cli-tunnel 1.2.0-beta.10 → 1.2.0-beta.11

package/dist/index.js

@@ -228,7 +228,7 @@ setInterval(() => {
             ticketRateLimits.delete(ip);
     }
 }, 60000);
-const server = http.createServer((req, res) => {
+const server = http.createServer(async (req, res) => {
     const clientIp = req.socket.remoteAddress || 'unknown';
     // F-8: Rate limiting for HTTP endpoints
     if (req.url?.startsWith('/api/')) {
@@ -274,6 +274,40 @@ const server = http.createServer((req, res) => {
             return;
         }
     }
+    // Hub ticket proxy — fetch ticket from local session on behalf of grid client
+    if (hubMode && req.url?.startsWith('/api/proxy/ticket/') && req.method === 'POST') {
+        const targetPort = parseInt(req.url.replace('/api/proxy/ticket/', ''), 10);
+        if (!Number.isFinite(targetPort) || targetPort < 1 || targetPort > 65535) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Invalid port' }));
+            return;
+        }
+        // Find token for this port from session files
+        const localSessions = readLocalSessions();
+        const session = localSessions.find(s => s.port === targetPort);
+        if (!session) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Session not found' }));
+            return;
+        }
+        try {
+            const ticketResp = await fetch(`http://127.0.0.1:${targetPort}/api/auth/ticket`, {
+                method: 'POST', headers: { 'Authorization': `Bearer ${session.token}` },
+                signal: AbortSignal.timeout(3000),
+            });
+            if (!ticketResp.ok)
+                throw new Error('Ticket request failed');
+            const ticketData = await ticketResp.json();
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ ticket: ticketData.ticket, port: targetPort }));
+        }
+        catch {
+            res.writeHead(502, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Session unreachable' }));
+            return;
+        }
+        return;
+    }
     // Sessions API
     if ((req.url === '/api/sessions' || req.url?.startsWith('/api/sessions?')) && req.method === 'GET') {
         try {
@@ -383,7 +417,7 @@ const server = http.createServer((req, res) => {
         'Content-Type': mimes[ext] || 'application/octet-stream',
         'X-Frame-Options': 'DENY',
         'X-Content-Type-Options': 'nosniff',
-        'Content-Security-Policy': "default-src 'self'; script-src 'self' https://cdn.jsdelivr.net; style-src 'self' https://cdn.jsdelivr.net; connect-src 'self' ws://localhost:* wss://*.devtunnels.ms;",
+        'Content-Security-Policy': "default-src 'self'; script-src 'self' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; connect-src 'self' ws://localhost:* ws://127.0.0.1:* http://127.0.0.1:* wss://*.devtunnels.ms https://*.devtunnels.ms;",
         'Referrer-Policy': 'no-referrer',
         'Cache-Control': 'no-store',
         'Strict-Transport-Security': 'max-age=31536000; includeSubDomains',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cli-tunnel",
-  "version": "1.2.0-beta.10",
+  "version": "1.2.0-beta.11",
   "description": "Tunnel any CLI app to your phone — PTY + devtunnel + xterm.js",
   "type": "module",
   "main": "dist/index.js",

package/remote-ui/app.js

@@ -117,7 +117,9 @@
 
   async function loadSessions() {
     try {
-      const resp = await fetch('/api/sessions');
+      const tokenParam = new URLSearchParams(window.location.search).get('token');
+      const headers = tokenParam ? { 'Authorization': 'Bearer ' + tokenParam } : {};
+      const resp = await fetch('/api/sessions', { headers });
       const data = await resp.json();
       renderDashboard(data.sessions || []);
     } catch (err) {
@@ -187,17 +189,21 @@
   };
 
   window.cleanOffline = async () => {
-    const resp = await fetch('/api/sessions');
+    const tokenParam = new URLSearchParams(window.location.search).get('token');
+    const headers = tokenParam ? { 'Authorization': 'Bearer ' + tokenParam } : {};
+    const resp = await fetch('/api/sessions', { headers });
     const data = await resp.json();
     const offline = (data.sessions || []).filter(s => !s.online);
     for (const s of offline) {
-      await fetch('/api/sessions/' + s.id, { method: 'DELETE' });
+      await fetch('/api/sessions/' + s.id, { method: 'DELETE', headers });
     }
     loadSessions();
   };
 
   window.deleteSession = async (id) => {
-    await fetch('/api/sessions/' + id, { method: 'DELETE' });
+    const tokenParam = new URLSearchParams(window.location.search).get('token');
+    const headers = tokenParam ? { 'Authorization': 'Bearer ' + tokenParam } : {};
+    await fetch('/api/sessions/' + id, { method: 'DELETE', headers });
     loadSessions();
   };
 
@@ -265,20 +271,24 @@
       // Delay fit to ensure container has size
       setTimeout(function() { panelFit.fit(); }, 100);
 
-      // Connect WebSocket to this session via ticket auth
+      // Connect WebSocket to this session
       var statusDot = header.querySelector('.grid-panel-status');
       var panelWs = null;
 
       (function connectPanel() {
-        var sessionOrigin = new URL(s.url).origin;
-        fetch(sessionOrigin + '/api/auth/ticket', {
+        // Use hub's proxy endpoint to get a ticket for the session
+        var tokenParam = new URLSearchParams(window.location.search).get('token');
+        var proxyUrl = '/api/proxy/ticket/' + s.port;
+        var wsBase = s.isLocal ? 'ws://127.0.0.1:' + s.port : s.url.replace('https://', 'wss://');
+
+        fetch(proxyUrl, {
           method: 'POST',
-          headers: { 'Authorization': 'Bearer ' + s.token }
+          headers: { 'Authorization': 'Bearer ' + tokenParam }
         }).then(function(resp) {
           if (!resp.ok) throw new Error('Auth failed');
           return resp.json();
         }).then(function(data) {
-          panelWs = new WebSocket(sessionOrigin.replace('https://', 'wss://') + '?ticket=' + encodeURIComponent(data.ticket));
+          panelWs = new WebSocket(wsBase + '?ticket=' + encodeURIComponent(data.ticket));
 
           panelWs.onopen = function() {
             if (statusDot) { statusDot.style.color = 'var(--green)'; statusDot.title = 'Connected'; }
@@ -731,7 +741,7 @@
   // F-5: Event delegation for key-bar buttons (no inline onclick)
   const keyBar = document.getElementById('key-bar');
   if (keyBar) {
-    const keyMap: Record<string, string> = {
+    var keyMap = {
       '\\x1b[A': '\x1b[A', '\\x1b[B': '\x1b[B', '\\x1b[C': '\x1b[C', '\\x1b[D': '\x1b[D',
       '\\t': '\t', '\\r': '\r', '\\x1b': '\x1b', '\\x03': '\x03', ' ': ' ', '\\x7f': '\x7f',
     };