provide-terminal 2026-03-28
uterm tunnel: TCP port forwarding with hardened token security and audit logging
70 files · 6,604+ · 61-

uterm tunnel: TCP port forwarding through tunnel primitive

instantiate behavioral
2 files changed
  • tunnel.py uterm tunnel CLI — opens a TCP forward through the tunnel primitive
  • tunnel.py Tunnel core: TunnelConfig, token_transport, local port binding
  • uterm tunnel CLI command opens a local TCP port and forwards traffic through the undef-terminal tunnel primitive to a remote host. TunnelConfig holds endpoint, token, and transport settings. Pyodide JsProxy handled in binary frame detection for WASM compatibility. instantiate behavioral
    2 files
    • tunnel.py
    • tunnel.py

Tunnel token hardening: TTL, revocation, timing-safe compare, audit logs

harden behavioral
3 files changed
  • tokens.ts Tunnel tokens: configurable TTL, revocation registry, timing-safe comparison to prevent timing oracle attacks
  • audit.ts Structured audit logs for tunnel token creation, use, and revocation
  • ip_binding.ts Optional IP binding for tunnel tokens — token only valid from issuing IP
  • Tunnel token security hardened: configurable TTL (tokens expire), in-memory revocation registry (tokens can be invalidated before expiry), timing-safe string comparison to prevent timing oracle attacks on token validation, and optional IP binding. Structured audit logs record all token lifecycle events. harden behavioral
    2 files
    • tokens.ts
    • audit.ts

Tunnel test coverage: 100% statements, E2E and integration suites

qualify internal
2 files changed
  • test_tunnel_e2e.py E2E tests: data flow, token APIs, registry
  • test_tunnel_integration.py Integration tests for tunnel auth chain (FastAPI + CF)
  • 100% statement coverage achieved on all tunnel code. E2E tests cover full data flow, token API lifecycle, and registry operations. Integration tests verify the auth chain works end-to-end on both FastAPI and CF backends. JWT role resolution skipped for worker WebSocket connections. qualify internal
    2 files
    • test_tunnel_e2e.py
    • test_tunnel_integration.py
← 2026-03-27 provide-terminal changelog → 2026-03-29 provide-terminal →