cmux-ssh-here 0.6.0 → 0.7.0

package/README.md

@@ -16,7 +16,7 @@ That's it. No `sshd` to configure, no `~/.ssh/authorized_keys` to edit, no firew
 
 ---
 
-The terminal turns into a live dashboard — the link, a countdown bar for its lifetime, and who's connected:
+The terminal turns into a live dashboard — the link, a scannable QR code, a countdown bar for its lifetime, and who's connected:
 
 ![cmux-ssh-here dashboard](https://raw.githubusercontent.com/viktor-silakov/cmux-ssh-here/main/assets/dashboard.png)
 
@@ -27,8 +27,10 @@ Open the link and cmux connects on its own — one click, straight into the shel
 ## Why you'll like it
 
 - ⚡ **Zero setup** — one `npx` command, no SSH server administration.
+- 📱 **Scan to connect** — a QR code in the terminal opens the link on a phone or tablet.
 - 🔑 **No credentials to share** — auth is a one-time token baked into the link.
 - ⏳ **Self-expiring** — the link rotates every 3 minutes; leaked links go stale on their own. Live sessions stay connected.
+- 🎯 **One-time mode** — `--once` locks the link to the first device that connects and rejects everyone else.
 - 👀 **Live dashboard** — see the current link, a countdown bar, and every connected client at a glance.
 - 🧩 **Real SSH** — full PTY shell, `scp`/`sftp`, and the exec channel cmux needs to bootstrap remote workspaces.
 - 🪟 **Persistent sessions** — when `tmux` is present, sessions survive disconnects and are shared across connections.
@@ -66,6 +68,7 @@ The device you open the link from just needs [cmux](https://cmux.com) installed.
 
 ## Options
 
+- `npx cmux-ssh-here --once` — single-use link: locks to the first device that connects, rejects any other.
 - `PORT=2222 npx cmux-ssh-here` — fixed port (random free port by default).
 - `CMUX_SSH_TTL=600 npx cmux-ssh-here` — link/token lifetime in seconds before regeneration (default 180).
 - `CMUX_SSH_DEBUG=1 npx cmux-ssh-here` — log incoming auth/env/exec/shell requests to stderr (disables the live dashboard).

package/bin.js

@@ -18,6 +18,7 @@ import { spawn } from "node:child_process";
 import { chmodSync } from "node:fs";
 import { createRequire } from "node:module";
 import { dirname, join, resolve } from "node:path";
+import qrcodeTerminal from "qrcode-terminal";
 
 // ponytail: the host side needs a POSIX shell + scp/exec semantics, and cmux's
 // own remote daemon only ships linux/darwin/freebsd builds — so a Windows host
@@ -48,6 +49,13 @@ const regenerateToken = () => {
 };
 regenerateToken();
 
+// --once: single-use link. After the first client connects, lock to its IP and
+// stop rotating — new machines are rejected, but that client's several
+// connections (cmux opens ControlMaster + daemon + probes) keep working.
+const ONCE = process.argv.includes("--once");
+let consumed = false;
+let lockedIp = null;
+
 // Active authenticated connections, shown live in the server terminal.
 const sessions = new Map();
 let nextSid = 0;
@@ -258,13 +266,19 @@ let render = () => {}; // assigned once the server is listening (knows ip/port)
 const server = new Server(serverCfg, (client, info) => {
   client.on("authentication", (ctx) => {
     debug("auth", ctx.method, ctx.username);
-    return ctx.username === token ? ctx.accept() : ctx.reject();
+    // Correct token, plus (in --once after consumption) only the locked-in IP.
+    const ok = ctx.username === token && (!consumed || info?.ip === lockedIp);
+    return ok ? ctx.accept() : ctx.reject();
   });
   client.on("ready", () => {
     // ponytail: just track the connection; the 5s timer redraws — no per-event
     // repaint (that was the screen-churn that broke copying).
     const id = nextSid++;
     sessions.set(id, { ip: info?.ip || "?", since: Date.now() });
+    if (ONCE && !consumed) {
+      consumed = true;
+      lockedIp = info?.ip || "?";
+    }
     client.on("close", () => sessions.delete(id));
   });
   client.on("session", (accept) => {
@@ -343,6 +357,16 @@ server.listen(PORT, "0.0.0.0", function () {
     return `[${"█".repeat(filled)}${"░".repeat(W - filled)}]`;
   };
 
+  // ASCII QR of the current link — scan with a phone/tablet to open in cmux.
+  const qrFor = (text) => {
+    let out = "";
+    qrcodeTerminal.generate(text, { small: true }, (q) => (out = q));
+    return out
+      .split("\n")
+      .map((l) => "  " + l)
+      .join("\n");
+  };
+
   // Collapse cmux's several SSH connections from one machine into one row per IP.
   const sessionRows = () => {
     const byIp = new Map();
@@ -356,19 +380,25 @@ server.listen(PORT, "0.0.0.0", function () {
     );
   };
 
+  const mode = ONCE ? " (one-time link)" : "";
+
   render = () => {
     if (!liveUI) return;
     const rem = remainingSec();
+    const link = buildLink();
     const lines = [
       "",
-      `  cmux-ssh-here — shell as ${user} over the LAN`,
+      `  cmux-ssh-here — shell as ${user} over the LAN${mode}`,
       "",
-      "  Open in cmux:",
-      `  ${buildLink()}`,
+      "  Open in cmux (or scan to open on a phone/tablet):",
+      `  ${link}`,
       "",
-      `  Link valid  ${bar(rem)} ${rem}s`,
+      qrFor(link),
       "",
     ];
+    if (consumed) lines.push(`  🔒 One-time link used — locked to ${lockedIp}.`);
+    else lines.push(`  Link valid  ${bar(rem)} ${rem}s`);
+    lines.push("");
     const rows = sessionRows();
     if (rows.length) lines.push(`  Connected (${rows.length}):`, ...rows);
     else lines.push("  No active sessions yet.");
@@ -380,9 +410,10 @@ server.listen(PORT, "0.0.0.0", function () {
   if (liveUI) render();
   else console.log(`\n  Open in cmux (regenerates in ${remainingSec()}s):\n  ${buildLink()}\n`);
 
-  // Refresh every 5s: regenerate the link when it expires, then redraw.
+  // Refresh every 5s: regenerate the link when it expires (unless a one-time
+  // link has already been consumed — then it's frozen), then redraw.
   setInterval(() => {
-    if (remainingSec() <= 0) {
+    if (!consumed && remainingSec() <= 0) {
       regenerateToken();
       if (!liveUI) console.log(`\n  [link regenerated]\n  ${buildLink()}\n`);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cmux-ssh-here",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Spin up a token-auth SSH server and print a cmux deep link to connect over LAN",
   "type": "module",
   "bin": {
@@ -34,6 +34,7 @@
   },
   "dependencies": {
     "node-pty": "^1.0.0",
+    "qrcode-terminal": "^0.12.0",
     "ssh2": "^1.16.0"
   }
 }