feat: 仅在必要时提权，用 root helper 替代整进程 sudo

.github/workflows/release.yml

@@ -36,4 +36,17 @@ jobs:
         run: |
           pnpm run build
           TARBALL=$(pnpm pack --pack-destination "$RUNNER_TEMP" | tail -n 1)
-          npm publish "$TARBALL" --access public
+          VERSION=$(node -p "require('./package.json').version")
+
+          # A prerelease must name its dist-tag explicitly; without one npm 11
+          # refuses to publish. Using `beta` also keeps `latest` on the stable
+          # line so a plain install does not pick up a beta.
+          if [[ "$VERSION" == *-* ]]; then
+            DIST_TAG="${VERSION#*-}"
+            DIST_TAG="${DIST_TAG%%.*}"
+            echo "publishing $VERSION under dist-tag $DIST_TAG"
+            npm publish "$TARBALL" --access public --tag "$DIST_TAG"
+          else
+            echo "publishing $VERSION as latest"
+            npm publish "$TARBALL" --access public
+          fi

README.md

@@ -314,15 +314,39 @@ Please check [caddy path](https://github.com/zcf0508/unplugin-https-reverse-prox
 ## Usage
 
 ```bash
-# macOS
-sudo -E npm run dev # your dev script
-#    ^ `-E` is important
-
-# windows
-# use powershell as administrator
+# macOS / Linux / Windows
 npm run dev # your dev script
 ```
 
+Run it as your normal user. The plugin starts a small privileged helper that
+runs as administrator, and only that helper touches `/etc/hosts` and ports
+80/443. Your dev server, its caches and `node_modules` stay owned by you.
+
+On macOS and Linux the plugin asks for your password once when the dev server
+starts, then reuses the sudo credential for the rest of the session. If you
+already ran `sudo -v` in the same terminal, no prompt is shown.
+
+The helper restores the hosts entries by itself when the dev server exits,
+including when it is killed or crashes.
+
+### Granting the permission once (optional)
+
+To skip the password prompt entirely, allow the plugin's helper in
+`/etc/sudoers.d/` (edit with `sudo visudo -f /etc/sudoers.d/uhrp`):
+
+```
+yourname ALL=(root) NOPASSWD: /usr/bin/killall -HUP mDNSResponder
+yourname ALL=(root) NOPASSWD: /usr/bin/install -m 644 -o root -g wheel /tmp/uhrp-hosts.* /etc/hosts
+```
+
+The second rule only matters when the helper rewrites `/etc/hosts` through
+`install`; adjust the paths to your platform.
+
+### Windows
+
+Run `npm run dev` normally. Windows raises a UAC prompt once, when the helper
+is started through `Start-Process -Verb RunAs`.
+
 If your broswer shows a not trusted certificate warning, please check the keychain.
 
 ![keychain](https://github.com/zcf0508/unplugin-https-reverse-proxy/blob/main/images/Snipaste_2023-11-16_16-59-55.png)

package.json

@@ -1,7 +1,7 @@
 {
   "name": "unplugin-https-reverse-proxy",
   "type": "module",
-  "version": "4.0.4",
+  "version": "4.1.0-beta.10",
   "description": "",
   "license": "MIT",
   "homepage": "https://github.com/zcf0508/unplugin-https-reverse-proxy#readme",
@@ -135,7 +135,6 @@
     "console-table-printer": "^2.12.1",
     "dotenv-flow": "^4.1.0",
     "got-cjs": "^12.5.4",
-    "hostile": "^1.4.0",
     "http-proxy-agent": "^7.0.2",
     "https-proxy-agent": "^7.0.6",
     "ora": "5",
@@ -149,8 +148,6 @@
     "@nuxt/schema": "^3.16.1",
     "@rsbuild/core": "^0.4.15",
     "@rspack/core": "^0.5.9",
-    "@types/hostile": "^1.3.5",
-    "@types/kill-port": "^2.0.3",
     "@types/node": "^20.11.19",
     "@types/proper-lockfile": "^4.1.4",
     "@types/qrcode-terminal": "^0.12.2",