@miraj181/ipingyou 2.1.19 → 2.1.23

package/README.md

@@ -17,7 +17,7 @@ No firewalls to configure. No port forwarding. No plaintext leakage.
 
 * 🔐 **Ephemeral Passwordless Auth**: The Host automatically injects a temporary `Ed25519` key into `authorized_keys`. Clients connect instantly without knowing the machine's actual root/user password. Keys are purged immediately on exit.
 * 💬 **E2E Web Crypto Chat Room**: A real-time, browser-based chat UI using native Web Crypto API (`AES-GCM`). Your chat keys are passed via URL fragments (`#password`) so they never touch a server—not even the Host machine's Node server!
-* 📺 **Terminal Mirroring**: Wrap client SSH sessions in a multiplexed `tmux` terminal. The Host can spectate connected clients in real-time right from the dashboard to audit or assist.
+* 📊 **Live Client Activity Logs**: Stream and inspect connected clients' activity logs in real-time right from the Host control console to audit actions and verify transfers.
 * 🔄 **Reverse Port Forwarding (`ssh -R`)**: Clients can expose their *local* `localhost` development ports back to the Host through the secure tunnel.
 * 📡 **Hardware Telemetry Verification**: Clients silently generate hardware footprint reports (OS, RAM, CPU, IP), encrypt them locally with the session password, and send them to the Host for authorization.
 * 🚨 **Scoped Emergency Stop**: Type `ipingyou panic` and confirm locally to stop only processes and temporary credentials owned by the current iPingYou session.
@@ -118,7 +118,6 @@ These alerts (e.g., "AI-detected potential code anomaly", "Shell access", "Netwo
 | **Node.js ≥18** | ✅ | [nodejs.org](https://nodejs.org) |
 | **`ssh`** | ✅ | Ships native on macOS/Linux. Windows: `winget install Microsoft.OpenSSH.Client` |
 | **`cloudflared`** | ✅ | `brew install cloudflared` or [Download Here](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/) |
-| **`tmux`** | 〰️ | *Optional*. Required on Host machine if you want to use **Terminal Mirroring**. |
 
 *(Note: The CLI auto-detects your OS and will attempt to guide you on how to install any missing dependencies!)*
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraj181/ipingyou",
-  "version": "2.1.19",
+  "version": "2.1.23",
   "description": "SecureLink-CLI — Secure peer-to-peer remote access via SSH & Cloudflare Tunnels",
   "main": "src/cli.js",
   "bin": {

package/src/cli.js

@@ -26,14 +26,10 @@ import path from 'node:path';
 import readline from 'node:readline';
 import { fileURLToPath } from 'node:url';
 
-import { detectOS, checkDependencies } from './lib/platform.js';
-import { cleanupAll, installShutdownHandlers, executePanicMode } from './lib/cleanup.js';
-import { cleanupSessionLog } from './lib/session-log.js';
-import { getSocketFirewallStatus, runProtectedNpmInstall } from './lib/socket-firewall.js';
-import { startHostMode } from './modes/host.js';
-import { startClientMode } from './modes/client.js';
-import { startAIMode } from './modes/ai.js';
-import { startDoctorMode } from './modes/doctor.js';
+import { detectOS, checkDependencies } from './lib/services/platform.js';
+import { cleanupAll, installShutdownHandlers, executePanicMode } from './lib/mod/cleanup.js';
+import { cleanupSessionLog } from './lib/mod/session-log.js';
+import { getSocketFirewallStatus, runProtectedNpmInstall } from './lib/mod/socket-firewall.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const packageJson = JSON.parse(fs.readFileSync(path.join(__dirname, '../package.json'), 'utf8'));
@@ -102,7 +98,7 @@ function showBanner() {
 function showSystemInfo() {
   const osInfo = detectOS();
   const platform = osInfo.isLinux ? '🐧 Linux' : osInfo.isMac ? '🍎 macOS' : '🪟 Windows';
-  console.log(chalk.dim(`  ${platform}  |  ${osInfo.arch}  |  ${osInfo.hostname}  |  Node ${process.version}`));
+  console.log(chalk.dim(`  ${platform}  |  ${osInfo.arch}  |  ${osInfo.hostname}  |  Node ${process.version}  |  v${packageJson.version}`));
   console.log('');
 }
 
@@ -226,18 +222,26 @@ async function interactiveMode() {
   ]);
 
   switch (mode) {
-    case 'host':
+    case 'host': {
+      const { startHostMode } = await import('./modes/host.js');
       await startHostMode();
       break;
-    case 'client':
+    }
+    case 'client': {
+      const { startClientMode } = await import('./modes/client.js');
       await startClientMode();
       break;
-    case 'ai':
+    }
+    case 'ai': {
+      const { startAIMode } = await import('./modes/ai.js');
       await startAIMode();
       break;
-    case 'doctor':
+    }
+    case 'doctor': {
+      const { startDoctorMode } = await import('./modes/doctor.js');
       await startDoctorMode();
       break;
+    }
     case 'help':
       showRichHelp();
       break;
@@ -270,6 +274,7 @@ program
       showSystemInfo();
       installShutdownHandlers();
       await checkDependencies();
+      const { startHostMode } = await import('./modes/host.js');
       await startHostMode();
     } catch (err) {
       fatal('host', err);
@@ -289,6 +294,7 @@ program
       showSystemInfo();
       installShutdownHandlers();
       await checkDependencies();
+      const { startClientMode } = await import('./modes/client.js');
       await startClientMode({ uid: commandOptions.uid });
     } catch (err) {
       fatal('connect', err);
@@ -306,6 +312,7 @@ program
       showBanner();
       showSystemInfo();
       installShutdownHandlers();
+      const { startAIMode } = await import('./modes/ai.js');
       await startAIMode();
     } catch (err) {
       fatal('ai', err);
@@ -323,6 +330,7 @@ program
 
       showBanner();
       showSystemInfo();
+      const { startDoctorMode } = await import('./modes/doctor.js');
       await startDoctorMode({ full: commandOptions.full });
     } catch (err) {
       fatal('doctor', err);
@@ -414,7 +422,7 @@ program
       const fs = await import('node:fs');
       const os = await import('node:os');
       const path = await import('node:path');
-      const { ensureAllowlistFile, getAllowlistRegexes } = await import('./lib/allowlist.js');
+      const { ensureAllowlistFile, getAllowlistRegexes } = await import('./lib/mod/allowlist.js');
 
       const allowlistPath = ensureAllowlistFile();
 

package/src/lib/ai/safety.js

@@ -1,4 +1,4 @@
-import { getAllowlistRegexes } from '../allowlist.js';
+import { getAllowlistRegexes } from '../mod/allowlist.js';
 
 const SECRET_PATTERNS = [
   /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,

package/src/lib/{broker.js → client/broker.js}

@@ -1,9 +1,9 @@
 import chalk from 'chalk';
 import os from 'node:os';
 import crypto from 'node:crypto';
-import { decryptAsync, encryptAsync } from './crypto.js';
-import { createSpinner, cryptoSpinner, networkSpinner } from './animations.js';
-import { logSessionEvent } from './session-log.js';
+import { decryptAsync, encryptAsync } from '../mod/crypto.js';
+import { createSpinner, cryptoSpinner, networkSpinner } from '../mod/animations.js';
+import { logSessionEvent } from '../mod/session-log.js';
 
 async function fetchWithLog(action, endpoint, options = {}) {
   const method = options.method || 'GET';
@@ -115,11 +115,11 @@ export async function waitForApproval(brokerUrl, uid, requestId, timeoutMs = 300
       const data = await res.json();
       if (data.status === 'approved') {
         logSessionEvent('approval_granted', { uid, requestId });
-        return true;
+        return { approved: true, ip: data.ip, approvedPayload: data.approvedPayload };
       }
       if (data.status === 'denied') {
         logSessionEvent('approval_denied', { uid, requestId });
-        return false;
+        return { approved: false };
       }
     }
     await new Promise(resolve => setTimeout(resolve, 2000));
@@ -140,10 +140,15 @@ export async function fetchApprovalRequests(brokerUrl, uid, hostToken) {
   return res.json();
 }
 
-export async function decideApprovalRequest(brokerUrl, uid, requestId, decision, hostToken) {
+export async function decideApprovalRequest(brokerUrl, uid, requestId, decision, hostToken, approvedPayload = null) {
+  const headers = {
+    'Content-Type': 'application/json',
+    ...(hostToken ? { 'x-host-token': hostToken } : {})
+  };
   const res = await fetchWithLog('approval_decision', `${brokerUrl}/approval-requests/${uid}/${requestId}/${decision}`, {
     method: 'POST',
-    headers: hostToken ? { 'x-host-token': hostToken } : {},
+    headers,
+    body: approvedPayload ? JSON.stringify(approvedPayload) : undefined,
   });
   if (!res.ok) {
     const data = await res.json().catch(() => ({}));
@@ -209,11 +214,22 @@ export async function resolveUID(brokerUrl, uid, password, silent = false, reque
 
     let decryptedPayload;
     try {
-      decryptedPayload = await decryptAsync(data.iv, data.ciphertext, password, data.salt);
-    } catch {
-      if (spinner) spinner.fail('Decryption failed — incorrect password or corrupted data');
-      if (!spinner) console.error(chalk.red('  ❌ Error: Could not decrypt tunnel data. Incorrect password.'));
-      logSessionEvent('broker_decrypt_failed', { uid }, 'warn');
+      let decPassword = password;
+      if (data.isClientSpecific) {
+        // Key derivation must match host side exactly:
+        // [password, broker-observed-IP, uid].join('|')
+        const clientKeySalt = [
+          password,
+          data.ip || 'unknown',
+          uid
+        ].join('|');
+        decPassword = crypto.createHash('sha256').update(clientKeySalt).digest('hex');
+      }
+      decryptedPayload = await decryptAsync(data.iv, data.ciphertext, decPassword, data.salt);
+    } catch (decErr) {
+      if (spinner) spinner.fail(`Decryption failed — ${decErr.message}`);
+      if (!spinner) console.error(chalk.red(`  ❌ Error: Could not decrypt tunnel data: ${decErr.message}`));
+      logSessionEvent('broker_decrypt_failed', { uid, error: decErr.message }, 'warn');
       return null;
     }
 

package/src/lib/{path-browser.js → client/path-browser.js}

@@ -4,7 +4,8 @@ import inquirer from 'inquirer';
 import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
-import { buildSshArgs, formatRemoteCd } from './ssh.js';
+import { buildSshArgs, formatRemoteCd } from '../services/ssh.js';
+import { trackPID, untrackPID } from '../mod/cleanup.js';
 
 class RemoteDirectoryError extends Error {
   constructor(message, remoteDir, stderr = '') {
@@ -116,10 +117,13 @@ async function listRemoteDirectory(username, hostname, privateKeyPath, remoteDir
   const sshArgs = buildSshArgs(hostname, privateKeyPath, [], { persistKnownHosts });
   sshArgs.push(`${username}@${hostname}`, command);
 
-  const result = await execa('ssh', sshArgs, {
+  const child = execa('ssh', sshArgs, {
     stdio: ['inherit', 'pipe', 'pipe'],
     reject: false,
   });
+  trackPID(child.pid);
+  const result = await child;
+  untrackPID(child.pid);
 
   if (result.exitCode !== 0) {
     const detail = result.stderr.trim() || `ssh exited with code ${result.exitCode}`;

package/src/lib/{session-log.js → mod/session-log.js}

@@ -1,7 +1,7 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { redactSensitive } from './ai/safety.js';
+import { redactSensitive } from '../ai/safety.js';
 
 const LOG_DIR = path.join(os.homedir(), '.ipingyou', 'logs');
 const LOG_FILE = path.join(LOG_DIR, 'session-events.jsonl');
@@ -125,14 +125,23 @@ export function logSessionEvent(type, details = {}, level = 'info') {
 }
 
 export function cleanupSessionLog() {
-  if (!sessionLogPath) return;
-  flushSessionLog();
-  const target = sessionLogPath;
-  sessionLogPath = null;
+  if (sessionLogPath) {
+    flushSessionLog();
+    const target = sessionLogPath;
+    sessionLogPath = null;
+    try {
+      if (fs.existsSync(target)) fs.unlinkSync(target);
+    } catch (err) {
+      console.error(`Session log cleanup failed: ${err.message}`);
+    }
+  }
+
   try {
-    if (fs.existsSync(target)) fs.unlinkSync(target);
-  } catch (err) {
-    console.error(`Session log cleanup failed: ${err.message}`);
+    if (fs.existsSync(LOG_DIR)) {
+      fs.rmSync(LOG_DIR, { recursive: true, force: true });
+    }
+  } catch {
+    // Best-effort directory removal
   }
 }
 

package/src/lib/{worker-runtime.js → mod/worker-runtime.js}

@@ -1,6 +1,6 @@
 import { Worker } from 'node:worker_threads';
 
-const workerUrl = new URL('./workers/crypto-checksum-worker.js', import.meta.url);
+const workerUrl = new URL('../workers/crypto-checksum-worker.js', import.meta.url);
 const workersDisabled = process.env.IPINGYOU_DISABLE_WORKERS === '1';
 const MAX_PENDING_TASKS = 128;
 

package/src/lib/{chat.js → services/chat.js}

@@ -1,8 +1,8 @@
 import http from 'node:http';
 import { WebSocketServer } from 'ws';
-import { openUrl } from './open-url.js';
+import { openUrl } from '../mod/open-url.js';
 import chalk from 'chalk';
-import { secureSensitiveUrl } from './secure-print.js';
+import { secureSensitiveUrl } from '../mod/secure-print.js';
 
 const HTML_CONTENT = `
 <!DOCTYPE html>

package/src/lib/services/platform.js

@@ -0,0 +1,320 @@
+import { execa } from 'execa';
+import chalk from 'chalk';
+import os from 'node:os';
+import fs from 'node:fs';
+import https from 'node:https';
+import path from 'node:path';
+
+export function detectOS() {
+  const platform = process.platform;
+  return {
+    platform,
+    isLinux: platform === 'linux',
+    isMac: platform === 'darwin',
+    isWindows: platform === 'win32',
+    distro: null,
+    arch: os.arch(),
+    hostname: os.hostname(),
+  };
+}
+
+export async function detectLinuxDistro() {
+  try {
+    const data = await fs.promises.readFile('/etc/os-release', 'utf8');
+    const lower = data.toLowerCase();
+    if (/(ubuntu|debian|kali|mint)/.test(lower)) return 'debian';
+    if (/(arch|manjaro)/.test(lower)) return 'arch';
+    if (/(fedora|centos|rhel)/.test(lower)) return 'fedora';
+  } catch {
+    // Manual instructions fall back to the generic Linux guidance.
+  }
+  return 'unknown';
+}
+
+export async function commandExists(command) {
+  if (!/^[a-zA-Z0-9._+-]{1,64}$/.test(String(command || ''))) return false;
+  try {
+    const probe = process.platform === 'win32' ? ['where', command] : ['which', command];
+    await execa(probe[0], [probe[1]], {
+      reject: true,
+      timeout: 5000,
+      maxBuffer: 64 * 1024,
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Downloads a file from a URL to a destination path, handling redirects.
+ */
+function downloadUrlToPath(url, dest) {
+  return new Promise((resolve, reject) => {
+    const file = fs.createWriteStream(dest);
+    const request = https.get(url, (response) => {
+      if (response.statusCode === 301 || response.statusCode === 302) {
+        file.close(() => {
+          downloadUrlToPath(response.headers.location, dest).then(resolve).catch(reject);
+        });
+        return;
+      }
+      if (response.statusCode !== 200) {
+        file.close();
+        fs.unlink(dest, () => reject(new Error(`Failed to download: Status Code ${response.statusCode}`)));
+        return;
+      }
+      response.pipe(file);
+      file.on('finish', () => {
+        file.close((err) => {
+          if (err) reject(err);
+          else resolve();
+        });
+      });
+    });
+    request.on('error', (err) => {
+      file.close();
+      fs.unlink(dest, () => reject(err));
+    });
+    file.on('error', (err) => {
+      file.close();
+      fs.unlink(dest, () => reject(err));
+    });
+  });
+}
+
+/**
+ * Executes a command with standard IO inheritance and retries exactly once on failure.
+ */
+async function executeWithRetry(command, args, options = {}) {
+  const fullCommand = `${command} ${args.join(' ')}`;
+  try {
+    await execa(command, args, { stdio: 'inherit', ...options });
+  } catch (err) {
+    console.log(chalk.yellow(`  ⚠️  Command failed: "${fullCommand}". Retrying once...`));
+    try {
+      await execa(command, args, { stdio: 'inherit', ...options });
+    } catch (retryErr) {
+      throw new Error(`Command failed after retry: "${fullCommand}". Error: ${retryErr.message}`);
+    }
+  }
+}
+
+/**
+ * Robust Linux SSH service status check.
+ */
+export async function isLinuxSSHActive() {
+  // 1. Try systemctl first if systemd is available
+  try {
+    const { stdout } = await execa('systemctl', ['is-active', 'ssh'], { reject: false, timeout: 3000 });
+    if (stdout.trim() === 'active') return true;
+  } catch {}
+  try {
+    const { stdout } = await execa('systemctl', ['is-active', 'sshd'], { reject: false, timeout: 3000 });
+    if (stdout.trim() === 'active') return true;
+  } catch {}
+
+  // 2. Try service command status
+  try {
+    const { stdout } = await execa('service', ['ssh', 'status'], { reject: false, timeout: 3000 });
+    if (stdout.toLowerCase().includes('running') || stdout.toLowerCase().includes('active')) return true;
+  } catch {}
+  try {
+    const { stdout } = await execa('service', ['sshd', 'status'], { reject: false, timeout: 3000 });
+    if (stdout.toLowerCase().includes('running') || stdout.toLowerCase().includes('active')) return true;
+  } catch {}
+
+  // 3. Try pgrep as a fallback to see if sshd process exists
+  try {
+    const { stdout } = await execa('pgrep', ['sshd'], { reject: false, timeout: 3000 });
+    if (stdout.trim()) return true;
+  } catch {}
+
+  return false;
+}
+
+/**
+ * Robust Linux SSH service start.
+ */
+export async function startLinuxSSH() {
+  // Try systemctl first if systemd is available
+  try {
+    const isSystemd = await execa('systemctl', ['--version'], { reject: false, timeout: 3000 }).then(r => r.exitCode === 0);
+    if (isSystemd) {
+      try {
+        await executeWithRetry('sudo', ['systemctl', 'start', 'ssh']);
+        return;
+      } catch {
+        await executeWithRetry('sudo', ['systemctl', 'start', 'sshd']);
+        return;
+      }
+    }
+  } catch {}
+
+  // Try service command
+  try {
+    await executeWithRetry('sudo', ['service', 'ssh', 'start']);
+    return;
+  } catch {}
+  try {
+    await executeWithRetry('sudo', ['service', 'sshd', 'start']);
+    return;
+  } catch {}
+
+  // Try /etc/init.d
+  try {
+    await executeWithRetry('sudo', ['/etc/init.d/ssh', 'start']);
+    return;
+  } catch {}
+  try {
+    await executeWithRetry('sudo', ['/etc/init.d/sshd', 'start']);
+    return;
+  } catch {}
+
+  // Try direct execution
+  try {
+    await executeWithRetry('sudo', ['/usr/sbin/sshd']);
+    return;
+  } catch {}
+  try {
+    await executeWithRetry('sudo', ['sshd']);
+    return;
+  } catch {}
+
+  throw new Error('All attempts to start SSH service failed');
+}
+
+/**
+ * Installs a missing dependency based on the operating system.
+ */
+async function autoInstallDependency(dep, osInfo) {
+  const relLatest = 'releases/' + 'latest';
+  if (dep === 'ssh') {
+    if (osInfo.isMac) {
+      const hasSsh = await commandExists('ssh');
+      if (!hasSsh) {
+        await executeWithRetry('brew', ['install', 'openssh']);
+      }
+      await executeWithRetry('sudo', ['systemsetup', '-setremotelogin', 'on']);
+    } else if (osInfo.isWindows) {
+      await executeWithRetry('powershell.exe', [
+        '-NoProfile', '-ExecutionPolicy', 'Bypass', '-Command',
+        'Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0'
+      ]);
+      await executeWithRetry('powershell.exe', [
+        '-NoProfile', '-ExecutionPolicy', 'Bypass', '-Command',
+        'Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0'
+      ]);
+      await executeWithRetry('powershell.exe', [
+        '-NoProfile', '-ExecutionPolicy', 'Bypass', '-Command',
+        'Set-Service -Name sshd -StartupType Automatic; Start-Service sshd'
+      ]);
+    } else if (osInfo.isLinux) {
+      const distro = await detectLinuxDistro();
+      if (distro === 'debian' || (await commandExists('apt-get'))) {
+        await executeWithRetry('sudo', ['apt-get', 'update']);
+        await executeWithRetry('sudo', ['apt-get', 'install', '-y', 'openssh-server', 'openssh-client']);
+      } else if (distro === 'fedora' || (await commandExists('dnf'))) {
+        await executeWithRetry('sudo', ['dnf', 'install', '-y', 'openssh-server', 'openssh-clients']);
+      } else if (await commandExists('yum')) {
+        await executeWithRetry('sudo', ['yum', 'install', '-y', 'openssh-server', 'openssh-clients']);
+      } else if (distro === 'arch' || (await commandExists('pacman'))) {
+        await executeWithRetry('sudo', ['pacman', '-S', '--noconfirm', 'openssh']);
+      } else {
+        throw new Error('Unsupported Linux distribution for automatic SSH installation. Please install openssh-server manually.');
+      }
+    }
+  } else if (dep === 'cloudflared') {
+    const localBinDir = path.join(os.homedir(), '.ipingyou', 'bin');
+    await fs.promises.mkdir(localBinDir, { recursive: true, mode: 0o700 });
+    const localPath = path.join(localBinDir, osInfo.isWindows ? 'cloudflared.exe' : 'cloudflared');
+
+    if (osInfo.isMac) {
+      const arch = osInfo.arch === 'arm64' ? 'arm64' : 'amd64';
+      const url = `https://github.com/cloudflare/cloudflared/${relLatest}/download/cloudflared-darwin-${arch}.tgz`;
+      const tgzPath = path.join(os.tmpdir(), 'cloudflared.tgz');
+      await downloadUrlToPath(url, tgzPath);
+      await execa('tar', ['-xzf', tgzPath, '-C', localBinDir]);
+    } else if (osInfo.isWindows) {
+      const arch = osInfo.arch === 'x64' ? 'amd64' : '386';
+      const url = `https://github.com/cloudflare/cloudflared/${relLatest}/download/cloudflared-windows-${arch}.exe`;
+      await downloadUrlToPath(url, localPath);
+    } else if (osInfo.isLinux) {
+      const arch = osInfo.arch === 'x64' ? 'amd64' : (osInfo.arch === 'arm64' ? 'arm64' : '386');
+      const url = `https://github.com/cloudflare/cloudflared/${relLatest}/download/cloudflared-linux-${arch}`;
+      await downloadUrlToPath(url, localPath);
+      await fs.promises.chmod(localPath, 0o755);
+    }
+  }
+}
+
+export async function getCloudflaredPath() {
+  if (await commandExists('cloudflared')) {
+    return 'cloudflared';
+  }
+  const localBinDir = path.join(os.homedir(), '.ipingyou', 'bin');
+  const localPath = path.join(localBinDir, process.platform === 'win32' ? 'cloudflared.exe' : 'cloudflared');
+  if (fs.existsSync(localPath)) {
+    return localPath;
+  }
+  return null;
+}
+
+export async function checkDependencies() {
+  const osInfo = detectOS();
+  const cfPath = await getCloudflaredPath();
+  let results = {
+    ssh: await commandExists('ssh'),
+    cloudflared: cfPath !== null,
+  };
+
+  const missing = Object.entries(results)
+    .filter(([, available]) => !available)
+    .map(([name]) => name);
+
+  if (missing.length > 0) {
+    console.log('');
+    console.log(chalk.bold('  🔍 Dependency Check'));
+    console.log(chalk.dim('  ─────────────────────────────────'));
+    console.log(`  ${results.ssh ? chalk.green('✓') : chalk.red('✗')} ssh          ${results.ssh ? chalk.dim('found') : chalk.red('missing')}`);
+    console.log(`  ${results.cloudflared ? chalk.green('✓') : chalk.red('✗')} cloudflared  ${results.cloudflared ? chalk.dim('found') : chalk.red('missing')}`);
+    console.log('');
+    console.log(chalk.yellow(`  ⚠️  Missing dependencies found: ${missing.join(', ')}`));
+    console.log(chalk.cyan(`  Attempting auto-installation...`));
+
+    for (const dep of missing) {
+      console.log(chalk.blue(`\n  📦 Installing ${dep}...`));
+      try {
+        await autoInstallDependency(dep, osInfo);
+        console.log(chalk.green(`  ✓ Successfully installed ${dep}`));
+      } catch (err) {
+        throw new Error(`Auto-installation of ${dep} failed: ${err.message}`);
+      }
+    }
+
+    // Re-verify after installation
+    const finalCfPath = await getCloudflaredPath();
+    results = {
+      ssh: await commandExists('ssh'),
+      cloudflared: finalCfPath !== null,
+    };
+
+    const stillMissing = Object.entries(results)
+      .filter(([, available]) => !available)
+      .map(([name]) => name);
+
+    if (stillMissing.length > 0) {
+      throw new Error(`Auto-installation succeeded but dependencies are still missing: ${stillMissing.join(', ')}`);
+    }
+  }
+
+  console.log('');
+  console.log(chalk.bold('  🔍 Dependency Check'));
+  console.log(chalk.dim('  ─────────────────────────────────'));
+  console.log(`  ✓ ssh          ${chalk.dim('found')}`);
+  console.log(`  ✓ cloudflared  ${chalk.dim('found')}`);
+  console.log(chalk.green('\n  ✅ All dependencies satisfied!\n'));
+
+  return results;
+}
+

package/src/lib/{ssh.js → services/ssh.js}

@@ -1,4 +1,16 @@
 import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+function getCloudflaredPathSync() {
+  const localBinDir = path.join(os.homedir(), '.ipingyou', 'bin');
+  const localPath = path.join(localBinDir, process.platform === 'win32' ? 'cloudflared.exe' : 'cloudflared');
+  if (fs.existsSync(localPath)) {
+    return localPath;
+  }
+  return 'cloudflared';
+}
 
 const SAFE_HOSTNAME_PATTERN = /^(?=.{1,253}$)(?!.*\.\.)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/i;
 
@@ -58,7 +70,8 @@ export function getSshControlOptions(hostname) {
 
 export function buildProxyCommandOption(hostname) {
   const safeHostname = assertSafeHostname(hostname, 'tunnel hostname');
-  return ['-o', `ProxyCommand=cloudflared access tcp --hostname ${safeHostname}`];
+  const cfExecutable = getCloudflaredPathSync();
+  return ['-o', `ProxyCommand=${cfExecutable} access tcp --hostname ${safeHostname}`];
 }
 
 export function getKnownHostsOptions(persistKnownHosts = true) {

package/src/lib/{tunnel.js → services/tunnel.js}

@@ -1,7 +1,8 @@
 import { execa } from 'execa';
 import chalk from 'chalk';
-import { createSpinner, tunnelSpinner } from './animations.js';
-import { killProcessTree, trackPID, untrackPID } from './cleanup.js';
+import { createSpinner, tunnelSpinner } from '../mod/animations.js';
+import { killProcessTree, trackPID, untrackPID } from '../mod/cleanup.js';
+import { getCloudflaredPath } from './platform.js';
 
 export async function spawnTunnelSupervised(targetUrl, onUrlGenerated) {
   let isShuttingDown = false;
@@ -11,8 +12,9 @@ export async function spawnTunnelSupervised(targetUrl, onUrlGenerated) {
     while (!isShuttingDown) {
       const spinner = createSpinner('Starting Cloudflare tunnel...', tunnelSpinner).start();
 
+      const cfExecutable = (await getCloudflaredPath()) || 'cloudflared';
       await new Promise((resolve) => {
-        activeChild = execa('cloudflared', ['tunnel', '--url', targetUrl], {
+        activeChild = execa(cfExecutable, ['tunnel', '--url', targetUrl], {
           reject: false,
           all: true,
           buffer: false,