navig-devhost 0.1.0__tar.gz

navig_devhost-0.1.0/LICENSE

@@ -0,0 +1,173 @@
+Apache License
+Version 2.0, January 2004
+http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction,
+and distribution as defined by Sections 1 through 9 of this document.
+
+"Licensor" shall mean the copyright owner or entity authorized by
+the copyright owner that is granting the License.
+
+"Legal Entity" shall mean the union of the acting entity and all
+other entities that control, are controlled by, or are under common
+control with that entity. For the purposes of this definition,
+"control" means (i) the power, direct or indirect, to cause the
+direction or management of such entity, whether by contract or
+otherwise, or (ii) ownership of fifty percent (50%) or more of the
+outstanding shares, or (iii) beneficial ownership of such entity.
+
+"You" (or "Your") shall mean an individual or Legal Entity
+exercising permissions granted by this License.
+
+"Source" form shall mean the preferred form for making modifications,
+including but not limited to software source code, documentation
+source, and configuration files.
+
+"Object" form shall mean any form resulting from mechanical
+transformation or translation of a Source form, including but
+not limited to compiled object code, generated documentation,
+and conversions to other media types.
+
+"Work" shall mean the work of authorship, whether in Source or
+Object form, made available under the License, as indicated by a
+copyright notice that is included in or attached to the work
+(an example is provided in the Appendix below).
+
+"Derivative Works" shall mean any work, whether in Source or Object
+form, that is based on (or derived from) the Work and for which the
+editorial revisions, annotations, elaborations, or other modifications
+represent, as a whole, an original work of authorship. For the purposes
+of this License, Derivative Works shall not include works that remain
+separable from, or merely link (or bind by name) to the interfaces of,
+the Work and Derivative Works thereof.
+
+"Contribution" shall mean any work of authorship, including
+the original version of the Work and any modifications or additions
+to that Work or Derivative Works thereof, that is intentionally
+submitted to Licensor for inclusion in the Work by the copyright owner
+or by an individual or Legal Entity authorized to submit on behalf of
+the copyright owner. For the purposes of this definition, "submitted"
+means any form of electronic, verbal, or written communication sent
+to the Licensor or its representatives, including but not limited to
+communication on electronic mailing lists, source code control systems,
+and issue tracking systems that are managed by, or on behalf of, the
+Licensor for the purpose of discussing and improving the Work, but
+excluding communication that is conspicuously marked or otherwise
+designated in writing by the copyright owner as "Not a Contribution."
+
+"Contributor" shall mean Licensor and any individual or Legal Entity
+on behalf of whom a Contribution has been received by Licensor and
+subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+this License, each Contributor hereby grants to You a perpetual,
+worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+copyright license to reproduce, prepare Derivative Works of,
+publicly display, publicly perform, sublicense, and distribute the
+Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+this License, each Contributor hereby grants to You a perpetual,
+worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+(except as stated in this section) patent license to make, have made,
+use, offer to sell, sell, import, and otherwise transfer the Work,
+where such license applies only to those patent claims licensable
+by such Contributor that are necessarily infringed by their
+Contribution(s) alone or by combination of their Contribution(s)
+with the Work to which such Contribution(s) was submitted. If You
+institute patent litigation against any entity (including a
+cross-claim or counterclaim in a lawsuit) alleging that the Work
+or a Contribution incorporated within the Work constitutes direct
+or contributory patent infringement, then any patent licenses
+granted to You under this License for that Work shall terminate
+as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+Work or Derivative Works thereof in any medium, with or without
+modifications, and in Source or Object form, provided that You
+meet the following conditions:
+
+(a) You must give any other recipients of the Work or
+Derivative Works a copy of this License; and
+
+(b) You must cause any modified files to carry prominent notices
+stating that You changed the files; and
+
+(c) You must retain, in the Source form of any Derivative Works
+that You distribute, all copyright, patent, trademark, and
+attribution notices from the Source form of the Work,
+excluding those notices that do not pertain to any part of
+the Derivative Works; and
+
+(d) If the Work includes a "NOTICE" text file as part of its
+distribution, then any Derivative Works that You distribute must
+include a readable copy of the attribution notices contained
+within such NOTICE file, excluding those notices that do not
+pertain to any part of the Derivative Works, in at least one
+of the following places: within a NOTICE text file distributed
+as part of the Derivative Works; within the Source form or
+documentation, if provided along with the Derivative Works; or,
+within a display generated by the Derivative Works, if and
+wherever such third-party notices normally appear. The contents
+of the NOTICE file are for informational purposes only and
+do not modify the License. You may add Your own attribution
+notices within Derivative Works that You distribute, alongside
+or as an addendum to the NOTICE text from the Work, provided
+that such additional attribution notices cannot be construed
+as modifying the License.
+
+You may add Your own copyright statement to Your modifications and
+may provide additional or different license terms and conditions
+for use, reproduction, or distribution of Your modifications, or
+for any such Derivative Works as a whole, provided Your use,
+reproduction, and distribution of the Work otherwise complies with
+the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+any Contribution intentionally submitted for inclusion in the Work
+by You to the Licensor shall be under the terms and conditions of
+this License, without any additional terms or conditions.
+
+6. Trademarks. This License does not grant permission to use the trade
+names, trademarks, service marks, or product names of the Licensor,
+except as required for reasonable and customary use in describing the
+origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+agreed to in writing, Licensor provides the Work (and each
+Contributor provides its Contributions) on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+implied, including, without limitation, any warranties or conditions
+of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+PARTICULAR PURPOSE. You are solely responsible for determining the
+appropriateness of using or redistributing the Work and assume any
+risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+whether in tort (including negligence), contract, or otherwise,
+unless required by applicable law (such as deliberate and grossly
+negligent acts) or agreed to in writing, shall any Contributor be
+liable to You for damages, including any direct, indirect, special,
+incidental, or consequential damages of any character arising as a
+result of this License or out of the use or inability to use the
+Work (including but not limited to damages for loss of goodwill,
+work stoppage, computer failure or malfunction, or any and all
+other commercial damages or losses), even if such Contributor
+has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+the Work or Derivative Works thereof, You may choose to offer,
+and charge a fee for, acceptance of support, warranty, indemnity,
+or other liability obligations and/or rights consistent with this
+License. However, in accepting such obligations, You may act only
+on Your own behalf and on Your sole responsibility, not on behalf
+of any other Contributor, and only if You agree to indemnify,
+defend, and hold each Contributor harmless for any liability
+incurred by, or claims asserted against, such Contributor by reason
+of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS

navig_devhost-0.1.0/PKG-INFO

@@ -0,0 +1,89 @@
+Metadata-Version: 2.4
+Name: navig-devhost
+Version: 0.1.0
+Summary: NAVIG Dev Host module — give any local dev server a real .test domain over trusted HTTPS in one command (hosts + mkcert + raw TLS relay), wired into `navig devhost`. A first-party navig plugin (free, toggleable).
+Author-email: NAVIG Development Team <opensource@navig.run>
+License-Expression: Apache-2.0
+Project-URL: Homepage, https://navig.run
+Project-URL: Documentation, https://navig.run/docs
+Keywords: navig,cli,agent,automation,plugin,devhost,https,tls,mkcert,localhost,dns
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Utilities
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: navig>=3.24.0
+Dynamic: license-file
+
+# navig-devhost
+
+**Local `.test` domains with trusted HTTPS for any dev server — one command, any project.**
+
+Turn `http://localhost:7645` into **`https://cybesis.test`** without per-project proxy scripts.
+A first-party [navig](../../README.md) plugin (free, toggleable) that wires together the three
+pieces every local dev domain needs:
+
+1. a **hosts entry** on a dedicated loopback (coexists with your other `.test` sites on `:443`),
+2. a **trusted mkcert certificate** (real padlock, no browser warnings),
+3. a **raw TLS relay** in front of your plain-HTTP dev server.
+
+No Playwright/nginx/Caddy — the relay is pure stdlib `ssl`/`socket`, and it terminates TLS then
+pipes bytes verbatim, so keep-alive, SSE, and **WebSocket/HMR pass through untouched**.
+
+## Install
+
+```bash
+py -3.13 -m pip install -e plugins/navig-devhost   # into navig's Python (Windows)
+python3 -m pip install -e plugins/navig-devhost     # macOS/Linux
+navig plugin list          # → navig-devhost … + wired
+navig devhost doctor       # check mkcert + admin
+```
+
+Prereq: [mkcert](https://github.com/FiloSottile/mkcert) (`winget install FiloSottile.mkcert`), then
+`mkcert -install` once so its CA is trusted.
+
+## Use
+
+```bash
+# 1) register (adds hosts entry on next free 127.0.0.x + issues a cert) — needs admin
+navig devhost add cybesis.test --port 7645
+
+# 2) start your dev server however you normally do (→ http://localhost:7645)
+
+# 3) run the relay (foreground; Ctrl+C to stop)
+navig devhost up cybesis.test        # or: navig devhost up   (serves all registered)
+#  🔒 https://cybesis.test  →  http://127.0.0.1:7645
+```
+
+Open **https://cybesis.test**.
+
+## Commands
+
+| Command | What it does |
+|---|---|
+| `navig devhost add <domain> --port N` | Register: dedicated loopback + hosts entry + mkcert cert. `--ip`, `--no-tls`, `--target-host`. |
+| `navig devhost up [domain] [--all]` | Run the HTTPS relay (foreground). No domain → all registered. |
+| `navig devhost list` / `status` | Table: hosts ok · cert ok · dev-server up · currently serving. |
+| `navig devhost remove <domain>` | Remove hosts entry + cert + registry record. `--keep-cert`. |
+| `navig devhost doctor` | Check mkcert, its CA, and admin for hosts edits. |
+
+Everything supports `--json` for scripting.
+
+## Notes / gotchas
+
+- **Dedicated loopback per site** (`127.0.0.2`, `.3`, …) so each `.test` can own `:443` and coexist —
+  matching the established house convention. `add` auto-picks the next free one.
+- **Admin** is needed only for `add`/`remove` (they edit the system hosts file). `up`/`list`/`status`
+  need no elevation — Windows doesn't gate ports < 1024.
+- **Next.js dev**: to silence the cross-origin dev warning under the new host, add
+  `allowedDevOrigins: ['<domain>']` to `next.config.js`. (Vite needs nothing.)
+- State lives in `<navig config>/devhost/` (`registry.json` + `certs/`).
+
+<sub>First-party navig plugin · Apache-2.0 · reuses navig's hosts plumbing; zero Python deps.</sub>

navig_devhost-0.1.0/README.md

@@ -0,0 +1,65 @@
+# navig-devhost
+
+**Local `.test` domains with trusted HTTPS for any dev server — one command, any project.**
+
+Turn `http://localhost:7645` into **`https://cybesis.test`** without per-project proxy scripts.
+A first-party [navig](../../README.md) plugin (free, toggleable) that wires together the three
+pieces every local dev domain needs:
+
+1. a **hosts entry** on a dedicated loopback (coexists with your other `.test` sites on `:443`),
+2. a **trusted mkcert certificate** (real padlock, no browser warnings),
+3. a **raw TLS relay** in front of your plain-HTTP dev server.
+
+No Playwright/nginx/Caddy — the relay is pure stdlib `ssl`/`socket`, and it terminates TLS then
+pipes bytes verbatim, so keep-alive, SSE, and **WebSocket/HMR pass through untouched**.
+
+## Install
+
+```bash
+py -3.13 -m pip install -e plugins/navig-devhost   # into navig's Python (Windows)
+python3 -m pip install -e plugins/navig-devhost     # macOS/Linux
+navig plugin list          # → navig-devhost … + wired
+navig devhost doctor       # check mkcert + admin
+```
+
+Prereq: [mkcert](https://github.com/FiloSottile/mkcert) (`winget install FiloSottile.mkcert`), then
+`mkcert -install` once so its CA is trusted.
+
+## Use
+
+```bash
+# 1) register (adds hosts entry on next free 127.0.0.x + issues a cert) — needs admin
+navig devhost add cybesis.test --port 7645
+
+# 2) start your dev server however you normally do (→ http://localhost:7645)
+
+# 3) run the relay (foreground; Ctrl+C to stop)
+navig devhost up cybesis.test        # or: navig devhost up   (serves all registered)
+#  🔒 https://cybesis.test  →  http://127.0.0.1:7645
+```
+
+Open **https://cybesis.test**.
+
+## Commands
+
+| Command | What it does |
+|---|---|
+| `navig devhost add <domain> --port N` | Register: dedicated loopback + hosts entry + mkcert cert. `--ip`, `--no-tls`, `--target-host`. |
+| `navig devhost up [domain] [--all]` | Run the HTTPS relay (foreground). No domain → all registered. |
+| `navig devhost list` / `status` | Table: hosts ok · cert ok · dev-server up · currently serving. |
+| `navig devhost remove <domain>` | Remove hosts entry + cert + registry record. `--keep-cert`. |
+| `navig devhost doctor` | Check mkcert, its CA, and admin for hosts edits. |
+
+Everything supports `--json` for scripting.
+
+## Notes / gotchas
+
+- **Dedicated loopback per site** (`127.0.0.2`, `.3`, …) so each `.test` can own `:443` and coexist —
+  matching the established house convention. `add` auto-picks the next free one.
+- **Admin** is needed only for `add`/`remove` (they edit the system hosts file). `up`/`list`/`status`
+  need no elevation — Windows doesn't gate ports < 1024.
+- **Next.js dev**: to silence the cross-origin dev warning under the new host, add
+  `allowedDevOrigins: ['<domain>']` to `next.config.js`. (Vite needs nothing.)
+- State lives in `<navig config>/devhost/` (`registry.json` + `certs/`).
+
+<sub>First-party navig plugin · Apache-2.0 · reuses navig's hosts plumbing; zero Python deps.</sub>

navig_devhost-0.1.0/navig_devhost/__init__.py

@@ -0,0 +1,9 @@
+"""navig-devhost — local dev domains with trusted HTTPS, from `navig devhost`.
+
+Give any local dev server a real `.test` domain over trusted HTTPS in one command:
+`navig devhost add cybesis.test --port 7645` then `navig devhost up`. A first-party
+navig plugin (free, toggleable). Hosts entry + mkcert cert + a raw TLS relay — no
+per-project proxy scripts.
+"""
+
+__version__ = "0.1.0"

navig_devhost-0.1.0/navig_devhost/commands/__init__.py

@@ -0,0 +1 @@
+"""navig-devhost CLI commands."""

navig_devhost-0.1.0/navig_devhost/commands/devhost.py

@@ -0,0 +1,305 @@
+"""navig devhost — local dev domains with trusted HTTPS.
+
+Give any local dev server a real `.test` domain over trusted HTTPS in one command:
+
+    navig devhost add cybesis.test --port 7645
+    navig devhost up                 # → https://cybesis.test
+
+devhost adds the hosts entry (on a dedicated loopback, coexisting with your other
+.test sites), issues a trusted mkcert certificate, and runs a raw TLS relay in
+front of your plain-HTTP dev server. No per-project proxy scripts.
+"""
+
+from __future__ import annotations
+
+import json as _json
+import time
+from pathlib import Path
+from typing import Optional
+
+import typer
+from rich.console import Console
+from rich.panel import Panel
+from rich.table import Table
+
+from navig_devhost.engine import certs, hosts, net
+from navig_devhost.engine.paths import registry_path
+from navig_devhost.engine.proxy import Relay, Site
+from navig_devhost.engine.registry import DevHost, JsonReadError, Registry
+
+console = Console()
+err = Console(stderr=True)
+
+devhost_app = typer.Typer(
+    name="devhost",
+    help="🌐 Dev Host: local .test domains with trusted HTTPS for any dev server.",
+    no_args_is_help=True,
+)
+
+
+# ── helpers ─────────────────────────────────────────────────────────────────
+def _now() -> str:
+    return time.strftime("%Y-%m-%dT%H:%M:%S")
+
+
+def _load_for_write(json_out: bool) -> Registry:
+    """Load the registry for a read-MODIFY-write (add / remove).
+
+    Refuses to continue if registry.json exists but is transiently unreadable —
+    saving after a failed read would persist an empty registry over every other
+    host (the config-wipe class). The read-only views use ``Registry.load()``.
+    """
+    try:
+        return Registry.load_for_update()
+    except JsonReadError as e:
+        _fail(json_out, f"registry unreadable — not saving, to avoid wiping hosts: {e}")
+        raise typer.Exit(2) from e
+
+
+def _sites_from(entries: list[DevHost]) -> tuple[list[Site], list[str]]:
+    """Build relay Sites from registry entries; collect skip reasons."""
+    sites, skipped = [], []
+    for dh in entries:
+        if not dh.tls:
+            skipped.append(f"{dh.domain}: TLS disabled")
+            continue
+        if not dh.cert or not dh.key or not Path(dh.cert).exists() or not Path(dh.key).exists():
+            skipped.append(f"{dh.domain}: cert missing (re-run `navig devhost add {dh.domain}`)")
+            continue
+        sites.append(Site(dh.domain, dh.ip, dh.https_port, dh.target_host, dh.target_port, dh.cert, dh.key))
+    return sites, skipped
+
+
+# ── add ─────────────────────────────────────────────────────────────────────
+@devhost_app.command()
+def add(
+    domain: str = typer.Argument(..., help="The .test domain, e.g. cybesis.test"),
+    port: int = typer.Option(..., "--port", "-p", help="Dev server port to proxy to."),
+    ip: Optional[str] = typer.Option(None, "--ip", help="Loopback IP (default: next free 127.0.0.x)."),
+    target_host: str = typer.Option("127.0.0.1", "--target-host", help="Where the dev server listens."),
+    tls: bool = typer.Option(True, "--tls/--no-tls", help="Issue an mkcert cert and serve HTTPS."),
+    json_out: bool = typer.Option(False, "--json", help="Emit JSON."),
+) -> None:
+    """Register a dev domain: hosts entry + (optional) trusted cert."""
+    domain = domain.strip().lower()
+    reg = _load_for_write(json_out)
+
+    # resolve the loopback IP: explicit → existing hosts mapping → existing registry → next free
+    used_ips = [d.ip for d in reg.all()]
+    if ip:
+        chosen_ip = ip
+    elif (existing := hosts.entry_for(domain)):
+        chosen_ip = existing
+    elif reg.get(domain):
+        chosen_ip = reg.get(domain).ip  # type: ignore[union-attr]
+    else:
+        chosen_ip = net.next_free_loopback(hosts.read(), *used_ips)
+
+    # hosts entry (idempotent; needs admin only if a write is required)
+    hres = hosts.add(chosen_ip, domain)
+    if not hres.ok:
+        _fail(json_out, f"hosts: {hres.message}")
+        raise typer.Exit(2)
+
+    # certificate
+    cert = key = None
+    cert_msg = "TLS disabled"
+    if tls:
+        cres = certs.generate(domain, chosen_ip)
+        if not cres.ok:
+            _fail(json_out, f"cert: {cres.message}")
+            raise typer.Exit(2)
+        cert, key, cert_msg = cres.cert, cres.key, cres.message
+        if not certs.ca_installed():
+            (err if not json_out else console).print(
+                "[yellow]![/yellow] mkcert CA not detected — run [cyan]mkcert -install[/cyan] once so browsers trust it."
+            )
+
+    dh = DevHost(
+        domain=domain, ip=chosen_ip, target_host=target_host, target_port=port,
+        tls=tls, cert=cert, key=key, created=(reg.get(domain).created if reg.get(domain) else _now()),
+    )
+    reg.put(dh)
+    reg.save()
+
+    if json_out:
+        console.print_json(_json.dumps({"ok": True, "domain": domain, "ip": chosen_ip,
+                                        "url": dh.url, "target": dh.target, "tls": tls, "cert": cert}))
+        return
+    console.print(Panel.fit(
+        f"[bold]{dh.url}[/bold]  →  {dh.target}\n"
+        f"[dim]{chosen_ip}  ·  {hres.message}  ·  {cert_msg}[/dim]",
+        title="devhost added", border_style="green",
+    ))
+    console.print(f"Start it:  [cyan]navig devhost up {domain}[/cyan]   (run your dev server on :{port} first)")
+
+
+# ── list ────────────────────────────────────────────────────────────────────
+@devhost_app.command("list")
+def list_cmd(json_out: bool = typer.Option(False, "--json", help="Emit JSON.")) -> None:
+    """List registered dev domains and their live status."""
+    reg = Registry.load()
+    entries = reg.all()
+    if json_out:
+        console.print_json(_json.dumps({"domains": [
+            {"domain": d.domain, "url": d.url, "ip": d.ip, "target": d.target, "tls": d.tls,
+             "hosts_ok": hosts.entry_for(d.domain) == d.ip,
+             "cert_ok": bool(d.cert and Path(d.cert).exists()),
+             "target_up": net.target_reachable(d.target_host, d.target_port),
+             "serving": not net.can_bind(d.ip, d.https_port)} for d in entries]}))
+        return
+    if not entries:
+        console.print("[dim]No dev domains yet.[/dim]  Add one:  [cyan]navig devhost add app.test --port 3000[/cyan]")
+        return
+    table = Table(title="devhost domains", header_style="bold cyan")
+    for col in ("Domain", "URL", "→ Target", "Hosts", "Cert", "Dev up", "Serving"):
+        table.add_column(col)
+    for d in entries:
+        table.add_row(
+            d.domain, d.url, d.target,
+            _yn(hosts.entry_for(d.domain) == d.ip),
+            _yn(bool(d.cert and Path(d.cert).exists())) if d.tls else "[dim]—[/dim]",
+            _yn(net.target_reachable(d.target_host, d.target_port)),
+            _yn(not net.can_bind(d.ip, d.https_port)),
+        )
+    console.print(table)
+
+
+# ── up ──────────────────────────────────────────────────────────────────────
+@devhost_app.command()
+def up(
+    domain: Optional[str] = typer.Argument(None, help="Domain to serve (default: all registered)."),
+    all_: bool = typer.Option(False, "--all", help="Serve every registered domain."),
+) -> None:
+    """Run the HTTPS relay (foreground). Ctrl+C to stop."""
+    reg = Registry.load()
+    if domain:
+        dh = reg.get(domain.strip().lower())
+        if not dh:
+            err.print(f"[red]✗[/red] '{domain}' is not registered. Add it:  navig devhost add {domain} --port <PORT>")
+            raise typer.Exit(2)
+        entries = [dh]
+    else:
+        entries = reg.all()
+        if not entries:
+            err.print("[red]✗[/red] no domains registered. Add one:  navig devhost add app.test --port 3000")
+            raise typer.Exit(2)
+
+    sites, skipped = _sites_from(entries)
+    for reason in skipped:
+        err.print(f"[yellow]skip[/yellow] {reason}")
+    if not sites:
+        err.print("[red]✗[/red] nothing to serve (no TLS domains with valid certs).")
+        raise typer.Exit(2)
+
+    relay = Relay(sites, on_log=lambda m: console.print(m))
+    console.print(Panel.fit("devhost relay — [dim]Ctrl+C to stop[/dim]", border_style="cyan"))
+    errors = relay.start()
+    for e in errors:
+        err.print(f"[red]✗[/red] {e}")
+    if len(errors) == len(sites):
+        raise typer.Exit(1)
+    for s in sites:
+        if not net.target_reachable(s.target_host, s.target_port):
+            err.print(f"[yellow]![/yellow] {s.domain}: dev server not up yet on :{s.target_port} "
+                      f"— start it; the relay is ready and will connect on reload.")
+    relay.serve_forever()
+    console.print("\n[dim]devhost relay stopped.[/dim]")
+
+
+# ── status ──────────────────────────────────────────────────────────────────
+@devhost_app.command()
+def status(json_out: bool = typer.Option(False, "--json", help="Emit JSON.")) -> None:
+    """One-line health per domain (hosts · cert · dev-up · serving)."""
+    list_cmd(json_out=json_out)
+
+
+# ── remove ──────────────────────────────────────────────────────────────────
+@devhost_app.command()
+def remove(
+    domain: str = typer.Argument(..., help="Domain to remove."),
+    keep_cert: bool = typer.Option(False, "--keep-cert", help="Leave the mkcert files on disk."),
+    json_out: bool = typer.Option(False, "--json", help="Emit JSON."),
+) -> None:
+    """Remove a dev domain: hosts entry + cert + registry record."""
+    domain = domain.strip().lower()
+    reg = _load_for_write(json_out)
+    dh = reg.get(domain)
+
+    hres = hosts.remove(domain)
+    if not hres.ok:
+        # The hosts entry could not be removed (needs admin, or a write error) — do NOT
+        # delete the cert files or drop the registry record. Tearing those down while the
+        # live hosts entry survives orphans the domain (it still resolves to the loopback)
+        # and throws away the state needed to retry. `add` aborts on a hosts failure too;
+        # remove must mirror it. Re-run in an elevated terminal to complete the removal.
+        _fail(json_out, f"hosts: {hres.message}")
+        raise typer.Exit(2)
+
+    removed_certs = []
+    if dh and not keep_cert:
+        for p in (dh.cert, dh.key):
+            if p and Path(p).exists():
+                try:
+                    Path(p).unlink()
+                    removed_certs.append(p)
+                except OSError:
+                    pass
+    reg.remove(domain)
+    reg.save()
+
+    if json_out:
+        console.print_json(_json.dumps({"ok": hres.ok, "domain": domain, "hosts": hres.message,
+                                        "certs_removed": removed_certs}))
+        return
+    mark = "[green]✓[/green]" if hres.ok else "[yellow]![/yellow]"
+    console.print(f"{mark} {domain} — {hres.message}"
+                  + (f"; removed {len(removed_certs)} cert file(s)" if removed_certs else ""))
+
+
+# ── doctor ──────────────────────────────────────────────────────────────────
+@devhost_app.command()
+def doctor() -> None:
+    """Check prerequisites: mkcert, its CA, admin for hosts edits."""
+    console.print(Panel.fit("navig devhost · environment check", border_style="cyan"))
+    ok = True
+
+    exe = certs.find_mkcert()
+    if exe:
+        console.print(f"[green]✓[/green] mkcert: [dim]{exe}[/dim]")
+    else:
+        console.print("[red]✗[/red] mkcert not found — [cyan]winget install FiloSottile.mkcert[/cyan]")
+        ok = False
+
+    if certs.ca_installed():
+        console.print(f"[green]✓[/green] local CA present: [dim]{certs.caroot()}[/dim]")
+    else:
+        console.print("[yellow]![/yellow] local CA not detected — run [cyan]mkcert -install[/cyan] once")
+
+    if hosts.can_edit():
+        console.print("[green]✓[/green] can edit hosts file (admin) — needed for add/remove")
+    else:
+        console.print("[yellow]![/yellow] not elevated — run add/remove in an Administrator terminal")
+
+    console.print(f"[green]✓[/green] registry: [dim]{registry_path()}[/dim]")
+    console.print()
+    if ok:
+        console.print("[bold green]Ready.[/bold green]  Try:  [cyan]navig devhost add app.test --port 3000[/cyan]")
+    else:
+        raise typer.Exit(1)
+
+
+# ── tiny formatters ─────────────────────────────────────────────────────────
+def _yn(v: bool) -> str:
+    return "[green]✓[/green]" if v else "[red]✗[/red]"
+
+
+def _fail(json_out: bool, msg: str) -> None:
+    if json_out:
+        console.print_json(_json.dumps({"ok": False, "error": msg}))
+    else:
+        err.print(f"[red]✗[/red] {msg}")
+
+
+if __name__ == "__main__":  # python -m navig_devhost.commands.devhost
+    devhost_app()

navig_devhost-0.1.0/navig_devhost/engine/__init__.py

@@ -0,0 +1,7 @@
+"""navig-devhost engine — local dev domains with trusted HTTPS."""
+
+from navig_devhost.engine import certs, hosts, net
+from navig_devhost.engine.proxy import Relay, Site
+from navig_devhost.engine.registry import DevHost, Registry
+
+__all__ = ["certs", "hosts", "net", "Relay", "Site", "DevHost", "Registry"]