localghost 3.2.1__tar.gz → 3.3.0__tar.gz

{localghost-3.2.1 → localghost-3.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: localghost
-Version: 3.2.1
+Version: 3.3.0
 Summary: Localghost serves local applications at friendly .localhost URLs
 Keywords: localghost,localhost,docker,compose,traefik,development,proxy
 Author: SmileyChris

{localghost-3.2.1 → localghost-3.3.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "localghost"
-version = "3.2.1"
+version = "3.3.0"
 description = "Localghost serves local applications at friendly .localhost URLs"
 readme = "README.md"
 requires-python = ">=3.11"

{localghost-3.2.1 → localghost-3.3.0}/src/localghost/cli.py

@@ -16,7 +16,7 @@ import tempfile
 import time
 from collections.abc import Iterator
 from contextlib import contextmanager, suppress
-from dataclasses import dataclass
+from dataclasses import dataclass, replace
 from pathlib import Path
 
 import click
@@ -35,10 +35,12 @@ from .feedback import (
     choices,
     compose_dry_run,
     details,
+    failure,
     info,
     next_actions,
     routes,
     run_plan,
+    sign_off,
     success,
     title,
     warning,
@@ -88,6 +90,9 @@ from .tailscale import (
     TailscaleError,
     TailscaleState,
 )
+from .tailscale import (
+    default_node as default_tailscale_node,
+)
 from .tailscale import (
     delete_credential as delete_tailscale_credential,
 )
@@ -118,7 +123,13 @@ from .tailscale import (
 from .tailscale import (
     validate_suffix as validate_tailscale_suffix,
 )
-from .trust import MkcertInstaller, PublicCertificate, TrustError, ZenNssInstaller
+from .trust import (
+    MkcertInstaller,
+    PublicCertificate,
+    TrustError,
+    ZenNssInstaller,
+    require_mkcert,
+)
 
 LOCALGHOST_VERSION = importlib.metadata.version("localghost")
 TRAEFIK_IMAGE = f"localghost-traefik:v{LOCALGHOST_VERSION}"
@@ -716,6 +727,11 @@ def tailscale_status() -> None:
     _tailscale_status()
 
 
+def _explicit_tailnet_row(tailnet: str) -> list[tuple[str, str]]:
+    """Name the tailnet only when one was chosen; '-' is the credential's own."""
+    return [] if tailnet == "-" else [("Tailnet", tailnet)]
+
+
 def _tailscale_status() -> None:
     try:
         state = load_tailscale_state()
@@ -725,14 +741,10 @@ def _tailscale_status() -> None:
         details([("Tailnet hosting", "disabled")], title="Tailscale status")
         return
     details(
-        [
-            ("Tailnet hosting", "enabled"),
-            ("Tailnet", state.tailnet),
+        [("Tailnet hosting", "enabled")]
+        + _explicit_tailnet_row(state.tailnet)
+        + [
             ("Route suffix", f".{state.suffix}"),
-            (
-                "Tailnet HTTPS",
-                "enabled" if state.https else "HTTP only (public DNS name)",
-            ),
             ("Gateway", ", ".join(state.gateway_ips)),
             ("Gateway health", _tailscale_gateway_health()),
             ("Device tag", state.tag),
@@ -744,12 +756,15 @@ def _tailscale_status() -> None:
         ),
         title="Tailscale status",
     )
+    if not state.https:
+        _public_suffix_notice(state.suffix)
+        return
     root_path = _tailnet_root_path(state.suffix)
-    if state.https and root_path.is_file():
+    if root_path.is_file():
         with suppress(TrustError):
             certificate = PublicCertificate.parse(root_path.read_bytes())
             action(
-                "Trust on other tailnet machines",
+                f"Trust https://*.{state.suffix} on other machines",
                 _share_command(state.suffix, certificate),
             )
 
@@ -869,10 +884,16 @@ def tailscale_enable(
     client_id: str | None,
     client_secret: str | None,
 ) -> None:
-    """Enroll a tagged gateway and add split DNS for the chosen suffix."""
+    """Enroll a tagged gateway and add split DNS for the chosen suffix.
+
+    When tailnet hosting is already enabled, a different suffix, given or
+    detected, moves the routes to it, keeping the same gateway device.
+    """
     title()
-    if load_tailscale_state() is not None:
-        raise click.ClickException("tailnet hosting is already enabled")
+    current = load_tailscale_state()
+    if current is not None:
+        _switch_tailnet_suffix(current, suffix, takeover, client_id, client_secret)
+        return
     localhost_trusted = _https_configured()
     if not tag.startswith("tag:"):
         raise click.UsageError("--tag must start with 'tag:'")
@@ -884,12 +905,12 @@ def tailscale_enable(
             suffix or detect_tailscale_suffix()
         )
         https = not tailscale_suffix_is_public(chosen_suffix)
+        node = default_tailscale_node()
         details(
-            [
-                ("Tailnet", "credential's own tailnet" if tailnet == "-" else tailnet),
+            _explicit_tailnet_row(tailnet)
+            + [
                 ("Route suffix", f".{chosen_suffix}"),
-                ("Tailnet HTTPS", "enabled" if https else "HTTP only"),
-                ("Gateway", f"localghost-{chosen_suffix}"),
+                ("Gateway", f"localghost-{node}"),
                 ("Device tag", tag),
             ],
             title="Tailnet hosting",
@@ -900,40 +921,23 @@ def tailscale_enable(
         api = TailscaleAPI.authenticate(client_id, client_secret)
         info("Reading the existing split-DNS configuration…")
         previous = api.split_dns(tailnet)
-        active = previous.get(chosen_suffix)
-        if active and not takeover:
-            raise click.ClickException(
-                f"split DNS for .{chosen_suffix} already points at "
-                f"{', '.join(active)} — another machine may be hosting this "
-                "suffix. Choose a different --suffix, or pass --takeover to "
-                "replace the mapping."
-            )
-        certificate: PublicCertificate | None = None
-        if https:
-            # Tailnet TLS terminates on Traefik's websecure entrypoint.
-            # Bootstrap its localhost signer as well, but do not install
-            # localhost trust as an implicit side effect of enabling a remote
-            # route.
-            info("Preparing the localhost and tailnet HTTPS authorities…")
-            _bootstrap_public_root()
-            certificate = _bootstrap_tailnet_root(chosen_suffix)
-            # Keep the tailnet root beside the state so `tailscale status` can
-            # repeat the share command without a running gateway.
-            _write_public_root(_tailnet_root_path(chosen_suffix), certificate.pem)
+        _refuse_active_mapping(chosen_suffix, previous, takeover)
+        certificate = _prepare_tailnet_authority(chosen_suffix) if https else None
         # The auth key lives ten minutes; the first gateway image build can
         # take longer, so build before minting the key rather than after.
         info("Preparing the gateway image…")
         _ensure_gateway_image(chosen_suffix)
         info("Creating a single-use gateway auth key…")
         auth_key = api.create_auth_key(tailnet, tag)
-        info(f"Enrolling localghost-{chosen_suffix} in the tailnet…")
-        gateway_ips = _bootstrap_tailscale_gateway(chosen_suffix, auth_key)
+        info(f"Enrolling localghost-{node} in the tailnet…")
+        gateway_ips = _bootstrap_tailscale_gateway(chosen_suffix, node, auth_key)
         state = TailscaleState(
             tailnet=tailnet,
             suffix=chosen_suffix,
             gateway_ips=gateway_ips,
             previous_split_dns=previous,
             tag=tag,
+            node=node,
         )
         save_tailscale_state(state)
         try:
@@ -948,22 +952,143 @@ def tailscale_enable(
             raise
     except (TailscaleError, ValueError) as exc:
         raise click.ClickException(str(exc)) from exc
+    _remember_tailscale_credential(client_id, client_secret)
+    success(f"Tailnet routes are enabled at {_tailnet_url(state, '<project>')}.")
+    _offer_tailnet_trust(chosen_suffix, certificate, localhost_trusted)
+
+
+def _switch_tailnet_suffix(
+    current: TailscaleState,
+    suffix: str | None,
+    takeover: bool,
+    client_id: str | None,
+    client_secret: str | None,
+) -> None:
+    """Move the tailnet routes to another suffix on the same gateway device.
+
+    The gateway keeps its enrollment, addresses, tailnet and tag: only the
+    split-DNS entries move, the suffix's HTTPS root is prepared, and the hub is
+    recreated to answer for the new names.
+    """
+    try:
+        # Without --suffix, detection runs again, so renaming the machine in
+        # the admin console carries its routes to the new name.
+        chosen_suffix = validate_tailscale_suffix(
+            suffix or detect_tailscale_suffix()
+        )
+    except (TailscaleError, ValueError) as exc:
+        if suffix:
+            raise click.ClickException(str(exc)) from exc
+        chosen_suffix = current.suffix
+    if chosen_suffix == current.suffix:
+        raise click.ClickException(
+            f"tailnet hosting is already enabled at .{current.suffix}; pass "
+            "--suffix to move it to another suffix"
+        )
+    old_suffix = current.suffix
+    localhost_trusted = _https_configured()
+    client_id, client_secret = _resolve_tailscale_credential(
+        client_id, client_secret, tag=current.tag
+    )
+    https = not tailscale_suffix_is_public(chosen_suffix)
+    details(
+        [
+            ("Route suffix", f".{old_suffix} → .{chosen_suffix}"),
+            ("Gateway", f"localghost-{current.node_label} (unchanged)"),
+        ],
+        title="Switching tailnet suffix",
+    )
+    if not https:
+        _public_suffix_notice(chosen_suffix)
+    try:
+        info("Authenticating with the Tailscale API…")
+        api = TailscaleAPI.authenticate(client_id, client_secret)
+        info("Reading the existing split-DNS configuration…")
+        previous = api.split_dns(current.tailnet)
+        _refuse_active_mapping(chosen_suffix, previous, takeover)
+        certificate = _prepare_tailnet_authority(chosen_suffix) if https else None
+        state = replace(
+            current,
+            suffix=chosen_suffix,
+            previous_split_dns=previous,
+            node=current.node_label,
+        )
+        save_tailscale_state(state)
+        try:
+            info(f"Routing *.{chosen_suffix} DNS to the gateway…")
+            api.update_split_dns(
+                current.tailnet,
+                {
+                    chosen_suffix: list(current.gateway_ips),
+                    old_suffix: current.previous_split_dns.get(old_suffix),
+                },
+            )
+            info("Starting the mirrored localhost and tailnet routes…")
+            _run_proxy(
+                "up", https_enabled=https or localhost_trusted, force_recreate=True
+            )
+        except Exception:
+            _rollback_switch(api, current, chosen_suffix, previous)
+            raise
+    except (TailscaleError, ValueError) as exc:
+        raise click.ClickException(str(exc)) from exc
+    _remember_tailscale_credential(client_id, client_secret)
+    success(f"Tailnet routes moved to {_tailnet_url(state, '<project>')}.")
+    if current.https:
+        info(
+            f"Machines that trusted the .{old_suffix} root still trust it; run "
+            "`localghost trust remove` on each to revoke."
+        )
+    _offer_tailnet_trust(chosen_suffix, certificate, localhost_trusted)
+
+
+def _refuse_active_mapping(
+    suffix: str, split_dns: dict[str, list[str]], takeover: bool
+) -> None:
+    active = split_dns.get(suffix)
+    if active and not takeover:
+        raise click.ClickException(
+            f"split DNS for .{suffix} already points at "
+            f"{', '.join(active)} — another machine may be hosting this "
+            "suffix. Choose a different --suffix, or pass --takeover to "
+            "replace the mapping."
+        )
+
+
+def _prepare_tailnet_authority(suffix: str) -> PublicCertificate:
+    # Tailnet TLS terminates on Traefik's websecure entrypoint. Bootstrap its
+    # localhost signer as well, but do not install localhost trust as an
+    # implicit side effect of enabling a remote route.
+    info("Preparing the localhost and tailnet HTTPS authorities…")
+    _bootstrap_public_root()
+    certificate = _bootstrap_tailnet_root(suffix)
+    # Keep the tailnet root beside the state so `tailscale status` can repeat
+    # the share command without a running gateway.
+    _write_public_root(_tailnet_root_path(suffix), certificate.pem)
+    return certificate
+
+
+def _remember_tailscale_credential(client_id: str, client_secret: str) -> None:
     if not store_tailscale_credential(client_id, client_secret):
         warning(
             "The OAuth credential was not stored",
             ["no usable system keyring; disable will ask for the credential again"],
         )
-    success(f"Tailnet routes are enabled at {_tailnet_url(state, '<project>')}.")
+
+
+def _offer_tailnet_trust(
+    suffix: str, certificate: PublicCertificate | None, localhost_trusted: bool
+) -> None:
     if certificate is None:
         return
     action(
-        "Trust on other tailnet machines",
-        _share_command(chosen_suffix, certificate),
+        f"Trust https://*.{suffix} on other machines",
+        _share_command(suffix, certificate),
     )
     if localhost_trusted:
         info("Installing the tailnet HTTPS root (sudo may be requested)…")
         try:
-            _install_tailnet_trust(chosen_suffix, show_details=False)
+            _install_tailnet_trust(suffix, show_details=False)
         except click.ClickException as exc:
             warning("Tailnet trust was not installed", [str(exc)])
             action("Trust this client", "localghost trust")
@@ -976,7 +1101,12 @@ def tailscale_enable(
 def _resolve_tailscale_credential(
     client_id: str | None, client_secret: str | None, *, tag: str | None = None
 ) -> tuple[str, str]:
-    """Find the OAuth credential: options, then keyring, then a guided prompt."""
+    """Find the OAuth credential: options, then keyring, then a guided prompt.
+
+    With a tag, the prompt follows enable's full admin-console setup; without
+    one it only names the scope disable uses, since disable deletes the
+    credential afterwards anyway.
+    """
     if not client_id and not client_secret:
         stored = load_tailscale_credential()
         if stored is not None:
@@ -998,6 +1128,11 @@ def _resolve_tailscale_credential(
                 ],
                 title="One-time Tailscale admin-console setup",
             )
+        else:
+            details(
+                [("OAuth client with dns:write", OAUTH_CONSOLE_URL)],
+                title="No OAuth credential is stored in the system keyring",
+            )
     if not client_id:
         client_id = click.prompt("Client id")
     if not client_secret:
@@ -1026,17 +1161,27 @@ def tailscale_disable(client_id: str | None, client_secret: str | None) -> None:
         previous = state.previous_split_dns.get(state.suffix)
         api.update_split_dns(state.tailnet, {state.suffix: previous})
         remove_tailscale_state()
-        delete_tailscale_credential()
+        forgot_credential = delete_tailscale_credential()
         if proxy_is_running():
-            _run_proxy("up", https_enabled=_https_configured(), force_recreate=True)
+            _run_proxy(
+                "up",
+                already_running=True,
+                https_enabled=_https_configured(),
+                force_recreate=True,
+            )
     except TailscaleError as exc:
         raise click.ClickException(str(exc)) from exc
     success("Tailnet DNS was restored and the local gateway was removed.")
+    if forgot_credential:
+        info("The OAuth credential was removed from the system keyring.")
     info(
         f"Machines that trusted the .{state.suffix} root still trust it; run "
         "`localghost trust remove` on each to revoke."
     )
-    info("Remove the offline tagged localghost device in the Tailscale admin console.")
+    info(
+        f"Remove the offline tagged localghost-{state.node_label} device in the "
+        "Tailscale admin console."
+    )
 
 
 @tailscale.command("trust")
@@ -1093,6 +1238,33 @@ def _rollback_enable(
     )
 
 
+def _rollback_switch(
+    api: TailscaleAPI,
+    current: TailscaleState,
+    suffix: str,
+    previous: dict[str, list[str]],
+) -> None:
+    """Return the routes to the old suffix after a late switch failure."""
+    try:
+        api.update_split_dns(
+            current.tailnet,
+            {
+                suffix: previous.get(suffix),
+                current.suffix: previous.get(current.suffix),
+            },
+        )
+    except TailscaleError as exc:
+        warning("Tailnet DNS was not restored", [str(exc)])
+    save_tailscale_state(current)
+    warning(
+        "The switch failed and was rolled back",
+        [
+            f"tailnet routes stay on .{current.suffix}",
+            "run `localghost hub up` to restore them on the running hub",
+        ],
+    )
+
+
 def _tailnet_root_path(suffix: str) -> Path:
     return _state_directory() / f"tailscale-{suffix}-rootCA.pem"
 
@@ -1110,6 +1282,7 @@ def _install_tailnet_trust(
 ) -> None:
     expected = _normalize_fingerprint(expected_fingerprint)
     try:
+        require_mkcert()
         suffix = validate_tailscale_suffix(suffix)
         state = load_tailscale_state()
         gateway_ips = state.gateway_ips if state and state.suffix == suffix else ()
@@ -1131,7 +1304,7 @@ def _install_tailnet_trust(
     if show_details:
         details(
             [
-                ("Authorization", "system authorization is required now"),
+                ("Authorization", "sudo password may be requested for system trust"),
                 ("Scope", f"development names under .{suffix}"),
                 ("Public-root fingerprint", certificate.fingerprint),
                 ("Private keys", "remain on the hosting machine"),
@@ -1326,10 +1499,9 @@ def run(
         secondary_origin=_tailnet_origin(plan.name),
         status_bar=not no_status_bar,
     )
+    _report_application_exit(plan.name, status)
     if status:
-        _report_application_exit(status)
         raise click.exceptions.Exit(status)
-    success("Application stopped.")
 
 
 def _report_live_session(session: Session, *, refuse: bool) -> None:
@@ -1537,7 +1709,7 @@ def _run_compose(
         bar.status("starting")
         result = subprocess.run(command, cwd=cwd, check=False)
     if result.returncode:
-        _report_application_exit(result.returncode)
+        _report_application_exit(project, result.returncode)
         raise click.exceptions.Exit(result.returncode)
     if detach:
         log = _session_log_path(project)
@@ -1554,20 +1726,20 @@ def _run_compose(
         success(f"Started detached Compose session for {project}.")
 
 
-def _report_application_exit(status: int) -> None:
+def _report_application_exit(name: str, status: int) -> None:
     """Leave a stable diagnosis after the transient status display is gone."""
-    warning(
-        "Application exited",
-        [
-            f"The application command exited with status {status}.",
-            "Its output is above; use --no-status-bar for plain terminal output.",
-        ],
-    )
+    sign_off()
+    if status in (0, 128 + signal.SIGINT):
+        # Ctrl+C is how a foreground run is meant to end, not a failure.
+        success(f"Stopped {name}.")
+        return
+    failure(f"{name} exited with status {status}.")
 
 
 def _print_run_plan(plan: RunPlan, dry_run: bool, detach: bool = False) -> None:
     public_origin = _proxy_origin(plan.name)
     run_plan(
+        name=plan.name,
         type=plan.type,
         command=plan.command,
         port=plan.port,
@@ -1764,6 +1936,7 @@ def _run_proxy(
             environment["LOCALGHOST_IMAGE_TAG"] = f"v{LOCALGHOST_VERSION}"
             if tailscale_state is not None:
                 environment["LOCALGHOST_TAILSCALE_SUFFIX"] = tailscale_state.suffix
+                environment["LOCALGHOST_TAILSCALE_NODE"] = tailscale_state.node_label
                 # The tailnet overlay owns Traefik's command, so it also has
                 # to be told which CA providers have a signer to run with.
                 environment["LOCALGHOST_LOCALHOST_CA_MODE"] = (
@@ -1927,7 +2100,9 @@ def _ensure_gateway_image(suffix: str) -> None:
         raise TailscaleError(detail or "could not build the gateway image")
 
 
-def _bootstrap_tailscale_gateway(suffix: str, auth_key: str) -> tuple[str, ...]:
+def _bootstrap_tailscale_gateway(
+    suffix: str, node: str, auth_key: str
+) -> tuple[str, ...]:
     with _proxy_resource_directory() as resource_root:
         command = [
             "docker",
@@ -1946,13 +2121,14 @@ def _bootstrap_tailscale_gateway(suffix: str, auth_key: str) -> tuple[str, ...]:
             "-T",
             "tailscale-gateway",
             f"--suffix={suffix}",
-            f"--hostname=localghost-{suffix}",
+            f"--hostname=localghost-{node}",
             "--state-dir=/var/lib/localghost-tailscale",
             "--bootstrap",
         ]
         environment = os.environ.copy()
         environment["LOCALGHOST_IMAGE_TAG"] = f"v{LOCALGHOST_VERSION}"
         environment["LOCALGHOST_TAILSCALE_SUFFIX"] = suffix
+        environment["LOCALGHOST_TAILSCALE_NODE"] = node
         try:
             result = subprocess.run(
                 command,
@@ -2061,6 +2237,10 @@ def _detect_root_rotation(certificate: PublicCertificate) -> bool:
 
 
 def _enable_https() -> None:
+    try:
+        require_mkcert()
+    except TrustError as exc:
+        raise click.ClickException(str(exc)) from exc
     was_configured = _https_configured()
     certificate = _bootstrap_public_root()
     certificate_path = _public_root_path()

{localghost-3.2.1 → localghost-3.3.0}/src/localghost/feedback.py

@@ -9,7 +9,6 @@ from pathlib import Path
 
 from rich import box
 from rich.console import Console
-from rich.panel import Panel
 from rich.table import Table
 from rich.text import Text
 
@@ -34,12 +33,25 @@ def title(*, welcome: bool = False) -> None:
         return
     _wordmark_shown = True
     console = _console(False)
-    console.print(Text.assemble(("local", "bold"), ("ghost", f"bold {LIME}")))
+    console.print(_wordmark())
     console.print()
     if welcome:
         console.print("Easy .localhost URLs for your local apps.")
 
 
+def sign_off() -> None:
+    """Mark where localghost speaks again after an application's own output."""
+    if not _rich_terminal(False):
+        return
+    console = _console(False)
+    console.print()
+    console.print(_wordmark())
+
+
+def _wordmark() -> Text:
+    return Text.assemble(("local", "bold"), ("ghost", f"bold {LIME}"))
+
+
 def next_actions(*, https_enabled: bool) -> None:
     """Show useful commands after a successful hub launch."""
     action("Stop the hub", "uvx localghost hub down")
@@ -137,32 +149,42 @@ def success(message: str, *, err: bool = False) -> None:
     _message(message, LIME, err=err, symbol="✓")
 
 
+def failure(message: str) -> None:
+    _message(message, "red", err=True, symbol="✗")
+
+
 def warning(title: str, messages: Iterable[str]) -> None:
     items = list(messages)
     if _rich_terminal(True):
-        body = Text("\n".join(f"• {message}" for message in items))
-        _console(True).print(Panel(body, title=title, border_style="yellow"))
+        console = _console(True)
+        console.print(Text(title, style="bold yellow"))
+        for message in items:
+            console.print(Text.assemble(("• ", "yellow"), message))
         return
     for message in items:
         _console(True).print(f"Warning: {title}: {message}", soft_wrap=True)
 
 
-def _labeled_block(rows: list[tuple[str, str]], *, title: str, err: bool) -> None:
-    """Render label/value rows under a title, as a Panel or a plain heading."""
+def _labeled_block(rows: list[tuple[str, str]], *, heading: str, err: bool) -> None:
+    """Render label/value rows under a heading, marked by a mint accent bar."""
     if _rich_terminal(err):
+        console = _console(err)
+        console.print(Text.assemble(("▌ ", MINT), (heading, "bold")))
         table = Table.grid(padding=(0, 1))
+        table.add_column(style=MINT)
         table.add_column(style="bold")
         table.add_column()
         for label, value in rows:
-            table.add_row(label, value)
-        _console(err).print(Panel(table, title=title, border_style=MINT))
+            table.add_row("▌", label, value)
+        console.print(table)
         return
-    lines = [f"{title}:", *(f"  {label}: {value}" for label, value in rows)]
+    lines = [heading, *(f"  {label}: {value}" for label, value in rows)]
     _console(err).print("\n".join(lines), soft_wrap=True)
 
 
 def run_plan(
     *,
+    name: str,
     type: str,
     command: tuple[str, ...],
     port: int,
@@ -171,7 +193,7 @@ def run_plan(
     project_root: Path | None = None,
     working_directory: Path | None = None,
 ) -> None:
-    rows = [("Type", type)]
+    rows = []
     if project_root:
         rows.append(("Project root", str(project_root)))
     if working_directory and working_directory != project_root:
@@ -183,18 +205,22 @@ def run_plan(
             ("Public URL", url),
         ]
     )
-    title = "Dry run" if dry_run else "Run configuration"
-    _labeled_block(rows, title=title, err=dry_run)
+    heading = f"Dry run: {name}" if dry_run else f"Running {name}"
+    # A custom command says nothing as a type; the Command row shows it.
+    if type != "custom":
+        heading += f" ({type})"
+    _labeled_block(rows, heading=heading, err=dry_run)
 
 
 def compose_dry_run(*, project: str, url: str) -> None:
     """The Compose analogue of `run_plan`'s dry-run block.
 
     Compose owns its own port and command, so those rows never apply here;
-    only the type, the project name, and the public URL are meaningful.
+    only the project name and the public URL are meaningful.
     """
-    rows = [("Type", "compose"), ("Project", project), ("Public URL", url)]
-    _labeled_block(rows, title="Dry run", err=True)
+    _labeled_block(
+        [("Public URL", url)], heading=f"Dry run: {project} (compose)", err=True
+    )
 
 
 def routes(items: Iterable[tuple[str, str]]) -> None: