portless 0.6.0 → 0.7.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1.  Definitions.
+
+    "License" shall mean the terms and conditions for use, reproduction,
+    and distribution as defined by Sections 1 through 9 of this document.
+
+    "Licensor" shall mean the copyright owner or entity authorized by
+    the copyright owner that is granting the License.
+
+    "Legal Entity" shall mean the union of the acting entity and all
+    other entities that control, are controlled by, or are under common
+    control with that entity. For the purposes of this definition,
+    "control" means (i) the power, direct or indirect, to cause the
+    direction or management of such entity, whether by contract or
+    otherwise, or (ii) ownership of fifty percent (50%) or more of the
+    outstanding shares, or (iii) beneficial ownership of such entity.
+
+    "You" (or "Your") shall mean an individual or Legal Entity
+    exercising permissions granted by this License.
+
+    "Source" form shall mean the preferred form for making modifications,
+    including but not limited to software source code, documentation
+    source, and configuration files.
+
+    "Object" form shall mean any form resulting from mechanical
+    transformation or translation of a Source form, including but
+    not limited to compiled object code, generated documentation,
+    and conversions to other media types.
+
+    "Work" shall mean the work of authorship, whether in Source or
+    Object form, made available under the License, as indicated by a
+    copyright notice that is included in or attached to the work
+    (an example is provided in the Appendix below).
+
+    "Derivative Works" shall mean any work, whether in Source or Object
+    form, that is based on (or derived from) the Work and for which the
+    editorial revisions, annotations, elaborations, or other modifications
+    represent, as a whole, an original work of authorship. For the purposes
+    of this License, Derivative Works shall not include works that remain
+    separable from, or merely link (or bind by name) to the interfaces of,
+    the Work and Derivative Works thereof.
+
+    "Contribution" shall mean any work of authorship, including
+    the original version of the Work and any modifications or additions
+    to that Work or Derivative Works thereof, that is intentionally
+    submitted to Licensor for inclusion in the Work by the copyright owner
+    or by an individual or Legal Entity authorized to submit on behalf of
+    the copyright owner. For the purposes of this definition, "submitted"
+    means any form of electronic, verbal, or written communication sent
+    to the Licensor or its representatives, including but not limited to
+    communication on electronic mailing lists, source code control systems,
+    and issue tracking systems that are managed by, or on behalf of, the
+    Licensor for the purpose of discussing and improving the Work, but
+    excluding communication that is conspicuously marked or otherwise
+    designated in writing by the copyright owner as "Not a Contribution."
+
+    "Contributor" shall mean Licensor and any individual or Legal Entity
+    on behalf of whom a Contribution has been received by Licensor and
+    subsequently incorporated within the Work.
+
+2.  Grant of Copyright License. Subject to the terms and conditions of
+    this License, each Contributor hereby grants to You a perpetual,
+    worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+    copyright license to reproduce, prepare Derivative Works of,
+    publicly display, publicly perform, sublicense, and distribute the
+    Work and such Derivative Works in Source or Object form.
+
+3.  Grant of Patent License. Subject to the terms and conditions of
+    this License, each Contributor hereby grants to You a perpetual,
+    worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+    (except as stated in this section) patent license to make, have made,
+    use, offer to sell, sell, import, and otherwise transfer the Work,
+    where such license applies only to those patent claims licensable
+    by such Contributor that are necessarily infringed by their
+    Contribution(s) alone or by combination of their Contribution(s)
+    with the Work to which such Contribution(s) was submitted. If You
+    institute patent litigation against any entity (including a
+    cross-claim or counterclaim in a lawsuit) alleging that the Work
+    or a Contribution incorporated within the Work constitutes direct
+    or contributory patent infringement, then any patent licenses
+    granted to You under this License for that Work shall terminate
+    as of the date such litigation is filed.
+
+4.  Redistribution. You may reproduce and distribute copies of the
+    Work or Derivative Works thereof in any medium, with or without
+    modifications, and in Source or Object form, provided that You
+    meet the following conditions:
+
+    (a) You must give any other recipients of the Work or
+    Derivative Works a copy of this License; and
+
+    (b) You must cause any modified files to carry prominent notices
+    stating that You changed the files; and
+
+    (c) You must retain, in the Source form of any Derivative Works
+    that You distribute, all copyright, patent, trademark, and
+    attribution notices from the Source form of the Work,
+    excluding those notices that do not pertain to any part of
+    the Derivative Works; and
+
+    (d) If the Work includes a "NOTICE" text file as part of its
+    distribution, then any Derivative Works that You distribute must
+    include a readable copy of the attribution notices contained
+    within such NOTICE file, excluding those notices that do not
+    pertain to any part of the Derivative Works, in at least one
+    of the following places: within a NOTICE text file distributed
+    as part of the Derivative Works; within the Source form or
+    documentation, if provided along with the Derivative Works; or,
+    within a display generated by the Derivative Works, if and
+    wherever such third-party notices normally appear. The contents
+    of the NOTICE file are for informational purposes only and
+    do not modify the License. You may add Your own attribution
+    notices within Derivative Works that You distribute, alongside
+    or as an addendum to the NOTICE text from the Work, provided
+    that such additional attribution notices cannot be construed
+    as modifying the License.
+
+    You may add Your own copyright statement to Your modifications and
+    may provide additional or different license terms and conditions
+    for use, reproduction, or distribution of Your modifications, or
+    for any such Derivative Works as a whole, provided Your use,
+    reproduction, and distribution of the Work otherwise complies with
+    the conditions stated in this License.
+
+5.  Submission of Contributions. Unless You explicitly state otherwise,
+    any Contribution intentionally submitted for inclusion in the Work
+    by You to the Licensor shall be under the terms and conditions of
+    this License, without any additional terms or conditions.
+    Notwithstanding the above, nothing herein shall supersede or modify
+    the terms of any separate license agreement you may have executed
+    with Licensor regarding such Contributions.
+
+6.  Trademarks. This License does not grant permission to use the trade
+    names, trademarks, service marks, or product names of the Licensor,
+    except as required for reasonable and customary use in describing the
+    origin of the Work and reproducing the content of the NOTICE file.
+
+7.  Disclaimer of Warranty. Unless required by applicable law or
+    agreed to in writing, Licensor provides the Work (and each
+    Contributor provides its Contributions) on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+    implied, including, without limitation, any warranties or conditions
+    of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+    PARTICULAR PURPOSE. You are solely responsible for determining the
+    appropriateness of using or redistributing the Work and assume any
+    risks associated with Your exercise of permissions under this License.
+
+8.  Limitation of Liability. In no event and under no legal theory,
+    whether in tort (including negligence), contract, or otherwise,
+    unless required by applicable law (such as deliberate and grossly
+    negligent acts) or agreed to in writing, shall any Contributor be
+    liable to You for damages, including any direct, indirect, special,
+    incidental, or consequential damages of any character arising as a
+    result of this License or out of the use or inability to use the
+    Work (including but not limited to damages for loss of goodwill,
+    work stoppage, computer failure or malfunction, or any and all
+    other commercial damages or losses), even if such Contributor
+    has been advised of the possibility of such damages.
+
+9.  Accepting Warranty or Additional Liability. While redistributing
+    the Work or Derivative Works thereof, You may choose to offer,
+    and charge a fee for, acceptance of support, warranty, indemnity,
+    or other liability obligations and/or rights consistent with this
+    License. However, in accepting such obligations, You may act only
+    on Your own behalf and on Your sole responsibility, not on behalf
+    of any other Contributor, and only if You agree to indemnify,
+    defend, and hold each Contributor harmless for any liability
+    incurred by, or claims asserted against, such Contributor by reason
+    of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+Copyright 2025 Vercel Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/README.md

@@ -129,7 +129,7 @@ portless proxy start --cert ./cert.pem --key ./key.pem
 sudo portless trust
 ```
 
-On Linux, `portless trust` supports Debian/Ubuntu, Arch, Fedora/RHEL/CentOS, and openSUSE (via `update-ca-certificates` or `update-ca-trust`).
+On Linux, `portless trust` supports Debian/Ubuntu, Arch, Fedora/RHEL/CentOS, and openSUSE (via `update-ca-certificates` or `update-ca-trust`). On Windows, it uses `certutil` to add the CA to the system trust store.
 
 ## Commands
 
@@ -187,7 +187,7 @@ HOST                             Always 127.0.0.1
 PORTLESS_URL                     Public URL (e.g. https://myapp.localhost)
 ```
 
-> **Reserved names:** `run`, `alias`, `hosts`, `list`, `trust`, and `proxy` are subcommands and cannot be used as app names directly. Use `portless run <cmd>` to infer the name from your project, or `portless --name <name> <cmd>` to force any name including reserved ones.
+> **Reserved names:** `run`, `get`, `alias`, `hosts`, `list`, `trust`, and `proxy` are subcommands and cannot be used as app names directly. Use `portless run <cmd>` to infer the name from your project, or `portless --name <name> <cmd>` to force any name including reserved ones.
 
 ## Safari / DNS
 
@@ -251,4 +251,4 @@ pnpm format           # Format all files with Prettier
 ## Requirements
 
 - Node.js 20+
-- macOS or Linux
+- macOS, Linux, or Windows

package/dist/{chunk-AB3HUERH.js → chunk-Y6FWHU6F.js}

@@ -1,6 +1,7 @@
 // src/utils.ts
 import * as fs from "fs";
 function fixOwnership(...paths) {
+  if (process.platform === "win32") return;
   const uid = process.env.SUDO_UID;
   const gid = process.env.SUDO_GID;
   if (!uid || process.getuid?.() !== 0) return;
@@ -544,7 +545,9 @@ function createProxyServer(options) {
 // src/hosts.ts
 import * as fs2 from "fs";
 import * as dns from "dns";
-var HOSTS_PATH = "/etc/hosts";
+import * as path from "path";
+var isWindows = process.platform === "win32";
+var HOSTS_PATH = isWindows ? path.join(process.env.SystemRoot ?? "C:\\Windows", "System32", "drivers", "etc", "hosts") : "/etc/hosts";
 var MARKER_START = "# portless-start";
 var MARKER_END = "# portless-end";
 function readHostsFile() {
@@ -626,18 +629,19 @@ import * as http3 from "http";
 import * as https from "https";
 import * as net2 from "net";
 import * as os from "os";
-import * as path from "path";
+import * as path2 from "path";
 import * as readline from "readline";
 import { execSync, spawn } from "child_process";
+var isWindows2 = process.platform === "win32";
 var DEFAULT_PROXY_PORT = 1355;
 var PRIVILEGED_PORT_THRESHOLD = 1024;
-var SYSTEM_STATE_DIR = "/tmp/portless";
-var USER_STATE_DIR = path.join(os.homedir(), ".portless");
+var SYSTEM_STATE_DIR = path2.join(os.tmpdir(), "portless");
+var USER_STATE_DIR = path2.join(os.homedir(), ".portless");
 var MIN_APP_PORT = 4e3;
 var MAX_APP_PORT = 4999;
 var RANDOM_PORT_ATTEMPTS = 50;
 var SOCKET_TIMEOUT_MS = 500;
-var LSOF_TIMEOUT_MS = 5e3;
+var PID_LOOKUP_TIMEOUT_MS = 5e3;
 var WAIT_FOR_PROXY_MAX_ATTEMPTS = 20;
 var WAIT_FOR_PROXY_INTERVAL_MS = 250;
 var SIGNAL_CODES = {
@@ -658,11 +662,12 @@ function getDefaultPort() {
 }
 function resolveStateDir(port) {
   if (process.env.PORTLESS_STATE_DIR) return process.env.PORTLESS_STATE_DIR;
+  if (isWindows2) return USER_STATE_DIR;
   return port < PRIVILEGED_PORT_THRESHOLD ? SYSTEM_STATE_DIR : USER_STATE_DIR;
 }
 function readPortFromDir(dir) {
   try {
-    const raw = fs3.readFileSync(path.join(dir, "proxy.port"), "utf-8").trim();
+    const raw = fs3.readFileSync(path2.join(dir, "proxy.port"), "utf-8").trim();
     const port = parseInt(raw, 10);
     return isNaN(port) ? null : port;
   } catch {
@@ -672,13 +677,13 @@ function readPortFromDir(dir) {
 var TLS_MARKER_FILE = "proxy.tls";
 function readTlsMarker(dir) {
   try {
-    return fs3.existsSync(path.join(dir, TLS_MARKER_FILE));
+    return fs3.existsSync(path2.join(dir, TLS_MARKER_FILE));
   } catch {
     return false;
   }
 }
 function writeTlsMarker(dir, enabled) {
-  const markerPath = path.join(dir, TLS_MARKER_FILE);
+  const markerPath = path2.join(dir, TLS_MARKER_FILE);
   if (enabled) {
     fs3.writeFileSync(markerPath, "1", { mode: 420 });
   } else {
@@ -712,14 +717,14 @@ function validateTld(tld) {
 var TLD_FILE = "proxy.tld";
 function readTldFromDir(dir) {
   try {
-    const raw = fs3.readFileSync(path.join(dir, TLD_FILE), "utf-8").trim();
+    const raw = fs3.readFileSync(path2.join(dir, TLD_FILE), "utf-8").trim();
     return raw || DEFAULT_TLD;
   } catch {
     return DEFAULT_TLD;
   }
 }
 function writeTldFile(dir, tld) {
-  const filePath = path.join(dir, TLD_FILE);
+  const filePath = path2.join(dir, TLD_FILE);
   if (tld === DEFAULT_TLD) {
     try {
       fs3.unlinkSync(filePath);
@@ -827,11 +832,34 @@ function isProxyRunning(port, tls = false) {
     req.end();
   });
 }
+function parsePidFromNetstat(output, port) {
+  for (const line of output.split(/\r?\n/)) {
+    if (!line.includes("LISTENING")) continue;
+    const parts = line.trim().split(/\s+/);
+    if (parts.length < 5) continue;
+    const localAddr = parts[1];
+    const lastColon = localAddr.lastIndexOf(":");
+    if (lastColon === -1) continue;
+    const addrPort = parseInt(localAddr.substring(lastColon + 1), 10);
+    if (addrPort === port) {
+      const pid = parseInt(parts[parts.length - 1], 10);
+      if (!isNaN(pid) && pid > 0) return pid;
+    }
+  }
+  return null;
+}
 function findPidOnPort(port) {
   try {
+    if (isWindows2) {
+      const output2 = execSync("netstat -ano -p tcp", {
+        encoding: "utf-8",
+        timeout: PID_LOOKUP_TIMEOUT_MS
+      });
+      return parsePidFromNetstat(output2, port);
+    }
     const output = execSync(`lsof -ti tcp:${port} -sTCP:LISTEN`, {
       encoding: "utf-8",
-      timeout: LSOF_TIMEOUT_MS
+      timeout: PID_LOOKUP_TIMEOUT_MS
     });
     const pid = parseInt(output.trim().split("\n")[0], 10);
     return isNaN(pid) ? null : pid;
@@ -855,11 +883,11 @@ function collectBinPaths(cwd) {
   const dirs = [];
   let dir = cwd;
   for (; ; ) {
-    const bin = path.join(dir, "node_modules", ".bin");
+    const bin = path2.join(dir, "node_modules", ".bin");
     if (fs3.existsSync(bin)) {
       dirs.push(bin);
     }
-    const parent = path.dirname(dir);
+    const parent = path2.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -868,12 +896,15 @@ function collectBinPaths(cwd) {
 function augmentedPath(env) {
   const base = (env ?? process.env).PATH ?? "";
   const bins = collectBinPaths(process.cwd());
-  return bins.length > 0 ? bins.join(path.delimiter) + path.delimiter + base : base;
+  return bins.length > 0 ? bins.join(path2.delimiter) + path2.delimiter + base : base;
 }
 function spawnCommand(commandArgs, options) {
   const env = { ...options?.env ?? process.env, PATH: augmentedPath(options?.env) };
-  const shellCmd = commandArgs.map(shellEscape).join(" ");
-  const child = spawn("/bin/sh", ["-c", shellCmd], {
+  const child = isWindows2 ? spawn(commandArgs[0], commandArgs.slice(1), {
+    stdio: "inherit",
+    env,
+    shell: true
+  }) : spawn("/bin/sh", ["-c", commandArgs.map(shellEscape).join(" ")], {
     stdio: "inherit",
     env
   });
@@ -925,7 +956,7 @@ var FRAMEWORKS_NEEDING_PORT = {
 function injectFrameworkFlags(commandArgs, port) {
   const cmd = commandArgs[0];
   if (!cmd) return;
-  const basename2 = path.basename(cmd);
+  const basename2 = path2.basename(cmd);
   const framework = FRAMEWORKS_NEEDING_PORT[basename2];
   if (!framework) return;
   if (!commandArgs.includes("--port")) {
@@ -955,7 +986,7 @@ function prompt(question) {
 
 // src/routes.ts
 import * as fs4 from "fs";
-import * as path2 from "path";
+import * as path3 from "path";
 var STALE_LOCK_THRESHOLD_MS = 1e4;
 var LOCK_MAX_RETRIES = 20;
 var LOCK_RETRY_DELAY_MS = 50;
@@ -988,10 +1019,10 @@ var RouteStore = class _RouteStore {
   onWarning;
   constructor(dir, options) {
     this.dir = dir;
-    this.routesPath = path2.join(dir, "routes.json");
-    this.lockPath = path2.join(dir, "routes.lock");
-    this.pidPath = path2.join(dir, "proxy.pid");
-    this.portFilePath = path2.join(dir, "proxy.port");
+    this.routesPath = path3.join(dir, "routes.json");
+    this.lockPath = path3.join(dir, "routes.lock");
+    this.pidPath = path3.join(dir, "proxy.pid");
+    this.portFilePath = path3.join(dir, "proxy.port");
     this.onWarning = options?.onWarning;
   }
   isSystemDir() {
@@ -1149,6 +1180,7 @@ export {
   cleanHostsFile,
   getManagedHostnames,
   checkHostResolution,
+  isWindows2 as isWindows,
   PRIVILEGED_PORT_THRESHOLD,
   getDefaultPort,
   resolveStateDir,

package/dist/cli.js

@@ -19,6 +19,7 @@ import {
   isErrnoException,
   isHttpsEnvEnabled,
   isProxyRunning,
+  isWindows,
   parseHostname,
   prompt,
   readTldFromDir,
@@ -30,7 +31,7 @@ import {
   waitForProxy,
   writeTldFile,
   writeTlsMarker
-} from "./chunk-AB3HUERH.js";
+} from "./chunk-Y6FWHU6F.js";
 
 // src/cli.ts
 import chalk from "chalk";
@@ -219,9 +220,24 @@ function isCATrusted(stateDir) {
     return isCATrustedMacOS(caCertPath);
   } else if (process.platform === "linux") {
     return isCATrustedLinux(stateDir);
+  } else if (process.platform === "win32") {
+    return isCATrustedWindows(caCertPath);
   }
   return false;
 }
+function isCATrustedWindows(caCertPath) {
+  try {
+    const fingerprint = openssl(["x509", "-in", caCertPath, "-noout", "-fingerprint", "-sha1"]).trim().replace(/^.*=/, "").replace(/:/g, "").toLowerCase();
+    const result = execFileSync("certutil", ["-store", "-user", "Root"], {
+      encoding: "utf-8",
+      timeout: 1e4,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    return result.replace(/\s/g, "").toLowerCase().includes(fingerprint);
+  } catch {
+    return false;
+  }
+}
 function isCATrustedMacOS(caCertPath) {
   try {
     const isRoot = (process.getuid?.() ?? -1) === 0;
@@ -466,6 +482,12 @@ function trustCA(stateDir) {
       fs.copyFileSync(caCertPath, dest);
       execFileSync(config.updateCommand, [], { stdio: "pipe", timeout: 3e4 });
       return { trusted: true };
+    } else if (process.platform === "win32") {
+      execFileSync("certutil", ["-addstore", "-user", "Root", caCertPath], {
+        stdio: "pipe",
+        timeout: 3e4
+      });
+      return { trusted: true };
     }
     return { trusted: false, error: `Unsupported platform: ${process.platform}` };
   } catch (err) {
@@ -584,6 +606,25 @@ function detectWorktreeViaCli(cwd) {
     });
     const worktreeCount = listOutput.split("\n").filter((l) => l.startsWith("worktree ")).length;
     if (worktreeCount <= 1) return null;
+    const gitDir = path2.resolve(
+      cwd,
+      execFileSync2("git", ["rev-parse", "--git-dir"], {
+        cwd,
+        encoding: "utf-8",
+        timeout: 5e3,
+        stdio: ["ignore", "pipe", "ignore"]
+      }).trim()
+    );
+    const gitCommonDir = path2.resolve(
+      cwd,
+      execFileSync2("git", ["rev-parse", "--git-common-dir"], {
+        cwd,
+        encoding: "utf-8",
+        timeout: 5e3,
+        stdio: ["ignore", "pipe", "ignore"]
+      }).trim()
+    );
+    if (gitDir === gitCommonDir) return null;
     const branch = execFileSync2("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
       cwd,
       encoding: "utf-8",
@@ -611,7 +652,7 @@ function detectWorktreeViaFilesystem(startDir) {
         const match = content.match(/^gitdir:\s*(.+)$/);
         if (!match) return null;
         const gitdir = match[1];
-        if (!gitdir.match(/\/worktrees\/[^/]+$/)) return null;
+        if (!gitdir.match(/[/\\]worktrees[/\\][^/\\]+$/)) return null;
         const branch = readBranchFromHead(path2.resolve(dir, gitdir));
         const prefix = branchToPrefix(branch ?? "");
         if (!prefix) return null;
@@ -636,6 +677,8 @@ function readBranchFromHead(gitdir) {
 }
 
 // src/cli.ts
+var HOSTS_DISPLAY = isWindows ? "hosts file" : "/etc/hosts";
+var SUDO_PREFIX = isWindows ? "" : "sudo ";
 var DEBOUNCE_MS = 100;
 var POLL_INTERVAL_MS = 3e3;
 var EXIT_TIMEOUT_MS = 2e3;
@@ -692,7 +735,11 @@ function startProxyServer(store, proxyPort, tld, tlsOptions) {
       console.error(chalk.blue("Stop the existing proxy first:"));
       console.error(chalk.cyan("  portless proxy stop"));
       console.error(chalk.blue("Or check what is using the port:"));
-      console.error(chalk.cyan(`  lsof -ti tcp:${proxyPort}`));
+      console.error(
+        chalk.cyan(
+          isWindows ? `  netstat -ano | findstr :${proxyPort}` : `  lsof -ti tcp:${proxyPort}`
+        )
+      );
     } else if (err.code === "EACCES") {
       console.error(chalk.red(`Permission denied for port ${proxyPort}.`));
       console.error(chalk.blue("Either run with sudo:"));
@@ -744,7 +791,7 @@ function startProxyServer(store, proxyPort, tld, tlsOptions) {
 }
 async function stopProxy(store, proxyPort, _tls) {
   const pidPath = store.pidPath;
-  const needsSudo = proxyPort < PRIVILEGED_PORT_THRESHOLD;
+  const needsSudo = !isWindows && proxyPort < PRIVILEGED_PORT_THRESHOLD;
   const sudoHint = needsSudo ? "sudo " : "";
   if (!fs3.existsSync(pidPath)) {
     if (await isProxyRunning(proxyPort)) {
@@ -760,24 +807,38 @@ async function stopProxy(store, proxyPort, _tls) {
           console.log(chalk.green(`Killed process ${pid}. Proxy stopped.`));
         } catch (err) {
           if (isErrnoException(err) && err.code === "EPERM") {
-            console.error(chalk.red("Permission denied. The proxy was started with sudo."));
+            console.error(
+              chalk.red("Permission denied. The proxy was started with elevated privileges.")
+            );
             console.error(chalk.blue("Stop it with:"));
-            console.error(chalk.cyan("  sudo portless proxy stop"));
+            console.error(
+              chalk.cyan(
+                isWindows ? "  Run portless proxy stop as Administrator" : "  sudo portless proxy stop"
+              )
+            );
           } else {
             const message = err instanceof Error ? err.message : String(err);
             console.error(chalk.red(`Failed to stop proxy: ${message}`));
             console.error(chalk.blue("Check if the process is still running:"));
-            console.error(chalk.cyan(`  lsof -ti tcp:${proxyPort}`));
+            console.error(
+              chalk.cyan(
+                isWindows ? `  netstat -ano | findstr :${proxyPort}` : `  lsof -ti tcp:${proxyPort}`
+              )
+            );
           }
         }
-      } else if (process.getuid?.() !== 0) {
+      } else if (!isWindows && process.getuid?.() !== 0) {
         console.error(chalk.red("Cannot identify the process. It may be running as root."));
         console.error(chalk.blue("Try stopping with sudo:"));
         console.error(chalk.cyan("  sudo portless proxy stop"));
       } else {
         console.error(chalk.red(`Could not identify the process on port ${proxyPort}.`));
         console.error(chalk.blue("Try manually:"));
-        console.error(chalk.cyan(`  sudo kill "$(lsof -ti tcp:${proxyPort})"`));
+        console.error(
+          chalk.cyan(
+            isWindows ? "  taskkill /F /PID <pid>" : `  sudo kill "$(lsof -ti tcp:${proxyPort})"`
+          )
+        );
       }
     } else {
       console.log(chalk.yellow("Proxy is not running."));
@@ -821,14 +882,20 @@ async function stopProxy(store, proxyPort, _tls) {
     console.log(chalk.green("Proxy stopped."));
   } catch (err) {
     if (isErrnoException(err) && err.code === "EPERM") {
-      console.error(chalk.red("Permission denied. The proxy was started with sudo."));
+      console.error(
+        chalk.red("Permission denied. The proxy was started with elevated privileges.")
+      );
       console.error(chalk.blue("Stop it with:"));
       console.error(chalk.cyan(`  ${sudoHint}portless proxy stop`));
     } else {
       const message = err instanceof Error ? err.message : String(err);
       console.error(chalk.red(`Failed to stop proxy: ${message}`));
       console.error(chalk.blue("Check if the process is still running:"));
-      console.error(chalk.cyan(`  lsof -ti tcp:${proxyPort}`));
+      console.error(
+        chalk.cyan(
+          isWindows ? `  netstat -ano | findstr :${proxyPort}` : `  lsof -ti tcp:${proxyPort}`
+        )
+      );
     }
   }
 }
@@ -878,7 +945,7 @@ portless
   }
   if (!await isProxyRunning(proxyPort, tls2)) {
     const defaultPort = getDefaultPort();
-    const needsSudo = defaultPort < PRIVILEGED_PORT_THRESHOLD;
+    const needsSudo = !isWindows && defaultPort < PRIVILEGED_PORT_THRESHOLD;
     const wantHttps = isHttpsEnvEnabled();
     if (needsSudo) {
       if (!process.stdin.isTTY) {
@@ -1135,8 +1202,8 @@ ${chalk.bold("Usage:")}
   ${chalk.cyan("portless alias --remove <name>")}   Remove a static route
   ${chalk.cyan("portless list")}                    Show active routes
   ${chalk.cyan("portless trust")}                   Add local CA to system trust store
-  ${chalk.cyan("portless hosts sync")}              Add routes to /etc/hosts (fixes Safari)
-  ${chalk.cyan("portless hosts clean")}             Remove portless entries from /etc/hosts
+  ${chalk.cyan("portless hosts sync")}              Add routes to ${HOSTS_DISPLAY} (fixes Safari)
+  ${chalk.cyan("portless hosts clean")}             Remove portless entries from ${HOSTS_DISPLAY}
 
 ${chalk.bold("Examples:")}
   portless proxy start                # Start proxy on port 1355
@@ -1191,7 +1258,7 @@ ${chalk.bold("Environment variables:")}
   PORTLESS_APP_PORT=<number>    Use a fixed port for the app (same as --app-port)
   PORTLESS_HTTPS=1              Always enable HTTPS (set in .bashrc / .zshrc)
   PORTLESS_TLD=<tld>            Use a custom TLD (e.g. test, dev; default: localhost)
-  PORTLESS_SYNC_HOSTS=1         Auto-sync /etc/hosts (auto-enabled for custom TLDs)
+  PORTLESS_SYNC_HOSTS=1         Auto-sync ${HOSTS_DISPLAY} (auto-enabled for custom TLDs)
   PORTLESS_STATE_DIR=<path>     Override the state directory
   PORTLESS=0                    Run command directly without proxy
 
@@ -1203,11 +1270,11 @@ ${chalk.bold("Child process environment:")}
 ${chalk.bold("Safari / DNS:")}
   .localhost subdomains auto-resolve in Chrome, Firefox, and Edge.
   Safari relies on the system DNS resolver, which may not handle them.
-  Auto-syncs /etc/hosts for custom TLDs (e.g. --tld test). For .localhost,
+  Auto-syncs ${HOSTS_DISPLAY} for custom TLDs (e.g. --tld test). For .localhost,
   set PORTLESS_SYNC_HOSTS=1 to enable. To manually sync:
-    ${chalk.cyan("sudo portless hosts sync")}
+    ${chalk.cyan(`${SUDO_PREFIX}portless hosts sync`)}
   Clean up later with:
-    ${chalk.cyan("sudo portless hosts clean")}
+    ${chalk.cyan(`${SUDO_PREFIX}portless hosts clean`)}
 
 ${chalk.bold("Skip portless:")}
   PORTLESS=0 pnpm dev           # Runs command directly without proxy
@@ -1220,7 +1287,7 @@ ${chalk.bold("Reserved names:")}
   process.exit(0);
 }
 function printVersion() {
-  console.log("0.6.0");
+  console.log("0.7.0");
   process.exit(0);
 }
 async function handleTrust() {
@@ -1362,14 +1429,14 @@ ${chalk.bold("Examples:")}
 async function handleHosts(args) {
   if (args[1] === "--help" || args[1] === "-h") {
     console.log(`
-${chalk.bold("portless hosts")} - Manage /etc/hosts entries for .localhost subdomains.
+${chalk.bold("portless hosts")} - Manage ${HOSTS_DISPLAY} entries for .localhost subdomains.
 
 Safari relies on the system DNS resolver, which may not handle .localhost
-subdomains. This command adds entries to /etc/hosts as a workaround.
+subdomains. This command adds entries to ${HOSTS_DISPLAY} as a workaround.
 
 ${chalk.bold("Usage:")}
-  ${chalk.cyan("sudo portless hosts sync")}    Add current routes to /etc/hosts
-  ${chalk.cyan("sudo portless hosts clean")}   Remove portless entries from /etc/hosts
+  ${chalk.cyan(`${SUDO_PREFIX}portless hosts sync`)}    Add current routes to ${HOSTS_DISPLAY}
+  ${chalk.cyan(`${SUDO_PREFIX}portless hosts clean`)}   Remove portless entries from ${HOSTS_DISPLAY}
 
 ${chalk.bold("Auto-sync:")}
   Auto-enabled for custom TLDs (e.g. --tld test). For .localhost, set
@@ -1379,10 +1446,14 @@ ${chalk.bold("Auto-sync:")}
   }
   if (args[1] === "clean") {
     if (cleanHostsFile()) {
-      console.log(chalk.green("Removed portless entries from /etc/hosts."));
+      console.log(chalk.green(`Removed portless entries from ${HOSTS_DISPLAY}.`));
     } else {
-      console.error(chalk.red("Failed to update /etc/hosts (requires sudo)."));
-      console.error(chalk.cyan("  sudo portless hosts clean"));
+      console.error(
+        chalk.red(
+          `Failed to update ${HOSTS_DISPLAY}${isWindows ? " (run as Administrator)." : " (requires sudo)."}`
+        )
+      );
+      console.error(chalk.cyan(`  ${SUDO_PREFIX}portless hosts clean`));
       process.exit(1);
     }
     return;
@@ -1391,16 +1462,18 @@ ${chalk.bold("Auto-sync:")}
     console.log(`
 ${chalk.bold("Usage: portless hosts <command>")}
 
-  ${chalk.cyan("sudo portless hosts sync")}    Add current routes to /etc/hosts
-  ${chalk.cyan("sudo portless hosts clean")}   Remove portless entries from /etc/hosts
+  ${chalk.cyan(`${SUDO_PREFIX}portless hosts sync`)}    Add current routes to ${HOSTS_DISPLAY}
+  ${chalk.cyan(`${SUDO_PREFIX}portless hosts clean`)}   Remove portless entries from ${HOSTS_DISPLAY}
 `);
     process.exit(0);
   }
   if (args[1] !== "sync") {
     console.error(chalk.red(`Error: Unknown hosts subcommand "${args[1]}".`));
     console.error(chalk.blue("Usage:"));
-    console.error(chalk.cyan("  portless hosts sync    # Add routes to /etc/hosts"));
-    console.error(chalk.cyan("  portless hosts clean   # Remove portless entries"));
+    console.error(
+      chalk.cyan(`  ${SUDO_PREFIX}portless hosts sync    # Add routes to ${HOSTS_DISPLAY}`)
+    );
+    console.error(chalk.cyan(`  ${SUDO_PREFIX}portless hosts clean   # Remove portless entries`));
     process.exit(1);
   }
   const { dir } = await discoverState();
@@ -1414,13 +1487,17 @@ ${chalk.bold("Usage: portless hosts <command>")}
   }
   const hostnames = routes.map((r) => r.hostname);
   if (syncHostsFile(hostnames)) {
-    console.log(chalk.green(`Synced ${hostnames.length} hostname(s) to /etc/hosts:`));
+    console.log(chalk.green(`Synced ${hostnames.length} hostname(s) to ${HOSTS_DISPLAY}:`));
     for (const h of hostnames) {
       console.log(chalk.cyan(`  127.0.0.1 ${h}`));
     }
   } else {
-    console.error(chalk.red("Failed to update /etc/hosts (requires sudo)."));
-    console.error(chalk.cyan("  sudo portless hosts sync"));
+    console.error(
+      chalk.red(
+        `Failed to update ${HOSTS_DISPLAY}${isWindows ? " (run as Administrator)." : " (requires sudo)."}`
+      )
+    );
+    console.error(chalk.cyan(`  ${SUDO_PREFIX}portless hosts sync`));
     process.exit(1);
   }
 }
@@ -1520,10 +1597,12 @@ ${chalk.bold("Usage:")}
   const syncDisabled = process.env.PORTLESS_SYNC_HOSTS === "0" || process.env.PORTLESS_SYNC_HOSTS === "false";
   if (tld !== DEFAULT_TLD && syncDisabled) {
     console.warn(
-      chalk.yellow(`Warning: .${tld} domains require /etc/hosts entries to resolve to 127.0.0.1.`)
+      chalk.yellow(
+        `Warning: .${tld} domains require ${HOSTS_DISPLAY} entries to resolve to 127.0.0.1.`
+      )
     );
     console.warn(chalk.yellow("Hosts sync is disabled. To add entries manually, run:"));
-    console.warn(chalk.cyan("  sudo portless hosts sync"));
+    console.warn(chalk.cyan(`  ${SUDO_PREFIX}portless hosts sync`));
   }
   const useHttps = wantHttps || !!(customCertPath && customKeyPath);
   const stateDir = resolveStateDir(proxyPort);
@@ -1534,7 +1613,7 @@ ${chalk.bold("Usage:")}
     if (isForeground) {
       return;
     }
-    const needsSudo = proxyPort < PRIVILEGED_PORT_THRESHOLD;
+    const needsSudo = !isWindows && proxyPort < PRIVILEGED_PORT_THRESHOLD;
     const sudoPrefix = needsSudo ? "sudo " : "";
     const portFlag = proxyPort !== getDefaultPort() ? ` -p ${proxyPort}` : "";
     console.log(chalk.yellow(`Proxy is already running on port ${proxyPort}.`));
@@ -1545,7 +1624,7 @@ ${chalk.bold("Usage:")}
     );
     return;
   }
-  if (proxyPort < PRIVILEGED_PORT_THRESHOLD && (process.getuid?.() ?? -1) !== 0) {
+  if (!isWindows && proxyPort < PRIVILEGED_PORT_THRESHOLD && (process.getuid?.() ?? -1) !== 0) {
     console.error(chalk.red(`Error: Port ${proxyPort} requires sudo.`));
     console.error(chalk.blue("Either run with sudo:"));
     console.error(chalk.cyan("  sudo portless proxy start -p 80"));
@@ -1642,7 +1721,8 @@ ${chalk.bold("Usage:")}
     const child = spawn(process.execPath, daemonArgs, {
       detached: true,
       stdio: ["ignore", logFd, logFd],
-      env: process.env
+      env: process.env,
+      windowsHide: true
     });
     child.unref();
   } finally {
@@ -1651,7 +1731,7 @@ ${chalk.bold("Usage:")}
   if (!await waitForProxy(proxyPort, void 0, void 0, useHttps)) {
     console.error(chalk.red("Proxy failed to start (timed out waiting for it to listen)."));
     console.error(chalk.blue("Try starting the proxy in the foreground to see the error:"));
-    const needsSudo = proxyPort < PRIVILEGED_PORT_THRESHOLD;
+    const needsSudo = !isWindows && proxyPort < PRIVILEGED_PORT_THRESHOLD;
     console.error(chalk.cyan(`  ${needsSudo ? "sudo " : ""}portless proxy start --foreground`));
     if (fs3.existsSync(logPath)) {
       console.error(chalk.gray(`Logs: ${logPath}`));
@@ -1674,12 +1754,7 @@ async function handleRunMode(args) {
   let baseName;
   let nameSource;
   if (parsed.name) {
-    const sanitized = sanitizeForHostname(parsed.name);
-    if (!sanitized) {
-      console.error(chalk.red(`Error: --name value "${parsed.name}" produces an empty hostname.`));
-      process.exit(1);
-    }
-    baseName = sanitized;
+    baseName = parsed.name;
     nameSource = "--name flag";
   } else {
     const inferred = inferProjectName();

package/dist/index.d.ts

@@ -101,7 +101,8 @@ declare class RouteStore {
 
 /**
  * When running under sudo, fix file ownership so the real user can
- * read/write the file later without sudo. No-op when not running as root.
+ * read/write the file later without sudo. No-op on Windows or when not
+ * running as root.
  */
 declare function fixOwnership(...paths: string[]): void;
 /** Type guard for Node.js system errors with an error code. */

package/dist/index.js

@@ -19,7 +19,7 @@ import {
   parseHostname,
   removeBlock,
   syncHostsFile
-} from "./chunk-AB3HUERH.js";
+} from "./chunk-Y6FWHU6F.js";
 export {
   DIR_MODE,
   FILE_MODE,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "portless",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Replace port numbers with stable, named .localhost URLs. For humans and agents.",
   "type": "module",
   "main": "./dist/index.js",
@@ -22,19 +22,9 @@
   },
   "os": [
     "darwin",
-    "linux"
+    "linux",
+    "win32"
   ],
-  "scripts": {
-    "build": "tsup",
-    "dev": "tsup --watch",
-    "lint": "eslint src/",
-    "lint:fix": "eslint src/ --fix",
-    "prepublishOnly": "cp ../../README.md . && pnpm build",
-    "test": "vitest run",
-    "test:coverage": "vitest run --coverage",
-    "test:watch": "vitest",
-    "typecheck": "tsc --noEmit"
-  },
   "keywords": [
     "local",
     "development",
@@ -61,5 +51,15 @@
     "tsup": "^8.0.1",
     "typescript": "^5.3.3",
     "vitest": "^4.0.18"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "lint": "eslint src/",
+    "lint:fix": "eslint src/ --fix",
+    "test": "vitest run",
+    "test:coverage": "vitest run --coverage",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit"
   }
-}
+}