@monotykamary/localterm 1.6.0 → 1.8.0

package/README.md

@@ -49,8 +49,8 @@ State lives in `~/.localterm/` (PID, port, server log at `~/.localterm/server.lo
 
 ## Security
 
-- By default, binds loopback hosts only: `127.0.0.1`, `localhost`, `*.localhost`, `::1`, and enforces loopback `Host`/`Origin` headers to defeat DNS-rebinding attacks.
-- Pass `-H 0.0.0.0` (or any non-loopback address) to expose the server on all network interfaces. Loopback header enforcement is disabled in this mode — only use on trusted networks (e.g. Tailscale, a home LAN behind a firewall).
+- By default, binds loopback (`127.0.0.1`) and enforces loopback `Host`/`Origin` headers to defeat DNS-rebinding and cross-origin attacks.
+- Pass `-H 0.0.0.0` (or any non-loopback address) to expose the server on all network interfaces. In this mode, `Host`/`Origin` must be from a private network (RFC 1918, CGNAT/Tailscale `100.64.127.x`, link-local, `*.localhost`) and WebSocket source IPs are filtered to private ranges — only use on trusted networks.
 - One PTY per WebSocket. Closing the tab kills the shell — no orphaned processes.
 
 ## Resources & Contributing Back

package/dist/constants.d.ts

@@ -4,7 +4,7 @@ export declare const STOP_MAX_WAIT_MS = 5000;
 export declare const DAEMON_PROBE_INTERVAL_MS = 100;
 export declare const DAEMON_PROBE_MAX_WAIT_MS = 5000;
 export declare const VERIFY_PID_TIMEOUT_MS = 1000;
-export declare const MIN_TCP_PORT = 0;
+export declare const MIN_TCP_PORT = 1;
 export declare const MAX_TCP_PORT = 65535;
 export declare const FRIENDLY_HOSTNAME = "localterm.localhost";
 export declare const STOP_COMMAND = "npx @monotykamary/localterm@latest stop";

package/dist/constants.js

@@ -4,7 +4,7 @@ export const STOP_MAX_WAIT_MS = 5000;
 export const DAEMON_PROBE_INTERVAL_MS = 100;
 export const DAEMON_PROBE_MAX_WAIT_MS = 5000;
 export const VERIFY_PID_TIMEOUT_MS = 1000;
-export const MIN_TCP_PORT = 0;
+export const MIN_TCP_PORT = 1;
 export const MAX_TCP_PORT = 65535;
 export const FRIENDLY_HOSTNAME = "localterm.localhost";
 export const STOP_COMMAND = "npx @monotykamary/localterm@latest stop";

package/dist/utils/poll-for-daemon-ready.d.ts

@@ -15,6 +15,7 @@ export interface DaemonProbeOptions {
     isAlive: (pid: number) => boolean;
     readPort: () => number | null;
     sleep: (durationMs: number) => Promise<void>;
+    probeHealth?: (port: number) => Promise<boolean>;
 }
 export declare const pollForDaemonReady: (options: DaemonProbeOptions) => Promise<DaemonReadyResult>;
 //# sourceMappingURL=poll-for-daemon-ready.d.ts.map

package/dist/utils/poll-for-daemon-ready.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"poll-for-daemon-ready.d.ts","sourceRoot":"","sources":["../../src/utils/poll-for-daemon-ready.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,QAAQ,EAAY,MAAM,cAAc,CAAC;AAEvD,MAAM,MAAM,iBAAiB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAA;CAAE,CAAC;AAE5F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAClC,QAAQ,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAC9B,KAAK,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9C;AAED,eAAO,MAAM,kBAAkB,GAC7B,SAAS,kBAAkB,KAC1B,OAAO,CAAC,iBAAiB,CAiB3B,CAAC"}
+{"version":3,"file":"poll-for-daemon-ready.d.ts","sourceRoot":"","sources":["../../src/utils/poll-for-daemon-ready.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,QAAQ,EAAY,MAAM,cAAc,CAAC;AAEvD,MAAM,MAAM,iBAAiB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAA;CAAE,CAAC;AAE5F,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAClC,QAAQ,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;IAC9B,KAAK,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAClD;AAaD,eAAO,MAAM,kBAAkB,GAC7B,SAAS,kBAAkB,KAC1B,OAAO,CAAC,iBAAiB,CAsB3B,CAAC"}

package/dist/utils/poll-for-daemon-ready.js

@@ -1,5 +1,17 @@
 import { cliError } from "../errors.js";
+const defaultProbeHealth = async (port) => {
+    try {
+        const response = await fetch(`http://127.0.0.1:${port}/api/health`, {
+            signal: AbortSignal.timeout(2000),
+        });
+        return response.ok;
+    }
+    catch {
+        return false;
+    }
+};
 export const pollForDaemonReady = async (options) => {
+    const probeHealth = options.probeHealth ?? defaultProbeHealth;
     let waited = 0;
     while (waited < options.maxWaitMs) {
         await options.sleep(options.intervalMs);
@@ -11,6 +23,11 @@ export const pollForDaemonReady = async (options) => {
         if (observedPort !== null && observedPort !== options.initialPort) {
             return { ok: true, port: observedPort };
         }
+        if (observedPort !== null) {
+            const healthy = await probeHealth(observedPort);
+            if (healthy)
+                return { ok: true, port: observedPort };
+        }
     }
     return {
         ok: false,

package/dist/utils/poll-for-daemon-ready.js.map

@@ -1 +1 @@
-{"version":3,"file":"poll-for-daemon-ready.js","sourceRoot":"","sources":["../../src/utils/poll-for-daemon-ready.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,QAAQ,EAAE,MAAM,cAAc,CAAC;AAevD,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,OAA2B,EACC,EAAE;IAC9B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;QAClC,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtF,CAAC;QACD,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QACxC,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;YAClE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,QAAQ,CAAC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC;KACzF,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"file":"poll-for-daemon-ready.js","sourceRoot":"","sources":["../../src/utils/poll-for-daemon-ready.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,QAAQ,EAAE,MAAM,cAAc,CAAC;AAgBvD,MAAM,kBAAkB,GAAG,KAAK,EAAE,IAAY,EAAoB,EAAE;IAClE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,oBAAoB,IAAI,aAAa,EAAE;YAClE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,EAAE,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,OAA2B,EACC,EAAE;IAC9B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,kBAAkB,CAAC;IAC9D,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;QAClC,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtF,CAAC;QACD,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QACxC,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;YAClE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAC1C,CAAC;QACD,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,CAAC;YAChD,IAAI,OAAO;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QACvD,CAAC;IACH,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,QAAQ,CAAC,kBAAkB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC;KACzF,CAAC;AACJ,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@monotykamary/localterm",
-  "version": "1.6.0",
+  "version": "1.8.0",
   "description": "A browser-based terminal: one browser tab is one PTY session. Friendly URL, persistent xterm.js front-end, hono + node-pty back-end.",
   "keywords": [
     "browser-terminal",
@@ -43,12 +43,19 @@
   "publishConfig": {
     "access": "public"
   },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "dev": "tsc -p tsconfig.build.json --watch",
+    "test": "vp test --run",
+    "typecheck": "tsc --noEmit",
+    "prepack": "node ../../scripts/prepare-cli-publish.mjs"
+  },
   "dependencies": {
+    "@monotykamary/localterm-server": "workspace:*",
     "commander": "^12.1.0",
     "kleur": "^4.1.5",
     "open": "^10.1.0",
-    "zod": "^4.3.6",
-    "@monotykamary/localterm-server": "1.6.0"
+    "zod": "^4.3.6"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",
@@ -57,11 +64,5 @@
   },
   "engines": {
     "node": ">=22"
-  },
-  "scripts": {
-    "build": "tsc -p tsconfig.build.json",
-    "dev": "tsc -p tsconfig.build.json --watch",
-    "test": "vp test --run",
-    "typecheck": "tsc --noEmit"
   }
-}
+}