portless 0.15.3 → 0.15.4

package/README.md

@@ -243,6 +243,8 @@ flowchart TD
 2. **Run apps**: `portless <name> <command>` assigns a free port and registers with the proxy
 3. **Access via URL**: `https://<name>.localhost` routes through the proxy to your app
 
+Outside LAN mode, the proxy and its HTTP redirect listener bind only to the IPv4 and IPv6 loopback addresses, `127.0.0.1` and `::1`. They do not accept connections through LAN, VPN, or other network interfaces.
+
 ## HTTP/2 + HTTPS
 
 HTTPS with HTTP/2 is enabled by default. Browsers limit HTTP/1.1 to 6 connections per host, which bottlenecks dev servers that serve many unbundled files (Vite, Nuxt, etc.). HTTP/2 multiplexes all requests over a single connection.
@@ -287,7 +289,7 @@ portless proxy start --lan --https
 portless proxy start --lan --ip 192.168.1.42
 ```
 
-`--lan` switches the proxy to mDNS discovery: services are advertised as `<name>.local` and reachable from any device on the same network. Portless auto-detects your LAN IP and follows Wi-Fi/IP changes automatically, but you can pin another address with `--ip <address>` or by exporting `PORTLESS_LAN_IP`. Set `PORTLESS_LAN=1` in your shell (0/1 boolean) to make LAN mode the default whenever the proxy starts.
+`--lan` explicitly binds the proxy to the IPv4 and IPv6 unspecified addresses, `0.0.0.0` and `::`, and switches to mDNS discovery. This makes services available as `<name>.local` to devices on the same network. Portless auto-detects your LAN IP and follows Wi-Fi/IP changes automatically, but you can pin another address with `--ip <address>` or by exporting `PORTLESS_LAN_IP`. Set `PORTLESS_LAN=1` in your shell (0/1 boolean) to make LAN mode the default whenever the proxy starts.
 
 Portless remembers LAN mode via `proxy.lan`, so if you stop a LAN proxy and start it again, it stays in LAN mode. All proxy settings (port, TLS, TLDs, LAN) are persisted and reused on auto-start unless overridden by explicit flags or env vars. Use `PORTLESS_LAN=0` for one start to switch back to `.localhost` mode. If a proxy is already running with different explicit LAN/TLS/TLD settings, portless warns and asks you to stop it first.
 

package/dist/cli.js

@@ -1450,6 +1450,10 @@ var FALLBACK_PROXY_PORT = 1355;
 var PRIVILEGED_PORT_THRESHOLD = 1024;
 var INTERNAL_LAN_IP_ENV = "PORTLESS_INTERNAL_LAN_IP";
 var INTERNAL_LAN_IP_FLAG = "--lan-ip-auto";
+var IPV4_LOOPBACK_PROXY_HOST = "127.0.0.1";
+var IPV6_LOOPBACK_PROXY_HOST = "::1";
+var IPV4_LAN_PROXY_HOST = "0.0.0.0";
+var IPV6_LAN_PROXY_HOST = "::";
 var LEGACY_SYSTEM_STATE_DIR = isWindows ? path3.join(os2.tmpdir(), "portless") : "/tmp/portless";
 var USER_STATE_DIR = path3.join(resolveUserHome(), ".portless");
 var MIN_APP_PORT = 4e3;
@@ -1552,6 +1556,12 @@ var SIGNAL_CODES = {
   SIGKILL: 9,
   SIGTERM: 15
 };
+function getProxyBindTargets(lanMode) {
+  return lanMode ? [{ host: IPV4_LAN_PROXY_HOST }, { host: IPV6_LAN_PROXY_HOST, ipv6Only: true }] : [{ host: IPV4_LOOPBACK_PROXY_HOST }, { host: IPV6_LOOPBACK_PROXY_HOST, ipv6Only: true }];
+}
+function listenOnProxyInterface(server, port, target, listener) {
+  server.listen({ port, host: target.host, ipv6Only: target.ipv6Only }, listener);
+}
 function killTree(child, signal = "SIGTERM") {
   if (!child.pid) {
     child.kill(signal);
@@ -4102,6 +4112,12 @@ function formatUrls(hostnames, proxyPort, tls2) {
 function formatViteAllowedHosts(tlds) {
   return tlds.map((configuredTld) => `.${configuredTld}`).join(",");
 }
+function formatBindEndpoint(host, port) {
+  return host.includes(":") ? `[${host}]:${port}` : `${host}:${port}`;
+}
+function isUnavailableIpv6Bind(err, host) {
+  return host.includes(":") && (err.code === "EAFNOSUPPORT" || err.code === "EADDRNOTAVAIL");
+}
 function addRoutes(store, hostnames, port, pid, force = false) {
   const registered = [];
   const killedPids = [];
@@ -4137,6 +4153,9 @@ function startProxyServer(store, proxyPort, tld, tlds, tlsOptions, lanIp, strict
   const isTls = !!tlsOptions;
   const mdnsSupport = isMdnsSupported();
   let activeLanIp = lanIp && mdnsSupport.supported ? lanIp : null;
+  const lanModeActive = activeLanIp !== null;
+  const bindTargets = getProxyBindTargets(lanModeActive);
+  const primaryBindTarget = bindTargets[0];
   const lanIpPinned = !!process.env.PORTLESS_LAN_IP;
   let lanMonitor = null;
   if (lanIp && !mdnsSupport.supported) {
@@ -4220,7 +4239,7 @@ function startProxyServer(store, proxyPort, tld, tlds, tlsOptions, lanIp, strict
     syncHostsFile(cachedRoutes.map((r) => r.hostname));
   }
   publishCachedRoutes();
-  const server = createProxyServer({
+  const createServer2 = () => createProxyServer({
     getRoutes: () => cachedRoutes,
     proxyPort,
     tld,
@@ -4229,6 +4248,17 @@ function startProxyServer(store, proxyPort, tld, tlds, tlsOptions, lanIp, strict
     onError: (msg) => console.error(colors_default.red(msg)),
     tls: tlsOptions
   });
+  const server = createServer2();
+  const additionalServers = /* @__PURE__ */ new Set();
+  const redirectServers = /* @__PURE__ */ new Set();
+  const closeAuxiliaryServers = () => {
+    for (const auxiliaryServer of [...additionalServers, ...redirectServers]) {
+      try {
+        auxiliaryServer.close();
+      } catch {
+      }
+    }
+  };
   server.on("error", (err) => {
     if (err.code === "EADDRINUSE") {
       console.error(colors_default.red(`Port ${proxyPort} is already in use.`));
@@ -4247,18 +4277,50 @@ function startProxyServer(store, proxyPort, tld, tlds, tlsOptions, lanIp, strict
     } else {
       console.error(colors_default.red(`Proxy error: ${err.message}`));
     }
-    if (redirectServer) redirectServer.close();
+    closeAuxiliaryServers();
     process.exit(1);
   });
-  let redirectServer = null;
-  if (isTls && proxyPort !== 80) {
-    redirectServer = createHttpRedirectServer(proxyPort);
-    redirectServer.on("error", () => {
-      redirectServer = null;
+  const proto = isTls ? "HTTPS/2" : "HTTP";
+  const tldLabel = tlds.length > 1 || tld !== DEFAULT_TLD ? ` (TLDs: ${formatTldList2(tlds)})` : "";
+  const modeLabel = strict === false ? " (wildcard)" : "";
+  for (const bindTarget of bindTargets.slice(1)) {
+    const additionalServer = createServer2();
+    additionalServers.add(additionalServer);
+    additionalServer.on("error", (err) => {
+      additionalServers.delete(additionalServer);
+      if (!isUnavailableIpv6Bind(err, bindTarget.host)) {
+        console.warn(
+          colors_default.yellow(
+            `Could not listen on ${formatBindEndpoint(bindTarget.host, proxyPort)}: ${err.message}`
+          )
+        );
+      }
+    });
+    listenOnProxyInterface(additionalServer, proxyPort, bindTarget, () => {
+      console.log(
+        colors_default.green(
+          `${proto} proxy listening on ${formatBindEndpoint(bindTarget.host, proxyPort)}${tldLabel}${modeLabel}`
+        )
+      );
     });
-    redirectServer.listen(80);
   }
-  server.listen(proxyPort, () => {
+  if (isTls && proxyPort !== 80) {
+    for (const bindTarget of bindTargets) {
+      const redirectServer = createHttpRedirectServer(proxyPort);
+      redirectServers.add(redirectServer);
+      redirectServer.on("error", () => {
+        redirectServers.delete(redirectServer);
+      });
+      listenOnProxyInterface(redirectServer, 80, bindTarget, () => {
+        console.log(
+          colors_default.green(
+            `HTTP-to-HTTPS redirect listening on ${formatBindEndpoint(bindTarget.host, 80)}`
+          )
+        );
+      });
+    }
+  }
+  listenOnProxyInterface(server, proxyPort, primaryBindTarget, () => {
     fs10.writeFileSync(store.pidPath, process.pid.toString(), { mode: FILE_MODE });
     fs10.writeFileSync(store.portFilePath, proxyPort.toString(), { mode: FILE_MODE });
     writeTlsMarker(store.dir, isTls);
@@ -4266,11 +4328,10 @@ function startProxyServer(store, proxyPort, tld, tlds, tlsOptions, lanIp, strict
     writeTldsFile(store.dir, tlds);
     writeLanMarker(store.dir, activeLanIp);
     fixOwnership(store.dir, store.pidPath, store.portFilePath);
-    const proto = isTls ? "HTTPS/2" : "HTTP";
-    const tldLabel = tlds.length > 1 || tld !== DEFAULT_TLD ? ` (TLDs: ${formatTldList2(tlds)})` : "";
-    const modeLabel = strict === false ? " (wildcard)" : "";
     console.log(
-      colors_default.green(`${proto} proxy listening on port ${proxyPort}${tldLabel}${modeLabel}`)
+      colors_default.green(
+        `${proto} proxy listening on ${formatBindEndpoint(primaryBindTarget.host, proxyPort)}${tldLabel}${modeLabel}`
+      )
     );
     if (activeLanIp) {
       console.log(chalk.green(`LAN mode: ${activeLanIp}`));
@@ -4290,9 +4351,6 @@ function startProxyServer(store, proxyPort, tld, tlds, tlsOptions, lanIp, strict
         });
       }
     }
-    if (redirectServer) {
-      console.log(colors_default.green("HTTP-to-HTTPS redirect listening on port 80"));
-    }
   });
   let exiting = false;
   const cleanup = () => {
@@ -4305,9 +4363,7 @@ function startProxyServer(store, proxyPort, tld, tlds, tlsOptions, lanIp, strict
       watcher.close();
     }
     if (activeLanIp) cleanupAll();
-    if (redirectServer) {
-      redirectServer.close();
-    }
+    closeAuxiliaryServers();
     try {
       fs10.unlinkSync(store.pidPath);
     } catch {
@@ -5132,6 +5188,7 @@ ${colors_default.bold("How it works:")}
   5. Frameworks that ignore PORT (Vite, VitePlus, Astro, React Router, Angular,
      Expo, React Native) get --port and, when needed, --host flags
      injected automatically
+  6. The proxy listens only on 127.0.0.1 and ::1 unless LAN mode is enabled
   Elevated proxy processes keep the invoking user's ~/.portless state directory.
 
 ${colors_default.bold("HTTP/2 + HTTPS (default):")}
@@ -5143,6 +5200,8 @@ ${colors_default.bold("HTTP/2 + HTTPS (default):")}
 ${colors_default.bold("LAN mode:")}
   Use --lan to make services accessible from other devices (phones,
   tablets) on the same WiFi network via mDNS (.local domains).
+  Normal mode binds only to 127.0.0.1 and ::1.
+  LAN mode binds to 0.0.0.0 and ::.
   Useful for testing React Native / Expo apps on real devices.
   Expo keeps Metro's default LAN host behavior in this mode.
   Auto-detected LAN IPs follow network changes automatically.
@@ -5240,7 +5299,7 @@ ${colors_default.bold("Reserved names:")}
   process.exit(0);
 }
 function printVersion() {
-  console.log("0.15.3");
+  console.log("0.15.4");
   process.exit(0);
 }
 async function handleTrust() {
@@ -5796,7 +5855,7 @@ ${colors_default.bold("Options:")}
   const proxyUsesCustomCert = proxyTls && readCustomCertMarker(state.dir);
   const stateExists = fs10.existsSync(state.dir);
   console.log(colors_default.blue.bold("\nportless doctor\n"));
-  console.log(`Version: ${"0.15.3"}`);
+  console.log(`Version: ${"0.15.4"}`);
   console.log(`Node.js: ${process.versions.node}`);
   console.log(`Platform: ${process.platform} ${process.arch}`);
   console.log(`State dir: ${state.dir}`);
@@ -6080,6 +6139,8 @@ ${colors_default.bold("Usage:")}
   ${colors_default.cyan("portless proxy stop")}                 Stop the proxy
 
 ${colors_default.bold("LAN mode (--lan):")}
+  Without LAN mode, the proxy listens only on 127.0.0.1 and ::1.
+  LAN mode explicitly binds the proxy to 0.0.0.0 and ::.
   Makes services accessible from other devices on the same WiFi network
   via mDNS (.local domains). Useful for testing on real mobile devices.
   Auto-detects your LAN IP and follows changes automatically, or use

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "portless",
-  "version": "0.15.3",
+  "version": "0.15.4",
   "description": "Replace port numbers with stable, named .localhost URLs. For humans and agents.",
   "type": "module",
   "main": "./dist/index.js",