* chore: require pnpm release age policy
- Add pnpm minimum release age 2880 and deny dependency build scripts.
- Require Node 24 and pnpm 11 across engines, CI, and version files.
- Refresh docs and lockfile for the runtime upgrade.
* ci: install pnpm after node setup
- Put Node 24 on PATH before pnpm/action-setup installs pnpm 11.
- Keep setup-node cache restore after pnpm is installed.
* ci: run javascript actions on node 24
- Opt CI and release workflows into GitHub JavaScript action execution on Node 24.
- Unblock pnpm/action-setup from installing pnpm 11.
* ci: avoid engine strict pnpm setup
- Remove the root engine-strict npm config.
- Drop the temporary Node 24 JavaScript action runtime override.
* test: use valid ca pem fixture
- Replace the fake CA text used in NODE_EXTRA_CA_CERTS tests with a valid PEM.
- Avoid Windows Node 24 aborting before the capture script runs.
* Rewrite Origin/Referer headers in proxy for portless-managed hostnames
- Frameworks like Next.js 16.2+ block cross-origin requests to dev endpoints (e.g. /_next/webpack-hmr) when the Origin header doesn't match their allowlist. Next.js auto-allows *.localhost, but * only matches a single subdomain level, so multi-level names like admin.cmd.localhost are blocked.
- The proxy now rewrites Origin and Referer headers to http://localhost:{port} when the hostname belongs to the portless TLD. The original host is preserved in X-Forwarded-Host.
- This is framework-agnostic and works for both HTTP requests and WebSocket upgrades (HMR), so any framework with dev-origin checks benefits automatically.
* increase timeout
* fix patch
* validate changeset status
* fix: fetch full git history for changeset status
* fix: use origin/main for changeset status and skip on push
---------
Co-authored-by: ctate <366502+ctate@users.noreply.github.com>
* feat: add Windows support
- Add win32 to os field in package.json
- Use os.tmpdir() for cross-platform SYSTEM_STATE_DIR
- Add parsePidFromNetstat for exact port matching on Windows
- Windows branch in findPidOnPort using netstat -ano
- Windows-aware spawnCommand (shell: true instead of /bin/sh)
- resolveStateDir always uses user dir on Windows (no privileged ports)
- Guard all needsSudo checks with !isWindows
- Guard process.getuid() checks for Unix only
- Platform-aware error messages (netstat/taskkill/Administrator vs lsof/kill/sudo)
- windowsHide: true on daemon spawn
- Windows certificate trust via certutil (isCATrusted + trustCA)
- fixOwnership no-op on Windows
- Windows CI job in GitHub Actions (windows-latest, Node 20/22)
- parsePidFromNetstat test suite (8 cases)
* fix: resolve Windows CI test failures
- auto.test.ts: replace process.env.TMPDIR || "/tmp" with os.tmpdir()
- certs.test.ts: skip chmod permission assertion on Windows
- cli-utils.test.ts: skip privileged port resolveStateDir test on Windows
* fix: match both path separators in worktree detection regex
The /worktrees/ regex used forward slashes only, which fails on
Windows where path.join produces backslashes in the gitdir path.
---------
Co-authored-by: Ben Sabic <bensabic@users.noreply.github.com>
Chris Tate