unplugin-https-reverse-proxy 4.0.4 → 4.1.0-beta.10

package/dist/webpack.cjs

@@ -36,486 +36,30 @@ module.exports = __toCommonJS(webpack_exports);
 var import_unplugin2 = require("unplugin");
 
 // src/index.ts
-var import_node_process5 = __toESM(require("process"), 1);
+var import_node_process9 = __toESM(require("process"), 1);
 var import_console_table_printer = require("console-table-printer");
 var import_picocolors2 = __toESM(require("picocolors"), 1);
 var import_unplugin = require("unplugin");
 
 // src/caddy/index.ts
-var import_node_child_process4 = require("child_process");
-var import_node_fs3 = require("fs");
-var import_promises3 = require("fs/promises");
-var import_node_os3 = require("os");
-var import_node_path3 = require("path");
-var import_node_process4 = __toESM(require("process"), 1);
-
-// node_modules/.pnpm/alien-signals@2.0.7/node_modules/alien-signals/esm/system.mjs
-var ReactiveFlags;
-(function(ReactiveFlags2) {
-  ReactiveFlags2[ReactiveFlags2["None"] = 0] = "None";
-  ReactiveFlags2[ReactiveFlags2["Mutable"] = 1] = "Mutable";
-  ReactiveFlags2[ReactiveFlags2["Watching"] = 2] = "Watching";
-  ReactiveFlags2[ReactiveFlags2["RecursedCheck"] = 4] = "RecursedCheck";
-  ReactiveFlags2[ReactiveFlags2["Recursed"] = 8] = "Recursed";
-  ReactiveFlags2[ReactiveFlags2["Dirty"] = 16] = "Dirty";
-  ReactiveFlags2[ReactiveFlags2["Pending"] = 32] = "Pending";
-})(ReactiveFlags || (ReactiveFlags = {}));
-function createReactiveSystem({ update, notify: notify2, unwatched }) {
-  let currentVersion = 0;
-  return {
-    link: link2,
-    unlink: unlink4,
-    propagate: propagate2,
-    checkDirty: checkDirty2,
-    endTracking: endTracking2,
-    startTracking: startTracking2,
-    shallowPropagate: shallowPropagate2
-  };
-  function link2(dep, sub) {
-    const prevDep = sub.depsTail;
-    if (prevDep !== void 0 && prevDep.dep === dep) {
-      return;
-    }
-    const nextDep = prevDep !== void 0 ? prevDep.nextDep : sub.deps;
-    if (nextDep !== void 0 && nextDep.dep === dep) {
-      nextDep.version = currentVersion;
-      sub.depsTail = nextDep;
-      return;
-    }
-    const prevSub = dep.subsTail;
-    if (prevSub !== void 0 && prevSub.version === currentVersion && prevSub.sub === sub) {
-      return;
-    }
-    const newLink = sub.depsTail = dep.subsTail = {
-      version: currentVersion,
-      dep,
-      sub,
-      prevDep,
-      nextDep,
-      prevSub,
-      nextSub: void 0
-    };
-    if (nextDep !== void 0) {
-      nextDep.prevDep = newLink;
-    }
-    if (prevDep !== void 0) {
-      prevDep.nextDep = newLink;
-    } else {
-      sub.deps = newLink;
-    }
-    if (prevSub !== void 0) {
-      prevSub.nextSub = newLink;
-    } else {
-      dep.subs = newLink;
-    }
-  }
-  function unlink4(link3, sub = link3.sub) {
-    const dep = link3.dep;
-    const prevDep = link3.prevDep;
-    const nextDep = link3.nextDep;
-    const nextSub = link3.nextSub;
-    const prevSub = link3.prevSub;
-    if (nextDep !== void 0) {
-      nextDep.prevDep = prevDep;
-    } else {
-      sub.depsTail = prevDep;
-    }
-    if (prevDep !== void 0) {
-      prevDep.nextDep = nextDep;
-    } else {
-      sub.deps = nextDep;
-    }
-    if (nextSub !== void 0) {
-      nextSub.prevSub = prevSub;
-    } else {
-      dep.subsTail = prevSub;
-    }
-    if (prevSub !== void 0) {
-      prevSub.nextSub = nextSub;
-    } else if ((dep.subs = nextSub) === void 0) {
-      unwatched(dep);
-    }
-    return nextDep;
-  }
-  function propagate2(link3) {
-    let next2 = link3.nextSub;
-    let stack;
-    top:
-      do {
-        const sub = link3.sub;
-        let flags = sub.flags;
-        if (!(flags & 60)) {
-          sub.flags = flags | 32;
-        } else if (!(flags & 12)) {
-          flags = 0;
-        } else if (!(flags & 4)) {
-          sub.flags = flags & ~8 | 32;
-        } else if (!(flags & 48) && isValidLink(link3, sub)) {
-          sub.flags = flags | 40;
-          flags &= 1;
-        } else {
-          flags = 0;
-        }
-        if (flags & 2) {
-          notify2(sub);
-        }
-        if (flags & 1) {
-          const subSubs = sub.subs;
-          if (subSubs !== void 0) {
-            const nextSub = (link3 = subSubs).nextSub;
-            if (nextSub !== void 0) {
-              stack = { value: next2, prev: stack };
-              next2 = nextSub;
-            }
-            continue;
-          }
-        }
-        if ((link3 = next2) !== void 0) {
-          next2 = link3.nextSub;
-          continue;
-        }
-        while (stack !== void 0) {
-          link3 = stack.value;
-          stack = stack.prev;
-          if (link3 !== void 0) {
-            next2 = link3.nextSub;
-            continue top;
-          }
-        }
-        break;
-      } while (true);
-  }
-  function startTracking2(sub) {
-    ++currentVersion;
-    sub.depsTail = void 0;
-    sub.flags = sub.flags & ~56 | 4;
-  }
-  function endTracking2(sub) {
-    const depsTail = sub.depsTail;
-    let toRemove = depsTail !== void 0 ? depsTail.nextDep : sub.deps;
-    while (toRemove !== void 0) {
-      toRemove = unlink4(toRemove, sub);
-    }
-    sub.flags &= ~4;
-  }
-  function checkDirty2(link3, sub) {
-    let stack;
-    let checkDepth = 0;
-    top:
-      do {
-        const dep = link3.dep;
-        const flags = dep.flags;
-        let dirty = false;
-        if (sub.flags & 16) {
-          dirty = true;
-        } else if ((flags & 17) === 17) {
-          if (update(dep)) {
-            const subs = dep.subs;
-            if (subs.nextSub !== void 0) {
-              shallowPropagate2(subs);
-            }
-            dirty = true;
-          }
-        } else if ((flags & 33) === 33) {
-          if (link3.nextSub !== void 0 || link3.prevSub !== void 0) {
-            stack = { value: link3, prev: stack };
-          }
-          link3 = dep.deps;
-          sub = dep;
-          ++checkDepth;
-          continue;
-        }
-        if (!dirty) {
-          const nextDep = link3.nextDep;
-          if (nextDep !== void 0) {
-            link3 = nextDep;
-            continue;
-          }
-        }
-        while (checkDepth--) {
-          const firstSub = sub.subs;
-          const hasMultipleSubs = firstSub.nextSub !== void 0;
-          if (hasMultipleSubs) {
-            link3 = stack.value;
-            stack = stack.prev;
-          } else {
-            link3 = firstSub;
-          }
-          if (dirty) {
-            if (update(sub)) {
-              if (hasMultipleSubs) {
-                shallowPropagate2(firstSub);
-              }
-              sub = link3.sub;
-              continue;
-            }
-          } else {
-            sub.flags &= ~32;
-          }
-          sub = link3.sub;
-          const nextDep = link3.nextDep;
-          if (nextDep !== void 0) {
-            link3 = nextDep;
-            continue top;
-          }
-          dirty = false;
-        }
-        return dirty;
-      } while (true);
-  }
-  function shallowPropagate2(link3) {
-    do {
-      const sub = link3.sub;
-      const flags = sub.flags;
-      if ((flags & 48) === 32) {
-        sub.flags = flags | 16;
-        if (flags & 2) {
-          notify2(sub);
-        }
-      }
-    } while ((link3 = link3.nextSub) !== void 0);
-  }
-  function isValidLink(checkLink, sub) {
-    let link3 = sub.depsTail;
-    while (link3 !== void 0) {
-      if (link3 === checkLink) {
-        return true;
-      }
-      link3 = link3.prevDep;
-    }
-    return false;
-  }
-}
-
-// node_modules/.pnpm/alien-signals@2.0.7/node_modules/alien-signals/esm/index.mjs
-var queuedEffects = [];
-var { link, unlink, propagate, checkDirty, endTracking, startTracking, shallowPropagate } = createReactiveSystem({
-  update(signal2) {
-    if ("getter" in signal2) {
-      return updateComputed(signal2);
-    } else {
-      return updateSignal(signal2, signal2.value);
-    }
-  },
-  notify,
-  unwatched(node2) {
-    if ("getter" in node2) {
-      let toRemove = node2.deps;
-      if (toRemove !== void 0) {
-        node2.flags = 17;
-        do {
-          toRemove = unlink(toRemove, node2);
-        } while (toRemove !== void 0);
-      }
-    } else if (!("previousValue" in node2)) {
-      effectOper.call(node2);
-    }
-  }
-});
-var batchDepth = 0;
-var notifyIndex = 0;
-var queuedEffectsLength = 0;
-var activeSub;
-var activeScope;
-function setCurrentSub(sub) {
-  const prevSub = activeSub;
-  activeSub = sub;
-  return prevSub;
-}
-function signal(initialValue) {
-  return signalOper.bind({
-    previousValue: initialValue,
-    value: initialValue,
-    subs: void 0,
-    subsTail: void 0,
-    flags: 1
-  });
-}
-function computed(getter) {
-  return computedOper.bind({
-    value: void 0,
-    subs: void 0,
-    subsTail: void 0,
-    deps: void 0,
-    depsTail: void 0,
-    flags: 17,
-    getter
-  });
-}
-function effect(fn) {
-  const e = {
-    fn,
-    subs: void 0,
-    subsTail: void 0,
-    deps: void 0,
-    depsTail: void 0,
-    flags: 2
-  };
-  if (activeSub !== void 0) {
-    link(e, activeSub);
-  } else if (activeScope !== void 0) {
-    link(e, activeScope);
-  }
-  const prev = setCurrentSub(e);
-  try {
-    e.fn();
-  } finally {
-    setCurrentSub(prev);
-  }
-  return effectOper.bind(e);
-}
-function updateComputed(c3) {
-  const prevSub = setCurrentSub(c3);
-  startTracking(c3);
-  try {
-    const oldValue = c3.value;
-    return oldValue !== (c3.value = c3.getter(oldValue));
-  } finally {
-    setCurrentSub(prevSub);
-    endTracking(c3);
-  }
-}
-function updateSignal(s, value2) {
-  s.flags = 1;
-  return s.previousValue !== (s.previousValue = value2);
-}
-function notify(e) {
-  const flags = e.flags;
-  if (!(flags & 64)) {
-    e.flags = flags | 64;
-    const subs = e.subs;
-    if (subs !== void 0) {
-      notify(subs.sub);
-    } else {
-      queuedEffects[queuedEffectsLength++] = e;
-    }
-  }
-}
-function run(e, flags) {
-  if (flags & 16 || flags & 32 && checkDirty(e.deps, e)) {
-    const prev = setCurrentSub(e);
-    startTracking(e);
-    try {
-      e.fn();
-    } finally {
-      setCurrentSub(prev);
-      endTracking(e);
-    }
-    return;
-  } else if (flags & 32) {
-    e.flags = flags & ~32;
-  }
-  let link2 = e.deps;
-  while (link2 !== void 0) {
-    const dep = link2.dep;
-    const depFlags = dep.flags;
-    if (depFlags & 64) {
-      run(dep, dep.flags = depFlags & ~64);
-    }
-    link2 = link2.nextDep;
-  }
-}
-function flush() {
-  while (notifyIndex < queuedEffectsLength) {
-    const effect2 = queuedEffects[notifyIndex];
-    queuedEffects[notifyIndex++] = void 0;
-    run(effect2, effect2.flags &= ~64);
-  }
-  notifyIndex = 0;
-  queuedEffectsLength = 0;
-}
-function computedOper() {
-  const flags = this.flags;
-  if (flags & 16 || flags & 32 && checkDirty(this.deps, this)) {
-    if (updateComputed(this)) {
-      const subs = this.subs;
-      if (subs !== void 0) {
-        shallowPropagate(subs);
-      }
-    }
-  } else if (flags & 32) {
-    this.flags = flags & ~32;
-  }
-  if (activeSub !== void 0) {
-    link(this, activeSub);
-  } else if (activeScope !== void 0) {
-    link(this, activeScope);
-  }
-  return this.value;
-}
-function signalOper(...value2) {
-  if (value2.length) {
-    if (this.value !== (this.value = value2[0])) {
-      this.flags = 17;
-      const subs = this.subs;
-      if (subs !== void 0) {
-        propagate(subs);
-        if (!batchDepth) {
-          flush();
-        }
-      }
-    }
-  } else {
-    const value3 = this.value;
-    if (this.flags & 16) {
-      if (updateSignal(this, value3)) {
-        const subs = this.subs;
-        if (subs !== void 0) {
-          shallowPropagate(subs);
-        }
-      }
-    }
-    if (activeSub !== void 0) {
-      link(this, activeSub);
-    }
-    return value3;
-  }
-}
-function effectOper() {
-  let dep = this.deps;
-  while (dep !== void 0) {
-    dep = unlink(dep, this);
-  }
-  const sub = this.subs;
-  if (sub !== void 0) {
-    unlink(sub);
-  }
-  this.flags = 0;
-}
-
-// src/caddy/index.ts
+var import_node_child_process3 = require("child_process");
+var import_node_fs4 = require("fs");
+var import_promises2 = require("fs/promises");
+var import_node_os5 = require("os");
+var import_node_path5 = require("path");
+var import_node_process8 = __toESM(require("process"), 1);
 var import_got_cjs = require("got-cjs");
 var import_http_proxy_agent = require("http-proxy-agent");
 var import_https_proxy_agent = require("https-proxy-agent");
-var lockfile = __toESM(require("proper-lockfile"), 1);
-
-// src/host/index.ts
-var import_node_child_process2 = require("child_process");
-var import_node_fs = require("fs");
-var import_node_process2 = __toESM(require("process"), 1);
-var import_node_util = require("util");
-var import_hostile = __toESM(require("hostile"), 1);
 
 // src/utils.ts
-var import_node_child_process = require("child_process");
-var import_promises = require("fs/promises");
 var import_node_os = require("os");
-var import_node_path = __toESM(require("path"), 1);
-var import_node_process = __toESM(require("process"), 1);
 var import_consola = require("consola");
 var import_picocolors = __toESM(require("picocolors"), 1);
 var import_qrcode_terminal = __toESM(require("qrcode-terminal"), 1);
 var consola = (0, import_consola.createConsola)({
   level: 3
 }).withTag("reverse-proxy");
-async function chmodRecursive(_path, mode) {
-  await (0, import_promises.chmod)(_path, mode);
-  if ((await (0, import_promises.stat)(_path)).isDirectory()) {
-    const children = await (0, import_promises.readdir)(_path);
-    for (const child of children)
-      await chmodRecursive(import_node_path.default.join(_path, child), mode);
-  }
-}
 function once(fn) {
   let called = false;
   return (...args2) => {
@@ -525,18 +69,6 @@ function once(fn) {
     return fn(...args2);
   };
 }
-function isAdmin() {
-  if (import_node_process.default.platform === "win32") {
-    try {
-      (0, import_node_child_process.execSync)("net session", { stdio: "ignore" });
-      return true;
-    } catch {
-      return false;
-    }
-  } else {
-    return !!(import_node_process.default.getuid && import_node_process.default.getuid() === 0);
-  }
-}
 function getIpv4List() {
   const interfaces = (0, import_node_os.networkInterfaces)();
   return Object.values(interfaces).flatMap((nInterface) => nInterface ?? []).filter(
@@ -551,44 +83,6 @@ async function generateQrcode(input) {
   });
 }
 
-// src/host/index.ts
-var _setHost = (0, import_node_util.promisify)(import_hostile.default.set);
-var _removeHost = (0, import_node_util.promisify)(import_hostile.default.remove);
-function getPathOfSystemHostsPath() {
-  return import_node_process2.default.platform === "win32" ? `${import_node_process2.default.env.windir || "C:\\WINDOWS"}\\system32\\drivers\\etc\\hosts` : "/etc/hosts";
-}
-async function syncHost() {
-  return new Promise((resolve2, _reject) => {
-    (0, import_node_child_process2.exec)(
-      import_node_process2.default.platform === "win32" ? "ipconfig /flushdns" : "sudo -E killall -HUP mDNSResponder",
-      (error, _stdout, _stderr) => {
-        if (error) {
-          consola.error(`exec error: ${error}`);
-          return resolve2(false);
-        }
-        return resolve2(true);
-      }
-    );
-  });
-}
-async function addHost(ip2, host) {
-  if (import_node_process2.default.platform !== "win32")
-    (0, import_node_fs.chmodSync)(getPathOfSystemHostsPath(), 511);
-  await _setHost("127.0.0.1", "localhost");
-  await _setHost(ip2, host);
-  if (ip2 === "localhost")
-    await _setHost("127.0.0.1", host);
-  return await syncHost();
-}
-async function removeHost(ip2, host) {
-  if (import_node_process2.default.platform !== "win32")
-    (0, import_node_fs.chmodSync)(getPathOfSystemHostsPath(), 511);
-  await _removeHost(ip2, host);
-  if (ip2 === "localhost")
-    await _removeHost("127.0.0.1", host);
-  return await syncHost();
-}
-
 // node_modules/.pnpm/@ark+util@0.46.0/node_modules/@ark/util/out/arrays.js
 var liftArray = (data) => Array.isArray(data) ? data : [data];
 var spliterate = (arr, predicate) => {
@@ -1216,29 +710,29 @@ var timeWithUnnecessarySeconds = /:\d\d:00$/;
 var pad = (value2, length) => String(value2).padStart(length, "0");
 
 // node_modules/.pnpm/@ark+util@0.46.0/node_modules/@ark/util/out/path.js
-var appendStringifiedKey = (path2, prop, ...[opts]) => {
+var appendStringifiedKey = (path, prop, ...[opts]) => {
   const stringifySymbol = (opts == null ? void 0 : opts.stringifySymbol) ?? printable;
-  let propAccessChain = path2;
+  let propAccessChain = path;
   switch (typeof prop) {
     case "string":
-      propAccessChain = isDotAccessible(prop) ? path2 === "" ? prop : `${path2}.${prop}` : `${path2}[${JSON.stringify(prop)}]`;
+      propAccessChain = isDotAccessible(prop) ? path === "" ? prop : `${path}.${prop}` : `${path}[${JSON.stringify(prop)}]`;
       break;
     case "number":
-      propAccessChain = `${path2}[${prop}]`;
+      propAccessChain = `${path}[${prop}]`;
       break;
     case "symbol":
-      propAccessChain = `${path2}[${stringifySymbol(prop)}]`;
+      propAccessChain = `${path}[${stringifySymbol(prop)}]`;
       break;
     default:
       if (opts == null ? void 0 : opts.stringifyNonKey)
-        propAccessChain = `${path2}[${opts.stringifyNonKey(prop)}]`;
+        propAccessChain = `${path}[${opts.stringifyNonKey(prop)}]`;
       else {
         throwParseError(`${printable(prop)} must be a PropertyKey or stringifyNonKey must be passed to options`);
       }
   }
   return propAccessChain;
 };
-var stringifyPath = (path2, ...opts) => path2.reduce((s, k) => appendStringifiedKey(s, k, ...opts), "");
+var stringifyPath = (path, ...opts) => path.reduce((s, k) => appendStringifiedKey(s, k, ...opts), "");
 var ReadonlyPath = class extends ReadonlyArray {
   // alternate strategy for caching since the base object is frozen
   cache = {};
@@ -1265,8 +759,8 @@ var ReadonlyPath = class extends ReadonlyArray {
       return this.cache.stringifyAncestors;
     let propString = "";
     const result = [propString];
-    for (const path2 of this) {
-      propString = appendStringifiedKey(propString, path2);
+    for (const path of this) {
+      propString = appendStringifiedKey(propString, path);
       result.push(propString);
     }
     return this.cache.stringifyAncestors = result;
@@ -1859,15 +1353,15 @@ var ArkErrors = class _ArkErrors extends ReadonlyArray {
   /**
    * @internal
    */
-  affectsPath(path2) {
+  affectsPath(path) {
     if (this.length === 0)
       return false;
     return (
       // this would occur if there is an existing error at a prefix of path
       // e.g. the path is ["foo", "bar"] and there is an error at ["foo"]
-      path2.stringifyAncestors().some((s) => s in this.byPath) || // this would occur if there is an existing error at a suffix of path
+      path.stringifyAncestors().some((s) => s in this.byPath) || // this would occur if there is an existing error at a suffix of path
       // e.g. the path is ["foo"] and there is an error at ["foo", "bar"]
-      path2.stringify() in this.byAncestorPath
+      path.stringify() in this.byAncestorPath
     );
   }
   /**
@@ -2074,22 +1568,22 @@ var Traversal = class {
     while (this.queuedMorphs.length) {
       const queuedMorphs = this.queuedMorphs;
       this.queuedMorphs = [];
-      for (const { path: path2, morphs } of queuedMorphs) {
-        if (this.errors.affectsPath(path2))
+      for (const { path, morphs } of queuedMorphs) {
+        if (this.errors.affectsPath(path))
           continue;
-        this.applyMorphsAtPath(path2, morphs);
+        this.applyMorphsAtPath(path, morphs);
       }
     }
   }
-  applyMorphsAtPath(path2, morphs) {
-    const key = path2.at(-1);
+  applyMorphsAtPath(path, morphs) {
+    const key = path.at(-1);
     let parent;
     if (key !== void 0) {
       parent = this.root;
-      for (let pathIndex = 0; pathIndex < path2.length - 1; pathIndex++)
-        parent = parent[path2[pathIndex]];
+      for (let pathIndex = 0; pathIndex < path.length - 1; pathIndex++)
+        parent = parent[path[pathIndex]];
     }
-    this.path = [...path2];
+    this.path = [...path];
     for (const morph of morphs) {
       const morphIsNode = isNode(morph);
       const result = morph(parent === void 0 ? this.root : parent[key], this);
@@ -2459,15 +1953,15 @@ var NodeSelector = {
   normalize: (selector) => typeof selector === "function" ? { boundary: "references", method: "filter", where: selector } : typeof selector === "string" ? isKeyOf(selector, NodeSelector.applyBoundary) ? { method: "filter", boundary: selector } : { boundary: "references", method: "filter", kind: selector } : { boundary: "references", method: "filter", ...selector }
 };
 var writeSelectAssertionMessage = (from, selector) => `${from} had no references matching ${printable(selector)}.`;
-var typePathToPropString = (path2) => stringifyPath(path2, {
+var typePathToPropString = (path) => stringifyPath(path, {
   stringifyNonKey: (node2) => node2.expression
 });
 var referenceMatcher = /"(\$ark\.[^"]+)"/g;
 var compileMeta = (metaJson) => JSON.stringify(metaJson).replaceAll(referenceMatcher, "$1");
-var flatRef = (path2, node2) => ({
-  path: path2,
+var flatRef = (path, node2) => ({
+  path,
   node: node2,
-  propString: typePathToPropString(path2)
+  propString: typePathToPropString(path)
 });
 var flatRefsAreEqual = (l, r) => l.propString === r.propString && l.node.equals(r.node);
 var appendUniqueFlatRefs = (existing, refs) => appendUnique(existing, refs, {
@@ -2503,12 +1997,12 @@ var Disjoint = class _Disjoint extends Array {
   }
   describeReasons() {
     if (this.length === 1) {
-      const { path: path2, l, r } = this[0];
-      const pathString = stringifyPath(path2);
+      const { path, l, r } = this[0];
+      const pathString = stringifyPath(path);
       return writeUnsatisfiableExpressionError(`Intersection${pathString && ` at ${pathString}`} of ${describeReasons(l, r)}`);
     }
     return `The following intersections result in unsatisfiable types:
-\u2022 ${this.map(({ path: path2, l, r }) => `${path2}: ${describeReasons(l, r)}`).join("\n\u2022 ")}`;
+\u2022 ${this.map(({ path, l, r }) => `${path}: ${describeReasons(l, r)}`).join("\n\u2022 ")}`;
   }
   throw() {
     return throwParseError(this.describeReasons());
@@ -3868,10 +3362,10 @@ var BaseRoot = class extends BaseNode {
       });
     });
   }
-  get(...path2) {
-    if (path2[0] === void 0)
+  get(...path) {
+    if (path[0] === void 0)
       return this;
-    return this.$.schema(this.applyStructuralOperation("get", path2));
+    return this.$.schema(this.applyStructuralOperation("get", path));
   }
   extract(r) {
     const rNode = this.$.parseDefinition(r);
@@ -4806,13 +4300,13 @@ var implementation17 = implementNode({
     description: (node2) => node2.distribute((branch) => branch.description, describeBranches),
     expected: (ctx) => {
       const byPath = groupBy(ctx.errors, "propString");
-      const pathDescriptions = Object.entries(byPath).map(([path2, errors]) => {
+      const pathDescriptions = Object.entries(byPath).map(([path, errors]) => {
         const branchesAtPath = [];
         for (const errorAtPath of errors)
           appendUnique(branchesAtPath, errorAtPath.expected);
         const expected = describeBranches(branchesAtPath);
         const actual = errors.every((e) => e.actual === errors[0].actual) ? errors[0].actual : printable(errors[0].data);
-        return `${path2 && `${path2} `}must be ${expected}${actual && ` (was ${actual})`}`;
+        return `${path && `${path} `}must be ${expected}${actual && ` (was ${actual})`}`;
       });
       return describeBranches(pathDescriptions);
     },
@@ -5176,10 +4670,10 @@ var orderCandidates = (candidates, originalBranches) => {
   });
   return viableCandidates;
 };
-var discriminantCaseToNode = (caseDiscriminant, path2, $) => {
+var discriminantCaseToNode = (caseDiscriminant, path, $) => {
   let node2 = caseDiscriminant === "undefined" ? $.node("unit", { unit: void 0 }) : caseDiscriminant === "null" ? $.node("unit", { unit: null }) : caseDiscriminant === "boolean" ? $.units([true, false]) : caseDiscriminant;
-  for (let i = path2.length - 1; i >= 0; i--) {
-    const key = path2[i];
+  for (let i = path.length - 1; i >= 0; i--) {
+    const key = path[i];
     node2 = $.node("intersection", typeof key === "number" ? {
       proto: "Array",
       // create unknown for preceding elements (could be optimized with safe imports)
@@ -5191,7 +4685,7 @@ var discriminantCaseToNode = (caseDiscriminant, path2, $) => {
   }
   return node2;
 };
-var optionallyChainPropString = (path2) => path2.reduce((acc, k) => acc + compileLiteralPropAccess(k, true), "data");
+var optionallyChainPropString = (path) => path.reduce((acc, k) => acc + compileLiteralPropAccess(k, true), "data");
 var serializedTypeOfDescriptions = registeredReference(jsTypeOfDescriptions);
 var serializedPrintable = registeredReference(printable);
 var Union = {
@@ -6149,7 +5643,7 @@ var StructureNode = class extends BaseConstraint {
       return throwParseError(writeInvalidKeysMessage(this.expression, invalidKeys));
     }
   }
-  get(indexer, ...path2) {
+  get(indexer, ...path) {
     var _a4;
     let value2;
     let required = false;
@@ -6186,7 +5680,7 @@ var StructureNode = class extends BaseConstraint {
       }
       return throwParseError(writeInvalidKeysMessage(this.expression, [key]));
     }
-    const result = value2.get(...path2);
+    const result = value2.get(...path);
     return required ? result : result.or($ark.intrinsic.undefined);
   }
   pick(...keys) {
@@ -8912,7 +8406,7 @@ function isIterator(val) {
 function escapeRegex(str) {
   return str.replace(/[-/\\^$*+?.()|[\]{}]/g, "\\$&");
 }
-function promisify2(fn) {
+function promisify(fn) {
   return function(...args2) {
     return new Promise((resolve2, reject2) => {
       fn(...args2, (err, result) => {
@@ -10248,8 +9742,8 @@ function requireResolve(file) {
   const require2 = (0, import_module3.createRequire)(process.cwd() + "/");
   return require2.resolve(file);
 }
-var statAsync = promisify2(import_fs.stat);
-var readFileAsync = promisify2(import_fs.readFile);
+var statAsync = promisify(import_fs.stat);
+var readFileAsync = promisify(import_fs.readFile);
 function exists(filepath) {
   return __awaiter(this, void 0, void 0, function* () {
     try {
@@ -11491,10 +10985,10 @@ var Loader = class {
         yield filepath;
     }
   }
-  dirname(path2) {
+  dirname(path) {
     const fs2 = this.options.fs;
     assert(fs2.dirname, "`fs.dirname` is required for relative reference");
-    return fs2.dirname(path2);
+    return fs2.dirname(path);
   }
   lookupError(file, roots) {
     const err = new Error("ENOENT");
@@ -13445,6 +12939,7 @@ var ProxyType = type({
 });
 var CaddyContext = type({
   caddy_root: "string",
+  admin_socket: "string",
   proxies: ProxyType.array()
 });
 function validateTemplateContext(ctx) {
@@ -13456,6 +12951,8 @@ function validateTemplateContext(ctx) {
 var caddyTemplate = `{
   debug
   auto_https disable_redirects ignore_loaded_certs
+  skip_install_trust
+  admin unix/{{ admin_socket }}
 }
 
 :7601 {
@@ -13536,27 +13033,37 @@ async function genCaddyfile(ctx) {
 }
 
 // src/caddy/config.ts
-var import_node_fs2 = require("fs");
-var import_promises2 = require("fs/promises");
+var import_node_fs = require("fs");
+var import_node_process2 = __toESM(require("process"), 1);
+var lockfile = __toESM(require("proper-lockfile"), 1);
 
 // src/caddy/constants.ts
 var import_node_os2 = __toESM(require("os"), 1);
-var import_node_path2 = require("path");
-var import_node_process3 = __toESM(require("process"), 1);
+var import_node_path = require("path");
+var import_node_process = __toESM(require("process"), 1);
 var import_dotenv_flow = __toESM(require("dotenv-flow"), 1);
 import_dotenv_flow.default.config({
   silent: true
 });
-function resolvePath(path2) {
-  if (path2.startsWith("~"))
-    return (0, import_node_path2.join)(import_node_os2.default.homedir() || "", path2.slice(1));
-  return path2;
-}
-var TEMP_DIR = resolvePath(import_node_process3.default.env.UHRP_CADDY_PATH || import_node_process3.default.env.TEMP || import_node_process3.default.env.TMPDIR || "/tmp");
-var caddyPath = (0, import_node_path2.join)(TEMP_DIR, `caddy${import_node_process3.default.platform === "win32" ? ".exe" : ""}`);
-var caddyFilePath = (0, import_node_path2.join)(TEMP_DIR, "CADDYFILE");
-var caddyConfigPath = (0, import_node_path2.join)(TEMP_DIR, ".CADDYFILE.config.json");
-var caddyLockFilePath = (0, import_node_path2.join)(TEMP_DIR, "caddylock");
+function resolvePath(path) {
+  if (path.startsWith("~"))
+    return (0, import_node_path.join)(import_node_os2.default.homedir() || "", path.slice(1));
+  return path;
+}
+function defaultTempDir() {
+  const fromEnv = import_node_process.default.env.TEMP || import_node_process.default.env.TMPDIR;
+  if (fromEnv)
+    return resolvePath(fromEnv);
+  if (import_node_process.default.platform === "linux")
+    return (0, import_node_path.join)(import_node_process.default.env.XDG_CACHE_HOME || (0, import_node_path.join)(import_node_os2.default.homedir(), ".cache"), "uhrp");
+  return "/tmp";
+}
+var TEMP_DIR = resolvePath(import_node_process.default.env.UHRP_CADDY_PATH || defaultTempDir());
+var caddyPath = (0, import_node_path.join)(TEMP_DIR, `caddy${import_node_process.default.platform === "win32" ? ".exe" : ""}`);
+var caddyFilePath = (0, import_node_path.join)(TEMP_DIR, "CADDYFILE");
+var caddyConfigPath = (0, import_node_path.join)(TEMP_DIR, ".CADDYFILE.config.json");
+var caddyLockFilePath = (0, import_node_path.join)(TEMP_DIR, "caddylock");
+var caddyAdminSocketPath = (0, import_node_path.join)(TEMP_DIR, "caddy-admin.sock");
 var supportList = [
   {
     platform: "dragonfly",
@@ -13669,67 +13176,786 @@ var supportList = [
 ];
 
 // src/caddy/config.ts
-function useCaddyConfig() {
-  const configContentRef = signal("{}");
-  const configJsonRef = computed(() => {
+function isAlive(pid) {
+  if (pid === void 0)
+    return true;
+  try {
+    import_node_process2.default.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function readConfig(path = caddyConfigPath) {
+  if (!(0, import_node_fs.existsSync)(path))
+    return {};
+  let parsed2;
+  try {
+    parsed2 = JSON.parse((0, import_node_fs.readFileSync)(path, "utf-8"));
+  } catch {
+    return {};
+  }
+  const alive = {};
+  for (const [key, entry] of Object.entries(parsed2)) {
+    if (isAlive(entry == null ? void 0 : entry.ownerPid))
+      alive[key] = entry;
+  }
+  return alive;
+}
+function writeConfig(proxies, path = caddyConfigPath) {
+  const content = JSON.stringify(proxies, null, 2);
+  const temp = `${path}.${import_node_process2.default.pid}.tmp`;
+  (0, import_node_fs.writeFileSync)(temp, content);
+  (0, import_node_fs.renameSync)(temp, path);
+}
+function useCaddyConfig(options = {}) {
+  const lock3 = options.lock ?? createFileLock();
+  const configPath = options.configPath ?? caddyConfigPath;
+  async function mutate(apply) {
+    var _a4;
+    const release = await lock3.acquire();
     try {
-      return JSON.parse(configContentRef());
-    } catch {
+      const proxies = readConfig(configPath);
+      apply(proxies);
+      writeConfig(proxies, configPath);
+      await ((_a4 = options.renderCaddyfile) == null ? void 0 : _a4.call(options, proxies));
+      return proxies;
+    } finally {
+      release();
+    }
+  }
+  return {
+    configJsonRef: () => (0, import_node_fs.existsSync)(configPath) ? readConfig(configPath) : void 0,
+    async writeCaddyConfig(_proxies, key) {
+      await mutate((proxies) => {
+        for (const p of _proxies)
+          proxies[routeKey(p, key)] = { ...p, base: normalizeBase(p.base), ownerPid: import_node_process2.default.pid };
+      });
+    },
+    async removeProxy(key) {
+      await mutate((current) => {
+        for (const route of Object.keys(current)) {
+          if (route.endsWith(`#${key}`))
+            delete current[route];
+        }
+      });
+    },
+    readProxies: () => readConfig(configPath),
+    async cleanUp() {
+      removeConfigFile(configPath);
+    }
+  };
+}
+function removeConfigFile(path = caddyConfigPath) {
+  try {
+    if ((0, import_node_fs.existsSync)(path))
+      (0, import_node_fs.unlinkSync)(path);
+  } catch {
+  }
+}
+function normalizeBase(base) {
+  let out = base || "/";
+  if (!out.startsWith("/"))
+    out = `/${out}`;
+  if (out !== "/" && !out.endsWith("/"))
+    out = `${out}/`;
+  return out;
+}
+function routeKey(proxy, ownerKey) {
+  return `${proxy.target}${proxy.portSuffix}${normalizeBase(proxy.base)}#${ownerKey}`;
+}
+function createFileLock() {
+  return {
+    async acquire() {
+      if (!(0, import_node_fs.existsSync)(caddyConfigPath))
+        (0, import_node_fs.writeFileSync)(caddyConfigPath, "{}");
+      const release = await lockfile.lock(caddyConfigPath, {
+        realpath: false,
+        stale: 1e4,
+        retries: { retries: 20, minTimeout: 10, maxTimeout: 100 }
+      });
+      return () => {
+        void release().catch(() => {
+        });
+      };
+    }
+  };
+}
+
+// src/caddy/log.ts
+function isCaddyReloadCancellation(line) {
+  try {
+    const entry = JSON.parse(line);
+    return entry.logger === "tls" && typeof entry.error === "string" && entry.error.endsWith("context canceled");
+  } catch {
+    return false;
+  }
+}
+
+// src/caddy/privileged.ts
+var import_node_buffer2 = require("buffer");
+var import_node_events = require("events");
+var import_node_path4 = require("path");
+var import_node_process7 = __toESM(require("process"), 1);
+var import_node_url = require("url");
+
+// src/privileged/entry.ts
+var import_node_fs2 = require("fs");
+var import_node_path2 = require("path");
+var import_node_process3 = __toESM(require("process"), 1);
+function resolveHelperEntry(options) {
+  const { moduleDir, nodeBin = import_node_process3.default.execPath, exists: exists2 = import_node_fs2.existsSync } = options;
+  for (const name of ["privileged-helper.js", "privileged-helper.cjs", "privileged-helper.mjs"]) {
+    const candidate = findUp(moduleDir, name, exists2);
+    if (candidate)
+      return { entry: nodeBin, args: [candidate] };
+  }
+  const source = findUp(moduleDir, "privileged-helper.ts", exists2);
+  const tsxCli = findUp(moduleDir, "node_modules/tsx/dist/cli.mjs", exists2);
+  if (source && tsxCli)
+    return { entry: nodeBin, args: [tsxCli, source] };
+  throw new Error(`privileged helper entry not found in ${moduleDir}. Build the package first.`);
+}
+function findUp(from, relative, exists2) {
+  let current = from;
+  while (true) {
+    const candidate = (0, import_node_path2.join)(current, relative);
+    if (exists2(candidate))
+      return candidate;
+    const parent = (0, import_node_path2.dirname)(current);
+    if (parent === current)
       return void 0;
+    current = parent;
+  }
+}
+
+// src/privileged/session.ts
+var import_node_buffer = require("buffer");
+var import_node_fs3 = require("fs");
+var import_promises = require("fs/promises");
+var import_node_os4 = require("os");
+var import_node_path3 = require("path");
+var lockfile2 = __toESM(require("proper-lockfile"), 1);
+
+// src/privileged/launch.ts
+var import_node_child_process2 = require("child_process");
+var import_node_crypto = require("crypto");
+var import_node_os3 = require("os");
+var import_node_process6 = __toESM(require("process"), 1);
+
+// src/privileged/client.ts
+var import_node_net = require("net");
+var import_node_process4 = __toESM(require("process"), 1);
+
+// src/privileged/protocol.ts
+function serializeMessage(message) {
+  return `${JSON.stringify(message)}
+`;
+}
+function splitLines(buffer, chunk) {
+  const parts = (buffer + chunk).split("\n");
+  const rest = parts.pop() ?? "";
+  return { lines: parts.filter((line) => line.trim() !== ""), rest };
+}
+function isRecord(value2) {
+  return typeof value2 === "object" && value2 !== null;
+}
+function decodeMessage(line) {
+  let parsed2;
+  try {
+    parsed2 = JSON.parse(line);
+  } catch (error) {
+    return { ok: false, error: `invalid JSON: ${error.message}` };
+  }
+  if (!isRecord(parsed2))
+    return { ok: false, error: "message must be an object" };
+  if (parsed2.type === "event") {
+    if (typeof parsed2.kind !== "string")
+      return { ok: false, error: "event.kind must be a string" };
+    return { ok: true, message: parsed2 };
+  }
+  if (typeof parsed2.id !== "number")
+    return { ok: false, error: "response.id must be a number" };
+  if (parsed2.ok === true)
+    return { ok: true, message: { id: parsed2.id, ok: true, result: parsed2.result } };
+  if (parsed2.ok === false) {
+    const error = isRecord(parsed2.error) ? parsed2.error : {};
+    return {
+      ok: true,
+      message: {
+        id: parsed2.id,
+        ok: false,
+        error: {
+          message: typeof error.message === "string" ? error.message : "helper request failed",
+          code: typeof error.code === "string" ? error.code : void 0
+        }
+      }
+    };
+  }
+  return { ok: false, error: "response.ok must be a boolean" };
+}
+
+// src/privileged/client.ts
+var FORWARDED_ENV_KEYS = [
+  "HOME",
+  "USER",
+  "LOGNAME",
+  "TMPDIR",
+  "HTTP_PROXY",
+  "HTTPS_PROXY",
+  "http_proxy",
+  "https_proxy",
+  "NO_PROXY",
+  "no_proxy"
+];
+function collectForwardedEnv(source = import_node_process4.default.env) {
+  const result = {};
+  for (const key of FORWARDED_ENV_KEYS) {
+    const value2 = source[key];
+    if (typeof value2 === "string" && value2 !== "")
+      result[key] = value2;
+  }
+  return result;
+}
+var HelperConnectionError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "HelperConnectionError";
+  }
+};
+function openSocket(socketPath) {
+  return new Promise((resolve2, reject2) => {
+    const socket = (0, import_node_net.connect)(socketPath);
+    function onConnect() {
+      socket.removeListener("error", onError);
+      resolve2(socket);
     }
-  });
-  function setConfigContent() {
-    if (!(0, import_node_fs2.existsSync)(caddyConfigPath)) {
-      (0, import_node_fs2.writeFileSync)(caddyConfigPath, "{}");
+    function onError(error) {
+      socket.removeListener("connect", onConnect);
+      reject2(error);
     }
+    socket.once("error", onError);
+    socket.once("connect", onConnect);
+  });
+}
+async function connectClient(options) {
+  const {
+    socketPath,
+    token,
+    timeoutMs = 12e4,
+    retryIntervalMs = 100,
+    callTimeoutMs = 3e4
+  } = options;
+  const deadline = Date.now() + timeoutMs;
+  let lastError;
+  while (Date.now() < deadline) {
     try {
-      configContentRef((0, import_node_fs2.readFileSync)(caddyConfigPath, "utf-8"));
-    } catch {
-      configContentRef("");
+      return await handshake(socketPath, token, callTimeoutMs);
+    } catch (error) {
+      lastError = error;
+      const code = lastError.code;
+      if (code === "EACCES" || lastError instanceof HelperConnectionError)
+        throw lastError;
+      await new Promise((resolve2) => setTimeout(resolve2, retryIntervalMs));
     }
   }
-  if (!(0, import_node_fs2.existsSync)(caddyConfigPath)) {
-    (0, import_node_fs2.writeFileSync)(caddyConfigPath, "{}");
-  }
-  const watchCaddyConfig = (0, import_node_fs2.watch)(caddyConfigPath, () => {
-    setConfigContent();
+  throw new HelperConnectionError(
+    `privileged helper is not reachable at ${socketPath}: ${(lastError == null ? void 0 : lastError.message) ?? "timed out"}`
+  );
+}
+function handshake(socketPath, token, callTimeoutMs) {
+  return new Promise((resolve2, reject2) => {
+    void openSocket(socketPath).then((socket) => {
+      let buffer = "";
+      let settled = false;
+      const fail = (error) => {
+        if (settled)
+          return;
+        settled = true;
+        socket.destroy();
+        reject2(error);
+      };
+      const onData = (chunk) => {
+        if (settled)
+          return;
+        const split2 = splitLines(buffer, chunk.toString("utf8"));
+        buffer = split2.rest;
+        const line = split2.lines[0];
+        if (line === void 0)
+          return;
+        let hello;
+        try {
+          hello = JSON.parse(line);
+        } catch (error) {
+          return fail(new HelperConnectionError(`invalid handshake reply: ${error.message}`));
+        }
+        if (hello.type !== "handshake")
+          return fail(new HelperConnectionError("helper did not answer the handshake"));
+        if (!hello.ok)
+          return fail(new HelperConnectionError(hello.reason ?? "helper rejected the handshake"));
+        settled = true;
+        socket.removeListener("data", onData);
+        socket.removeListener("error", onError);
+        const remaining = split2.lines.slice(1);
+        resolve2(createClient(socket, [split2.rest, ...remaining].filter(Boolean).join("\n"), callTimeoutMs));
+      };
+      function onError(error) {
+        fail(error);
+      }
+      socket.on("data", onData);
+      socket.on("error", onError);
+      const greeting = { type: "handshake", token };
+      socket.write(serializeMessage(greeting));
+    }, reject2);
+  });
+}
+function createClient(socket, initialBuffer, callTimeoutMs) {
+  let buffer = initialBuffer;
+  let connected = true;
+  let nextId = 1;
+  const pending = /* @__PURE__ */ new Map();
+  const listeners = /* @__PURE__ */ new Set();
+  socket.on("data", (chunk) => {
+    const split2 = splitLines(buffer, chunk.toString("utf8"));
+    buffer = split2.rest;
+    for (const line of split2.lines) {
+      const decoded = decodeMessage(line);
+      if (!decoded.ok)
+        continue;
+      const message = decoded.message;
+      if (!("id" in message)) {
+        for (const listener of listeners)
+          listener(message);
+        continue;
+      }
+      const entry = pending.get(message.id);
+      if (!entry)
+        continue;
+      pending.delete(message.id);
+      clearTimeout(entry.timer);
+      if (message.ok)
+        entry.resolve(message.result);
+      else
+        entry.reject(new Error(message.error.message));
+    }
   });
-  function writeCaddyConfig(_proxies) {
-    const proxies = configJsonRef() || {};
-    _proxies.forEach((p) => {
-      let base = p.base || "/";
-      if (!base.startsWith("/"))
-        base = `/${base}`;
-      if (base !== "/" && !base.endsWith("/"))
-        base = `${base}/`;
-      const index = `${p.target}${p.portSuffix}${base}`;
-      proxies[index] = { ...p, base };
+  const disconnect = () => {
+    if (!connected)
+      return;
+    connected = false;
+    for (const [id, entry] of pending) {
+      clearTimeout(entry.timer);
+      pending.delete(id);
+      entry.reject(new HelperConnectionError("privileged helper connection closed"));
+    }
+  };
+  socket.on("close", disconnect);
+  socket.on("error", disconnect);
+  function call(method, params) {
+    if (!connected)
+      return Promise.reject(new HelperConnectionError("privileged helper is not connected"));
+    const id = nextId++;
+    const request = { id, method, params };
+    return new Promise((resolve2, reject2) => {
+      const timer = setTimeout(() => {
+        pending.delete(id);
+        reject2(new HelperConnectionError(`privileged helper did not answer "${method}" in time`));
+      }, callTimeoutMs);
+      pending.set(id, { resolve: resolve2, reject: reject2, timer });
+      socket.write(serializeMessage(request));
     });
-    const content = JSON.stringify(proxies, null, 2);
-    configContentRef(content);
-    return (0, import_node_fs2.writeFileSync)(caddyConfigPath, content);
   }
-  async function cleanUp() {
-    await (0, import_promises2.unlink)(caddyConfigPath).catch(() => {
+  return {
+    get connected() {
+      return connected;
+    },
+    call,
+    onEvent(listener) {
+      listeners.add(listener);
+      return () => {
+        listeners.delete(listener);
+      };
+    },
+    async close() {
+      disconnect();
+      socket.destroy();
+    }
+  };
+}
+
+// src/privileged/windows-elevation.ts
+var import_node_child_process = require("child_process");
+var import_node_process5 = __toESM(require("process"), 1);
+function quotePowerShell(value2) {
+  return `'${value2.replace(/'/g, "''")}'`;
+}
+function buildElevationCommand(options) {
+  const argumentList = options.args.map(quotePowerShell).join(",");
+  const parts = [
+    "Start-Process",
+    "-FilePath",
+    quotePowerShell(options.file)
+  ];
+  if (argumentList)
+    parts.push("-ArgumentList", argumentList);
+  if (options.cwd)
+    parts.push("-WorkingDirectory", quotePowerShell(options.cwd));
+  parts.push("-Verb", "RunAs");
+  parts.push("-WindowStyle", "Hidden");
+  return parts.join(" ");
+}
+function spawnElevatedOnWindows(options) {
+  return new Promise((resolve2, reject2) => {
+    const script = buildElevationCommand(options);
+    const child = (0, import_node_child_process.spawn)(
+      "powershell.exe",
+      ["-NoProfile", "-NonInteractive", "-Command", script],
+      { stdio: "ignore", windowsHide: true }
+    );
+    child.once("error", reject2);
+    child.once("exit", (code) => {
+      if (code === 0)
+        return resolve2(child);
+      reject2(new Error(
+        `administrator permission was not granted (PowerShell exited with ${code}). Accept the UAC prompt to let the plugin edit the hosts file and bind ports 80/443.`
+      ));
     });
-    configContentRef("{}");
-    watchCaddyConfig.close();
+  });
+}
+
+// src/privileged/launch.ts
+function createHelperToken() {
+  return (0, import_node_crypto.randomBytes)(24).toString("hex");
+}
+function describePasswordReason(target, https) {
+  const port = https ? "443" : "80";
+  return [
+    `reverse proxy needs administrator permission for ${target}`,
+    `  \xB7 bind port ${port}${https ? ` for https://${target}` : ""}`,
+    `  \xB7 add ${target} to the hosts file`,
+    "",
+    "This is the only prompt; the rest of the dev server keeps running as you.",
+    "Press Ctrl+C at the prompt to skip the proxy and keep the dev server."
+  ];
+}
+async function authenticateSudo(sudoCommand = "sudo", options = {}) {
+  if ((0, import_node_os3.platform)() === "win32")
+    return { ok: true };
+  if ((0, import_node_child_process2.spawnSync)(sudoCommand, ["-n", "true"], { stdio: "ignore" }).status === 0)
+    return { ok: true };
+  if (options.target && !options.quiet) {
+    for (const line of describePasswordReason(options.target, options.https ?? false))
+      import_node_process6.default.stderr.write(`${line}
+`);
+    import_node_process6.default.stderr.write("\n");
   }
-  return {
-    configJsonRef,
-    writeCaddyConfig,
-    cleanUp
+  let interrupted = false;
+  const onSigint = () => {
+    interrupted = true;
+  };
+  import_node_process6.default.on("SIGINT", onSigint);
+  try {
+    const { status, signal } = await runPrompt(sudoCommand);
+    if (status === 0)
+      return { ok: true };
+    const cancelled = interrupted || signal === "SIGINT";
+    return {
+      ok: false,
+      denied: true,
+      message: cancelled ? "administrator permission was cancelled" : "administrator permission is required to edit the hosts file and bind ports 80/443"
+    };
+  } finally {
+    import_node_process6.default.off("SIGINT", onSigint);
+  }
+}
+function runPrompt(sudoCommand) {
+  return new Promise((resolve2) => {
+    const restore = takeBackTerminal();
+    const child = (0, import_node_child_process2.spawn)(sudoCommand, ["-v"], { stdio: "inherit" });
+    const finish = (result) => {
+      restore();
+      resolve2(result);
+    };
+    child.on("error", () => finish({ status: 1, signal: null }));
+    child.on("exit", (status, signal) => finish({ status, signal }));
+  });
+}
+function takeBackTerminal() {
+  const stdin = import_node_process6.default.stdin;
+  if (!stdin.isTTY || typeof stdin.setRawMode !== "function")
+    return () => {
+    };
+  const wasRaw = stdin.isRaw === true;
+  stdin.pause();
+  try {
+    stdin.setRawMode(false);
+  } catch {
+    stdin.resume();
+    return () => {
+    };
+  }
+  return () => {
+    if (wasRaw) {
+      try {
+        stdin.setRawMode(true);
+      } catch {
+      }
+    }
+    stdin.resume();
   };
 }
+var PrivilegeDeniedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PrivilegeDeniedError";
+  }
+};
+async function startPrivilegedHelper(options) {
+  var _a4, _b3;
+  const {
+    socketPath,
+    token,
+    helperEntry,
+    helperArgs = [],
+    sudoCommand = "sudo",
+    skipAuth = false,
+    direct = false,
+    env: env2 = import_node_process6.default.env,
+    log,
+    connectTimeoutMs = 12e4
+  } = options;
+  if (!skipAuth && !direct) {
+    const auth = await authenticateSudo(sudoCommand, options.reason);
+    if (!auth.ok) {
+      const message = auth.message ?? "administrator permission is required";
+      throw auth.denied ? new PrivilegeDeniedError(message) : new Error(message);
+    }
+  }
+  const forwarded = collectForwardedEnv(env2);
+  const forwardedArgs = Object.entries(forwarded).map(([key, value2]) => `${key}=${value2}`);
+  const childArgv = [
+    ...helperArgs,
+    "--socket",
+    socketPath,
+    "--token",
+    token,
+    ...typeof import_node_process6.default.getuid === "function" ? ["--owner-uid", String(import_node_process6.default.getuid())] : [],
+    ...typeof import_node_process6.default.getgid === "function" ? ["--owner-gid", String(import_node_process6.default.getgid())] : [],
+    ...options.caddyStoragePath ? ["--caddy-storage", options.caddyStoragePath] : [],
+    "--caddy",
+    options.caddyBin,
+    "--caddy-config",
+    options.caddyConfigPath,
+    ...options.caddyAdminSocket ? ["--caddy-admin", options.caddyAdminSocket] : []
+  ];
+  let child;
+  if (!direct && (0, import_node_os3.platform)() === "win32") {
+    await spawnElevatedOnWindows({ file: helperEntry, args: childArgv, cwd: import_node_process6.default.cwd() });
+  } else {
+    const command = direct ? helperEntry : sudoCommand;
+    const spawnArgs = direct ? childArgv : ["-n", "env", ...forwardedArgs, helperEntry, ...childArgv];
+    child = (0, import_node_child_process2.spawn)(command, spawnArgs, {
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    (_a4 = child.stdout) == null ? void 0 : _a4.on("data", (data) => log == null ? void 0 : log(data.toString().trimEnd()));
+    (_b3 = child.stderr) == null ? void 0 : _b3.on("data", (data) => log == null ? void 0 : log(data.toString().trimEnd()));
+    const exited = new Promise((resolve2) => child.once("exit", (code) => resolve2(code)));
+    const earlyExit = await Promise.race([
+      exited,
+      new Promise((resolve2) => setTimeout(() => resolve2(void 0), 500))
+    ]);
+    if (earlyExit !== void 0 && earlyExit !== 0) {
+      throw new Error(
+        `privileged helper exited with code ${earlyExit}. Administrator permission was refused, or sudo is not available.`
+      );
+    }
+  }
+  try {
+    const client = await connectClient({ socketPath, token, timeoutMs: connectTimeoutMs });
+    return {
+      client,
+      async close() {
+        await client.close().catch(() => {
+        });
+        child == null ? void 0 : child.unref();
+      }
+    };
+  } catch (error) {
+    try {
+      child == null ? void 0 : child.kill();
+    } catch {
+    }
+    throw error;
+  }
+}
+async function connectExistingHelper(socketPath, token, timeoutMs = 1500) {
+  try {
+    return await connectClient({ socketPath, token, timeoutMs });
+  } catch {
+    return void 0;
+  }
+}
 
-// src/caddy/log.ts
-function isCaddyReloadCancellation(line) {
+// src/privileged/session.ts
+function tokenPath(runtimeDir) {
+  return (0, import_node_path3.join)(runtimeDir, "helper.token");
+}
+function sessionSocketPath(runtimeDir) {
+  if ((0, import_node_os4.platform)() === "win32")
+    return `\\\\.\\pipe\\uhrp-${import_node_buffer.Buffer.from(runtimeDir).toString("hex").slice(0, 40)}`;
+  return (0, import_node_path3.join)(runtimeDir, "helper.sock");
+}
+async function openHelperSession(scope2) {
+  const socketPath = sessionSocketPath(scope2.runtimeDir);
+  const release = await acquireStartLock(scope2.runtimeDir);
   try {
-    const entry = JSON.parse(line);
-    return entry.logger === "tls" && typeof entry.error === "string" && entry.error.endsWith("context canceled");
+    const reused = await tryReuse(socketPath, scope2);
+    if (reused)
+      return reused;
+    return await startNew(socketPath, scope2);
+  } finally {
+    release();
+  }
+}
+async function tryReuse(socketPath, scope2) {
+  if (!(0, import_node_fs3.existsSync)(socketPath) && (0, import_node_os4.platform)() !== "win32")
+    return void 0;
+  const token = await readToken(scope2.runtimeDir);
+  if (!token)
+    return void 0;
+  const reused = await connectExistingHelper(socketPath, token);
+  if (!reused)
+    return void 0;
+  return {
+    client: reused,
+    reused: true,
+    close: async () => {
+      await reused.close();
+    }
+  };
+}
+async function startNew(socketPath, scope2) {
+  const token = createHelperToken();
+  const started = await startPrivilegedHelper({
+    socketPath,
+    token,
+    helperEntry: scope2.helperEntry,
+    helperArgs: scope2.helperArgs,
+    sudoCommand: scope2.sudoCommand,
+    skipAuth: scope2.skipAuth,
+    direct: scope2.direct,
+    env: scope2.env,
+    caddyStoragePath: scope2.caddyStoragePath,
+    caddyBin: scope2.caddyBin,
+    caddyConfigPath: scope2.caddyConfigPath,
+    caddyAdminSocket: scope2.caddyAdminSocket,
+    reason: scope2.reason,
+    log: scope2.log
+  });
+  await writeToken(scope2.runtimeDir, token);
+  return {
+    client: started.client,
+    reused: false,
+    close: async () => {
+      await started.close();
+    }
+  };
+}
+async function acquireStartLock(runtimeDir) {
+  const lockPath = (0, import_node_path3.join)(runtimeDir, "helper.start.lock");
+  try {
+    await (0, import_promises.writeFile)(lockPath, "", { flag: "a" });
   } catch {
-    return false;
   }
+  const release = await lockfile2.lock(lockPath, {
+    realpath: false,
+    stale: 3e4,
+    retries: { retries: 100, minTimeout: 50, maxTimeout: 200 }
+  });
+  return () => {
+    void release().catch(() => {
+    });
+  };
+}
+async function readToken(runtimeDir) {
+  try {
+    const content = await (0, import_promises.readFile)(tokenPath(runtimeDir), "utf8");
+    const token = content.trim();
+    return token === "" ? void 0 : token;
+  } catch {
+    return void 0;
+  }
+}
+async function writeToken(runtimeDir, token) {
+  try {
+    await (0, import_promises.writeFile)(tokenPath(runtimeDir), token, { mode: 384 });
+  } catch {
+  }
+}
+
+// src/caddy/privileged.ts
+var import_meta = {};
+function resolvePrivilegedEnv() {
+  const moduleDir = typeof __dirname === "string" ? __dirname : (0, import_node_path4.dirname)((0, import_node_url.fileURLToPath)(import_meta.url));
+  const resolved = resolveHelperEntry({ moduleDir });
+  return { helperEntry: resolved.entry, helperArgs: resolved.args };
+}
+var HelperCaddyProcess = class extends import_node_events.EventEmitter {
+  constructor(client) {
+    super();
+    this.client = client;
+    this.stdout = new import_node_events.EventEmitter();
+    this.stderr = new import_node_events.EventEmitter();
+    this.finished = false;
+    this.unsubscribe = client.onEvent((event) => this.handleEvent(event));
+  }
+  handleEvent(event) {
+    if (event.type !== "event")
+      return;
+    if (event.kind === "caddy.stdout") {
+      this.stdout.emit("data", import_node_buffer2.Buffer.from(event.data));
+      return;
+    }
+    if (event.kind === "caddy.stderr") {
+      this.stderr.emit("data", import_node_buffer2.Buffer.from(event.data));
+      return;
+    }
+    if (event.kind === "caddy.exit") {
+      this.finished = true;
+      this.emit("exit", event.code, event.signal);
+    }
+  }
+  /** Asks the helper to stop Caddy; the helper also stops it on disconnect. */
+  kill() {
+    this.unsubscribe();
+    if (this.finished)
+      return;
+    this.finished = true;
+    void this.client.call("caddy.stop").catch(() => {
+    });
+  }
+};
+function caddyStoragePath() {
+  return import_node_process7.default.platform === "win32" ? (0, import_node_path4.join)(import_node_process7.default.env.AppData ?? "", "Caddy") : (0, import_node_path4.join)(import_node_process7.default.env.HOME ?? "", "Library/Application Support/Caddy");
+}
+function openPrivilegedSession(runtimeDir, options) {
+  const env2 = resolvePrivilegedEnv();
+  return openHelperSession({
+    runtimeDir,
+    helperEntry: env2.helperEntry,
+    helperArgs: env2.helperArgs,
+    direct: options.direct,
+    // Caddy keeps its PKI under the user's home; the helper runs it as root, so
+    // it must know which tree to hand back afterwards.
+    caddyStoragePath: caddyStoragePath(),
+    // The binary and Caddyfile are fixed here: the privileged helper must never
+    // execute a path supplied over the socket.
+    caddyBin: options.caddyBin,
+    caddyConfigPath: options.caddyConfigPath,
+    caddyAdminSocket: options.caddyAdminSocket,
+    reason: options.reason,
+    log: options.log
+  });
 }
 
 // src/caddy/tls-health.ts
@@ -13814,40 +14040,8 @@ function formatTlsHealthFailure(hostname, result) {
 }
 
 // src/caddy/utils.ts
-var import_node_child_process3 = require("child_process");
-var import_node_net = require("net");
 var import_ora = __toESM(require("ora"), 1);
 var spinner;
-function tryPort(port) {
-  return new Promise((resolve2, _reject) => {
-    try {
-      const server = (0, import_node_net.createServer)().listen(port);
-      server.on("listening", () => {
-        server.close();
-        resolve2(false);
-      });
-      server.on("error", (err) => {
-        if (err.code === "EADDRINUSE")
-          resolve2(true);
-        server.close();
-      });
-    } catch {
-      resolve2(true);
-    }
-  });
-}
-async function kill(port) {
-  return new Promise((resolve2, reject2) => {
-    (0, import_node_child_process3.exec)(`npx @maxbo/free-port ${port} -s`, (err, stdout, _stderr) => {
-      if (err) {
-        reject2(err);
-      } else {
-        consola.log(stdout);
-        resolve2();
-      }
-    });
-  });
-}
 function getNumber(number2) {
   if (number2 <= 0)
     return "0%";
@@ -13886,26 +14080,26 @@ async function download() {
   if (await testCaddy())
     return caddyPath;
   return new Promise((resolve2, reject2) => {
-    if (!(0, import_node_fs3.existsSync)(TEMP_DIR)) {
-      (0, import_node_fs3.mkdirSync)(TEMP_DIR, { recursive: true });
-      (0, import_node_fs3.chmodSync)(TEMP_DIR, 511);
+    if (!(0, import_node_fs4.existsSync)(TEMP_DIR)) {
+      (0, import_node_fs4.mkdirSync)(TEMP_DIR, { recursive: true });
+      (0, import_node_fs4.chmodSync)(TEMP_DIR, 448);
     }
-    const file = (0, import_node_fs3.createWriteStream)(caddyPath);
-    let _platform = (0, import_node_os3.platform)().toString();
+    const file = (0, import_node_fs4.createWriteStream)(caddyPath);
+    let _platform = (0, import_node_os5.platform)().toString();
     _platform === "win32" && (_platform = "windows");
-    let _arch = import_node_process4.default.arch.toString();
+    let _arch = import_node_process8.default.arch.toString();
     _arch === "x64" && (_arch = "amd64");
     const support = supportList.find((item) => item.platform === _platform && item.arch === _arch);
     if (!support)
       return reject2(new Error("not support"));
     const dowmloadLink = `https://caddyserver.com/api/download?os=${support.platform}&arch=${support.arch}&p=github.com%2Fcaddyserver%2Fforwardproxy`;
-    (0, import_node_fs3.existsSync)(caddyPath) && (0, import_node_fs3.unlinkSync)(caddyPath);
-    const httpProxy = import_node_process4.default.env.HTTP_PROXY || import_node_process4.default.env.http_proxy;
-    const httpsProxy = import_node_process4.default.env.HTTPS_PROXY || import_node_process4.default.env.https_proxy;
+    (0, import_node_fs4.existsSync)(caddyPath) && (0, import_node_fs4.unlinkSync)(caddyPath);
+    const httpProxy = import_node_process8.default.env.HTTP_PROXY || import_node_process8.default.env.http_proxy;
+    const httpsProxy = import_node_process8.default.env.HTTPS_PROXY || import_node_process8.default.env.https_proxy;
     const httpAgent = httpProxy ? new import_http_proxy_agent.HttpProxyAgent(httpProxy) : void 0;
     const httpsAgent = httpsProxy ? new import_https_proxy_agent.HttpsProxyAgent(httpsProxy) : void 0;
     const chmodCaddyOnce = once(() => {
-      (0, import_node_fs3.chmodSync)(caddyPath, 511);
+      (0, import_node_fs4.chmodSync)(caddyPath, 493);
     });
     import_got_cjs.got.stream(dowmloadLink, {
       agent: {
@@ -13917,9 +14111,9 @@ async function download() {
       chmodCaddyOnce();
     }).pipe(file).on("finish", () => {
       logProgressOver();
-      if (import_node_process4.default.platform === "win32")
+      if (import_node_process8.default.platform === "win32")
         return resolve2(caddyPath);
-      (0, import_node_fs3.chmodSync)(caddyPath, 511);
+      (0, import_node_fs4.chmodSync)(caddyPath, 493);
       resolve2(caddyPath);
     }).on("error", (err) => {
       reject2(err);
@@ -13927,26 +14121,41 @@ async function download() {
   });
 }
 function testCaddy() {
-  return new Promise((resolve2, reject2) => {
-    if (!(0, import_node_fs3.existsSync)(caddyPath))
-      return resolve2(false);
-    (0, import_node_fs3.chmodSync)(caddyPath, 511);
-    const child = import_node_process4.default.platform === "win32" ? (0, import_node_child_process4.spawn)(caddyPath, []) : (0, import_node_child_process4.spawn)("sudo", ["-E", caddyPath]);
-    child.on("close", () => {
+  return new Promise((resolve2) => {
+    if (!(0, import_node_fs4.existsSync)(caddyPath))
       return resolve2(false);
+    try {
+      (0, import_node_fs4.chmodSync)(caddyPath, 493);
+    } catch {
+    }
+    (0, import_node_child_process3.execFile)(caddyPath, [], { timeout: 1e4 }, (error, stdout) => {
+      if (error && !stdout)
+        return resolve2(false);
+      resolve2(stdout.length > 0);
     });
-    child.on("error", (err) => {
-      return reject2(err);
-    });
-    child.stdout.on("data", (_data) => {
-      return resolve2(true);
-    });
   });
 }
+function caddyRootPath() {
+  return (0, import_node_path5.join)(
+    import_node_process8.default.platform === "win32" ? `${import_node_process8.default.env.AppData}/Caddy` : `${import_node_process8.default.env.HOME}/Library/Application Support/Caddy`,
+    "./pki/authorities/local"
+  );
+}
+async function renderCaddyfile(proxies) {
+  const ctx = validateTemplateContext({
+    caddy_root: caddyRootPath(),
+    admin_socket: caddyAdminSocketPath,
+    proxies: Object.values(proxies)
+  });
+  const content = await genCaddyfile(ctx);
+  const temp = `${caddyFilePath}.${import_node_process8.default.pid}.tmp`;
+  await (0, import_promises2.writeFile)(temp, content);
+  await (0, import_promises2.rename)(temp, caddyFilePath);
+}
 var caddyConfig;
 function getCaddyConfig() {
   if (!caddyConfig) {
-    caddyConfig = useCaddyConfig();
+    caddyConfig = useCaddyConfig({ renderCaddyfile });
   }
   return caddyConfig;
 }
@@ -13961,80 +14170,92 @@ function splitHostPort(addr) {
   }
   return { host: addr.slice(0, lastColon), port: addr.slice(lastColon + 1) };
 }
+var defaultDependencies = {
+  openSession: (runtimeDir, reason) => openPrivilegedSession(runtimeDir, {
+    log: (message) => consola.debug(message),
+    // Both paths are fixed here, before any socket traffic: the privileged
+    // helper must never execute something named in a request.
+    caddyBin: caddyPath,
+    caddyConfigPath: caddyFilePath,
+    caddyAdminSocket: caddyAdminSocketPath,
+    reason
+  }),
+  config: () => getCaddyConfig()
+};
 var CaddyInstant = class {
-  constructor() {
+  constructor(deps = {}) {
     this.inited = false;
     this.stoped = false;
-    /** has locked when start */
-    this.locked = false;
     this._stopEffects = [];
-    testCaddy().then(async () => {
-      this.inited = true;
-    });
-    this.locked = this.checkLock();
+    /** Identifies this instance's routes in the shared config. */
+    this.proxyKey = `${import_node_process8.default.pid}-${Math.random().toString(36).slice(2, 8)}`;
+    this.deps = { ...defaultDependencies, ...deps };
   }
-  checkLock() {
-    if (!(0, import_node_fs3.existsSync)(caddyLockFilePath))
-      (0, import_node_fs3.writeFileSync)(caddyLockFilePath, "");
-    return lockfile.checkSync(caddyLockFilePath);
+  /**
+   * Connects to the privileged helper, starting it once if needed. It is
+   * reused across instances so a second dev server does not ask for a
+   * password again.
+   */
+  async session(reason) {
+    if (this._session && !this._session.client.connected)
+      this._session = void 0;
+    if (!this._session)
+      this._session = await this.deps.openSession(TEMP_DIR, reason);
+    return this._session;
   }
   async getCaddyfile() {
-    if (!(0, import_node_fs3.existsSync)(caddyFilePath)) {
+    if (!(0, import_node_fs4.existsSync)(caddyFilePath)) {
       this.caddyfile = "";
       return "";
     }
-    this.caddyfile = await (0, import_promises3.readFile)(caddyFilePath, "utf-8");
+    this.caddyfile = await (0, import_promises2.readFile)(caddyFilePath, "utf-8");
     return this.caddyfile;
   }
   get caddyRoot() {
-    return (0, import_node_path3.join)(
-      import_node_process4.default.platform === "win32" ? `${import_node_process4.default.env.AppData}/Caddy` : `${import_node_process4.default.env.HOME}/Library/Application Support/Caddy`,
-      "./pki/authorities/local"
-    );
+    return caddyRootPath();
   }
   async writeCaddyfile() {
-    return await (0, import_promises3.writeFile)(caddyFilePath, this.caddyfile || "");
+    return await (0, import_promises2.writeFile)(caddyFilePath, this.caddyfile || "");
   }
   async deleteCaddyfile() {
-    return await (0, import_promises3.unlink)(caddyFilePath);
+    return await (0, import_promises2.unlink)(caddyFilePath);
   }
   async init() {
     await download();
     this.inited = true;
   }
+  /**
+   * Hands the Caddy storage directory back to the developer. Local CA data
+   * created by an earlier root-owned run must stay readable for `tls internal`
+   * to keep serving the same certificate the browser already trusts.
+   */
+  /**
+   * Installs Caddy's local root CA so the browser stops warning about
+   * `tls internal` certificates. Generating the CA and trusting it are separate
+   * steps: a new CA appears whenever the previous one expires or the storage is
+   * replaced, so this runs on every start instead of once.
+   *
+   * The helper owns both the binary path and the command, so nothing here can
+   * be turned into an arbitrary root execution.
+   */
+  async trustLocalCa(session) {
+    try {
+      const result = await session.client.call("ca.trust");
+      if (result.trusted)
+        consola.debug(`Caddy local CA is trusted
+${result.output}`);
+    } catch (error) {
+      consola.warn(
+        `could not install the Caddy root certificate automatically: ${error.message}
+Run \`${caddyPath} trust\` manually if the browser warns about the certificate.`
+      );
+    }
+  }
   async ensureTlsReady(targetHost) {
     const health = await waitForLocalTls(targetHost);
     if (!health.healthy)
       throw new Error(formatTlsHealthFailure(targetHost, health));
   }
-  async updateCaddyfile() {
-    const { configJsonRef } = getCaddyConfig();
-    const proxies = Object.values(configJsonRef() || {});
-    const ctx = validateTemplateContext({
-      caddy_root: this.caddyRoot,
-      proxies
-    });
-    this.caddyfile = await genCaddyfile(ctx);
-    await this.writeCaddyfile();
-  }
-  async stopCaddy() {
-    var _a4;
-    try {
-      await import_got_cjs.got.post("http://127.0.0.1:2019/stop", {
-        headers: {
-          Origin: "http://localhost:2019"
-        },
-        retry: {
-          limit: 0
-        },
-        timeout: {
-          request: 2e3
-        }
-      });
-    } catch {
-    }
-    (_a4 = this._caddyChild) == null ? void 0 : _a4.kill();
-  }
   /**
    * @param source like `127.0.0.1:8080`
    * @param target like `test.abc.com`. And if you provide a port ,it will be ignore.
@@ -14055,10 +14276,10 @@ var CaddyInstant = class {
       await this.init();
     const sourceHost = splitHostPort(source).host;
     const targetHost = splitHostPort(target).host;
-    if (!await addHost(sourceHost, targetHost))
-      throw new Error("update host failed");
+    const session = await this.session({ target: targetHost, https });
+    await session.client.call("hosts.add", { ip: sourceHost, host: targetHost });
     consola.success("update host success\n");
-    const normalizeBase = (b) => {
+    const normalizeBase2 = (b) => {
       let out = b || "/";
       if (!out.startsWith("/"))
         out = `/${out}`;
@@ -14066,7 +14287,7 @@ var CaddyInstant = class {
         out = `${out}/`;
       return out;
     };
-    const baseNormalized = normalizeBase(base);
+    const baseNormalized = normalizeBase2(base);
     const proxies = [
       {
         target: targetHost,
@@ -14077,176 +14298,138 @@ var CaddyInstant = class {
         healthCheck
       }
     ];
-    const { writeCaddyConfig } = getCaddyConfig();
-    writeCaddyConfig(proxies);
-    await this.updateCaddyfile();
-    let skipInitialCaddyfileEffect = true;
-    this._stopEffects.push(
-      effect(() => {
-        getCaddyConfig().configJsonRef();
-        if (skipInitialCaddyfileEffect) {
-          skipInitialCaddyfileEffect = false;
-          return;
-        }
-        void this.updateCaddyfile();
-      })
-    );
-    if (!(0, import_node_fs3.existsSync)(caddyLockFilePath))
-      (0, import_node_fs3.writeFileSync)(caddyLockFilePath, "");
-    if (!this.locked) {
-      if (await tryPort(443))
-        await kill(443);
-      if ((import_node_process4.default.platform === "win32" || !https) && await tryPort(80))
-        await kill(80);
-    }
+    const { writeCaddyConfig } = this.deps.config();
+    await writeCaddyConfig(proxies, this.proxyKey);
+    await session.client.call("port.free", { port: 443 });
+    if (import_node_process8.default.platform === "win32" || !https)
+      await session.client.call("port.free", { port: 80 });
     return new Promise((resolve2, reject2) => {
-      var _a4, _b3;
       let startupCheckStarted = false;
       const resolveWhenReady = async () => {
         if (startupCheckStarted)
           return;
         startupCheckStarted = true;
         try {
-          if (https)
+          if (https) {
+            await this.trustLocalCa(session);
             await this.ensureTlsReady(targetHost);
+          }
           resolve2();
         } catch (error) {
-          if (!this.locked)
-            await this.baseCleanup(restore);
+          await this.baseCleanup(restore);
           reject2(error);
         }
       };
       const setupCleanup = () => {
-        import_node_process4.default.on("SIGINT", async () => {
+        import_node_process8.default.on("SIGINT", async () => {
           if (this.stoped)
             return;
-          import_node_process4.default.stdin.resume();
+          import_node_process8.default.stdin.resume();
           try {
             await this.baseCleanup(restore);
           } finally {
             this.stoped = true;
-            import_node_process4.default.nextTick(() => {
-              import_node_process4.default.exit();
+            import_node_process8.default.nextTick(() => {
+              import_node_process8.default.exit();
             });
           }
         });
-        const originalExit = import_node_process4.default.exit.bind(import_node_process4.default);
-        import_node_process4.default.exit = async (code) => {
-          const port = Number(splitHostPort(source).port);
-          if (!Number.isNaN(port) && await tryPort(port))
-            await kill(port);
-          const pwd = import_node_process4.default.cwd();
-          const viteCacheDir = `${pwd}/node_modules/.vite`;
-          if ((0, import_node_fs3.existsSync)(viteCacheDir))
-            await chmodRecursive(viteCacheDir, 511).catch(() => {
-            });
-          const viteTempCacheDir = `${pwd}/node_modules/.vite-temp`;
-          if ((0, import_node_fs3.existsSync)(viteTempCacheDir))
-            await chmodRecursive(viteTempCacheDir, 511).catch(() => {
-            });
-          const nuxtCacheDir = `${pwd}/.nuxt`;
-          if ((0, import_node_fs3.existsSync)(nuxtCacheDir))
-            await chmodRecursive(nuxtCacheDir, 511).catch(() => {
-            });
-          const webpackCacheDir = `${pwd}/node_modules/.cache`;
-          if ((0, import_node_fs3.existsSync)(webpackCacheDir))
-            await chmodRecursive(webpackCacheDir, 511).catch(() => {
-            });
+        const originalExit = import_node_process8.default.exit.bind(import_node_process8.default);
+        import_node_process8.default.exit = async (code) => {
           if (this.stoped)
             return originalExit(code);
-          import_node_process4.default.stdin.resume();
+          import_node_process8.default.stdin.resume();
           try {
             await this.baseCleanup();
           } finally {
             this.stoped = true;
-            import_node_process4.default.nextTick(() => {
+            import_node_process8.default.nextTick(() => {
               originalExit(code);
             });
           }
         };
       };
-      if (!this.locked) {
-        this._caddyChild = import_node_process4.default.platform !== "win32" ? (0, import_node_child_process4.spawn)("sudo", ["-E", caddyPath, "run", "--config", caddyFilePath, "--watch"]) : (0, import_node_child_process4.spawn)(caddyPath, ["run", "--config", caddyFilePath, "--watch"]);
-        lockfile.lockSync(caddyLockFilePath);
-        this._caddyChild.on("error", (err) => {
-          return reject2(err);
-        });
-        (_a4 = this._caddyChild.stderr) == null ? void 0 : _a4.on("data", async (data) => {
-          const lines = data.toString().split("\n").map((line) => line.trim());
-          for (const line of lines) {
-            showCaddyLog && line && console.info(line);
-            if (isCaddyReloadCancellation(line)) {
-              consola.info("Caddy restarted before TLS issuance completed; retrying.\n");
-              continue;
-            }
-            try {
-              if (line.includes("Error:") || line && JSON.parse(line).level === "error") {
-                if (line.includes("parsing caddyfile tokens")) {
-                  consola.error("Caddyfile syntax error, please contact the author:\n", `${this.caddyfile}
+      setupCleanup();
+      void (async () => {
+        try {
+          const child = new HelperCaddyProcess(session.client);
+          this._caddyChild = child;
+          const started = await session.client.call("caddy.start");
+          child.on("exit", (code) => {
+            if (code !== null && code !== 0)
+              reject2(new Error(`Caddy exited with code ${code}`));
+          });
+          if ((started == null ? void 0 : started.started) === false) {
+            consola.info("Caddy is already running; added this route to it.");
+            void resolveWhenReady();
+            return;
+          }
+          child.stderr.on("data", async (data) => {
+            const lines = data.toString().split("\n").map((line) => line.trim());
+            for (const line of lines) {
+              showCaddyLog && line && console.info(line);
+              if (isCaddyReloadCancellation(line)) {
+                consola.info("Caddy restarted before TLS issuance completed; retrying.\n");
+                continue;
+              }
+              try {
+                if (line.includes("Error:") || line && JSON.parse(line).level === "error") {
+                  if (line.includes("parsing caddyfile tokens")) {
+                    consola.error("Caddyfile syntax error, please contact the author:\n", `${this.caddyfile}
 
 ${line}
 `);
-                  await this.baseCleanup();
-                  import_node_process4.default.exit();
-                } else {
-                  consola.error(`${line}
+                    await this.baseCleanup();
+                    import_node_process8.default.exit();
+                  } else {
+                    consola.error(`${line}
 `);
-                  return reject2(line);
+                    return reject2(line);
+                  }
                 }
+              } catch {
               }
-            } catch {
+              if (line.includes("config file changed"))
+                consola.success("Detect added a new reverse proxy config, restarted.\n");
+              if (line.includes("caddy proxying") || line.includes("serving initial"))
+                void resolveWhenReady();
             }
-            if (line.includes("config file changed"))
-              consola.success("Detect added a new reverse proxy config, restarted.\n");
-            if (line.includes("caddy proxying") || line.includes("serving initial"))
-              void resolveWhenReady();
-          }
-        });
-        (_b3 = this._caddyChild.stdout) == null ? void 0 : _b3.on("data", (_data) => {
-          consola.info(_data.toString());
-          void resolveWhenReady();
-        });
-        setupCleanup();
-      } else {
-        consola.info("Caddy is running in another process.");
-        void (async () => {
-          try {
-            if (https)
-              await this.ensureTlsReady(targetHost);
-            setupCleanup();
-            resolve2();
-          } catch (error) {
-            reject2(error);
-          }
-        })();
-      }
+          });
+          child.stdout.on("data", (data) => {
+            consola.info(data.toString());
+            void resolveWhenReady();
+          });
+        } catch (error) {
+          await this.baseCleanup(restore);
+          reject2(error);
+        }
+      })();
     });
   }
   async baseCleanup(restore = true) {
+    var _a4;
     this._stopEffects.forEach((fn) => fn());
+    this._stopEffects.length = 0;
     try {
-      if (restore && this._source && this._target) {
-        if (await removeHost(splitHostPort(this._source).host, splitHostPort(this._target).host))
-          consola.success("Restore host success.\n");
-        else
-          consola.fail("Restore host failed.\n");
+      if (restore && this._source && this._target && this._session) {
+        const sourceHost = splitHostPort(this._source).host;
+        const targetHost = splitHostPort(this._target).host;
+        await this._session.client.call("hosts.remove", { ip: sourceHost, host: targetHost });
+        if (sourceHost === "localhost")
+          await this._session.client.call("hosts.remove", { ip: "127.0.0.1", host: targetHost });
+        consola.success("Restore host success.\n");
       }
     } catch (e) {
-      consola.error(e);
-      consola.fail("Restore host failed.\n");
+      if (((_a4 = this._session) == null ? void 0 : _a4.client.connected) === false) {
+        consola.debug("hosts entries are restored by the privileged helper on disconnect");
+      } else {
+        consola.error(e);
+        consola.fail("Restore host failed.\n");
+      }
     }
-    if (!this.locked && !this.stoped) {
-      await this.stopCaddy();
+    if (!this.stoped) {
       try {
-        await lockfile.unlock(caddyLockFilePath).catch(() => {
-        });
-        await (0, import_promises3.unlink)(caddyFilePath).catch(() => {
-        });
-        await (0, import_promises3.unlink)(caddyLockFilePath).catch(() => {
-        });
-        if (caddyConfig) {
-          await caddyConfig.cleanUp();
-        }
+        await this.deps.config().removeProxy(this.proxyKey);
       } catch (e) {
         consola.error(e);
       }
@@ -14488,11 +14671,20 @@ var hmrSseBridgeClientScript = `
 })();
 `;
 
+// src/privilege-state.ts
+var denied = false;
+function markPrivilegeDenied() {
+  denied = true;
+}
+function isPrivilegeDenied() {
+  return denied;
+}
+
 // src/index.ts
 var config;
 var caddy;
 var hmrSseBridgeActive = false;
-var cwd = import_node_process5.default.cwd();
+var cwd = import_node_process9.default.cwd();
 function colorUrl(url2) {
   return import_picocolors2.default.green(url2.replace(/:(\d+)\//, (_, port) => `:${import_picocolors2.default.bold(port)}/`));
 }
@@ -14527,16 +14719,27 @@ async function printForwardProxy() {
 }
 var vitePrintUrls = once((options, source, target, base = "/", _printUrls) => {
   _printUrls == null ? void 0 : _printUrls();
+  if (isPrivilegeDenied())
+    return;
   if (caddy)
     return;
-  caddy = new CaddyInstant();
-  caddy.run(source, target, {
+  const instance = new CaddyInstant();
+  caddy = instance;
+  instance.run(source, target, {
     base,
     ...options
   }).then(async () => {
     await printForwardProxy();
     consola.success(`  ${import_picocolors2.default.green("\u279C")}  ${import_picocolors2.default.bold("run caddy reverse proxy success")}: ${colorUrl(`${options.https ? "https" : "http"}://${target}${base}`)}`);
   }).catch((e) => {
+    if (caddy === instance)
+      caddy = void 0;
+    if (e instanceof PrivilegeDeniedError) {
+      markPrivilegeDenied();
+      consola.warn("reverse proxy skipped: administrator permission was not granted.");
+      consola.info("Restart the dev server to enable it again.");
+      return;
+    }
     throw e;
   });
 });
@@ -14557,10 +14760,6 @@ var unpluginFactory = (options) => ({
       } = options;
       if (!enable)
         return;
-      if (!isAdmin()) {
-        consola.warn("please run as administrator");
-        return;
-      }
       if (!target) {
         consola.fail("please provide target");
         return;
@@ -14596,7 +14795,7 @@ var unpluginFactory = (options) => ({
   },
   webpack(compiler) {
     var _a4, _b3, _c2;
-    if (import_node_process5.default.env.NODE_ENV !== "development")
+    if (import_node_process9.default.env.NODE_ENV !== "development")
       return;
     const {
       enable = true,
@@ -14604,10 +14803,6 @@ var unpluginFactory = (options) => ({
     } = options;
     if (!enable)
       return;
-    if (!isAdmin()) {
-      consola.warn("please run as administrator");
-      return;
-    }
     if (!target) {
       consola.fail("please provide target");
       return;
@@ -14621,9 +14816,11 @@ var unpluginFactory = (options) => ({
       port: 8080,
       ...compiler.options.devServer,
       // @ts-expect-error vuecli
-      ...(_a4 = import_node_process5.default.VUE_CLI_SERVICE) == null ? void 0 : _a4.projectOptions.devServer
+      ...(_a4 = import_node_process9.default.VUE_CLI_SERVICE) == null ? void 0 : _a4.projectOptions.devServer
     };
     const source = `${devServer.host}:${devServer.port}`;
+    if (isPrivilegeDenied())
+      return;
     if (caddy)
       return;
     let base = "/";
@@ -14638,15 +14835,16 @@ var unpluginFactory = (options) => ({
     const _close = (_c2 = compiler.close) == null ? void 0 : _c2.bind(compiler);
     if (_close) {
       compiler.close = async (callback) => {
-        import_node_process5.default.on("exit", () => {
+        import_node_process9.default.on("exit", () => {
           _close && _close(callback);
         });
       };
     } else {
       options.https = false;
     }
-    caddy = new CaddyInstant();
-    caddy.run(source, target, {
+    const instance = new CaddyInstant();
+    caddy = instance;
+    instance.run(source, target, {
       base,
       ...options
     }).then(() => {
@@ -14655,12 +14853,20 @@ var unpluginFactory = (options) => ({
         consola.success(`  ${import_picocolors2.default.green("\u279C")}  ${import_picocolors2.default.bold("run caddy reverse proxy success")}: ${colorUrl(`${options.https ? "https" : "http"}://${target}${base}`)}`);
       });
     }).catch((e) => {
+      if (caddy === instance)
+        caddy = void 0;
+      if (e instanceof PrivilegeDeniedError) {
+        markPrivilegeDenied();
+        consola.warn("reverse proxy skipped: administrator permission was not granted.");
+        consola.info("Restart the dev server to enable it again.");
+        return;
+      }
       throw e;
     });
   },
   async rspack(compiler) {
     var _a4, _b3, _c2, _d2;
-    if (import_node_process5.default.env.NODE_ENV !== "development")
+    if (import_node_process9.default.env.NODE_ENV !== "development")
       return;
     const {
       enable = true,
@@ -14668,10 +14874,6 @@ var unpluginFactory = (options) => ({
     } = options;
     if (!enable)
       return;
-    if (!isAdmin()) {
-      consola.warn("please run as administrator");
-      return;
-    }
     if (!target) {
       consola.fail("please provide target");
       return;
@@ -14689,9 +14891,10 @@ var unpluginFactory = (options) => ({
       }))) == null ? void 0 : _b3.content) == null ? void 0 : _c2.server
     };
     const source = `${devServer.host}:${devServer.port}`;
+    if (isPrivilegeDenied())
+      return;
     if (caddy)
       return;
-    caddy = new CaddyInstant();
     let base = "/";
     const publicPath = (_d2 = compiler.options.output) == null ? void 0 : _d2.publicPath;
     if (typeof publicPath === "string" && publicPath) {
@@ -14701,13 +14904,23 @@ var unpluginFactory = (options) => ({
       base = `/${base}`;
     if (base !== "/" && !base.endsWith("/"))
       base = `${base}/`;
-    caddy.run(source, target, {
+    const instance = new CaddyInstant();
+    caddy = instance;
+    instance.run(source, target, {
       base,
       ...options
     }).then(async () => {
       await printForwardProxy();
       consola.success(`  ${import_picocolors2.default.green("\u279C")}  ${import_picocolors2.default.bold("run caddy reverse proxy success")}: ${colorUrl(`${options.https ? "https" : "http"}://${target}${base}`)}`);
     }).catch((e) => {
+      if (caddy === instance)
+        caddy = void 0;
+      if (e instanceof PrivilegeDeniedError) {
+        markPrivilegeDenied();
+        consola.warn("reverse proxy skipped: administrator permission was not granted.");
+        consola.info("Restart the dev server to enable it again.");
+        return;
+      }
       throw e;
     });
   }