webtun 1.5.2 → 1.5.4

package/README.md

@@ -65,10 +65,11 @@ git clone https://github.com/unn-Known1/webtun.git && cd webtun && ./setup.sh &&
 
 ### Terminal
 - **Real shell sessions** — node-pty backed, full bash/zsh/PowerShell support
-- **Multi-tab** — drag to reorder, side-by-side sessions
-- **Bracketed paste** — Ctrl+V works in TUI apps (vim, nano, htop)
+- **Multi-tab** — drag to reorder, side-by-side sessions, new-tab button next to last tab
+- **Bracketed paste** — Ctrl+V works in TUI apps (vim, nano, htop) — 60KB chunked
 - **Command history** — keystroke-based capture, strips ANSI/control sequences
-- **tmux sessions** — persistent sessions survive page reload
+- **Session persistence** — tmux or in-memory PTY; tabs survive page reload (all platforms)
+- **Fullscreen** — terminal fullscreen `Shift+F11` (header button), fits and refocuses
 - **Keyboard Shortcuts** — reference dialog in the overflow menu (Ctrl+P/T/W/B/F, etc.)
 
 ### File Explorer
@@ -77,7 +78,8 @@ git clone https://github.com/unn-Known1/webtun.git && cd webtun && ./setup.sh &&
 - **Zip/Extract** — right-click any file or folder
 - **Image viewer** — preview inline (png, jpg, gif, svg, webp)
 - **Conflict resolution** — replace, merge, keep both, skip
-- **Breadcrumb navigation** — tappable directory segments
+- **Breadcrumb navigation** — tappable segments, folder icon + path one line, `2px` tight spacing, header/breadcrumb unified `30px` bar
+- **Editor** — CodeMirror with autosave draft, `F11` fullscreen + `horizontal/vertical` split toggle, markdown/HTML preview
 
 ### Mobile
 - **Touch gestures** — swipe to close tabs, pull-to-refresh
@@ -96,7 +98,7 @@ git clone https://github.com/unn-Known1/webtun.git && cd webtun && ./setup.sh &&
 - CPU, Memory, Disk, Uptime — real-time with progress bars
 - GPU detection (nvidia-smi, system_profiler, WMI)
 - Multi-GPU support with VRAM, utilization, temperature
-- Top processes sorted by CPU
+- Top processes sorted by CPU — **Kill** button per row (`POST /api/system/kill`)
 
 ### Desktop (Electron)
 - Cross-platform app for Linux, Windows, macOS
@@ -133,6 +135,7 @@ git clone https://github.com/unn-Known1/webtun.git && cd webtun && ./setup.sh &&
 | `PIN` | Auth PIN (empty = no auth) | none |
 | `SHELL` | Shell to use | platform default |
 | `WORKSPACE_ROOT` | File explorer root | `~` |
+| `ALLOW_FULL_FS` | Allow browsing outside `WORKSPACE_ROOT` (full FS) | `false` |
 | `TRUST_PROXY` | Trust `X-Forwarded-For` from first proxy | `false` |
 | `WEBTUN_SHELL` | Override shell on Windows | PowerShell |
 
@@ -175,6 +178,21 @@ git clone https://github.com/unn-Known1/webtun.git && cd webtun && ./setup.sh &&
 
 ## Changelog
 
+### v1.5.4
+- Security hardening: path sandbox `ALLOW_FULL_FS` (default `~`), symlink containment, null-byte/array guards, `rename` traversal block, `delete` uses `lstat`, batch caps 100, zip 1GB/unzip bomb guards, `download` header sanitization, `image` no-store, `write` 10MB cap, tunnel SSRF (localhost-only) + URL validation
+- Auth & transport: `checkPin` array guard, length-leak free `constantTimeEqual`, rate limiter uses `req.ip` with `trust proxy` + Map cap 10k, `--pin` arg consumption fix, WS `cols/rows` clamp 2-500, Origin check + `constantTimeEqual` token, `sessionId` length 1-64, per-IP `clipboard`, `history` max 1k & `cmdhist.json` 0600 atomic writes, `ptySessions` TTL 30m + cap 100, `TMUX_PREFIX=wt-webtun-`
+- Build: predictable `tmp` via `mkdtemp`, tar-slip `tzf` validation, heredoc `printf` no-expansion, `.env` parser first-`=` fix, `pkill $SCRIPT_DIR` + `kill -0` race, `electron` `parseInt PORT` + `autostart` filter, `ws ^8.17.1`
+- UI/UX: touch 32-36px, `aria-pressed`/`aria-expanded`/`aria-modal`/`inert` (siblings), focus-trap fix, `confirmDialog` queue, `skip-link`, `pan-y` + `contain`, `visualViewport` Samsung+scale, `pull-to-refresh`, `safe-area`, `cmd-lib` trap, `tiles min(300px,100%)`, `upload 6px+cancel`, `paste 60KB`, `WebGL<4`, `iframe allow-scripts`, `autosave draft 2s` + `jsx:true`
+- Explorer: `new-tab` next to last tab (sticky), `sidebar-header`/`breadcrumb` unified `30px` `3px 6px gap3`, `file-item 2→1px` `breadcrumb 1px sep`, `sidebar-footer/bookmarks` compact, folder icon + path one line `flex gap2`
+- Editor: `F11` fullscreen (`fixed inset0`) + `horizontal/vertical` split toggle stays usable, `Esc` to exit, `requestFullscreen` fallback, `closeEditor` clears
+- Terminal: `Shift+F11` fullscreen (`#content.terminal-fullscreen` + `#terminals.fullscreen`), header button, `fitTerm` refit
+- System Stats: **Kill** `POST /api/system/kill` per-row button (refuse `1/self/cloudflared`)
+- PWA: `sw.js` no immediate `skipWaiting`, `token`/`/ws` bypass, stale-while-revalidate, `manifest` `?newTerm=1` + `titlebar-area` CSS
+
+### v1.5.3
+- Terminal session persistence without tmux (in-memory PTY on Windows + Linux)
+- Session IDs always generated; tabs now survive page reload on all platforms
+
 ### v1.5.2
 - UI/UX audit fixes: theme-aware xterm selection color, `--fg3` across all 6 themes
 - Replaced native `confirm()` with a theme-aware, focus-trapped dialog

package/bin/webtun.js

@@ -49,14 +49,26 @@ function parseArgs(argv) {
       process.exit(0);
     }
     if (arg === '--port' || arg === '-p') {
+      if (!argv[i+1] || argv[i+1].startsWith('-')) {
+        console.error('Error: --port requires a value');
+        process.exit(1);
+      }
       opts.port = parseInt(argv[++i], 10);
       if (isNaN(opts.port)) {
         console.error('Error: --port requires a numeric value');
         process.exit(1);
       }
     } else if (arg === '--host' || arg === '-h') {
+      if (!argv[i+1] || argv[i+1].startsWith('-')) {
+        console.error('Error: --host requires a value');
+        process.exit(1);
+      }
       opts.host = argv[++i];
     } else if (arg === '--pin') {
+      if (!argv[i+1] || argv[i+1].startsWith('-')) {
+        console.error('Error: --pin requires a value');
+        process.exit(1);
+      }
       process.env.PIN = argv[++i] || '';
     } else if (arg === '--tunnel' || arg === '-t') {
       opts.tunnel = true;

package/electron/main.js

@@ -0,0 +1,176 @@
+const { app, BrowserWindow, Menu, dialog, ipcMain } = require('electron');
+const { fork } = require('child_process');
+const path = require('path');
+const http = require('http');
+const fs = require('fs');
+
+let mainWindow;
+let serverProcess;
+const PORT = (() => {
+  const p = parseInt(process.env.PORT, 10);
+  return Number.isFinite(p) && p > 0 && p <= 65535 ? p : 3000;
+})();
+const PIN = process.env.PIN || '';
+if (PIN && typeof PIN !== 'string') {
+  console.warn('Invalid PIN type — expected string');
+}
+
+function resolveNodeModules() {
+  // Packaged app: resources/node_modules or app.asar.unpacked/node_modules
+  if (app.isPackaged) {
+    const candidates = [
+      path.join(process.resourcesPath, 'node_modules'),
+      path.join(process.resourcesPath, 'app.asar.unpacked', 'node_modules'),
+      path.join(path.dirname(app.getAppPath()), 'node_modules'),
+    ];
+    for (const c of candidates) {
+      if (fs.existsSync(c)) return c;
+    }
+  }
+  return path.join(__dirname, '..', 'node_modules');
+}
+
+function startServer() {
+  return new Promise((resolve, reject) => {
+    const serverPath = path.join(__dirname, '..', 'server.js');
+    const nodeModules = resolveNodeModules();
+    const env = {
+      ...process.env,
+      PORT: String(PORT),
+      HOST: '127.0.0.1',
+    };
+    // Validate PIN exists and is a non-empty string before passing to server
+    if (PIN && typeof PIN === 'string' && PIN.trim().length > 0) {
+      env.PIN = PIN.trim();
+    } else if (PIN) {
+      console.warn('Invalid PIN — starting without authentication');
+      delete env.PIN;
+    }
+    // Ensure forked server can resolve deps when packaged
+    env.NODE_PATH = [nodeModules, env.NODE_PATH].filter(Boolean).join(path.delimiter);
+
+    serverProcess = fork(serverPath, [], {
+      env,
+      stdio: ['ignore', 'pipe', 'pipe']
+    });
+
+    serverProcess.stdout.on('data', d => console.log('[server]', d.toString().trim()));
+    serverProcess.stderr.on('data', d => console.error('[server]', d.toString().trim()));
+
+    let settled = false;
+    const fail = (msg) => {
+      if (settled) return;
+      settled = true;
+      reject(new Error(msg));
+    };
+
+    serverProcess.on('exit', code => {
+      if (code !== 0) {
+        console.error(`Server exited with code ${code}`);
+        fail(`Server exited with code ${code}`);
+      }
+    });
+    serverProcess.on('error', err => fail(err.message));
+
+    const deadline = Date.now() + 30000;
+    const check = () => {
+      if (settled) return;
+      if (Date.now() > deadline) return fail('Server start timed out');
+      http.get(`http://127.0.0.1:${PORT}/api/auth/required`, res => {
+        if (res.statusCode === 200) {
+          settled = true;
+          resolve();
+        } else setTimeout(check, 200);
+      }).on('error', () => setTimeout(check, 200));
+    };
+    setTimeout(check, 500);
+  });
+}
+
+function createWindow() {
+  mainWindow = new BrowserWindow({
+    width: 1100,
+    height: 700,
+    minWidth: 600,
+    minHeight: 400,
+    title: 'WebTun',
+    icon: path.join(__dirname, '..', 'public', 'icon-512.png'),
+    webPreferences: {
+      nodeIntegration: false,
+      contextIsolation: true,
+      preload: path.join(__dirname, 'preload.js')
+    }
+  });
+
+  const menu = Menu.buildFromTemplate([
+    {
+      label: 'WebTun',
+      submenu: [
+        { label: 'About WebTun', role: 'about' },
+        { type: 'separator' },
+        { label: 'Quit', accelerator: 'CmdOrCtrl+Q', click: () => app.quit() }
+      ]
+    },
+    {
+      label: 'Edit',
+      submenu: [
+        { role: 'undo' }, { role: 'redo' }, { type: 'separator' },
+        { role: 'cut' }, { role: 'copy' }, { role: 'paste' }, { role: 'selectAll' }
+      ]
+    },
+    {
+      label: 'View',
+      submenu: [
+        { role: 'reload' }, { role: 'forceReload' },
+        { type: 'separator' },
+        { role: 'togglefullscreen' },
+        { type: 'separator' },
+        { role: 'toggleDevTools' }
+      ]
+    }
+  ]);
+  Menu.setApplicationMenu(menu);
+
+  mainWindow.loadURL(`http://127.0.0.1:${PORT}`);
+
+  mainWindow.on('closed', () => { mainWindow = null; });
+}
+
+app.whenReady().then(async () => {
+  try {
+    await startServer();
+    createWindow();
+  } catch (e) {
+    dialog.showErrorBox('WebTun Error', `Failed to start server:\n${e.message}`);
+    app.quit();
+  }
+});
+
+app.on('window-all-closed', () => {
+  if (process.platform !== 'darwin') app.quit();
+});
+
+app.on('before-quit', () => {
+  if (serverProcess) {
+    try { serverProcess.kill('SIGTERM'); } catch {}
+    serverProcess = null;
+  }
+});
+
+app.on('activate', () => {
+  if (mainWindow === null) createWindow();
+});
+
+// ── Auto-start on login ──────────────────────────────────────
+ipcMain.handle('get-autostart', () => {
+  return app.getLoginItemSettings().openAtLogin;
+});
+
+ipcMain.handle('set-autostart', (_event, enabled) => {
+  app.setLoginItemSettings({
+    openAtLogin: enabled,
+    path: process.execPath,
+    args: process.argv.slice(1).filter(a => !a.startsWith('--'))
+  });
+  return app.getLoginItemSettings().openAtLogin;
+});

package/electron/preload.js

@@ -0,0 +1,7 @@
+const { contextBridge, ipcRenderer } = require('electron');
+
+contextBridge.exposeInMainWorld('electronAPI', {
+  isElectron: true,
+  getAutostart: () => ipcRenderer.invoke('get-autostart'),
+  setAutostart: (enabled) => ipcRenderer.invoke('set-autostart', enabled)
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webtun",
-  "version": "1.5.2",
+  "version": "1.5.4",
   "description": "Self-hosted web terminal with Cloudflare Tunnel, file explorer, and PWA support",
   "author": {
     "name": "Gaurang Patel",
@@ -15,7 +15,8 @@
     "bin/",
     "server.js",
     "public/",
-    "postinstall.js"
+    "postinstall.js",
+    "electron/"
   ],
   "engines": {
     "node": ">=18.0.0"
@@ -106,9 +107,47 @@
     "nodemon": "^3.1.14"
   },
   "overrides": {
-    "form-data": "4.0.6"
+    "array-flatten": "npm:@socketregistry/array-flatten@^1",
+    "define-properties": "npm:@socketregistry/define-properties@^1",
+    "es-define-property": "npm:@socketregistry/es-define-property@^1",
+    "es-set-tostringtag": "npm:@socketregistry/es-set-tostringtag@^1",
+    "form-data": "4.0.6",
+    "function-bind": "npm:@socketregistry/function-bind@^1",
+    "globalthis": "npm:@socketregistry/globalthis@^1",
+    "gopd": "npm:@socketregistry/gopd@^1",
+    "has-property-descriptors": "npm:@socketregistry/has-property-descriptors@^1",
+    "has-symbols": "npm:@socketregistry/has-symbols@^1",
+    "has-tostringtag": "npm:@socketregistry/has-tostringtag@^1",
+    "hasown": "npm:@socketregistry/hasown@^1",
+    "isarray": "npm:@socketregistry/isarray@^1",
+    "object-keys": "npm:@socketregistry/object-keys@^1",
+    "safe-buffer": "npm:@socketregistry/safe-buffer@^1",
+    "safer-buffer": "npm:@socketregistry/safer-buffer@^1",
+    "side-channel": "npm:@socketregistry/side-channel@^1",
+    "typedarray": "npm:@socketregistry/typedarray@^1",
+    "ws": "^8.21.0"
+  },
+  "resolutions": {
+    "array-flatten": "npm:@socketregistry/array-flatten@^1",
+    "define-properties": "npm:@socketregistry/define-properties@^1",
+    "es-define-property": "npm:@socketregistry/es-define-property@^1",
+    "es-set-tostringtag": "npm:@socketregistry/es-set-tostringtag@^1",
+    "function-bind": "npm:@socketregistry/function-bind@^1",
+    "globalthis": "npm:@socketregistry/globalthis@^1",
+    "gopd": "npm:@socketregistry/gopd@^1",
+    "has-property-descriptors": "npm:@socketregistry/has-property-descriptors@^1",
+    "has-symbols": "npm:@socketregistry/has-symbols@^1",
+    "has-tostringtag": "npm:@socketregistry/has-tostringtag@^1",
+    "hasown": "npm:@socketregistry/hasown@^1",
+    "isarray": "npm:@socketregistry/isarray@^1",
+    "object-keys": "npm:@socketregistry/object-keys@^1",
+    "safe-buffer": "npm:@socketregistry/safe-buffer@^1",
+    "safer-buffer": "npm:@socketregistry/safer-buffer@^1",
+    "side-channel": "npm:@socketregistry/side-channel@^1",
+    "typedarray": "npm:@socketregistry/typedarray@^1",
+    "ws": "^8.21.0"
   },
   "allowScripts": {
-    "node-pty@1.1.0": true
+    "node-pty": true
   }
 }

package/postinstall.js

@@ -17,12 +17,21 @@ function rebuildNodePty() {
 
   console.log('  rebuilding node-pty...');
   try {
-    spawnSync('npm', ['rebuild', 'node-pty'], {
+    const r = spawnSync('npm', ['rebuild', 'node-pty'], {
       cwd: __dirname,
-      stdio: 'inherit',
-      timeout: 120000,
-      shell: os.platform() === 'win32'
+      stdio: 'pipe',
+      timeout: 120000
     });
+    if (r.status !== 0) {
+      const out = (r.stderr ? r.stderr.toString() : '') + (r.stdout ? r.stdout.toString() : '');
+      if (out.includes('allow-scripts') || out.toLowerCase().includes('not allowed')) {
+        console.log('  npm blocked build scripts (allow-scripts). To fix:');
+        console.log('    npm install -g --allow-scripts=webtun,node-pty webtun');
+        console.log('  Or: npm config set allow-scripts=webtun,node-pty --location=user');
+        console.log('  Then: npm install -g webtun');
+      }
+      throw new Error(out.trim() || 'rebuild failed with status ' + r.status);
+    }
     // Verify it worked
     delete require.cache[require.resolve('node-pty')];
     require('node-pty');
@@ -34,6 +43,9 @@ function rebuildNodePty() {
     console.log('  macOS:   xcode-select --install');
     console.log('  Windows: install Visual Studio Build Tools with "Desktop development with C++"');
     console.log('           https://visualstudio.microsoft.com/visual-cpp-build-tools/');
+    console.log('  If npm v10+ blocks scripts, allow them:');
+    console.log('    npm config set allow-scripts=webtun,node-pty --location=user');
+    console.log('    npm install --allow-scripts=webtun,node-pty webtun');
   }
 }
 
@@ -89,11 +101,13 @@ if (!file) process.exit(0);
 console.log('  installing cloudflared...');
 
 const url = CF_RELEASES + '/' + file;
-const tmpDir = os.tmpdir();
-const tmp = path.join(tmpDir, 'cloudflared-' + process.pid + (platform === 'win32' ? '.exe' : ''));
+const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'webtun-'));
+const tmp = path.join(tmpDir, 'cloudflared' + (platform === 'win32' ? '.exe' : ''));
 
 function cleanup() {
   try { fs.unlinkSync(tmp); } catch {}
+  try { fs.rmdirSync(tmpDir); } catch {}
+  try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch {}
 }
 
 function downloadFile(downloadUrl, dest) {
@@ -121,22 +135,14 @@ function downloadFile(downloadUrl, dest) {
   });
 }
 
-function downloadWithCurlOrWget() {
-  const r = spawnSync('curl', ['-#fL', url, '-o', tmp], { stdio: 'inherit', timeout: 60000 });
-  if (r.status === 0) return true;
-  const r2 = spawnSync('wget', ['-q', url, '-O', tmp], { stdio: 'inherit', timeout: 60000 });
-  return r2.status === 0;
-}
-
 async function main() {
   try {
     await downloadFile(url, tmp);
   } catch (e) {
-    if (!downloadWithCurlOrWget()) {
-      console.log('  cloudflared install failed (download error) — skipping');
-      cleanup();
-      return;
-    }
+    console.log('  cloudflared install failed (download error) — skipping: ' + e.message);
+    console.log('  (Node https download failed; ensure network access to github.com)');
+    cleanup();
+    return;
   }
 
   // Validate downloaded file is not HTML (e.g. 404 page)
@@ -183,8 +189,20 @@ async function main() {
 
   function extractDarwinIfNeeded() {
     if (platform !== 'darwin') return tmp;
-    const result = spawnSync('tar', ['xzf', tmp, '-C', tmpDir], { stdio: 'inherit' });
-    if (result.status !== 0) throw new Error('tar extraction failed');
+    // Validate tar entries to prevent tar slip (filter .. and absolute paths)
+    const list = spawnSync('tar', ['tzf', tmp], { encoding: 'utf8', timeout: 10000 });
+    if (list.stdout) {
+      const entries = list.stdout.split('\n').map(s => s.trim()).filter(Boolean);
+      for (const entry of entries) {
+        if (entry.includes('..') || path.isAbsolute(entry) || entry.startsWith('/')) {
+          throw new Error('tar slip detected: invalid entry ' + entry);
+        }
+      }
+    } else if (list.status !== 0) {
+      throw new Error('tar list failed: ' + (list.stderr ? list.stderr.toString().trim() : 'unknown error'));
+    }
+    const result = spawnSync('tar', ['xzf', tmp, '-C', tmpDir], { stdio: 'pipe', timeout: 30000 });
+    if (result.status !== 0) throw new Error('tar extraction failed: ' + (result.stderr ? result.stderr.toString().trim() : 'unknown'));
     try { fs.unlinkSync(tmp); } catch {}
     return path.join(tmpDir, 'cloudflared');
   }

package/public/commands.js

@@ -2,5 +2,5 @@ window.DEFAULT_CMDS = [
   { name: 'Install OpenCode AI', cmd: 'npm install -g opencode-ai', cat: 'AI Tools' },
   { name: 'Install 9Router', cmd: 'npm install -g 9router', cat: 'AI Tools' },
   { name: 'GitHub TUI', cmd: 'npx github-tui', cat: 'Tools' },
-  { name: 'Colab Setup', cmd: 'curl -fsSL https://raw.githubusercontent.com/unn-Known1/unn-Known1/main/colab_setup.sh | bash', cat: 'Setup' },
+  { name: 'Colab Setup', cmd: 'curl -fsSL https://raw.githubusercontent.com/unn-Known1/unn-Known1/main/colab_setup.sh | bash', cat: 'Setup', requiresConfirm: true },
 ];