@miraj181/ipingyou 2.0.14 → 2.1.1

package/src/modes/client.js

@@ -21,11 +21,12 @@ import os from 'node:os';
 import { cleanupAll, trackPID, untrackPID, addCleanupHook } from '../lib/cleanup.js';
 import { createSpinner, sshSpinner, networkSpinner, fileTransferSpinner, showConnectionTrace, simulateTransferProgress } from '../lib/animations.js';
 import { getConfig, saveAlias } from '../lib/config.js';
-import { pushTelemetry, resolveUID } from '../lib/broker.js';
+import { pushTelemetry, requestHostApproval, resolveUID, revokeUID, waitForApproval } from '../lib/broker.js';
 import { calculateChecksum } from '../lib/checksum.js';
 import { promptLocalPath, promptRemotePath } from '../lib/path-browser.js';
 import { buildSshArgs, extractHostname, formatScpRemotePath, getSshControlOptions, quoteRemoteShell } from '../lib/ssh.js';
 import open from 'open';
+import { cleanupSessionLog, initSessionLog, logSessionEvent, recordEvent } from '../lib/session-log.js';
 
 let BROKER_URL = process.env.BROKER_URL || 'https://ipingyou.onrender.com';
 
@@ -57,7 +58,7 @@ async function writeEphemeralPrivateKey(privateKey) {
   });
 
   if (result.exitCode !== 0) {
-    try { fs.unlinkSync(keyPath); } catch {}
+    try { fs.unlinkSync(keyPath); } catch { }
     throw new Error(result.stderr.trim() || 'OpenSSH could not parse the host-provided private key');
   }
 
@@ -100,12 +101,15 @@ async function connectSSH(username, hostname, privateKeyPath) {
     if (result.exitCode === 0) {
       console.log('');
       console.log(chalk.green('  ✅ SSH session ended cleanly'));
+      recordEvent('ssh_session_ended', { hostname, exitCode: 0 });
     } else if (result.exitCode === 255) {
       console.log('');
       console.error(chalk.red('  ❌ SSH connection failed (exit code 255)'));
+      recordEvent('ssh_session_failed', { hostname, exitCode: 255 });
     } else {
       console.log('');
       console.error(chalk.red(`  ❌ SSH exited with code ${result.exitCode}`));
+      recordEvent('ssh_session_ended', { hostname, exitCode: result.exitCode });
     }
   } catch (err) {
     console.error(chalk.red(`  ❌ SSH error: ${err.message}`));
@@ -115,7 +119,48 @@ async function connectSSH(username, hostname, privateKeyPath) {
 /**
  * Perform an SCP file transfer through the Cloudflare tunnel.
  */
-async function performSCP(username, hostname, direction, privateKeyPath) {
+async function chooseRemoteTransferPath(username, hostname, privateKeyPath, direction, sharedDropPath) {
+  if (!sharedDropPath) {
+    return promptRemotePath(username, hostname, privateKeyPath, direction === 'upload' ? 'destination' : 'source');
+  }
+
+  const { dropChoice } = await inquirer.prompt([{
+    type: 'list',
+    name: 'dropChoice',
+    message: direction === 'upload'
+      ? 'Where should the file/folder go on the host?'
+      : 'Where should browsing start on the host?',
+    choices: direction === 'upload'
+      ? [
+        { name: `📥 Use host shared drop folder (${sharedDropPath})`, value: 'drop' },
+        { name: '🔍 Browse host folders', value: 'browse' },
+        { name: '⌨️  Type host destination path manually', value: 'manual' }
+      ]
+      : [
+        { name: `📥 Start in host shared drop folder (${sharedDropPath})`, value: 'drop_browse' },
+        { name: '🔍 Browse from host home folder', value: 'browse' },
+        { name: '⌨️  Type host file/folder path manually', value: 'manual' }
+      ]
+  }]);
+
+  if (dropChoice === 'drop') return sharedDropPath;
+  if (dropChoice === 'drop_browse') {
+    return promptRemotePath(username, hostname, privateKeyPath, 'source', sharedDropPath);
+  }
+  if (dropChoice === 'manual') {
+    const { remotePath } = await inquirer.prompt([{
+      type: 'input',
+      name: 'remotePath',
+      message: direction === 'upload' ? 'Host destination path:' : 'Host file/folder path:',
+      validate: v => v.trim().length > 0 || 'Required',
+    }]);
+    return remotePath.trim();
+  }
+
+  return promptRemotePath(username, hostname, privateKeyPath, direction === 'upload' ? 'destination' : 'source');
+}
+
+async function performSCP(username, hostname, direction, privateKeyPath, sharedDropPath = null) {
   console.log('');
   console.log(chalk.bold(`  📦 SCP Transfer (${direction})`));
   console.log(chalk.dim('  ─────────────────────────────────'));
@@ -124,11 +169,11 @@ async function performSCP(username, hostname, direction, privateKeyPath) {
   let remotePath;
 
   if (direction === 'upload') {
-    remotePath = await promptRemotePath(username, hostname, privateKeyPath, 'destination');
+    remotePath = await chooseRemoteTransferPath(username, hostname, privateKeyPath, direction, sharedDropPath);
     localPath = await promptLocalPath('client file/folder to upload');
   } else {
     localPath = await promptLocalPath('client destination');
-    remotePath = await promptRemotePath(username, hostname, privateKeyPath, 'source');
+    remotePath = await chooseRemoteTransferPath(username, hostname, privateKeyPath, direction, sharedDropPath);
   }
 
   await showConnectionTrace('Local', 'Remote SCP');
@@ -179,7 +224,7 @@ async function performSCP(username, hostname, direction, privateKeyPath) {
 
     if (result.exitCode === 0) {
       await simulateTransferProgress(direction === 'upload' ? localPath : remotePath, direction, 1500);
-      
+
       // Verify Checksum
       if (direction === 'upload' && localHash) {
         console.log(chalk.dim('  🔍 Verifying remote SHA-256 checksum...'));
@@ -193,10 +238,10 @@ async function performSCP(username, hostname, direction, privateKeyPath) {
           ];
           if (privateKeyPath) sshArgs.push('-i', privateKeyPath, '-o', 'IdentityAgent=none');
           sshArgs.push(`${username}@${hostname}`, `shasum -a 256 ${quoteRemoteShell(remoteChecksumPath)} 2>/dev/null || sha256sum ${quoteRemoteShell(remoteChecksumPath)} 2>/dev/null || shasum -a 256 ${quoteRemoteShell(remotePath)} 2>/dev/null || sha256sum ${quoteRemoteShell(remotePath)}`);
-          
+
           const { stdout } = await execa('ssh', sshArgs, { reject: false });
           const remoteHash = stdout.split(' ')[0].trim();
-          
+
           if (remoteHash === localHash) {
             console.log(chalk.green(`  ✅ Zero-Trust File Integrity: Hash match (${remoteHash.substring(0, 16)}...)`));
           } else {
@@ -212,15 +257,33 @@ async function performSCP(username, hostname, direction, privateKeyPath) {
       }
 
       console.log(chalk.green(`  ✅ Transfer completed successfully!`));
+      recordEvent('scp_transfer_success', { direction, localPath, remotePath, hostname });
     } else {
       console.error(chalk.red('  ❌ SCP transfer failed'));
       if (result.stderr) console.error(chalk.dim(`     ${result.stderr.trim()}`));
+      recordEvent('scp_transfer_failed', { direction, localPath, remotePath, hostname, error: result.stderr });
     }
   } catch (err) {
     console.error(chalk.red(`  ❌ SCP error: ${err.message}`));
   }
 }
 
+async function downloadSpecificRemotePath(username, hostname, privateKeyPath, remotePath, localPath) {
+  await showConnectionTrace('Local', 'Remote SCP');
+  const proxyCommand = `cloudflared access tcp --hostname ${hostname}`;
+  const scpArgs = [
+    '-r',
+    '-o', `ProxyCommand=${proxyCommand}`,
+    '-o', 'StrictHostKeyChecking=accept-new',
+    '-o', 'IdentitiesOnly=yes',
+    ...getSshControlOptions(hostname),
+  ];
+  if (privateKeyPath) scpArgs.push('-i', privateKeyPath, '-o', 'IdentityAgent=none');
+  scpArgs.push(`${username}@${hostname}:${formatScpRemotePath(remotePath)}`, localPath);
+  const result = await execa('scp', scpArgs, { stdio: 'inherit', reject: false });
+  return result.exitCode === 0;
+}
+
 function joinRemotePath(parent, child) {
   const cleanParent = String(parent || '').replace(/\/+$/, '');
   if (!cleanParent) return child;
@@ -237,6 +300,13 @@ export async function startClientMode(options = {}) {
   console.log(chalk.dim('  ──────────────────────────────────────────'));
   console.log('');
 
+  const sessionLogPath = initSessionLog('client');
+  if (sessionLogPath) {
+    console.log(chalk.dim(`  📜 Session log: ${sessionLogPath}`));
+    addCleanupHook(() => cleanupSessionLog());
+  }
+  logSessionEvent('client_mode_started');
+
   // Allow setting a custom broker URL if process.env isn't overridden by CLI
   if (process.env.BROKER_URL) {
     BROKER_URL = process.env.BROKER_URL;
@@ -264,11 +334,12 @@ export async function startClientMode(options = {}) {
       BROKER_URL = customBroker.trim();
       process.env.BROKER_URL = BROKER_URL; // Update for consistency
     }
+    logSessionEvent('client_broker_selected', { choice: brokerChoice, broker: BROKER_URL });
   }
 
   const config = getConfig();
   const aliasKeys = Object.keys(config.aliases || {});
-  
+
   let targetUid = null;
   let targetPassword = null;
   let targetUsername = null;
@@ -291,6 +362,7 @@ export async function startClientMode(options = {}) {
       targetUid = aliasData.uid;
       targetPassword = aliasData.password;
       targetUsername = aliasData.username;
+      logSessionEvent('client_alias_selected', { alias: useAlias, uid: targetUid });
     }
   }
 
@@ -303,6 +375,7 @@ export async function startClientMode(options = {}) {
       validate: (v) => v.trim().length > 0 || 'Password is required to decrypt',
     }]);
     targetPassword = password.trim();
+    logSessionEvent('client_uid_provided', { uid: targetUid });
   }
 
   if (!targetUid) {
@@ -327,10 +400,61 @@ export async function startClientMode(options = {}) {
     ]);
     targetUid = answer.uid.trim();
     targetPassword = answer.password.trim();
+    logSessionEvent('client_uid_provided', { uid: targetUid });
+  }
+
+  let payload = await resolveUID(BROKER_URL, targetUid, targetPassword);
+
+  // ─── Approval Flow ──────────────────────────────────────────
+  if (payload && payload.needsApproval) {
+    console.log('');
+    console.log(chalk.bold.yellow('  🔐 Host Approval Required'));
+    console.log(chalk.dim('  ──────────────────────────────────────'));
+    console.log(chalk.dim('  The host has enabled approval gating. Submitting your access request...'));
+
+    try {
+      const approvalDetails = {
+        username: os.userInfo().username,
+        hostname: os.hostname(),
+        os: `${os.type()} ${os.release()} (${os.arch()})`,
+        intent: 'connect',
+        time: new Date().toISOString(),
+      };
+
+      const { requestId, status: reqStatus, approvalRequired } = await requestHostApproval(
+        BROKER_URL, targetUid, targetPassword, approvalDetails
+      );
+
+      logSessionEvent('client_approval_submitted', { uid: targetUid, requestId });
+
+      if (!approvalRequired || reqStatus === 'approved') {
+        console.log(chalk.green('  ✅ Access auto-approved (host does not require manual approval for this session).'));
+        payload = await resolveUID(BROKER_URL, targetUid, targetPassword, false, requestId);
+      } else {
+        console.log(chalk.yellow(`  ⏳ Waiting for host to approve your request (ID: ${requestId})...`));
+        console.log(chalk.dim('     This may take a few minutes. Press Ctrl+C to cancel.'));
+        console.log('');
+
+        const approved = await waitForApproval(BROKER_URL, targetUid, requestId, 300000);
+
+        if (approved) {
+          console.log(chalk.green('  ✅ Host approved your access request!'));
+          logSessionEvent('client_approval_granted', { uid: targetUid, requestId });
+          payload = await resolveUID(BROKER_URL, targetUid, targetPassword, false, requestId);
+        } else {
+          console.log(chalk.red('  ❌ Host denied your access request.'));
+          logSessionEvent('client_approval_denied', { uid: targetUid, requestId });
+          process.exit(1);
+        }
+      }
+    } catch (err) {
+      console.log(chalk.red(`  ❌ Approval flow failed: ${err.message}`));
+      logSessionEvent('client_approval_error', { uid: targetUid, error: err.message }, 'error');
+      process.exit(1);
+    }
   }
 
-  const payload = await resolveUID(BROKER_URL, targetUid, targetPassword);
-  if (!payload) {
+  if (!payload || payload.needsApproval) {
     process.exit(1);
   }
 
@@ -338,9 +462,17 @@ export async function startClientMode(options = {}) {
     console.log('');
     console.log(chalk.bold('  🌐 HTTP Service Exposed'));
     console.log(chalk.dim('  ─────────────────────────────────'));
-    console.log(chalk.green(`  Open this URL in your browser:\n  👉 ${chalk.bold.cyan(payload.url)}`));
+    console.log(chalk.green(`  Opening in browser: ${chalk.bold.cyan(payload.url)}`));
     console.log('');
-    process.exit(0);
+    logSessionEvent('client_http_mode', { uid: targetUid, port: payload.port || null });
+    try {
+      await open(payload.url);
+    } catch {
+      console.log(chalk.dim(`  Could not auto-open. Please visit: ${payload.url}`));
+    }
+    console.log(chalk.dim('  Press Ctrl+C to exit.'));
+    // Keep process alive so cleanup handlers work
+    await new Promise(() => {});
   }
 
   if (payload.type === 'tcp') {
@@ -348,12 +480,40 @@ export async function startClientMode(options = {}) {
     console.log(chalk.bold('  🔌 Custom TCP Port Exposed'));
     console.log(chalk.dim('  ─────────────────────────────────'));
     console.log(`  The host is exposing a generic TCP service on port ${payload.port}.`);
-    console.log(`  To connect, run this command in a separate terminal:`);
-    console.log(chalk.cyan(`  cloudflared access tcp --hostname ${extractHostname(payload.url)} --url 127.0.0.1:${payload.port}`));
-    console.log('');
-    console.log(`  Then connect your local client (e.g. Postgres, VNC, RDP) to ${chalk.green('127.0.0.1:' + payload.port)}`);
+
+    const hostname = extractHostname(payload.url);
+    const localPort = payload.port;
+
+    console.log(chalk.dim(`  Starting local cloudflared proxy to ${hostname}...`));
     console.log('');
-    process.exit(0);
+
+    try {
+      const { execa: execaFn } = await import('execa');
+      const child = execaFn('cloudflared', ['access', 'tcp', '--hostname', hostname, '--url', `127.0.0.1:${localPort}`], {
+        stdio: 'inherit',
+        reject: false,
+      });
+
+      trackPID(child.pid);
+      console.log(chalk.green(`  ✅ Local proxy active! Connect your client to ${chalk.bold('127.0.0.1:' + localPort)}`));
+      console.log(chalk.dim('  Press Ctrl+C to terminate the tunnel.'));
+      logSessionEvent('client_tcp_mode', { uid: targetUid, port: localPort, hostname });
+
+      const result = await child;
+      untrackPID(child.pid);
+
+      if (result.exitCode !== 0) {
+        console.log(chalk.red(`  ❌ Cloudflared exited with code ${result.exitCode}`));
+      }
+    } catch (err) {
+      console.log(chalk.red(`  ❌ Could not start cloudflared proxy: ${err.message}`));
+      console.log(chalk.dim('  Fallback: run manually in another terminal:'));
+      console.log(chalk.cyan(`  cloudflared access tcp --hostname ${hostname} --url 127.0.0.1:${localPort}`));
+      console.log('');
+      console.log(`  Then connect your local client to ${chalk.green('127.0.0.1:' + localPort)}`);
+    }
+    await cleanupAll();
+    return;
   }
 
   const tunnelUrl = payload.url;
@@ -367,15 +527,56 @@ export async function startClientMode(options = {}) {
     try {
       privateKeyPath = await writeEphemeralPrivateKey(payload.privateKey);
       addCleanupHook(() => {
-        try { fs.unlinkSync(privateKeyPath); } catch {}
+        try { fs.unlinkSync(privateKeyPath); } catch { }
       });
+      logSessionEvent('client_ephemeral_key_ready');
     } catch (err) {
       console.log(chalk.yellow(`  ⚠️  Could not use ephemeral SSH key: ${err.message}`));
       console.log(chalk.dim('     Falling back to standard OS password.'));
+      logSessionEvent('client_ephemeral_key_failed', { error: err.message }, 'warn');
       privateKeyPath = null;
     }
   }
 
+  // ─── One-Time File Share Auto-Download ────────────────────
+  if (payload.oneTime && payload.oneTimeSharePath) {
+    console.log('');
+    console.log(chalk.bold.magenta('  📦 One-Time File Share'));
+    console.log(chalk.dim('  ──────────────────────────────────────'));
+    console.log(chalk.dim(`  Host is sharing: ${chalk.cyan(payload.oneTimeSharePath)}`));
+    console.log(chalk.dim('  This is a one-time transfer — the session will be revoked after download.'));
+    console.log('');
+
+    const localDest = await promptLocalPath('download destination');
+
+    await pushTelemetry(BROKER_URL, targetUid, targetPassword, username, 'one-time-download');
+    logSessionEvent('client_one_time_download_start', { uid: targetUid, remotePath: payload.oneTimeSharePath });
+
+    const success = await downloadSpecificRemotePath(username, hostname, privateKeyPath, payload.oneTimeSharePath, localDest);
+
+    if (success) {
+      console.log(chalk.green('  ✅ One-time file transfer completed successfully!'));
+
+      // Verify download checksum
+      const dlHash = await calculateChecksum(localDest);
+      if (dlHash) console.log(chalk.green(`  🔍 File Intact. SHA-256: ${dlHash.substring(0, 16)}...`));
+
+      // Auto-revoke the UID from broker
+      console.log(chalk.dim('  Revoking session from broker...'));
+      await revokeUID(BROKER_URL, targetUid);
+      console.log(chalk.green('  🔒 Session revoked. No further access is possible.'));
+
+      logSessionEvent('client_one_time_download_complete', { uid: targetUid });
+      recordEvent('one_time_transfer_complete', { uid: targetUid, localDest });
+    } else {
+      console.log(chalk.red('  ❌ One-time file transfer failed.'));
+      logSessionEvent('client_one_time_download_failed', { uid: targetUid }, 'error');
+    }
+
+    await cleanupAll();
+    return;
+  }
+
   // Ask to save alias if we entered manually
   if (!targetUsername) {
     const { saveIt } = await inquirer.prompt([{
@@ -394,12 +595,10 @@ export async function startClientMode(options = {}) {
       }]);
       saveAlias(aliasName.trim(), { uid: targetUid, password: targetPassword, username });
       console.log(chalk.green(`  ✓ Saved as alias: ${chalk.bold(aliasName.trim())}\n`));
+      logSessionEvent('client_alias_saved', { alias: aliasName.trim(), uid: targetUid });
     }
   }
 
-  // Push secure telemetry to host
-  await pushTelemetry(BROKER_URL, targetUid, targetPassword, username);
-
   const { action } = await inquirer.prompt([
     {
       type: 'list',
@@ -415,6 +614,9 @@ export async function startClientMode(options = {}) {
     }
   ]);
 
+  await pushTelemetry(BROKER_URL, targetUid, targetPassword, username, action);
+  logSessionEvent('client_action_selected', { action });
+
   if (action === 'chat') {
     await handleClientChat(targetUid, targetPassword, payload.chatUrl);
   } else if (action === 'ssh') {
@@ -422,7 +624,7 @@ export async function startClientMode(options = {}) {
   } else if (action === 'reverse') {
     await performReverseForward(username, hostname, privateKeyPath);
   } else {
-    await performSCP(username, hostname, action, privateKeyPath);
+    await performSCP(username, hostname, action, privateKeyPath, payload.sharedDropPath);
   }
 
   console.log('');
@@ -436,16 +638,57 @@ export async function startClientMode(options = {}) {
   ]);
 
   if (reconnect) {
-    await handleSubsequentActions(username, hostname, privateKeyPath, targetUid, targetPassword);
+    await handleSubsequentActions(username, hostname, privateKeyPath, targetUid, targetPassword, payload.sharedDropPath);
   }
 
+  logSessionEvent('client_session_exit');
   await cleanupAll();
 }
 
+/**
+ * Perform a non-interactive SCP transfer (used by AI Transfer Assistant).
+ * params: { brokerUrl, uid, password, username, direction, localPath, remotePath }
+ */
+export async function performSCPNonInteractive(params = {}) {
+  const { brokerUrl, uid, password, username, direction, localPath, remotePath } = params;
+  if (!brokerUrl || !uid || !password) throw new Error('Missing broker connection info');
+
+  const payload = await resolveUID(brokerUrl, uid, password);
+  if (!payload) throw new Error('Could not resolve UID/payload');
+
+  const tunnelUrl = payload.url;
+  const hostname = extractHostname(tunnelUrl);
+  const privateKeyPath = payload.privateKey ? await writeEphemeralPrivateKey(payload.privateKey) : null;
+
+  // Build scp args similar to performSCP
+  const proxyCommand = `cloudflared access tcp --hostname ${hostname}`;
+  const scpArgs = ['-r', '-o', `ProxyCommand=${proxyCommand}`, '-o', 'StrictHostKeyChecking=accept-new', '-o', 'IdentitiesOnly=yes', ...getSshControlOptions(hostname)];
+  if (privateKeyPath) scpArgs.push('-i', privateKeyPath, '-o', 'IdentityAgent=none');
+
+  const remoteSpec = `${username}@${hostname}:${formatScpRemotePath(remotePath)}`;
+  if (direction === 'upload') {
+    scpArgs.push(localPath, remoteSpec);
+  } else {
+    scpArgs.push(remoteSpec, localPath);
+  }
+
+  try {
+    const result = await execa('scp', scpArgs, { stdio: 'inherit', reject: false });
+    if (result.exitCode === 0) {
+      recordEvent('scp_transfer_success', { direction, localPath, remotePath, hostname, automated: true });
+      return true;
+    }
+    recordEvent('scp_transfer_failed', { direction, localPath, remotePath, hostname, error: result.stderr, automated: true });
+    return false;
+  } finally {
+    try { if (privateKeyPath) fs.unlinkSync(privateKeyPath); } catch { }
+  }
+}
+
 async function handleClientChat(uid, password, cachedChatUrl) {
   let chatUrl = cachedChatUrl;
   const spinner = createSpinner('Checking for active chat room...', networkSpinner).start();
-  
+
   const payload = await resolveUID(BROKER_URL, uid, password, true); // true = silent if possible, or just re-resolve
   if (payload && payload.chatUrl) {
     chatUrl = payload.chatUrl;
@@ -464,7 +707,7 @@ async function handleClientChat(uid, password, cachedChatUrl) {
   }
 }
 
-async function handleSubsequentActions(username, hostname, privateKeyPath, targetUid, targetPassword) {
+async function handleSubsequentActions(username, hostname, privateKeyPath, targetUid, targetPassword, sharedDropPath = null) {
   const { action } = await inquirer.prompt([
     {
       type: 'list',
@@ -483,6 +726,9 @@ async function handleSubsequentActions(username, hostname, privateKeyPath, targe
 
   if (action === 'exit') return;
 
+  await pushTelemetry(BROKER_URL, targetUid, targetPassword, username, action);
+  logSessionEvent('client_action_selected', { action });
+
   if (action === 'chat') {
     await handleClientChat(targetUid, targetPassword, null);
   } else if (action === 'ssh') {
@@ -490,7 +736,7 @@ async function handleSubsequentActions(username, hostname, privateKeyPath, targe
   } else if (action === 'reverse') {
     await performReverseForward(username, hostname, privateKeyPath);
   } else {
-    await performSCP(username, hostname, action, privateKeyPath);
+    await performSCP(username, hostname, action, privateKeyPath, sharedDropPath);
   }
 
   const { reconnect } = await inquirer.prompt([
@@ -503,7 +749,7 @@ async function handleSubsequentActions(username, hostname, privateKeyPath, targe
   ]);
 
   if (reconnect) {
-    await handleSubsequentActions(username, hostname, privateKeyPath, targetUid, targetPassword);
+    await handleSubsequentActions(username, hostname, privateKeyPath, targetUid, targetPassword, sharedDropPath);
   }
 }
 
@@ -542,16 +788,27 @@ async function performReverseForward(username, hostname, privateKeyPath) {
   console.log('');
   const spinner = createSpinner(`Forwarding Host:${remotePort} ➔ Localhost:${localPort}...`, networkSpinner).start();
 
+  let child = null;
   try {
-    const child = execa('ssh', sshArgs, { stdio: 'inherit' });
+    child = execa('ssh', sshArgs, { stdio: 'inherit', reject: false });
     trackPID(child.pid);
     spinner.succeed(`Reverse tunnel active! Host can access your app at ${chalk.bold.green('localhost:' + remotePort)}`);
     console.log(chalk.dim('  Press Ctrl+C to terminate the reverse tunnel.'));
-    
-    await child;
+
+    recordEvent('reverse_forward_started', { localPort, remotePort, hostname });
+    const result = await child;
+    if (result.exitCode === 0) {
+      recordEvent('reverse_forward_ended', { localPort, remotePort, hostname, exitCode: 0 });
+    } else {
+      console.log(chalk.red(`\n  ❌ Reverse tunnel exited with code ${result.exitCode}`));
+      recordEvent('reverse_forward_failed', { localPort, remotePort, hostname, exitCode: result.exitCode });
+    }
   } catch (err) {
     if (err.isCanceled) return;
     if (err.killed) return;
+    spinner.fail('Reverse tunnel failed to start');
     console.log(chalk.red(`\n  ❌ Tunnel disconnected: ${err.message}`));
+  } finally {
+    if (child?.pid) untrackPID(child.pid);
   }
 }