Portless Updates & Release Notes

New Features

• Turbo JSONC workspaces: Workspaces that only have turbo.jsonc now use Turbo orchestration, the same as turbo.json. (#422)
• Unresolved hostname warning: After registering a route, portless asks the proxy to sync the hosts file and warns when the hostname still does not resolve. (#374)
• WebMCP documentation site: The docs moved to Geistdocs and expose their pages to agents through WebMCP. (#427)

Bug Fixes

• Hosts sync data loss: Manual hosts sync refuses to write when the hosts file cannot be read, verifies what it wrote, and removes stale managed entries when no routes remain. (#424)
• Local CA certificate: The generated CA no longer carries a duplicate Basic Constraints extension on OpenSSL 1.1.1 and LibreSSL, which macOS and OpenSSL 3 rejected and left *.localhost untrusted. (#443)
• Proxy crash on backend restart: The proxy no longer forwards client hop-by-hop headers, which left backend sockets open and crashed the proxy with ECONNRESET when a backend restarted. (#445)
• Wildcard fallback order: With --wildcard, an unregistered subdomain now routes to the most specific registered parent instead of the first one stored. (#446)
• Occupied app ports: Free app ports are checked on 127.0.0.1, ::1, 0.0.0.0 and ::, so portless no longer assigns a port another server already holds. (#447) …

New Features

• Agent-readable documentation: The documentation site now exposes clean Markdown pages and an llms.txt index so agents can discover and consume the docs directly. (#387)

Bug Fixes

• Framework flags through package scripts: Frameworks that ignore PORT now receive the assigned --port and --host flags when launched through supported package-manager scripts, while non-server and unsafe scripts are left untouched. (#366)
• Windows service lifetime: The Windows startup service now registers a UTF-16 Task Scheduler definition with no execution time limit and replaces existing tasks atomically. (#381)
• Ctrl+C process cleanup: Interrupt handling now waits for the command's process tree to exit and terminates remaining descendants after a short grace period. (#385)

Contributors

• @Railly
• @EfeDurmaz16
• @JohnPhamous

Bug Fixes

• Multi-segment custom TLDs: --tld and PORTLESS_TLD now accept dotted DNS names such as dev.example.com, so local URLs can mirror production structure. validateTld checks per-label DNS rules and the 253-character total limit, overlapping TLDs resolve by longest match, and cert cache filenames stay under the filesystem name limit for long hostnames. (#365)
• WebSocket over HTTP/2: Proxy now advertises RFC 8441 extended CONNECT and bridges :protocol websocket streams to an HTTP/1.1 upgrade against the backend, fixing dev server HMR for browsers that negotiate h2 over ALPN. Plain-HTTP upgrades on the TLS port are proxied instead of dropped, and a backend that rejects the handshake or answers with a bad Sec-WebSocket-Accept now gets a 502 instead of a silently destroyed socket. (#363)

Contributors

• @Railly
• @KingPsychopath
• @erichurkman
• @sanjevirau

Bug Fixes

• Tailscale funnel routing: Proxy now routes requests addressed to a route's Tailscale funnel or serve hostname, so --funnel and --tailscale apps reached at <device>.ts.net no longer return a 404, including when several apps share one hostname on different ports. (#352)
• IPv6-only dev servers return 502: Proxy now dials upstreams over both loopback families, fixing 502s when a dev server binds ::1 only, such as Vite on Node 17+. (#353)
• Worktree prefix in multi-app mode: Bare portless in a monorepo worktree now applies the branch prefix in multi-app mode as it already did for single apps, so hostnames no longer collide across worktrees. (#355)

Contributors

• @Railly
• @ahfoysal