webtun 1.4.1 → 1.4.3

package/README.md

@@ -106,7 +106,17 @@ npx webtun --tunnel               # With Cloudflare Tunnel
 npx webtun -p 4000 -t             # Port 4000 + tunnel
 ```
 
-**Note:** `node-pty` requires build tools on first install:
+**Note:** npm 12+ blocks install scripts by default. Allow them for `node-pty` (native module):
+```bash
+# Allow scripts once during install
+npm install -g --allow-scripts=webtun,node-pty webtun
+
+# Or allow globally (one-time setup)
+npm config set allow-scripts=webtun,node-pty --location=user
+npm install -g webtun
+```
+
+Build tools are also required (for compiling native modules):
 ```bash
 # Debian/Ubuntu
 sudo apt-get install -y python3 make g++

package/bin/webtun.js

@@ -23,7 +23,7 @@ function printHelp() {
     PORT                  Server port (default: 3000)
     HOST                  Bind address (default: 0.0.0.0)
     PIN                   Authentication PIN (empty = no auth)
-    SHELL                 Shell to use (default: /bin/bash or system shell)
+    SHELL                 Shell to use (default: PowerShell on Windows, bash/sh elsewhere)
     WORKSPACE_ROOT        Root directory for file operations (default: ~)
 
   Examples:
@@ -70,25 +70,20 @@ function parseArgs(argv) {
 }
 
 function startTunnel(port) {
-  const { execSync, spawn } = require('child_process');
-  const os = require('os');
+  const { spawn } = require('child_process');
+  const { findCloudflared } = require('../server');
 
-  // Check if cloudflared is installed
-  try {
-    if (os.platform() === 'win32') {
-      execSync('where cloudflared', { stdio: 'ignore' });
-    } else {
-      execSync('command -v cloudflared', { stdio: 'ignore' });
-    }
-  } catch {
+  const bin = findCloudflared();
+  if (!bin) {
     console.error('\n  Error: cloudflared is not installed.');
     console.error('  Install it from: https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/');
+    console.error('  Or re-run: npm install webtun  (postinstall downloads it)');
     return;
   }
 
-  console.log('\n  Starting Cloudflare Tunnel...');
+  console.log('  Starting Cloudflare Tunnel...');
 
-  const proc = spawn('cloudflared', ['tunnel', '--url', `http://localhost:${port}`], {
+  const proc = spawn(bin, ['tunnel', '--url', `http://localhost:${port}`], {
     stdio: ['ignore', 'pipe', 'pipe']
   });
 
@@ -121,23 +116,22 @@ function startTunnel(port) {
     }
   });
 
-  // Cleanup on exit
-  process.on('SIGINT', () => {
-    try { proc.kill('SIGTERM'); } catch {}
-    process.exit(0);
-  });
-  process.on('SIGTERM', () => {
+  const stop = () => {
     try { proc.kill('SIGTERM'); } catch {}
     process.exit(0);
-  });
+  };
+  process.on('SIGINT', stop);
+  process.on('SIGTERM', stop);
 }
 
 const opts = parseArgs(args);
-const { startServer } = require('../server');
+const { startServer, PORT } = require('../server');
+
+const listenPort = opts.port || PORT;
 
 startServer(opts).then(() => {
   if (opts.tunnel) {
-    startTunnel(opts.port || 3000);
+    startTunnel(listenPort);
   }
 }).catch(err => {
   console.error('Failed to start server:', err.message);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webtun",
-  "version": "1.4.1",
+  "version": "1.4.3",
   "description": "Self-hosted web terminal with Cloudflare Tunnel, file explorer, and PWA support",
   "author": {
     "name": "Gaurang Patel",
@@ -93,10 +93,12 @@
     }
   },
   "dependencies": {
+    "archiver": "^8.0.0",
     "express": "^4.18.2",
     "multer": "^2.0.0",
     "node-pty": "^1.0.0",
-    "ws": "^8.21.0"
+    "ws": "^8.21.0",
+    "yauzl": "^3.4.0"
   },
   "devDependencies": {
     "electron": "^42.2.0",
@@ -105,5 +107,8 @@
   },
   "overrides": {
     "form-data": "4.0.6"
+  },
+  "allowScripts": {
+    "node-pty@1.1.0": true
   }
 }

package/postinstall.js

@@ -2,6 +2,8 @@ const { execSync, spawnSync } = require('child_process');
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
+const https = require('https');
+const http = require('http');
 
 // ── Rebuild node-pty if native module is missing ─────────────────────
 function rebuildNodePty() {
@@ -18,16 +20,20 @@ function rebuildNodePty() {
     spawnSync('npm', ['rebuild', 'node-pty'], {
       cwd: __dirname,
       stdio: 'inherit',
-      timeout: 120000
+      timeout: 120000,
+      shell: os.platform() === 'win32'
     });
     // Verify it worked
+    delete require.cache[require.resolve('node-pty')];
     require('node-pty');
     console.log('  node-pty rebuilt successfully');
   } catch (e) {
     console.log('  node-pty rebuild failed: ' + e.message);
-    console.log('  Terminal requires build tools: python3, make, g++');
-    console.log('  Linux:  sudo apt-get install -y python3 make g++');
-    console.log('  macOS:  xcode-select --install');
+    console.log('  Terminal requires native build tools:');
+    console.log('  Linux:   sudo apt-get install -y python3 make g++');
+    console.log('  macOS:   xcode-select --install');
+    console.log('  Windows: install Visual Studio Build Tools with "Desktop development with C++"');
+    console.log('           https://visualstudio.microsoft.com/visual-cpp-build-tools/');
   }
 }
 
@@ -36,47 +42,101 @@ rebuildNodePty();
 // ── Install cloudflared ──────────────────────────────────────────────
 const CF_RELEASES = 'https://github.com/cloudflare/cloudflared/releases/latest/download';
 
-try {
-  if (os.platform() === 'win32') {
-    execSync('where cloudflared', { stdio: 'ignore' });
+function cloudflaredExists() {
+  try {
+    if (os.platform() === 'win32') {
+      execSync('where cloudflared', { stdio: 'ignore' });
+    } else {
+      execSync('command -v cloudflared', { stdio: 'ignore' });
+    }
+    return true;
+  } catch {}
+
+  const isWin = os.platform() === 'win32';
+  const name = isWin ? 'cloudflared.exe' : 'cloudflared';
+  const candidates = [
+    path.join(__dirname, name),
+    path.join(process.cwd(), name),
+  ];
+  if (isWin) {
+    const localApp = process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local');
+    candidates.push(path.join(localApp, 'cloudflared', name));
+    const pf = process.env.ProgramW6432 || process.env.ProgramFiles;
+    if (pf) candidates.push(path.join(pf, 'cloudflared', name));
   } else {
-    execSync('command -v cloudflared', { stdio: 'ignore' });
+    candidates.push(path.join(os.homedir(), '.local', 'bin', name));
+    candidates.push('/usr/local/bin/' + name);
   }
-} catch {
-  // cloudflared not found — install it
-  const platform = os.platform();
-  const arch = os.arch();
+  return candidates.some(c => {
+    try { return fs.existsSync(c) && fs.statSync(c).isFile(); } catch { return false; }
+  });
+}
 
-  const files = {
-    linux:   { x64: 'cloudflared-linux-amd64', arm64: 'cloudflared-linux-arm64', arm: 'cloudflared-linux-arm' },
-    darwin:  { x64: 'cloudflared-darwin-amd64.tgz', arm64: 'cloudflared-darwin-arm64.tgz' },
-    win32:   { x64: 'cloudflared-windows-amd64.exe' }
-  };
+if (cloudflaredExists()) process.exit(0);
 
-  const file = (files[platform] || {})[arch];
-  if (!file) process.exit(0);
+const platform = os.platform();
+const arch = os.arch();
 
-  console.log('  installing cloudflared...');
+const files = {
+  linux:   { x64: 'cloudflared-linux-amd64', arm64: 'cloudflared-linux-arm64', arm: 'cloudflared-linux-arm' },
+  darwin:  { x64: 'cloudflared-darwin-amd64.tgz', arm64: 'cloudflared-darwin-arm64.tgz' },
+  win32:   { x64: 'cloudflared-windows-amd64.exe', arm64: 'cloudflared-windows-amd64.exe' }
+};
 
-  const url = CF_RELEASES + '/' + file;
-  const tmpDir = os.tmpdir();
-  const tmp = path.join(tmpDir, 'cloudflared-' + process.pid + (platform === 'win32' ? '.exe' : ''));
+const file = (files[platform] || {})[arch];
+if (!file) process.exit(0);
 
-  function cleanup() {
-    try { fs.unlinkSync(tmp); } catch {}
-  }
+console.log('  installing cloudflared...');
 
-  function download() {
-    const r = spawnSync('curl', ['-#fL', url, '-o', tmp], { stdio: 'inherit', timeout: 60000 });
-    if (r.status === 0) return true;
-    const r2 = spawnSync('wget', ['-q', url, '-O', tmp], { stdio: 'inherit', timeout: 60000 });
-    return r2.status === 0;
-  }
+const url = CF_RELEASES + '/' + file;
+const tmpDir = os.tmpdir();
+const tmp = path.join(tmpDir, 'cloudflared-' + process.pid + (platform === 'win32' ? '.exe' : ''));
 
-  if (!download()) {
-    console.log('  cloudflared install failed (download error) — skipping');
-    cleanup();
-    process.exit(0);
+function cleanup() {
+  try { fs.unlinkSync(tmp); } catch {}
+}
+
+function downloadFile(downloadUrl, dest) {
+  return new Promise((resolve, reject) => {
+    const mod = downloadUrl.startsWith('https') ? https : http;
+    const req = mod.get(downloadUrl, { headers: { 'User-Agent': 'webtun-postinstall' } }, res => {
+      if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+        res.resume();
+        return downloadFile(res.headers.location, dest).then(resolve, reject);
+      }
+      if (res.statusCode !== 200) {
+        res.resume();
+        return reject(new Error('HTTP ' + res.statusCode));
+      }
+      const out = fs.createWriteStream(dest);
+      res.pipe(out);
+      out.on('finish', () => out.close(err => err ? reject(err) : resolve()));
+      out.on('error', reject);
+    });
+    req.on('error', reject);
+    req.setTimeout(60000, () => {
+      req.destroy();
+      reject(new Error('download timeout'));
+    });
+  });
+}
+
+function downloadWithCurlOrWget() {
+  const r = spawnSync('curl', ['-#fL', url, '-o', tmp], { stdio: 'inherit', timeout: 60000 });
+  if (r.status === 0) return true;
+  const r2 = spawnSync('wget', ['-q', url, '-O', tmp], { stdio: 'inherit', timeout: 60000 });
+  return r2.status === 0;
+}
+
+async function main() {
+  try {
+    await downloadFile(url, tmp);
+  } catch (e) {
+    if (!downloadWithCurlOrWget()) {
+      console.log('  cloudflared install failed (download error) — skipping');
+      cleanup();
+      process.exit(0);
+    }
   }
 
   // Validate downloaded file is not HTML (e.g. 404 page)
@@ -98,6 +158,7 @@ try {
   }
 
   function installBin(src, dest) {
+    fs.mkdirSync(path.dirname(dest), { recursive: true });
     try {
       fs.renameSync(src, dest);
     } catch (e) {
@@ -111,35 +172,61 @@ try {
     try { fs.chmodSync(dest, 0o755); } catch {}
   }
 
+  function preferredDest() {
+    const name = platform === 'win32' ? 'cloudflared.exe' : 'cloudflared';
+    if (platform === 'win32') {
+      const localApp = process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local');
+      return path.join(localApp, 'cloudflared', name);
+    }
+    return path.join(os.homedir(), '.local', 'bin', name);
+  }
+
+  function extractDarwinIfNeeded() {
+    if (platform !== 'darwin') return tmp;
+    const result = spawnSync('tar', ['xzf', tmp, '-C', tmpDir], { stdio: 'inherit' });
+    if (result.status !== 0) throw new Error('tar extraction failed');
+    try { fs.unlinkSync(tmp); } catch {}
+    return path.join(tmpDir, 'cloudflared');
+  }
+
   try {
-    if (platform === 'darwin') {
-      const result = spawnSync('tar', ['xzf', tmp, '-C', tmpDir], { stdio: 'inherit' });
-      if (result.status !== 0) throw new Error('tar extraction failed');
-      installBin(path.join(tmpDir, 'cloudflared'), '/usr/local/bin/cloudflared');
-      try { fs.unlinkSync(tmp); } catch {}
-    } else if (platform === 'win32') {
-      const progFiles = process.env.ProgramW6432 || process.env.ProgramFiles || (process.env.SystemRoot + '\\Program Files');
-      const dest = path.join(progFiles, 'cloudflared', 'cloudflared.exe');
-      fs.mkdirSync(path.dirname(dest), { recursive: true });
-      installBin(tmp, dest);
-    } else {
-      installBin(tmp, '/usr/local/bin/cloudflared');
+    const src = extractDarwinIfNeeded();
+    // Prefer user-local path (no admin), then package dir, then system
+    const dests = [preferredDest(), path.join(__dirname, platform === 'win32' ? 'cloudflared.exe' : 'cloudflared')];
+    if (platform !== 'win32') dests.push('/usr/local/bin/cloudflared');
+    else {
+      const pf = process.env.ProgramW6432 || process.env.ProgramFiles;
+      if (pf) dests.push(path.join(pf, 'cloudflared', 'cloudflared.exe'));
     }
-    console.log('  cloudflared installed');
-    cleanup();
-  } catch (e) {
-    if (e.code === 'EACCES' || e.code === 'EPERM') {
-      const localDest = path.join(process.cwd(), 'cloudflared' + (platform === 'win32' ? '.exe' : ''));
+
+    let installed = null;
+    let lastErr = null;
+    for (const dest of dests) {
       try {
-        installBin(tmp, localDest);
-        console.log('  cloudflared installed to ' + localDest);
-        console.log('  Move it to your PATH: sudo mv ' + localDest + ' /usr/local/bin/');
-      } catch (e2) {
-        console.log('  cloudflared install failed: ' + e2.message + ' — skipping');
+        installBin(src, dest);
+        installed = dest;
+        break;
+      } catch (e) {
+        lastErr = e;
+      }
+    }
+
+    if (installed) {
+      console.log('  cloudflared installed → ' + installed);
+      if (platform === 'win32' && installed.includes('Local')) {
+        console.log('  (not on PATH; WebTun will find it automatically)');
       }
     } else {
-      console.log('  cloudflared install failed: ' + e.message + ' — skipping');
+      console.log('  cloudflared install failed: ' + (lastErr && lastErr.message) + ' — skipping');
     }
     cleanup();
+  } catch (e) {
+    console.log('  cloudflared install failed: ' + e.message + ' — skipping');
+    cleanup();
   }
 }
+
+main().catch(e => {
+  console.log('  cloudflared install failed: ' + e.message + ' — skipping');
+  cleanup();
+});

package/public/index.html

@@ -1152,6 +1152,7 @@ svg { display: block; }
             <div style="display:flex;align-items:center;gap:8px">
               <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="var(--accent)" stroke-width="2"><path d="M9 19c-5 1.5-5-2.5-7-3m14 6v-3.87a3.37 3.37 0 0 0-.94-2.61c3.14-.35 6.44-1.54 6.44-7A5.44 5.44 0 0 0 20 4.77 5.07 5.07 0 0 0 19.91 1S18.73.65 16 2.48a13.38 13.38 0 0 0-7 0C6.27.65 5.09 1 5.09 1A5.07 5.07 0 0 0 5 4.77a5.44 5.44 0 0 0-1.5 3.78c0 5.42 3.3 6.61 6.44 7A3.37 3.37 0 0 0 9 18.13V22"/></svg>
               <span>WebTun</span>
+              <span id="about-version" style="color:var(--fg3);font-size:11px"></span>
             </div>
             <div style="display:flex;align-items:center;gap:8px">
               <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="var(--fg2)" stroke-width="2"><path d="M20 21v-2a4 4 0 0 0-4-4H8a4 4 0 0 0-4 4v2"/><circle cx="12" cy="7" r="4"/></svg>
@@ -2437,27 +2438,74 @@ function formatSize(bytes) {
   return (bytes / 1073741824).toFixed(1) + ' GB';
 }
 
-function renderBreadcrumb(path) {
+function renderBreadcrumb(fullPath) {
   const el = document.getElementById('file-breadcrumb');
   if (!el) return;
-  const parts = path.replace(/^\/+|\/+$/g, '').split('/').filter(Boolean);
+  const isWin = /\\/.test(fullPath) || /^[A-Za-z]:/.test(fullPath);
+  const sep = isWin ? '\\' : '/';
   let html = '';
-  let accumulated = '';
-  for (const part of parts) {
-    accumulated += '/' + part;
-    const isLast = part === parts[parts.length - 1];
-    if (isLast) {
-      html += `<span style="color:var(--fg);font-weight:500">${escHtml(part)}</span>`;
+
+  if (isWin) {
+    // e.g. C:\Users\name or \\server\share\path
+    const normalized = fullPath.replace(/\//g, '\\');
+    const unc = normalized.startsWith('\\\\');
+    let rest = normalized;
+    let accumulated = '';
+    const segments = [];
+
+    if (unc) {
+      const m = normalized.match(/^\\\\[^\\]+\\[^\\]+/);
+      if (m) {
+        segments.push({ label: m[0], path: m[0] });
+        rest = normalized.slice(m[0].length).replace(/^\\+/, '');
+        accumulated = m[0];
+      }
     } else {
-      html += `<a href="#" data-path="${escHtml(accumulated)}" style="color:var(--accent);text-decoration:none;padding:4px 2px;display:inline-block">${escHtml(part)}</a>`;
-      html += `<span style="color:var(--fg2);margin:0 2px">/</span>`;
+      const driveMatch = normalized.match(/^([A-Za-z]:)(.*)$/);
+      if (driveMatch) {
+        const root = driveMatch[1] + '\\';
+        segments.push({ label: driveMatch[1], path: root });
+        rest = (driveMatch[2] || '').replace(/^\\+/, '');
+        accumulated = root;
+      }
+    }
+
+    const parts = rest.split('\\').filter(Boolean);
+    for (let i = 0; i < parts.length; i++) {
+      accumulated = accumulated.endsWith('\\') ? accumulated + parts[i] : accumulated + '\\' + parts[i];
+      segments.push({ label: parts[i], path: accumulated });
+    }
+
+    if (!segments.length) {
+      html = `<span style="color:var(--fg2)">\\</span><span style="color:var(--fg2);font-size:11px;margin-left:6px">(root)</span>`;
+    } else {
+      html = segments.map((seg, i) => {
+        const isLast = i === segments.length - 1;
+        if (isLast) return `<span style="color:var(--fg);font-weight:500">${escHtml(seg.label)}</span>`;
+        return `<a href="#" data-path="${escHtml(seg.path)}" style="color:var(--accent);text-decoration:none;padding:4px 2px;display:inline-block">${escHtml(seg.label)}</a>` +
+          `<span style="color:var(--fg2);margin:0 2px">\\</span>`;
+      }).join('');
+    }
+  } else {
+    const parts = fullPath.replace(/^\/+|\/+$/g, '').split('/').filter(Boolean);
+    let accumulated = '';
+    for (const part of parts) {
+      accumulated += '/' + part;
+      const isLast = part === parts[parts.length - 1];
+      if (isLast) {
+        html += `<span style="color:var(--fg);font-weight:500">${escHtml(part)}</span>`;
+      } else {
+        html += `<a href="#" data-path="${escHtml(accumulated)}" style="color:var(--accent);text-decoration:none;padding:4px 2px;display:inline-block">${escHtml(part)}</a>`;
+        html += `<span style="color:var(--fg2);margin:0 2px">/</span>`;
+      }
+    }
+    if (!parts.length) {
+      html = `<span style="color:var(--fg2)">/</span><span style="color:var(--fg2);font-size:11px;margin-left:6px">(root)</span>`;
     }
   }
-  if (!parts.length) {
-    html = `<span style="color:var(--fg2)">/</span><span style="color:var(--fg2);font-size:11px;margin-left:6px">(root)</span>`;
-  }
+
   el.innerHTML = '<svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" style="color:var(--fg2);margin-right:4px;vertical-align:middle"><path d="M22 19a2 2 0 01-2 2H4a2 2 0 01-2-2V5a2 2 0 012-2h5l2 3h9a2 2 0 012 2z"/></svg>' + html;
-  
+
   if (!el.dataset.delegated) {
     el.addEventListener('click', e => {
       const a = e.target.closest('a[data-path]');
@@ -4947,6 +4995,12 @@ function registerSW() {
 // ═══════════════════════════════════════════════════════
 init().catch(e => console.error('Init failed:', e));
 
+// Set version in About section
+fetch('/api/version').then(r => r.json()).then(d => {
+  const el = document.getElementById('about-version');
+  if (el) el.textContent = 'v' + (d.version || '');
+}).catch(() => {});
+
 // Warn before closing if there are unsaved changes or active terminals
 window.addEventListener('beforeunload', e => {
   const editorOpen = document.getElementById('editor-view').classList.contains('open');

package/server.js

@@ -14,17 +14,29 @@ try {
 } catch {}
 
 const express = require('express');
-const http = require('http');
 const WebSocket = require('ws');
 let pty;
 try {
   pty = require('node-pty');
 } catch (e) {
-  console.error('\n  Error: node-pty failed to load. Terminal functionality requires native build tools.');
-  console.error('  Install build tools and reinstall:');
-  console.error('    Linux:  sudo apt-get install -y python3 make g++');
-  console.error('    macOS:  xcode-select --install');
-  console.error('  Then reinstall: npm install webtun\n');
+  console.error('');
+  console.error('  Error: node-pty native module not found.');
+  console.error('');
+  console.error('  npm 12+ blocks install scripts by default. To fix:');
+  console.error('');
+  console.error('  Option 1 — Allow scripts once:');
+  console.error('    npm install -g --allow-scripts=webtun,node-pty webtun');
+  console.error('');
+  console.error('  Option 2 — Allow scripts globally (one-time):');
+  console.error('    npm config set allow-scripts=webtun,node-pty --location=user');
+  console.error('    npm install -g webtun');
+  console.error('');
+  console.error('  Option 3 — If building from source, install build tools first:');
+  console.error('    Linux:   sudo apt-get install -y python3 make g++');
+  console.error('    macOS:   xcode-select --install');
+  console.error('    Windows: install "Desktop development with C++" (Visual Studio Build Tools)');
+  console.error('             https://visualstudio.microsoft.com/visual-cpp-build-tools/');
+  console.error('');
   process.exit(1);
 }
 const multer = require('multer');
@@ -33,6 +45,10 @@ const path = require('path');
 const os = require('os');
 const crypto = require('crypto');
 const { execSync, execFileSync, spawn } = require('child_process');
+const archiver = require('archiver');
+const yauzl = require('yauzl');
+const https = require('https');
+const http = require('http');
 
 // MIME type lookup without mime-types dependency
 const MIME_MAP = {
@@ -136,6 +152,10 @@ app.get('/api/auth/required', (req, res) => {
   res.json({ required: !!PIN });
 });
 
+app.get('/api/version', (req, res) => {
+  res.json({ version: require('./package.json').version });
+});
+
 app.post('/api/auth', authRateLimiter, (req, res) => {
   const { pin } = req.body;
   if (!PIN || (pin && constantTimeEqual(pin, PIN))) {
@@ -166,6 +186,188 @@ function realPath(targetPath) {
   try { return fs.realpathSync(resolved); } catch { return resolved; }
 }
 
+// Case-aware path containment (Windows paths are case-insensitive).
+function pathContained(parent, child) {
+  let p = path.resolve(parent);
+  let c = path.resolve(child);
+  if (os.platform() === 'win32') {
+    p = p.replace(/\\/g, '/').toLowerCase();
+    c = c.replace(/\\/g, '/').toLowerCase();
+    if (!p.endsWith('/')) p += '/';
+    return c === p.slice(0, -1) || c.startsWith(p);
+  }
+  return c === p || c.startsWith(p + path.sep);
+}
+
+async function renameWithFallback(src, dst) {
+  try {
+    await fsPromises.rename(src, dst);
+  } catch (e) {
+    if (e.code === 'EXDEV') {
+      await fsPromises.cp(src, dst, { recursive: true, force: true });
+      await fsPromises.rm(src, { recursive: true, force: true });
+    } else {
+      throw e;
+    }
+  }
+}
+
+async function dirSize(dir) {
+  let total = 0;
+  async function walk(d) {
+    let entries;
+    try { entries = await fsPromises.readdir(d, { withFileTypes: true }); } catch { return; }
+    await Promise.all(entries.map(async e => {
+      const full = path.join(d, e.name);
+      try {
+        if (e.isDirectory()) await walk(full);
+        else if (e.isFile()) {
+          const st = await fsPromises.stat(full);
+          total += st.size;
+        }
+      } catch {}
+    }));
+  }
+  await walk(dir);
+  return total;
+}
+
+function createZipArchive(entries, zipPath) {
+  return new Promise((resolve, reject) => {
+    const output = fs.createWriteStream(zipPath);
+    const archive = archiver('zip', { zlib: { level: 6 } });
+    output.on('close', () => resolve());
+    output.on('error', reject);
+    archive.on('error', reject);
+    archive.pipe(output);
+    for (const entry of entries) {
+      try {
+        const st = fs.statSync(entry.fullPath);
+        if (st.isDirectory()) archive.directory(entry.fullPath, entry.nameInZip);
+        else archive.file(entry.fullPath, { name: entry.nameInZip });
+      } catch (e) {
+        return reject(e);
+      }
+    }
+    archive.finalize();
+  });
+}
+
+function streamZipDirectory(dirPath, res) {
+  const archive = archiver('zip', { zlib: { level: 6 } });
+  archive.on('error', err => {
+    if (!res.headersSent) res.status(500).json({ error: err.message });
+    else res.end();
+  });
+  archive.pipe(res);
+  archive.directory(dirPath, path.basename(dirPath));
+  archive.finalize();
+}
+
+function extractZip(zipPath, destDir) {
+  return new Promise((resolve, reject) => {
+    yauzl.open(zipPath, { lazyEntries: true }, (err, zipfile) => {
+      if (err) return reject(err);
+      zipfile.readEntry();
+      zipfile.on('entry', entry => {
+        const entryName = entry.fileName.replace(/\\/g, '/');
+        const entryPath = path.normalize(entryName);
+        if (entryPath.startsWith('..') || path.isAbsolute(entryPath) || entryName.includes('\0')) {
+          return reject(new Error('Invalid zip entry: ' + entry.fileName));
+        }
+        const target = path.join(destDir, entryPath);
+        if (!pathContained(destDir, target)) {
+          return reject(new Error('Zip entry escapes destination directory'));
+        }
+        if (/\/$/.test(entryName)) {
+          fs.mkdirSync(target, { recursive: true });
+          zipfile.readEntry();
+          return;
+        }
+        fs.mkdirSync(path.dirname(target), { recursive: true });
+        zipfile.openReadStream(entry, (err2, readStream) => {
+          if (err2) return reject(err2);
+          const writeStream = fs.createWriteStream(target);
+          readStream.on('error', reject);
+          writeStream.on('error', reject);
+          writeStream.on('close', () => zipfile.readEntry());
+          readStream.pipe(writeStream);
+        });
+      });
+      zipfile.on('end', () => resolve());
+      zipfile.on('error', reject);
+    });
+  });
+}
+
+function findCloudflared() {
+  const isWin = os.platform() === 'win32';
+  const name = isWin ? 'cloudflared.exe' : 'cloudflared';
+  const candidates = [
+    path.join(__dirname, name),
+    path.join(process.cwd(), name),
+  ];
+  if (isWin) {
+    const localApp = process.env.LOCALAPPDATA || path.join(os.homedir(), 'AppData', 'Local');
+    candidates.push(path.join(localApp, 'cloudflared', name));
+    const pf = process.env.ProgramW6432 || process.env.ProgramFiles;
+    if (pf) candidates.push(path.join(pf, 'cloudflared', name));
+  } else {
+    candidates.push(path.join(os.homedir(), '.local', 'bin', name));
+    candidates.push('/usr/local/bin/' + name);
+    candidates.push('/usr/bin/' + name);
+  }
+  for (const c of candidates) {
+    try { if (fs.existsSync(c) && fs.statSync(c).isFile()) return c; } catch {}
+  }
+  try {
+    const cmd = isWin ? 'where cloudflared' : 'command -v cloudflared';
+    const out = execSync(cmd, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim().split(/\r?\n/)[0];
+    if (out && fs.existsSync(out)) return out;
+  } catch {}
+  return null;
+}
+
+function killPid(pid, signal = 'SIGTERM') {
+  if (typeof pid !== 'number' || !Number.isInteger(pid) || pid <= 0) return;
+  try {
+    if (os.platform() === 'win32') {
+      execSync(`taskkill /PID ${pid} /T /F`, { stdio: 'ignore' });
+    } else {
+      process.kill(pid, signal);
+    }
+  } catch {}
+}
+
+function buildSessionEnv() {
+  if (os.platform() === 'win32') {
+    const env = { ...process.env };
+    env.TERM = env.TERM || 'xterm-256color';
+    env.COLORTERM = env.COLORTERM || 'truecolor';
+    if (!env.HOME && env.USERPROFILE) env.HOME = env.USERPROFILE;
+    if (!env.USER && env.USERNAME) env.USER = env.USERNAME;
+    env.SHELL = SHELL;
+    // Prefer Path (Windows) over PATH if both set
+    if (env.Path && !env.PATH) env.PATH = env.Path;
+    return env;
+  }
+  const safe = {
+    TERM: 'xterm-256color',
+    COLORTERM: 'truecolor',
+    HOME: process.env.HOME || '',
+    USER: process.env.USER || '',
+    PATH: process.env.PATH || '/usr/local/bin:/usr/bin:/bin',
+    LANG: process.env.LANG || 'C.UTF-8',
+    SHELL
+  };
+  if (process.env.NODE_ENV) safe.NODE_ENV = process.env.NODE_ENV;
+  // Preserve common terminal/locale vars when present
+  for (const k of ['LC_ALL', 'LC_CTYPE', 'TERM_PROGRAM', 'COLORFGBG']) {
+    if (process.env[k]) safe[k] = process.env[k];
+  }
+  return safe;
+}
+
 async function safeStat(p) {
   try { return await fsPromises.stat(p); } catch { return null; }
 }
@@ -273,7 +475,7 @@ app.post('/api/files/rename', checkPin, async (req, res) => {
     }
     const oldPath = realPath(req.body.oldPath);
     const newPath = realPath(path.join(path.dirname(oldPath), req.body.newName));
-    await fsPromises.rename(oldPath, newPath);
+    await renameWithFallback(oldPath, newPath);
     res.json({ success: true, newPath });
   } catch (e) {
     res.status(500).json({ error: e.message });
@@ -322,7 +524,7 @@ async function resolveCopyMove(src, dst, conflict, isMove) {
       }
       await fsPromises.rm(src, { recursive: true, force: true });
     } else {
-      await fsPromises.rename(src, dst);
+      await renameWithFallback(src, dst);
     }
   } else {
     if (isDir) {
@@ -410,7 +612,7 @@ app.post('/api/files/zip', checkPin, async (req, res) => {
       return res.status(400).json({ error: 'path is required', usage: 'POST JSON { "path": "<file_or_dir>" }' });
     }
     const p = realPath(req.body.path);
-    const st = await fsPromises.stat(p);
+    await fsPromises.stat(p);
     const baseName = path.basename(p);
     let zipName = baseName + '.zip';
     let zipPath = path.join(path.dirname(p), zipName);
@@ -421,13 +623,7 @@ app.post('/api/files/zip', checkPin, async (req, res) => {
       zipPath = path.join(path.dirname(p), zipName);
       counter++;
     }
-    const zipDir = path.dirname(zipPath);
-    const zipTarget = path.basename(zipPath);
-    if (st.isDirectory()) {
-      execSync(`zip -r -6 "${zipTarget}" "${baseName}"`, { cwd: zipDir, stdio: 'pipe' });
-    } else {
-      execSync(`zip -6 "${zipTarget}" "${baseName}"`, { cwd: zipDir, stdio: 'pipe' });
-    }
+    await createZipArchive([{ fullPath: p, nameInZip: baseName }], zipPath);
     res.json({ success: true, name: zipName });
   } catch (e) {
     res.status(500).json({ error: e.message });
@@ -445,23 +641,8 @@ app.post('/api/files/unzip', checkPin, async (req, res) => {
     if (ext !== '.zip') return res.status(400).json({ error: 'Not a zip file' });
     const destDir = path.join(path.dirname(p), path.basename(p, '.zip'));
     await fsPromises.mkdir(destDir, { recursive: true });
-    // Security: scan zip entries before extraction
-    const unzipList = execSync(`unzip -l "${p}"`, { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] });
-    for (const line of unzipList.split('\n')) {
-      const match = line.match(/^\s*\S+\s+\S+\s+(.+)$/);
-      if (match) {
-        const entryPath = path.normalize(match[1]);
-        if (entryPath.startsWith('..') || path.isAbsolute(entryPath)) {
-          return res.status(400).json({ error: 'Invalid zip entry: ' + match[1] });
-        }
-        const target = path.join(destDir, entryPath);
-        if (!target.startsWith(destDir + path.sep) && target !== destDir) {
-          return res.status(400).json({ error: 'Zip entry escapes destination directory' });
-        }
-      }
-    }
     try {
-      execSync(`unzip -o "${p}" -d "${destDir}"`, { stdio: 'pipe' });
+      await extractZip(p, destDir);
     } catch (e) {
       return res.status(500).json({ error: e.message });
     }
@@ -526,13 +707,7 @@ app.get('/api/files/download', checkPin, async (req, res) => {
     if (st.isDirectory()) {
       res.setHeader('Content-Type', 'application/zip');
       res.setHeader('Content-Disposition', `attachment; filename="${path.basename(p)}.zip"`);
-      // Stream zip to response via system zip command
-      const zipProc = spawn('zip', ['-r', '-6', '-', path.basename(p)], { cwd: path.dirname(p), stdio: ['ignore', 'pipe', 'pipe'] });
-      zipProc.stdout.pipe(res);
-      zipProc.on('error', err => {
-        if (!res.headersSent) res.status(500).json({ error: err.message });
-      });
-      zipProc.on('close', code => { if (code !== 0 && !res.headersSent) res.status(500).json({ error: 'zip failed' }); });
+      streamZipDirectory(p, res);
       return;
     } else {
       const mimeType = mimeLookup(p);
@@ -562,7 +737,7 @@ app.post('/api/files/upload', checkPin, (req, res) => {
       try {
         const safeName = path.basename(file.originalname).replace(/[^a-zA-Z0-9_.\-]/g, '_');
         const finalDest = path.join(destDir, safeName);
-        if (!finalDest.startsWith(destDir + path.sep) && finalDest !== destDir) {
+        if (!pathContained(destDir, finalDest)) {
           return cb(new Error('Invalid upload destination'));
         }
         const subPath = path.dirname(finalDest);
@@ -630,8 +805,7 @@ app.get('/api/files/size', checkPin, async (req, res) => {
     if (!st.isDirectory()) {
       return res.json({ path: p, size: st.size, isDir: false });
     }
-    const out = execFileSync('du', ['-sb', p], { encoding: 'utf8', stdio: 'pipe', timeout: 30000 });
-    const size = parseInt(out.split('\t')[0], 10);
+    const size = await dirSize(p);
     res.json({ path: p, size, isDir: true });
   } catch (e) {
     res.status(500).json({ error: e.message });
@@ -801,23 +975,18 @@ app.post('/api/files/batch-zip', checkPin, async (req, res) => {
     }
     let dest = realPath(req.body.destination);
     const resolved = req.body.sources.map(s => realPath(s));
-    // Prevent zipping workspace root
     // Auto-rename if destination exists
     let counter = 1;
     const ext = '.zip';
     const origDest = dest;
     while (true) {
       try { await fsPromises.access(dest); } catch { break; }
-      dest = origDest.replace(/(\.zip)?$/, ` (${counter})${ext}`);
+      dest = origDest.replace(/(\.zip)?$/i, ` (${counter})${ext}`);
       counter++;
     }
-    const zipDir = path.dirname(dest);
-    const zipTarget = path.basename(dest);
-    const zipArgs = resolved.map(s => {
-      const rel = path.relative(zipDir, s);
-      return `"${rel}"`;
-    });
-    execSync(`zip -r -6 "${zipTarget}" ${zipArgs.join(' ')}`, { cwd: zipDir, stdio: 'pipe' });
+    await fsPromises.mkdir(path.dirname(dest), { recursive: true });
+    const entries = resolved.map(s => ({ fullPath: s, nameInZip: path.basename(s) }));
+    await createZipArchive(entries, dest);
     res.json({ success: true, name: path.basename(dest), files: req.body.sources.length });
   } catch (e) {
     res.status(500).json({ error: e.message });
@@ -1080,11 +1249,7 @@ wss.on('connection', (ws, req) => {
   }
   const sessionId = (url.searchParams.get('session') || '').replace(/[^a-zA-Z0-9_-]/g, '');
 
-  const sessionEnv = (() => {
-    const safe = { TERM: 'xterm-256color', COLORTERM: 'truecolor', HOME: process.env.HOME || '', USER: process.env.USER || '', PATH: process.env.PATH || '/usr/local/bin:/usr/bin:/bin', LANG: process.env.LANG || 'C.UTF-8', SHELL: SHELL };
-    if (process.env.NODE_ENV) safe.NODE_ENV = process.env.NODE_ENV;
-    return safe;
-  })();
+  const sessionEnv = buildSessionEnv();
 
   const send = (type, payload) => {
     if (ws.readyState !== WebSocket.OPEN) return;
@@ -1370,16 +1535,31 @@ async function verifyTunnelUrl(url, retries = 3) {
   return false;
 }
 
+function spawnCloudflared(args, opts = {}) {
+  const bin = findCloudflared();
+  if (!bin) {
+    const err = new Error('cloudflared not installed');
+    err.code = 'ENOENT';
+    throw err;
+  }
+  return spawn(bin, args, opts);
+}
+
 function restartTunnel(id, entry) {
   if (!entry.localUrl) return;
   try { if (entry.proc) entry.proc.kill('SIGTERM'); } catch {}
-  try { if (entry.pid && isCloudflaredProcess(entry.pid)) process.kill(entry.pid, 'SIGTERM'); } catch {}
+  try { if (entry.pid && isCloudflaredProcess(entry.pid)) killPid(entry.pid); } catch {}
   tunnels.delete(id);
 
   const url = entry.localUrl;
-  const proc = spawn('cloudflared', ['tunnel', '--url', url], {
-    detached: true, stdio: ['ignore', 'pipe', 'pipe']
-  });
+  let proc;
+  try {
+    proc = spawnCloudflared(['tunnel', '--url', url], {
+      detached: true, stdio: ['ignore', 'pipe', 'pipe']
+    });
+  } catch {
+    return;
+  }
   proc.unref();
 
   const handler = data => {
@@ -1453,12 +1633,18 @@ app.post('/api/tunnel', checkPin, async (req, res) => {
   const { url } = req.body;
   if (!url) return res.status(400).json({ error: 'url required' });
 
-  try { execSync(os.platform() === 'win32' ? 'where cloudflared' : 'command -v cloudflared', { stdio: 'ignore' }); }
-  catch { return res.status(500).json({ error: 'cloudflared not installed' }); }
+  if (!findCloudflared()) {
+    return res.status(500).json({ error: 'cloudflared not installed' });
+  }
 
-  const proc = spawn('cloudflared', ['tunnel', '--url', url], {
-    detached: true, stdio: ['ignore', 'pipe', 'pipe']
-  });
+  let proc;
+  try {
+    proc = spawnCloudflared(['tunnel', '--url', url], {
+      detached: true, stdio: ['ignore', 'pipe', 'pipe']
+    });
+  } catch (e) {
+    return res.status(500).json({ error: e.message });
+  }
   proc.unref();
   let tunnelUrl = null;
   const timeout = 15000;
@@ -1482,7 +1668,7 @@ app.post('/api/tunnel', checkPin, async (req, res) => {
   });
 
   try {
-    const result = await Promise.race([
+    await Promise.race([
       urlPromise,
       new Promise((_, reject) => setTimeout(() => reject(new Error('timeout')), timeout))
     ]);
@@ -1493,7 +1679,7 @@ app.post('/api/tunnel', checkPin, async (req, res) => {
     saveTunnels();
     res.json({ success: true, id, url: tunnelUrl, verified: urlOk });
   } catch (e) {
-    try { proc.kill(); } catch {}
+    try { if (proc.pid) killPid(proc.pid); else proc.kill(); } catch {}
     res.status(500).json({ error: e.message === 'timeout' ? 'Timed out waiting for tunnel URL' : e.message });
   }
 });
@@ -1504,9 +1690,10 @@ app.delete('/api/tunnel', checkPin, (req, res) => {
   const entry = tunnels.get(id);
   try {
     if (entry.proc) {
-      entry.proc.kill('SIGTERM');
+      try { entry.proc.kill('SIGTERM'); } catch {}
+      if (entry.proc.pid) killPid(entry.proc.pid);
     } else if (entry.pid && isCloudflaredProcess(entry.pid)) {
-      process.kill(entry.pid, 'SIGTERM');
+      killPid(entry.pid);
     }
   } catch {}
   tunnels.delete(id);
@@ -1519,8 +1706,12 @@ app.delete('/api/tunnel', checkPin, (req, res) => {
 function cleanup() {
   for (const [id, entry] of tunnels) {
     try {
-      if (entry.proc) entry.proc.kill('SIGTERM');
-      else if (entry.pid && isCloudflaredProcess(entry.pid)) process.kill(entry.pid, 'SIGTERM');
+      if (entry.proc) {
+        try { entry.proc.kill('SIGTERM'); } catch {}
+        if (entry.proc.pid) killPid(entry.proc.pid);
+      } else if (entry.pid && isCloudflaredProcess(entry.pid)) {
+        killPid(entry.pid);
+      }
     } catch {}
   }
   if (TMUX) {
@@ -1541,60 +1732,12 @@ function startServer(opts = {}) {
   loadTunnels();
   cleanupOrphanTmuxSessions();
 
-  return new Promise((resolve) => {
+  return new Promise((resolve, reject) => {
+    server.once('error', reject);
     server.listen(port, host, () => {
-      console.log(`\n  WebTun running → http://localhost:${port}\n`);
-      if (PIN) console.log(`  PIN protection enabled\n`);
-      console.log(`  File API examples:`);
-      console.log(`    GET    /api/files?path=<dir>             — list directory`);
-      console.log(`    GET    /api/files/read?path=<file>       — read file content`);
-      console.log(`    POST   /api/files/write                  — write file  { path, content }`);
-      console.log(`    POST   /api/files/upload?path=<dir>      — upload files (multipart)`);
-      console.log(`    GET    /api/files/download?path=<path>   — download file/dir`);
-      console.log(`    GET    /api/files/image?path=<file>      — view image inline`);
-      console.log(`    POST   /api/files/rename                 — rename       { oldPath, newName }`);
-      console.log(`    POST   /api/files/copy                   — copy         { source, destination, conflict? }`);
-      console.log(`    POST   /api/files/move                   — move         { source, destination, conflict? }`);
-      console.log(`    DELETE /api/files?path=<path>            — delete file/dir`);
-      console.log(`    POST   /api/files/mkdir                  — create dir   { path }`);
-      console.log(`    POST   /api/files/touch                  — create file  { path }`);
-      console.log(`    POST   /api/files/zip                    — create zip   { path }`);
-      console.log(`    POST   /api/files/unzip                  — extract zip  { path }`);
-      console.log(`    GET    /api/search?q=<query>&path=<dir>  — search files`);
-      console.log(`    GET    /api/files/stat?path=<path>        — file metadata`);
-      console.log(`    POST   /api/files/batch-delete            — bulk delete     { paths: [...] }`);
-      console.log(`    POST   /api/files/batch-copy              — bulk copy       { sources: [...], destination, conflict? }`);
-      console.log(`    POST   /api/files/batch-move              — bulk move       { sources: [...], destination, conflict? }`);
-      console.log(`    POST   /api/files/chmod                   — change perms    { path, mode }`);
-      console.log(`    POST   /api/files/symlink                 — create symlink  { target, linkPath }`);
-      console.log(`    POST   /api/files/search-content          — full-text search { query, path, pattern?, maxResults? }`);
-      console.log(`    POST   /api/files/batch-zip               — multi-source zip { sources: [...], destination }`);
-      console.log(`    POST   /api/files/trash                   — trash files     { paths: [...] }`);
-      console.log(`    GET    /api/files/trash                   — list trash`);
-      console.log(`    POST   /api/files/trash/restore           — restore trash   { path }`);
-      console.log(`    DELETE /api/files/trash?path=<path>       — delete trash item permanently`);
-      console.log(`    DELETE /api/files/trash/all               — empty entire trash`);
-      console.log(`    GET    /api/files/preview?path=<file>      — file preview (md→html, code)`);
-      console.log(`    GET    /api/files/tail?path=<file>&lines=N  — tail log file (SSE)`);
-      console.log(`  Git API:`);
-      console.log(`    GET    /api/git/status?path=<dir>           — git status`);
-      console.log(`    POST   /api/git/diff                        — git diff       { path, file? }`);
-      console.log(`    POST   /api/git/add                         — git add        { path, files? }`);
-      console.log(`    POST   /api/git/commit                      — git commit     { path, message }`);
-      console.log(`    GET    /api/git/log?path=<dir>&maxCount=N   — git log`);
-      console.log(`    POST   /api/git/push                        — git push       { path, remote?, branch? }`);
-      console.log(`    POST   /api/git/pull                        — git pull       { path, remote?, branch? }`);
-      console.log(`    GET    /api/git/branches?path=<dir>         — list branches`);
-      console.log(`    POST   /api/git/branch                      — create branch  { path, name, switch? }`);
-      console.log(`    GET    /api/git/remote?path=<dir>           — list remotes`);
-      console.log(`  System:`);
-      console.log(`    GET    /api/system/network                  — network interfaces, ports`);
-      console.log(`    GET    /api/env                             — environment variables`);
-      console.log(`  Clipboard:`);
-      console.log(`    GET    /api/clipboard                       — clipboard contents`);
-      console.log(`    POST   /api/clipboard                       — set clipboard  { sources, action }`);
-      console.log(`    POST   /api/clipboard/paste                 — paste          { destination, conflict? }`);
-      console.log(`    DELETE /api/clipboard                       — clear clipboard`);
+      console.log(`\n  WebTun running → http://localhost:${port}`);
+      if (PIN) console.log(`  PIN protection enabled`);
+      console.log('');
       resolve(server);
     });
   });
@@ -1613,7 +1756,7 @@ process.on('SIGTERM', () => { try { cleanup(); } catch {}; process.exit(0); });
 process.on('SIGINT', () => { try { cleanup(); } catch {}; process.exit(0); });
 process.on('exit', () => { try { cleanup(); } catch {} });
 
-module.exports = { app, server, startServer, PORT, PIN, WORKSPACE_ROOT };
+module.exports = { app, server, startServer, PORT, PIN, WORKSPACE_ROOT, findCloudflared };
 
 if (require.main === module) {
   startServer();