supbuddy 3.1.17 → 3.1.18

package/dist/bin.js

@@ -19803,7 +19803,7 @@ function cliBuildKind(env3 = process.env) {
   return raw === "host" || raw === "npm" ? raw : "dev";
 }
 function cliVersion(env3 = process.env) {
-  return "3.1.17".trim() || "0.0.0-dev";
+  return "3.1.18".trim() || "0.0.0-dev";
 }
 function isDevBuild(env3) {
   return cliBuildKind(env3) === "dev";

package/dist/daemon/worker.cjs

@@ -45400,6 +45400,8 @@ const executors = {
         resolversReapplied: false,
         resolverError: `${resolvers.error ?? resolvers.outcome}. Missing: [${(resolvers.missing ?? []).join(", ")}]. Those domains will not resolve until the files exist.`
       } : {};
+      const anchor = await globalThis.reapplyPfAnchorIfDrifted?.("restart_proxy");
+      const anchorReport = anchor && anchor.ok === false ? { pfAnchorUpdated: false, pfAnchorError: `${anchor.error ?? anchor.outcome}` } : anchor?.outcome === "applied" ? { pfAnchorUpdated: true } : {};
       const { getPortForwardingStatus: getPortForwardingStatus2, probe443: probe4432, waitForPort: waitForPort2 } = await __vitePreload(async () => {
         const { getPortForwardingStatus: getPortForwardingStatus3, probe443: probe4433, waitForPort: waitForPort3 } = await Promise.resolve().then(() => portForwarding);
         return { getPortForwardingStatus: getPortForwardingStatus3, probe443: probe4433, waitForPort: waitForPort3 };
@@ -45408,14 +45410,14 @@ const executors = {
       const caddyUp = await waitForPort2(httpsPort).catch(() => false);
       const pf = caddyUp ? await getPortForwardingStatus2(httpPort, httpsPort, { probe: probe4432 }).catch(() => null) : null;
       if (!caddyUp) {
-        return { ok: true, ...resolverReport, portForwardingChecked: false, note: `Caddy is not accepting on ${httpsPort}, so port forwarding was not verified.` };
+        return { ok: true, ...resolverReport, ...anchorReport, portForwardingChecked: false, note: `Caddy is not accepting on ${httpsPort}, so port forwarding was not verified.` };
       }
       if (pf?.enabled && pf.enforced === false) {
         const repair = globalThis.repairPortForwarding;
         const r = repair ? await repair({ prompt: "Supbuddy needs to re-apply the port-forwarding rules." }).catch((e) => ({ ok: false, error: e instanceof Error ? e.message : String(e) })) : { ok: false, error: "pf repair is unavailable in this process" };
-        return { ok: true, ...resolverReport, portForwardingRepaired: r.ok, ...r.ok ? {} : { portForwardingError: r.error } };
+        return { ok: true, ...resolverReport, ...anchorReport, portForwardingRepaired: r.ok, ...r.ok ? {} : { portForwardingError: r.error } };
       }
-      return { ok: true, ...resolverReport };
+      return { ok: true, ...resolverReport, ...anchorReport };
     } finally {
       globalThis.scheduleDoctorAutoScan?.("proxy-restart", PROXY_RESCAN_SETTLE_MS);
     }
@@ -50321,6 +50323,10 @@ function buildPfAnchor(input) {
   }
   return lines.join("\n") + "\n";
 }
+function pfAnchorDrifted(desired, actual) {
+  if (actual === null) return true;
+  return actual !== desired;
+}
 const execAsync$5 = util$1.promisify(child_process.exec);
 const execFileAsync$2 = util$1.promisify(child_process.execFile);
 const MIGRATE_DIR = path.join(os$1.tmpdir(), "supbuddy-migrate");
@@ -51351,6 +51357,7 @@ async function applyProjectActivation(projectId, opts) {
 }
 globalThis.applyProjectActivation = applyProjectActivation;
 globalThis.reapplyDnsResolversIfDrifted = reapplyDnsResolversIfDrifted;
+globalThis.reapplyPfAnchorIfDrifted = reapplyPfAnchorIfDrifted;
 globalThis.repairPortForwarding = repairPortForwarding;
 async function testPortForwarding(_httpsPort) {
   return probe443();
@@ -51589,12 +51596,15 @@ function isPfRulesetRejection(err, stderr) {
 async function maybeAutoStartProxyForGui() {
   if (guiProxyAutoStartDone) return;
   const store2 = useStore.getState();
-  if (!store2.settings.autoStart) return;
   const status = store2.proxyState.status;
   if (status === "running" || status === "starting") {
     guiProxyAutoStartDone = true;
+    if (status === "running" && shouldRetryPrivilegedSetup(store2.proxyState, lastPrivilegedError)) {
+      await retryPrivilegedSetupOnce("proxy is running but its privileged setup never ran (no GUI owner at boot)");
+    }
     return;
   }
+  if (!store2.settings.autoStart) return;
   guiProxyAutoStartDone = true;
   console.log("[Proxy] GUI host-bridge owner ready — auto-starting proxy (autoStart on)");
   try {
@@ -51604,19 +51614,20 @@ async function maybeAutoStartProxyForGui() {
   }
   const afterFirst = useStore.getState().proxyState;
   if (shouldRetryPrivilegedSetup(afterFirst, lastPrivilegedError)) {
-    console.warn(
-      "[Proxy] auto-start hit the host-bridge owner race (TTY/ASKPASS) — retrying privileged setup once in 2s"
+    await retryPrivilegedSetupOnce("auto-start hit the host-bridge owner race (TTY/ASKPASS)");
+  }
+}
+async function retryPrivilegedSetupOnce(reason) {
+  console.warn(`[Proxy] ${reason} — retrying privileged setup once in 2s`);
+  await new Promise((resolve) => setTimeout(resolve, 2e3));
+  try {
+    await handleStartProxy();
+    const after = useStore.getState().proxyState;
+    console.log(
+      after.needsPrivilegedRepair ? "[Proxy] privileged retry still degraded — setup failed again (manual Retry remains available)" : "[Proxy] privileged retry recovered — setup applied"
     );
-    await new Promise((resolve) => setTimeout(resolve, 2e3));
-    try {
-      await handleStartProxy();
-      const afterRetry = useStore.getState().proxyState;
-      console.log(
-        afterRetry.needsPrivilegedRepair ? "[Proxy] auto-start retry still degraded — privileged setup failed again (manual Retry remains available)" : "[Proxy] auto-start retry recovered — privileged setup applied"
-      );
-    } catch (e) {
-      console.error("[Proxy] auto-start retry failed:", e);
-    }
+  } catch (e) {
+    console.error("[Proxy] privileged retry failed:", e);
   }
 }
 async function handleStartProxy() {
@@ -51921,6 +51932,75 @@ async function repairPortForwarding(opts) {
   await clearProxyFaultIfHealthy("a confirmed pf repair");
   return { ok: true, enforced: true };
 }
+async function reapplyPfAnchorIfDrifted(reason) {
+  const store2 = useStore.getState();
+  const { httpPort, httpsPort, lanSharing } = store2.settings;
+  const desired = buildPfAnchor({
+    httpPort,
+    httpsPort,
+    lanSharing,
+    lanInterfaces: lanSharing ? getLanInterfaces() : []
+  });
+  let actual = null;
+  try {
+    actual = fsSync.readFileSync("/etc/pf.anchors/virtual.localhost", "utf-8");
+  } catch {
+    actual = null;
+  }
+  let pfConf = "";
+  try {
+    pfConf = fsSync.readFileSync("/etc/pf.conf", "utf-8");
+  } catch {
+    pfConf = "";
+  }
+  if (!pfConf.includes("virtual.localhost")) return { ok: true, outcome: "not-configured" };
+  if (!pfAnchorDrifted(desired, actual)) return { ok: true, outcome: "no-drift" };
+  console.log(`[Proxy] pf anchor is out of date (${reason}) — rewriting`);
+  const tmpSuffix = `${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+  const tmpAnchor = path.join(os$1.tmpdir(), `supbuddy-pf-anchor-${tmpSuffix}`);
+  const tmpValidation = path.join(os$1.tmpdir(), `supbuddy-pf-validate-${tmpSuffix}`);
+  fsSync.writeFileSync(tmpAnchor, desired);
+  try {
+    const { content: correctedPfConf } = buildCorrectedPfConf(pfConf);
+    fsSync.writeFileSync(tmpValidation, buildValidationPfConf(correctedPfConf, tmpAnchor));
+    try {
+      child_process.execSync(`pfctl -nf "${tmpValidation}"`, { stdio: "pipe" });
+    } catch (validationErr) {
+      const stderr = (validationErr?.stderr?.toString() ?? "").trim();
+      if (isPfRulesetRejection(validationErr, stderr)) {
+        console.error(`[Proxy] refusing to install pf anchor — ruleset rejected: ${stderr}`);
+        return { ok: false, outcome: "invalid", error: stderr || "pf rejected the generated ruleset" };
+      }
+    }
+    if (!process.send) return { ok: false, outcome: "no-bridge", error: "no host bridge in this process" };
+    const res = await defaultElevate$1({
+      command: `cp ${JSON.stringify(tmpAnchor)} /etc/pf.anchors/virtual.localhost && ${buildPfLoadCommand({ restoreBackupOnFailure: false })}`,
+      prompt: "Supbuddy needs to update its port-forwarding rules."
+    }).catch((e) => ({ success: false, error: e instanceof Error ? e.message : String(e) }));
+    if (!res.success) {
+      console.warn(`[Proxy] pf anchor rewrite failed: ${res.error ?? "unknown error"}`);
+      return { ok: false, outcome: "failed", error: res.error };
+    }
+    let after = null;
+    try {
+      after = fsSync.readFileSync("/etc/pf.anchors/virtual.localhost", "utf-8");
+    } catch {
+      after = null;
+    }
+    if (pfAnchorDrifted(desired, after)) {
+      return { ok: false, outcome: "failed", error: "the elevated write reported success but the anchor on disk is unchanged" };
+    }
+    console.log("[Proxy] pf anchor rewritten and reloaded");
+    return { ok: true, outcome: "applied" };
+  } finally {
+    for (const f2 of [tmpAnchor, tmpValidation]) {
+      try {
+        fsSync.unlinkSync(f2);
+      } catch {
+      }
+    }
+  }
+}
 async function clearProxyFaultIfHealthy(reason) {
   const store2 = useStore.getState();
   if (store2.proxyState.status !== "error") return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "supbuddy",
-  "version": "3.1.17",
+  "version": "3.1.18",
   "description": "Run multiple Supabase projects at once on custom local domains with HTTPS. A headless CLI and daemon (proxy, DNS, Supabase/Compose lifecycle, MCP) for macOS and Linux.",
   "keywords": [
     "supabase",