fix(routes): resolve static file 404 when installed via npx

The send module treats dotfile path segments (e.g. .npm in the npx
cache path) as hidden and returns 404. Use res.sendFile with root
option instead of absolute paths to avoid dotfile detection.

Also improve tunnel login error handling with clear user-facing
guidance when devtunnel login fails.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: dorlugasigal

src/routes.js

@@ -45,9 +45,9 @@ function setupRoutes(app, { auth, sessions, config }) {
   });
 
   // Pages
-  app.get('/', auth.middleware, (_req, res) => res.sendFile(path.join(PUBLIC_DIR, 'index.html')));
+  app.get('/', auth.middleware, (_req, res) => res.sendFile('index.html', { root: PUBLIC_DIR }));
   app.get('/terminal', auth.middleware, (_req, res) =>
-    res.sendFile(path.join(PUBLIC_DIR, 'terminal.html')),
+    res.sendFile('terminal.html', { root: PUBLIC_DIR }),
   );
 
   // Session API
@@ -61,7 +61,7 @@ function setupRoutes(app, { auth, sessions, config }) {
     // Validate shell field
     if (shell) {
       const availableShells = detectShells();
-      const isValid = availableShells.some(s => s.path === shell || s.cmd === shell);
+      const isValid = availableShells.some((s) => s.path === shell || s.cmd === shell);
       if (!isValid) {
         return res.status(400).json({ error: 'Invalid shell' });
       }
@@ -150,13 +150,14 @@ function setupRoutes(app, { auth, sessions, config }) {
       if (!buffer.length) {
         return res.status(400).json({ error: 'No image data' });
       }
-      const ext = {
-        'image/png': '.png',
-        'image/jpeg': '.jpg',
-        'image/gif': '.gif',
-        'image/webp': '.webp',
-        'image/bmp': '.bmp',
-      }[contentType] || '.png';
+      const ext =
+        {
+          'image/png': '.png',
+          'image/jpeg': '.jpg',
+          'image/gif': '.gif',
+          'image/webp': '.webp',
+          'image/bmp': '.bmp',
+        }[contentType] || '.png';
       const filename = `termbeam-${crypto.randomUUID()}${ext}`;
       const filepath = path.join(os.tmpdir(), filename);
       fs.writeFileSync(filepath, buffer);
@@ -173,7 +174,7 @@ function setupRoutes(app, { auth, sessions, config }) {
 
   // Directory listing for folder browser
   app.get('/api/dirs', auth.middleware, (req, res) => {
-    const query = req.query.q || (config.cwd + path.sep);
+    const query = req.query.q || config.cwd + path.sep;
     const endsWithSep = query.endsWith('/') || query.endsWith('\\');
     const dir = endsWithSep ? query : path.dirname(query);
     const prefix = endsWithSep ? '' : path.basename(query);

src/tunnel.js

@@ -47,7 +47,10 @@ function loadPersistedTunnel() {
 
 function savePersistedTunnel(id) {
   fs.mkdirSync(TUNNEL_CONFIG_DIR, { recursive: true });
-  fs.writeFileSync(TUNNEL_CONFIG_PATH, JSON.stringify({ tunnelId: id, createdAt: new Date().toISOString() }, null, 2));
+  fs.writeFileSync(
+    TUNNEL_CONFIG_PATH,
+    JSON.stringify({ tunnelId: id, createdAt: new Date().toISOString() }, null, 2),
+  );
 }
 
 function deletePersisted() {
@@ -68,7 +71,10 @@ function deletePersisted() {
 function isTunnelValid(id) {
   try {
     if (!SAFE_ID_RE.test(id)) return false;
-    execFileSync(devtunnelCmd, ['show', id, '--json'], { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
+    execFileSync(devtunnelCmd, ['show', id, '--json'], {
+      encoding: 'utf-8',
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
     return true;
   } catch {
     return false;
@@ -87,7 +93,9 @@ async function startTunnel(port, options = {}) {
     log.error('');
     log.error('  Install it:');
     log.error('    Windows:  winget install Microsoft.devtunnel');
-    log.error('             or: Invoke-WebRequest -Uri https://aka.ms/TunnelsCliDownload/win-x64 -OutFile devtunnel.exe');
+    log.error(
+      '             or: Invoke-WebRequest -Uri https://aka.ms/TunnelsCliDownload/win-x64 -OutFile devtunnel.exe',
+    );
     log.error('    macOS:    brew install --cask devtunnel');
     log.error('    Linux:    curl -sL https://aka.ms/DevTunnelCliInstall | bash');
     log.error('');
@@ -103,15 +111,29 @@ async function startTunnel(port, options = {}) {
     // Ensure user is logged in
     let loggedIn = false;
     try {
-      const userOut = execFileSync(devtunnelCmd, ['user', 'show'], { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] });
+      const userOut = execFileSync(devtunnelCmd, ['user', 'show'], {
+        encoding: 'utf-8',
+        stdio: ['pipe', 'pipe', 'pipe'],
+      });
       // user show can succeed but show "not logged in" status
       loggedIn = userOut && !userOut.toLowerCase().includes('not logged in');
     } catch {}
 
     if (!loggedIn) {
       log.info('devtunnel not logged in, launching login...');
       log.info('A browser window will open for authentication.');
-      execFileSync(devtunnelCmd, ['user', 'login'], { stdio: 'inherit' });
+      try {
+        execFileSync(devtunnelCmd, ['user', 'login'], { stdio: 'inherit' });
+      } catch (loginErr) {
+        log.error('');
+        log.error('  DevTunnel login failed. To use tunnels, run:');
+        log.error('    devtunnel user login');
+        log.error('');
+        log.error('  Or start without a tunnel:');
+        log.error('    termbeam --no-tunnel');
+        log.error('');
+        return null;
+      }
     }
 
     const persisted = options.persisted;
@@ -130,7 +152,9 @@ async function startTunnel(port, options = {}) {
         if (saved) {
           log.info('Persisted tunnel expired, creating new one');
         }
-        const createOut = execFileSync(devtunnelCmd, ['create', '--expiration', '30d', '--json'], { encoding: 'utf-8' });
+        const createOut = execFileSync(devtunnelCmd, ['create', '--expiration', '30d', '--json'], {
+          encoding: 'utf-8',
+        });
         const tunnelData = JSON.parse(createOut);
         tunnelId = tunnelData.tunnel.tunnelId;
         savePersistedTunnel(tunnelId);
@@ -140,18 +164,28 @@ async function startTunnel(port, options = {}) {
       tunnelMode = 'ephemeral';
       tunnelExpiry = '1 day';
       // Ephemeral tunnel — create fresh, will be deleted on shutdown
-      const createOut = execFileSync(devtunnelCmd, ['create', '--expiration', '1d', '--json'], { encoding: 'utf-8' });
+      const createOut = execFileSync(devtunnelCmd, ['create', '--expiration', '1d', '--json'], {
+        encoding: 'utf-8',
+      });
       const tunnelData = JSON.parse(createOut);
       tunnelId = tunnelData.tunnel.tunnelId;
       log.info(`Created ephemeral tunnel ${tunnelId}`);
     }
 
     // Idempotent port and access setup
     try {
-      execFileSync(devtunnelCmd, ['port', 'create', tunnelId, '-p', String(port), '--protocol', 'http'], { stdio: 'pipe' });
+      execFileSync(
+        devtunnelCmd,
+        ['port', 'create', tunnelId, '-p', String(port), '--protocol', 'http'],
+        { stdio: 'pipe' },
+      );
     } catch {}
     try {
-      execFileSync(devtunnelCmd, ['access', 'create', tunnelId, '-p', String(port), '--anonymous'], { stdio: 'pipe' });
+      execFileSync(
+        devtunnelCmd,
+        ['access', 'create', tunnelId, '-p', String(port), '--anonymous'],
+        { stdio: 'pipe' },
+      );
     } catch {}
 
     const hostProc = spawn(devtunnelCmd, ['host', tunnelId], {
@@ -193,8 +227,13 @@ function cleanupTunnel() {
       // On Windows, kill the process tree to ensure all children die
       if (process.platform === 'win32' && tunnelProc.pid) {
         try {
-          execFileSync('taskkill', ['/pid', String(tunnelProc.pid), '/T', '/F'], { stdio: 'pipe', timeout: 5000 });
-        } catch { /* best effort */ }
+          execFileSync('taskkill', ['/pid', String(tunnelProc.pid), '/T', '/F'], {
+            stdio: 'pipe',
+            timeout: 5000,
+          });
+        } catch {
+          /* best effort */
+        }
       } else {
         tunnelProc.kill('SIGKILL');
       }