Skip to content

Add shellshare serve command for combined local server + client#102

Open
vitorbaptista wants to merge 4 commits intomasterfrom
claude/review-pr-101-Nv2JI
Open

Add shellshare serve command for combined local server + client#102
vitorbaptista wants to merge 4 commits intomasterfrom
claude/review-pr-101-Nv2JI

Conversation

@vitorbaptista
Copy link
Copy Markdown
Owner

This adds a new serve subcommand that starts a local server and
broadcasts the terminal to it in a single command, eliminating the
need to run server and client separately for local sharing.

Options:
--host/-H: Bind address (default: 127.0.0.1)
--port/-p: Listen port (default: 5000)
--stdin: Read from stdin instead of spawning a shell

The server automatically shuts down when the session ends.

https://claude.ai/code/session_01HsviQhQjYdFSDSU7mpZmXw

This adds a new `serve` subcommand that starts a local server and
broadcasts the terminal to it in a single command, eliminating the
need to run server and client separately for local sharing.

Options:
  --host/-H: Bind address (default: 127.0.0.1)
  --port/-p: Listen port (default: 5000)
  --stdin:   Read from stdin instead of spawning a shell

The server automatically shuts down when the session ends.

https://claude.ai/code/session_01HsviQhQjYdFSDSU7mpZmXw
When running `shellshare serve`, GET / now serves the room viewer
page instead of the home page. This means visitors can go to
http://localhost:5000 and see the terminal directly.

Implementation:
- Add `ServerConfig` struct with optional `serve_room` field
- In serve mode, inject `window.SHELLSHARE_ROOM` into room.html
  so the JS knows which room to join regardless of URL path
- Display clean base URL (http://localhost:5000) in output
- Regular `shellshare server` is unaffected (serve_room: None)

https://claude.ai/code/session_01HsviQhQjYdFSDSU7mpZmXw
- Fix XSS vulnerability: room name was injected unescaped into a <script> tag.
  Replace with a JSON config block (<script type="application/json">) that is
  safely parsed via JSON.parse, eliminating any injection vector.

- Replace brittle HTML string manipulation (replacen("<script>", ...)) with a
  proper template placeholder ({{ROOM_CONFIG}}) and a shared render_room_page()
  helper that serves both the index and room page handlers.

- Extract stream_and_cleanup() to eliminate duplicated stdin/script mode logic
  between cli::run() and serve::run().

- Ensure tokio runtime shuts down on all code paths (error and success) by
  moving shutdown_background() after the streaming result.

- Fix flaky test: replace port 1 (environment-dependent) with non-routable
  192.0.2.1 (TEST-NET-1, RFC 5737) for reliable failure.

https://claude.ai/code/session_01B5yx7NLnwqDWtvjR5JdtJ8
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants