shelldeck 0.0.3__tar.gz → 0.0.4__tar.gz

{shelldeck-0.0.3 → shelldeck-0.0.4}/CHANGELOG.md

@@ -2,6 +2,25 @@
 
 All notable changes to shelldeck are listed here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions follow [Semantic Versioning](https://semver.org/).
 
+## [0.0.4] - 2026-09-29
+
+### Added
+
+- Share approval: opening a share link puts the device on a waiting page until you allow it in the `sd share` window (`Allow it? [y/N]`); then it still needs the password.
+- `sd share --new-link` prints another one-use link for the running share.
+- Security headers on every response (no framing, no MIME sniffing, no referrer) and `Cache-Control: no-store` on the API.
+
+### Changed
+
+- Share links work once and expire after 10 minutes unopened. A new link voids the unused old one.
+- Sharing needs a password of 12+ characters (an existing one that long counts after the next login).
+- Revoking a shared device in Devices also voids its approval, so it needs a new link.
+- README: `sd share` is encrypted in transit but not end to end; Cloudflare can see the traffic.
+
+### Fixed
+
+- A share left open when `sd share` was killed or its window closed: the server now closes a share within a minute of its last heartbeat and signs its browsers out. Devices no longer shows "sharing via" a dead tunnel.
+
 ## [0.0.3] - 2026-09-29
 
 ### Added
@@ -48,6 +67,7 @@ First public release.
 - Mandatory password with per-browser logins, idle lock, and HTTPS or SSH-tunnel remote access.
 - `sd` CLI with a startup banner, `sd search` (LLM-free code search), and one-line installers for Windows and Linux.
 
+[0.0.4]: https://github.com/codejunction/shelldeck/releases/tag/v0.0.4
 [0.0.3]: https://github.com/codejunction/shelldeck/releases/tag/v0.0.3
 [0.0.2]: https://github.com/codejunction/shelldeck/releases/tag/v0.0.2
 [0.0.1]: https://github.com/codejunction/shelldeck/releases/tag/v0.0.1

{shelldeck-0.0.3 → shelldeck-0.0.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: shelldeck
-Version: 0.0.3
+Version: 0.0.4
 Summary: Project-first multi-terminal for Windows and Linux: real shells, grouped by project, in your browser
 Project-URL: Homepage, https://github.com/codejunction/shelldeck
 Project-URL: Source, https://github.com/codejunction/shelldeck
@@ -196,7 +196,7 @@ sd schedule list|add|run|toggle|delete|logs
 sd task list|add|move|delete|alarms
 sd serve [--host H]                  run the server in the foreground
 sd stop                              stop the background server (closes all terminals)
-sd share                             share over an HTTPS Cloudflare tunnel with a QR link (needs cloudflared)
+sd share [--new-link]                share over an HTTPS Cloudflare tunnel: one-use QR link, host approval (needs cloudflared)
 sd login-link                        emergency: one-time login URL (host only)
 sd reset-password                    emergency: forget the password (host only)
 ```
@@ -221,13 +221,16 @@ ssh -N -L 5455:127.0.0.1:5455 you@vm      # on your machine, then open http://12
 **`sd share` (any device, no setup).** Needs [`cloudflared`](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/) (`winget install Cloudflare.cloudflared`); no Cloudflare account.
 
 ```sh
-sd share          # starts shelldeck if needed, prints a QR code and a link; Ctrl+C stops sharing
+sd share              # starts shelldeck if needed, prints a QR code and a link; Ctrl+C stops sharing
+sd share --new-link   # another one-use link for the running share (a second device)
 ```
 
-- **Encrypted.** The other device talks HTTPS to Cloudflare, which relays it through cloudflared's outbound encrypted tunnel to shelldeck on `127.0.0.1`. No ports are opened.
-- **Two locks.** The random `trycloudflare.com` address alone is refused; only the printed link (a one-per-share token made on the host) lets a browser in, and then it still needs your password. A password must exist before sharing.
+- **Encrypted in transit, not end to end.** The other device talks HTTPS to Cloudflare, which relays it through cloudflared's outbound encrypted tunnel to shelldeck on `127.0.0.1`. No ports are opened. Cloudflare ends the TLS connection, so it can see the traffic (terminal input and output, your password as you log in). For sensitive work use the SSH tunnel or Tailscale instead.
+- **Three locks.** The random `trycloudflare.com` address alone is refused. The printed link works **once** and only for **10 minutes**; opening it makes the device wait until you allow it in the `sd share` window (`Allow it? [y/N]`). Then it still needs your password.
+- **Long password.** Sharing needs a password of 12+ characters. An older password that long counts after your next login.
+- **Self-closing.** `sd share` renews the share every few seconds. If it stops without Ctrl+C (window closed, process killed), the server closes the share within a minute and signs those browsers out.
 - **Phones.** On touch screens a key bar adds Esc, Tab, Ctrl (applies to the next letter), arrows and `| ~ / -`; dialogs open as bottom sheets.
-- **Stopping.** Ctrl+C closes the tunnel, voids the link and signs out every browser that logged in through it (they also vanish from **Devices**; a server restart clears them too). Each `sd share` gets a new address and link.
+- **Stopping.** Ctrl+C closes the tunnel, voids the link and signs out every browser that logged in through it (they also vanish from **Devices**; a server restart clears them too). Revoking a shared device in **Devices** also voids its approval, so it needs a new link. Each `sd share` gets a new address and link.
 
 **HTTPS on the VM's address,** with a real certificate (Tailscale `tailscale cert`, Let's Encrypt, your reverse proxy) or a self-signed one:
 
@@ -244,6 +247,8 @@ sd serve --host 0.0.0.0 --cert cert.pem --key key.pem
 - **Local only.** The server binds to `127.0.0.1` and rejects HTTP and WebSocket requests whose `Host` or `Origin` isn't the app itself, so other websites can't reach your shells.
 - **Passwords** are stored as PBKDF2-SHA256 (600k iterations). A login is a random token in an `HttpOnly`, `SameSite=Strict` cookie, and only its SHA-256 is stored. After 5 wrong passwords, each further try waits longer.
 - **Devices.** Each login records where it came from (this machine, the network, or a share). Only one login is in use at a time; the others get `423` until they enter the password again. Revoke any login from the Devices page.
+- **Headers.** Every response forbids framing (`X-Frame-Options: DENY`, `frame-ancestors 'none'`), sniffing and referrers, and API responses are never cached.
+- **Sharing** adds a one-use, 10-minute link, approval on the host and a 12+ character password; see [Remote access](#remote-access).
 - **The CLI** authenticates with a token file in the data folder, readable only by your account and rotated on every server start.
 - **Forgot the password?** On the host machine, `sd login-link` prints a one-time login URL valid for 5 minutes, and `sd reset-password` removes the password. There is deliberately no way to do either from the browser.
 - **Your data** lives in `~/.config/shelldeck/` (database, log and saved terminal history). Set `SHELLDECK_HOME` to move it.

{shelldeck-0.0.3 → shelldeck-0.0.4}/README.md

@@ -161,7 +161,7 @@ sd schedule list|add|run|toggle|delete|logs
 sd task list|add|move|delete|alarms
 sd serve [--host H]                  run the server in the foreground
 sd stop                              stop the background server (closes all terminals)
-sd share                             share over an HTTPS Cloudflare tunnel with a QR link (needs cloudflared)
+sd share [--new-link]                share over an HTTPS Cloudflare tunnel: one-use QR link, host approval (needs cloudflared)
 sd login-link                        emergency: one-time login URL (host only)
 sd reset-password                    emergency: forget the password (host only)
 ```
@@ -186,13 +186,16 @@ ssh -N -L 5455:127.0.0.1:5455 you@vm      # on your machine, then open http://12
 **`sd share` (any device, no setup).** Needs [`cloudflared`](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/) (`winget install Cloudflare.cloudflared`); no Cloudflare account.
 
 ```sh
-sd share          # starts shelldeck if needed, prints a QR code and a link; Ctrl+C stops sharing
+sd share              # starts shelldeck if needed, prints a QR code and a link; Ctrl+C stops sharing
+sd share --new-link   # another one-use link for the running share (a second device)
 ```
 
-- **Encrypted.** The other device talks HTTPS to Cloudflare, which relays it through cloudflared's outbound encrypted tunnel to shelldeck on `127.0.0.1`. No ports are opened.
-- **Two locks.** The random `trycloudflare.com` address alone is refused; only the printed link (a one-per-share token made on the host) lets a browser in, and then it still needs your password. A password must exist before sharing.
+- **Encrypted in transit, not end to end.** The other device talks HTTPS to Cloudflare, which relays it through cloudflared's outbound encrypted tunnel to shelldeck on `127.0.0.1`. No ports are opened. Cloudflare ends the TLS connection, so it can see the traffic (terminal input and output, your password as you log in). For sensitive work use the SSH tunnel or Tailscale instead.
+- **Three locks.** The random `trycloudflare.com` address alone is refused. The printed link works **once** and only for **10 minutes**; opening it makes the device wait until you allow it in the `sd share` window (`Allow it? [y/N]`). Then it still needs your password.
+- **Long password.** Sharing needs a password of 12+ characters. An older password that long counts after your next login.
+- **Self-closing.** `sd share` renews the share every few seconds. If it stops without Ctrl+C (window closed, process killed), the server closes the share within a minute and signs those browsers out.
 - **Phones.** On touch screens a key bar adds Esc, Tab, Ctrl (applies to the next letter), arrows and `| ~ / -`; dialogs open as bottom sheets.
-- **Stopping.** Ctrl+C closes the tunnel, voids the link and signs out every browser that logged in through it (they also vanish from **Devices**; a server restart clears them too). Each `sd share` gets a new address and link.
+- **Stopping.** Ctrl+C closes the tunnel, voids the link and signs out every browser that logged in through it (they also vanish from **Devices**; a server restart clears them too). Revoking a shared device in **Devices** also voids its approval, so it needs a new link. Each `sd share` gets a new address and link.
 
 **HTTPS on the VM's address,** with a real certificate (Tailscale `tailscale cert`, Let's Encrypt, your reverse proxy) or a self-signed one:
 
@@ -209,6 +212,8 @@ sd serve --host 0.0.0.0 --cert cert.pem --key key.pem
 - **Local only.** The server binds to `127.0.0.1` and rejects HTTP and WebSocket requests whose `Host` or `Origin` isn't the app itself, so other websites can't reach your shells.
 - **Passwords** are stored as PBKDF2-SHA256 (600k iterations). A login is a random token in an `HttpOnly`, `SameSite=Strict` cookie, and only its SHA-256 is stored. After 5 wrong passwords, each further try waits longer.
 - **Devices.** Each login records where it came from (this machine, the network, or a share). Only one login is in use at a time; the others get `423` until they enter the password again. Revoke any login from the Devices page.
+- **Headers.** Every response forbids framing (`X-Frame-Options: DENY`, `frame-ancestors 'none'`), sniffing and referrers, and API responses are never cached.
+- **Sharing** adds a one-use, 10-minute link, approval on the host and a 12+ character password; see [Remote access](#remote-access).
 - **The CLI** authenticates with a token file in the data folder, readable only by your account and rotated on every server start.
 - **Forgot the password?** On the host machine, `sd login-link` prints a one-time login URL valid for 5 minutes, and `sd reset-password` removes the password. There is deliberately no way to do either from the browser.
 - **Your data** lives in `~/.config/shelldeck/` (database, log and saved terminal history). Set `SHELLDECK_HOME` to move it.

{shelldeck-0.0.3 → shelldeck-0.0.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "shelldeck"
-version = "0.0.3"
+version = "0.0.4"
 description = "Project-first multi-terminal for Windows and Linux: real shells, grouped by project, in your browser"
 readme = "README.md"
 license = "MIT"

{shelldeck-0.0.3 → shelldeck-0.0.4}/shelldeck/auth.py

@@ -20,9 +20,11 @@ from . import db
 
 LOCK_TIMEOUT_SECONDS = 30 * 60
 MIN_PASSWORD = 8
+SHARE_MIN_PASSWORD = 12  # `sd share` puts the login page on the internet
 COOKIE = "sd_session"
 TOKEN_HEADER = "x-shelldeck-token"
 _PASSWORD_KEY = "auth_password_hash"
+_STRONG_KEY = "auth_password_strong"  # "1" when the password is long enough to share
 _TOUCH_EVERY = 60  # seconds; last_seen writes are throttled
 _CACHE_TTL = 5  # seconds a session lookup is trusted before re-reading the db
 
@@ -57,7 +59,20 @@ def has_password() -> bool:
 
 def check_password(password: str) -> bool:
     stored = db.get_setting(_PASSWORD_KEY)
-    return bool(stored) and _verify_password(password, stored)
+    ok = bool(stored) and _verify_password(password, stored)
+    if ok:
+        _note_strength(password)  # passwords set before this flag existed get it at their next login
+    return ok
+
+
+def _note_strength(password: str) -> None:
+    strong = "1" if len(password) >= SHARE_MIN_PASSWORD else ""
+    if db.get_setting(_STRONG_KEY, "") != strong:
+        db.set_setting(_STRONG_KEY, strong)
+
+
+def strong_password() -> bool:
+    return db.get_setting(_STRONG_KEY, "") == "1"
 
 
 def validate_new(password: str, confirm: str) -> str | None:
@@ -71,6 +86,7 @@ def validate_new(password: str, confirm: str) -> str | None:
 
 def set_password(password: str) -> None:
     db.set_setting(_PASSWORD_KEY, _hash_password(password))
+    _note_strength(password)
     _file("setup-code").unlink(missing_ok=True)
 
 
@@ -128,6 +144,7 @@ def init_auth() -> str | None:
 def reset() -> str:
     """Emergency, host-only: forget the password and every login. Returns the new setup code."""
     db.delete_setting(_PASSWORD_KEY)
+    db.delete_setting(_STRONG_KEY)
     db.delete_auth_sessions()
     _file("setup-code").unlink(missing_ok=True)
     _cache.clear()

{shelldeck-0.0.3 → shelldeck-0.0.4}/shelldeck/cli.py

@@ -1,10 +1,12 @@
 import json
 import os
+import queue
 import re
 import shutil
 import ssl
 import subprocess
 import sys
+import threading
 import time
 import urllib.error
 import urllib.request
@@ -308,13 +310,53 @@ def _show_share(url: str) -> None:
     if sys.stdout.isatty():
         segno.make(url, error="l").terminal(compact=(sys.stdout.encoding or "").lower().startswith("utf"))
     typer.echo(f"\n  {url}\n")
-    typer.echo("  Scan or open it on the other device, then log in with your shelldeck password.")
-    typer.echo("  Without this link the tunnel URL is refused. Ctrl+C stops sharing and signs those browsers out.")
+    typer.echo("  Open it on the other device within 10 minutes. It works once; allow the device here, then log in")
+    typer.echo("  with your password. Another device: `sd share --new-link`. Ctrl+C stops sharing and signs them out.")
+
+
+def _watch_share() -> None:
+    """Renew the share's lease (the server closes it ~60s after this stops) and ask here before a
+    device that opened the link gets in."""
+    asks: queue.Queue = queue.Queue()
+
+    def poll() -> None:
+        asked: set[str] = set()
+        while True:
+            try:
+                for p in _api("/api/share").get("pending", []):
+                    if p["id"] not in asked:
+                        asked.add(p["id"])
+                        asks.put(p)
+            except typer.Exit:
+                pass  # server busy or restarting; try again
+            time.sleep(3)
+
+    def ask() -> None:
+        while True:
+            p = asks.get()
+            typer.echo(f"\n  A device opened the link: {p['ip']}\n  {p['agent'][:100]}")
+            allow = input("  Allow it? [y/N] ").strip().lower() in ("y", "yes")
+            try:
+                _api("/api/share/decide", "POST", {"id": p["id"], "allow": allow})
+                typer.echo("  allowed; it can log in with your password now" if allow else "  denied")
+            except typer.Exit:
+                typer.echo("  that request expired; open a new link")
+
+    for target in (poll, ask):
+        threading.Thread(target=target, daemon=True).start()
 
 
 @app.command()
-def share():
-    """Reach this shelldeck from another device: HTTPS Cloudflare quick tunnel, QR link, then your password."""
+def share(
+    new_link: bool = typer.Option(False, "--new-link", help="Print a fresh one-use link for the running share."),
+):
+    """Reach this shelldeck from another device: HTTPS Cloudflare quick tunnel, one-use QR link, host approval, then your password."""
+    if new_link:
+        if not (_health() == "ok" and _api("/api/share").get("host")):
+            typer.echo("not sharing; start with `sd share`", err=True)
+            raise typer.Exit(1)
+        _show_share(f"https://{_api('/api/share')['host']}" + _api("/api/share/link", "POST", {})["path"])
+        return
     exe = shutil.which("cloudflared")
     if not exe:
         hint = "winget install Cloudflare.cloudflared" if sys.platform == "win32" else "see https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/"
@@ -324,6 +366,13 @@ def share():
     if not _api("/api/auth/status").get("has_password"):
         typer.echo("Set a password first: open shelldeck on this machine (`sd`), then run `sd share` again.", err=True)
         raise typer.Exit(1)
+    if not _api("/api/share").get("strong_password"):
+        typer.echo(
+            f"Sharing puts the login page on the internet, so it needs a password of {auth.SHARE_MIN_PASSWORD}+ characters.\n"
+            "Change it in Settings (or, if it is already that long, log in once), then run `sd share` again.",
+            err=True,
+        )
+        raise typer.Exit(1)
     # the tunnel ends at our own loopback server, whose certificate (if any) is self-signed
     cmd = [exe, "tunnel", "--no-autoupdate", "--url", _url()] + (["--no-tls-verify"] if _scheme() == "https" else [])
     proc = subprocess.Popen(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.PIPE, text=True, errors="replace")
@@ -335,6 +384,7 @@ def share():
             elif host and not shared and "Registered tunnel connection" in line:
                 shared = f"https://{host}" + _api("/api/share", "POST", {"host": host})["path"]
                 _show_share(shared)
+                _watch_share()
     except KeyboardInterrupt:
         pass
     finally:

{shelldeck-0.0.3 → shelldeck-0.0.4}/shelldeck/server.py

@@ -18,7 +18,7 @@ from urllib.parse import quote, urlsplit
 
 import uvicorn
 from fastapi import FastAPI, Request, WebSocket, WebSocketDisconnect
-from fastapi.responses import FileResponse, JSONResponse, RedirectResponse
+from fastapi.responses import FileResponse, HTMLResponse, JSONResponse, RedirectResponse
 from fastapi.staticfiles import StaticFiles
 
 from . import auth, db, gitgraph, shells, stats
@@ -68,26 +68,47 @@ def err(code: str, status: int = 400) -> JSONResponse:
     return JSONResponse({"error": code}, status_code=status)
 
 
-# `sd share`: the tunnel's public hostname, sha256 of its link token, and the logins made through it
+# `sd share`: the tunnel's public hostname, the sha256 of its one unused link token (None once used),
+# when that link expires, when the CLI last renewed the lease, and one grant per browser that opened
+# a link: sha256(cookie) -> {id, ip, agent, at, state: pending|ok|denied, session}.
 _share: dict = {}
 SHARE_COOKIE = "sd_share"
+SHARE_LEASE = 60  # seconds without a CLI heartbeat before the share closes itself
+LINK_TTL = 600  # a link must be opened within 10 minutes, once
+APPROVAL_TTL = 300  # a pending device the host didn't answer is dropped after 5 minutes
 
 
-def _share_key(token: str | None) -> bool:
-    return bool(token and _share) and hmac.compare_digest(hashlib.sha256(token.encode()).hexdigest(), _share["key"])
+def _sha(value: str) -> str:
+    return hashlib.sha256(value.encode()).hexdigest()
+
+
+def _share_on() -> bool:
+    """A share exists and its `sd share` process is still renewing it."""
+    return bool(_share) and time.time() - _share["seen"] < SHARE_LEASE
+
+
+def _share_link_ok(token: str) -> bool:
+    key = _share.get("link")
+    return bool(key) and time.time() < _share["link_until"] and hmac.compare_digest(_sha(token), key)
+
+
+def _grant(conn) -> dict | None:
+    cookie = conn.cookies.get(SHARE_COOKIE)
+    return _share.get("grants", {}).get(_sha(cookie)) if cookie and _share else None
 
 
 def _via_share(conn) -> bool:
-    return bool(_share) and conn.headers.get("host", "").rsplit(":", 1)[0] == _share["host"]
+    return _share_on() and conn.headers.get("host", "").rsplit(":", 1)[0] == _share["host"]
 
 
 def _trusted(conn) -> bool:
     """Same-origin check. Browsers always send Origin cross-site; the CLI sends none.
-    The share tunnel's host also needs the cookie its link sets (or to be opening that link)."""
+    On the share tunnel's host only /share/ pages are open; the rest needs a host-approved grant."""
     headers = conn.headers
     host = headers.get("host", "")
     if _via_share(conn):
-        if not (conn.url.path.startswith("/share/") or _share_key(conn.cookies.get(SHARE_COOKIE))):
+        g = _grant(conn)
+        if not (conn.url.path.startswith("/share/") or (g and g["state"] == "ok")):
             return False
     elif ALLOWED_HOSTS is not None and host.rsplit(":", 1)[0] not in ALLOWED_HOSTS:
         return False
@@ -127,9 +148,11 @@ async def lifespan(app: FastAPI):
     manager.store = db.config_dir() / "scrollback"
     manager.prune({s["id"] for s in db.list_sessions()})
     saver = asyncio.create_task(_save_scrollback())
+    reaper = asyncio.create_task(_share_reaper())
     log.info("shelldeck %s started", VERSION)
     yield
     saver.cancel()
+    reaper.cancel()
     stats.stop()
     sched.shutdown()
     for task in list(readers.values()):
@@ -149,6 +172,15 @@ async def _save_scrollback() -> None:
             log.warning("saving scrollback failed", exc_info=True)
 
 
+async def _share_reaper() -> None:
+    """Close a share whose `sd share` stopped renewing it (killed, window closed, crashed)."""
+    while True:
+        await asyncio.sleep(10)
+        if _share and not _share_on():
+            log.info("share lease expired; closing it")
+            await _share_stop()
+
+
 class RevalidatedStaticFiles(StaticFiles):
     """Browsers must revalidate (a cheap 304), or they keep running old JS after an upgrade."""
 
@@ -199,8 +231,24 @@ def _denied() -> JSONResponse:
     return err("locked" if auth.has_password() else "setup_required", 401)
 
 
+SECURITY_HEADERS = {
+    "X-Frame-Options": "DENY",
+    "Content-Security-Policy": "frame-ancestors 'none'",
+    "X-Content-Type-Options": "nosniff",
+    "Referrer-Policy": "no-referrer",
+}
+
+
 @app.middleware("http")
 async def guard(request: Request, call_next):
+    response = await _guarded(request, call_next)
+    response.headers.update(SECURITY_HEADERS)
+    if request.url.path.startswith("/api/"):
+        response.headers["Cache-Control"] = "no-store"  # terminal output, history, devices
+    return response
+
+
+async def _guarded(request: Request, call_next):
     if not _trusted(request):
         return err("forbidden_origin", 403)
     path = request.url.path
@@ -262,6 +310,8 @@ async def _login_response(request: Request, body: dict, res=None):
     token = auth.new_session(f"{_client(request)} {request.headers.get('user-agent', '')}", _via(request))
     h = auth.session_hash(token)
     _active["h"] = h
+    if _via_share(request) and (g := _grant(request)):
+        g["session"] = h  # revoking this login also voids the grant
     await _close_session_sockets(lambda owner: owner != h, IN_USE)
     res = res or JSONResponse(body)
     res.set_cookie(
@@ -342,17 +392,64 @@ async def auth_login_link(request: Request):
 
 @app.post("/api/share")
 async def share_start(request: Request, payload: dict):
-    """Host CLI only: open the gate for an `sd share` tunnel host; returns its one link."""
+    """Host CLI only: open the gate for an `sd share` tunnel host; returns its first link."""
     if not auth.cli_ok(request.headers.get(auth.TOKEN_HEADER)):
         return err("host_cli_only", 403)
+    if not auth.strong_password():
+        return err("weak_password", 409)
     host = str(payload.get("host", "")).lower()
     if not re.fullmatch(r"[a-z0-9-]+(\.[a-z0-9-]+)+", host):
         return err("invalid_host")
     await _share_stop()
-    token = secrets.token_urlsafe(32)
-    _share.update(host=host, key=hashlib.sha256(token.encode()).hexdigest())
+    _share.update(host=host, seen=time.time(), grants={})
     log.info("sharing via %s", host)
-    return {"path": f"/share/{token}"}
+    return {"path": _new_share_link()}
+
+
+def _new_share_link() -> str:
+    """One link at a time: a new one voids the unused old one."""
+    token = secrets.token_urlsafe(32)
+    _share.update(link=_sha(token), link_until=time.time() + LINK_TTL)
+    return f"/share/{token}"
+
+
+@app.get("/api/share")
+async def share_state(request: Request):
+    """Host CLI heartbeat: renews the lease and lists devices waiting for approval."""
+    if not auth.cli_ok(request.headers.get(auth.TOKEN_HEADER)):
+        return err("host_cli_only", 403)
+    if not _share:
+        return {"host": None, "strong_password": auth.strong_password()}
+    now = time.time()
+    _share["seen"] = now
+    grants = _share["grants"]
+    for k in [k for k, g in grants.items() if g["state"] == "pending" and now - g["at"] > APPROVAL_TTL]:
+        del grants[k]
+    pending = [{"id": g["id"], "ip": g["ip"], "agent": g["agent"]} for g in grants.values() if g["state"] == "pending"]
+    return {"host": _share["host"], "pending": pending, "strong_password": auth.strong_password()}
+
+
+@app.post("/api/share/link")
+async def share_link(request: Request):
+    """Host CLI only: a fresh link for another device on the running share."""
+    if not auth.cli_ok(request.headers.get(auth.TOKEN_HEADER)):
+        return err("host_cli_only", 403)
+    if not _share_on():
+        return err("not_sharing", 404)
+    return {"path": _new_share_link()}
+
+
+@app.post("/api/share/decide")
+async def share_decide(request: Request, payload: dict):
+    """Host CLI only: allow or deny a device that opened a link."""
+    if not auth.cli_ok(request.headers.get(auth.TOKEN_HEADER)):
+        return err("host_cli_only", 403)
+    g = next((g for g in _share.get("grants", {}).values() if g["id"] == payload.get("id")), None)
+    if not g or g["state"] != "pending":
+        return err("not_found", 404)
+    g["state"] = "ok" if payload.get("allow") is True else "denied"
+    log.info("share device %s from %s %s", g["id"], g["ip"], "allowed" if g["state"] == "ok" else "denied")
+    return {"state": g["state"]}
 
 
 @app.delete("/api/share")
@@ -372,13 +469,57 @@ async def _share_stop() -> None:
     await _revoke(gone)
 
 
+_WAIT_PAGE = """<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>shelldeck</title><meta name="referrer" content="no-referrer">
+<style>body{margin:0;min-height:100vh;display:grid;place-items:center;background:#09090b;color:#e4e4e7;
+font:16px/1.5 Inter,"Segoe UI",system-ui,sans-serif;text-align:center;padding:24px;box-sizing:border-box}
+p{max-width:28em;margin:.4em auto}b{color:#a78bfa}.m{color:#a1a1aa;font-size:14px}</style>
+<main><p><b>shelldeck</b></p><p id="s">Waiting for the host to allow this device…</p>
+<p class="m" id="m">Answer the prompt in the <code>sd share</code> window on the host.</p></main>
+<script>
+const say = (s, m) => { document.getElementById("s").textContent = s; document.getElementById("m").textContent = m; };
+async function poll() {
+  let st = "none";
+  try { st = (await (await fetch("/share/status", { cache: "no-store" })).json()).state; } catch {}
+  if (st === "ok") return location.replace("/");
+  if (st === "denied") return say("The host denied this device.", "Ask for a new link if that was a mistake.");
+  if (st !== "pending") return say("This request expired.", "Ask the host for a new link.");
+  setTimeout(poll, 2000);
+}
+poll();
+</script>"""
+
+
+def _share_page(body: str, status: int = 200):
+    return HTMLResponse(body, status_code=status, headers={"Cache-Control": "no-store"})
+
+
+@app.get("/share/status")
+async def share_status(request: Request):
+    """The waiting page's poll: pending, ok, denied, or none."""
+    g = _grant(request) if _via_share(request) else None
+    return JSONResponse({"state": g["state"] if g else "none"}, headers={"Cache-Control": "no-store"})
+
+
 @app.get("/share/{token}")
 async def share_open(request: Request, token: str):
-    """The QR link: sets the tunnel cookie, then the usual password login takes over."""
-    if not (_via_share(request) and _share_key(token)):
+    """The QR link: works once, within LINK_TTL. It makes a pending grant that the host must allow in
+    the `sd share` window; after that the usual password login takes over."""
+    if not _via_share(request):
         return err("link_expired", 403)
-    res = RedirectResponse("/", status_code=303)  # drops the token from the address bar
-    res.set_cookie(SHARE_COOKIE, token, httponly=True, samesite="lax", secure=True, path="/", max_age=24 * 3600)
+    if g := _grant(request):  # this browser already opened a link (e.g. a reload)
+        return RedirectResponse("/", status_code=303) if g["state"] == "ok" else _share_page(_WAIT_PAGE)
+    if not _share_link_ok(token):
+        return _share_page(_WAIT_PAGE.replace("poll();", 'say("This link has expired or was already used.", "Ask the host for a new one.");'), 403)
+    _share["link"] = None  # one use
+    cookie = secrets.token_urlsafe(32)
+    _share["grants"][_sha(cookie)] = {
+        "id": secrets.token_hex(4), "ip": _client(request), "agent": request.headers.get("user-agent", "")[:200],
+        "at": time.time(), "state": "pending", "session": None,
+    }
+    log.info("share link opened from %s; waiting for the host", _client(request))
+    res = _share_page(_WAIT_PAGE)
+    res.set_cookie(SHARE_COOKIE, cookie, httponly=True, samesite="lax", secure=True, path="/", max_age=24 * 3600)
     return res
 
 
@@ -420,7 +561,7 @@ async def devices(request: Request):
             "created_at": r["created_at"], "last_seen": r["last_seen"],
             "active": h == _active["h"], "current": h == request.state.session, "sockets": online.get(h, 0),
         })
-    return {"devices": rows, "share": _share.get("host")}
+    return {"devices": rows, "share": _share["host"] if _share_on() else None}
 
 
 @app.delete("/api/devices/{device_id}")
@@ -432,6 +573,9 @@ async def revoke_device(request: Request, device_id: str):
 
 
 async def _revoke(hashes: list[str]) -> dict:
+    grants = _share.get("grants", {})
+    for k in [k for k, g in grants.items() if g["session"] in hashes]:
+        del grants[k]  # a revoked share device needs a new link and approval
     for h in hashes:
         auth.end_session(h)
         if _active["h"] == h:

{shelldeck-0.0.3 → shelldeck-0.0.4}/tests/test_cli.py

@@ -124,13 +124,22 @@ def test_share_waits_for_tunnel_then_prints_link_and_cleans_up(monkeypatch, caps
 
     def api(path, method="GET", payload=None):
         calls.append((method, path))
-        return {"has_password": True} if path == "/api/auth/status" else {"path": "/share/tok"}
+        return {"has_password": True, "strong_password": True, "path": "/share/tok"}
 
     monkeypatch.setattr(cli.shutil, "which", lambda name: "cloudflared")
     monkeypatch.setattr(cli, "ensure_server", lambda: None)
     monkeypatch.setattr(cli, "_health", lambda: "ok")
     monkeypatch.setattr(cli, "_api", api)
+    monkeypatch.setattr(cli, "_watch_share", lambda: calls.append("watch"))
     monkeypatch.setattr(cli.subprocess, "Popen", lambda argv, **kw: calls.append(argv[1:4]) or FakeTunnel())
-    cli.share()
+    cli.share(new_link=False)
     assert "https://abc-def.trycloudflare.com/share/tok" in capsys.readouterr().out
-    assert calls[1:] == [["tunnel", "--no-autoupdate", "--url"], ("POST", "/api/share"), "terminate", ("DELETE", "/api/share")]
+    assert calls[2:] == [["tunnel", "--no-autoupdate", "--url"], ("POST", "/api/share"), "watch", "terminate", ("DELETE", "/api/share")]
+
+
+def test_share_refuses_a_short_password(monkeypatch):
+    monkeypatch.setattr(cli.shutil, "which", lambda name: "cloudflared")
+    monkeypatch.setattr(cli, "ensure_server", lambda: None)
+    monkeypatch.setattr(cli, "_api", lambda path, *a: {"has_password": True, "strong_password": False})
+    r = runner.invoke(cli.app, ["share"])
+    assert r.exit_code == 1 and "12+ characters" in r.output

{shelldeck-0.0.3 → shelldeck-0.0.4}/tests/test_shelldeck.py

@@ -369,28 +369,48 @@ def test_projects_get_distinct_colors(client, tmp_path):
     assert client.put("/api/settings", json={"layout_mode": "grid"}).status_code == 400
 
 
-def test_share_gate_needs_link_then_password(browser):
-    b = browser
-    b.post("/api/auth/setup", json={"password": "longenough", "confirm": "longenough"})
+def _share_setup(b, password="long enough pass"):
+    b.post("/api/auth/setup", json={"password": password, "confirm": password})
     cli = {"X-Shelldeck-Token": auth.read_cli_token()}
     tunnel = {"host": "abc-def.trycloudflare.com", "cf-connecting-ip": "203.0.113.9", "x-forwarded-for": "203.0.113.9"}
+    return cli, tunnel
+
+
+def _open_link(b, path, tunnel):
+    r = b.get(path, headers=tunnel)
+    return r, {**tunnel, "cookie": r.headers["set-cookie"].split(";")[0]}
+
+
+def _allow(b, cli, allow=True):
+    [p] = b.get("/api/share", headers=cli).json()["pending"]
+    return b.post("/api/share/decide", json={"id": p["id"], "allow": allow}, headers=cli)
+
+
+def test_share_gate_needs_link_approval_then_password(browser):
+    b = browser
+    cli, tunnel = _share_setup(b)
     assert b.get("/", headers=tunnel).status_code == 403  # not shared
     assert b.post("/api/share", json={"host": tunnel["host"]}).status_code == 403  # browsers can't open it
+    assert b.get("/api/share").status_code == 403
     assert b.post("/api/share", json={"host": "bad host"}, headers=cli).status_code == 400
     path = b.post("/api/share", json={"host": tunnel["host"]}, headers=cli).json()["path"]
 
-    # the bare tunnel URL and a wrong token get nothing; the link sets the gate cookie
+    # the bare tunnel URL and a wrong token get nothing; the link waits for the host
     assert b.get("/", headers=tunnel).status_code == 403
     assert b.get("/share/wrong", headers=tunnel).status_code == 403
-    r = b.get(path, headers=tunnel, follow_redirects=False)
-    assert r.status_code == 303 and r.headers["location"] == "/" and "secure" in r.headers["set-cookie"].lower()
-    gate = {**tunnel, "cookie": f"{server.SHARE_COOKIE}={path.rsplit('/', 1)[1]}"}
+    r, gate = _open_link(b, path, tunnel)
+    assert r.status_code == 200 and "secure" in r.headers["set-cookie"].lower() and "Waiting" in r.text
+    assert b.get("/", headers=gate).status_code == 403  # pending
+    assert b.get("/share/status", headers=gate).json() == {"state": "pending"}
+    assert b.get(path, headers=tunnel).status_code == 403  # the link worked once
+    assert _allow(b, cli).json() == {"state": "ok"}
+    assert b.get("/share/status", headers=gate).json() == {"state": "ok"}
     assert b.get("/", headers=gate).status_code == 200
 
     # the password is still required, and tunnel visitors are remote
     assert b.get("/api/projects", headers=gate).json() == {"error": "locked"}
     assert b.post("/api/auth/login-link", headers=gate).status_code == 403
-    r = b.post("/api/auth/login", json={"password": "longenough"}, headers={**gate, "origin": "https://" + tunnel["host"]})
+    r = b.post("/api/auth/login", json={"password": "long enough pass"}, headers={**gate, "origin": "https://" + tunnel["host"]})
     assert r.status_code == 200
     login = r.headers["set-cookie"].split(";")[0]
     authed = {**tunnel, "cookie": f"{gate['cookie']}; {login}"}
@@ -405,6 +425,64 @@ def test_share_gate_needs_link_then_password(browser):
     assert b.get("/api/projects", headers={"cookie": login}).status_code == 401
 
 
+def test_share_denied_expired_and_new_link(browser, monkeypatch):
+    b = browser
+    cli, tunnel = _share_setup(b)
+    path = b.post("/api/share", json={"host": tunnel["host"]}, headers=cli).json()["path"]
+    _, gate = _open_link(b, path, tunnel)
+    assert _allow(b, cli, allow=False).json() == {"state": "denied"}
+    assert b.get("/", headers=gate).status_code == 403
+    assert b.get("/share/status", headers=gate).json() == {"state": "denied"}
+
+    # a new link replaces the old one, and expires unopened
+    old = b.post("/api/share/link", headers=cli).json()["path"]
+    new = b.post("/api/share/link", headers=cli).json()["path"]
+    assert b.get(old, headers=tunnel).status_code == 403
+    now = time.time()
+    monkeypatch.setattr(server.time, "time", lambda: now + server.LINK_TTL + 1)
+    b.get("/api/share", headers=cli)  # heartbeat keeps the share itself alive
+    assert b.get(new, headers=tunnel).status_code == 403
+
+
+def test_share_lease_expires_without_heartbeat(browser, monkeypatch):
+    b = browser
+    cli, tunnel = _share_setup(b)
+    path = b.post("/api/share", json={"host": tunnel["host"]}, headers=cli).json()["path"]
+    _, gate = _open_link(b, path, tunnel)
+    _allow(b, cli)
+    assert b.get("/", headers=gate).status_code == 200
+    now = time.time()
+    monkeypatch.setattr(server.time, "time", lambda: now + server.SHARE_LEASE + 1)
+    assert b.get("/", headers=gate).status_code == 403  # `sd share` died: the tunnel host is refused
+    assert b.get("/api/devices").json()["share"] is None
+
+
+def test_share_revoked_device_loses_its_grant(browser):
+    b = browser
+    cli, tunnel = _share_setup(b)
+    path = b.post("/api/share", json={"host": tunnel["host"]}, headers=cli).json()["path"]
+    _, gate = _open_link(b, path, tunnel)
+    _allow(b, cli)
+    phone = TestClient(server.app)
+    r = phone.post("/api/auth/login", json={"password": "long enough pass"}, headers={**gate, "origin": "https://" + tunnel["host"]})
+    h = auth.session_hash(r.cookies[auth.COOKIE])
+    assert b.post("/api/auth/login", json={"password": "long enough pass"}).status_code == 200  # host takes over
+    assert b.delete(f"/api/devices/{h}").json() == {"revoked": 1}
+    assert b.get("/", headers=gate).status_code == 403
+
+
+def test_share_needs_a_long_password(browser):
+    cli, tunnel = _share_setup(browser, password="short123")
+    assert browser.get("/api/share", headers=cli).json()["strong_password"] is False
+    assert browser.post("/api/share", json={"host": tunnel["host"]}, headers=cli).json() == {"error": "weak_password"}
+
+
+def test_security_headers(browser):
+    r = browser.get("/api/auth/status")
+    assert r.headers["x-frame-options"] == "DENY" and r.headers["cache-control"] == "no-store"
+    assert "frame-ancestors 'none'" in browser.get("/").headers["content-security-policy"]
+
+
 def test_devices_one_active_takeover_and_revoke(browser, tmp_path):
     a = browser
     a.post("/api/auth/setup", json={"password": "longenough", "confirm": "longenough"})