portless 0.15.2 → 0.15.3

package/dist/cli.js

@@ -16,9 +16,10 @@ import {
   isProcessAlive,
   parseHostname,
   parseHostnames,
+  resolveUserHome,
   shouldAutoSyncHosts,
   syncHostsFile
-} from "./chunk-T7CGCIRO.js";
+} from "./chunk-JSJUKQRJ.js";
 
 // src/colors.ts
 function supportsColor() {
@@ -44,18 +45,96 @@ var gray = dim;
 var colors_default = { bold, dim, red, green, yellow, blue, cyan, white, gray };
 
 // src/cli.ts
-import * as fs9 from "fs";
+import * as fs10 from "fs";
 import * as path9 from "path";
 import { spawn as spawn4, spawnSync as spawnSync5 } from "child_process";
 import { StringDecoder } from "string_decoder";
 
 // src/certs.ts
-import * as fs from "fs";
+import * as fs2 from "fs";
 import * as path from "path";
-import * as crypto from "crypto";
+import * as crypto2 from "crypto";
 import * as tls from "tls";
-import { execFile as execFileCb, execFileSync } from "child_process";
+import { execFile as execFileCb, execFileSync as execFileSync2 } from "child_process";
 import { promisify } from "util";
+
+// src/windows-ca.ts
+import * as crypto from "crypto";
+import * as fs from "fs";
+import * as os from "os";
+import { execFileSync } from "child_process";
+var WINDOWS_COMMAND_TIMEOUT_MS = 3e4;
+var commandOptions = {
+  encoding: "utf-8",
+  timeout: WINDOWS_COMMAND_TIMEOUT_MS,
+  stdio: ["pipe", "pipe", "pipe"]
+};
+var defaultRunner = (command, args, options) => execFileSync(command, args, options);
+function isWSL(options = {}) {
+  const platform = options.platform ?? process.platform;
+  if (platform !== "linux") return false;
+  const env = options.env ?? process.env;
+  if (env.WSL_DISTRO_NAME || env.WSL_INTEROP) return true;
+  const release2 = options.release ?? os.release();
+  return release2.toLowerCase().includes("microsoft");
+}
+function wslWindowsCAStoreOptions(run = defaultRunner) {
+  const command = run(
+    "wslpath",
+    ["-u", String.raw`C:\Windows\System32\certutil.exe`],
+    commandOptions
+  ).trim();
+  return {
+    command,
+    certificatePath: (certificatePath) => run("wslpath", ["-w", certificatePath], commandOptions).trim(),
+    run
+  };
+}
+function certificateFingerprint(certificatePath) {
+  const certificate = new crypto.X509Certificate(fs.readFileSync(certificatePath));
+  return certificate.fingerprint.replace(/:/g, "").toLowerCase();
+}
+function storeOptions(options) {
+  return {
+    command: options.command ?? "certutil",
+    certificatePath: options.certificatePath ?? ((certificatePath) => certificatePath),
+    run: options.run ?? defaultRunner
+  };
+}
+function storeContainsFingerprint(fingerprint, resolved) {
+  const listing = resolved.run(resolved.command, ["-store", "-user", "Root"], commandOptions);
+  return listing.replace(/\s/g, "").toLowerCase().includes(fingerprint);
+}
+function isWindowsCATrusted(caCertPath, options = {}) {
+  try {
+    const resolved = storeOptions(options);
+    const fingerprint = certificateFingerprint(caCertPath);
+    return storeContainsFingerprint(fingerprint, resolved);
+  } catch {
+    return false;
+  }
+}
+function trustWindowsCA(caCertPath, options = {}) {
+  const resolved = storeOptions(options);
+  resolved.run(
+    resolved.command,
+    ["-addstore", "-user", "Root", resolved.certificatePath(caCertPath)],
+    commandOptions
+  );
+}
+function untrustWindowsCA(caCertPath, options = {}) {
+  try {
+    const resolved = storeOptions(options);
+    const fingerprint = certificateFingerprint(caCertPath);
+    if (!storeContainsFingerprint(fingerprint, resolved)) return { removed: true };
+    resolved.run(resolved.command, ["-delstore", "-user", "Root", fingerprint], commandOptions);
+    return storeContainsFingerprint(fingerprint, resolved) ? { removed: false, error: "certutil could not remove the portless CA from Root" } : { removed: true };
+  } catch (error) {
+    return { removed: false, error: error instanceof Error ? error.message : String(error) };
+  }
+}
+
+// src/certs.ts
 var CA_VALIDITY_DAYS = 3650;
 var SERVER_VALIDITY_DAYS = 365;
 var EXPIRY_BUFFER_MS = 7 * 24 * 60 * 60 * 1e3;
@@ -69,9 +148,10 @@ var CA_CERT_FILE = "ca.pem";
 var SERVER_KEY_FILE = "server-key.pem";
 var SERVER_CERT_FILE = "server.pem";
 var CA_TRUST_MARKER = "ca.trusted";
+var CA_TRUST_REFRESH_PENDING = "ca.trust-refresh-pending";
 function fileExists(filePath) {
   try {
-    fs.accessSync(filePath, fs.constants.R_OK);
+    fs2.accessSync(filePath, fs2.constants.R_OK);
     return true;
   } catch {
     return false;
@@ -80,30 +160,38 @@ function fileExists(filePath) {
 function caFingerprint(stateDir) {
   const caCertPath = path.join(stateDir, CA_CERT_FILE);
   try {
-    const pem = fs.readFileSync(caCertPath);
-    return crypto.createHash("sha256").update(pem).digest("hex");
+    const pem = fs2.readFileSync(caCertPath);
+    return crypto2.createHash("sha256").update(pem).digest("hex");
   } catch {
     return null;
   }
 }
 function readTrustMarker(stateDir) {
   try {
-    const value = fs.readFileSync(path.join(stateDir, CA_TRUST_MARKER), "utf-8").trim();
+    const value = fs2.readFileSync(path.join(stateDir, CA_TRUST_MARKER), "utf-8").trim();
     return value || null;
   } catch {
     return null;
   }
 }
+function clearTrustRefreshPending(stateDir) {
+  try {
+    fs2.unlinkSync(path.join(stateDir, CA_TRUST_REFRESH_PENDING));
+  } catch {
+  }
+}
 function writeTrustMarker(stateDir) {
   const fp = caFingerprint(stateDir);
   if (fp) {
-    fs.writeFileSync(path.join(stateDir, CA_TRUST_MARKER), fp + "\n");
+    clearTrustRefreshPending(stateDir);
+    const marker = isWSL() ? `wsl:${fp}` : fp;
+    fs2.writeFileSync(path.join(stateDir, CA_TRUST_MARKER), marker + "\n");
     fixOwnership(path.join(stateDir, CA_TRUST_MARKER));
   }
 }
 function clearTrustMarker(stateDir) {
   try {
-    fs.unlinkSync(path.join(stateDir, CA_TRUST_MARKER));
+    fs2.unlinkSync(path.join(stateDir, CA_TRUST_MARKER));
   } catch {
   }
 }
@@ -143,8 +231,8 @@ function opensslErrorMessage() {
 }
 function isCertValid(certPath) {
   try {
-    const pem = fs.readFileSync(certPath, "utf-8");
-    const cert = new crypto.X509Certificate(pem);
+    const pem = fs2.readFileSync(certPath, "utf-8");
+    const cert = new crypto2.X509Certificate(pem);
     const expiry = new Date(cert.validTo).getTime();
     return Date.now() + EXPIRY_BUFFER_MS < expiry;
   } catch {
@@ -173,7 +261,7 @@ function isCertSignatureStrong(certPath) {
 function openssl(args, options) {
   try {
     const extraEnv = getOpensslEnv();
-    return execFileSync("openssl", args, {
+    return execFileSync2("openssl", args, {
       encoding: "utf-8",
       timeout: OPENSSL_TIMEOUT_MS,
       input: options?.input,
@@ -226,8 +314,8 @@ function generateCA(stateDir) {
     "-addext",
     "keyUsage=critical,keyCertSign,cRLSign"
   ]);
-  fs.chmodSync(keyPath, 384);
-  fs.chmodSync(certPath, 420);
+  fs2.chmodSync(keyPath, 384);
+  fs2.chmodSync(certPath, 420);
   fixOwnership(keyPath, certPath);
   clearTrustMarker(stateDir);
   return { certPath, keyPath };
@@ -242,7 +330,7 @@ function generateServerCert(stateDir) {
   openssl(["ecparam", "-genkey", "-name", "prime256v1", "-noout", "-out", serverKeyPath]);
   openssl(["req", "-new", "-key", serverKeyPath, "-out", csrPath, "-subj", "/CN=localhost"]);
   const sans = ["DNS:localhost", "DNS:*.localhost", "DNS:*.local"];
-  fs.writeFileSync(
+  fs2.writeFileSync(
     extPath,
     [
       "authorityKeyIdentifier=keyid,issuer",
@@ -254,9 +342,9 @@ function generateServerCert(stateDir) {
   );
   const srlPath = path.join(stateDir, "ca.srl");
   if (!fileExists(srlPath)) {
-    fs.writeFileSync(
+    fs2.writeFileSync(
       srlPath,
-      crypto.randomUUID().replace(/-/g, "").slice(0, 16).toUpperCase() + "\n"
+      crypto2.randomUUID().replace(/-/g, "").slice(0, 16).toUpperCase() + "\n"
     );
   }
   openssl([
@@ -280,12 +368,12 @@ function generateServerCert(stateDir) {
   ]);
   for (const tmp of [csrPath, extPath]) {
     try {
-      fs.unlinkSync(tmp);
+      fs2.unlinkSync(tmp);
     } catch {
     }
   }
-  fs.chmodSync(serverKeyPath, 384);
-  fs.chmodSync(serverCertPath, 420);
+  fs2.chmodSync(serverKeyPath, 384);
+  fs2.chmodSync(serverCertPath, 420);
   fixOwnership(serverKeyPath, serverCertPath);
   return { certPath: serverCertPath, keyPath: serverKeyPath };
 }
@@ -316,36 +404,30 @@ function isCATrusted(stateDir) {
   const marker = readTrustMarker(stateDir);
   if (marker) {
     const fp = caFingerprint(stateDir);
-    if (fp && marker === fp) return true;
+    const expected = fp && isWSL() ? `wsl:${fp}` : fp;
+    if (expected && marker === expected) return true;
   }
   if (process.platform === "darwin") {
     return isCATrustedMacOS(caCertPath);
   } else if (process.platform === "linux") {
-    return isCATrustedLinux(stateDir);
+    if (!isCATrustedLinux(stateDir)) return false;
+    if (!isWSL()) return true;
+    try {
+      return isWindowsCATrusted(caCertPath, wslWindowsCAStoreOptions());
+    } catch {
+      return false;
+    }
   } else if (process.platform === "win32") {
-    return isCATrustedWindows(caCertPath);
+    return isWindowsCATrusted(caCertPath);
   }
   return false;
 }
-function isCATrustedWindows(caCertPath) {
-  try {
-    const fingerprint = openssl(["x509", "-in", caCertPath, "-noout", "-fingerprint", "-sha1"]).trim().replace(/^.*=/, "").replace(/:/g, "").toLowerCase();
-    const result = execFileSync("certutil", ["-store", "-user", "Root"], {
-      encoding: "utf-8",
-      timeout: 1e4,
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    return result.replace(/\s/g, "").toLowerCase().includes(fingerprint);
-  } catch {
-    return false;
-  }
-}
 function isCATrustedMacOS(caCertPath) {
   try {
     const isRoot = (process.getuid?.() ?? -1) === 0;
     const sudoUser = process.env.SUDO_USER;
     if (isRoot && sudoUser) {
-      execFileSync(
+      execFileSync2(
         "sudo",
         ["-u", sudoUser, "security", "verify-cert", "-c", caCertPath, "-L", "-p", "ssl"],
         {
@@ -354,7 +436,7 @@ function isCATrustedMacOS(caCertPath) {
         }
       );
     } else {
-      execFileSync("security", ["verify-cert", "-c", caCertPath, "-L", "-p", "ssl"], {
+      execFileSync2("security", ["verify-cert", "-c", caCertPath, "-L", "-p", "ssl"], {
         stdio: "pipe",
         timeout: MACOS_SECURITY_TIMEOUT_MS
       });
@@ -366,7 +448,7 @@ function isCATrustedMacOS(caCertPath) {
 }
 function loginKeychainPath() {
   try {
-    const result = execFileSync("security", ["default-keychain"], {
+    const result = execFileSync2("security", ["default-keychain"], {
       encoding: "utf-8",
       timeout: MACOS_SECURITY_TIMEOUT_MS
     }).trim();
@@ -397,7 +479,7 @@ var LINUX_CA_TRUST_CONFIGS = {
 };
 function detectLinuxDistro() {
   try {
-    const osRelease = fs.readFileSync("/etc/os-release", "utf-8").toLowerCase();
+    const osRelease = fs2.readFileSync("/etc/os-release", "utf-8").toLowerCase();
     if (osRelease.includes("arch")) return "arch";
     if (osRelease.includes("fedora") || osRelease.includes("rhel") || osRelease.includes("centos"))
       return "fedora";
@@ -407,8 +489,8 @@ function detectLinuxDistro() {
   }
   for (const [distro, config] of Object.entries(LINUX_CA_TRUST_CONFIGS)) {
     try {
-      execFileSync("which", [config.updateCommand], { stdio: "pipe", timeout: 5e3 });
-      if (fs.existsSync(path.dirname(config.certDir))) return distro;
+      execFileSync2("which", [config.updateCommand], { stdio: "pipe", timeout: 5e3 });
+      if (fs2.existsSync(path.dirname(config.certDir))) return distro;
     } catch {
     }
   }
@@ -418,13 +500,12 @@ function getLinuxCATrustConfig() {
   const distro = detectLinuxDistro();
   return LINUX_CA_TRUST_CONFIGS[distro ?? "debian"];
 }
-function isCATrustedLinux(stateDir) {
-  const config = getLinuxCATrustConfig();
+function isCATrustedLinux(stateDir, config = getLinuxCATrustConfig()) {
   const systemCertPath = path.join(config.certDir, "portless-ca.crt");
   if (!fileExists(systemCertPath)) return false;
   try {
-    const ours = fs.readFileSync(path.join(stateDir, CA_CERT_FILE), "utf-8").trim();
-    const installed = fs.readFileSync(systemCertPath, "utf-8").trim();
+    const ours = fs2.readFileSync(path.join(stateDir, CA_CERT_FILE), "utf-8").trim();
+    const installed = fs2.readFileSync(systemCertPath, "utf-8").trim();
     return ours === installed;
   } catch {
     return false;
@@ -439,8 +520,8 @@ async function generateHostCertAsync(stateDir, hostname) {
   const caKeyPath = path.join(stateDir, CA_KEY_FILE);
   const caCertPath = path.join(stateDir, CA_CERT_FILE);
   const hostDir = path.join(stateDir, HOST_CERTS_DIR);
-  if (!fs.existsSync(hostDir)) {
-    await fs.promises.mkdir(hostDir, { recursive: true, mode: 493 });
+  if (!fs2.existsSync(hostDir)) {
+    await fs2.promises.mkdir(hostDir, { recursive: true, mode: 493 });
     fixOwnership(hostDir);
   }
   const safeName = sanitizeHostForFilename(hostname);
@@ -456,7 +537,7 @@ async function generateHostCertAsync(stateDir, hostname) {
   if (parts.length >= 2) {
     sans.push(`DNS:*.${parts.slice(1).join(".")}`);
   }
-  await fs.promises.writeFile(
+  await fs2.promises.writeFile(
     extPath,
     [
       "authorityKeyIdentifier=keyid,issuer",
@@ -467,10 +548,10 @@ async function generateHostCertAsync(stateDir, hostname) {
     ].join("\n") + "\n"
   );
   const srlPath = path.join(stateDir, "ca.srl");
-  if (!fs.existsSync(srlPath)) {
-    await fs.promises.writeFile(
+  if (!fs2.existsSync(srlPath)) {
+    await fs2.promises.writeFile(
       srlPath,
-      crypto.randomUUID().replace(/-/g, "").slice(0, 16).toUpperCase() + "\n"
+      crypto2.randomUUID().replace(/-/g, "").slice(0, 16).toUpperCase() + "\n"
     );
   }
   await opensslAsync([
@@ -494,12 +575,12 @@ async function generateHostCertAsync(stateDir, hostname) {
   ]);
   for (const tmp of [csrPath, extPath]) {
     try {
-      await fs.promises.unlink(tmp);
+      await fs2.promises.unlink(tmp);
     } catch {
     }
   }
-  await fs.promises.chmod(keyPath, 384);
-  await fs.promises.chmod(certPath, 420);
+  await fs2.promises.chmod(keyPath, 384);
+  await fs2.promises.chmod(certPath, 420);
   fixOwnership(keyPath, certPath);
   return { certPath, keyPath };
 }
@@ -526,10 +607,10 @@ function createSNICallback(stateDir, defaultCert, defaultKey, tlds = "localhost"
     const keyPath = path.join(hostDir, `${safeName}-key.pem`);
     if (fileExists(certPath) && fileExists(keyPath) && isCertValid(certPath) && isCertSignatureStrong(certPath)) {
       try {
-        const hostCert = fs.readFileSync(certPath);
+        const hostCert = fs2.readFileSync(certPath);
         const ctx = tls.createSecureContext({
           cert: caCert ? Buffer.concat([hostCert, caCert]) : hostCert,
-          key: fs.readFileSync(keyPath)
+          key: fs2.readFileSync(keyPath)
         });
         cache.set(servername, ctx);
         cb(null, ctx);
@@ -543,8 +624,8 @@ function createSNICallback(stateDir, defaultCert, defaultKey, tlds = "localhost"
     }
     const promise = generateHostCertAsync(stateDir, servername).then(async (generated) => {
       const [hostCert, key] = await Promise.all([
-        fs.promises.readFile(generated.certPath),
-        fs.promises.readFile(generated.keyPath)
+        fs2.promises.readFile(generated.certPath),
+        fs2.promises.readFile(generated.keyPath)
       ]);
       return tls.createSecureContext({
         cert: caCert ? Buffer.concat([hostCert, caCert]) : hostCert,
@@ -574,7 +655,7 @@ function trustCA(stateDir) {
     if (process.platform === "darwin") {
       const isRoot = (process.getuid?.() ?? -1) === 0;
       if (isRoot) {
-        execFileSync(
+        execFileSync2(
           "security",
           [
             "add-trusted-cert",
@@ -589,7 +670,7 @@ function trustCA(stateDir) {
         );
       } else {
         const keychain = loginKeychainPath();
-        execFileSync(
+        execFileSync2(
           "security",
           ["add-trusted-cert", "-r", "trustRoot", "-k", keychain, caCertPath],
           { stdio: "pipe", timeout: MACOS_SECURITY_AUTH_TIMEOUT_MS }
@@ -599,19 +680,19 @@ function trustCA(stateDir) {
       return { trusted: true };
     } else if (process.platform === "linux") {
       const config = getLinuxCATrustConfig();
-      if (!fs.existsSync(config.certDir)) {
-        fs.mkdirSync(config.certDir, { recursive: true });
+      if (!fs2.existsSync(config.certDir)) {
+        fs2.mkdirSync(config.certDir, { recursive: true });
       }
       const dest = path.join(config.certDir, "portless-ca.crt");
-      fs.copyFileSync(caCertPath, dest);
-      execFileSync(config.updateCommand, [], { stdio: "pipe", timeout: 3e4 });
+      fs2.copyFileSync(caCertPath, dest);
+      execFileSync2(config.updateCommand, [], { stdio: "pipe", timeout: 3e4 });
+      if (isWSL()) {
+        trustWindowsCA(caCertPath, wslWindowsCAStoreOptions());
+      }
       writeTrustMarker(stateDir);
       return { trusted: true };
     } else if (process.platform === "win32") {
-      execFileSync("certutil", ["-addstore", "-user", "Root", caCertPath], {
-        stdio: "pipe",
-        timeout: 3e4
-      });
+      trustWindowsCA(caCertPath);
       writeTrustMarker(stateDir);
       return { trusted: true };
     }
@@ -637,18 +718,15 @@ function untrustCA(stateDir) {
     clearTrustMarker(stateDir);
     return { removed: true };
   }
-  if (!isCATrusted(stateDir)) {
-    clearTrustMarker(stateDir);
-    return { removed: true };
-  }
+  const runningInWSL = isWSL();
   try {
     let result;
     if (process.platform === "darwin") {
       result = untrustCAMacOS(caCertPath);
     } else if (process.platform === "linux") {
-      result = untrustCALinux(stateDir);
+      result = runningInWSL ? untrustCAWSL(stateDir, caCertPath) : untrustCALinux(stateDir);
     } else if (process.platform === "win32") {
-      result = untrustCAWindows(caCertPath);
+      result = untrustWindowsCA(caCertPath);
     } else {
       result = { removed: false, error: `Unsupported platform: ${process.platform}` };
     }
@@ -663,7 +741,7 @@ function untrustCAMacOS(caCertPath) {
   const errors = [];
   const tryExec = (args) => {
     try {
-      execFileSync("security", args, { stdio: "pipe", timeout: MACOS_SECURITY_ROOT_TIMEOUT_MS });
+      execFileSync2("security", args, { stdio: "pipe", timeout: MACOS_SECURITY_ROOT_TIMEOUT_MS });
       return true;
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
@@ -685,13 +763,13 @@ function isCATrustedMacOSAfterAttempt(caCertPath) {
     const isRoot = (process.getuid?.() ?? -1) === 0;
     const sudoUser = process.env.SUDO_USER;
     if (isRoot && sudoUser) {
-      execFileSync(
+      execFileSync2(
         "sudo",
         ["-u", sudoUser, "security", "verify-cert", "-c", caCertPath, "-L", "-p", "ssl"],
         { stdio: "pipe", timeout: MACOS_SECURITY_TIMEOUT_MS }
       );
     } else {
-      execFileSync("security", ["verify-cert", "-c", caCertPath, "-L", "-p", "ssl"], {
+      execFileSync2("security", ["verify-cert", "-c", caCertPath, "-L", "-p", "ssl"], {
         stdio: "pipe",
         timeout: MACOS_SECURITY_TIMEOUT_MS
       });
@@ -701,63 +779,67 @@ function isCATrustedMacOSAfterAttempt(caCertPath) {
     return false;
   }
 }
-function untrustCALinux(stateDir) {
+function untrustCALinux(stateDir, options = {}) {
   const errors = [];
-  let deletedAny = false;
-  for (const config of Object.values(LINUX_CA_TRUST_CONFIGS)) {
+  const pendingRefreshPath = path.join(stateDir, CA_TRUST_REFRESH_PENDING);
+  let refreshNeeded = fileExists(pendingRefreshPath);
+  const configs = options.configs ?? Object.values(LINUX_CA_TRUST_CONFIGS);
+  const activeConfig = options.activeConfig ?? getLinuxCATrustConfig();
+  const runUpdate = options.runUpdate ?? ((command) => {
+    execFileSync2(command, [], { stdio: "pipe", timeout: 3e4 });
+  });
+  for (const config of configs) {
     const dest = path.join(config.certDir, "portless-ca.crt");
     try {
       if (fileExists(dest)) {
-        const ours = fs.readFileSync(path.join(stateDir, CA_CERT_FILE), "utf-8").trim();
-        const installed = fs.readFileSync(dest, "utf-8").trim();
+        const ours = fs2.readFileSync(path.join(stateDir, CA_CERT_FILE), "utf-8").trim();
+        const installed = fs2.readFileSync(dest, "utf-8").trim();
         if (ours === installed) {
-          fs.unlinkSync(dest);
-          deletedAny = true;
+          if (!refreshNeeded) {
+            fs2.writeFileSync(pendingRefreshPath, "1\n");
+            fixOwnership(pendingRefreshPath);
+            refreshNeeded = true;
+          }
+          fs2.unlinkSync(dest);
         }
       }
     } catch (err) {
       errors.push(err instanceof Error ? err.message : String(err));
     }
   }
-  if (deletedAny) {
+  if (refreshNeeded) {
     try {
-      const config = getLinuxCATrustConfig();
-      execFileSync(config.updateCommand, [], { stdio: "pipe", timeout: 3e4 });
+      runUpdate(activeConfig.updateCommand);
     } catch (err) {
       errors.push(err instanceof Error ? err.message : String(err));
     }
   }
-  if (isCATrusted(stateDir)) {
+  if (errors.length > 0 || isCATrustedLinux(stateDir, activeConfig)) {
     return {
       removed: false,
       error: errors.join("; ") || "CA still trusted (remove portless-ca.crt and run the distro CA update command, often with sudo)"
     };
   }
+  clearTrustRefreshPending(stateDir);
   return { removed: true };
 }
-function untrustCAWindows(caCertPath) {
+function untrustCAWSL(stateDir, caCertPath) {
+  const linuxResult = untrustCALinux(stateDir);
+  let windowsResult;
   try {
-    const fingerprint = openssl(["x509", "-in", caCertPath, "-noout", "-fingerprint", "-sha1"]).trim().replace(/^.*=/, "").replace(/:/g, "").toLowerCase();
-    const storeListing = execFileSync("certutil", ["-store", "-user", "Root"], {
-      encoding: "utf-8",
-      timeout: 1e4,
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    const normalized = storeListing.replace(/\s/g, "").toLowerCase();
-    if (!normalized.includes(fingerprint)) {
-      return { removed: true };
-    }
-    execFileSync("certutil", ["-delstore", "-user", "Root", "portless Local CA"], {
-      stdio: "pipe",
-      timeout: 3e4
-    });
-    if (isCATrustedWindows(caCertPath)) {
-      return { removed: false, error: "certutil could not remove the portless CA from Root" };
-    }
-    return { removed: true };
+    windowsResult = untrustWindowsCA(caCertPath, wslWindowsCAStoreOptions());
   } catch (err) {
-    return { removed: false, error: err instanceof Error ? err.message : String(err) };
+    windowsResult = {
+      removed: false,
+      error: err instanceof Error ? err.message : String(err)
+    };
   }
+  if (linuxResult.removed && windowsResult.removed) return { removed: true };
+  const errors = [linuxResult.error, windowsResult.error].filter(Boolean);
+  return {
+    removed: false,
+    error: errors.join("; ") || "Could not remove the portless CA from every WSL trust store"
+  };
 }
 
 // src/tailscale.ts
@@ -766,7 +848,7 @@ var TAILSCALE_BINARY = "tailscale";
 var TAILSCALE_COMMAND_TIMEOUT_MS = 3e4;
 var PREFERRED_SERVE_PORTS = [443, 8443, 8444, 8445, 8446, 8447, 8448, 8449, 8450];
 var FUNNEL_PORTS = [443, 8443, 1e4];
-function defaultRunner(args) {
+function defaultRunner2(args) {
   const result = spawnSync(TAILSCALE_BINARY, args, {
     encoding: "utf-8",
     killSignal: "SIGKILL",
@@ -858,7 +940,7 @@ function throwFunnelNotEnabled(status) {
   );
 }
 function ensureTailscaleReady(options = {}) {
-  const runner = options.runner ?? defaultRunner;
+  const runner = options.runner ?? defaultRunner2;
   runOrThrow(["version"], "check tailscale version", runner);
   const statusResult = runOrThrow(["status", "--json"], "read tailscale status", runner);
   const status = parseStatusJson(statusResult.stdout);
@@ -874,7 +956,7 @@ function ensureTailscaleReady(options = {}) {
     baseUrl: `https://${dnsName}`
   };
 }
-function getUsedServePorts(runner = defaultRunner) {
+function getUsedServePorts(runner = defaultRunner2) {
   const result = runner(["serve", "status", "--json"]);
   if (result.error || result.status !== 0) {
     return /* @__PURE__ */ new Set();
@@ -970,7 +1052,7 @@ function register(mode, localPort, httpsPort, runner) {
   }
 }
 function unregister(mode, httpsPort, options) {
-  const runner = options?.runner ?? defaultRunner;
+  const runner = options?.runner ?? defaultRunner2;
   const result = runner([mode, "--yes", `--https=${httpsPort}`, "off"]);
   if (result.error) {
     const errno = result.error;
@@ -989,10 +1071,10 @@ ${result.stdout}`.toLowerCase();
   }
 }
 function registerServe(localPort, httpsPort, options) {
-  register("serve", localPort, httpsPort, options?.runner ?? defaultRunner);
+  register("serve", localPort, httpsPort, options?.runner ?? defaultRunner2);
 }
 function registerFunnel(localPort, httpsPort, options) {
-  register("funnel", localPort, httpsPort, options?.runner ?? defaultRunner);
+  register("funnel", localPort, httpsPort, options?.runner ?? defaultRunner2);
 }
 function unregisterTailscale(route) {
   if (!route.tailscaleHttpsPort) return;
@@ -1017,7 +1099,7 @@ function defaultSpawner(args) {
     windowsHide: true
   });
 }
-function defaultRunner2(args) {
+function defaultRunner3(args) {
   const result = spawnSync2(NGROK_BINARY, args, {
     encoding: "utf-8",
     killSignal: "SIGKILL",
@@ -1054,7 +1136,7 @@ function formatOutputError(output) {
     `Failed to start ngrok tunnel: ${details || "ngrok exited before printing a public URL"}`
   );
 }
-function ensureNgrokAvailable(runner = defaultRunner2) {
+function ensureNgrokAvailable(runner = defaultRunner3) {
   const result = runner(["version"]);
   if (result.error) {
     throw formatSpawnError(result.error);
@@ -1179,8 +1261,8 @@ function stopNgrok(route) {
 
 // src/auto.ts
 import { createHash as createHash2 } from "crypto";
-import { execFileSync as execFileSync2 } from "child_process";
-import * as fs2 from "fs";
+import { execFileSync as execFileSync3 } from "child_process";
+import * as fs3 from "fs";
 import * as path2 from "path";
 var MAX_DNS_LABEL_LENGTH = 63;
 function truncateLabel(label) {
@@ -1220,7 +1302,7 @@ function findPackageJsonName(startDir) {
   for (; ; ) {
     const pkgPath = path2.join(dir, "package.json");
     try {
-      const raw = fs2.readFileSync(pkgPath, "utf-8");
+      const raw = fs3.readFileSync(pkgPath, "utf-8");
       const pkg = JSON.parse(raw);
       if (typeof pkg.name === "string" && pkg.name) {
         return pkg.name.replace(/^@[^/]+\//, "");
@@ -1235,7 +1317,7 @@ function findPackageJsonName(startDir) {
 }
 function findGitRoot(startDir) {
   try {
-    const toplevel = execFileSync2("git", ["rev-parse", "--show-toplevel"], {
+    const toplevel = execFileSync3("git", ["rev-parse", "--show-toplevel"], {
       cwd: startDir,
       encoding: "utf-8",
       timeout: 5e3,
@@ -1248,7 +1330,7 @@ function findGitRoot(startDir) {
   for (; ; ) {
     const gitPath = path2.join(dir, ".git");
     try {
-      const stat = fs2.statSync(gitPath);
+      const stat = fs3.statSync(gitPath);
       if (stat.isDirectory()) return dir;
       if (stat.isFile()) return dir;
     } catch {
@@ -1276,7 +1358,7 @@ function detectWorktreePrefix(cwd = process.cwd()) {
 }
 function detectWorktreeViaCli(cwd) {
   try {
-    const listOutput = execFileSync2("git", ["worktree", "list", "--porcelain"], {
+    const listOutput = execFileSync3("git", ["worktree", "list", "--porcelain"], {
       cwd,
       encoding: "utf-8",
       timeout: 5e3,
@@ -1286,7 +1368,7 @@ function detectWorktreeViaCli(cwd) {
     if (worktreeCount <= 1) return null;
     const gitDir = path2.resolve(
       cwd,
-      execFileSync2("git", ["rev-parse", "--git-dir"], {
+      execFileSync3("git", ["rev-parse", "--git-dir"], {
         cwd,
         encoding: "utf-8",
         timeout: 5e3,
@@ -1295,7 +1377,7 @@ function detectWorktreeViaCli(cwd) {
     );
     const gitCommonDir = path2.resolve(
       cwd,
-      execFileSync2("git", ["rev-parse", "--git-common-dir"], {
+      execFileSync3("git", ["rev-parse", "--git-common-dir"], {
         cwd,
         encoding: "utf-8",
         timeout: 5e3,
@@ -1303,7 +1385,7 @@ function detectWorktreeViaCli(cwd) {
       }).trim()
     );
     if (gitDir === gitCommonDir) return null;
-    const branch = execFileSync2("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+    const branch = execFileSync3("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
       cwd,
       encoding: "utf-8",
       timeout: 5e3,
@@ -1321,12 +1403,12 @@ function detectWorktreeViaFilesystem(startDir) {
   for (; ; ) {
     const gitPath = path2.join(dir, ".git");
     try {
-      const stat = fs2.statSync(gitPath);
+      const stat = fs3.statSync(gitPath);
       if (stat.isDirectory()) {
         return null;
       }
       if (stat.isFile()) {
-        const content = fs2.readFileSync(gitPath, "utf-8").trim();
+        const content = fs3.readFileSync(gitPath, "utf-8").trim();
         const match = content.match(/^gitdir:\s*(.+)$/);
         if (!match) return null;
         const gitdir = match[1];
@@ -1346,7 +1428,7 @@ function detectWorktreeViaFilesystem(startDir) {
 }
 function readBranchFromHead(gitdir) {
   try {
-    const head = fs2.readFileSync(path2.join(gitdir, "HEAD"), "utf-8").trim();
+    const head = fs3.readFileSync(path2.join(gitdir, "HEAD"), "utf-8").trim();
     const refMatch = head.match(/^ref: refs\/heads\/(.+)$/);
     return refMatch ? refMatch[1] : null;
   } catch {
@@ -1355,11 +1437,11 @@ function readBranchFromHead(gitdir) {
 }
 
 // src/cli-utils.ts
-import * as fs3 from "fs";
+import * as fs4 from "fs";
 import * as http from "http";
 import * as https from "https";
 import * as net from "net";
-import * as os from "os";
+import * as os2 from "os";
 import * as path3 from "path";
 import * as readline from "readline";
 import { execSync, spawn as spawn2 } from "child_process";
@@ -1368,8 +1450,8 @@ var FALLBACK_PROXY_PORT = 1355;
 var PRIVILEGED_PORT_THRESHOLD = 1024;
 var INTERNAL_LAN_IP_ENV = "PORTLESS_INTERNAL_LAN_IP";
 var INTERNAL_LAN_IP_FLAG = "--lan-ip-auto";
-var LEGACY_SYSTEM_STATE_DIR = isWindows ? path3.join(os.tmpdir(), "portless") : "/tmp/portless";
-var USER_STATE_DIR = path3.join(os.homedir(), ".portless");
+var LEGACY_SYSTEM_STATE_DIR = isWindows ? path3.join(os2.tmpdir(), "portless") : "/tmp/portless";
+var USER_STATE_DIR = path3.join(resolveUserHome(), ".portless");
 var MIN_APP_PORT = 4e3;
 var MAX_APP_PORT = 4999;
 var RANDOM_PORT_ATTEMPTS = 50;
@@ -1504,7 +1586,7 @@ function resolveStateDir(_port) {
 }
 function readPortFromDir(dir) {
   try {
-    const raw = fs3.readFileSync(path3.join(dir, "proxy.port"), "utf-8").trim();
+    const raw = fs4.readFileSync(path3.join(dir, "proxy.port"), "utf-8").trim();
     const port = parseInt(raw, 10);
     return isNaN(port) ? null : port;
   } catch {
@@ -1515,7 +1597,7 @@ var TLS_MARKER_FILE = "proxy.tls";
 var CUSTOM_CERT_MARKER_FILE = "proxy.custom-cert";
 function readTlsMarker(dir) {
   try {
-    return fs3.existsSync(path3.join(dir, TLS_MARKER_FILE));
+    return fs4.existsSync(path3.join(dir, TLS_MARKER_FILE));
   } catch {
     return false;
   }
@@ -1523,17 +1605,17 @@ function readTlsMarker(dir) {
 function writeTlsMarker(dir, enabled2) {
   const markerPath = path3.join(dir, TLS_MARKER_FILE);
   if (enabled2) {
-    fs3.writeFileSync(markerPath, "1", { mode: 420 });
+    fs4.writeFileSync(markerPath, "1", { mode: 420 });
   } else {
     try {
-      fs3.unlinkSync(markerPath);
+      fs4.unlinkSync(markerPath);
     } catch {
     }
   }
 }
 function readCustomCertMarker(dir) {
   try {
-    return fs3.existsSync(path3.join(dir, CUSTOM_CERT_MARKER_FILE));
+    return fs4.existsSync(path3.join(dir, CUSTOM_CERT_MARKER_FILE));
   } catch {
     return false;
   }
@@ -1541,10 +1623,10 @@ function readCustomCertMarker(dir) {
 function writeCustomCertMarker(dir, enabled2) {
   const markerPath = path3.join(dir, CUSTOM_CERT_MARKER_FILE);
   if (enabled2) {
-    fs3.writeFileSync(markerPath, "1", { mode: 420 });
+    fs4.writeFileSync(markerPath, "1", { mode: 420 });
   } else {
     try {
-      fs3.unlinkSync(markerPath);
+      fs4.unlinkSync(markerPath);
     } catch {
     }
   }
@@ -1552,7 +1634,7 @@ function writeCustomCertMarker(dir, enabled2) {
 var LAN_MARKER_FILE = "proxy.lan";
 function readLanMarker(dir) {
   try {
-    const raw = fs3.readFileSync(path3.join(dir, LAN_MARKER_FILE), "utf-8").trim();
+    const raw = fs4.readFileSync(path3.join(dir, LAN_MARKER_FILE), "utf-8").trim();
     return raw || null;
   } catch {
     return null;
@@ -1562,11 +1644,11 @@ function writeLanMarker(dir, ip) {
   const markerPath = path3.join(dir, LAN_MARKER_FILE);
   if (!ip) {
     try {
-      fs3.unlinkSync(markerPath);
+      fs4.unlinkSync(markerPath);
     } catch {
     }
   } else {
-    fs3.writeFileSync(markerPath, ip, { mode: 420 });
+    fs4.writeFileSync(markerPath, ip, { mode: 420 });
   }
 }
 var DEFAULT_TLD = "localhost";
@@ -1610,7 +1692,7 @@ var TLD_FILE = "proxy.tld";
 var TLDS_FILE = "proxy.tlds";
 function readLegacyTldFromDir(dir) {
   try {
-    const raw = fs3.readFileSync(path3.join(dir, TLD_FILE), "utf-8").trim();
+    const raw = fs4.readFileSync(path3.join(dir, TLD_FILE), "utf-8").trim();
     return raw || DEFAULT_TLD;
   } catch {
     return DEFAULT_TLD;
@@ -1618,7 +1700,7 @@ function readLegacyTldFromDir(dir) {
 }
 function readTldsFromDir(dir) {
   try {
-    const raw = fs3.readFileSync(path3.join(dir, TLDS_FILE), "utf-8").trim();
+    const raw = fs4.readFileSync(path3.join(dir, TLDS_FILE), "utf-8").trim();
     const parsed = raw.startsWith("[") ? JSON.parse(raw) : raw.split(/\r?\n/).flatMap((line) => line.split(",")).map((line) => line.trim()).filter(Boolean);
     if (!Array.isArray(parsed)) return [readLegacyTldFromDir(dir)];
     const tlds = parsed.flatMap((value) => typeof value === "string" ? parseTldList(value) : []);
@@ -1633,16 +1715,16 @@ function writeTldsFile(dir, tlds) {
   const tldPath = path3.join(dir, TLD_FILE);
   if (uniqueTlds.length === 1 && uniqueTlds[0] === DEFAULT_TLD) {
     try {
-      fs3.unlinkSync(tldsPath);
+      fs4.unlinkSync(tldsPath);
     } catch {
     }
     try {
-      fs3.unlinkSync(tldPath);
+      fs4.unlinkSync(tldPath);
     } catch {
     }
   } else {
-    fs3.writeFileSync(tldsPath, uniqueTlds.join("\n") + "\n", { mode: 420 });
-    fs3.writeFileSync(tldPath, uniqueTlds[0] ?? DEFAULT_TLD, { mode: 420 });
+    fs4.writeFileSync(tldsPath, uniqueTlds.join("\n") + "\n", { mode: 420 });
+    fs4.writeFileSync(tldPath, uniqueTlds[0] ?? DEFAULT_TLD, { mode: 420 });
   }
 }
 function writeTldFile(dir, tld) {
@@ -1957,7 +2039,7 @@ function collectBinPaths(cwd) {
   let dir = cwd;
   for (; ; ) {
     const bin = path3.join(dir, "node_modules", ".bin");
-    if (fs3.existsSync(bin)) {
+    if (fs4.existsSync(bin)) {
       dirs.push(bin);
     }
     const parent = path3.dirname(dir);
@@ -2088,7 +2170,7 @@ function injectFrameworkFlags(commandArgs, port) {
 }
 
 // src/clean-utils.ts
-import * as fs4 from "fs";
+import * as fs5 from "fs";
 import * as path4 from "path";
 var PORTLESS_STATE_FILES = [
   "routes.json",
@@ -2101,6 +2183,8 @@ var PORTLESS_STATE_FILES = [
   "proxy.tld",
   "proxy.tlds",
   "proxy.lan",
+  "ca.trusted",
+  "ca.trust-refresh-pending",
   "ca-key.pem",
   "ca.pem",
   "server-key.pem",
@@ -2110,28 +2194,38 @@ var PORTLESS_STATE_FILES = [
   "ca.srl"
 ];
 var HOST_CERTS_DIR2 = "host-certs";
+var CA_IDENTITY_FILES = /* @__PURE__ */ new Set(["ca-key.pem", "ca.pem", "ca.trust-refresh-pending"]);
 function collectStateDirsForCleanup() {
   const dirs = /* @__PURE__ */ new Set();
   const add = (d) => {
     const trimmed = d?.trim();
     if (!trimmed) return;
     const resolved = path4.resolve(trimmed);
-    if (fs4.existsSync(resolved)) dirs.add(resolved);
+    if (fs5.existsSync(resolved)) dirs.add(resolved);
   };
   add(USER_STATE_DIR);
   add(LEGACY_SYSTEM_STATE_DIR);
   add(process.env.PORTLESS_STATE_DIR);
   return [...dirs];
 }
-function removePortlessStateFiles(dir) {
+function attemptCATrustRemovalForCleanup(stateDirs, untrust) {
+  const results = /* @__PURE__ */ new Map();
+  for (const stateDir of stateDirs) {
+    if (!fs5.existsSync(path4.join(stateDir, "ca.pem"))) continue;
+    results.set(stateDir, untrust(stateDir));
+  }
+  return results;
+}
+function removePortlessStateFiles(dir, options = {}) {
   for (const f of PORTLESS_STATE_FILES) {
+    if (options.preserveCAIdentity && CA_IDENTITY_FILES.has(f)) continue;
     try {
-      fs4.unlinkSync(path4.join(dir, f));
+      fs5.unlinkSync(path4.join(dir, f));
     } catch {
     }
   }
   try {
-    fs4.rmSync(path4.join(dir, HOST_CERTS_DIR2), { recursive: true, force: true });
+    fs5.rmSync(path4.join(dir, HOST_CERTS_DIR2), { recursive: true, force: true });
   } catch {
   }
 }
@@ -2340,7 +2434,7 @@ function cleanupAll() {
 }
 
 // src/config.ts
-import * as fs5 from "fs";
+import * as fs6 from "fs";
 import * as path5 from "path";
 var ConfigValidationError = class extends Error {
   constructor(message) {
@@ -2352,7 +2446,7 @@ var CONFIG_FILENAME = "portless.json";
 function loadConfig(cwd = process.cwd()) {
   const configPath = path5.join(cwd, CONFIG_FILENAME);
   try {
-    const raw = fs5.readFileSync(configPath, "utf-8");
+    const raw = fs6.readFileSync(configPath, "utf-8");
     const parsed = JSON.parse(raw);
     validateConfig(parsed, configPath);
     return { config: parsed, configDir: cwd };
@@ -2375,7 +2469,7 @@ function normalizePortlessValue(value) {
 function loadConfigFromPackageJson(dir) {
   const pkgPath = path5.join(dir, "package.json");
   try {
-    const raw = fs5.readFileSync(pkgPath, "utf-8");
+    const raw = fs6.readFileSync(pkgPath, "utf-8");
     const pkg = JSON.parse(raw);
     if (pkg && typeof pkg === "object" && "portless" in pkg) {
       const config = normalizePortlessValue(pkg.portless);
@@ -2393,7 +2487,7 @@ function loadConfigFromPackageJson(dir) {
 function loadPackagePortlessConfig(dir) {
   const pkgPath = path5.join(dir, "package.json");
   try {
-    const raw = fs5.readFileSync(pkgPath, "utf-8");
+    const raw = fs6.readFileSync(pkgPath, "utf-8");
     const pkg = JSON.parse(raw);
     if (pkg && typeof pkg === "object" && "portless" in pkg) {
       const config = normalizePortlessValue(pkg.portless);
@@ -2429,7 +2523,7 @@ function resolveAppConfig(config, configDir, packageDir) {
 function hasScript(scriptName, dir) {
   const pkgPath = path5.join(dir, "package.json");
   try {
-    const raw = fs5.readFileSync(pkgPath, "utf-8");
+    const raw = fs6.readFileSync(pkgPath, "utf-8");
     const pkg = JSON.parse(raw);
     return typeof pkg?.scripts?.[scriptName] === "string";
   } catch {
@@ -2448,7 +2542,7 @@ function detectPackageManager(cwd) {
   for (; ; ) {
     const pkgPath = path5.join(dir, "package.json");
     try {
-      const raw = fs5.readFileSync(pkgPath, "utf-8");
+      const raw = fs6.readFileSync(pkgPath, "utf-8");
       const pkg = JSON.parse(raw);
       if (typeof pkg.packageManager === "string") {
         const name = pkg.packageManager.split("@")[0];
@@ -2460,7 +2554,7 @@ function detectPackageManager(cwd) {
     }
     for (const [file, pm] of LOCK_FILES) {
       try {
-        fs5.accessSync(path5.join(dir, file), fs5.constants.F_OK);
+        fs6.accessSync(path5.join(dir, file), fs6.constants.F_OK);
         return pm;
       } catch {
       }
@@ -2619,13 +2713,13 @@ function warnUnknownKeys(obj, known, configPath, prefix) {
 }
 
 // src/workspace.ts
-import * as fs6 from "fs";
+import * as fs7 from "fs";
 import * as path6 from "path";
 function findWorkspaceRoot(cwd = process.cwd()) {
   let dir = cwd;
   for (; ; ) {
     try {
-      fs6.accessSync(path6.join(dir, "pnpm-workspace.yaml"), fs6.constants.R_OK);
+      fs7.accessSync(path6.join(dir, "pnpm-workspace.yaml"), fs7.constants.R_OK);
       return dir;
     } catch {
     }
@@ -2639,7 +2733,7 @@ function findWorkspaceRoot(cwd = process.cwd()) {
 }
 function detectWorkspaceSource(workspaceRoot) {
   try {
-    fs6.accessSync(path6.join(workspaceRoot, "pnpm-workspace.yaml"), fs6.constants.R_OK);
+    fs7.accessSync(path6.join(workspaceRoot, "pnpm-workspace.yaml"), fs7.constants.R_OK);
     return "pnpm";
   } catch {
   }
@@ -2651,7 +2745,7 @@ function detectWorkspaceSource(workspaceRoot) {
 function readWorkspacesFromPackageJson(dir) {
   const pkgPath = path6.join(dir, "package.json");
   try {
-    const raw = fs6.readFileSync(pkgPath, "utf-8");
+    const raw = fs7.readFileSync(pkgPath, "utf-8");
     const pkg = JSON.parse(raw);
     if (!pkg || typeof pkg !== "object") return null;
     const ws = pkg.workspaces;
@@ -2672,7 +2766,7 @@ function discoverWorkspacePackages(workspaceRoot) {
     const wsPath = path6.join(workspaceRoot, "pnpm-workspace.yaml");
     let content;
     try {
-      content = fs6.readFileSync(wsPath, "utf-8");
+      content = fs7.readFileSync(wsPath, "utf-8");
     } catch {
       return [];
     }
@@ -2687,7 +2781,7 @@ function discoverWorkspacePackages(workspaceRoot) {
   for (const dir of dirs) {
     const pkgPath = path6.join(dir, "package.json");
     try {
-      const raw = fs6.readFileSync(pkgPath, "utf-8");
+      const raw = fs7.readFileSync(pkgPath, "utf-8");
       const pkg = JSON.parse(raw);
       const rawName = typeof pkg.name === "string" ? pkg.name : null;
       const scopeMatch = rawName?.match(/^@([^/]+)\//);
@@ -2769,7 +2863,7 @@ function expandSingleGlob(root, glob) {
 function expandSegments(base, segments) {
   if (segments.length === 0) {
     try {
-      const stat = fs6.statSync(base);
+      const stat = fs7.statSync(base);
       if (stat.isDirectory()) return [base];
     } catch {
     }
@@ -2778,7 +2872,7 @@ function expandSegments(base, segments) {
   const [current, ...rest] = segments;
   if (current.includes("*")) {
     try {
-      const entries = fs6.readdirSync(base, { withFileTypes: true });
+      const entries = fs7.readdirSync(base, { withFileTypes: true });
       const matched = entries.filter((e) => e.isDirectory() && segmentMatches(current, e.name));
       if (rest.length === 0) {
         return matched.map((e) => path6.join(base, e.name));
@@ -2796,7 +2890,7 @@ function expandSegments(base, segments) {
 }
 
 // src/turbo.ts
-import * as fs7 from "fs";
+import * as fs8 from "fs";
 import * as path7 from "path";
 var LOADER_FILENAME = "turbo-env-loader.cjs";
 var MANIFEST_FILENAME = "dev-manifest.json";
@@ -2826,23 +2920,23 @@ try {
 `;
 }
 function ensureEnvLoader(baseDir = USER_STATE_DIR) {
-  fs7.mkdirSync(baseDir, { recursive: true, mode: 493 });
+  fs8.mkdirSync(baseDir, { recursive: true, mode: 493 });
   const target = loaderPath(baseDir);
   const source = loaderSource(baseDir);
   try {
-    const existing = fs7.readFileSync(target, "utf-8");
+    const existing = fs8.readFileSync(target, "utf-8");
     if (existing === source) return;
   } catch {
   }
-  fs7.writeFileSync(target, source, { mode: 420 });
+  fs8.writeFileSync(target, source, { mode: 420 });
 }
 function writeManifest(entries, baseDir = USER_STATE_DIR) {
-  fs7.mkdirSync(baseDir, { recursive: true, mode: 493 });
-  fs7.writeFileSync(manifestPath(baseDir), JSON.stringify(entries, null, 2) + "\n", { mode: 420 });
+  fs8.mkdirSync(baseDir, { recursive: true, mode: 493 });
+  fs8.writeFileSync(manifestPath(baseDir), JSON.stringify(entries, null, 2) + "\n", { mode: 420 });
 }
 function removeManifest(baseDir = USER_STATE_DIR) {
   try {
-    fs7.unlinkSync(manifestPath(baseDir));
+    fs8.unlinkSync(manifestPath(baseDir));
   } catch {
   }
 }
@@ -2854,7 +2948,7 @@ function buildNodeOptions(baseDir = USER_STATE_DIR) {
 }
 function hasTurboConfig(wsRoot) {
   try {
-    fs7.accessSync(path7.join(wsRoot, "turbo.json"), fs7.constants.R_OK);
+    fs8.accessSync(path7.join(wsRoot, "turbo.json"), fs8.constants.R_OK);
     return true;
   } catch {
     return false;
@@ -2862,8 +2956,8 @@ function hasTurboConfig(wsRoot) {
 }
 
 // src/service.ts
-import * as fs8 from "fs";
-import * as os2 from "os";
+import * as fs9 from "fs";
+import * as os3 from "os";
 import * as path8 from "path";
 import { spawnSync as spawnSync4 } from "child_process";
 var DEFAULT_SERVICE_PORT = getProtocolPort(true);
@@ -2894,7 +2988,7 @@ var DEFAULT_SERVICE_CONFIG = {
   useWildcard: false,
   extraEnv: {}
 };
-function defaultRunner3(command, args, options) {
+function defaultRunner4(command, args, options) {
   return spawnSync4(command, args, {
     encoding: "utf-8",
     stdio: options?.stdio ?? "pipe"
@@ -2936,7 +3030,7 @@ function getFlagValue(args, index, flag) {
   return value;
 }
 function resolveServicePath(value) {
-  const expanded = value === "~" ? os2.homedir() : value.startsWith("~/") || value.startsWith("~\\") ? path8.join(os2.homedir(), value.slice(2)) : value;
+  const expanded = value === "~" ? os3.homedir() : value.startsWith("~/") || value.startsWith("~\\") ? path8.join(os3.homedir(), value.slice(2)) : value;
   return path8.resolve(expanded);
 }
 function normalizeServiceInstallPaths(config) {
@@ -3064,34 +3158,21 @@ function parseServiceInstallConfig(args, env = process.env, options = {}) {
   }
   return config;
 }
-function readPasswdHome(username) {
-  try {
-    const passwd = fs8.readFileSync("/etc/passwd", "utf-8");
-    for (const line of passwd.split("\n")) {
-      const fields = line.split(":");
-      if (fields[0] === username && fields[5]) {
-        return fields[5];
-      }
-    }
-  } catch {
-  }
-  return null;
-}
 function resolveUserContext(platform) {
   if (platform === "win32") {
-    const home = process.env.USERPROFILE || os2.homedir();
+    const home = resolveUserHome({ platform });
     return { home, username: process.env.USERNAME };
   }
   const sudoUser = process.env.SUDO_USER;
   const sudoUid = process.env.SUDO_UID;
   const sudoGid = process.env.SUDO_GID;
   if (sudoUser && sudoUser !== "root") {
-    const home = process.env.HOME && process.env.HOME !== "/var/root" && process.env.HOME !== "/root" ? process.env.HOME : readPasswdHome(sudoUser) || (platform === "darwin" ? path8.posix.join("/Users", sudoUser) : path8.posix.join("/home", sudoUser));
+    const home = resolveUserHome({ platform });
     return { home, uid: sudoUid, gid: sudoGid, username: sudoUser };
   }
-  const userInfo2 = os2.userInfo();
+  const userInfo2 = os3.userInfo();
   return {
-    home: os2.homedir(),
+    home: os3.homedir(),
     uid: process.getuid?.()?.toString(),
     gid: process.getgid?.()?.toString(),
     username: userInfo2.username
@@ -3369,8 +3450,8 @@ function parsePlistEnv(block) {
 function readInstalledServiceSnapshot(spec) {
   try {
     if (spec.platform === "darwin") {
-      if (!fs8.existsSync(spec.plistPath)) return null;
-      const plist = fs8.readFileSync(spec.plistPath, "utf-8");
+      if (!fs9.existsSync(spec.plistPath)) return null;
+      const plist = fs9.readFileSync(spec.plistPath, "utf-8");
       const argsBlock = plist.match(/<key>ProgramArguments<\/key>\s*<array>([\s\S]*?)<\/array>/);
       const envBlock = plist.match(/<key>EnvironmentVariables<\/key>\s*<dict>([\s\S]*?)<\/dict>/);
       if (!argsBlock) return null;
@@ -3380,8 +3461,8 @@ function readInstalledServiceSnapshot(spec) {
       };
     }
     if (spec.platform === "linux") {
-      if (!fs8.existsSync(spec.unitPath)) return null;
-      const unit = fs8.readFileSync(spec.unitPath, "utf-8");
+      if (!fs9.existsSync(spec.unitPath)) return null;
+      const unit = fs9.readFileSync(spec.unitPath, "utf-8");
       const env2 = {};
       let command = null;
       for (const line of unit.split("\n")) {
@@ -3399,8 +3480,8 @@ function readInstalledServiceSnapshot(spec) {
       }
       return command ? { command, env: env2 } : null;
     }
-    if (!fs8.existsSync(spec.scriptPath)) return null;
-    const script = fs8.readFileSync(spec.scriptPath, "utf-8");
+    if (!fs9.existsSync(spec.scriptPath)) return null;
+    const script = fs9.readFileSync(spec.scriptPath, "utf-8");
     const env = {};
     let commandLine = null;
     for (const rawLine of script.split(/\r?\n/)) {
@@ -3462,7 +3543,7 @@ function buildElevatedEnvArgs(options) {
 }
 function buildServiceUninstallSudoArgs(entryScript, options = {}) {
   const env = options.env ?? process.env;
-  const home = options.home ?? os2.homedir();
+  const home = options.home ?? os3.homedir();
   const stateDir = options.stateDir ?? env.PORTLESS_STATE_DIR ?? path8.join(home, ".portless");
   return [
     ...buildElevatedEnvArgs({ home, stateDir, env }),
@@ -3476,7 +3557,7 @@ function requireUnixElevation(args, runner) {
   if (process.platform !== "darwin" && process.platform !== "linux") return;
   if ((process.getuid?.() ?? -1) === 0) return;
   if (process.env[INTERNAL_ELEVATED_ENV] === "1") return;
-  const home = os2.homedir();
+  const home = os3.homedir();
   const stateDir = process.env.PORTLESS_STATE_DIR || path8.join(home, ".portless");
   const result = runner(
     "sudo",
@@ -3533,7 +3614,7 @@ async function stopExistingProxy(entryScript, runner, proxyPort) {
   }
 }
 function prepareServiceState(stateDir) {
-  fs8.mkdirSync(stateDir, { recursive: true });
+  fs9.mkdirSync(stateDir, { recursive: true });
   fixOwnership(stateDir);
 }
 function prepareTrust(stateDir) {
@@ -3581,8 +3662,8 @@ async function installService(entryScript, runner, args) {
   if (spec.platform === "darwin") {
     runOptional(runner, "launchctl", ["bootout", "system", spec.plistPath]);
     await stopExistingProxy(entryScript, runner, spec.config.proxyPort);
-    fs8.writeFileSync(spec.plistPath, spec.plist);
-    fs8.chmodSync(spec.plistPath, 420);
+    fs9.writeFileSync(spec.plistPath, spec.plist);
+    fs9.chmodSync(spec.plistPath, 420);
     runRequired(runner, "chown", ["root:wheel", spec.plistPath]);
     runRequired(runner, "launchctl", ["bootstrap", "system", spec.plistPath]);
     runRequired(runner, "launchctl", ["enable", `system/${spec.label}`]);
@@ -3590,16 +3671,16 @@ async function installService(entryScript, runner, args) {
   } else if (spec.platform === "linux") {
     runOptional(runner, "systemctl", ["disable", "--now", spec.serviceName]);
     await stopExistingProxy(entryScript, runner, spec.config.proxyPort);
-    fs8.writeFileSync(spec.unitPath, spec.unit);
-    fs8.chmodSync(spec.unitPath, 420);
+    fs9.writeFileSync(spec.unitPath, spec.unit);
+    fs9.chmodSync(spec.unitPath, 420);
     runRequired(runner, "systemctl", ["daemon-reload"]);
     runRequired(runner, "systemctl", ["enable", spec.serviceName]);
     runRequired(runner, "systemctl", ["restart", spec.serviceName]);
   } else {
     runOptional(runner, "schtasks", ["/End", "/TN", spec.taskName]);
     await stopExistingProxy(entryScript, runner, spec.config.proxyPort);
-    fs8.mkdirSync(spec.scriptDir, { recursive: true });
-    fs8.writeFileSync(spec.scriptPath, spec.script);
+    fs9.mkdirSync(spec.scriptDir, { recursive: true });
+    fs9.writeFileSync(spec.scriptPath, spec.script);
     runRequired(runner, "schtasks", spec.createArgs);
     runOptional(runner, "schtasks", spec.runArgs);
   }
@@ -3612,32 +3693,32 @@ async function uninstallService(entryScript, runner) {
   const spec = currentServiceSpec(entryScript);
   if (spec.platform === "darwin") {
     runOptional(runner, "launchctl", ["bootout", "system", spec.plistPath]);
-    fs8.rmSync(spec.plistPath, { force: true });
+    fs9.rmSync(spec.plistPath, { force: true });
   } else if (spec.platform === "linux") {
     runOptional(runner, "systemctl", ["disable", "--now", spec.serviceName]);
-    fs8.rmSync(spec.unitPath, { force: true });
+    fs9.rmSync(spec.unitPath, { force: true });
     runOptional(runner, "systemctl", ["daemon-reload"]);
   } else {
     runOptional(runner, "schtasks", ["/End", "/TN", spec.taskName]);
     runOptional(runner, "schtasks", spec.deleteArgs);
-    fs8.rmSync(spec.scriptDir, { recursive: true, force: true });
+    fs9.rmSync(spec.scriptDir, { recursive: true, force: true });
   }
   console.log(colors_default.green("Portless service uninstalled."));
 }
-function tryUninstallService(entryScript, runner = defaultRunner3) {
+function tryUninstallService(entryScript, runner = defaultRunner4) {
   let installed = false;
   try {
     const spec = currentServiceSpec(entryScript);
     if (spec.platform === "darwin") {
-      installed = fs8.existsSync(spec.plistPath);
+      installed = fs9.existsSync(spec.plistPath);
       if (!installed) return { removed: false, installed: false };
       runOptional(runner, "launchctl", ["bootout", "system", spec.plistPath]);
-      fs8.rmSync(spec.plistPath, { force: true });
+      fs9.rmSync(spec.plistPath, { force: true });
     } else if (spec.platform === "linux") {
-      installed = fs8.existsSync(spec.unitPath);
+      installed = fs9.existsSync(spec.unitPath);
       if (!installed) return { removed: false, installed: false };
       runOptional(runner, "systemctl", ["disable", "--now", spec.serviceName]);
-      fs8.rmSync(spec.unitPath, { force: true });
+      fs9.rmSync(spec.unitPath, { force: true });
       runOptional(runner, "systemctl", ["daemon-reload"]);
     } else {
       const query = runner("schtasks", ["/Query", "/TN", spec.taskName, "/FO", "LIST"]);
@@ -3645,7 +3726,7 @@ function tryUninstallService(entryScript, runner = defaultRunner3) {
       if (!installed) return { removed: false, installed: false };
       runOptional(runner, "schtasks", ["/End", "/TN", spec.taskName]);
       runRequired(runner, "schtasks", spec.deleteArgs);
-      fs8.rmSync(spec.scriptDir, { recursive: true, force: true });
+      fs9.rmSync(spec.scriptDir, { recursive: true, force: true });
     }
     return { removed: true, installed: true };
   } catch (err) {
@@ -3662,7 +3743,7 @@ async function getServiceStatus(entryScript, runner) {
   const installedConfig = readInstalledServiceConfig(spec) ?? spec.config;
   const proxyRunning = await isProxyRunning(installedConfig.proxyPort, installedConfig.useHttps);
   if (spec.platform === "darwin") {
-    const installed2 = fs8.existsSync(spec.plistPath);
+    const installed2 = fs9.existsSync(spec.plistPath);
     const result = runner("launchctl", ["print", `system/${spec.label}`]);
     const output2 = `${result.stdout || ""}${result.stderr || ""}`;
     const managerState = result.status === 0 && /state = running|pid = \d+/.test(output2) ? "running" : installed2 ? "installed" : "not installed";
@@ -3677,7 +3758,7 @@ async function getServiceStatus(entryScript, runner) {
   if (spec.platform === "linux") {
     const enabled2 = runner("systemctl", ["is-enabled", spec.serviceName]);
     const active = runner("systemctl", ["is-active", spec.serviceName]);
-    const installed2 = enabled2.status === 0 || active.status === 0 || fs8.existsSync(spec.unitPath);
+    const installed2 = enabled2.status === 0 || active.status === 0 || fs9.existsSync(spec.unitPath);
     const activeText = (active.stdout || "").trim();
     return {
       installed: installed2,
@@ -3752,7 +3833,7 @@ ${colors_default.bold("Notes:")}
 }
 async function handleService(args, options) {
   const action = args[1];
-  const runner = options.runner || defaultRunner3;
+  const runner = options.runner || defaultRunner4;
   if (!action || action === "--help" || action === "-h") {
     printServiceHelp();
     process.exit(0);
@@ -3949,7 +4030,7 @@ function getEntryScript() {
 function isLocallyInstalled() {
   let dir = process.cwd();
   for (; ; ) {
-    if (fs9.existsSync(path9.join(dir, "node_modules", "portless", "package.json"))) {
+    if (fs10.existsSync(path9.join(dir, "node_modules", "portless", "package.json"))) {
       return true;
     }
     const parent = path9.dirname(dir);
@@ -4063,11 +4144,11 @@ function startProxyServer(store, proxyPort, tld, tlds, tlsOptions, lanIp, strict
     console.warn(chalk.yellow(`LAN mode disabled: ${reason}`));
   }
   const routesPath = store.getRoutesPath();
-  if (!fs9.existsSync(routesPath)) {
-    fs9.writeFileSync(routesPath, "[]", { mode: FILE_MODE });
+  if (!fs10.existsSync(routesPath)) {
+    fs10.writeFileSync(routesPath, "[]", { mode: FILE_MODE });
   }
   try {
-    fs9.chmodSync(routesPath, FILE_MODE);
+    fs10.chmodSync(routesPath, FILE_MODE);
   } catch {
   }
   fixOwnership(routesPath);
@@ -4127,7 +4208,7 @@ function startProxyServer(store, proxyPort, tld, tlds, tlsOptions, lanIp, strict
     }
   };
   try {
-    watcher = fs9.watch(routesPath, () => {
+    watcher = fs10.watch(routesPath, () => {
       if (debounceTimer) clearTimeout(debounceTimer);
       debounceTimer = setTimeout(reloadRoutes, DEBOUNCE_MS);
     });
@@ -4178,8 +4259,8 @@ function startProxyServer(store, proxyPort, tld, tlds, tlsOptions, lanIp, strict
     redirectServer.listen(80);
   }
   server.listen(proxyPort, () => {
-    fs9.writeFileSync(store.pidPath, process.pid.toString(), { mode: FILE_MODE });
-    fs9.writeFileSync(store.portFilePath, proxyPort.toString(), { mode: FILE_MODE });
+    fs10.writeFileSync(store.pidPath, process.pid.toString(), { mode: FILE_MODE });
+    fs10.writeFileSync(store.portFilePath, proxyPort.toString(), { mode: FILE_MODE });
     writeTlsMarker(store.dir, isTls);
     writeCustomCertMarker(store.dir, isTls && customCert);
     writeTldsFile(store.dir, tlds);
@@ -4228,11 +4309,11 @@ function startProxyServer(store, proxyPort, tld, tlds, tlsOptions, lanIp, strict
       redirectServer.close();
     }
     try {
-      fs9.unlinkSync(store.pidPath);
+      fs10.unlinkSync(store.pidPath);
     } catch {
     }
     try {
-      fs9.unlinkSync(store.portFilePath);
+      fs10.unlinkSync(store.portFilePath);
     } catch {
     }
     writeTlsMarker(store.dir, false);
@@ -4263,7 +4344,7 @@ function sudoStopOrHint(port) {
 }
 async function stopProxy(store, proxyPort, _tls) {
   const pidPath = store.pidPath;
-  if (!fs9.existsSync(pidPath)) {
+  if (!fs10.existsSync(pidPath)) {
     if (await isProxyRunning(proxyPort)) {
       console.log(colors_default.yellow(`PID file is missing but port ${proxyPort} is still in use.`));
       const pid = findPidOnPort(proxyPort);
@@ -4271,7 +4352,7 @@ async function stopProxy(store, proxyPort, _tls) {
         try {
           process.kill(pid, "SIGTERM");
           try {
-            fs9.unlinkSync(store.portFilePath);
+            fs10.unlinkSync(store.portFilePath);
           } catch {
           }
           writeTlsMarker(store.dir, false);
@@ -4310,10 +4391,10 @@ async function stopProxy(store, proxyPort, _tls) {
     return;
   }
   try {
-    const pid = parseInt(fs9.readFileSync(pidPath, "utf-8"), 10);
+    const pid = parseInt(fs10.readFileSync(pidPath, "utf-8"), 10);
     if (isNaN(pid)) {
       console.error(colors_default.red("Corrupted PID file. Removing it."));
-      fs9.unlinkSync(pidPath);
+      fs10.unlinkSync(pidPath);
       writeTlsMarker(store.dir, false);
       writeCustomCertMarker(store.dir, false);
       writeTldFile(store.dir, DEFAULT_TLD);
@@ -4328,9 +4409,9 @@ async function stopProxy(store, proxyPort, _tls) {
         return;
       }
       console.log(colors_default.yellow("Proxy process is no longer running. Cleaning up stale files."));
-      fs9.unlinkSync(pidPath);
+      fs10.unlinkSync(pidPath);
       try {
-        fs9.unlinkSync(store.portFilePath);
+        fs10.unlinkSync(store.portFilePath);
       } catch {
       }
       writeTlsMarker(store.dir, false);
@@ -4346,7 +4427,7 @@ async function stopProxy(store, proxyPort, _tls) {
         )
       );
       console.log(colors_default.yellow("Removing stale PID file."));
-      fs9.unlinkSync(pidPath);
+      fs10.unlinkSync(pidPath);
       writeTlsMarker(store.dir, false);
       writeCustomCertMarker(store.dir, false);
       writeTldFile(store.dir, DEFAULT_TLD);
@@ -4354,9 +4435,9 @@ async function stopProxy(store, proxyPort, _tls) {
       return;
     }
     process.kill(pid, "SIGTERM");
-    fs9.unlinkSync(pidPath);
+    fs10.unlinkSync(pidPath);
     try {
-      fs9.unlinkSync(store.portFilePath);
+      fs10.unlinkSync(store.portFilePath);
     } catch {
     }
     writeTlsMarker(store.dir, false);
@@ -4507,7 +4588,7 @@ async function ensureProxyRunning(proxyPort, tls2, desired) {
     const logPath = path9.join(fallbackDir, "proxy.log");
     console.error(colors_default.blue("Try starting it manually:"));
     console.error(colors_default.cyan(`  ${manualStartCommand}`));
-    if (fs9.existsSync(logPath)) {
+    if (fs10.existsSync(logPath)) {
       console.error(colors_default.gray(`Logs: ${logPath}`));
     }
     process.exit(1);
@@ -4772,7 +4853,7 @@ portless
   const caEnv = {};
   if (tls2 && !process.env.NODE_EXTRA_CA_CERTS) {
     const caPath = path9.join(stateDir, "ca.pem");
-    if (fs9.existsSync(caPath)) {
+    if (fs10.existsSync(caPath)) {
       caEnv.NODE_EXTRA_CA_CERTS = caPath;
     }
   }
@@ -5051,11 +5132,13 @@ ${colors_default.bold("How it works:")}
   5. Frameworks that ignore PORT (Vite, VitePlus, Astro, React Router, Angular,
      Expo, React Native) get --port and, when needed, --host flags
      injected automatically
+  Elevated proxy processes keep the invoking user's ~/.portless state directory.
 
 ${colors_default.bold("HTTP/2 + HTTPS (default):")}
   HTTPS with HTTP/2 multiplexing is enabled by default (faster page loads).
   On first use, portless generates a local CA and adds it to your
   system trust store. No browser warnings. Disable with --no-tls.
+  On WSL, portless also adds the CA to the Windows user certificate store.
 
 ${colors_default.bold("LAN mode:")}
   Use --lan to make services accessible from other devices (phones,
@@ -5157,13 +5240,13 @@ ${colors_default.bold("Reserved names:")}
   process.exit(0);
 }
 function printVersion() {
-  console.log("0.15.2");
+  console.log("0.15.3");
   process.exit(0);
 }
 async function handleTrust() {
   const { dir } = await discoverState();
-  if (!fs9.existsSync(dir)) {
-    fs9.mkdirSync(dir, { recursive: true });
+  if (!fs10.existsSync(dir)) {
+    fs10.mkdirSync(dir, { recursive: true });
   }
   const { caGenerated } = ensureCerts(dir);
   if (caGenerated) {
@@ -5211,7 +5294,8 @@ directory, and PORTLESS_STATE_DIR when set), and removes the portless block
 from ${HOSTS_DISPLAY}.
 
 Only allowlisted filenames under each state directory are deleted. Custom
-certificate paths from --cert and --key are never removed.
+certificate paths from --cert and --key are never removed. If trust removal
+fails, the CA certificate and key are retained so clean can safely retry.
 
 macOS/Linux may prompt for sudo when the proxy, trust store, or ${HOSTS_DISPLAY}
 require elevated privileges. On Windows, run as Administrator if needed.
@@ -5267,27 +5351,32 @@ ${colors_default.bold("Options:")}
     }
   }
   const stateDirs = collectStateDirsForCleanup();
-  for (const stateDir of stateDirs) {
-    const caPath = path9.join(stateDir, "ca.pem");
-    if (!fs9.existsSync(caPath)) continue;
-    const wasTrusted = isCATrusted(stateDir);
-    if (!wasTrusted) continue;
-    const untrustResult = untrustCA(stateDir);
+  const failedCAStateDirs = /* @__PURE__ */ new Set();
+  const caRemovalResults = attemptCATrustRemovalForCleanup(stateDirs, untrustCA);
+  for (const [stateDir, untrustResult] of caRemovalResults) {
     if (untrustResult.removed) {
       console.log(colors_default.green("Removed local CA from the system trust store."));
-    } else if (untrustResult.error) {
+    } else {
+      failedCAStateDirs.add(stateDir);
       console.warn(
         colors_default.yellow(
-          `Could not remove CA from trust store: ${untrustResult.error}
+          `Could not remove CA from trust store: ${untrustResult.error ?? "unknown error"}
 Try: sudo portless clean (Linux), or delete the certificate manually.`
         )
       );
     }
   }
   for (const stateDir of stateDirs) {
-    removePortlessStateFiles(stateDir);
+    removePortlessStateFiles(stateDir, {
+      preserveCAIdentity: failedCAStateDirs.has(stateDir)
+    });
   }
   console.log(colors_default.green("Removed portless state files from known state directories."));
+  if (failedCAStateDirs.size > 0) {
+    console.warn(
+      colors_default.yellow("Retained CA identity files so trust removal can be retried safely.")
+    );
+  }
   if (cleanHostsFile()) {
     console.log(colors_default.green(`Removed portless entries from ${HOSTS_DISPLAY}.`));
   } else if (!isWindows && process.getuid?.() !== 0) {
@@ -5613,7 +5702,7 @@ function isProcessAliveForDoctor(pid) {
 }
 function checkPathWritable(targetPath) {
   try {
-    fs9.accessSync(targetPath, fs9.constants.W_OK);
+    fs10.accessSync(targetPath, fs10.constants.W_OK);
     return true;
   } catch {
     return false;
@@ -5622,7 +5711,7 @@ function checkPathWritable(targetPath) {
 function findExistingAncestor(targetPath) {
   let current = targetPath;
   for (; ; ) {
-    if (fs9.existsSync(current)) return current;
+    if (fs10.existsSync(current)) return current;
     const parent = path9.dirname(current);
     if (parent === current) return null;
     current = parent;
@@ -5693,7 +5782,7 @@ ${colors_default.bold("Options:")}
   const store = new RouteStore(state.dir, {
     onWarning: (msg) => add("warn", msg)
   });
-  const hasPortFile = fs9.existsSync(store.portFilePath);
+  const hasPortFile = fs10.existsSync(store.portFilePath);
   const configuredTls = hasPortFile ? state.tls : !isHttpsEnvDisabled();
   const configuredPort = hasPortFile ? state.port : getDefaultPort(configuredTls);
   const initialProxyRunning = await isProxyRunning(state.port, state.tls);
@@ -5705,9 +5794,9 @@ ${colors_default.bold("Options:")}
   const proxyTls = proxyRunning || portListening || hasPortFile ? probeTls : configuredTls;
   const currentProxyStateIsHttp = (proxyRunning || portListening || hasPortFile) && !proxyTls;
   const proxyUsesCustomCert = proxyTls && readCustomCertMarker(state.dir);
-  const stateExists = fs9.existsSync(state.dir);
+  const stateExists = fs10.existsSync(state.dir);
   console.log(colors_default.blue.bold("\nportless doctor\n"));
-  console.log(`Version: ${"0.15.2"}`);
+  console.log(`Version: ${"0.15.3"}`);
   console.log(`Node.js: ${process.versions.node}`);
   console.log(`Platform: ${process.platform} ${process.arch}`);
   console.log(`State dir: ${state.dir}`);
@@ -5724,7 +5813,7 @@ ${colors_default.bold("Options:")}
   }
   if (stateExists) {
     try {
-      const stat = fs9.statSync(state.dir);
+      const stat = fs10.statSync(state.dir);
       if (!stat.isDirectory()) {
         add("fail", `State path exists but is not a directory: ${state.dir}`);
       } else if (checkPathWritable(state.dir)) {
@@ -5744,7 +5833,7 @@ ${colors_default.bold("Options:")}
         `State directory does not exist and no writable ancestor was found: ${state.dir}`
       );
     } else {
-      const ancestorStat = fs9.statSync(ancestor);
+      const ancestorStat = fs10.statSync(ancestor);
       if (!ancestorStat.isDirectory()) {
         add("fail", `State directory does not exist and ancestor is not a directory: ${ancestor}`);
       } else if (checkPathWritable(ancestor)) {
@@ -5770,9 +5859,9 @@ ${colors_default.bold("Options:")}
       doctorProxyStartHint(proxyPort, proxyTls)
     );
   }
-  if (fs9.existsSync(store.pidPath)) {
+  if (fs10.existsSync(store.pidPath)) {
     try {
-      const rawPid = fs9.readFileSync(store.pidPath, "utf-8").trim();
+      const rawPid = fs10.readFileSync(store.pidPath, "utf-8").trim();
       const pid = parseInt(rawPid, 10);
       if (isNaN(pid) || pid <= 0) {
         add("fail", `Proxy PID file is invalid: ${store.pidPath}`);
@@ -5822,7 +5911,7 @@ ${colors_default.bold("Options:")}
     add("info", "Generated local CA is not required for custom TLS certificates.");
   } else if (proxyTls) {
     const caPath = path9.join(state.dir, "ca.pem");
-    if (fs9.existsSync(caPath)) {
+    if (fs10.existsSync(caPath)) {
       if (isCATrusted(state.dir)) {
         add("ok", "Local CA is trusted by the OS trust store.");
       } else {
@@ -6247,7 +6336,7 @@ ${colors_default.bold("LAN mode (--lan):")}
         } else {
           console.error(colors_default.red("Proxy process started but is not responding."));
           const logPath2 = path9.join(resolveStateDir(proxyPort), "proxy.log");
-          if (fs9.existsSync(logPath2)) {
+          if (fs10.existsSync(logPath2)) {
             console.error(colors_default.gray(`Logs: ${logPath2}`));
           }
         }
@@ -6286,8 +6375,8 @@ ${colors_default.bold("LAN mode (--lan):")}
     store.ensureDir();
     if (customCertPath && customKeyPath) {
       try {
-        const cert = fs9.readFileSync(customCertPath);
-        const key = fs9.readFileSync(customKeyPath);
+        const cert = fs10.readFileSync(customCertPath);
+        const key = fs10.readFileSync(customKeyPath);
         const certStr = cert.toString("utf-8");
         const keyStr = key.toString("utf-8");
         if (!certStr.includes("-----BEGIN CERTIFICATE-----")) {
@@ -6332,9 +6421,9 @@ ${colors_default.bold("LAN mode (--lan):")}
           console.warn(colors_default.cyan("  portless trust"));
         }
       }
-      const cert = fs9.readFileSync(certs.certPath);
-      const key = fs9.readFileSync(certs.keyPath);
-      const ca = fs9.readFileSync(certs.caPath);
+      const cert = fs10.readFileSync(certs.certPath);
+      const key = fs10.readFileSync(certs.keyPath);
+      const ca = fs10.readFileSync(certs.caPath);
       tlsOptions = {
         cert,
         key,
@@ -6359,10 +6448,10 @@ ${colors_default.bold("LAN mode (--lan):")}
   }
   store.ensureDir();
   const logPath = path9.join(stateDir, "proxy.log");
-  const logFd = fs9.openSync(logPath, "a");
+  const logFd = fs10.openSync(logPath, "a");
   try {
     try {
-      fs9.chmodSync(logPath, FILE_MODE);
+      fs10.chmodSync(logPath, FILE_MODE);
     } catch {
     }
     fixOwnership(logPath);
@@ -6394,13 +6483,13 @@ ${colors_default.bold("LAN mode (--lan):")}
     });
     child.unref();
   } finally {
-    fs9.closeSync(logFd);
+    fs10.closeSync(logFd);
   }
   if (!await waitForProxy(proxyPort, void 0, void 0, useHttps)) {
     console.error(colors_default.red("Proxy failed to start (timed out waiting for it to listen)."));
     console.error(colors_default.blue("Try starting the proxy in the foreground to see the error:"));
     console.error(colors_default.cyan("  portless proxy start --foreground"));
-    if (fs9.existsSync(logPath)) {
+    if (fs10.existsSync(logPath)) {
       console.error(colors_default.gray(`Logs: ${logPath}`));
     }
     process.exit(1);
@@ -6553,7 +6642,7 @@ async function spawnProxiedApp(app, stateDir, proxyPort, tls2, tlds, exitCodes)
     };
     if (tls2) {
       const caPath = path9.join(stateDir, "ca.pem");
-      if (fs9.existsSync(caPath)) {
+      if (fs10.existsSync(caPath)) {
         env.NODE_EXTRA_CA_CERTS = caPath;
       }
     }
@@ -6743,7 +6832,7 @@ async function runWithTurbo(wsRoot, stateDir, proxyPort, tls2, tlds, scriptName,
     };
     if (tls2) {
       const caPath = path9.join(stateDir, "ca.pem");
-      if (fs9.existsSync(caPath)) {
+      if (fs10.existsSync(caPath)) {
         entry.NODE_EXTRA_CA_CERTS = caPath;
       }
     }