termbeam 1.9.0 → 1.10.1

package/README.md

@@ -72,6 +72,7 @@ termbeam -i                     # interactive setup wizard
 
 - **Terminal search** with regex, match count, and prev/next navigation
 - **Command palette** (Ctrl+K / Cmd+K) for quick access to all actions
+- **File upload** — send files from your phone to the session's working directory
 - **Completion notifications** — browser alerts when background commands finish
 - **12 color themes** with adjustable font size
 - **Port preview** — reverse-proxy a local web server through TermBeam
@@ -108,6 +109,7 @@ flowchart LR
 | `--port <port>`       | Server port                                     | `3456`         |
 | `--host <addr>`       | Bind address                                    | `127.0.0.1`    |
 | `--lan`               | Bind to all interfaces (LAN access)             | Off            |
+| `--public`            | Allow public tunnel access (no Microsoft login) | Off            |
 | `-i, --interactive`   | Interactive setup wizard                        | Off            |
 | `--log-level <level>` | Log verbosity (error/warn/info/debug)           | `info`         |
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "termbeam",
-  "version": "1.9.0",
+  "version": "1.10.1",
   "description": "Beam your terminal to any device — mobile-optimized web terminal with multi-session support",
   "main": "src/server.js",
   "bin": {

package/public/index.html

@@ -991,17 +991,22 @@
       }
 
       async function loadSessions() {
-        const res = await fetch('/api/sessions');
-        const sessions = await res.json();
+        try {
+          const res = await fetch('/api/sessions');
+          if (!res.ok) {
+            console.error(`Failed to load sessions: ${res.status}`);
+            return;
+          }
+          const sessions = await res.json();
 
-        if (sessions.length === 0) {
-          listEl.innerHTML = '<div class="empty-state">No active sessions</div>';
-          return;
-        }
+          if (sessions.length === 0) {
+            listEl.innerHTML = '<div class="empty-state">No active sessions</div>';
+            return;
+          }
 
-        listEl.innerHTML = sessions
-          .map(
-            (s) => `
+          listEl.innerHTML = sessions
+            .map(
+              (s) => `
         <div class="swipe-wrap" data-session-id="${esc(s.id)}">
           <div class="swipe-delete">
             <button data-delete-id="${esc(s.id)}"><svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><polyline points="3 6 5 6 21 6"/><path d="M19 6l-1 14a2 2 0 0 1-2 2H8a2 2 0 0 1-2-2L5 6"/><path d="M10 11v6"/><path d="M14 11v6"/><path d="M9 6V4a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v2"/></svg><span>Delete</span></button>
@@ -1031,22 +1036,25 @@
           </div>
         </div>
       `,
-          )
-          .join('');
+            )
+            .join('');
 
-        // Attach swipe handlers and click handlers after rendering
-        listEl.querySelectorAll('.swipe-wrap').forEach(initSwipe);
-        listEl.querySelectorAll('[data-delete-id]').forEach((btn) => {
-          btn.addEventListener('click', (e) => deleteSession(btn.dataset.deleteId, e));
-        });
-        listEl.querySelectorAll('[data-nav-id]').forEach((card) => {
-          card.addEventListener('click', () => {
-            location.href = '/terminal?id=' + encodeURIComponent(card.dataset.navId);
+          // Attach swipe handlers and click handlers after rendering
+          listEl.querySelectorAll('.swipe-wrap').forEach(initSwipe);
+          listEl.querySelectorAll('[data-delete-id]').forEach((btn) => {
+            btn.addEventListener('click', (e) => deleteSession(btn.dataset.deleteId, e));
           });
-        });
-        listEl.querySelectorAll('.dot[data-color]').forEach((dot) => {
-          dot.style.background = dot.dataset.color || 'var(--success)';
-        });
+          listEl.querySelectorAll('[data-nav-id]').forEach((card) => {
+            card.addEventListener('click', () => {
+              location.href = '/terminal?id=' + encodeURIComponent(card.dataset.navId);
+            });
+          });
+          listEl.querySelectorAll('.dot[data-color]').forEach((dot) => {
+            dot.style.background = dot.dataset.color || 'var(--success)';
+          });
+        } catch (err) {
+          console.error('Failed to load sessions:', err);
+        }
       }
 
       document.getElementById('new-session-btn').addEventListener('click', () => {
@@ -1085,13 +1093,21 @@
         if (initialCommand) body.initialCommand = initialCommand;
         if (color) body.color = color;
 
-        const res = await fetch('/api/sessions', {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify(body),
-        });
-        const data = await res.json();
-        location.href = data.url;
+        try {
+          const res = await fetch('/api/sessions', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(body),
+          });
+          if (!res.ok) {
+            console.error(`Failed to create session: ${res.status}`);
+            return;
+          }
+          const data = await res.json();
+          location.href = data.url;
+        } catch (err) {
+          console.error('Failed to create session:', err);
+        }
       });
 
       // --- Shell detection ---
@@ -1101,6 +1117,7 @@
         const shellSelect = document.getElementById('sess-shell');
         try {
           const res = await fetch('/api/shells');
+          if (!res.ok) throw new Error(`Failed to load shells: ${res.status}`);
           const data = await res.json();
           if (data.cwd) {
             document.getElementById('sess-cwd').placeholder = data.cwd;
@@ -1225,7 +1242,10 @@
       document.getElementById('browse-btn').addEventListener('click', async () => {
         if (hubServerCwd === '/') {
           try {
-            const data = await fetch('/api/shells').then((r) => r.json());
+            const data = await fetch('/api/shells').then((r) => {
+              if (!r.ok) throw new Error(`${r.status}`);
+              return r.json();
+            });
             if (data.cwd) hubServerCwd = data.cwd;
           } catch {}
         }
@@ -1254,6 +1274,7 @@
 
         try {
           const res = await fetch(`/api/dirs?q=${encodeURIComponent(dir + '/')}`);
+          if (!res.ok) throw new Error(`Failed to load directories: ${res.status}`);
           const data = await res.json();
           let items = '';
           // Add parent (..) entry unless at root
@@ -1310,7 +1331,10 @@
 
       // Fetch version
       fetch('/api/version')
-        .then((r) => r.json())
+        .then((r) => {
+          if (!r.ok) throw new Error(`${r.status}`);
+          return r.json();
+        })
         .then((d) => {
           document.getElementById('version').textContent = 'v' + d.version;
         })

package/public/terminal.html

@@ -1165,6 +1165,9 @@
         max-height: 90vh;
         overflow-y: auto;
       }
+      #upload-modal .modal {
+        overflow: visible;
+      }
       .modal h2 {
         font-size: 18px;
         margin-bottom: 16px;
@@ -1982,6 +1985,53 @@
         <button class="key-btn icon-btn" data-key="&#x1b;[C" title="Right">→</button>
       </div>
     </div>
+    <input type="file" id="upload-input" multiple hidden />
+
+    <!-- Upload Confirm Modal -->
+    <div class="modal-overlay" id="upload-modal">
+      <div class="modal">
+        <h2>Upload Files</h2>
+        <div
+          id="upload-file-list"
+          style="
+            margin-bottom: 12px;
+            font-size: 13px;
+            color: var(--text-secondary);
+            max-height: 120px;
+            overflow-y: auto;
+          "
+        ></div>
+        <label for="upload-dir">Destination directory</label>
+        <div class="cwd-picker">
+          <input type="text" id="upload-dir" placeholder="Session working directory" />
+          <button
+            type="button"
+            class="cwd-browse-btn"
+            id="upload-browse-btn"
+            title="Browse folders"
+          >
+            <svg
+              width="18"
+              height="18"
+              viewBox="0 0 24 24"
+              fill="none"
+              stroke="currentColor"
+              stroke-width="2"
+              stroke-linecap="round"
+              stroke-linejoin="round"
+            >
+              <path
+                d="M22 19a2 2 0 0 1-2 2H4a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h5l2 3h9a2 2 0 0 1 2 2z"
+              />
+            </svg>
+          </button>
+        </div>
+        <div class="modal-actions">
+          <button class="btn-cancel" id="upload-cancel">Cancel</button>
+          <button class="btn-create" id="upload-confirm">Upload</button>
+        </div>
+      </div>
+    </div>
 
     <div id="reconnect-overlay">
       <div class="msg">Session disconnected</div>
@@ -2426,7 +2476,14 @@
 
       // ===== Init =====
       async function init() {
-        const sessionList = await fetch('/api/sessions').then((r) => r.json());
+        let sessionList = [];
+        try {
+          const res = await fetch('/api/sessions');
+          if (!res.ok) throw new Error(`${res.status}`);
+          sessionList = await res.json();
+        } catch (err) {
+          console.error('Failed to load sessions:', err);
+        }
         const initialId = new URLSearchParams(location.search).get('id');
 
         for (const s of sessionList) addSession(s);
@@ -2449,6 +2506,7 @@
         setupKeyBar();
         setupPaste();
         setupImagePaste();
+        setupUpload();
         setupSelectMode();
         setupNewSessionModal();
         setupPreviewModal();
@@ -2627,7 +2685,10 @@
 
         // Version
         fetch('/api/version')
-          .then((r) => r.json())
+          .then((r) => {
+            if (!r.ok) throw new Error(`${r.status}`);
+            return r.json();
+          })
           .then((d) => {
             window._termbeamVersion = 'v' + d.version;
             document.getElementById('side-panel-version').textContent = 'v' + d.version;
@@ -3739,6 +3800,168 @@
         );
       }
 
+      // ===== File Upload =====
+      function setupUpload() {
+        const uploadInput = document.getElementById('upload-input');
+        const uploadModal = document.getElementById('upload-modal');
+        const uploadDirInput = document.getElementById('upload-dir');
+        const uploadFileList = document.getElementById('upload-file-list');
+        const uploadConfirmBtn = document.getElementById('upload-confirm');
+        const uploadCancelBtn = document.getElementById('upload-cancel');
+        const uploadBrowseBtn = document.getElementById('upload-browse-btn');
+
+        let pendingFiles = null;
+
+        const MAX_FILE_SIZE = 10 * 1024 * 1024;
+
+        function openUploadModal(files) {
+          pendingFiles = files;
+          const ms = managed.get(activeId);
+          const cwd = (ms && ms.cwd) || '';
+          uploadDirInput.value = cwd;
+          let hasOversized = false;
+          uploadFileList.innerHTML = '';
+          Array.from(files).forEach((f) => {
+            const oversized = f.size > MAX_FILE_SIZE;
+            if (oversized) hasOversized = true;
+            const row = document.createElement('div');
+            if (oversized) row.style.color = '#f87171';
+            row.textContent =
+              '📄 ' +
+              f.name +
+              ' (' +
+              formatSize(f.size) +
+              ')' +
+              (oversized ? ' exceeds 10 MB limit' : '');
+            uploadFileList.appendChild(row);
+          });
+          uploadConfirmBtn.disabled = hasOversized;
+          uploadConfirmBtn.style.opacity = hasOversized ? '0.5' : '1';
+          uploadModal.classList.add('visible');
+        }
+
+        function closeUploadModal() {
+          uploadModal.classList.remove('visible');
+          closeBrowseDropdown();
+          pendingFiles = null;
+        }
+
+        function formatSize(bytes) {
+          if (bytes < 1024) return bytes + ' B';
+          if (bytes < 1024 * 1024) return (bytes / 1024).toFixed(1) + ' KB';
+          return (bytes / (1024 * 1024)).toFixed(1) + ' MB';
+        }
+
+        uploadInput.addEventListener('change', () => {
+          const files = uploadInput.files;
+          if (!files || !files.length || !activeId) return;
+          openUploadModal(files);
+        });
+
+        uploadCancelBtn.addEventListener('click', closeUploadModal);
+        uploadModal.addEventListener('click', (e) => {
+          if (e.target === uploadModal) closeUploadModal();
+        });
+
+        // Directory browsing (reuse /api/dirs)
+        let browseDropdown = null;
+
+        function closeBrowseDropdown() {
+          if (browseDropdown) {
+            browseDropdown.remove();
+            browseDropdown = null;
+          }
+        }
+
+        // Close dropdown when clicking outside
+        document.addEventListener('click', (e) => {
+          if (
+            browseDropdown &&
+            !browseDropdown.contains(e.target) &&
+            e.target !== uploadBrowseBtn
+          ) {
+            closeBrowseDropdown();
+          }
+        });
+
+        uploadBrowseBtn.addEventListener('click', async () => {
+          if (browseDropdown) {
+            closeBrowseDropdown();
+            return;
+          }
+          const q = uploadDirInput.value || '';
+          try {
+            const res = await fetch('/api/dirs?q=' + encodeURIComponent(q ? q + '/' : ''), {
+              credentials: 'same-origin',
+            });
+            if (!res.ok) throw new Error(`Failed to browse directories: ${res.status}`);
+            const data = await res.json();
+            if (!data.dirs || !data.dirs.length) return;
+            browseDropdown = document.createElement('div');
+            browseDropdown.style.cssText =
+              'position:absolute;left:0;right:0;bottom:100%;margin-bottom:4px;max-height:150px;overflow-y:auto;background:var(--surface);border:1px solid var(--border);border-radius:6px;z-index:10;box-shadow:0 -4px 12px rgba(0,0,0,0.2);';
+            data.dirs.forEach((d) => {
+              const opt = document.createElement('div');
+              opt.textContent = d;
+              opt.style.cssText =
+                'padding:6px 10px;cursor:pointer;font-size:13px;color:var(--text);';
+              opt.addEventListener('mouseenter', () => (opt.style.background = 'var(--hover)'));
+              opt.addEventListener('mouseleave', () => (opt.style.background = 'none'));
+              opt.addEventListener('click', () => {
+                uploadDirInput.value = d;
+                closeBrowseDropdown();
+              });
+              browseDropdown.appendChild(opt);
+            });
+            uploadBrowseBtn.parentElement.style.position = 'relative';
+            uploadBrowseBtn.parentElement.appendChild(browseDropdown);
+          } catch {}
+        });
+
+        uploadConfirmBtn.addEventListener('click', async () => {
+          if (!pendingFiles || !pendingFiles.length || !activeId) return;
+          const targetDir = uploadDirInput.value.trim();
+          const filesToUpload = Array.from(pendingFiles);
+          closeUploadModal();
+
+          let uploaded = 0;
+          let failed = 0;
+
+          for (const file of filesToUpload) {
+            try {
+              const headers = {
+                'Content-Type': file.type || 'application/octet-stream',
+                'X-Filename': file.name,
+              };
+              if (targetDir) headers['X-Target-Dir'] = targetDir;
+              const res = await fetch(`/api/sessions/${activeId}/upload`, {
+                method: 'POST',
+                headers,
+                body: file,
+                credentials: 'same-origin',
+              });
+              if (!res.ok) {
+                const err = await res.json().catch(() => ({}));
+                throw new Error(err.error || 'Upload failed');
+              }
+              await res.json();
+              uploaded++;
+            } catch (err) {
+              failed++;
+              console.error('Upload error:', file.name, err);
+            }
+          }
+
+          if (uploaded > 0) {
+            const dir = targetDir || 'session directory';
+            showToast(`${uploaded} file${uploaded > 1 ? 's' : ''} uploaded to ${dir}`);
+          }
+          if (failed > 0) {
+            showToast(`${failed} file${failed > 1 ? 's' : ''} failed to upload`);
+          }
+        });
+      }
+
       // ===== New Session Modal =====
       let shellsLoaded = false;
 
@@ -3785,7 +4008,10 @@
         document.getElementById('ns-browse-btn').addEventListener('click', async () => {
           if (serverCwd === '/') {
             try {
-              const data = await fetch('/api/shells').then((r) => r.json());
+              const data = await fetch('/api/shells').then((r) => {
+                if (!r.ok) throw new Error(`${r.status}`);
+                return r.json();
+              });
               if (data.cwd) serverCwd = data.cwd;
             } catch {}
           }
@@ -3813,6 +4039,7 @@
           nsBrowserList.innerHTML = '<div class="browser-empty">Loading…</div>';
           try {
             const res = await fetch(`/api/dirs?q=${encodeURIComponent(dir + '/')}`);
+            if (!res.ok) throw new Error(`Failed to load directories: ${res.status}`);
             const data = await res.json();
             let items = '';
             // Add parent (..) entry unless at root
@@ -3870,7 +4097,10 @@
         if (shellsLoaded) return;
         const sel = document.getElementById('ns-shell');
         try {
-          const data = await fetch('/api/shells').then((r) => r.json());
+          const data = await fetch('/api/shells').then((r) => {
+            if (!r.ok) throw new Error(`${r.status}`);
+            return r.json();
+          });
           if (data.cwd) {
             serverCwd = data.cwd;
             document.getElementById('ns-cwd').placeholder = data.cwd;
@@ -3928,10 +4158,16 @@
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify(body),
           });
+          if (!res.ok) {
+            console.error(`Failed to create session: ${res.status}`);
+            return;
+          }
           const data = await res.json();
 
           // Fetch full session list to get the new session data
-          const list = await fetch('/api/sessions').then((r) => r.json());
+          const listRes = await fetch('/api/sessions');
+          if (!listRes.ok) throw new Error(`Failed to list sessions: ${listRes.status}`);
+          const list = await listRes.json();
           const newSession = list.find((s) => s.id === data.id);
           if (newSession) {
             addSession(newSession);
@@ -3951,7 +4187,9 @@
       function startPolling() {
         setInterval(async () => {
           try {
-            const list = await fetch('/api/sessions').then((r) => r.json());
+            const pollRes = await fetch('/api/sessions');
+            if (!pollRes.ok) throw new Error(`${pollRes.status}`);
+            const list = await pollRes.json();
             const serverIds = new Set(list.map((s) => s.id));
 
             // Add new sessions created elsewhere
@@ -4164,6 +4402,19 @@
             category: 'Session',
             action: () => openNewSessionModal(),
           },
+          {
+            icon: '<svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="17 8 12 3 7 8"/><line x1="12" y1="3" x2="12" y2="15"/></svg>',
+            label: 'Upload files',
+            category: 'Session',
+            action: () => {
+              if (!activeId) {
+                showToast('No active session');
+                return;
+              }
+              document.getElementById('upload-input').value = '';
+              document.getElementById('upload-input').click();
+            },
+          },
           {
             icon: '<svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round"><line x1="18" y1="6" x2="6" y2="18"/><line x1="6" y1="6" x2="18" y2="18"/></svg>',
             label: 'Close tab',
@@ -4348,8 +4599,8 @@
               btn.innerHTML =
                 '<span class="palette-action-icon">' + a.icon + '</span>' + esc(a.label);
               btn.addEventListener('click', () => {
-                if (!a.keepOpen) closePalette();
                 a.action();
+                if (!a.keepOpen) closePalette();
               });
               body.appendChild(btn);
             });

package/src/auth.js

@@ -177,7 +177,7 @@ function createAuth(password) {
   const shareTokens = new Map(); // share tokens: token -> expiry
 
   // Periodically clean up expired tokens and stale rate-limit entries
-  setInterval(
+  const cleanupInterval = setInterval(
     () => {
       const now = Date.now();
       for (const [token, expiry] of tokens) {
@@ -296,6 +296,7 @@ function createAuth(password) {
     rateLimit,
     parseCookies,
     loginHTML: LOGIN_HTML,
+    cleanup: () => clearInterval(cleanupInterval),
   };
 }
 

package/src/cli.js

@@ -270,6 +270,10 @@ function parseArgs() {
       publicTunnel = true;
     } else if (args[i].startsWith('--password=')) {
       password = args[i].split('=')[1];
+      if (!password) {
+        console.error('Error: --password= requires a non-empty value\n');
+        process.exit(1);
+      }
       explicitPassword = true;
     } else if (args[i] === '--help' || args[i] === '-h') {
       printHelp();
@@ -286,6 +290,10 @@ function parseArgs() {
       explicitPassword = true;
     } else if (args[i] === '--port' && args[i + 1]) {
       port = parseInt(args[++i], 10);
+      if (!Number.isFinite(port) || port < 1 || port > 65535) {
+        console.error('Error: --port must be a number between 1 and 65535\n');
+        process.exit(1);
+      }
     } else if (args[i] === '--lan') {
       host = '0.0.0.0';
     } else if (args[i] === '--host' && args[i + 1]) {
@@ -307,6 +315,12 @@ function parseArgs() {
     }
   }
 
+  const validLogLevels = ['error', 'warn', 'info', 'debug'];
+  if (!validLogLevels.includes(logLevel)) {
+    console.error(`Error: --log-level must be one of: ${validLogLevels.join(', ')}\n`);
+    process.exit(1);
+  }
+
   // Default: auto-generate password if none specified
   if (!explicitPassword && !password) {
     password = crypto.randomBytes(16).toString('base64url');

package/src/client.js

@@ -80,7 +80,7 @@ function createTerminalClient({
       try {
         msg = JSON.parse(raw);
       } catch {
-        return;
+        return; // Silently drop unparseable messages from server
       }
 
       if (msg.type === 'auth_ok') {

package/src/preview.js

@@ -96,7 +96,7 @@ function createPreviewProxy() {
     proxyReq.on('error', (err) => {
       log.warn(`Preview proxy error (port ${port}): ${err.message}`);
       if (!res.headersSent) {
-        res.status(502).json({ error: `Bad gateway: ${err.message}` });
+        res.status(502).json({ error: 'Bad gateway: upstream server is not responding' });
       }
     });
 

package/src/routes.js

@@ -185,9 +185,10 @@ function setupRoutes(app, { auth, sessions, config, state }) {
         rows: typeof rows === 'number' && rows > 0 && rows <= 200 ? Math.floor(rows) : undefined,
       });
     } catch (err) {
-      return res.status(400).json({ error: err.message || 'Failed to create session' });
+      log.warn(`Session creation failed: ${err.message}`);
+      return res.status(400).json({ error: 'Failed to create session' });
     }
-    res.json({ id, url: `/terminal?id=${id}` });
+    res.status(201).json({ id, url: `/terminal?id=${id}` });
   });
 
   // Available shells
@@ -220,7 +221,7 @@ function setupRoutes(app, { auth, sessions, config, state }) {
 
   app.delete('/api/sessions/:id', auth.middleware, (req, res) => {
     if (sessions.delete(req.params.id)) {
-      res.json({ ok: true });
+      res.status(204).end();
     } else {
       res.status(404).json({ error: 'not found' });
     }
@@ -288,7 +289,7 @@ function setupRoutes(app, { auth, sessions, config, state }) {
       fs.writeFileSync(filepath, buffer);
       uploadedFiles.set(id, filepath);
       log.info(`Upload: ${filename} (${buffer.length} bytes)`);
-      res.json({ id, url: `/uploads/${id}`, path: filepath });
+      res.status(201).json({ id, url: `/uploads/${id}`, path: filepath });
     });
 
     req.on('error', (err) => {
@@ -308,6 +309,112 @@ function setupRoutes(app, { auth, sessions, config, state }) {
     res.sendFile(filepath);
   });
 
+  // General file upload to a session's working directory
+  app.post('/api/sessions/:id/upload', apiRateLimit, auth.middleware, (req, res) => {
+    const session = sessions.get(req.params.id);
+    if (!session) {
+      return res.status(404).json({ error: 'Session not found' });
+    }
+
+    const rawName = req.headers['x-filename'];
+    if (!rawName || typeof rawName !== 'string') {
+      return res.status(400).json({ error: 'Missing X-Filename header' });
+    }
+
+    // Sanitize: take only the basename, strip control chars, collapse whitespace
+    const sanitized = path
+      .basename(rawName)
+      .replace(/[\x00-\x1f]/g, '')
+      .replace(/\s+/g, ' ')
+      .trim();
+    if (!sanitized || sanitized === '.' || sanitized === '..') {
+      return res.status(400).json({ error: 'Invalid filename' });
+    }
+
+    // Resolve target directory: optional X-Target-Dir header, falls back to session cwd
+    const rawTargetDir = req.headers['x-target-dir'];
+    let targetDir = session.cwd;
+    if (rawTargetDir && typeof rawTargetDir === 'string') {
+      if (!path.isAbsolute(rawTargetDir)) {
+        return res.status(400).json({ error: 'Target directory must be an absolute path' });
+      }
+      const resolved = path.resolve(rawTargetDir);
+      try {
+        if (fs.statSync(resolved).isDirectory()) {
+          targetDir = resolved;
+        } else {
+          return res.status(400).json({ error: 'Target directory is not a directory' });
+        }
+      } catch {
+        return res.status(400).json({ error: 'Target directory does not exist' });
+      }
+    }
+    // Defense-in-depth: ensure destPath is still inside targetDir after join
+    const destPath = path.join(targetDir, sanitized);
+    if (
+      !path.resolve(destPath).startsWith(path.resolve(targetDir) + path.sep) &&
+      path.resolve(destPath) !== path.resolve(targetDir)
+    ) {
+      return res.status(400).json({ error: 'Invalid filename' });
+    }
+
+    const chunks = [];
+    let size = 0;
+    let aborted = false;
+    const limit = 10 * 1024 * 1024;
+
+    req.on('data', (chunk) => {
+      if (aborted) return;
+      size += chunk.length;
+      if (size > limit) {
+        aborted = true;
+        log.warn(`File upload rejected: too large (${size} bytes)`);
+        res.status(413).json({ error: 'File too large (max 10 MB)' });
+        req.resume();
+        return;
+      }
+      chunks.push(chunk);
+    });
+
+    req.on('end', () => {
+      if (aborted) return;
+      const buffer = Buffer.concat(chunks);
+      if (!buffer.length) {
+        return res.status(400).json({ error: 'Empty file' });
+      }
+
+      // Atomic write with dedup: use wx flag to fail on existing file, retry with suffix
+      const ext = path.extname(sanitized);
+      const base = path.basename(sanitized, ext);
+      let destPath = path.join(targetDir, sanitized);
+      let written = false;
+      for (let n = 0; n < 100; n++) {
+        const candidate = n === 0 ? destPath : path.join(targetDir, `${base} (${n})${ext}`);
+        try {
+          fs.writeFileSync(candidate, buffer, { flag: 'wx' });
+          destPath = candidate;
+          written = true;
+          break;
+        } catch (err) {
+          if (err.code === 'EEXIST') continue;
+          log.error(`File upload write error: ${err.message}`);
+          return res.status(500).json({ error: 'Failed to write file' });
+        }
+      }
+      if (!written) {
+        return res.status(409).json({ error: 'Too many filename collisions' });
+      }
+      const finalName = path.basename(destPath);
+      log.info(`File upload: ${finalName} → ${targetDir} (${buffer.length} bytes)`);
+      res.status(201).json({ name: finalName, path: destPath, size: buffer.length });
+    });
+
+    req.on('error', (err) => {
+      log.error(`File upload error: ${err.message}`);
+      res.status(500).json({ error: 'Upload failed' });
+    });
+  });
+
   // Directory listing for folder browser
   app.get('/api/dirs', apiRateLimit, auth.middleware, (req, res) => {
     const query = req.query.q || config.cwd + path.sep;

package/src/server.js

@@ -83,10 +83,14 @@ function createTermBeamServer(overrides = {}) {
   function shutdown() {
     if (shuttingDown) return;
     shuttingDown = true;
+    auth.cleanup();
     sessions.shutdown();
     cleanupUploadedFiles();
     cleanupTunnel();
     removeConnectionConfig();
+    for (const client of wss.clients) {
+      client.close(1001, 'Server shutting down');
+    }
     server.close();
     wss.close();
   }

package/src/sessions.js

@@ -1,30 +1,10 @@
 const crypto = require('crypto');
 const path = require('path');
-const { execSync, exec } = require('child_process');
-const fs = require('fs');
+const { exec } = require('child_process');
 const pty = require('node-pty');
 const log = require('./logger');
 const { getGitInfo } = require('./git');
 
-function _getProcessCwd(pid) {
-  try {
-    if (process.platform === 'linux') {
-      return fs.readlinkSync(`/proc/${pid}/cwd`);
-    }
-    if (process.platform === 'darwin') {
-      const out = execSync(`lsof -a -p ${pid} -d cwd -Fn`, {
-        stdio: 'pipe',
-        timeout: 2000,
-      }).toString();
-      const match = out.match(/\nn(.+)/);
-      if (match) return match[1];
-    }
-  } catch {
-    /* process may have exited */
-  }
-  return null;
-}
-
 // Cache git info per session to avoid blocking the event loop on every list() call.
 // lsof + git commands take ~200-500ms and block WebSocket traffic, causing
 // xterm.js cursor position report responses to leak as visible text.
@@ -69,6 +49,7 @@ function scheduleGitRefresh(sessionId, pid, originalCwd) {
   }
 
   exec(cmd, { timeout: 2000 }, (err, stdout) => {
+    if (err) log.debug(`Git cwd detection failed: ${err.message}`);
     let liveCwd = originalCwd;
     if (!err && stdout) {
       if (process.platform === 'darwin') {

package/src/tunnel.js

@@ -67,21 +67,6 @@ function savePersistedTunnel(id) {
   );
 }
 
-function _deletePersisted() {
-  const persisted = loadPersistedTunnel();
-  if (persisted) {
-    try {
-      if (SAFE_ID_RE.test(persisted.tunnelId)) {
-        execFileSync(devtunnelCmd, ['delete', persisted.tunnelId, '-f'], { stdio: 'pipe' });
-        log.info(`Deleted persisted tunnel ${persisted.tunnelId}`);
-      }
-    } catch {}
-    try {
-      fs.unlinkSync(TUNNEL_CONFIG_PATH);
-    } catch {}
-  }
-}
-
 function isTunnelValid(id) {
   try {
     if (!SAFE_ID_RE.test(id)) return false;

package/src/websocket.js

@@ -17,6 +17,10 @@ function recalcPtySize(session) {
 }
 
 function setupWebSocket(wss, { auth, sessions }) {
+  const wsAuthAttempts = new Map(); // ip -> [timestamps]
+  const WS_AUTH_WINDOW = 60 * 1000; // 1 minute
+  const WS_MAX_AUTH_ATTEMPTS = 5;
+
   wss.on('connection', (ws, req) => {
     const origin = req.headers.origin;
     if (origin) {
@@ -51,11 +55,26 @@ function setupWebSocket(wss, { auth, sessions }) {
         const msg = JSON.parse(raw);
 
         if (msg.type === 'auth') {
+          const ip = req.socket.remoteAddress;
+          const now = Date.now();
+          const attempts = (wsAuthAttempts.get(ip) || []).filter((t) => now - t < WS_AUTH_WINDOW);
+
+          if (attempts.length >= WS_MAX_AUTH_ATTEMPTS) {
+            log.warn(`WS: rate limit exceeded for ${ip}`);
+            ws.send(
+              JSON.stringify({ type: 'error', message: 'Too many attempts. Try again later.' }),
+            );
+            ws.close();
+            return;
+          }
+
           if (msg.password === auth.password || auth.validateToken(msg.token)) {
             authenticated = true;
             ws.send(JSON.stringify({ type: 'auth_ok' }));
             log.info('WS: auth success');
           } else {
+            attempts.push(now);
+            wsAuthAttempts.set(ip, attempts);
             log.warn('WS: auth failed');
             ws.send(JSON.stringify({ type: 'error', message: 'Unauthorized' }));
             ws.close();