@goodandready/dsh-remote-workspace 0.3.9 → 0.3.11

package/lib/routes/helpers.js

@@ -10,18 +10,54 @@ export function writeJson(res, statusCode, body) {
   res.end(JSON.stringify(body));
 }
 
-export function readBody(req) {
+export const MAX_BODY_BYTES = 5 * 1024 * 1024; // 5 MiB
+
+export function readBody(req, maxBytes = MAX_BODY_BYTES) {
   return new Promise((resolve, reject) => {
+    const rawCl = req?.headers?.['content-length'];
+    const contentLength = rawCl !== undefined ? parseInt(Array.isArray(rawCl) ? rawCl[0] : rawCl, 10) : NaN;
+    if (!isNaN(contentLength) && contentLength > maxBytes) {
+      if (typeof req.destroy === 'function') req.destroy();
+      const error = new Error('Payload too large');
+      error.statusCode = 413;
+      return reject(error);
+    }
+
     let body = '';
-    req.on('data', (chunk) => { body += chunk.toString(); });
+    let bytesReceived = 0;
+    let exceeded = false;
+
+    function onData(chunk) {
+      if (exceeded) return;
+      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+      bytesReceived += buffer.length;
+      if (bytesReceived > maxBytes) {
+        exceeded = true;
+        if (typeof req.removeListener === 'function') {
+          req.removeListener('data', onData);
+        } else if (typeof req.off === 'function') {
+          req.off('data', onData);
+        }
+        if (typeof req.destroy === 'function') req.destroy();
+        const error = new Error('Payload too large');
+        error.statusCode = 413;
+        return reject(error);
+      }
+      body += buffer.toString('utf8');
+    }
+
+    req.on('data', onData);
     req.on('end', () => {
+      if (exceeded) return;
       try {
         resolve(body ? JSON.parse(body) : {});
       } catch (err) {
         reject(err);
       }
     });
-    req.on('error', reject);
+    req.on('error', (err) => {
+      if (!exceeded) reject(err);
+    });
   });
 }
 
@@ -39,16 +75,24 @@ export function parseCookies(cookieHeader) {
   return cookies;
 }
 
+export function isLoopbackAddress(address) {
+  if (!address || typeof address !== 'string') return false;
+  return address === '127.0.0.1' || address === '::1' || address === '::ffff:127.0.0.1' || address.startsWith('127.');
+}
+
 export function isTrustedSettingsRequest(req) {
-  const secFetch = req.headers['sec-fetch-site'];
+  const ip = req?.socket?.remoteAddress || '';
+  const isLoopback = isLoopbackAddress(ip);
+
+  const secFetch = req?.headers?.['sec-fetch-site'];
   // Fail-closed: unconditionally reject cross-site and cross-origin requests
   if (secFetch && secFetch !== 'same-origin') {
     return false;
   }
 
   // If origin is present, ensure it matches the request host
-  const origin = req.headers['origin'];
-  const host = req.headers['host'];
+  const origin = req?.headers?.['origin'];
+  const host = req?.headers?.['host'];
   if (origin && host) {
     try {
       const url = new URL(origin);
@@ -60,8 +104,8 @@ export function isTrustedSettingsRequest(req) {
     }
   }
 
-  const rawAuth = req.headers['authorization'];
-  const cookieHeader = req.headers['cookie'];
+  const rawAuth = req?.headers?.['authorization'];
+  const cookieHeader = req?.headers?.['cookie'];
   const expectedToken = process.env.DSH_AUTH_TOKEN || process.env.DSH_TOKEN;
 
   if (expectedToken) {
@@ -74,9 +118,53 @@ export function isTrustedSettingsRequest(req) {
       const token = cookies['token'] || cookies['dsh_token'];
       if (token && token === expectedToken) return true;
     }
+    return false;
   }
+
+  // Non-loopback requests without valid token must not pass simply on Sec-Fetch-Site: same-origin
+  if (!isLoopback) return false;
   if (secFetch === 'same-origin') return true;
-  const ip = req.socket?.remoteAddress || '';
-  if (ip === '127.0.0.1' || ip === '::1' || ip === '::ffff:127.0.0.1') return true;
-  return false;
+  return true;
+}
+
+export function getConnection(ctx) {
+  try {
+    return ctx?.reflect?.get ? ctx.reflect.get('connection') : (ctx?.get ? ctx.get('connection') : Reflect.get(ctx || {}, 'connection'));
+  } catch {
+    return undefined;
+  }
+}
+
+export function authorizeRequest(sctx, req, res) {
+  let connection;
+  try {
+    connection = getConnection(sctx);
+  } catch {
+    writeJson(res, 503, { ok: false, error: 'DSH browser authentication is unavailable' });
+    return false;
+  }
+
+  if (!connection || typeof connection.requestRejection !== 'function') {
+    writeJson(res, 503, { ok: false, error: 'DSH browser authentication is unavailable' });
+    return false;
+  }
+
+  let rejection;
+  try {
+    rejection = connection.requestRejection(req);
+  } catch {
+    writeJson(res, 503, { ok: false, error: 'DSH browser authentication is unavailable' });
+    return false;
+  }
+
+  if (rejection !== undefined) {
+    const status = rejection === 401 ? 401 : 403;
+    writeJson(res, status, {
+      ok: false,
+      error: status === 401 ? 'DSH browser authentication is required' : 'Forbidden'
+    });
+    return false;
+  }
+
+  return true;
 }

package/lib/routes/profiles.js

@@ -1,4 +1,4 @@
-import { writeJson, readBody, isTrustedSettingsRequest } from './helpers.js';
+import { writeJson, readBody, isTrustedSettingsRequest, authorizeRequest } from './helpers.js';
 import { SshConfigParser } from '../ssh-config-parser.js';
 import { testProfileGroup } from '../profile-groups.js';
 import { filterClusterProfiles, runCluster } from '../cluster-service.js';
@@ -19,7 +19,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
     path: '/dsh-remote-workspace/state',
     handler: async (req, res) => {
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const profiles = store.getProfiles();
         const activeId = store.getActiveId() || (profiles[0]?.id || '');
@@ -31,7 +31,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
         const terminalFontFamily = store.getTerminalFont ? store.getTerminalFont() : '';
         writeJson(res, 200, { ok: true, activeId, profiles: sanitized, tunnels, autoSync, alerts, authPrompts, terminalFontFamily });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /state');
@@ -42,7 +42,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
     path: '/dsh-remote-workspace/profiles/save',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const profile = await readBody(req);
         if (!profile.id || !profile.host) {
@@ -53,7 +53,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
         const sanitized = store.vault ? store.vault.sanitizeProfile(profile) : maskProfile(profile);
         writeJson(res, 200, { ok: true, profile: sanitized });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /profiles/save');
@@ -64,7 +64,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
     path: '/dsh-remote-workspace/profiles/delete',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { id } = await readBody(req);
         if (!id) return writeJson(res, 400, { ok: false, error: 'ID is required' });
@@ -72,7 +72,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
         await store.deleteProfile(id);
         writeJson(res, 200, { ok: true });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /profiles/delete');
@@ -83,14 +83,14 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
     path: '/dsh-remote-workspace/profiles/active',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { id } = await readBody(req);
         if (!id) return writeJson(res, 400, { ok: false, error: 'ID is required' });
         await store.setActiveId(id);
         writeJson(res, 200, { ok: true, activeId: id });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /profiles/active');
@@ -101,7 +101,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
     path: '/dsh-remote-workspace/profiles/import-ssh-config',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const body = await readBody(req);
         const content = typeof body.content === 'string' && body.content.trim()
@@ -119,7 +119,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
           skipped: report.skipped
         });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /profiles/import-ssh-config');
@@ -130,7 +130,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
     path: '/dsh-remote-workspace/auth/keyboard',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const body = await readBody(req);
         const answers = Array.isArray(body.answers) ? body.answers.slice(0, 20).map((item) => String(item ?? '').slice(0, 256)) : [];
@@ -138,7 +138,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
         if (!accepted) return writeJson(res, 404, { ok: false, error: 'No authentication prompt is waiting' });
         writeJson(res, 200, { ok: true });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /auth/keyboard');
@@ -149,7 +149,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
     path: '/dsh-remote-workspace/profiles/test-group',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const body = await readBody(req);
         const ids = Array.isArray(body.ids) ? body.ids.map((item) => String(item)) : [];
@@ -157,7 +157,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
         const results = await testProfileGroup(selected, (profile) => sshService.testConnection(profile));
         writeJson(res, 200, { ok: true, results });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /profiles/test-group');
@@ -168,7 +168,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
     path: '/dsh-remote-workspace/cluster',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const body = await readBody(req);
         if (!body.command || typeof body.command !== 'string') return writeJson(res, 400, { ok: false, error: 'Command is required' });
@@ -183,7 +183,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
         });
         writeJson(res, 200, { ok: true, results });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /cluster');
@@ -194,7 +194,7 @@ export function registerProfileRoutes(sctx, webServer, { store, sshService, aler
     path: '/dsh-remote-workspace/test',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const profile = await readBody(req);
         if (!profile.host) return writeJson(res, 400, { ok: false, error: 'Host is required' });

package/lib/routes/sync.js

@@ -1,4 +1,4 @@
-import { writeJson, readBody, isTrustedSettingsRequest } from './helpers.js';
+import { writeJson, readBody, isTrustedSettingsRequest, authorizeRequest } from './helpers.js';
 
 export function registerSyncRoutes(sctx, webServer, { mirrorSync, tarSyncService, watcherService, store }) {
   // 17. POST /dsh-remote-workspace/sync
@@ -7,7 +7,7 @@ export function registerSyncRoutes(sctx, webServer, { mirrorSync, tarSyncService
     path: '/dsh-remote-workspace/sync',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { profileId, direction, force, mode } = await readBody(req);
         const profile = (profileId ? store.getProfile(profileId) : null) || store.getActiveProfile();
@@ -28,7 +28,7 @@ export function registerSyncRoutes(sctx, webServer, { mirrorSync, tarSyncService
           : await mirrorSync.pull(profile, profile.remoteWorkspace, profile.localMirrorPath);
         writeJson(res, 200, { ok: resSync.success, ...resSync });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /sync');
@@ -39,13 +39,13 @@ export function registerSyncRoutes(sctx, webServer, { mirrorSync, tarSyncService
     path: '/dsh-remote-workspace/watcher/toggle',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { enabled } = await readBody(req);
         await store.setAutoSyncEnabled(Boolean(enabled));
         writeJson(res, 200, { ok: true, autoSync: store.isAutoSyncEnabled() });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /watcher/toggle');

package/lib/routes/terminal.js

@@ -1,4 +1,4 @@
-import { writeJson, readBody, isTrustedSettingsRequest } from './helpers.js';
+import { writeJson, readBody, isTrustedSettingsRequest, authorizeRequest } from './helpers.js';
 import { normalizeTerminalFont } from '../terminal-font.js';
 
 export function registerTerminalRoutes(sctx, webServer, { sshService, store }) {
@@ -8,7 +8,7 @@ export function registerTerminalRoutes(sctx, webServer, { sshService, store }) {
     path: '/dsh-remote-workspace/terminal/font',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const body = await readBody(req);
         const fontFamily = await store.setTerminalFont(body.fontFamily);
@@ -26,7 +26,7 @@ export function registerTerminalRoutes(sctx, webServer, { sshService, store }) {
     path: '/dsh-remote-workspace/terminal/create',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { profileId, cols, rows } = await readBody(req);
         const profile = profileId ? store.getProfile(profileId) : store.getActiveProfile();
@@ -34,7 +34,7 @@ export function registerTerminalRoutes(sctx, webServer, { sshService, store }) {
         const session = await sshService.createTerminalSession(profile, { cols: cols || 80, rows: rows || 24 });
         writeJson(res, 200, { ok: true, sessionId: session.id });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /terminal/create');
@@ -45,7 +45,7 @@ export function registerTerminalRoutes(sctx, webServer, { sshService, store }) {
     path: '/dsh-remote-workspace/terminal/input',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { sessionId, data, resize } = await readBody(req);
         const session = sshService.getTerminalSession(sessionId);
@@ -58,7 +58,7 @@ export function registerTerminalRoutes(sctx, webServer, { sshService, store }) {
         }
         writeJson(res, 200, { ok: true });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /terminal/input');
@@ -69,7 +69,7 @@ export function registerTerminalRoutes(sctx, webServer, { sshService, store }) {
     path: '/dsh-remote-workspace/terminal/stream',
     handler: async (req, res) => {
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const url = new URL(req.url, 'http://localhost');
         const sessionId = url.searchParams.get('sessionId');
@@ -99,7 +99,7 @@ export function registerTerminalRoutes(sctx, webServer, { sshService, store }) {
           session.subscribers.delete(sub);
         });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /terminal/stream');
@@ -110,13 +110,13 @@ export function registerTerminalRoutes(sctx, webServer, { sshService, store }) {
     path: '/dsh-remote-workspace/terminal/close',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { sessionId } = await readBody(req);
         sshService.closeTerminalSession(sessionId);
         writeJson(res, 200, { ok: true });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /terminal/close');

package/lib/routes/tunnels.js

@@ -1,4 +1,4 @@
-import { writeJson, readBody, isTrustedSettingsRequest } from './helpers.js';
+import { writeJson, readBody, isTrustedSettingsRequest, authorizeRequest } from './helpers.js';
 
 export function registerTunnelRoutes(sctx, webServer, { tunnelService, store }) {
   // 18. POST /dsh-remote-workspace/tunnels/start
@@ -7,7 +7,7 @@ export function registerTunnelRoutes(sctx, webServer, { tunnelService, store })
     path: '/dsh-remote-workspace/tunnels/start',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { profileId, localPort, targetHost, remotePort } = await readBody(req);
         const profile = (profileId ? store.getProfile(profileId) : null) || store.getActiveProfile();
@@ -20,7 +20,7 @@ export function registerTunnelRoutes(sctx, webServer, { tunnelService, store })
         const result = await tunnelService.startLocalTunnel(profile, lPort, targetHost || '127.0.0.1', rPort);
         writeJson(res, 200, { ok: result.success, ...result });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /tunnels/start');
@@ -31,14 +31,14 @@ export function registerTunnelRoutes(sctx, webServer, { tunnelService, store })
     path: '/dsh-remote-workspace/tunnels/stop',
     handler: async (req, res) => {
       if (req.method !== 'POST') return writeJson(res, 405, { ok: false, error: 'POST only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         const { tunnelId } = await readBody(req);
         if (!tunnelId) return writeJson(res, 400, { ok: false, error: 'tunnelId required' });
         const stopped = tunnelService.stopTunnel(tunnelId);
         writeJson(res, 200, { ok: stopped });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /tunnels/stop');
@@ -49,11 +49,11 @@ export function registerTunnelRoutes(sctx, webServer, { tunnelService, store })
     path: '/dsh-remote-workspace/tunnels/telemetry',
     handler: async (req, res) => {
       if (req.method !== 'GET') return writeJson(res, 405, { ok: false, error: 'GET only' });
-      if (!isTrustedSettingsRequest(req)) return writeJson(res, 403, { ok: false, error: 'Forbidden' });
+      if (!authorizeRequest(sctx, req, res)) return;
       try {
         writeJson(res, 200, { ok: true, tunnels: tunnelService.listActiveTunnels() });
       } catch (err) {
-        writeJson(res, 500, { ok: false, error: err.message });
+        writeJson(res, err.statusCode || (err.name === 'SyntaxError' ? 400 : 500), { ok: false, error: err.message });
       }
     }
   }), 'dsh-remote-workspace: /tunnels/telemetry');

package/lib/routes.js

@@ -8,7 +8,7 @@ import { registerTunnelRoutes } from './routes/tunnels.js';
 import { registerDockerRoutes } from './routes/docker.js';
 import { registerSyncRoutes } from './routes/sync.js';
 
-export { isTrustedSettingsRequest } from './routes/helpers.js';
+export { isTrustedSettingsRequest, authorizeRequest, readBody, MAX_BODY_BYTES } from './routes/helpers.js';
 
 export function registerApiRoutes(
   ctx,
@@ -44,7 +44,7 @@ export function registerApiRoutes(
 
     registerProfileRoutes(sctx, webServer, { store, sshService, alertService, tunnelService });
     registerFileRoutes(sctx, webServer, { remoteFs, store, sshService });
-    registerEnvRoutes(sctx, webServer, { envService, diagnoseService, sshService, store });
+    registerEnvRoutes(sctx, webServer, { envService, diagnoseService, sshService, store, remoteFs });
     registerTerminalRoutes(sctx, webServer, { sshService, store });
     registerTunnelRoutes(sctx, webServer, { tunnelService, store });
     registerDockerRoutes(sctx, webServer, { dockerService, healthService, store });

package/lib/ssh-service.js

@@ -93,6 +93,21 @@ export class SshService {
       this.connMeta.delete(id);
       closed.push(id);
     }
+    this.sweepAbandonedTerminalSessions(now);
+    return closed;
+  }
+
+  sweepAbandonedTerminalSessions(now = Date.now(), idleTimeoutMs = 10 * 60 * 1000) {
+    const closed = [];
+    for (const [id, session] of this.terminalSessions.entries()) {
+      const hasSubscribers = session.subscribers && session.subscribers.size > 0;
+      const lastActive = session.lastActive || session.createdAt || now;
+      if (!hasSubscribers && (now - lastActive >= idleTimeoutMs)) {
+        try { session.close(); } catch (err) { /* best-effort cleanup */ }
+        this.terminalSessions.delete(id);
+        closed.push(id);
+      }
+    }
     return closed;
   }
 
@@ -368,7 +383,8 @@ export class SshService {
       this.bumpInFlight(profile.id, -1);
       throw err;
     }
-    const shellCmd = cwd ? `cd ${JSON.stringify(cwd)} && ${command}` : command;
+    const safeCwd = cwd ? "'" + String(cwd).replace(/'/g, "'\\''") + "'" : '';
+    const shellCmd = cwd ? `cd ${safeCwd} && ${command}` : command;
 
     const execOptions = {};
     if (pty) {
@@ -486,12 +502,15 @@ export class SshService {
           profileId: profile.id,
           stream,
           createdAt: Date.now(),
+          lastActive: Date.now(),
           buffer: [],
           subscribers: new Set(),
           write(data) {
+            session.lastActive = Date.now();
             try { stream.write(data); } catch (err) { session.status = 'disconnected'; const lost = '\r\n\x1b[31m[Connection lost]\x1b[0m\r\n'; session.buffer.push(lost); for (const sub of session.subscribers) { try { sub(lost); } catch (e) { /* best-effort notify */ } } }
           },
           resize(c, r) {
+            session.lastActive = Date.now();
             try { stream.setWindow(r, c, 0, 0); } catch (err) { /* best-effort cleanup */ }
           },
           close() {
@@ -503,6 +522,7 @@ export class SshService {
         };
 
         stream.on('data', (d) => {
+          session.lastActive = Date.now();
           const chunk = d.toString('utf8');
           session.buffer.push(chunk);
           if (session.buffer.length > 500) session.buffer.shift();

package/lib/tar-sync-service.js

@@ -40,14 +40,27 @@ export class TarSyncService {
 
         localTar.on('close', (code) => {
           if (code !== 0) {
+            try { stream.destroy(); } catch (_) {}
             reject(new Error(`Local tar extraction failed (code ${code}): ${stderr}`));
           } else {
             resolve({ ok: true, direction: 'pull', remoteDir, localDir });
           }
         });
 
-        stream.on('error', reject);
-        localTar.stdin.on('error', reject);
+        localTar.on('error', (err) => {
+          try { stream.destroy(); } catch (_) {}
+          reject(err);
+        });
+
+        stream.on('error', (err) => {
+          try { localTar.kill('SIGTERM'); } catch (_) {}
+          reject(err);
+        });
+
+        localTar.stdin.on('error', (err) => {
+          try { stream.destroy(); } catch (_) {}
+          reject(err);
+        });
       });
     });
   }
@@ -80,14 +93,22 @@ export class TarSyncService {
 
         stream.on('close', (code) => {
           if (code !== 0) {
+            try { localTar.kill('SIGTERM'); } catch (_) {}
             reject(new Error(`Remote tar extraction failed (code ${code}): ${remoteStderr}`));
           } else {
             resolve({ ok: true, direction: 'push', localDir, remoteDir });
           }
         });
 
-        stream.on('error', reject);
-        localTar.on('error', reject);
+        stream.on('error', (err) => {
+          try { localTar.kill('SIGTERM'); } catch (_) {}
+          reject(err);
+        });
+
+        localTar.on('error', (err) => {
+          try { stream.destroy(); } catch (_) {}
+          reject(err);
+        });
       });
     });
   }

package/lib/tunnel-service.js

@@ -73,8 +73,13 @@ export class TunnelService {
             clientSocket.pipe(stream);
             stream.pipe(clientSocket);
 
+            let cleaned = false;
             const cleanup = () => {
+              if (cleaned) return;
+              cleaned = true;
               tunnelMeta.activeConnections = Math.max(0, tunnelMeta.activeConnections - 1);
+              try { clientSocket.destroy(); } catch (err) { /* best-effort */ }
+              try { stream.destroy(); } catch (err) { /* best-effort */ }
             };
             clientSocket.on('close', cleanup);
             clientSocket.on('error', cleanup);