portless 0.14.0 → 0.15.1

package/dist/cli.js

@@ -4,16 +4,20 @@ import {
   PORTLESS_HEADER,
   RouteConflictError,
   RouteStore,
+  checkHostResolution,
   cleanHostsFile,
   createHttpRedirectServer,
   createProxyServer,
   fixOwnership,
   formatUrl,
+  getManagedHostnames,
   isErrnoException,
+  isProcessAlive,
   parseHostname,
+  parseHostnames,
   shouldAutoSyncHosts,
   syncHostsFile
-} from "./chunk-OZM4AEYL.js";
+} from "./chunk-SD2PIWJU.js";
 
 // src/colors.ts
 function supportsColor() {
@@ -498,15 +502,16 @@ async function generateHostCertAsync(stateDir, hostname) {
   fixOwnership(keyPath, certPath);
   return { certPath, keyPath };
 }
-function createSNICallback(stateDir, defaultCert, defaultKey, tld = "localhost", caCert) {
+function createSNICallback(stateDir, defaultCert, defaultKey, tlds = "localhost", caCert) {
   const cache = /* @__PURE__ */ new Map();
   const pending = /* @__PURE__ */ new Map();
+  const configuredTlds = Array.isArray(tlds) ? tlds : [tlds];
   const defaultCtx = tls.createSecureContext({
     cert: caCert ? Buffer.concat([defaultCert, caCert]) : defaultCert,
     key: defaultKey
   });
   return (servername, cb) => {
-    if (servername === tld) {
+    if (servername === "localhost" && configuredTlds.includes("localhost")) {
       cb(null, defaultCtx);
       return;
     }
@@ -1503,6 +1508,7 @@ function readPortFromDir(dir) {
   }
 }
 var TLS_MARKER_FILE = "proxy.tls";
+var CUSTOM_CERT_MARKER_FILE = "proxy.custom-cert";
 function readTlsMarker(dir) {
   try {
     return fs3.existsSync(path3.join(dir, TLS_MARKER_FILE));
@@ -1521,6 +1527,24 @@ function writeTlsMarker(dir, enabled2) {
     }
   }
 }
+function readCustomCertMarker(dir) {
+  try {
+    return fs3.existsSync(path3.join(dir, CUSTOM_CERT_MARKER_FILE));
+  } catch {
+    return false;
+  }
+}
+function writeCustomCertMarker(dir, enabled2) {
+  const markerPath = path3.join(dir, CUSTOM_CERT_MARKER_FILE);
+  if (enabled2) {
+    fs3.writeFileSync(markerPath, "1", { mode: 420 });
+  } else {
+    try {
+      fs3.unlinkSync(markerPath);
+    } catch {
+    }
+  }
+}
 var LAN_MARKER_FILE = "proxy.lan";
 function readLanMarker(dir) {
   try {
@@ -1562,8 +1586,25 @@ function validateTld(tld) {
   }
   return null;
 }
+function parseTldList(value, source = "TLD") {
+  const trimmed = value.trim();
+  if (!trimmed) return [];
+  const tlds = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const rawPart of trimmed.split(",")) {
+    const tld = rawPart.trim().toLowerCase();
+    const err = validateTld(tld);
+    if (err) throw new Error(source === "TLD" ? err : `${source}: ${err}`);
+    if (!seen.has(tld)) {
+      seen.add(tld);
+      tlds.push(tld);
+    }
+  }
+  return tlds;
+}
 var TLD_FILE = "proxy.tld";
-function readTldFromDir(dir) {
+var TLDS_FILE = "proxy.tlds";
+function readLegacyTldFromDir(dir) {
   try {
     const raw = fs3.readFileSync(path3.join(dir, TLD_FILE), "utf-8").trim();
     return raw || DEFAULT_TLD;
@@ -1571,23 +1612,43 @@ function readTldFromDir(dir) {
     return DEFAULT_TLD;
   }
 }
-function writeTldFile(dir, tld) {
-  const filePath = path3.join(dir, TLD_FILE);
-  if (tld === DEFAULT_TLD) {
+function readTldsFromDir(dir) {
+  try {
+    const raw = fs3.readFileSync(path3.join(dir, TLDS_FILE), "utf-8").trim();
+    const parsed = raw.startsWith("[") ? JSON.parse(raw) : raw.split(/\r?\n/).flatMap((line) => line.split(",")).map((line) => line.trim()).filter(Boolean);
+    if (!Array.isArray(parsed)) return [readLegacyTldFromDir(dir)];
+    const tlds = parsed.flatMap((value) => typeof value === "string" ? parseTldList(value) : []);
+    return tlds.length > 0 ? [...new Set(tlds)] : [DEFAULT_TLD];
+  } catch {
+    return [readLegacyTldFromDir(dir)];
+  }
+}
+function writeTldsFile(dir, tlds) {
+  const uniqueTlds = [...new Set(tlds)];
+  const tldsPath = path3.join(dir, TLDS_FILE);
+  const tldPath = path3.join(dir, TLD_FILE);
+  if (uniqueTlds.length === 1 && uniqueTlds[0] === DEFAULT_TLD) {
+    try {
+      fs3.unlinkSync(tldsPath);
+    } catch {
+    }
     try {
-      fs3.unlinkSync(filePath);
+      fs3.unlinkSync(tldPath);
     } catch {
     }
   } else {
-    fs3.writeFileSync(filePath, tld, { mode: 420 });
+    fs3.writeFileSync(tldsPath, uniqueTlds.join("\n") + "\n", { mode: 420 });
+    fs3.writeFileSync(tldPath, uniqueTlds[0] ?? DEFAULT_TLD, { mode: 420 });
   }
 }
-function getDefaultTld() {
+function writeTldFile(dir, tld) {
+  writeTldsFile(dir, [tld]);
+}
+function getDefaultTlds() {
   const val = process.env.PORTLESS_TLD?.trim().toLowerCase();
-  if (!val) return DEFAULT_TLD;
-  const err = validateTld(val);
-  if (err) throw new Error(`PORTLESS_TLD: ${err}`);
-  return val;
+  if (!val) return [DEFAULT_TLD];
+  const tlds = parseTldList(val, "PORTLESS_TLD");
+  return tlds.length > 0 ? tlds : [DEFAULT_TLD];
 }
 function isHttpsEnvDisabled() {
   const val = process.env.PORTLESS_HTTPS;
@@ -1606,14 +1667,17 @@ function readPersistedProxyState() {
   const port = readPortFromDir(dir);
   if (port !== null) {
     const tls2 = readTlsMarker(dir);
-    const tld = readTldFromDir(dir);
+    const tlds = readTldsFromDir(dir);
+    const tld = tlds[0] ?? DEFAULT_TLD;
     const lanIp = readLanMarker(dir);
-    return { port, tls: tls2, tld, lanMode: lanIp !== null || tld === "local" };
+    return { port, tls: tls2, tld, tlds, lanMode: lanIp !== null || tlds.includes("local") };
   }
   return null;
 }
 function buildProxyStartConfig(options) {
-  const effectiveTld = options.lanMode ? "local" : options.tld;
+  const requestedTlds = options.tlds && options.tlds.length > 0 ? [...options.tlds] : [options.tld];
+  const effectiveTlds = options.lanMode ? ["local"] : [...new Set(requestedTlds)];
+  const effectiveTld = effectiveTlds[0] ?? DEFAULT_TLD;
   const args = [];
   if (options.foreground) {
     args.push("--foreground");
@@ -1639,8 +1703,10 @@ function buildProxyStartConfig(options) {
         args.push(INTERNAL_LAN_IP_FLAG, options.lanIp);
       }
     }
-  } else if (effectiveTld !== DEFAULT_TLD) {
-    args.push("--tld", effectiveTld);
+  } else if (effectiveTlds.length > 1 || effectiveTld !== DEFAULT_TLD) {
+    for (const tld of effectiveTlds) {
+      args.push("--tld", tld);
+    }
   }
   if (options.useWildcard) {
     args.push("--wildcard");
@@ -1648,7 +1714,7 @@ function buildProxyStartConfig(options) {
   if (options.skipTrust) {
     args.push("--skip-trust");
   }
-  return { effectiveTld, args };
+  return { effectiveTld, effectiveTlds, args };
 }
 async function discoverState() {
   if (process.env.PORTLESS_STATE_DIR) {
@@ -1657,14 +1723,25 @@ async function discoverState() {
     const lanIp = readLanMarker(dir2);
     if (await isProxyRunning(port) || await isPortListening(port)) {
       const tls2 = readTlsMarker(dir2);
-      const tld = readTldFromDir(dir2);
-      return { dir: dir2, port, tls: tls2, tld, lanMode: lanIp !== null || tld === "local", lanIp };
+      const tlds3 = readTldsFromDir(dir2);
+      const tld = tlds3[0] ?? DEFAULT_TLD;
+      return {
+        dir: dir2,
+        port,
+        tls: tls2,
+        tld,
+        tlds: tlds3,
+        lanMode: lanIp !== null || tlds3.includes("local"),
+        lanIp
+      };
     }
+    const tlds2 = readTldsFromDir(dir2);
     return {
       dir: dir2,
       port,
       tls: readTlsMarker(dir2),
-      tld: readTldFromDir(dir2),
+      tld: tlds2[0] ?? DEFAULT_TLD,
+      tlds: tlds2,
       lanMode: lanIp !== null,
       lanIp: null
     };
@@ -1673,14 +1750,16 @@ async function discoverState() {
   if (userPort !== null) {
     if (await isProxyRunning(userPort)) {
       const tls2 = readTlsMarker(USER_STATE_DIR);
-      const tld = readTldFromDir(USER_STATE_DIR);
+      const tlds2 = readTldsFromDir(USER_STATE_DIR);
+      const tld = tlds2[0] ?? DEFAULT_TLD;
       const lanIp = readLanMarker(USER_STATE_DIR);
       return {
         dir: USER_STATE_DIR,
         port: userPort,
         tls: tls2,
         tld,
-        lanMode: lanIp !== null || tld === "local",
+        tlds: tlds2,
+        lanMode: lanIp !== null || tlds2.includes("local"),
         lanIp
       };
     }
@@ -1689,14 +1768,16 @@ async function discoverState() {
   if (legacyPort !== null) {
     if (await isProxyRunning(legacyPort)) {
       const tls2 = readTlsMarker(LEGACY_SYSTEM_STATE_DIR);
-      const tld = readTldFromDir(LEGACY_SYSTEM_STATE_DIR);
+      const tlds2 = readTldsFromDir(LEGACY_SYSTEM_STATE_DIR);
+      const tld = tlds2[0] ?? DEFAULT_TLD;
       const lanIp = readLanMarker(LEGACY_SYSTEM_STATE_DIR);
       return {
         dir: LEGACY_SYSTEM_STATE_DIR,
         port: legacyPort,
         tls: tls2,
         tld,
-        lanMode: lanIp !== null || tld === "local",
+        tlds: tlds2,
+        lanMode: lanIp !== null || tlds2.includes("local"),
         lanIp
       };
     }
@@ -1708,17 +1789,28 @@ async function discoverState() {
       const dir2 = resolveStateDir(port);
       const markerTls = readTlsMarker(dir2);
       const tls2 = markerTls || port === getProtocolPort(true);
-      const tld = readTldFromDir(dir2);
+      const tlds2 = readTldsFromDir(dir2);
+      const tld = tlds2[0] ?? DEFAULT_TLD;
       const lanIp = readLanMarker(dir2);
-      return { dir: dir2, port, tls: tls2, tld, lanMode: lanIp !== null || tld === "local", lanIp };
+      return {
+        dir: dir2,
+        port,
+        tls: tls2,
+        tld,
+        tlds: tlds2,
+        lanMode: lanIp !== null || tlds2.includes("local"),
+        lanIp
+      };
     }
   }
   const dir = resolveStateDir(configuredPort);
+  const tlds = readTldsFromDir(dir);
   return {
     dir,
     port: configuredPort,
     tls: readTlsMarker(dir),
-    tld: readTldFromDir(dir),
+    tld: tlds[0] ?? DEFAULT_TLD,
+    tlds,
     lanMode: readLanMarker(dir) !== null,
     lanIp: null
   };
@@ -2001,7 +2093,9 @@ var PORTLESS_STATE_FILES = [
   "proxy.port",
   "proxy.log",
   "proxy.tls",
+  "proxy.custom-cert",
   "proxy.tld",
+  "proxy.tlds",
   "proxy.lan",
   "ca-key.pem",
   "ca.pem",
@@ -2774,6 +2868,15 @@ var SYSTEMD_SERVICE = "portless.service";
 var WINDOWS_TASK_NAME = "Portless Proxy";
 var INTERNAL_ELEVATED_ENV = "PORTLESS_INTERNAL_SERVICE_ELEVATED";
 var SERVICE_ENV_KEYS = /* @__PURE__ */ new Set(["PORTLESS_SYNC_HOSTS"]);
+function normalizeTlds(tlds) {
+  return [...new Set(tlds.length > 0 ? tlds : [DEFAULT_TLD])];
+}
+function primaryTld(tlds) {
+  return tlds[0] ?? DEFAULT_TLD;
+}
+function formatTldList(tlds) {
+  return tlds.map((tld) => `.${tld}`).join(", ");
+}
 var DEFAULT_SERVICE_CONFIG = {
   proxyPort: DEFAULT_SERVICE_PORT,
   useHttps: true,
@@ -2783,6 +2886,7 @@ var DEFAULT_SERVICE_CONFIG = {
   lanIp: null,
   lanIpExplicit: false,
   tld: DEFAULT_TLD,
+  tlds: [DEFAULT_TLD],
   useWildcard: false,
   extraEnv: {}
 };
@@ -2869,10 +2973,8 @@ function parseServiceInstallConfig(args, env = process.env, options = {}) {
     config.lanIpExplicit = true;
   }
   if (env.PORTLESS_TLD) {
-    const tld = env.PORTLESS_TLD.trim().toLowerCase();
-    const err = validateTld(tld);
-    if (err) throw new Error(`PORTLESS_TLD: ${err}`);
-    config.tld = tld;
+    config.tlds = normalizeTlds(parseTldList(env.PORTLESS_TLD, "PORTLESS_TLD"));
+    config.tld = primaryTld(config.tlds);
   }
   const envWildcard = parseBooleanEnv(env.PORTLESS_WILDCARD);
   if (envWildcard !== null) {
@@ -2884,6 +2986,7 @@ function parseServiceInstallConfig(args, env = process.env, options = {}) {
     config.proxyPort = getProtocolPort(config.useHttps);
   }
   const tokens = args[0] === "service" ? args.slice(2) : args;
+  let tldFlagSeen = false;
   for (let i = 0; i < tokens.length; i += 1) {
     const token = tokens[i];
     switch (token) {
@@ -2908,10 +3011,10 @@ function parseServiceInstallConfig(args, env = process.env, options = {}) {
         i += 1;
         break;
       case "--tld": {
-        const tld = getFlagValue(tokens, i, token).trim().toLowerCase();
-        const err = validateTld(tld);
-        if (err) throw new Error(err);
-        config.tld = tld;
+        const tlds = parseTldList(getFlagValue(tokens, i, token));
+        config.tlds = normalizeTlds([...tldFlagSeen ? config.tlds : [], ...tlds]);
+        config.tld = primaryTld(config.tlds);
+        tldFlagSeen = true;
         i += 1;
         break;
       }
@@ -2951,6 +3054,9 @@ function parseServiceInstallConfig(args, env = process.env, options = {}) {
   if (!config.lanMode) {
     config.lanIp = null;
     config.lanIpExplicit = false;
+  } else {
+    config.tlds = ["local"];
+    config.tld = "local";
   }
   return config;
 }
@@ -2996,6 +3102,7 @@ function buildProxyCommand(entryScript, serviceConfig) {
     lanIp: serviceConfig.lanIp,
     lanIpExplicit: serviceConfig.lanIpExplicit,
     tld: serviceConfig.tld,
+    tlds: serviceConfig.tlds,
     useWildcard: serviceConfig.useWildcard,
     foreground: true,
     includePort: true,
@@ -3018,8 +3125,8 @@ function buildServiceEnv(ctx) {
   }
   if (ctx.config.lanMode) {
     env.PORTLESS_TLD = "local";
-  } else if (ctx.config.tld !== DEFAULT_TLD) {
-    env.PORTLESS_TLD = ctx.config.tld;
+  } else if (ctx.config.tlds.length > 1 || ctx.config.tld !== DEFAULT_TLD) {
+    env.PORTLESS_TLD = ctx.config.tlds.join(",");
   }
   if (ctx.platform === "win32") {
     env.USERPROFILE = ctx.user.home;
@@ -3104,6 +3211,10 @@ function buildServiceSpec(options) {
     ...options.installConfig,
     extraEnv: options.installConfig?.extraEnv ?? {}
   };
+  installConfig.tlds = installConfig.lanMode ? ["local"] : normalizeTlds(
+    options.installConfig?.tlds ?? (options.installConfig?.tld ? [options.installConfig.tld] : installConfig.tlds)
+  );
+  installConfig.tld = primaryTld(installConfig.tlds);
   const stateDir = options.stateDir || installConfig.stateDir || defaultStateDir(options.platform, options.userHome);
   const normalizedConfig = {
     ...installConfig,
@@ -3594,7 +3705,7 @@ async function printServiceStatus(entryScript, runner) {
     `  Proxy on ${config.proxyPort}: ${status.proxyRunning ? "responding" : "not responding"}`
   );
   console.log(`  HTTPS: ${config.useHttps ? "yes" : "no"}`);
-  console.log(`  TLD: ${config.lanMode ? "local" : config.tld}`);
+  console.log(`  TLDs: ${config.lanMode ? ".local" : formatTldList(config.tlds)}`);
   console.log(`  LAN mode: ${config.lanMode ? "yes" : "no"}`);
   if (config.lanIpExplicit && config.lanIp) {
     console.log(`  LAN IP: ${config.lanIp}`);
@@ -3622,7 +3733,7 @@ ${colors_default.bold("Install options:")}
   --https                          Enable HTTPS
   --lan                            Enable LAN mode
   --ip <address>                   Pin a specific LAN IP
-  --tld <tld>                      Use a custom TLD outside LAN mode
+  --tld <tld>                      Use a custom TLD outside LAN mode, repeatable
   --wildcard                       Allow subdomain fallback
   --cert <path>                    Use a custom TLS certificate
   --key <path>                     Use a custom TLS private key
@@ -3672,7 +3783,17 @@ var DEBOUNCE_MS = 100;
 var POLL_INTERVAL_MS = 3e3;
 var EXIT_TIMEOUT_MS = 2e3;
 var SUDO_SPAWN_TIMEOUT_MS = 3e4;
-function defaultProxyConfig(tld, useHttps, lanMode) {
+function normalizeTlds2(tlds) {
+  return [...new Set(tlds.length > 0 ? tlds : [DEFAULT_TLD])];
+}
+function primaryTld2(tlds) {
+  return tlds[0] ?? DEFAULT_TLD;
+}
+function formatTldList2(tlds) {
+  return tlds.map((tld) => `.${tld}`).join(", ");
+}
+function defaultProxyConfig(tlds, useHttps, lanMode) {
+  const effectiveTlds = lanMode ? ["local"] : normalizeTlds2(tlds);
   return {
     useHttps,
     customCertPath: null,
@@ -3680,13 +3801,14 @@ function defaultProxyConfig(tld, useHttps, lanMode) {
     lanMode,
     lanIp: null,
     lanIpExplicit: false,
-    tld: lanMode ? "local" : tld,
+    tld: primaryTld2(effectiveTlds),
+    tlds: effectiveTlds,
     useWildcard: false
   };
 }
 function resolveProxyConfig(options) {
   const config = defaultProxyConfig(
-    options.defaultTld,
+    options.defaultTlds,
     options.useHttps,
     options.explicit.lanMode ? options.lanMode : options.persistedLanMode
   );
@@ -3707,8 +3829,9 @@ function resolveProxyConfig(options) {
     if (!options.lanMode) {
       config.lanIp = null;
       config.lanIpExplicit = false;
-      if (!options.explicit.tld) {
-        config.tld = options.defaultTld;
+      if (!options.explicit.tlds) {
+        config.tlds = normalizeTlds2(options.defaultTlds);
+        config.tld = primaryTld2(config.tlds);
       }
     }
   }
@@ -3717,8 +3840,9 @@ function resolveProxyConfig(options) {
     config.lanIp = options.lanIp;
     config.lanIpExplicit = true;
   }
-  if (options.explicit.tld) {
-    config.tld = options.tld;
+  if (options.explicit.tlds) {
+    config.tlds = normalizeTlds2(options.tlds);
+    config.tld = primaryTld2(config.tlds);
   }
   if (options.explicit.useWildcard) {
     config.useWildcard = options.useWildcard;
@@ -3728,6 +3852,7 @@ function resolveProxyConfig(options) {
     config.lanIpExplicit = false;
   }
   if (config.lanMode) {
+    config.tlds = ["local"];
     config.tld = "local";
     if (!config.lanIpExplicit) {
       config.lanIp = null;
@@ -3741,15 +3866,17 @@ function resolveProxyConfig(options) {
 }
 function readCurrentProxyConfig(dir) {
   const lanIp = readLanMarker(dir);
-  const tld = readTldFromDir(dir);
+  const tlds = readTldsFromDir(dir);
+  const tld = primaryTld2(tlds);
   return {
     useHttps: readTlsMarker(dir),
     customCertPath: null,
     customKeyPath: null,
-    lanMode: lanIp !== null || tld === "local",
+    lanMode: lanIp !== null || tlds.includes("local"),
     lanIp,
     lanIpExplicit: false,
     tld,
+    tlds,
     useWildcard: false
   };
 }
@@ -3770,9 +3897,9 @@ function getProxyConfigMismatchMessages(desiredConfig, actualConfig, explicit) {
       desiredConfig.useHttps ? "requested HTTPS, but the running proxy is using HTTP" : "requested HTTP, but the running proxy is using HTTPS"
     );
   }
-  if (explicit.tld && desiredConfig.tld !== actualConfig.tld) {
+  if (explicit.tlds && (desiredConfig.tlds.length !== actualConfig.tlds.length || desiredConfig.tlds.some((tld, index) => tld !== actualConfig.tlds[index]))) {
     messages.push(
-      `requested .${desiredConfig.tld}, but the running proxy is using .${actualConfig.tld}`
+      `requested ${formatTldList2(desiredConfig.tlds)}, but the running proxy is using ${formatTldList2(actualConfig.tlds)}`
     );
   }
   return messages;
@@ -3787,6 +3914,7 @@ function formatProxyStartCommand(proxyPort, config) {
     lanIp: config.lanIpExplicit ? config.lanIp : null,
     lanIpExplicit: config.lanIpExplicit,
     tld: config.tld,
+    tlds: config.tlds,
     useWildcard: config.useWildcard,
     includePort: proxyPort !== getDefaultPort(config.useHttps),
     proxyPort
@@ -3880,7 +4008,46 @@ function formatProcessExitSuffix(code, signal) {
   if (code !== null) return ` (exit ${code})`;
   return "";
 }
-function startProxyServer(store, proxyPort, tld, tlsOptions, lanIp, strict) {
+function buildHostnames(name, tlds) {
+  return parseHostnames(name, normalizeTlds2(tlds));
+}
+function formatUrls(hostnames, proxyPort, tls2) {
+  return hostnames.map((hostname) => formatUrl(hostname, proxyPort, tls2));
+}
+function formatViteAllowedHosts(tlds) {
+  return tlds.map((configuredTld) => `.${configuredTld}`).join(",");
+}
+function addRoutes(store, hostnames, port, pid, force = false) {
+  const registered = [];
+  const killedPids = [];
+  try {
+    for (const hostname of hostnames) {
+      const killedPid = store.addRoute(hostname, port, pid, force);
+      registered.push(hostname);
+      if (killedPid !== void 0) {
+        killedPids.push(killedPid);
+      }
+    }
+  } catch (err) {
+    for (const hostname of registered) {
+      try {
+        store.removeRoute(hostname, pid);
+      } catch {
+      }
+    }
+    throw err;
+  }
+  return [...new Set(killedPids)];
+}
+function removeRoutes(store, hostnames, ownerPid) {
+  for (const hostname of hostnames) {
+    try {
+      store.removeRoute(hostname, ownerPid);
+    } catch {
+    }
+  }
+}
+function startProxyServer(store, proxyPort, tld, tlds, tlsOptions, lanIp, strict, customCert = false) {
   store.ensureDir();
   const isTls = !!tlsOptions;
   const mdnsSupport = isMdnsSupported();
@@ -3972,6 +4139,7 @@ function startProxyServer(store, proxyPort, tld, tlsOptions, lanIp, strict) {
     getRoutes: () => cachedRoutes,
     proxyPort,
     tld,
+    tlds,
     strict,
     onError: (msg) => console.error(colors_default.red(msg)),
     tls: tlsOptions
@@ -4009,11 +4177,12 @@ function startProxyServer(store, proxyPort, tld, tlsOptions, lanIp, strict) {
     fs9.writeFileSync(store.pidPath, process.pid.toString(), { mode: FILE_MODE });
     fs9.writeFileSync(store.portFilePath, proxyPort.toString(), { mode: FILE_MODE });
     writeTlsMarker(store.dir, isTls);
-    writeTldFile(store.dir, tld);
+    writeCustomCertMarker(store.dir, isTls && customCert);
+    writeTldsFile(store.dir, tlds);
     writeLanMarker(store.dir, activeLanIp);
     fixOwnership(store.dir, store.pidPath, store.portFilePath);
     const proto = isTls ? "HTTPS/2" : "HTTP";
-    const tldLabel = tld !== DEFAULT_TLD ? ` (TLD: .${tld})` : "";
+    const tldLabel = tlds.length > 1 || tld !== DEFAULT_TLD ? ` (TLDs: ${formatTldList2(tlds)})` : "";
     const modeLabel = strict === false ? " (wildcard)" : "";
     console.log(
       colors_default.green(`${proto} proxy listening on port ${proxyPort}${tldLabel}${modeLabel}`)
@@ -4021,7 +4190,7 @@ function startProxyServer(store, proxyPort, tld, tlsOptions, lanIp, strict) {
     if (activeLanIp) {
       console.log(chalk.green(`LAN mode: ${activeLanIp}`));
       console.log(chalk.gray("Services are discoverable as <name>.local on your network"));
-      if (isTls) {
+      if (isTls && !customCert) {
         console.log(chalk.yellow("For HTTPS on devices, install the CA certificate:"));
         console.log(chalk.gray(`  ${path9.join(store.dir, "ca.pem")}`));
       }
@@ -4063,6 +4232,7 @@ function startProxyServer(store, proxyPort, tld, tlsOptions, lanIp, strict) {
     } catch {
     }
     writeTlsMarker(store.dir, false);
+    writeCustomCertMarker(store.dir, false);
     writeTldFile(store.dir, DEFAULT_TLD);
     writeLanMarker(store.dir, null);
     if (autoSyncHosts) cleanHostsFile();
@@ -4101,6 +4271,7 @@ async function stopProxy(store, proxyPort, _tls) {
           } catch {
           }
           writeTlsMarker(store.dir, false);
+          writeCustomCertMarker(store.dir, false);
           writeTldFile(store.dir, DEFAULT_TLD);
           writeLanMarker(store.dir, null);
           console.log(colors_default.green(`Killed process ${pid}. Proxy stopped.`));
@@ -4140,6 +4311,7 @@ async function stopProxy(store, proxyPort, _tls) {
       console.error(colors_default.red("Corrupted PID file. Removing it."));
       fs9.unlinkSync(pidPath);
       writeTlsMarker(store.dir, false);
+      writeCustomCertMarker(store.dir, false);
       writeTldFile(store.dir, DEFAULT_TLD);
       writeLanMarker(store.dir, null);
       return;
@@ -4158,6 +4330,7 @@ async function stopProxy(store, proxyPort, _tls) {
       } catch {
       }
       writeTlsMarker(store.dir, false);
+      writeCustomCertMarker(store.dir, false);
       writeTldFile(store.dir, DEFAULT_TLD);
       writeLanMarker(store.dir, null);
       return;
@@ -4171,6 +4344,7 @@ async function stopProxy(store, proxyPort, _tls) {
       console.log(colors_default.yellow("Removing stale PID file."));
       fs9.unlinkSync(pidPath);
       writeTlsMarker(store.dir, false);
+      writeCustomCertMarker(store.dir, false);
       writeTldFile(store.dir, DEFAULT_TLD);
       writeLanMarker(store.dir, null);
       return;
@@ -4182,6 +4356,7 @@ async function stopProxy(store, proxyPort, _tls) {
     } catch {
     }
     writeTlsMarker(store.dir, false);
+    writeCustomCertMarker(store.dir, false);
     writeTldFile(store.dir, DEFAULT_TLD);
     writeLanMarker(store.dir, null);
     console.log(colors_default.green("Proxy stopped."));
@@ -4225,28 +4400,29 @@ function listRoutes(store, proxyPort, tls2) {
   console.log();
 }
 function resolveProxyDesiredState(lanMode) {
-  const envTld = getDefaultTld();
+  const envTlds = getDefaultTlds();
+  const envTld = primaryTld2(envTlds);
   const explicit = {
     useHttps: process.env.PORTLESS_HTTPS !== void 0,
     customCert: false,
     lanMode: process.env.PORTLESS_LAN !== void 0,
     lanIp: process.env.PORTLESS_LAN_IP !== void 0,
-    tld: process.env.PORTLESS_TLD !== void 0,
+    tlds: process.env.PORTLESS_TLD !== void 0,
     useWildcard: process.env.PORTLESS_WILDCARD !== void 0
   };
   const desiredConfig = resolveProxyConfig({
     persistedLanMode: lanMode,
     explicit,
-    defaultTld: envTld,
+    defaultTlds: envTlds,
     useHttps: !isHttpsEnvDisabled(),
     customCertPath: null,
     customKeyPath: null,
     lanMode: isLanEnvEnabled(),
     lanIp: process.env.PORTLESS_LAN_IP || null,
-    tld: envTld,
+    tlds: envTlds,
     useWildcard: isWildcardEnvEnabled()
   });
-  return { explicit, desiredConfig, envTld };
+  return { explicit, desiredConfig, envTld, envTlds };
 }
 async function ensureProxyRunning(proxyPort, tls2, desired) {
   const { explicit, desiredConfig } = desired;
@@ -4262,8 +4438,9 @@ async function ensureProxyRunning(proxyPort, tls2, desired) {
     if (!explicit.useHttps && persisted.tls !== desiredConfig.useHttps) {
       startConfig.useHttps = persisted.tls;
     }
-    if (!explicit.tld && persisted.tld !== desiredConfig.tld) {
-      startConfig.tld = persisted.tld;
+    if (!explicit.tlds && (persisted.tlds.length !== desiredConfig.tlds.length || persisted.tlds.some((tld, index) => tld !== desiredConfig.tlds[index]))) {
+      startConfig.tlds = persisted.tlds;
+      startConfig.tld = primaryTld2(persisted.tlds);
     }
     if (!explicit.lanMode && persisted.lanMode !== desiredConfig.lanMode) {
       startConfig.lanMode = persisted.lanMode;
@@ -4299,6 +4476,7 @@ async function ensureProxyRunning(proxyPort, tls2, desired) {
     lanIp: startConfig.lanIpExplicit ? startConfig.lanIp : null,
     lanIpExplicit: startConfig.lanIpExplicit,
     tld: startConfig.tld,
+    tlds: startConfig.tlds,
     useWildcard: startConfig.useWildcard,
     includePort: startPort !== void 0,
     proxyPort: startPort
@@ -4333,7 +4511,7 @@ async function ensureProxyRunning(proxyPort, tls2, desired) {
   }
   return { started: true, state: discovered };
 }
-async function runApp(initialStore, proxyPort, stateDir, name, commandArgs, tls2, tld, force, autoInfo, desiredPort, lanMode = false, lanIp) {
+async function runApp(initialStore, proxyPort, stateDir, name, commandArgs, tls2, tlds, force, autoInfo, desiredPort, lanMode = false, lanIp) {
   let store = initialStore;
   console.log(chalk.blue.bold(`
 portless
@@ -4380,12 +4558,12 @@ portless
     console.error(colors_default.red(`Error: ${err.message}`));
     process.exit(1);
   }
-  parseHostname(name, tld);
+  buildHostnames(name, tlds);
   const ensureResult = await ensureProxyRunning(proxyPort, tls2, desired);
   if (ensureResult.started) {
     proxyPort = ensureResult.state.port;
     stateDir = ensureResult.state.dir;
-    tld = ensureResult.state.tld;
+    tlds = ensureResult.state.tlds;
     tls2 = ensureResult.state.tls;
     lanMode = ensureResult.state.lanMode;
     lanIp = ensureResult.state.lanIp;
@@ -4407,20 +4585,22 @@ portless
     }
     lanMode = runningConfig.lanMode;
     lanIp = runningConfig.lanIp;
+    tlds = runningConfig.tlds;
     console.log(chalk.gray("-- Proxy is running"));
   }
-  const hostname = parseHostname(name, tld);
-  if (desired.envTld !== DEFAULT_TLD && desired.envTld !== tld) {
+  const hostnames = buildHostnames(name, tlds);
+  const hostname = hostnames[0];
+  if (desired.explicit.tlds && (desired.envTlds.some((envConfiguredTld, index) => envConfiguredTld !== tlds[index]) || desired.envTlds.length !== tlds.length)) {
     console.warn(
       chalk.yellow(
-        `Warning: PORTLESS_TLD=${desired.envTld} but the running proxy uses .${tld}. Using .${tld}.`
+        `Warning: PORTLESS_TLD=${desired.envTlds.join(",")} but the running proxy uses ${formatTldList2(tlds)}.`
       )
     );
   }
   if (lanIp) {
-    console.log(chalk.gray(`-- ${hostname} (LAN: ${lanIp})`));
+    console.log(chalk.gray(`-- ${hostnames.join(", ")} (LAN: ${lanIp})`));
   } else {
-    console.log(chalk.gray(`-- ${hostname} (auto-resolves to 127.0.0.1)`));
+    console.log(chalk.gray(`-- ${hostnames.join(", ")} (auto-resolves to 127.0.0.1)`));
   }
   if (autoInfo) {
     const baseName = autoInfo.prefix ? name.slice(autoInfo.prefix.length + 1) : name;
@@ -4435,9 +4615,9 @@ portless
   } else {
     console.log(colors_default.green(`-- Using port ${port}`));
   }
-  let killedPid;
+  let killedPids = [];
   try {
-    killedPid = store.addRoute(hostname, port, process.pid, force);
+    killedPids = addRoutes(store, hostnames, port, process.pid, force);
   } catch (err) {
     if (err instanceof RouteConflictError) {
       console.error(colors_default.red(`Error: ${err.message}`));
@@ -4445,13 +4625,20 @@ portless
     }
     throw err;
   }
-  if (killedPid !== void 0) {
-    console.log(colors_default.yellow(`Killed existing process (PID ${killedPid})`));
+  if (killedPids.length > 0) {
+    console.log(colors_default.yellow(`Killed existing process(es): ${killedPids.join(", ")}`));
   }
   const finalUrl = formatUrl(hostname, proxyPort, tls2);
+  const allUrls = formatUrls(hostnames, proxyPort, tls2);
   console.log(chalk.cyan.bold(`
   -> ${finalUrl}
 `));
+  for (const extraUrl of allUrls.slice(1)) {
+    console.log(chalk.cyan(`  also -> ${extraUrl}`));
+  }
+  if (allUrls.length > 1) {
+    console.log("");
+  }
   if (lanIp) {
     console.log(chalk.green(`  LAN -> ${finalUrl}`));
     console.log(chalk.gray("  (accessible from other devices on the same WiFi network)\n"));
@@ -4564,7 +4751,7 @@ portless
       } catch {
       }
       try {
-        store.removeRoute(hostname);
+        removeRoutes(store, hostnames, process.pid);
       } catch {
       }
       process.exit(1);
@@ -4598,7 +4785,7 @@ portless
       PORT: port.toString(),
       ...hostBind ? { HOST: hostBind } : {},
       PORTLESS_URL: finalUrl,
-      __VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS: `.${tld}`,
+      __VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS: formatViteAllowedHosts(tlds),
       // Note: EXPO_PACKAGER_PROXY_URL is not used — expo-dev-client removed
       // baked-in pinging, making this env var ineffective. Expo handles its
       // own LAN discovery natively.
@@ -4618,7 +4805,7 @@ portless
       } catch {
       }
       try {
-        store.removeRoute(hostname);
+        removeRoutes(store, hostnames, process.pid);
       } catch {
       }
     }
@@ -4803,13 +4990,14 @@ ${colors_default.bold("Usage:")}
   ${colors_default.cyan("portless run")}                     Same as above
   ${colors_default.cyan("portless run <cmd>")}               Run a command through the proxy
   ${colors_default.cyan("portless <name> <cmd>")}            Run with an explicit app name
-  ${colors_default.cyan("portless proxy start")}             Start the proxy (HTTPS on port 443, daemon)
+  ${colors_default.cyan("portless proxy start")}             Start the proxy (HTTPS on port 443, daemon); rarely needed since it auto-starts on first run
   ${colors_default.cyan("portless proxy stop")}              Stop the proxy
   ${colors_default.cyan("portless service install")}         Start proxy automatically when the OS starts
   ${colors_default.cyan("portless get <name>")}              Print URL for a service (for cross-service refs)
   ${colors_default.cyan("portless alias <name> <port>")}     Register a static route (e.g. for Docker)
   ${colors_default.cyan("portless alias --remove <name>")}   Remove a static route
   ${colors_default.cyan("portless list")}                    Show active routes
+  ${colors_default.cyan("portless doctor")}                  Check local portless health
   ${colors_default.cyan("portless trust")}                   Add local CA to system trust store
   ${colors_default.cyan("portless clean")}                   Remove portless state, trust entry, and hosts block
   ${colors_default.cyan("portless prune")}                   Kill orphaned dev servers from crashed sessions
@@ -4827,6 +5015,7 @@ ${colors_default.bold("Examples:")}
   portless service install --lan      # Persist LAN mode in the startup service
   portless service install --wildcard # Persist wildcard routing in the startup service
   portless get backend                # -> https://backend.localhost
+  portless doctor                     # Check proxy, routes, DNS, and CA trust
   portless myapp --tailscale next dev # -> also https://<node>.ts.net (tailnet)
   portless myapp --funnel next dev    # -> also https://<node>.ts.net (public)
   portless myapp --ngrok next dev     # -> also https://<random>.ngrok.app (public)
@@ -4909,7 +5098,7 @@ ${colors_default.bold("Options:")}
   --cert <path>                 Use a custom TLS certificate
   --key <path>                  Use a custom TLS private key
   --foreground                  Run proxy in foreground (for debugging)
-  --tld <tld>                   Use a custom TLD instead of .localhost (e.g. test, dev)
+  --tld <tld>                   Use a custom TLD instead of .localhost; repeat for more
   --wildcard                    Allow unregistered subdomains to fall back to parent route
   --state-dir <path>            Use a custom state directory with service install
   --app-port <number>           Use a fixed port for the app (skip auto-assignment)
@@ -4926,7 +5115,7 @@ ${colors_default.bold("Environment variables:")}
   PORTLESS_HTTPS=0              Disable HTTPS (same as --no-tls)
   PORTLESS_LAN=1                Enable LAN mode when set to 1 (set in .bashrc / .zshrc)
   PORTLESS_LAN_IP=<address>     Pin a specific LAN IP for LAN mode
-  PORTLESS_TLD=<tld>            Use a custom TLD (e.g. test, dev; default: localhost)
+  PORTLESS_TLD=<tld>[,<tld>]    Use one or more TLDs (e.g. localhost,test)
   PORTLESS_WILDCARD=1           Allow unregistered subdomains to fall back to parent route
   PORTLESS_SYNC_HOSTS=0         Disable auto-sync of ${HOSTS_DISPLAY} (on by default)
   PORTLESS_TAILSCALE=1          Share apps on your Tailscale network (same as --tailscale)
@@ -4938,7 +5127,7 @@ ${colors_default.bold("Environment variables:")}
 ${colors_default.bold("Child process environment:")}
   PORT                          Ephemeral port the child should listen on
   HOST                          Usually 127.0.0.1 (omitted for Expo in LAN mode)
-  PORTLESS_URL                  Public URL of the app (e.g. https://myapp.localhost)
+  PORTLESS_URL                  Primary public URL of the app
   PORTLESS_LAN                  Set to 1 when proxy is in LAN mode
   PORTLESS_TAILSCALE_URL        Tailscale URL of the app (when --tailscale is active)
   PORTLESS_NGROK_URL            ngrok URL of the app (when --ngrok is active)
@@ -4957,14 +5146,14 @@ ${colors_default.bold("Skip portless:")}
   PORTLESS=0 pnpm dev           # Runs command directly without proxy
 
 ${colors_default.bold("Reserved names:")}
-  run, get, alias, hosts, list, trust, clean, prune, proxy, service are subcommands and
+  run, get, alias, hosts, list, doctor, trust, clean, prune, proxy, service are subcommands and
   cannot be used as app names directly. Use "portless run" to infer the name,
   or "portless --name <name>" to force any name including reserved ones.
 `);
   process.exit(0);
 }
 function printVersion() {
-  console.log("0.14.0");
+  console.log("0.15.1");
   process.exit(0);
 }
 async function handleTrust() {
@@ -5239,8 +5428,8 @@ ${colors_default.bold("Examples:")}
   const name = positional[0];
   const worktree = skipWorktree ? null : detectWorktreePrefix();
   const effectiveName = worktree ? `${worktree.prefix}.${name}` : name;
-  const { port, tls: tls2, tld } = await discoverState();
-  const hostname = parseHostname(effectiveName, tld);
+  const { port, tls: tls2, tlds } = await discoverState();
+  const hostname = buildHostnames(effectiveName, tlds)[0];
   const url = formatUrl(hostname, port, tls2);
   process.stdout.write(url + "\n");
 }
@@ -5261,7 +5450,7 @@ ${colors_default.bold("Examples:")}
 `);
     process.exit(0);
   }
-  const { dir, tld } = await discoverState();
+  const { dir, tlds } = await discoverState();
   const store = new RouteStore(dir, {
     onWarning: (msg) => console.warn(colors_default.yellow(msg))
   });
@@ -5272,15 +5461,15 @@ ${colors_default.bold("Examples:")}
       console.error(colors_default.cyan("  portless alias --remove <name>"));
       process.exit(1);
     }
-    const hostname2 = parseHostname(aliasName2, tld);
+    const hostnames2 = buildHostnames(aliasName2, tlds);
     const routes = store.loadRoutes();
-    const existing = routes.find((r) => r.hostname === hostname2 && r.pid === 0);
+    const existing = routes.find((r) => hostnames2.includes(r.hostname) && r.pid === 0);
     if (!existing) {
-      console.error(colors_default.red(`Error: No alias found for "${hostname2}".`));
+      console.error(colors_default.red(`Error: No alias found for "${hostnames2.join(", ")}".`));
       process.exit(1);
     }
-    store.removeRoute(hostname2);
-    console.log(colors_default.green(`Removed alias: ${hostname2}`));
+    removeRoutes(store, hostnames2);
+    console.log(colors_default.green(`Removed alias: ${hostnames2.join(", ")}`));
     return;
   }
   const aliasName = args[1];
@@ -5294,15 +5483,15 @@ ${colors_default.bold("Examples:")}
     console.error(colors_default.cyan("  portless alias my-postgres 5432"));
     process.exit(1);
   }
-  const hostname = parseHostname(aliasName, tld);
+  const hostnames = buildHostnames(aliasName, tlds);
   const port = parseInt(aliasPort, 10);
   if (isNaN(port) || port < 1 || port > 65535) {
     console.error(colors_default.red(`Error: Invalid port "${aliasPort}". Must be 1-65535.`));
     process.exit(1);
   }
   const force = args.includes("--force");
-  store.addRoute(hostname, port, 0, force);
-  console.log(colors_default.green(`Alias registered: ${hostname} -> 127.0.0.1:${port}`));
+  addRoutes(store, hostnames, port, 0, force);
+  console.log(colors_default.green(`Alias registered: ${hostnames.join(", ")} -> 127.0.0.1:${port}`));
 }
 async function handleHosts(args) {
   if (args[1] === "--help" || args[1] === "-h") {
@@ -5401,6 +5590,358 @@ ${colors_default.bold("Usage: portless hosts <command>")}
   );
   process.exit(1);
 }
+function colorDoctorStatus(status) {
+  if (status === "fail") return colors_default.red;
+  if (status === "warn") return colors_default.yellow;
+  if (status === "ok") return colors_default.green;
+  return colors_default.gray;
+}
+function printDoctorFinding(finding) {
+  const status = finding.status.padEnd(5);
+  console.log(`${colorDoctorStatus(finding.status)(status)} ${finding.message}`);
+  if (finding.hint) {
+    console.log(colors_default.gray(`      ${finding.hint}`));
+  }
+}
+function isProcessAliveForDoctor(pid) {
+  if (pid <= 0) return true;
+  return isProcessAlive(pid);
+}
+function checkPathWritable(targetPath) {
+  try {
+    fs9.accessSync(targetPath, fs9.constants.W_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function findExistingAncestor(targetPath) {
+  let current = targetPath;
+  for (; ; ) {
+    if (fs9.existsSync(current)) return current;
+    const parent = path9.dirname(current);
+    if (parent === current) return null;
+    current = parent;
+  }
+}
+function checkCommandAvailable(command, args) {
+  const result = spawnSync5(command, args, {
+    stdio: "ignore",
+    timeout: 3e3,
+    windowsHide: true
+  });
+  return !result.error && (result.status === 0 || result.status === null);
+}
+function pluralize(count, singular, plural = `${singular}s`) {
+  return `${count} ${count === 1 ? singular : plural}`;
+}
+function isValidTcpPort(port) {
+  return Number.isInteger(port) && port >= 1 && port <= 65535;
+}
+function doctorProxyStartHint(proxyPort, tls2) {
+  const defaultPort = getDefaultPort(tls2);
+  const portArgs = proxyPort === defaultPort ? "" : ` -p ${proxyPort}`;
+  const tlsArgs = tls2 ? "" : " --no-tls";
+  return `Run: portless proxy start${portArgs}${tlsArgs}`;
+}
+async function handleDoctor(args) {
+  if (args[1] === "--help" || args[1] === "-h") {
+    console.log(`
+${colors_default.bold("portless doctor")} - Check local portless health and print suggested fixes.
+
+${colors_default.bold("Usage:")}
+  ${colors_default.cyan("portless doctor")}
+
+Checks Node.js, the state directory, proxy liveness, route entries, HTTPS CA
+trust, hostname resolution, and LAN mode prerequisites. It does not start,
+stop, clean, prune, trust, or modify portless state.
+
+${colors_default.bold("Options:")}
+  --help, -h             Show this help
+`);
+    process.exit(0);
+  }
+  if (args.length > 1) {
+    console.error(colors_default.red(`Error: Unknown argument "${args[1]}".`));
+    console.error(colors_default.cyan("  portless doctor --help"));
+    process.exit(1);
+  }
+  const findings = [];
+  const add = (status, message, hint) => {
+    findings.push({ status, message, hint });
+  };
+  let state;
+  try {
+    state = await discoverState();
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    add("fail", `Could not discover portless state: ${message}`);
+    state = {
+      dir: resolveStateDir(),
+      port: getDefaultPort(!isHttpsEnvDisabled()),
+      tls: !isHttpsEnvDisabled(),
+      tld: DEFAULT_TLD,
+      tlds: [DEFAULT_TLD],
+      lanMode: isLanEnvEnabled(),
+      lanIp: null
+    };
+  }
+  const store = new RouteStore(state.dir, {
+    onWarning: (msg) => add("warn", msg)
+  });
+  const hasPortFile = fs9.existsSync(store.portFilePath);
+  const configuredTls = hasPortFile ? state.tls : !isHttpsEnvDisabled();
+  const configuredPort = hasPortFile ? state.port : getDefaultPort(configuredTls);
+  const initialProxyRunning = await isProxyRunning(state.port, state.tls);
+  const probePort = initialProxyRunning || hasPortFile ? state.port : configuredPort;
+  const probeTls = initialProxyRunning || hasPortFile ? state.tls : configuredTls;
+  const proxyRunning = initialProxyRunning && probePort === state.port ? true : await isProxyRunning(probePort, probeTls);
+  const portListening = proxyRunning ? true : await isPortListening(probePort);
+  const proxyPort = proxyRunning || portListening || hasPortFile ? probePort : configuredPort;
+  const proxyTls = proxyRunning || portListening || hasPortFile ? probeTls : configuredTls;
+  const currentProxyStateIsHttp = (proxyRunning || portListening || hasPortFile) && !proxyTls;
+  const proxyUsesCustomCert = proxyTls && readCustomCertMarker(state.dir);
+  const stateExists = fs9.existsSync(state.dir);
+  console.log(colors_default.blue.bold("\nportless doctor\n"));
+  console.log(`Version: ${"0.15.1"}`);
+  console.log(`Node.js: ${process.versions.node}`);
+  console.log(`Platform: ${process.platform} ${process.arch}`);
+  console.log(`State dir: ${state.dir}`);
+  console.log(`Proxy target: ${formatUrl("127.0.0.1", proxyPort, proxyTls)}`);
+  console.log(
+    `Mode: ${proxyTls ? "HTTPS" : "HTTP"}, ${formatTldList2(state.tlds)}${state.lanMode ? ", LAN" : ""}`
+  );
+  console.log("");
+  const nodeMajor = parseInt(process.versions.node.split(".")[0], 10);
+  if (nodeMajor >= 24) {
+    add("ok", `Node.js ${process.versions.node} satisfies portless requirements.`);
+  } else {
+    add("fail", `Node.js ${process.versions.node} is unsupported.`, "Install Node.js 24 or newer.");
+  }
+  if (stateExists) {
+    try {
+      const stat = fs9.statSync(state.dir);
+      if (!stat.isDirectory()) {
+        add("fail", `State path exists but is not a directory: ${state.dir}`);
+      } else if (checkPathWritable(state.dir)) {
+        add("ok", `State directory is writable: ${state.dir}`);
+      } else {
+        add("fail", `State directory is not writable: ${state.dir}`);
+      }
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      add("fail", `Could not inspect state directory: ${message}`);
+    }
+  } else {
+    const ancestor = findExistingAncestor(path9.dirname(state.dir));
+    if (!ancestor) {
+      add(
+        "fail",
+        `State directory does not exist and no writable ancestor was found: ${state.dir}`
+      );
+    } else {
+      const ancestorStat = fs9.statSync(ancestor);
+      if (!ancestorStat.isDirectory()) {
+        add("fail", `State directory does not exist and ancestor is not a directory: ${ancestor}`);
+      } else if (checkPathWritable(ancestor)) {
+        add("info", `State directory has not been created yet: ${state.dir}`);
+      } else {
+        add("fail", `State directory does not exist and ancestor is not writable: ${ancestor}`);
+      }
+    }
+  }
+  if (proxyRunning) {
+    add("ok", `Proxy is responding on port ${proxyPort}.`);
+  } else if (portListening) {
+    const pid = findPidOnPort(proxyPort);
+    add(
+      "fail",
+      `Port ${proxyPort} is in use, but it is not a portless proxy.`,
+      pid ? `Process on port: PID ${pid}` : "Could not identify the process holding the port."
+    );
+  } else {
+    add(
+      "warn",
+      `Proxy is not running on port ${proxyPort}.`,
+      doctorProxyStartHint(proxyPort, proxyTls)
+    );
+  }
+  if (fs9.existsSync(store.pidPath)) {
+    try {
+      const rawPid = fs9.readFileSync(store.pidPath, "utf-8").trim();
+      const pid = parseInt(rawPid, 10);
+      if (isNaN(pid) || pid <= 0) {
+        add("fail", `Proxy PID file is invalid: ${store.pidPath}`);
+      } else if (!isProcessAliveForDoctor(pid)) {
+        add("warn", `Proxy PID file is stale: ${pid}`, "Run: portless proxy stop");
+      } else if (!proxyRunning) {
+        add(
+          "warn",
+          `Proxy PID file points to PID ${pid}, but no portless proxy is responding on port ${proxyPort}.`,
+          "Run: portless proxy stop"
+        );
+      } else {
+        const portPid = findPidOnPort(proxyPort);
+        if (portPid !== null && portPid !== pid) {
+          add(
+            "warn",
+            `Proxy PID file points to PID ${pid}, but port ${proxyPort} is owned by PID ${portPid}.`,
+            "Run: portless proxy stop"
+          );
+        } else {
+          add("ok", `Proxy PID file points to the responding proxy process: ${pid}`);
+        }
+      }
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      add("fail", `Could not read proxy PID file: ${message}`);
+    }
+  } else if (proxyRunning) {
+    add("warn", `Proxy is running but the PID file is missing: ${store.pidPath}`);
+  }
+  if (proxyUsesCustomCert) {
+    add("ok", "Proxy is configured with a custom TLS certificate.");
+  } else if (proxyTls || !currentProxyStateIsHttp && !isHttpsEnvDisabled()) {
+    if (checkCommandAvailable("openssl", ["version"])) {
+      add("ok", "OpenSSL is available for certificate generation.");
+    } else {
+      add(
+        "fail",
+        "OpenSSL is not available on PATH.",
+        isWindows ? "Install OpenSSL or add Git for Windows OpenSSL to PATH." : "Install OpenSSL with your system package manager."
+      );
+    }
+  } else {
+    add("info", "HTTPS is disabled, so OpenSSL is not required for this run.");
+  }
+  if (proxyTls && proxyUsesCustomCert) {
+    add("info", "Generated local CA is not required for custom TLS certificates.");
+  } else if (proxyTls) {
+    const caPath = path9.join(state.dir, "ca.pem");
+    if (fs9.existsSync(caPath)) {
+      if (isCATrusted(state.dir)) {
+        add("ok", "Local CA is trusted by the OS trust store.");
+      } else {
+        add(
+          "warn",
+          "Local CA exists but is not trusted by the OS trust store.",
+          "Run: portless trust"
+        );
+      }
+    } else if (proxyRunning) {
+      add("warn", `Generated CA file is missing: ${caPath}`);
+    } else {
+      add("info", "Local CA has not been generated yet.");
+    }
+  } else {
+    add("info", "HTTPS is disabled for the current proxy state.");
+  }
+  let rawRoutes = [];
+  try {
+    rawRoutes = store.loadRoutesRaw();
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    add("fail", `Could not read routes: ${message}`);
+  }
+  const liveRoutes = rawRoutes.filter(
+    (route) => route.pid === 0 || isProcessAliveForDoctor(route.pid)
+  );
+  const staleRoutes = rawRoutes.filter(
+    (route) => route.pid !== 0 && !isProcessAliveForDoctor(route.pid)
+  );
+  if (rawRoutes.length === 0) {
+    add("info", "No routes are registered.");
+  } else if (staleRoutes.length === 0) {
+    add("ok", `Routes: ${pluralize(liveRoutes.length, "active route")}.`);
+  } else {
+    add(
+      "warn",
+      `Routes: ${pluralize(liveRoutes.length, "active route")}, ${pluralize(staleRoutes.length, "stale route")}.`,
+      "Run: portless prune"
+    );
+  }
+  for (const route of staleRoutes.slice(0, 5)) {
+    add("warn", `Stale route ${route.hostname} is owned by exited PID ${route.pid}.`);
+  }
+  if (staleRoutes.length > 5) {
+    add("warn", `${staleRoutes.length - 5} additional stale routes hidden.`);
+  }
+  const routePortChecks = await Promise.all(
+    liveRoutes.map(async (route) => {
+      const validPort = isValidTcpPort(route.port);
+      return {
+        route,
+        invalidPort: !validPort,
+        listening: validPort ? await isPortListening(route.port) : false
+      };
+    })
+  );
+  for (const { route, invalidPort, listening } of routePortChecks) {
+    if (invalidPort) {
+      add(
+        "warn",
+        `Route ${route.hostname} has invalid port ${route.port}.`,
+        route.pid === 0 ? "Remove or recreate the alias." : "Run: portless prune"
+      );
+      continue;
+    }
+    if (listening) continue;
+    add(
+      "warn",
+      `Route ${route.hostname} points to port ${route.port}, but nothing is listening there.`,
+      route.pid === 0 ? "Remove the alias or start that service." : "The app may still be starting."
+    );
+  }
+  if (state.lanMode || isLanEnvEnabled()) {
+    const mdns = isMdnsSupported();
+    if (mdns.supported) {
+      add("ok", "mDNS publishing support is available for LAN mode.");
+    } else {
+      add("fail", `LAN mode is enabled but mDNS publishing is unavailable: ${mdns.reason}`);
+    }
+    if (state.lanIp) {
+      add("ok", `LAN IP is recorded: ${state.lanIp}`);
+    } else {
+      add("warn", "LAN mode is enabled but no LAN IP is recorded.");
+    }
+  } else if (liveRoutes.length > 0) {
+    const managedHosts = new Set(getManagedHostnames());
+    const resolutionChecks = await Promise.all(
+      liveRoutes.map(async (route) => ({
+        hostname: route.hostname,
+        resolves: await checkHostResolution(route.hostname),
+        managed: managedHosts.has(route.hostname)
+      }))
+    );
+    const unresolved = resolutionChecks.filter((result) => !result.resolves);
+    if (unresolved.length === 0) {
+      add("ok", "Registered hostnames resolve through the system resolver.");
+    } else {
+      add(
+        "warn",
+        `${pluralize(unresolved.length, "hostname")} did not resolve through the system resolver.`,
+        "Run: portless hosts sync"
+      );
+      for (const result of unresolved.slice(0, 5)) {
+        const hostState = result.managed ? "present in hosts block" : "missing from hosts block";
+        add("warn", `${result.hostname} is ${hostState}.`);
+      }
+    }
+  }
+  for (const finding of findings) {
+    printDoctorFinding(finding);
+  }
+  const failures = findings.filter((finding) => finding.status === "fail").length;
+  const warnings = findings.filter((finding) => finding.status === "warn").length;
+  console.log("");
+  if (failures > 0) {
+    console.log(
+      colors_default.red(`Summary: ${pluralize(failures, "failure")}, ${pluralize(warnings, "warning")}.`)
+    );
+    process.exit(1);
+  }
+  console.log(colors_default.green(`Summary: 0 failures, ${pluralize(warnings, "warning")}.`));
+}
 async function handleProxy(args) {
   if (args[1] === "stop") {
     let explicitPort;
@@ -5441,6 +5982,7 @@ ${colors_default.bold("Usage:")}
   ${colors_default.cyan("portless proxy start --foreground")}   Start in foreground (for debugging)
   ${colors_default.cyan("portless proxy start -p 1355")}        Start on a custom port (no sudo)
   ${colors_default.cyan("portless proxy start --tld test")}     Use .test instead of .localhost
+  ${colors_default.cyan("portless proxy start --tld localhost --tld test")}  Serve both TLDs
   ${colors_default.cyan("portless proxy start --wildcard")}     Allow unregistered subdomains to fall back to parent
   ${colors_default.cyan("portless proxy stop")}                 Stop the proxy
 
@@ -5502,34 +6044,41 @@ ${colors_default.bold("LAN mode (--lan):")}
     }
     hasExplicitPort = true;
   }
-  let tld;
+  let tlds;
   try {
-    tld = getDefaultTld();
+    tlds = getDefaultTlds();
   } catch (err) {
     console.error(colors_default.red(`Error: ${err.message}`));
     process.exit(1);
   }
-  const tldIdx = args.indexOf("--tld");
-  if (tldIdx !== -1) {
-    const tldValue = args[tldIdx + 1];
-    if (!tldValue || tldValue.startsWith("-")) {
-      console.error(colors_default.red("Error: --tld requires a TLD value (e.g. test, localhost)."));
-      process.exit(1);
+  const tldFlagValues = [];
+  for (let i = 0; i < args.length; i += 1) {
+    if (args[i] === "--tld") {
+      const tldValue = args[i + 1];
+      if (!tldValue || tldValue.startsWith("-")) {
+        console.error(colors_default.red("Error: --tld requires a TLD value (e.g. test, localhost)."));
+        process.exit(1);
+      }
+      tldFlagValues.push(tldValue);
+      i += 1;
     }
-    tld = tldValue.trim().toLowerCase();
-    const tldErr = validateTld(tld);
-    if (tldErr) {
-      console.error(colors_default.red(`Error: ${tldErr}`));
+  }
+  if (tldFlagValues.length > 0) {
+    try {
+      tlds = normalizeTlds2(tldFlagValues.flatMap((value) => parseTldList(value)));
+    } catch (err) {
+      console.error(colors_default.red(`Error: ${err.message}`));
       process.exit(1);
     }
   }
+  let tld = primaryTld2(tlds);
   const useWildcard = args.includes("--wildcard") || isWildcardEnvEnabled();
   const explicit = {
     useHttps: hasHttpsFlag || hasNoTls || customCertPath !== null || customKeyPath !== null || process.env.PORTLESS_HTTPS !== void 0,
     customCert: customCertPath !== null || customKeyPath !== null,
     lanMode: process.env.PORTLESS_LAN !== void 0,
     lanIp: process.env.PORTLESS_LAN_IP !== void 0,
-    tld: tldIdx !== -1 || process.env.PORTLESS_TLD !== void 0,
+    tlds: tldFlagValues.length > 0 || process.env.PORTLESS_TLD !== void 0,
     useWildcard: args.includes("--wildcard") || process.env.PORTLESS_WILDCARD !== void 0
   };
   let stateDir = resolveStateDir(proxyPort);
@@ -5547,13 +6096,13 @@ ${colors_default.bold("LAN mode (--lan):")}
   const desiredConfig = resolveProxyConfig({
     persistedLanMode,
     explicit,
-    defaultTld: getDefaultTld(),
+    defaultTlds: getDefaultTlds(),
     useHttps: wantHttps || !!(customCertPath && customKeyPath),
     customCertPath,
     customKeyPath,
     lanMode: isLanEnvEnabled(),
     lanIp: process.env.PORTLESS_LAN_IP || null,
-    tld,
+    tlds,
     useWildcard
   });
   const lanMode = desiredConfig.lanMode;
@@ -5561,31 +6110,35 @@ ${colors_default.bold("LAN mode (--lan):")}
   customCertPath = desiredConfig.customCertPath;
   customKeyPath = desiredConfig.customKeyPath;
   tld = desiredConfig.tld;
+  tlds = desiredConfig.tlds;
   const desiredWildcard = desiredConfig.useWildcard;
   let lanIp = desiredConfig.lanIpExplicit ? desiredConfig.lanIp : null;
   if (!hasExplicitPort && runningPort === null) {
     proxyPort = getDefaultPort(useHttps);
     stateDir = resolveStateDir(proxyPort);
   }
-  if (lanMode && tldIdx !== -1) {
-    const userTld = args[tldIdx + 1];
-    if (userTld && userTld !== "local") {
+  if (lanMode && tldFlagValues.length > 0) {
+    const userTlds = tldFlagValues.join(", ");
+    if (userTlds !== "local") {
       console.warn(
         chalk.yellow(
-          `Warning: --lan forces .local TLD (mDNS requirement). Ignoring --tld ${userTld}.`
+          `Warning: --lan forces .local TLD (mDNS requirement). Ignoring --tld ${userTlds}.`
         )
       );
     }
   }
-  const riskyReason = RISKY_TLDS.get(tld);
-  if (riskyReason && !lanMode) {
-    console.warn(colors_default.yellow(`Warning: .${tld}: ${riskyReason}`));
+  for (const configuredTld of tlds) {
+    const riskyReason = RISKY_TLDS.get(configuredTld);
+    if (riskyReason && !lanMode) {
+      console.warn(colors_default.yellow(`Warning: .${configuredTld}: ${riskyReason}`));
+    }
   }
   const syncDisabled = process.env.PORTLESS_SYNC_HOSTS === "0" || process.env.PORTLESS_SYNC_HOSTS === "false";
-  if (tld !== DEFAULT_TLD && !lanMode && syncDisabled) {
+  const nonDefaultTlds = tlds.filter((configuredTld) => configuredTld !== DEFAULT_TLD);
+  if (nonDefaultTlds.length > 0 && !lanMode && syncDisabled) {
     console.warn(
       colors_default.yellow(
-        `Warning: .${tld} domains require ${HOSTS_DISPLAY} entries to resolve to 127.0.0.1.`
+        `Warning: ${formatTldList2(nonDefaultTlds)} domains require ${HOSTS_DISPLAY} entries to resolve to 127.0.0.1.`
       )
     );
     console.warn(colors_default.yellow("Hosts sync is disabled. To add entries manually, run:"));
@@ -5647,6 +6200,7 @@ ${colors_default.bold("LAN mode (--lan):")}
     lanIp: desiredConfig.lanIpExplicit ? lanIp : null,
     lanIpExplicit: desiredConfig.lanIpExplicit,
     tld,
+    tlds,
     useWildcard: desiredWildcard
   };
   if (!isWindows && proxyPort < PRIVILEGED_PORT_THRESHOLD && (process.getuid?.() ?? -1) !== 0) {
@@ -5663,6 +6217,7 @@ ${colors_default.bold("LAN mode (--lan):")}
         lanIp: desiredConfig.lanIpExplicit ? lanIp : null,
         lanIpExplicit: desiredConfig.lanIpExplicit,
         tld,
+        tlds,
         useWildcard: desiredWildcard,
         foreground: isForeground,
         includePort: true,
@@ -5780,13 +6335,22 @@ ${colors_default.bold("LAN mode (--lan):")}
         cert,
         key,
         ca,
-        SNICallback: createSNICallback(stateDir, cert, key, tld, ca)
+        SNICallback: createSNICallback(stateDir, cert, key, tlds, ca)
       };
     }
   }
   if (isForeground) {
     console.log(chalk.blue.bold("\nportless proxy\n"));
-    startProxyServer(store, proxyPort, tld, tlsOptions, lanIp, desiredWildcard ? false : void 0);
+    startProxyServer(
+      store,
+      proxyPort,
+      tld,
+      tlds,
+      tlsOptions,
+      lanIp,
+      desiredWildcard ? false : void 0,
+      !!(customCertPath && customKeyPath)
+    );
     return;
   }
   store.ensureDir();
@@ -5810,6 +6374,7 @@ ${colors_default.bold("LAN mode (--lan):")}
         lanIp: desiredConfig.lanIpExplicit ? lanIp : null,
         lanIpExplicit: desiredConfig.lanIpExplicit,
         tld,
+        tlds,
         useWildcard: desiredWildcard,
         foreground: true,
         includePort: true,
@@ -5903,7 +6468,7 @@ async function handleDefaultSingle(cwd, scriptName, appConfig) {
   }
   const worktree = detectWorktreePrefix(cwd);
   const effectiveName = worktree ? `${worktree.prefix}.${baseName}` : baseName;
-  const { dir, port, tls: tls2, tld, lanMode, lanIp } = await discoverState();
+  const { dir, port, tls: tls2, tlds, lanMode, lanIp } = await discoverState();
   const store = new RouteStore(dir, {
     onWarning: (msg) => console.warn(colors_default.yellow(msg))
   });
@@ -5914,7 +6479,7 @@ async function handleDefaultSingle(cwd, scriptName, appConfig) {
     effectiveName,
     resolved,
     tls2,
-    tld,
+    tlds,
     false,
     { nameSource, prefix: worktree?.prefix, prefixSource: worktree?.source },
     appConfig?.appPort,
@@ -5954,13 +6519,13 @@ function pipeOutput(child, prefix) {
   prefixStream(child.stdout, process.stdout, prefix);
   prefixStream(child.stderr, process.stderr, prefix);
 }
-async function spawnProxiedApp(app, stateDir, proxyPort, tls2, tld, exitCodes) {
+async function spawnProxiedApp(app, stateDir, proxyPort, tls2, tlds, exitCodes) {
   const usesPortless = app.commandArgs[0] === "portless";
   const pkgEnv = { ...process.env };
   pkgEnv.PATH = augmentedPath(pkgEnv, app.pkg.dir);
   let env;
   let store = null;
-  let hostname = null;
+  let hostnames = [];
   let displayUrl;
   if (usesPortless) {
     env = pkgEnv;
@@ -5970,17 +6535,17 @@ async function spawnProxiedApp(app, stateDir, proxyPort, tls2, tld, exitCodes) {
       onWarning: (msg) => console.warn(colors_default.yellow(`[${app.name}] ${msg}`))
     });
     const appPort = app.appPort ?? await findFreePort();
-    const protocol = tls2 ? "https" : "http";
-    const portSuffix = tls2 && proxyPort === 443 || !tls2 && proxyPort === 80 ? "" : `:${proxyPort}`;
-    const url = `${protocol}://${app.name}.${tld}${portSuffix}`;
+    hostnames = buildHostnames(app.name, tlds);
+    const urls = formatUrls(hostnames, proxyPort, tls2);
+    const url = urls[0];
     displayUrl = url;
-    hostname = parseHostname(app.name, tld);
-    store.addRoute(hostname, appPort, process.pid);
+    addRoutes(store, hostnames, appPort, process.pid);
     env = {
       ...pkgEnv,
       PORT: String(appPort),
       HOST: "127.0.0.1",
-      PORTLESS_URL: url
+      PORTLESS_URL: url,
+      __VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS: formatViteAllowedHosts(tlds)
     };
     if (tls2) {
       const caPath = path9.join(stateDir, "ca.pem");
@@ -5992,7 +6557,7 @@ async function spawnProxiedApp(app, stateDir, proxyPort, tls2, tld, exitCodes) {
   const child = spawnChildProcess(app.commandArgs, env, app.pkg.dir);
   pipeOutput(child, chalk.cyan(`[${app.name}]`));
   const capturedStore = store;
-  const capturedHostname = hostname;
+  const capturedHostnames = hostnames;
   child.on("exit", (code, signal) => {
     exitCodes.set(app.name, code);
     if (code !== 0 && code !== null) {
@@ -6000,14 +6565,11 @@ async function spawnProxiedApp(app, stateDir, proxyPort, tls2, tld, exitCodes) {
     } else if (signal) {
       console.error(colors_default.yellow(`[${app.name}] killed by ${signal}`));
     }
-    if (capturedStore && capturedHostname) {
-      try {
-        capturedStore.removeRoute(capturedHostname);
-      } catch {
-      }
+    if (capturedStore && capturedHostnames.length > 0) {
+      removeRoutes(capturedStore, capturedHostnames, process.pid);
     }
   });
-  const route = store && hostname ? { store, hostname } : null;
+  const route = store && hostnames.length > 0 ? { store, hostnames } : null;
   return { child, displayUrl, route };
 }
 function spawnTaskApp(app, exitCodes) {
@@ -6118,7 +6680,7 @@ async function handleDefaultMulti(wsRoot, globalScript, extraArgs = []) {
   console.log(chalk.blue.bold(`
 portless
 `));
-  let { dir, port, tls: tls2, tld } = await discoverState();
+  let { dir, port, tls: tls2, tlds } = await discoverState();
   if (proxiedApps.length > 0) {
     let multiDesired;
     try {
@@ -6132,9 +6694,9 @@ portless
       dir = ensureResult.state.dir;
       port = ensureResult.state.port;
       tls2 = ensureResult.state.tls;
-      tld = ensureResult.state.tld;
+      tlds = ensureResult.state.tlds;
     } else {
-      ({ dir, port, tls: tls2, tld } = await discoverState());
+      ({ dir, port, tls: tls2, tlds } = await discoverState());
     }
     if (tls2 && !isCATrusted(dir)) {
       await handleTrust();
@@ -6142,12 +6704,12 @@ portless
   }
   const useTurbo = loaded?.config.turbo !== false && hasTurboConfig(wsRoot);
   if (useTurbo) {
-    await runWithTurbo(wsRoot, dir, port, tls2, tld, scriptName, proxiedApps, taskApps, extraArgs);
+    await runWithTurbo(wsRoot, dir, port, tls2, tlds, scriptName, proxiedApps, taskApps, extraArgs);
   } else {
-    await runWithDirectSpawn(dir, port, tls2, tld, proxiedApps, taskApps);
+    await runWithDirectSpawn(dir, port, tls2, tlds, proxiedApps, taskApps);
   }
 }
-async function runWithTurbo(wsRoot, stateDir, proxyPort, tls2, tld, scriptName, proxiedApps, taskApps, extraArgs = []) {
+async function runWithTurbo(wsRoot, stateDir, proxyPort, tls2, tlds, scriptName, proxiedApps, taskApps, extraArgs = []) {
   const store = new RouteStore(stateDir, {
     onWarning: (msg) => console.warn(colors_default.yellow(msg))
   });
@@ -6161,17 +6723,17 @@ async function runWithTurbo(wsRoot, stateDir, proxyPort, tls2, tld, scriptName,
       continue;
     }
     const appPort = app.appPort ?? await findFreePort();
-    const protocol = tls2 ? "https" : "http";
-    const portSuffix = tls2 && proxyPort === 443 || !tls2 && proxyPort === 80 ? "" : `:${proxyPort}`;
-    const url = `${protocol}://${app.name}.${tld}${portSuffix}`;
+    const hostnames = buildHostnames(app.name, tlds);
+    const urls = formatUrls(hostnames, proxyPort, tls2);
+    const url = urls[0];
     appUrls.push({ label: app.label, url });
-    const hostname = parseHostname(app.name, tld);
-    store.addRoute(hostname, appPort, process.pid);
-    routes.push({ hostname });
+    addRoutes(store, hostnames, appPort, process.pid);
+    routes.push({ hostnames });
     const entry = {
       PORT: String(appPort),
       HOST: "127.0.0.1",
-      PORTLESS_URL: url
+      PORTLESS_URL: url,
+      __VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS: formatViteAllowedHosts(tlds)
     };
     if (tls2) {
       const caPath = path9.join(stateDir, "ca.pem");
@@ -6214,11 +6776,8 @@ async function runWithTurbo(wsRoot, stateDir, proxyPort, tls2, tld, scriptName,
         killTree(turboChild, "SIGKILL");
       }
     }, SIGKILL_TIMEOUT_MS).unref();
-    for (const { hostname } of routes) {
-      try {
-        store.removeRoute(hostname);
-      } catch {
-      }
+    for (const { hostnames } of routes) {
+      removeRoutes(store, hostnames, process.pid);
     }
     removeManifest();
   };
@@ -6232,7 +6791,7 @@ async function runWithTurbo(wsRoot, stateDir, proxyPort, tls2, tld, scriptName,
     process.exit(exitCode);
   }
 }
-async function runWithDirectSpawn(stateDir, proxyPort, tls2, tld, proxiedApps, taskApps) {
+async function runWithDirectSpawn(stateDir, proxyPort, tls2, tlds, proxiedApps, taskApps) {
   const children = [];
   const exitCodes = /* @__PURE__ */ new Map();
   const appUrls = [];
@@ -6243,7 +6802,7 @@ async function runWithDirectSpawn(stateDir, proxyPort, tls2, tld, proxiedApps, t
       stateDir,
       proxyPort,
       tls2,
-      tld,
+      tlds,
       exitCodes
     );
     children.push(child);
@@ -6278,11 +6837,8 @@ async function runWithDirectSpawn(stateDir, proxyPort, tls2, tld, proxiedApps, t
         }
       }
     }, SIGKILL_TIMEOUT_MS).unref();
-    for (const { store, hostname } of routeEntries) {
-      try {
-        store.removeRoute(hostname);
-      } catch {
-      }
+    for (const { store, hostnames } of routeEntries) {
+      removeRoutes(store, hostnames, process.pid);
     }
   };
   process.on("SIGINT", cleanup);
@@ -6341,7 +6897,7 @@ async function handleRunMode(args, globalScript) {
   }
   const worktree = detectWorktreePrefix();
   const effectiveName = worktree ? `${worktree.prefix}.${baseName}` : baseName;
-  const { dir, port, tls: tls2, tld, lanMode, lanIp } = await discoverState();
+  const { dir, port, tls: tls2, tlds, lanMode, lanIp } = await discoverState();
   const store = new RouteStore(dir, {
     onWarning: (msg) => console.warn(colors_default.yellow(msg))
   });
@@ -6352,7 +6908,7 @@ async function handleRunMode(args, globalScript) {
     effectiveName,
     parsed.commandArgs,
     tls2,
-    tld,
+    tlds,
     parsed.force,
     { nameSource, prefix: worktree?.prefix, prefixSource: worktree?.source },
     parsed.appPort,
@@ -6378,7 +6934,7 @@ async function handleNamedMode(args) {
   }
   const safeName = parsed.name.split(".").map((label) => truncateLabel(label)).join(".");
   parseHostname(safeName, DEFAULT_TLD);
-  const { dir, port, tls: tls2, tld, lanMode, lanIp } = await discoverState();
+  const { dir, port, tls: tls2, tlds, lanMode, lanIp } = await discoverState();
   const store = new RouteStore(dir, {
     onWarning: (msg) => console.warn(colors_default.yellow(msg))
   });
@@ -6389,7 +6945,7 @@ async function handleNamedMode(args) {
     safeName,
     parsed.commandArgs,
     tls2,
-    tld,
+    tlds,
     parsed.force,
     void 0,
     parsed.appPort,
@@ -6492,7 +7048,7 @@ async function main() {
     args.shift();
   }
   const skipPortless = process.env.PORTLESS === "0" || process.env.PORTLESS === "false" || process.env.PORTLESS === "skip";
-  if (skipPortless && (isRunCommand || args.length === 0 || args.length >= 2 && args[0] !== "proxy" && args[0] !== "clean" && args[0] !== "service")) {
+  if (skipPortless && (isRunCommand || args.length === 0 || args.length >= 2 && args[0] !== "proxy" && args[0] !== "clean" && args[0] !== "doctor" && args[0] !== "service")) {
     const parsed = isRunCommand ? parseRunArgs(args) : parseAppArgs(args);
     let commandArgs = parsed.commandArgs;
     if (commandArgs.length === 0 && (isRunCommand || args.length === 0)) {
@@ -6540,6 +7096,10 @@ async function main() {
       await handleList();
       return;
     }
+    if (args[0] === "doctor") {
+      await handleDoctor(args);
+      return;
+    }
     if (args[0] === "get") {
       await handleGet(args);
       return;