feat(dev-server): support allowedHosts

Cargo.toml

@@ -3,7 +3,7 @@ resolver = "2"
 members = ["crates/cli", "crates/diagnostics", "crates/project-resolver", "crates/ts-transform", "crates/bundler", "crates/template-compiler", "crates/npm-resolver", "crates/linker", "crates/watch", "crates/dev-server"]
 
 [workspace.package]
-version = "0.10.8"
+version = "0.10.12"
 edition = "2021"
 license = "MIT OR Apache-2.0"
 authors = ["lukekania"]

crates/cli/src/main.rs

@@ -235,6 +235,16 @@ enum Commands {
         /// to use the same value as its `<base href>`.
         #[arg(long = "serve-path")]
         serve_path: Option<String>,
+        /// Comma-separated list of host names the dev server's
+        /// `Host:`-header check accepts. Loopback hosts (`localhost`,
+        /// `127.0.0.1`, `[::1]`) are always allowed. Pass `all` to
+        /// disable the check entirely, or `auto` to additionally accept
+        /// the configured bind host. Use this when fronting the dev
+        /// server with a tunneling proxy (ngrok, Cloudflare Tunnel,
+        /// GitHub Codespaces) or a non-default local hostname
+        /// (`*.localhost`, `app.local`).
+        #[arg(long = "allowed-hosts", value_delimiter = ',', num_args = 0..)]
+        allowed_hosts: Vec<String>,
     },
     /// Extract translatable messages from every component template in the
     /// project and emit a translation file (XLIFF 2.0 by default; XLIFF 1.2
@@ -335,6 +345,7 @@ fn main() {
             host,
             open,
             serve_path,
+            allowed_hosts,
         } => {
             if let Err(e) = serve_cmd::run(
                 &project,
@@ -343,6 +354,7 @@ fn main() {
                 port,
                 open,
                 serve_path.as_deref(),
+                &allowed_hosts,
             ) {
                 eprintln!("{} {e}", "Error:".red().bold());
                 process::exit(1);

crates/cli/src/serve_cmd.rs

@@ -34,6 +34,7 @@ pub fn run(
     port: u16,
     open: bool,
     serve_path: Option<&str>,
+    allowed_hosts: &[String],
 ) -> NgcResult<()> {
     run_with_stop(
         project,
@@ -42,6 +43,7 @@ pub fn run(
         port,
         open,
         serve_path,
+        allowed_hosts,
         install_ctrlc,
     )
 }
@@ -50,13 +52,15 @@ pub fn run(
 /// armed. Tests use a no-op installer so the watcher loop can be exited via
 /// the returned [`Arc<AtomicBool>`] without touching the real signal
 /// machinery (which would interfere with `cargo test`'s own handlers).
+#[allow(clippy::too_many_arguments)]
 pub(crate) fn run_with_stop(
     project: &Path,
     configuration: Option<&str>,
     host: &str,
     port: u16,
     open: bool,
     serve_path: Option<&str>,
+    allowed_hosts: &[String],
     install_stop: impl FnOnce(Arc<AtomicBool>),
 ) -> NgcResult<()> {
     let out_dir = crate::resolve_out_dir(project, None, configuration)?;
@@ -90,7 +94,8 @@ pub(crate) fn run_with_stop(
     let cfg = DevServerConfig::new(&out_dir)
         .with_host(host.to_string())
         .with_port(port)
-        .with_serve_path(normalized_serve_path.as_deref());
+        .with_serve_path(normalized_serve_path.as_deref())
+        .with_allowed_hosts(allowed_hosts.iter().cloned());
     let server = DevServer::start(cfg, event_rx)?;
     let url = match server.serve_path() {
         Some(prefix) => format!("http://{}{}", server.addr(), prefix),

crates/cli/tests/serve_integration.rs

@@ -83,6 +83,7 @@ fn serve_help_lists_all_flags() {
         "--host",
         "--open",
         "--serve-path",
+        "--allowed-hosts",
     ] {
         assert!(
             stdout.contains(flag),