TunnelMC

🆕 What's New in 1.5.0: Reliability & Security Fixes

A maintenance release from a systematic audit, plus one addition to keep pace with an ngrok change:

• Added: ngrok tunnels can now use a reserved/static domain. ngrok moved domain selection to their own dashboard ("Choose your URL") — pick one there, drop it into the new hostname field, and it's passed along with --url. Leave it blank for a random domain each start, same as before.
• Fixed: editing a tunnel could silently wipe its saved authtoken/cfToken. The edit form correctly never sends secrets back to the browser, but saving an unrelated change (like toggling auto-start) was overwriting the stored token with blank — breaking the tunnel on its next start. Blank secret fields on save now keep the existing value; only an actual new value overwrites it.
• Fixed: a tunnel name containing an apostrophe broke every action button on that tunnel's card. Start/Stop/Restart/Delete/Copy buttons are now correctly escaped for names, URLs, and IDs containing ', ", or \.
• Fixed: renaming a tunnel to an existing tunnel's name silently orphaned the old one. The old tunnel's process kept running with nothing left tracking it, and it disappeared from config.yml entirely. Renaming to a name already in use is now rejected instead.
• Fixed: clicking Stop immediately after Start could leave an untracked tunnel process running, and later resurrect it as "running" in the dashboard even though you'd explicitly stopped it. A start/stop race no longer lets a launch that lost the race adopt its process.
• Fixed: playit.gg's "Try Again" button could hand back a dead claim session for up to ~11 minutes after a rejected or cancelled link attempt, instead of issuing a fresh code.
• Fixed: an unsanitized tunnel name could write ngrok's per-tunnel config file outside the intended directory. Tunnel names are now restricted to letters, numbers, _, and -.
• Fixed: editing any tunnel could silently wipe a saved ngrok reserved domain back to blank, since the persistence path rebuilt every tunnel's entry from scratch on every save.
• Fixed: a malformed dashboard API request could return an empty, unexplained server error with nothing in the log. Bad requests now get a clear JSON error and the real cause is logged server-side.
• Improved: error logging for playit/ngrok/cloudflared download and connection failures now always includes the exception type (and throw site when there's no message), instead of sometimes printing a bare "null".