@ghostty-web/demo 0.4.0-next.13.g65ed96f → 0.4.0-next.18.gbec9e16

package/README.md

@@ -13,11 +13,12 @@ Works on **Linux** and **macOS** (no Windows support yet).
 
 ## What it does
 
-- Starts an HTTP server on port 8080 (configurable via `PORT` env var)
+- Starts an HTTP server on `127.0.0.1:8080` by default (`PORT` and `HOST` are configurable)
 - Serves WebSocket PTY on the same port at `/ws` endpoint
+- Protects `/ws` with a per-run same-origin token from `/api/token`
+- Rejects cross-origin WebSocket handshakes
 - Opens a real shell session (bash, zsh, etc.)
 - Provides full PTY support (colors, cursor positioning, resize, etc.)
-- Supports reverse proxies (ngrok, nginx, etc.) via X-Forwarded-\* headers
 
 ## Usage
 
@@ -27,31 +28,18 @@ npx @ghostty-web/demo@next
 
 # Custom port
 PORT=3000 npx @ghostty-web/demo@next
-```
-
-Then open http://localhost:8080 in your browser.
-
-## Reverse Proxy Support
-
-The server now supports reverse proxies like ngrok, nginx, and others by:
-
-- Serving WebSocket on the same HTTP port (no separate port needed)
-- Using relative WebSocket URLs on the client side
-- Automatic protocol detection (HTTP/HTTPS, WS/WSS)
 
-This means the WebSocket connection automatically adapts to use the same protocol and host as the HTTP connection, making it work seamlessly through any reverse proxy.
+# Explicit bind host for intentional non-default access
+HOST=192.0.2.10 GHOSTTY_ALLOWED_HOSTS=demo.example npx @ghostty-web/demo@next
+```
 
-### Example with ngrok
+Then open http://127.0.0.1:8080 in your browser.
 
-```bash
-# Start the demo server
-npx @ghostty-web/demo@next
+## Bind host and proxy configuration
 
-# In another terminal, expose it via ngrok
-ngrok http 8080
-```
+The demo binds to `127.0.0.1` by default and only allows loopback hostnames (`localhost`, `127.0.0.1`, and `::1`) unless configured otherwise. Set `HOST=<host>` to change the bind address. If you serve the demo through another hostname, or bind to a wildcard such as `HOST=0.0.0.0`, add the browser-visible hostnames with `GHOSTTY_ALLOWED_HOSTS=host1,host2`.
 
-The terminal will work seamlessly through the ngrok URL! Both HTTP and WebSocket traffic will be properly proxied.
+The browser client fetches `/api/token` from the same origin before opening `/ws`, and the server rejects `/ws` when the token is missing, the `Host` is not allowed, or the WebSocket `Origin` does not match the request host. Do not set permissive CORS in front of `/api/token`.
 
 ### Example with nginx
 
@@ -66,10 +54,6 @@ server {
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection "upgrade";
         proxy_set_header Host $host;
-        proxy_set_header X-Forwarded-Host $host;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     }
 }
 ```
@@ -78,4 +62,4 @@ server {
 
 ⚠️ **This server provides full shell access.**
 
-Only use for local development and demos. Do not expose to untrusted networks.
+Only use for local development and demos. Keep the default loopback bind unless you intentionally need remote access and have configured `HOST` and `GHOSTTY_ALLOWED_HOSTS` for the exact hostnames you trust.

package/bin/auth.js

@@ -0,0 +1,335 @@
+import assert from 'assert';
+import { randomBytes, timingSafeEqual } from 'crypto';
+import { isIP } from 'net';
+
+const LOOPBACK_HOSTS = Object.freeze(['localhost', '127.0.0.1', '::1']);
+const WILDCARD_BIND_HOSTS = Object.freeze(['0.0.0.0', '::', '*']);
+
+function decision(status, reason) {
+  return { ok: false, status, reason };
+}
+
+function badRequest() {
+  return decision(400, 'Bad Request');
+}
+
+function forbidden() {
+  return decision(403, 'Forbidden');
+}
+
+function unauthorized() {
+  return decision(401, 'Unauthorized');
+}
+
+function parseAllowedHosts(value) {
+  if (!value) {
+    return [];
+  }
+  return value
+    .split(',')
+    .map((host) => host.trim())
+    .filter((host) => host.length > 0);
+}
+
+function normalizeHostname(hostname) {
+  if (typeof hostname !== 'string') {
+    return null;
+  }
+
+  let value = hostname.trim().toLowerCase();
+  if (value.length === 0 || /\s/.test(value)) {
+    return null;
+  }
+
+  if (value.startsWith('[') || value.endsWith(']')) {
+    if (!value.startsWith('[') || !value.endsWith(']')) {
+      return null;
+    }
+    value = value.slice(1, -1);
+  }
+
+  if (value.length === 0 || value.includes('/') || value.includes('\\') || value.includes('@')) {
+    return null;
+  }
+
+  if (isIP(value) !== 0) {
+    return value;
+  }
+
+  if (value.includes(':') || !/^[a-z0-9.-]+$/.test(value)) {
+    return null;
+  }
+
+  const labels = value.split('.');
+  if (labels.some((label) => label.length === 0 || label.length > 63)) {
+    return null;
+  }
+
+  for (const label of labels) {
+    if (label.startsWith('-') || label.endsWith('-')) {
+      return null;
+    }
+  }
+
+  return value;
+}
+
+function addAllowedHost(allowedHosts, host) {
+  const normalized = normalizeHostname(host);
+  assert(normalized, `Allowed host must be a hostname or IP address: ${host}`);
+  allowedHosts.add(normalized);
+}
+
+function parsePort(port) {
+  if (port === undefined || port === '') {
+    return '';
+  }
+  if (!/^[0-9]+$/.test(port)) {
+    return null;
+  }
+  const value = Number.parseInt(port, 10);
+  if (!Number.isInteger(value) || value < 1 || value > 65535) {
+    return null;
+  }
+  return String(value);
+}
+
+export function parseHostHeader(hostHeader) {
+  if (
+    typeof hostHeader !== 'string' ||
+    hostHeader.length === 0 ||
+    hostHeader.trim() !== hostHeader
+  ) {
+    return null;
+  }
+
+  let hostname = '';
+  let port = '';
+
+  if (hostHeader.startsWith('[')) {
+    const match = /^\[([^\]]+)\](?::([0-9]+))?$/.exec(hostHeader);
+    if (!match) {
+      return null;
+    }
+    hostname = match[1];
+    const parsedPort = parsePort(match[2]);
+    if (parsedPort === null) {
+      return null;
+    }
+    port = parsedPort;
+  } else {
+    const colonCount = (hostHeader.match(/:/g) || []).length;
+    if (colonCount === 0) {
+      hostname = hostHeader;
+    } else if (colonCount === 1) {
+      const parts = hostHeader.split(':');
+      hostname = parts[0];
+      const parsedPort = parsePort(parts[1]);
+      if (parsedPort === null) {
+        return null;
+      }
+      port = parsedPort;
+    } else {
+      hostname = hostHeader;
+    }
+  }
+
+  const normalizedHostname = normalizeHostname(hostname);
+  if (!normalizedHostname) {
+    return null;
+  }
+
+  return { hostname: normalizedHostname, port };
+}
+
+function parseOriginHeader(originHeader) {
+  if (
+    typeof originHeader !== 'string' ||
+    originHeader.length === 0 ||
+    originHeader.trim() !== originHeader
+  ) {
+    return null;
+  }
+
+  let origin;
+  try {
+    origin = new URL(originHeader);
+  } catch (_error) {
+    return null;
+  }
+
+  if (origin.protocol !== 'http:' && origin.protocol !== 'https:') {
+    return null;
+  }
+
+  if (
+    origin.username ||
+    origin.password ||
+    origin.pathname !== '/' ||
+    origin.search ||
+    origin.hash
+  ) {
+    return null;
+  }
+
+  const host = parseHostHeader(origin.host);
+  if (!host) {
+    return null;
+  }
+
+  return { protocol: origin.protocol, ...host };
+}
+
+function defaultPort(protocol) {
+  assert(protocol === 'http:' || protocol === 'https:', `Unexpected origin protocol: ${protocol}`);
+  return protocol === 'https:' ? '443' : '80';
+}
+
+function originMatchesHost(origin, host) {
+  const fallbackPort = defaultPort(origin.protocol);
+  return (
+    origin.hostname === host.hostname &&
+    (origin.port || fallbackPort) === (host.port || fallbackPort)
+  );
+}
+
+function validateAllowedHost(config, hostHeader) {
+  assertAuthConfig(config);
+  const host = parseHostHeader(hostHeader);
+  if (!host) {
+    return { ...badRequest(), host: null };
+  }
+
+  if (!config.allowedHosts.includes(host.hostname)) {
+    return { ...forbidden(), host };
+  }
+
+  return { ok: true, host };
+}
+
+function validateMatchingOrigin(originHeader, host, required) {
+  if (originHeader === undefined && !required) {
+    return { ok: true };
+  }
+
+  if (originHeader === undefined) {
+    return forbidden();
+  }
+
+  const origin = parseOriginHeader(originHeader);
+  if (!origin) {
+    return badRequest();
+  }
+
+  if (!originMatchesHost(origin, host)) {
+    return forbidden();
+  }
+
+  return { ok: true };
+}
+
+function safeTokenEquals(expected, actual) {
+  assert(
+    typeof expected === 'string' && expected.length > 0,
+    'Expected auth token must be non-empty'
+  );
+  if (typeof actual !== 'string' || actual.length === 0) {
+    return false;
+  }
+
+  const expectedBuffer = Buffer.from(expected, 'utf8');
+  const actualBuffer = Buffer.from(actual, 'utf8');
+  if (expectedBuffer.length !== actualBuffer.length) {
+    return false;
+  }
+
+  return timingSafeEqual(expectedBuffer, actualBuffer);
+}
+
+function assertAuthConfig(config) {
+  assert(config && typeof config === 'object', 'Auth config must be an object');
+  assert(
+    typeof config.token === 'string' && config.token.length > 0,
+    'Auth token must be non-empty'
+  );
+  assert(
+    Array.isArray(config.allowedHosts) && config.allowedHosts.length > 0,
+    'Allowed host list must be non-empty'
+  );
+}
+
+export function generateSessionToken() {
+  const token = randomBytes(32).toString('base64url');
+  assert(token.length >= 32, 'Generated session token must contain enough entropy');
+  return token;
+}
+
+export function isWildcardBindHost(host) {
+  const normalized = normalizeHostname(host);
+  return (
+    WILDCARD_BIND_HOSTS.includes(host) ||
+    (normalized !== null && WILDCARD_BIND_HOSTS.includes(normalized))
+  );
+}
+
+export function isLoopbackHost(host) {
+  const normalized = normalizeHostname(host);
+  return normalized !== null && LOOPBACK_HOSTS.includes(normalized);
+}
+
+export function createAuthConfig(options = {}) {
+  const env = options.env ?? process.env;
+  const bindHost = options.bindHost ?? env.HOST ?? '127.0.0.1';
+  const token = options.token ?? generateSessionToken();
+
+  assert(typeof bindHost === 'string' && bindHost.length > 0, 'Bind host must be non-empty');
+  assert(typeof token === 'string' && token.length > 0, 'Auth token must be non-empty');
+  assert(LOOPBACK_HOSTS.length > 0, 'Loopback host allowlist must not be empty');
+
+  const allowedHosts = new Set(LOOPBACK_HOSTS);
+  for (const host of options.allowedHosts ?? parseAllowedHosts(env.GHOSTTY_ALLOWED_HOSTS)) {
+    addAllowedHost(allowedHosts, host);
+  }
+
+  if (!isWildcardBindHost(bindHost)) {
+    addAllowedHost(allowedHosts, bindHost);
+  }
+
+  return Object.freeze({
+    token,
+    bindHost,
+    allowedHosts: Object.freeze([...allowedHosts]),
+  });
+}
+
+export function validateTokenRequest(config, request) {
+  const hostDecision = validateAllowedHost(config, request.host);
+  if (!hostDecision.ok) {
+    return hostDecision;
+  }
+
+  const originDecision = validateMatchingOrigin(request.origin, hostDecision.host, false);
+  if (!originDecision.ok) {
+    return originDecision;
+  }
+
+  return { ok: true };
+}
+
+export function validateWebSocketRequest(config, request) {
+  const hostDecision = validateAllowedHost(config, request.host);
+  if (!hostDecision.ok) {
+    return hostDecision;
+  }
+
+  const originDecision = validateMatchingOrigin(request.origin, hostDecision.host, true);
+  if (!originDecision.ok) {
+    return originDecision;
+  }
+
+  if (!safeTokenEquals(config.token, request.token)) {
+    return unauthorized();
+  }
+
+  return { ok: true };
+}

package/bin/demo.js

@@ -18,11 +18,29 @@ import pty from '@lydell/node-pty';
 // WebSocket server
 import { WebSocketServer } from 'ws';
 
+import {
+  createAuthConfig,
+  isLoopbackHost,
+  isWildcardBindHost,
+  validateTokenRequest,
+  validateWebSocketRequest,
+} from './auth.js';
+
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
 const DEV_MODE = process.argv.includes('--dev');
-const HTTP_PORT = process.env.PORT || (DEV_MODE ? 8000 : 8080);
+const HTTP_PORT = parsePort(process.env.PORT || (DEV_MODE ? '8000' : '8080'));
+const AUTH_CONFIG = createAuthConfig();
+const HOST = AUTH_CONFIG.bindHost;
+
+function parsePort(value) {
+  const port = Number.parseInt(value, 10);
+  if (!Number.isInteger(port) || port < 1 || port > 65535) {
+    throw new Error(`PORT must be an integer from 1 to 65535: ${value}`);
+  }
+  return port;
+}
 
 // ============================================================================
 // Locate ghostty-web assets
@@ -240,12 +258,46 @@ const HTML_TEMPLATE = `<!doctype html>
 
       // Connect to WebSocket PTY server (use same origin as HTTP server)
       const protocol = window.location.protocol === 'https:' ? 'wss:' : 'ws:';
-      const wsUrl = protocol + '//' + window.location.host + '/ws?cols=' + term.cols + '&rows=' + term.rows;
       let ws;
 
-      function connect() {
+      async function fetchAuthToken() {
+        const response = await fetch('/api/token', { cache: 'no-store' });
+        if (!response.ok) {
+          throw new Error('Token request failed with HTTP ' + response.status);
+        }
+
+        const body = await response.json();
+        if (!body || typeof body.token !== 'string' || body.token.length === 0) {
+          throw new Error('Token response did not include a token');
+        }
+
+        return body.token;
+      }
+
+      function buildWebSocketUrl(token) {
+        const params = new URLSearchParams();
+        params.set('cols', String(term.cols));
+        params.set('rows', String(term.rows));
+        params.set('token', token);
+        return protocol + '//' + window.location.host + '/ws?' + params.toString();
+      }
+
+      async function connect() {
+        setStatus('connecting', 'Authenticating...');
+
+        let token;
+        try {
+          token = await fetchAuthToken();
+        } catch (error) {
+          console.error('Authentication failed:', error);
+          setStatus('disconnected', 'Auth error');
+          term.write('\\r\\n\\x1b[31mAuthentication failed. Retrying in 2s...\\x1b[0m\\r\\n');
+          setTimeout(connect, 2000);
+          return;
+        }
+
         setStatus('connecting', 'Connecting...');
-        ws = new WebSocket(wsUrl);
+        ws = new WebSocket(buildWebSocketUrl(token));
 
         ws.onopen = () => {
           setStatus('connected', 'Connected');
@@ -338,7 +390,16 @@ const MIME_TYPES = {
 // ============================================================================
 
 const httpServer = http.createServer((req, res) => {
-  const url = new URL(req.url, `http://${req.headers.host}`);
+  const url = parseRequestUrl(req);
+  if (!url) {
+    writeHttpDecision(res, { status: 400, reason: 'Bad Request' });
+    return;
+  }
+
+  if (handleTokenRequest(req, res, url)) {
+    return;
+  }
+
   const pathname = url.pathname;
 
   // Serve index page
@@ -381,6 +442,60 @@ function serveFile(filePath, res) {
   });
 }
 
+function parseRequestUrl(req) {
+  try {
+    return new URL(req.url || '/', 'http://127.0.0.1');
+  } catch (_error) {
+    return null;
+  }
+}
+
+function writeHttpDecision(res, decision) {
+  res.writeHead(decision.status, {
+    'Content-Type': 'text/plain; charset=utf-8',
+    'X-Content-Type-Options': 'nosniff',
+  });
+  res.end(decision.reason);
+}
+
+function writeTokenResponse(res) {
+  res.writeHead(200, {
+    'Content-Type': 'application/json',
+    'Cache-Control': 'no-store',
+    'X-Content-Type-Options': 'nosniff',
+  });
+  res.end(JSON.stringify({ token: AUTH_CONFIG.token }));
+}
+
+function handleTokenRequest(req, res, url) {
+  if (url.pathname !== '/api/token') {
+    return false;
+  }
+
+  if (req.method !== 'GET') {
+    res.writeHead(405, {
+      Allow: 'GET',
+      'Content-Type': 'text/plain; charset=utf-8',
+      'X-Content-Type-Options': 'nosniff',
+    });
+    res.end('Method Not Allowed');
+    return true;
+  }
+
+  const decision = validateTokenRequest(AUTH_CONFIG, {
+    host: req.headers.host,
+    origin: req.headers.origin,
+  });
+
+  if (!decision.ok) {
+    writeHttpDecision(res, decision);
+    return true;
+  }
+
+  writeTokenResponse(res);
+  return true;
+}
+
 // ============================================================================
 // WebSocket Server (using ws package)
 // ============================================================================
@@ -416,23 +531,67 @@ function createPtySession(cols, rows) {
 // WebSocket server attached to HTTP server (same port)
 const wss = new WebSocketServer({ noServer: true });
 
-// Handle HTTP upgrade for WebSocket connections
-httpServer.on('upgrade', (req, socket, head) => {
-  const url = new URL(req.url, `http://${req.headers.host}`);
+function rejectUpgrade(socket, decision) {
+  if (socket.destroyed) {
+    return;
+  }
+
+  const body = decision.reason + '\n';
+  socket.write(
+    `HTTP/1.1 ${decision.status} ${decision.reason}\r\n` +
+      'Connection: close\r\n' +
+      'Content-Type: text/plain; charset=utf-8\r\n' +
+      'X-Content-Type-Options: nosniff\r\n' +
+      `Content-Length: ${Buffer.byteLength(body)}\r\n` +
+      '\r\n' +
+      body
+  );
+  socket.destroy();
+}
+
+function handleWebSocketUpgrade(req, socket, head) {
+  const url = parseRequestUrl(req);
+  if (!url) {
+    rejectUpgrade(socket, { status: 400, reason: 'Bad Request' });
+    return true;
+  }
+
+  if (url.pathname !== '/ws') {
+    return false;
+  }
+
+  const decision = validateWebSocketRequest(AUTH_CONFIG, {
+    host: req.headers.host,
+    origin: req.headers.origin,
+    token: url.searchParams.get('token'),
+  });
 
-  if (url.pathname === '/ws') {
-    // In production, consider validating req.headers.origin to prevent CSRF
-    // For development/demo purposes, we allow all origins
+  if (!decision.ok) {
+    rejectUpgrade(socket, decision);
+    return true;
+  }
+
+  if (!socket.destroyed && !socket.readableEnded) {
     wss.handleUpgrade(req, socket, head, (ws) => {
       wss.emit('connection', ws, req);
     });
-  } else {
+  }
+  return true;
+}
+
+// Handle HTTP upgrade for WebSocket connections
+httpServer.on('upgrade', (req, socket, head) => {
+  if (!handleWebSocketUpgrade(req, socket, head)) {
     socket.destroy();
   }
 });
 
 wss.on('connection', (ws, req) => {
-  const url = new URL(req.url, `http://${req.headers.host}`);
+  const url = parseRequestUrl(req);
+  if (!url) {
+    ws.close();
+    return;
+  }
   const cols = Number.parseInt(url.searchParams.get('cols') || '80');
   const rows = Number.parseInt(url.searchParams.get('rows') || '24');
 
@@ -508,12 +667,17 @@ wss.on('connection', (ws, req) => {
 // Startup
 // ============================================================================
 
+function formatUrlHost(host) {
+  return host.includes(':') && !host.startsWith('[') ? `[${host}]` : host;
+}
+
 function printBanner(url) {
   console.log('\n' + '═'.repeat(60));
   console.log('  🚀 ghostty-web demo server' + (DEV_MODE ? ' (dev mode)' : ''));
   console.log('═'.repeat(60));
   console.log(`\n  📺 Open: ${url}`);
   console.log(`  📡 WebSocket PTY: same endpoint /ws`);
+  console.log('  🔐 WebSocket auth: per-run same-origin token');
   console.log(`  🐚 Shell: ${getShell()}`);
   console.log(`  📁 Home: ${homedir()}`);
   if (DEV_MODE) {
@@ -522,6 +686,12 @@ function printBanner(url) {
     console.log(`  📦 Using local build: ${distPath}`);
   }
   console.log('\n  ⚠️  This server provides shell access.');
+  console.log('     It binds to ' + HOST + ' and rejects cross-origin WebSockets.');
+  if (isWildcardBindHost(HOST) || !isLoopbackHost(HOST)) {
+    console.log(
+      '     Remote access requires GHOSTTY_ALLOWED_HOSTS and can expose your shell if misconfigured.'
+    );
+  }
   console.log('     Only use for local development.\n');
   console.log('═'.repeat(60));
   console.log('  Press Ctrl+C to stop.\n');
@@ -544,9 +714,32 @@ if (DEV_MODE) {
   const { createServer } = await import('vite');
   const vite = await createServer({
     root: repoRoot,
+    plugins: [
+      {
+        name: 'ghostty-demo-auth',
+        configureServer(server) {
+          server.middlewares.use((req, res, next) => {
+            const url = parseRequestUrl(req);
+            if (!url) {
+              writeHttpDecision(res, { status: 400, reason: 'Bad Request' });
+              return;
+            }
+
+            if (handleTokenRequest(req, res, url)) {
+              return;
+            }
+
+            next();
+          });
+        },
+      },
+    ],
     server: {
+      host: HOST,
       port: HTTP_PORT,
       strictPort: true,
+      cors: false,
+      allowedHosts: AUTH_CONFIG.allowedHosts,
     },
   });
 
@@ -557,30 +750,20 @@ if (DEV_MODE) {
   // This ensures our handler runs BEFORE Vite's handlers
   if (vite.httpServer) {
     vite.httpServer.prependListener('upgrade', (req, socket, head) => {
-      const pathname = req.url?.split('?')[0] || req.url || '';
-
-      // ONLY handle /ws - everything else passes through unchanged to Vite
-      if (pathname === '/ws') {
-        if (!socket.destroyed && !socket.readableEnded) {
-          wss.handleUpgrade(req, socket, head, (ws) => {
-            wss.emit('connection', ws, req);
-          });
-        }
-        // Stop here - we handled it, socket is consumed
-        // Don't call other listeners
+      // ONLY handle /ws - everything else passes through unchanged to Vite.
+      if (handleWebSocketUpgrade(req, socket, head)) {
         return;
       }
 
-      // For non-/ws paths, explicitly do nothing and let the event propagate
-      // The key is: don't return, don't touch the socket, just let it pass through
-      // Vite's handlers (which were added before ours via prependListener) will process it
+      // For non-/ws paths, explicitly do nothing and let the event propagate.
+      // The key is: don't return, don't touch the socket, just let Vite process it.
     });
   }
 
-  printBanner(`http://localhost:${HTTP_PORT}/demo/`);
+  printBanner(`http://${formatUrlHost(HOST)}:${HTTP_PORT}/demo/`);
 } else {
   // Production mode: static file server
-  httpServer.listen(HTTP_PORT, () => {
-    printBanner(`http://localhost:${HTTP_PORT}`);
+  httpServer.listen(HTTP_PORT, HOST, () => {
+    printBanner(`http://${formatUrlHost(HOST)}:${HTTP_PORT}`);
   });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ghostty-web/demo",
-  "version": "0.4.0-next.13.g65ed96f",
+  "version": "0.4.0-next.18.gbec9e16",
   "description": "Cross-platform demo server for ghostty-web terminal emulator",
   "type": "module",
   "bin": {
@@ -12,7 +12,7 @@
   },
   "dependencies": {
     "@lydell/node-pty": "^1.0.1",
-    "ghostty-web": "0.4.0-next.13.g65ed96f",
+    "ghostty-web": "0.4.0-next.18.gbec9e16",
     "ws": "^8.18.0"
   },
   "files": [