unplugin-https-reverse-proxy 4.1.0-beta.2 → 4.1.0-beta.4

package/dist/{chunk-7CA3EIIX.js → chunk-H7LIW3S4.js}

@@ -8,6 +8,10 @@ import {
   hmrSseBridgeClientScript,
   setupHmrSseBridge
 } from "./chunk-C5A7XLKL.js";
+import {
+  isPrivilegeDenied,
+  markPrivilegeDenied
+} from "./chunk-WOMR3ZLM.js";
 import {
   decodeMessage,
   serializeMessage,
@@ -15,458 +19,21 @@ import {
 } from "./chunk-RKHJN6KY.js";
 
 // src/index.ts
-import process8 from "node:process";
+import process9 from "node:process";
 import { Table } from "console-table-printer";
 import c from "picocolors";
 import { createUnplugin } from "unplugin";
 
 // src/caddy/index.ts
 import { execFile } from "node:child_process";
-import { chmodSync, createWriteStream, existsSync as existsSync5, mkdirSync, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
-import { readFile as readFile3, unlink as unlink3, writeFile as writeFile2 } from "node:fs/promises";
+import { chmodSync, createWriteStream, existsSync as existsSync5, mkdirSync, unlinkSync as unlinkSync2 } from "node:fs";
+import { readFile as readFile3, unlink, writeFile as writeFile2 } from "node:fs/promises";
 import { platform as platform3 } from "node:os";
 import { join as join6 } from "node:path";
-import process7 from "node:process";
-
-// node_modules/.pnpm/alien-signals@2.0.7/node_modules/alien-signals/esm/system.mjs
-var ReactiveFlags;
-(function(ReactiveFlags2) {
-  ReactiveFlags2[ReactiveFlags2["None"] = 0] = "None";
-  ReactiveFlags2[ReactiveFlags2["Mutable"] = 1] = "Mutable";
-  ReactiveFlags2[ReactiveFlags2["Watching"] = 2] = "Watching";
-  ReactiveFlags2[ReactiveFlags2["RecursedCheck"] = 4] = "RecursedCheck";
-  ReactiveFlags2[ReactiveFlags2["Recursed"] = 8] = "Recursed";
-  ReactiveFlags2[ReactiveFlags2["Dirty"] = 16] = "Dirty";
-  ReactiveFlags2[ReactiveFlags2["Pending"] = 32] = "Pending";
-})(ReactiveFlags || (ReactiveFlags = {}));
-function createReactiveSystem({ update, notify: notify2, unwatched }) {
-  let currentVersion = 0;
-  return {
-    link: link2,
-    unlink: unlink4,
-    propagate: propagate2,
-    checkDirty: checkDirty2,
-    endTracking: endTracking2,
-    startTracking: startTracking2,
-    shallowPropagate: shallowPropagate2
-  };
-  function link2(dep, sub) {
-    const prevDep = sub.depsTail;
-    if (prevDep !== void 0 && prevDep.dep === dep) {
-      return;
-    }
-    const nextDep = prevDep !== void 0 ? prevDep.nextDep : sub.deps;
-    if (nextDep !== void 0 && nextDep.dep === dep) {
-      nextDep.version = currentVersion;
-      sub.depsTail = nextDep;
-      return;
-    }
-    const prevSub = dep.subsTail;
-    if (prevSub !== void 0 && prevSub.version === currentVersion && prevSub.sub === sub) {
-      return;
-    }
-    const newLink = sub.depsTail = dep.subsTail = {
-      version: currentVersion,
-      dep,
-      sub,
-      prevDep,
-      nextDep,
-      prevSub,
-      nextSub: void 0
-    };
-    if (nextDep !== void 0) {
-      nextDep.prevDep = newLink;
-    }
-    if (prevDep !== void 0) {
-      prevDep.nextDep = newLink;
-    } else {
-      sub.deps = newLink;
-    }
-    if (prevSub !== void 0) {
-      prevSub.nextSub = newLink;
-    } else {
-      dep.subs = newLink;
-    }
-  }
-  function unlink4(link3, sub = link3.sub) {
-    const dep = link3.dep;
-    const prevDep = link3.prevDep;
-    const nextDep = link3.nextDep;
-    const nextSub = link3.nextSub;
-    const prevSub = link3.prevSub;
-    if (nextDep !== void 0) {
-      nextDep.prevDep = prevDep;
-    } else {
-      sub.depsTail = prevDep;
-    }
-    if (prevDep !== void 0) {
-      prevDep.nextDep = nextDep;
-    } else {
-      sub.deps = nextDep;
-    }
-    if (nextSub !== void 0) {
-      nextSub.prevSub = prevSub;
-    } else {
-      dep.subsTail = prevSub;
-    }
-    if (prevSub !== void 0) {
-      prevSub.nextSub = nextSub;
-    } else if ((dep.subs = nextSub) === void 0) {
-      unwatched(dep);
-    }
-    return nextDep;
-  }
-  function propagate2(link3) {
-    let next2 = link3.nextSub;
-    let stack;
-    top:
-      do {
-        const sub = link3.sub;
-        let flags = sub.flags;
-        if (!(flags & 60)) {
-          sub.flags = flags | 32;
-        } else if (!(flags & 12)) {
-          flags = 0;
-        } else if (!(flags & 4)) {
-          sub.flags = flags & ~8 | 32;
-        } else if (!(flags & 48) && isValidLink(link3, sub)) {
-          sub.flags = flags | 40;
-          flags &= 1;
-        } else {
-          flags = 0;
-        }
-        if (flags & 2) {
-          notify2(sub);
-        }
-        if (flags & 1) {
-          const subSubs = sub.subs;
-          if (subSubs !== void 0) {
-            const nextSub = (link3 = subSubs).nextSub;
-            if (nextSub !== void 0) {
-              stack = { value: next2, prev: stack };
-              next2 = nextSub;
-            }
-            continue;
-          }
-        }
-        if ((link3 = next2) !== void 0) {
-          next2 = link3.nextSub;
-          continue;
-        }
-        while (stack !== void 0) {
-          link3 = stack.value;
-          stack = stack.prev;
-          if (link3 !== void 0) {
-            next2 = link3.nextSub;
-            continue top;
-          }
-        }
-        break;
-      } while (true);
-  }
-  function startTracking2(sub) {
-    ++currentVersion;
-    sub.depsTail = void 0;
-    sub.flags = sub.flags & ~56 | 4;
-  }
-  function endTracking2(sub) {
-    const depsTail = sub.depsTail;
-    let toRemove = depsTail !== void 0 ? depsTail.nextDep : sub.deps;
-    while (toRemove !== void 0) {
-      toRemove = unlink4(toRemove, sub);
-    }
-    sub.flags &= ~4;
-  }
-  function checkDirty2(link3, sub) {
-    let stack;
-    let checkDepth = 0;
-    top:
-      do {
-        const dep = link3.dep;
-        const flags = dep.flags;
-        let dirty = false;
-        if (sub.flags & 16) {
-          dirty = true;
-        } else if ((flags & 17) === 17) {
-          if (update(dep)) {
-            const subs = dep.subs;
-            if (subs.nextSub !== void 0) {
-              shallowPropagate2(subs);
-            }
-            dirty = true;
-          }
-        } else if ((flags & 33) === 33) {
-          if (link3.nextSub !== void 0 || link3.prevSub !== void 0) {
-            stack = { value: link3, prev: stack };
-          }
-          link3 = dep.deps;
-          sub = dep;
-          ++checkDepth;
-          continue;
-        }
-        if (!dirty) {
-          const nextDep = link3.nextDep;
-          if (nextDep !== void 0) {
-            link3 = nextDep;
-            continue;
-          }
-        }
-        while (checkDepth--) {
-          const firstSub = sub.subs;
-          const hasMultipleSubs = firstSub.nextSub !== void 0;
-          if (hasMultipleSubs) {
-            link3 = stack.value;
-            stack = stack.prev;
-          } else {
-            link3 = firstSub;
-          }
-          if (dirty) {
-            if (update(sub)) {
-              if (hasMultipleSubs) {
-                shallowPropagate2(firstSub);
-              }
-              sub = link3.sub;
-              continue;
-            }
-          } else {
-            sub.flags &= ~32;
-          }
-          sub = link3.sub;
-          const nextDep = link3.nextDep;
-          if (nextDep !== void 0) {
-            link3 = nextDep;
-            continue top;
-          }
-          dirty = false;
-        }
-        return dirty;
-      } while (true);
-  }
-  function shallowPropagate2(link3) {
-    do {
-      const sub = link3.sub;
-      const flags = sub.flags;
-      if ((flags & 48) === 32) {
-        sub.flags = flags | 16;
-        if (flags & 2) {
-          notify2(sub);
-        }
-      }
-    } while ((link3 = link3.nextSub) !== void 0);
-  }
-  function isValidLink(checkLink, sub) {
-    let link3 = sub.depsTail;
-    while (link3 !== void 0) {
-      if (link3 === checkLink) {
-        return true;
-      }
-      link3 = link3.prevDep;
-    }
-    return false;
-  }
-}
-
-// node_modules/.pnpm/alien-signals@2.0.7/node_modules/alien-signals/esm/index.mjs
-var queuedEffects = [];
-var { link, unlink, propagate, checkDirty, endTracking, startTracking, shallowPropagate } = createReactiveSystem({
-  update(signal2) {
-    if ("getter" in signal2) {
-      return updateComputed(signal2);
-    } else {
-      return updateSignal(signal2, signal2.value);
-    }
-  },
-  notify,
-  unwatched(node2) {
-    if ("getter" in node2) {
-      let toRemove = node2.deps;
-      if (toRemove !== void 0) {
-        node2.flags = 17;
-        do {
-          toRemove = unlink(toRemove, node2);
-        } while (toRemove !== void 0);
-      }
-    } else if (!("previousValue" in node2)) {
-      effectOper.call(node2);
-    }
-  }
-});
-var batchDepth = 0;
-var notifyIndex = 0;
-var queuedEffectsLength = 0;
-var activeSub;
-var activeScope;
-function setCurrentSub(sub) {
-  const prevSub = activeSub;
-  activeSub = sub;
-  return prevSub;
-}
-function signal(initialValue) {
-  return signalOper.bind({
-    previousValue: initialValue,
-    value: initialValue,
-    subs: void 0,
-    subsTail: void 0,
-    flags: 1
-  });
-}
-function computed(getter) {
-  return computedOper.bind({
-    value: void 0,
-    subs: void 0,
-    subsTail: void 0,
-    deps: void 0,
-    depsTail: void 0,
-    flags: 17,
-    getter
-  });
-}
-function effect(fn) {
-  const e = {
-    fn,
-    subs: void 0,
-    subsTail: void 0,
-    deps: void 0,
-    depsTail: void 0,
-    flags: 2
-  };
-  if (activeSub !== void 0) {
-    link(e, activeSub);
-  } else if (activeScope !== void 0) {
-    link(e, activeScope);
-  }
-  const prev = setCurrentSub(e);
-  try {
-    e.fn();
-  } finally {
-    setCurrentSub(prev);
-  }
-  return effectOper.bind(e);
-}
-function updateComputed(c2) {
-  const prevSub = setCurrentSub(c2);
-  startTracking(c2);
-  try {
-    const oldValue = c2.value;
-    return oldValue !== (c2.value = c2.getter(oldValue));
-  } finally {
-    setCurrentSub(prevSub);
-    endTracking(c2);
-  }
-}
-function updateSignal(s, value2) {
-  s.flags = 1;
-  return s.previousValue !== (s.previousValue = value2);
-}
-function notify(e) {
-  const flags = e.flags;
-  if (!(flags & 64)) {
-    e.flags = flags | 64;
-    const subs = e.subs;
-    if (subs !== void 0) {
-      notify(subs.sub);
-    } else {
-      queuedEffects[queuedEffectsLength++] = e;
-    }
-  }
-}
-function run(e, flags) {
-  if (flags & 16 || flags & 32 && checkDirty(e.deps, e)) {
-    const prev = setCurrentSub(e);
-    startTracking(e);
-    try {
-      e.fn();
-    } finally {
-      setCurrentSub(prev);
-      endTracking(e);
-    }
-    return;
-  } else if (flags & 32) {
-    e.flags = flags & ~32;
-  }
-  let link2 = e.deps;
-  while (link2 !== void 0) {
-    const dep = link2.dep;
-    const depFlags = dep.flags;
-    if (depFlags & 64) {
-      run(dep, dep.flags = depFlags & ~64);
-    }
-    link2 = link2.nextDep;
-  }
-}
-function flush() {
-  while (notifyIndex < queuedEffectsLength) {
-    const effect2 = queuedEffects[notifyIndex];
-    queuedEffects[notifyIndex++] = void 0;
-    run(effect2, effect2.flags &= ~64);
-  }
-  notifyIndex = 0;
-  queuedEffectsLength = 0;
-}
-function computedOper() {
-  const flags = this.flags;
-  if (flags & 16 || flags & 32 && checkDirty(this.deps, this)) {
-    if (updateComputed(this)) {
-      const subs = this.subs;
-      if (subs !== void 0) {
-        shallowPropagate(subs);
-      }
-    }
-  } else if (flags & 32) {
-    this.flags = flags & ~32;
-  }
-  if (activeSub !== void 0) {
-    link(this, activeSub);
-  } else if (activeScope !== void 0) {
-    link(this, activeScope);
-  }
-  return this.value;
-}
-function signalOper(...value2) {
-  if (value2.length) {
-    if (this.value !== (this.value = value2[0])) {
-      this.flags = 17;
-      const subs = this.subs;
-      if (subs !== void 0) {
-        propagate(subs);
-        if (!batchDepth) {
-          flush();
-        }
-      }
-    }
-  } else {
-    const value3 = this.value;
-    if (this.flags & 16) {
-      if (updateSignal(this, value3)) {
-        const subs = this.subs;
-        if (subs !== void 0) {
-          shallowPropagate(subs);
-        }
-      }
-    }
-    if (activeSub !== void 0) {
-      link(this, activeSub);
-    }
-    return value3;
-  }
-}
-function effectOper() {
-  let dep = this.deps;
-  while (dep !== void 0) {
-    dep = unlink(dep, this);
-  }
-  const sub = this.subs;
-  if (sub !== void 0) {
-    unlink(sub);
-  }
-  this.flags = 0;
-}
-
-// src/caddy/index.ts
+import process8 from "node:process";
 import { got } from "got-cjs";
 import { HttpProxyAgent } from "http-proxy-agent";
 import { HttpsProxyAgent } from "https-proxy-agent";
-import * as lockfile from "proper-lockfile";
 
 // node_modules/.pnpm/@ark+util@0.46.0/node_modules/@ark/util/out/arrays.js
 var liftArray = (data) => Array.isArray(data) ? data : [data];
@@ -13416,8 +12983,9 @@ async function genCaddyfile(ctx) {
 }
 
 // src/caddy/config.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2, watch, writeFileSync } from "node:fs";
-import { unlink as unlink2 } from "node:fs/promises";
+import { existsSync as existsSync2, readFileSync as readFileSync2, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import process3 from "node:process";
+import * as lockfile from "proper-lockfile";
 
 // src/caddy/constants.ts
 import os from "node:os";
@@ -13549,56 +13117,108 @@ var supportList = [
 ];
 
 // src/caddy/config.ts
-function useCaddyConfig() {
-  const configContentRef = signal("{}");
-  const configJsonRef = computed(() => {
-    try {
-      return JSON.parse(configContentRef());
-    } catch {
-      return void 0;
-    }
-  });
-  function setConfigContent() {
-    if (!existsSync2(caddyConfigPath)) {
-      writeFileSync(caddyConfigPath, "{}");
-    }
-    try {
-      configContentRef(readFileSync2(caddyConfigPath, "utf-8"));
-    } catch {
-      configContentRef("");
-    }
+function isAlive(pid) {
+  if (pid === void 0)
+    return true;
+  try {
+    process3.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
   }
-  if (!existsSync2(caddyConfigPath)) {
-    writeFileSync(caddyConfigPath, "{}");
+}
+function readConfig() {
+  if (!existsSync2(caddyConfigPath))
+    return {};
+  let parsed2;
+  try {
+    parsed2 = JSON.parse(readFileSync2(caddyConfigPath, "utf-8"));
+  } catch {
+    return {};
   }
-  const watchCaddyConfig = watch(caddyConfigPath, () => {
-    setConfigContent();
-  });
-  function writeCaddyConfig(_proxies) {
-    const proxies = configJsonRef() || {};
-    _proxies.forEach((p) => {
-      let base = p.base || "/";
-      if (!base.startsWith("/"))
-        base = `/${base}`;
-      if (base !== "/" && !base.endsWith("/"))
-        base = `${base}/`;
-      const index = `${p.target}${p.portSuffix}${base}`;
-      proxies[index] = { ...p, base };
-    });
-    const content = JSON.stringify(proxies, null, 2);
-    configContentRef(content);
-    return writeFileSync(caddyConfigPath, content);
+  const alive = {};
+  for (const [key, entry] of Object.entries(parsed2)) {
+    if (isAlive(entry == null ? void 0 : entry.ownerPid))
+      alive[key] = entry;
   }
-  async function cleanUp() {
-    await unlink2(caddyConfigPath).catch(() => {
-    });
-    configContentRef("{}");
-    watchCaddyConfig.close();
+  return alive;
+}
+function writeConfig(proxies) {
+  const content = JSON.stringify(proxies, null, 2);
+  const temp = `${caddyConfigPath}.${process3.pid}.tmp`;
+  writeFileSync(temp, content);
+  renameSync(temp, caddyConfigPath);
+}
+async function mutateConfig(lock3, mutate) {
+  const release = await lock3.acquire();
+  try {
+    const proxies = readConfig();
+    mutate(proxies);
+    writeConfig(proxies);
+    return proxies;
+  } finally {
+    release();
   }
+}
+function useCaddyConfig(options = {}) {
+  const lock3 = options.lock ?? createFileLock();
   return {
-    configJsonRef,
-    writeCaddyConfig,
-    cleanUp
+    configJsonRef: () => existsSync2(caddyConfigPath) ? readConfig() : void 0,
+    async writeCaddyConfig(_proxies, key) {
+      await mutateConfig(lock3, (proxies) => {
+        for (const p of _proxies)
+          proxies[routeKey(p, key)] = { ...p, base: normalizeBase(p.base), ownerPid: process3.pid };
+      });
+    },
+    async removeProxy(key) {
+      const proxies = await mutateConfig(lock3, (current) => {
+        for (const route of Object.keys(current)) {
+          if (route.endsWith(`#${key}`))
+            delete current[route];
+        }
+      });
+      if (Object.keys(proxies).length === 0)
+        removeConfigFile();
+    },
+    readProxies: () => readConfig(),
+    async cleanUp() {
+      removeConfigFile();
+    }
+  };
+}
+function removeConfigFile() {
+  try {
+    if (existsSync2(caddyConfigPath))
+      unlinkSync(caddyConfigPath);
+  } catch {
+  }
+}
+function normalizeBase(base) {
+  let out = base || "/";
+  if (!out.startsWith("/"))
+    out = `/${out}`;
+  if (out !== "/" && !out.endsWith("/"))
+    out = `${out}/`;
+  return out;
+}
+function routeKey(proxy, ownerKey) {
+  return `${proxy.target}${proxy.portSuffix}${normalizeBase(proxy.base)}#${ownerKey}`;
+}
+function createFileLock() {
+  return {
+    async acquire() {
+      if (!existsSync2(caddyConfigPath))
+        writeFileSync(caddyConfigPath, "{}");
+      const release = await lockfile.lock(caddyConfigPath, {
+        realpath: false,
+        stale: 1e4,
+        retries: { retries: 20, minTimeout: 10, maxTimeout: 100 }
+      });
+      return () => {
+        void release().catch(() => {
+        });
+      };
+    }
   };
 }
 
@@ -13615,27 +13235,39 @@ function isCaddyReloadCancellation(line) {
 // src/caddy/privileged.ts
 import { Buffer as Buffer2 } from "node:buffer";
 import { EventEmitter } from "node:events";
-import { dirname as dirname2, join as join5 } from "node:path";
-import process6 from "node:process";
+import { dirname as dirname3, join as join5 } from "node:path";
+import process7 from "node:process";
 import { fileURLToPath } from "node:url";
 
 // src/privileged/entry.ts
 import { existsSync as existsSync3 } from "node:fs";
-import { join as join3 } from "node:path";
-import process3 from "node:process";
+import { dirname as dirname2, join as join3 } from "node:path";
+import process4 from "node:process";
 function resolveHelperEntry(options) {
-  const { moduleDir, nodeBin = process3.execPath, exists: exists2 = existsSync3 } = options;
+  const { moduleDir, nodeBin = process4.execPath, exists: exists2 = existsSync3 } = options;
   for (const name of ["privileged-helper.js", "privileged-helper.cjs", "privileged-helper.mjs"]) {
-    const candidate = join3(moduleDir, name);
-    if (exists2(candidate))
+    const candidate = findUp(moduleDir, name, exists2);
+    if (candidate)
       return { entry: nodeBin, args: [candidate] };
   }
-  const source = join3(moduleDir, "privileged-helper.ts");
-  const tsxCli = join3(moduleDir, "../node_modules/tsx/dist/cli.mjs");
-  if (exists2(source) && exists2(tsxCli))
+  const source = findUp(moduleDir, "privileged-helper.ts", exists2);
+  const tsxCli = findUp(moduleDir, "node_modules/tsx/dist/cli.mjs", exists2);
+  if (source && tsxCli)
     return { entry: nodeBin, args: [tsxCli, source] };
   throw new Error(`privileged helper entry not found in ${moduleDir}. Build the package first.`);
 }
+function findUp(from, relative, exists2) {
+  let current = from;
+  while (true) {
+    const candidate = join3(current, relative);
+    if (exists2(candidate))
+      return candidate;
+    const parent = dirname2(current);
+    if (parent === current)
+      return void 0;
+    current = parent;
+  }
+}
 
 // src/privileged/session.ts
 import { Buffer } from "node:buffer";
@@ -13643,16 +13275,17 @@ import { existsSync as existsSync4 } from "node:fs";
 import { readFile as readFile2, writeFile } from "node:fs/promises";
 import { platform as platform2 } from "node:os";
 import { join as join4 } from "node:path";
+import * as lockfile2 from "proper-lockfile";
 
 // src/privileged/launch.ts
 import { spawn as spawn2, spawnSync } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { platform } from "node:os";
-import process5 from "node:process";
+import process6 from "node:process";
 
 // src/privileged/client.ts
 import { connect } from "node:net";
-import process4 from "node:process";
+import process5 from "node:process";
 var FORWARDED_ENV_KEYS = [
   "HOME",
   "USER",
@@ -13665,7 +13298,7 @@ var FORWARDED_ENV_KEYS = [
   "NO_PROXY",
   "no_proxy"
 ];
-function collectForwardedEnv(source = process4.env) {
+function collectForwardedEnv(source = process5.env) {
   const result = {};
   for (const key of FORWARDED_ENV_KEYS) {
     const value2 = source[key];
@@ -13883,18 +13516,42 @@ function spawnElevatedOnWindows(options) {
 function createHelperToken() {
   return randomBytes(24).toString("hex");
 }
-function authenticateSudo(sudoCommand = "sudo") {
+function describePasswordReason(target, https) {
+  const port = https ? "443" : "80";
+  return [
+    `reverse proxy needs administrator permission for ${target}`,
+    `  \xB7 bind port ${port}${https ? ` for https://${target}` : ""}`,
+    `  \xB7 add ${target} to the hosts file`,
+    "",
+    "This is the only prompt; the rest of the dev server keeps running as you.",
+    "Press Ctrl+C at the prompt to skip the proxy and keep the dev server."
+  ];
+}
+function authenticateSudo(sudoCommand = "sudo", options = {}) {
   if (platform() === "win32")
     return { ok: true };
   if (spawnSync(sudoCommand, ["-n", "true"], { stdio: "ignore" }).status === 0)
     return { ok: true };
+  if (options.target) {
+    for (const line of describePasswordReason(options.target, options.https ?? false))
+      process6.stderr.write(`${line}
+`);
+    process6.stderr.write("\n");
+  }
   if (spawnSync(sudoCommand, ["-v"], { stdio: "inherit" }).status === 0)
     return { ok: true };
   return {
     ok: false,
+    denied: true,
     message: "administrator permission is required to edit the hosts file and bind ports 80/443"
   };
 }
+var PrivilegeDeniedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PrivilegeDeniedError";
+  }
+};
 async function startPrivilegedHelper(options) {
   var _a4, _b3;
   const {
@@ -13905,14 +13562,16 @@ async function startPrivilegedHelper(options) {
     sudoCommand = "sudo",
     skipAuth = false,
     direct = false,
-    env: env2 = process5.env,
+    env: env2 = process6.env,
     log,
     connectTimeoutMs = 12e4
   } = options;
   if (!skipAuth && !direct) {
-    const auth = authenticateSudo(sudoCommand);
-    if (!auth.ok)
-      throw new Error(auth.message);
+    const auth = authenticateSudo(sudoCommand, options.reason);
+    if (!auth.ok) {
+      const message = auth.message ?? "administrator permission is required";
+      throw auth.denied ? new PrivilegeDeniedError(message) : new Error(message);
+    }
   }
   const forwarded = collectForwardedEnv(env2);
   const forwardedArgs = Object.entries(forwarded).map(([key, value2]) => `${key}=${value2}`);
@@ -13922,8 +13581,8 @@ async function startPrivilegedHelper(options) {
     socketPath,
     "--token",
     token,
-    ...typeof process5.getuid === "function" ? ["--owner-uid", String(process5.getuid())] : [],
-    ...typeof process5.getgid === "function" ? ["--owner-gid", String(process5.getgid())] : [],
+    ...typeof process6.getuid === "function" ? ["--owner-uid", String(process6.getuid())] : [],
+    ...typeof process6.getgid === "function" ? ["--owner-gid", String(process6.getgid())] : [],
     ...options.caddyStoragePath ? ["--caddy-storage", options.caddyStoragePath] : [],
     "--caddy",
     options.caddyBin,
@@ -13932,7 +13591,7 @@ async function startPrivilegedHelper(options) {
   ];
   let child;
   if (!direct && platform() === "win32") {
-    await spawnElevatedOnWindows({ file: helperEntry, args: childArgv, cwd: process5.cwd() });
+    await spawnElevatedOnWindows({ file: helperEntry, args: childArgv, cwd: process6.cwd() });
   } else {
     const command = direct ? helperEntry : sudoCommand;
     const spawnArgs = direct ? childArgv : ["-n", "env", ...forwardedArgs, helperEntry, ...childArgv];
@@ -13989,21 +13648,34 @@ function sessionSocketPath(runtimeDir) {
 }
 async function openHelperSession(scope2) {
   const socketPath = sessionSocketPath(scope2.runtimeDir);
-  if (existsSync4(socketPath) || platform2() === "win32") {
-    const token2 = await readToken(scope2.runtimeDir);
-    if (token2) {
-      const reused = await connectExistingHelper(socketPath, token2);
-      if (reused) {
-        return {
-          client: reused,
-          reused: true,
-          close: async () => {
-            await reused.close();
-          }
-        };
-      }
-    }
+  const release = await acquireStartLock(scope2.runtimeDir);
+  try {
+    const reused = await tryReuse(socketPath, scope2);
+    if (reused)
+      return reused;
+    return await startNew(socketPath, scope2);
+  } finally {
+    release();
   }
+}
+async function tryReuse(socketPath, scope2) {
+  if (!existsSync4(socketPath) && platform2() !== "win32")
+    return void 0;
+  const token = await readToken(scope2.runtimeDir);
+  if (!token)
+    return void 0;
+  const reused = await connectExistingHelper(socketPath, token);
+  if (!reused)
+    return void 0;
+  return {
+    client: reused,
+    reused: true,
+    close: async () => {
+      await reused.close();
+    }
+  };
+}
+async function startNew(socketPath, scope2) {
   const token = createHelperToken();
   const started = await startPrivilegedHelper({
     socketPath,
@@ -14017,6 +13689,7 @@ async function openHelperSession(scope2) {
     caddyStoragePath: scope2.caddyStoragePath,
     caddyBin: scope2.caddyBin,
     caddyConfigPath: scope2.caddyConfigPath,
+    reason: scope2.reason,
     log: scope2.log
   });
   await writeToken(scope2.runtimeDir, token);
@@ -14028,6 +13701,22 @@ async function openHelperSession(scope2) {
     }
   };
 }
+async function acquireStartLock(runtimeDir) {
+  const lockPath = join4(runtimeDir, "helper.start.lock");
+  try {
+    await writeFile(lockPath, "", { flag: "a" });
+  } catch {
+  }
+  const release = await lockfile2.lock(lockPath, {
+    realpath: false,
+    stale: 3e4,
+    retries: { retries: 100, minTimeout: 50, maxTimeout: 200 }
+  });
+  return () => {
+    void release().catch(() => {
+    });
+  };
+}
 async function readToken(runtimeDir) {
   try {
     const content = await readFile2(tokenPath(runtimeDir), "utf8");
@@ -14046,7 +13735,7 @@ async function writeToken(runtimeDir, token) {
 
 // src/caddy/privileged.ts
 function resolvePrivilegedEnv() {
-  const moduleDir = typeof __dirname === "string" ? __dirname : dirname2(fileURLToPath(import.meta.url));
+  const moduleDir = typeof __dirname === "string" ? __dirname : dirname3(fileURLToPath(import.meta.url));
   const resolved = resolveHelperEntry({ moduleDir });
   return { helperEntry: resolved.entry, helperArgs: resolved.args };
 }
@@ -14086,7 +13775,7 @@ var HelperCaddyProcess = class extends EventEmitter {
   }
 };
 function caddyStoragePath() {
-  return process6.platform === "win32" ? join5(process6.env.AppData ?? "", "Caddy") : join5(process6.env.HOME ?? "", "Library/Application Support/Caddy");
+  return process7.platform === "win32" ? join5(process7.env.AppData ?? "", "Caddy") : join5(process7.env.HOME ?? "", "Library/Application Support/Caddy");
 }
 function openPrivilegedSession(runtimeDir, options) {
   const env2 = resolvePrivilegedEnv();
@@ -14102,6 +13791,7 @@ function openPrivilegedSession(runtimeDir, options) {
     // execute a path supplied over the socket.
     caddyBin: options.caddyBin,
     caddyConfigPath: options.caddyConfigPath,
+    reason: options.reason,
     log: options.log
   });
 }
@@ -14235,15 +13925,15 @@ async function download() {
     const file = createWriteStream(caddyPath);
     let _platform = platform3().toString();
     _platform === "win32" && (_platform = "windows");
-    let _arch = process7.arch.toString();
+    let _arch = process8.arch.toString();
     _arch === "x64" && (_arch = "amd64");
     const support = supportList.find((item) => item.platform === _platform && item.arch === _arch);
     if (!support)
       return reject2(new Error("not support"));
     const dowmloadLink = `https://caddyserver.com/api/download?os=${support.platform}&arch=${support.arch}&p=github.com%2Fcaddyserver%2Fforwardproxy`;
-    existsSync5(caddyPath) && unlinkSync(caddyPath);
-    const httpProxy = process7.env.HTTP_PROXY || process7.env.http_proxy;
-    const httpsProxy = process7.env.HTTPS_PROXY || process7.env.https_proxy;
+    existsSync5(caddyPath) && unlinkSync2(caddyPath);
+    const httpProxy = process8.env.HTTP_PROXY || process8.env.http_proxy;
+    const httpsProxy = process8.env.HTTPS_PROXY || process8.env.https_proxy;
     const httpAgent = httpProxy ? new HttpProxyAgent(httpProxy) : void 0;
     const httpsAgent = httpsProxy ? new HttpsProxyAgent(httpsProxy) : void 0;
     const chmodCaddyOnce = once(() => {
@@ -14259,7 +13949,7 @@ async function download() {
       chmodCaddyOnce();
     }).pipe(file).on("finish", () => {
       logProgressOver();
-      if (process7.platform === "win32")
+      if (process8.platform === "win32")
         return resolve2(caddyPath);
       chmodSync(caddyPath, 493);
       resolve2(caddyPath);
@@ -14302,43 +13992,35 @@ function splitHostPort(addr) {
   return { host: addr.slice(0, lastColon), port: addr.slice(lastColon + 1) };
 }
 var defaultDependencies = {
-  openSession: (runtimeDir) => openPrivilegedSession(runtimeDir, {
+  openSession: (runtimeDir, reason) => openPrivilegedSession(runtimeDir, {
     log: (message) => consola.debug(message),
     // Both paths are fixed here, before any socket traffic: the privileged
     // helper must never execute something named in a request.
     caddyBin: caddyPath,
-    caddyConfigPath: caddyFilePath
-  })
+    caddyConfigPath: caddyFilePath,
+    reason
+  }),
+  config: () => getCaddyConfig()
 };
 var CaddyInstant = class {
   constructor(deps = {}) {
     this.inited = false;
     this.stoped = false;
-    /** has locked when start */
-    this.locked = false;
     this._stopEffects = [];
+    /** Identifies this instance's routes in the shared config. */
+    this.proxyKey = `${process8.pid}-${Math.random().toString(36).slice(2, 8)}`;
     this.deps = { ...defaultDependencies, ...deps };
-    this.locked = this.checkLock();
-  }
-  checkLock() {
-    if (!existsSync5(caddyLockFilePath))
-      writeFileSync2(caddyLockFilePath, "");
-    try {
-      return lockfile.checkSync(caddyLockFilePath);
-    } catch {
-      return false;
-    }
   }
   /**
    * Connects to the privileged helper, starting it once if needed. It is
    * reused across instances so a second dev server does not ask for a
    * password again.
    */
-  async session() {
+  async session(reason) {
     if (this._session && !this._session.client.connected)
       this._session = void 0;
     if (!this._session)
-      this._session = await this.deps.openSession(TEMP_DIR);
+      this._session = await this.deps.openSession(TEMP_DIR, reason);
     return this._session;
   }
   async getCaddyfile() {
@@ -14351,7 +14033,7 @@ var CaddyInstant = class {
   }
   get caddyRoot() {
     return join6(
-      process7.platform === "win32" ? `${process7.env.AppData}/Caddy` : `${process7.env.HOME}/Library/Application Support/Caddy`,
+      process8.platform === "win32" ? `${process8.env.AppData}/Caddy` : `${process8.env.HOME}/Library/Application Support/Caddy`,
       "./pki/authorities/local"
     );
   }
@@ -14359,7 +14041,7 @@ var CaddyInstant = class {
     return await writeFile2(caddyFilePath, this.caddyfile || "");
   }
   async deleteCaddyfile() {
-    return await unlink3(caddyFilePath);
+    return await unlink(caddyFilePath);
   }
   async init() {
     await download();
@@ -14397,9 +14079,15 @@ Run \`${caddyPath} trust\` manually if the browser warns about the certificate.`
     if (!health.healthy)
       throw new Error(formatTlsHealthFailure(targetHost, health));
   }
+  /**
+   * Regenerates the Caddyfile from the config on disk.
+   *
+   * Reading the file rather than a cached view matters here: another project
+   * may have added its route since this instance last looked.
+   */
   async updateCaddyfile() {
-    const { configJsonRef } = getCaddyConfig();
-    const proxies = Object.values(configJsonRef() || {});
+    const { readProxies } = this.deps.config();
+    const proxies = Object.values(readProxies());
     const ctx = validateTemplateContext({
       caddy_root: this.caddyRoot,
       proxies
@@ -14443,12 +14131,12 @@ Run \`${caddyPath} trust\` manually if the browser warns about the certificate.`
     this._target = target;
     if (!this.inited)
       await this.init();
-    const session = await this.session();
     const sourceHost = splitHostPort(source).host;
     const targetHost = splitHostPort(target).host;
+    const session = await this.session({ target: targetHost, https });
     await session.client.call("hosts.add", { ip: sourceHost, host: targetHost });
     consola.success("update host success\n");
-    const normalizeBase = (b) => {
+    const normalizeBase2 = (b) => {
       let out = b || "/";
       if (!out.startsWith("/"))
         out = `/${out}`;
@@ -14456,7 +14144,7 @@ Run \`${caddyPath} trust\` manually if the browser warns about the certificate.`
         out = `${out}/`;
       return out;
     };
-    const baseNormalized = normalizeBase(base);
+    const baseNormalized = normalizeBase2(base);
     const proxies = [
       {
         target: targetHost,
@@ -14467,27 +14155,12 @@ Run \`${caddyPath} trust\` manually if the browser warns about the certificate.`
         healthCheck
       }
     ];
-    const { writeCaddyConfig } = getCaddyConfig();
-    writeCaddyConfig(proxies);
+    const { writeCaddyConfig } = this.deps.config();
+    await writeCaddyConfig(proxies, this.proxyKey);
     await this.updateCaddyfile();
-    let skipInitialCaddyfileEffect = true;
-    this._stopEffects.push(
-      effect(() => {
-        getCaddyConfig().configJsonRef();
-        if (skipInitialCaddyfileEffect) {
-          skipInitialCaddyfileEffect = false;
-          return;
-        }
-        void this.updateCaddyfile();
-      })
-    );
-    if (!existsSync5(caddyLockFilePath))
-      writeFileSync2(caddyLockFilePath, "");
-    if (!this.locked) {
-      await session.client.call("port.free", { port: 443 });
-      if (process7.platform === "win32" || !https)
-        await session.client.call("port.free", { port: 80 });
-    }
+    await session.client.call("port.free", { port: 443 });
+    if (process8.platform === "win32" || !https)
+      await session.client.call("port.free", { port: 80 });
     return new Promise((resolve2, reject2) => {
       let startupCheckStarted = false;
       const resolveWhenReady = async () => {
@@ -14501,106 +14174,89 @@ Run \`${caddyPath} trust\` manually if the browser warns about the certificate.`
           }
           resolve2();
         } catch (error) {
-          if (!this.locked)
-            await this.baseCleanup(restore);
+          await this.baseCleanup(restore);
           reject2(error);
         }
       };
       const setupCleanup = () => {
-        process7.on("SIGINT", async () => {
+        process8.on("SIGINT", async () => {
           if (this.stoped)
             return;
-          process7.stdin.resume();
+          process8.stdin.resume();
           try {
             await this.baseCleanup(restore);
           } finally {
             this.stoped = true;
-            process7.nextTick(() => {
-              process7.exit();
+            process8.nextTick(() => {
+              process8.exit();
             });
           }
         });
-        const originalExit = process7.exit.bind(process7);
-        process7.exit = async (code) => {
+        const originalExit = process8.exit.bind(process8);
+        process8.exit = async (code) => {
           if (this.stoped)
             return originalExit(code);
-          process7.stdin.resume();
+          process8.stdin.resume();
           try {
             await this.baseCleanup();
           } finally {
             this.stoped = true;
-            process7.nextTick(() => {
+            process8.nextTick(() => {
               originalExit(code);
             });
           }
         };
       };
-      if (!this.locked) {
-        lockfile.lockSync(caddyLockFilePath);
-        setupCleanup();
-        void (async () => {
-          try {
-            const child = new HelperCaddyProcess(session.client);
-            this._caddyChild = child;
-            await session.client.call("caddy.start");
-            child.on("exit", (code) => {
-              if (code !== null && code !== 0)
-                reject2(new Error(`Caddy exited with code ${code}`));
-            });
-            child.stderr.on("data", async (data) => {
-              const lines = data.toString().split("\n").map((line) => line.trim());
-              for (const line of lines) {
-                showCaddyLog && line && console.info(line);
-                if (isCaddyReloadCancellation(line)) {
-                  consola.info("Caddy restarted before TLS issuance completed; retrying.\n");
-                  continue;
-                }
-                try {
-                  if (line.includes("Error:") || line && JSON.parse(line).level === "error") {
-                    if (line.includes("parsing caddyfile tokens")) {
-                      consola.error("Caddyfile syntax error, please contact the author:\n", `${this.caddyfile}
+      setupCleanup();
+      void (async () => {
+        try {
+          const child = new HelperCaddyProcess(session.client);
+          this._caddyChild = child;
+          await session.client.call("caddy.start");
+          child.on("exit", (code) => {
+            if (code !== null && code !== 0)
+              reject2(new Error(`Caddy exited with code ${code}`));
+          });
+          child.stderr.on("data", async (data) => {
+            const lines = data.toString().split("\n").map((line) => line.trim());
+            for (const line of lines) {
+              showCaddyLog && line && console.info(line);
+              if (isCaddyReloadCancellation(line)) {
+                consola.info("Caddy restarted before TLS issuance completed; retrying.\n");
+                continue;
+              }
+              try {
+                if (line.includes("Error:") || line && JSON.parse(line).level === "error") {
+                  if (line.includes("parsing caddyfile tokens")) {
+                    consola.error("Caddyfile syntax error, please contact the author:\n", `${this.caddyfile}
 
 ${line}
 `);
-                      await this.baseCleanup();
-                      process7.exit();
-                    } else {
-                      consola.error(`${line}
+                    await this.baseCleanup();
+                    process8.exit();
+                  } else {
+                    consola.error(`${line}
 `);
-                      return reject2(line);
-                    }
+                    return reject2(line);
                   }
-                } catch {
                 }
-                if (line.includes("config file changed"))
-                  consola.success("Detect added a new reverse proxy config, restarted.\n");
-                if (line.includes("caddy proxying") || line.includes("serving initial"))
-                  void resolveWhenReady();
+              } catch {
               }
-            });
-            child.stdout.on("data", (data) => {
-              consola.info(data.toString());
-              void resolveWhenReady();
-            });
-          } catch (error) {
-            if (!this.locked)
-              await this.baseCleanup(restore);
-            reject2(error);
-          }
-        })();
-      } else {
-        consola.info("Caddy is running in another process.");
-        void (async () => {
-          try {
-            if (https)
-              await this.ensureTlsReady(targetHost);
-            setupCleanup();
-            resolve2();
-          } catch (error) {
-            reject2(error);
-          }
-        })();
-      }
+              if (line.includes("config file changed"))
+                consola.success("Detect added a new reverse proxy config, restarted.\n");
+              if (line.includes("caddy proxying") || line.includes("serving initial"))
+                void resolveWhenReady();
+            }
+          });
+          child.stdout.on("data", (data) => {
+            consola.info(data.toString());
+            void resolveWhenReady();
+          });
+        } catch (error) {
+          await this.baseCleanup(restore);
+          reject2(error);
+        }
+      })();
     });
   }
   async baseCleanup(restore = true) {
@@ -14624,18 +14280,9 @@ ${line}
         consola.fail("Restore host failed.\n");
       }
     }
-    if (!this.locked && !this.stoped) {
-      await this.stopCaddy();
+    if (!this.stoped) {
       try {
-        await lockfile.unlock(caddyLockFilePath).catch(() => {
-        });
-        await unlink3(caddyFilePath).catch(() => {
-        });
-        await unlink3(caddyLockFilePath).catch(() => {
-        });
-        if (caddyConfig) {
-          await caddyConfig.cleanUp();
-        }
+        await this.deps.config().removeProxy(this.proxyKey);
       } catch (e) {
         consola.error(e);
       }
@@ -14647,7 +14294,7 @@ ${line}
 var config;
 var caddy;
 var hmrSseBridgeActive = false;
-var cwd = process8.cwd();
+var cwd = process9.cwd();
 function colorUrl(url2) {
   return c.green(url2.replace(/:(\d+)\//, (_, port) => `:${c.bold(port)}/`));
 }
@@ -14682,16 +14329,27 @@ async function printForwardProxy() {
 }
 var vitePrintUrls = once((options, source, target, base = "/", _printUrls) => {
   _printUrls == null ? void 0 : _printUrls();
+  if (isPrivilegeDenied())
+    return;
   if (caddy)
     return;
-  caddy = new CaddyInstant();
-  caddy.run(source, target, {
+  const instance = new CaddyInstant();
+  caddy = instance;
+  instance.run(source, target, {
     base,
     ...options
   }).then(async () => {
     await printForwardProxy();
     consola.success(`  ${c.green("\u279C")}  ${c.bold("run caddy reverse proxy success")}: ${colorUrl(`${options.https ? "https" : "http"}://${target}${base}`)}`);
   }).catch((e) => {
+    if (caddy === instance)
+      caddy = void 0;
+    if (e instanceof PrivilegeDeniedError) {
+      markPrivilegeDenied();
+      consola.warn("reverse proxy skipped: administrator permission was not granted.");
+      consola.info("Restart the dev server to enable it again.");
+      return;
+    }
     throw e;
   });
 });
@@ -14747,7 +14405,7 @@ var unpluginFactory = (options) => ({
   },
   webpack(compiler) {
     var _a4, _b3, _c2;
-    if (process8.env.NODE_ENV !== "development")
+    if (process9.env.NODE_ENV !== "development")
       return;
     const {
       enable = true,
@@ -14768,9 +14426,11 @@ var unpluginFactory = (options) => ({
       port: 8080,
       ...compiler.options.devServer,
       // @ts-expect-error vuecli
-      ...(_a4 = process8.VUE_CLI_SERVICE) == null ? void 0 : _a4.projectOptions.devServer
+      ...(_a4 = process9.VUE_CLI_SERVICE) == null ? void 0 : _a4.projectOptions.devServer
     };
     const source = `${devServer.host}:${devServer.port}`;
+    if (isPrivilegeDenied())
+      return;
     if (caddy)
       return;
     let base = "/";
@@ -14785,15 +14445,16 @@ var unpluginFactory = (options) => ({
     const _close = (_c2 = compiler.close) == null ? void 0 : _c2.bind(compiler);
     if (_close) {
       compiler.close = async (callback) => {
-        process8.on("exit", () => {
+        process9.on("exit", () => {
           _close && _close(callback);
         });
       };
     } else {
       options.https = false;
     }
-    caddy = new CaddyInstant();
-    caddy.run(source, target, {
+    const instance = new CaddyInstant();
+    caddy = instance;
+    instance.run(source, target, {
       base,
       ...options
     }).then(() => {
@@ -14802,12 +14463,20 @@ var unpluginFactory = (options) => ({
         consola.success(`  ${c.green("\u279C")}  ${c.bold("run caddy reverse proxy success")}: ${colorUrl(`${options.https ? "https" : "http"}://${target}${base}`)}`);
       });
     }).catch((e) => {
+      if (caddy === instance)
+        caddy = void 0;
+      if (e instanceof PrivilegeDeniedError) {
+        markPrivilegeDenied();
+        consola.warn("reverse proxy skipped: administrator permission was not granted.");
+        consola.info("Restart the dev server to enable it again.");
+        return;
+      }
       throw e;
     });
   },
   async rspack(compiler) {
     var _a4, _b3, _c2, _d2;
-    if (process8.env.NODE_ENV !== "development")
+    if (process9.env.NODE_ENV !== "development")
       return;
     const {
       enable = true,
@@ -14832,9 +14501,10 @@ var unpluginFactory = (options) => ({
       }))) == null ? void 0 : _b3.content) == null ? void 0 : _c2.server
     };
     const source = `${devServer.host}:${devServer.port}`;
+    if (isPrivilegeDenied())
+      return;
     if (caddy)
       return;
-    caddy = new CaddyInstant();
     let base = "/";
     const publicPath = (_d2 = compiler.options.output) == null ? void 0 : _d2.publicPath;
     if (typeof publicPath === "string" && publicPath) {
@@ -14844,13 +14514,23 @@ var unpluginFactory = (options) => ({
       base = `/${base}`;
     if (base !== "/" && !base.endsWith("/"))
       base = `${base}/`;
-    caddy.run(source, target, {
+    const instance = new CaddyInstant();
+    caddy = instance;
+    instance.run(source, target, {
       base,
       ...options
     }).then(async () => {
       await printForwardProxy();
       consola.success(`  ${c.green("\u279C")}  ${c.bold("run caddy reverse proxy success")}: ${colorUrl(`${options.https ? "https" : "http"}://${target}${base}`)}`);
     }).catch((e) => {
+      if (caddy === instance)
+        caddy = void 0;
+      if (e instanceof PrivilegeDeniedError) {
+        markPrivilegeDenied();
+        consola.warn("reverse proxy skipped: administrator permission was not granted.");
+        consola.info("Restart the dev server to enable it again.");
+        return;
+      }
       throw e;
     });
   }