termbeam 1.8.0 → 1.9.0

package/src/service.js

@@ -1,4 +1,4 @@
-const { execFileSync, execFile } = require('child_process');
+const { execFileSync } = require('child_process');
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
@@ -237,7 +237,7 @@ async function actionInstall() {
   ]);
   if (pwChoice.index === 0) {
     config.password = crypto.randomBytes(16).toString('base64url');
-    console.log(dim(`  Generated password: ${config.password}`));
+    process.stdout.write(dim(`  Generated password: ${config.password}`) + '\n');
   } else if (pwChoice.index === 1) {
     config.password = await ask(rl, 'Enter password:');
     while (!config.password) {
@@ -297,7 +297,7 @@ async function actionInstall() {
     if (config.publicTunnel && config.password === false) {
       console.log(yellow('  ⚠ Public tunnels require password authentication.'));
       config.password = crypto.randomBytes(16).toString('base64url');
-      console.log(dim(`  Auto-generated password: ${config.password}`));
+      process.stdout.write(dim(`  Auto-generated password: ${config.password}`) + '\n');
     }
   } else if (accessChoice.index === 1) {
     // LAN mode: bind to all interfaces, no tunnel
@@ -352,7 +352,7 @@ async function actionInstall() {
   console.log(bold('\n── Configuration Summary ──────────────────'));
   console.log(`  Service name:  ${cyan(config.name)}`);
   console.log(
-    `  Password:      ${config.password === false ? yellow('disabled') : cyan(config.password)}`,
+    `  Password:      ${config.password === false ? yellow('disabled') : cyan('••••••••')}`,
   );
   console.log(`  Port:          ${cyan(String(config.port))}`);
   console.log(

package/src/sessions.js

@@ -1,11 +1,12 @@
 const crypto = require('crypto');
+const path = require('path');
 const { execSync, exec } = require('child_process');
 const fs = require('fs');
 const pty = require('node-pty');
 const log = require('./logger');
 const { getGitInfo } = require('./git');
 
-function getProcessCwd(pid) {
+function _getProcessCwd(pid) {
   try {
     if (process.platform === 'linux') {
       return fs.readlinkSync(`/proc/${pid}/cwd`);
@@ -108,6 +109,24 @@ class SessionManager {
     cols = 120,
     rows = 30,
   }) {
+    // Defense-in-depth: reject shells with dangerous characters or relative paths
+    if (
+      typeof shell !== 'string' ||
+      !shell ||
+      /[;&|`$(){}\[\]!#~]/.test(shell) ||
+      (!path.isAbsolute(shell) && !shell.match(/^[a-zA-Z0-9._-]+(\.exe)?$/))
+    ) {
+      throw new Error('Invalid shell');
+    }
+
+    // Defense-in-depth: validate args and initialCommand types
+    if (!Array.isArray(args) || !args.every((a) => typeof a === 'string')) {
+      throw new Error('args must be an array of strings');
+    }
+    if (initialCommand !== null && typeof initialCommand !== 'string') {
+      throw new Error('initialCommand must be a string');
+    }
+
     const id = crypto.randomBytes(16).toString('hex');
     if (!color) {
       color = SESSION_COLORS[this.sessions.size % SESSION_COLORS.length];
@@ -117,7 +136,7 @@ class SessionManager {
       cols,
       rows,
       cwd,
-      env: { ...process.env, TERM: 'xterm-256color' },
+      env: { ...process.env, TERM: 'xterm-256color', TERMBEAM_SESSION: '1' },
     });
 
     // Send initial command once the shell is ready
@@ -209,7 +228,7 @@ class SessionManager {
   }
 
   shutdown() {
-    for (const [id, s] of this.sessions) {
+    for (const [_id, s] of this.sessions) {
       try {
         s.pty.kill();
       } catch {

package/src/tunnel.js

@@ -67,7 +67,7 @@ function savePersistedTunnel(id) {
   );
 }
 
-function deletePersisted() {
+function _deletePersisted() {
   const persisted = loadPersistedTunnel();
   if (persisted) {
     try {
@@ -139,7 +139,7 @@ async function startTunnel(port, options = {}) {
         log.info('A code will be displayed — open the URL on any device to authenticate.');
         try {
           execFileSync(devtunnelCmd, ['user', 'login', '-d'], { stdio: 'inherit' });
-        } catch (loginErr) {
+        } catch (_loginErr) {
           log.error('');
           log.error('  DevTunnel login failed. To use tunnels, run:');
           log.error('    devtunnel user login');