termdock 1.4.59 → 1.4.61

package/dist/server/routes/filesystem.js

@@ -1,10 +1,12 @@
 import { Router } from 'express';
+import crypto from 'crypto';
 import fs from 'fs';
 import path from 'path';
 import { execFile, spawn } from 'child_process';
 import watcher from '@parcel/watcher';
 import busboy from 'busboy';
 import { pathValidator } from '../utils/pathValidator.js';
+import { isAuthEnabled, isRequestAuthenticated } from '../utils/authProtection.js';
 import { getImageDimensions } from '../utils/imageDimensions.js';
 import { writeDiffTraceLog, writeErrorLog, writeJsonLog } from '../utils/serverLogger.js';
 import { clearBranchAuditRecords, clearChangeAuditRecords, listBranchAuditRecords, listChangeAuditRecords, buildChangeAuditFingerprint } from '../utils/changeAuditStore.js';
@@ -2956,21 +2958,59 @@ router.get('/video', async (req, res) => {
 // index.html), so relative css/js/image references inside a document resolve
 // to the file's own directory. To make that resolution explicit and engine-
 // independent (some engines don't reliably resolve subresources against a
-// sandboxed iframe's document URL), HTML documents get an injected
-// <base href> pointing at the file's preview directory; other asset types
-// keep streaming as-is. The frontend renders this in a sandboxed iframe
-// (no allow-same-origin), so previewed scripts never gain the termdock origin.
-export function buildHtmlPreviewDirectoryUrl(filePath) {
-    // Drop the filename segment, then encode each directory segment exactly like
-    // the client-side buildHtmlPreviewUrl does (works for POSIX and Windows
-    // paths regardless of the host platform).
-    const encodedSegments = filePath
-        .split(/[\\/]+/)
-        .filter(Boolean)
-        .slice(0, -1)
-        .map((segment) => encodeURIComponent(segment))
-        .join('/');
-    return `/api/terminal/fs/preview/${encodedSegments}${encodedSegments ? '/' : ''}`;
+// sandboxed iframe's document URL), HTML documents get an injected <base href>
+// equal to the document's own request URL — that keeps relative references
+// working while also making in-page anchor links (#section) stay same-document
+// instead of forcing a full reload. Other asset types keep streaming as-is.
+//
+// Authentication: browsers refuse to send cookies for subresource requests
+// from a sandboxed iframe without allow-same-origin (Chrome blocks the 401
+// responses as ORB), so with a password set the document loads but images
+// don't. The preview route therefore authenticates document requests with the
+// session cookie, then redirects them to a URL carrying a short-lived token
+// bound to the previewed file's directory. Every relative subresource URL
+// inherits that token from the document URL, so css/js/images load without
+// cookies while the sandbox keeps previewed scripts on a separate origin.
+// The frontend renders this in a sandboxed iframe (no allow-same-origin), so
+// previewed scripts never gain the termdock origin.
+const PREVIEW_TOKEN_TTL_MS = 30 * 60 * 1000;
+const previewTokens = new Map();
+export function isPreviewToken(value) {
+    return /^[0-9a-f]{32}$/.test(value);
+}
+export function isPathWithinPreviewRoot(root, targetPath) {
+    const resolvedRoot = path.resolve(root);
+    const resolvedTarget = path.resolve(targetPath);
+    const prefix = resolvedRoot.endsWith(path.sep) ? resolvedRoot : `${resolvedRoot}${path.sep}`;
+    return resolvedTarget === resolvedRoot || resolvedTarget.startsWith(prefix);
+}
+// Sliding-expiry validation: a valid token refreshes its lifetime so a page
+// that keeps loading subresources stays usable without re-authenticating.
+export function validatePreviewToken(token, targetPath) {
+    const entry = previewTokens.get(token);
+    if (!entry)
+        return false;
+    if (entry.expiresAt < Date.now()) {
+        previewTokens.delete(token);
+        return false;
+    }
+    if (!isPathWithinPreviewRoot(entry.root, targetPath))
+        return false;
+    entry.expiresAt = Date.now() + PREVIEW_TOKEN_TTL_MS;
+    return true;
+}
+export function mintPreviewToken(root) {
+    const now = Date.now();
+    for (const [token, entry] of previewTokens) {
+        if (entry.expiresAt < now)
+            previewTokens.delete(token);
+    }
+    const token = crypto.randomBytes(16).toString('hex');
+    previewTokens.set(token, { root: path.resolve(root), expiresAt: now + PREVIEW_TOKEN_TTL_MS });
+    return token;
+}
+function tokenizePreviewUrl(previewBaseUrl, token) {
+    return previewBaseUrl.replace(/^(\/api\/terminal\/fs\/preview\/)/, `$1${token}/`);
 }
 // Insert <base href> right after <head> (or after the doctype / at the very
 // start when the document has no head). Documents that already declare their
@@ -2990,22 +3030,92 @@ export function injectHtmlPreviewBase(html, baseUrl) {
     }
     return baseTag + html;
 }
+const HTML_PREVIEW_INDEX_FILES = ['index.html', 'index.htm'];
+// Directory navigation in a previewed document (e.g. <a href="docs/">) should
+// behave like a normal web server: serve the directory's index document when
+// one exists. Returns the validated index file path, or null when the
+// directory has no index to preview.
+export async function findDirectoryIndexFile(dirPath) {
+    for (const name of HTML_PREVIEW_INDEX_FILES) {
+        const candidate = path.join(dirPath, name);
+        try {
+            const candidatePath = await pathValidator.validatePathAsync(candidate);
+            const candidateStat = await fs.promises.stat(candidatePath);
+            if (candidateStat.isFile())
+                return candidatePath;
+        }
+        catch {
+            // Missing or not allowed — try the next index name.
+        }
+    }
+    return null;
+}
 router.get('/preview/*path', async (req, res) => {
     try {
         const rawSegments = req.params.path;
         const segments = Array.isArray(rawSegments) ? rawSegments : rawSegments ? [rawSegments] : [];
-        const requestedPath = `/${segments.join('/')}`;
+        const firstSegment = segments[0];
+        const maybeToken = firstSegment && isPreviewToken(firstSegment) ? firstSegment : null;
+        const pathSegments = maybeToken ? segments.slice(1) : segments;
+        const requestedPath = `/${pathSegments.join('/')}`;
         if (!requestedPath || requestedPath === '/') {
             res.status(400).json({ error: 'Missing path parameter' });
             return;
         }
-        const resolvedPath = await pathValidator.validatePathAsync(requestedPath);
-        const stat = await fs.promises.stat(resolvedPath);
+        // Raw (percent-encoded) full pathname as the browser sees it (baseUrl +
+        // path, since this router is mounted under /api/terminal/fs); used as the
+        // injected <base> so it always equals the document URL.
+        const previewBaseUrl = req.originalUrl.split('?', 1)[0];
+        const authEnabled = isAuthEnabled();
+        // Token requests carry their own credential in the URL. Document requests
+        // must present the session cookie before we mint a token for them.
+        if (!maybeToken && authEnabled && !isRequestAuthenticated(req)) {
+            res.status(401).json({ error: 'Authentication required', code: 'AUTH_REQUIRED' });
+            return;
+        }
+        const validatedPath = await pathValidator.validatePathAsync(requestedPath);
+        let stat = await fs.promises.stat(validatedPath);
+        let targetPath = validatedPath;
+        let redirectUrl = null;
+        if (stat.isDirectory()) {
+            // Directory links must carry a trailing slash so relative references
+            // inside the served index resolve within the directory, matching how a
+            // normal web server behaves.
+            if (!previewBaseUrl.endsWith('/')) {
+                redirectUrl = `${previewBaseUrl}/`;
+            }
+            else {
+                const indexPath = await findDirectoryIndexFile(validatedPath);
+                if (!indexPath) {
+                    res.status(404).json({ error: 'Directory has no index file to preview', code: 'NO_INDEX' });
+                    return;
+                }
+                targetPath = indexPath;
+                stat = await fs.promises.stat(targetPath);
+            }
+        }
+        // Authenticated document requests get a short-lived token bound to the
+        // previewed file's directory, so the sandboxed iframe's subresources can
+        // load without cookies. The token segment in the URL is inherited by every
+        // relative reference the document makes.
+        if (authEnabled && !maybeToken) {
+            const root = stat.isDirectory() ? validatedPath : path.dirname(validatedPath);
+            const tokenized = tokenizePreviewUrl(previewBaseUrl, mintPreviewToken(root));
+            redirectUrl = stat.isDirectory() && !previewBaseUrl.endsWith('/') ? `${tokenized}/` : tokenized;
+        }
+        if (redirectUrl) {
+            res.redirect(302, redirectUrl);
+            return;
+        }
         if (!stat.isFile()) {
             res.status(400).json({ error: 'Path is not a file' });
             return;
         }
-        const mimeType = getHtmlPreviewMimeType(resolvedPath);
+        if (maybeToken && !validatePreviewToken(maybeToken, targetPath)) {
+            res.status(403).json({ error: 'Preview token invalid or expired', code: 'PREVIEW_TOKEN_INVALID' });
+            return;
+        }
+        const mimeType = getHtmlPreviewMimeType(targetPath);
         if (!mimeType) {
             res.status(415).json({ error: 'Unsupported file type for preview' });
             return;
@@ -3019,19 +3129,23 @@ router.get('/preview/*path', async (req, res) => {
             });
             return;
         }
-        const isHtml = path.extname(resolvedPath).toLowerCase() === '.html' || path.extname(resolvedPath).toLowerCase() === '.htm';
+        const isHtml = path.extname(targetPath).toLowerCase() === '.html' || path.extname(targetPath).toLowerCase() === '.htm';
         if (isHtml) {
             // HTML is size-capped above; buffer it so we can inject <base> and send
             // an accurate Content-Length for the modified payload.
-            const html = await fs.promises.readFile(resolvedPath, 'utf8');
-            const served = injectHtmlPreviewBase(html, buildHtmlPreviewDirectoryUrl(resolvedPath));
+            const html = await fs.promises.readFile(targetPath, 'utf8');
+            const served = injectHtmlPreviewBase(html, previewBaseUrl);
             const payload = Buffer.from(served, 'utf8');
             res.setHeader('Content-Type', mimeType);
             res.setHeader('Content-Length', payload.length.toString());
             res.setHeader('Last-Modified', stat.mtime.toUTCString());
             res.setHeader('Cache-Control', 'no-store');
             res.setHeader('X-Content-Type-Options', 'nosniff');
-            res.setHeader('Content-Disposition', buildContentDisposition('inline', path.basename(resolvedPath)));
+            // Preview URLs carry a short-lived token; never leak it to third-party
+            // resources the previewed document loads (fonts, analytics, hotlinked
+            // images) via the Referer header.
+            res.setHeader('Referrer-Policy', 'no-referrer');
+            res.setHeader('Content-Disposition', buildContentDisposition('inline', path.basename(targetPath)));
             res.end(payload);
             return;
         }
@@ -3040,8 +3154,9 @@ router.get('/preview/*path', async (req, res) => {
         res.setHeader('Last-Modified', stat.mtime.toUTCString());
         res.setHeader('Cache-Control', 'no-store');
         res.setHeader('X-Content-Type-Options', 'nosniff');
-        res.setHeader('Content-Disposition', buildContentDisposition('inline', path.basename(resolvedPath)));
-        const stream = fs.createReadStream(resolvedPath);
+        res.setHeader('Referrer-Policy', 'no-referrer');
+        res.setHeader('Content-Disposition', buildContentDisposition('inline', path.basename(targetPath)));
+        const stream = fs.createReadStream(targetPath);
         stream.on('error', (error) => {
             if (!res.headersSent) {
                 const message = error instanceof Error ? error.message : 'Failed to serve file';

package/dist/server/utils/authProtection.js

@@ -277,10 +277,12 @@ export function isRequestAuthenticated(req) {
 // Middleware factory: blocks the request with 401 unless either auth is
 // disabled (no auth.json) or the request carries a valid session cookie.
 // Bypass paths are public (login/status/health/static).
-export function requireAuth() {
+export function requireAuth(options) {
     return (req, res, next) => {
         if (!isAuthEnabled())
             return next();
+        if (options?.bypass?.(req))
+            return next();
         if (isRequestAuthenticated(req))
             return next();
         res.status(401).json({ error: 'Authentication required', code: 'AUTH_REQUIRED' });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "termdock",
-  "version": "1.4.59",
+  "version": "1.4.61",
   "description": "A complete web-based terminal application with modern UI",
   "type": "module",
   "main": ".desktop-dist/main.js",

package/runtime-manifest.json

@@ -1,12 +1,12 @@
 {
   "schemaVersion": 1,
   "packageName": "termdock",
-  "version": "1.4.59",
+  "version": "1.4.61",
   "runtimeProtocolVersion": 1,
   "minimumDesktopVersion": "1.4.46",
   "nodeMajor": 22,
   "dependencyHash": "sha256-HxC6p3b4kFesefw+vmNYJtPtdIKJaZR1jFNb7DRJqjU=",
-  "serverBundleHash": "sha256-18XRnMd10r7JrY3vxiDJTSxPtdaDpyYWCKzlqWHfq9I=",
+  "serverBundleHash": "sha256-LCn7H9Y5FsrDIW4fPGpMsIQKA6h6pY/QNFtpIb/cARM=",
   "entrypoint": "dist/server/cli.js",
   "clientEntrypoint": "dist/client/index.html"
 }

package/dist/client/assets/channel-LdBDFRps.js

@@ -1 +0,0 @@
-import{U as a,C as n}from"./mermaid.core-DSPzdUTe.js";const t=(r,o)=>a.lang.round(n.parse(r)[o]);export{t as c};

package/dist/client/assets/classDiagram-OUVF2IWQ-B836Ofsf.js

@@ -1 +0,0 @@
-import{s as a,a as s,c as t,C as e}from"./chunk-V7JOEXUC-B5mnq3DX.js";import{b as i}from"./mermaid.core-DSPzdUTe.js";import"./chunk-5VM5RSS4-CwCLJYkK.js";import"./chunk-XXDRQBXY-BlHAakeI.js";import"./chunk-VR4S4FIN-Dc58ALhF.js";import"./chunk-32BRIVSS-DnwdpIMs.js";import"./purify.es-CC4Brkr_.js";import"./index-wM1B1hbM.js";import"./react-XDCjal2T.js";import"./dnd-BCFAPC0L.js";import"./terminal-C7X98Amf.js";var g={parser:t,get db(){return new e},renderer:s,styles:a,init:i(r=>{r.class||(r.class={}),r.class.arrowMarkerAbsolute=r.arrowMarkerAbsolute},"init")};export{g as diagram};

package/dist/client/assets/classDiagram-v2-EOCWNBFH-B836Ofsf.js

@@ -1 +0,0 @@
-import{s as a,a as s,c as t,C as e}from"./chunk-V7JOEXUC-B5mnq3DX.js";import{b as i}from"./mermaid.core-DSPzdUTe.js";import"./chunk-5VM5RSS4-CwCLJYkK.js";import"./chunk-XXDRQBXY-BlHAakeI.js";import"./chunk-VR4S4FIN-Dc58ALhF.js";import"./chunk-32BRIVSS-DnwdpIMs.js";import"./purify.es-CC4Brkr_.js";import"./index-wM1B1hbM.js";import"./react-XDCjal2T.js";import"./dnd-BCFAPC0L.js";import"./terminal-C7X98Amf.js";var g={parser:t,get db(){return new e},renderer:s,styles:a,init:i(r=>{r.class||(r.class={}),r.class.arrowMarkerAbsolute=r.arrowMarkerAbsolute},"init")};export{g as diagram};

package/dist/client/assets/stateDiagram-v2-6OUMAXLB-DXnU7NjN.js

@@ -1 +0,0 @@
-import{b as r,a as e,s as a,S as i}from"./chunk-EX3LRPZG-BOZ7Q5SG.js";import{b as s}from"./mermaid.core-DSPzdUTe.js";import"./chunk-XXDRQBXY-BlHAakeI.js";import"./chunk-VR4S4FIN-Dc58ALhF.js";import"./chunk-32BRIVSS-DnwdpIMs.js";import"./purify.es-CC4Brkr_.js";import"./index-wM1B1hbM.js";import"./react-XDCjal2T.js";import"./dnd-BCFAPC0L.js";import"./terminal-C7X98Amf.js";var g={parser:a,get db(){return new i(2)},renderer:e,styles:r,init:s(t=>{t.state||(t.state={}),t.state.arrowMarkerAbsolute=t.arrowMarkerAbsolute},"init")};export{g as diagram};

package/dist/client/assets/swimlanesDiagram-G3AALYLV-DTDpRtmY.js

@@ -1,8 +0,0 @@
-import{c as r,s as e}from"./flowDiagram-23GEKE2U-B3xYW3Ac.js";import{b as o}from"./mermaid.core-DSPzdUTe.js";import"./chunk-5VM5RSS4-CwCLJYkK.js";import"./chunk-XXDRQBXY-BlHAakeI.js";import"./chunk-VR4S4FIN-Dc58ALhF.js";import"./chunk-32BRIVSS-DnwdpIMs.js";import"./purify.es-CC4Brkr_.js";import"./channel-LdBDFRps.js";import"./index-wM1B1hbM.js";import"./react-XDCjal2T.js";import"./dnd-BCFAPC0L.js";import"./terminal-C7X98Amf.js";var a=o(t=>`${e(t)}
-  .swimlane.cluster rect {
-    stroke: ${t.clusterBorder} !important;
-  }
-  [data-look="neo"].cluster rect {
-    filter: none;
-  }
-`,"getStyles"),m=a,v=r({defaultLayout:"swimlane",styles:m});export{v as diagram};