d22dcd24f7
Implements the fixes from docs/REVIEW_REPORT.md (4-agent parallel review). typecheck clean; 341 tests pass (16 files, +113); build:web ok; coverage thresholds (80%) enforced in vitest.config.ts. Critical: - multi-device approval race: release held approval only when the last client detaches (closing one mirror no longer cancels another's prompt) - unbounded session creation (DoS): Config.maxSessions cap (env MAX_SESSIONS), enforced in manager via the existing M4 exit(-1) path - signal-handler leak: named SIGINT/SIGTERM/uncaughtException refs removed in close() - terminal-session initialInput timer tracked + cleared on dispose - tabs.addEntry null-as-cast type hole removed (build session before entry) Should-fix: - security-headers middleware + Origin/CSRF guard on DELETE /live-sessions[/:id] - history.ts converted to fs/promises (async /sessions handler) - removed dead clientDims map + blur protocol message end-to-end - per-connection WS message rate limit (Config.maxMsgsPerSec) - /sessions behavior kept; documented as accepted LAN risk (TECH_DOC §7) Tests: - new tmux / preview-grid / terminal-session (jsdom) / tabs (jsdom) suites - extended history/config/manager/integration coverage incl. regressions Hygiene: - parsePositiveInt -> parseNonNegativeInt; ALLOWED_ORIGINS scheme validation - log-injection sanitize; isLoopback handles 127.0.0.0/8 + IPv4-mapped - operational constants moved into Config - extracted public/preview-grid.ts (DRY launcher/manage) - doc sweeps: ARCHITECTURE §8 runtime-handle exception, stale comments
45 lines
1.4 KiB
JSON
45 lines
1.4 KiB
JSON
{
|
|
"name": "web-terminal",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"type": "module",
|
|
"description": "Browser terminal over WebSocket to the host's local shell (vibe coding). LAN-only, no auth.",
|
|
"engines": {
|
|
"node": ">=18"
|
|
},
|
|
"scripts": {
|
|
"postinstall": "chmod +x node_modules/node-pty/prebuilds/darwin-*/spawn-helper 2>/dev/null || true",
|
|
"start": "tsx src/server.ts",
|
|
"dev": "tsx watch src/server.ts",
|
|
"build": "tsc -p tsconfig.json",
|
|
"build:web": "esbuild public/main.ts public/manage.ts --bundle --format=esm --outdir=public/build --sourcemap",
|
|
"dev:web": "esbuild public/main.ts public/manage.ts --bundle --format=esm --outdir=public/build --sourcemap --watch",
|
|
"typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.web.json",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest",
|
|
"setup-hooks": "node scripts/setup-hooks.mjs"
|
|
},
|
|
"dependencies": {
|
|
"@xterm/addon-fit": "^0.11.0",
|
|
"@xterm/addon-search": "^0.16.0",
|
|
"@xterm/addon-web-links": "^0.12.0",
|
|
"@xterm/xterm": "^6.0.0",
|
|
"express": "^5.2.1",
|
|
"node-pty": "^1.1.0",
|
|
"qrcode": "^1.5.4",
|
|
"ws": "^8.21.0"
|
|
},
|
|
"devDependencies": {
|
|
"@types/express": "^5.0.6",
|
|
"@types/node": "^25.9.3",
|
|
"@types/qrcode": "^1.5.6",
|
|
"@types/ws": "^8.18.1",
|
|
"@vitest/coverage-v8": "^4.1.9",
|
|
"esbuild": "^0.28.1",
|
|
"jsdom": "^29.1.1",
|
|
"tsx": "^4.22.4",
|
|
"typescript": "^6.0.3",
|
|
"vitest": "^4.1.9"
|
|
}
|
|
}
|