termbeam 1.10.0 → 1.10.1

package/README.md

@@ -109,6 +109,7 @@ flowchart LR
 | `--port <port>`       | Server port                                     | `3456`         |
 | `--host <addr>`       | Bind address                                    | `127.0.0.1`    |
 | `--lan`               | Bind to all interfaces (LAN access)             | Off            |
+| `--public`            | Allow public tunnel access (no Microsoft login) | Off            |
 | `-i, --interactive`   | Interactive setup wizard                        | Off            |
 | `--log-level <level>` | Log verbosity (error/warn/info/debug)           | `info`         |
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "termbeam",
-  "version": "1.10.0",
+  "version": "1.10.1",
   "description": "Beam your terminal to any device — mobile-optimized web terminal with multi-session support",
   "main": "src/server.js",
   "bin": {

package/public/index.html

@@ -991,17 +991,22 @@
       }
 
       async function loadSessions() {
-        const res = await fetch('/api/sessions');
-        const sessions = await res.json();
+        try {
+          const res = await fetch('/api/sessions');
+          if (!res.ok) {
+            console.error(`Failed to load sessions: ${res.status}`);
+            return;
+          }
+          const sessions = await res.json();
 
-        if (sessions.length === 0) {
-          listEl.innerHTML = '<div class="empty-state">No active sessions</div>';
-          return;
-        }
+          if (sessions.length === 0) {
+            listEl.innerHTML = '<div class="empty-state">No active sessions</div>';
+            return;
+          }
 
-        listEl.innerHTML = sessions
-          .map(
-            (s) => `
+          listEl.innerHTML = sessions
+            .map(
+              (s) => `
         <div class="swipe-wrap" data-session-id="${esc(s.id)}">
           <div class="swipe-delete">
             <button data-delete-id="${esc(s.id)}"><svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="3 6 5 6 21 6"/><path d="M19 6l-1 14a2 2 0 0 1-2 2H8a2 2 0 0 1-2-2L5 6"/><path d="M10 11v6"/><path d="M14 11v6"/><path d="M9 6V4a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v2"/></svg><span>Delete</span></button>
@@ -1031,22 +1036,25 @@
           </div>
         </div>
       `,
-          )
-          .join('');
+            )
+            .join('');
 
-        // Attach swipe handlers and click handlers after rendering
-        listEl.querySelectorAll('.swipe-wrap').forEach(initSwipe);
-        listEl.querySelectorAll('[data-delete-id]').forEach((btn) => {
-          btn.addEventListener('click', (e) => deleteSession(btn.dataset.deleteId, e));
-        });
-        listEl.querySelectorAll('[data-nav-id]').forEach((card) => {
-          card.addEventListener('click', () => {
-            location.href = '/terminal?id=' + encodeURIComponent(card.dataset.navId);
+          // Attach swipe handlers and click handlers after rendering
+          listEl.querySelectorAll('.swipe-wrap').forEach(initSwipe);
+          listEl.querySelectorAll('[data-delete-id]').forEach((btn) => {
+            btn.addEventListener('click', (e) => deleteSession(btn.dataset.deleteId, e));
           });
-        });
-        listEl.querySelectorAll('.dot[data-color]').forEach((dot) => {
-          dot.style.background = dot.dataset.color || 'var(--success)';
-        });
+          listEl.querySelectorAll('[data-nav-id]').forEach((card) => {
+            card.addEventListener('click', () => {
+              location.href = '/terminal?id=' + encodeURIComponent(card.dataset.navId);
+            });
+          });
+          listEl.querySelectorAll('.dot[data-color]').forEach((dot) => {
+            dot.style.background = dot.dataset.color || 'var(--success)';
+          });
+        } catch (err) {
+          console.error('Failed to load sessions:', err);
+        }
       }
 
       document.getElementById('new-session-btn').addEventListener('click', () => {
@@ -1085,13 +1093,21 @@
         if (initialCommand) body.initialCommand = initialCommand;
         if (color) body.color = color;
 
-        const res = await fetch('/api/sessions', {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify(body),
-        });
-        const data = await res.json();
-        location.href = data.url;
+        try {
+          const res = await fetch('/api/sessions', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(body),
+          });
+          if (!res.ok) {
+            console.error(`Failed to create session: ${res.status}`);
+            return;
+          }
+          const data = await res.json();
+          location.href = data.url;
+        } catch (err) {
+          console.error('Failed to create session:', err);
+        }
       });
 
       // --- Shell detection ---
@@ -1101,6 +1117,7 @@
         const shellSelect = document.getElementById('sess-shell');
         try {
           const res = await fetch('/api/shells');
+          if (!res.ok) throw new Error(`Failed to load shells: ${res.status}`);
           const data = await res.json();
           if (data.cwd) {
             document.getElementById('sess-cwd').placeholder = data.cwd;
@@ -1225,7 +1242,10 @@
       document.getElementById('browse-btn').addEventListener('click', async () => {
         if (hubServerCwd === '/') {
           try {
-            const data = await fetch('/api/shells').then((r) => r.json());
+            const data = await fetch('/api/shells').then((r) => {
+              if (!r.ok) throw new Error(`${r.status}`);
+              return r.json();
+            });
             if (data.cwd) hubServerCwd = data.cwd;
           } catch {}
         }
@@ -1254,6 +1274,7 @@
 
         try {
           const res = await fetch(`/api/dirs?q=${encodeURIComponent(dir + '/')}`);
+          if (!res.ok) throw new Error(`Failed to load directories: ${res.status}`);
           const data = await res.json();
           let items = '';
           // Add parent (..) entry unless at root
@@ -1310,7 +1331,10 @@
 
       // Fetch version
       fetch('/api/version')
-        .then((r) => r.json())
+        .then((r) => {
+          if (!r.ok) throw new Error(`${r.status}`);
+          return r.json();
+        })
         .then((d) => {
           document.getElementById('version').textContent = 'v' + d.version;
         })

package/public/terminal.html

@@ -2476,7 +2476,14 @@
 
       // ===== Init =====
       async function init() {
-        const sessionList = await fetch('/api/sessions').then((r) => r.json());
+        let sessionList = [];
+        try {
+          const res = await fetch('/api/sessions');
+          if (!res.ok) throw new Error(`${res.status}`);
+          sessionList = await res.json();
+        } catch (err) {
+          console.error('Failed to load sessions:', err);
+        }
         const initialId = new URLSearchParams(location.search).get('id');
 
         for (const s of sessionList) addSession(s);
@@ -2678,7 +2685,10 @@
 
         // Version
         fetch('/api/version')
-          .then((r) => r.json())
+          .then((r) => {
+            if (!r.ok) throw new Error(`${r.status}`);
+            return r.json();
+          })
           .then((d) => {
             window._termbeamVersion = 'v' + d.version;
             document.getElementById('side-panel-version').textContent = 'v' + d.version;
@@ -3884,6 +3894,7 @@
             const res = await fetch('/api/dirs?q=' + encodeURIComponent(q ? q + '/' : ''), {
               credentials: 'same-origin',
             });
+            if (!res.ok) throw new Error(`Failed to browse directories: ${res.status}`);
             const data = await res.json();
             if (!data.dirs || !data.dirs.length) return;
             browseDropdown = document.createElement('div');
@@ -3997,7 +4008,10 @@
         document.getElementById('ns-browse-btn').addEventListener('click', async () => {
           if (serverCwd === '/') {
             try {
-              const data = await fetch('/api/shells').then((r) => r.json());
+              const data = await fetch('/api/shells').then((r) => {
+                if (!r.ok) throw new Error(`${r.status}`);
+                return r.json();
+              });
               if (data.cwd) serverCwd = data.cwd;
             } catch {}
           }
@@ -4025,6 +4039,7 @@
           nsBrowserList.innerHTML = '<div class="browser-empty">Loading…</div>';
           try {
             const res = await fetch(`/api/dirs?q=${encodeURIComponent(dir + '/')}`);
+            if (!res.ok) throw new Error(`Failed to load directories: ${res.status}`);
             const data = await res.json();
             let items = '';
             // Add parent (..) entry unless at root
@@ -4082,7 +4097,10 @@
         if (shellsLoaded) return;
         const sel = document.getElementById('ns-shell');
         try {
-          const data = await fetch('/api/shells').then((r) => r.json());
+          const data = await fetch('/api/shells').then((r) => {
+            if (!r.ok) throw new Error(`${r.status}`);
+            return r.json();
+          });
           if (data.cwd) {
             serverCwd = data.cwd;
             document.getElementById('ns-cwd').placeholder = data.cwd;
@@ -4140,10 +4158,16 @@
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify(body),
           });
+          if (!res.ok) {
+            console.error(`Failed to create session: ${res.status}`);
+            return;
+          }
           const data = await res.json();
 
           // Fetch full session list to get the new session data
-          const list = await fetch('/api/sessions').then((r) => r.json());
+          const listRes = await fetch('/api/sessions');
+          if (!listRes.ok) throw new Error(`Failed to list sessions: ${listRes.status}`);
+          const list = await listRes.json();
           const newSession = list.find((s) => s.id === data.id);
           if (newSession) {
             addSession(newSession);
@@ -4163,7 +4187,9 @@
       function startPolling() {
         setInterval(async () => {
           try {
-            const list = await fetch('/api/sessions').then((r) => r.json());
+            const pollRes = await fetch('/api/sessions');
+            if (!pollRes.ok) throw new Error(`${pollRes.status}`);
+            const list = await pollRes.json();
             const serverIds = new Set(list.map((s) => s.id));
 
             // Add new sessions created elsewhere

package/src/auth.js

@@ -177,7 +177,7 @@ function createAuth(password) {
   const shareTokens = new Map(); // share tokens: token -> expiry
 
   // Periodically clean up expired tokens and stale rate-limit entries
-  setInterval(
+  const cleanupInterval = setInterval(
     () => {
       const now = Date.now();
       for (const [token, expiry] of tokens) {
@@ -296,6 +296,7 @@ function createAuth(password) {
     rateLimit,
     parseCookies,
     loginHTML: LOGIN_HTML,
+    cleanup: () => clearInterval(cleanupInterval),
   };
 }
 

package/src/cli.js

@@ -270,6 +270,10 @@ function parseArgs() {
       publicTunnel = true;
     } else if (args[i].startsWith('--password=')) {
       password = args[i].split('=')[1];
+      if (!password) {
+        console.error('Error: --password= requires a non-empty value\n');
+        process.exit(1);
+      }
       explicitPassword = true;
     } else if (args[i] === '--help' || args[i] === '-h') {
       printHelp();
@@ -286,6 +290,10 @@ function parseArgs() {
       explicitPassword = true;
     } else if (args[i] === '--port' && args[i + 1]) {
       port = parseInt(args[++i], 10);
+      if (!Number.isFinite(port) || port < 1 || port > 65535) {
+        console.error('Error: --port must be a number between 1 and 65535\n');
+        process.exit(1);
+      }
     } else if (args[i] === '--lan') {
       host = '0.0.0.0';
     } else if (args[i] === '--host' && args[i + 1]) {
@@ -307,6 +315,12 @@ function parseArgs() {
     }
   }
 
+  const validLogLevels = ['error', 'warn', 'info', 'debug'];
+  if (!validLogLevels.includes(logLevel)) {
+    console.error(`Error: --log-level must be one of: ${validLogLevels.join(', ')}\n`);
+    process.exit(1);
+  }
+
   // Default: auto-generate password if none specified
   if (!explicitPassword && !password) {
     password = crypto.randomBytes(16).toString('base64url');

package/src/client.js

@@ -80,7 +80,7 @@ function createTerminalClient({
       try {
         msg = JSON.parse(raw);
       } catch {
-        return;
+        return; // Silently drop unparseable messages from server
       }
 
       if (msg.type === 'auth_ok') {

package/src/preview.js

@@ -96,7 +96,7 @@ function createPreviewProxy() {
     proxyReq.on('error', (err) => {
       log.warn(`Preview proxy error (port ${port}): ${err.message}`);
       if (!res.headersSent) {
-        res.status(502).json({ error: `Bad gateway: ${err.message}` });
+        res.status(502).json({ error: 'Bad gateway: upstream server is not responding' });
       }
     });
 

package/src/routes.js

@@ -185,9 +185,10 @@ function setupRoutes(app, { auth, sessions, config, state }) {
         rows: typeof rows === 'number' && rows > 0 && rows <= 200 ? Math.floor(rows) : undefined,
       });
     } catch (err) {
-      return res.status(400).json({ error: err.message || 'Failed to create session' });
+      log.warn(`Session creation failed: ${err.message}`);
+      return res.status(400).json({ error: 'Failed to create session' });
     }
-    res.json({ id, url: `/terminal?id=${id}` });
+    res.status(201).json({ id, url: `/terminal?id=${id}` });
   });
 
   // Available shells
@@ -220,7 +221,7 @@ function setupRoutes(app, { auth, sessions, config, state }) {
 
   app.delete('/api/sessions/:id', auth.middleware, (req, res) => {
     if (sessions.delete(req.params.id)) {
-      res.json({ ok: true });
+      res.status(204).end();
     } else {
       res.status(404).json({ error: 'not found' });
     }
@@ -288,7 +289,7 @@ function setupRoutes(app, { auth, sessions, config, state }) {
       fs.writeFileSync(filepath, buffer);
       uploadedFiles.set(id, filepath);
       log.info(`Upload: ${filename} (${buffer.length} bytes)`);
-      res.json({ id, url: `/uploads/${id}`, path: filepath });
+      res.status(201).json({ id, url: `/uploads/${id}`, path: filepath });
     });
 
     req.on('error', (err) => {
@@ -405,7 +406,7 @@ function setupRoutes(app, { auth, sessions, config, state }) {
       }
       const finalName = path.basename(destPath);
       log.info(`File upload: ${finalName} → ${targetDir} (${buffer.length} bytes)`);
-      res.json({ name: finalName, path: destPath, size: buffer.length });
+      res.status(201).json({ name: finalName, path: destPath, size: buffer.length });
     });
 
     req.on('error', (err) => {

package/src/server.js

@@ -83,10 +83,14 @@ function createTermBeamServer(overrides = {}) {
   function shutdown() {
     if (shuttingDown) return;
     shuttingDown = true;
+    auth.cleanup();
     sessions.shutdown();
     cleanupUploadedFiles();
     cleanupTunnel();
     removeConnectionConfig();
+    for (const client of wss.clients) {
+      client.close(1001, 'Server shutting down');
+    }
     server.close();
     wss.close();
   }

package/src/sessions.js

@@ -1,30 +1,10 @@
 const crypto = require('crypto');
 const path = require('path');
-const { execSync, exec } = require('child_process');
-const fs = require('fs');
+const { exec } = require('child_process');
 const pty = require('node-pty');
 const log = require('./logger');
 const { getGitInfo } = require('./git');
 
-function _getProcessCwd(pid) {
-  try {
-    if (process.platform === 'linux') {
-      return fs.readlinkSync(`/proc/${pid}/cwd`);
-    }
-    if (process.platform === 'darwin') {
-      const out = execSync(`lsof -a -p ${pid} -d cwd -Fn`, {
-        stdio: 'pipe',
-        timeout: 2000,
-      }).toString();
-      const match = out.match(/\nn(.+)/);
-      if (match) return match[1];
-    }
-  } catch {
-    /* process may have exited */
-  }
-  return null;
-}
-
 // Cache git info per session to avoid blocking the event loop on every list() call.
 // lsof + git commands take ~200-500ms and block WebSocket traffic, causing
 // xterm.js cursor position report responses to leak as visible text.
@@ -69,6 +49,7 @@ function scheduleGitRefresh(sessionId, pid, originalCwd) {
   }
 
   exec(cmd, { timeout: 2000 }, (err, stdout) => {
+    if (err) log.debug(`Git cwd detection failed: ${err.message}`);
     let liveCwd = originalCwd;
     if (!err && stdout) {
       if (process.platform === 'darwin') {

package/src/tunnel.js

@@ -67,21 +67,6 @@ function savePersistedTunnel(id) {
   );
 }
 
-function _deletePersisted() {
-  const persisted = loadPersistedTunnel();
-  if (persisted) {
-    try {
-      if (SAFE_ID_RE.test(persisted.tunnelId)) {
-        execFileSync(devtunnelCmd, ['delete', persisted.tunnelId, '-f'], { stdio: 'pipe' });
-        log.info(`Deleted persisted tunnel ${persisted.tunnelId}`);
-      }
-    } catch {}
-    try {
-      fs.unlinkSync(TUNNEL_CONFIG_PATH);
-    } catch {}
-  }
-}
-
 function isTunnelValid(id) {
   try {
     if (!SAFE_ID_RE.test(id)) return false;

package/src/websocket.js

@@ -17,6 +17,10 @@ function recalcPtySize(session) {
 }
 
 function setupWebSocket(wss, { auth, sessions }) {
+  const wsAuthAttempts = new Map(); // ip -> [timestamps]
+  const WS_AUTH_WINDOW = 60 * 1000; // 1 minute
+  const WS_MAX_AUTH_ATTEMPTS = 5;
+
   wss.on('connection', (ws, req) => {
     const origin = req.headers.origin;
     if (origin) {
@@ -51,11 +55,26 @@ function setupWebSocket(wss, { auth, sessions }) {
         const msg = JSON.parse(raw);
 
         if (msg.type === 'auth') {
+          const ip = req.socket.remoteAddress;
+          const now = Date.now();
+          const attempts = (wsAuthAttempts.get(ip) || []).filter((t) => now - t < WS_AUTH_WINDOW);
+
+          if (attempts.length >= WS_MAX_AUTH_ATTEMPTS) {
+            log.warn(`WS: rate limit exceeded for ${ip}`);
+            ws.send(
+              JSON.stringify({ type: 'error', message: 'Too many attempts. Try again later.' }),
+            );
+            ws.close();
+            return;
+          }
+
           if (msg.password === auth.password || auth.validateToken(msg.token)) {
             authenticated = true;
             ws.send(JSON.stringify({ type: 'auth_ok' }));
             log.info('WS: auth success');
           } else {
+            attempts.push(now);
+            wsAuthAttempts.set(ip, attempts);
             log.warn('WS: auth failed');
             ws.send(JSON.stringify({ type: 'error', message: 'Unauthorized' }));
             ws.close();