@miraj181/ipingyou 1.0.1 → 2.0.0

package/src/modes/host.js

@@ -16,13 +16,18 @@
 import { execa, execaCommand } from 'execa';
 import chalk from 'chalk';
 import inquirer from 'inquirer';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { generateUID } from '../lib/uid.js';
-import { encrypt } from '../lib/crypto.js';
-import { trackPID, untrackPID, setRevokeOnExit } from '../lib/cleanup.js';
+import { encrypt, decrypt } from '../lib/crypto.js';
+import { trackPID, untrackPID, setRevokeOnExit, addCleanupHook } from '../lib/cleanup.js';
 import { detectOS } from '../lib/platform.js';
 import { createSpinner, cryptoSpinner, tunnelSpinner, networkSpinner, typeText } from '../lib/animations.js';
+import { startChatServer, openLocalChatUI } from '../lib/chat.js';
+import open from 'open';
 
-const BROKER_URL = process.env.BROKER_URL || 'https://ipingyou.onrender.com';
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+let BROKER_URL = process.env.BROKER_URL || 'https://ipingyou.onrender.com';
 
 /**
  * Ensure the local SSH server is running.
@@ -76,73 +81,176 @@ async function ensureSSHRunning() {
       }
     }
   } catch (err) {
-    spinner.fail(`SSH check failed: ${err.message}`);
-    console.log(chalk.dim('  Continue anyway? The tunnel will still start, but SSH connections may fail.'));
+    spinner.fail(`Service check failed: ${err.message}`);
+    console.log(chalk.dim('  Continue anyway? The tunnel will still start, but connections may fail.'));
   }
 }
 
 /**
- * Spawn cloudflared tunnel and extract the generated URL.
+ * Supervise cloudflared tunnel, restarting it if it crashes.
  */
-async function spawnTunnel() {
-  const spinner = createSpinner('Starting Cloudflare tunnel...', tunnelSpinner).start();
+async function spawnTunnelSupervised(targetUrl, onUrlGenerated) {
+  let isShuttingDown = false;
+  let activeChild = null;
+
+  const loop = async () => {
+    while (!isShuttingDown) {
+      const spinner = createSpinner('Starting Cloudflare tunnel...', tunnelSpinner).start();
+      
+      await new Promise((resolve) => {
+        activeChild = execa('cloudflared', ['tunnel', '--url', targetUrl], {
+          reject: false,
+          all: true,
+        });
+
+        trackPID(activeChild.pid);
+        let tunnelUrl = null;
+        let resolved = false;
+
+        activeChild.all.on('data', (chunk) => {
+          const text = chunk.toString();
+          const match = text.match(/https:\/\/[-0-9a-z]+\.trycloudflare\.com/);
+          if (match && !resolved) {
+            tunnelUrl = match[0];
+            resolved = true;
+            spinner.succeed(`Tunnel active: ${chalk.cyan(tunnelUrl)}`);
+            onUrlGenerated(tunnelUrl);
+          }
+        });
+
+        activeChild.on('exit', (code) => {
+          untrackPID(activeChild.pid);
+          if (!resolved) {
+            spinner.fail('Cloudflare tunnel exited before generating URL');
+          } else if (!isShuttingDown) {
+            console.log(chalk.yellow(`\n  ⚠️  Tunnel disconnected (code ${code}). Restarting...`));
+          }
+          resolve(); // Let the loop continue to restart
+        });
+
+        activeChild.on('error', (err) => {
+          untrackPID(activeChild.pid);
+          spinner.fail(`Tunnel error: ${err.message}`);
+          resolve();
+        });
+      });
+
+      if (!isShuttingDown) {
+        // Wait a bit before restarting to avoid tight loop
+        await new Promise(r => setTimeout(r, 2000));
+      }
+    }
+  };
 
-  return new Promise((resolve, reject) => {
-    const child = execa('cloudflared', ['tunnel', '--url', 'ssh://localhost:22'], {
-      reject: false,
-      all: true,
-    });
+  loop(); // Fire and forget the supervisor loop
 
-    trackPID(child.pid);
-    let tunnelUrl = null;
-    let resolved = false;
-
-    child.all.on('data', (chunk) => {
-      const text = chunk.toString();
-      const match = text.match(/https:\/\/[-0-9a-z]+\.trycloudflare\.com/);
-      if (match && !resolved) {
-        tunnelUrl = match[0];
-        resolved = true;
-        spinner.succeed(`Tunnel active: ${chalk.cyan(tunnelUrl)}`);
-        resolve({ process: child, url: tunnelUrl });
+  return {
+    kill: () => {
+      isShuttingDown = true;
+      if (activeChild) {
+        untrackPID(activeChild.pid);
+        try { process.kill(activeChild.pid); } catch { /* ignore */ }
       }
-    });
+    }
+  };
+}
 
-    child.on('exit', (code) => {
-      untrackPID(child.pid);
-      if (!resolved) {
-        spinner.fail('Cloudflare tunnel exited before generating URL');
-        reject(new Error(`cloudflared exited with code ${code}`));
-      }
-    });
+// ─── Ephemeral SSH Key Management ────────────────────────────
+async function generateEphemeralKey() {
+  const osInfo = detectOS();
+  const tmpDir = osInfo.isWindows ? process.env.TEMP : '/tmp';
+  const keyPath = path.join(tmpDir, `ipingyou_${Date.now()}`);
+  
+  await execa('ssh-keygen', ['-t', 'ed25519', '-C', 'ipingyou-ephemeral', '-f', keyPath, '-N', '']);
+  
+  const privKey = (await fs.promises.readFile(keyPath, 'utf8')).trim();
+  const pubKey = (await fs.promises.readFile(`${keyPath}.pub`, 'utf8')).trim();
+  
+  return { keyPath, privKey, pubKey };
+}
 
-    child.on('error', (err) => {
-      untrackPID(child.pid);
-      if (!resolved) {
-        spinner.fail(`Tunnel error: ${err.message}`);
-        reject(err);
-      }
-    });
+async function injectPublicKey(pubKey) {
+  const osInfo = detectOS();
+  const sshDir = path.join(osInfo.homedir, '.ssh');
+  
+  if (!fs.existsSync(sshDir)) {
+    await fs.promises.mkdir(sshDir, { mode: 0o700, recursive: true });
+  }
+  
+  const authKeysPath = path.join(sshDir, 'authorized_keys');
+  await fs.promises.appendFile(authKeysPath, `\n${pubKey}\n`);
+  return authKeysPath;
+}
 
-    setTimeout(() => {
-      if (!resolved) {
-        spinner.fail('Timeout: No tunnel URL received after 30 seconds');
-        reject(new Error('Tunnel timeout'));
-      }
-    }, 30000);
+async function removePublicKey(authKeysPath, pubKey) {
+  if (fs.existsSync(authKeysPath)) {
+    let keys = await fs.promises.readFile(authKeysPath, 'utf8');
+    keys = keys.replace(`\n${pubKey}\n`, '');
+    await fs.promises.writeFile(authKeysPath, keys);
+  }
+}
+
+/**
+ * Ping the broker to see if it's online.
+ */
+async function pingBroker(url) {
+  try {
+    const controller = new AbortController();
+    const id = setTimeout(() => controller.abort(), 3000);
+    const res = await fetch(`${url}/health`, { signal: controller.signal });
+    clearTimeout(id);
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Auto-spawn a Private Broker locally and wrap it in a Cloudflare tunnel.
+ */
+async function spawnPrivateBroker() {
+  console.log(chalk.yellow('\n  ⚠️  Public Broker is unreachable. Spawning Private Broker...'));
+  
+  // 1. Spawn the broker server process
+  const brokerProcess = execa('node', [path.join(__dirname, '../server.js')], {
+    env: { ...process.env, PORT: '4040' },
+    reject: false
   });
+  trackPID(brokerProcess.pid);
+
+  // 2. Wrap it in a cloudflare tunnel
+  let brokerTunnelUrl = null;
+  const privateBrokerTunnelProcess = await spawnTunnelSupervised('http://localhost:4040', (newUrl) => {
+    brokerTunnelUrl = newUrl;
+  });
+
+  while (!brokerTunnelUrl) {
+    await new Promise(r => setTimeout(r, 100));
+  }
+
+  console.log(chalk.green(`  ✅ Private Broker Active: ${chalk.bold.cyan(brokerTunnelUrl)}\n`));
+  
+  return {
+    url: brokerTunnelUrl,
+    kill: () => {
+      privateBrokerTunnelProcess.kill();
+      untrackPID(brokerProcess.pid);
+      try { process.kill(brokerProcess.pid); } catch { /* ignore */ }
+    }
+  };
 }
 
 /**
- * Encrypt tunnel URL and register with the Central Broker.
+ * Encrypt tunnel details and register with the Central Broker.
  */
-async function registerWithBroker(uid, tunnelUrl) {
-  const spinner = createSpinner('Encrypting tunnel URL...', cryptoSpinner).start();
+async function registerWithBroker(uid, tunnelUrl, password, serviceConfig) {
+  const spinner = createSpinner('Encrypting session data...', cryptoSpinner).start();
 
   try {
-    // Encrypt the tunnel URL LOCALLY before sending
+    // Encrypt the JSON payload LOCALLY before sending
     await new Promise(r => setTimeout(r, 600)); // animation effect
-    const encrypted = encrypt(tunnelUrl);
+    const payload = JSON.stringify({ url: tunnelUrl, ...serviceConfig });
+    const encrypted = encrypt(payload, password);
 
     spinner.text = 'Registering with broker...';
 
@@ -153,6 +261,7 @@ async function registerWithBroker(uid, tunnelUrl) {
         uid,
         iv: encrypted.iv,
         ciphertext: encrypted.ciphertext,
+        salt: encrypted.salt,
       }),
     });
 
@@ -172,83 +281,158 @@ async function registerWithBroker(uid, tunnelUrl) {
   }
 }
 
-/**
- * Monitor active connections to port 22.
- */
-async function getConnectedIPs() {
-  const osInfo = detectOS();
-  try {
-    let cmd;
-    if (osInfo.isWindows) {
-      cmd = 'netstat -an | findstr :22 | findstr ESTABLISHED';
-    } else {
-      cmd = "ss -tn sport = :22 | grep ESTAB | awk '{print $5}' | cut -d: -f1";
-    }
-    const { stdout } = await execaCommand(cmd, { shell: true, reject: false });
-    return stdout.split('\n').filter(Boolean).map(ip => ip.trim());
-  } catch {
-    return [];
-  }
-}
+// Monitor active connections removed (replaced by Telemetry)
 
 /**
  * Display the host dashboard and handle user input.
  */
-async function hostDashboard(uid, tunnelUrl) {
-  console.log('');
-  console.log(chalk.bold('  ╔════════════════════════════════════════════════════╗'));
-  console.log(chalk.bold('  ║         🛡️  SecureLink — HOST MODE ACTIVE          ║'));
-  console.log(chalk.bold('  ╠════════════════════════════════════════════════════╣'));
-  console.log(`  ║  ${chalk.cyan('UID:')}        ${chalk.bold.white(uid)}                              ║`);
-  console.log(`  ║  ${chalk.cyan('Tunnel:')}     ${chalk.dim(tunnelUrl.substring(0, 40))}  ║`);
-  console.log(`  ║  ${chalk.cyan('Broker:')}     ${chalk.dim(BROKER_URL.padEnd(25))}  ║`);
-  console.log(`  ║  ${chalk.cyan('Crypto:')}     ${chalk.green('AES-256-CBC E2E')}                      ║`);
-  console.log(chalk.bold('  ╠════════════════════════════════════════════════════╣'));
-  console.log(`  ║  ${chalk.yellow('Share this UID with the person who needs access')}   ║`);
-  console.log(`  ║  ${chalk.dim('Press Ctrl+C to terminate the session')}              ║`);
-  console.log(chalk.bold('  ╚════════════════════════════════════════════════════╝'));
-  console.log('');
-
-  await typeText(chalk.dim('  Listening for incoming connections...'), 30);
-
-  const monitorInterval = setInterval(async () => {
-    const ips = await getConnectedIPs();
-    if (ips.length > 0) {
-      console.log(chalk.cyan(`  📡 Active connections (${ips.length}):`));
-      ips.forEach(ip => console.log(chalk.dim(`     → ${ip}`)));
+async function hostDashboard(uid, tunnelUrl, password, serviceConfig, tunnelProcess) {
+  let chatServerInstance = null;
+  let chatTunnelProcess = null;
+
+  const renderDashboard = () => {
+    console.clear();
+    console.log('');
+    console.log(chalk.bold('  ╔════════════════════════════════════════════════════╗'));
+    console.log(chalk.bold('  ║         🛡️  SecureLink — HOST MODE ACTIVE          ║'));
+    console.log(chalk.bold('  ╠════════════════════════════════════════════════════╣'));
+    console.log(`  ║  ${chalk.cyan('UID:')}        ${chalk.bold.white(uid.padEnd(30))}║`);
+    console.log(`  ║  ${chalk.cyan('Password:')}   ${chalk.bold.white(password.padEnd(30))}║`);
+    console.log(`  ║  ${chalk.cyan('Service:')}    ${chalk.dim(serviceConfig.type.toUpperCase() + ' (Port ' + serviceConfig.port + ')').padEnd(30)}║`);
+    console.log(`  ║  ${chalk.cyan('Tunnel:')}     ${chalk.dim(tunnelUrl.substring(0, 40))}  ║`);
+    if (serviceConfig.chatUrl) {
+      console.log(`  ║  ${chalk.cyan('Chat URL:')}   ${chalk.dim(serviceConfig.chatUrl.substring(0, 40))}  ║`);
     }
-  }, 15000);
+    console.log(`  ║  ${chalk.cyan('Broker:')}     ${chalk.dim(BROKER_URL.substring(0, 40))}  ║`);
+    console.log(`  ║  ${chalk.cyan('Crypto:')}     ${chalk.green('AES-256-CBC E2E (PBKDF2)')}             ║`);
+    console.log(chalk.bold('  ╠════════════════════════════════════════════════════╣'));
+    console.log(`  ║  ${chalk.yellow('Share the UID, Password & Broker URL with client ')}  ║`);
+    console.log(`  ║  ${chalk.dim('Press Ctrl+C to terminate the session')}              ║`);
+    console.log(chalk.bold('  ╚════════════════════════════════════════════════════╝'));
+    console.log('');
+  };
+
+  renderDashboard();
+  await typeText(chalk.dim(`  Listening for incoming connections on port ${serviceConfig.port}...`), 30);
+  console.log('');
 
   const waitForAction = async () => {
     try {
+      const choices = [
+        { name: '📡 See detailed client telemetry', value: 'show' },
+        { name: '📺 Mirror Client Terminal (requires tmux)', value: 'mirror' },
+        { name: '🔄 Re-register with broker', value: 'reregister' }
+      ];
+
+      if (!chatServerInstance) {
+        choices.push({ name: '💬 Start Real-time Chat Room', value: 'chat' });
+      } else {
+        choices.push({ name: '💬 Re-open Chat Room in Browser', value: 'reopen_chat' });
+      }
+
+      choices.push(
+        { name: '🚫 Terminate all connections', value: 'terminate' },
+        { name: '❌ Shut down session', value: 'exit' }
+      );
+
       const { action } = await inquirer.prompt([
         {
           type: 'list',
           name: 'action',
           message: 'Host Controls:',
-          choices: [
-            { name: '📡 Show connected clients', value: 'show' },
-            { name: '🔄 Re-register with broker', value: 'reregister' },
-            { name: '🚫 Terminate all connections', value: 'terminate' },
-            { name: '❌ Shut down session', value: 'exit' },
-          ],
+          choices,
         },
       ]);
 
       switch (action) {
+        case 'chat': {
+          console.log(chalk.dim('\n  Starting chat server...'));
+          chatServerInstance = await startChatServer(async () => {
+             if (chatTunnelProcess) {
+               chatTunnelProcess.kill();
+               chatTunnelProcess = null;
+               chatServerInstance = null;
+               delete serviceConfig.chatUrl;
+               await registerWithBroker(uid, tunnelUrl, password, serviceConfig);
+               renderDashboard();
+             }
+          });
+
+          console.log(chalk.dim('  Provisioning Cloudflare tunnel for chat...'));
+          chatTunnelProcess = await spawnTunnelSupervised(`http://localhost:${chatServerInstance.port}`, async (newUrl) => {
+            serviceConfig.chatUrl = newUrl;
+            await registerWithBroker(uid, tunnelUrl, password, serviceConfig);
+            renderDashboard();
+          });
+
+          while (!serviceConfig.chatUrl) {
+            await new Promise(r => setTimeout(r, 100));
+          }
+
+          console.log(chalk.green('  ✅ Chat Room Live! Clients can now join.'));
+          await openLocalChatUI(chatServerInstance.port, password);
+          return waitForAction();
+        }
+
+        case 'reopen_chat': {
+          if (chatServerInstance) await openLocalChatUI(chatServerInstance.port, password);
+          return waitForAction();
+        }
+
+        case 'mirror': {
+          console.log('');
+          console.log(chalk.bold.cyan('  📺 Terminal Mirroring'));
+          console.log(chalk.dim('  ──────────────────────────────────────'));
+          console.log(chalk.dim('  Attaching to client session. Press Ctrl+b then d to detach gracefully!'));
+          console.log(chalk.dim('  If no client has connected yet or tmux is missing, this will fail.'));
+          console.log('');
+          
+          try {
+            await execaCommand('tmux attach -t SecureLink_Session -r', { stdio: 'inherit' });
+          } catch {
+            console.log(chalk.yellow('  ⚠️  Could not attach. Ensure a client is connected and tmux is installed.'));
+          }
+          return waitForAction();
+        }
+
         case 'show': {
-          const ips = await getConnectedIPs();
-          if (ips.length === 0) {
-            console.log(chalk.dim('  No active connections.'));
-          } else {
-            console.log(chalk.cyan(`  📡 ${ips.length} connected client(s):`));
-            ips.forEach(ip => console.log(`     ${chalk.white('→')} ${ip}`));
+          const spinner = createSpinner('Fetching secure client telemetry...', networkSpinner).start();
+          try {
+            const res = await fetch(`${BROKER_URL}/clients/${uid}`);
+            if (!res.ok) throw new Error('Failed to fetch from broker');
+            const data = await res.json();
+            
+            if (!data.clients || data.clients.length === 0) {
+              spinner.warn('No clients have successfully connected and sent telemetry yet.');
+            } else {
+              spinner.succeed(`Found ${data.clients.length} recent connection(s):`);
+              
+              data.clients.forEach((clientBlob, i) => {
+                try {
+                  // Decrypt using the unique salt the client generated for this payload
+                  const decrypted = decrypt(clientBlob.iv, clientBlob.ciphertext, password, clientBlob.salt);
+                  const t = JSON.parse(decrypted);
+                  
+                  console.log(chalk.bold.blue(`\n  Client #${i+1} (${t.username})`));
+                  console.log(`    IP:       ${chalk.white(t.ip)}`);
+                  console.log(`    OS:       ${chalk.dim(t.os)}`);
+                  console.log(`    CPU:      ${chalk.dim(t.cpu)}`);
+                  console.log(`    RAM:      ${chalk.dim(t.ram)}`);
+                  console.log(`    Time:     ${chalk.dim(t.time)}`);
+                } catch (e) {
+                  console.log(chalk.yellow(`\n  Client #${i+1}: Payload decryption failed (wrong password or corrupted).`));
+                }
+              });
+            }
+          } catch (e) {
+             spinner.fail('Could not reach broker.');
           }
+          console.log('');
           return waitForAction();
         }
 
         case 'reregister':
-          await registerWithBroker(uid, tunnelUrl);
+          await registerWithBroker(uid, tunnelUrl, password, serviceConfig);
           return waitForAction();
 
         case 'terminate': {
@@ -268,6 +452,9 @@ async function hostDashboard(uid, tunnelUrl) {
 
         case 'exit':
           clearInterval(monitorInterval);
+          if (tunnelProcess) tunnelProcess.kill();
+          if (chatTunnelProcess) chatTunnelProcess.kill();
+          if (global.privateBrokerInstance) global.privateBrokerInstance.kill();
           return;
       }
     } catch (err) {
@@ -292,25 +479,135 @@ export async function startHostMode() {
   console.log(`  ${chalk.green('✓')} Session UID: ${chalk.bold.white(uid)}`);
   console.log('');
 
-  await ensureSSHRunning();
+  const { pwdInput } = await inquirer.prompt([
+    {
+      type: 'input',
+      name: 'pwdInput',
+      message: 'Enter a session password to encrypt the tunnel (leave blank to auto-generate):',
+    },
+  ]);
+  const password = pwdInput.trim() || generateUID();
+  console.log(`  ${chalk.green('✓')} Password: ${chalk.bold.white(password)}`);
+  console.log('');
 
-  let tunnel;
-  try {
-    tunnel = await spawnTunnel();
-  } catch (err) {
-    console.error(chalk.red(`\n  ❌ FATAL: Failed to start tunnel`));
-    console.error(chalk.red(`     Error: ${err.message}`));
-    console.log(chalk.dim('     Make sure cloudflared is installed and in your PATH.'));
-    process.exit(1);
+  // ─── Broker Selection ───
+  if (!process.env.BROKER_URL) {
+    const { brokerChoice } = await inquirer.prompt([
+      {
+        type: 'list',
+        name: 'brokerChoice',
+        message: 'Which Broker Server would you like to use?',
+        choices: [
+          { name: '🌍 Global Public Broker (Render)', value: 'global' },
+          { name: '🛠️  Create a Private Broker (Local + Cloudflare)', value: 'create_private' }
+        ]
+      }
+    ]);
+
+    if (brokerChoice === 'create_private') {
+      global.privateBrokerInstance = await spawnPrivateBroker();
+      BROKER_URL = global.privateBrokerInstance.url;
+    }
   }
 
-  const registered = await registerWithBroker(uid, tunnel.url);
-  if (!registered) {
-    console.error(chalk.red(`\n  ❌ FATAL: Could not register with broker at ${BROKER_URL}`));
-    process.exit(1);
+  // Only ping if we haven't just created a private broker
+  if (!global.privateBrokerInstance) {
+    const spinner = createSpinner(`Checking broker status at ${BROKER_URL}...`, networkSpinner).start();
+    const brokerOnline = await pingBroker(BROKER_URL);
+    
+    if (brokerOnline) {
+      spinner.succeed(`Broker is online ${chalk.dim(`(${BROKER_URL})`)}`);
+    } else {
+      spinner.warn(`Broker is unreachable ${chalk.dim(`(${BROKER_URL})`)}`);
+      const { startPrivate } = await inquirer.prompt([
+        {
+          type: 'confirm',
+          name: 'startPrivate',
+          message: 'The broker is offline. Do you want to auto-spawn a Private Broker on this machine?',
+          default: true
+        }
+      ]);
+      if (startPrivate) {
+        global.privateBrokerInstance = await spawnPrivateBroker();
+        BROKER_URL = global.privateBrokerInstance.url;
+      } else {
+        console.log(chalk.red('\n  ❌ FATAL: Cannot continue without a broker.'));
+        process.exit(1);
+      }
+    }
+  }
+
+  console.log('');
+  const { serviceType } = await inquirer.prompt([
+    {
+      type: 'list',
+      name: 'serviceType',
+      message: 'What service do you want to expose?',
+      choices: [
+        { name: '🖥️  SSH (Port 22)', value: 'ssh' },
+        { name: '🌐 Web/HTTP (Custom Port)', value: 'http' },
+        { name: '🔌 Custom TCP Port (e.g. Database, RDP, VNC)', value: 'tcp' }
+      ]
+    }
+  ]);
+
+  let targetPort = 22;
+  let protocol = 'ssh';
+
+  if (serviceType === 'http') {
+    const ans = await inquirer.prompt([{ name: 'port', message: 'Enter local HTTP port (e.g. 3000):', default: '3000' }]);
+    targetPort = ans.port;
+    protocol = 'http';
+  } else if (serviceType === 'tcp') {
+    const ans = await inquirer.prompt([{ name: 'port', message: 'Enter local TCP port (e.g. 3389 for RDP, 5432 for Postgres):' }]);
+    targetPort = ans.port;
+    protocol = 'tcp';
+  }
+
+  const serviceConfig = { type: serviceType, port: targetPort, protocol };
+  const targetUrl = `${protocol}://localhost:${targetPort}`;
+
+  if (serviceType === 'ssh') {
+    await ensureSSHRunning();
+    console.log(chalk.dim('  🔑 Generating ephemeral SSH key for passwordless entry...'));
+    try {
+      const ephemeralKey = await generateEphemeralKey();
+      const authKeysPath = await injectPublicKey(ephemeralKey.pubKey);
+      
+      serviceConfig.privateKey = ephemeralKey.privKey;
+      
+      addCleanupHook(async () => {
+        console.log(chalk.dim('     Removing ephemeral public key...'));
+        await removePublicKey(authKeysPath, ephemeralKey.pubKey);
+        try { await fs.promises.unlink(ephemeralKey.keyPath); } catch {}
+        try { await fs.promises.unlink(`${ephemeralKey.keyPath}.pub`); } catch {}
+      });
+      console.log(chalk.green('  ✓ Ephemeral key injected. Client will connect without system password!'));
+    } catch (err) {
+      console.log(chalk.yellow(`  ⚠️  Could not generate ephemeral key: ${err.message}`));
+      console.log(chalk.dim('     Client will need to use standard OS password.'));
+    }
+  } else {
+    console.log(chalk.dim(`  ℹ️  Ensure your ${protocol.toUpperCase()} service is running on port ${targetPort}.`));
+  }
+
+  let tunnelUrl = null;
+  const tunnelProcess = await spawnTunnelSupervised(targetUrl, async (newUrl) => {
+    tunnelUrl = newUrl;
+    // Register or re-register with broker when tunnel is spawned/respawned
+    const registered = await registerWithBroker(uid, tunnelUrl, password, serviceConfig);
+    if (!registered) {
+      console.error(chalk.red(`\n  ❌ FATAL: Could not register with broker at ${BROKER_URL}`));
+      process.exit(1);
+    }
+  });
+
+  // Wait for the first URL to be generated before showing the dashboard
+  while (!tunnelUrl) {
+    await new Promise(r => setTimeout(r, 100));
   }
 
   setRevokeOnExit(uid, BROKER_URL);
 
-  await hostDashboard(uid, tunnel.url);
+  await hostDashboard(uid, tunnelUrl, password, serviceConfig, tunnelProcess);
 }