unplugin-https-reverse-proxy 4.0.4 → 4.1.0-beta.3

package/dist/{chunk-5R33PUJP.js → chunk-HBXMM25C.js}

@@ -1,29 +1,36 @@
 import {
-  hmrSseBridgeClientScript,
-  setupHmrSseBridge
-} from "./chunk-C5A7XLKL.js";
-import {
-  chmodRecursive,
   consola,
   generateQrcode,
   getIpv4List,
-  isAdmin,
   once
-} from "./chunk-2P7SUCQ3.js";
+} from "./chunk-EY3HXBJ4.js";
+import {
+  hmrSseBridgeClientScript,
+  setupHmrSseBridge
+} from "./chunk-C5A7XLKL.js";
+import {
+  isPrivilegeDenied,
+  markPrivilegeDenied
+} from "./chunk-WOMR3ZLM.js";
+import {
+  decodeMessage,
+  serializeMessage,
+  splitLines
+} from "./chunk-RKHJN6KY.js";
 
 // src/index.ts
-import process5 from "node:process";
+import process8 from "node:process";
 import { Table } from "console-table-printer";
 import c from "picocolors";
 import { createUnplugin } from "unplugin";
 
 // src/caddy/index.ts
-import { spawn } from "node:child_process";
-import { chmodSync as chmodSync2, createWriteStream, existsSync as existsSync3, mkdirSync, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { readFile as readFile2, unlink as unlink3, writeFile } from "node:fs/promises";
-import { platform } from "node:os";
-import { join as join3 } from "node:path";
-import process4 from "node:process";
+import { execFile } from "node:child_process";
+import { chmodSync, createWriteStream, existsSync as existsSync5, mkdirSync, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { readFile as readFile3, unlink as unlink3, writeFile as writeFile2 } from "node:fs/promises";
+import { platform as platform3 } from "node:os";
+import { join as join6 } from "node:path";
+import process7 from "node:process";
 
 // node_modules/.pnpm/alien-signals@2.0.7/node_modules/alien-signals/esm/system.mjs
 var ReactiveFlags;
@@ -465,49 +472,6 @@ import { HttpProxyAgent } from "http-proxy-agent";
 import { HttpsProxyAgent } from "https-proxy-agent";
 import * as lockfile from "proper-lockfile";
 
-// src/host/index.ts
-import { exec } from "node:child_process";
-import { chmodSync } from "node:fs";
-import process2 from "node:process";
-import { promisify } from "node:util";
-import hostile from "hostile";
-var _setHost = promisify(hostile.set);
-var _removeHost = promisify(hostile.remove);
-function getPathOfSystemHostsPath() {
-  return process2.platform === "win32" ? `${process2.env.windir || "C:\\WINDOWS"}\\system32\\drivers\\etc\\hosts` : "/etc/hosts";
-}
-async function syncHost() {
-  return new Promise((resolve2, _reject) => {
-    exec(
-      process2.platform === "win32" ? "ipconfig /flushdns" : "sudo -E killall -HUP mDNSResponder",
-      (error, _stdout, _stderr) => {
-        if (error) {
-          consola.error(`exec error: ${error}`);
-          return resolve2(false);
-        }
-        return resolve2(true);
-      }
-    );
-  });
-}
-async function addHost(ip2, host) {
-  if (process2.platform !== "win32")
-    chmodSync(getPathOfSystemHostsPath(), 511);
-  await _setHost("127.0.0.1", "localhost");
-  await _setHost(ip2, host);
-  if (ip2 === "localhost")
-    await _setHost("127.0.0.1", host);
-  return await syncHost();
-}
-async function removeHost(ip2, host) {
-  if (process2.platform !== "win32")
-    chmodSync(getPathOfSystemHostsPath(), 511);
-  await _removeHost(ip2, host);
-  if (ip2 === "localhost")
-    await _removeHost("127.0.0.1", host);
-  return await syncHost();
-}
-
 // node_modules/.pnpm/@ark+util@0.46.0/node_modules/@ark/util/out/arrays.js
 var liftArray = (data) => Array.isArray(data) ? data : [data];
 var spliterate = (arr, predicate) => {
@@ -8831,7 +8795,7 @@ function isIterator(val) {
 function escapeRegex(str) {
   return str.replace(/[-/\\^$*+?.()|[\]{}]/g, "\\$&");
 }
-function promisify2(fn) {
+function promisify(fn) {
   return function(...args2) {
     return new Promise((resolve2, reject2) => {
       fn(...args2, (err, result) => {
@@ -10167,8 +10131,8 @@ function requireResolve(file) {
   const require2 = createRequire(process.cwd() + "/");
   return require2.resolve(file);
 }
-var statAsync = promisify2(stat);
-var readFileAsync = promisify2(readFile$1);
+var statAsync = promisify(stat);
+var readFileAsync = promisify(readFile$1);
 function exists(filepath) {
   return __awaiter(this, void 0, void 0, function* () {
     try {
@@ -13375,6 +13339,7 @@ function validateTemplateContext(ctx) {
 var caddyTemplate = `{
   debug
   auto_https disable_redirects ignore_loaded_certs
+  skip_install_trust
 }
 
 :7601 {
@@ -13461,7 +13426,7 @@ import { unlink as unlink2 } from "node:fs/promises";
 // src/caddy/constants.ts
 import os from "node:os";
 import { join as join2 } from "node:path";
-import process3 from "node:process";
+import process2 from "node:process";
 import dotenvFlow from "dotenv-flow";
 dotenvFlow.config({
   silent: true
@@ -13471,8 +13436,8 @@ function resolvePath(path) {
     return join2(os.homedir() || "", path.slice(1));
   return path;
 }
-var TEMP_DIR = resolvePath(process3.env.UHRP_CADDY_PATH || process3.env.TEMP || process3.env.TMPDIR || "/tmp");
-var caddyPath = join2(TEMP_DIR, `caddy${process3.platform === "win32" ? ".exe" : ""}`);
+var TEMP_DIR = resolvePath(process2.env.UHRP_CADDY_PATH || process2.env.TEMP || process2.env.TMPDIR || "/tmp");
+var caddyPath = join2(TEMP_DIR, `caddy${process2.platform === "win32" ? ".exe" : ""}`);
 var caddyFilePath = join2(TEMP_DIR, "CADDYFILE");
 var caddyConfigPath = join2(TEMP_DIR, ".CADDYFILE.config.json");
 var caddyLockFilePath = join2(TEMP_DIR, "caddylock");
@@ -13651,8 +13616,542 @@ function isCaddyReloadCancellation(line) {
   }
 }
 
+// src/caddy/privileged.ts
+import { Buffer as Buffer2 } from "node:buffer";
+import { EventEmitter } from "node:events";
+import { dirname as dirname3, join as join5 } from "node:path";
+import process6 from "node:process";
+import { fileURLToPath } from "node:url";
+
+// src/privileged/entry.ts
+import { existsSync as existsSync3 } from "node:fs";
+import { dirname as dirname2, join as join3 } from "node:path";
+import process3 from "node:process";
+function resolveHelperEntry(options) {
+  const { moduleDir, nodeBin = process3.execPath, exists: exists2 = existsSync3 } = options;
+  for (const name of ["privileged-helper.js", "privileged-helper.cjs", "privileged-helper.mjs"]) {
+    const candidate = findUp(moduleDir, name, exists2);
+    if (candidate)
+      return { entry: nodeBin, args: [candidate] };
+  }
+  const source = findUp(moduleDir, "privileged-helper.ts", exists2);
+  const tsxCli = findUp(moduleDir, "node_modules/tsx/dist/cli.mjs", exists2);
+  if (source && tsxCli)
+    return { entry: nodeBin, args: [tsxCli, source] };
+  throw new Error(`privileged helper entry not found in ${moduleDir}. Build the package first.`);
+}
+function findUp(from, relative, exists2) {
+  let current = from;
+  while (true) {
+    const candidate = join3(current, relative);
+    if (exists2(candidate))
+      return candidate;
+    const parent = dirname2(current);
+    if (parent === current)
+      return void 0;
+    current = parent;
+  }
+}
+
+// src/privileged/session.ts
+import { Buffer } from "node:buffer";
+import { existsSync as existsSync4 } from "node:fs";
+import { readFile as readFile2, writeFile } from "node:fs/promises";
+import { platform as platform2 } from "node:os";
+import { join as join4 } from "node:path";
+
+// src/privileged/launch.ts
+import { spawn as spawn2, spawnSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { platform } from "node:os";
+import process5 from "node:process";
+
+// src/privileged/client.ts
+import { connect } from "node:net";
+import process4 from "node:process";
+var FORWARDED_ENV_KEYS = [
+  "HOME",
+  "USER",
+  "LOGNAME",
+  "TMPDIR",
+  "HTTP_PROXY",
+  "HTTPS_PROXY",
+  "http_proxy",
+  "https_proxy",
+  "NO_PROXY",
+  "no_proxy"
+];
+function collectForwardedEnv(source = process4.env) {
+  const result = {};
+  for (const key of FORWARDED_ENV_KEYS) {
+    const value2 = source[key];
+    if (typeof value2 === "string" && value2 !== "")
+      result[key] = value2;
+  }
+  return result;
+}
+var HelperConnectionError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "HelperConnectionError";
+  }
+};
+function openSocket(socketPath) {
+  return new Promise((resolve2, reject2) => {
+    const socket = connect(socketPath);
+    function onConnect() {
+      socket.removeListener("error", onError);
+      resolve2(socket);
+    }
+    function onError(error) {
+      socket.removeListener("connect", onConnect);
+      reject2(error);
+    }
+    socket.once("error", onError);
+    socket.once("connect", onConnect);
+  });
+}
+async function connectClient(options) {
+  const {
+    socketPath,
+    token,
+    timeoutMs = 12e4,
+    retryIntervalMs = 100,
+    callTimeoutMs = 3e4
+  } = options;
+  const deadline = Date.now() + timeoutMs;
+  let lastError;
+  while (Date.now() < deadline) {
+    try {
+      return await handshake(socketPath, token, callTimeoutMs);
+    } catch (error) {
+      lastError = error;
+      const code = lastError.code;
+      if (code === "EACCES" || lastError instanceof HelperConnectionError)
+        throw lastError;
+      await new Promise((resolve2) => setTimeout(resolve2, retryIntervalMs));
+    }
+  }
+  throw new HelperConnectionError(
+    `privileged helper is not reachable at ${socketPath}: ${(lastError == null ? void 0 : lastError.message) ?? "timed out"}`
+  );
+}
+function handshake(socketPath, token, callTimeoutMs) {
+  return new Promise((resolve2, reject2) => {
+    void openSocket(socketPath).then((socket) => {
+      let buffer = "";
+      let settled = false;
+      const fail = (error) => {
+        if (settled)
+          return;
+        settled = true;
+        socket.destroy();
+        reject2(error);
+      };
+      const onData = (chunk) => {
+        if (settled)
+          return;
+        const split2 = splitLines(buffer, chunk.toString("utf8"));
+        buffer = split2.rest;
+        const line = split2.lines[0];
+        if (line === void 0)
+          return;
+        let hello;
+        try {
+          hello = JSON.parse(line);
+        } catch (error) {
+          return fail(new HelperConnectionError(`invalid handshake reply: ${error.message}`));
+        }
+        if (hello.type !== "handshake")
+          return fail(new HelperConnectionError("helper did not answer the handshake"));
+        if (!hello.ok)
+          return fail(new HelperConnectionError(hello.reason ?? "helper rejected the handshake"));
+        settled = true;
+        socket.removeListener("data", onData);
+        socket.removeListener("error", onError);
+        const remaining = split2.lines.slice(1);
+        resolve2(createClient(socket, [split2.rest, ...remaining].filter(Boolean).join("\n"), callTimeoutMs));
+      };
+      function onError(error) {
+        fail(error);
+      }
+      socket.on("data", onData);
+      socket.on("error", onError);
+      const greeting = { type: "handshake", token };
+      socket.write(serializeMessage(greeting));
+    }, reject2);
+  });
+}
+function createClient(socket, initialBuffer, callTimeoutMs) {
+  let buffer = initialBuffer;
+  let connected = true;
+  let nextId = 1;
+  const pending = /* @__PURE__ */ new Map();
+  const listeners = /* @__PURE__ */ new Set();
+  socket.on("data", (chunk) => {
+    const split2 = splitLines(buffer, chunk.toString("utf8"));
+    buffer = split2.rest;
+    for (const line of split2.lines) {
+      const decoded = decodeMessage(line);
+      if (!decoded.ok)
+        continue;
+      const message = decoded.message;
+      if (!("id" in message)) {
+        for (const listener of listeners)
+          listener(message);
+        continue;
+      }
+      const entry = pending.get(message.id);
+      if (!entry)
+        continue;
+      pending.delete(message.id);
+      clearTimeout(entry.timer);
+      if (message.ok)
+        entry.resolve(message.result);
+      else
+        entry.reject(new Error(message.error.message));
+    }
+  });
+  const disconnect = () => {
+    if (!connected)
+      return;
+    connected = false;
+    for (const [id, entry] of pending) {
+      clearTimeout(entry.timer);
+      pending.delete(id);
+      entry.reject(new HelperConnectionError("privileged helper connection closed"));
+    }
+  };
+  socket.on("close", disconnect);
+  socket.on("error", disconnect);
+  function call(method, params) {
+    if (!connected)
+      return Promise.reject(new HelperConnectionError("privileged helper is not connected"));
+    const id = nextId++;
+    const request = { id, method, params };
+    return new Promise((resolve2, reject2) => {
+      const timer = setTimeout(() => {
+        pending.delete(id);
+        reject2(new HelperConnectionError(`privileged helper did not answer "${method}" in time`));
+      }, callTimeoutMs);
+      pending.set(id, { resolve: resolve2, reject: reject2, timer });
+      socket.write(serializeMessage(request));
+    });
+  }
+  return {
+    get connected() {
+      return connected;
+    },
+    call,
+    onEvent(listener) {
+      listeners.add(listener);
+      return () => {
+        listeners.delete(listener);
+      };
+    },
+    async close() {
+      disconnect();
+      socket.destroy();
+    }
+  };
+}
+
+// src/privileged/windows-elevation.ts
+import { spawn } from "node:child_process";
+function quotePowerShell(value2) {
+  return `'${value2.replace(/'/g, "''")}'`;
+}
+function buildElevationCommand(options) {
+  const argumentList = options.args.map(quotePowerShell).join(",");
+  const parts = [
+    "Start-Process",
+    "-FilePath",
+    quotePowerShell(options.file)
+  ];
+  if (argumentList)
+    parts.push("-ArgumentList", argumentList);
+  if (options.cwd)
+    parts.push("-WorkingDirectory", quotePowerShell(options.cwd));
+  parts.push("-Verb", "RunAs");
+  parts.push("-WindowStyle", "Hidden");
+  return parts.join(" ");
+}
+function spawnElevatedOnWindows(options) {
+  return new Promise((resolve2, reject2) => {
+    const script = buildElevationCommand(options);
+    const child = spawn(
+      "powershell.exe",
+      ["-NoProfile", "-NonInteractive", "-Command", script],
+      { stdio: "ignore", windowsHide: true }
+    );
+    child.once("error", reject2);
+    child.once("exit", (code) => {
+      if (code === 0)
+        return resolve2(child);
+      reject2(new Error(
+        `administrator permission was not granted (PowerShell exited with ${code}). Accept the UAC prompt to let the plugin edit the hosts file and bind ports 80/443.`
+      ));
+    });
+  });
+}
+
+// src/privileged/launch.ts
+function createHelperToken() {
+  return randomBytes(24).toString("hex");
+}
+function describePasswordReason(target, https) {
+  const port = https ? "443" : "80";
+  return [
+    `reverse proxy needs administrator permission for ${target}`,
+    `  \xB7 bind port ${port}${https ? ` for https://${target}` : ""}`,
+    `  \xB7 add ${target} to the hosts file`,
+    "",
+    "This is the only prompt; the rest of the dev server keeps running as you.",
+    "Press Ctrl+C at the prompt to skip the proxy and keep the dev server."
+  ];
+}
+function authenticateSudo(sudoCommand = "sudo", options = {}) {
+  if (platform() === "win32")
+    return { ok: true };
+  if (spawnSync(sudoCommand, ["-n", "true"], { stdio: "ignore" }).status === 0)
+    return { ok: true };
+  if (options.target) {
+    for (const line of describePasswordReason(options.target, options.https ?? false))
+      process5.stderr.write(`${line}
+`);
+    process5.stderr.write("\n");
+  }
+  if (spawnSync(sudoCommand, ["-v"], { stdio: "inherit" }).status === 0)
+    return { ok: true };
+  return {
+    ok: false,
+    denied: true,
+    message: "administrator permission is required to edit the hosts file and bind ports 80/443"
+  };
+}
+var PrivilegeDeniedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PrivilegeDeniedError";
+  }
+};
+async function startPrivilegedHelper(options) {
+  var _a4, _b3;
+  const {
+    socketPath,
+    token,
+    helperEntry,
+    helperArgs = [],
+    sudoCommand = "sudo",
+    skipAuth = false,
+    direct = false,
+    env: env2 = process5.env,
+    log,
+    connectTimeoutMs = 12e4
+  } = options;
+  if (!skipAuth && !direct) {
+    const auth = authenticateSudo(sudoCommand, options.reason);
+    if (!auth.ok) {
+      const message = auth.message ?? "administrator permission is required";
+      throw auth.denied ? new PrivilegeDeniedError(message) : new Error(message);
+    }
+  }
+  const forwarded = collectForwardedEnv(env2);
+  const forwardedArgs = Object.entries(forwarded).map(([key, value2]) => `${key}=${value2}`);
+  const childArgv = [
+    ...helperArgs,
+    "--socket",
+    socketPath,
+    "--token",
+    token,
+    ...typeof process5.getuid === "function" ? ["--owner-uid", String(process5.getuid())] : [],
+    ...typeof process5.getgid === "function" ? ["--owner-gid", String(process5.getgid())] : [],
+    ...options.caddyStoragePath ? ["--caddy-storage", options.caddyStoragePath] : [],
+    "--caddy",
+    options.caddyBin,
+    "--caddy-config",
+    options.caddyConfigPath
+  ];
+  let child;
+  if (!direct && platform() === "win32") {
+    await spawnElevatedOnWindows({ file: helperEntry, args: childArgv, cwd: process5.cwd() });
+  } else {
+    const command = direct ? helperEntry : sudoCommand;
+    const spawnArgs = direct ? childArgv : ["-n", "env", ...forwardedArgs, helperEntry, ...childArgv];
+    child = spawn2(command, spawnArgs, {
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    (_a4 = child.stdout) == null ? void 0 : _a4.on("data", (data) => log == null ? void 0 : log(data.toString().trimEnd()));
+    (_b3 = child.stderr) == null ? void 0 : _b3.on("data", (data) => log == null ? void 0 : log(data.toString().trimEnd()));
+    const exited = new Promise((resolve2) => child.once("exit", (code) => resolve2(code)));
+    const earlyExit = await Promise.race([
+      exited,
+      new Promise((resolve2) => setTimeout(() => resolve2(void 0), 500))
+    ]);
+    if (earlyExit !== void 0 && earlyExit !== 0) {
+      throw new Error(
+        `privileged helper exited with code ${earlyExit}. Administrator permission was refused, or sudo is not available.`
+      );
+    }
+  }
+  try {
+    const client = await connectClient({ socketPath, token, timeoutMs: connectTimeoutMs });
+    return {
+      client,
+      async close() {
+        await client.close().catch(() => {
+        });
+        child == null ? void 0 : child.unref();
+      }
+    };
+  } catch (error) {
+    try {
+      child == null ? void 0 : child.kill();
+    } catch {
+    }
+    throw error;
+  }
+}
+async function connectExistingHelper(socketPath, token, timeoutMs = 1500) {
+  try {
+    return await connectClient({ socketPath, token, timeoutMs });
+  } catch {
+    return void 0;
+  }
+}
+
+// src/privileged/session.ts
+function tokenPath(runtimeDir) {
+  return join4(runtimeDir, "helper.token");
+}
+function sessionSocketPath(runtimeDir) {
+  if (platform2() === "win32")
+    return `\\\\.\\pipe\\uhrp-${Buffer.from(runtimeDir).toString("hex").slice(0, 40)}`;
+  return join4(runtimeDir, "helper.sock");
+}
+async function openHelperSession(scope2) {
+  const socketPath = sessionSocketPath(scope2.runtimeDir);
+  if (existsSync4(socketPath) || platform2() === "win32") {
+    const token2 = await readToken(scope2.runtimeDir);
+    if (token2) {
+      const reused = await connectExistingHelper(socketPath, token2);
+      if (reused) {
+        return {
+          client: reused,
+          reused: true,
+          close: async () => {
+            await reused.close();
+          }
+        };
+      }
+    }
+  }
+  const token = createHelperToken();
+  const started = await startPrivilegedHelper({
+    socketPath,
+    token,
+    helperEntry: scope2.helperEntry,
+    helperArgs: scope2.helperArgs,
+    sudoCommand: scope2.sudoCommand,
+    skipAuth: scope2.skipAuth,
+    direct: scope2.direct,
+    env: scope2.env,
+    caddyStoragePath: scope2.caddyStoragePath,
+    caddyBin: scope2.caddyBin,
+    caddyConfigPath: scope2.caddyConfigPath,
+    reason: scope2.reason,
+    log: scope2.log
+  });
+  await writeToken(scope2.runtimeDir, token);
+  return {
+    client: started.client,
+    reused: false,
+    close: async () => {
+      await started.close();
+    }
+  };
+}
+async function readToken(runtimeDir) {
+  try {
+    const content = await readFile2(tokenPath(runtimeDir), "utf8");
+    const token = content.trim();
+    return token === "" ? void 0 : token;
+  } catch {
+    return void 0;
+  }
+}
+async function writeToken(runtimeDir, token) {
+  try {
+    await writeFile(tokenPath(runtimeDir), token, { mode: 384 });
+  } catch {
+  }
+}
+
+// src/caddy/privileged.ts
+function resolvePrivilegedEnv() {
+  const moduleDir = typeof __dirname === "string" ? __dirname : dirname3(fileURLToPath(import.meta.url));
+  const resolved = resolveHelperEntry({ moduleDir });
+  return { helperEntry: resolved.entry, helperArgs: resolved.args };
+}
+var HelperCaddyProcess = class extends EventEmitter {
+  constructor(client) {
+    super();
+    this.client = client;
+    this.stdout = new EventEmitter();
+    this.stderr = new EventEmitter();
+    this.finished = false;
+    this.unsubscribe = client.onEvent((event) => this.handleEvent(event));
+  }
+  handleEvent(event) {
+    if (event.type !== "event")
+      return;
+    if (event.kind === "caddy.stdout") {
+      this.stdout.emit("data", Buffer2.from(event.data));
+      return;
+    }
+    if (event.kind === "caddy.stderr") {
+      this.stderr.emit("data", Buffer2.from(event.data));
+      return;
+    }
+    if (event.kind === "caddy.exit") {
+      this.finished = true;
+      this.emit("exit", event.code, event.signal);
+    }
+  }
+  /** Asks the helper to stop Caddy; the helper also stops it on disconnect. */
+  kill() {
+    this.unsubscribe();
+    if (this.finished)
+      return;
+    this.finished = true;
+    void this.client.call("caddy.stop").catch(() => {
+    });
+  }
+};
+function caddyStoragePath() {
+  return process6.platform === "win32" ? join5(process6.env.AppData ?? "", "Caddy") : join5(process6.env.HOME ?? "", "Library/Application Support/Caddy");
+}
+function openPrivilegedSession(runtimeDir, options) {
+  const env2 = resolvePrivilegedEnv();
+  return openHelperSession({
+    runtimeDir,
+    helperEntry: env2.helperEntry,
+    helperArgs: env2.helperArgs,
+    direct: options.direct,
+    // Caddy keeps its PKI under the user's home; the helper runs it as root, so
+    // it must know which tree to hand back afterwards.
+    caddyStoragePath: caddyStoragePath(),
+    // The binary and Caddyfile are fixed here: the privileged helper must never
+    // execute a path supplied over the socket.
+    caddyBin: options.caddyBin,
+    caddyConfigPath: options.caddyConfigPath,
+    reason: options.reason,
+    log: options.log
+  });
+}
+
 // src/caddy/tls-health.ts
-import { checkServerIdentity, connect } from "node:tls";
+import { checkServerIdentity, connect as connect2 } from "node:tls";
 function assessTlsCertificate(certificate, hostname, now = Date.now(), verifyHostname = checkServerIdentity) {
   if (!certificate.valid_to)
     return { healthy: false, reason: "certificate_missing" };
@@ -13671,7 +14170,7 @@ function assessTlsCertificate(certificate, hostname, now = Date.now(), verifyHos
 }
 function probeLocalTls(hostname, options = {}) {
   const {
-    connect: openTlsConnection = connect,
+    connect: openTlsConnection = connect2,
     port = 443,
     timeoutMs = 1e3
   } = options;
@@ -13733,40 +14232,8 @@ function formatTlsHealthFailure(hostname, result) {
 }
 
 // src/caddy/utils.ts
-import { exec as exec2 } from "node:child_process";
-import { createServer } from "node:net";
 import ora from "ora";
 var spinner;
-function tryPort(port) {
-  return new Promise((resolve2, _reject) => {
-    try {
-      const server = createServer().listen(port);
-      server.on("listening", () => {
-        server.close();
-        resolve2(false);
-      });
-      server.on("error", (err) => {
-        if (err.code === "EADDRINUSE")
-          resolve2(true);
-        server.close();
-      });
-    } catch {
-      resolve2(true);
-    }
-  });
-}
-async function kill(port) {
-  return new Promise((resolve2, reject2) => {
-    exec2(`npx @maxbo/free-port ${port} -s`, (err, stdout, _stderr) => {
-      if (err) {
-        reject2(err);
-      } else {
-        consola.log(stdout);
-        resolve2();
-      }
-    });
-  });
-}
 function getNumber(number2) {
   if (number2 <= 0)
     return "0%";
@@ -13805,26 +14272,26 @@ async function download() {
   if (await testCaddy())
     return caddyPath;
   return new Promise((resolve2, reject2) => {
-    if (!existsSync3(TEMP_DIR)) {
+    if (!existsSync5(TEMP_DIR)) {
       mkdirSync(TEMP_DIR, { recursive: true });
-      chmodSync2(TEMP_DIR, 511);
+      chmodSync(TEMP_DIR, 448);
     }
     const file = createWriteStream(caddyPath);
-    let _platform = platform().toString();
+    let _platform = platform3().toString();
     _platform === "win32" && (_platform = "windows");
-    let _arch = process4.arch.toString();
+    let _arch = process7.arch.toString();
     _arch === "x64" && (_arch = "amd64");
     const support = supportList.find((item) => item.platform === _platform && item.arch === _arch);
     if (!support)
       return reject2(new Error("not support"));
     const dowmloadLink = `https://caddyserver.com/api/download?os=${support.platform}&arch=${support.arch}&p=github.com%2Fcaddyserver%2Fforwardproxy`;
-    existsSync3(caddyPath) && unlinkSync(caddyPath);
-    const httpProxy = process4.env.HTTP_PROXY || process4.env.http_proxy;
-    const httpsProxy = process4.env.HTTPS_PROXY || process4.env.https_proxy;
+    existsSync5(caddyPath) && unlinkSync(caddyPath);
+    const httpProxy = process7.env.HTTP_PROXY || process7.env.http_proxy;
+    const httpsProxy = process7.env.HTTPS_PROXY || process7.env.https_proxy;
     const httpAgent = httpProxy ? new HttpProxyAgent(httpProxy) : void 0;
     const httpsAgent = httpsProxy ? new HttpsProxyAgent(httpsProxy) : void 0;
     const chmodCaddyOnce = once(() => {
-      chmodSync2(caddyPath, 511);
+      chmodSync(caddyPath, 493);
     });
     got.stream(dowmloadLink, {
       agent: {
@@ -13836,9 +14303,9 @@ async function download() {
       chmodCaddyOnce();
     }).pipe(file).on("finish", () => {
       logProgressOver();
-      if (process4.platform === "win32")
+      if (process7.platform === "win32")
         return resolve2(caddyPath);
-      chmodSync2(caddyPath, 511);
+      chmodSync(caddyPath, 493);
       resolve2(caddyPath);
     }).on("error", (err) => {
       reject2(err);
@@ -13846,19 +14313,17 @@ async function download() {
   });
 }
 function testCaddy() {
-  return new Promise((resolve2, reject2) => {
-    if (!existsSync3(caddyPath))
-      return resolve2(false);
-    chmodSync2(caddyPath, 511);
-    const child = process4.platform === "win32" ? spawn(caddyPath, []) : spawn("sudo", ["-E", caddyPath]);
-    child.on("close", () => {
+  return new Promise((resolve2) => {
+    if (!existsSync5(caddyPath))
       return resolve2(false);
-    });
-    child.on("error", (err) => {
-      return reject2(err);
-    });
-    child.stdout.on("data", (_data) => {
-      return resolve2(true);
+    try {
+      chmodSync(caddyPath, 493);
+    } catch {
+    }
+    execFile(caddyPath, [], { timeout: 1e4 }, (error, stdout) => {
+      if (error && !stdout)
+        return resolve2(false);
+      resolve2(stdout.length > 0);
     });
   });
 }
@@ -13880,39 +14345,63 @@ function splitHostPort(addr) {
   }
   return { host: addr.slice(0, lastColon), port: addr.slice(lastColon + 1) };
 }
+var defaultDependencies = {
+  openSession: (runtimeDir, reason) => openPrivilegedSession(runtimeDir, {
+    log: (message) => consola.debug(message),
+    // Both paths are fixed here, before any socket traffic: the privileged
+    // helper must never execute something named in a request.
+    caddyBin: caddyPath,
+    caddyConfigPath: caddyFilePath,
+    reason
+  })
+};
 var CaddyInstant = class {
-  constructor() {
+  constructor(deps = {}) {
     this.inited = false;
     this.stoped = false;
     /** has locked when start */
     this.locked = false;
     this._stopEffects = [];
-    testCaddy().then(async () => {
-      this.inited = true;
-    });
+    this.deps = { ...defaultDependencies, ...deps };
     this.locked = this.checkLock();
   }
   checkLock() {
-    if (!existsSync3(caddyLockFilePath))
+    if (!existsSync5(caddyLockFilePath))
       writeFileSync2(caddyLockFilePath, "");
-    return lockfile.checkSync(caddyLockFilePath);
+    try {
+      return lockfile.checkSync(caddyLockFilePath);
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * Connects to the privileged helper, starting it once if needed. It is
+   * reused across instances so a second dev server does not ask for a
+   * password again.
+   */
+  async session(reason) {
+    if (this._session && !this._session.client.connected)
+      this._session = void 0;
+    if (!this._session)
+      this._session = await this.deps.openSession(TEMP_DIR, reason);
+    return this._session;
   }
   async getCaddyfile() {
-    if (!existsSync3(caddyFilePath)) {
+    if (!existsSync5(caddyFilePath)) {
       this.caddyfile = "";
       return "";
     }
-    this.caddyfile = await readFile2(caddyFilePath, "utf-8");
+    this.caddyfile = await readFile3(caddyFilePath, "utf-8");
     return this.caddyfile;
   }
   get caddyRoot() {
-    return join3(
-      process4.platform === "win32" ? `${process4.env.AppData}/Caddy` : `${process4.env.HOME}/Library/Application Support/Caddy`,
+    return join6(
+      process7.platform === "win32" ? `${process7.env.AppData}/Caddy` : `${process7.env.HOME}/Library/Application Support/Caddy`,
       "./pki/authorities/local"
     );
   }
   async writeCaddyfile() {
-    return await writeFile(caddyFilePath, this.caddyfile || "");
+    return await writeFile2(caddyFilePath, this.caddyfile || "");
   }
   async deleteCaddyfile() {
     return await unlink3(caddyFilePath);
@@ -13921,6 +14410,33 @@ var CaddyInstant = class {
     await download();
     this.inited = true;
   }
+  /**
+   * Hands the Caddy storage directory back to the developer. Local CA data
+   * created by an earlier root-owned run must stay readable for `tls internal`
+   * to keep serving the same certificate the browser already trusts.
+   */
+  /**
+   * Installs Caddy's local root CA so the browser stops warning about
+   * `tls internal` certificates. Generating the CA and trusting it are separate
+   * steps: a new CA appears whenever the previous one expires or the storage is
+   * replaced, so this runs on every start instead of once.
+   *
+   * The helper owns both the binary path and the command, so nothing here can
+   * be turned into an arbitrary root execution.
+   */
+  async trustLocalCa(session) {
+    try {
+      const result = await session.client.call("ca.trust");
+      if (result.trusted)
+        consola.debug(`Caddy local CA is trusted
+${result.output}`);
+    } catch (error) {
+      consola.warn(
+        `could not install the Caddy root certificate automatically: ${error.message}
+Run \`${caddyPath} trust\` manually if the browser warns about the certificate.`
+      );
+    }
+  }
   async ensureTlsReady(targetHost) {
     const health = await waitForLocalTls(targetHost);
     if (!health.healthy)
@@ -13974,8 +14490,8 @@ var CaddyInstant = class {
       await this.init();
     const sourceHost = splitHostPort(source).host;
     const targetHost = splitHostPort(target).host;
-    if (!await addHost(sourceHost, targetHost))
-      throw new Error("update host failed");
+    const session = await this.session({ target: targetHost, https });
+    await session.client.call("hosts.add", { ip: sourceHost, host: targetHost });
     consola.success("update host success\n");
     const normalizeBase = (b) => {
       let out = b || "/";
@@ -14010,24 +14526,24 @@ var CaddyInstant = class {
         void this.updateCaddyfile();
       })
     );
-    if (!existsSync3(caddyLockFilePath))
+    if (!existsSync5(caddyLockFilePath))
       writeFileSync2(caddyLockFilePath, "");
     if (!this.locked) {
-      if (await tryPort(443))
-        await kill(443);
-      if ((process4.platform === "win32" || !https) && await tryPort(80))
-        await kill(80);
+      await session.client.call("port.free", { port: 443 });
+      if (process7.platform === "win32" || !https)
+        await session.client.call("port.free", { port: 80 });
     }
     return new Promise((resolve2, reject2) => {
-      var _a4, _b3;
       let startupCheckStarted = false;
       const resolveWhenReady = async () => {
         if (startupCheckStarted)
           return;
         startupCheckStarted = true;
         try {
-          if (https)
+          if (https) {
+            await this.trustLocalCa(session);
             await this.ensureTlsReady(targetHost);
+          }
           resolve2();
         } catch (error) {
           if (!this.locked)
@@ -14036,96 +14552,87 @@ var CaddyInstant = class {
         }
       };
       const setupCleanup = () => {
-        process4.on("SIGINT", async () => {
+        process7.on("SIGINT", async () => {
           if (this.stoped)
             return;
-          process4.stdin.resume();
+          process7.stdin.resume();
           try {
             await this.baseCleanup(restore);
           } finally {
             this.stoped = true;
-            process4.nextTick(() => {
-              process4.exit();
+            process7.nextTick(() => {
+              process7.exit();
             });
           }
         });
-        const originalExit = process4.exit.bind(process4);
-        process4.exit = async (code) => {
-          const port = Number(splitHostPort(source).port);
-          if (!Number.isNaN(port) && await tryPort(port))
-            await kill(port);
-          const pwd = process4.cwd();
-          const viteCacheDir = `${pwd}/node_modules/.vite`;
-          if (existsSync3(viteCacheDir))
-            await chmodRecursive(viteCacheDir, 511).catch(() => {
-            });
-          const viteTempCacheDir = `${pwd}/node_modules/.vite-temp`;
-          if (existsSync3(viteTempCacheDir))
-            await chmodRecursive(viteTempCacheDir, 511).catch(() => {
-            });
-          const nuxtCacheDir = `${pwd}/.nuxt`;
-          if (existsSync3(nuxtCacheDir))
-            await chmodRecursive(nuxtCacheDir, 511).catch(() => {
-            });
-          const webpackCacheDir = `${pwd}/node_modules/.cache`;
-          if (existsSync3(webpackCacheDir))
-            await chmodRecursive(webpackCacheDir, 511).catch(() => {
-            });
+        const originalExit = process7.exit.bind(process7);
+        process7.exit = async (code) => {
           if (this.stoped)
             return originalExit(code);
-          process4.stdin.resume();
+          process7.stdin.resume();
           try {
             await this.baseCleanup();
           } finally {
             this.stoped = true;
-            process4.nextTick(() => {
+            process7.nextTick(() => {
               originalExit(code);
             });
           }
         };
       };
       if (!this.locked) {
-        this._caddyChild = process4.platform !== "win32" ? spawn("sudo", ["-E", caddyPath, "run", "--config", caddyFilePath, "--watch"]) : spawn(caddyPath, ["run", "--config", caddyFilePath, "--watch"]);
         lockfile.lockSync(caddyLockFilePath);
-        this._caddyChild.on("error", (err) => {
-          return reject2(err);
-        });
-        (_a4 = this._caddyChild.stderr) == null ? void 0 : _a4.on("data", async (data) => {
-          const lines = data.toString().split("\n").map((line) => line.trim());
-          for (const line of lines) {
-            showCaddyLog && line && console.info(line);
-            if (isCaddyReloadCancellation(line)) {
-              consola.info("Caddy restarted before TLS issuance completed; retrying.\n");
-              continue;
-            }
-            try {
-              if (line.includes("Error:") || line && JSON.parse(line).level === "error") {
-                if (line.includes("parsing caddyfile tokens")) {
-                  consola.error("Caddyfile syntax error, please contact the author:\n", `${this.caddyfile}
+        setupCleanup();
+        void (async () => {
+          try {
+            const child = new HelperCaddyProcess(session.client);
+            this._caddyChild = child;
+            await session.client.call("caddy.start");
+            child.on("exit", (code) => {
+              if (code !== null && code !== 0)
+                reject2(new Error(`Caddy exited with code ${code}`));
+            });
+            child.stderr.on("data", async (data) => {
+              const lines = data.toString().split("\n").map((line) => line.trim());
+              for (const line of lines) {
+                showCaddyLog && line && console.info(line);
+                if (isCaddyReloadCancellation(line)) {
+                  consola.info("Caddy restarted before TLS issuance completed; retrying.\n");
+                  continue;
+                }
+                try {
+                  if (line.includes("Error:") || line && JSON.parse(line).level === "error") {
+                    if (line.includes("parsing caddyfile tokens")) {
+                      consola.error("Caddyfile syntax error, please contact the author:\n", `${this.caddyfile}
 
 ${line}
 `);
-                  await this.baseCleanup();
-                  process4.exit();
-                } else {
-                  consola.error(`${line}
+                      await this.baseCleanup();
+                      process7.exit();
+                    } else {
+                      consola.error(`${line}
 `);
-                  return reject2(line);
+                      return reject2(line);
+                    }
+                  }
+                } catch {
                 }
+                if (line.includes("config file changed"))
+                  consola.success("Detect added a new reverse proxy config, restarted.\n");
+                if (line.includes("caddy proxying") || line.includes("serving initial"))
+                  void resolveWhenReady();
               }
-            } catch {
-            }
-            if (line.includes("config file changed"))
-              consola.success("Detect added a new reverse proxy config, restarted.\n");
-            if (line.includes("caddy proxying") || line.includes("serving initial"))
+            });
+            child.stdout.on("data", (data) => {
+              consola.info(data.toString());
               void resolveWhenReady();
+            });
+          } catch (error) {
+            if (!this.locked)
+              await this.baseCleanup(restore);
+            reject2(error);
           }
-        });
-        (_b3 = this._caddyChild.stdout) == null ? void 0 : _b3.on("data", (_data) => {
-          consola.info(_data.toString());
-          void resolveWhenReady();
-        });
-        setupCleanup();
+        })();
       } else {
         consola.info("Caddy is running in another process.");
         void (async () => {
@@ -14142,17 +14649,25 @@ ${line}
     });
   }
   async baseCleanup(restore = true) {
+    var _a4;
     this._stopEffects.forEach((fn) => fn());
+    this._stopEffects.length = 0;
     try {
-      if (restore && this._source && this._target) {
-        if (await removeHost(splitHostPort(this._source).host, splitHostPort(this._target).host))
-          consola.success("Restore host success.\n");
-        else
-          consola.fail("Restore host failed.\n");
+      if (restore && this._source && this._target && this._session) {
+        const sourceHost = splitHostPort(this._source).host;
+        const targetHost = splitHostPort(this._target).host;
+        await this._session.client.call("hosts.remove", { ip: sourceHost, host: targetHost });
+        if (sourceHost === "localhost")
+          await this._session.client.call("hosts.remove", { ip: "127.0.0.1", host: targetHost });
+        consola.success("Restore host success.\n");
       }
     } catch (e) {
-      consola.error(e);
-      consola.fail("Restore host failed.\n");
+      if (((_a4 = this._session) == null ? void 0 : _a4.client.connected) === false) {
+        consola.debug("hosts entries are restored by the privileged helper on disconnect");
+      } else {
+        consola.error(e);
+        consola.fail("Restore host failed.\n");
+      }
     }
     if (!this.locked && !this.stoped) {
       await this.stopCaddy();
@@ -14177,7 +14692,7 @@ ${line}
 var config;
 var caddy;
 var hmrSseBridgeActive = false;
-var cwd = process5.cwd();
+var cwd = process8.cwd();
 function colorUrl(url2) {
   return c.green(url2.replace(/:(\d+)\//, (_, port) => `:${c.bold(port)}/`));
 }
@@ -14212,16 +14727,27 @@ async function printForwardProxy() {
 }
 var vitePrintUrls = once((options, source, target, base = "/", _printUrls) => {
   _printUrls == null ? void 0 : _printUrls();
+  if (isPrivilegeDenied())
+    return;
   if (caddy)
     return;
-  caddy = new CaddyInstant();
-  caddy.run(source, target, {
+  const instance = new CaddyInstant();
+  caddy = instance;
+  instance.run(source, target, {
     base,
     ...options
   }).then(async () => {
     await printForwardProxy();
     consola.success(`  ${c.green("\u279C")}  ${c.bold("run caddy reverse proxy success")}: ${colorUrl(`${options.https ? "https" : "http"}://${target}${base}`)}`);
   }).catch((e) => {
+    if (caddy === instance)
+      caddy = void 0;
+    if (e instanceof PrivilegeDeniedError) {
+      markPrivilegeDenied();
+      consola.warn("reverse proxy skipped: administrator permission was not granted.");
+      consola.info("Restart the dev server to enable it again.");
+      return;
+    }
     throw e;
   });
 });
@@ -14242,10 +14768,6 @@ var unpluginFactory = (options) => ({
       } = options;
       if (!enable)
         return;
-      if (!isAdmin()) {
-        consola.warn("please run as administrator");
-        return;
-      }
       if (!target) {
         consola.fail("please provide target");
         return;
@@ -14281,7 +14803,7 @@ var unpluginFactory = (options) => ({
   },
   webpack(compiler) {
     var _a4, _b3, _c2;
-    if (process5.env.NODE_ENV !== "development")
+    if (process8.env.NODE_ENV !== "development")
       return;
     const {
       enable = true,
@@ -14289,10 +14811,6 @@ var unpluginFactory = (options) => ({
     } = options;
     if (!enable)
       return;
-    if (!isAdmin()) {
-      consola.warn("please run as administrator");
-      return;
-    }
     if (!target) {
       consola.fail("please provide target");
       return;
@@ -14306,9 +14824,11 @@ var unpluginFactory = (options) => ({
       port: 8080,
       ...compiler.options.devServer,
       // @ts-expect-error vuecli
-      ...(_a4 = process5.VUE_CLI_SERVICE) == null ? void 0 : _a4.projectOptions.devServer
+      ...(_a4 = process8.VUE_CLI_SERVICE) == null ? void 0 : _a4.projectOptions.devServer
     };
     const source = `${devServer.host}:${devServer.port}`;
+    if (isPrivilegeDenied())
+      return;
     if (caddy)
       return;
     let base = "/";
@@ -14323,15 +14843,16 @@ var unpluginFactory = (options) => ({
     const _close = (_c2 = compiler.close) == null ? void 0 : _c2.bind(compiler);
     if (_close) {
       compiler.close = async (callback) => {
-        process5.on("exit", () => {
+        process8.on("exit", () => {
           _close && _close(callback);
         });
       };
     } else {
       options.https = false;
     }
-    caddy = new CaddyInstant();
-    caddy.run(source, target, {
+    const instance = new CaddyInstant();
+    caddy = instance;
+    instance.run(source, target, {
       base,
       ...options
     }).then(() => {
@@ -14340,12 +14861,20 @@ var unpluginFactory = (options) => ({
         consola.success(`  ${c.green("\u279C")}  ${c.bold("run caddy reverse proxy success")}: ${colorUrl(`${options.https ? "https" : "http"}://${target}${base}`)}`);
       });
     }).catch((e) => {
+      if (caddy === instance)
+        caddy = void 0;
+      if (e instanceof PrivilegeDeniedError) {
+        markPrivilegeDenied();
+        consola.warn("reverse proxy skipped: administrator permission was not granted.");
+        consola.info("Restart the dev server to enable it again.");
+        return;
+      }
       throw e;
     });
   },
   async rspack(compiler) {
     var _a4, _b3, _c2, _d2;
-    if (process5.env.NODE_ENV !== "development")
+    if (process8.env.NODE_ENV !== "development")
       return;
     const {
       enable = true,
@@ -14353,10 +14882,6 @@ var unpluginFactory = (options) => ({
     } = options;
     if (!enable)
       return;
-    if (!isAdmin()) {
-      consola.warn("please run as administrator");
-      return;
-    }
     if (!target) {
       consola.fail("please provide target");
       return;
@@ -14374,9 +14899,10 @@ var unpluginFactory = (options) => ({
       }))) == null ? void 0 : _b3.content) == null ? void 0 : _c2.server
     };
     const source = `${devServer.host}:${devServer.port}`;
+    if (isPrivilegeDenied())
+      return;
     if (caddy)
       return;
-    caddy = new CaddyInstant();
     let base = "/";
     const publicPath = (_d2 = compiler.options.output) == null ? void 0 : _d2.publicPath;
     if (typeof publicPath === "string" && publicPath) {
@@ -14386,13 +14912,23 @@ var unpluginFactory = (options) => ({
       base = `/${base}`;
     if (base !== "/" && !base.endsWith("/"))
       base = `${base}/`;
-    caddy.run(source, target, {
+    const instance = new CaddyInstant();
+    caddy = instance;
+    instance.run(source, target, {
       base,
       ...options
     }).then(async () => {
       await printForwardProxy();
       consola.success(`  ${c.green("\u279C")}  ${c.bold("run caddy reverse proxy success")}: ${colorUrl(`${options.https ? "https" : "http"}://${target}${base}`)}`);
     }).catch((e) => {
+      if (caddy === instance)
+        caddy = void 0;
+      if (e instanceof PrivilegeDeniedError) {
+        markPrivilegeDenied();
+        consola.warn("reverse proxy skipped: administrator permission was not granted.");
+        consola.info("Restart the dev server to enable it again.");
+        return;
+      }
       throw e;
     });
   }