cli-tunnel 1.1.0 → 1.2.0-beta.10

package/dist/index.js

@@ -20,8 +20,15 @@ import crypto from 'node:crypto';
 import { execSync, execFileSync, spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import http from 'node:http';
+import readline from 'node:readline';
 import { WebSocketServer, WebSocket } from 'ws';
 import os from 'node:os';
+function askUser(question) {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    return new Promise((resolve) => {
+        rl.question(question, (answer) => { rl.close(); resolve(answer.trim().toLowerCase()); });
+    });
+}
 const BOLD = '\x1b[1m';
 const RESET = '\x1b[0m';
 const DIM = '\x1b[2m';
@@ -29,40 +36,45 @@ const GREEN = '\x1b[32m';
 const YELLOW = '\x1b[33m';
 // ─── Parse args ─────────────────────────────────────────────
 const args = process.argv.slice(2);
-if (args.includes('--help') || args.includes('-h') || args.length === 0) {
+if (args.includes('--help') || args.includes('-h')) {
     console.log(`
 ${BOLD}cli-tunnel${RESET} — Tunnel any CLI app to your phone
 
 ${BOLD}Usage:${RESET}
   cli-tunnel [options] <command> [args...]
+  cli-tunnel                              # hub mode — sessions dashboard only
 
 ${BOLD}Options:${RESET}
-  --tunnel           Enable remote access via devtunnel
+  --local            Disable devtunnel (localhost only)
   --port <n>         Bridge port (default: random)
   --name <name>      Session name (shown in dashboard)
+  --replay           Enable replay buffer (off by default)
   --help, -h         Show this help
 
 ${BOLD}Examples:${RESET}
-  cli-tunnel copilot
-  cli-tunnel --tunnel copilot --yolo
-  cli-tunnel --tunnel copilot --model claude-sonnet-4 --agent squad
-  cli-tunnel --tunnel --name wizard copilot --allow-all
-  cli-tunnel --tunnel python -i
-  cli-tunnel --tunnel htop
+  cli-tunnel copilot --yolo               # tunnel + run copilot
+  cli-tunnel copilot --model claude-sonnet-4 --agent squad
+  cli-tunnel k9s                          # tunnel + run k9s
+  cli-tunnel python -i                    # tunnel + run python
+  cli-tunnel --name wizard copilot        # named session
+  cli-tunnel --local copilot --yolo       # localhost only, no devtunnel
+  cli-tunnel                              # hub: see all active sessions
 
-Any flags after the command name pass through to the underlying
-app. cli-tunnel's own flags (--tunnel, --port, --name) must come
-before the command.
+Devtunnel is enabled by default. All flags after the command name
+pass through to the underlying app. cli-tunnel's own flags
+(--local, --port, --name) must come before the command.
 `);
     process.exit(0);
 }
-const hasTunnel = args.includes('--tunnel');
+const hasLocal = args.includes('--local');
+const hasTunnel = !hasLocal;
+const hasReplay = args.includes('--replay');
 const portIdx = args.indexOf('--port');
 const port = (portIdx !== -1 && args[portIdx + 1]) ? parseInt(args[portIdx + 1], 10) : 0;
 const nameIdx = args.indexOf('--name');
 const sessionName = (nameIdx !== -1 && args[nameIdx + 1]) ? args[nameIdx + 1] : '';
 // Everything that's not our flags is the command
-const ourFlags = new Set(['--tunnel', '--port', '--name']);
+const ourFlags = new Set(['--local', '--tunnel', '--port', '--name', '--replay']);
 const cmdArgs = [];
 let skip = false;
 for (let i = 0; i < args.length; i++) {
@@ -70,20 +82,18 @@ for (let i = 0; i < args.length; i++) {
         skip = false;
         continue;
     }
-    if (ourFlags.has(args[i]) && args[i] !== '--tunnel') {
+    if (args[i] === '--port' || args[i] === '--name') {
         skip = true;
         continue;
     }
-    if (args[i] === '--tunnel')
+    if (args[i] === '--local' || args[i] === '--tunnel' || args[i] === '--replay')
         continue;
     cmdArgs.push(args[i]);
 }
-if (cmdArgs.length === 0) {
-    console.error('Error: no command specified. Run cli-tunnel --help for usage.');
-    process.exit(1);
-}
-const command = cmdArgs[0];
-const commandArgs = cmdArgs.slice(1);
+// Hub mode — no command, just show sessions dashboard
+const hubMode = cmdArgs.length === 0;
+const command = hubMode ? '' : cmdArgs[0];
+const commandArgs = hubMode ? [] : cmdArgs.slice(1);
 const cwd = process.cwd();
 // ─── Tunnel helpers ─────────────────────────────────────────
 function sanitizeLabel(l) {
@@ -103,35 +113,199 @@ function getGitInfo() {
 }
 // ─── Security: Session token for WebSocket auth ────────────
 const sessionToken = crypto.randomUUID();
+// ─── Session file registry (IPC via filesystem) ────────────
+const sessionsDir = path.join(os.homedir(), '.cli-tunnel', 'sessions');
+fs.mkdirSync(sessionsDir, { recursive: true, mode: 0o700 });
+let sessionFilePath = null;
+function writeSessionFile(tunnelId, tunnelUrl, port) {
+    sessionFilePath = path.join(sessionsDir, `${tunnelId}.json`);
+    const data = JSON.stringify({
+        token: sessionToken, name: sessionName || command,
+        tunnelId, tunnelUrl, port, hubMode,
+        machine: os.hostname(), pid: process.pid,
+        createdAt: new Date().toISOString(),
+    });
+    fs.writeFileSync(sessionFilePath, data, { mode: 0o600 });
+}
+function removeSessionFile() {
+    if (sessionFilePath) {
+        try {
+            fs.unlinkSync(sessionFilePath);
+        }
+        catch { }
+    }
+}
+function readLocalSessions() {
+    try {
+        return fs.readdirSync(sessionsDir)
+            .filter(f => f.endsWith('.json'))
+            .map(f => { try {
+            return JSON.parse(fs.readFileSync(path.join(sessionsDir, f), 'utf-8'));
+        }
+        catch {
+            return null;
+        } })
+            .filter((s) => s !== null && !s.hubMode);
+    }
+    catch {
+        return [];
+    }
+}
+// ─── F-18: Session TTL (4 hours) ───────────────────────────
+const SESSION_TTL = 4 * 60 * 60 * 1000; // 4 hours
+const sessionCreatedAt = Date.now();
+// ─── F-02: One-time ticket store for WebSocket auth ────────
+const tickets = new Map();
+// #30: Ticket GC — clean expired tickets every 30s
+setInterval(() => {
+    const now = Date.now();
+    for (const [id, t] of tickets) {
+        if (t.expires < now)
+            tickets.delete(id);
+    }
+}, 30000);
 // ─── Security: Redact secrets from replay events ────────────
 function redactSecrets(text) {
-    return text.replace(/(?:token|secret|key|password|credential|authorization)[\s:="']+[^\s"']{8,}/gi, '$& [REDACTED]');
+    return text
+        // Generic patterns: key=value, key: value, key="value"
+        .replace(/(?:token|secret|key|password|credential|authorization|api_key|private_key|access_key|connection_string|db_pass|signing)[\s:="']+\S{8,}/gi, '[REDACTED]')
+        // OpenAI keys
+        .replace(/sk-[a-zA-Z0-9]{20,}/g, '[REDACTED]')
+        // GitHub tokens
+        .replace(/gh[ps]_[a-zA-Z0-9]{36,}/g, '[REDACTED]')
+        // AWS keys
+        .replace(/AKIA[A-Z0-9]{16}/g, '[REDACTED]')
+        // Azure connection strings
+        .replace(/DefaultEndpointsProtocol=[^;\s]{20,}/gi, '[REDACTED]')
+        .replace(/AccountKey=[^;\s]{20,}/gi, 'AccountKey=[REDACTED]')
+        // Database URLs
+        .replace(/(postgres|mongodb|mysql|redis):\/\/[^\s"']{10,}/gi, '[REDACTED]')
+        // Bearer tokens in headers
+        .replace(/Bearer\s+[a-zA-Z0-9._-]{20,}/gi, 'Bearer [REDACTED]')
+        // JWT tokens
+        .replace(/eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}/g, '[REDACTED]')
+        // Slack tokens
+        .replace(/xox[bpras]-[a-zA-Z0-9-]{10,}/g, '[REDACTED]')
+        // npm tokens
+        .replace(/npm_[a-zA-Z0-9]{20,}/g, '[REDACTED]')
+        // PEM private keys
+        .replace(/-----BEGIN [A-Z ]+ PRIVATE KEY-----[\s\S]*?-----END [A-Z ]+ PRIVATE KEY-----/g, '[REDACTED]');
 }
 // ─── Bridge server ──────────────────────────────────────────
 const acpEventLog = [];
 const connections = new Map();
+// #10: Session TTL enforcement — periodically close expired connections
+setInterval(() => {
+    if (Date.now() - sessionCreatedAt > SESSION_TTL) {
+        for (const [id, ws] of connections) {
+            ws.close(1000, 'Session expired');
+            connections.delete(id);
+        }
+    }
+}, 60000);
+// ─── F-8: Per-IP rate limiter ───────────────────────────────
+const rateLimits = new Map();
+const ticketRateLimits = new Map();
+function checkRateLimit(ip, map, maxRequests) {
+    const now = Date.now();
+    const entry = map.get(ip);
+    if (!entry || entry.resetAt < now) {
+        map.set(ip, { count: 1, resetAt: now + 60000 });
+        return true;
+    }
+    entry.count++;
+    return entry.count <= maxRequests;
+}
+// Clean up rate limit maps every 60s
+setInterval(() => {
+    const now = Date.now();
+    for (const [ip, entry] of rateLimits) {
+        if (entry.resetAt < now)
+            rateLimits.delete(ip);
+    }
+    for (const [ip, entry] of ticketRateLimits) {
+        if (entry.resetAt < now)
+            ticketRateLimits.delete(ip);
+    }
+}, 60000);
 const server = http.createServer((req, res) => {
+    const clientIp = req.socket.remoteAddress || 'unknown';
+    // F-8: Rate limiting for HTTP endpoints
+    if (req.url?.startsWith('/api/')) {
+        const isTicket = req.url === '/api/auth/ticket';
+        if (isTicket && !checkRateLimit(clientIp, ticketRateLimits, 10)) {
+            res.writeHead(429, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Too Many Requests' }));
+            return;
+        }
+        if (!checkRateLimit(clientIp, rateLimits, 30)) {
+            res.writeHead(429, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Too Many Requests' }));
+            return;
+        }
+    }
+    // F-18: Session expiry check for API routes
+    if (!hubMode && req.url?.startsWith('/api/') && Date.now() - sessionCreatedAt > SESSION_TTL) {
+        res.writeHead(401, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Session expired' }));
+        return;
+    }
+    // F-02: Ticket endpoint — exchange session token for one-time WS ticket
+    if (req.url === '/api/auth/ticket' && req.method === 'POST') {
+        const auth = req.headers.authorization?.replace('Bearer ', '');
+        if (auth !== sessionToken) {
+            res.writeHead(401);
+            res.end();
+            return;
+        }
+        const ticket = crypto.randomUUID();
+        tickets.set(ticket, { expires: Date.now() + 60000 });
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ ticket, expires: Date.now() + 60000 }));
+        return;
+    }
+    // F-01: Session token check for all API routes
+    if (req.url?.startsWith('/api/')) {
+        const reqUrl = new URL(req.url, `http://${req.headers.host}`);
+        const authToken = req.headers.authorization?.replace('Bearer ', '') || reqUrl.searchParams.get('token');
+        if (authToken !== sessionToken) {
+            res.writeHead(401, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Unauthorized' }));
+            return;
+        }
+    }
     // Sessions API
-    if (req.url === '/api/sessions' && req.method === 'GET') {
+    if ((req.url === '/api/sessions' || req.url?.startsWith('/api/sessions?')) && req.method === 'GET') {
         try {
-            const output = execSync('devtunnel list --labels cli-tunnel --json', { encoding: 'utf-8', timeout: 10000, stdio: ['pipe', 'pipe', 'pipe'] });
+            const output = execFileSync('devtunnel', ['list', '--labels', 'cli-tunnel', '--json'], { encoding: 'utf-8', timeout: 10000, stdio: ['pipe', 'pipe', 'pipe'] });
             const data = JSON.parse(output);
+            const localMachine = os.hostname();
+            const localSessions = hubMode ? readLocalSessions() : [];
+            const tokenMap = new Map(localSessions.map(s => [s.tunnelId, s.token]));
             const sessions = (data.tunnels || []).map((t) => {
                 const labels = t.labels || [];
                 const id = t.tunnelId?.replace(/\.\w+$/, '') || t.tunnelId;
                 const cluster = t.tunnelId?.split('.').pop() || 'euw';
                 const portLabel = labels.find((l) => l.startsWith('port-'));
                 const p = portLabel ? parseInt(portLabel.replace('port-', ''), 10) : 3456;
-                return {
+                const machine = labels[4] || 'unknown';
+                const session = {
                     id, tunnelId: t.tunnelId,
                     name: labels[1] || 'unnamed',
                     repo: labels[2] || 'unknown',
                     branch: (labels[3] || 'unknown').replace(/_/g, '/'),
-                    machine: labels[4] || 'unknown',
+                    machine,
                     online: (t.hostConnections || 0) > 0,
                     port: p,
                     url: `https://${id}-${p}.${cluster}.devtunnels.ms`,
+                    isLocal: machine === localMachine,
                 };
+                // Attach token from local session files (hub mode only)
+                const baseId = t.tunnelId?.split('.')[0] || t.tunnelId;
+                const token = tokenMap.get(baseId) || tokenMap.get(t.tunnelId);
+                if (token)
+                    session.token = token;
+                return session;
             });
             res.writeHead(200, { 'Content-Type': 'application/json', 'X-Frame-Options': 'DENY', 'X-Content-Type-Options': 'nosniff' });
             res.end(JSON.stringify({ sessions }));
@@ -163,7 +337,18 @@ const server = http.createServer((req, res) => {
     }
     // Static files
     const uiDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../remote-ui');
-    const decodedUrl = decodeURIComponent(req.url || '/');
+    // #18: Guard against malformed URI encoding
+    let decodedUrl;
+    try {
+        // Strip query string before resolving file path
+        const urlPath = (req.url || '/').split('?')[0];
+        decodedUrl = decodeURIComponent(urlPath);
+    }
+    catch {
+        res.writeHead(400);
+        res.end();
+        return;
+    }
     if (decodedUrl.includes('..')) {
         res.writeHead(400);
         res.end();
@@ -175,65 +360,154 @@ const server = http.createServer((req, res) => {
         res.end();
         return;
     }
-    if (!fs.existsSync(filePath))
-        filePath = path.resolve(uiDir, 'index.html');
+    // #2: EISDIR guard — check if path is a directory before createReadStream
+    try {
+        const stat = fs.statSync(filePath);
+        if (stat.isDirectory()) {
+            filePath = path.join(filePath, 'index.html');
+            if (!fs.existsSync(filePath)) {
+                res.writeHead(404);
+                res.end();
+                return;
+            }
+        }
+    }
+    catch {
+        res.writeHead(404);
+        res.end();
+        return;
+    }
     const ext = path.extname(filePath);
     const mimes = { '.html': 'text/html', '.js': 'application/javascript', '.css': 'text/css', '.json': 'application/json' };
     const securityHeaders = {
         'Content-Type': mimes[ext] || 'application/octet-stream',
         'X-Frame-Options': 'DENY',
         'X-Content-Type-Options': 'nosniff',
-        'Content-Security-Policy': "default-src 'self'; script-src 'self' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; connect-src 'self' ws: wss:;",
+        'Content-Security-Policy': "default-src 'self'; script-src 'self' https://cdn.jsdelivr.net; style-src 'self' https://cdn.jsdelivr.net; connect-src 'self' ws://localhost:* wss://*.devtunnels.ms;",
+        'Referrer-Policy': 'no-referrer',
+        'Cache-Control': 'no-store',
+        'Strict-Transport-Security': 'max-age=31536000; includeSubDomains',
     };
     res.writeHead(200, securityHeaders);
-    fs.createReadStream(filePath).pipe(res);
+    // #8: Handle createReadStream errors
+    const stream = fs.createReadStream(filePath);
+    stream.on('error', () => { if (!res.headersSent) {
+        res.writeHead(500);
+    } res.end(); });
+    stream.pipe(res);
 });
 const wss = new WebSocketServer({
     server,
     maxPayload: 1048576,
     verifyClient: (info) => {
+        if (hubMode)
+            return true; // Hub mode doesn't need WS auth
+        // F-18: Session expiry
+        if (Date.now() - sessionCreatedAt > SESSION_TTL)
+            return false;
+        // F-3: Validate origin BEFORE ticket acceptance
+        const origin = info.req.headers.origin;
+        if (origin) {
+            try {
+                const originUrl = new URL(origin);
+                const host = originUrl.hostname;
+                if (host !== 'localhost' && host !== '127.0.0.1' && !host.endsWith('.devtunnels.ms')) {
+                    return false;
+                }
+            }
+            catch {
+                return false;
+            }
+        }
         const url = new URL(info.req.url, `http://${info.req.headers.host}`);
-        return url.searchParams.get('token') === sessionToken;
+        // F-02: Accept one-time ticket (only auth method for WS)
+        const ticket = url.searchParams.get('ticket');
+        if (ticket && tickets.has(ticket)) {
+            const t = tickets.get(ticket);
+            tickets.delete(ticket); // Single use
+            return t.expires > Date.now();
+        }
+        return false;
     },
 });
 // ─── Security: Audit log for remote PTY input ──────────────
-const auditLogPath = path.join(os.tmpdir(), `cli-tunnel-audit-${Date.now()}.log`);
+const auditDir = path.join(os.homedir(), '.cli-tunnel', 'audit');
+fs.mkdirSync(auditDir, { recursive: true, mode: 0o700 });
+const auditLogPath = path.join(auditDir, `audit-${new Date().toISOString().slice(0, 10)}.jsonl`);
 const auditLog = fs.createWriteStream(auditLogPath, { flags: 'a' });
+auditLog.on('error', (err) => { console.error('Audit log error:', err.message); });
 wss.on('connection', (ws, req) => {
-    const id = Math.random().toString(36).substring(2);
+    // F-10: Connection cap (global + per-IP)
+    if (connections.size >= 5) {
+        ws.close(1013, 'Max connections reached');
+        return;
+    }
     const remoteAddress = req.socket.remoteAddress || 'unknown';
+    let perIpCount = 0;
+    for (const [, c] of connections) {
+        if (c._remoteAddress === remoteAddress)
+            perIpCount++;
+    }
+    if (perIpCount >= 2) {
+        ws.close(1013, 'Max connections per IP reached');
+        return;
+    }
+    const id = crypto.randomUUID();
+    ws._remoteAddress = remoteAddress;
     connections.set(id, ws);
-    // Replay history with secrets redacted
-    for (const event of acpEventLog) {
-        ws.send(JSON.stringify({ type: '_replay', data: redactSecrets(event) }));
+    // F-10: WS ping/pong heartbeat
+    ws._isAlive = true;
+    ws.on('pong', () => { ws._isAlive = true; });
+    // Replay history with secrets redacted (only if replay is enabled)
+    if (hasReplay) {
+        for (const event of acpEventLog) {
+            ws.send(JSON.stringify({ type: '_replay', data: redactSecrets(event) }));
+        }
+        ws.send(JSON.stringify({ type: '_replay_done' }));
     }
-    ws.send(JSON.stringify({ type: '_replay_done' }));
     ws.on('message', (data) => {
         const raw = data.toString();
         try {
             const msg = JSON.parse(raw);
             if (msg.type === 'pty_input' && ptyProcess) {
-                auditLog.write(`${new Date().toISOString()} [${remoteAddress}] ${JSON.stringify(msg.data)}\n`);
+                auditLog.write(JSON.stringify({ ts: new Date().toISOString(), src: remoteAddress, type: 'pty_input', data: redactSecrets(JSON.stringify(msg.data)) }) + '\n');
                 ptyProcess.write(msg.data);
             }
-            if (msg.type === 'pty_resize' && ptyProcess) {
-                const cols = Math.max(1, Math.min(500, msg.cols));
-                const rows = Math.max(1, Math.min(200, msg.rows));
-                ptyProcess.resize(cols, rows);
+            // #7: NaN guard on pty_resize
+            if (msg.type === 'pty_resize') {
+                const cols = Number(msg.cols);
+                const rows = Number(msg.rows);
+                if (Number.isFinite(cols) && Number.isFinite(rows) && ptyProcess) {
+                    ptyProcess.resize(Math.max(1, Math.min(500, cols)), Math.max(1, Math.min(200, rows)));
+                }
             }
         }
         catch {
-            if (ptyProcess)
-                ptyProcess.write(raw + '\r');
+            // #3: Log but do NOT write to PTY — only structured pty_input messages allowed
+            auditLog.write(JSON.stringify({ ts: new Date().toISOString(), type: 'rejected', reason: 'non-json', length: raw.length }) + '\n');
         }
     });
     ws.on('close', () => connections.delete(id));
 });
+// F-10: WS heartbeat — ping every 30s, close unresponsive after 10s
+setInterval(() => {
+    for (const [id, ws] of connections) {
+        if (ws._isAlive === false) {
+            ws.terminate();
+            connections.delete(id);
+            continue;
+        }
+        ws._isAlive = false;
+        ws.ping();
+    }
+}, 30000);
 function broadcast(data) {
     const msg = JSON.stringify({ type: 'pty', data });
-    acpEventLog.push(msg);
-    if (acpEventLog.length > 2000)
-        acpEventLog.splice(0, acpEventLog.length - 2000);
+    if (hasReplay) {
+        acpEventLog.push(msg);
+        if (acpEventLog.length > 2000)
+            acpEventLog.splice(0, acpEventLog.length - 2000);
+    }
     for (const [, ws] of connections) {
         if (ws.readyState === WebSocket.OPEN)
             ws.send(msg);
@@ -243,7 +517,7 @@ function broadcast(data) {
 let ptyProcess = null;
 async function main() {
     const actualPort = await new Promise((resolve, reject) => {
-        server.listen(port, () => {
+        server.listen(port, '127.0.0.1', () => {
             const addr = server.address();
             resolve(typeof addr === 'object' ? addr.port : port);
         });
@@ -252,60 +526,117 @@ async function main() {
     const { repo, branch } = getGitInfo();
     const machine = os.hostname();
     const displayName = sessionName || command;
-    console.log(`\n${BOLD}cli-tunnel${RESET} ${DIM}v1.0.0${RESET}\n`);
-    console.log(`  ${DIM}Command:${RESET}  ${command} ${commandArgs.join(' ')}`);
-    console.log(`  ${DIM}Name:${RESET}     ${displayName}`);
-    console.log(`  ${DIM}Port:${RESET}     ${actualPort}`);
-    console.log(`  ${DIM}Audit log:${RESET} ${auditLogPath}`);
+    console.log(`\n${BOLD}cli-tunnel${RESET} ${DIM}v1.1.0${RESET}\n`);
+    if (hubMode) {
+        console.log(`  ${BOLD}📋 Hub Mode${RESET} — sessions dashboard`);
+        console.log(`  ${DIM}Port:${RESET}     ${actualPort}`);
+        console.log(`  ${DIM}Local URL:${RESET} http://127.0.0.1:${actualPort}?token=${sessionToken}&hub=1\n`);
+    }
+    else {
+        console.log(`  ${DIM}Command:${RESET}  ${command} ${commandArgs.join(' ')}`);
+        console.log(`  ${DIM}Name:${RESET}     ${displayName}`);
+        console.log(`  ${DIM}Port:${RESET}     ${actualPort}`);
+        console.log(`  ${DIM}Audit log:${RESET} ${auditLogPath}`);
+        console.log(`  ${DIM}Local URL:${RESET} http://127.0.0.1:${actualPort}?token=${sessionToken}`);
+        console.log(`  ${DIM}Session expires:${RESET} ${new Date(sessionCreatedAt + SESSION_TTL).toLocaleTimeString()}`);
+    }
     // Tunnel
     if (hasTunnel) {
         // Check if devtunnel is installed
         let devtunnelInstalled = false;
         try {
-            execSync('devtunnel --version', { stdio: 'pipe' });
+            execFileSync('devtunnel', ['--version'], { stdio: 'pipe' });
             devtunnelInstalled = true;
         }
         catch {
             console.log(`\n  ${YELLOW}⚠ devtunnel CLI not found!${RESET}\n`);
-            console.log(`  ${BOLD}To enable remote access, install Microsoft Dev Tunnels:${RESET}\n`);
+            let installCmd = '';
             if (process.platform === 'win32') {
-                console.log(`    ${GREEN}winget install Microsoft.devtunnel${RESET}`);
+                installCmd = 'winget install Microsoft.devtunnel';
             }
             else if (process.platform === 'darwin') {
-                console.log(`    ${GREEN}brew install --cask devtunnel${RESET}`);
+                installCmd = 'brew install --cask devtunnel';
+            }
+            else {
+                installCmd = 'curl -sL https://aka.ms/DevTunnelCliInstall | bash';
+            }
+            const answer = await askUser(`  Would you like to install it now? (${GREEN}${installCmd}${RESET}) [Y/n] `);
+            if (answer === '' || answer === 'y' || answer === 'yes') {
+                console.log(`\n  ${DIM}Installing devtunnel...${RESET}\n`);
+                try {
+                    const installParts = installCmd.split(' ');
+                    const installProc = spawn(installParts[0], installParts.slice(1), { stdio: 'inherit', shell: process.platform !== 'win32' && installCmd.includes('|') });
+                    await new Promise((resolve, reject) => {
+                        installProc.on('close', (code) => code === 0 ? resolve() : reject(new Error(`Install exited with code ${code}`)));
+                        installProc.on('error', reject);
+                    });
+                    // Refresh PATH — winget updates the registry but current process has stale PATH
+                    if (process.platform === 'win32') {
+                        try {
+                            const userPath = execFileSync('reg', ['query', 'HKCU\\Environment', '/v', 'Path'], { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
+                            const sysPath = execFileSync('reg', ['query', 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment', '/v', 'Path'], { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
+                            const extractPath = (out) => out.split('\n').find(l => l.includes('REG_'))?.split('REG_EXPAND_SZ')[1]?.trim() || out.split('\n').find(l => l.includes('REG_'))?.split('REG_SZ')[1]?.trim() || '';
+                            process.env.PATH = `${extractPath(userPath)};${extractPath(sysPath)}`;
+                        }
+                        catch { /* keep existing PATH */ }
+                    }
+                    // Verify installation
+                    execFileSync('devtunnel', ['--version'], { stdio: 'pipe' });
+                    console.log(`\n  ${GREEN}✓${RESET} devtunnel installed successfully!\n`);
+                    devtunnelInstalled = true;
+                }
+                catch (err) {
+                    console.log(`\n  ${YELLOW}⚠${RESET} Installation failed: ${err.message}`);
+                    console.log(`  ${DIM}You can install it manually: ${installCmd}${RESET}\n`);
+                    console.log(`  ${DIM}Continuing without tunnel (local only)...${RESET}\n`);
+                }
             }
             else {
-                console.log(`    ${GREEN}curl -sL https://aka.ms/DevTunnelCliInstall | bash${RESET}`);
+                console.log(`\n  ${DIM}More info: https://aka.ms/devtunnels/doc${RESET}`);
+                console.log(`  ${DIM}Continuing without tunnel (local only)...${RESET}\n`);
             }
-            console.log(`\n  Then authenticate once:\n`);
-            console.log(`    ${GREEN}devtunnel user login${RESET}\n`);
-            console.log(`  ${DIM}More info: https://aka.ms/devtunnels/doc${RESET}\n`);
-            console.log(`  ${DIM}Continuing without tunnel (local only)...${RESET}\n`);
         }
-        // Check if logged in
         if (devtunnelInstalled) {
+            // Check if logged in before attempting tunnel creation
             try {
-                const userInfo = execSync('devtunnel user show', { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
-                if (userInfo.includes('not logged in') || userInfo.includes('No user')) {
+                const userInfo = execFileSync('devtunnel', ['user', 'show'], { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
+                if (userInfo.includes('not logged in') || userInfo.includes('No user') || userInfo.includes('Anonymous')) {
                     throw new Error('not logged in');
                 }
             }
             catch {
-                console.log(`\n  ${YELLOW}⚠ devtunnel not authenticated!${RESET}\n`);
-                console.log(`  Run this once to log in:\n`);
-                console.log(`    ${GREEN}devtunnel user login${RESET}\n`);
-                console.log(`  ${DIM}Continuing without tunnel (local only)...${RESET}\n`);
-                devtunnelInstalled = false;
+                console.log(`\n  ${YELLOW}⚠ devtunnel not authenticated.${RESET}\n`);
+                const loginAnswer = await askUser(`  Would you like to log in now? [Y/n] `);
+                if (loginAnswer === '' || loginAnswer === 'y' || loginAnswer === 'yes') {
+                    try {
+                        const loginProc = spawn('devtunnel', ['user', 'login'], { stdio: 'inherit' });
+                        await new Promise((resolve, reject) => {
+                            loginProc.on('close', (code) => code === 0 ? resolve() : reject(new Error(`Login exited with code ${code}`)));
+                            loginProc.on('error', reject);
+                        });
+                        console.log(`\n  ${GREEN}✓${RESET} Logged in successfully!\n`);
+                    }
+                    catch {
+                        console.log(`\n  ${YELLOW}⚠${RESET} Login failed. Run manually: ${GREEN}devtunnel user login${RESET}\n`);
+                        console.log(`  ${DIM}Continuing without tunnel (local only)...${RESET}\n`);
+                        devtunnelInstalled = false;
+                    }
+                }
+                else {
+                    console.log(`\n  ${DIM}Run this once to log in: ${GREEN}devtunnel user login${RESET}`);
+                    console.log(`  ${DIM}Continuing without tunnel (local only)...${RESET}\n`);
+                    devtunnelInstalled = false;
+                }
             }
         }
         if (devtunnelInstalled) {
             try {
-                const labels = ['cli-tunnel', sanitizeLabel(sessionName || command), sanitizeLabel(repo), sanitizeLabel(branch), sanitizeLabel(machine), `port-${actualPort}`]
-                    .map(l => `--labels ${l}`).join(' ');
-                const createOut = execSync(`devtunnel create ${labels} --expiration 1d --json`, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
+                const labelValues = ['cli-tunnel', sanitizeLabel(sessionName || command), sanitizeLabel(repo), sanitizeLabel(branch), sanitizeLabel(machine), `port-${actualPort}`];
+                const labelArgs = labelValues.flatMap(l => ['--labels', l]);
+                const createOut = execFileSync('devtunnel', ['create', ...labelArgs, '--expiration', '1d', '--json'], { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
                 const tunnelId = JSON.parse(createOut).tunnel?.tunnelId?.split('.')[0];
                 const cluster = JSON.parse(createOut).tunnel?.tunnelId?.split('.')[1] || 'euw';
-                execSync(`devtunnel port create ${tunnelId} -p ${actualPort} --protocol http`, { stdio: 'pipe' });
+                execFileSync('devtunnel', ['port', 'create', tunnelId, '-p', String(actualPort), '--protocol', 'http'], { stdio: 'pipe' });
                 const hostProc = spawn('devtunnel', ['host', tunnelId], { stdio: 'pipe', detached: false });
                 const url = await new Promise((resolve, reject) => {
                     const timeout = setTimeout(() => reject(new Error('Tunnel timeout')), 15000);
@@ -320,28 +651,59 @@ async function main() {
                     });
                     hostProc.on('error', (e) => { clearTimeout(timeout); reject(e); });
                 });
-                const tunnelUrlWithToken = `${url}?token=${sessionToken}`;
+                const tunnelUrlWithToken = `${url}?token=${sessionToken}${hubMode ? '&hub=1' : ''}`;
                 console.log(`  ${GREEN}✓${RESET} Tunnel: ${BOLD}${tunnelUrlWithToken}${RESET}\n`);
+                // Write session file for hub discovery
+                writeSessionFile(tunnelId, url, actualPort);
                 try {
                     // @ts-ignore
                     const qr = (await import('qrcode-terminal'));
                     qr.default.generate(tunnelUrlWithToken, { small: true }, (code) => console.log(code));
                 }
                 catch { }
-                process.on('SIGINT', () => { hostProc.kill(); try {
-                    execSync(`devtunnel delete ${tunnelId} --force`, { stdio: 'pipe' });
+                process.on('SIGINT', () => { removeSessionFile(); hostProc.kill(); try {
+                    execFileSync('devtunnel', ['delete', tunnelId, '--force'], { stdio: 'pipe' });
                 }
                 catch { } });
-                process.on('exit', () => { hostProc.kill(); try {
-                    execSync(`devtunnel delete ${tunnelId} --force`, { stdio: 'pipe' });
+                process.on('exit', () => { removeSessionFile(); hostProc.kill(); try {
+                    execFileSync('devtunnel', ['delete', tunnelId, '--force'], { stdio: 'pipe' });
                 }
                 catch { } });
             }
             catch (err) {
-                console.log(`  ${YELLOW}⚠${RESET} Tunnel failed: ${err.message}\n`);
+                const errMsg = err.message || '';
+                // Detect auth failure at create time (expired token, anonymous, etc.)
+                if (errMsg.includes('Anonymous') || errMsg.includes('Unauthorized') || errMsg.includes('not permitted')) {
+                    console.log(`\n  ${YELLOW}⚠ devtunnel session expired or not authenticated.${RESET}\n`);
+                    const loginAnswer = await askUser(`  Would you like to log in now? [Y/n] `);
+                    if (loginAnswer === '' || loginAnswer === 'y' || loginAnswer === 'yes') {
+                        try {
+                            const loginProc = spawn('devtunnel', ['user', 'login'], { stdio: 'inherit' });
+                            await new Promise((resolve, reject) => {
+                                loginProc.on('close', (code) => code === 0 ? resolve() : reject(new Error(`Login exited with code ${code}`)));
+                                loginProc.on('error', reject);
+                            });
+                            console.log(`\n  ${GREEN}✓${RESET} Logged in! Please run cli-tunnel again to create the tunnel.\n`);
+                        }
+                        catch {
+                            console.log(`\n  ${YELLOW}⚠${RESET} Login failed. Run manually: ${GREEN}devtunnel user login${RESET}\n`);
+                        }
+                    }
+                }
+                else {
+                    console.log(`  ${YELLOW}⚠${RESET} Tunnel failed: ${errMsg}\n`);
+                }
             }
         } // end if (devtunnelInstalled)
     }
+    if (hubMode) {
+        // Hub mode — just serve the sessions dashboard, no PTY
+        console.log(`  ${GREEN}✓${RESET} Hub running — open in browser to see all sessions\n`);
+        console.log(`  ${DIM}Press Ctrl+C to stop.${RESET}\n`);
+        process.on('SIGINT', () => { server.close(); process.exit(0); });
+        // Keep process alive
+        await new Promise(() => { });
+    }
     console.log(`  ${DIM}Starting ${command}...${RESET}\n`);
     // Spawn PTY
     const nodePty = await import('node-pty');
@@ -351,7 +713,7 @@ async function main() {
     let resolvedCmd = command;
     if (process.platform === 'win32') {
         try {
-            const wherePaths = execSync(`where ${command}`, { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }).trim().split('\n');
+            const wherePaths = execFileSync('where', [command], { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }).trim().split('\n');
             // Prefer .exe or .cmd over .ps1 for node-pty compatibility
             const exePath = wherePaths.find(p => p.trim().endsWith('.exe')) || wherePaths.find(p => p.trim().endsWith('.cmd'));
             if (exePath) {
@@ -365,11 +727,16 @@ async function main() {
         }
         catch { /* use as-is */ }
     }
-    // Security: filter sensitive environment variables
+    // F-07: Security — filter dangerous environment variables for PTY
+    // Blocklist approach: pass everything except known dangerous vars and secrets
+    const DANGEROUS_VARS = new Set(['NODE_OPTIONS', 'NODE_REPL_HISTORY', 'NODE_EXTRA_CA_CERTS',
+        'NODE_PATH', 'NODE_REDIRECT_WARNINGS', 'NODE_PENDING_DEPRECATION',
+        'UV_THREADPOOL_SIZE', 'LD_PRELOAD', 'DYLD_INSERT_LIBRARIES',
+        'SSH_AUTH_SOCK', 'GPG_TTY']);
+    const sensitivePattern = /token|secret|key|password|credential|api_key|private_key|access_key|connection_string|auth|kubeconfig|docker_host|docker_config/i;
     const safeEnv = {};
-    const sensitivePatterns = /token|secret|key|password|credential|api_key|private/i;
     for (const [k, v] of Object.entries(process.env)) {
-        if (!sensitivePatterns.test(k) && v !== undefined) {
+        if (v !== undefined && !DANGEROUS_VARS.has(k) && !sensitivePattern.test(k)) {
             safeEnv[k] = v;
         }
     }
@@ -378,6 +745,25 @@ async function main() {
         cols, rows, cwd,
         env: safeEnv,
     });
+    // Detect CSPRNG crash (rare Node.js + PTY issue) and show helpful message
+    let ptyExitedEarly = false;
+    const earlyExitCheck = new Promise((resolve) => {
+        ptyProcess.onExit(({ exitCode }) => {
+            if (exitCode === 134 || exitCode === 3221226505) {
+                ptyExitedEarly = true;
+                resolve();
+            }
+        });
+        setTimeout(resolve, 2000);
+    });
+    await earlyExitCheck;
+    if (ptyExitedEarly) {
+        const nodeVer = process.version;
+        console.log(`  ${YELLOW}⚠${RESET} The command crashed (CSPRNG assertion failure).`);
+        console.log(`  This is a known issue with Node.js ${nodeVer} + PTY on Windows.`);
+        console.log(`  ${BOLD}Fix:${RESET} Install Node.js 22 LTS: ${GREEN}nvm install 22${RESET} or ${GREEN}winget install OpenJS.NodeJS.LTS${RESET}\n`);
+        process.exit(1);
+    }
     ptyProcess.onData((data) => {
         process.stdout.write(data);
         broadcast(data);