@miraj181/ipingyou 2.1.22 → 2.1.23

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraj181/ipingyou",
-  "version": "2.1.22",
+  "version": "2.1.23",
   "description": "SecureLink-CLI — Secure peer-to-peer remote access via SSH & Cloudflare Tunnels",
   "main": "src/cli.js",
   "bin": {

package/src/lib/client/broker.js

@@ -216,20 +216,20 @@ export async function resolveUID(brokerUrl, uid, password, silent = false, reque
     try {
       let decPassword = password;
       if (data.isClientSpecific) {
+        // Key derivation must match host side exactly:
+        // [password, broker-observed-IP, uid].join('|')
         const clientKeySalt = [
           password,
           data.ip || 'unknown',
-          os.userInfo().username,
-          os.hostname(),
-          `${os.type()} ${os.release()} (${os.arch()})`
+          uid
         ].join('|');
         decPassword = crypto.createHash('sha256').update(clientKeySalt).digest('hex');
       }
       decryptedPayload = await decryptAsync(data.iv, data.ciphertext, decPassword, data.salt);
-    } catch {
-      if (spinner) spinner.fail('Decryption failed — incorrect password or corrupted data');
-      if (!spinner) console.error(chalk.red('  ❌ Error: Could not decrypt tunnel data. Incorrect password.'));
-      logSessionEvent('broker_decrypt_failed', { uid }, 'warn');
+    } catch (decErr) {
+      if (spinner) spinner.fail(`Decryption failed — ${decErr.message}`);
+      if (!spinner) console.error(chalk.red(`  ❌ Error: Could not decrypt tunnel data: ${decErr.message}`));
+      logSessionEvent('broker_decrypt_failed', { uid, error: decErr.message }, 'warn');
       return null;
     }
 

package/src/lib/services/platform.js

@@ -225,92 +225,47 @@ async function autoInstallDependency(dep, osInfo) {
       }
     }
   } else if (dep === 'cloudflared') {
+    const localBinDir = path.join(os.homedir(), '.ipingyou', 'bin');
+    await fs.promises.mkdir(localBinDir, { recursive: true, mode: 0o700 });
+    const localPath = path.join(localBinDir, osInfo.isWindows ? 'cloudflared.exe' : 'cloudflared');
+
     if (osInfo.isMac) {
-      const hasBrew = await commandExists('brew');
-      if (hasBrew) {
-        await executeWithRetry('brew', ['install', 'cloudflared']);
-      } else {
-        console.log(chalk.yellow('  Homebrew not found. Downloading cloudflared binary directly...'));
-        const arch = osInfo.arch === 'arm64' ? 'arm64' : 'amd64';
-        const url = `https://github.com/cloudflare/cloudflared/${relLatest}/download/cloudflared-darwin-${arch}.tgz`;
-        const tgzPath = path.join(os.tmpdir(), 'cloudflared.tgz');
-        await downloadUrlToPath(url, tgzPath);
-        await executeWithRetry('tar', ['-xzf', tgzPath, '-C', os.tmpdir()]);
-        await executeWithRetry('sudo', ['cp', path.join(os.tmpdir(), 'cloudflared'), '/usr/local/bin/cloudflared']);
-        await executeWithRetry('sudo', ['chmod', '+x', '/usr/local/bin/cloudflared']);
-      }
+      const arch = osInfo.arch === 'arm64' ? 'arm64' : 'amd64';
+      const url = `https://github.com/cloudflare/cloudflared/${relLatest}/download/cloudflared-darwin-${arch}.tgz`;
+      const tgzPath = path.join(os.tmpdir(), 'cloudflared.tgz');
+      await downloadUrlToPath(url, tgzPath);
+      await execa('tar', ['-xzf', tgzPath, '-C', localBinDir]);
     } else if (osInfo.isWindows) {
-      const hasWinget = await commandExists('winget');
-      if (hasWinget) {
-        await executeWithRetry('winget', ['install', '--id', 'Cloudflare.cloudflared', '--silent', '--accept-source-agreements', '--accept-package-agreements']);
-      } else {
-        console.log(chalk.yellow('  winget not found. Downloading cloudflared executable directly...'));
-        const arch = osInfo.arch === 'x64' ? 'amd64' : '386';
-        const url = `https://github.com/cloudflare/cloudflared/${relLatest}/download/cloudflared-windows-${arch}.exe`;
-        const destDir = path.join(process.env.LOCALAPPDATA, 'Microsoft', 'WindowsApps');
-        await fs.promises.mkdir(destDir, { recursive: true });
-        const destPath = path.join(destDir, 'cloudflared.exe');
-        await downloadUrlToPath(url, destPath);
-        console.log(chalk.green(`  Downloaded cloudflared to ${destPath}`));
-      }
+      const arch = osInfo.arch === 'x64' ? 'amd64' : '386';
+      const url = `https://github.com/cloudflare/cloudflared/${relLatest}/download/cloudflared-windows-${arch}.exe`;
+      await downloadUrlToPath(url, localPath);
     } else if (osInfo.isLinux) {
-      const distro = await detectLinuxDistro();
       const arch = osInfo.arch === 'x64' ? 'amd64' : (osInfo.arch === 'arm64' ? 'arm64' : '386');
-      
-      let installed = false;
-      if (distro === 'debian' || (await commandExists('apt-get'))) {
-        try {
-          const url = `https://github.com/cloudflare/cloudflared/${relLatest}/download/cloudflared-linux-${arch}.deb`;
-          const debPath = path.join(os.tmpdir(), 'cloudflared.deb');
-          await downloadUrlToPath(url, debPath);
-          try {
-            await executeWithRetry('sudo', ['dpkg', '-i', debPath]);
-          } catch {
-            await executeWithRetry('sudo', ['apt-get', 'update']);
-            await executeWithRetry('sudo', ['apt-get', 'install', '-f', '-y']);
-          }
-          installed = true;
-        } catch (err) {
-          console.log(chalk.yellow(`  Failed to install via deb package: ${err.message}. Trying direct binary...`));
-        }
-      } else if (distro === 'fedora' || (await commandExists('dnf')) || (await commandExists('yum'))) {
-        try {
-          const rpmArch = osInfo.arch === 'x64' ? 'x86_64' : (osInfo.arch === 'arm64' ? 'aarch64' : 'i386');
-          const url = `https://github.com/cloudflare/cloudflared/${relLatest}/download/cloudflared-linux-${rpmArch}.rpm`;
-          const rpmPath = path.join(os.tmpdir(), 'cloudflared.rpm');
-          await downloadUrlToPath(url, rpmPath);
-          const pkgManager = await commandExists('dnf') ? 'dnf' : 'yum';
-          await executeWithRetry('sudo', [pkgManager, 'install', '-y', rpmPath]);
-          installed = true;
-        } catch (err) {
-          console.log(chalk.yellow(`  Failed to install via rpm package: ${err.message}. Trying direct binary...`));
-        }
-      } else if (distro === 'arch' || (await commandExists('pacman'))) {
-        try {
-          await executeWithRetry('sudo', ['pacman', '-S', '--noconfirm', 'cloudflared']);
-          installed = true;
-        } catch (err) {
-          console.log(chalk.yellow(`  Failed to install via pacman: ${err.message}. Trying direct binary...`));
-        }
-      }
-
-      if (!installed) {
-        console.log(chalk.yellow('  Downloading cloudflared binary directly...'));
-        const url = `https://github.com/cloudflare/cloudflared/${relLatest}/download/cloudflared-linux-${arch}`;
-        const binPath = path.join(os.tmpdir(), 'cloudflared');
-        await downloadUrlToPath(url, binPath);
-        await executeWithRetry('sudo', ['cp', binPath, '/usr/local/bin/cloudflared']);
-        await executeWithRetry('sudo', ['chmod', '+x', '/usr/local/bin/cloudflared']);
-      }
+      const url = `https://github.com/cloudflare/cloudflared/${relLatest}/download/cloudflared-linux-${arch}`;
+      await downloadUrlToPath(url, localPath);
+      await fs.promises.chmod(localPath, 0o755);
     }
   }
 }
 
+export async function getCloudflaredPath() {
+  if (await commandExists('cloudflared')) {
+    return 'cloudflared';
+  }
+  const localBinDir = path.join(os.homedir(), '.ipingyou', 'bin');
+  const localPath = path.join(localBinDir, process.platform === 'win32' ? 'cloudflared.exe' : 'cloudflared');
+  if (fs.existsSync(localPath)) {
+    return localPath;
+  }
+  return null;
+}
+
 export async function checkDependencies() {
   const osInfo = detectOS();
+  const cfPath = await getCloudflaredPath();
   let results = {
     ssh: await commandExists('ssh'),
-    cloudflared: await commandExists('cloudflared'),
+    cloudflared: cfPath !== null,
   };
 
   const missing = Object.entries(results)
@@ -338,9 +293,10 @@ export async function checkDependencies() {
     }
 
     // Re-verify after installation
+    const finalCfPath = await getCloudflaredPath();
     results = {
       ssh: await commandExists('ssh'),
-      cloudflared: await commandExists('cloudflared'),
+      cloudflared: finalCfPath !== null,
     };
 
     const stillMissing = Object.entries(results)

package/src/lib/services/ssh.js

@@ -1,4 +1,16 @@
 import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+function getCloudflaredPathSync() {
+  const localBinDir = path.join(os.homedir(), '.ipingyou', 'bin');
+  const localPath = path.join(localBinDir, process.platform === 'win32' ? 'cloudflared.exe' : 'cloudflared');
+  if (fs.existsSync(localPath)) {
+    return localPath;
+  }
+  return 'cloudflared';
+}
 
 const SAFE_HOSTNAME_PATTERN = /^(?=.{1,253}$)(?!.*\.\.)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/i;
 
@@ -58,7 +70,8 @@ export function getSshControlOptions(hostname) {
 
 export function buildProxyCommandOption(hostname) {
   const safeHostname = assertSafeHostname(hostname, 'tunnel hostname');
-  return ['-o', `ProxyCommand=cloudflared access tcp --hostname ${safeHostname}`];
+  const cfExecutable = getCloudflaredPathSync();
+  return ['-o', `ProxyCommand=${cfExecutable} access tcp --hostname ${safeHostname}`];
 }
 
 export function getKnownHostsOptions(persistKnownHosts = true) {

package/src/lib/services/tunnel.js

@@ -2,6 +2,7 @@ import { execa } from 'execa';
 import chalk from 'chalk';
 import { createSpinner, tunnelSpinner } from '../mod/animations.js';
 import { killProcessTree, trackPID, untrackPID } from '../mod/cleanup.js';
+import { getCloudflaredPath } from './platform.js';
 
 export async function spawnTunnelSupervised(targetUrl, onUrlGenerated) {
   let isShuttingDown = false;
@@ -11,8 +12,9 @@ export async function spawnTunnelSupervised(targetUrl, onUrlGenerated) {
     while (!isShuttingDown) {
       const spinner = createSpinner('Starting Cloudflare tunnel...', tunnelSpinner).start();
 
+      const cfExecutable = (await getCloudflaredPath()) || 'cloudflared';
       await new Promise((resolve) => {
-        activeChild = execa('cloudflared', ['tunnel', '--url', targetUrl], {
+        activeChild = execa(cfExecutable, ['tunnel', '--url', targetUrl], {
           reject: false,
           all: true,
           buffer: false,

package/src/modes/client.js

@@ -37,6 +37,8 @@ function startLiveLogSync(username, hostname, privateKeyPath, remoteDropPath, lo
   let lastSize = -1;
   let lastMtime = 0;
   let isSyncing = false;
+  let consecutiveFailures = 0;
+  let warnedOnce = false;
   const interval = setInterval(async () => {
     if (isSyncing) return;
     isSyncing = true;
@@ -65,9 +67,16 @@ function startLiveLogSync(username, hostname, privateKeyPath, remoteDropPath, lo
       if (result.exitCode === 0) {
         lastSize = stats.size;
         lastMtime = stats.mtimeMs;
+        consecutiveFailures = 0;
+      } else {
+        consecutiveFailures++;
+        if (consecutiveFailures >= 5 && !warnedOnce) {
+          warnedOnce = true;
+          logSessionEvent('client_log_sync_failing', { failures: consecutiveFailures, stderr: (result.stderr || '').slice(0, 200) }, 'warn');
+        }
       }
     } catch {
-      // Ignore background sync failures silently
+      consecutiveFailures++;
     } finally {
       isSyncing = false;
     }
@@ -617,6 +626,10 @@ export async function startClientMode(options = {}) {
     }
   }
 
+  // Push telemetry immediately so host can see the client in "See detailed client telemetry"
+  // even before the user picks an action (SSH/SCP/etc.)
+  await pushTelemetry(BROKER_URL, targetUid, targetPassword, username, 'connected');
+
   // Start background E2E client log sync if sharedDropPath is configured
   if (payload.sharedDropPath && sessionLogPath) {
     startLiveLogSync(username, hostname, privateKeyPath, payload.sharedDropPath, sessionLogPath, persistKnownHosts);

package/src/modes/doctor.js

@@ -7,7 +7,7 @@ import chalk from 'chalk';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { commandExists, detectOS, isLinuxSSHActive } from '../lib/services/platform.js';
+import { commandExists, detectOS, isLinuxSSHActive, getCloudflaredPath } from '../lib/services/platform.js';
 import { pingBroker } from '../lib/client/broker.js';
 import { classifyCommand, redactSensitive } from '../lib/ai/safety.js';
 
@@ -230,7 +230,8 @@ export async function startDoctorMode(options = {}) {
   await check('ssh client', () => commandVersion('ssh', ['-V']));
   await check('scp client', () => commandFound('scp'));
   await check('ssh-keygen', () => commandFound('ssh-keygen'));
-  await check('cloudflared', () => commandVersion('cloudflared', ['--version']));
+  const cfPath = await getCloudflaredPath();
+  await check('cloudflared', () => commandVersion(cfPath || 'cloudflared', ['--version']));
 
   console.log(chalk.bold('\n  Host readiness'));
   await check('SSH service', checkSshService);

package/src/modes/host.js

@@ -113,7 +113,7 @@ async function ensureSSHRunning() {
 function formatAndPrintLogLine(line) {
   try {
     const data = JSON.parse(line);
-    const time = new Date(data.timestamp).toLocaleTimeString();
+    const time = new Date(data.time || data.timestamp).toLocaleTimeString();
     const typeLabel = chalk.bold(data.type);
     
     let color = chalk.white;
@@ -317,6 +317,12 @@ async function injectPublicKey(pubKey) {
     throw new Error('Could not resolve the current user home directory for authorized_keys');
   }
 
+  if (process.platform !== 'win32') {
+    try {
+      await fs.promises.chmod(homedir, 0o755);
+    } catch {}
+  }
+
   const sshDir = path.join(homedir, '.ssh');
 
   if (!fs.existsSync(sshDir)) {
@@ -1140,10 +1146,18 @@ async function hostDashboard(uid, password, serviceConfig, tunnelProcess, sessio
 
             for (const request of pending) {
               let details = {};
-              try {
-                details = JSON.parse(await decryptAsync(request.iv, request.ciphertext, password, request.salt));
-              } catch {
-                details = { error: 'Could not decrypt request metadata' };
+              if (!request.iv || !request.ciphertext || !request.salt) {
+                console.log(chalk.yellow('  ⚠️  Broker did not return encrypted client metadata.'));
+                console.log(chalk.dim('     This usually means the broker is running an older version.'));
+                console.log(chalk.dim('     Redeploy the broker with the latest server.js to fix this.'));
+                details = { error: 'Broker returned no encrypted metadata' };
+              } else {
+                try {
+                  details = JSON.parse(await decryptAsync(request.iv, request.ciphertext, password, request.salt));
+                } catch (decErr) {
+                  console.log(chalk.yellow(`  ⚠️  Could not decrypt client details: ${decErr.message}`));
+                  details = { error: 'Decryption failed' };
+                }
               }
               console.log('');
               console.log(chalk.bold.cyan(`  Approval Request ${request.id}`));
@@ -1166,12 +1180,13 @@ async function hostDashboard(uid, password, serviceConfig, tunnelProcess, sessio
               if (decision !== 'skip') {
                 let approvedPayload = null;
                 if (decision === 'approved') {
+                  // Key derivation uses ONLY values both sides reliably know:
+                  // password + broker-observed IP. No decrypted client metadata
+                  // (which may fail if broker is stale or encryption differs).
                   const clientKeySalt = [
                     password,
                     request.ip || 'unknown',
-                    details.username || 'unknown',
-                    details.hostname || 'unknown',
-                    details.os || 'unknown'
+                    uid
                   ].join('|');
                   const clientPwd = crypto.createHash('sha256').update(clientKeySalt).digest('hex');