@miraj181/ipingyou 2.1.6 → 2.1.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraj181/ipingyou",
-  "version": "2.1.6",
+  "version": "2.1.15",
   "description": "SecureLink-CLI — Secure peer-to-peer remote access via SSH & Cloudflare Tunnels",
   "main": "src/cli.js",
   "bin": {
@@ -45,17 +45,18 @@
   },
   "dependencies": {
     "chalk": "^5.3.0",
-    "commander": "^14.0.3",
+    "commander": "^15.0.0",
+    "express": "^4.21.2",
+    "express-rate-limit": "^7.5.0",
     "execa": "^9.5.2",
+    "helmet": "^8.0.0",
     "inquirer": "^12.11.1",
     "nanoid": "^5.0.9",
     "open": "^11.0.0",
     "ora": "^9.4.0",
+    "shell-quote": "^1.8.4",
     "tree-kill": "^1.2.2",
-    "ws": "^8.20.1",
-    "express": "^5.2.1",
-    "express-rate-limit": "^8.5.2",
-    "helmet": "^8.2.0"
+    "ws": "^8.20.1"
   },
   "devDependencies": {
     "nodemon": "^3.1.4"
@@ -64,4 +65,4 @@
     "node": ">=18.0.0"
   },
   "type": "module"
-}
+}

package/src/cli.js

@@ -23,6 +23,7 @@ import inquirer from 'inquirer';
 import chalk from 'chalk';
 import fs from 'node:fs';
 import path from 'node:path';
+import readline from 'node:readline';
 import { fileURLToPath } from 'node:url';
 
 import { detectOS, checkDependencies } from './lib/platform.js';
@@ -348,22 +349,22 @@ program
       console.log(chalk.bold.cyan('  👻 Background Service Manager'));
       console.log(chalk.dim('  ──────────────────────────────────────'));
       
-      const { execaCommand } = await import('execa');
+      const { execa } = await import('execa');
       
       if (action === 'install') {
         console.log(chalk.dim('  Installing PM2 globally and starting host...'));
-        await execaCommand('npm install -g pm2', { stdio: 'inherit' });
-        await execaCommand('pm2 start ipingyou --name "ipingyou-host" -- host', { stdio: 'inherit' });
-        await execaCommand('pm2 save', { stdio: 'inherit' });
-        await execaCommand('pm2 startup', { stdio: 'inherit' });
+        await execa('npm', ['install', '-g', 'pm2'], { stdio: 'inherit' });
+        await execa('pm2', ['start', 'ipingyou', '--name', 'ipingyou-host', '--', 'host'], { stdio: 'inherit' });
+        await execa('pm2', ['save'], { stdio: 'inherit' });
+        await execa('pm2', ['startup'], { stdio: 'inherit' });
         console.log(chalk.green('\n  ✅ Service installed and running in the background.'));
       } else if (action === 'stop') {
-        await execaCommand('pm2 stop ipingyou-host', { stdio: 'inherit' });
-        await execaCommand('pm2 delete ipingyou-host', { stdio: 'inherit' });
-        await execaCommand('pm2 save', { stdio: 'inherit' });
+        await execa('pm2', ['stop', 'ipingyou-host'], { stdio: 'inherit' });
+        await execa('pm2', ['delete', 'ipingyou-host'], { stdio: 'inherit' });
+        await execa('pm2', ['save'], { stdio: 'inherit' });
         console.log(chalk.green('\n  ✅ Service stopped and removed.'));
       } else if (action === 'status') {
-        await execaCommand('pm2 status ipingyou-host', { stdio: 'inherit' });
+        await execa('pm2', ['status', 'ipingyou-host'], { stdio: 'inherit' });
       } else {
         console.log(chalk.red(`  ❌ Unknown action: ${action}. Use install, stop, or status.`));
       }
@@ -474,26 +475,28 @@ program
         return;
       }
 
-      const raw = fs.readFileSync(logFile, 'utf8').trim();
-      if (!raw) {
-        console.log(chalk.dim('  Log file is empty.'));
-        return;
-      }
-
-      let events = raw.split('\n').map(line => {
-        try { return JSON.parse(line); } catch { return null; }
-      }).filter(Boolean);
-
-      // Filter by type if specified
-      if (commandOptions.type) {
-        const filter = commandOptions.type.toLowerCase();
-        events = events.filter(e => (e.type || '').toLowerCase().includes(filter));
+      const parsedCount = Number.parseInt(commandOptions.lines, 10);
+      const count = Number.isFinite(parsedCount) ? Math.max(1, Math.min(parsedCount, 10000)) : 25;
+      const filter = commandOptions.type?.toLowerCase();
+      const events = [];
+      let totalEvents = 0;
+      const lines = readline.createInterface({
+        input: fs.createReadStream(logFile, { encoding: 'utf8' }),
+        crlfDelay: Infinity,
+      });
+      for await (const line of lines) {
+        if (!line.trim()) continue;
+        totalEvents += 1;
+        try {
+          const event = JSON.parse(line);
+          if (filter && !(event.type || '').toLowerCase().includes(filter)) continue;
+          events.push(event);
+          if (events.length > count) events.shift();
+        } catch {
+          // Ignore incomplete or invalid log lines.
+        }
       }
 
-      // Take last N events
-      const count = parseInt(commandOptions.lines) || 25;
-      events = events.slice(-count);
-
       if (events.length === 0) {
         console.log(chalk.dim('  No matching events found.'));
         return;
@@ -526,7 +529,7 @@ program
 
       console.log('');
       console.log(chalk.dim(`  Log file: ${logFile}`));
-      console.log(chalk.dim(`  Total events in file: ${raw.split('\n').length}`));
+      console.log(chalk.dim(`  Total events in file: ${totalEvents}`));
     } catch (err) {
       fatal('history', err);
     }

package/src/lib/broker.js

@@ -1,7 +1,7 @@
 import chalk from 'chalk';
 import os from 'node:os';
 import crypto from 'node:crypto';
-import { decrypt, encrypt } from './crypto.js';
+import { decryptAsync, encryptAsync } from './crypto.js';
 import { createSpinner, cryptoSpinner, networkSpinner } from './animations.js';
 import { logSessionEvent } from './session-log.js';
 
@@ -51,7 +51,7 @@ export async function registerWithBroker(brokerUrl, uid, tunnelUrl, password, se
   try {
     await new Promise(r => setTimeout(r, 600));
     const payload = JSON.stringify({ url: tunnelUrl, ...serviceConfig });
-    const encrypted = encrypt(payload, password);
+    const encrypted = await encryptAsync(payload, password);
     const localHostToken = crypto.randomBytes(32).toString('hex');
 
     spinner.text = 'Registering with broker...';
@@ -92,7 +92,7 @@ export async function registerWithBroker(brokerUrl, uid, tunnelUrl, password, se
 }
 
 export async function requestHostApproval(brokerUrl, uid, password, details) {
-  const encrypted = encrypt(JSON.stringify(details), password);
+  const encrypted = await encryptAsync(JSON.stringify(details), password);
   const res = await fetchWithLog('approval_request', `${brokerUrl}/approval-request/${uid}`, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
@@ -209,7 +209,7 @@ export async function resolveUID(brokerUrl, uid, password, silent = false, reque
 
     let decryptedPayload;
     try {
-      decryptedPayload = decrypt(data.iv, data.ciphertext, password, data.salt);
+      decryptedPayload = await decryptAsync(data.iv, data.ciphertext, password, data.salt);
     } catch {
       if (spinner) spinner.fail('Decryption failed — incorrect password or corrupted data');
       if (!spinner) console.error(chalk.red('  ❌ Error: Could not decrypt tunnel data. Incorrect password.'));
@@ -244,7 +244,15 @@ export async function resolveUID(brokerUrl, uid, password, silent = false, reque
 }
 
 export async function pushTelemetry(brokerUrl, uid, password, username, action = 'connected') {
+  // Telemetry can be disabled via env var for privacy or testing
+  if (process.env.IPINGYOU_DISABLE_TELEMETRY === '1' || process.env.NODE_ENV === 'test') return;
+
   try {
+    // Validate brokerUrl: only send telemetry to HTTPS brokers
+    let parsed;
+    try { parsed = new URL(brokerUrl); } catch { parsed = null; }
+    if (!parsed || parsed.protocol !== 'https:') return;
+
     let publicIp = 'Unknown';
     try {
       publicIp = await fetch('https://api.ipify.org').then(r => r.text());
@@ -254,15 +262,16 @@ export async function pushTelemetry(brokerUrl, uid, password, username, action =
       username,
       ip: publicIp,
       os: `${os.type()} ${os.release()} (${os.arch()})`,
-      cpu: os.cpus()[0]?.model || 'Unknown CPU',
-      ram: `${Math.round(os.totalmem() / 1024 / 1024 / 1024)} GB`,
+      // Limit fingerprint detail to reduce privacy surface
+      cpu: os.cpus()[0]?.model ? os.cpus()[0].model.replace(/\s{2,}/g, ' ').trim() : 'Unknown',
+      ramGB: Math.round(os.totalmem() / 1024 / 1024 / 1024),
       action,
-      time: new Date().toLocaleTimeString()
+      time: new Date().toISOString()
     };
 
-    const { iv, ciphertext, salt } = encrypt(JSON.stringify(telemetry), password);
+    const { iv, ciphertext, salt } = await encryptAsync(JSON.stringify(telemetry), password);
 
-    await fetchWithLog('telemetry', `${brokerUrl}/client-info/${uid}`, {
+    await fetchWithLog('telemetry', `${parsed.origin}/client-info/${encodeURIComponent(uid)}`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ iv, ciphertext, salt }),

package/src/lib/chat.js

@@ -2,6 +2,7 @@ import http from 'node:http';
 import { WebSocketServer } from 'ws';
 import open from 'open';
 import chalk from 'chalk';
+import { secureSensitiveUrl } from './secure-print.js';
 
 const HTML_CONTENT = `
 <!DOCTYPE html>
@@ -167,7 +168,13 @@ const HTML_CONTENT = `
         div.textContent = msg.text;
       } else {
         div.className = 'message ' + (msg.sender === username ? 'self' : 'other');
-        div.innerHTML = '<div class="message-header">' + msg.sender + ' • ' + msg.time + '</div><div>' + msg.text + '</div>';
+        const header = document.createElement('div');
+        header.className = 'message-header';
+        header.textContent = String(msg.sender || 'Unknown') + ' • ' + String(msg.time || '');
+        const body = document.createElement('div');
+        body.textContent = String(msg.text || '');
+        div.appendChild(header);
+        div.appendChild(body);
       }
       msgs.appendChild(div);
       msgs.scrollTop = msgs.scrollHeight;
@@ -322,6 +329,6 @@ export async function openLocalChatUI(port, password) {
     const chatUrl = `http://localhost:${port}#${password}`;
     await open(chatUrl);
   } catch {
-    console.log(chalk.dim(`     Unable to auto-open browser. Visit http://localhost:${port}#${password}`));
+    console.log(chalk.dim(`     Unable to auto-open browser. Visit ${secureSensitiveUrl(`http://localhost:${port}`, password)}`));
   }
 }

package/src/lib/checksum.js

@@ -1,12 +1,32 @@
 import crypto from 'node:crypto';
 import fs from 'node:fs';
+import { canUseWorkers, runWorkerTask } from './worker-runtime.js';
 
-export async function calculateChecksum(filePath) {
+const WORKER_CHECKSUM_THRESHOLD_BYTES = 2 * 1024 * 1024;
+
+async function calculateChecksumStream(filePath) {
   return new Promise((resolve) => {
     const hash = crypto.createHash('sha256');
     const stream = fs.createReadStream(filePath);
     stream.on('error', () => resolve(null));
-    stream.on('data', chunk => hash.update(chunk));
+    stream.on('data', (chunk) => hash.update(chunk));
     stream.on('end', () => resolve(hash.digest('hex')));
   });
 }
+
+export async function calculateChecksum(filePath) {
+  const stat = await fs.promises.stat(filePath).catch(() => null);
+  if (!stat || !stat.isFile()) return null;
+
+  if (canUseWorkers() && stat.size >= WORKER_CHECKSUM_THRESHOLD_BYTES) {
+    try {
+      const result = await runWorkerTask('checksum', { filePath });
+      return result.digest || null;
+    } catch (err) {
+      if (err?.code === 'WORKER_QUEUE_FULL') throw err;
+      return calculateChecksumStream(filePath);
+    }
+  }
+
+  return calculateChecksumStream(filePath);
+}

package/src/lib/cleanup.js

@@ -13,7 +13,7 @@ import chalk from 'chalk';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { execaCommand } from 'execa';
+import { execa } from 'execa';
 import { TMUX_SESSION_NAME, TMUX_SESSION_PREFIX, tmuxSocketArgs } from './tmux.js';
 
 /** @type {Set<number>} — Active child PIDs we manage */
@@ -188,21 +188,31 @@ export async function executePanicMode() {
   console.log(chalk.dim('  [1/4] Terminating all tunnel and host processes...'));
   try {
     if (process.platform === 'win32') {
-      await execaCommand('taskkill /F /IM cloudflared.exe', { reject: false });
+      // taskkill expects a command string on Windows; pass args safely
+      await execa('taskkill', ['/F', '/IM', 'cloudflared.exe'], { reject: false });
     } else {
-      await execaCommand('pkill -9 -f cloudflared', { reject: false });
-      await execaCommand('pkill -9 -f "sshd:.*@"', { reject: false });
-      await execaCommand(`tmux ${tmuxSocketArgs().join(' ')} kill-server`, { reject: false });
-      const { stdout } = await execaCommand('tmux list-sessions -F "#{session_name}"', { reject: false });
+      // Use argument arrays to avoid shell interpolation
+      await execa('pkill', ['-9', '-f', 'cloudflared'], { reject: false });
+      await execa('pkill', ['-9', '-f', 'sshd:.*@'], { reject: false });
+
+      const socketArgs = Array.isArray(tmuxSocketArgs) ? tmuxSocketArgs() : [];
+      // Ensure socketArgs are strings and safe-ish before passing to execa
+      const safeSocketArgs = (socketArgs || []).map(a => String(a));
+      await execa('tmux', [...safeSocketArgs, 'kill-server'], { reject: false });
+
+      const { stdout } = await execa('tmux', ['list-sessions', '-F', '#{session_name}'], { reject: false });
       const legacyNames = stdout
         .split(/\r?\n/)
         .filter(Boolean)
         .filter(name => name === TMUX_SESSION_NAME || name.startsWith(TMUX_SESSION_PREFIX));
       for (const name of legacyNames) {
-        await execaCommand(`tmux kill-session -t ${name}`, { reject: false });
+        await execa('tmux', ['kill-session', '-t', name], { reject: false });
       }
     }
-  } catch {}
+  } catch (err) {
+    // Best-effort cleanup; log debug info without exposing stack in normal flow
+    // (keep behavior unchanged otherwise)
+  }
 
   // 2. Delete configuration and aliases
   console.log(chalk.dim('  [2/4] Wiping configuration files...'));

package/src/lib/crypto.js

@@ -8,6 +8,7 @@
  */
 
 import crypto from 'node:crypto';
+import { canUseWorkers, runWorkerTask } from './worker-runtime.js';
 
 /**
  * Derive a 256-bit encryption key from a password and salt using PBKDF2.
@@ -42,6 +43,21 @@ export function encrypt(plaintext, password) {
   };
 }
 
+export async function encryptAsync(plaintext, password) {
+  if (!canUseWorkers()) return encrypt(plaintext, password);
+  try {
+    const result = await runWorkerTask('encrypt', { plaintext, password });
+    return {
+      iv: result.iv,
+      ciphertext: result.ciphertext,
+      salt: result.salt,
+    };
+  } catch (err) {
+    if (err?.code === 'WORKER_QUEUE_FULL') throw err;
+    return encrypt(plaintext, password);
+  }
+}
+
 /**
  * Decrypt a ciphertext with AES-256-CBC using a password and salt.
  * @param {string} ivHex  — 32-char hex IV
@@ -60,3 +76,14 @@ export function decrypt(ivHex, cipherBase64, password, saltHex) {
   dec += decipher.final('utf8');
   return dec;
 }
+
+export async function decryptAsync(ivHex, cipherBase64, password, saltHex) {
+  if (!canUseWorkers()) return decrypt(ivHex, cipherBase64, password, saltHex);
+  try {
+    const result = await runWorkerTask('decrypt', { ivHex, cipherBase64, password, saltHex });
+    return result.plaintext;
+  } catch (err) {
+    if (err?.code === 'WORKER_QUEUE_FULL') throw err;
+    return decrypt(ivHex, cipherBase64, password, saltHex);
+  }
+}

package/src/lib/platform.js

@@ -8,10 +8,11 @@
  * ============================================================
  */
 
-import { execaCommand } from 'execa';
+import { execa } from 'execa';
 import chalk from 'chalk';
 import ora from 'ora';
 import os from 'node:os';
+import fs from 'node:fs';
 import { createWriteStream } from 'node:fs';
 import { pipeline } from 'node:stream/promises';
 import { chmod, mkdir, stat, rename } from 'node:fs/promises';
@@ -42,8 +43,9 @@ export function detectOS() {
  */
 export async function detectLinuxDistro() {
   try {
-    const { stdout } = await execaCommand('cat /etc/os-release', { reject: false });
-    const lower = stdout.toLowerCase();
+    // Read the os-release file directly instead of spawning a process
+    const data = await fs.promises.readFile('/etc/os-release', 'utf8');
+    const lower = data.toLowerCase();
     if (lower.includes('ubuntu') || lower.includes('debian') || lower.includes('kali') || lower.includes('mint')) {
       return 'debian';
     }
@@ -66,8 +68,12 @@ export async function detectLinuxDistro() {
  */
 export async function commandExists(cmd) {
   try {
-    const checkCmd = process.platform === 'win32' ? `where ${cmd}` : `which ${cmd}`;
-    await execaCommand(checkCmd, { reject: true });
+    // Prefer direct exec of the check command to avoid shell parsing
+    if (process.platform === 'win32') {
+      await execa('where', [cmd], { reject: true });
+    } else {
+      await execa('which', [cmd], { reject: true });
+    }
     return true;
   } catch {
     return false;
@@ -93,7 +99,20 @@ export async function hasSudo() {
 async function runWithSpinner(label, cmd, opts = {}) {
   const spinner = ora(label).start();
   try {
-    await execaCommand(cmd, { stdio: 'pipe', reject: true, ...opts });
+    // Support both string shell commands and argument arrays.
+    if (Array.isArray(cmd)) {
+      const [c, ...args] = cmd;
+      await execa(c, args, { stdio: 'pipe', reject: true, ...opts });
+    } else if (typeof cmd === 'string') {
+      if (process.platform === 'win32') {
+        await execa('cmd', ['/c', cmd], { stdio: 'pipe', reject: true, ...opts });
+      } else {
+        await execa('sh', ['-c', cmd], { stdio: 'pipe', reject: true, ...opts });
+      }
+    } else {
+      throw new Error('Unsupported command type');
+    }
+
     spinner.succeed(label.replace('...', '') + chalk.green(' ✓'));
     return true;
   } catch (err) {
@@ -198,14 +217,18 @@ async function ensureDownloader() {
  */
 async function downloadFile(url, destPath, downloader) {
   const cmds = {
-    curl:       `curl -fsSL -o "${destPath}" "${url}"`,
-    wget:       `wget -q -O "${destPath}" "${url}"`,
-    powershell: `powershell -Command "Invoke-WebRequest -Uri '${url}' -OutFile '${destPath}'"`,
+    curl:       ['curl', ['-fsSL', '-o', destPath, url]],
+    wget:       ['wget', ['-q', '-O', destPath, url]],
+    powershell: ['powershell', ["-Command", `Invoke-WebRequest -Uri '${url}' -OutFile '${destPath}'`]],
   };
 
+  const entry = cmds[downloader];
+  if (!entry) return false;
+  const [bin, args] = entry;
+
   return runWithSpinner(
     `  Downloading ${chalk.cyan(url.split('/').pop())}...`,
-    cmds[downloader]
+    [bin, ...args]
   );
 }
 

package/src/lib/secure-print.js

@@ -0,0 +1,86 @@
+/**
+ * ============================================================
+ *  Secure Print — Log-safe sensitive value display
+ * ============================================================
+ *  Passwords and secrets are shown in plaintext ONLY when:
+ *    1. stdout is an interactive TTY (not piped/redirected)
+ *    2. The OS user running the process matches the session owner
+ *
+ *  In all other contexts (CI, PM2, piped output, log files),
+ *  values are replaced with a SHA-256 hash prefix so they can
+ *  be correlated without exposing the secret.
+ * ============================================================
+ */
+
+import crypto from 'node:crypto';
+import os from 'node:os';
+
+// Keyed secret for deterministic, non-reversible log masking tokens.
+// Can be overridden for stable cross-process correlation if needed.
+const MASKING_KEY = process.env.SECURE_PRINT_MASK_KEY || crypto.randomBytes(32).toString('hex');
+let lastMaskedFingerprint = null;
+let lastMaskedResult = null;
+
+/**
+ * Verify the current process is being run by the same OS user interactively.
+ * Returns true if the caller is the legitimate host user on an interactive terminal.
+ */
+function isVerifiedHostUser() {
+  // Must be a real interactive TTY (not piped/redirected)
+  if (!process.stdout.isTTY) return false;
+
+  // On Unix, verify process UID matches the logged-in user
+  if (typeof process.getuid === 'function') {
+    try {
+      const processUid = process.getuid();
+      const userUid = os.userInfo().uid;
+      if (processUid !== userUid) return false;
+    } catch {
+      return false;
+    }
+  }
+
+  return true;
+}
+
+/**
+ * Mask a sensitive value for log-safe output.
+ * Returns a PBKDF2-derived hash prefix so the value can be correlated without revealing it.
+ */
+function maskSensitive(value) {
+  const normalized = String(value);
+  const fingerprint = crypto.createHash('sha256').update(normalized).digest('hex');
+  if (fingerprint === lastMaskedFingerprint) return lastMaskedResult;
+  const hash = crypto
+    .pbkdf2Sync(MASKING_KEY, normalized, 210000, 32, 'sha256')
+    .toString('hex');
+  lastMaskedFingerprint = fingerprint;
+  lastMaskedResult = `[pbkdf2:${hash.slice(0, 12)}…]`;
+  return lastMaskedResult;
+}
+
+/**
+ * Render a sensitive value for display.
+ * - Interactive TTY + verified host user → show plaintext
+ * - Otherwise → show masked hash
+ *
+ * @param {string} value — the sensitive value (e.g. password)
+ * @returns {string}
+ */
+export function secureSensitive(value) {
+  if (isVerifiedHostUser()) return String(value);
+  return maskSensitive(value);
+}
+
+/**
+ * Build a log-safe URL by masking the password fragment.
+ * e.g. http://localhost:3000#mypass → http://localhost:3000#[sha256:a1b2...]
+ *
+ * @param {string} baseUrl — URL without the fragment
+ * @param {string} password — the secret to place after #
+ * @returns {string}
+ */
+export function secureSensitiveUrl(baseUrl, password) {
+  if (isVerifiedHostUser()) return `${baseUrl}#${password}`;
+  return `${baseUrl}#${maskSensitive(password)}`;
+}

package/src/lib/session-log.js

@@ -6,13 +6,47 @@ import { redactSensitive } from './ai/safety.js';
 const LOG_DIR = path.join(os.homedir(), '.ipingyou', 'logs');
 const LOG_FILE = path.join(LOG_DIR, 'session-events.jsonl');
 const SESSION_LOG_DIR = path.join(os.tmpdir(), 'ipingyou-session-logs');
+const MAX_HISTORY_LOG_BYTES = 5 * 1024 * 1024;
+const MAX_SESSION_LOG_BYTES = 2 * 1024 * 1024;
+const MAX_LOG_STRING_LENGTH = 16 * 1024;
+const SESSION_LOG_FLUSH_BYTES = 64 * 1024;
+const SESSION_LOG_FLUSH_MS = 250;
 
 let sessionLogPath = null;
 let sessionLogDisabled = false;
 let cleanupRegistered = false;
+let sessionLogBytes = 0;
+let historyLogBytes = null;
+let sessionLogBuffer = '';
+let sessionLogFlushTimer = null;
+
+function flushSessionLog() {
+  if (sessionLogFlushTimer) clearTimeout(sessionLogFlushTimer);
+  sessionLogFlushTimer = null;
+  if (!sessionLogPath || !sessionLogBuffer) return;
+  const buffered = sessionLogBuffer;
+  sessionLogBuffer = '';
+  try {
+    fs.appendFileSync(sessionLogPath, buffered, { mode: 0o600 });
+  } catch (err) {
+    sessionLogDisabled = true;
+    console.error(`Session log write failed: ${err.message}`);
+  }
+}
+
+function scheduleSessionLogFlush() {
+  if (sessionLogFlushTimer) return;
+  sessionLogFlushTimer = setTimeout(flushSessionLog, SESSION_LOG_FLUSH_MS);
+  sessionLogFlushTimer.unref?.();
+}
 
 function sanitize(value) {
-  if (typeof value === 'string') return redactSensitive(value);
+  if (typeof value === 'string') {
+    const redacted = redactSensitive(value);
+    return redacted.length > MAX_LOG_STRING_LENGTH
+      ? `${redacted.slice(0, MAX_LOG_STRING_LENGTH)}…[truncated]`
+      : redacted;
+  }
   if (Array.isArray(value)) return value.map(sanitize);
   if (value && typeof value === 'object') {
     return Object.fromEntries(
@@ -28,11 +62,23 @@ export function initSessionLog(scope = 'session') {
   if (sessionLogPath || sessionLogDisabled) return sessionLogPath;
   try {
     fs.mkdirSync(SESSION_LOG_DIR, { recursive: true, mode: 0o700 });
+    const staleBefore = Date.now() - (24 * 60 * 60 * 1000);
+    for (const name of fs.readdirSync(SESSION_LOG_DIR)) {
+      if (!name.startsWith('ipingyou-')) continue;
+      const candidate = path.join(SESSION_LOG_DIR, name);
+      try {
+        if (fs.statSync(candidate).mtimeMs < staleBefore) fs.unlinkSync(candidate);
+      } catch {
+        // Best-effort cleanup; another process may own or remove the file.
+      }
+    }
     sessionLogPath = path.join(
       SESSION_LOG_DIR,
       `ipingyou-${scope}-${Date.now()}-${process.pid}.log`
     );
     fs.writeFileSync(sessionLogPath, '', { mode: 0o600 });
+    sessionLogBytes = 0;
+    sessionLogBuffer = '';
     if (!cleanupRegistered) {
       process.on('exit', () => cleanupSessionLog());
       cleanupRegistered = true;
@@ -59,7 +105,19 @@ export function logSessionEvent(type, details = {}, level = 'info') {
     details: sanitize(details),
   };
   try {
-    fs.appendFileSync(sessionLogPath, `${JSON.stringify(entry)}\n`, { mode: 0o600 });
+    const line = `${JSON.stringify(entry)}\n`;
+    const lineBytes = Buffer.byteLength(line);
+    if (sessionLogBytes + lineBytes > MAX_SESSION_LOG_BYTES) {
+      sessionLogDisabled = true;
+      return;
+    }
+    sessionLogBuffer += line;
+    sessionLogBytes += lineBytes;
+    if (Buffer.byteLength(sessionLogBuffer) >= SESSION_LOG_FLUSH_BYTES) {
+      flushSessionLog();
+    } else {
+      scheduleSessionLogFlush();
+    }
   } catch (err) {
     sessionLogDisabled = true;
     console.error(`Session log write failed: ${err.message}`);
@@ -68,6 +126,7 @@ export function logSessionEvent(type, details = {}, level = 'info') {
 
 export function cleanupSessionLog() {
   if (!sessionLogPath) return;
+  flushSessionLog();
   const target = sessionLogPath;
   sessionLogPath = null;
   try {
@@ -85,7 +144,23 @@ export function recordEvent(type, details = {}) {
       type,
       details: sanitize(details),
     };
-    fs.appendFileSync(LOG_FILE, `${JSON.stringify(event)}\n`, { mode: 0o600 });
+    const line = `${JSON.stringify(event)}\n`;
+    const lineBytes = Buffer.byteLength(line);
+    if (historyLogBytes === null) {
+      historyLogBytes = fs.existsSync(LOG_FILE) ? fs.statSync(LOG_FILE).size : 0;
+    }
+    if (historyLogBytes + lineBytes > MAX_HISTORY_LOG_BYTES) {
+      const previousLog = `${LOG_FILE}.1`;
+      try {
+        if (fs.existsSync(previousLog)) fs.unlinkSync(previousLog);
+        if (fs.existsSync(LOG_FILE)) fs.renameSync(LOG_FILE, previousLog);
+      } catch {
+        fs.writeFileSync(LOG_FILE, '', { mode: 0o600 });
+      }
+      historyLogBytes = 0;
+    }
+    fs.appendFileSync(LOG_FILE, line, { mode: 0o600 });
+    historyLogBytes += lineBytes;
     logSessionEvent(type, details);
   } catch {
     // Session recording is best-effort.