@miraj181/ipingyou 2.1.6 → 2.1.15

package/src/modes/host.js

@@ -13,19 +13,21 @@
  * ============================================================
  */
 
-import { execa, execaCommand } from 'execa';
+import { execa } from 'execa';
 import chalk from 'chalk';
 import inquirer from 'inquirer';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
 import fs from 'node:fs';
 import os from 'node:os';
 import { generateUID } from '../lib/uid.js';
-import { decrypt } from '../lib/crypto.js';
+import { decryptAsync } from '../lib/crypto.js';
 import { cleanupAll, killProcessTree, trackPID, untrackPID, setRevokeOnExit, addCleanupHook } from '../lib/cleanup.js';
 import { detectOS } from '../lib/platform.js';
 import { createSpinner, networkSpinner, typeText } from '../lib/animations.js';
 import { startChatServer, openLocalChatUI } from '../lib/chat.js';
+import { secureSensitive } from '../lib/secure-print.js';
 import { spawnTunnelSupervised } from '../lib/tunnel.js';
 import { decideApprovalRequest, fetchApprovalRequests, pingBroker, registerWithBroker, revokeUID } from '../lib/broker.js';
 import { cleanupSessionLog, getSessionLogPath, initSessionLog, logSessionEvent, recordEvent } from '../lib/session-log.js';
@@ -55,24 +57,24 @@ async function ensureSSHRunning() {
   try {
     if (osInfo.isLinux) {
       try {
-        await execaCommand('systemctl is-active ssh', { reject: true });
+        await execa('systemctl', ['is-active', 'ssh'], { reject: true });
         spinner.succeed('SSH service is active');
       } catch {
         spinner.text = 'Starting SSH service...';
         try {
-          await execaCommand('sudo systemctl start ssh', { stdio: 'inherit' });
+          await execa('sudo', ['systemctl', 'start', 'ssh'], { stdio: 'inherit' });
           spinner.succeed('SSH service started');
         } catch {
-          await execaCommand('sudo systemctl start sshd', { stdio: 'inherit' });
+          await execa('sudo', ['systemctl', 'start', 'sshd'], { stdio: 'inherit' });
           spinner.succeed('SSH service started (sshd)');
         }
       }
     } else if (osInfo.isMac) {
       try {
-        const { stdout } = await execaCommand('sudo systemsetup -getremotelogin', { reject: false });
+        const { stdout } = await execa('sudo', ['systemsetup', '-getremotelogin'], { reject: false });
         if (stdout.toLowerCase().includes('off')) {
           spinner.text = 'Enabling Remote Login...';
-          await execaCommand('sudo systemsetup -setremotelogin on', { stdio: 'inherit' });
+          await execa('sudo', ['systemsetup', '-setremotelogin', 'on'], { stdio: 'inherit' });
           spinner.succeed('Remote Login enabled');
         } else {
           spinner.succeed('SSH (Remote Login) is active');
@@ -82,10 +84,10 @@ async function ensureSSHRunning() {
       }
     } else if (osInfo.isWindows) {
       try {
-        const { stdout } = await execaCommand('sc query sshd', { reject: false });
+        const { stdout } = await execa('sc', ['query', 'sshd'], { reject: false });
         if (stdout.includes('STOPPED')) {
           spinner.text = 'Starting OpenSSH Server...';
-          await execaCommand('net start sshd', { stdio: 'inherit' });
+          await execa('net', ['start', 'sshd'], { stdio: 'inherit' });
           spinner.succeed('OpenSSH Server started');
         } else if (stdout.includes('RUNNING')) {
           spinner.succeed('OpenSSH Server is running');
@@ -112,64 +114,34 @@ async function ensureTmuxInstalled() {
   const spinner = createSpinner('Checking tmux installation...', networkSpinner).start();
   try {
     try {
-      await execaCommand('tmux -V', { reject: true });
+      await execa('tmux', ['-V'], { reject: true });
       spinner.succeed('tmux is installed (Terminal Mirroring available)');
     } catch {
       spinner.text = 'tmux not found. Attempting to install...';
       if (osInfo.isLinux) {
         if (fs.existsSync('/usr/bin/apt') || fs.existsSync('/usr/bin/apt-get')) {
-          await execaCommand('sudo apt-get update && sudo apt-get install -y tmux', { shell: true, stdio: 'inherit' });
+          await execa('sudo', ['apt-get', 'update', '-qq'], { stdio: 'inherit' });
+          await execa('sudo', ['apt-get', 'install', '-y', 'tmux'], { stdio: 'inherit' });
         } else if (fs.existsSync('/usr/bin/dnf')) {
-          await execaCommand('sudo dnf install -y tmux', { shell: true, stdio: 'inherit' });
+          await execa('sudo', ['dnf', 'install', '-y', 'tmux'], { stdio: 'inherit' });
         } else if (fs.existsSync('/usr/bin/yum')) {
-          await execaCommand('sudo yum install -y tmux', { shell: true, stdio: 'inherit' });
+          await execa('sudo', ['yum', 'install', '-y', 'tmux'], { stdio: 'inherit' });
         } else if (fs.existsSync('/usr/bin/pacman')) {
-          await execaCommand('sudo pacman -S --noconfirm tmux', { shell: true, stdio: 'inherit' });
+          await execa('sudo', ['pacman', '-S', '--noconfirm', 'tmux'], { stdio: 'inherit' });
         } else if (fs.existsSync('/sbin/apk')) {
-          await execaCommand('sudo apk add tmux', { shell: true, stdio: 'inherit' });
+          await execa('sudo', ['apk', 'add', 'tmux'], { stdio: 'inherit' });
         } else {
           throw new Error('Unsupported Linux package manager');
         }
         spinner.succeed('tmux installed successfully (Terminal Mirroring available)');
       } else if (osInfo.isMac) {
         try {
-          await execaCommand('brew install tmux', { shell: true, stdio: 'inherit' });
+          await execa('brew', ['install', 'tmux'], { stdio: 'inherit' });
           spinner.succeed('tmux installed successfully (Terminal Mirroring available)');
         } catch {
           throw new Error('Homebrew is required to install tmux on macOS');
         }
       }
-
-      function isSecureLinkSession(name) {
-        return name === TMUX_SESSION_NAME || name.startsWith(TMUX_SESSION_PREFIX);
-      }
-
-      async function listTmuxSessions(socketArgs = []) {
-        const result = await execa('tmux', [...socketArgs, 'list-sessions', '-F', '#{session_name}|#{session_created}'], { reject: false });
-        if (result.exitCode !== 0) return [];
-        return result.stdout
-          .split(/\r?\n/)
-          .filter(Boolean)
-          .map(line => {
-            const [name, createdAt] = line.split('|');
-            return { name, createdAt: Number(createdAt) || null };
-          });
-      }
-
-      async function getMirrorableSessions() {
-        const sessions = [];
-        const customSessions = await listTmuxSessions(tmuxSocketArgs());
-        customSessions
-          .filter(s => isSecureLinkSession(s.name))
-          .forEach(s => sessions.push({ ...s, socketArgs: tmuxSocketArgs(), source: 'custom' }));
-
-        const legacySessions = await listTmuxSessions();
-        legacySessions
-          .filter(s => isSecureLinkSession(s.name))
-          .forEach(s => sessions.push({ ...s, socketArgs: [], source: 'legacy' }));
-
-        return sessions;
-      }
     }
   } catch (err) {
     spinner.fail(`tmux check/install failed: ${err.message}`);
@@ -177,6 +149,37 @@ async function ensureTmuxInstalled() {
   }
 }
 
+function isSecureLinkSession(name) {
+  return name === TMUX_SESSION_NAME || name.startsWith(TMUX_SESSION_PREFIX);
+}
+
+async function listTmuxSessions(socketArgs = []) {
+  const result = await execa('tmux', [...socketArgs, 'list-sessions', '-F', '#{session_name}|#{session_created}'], { reject: false });
+  if (result.exitCode !== 0) return [];
+  return result.stdout
+    .split(/\r?\n/)
+    .filter(Boolean)
+    .map(line => {
+      const [name, createdAt] = line.split('|');
+      return { name, createdAt: Number(createdAt) || null };
+    });
+}
+
+async function getMirrorableSessions() {
+  const sessions = [];
+  const customSessions = await listTmuxSessions(tmuxSocketArgs());
+  customSessions
+    .filter(s => isSecureLinkSession(s.name))
+    .forEach(s => sessions.push({ ...s, socketArgs: tmuxSocketArgs(), source: 'custom' }));
+
+  const legacySessions = await listTmuxSessions();
+  legacySessions
+    .filter(s => isSecureLinkSession(s.name))
+    .forEach(s => sessions.push({ ...s, socketArgs: [], source: 'legacy' }));
+
+  return sessions;
+}
+
 // ─── Ephemeral SSH Key Management ────────────────────────────
 async function generateEphemeralKey() {
   const tmpDir = os.tmpdir() || process.env.TMPDIR || process.env.TEMP || process.env.TMP;
@@ -275,6 +278,44 @@ async function startLocalHostDashboard(uid, password, serviceConfig, sessionStat
   const { default: open } = await import('open');
   const app = express();
   const startedAt = new Date().toISOString();
+  const decryptedClientCache = new Map();
+  const MAX_DECRYPTED_CLIENT_CACHE = 100;
+  const activeEventStreams = new Set();
+  const MAX_EVENT_STREAMS = 5;
+
+  async function fetchDecryptedClients() {
+    const brokerRes = await fetch(`${BROKER_URL}/clients/${uid}`, {
+      headers: sessionState.hostToken ? { 'x-host-token': sessionState.hostToken } : {}
+    });
+    if (!brokerRes.ok) {
+      const data = await brokerRes.json().catch(() => ({}));
+      throw new Error(data.error || 'Failed to fetch clients');
+    }
+    const data = await brokerRes.json();
+    const activeCacheKeys = new Set();
+    const decryptedClients = await Promise.all((data.clients || []).map(async (clientBlob) => {
+      const cacheKey = `${clientBlob.iv}:${clientBlob.salt}:${clientBlob.ciphertext}`;
+      activeCacheKeys.add(cacheKey);
+      const cached = decryptedClientCache.get(cacheKey);
+      if (cached) return { ...cached, seenAt: clientBlob.seenAt || null };
+      try {
+        const decrypted = await decryptAsync(clientBlob.iv, clientBlob.ciphertext, password, clientBlob.salt);
+        const t = JSON.parse(decrypted);
+        decryptedClientCache.set(cacheKey, t);
+        return { ...t, seenAt: clientBlob.seenAt || null };
+      } catch {
+        const failed = { error: 'decrypt_failed' };
+        decryptedClientCache.set(cacheKey, failed);
+        return { ...failed, seenAt: clientBlob.seenAt || null };
+      }
+    }));
+    for (const key of decryptedClientCache.keys()) {
+      if (!activeCacheKeys.has(key) || decryptedClientCache.size > MAX_DECRYPTED_CLIENT_CACHE) {
+        decryptedClientCache.delete(key);
+      }
+    }
+    return { clients: decryptedClients };
+  }
 
   app.get('/api/status', (_req, res) => {
     res.json({
@@ -291,47 +332,91 @@ async function startLocalHostDashboard(uid, password, serviceConfig, sessionStat
 
   app.use(express.json());
 
+  app.get('/api/approvals', async (_req, res) => {
+    try {
+      const data = await fetchApprovalRequests(BROKER_URL, uid, sessionState.hostToken);
+      res.json(data);
+    } catch (err) {
+      res.status(500).json({ error: err.message });
+    }
+  });
+
   // Server-Sent Events for live telemetry & approvals
   app.get('/api/events', async (req, res) => {
+    if (activeEventStreams.size >= MAX_EVENT_STREAMS) {
+      return res.status(503).json({ error: 'Too many dashboard event streams' });
+    }
+    activeEventStreams.add(res);
     res.set({ 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-cache', Connection: 'keep-alive' });
     res.flushHeaders?.();
 
     let closed = false;
-    const push = async () => {
+    let timer = null;
+    let intervalMs = 5000;
+    let unchangedCycles = 0;
+    let lastApprovals = '';
+    let lastClients = '';
+
+    const writeEvent = (event, payload) => {
+      if (closed) return;
+      res.write(`event: ${event}\n`);
+      res.write(`data: ${JSON.stringify(payload)}\n\n`);
+    };
+
+    const scheduleNext = () => {
+      if (closed) return;
+      timer = setTimeout(pushLoop, intervalMs);
+    };
+
+    const pushLoop = async () => {
       if (closed) return;
       try {
-        const data = await fetchApprovalRequests(BROKER_URL, uid, sessionState.hostToken).catch(() => ({ approvals: [] }));
-        res.write(`event: approvals\n`);
-        res.write(`data: ${JSON.stringify(data)}\n\n`);
-      } catch { }
+        const [approvalData, clientData] = await Promise.all([
+          fetchApprovalRequests(BROKER_URL, uid, sessionState.hostToken).catch(() => ({ approvals: [] })),
+          fetchDecryptedClients().catch(() => ({ clients: [] })),
+        ]);
+
+        const approvalsPayload = { approvals: approvalData.approvals || [] };
+        const clientsPayload = { clients: clientData.clients || [] };
+        const approvalsHash = JSON.stringify(approvalsPayload.approvals);
+        const clientsHash = JSON.stringify(clientsPayload.clients);
+        const changed = approvalsHash !== lastApprovals || clientsHash !== lastClients;
+
+        if (approvalsHash !== lastApprovals) {
+          writeEvent('approvals', approvalsPayload);
+          lastApprovals = approvalsHash;
+        }
+        if (clientsHash !== lastClients) {
+          writeEvent('clients', clientsPayload);
+          lastClients = clientsHash;
+        }
+
+        if (changed) {
+          unchangedCycles = 0;
+          intervalMs = 5000;
+        } else {
+          unchangedCycles += 1;
+          intervalMs = Math.min(20000, 5000 * (2 ** Math.min(2, unchangedCycles)));
+        }
+      } finally {
+        scheduleNext();
+      }
     };
 
-    const iv = setInterval(push, 5000);
-    req.on('close', () => { clearInterval(iv); closed = true; });
-    // send initial payload
-    await push();
+    req.on('close', () => {
+      closed = true;
+      activeEventStreams.delete(res);
+      if (timer) clearTimeout(timer);
+    });
+
+    writeEvent('ready', { ok: true });
+    await pushLoop();
   });
 
   app.get('/api/clients', async (_req, res) => {
     try {
-      const brokerRes = await fetch(`${BROKER_URL}/clients/${uid}`, {
-        headers: sessionState.hostToken ? { 'x-host-token': sessionState.hostToken } : {}
-      });
-      if (!brokerRes.ok) {
-        const data = await brokerRes.json().catch(() => ({}));
-        return res.status(brokerRes.status).json({ error: data.error || 'Failed to fetch clients' });
-      }
-      const data = await brokerRes.json();
-      const clients = (data.clients || []).map((clientBlob) => {
-        try {
-          const decrypted = decrypt(clientBlob.iv, clientBlob.ciphertext, password, clientBlob.salt);
-          const t = JSON.parse(decrypted);
-          return { ...t, seenAt: clientBlob.seenAt || null };
-        } catch {
-          return { error: 'decrypt_failed', seenAt: clientBlob.seenAt || null };
-        }
-      });
-      res.json({ clients });
+      const clients = await fetchDecryptedClients();
+      res.json(clients);
     } catch (err) {
       res.status(500).json({ error: err.message });
     }
@@ -484,12 +569,44 @@ updateUptime();
 
 // SSE for live updates
 const es = new EventSource('/api/events');
+let fallbackTimer = null;
+let fallbackDelay = 5000;
+
+function scheduleFallbackPoll() {
+  if (fallbackTimer) return;
+  fallbackTimer = setTimeout(async function pollFallback() {
+    fallbackTimer = null;
+    try {
+      const [approvalsRes, clientsRes] = await Promise.all([
+        fetch('/api/approvals'),
+        fetch('/api/clients')
+      ]);
+      if (approvalsRes.ok) renderApprovals((await approvalsRes.json()).approvals || []);
+      if (clientsRes.ok) renderClients((await clientsRes.json()).clients || []);
+    } catch {}
+    fallbackDelay = Math.min(20000, fallbackDelay * 2);
+    scheduleFallbackPoll();
+  }, fallbackDelay);
+}
+
+es.addEventListener('open', () => {
+  fallbackDelay = 5000;
+  if (fallbackTimer) clearTimeout(fallbackTimer);
+  fallbackTimer = null;
+});
+es.addEventListener('error', scheduleFallbackPoll);
 es.addEventListener('approvals', (e) => {
   try {
     const data = JSON.parse(e.data);
     renderApprovals(data.approvals || []);
   } catch {}
 });
+es.addEventListener('clients', (e) => {
+  try {
+    const data = JSON.parse(e.data);
+    renderClients(data.clients || []);
+  } catch {}
+});
 
 function renderApprovals(approvals) {
   const container = document.getElementById('approvals');
@@ -554,16 +671,6 @@ async function revokeSession() {
   } catch (err) { showToast('Error: ' + err.message); }
 }
 
-// Poll client telemetry (separate from SSE for simplicity)
-async function pollClients() {
-  try {
-    const res = await fetch('/api/clients');
-    if (!res.ok) return;
-    const data = await res.json();
-    renderClients(data.clients || []);
-  } catch {}
-}
- 
 function renderClients(clients) {
   const container = document.getElementById('clients');
   if (!clients || clients.length === 0) {
@@ -593,8 +700,6 @@ function renderClients(clients) {
   container.innerHTML = html;
 }
  
-setInterval(pollClients, 5000);
-pollClients();
 </script>
 </body></html>`);
  });
@@ -616,18 +721,67 @@ pollClients();
 async function spawnPrivateBroker() {
   console.log(chalk.yellow('\n  ⚠️  Public Broker is unreachable. Spawning Private Broker...'));
 
+  const packageRoot = path.resolve(__dirname, '../..');
+  const serverEntrypoint = path.join(__dirname, '../server.js');
+  const requireFromServer = createRequire(serverEntrypoint);
+  const requiredBrokerPackages = ['express', 'express-rate-limit', 'helmet'];
+  const missingPackages = requiredBrokerPackages.filter((pkg) => {
+    try {
+      requireFromServer.resolve(pkg);
+      return false;
+    } catch {
+      return true;
+    }
+  });
+
+  if (missingPackages.length > 0) {
+    console.log(chalk.yellow(`  ⚠️  Missing broker runtime packages: ${missingPackages.join(', ')}`));
+    const npmCmd = process.platform === 'win32' ? 'npm.cmd' : 'npm';
+    const installResult = await execa(
+      npmCmd,
+      ['install', '--no-save', '--no-audit', '--no-fund', ...missingPackages],
+      { cwd: packageRoot, reject: false, all: true }
+    );
+
+    if (installResult.exitCode !== 0) {
+      const installOutput = installResult.all?.trim();
+      throw new Error(
+        `Private broker dependencies failed to install (${missingPackages.join(', ')})`
+        + (installOutput ? `: ${installOutput}` : '')
+      );
+    }
+
+    // Verify modules are now resolvable for the server entrypoint context.
+    const unresolved = missingPackages.filter((pkg) => {
+      try {
+        requireFromServer.resolve(pkg);
+        return false;
+      } catch {
+        return true;
+      }
+    });
+    if (unresolved.length > 0) {
+      throw new Error(`Private broker dependencies are still missing after install: ${unresolved.join(', ')}`);
+    }
+  }
+
   // 1. Spawn the broker server process
-  const brokerProcess = execa('node', [path.join(__dirname, '../server.js')], {
+  const brokerProcess = execa('node', [serverEntrypoint], {
     env: { ...process.env, PORT: '4040' },
     reject: false,
     all: true,
+    buffer: false,
   });
   trackPID(brokerProcess.pid);
 
   let brokerExited = false;
-  let brokerOutput = '';
+  const maxBrokerOutputBytes = 64 * 1024;
+  let brokerOutput = Buffer.alloc(0);
   brokerProcess.all?.on('data', chunk => {
-    brokerOutput += chunk.toString();
+    const next = Buffer.concat([brokerOutput, Buffer.from(chunk)]);
+    brokerOutput = next.length > maxBrokerOutputBytes
+      ? next.subarray(next.length - maxBrokerOutputBytes)
+      : next;
   });
   brokerProcess.on('exit', () => {
     brokerExited = true;
@@ -641,7 +795,8 @@ async function spawnPrivateBroker() {
 
   await waitForValue(() => {
     if (brokerExited) {
-      throw new Error(`Private broker exited before tunnel was ready${brokerOutput ? `: ${brokerOutput.trim()}` : ''}`);
+      const output = brokerOutput.toString('utf8').trim();
+      throw new Error(`Private broker exited before tunnel was ready${output ? `: ${output}` : ''}`);
     }
     return brokerTunnelUrl;
   }, 30000, 'Private broker tunnel startup');
@@ -674,7 +829,7 @@ async function hostDashboard(uid, password, serviceConfig, tunnelProcess, sessio
     console.log(chalk.bold('  ║         🛡️  SecureLink — HOST MODE ACTIVE          ║'));
     console.log(chalk.bold('  ╠════════════════════════════════════════════════════╣'));
     console.log(`  ║  ${chalk.cyan('UID:')}        ${chalk.bold.white(uid.padEnd(30))}║`);
-    console.log(`  ║  ${chalk.cyan('Password:')}   ${chalk.bold.white(password.padEnd(30))}║`);
+    console.log(`  ║  ${chalk.cyan('Password:')}   ${chalk.bold.white(secureSensitive(password).padEnd(30))}║`);
     console.log(`  ║  ${chalk.cyan('Service:')}    ${chalk.dim(serviceConfig.type.toUpperCase() + ' (Port ' + serviceConfig.port + ')').padEnd(30)}║`);
     console.log(`  ║  ${chalk.cyan('Tunnel:')}     ${chalk.dim(sessionState.tunnelUrl.substring(0, 40))}  ║`);
     if (serviceConfig.chatUrl) {
@@ -751,7 +906,7 @@ async function hostDashboard(uid, password, serviceConfig, tunnelProcess, sessio
             for (const request of pending) {
               let details = {};
               try {
-                details = JSON.parse(decrypt(request.iv, request.ciphertext, password, request.salt));
+                details = JSON.parse(await decryptAsync(request.iv, request.ciphertext, password, request.salt));
               } catch {
                 details = { error: 'Could not decrypt request metadata' };
               }
@@ -841,7 +996,7 @@ async function hostDashboard(uid, password, serviceConfig, tunnelProcess, sessio
           console.log('');
 
           try {
-            await execaCommand('tmux -V', { reject: true });
+            await execa('tmux', ['-V'], { reject: true });
             const sessions = await getMirrorableSessions();
             if (sessions.length === 0) {
               console.log(chalk.yellow('  ⚠️  No mirrored terminal session is active yet.'));
@@ -891,10 +1046,10 @@ async function hostDashboard(uid, password, serviceConfig, tunnelProcess, sessio
             } else {
               spinner.succeed(`Found ${data.clients.length} recent connection(s):`);
 
-              data.clients.forEach((clientBlob, i) => {
+              for (const [i, clientBlob] of data.clients.entries()) {
                 try {
                   // Decrypt using the unique salt the client generated for this payload
-                  const decrypted = decrypt(clientBlob.iv, clientBlob.ciphertext, password, clientBlob.salt);
+                  const decrypted = await decryptAsync(clientBlob.iv, clientBlob.ciphertext, password, clientBlob.salt);
                   const t = JSON.parse(decrypted);
 
                   console.log(chalk.bold.blue(`\n  Client #${i + 1} (${t.username})`));
@@ -908,7 +1063,7 @@ async function hostDashboard(uid, password, serviceConfig, tunnelProcess, sessio
                   console.log(chalk.yellow(`\n  Client #${i + 1}: Payload decryption failed (wrong password or corrupted).`));
                   logSessionEvent('host_telemetry_decrypt_failed', { index: i + 1 }, 'warn');
                 }
-              });
+              }
             }
           } catch (e) {
             spinner.fail('Could not reach broker.');
@@ -928,9 +1083,9 @@ async function hostDashboard(uid, password, serviceConfig, tunnelProcess, sessio
           const spinner = createSpinner('Terminating active SSH sessions...', networkSpinner).start();
           try {
             if (process.platform === 'win32') {
-              await execaCommand('powershell -NoProfile -Command "Get-CimInstance Win32_Process -Filter \\"name = \'sshd.exe\'\\" | Where-Object { $_.CommandLine -match \'sshd:.*@\' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force }"', { reject: false });
+              await execa('powershell', ['-NoProfile', '-Command', "Get-CimInstance Win32_Process -Filter \"name = 'sshd.exe'\" | Where-Object { $_.CommandLine -match 'sshd:.*@' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force }"], { reject: false });
             } else {
-              await execaCommand("pkill -f 'sshd:.*@'", { shell: true, reject: false });
+              await execa('pkill', ['-f', 'sshd:.*@'], { reject: false });
               await execa('tmux', [...tmuxSocketArgs(), 'kill-server'], { reject: false });
               const legacySessions = await listTmuxSessions();
               for (const session of legacySessions) {
@@ -994,7 +1149,7 @@ export async function startHostMode() {
     },
   ]);
   const password = pwdInput.trim() || generateUID();
-  console.log(`  ${chalk.green('✓')} Password: ${chalk.bold.white(password)}`);
+  console.log(`  ${chalk.green('✓')} Password: ${chalk.bold.white(secureSensitive(password))}`);
   console.log('');
 
   // ─── Broker Selection ───