portless 0.10.2 → 0.11.0

package/dist/cli.js

@@ -1,53 +1,19 @@
 #!/usr/bin/env node
 import {
-  DEFAULT_TLD,
-  FALLBACK_PROXY_PORT,
   FILE_MODE,
-  INTERNAL_LAN_IP_ENV,
-  INTERNAL_LAN_IP_FLAG,
-  PRIVILEGED_PORT_THRESHOLD,
-  RISKY_TLDS,
+  PORTLESS_HEADER,
   RouteConflictError,
   RouteStore,
-  SYSTEM_STATE_DIR,
-  USER_STATE_DIR,
-  WAIT_FOR_PROXY_INTERVAL_MS,
-  WAIT_FOR_PROXY_MAX_ATTEMPTS,
-  buildProxyStartConfig,
   cleanHostsFile,
   createHttpRedirectServer,
   createProxyServer,
-  discoverState,
-  findFreePort,
-  findPidOnPort,
   fixOwnership,
   formatUrl,
-  getDefaultPort,
-  getDefaultTld,
-  injectFrameworkFlags,
   isErrnoException,
-  isHttpsEnvDisabled,
-  isLanEnvEnabled,
-  isPortListening,
-  isProxyRunning,
-  isWildcardEnvEnabled,
-  isWindows,
   parseHostname,
-  prompt,
-  readLanMarker,
-  readPersistedProxyState,
-  readTldFromDir,
-  readTlsMarker,
-  resolveStateDir,
   shouldAutoSyncHosts,
-  spawnCommand,
-  syncHostsFile,
-  validateTld,
-  waitForProxy,
-  writeLanMarker,
-  writeTldFile,
-  writeTlsMarker
-} from "./chunk-EZJWUTUA.js";
+  syncHostsFile
+} from "./chunk-6PDLZVDS.js";
 
 // src/colors.ts
 function supportsColor() {
@@ -60,24 +26,23 @@ var wrap = (open, close) => {
   if (!enabled) return (s) => s;
   return (s) => `\x1B[${open}m${s}\x1B[${close}m`;
 };
+var identity = (s) => s;
 var bold = wrap("1", "22");
+var dim = wrap("2", "22");
 var red = wrap("31", "39");
-var green = wrap("32", "39");
+var green = identity;
 var yellow = wrap("33", "39");
-var blue = Object.assign(wrap("34", "39"), {
-  bold: enabled ? (s) => `\x1B[34;1m${s}\x1B[22;39m` : (s) => s
-});
-var cyan = Object.assign(wrap("36", "39"), {
-  bold: enabled ? (s) => `\x1B[36;1m${s}\x1B[22;39m` : (s) => s
-});
-var white = wrap("37", "39");
-var gray = wrap("90", "39");
-var colors_default = { bold, red, green, yellow, blue, cyan, white, gray };
+var blue = Object.assign(identity, { bold });
+var cyan = Object.assign(identity, { bold });
+var white = identity;
+var gray = dim;
+var colors_default = { bold, dim, red, green, yellow, blue, cyan, white, gray };
 
 // src/cli.ts
-import * as fs4 from "fs";
-import * as path4 from "path";
-import { spawn as spawn2, spawnSync as spawnSync2 } from "child_process";
+import * as fs8 from "fs";
+import * as path8 from "path";
+import { spawn as spawn3, spawnSync as spawnSync2 } from "child_process";
+import { StringDecoder } from "string_decoder";
 
 // src/certs.ts
 import * as fs from "fs";
@@ -98,6 +63,7 @@ var CA_KEY_FILE = "ca-key.pem";
 var CA_CERT_FILE = "ca.pem";
 var SERVER_KEY_FILE = "server-key.pem";
 var SERVER_CERT_FILE = "server.pem";
+var CA_TRUST_MARKER = "ca.trusted";
 function fileExists(filePath) {
   try {
     fs.accessSync(filePath, fs.constants.R_OK);
@@ -106,6 +72,36 @@ function fileExists(filePath) {
     return false;
   }
 }
+function caFingerprint(stateDir) {
+  const caCertPath = path.join(stateDir, CA_CERT_FILE);
+  try {
+    const pem = fs.readFileSync(caCertPath);
+    return crypto.createHash("sha256").update(pem).digest("hex");
+  } catch {
+    return null;
+  }
+}
+function readTrustMarker(stateDir) {
+  try {
+    const value = fs.readFileSync(path.join(stateDir, CA_TRUST_MARKER), "utf-8").trim();
+    return value || null;
+  } catch {
+    return null;
+  }
+}
+function writeTrustMarker(stateDir) {
+  const fp = caFingerprint(stateDir);
+  if (fp) {
+    fs.writeFileSync(path.join(stateDir, CA_TRUST_MARKER), fp + "\n");
+    fixOwnership(path.join(stateDir, CA_TRUST_MARKER));
+  }
+}
+function clearTrustMarker(stateDir) {
+  try {
+    fs.unlinkSync(path.join(stateDir, CA_TRUST_MARKER));
+  } catch {
+  }
+}
 var _opensslEnv;
 function getOpensslEnv() {
   if (process.platform !== "win32") return void 0;
@@ -228,6 +224,7 @@ function generateCA(stateDir) {
   fs.chmodSync(keyPath, 384);
   fs.chmodSync(certPath, 420);
   fixOwnership(keyPath, certPath);
+  clearTrustMarker(stateDir);
   return { certPath, keyPath };
 }
 function generateServerCert(stateDir) {
@@ -293,7 +290,8 @@ function ensureCerts(stateDir) {
   const serverCertPath = path.join(stateDir, SERVER_CERT_FILE);
   const serverKeyPath = path.join(stateDir, SERVER_KEY_FILE);
   let caGenerated = false;
-  if (!fileExists(caCertPath) || !fileExists(caKeyPath) || !isCertValid(caCertPath) || !isCertSignatureStrong(caCertPath)) {
+  const caMissing = !fileExists(caCertPath) || !fileExists(caKeyPath) || !isCertValid(caCertPath) || !isCertSignatureStrong(caCertPath);
+  if (caMissing) {
     generateCA(stateDir);
     caGenerated = true;
   }
@@ -302,7 +300,7 @@ function ensureCerts(stateDir) {
   }
   return {
     certPath: serverCertPath,
-    keyPath: path.join(stateDir, SERVER_KEY_FILE),
+    keyPath: serverKeyPath,
     caPath: caCertPath,
     caGenerated
   };
@@ -310,6 +308,11 @@ function ensureCerts(stateDir) {
 function isCATrusted(stateDir) {
   const caCertPath = path.join(stateDir, CA_CERT_FILE);
   if (!fileExists(caCertPath)) return false;
+  const marker = readTrustMarker(stateDir);
+  if (marker) {
+    const fp = caFingerprint(stateDir);
+    if (fp && marker === fp) return true;
+  }
   if (process.platform === "darwin") {
     return isCATrustedMacOS(caCertPath);
   } else if (process.platform === "linux") {
@@ -586,6 +589,7 @@ function trustCA(stateDir) {
           { stdio: "pipe", timeout: MACOS_SECURITY_AUTH_TIMEOUT_MS }
         );
       }
+      writeTrustMarker(stateDir);
       return { trusted: true };
     } else if (process.platform === "linux") {
       const config = getLinuxCATrustConfig();
@@ -595,12 +599,14 @@ function trustCA(stateDir) {
       const dest = path.join(config.certDir, "portless-ca.crt");
       fs.copyFileSync(caCertPath, dest);
       execFileSync(config.updateCommand, [], { stdio: "pipe", timeout: 3e4 });
+      writeTrustMarker(stateDir);
       return { trusted: true };
     } else if (process.platform === "win32") {
       execFileSync("certutil", ["-addstore", "-user", "Root", caCertPath], {
         stdio: "pipe",
         timeout: 3e4
       });
+      writeTrustMarker(stateDir);
       return { trusted: true };
     }
     return { trusted: false, error: `Unsupported platform: ${process.platform}` };
@@ -622,22 +628,26 @@ function trustCA(stateDir) {
 function untrustCA(stateDir) {
   const caCertPath = path.join(stateDir, CA_CERT_FILE);
   if (!fileExists(caCertPath)) {
+    clearTrustMarker(stateDir);
     return { removed: true };
   }
   if (!isCATrusted(stateDir)) {
+    clearTrustMarker(stateDir);
     return { removed: true };
   }
   try {
+    let result;
     if (process.platform === "darwin") {
-      return untrustCAMacOS(caCertPath);
-    }
-    if (process.platform === "linux") {
-      return untrustCALinux(stateDir);
-    }
-    if (process.platform === "win32") {
-      return untrustCAWindows(caCertPath);
+      result = untrustCAMacOS(caCertPath);
+    } else if (process.platform === "linux") {
+      result = untrustCALinux(stateDir);
+    } else if (process.platform === "win32") {
+      result = untrustCAWindows(caCertPath);
+    } else {
+      result = { removed: false, error: `Unsupported platform: ${process.platform}` };
     }
-    return { removed: false, error: `Unsupported platform: ${process.platform}` };
+    if (result.removed) clearTrustMarker(stateDir);
+    return result;
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     return { removed: false, error: message };
@@ -655,12 +665,13 @@ function untrustCAMacOS(caCertPath) {
       return false;
     }
   };
-  if (tryExec(["remove-trusted-cert", caCertPath])) {
-    return isCATrustedMacOSAfterAttempt(caCertPath) ? { removed: false, error: errors.join("; ") || "Trust entry may still be present" } : { removed: true };
+  tryExec(["remove-trusted-cert", caCertPath]);
+  const keychains = [loginKeychainPath(), "/Library/Keychains/System.keychain"];
+  for (const kc of keychains) {
+    for (let i = 0; i < 20; i++) {
+      if (!tryExec(["delete-certificate", "-c", CA_COMMON_NAME, kc])) break;
+    }
   }
-  const login = loginKeychainPath();
-  tryExec(["delete-certificate", "-c", CA_COMMON_NAME, login]);
-  tryExec(["delete-certificate", "-c", CA_COMMON_NAME, "/Library/Keychains/System.keychain"]);
   return isCATrustedMacOSAfterAttempt(caCertPath) ? { removed: false, error: errors.join("; ") || "Could not remove CA from keychain (try sudo)" } : { removed: true };
 }
 function isCATrustedMacOSAfterAttempt(caCertPath) {
@@ -744,14 +755,14 @@ function untrustCAWindows(caCertPath) {
 }
 
 // src/auto.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import { execFileSync as execFileSync2 } from "child_process";
 import * as fs2 from "fs";
 import * as path2 from "path";
 var MAX_DNS_LABEL_LENGTH = 63;
 function truncateLabel(label) {
   if (label.length <= MAX_DNS_LABEL_LENGTH) return label;
-  const hash = createHash("sha256").update(label).digest("hex").slice(0, 6);
+  const hash = createHash2("sha256").update(label).digest("hex").slice(0, 6);
   const maxPrefixLength = MAX_DNS_LABEL_LENGTH - 7;
   const prefix = label.slice(0, maxPrefixLength).replace(/-+$/, "");
   return `${prefix}-${hash}`;
@@ -917,9 +928,618 @@ function readBranchFromHead(gitdir) {
   }
 }
 
-// src/clean-utils.ts
+// src/cli-utils.ts
 import * as fs3 from "fs";
+import * as http from "http";
+import * as https from "https";
+import * as net from "net";
+import * as os from "os";
 import * as path3 from "path";
+import * as readline from "readline";
+import { execSync, spawn } from "child_process";
+var isWindows = process.platform === "win32";
+var FALLBACK_PROXY_PORT = 1355;
+var PRIVILEGED_PORT_THRESHOLD = 1024;
+var INTERNAL_LAN_IP_ENV = "PORTLESS_INTERNAL_LAN_IP";
+var INTERNAL_LAN_IP_FLAG = "--lan-ip-auto";
+var LEGACY_SYSTEM_STATE_DIR = isWindows ? path3.join(os.tmpdir(), "portless") : "/tmp/portless";
+var USER_STATE_DIR = path3.join(os.homedir(), ".portless");
+var MIN_APP_PORT = 4e3;
+var MAX_APP_PORT = 4999;
+var RANDOM_PORT_ATTEMPTS = 50;
+var BLOCKED_PORTS = /* @__PURE__ */ new Set([
+  0,
+  1,
+  7,
+  9,
+  11,
+  13,
+  15,
+  17,
+  19,
+  20,
+  21,
+  22,
+  23,
+  25,
+  37,
+  42,
+  43,
+  53,
+  69,
+  77,
+  79,
+  87,
+  95,
+  101,
+  102,
+  103,
+  104,
+  109,
+  110,
+  111,
+  113,
+  115,
+  117,
+  119,
+  123,
+  135,
+  137,
+  139,
+  143,
+  161,
+  179,
+  389,
+  427,
+  465,
+  512,
+  513,
+  514,
+  515,
+  526,
+  530,
+  531,
+  532,
+  540,
+  548,
+  554,
+  556,
+  563,
+  587,
+  601,
+  636,
+  989,
+  990,
+  993,
+  995,
+  1719,
+  1720,
+  1723,
+  2049,
+  3659,
+  4045,
+  4190,
+  5060,
+  5061,
+  6e3,
+  6566,
+  6665,
+  6666,
+  6667,
+  6668,
+  6669,
+  6679,
+  6697,
+  10080
+]);
+var SOCKET_TIMEOUT_MS = 500;
+var PID_LOOKUP_TIMEOUT_MS = 5e3;
+var WAIT_FOR_PROXY_MAX_ATTEMPTS = 20;
+var WAIT_FOR_PROXY_INTERVAL_MS = 250;
+var SIGNAL_CODES = {
+  SIGHUP: 1,
+  SIGINT: 2,
+  SIGQUIT: 3,
+  SIGABRT: 6,
+  SIGKILL: 9,
+  SIGTERM: 15
+};
+function getProtocolPort(tls2) {
+  return tls2 ? 443 : 80;
+}
+function getDefaultPort(tls2) {
+  const envPort = process.env.PORTLESS_PORT;
+  if (envPort) {
+    const port = parseInt(envPort, 10);
+    if (!isNaN(port) && port >= 1 && port <= 65535) return port;
+  }
+  return tls2 === void 0 ? FALLBACK_PROXY_PORT : getProtocolPort(tls2);
+}
+function resolveStateDir(_port) {
+  if (process.env.PORTLESS_STATE_DIR) return process.env.PORTLESS_STATE_DIR;
+  return USER_STATE_DIR;
+}
+function readPortFromDir(dir) {
+  try {
+    const raw = fs3.readFileSync(path3.join(dir, "proxy.port"), "utf-8").trim();
+    const port = parseInt(raw, 10);
+    return isNaN(port) ? null : port;
+  } catch {
+    return null;
+  }
+}
+var TLS_MARKER_FILE = "proxy.tls";
+function readTlsMarker(dir) {
+  try {
+    return fs3.existsSync(path3.join(dir, TLS_MARKER_FILE));
+  } catch {
+    return false;
+  }
+}
+function writeTlsMarker(dir, enabled2) {
+  const markerPath = path3.join(dir, TLS_MARKER_FILE);
+  if (enabled2) {
+    fs3.writeFileSync(markerPath, "1", { mode: 420 });
+  } else {
+    try {
+      fs3.unlinkSync(markerPath);
+    } catch {
+    }
+  }
+}
+var LAN_MARKER_FILE = "proxy.lan";
+function readLanMarker(dir) {
+  try {
+    const raw = fs3.readFileSync(path3.join(dir, LAN_MARKER_FILE), "utf-8").trim();
+    return raw || null;
+  } catch {
+    return null;
+  }
+}
+function writeLanMarker(dir, ip) {
+  const markerPath = path3.join(dir, LAN_MARKER_FILE);
+  if (!ip) {
+    try {
+      fs3.unlinkSync(markerPath);
+    } catch {
+    }
+  } else {
+    fs3.writeFileSync(markerPath, ip, { mode: 420 });
+  }
+}
+var DEFAULT_TLD = "localhost";
+var RISKY_TLDS = /* @__PURE__ */ new Map([
+  ["local", "conflicts with mDNS/Bonjour on macOS"],
+  ["dev", "Google-owned; browsers force HTTPS via preloaded HSTS"],
+  ["com", "public TLD; DNS requests will leak to the internet"],
+  ["org", "public TLD; DNS requests will leak to the internet"],
+  ["net", "public TLD; DNS requests will leak to the internet"],
+  ["io", "public TLD; DNS requests will leak to the internet"],
+  ["app", "public TLD; DNS requests will leak to the internet"],
+  ["edu", "public TLD; DNS requests will leak to the internet"],
+  ["gov", "public TLD; DNS requests will leak to the internet"],
+  ["mil", "public TLD; DNS requests will leak to the internet"],
+  ["int", "public TLD; DNS requests will leak to the internet"]
+]);
+function validateTld(tld) {
+  if (!tld) return "TLD cannot be empty";
+  if (!/^[a-z0-9]+$/.test(tld)) {
+    return `Invalid TLD "${tld}": must contain only lowercase letters and digits`;
+  }
+  return null;
+}
+var TLD_FILE = "proxy.tld";
+function readTldFromDir(dir) {
+  try {
+    const raw = fs3.readFileSync(path3.join(dir, TLD_FILE), "utf-8").trim();
+    return raw || DEFAULT_TLD;
+  } catch {
+    return DEFAULT_TLD;
+  }
+}
+function writeTldFile(dir, tld) {
+  const filePath = path3.join(dir, TLD_FILE);
+  if (tld === DEFAULT_TLD) {
+    try {
+      fs3.unlinkSync(filePath);
+    } catch {
+    }
+  } else {
+    fs3.writeFileSync(filePath, tld, { mode: 420 });
+  }
+}
+function getDefaultTld() {
+  const val = process.env.PORTLESS_TLD?.trim().toLowerCase();
+  if (!val) return DEFAULT_TLD;
+  const err = validateTld(val);
+  if (err) throw new Error(`PORTLESS_TLD: ${err}`);
+  return val;
+}
+function isHttpsEnvDisabled() {
+  const val = process.env.PORTLESS_HTTPS;
+  return val === "0" || val === "false";
+}
+function isWildcardEnvEnabled() {
+  const val = process.env.PORTLESS_WILDCARD;
+  return val === "1" || val === "true";
+}
+function isLanEnvEnabled() {
+  const val = process.env.PORTLESS_LAN;
+  return val === "1" || val === "true";
+}
+function readPersistedProxyState() {
+  const dir = process.env.PORTLESS_STATE_DIR || USER_STATE_DIR;
+  const port = readPortFromDir(dir);
+  if (port !== null) {
+    const tls2 = readTlsMarker(dir);
+    const tld = readTldFromDir(dir);
+    const lanIp = readLanMarker(dir);
+    return { port, tls: tls2, tld, lanMode: lanIp !== null || tld === "local" };
+  }
+  return null;
+}
+function buildProxyStartConfig(options) {
+  const effectiveTld = options.lanMode ? "local" : options.tld;
+  const args = [];
+  if (options.foreground) {
+    args.push("--foreground");
+  }
+  if (options.includePort && options.proxyPort !== void 0) {
+    args.push("--port", options.proxyPort.toString());
+  }
+  if (options.useHttps) {
+    if (options.customCertPath && options.customKeyPath) {
+      args.push("--cert", options.customCertPath, "--key", options.customKeyPath);
+    } else {
+      args.push("--https");
+    }
+  } else {
+    args.push("--no-tls");
+  }
+  if (options.lanMode) {
+    args.push("--lan");
+    if (options.lanIp) {
+      if (options.lanIpExplicit) {
+        args.push("--ip", options.lanIp);
+      } else {
+        args.push(INTERNAL_LAN_IP_FLAG, options.lanIp);
+      }
+    }
+  } else if (effectiveTld !== DEFAULT_TLD) {
+    args.push("--tld", effectiveTld);
+  }
+  if (options.useWildcard) {
+    args.push("--wildcard");
+  }
+  if (options.skipTrust) {
+    args.push("--skip-trust");
+  }
+  return { effectiveTld, args };
+}
+async function discoverState() {
+  if (process.env.PORTLESS_STATE_DIR) {
+    const dir2 = process.env.PORTLESS_STATE_DIR;
+    const port = readPortFromDir(dir2) ?? getDefaultPort();
+    const lanIp = readLanMarker(dir2);
+    if (await isProxyRunning(port) || await isPortListening(port)) {
+      const tls2 = readTlsMarker(dir2);
+      const tld = readTldFromDir(dir2);
+      return { dir: dir2, port, tls: tls2, tld, lanMode: lanIp !== null || tld === "local", lanIp };
+    }
+    return {
+      dir: dir2,
+      port,
+      tls: readTlsMarker(dir2),
+      tld: readTldFromDir(dir2),
+      lanMode: lanIp !== null,
+      lanIp: null
+    };
+  }
+  const userPort = readPortFromDir(USER_STATE_DIR);
+  if (userPort !== null) {
+    if (await isProxyRunning(userPort)) {
+      const tls2 = readTlsMarker(USER_STATE_DIR);
+      const tld = readTldFromDir(USER_STATE_DIR);
+      const lanIp = readLanMarker(USER_STATE_DIR);
+      return {
+        dir: USER_STATE_DIR,
+        port: userPort,
+        tls: tls2,
+        tld,
+        lanMode: lanIp !== null || tld === "local",
+        lanIp
+      };
+    }
+  }
+  const legacyPort = readPortFromDir(LEGACY_SYSTEM_STATE_DIR);
+  if (legacyPort !== null) {
+    if (await isProxyRunning(legacyPort)) {
+      const tls2 = readTlsMarker(LEGACY_SYSTEM_STATE_DIR);
+      const tld = readTldFromDir(LEGACY_SYSTEM_STATE_DIR);
+      const lanIp = readLanMarker(LEGACY_SYSTEM_STATE_DIR);
+      return {
+        dir: LEGACY_SYSTEM_STATE_DIR,
+        port: legacyPort,
+        tls: tls2,
+        tld,
+        lanMode: lanIp !== null || tld === "local",
+        lanIp
+      };
+    }
+  }
+  const configuredPort = getDefaultPort();
+  const probePorts = /* @__PURE__ */ new Set([443, 80, FALLBACK_PROXY_PORT, configuredPort]);
+  for (const port of probePorts) {
+    if (await isProxyRunning(port)) {
+      const dir2 = resolveStateDir(port);
+      const markerTls = readTlsMarker(dir2);
+      const tls2 = markerTls || port === getProtocolPort(true);
+      const tld = readTldFromDir(dir2);
+      const lanIp = readLanMarker(dir2);
+      return { dir: dir2, port, tls: tls2, tld, lanMode: lanIp !== null || tld === "local", lanIp };
+    }
+  }
+  const dir = resolveStateDir(configuredPort);
+  return {
+    dir,
+    port: configuredPort,
+    tls: readTlsMarker(dir),
+    tld: readTldFromDir(dir),
+    lanMode: readLanMarker(dir) !== null,
+    lanIp: null
+  };
+}
+async function findFreePort(minPort = MIN_APP_PORT, maxPort = MAX_APP_PORT) {
+  if (minPort > maxPort) {
+    throw new Error(`minPort (${minPort}) must be <= maxPort (${maxPort})`);
+  }
+  const tryPort = (port) => {
+    return new Promise((resolve3) => {
+      const server = net.createServer();
+      server.listen(port, () => {
+        server.close(() => resolve3(true));
+      });
+      server.on("error", () => resolve3(false));
+    });
+  };
+  for (let i = 0; i < RANDOM_PORT_ATTEMPTS; i++) {
+    const port = minPort + Math.floor(Math.random() * (maxPort - minPort + 1));
+    if (!BLOCKED_PORTS.has(port) && await tryPort(port)) {
+      return port;
+    }
+  }
+  for (let port = minPort; port <= maxPort; port++) {
+    if (!BLOCKED_PORTS.has(port) && await tryPort(port)) {
+      return port;
+    }
+  }
+  throw new Error(`No free port found in range ${minPort}-${maxPort}`);
+}
+function isProxyRunning(port, tls2 = false) {
+  return new Promise((resolve3) => {
+    const requestFn = tls2 ? https.request : http.request;
+    const req = requestFn(
+      {
+        hostname: "127.0.0.1",
+        port,
+        path: "/",
+        method: "HEAD",
+        timeout: SOCKET_TIMEOUT_MS,
+        ...tls2 ? { rejectUnauthorized: false } : {}
+      },
+      (res) => {
+        res.resume();
+        resolve3(res.headers[PORTLESS_HEADER.toLowerCase()] === "1");
+      }
+    );
+    req.on("error", () => resolve3(false));
+    req.on("timeout", () => {
+      req.destroy();
+      resolve3(false);
+    });
+    req.end();
+  });
+}
+function isPortListening(port) {
+  return new Promise((resolve3) => {
+    const socket = net.createConnection({ host: "127.0.0.1", port });
+    let settled = false;
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      socket.destroy();
+      resolve3(result);
+    };
+    socket.setTimeout(SOCKET_TIMEOUT_MS);
+    socket.once("connect", () => finish(true));
+    socket.once("error", () => finish(false));
+    socket.once("timeout", () => finish(false));
+  });
+}
+function parsePidFromNetstat(output, port) {
+  for (const line of output.split(/\r?\n/)) {
+    if (!line.includes("LISTENING")) continue;
+    const parts = line.trim().split(/\s+/);
+    if (parts.length < 5) continue;
+    const localAddr = parts[1];
+    const lastColon = localAddr.lastIndexOf(":");
+    if (lastColon === -1) continue;
+    const addrPort = parseInt(localAddr.substring(lastColon + 1), 10);
+    if (addrPort === port) {
+      const pid = parseInt(parts[parts.length - 1], 10);
+      if (!isNaN(pid) && pid > 0) return pid;
+    }
+  }
+  return null;
+}
+function findPidOnPort(port) {
+  try {
+    if (isWindows) {
+      const output2 = execSync("netstat -ano -p tcp", {
+        encoding: "utf-8",
+        timeout: PID_LOOKUP_TIMEOUT_MS
+      });
+      return parsePidFromNetstat(output2, port);
+    }
+    const output = execSync(`lsof -ti tcp:${port} -sTCP:LISTEN`, {
+      encoding: "utf-8",
+      timeout: PID_LOOKUP_TIMEOUT_MS
+    });
+    const pid = parseInt(output.trim().split("\n")[0], 10);
+    return isNaN(pid) ? null : pid;
+  } catch {
+    return null;
+  }
+}
+async function waitForProxy(port, maxAttempts = WAIT_FOR_PROXY_MAX_ATTEMPTS, intervalMs = WAIT_FOR_PROXY_INTERVAL_MS, tls2 = false) {
+  for (let i = 0; i < maxAttempts; i++) {
+    await new Promise((resolve3) => setTimeout(resolve3, intervalMs));
+    if (await isProxyRunning(port, tls2)) {
+      return true;
+    }
+  }
+  return false;
+}
+function shellEscape(arg) {
+  return `'${arg.replace(/'/g, "'\\''")}'`;
+}
+function collectBinPaths(cwd) {
+  const dirs = [];
+  let dir = cwd;
+  for (; ; ) {
+    const bin = path3.join(dir, "node_modules", ".bin");
+    if (fs3.existsSync(bin)) {
+      dirs.push(bin);
+    }
+    const parent = path3.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return dirs;
+}
+function augmentedPath(env, cwd) {
+  const source = env ?? process.env;
+  const base = source.PATH ?? source.Path ?? "";
+  const bins = collectBinPaths(cwd ?? process.cwd());
+  const nodeBin = path3.dirname(process.execPath);
+  const allBins = [...bins, nodeBin];
+  return allBins.join(path3.delimiter) + path3.delimiter + base;
+}
+function spawnCommand(commandArgs, options) {
+  const env = {
+    ...options?.env ?? process.env,
+    PATH: augmentedPath(options?.env)
+  };
+  if (isWindows) {
+    for (const key of Object.keys(env)) {
+      if (key !== "PATH" && key.toUpperCase() === "PATH") {
+        delete env[key];
+      }
+    }
+  }
+  const child = isWindows ? spawn("cmd.exe", ["/d", "/s", "/c", commandArgs.join(" ")], {
+    stdio: "inherit",
+    env
+  }) : spawn("/bin/sh", ["-c", commandArgs.map(shellEscape).join(" ")], {
+    stdio: "inherit",
+    env
+  });
+  let exiting = false;
+  const cleanup = () => {
+    process.removeListener("SIGINT", onSigInt);
+    process.removeListener("SIGTERM", onSigTerm);
+    options?.onCleanup?.();
+  };
+  const handleSignal = (signal) => {
+    if (exiting) return;
+    exiting = true;
+    child.kill(signal);
+    cleanup();
+    process.exit(128 + (SIGNAL_CODES[signal] || 15));
+  };
+  const onSigInt = () => handleSignal("SIGINT");
+  const onSigTerm = () => handleSignal("SIGTERM");
+  process.on("SIGINT", onSigInt);
+  process.on("SIGTERM", onSigTerm);
+  child.on("error", (err) => {
+    if (exiting) return;
+    exiting = true;
+    console.error(`Failed to run command: ${err.message}`);
+    if (err.code === "ENOENT") {
+      console.error(`Is "${commandArgs[0]}" installed and in your PATH?`);
+    }
+    cleanup();
+    process.exit(1);
+  });
+  child.on("exit", (code, signal) => {
+    if (exiting) return;
+    exiting = true;
+    cleanup();
+    if (signal) {
+      process.exit(128 + (SIGNAL_CODES[signal] || 15));
+    }
+    process.exit(code ?? 1);
+  });
+}
+var FRAMEWORKS_NEEDING_PORT = {
+  vite: { strictPort: true },
+  vp: { strictPort: true },
+  "react-router": { strictPort: true },
+  rsbuild: { strictPort: false },
+  astro: { strictPort: false },
+  ng: { strictPort: false },
+  "react-native": { strictPort: false },
+  expo: { strictPort: false }
+};
+var PACKAGE_RUNNERS = {
+  npx: [],
+  bunx: [],
+  pnpx: [],
+  yarn: ["dlx", "exec"],
+  pnpm: ["dlx", "exec"]
+};
+function findFrameworkBasename(commandArgs) {
+  if (commandArgs.length === 0) return null;
+  const first = path3.basename(commandArgs[0]);
+  if (FRAMEWORKS_NEEDING_PORT[first]) return first;
+  const subcommands = PACKAGE_RUNNERS[first];
+  if (!subcommands) return null;
+  let i = 1;
+  if (subcommands.length > 0) {
+    while (i < commandArgs.length && commandArgs[i].startsWith("-")) i++;
+    if (i >= commandArgs.length) return null;
+    if (!subcommands.includes(commandArgs[i])) {
+      const name2 = path3.basename(commandArgs[i]);
+      return FRAMEWORKS_NEEDING_PORT[name2] ? name2 : null;
+    }
+    i++;
+  }
+  while (i < commandArgs.length && commandArgs[i].startsWith("-")) i++;
+  if (i >= commandArgs.length) return null;
+  const name = path3.basename(commandArgs[i]);
+  return FRAMEWORKS_NEEDING_PORT[name] ? name : null;
+}
+function injectFrameworkFlags(commandArgs, port) {
+  const basename5 = findFrameworkBasename(commandArgs);
+  if (!basename5) return;
+  const framework = FRAMEWORKS_NEEDING_PORT[basename5];
+  if (!commandArgs.includes("--port")) {
+    commandArgs.push("--port", port.toString());
+    if (framework.strictPort) {
+      commandArgs.push("--strictPort");
+    }
+  }
+  if (!commandArgs.includes("--host")) {
+    const isExpoLan = basename5 === "expo" && isLanEnvEnabled();
+    if (isExpoLan) return;
+    const hostValue = basename5 === "expo" ? "localhost" : "127.0.0.1";
+    commandArgs.push("--host", hostValue);
+  }
+}
+
+// src/clean-utils.ts
+import * as fs4 from "fs";
+import * as path4 from "path";
 var PORTLESS_STATE_FILES = [
   "routes.json",
   "routes.lock",
@@ -943,29 +1563,29 @@ function collectStateDirsForCleanup() {
   const add = (d) => {
     const trimmed = d?.trim();
     if (!trimmed) return;
-    const resolved = path3.resolve(trimmed);
-    if (fs3.existsSync(resolved)) dirs.add(resolved);
+    const resolved = path4.resolve(trimmed);
+    if (fs4.existsSync(resolved)) dirs.add(resolved);
   };
   add(USER_STATE_DIR);
-  add(SYSTEM_STATE_DIR);
+  add(LEGACY_SYSTEM_STATE_DIR);
   add(process.env.PORTLESS_STATE_DIR);
   return [...dirs];
 }
 function removePortlessStateFiles(dir) {
   for (const f of PORTLESS_STATE_FILES) {
     try {
-      fs3.unlinkSync(path3.join(dir, f));
+      fs4.unlinkSync(path4.join(dir, f));
     } catch {
     }
   }
   try {
-    fs3.rmSync(path3.join(dir, HOST_CERTS_DIR2), { recursive: true, force: true });
+    fs4.rmSync(path4.join(dir, HOST_CERTS_DIR2), { recursive: true, force: true });
   } catch {
   }
 }
 
 // src/mdns.ts
-import { spawn, spawnSync } from "child_process";
+import { spawn as spawn2, spawnSync } from "child_process";
 
 // src/lan-ip.ts
 import { createSocket } from "dgram";
@@ -1140,7 +1760,7 @@ function publish(hostname, port, ip, onError) {
   if (!publisher) {
     return;
   }
-  const child = spawn(publisher.command, publisher.buildArgs(fqdn, name, port, ip), {
+  const child = spawn2(publisher.command, publisher.buildArgs(fqdn, name, port, ip), {
     stdio: "ignore",
     detached: false
   });
@@ -1167,6 +1787,528 @@ function cleanupAll() {
   activePublishers.clear();
 }
 
+// src/config.ts
+import * as fs5 from "fs";
+import * as path5 from "path";
+var ConfigValidationError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ConfigValidationError";
+  }
+};
+var CONFIG_FILENAME = "portless.json";
+function loadConfig(cwd = process.cwd()) {
+  const configPath = path5.join(cwd, CONFIG_FILENAME);
+  try {
+    const raw = fs5.readFileSync(configPath, "utf-8");
+    const parsed = JSON.parse(raw);
+    validateConfig(parsed, configPath);
+    return { config: parsed, configDir: cwd };
+  } catch (err) {
+    if (isErrnoException2(err) && err.code === "ENOENT") {
+      return loadConfigFromPackageJson(cwd);
+    }
+    if (err instanceof SyntaxError) {
+      throw new ConfigValidationError(`Invalid JSON in ${configPath}`);
+    }
+    throw err;
+  }
+}
+function normalizePortlessValue(value) {
+  if (typeof value === "string") {
+    return value.trim() ? { name: value.trim() } : null;
+  }
+  return value;
+}
+function loadConfigFromPackageJson(dir) {
+  const pkgPath = path5.join(dir, "package.json");
+  try {
+    const raw = fs5.readFileSync(pkgPath, "utf-8");
+    const pkg = JSON.parse(raw);
+    if (pkg && typeof pkg === "object" && "portless" in pkg) {
+      const config = normalizePortlessValue(pkg.portless);
+      if (config === null) return null;
+      validateConfig(config, `${pkgPath} "portless"`);
+      return { config, configDir: dir };
+    }
+  } catch (err) {
+    if (isErrnoException2(err) && err.code === "ENOENT") return null;
+    if (err instanceof SyntaxError) return null;
+    throw err;
+  }
+  return null;
+}
+function loadPackagePortlessConfig(dir) {
+  const pkgPath = path5.join(dir, "package.json");
+  try {
+    const raw = fs5.readFileSync(pkgPath, "utf-8");
+    const pkg = JSON.parse(raw);
+    if (pkg && typeof pkg === "object" && "portless" in pkg) {
+      const config = normalizePortlessValue(pkg.portless);
+      if (config === null) return null;
+      if (typeof config === "object" && !Array.isArray(config)) {
+        validateAppConfig(config, "portless", pkgPath);
+        return config;
+      }
+    }
+  } catch (err) {
+    if (err instanceof ConfigValidationError) throw err;
+  }
+  return null;
+}
+function resolveAppConfig(config, configDir, packageDir) {
+  if (config.apps) {
+    const rel = normalizePath(path5.relative(configDir, packageDir));
+    if (rel && !rel.startsWith("..")) {
+      let candidate = rel;
+      while (candidate) {
+        if (config.apps[candidate]) {
+          return config.apps[candidate];
+        }
+        const parent = path5.dirname(candidate);
+        if (parent === "." || parent === candidate) break;
+        candidate = normalizePath(parent);
+      }
+    }
+    return {};
+  }
+  return { name: config.name, script: config.script, appPort: config.appPort, proxy: config.proxy };
+}
+function hasScript(scriptName, dir) {
+  const pkgPath = path5.join(dir, "package.json");
+  try {
+    const raw = fs5.readFileSync(pkgPath, "utf-8");
+    const pkg = JSON.parse(raw);
+    return typeof pkg?.scripts?.[scriptName] === "string";
+  } catch {
+    return false;
+  }
+}
+var LOCK_FILES = [
+  ["pnpm-lock.yaml", "pnpm"],
+  ["yarn.lock", "yarn"],
+  ["bun.lockb", "bun"],
+  ["bun.lock", "bun"],
+  ["package-lock.json", "npm"]
+];
+function detectPackageManager(cwd) {
+  let dir = cwd;
+  for (; ; ) {
+    const pkgPath = path5.join(dir, "package.json");
+    try {
+      const raw = fs5.readFileSync(pkgPath, "utf-8");
+      const pkg = JSON.parse(raw);
+      if (typeof pkg.packageManager === "string") {
+        const name = pkg.packageManager.split("@")[0];
+        if (name === "pnpm" || name === "yarn" || name === "bun" || name === "npm") {
+          return name;
+        }
+      }
+    } catch {
+    }
+    for (const [file, pm] of LOCK_FILES) {
+      try {
+        fs5.accessSync(path5.join(dir, file), fs5.constants.F_OK);
+        return pm;
+      } catch {
+      }
+    }
+    const parent = path5.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return "npm";
+}
+function resolveScriptCommand(scriptName, packageDir) {
+  if (!hasScript(scriptName, packageDir)) return null;
+  const pm = detectPackageManager(packageDir);
+  return [pm, "run", scriptName];
+}
+function splitCommand(command) {
+  const args = [];
+  let current = "";
+  let inSingle = false;
+  let inDouble = false;
+  let escaped = false;
+  for (const ch of command) {
+    if (escaped) {
+      current += ch;
+      escaped = false;
+      continue;
+    }
+    if (ch === "\\" && !inSingle) {
+      escaped = true;
+      continue;
+    }
+    if (ch === "'" && !inDouble) {
+      inSingle = !inSingle;
+    } else if (ch === '"' && !inSingle) {
+      inDouble = !inDouble;
+    } else if (/\s/.test(ch) && !inSingle && !inDouble) {
+      if (current) {
+        args.push(current);
+        current = "";
+      }
+    } else {
+      current += ch;
+    }
+  }
+  if (current) args.push(current);
+  return args;
+}
+var BUILD_ONLY_COMMANDS = /* @__PURE__ */ new Set([
+  "tsup",
+  "tsc",
+  "esbuild",
+  "rollup",
+  "babel",
+  "swc",
+  "unbuild",
+  "pkgroll",
+  "ncc",
+  "microbundle"
+]);
+function isServerCommand(args) {
+  if (args.length === 0) return false;
+  const bin = path5.basename(args[0]);
+  return !BUILD_ONLY_COMMANDS.has(bin);
+}
+function normalizePath(p) {
+  return p.replace(/\\/g, "/");
+}
+function isErrnoException2(err) {
+  return err instanceof Error && "code" in err;
+}
+var KNOWN_TOP_KEYS = /* @__PURE__ */ new Set(["name", "script", "appPort", "proxy", "apps", "turbo"]);
+var KNOWN_APP_KEYS = /* @__PURE__ */ new Set(["name", "script", "appPort", "proxy"]);
+function validateConfig(config, configPath) {
+  if (typeof config !== "object" || config === null || Array.isArray(config)) {
+    throw new ConfigValidationError(`${configPath} must be a JSON object.`);
+  }
+  const obj = config;
+  if (obj.name !== void 0) {
+    if (typeof obj.name !== "string" || !obj.name.trim()) {
+      throw new ConfigValidationError(`"name" in ${configPath} must be a non-empty string.`);
+    }
+  }
+  if (obj.script !== void 0) {
+    if (typeof obj.script !== "string" || !obj.script.trim()) {
+      throw new ConfigValidationError(`"script" in ${configPath} must be a non-empty string.`);
+    }
+  }
+  if (obj.appPort !== void 0) {
+    if (typeof obj.appPort !== "number" || !Number.isInteger(obj.appPort) || obj.appPort < 1 || obj.appPort > 65535) {
+      throw new ConfigValidationError(
+        `"appPort" in ${configPath} must be an integer between 1 and 65535.`
+      );
+    }
+  }
+  if (obj.proxy !== void 0) {
+    if (typeof obj.proxy !== "boolean") {
+      throw new ConfigValidationError(`"proxy" in ${configPath} must be a boolean.`);
+    }
+  }
+  if (obj.turbo !== void 0) {
+    if (typeof obj.turbo !== "boolean") {
+      throw new ConfigValidationError(`"turbo" in ${configPath} must be a boolean.`);
+    }
+  }
+  if (obj.apps !== void 0) {
+    if (typeof obj.apps !== "object" || obj.apps === null || Array.isArray(obj.apps)) {
+      throw new ConfigValidationError(`"apps" in ${configPath} must be an object.`);
+    }
+    for (const [key, value] of Object.entries(obj.apps)) {
+      if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new ConfigValidationError(`"apps.${key}" in ${configPath} must be an object.`);
+      }
+      validateAppConfig(value, `apps.${key}`, configPath);
+    }
+  }
+  warnUnknownKeys(obj, KNOWN_TOP_KEYS, configPath);
+}
+function validateAppConfig(obj, prefix, configPath) {
+  if (obj.name !== void 0) {
+    if (typeof obj.name !== "string" || !obj.name.trim()) {
+      throw new ConfigValidationError(
+        `"${prefix}.name" in ${configPath} must be a non-empty string.`
+      );
+    }
+  }
+  if (obj.script !== void 0) {
+    if (typeof obj.script !== "string" || !obj.script.trim()) {
+      throw new ConfigValidationError(
+        `"${prefix}.script" in ${configPath} must be a non-empty string.`
+      );
+    }
+  }
+  if (obj.appPort !== void 0) {
+    if (typeof obj.appPort !== "number" || !Number.isInteger(obj.appPort) || obj.appPort < 1 || obj.appPort > 65535) {
+      throw new ConfigValidationError(
+        `"${prefix}.appPort" in ${configPath} must be an integer between 1 and 65535.`
+      );
+    }
+  }
+  if (obj.proxy !== void 0) {
+    if (typeof obj.proxy !== "boolean") {
+      throw new ConfigValidationError(`"${prefix}.proxy" in ${configPath} must be a boolean.`);
+    }
+  }
+  warnUnknownKeys(obj, KNOWN_APP_KEYS, configPath, prefix);
+}
+function warnUnknownKeys(obj, known, configPath, prefix) {
+  for (const key of Object.keys(obj)) {
+    if (!known.has(key)) {
+      const label = prefix ? `"${prefix}.${key}"` : `"${key}"`;
+      console.warn(
+        `Warning: Unknown key ${label} in ${configPath}. Known keys: ${[...known].join(", ")}`
+      );
+    }
+  }
+}
+
+// src/workspace.ts
+import * as fs6 from "fs";
+import * as path6 from "path";
+function findWorkspaceRoot(cwd = process.cwd()) {
+  let dir = cwd;
+  for (; ; ) {
+    try {
+      fs6.accessSync(path6.join(dir, "pnpm-workspace.yaml"), fs6.constants.R_OK);
+      return dir;
+    } catch {
+    }
+    if (readWorkspacesFromPackageJson(dir) !== null) {
+      return dir;
+    }
+    const parent = path6.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+function detectWorkspaceSource(workspaceRoot) {
+  try {
+    fs6.accessSync(path6.join(workspaceRoot, "pnpm-workspace.yaml"), fs6.constants.R_OK);
+    return "pnpm";
+  } catch {
+  }
+  if (readWorkspacesFromPackageJson(workspaceRoot) !== null) {
+    return "package-json";
+  }
+  return null;
+}
+function readWorkspacesFromPackageJson(dir) {
+  const pkgPath = path6.join(dir, "package.json");
+  try {
+    const raw = fs6.readFileSync(pkgPath, "utf-8");
+    const pkg = JSON.parse(raw);
+    if (!pkg || typeof pkg !== "object") return null;
+    const ws = pkg.workspaces;
+    if (Array.isArray(ws)) {
+      return ws.filter((g) => typeof g === "string");
+    }
+    if (ws && typeof ws === "object" && !Array.isArray(ws) && Array.isArray(ws.packages)) {
+      return ws.packages.filter((g) => typeof g === "string");
+    }
+  } catch {
+  }
+  return null;
+}
+function discoverWorkspacePackages(workspaceRoot) {
+  const source = detectWorkspaceSource(workspaceRoot);
+  let globs;
+  if (source === "pnpm") {
+    const wsPath = path6.join(workspaceRoot, "pnpm-workspace.yaml");
+    let content;
+    try {
+      content = fs6.readFileSync(wsPath, "utf-8");
+    } catch {
+      return [];
+    }
+    globs = parsePnpmWorkspaceYaml(content);
+  } else if (source === "package-json") {
+    globs = readWorkspacesFromPackageJson(workspaceRoot) ?? [];
+  } else {
+    return [];
+  }
+  const dirs = expandPackageGlobs(workspaceRoot, globs);
+  const packages = [];
+  for (const dir of dirs) {
+    const pkgPath = path6.join(dir, "package.json");
+    try {
+      const raw = fs6.readFileSync(pkgPath, "utf-8");
+      const pkg = JSON.parse(raw);
+      const rawName = typeof pkg.name === "string" ? pkg.name : null;
+      const scopeMatch = rawName?.match(/^@([^/]+)\//);
+      const scope = scopeMatch ? scopeMatch[1] : null;
+      const name = rawName ? rawName.replace(/^@[^/]+\//, "") : null;
+      const scripts = typeof pkg.scripts === "object" && pkg.scripts !== null ? pkg.scripts : {};
+      packages.push({ dir, name, scope, scripts });
+    } catch {
+    }
+  }
+  return packages;
+}
+function parsePnpmWorkspaceYaml(content) {
+  const lines = content.split("\n");
+  const globs = [];
+  let inPackages = false;
+  for (const rawLine of lines) {
+    const line = rawLine.trimEnd();
+    const headerMatch = line.match(/^packages\s*:(.*)/);
+    if (headerMatch) {
+      const rest = headerMatch[1].trim();
+      if (rest.startsWith("[")) {
+        return parseFlowSequence(rest);
+      }
+      inPackages = true;
+      continue;
+    }
+    if (inPackages) {
+      if (line.length > 0 && !line.startsWith(" ") && !line.startsWith("	") && !line.startsWith("-")) {
+        break;
+      }
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#")) continue;
+      const match = trimmed.match(/^-\s+['"]?([^'"#]+?)['"]?\s*(?:#.*)?$/);
+      if (match) {
+        const glob = match[1].trim();
+        if (glob) globs.push(glob);
+      }
+    }
+  }
+  return globs;
+}
+function parseFlowSequence(input) {
+  const inner = input.replace(/^\[/, "").replace(/]\s*$/, "");
+  return inner.split(",").map((s) => s.trim().replace(/^['"]/, "").replace(/['"]$/, "").trim()).filter(Boolean);
+}
+function expandPackageGlobs(root, globs) {
+  const included = /* @__PURE__ */ new Set();
+  const excluded = /* @__PURE__ */ new Set();
+  for (const glob of globs) {
+    if (glob.startsWith("!")) {
+      const negated = glob.slice(1);
+      for (const dir of expandSingleGlob(root, negated)) {
+        excluded.add(dir);
+      }
+    } else {
+      for (const dir of expandSingleGlob(root, glob)) {
+        included.add(dir);
+      }
+    }
+  }
+  for (const dir of excluded) {
+    included.delete(dir);
+  }
+  return [...included].sort();
+}
+function segmentMatches(pattern, name) {
+  if (pattern === "*" || pattern === "**") return true;
+  const starIdx = pattern.indexOf("*");
+  if (starIdx === -1) return pattern === name;
+  const prefix = pattern.slice(0, starIdx);
+  const suffix = pattern.slice(starIdx + 1).replace(/\*+$/, "");
+  return name.startsWith(prefix) && name.endsWith(suffix);
+}
+function expandSingleGlob(root, glob) {
+  const segments = glob.split("/");
+  return expandSegments(root, segments);
+}
+function expandSegments(base, segments) {
+  if (segments.length === 0) {
+    try {
+      const stat = fs6.statSync(base);
+      if (stat.isDirectory()) return [base];
+    } catch {
+    }
+    return [];
+  }
+  const [current, ...rest] = segments;
+  if (current.includes("*")) {
+    try {
+      const entries = fs6.readdirSync(base, { withFileTypes: true });
+      const matched = entries.filter((e) => e.isDirectory() && segmentMatches(current, e.name));
+      if (rest.length === 0) {
+        return matched.map((e) => path6.join(base, e.name));
+      }
+      const results = [];
+      for (const entry of matched) {
+        results.push(...expandSegments(path6.join(base, entry.name), rest));
+      }
+      return results;
+    } catch {
+      return [];
+    }
+  }
+  return expandSegments(path6.join(base, current), rest);
+}
+
+// src/turbo.ts
+import * as fs7 from "fs";
+import * as path7 from "path";
+var LOADER_FILENAME = "turbo-env-loader.cjs";
+var MANIFEST_FILENAME = "dev-manifest.json";
+function loaderPath(baseDir = USER_STATE_DIR) {
+  return path7.join(baseDir, LOADER_FILENAME);
+}
+function manifestPath(baseDir = USER_STATE_DIR) {
+  return path7.join(baseDir, MANIFEST_FILENAME);
+}
+function loaderSource(baseDir = USER_STATE_DIR) {
+  return `"use strict";
+var fs = require("fs");
+var path = require("path");
+var manifestPath = path.join(${JSON.stringify(baseDir)}, "dev-manifest.json");
+try {
+  var raw = fs.readFileSync(manifestPath, "utf-8");
+  var manifest = JSON.parse(raw);
+  var cwd = process.cwd();
+  var entry = manifest[cwd];
+  if (entry && typeof entry === "object") {
+    var keys = Object.keys(entry);
+    for (var i = 0; i < keys.length; i++) {
+      process.env[keys[i]] = entry[keys[i]];
+    }
+  }
+} catch (_) {}
+`;
+}
+function ensureEnvLoader(baseDir = USER_STATE_DIR) {
+  fs7.mkdirSync(baseDir, { recursive: true, mode: 493 });
+  const target = loaderPath(baseDir);
+  const source = loaderSource(baseDir);
+  try {
+    const existing = fs7.readFileSync(target, "utf-8");
+    if (existing === source) return;
+  } catch {
+  }
+  fs7.writeFileSync(target, source, { mode: 420 });
+}
+function writeManifest(entries, baseDir = USER_STATE_DIR) {
+  fs7.mkdirSync(baseDir, { recursive: true, mode: 493 });
+  fs7.writeFileSync(manifestPath(baseDir), JSON.stringify(entries, null, 2) + "\n", { mode: 420 });
+}
+function removeManifest(baseDir = USER_STATE_DIR) {
+  try {
+    fs7.unlinkSync(manifestPath(baseDir));
+  } catch {
+  }
+}
+function buildNodeOptions(baseDir = USER_STATE_DIR) {
+  const existing = process.env.NODE_OPTIONS || "";
+  const lp = loaderPath(baseDir);
+  const requireFlag = lp.includes(" ") ? `--require "${lp}"` : `--require ${lp}`;
+  return existing ? `${requireFlag} ${existing}` : requireFlag;
+}
+function hasTurboConfig(wsRoot) {
+  try {
+    fs7.accessSync(path7.join(wsRoot, "turbo.json"), fs7.constants.R_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 // src/cli.ts
 var chalk = colors_default;
 var HOSTS_DISPLAY = isWindows ? "hosts file" : "/etc/hosts";
@@ -1319,10 +2461,10 @@ function getEntryScript() {
 function isLocallyInstalled() {
   let dir = process.cwd();
   for (; ; ) {
-    if (fs4.existsSync(path4.join(dir, "node_modules", "portless", "package.json"))) {
+    if (fs8.existsSync(path8.join(dir, "node_modules", "portless", "package.json"))) {
       return true;
     }
-    const parent = path4.dirname(dir);
+    const parent = path8.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -1358,11 +2500,11 @@ function startProxyServer(store, proxyPort, tld, tlsOptions, lanIp, strict) {
     console.warn(chalk.yellow(`LAN mode disabled: ${reason}`));
   }
   const routesPath = store.getRoutesPath();
-  if (!fs4.existsSync(routesPath)) {
-    fs4.writeFileSync(routesPath, "[]", { mode: FILE_MODE });
+  if (!fs8.existsSync(routesPath)) {
+    fs8.writeFileSync(routesPath, "[]", { mode: FILE_MODE });
   }
   try {
-    fs4.chmodSync(routesPath, FILE_MODE);
+    fs8.chmodSync(routesPath, FILE_MODE);
   } catch {
   }
   fixOwnership(routesPath);
@@ -1422,7 +2564,7 @@ function startProxyServer(store, proxyPort, tld, tlsOptions, lanIp, strict) {
     }
   };
   try {
-    watcher = fs4.watch(routesPath, () => {
+    watcher = fs8.watch(routesPath, () => {
       if (debounceTimer) clearTimeout(debounceTimer);
       debounceTimer = setTimeout(reloadRoutes, DEBOUNCE_MS);
     });
@@ -1472,8 +2614,8 @@ function startProxyServer(store, proxyPort, tld, tlsOptions, lanIp, strict) {
     redirectServer.listen(80);
   }
   server.listen(proxyPort, () => {
-    fs4.writeFileSync(store.pidPath, process.pid.toString(), { mode: FILE_MODE });
-    fs4.writeFileSync(store.portFilePath, proxyPort.toString(), { mode: FILE_MODE });
+    fs8.writeFileSync(store.pidPath, process.pid.toString(), { mode: FILE_MODE });
+    fs8.writeFileSync(store.portFilePath, proxyPort.toString(), { mode: FILE_MODE });
     writeTlsMarker(store.dir, isTls);
     writeTldFile(store.dir, tld);
     writeLanMarker(store.dir, activeLanIp);
@@ -1489,7 +2631,7 @@ function startProxyServer(store, proxyPort, tld, tlsOptions, lanIp, strict) {
       console.log(chalk.gray("Services are discoverable as <name>.local on your network"));
       if (isTls) {
         console.log(chalk.yellow("For HTTPS on devices, install the CA certificate:"));
-        console.log(chalk.gray(`  ${path4.join(store.dir, "ca.pem")}`));
+        console.log(chalk.gray(`  ${path8.join(store.dir, "ca.pem")}`));
       }
       if (!lanIpPinned) {
         lanMonitor = startLanIpMonitor({
@@ -1521,15 +2663,16 @@ function startProxyServer(store, proxyPort, tld, tlsOptions, lanIp, strict) {
       redirectServer.close();
     }
     try {
-      fs4.unlinkSync(store.pidPath);
+      fs8.unlinkSync(store.pidPath);
     } catch {
     }
     try {
-      fs4.unlinkSync(store.portFilePath);
+      fs8.unlinkSync(store.portFilePath);
     } catch {
     }
     writeTlsMarker(store.dir, false);
     writeTldFile(store.dir, DEFAULT_TLD);
+    writeLanMarker(store.dir, null);
     if (autoSyncHosts) cleanHostsFile();
     server.close(() => process.exit(0));
     setTimeout(() => process.exit(0), EXIT_TIMEOUT_MS).unref();
@@ -1554,7 +2697,7 @@ function sudoStopOrHint(port) {
 }
 async function stopProxy(store, proxyPort, _tls) {
   const pidPath = store.pidPath;
-  if (!fs4.existsSync(pidPath)) {
+  if (!fs8.existsSync(pidPath)) {
     if (await isProxyRunning(proxyPort)) {
       console.log(colors_default.yellow(`PID file is missing but port ${proxyPort} is still in use.`));
       const pid = findPidOnPort(proxyPort);
@@ -1562,9 +2705,12 @@ async function stopProxy(store, proxyPort, _tls) {
         try {
           process.kill(pid, "SIGTERM");
           try {
-            fs4.unlinkSync(store.portFilePath);
+            fs8.unlinkSync(store.portFilePath);
           } catch {
           }
+          writeTlsMarker(store.dir, false);
+          writeTldFile(store.dir, DEFAULT_TLD);
+          writeLanMarker(store.dir, null);
           console.log(colors_default.green(`Killed process ${pid}. Proxy stopped.`));
         } catch (err) {
           if (isErrnoException(err) && err.code === "EPERM") {
@@ -1597,10 +2743,13 @@ async function stopProxy(store, proxyPort, _tls) {
     return;
   }
   try {
-    const pid = parseInt(fs4.readFileSync(pidPath, "utf-8"), 10);
+    const pid = parseInt(fs8.readFileSync(pidPath, "utf-8"), 10);
     if (isNaN(pid)) {
       console.error(colors_default.red("Corrupted PID file. Removing it."));
-      fs4.unlinkSync(pidPath);
+      fs8.unlinkSync(pidPath);
+      writeTlsMarker(store.dir, false);
+      writeTldFile(store.dir, DEFAULT_TLD);
+      writeLanMarker(store.dir, null);
       return;
     }
     try {
@@ -1611,11 +2760,14 @@ async function stopProxy(store, proxyPort, _tls) {
         return;
       }
       console.log(colors_default.yellow("Proxy process is no longer running. Cleaning up stale files."));
-      fs4.unlinkSync(pidPath);
+      fs8.unlinkSync(pidPath);
       try {
-        fs4.unlinkSync(store.portFilePath);
+        fs8.unlinkSync(store.portFilePath);
       } catch {
       }
+      writeTlsMarker(store.dir, false);
+      writeTldFile(store.dir, DEFAULT_TLD);
+      writeLanMarker(store.dir, null);
       return;
     }
     if (!await isProxyRunning(proxyPort)) {
@@ -1625,15 +2777,21 @@ async function stopProxy(store, proxyPort, _tls) {
         )
       );
       console.log(colors_default.yellow("Removing stale PID file."));
-      fs4.unlinkSync(pidPath);
+      fs8.unlinkSync(pidPath);
+      writeTlsMarker(store.dir, false);
+      writeTldFile(store.dir, DEFAULT_TLD);
+      writeLanMarker(store.dir, null);
       return;
     }
     process.kill(pid, "SIGTERM");
-    fs4.unlinkSync(pidPath);
+    fs8.unlinkSync(pidPath);
     try {
-      fs4.unlinkSync(store.portFilePath);
+      fs8.unlinkSync(store.portFilePath);
     } catch {
     }
+    writeTlsMarker(store.dir, false);
+    writeTldFile(store.dir, DEFAULT_TLD);
+    writeLanMarker(store.dir, null);
     console.log(colors_default.green("Proxy stopped."));
   } catch (err) {
     if (isErrnoException(err) && err.code === "EPERM") {
@@ -1659,26 +2817,16 @@ function listRoutes(store, proxyPort, tls2) {
   }
   console.log(colors_default.blue.bold("\nActive routes:\n"));
   for (const route of routes) {
-    const url = formatUrl(route.hostname, proxyPort, tls2);
-    const label = route.pid === 0 ? "(alias)" : `(pid ${route.pid})`;
-    console.log(
-      `  ${colors_default.cyan(url)}  ${colors_default.gray("->")}  ${colors_default.white(`localhost:${route.port}`)}  ${colors_default.gray(label)}`
-    );
-  }
-  console.log();
-}
-async function runApp(initialStore, proxyPort, stateDir, name, commandArgs, tls2, tld, force, autoInfo, desiredPort, lanMode = false, lanIp) {
-  let store = initialStore;
-  console.log(chalk.blue.bold(`
-portless
-`));
-  let envTld;
-  try {
-    envTld = getDefaultTld();
-  } catch (err) {
-    console.error(colors_default.red(`Error: ${err.message}`));
-    process.exit(1);
+    const url = formatUrl(route.hostname, proxyPort, tls2);
+    const label = route.pid === 0 ? "(alias)" : `(pid ${route.pid})`;
+    console.log(
+      `  ${colors_default.cyan(url)}  ${colors_default.gray("->")}  ${colors_default.white(`localhost:${route.port}`)}  ${colors_default.gray(label)}`
+    );
   }
+  console.log();
+}
+function resolveProxyDesiredState(lanMode) {
+  const envTld = getDefaultTld();
   const explicit = {
     useHttps: process.env.PORTLESS_HTTPS !== void 0,
     customCert: false,
@@ -1699,131 +2847,139 @@ portless
     tld: envTld,
     useWildcard: isWildcardEnvEnabled()
   });
-  parseHostname(name, tld);
+  return { explicit, desiredConfig, envTld };
+}
+async function ensureProxyRunning(proxyPort, tls2, desired) {
+  const { explicit, desiredConfig } = desired;
   const proxyResponsive = await isProxyRunning(proxyPort, tls2);
   const proxyListeningFromStateDir = !!process.env.PORTLESS_STATE_DIR && await isPortListening(proxyPort);
-  if (!proxyResponsive && !proxyListeningFromStateDir) {
-    const persisted = readPersistedProxyState();
-    const startConfig = { ...desiredConfig };
-    let startPort;
-    if (persisted) {
-      if (!explicit.useHttps && persisted.tls !== desiredConfig.useHttps) {
-        startConfig.useHttps = persisted.tls;
-      }
-      if (!explicit.tld && persisted.tld !== desiredConfig.tld) {
-        startConfig.tld = persisted.tld;
-      }
-      if (!explicit.lanMode && persisted.lanMode !== desiredConfig.lanMode) {
-        startConfig.lanMode = persisted.lanMode;
-      }
-      const envPort = getDefaultPort(startConfig.useHttps);
-      if (persisted.port !== envPort) {
-        startPort = persisted.port;
-      }
+  if (proxyResponsive || proxyListeningFromStateDir) {
+    return { started: false };
+  }
+  const persisted = readPersistedProxyState();
+  const startConfig = { ...desiredConfig };
+  let startPort;
+  if (persisted) {
+    if (!explicit.useHttps && persisted.tls !== desiredConfig.useHttps) {
+      startConfig.useHttps = persisted.tls;
     }
-    const effectivePort = startPort ?? getDefaultPort(startConfig.useHttps);
-    const needsSudo = !isWindows && effectivePort < PRIVILEGED_PORT_THRESHOLD;
-    const manualStartCommand = formatProxyStartCommand(effectivePort, startConfig);
-    const fallbackStartCommand = formatProxyStartCommand(FALLBACK_PROXY_PORT, startConfig);
-    const isInteractive = !!process.stdin.isTTY && !process.env.CI;
-    if (needsSudo && !isInteractive) {
-      console.error(colors_default.red("Proxy is not running and no TTY is available for sudo."));
-      console.error(colors_default.blue("Option 1: start the proxy in a terminal (will prompt for sudo):"));
-      console.error(colors_default.cyan(`  ${manualStartCommand}`));
-      console.error(
-        colors_default.blue(
-          `Option 2: use an unprivileged port (no sudo needed, URLs will include :${FALLBACK_PROXY_PORT}):`
-        )
-      );
-      console.error(colors_default.cyan(`  ${fallbackStartCommand}`));
-      process.exit(1);
+    if (!explicit.tld && persisted.tld !== desiredConfig.tld) {
+      startConfig.tld = persisted.tld;
     }
-    if (needsSudo) {
-      const answer = await prompt(colors_default.yellow("Proxy not running. Start it? [Y/n/skip] "));
-      if (answer === "n" || answer === "no") {
-        console.log(colors_default.gray("Cancelled."));
-        process.exit(0);
-      }
-      if (answer === "s" || answer === "skip") {
-        console.log(colors_default.gray("Skipping proxy, running command directly...\n"));
-        spawnCommand(commandArgs);
-        return;
-      }
+    if (!explicit.lanMode && persisted.lanMode !== desiredConfig.lanMode) {
+      startConfig.lanMode = persisted.lanMode;
     }
-    if (persisted && startPort !== void 0) {
-      console.log(
-        colors_default.yellow(
-          `Starting proxy with previous configuration (port ${startPort}, ${startConfig.useHttps ? "HTTPS" : "HTTP"})...`
-        )
-      );
-    } else {
-      console.log(colors_default.yellow("Starting proxy..."));
-    }
-    const proxyStartConfig = buildProxyStartConfig({
-      useHttps: startConfig.useHttps,
-      customCertPath: startConfig.customCertPath,
-      customKeyPath: startConfig.customKeyPath,
-      lanMode: startConfig.lanMode,
-      lanIp: startConfig.lanIpExplicit ? startConfig.lanIp : null,
-      lanIpExplicit: startConfig.lanIpExplicit,
-      tld: startConfig.tld,
-      useWildcard: startConfig.useWildcard,
-      includePort: startPort !== void 0,
-      proxyPort: startPort
-    });
-    const startArgs = [getEntryScript(), "proxy", "start", ...proxyStartConfig.args];
-    const result = spawnSync2(process.execPath, startArgs, {
-      stdio: "inherit",
-      timeout: SUDO_SPAWN_TIMEOUT_MS
-    });
-    let discovered = null;
-    if (!result.signal) {
-      for (let i = 0; i < WAIT_FOR_PROXY_MAX_ATTEMPTS; i++) {
-        await new Promise((r) => setTimeout(r, WAIT_FOR_PROXY_INTERVAL_MS));
-        const state = await discoverState();
-        if (await isProxyRunning(state.port)) {
-          discovered = state;
-          break;
-        }
-      }
+    const envPort = getDefaultPort(startConfig.useHttps);
+    if (persisted.port !== envPort) {
+      startPort = persisted.port;
     }
-    if (!discovered) {
-      console.error(colors_default.red("Failed to start proxy."));
-      const fallbackDir = resolveStateDir(effectivePort);
-      const logPath = path4.join(fallbackDir, "proxy.log");
-      console.error(colors_default.blue("Try starting it manually:"));
-      console.error(colors_default.cyan(`  ${manualStartCommand}`));
-      if (fs4.existsSync(logPath)) {
-        console.error(colors_default.gray(`Logs: ${logPath}`));
+  }
+  const effectivePort = startPort ?? getDefaultPort(startConfig.useHttps);
+  const needsSudo = !isWindows && effectivePort < PRIVILEGED_PORT_THRESHOLD;
+  const manualStartCommand = formatProxyStartCommand(effectivePort, startConfig);
+  const fallbackStartCommand = formatProxyStartCommand(FALLBACK_PROXY_PORT, startConfig);
+  const isInteractive = !!process.stdin.isTTY && !process.env.CI;
+  if (needsSudo && !isInteractive) {
+    console.error(colors_default.red("Proxy is not running and no TTY is available for sudo."));
+    console.error(colors_default.blue("Option 1: start the proxy in a terminal (will prompt for sudo):"));
+    console.error(colors_default.cyan(`  ${manualStartCommand}`));
+    console.error(
+      colors_default.blue(
+        `Option 2: use an unprivileged port (no sudo needed, URLs will include :${FALLBACK_PROXY_PORT}):`
+      )
+    );
+    console.error(colors_default.cyan(`  ${fallbackStartCommand}`));
+    process.exit(1);
+  }
+  console.log(colors_default.gray("Starting proxy..."));
+  const proxyStartConfig = buildProxyStartConfig({
+    useHttps: startConfig.useHttps,
+    customCertPath: startConfig.customCertPath,
+    customKeyPath: startConfig.customKeyPath,
+    lanMode: startConfig.lanMode,
+    lanIp: startConfig.lanIpExplicit ? startConfig.lanIp : null,
+    lanIpExplicit: startConfig.lanIpExplicit,
+    tld: startConfig.tld,
+    useWildcard: startConfig.useWildcard,
+    includePort: startPort !== void 0,
+    proxyPort: startPort
+  });
+  const startArgs = [getEntryScript(), "proxy", "start", ...proxyStartConfig.args];
+  const result = spawnSync2(process.execPath, startArgs, {
+    stdio: "inherit",
+    timeout: SUDO_SPAWN_TIMEOUT_MS
+  });
+  let discovered = null;
+  if (!result.signal) {
+    for (let i = 0; i < WAIT_FOR_PROXY_MAX_ATTEMPTS; i++) {
+      await new Promise((r) => setTimeout(r, WAIT_FOR_PROXY_INTERVAL_MS));
+      const state = await discoverState();
+      if (await isProxyRunning(state.port)) {
+        discovered = state;
+        break;
       }
-      process.exit(1);
-      return;
     }
-    proxyPort = discovered.port;
-    stateDir = discovered.dir;
-    tld = discovered.tld;
-    tls2 = discovered.tls;
-    lanMode = discovered.lanMode;
-    lanIp = discovered.lanIp;
+  }
+  if (!discovered) {
+    console.error(colors_default.red("Failed to start proxy."));
+    const fallbackDir = resolveStateDir(effectivePort);
+    const logPath = path8.join(fallbackDir, "proxy.log");
+    console.error(colors_default.blue("Try starting it manually:"));
+    console.error(colors_default.cyan(`  ${manualStartCommand}`));
+    if (fs8.existsSync(logPath)) {
+      console.error(colors_default.gray(`Logs: ${logPath}`));
+    }
+    process.exit(1);
+    return { started: false };
+  }
+  return { started: true, state: discovered };
+}
+async function runApp(initialStore, proxyPort, stateDir, name, commandArgs, tls2, tld, force, autoInfo, desiredPort, lanMode = false, lanIp) {
+  let store = initialStore;
+  console.log(chalk.blue.bold(`
+portless
+`));
+  let desired;
+  try {
+    desired = resolveProxyDesiredState(lanMode);
+  } catch (err) {
+    console.error(colors_default.red(`Error: ${err.message}`));
+    process.exit(1);
+  }
+  parseHostname(name, tld);
+  const ensureResult = await ensureProxyRunning(proxyPort, tls2, desired);
+  if (ensureResult.started) {
+    proxyPort = ensureResult.state.port;
+    stateDir = ensureResult.state.dir;
+    tld = ensureResult.state.tld;
+    tls2 = ensureResult.state.tls;
+    lanMode = ensureResult.state.lanMode;
+    lanIp = ensureResult.state.lanIp;
     store = new RouteStore(stateDir, {
       onWarning: (msg) => console.warn(colors_default.yellow(msg))
     });
-    console.log(colors_default.green("Proxy started in background"));
+    if (tls2 && !isCATrusted(stateDir)) {
+      await handleTrust();
+    }
   } else {
     const runningConfig = readCurrentProxyConfig(stateDir);
-    const mismatchMessages = getProxyConfigMismatchMessages(desiredConfig, runningConfig, explicit);
+    const mismatchMessages = getProxyConfigMismatchMessages(
+      desired.desiredConfig,
+      runningConfig,
+      desired.explicit
+    );
     if (mismatchMessages.length > 0) {
-      printProxyConfigMismatch(proxyPort, desiredConfig, mismatchMessages);
+      printProxyConfigMismatch(proxyPort, desired.desiredConfig, mismatchMessages);
     }
     lanMode = runningConfig.lanMode;
     lanIp = runningConfig.lanIp;
     console.log(chalk.gray("-- Proxy is running"));
   }
   const hostname = parseHostname(name, tld);
-  if (envTld !== DEFAULT_TLD && envTld !== tld) {
+  if (desired.envTld !== DEFAULT_TLD && desired.envTld !== tld) {
     console.warn(
       chalk.yellow(
-        `Warning: PORTLESS_TLD=${envTld} but the running proxy uses .${tld}. Using .${tld}.`
+        `Warning: PORTLESS_TLD=${desired.envTld} but the running proxy uses .${tld}. Using .${tld}.`
       )
     );
   }
@@ -1866,8 +3022,8 @@ portless
     console.log(chalk.green(`  LAN -> ${finalUrl}`));
     console.log(chalk.gray("  (accessible from other devices on the same WiFi network)\n"));
   }
-  const basename3 = path4.basename(commandArgs[0]);
-  const isExpo = basename3 === "expo";
+  const basename5 = path8.basename(commandArgs[0]);
+  const isExpo = basename5 === "expo";
   const isExpoLan = isExpo && (lanMode || isLanEnvEnabled());
   const hostBind = isExpoLan ? void 0 : "127.0.0.1";
   if (lanMode && !process.env.PORTLESS_LAN) {
@@ -1876,8 +3032,8 @@ portless
   injectFrameworkFlags(commandArgs, port);
   const caEnv = {};
   if (tls2 && !process.env.NODE_EXTRA_CA_CERTS) {
-    const caPath = path4.join(stateDir, "ca.pem");
-    if (fs4.existsSync(caPath)) {
+    const caPath = path8.join(stateDir, "ca.pem");
+    if (fs8.existsSync(caPath)) {
       caEnv.NODE_EXTRA_CA_CERTS = caPath;
     }
   }
@@ -1945,7 +3101,10 @@ function parseRunArgs(args) {
 ${colors_default.bold("portless run")} - Infer project name and run through the proxy.
 
 ${colors_default.bold("Usage:")}
-  ${colors_default.cyan("portless run [options] <command...>")}
+  ${colors_default.cyan("portless run [options] [command...]")}
+
+  When no command is given, runs the configured script (default: "dev")
+  from package.json.
 
 ${colors_default.bold("Options:")}
   --name <name>          Override the inferred base name (worktree prefix still applies)
@@ -1954,15 +3113,17 @@ ${colors_default.bold("Options:")}
   --help, -h             Show this help
 
 ${colors_default.bold("Name inference (in order):")}
-  1. package.json "name" field (walks up directories)
-  2. Git repo root directory name
-  3. Current directory basename
+  1. portless.json "name" field
+  2. package.json "name" field (walks up directories)
+  3. Git repo root directory name
+  4. Current directory basename
 
   Use --name to override the inferred name while keeping worktree prefixes.
   In git worktrees, the branch name is prepended as a subdomain prefix
   (e.g. feature-auth.myapp.localhost).
 
 ${colors_default.bold("Examples:")}
+  portless run                        # Run dev script through proxy
   portless run next dev               # -> https://<project>.localhost
   portless run --name myapp next dev  # -> https://myapp.localhost
   portless run vite dev               # -> https://<project>.localhost
@@ -2045,13 +3206,13 @@ ${colors_default.bold("Install:")}
   ${colors_default.cyan("npm install -D portless")}          Project dev dependency
 
 ${colors_default.bold("Usage:")}
+  ${colors_default.cyan("portless")}                         Run dev script through proxy
+  ${colors_default.cyan("portless")}                         From monorepo root: run all workspace packages
+  ${colors_default.cyan("portless run")}                     Same as above
+  ${colors_default.cyan("portless run <cmd>")}               Run a command through the proxy
+  ${colors_default.cyan("portless <name> <cmd>")}            Run with an explicit app name
   ${colors_default.cyan("portless proxy start")}             Start the proxy (HTTPS on port 443, daemon)
-  ${colors_default.cyan("portless proxy start --no-tls")}    Start without HTTPS (port 80)
-  ${colors_default.cyan("portless proxy start --lan")}       Start in LAN mode (mDNS for real device testing)
-  ${colors_default.cyan("portless proxy start -p 1355")}     Start on a custom port (no sudo)
   ${colors_default.cyan("portless proxy stop")}              Stop the proxy
-  ${colors_default.cyan("portless <name> <cmd>")}            Run your app through the proxy
-  ${colors_default.cyan("portless run <cmd>")}               Infer name from project, run through proxy
   ${colors_default.cyan("portless get <name>")}              Print URL for a service (for cross-service refs)
   ${colors_default.cyan("portless alias <name> <port>")}     Register a static route (e.g. for Docker)
   ${colors_default.cyan("portless alias --remove <name>")}   Remove a static route
@@ -2062,22 +3223,31 @@ ${colors_default.bold("Usage:")}
   ${colors_default.cyan("portless hosts clean")}             Remove portless entries from ${HOSTS_DISPLAY}
 
 ${colors_default.bold("Examples:")}
-  portless proxy start                # Start HTTPS proxy on port 443
-  portless proxy start --no-tls       # Start HTTP proxy on port 80
+  portless                            # Run dev script through proxy
+  portless                            # From monorepo root: start all apps
+  portless --script start             # Run "start" script instead of "dev"
   portless myapp next dev             # -> https://myapp.localhost
-  portless myapp vite dev             # -> https://myapp.localhost
-  portless api.myapp pnpm start       # -> https://api.myapp.localhost
   portless run next dev               # -> https://<project>.localhost
   portless run next dev               # in worktree -> https://<worktree>.<project>.localhost
-  portless get backend                 # -> https://backend.localhost (for cross-service refs)
-  # Wildcard subdomains: tenant.myapp.localhost also routes to myapp
+  portless get backend                # -> https://backend.localhost
+
+${colors_default.bold("Configuration (portless.json):")}
+  Optional. Portless works out of the box by running the "dev" script
+  from package.json. Use portless.json to override defaults.
+
+  Override name:   { "name": "myapp" }
+  Override script: { "name": "myapp", "script": "start" }
+  Monorepo:        { "apps": { "apps/web": { "name": "myapp" } } }
 
 ${colors_default.bold("In package.json:")}
   {
     "scripts": {
-      "dev": "portless run next dev"
+      "dev": "next dev"
     }
   }
+  Then run: portless
+  Or:       portless run
+  Or:       portless run next dev
 
 ${colors_default.bold("How it works:")}
   1. Start the proxy once (HTTPS on port 443 by default, auto-elevates with sudo)
@@ -2113,6 +3283,7 @@ ${colors_default.bold("LAN mode:")}
 ${colors_default.bold("Options:")}
   run [--name <name>] <cmd>      Infer project name (or override with --name)
                                 Adds worktree prefix in git worktrees
+  --script <name>               Run a specific package.json script (default: dev)
   -p, --port <number>           Port for the proxy (default: 443, or 80 with --no-tls)
                                 Standard ports auto-elevate with sudo on macOS/Linux
   --no-tls                      Disable HTTPS (use plain HTTP on port 80)
@@ -2167,13 +3338,13 @@ ${colors_default.bold("Reserved names:")}
   process.exit(0);
 }
 function printVersion() {
-  console.log("0.10.2");
+  console.log("0.11.0");
   process.exit(0);
 }
 async function handleTrust() {
   const { dir } = await discoverState();
-  if (!fs4.existsSync(dir)) {
-    fs4.mkdirSync(dir, { recursive: true });
+  if (!fs8.existsSync(dir)) {
+    fs8.mkdirSync(dir, { recursive: true });
   }
   const { caGenerated } = ensureCerts(dir);
   if (caGenerated) {
@@ -2246,8 +3417,8 @@ ${colors_default.bold("Options:")}
   await stopProxy(store, port, tls2);
   const stateDirs = collectStateDirsForCleanup();
   for (const stateDir of stateDirs) {
-    const caPath = path4.join(stateDir, "ca.pem");
-    if (!fs4.existsSync(caPath)) continue;
+    const caPath = path8.join(stateDir, "ca.pem");
+    if (!fs8.existsSync(caPath)) continue;
     const wasTrusted = isCATrusted(stateDir);
     if (!wasTrusted) continue;
     const untrustResult = untrustCA(stateDir);
@@ -2797,8 +3968,8 @@ ${colors_default.bold("LAN mode (--lan):")}
           console.log(colors_default.green(`Proxy started on port ${proxyPort}.`));
         } else {
           console.error(colors_default.red("Proxy process started but is not responding."));
-          const logPath2 = path4.join(resolveStateDir(proxyPort), "proxy.log");
-          if (fs4.existsSync(logPath2)) {
+          const logPath2 = path8.join(resolveStateDir(proxyPort), "proxy.log");
+          if (fs8.existsSync(logPath2)) {
             console.error(colors_default.gray(`Logs: ${logPath2}`));
           }
         }
@@ -2837,8 +4008,8 @@ ${colors_default.bold("LAN mode (--lan):")}
     store.ensureDir();
     if (customCertPath && customKeyPath) {
       try {
-        const cert = fs4.readFileSync(customCertPath);
-        const key = fs4.readFileSync(customKeyPath);
+        const cert = fs8.readFileSync(customCertPath);
+        const key = fs8.readFileSync(customKeyPath);
         const certStr = cert.toString("utf-8");
         const keyStr = key.toString("utf-8");
         if (!certStr.includes("-----BEGIN CERTIFICATE-----")) {
@@ -2883,9 +4054,9 @@ ${colors_default.bold("LAN mode (--lan):")}
           console.warn(colors_default.cyan("  portless trust"));
         }
       }
-      const cert = fs4.readFileSync(certs.certPath);
-      const key = fs4.readFileSync(certs.keyPath);
-      const ca = fs4.readFileSync(certs.caPath);
+      const cert = fs8.readFileSync(certs.certPath);
+      const key = fs8.readFileSync(certs.keyPath);
+      const ca = fs8.readFileSync(certs.caPath);
       tlsOptions = {
         cert,
         key,
@@ -2900,11 +4071,11 @@ ${colors_default.bold("LAN mode (--lan):")}
     return;
   }
   store.ensureDir();
-  const logPath = path4.join(stateDir, "proxy.log");
-  const logFd = fs4.openSync(logPath, "a");
+  const logPath = path8.join(stateDir, "proxy.log");
+  const logFd = fs8.openSync(logPath, "a");
   try {
     try {
-      fs4.chmodSync(logPath, FILE_MODE);
+      fs8.chmodSync(logPath, FILE_MODE);
     } catch {
     }
     fixOwnership(logPath);
@@ -2927,7 +4098,7 @@ ${colors_default.bold("LAN mode (--lan):")}
         skipTrust: true
       }).args
     ];
-    const child = spawn2(process.execPath, daemonArgs, {
+    const child = spawn3(process.execPath, daemonArgs, {
       detached: true,
       stdio: ["ignore", logFd, logFd],
       env: process.env,
@@ -2935,13 +4106,13 @@ ${colors_default.bold("LAN mode (--lan):")}
     });
     child.unref();
   } finally {
-    fs4.closeSync(logFd);
+    fs8.closeSync(logFd);
   }
   if (!await waitForProxy(proxyPort, void 0, void 0, useHttps)) {
     console.error(colors_default.red("Proxy failed to start (timed out waiting for it to listen)."));
     console.error(colors_default.blue("Try starting the proxy in the foreground to see the error:"));
     console.error(colors_default.cyan("  portless proxy start --foreground"));
-    if (fs4.existsSync(logPath)) {
+    if (fs8.existsSync(logPath)) {
       console.error(colors_default.gray(`Logs: ${logPath}`));
     }
     process.exit(1);
@@ -2953,8 +4124,488 @@ ${colors_default.bold("LAN mode (--lan):")}
     console.log(chalk.gray("Services will be discoverable as <name>.local on your network."));
   }
 }
-async function handleRunMode(args) {
+function loadAppConfig(cwd = process.cwd()) {
+  try {
+    const loaded = loadConfig(cwd);
+    if (!loaded) return null;
+    return resolveAppConfig(loaded.config, loaded.configDir, cwd);
+  } catch (err) {
+    if (err instanceof ConfigValidationError) {
+      console.error(colors_default.red(`Error: ${err.message}`));
+      process.exit(1);
+    }
+    throw err;
+  }
+}
+async function handleDefaultMode(globalScript, extraArgs = []) {
+  const cwd = process.cwd();
+  const wsRoot = findWorkspaceRoot(cwd);
+  if (wsRoot === cwd) {
+    const packages = discoverWorkspacePackages(cwd);
+    let wsScriptName;
+    try {
+      wsScriptName = globalScript ?? loadConfig(cwd)?.config.script ?? "dev";
+    } catch (err) {
+      if (err instanceof ConfigValidationError) {
+        console.error(colors_default.red(`Error: ${err.message}`));
+        process.exit(1);
+      }
+      throw err;
+    }
+    const hasMatchingPackages = packages.some((p) => p.scripts[wsScriptName]);
+    if (hasMatchingPackages) {
+      await handleDefaultMulti(cwd, globalScript, extraArgs);
+      return true;
+    }
+  }
+  const appConfig = loadAppConfig(cwd);
+  const scriptName = globalScript ?? appConfig?.script ?? "dev";
+  if (hasScript(scriptName, cwd)) {
+    await handleDefaultSingle(cwd, scriptName, appConfig);
+    return true;
+  }
+  return false;
+}
+async function handleDefaultSingle(cwd, scriptName, appConfig) {
+  const resolved = resolveScriptCommand(scriptName, cwd);
+  if (!resolved) {
+    console.error(colors_default.red(`Error: No "${scriptName}" script found in package.json.`));
+    process.exit(1);
+  }
+  let baseName;
+  let nameSource;
+  if (appConfig?.name) {
+    baseName = appConfig.name.split(".").map((label) => truncateLabel(label)).join(".");
+    nameSource = "portless.json";
+  } else {
+    const inferred = inferProjectName(cwd);
+    baseName = inferred.name;
+    nameSource = inferred.source;
+  }
+  const worktree = detectWorktreePrefix(cwd);
+  const effectiveName = worktree ? `${worktree.prefix}.${baseName}` : baseName;
+  const { dir, port, tls: tls2, tld, lanMode, lanIp } = await discoverState();
+  const store = new RouteStore(dir, {
+    onWarning: (msg) => console.warn(colors_default.yellow(msg))
+  });
+  await runApp(
+    store,
+    port,
+    dir,
+    effectiveName,
+    resolved,
+    tls2,
+    tld,
+    false,
+    { nameSource, prefix: worktree?.prefix, prefixSource: worktree?.source },
+    appConfig?.appPort,
+    lanMode,
+    lanIp
+  );
+}
+function spawnChildProcess(commandArgs, env, cwd) {
+  return spawn3(commandArgs[0], commandArgs.slice(1), {
+    stdio: ["ignore", "pipe", "pipe"],
+    env,
+    cwd
+  });
+}
+function prefixStream(stream, output, prefix) {
+  if (!stream) return;
+  const decoder = new StringDecoder("utf8");
+  let buffer = "";
+  stream.on("data", (data) => {
+    buffer += decoder.write(data);
+    let idx;
+    while ((idx = buffer.indexOf("\n")) !== -1) {
+      const line = buffer.slice(0, idx).replace(/\r$/, "");
+      buffer = buffer.slice(idx + 1);
+      output.write(`${prefix} ${line}
+`);
+    }
+  });
+  stream.on("end", () => {
+    buffer += decoder.end();
+    if (buffer) output.write(`${prefix} ${buffer}
+`);
+  });
+}
+function pipeOutput(child, prefix) {
+  prefixStream(child.stdout, process.stdout, prefix);
+  prefixStream(child.stderr, process.stderr, prefix);
+}
+async function spawnProxiedApp(app, stateDir, proxyPort, tls2, tld, exitCodes) {
+  const usesPortless = app.commandArgs[0] === "portless";
+  const pkgEnv = { ...process.env };
+  pkgEnv.PATH = augmentedPath(pkgEnv, app.pkg.dir);
+  let env;
+  let store = null;
+  let hostname = null;
+  let displayUrl;
+  if (usesPortless) {
+    env = pkgEnv;
+    displayUrl = "(managed by portless)";
+  } else {
+    store = new RouteStore(stateDir, {
+      onWarning: (msg) => console.warn(colors_default.yellow(`[${app.name}] ${msg}`))
+    });
+    const appPort = app.appPort ?? await findFreePort();
+    const protocol = tls2 ? "https" : "http";
+    const portSuffix = tls2 && proxyPort === 443 || !tls2 && proxyPort === 80 ? "" : `:${proxyPort}`;
+    const url = `${protocol}://${app.name}.${tld}${portSuffix}`;
+    displayUrl = url;
+    hostname = parseHostname(app.name, tld);
+    store.addRoute(hostname, appPort, process.pid);
+    env = {
+      ...pkgEnv,
+      PORT: String(appPort),
+      HOST: "127.0.0.1",
+      PORTLESS_URL: url
+    };
+    if (tls2) {
+      const caPath = path8.join(stateDir, "ca.pem");
+      if (fs8.existsSync(caPath)) {
+        env.NODE_EXTRA_CA_CERTS = caPath;
+      }
+    }
+  }
+  const child = spawnChildProcess(app.commandArgs, env, app.pkg.dir);
+  pipeOutput(child, chalk.cyan(`[${app.name}]`));
+  const capturedStore = store;
+  const capturedHostname = hostname;
+  child.on("exit", (code, signal) => {
+    exitCodes.set(app.name, code);
+    if (code !== 0 && code !== null) {
+      console.error(colors_default.red(`[${app.name}] exited with code ${code}`));
+    } else if (signal) {
+      console.error(colors_default.yellow(`[${app.name}] killed by ${signal}`));
+    }
+    if (capturedStore && capturedHostname) {
+      try {
+        capturedStore.removeRoute(capturedHostname);
+      } catch {
+      }
+    }
+  });
+  const route = store && hostname ? { store, hostname } : null;
+  return { child, displayUrl, route };
+}
+function spawnTaskApp(app, exitCodes) {
+  const pkgEnv = { ...process.env };
+  pkgEnv.PATH = augmentedPath(pkgEnv, app.pkg.dir);
+  const child = spawnChildProcess(app.commandArgs, pkgEnv, app.pkg.dir);
+  pipeOutput(child, chalk.gray(`[${app.name}]`));
+  child.on("exit", (code, signal) => {
+    exitCodes.set(app.name, code);
+    if (code !== 0 && code !== null) {
+      console.error(colors_default.red(`[${app.name}] exited with code ${code}`));
+    } else if (signal) {
+      console.error(colors_default.yellow(`[${app.name}] killed by ${signal}`));
+    }
+  });
+  return child;
+}
+async function handleDefaultMulti(wsRoot, globalScript, extraArgs = []) {
+  let loaded;
+  try {
+    loaded = loadConfig(wsRoot);
+  } catch (err) {
+    if (err instanceof ConfigValidationError) {
+      console.error(colors_default.red(`Error: ${err.message}`));
+      process.exit(1);
+    }
+    throw err;
+  }
+  const packages = discoverWorkspacePackages(wsRoot);
+  if (packages.length === 0) {
+    console.error(colors_default.red("Error: No workspace packages found."));
+    process.exit(1);
+  }
+  const scriptName = globalScript ?? loaded?.config.script ?? "dev";
+  let projectName;
+  if (loaded?.config.name) {
+    projectName = loaded.config.name.split(".").map((label) => truncateLabel(label)).join(".");
+  } else {
+    const scopeCounts = /* @__PURE__ */ new Map();
+    for (const p of packages) {
+      if (p.scope) scopeCounts.set(p.scope, (scopeCounts.get(p.scope) ?? 0) + 1);
+    }
+    let commonScope;
+    let maxCount = 0;
+    for (const [scope, count] of scopeCounts) {
+      if (count > maxCount) {
+        commonScope = scope;
+        maxCount = count;
+      }
+    }
+    if (commonScope) {
+      projectName = sanitizeForHostname(commonScope) || inferProjectName(wsRoot).name;
+    } else {
+      projectName = inferProjectName(wsRoot).name;
+    }
+  }
+  const apps = [];
+  for (const pkg of packages) {
+    const rel = path8.relative(wsRoot, pkg.dir).replace(/\\/g, "/");
+    const rootOverride = loaded ? resolveAppConfig(loaded.config, loaded.configDir, pkg.dir) : null;
+    let pkgConfig;
+    try {
+      pkgConfig = loadPackagePortlessConfig(pkg.dir);
+    } catch (err) {
+      if (err instanceof ConfigValidationError) {
+        console.error(colors_default.red(`Error: ${err.message}`));
+        process.exit(1);
+      }
+      throw err;
+    }
+    const appOverride = {
+      ...Object.fromEntries(Object.entries(rootOverride ?? {}).filter(([, v]) => v !== void 0)),
+      ...Object.fromEntries(Object.entries(pkgConfig ?? {}).filter(([, v]) => v !== void 0))
+    };
+    const effectiveScript = appOverride.script ?? scriptName;
+    const scriptValue = pkg.scripts[effectiveScript];
+    if (!scriptValue) continue;
+    const rawScript = splitCommand(scriptValue);
+    if (rawScript.length === 0) continue;
+    const pm = detectPackageManager(pkg.dir);
+    const commandArgs = [pm, "run", effectiveScript];
+    const proxied = appOverride.proxy ?? isServerCommand(rawScript);
+    let name;
+    let label;
+    if (appOverride.name) {
+      name = appOverride.name.split(".").map((l) => truncateLabel(l)).join(".");
+      label = appOverride.name;
+    } else {
+      let pkgLabel;
+      if (pkg.name) {
+        const sanitized = sanitizeForHostname(pkg.name);
+        pkgLabel = sanitized || rel.replace(/\//g, "-");
+      } else {
+        pkgLabel = rel.replace(/\//g, "-");
+      }
+      name = pkgLabel === projectName ? projectName : `${pkgLabel}.${projectName}`;
+      label = pkg.scope ? `@${pkg.scope}/${pkg.name}` : pkg.name ?? rel;
+    }
+    apps.push({ pkg, name, label, commandArgs, appPort: appOverride.appPort, proxied });
+  }
+  if (apps.length === 0) {
+    console.error(colors_default.yellow(`No workspace packages have a "${scriptName}" script.`));
+    process.exit(1);
+  }
+  apps.sort((a, b) => a.label.localeCompare(b.label));
+  const proxiedApps = apps.filter((a) => a.proxied);
+  const taskApps = apps.filter((a) => !a.proxied);
+  console.log(chalk.blue.bold(`
+portless
+`));
+  let { dir, port, tls: tls2, tld } = await discoverState();
+  if (proxiedApps.length > 0) {
+    let multiDesired;
+    try {
+      multiDesired = resolveProxyDesiredState(false);
+    } catch (err) {
+      console.error(colors_default.red(`Error: ${err.message}`));
+      process.exit(1);
+    }
+    const ensureResult = await ensureProxyRunning(port, tls2, multiDesired);
+    if (ensureResult.started) {
+      dir = ensureResult.state.dir;
+      port = ensureResult.state.port;
+      tls2 = ensureResult.state.tls;
+      tld = ensureResult.state.tld;
+    } else {
+      ({ dir, port, tls: tls2, tld } = await discoverState());
+    }
+    if (tls2 && !isCATrusted(dir)) {
+      await handleTrust();
+    }
+  }
+  const useTurbo = loaded?.config.turbo !== false && hasTurboConfig(wsRoot);
+  if (useTurbo) {
+    await runWithTurbo(wsRoot, dir, port, tls2, tld, scriptName, proxiedApps, taskApps, extraArgs);
+  } else {
+    await runWithDirectSpawn(dir, port, tls2, tld, proxiedApps, taskApps);
+  }
+}
+async function runWithTurbo(wsRoot, stateDir, proxyPort, tls2, tld, scriptName, proxiedApps, taskApps, extraArgs = []) {
+  const store = new RouteStore(stateDir, {
+    onWarning: (msg) => console.warn(colors_default.yellow(msg))
+  });
+  const manifest = {};
+  const routes = [];
+  const appUrls = [];
+  for (const app of proxiedApps) {
+    const usesPortless = app.commandArgs[0] === "portless";
+    if (usesPortless) {
+      appUrls.push({ label: app.label, url: "(managed by portless)" });
+      continue;
+    }
+    const appPort = app.appPort ?? await findFreePort();
+    const protocol = tls2 ? "https" : "http";
+    const portSuffix = tls2 && proxyPort === 443 || !tls2 && proxyPort === 80 ? "" : `:${proxyPort}`;
+    const url = `${protocol}://${app.name}.${tld}${portSuffix}`;
+    appUrls.push({ label: app.label, url });
+    const hostname = parseHostname(app.name, tld);
+    store.addRoute(hostname, appPort, process.pid);
+    routes.push({ hostname });
+    const entry = {
+      PORT: String(appPort),
+      HOST: "127.0.0.1",
+      PORTLESS_URL: url
+    };
+    if (tls2) {
+      const caPath = path8.join(stateDir, "ca.pem");
+      if (fs8.existsSync(caPath)) {
+        entry.NODE_EXTRA_CA_CERTS = caPath;
+      }
+    }
+    manifest[app.pkg.dir] = entry;
+  }
+  ensureEnvLoader();
+  writeManifest(manifest);
+  if (appUrls.length > 0) {
+    const maxLabel = Math.max(...appUrls.map((a) => a.label.length));
+    for (const { label, url } of appUrls) {
+      const pad = " ".repeat(maxLabel - label.length);
+      console.log(`  ${label}${pad}  ${chalk.dim(url)}`);
+    }
+  }
+  console.log("");
+  const pm = detectPackageManager(wsRoot);
+  const useRootScript = hasScript(scriptName, wsRoot);
+  const turboArgs = useRootScript ? [pm, "run", scriptName, ...extraArgs] : pm === "npm" ? ["npx", "turbo", "run", scriptName, ...extraArgs] : pm === "bun" ? ["bunx", "turbo", "run", scriptName, ...extraArgs] : [pm, "exec", "turbo", "run", scriptName, ...extraArgs];
+  const turboChild = spawn3(turboArgs[0], turboArgs.slice(1), {
+    stdio: "inherit",
+    cwd: wsRoot,
+    env: {
+      ...process.env,
+      NODE_OPTIONS: buildNodeOptions()
+    }
+  });
+  const SIGKILL_TIMEOUT_MS = 5e3;
+  let cleanedUp = false;
+  const cleanup = () => {
+    if (cleanedUp) return;
+    cleanedUp = true;
+    try {
+      turboChild.kill("SIGTERM");
+    } catch {
+    }
+    setTimeout(() => {
+      if (turboChild.exitCode === null && !turboChild.killed) {
+        try {
+          turboChild.kill("SIGKILL");
+        } catch {
+        }
+      }
+    }, SIGKILL_TIMEOUT_MS).unref();
+    for (const { hostname } of routes) {
+      try {
+        store.removeRoute(hostname);
+      } catch {
+      }
+    }
+    removeManifest();
+  };
+  process.on("SIGINT", cleanup);
+  process.on("SIGTERM", cleanup);
+  const exitCode = await new Promise((resolve3) => {
+    turboChild.on("exit", (code) => resolve3(code));
+  });
+  cleanup();
+  if (exitCode !== 0 && exitCode !== null) {
+    process.exit(exitCode);
+  }
+}
+async function runWithDirectSpawn(stateDir, proxyPort, tls2, tld, proxiedApps, taskApps) {
+  const children = [];
+  const exitCodes = /* @__PURE__ */ new Map();
+  const appUrls = [];
+  const routeEntries = [];
+  for (const app of proxiedApps) {
+    const { child, displayUrl, route } = await spawnProxiedApp(
+      app,
+      stateDir,
+      proxyPort,
+      tls2,
+      tld,
+      exitCodes
+    );
+    children.push(child);
+    if (route) routeEntries.push(route);
+    appUrls.push({ label: app.label, url: displayUrl });
+  }
+  const taskLabels = [];
+  for (const app of taskApps) {
+    children.push(spawnTaskApp(app, exitCodes));
+    taskLabels.push(app.label);
+  }
+  if (appUrls.length > 0) {
+    const maxLabel = Math.max(...appUrls.map((a) => a.label.length));
+    for (const { label, url } of appUrls) {
+      const pad = " ".repeat(maxLabel - label.length);
+      console.log(`  ${label}${pad}  ${chalk.dim(url)}`);
+    }
+  }
+  console.log("");
+  const SIGKILL_TIMEOUT_MS = 5e3;
+  let cleanedUp = false;
+  const cleanup = () => {
+    if (cleanedUp) return;
+    cleanedUp = true;
+    for (const child of children) {
+      try {
+        child.kill("SIGTERM");
+      } catch {
+      }
+    }
+    setTimeout(() => {
+      for (const child of children) {
+        if (child.exitCode === null && !child.killed) {
+          try {
+            child.kill("SIGKILL");
+          } catch {
+          }
+        }
+      }
+    }, SIGKILL_TIMEOUT_MS).unref();
+    for (const { store, hostname } of routeEntries) {
+      try {
+        store.removeRoute(hostname);
+      } catch {
+      }
+    }
+  };
+  process.on("SIGINT", cleanup);
+  process.on("SIGTERM", cleanup);
+  await Promise.all(
+    children.map(
+      (child) => new Promise((resolve3) => {
+        child.on("exit", () => resolve3());
+      })
+    )
+  );
+  const failed = [...exitCodes.entries()].filter(([, code]) => code !== 0 && code !== null);
+  if (failed.length > 0) {
+    console.error(
+      colors_default.red(
+        `
+${failed.length} app${failed.length === 1 ? "" : "s"} exited with errors: ${failed.map(([name, code]) => `${name} (${code})`).join(", ")}`
+      )
+    );
+    process.exit(1);
+  }
+}
+async function handleRunMode(args, globalScript) {
   const parsed = parseRunArgs(args);
+  const appConfig = loadAppConfig();
+  if (parsed.commandArgs.length === 0) {
+    const scriptName = globalScript ?? appConfig?.script ?? "dev";
+    const resolved = resolveScriptCommand(scriptName, process.cwd());
+    if (resolved) {
+      parsed.commandArgs = resolved;
+    }
+  }
   if (parsed.commandArgs.length === 0) {
     console.error(colors_default.red("Error: No command provided."));
     console.error(colors_default.blue("Usage:"));
@@ -2968,11 +4619,17 @@ async function handleRunMode(args) {
   if (parsed.name) {
     baseName = parsed.name.split(".").map((label) => truncateLabel(label)).join(".");
     nameSource = "--name flag";
+  } else if (appConfig?.name) {
+    baseName = appConfig.name.split(".").map((label) => truncateLabel(label)).join(".");
+    nameSource = "portless.json";
   } else {
     const inferred = inferProjectName();
     baseName = inferred.name;
     nameSource = inferred.source;
   }
+  if (!parsed.appPort && appConfig?.appPort) {
+    parsed.appPort = appConfig.appPort;
+  }
   const worktree = detectWorktreePrefix();
   const effectiveName = worktree ? `${worktree.prefix}.${baseName}` : baseName;
   const { dir, port, tls: tls2, tld, lanMode, lanIp } = await discoverState();
@@ -3004,6 +4661,12 @@ async function handleNamedMode(args) {
     console.error(colors_default.cyan("  portless myapp next dev"));
     process.exit(1);
   }
+  if (!parsed.appPort) {
+    const appConfig = loadAppConfig();
+    if (appConfig?.appPort) {
+      parsed.appPort = appConfig.appPort;
+    }
+  }
   const safeName = parsed.name.split(".").map((label) => truncateLabel(label)).join(".");
   const { dir, port, tls: tls2, tld, lanMode, lanIp } = await discoverState();
   const store = new RouteStore(dir, {
@@ -3077,6 +4740,13 @@ async function main() {
     process.env[INTERNAL_LAN_IP_ENV] = autoIpResult;
     process.env.PORTLESS_LAN = "1";
   }
+  const scriptResult = stripGlobalFlag("--script", true);
+  if (scriptResult === false) {
+    console.error(colors_default.red("Error: --script requires a script name."));
+    console.error(colors_default.cyan("  portless --script start"));
+    process.exit(1);
+  }
+  const globalScript = typeof scriptResult === "string" ? scriptResult : void 0;
   if (args[0] === "--name") {
     args.shift();
     if (!args[0]) {
@@ -3102,8 +4772,15 @@ async function main() {
     args.shift();
   }
   const skipPortless = process.env.PORTLESS === "0" || process.env.PORTLESS === "false" || process.env.PORTLESS === "skip";
-  if (skipPortless && (isRunCommand || args.length >= 2 && args[0] !== "proxy" && args[0] !== "clean")) {
-    const { commandArgs } = isRunCommand ? parseRunArgs(args) : parseAppArgs(args);
+  if (skipPortless && (isRunCommand || args.length === 0 || args.length >= 2 && args[0] !== "proxy" && args[0] !== "clean")) {
+    const parsed = isRunCommand ? parseRunArgs(args) : parseAppArgs(args);
+    let commandArgs = parsed.commandArgs;
+    if (commandArgs.length === 0 && (isRunCommand || args.length === 0)) {
+      const appConfig = loadAppConfig();
+      const scriptName = globalScript ?? appConfig?.script ?? "dev";
+      const resolved = resolveScriptCommand(scriptName, process.cwd());
+      if (resolved) commandArgs = resolved;
+    }
     if (commandArgs.length === 0) {
       console.error(colors_default.red("Error: No command provided."));
       process.exit(1);
@@ -3112,7 +4789,14 @@ async function main() {
     return;
   }
   if (!isRunCommand) {
-    if (args.length === 0 || args[0] === "--help" || args[0] === "-h") {
+    if (args[0] === "--help" || args[0] === "-h") {
+      printHelp();
+      return;
+    }
+    if (args.length === 0 || args[0] === "--") {
+      const extraArgs = args[0] === "--" ? args.slice(1) : [];
+      const handled = await handleDefaultMode(globalScript, extraArgs);
+      if (handled) return;
       printHelp();
       return;
     }
@@ -3150,7 +4834,7 @@ async function main() {
     }
   }
   if (isRunCommand) {
-    await handleRunMode(args);
+    await handleRunMode(args, globalScript);
   } else {
     await handleNamedMode(args);
   }