@matter/nodejs-shell 0.17.5-alpha.0-20260702-a2cd6f764 → 0.17.5-alpha.0-20260706-fd4c49e2e

package/README.md

@@ -4,6 +4,8 @@ This project provides a light-weight node.js implementation of a Matter shell ap
 
 > This package supports all Node.js LTS versions starting with 20.x
 
+> **⚠️ Development and testing tool only.** The shell (and its optional WebSocket/web interface) is intended for development, testing and debugging. It is **not** hardened for production use: it has no authentication, stores credentials unencrypted on disk, and the WebSocket/web interface serves the shell without access control. Do not expose it on untrusted networks or run it as a production service.
+
 ## Install
 
 If you want to install just the shell app then you can do so by running:
@@ -448,6 +450,8 @@ $ more .matter-shell-1/Node.ip
 
 If the matter shell is started with the parameter --webSocketInterface all interaction with the shell will be done over a websocket instead of the local terminal. The parameter --webSocketPort NNNN can be used to change from the default port of 3000 to a user-specified port. If the parameter --webServer is added, the matter shell will also start an http server that will serve files from the same directory as the application itself utilizying the same port as the websocket. The functionality of the shell will be identical to the above description with the exception that the "exit" command will only close the websocket and not exit the matter shell application.
 
+> **⚠️ Security:** The WebSocket/web interface has **no authentication** — anyone who can reach the port gets full shell control. By default it binds to loopback (`127.0.0.1`) only; a warning is logged to remind you of this. To expose it on other interfaces pass `--webAddress <address>` (e.g. `--webAddress 0.0.0.0`), but only do so on a trusted network. This interface is meant for local development and testing, not for production or internet-facing deployments.
+
 An example application that shows interaction from a web browser is included. The example shows how commands can be sent from html and javascript in the browser to the shell and how the results of the commands can be parsed to create a user interface. 
 
 ![Web Interface](src/shell/webassets/WebShell.png "Example Application")

package/dist/esm/app.js

@@ -91,6 +91,11 @@ async function main() {
           description: "Enable Web server when using WebSocket interface",
           type: "boolean",
           default: false
+        },
+        webAddress: {
+          description: "Address the WebSocket/web server binds to. Defaults to loopback (127.0.0.1); pass e.g. 0.0.0.0 to expose on all interfaces.",
+          type: "string",
+          default: void 0
         }
       });
     },
@@ -108,7 +113,8 @@ async function main() {
         logfile,
         webSocketInterface,
         webSocketPort,
-        webServer
+        webServer,
+        webAddress
       } = argv;
       theNode = new MatterNode(nodeNum, netInterface);
       await theNode.initialize(factoryReset);
@@ -128,7 +134,7 @@ async function main() {
       setLogLevel("default", await theNode.Store.get("LogLevel", "info"));
       if (webSocketInterface) {
         Logger.format = LogFormat.PLAIN;
-        initializeWebPlumbing(theNode, nodeNum, webSocketPort, webServer);
+        initializeWebPlumbing(theNode, nodeNum, webSocketPort, webServer, webAddress);
       } else {
         theShell = new Shell(theNode, nodeNum, PROMPT, process.stdin, process.stdout);
       }

package/dist/esm/app.js.map

@@ -1,6 +1,6 @@
 {
   "version": 3,
   "sources": ["../../src/app.ts"],
-  "mappings": ";AACA;AAAA;AAAA;AAAA;AAAA;AAMA,SAAS,aAAa,gBAAgB,WAAW,QAAQ,gBAAgB;AACzE,SAAS,wBAAwB;AACjC,OAAO;AACP,OAAO,WAAW;AAClB,SAAS,eAAe;AACxB,SAAS,kBAAkB;AAC3B,SAAS,aAAa;AACtB,SAAS,6BAA6B;AAEtC,MAAM,SAAS;AACf,MAAM,yBAAyB;AAC/B,MAAM,SAAS,OAAO,IAAI,OAAO;AACjC,IAAI;AAEJ,IAAI,QAAQ,OAAO,MAAO,QAAO,SAAS,UAAU;AAEpD,IAAI;AAEG,SAAS,YAAY,YAAoB,OAAqB;AACjE,MAAI,WAAW,SAAS;AACxB,UAAQ,OAAO;AAAA,IACX,KAAK;AACD,iBAAW,SAAS;AACpB;AAAA,IACJ,KAAK;AACD,iBAAW,SAAS;AACpB;AAAA,IACJ,KAAK;AACD,iBAAW,SAAS;AACpB;AAAA,IACJ,KAAK;AACD,iBAAW,SAAS;AACpB;AAAA,EACR;AACA,SAAO,aAAa,UAAU,EAAE,QAAQ;AAC5C;AAKA,eAAe,OAAO;AAClB,QAAM,gBAAgB,MAAM,EACvB;AAAA,IACG;AAAA,IACA;AAAA,IACA,CAAAA,WAAS;AACL,aAAOA,OACF,WAAW,YAAY;AAAA,QACpB,UAAU;AAAA,QACV,SAAS;AAAA,QACT,MAAM;AAAA,MACV,CAAC,EACA,WAAW,aAAa;AAAA,QACrB,UAAU;AAAA,QACV,SAAS,CAAC,YAAY;AAAA,QACtB,SAAS;AAAA,QACT,MAAM;AAAA,MACV,CAAC,EACA,QAAQ;AAAA,QACL,cAAc;AAAA,UACV,aAAa;AAAA,UACb,MAAM;AAAA,UACN,SAAS;AAAA,UACT,OAAO;AAAA,QACX;AAAA,QACA,UAAU;AAAA,UACN,aACI;AAAA,UACJ,MAAM;AAAA,UACN,SAAS;AAAA,QACb;AAAA,QACA,cAAc;AAAA,UACV,aAAa;AAAA,UACb,SAAS;AAAA,UACT,MAAM;AAAA,QACV;AAAA,QACA,cAAc;AAAA,UACV,aAAa;AAAA,UACb,MAAM;AAAA,UACN,SAAS;AAAA,QACb;AAAA,QACA,SAAS;AAAA,UACL,aACI;AAAA,UACJ,MAAM;AAAA,UACN,SAAS;AAAA,QACb;AAAA,QACA,oBAAoB;AAAA,UAChB,aAAa;AAAA,UACb,MAAM;AAAA,UACN,SAAS;AAAA,QACb;AAAA,QACA,eAAe;AAAA,UACX,aAAa;AAAA,UACb,MAAM;AAAA,UACN,SAAS;AAAA,QACb;AAAA,QACA,WAAW;AAAA,UACP,aAAa;AAAA,UACb,MAAM;AAAA,UACN,SAAS;AAAA,QACb;AAAA,MACJ,CAAC;AAAA,IACT;AAAA,IACA,OAAM,SAAQ;AACV,UAAI,KAAK,MAAM;AACX;AAAA,MACJ;AAEA,YAAM;AAAA,QACF;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACJ,IAAI;AAEJ,gBAAU,IAAI,WAAW,SAAS,YAAY;AAC9C,YAAM,QAAQ,WAAW,YAAY;AAErC,UAAI,YAAY,QAAW;AACvB,cAAM,QAAQ,MAAM,IAAI,WAAW,OAAO;AAAA,MAC9C;AACA,UAAI,MAAM,QAAQ,MAAM,IAAI,SAAS,GAAG;AACpC,cAAM,oBAAoB,MAAM,QAAQ,MAAM,IAAY,SAAS;AACnE,YAAI,sBAAsB,QAAW;AACjC,iBAAO,aAAa,OAAO,eAAe;AAAA,YACtC,OAAO,MAAM,iBAAiB,iBAAiB;AAAA,YAC/C,OAAO,SAAS,MAAM,QAAQ,MAAM,IAAc,gBAAgB,SAAS,KAAK,CAAC;AAAA,YACjF,QAAQ,UAAU,OAAO;AAAA,UAC7B,CAAC;AAAA,QACL;AAAA,MACJ;AACA,kBAAY,WAAW,MAAM,QAAQ,MAAM,IAAY,YAAY,MAAM,CAAC;AAE1E,UAAI,oBAAoB;AACpB,eAAO,SAAS,UAAU;AAC1B,8BAAsB,SAAS,SAAS,eAAe,SAAS;AAAA,MACpE,OAAO;AACH,mBAAW,IAAI,MAAM,SAAS,SAAS,QAAQ,QAAQ,OAAO,QAAQ,MAAM;AAAA,MAChF;AAEA,UAAI,WAAW;AACX,oBAAY,QAAQ,KAAK,IAAI,cAAc,IAAI;AAAA,MACnD;AAEA,UAAI,aAAa,QAAW;AACxB,oBAAY,QAAQ,KAAK,IAAI,cAAc,QAAQ;AAAA,MACvD;AAEA,cAAQ,IAAI,iBAAiB,OAAO,WAAW,QAAQ,KAAK,YAAY,SAAS,SAAS,MAAM;AAChG,UAAI,CAAC,oBAAoB;AACrB,iBAAS,MAAM,QAAQ,eAAe;AAAA,MAC1C;AAAA,IACJ;AAAA,EACJ,EACC,QAAQ,KAAK,EACb,WAAW,OAAO,EAClB,OAAO;AACZ,QAAM,cAAc,KAAK,cAAc,cAAc,CAAC,EAAE,MAAM,QAAQ,QAAQ,IAAI,CAAC;AACvF;AAEA,QAAQ,GAAG,WAAW,SAAU,SAAS;AACrC,UAAQ,IAAI,wBAAwB,OAAO,EAAE;AAE7C,UAAQ,SAAS;AAAA,IACb,KAAK;AACD,WAAK,EAAE,MAAM,WAAS,OAAO,MAAM,qBAAqB,KAAK,CAAC;AAAA,EACtE;AACJ,CAAC;AAED,eAAsB,KAAK,OAAO,GAAG;AACjC,UAAQ,WAAW;AACnB,cAAY,QAAQ,QAAQ,OAAO;AACvC;AAEA,MAAM,UAAU,YAAY,QAAQ;AACpC,QAAQ,IAAI,KAAK,CAAC;AAClB,KAAK,QAAQ,SAAS,KAAK,MAAM,QAAQ,KAAK,QAAQ,YAAY,CAAC,CAAC;",
+  "mappings": ";AACA;AAAA;AAAA;AAAA;AAAA;AAMA,SAAS,aAAa,gBAAgB,WAAW,QAAQ,gBAAgB;AACzE,SAAS,wBAAwB;AACjC,OAAO;AACP,OAAO,WAAW;AAClB,SAAS,eAAe;AACxB,SAAS,kBAAkB;AAC3B,SAAS,aAAa;AACtB,SAAS,6BAA6B;AAEtC,MAAM,SAAS;AACf,MAAM,yBAAyB;AAC/B,MAAM,SAAS,OAAO,IAAI,OAAO;AACjC,IAAI;AAEJ,IAAI,QAAQ,OAAO,MAAO,QAAO,SAAS,UAAU;AAEpD,IAAI;AAEG,SAAS,YAAY,YAAoB,OAAqB;AACjE,MAAI,WAAW,SAAS;AACxB,UAAQ,OAAO;AAAA,IACX,KAAK;AACD,iBAAW,SAAS;AACpB;AAAA,IACJ,KAAK;AACD,iBAAW,SAAS;AACpB;AAAA,IACJ,KAAK;AACD,iBAAW,SAAS;AACpB;AAAA,IACJ,KAAK;AACD,iBAAW,SAAS;AACpB;AAAA,EACR;AACA,SAAO,aAAa,UAAU,EAAE,QAAQ;AAC5C;AAKA,eAAe,OAAO;AAClB,QAAM,gBAAgB,MAAM,EACvB;AAAA,IACG;AAAA,IACA;AAAA,IACA,CAAAA,WAAS;AACL,aAAOA,OACF,WAAW,YAAY;AAAA,QACpB,UAAU;AAAA,QACV,SAAS;AAAA,QACT,MAAM;AAAA,MACV,CAAC,EACA,WAAW,aAAa;AAAA,QACrB,UAAU;AAAA,QACV,SAAS,CAAC,YAAY;AAAA,QACtB,SAAS;AAAA,QACT,MAAM;AAAA,MACV,CAAC,EACA,QAAQ;AAAA,QACL,cAAc;AAAA,UACV,aAAa;AAAA,UACb,MAAM;AAAA,UACN,SAAS;AAAA,UACT,OAAO;AAAA,QACX;AAAA,QACA,UAAU;AAAA,UACN,aACI;AAAA,UACJ,MAAM;AAAA,UACN,SAAS;AAAA,QACb;AAAA,QACA,cAAc;AAAA,UACV,aAAa;AAAA,UACb,SAAS;AAAA,UACT,MAAM;AAAA,QACV;AAAA,QACA,cAAc;AAAA,UACV,aAAa;AAAA,UACb,MAAM;AAAA,UACN,SAAS;AAAA,QACb;AAAA,QACA,SAAS;AAAA,UACL,aACI;AAAA,UACJ,MAAM;AAAA,UACN,SAAS;AAAA,QACb;AAAA,QACA,oBAAoB;AAAA,UAChB,aAAa;AAAA,UACb,MAAM;AAAA,UACN,SAAS;AAAA,QACb;AAAA,QACA,eAAe;AAAA,UACX,aAAa;AAAA,UACb,MAAM;AAAA,UACN,SAAS;AAAA,QACb;AAAA,QACA,WAAW;AAAA,UACP,aAAa;AAAA,UACb,MAAM;AAAA,UACN,SAAS;AAAA,QACb;AAAA,QACA,YAAY;AAAA,UACR,aACI;AAAA,UACJ,MAAM;AAAA,UACN,SAAS;AAAA,QACb;AAAA,MACJ,CAAC;AAAA,IACT;AAAA,IACA,OAAM,SAAQ;AACV,UAAI,KAAK,MAAM;AACX;AAAA,MACJ;AAEA,YAAM;AAAA,QACF;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACJ,IAAI;AAEJ,gBAAU,IAAI,WAAW,SAAS,YAAY;AAC9C,YAAM,QAAQ,WAAW,YAAY;AAErC,UAAI,YAAY,QAAW;AACvB,cAAM,QAAQ,MAAM,IAAI,WAAW,OAAO;AAAA,MAC9C;AACA,UAAI,MAAM,QAAQ,MAAM,IAAI,SAAS,GAAG;AACpC,cAAM,oBAAoB,MAAM,QAAQ,MAAM,IAAY,SAAS;AACnE,YAAI,sBAAsB,QAAW;AACjC,iBAAO,aAAa,OAAO,eAAe;AAAA,YACtC,OAAO,MAAM,iBAAiB,iBAAiB;AAAA,YAC/C,OAAO,SAAS,MAAM,QAAQ,MAAM,IAAc,gBAAgB,SAAS,KAAK,CAAC;AAAA,YACjF,QAAQ,UAAU,OAAO;AAAA,UAC7B,CAAC;AAAA,QACL;AAAA,MACJ;AACA,kBAAY,WAAW,MAAM,QAAQ,MAAM,IAAY,YAAY,MAAM,CAAC;AAE1E,UAAI,oBAAoB;AACpB,eAAO,SAAS,UAAU;AAC1B,8BAAsB,SAAS,SAAS,eAAe,WAAW,UAAU;AAAA,MAChF,OAAO;AACH,mBAAW,IAAI,MAAM,SAAS,SAAS,QAAQ,QAAQ,OAAO,QAAQ,MAAM;AAAA,MAChF;AAEA,UAAI,WAAW;AACX,oBAAY,QAAQ,KAAK,IAAI,cAAc,IAAI;AAAA,MACnD;AAEA,UAAI,aAAa,QAAW;AACxB,oBAAY,QAAQ,KAAK,IAAI,cAAc,QAAQ;AAAA,MACvD;AAEA,cAAQ,IAAI,iBAAiB,OAAO,WAAW,QAAQ,KAAK,YAAY,SAAS,SAAS,MAAM;AAChG,UAAI,CAAC,oBAAoB;AACrB,iBAAS,MAAM,QAAQ,eAAe;AAAA,MAC1C;AAAA,IACJ;AAAA,EACJ,EACC,QAAQ,KAAK,EACb,WAAW,OAAO,EAClB,OAAO;AACZ,QAAM,cAAc,KAAK,cAAc,cAAc,CAAC,EAAE,MAAM,QAAQ,QAAQ,IAAI,CAAC;AACvF;AAEA,QAAQ,GAAG,WAAW,SAAU,SAAS;AACrC,UAAQ,IAAI,wBAAwB,OAAO,EAAE;AAE7C,UAAQ,SAAS;AAAA,IACb,KAAK;AACD,WAAK,EAAE,MAAM,WAAS,OAAO,MAAM,qBAAqB,KAAK,CAAC;AAAA,EACtE;AACJ,CAAC;AAED,eAAsB,KAAK,OAAO,GAAG;AACjC,UAAQ,WAAW;AACnB,cAAY,QAAQ,QAAQ,OAAO;AACvC;AAEA,MAAM,UAAU,YAAY,QAAQ;AACpC,QAAQ,IAAI,KAAK,CAAC;AAClB,KAAK,QAAQ,SAAS,KAAK,MAAM,QAAQ,KAAK,QAAQ,YAAY,CAAC,CAAC;",
   "names": ["yargs"]
 }

package/dist/esm/web_plumbing.js

@@ -14,26 +14,56 @@ let client;
 let server;
 let wss;
 const socketLogger = "websocket";
-function initializeWebPlumbing(theNode, nodeNum, webSocketPort, webServer) {
+const logger = Logger.get("WebPlumbing");
+const DEFAULT_LISTEN_ADDRESS = "127.0.0.1";
+function initializeWebPlumbing(theNode, nodeNum, webSocketPort, webServer, listenAddress) {
+  const configuredAddress = listenAddress?.trim() || void 0;
+  const listenHost = configuredAddress ?? DEFAULT_LISTEN_ADDRESS;
+  if (configuredAddress === void 0) {
+    logger.warn(
+      `No listen address configured; binding the WebSocket/web server to loopback ${DEFAULT_LISTEN_ADDRESS} only. Pass --webAddress <address> (e.g. 0.0.0.0) to expose it on other interfaces.`
+    );
+  }
   if (webServer) {
-    const root = path.resolve(__dirname) ?? "./";
+    const resolvedRoot = path.resolve(__dirname);
+    let root;
+    try {
+      root = fs.realpathSync(resolvedRoot);
+    } catch (error) {
+      logger.warn(`Could not resolve web root real path (${resolvedRoot}): ${error}. Using unresolved path.`);
+      root = resolvedRoot;
+    }
+    const rootWithSep = root.endsWith(path.sep) ? root : root + path.sep;
+    const isContained = (candidate) => candidate === root || candidate.startsWith(rootWithSep);
     server = http.createServer((req, res) => {
       const url = req.url ?? "/";
-      const safePath = path.normalize(
-        path.join(root, decodeURIComponent(url === "/" ? "/index.html" : url))
-      );
-      if (!safePath.startsWith(root)) {
+      let decodedPath;
+      try {
+        decodedPath = decodeURIComponent(url === "/" ? "/index.html" : url);
+      } catch {
+        res.writeHead(400).end("Bad Request");
+        return;
+      }
+      const safePath = path.normalize(path.join(root, decodedPath));
+      if (!isContained(safePath)) {
         res.writeHead(403).end("Forbidden");
         return;
       }
-      fs.readFile(safePath, (err, data) => {
-        if (err) return res.writeHead(404).end("Not Found");
-        res.writeHead(200).end(data);
+      fs.realpath(safePath, (realpathErr, resolvedPath) => {
+        if (realpathErr) return res.writeHead(404).end("Not Found");
+        if (!isContained(resolvedPath)) {
+          res.writeHead(403).end("Forbidden");
+          return;
+        }
+        fs.readFile(resolvedPath, (err, data) => {
+          if (err) return res.writeHead(404).end("Not Found");
+          res.writeHead(200).end(data);
+        });
       });
-    }).listen(webSocketPort);
+    }).listen(webSocketPort, listenHost);
     wss = new WebSocketServer({ server });
-  } else wss = new WebSocketServer({ port: webSocketPort });
-  console.info(`WebSocket server running on ws://localhost:${webSocketPort}`);
+  } else wss = new WebSocketServer({ port: webSocketPort, host: listenHost });
+  console.info(`WebSocket server listening on ${listenHost} port ${webSocketPort}`);
   console.log = // console.debug = // too much traffic - kills the websocket
   console.info = console.warn = console.error = (...args) => {
     if (client && client.readyState === WebSocket.OPEN) {
@@ -50,11 +80,11 @@ function initializeWebPlumbing(theNode, nodeNum, webSocketPort, webServer) {
       return;
     }
     client = ws;
-    createWebSocketLogger(ws).then((logger) => {
+    createWebSocketLogger(ws).then((logger2) => {
       delete Logger.destinations["Shell"];
       Logger.destinations[socketLogger] = LogDestination({
         name: socketLogger,
-        write: (text, message) => logger(message.level, text)
+        write: (text, message) => logger2(message.level, text)
       });
     }).catch((err) => {
       console.error("Failed to add WebSocket logger: " + err);

package/dist/esm/web_plumbing.js.map

@@ -1,6 +1,6 @@
 {
   "version": 3,
   "sources": ["../../src/web_plumbing.ts"],
-  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,SAAS,gBAAgB,cAAwB;AACjD,SAAS,UAAU,gBAAgB;AACnC,OAAO,aAAmB,uBAAuB;AAEjD,SAAS,aAAa;AAEtB,OAAO,QAAQ;AACf,OAAO,UAAsB;AAC7B,OAAO,UAAU;AAGjB,IAAI;AACJ,IAAI;AACJ,IAAI;AACJ,MAAM,eAAe;AAEd,SAAS,sBACZ,SACA,SACA,eACA,WACI;AACJ,MAAI,WAAW;AACX,UAAM,OAAe,KAAK,QAAQ,SAAS,KAAK;AAEhD,aAAS,KACJ,aAAa,CAAC,KAAK,QAAQ;AACxB,YAAM,MAAM,IAAI,OAAO;AACvB,YAAM,WAAmB,KAAK;AAAA,QAC1B,KAAK,KAAK,MAAM,mBAAmB,QAAQ,MAAM,gBAAgB,GAAG,CAAC;AAAA,MACzE;AAGA,UAAI,CAAC,SAAS,WAAW,IAAI,GAAG;AAC5B,YAAI,UAAU,GAAG,EAAE,IAAI,WAAW;AAClC;AAAA,MACJ;AAEA,SAAG,SAAS,UAAU,CAAC,KAAK,SAAS;AACjC,YAAI,IAAK,QAAO,IAAI,UAAU,GAAG,EAAE,IAAI,WAAW;AAClD,YAAI,UAAU,GAAG,EAAE,IAAI,IAAI;AAAA,MAC/B,CAAC;AAAA,IACL,CAAC,EACA,OAAO,aAAa;AACzB,UAAM,IAAI,gBAAgB,EAAE,OAAO,CAAC;AAAA,EACxC,MAAO,OAAM,IAAI,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAExD,UAAQ,KAAK,8CAA8C,aAAa,EAAE;AAE1E,UAAQ;AAAA,EAEJ,QAAQ,OACR,QAAQ,OACR,QAAQ,QACJ,IAAI,SAAgB;AAChB,QAAI,UAAU,OAAO,eAAe,UAAU,MAAM;AAChD,aAAO,KAAK,KAAK,IAAI,SAAQ,OAAO,QAAQ,WAAW,KAAK,UAAU,GAAG,IAAI,GAAI,EAAE,KAAK,GAAG,CAAC;AAAA,IAChG;AACI,cAAQ,OAAO;AAAA,QACX,KAAK,IAAI,SAAQ,OAAO,QAAQ,WAAW,KAAK,UAAU,GAAG,IAAI,GAAI,EAAE,KAAK,GAAG,IAAI;AAAA,MACvF;AAAA,EACR;AAER,MAAI,GAAG,cAAc,CAAC,OAAkB;AACpC,QAAI,UAAU,OAAO,eAAe,UAAU,MAAM;AAChD,SAAG,KAAK,uCAAuC;AAC/C,SAAG,MAAM;AACT;AAAA,IACJ;AAEA,aAAS;AAET,0BAAsB,EAAE,EACnB,KAAK,YAAU;AACZ,aAAO,OAAO,aAAa,OAAO;AAClC,aAAO,aAAa,YAAY,IAAI,eAAe;AAAA,QAC/C,MAAM;AAAA,QACN,OAAO,CAAC,MAAM,YAAY,OAAO,QAAQ,OAAO,IAAI;AAAA,MACxD,CAAC;AAAA,IACL,CAAC,EACA,MAAM,SAAO;AACV,cAAQ,MAAM,qCAAqC,GAAG;AAAA,IAC1D,CAAC;AAEL,UAAM,QAAQ,IAAI,MAAM,SAAS,SAAS,IAAI,qBAAqB,EAAE,GAAG,qBAAqB,EAAE,CAAC;AAChG,UAAM,MAAM,QAAQ,eAAe;AAEnC,OAAG,GAAG,SAAS,MAAM;AACjB,cAAQ,OAAO,MAAM,uBAAuB;AAC5C,UAAI,gBAAgB,OAAO,cAAc;AACrC,eAAO,OAAO,aAAa,YAAY;AAAA,MAC3C;AAEA,eAAS;AAAA,IACb,CAAC;AACD,OAAG,GAAG,SAAS,SAAO;AAClB,cAAQ,OAAO,MAAM,oBAAoB,IAAI,OAAO;AAAA,CAAI;AACxD,UAAI,gBAAgB,OAAO,cAAc;AACrC,eAAO,OAAO,aAAa,YAAY;AAAA,MAC3C;AAAA,IACJ,CAAC;AAAA,EACL,CAAC;AAED,iBAAe,sBAAsB,QAA6E;AAC9G,QAAI,OAAO,eAAe,UAAU,YAAY;AAC5C,YAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AACzC,eAAO,SAAS,MAAM,QAAQ;AAC9B,eAAO,UAAU,SAAO,OAAO,IAAI,MAAM,oBAAoB,IAAI,IAAI,EAAE,CAAC;AAAA,MAC5E,CAAC;AAAA,IACL;AAEA,WAAO,CAAC,SAAmB,iBAAyB;AAChD,UAAI,OAAO,eAAe,UAAU,MAAM;AACtC,eAAO,KAAK,YAAY;AAAA,MAC5B,OAAO;AACH,gBAAQ,OAAO,MAAM,2CAA2C,YAAY;AAAA,CAAI;AAAA,MACpF;AAAA,IACJ;AAAA,EACJ;AACJ;AACA,SAAS,qBAAqB,IAAyB;AACnD,QAAM,WAAW,IAAI,SAAS,EAAE,OAAO;AAAA,EAAC,EAAE,CAAC;AAE3C,KAAG,GAAG,WAAW,CAAC,SAAe;AAC7B,UAAM,QAAQ,OAAO,SAAS,IAAI,IAAI,OAAO,OAAO,KAAK,KAAK,SAAS,CAAC;AAGxE,aAAS,KAAK,KAAK;AAAA,EACvB,CAAC;AAED,KAAG,GAAG,SAAS,MAAM;AACjB,aAAS,KAAK,IAAI;AAAA,EACtB,CAAC;AACD,KAAG,GAAG,SAAS,SAAO;AAClB,aAAS,KAAK,SAAS,GAAG;AAC1B,aAAS,KAAK,IAAI;AAAA,EACtB,CAAC;AAED,SAAO;AACX;AACA,SAAS,qBAAqB,IAAyB;AACnD,QAAM,WAAW,IAAI,SAAS;AAAA,IAC1B,MAAM,OAAe,WAAmB,UAA0C;AAC9E,UAAI,GAAG,eAAe,UAAU,MAAM;AAClC,WAAG,KAAK,OAAO,QAAQ;AAAA,MAC3B,OAAO;AACH,YAAI,MAAM,SAAS,EAAG,SAAQ,OAAO,MAAM,iDAAiD,KAAK;AAAA,CAAK;AAAA,MAC1G;AAAA,IACJ;AAAA,IACA,MAAM,UAA0C;AAC5C,UAAI,GAAG,eAAe,UAAU,MAAM;AAClC,WAAG,MAAM;AAAA,MACb;AACA,eAAS;AAAA,IACb;AAAA,EACJ,CAAC;AAED,KAAG,GAAG,SAAS,SAAO,SAAS,KAAK,2BAA2B,GAAG,CAAC;AACnE,SAAO;AACX;",
-  "names": []
+  "mappings": "AAAA;AAAA;AAAA;AAAA;AAAA;AAMA,SAAS,gBAAgB,cAAwB;AACjD,SAAS,UAAU,gBAAgB;AACnC,OAAO,aAAmB,uBAAuB;AAEjD,SAAS,aAAa;AAEtB,OAAO,QAAQ;AACf,OAAO,UAAsB;AAC7B,OAAO,UAAU;AAGjB,IAAI;AACJ,IAAI;AACJ,IAAI;AACJ,MAAM,eAAe;AACrB,MAAM,SAAS,OAAO,IAAI,aAAa;AAEvC,MAAM,yBAAyB;AAExB,SAAS,sBACZ,SACA,SACA,eACA,WACA,eACI;AACJ,QAAM,oBAAoB,eAAe,KAAK,KAAK;AACnD,QAAM,aAAa,qBAAqB;AACxC,MAAI,sBAAsB,QAAW;AACjC,WAAO;AAAA,MACH,8EAA8E,sBAAsB;AAAA,IAExG;AAAA,EACJ;AAEA,MAAI,WAAW;AACX,UAAM,eAAe,KAAK,QAAQ,SAAS;AAC3C,QAAI;AACJ,QAAI;AACA,aAAO,GAAG,aAAa,YAAY;AAAA,IACvC,SAAS,OAAO;AACZ,aAAO,KAAK,yCAAyC,YAAY,MAAM,KAAK,0BAA0B;AACtG,aAAO;AAAA,IACX;AACA,UAAM,cAAc,KAAK,SAAS,KAAK,GAAG,IAAI,OAAO,OAAO,KAAK;AAGjE,UAAM,cAAc,CAAC,cAAsB,cAAc,QAAQ,UAAU,WAAW,WAAW;AAEjG,aAAS,KACJ,aAAa,CAAC,KAAK,QAAQ;AACxB,YAAM,MAAM,IAAI,OAAO;AACvB,UAAI;AACJ,UAAI;AACA,sBAAc,mBAAmB,QAAQ,MAAM,gBAAgB,GAAG;AAAA,MACtE,QAAQ;AACJ,YAAI,UAAU,GAAG,EAAE,IAAI,aAAa;AACpC;AAAA,MACJ;AACA,YAAM,WAAmB,KAAK,UAAU,KAAK,KAAK,MAAM,WAAW,CAAC;AAEpE,UAAI,CAAC,YAAY,QAAQ,GAAG;AACxB,YAAI,UAAU,GAAG,EAAE,IAAI,WAAW;AAClC;AAAA,MACJ;AAGA,SAAG,SAAS,UAAU,CAAC,aAAa,iBAAiB;AACjD,YAAI,YAAa,QAAO,IAAI,UAAU,GAAG,EAAE,IAAI,WAAW;AAC1D,YAAI,CAAC,YAAY,YAAY,GAAG;AAC5B,cAAI,UAAU,GAAG,EAAE,IAAI,WAAW;AAClC;AAAA,QACJ;AAEA,WAAG,SAAS,cAAc,CAAC,KAAK,SAAS;AACrC,cAAI,IAAK,QAAO,IAAI,UAAU,GAAG,EAAE,IAAI,WAAW;AAClD,cAAI,UAAU,GAAG,EAAE,IAAI,IAAI;AAAA,QAC/B,CAAC;AAAA,MACL,CAAC;AAAA,IACL,CAAC,EACA,OAAO,eAAe,UAAU;AACrC,UAAM,IAAI,gBAAgB,EAAE,OAAO,CAAC;AAAA,EACxC,MAAO,OAAM,IAAI,gBAAgB,EAAE,MAAM,eAAe,MAAM,WAAW,CAAC;AAE1E,UAAQ,KAAK,iCAAiC,UAAU,SAAS,aAAa,EAAE;AAEhF,UAAQ;AAAA,EAEJ,QAAQ,OACR,QAAQ,OACR,QAAQ,QACJ,IAAI,SAAgB;AAChB,QAAI,UAAU,OAAO,eAAe,UAAU,MAAM;AAChD,aAAO,KAAK,KAAK,IAAI,SAAQ,OAAO,QAAQ,WAAW,KAAK,UAAU,GAAG,IAAI,GAAI,EAAE,KAAK,GAAG,CAAC;AAAA,IAChG;AACI,cAAQ,OAAO;AAAA,QACX,KAAK,IAAI,SAAQ,OAAO,QAAQ,WAAW,KAAK,UAAU,GAAG,IAAI,GAAI,EAAE,KAAK,GAAG,IAAI;AAAA,MACvF;AAAA,EACR;AAER,MAAI,GAAG,cAAc,CAAC,OAAkB;AACpC,QAAI,UAAU,OAAO,eAAe,UAAU,MAAM;AAChD,SAAG,KAAK,uCAAuC;AAC/C,SAAG,MAAM;AACT;AAAA,IACJ;AAEA,aAAS;AAET,0BAAsB,EAAE,EACnB,KAAK,CAAAA,YAAU;AACZ,aAAO,OAAO,aAAa,OAAO;AAClC,aAAO,aAAa,YAAY,IAAI,eAAe;AAAA,QAC/C,MAAM;AAAA,QACN,OAAO,CAAC,MAAM,YAAYA,QAAO,QAAQ,OAAO,IAAI;AAAA,MACxD,CAAC;AAAA,IACL,CAAC,EACA,MAAM,SAAO;AACV,cAAQ,MAAM,qCAAqC,GAAG;AAAA,IAC1D,CAAC;AAEL,UAAM,QAAQ,IAAI,MAAM,SAAS,SAAS,IAAI,qBAAqB,EAAE,GAAG,qBAAqB,EAAE,CAAC;AAChG,UAAM,MAAM,QAAQ,eAAe;AAEnC,OAAG,GAAG,SAAS,MAAM;AACjB,cAAQ,OAAO,MAAM,uBAAuB;AAC5C,UAAI,gBAAgB,OAAO,cAAc;AACrC,eAAO,OAAO,aAAa,YAAY;AAAA,MAC3C;AAEA,eAAS;AAAA,IACb,CAAC;AACD,OAAG,GAAG,SAAS,SAAO;AAClB,cAAQ,OAAO,MAAM,oBAAoB,IAAI,OAAO;AAAA,CAAI;AACxD,UAAI,gBAAgB,OAAO,cAAc;AACrC,eAAO,OAAO,aAAa,YAAY;AAAA,MAC3C;AAAA,IACJ,CAAC;AAAA,EACL,CAAC;AAED,iBAAe,sBAAsB,QAA6E;AAC9G,QAAI,OAAO,eAAe,UAAU,YAAY;AAC5C,YAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AACzC,eAAO,SAAS,MAAM,QAAQ;AAC9B,eAAO,UAAU,SAAO,OAAO,IAAI,MAAM,oBAAoB,IAAI,IAAI,EAAE,CAAC;AAAA,MAC5E,CAAC;AAAA,IACL;AAEA,WAAO,CAAC,SAAmB,iBAAyB;AAChD,UAAI,OAAO,eAAe,UAAU,MAAM;AACtC,eAAO,KAAK,YAAY;AAAA,MAC5B,OAAO;AACH,gBAAQ,OAAO,MAAM,2CAA2C,YAAY;AAAA,CAAI;AAAA,MACpF;AAAA,IACJ;AAAA,EACJ;AACJ;AACA,SAAS,qBAAqB,IAAyB;AACnD,QAAM,WAAW,IAAI,SAAS,EAAE,OAAO;AAAA,EAAC,EAAE,CAAC;AAE3C,KAAG,GAAG,WAAW,CAAC,SAAe;AAC7B,UAAM,QAAQ,OAAO,SAAS,IAAI,IAAI,OAAO,OAAO,KAAK,KAAK,SAAS,CAAC;AAGxE,aAAS,KAAK,KAAK;AAAA,EACvB,CAAC;AAED,KAAG,GAAG,SAAS,MAAM;AACjB,aAAS,KAAK,IAAI;AAAA,EACtB,CAAC;AACD,KAAG,GAAG,SAAS,SAAO;AAClB,aAAS,KAAK,SAAS,GAAG;AAC1B,aAAS,KAAK,IAAI;AAAA,EACtB,CAAC;AAED,SAAO;AACX;AACA,SAAS,qBAAqB,IAAyB;AACnD,QAAM,WAAW,IAAI,SAAS;AAAA,IAC1B,MAAM,OAAe,WAAmB,UAA0C;AAC9E,UAAI,GAAG,eAAe,UAAU,MAAM;AAClC,WAAG,KAAK,OAAO,QAAQ;AAAA,MAC3B,OAAO;AACH,YAAI,MAAM,SAAS,EAAG,SAAQ,OAAO,MAAM,iDAAiD,KAAK;AAAA,CAAK;AAAA,MAC1G;AAAA,IACJ;AAAA,IACA,MAAM,UAA0C;AAC5C,UAAI,GAAG,eAAe,UAAU,MAAM;AAClC,WAAG,MAAM;AAAA,MACb;AACA,eAAS;AAAA,IACb;AAAA,EACJ,CAAC;AAED,KAAG,GAAG,SAAS,SAAO,SAAS,KAAK,2BAA2B,GAAG,CAAC;AACnE,SAAO;AACX;",
+  "names": ["logger"]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@matter/nodejs-shell",
-    "version": "0.17.5-alpha.0-20260702-a2cd6f764",
+    "version": "0.17.5-alpha.0-20260706-fd4c49e2e",
     "description": "Shell app for Matter controller",
     "keywords": [
         "iot",
@@ -34,14 +34,14 @@
         "matter-shell": "dist/cjs/app.js"
     },
     "dependencies": {
-        "@matter/general": "0.17.5-alpha.0-20260702-a2cd6f764",
-        "@matter/model": "0.17.5-alpha.0-20260702-a2cd6f764",
-        "@matter/node": "0.17.5-alpha.0-20260702-a2cd6f764",
-        "@matter/nodejs": "0.17.5-alpha.0-20260702-a2cd6f764",
-        "@matter/nodejs-ble": "0.17.5-alpha.0-20260702-a2cd6f764",
-        "@matter/protocol": "0.17.5-alpha.0-20260702-a2cd6f764",
-        "@matter/types": "0.17.5-alpha.0-20260702-a2cd6f764",
-        "@project-chip/matter.js": "0.17.5-alpha.0-20260702-a2cd6f764",
+        "@matter/general": "0.17.5-alpha.0-20260706-fd4c49e2e",
+        "@matter/model": "0.17.5-alpha.0-20260706-fd4c49e2e",
+        "@matter/node": "0.17.5-alpha.0-20260706-fd4c49e2e",
+        "@matter/nodejs": "0.17.5-alpha.0-20260706-fd4c49e2e",
+        "@matter/nodejs-ble": "0.17.5-alpha.0-20260706-fd4c49e2e",
+        "@matter/protocol": "0.17.5-alpha.0-20260706-fd4c49e2e",
+        "@matter/types": "0.17.5-alpha.0-20260706-fd4c49e2e",
+        "@project-chip/matter.js": "0.17.5-alpha.0-20260706-fd4c49e2e",
         "ws": "^8.21.0",
         "yargs": "^18.0.0"
     },

package/src/app.ts

@@ -107,6 +107,12 @@ async function main() {
                             type: "boolean",
                             default: false,
                         },
+                        webAddress: {
+                            description:
+                                "Address the WebSocket/web server binds to. Defaults to loopback (127.0.0.1); pass e.g. 0.0.0.0 to expose on all interfaces.",
+                            type: "string",
+                            default: undefined,
+                        },
                     });
             },
             async argv => {
@@ -125,6 +131,7 @@ async function main() {
                     webSocketInterface,
                     webSocketPort,
                     webServer,
+                    webAddress,
                 } = argv;
 
                 theNode = new MatterNode(nodeNum, netInterface);
@@ -147,7 +154,7 @@ async function main() {
 
                 if (webSocketInterface) {
                     Logger.format = LogFormat.PLAIN;
-                    initializeWebPlumbing(theNode, nodeNum, webSocketPort, webServer); // set up but wait for connect to create Shell
+                    initializeWebPlumbing(theNode, nodeNum, webSocketPort, webServer, webAddress); // set up but wait for connect to create Shell
                 } else {
                     theShell = new Shell(theNode, nodeNum, PROMPT, process.stdin, process.stdout);
                 }

package/src/web_plumbing.ts

@@ -19,39 +19,76 @@ let client: WebSocket;
 let server: Server;
 let wss: WebSocketServer;
 const socketLogger = "websocket";
+const logger = Logger.get("WebPlumbing");
+
+const DEFAULT_LISTEN_ADDRESS = "127.0.0.1";
 
 export function initializeWebPlumbing(
     theNode: MatterNode,
     nodeNum: number,
     webSocketPort: number,
     webServer: boolean,
+    listenAddress?: string,
 ): void {
+    const configuredAddress = listenAddress?.trim() || undefined;
+    const listenHost = configuredAddress ?? DEFAULT_LISTEN_ADDRESS;
+    if (configuredAddress === undefined) {
+        logger.warn(
+            `No listen address configured; binding the WebSocket/web server to loopback ${DEFAULT_LISTEN_ADDRESS} only. ` +
+                `Pass --webAddress <address> (e.g. 0.0.0.0) to expose it on other interfaces.`,
+        );
+    }
+
     if (webServer) {
-        const root: string = path.resolve(__dirname) ?? "./";
+        const resolvedRoot = path.resolve(__dirname);
+        let root: string;
+        try {
+            root = fs.realpathSync(resolvedRoot);
+        } catch (error) {
+            logger.warn(`Could not resolve web root real path (${resolvedRoot}): ${error}. Using unresolved path.`);
+            root = resolvedRoot;
+        }
+        const rootWithSep = root.endsWith(path.sep) ? root : root + path.sep;
+        // The trailing separator prevents sibling directories that merely share the root string as a
+        // prefix from passing the containment check.
+        const isContained = (candidate: string) => candidate === root || candidate.startsWith(rootWithSep);
 
         server = http
             .createServer((req, res) => {
                 const url = req.url ?? "/";
-                const safePath: string = path.normalize(
-                    path.join(root, decodeURIComponent(url === "/" ? "/index.html" : url)),
-                );
+                let decodedPath: string;
+                try {
+                    decodedPath = decodeURIComponent(url === "/" ? "/index.html" : url);
+                } catch {
+                    res.writeHead(400).end("Bad Request");
+                    return;
+                }
+                const safePath: string = path.normalize(path.join(root, decodedPath));
 
-                // Check that the resolved path is within the root directory
-                if (!safePath.startsWith(root)) {
+                if (!isContained(safePath)) {
                     res.writeHead(403).end("Forbidden");
                     return;
                 }
 
-                fs.readFile(safePath, (err, data) => {
-                    if (err) return res.writeHead(404).end("Not Found");
-                    res.writeHead(200).end(data);
+                // Resolve symlinks so a link inside the root cannot redirect reads outside of it.
+                fs.realpath(safePath, (realpathErr, resolvedPath) => {
+                    if (realpathErr) return res.writeHead(404).end("Not Found");
+                    if (!isContained(resolvedPath)) {
+                        res.writeHead(403).end("Forbidden");
+                        return;
+                    }
+
+                    fs.readFile(resolvedPath, (err, data) => {
+                        if (err) return res.writeHead(404).end("Not Found");
+                        res.writeHead(200).end(data);
+                    });
                 });
             })
-            .listen(webSocketPort);
+            .listen(webSocketPort, listenHost);
         wss = new WebSocketServer({ server });
-    } else wss = new WebSocketServer({ port: webSocketPort });
+    } else wss = new WebSocketServer({ port: webSocketPort, host: listenHost });
 
-    console.info(`WebSocket server running on ws://localhost:${webSocketPort}`);
+    console.info(`WebSocket server listening on ${listenHost} port ${webSocketPort}`);
 
     console.log =
         // console.debug = // too much traffic - kills the websocket