supbuddy 3.1.17 → 3.1.22

package/dist/bin.js

@@ -19207,6 +19207,12 @@ function startRelayServer(child, opts) {
   let hostBridgeOwner = null;
   let seq2 = 0;
   const pending = /* @__PURE__ */ new Map();
+  const sendOwnerReady = () => {
+    try {
+      child.send?.({ type: "host-bridge:owner-ready" });
+    } catch {
+    }
+  };
   const failAllPending = (reason) => {
     for (const [, p] of pending) {
       clearTimeout(p.timer);
@@ -19225,17 +19231,11 @@ function startRelayServer(child, opts) {
       }
     });
     socket2.on("host-bridge:claim", () => {
-      const hadOwner = hostBridgeOwner !== null;
       if (hostBridgeOwner && hostBridgeOwner.id !== socket2.id) {
         hostBridgeOwner.emit("host-bridge:revoked");
       }
       hostBridgeOwner = socket2;
-      if (!hadOwner) {
-        try {
-          child.send?.({ type: "host-bridge:owner-ready" });
-        } catch {
-        }
-      }
+      sendOwnerReady();
     });
     socket2.on("host-bridge:reply", ({ correlationId, reply }) => {
       const p = pending.get(correlationId);
@@ -19265,6 +19265,10 @@ function startRelayServer(child, opts) {
     });
   };
   const onChildMessage = (m) => {
+    if (m?.type === "host-bridge:owner?") {
+      if (hostBridgeOwner) sendOwnerReady();
+      return;
+    }
     if (isHostBridgeMessage(m)) return;
     io2.emit("worker:message", m);
   };
@@ -19803,7 +19807,7 @@ function cliBuildKind(env3 = process.env) {
   return raw === "host" || raw === "npm" ? raw : "dev";
 }
 function cliVersion(env3 = process.env) {
-  return "3.1.17".trim() || "0.0.0-dev";
+  return "3.1.22".trim() || "0.0.0-dev";
 }
 function isDevBuild(env3) {
   return cliBuildKind(env3) === "dev";
@@ -39154,7 +39158,10 @@ async function probe443(timeoutMs = 1e3) {
 }
 async function probePort(port, timeoutMs = 1e3) {
   const results = await Promise.all(["127.0.0.1", "::1"].map((host) => probeHost(host, port, timeoutMs)));
-  return results.some(Boolean);
+  if (results.some(Boolean)) return true;
+  await new Promise((r) => setTimeout(r, 150));
+  const confirm = await Promise.all(["127.0.0.1", "::1"].map((host) => probeHost(host, port, timeoutMs)));
+  return confirm.some(Boolean);
 }
 async function probeHost(host, port, timeoutMs) {
   const net2 = await import("net");

package/dist/daemon/worker.cjs

@@ -30248,7 +30248,10 @@ async function probe443(timeoutMs = 1e3) {
 }
 async function probePort(port, timeoutMs = 1e3) {
   const results = await Promise.all(["127.0.0.1", "::1"].map((host) => probeHost(host, port, timeoutMs)));
-  return results.some(Boolean);
+  if (results.some(Boolean)) return true;
+  await new Promise((r) => setTimeout(r, 150));
+  const confirm2 = await Promise.all(["127.0.0.1", "::1"].map((host) => probeHost(host, port, timeoutMs)));
+  return confirm2.some(Boolean);
 }
 async function probeHost(host, port, timeoutMs) {
   const net2 = await __vitePreload(() => import("net"), false ? __VITE_PRELOAD__ : void 0);
@@ -45400,6 +45403,8 @@ const executors = {
         resolversReapplied: false,
         resolverError: `${resolvers.error ?? resolvers.outcome}. Missing: [${(resolvers.missing ?? []).join(", ")}]. Those domains will not resolve until the files exist.`
       } : {};
+      const anchor = await globalThis.reapplyPfAnchorIfDrifted?.("restart_proxy");
+      const anchorReport = anchor && anchor.ok === false ? { pfAnchorUpdated: false, pfAnchorError: `${anchor.error ?? anchor.outcome}` } : anchor?.outcome === "applied" ? { pfAnchorUpdated: true } : {};
       const { getPortForwardingStatus: getPortForwardingStatus2, probe443: probe4432, waitForPort: waitForPort2 } = await __vitePreload(async () => {
         const { getPortForwardingStatus: getPortForwardingStatus3, probe443: probe4433, waitForPort: waitForPort3 } = await Promise.resolve().then(() => portForwarding);
         return { getPortForwardingStatus: getPortForwardingStatus3, probe443: probe4433, waitForPort: waitForPort3 };
@@ -45408,14 +45413,14 @@ const executors = {
       const caddyUp = await waitForPort2(httpsPort).catch(() => false);
       const pf = caddyUp ? await getPortForwardingStatus2(httpPort, httpsPort, { probe: probe4432 }).catch(() => null) : null;
       if (!caddyUp) {
-        return { ok: true, ...resolverReport, portForwardingChecked: false, note: `Caddy is not accepting on ${httpsPort}, so port forwarding was not verified.` };
+        return { ok: true, ...resolverReport, ...anchorReport, portForwardingChecked: false, note: `Caddy is not accepting on ${httpsPort}, so port forwarding was not verified.` };
       }
       if (pf?.enabled && pf.enforced === false) {
         const repair = globalThis.repairPortForwarding;
         const r = repair ? await repair({ prompt: "Supbuddy needs to re-apply the port-forwarding rules." }).catch((e) => ({ ok: false, error: e instanceof Error ? e.message : String(e) })) : { ok: false, error: "pf repair is unavailable in this process" };
-        return { ok: true, ...resolverReport, portForwardingRepaired: r.ok, ...r.ok ? {} : { portForwardingError: r.error } };
+        return { ok: true, ...resolverReport, ...anchorReport, portForwardingRepaired: r.ok, ...r.ok ? {} : { portForwardingError: r.error } };
       }
-      return { ok: true, ...resolverReport };
+      return { ok: true, ...resolverReport, ...anchorReport };
     } finally {
       globalThis.scheduleDoctorAutoScan?.("proxy-restart", PROXY_RESCAN_SETTLE_MS);
     }
@@ -50321,6 +50326,10 @@ function buildPfAnchor(input) {
   }
   return lines.join("\n") + "\n";
 }
+function pfAnchorDrifted(desired, actual) {
+  if (actual === null) return true;
+  return actual !== desired;
+}
 const execAsync$5 = util$1.promisify(child_process.exec);
 const execFileAsync$2 = util$1.promisify(child_process.execFile);
 const MIGRATE_DIR = path.join(os$1.tmpdir(), "supbuddy-migrate");
@@ -51351,6 +51360,7 @@ async function applyProjectActivation(projectId, opts) {
 }
 globalThis.applyProjectActivation = applyProjectActivation;
 globalThis.reapplyDnsResolversIfDrifted = reapplyDnsResolversIfDrifted;
+globalThis.reapplyPfAnchorIfDrifted = reapplyPfAnchorIfDrifted;
 globalThis.repairPortForwarding = repairPortForwarding;
 async function testPortForwarding(_httpsPort) {
   return probe443();
@@ -51574,9 +51584,15 @@ async function requestPrivilegedBatch(command, prompt, tmpFiles = []) {
     process.on("message", handler);
   });
 }
+let privilegedRepairAttempted = false;
 let guiProxyAutoStartDone = false;
 let lastPrivilegedError = null;
+let privilegedWorkPending = null;
 const TRANSIENT_PRIVILEGED_FAILURE = /TTY|ASKPASS|detached/i;
+function shouldFinishPrivilegedSetup(proxyState, privilegedError, workPending) {
+  if (shouldRetryPrivilegedSetup(proxyState, privilegedError)) return true;
+  return TRANSIENT_PRIVILEGED_FAILURE.test(workPending || "");
+}
 function shouldRetryPrivilegedSetup(proxyState, privilegedError) {
   if (!proxyState.needsPrivilegedRepair) return false;
   return TRANSIENT_PRIVILEGED_FAILURE.test(privilegedError || "");
@@ -51587,14 +51603,24 @@ function isPfRulesetRejection(err, stderr) {
   return stderr.trim().length > 0;
 }
 async function maybeAutoStartProxyForGui() {
-  if (guiProxyAutoStartDone) return;
   const store2 = useStore.getState();
-  if (!store2.settings.autoStart) return;
   const status = store2.proxyState.status;
+  if (privilegedWorkPending && !privilegedRepairAttempted) {
+    console.log(
+      `[Proxy] owner-ready: status=${status} repairAttempted=${privilegedRepairAttempted} needsRepair=${!!store2.proxyState.needsPrivilegedRepair} pending=${JSON.stringify(privilegedWorkPending)}`
+    );
+  }
+  if (status === "running" && !privilegedRepairAttempted && shouldFinishPrivilegedSetup(store2.proxyState, lastPrivilegedError, privilegedWorkPending)) {
+    privilegedRepairAttempted = true;
+    await retryPrivilegedSetupOnce("proxy is running but its privileged setup never ran (no GUI owner at boot)");
+    return;
+  }
+  if (guiProxyAutoStartDone) return;
   if (status === "running" || status === "starting") {
     guiProxyAutoStartDone = true;
     return;
   }
+  if (!store2.settings.autoStart) return;
   guiProxyAutoStartDone = true;
   console.log("[Proxy] GUI host-bridge owner ready — auto-starting proxy (autoStart on)");
   try {
@@ -51604,24 +51630,25 @@ async function maybeAutoStartProxyForGui() {
   }
   const afterFirst = useStore.getState().proxyState;
   if (shouldRetryPrivilegedSetup(afterFirst, lastPrivilegedError)) {
-    console.warn(
-      "[Proxy] auto-start hit the host-bridge owner race (TTY/ASKPASS) — retrying privileged setup once in 2s"
+    await retryPrivilegedSetupOnce("auto-start hit the host-bridge owner race (TTY/ASKPASS)");
+  }
+}
+async function retryPrivilegedSetupOnce(reason) {
+  console.warn(`[Proxy] ${reason} — retrying privileged setup once in 2s`);
+  await new Promise((resolve) => setTimeout(resolve, 2e3));
+  try {
+    await handleStartProxy();
+    const after = useStore.getState().proxyState;
+    console.log(
+      after.needsPrivilegedRepair ? "[Proxy] privileged retry still degraded — setup failed again (manual Retry remains available)" : "[Proxy] privileged retry recovered — setup applied"
     );
-    await new Promise((resolve) => setTimeout(resolve, 2e3));
-    try {
-      await handleStartProxy();
-      const afterRetry = useStore.getState().proxyState;
-      console.log(
-        afterRetry.needsPrivilegedRepair ? "[Proxy] auto-start retry still degraded — privileged setup failed again (manual Retry remains available)" : "[Proxy] auto-start retry recovered — privileged setup applied"
-      );
-    } catch (e) {
-      console.error("[Proxy] auto-start retry failed:", e);
-    }
+  } catch (e) {
+    console.error("[Proxy] privileged retry failed:", e);
   }
 }
 async function handleStartProxy() {
   const alreadyRunning = isCaddyRunning();
-  const repairPending = !!useStore.getState().proxyState.needsPrivilegedRepair;
+  const repairPending = !!useStore.getState().proxyState.needsPrivilegedRepair || !!privilegedWorkPending;
   if (alreadyRunning && !repairPending) {
     const { probeProxyReachability: probeProxyReachability2 } = await __vitePreload(async () => {
       const { probeProxyReachability: probeProxyReachability3 } = await Promise.resolve().then(() => dnsPlatform);
@@ -51751,11 +51778,13 @@ async function handleStartProxy() {
         });
         if (!sudoResult.success) {
           privilegedFailure = sudoResult.error || "unknown error";
+          privilegedWorkPending = privilegedFailure;
           console.error(
             `[Proxy] privileged setup failed (continuing degraded — Caddy still starts): ${privilegedFailure}`
           );
         } else {
           console.log("[Proxy] sudo setup result: success");
+          privilegedWorkPending = null;
           const resolverAudit = await auditResolverState().catch(() => null);
           if (resolverAudit && resolverAudit.in_sync === false && resolverAudit.missing.length > 0) {
             privilegedFailure = `DNS resolver files missing after privileged setup: ${resolverAudit.missing.join(", ")}`;
@@ -51764,6 +51793,7 @@ async function handleStartProxy() {
       }
     } catch (privErr) {
       privilegedFailure = privErr?.message || String(privErr);
+      privilegedWorkPending = privilegedFailure;
       console.error(
         "[Proxy] privileged setup threw (continuing degraded — Caddy still starts):",
         privilegedFailure
@@ -51921,6 +51951,75 @@ async function repairPortForwarding(opts) {
   await clearProxyFaultIfHealthy("a confirmed pf repair");
   return { ok: true, enforced: true };
 }
+async function reapplyPfAnchorIfDrifted(reason) {
+  const store2 = useStore.getState();
+  const { httpPort, httpsPort, lanSharing } = store2.settings;
+  const desired = buildPfAnchor({
+    httpPort,
+    httpsPort,
+    lanSharing,
+    lanInterfaces: lanSharing ? getLanInterfaces() : []
+  });
+  let actual = null;
+  try {
+    actual = fsSync.readFileSync("/etc/pf.anchors/virtual.localhost", "utf-8");
+  } catch {
+    actual = null;
+  }
+  let pfConf = "";
+  try {
+    pfConf = fsSync.readFileSync("/etc/pf.conf", "utf-8");
+  } catch {
+    pfConf = "";
+  }
+  if (!pfConf.includes("virtual.localhost")) return { ok: true, outcome: "not-configured" };
+  if (!pfAnchorDrifted(desired, actual)) return { ok: true, outcome: "no-drift" };
+  console.log(`[Proxy] pf anchor is out of date (${reason}) — rewriting`);
+  const tmpSuffix = `${process.pid}-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
+  const tmpAnchor = path.join(os$1.tmpdir(), `supbuddy-pf-anchor-${tmpSuffix}`);
+  const tmpValidation = path.join(os$1.tmpdir(), `supbuddy-pf-validate-${tmpSuffix}`);
+  fsSync.writeFileSync(tmpAnchor, desired);
+  try {
+    const { content: correctedPfConf } = buildCorrectedPfConf(pfConf);
+    fsSync.writeFileSync(tmpValidation, buildValidationPfConf(correctedPfConf, tmpAnchor));
+    try {
+      child_process.execSync(`pfctl -nf "${tmpValidation}"`, { stdio: "pipe" });
+    } catch (validationErr) {
+      const stderr = (validationErr?.stderr?.toString() ?? "").trim();
+      if (isPfRulesetRejection(validationErr, stderr)) {
+        console.error(`[Proxy] refusing to install pf anchor — ruleset rejected: ${stderr}`);
+        return { ok: false, outcome: "invalid", error: stderr || "pf rejected the generated ruleset" };
+      }
+    }
+    if (!process.send) return { ok: false, outcome: "no-bridge", error: "no host bridge in this process" };
+    const res = await defaultElevate$1({
+      command: `cp ${JSON.stringify(tmpAnchor)} /etc/pf.anchors/virtual.localhost && ${buildPfLoadCommand({ restoreBackupOnFailure: false })}`,
+      prompt: "Supbuddy needs to update its port-forwarding rules."
+    }).catch((e) => ({ success: false, error: e instanceof Error ? e.message : String(e) }));
+    if (!res.success) {
+      console.warn(`[Proxy] pf anchor rewrite failed: ${res.error ?? "unknown error"}`);
+      return { ok: false, outcome: "failed", error: res.error };
+    }
+    let after = null;
+    try {
+      after = fsSync.readFileSync("/etc/pf.anchors/virtual.localhost", "utf-8");
+    } catch {
+      after = null;
+    }
+    if (pfAnchorDrifted(desired, after)) {
+      return { ok: false, outcome: "failed", error: "the elevated write reported success but the anchor on disk is unchanged" };
+    }
+    console.log("[Proxy] pf anchor rewritten and reloaded");
+    return { ok: true, outcome: "applied" };
+  } finally {
+    for (const f2 of [tmpAnchor, tmpValidation]) {
+      try {
+        fsSync.unlinkSync(f2);
+      } catch {
+      }
+    }
+  }
+}
 async function clearProxyFaultIfHealthy(reason) {
   const store2 = useStore.getState();
   if (store2.proxyState.status !== "error") return;
@@ -54588,6 +54687,10 @@ async function init() {
       process.exit(0);
     }
   };
+  try {
+    process.send?.({ type: "host-bridge:owner?" });
+  } catch {
+  }
   process.on("SIGINT", () => cleanup());
   process.on("SIGTERM", () => cleanup());
   shutdownHandler = async () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "supbuddy",
-  "version": "3.1.17",
+  "version": "3.1.22",
   "description": "Run multiple Supabase projects at once on custom local domains with HTTPS. A headless CLI and daemon (proxy, DNS, Supabase/Compose lifecycle, MCP) for macOS and Linux.",
   "keywords": [
     "supabase",