@miraj181/ipingyou 2.1.2 → 2.1.4

package/README.md

@@ -25,7 +25,7 @@ No firewalls to configure. No port forwarding. No plaintext leakage.
 * 🧭 **Approval Gate**: Require the Host to explicitly approve clients before they receive tunnel/key material.
 * 📦 **One-Time File Share**: Serve a single file/folder over SCP and revoke after use.
 * 🌐 **HTTP & TCP Exposure**: Share a local web app or any TCP service (DB/RDP/VNC) beyond SSH.
-* 📂 **Shared Drop Folder**: Auto-prepared dropbox folder for safe file transfers (macOS friendly).
+* 📂 **Shared Drop Folder**: Auto-prepared dropbox folder for safe file transfers (macOS friendly), removed on exit.
 * 🧾 **Live Session Logs**: Host/client/broker write ephemeral per-session logs with actions and request/response status, removed on exit.
 
 ---
@@ -60,22 +60,43 @@ securelink
 
 ## 🔒 Zero-Knowledge Architecture
 
-The public broker server exists solely to rendezvous connections. It is fundamentally a **"Dumb Pipe"**.
+The public broker server exists solely to rendezvous connections and approvals. It is fundamentally a **"Dumb Pipe"**.
+
+### Session Bootstrap & Data Path
 
 ```mermaid
 graph LR
-    H[Host CLI] -->|AES-256-CBC Encrypted Payload| B((Broker Relay))
-    B -->|Encrypted Payload| C[Client CLI]
+    H[Host CLI] -->|AES-256-CBC Encrypted Session Payload| B((Broker Relay))
+    H -->|Host Auth Token for approvals and telemetry| B
+    B -->|Encrypted Session Payload| C[Client CLI]
     C -->|Locally Decrypts Password| C
-    C -->|Direct Cloudflare SSH| H
+    C -->|Direct Cloudflare SSH/TCP| H
     C -->|E2E AES-GCM WebSockets| H
 ```
 
-1. **Host** starts up, spawns `cloudflared` tunnels for SSH and Chat, and generates a random, offline **AES-256 Session Password**.
-2. **Host** encrypts the tunnel data with the password and sends the *ciphertext* to the Broker alongside a short UID.
+1. **Host** starts up, spawns `cloudflared` tunnels for SSH/HTTP/TCP and Chat, then generates a random **AES-256 Session Password** plus a **host-only auth token**.
+2. **Host** encrypts the session payload with the password and registers the ciphertext (plus the host token) with the Broker under a short UID.
 3. **Client** runs `ipingyou connect`, enters the UID and Password.
-4. **Client** fetches the ciphertext, decrypts it locally, and connects directly via SSH and WebSockets.
-5. On `Ctrl+C`, `tree-kill` initiates a graceful shutdown, revokes the UID from the broker, and scrubs `/tmp` memory.
+4. **Client** fetches the ciphertext, decrypts it locally, and connects directly via SSH or WebSockets.
+5. On `Ctrl+C`, `tree-kill` initiates a graceful shutdown, revokes the UID from the broker, and removes session artifacts.
+
+### Approval Gate Flow (Optional)
+
+```mermaid
+sequenceDiagram
+    participant C as Client CLI
+    participant B as Broker Relay
+    participant H as Host CLI
+    C->>B: approval-request encrypted metadata
+    H->>B: fetch approvals with x-host-token
+    H->>B: approve/deny with x-host-token
+    C->>B: poll approval status
+    B-->>C: approved/denied
+```
+
+1. **Client** submits encrypted approval metadata (username, host, intent) to the Broker.
+2. **Host** lists and decides approvals using its host-only auth token; the Broker never shares this token with clients.
+3. **Client** polls for approval status and proceeds only when approved.
 
 ---
 
@@ -111,6 +132,8 @@ These alerts (e.g., "AI-detected potential code anomaly", "Shell access", "Netwo
 | `ipingyou service install` | 👻 Installs Host mode as an always-on background daemon. |
 | `ipingyou service stop` | Stops and removes the background daemon. |
 | `ipingyou service status` | Shows background daemon status. |
+| `ipingyou allowlist` | Manage the AI command allowlist (list/add/remove). |
+| `ipingyou history` | View session event logs from `~/.ipingyou/logs`. |
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraj181/ipingyou",
-  "version": "2.1.2",
+  "version": "2.1.4",
   "description": "SecureLink-CLI — Secure peer-to-peer remote access via SSH & Cloudflare Tunnels",
   "main": "src/cli.js",
   "bin": {

package/src/cli.js

@@ -122,6 +122,8 @@ function showRichHelp() {
   console.log(`    • Cloudflare Tunnels punch through NAT/Firewalls securely.`);
   console.log(`    • ${chalk.green('End-to-End Encryption')}: Tunnel URLs are AES-256 encrypted locally.`);
   console.log(`    • The Broker never sees your plaintext URL, only ciphertext.`);
+  console.log(`    • ${chalk.green('Host Auth Token')}: Host-only token gates approvals & telemetry access.`);
+  console.log(`    • ${chalk.green('Approval Gate')}: Clients submit encrypted metadata; Host approves/denies.`);
   console.log('');
 
   console.log(chalk.bold.white('  🔥 Advanced Features:'));
@@ -130,6 +132,8 @@ function showRichHelp() {
   console.log(`    • ${chalk.green('E2E Chat Room')}      : Real-time Web Crypto AES-GCM secure chat UI for Host & Clients.`);
   console.log(`    • ${chalk.green('Daemonization')}      : Run Host mode as a background service via PM2.`);
   console.log(`    • ${chalk.green('Panic Kill-Switch')}  : Instantly purge all processes, configurations, and traces.`);
+  console.log(`    • ${chalk.green('Shared Drop Folder')} : Session dropbox auto-removed on exit.`);
+  console.log(`    • ${chalk.green('Live Session Logs')}  : Host/client/broker events written per session.`);
   console.log('');
 
   console.log(chalk.bold.white('  💡 Examples:'));

package/src/lib/broker.js

@@ -1,5 +1,6 @@
 import chalk from 'chalk';
 import os from 'node:os';
+import crypto from 'node:crypto';
 import { decrypt, encrypt } from './crypto.js';
 import { createSpinner, cryptoSpinner, networkSpinner } from './animations.js';
 import { logSessionEvent } from './session-log.js';
@@ -51,6 +52,7 @@ export async function registerWithBroker(brokerUrl, uid, tunnelUrl, password, se
     await new Promise(r => setTimeout(r, 600));
     const payload = JSON.stringify({ url: tunnelUrl, ...serviceConfig });
     const encrypted = encrypt(payload, password);
+    const localHostToken = crypto.randomBytes(32).toString('hex');
 
     spinner.text = 'Registering with broker...';
 
@@ -64,6 +66,7 @@ export async function registerWithBroker(brokerUrl, uid, tunnelUrl, password, se
         salt: encrypted.salt,
         approvalRequired: Boolean(serviceConfig.approvalRequired),
         oneTime: Boolean(serviceConfig.oneTimeSharePath),
+        hostToken: localHostToken,
       }),
     });
 
@@ -77,7 +80,7 @@ export async function registerWithBroker(brokerUrl, uid, tunnelUrl, password, se
     spinner.succeed(`Registered with broker ${chalk.dim(`(${brokerUrl})`)} ${chalk.green('[E2E encrypted]')}`);
     logSessionEvent('broker_registered', { uid, broker: brokerUrl });
     // Return the host authentication token — needed for all host-only broker operations
-    return { success: true, hostToken: result.hostToken || null };
+    return { success: true, hostToken: result.hostToken || localHostToken || null };
   } catch (err) {
     spinner.fail(`Broker registration failed: ${err.message}`);
     console.error(chalk.red(`  ❌ Error: ${err.message}`));

package/src/modes/host.js

@@ -193,6 +193,23 @@ async function prepareSharedDropFolder(uid) {
   return dropPath;
 }
 
+async function cleanupSharedDropFolder(dropPath, uid) {
+  if (!dropPath) return;
+  const expectedPath = path.join(os.homedir(), `ipingyou-dropbox-${uid}`);
+  if (path.resolve(dropPath) !== path.resolve(expectedPath)) {
+    console.log(chalk.yellow('     Skipping drop folder cleanup (unexpected path).'));
+    return;
+  }
+  try {
+    const stat = await fs.promises.lstat(dropPath).catch(() => null);
+    if (!stat || !stat.isDirectory() || stat.isSymbolicLink()) return;
+    console.log(chalk.dim('     Removing shared drop folder...'));
+    await fs.promises.rm(dropPath, { recursive: true, force: true });
+  } catch (err) {
+    console.log(chalk.yellow(`     Could not remove drop folder: ${err.message}`));
+  }
+}
+
 function showMacPrivacyPreflight(sharedDropPath) {
   if (process.platform !== 'darwin') return;
 
@@ -221,7 +238,7 @@ async function promptOneTimeSharePath() {
   return sharePath.trim() === '~' ? os.homedir() : sharePath.trim().replace(/^~(?=\/)/, os.homedir());
 }
 
-async function startLocalHostDashboard(uid, password, serviceConfig, hostToken) {
+async function startLocalHostDashboard(uid, password, serviceConfig, sessionState) {
   const { default: express } = await import('express');
   const { default: open } = await import('open');
   const app = express();
@@ -251,7 +268,7 @@ async function startLocalHostDashboard(uid, password, serviceConfig, hostToken)
     const push = async () => {
       if (closed) return;
       try {
-        const data = await fetchApprovalRequests(BROKER_URL, uid, hostToken).catch(() => ({ approvals: [] }));
+        const data = await fetchApprovalRequests(BROKER_URL, uid, sessionState.hostToken).catch(() => ({ approvals: [] }));
         res.write(`event: approvals\n`);
         res.write(`data: ${JSON.stringify(data)}\n\n`);
       } catch { }
@@ -286,7 +303,7 @@ async function startLocalHostDashboard(uid, password, serviceConfig, hostToken)
     const { requestId, decision } = req.body || {};
     if (!requestId || !decision) return res.status(400).json({ error: 'requestId and decision required' });
     try {
-      await decideApprovalRequest(BROKER_URL, uid, requestId, decision, hostToken);
+      await decideApprovalRequest(BROKER_URL, uid, requestId, decision, sessionState.hostToken);
       recordEvent('approval_decision', { uid, requestId, decision, via: 'dashboard' });
       res.json({ ok: true });
     } catch (err) {
@@ -296,7 +313,7 @@ async function startLocalHostDashboard(uid, password, serviceConfig, hostToken)
 
   app.post('/api/revoke', async (_req, res) => {
     try {
-      await revokeUID(BROKER_URL, uid, hostToken);
+      await revokeUID(BROKER_URL, uid, sessionState.hostToken);
       recordEvent('uid_revoked', { uid, via: 'dashboard' });
       res.json({ ok: true });
     } catch (err) {
@@ -545,7 +562,7 @@ async function spawnPrivateBroker() {
 /**
  * Display the host dashboard and handle user input.
  */
-async function hostDashboard(uid, tunnelUrl, password, serviceConfig, tunnelProcess, hostToken) {
+async function hostDashboard(uid, password, serviceConfig, tunnelProcess, sessionState) {
   let chatServerInstance = null;
   let chatTunnelProcess = null;
   let dashboardInstance = null;
@@ -559,7 +576,7 @@ async function hostDashboard(uid, tunnelUrl, password, serviceConfig, tunnelProc
     console.log(`  ║  ${chalk.cyan('UID:')}        ${chalk.bold.white(uid.padEnd(30))}║`);
     console.log(`  ║  ${chalk.cyan('Password:')}   ${chalk.bold.white(password.padEnd(30))}║`);
     console.log(`  ║  ${chalk.cyan('Service:')}    ${chalk.dim(serviceConfig.type.toUpperCase() + ' (Port ' + serviceConfig.port + ')').padEnd(30)}║`);
-    console.log(`  ║  ${chalk.cyan('Tunnel:')}     ${chalk.dim(tunnelUrl.substring(0, 40))}  ║`);
+    console.log(`  ║  ${chalk.cyan('Tunnel:')}     ${chalk.dim(sessionState.tunnelUrl.substring(0, 40))}  ║`);
     if (serviceConfig.chatUrl) {
       console.log(`  ║  ${chalk.cyan('Chat URL:')}   ${chalk.dim(serviceConfig.chatUrl.substring(0, 40))}  ║`);
     }
@@ -624,7 +641,7 @@ async function hostDashboard(uid, tunnelUrl, password, serviceConfig, tunnelProc
       switch (action) {
         case 'approvals': {
           try {
-            const data = await fetchApprovalRequests(BROKER_URL, uid, hostToken);
+            const data = await fetchApprovalRequests(BROKER_URL, uid, sessionState.hostToken);
             const pending = (data.approvals || []).filter(item => item.status === 'pending');
             if (pending.length === 0) {
               console.log(chalk.yellow('  No pending approval requests.'));
@@ -656,7 +673,7 @@ async function hostDashboard(uid, tunnelUrl, password, serviceConfig, tunnelProc
                 ],
               }]);
               if (decision !== 'skip') {
-                await decideApprovalRequest(BROKER_URL, uid, request.id, decision, hostToken);
+                await decideApprovalRequest(BROKER_URL, uid, request.id, decision, sessionState.hostToken);
                 recordEvent('approval_decision', { uid, requestId: request.id, decision, username: details.username });
               }
             }
@@ -675,8 +692,8 @@ async function hostDashboard(uid, tunnelUrl, password, serviceConfig, tunnelProc
               chatTunnelProcess = null;
               chatServerInstance = null;
               delete serviceConfig.chatUrl;
-              const res = await registerWithBroker(BROKER_URL, uid, tunnelUrl, password, serviceConfig);
-              if (res.success && res.hostToken) hostToken = res.hostToken;
+              const res = await registerWithBroker(BROKER_URL, uid, sessionState.tunnelUrl, password, serviceConfig);
+              if (res.success && res.hostToken) sessionState.hostToken = res.hostToken;
               renderDashboard();
             }
           });
@@ -684,8 +701,8 @@ async function hostDashboard(uid, tunnelUrl, password, serviceConfig, tunnelProc
           console.log(chalk.dim('  Provisioning Cloudflare tunnel for chat...'));
           chatTunnelProcess = await spawnTunnelSupervised(`http://localhost:${chatServerInstance.port}`, async (newUrl) => {
             serviceConfig.chatUrl = newUrl;
-            const res = await registerWithBroker(BROKER_URL, uid, tunnelUrl, password, serviceConfig);
-            if (res.success && res.hostToken) hostToken = res.hostToken;
+            const res = await registerWithBroker(BROKER_URL, uid, sessionState.tunnelUrl, password, serviceConfig);
+            if (res.success && res.hostToken) sessionState.hostToken = res.hostToken;
             renderDashboard();
           });
 
@@ -698,7 +715,7 @@ async function hostDashboard(uid, tunnelUrl, password, serviceConfig, tunnelProc
         }
 
         case 'dashboard': {
-          dashboardInstance = await startLocalHostDashboard(uid, password, serviceConfig, hostToken);
+          dashboardInstance = await startLocalHostDashboard(uid, password, serviceConfig, sessionState);
           logSessionEvent('host_dashboard_opened');
           return waitForAction();
         }
@@ -748,7 +765,7 @@ async function hostDashboard(uid, tunnelUrl, password, serviceConfig, tunnelProc
           const spinner = createSpinner('Fetching secure client telemetry...', networkSpinner).start();
           try {
             const res = await fetch(`${BROKER_URL}/clients/${uid}`, {
-              headers: hostToken ? { 'x-host-token': hostToken } : {}
+              headers: sessionState.hostToken ? { 'x-host-token': sessionState.hostToken } : {}
             });
             if (!res.ok) throw new Error('Failed to fetch from broker');
             const data = await res.json();
@@ -786,8 +803,8 @@ async function hostDashboard(uid, tunnelUrl, password, serviceConfig, tunnelProc
         }
 
         case 'reregister':
-          const res = await registerWithBroker(BROKER_URL, uid, tunnelUrl, password, serviceConfig);
-          if (res.success && res.hostToken) hostToken = res.hostToken;
+          const res = await registerWithBroker(BROKER_URL, uid, sessionState.tunnelUrl, password, serviceConfig);
+          if (res.success && res.hostToken) sessionState.hostToken = res.hostToken;
           logSessionEvent('host_broker_reregistered');
           return waitForAction();
 
@@ -953,6 +970,7 @@ export async function startHostMode() {
       serviceConfig.sharedDropPath = await prepareSharedDropFolder(uid);
       console.log(chalk.green(`  ✓ Shared drop folder ready: ${serviceConfig.sharedDropPath}`));
       showMacPrivacyPreflight(serviceConfig.sharedDropPath);
+      addCleanupHook(() => cleanupSharedDropFolder(serviceConfig.sharedDropPath, uid));
     } catch (err) {
       console.log(chalk.yellow(`  ⚠️  Could not prepare shared drop folder: ${err.message}`));
     }
@@ -997,24 +1015,23 @@ export async function startHostMode() {
     console.log(chalk.dim(`  ℹ️  Ensure your ${protocol.toUpperCase()} service is running on port ${targetPort}.`));
   }
 
-  let tunnelUrl = null;
-  let hostToken = null;
+  const sessionState = { tunnelUrl: null, hostToken: null };
   const tunnelProcess = await spawnTunnelSupervised(targetUrl, async (newUrl) => {
-    tunnelUrl = newUrl;
+    sessionState.tunnelUrl = newUrl;
     // Register or re-register with broker when tunnel is spawned/respawned
-    const res = await registerWithBroker(BROKER_URL, uid, tunnelUrl, password, serviceConfig);
+    const res = await registerWithBroker(BROKER_URL, uid, sessionState.tunnelUrl, password, serviceConfig);
     if (!res.success) {
       console.error(chalk.red(`\n  ❌ FATAL: Could not register with broker at ${BROKER_URL}`));
       logSessionEvent('host_broker_register_failed', { broker: BROKER_URL }, 'error');
       process.exit(1);
     }
-    if (res.hostToken) hostToken = res.hostToken;
+    if (res.hostToken) sessionState.hostToken = res.hostToken;
   });
 
-  // Wait for the first URL to be generated before showing the dashboard
-  await waitForValue(() => tunnelUrl, 30000, 'Cloudflare tunnel startup');
+  // Wait for the tunnel AND broker registration to complete before showing dashboard
+  await waitForValue(() => sessionState.hostToken, 30000, 'Cloudflare tunnel and Broker startup');
 
-  setRevokeOnExit(uid, BROKER_URL, () => hostToken);
+  setRevokeOnExit(uid, BROKER_URL, () => sessionState.hostToken);
 
-  await hostDashboard(uid, tunnelUrl, password, serviceConfig, tunnelProcess, hostToken);
+  await hostDashboard(uid, password, serviceConfig, tunnelProcess, sessionState);
 }

package/src/server.js

@@ -124,6 +124,7 @@ const store = new Map(); // uid → { iv, ciphertext, salt, createdAt, clients:
 
 // ─── Security Helpers ────────────────────────────────────────
 const SAFE_PARAM = /^[a-zA-Z0-9_-]{1,64}$/;
+const HOST_TOKEN_FORMAT = /^[a-f0-9]{64}$/i;
 
 function isSafeParam(val) {
   return typeof val === 'string' && SAFE_PARAM.test(val);
@@ -185,7 +186,7 @@ app.get('/health', (_req, res) => {
  */
 app.post('/register', strictLimiter, (req, res) => {
   try {
-    const { uid, iv, ciphertext, salt, approvalRequired = false, oneTime = false } = req.body;
+    const { uid, iv, ciphertext, salt, approvalRequired = false, oneTime = false, hostToken: providedHostToken } = req.body;
 
     if (!uid || !iv || !ciphertext || !salt) {
       recordViolation(req);
@@ -219,8 +220,10 @@ app.post('/register', strictLimiter, (req, res) => {
       return res.status(503).json({ error: 'Broker is at maximum capacity. Please try again later.' });
     }
 
-    // Generate a cryptographic host token — only the host receives this
-    const hostToken = generateHostToken(uid + Date.now().toString());
+    // Use provided host token if valid; otherwise generate a fresh one
+    const hostToken = (typeof providedHostToken === 'string' && HOST_TOKEN_FORMAT.test(providedHostToken))
+      ? providedHostToken
+      : generateHostToken(uid + Date.now().toString());
 
     // Store the encrypted blob as-is — broker NEVER decrypts
     store.set(uid, {