@miraj181/ipingyou 2.1.5 → 2.1.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraj181/ipingyou",
-  "version": "2.1.5",
+  "version": "2.1.9",
   "description": "SecureLink-CLI — Secure peer-to-peer remote access via SSH & Cloudflare Tunnels",
   "main": "src/cli.js",
   "bin": {
@@ -45,17 +45,15 @@
   },
   "dependencies": {
     "chalk": "^5.3.0",
-    "commander": "^14.0.3",
+    "commander": "^15.0.0",
     "execa": "^9.5.2",
     "inquirer": "^12.11.1",
     "nanoid": "^5.0.9",
     "open": "^11.0.0",
     "ora": "^9.4.0",
+    "shell-quote": "^1.8.4",
     "tree-kill": "^1.2.2",
-    "ws": "^8.20.1",
-    "express": "^5.2.1",
-    "express-rate-limit": "^8.5.2",
-    "helmet": "^8.2.0"
+    "ws": "^8.20.1"
   },
   "devDependencies": {
     "nodemon": "^3.1.4"
@@ -64,4 +62,4 @@
     "node": ">=18.0.0"
   },
   "type": "module"
-}
+}

package/src/cli.js

@@ -348,22 +348,22 @@ program
       console.log(chalk.bold.cyan('  👻 Background Service Manager'));
       console.log(chalk.dim('  ──────────────────────────────────────'));
       
-      const { execaCommand } = await import('execa');
+      const { execa } = await import('execa');
       
       if (action === 'install') {
         console.log(chalk.dim('  Installing PM2 globally and starting host...'));
-        await execaCommand('npm install -g pm2', { stdio: 'inherit' });
-        await execaCommand('pm2 start ipingyou --name "ipingyou-host" -- host', { stdio: 'inherit' });
-        await execaCommand('pm2 save', { stdio: 'inherit' });
-        await execaCommand('pm2 startup', { stdio: 'inherit' });
+        await execa('npm', ['install', '-g', 'pm2'], { stdio: 'inherit' });
+        await execa('pm2', ['start', 'ipingyou', '--name', 'ipingyou-host', '--', 'host'], { stdio: 'inherit' });
+        await execa('pm2', ['save'], { stdio: 'inherit' });
+        await execa('pm2', ['startup'], { stdio: 'inherit' });
         console.log(chalk.green('\n  ✅ Service installed and running in the background.'));
       } else if (action === 'stop') {
-        await execaCommand('pm2 stop ipingyou-host', { stdio: 'inherit' });
-        await execaCommand('pm2 delete ipingyou-host', { stdio: 'inherit' });
-        await execaCommand('pm2 save', { stdio: 'inherit' });
+        await execa('pm2', ['stop', 'ipingyou-host'], { stdio: 'inherit' });
+        await execa('pm2', ['delete', 'ipingyou-host'], { stdio: 'inherit' });
+        await execa('pm2', ['save'], { stdio: 'inherit' });
         console.log(chalk.green('\n  ✅ Service stopped and removed.'));
       } else if (action === 'status') {
-        await execaCommand('pm2 status ipingyou-host', { stdio: 'inherit' });
+        await execa('pm2', ['status', 'ipingyou-host'], { stdio: 'inherit' });
       } else {
         console.log(chalk.red(`  ❌ Unknown action: ${action}. Use install, stop, or status.`));
       }

package/src/lib/broker.js

@@ -244,7 +244,15 @@ export async function resolveUID(brokerUrl, uid, password, silent = false, reque
 }
 
 export async function pushTelemetry(brokerUrl, uid, password, username, action = 'connected') {
+  // Telemetry can be disabled via env var for privacy or testing
+  if (process.env.IPINGYOU_DISABLE_TELEMETRY === '1' || process.env.NODE_ENV === 'test') return;
+
   try {
+    // Validate brokerUrl: only send telemetry to HTTPS brokers
+    let parsed;
+    try { parsed = new URL(brokerUrl); } catch { parsed = null; }
+    if (!parsed || parsed.protocol !== 'https:') return;
+
     let publicIp = 'Unknown';
     try {
       publicIp = await fetch('https://api.ipify.org').then(r => r.text());
@@ -254,15 +262,16 @@ export async function pushTelemetry(brokerUrl, uid, password, username, action =
       username,
       ip: publicIp,
       os: `${os.type()} ${os.release()} (${os.arch()})`,
-      cpu: os.cpus()[0]?.model || 'Unknown CPU',
-      ram: `${Math.round(os.totalmem() / 1024 / 1024 / 1024)} GB`,
+      // Limit fingerprint detail to reduce privacy surface
+      cpu: os.cpus()[0]?.model ? os.cpus()[0].model.replace(/\s{2,}/g, ' ').trim() : 'Unknown',
+      ramGB: Math.round(os.totalmem() / 1024 / 1024 / 1024),
       action,
-      time: new Date().toLocaleTimeString()
+      time: new Date().toISOString()
     };
 
     const { iv, ciphertext, salt } = encrypt(JSON.stringify(telemetry), password);
 
-    await fetchWithLog('telemetry', `${brokerUrl}/client-info/${uid}`, {
+    await fetchWithLog('telemetry', `${parsed.origin}/client-info/${encodeURIComponent(uid)}`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ iv, ciphertext, salt }),

package/src/lib/chat.js

@@ -2,6 +2,7 @@ import http from 'node:http';
 import { WebSocketServer } from 'ws';
 import open from 'open';
 import chalk from 'chalk';
+import { secureSensitiveUrl } from './secure-print.js';
 
 const HTML_CONTENT = `
 <!DOCTYPE html>
@@ -322,6 +323,6 @@ export async function openLocalChatUI(port, password) {
     const chatUrl = `http://localhost:${port}#${password}`;
     await open(chatUrl);
   } catch {
-    console.log(chalk.dim(`     Unable to auto-open browser. Visit http://localhost:${port}#${password}`));
+    console.log(chalk.dim(`     Unable to auto-open browser. Visit ${secureSensitiveUrl(`http://localhost:${port}`, password)}`));
   }
 }

package/src/lib/cleanup.js

@@ -13,8 +13,8 @@ import chalk from 'chalk';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { execaCommand } from 'execa';
-import { TMUX_SESSION_NAME, tmuxSocketArgs } from './tmux.js';
+import { execa } from 'execa';
+import { TMUX_SESSION_NAME, TMUX_SESSION_PREFIX, tmuxSocketArgs } from './tmux.js';
 
 /** @type {Set<number>} — Active child PIDs we manage */
 const trackedPIDs = new Set();
@@ -188,13 +188,31 @@ export async function executePanicMode() {
   console.log(chalk.dim('  [1/4] Terminating all tunnel and host processes...'));
   try {
     if (process.platform === 'win32') {
-      await execaCommand('taskkill /F /IM cloudflared.exe', { reject: false });
+      // taskkill expects a command string on Windows; pass args safely
+      await execa('taskkill', ['/F', '/IM', 'cloudflared.exe'], { reject: false });
     } else {
-      await execaCommand('pkill -9 -f cloudflared', { reject: false });
-      await execaCommand('pkill -9 -f "sshd:.*@"', { reject: false });
-      await execaCommand(`tmux ${tmuxSocketArgs().join(' ')} kill-session -t ${TMUX_SESSION_NAME}`, { reject: false });
+      // Use argument arrays to avoid shell interpolation
+      await execa('pkill', ['-9', '-f', 'cloudflared'], { reject: false });
+      await execa('pkill', ['-9', '-f', 'sshd:.*@'], { reject: false });
+
+      const socketArgs = Array.isArray(tmuxSocketArgs) ? tmuxSocketArgs() : [];
+      // Ensure socketArgs are strings and safe-ish before passing to execa
+      const safeSocketArgs = (socketArgs || []).map(a => String(a));
+      await execa('tmux', [...safeSocketArgs, 'kill-server'], { reject: false });
+
+      const { stdout } = await execa('tmux', ['list-sessions', '-F', '#{session_name}'], { reject: false });
+      const legacyNames = stdout
+        .split(/\r?\n/)
+        .filter(Boolean)
+        .filter(name => name === TMUX_SESSION_NAME || name.startsWith(TMUX_SESSION_PREFIX));
+      for (const name of legacyNames) {
+        await execa('tmux', ['kill-session', '-t', name], { reject: false });
+      }
     }
-  } catch {}
+  } catch (err) {
+    // Best-effort cleanup; log debug info without exposing stack in normal flow
+    // (keep behavior unchanged otherwise)
+  }
 
   // 2. Delete configuration and aliases
   console.log(chalk.dim('  [2/4] Wiping configuration files...'));

package/src/lib/platform.js

@@ -8,10 +8,11 @@
  * ============================================================
  */
 
-import { execaCommand } from 'execa';
+import { execa } from 'execa';
 import chalk from 'chalk';
 import ora from 'ora';
 import os from 'node:os';
+import fs from 'node:fs';
 import { createWriteStream } from 'node:fs';
 import { pipeline } from 'node:stream/promises';
 import { chmod, mkdir, stat, rename } from 'node:fs/promises';
@@ -42,8 +43,9 @@ export function detectOS() {
  */
 export async function detectLinuxDistro() {
   try {
-    const { stdout } = await execaCommand('cat /etc/os-release', { reject: false });
-    const lower = stdout.toLowerCase();
+    // Read the os-release file directly instead of spawning a process
+    const data = await fs.promises.readFile('/etc/os-release', 'utf8');
+    const lower = data.toLowerCase();
     if (lower.includes('ubuntu') || lower.includes('debian') || lower.includes('kali') || lower.includes('mint')) {
       return 'debian';
     }
@@ -66,8 +68,12 @@ export async function detectLinuxDistro() {
  */
 export async function commandExists(cmd) {
   try {
-    const checkCmd = process.platform === 'win32' ? `where ${cmd}` : `which ${cmd}`;
-    await execaCommand(checkCmd, { reject: true });
+    // Prefer direct exec of the check command to avoid shell parsing
+    if (process.platform === 'win32') {
+      await execa('where', [cmd], { reject: true });
+    } else {
+      await execa('which', [cmd], { reject: true });
+    }
     return true;
   } catch {
     return false;
@@ -93,7 +99,20 @@ export async function hasSudo() {
 async function runWithSpinner(label, cmd, opts = {}) {
   const spinner = ora(label).start();
   try {
-    await execaCommand(cmd, { stdio: 'pipe', reject: true, ...opts });
+    // Support both string shell commands and argument arrays.
+    if (Array.isArray(cmd)) {
+      const [c, ...args] = cmd;
+      await execa(c, args, { stdio: 'pipe', reject: true, ...opts });
+    } else if (typeof cmd === 'string') {
+      if (process.platform === 'win32') {
+        await execa('cmd', ['/c', cmd], { stdio: 'pipe', reject: true, ...opts });
+      } else {
+        await execa('sh', ['-c', cmd], { stdio: 'pipe', reject: true, ...opts });
+      }
+    } else {
+      throw new Error('Unsupported command type');
+    }
+
     spinner.succeed(label.replace('...', '') + chalk.green(' ✓'));
     return true;
   } catch (err) {
@@ -198,14 +217,18 @@ async function ensureDownloader() {
  */
 async function downloadFile(url, destPath, downloader) {
   const cmds = {
-    curl:       `curl -fsSL -o "${destPath}" "${url}"`,
-    wget:       `wget -q -O "${destPath}" "${url}"`,
-    powershell: `powershell -Command "Invoke-WebRequest -Uri '${url}' -OutFile '${destPath}'"`,
+    curl:       ['curl', ['-fsSL', '-o', destPath, url]],
+    wget:       ['wget', ['-q', '-O', destPath, url]],
+    powershell: ['powershell', ["-Command", `Invoke-WebRequest -Uri '${url}' -OutFile '${destPath}'`]],
   };
 
+  const entry = cmds[downloader];
+  if (!entry) return false;
+  const [bin, args] = entry;
+
   return runWithSpinner(
     `  Downloading ${chalk.cyan(url.split('/').pop())}...`,
-    cmds[downloader]
+    [bin, ...args]
   );
 }
 

package/src/lib/secure-print.js

@@ -0,0 +1,80 @@
+/**
+ * ============================================================
+ *  Secure Print — Log-safe sensitive value display
+ * ============================================================
+ *  Passwords and secrets are shown in plaintext ONLY when:
+ *    1. stdout is an interactive TTY (not piped/redirected)
+ *    2. The OS user running the process matches the session owner
+ *
+ *  In all other contexts (CI, PM2, piped output, log files),
+ *  values are replaced with a SHA-256 hash prefix so they can
+ *  be correlated without exposing the secret.
+ * ============================================================
+ */
+
+import crypto from 'node:crypto';
+import os from 'node:os';
+
+// Keyed secret for deterministic, non-reversible log masking tokens.
+// Can be overridden for stable cross-process correlation if needed.
+const MASKING_KEY = process.env.SECURE_PRINT_MASK_KEY || crypto.randomBytes(32).toString('hex');
+
+/**
+ * Verify the current process is being run by the same OS user interactively.
+ * Returns true if the caller is the legitimate host user on an interactive terminal.
+ */
+function isVerifiedHostUser() {
+  // Must be a real interactive TTY (not piped/redirected)
+  if (!process.stdout.isTTY) return false;
+
+  // On Unix, verify process UID matches the logged-in user
+  if (typeof process.getuid === 'function') {
+    try {
+      const processUid = process.getuid();
+      const userUid = os.userInfo().uid;
+      if (processUid !== userUid) return false;
+    } catch {
+      return false;
+    }
+  }
+
+  return true;
+}
+
+/**
+ * Mask a sensitive value for log-safe output.
+ * Returns a PBKDF2-derived hash prefix so the value can be correlated without revealing it.
+ */
+function maskSensitive(value) {
+  const normalized = String(value);
+  const hash = crypto
+    .pbkdf2Sync(MASKING_KEY, normalized, 210000, 32, 'sha256')
+    .toString('hex');
+  return `[pbkdf2:${hash.slice(0, 12)}…]`;
+}
+
+/**
+ * Render a sensitive value for display.
+ * - Interactive TTY + verified host user → show plaintext
+ * - Otherwise → show masked hash
+ *
+ * @param {string} value — the sensitive value (e.g. password)
+ * @returns {string}
+ */
+export function secureSensitive(value) {
+  if (isVerifiedHostUser()) return String(value);
+  return maskSensitive(value);
+}
+
+/**
+ * Build a log-safe URL by masking the password fragment.
+ * e.g. http://localhost:3000#mypass → http://localhost:3000#[sha256:a1b2...]
+ *
+ * @param {string} baseUrl — URL without the fragment
+ * @param {string} password — the secret to place after #
+ * @returns {string}
+ */
+export function secureSensitiveUrl(baseUrl, password) {
+  if (isVerifiedHostUser()) return `${baseUrl}#${password}`;
+  return `${baseUrl}#${maskSensitive(password)}`;
+}

package/src/lib/ssh.js

@@ -26,7 +26,7 @@ export function formatScpRemotePath(remotePath) {
 
 export function getSshControlOptions(hostname) {
   if (process.platform === 'win32') return [];
-  const hash = crypto.createHash('sha1').update(hostname).digest('hex').slice(0, 10);
+  const hash = crypto.createHash('sha256').update(hostname).digest('hex').slice(0, 10);
   return [
     '-o', 'ControlMaster=auto',
     '-o', 'ControlPersist=5m',

package/src/lib/tmux.js

@@ -1,6 +1,7 @@
 import os from 'node:os';
 import path from 'node:path';
 
+export const TMUX_SESSION_PREFIX = 'SecureLink_';
 export const TMUX_SESSION_NAME = 'SecureLink_Session';
 export const TMUX_SOCKET_PATH = path.join(os.tmpdir(), 'ipingyou-tmux.sock');
 
@@ -11,3 +12,12 @@ export function tmuxSocketArgs() {
 export function tmuxSocketCommand() {
   return `tmux -S ${TMUX_SOCKET_PATH}`;
 }
+
+export function buildTmuxSessionName(label) {
+  const safeLabel = String(label || 'client')
+    .replace(/[^a-zA-Z0-9_-]/g, '')
+    .slice(0, 24) || 'client';
+  const stamp = Date.now().toString(36);
+  const rand = Math.random().toString(36).slice(2, 6);
+  return `${TMUX_SESSION_PREFIX}${safeLabel}_${stamp}${rand}`;
+}

package/src/modes/ai.js

@@ -2,7 +2,8 @@
  * AI Mode — privacy-first local/remote task assistant powered by Groq.
  */
 
-import { execa, execaCommand } from 'execa';
+import { execa } from 'execa';
+import { parse as shellParse } from 'shell-quote';
 import chalk from 'chalk';
 import inquirer from 'inquirer';
 import fs from 'node:fs';
@@ -210,8 +211,13 @@ function showRateLimitWarnings(rateLimit) {
 }
 
 async function runLocalCommand(command) {
-  const result = await execaCommand(command, {
-    shell: true,
+  const parsed = shellParse(command);
+  // Filter out non-string tokens (shell operators like |, &&, ; etc.) to prevent injection
+  const args = parsed.filter(token => typeof token === 'string');
+  if (args.length === 0) {
+    return { exitCode: 1, stdout: '', stderr: 'Empty or unsafe command after parsing' };
+  }
+  const result = await execa(args[0], args.slice(1), {
     reject: false,
     timeout: 30000,
     maxBuffer: 1024 * 1024,

package/src/modes/client.js

@@ -25,8 +25,9 @@ import { pushTelemetry, requestHostApproval, resolveUID, revokeUID, waitForAppro
 import { calculateChecksum } from '../lib/checksum.js';
 import { promptLocalPath, promptRemotePath } from '../lib/path-browser.js';
 import { buildSshArgs, extractHostname, formatScpRemotePath, getKnownHostsOptions, getSshControlOptions, quoteRemoteShell } from '../lib/ssh.js';
-import { TMUX_SESSION_NAME, tmuxSocketCommand } from '../lib/tmux.js';
+import { buildTmuxSessionName, TMUX_SOCKET_PATH } from '../lib/tmux.js';
 import open from 'open';
+import { secureSensitiveUrl } from '../lib/secure-print.js';
 import { cleanupSessionLog, initSessionLog, logSessionEvent, recordEvent } from '../lib/session-log.js';
 
 let BROKER_URL = process.env.BROKER_URL || 'https://ipingyou.onrender.com';
@@ -88,9 +89,14 @@ async function connectSSH(username, hostname, privateKeyPath, persistKnownHosts
     ], { persistKnownHosts });
 
     sshArgs.push(`${username}@${hostname}`);
-    const tmuxPrepare = `${tmuxSocketCommand()} has-session -t ${TMUX_SESSION_NAME} 2>/dev/null || ${tmuxSocketCommand()} new-session -d -s ${TMUX_SESSION_NAME}`;
-    const tmuxAttach = `${tmuxSocketCommand()} attach -t ${TMUX_SESSION_NAME}`;
-    sshArgs.push('-t', `${tmuxPrepare} && ${tmuxAttach} || exec $SHELL -l`);
+    const tmuxSession = buildTmuxSessionName(username);
+    const quotedSocket = quoteRemoteShell(TMUX_SOCKET_PATH);
+    const quotedSession = quoteRemoteShell(tmuxSession);
+    const tmuxSocketCmdStr = `tmux -S ${quotedSocket}`;
+    const tmuxPrepare = `${tmuxSocketCmdStr} has-session -t ${quotedSession} 2>/dev/null || ${tmuxSocketCmdStr} new-session -d -s ${quotedSession}`;
+    const tmuxAttach = `${tmuxSocketCmdStr} attach -t ${quotedSession}`;
+    const tmuxCommand = `if command -v tmux >/dev/null 2>&1; then (${tmuxPrepare} && ${tmuxAttach}) || exec $SHELL -l; else exec $SHELL -l; fi`;
+    sshArgs.push('-t', tmuxCommand);
 
     const child = execa('ssh', sshArgs, {
       stdio: 'inherit',
@@ -700,7 +706,7 @@ async function handleClientChat(uid, password, cachedChatUrl) {
       const fullUrl = `${chatUrl}#${password}`;
       await open(fullUrl);
     } catch {
-      console.log(chalk.cyan(`  👉 Please open: ${chatUrl}#${password}`));
+      console.log(chalk.cyan(`  👉 Please open: ${secureSensitiveUrl(chatUrl, password)}`));
     }
   } else {
     spinner.warn('The host has not started a chat room yet.');

package/src/modes/doctor.js

@@ -2,7 +2,7 @@
  * Doctor Mode — non-invasive diagnostics for iPingYou.
  */
 
-import { execa, execaCommand } from 'execa';
+import { execa } from 'execa';
 import chalk from 'chalk';
 import fs from 'node:fs';
 import os from 'node:os';
@@ -66,7 +66,7 @@ async function commandFound(command) {
 async function checkSshService() {
   const osInfo = detectOS();
   if (osInfo.isMac) {
-    const launchctl = await execaCommand('launchctl print-disabled system', { reject: false, timeout: 5000 });
+    const launchctl = await execa('launchctl', ['print-disabled', 'system'], { reject: false, timeout: 5000 });
     const launchctlOutput = `${launchctl.stdout || ''}\n${launchctl.stderr || ''}`.toLowerCase();
     const launchctlMatch = launchctlOutput.match(/"com\.openssh\.sshd"\s*=>\s*(enabled|disabled)/);
     if (launchctlMatch) {
@@ -78,7 +78,7 @@ async function checkSshService() {
       };
     }
 
-    const result = await execaCommand('systemsetup -getremotelogin', { reject: false, timeout: 5000 });
+    const result = await execa('systemsetup', ['-getremotelogin'], { reject: false, timeout: 5000 });
     const output = result.stdout || result.stderr || '';
     if (/on/i.test(output)) return { status: 'pass', detail: 'Remote Login is on' };
     if (/off/i.test(output)) {
@@ -96,8 +96,8 @@ async function checkSshService() {
   }
 
   if (osInfo.isLinux) {
-    const ssh = await execaCommand('systemctl is-active ssh', { reject: false, timeout: 5000 });
-    const sshd = ssh.exitCode === 0 ? ssh : await execaCommand('systemctl is-active sshd', { reject: false, timeout: 5000 });
+    const ssh = await execa('systemctl', ['is-active', 'ssh'], { reject: false, timeout: 5000 });
+    const sshd = ssh.exitCode === 0 ? ssh : await execa('systemctl', ['is-active', 'sshd'], { reject: false, timeout: 5000 });
     if (sshd.exitCode === 0) return { status: 'pass', detail: 'SSH service is active' };
     return {
       status: 'warn',
@@ -107,7 +107,7 @@ async function checkSshService() {
   }
 
   if (osInfo.isWindows) {
-    const result = await execaCommand('sc query sshd', { reject: false, timeout: 5000 });
+    const result = await execa('sc', ['query', 'sshd'], { reject: false, timeout: 5000 });
     if (/RUNNING/i.test(result.stdout)) return { status: 'pass', detail: 'OpenSSH Server is running' };
     return {
       status: 'warn',
@@ -196,7 +196,11 @@ function checkAiSafety() {
 }
 
 async function runProjectSelfTest(label, command) {
-  const result = await execaCommand(command, {
+  // Prefer splitting simple commands into args to avoid shell interpolation
+  const parts = String(command).split(' ').filter(Boolean);
+  const cmd = parts.shift();
+  const args = parts;
+  const result = await execa(cmd, args, {
     reject: false,
     timeout: 30000,
     maxBuffer: 1024 * 1024,

package/src/modes/host.js

@@ -13,7 +13,7 @@
  * ============================================================
  */
 
-import { execa, execaCommand } from 'execa';
+import { execa } from 'execa';
 import chalk from 'chalk';
 import inquirer from 'inquirer';
 import path from 'node:path';
@@ -26,10 +26,11 @@ import { cleanupAll, killProcessTree, trackPID, untrackPID, setRevokeOnExit, add
 import { detectOS } from '../lib/platform.js';
 import { createSpinner, networkSpinner, typeText } from '../lib/animations.js';
 import { startChatServer, openLocalChatUI } from '../lib/chat.js';
+import { secureSensitive } from '../lib/secure-print.js';
 import { spawnTunnelSupervised } from '../lib/tunnel.js';
 import { decideApprovalRequest, fetchApprovalRequests, pingBroker, registerWithBroker, revokeUID } from '../lib/broker.js';
 import { cleanupSessionLog, getSessionLogPath, initSessionLog, logSessionEvent, recordEvent } from '../lib/session-log.js';
-import { TMUX_SESSION_NAME, tmuxSocketArgs } from '../lib/tmux.js';
+import { TMUX_SESSION_NAME, TMUX_SESSION_PREFIX, tmuxSocketArgs } from '../lib/tmux.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 let BROKER_URL = process.env.BROKER_URL || 'https://ipingyou.onrender.com';
@@ -55,24 +56,24 @@ async function ensureSSHRunning() {
   try {
     if (osInfo.isLinux) {
       try {
-        await execaCommand('systemctl is-active ssh', { reject: true });
+        await execa('systemctl', ['is-active', 'ssh'], { reject: true });
         spinner.succeed('SSH service is active');
       } catch {
         spinner.text = 'Starting SSH service...';
         try {
-          await execaCommand('sudo systemctl start ssh', { stdio: 'inherit' });
+          await execa('sudo', ['systemctl', 'start', 'ssh'], { stdio: 'inherit' });
           spinner.succeed('SSH service started');
         } catch {
-          await execaCommand('sudo systemctl start sshd', { stdio: 'inherit' });
+          await execa('sudo', ['systemctl', 'start', 'sshd'], { stdio: 'inherit' });
           spinner.succeed('SSH service started (sshd)');
         }
       }
     } else if (osInfo.isMac) {
       try {
-        const { stdout } = await execaCommand('sudo systemsetup -getremotelogin', { reject: false });
+        const { stdout } = await execa('sudo', ['systemsetup', '-getremotelogin'], { reject: false });
         if (stdout.toLowerCase().includes('off')) {
           spinner.text = 'Enabling Remote Login...';
-          await execaCommand('sudo systemsetup -setremotelogin on', { stdio: 'inherit' });
+          await execa('sudo', ['systemsetup', '-setremotelogin', 'on'], { stdio: 'inherit' });
           spinner.succeed('Remote Login enabled');
         } else {
           spinner.succeed('SSH (Remote Login) is active');
@@ -82,10 +83,10 @@ async function ensureSSHRunning() {
       }
     } else if (osInfo.isWindows) {
       try {
-        const { stdout } = await execaCommand('sc query sshd', { reject: false });
+        const { stdout } = await execa('sc', ['query', 'sshd'], { reject: false });
         if (stdout.includes('STOPPED')) {
           spinner.text = 'Starting OpenSSH Server...';
-          await execaCommand('net start sshd', { stdio: 'inherit' });
+          await execa('net', ['start', 'sshd'], { stdio: 'inherit' });
           spinner.succeed('OpenSSH Server started');
         } else if (stdout.includes('RUNNING')) {
           spinner.succeed('OpenSSH Server is running');
@@ -112,28 +113,29 @@ async function ensureTmuxInstalled() {
   const spinner = createSpinner('Checking tmux installation...', networkSpinner).start();
   try {
     try {
-      await execaCommand('tmux -V', { reject: true });
+      await execa('tmux', ['-V'], { reject: true });
       spinner.succeed('tmux is installed (Terminal Mirroring available)');
     } catch {
       spinner.text = 'tmux not found. Attempting to install...';
       if (osInfo.isLinux) {
         if (fs.existsSync('/usr/bin/apt') || fs.existsSync('/usr/bin/apt-get')) {
-          await execaCommand('sudo apt-get update && sudo apt-get install -y tmux', { shell: true, stdio: 'inherit' });
+          await execa('sudo', ['apt-get', 'update', '-qq'], { stdio: 'inherit' });
+          await execa('sudo', ['apt-get', 'install', '-y', 'tmux'], { stdio: 'inherit' });
         } else if (fs.existsSync('/usr/bin/dnf')) {
-          await execaCommand('sudo dnf install -y tmux', { shell: true, stdio: 'inherit' });
+          await execa('sudo', ['dnf', 'install', '-y', 'tmux'], { stdio: 'inherit' });
         } else if (fs.existsSync('/usr/bin/yum')) {
-          await execaCommand('sudo yum install -y tmux', { shell: true, stdio: 'inherit' });
+          await execa('sudo', ['yum', 'install', '-y', 'tmux'], { stdio: 'inherit' });
         } else if (fs.existsSync('/usr/bin/pacman')) {
-          await execaCommand('sudo pacman -S --noconfirm tmux', { shell: true, stdio: 'inherit' });
+          await execa('sudo', ['pacman', '-S', '--noconfirm', 'tmux'], { stdio: 'inherit' });
         } else if (fs.existsSync('/sbin/apk')) {
-          await execaCommand('sudo apk add tmux', { shell: true, stdio: 'inherit' });
+          await execa('sudo', ['apk', 'add', 'tmux'], { stdio: 'inherit' });
         } else {
           throw new Error('Unsupported Linux package manager');
         }
         spinner.succeed('tmux installed successfully (Terminal Mirroring available)');
       } else if (osInfo.isMac) {
         try {
-          await execaCommand('brew install tmux', { shell: true, stdio: 'inherit' });
+          await execa('brew', ['install', 'tmux'], { stdio: 'inherit' });
           spinner.succeed('tmux installed successfully (Terminal Mirroring available)');
         } catch {
           throw new Error('Homebrew is required to install tmux on macOS');
@@ -146,6 +148,37 @@ async function ensureTmuxInstalled() {
   }
 }
 
+function isSecureLinkSession(name) {
+  return name === TMUX_SESSION_NAME || name.startsWith(TMUX_SESSION_PREFIX);
+}
+
+async function listTmuxSessions(socketArgs = []) {
+  const result = await execa('tmux', [...socketArgs, 'list-sessions', '-F', '#{session_name}|#{session_created}'], { reject: false });
+  if (result.exitCode !== 0) return [];
+  return result.stdout
+    .split(/\r?\n/)
+    .filter(Boolean)
+    .map(line => {
+      const [name, createdAt] = line.split('|');
+      return { name, createdAt: Number(createdAt) || null };
+    });
+}
+
+async function getMirrorableSessions() {
+  const sessions = [];
+  const customSessions = await listTmuxSessions(tmuxSocketArgs());
+  customSessions
+    .filter(s => isSecureLinkSession(s.name))
+    .forEach(s => sessions.push({ ...s, socketArgs: tmuxSocketArgs(), source: 'custom' }));
+
+  const legacySessions = await listTmuxSessions();
+  legacySessions
+    .filter(s => isSecureLinkSession(s.name))
+    .forEach(s => sessions.push({ ...s, socketArgs: [], source: 'legacy' }));
+
+  return sessions;
+}
+
 // ─── Ephemeral SSH Key Management ────────────────────────────
 async function generateEphemeralKey() {
   const tmpDir = os.tmpdir() || process.env.TMPDIR || process.env.TEMP || process.env.TMP;
@@ -643,7 +676,7 @@ async function hostDashboard(uid, password, serviceConfig, tunnelProcess, sessio
     console.log(chalk.bold('  ║         🛡️  SecureLink — HOST MODE ACTIVE          ║'));
     console.log(chalk.bold('  ╠════════════════════════════════════════════════════╣'));
     console.log(`  ║  ${chalk.cyan('UID:')}        ${chalk.bold.white(uid.padEnd(30))}║`);
-    console.log(`  ║  ${chalk.cyan('Password:')}   ${chalk.bold.white(password.padEnd(30))}║`);
+    console.log(`  ║  ${chalk.cyan('Password:')}   ${chalk.bold.white(secureSensitive(password).padEnd(30))}║`);
     console.log(`  ║  ${chalk.cyan('Service:')}    ${chalk.dim(serviceConfig.type.toUpperCase() + ' (Port ' + serviceConfig.port + ')').padEnd(30)}║`);
     console.log(`  ║  ${chalk.cyan('Tunnel:')}     ${chalk.dim(sessionState.tunnelUrl.substring(0, 40))}  ║`);
     if (serviceConfig.chatUrl) {
@@ -810,17 +843,33 @@ async function hostDashboard(uid, password, serviceConfig, tunnelProcess, sessio
           console.log('');
 
           try {
-            await execaCommand('tmux -V', { reject: true });
-            const sessionCheck = await execa('tmux', [...tmuxSocketArgs(), 'has-session', '-t', TMUX_SESSION_NAME], { reject: false });
-            if (sessionCheck.exitCode !== 0) {
+            await execa('tmux', ['-V'], { reject: true });
+            const sessions = await getMirrorableSessions();
+            if (sessions.length === 0) {
               console.log(chalk.yellow('  ⚠️  No mirrored terminal session is active yet.'));
               console.log(chalk.dim('     A client must choose "Connect via SSH" first. SCP-only clients do not create a tmux session.'));
               console.log(chalk.dim('     tmux is needed on the host machine only; the client does not need tmux.'));
               logSessionEvent('host_mirror_missing_session', {}, 'warn');
               return waitForAction();
             }
-            await execa('tmux', [...tmuxSocketArgs(), 'attach', '-t', TMUX_SESSION_NAME, '-r'], { stdio: 'inherit', reject: false });
-            logSessionEvent('host_mirror_attached');
+
+            let target = sessions[0];
+            if (sessions.length > 1) {
+              const { sessionChoice } = await inquirer.prompt([{
+                type: 'list',
+                name: 'sessionChoice',
+                message: 'Select an active client session to mirror:',
+                choices: sessions.map((s, idx) => {
+                  const created = s.createdAt ? new Date(s.createdAt * 1000).toLocaleTimeString() : 'Unknown';
+                  const label = `${s.name} ${chalk.dim(`(started ${created})`)}`;
+                  return { name: label, value: String(idx) };
+                }),
+              }]);
+              target = sessions[parseInt(sessionChoice, 10)] || sessions[0];
+            }
+
+            await execa('tmux', [...target.socketArgs, 'attach', '-t', target.name, '-r'], { stdio: 'inherit', reject: false });
+            logSessionEvent('host_mirror_attached', { session: target.name, source: target.source });
           } catch (err) {
             console.log(chalk.yellow('  ⚠️  Could not attach to tmux.'));
             console.log(chalk.dim(`     ${err.message}`));
@@ -881,10 +930,16 @@ async function hostDashboard(uid, password, serviceConfig, tunnelProcess, sessio
           const spinner = createSpinner('Terminating active SSH sessions...', networkSpinner).start();
           try {
             if (process.platform === 'win32') {
-              await execaCommand('powershell -NoProfile -Command "Get-CimInstance Win32_Process -Filter \\"name = \'sshd.exe\'\\" | Where-Object { $_.CommandLine -match \'sshd:.*@\' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force }"', { reject: false });
+              await execa('powershell', ['-NoProfile', '-Command', "Get-CimInstance Win32_Process -Filter \"name = 'sshd.exe'\" | Where-Object { $_.CommandLine -match 'sshd:.*@' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force }"], { reject: false });
             } else {
-              await execaCommand("pkill -f 'sshd:.*@'", { shell: true, reject: false });
-              await execa('tmux', [...tmuxSocketArgs(), 'kill-session', '-t', TMUX_SESSION_NAME], { reject: false });
+              await execa('pkill', ['-f', 'sshd:.*@'], { reject: false });
+              await execa('tmux', [...tmuxSocketArgs(), 'kill-server'], { reject: false });
+              const legacySessions = await listTmuxSessions();
+              for (const session of legacySessions) {
+                if (isSecureLinkSession(session.name)) {
+                  await execa('tmux', ['kill-session', '-t', session.name], { reject: false });
+                }
+              }
             }
             spinner.succeed('All client SSH sessions terminated');
             logSessionEvent('host_sessions_terminated');
@@ -941,7 +996,7 @@ export async function startHostMode() {
     },
   ]);
   const password = pwdInput.trim() || generateUID();
-  console.log(`  ${chalk.green('✓')} Password: ${chalk.bold.white(password)}`);
+  console.log(`  ${chalk.green('✓')} Password: ${chalk.bold.white(secureSensitive(password))}`);
   console.log('');
 
   // ─── Broker Selection ───