webtun 1.4.3 → 1.4.5

package/README.md

@@ -6,7 +6,7 @@
 ![Desktop](https://img.shields.io/badge/Desktop-Electron-47848F?style=for-the-badge)
 ![License](https://img.shields.io/badge/License-MIT-green?style=for-the-badge)
 
-**Access your Linux server from any browser — no VPN, no SSH client, no installing anything.**
+**Access your server from any browser — no VPN, no SSH client, no installing anything.**
 
 [![Quick Start](https://img.shields.io/badge/Quick_Start-One_Command-2D5B8E?style=for-the-badge&logo=gnu-bash)](install.sh)
 [![Download](https://img.shields.io/github/v/release/unn-known1/webtun?style=for-the-badge&logo=github)](https://github.com/unn-known1/webtun/releases/latest)
@@ -97,6 +97,17 @@ webtun
 | `--help` | Show help |
 | `--version` | Show version |
 
+**Environment Variables:**
+| Variable | Description |
+|----------|-------------|
+| `PORT` | Server port (default: 3000) |
+| `HOST` | Bind address (default: 0.0.0.0) |
+| `PIN` | Authentication PIN (empty = no auth) |
+| `SHELL` | Shell to use (default: PowerShell on Windows, bash/sh elsewhere) |
+| `WORKSPACE_ROOT` | Root directory for file operations (default: ~) |
+| `TRUST_PROXY` | Set to `true` if behind a reverse proxy (default: loopback only) |
+| `WEBTUN_SHELL` | Override shell on Windows (e.g., `/usr/bin/bash` for Git Bash) |
+
 **Examples:**
 ```bash
 npx webtun                        # Start on port 3000
@@ -148,35 +159,35 @@ npm start
 ## Architecture
 
 ```
-┌─────────────────────────────────────────────────────────────┐
-│                      Your Browser                           │
-│  ┌─────────┐  ┌──────────┐  ┌────────────┐  ┌────────────┐  │
-│  │Terminal │  │  File    │  │   Tunnel   │  │  Settings  │  │
-│  │ (xterm) │  │ Explorer │  │   Manager  │  │   Panel    │  │
-│  └────┬────┘  └────┬─────┘  └──────┬─────┘  └─────┬──────┘  │
-│       │            │               │              │         │
-└───────┼────────────┼───────────────┼──────────────┼─────────┘
-        │ WebSocket  │               │              │
-        ▼            ▼               ▼              │
-┌─────────────────────────────────────────────────────────────┐
-│                      Node.js Server                         │
-│  ┌────────────┐  ┌─────────────┐  ┌────────────────────┐    │
-│  │  WebSocket │  │   File API  │  │ Cloudflare Tunnel   │    │
-│  │  Handler   │  │ (read/write)│  │     Manager        │    │
-│  └─────┬──────┘  └──────┬──────┘  └─────────┬──────────┘    │
-│        │                │                   │               │
-│        ▼                ▼                   ▼               │
-│  ┌─────────┐  ┌────────────────┐  ┌──────────────────────┐  │
-│  │ node-pty│  │Local Filesystem│  │ cloudflared daemon    │  │
-│  │ (shell) │  │(your server)   │  │ (exposes to internet)│  │
-│  └─────────┘  └────────────────┘  └──────────────────────┘  │
-└─────────────────────────────────────────────────────────────┘
-                            │
-                            ▼
-                    ┌─────────────────┐
-                    │  Internet Users │
-                    │  (HTTPS URL)    │
-                    └─────────────────┘
+┌────────────────────────────────────────────────────────────────┐
+│                        Your Browser                            │
+│  ┌──────────┐  ┌───────────┐  ┌─────────────┐  ┌───────────┐   │
+│  │ Terminal │  │   File    │  │   Tunnel    │  │  Settings │   │
+│  │  (xterm) │  │ Explorer  │  │   Manager   │  │   Panel   │   │
+│  └─────┬────┘  └─────┬─────┘  └──────┬──────┘  └─────┬─────┘   │
+│        │             │               │               │         │
+└────────┼─────────────┼───────────────┼───────────────┼─────────┘
+         │  WebSocket  │  REST API     │               │
+         ▼             ▼               ▼               │
+┌────────────────────────────────────────────────────────────────┐
+│                       Node.js Server                           │
+│  ┌─────────────┐  ┌──────────────┐  ┌───────────────────────┐  │
+│  │  WebSocket  │  │   File API   │  │  Cloudflare Tunnel    │  │
+│  │   Handler   │  │ (read/write) │  │      Manager          │  │
+│  └──────┬──────┘  └──────┬───────┘  └───────────┬───────────┘  │
+│         │                │                      │              │
+│         ▼                ▼                      ▼              │
+│  ┌──────────┐  ┌──────────────────┐  ┌──────────────────────┐  │
+│  │ node-pty │  │ Local Filesystem │  │ cloudflared daemon   │  │
+│  │  (shell) │  │ (your server)    │  │ (exposes to internet)│  │
+│  └──────────┘  └──────────────────┘  └──────────────────────┘  │
+└────────────────────────────────────────────────────────────────┘
+                               │
+                               ▼
+                      ┌─────────────────┐
+                      │  Internet Users │
+                      │  (HTTPS URL)    │
+                      └─────────────────┘
 ```
 
 ---
@@ -231,6 +242,9 @@ kill $(pgrep -f 'cloudflared tunnel')
 | Permission denied on shell | Ensure user has shell access: `chsh -s /bin/bash` |
 | File upload fails | Check `public/uploads/` permissions: `chmod 755 public/uploads/` |
 | Port 3000 in use | Change port: `PORT=3001 npm start` |
+| Windows terminal opens PowerShell instead of Git Bash | Set `WEBTUN_SHELL=/usr/bin/bash` in `.env` |
+| Behind reverse proxy, wrong client IP | Set `TRUST_PROXY=true` in `.env` |
+| Tunnel persists after server restart | Tunnels are auto-managed; manual cleanup: `kill $(pgrep -f 'cloudflared tunnel')` |
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webtun",
-  "version": "1.4.3",
+  "version": "1.4.5",
   "description": "Self-hosted web terminal with Cloudflare Tunnel, file explorer, and PWA support",
   "author": {
     "name": "Gaurang Patel",

package/postinstall.js

@@ -135,7 +135,7 @@ async function main() {
     if (!downloadWithCurlOrWget()) {
       console.log('  cloudflared install failed (download error) — skipping');
       cleanup();
-      process.exit(0);
+      return;
     }
   }
 
@@ -149,12 +149,12 @@ async function main() {
     if (/^<!doctype\s+html/i.test(head) || /^<html/i.test(head)) {
       console.log('  cloudflared install failed (downloaded file is not a binary) — skipping');
       cleanup();
-      process.exit(0);
+      return;
     }
   } catch (e) {
     console.log('  cloudflared install failed (cannot validate download): ' + e.message);
     cleanup();
-    process.exit(0);
+    return;
   }
 
   function installBin(src, dest) {

package/public/index.html

@@ -14,6 +14,8 @@
 <script src="https://cdn.jsdelivr.net/npm/@xterm/addon-fit@0.10.0/lib/addon-fit.min.js"></script>
 <script src="https://cdn.jsdelivr.net/npm/@xterm/addon-search@0.15.0/lib/addon-search.min.js"></script>
 <script src="https://cdn.jsdelivr.net/npm/@xterm/addon-web-links@0.11.0/lib/addon-web-links.min.js"></script>
+<script src="https://cdn.jsdelivr.net/npm/@xterm/addon-unicode11@0.7.0/lib/addon-unicode11.min.js"></script>
+<script src="https://cdn.jsdelivr.net/npm/@xterm/addon-webgl@0.18.1/lib/addon-webgl.min.js"></script>
 <script src="https://cdn.jsdelivr.net/npm/marked@15.0.7/marked.min.js"></script>
 <script src="https://cdn.jsdelivr.net/npm/dompurify@3.2.4/dist/purify.min.js"></script>
 <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/codemirror@5.65.18/lib/codemirror.min.css">
@@ -166,6 +168,8 @@ svg { display: block; }
 .term-wrapper.active { display: flex; }
 .xterm { flex: 1; }
 .xterm-viewport { border-radius: 0; }
+.term-bell-flash { animation: bellFlash 0.15s ease-out; }
+@keyframes bellFlash { 0% { filter: brightness(1.8); } 100% { filter: brightness(1); } }
 #terminals.tiles-mode { display: grid; grid-template-columns: repeat(auto-fit, minmax(300px, 1fr)); grid-auto-rows: 1fr; gap: 4px; padding: 4px; position: relative; overflow: auto; min-height: 0; overscroll-behavior: none; }
 #terminals.tiles-mode .term-wrapper { position: relative; inset: unset; display: flex; flex-direction: column; border: 1px solid var(--border); border-radius: var(--radius); overflow: hidden; min-height: 150px; }
 #terminals.tiles-mode .term-wrapper.active { border-color: var(--accent); box-shadow: 0 0 0 1px var(--accent); }
@@ -1193,6 +1197,15 @@ svg { display: block; }
   <div class="ctx-item danger" id="ctx-delete" role="menuitem"><svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><polyline points="3 6 5 6 21 6"/><path d="M19 6v14a2 2 0 0 1-2 2H7a2 2 0 0 1-2-2V6m3 0V4a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v2"/><line x1="10" y1="11" x2="10" y2="17"/><line x1="14" y1="11" x2="14" y2="17"/></svg> Delete</div>
 </div>
 
+<!-- Terminal context menu -->
+<div id="term-ctx-menu" role="menu" style="position:fixed;background:var(--bg2);border:1px solid var(--border);border-radius:var(--radius);box-shadow:0 4px 20px var(--shadow-color);z-index:500;display:none;min-width:160px;overflow:hidden">
+  <div class="ctx-item" id="term-ctx-copy" role="menuitem"><svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><rect x="9" y="9" width="13" height="13" rx="2"/><path d="M5 15H4a2 2 0 0 1-2-2V4a2 2 0 0 1 2-2h9a2 2 0 0 1 2 2v1"/></svg> Copy</div>
+  <div class="ctx-item" id="term-ctx-paste" role="menuitem"><svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><rect x="14" y="2" width="8" height="8" rx="2"/><path d="M16 14H8M8 18h8"/><path d="M5 4h4"/><rect x="2" y="6" width="16" height="16" rx="2"/></svg> Paste</div>
+  <div class="ctx-item" id="term-ctx-select-all" role="menuitem"><svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><rect x="3" y="3" width="18" height="18" rx="2"/><path d="M9 3v18"/><path d="M15 3v18"/><path d="M3 9h18"/><path d="M3 15h18"/></svg> Select All</div>
+  <div class="ctx-sep"></div>
+  <div class="ctx-item" id="term-ctx-clear" role="menuitem"><svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><rect x="3" y="3" width="18" height="18" rx="2"/><path d="M3 9h18"/></svg> Clear</div>
+</div>
+
 <!-- Fuzzy Finder Modal -->
 <div class="overlay" id="finder-overlay">
   <div class="modal modal-md" style="padding:12px">
@@ -1362,6 +1375,7 @@ let settings = {
   cursor: 'block', blink: true, scrollback: 5000, bell: false,
   mobilekeys: false, confirmclose: true, datasaver: false, autostart: false, keepAwake: false
 };
+let serverPlatform = '';
 
 const isElectron = !!(window.electronAPI && window.electronAPI.isElectron);
 
@@ -1471,6 +1485,7 @@ async function unlockApp() {
   const info = await api('/api/home');
   homeDir = info.home;
   currentPath = homeDir;
+  serverPlatform = info.platform || '';
   document.getElementById('hostname-badge').textContent = info.hostname || '—';
 
   // Check tmux availability
@@ -1819,10 +1834,77 @@ function connectWebSocket(tab, isReconnect = false) {
     setupVisualViewport();
   };
 
+  // OSC sequence handler: intercepts OSC 7, 133, 52 before passing to xterm.js
+  let oscBuf = '';
+  function processTerminalOutput(data) {
+    const str = typeof data === 'string' ? data : new TextDecoder().decode(data);
+    let out = '';
+    let i = 0;
+    while (i < str.length) {
+      // Look for ESC ] (OSC introducer)
+      if (str[i] === '\x1b' && str[i + 1] === ']') {
+        const endIdx = str.indexOf('\x07', i + 2);
+        const stIdx = str.indexOf('\x1b\\', i + 2);
+        let oscEnd = -1;
+        if (endIdx !== -1 && (stIdx === -1 || endIdx < stIdx)) oscEnd = endIdx;
+        else if (stIdx !== -1) oscEnd = stIdx;
+
+        if (oscEnd !== -1) {
+          const oscData = str.substring(i + 2, oscEnd);
+          const semi = oscData.indexOf(';');
+          if (semi !== -1) {
+            const code = oscData.substring(0, semi);
+            const value = oscData.substring(semi + 1);
+            if (code === '7') {
+              // OSC 7: CWD update — file://hostname/path
+              try {
+                const url = new URL(value);
+                tab.cwd = decodeURIComponent(url.pathname);
+              } catch (_) {}
+            } else if (code === '133') {
+              // OSC 133: Shell integration markers (prompt/cmd start/end/done)
+              // Handled silently — available for future command tracking
+            } else if (code === '52') {
+              // OSC 52: Clipboard operations
+              const parts = value.split(';');
+              const targets = parts[0] || 'c';
+              const b64 = parts.slice(1).join(';');
+              if (b64) {
+                // SET clipboard
+                try {
+                  const decoded = atob(b64);
+                  if (targets.includes('c') || targets.includes('p')) {
+                    navigator.clipboard.writeText(decoded).catch(() => {});
+                  }
+                } catch (_) {}
+              } else {
+                // GET clipboard — respond with current clipboard contents
+                navigator.clipboard.readText().then(text => {
+                  const response = '\x1b]52;c;' + btoa(text) + '\x07';
+                  if (tab.ws && tab.ws.readyState === WebSocket.OPEN) {
+                    const enc = new TextEncoder().encode(response);
+                    const buf = new Uint8Array(1 + enc.length);
+                    buf[0] = 0x00; buf.set(enc, 1);
+                    tab.ws.send(buf.buffer);
+                  }
+                }).catch(() => {});
+              }
+            }
+          }
+          i = oscEnd + (str[oscEnd] === '\x07' ? 1 : 2);
+          continue;
+        }
+      }
+      out += str[i];
+      i++;
+    }
+    if (out) tab.term.write(out);
+  }
+
   ws.onmessage = e => {
     const buf = new Uint8Array(e.data);
     const type = buf[0], payload = buf.slice(1);
-    if (type === 0x00) tab.term.write(payload);
+    if (type === 0x00) processTerminalOutput(payload);
     else if (type === 0x01) tab.term.writeln('\r\n\x1b[31m[Process exited]\x1b[0m');
     else if (type === 0x02) tab.term.writeln('\r\n\x1b[31m' + new TextDecoder().decode(payload) + '\x1b[0m');
   };
@@ -1919,7 +2001,7 @@ function initTerminal(tab) {
     scrollback: settings.scrollback,
     allowTransparency: false,
     theme: getXtermTheme(),
-    windowsMode: false,
+    windowsMode: serverPlatform === 'win32',
     convertEol: false,
     bellStyle: settings.bell ? 'sound' : 'none',
     smoothScrollDuration: 80,
@@ -1939,6 +2021,19 @@ function initTerminal(tab) {
   term.loadAddon(searchAddon);
   term.loadAddon(webLinksAddon);
 
+  try {
+    const unicodeAddon = new Unicode11Addon.Unicode11Addon();
+    term.loadAddon(unicodeAddon);
+    term.unicode.activeVersion = '11';
+  } catch (_) {}
+
+  // GPU-accelerated renderer — falls back to canvas if WebGL unavailable
+  try {
+    const webglAddon = new WebglAddon.WebglAddon();
+    webglAddon.onContextLoss(() => { webglAddon.dispose(); });
+    term.loadAddon(webglAddon);
+  } catch (_) {}
+
   term.open(tab.wrapper);
 
   tab.term = term;
@@ -1960,6 +2055,23 @@ function initTerminal(tab) {
     tab.el.querySelector('.tab-title').textContent = tab.title;
   });
 
+  // Bell: visual flash + desktop notification for background tabs
+  term.onBell(() => {
+    // Visual flash on terminal screen
+    const screen = term.element?.querySelector('.xterm-screen');
+    if (screen) {
+      screen.classList.remove('term-bell-flash');
+      void screen.offsetWidth; // reflow to restart animation
+      screen.classList.add('term-bell-flash');
+    }
+    // Desktop notification if tab is in the background
+    if (document.hidden && settings.bell && Notification.permission === 'granted') {
+      try {
+        new Notification(tab.title || 'WebTun', { body: 'Terminal bell', tag: 'webtun-bell' });
+      } catch (_) {}
+    }
+  });
+
   // Resize observer
   tab.resizeObserver = new ResizeObserver(() => {
     if (activeTabId === tab.id) { try { fitTerm(tab); } catch(e) { console.warn(e); } }
@@ -1979,6 +2091,55 @@ function initTerminal(tab) {
     }
   });
 
+  // Terminal right-click context menu
+  term.element.addEventListener('contextmenu', e => {
+    e.preventDefault();
+    const menu = document.getElementById('term-ctx-menu');
+    const sel = term.getSelection();
+    document.getElementById('term-ctx-copy').style.opacity = sel ? '' : '0.5';
+    menu.style.left = Math.min(e.clientX, window.innerWidth - 170) + 'px';
+    menu.style.top = Math.min(e.clientY, window.innerHeight - 160) + 'px';
+    menu.style.display = 'block';
+  });
+
+  // Touch-to-mouse translation for TUI apps (mobile)
+  let _tapTimeout = null, _tapPos = null, _longPressTimer = null;
+  term.element.addEventListener('touchstart', e => {
+    if (e.touches.length !== 1) return;
+    const touch = e.touches[0];
+    _tapPos = { x: touch.clientX, y: touch.clientY, time: Date.now() };
+    // Long press detection for right-click
+    _longPressTimer = setTimeout(() => {
+      if (_tapPos) {
+        const evt = new MouseEvent('mousedown', { clientX: _tapPos.x, clientY: _tapPos.y, button: 2, bubbles: true });
+        term.element.dispatchEvent(evt);
+        const upEvt = new MouseEvent('mouseup', { clientX: _tapPos.x, clientY: _tapPos.y, button: 2, bubbles: true });
+        term.element.dispatchEvent(upEvt);
+        _tapPos = null;
+      }
+    }, 500);
+  }, { passive: true });
+  term.element.addEventListener('touchend', e => {
+    clearTimeout(_longPressTimer);
+    if (!_tapPos || e.changedTouches.length !== 1) return;
+    const touch = e.changedTouches[0];
+    const dx = Math.abs(touch.clientX - _tapPos.x);
+    const dy = Math.abs(touch.clientY - _tapPos.y);
+    const dt = Date.now() - _tapPos.time;
+    if (dx < 10 && dy < 10 && dt < 300) {
+      // Short tap → left click
+      const evt = new MouseEvent('mousedown', { clientX: touch.clientX, clientY: touch.clientY, button: 0, bubbles: true });
+      term.element.dispatchEvent(evt);
+      const upEvt = new MouseEvent('mouseup', { clientX: touch.clientX, clientY: touch.clientY, button: 0, bubbles: true });
+      term.element.dispatchEvent(upEvt);
+    }
+    _tapPos = null;
+  }, { passive: true });
+  term.element.addEventListener('touchmove', () => {
+    clearTimeout(_longPressTimer);
+    _tapPos = null;
+  }, { passive: true });
+
   // Fit terminal then connect WebSocket — ensures WS uses correct dimensions
   requestAnimationFrame(() => {
     fitTerm(tab);
@@ -2110,6 +2271,10 @@ function sendKey(key) {
       altLatch = false;
     }
     updateModifierButtons();
+  } else {
+    shiftLatch = false;
+    altLatch = false;
+    updateModifierButtons();
   }
   const tab = getActiveTab();
   if (tab?.ws?.readyState === WebSocket.OPEN) {
@@ -2520,6 +2685,27 @@ function renderBreadcrumb(fullPath) {
 // ═══════════════════════════════════════════════════════
 let fsClipboard = null;
 
+// Terminal context menu actions (registered once)
+document.getElementById('term-ctx-copy').addEventListener('click', () => {
+  const t = getActiveTab();
+  if (t?.term) { const sel = t.term.getSelection(); if (sel) navigator.clipboard.writeText(sel); }
+  document.getElementById('term-ctx-menu').style.display = 'none';
+});
+document.getElementById('term-ctx-paste').addEventListener('click', () => {
+  pasteToTerminal();
+  document.getElementById('term-ctx-menu').style.display = 'none';
+});
+document.getElementById('term-ctx-select-all').addEventListener('click', () => {
+  const t = getActiveTab();
+  if (t?.term) t.term.selectAll();
+  document.getElementById('term-ctx-menu').style.display = 'none';
+});
+document.getElementById('term-ctx-clear').addEventListener('click', () => {
+  const t = getActiveTab();
+  if (t?.term) t.term.clear();
+  document.getElementById('term-ctx-menu').style.display = 'none';
+});
+
 function showCtxMenu(e, file) {
   e.preventDefault();
   ctxTarget = file;
@@ -2552,7 +2738,11 @@ function showCtxMenu(e, file) {
   });
 }
 
-document.addEventListener('click', () => document.getElementById('ctx-menu').classList.remove('open'));
+document.addEventListener('click', () => {
+  document.getElementById('ctx-menu').classList.remove('open');
+  const termMenu = document.getElementById('term-ctx-menu');
+  if (termMenu) termMenu.style.display = 'none';
+});
 
 document.getElementById('ctx-open').onclick = () => { if (!ctxTarget) return; if (isImageFile(ctxTarget.path)) openImageViewer(ctxTarget.path); else loadFiles(ctxTarget.path); };
 document.getElementById('ctx-edit').onclick = () => ctxTarget && openFileEditor(ctxTarget.path);
@@ -3498,6 +3688,9 @@ function toggleSetting(k) {
     const ctrlBtn = document.getElementById('ctrl-toggle-btn');
     if (ctrlBtn) ctrlBtn.style.background = '';
   }
+  if (k === 'bell' && settings.bell && 'Notification' in window && Notification.permission === 'default') {
+    Notification.requestPermission();
+  }
   if (k === 'datasaver') {
     if (settings.datasaver) {
       if (sysStatsTimer) { clearInterval(sysStatsTimer); sysStatsTimer = null; }
@@ -4151,7 +4344,9 @@ function pasteToTerminal() {
     if (!text) return;
     const tab = getActiveTab();
     if (tab?.ws && tab.ws.readyState === WebSocket.OPEN) {
-      const enc = new TextEncoder().encode(text);
+      // Bracketed paste: wrap in escape sequences so the shell buffers the input
+      const bracketed = '\x1b[200~' + text + '\x1b[201~';
+      const enc = new TextEncoder().encode(bracketed);
       const buf = new Uint8Array(1 + enc.length);
       buf[0] = 0x00; buf.set(enc, 1);
       tab.ws.send(buf.buffer);

package/server.js

@@ -8,7 +8,10 @@ try {
     const idx = trimmed.indexOf('=');
     if (idx === -1) return;
     const key = trimmed.slice(0, idx).trim();
-    const val = trimmed.slice(idx + 1).trim();
+    let val = trimmed.slice(idx + 1).trim();
+    if ((val.startsWith('"') && val.endsWith('"')) || (val.startsWith("'") && val.endsWith("'"))) {
+      val = val.slice(1, -1);
+    }
     if (!(key in process.env)) process.env[key] = val;
   });
 } catch {}
@@ -114,7 +117,10 @@ const wss = new WebSocket.Server({ server, path: '/ws' });
 
 const PORT = process.env.PORT || 3000;
 const PIN = process.env.PIN || '';
-const SHELL = process.env.SHELL || (os.platform() === 'win32' ? 'powershell.exe' : (fs.existsSync('/bin/bash') ? '/bin/bash' : 'sh'));
+// On Windows, ignore SHELL env from Git Bash/MSYS2/WSL — prefer PowerShell
+const SHELL = (os.platform() === 'win32' && !process.env.WEBTUN_SHELL)
+  ? 'powershell.exe'
+  : (process.env.SHELL || (os.platform() === 'win32' ? 'powershell.exe' : (fs.existsSync('/bin/bash') ? '/bin/bash' : 'sh')));
 const HOST = process.env.HOST || '0.0.0.0';
 const WORKSPACE_ROOT = process.env.WORKSPACE_ROOT ? path.resolve(process.env.WORKSPACE_ROOT) : os.homedir();
 
@@ -132,7 +138,9 @@ app.use((req, res, next) => {
 });
 
 // Trust proxy for proper IP detection behind reverse proxy
-app.set('trust proxy', 1);
+// 'loopback' only trusts 127.0.0.1/::1 — safe default for direct connections
+// Set TRUST_PROXY=true in .env if behind a reverse proxy
+app.set('trust proxy', process.env.TRUST_PROXY === 'true' ? 1 : 'loopback');
 
 function constantTimeEqual(a, b) {
   if (typeof a !== 'string' || typeof b !== 'string') return false;
@@ -161,7 +169,7 @@ app.post('/api/auth', authRateLimiter, (req, res) => {
   if (!PIN || (pin && constantTimeEqual(pin, PIN))) {
     res.json({ success: true, token: PIN || 'open' });
   } else {
-    res.status(401).json({ error: 'Invalid PIN' });
+    res.status(401).json({ error: 'Unauthorized' });
   }
 });
 
@@ -332,7 +340,13 @@ function killPid(pid, signal = 'SIGTERM') {
   if (typeof pid !== 'number' || !Number.isInteger(pid) || pid <= 0) return;
   try {
     if (os.platform() === 'win32') {
-      execSync(`taskkill /PID ${pid} /T /F`, { stdio: 'ignore' });
+      try { execSync(`taskkill /PID ${pid} /T /F`, { stdio: 'ignore' }); } catch {}
+      // Fallback: also kill any remaining child processes via WMIC
+      try {
+        const out = execSync(`wmic process where "ParentProcessId=${pid}" get ProcessId /format:list`, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+        const childPids = out.split('\n').filter(l => l.startsWith('ProcessId=')).map(l => parseInt(l.split('=')[1])).filter(Boolean);
+        for (const cp of childPids) { try { execSync(`taskkill /PID ${cp} /F`, { stdio: 'ignore' }); } catch {} }
+      } catch {}
     } else {
       process.kill(pid, signal);
     }
@@ -344,7 +358,7 @@ function buildSessionEnv() {
     const env = { ...process.env };
     env.TERM = env.TERM || 'xterm-256color';
     env.COLORTERM = env.COLORTERM || 'truecolor';
-    if (!env.HOME && env.USERPROFILE) env.HOME = env.USERPROFILE;
+    if (!env.HOME && env.USERPROFILE) env.HOME = env.USERPROFILE.replace(/\\/g, '/');
     if (!env.USER && env.USERNAME) env.USER = env.USERNAME;
     env.SHELL = SHELL;
     // Prefer Path (Windows) over PATH if both set
@@ -747,7 +761,7 @@ app.post('/api/files/upload', checkPin, (req, res) => {
         cb(err);
       }
     },
-    filename: (_, file, cb) => cb(null, path.basename(file.originalname).replace(/[^a-zA-Z0-9_.\-]/g, '_'))
+    filename: (_, file, cb) => cb(null, path.basename(file.originalname).replace(/[^\w\u00C0-\u024F\u0400-\u04FF\u4E00-\u9FFF\u3040-\u309F\u30A0-\u30FF\uAC00-\uD7AF_.\-]/g, '_'))
   });
   const upload = multer({ storage, limits: { fileSize: 500 * 1024 * 1024, files: 100 } }).array('files');
   upload(req, res, err => {
@@ -779,10 +793,22 @@ app.get('/api/files/stat', checkPin, async (req, res) => {
       isSocket: st.isSocket(), isFIFO: st.isFIFO(),
     };
     try {
-      stat.owner = execFileSync('id', ['-nu', String(st.uid)], { encoding: 'utf8', stdio: 'pipe' }).trim();
+      if (os.platform() === 'win32') {
+        stat.owner = String(st.uid);
+      } else {
+        stat.owner = execFileSync('id', ['-nu', String(st.uid)], { encoding: 'utf8', stdio: 'pipe' }).trim();
+      }
     } catch { stat.owner = String(st.uid); }
     try {
-      stat.group = execFileSync('getent', ['group', String(st.gid)], { encoding: 'utf8', stdio: 'pipe' }).split(':')[0];
+      if (os.platform() === 'win32') {
+        stat.group = String(st.gid);
+      } else if (os.platform() === 'darwin') {
+        const dscl = execSync(`dscl . -read /Groups/${st.gid} RecordName 2>/dev/null`, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+        const m = dscl.match(/RecordName:\s*(.+)/);
+        stat.group = m ? m[1].trim() : String(st.gid);
+      } else {
+        stat.group = execFileSync('getent', ['group', String(st.gid)], { encoding: 'utf8', stdio: 'pipe' }).split(':')[0];
+      }
     } catch { stat.group = String(st.gid); }
     try {
       const symlink = lst && lst.isSymbolicLink() ? await fsPromises.readlink(p) : null;
@@ -873,7 +899,8 @@ app.post('/api/files/chmod', checkPin, async (req, res) => {
     if (!/^[0-7]{3,4}$/.test(req.body.mode)) return res.status(400).json({ error: 'mode must be a 3-4 digit octal number (e.g. 755, 644, 1777)' });
     const mode = parseInt(req.body.mode, 8);
     await fsPromises.chmod(p, mode);
-    res.json({ success: true, mode: req.body.mode });
+    const warning = os.platform() === 'win32' ? 'chmod has no effect on Windows' : undefined;
+    res.json({ success: true, mode: req.body.mode, ...(warning && { warning }) });
   } catch (e) {
     res.status(500).json({ error: e.message });
   }
@@ -1071,10 +1098,21 @@ app.get('/api/system/network', checkPin, async (req, res) => {
         gateway = route.split('\n')[0].trim() || null;
         const dnsOut = execFileSync('powershell.exe', ['-Command', '(Get-DnsClientServerAddress -AddressFamily IPv4).ServerAddresses'], { encoding: 'utf8', stdio: 'pipe' }).trim();
         dns = dnsOut.split('\n').filter(Boolean);
+      } else if (os.platform() === 'darwin') {
+        const route = execFileSync('sh', ['-c', "route -n get default 2>/dev/null | awk '/gateway:/{print $2}'"], { encoding: 'utf8', stdio: 'pipe' }).trim();
+        gateway = route || null;
+        const resolv = execFileSync('sh', ['-c', "scutil --dns 2>/dev/null | awk '/nameserver\[0\]/{print $3}' | head -3"], { encoding: 'utf8', stdio: 'pipe' }).trim();
+        dns = resolv.split('\n').filter(Boolean);
       } else {
         const route = execFileSync('sh', ['-c', "ip route | grep default | head -1 | awk '{print $3}'"], { encoding: 'utf8', stdio: 'pipe' }).trim();
         gateway = route || null;
-        const resolv = execFileSync('sh', ['-c', "grep nameserver /etc/resolv.conf | awk '{print $2}'"], { encoding: 'utf8', stdio: 'pipe' }).trim();
+        let resolv = '';
+        try {
+          resolv = execFileSync('sh', ['-c', "grep nameserver /etc/resolv.conf | awk '{print $2}'"], { encoding: 'utf8', stdio: 'pipe' }).trim();
+        } catch {}
+        if (!resolv) {
+          try { resolv = execFileSync('sh', ['-c', "resolvectl status 2>/dev/null | awk '/DNS Servers/{found=1; next} /^$/{found=0} found{print $1}' | head -3"], { encoding: 'utf8', stdio: 'pipe' }).trim(); } catch {}
+        }
         dns = resolv.split('\n').filter(Boolean);
       }
     } catch {}
@@ -1085,6 +1123,15 @@ app.get('/api/system/network', checkPin, async (req, res) => {
           const m = l.match(/:(\d+)\s+/);
           return m ? { port: parseInt(m[1]), process: l.split(/\s+/).pop() } : null;
         }).filter(Boolean);
+      } else if (os.platform() === 'darwin') {
+        const out = execFileSync('lsof', ['-i', '-P', '-n', '-sTCP:LISTEN'], { encoding: 'utf8', stdio: 'pipe' }).trim();
+        const lines = out.split('\n').slice(1).filter(Boolean);
+        listenPorts = lines.map(l => {
+          const parts = l.split(/\s+/);
+          const addr = parts[8] || '';
+          const m = addr.match(/:(\d+)$/);
+          return m ? { port: parseInt(m[1]), address: addr, process: parts[0] || '' } : null;
+        }).filter(Boolean);
       } else {
         const out = execFileSync('sh', ['-c', "ss -tlnp 2>/dev/null | tail -n+2"], { encoding: 'utf8', stdio: 'pipe' }).trim();
         listenPorts = out.split('\n').filter(Boolean).map(l => {
@@ -1282,7 +1329,8 @@ wss.on('connection', (ws, req) => {
         });
       }
     } else {
-      proc = pty.spawn(SHELL, [], {
+      const shellArgs = os.platform() === 'win32' ? ['-NoLogo'] : ['-l'];
+      proc = pty.spawn(SHELL, shellArgs, {
         name: 'xterm-256color', cols, rows, cwd,
         env: sessionEnv
       });
@@ -1293,9 +1341,29 @@ wss.on('connection', (ws, req) => {
     return;
   }
 
-  proc.onData(data => send(0x00, data));
+  // Back-pressure: pause PTY output when WebSocket send buffer is full
+  let paused = false;
+  const HIGH_WATER = 4 * 1024 * 1024; // 4MB — pause PTY above this
+  const LOW_WATER  = 1 * 1024 * 1024; // 1MB — resume PTY below this
+
+  proc.onData(data => {
+    if (ws.readyState !== WebSocket.OPEN) return;
+    send(0x00, data);
+    // If WebSocket buffer is backing up, pause PTY to prevent OOM
+    if (!paused && ws.bufferedAmount > HIGH_WATER) {
+      try { proc.pause(); paused = true; } catch (_) {}
+    }
+  });
+
+  // Drain check: resume PTY when buffer drops
+  const drainCheck = setInterval(() => {
+    if (paused && ws.bufferedAmount < LOW_WATER) {
+      try { proc.resume(); paused = false; } catch (_) {}
+    }
+  }, 50);
 
   proc.onExit(() => {
+    clearInterval(drainCheck);
     if (!TMUX || !sessionId) send(0x01, Buffer.from([0]));
     ws.close();
   });
@@ -1314,8 +1382,8 @@ wss.on('connection', (ws, req) => {
       if (buf.length < 1) return;
       const type = buf[0];
       if (type === 0x00) {
-        // Limit input to 64KB per message
-        const payload = buf.slice(1, Math.min(buf.length, 65537));
+        // Limit input to 1MB per message
+        const payload = buf.slice(1, Math.min(buf.length, 1048577));
         proc.write(payload.toString('utf8'));
       } else if (type === 0x01 && buf.length >= 5) {
         const c = buf.readUInt16LE(1), r = buf.readUInt16LE(3);
@@ -1331,6 +1399,7 @@ wss.on('connection', (ws, req) => {
 
   const cleanup = () => {
     clearInterval(pingInterval);
+    clearInterval(drainCheck);
     try { proc.kill(); } catch {}
   };
   ws.on('close', cleanup);
@@ -1448,6 +1517,15 @@ app.get('/api/system', checkPin, async (req, res) => {
         mem: p.mem || '',
         cmd: p.cmd || ''
       }));
+    } else if (os.platform() === 'darwin') {
+      const psOut = await spawnRead('ps', ['-axo', 'pid,user,%cpu,%mem,command', '-r']);
+      const lines = psOut.trim().split('\n').slice(1, 16);
+      for (const line of lines) {
+        const m = line.match(/^\s*(\S+)\s+(\S+)\s+(\S+)\s+(\S+)\s+(.*)/);
+        if (m) {
+          processes.push({ user: m[2], pid: m[1], cpu: m[3], mem: m[4], cmd: m[5] });
+        }
+      }
     } else {
       const psOut = await spawnRead('ps', ['-eo', 'pid,user,%cpu,%mem,cmd', '--no-headers', '--sort=-%cpu']);
       const lines = psOut.trim().split('\n').slice(0, 15);
@@ -1482,9 +1560,12 @@ function isCloudflaredProcess(pid) {
     if (os.platform() === 'win32') {
       const stdout = execSync(`tasklist /FI "PID eq ${pid}" /FO CSV /NH`, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
       return stdout.toLowerCase().includes('cloudflared');
-    } else {
+    } else if (os.platform() === 'linux') {
       const cmdline = fs.readFileSync(`/proc/${pid}/cmdline`, 'utf8');
       return cmdline.toLowerCase().includes('cloudflared');
+    } else {
+      const stdout = execSync(`ps -p ${pid} -o command=`, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+      return stdout.toLowerCase().includes('cloudflared');
     }
   } catch {
     return false;