@miraj181/ipingyou 2.1.4 → 2.1.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraj181/ipingyou",
-  "version": "2.1.4",
+  "version": "2.1.6",
   "description": "SecureLink-CLI — Secure peer-to-peer remote access via SSH & Cloudflare Tunnels",
   "main": "src/cli.js",
   "bin": {

package/src/cli.js

@@ -27,6 +27,7 @@ import { fileURLToPath } from 'node:url';
 
 import { detectOS, checkDependencies } from './lib/platform.js';
 import { cleanupAll, installShutdownHandlers, executePanicMode } from './lib/cleanup.js';
+import { cleanupSessionLog } from './lib/session-log.js';
 import { startHostMode } from './modes/host.js';
 import { startClientMode } from './modes/client.js';
 import { startAIMode } from './modes/ai.js';
@@ -163,6 +164,7 @@ function fatal(context, err) {
     stackLines.forEach(line => console.error(chalk.dim(`     ${line.trim()}`)));
   }
   console.error('');
+  cleanupSessionLog();
   cleanupAll().finally(() => process.exit(1));
 }
 

package/src/lib/cleanup.js

@@ -14,6 +14,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { execaCommand } from 'execa';
+import { TMUX_SESSION_NAME, TMUX_SESSION_PREFIX, tmuxSocketArgs } from './tmux.js';
 
 /** @type {Set<number>} — Active child PIDs we manage */
 const trackedPIDs = new Set();
@@ -191,7 +192,15 @@ export async function executePanicMode() {
     } else {
       await execaCommand('pkill -9 -f cloudflared', { reject: false });
       await execaCommand('pkill -9 -f "sshd:.*@"', { reject: false });
-      await execaCommand('tmux kill-session -t SecureLink_Session', { reject: false });
+      await execaCommand(`tmux ${tmuxSocketArgs().join(' ')} kill-server`, { reject: false });
+      const { stdout } = await execaCommand('tmux list-sessions -F "#{session_name}"', { reject: false });
+      const legacyNames = stdout
+        .split(/\r?\n/)
+        .filter(Boolean)
+        .filter(name => name === TMUX_SESSION_NAME || name.startsWith(TMUX_SESSION_PREFIX));
+      for (const name of legacyNames) {
+        await execaCommand(`tmux kill-session -t ${name}`, { reject: false });
+      }
     }
   } catch {}
 

package/src/lib/path-browser.js

@@ -109,11 +109,11 @@ export async function promptLocalPath(label, browserStart = process.cwd()) {
   return expandLocalPath(localPath);
 }
 
-async function listRemoteDirectory(username, hostname, privateKeyPath, remoteDir) {
+async function listRemoteDirectory(username, hostname, privateKeyPath, remoteDir, persistKnownHosts = true) {
   const cdTarget = formatRemoteCd(remoteDir);
   const cdCommand = cdTarget ? `cd ${cdTarget}` : 'cd';
   const command = `${cdCommand} && printf '__SECURELINK_PWD__%s\\n' "$PWD" && ls -1Ap`;
-  const sshArgs = buildSshArgs(hostname, privateKeyPath);
+  const sshArgs = buildSshArgs(hostname, privateKeyPath, [], { persistKnownHosts });
   sshArgs.push(`${username}@${hostname}`, command);
 
   const result = await execa('ssh', sshArgs, {
@@ -146,7 +146,8 @@ async function listRemoteDirectory(username, hostname, privateKeyPath, remoteDir
   return { pwd, entries };
 }
 
-export async function promptRemotePath(username, hostname, privateKeyPath, purpose, startDir = '~') {
+export async function promptRemotePath(username, hostname, privateKeyPath, purpose, startDir = '~', options = {}) {
+  const { persistKnownHosts = true } = options;
   const browseLabel = purpose === 'source'
     ? 'Browse host files interactively'
     : 'Browse host folders interactively';
@@ -183,7 +184,7 @@ export async function promptRemotePath(username, hostname, privateKeyPath, purpo
   while (true) {
     let listing;
     try {
-      listing = await listRemoteDirectory(username, hostname, privateKeyPath, currentDir);
+      listing = await listRemoteDirectory(username, hostname, privateKeyPath, currentDir, persistKnownHosts);
     } catch (err) {
       console.log(chalk.yellow(`  ⚠️  Could not browse host files: ${err.message}`));
       if (/Operation not permitted/i.test(err.stderr || err.message)) {

package/src/lib/ssh.js

@@ -34,11 +34,24 @@ export function getSshControlOptions(hostname) {
   ];
 }
 
-export function buildSshArgs(hostname, privateKeyPath, extraOptions = []) {
+export function getKnownHostsOptions(persistKnownHosts = true) {
+  if (persistKnownHosts) {
+    return ['-o', 'StrictHostKeyChecking=accept-new'];
+  }
+  const nullDevice = process.platform === 'win32' ? 'NUL' : '/dev/null';
+  return [
+    '-o', 'StrictHostKeyChecking=no',
+    '-o', `UserKnownHostsFile=${nullDevice}`,
+    '-o', 'LogLevel=ERROR',
+  ];
+}
+
+export function buildSshArgs(hostname, privateKeyPath, extraOptions = [], options = {}) {
+  const { persistKnownHosts = true } = options;
   const proxyCommand = `cloudflared access tcp --hostname ${hostname}`;
   const sshArgs = [
     '-o', `ProxyCommand=${proxyCommand}`,
-    '-o', 'StrictHostKeyChecking=accept-new',
+    ...getKnownHostsOptions(persistKnownHosts),
     '-o', 'IdentitiesOnly=yes',
     ...getSshControlOptions(hostname),
     ...extraOptions,

package/src/lib/tmux.js

@@ -0,0 +1,23 @@
+import os from 'node:os';
+import path from 'node:path';
+
+export const TMUX_SESSION_PREFIX = 'SecureLink_';
+export const TMUX_SESSION_NAME = 'SecureLink_Session';
+export const TMUX_SOCKET_PATH = path.join(os.tmpdir(), 'ipingyou-tmux.sock');
+
+export function tmuxSocketArgs() {
+  return ['-S', TMUX_SOCKET_PATH];
+}
+
+export function tmuxSocketCommand() {
+  return `tmux -S ${TMUX_SOCKET_PATH}`;
+}
+
+export function buildTmuxSessionName(label) {
+  const safeLabel = String(label || 'client')
+    .replace(/[^a-zA-Z0-9_-]/g, '')
+    .slice(0, 24) || 'client';
+  const stamp = Date.now().toString(36);
+  const rand = Math.random().toString(36).slice(2, 6);
+  return `${TMUX_SESSION_PREFIX}${safeLabel}_${stamp}${rand}`;
+}

package/src/modes/client.js

@@ -24,7 +24,8 @@ import { getConfig, saveAlias } from '../lib/config.js';
 import { pushTelemetry, requestHostApproval, resolveUID, revokeUID, waitForApproval } from '../lib/broker.js';
 import { calculateChecksum } from '../lib/checksum.js';
 import { promptLocalPath, promptRemotePath } from '../lib/path-browser.js';
-import { buildSshArgs, extractHostname, formatScpRemotePath, getSshControlOptions, quoteRemoteShell } from '../lib/ssh.js';
+import { buildSshArgs, extractHostname, formatScpRemotePath, getKnownHostsOptions, getSshControlOptions, quoteRemoteShell } from '../lib/ssh.js';
+import { buildTmuxSessionName, tmuxSocketCommand } from '../lib/tmux.js';
 import open from 'open';
 import { cleanupSessionLog, initSessionLog, logSessionEvent, recordEvent } from '../lib/session-log.js';
 
@@ -68,7 +69,7 @@ async function writeEphemeralPrivateKey(privateKey) {
 /**
  * Start SSH connection through the Cloudflare tunnel.
  */
-async function connectSSH(username, hostname, privateKeyPath) {
+async function connectSSH(username, hostname, privateKeyPath, persistKnownHosts = true) {
   console.log('');
   console.log(chalk.bold('  🔗 Establishing SSH Connection'));
   console.log(chalk.dim('  ─────────────────────────────────'));
@@ -84,10 +85,13 @@ async function connectSSH(username, hostname, privateKeyPath) {
     const sshArgs = buildSshArgs(hostname, privateKeyPath, [
       '-o', 'ServerAliveInterval=30',
       '-o', 'ServerAliveCountMax=3'
-    ]);
+    ], { persistKnownHosts });
 
     sshArgs.push(`${username}@${hostname}`);
-    sshArgs.push('-t', 'tmux new-session -A -s SecureLink_Session 2>/dev/null || exec $SHELL -l');
+    const tmuxSession = buildTmuxSessionName(username);
+    const tmuxPrepare = `${tmuxSocketCommand()} has-session -t ${tmuxSession} 2>/dev/null || ${tmuxSocketCommand()} new-session -d -s ${tmuxSession}`;
+    const tmuxAttach = `${tmuxSocketCommand()} attach -t ${tmuxSession}`;
+    sshArgs.push('-t', `${tmuxPrepare} && ${tmuxAttach} || exec $SHELL -l`);
 
     const child = execa('ssh', sshArgs, {
       stdio: 'inherit',
@@ -119,9 +123,9 @@ async function connectSSH(username, hostname, privateKeyPath) {
 /**
  * Perform an SCP file transfer through the Cloudflare tunnel.
  */
-async function chooseRemoteTransferPath(username, hostname, privateKeyPath, direction, sharedDropPath) {
+async function chooseRemoteTransferPath(username, hostname, privateKeyPath, direction, sharedDropPath, persistKnownHosts = true) {
   if (!sharedDropPath) {
-    return promptRemotePath(username, hostname, privateKeyPath, direction === 'upload' ? 'destination' : 'source');
+    return promptRemotePath(username, hostname, privateKeyPath, direction === 'upload' ? 'destination' : 'source', '~', { persistKnownHosts });
   }
 
   const { dropChoice } = await inquirer.prompt([{
@@ -145,7 +149,7 @@ async function chooseRemoteTransferPath(username, hostname, privateKeyPath, dire
 
   if (dropChoice === 'drop') return sharedDropPath;
   if (dropChoice === 'drop_browse') {
-    return promptRemotePath(username, hostname, privateKeyPath, 'source', sharedDropPath);
+    return promptRemotePath(username, hostname, privateKeyPath, 'source', sharedDropPath, { persistKnownHosts });
   }
   if (dropChoice === 'manual') {
     const { remotePath } = await inquirer.prompt([{
@@ -157,10 +161,10 @@ async function chooseRemoteTransferPath(username, hostname, privateKeyPath, dire
     return remotePath.trim();
   }
 
-  return promptRemotePath(username, hostname, privateKeyPath, direction === 'upload' ? 'destination' : 'source');
+  return promptRemotePath(username, hostname, privateKeyPath, direction === 'upload' ? 'destination' : 'source', '~', { persistKnownHosts });
 }
 
-async function performSCP(username, hostname, direction, privateKeyPath, sharedDropPath = null) {
+async function performSCP(username, hostname, direction, privateKeyPath, sharedDropPath = null, persistKnownHosts = true) {
   console.log('');
   console.log(chalk.bold(`  📦 SCP Transfer (${direction})`));
   console.log(chalk.dim('  ─────────────────────────────────'));
@@ -169,11 +173,11 @@ async function performSCP(username, hostname, direction, privateKeyPath, sharedD
   let remotePath;
 
   if (direction === 'upload') {
-    remotePath = await chooseRemoteTransferPath(username, hostname, privateKeyPath, direction, sharedDropPath);
+    remotePath = await chooseRemoteTransferPath(username, hostname, privateKeyPath, direction, sharedDropPath, persistKnownHosts);
     localPath = await promptLocalPath('client file/folder to upload');
   } else {
     localPath = await promptLocalPath('client destination');
-    remotePath = await chooseRemoteTransferPath(username, hostname, privateKeyPath, direction, sharedDropPath);
+    remotePath = await chooseRemoteTransferPath(username, hostname, privateKeyPath, direction, sharedDropPath, persistKnownHosts);
   }
 
   await showConnectionTrace('Local', 'Remote SCP');
@@ -184,7 +188,7 @@ async function performSCP(username, hostname, direction, privateKeyPath, sharedD
   const scpArgs = [
     '-r', // recursive just in case
     '-o', `ProxyCommand=${proxyCommand}`,
-    '-o', 'StrictHostKeyChecking=accept-new',
+    ...getKnownHostsOptions(persistKnownHosts),
     '-o', 'IdentitiesOnly=yes',
     ...getSshControlOptions(hostname)
   ];
@@ -230,13 +234,7 @@ async function performSCP(username, hostname, direction, privateKeyPath, sharedD
         console.log(chalk.dim('  🔍 Verifying remote SHA-256 checksum...'));
         try {
           const remoteChecksumPath = joinRemotePath(remotePath, path.basename(localPath));
-          const sshArgs = [
-            '-o', `ProxyCommand=${proxyCommand}`,
-            '-o', 'StrictHostKeyChecking=accept-new',
-            '-o', 'IdentitiesOnly=yes',
-            ...getSshControlOptions(hostname)
-          ];
-          if (privateKeyPath) sshArgs.push('-i', privateKeyPath, '-o', 'IdentityAgent=none');
+          const sshArgs = buildSshArgs(hostname, privateKeyPath, [], { persistKnownHosts });
           sshArgs.push(`${username}@${hostname}`, `shasum -a 256 ${quoteRemoteShell(remoteChecksumPath)} 2>/dev/null || sha256sum ${quoteRemoteShell(remoteChecksumPath)} 2>/dev/null || shasum -a 256 ${quoteRemoteShell(remotePath)} 2>/dev/null || sha256sum ${quoteRemoteShell(remotePath)}`);
 
           const { stdout } = await execa('ssh', sshArgs, { reject: false });
@@ -268,13 +266,13 @@ async function performSCP(username, hostname, direction, privateKeyPath, sharedD
   }
 }
 
-async function downloadSpecificRemotePath(username, hostname, privateKeyPath, remotePath, localPath) {
+async function downloadSpecificRemotePath(username, hostname, privateKeyPath, remotePath, localPath, persistKnownHosts = true) {
   await showConnectionTrace('Local', 'Remote SCP');
   const proxyCommand = `cloudflared access tcp --hostname ${hostname}`;
   const scpArgs = [
     '-r',
     '-o', `ProxyCommand=${proxyCommand}`,
-    '-o', 'StrictHostKeyChecking=accept-new',
+    ...getKnownHostsOptions(persistKnownHosts),
     '-o', 'IdentitiesOnly=yes',
     ...getSshControlOptions(hostname),
   ];
@@ -343,6 +341,7 @@ export async function startClientMode(options = {}) {
   let targetUid = null;
   let targetPassword = null;
   let targetUsername = null;
+  let persistKnownHosts = false;
 
   if (aliasKeys.length > 0) {
     const { useAlias } = await inquirer.prompt([
@@ -362,6 +361,7 @@ export async function startClientMode(options = {}) {
       targetUid = aliasData.uid;
       targetPassword = aliasData.password;
       targetUsername = aliasData.username;
+      persistKnownHosts = true;
       logSessionEvent('client_alias_selected', { alias: useAlias, uid: targetUid });
     }
   }
@@ -552,7 +552,7 @@ export async function startClientMode(options = {}) {
     await pushTelemetry(BROKER_URL, targetUid, targetPassword, username, 'one-time-download');
     logSessionEvent('client_one_time_download_start', { uid: targetUid, remotePath: payload.oneTimeSharePath });
 
-    const success = await downloadSpecificRemotePath(username, hostname, privateKeyPath, payload.oneTimeSharePath, localDest);
+    const success = await downloadSpecificRemotePath(username, hostname, privateKeyPath, payload.oneTimeSharePath, localDest, persistKnownHosts);
 
     if (success) {
       console.log(chalk.green('  ✅ One-time file transfer completed successfully!'));
@@ -596,6 +596,7 @@ export async function startClientMode(options = {}) {
       saveAlias(aliasName.trim(), { uid: targetUid, password: targetPassword, username });
       console.log(chalk.green(`  ✓ Saved as alias: ${chalk.bold(aliasName.trim())}\n`));
       logSessionEvent('client_alias_saved', { alias: aliasName.trim(), uid: targetUid });
+      persistKnownHosts = true;
     }
   }
 
@@ -620,11 +621,11 @@ export async function startClientMode(options = {}) {
   if (action === 'chat') {
     await handleClientChat(targetUid, targetPassword, payload.chatUrl);
   } else if (action === 'ssh') {
-    await connectSSH(username, hostname, privateKeyPath);
+    await connectSSH(username, hostname, privateKeyPath, persistKnownHosts);
   } else if (action === 'reverse') {
-    await performReverseForward(username, hostname, privateKeyPath);
+    await performReverseForward(username, hostname, privateKeyPath, persistKnownHosts);
   } else {
-    await performSCP(username, hostname, action, privateKeyPath, payload.sharedDropPath);
+    await performSCP(username, hostname, action, privateKeyPath, payload.sharedDropPath, persistKnownHosts);
   }
 
   console.log('');
@@ -638,7 +639,7 @@ export async function startClientMode(options = {}) {
   ]);
 
   if (reconnect) {
-    await handleSubsequentActions(username, hostname, privateKeyPath, targetUid, targetPassword, payload.sharedDropPath);
+    await handleSubsequentActions(username, hostname, privateKeyPath, targetUid, targetPassword, payload.sharedDropPath, persistKnownHosts);
   }
 
   logSessionEvent('client_session_exit');
@@ -650,7 +651,7 @@ export async function startClientMode(options = {}) {
  * params: { brokerUrl, uid, password, username, direction, localPath, remotePath }
  */
 export async function performSCPNonInteractive(params = {}) {
-  const { brokerUrl, uid, password, username, direction, localPath, remotePath } = params;
+  const { brokerUrl, uid, password, username, direction, localPath, remotePath, persistKnownHosts = true } = params;
   if (!brokerUrl || !uid || !password) throw new Error('Missing broker connection info');
 
   const payload = await resolveUID(brokerUrl, uid, password);
@@ -662,7 +663,7 @@ export async function performSCPNonInteractive(params = {}) {
 
   // Build scp args similar to performSCP
   const proxyCommand = `cloudflared access tcp --hostname ${hostname}`;
-  const scpArgs = ['-r', '-o', `ProxyCommand=${proxyCommand}`, '-o', 'StrictHostKeyChecking=accept-new', '-o', 'IdentitiesOnly=yes', ...getSshControlOptions(hostname)];
+  const scpArgs = ['-r', '-o', `ProxyCommand=${proxyCommand}`, ...getKnownHostsOptions(persistKnownHosts), '-o', 'IdentitiesOnly=yes', ...getSshControlOptions(hostname)];
   if (privateKeyPath) scpArgs.push('-i', privateKeyPath, '-o', 'IdentityAgent=none');
 
   const remoteSpec = `${username}@${hostname}:${formatScpRemotePath(remotePath)}`;
@@ -707,7 +708,7 @@ async function handleClientChat(uid, password, cachedChatUrl) {
   }
 }
 
-async function handleSubsequentActions(username, hostname, privateKeyPath, targetUid, targetPassword, sharedDropPath = null) {
+async function handleSubsequentActions(username, hostname, privateKeyPath, targetUid, targetPassword, sharedDropPath = null, persistKnownHosts = true) {
   const { action } = await inquirer.prompt([
     {
       type: 'list',
@@ -732,11 +733,11 @@ async function handleSubsequentActions(username, hostname, privateKeyPath, targe
   if (action === 'chat') {
     await handleClientChat(targetUid, targetPassword, null);
   } else if (action === 'ssh') {
-    await connectSSH(username, hostname, privateKeyPath);
+    await connectSSH(username, hostname, privateKeyPath, persistKnownHosts);
   } else if (action === 'reverse') {
-    await performReverseForward(username, hostname, privateKeyPath);
+    await performReverseForward(username, hostname, privateKeyPath, persistKnownHosts);
   } else {
-    await performSCP(username, hostname, action, privateKeyPath, sharedDropPath);
+    await performSCP(username, hostname, action, privateKeyPath, sharedDropPath, persistKnownHosts);
   }
 
   const { reconnect } = await inquirer.prompt([
@@ -749,11 +750,11 @@ async function handleSubsequentActions(username, hostname, privateKeyPath, targe
   ]);
 
   if (reconnect) {
-    await handleSubsequentActions(username, hostname, privateKeyPath, targetUid, targetPassword, sharedDropPath);
+    await handleSubsequentActions(username, hostname, privateKeyPath, targetUid, targetPassword, sharedDropPath, persistKnownHosts);
   }
 }
 
-async function performReverseForward(username, hostname, privateKeyPath) {
+async function performReverseForward(username, hostname, privateKeyPath, persistKnownHosts = true) {
   console.log('');
   console.log(chalk.bold.cyan('  🔄 Reverse Port Forwarding'));
   console.log(chalk.dim('  ──────────────────────────────────────'));
@@ -782,7 +783,7 @@ async function performReverseForward(username, hostname, privateKeyPath) {
     '-N',
     '-R', portMap,
     '-o', 'ExitOnForwardFailure=yes',
-  ]);
+  ], { persistKnownHosts });
   sshArgs.push(`${username}@${hostname}`);
 
   console.log('');

package/src/modes/host.js

@@ -29,6 +29,7 @@ import { startChatServer, openLocalChatUI } from '../lib/chat.js';
 import { spawnTunnelSupervised } from '../lib/tunnel.js';
 import { decideApprovalRequest, fetchApprovalRequests, pingBroker, registerWithBroker, revokeUID } from '../lib/broker.js';
 import { cleanupSessionLog, getSessionLogPath, initSessionLog, logSessionEvent, recordEvent } from '../lib/session-log.js';
+import { TMUX_SESSION_NAME, TMUX_SESSION_PREFIX, tmuxSocketArgs } from '../lib/tmux.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 let BROKER_URL = process.env.BROKER_URL || 'https://ipingyou.onrender.com';
@@ -138,6 +139,37 @@ async function ensureTmuxInstalled() {
           throw new Error('Homebrew is required to install tmux on macOS');
         }
       }
+
+      function isSecureLinkSession(name) {
+        return name === TMUX_SESSION_NAME || name.startsWith(TMUX_SESSION_PREFIX);
+      }
+
+      async function listTmuxSessions(socketArgs = []) {
+        const result = await execa('tmux', [...socketArgs, 'list-sessions', '-F', '#{session_name}|#{session_created}'], { reject: false });
+        if (result.exitCode !== 0) return [];
+        return result.stdout
+          .split(/\r?\n/)
+          .filter(Boolean)
+          .map(line => {
+            const [name, createdAt] = line.split('|');
+            return { name, createdAt: Number(createdAt) || null };
+          });
+      }
+
+      async function getMirrorableSessions() {
+        const sessions = [];
+        const customSessions = await listTmuxSessions(tmuxSocketArgs());
+        customSessions
+          .filter(s => isSecureLinkSession(s.name))
+          .forEach(s => sessions.push({ ...s, socketArgs: tmuxSocketArgs(), source: 'custom' }));
+
+        const legacySessions = await listTmuxSessions();
+        legacySessions
+          .filter(s => isSecureLinkSession(s.name))
+          .forEach(s => sessions.push({ ...s, socketArgs: [], source: 'legacy' }));
+
+        return sessions;
+      }
     }
   } catch (err) {
     spinner.fail(`tmux check/install failed: ${err.message}`);
@@ -274,12 +306,37 @@ async function startLocalHostDashboard(uid, password, serviceConfig, sessionStat
       } catch { }
     };
 
-    const iv = setInterval(push, 3000);
+    const iv = setInterval(push, 5000);
     req.on('close', () => { clearInterval(iv); closed = true; });
     // send initial payload
     await push();
   });
 
+  app.get('/api/clients', async (_req, res) => {
+    try {
+      const brokerRes = await fetch(`${BROKER_URL}/clients/${uid}`, {
+        headers: sessionState.hostToken ? { 'x-host-token': sessionState.hostToken } : {}
+      });
+      if (!brokerRes.ok) {
+        const data = await brokerRes.json().catch(() => ({}));
+        return res.status(brokerRes.status).json({ error: data.error || 'Failed to fetch clients' });
+      }
+      const data = await brokerRes.json();
+      const clients = (data.clients || []).map((clientBlob) => {
+        try {
+          const decrypted = decrypt(clientBlob.iv, clientBlob.ciphertext, password, clientBlob.salt);
+          const t = JSON.parse(decrypted);
+          return { ...t, seenAt: clientBlob.seenAt || null };
+        } catch {
+          return { error: 'decrypt_failed', seenAt: clientBlob.seenAt || null };
+        }
+      });
+      res.json({ clients });
+    } catch (err) {
+      res.status(500).json({ error: err.message });
+    }
+  });
+
   // CSRF Protection Middleware for all mutating endpoints
   app.use((req, res, next) => {
     if (req.method !== 'POST') return next();
@@ -404,6 +461,16 @@ function showToast(msg) {
   t.classList.add('show');
   setTimeout(() => t.classList.remove('show'), 2500);
 }
+ 
+function escapeHtml(value) {
+ return String(value || '').replace(/[&<>"']/g, (m) => ({
+   '&': '&amp;',
+   '<': '&lt;',
+   '>': '&gt;',
+   '"': '&quot;',
+   "'": '&#39;',
+ })[m]);
+}
 
 function updateUptime() {
   const diff = Math.floor((Date.now() - startedAt.getTime()) / 1000);
@@ -490,14 +557,47 @@ async function revokeSession() {
 // Poll client telemetry (separate from SSE for simplicity)
 async function pollClients() {
   try {
-    const res = await fetch('/api/status');
+    const res = await fetch('/api/clients');
     if (!res.ok) return;
-    // Client data is fetched from broker by SSE push. Let's also add a client endpoint.
+    const data = await res.json();
+    renderClients(data.clients || []);
   } catch {}
 }
+ 
+function renderClients(clients) {
+  const container = document.getElementById('clients');
+  if (!clients || clients.length === 0) {
+    container.innerHTML = '<p class="empty">No clients connected yet</p>';
+    document.getElementById('client-count').textContent = '';
+    return;
+  }
+ 
+  document.getElementById('client-count').textContent = '(' + clients.length + ' connected)';
+  let html = '';
+  clients.forEach((c, idx) => {
+    if (c.error) {
+      html += '<div class="client-card"><strong>Client #' + (idx + 1) + '</strong> — payload decryption failed</div>';
+      return;
+    }
+    const when = c.time || (c.seenAt ? new Date(c.seenAt).toLocaleTimeString() : 'Unknown');
+    html += '<div class="client-card">'
+      + '<strong>' + escapeHtml(c.username || 'Unknown') + '</strong>'
+      + ' — ' + escapeHtml(c.action || 'connected') + '<br>'
+      + '<span class="meta">IP: ' + escapeHtml(c.ip || 'Unknown') + '</span><br>'
+      + '<span class="meta">OS: ' + escapeHtml(c.os || 'Unknown') + '</span><br>'
+      + '<span class="meta">CPU: ' + escapeHtml(c.cpu || 'Unknown') + '</span><br>'
+      + '<span class="meta">RAM: ' + escapeHtml(c.ram || 'Unknown') + '</span><br>'
+      + '<span class="meta">Time: ' + escapeHtml(when) + '</span>'
+      + '</div>';
+  });
+  container.innerHTML = html;
+}
+ 
+setInterval(pollClients, 5000);
+pollClients();
 </script>
 </body></html>`);
-  });
+ });
 
   return new Promise((resolve) => {
     const server = app.listen(0, '127.0.0.1', async () => {
@@ -742,16 +842,32 @@ async function hostDashboard(uid, password, serviceConfig, tunnelProcess, sessio
 
           try {
             await execaCommand('tmux -V', { reject: true });
-            const sessionCheck = await execa('tmux', ['has-session', '-t', 'SecureLink_Session'], { reject: false });
-            if (sessionCheck.exitCode !== 0) {
+            const sessions = await getMirrorableSessions();
+            if (sessions.length === 0) {
               console.log(chalk.yellow('  ⚠️  No mirrored terminal session is active yet.'));
               console.log(chalk.dim('     A client must choose "Connect via SSH" first. SCP-only clients do not create a tmux session.'));
               console.log(chalk.dim('     tmux is needed on the host machine only; the client does not need tmux.'));
               logSessionEvent('host_mirror_missing_session', {}, 'warn');
               return waitForAction();
             }
-            await execaCommand('tmux attach -t SecureLink_Session -r', { stdio: 'inherit' });
-            logSessionEvent('host_mirror_attached');
+
+            let target = sessions[0];
+            if (sessions.length > 1) {
+              const { sessionChoice } = await inquirer.prompt([{
+                type: 'list',
+                name: 'sessionChoice',
+                message: 'Select an active client session to mirror:',
+                choices: sessions.map((s, idx) => {
+                  const created = s.createdAt ? new Date(s.createdAt * 1000).toLocaleTimeString() : 'Unknown';
+                  const label = `${s.name} ${chalk.dim(`(started ${created})`)}`;
+                  return { name: label, value: String(idx) };
+                }),
+              }]);
+              target = sessions[parseInt(sessionChoice, 10)] || sessions[0];
+            }
+
+            await execa('tmux', [...target.socketArgs, 'attach', '-t', target.name, '-r'], { stdio: 'inherit', reject: false });
+            logSessionEvent('host_mirror_attached', { session: target.name, source: target.source });
           } catch (err) {
             console.log(chalk.yellow('  ⚠️  Could not attach to tmux.'));
             console.log(chalk.dim(`     ${err.message}`));
@@ -815,7 +931,13 @@ async function hostDashboard(uid, password, serviceConfig, tunnelProcess, sessio
               await execaCommand('powershell -NoProfile -Command "Get-CimInstance Win32_Process -Filter \\"name = \'sshd.exe\'\\" | Where-Object { $_.CommandLine -match \'sshd:.*@\' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force }"', { reject: false });
             } else {
               await execaCommand("pkill -f 'sshd:.*@'", { shell: true, reject: false });
-              await execaCommand('tmux kill-session -t SecureLink_Session', { reject: false });
+              await execa('tmux', [...tmuxSocketArgs(), 'kill-server'], { reject: false });
+              const legacySessions = await listTmuxSessions();
+              for (const session of legacySessions) {
+                if (isSecureLinkSession(session.name)) {
+                  await execa('tmux', ['kill-session', '-t', session.name], { reject: false });
+                }
+              }
             }
             spinner.succeed('All client SSH sessions terminated');
             logSessionEvent('host_sessions_terminated');

package/src/server.js

@@ -68,7 +68,7 @@ app.use((req, res, next) => {
 // Trust proxy is required if the server is behind a reverse proxy (like Render, Heroku, Cloudflare)
 app.set('trust proxy', 1);
 
-// General rate limiter for all requests (100 reqs per 15 minutes per IP)
+// General rate limiter for public requests (100 reqs per 15 minutes per IP)
 const generalLimiter = rateLimit({
   windowMs: 15 * 60 * 1000,
   max: 100,
@@ -76,7 +76,6 @@ const generalLimiter = rateLimit({
   standardHeaders: true,
   legacyHeaders: false,
 });
-app.use(generalLimiter);
 
 // Stricter rate limiter for registration/revocation endpoints (e.g. 20 reqs per 15 mins)
 const strictLimiter = rateLimit({
@@ -87,6 +86,15 @@ const strictLimiter = rateLimit({
   legacyHeaders: false,
 });
 
+// Higher limiter for host-authenticated endpoints (dashboard polling, approvals, telemetry views)
+const hostLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000,
+  max: 600,
+  message: { error: 'Too many host requests. Please try again later.' },
+  standardHeaders: true,
+  legacyHeaders: false,
+});
+
 // ─── Active Defense & IP Blacklisting (IDS) ──────────────────
 const ipViolations = new Map(); // ip → violation_count
 const blacklistedIPs = new Set();
@@ -173,7 +181,7 @@ setInterval(pruneExpired, 5 * 60 * 1000);
 // ─── Routes ──────────────────────────────────────────────────
 
 // Health
-app.get('/health', (_req, res) => {
+app.get('/health', generalLimiter, (_req, res) => {
   res.json({ status: 'ok', uptime: process.uptime(), activeUIDs: store.size });
 });
 
@@ -253,7 +261,7 @@ app.post('/register', strictLimiter, (req, res) => {
  * Returns the ENCRYPTED blob { iv, ciphertext } for a given UID.
  * The client CLI decrypts it locally — the broker never sees plaintext.
  */
-app.get('/resolve/:uid', (req, res) => {
+app.get('/resolve/:uid', generalLimiter, (req, res) => {
   try {
     const { uid } = req.params;
     if (!isSafeParam(uid)) {
@@ -355,7 +363,7 @@ app.post('/approval-request/:uid', generalLimiter, (req, res) => {
 });
 
 // HOST-ONLY: List approval requests (requires host token)
-app.get('/approval-requests/:uid', generalLimiter, (req, res) => {
+app.get('/approval-requests/:uid', hostLimiter, (req, res) => {
   if (!isSafeParam(req.params.uid)) return res.status(400).json({ error: 'Invalid UID' });
   const entry = store.get(req.params.uid);
   if (!entry) return res.status(404).json({ error: 'UID not found' });
@@ -434,7 +442,7 @@ app.post('/client-info/:uid', generalLimiter, (req, res) => {
  * Host retrieves all securely encrypted client telemetry blobs.
  */
 // HOST-ONLY: View client telemetry (requires host token)
-app.get('/clients/:uid', generalLimiter, (req, res) => {
+app.get('/clients/:uid', hostLimiter, (req, res) => {
   try {
     const { uid } = req.params;
     if (!isSafeParam(uid)) return res.status(400).json({ error: 'Invalid UID format' });