@miraj181/ipingyou 2.0.10 → 2.0.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraj181/ipingyou",
-  "version": "2.0.10",
+  "version": "2.0.12",
   "description": "SecureLink-CLI — Secure peer-to-peer remote access via SSH & Cloudflare Tunnels",
   "main": "src/cli.js",
   "bin": {

package/src/cli.js

@@ -21,12 +21,17 @@
 import { Command } from 'commander';
 import inquirer from 'inquirer';
 import chalk from 'chalk';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 
 import { detectOS, checkDependencies } from './lib/platform.js';
-import { installShutdownHandlers, executePanicMode } from './lib/cleanup.js';
+import { cleanupAll, installShutdownHandlers, executePanicMode } from './lib/cleanup.js';
 import { startHostMode } from './modes/host.js';
 import { startClientMode } from './modes/client.js';
 
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const packageJson = JSON.parse(fs.readFileSync(path.join(__dirname, '../package.json'), 'utf8'));
 
 // ─── ASCII Banner ────────────────────────────────────────────
 const wolfAscii = [
@@ -146,19 +151,9 @@ function fatal(context, err) {
     stackLines.forEach(line => console.error(chalk.dim(`     ${line.trim()}`)));
   }
   console.error('');
-  process.exit(1);
+  cleanupAll().finally(() => process.exit(1));
 }
 
-// ─── Process-Level Error Catching ────────────────────────────
-process.on('uncaughtException', (err) => {
-  fatal('uncaughtException', err);
-});
-
-process.on('unhandledRejection', (reason) => {
-  const err = reason instanceof Error ? reason : new Error(String(reason));
-  fatal('unhandledRejection', err);
-});
-
 // ─── Interactive Mode Selection ──────────────────────────────
 async function interactiveMode() {
   showBanner();
@@ -225,7 +220,7 @@ const program = new Command();
 program
   .name('ipingyou')
   .description('SecureLink-CLI — Secure P2P remote access via SSH & Cloudflare Tunnels')
-  .version('1.0.0')
+  .version(packageJson.version)
   .option('-b, --broker <url>', 'Override the central broker URL')
   .addHelpText('beforeAll', () => {
     showBanner();
@@ -255,7 +250,7 @@ program
   .command('connect')
   .description('Connect to a remote machine via its UID (SSH or SCP)')
   .option('-u, --uid <uid>', 'The remote host UID')
-  .action(async () => {
+  .action(async (commandOptions) => {
     try {
       const opts = program.opts();
       if (opts.broker) process.env.BROKER_URL = opts.broker;
@@ -264,7 +259,7 @@ program
       showSystemInfo();
       installShutdownHandlers();
       await checkDependencies();
-      await startClientMode();
+      await startClientMode({ uid: commandOptions.uid });
     } catch (err) {
       fatal('connect', err);
     }

package/src/lib/broker.js

@@ -0,0 +1,144 @@
+import chalk from 'chalk';
+import os from 'node:os';
+import { decrypt, encrypt } from './crypto.js';
+import { createSpinner, cryptoSpinner, networkSpinner } from './animations.js';
+
+export async function pingBroker(url) {
+  try {
+    const controller = new AbortController();
+    const id = setTimeout(() => controller.abort(), 3000);
+    const res = await fetch(`${url}/health`, { signal: controller.signal });
+    clearTimeout(id);
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+
+export async function registerWithBroker(brokerUrl, uid, tunnelUrl, password, serviceConfig) {
+  const spinner = createSpinner('Encrypting session data...', cryptoSpinner).start();
+
+  try {
+    await new Promise(r => setTimeout(r, 600));
+    const payload = JSON.stringify({ url: tunnelUrl, ...serviceConfig });
+    const encrypted = encrypt(payload, password);
+
+    spinner.text = 'Registering with broker...';
+
+    const res = await fetch(`${brokerUrl}/register`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        uid,
+        iv: encrypted.iv,
+        ciphertext: encrypted.ciphertext,
+        salt: encrypted.salt,
+      }),
+    });
+
+    if (!res.ok) {
+      const data = await res.json().catch(() => ({}));
+      throw new Error(data.error || `HTTP ${res.status}`);
+    }
+
+    spinner.succeed(`Registered with broker ${chalk.dim(`(${brokerUrl})`)} ${chalk.green('[E2E encrypted]')}`);
+    return true;
+  } catch (err) {
+    spinner.fail(`Broker registration failed: ${err.message}`);
+    console.error(chalk.red(`  ❌ Error: ${err.message}`));
+    console.log(chalk.yellow('  ⚠️  Remote clients won\'t be able to find you without the broker.'));
+    console.log(chalk.dim('     Share the tunnel URL directly if needed.'));
+    return false;
+  }
+}
+
+export async function resolveUID(brokerUrl, uid, password, silent = false) {
+  const spinner = !silent ? createSpinner(`Resolving UID ${chalk.cyan(uid)}...`, networkSpinner).start() : null;
+
+  try {
+    const res = await fetch(`${brokerUrl}/resolve/${uid}`);
+
+    if (res.status === 404) {
+      if (spinner) spinner.fail('UID not found — the host may not be online or the session expired');
+      else console.error(chalk.red('  ❌ UID not found or expired.'));
+      return null;
+    }
+    if (res.status === 410) {
+      if (spinner) spinner.fail('UID has expired — ask the host for a new session');
+      else console.error(chalk.red('  ❌ UID expired.'));
+      return null;
+    }
+    if (!res.ok) {
+      const data = await res.json().catch(() => ({}));
+      throw new Error(data.error || `HTTP ${res.status}`);
+    }
+
+    const data = await res.json();
+
+    if (!data.iv || !data.ciphertext || !data.salt) {
+      if (spinner) spinner.fail('Broker returned invalid response — missing encrypted data or salt');
+      return null;
+    }
+
+    if (spinner) spinner.text = 'Decrypting tunnel URL locally...';
+    if (!silent) await new Promise(r => setTimeout(r, 600));
+
+    let decryptedPayload;
+    try {
+      decryptedPayload = decrypt(data.iv, data.ciphertext, password, data.salt);
+    } catch {
+      if (spinner) spinner.fail('Decryption failed — incorrect password or corrupted data');
+      if (!spinner) console.error(chalk.red('  ❌ Error: Could not decrypt tunnel data. Incorrect password.'));
+      return null;
+    }
+
+    let payloadConfig;
+    try {
+      payloadConfig = JSON.parse(decryptedPayload);
+      if (typeof payloadConfig !== 'object' || !payloadConfig.url) {
+        payloadConfig = { url: decryptedPayload, type: 'ssh' };
+      }
+    } catch {
+      payloadConfig = { url: decryptedPayload, type: 'ssh' };
+    }
+
+    if (!payloadConfig.url.startsWith('https://')) {
+      if (spinner) spinner.fail('Decrypted data is not a valid tunnel URL (incorrect password)');
+      return null;
+    }
+
+    if (spinner) spinner.succeed(`Resolved: ${chalk.dim(payloadConfig.url)} ${chalk.green('[decrypted locally]')}`);
+    return payloadConfig;
+  } catch (err) {
+    if (spinner) spinner.fail(`Broker lookup failed: ${err.message}`);
+    return null;
+  }
+}
+
+export async function pushTelemetry(brokerUrl, uid, password, username) {
+  try {
+    let publicIp = 'Unknown';
+    try {
+      publicIp = await fetch('https://api.ipify.org').then(r => r.text());
+    } catch {}
+
+    const telemetry = {
+      username,
+      ip: publicIp,
+      os: `${os.type()} ${os.release()} (${os.arch()})`,
+      cpu: os.cpus()[0]?.model || 'Unknown CPU',
+      ram: `${Math.round(os.totalmem() / 1024 / 1024 / 1024)} GB`,
+      time: new Date().toLocaleTimeString()
+    };
+
+    const { iv, ciphertext, salt } = encrypt(JSON.stringify(telemetry), password);
+
+    await fetch(`${brokerUrl}/client-info/${uid}`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ iv, ciphertext, salt }),
+    });
+  } catch {
+    // Telemetry is optional.
+  }
+}

package/src/lib/checksum.js

@@ -0,0 +1,12 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+
+export async function calculateChecksum(filePath) {
+  return new Promise((resolve) => {
+    const hash = crypto.createHash('sha256');
+    const stream = fs.createReadStream(filePath);
+    stream.on('error', () => resolve(null));
+    stream.on('data', chunk => hash.update(chunk));
+    stream.on('end', () => resolve(hash.digest('hex')));
+  });
+}

package/src/lib/cleanup.js

@@ -10,6 +10,10 @@
 
 import treeKill from 'tree-kill';
 import chalk from 'chalk';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { execaCommand } from 'execa';
 
 /** @type {Set<number>} — Active child PIDs we manage */
 const trackedPIDs = new Set();
@@ -22,6 +26,7 @@ let _brokerUrl = null;
 
 /** @type {Array<() => Promise<void>|void>} — Custom cleanup hooks */
 const _cleanupHooks = [];
+let cleanedUp = false;
 
 /**
  * Register a custom cleanup hook to run on shutdown.
@@ -62,11 +67,10 @@ export function setRevokeOnExit(uid, brokerUrl) {
  * @param {number} pid
  * @returns {Promise<void>}
  */
-function killPID(pid) {
+export function killProcessTree(pid, signal = 'SIGTERM') {
   return new Promise((resolve) => {
-    treeKill(pid, 'SIGTERM', (err) => {
+    treeKill(pid, signal, (err) => {
       if (err) {
-        // Force kill if SIGTERM fails
         treeKill(pid, 'SIGKILL', () => resolve());
       } else {
         resolve();
@@ -79,6 +83,9 @@ function killPID(pid) {
  * Kill all tracked PIDs and revoke UID from broker.
  */
 export async function cleanupAll() {
+  if (cleanedUp) return;
+  cleanedUp = true;
+
   console.log('');
   console.log(chalk.yellow('  🧹 Cleaning up...'));
 
@@ -86,7 +93,7 @@ export async function cleanupAll() {
   const kills = [];
   for (const pid of trackedPIDs) {
     console.log(chalk.dim(`     Killing PID ${pid}...`));
-    kills.push(killPID(pid));
+    kills.push(killProcessTree(pid));
   }
   await Promise.allSettled(kills);
   trackedPIDs.clear();
@@ -136,10 +143,21 @@ export function installShutdownHandlers() {
 
   // Also handle uncaught exceptions gracefully
   process.on('uncaughtException', async (err) => {
+    if (shuttingDown) return;
+    shuttingDown = true;
     console.error(chalk.red(`  💥 Uncaught exception: ${err.message}`));
     await cleanupAll();
     process.exit(1);
   });
+
+  process.on('unhandledRejection', async (reason) => {
+    if (shuttingDown) return;
+    shuttingDown = true;
+    const err = reason instanceof Error ? reason : new Error(String(reason));
+    console.error(chalk.red(`  💥 Unhandled rejection: ${err.message}`));
+    await cleanupAll();
+    process.exit(1);
+  });
 }
 
 /**
@@ -154,11 +172,6 @@ export function getTrackedCount() {
  * Execute Panic Mode (Self-Destruct)
  * Wipes all configs, keys, and forcefully kills associated processes.
  */
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { execaCommand } from 'execa';
-
 export async function executePanicMode() {
   console.log(chalk.bold.red('\n  🚨 INITIATING SECURELINK PANIC MODE 🚨\n'));
   
@@ -167,10 +180,10 @@ export async function executePanicMode() {
   try {
     if (process.platform === 'win32') {
       await execaCommand('taskkill /F /IM cloudflared.exe', { reject: false });
-      await execaCommand('taskkill /F /IM sshd.exe', { reject: false });
     } else {
       await execaCommand('pkill -9 -f cloudflared', { reject: false });
       await execaCommand('pkill -9 -f "sshd:.*@"', { reject: false });
+      await execaCommand('tmux kill-session -t SecureLink_Session', { reject: false });
     }
   } catch {}
 
@@ -193,16 +206,25 @@ export async function executePanicMode() {
     const tmpDir = os.tmpdir();
     const files = fs.readdirSync(tmpDir);
     for (const file of files) {
-      if (file.startsWith('ipingyou_')) {
+      if (file.startsWith('ipingyou_') || file.startsWith('ipingyou-')) {
         fs.unlinkSync(path.join(tmpDir, file));
       }
     }
   } catch {}
 
-  // 4. Scrub SSH authorized_keys if we know we injected
-  // Note: We don't want to wipe the user's whole authorized_keys, but if we have a hook, we could.
-  // We'll skip scraping the actual file here unless we know the exact comment.
-  console.log(chalk.dim('  [4/4] Finalizing cleanup...'));
+  console.log(chalk.dim('  [4/4] Scrubbing injected SSH keys...'));
+  try {
+    const authKeysPath = path.join(os.homedir(), '.ssh', 'authorized_keys');
+    if (fs.existsSync(authKeysPath)) {
+      const current = fs.readFileSync(authKeysPath, 'utf8');
+      const cleaned = current
+        .split(/\r?\n/)
+        .filter(line => !line.includes('ipingyou-ephemeral'))
+        .join('\n')
+        .replace(/\n{3,}/g, '\n\n');
+      if (cleaned !== current) fs.writeFileSync(authKeysPath, cleaned);
+    }
+  } catch {}
 
   console.log(chalk.bold.green('\n  ✅ Panic Mode Complete. All traces removed.\n'));
   process.exit(0);

package/src/lib/config.js

@@ -15,8 +15,8 @@ function ensureConfig() {
 }
 
 export function getConfig() {
-  ensureConfig();
   try {
+    ensureConfig();
     return JSON.parse(fs.readFileSync(CONFIG_FILE, 'utf8'));
   } catch {
     return { aliases: {}, settings: {} };
@@ -24,8 +24,12 @@ export function getConfig() {
 }
 
 export function saveConfig(config) {
-  ensureConfig();
-  fs.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2));
+  try {
+    ensureConfig();
+    fs.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2));
+  } catch (err) {
+    throw new Error(`Could not save config: ${err.message}`);
+  }
 }
 
 export function saveAlias(aliasName, data) {

package/src/lib/path-browser.js

@@ -0,0 +1,232 @@
+import { execa } from 'execa';
+import chalk from 'chalk';
+import inquirer from 'inquirer';
+import fs from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+import { buildSshArgs, formatRemoteCd } from './ssh.js';
+
+function expandLocalPath(inputPath) {
+  const trimmed = inputPath.trim();
+  if (trimmed === '~') return os.homedir();
+  if (trimmed.startsWith(`~${path.sep}`) || trimmed.startsWith('~/')) {
+    return path.join(os.homedir(), trimmed.slice(2));
+  }
+  return trimmed;
+}
+
+export async function promptLocalFileBrowser(startPath = process.cwd()) {
+  let items;
+  try {
+    items = fs.readdirSync(startPath, { withFileTypes: true });
+  } catch (err) {
+    console.log(chalk.yellow(`  ⚠️  Cannot open ${startPath}: ${err.message}`));
+    const parent = path.dirname(startPath);
+    return promptLocalFileBrowser(parent === startPath ? process.cwd() : parent);
+  }
+
+  const choices = [
+    { name: '📁 .. (Up a directory)', value: 'UP' },
+    { name: '✅ SELECT CURRENT DIRECTORY', value: 'SELECT_DIR' },
+    new inquirer.Separator(),
+    ...items.map(item => ({
+      name: `${item.isDirectory() ? '📁' : '📄'} ${item.name}`,
+      value: path.join(startPath, item.name),
+      isDir: item.isDirectory()
+    }))
+  ];
+
+  const { selection } = await inquirer.prompt([{
+    type: 'list',
+    name: 'selection',
+    message: `Browse local files [${startPath}]:`,
+    choices,
+    pageSize: 15
+  }]);
+
+  if (selection === 'UP') {
+    return promptLocalFileBrowser(path.dirname(startPath));
+  }
+  if (selection === 'SELECT_DIR') {
+    return startPath;
+  }
+
+  let stat;
+  try {
+    stat = fs.statSync(selection);
+  } catch (err) {
+    console.log(chalk.yellow(`  ⚠️  Cannot access ${selection}: ${err.message}`));
+    return promptLocalFileBrowser(startPath);
+  }
+  if (stat.isDirectory()) {
+    const { action } = await inquirer.prompt([{
+      type: 'list',
+      name: 'action',
+      message: `Selected Folder: ${path.basename(selection)}`,
+      choices: [
+        { name: '📂 Open Folder', value: 'open' },
+        { name: '✅ Select this Folder for Transfer', value: 'select' }
+      ]
+    }]);
+
+    if (action === 'open') return promptLocalFileBrowser(selection);
+    return selection;
+  }
+
+  return selection;
+}
+
+export async function promptLocalPath(label, browserStart = process.cwd()) {
+  const { pathMode } = await inquirer.prompt([{
+    type: 'list',
+    name: 'pathMode',
+    message: `How do you want to select the ${label}?`,
+    choices: [
+      { name: '⌨️  Type path manually', value: 'manual' },
+      { name: '🔍 Browse local files interactively', value: 'browse' }
+    ]
+  }]);
+
+  if (pathMode === 'browse') {
+    return promptLocalFileBrowser(browserStart);
+  }
+
+  const { localPath } = await inquirer.prompt([{
+    type: 'input',
+    name: 'localPath',
+    message: `Local ${label} path:`,
+    validate: v => v.trim().length > 0 || 'Required',
+  }]);
+  return expandLocalPath(localPath);
+}
+
+async function listRemoteDirectory(username, hostname, privateKeyPath, remoteDir) {
+  const cdTarget = formatRemoteCd(remoteDir);
+  const cdCommand = cdTarget ? `cd ${cdTarget}` : 'cd';
+  const command = `${cdCommand} && printf '__SECURELINK_PWD__%s\\n' "$PWD" && ls -1Ap`;
+  const sshArgs = buildSshArgs(hostname, privateKeyPath);
+  sshArgs.push(`${username}@${hostname}`, command);
+
+  const result = await execa('ssh', sshArgs, {
+    stdio: ['inherit', 'pipe', 'inherit'],
+    reject: false,
+  });
+
+  if (result.exitCode !== 0) {
+    throw new Error('Remote directory listing failed');
+  }
+
+  const lines = result.stdout.split(/\r?\n/).filter(Boolean);
+  const pwdLine = lines.find(line => line.startsWith('__SECURELINK_PWD__'));
+  const pwd = pwdLine ? pwdLine.replace('__SECURELINK_PWD__', '') : remoteDir || '~';
+
+  const entries = lines
+    .filter(line => !line.startsWith('__SECURELINK_PWD__'))
+    .filter(line => !line.endsWith('@') && !line.endsWith('|') && !line.endsWith('='))
+    .map(line => {
+      const isDir = line.endsWith('/');
+      const name = isDir ? line.slice(0, -1) : line;
+      return {
+        name,
+        isDir,
+        path: pwd === '/' ? `/${name}` : `${pwd}/${name}`,
+      };
+    });
+
+  return { pwd, entries };
+}
+
+export async function promptRemotePath(username, hostname, privateKeyPath, purpose) {
+  const browseLabel = purpose === 'source'
+    ? 'Browse host files interactively'
+    : 'Browse host folders interactively';
+
+  const manualLabel = purpose === 'source'
+    ? 'Type host file/folder path manually'
+    : 'Type host destination path manually';
+
+  const { remoteMode } = await inquirer.prompt([{
+    type: 'list',
+    name: 'remoteMode',
+    message: purpose === 'source'
+      ? 'How do you want to select the host file/folder to download?'
+      : 'How do you want to select the host destination?',
+    choices: [
+      { name: `⌨️  ${manualLabel}`, value: 'manual' },
+      { name: `🔍 ${browseLabel}`, value: 'browse' }
+    ]
+  }]);
+
+  if (remoteMode === 'manual') {
+    const { remotePath } = await inquirer.prompt([{
+      type: 'input',
+      name: 'remotePath',
+      message: purpose === 'source'
+        ? `Host file/folder path (relative to ${username}'s home or absolute):`
+        : `Host destination path (relative to ${username}'s home or absolute):`,
+      validate: v => v.trim().length > 0 || 'Required',
+    }]);
+    return remotePath.trim();
+  }
+
+  let currentDir = '~';
+  while (true) {
+    let listing;
+    try {
+      listing = await listRemoteDirectory(username, hostname, privateKeyPath, currentDir);
+    } catch (err) {
+      console.log(chalk.yellow(`  ⚠️  Could not browse host files: ${err.message}`));
+      console.log(chalk.dim('     Falling back to manual host path entry.'));
+      const { remotePath } = await inquirer.prompt([{
+        type: 'input',
+        name: 'remotePath',
+        message: purpose === 'source' ? 'Host file/folder path:' : 'Host destination path:',
+        validate: v => v.trim().length > 0 || 'Required',
+      }]);
+      return remotePath.trim();
+    }
+
+    currentDir = listing.pwd;
+    const choices = [
+      { name: '📁 .. (Up a directory)', value: { action: 'up' } },
+      { name: purpose === 'destination' ? '✅ SELECT CURRENT DIRECTORY' : '✅ Select this Folder for Transfer', value: { action: 'select', path: currentDir } },
+      new inquirer.Separator(),
+      ...listing.entries.map(item => ({
+        name: `${item.isDir ? '📁' : '📄'} ${item.name}`,
+        value: { action: item.isDir ? 'open_or_select' : 'select', path: item.path, name: item.name }
+      }))
+    ];
+
+    const { selection } = await inquirer.prompt([{
+      type: 'list',
+      name: 'selection',
+      message: `Browse host files [${currentDir}]:`,
+      choices,
+      pageSize: 15
+    }]);
+
+    if (selection.action === 'up') {
+      currentDir = currentDir === '/' ? '/' : path.posix.dirname(currentDir);
+    } else if (selection.action === 'select') {
+      return selection.path;
+    } else if (selection.action === 'open_or_select') {
+      const { action } = await inquirer.prompt([{
+        type: 'list',
+        name: 'action',
+        message: `Selected Host Folder: ${selection.name}`,
+        choices: purpose === 'source'
+          ? [
+              { name: '📂 Open Folder', value: 'open' },
+              { name: '✅ Select this Folder for Transfer', value: 'select' }
+            ]
+          : [
+              { name: '📂 Open Folder', value: 'open' },
+              { name: '✅ Use this Folder as Destination', value: 'select' }
+            ]
+      }]);
+
+      if (action === 'open') currentDir = selection.path;
+      else return selection.path;
+    }
+  }
+}

package/src/lib/ssh.js

@@ -0,0 +1,55 @@
+import crypto from 'node:crypto';
+
+export function extractHostname(url) {
+  try {
+    return new URL(url).hostname;
+  } catch {
+    return url.replace(/^https?:\/\//, '').replace(/\/$/, '');
+  }
+}
+
+export function quoteRemoteShell(value) {
+  return `'${String(value).replace(/'/g, `'\\''`)}'`;
+}
+
+export function formatRemoteCd(remotePath) {
+  const trimmed = String(remotePath || '').trim();
+  if (!trimmed || trimmed === '~') return '';
+  return quoteRemoteShell(trimmed);
+}
+
+export function formatScpRemotePath(remotePath) {
+  const trimmed = String(remotePath || '').trim();
+  if (!trimmed || trimmed === '~') return trimmed || '~';
+  if (trimmed.startsWith('~/')) {
+    return `~/${quoteRemoteShell(trimmed.slice(2))}`;
+  }
+  return quoteRemoteShell(trimmed);
+}
+
+export function getSshControlOptions(hostname) {
+  if (process.platform === 'win32') return [];
+  const hash = crypto.createHash('sha1').update(hostname).digest('hex').slice(0, 10);
+  return [
+    '-o', 'ControlMaster=auto',
+    '-o', 'ControlPersist=5m',
+    '-o', `ControlPath=/tmp/ipingyou-${process.pid}-${hash}-%r.sock`,
+  ];
+}
+
+export function buildSshArgs(hostname, privateKeyPath, extraOptions = []) {
+  const proxyCommand = `cloudflared access tcp --hostname ${hostname}`;
+  const sshArgs = [
+    '-o', `ProxyCommand=${proxyCommand}`,
+    '-o', 'StrictHostKeyChecking=accept-new',
+    '-o', 'IdentitiesOnly=yes',
+    ...getSshControlOptions(hostname),
+    ...extraOptions,
+  ];
+
+  if (privateKeyPath) {
+    sshArgs.push('-i', privateKeyPath, '-o', 'IdentityAgent=none');
+  }
+
+  return sshArgs;
+}