lobstakit-cloud 1.3.9 → 1.3.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lobstakit-cloud",
-  "version": "1.3.9",
+  "version": "1.3.10",
   "description": "LobstaKit Cloud — Setup wizard and management for LobstaCloud gateways",
   "main": "server.js",
   "bin": {

package/public/js/manage.js

@@ -96,6 +96,8 @@ const SETTINGS_PROVIDER_FALLBACK = {
 
 let settingsProviders = SETTINGS_PROVIDER_FALLBACK;
 let currentAiSettings = null;
+let terminalHistory = [];
+let terminalHistoryIndex = -1;
 
 async function logout() {
     const token = localStorage.getItem('lobstakit_token');
@@ -229,6 +231,7 @@ document.addEventListener('DOMContentLoaded', async () => {
     refreshVersionStatus();
     loadAccountEmail();
     checkMissionControlAccess();
+    initTerminal();
 
     // Auto-refresh
     setInterval(fetchStatus, 10000);
@@ -243,6 +246,115 @@ document.addEventListener('DOMContentLoaded', async () => {
     setInterval(refreshVersionStatus, 60000);
 });
 
+function escapeHtml(value) {
+    return String(value || '')
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+
+function appendTerminalOutput(html) {
+    const outputEl = document.getElementById('terminal-output');
+    if (!outputEl) return;
+    outputEl.insertAdjacentHTML('beforeend', html);
+    outputEl.scrollTop = outputEl.scrollHeight;
+}
+
+function setTerminalRunning(isRunning) {
+    const runBtn = document.getElementById('terminal-run-btn');
+    if (!runBtn) return;
+    runBtn.disabled = isRunning;
+    runBtn.textContent = isRunning ? 'Running...' : 'Run';
+}
+
+function terminalHistoryUp(inputEl) {
+    if (!terminalHistory.length) return;
+    if (terminalHistoryIndex <= 0) {
+        terminalHistoryIndex = 0;
+    } else {
+        terminalHistoryIndex -= 1;
+    }
+    inputEl.value = terminalHistory[terminalHistoryIndex];
+}
+
+function terminalHistoryDown(inputEl) {
+    if (!terminalHistory.length) return;
+    if (terminalHistoryIndex >= terminalHistory.length - 1) {
+        terminalHistoryIndex = terminalHistory.length;
+        inputEl.value = '';
+        return;
+    }
+    terminalHistoryIndex += 1;
+    inputEl.value = terminalHistory[terminalHistoryIndex];
+}
+
+async function runTerminalCommand() {
+    const inputEl = document.getElementById('terminal-input');
+    if (!inputEl) return;
+
+    const command = inputEl.value.trim();
+    if (!command) return;
+
+    terminalHistory.push(command);
+    terminalHistoryIndex = terminalHistory.length;
+    inputEl.value = '';
+    setTerminalRunning(true);
+
+    try {
+        const res = await fetch('/api/run-command', authFetchOpts({
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ command: command })
+        }));
+        const data = await res.json();
+
+        if (!res.ok) {
+            const requestError = escapeHtml(data.error || 'Request failed');
+            appendTerminalOutput(`$ ${escapeHtml(command)}\n<span style="color:#f85149">${requestError}</span>\n\n`);
+            return;
+        }
+
+        const stdout = escapeHtml(data.stdout || '');
+        const stderr = escapeHtml(data.stderr || '');
+        const hasError = Number(data.exitCode) !== 0;
+        const stderrBlock = stderr
+            ? (hasError ? `<span style="color:#f85149">${stderr}</span>` : stderr)
+            : '';
+
+        appendTerminalOutput(`$ ${escapeHtml(command)}\n${stdout}${stderrBlock}\n\n`);
+    } catch (err) {
+        appendTerminalOutput(`$ ${escapeHtml(command)}\n<span style="color:#f85149">${escapeHtml(err.message || 'Connection error')}</span>\n\n`);
+    } finally {
+        setTerminalRunning(false);
+    }
+}
+
+function initTerminal() {
+    const inputEl = document.getElementById('terminal-input');
+    const runBtn = document.getElementById('terminal-run-btn');
+    if (!inputEl || !runBtn) return;
+
+    runBtn.addEventListener('click', runTerminalCommand);
+    inputEl.addEventListener('keydown', (event) => {
+        if (event.key === 'Enter') {
+            event.preventDefault();
+            runTerminalCommand();
+            return;
+        }
+        if (event.key === 'ArrowUp') {
+            event.preventDefault();
+            terminalHistoryUp(inputEl);
+            return;
+        }
+        if (event.key === 'ArrowDown') {
+            event.preventDefault();
+            terminalHistoryDown(inputEl);
+        }
+    });
+}
+
 // ─── Gateway Status ──────────────────────────────────────────
 
 async function fetchStatus() {

package/public/manage.html

@@ -187,6 +187,15 @@
                         </div>
                     </div>
 
+                    <div class="card" id="terminal-section">
+                        <h3>🖥️ Terminal</h3>
+                        <div class="terminal-output" id="terminal-output" style="min-height:120px;max-height:300px;overflow-y:auto;background:#0d1117;color:#e6edf3;font-family:monospace;font-size:13px;padding:12px;border-radius:6px;margin-bottom:10px;white-space:pre-wrap;"></div>
+                        <div style="display:flex;gap:8px;">
+                            <input type="text" id="terminal-input" placeholder="Enter command..." style="flex:1;font-family:monospace;font-size:13px;" />
+                            <button id="terminal-run-btn" class="btn btn-secondary">Run</button>
+                        </div>
+                    </div>
+
                     <!-- Channels Management -->
                     <div class="card" id="channels-card">
                         <div class="flex items-center justify-between mb-4">

package/server.js

@@ -217,7 +217,7 @@ function requireAuth(req, res, next) {
   // NEW-1 FIX: Even before password is set, protect destructive endpoints with setupToken
   if (!lobstaConfig.passwordHash) {
     // These endpoints MUST require setupToken even before password is set
-    const protectedPreSetup = ['/api/setup', '/api/restart', '/api/security/harden', '/api/settings', '/api/diagnostics', '/api/diagnostics/fix'];
+    const protectedPreSetup = ['/api/setup', '/api/restart', '/api/security/harden', '/api/settings', '/api/diagnostics', '/api/diagnostics/fix', '/api/run-command'];
     const isProtected = protectedPreSetup.some(p => req.path === p) ||
                         req.path.startsWith('/api/channels/');
     if (isProtected) {
@@ -895,6 +895,36 @@ app.post('/api/diagnostics/fix', (req, res) => {
   });
 });
 
+/**
+ * POST /api/run-command — Execute a shell command from the dashboard terminal
+ */
+app.post('/api/run-command', (req, res) => {
+  const command = typeof req.body?.command === 'string' ? req.body.command.trim() : '';
+
+  if (!command) {
+    return res.status(400).json({ error: 'Command is required' });
+  }
+  if (command.length > 500) {
+    return res.status(400).json({ error: 'Command too long (max 500 characters)' });
+  }
+
+  try {
+    const stdout = execSync(command, {
+      encoding: 'utf8',
+      timeout: 30000,
+      shell: true
+    });
+    return res.json({ success: true, stdout, stderr: '', exitCode: 0 });
+  } catch (err) {
+    return res.json({
+      success: false,
+      stdout: err.stdout || '',
+      stderr: err.stderr || err.message,
+      exitCode: err.status || 1
+    });
+  }
+});
+
 /**
  * GET /api/gateway-status — Check if gateway is running
  */