shell-mirror 1.5.139 → 1.5.143

package/auth.js

@@ -7,8 +7,14 @@ passport.use(new GoogleStrategy({
     callbackURL: `${process.env.BASE_URL}/auth/google/callback`
   },
   function(accessToken, refreshToken, profile, cb) {
-    // Here, you would typically find or create a user in your database.
-    // For this simple application, we'll just pass the profile through.
+    // Access allowlist — personal tool, only the owner's account(s) may sign in.
+    // Comma-separated ALLOWED_EMAILS env var; empty => fail closed (deny all).
+    const allowed = (process.env.ALLOWED_EMAILS || '')
+      .split(',').map(e => e.trim().toLowerCase()).filter(Boolean);
+    const email = ((profile.emails && profile.emails[0] && profile.emails[0].value) || '').toLowerCase();
+    if (allowed.length === 0 || !allowed.includes(email)) {
+      return cb(null, false, { message: 'This account is not authorized to access Shell Mirror.' });
+    }
     return cb(null, profile);
   }
 ));

package/mac-agent/.env.example

@@ -14,6 +14,15 @@ RECONNECT_INTERVAL=5000
 HEARTBEAT_INTERVAL=30000
 COMMAND_TIMEOUT=30000
 
+# Cloud WebRTC signaling (OFF by default for safety).
+# The public relay does not authenticate callers, so exposing the agent on it lets
+# anyone who knows the agent id open a shell. Only set this to 'true' when you point
+# WEBSOCKET_URL at a relay you control, and ALWAYS pair it with CONNECT_SECRET.
+ENABLE_CLOUD_WEBRTC=false
+# Shared secret the browser must present in client-hello before a shell is spawned.
+# Leave empty only when cloud signaling is disabled and you use LAN-direct.
+CONNECT_SECRET=
+
 # Security
 MAX_CONCURRENT_SESSIONS=5
 ALLOWED_COMMANDS=ls,pwd,whoami,echo,cat,grep,find,ps,top,df,du,uname,date,which

package/mac-agent/agent.js

@@ -42,6 +42,13 @@ function generateStableAgentId() {
 const AGENT_ID = process.env.AGENT_ID || generateStableAgentId();
 logToFile(`🆔 Agent ID: ${AGENT_ID}`);
 
+// Cloud signaling is OFF by default. The public relay does not authenticate
+// callers, so exposing the agent on it lets anyone who knows/guesses the agent id
+// open a shell. Only dial a remote wss:// relay when explicitly enabled, and
+// ideally pair it with CONNECT_SECRET (checked in the client-hello handler).
+const ENABLE_CLOUD_WEBRTC = process.env.ENABLE_CLOUD_WEBRTC === 'true';
+const CONNECT_SECRET = process.env.CONNECT_SECRET || '';
+
 // Determine signaling server URL - prefer WEBSOCKET_URL for cloud connections
 let SIGNALING_SERVER_URL;
 if (process.env.WEBSOCKET_URL) {
@@ -527,28 +534,36 @@ function stopHeartbeatSystem() {
   }
 }
 
+// Open the web dashboard in the default browser (best-effort).
+function openDashboardInBrowser() {
+  const dashboardUrl = 'https://shellmirror.app/app/dashboard.html';
+  logToFile(`🌐 Opening dashboard in browser: ${dashboardUrl}`);
+  exec(`open "${dashboardUrl}"`, (error) => {
+    if (error) {
+      logToFile(`⚠️ Could not open browser automatically: ${error.message}`);
+      logToFile(`💡 Please open ${dashboardUrl} manually in your browser`);
+    } else {
+      logToFile('✅ Dashboard opened in browser');
+    }
+  });
+}
+
 function connectToSignalingServer() {
+  // Refuse to expose this agent on a remote (wss://) relay unless cloud signaling
+  // is explicitly enabled. Local/LAN signaling (ws://) is still allowed for dev.
+  const isRemoteRelay = /^wss:\/\//i.test(SIGNALING_SERVER_URL);
+  if (isRemoteRelay && !ENABLE_CLOUD_WEBRTC) {
+    logToFile(`⛔ Cloud WebRTC disabled (ENABLE_CLOUD_WEBRTC!=true): not connecting to remote relay ${SIGNALING_SERVER_URL}.`);
+    logToFile(`   Use LAN-direct, the HTTP agent, or set ENABLE_CLOUD_WEBRTC=true + CONNECT_SECRET to re-enable cloud access.`);
+    return;
+  }
   logToFile(`🔌 Connecting to signaling server at ${SIGNALING_SERVER_URL}?role=agent&agentId=${AGENT_ID}`);
   ws = new WebSocket(`${SIGNALING_SERVER_URL}?role=agent&agentId=${AGENT_ID}`);
 
   ws.on('open', () => {
-    logToFile('✅ Connected to signaling server.');
-
-    // Start heartbeat system to maintain agent status
-    startHeartbeatSystem();
-
-    // Open dashboard in default browser
-    const dashboardUrl = 'https://shellmirror.app/app/dashboard.html';
-    logToFile(`🌐 Opening dashboard in browser: ${dashboardUrl}`);
-
-    exec(`open "${dashboardUrl}"`, (error) => {
-      if (error) {
-        logToFile(`⚠️ Could not open browser automatically: ${error.message}`);
-        logToFile(`💡 Please open ${dashboardUrl} manually in your browser`);
-      } else {
-        logToFile('✅ Dashboard opened in browser');
-      }
-    });
+    logToFile('✅ Connected to signaling server (cloud relay).');
+    // Heartbeat + dashboard are started at agent startup (independent of the relay)
+    // so PHP registration and the LAN-direct path work even with cloud signaling off.
   });
 
   ws.on('message', async (message) => {
@@ -559,6 +574,14 @@ function connectToSignalingServer() {
       switch (data.type) {
         case 'client-hello':
           logToFile(`🔄 Received client-hello from ${data.from}. Processing session request.`);
+          // Defense-in-depth: if a connect secret is configured, the caller must
+          // present it before we ever spawn a shell. Stops anyone who can reach the
+          // relay from opening a session just by knowing the agent id.
+          if (CONNECT_SECRET && data.connectSecret !== CONNECT_SECRET) {
+            logToFile(`⛔ Rejected client-hello from ${data.from}: missing/invalid connect secret`);
+            sendMessage({ type: 'error', message: 'Not authorized', to: data.from, from: AGENT_ID });
+            break;
+          }
           try {
             let sessionId;
             let isNewSession = false;
@@ -1308,8 +1331,13 @@ function startLocalServer() {
 // --- Start the agent ---
 console.log(`[AGENT] Starting Mac Agent with ID: ${AGENT_ID}`);
 
-// Start local server for direct connections
+// Start local server for direct connections (LAN-direct path; no cloud needed)
 const localServer = startLocalServer();
 
+// Register with the PHP backend and open the dashboard regardless of cloud
+// signaling, so the agent stays usable over LAN-direct without Heroku.
+startHeartbeatSystem();
+openDashboardInBrowser();
+
 console.log(`[AGENT] Connecting to signaling server at: ${SIGNALING_SERVER_URL}`);
 connectToSignalingServer();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shell-mirror",
-  "version": "1.5.139",
+  "version": "1.5.143",
   "description": "Access your Mac shell from any device securely. Perfect for mobile coding with Claude Code CLI, Gemini CLI, and any shell tool.",
   "main": "server.js",
   "bin": {
@@ -52,6 +52,8 @@
     "url": "https://github.com/karmalsky/shell-mirror/issues"
   },
   "dependencies": {
+    "@koush/wrtc": "^0.5.3",
+    "axios": "^1.6.2",
     "commander": "^11.1.0",
     "dotenv": "^16.4.5",
     "express": "^5.1.0",
@@ -60,6 +62,7 @@
     "node-pty": "^1.0.0",
     "passport": "^0.7.0",
     "passport-google-oauth20": "^2.0.0",
+    "winston": "^3.11.0",
     "ws": "^8.18.2",
     "uuid": "^8.3.2"
   },

package/public/app/config.js

@@ -0,0 +1,12 @@
+// Shared runtime config for the Shell Mirror web app.
+// Single source of truth for the WebRTC signaling endpoint, so the deployment can
+// move off Heroku without touching application code. See PLAN.md → "Running
+// without Heroku" for the migration options.
+//
+// To go Heroku-free:
+//   • Free WS host (Fly.io / Render / Cloudflare Worker): set SIGNALING_URL to it.
+//   • LAN-direct only: set SIGNALING_URL to '' — the terminal falls back to
+//     connecting directly to the Mac over the local network.
+window.SHELL_MIRROR_CONFIG = {
+  SIGNALING_URL: 'wss://shell-mirror-30aa5479ceaf.herokuapp.com'
+};

package/public/app/dashboard.html

@@ -102,6 +102,7 @@
         <p id="dashboard-version-info" style="margin: 0;">>shell-mirror • Loading...</p>
     </footer>
 
+    <script src="config.js"></script>
     <script src="dashboard.js"></script>
 </body>
 </html>

package/public/app/dashboard.js

@@ -168,11 +168,17 @@ class ShellMirrorDashboard {
         const protocol = window.location.protocol === 'https:' ? 'wss:' : 'ws:';
         let wsUrl;
         
+        const configuredSignaling = (window.SHELL_MIRROR_CONFIG && window.SHELL_MIRROR_CONFIG.SIGNALING_URL) || '';
         if (isProduction) {
-            // For production, try the Heroku WebSocket app URL
-            // This may need to be adjusted based on actual deployment architecture
-            wsUrl = `wss://shell-mirror-30aa5479ceaf.herokuapp.com/?role=dashboard`;
-            console.log('[DASHBOARD] 🌐 Production environment detected, using Heroku WebSocket URL');
+            // Signaling endpoint from config.js (single source of truth). Empty =>
+            // cloud signaling disabled; the dashboard still lists agents via the
+            // PHP agents-list.php fallback below.
+            if (!configuredSignaling) {
+                console.log('[DASHBOARD] ☁️ Cloud signaling disabled — skipping live WebSocket, using PHP agent list.');
+                return;
+            }
+            wsUrl = `${configuredSignaling}/?role=dashboard`;
+            console.log('[DASHBOARD] 🌐 Using signaling server:', configuredSignaling);
         } else {
             // For development, use same host
             wsUrl = `${protocol}//${window.location.host}/?role=dashboard`;

package/public/app/terminal.html

@@ -2,7 +2,7 @@
 <html>
   <head>
     <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, interactive-widget=resizes-content">
     <link rel="icon" type="image/png" href="/images/favicon.png">
     <title>Terminal Mirror</title>
     
@@ -56,25 +56,33 @@
     <script src="https://cdn.jsdelivr.net/npm/xterm@4.15.0/lib/xterm.js"></script>
     <script src="https://cdn.jsdelivr.net/npm/xterm-addon-fit@0.5.0/lib/xterm-addon-fit.js"></script>
     <style>
-      body, html { 
-        margin: 0; 
-        padding: 0; 
-        height: 100%; 
-        overflow: hidden; 
-        background-color: #1e1e1e; 
-        color: #ccc; 
+      body, html {
+        margin: 0;
+        padding: 0;
+        height: 100%;
+        overflow: hidden;
+        background-color: #1e1e1e;
+        color: #ccc;
         font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
-      }
-      #terminal-container { 
-        display: none; 
-        height: 100%; 
-        width: 100%; 
+        box-sizing: border-box;
+        /* JS sets --keyboard-inset on <html> via visualViewport to shrink
+           the body when the on-screen keyboard opens. The flex column inside
+           shrinks with it so the FAB rides above the keyboard. */
+        padding-bottom: var(--keyboard-inset, 0px);
+        transition: padding-bottom 0.15s ease-out;
+      }
+      #terminal-container {
+        display: none;
+        height: 100%;
+        width: 100%;
         background-color: #000000;
       }
-      
+
       #terminal-container.show {
         display: flex;
         flex-direction: column;
+        min-height: 0;
+        overflow: hidden;
       }
       
       /* Session Header - Unified Design */
@@ -281,9 +289,11 @@
       #terminal {
         padding: 8px;  /* Mac Terminal.app padding */
         background-color: #000000;
-        height: calc(100% - 16px - 40px); /* Subtract session header height */
-        width: calc(100% - 16px);
-        flex: 1;
+        flex: 1 1 auto;
+        min-height: 0;  /* critical: lets xterm shrink as the column shortens */
+        width: 100%;
+        box-sizing: border-box;
+        overflow: hidden;
       }
       #connect-container { padding: 2em; text-align: center; }
       #agent-id-input { font-size: 1.2em; padding: 8px; width: 400px; margin-bottom: 1em; }
@@ -376,14 +386,18 @@
          Floating Buttons - Mobile CLI Shortcuts
          ======================================== */
       .floating-buttons {
-        position: fixed;
-        bottom: 20px;
-        left: 50%;
-        transform: translateX(-50%);
+        /* In-flow flex child of #terminal-container. Layout (not the
+           compositor) decides where the strip sits, which avoids iOS Safari's
+           position:fixed + backdrop-filter freeze during keyboard transitions. */
+        position: relative;
+        align-self: center;
+        margin: 0 auto 8px;
+        padding-bottom: env(safe-area-inset-bottom, 0);
         z-index: 1000;
         display: flex;
         align-items: center;
         gap: 0;
+        flex-shrink: 0;
       }
 
       /* Toggle button (collapse/expand) */
@@ -400,6 +414,8 @@
         cursor: pointer;
         flex-shrink: 0;
         margin-right: 4px;
+        touch-action: manipulation;
+        -webkit-tap-highlight-color: transparent;
       }
 
       .fab-toggle:active {
@@ -422,6 +438,8 @@
         display: flex;
         align-items: center;
         justify-content: center;
+        touch-action: manipulation;
+        -webkit-tap-highlight-color: transparent;
       }
 
       .fab-scroll:active { opacity: 1; background: #22232a; }
@@ -452,7 +470,7 @@
         -webkit-backdrop-filter: blur(10px);
         border-top: 1px solid #2a2b30;
         border-bottom: 1px solid #2a2b30;
-        max-width: calc(100vw - 130px);
+        max-width: calc(100vw - 104px); /* toggle 44 + two scroll chevrons 56 + 4 slack */
         scrollbar-width: none;
         transition: max-width 0.2s, opacity 0.2s, padding 0.2s;
       }
@@ -486,6 +504,8 @@
         white-space: nowrap;
         cursor: pointer;
         transition: background 0.1s;
+        touch-action: manipulation;
+        -webkit-tap-highlight-color: transparent;
       }
 
       .fab-btn:active { background: #22232a; }
@@ -500,21 +520,42 @@
         background: #4a4cd6;
       }
 
-      /* Desktop: hide floating buttons */
-      @media (min-width: 1025px) {
+      /* Transient notice bubble above the strip (paste failures etc.) */
+      .fab-notice {
+        position: absolute;
+        bottom: calc(100% + 8px);
+        left: 50%;
+        transform: translateX(-50%);
+        background: rgba(20, 21, 25, 0.95);
+        backdrop-filter: blur(10px);
+        -webkit-backdrop-filter: blur(10px);
+        border: 1px solid #2a2b30;
+        color: #8a8f98;
+        font-size: 12px;
+        padding: 6px 12px;
+        border-radius: 8px;
+        white-space: nowrap;
+        opacity: 0;
+        pointer-events: none;
+        transition: opacity 0.15s;
+        z-index: 1001;
+      }
+
+      .fab-notice.visible { opacity: 1; }
+
+      /* Desktop (mouse + hover only): hide floating buttons.
+         Touch tablets like iPad Pro 11"/12.9" landscape (1194/1366px) keep the strip. */
+      @media (min-width: 1025px) and (hover: hover) and (pointer: fine) {
         .floating-buttons { display: none; }
       }
 
-      /* Small phones: adjust sizing */
-      @media (max-width: 375px) {
+      /* Phones: tighter sizing so the primary group (⇧Tab…⏎) stays visible */
+      @media (max-width: 430px) {
         .fab-btn {
-          min-width: 44px;
-          padding: 0 10px;
+          min-width: 40px;
+          padding: 0 8px;
           font-size: 12px;
         }
-        .fab-strip {
-          max-width: calc(100vw - 110px);
-        }
       }
     </style>
   </head>
@@ -545,43 +586,49 @@
             </div>
         </div>
         <div id="terminal"></div>
-    </div>
 
-    <!-- Floating Buttons - Mobile CLI Shortcuts -->
-    <div id="floating-buttons" class="floating-buttons">
-      <!-- Toggle button (collapse/expand) -->
-      <button class="fab-toggle" id="fabToggle" aria-label="Toggle keyboard shortcuts" tabindex="-1">
-        <span class="fab-toggle-icon">⌨</span>
-      </button>
-
-      <!-- Left scroll indicator -->
-      <button class="fab-scroll fab-scroll-left hidden" id="fabScrollLeft" aria-label="Scroll left" tabindex="-1">
-        <span>‹</span>
-      </button>
-
-      <!-- Scrollable button strip -->
-      <div class="fab-strip" id="fabStrip">
-        <!-- Control group (scroll left to reveal) -->
-        <button class="fab-btn" data-keys="ctrl+l" title="Clear screen" tabindex="-1">^L</button>
-        <button class="fab-btn" data-keys="ctrl+d" title="EOF/Exit" tabindex="-1">^D</button>
-        <button class="fab-btn" data-keys="ctrl+c" title="Interrupt" tabindex="-1">^C</button>
-
-        <!-- Primary group (default visible - AI CLI essentials) -->
-        <button class="fab-btn fab-primary" data-keys="shift+tab" title="Mode: Normal → Auto → Plan" tabindex="-1">⇧Tab</button>
-        <button class="fab-btn" data-keys="tab" title="Autocomplete / Thinking" tabindex="-1">Tab</button>
-        <button class="fab-btn" data-keys="up" data-repeat="true" title="History up" tabindex="-1">↑</button>
-        <button class="fab-btn" data-keys="down" data-repeat="true" title="History down" tabindex="-1">↓</button>
-        <button class="fab-btn" data-keys="escape" title="Cancel / Rewind (2x)" tabindex="-1">Esc</button>
-
-        <!-- Navigation group (scroll right to reveal) -->
-        <button class="fab-btn" data-keys="left" title="Cursor left" tabindex="-1">←</button>
-        <button class="fab-btn" data-keys="right" title="Cursor right" tabindex="-1">→</button>
-      </div>
-
-      <!-- Right scroll indicator -->
-      <button class="fab-scroll fab-scroll-right" id="fabScrollRight" aria-label="Scroll right" tabindex="-1">
-        <span>›</span>
-      </button>
+        <!-- Floating Buttons - Mobile CLI Shortcuts (flex child so it reserves layout space) -->
+        <div id="floating-buttons" class="floating-buttons">
+          <!-- Transient notice (e.g. clipboard paste failures) -->
+          <div class="fab-notice" id="fabNotice" role="status"></div>
+
+          <!-- Toggle button (collapse/expand) -->
+          <button class="fab-toggle" id="fabToggle" aria-label="Toggle keyboard shortcuts" tabindex="-1">
+            <span class="fab-toggle-icon">⌨</span>
+          </button>
+
+          <!-- Left scroll indicator -->
+          <button class="fab-scroll fab-scroll-left hidden" id="fabScrollLeft" aria-label="Scroll left" tabindex="-1">
+            <span>‹</span>
+          </button>
+
+          <!-- Scrollable button strip -->
+          <div class="fab-strip" id="fabStrip">
+            <!-- Control group (scroll left to reveal) -->
+            <button class="fab-btn" data-keys="ctrl+l" title="Clear screen" tabindex="-1">^L</button>
+            <button class="fab-btn" data-keys="ctrl+d" title="EOF/Exit" tabindex="-1">^D</button>
+            <button class="fab-btn" data-keys="ctrl+c" title="Interrupt" tabindex="-1">^C</button>
+
+            <!-- Primary group (default visible - AI CLI essentials) -->
+            <button class="fab-btn fab-primary" data-keys="shift+tab" title="Mode: Normal → Auto → Plan" tabindex="-1">⇧Tab</button>
+            <button class="fab-btn" data-keys="tab" title="Autocomplete / Thinking" tabindex="-1">Tab</button>
+            <button class="fab-btn" data-keys="up" data-repeat="true" title="History up" tabindex="-1">↑</button>
+            <button class="fab-btn" data-keys="down" data-repeat="true" title="History down" tabindex="-1">↓</button>
+            <button class="fab-btn" data-keys="escape" title="Cancel / Rewind (2x)" tabindex="-1">Esc</button>
+            <button class="fab-btn fab-primary" data-keys="enter" title="Enter / Confirm" tabindex="-1">⏎</button>
+
+            <!-- Navigation group (scroll right to reveal) -->
+            <button class="fab-btn" data-keys="left" title="Cursor left" tabindex="-1">←</button>
+            <button class="fab-btn" data-keys="right" title="Cursor right" tabindex="-1">→</button>
+            <button class="fab-btn" data-keys="alt+enter" title="Newline without submit" tabindex="-1">⏎+</button>
+            <button class="fab-btn" id="fabPaste" title="Paste from clipboard" tabindex="-1">📋</button>
+          </div>
+
+          <!-- Right scroll indicator -->
+          <button class="fab-scroll fab-scroll-right" id="fabScrollRight" aria-label="Scroll right" tabindex="-1">
+            <span>›</span>
+          </button>
+        </div>
     </div>
 
     <!-- Help Modal (Dark Kraken Style) -->
@@ -783,6 +830,7 @@
         }
     </script>
 
+    <script src="/app/config.js"></script>
     <script src="/app/terminal.js?v=1.5.94"></script>
   </body>
 </html>