Ocean Blue CLI

Expose a local app through an Ocean Blue tunnel.

Install

npm install -g ocean-blue

Usage

ocean-blue --server http://localhost:25830

This starts a loopback-only control center and opens it in the browser. Create, start, stop, restart, and remove multiple tunnel profiles without entering a command for each tunnel. Saved profiles are never started automatically. Each connected tunnel owns a separate loopback dashboard; use that tunnel's Open dashboard link for its request log and traffic statistics. The control center does not merge request data from unrelated tunnels.

Use --no-open on a headless machine, or --control-port <port> when the local control center needs a stable port.

Direct proxy mode

The original single-tunnel command remains available for scripts and CI:

ocean-blue proxy --server http://localhost:25830 --local-port 3000 --subdomain myapp --token tk_xxx

The --token value is the tunnel key copied from the Ocean Blue dashboard. If it is omitted, the CLI uses a key saved for that exact server origin and then starts the server auth flow when needed.

Browser UI and local security

The selected Ocean Blue server supplies the Svelte interface, so design updates do not require a new CLI release. Tunnel state and typed command intents cross a versioned MessageChannel; tunnel keys and proxied bodies do not enter the iframe.

The trusted local parent binds only to 127.0.0.1, protects its WebSocket with an unguessable per-process path, and checks the exact Host and Origin. The remote UI cannot choose a host or execute a shell command: it can only propose a validated localhost port and DNS-safe subdomain. Every mutation is shown in a local confirmation layer before it reaches the tunnel manager.

The /cli/control UI shell remains data-free and public when the server uses dashboard password mode. It receives no password cookie or tunnel key. If the remote UI cannot load, no new local port is exposed; already running tunnels continue until the CLI process exits or they are stopped.