feat(dev): portless named .localhost origins for the local auth stack - #271
Merged
Zach Dunn (zachdunn) merged 6 commits intoJul 19, 2026
Merged
Conversation
pnpm dev:stack now runs web/auth/api through portless at https://uploads.localhost, https://auth.uploads.localhost, and https://api.uploads.localhost (worktree branch names become prefixes). The shared .uploads.localhost cookie parent lets the Better Auth session span all three workers like .uploads.sh does in prod, so signed-in pages work in local browsers — including agent browser panels — without the cross-port cookie workarounds. - deriveCookieDomain: multi-label *.localhost hosts share the last-two-label parent; bare x.localhost stays host-only - trusted origins: PORTLESS_ORIGIN_RE accepts multi-label and proxy-port (:1355) origins - dev-session gate: accepts a matched *.localhost pair (loopback by spec); real-TLD origins still never enable the bypass - resolveSignedInOrigins: in dev, supervisor-injected PUBLIC_* origins beat a stale apps/web/.dev.vars - dev-stack: pre-starts the proxy (with unprivileged-port fallback), re-execs with the portless CA for Node fetch, resolves origins via portless get; PORTLESS=0 keeps the legacy pinned loopback ports (dev GitHub OAuth callback path)
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
uploads-api | cadefca | Commit Preview URL Branch Preview URL |
Jul 19 2026, 09:02 PM |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
uploads-auth | 800766b | Commit Preview URL Branch Preview URL |
Jul 19 2026, 09:50 PM |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
uploads-web | 42619af | Commit Preview URL Branch Preview URL |
Jul 19 2026, 10:10 PM |
|
Important Review skippedAuto reviews are limited based on label configuration. 🏷️ Required labels (at least one) (2)
🚫 Excluded labels (none allowed) (1)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Mirrors the sibling repos' *.local.buildinternet.dev zones: providers that reject *.localhost redirect URIs can run the stack at https://auth.local.uploads.sh etc. via PORTLESS_TLD=sh PORTLESS_NAME=local.uploads (+ portless hosts sync). Trusted outside production only, https only; the dev-session bypass stays .localhost-only, so dev:stack skips its cookie smoke in this mode.
…ildinternet.dev local.uploads.sh shared prod's registrable domain, so prod's Domain=.uploads.sh session cookies would ride into local dev stacks (and local software could set prod-scoped cookies). The shared infra zone has no production cookies to overlap — same reasoning as the sibling repos. deriveCookieDomain anchors the zone parent across worktree prefixes; the uploads.sh DNS records were deleted.
…k-raw launch config
This was referenced Jul 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Agents (and humans) struggled to reach signed-in pages locally: the session cookie minted by the auth worker on
127.0.0.1:8788never spanned web (:4321) or api (:8787),localhostvs127.0.0.1were different cookie sites, and stale/prod origin fallbacks tripped the strict CSP. Modeled on the ~/Code/sunny and ~/Code/releases portless setups.What
pnpm dev:stacknow runs through portless:https://uploads.localhosthttps://auth.uploads.localhosthttps://api.uploads.localhostThe shared
.uploads.localhostcookie parent makes the Better Auth session span all three workers exactly like.uploads.shin prod. Worktrees get branch-prefixed hosts; the cookie parent anchors on the last two labels so nothing else changes.deriveCookieDomain: multi-label*.localhost→.<name>.localhostparent; barex.localhoststays host-onlyPORTLESS_ORIGIN_RE: multi-label + proxy-port (:1355) origins*.localhostpair (loopback by spec); real-TLD origins never enable the bypass; origin header now checked against configuredWEB_ORIGINresolveSignedInOrigins: in dev, supervisor-injectedPUBLIC_*origins beat a staleapps/web/.dev.vars(prod untouched)fetchverifies TLS, resolves origins viaportless get;PORTLESS=0keeps the legacy pinned loopback ports (dev GitHub OAuth callback path)Verified
pnpm dev:stackboots and its smoke passes end-to-end over the named origins (dev-session → get-session → API membership → file listing)/account/workspacesshell (files, usage, membership) — the original pain casepnpm check,pnpm typecheck, fullpnpm test(1589 passing)~/.portless/ca.srl(from an old sudo proxy run) silently produced 0-byte per-host certs and TLS aborts; removing it fixed cert issuance.pnpm exec portless doctordidn't catch this.