localdeck 1.2.3 → 1.4.0

package/dist/{index-6r7h3h6p.js → index-316fp4p2.js}

@@ -3414,15 +3414,16 @@ function stopOrder(commands) {
 }
 
 // ../daemon/src/index.ts
-import fs10 from "node:fs";
+import fs11 from "node:fs";
 import crypto2 from "node:crypto";
 import path11 from "node:path";
 
 // ../daemon/src/api.ts
 import http5 from "node:http";
-import { timingSafeEqual, randomUUID } from "node:crypto";
+import { timingSafeEqual, randomBytes, randomUUID } from "node:crypto";
 
 // ../daemon/src/clean-urls.ts
+import fs3 from "node:fs";
 import http from "node:http";
 import path3 from "node:path";
 
@@ -3501,10 +3502,11 @@ import os2 from "node:os";
 import { promisify as promisify2 } from "node:util";
 var execute2 = promisify2(execFile2);
 var label = "dev.localdeck.port80";
-var destination = `/Library/LaunchDaemons/${label}.plist`;
+var SYSTEM_FORWARDER_PLIST = `/Library/LaunchDaemons/${label}.plist`;
+var destination = SYSTEM_FORWARDER_PLIST;
 var marker = "LocalDeck managed loopback relay v1";
 function forwarderPlist(user, port) {
-  if (!/^[a-zA-Z_][a-zA-Z0-9_-]*$/.test(user) || user === "root")
+  if (!/^[a-zA-Z_][a-zA-Z0-9_.-]*$/.test(user) || user === "root")
     throw new Error("Forwarding must run as a regular macOS user.");
   if (!Number.isInteger(port) || port < 1 || port > 65535 || port === 80)
     throw new Error("Invalid forwarding target port.");
@@ -3579,16 +3581,18 @@ class CleanUrls {
   platform;
   preferenceFile;
   configureSystem;
+  systemRelayInstalled;
   bridge;
   enabling;
   closed = false;
-  constructor(targetPort, identity, port = 80, platform = process.platform, preferenceFile = path3.join(HOME_DIR, "forwarder.json"), configureSystem = configureSystemForwarder) {
+  constructor(targetPort, identity, port = 80, platform = process.platform, preferenceFile = path3.join(HOME_DIR, "forwarder.json"), configureSystem = configureSystemForwarder, systemRelayInstalled = () => fs3.existsSync(SYSTEM_FORWARDER_PLIST)) {
     this.targetPort = targetPort;
     this.identity = identity;
     this.port = port;
     this.platform = platform;
     this.preferenceFile = preferenceFile;
     this.configureSystem = configureSystem;
+    this.systemRelayInstalled = systemRelayInstalled;
   }
   async status() {
     const ready = await new Promise((resolve) => {
@@ -3623,6 +3627,12 @@ class CleanUrls {
     if (this.closed)
       return { ready: false, error: "LocalDeck is shutting down." };
     const preference = this.preferenceFile;
+    const saved = readJson(preference, {});
+    if (saved.removed) {
+      if (options.automatic)
+        return { ready: false, error: "Clean URLs are turned off; enable them in the dashboard to use them again." };
+      writeJson(preference, { declined: saved.declined });
+    }
     if (this.platform === "win32" && options.install && this.port === 80 && !(options.automatic && readJson(preference, {}).declined)) {
       if (!this.bridge && (await this.status()).ready)
         return { ready: true };
@@ -3686,13 +3696,14 @@ class CleanUrls {
     if (this.enabling)
       return { ready: false, error: "Wait for the current setup to finish." };
     try {
-      if (this.platform === "darwin" || this.platform === "win32" && this.port === 80 && !this.bridge)
-        await this.configureSystem(this.targetPort(), true);
+      const hadBridge = Boolean(this.bridge);
       if (this.bridge) {
         await this.bridge.close();
         this.bridge = undefined;
       }
-      writeJson(this.preferenceFile, { declined: true });
+      if (this.platform === "darwin" ? this.systemRelayInstalled() : this.platform === "win32" && this.port === 80 && !hadBridge)
+        await this.configureSystem(this.targetPort(), true);
+      writeJson(this.preferenceFile, { declined: true, removed: true });
       return { ready: false, removed: true };
     } catch (error) {
       return { ready: false, error: error instanceof Error ? error.message : "Removal failed." };
@@ -3709,7 +3720,7 @@ class CleanUrls {
 }
 
 // ../daemon/src/api.ts
-import fs6 from "node:fs";
+import fs7 from "node:fs";
 import path7 from "node:path";
 
 // ../daemon/src/request-body.ts
@@ -3930,6 +3941,7 @@ function proxyRequest(req, res, target, hooks) {
 }
 function proxyUpgrade(req, socket, head, target, hooks) {
   const started = Date.now();
+  socket.on("error", () => socket.destroy());
   if (!target.upstreamReady) {
     socket.end(`HTTP/1.1 503 Service Unavailable\r
 Connection: close\r
@@ -3979,8 +3991,80 @@ Connection: close\r
 
 // ../daemon/src/projects.ts
 import { createHash } from "node:crypto";
-import fs3 from "node:fs";
+import fs4 from "node:fs";
 import path4 from "node:path";
+
+// ../daemon/src/ports.ts
+import net3 from "node:net";
+function canBind(port, host, required) {
+  return new Promise((resolve) => {
+    const srv = net3.createServer();
+    srv.once("error", (error) => resolve(!required && error.code !== "EADDRINUSE" && error.code !== "EACCES" ? undefined : false));
+    srv.listen({ port, host, exclusive: true }, () => srv.close(() => resolve(true)));
+  });
+}
+async function isPortFree(port, host) {
+  for (const candidate of host ? [host] : ["127.0.0.1", "::1", "0.0.0.0", "::"]) {
+    if (await canBind(port, candidate, candidate === (host ?? "127.0.0.1")) === false)
+      return false;
+  }
+  return true;
+}
+function getFreePort(host = "127.0.0.1") {
+  return new Promise((resolve, reject) => {
+    const srv = net3.createServer();
+    srv.once("error", reject);
+    srv.listen(0, host, () => {
+      const { port } = srv.address();
+      srv.close(() => resolve(port));
+    });
+  });
+}
+function serviceName(key) {
+  const separator = key.lastIndexOf(":");
+  return separator === -1 ? key : key.slice(separator + 1);
+}
+function rememberedPortFromFile(key, file) {
+  const map = readJson(file, {});
+  if (map[key] !== undefined)
+    return map[key];
+  const name = serviceName(key);
+  const hasOtherQualifiedKey = Object.keys(map).some((candidate) => candidate !== key && candidate.includes(":") && candidate.endsWith(`:${name}`));
+  return hasOtherQualifiedKey ? undefined : map[name];
+}
+function rememberPort(name, port, file = PORTS_FILE) {
+  const map = readJson(file, {});
+  map[name] = port;
+  writeJson(file, map);
+}
+function forgetProjectPorts(projectId, file = PORTS_FILE) {
+  const map = readJson(file, {});
+  const kept = Object.fromEntries(Object.entries(map).filter(([key]) => !key.startsWith(`${projectId}:`)));
+  if (Object.keys(kept).length !== Object.keys(map).length)
+    writeJson(file, kept);
+}
+async function pickStablePort(name, taken, start = 4000, end = 4999, file = PORTS_FILE) {
+  const map = readJson(file, {});
+  const remembered = rememberedPortFromFile(name, file);
+  if (remembered) {
+    if (taken.has(remembered) || !await isPortFree(remembered)) {
+      throw new Error(`remembered stable port ${remembered} for "${name}" is already in use; stop the conflicting listener or explicitly choose a different port`);
+    }
+    return remembered;
+  }
+  const bareName = serviceName(name);
+  const usingLegacy = map[name] === undefined && remembered === map[bareName];
+  const reserved = new Set(Object.entries(map).filter(([n]) => n !== name && !(usingLegacy && n === bareName)).map(([, p]) => p));
+  for (let p = start;p <= end; p++) {
+    if (taken.has(p) || reserved.has(p))
+      continue;
+    if (await isPortFree(p))
+      return p;
+  }
+  throw new Error(`no free port between ${start} and ${end}`);
+}
+
+// ../daemon/src/projects.ts
 class ProjectError extends Error {
   code;
   constructor(code, message) {
@@ -3991,15 +4075,17 @@ class ProjectError extends Error {
 
 class ProjectRegistry {
   catalogFile;
+  portsFile;
   now;
   projects;
-  constructor({ catalogFile = PROJECTS_FILE, now = Date.now } = {}) {
+  constructor({ catalogFile = PROJECTS_FILE, portsFile = PORTS_FILE, now = Date.now } = {}) {
     this.catalogFile = catalogFile;
+    this.portsFile = portsFile;
     this.now = now;
     this.projects = this.readCatalog();
   }
   remember(file, now = this.now()) {
-    const realFile = fs3.realpathSync(file);
+    const realFile = fs4.realpathSync(file);
     const config = loadProjectFile(realFile);
     const id = projectId(realFile);
     const name = path4.basename(path4.dirname(realFile));
@@ -4039,13 +4125,13 @@ class ProjectRegistry {
       return { ...project, available: false, error: errorMessage(error), commands: [] };
     }
   }
-  resolve(projectId, serviceName) {
+  resolve(projectId, serviceName2) {
     const details = this.details(projectId);
     if (!details.available)
       throw new ProjectError("invalid", details.error);
-    const command = details.commands.find((candidate) => candidate.name === serviceName.toLowerCase());
+    const command = details.commands.find((candidate) => candidate.name === serviceName2.toLowerCase());
     if (!command)
-      throw new ProjectError("not_found", `Project ${projectId} has no service named ${serviceName}`);
+      throw new ProjectError("not_found", `Project ${projectId} has no service named ${serviceName2}`);
     return command;
   }
   forget(projectId, activeKeys) {
@@ -4055,6 +4141,7 @@ class ProjectRegistry {
     }
     this.projects = this.projects.filter((project) => project.id !== projectId);
     this.persist();
+    forgetProjectPorts(projectId, this.portsFile);
   }
   refresh(projectId) {
     return this.details(projectId);
@@ -4102,34 +4189,34 @@ class ProjectRegistry {
     project.configNickname = nickname || undefined;
     return this.updateNickname(projectId, "");
   }
-  updateDependencies(projectId, serviceName, after) {
+  updateDependencies(projectId, serviceName2, after) {
     const project = this.require(projectId);
     try {
-      updateProjectDependencies(project.file, serviceName, after);
+      updateProjectDependencies(project.file, serviceName2, after);
       return this.details(projectId);
     } catch (error) {
       throw new ProjectError("invalid", errorMessage(error));
     }
   }
-  updateServiceConfig(projectId, serviceName, settings) {
+  updateServiceConfig(projectId, serviceName2, settings) {
     const project = this.require(projectId);
     try {
-      updateProjectServiceConfig(project.file, serviceName, settings);
+      updateProjectServiceConfig(project.file, serviceName2, settings);
       return this.details(projectId);
     } catch (error) {
       throw new ProjectError("invalid", errorMessage(error));
     }
   }
   readCatalog() {
-    if (!fs3.existsSync(this.catalogFile))
+    if (!fs4.existsSync(this.catalogFile))
       return [];
     try {
-      const parsed = JSON.parse(fs3.readFileSync(this.catalogFile, "utf8"));
+      const parsed = JSON.parse(fs4.readFileSync(this.catalogFile, "utf8"));
       if (!isCatalog(parsed))
         throw new Error("invalid project catalog");
       return parsed.projects;
     } catch {
-      fs3.renameSync(this.catalogFile, this.nextCorruptFile());
+      fs4.renameSync(this.catalogFile, this.nextCorruptFile());
       return [];
     }
   }
@@ -4142,7 +4229,7 @@ class ProjectRegistry {
     const base = `${this.catalogFile}.corrupt-${this.now()}`;
     let candidate = base;
     let suffix = 2;
-    while (fs3.existsSync(candidate))
+    while (fs4.existsSync(candidate))
       candidate = `${base}-${suffix++}`;
     return candidate;
   }
@@ -4164,7 +4251,7 @@ class ProjectRegistry {
     }
   }
   load(project) {
-    if (!fs3.existsSync(project.file))
+    if (!fs4.existsSync(project.file))
       throw new Error(`${project.file} does not exist`);
     const loaded = loadProjectFile(project.file);
     if (loaded.nickname)
@@ -4250,72 +4337,59 @@ async function waitForShare(url, nonce, signal, options = {}) {
 // ../daemon/src/share.ts
 import crypto from "node:crypto";
 import { spawn } from "node:child_process";
-
-// ../daemon/src/ports.ts
-import net3 from "node:net";
-function isPortFree(port, host = "127.0.0.1") {
-  return new Promise((resolve) => {
-    const srv = net3.createServer();
-    srv.once("error", () => resolve(false));
-    srv.listen(port, host, () => srv.close(() => resolve(true)));
-  });
-}
-function getFreePort(host = "127.0.0.1") {
-  return new Promise((resolve, reject) => {
-    const srv = net3.createServer();
-    srv.once("error", reject);
-    srv.listen(0, host, () => {
-      const { port } = srv.address();
-      srv.close(() => resolve(port));
-    });
-  });
-}
-function serviceName(key) {
-  const separator = key.lastIndexOf(":");
-  return separator === -1 ? key : key.slice(separator + 1);
-}
-function rememberedPortFromFile(key, file) {
-  const map = readJson(file, {});
-  if (map[key] !== undefined)
-    return map[key];
-  const name = serviceName(key);
-  const hasOtherQualifiedKey = Object.keys(map).some((candidate) => candidate !== key && candidate.includes(":") && candidate.endsWith(`:${name}`));
-  return hasOtherQualifiedKey ? undefined : map[name];
-}
-function rememberPort(name, port, file = PORTS_FILE) {
-  const map = readJson(file, {});
-  map[name] = port;
-  writeJson(file, map);
-}
-async function pickStablePort(name, taken, start = 4000, end = 4999, file = PORTS_FILE) {
-  const map = readJson(file, {});
-  const remembered = rememberedPortFromFile(name, file);
-  if (remembered) {
-    if (taken.has(remembered) || !await isPortFree(remembered)) {
-      throw new Error(`remembered stable port ${remembered} for "${name}" is already in use; stop the conflicting listener or explicitly choose a different port`);
-    }
-    return remembered;
-  }
-  const bareName = serviceName(name);
-  const usingLegacy = map[name] === undefined && remembered === map[bareName];
-  const reserved = new Set(Object.entries(map).filter(([n]) => n !== name && !(usingLegacy && n === bareName)).map(([, p]) => p));
-  for (let p = start;p <= end; p++) {
-    if (taken.has(p) || reserved.has(p))
-      continue;
-    if (await isPortFree(p))
-      return p;
-  }
-  throw new Error(`no free port between ${start} and ${end}`);
-}
-
-// ../daemon/src/share.ts
 class ShareStartError extends Error {
 }
 var COOKIE = "localdeck_share";
 var URL_RE = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/;
 var MAX_LOGIN_BYTES = 65536;
 var DEFAULT_CLEANUP_AFTER_MS = 1000;
-function loginPage(name, wrong) {
+var HTML_ESCAPES = { "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" };
+function escapeHtml(value) {
+  return value.replace(/[&<>"']/g, (char) => HTML_ESCAPES[char]);
+}
+
+class LoginThrottle {
+  now;
+  clients = new Map;
+  all = [];
+  windowMs;
+  perClient;
+  perShare;
+  constructor(now = Date.now, limits = {}) {
+    this.now = now;
+    this.windowMs = limits.windowMs ?? 15 * 60000;
+    this.perClient = limits.perClient ?? 10;
+    this.perShare = limits.perShare ?? 100;
+  }
+  retryAfterSeconds(client) {
+    this.prune();
+    const own = this.clients.get(client) ?? [];
+    const blockedUntil = Math.max(own.length >= this.perClient ? own[own.length - this.perClient] + this.windowMs : 0, this.all.length >= this.perShare ? this.all[this.all.length - this.perShare] + this.windowMs : 0);
+    return blockedUntil ? Math.max(1, Math.ceil((blockedUntil - this.now()) / 1000)) : 0;
+  }
+  fail(client) {
+    const at = this.now();
+    this.all.push(at);
+    this.clients.set(client, [...this.clients.get(client) ?? [], at]);
+  }
+  prune() {
+    const cutoff = this.now() - this.windowMs;
+    this.all = this.all.filter((at) => at > cutoff);
+    for (const [client, times] of this.clients) {
+      const recent = times.filter((at) => at > cutoff);
+      if (recent.length)
+        this.clients.set(client, recent);
+      else
+        this.clients.delete(client);
+    }
+  }
+}
+function loginClient(req) {
+  const forwarded = req.headers["cf-connecting-ip"];
+  return typeof forwarded === "string" && forwarded || req.socket.remoteAddress || "unknown";
+}
+function loginPage(rawName, wrong, retryAfter = 0) {
+  const name = escapeHtml(rawName);
   return `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width">
 <title>${name} — LocalDeck</title>
 <style>body{font:15px/1.5 system-ui;margin:0;display:grid;place-items:center;height:100vh;background:#0f1115;color:#e6e8ef}
@@ -4323,7 +4397,7 @@ form{background:#171a21;padding:28px;border-radius:12px;width:300px}input{width:
 button{width:100%;padding:10px;border:0;border-radius:8px;background:#5b8cff;color:#fff;font-weight:600}.e{color:#ff7b7b;margin:0 0 8px}</style>
 <form method="post" action="/__localdeck/login"><h2 style="margin:0 0 6px;font-weight:600">${name}</h2>
 <p style="margin:0;opacity:.7">Shared with LocalDeck. Enter the password you were given.</p>
-${wrong ? '<p class="e">Wrong password.</p>' : ""}
+${retryAfter ? `<p class="e">Too many attempts. Try again in ${Math.ceil(retryAfter / 60)} min.</p>` : wrong ? '<p class="e">Wrong password.</p>' : ""}
 <input type="password" name="password" autofocus placeholder="Password"><button>Open</button></form>`;
 }
 function parseCookies(header) {
@@ -4338,6 +4412,25 @@ function parseCookies(header) {
   }
   return out;
 }
+function stripShareCookie(req) {
+  const strip = (value) => value.split(";").map((part) => part.trim()).filter((part) => part && part.split("=", 1)[0] !== COOKIE).join("; ");
+  if (typeof req.headers.cookie === "string") {
+    const cookie = strip(req.headers.cookie);
+    if (cookie)
+      req.headers.cookie = cookie;
+    else
+      delete req.headers.cookie;
+  }
+  const raw = [];
+  for (let i = 0;i + 1 < req.rawHeaders.length; i += 2) {
+    const name = req.rawHeaders[i];
+    const isCookie = name.toLowerCase() === "cookie";
+    const value = isCookie ? strip(req.rawHeaders[i + 1]) : req.rawHeaders[i + 1];
+    if (value || !isCookie)
+      raw.push(name, value);
+  }
+  req.rawHeaders.splice(0, req.rawHeaders.length, ...raw);
+}
 function passwordsMatch(given, expected) {
   const a = Buffer.from(given);
   const b = Buffer.from(expected);
@@ -4418,7 +4511,8 @@ class ShareManager {
     const startupSignal = AbortSignal.any([signal, deadline, disconnected.signal]);
     const gatePort = await getFreePort();
     signal.throwIfAborted();
-    const authed = (req) => !password || parseCookies(req.headers.cookie)[COOKIE] === token;
+    const authed = (req) => !password || passwordsMatch(parseCookies(req.headers.cookie)[COOKIE] ?? "", token);
+    const throttle = new LoginThrottle;
     let publicHost;
     let confirmPublicRequest;
     const publicRequest = new Promise((resolve) => {
@@ -4437,6 +4531,13 @@ class ShareManager {
         return;
       }
       if (password && req.url === "/__localdeck/login" && req.method === "POST") {
+        const client = loginClient(req);
+        const retryAfter = throttle.retryAfterSeconds(client);
+        if (retryAfter) {
+          res.writeHead(429, { "content-type": "text/html; charset=utf-8", "retry-after": String(retryAfter) }).end(loginPage(name, false, retryAfter));
+          req.resume();
+          return;
+        }
         let body = "";
         let bytes = 0;
         let tooLarge = false;
@@ -4464,8 +4565,10 @@ class ShareManager {
               this.registry.setShare(key, s.info);
             }
             res.writeHead(303, { "set-cookie": `${COOKIE}=${token}; Path=/; HttpOnly; SameSite=Lax; Secure`, location: "/" }).end();
-          } else
+          } else {
+            throttle.fail(client);
             res.writeHead(401, { "content-type": "text/html; charset=utf-8" }).end(loginPage(name, true));
+          }
         });
         return;
       }
@@ -4473,12 +4576,14 @@ class ShareManager {
         res.writeHead(401, { "content-type": "text/html; charset=utf-8" }).end(loginPage(name, false));
         return;
       }
+      stripShareCookie(req);
       proxyRequest(req, res, target, { responseBodies: this.store.responseBodies, onRequest: (r) => this.store.request(r) });
     });
     gate.on("upgrade", (req, socket, head) => {
       const target = this.registry.target(key, "share");
       if (!target || !authed(req))
         return socket.destroy();
+      stripShareCookie(req);
       proxyUpgrade(req, socket, head, target, { responseBodies: this.store.responseBodies, onRequest: (r) => this.store.request(r) });
     });
     const sockets = new Set;
@@ -4838,10 +4943,13 @@ function normalizeHost(host) {
   const normalized = host.replace(/^\[|\]$/g, "");
   return normalized === "*" || normalized === "0.0.0.0" || normalized === "::" || normalized === "" ? "*" : normalized;
 }
+function reachable(listener) {
+  return listener.host === "*" || listener.host === "127.0.0.1" || listener.host === "::1";
+}
 function chooseUpstream(listeners, assignedPort) {
   let lowest;
   for (const listener of listeners) {
-    if (IGNORED_PORTS.has(listener.port))
+    if (IGNORED_PORTS.has(listener.port) || !reachable(listener))
       continue;
     if (listener.port === assignedPort)
       return listener;
@@ -4850,6 +4958,16 @@ function chooseUpstream(listeners, assignedPort) {
   }
   return lowest;
 }
+function unreachableListenerMessage(listeners) {
+  const candidates = listeners.filter((listener2) => !IGNORED_PORTS.has(listener2.port));
+  if (candidates.some(reachable))
+    return;
+  const listener = candidates[0];
+  if (!listener)
+    return;
+  const address = listener.host.includes(":") ? `[${listener.host}]:${listener.port}` : `${listener.host}:${listener.port}`;
+  return `the process is listening only on ${address}, which LocalDeck cannot reach. Bind it to localhost (127.0.0.1) or all interfaces (0.0.0.0) instead.`;
+}
 function connectHost(listener) {
   return listener.host === "*" ? "127.0.0.1" : listener.host;
 }
@@ -4940,7 +5058,7 @@ function stripAnsi(value) {
 }
 
 // ../daemon/src/diagnostics.ts
-import fs4 from "node:fs";
+import fs5 from "node:fs";
 import os3 from "node:os";
 import path5 from "node:path";
 function redactDiagnostic(text, secrets = []) {
@@ -4964,10 +5082,10 @@ function environmentValues(directory) {
   for (const name of [".env", ".env.local", ".env.development", ".env.development.local"]) {
     const file = path5.join(directory, name);
     try {
-      const stat = fs4.lstatSync(file);
+      const stat = fs5.lstatSync(file);
       if (!stat.isFile() || stat.size > 65536)
         continue;
-      const text = fs4.readFileSync(file, "utf8");
+      const text = fs5.readFileSync(file, "utf8");
       for (const line of text.split(/\r?\n/)) {
         const match = line.match(/^\s*(?:export\s+)?([A-Za-z_][\w]*)\s*=\s*(.*)$/);
         if (match) {
@@ -5056,7 +5174,7 @@ function replayRequest(service, record, options = {}) {
 }
 
 // ../daemon/src/project-secrets.ts
-import fs5 from "node:fs";
+import fs6 from "node:fs";
 import path6 from "node:path";
 var ID = /^[a-f0-9]{16}$/;
 var NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
@@ -5079,7 +5197,7 @@ function createProjectSecretStore(home = HOME_DIR) {
     const file = secretPath(projectId2);
     let text;
     try {
-      text = fs5.readFileSync(file, "utf8");
+      text = fs6.readFileSync(file, "utf8");
     } catch (error) {
       if (error.code === "ENOENT")
         return Object.create(null);
@@ -5106,9 +5224,9 @@ function createProjectSecretStore(home = HOME_DIR) {
   }
   function write(projectId2, values) {
     const file = secretPath(projectId2);
-    fs5.mkdirSync(directory, { recursive: true, mode: 448 });
+    fs6.mkdirSync(directory, { recursive: true, mode: 448 });
     if (process.platform !== "win32")
-      fs5.chmodSync(directory, 448);
+      fs6.chmodSync(directory, 448);
     writePrivateJson(file, values);
   }
   function listProjectSecrets(projectId2) {
@@ -5384,6 +5502,7 @@ function createApiServer(deps) {
   });
   attach.on("connection", (ws) => handleAttach(ws, deps));
   server.on("upgrade", (req, socket, head) => {
+    socket.on("error", () => socket.destroy());
     const svc = serviceFromHost(req.headers.host);
     if (svc) {
       const resolved = registry.resolveHostname(svc);
@@ -5699,11 +5818,16 @@ async function handleApi(req, res, url, parts, deps) {
         requireMutationAllowed(deps);
         if (!body || typeof body !== "object" || Array.isArray(body))
           throw new HttpError(400, "request body must be a JSON object");
-        const password = body.password;
+        const { password, public: isPublic } = body;
         if (password !== undefined && typeof password !== "string")
           throw new HttpError(400, "password must be a string");
+        if (isPublic !== undefined && typeof isPublic !== "boolean")
+          throw new HttpError(400, "public must be a boolean");
+        if (isPublic && password)
+          throw new HttpError(400, "a public link cannot have a password");
+        const sharePassword = isPublic ? undefined : password || randomBytes(12).toString("base64url");
         try {
-          return json(res, 200, await shares.start(key, password || undefined, { exclusive: createShare }));
+          return json(res, 200, await shares.start(key, sharePassword, { exclusive: createShare }));
         } catch (error) {
           if (error instanceof ShareStartError)
             return json(res, 503, { error: error.message });
@@ -5730,14 +5854,17 @@ function serveStatic(pathname, res, dir) {
   let file = path7.join(dir, path7.normalize(pathname).replace(/^(\.\.[/\\])+/, ""));
   if (!file.startsWith(dir))
     file = path7.join(dir, "index.html");
-  if (!fs6.existsSync(file) || fs6.statSync(file).isDirectory())
+  if (!fs7.existsSync(file) || fs7.statSync(file).isDirectory())
     file = path7.join(dir, "index.html");
   const hashedAsset = path7.dirname(file) === path7.join(dir, "assets") && /-[A-Za-z0-9_-]{8,}\.[a-z0-9]+$/i.test(path7.basename(file));
   res.writeHead(200, {
     "content-type": MIME[path7.extname(file)] ?? "application/octet-stream",
-    "cache-control": hashedAsset ? "public, max-age=31536000, immutable" : "no-cache"
+    "cache-control": hashedAsset ? "public, max-age=31536000, immutable" : "no-cache",
+    "x-frame-options": "DENY",
+    "content-security-policy": "frame-ancestors 'none'",
+    "x-content-type-options": "nosniff"
   });
-  fs6.createReadStream(file).pipe(res);
+  fs7.createReadStream(file).pipe(res);
 }
 function handleAttach(ws, deps) {
   const { registry, store } = deps;
@@ -5968,7 +6095,7 @@ function buildRegistration(message, deps) {
 }
 function requireDirectory(cwd) {
   try {
-    if (!fs6.statSync(cwd).isDirectory())
+    if (!fs7.statSync(cwd).isDirectory())
       throw new Error("not a directory");
   } catch {
     throw new Error(`working directory does not exist or is not a directory: ${cwd}`);
@@ -6243,8 +6370,12 @@ class Registry {
       });
       await new Promise((resolve, reject) => {
         entry.server.once("error", reject);
-        entry.server.listen(stablePort, "127.0.0.1", resolve);
+        entry.server.listen(stablePort, "127.0.0.1", () => {
+          entry.server.off("error", reject);
+          resolve();
+        });
       });
+      entry.server.on("error", (error) => this.store.log({ ts: Date.now(), service: key, stream: "system", line: `LocalDeck: proxy listener error: ${error.message}` }));
       rememberPort(key, stablePort);
       this.store.log({ ts: Date.now(), service: key, stream: "system", line: `LocalDeck: ${name} on http://localhost:${stablePort} → waiting for the process to open a port (assigned PORT=${opts.upstreamPort})` });
       this.startHealthPolling(entry);
@@ -6433,7 +6564,7 @@ class Registry {
 }
 
 // ../daemon/src/store.ts
-import fs7 from "node:fs";
+import fs8 from "node:fs";
 
 // ../daemon/src/history.ts
 function isAfterHistoryBoundary(id, boundary) {
@@ -6524,17 +6655,33 @@ var ERROR_RE = /\b(error|exception|unhandled|fatal|EADDRINUSE|ECONNREFUSED)\b/i;
 
 class Ring {
   cap;
+  maxBytes;
   buf;
+  sizes;
   size = 0;
   next = 0;
-  constructor(cap) {
+  bytes = 0;
+  constructor(cap, maxBytes = Infinity) {
     this.cap = cap;
+    this.maxBytes = maxBytes;
     this.buf = new Array(cap);
+    this.sizes = new Array(cap).fill(0);
   }
-  push(v) {
+  push(v, bytes = 0) {
+    if (this.size === this.cap)
+      this.bytes -= this.sizes[this.next];
     this.buf[this.next] = v;
+    this.sizes[this.next] = bytes;
+    this.bytes += bytes;
     this.next = (this.next + 1) % this.cap;
     this.size = Math.min(this.size + 1, this.cap);
+    while (this.bytes > this.maxBytes && this.size > 1) {
+      const oldest = (this.next - this.size + this.cap) % this.cap;
+      this.bytes -= this.sizes[oldest];
+      this.buf[oldest] = undefined;
+      this.sizes[oldest] = 0;
+      this.size--;
+    }
   }
   last(n) {
     const count = Math.min(Math.max(0, n), this.size);
@@ -6547,8 +6694,10 @@ class Ring {
   }
   clear() {
     this.buf.fill(undefined);
+    this.sizes.fill(0);
     this.size = 0;
     this.next = 0;
+    this.bytes = 0;
   }
 }
 function emptyStats() {
@@ -6566,17 +6715,19 @@ class Store extends EventEmitter {
   closeAfterMs;
   streamFactory;
   maxFileBytes;
+  maxHistoryBytes;
   constructor(options = {}) {
     super();
     this.logsDir = options.logsDir ?? LOGS_DIR;
     this.daemonStartedAt = options.daemonStartedAt ?? Date.now();
     this.closeAfterMs = options.closeAfterMs ?? DEFAULT_CLOSE_AFTER_MS;
-    this.streamFactory = options.streamFactory ?? ((file, streamOptions) => fs7.createWriteStream(file, streamOptions));
+    this.streamFactory = options.streamFactory ?? ((file, streamOptions) => fs8.createWriteStream(file, streamOptions));
     this.maxFileBytes = Math.max(1, options.maxFileBytes ?? 5 * 1024 * 1024);
+    this.maxHistoryBytes = Math.max(1, options.maxHistoryBytes ?? 8 * 1024 * 1024);
     if (options.logsDir === undefined)
       ensureDirs();
     else
-      fs7.mkdirSync(this.logsDir, { recursive: true });
+      fs8.mkdirSync(this.logsDir, { recursive: true });
   }
   nextId() {
     return `${this.daemonStartedAt.toString(36)}-${(++this.sequence).toString(36)}`;
@@ -6596,12 +6747,12 @@ class Store extends EventEmitter {
   }
   loadHistory(file, type, service, ring, legacyService, budget = this.maxFileBytes) {
     const marker2 = `${this.historyFile(service, type)}.cleared`;
-    const boundary = fs7.existsSync(marker2) ? fs7.readFileSync(marker2, "utf8") : undefined;
+    const boundary = fs8.existsSync(marker2) ? fs8.readFileSync(marker2, "utf8") : undefined;
     let fd;
     let size;
     try {
-      fd = fs7.openSync(file, "r");
-      size = fs7.fstatSync(fd).size;
+      fd = fs8.openSync(file, "r");
+      size = fs8.fstatSync(fd).size;
     } catch (error) {
       if (error.code === "ENOENT")
         return 0;
@@ -6612,9 +6763,9 @@ class Store extends EventEmitter {
     const bytes = Buffer.alloc(count);
     try {
       if (count)
-        fs7.readSync(fd, bytes, 0, count, start);
+        fs8.readSync(fd, bytes, 0, count, start);
     } finally {
-      fs7.closeSync(fd);
+      fs8.closeSync(fd);
     }
     let lines = bytes.toString("binary").split(`
 `);
@@ -6635,7 +6786,7 @@ class Store extends EventEmitter {
             if (input.service === service || input.service === legacyService) {
               const id = typeof input.id === "string" ? input.id : this.compatibilityId(type, service, offset, serialized);
               if (!boundary || isAfterHistoryBoundary(id, boundary))
-                ring.push({ ...input, service, id });
+                ring.push({ ...input, service, id }, serialized.length);
             }
           }
         } catch {}
@@ -6652,8 +6803,8 @@ class Store extends EventEmitter {
       const legacyLogFile = this.legacyHistoryFile(service, "log");
       const legacyReqFile = this.legacyHistoryFile(service, "request");
       b = {
-        logs: new Ring(LOG_RING),
-        requests: new Ring(REQ_RING),
+        logs: new Ring(LOG_RING, this.maxHistoryBytes),
+        requests: new Ring(REQ_RING, this.maxHistoryBytes),
         stats: emptyStats(),
         latencyTotal: 0,
         logFile: undefined,
@@ -6677,14 +6828,14 @@ class Store extends EventEmitter {
       const rotatedReq = `${reqFile}.1`;
       const logCurrentSize = (() => {
         try {
-          return fs7.statSync(logFile).size;
+          return fs8.statSync(logFile).size;
         } catch {
           return 0;
         }
       })();
       const reqCurrentSize = (() => {
         try {
-          return fs7.statSync(reqFile).size;
+          return fs8.statSync(reqFile).size;
         } catch {
           return 0;
         }
@@ -6714,11 +6865,12 @@ class Store extends EventEmitter {
   log(log) {
     const record = { ...log, id: this.nextId() };
     const b = this.bucket(record.service);
-    b.logs.push(record);
+    const serialized = JSON.stringify(record);
+    b.logs.push(record, serialized.length);
     b.stats.logLines++;
     if (record.stream === "stderr" || ERROR_RE.test(record.line))
       b.stats.errorLines++;
-    this.persist(record.service, b, b.logFile, JSON.stringify(record) + `
+    this.persist(record.service, b, b.logFile, serialized + `
 `);
     this.emitEvent({ type: "log", log: record });
     return record;
@@ -6726,7 +6878,8 @@ class Store extends EventEmitter {
   request(request) {
     const record = { ...request, id: this.nextId() };
     const b = this.bucket(record.service);
-    b.requests.push(record);
+    const serialized = JSON.stringify(record);
+    b.requests.push(record, serialized.length);
     const s = b.stats;
     s.requests++;
     s.lastRequestAt = record.ts;
@@ -6740,7 +6893,7 @@ class Store extends EventEmitter {
       s.ok++;
     b.latencyTotal += record.durationMs;
     s.avgLatencyMs = Math.round(b.latencyTotal / s.requests);
-    this.persist(record.service, b, b.reqFile, JSON.stringify(record) + `
+    this.persist(record.service, b, b.reqFile, serialized + `
 `);
     this.emitEvent({ type: "request", request: record });
     return record;
@@ -6753,7 +6906,7 @@ class Store extends EventEmitter {
   }
   historyBoundary(service, kind) {
     const marker2 = `${this.historyFile(service, kind === "logs" ? "log" : "request")}.cleared`;
-    return fs7.existsSync(marker2) ? fs7.readFileSync(marker2, "utf8") : undefined;
+    return fs8.existsSync(marker2) ? fs8.readFileSync(marker2, "utf8") : undefined;
   }
   async clearHistory(service, kind) {
     if (this.closing)
@@ -6762,15 +6915,15 @@ class Store extends EventEmitter {
     const state = kind === "logs" ? bucket.logFile : bucket.reqFile;
     const beforeId = this.nextId();
     const marker2 = `${state.file}.cleared`;
-    fs7.writeFileSync(`${marker2}.tmp`, beforeId, { mode: 384 });
-    fs7.renameSync(`${marker2}.tmp`, marker2);
+    fs8.writeFileSync(`${marker2}.tmp`, beforeId, { mode: 384 });
+    fs8.renameSync(`${marker2}.tmp`, marker2);
     bucket[kind].clear();
     if (kind === "requests")
       this.responseBodies.clear(service);
     const operation = state.queue.then(async () => {
       await this.closeStream(state.stream);
-      fs7.writeFileSync(state.file, "", { mode: 384 });
-      fs7.rmSync(`${state.file}.1`, { force: true });
+      fs8.writeFileSync(state.file, "", { mode: 384 });
+      fs8.rmSync(`${state.file}.1`, { force: true });
       state.bytes = 0;
       state.stream = this.streamFactory(state.file, { flags: "a", mode: 384, highWaterMark: 65536 });
       state.disabled = false;
@@ -6857,12 +7010,12 @@ class Store extends EventEmitter {
       } });
     }
     try {
-      if (fs7.existsSync(file))
-        fs7.chmodSync(file, 384);
+      if (fs8.existsSync(file))
+        fs8.chmodSync(file, 384);
     } catch {}
     const state = { stream, file, bytes: (() => {
       try {
-        return fs7.statSync(file).size;
+        return fs8.statSync(file).size;
       } catch {
         return 0;
       }
@@ -6936,8 +7089,8 @@ class Store extends EventEmitter {
     }
     const rotated = `${state.file}.1`;
     try {
-      fs7.rmSync(rotated, { force: true });
-      fs7.renameSync(state.file, rotated);
+      fs8.rmSync(rotated, { force: true });
+      fs8.renameSync(state.file, rotated);
     } catch {
       state.disabled = true;
       this.reportPersistenceFailure(service, bucket, "history rotation");
@@ -6945,7 +7098,7 @@ class Store extends EventEmitter {
     }
     state.stream = this.streamFactory(state.file, { flags: "a", mode: 384, highWaterMark: 65536 });
     try {
-      fs7.chmodSync(state.file, 384);
+      fs8.chmodSync(state.file, 384);
     } catch {}
     state.bytes = 0;
     state.stream.on("error", () => {
@@ -6992,7 +7145,7 @@ function settlesWithin2(promise, timeoutMs) {
 // ../daemon/src/supervisor.ts
 import { spawn as spawn3 } from "node:child_process";
 import path10 from "node:path";
-import fs9 from "node:fs";
+import fs10 from "node:fs";
 
 // ../daemon/src/startup-guidance.ts
 function startupGuidance(message) {
@@ -7017,7 +7170,7 @@ function startupGuidance(message) {
 }
 
 // ../daemon/src/port-environment.ts
-import fs8 from "node:fs";
+import fs9 from "node:fs";
 import path9 from "node:path";
 function inferPortEnvironment(command, cwd, port) {
   const visited = new Set;
@@ -7121,7 +7274,7 @@ function shellWords(command) {
 }
 function manifest(directory) {
   try {
-    const value = JSON.parse(fs8.readFileSync(path9.join(directory, "package.json"), "utf8"));
+    const value = JSON.parse(fs9.readFileSync(path9.join(directory, "package.json"), "utf8"));
     return value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
   } catch {
     return;
@@ -7145,7 +7298,7 @@ function workspaceDirectory(root, selector) {
       const next = [];
       for (const candidate of candidates) {
         try {
-          for (const entry of fs8.readdirSync(candidate, { withFileTypes: true })) {
+          for (const entry of fs9.readdirSync(candidate, { withFileTypes: true })) {
             if (entry.isDirectory() && !["node_modules", ".git"].includes(entry.name) && matcher.test(entry.name))
               next.push(path9.join(candidate, entry.name));
             if (next.length > 100)
@@ -7639,7 +7792,7 @@ class ProcessSupervisor {
       throw new ProjectError("invalid", project.error);
     const cwd = command.cwd ? path10.resolve(project.directory, command.cwd) : project.directory;
     try {
-      if (!fs9.statSync(cwd).isDirectory())
+      if (!fs10.statSync(cwd).isDirectory())
         throw new Error("not a directory");
     } catch {
       throw new ProjectError("invalid", `configured working directory does not exist or is not a directory: ${cwd}`);
@@ -8002,6 +8155,7 @@ class ProcessSupervisor {
   }
   scheduleDetection(managed, assignedPort) {
     let reported;
+    let unreachable;
     let idle = 0;
     const tick = async () => {
       if (this.active.get(managed.key) !== managed || managed.child.exitCode !== null || managed.child.signalCode)
@@ -8009,6 +8163,14 @@ class ProcessSupervisor {
       try {
         const listeners = await listeningPorts(await processTree(managed.child.pid));
         const listener = chooseUpstream(listeners, assignedPort);
+        const problem = listener ? undefined : unreachableListenerMessage(listeners);
+        if (problem && problem !== unreachable) {
+          this.store.log({ ts: Date.now(), service: managed.key, stream: "system", line: `LocalDeck: ${problem}` });
+          this.setLastError(managed.key, problem);
+        } else if (listener && unreachable && this.registry.get(managed.key)?.lastError === unreachable) {
+          this.setLastError(managed.key, undefined);
+        }
+        unreachable = problem;
         if (listener) {
           const host = connectHost(listener);
           const target = `${host}:${listener.port}`;
@@ -8148,7 +8310,7 @@ async function waitForProcessGroupExit(groupId, timeoutMs) {
   return true;
 }
 // ../daemon/package.json
-var version = "1.2.3";
+var version = "1.4.0";
 
 // ../daemon/src/index.ts
 var VERSION = version;
@@ -8226,16 +8388,16 @@ async function startDaemon(opts = {}) {
         if (stateCleanup === "failed-write") {
           if (!stateWriteAttempted)
             return;
-          fs10.rmSync(`${stateFile}.${process.pid}.tmp`, { force: true });
+          fs11.rmSync(`${stateFile}.${process.pid}.tmp`, { force: true });
           if (priorState)
             restorePrivateState(stateFile, priorState.contents, priorState.mode);
           else
-            fs10.rmSync(stateFile, { force: true });
+            fs11.rmSync(stateFile, { force: true });
           return;
         }
         const state = readJson(stateFile, null);
         if (state?.pid === process.pid)
-          fs10.unlinkSync(stateFile);
+          fs11.unlinkSync(stateFile);
       }));
       return errors;
     })();
@@ -8255,11 +8417,15 @@ async function startDaemon(opts = {}) {
   try {
     await new Promise((resolve, reject) => {
       server.once("error", reject);
-      server.listen(apiPort, "127.0.0.1", resolve);
+      server.listen(apiPort, "127.0.0.1", () => {
+        server.off("error", reject);
+        resolve();
+      });
     });
-    if (fs10.existsSync(stateFile)) {
-      const stat = fs10.statSync(stateFile);
-      priorState = { contents: fs10.readFileSync(stateFile), mode: stat.mode & 511 };
+    server.on("error", (error) => console.error(`LocalDeck: API server error: ${error.message}`));
+    if (fs11.existsSync(stateFile)) {
+      const stat = fs11.statSync(stateFile);
+      priorState = { contents: fs11.readFileSync(stateFile), mode: stat.mode & 511 };
     }
     stateWriteAttempted = true;
     dependencies.writePrivateState(stateFile, {
@@ -8280,9 +8446,9 @@ async function startDaemon(opts = {}) {
 }
 function restorePrivateState(file, contents, mode) {
   const temporary = `${file}.${process.pid}.restore.tmp`;
-  fs10.writeFileSync(temporary, contents, { mode });
-  fs10.chmodSync(temporary, mode);
-  fs10.renameSync(temporary, file);
+  fs11.writeFileSync(temporary, contents, { mode });
+  fs11.chmodSync(temporary, mode);
+  fs11.renameSync(temporary, file);
 }
 function toError3(error) {
   return error instanceof Error ? error : new Error(String(error));
@@ -8303,7 +8469,7 @@ function createOperationTracker() {
 async function findDaemon(stateFile = STATE_FILE) {
   let state;
   try {
-    state = JSON.parse(fs10.readFileSync(stateFile, "utf8"));
+    state = JSON.parse(fs11.readFileSync(stateFile, "utf8"));
   } catch (error) {
     const code = error.code;
     if (code === "EACCES" || code === "EPERM") {
@@ -8328,7 +8494,7 @@ async function findDaemon(stateFile = STATE_FILE) {
 
 // src/client.ts
 import { spawn as spawn4, spawnSync } from "node:child_process";
-import fs11 from "node:fs";
+import fs12 from "node:fs";
 import path12 from "node:path";
 import { fileURLToPath } from "node:url";
 function dashboardDir() {
@@ -8337,7 +8503,7 @@ function dashboardDir() {
     path12.resolve(here, "../dashboard"),
     path12.resolve(here, "../../dashboard/dist")
   ];
-  return candidates.find((d) => fs11.existsSync(path12.join(d, "index.html")));
+  return candidates.find((d) => fs12.existsSync(path12.join(d, "index.html")));
 }
 function daemonCommand() {
   const entry = process.argv[1];
@@ -8345,7 +8511,7 @@ function daemonCommand() {
   if (runningUnderBun) {
     const dist = path12.resolve(path12.dirname(fileURLToPath(import.meta.url)), "../dist/index.js");
     const hasNode = spawnSync("node", ["--version"], { stdio: "ignore" }).status === 0;
-    if (fs11.existsSync(dist) && hasNode)
+    if (fs12.existsSync(dist) && hasNode)
       return ["node", [dist, "daemon", "run"]];
     console.warn("LocalDeck: starting daemon under Bun — WebSocket proxying (HMR) will not work. Run `bun run build` and make sure `node` is on PATH.");
   }
@@ -8358,8 +8524,8 @@ async function ensureDaemon() {
   const running = await findDaemon();
   if (running)
     return running;
-  fs11.mkdirSync(path12.dirname(DAEMON_LOG), { recursive: true });
-  const out = fs11.openSync(DAEMON_LOG, "a");
+  fs12.mkdirSync(path12.dirname(DAEMON_LOG), { recursive: true });
+  const out = fs12.openSync(DAEMON_LOG, "a");
   const [cmd, args] = daemonCommand();
   const child = spawn4(cmd, args, { detached: true, stdio: ["ignore", out, out], env: process.env });
   child.unref();
@@ -8421,11 +8587,12 @@ class Api {
   }
   service = async (reference) => this.call("GET", `/api/services/${await this.servicePath(reference)}`);
   logs = async (reference, limit) => this.call("GET", `/api/services/${await this.servicePath(reference)}/logs?limit=${limit}`);
+  response = (key, requestId) => this.call("GET", `/api/services/${encodeURIComponent(key)}/response?requestId=${encodeURIComponent(requestId)}`);
   requests = async (reference, limit) => this.call("GET", `/api/services/${await this.servicePath(reference)}/requests?limit=${limit}`);
   stop = async (reference) => this.call("POST", `/api/services/${await this.servicePath(reference)}/stop`);
-  share = async (reference, password, exclusive = false) => this.call("POST", `/api/services/${await this.servicePath(reference)}/share${exclusive ? "/new" : ""}`, { password });
+  share = async (reference, password, exclusive = false, isPublic = false) => this.call("POST", `/api/services/${await this.servicePath(reference)}/share${exclusive ? "/new" : ""}`, isPublic ? { public: true } : { password });
   unshare = async (reference) => this.call("DELETE", `/api/services/${await this.servicePath(reference)}/share`);
   shutdown = () => this.call("POST", "/api/shutdown");
 }
 
-export { __toESM, __commonJS, __export, __require, wrapper_default, startForwarder, HOME_DIR, STATE_FILE, DEFAULT_API_PORT, assertUserRuntime, findProjectFile, loadProject, loadProjectFile, shellCommand, isPortFree, getFreePort, serviceKey, processTree, listeningPorts, chooseUpstream, connectHost, streamLines, killProcessTree, stripAnsi, redactDiagnostic, environmentValues, listProjectSecrets, resolveProjectSecrets, startupGuidance, inferPortEnvironment, startupLayers, waitForReadiness, secretOutput, VERSION, startDaemon, findDaemon, dashboardDir, ensureDaemon, Api };
+export { __toESM, __commonJS, __export, __require, wrapper_default, startForwarder, HOME_DIR, STATE_FILE, DEFAULT_API_PORT, assertUserRuntime, isPortFree, getFreePort, findProjectFile, loadProject, loadProjectFile, shellCommand, serviceKey, processTree, listeningPorts, chooseUpstream, unreachableListenerMessage, connectHost, streamLines, killProcessTree, stripAnsi, redactDiagnostic, environmentValues, listProjectSecrets, resolveProjectSecrets, startupGuidance, inferPortEnvironment, startupLayers, waitForReadiness, secretOutput, VERSION, startDaemon, findDaemon, dashboardDir, ensureDaemon, Api };