termbeam 1.22.3 → 1.22.4

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.22.4] - 2026-04-26
+
+- perf(test): parallelize e2e suite via shared server + workers (#214) (@dorlugasigal)
+- fix(security): add inline path validation guards for CodeQL (#216) (@dorlugasigal)
+- fix(deps): update vulnerable dependencies and pin Docker image (#218) (@dorlugasigal)
+- refactor(site): clean up landing page design and optimize CI (#220) (@dorlugasigal)
+
 ## [1.22.3] - 2026-04-26
 
 - fix(site): auto-detect Cloudflare Pages build target (@dorlugasigal)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "termbeam",
-  "version": "1.22.3",
+  "version": "1.22.4",
   "description": "Beam your terminal to any device — mobile-optimized web terminal with multi-session support",
   "main": "src/server/index.js",
   "bin": {

package/src/cli/resume.js

@@ -6,15 +6,22 @@ const log = require('../utils/logger');
 const { createTerminalClient } = require('./client');
 const { bold, dim, red, yellow, choose, createRL, ask } = require('./prompts');
 
-const CONFIG_DIR = process.env.TERMBEAM_CONFIG_DIR || path.join(os.homedir(), '.termbeam');
-const CONNECTION_FILE = path.join(CONFIG_DIR, 'connection.json');
+// Resolve config paths at call time so that tests (and other code paths) which
+// set TERMBEAM_CONFIG_DIR after this module is first required still take effect.
+function getConfigDir() {
+  return process.env.TERMBEAM_CONFIG_DIR || path.join(os.homedir(), '.termbeam');
+}
+
+function getConnectionFile() {
+  return path.join(getConfigDir(), 'connection.json');
+}
 
 // ── Connection config ────────────────────────────────────────────────────────
 
 function readConnectionConfig() {
   log.debug('Reading connection config');
   try {
-    return JSON.parse(fs.readFileSync(CONNECTION_FILE, 'utf8'));
+    return JSON.parse(fs.readFileSync(getConnectionFile(), 'utf8'));
   } catch {
     return null;
   }
@@ -22,14 +29,15 @@ function readConnectionConfig() {
 
 function writeConnectionConfig({ port, host, password }) {
   log.debug('Writing connection config');
-  fs.mkdirSync(CONFIG_DIR, { recursive: true });
-  fs.writeFileSync(CONNECTION_FILE, JSON.stringify({ port, host, password }, null, 2) + '\n', {
+  const connectionFile = getConnectionFile();
+  fs.mkdirSync(getConfigDir(), { recursive: true });
+  fs.writeFileSync(connectionFile, JSON.stringify({ port, host, password }, null, 2) + '\n', {
     mode: 0o600,
   });
   // Ensure restrictive permissions even if the file already existed
   if (process.platform !== 'win32') {
     try {
-      fs.chmodSync(CONNECTION_FILE, 0o600);
+      fs.chmodSync(connectionFile, 0o600);
     } catch {
       /* best-effort */
     }
@@ -39,7 +47,7 @@ function writeConnectionConfig({ port, host, password }) {
 function removeConnectionConfig() {
   log.debug('Removing connection config');
   try {
-    fs.unlinkSync(CONNECTION_FILE);
+    fs.unlinkSync(getConnectionFile());
   } catch {
     /* ignore */
   }
@@ -402,6 +410,12 @@ module.exports = {
   readConnectionConfig,
   printResumeHelp,
   parseDetachKey,
-  CONFIG_DIR,
-  CONNECTION_FILE,
+  // Lazy getters so tests reading these after setting TERMBEAM_CONFIG_DIR see
+  // the current value, not the value at module load time.
+  get CONFIG_DIR() {
+    return getConfigDir();
+  },
+  get CONNECTION_FILE() {
+    return getConnectionFile();
+  },
 };

package/src/server/routes.js

@@ -98,23 +98,28 @@ function validateMagicBytes(buffer, contentType) {
 }
 
 function setupRoutes(app, { auth, sessions, config, state, pushManager, copilotService }) {
-  const pageRateLimit = rateLimit({
-    windowMs: 1 * 60 * 1000,
-    max: 120,
-    standardHeaders: true,
-    legacyHeaders: false,
-    handler: (_req, res) =>
-      res.status(429).json({ error: 'Too many requests, please try again later.' }),
-  });
+  const noopLimit = (_req, _res, next) => next();
+  const pageRateLimit = config.disableRateLimit
+    ? noopLimit
+    : rateLimit({
+        windowMs: 1 * 60 * 1000,
+        max: 120,
+        standardHeaders: true,
+        legacyHeaders: false,
+        handler: (_req, res) =>
+          res.status(429).json({ error: 'Too many requests, please try again later.' }),
+      });
 
-  const apiRateLimit = rateLimit({
-    windowMs: 1 * 60 * 1000,
-    max: 120,
-    standardHeaders: true,
-    legacyHeaders: false,
-    handler: (_req, res) =>
-      res.status(429).json({ error: 'Too many requests, please try again later.' }),
-  });
+  const apiRateLimit = config.disableRateLimit
+    ? noopLimit
+    : rateLimit({
+        windowMs: 1 * 60 * 1000,
+        max: 120,
+        standardHeaders: true,
+        legacyHeaders: false,
+        handler: (_req, res) =>
+          res.status(429).json({ error: 'Too many requests, please try again later.' }),
+      });
 
   // Serve static files — sw.js must never be cached by the browser
   app.get('/sw.js', (_req, res, next) => {
@@ -860,7 +865,7 @@ function setupRoutes(app, { auth, sessions, config, state, pushManager, copilotS
 
     const rootDir = path.resolve(sessions.getSessionCwd(req.params.id));
     const dir = safePath(rootDir, req.query.dir || '.');
-    if (!dir) {
+    if (!dir || (dir !== rootDir && !dir.startsWith(rootDir + path.sep))) {
       return res.status(403).json({ error: 'Path is outside session directory' });
     }
 
@@ -930,7 +935,7 @@ function setupRoutes(app, { auth, sessions, config, state, pushManager, copilotS
     let startDir = rootDir;
     if (typeof req.query.path === 'string' && req.query.path.length > 0) {
       const resolved = safePath(rootDir, req.query.path);
-      if (!resolved) {
+      if (!resolved || (resolved !== rootDir && !resolved.startsWith(rootDir + path.sep))) {
         return res.status(403).json({ error: 'Path is outside session directory' });
       }
       try {
@@ -1040,7 +1045,7 @@ function setupRoutes(app, { auth, sessions, config, state, pushManager, copilotS
 
     const rootDir = path.resolve(sessions.getSessionCwd(req.params.id));
     const filePath = safePath(rootDir, file);
-    if (!filePath) {
+    if (!filePath || (filePath !== rootDir && !filePath.startsWith(rootDir + path.sep))) {
       return res.status(403).json({ error: 'Path is outside session directory' });
     }
 
@@ -1074,7 +1079,7 @@ function setupRoutes(app, { auth, sessions, config, state, pushManager, copilotS
 
     const rootDir = path.resolve(sessions.getSessionCwd(req.params.id));
     const filePath = safePath(rootDir, file);
-    if (!filePath) {
+    if (!filePath || (filePath !== rootDir && !filePath.startsWith(rootDir + path.sep))) {
       return res.status(403).json({ error: 'Path is outside session directory' });
     }
 
@@ -1108,7 +1113,7 @@ function setupRoutes(app, { auth, sessions, config, state, pushManager, copilotS
 
     const rootDir = path.resolve(sessions.getSessionCwd(req.params.id));
     const filePath = safePath(rootDir, file);
-    if (!filePath) {
+    if (!filePath || (filePath !== rootDir && !filePath.startsWith(rootDir + path.sep))) {
       return res.status(403).json({ error: 'Path is outside session directory' });
     }