Portless - Named .localhost URLs

Replace port numbers with stable, named .localhost URLs for local development. For humans and agents.

Note: The portless CLI enables HTTPS on port 443 by default (https://myapp.localhost). Pass --no-tls to portless proxy start, or set PORTLESS_HTTPS=0, for plain HTTP. Keep HTTPS when the app needs OAuth, secure cookies, or HTTP/2.

Safety and Approval

Read existing proxy configuration before starting an app: auto-start reuses saved settings, including LAN mode. Outside LAN mode the proxy binds only to IPv4/IPv6 loopback; LAN mode binds all interfaces.

Ask for explicit approval before first-run sudo/elevation, CA trust-store changes, /etc/hosts writes, LAN exposure, Tailscale sharing, public Funnel/ngrok tunnels, startup-service installation/removal, or destructive cleanup. A request for local development does not authorize these actions. Use PORTLESS_SYNC_HOSTS=0 when hosts writes are not approved. In non-interactive environments, first-run prompts fail rather than granting permission; pre-start only an approved proxy configuration.

--force kills the existing process and takes over its route. prune terminates orphaned process groups, and prune --force uses SIGKILL. Do not use them without checking ownership and approval. clean also removes startup services and trust entries; it is not routine project cleanup.

Never print or commit TLS private keys or ngrok tokens. Let the user configure authentication through the provider's private credential workflow. Do not disable TLS verification to resolve proxy errors.

Why Portless?

Local dev with port numbers is fragile. Portless fixes that by giving each dev server a stable, named .localhost URL.