termbridge 0.1.1 → 0.3.0

package/README.md

@@ -24,7 +24,7 @@ Visit `https://termbridge.dev` for the full docs, architecture notes, and troubl
 ## CLI usage
 
 ```bash
-termbridge --port 7000 --session dev --kill-on-exit --no-qr --tunnel cloudflare
+termbridge --port 8080 --session dev --kill-on-exit --no-qr --tunnel cloudflare
 ```
 
 Flags:

package/dist/bin.js

@@ -1788,6 +1788,22 @@ var parseArgs = (argv) => {
       options.port = port;
       continue;
     }
+    if (current === "--proxy") {
+      const proxy = parseNumber(args.shift());
+      if (!proxy || proxy <= 0) {
+        throw new Error("invalid proxy port");
+      }
+      options.proxy = proxy;
+      continue;
+    }
+    if (current === "--dev-proxy-url") {
+      const url = args.shift();
+      if (!url) {
+        throw new Error("missing dev proxy URL");
+      }
+      options.devProxyUrl = url;
+      continue;
+    }
     if (current === "--session") {
       const session = args.shift();
       if (!session) {
@@ -1825,6 +1841,7 @@ Usage:
 
 Options:
   --port <port>       Bind the local server to a fixed port
+  --proxy <port>      Proxy a local dev server (e.g., Vite) through termbridge
   --session <name>    Use a specific tmux session name
   --kill-on-exit      Kill the tmux session when the CLI exits
   --no-qr             Disable QR code output
@@ -2089,6 +2106,7 @@ import { randomBytes, createHash } from "crypto";
 var SESSION_COOKIE_NAME = "termbridge_session";
 var hashToken = (token) => createHash("sha256").update(token).digest("hex");
 var createSessionId = () => randomBytes(18).toString("base64url");
+var createCsrfToken = () => randomBytes(24).toString("base64url");
 var parseCookies = (cookieHeader) => {
   const cookies = {};
   if (!cookieHeader) {
@@ -2136,6 +2154,7 @@ var createAuth = ({
     record.consumed = true;
     const session = {
       id: createSessionId(),
+      csrfToken: createCsrfToken(),
       createdAt: clock(),
       lastSeen: clock()
     };
@@ -2179,12 +2198,20 @@ var createAuth = ({
     }
     return parts.join("; ");
   };
+  const verifyCsrfToken = (sessionId, csrfToken) => {
+    const session = sessions.get(sessionId);
+    if (!session) {
+      return false;
+    }
+    return session.csrfToken === csrfToken;
+  };
   return {
     issueToken,
     redeemToken,
     getSession,
     getSessionFromRequest,
-    createSessionCookie
+    createSessionCookie,
+    verifyCsrfToken
   };
 };
 
@@ -2236,9 +2263,9 @@ var createTerminalRegistry = () => {
 };
 
 // src/server/server.ts
-import { createServer as createHttpServer } from "http";
+import { createServer as createHttpServer, request as httpRequest } from "http";
 import { randomBytes as randomBytes3 } from "crypto";
-import { WebSocketServer } from "ws";
+import { WebSocketServer, WebSocket as WsWebSocket } from "ws";
 
 // ../packages/shared/src/index.ts
 var TERMINAL_CONTROL_KEYS = [
@@ -2303,6 +2330,9 @@ var createStaticHandler = (uiDistPath, basePath) => {
 };
 
 // src/server/server.ts
+var MAX_HTTP_BODY_SIZE = 64 * 1024;
+var MAX_WS_MESSAGE_SIZE = 1024 * 1024;
+var MAX_INPUT_LENGTH = 64 * 1024;
 var jsonResponse = (response, status, payload) => {
   const body = JSON.stringify(payload);
   response.statusCode = status;
@@ -2312,7 +2342,12 @@ var jsonResponse = (response, status, payload) => {
 };
 var readJsonBody = async (request) => {
   const chunks = [];
+  let totalSize = 0;
   for await (const chunk of request) {
+    totalSize += chunk.length;
+    if (totalSize > MAX_HTTP_BODY_SIZE) {
+      return "too_large";
+    }
     chunks.push(chunk);
   }
   const body = Buffer.concat(chunks).toString("utf8").trim();
@@ -2338,21 +2373,28 @@ var isAllowedOrigin = (origin, host) => {
 };
 var allowedControlKeys = new Set(TERMINAL_CONTROL_KEYS);
 var parseClientMessage = (payload) => {
+  const size = typeof payload === "string" ? payload.length : payload.byteLength;
+  if (size > MAX_WS_MESSAGE_SIZE) {
+    return { ok: false, error: "too_large" };
+  }
   const text = typeof payload === "string" ? payload : payload.toString();
   try {
     const parsed = JSON.parse(text);
     if (parsed.type === "input" && typeof parsed.data === "string") {
-      return parsed;
+      if (parsed.data.length > MAX_INPUT_LENGTH) {
+        return { ok: false, error: "too_large" };
+      }
+      return { ok: true, message: parsed };
     }
     if (parsed.type === "resize" && typeof parsed.cols === "number" && typeof parsed.rows === "number") {
-      return parsed;
+      return { ok: true, message: parsed };
     }
     if (parsed.type === "control" && allowedControlKeys.has(parsed.key)) {
-      return parsed;
+      return { ok: true, message: parsed };
     }
-    return null;
+    return { ok: false, error: "invalid" };
   } catch {
-    return null;
+    return { ok: false, error: "invalid" };
   }
 };
 var sendWsMessage = (socket, message) => {
@@ -2360,24 +2402,44 @@ var sendWsMessage = (socket, message) => {
 };
 var createSessionName = () => `termbridge-${randomBytes3(4).toString("hex")}`;
 var createAppServer = (deps) => {
-  const staticHandler = createStaticHandler(deps.uiDistPath, "/app");
+  const staticHandler = createStaticHandler(deps.uiDistPath, "/__tb/app");
   const wss = new WebSocketServer({ noServer: true });
   const connectionInfo = /* @__PURE__ */ new WeakMap();
+  const proxyRequest = (request, response, targetPath, search) => {
+    const targetUrl = `http://localhost:${deps.proxyPort}${targetPath}${search}`;
+    const proxyHeaders = { ...request.headers };
+    delete proxyHeaders.cookie;
+    delete proxyHeaders.host;
+    proxyHeaders.host = `localhost:${deps.proxyPort}`;
+    const proxyReq = httpRequest(
+      targetUrl,
+      { method: request.method, headers: proxyHeaders },
+      (proxyRes) => {
+        response.writeHead(proxyRes.statusCode, proxyRes.headers);
+        proxyRes.pipe(response);
+      }
+    );
+    proxyReq.on("error", () => {
+      response.statusCode = 502;
+      response.end("proxy error");
+    });
+    request.pipe(proxyReq);
+  };
   const server = createHttpServer(async (request, response) => {
     const url = new URL(request.url, `http://${request.headers.host}`);
-    if (request.method === "GET" && url.pathname === "/healthz") {
+    if (request.method === "GET" && url.pathname === "/__tb/healthz") {
       response.statusCode = 200;
       response.end("ok");
       return;
     }
-    if (request.method === "GET" && url.pathname === "/") {
+    if (request.method === "GET" && url.pathname === "/" && !deps.proxyPort) {
       response.statusCode = 302;
-      response.setHeader("Location", "/app");
+      response.setHeader("Location", "/__tb/app");
       response.end();
       return;
     }
-    if (request.method === "GET" && url.pathname.startsWith("/s/")) {
-      const token = url.pathname.slice(3);
+    if (request.method === "GET" && url.pathname.startsWith("/__tb/s/")) {
+      const token = url.pathname.slice("/__tb/s/".length);
       const ip = getIp(request);
       if (!deps.redemptionLimiter.allow(ip)) {
         response.statusCode = 429;
@@ -2392,11 +2454,26 @@ var createAppServer = (deps) => {
       }
       response.statusCode = 302;
       response.setHeader("Set-Cookie", deps.auth.createSessionCookie(session.id));
-      response.setHeader("Location", "/app");
+      response.setHeader("Location", "/__tb/app");
       response.end();
       return;
     }
-    if (url.pathname === "/api/terminals") {
+    if (url.pathname === "/__tb/api/csrf") {
+      const session = deps.auth.getSessionFromRequest(request);
+      if (!session) {
+        response.statusCode = 401;
+        response.end("unauthorized");
+        return;
+      }
+      if (request.method === "GET") {
+        jsonResponse(response, 200, { csrfToken: session.csrfToken });
+        return;
+      }
+      response.statusCode = 404;
+      response.end("not found");
+      return;
+    }
+    if (url.pathname === "/__tb/api/terminals") {
       const session = deps.auth.getSessionFromRequest(request);
       if (!session) {
         response.statusCode = 401;
@@ -2410,6 +2487,11 @@ var createAppServer = (deps) => {
       }
       if (request.method === "POST") {
         const body = await readJsonBody(request);
+        if (body === "too_large") {
+          response.statusCode = 413;
+          response.end("request body too large");
+          return;
+        }
         if (body && typeof body !== "object") {
           response.statusCode = 400;
           response.end("invalid body");
@@ -2422,15 +2504,48 @@ var createAppServer = (deps) => {
         return;
       }
     }
+    if (request.method === "GET" && url.pathname === "/__tb/api/config") {
+      const session = deps.auth.getSessionFromRequest(request);
+      if (!session) {
+        response.statusCode = 401;
+        response.end("unauthorized");
+        return;
+      }
+      jsonResponse(response, 200, {
+        proxyPort: deps.proxyPort ?? null,
+        devProxyUrl: deps.devProxyUrl ?? null
+      });
+      return;
+    }
     const handled = await staticHandler(request, response);
     if (!handled) {
+      if (deps.proxyPort && deps.auth.getSessionFromRequest(request)) {
+        proxyRequest(request, response, url.pathname, url.search);
+        return;
+      }
       response.statusCode = 404;
       response.end("not found");
     }
   });
   server.on("upgrade", (request, socket, head) => {
     const url = new URL(request.url, `http://${request.headers.host}`);
-    if (!url.pathname.startsWith("/ws/terminal/")) {
+    if (!url.pathname.startsWith("/__tb/ws/terminal/")) {
+      if (deps.proxyPort && deps.auth.getSessionFromRequest(request)) {
+        const targetUrl = `ws://localhost:${deps.proxyPort}${url.pathname}${url.search}`;
+        const proxyWs = new WsWebSocket(targetUrl);
+        proxyWs.on("open", () => {
+          wss.handleUpgrade(request, socket, head, (clientWs) => {
+            clientWs.on("message", (data) => proxyWs.send(data));
+            proxyWs.on("message", (data) => clientWs.send(data));
+            clientWs.on("close", () => proxyWs.close());
+            proxyWs.on("close", () => clientWs.close());
+          });
+        });
+        proxyWs.on("error", () => {
+          socket.destroy();
+        });
+        return;
+      }
       socket.destroy();
       return;
     }
@@ -2453,6 +2568,11 @@ var createAppServer = (deps) => {
       socket.destroy();
       return;
     }
+    const csrfToken = url.searchParams.get("csrf");
+    if (!csrfToken || !deps.auth.verifyCsrfToken(session.id, csrfToken)) {
+      socket.destroy();
+      return;
+    }
     const record = deps.terminalRegistry.get(terminalId);
     if (!record) {
       socket.destroy();
@@ -2470,15 +2590,16 @@ var createAppServer = (deps) => {
       sendWsMessage(socket, { type: "output", data });
     });
     socket.on("message", (payload) => {
-      const message = parseClientMessage(payload);
-      if (!message) {
+      const result = parseClientMessage(payload);
+      if (!result.ok) {
         sendWsMessage(socket, {
           type: "status",
           state: "error",
-          message: "invalid payload"
+          message: result.error === "too_large" ? "message too large" : "invalid payload"
         });
         return;
       }
+      const message = result.message;
       if (message.type === "input") {
         void deps.terminalBackend.write(info.sessionName, message.data);
         return;
@@ -2564,7 +2685,9 @@ var startCommand = async (options, deps = {}) => {
     uiDistPath: resolveUiDistPath(),
     auth,
     terminalRegistry,
-    terminalBackend
+    terminalBackend,
+    proxyPort: options.proxy,
+    devProxyUrl: options.devProxyUrl
   });
   const started = await server.listen(options.port ?? 0);
   const localUrl = `http://127.0.0.1:${started.port}`;
@@ -2589,7 +2712,7 @@ var startCommand = async (options, deps = {}) => {
     await started.close();
     throw error;
   }
-  const redeemUrl = `${publicUrl}/s/${token}`;
+  const redeemUrl = `${publicUrl}/__tb/s/${token}`;
   logger.info(`Local server: ${localUrl}`);
   logger.info(`Tunnel URL: ${redeemUrl}`);
   if (!options.noQr && deps.qr) {