cli-tunnel 1.2.0-beta.8 → 1.2.0

package/dist/index.js

@@ -23,6 +23,7 @@ import http from 'node:http';
 import readline from 'node:readline';
 import { WebSocketServer, WebSocket } from 'ws';
 import os from 'node:os';
+import { redactSecrets } from './redact.js';
 function askUser(question) {
     const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
     return new Promise((resolve) => {
@@ -113,8 +114,46 @@ function getGitInfo() {
 }
 // ─── Security: Session token for WebSocket auth ────────────
 const sessionToken = crypto.randomUUID();
-// ─── F-18: Session TTL (24 hours) ──────────────────────────
-const SESSION_TTL = 24 * 60 * 60 * 1000; // 24 hours
+// ─── Session file registry (IPC via filesystem) ────────────
+const sessionsDir = path.join(os.homedir(), '.cli-tunnel', 'sessions');
+fs.mkdirSync(sessionsDir, { recursive: true, mode: 0o700 });
+let sessionFilePath = null;
+function writeSessionFile(tunnelId, tunnelUrl, port) {
+    sessionFilePath = path.join(sessionsDir, `${tunnelId}.json`);
+    const data = JSON.stringify({
+        token: sessionToken, name: sessionName || command,
+        tunnelId, tunnelUrl, port, hubMode,
+        machine: os.hostname(), pid: process.pid,
+        createdAt: new Date().toISOString(),
+    });
+    fs.writeFileSync(sessionFilePath, data, { mode: 0o600 });
+}
+function removeSessionFile() {
+    if (sessionFilePath) {
+        try {
+            fs.unlinkSync(sessionFilePath);
+        }
+        catch { }
+    }
+}
+function readLocalSessions() {
+    try {
+        return fs.readdirSync(sessionsDir)
+            .filter(f => f.endsWith('.json'))
+            .map(f => { try {
+            return JSON.parse(fs.readFileSync(path.join(sessionsDir, f), 'utf-8'));
+        }
+        catch {
+            return null;
+        } })
+            .filter((s) => s !== null && !s.hubMode);
+    }
+    catch {
+        return [];
+    }
+}
+// ─── F-18: Session TTL (4 hours) ───────────────────────────
+const SESSION_TTL = 4 * 60 * 60 * 1000; // 4 hours
 const sessionCreatedAt = Date.now();
 // ─── F-02: One-time ticket store for WebSocket auth ────────
 const tickets = new Map();
@@ -127,24 +166,6 @@ setInterval(() => {
     }
 }, 30000);
 // ─── Security: Redact secrets from replay events ────────────
-function redactSecrets(text) {
-    return text
-        // Generic patterns: key=value, key: value, key="value"
-        .replace(/(?:token|secret|key|password|credential|authorization|api_key|private_key|access_key|connection_string|db_pass|signing)[\s:="']+\S{8,}/gi, '[REDACTED]')
-        // OpenAI keys
-        .replace(/sk-[a-zA-Z0-9]{20,}/g, '[REDACTED]')
-        // GitHub tokens
-        .replace(/gh[ps]_[a-zA-Z0-9]{36,}/g, '[REDACTED]')
-        // AWS keys
-        .replace(/AKIA[A-Z0-9]{16}/g, '[REDACTED]')
-        // Azure connection strings
-        .replace(/DefaultEndpointsProtocol=[^;\s]{20,}/gi, '[REDACTED]')
-        .replace(/AccountKey=[^;\s]{20,}/gi, 'AccountKey=[REDACTED]')
-        // Database URLs
-        .replace(/(postgres|mongodb|mysql|redis):\/\/[^\s"']{10,}/gi, '[REDACTED]')
-        // Bearer tokens in headers
-        .replace(/Bearer\s+[a-zA-Z0-9._-]{20,}/gi, 'Bearer [REDACTED]');
-}
 // ─── Bridge server ──────────────────────────────────────────
 const acpEventLog = [];
 const connections = new Map();
@@ -157,7 +178,51 @@ setInterval(() => {
         }
     }
 }, 60000);
-const server = http.createServer((req, res) => {
+// ─── F-8: Per-IP rate limiter ───────────────────────────────
+const rateLimits = new Map();
+const ticketRateLimits = new Map();
+function checkRateLimit(ip, map, maxRequests) {
+    const now = Date.now();
+    const entry = map.get(ip);
+    if (!entry || entry.resetAt < now) {
+        map.set(ip, { count: 1, resetAt: now + 60000 });
+        return true;
+    }
+    entry.count++;
+    return entry.count <= maxRequests;
+}
+// Clean up rate limit maps every 60s
+setInterval(() => {
+    const now = Date.now();
+    for (const [ip, entry] of rateLimits) {
+        if (entry.resetAt < now)
+            rateLimits.delete(ip);
+    }
+    for (const [ip, entry] of ticketRateLimits) {
+        if (entry.resetAt < now)
+            ticketRateLimits.delete(ip);
+    }
+}, 60000);
+const server = http.createServer(async (req, res) => {
+    const clientIp = req.socket.remoteAddress || 'unknown';
+    // F-8: Rate limiting for HTTP endpoints
+    if (req.url?.startsWith('/api/')) {
+        const isTicket = req.url === '/api/auth/ticket';
+        if (isTicket) {
+            if (!checkRateLimit(clientIp, ticketRateLimits, 10)) {
+                res.writeHead(429, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'Too Many Requests' }));
+                return;
+            }
+        }
+        else {
+            if (!checkRateLimit(clientIp, rateLimits, 30)) {
+                res.writeHead(429, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'Too Many Requests' }));
+                return;
+            }
+        }
+    }
     // F-18: Session expiry check for API routes
     if (!hubMode && req.url?.startsWith('/api/') && Date.now() - sessionCreatedAt > SESSION_TTL) {
         res.writeHead(401, { 'Content-Type': 'application/json' });
@@ -173,13 +238,14 @@ const server = http.createServer((req, res) => {
             return;
         }
         const ticket = crypto.randomUUID();
-        tickets.set(ticket, { expires: Date.now() + 60000 });
+        const expiresAt = Date.now() + 60000;
+        tickets.set(ticket, { expires: expiresAt });
         res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ ticket, expires: Date.now() + 60000 }));
+        res.end(JSON.stringify({ ticket, expires: expiresAt }));
         return;
     }
-    // F-01: Session token check for all API routes (skip in hub mode)
-    if (!hubMode && req.url?.startsWith('/api/')) {
+    // F-01: Session token check for all API routes
+    if (req.url?.startsWith('/api/')) {
         const reqUrl = new URL(req.url, `http://${req.headers.host}`);
         const authToken = req.headers.authorization?.replace('Bearer ', '') || reqUrl.searchParams.get('token');
         if (authToken !== sessionToken) {
@@ -188,27 +254,78 @@ const server = http.createServer((req, res) => {
             return;
         }
     }
+    // Hub ticket proxy — fetch ticket from local session on behalf of grid client
+    if (hubMode && req.url?.startsWith('/api/proxy/ticket/') && req.method === 'POST') {
+        const ticketPathMatch = req.url?.match(/^\/api\/proxy\/ticket\/(\d+)$/);
+        if (!ticketPathMatch) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Invalid port' }));
+            return;
+        }
+        const targetPort = parseInt(ticketPathMatch[1], 10);
+        if (!Number.isFinite(targetPort) || targetPort < 1 || targetPort > 65535) {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Invalid port' }));
+            return;
+        }
+        // Find token for this port from session files
+        const localSessions = readLocalSessions();
+        const session = localSessions.find(s => s.port === targetPort);
+        if (!session) {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Session not found' }));
+            return;
+        }
+        try {
+            const ticketResp = await fetch(`http://127.0.0.1:${targetPort}/api/auth/ticket`, {
+                method: 'POST', headers: { 'Authorization': `Bearer ${session.token}` },
+                signal: AbortSignal.timeout(3000),
+            });
+            if (!ticketResp.ok)
+                throw new Error('Ticket request failed');
+            const ticketData = await ticketResp.json();
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ ticket: ticketData.ticket, port: targetPort }));
+        }
+        catch {
+            res.writeHead(502, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Session unreachable' }));
+            return;
+        }
+        return;
+    }
     // Sessions API
-    if (req.url === '/api/sessions' && req.method === 'GET') {
+    if ((req.url === '/api/sessions' || req.url?.startsWith('/api/sessions?')) && req.method === 'GET') {
         try {
             const output = execFileSync('devtunnel', ['list', '--labels', 'cli-tunnel', '--json'], { encoding: 'utf-8', timeout: 10000, stdio: ['pipe', 'pipe', 'pipe'] });
             const data = JSON.parse(output);
+            const localMachine = os.hostname();
+            const localSessions = hubMode ? readLocalSessions() : [];
+            const tokenMap = new Map(localSessions.map(s => [s.tunnelId, s.token]));
             const sessions = (data.tunnels || []).map((t) => {
                 const labels = t.labels || [];
                 const id = t.tunnelId?.replace(/\.\w+$/, '') || t.tunnelId;
                 const cluster = t.tunnelId?.split('.').pop() || 'euw';
                 const portLabel = labels.find((l) => l.startsWith('port-'));
                 const p = portLabel ? parseInt(portLabel.replace('port-', ''), 10) : 3456;
-                return {
+                const machine = labels[4] || 'unknown';
+                const session = {
                     id, tunnelId: t.tunnelId,
                     name: labels[1] || 'unnamed',
                     repo: labels[2] || 'unknown',
                     branch: (labels[3] || 'unknown').replace(/_/g, '/'),
-                    machine: labels[4] || 'unknown',
+                    machine,
                     online: (t.hostConnections || 0) > 0,
                     port: p,
                     url: `https://${id}-${p}.${cluster}.devtunnels.ms`,
+                    isLocal: machine === localMachine,
                 };
+                // Attach token from local session files (hub mode only)
+                const baseId = t.tunnelId?.split('.')[0] || t.tunnelId;
+                const token = tokenMap.get(baseId) || tokenMap.get(t.tunnelId);
+                if (token)
+                    session.hasToken = true;
+                return session;
             });
             res.writeHead(200, { 'Content-Type': 'application/json', 'X-Frame-Options': 'DENY', 'X-Content-Type-Options': 'nosniff' });
             res.end(JSON.stringify({ sessions }));
@@ -286,9 +403,10 @@ const server = http.createServer((req, res) => {
         'Content-Type': mimes[ext] || 'application/octet-stream',
         'X-Frame-Options': 'DENY',
         'X-Content-Type-Options': 'nosniff',
-        'Content-Security-Policy': "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; connect-src 'self' ws://localhost:* wss://*.devtunnels.ms;",
+        'Content-Security-Policy': "default-src 'self'; script-src 'self' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; connect-src 'self' ws://localhost:* ws://127.0.0.1:* wss://*.devtunnels.ms https://*.devtunnels.ms;",
         'Referrer-Policy': 'no-referrer',
         'Cache-Control': 'no-store',
+        'Strict-Transport-Security': 'max-age=31536000; includeSubDomains',
     };
     res.writeHead(200, securityHeaders);
     // #8: Handle createReadStream errors
@@ -302,24 +420,10 @@ const wss = new WebSocketServer({
     server,
     maxPayload: 1048576,
     verifyClient: (info) => {
-        if (hubMode)
-            return true; // Hub mode doesn't need WS auth
         // F-18: Session expiry
         if (Date.now() - sessionCreatedAt > SESSION_TTL)
             return false;
-        const url = new URL(info.req.url, `http://${info.req.headers.host}`);
-        // F-02: Accept one-time ticket
-        const ticket = url.searchParams.get('ticket');
-        if (ticket && tickets.has(ticket)) {
-            const t = tickets.get(ticket);
-            tickets.delete(ticket); // Single use
-            return t.expires > Date.now();
-        }
-        // Backward compat: accept token
-        if (url.searchParams.get('token') !== sessionToken)
-            return false;
-        // Validate origin if present
-        // #28: Proper origin validation using URL parsing
+        // F-3: Validate origin BEFORE ticket acceptance
         const origin = info.req.headers.origin;
         if (origin) {
             try {
@@ -333,7 +437,15 @@ const wss = new WebSocketServer({
                 return false;
             }
         }
-        return true;
+        const url = new URL(info.req.url, `http://${info.req.headers.host}`);
+        // F-02: Accept one-time ticket (only auth method for WS)
+        const ticket = url.searchParams.get('ticket');
+        if (ticket && tickets.has(ticket)) {
+            const t = tickets.get(ticket);
+            tickets.delete(ticket); // Single use
+            return t.expires > Date.now();
+        }
+        return false;
     },
 });
 // ─── Security: Audit log for remote PTY input ──────────────
@@ -343,14 +455,27 @@ const auditLogPath = path.join(auditDir, `audit-${new Date().toISOString().slice
 const auditLog = fs.createWriteStream(auditLogPath, { flags: 'a' });
 auditLog.on('error', (err) => { console.error('Audit log error:', err.message); });
 wss.on('connection', (ws, req) => {
-    // F-10: Connection cap
+    // F-10: Connection cap (global + per-IP)
     if (connections.size >= 5) {
         ws.close(1013, 'Max connections reached');
         return;
     }
-    const id = crypto.randomUUID();
     const remoteAddress = req.socket.remoteAddress || 'unknown';
+    let perIpCount = 0;
+    for (const [, c] of connections) {
+        if (c._remoteAddress === remoteAddress)
+            perIpCount++;
+    }
+    if (perIpCount >= 2) {
+        ws.close(1013, 'Max connections per IP reached');
+        return;
+    }
+    const id = crypto.randomUUID();
+    ws._remoteAddress = remoteAddress;
     connections.set(id, ws);
+    // F-10: WS ping/pong heartbeat
+    ws._isAlive = true;
+    ws.on('pong', () => { ws._isAlive = true; });
     // Replay history with secrets redacted (only if replay is enabled)
     if (hasReplay) {
         for (const event of acpEventLog) {
@@ -382,6 +507,18 @@ wss.on('connection', (ws, req) => {
     });
     ws.on('close', () => connections.delete(id));
 });
+// F-10: WS heartbeat — ping every 30s, close unresponsive after 10s
+setInterval(() => {
+    for (const [id, ws] of connections) {
+        if (ws._isAlive === false) {
+            ws.terminate();
+            connections.delete(id);
+            continue;
+        }
+        ws._isAlive = false;
+        ws.ping();
+    }
+}, 30000);
 function broadcast(data) {
     const msg = JSON.stringify({ type: 'pty', data });
     if (hasReplay) {
@@ -410,7 +547,8 @@ async function main() {
     console.log(`\n${BOLD}cli-tunnel${RESET} ${DIM}v1.1.0${RESET}\n`);
     if (hubMode) {
         console.log(`  ${BOLD}📋 Hub Mode${RESET} — sessions dashboard`);
-        console.log(`  ${DIM}Port:${RESET}     ${actualPort}\n`);
+        console.log(`  ${DIM}Port:${RESET}     ${actualPort}`);
+        console.log(`  ${DIM}Local URL:${RESET} http://127.0.0.1:${actualPort}?token=${sessionToken}&hub=1\n`);
     }
     else {
         console.log(`  ${DIM}Command:${RESET}  ${command} ${commandArgs.join(' ')}`);
@@ -531,19 +669,21 @@ async function main() {
                     });
                     hostProc.on('error', (e) => { clearTimeout(timeout); reject(e); });
                 });
-                const tunnelUrlWithToken = `${url}?token=${sessionToken}`;
+                const tunnelUrlWithToken = `${url}?token=${sessionToken}${hubMode ? '&hub=1' : ''}`;
                 console.log(`  ${GREEN}✓${RESET} Tunnel: ${BOLD}${tunnelUrlWithToken}${RESET}\n`);
+                // Write session file for hub discovery
+                writeSessionFile(tunnelId, url, actualPort);
                 try {
                     // @ts-ignore
                     const qr = (await import('qrcode-terminal'));
                     qr.default.generate(tunnelUrlWithToken, { small: true }, (code) => console.log(code));
                 }
                 catch { }
-                process.on('SIGINT', () => { hostProc.kill(); try {
+                process.on('SIGINT', () => { removeSessionFile(); hostProc.kill(); try {
                     execFileSync('devtunnel', ['delete', tunnelId, '--force'], { stdio: 'pipe' });
                 }
                 catch { } });
-                process.on('exit', () => { hostProc.kill(); try {
+                process.on('exit', () => { removeSessionFile(); hostProc.kill(); try {
                     execFileSync('devtunnel', ['delete', tunnelId, '--force'], { stdio: 'pipe' });
                 }
                 catch { } });
@@ -582,6 +722,21 @@ async function main() {
         // Keep process alive
         await new Promise(() => { });
     }
+    // Wait for user to scan QR / copy URL before starting the CLI tool
+    if (hasTunnel) {
+        console.log(`  ${BOLD}Press any key to start ${command}...${RESET}`);
+        await new Promise((resolve) => {
+            if (process.stdin.isTTY)
+                process.stdin.setRawMode(true);
+            process.stdin.resume();
+            process.stdin.once('data', () => {
+                if (process.stdin.isTTY)
+                    process.stdin.setRawMode(false);
+                process.stdin.pause();
+                resolve();
+            });
+        });
+    }
     console.log(`  ${DIM}Starting ${command}...${RESET}\n`);
     // Spawn PTY
     const nodePty = await import('node-pty');
@@ -609,8 +764,11 @@ async function main() {
     // Blocklist approach: pass everything except known dangerous vars and secrets
     const DANGEROUS_VARS = new Set(['NODE_OPTIONS', 'NODE_REPL_HISTORY', 'NODE_EXTRA_CA_CERTS',
         'NODE_PATH', 'NODE_REDIRECT_WARNINGS', 'NODE_PENDING_DEPRECATION',
-        'UV_THREADPOOL_SIZE', 'LD_PRELOAD', 'DYLD_INSERT_LIBRARIES']);
-    const sensitivePattern = /token|secret|key|password|credential|api_key|private_key|access_key|connection_string|auth/i;
+        'UV_THREADPOOL_SIZE', 'LD_PRELOAD', 'DYLD_INSERT_LIBRARIES',
+        'SSH_AUTH_SOCK', 'GPG_TTY',
+        'PYTHONPATH', 'BASH_ENV', 'BASH_FUNC', 'JAVA_TOOL_OPTIONS', 'JAVA_OPTIONS', '_JAVA_OPTIONS',
+        'PROMPT_COMMAND', 'ENV', 'ZDOTDIR', 'PERL5OPT', 'RUBYOPT']);
+    const sensitivePattern = /token|secret|key|password|credential|api_key|private_key|access_key|connection_string|auth|kubeconfig|docker_host|docker_config/i;
     const safeEnv = {};
     for (const [k, v] of Object.entries(process.env)) {
         if (v !== undefined && !DANGEROUS_VARS.has(k) && !sensitivePattern.test(k)) {
@@ -623,23 +781,28 @@ async function main() {
         env: safeEnv,
     });
     // Detect CSPRNG crash (rare Node.js + PTY issue) and show helpful message
-    let ptyExitedEarly = false;
+    let earlyExitCode = null;
     const earlyExitCheck = new Promise((resolve) => {
         ptyProcess.onExit(({ exitCode }) => {
-            if (exitCode === 134 || exitCode === 3221226505) {
-                ptyExitedEarly = true;
-                resolve();
-            }
+            earlyExitCode = exitCode;
+            resolve();
         });
         setTimeout(resolve, 2000);
     });
     await earlyExitCheck;
-    if (ptyExitedEarly) {
-        const nodeVer = process.version;
-        console.log(`  ${YELLOW}⚠${RESET} The command crashed (CSPRNG assertion failure).`);
-        console.log(`  This is a known issue with Node.js ${nodeVer} + PTY on Windows.`);
-        console.log(`  ${BOLD}Fix:${RESET} Install Node.js 22 LTS: ${GREEN}nvm install 22${RESET} or ${GREEN}winget install OpenJS.NodeJS.LTS${RESET}\n`);
-        process.exit(1);
+    if (earlyExitCode !== null) {
+        if (earlyExitCode === 134 || earlyExitCode === 3221226505) {
+            const nodeVer = process.version;
+            console.log(`  ${YELLOW}⚠${RESET} The command crashed (CSPRNG assertion failure).`);
+            console.log(`  This is a known issue with Node.js ${nodeVer} + PTY on Windows.`);
+            console.log(`  ${BOLD}Fix:${RESET} Install Node.js 22 LTS: ${GREEN}nvm install 22${RESET} or ${GREEN}winget install OpenJS.NodeJS.LTS${RESET}\n`);
+            process.exit(1);
+        }
+        else {
+            console.log(`\n${DIM}Process exited (code ${earlyExitCode}).${RESET}`);
+            server.close();
+            process.exit(earlyExitCode);
+        }
     }
     ptyProcess.onData((data) => {
         process.stdout.write(data);

package/dist/redact.d.ts

@@ -0,0 +1 @@
+export declare function redactSecrets(text: string): string;

package/dist/redact.js

@@ -0,0 +1,26 @@
+export function redactSecrets(text) {
+    return text
+        // Generic patterns: key=value, key: value, key="value"
+        .replace(/(?:token|secret|key|password|credential|authorization|api_key|private_key|access_key|connection_string|db_pass|signing)[\s:="']+\S{8,}/gi, '[REDACTED]')
+        // OpenAI keys
+        .replace(/sk-[a-zA-Z0-9]{20,}/g, '[REDACTED]')
+        // GitHub tokens
+        .replace(/gh[ps]_[a-zA-Z0-9]{36,}/g, '[REDACTED]')
+        // AWS keys
+        .replace(/AKIA[A-Z0-9]{16}/g, '[REDACTED]')
+        // Azure connection strings
+        .replace(/DefaultEndpointsProtocol=[^;\s]{20,}/gi, '[REDACTED]')
+        .replace(/AccountKey=[^;\s]{20,}/gi, 'AccountKey=[REDACTED]')
+        // Database URLs
+        .replace(/(postgres|mongodb|mysql|redis):\/\/[^\s"']{10,}/gi, '[REDACTED]')
+        // Bearer tokens in headers
+        .replace(/Bearer\s+[a-zA-Z0-9._-]{20,}/gi, 'Bearer [REDACTED]')
+        // JWT tokens
+        .replace(/eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}/g, '[REDACTED]')
+        // Slack tokens
+        .replace(/xox[bpras]-[a-zA-Z0-9-]{10,}/g, '[REDACTED]')
+        // npm tokens
+        .replace(/npm_[a-zA-Z0-9]{20,}/g, '[REDACTED]')
+        // PEM private keys
+        .replace(/-----BEGIN [A-Z ]+ PRIVATE KEY-----[\s\S]*?-----END [A-Z ]+ PRIVATE KEY-----/g, '[REDACTED]');
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cli-tunnel",
-  "version": "1.2.0-beta.8",
+  "version": "1.2.0",
   "description": "Tunnel any CLI app to your phone — PTY + devtunnel + xterm.js",
   "type": "module",
   "main": "dist/index.js",
@@ -13,7 +13,8 @@
   ],
   "scripts": {
     "build": "tsc",
-    "test": "vitest run"
+    "test": "vitest run",
+    "test:coverage": "vitest run --coverage"
   },
   "keywords": [
     "cli",
@@ -35,13 +36,14 @@
     "node": ">=22.0.0"
   },
   "dependencies": {
-    "node-pty": "^1.1.0",
-    "qrcode-terminal": "^0.12.0",
-    "ws": "^8.19.0"
+    "node-pty": "1.1.0",
+    "qrcode-terminal": "0.12.0",
+    "ws": "8.19.0"
   },
   "devDependencies": {
     "@types/node": "^25.3.2",
     "@types/ws": "^8.18.1",
+    "@vitest/coverage-v8": "^4.0.18",
     "typescript": "^5.9.3",
     "vitest": "^4.0.18"
   }