portless 0.15.2 → 0.15.4

package/README.md

@@ -36,6 +36,8 @@ The proxy auto-starts when you run an app. A random port (4000-4999) is assigned
 
 When auto-starting, portless reuses the configuration (port, TLS, TLDs) from the most recent proxy run, so a restart or reboot does not silently revert to defaults. Explicit env vars (`PORTLESS_PORT`, `PORTLESS_HTTPS`, etc.) always take priority.
 
+Portless stores per-user state in `~/.portless`. When the proxy runs under sudo, it resolves this path from the invoking user's home so the proxy and unprivileged app processes share the same route registrations.
+
 In non-interactive environments (no TTY, or `CI=1`), portless exits with a descriptive error instead of prompting, so task runners like turborepo and CI scripts fail early with a clear message.
 
 ## Configuration
@@ -241,6 +243,8 @@ flowchart TD
 2. **Run apps**: `portless <name> <command>` assigns a free port and registers with the proxy
 3. **Access via URL**: `https://<name>.localhost` routes through the proxy to your app
 
+Outside LAN mode, the proxy and its HTTP redirect listener bind only to the IPv4 and IPv6 loopback addresses, `127.0.0.1` and `::1`. They do not accept connections through LAN, VPN, or other network interfaces.
+
 ## HTTP/2 + HTTPS
 
 HTTPS with HTTP/2 is enabled by default. Browsers limit HTTP/1.1 to 6 connections per host, which bottlenecks dev servers that serve many unbundled files (Vite, Nuxt, etc.). HTTP/2 multiplexes all requests over a single connection.
@@ -258,7 +262,7 @@ portless proxy start --no-tls
 portless trust
 ```
 
-On Linux, `portless trust` supports Debian/Ubuntu, Arch, Fedora/RHEL/CentOS, and openSUSE (via `update-ca-certificates` or `update-ca-trust`). On Windows, it uses `certutil` to add the CA to the system trust store.
+On Linux, `portless trust` supports Debian/Ubuntu, Arch, Fedora/RHEL/CentOS, and openSUSE (via `update-ca-certificates` or `update-ca-trust`). On Windows, it uses `certutil` to add the CA to the system trust store. On WSL, it updates both the Linux trust store and the Windows current-user Root store so Windows browsers trust portless HTTPS certificates.
 
 ## Start at OS startup
 
@@ -285,7 +289,7 @@ portless proxy start --lan --https
 portless proxy start --lan --ip 192.168.1.42
 ```
 
-`--lan` switches the proxy to mDNS discovery: services are advertised as `<name>.local` and reachable from any device on the same network. Portless auto-detects your LAN IP and follows Wi-Fi/IP changes automatically, but you can pin another address with `--ip <address>` or by exporting `PORTLESS_LAN_IP`. Set `PORTLESS_LAN=1` in your shell (0/1 boolean) to make LAN mode the default whenever the proxy starts.
+`--lan` explicitly binds the proxy to the IPv4 and IPv6 unspecified addresses, `0.0.0.0` and `::`, and switches to mDNS discovery. This makes services available as `<name>.local` to devices on the same network. Portless auto-detects your LAN IP and follows Wi-Fi/IP changes automatically, but you can pin another address with `--ip <address>` or by exporting `PORTLESS_LAN_IP`. Set `PORTLESS_LAN=1` in your shell (0/1 boolean) to make LAN mode the default whenever the proxy starts.
 
 Portless remembers LAN mode via `proxy.lan`, so if you stop a LAN proxy and start it again, it stays in LAN mode. All proxy settings (port, TLS, TLDs, LAN) are persisted and reused on auto-start unless overridden by explicit flags or env vars. Use `PORTLESS_LAN=0` for one start to switch back to `.localhost` mode. If a proxy is already running with different explicit LAN/TLS/TLD settings, portless warns and asks you to stop it first.
 
@@ -445,7 +449,7 @@ To remove portless data from your machine (proxy state under `~/.portless` and t
 portless clean
 ```
 
-macOS/Linux may prompt for `sudo`. Custom certificate paths passed with `--cert` and `--key` are not deleted.
+macOS/Linux may prompt for `sudo`. Custom certificate paths passed with `--cert` and `--key` are not deleted. If trust-store removal fails, portless retains its CA certificate and key so a later `portless clean` can safely retry.
 
 ## Safari / DNS
 

package/dist/{chunk-T7CGCIRO.js → chunk-JSJUKQRJ.js}

@@ -1,6 +1,32 @@
 // src/utils.ts
 import * as fs from "fs";
 import * as net from "net";
+import * as os from "os";
+import * as path from "path";
+function readPasswdHome(username) {
+  try {
+    const passwd = fs.readFileSync("/etc/passwd", "utf-8");
+    for (const line of passwd.split("\n")) {
+      const fields = line.split(":");
+      if (fields[0] === username && fields[5]) return fields[5];
+    }
+  } catch {
+  }
+  return null;
+}
+function resolveUserHome(options = {}) {
+  const platform = options.platform ?? process.platform;
+  const env = options.env ?? process.env;
+  const homedir2 = options.homedir ?? os.homedir();
+  if (platform === "win32") return env.USERPROFILE || homedir2;
+  const sudoUser = env.SUDO_USER;
+  if (!sudoUser || sudoUser === "root") return homedir2;
+  const home = env.HOME;
+  if (home && home !== "/root" && home !== "/var/root") return home;
+  const passwdHome = (options.passwdHome ?? readPasswdHome)(sudoUser);
+  if (passwdHome) return passwdHome;
+  return platform === "darwin" ? path.posix.join("/Users", sudoUser) : path.posix.join("/home", sudoUser);
+}
 function loopbackLookup(_hostname, _options, callback) {
   callback(null, [
     { address: "127.0.0.1", family: 4 },
@@ -653,9 +679,9 @@ function createHttpRedirectServer(httpsPort) {
 // src/hosts.ts
 import * as fs2 from "fs";
 import * as dns from "dns";
-import * as path from "path";
+import * as path2 from "path";
 var isWindows = process.platform === "win32";
-var HOSTS_PATH = isWindows ? path.join(process.env.SystemRoot ?? "C:\\Windows", "System32", "drivers", "etc", "hosts") : "/etc/hosts";
+var HOSTS_PATH = isWindows ? path2.join(process.env.SystemRoot ?? "C:\\Windows", "System32", "drivers", "etc", "hosts") : "/etc/hosts";
 var MARKER_START = "# portless-start";
 var MARKER_END = "# portless-end";
 function readHostsFile() {
@@ -736,7 +762,7 @@ function checkHostResolution(hostname) {
 
 // src/routes.ts
 import * as fs3 from "fs";
-import * as path2 from "path";
+import * as path3 from "path";
 var STALE_LOCK_THRESHOLD_MS = 1e4;
 var LOCK_TIMEOUT_MS = 15e3;
 var LOCK_RETRY_BASE_MS = 10;
@@ -768,10 +794,10 @@ var RouteStore = class _RouteStore {
   onWarning;
   constructor(dir, options) {
     this.dir = dir;
-    this.routesPath = path2.join(dir, "routes.json");
-    this.lockPath = path2.join(dir, "routes.lock");
-    this.pidPath = path2.join(dir, "proxy.pid");
-    this.portFilePath = path2.join(dir, "proxy.port");
+    this.routesPath = path3.join(dir, "routes.json");
+    this.lockPath = path3.join(dir, "routes.lock");
+    this.pidPath = path3.join(dir, "proxy.pid");
+    this.portFilePath = path3.join(dir, "proxy.port");
     this.onWarning = options?.onWarning;
   }
   ensureDir() {
@@ -1033,6 +1059,7 @@ var RouteStore = class _RouteStore {
 };
 
 export {
+  resolveUserHome,
   createLoopbackConnection,
   fixOwnership,
   isErrnoException,