@miraj181/ipingyou 2.1.9 → 2.1.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miraj181/ipingyou",
-  "version": "2.1.9",
+  "version": "2.1.15",
   "description": "SecureLink-CLI — Secure peer-to-peer remote access via SSH & Cloudflare Tunnels",
   "main": "src/cli.js",
   "bin": {
@@ -46,7 +46,10 @@
   "dependencies": {
     "chalk": "^5.3.0",
     "commander": "^15.0.0",
+    "express": "^4.21.2",
+    "express-rate-limit": "^7.5.0",
     "execa": "^9.5.2",
+    "helmet": "^8.0.0",
     "inquirer": "^12.11.1",
     "nanoid": "^5.0.9",
     "open": "^11.0.0",

package/src/cli.js

@@ -23,6 +23,7 @@ import inquirer from 'inquirer';
 import chalk from 'chalk';
 import fs from 'node:fs';
 import path from 'node:path';
+import readline from 'node:readline';
 import { fileURLToPath } from 'node:url';
 
 import { detectOS, checkDependencies } from './lib/platform.js';
@@ -474,26 +475,28 @@ program
         return;
       }
 
-      const raw = fs.readFileSync(logFile, 'utf8').trim();
-      if (!raw) {
-        console.log(chalk.dim('  Log file is empty.'));
-        return;
-      }
-
-      let events = raw.split('\n').map(line => {
-        try { return JSON.parse(line); } catch { return null; }
-      }).filter(Boolean);
-
-      // Filter by type if specified
-      if (commandOptions.type) {
-        const filter = commandOptions.type.toLowerCase();
-        events = events.filter(e => (e.type || '').toLowerCase().includes(filter));
+      const parsedCount = Number.parseInt(commandOptions.lines, 10);
+      const count = Number.isFinite(parsedCount) ? Math.max(1, Math.min(parsedCount, 10000)) : 25;
+      const filter = commandOptions.type?.toLowerCase();
+      const events = [];
+      let totalEvents = 0;
+      const lines = readline.createInterface({
+        input: fs.createReadStream(logFile, { encoding: 'utf8' }),
+        crlfDelay: Infinity,
+      });
+      for await (const line of lines) {
+        if (!line.trim()) continue;
+        totalEvents += 1;
+        try {
+          const event = JSON.parse(line);
+          if (filter && !(event.type || '').toLowerCase().includes(filter)) continue;
+          events.push(event);
+          if (events.length > count) events.shift();
+        } catch {
+          // Ignore incomplete or invalid log lines.
+        }
       }
 
-      // Take last N events
-      const count = parseInt(commandOptions.lines) || 25;
-      events = events.slice(-count);
-
       if (events.length === 0) {
         console.log(chalk.dim('  No matching events found.'));
         return;
@@ -526,7 +529,7 @@ program
 
       console.log('');
       console.log(chalk.dim(`  Log file: ${logFile}`));
-      console.log(chalk.dim(`  Total events in file: ${raw.split('\n').length}`));
+      console.log(chalk.dim(`  Total events in file: ${totalEvents}`));
     } catch (err) {
       fatal('history', err);
     }

package/src/lib/broker.js

@@ -1,7 +1,7 @@
 import chalk from 'chalk';
 import os from 'node:os';
 import crypto from 'node:crypto';
-import { decrypt, encrypt } from './crypto.js';
+import { decryptAsync, encryptAsync } from './crypto.js';
 import { createSpinner, cryptoSpinner, networkSpinner } from './animations.js';
 import { logSessionEvent } from './session-log.js';
 
@@ -51,7 +51,7 @@ export async function registerWithBroker(brokerUrl, uid, tunnelUrl, password, se
   try {
     await new Promise(r => setTimeout(r, 600));
     const payload = JSON.stringify({ url: tunnelUrl, ...serviceConfig });
-    const encrypted = encrypt(payload, password);
+    const encrypted = await encryptAsync(payload, password);
     const localHostToken = crypto.randomBytes(32).toString('hex');
 
     spinner.text = 'Registering with broker...';
@@ -92,7 +92,7 @@ export async function registerWithBroker(brokerUrl, uid, tunnelUrl, password, se
 }
 
 export async function requestHostApproval(brokerUrl, uid, password, details) {
-  const encrypted = encrypt(JSON.stringify(details), password);
+  const encrypted = await encryptAsync(JSON.stringify(details), password);
   const res = await fetchWithLog('approval_request', `${brokerUrl}/approval-request/${uid}`, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
@@ -209,7 +209,7 @@ export async function resolveUID(brokerUrl, uid, password, silent = false, reque
 
     let decryptedPayload;
     try {
-      decryptedPayload = decrypt(data.iv, data.ciphertext, password, data.salt);
+      decryptedPayload = await decryptAsync(data.iv, data.ciphertext, password, data.salt);
     } catch {
       if (spinner) spinner.fail('Decryption failed — incorrect password or corrupted data');
       if (!spinner) console.error(chalk.red('  ❌ Error: Could not decrypt tunnel data. Incorrect password.'));
@@ -269,7 +269,7 @@ export async function pushTelemetry(brokerUrl, uid, password, username, action =
       time: new Date().toISOString()
     };
 
-    const { iv, ciphertext, salt } = encrypt(JSON.stringify(telemetry), password);
+    const { iv, ciphertext, salt } = await encryptAsync(JSON.stringify(telemetry), password);
 
     await fetchWithLog('telemetry', `${parsed.origin}/client-info/${encodeURIComponent(uid)}`, {
       method: 'POST',

package/src/lib/chat.js

@@ -168,7 +168,13 @@ const HTML_CONTENT = `
         div.textContent = msg.text;
       } else {
         div.className = 'message ' + (msg.sender === username ? 'self' : 'other');
-        div.innerHTML = '<div class="message-header">' + msg.sender + ' • ' + msg.time + '</div><div>' + msg.text + '</div>';
+        const header = document.createElement('div');
+        header.className = 'message-header';
+        header.textContent = String(msg.sender || 'Unknown') + ' • ' + String(msg.time || '');
+        const body = document.createElement('div');
+        body.textContent = String(msg.text || '');
+        div.appendChild(header);
+        div.appendChild(body);
       }
       msgs.appendChild(div);
       msgs.scrollTop = msgs.scrollHeight;

package/src/lib/checksum.js

@@ -1,12 +1,32 @@
 import crypto from 'node:crypto';
 import fs from 'node:fs';
+import { canUseWorkers, runWorkerTask } from './worker-runtime.js';
 
-export async function calculateChecksum(filePath) {
+const WORKER_CHECKSUM_THRESHOLD_BYTES = 2 * 1024 * 1024;
+
+async function calculateChecksumStream(filePath) {
   return new Promise((resolve) => {
     const hash = crypto.createHash('sha256');
     const stream = fs.createReadStream(filePath);
     stream.on('error', () => resolve(null));
-    stream.on('data', chunk => hash.update(chunk));
+    stream.on('data', (chunk) => hash.update(chunk));
     stream.on('end', () => resolve(hash.digest('hex')));
   });
 }
+
+export async function calculateChecksum(filePath) {
+  const stat = await fs.promises.stat(filePath).catch(() => null);
+  if (!stat || !stat.isFile()) return null;
+
+  if (canUseWorkers() && stat.size >= WORKER_CHECKSUM_THRESHOLD_BYTES) {
+    try {
+      const result = await runWorkerTask('checksum', { filePath });
+      return result.digest || null;
+    } catch (err) {
+      if (err?.code === 'WORKER_QUEUE_FULL') throw err;
+      return calculateChecksumStream(filePath);
+    }
+  }
+
+  return calculateChecksumStream(filePath);
+}

package/src/lib/crypto.js

@@ -8,6 +8,7 @@
  */
 
 import crypto from 'node:crypto';
+import { canUseWorkers, runWorkerTask } from './worker-runtime.js';
 
 /**
  * Derive a 256-bit encryption key from a password and salt using PBKDF2.
@@ -42,6 +43,21 @@ export function encrypt(plaintext, password) {
   };
 }
 
+export async function encryptAsync(plaintext, password) {
+  if (!canUseWorkers()) return encrypt(plaintext, password);
+  try {
+    const result = await runWorkerTask('encrypt', { plaintext, password });
+    return {
+      iv: result.iv,
+      ciphertext: result.ciphertext,
+      salt: result.salt,
+    };
+  } catch (err) {
+    if (err?.code === 'WORKER_QUEUE_FULL') throw err;
+    return encrypt(plaintext, password);
+  }
+}
+
 /**
  * Decrypt a ciphertext with AES-256-CBC using a password and salt.
  * @param {string} ivHex  — 32-char hex IV
@@ -60,3 +76,14 @@ export function decrypt(ivHex, cipherBase64, password, saltHex) {
   dec += decipher.final('utf8');
   return dec;
 }
+
+export async function decryptAsync(ivHex, cipherBase64, password, saltHex) {
+  if (!canUseWorkers()) return decrypt(ivHex, cipherBase64, password, saltHex);
+  try {
+    const result = await runWorkerTask('decrypt', { ivHex, cipherBase64, password, saltHex });
+    return result.plaintext;
+  } catch (err) {
+    if (err?.code === 'WORKER_QUEUE_FULL') throw err;
+    return decrypt(ivHex, cipherBase64, password, saltHex);
+  }
+}

package/src/lib/secure-print.js

@@ -18,6 +18,8 @@ import os from 'node:os';
 // Keyed secret for deterministic, non-reversible log masking tokens.
 // Can be overridden for stable cross-process correlation if needed.
 const MASKING_KEY = process.env.SECURE_PRINT_MASK_KEY || crypto.randomBytes(32).toString('hex');
+let lastMaskedFingerprint = null;
+let lastMaskedResult = null;
 
 /**
  * Verify the current process is being run by the same OS user interactively.
@@ -47,10 +49,14 @@ function isVerifiedHostUser() {
  */
 function maskSensitive(value) {
   const normalized = String(value);
+  const fingerprint = crypto.createHash('sha256').update(normalized).digest('hex');
+  if (fingerprint === lastMaskedFingerprint) return lastMaskedResult;
   const hash = crypto
     .pbkdf2Sync(MASKING_KEY, normalized, 210000, 32, 'sha256')
     .toString('hex');
-  return `[pbkdf2:${hash.slice(0, 12)}…]`;
+  lastMaskedFingerprint = fingerprint;
+  lastMaskedResult = `[pbkdf2:${hash.slice(0, 12)}…]`;
+  return lastMaskedResult;
 }
 
 /**

package/src/lib/session-log.js

@@ -6,13 +6,47 @@ import { redactSensitive } from './ai/safety.js';
 const LOG_DIR = path.join(os.homedir(), '.ipingyou', 'logs');
 const LOG_FILE = path.join(LOG_DIR, 'session-events.jsonl');
 const SESSION_LOG_DIR = path.join(os.tmpdir(), 'ipingyou-session-logs');
+const MAX_HISTORY_LOG_BYTES = 5 * 1024 * 1024;
+const MAX_SESSION_LOG_BYTES = 2 * 1024 * 1024;
+const MAX_LOG_STRING_LENGTH = 16 * 1024;
+const SESSION_LOG_FLUSH_BYTES = 64 * 1024;
+const SESSION_LOG_FLUSH_MS = 250;
 
 let sessionLogPath = null;
 let sessionLogDisabled = false;
 let cleanupRegistered = false;
+let sessionLogBytes = 0;
+let historyLogBytes = null;
+let sessionLogBuffer = '';
+let sessionLogFlushTimer = null;
+
+function flushSessionLog() {
+  if (sessionLogFlushTimer) clearTimeout(sessionLogFlushTimer);
+  sessionLogFlushTimer = null;
+  if (!sessionLogPath || !sessionLogBuffer) return;
+  const buffered = sessionLogBuffer;
+  sessionLogBuffer = '';
+  try {
+    fs.appendFileSync(sessionLogPath, buffered, { mode: 0o600 });
+  } catch (err) {
+    sessionLogDisabled = true;
+    console.error(`Session log write failed: ${err.message}`);
+  }
+}
+
+function scheduleSessionLogFlush() {
+  if (sessionLogFlushTimer) return;
+  sessionLogFlushTimer = setTimeout(flushSessionLog, SESSION_LOG_FLUSH_MS);
+  sessionLogFlushTimer.unref?.();
+}
 
 function sanitize(value) {
-  if (typeof value === 'string') return redactSensitive(value);
+  if (typeof value === 'string') {
+    const redacted = redactSensitive(value);
+    return redacted.length > MAX_LOG_STRING_LENGTH
+      ? `${redacted.slice(0, MAX_LOG_STRING_LENGTH)}…[truncated]`
+      : redacted;
+  }
   if (Array.isArray(value)) return value.map(sanitize);
   if (value && typeof value === 'object') {
     return Object.fromEntries(
@@ -28,11 +62,23 @@ export function initSessionLog(scope = 'session') {
   if (sessionLogPath || sessionLogDisabled) return sessionLogPath;
   try {
     fs.mkdirSync(SESSION_LOG_DIR, { recursive: true, mode: 0o700 });
+    const staleBefore = Date.now() - (24 * 60 * 60 * 1000);
+    for (const name of fs.readdirSync(SESSION_LOG_DIR)) {
+      if (!name.startsWith('ipingyou-')) continue;
+      const candidate = path.join(SESSION_LOG_DIR, name);
+      try {
+        if (fs.statSync(candidate).mtimeMs < staleBefore) fs.unlinkSync(candidate);
+      } catch {
+        // Best-effort cleanup; another process may own or remove the file.
+      }
+    }
     sessionLogPath = path.join(
       SESSION_LOG_DIR,
       `ipingyou-${scope}-${Date.now()}-${process.pid}.log`
     );
     fs.writeFileSync(sessionLogPath, '', { mode: 0o600 });
+    sessionLogBytes = 0;
+    sessionLogBuffer = '';
     if (!cleanupRegistered) {
       process.on('exit', () => cleanupSessionLog());
       cleanupRegistered = true;
@@ -59,7 +105,19 @@ export function logSessionEvent(type, details = {}, level = 'info') {
     details: sanitize(details),
   };
   try {
-    fs.appendFileSync(sessionLogPath, `${JSON.stringify(entry)}\n`, { mode: 0o600 });
+    const line = `${JSON.stringify(entry)}\n`;
+    const lineBytes = Buffer.byteLength(line);
+    if (sessionLogBytes + lineBytes > MAX_SESSION_LOG_BYTES) {
+      sessionLogDisabled = true;
+      return;
+    }
+    sessionLogBuffer += line;
+    sessionLogBytes += lineBytes;
+    if (Buffer.byteLength(sessionLogBuffer) >= SESSION_LOG_FLUSH_BYTES) {
+      flushSessionLog();
+    } else {
+      scheduleSessionLogFlush();
+    }
   } catch (err) {
     sessionLogDisabled = true;
     console.error(`Session log write failed: ${err.message}`);
@@ -68,6 +126,7 @@ export function logSessionEvent(type, details = {}, level = 'info') {
 
 export function cleanupSessionLog() {
   if (!sessionLogPath) return;
+  flushSessionLog();
   const target = sessionLogPath;
   sessionLogPath = null;
   try {
@@ -85,7 +144,23 @@ export function recordEvent(type, details = {}) {
       type,
       details: sanitize(details),
     };
-    fs.appendFileSync(LOG_FILE, `${JSON.stringify(event)}\n`, { mode: 0o600 });
+    const line = `${JSON.stringify(event)}\n`;
+    const lineBytes = Buffer.byteLength(line);
+    if (historyLogBytes === null) {
+      historyLogBytes = fs.existsSync(LOG_FILE) ? fs.statSync(LOG_FILE).size : 0;
+    }
+    if (historyLogBytes + lineBytes > MAX_HISTORY_LOG_BYTES) {
+      const previousLog = `${LOG_FILE}.1`;
+      try {
+        if (fs.existsSync(previousLog)) fs.unlinkSync(previousLog);
+        if (fs.existsSync(LOG_FILE)) fs.renameSync(LOG_FILE, previousLog);
+      } catch {
+        fs.writeFileSync(LOG_FILE, '', { mode: 0o600 });
+      }
+      historyLogBytes = 0;
+    }
+    fs.appendFileSync(LOG_FILE, line, { mode: 0o600 });
+    historyLogBytes += lineBytes;
     logSessionEvent(type, details);
   } catch {
     // Session recording is best-effort.

package/src/lib/ssh.js

@@ -1,11 +1,26 @@
 import crypto from 'node:crypto';
 
+const SAFE_HOSTNAME_PATTERN = /^(?=.{1,253}$)(?!.*\.\.)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/i;
+
+export function assertSafeHostname(hostname, label = 'hostname') {
+  const normalized = String(hostname || '').trim().replace(/\.$/, '').toLowerCase();
+  if (!normalized || !SAFE_HOSTNAME_PATTERN.test(normalized)) {
+    throw new Error(`Invalid ${label}`);
+  }
+  return normalized;
+}
+
 export function extractHostname(url) {
+  let parsed;
   try {
-    return new URL(url).hostname;
+    parsed = new URL(url);
   } catch {
-    return url.replace(/^https?:\/\//, '').replace(/\/$/, '');
+    throw new Error('Invalid tunnel URL');
   }
+  if (parsed.protocol !== 'https:') {
+    throw new Error('Tunnel URL must use HTTPS');
+  }
+  return assertSafeHostname(parsed.hostname, 'tunnel hostname');
 }
 
 export function quoteRemoteShell(value) {
@@ -25,8 +40,9 @@ export function formatScpRemotePath(remotePath) {
 }
 
 export function getSshControlOptions(hostname) {
+  const safeHostname = assertSafeHostname(hostname, 'ssh hostname');
   if (process.platform === 'win32') return [];
-  const hash = crypto.createHash('sha256').update(hostname).digest('hex').slice(0, 10);
+  const hash = crypto.createHash('sha256').update(safeHostname).digest('hex').slice(0, 10);
   return [
     '-o', 'ControlMaster=auto',
     '-o', 'ControlPersist=5m',
@@ -34,6 +50,11 @@ export function getSshControlOptions(hostname) {
   ];
 }
 
+export function buildProxyCommandOption(hostname) {
+  const safeHostname = assertSafeHostname(hostname, 'tunnel hostname');
+  return ['-o', `ProxyCommand=cloudflared access tcp --hostname ${safeHostname}`];
+}
+
 export function getKnownHostsOptions(persistKnownHosts = true) {
   if (persistKnownHosts) {
     return ['-o', 'StrictHostKeyChecking=accept-new'];
@@ -48,9 +69,8 @@ export function getKnownHostsOptions(persistKnownHosts = true) {
 
 export function buildSshArgs(hostname, privateKeyPath, extraOptions = [], options = {}) {
   const { persistKnownHosts = true } = options;
-  const proxyCommand = `cloudflared access tcp --hostname ${hostname}`;
   const sshArgs = [
-    '-o', `ProxyCommand=${proxyCommand}`,
+    ...buildProxyCommandOption(hostname),
     ...getKnownHostsOptions(persistKnownHosts),
     '-o', 'IdentitiesOnly=yes',
     ...getSshControlOptions(hostname),

package/src/lib/tunnel.js

@@ -15,6 +15,7 @@ export async function spawnTunnelSupervised(targetUrl, onUrlGenerated) {
         activeChild = execa('cloudflared', ['tunnel', '--url', targetUrl], {
           reject: false,
           all: true,
+          buffer: false,
         });
 
         trackPID(activeChild.pid);

package/src/lib/worker-runtime.js

@@ -0,0 +1,81 @@
+import { Worker } from 'node:worker_threads';
+
+const workerUrl = new URL('./workers/crypto-checksum-worker.js', import.meta.url);
+const workersDisabled = process.env.IPINGYOU_DISABLE_WORKERS === '1';
+const MAX_PENDING_TASKS = 128;
+
+let worker = null;
+let requestCounter = 0;
+const pending = new Map();
+
+function resetWorker(err) {
+  for (const { reject } of pending.values()) {
+    reject(err);
+  }
+  pending.clear();
+  worker = null;
+}
+
+function ensureWorker() {
+  if (worker || workersDisabled) return worker;
+
+  worker = new Worker(workerUrl, {
+    resourceLimits: {
+      maxOldGenerationSizeMb: 128,
+    },
+  });
+  worker.unref();
+
+  worker.on('message', (message) => {
+    const { id, ok, result, error } = message || {};
+    const entry = pending.get(id);
+    if (!entry) return;
+    pending.delete(id);
+    if (pending.size === 0) worker?.unref();
+    if (ok) {
+      entry.resolve(result);
+      return;
+    }
+    entry.reject(new Error(error || 'Worker task failed'));
+  });
+
+  worker.on('error', (err) => {
+    resetWorker(err);
+  });
+
+  worker.on('exit', (code) => {
+    if (code !== 0) {
+      resetWorker(new Error(`Worker exited with code ${code}`));
+    } else {
+      worker = null;
+    }
+  });
+
+  return worker;
+}
+
+export function canUseWorkers() {
+  return !workersDisabled;
+}
+
+export function runWorkerTask(type, payload) {
+  if (!canUseWorkers()) {
+    throw new Error('Worker threads are disabled');
+  }
+  const activeWorker = ensureWorker();
+  if (!activeWorker) {
+    throw new Error('Worker is not available');
+  }
+  if (pending.size >= MAX_PENDING_TASKS) {
+    const error = new Error('Worker task queue is at capacity');
+    error.code = 'WORKER_QUEUE_FULL';
+    throw error;
+  }
+
+  const id = ++requestCounter;
+  return new Promise((resolve, reject) => {
+    pending.set(id, { resolve, reject });
+    activeWorker.ref();
+    activeWorker.postMessage({ id, type, payload });
+  });
+}

package/src/lib/workers/crypto-checksum-worker.js

@@ -0,0 +1,70 @@
+import { parentPort } from 'node:worker_threads';
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+
+function deriveKey(password, salt) {
+  return crypto.pbkdf2Sync(password, salt, 100000, 32, 'sha256');
+}
+
+function encryptPayload(plaintext, password) {
+  const salt = crypto.randomBytes(16);
+  const key = deriveKey(password, salt);
+  const iv = crypto.randomBytes(16);
+
+  const cipher = crypto.createCipheriv('aes-256-cbc', key, iv);
+  let enc = cipher.update(plaintext, 'utf8', 'base64');
+  enc += cipher.final('base64');
+
+  return {
+    iv: iv.toString('hex'),
+    ciphertext: enc,
+    salt: salt.toString('hex'),
+  };
+}
+
+function decryptPayload(ivHex, cipherBase64, password, saltHex) {
+  const salt = Buffer.from(saltHex, 'hex');
+  const key = deriveKey(password, salt);
+  const iv = Buffer.from(ivHex, 'hex');
+  const decipher = crypto.createDecipheriv('aes-256-cbc', key, iv);
+  let dec = decipher.update(cipherBase64, 'base64', 'utf8');
+  dec += decipher.final('utf8');
+  return dec;
+}
+
+function checksumFile(filePath) {
+  return new Promise((resolve, reject) => {
+    const hash = crypto.createHash('sha256');
+    const stream = fs.createReadStream(filePath);
+    stream.on('error', reject);
+    stream.on('data', (chunk) => hash.update(chunk));
+    stream.on('end', () => resolve(hash.digest('hex')));
+  });
+}
+
+async function executeTask(type, payload) {
+  switch (type) {
+    case 'encrypt':
+      return encryptPayload(payload.plaintext, payload.password);
+    case 'decrypt':
+      return {
+        plaintext: decryptPayload(payload.ivHex, payload.cipherBase64, payload.password, payload.saltHex),
+      };
+    case 'checksum':
+      return {
+        digest: await checksumFile(payload.filePath),
+      };
+    default:
+      throw new Error(`Unsupported worker task: ${type}`);
+  }
+}
+
+parentPort.on('message', async (message) => {
+  const { id, type, payload } = message || {};
+  try {
+    const result = await executeTask(type, payload || {});
+    parentPort.postMessage({ id, ok: true, result });
+  } catch (err) {
+    parentPort.postMessage({ id, ok: false, error: err.message });
+  }
+});

package/src/modes/ai.js

@@ -574,12 +574,10 @@ async function tryAITransfer(task, context) {
   if (context && context.scope === 'remote' && context.hostname && context.username) {
     console.log(chalk.dim(`  Using active remote session: ${context.username}@${context.hostname}`));
 
-    const { getSshControlOptions, formatScpRemotePath } = await import('../lib/ssh.js');
-
-    const proxyCommand = `cloudflared access tcp --hostname ${context.hostname}`;
+    const { buildProxyCommandOption, getSshControlOptions, formatScpRemotePath } = await import('../lib/ssh.js');
     const scpArgs = [
       '-r',
-      '-o', `ProxyCommand=${proxyCommand}`,
+      ...buildProxyCommandOption(context.hostname),
       '-o', 'StrictHostKeyChecking=accept-new',
       '-o', 'IdentitiesOnly=yes',
       ...getSshControlOptions(context.hostname),
@@ -630,4 +628,3 @@ async function tryAITransfer(task, context) {
     return true;
   }
 }
-

package/src/modes/client.js

@@ -24,7 +24,7 @@ import { getConfig, saveAlias } from '../lib/config.js';
 import { pushTelemetry, requestHostApproval, resolveUID, revokeUID, waitForApproval } from '../lib/broker.js';
 import { calculateChecksum } from '../lib/checksum.js';
 import { promptLocalPath, promptRemotePath } from '../lib/path-browser.js';
-import { buildSshArgs, extractHostname, formatScpRemotePath, getKnownHostsOptions, getSshControlOptions, quoteRemoteShell } from '../lib/ssh.js';
+import { buildProxyCommandOption, buildSshArgs, extractHostname, formatScpRemotePath, getKnownHostsOptions, getSshControlOptions, quoteRemoteShell } from '../lib/ssh.js';
 import { buildTmuxSessionName, TMUX_SOCKET_PATH } from '../lib/tmux.js';
 import open from 'open';
 import { secureSensitiveUrl } from '../lib/secure-print.js';
@@ -187,12 +187,10 @@ async function performSCP(username, hostname, direction, privateKeyPath, sharedD
 
   await showConnectionTrace('Local', 'Remote SCP');
 
-  const proxyCommand = `cloudflared access tcp --hostname ${hostname}`;
-
   // Construct SCP args
   const scpArgs = [
     '-r', // recursive just in case
-    '-o', `ProxyCommand=${proxyCommand}`,
+    ...buildProxyCommandOption(hostname),
     ...getKnownHostsOptions(persistKnownHosts),
     '-o', 'IdentitiesOnly=yes',
     ...getSshControlOptions(hostname)
@@ -223,6 +221,16 @@ async function performSCP(username, hostname, direction, privateKeyPath, sharedD
     const child = execa('scp', scpArgs, {
       stdio: ['inherit', 'pipe', 'pipe'],
       reject: false,
+      buffer: false,
+    });
+    const maxDiagnosticBytes = 64 * 1024;
+    let stderrOutput = Buffer.alloc(0);
+    child.stdout?.resume();
+    child.stderr?.on('data', (chunk) => {
+      const next = Buffer.concat([stderrOutput, Buffer.from(chunk)]);
+      stderrOutput = next.length > maxDiagnosticBytes
+        ? next.subarray(next.length - maxDiagnosticBytes)
+        : next;
     });
 
     trackPID(child.pid);
@@ -262,9 +270,10 @@ async function performSCP(username, hostname, direction, privateKeyPath, sharedD
       console.log(chalk.green(`  ✅ Transfer completed successfully!`));
       recordEvent('scp_transfer_success', { direction, localPath, remotePath, hostname });
     } else {
+      const stderr = stderrOutput.toString('utf8');
       console.error(chalk.red('  ❌ SCP transfer failed'));
-      if (result.stderr) console.error(chalk.dim(`     ${result.stderr.trim()}`));
-      recordEvent('scp_transfer_failed', { direction, localPath, remotePath, hostname, error: result.stderr });
+      if (stderr) console.error(chalk.dim(`     ${stderr.trim()}`));
+      recordEvent('scp_transfer_failed', { direction, localPath, remotePath, hostname, error: stderr });
     }
   } catch (err) {
     console.error(chalk.red(`  ❌ SCP error: ${err.message}`));
@@ -273,10 +282,9 @@ async function performSCP(username, hostname, direction, privateKeyPath, sharedD
 
 async function downloadSpecificRemotePath(username, hostname, privateKeyPath, remotePath, localPath, persistKnownHosts = true) {
   await showConnectionTrace('Local', 'Remote SCP');
-  const proxyCommand = `cloudflared access tcp --hostname ${hostname}`;
   const scpArgs = [
     '-r',
-    '-o', `ProxyCommand=${proxyCommand}`,
+    ...buildProxyCommandOption(hostname),
     ...getKnownHostsOptions(persistKnownHosts),
     '-o', 'IdentitiesOnly=yes',
     ...getSshControlOptions(hostname),
@@ -667,8 +675,7 @@ export async function performSCPNonInteractive(params = {}) {
   const privateKeyPath = payload.privateKey ? await writeEphemeralPrivateKey(payload.privateKey) : null;
 
   // Build scp args similar to performSCP
-  const proxyCommand = `cloudflared access tcp --hostname ${hostname}`;
-  const scpArgs = ['-r', '-o', `ProxyCommand=${proxyCommand}`, ...getKnownHostsOptions(persistKnownHosts), '-o', 'IdentitiesOnly=yes', ...getSshControlOptions(hostname)];
+  const scpArgs = ['-r', ...buildProxyCommandOption(hostname), ...getKnownHostsOptions(persistKnownHosts), '-o', 'IdentitiesOnly=yes', ...getSshControlOptions(hostname)];
   if (privateKeyPath) scpArgs.push('-i', privateKeyPath, '-o', 'IdentityAgent=none');
 
   const remoteSpec = `${username}@${hostname}:${formatScpRemotePath(remotePath)}`;

package/src/modes/host.js

@@ -18,10 +18,11 @@ import chalk from 'chalk';
 import inquirer from 'inquirer';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
 import fs from 'node:fs';
 import os from 'node:os';
 import { generateUID } from '../lib/uid.js';
-import { decrypt } from '../lib/crypto.js';
+import { decryptAsync } from '../lib/crypto.js';
 import { cleanupAll, killProcessTree, trackPID, untrackPID, setRevokeOnExit, addCleanupHook } from '../lib/cleanup.js';
 import { detectOS } from '../lib/platform.js';
 import { createSpinner, networkSpinner, typeText } from '../lib/animations.js';
@@ -277,6 +278,44 @@ async function startLocalHostDashboard(uid, password, serviceConfig, sessionStat
   const { default: open } = await import('open');
   const app = express();
   const startedAt = new Date().toISOString();
+  const decryptedClientCache = new Map();
+  const MAX_DECRYPTED_CLIENT_CACHE = 100;
+  const activeEventStreams = new Set();
+  const MAX_EVENT_STREAMS = 5;
+
+  async function fetchDecryptedClients() {
+    const brokerRes = await fetch(`${BROKER_URL}/clients/${uid}`, {
+      headers: sessionState.hostToken ? { 'x-host-token': sessionState.hostToken } : {}
+    });
+    if (!brokerRes.ok) {
+      const data = await brokerRes.json().catch(() => ({}));
+      throw new Error(data.error || 'Failed to fetch clients');
+    }
+    const data = await brokerRes.json();
+    const activeCacheKeys = new Set();
+    const decryptedClients = await Promise.all((data.clients || []).map(async (clientBlob) => {
+      const cacheKey = `${clientBlob.iv}:${clientBlob.salt}:${clientBlob.ciphertext}`;
+      activeCacheKeys.add(cacheKey);
+      const cached = decryptedClientCache.get(cacheKey);
+      if (cached) return { ...cached, seenAt: clientBlob.seenAt || null };
+      try {
+        const decrypted = await decryptAsync(clientBlob.iv, clientBlob.ciphertext, password, clientBlob.salt);
+        const t = JSON.parse(decrypted);
+        decryptedClientCache.set(cacheKey, t);
+        return { ...t, seenAt: clientBlob.seenAt || null };
+      } catch {
+        const failed = { error: 'decrypt_failed' };
+        decryptedClientCache.set(cacheKey, failed);
+        return { ...failed, seenAt: clientBlob.seenAt || null };
+      }
+    }));
+    for (const key of decryptedClientCache.keys()) {
+      if (!activeCacheKeys.has(key) || decryptedClientCache.size > MAX_DECRYPTED_CLIENT_CACHE) {
+        decryptedClientCache.delete(key);
+      }
+    }
+    return { clients: decryptedClients };
+  }
 
   app.get('/api/status', (_req, res) => {
     res.json({
@@ -293,47 +332,91 @@ async function startLocalHostDashboard(uid, password, serviceConfig, sessionStat
 
   app.use(express.json());
 
+  app.get('/api/approvals', async (_req, res) => {
+    try {
+      const data = await fetchApprovalRequests(BROKER_URL, uid, sessionState.hostToken);
+      res.json(data);
+    } catch (err) {
+      res.status(500).json({ error: err.message });
+    }
+  });
+
   // Server-Sent Events for live telemetry & approvals
   app.get('/api/events', async (req, res) => {
+    if (activeEventStreams.size >= MAX_EVENT_STREAMS) {
+      return res.status(503).json({ error: 'Too many dashboard event streams' });
+    }
+    activeEventStreams.add(res);
     res.set({ 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-cache', Connection: 'keep-alive' });
     res.flushHeaders?.();
 
     let closed = false;
-    const push = async () => {
+    let timer = null;
+    let intervalMs = 5000;
+    let unchangedCycles = 0;
+    let lastApprovals = '';
+    let lastClients = '';
+
+    const writeEvent = (event, payload) => {
+      if (closed) return;
+      res.write(`event: ${event}\n`);
+      res.write(`data: ${JSON.stringify(payload)}\n\n`);
+    };
+
+    const scheduleNext = () => {
+      if (closed) return;
+      timer = setTimeout(pushLoop, intervalMs);
+    };
+
+    const pushLoop = async () => {
       if (closed) return;
       try {
-        const data = await fetchApprovalRequests(BROKER_URL, uid, sessionState.hostToken).catch(() => ({ approvals: [] }));
-        res.write(`event: approvals\n`);
-        res.write(`data: ${JSON.stringify(data)}\n\n`);
-      } catch { }
+        const [approvalData, clientData] = await Promise.all([
+          fetchApprovalRequests(BROKER_URL, uid, sessionState.hostToken).catch(() => ({ approvals: [] })),
+          fetchDecryptedClients().catch(() => ({ clients: [] })),
+        ]);
+
+        const approvalsPayload = { approvals: approvalData.approvals || [] };
+        const clientsPayload = { clients: clientData.clients || [] };
+        const approvalsHash = JSON.stringify(approvalsPayload.approvals);
+        const clientsHash = JSON.stringify(clientsPayload.clients);
+        const changed = approvalsHash !== lastApprovals || clientsHash !== lastClients;
+
+        if (approvalsHash !== lastApprovals) {
+          writeEvent('approvals', approvalsPayload);
+          lastApprovals = approvalsHash;
+        }
+        if (clientsHash !== lastClients) {
+          writeEvent('clients', clientsPayload);
+          lastClients = clientsHash;
+        }
+
+        if (changed) {
+          unchangedCycles = 0;
+          intervalMs = 5000;
+        } else {
+          unchangedCycles += 1;
+          intervalMs = Math.min(20000, 5000 * (2 ** Math.min(2, unchangedCycles)));
+        }
+      } finally {
+        scheduleNext();
+      }
     };
 
-    const iv = setInterval(push, 5000);
-    req.on('close', () => { clearInterval(iv); closed = true; });
-    // send initial payload
-    await push();
+    req.on('close', () => {
+      closed = true;
+      activeEventStreams.delete(res);
+      if (timer) clearTimeout(timer);
+    });
+
+    writeEvent('ready', { ok: true });
+    await pushLoop();
   });
 
   app.get('/api/clients', async (_req, res) => {
     try {
-      const brokerRes = await fetch(`${BROKER_URL}/clients/${uid}`, {
-        headers: sessionState.hostToken ? { 'x-host-token': sessionState.hostToken } : {}
-      });
-      if (!brokerRes.ok) {
-        const data = await brokerRes.json().catch(() => ({}));
-        return res.status(brokerRes.status).json({ error: data.error || 'Failed to fetch clients' });
-      }
-      const data = await brokerRes.json();
-      const clients = (data.clients || []).map((clientBlob) => {
-        try {
-          const decrypted = decrypt(clientBlob.iv, clientBlob.ciphertext, password, clientBlob.salt);
-          const t = JSON.parse(decrypted);
-          return { ...t, seenAt: clientBlob.seenAt || null };
-        } catch {
-          return { error: 'decrypt_failed', seenAt: clientBlob.seenAt || null };
-        }
-      });
-      res.json({ clients });
+      const clients = await fetchDecryptedClients();
+      res.json(clients);
     } catch (err) {
       res.status(500).json({ error: err.message });
     }
@@ -486,12 +569,44 @@ updateUptime();
 
 // SSE for live updates
 const es = new EventSource('/api/events');
+let fallbackTimer = null;
+let fallbackDelay = 5000;
+
+function scheduleFallbackPoll() {
+  if (fallbackTimer) return;
+  fallbackTimer = setTimeout(async function pollFallback() {
+    fallbackTimer = null;
+    try {
+      const [approvalsRes, clientsRes] = await Promise.all([
+        fetch('/api/approvals'),
+        fetch('/api/clients')
+      ]);
+      if (approvalsRes.ok) renderApprovals((await approvalsRes.json()).approvals || []);
+      if (clientsRes.ok) renderClients((await clientsRes.json()).clients || []);
+    } catch {}
+    fallbackDelay = Math.min(20000, fallbackDelay * 2);
+    scheduleFallbackPoll();
+  }, fallbackDelay);
+}
+
+es.addEventListener('open', () => {
+  fallbackDelay = 5000;
+  if (fallbackTimer) clearTimeout(fallbackTimer);
+  fallbackTimer = null;
+});
+es.addEventListener('error', scheduleFallbackPoll);
 es.addEventListener('approvals', (e) => {
   try {
     const data = JSON.parse(e.data);
     renderApprovals(data.approvals || []);
   } catch {}
 });
+es.addEventListener('clients', (e) => {
+  try {
+    const data = JSON.parse(e.data);
+    renderClients(data.clients || []);
+  } catch {}
+});
 
 function renderApprovals(approvals) {
   const container = document.getElementById('approvals');
@@ -556,16 +671,6 @@ async function revokeSession() {
   } catch (err) { showToast('Error: ' + err.message); }
 }
 
-// Poll client telemetry (separate from SSE for simplicity)
-async function pollClients() {
-  try {
-    const res = await fetch('/api/clients');
-    if (!res.ok) return;
-    const data = await res.json();
-    renderClients(data.clients || []);
-  } catch {}
-}
- 
 function renderClients(clients) {
   const container = document.getElementById('clients');
   if (!clients || clients.length === 0) {
@@ -595,8 +700,6 @@ function renderClients(clients) {
   container.innerHTML = html;
 }
  
-setInterval(pollClients, 5000);
-pollClients();
 </script>
 </body></html>`);
  });
@@ -618,18 +721,67 @@ pollClients();
 async function spawnPrivateBroker() {
   console.log(chalk.yellow('\n  ⚠️  Public Broker is unreachable. Spawning Private Broker...'));
 
+  const packageRoot = path.resolve(__dirname, '../..');
+  const serverEntrypoint = path.join(__dirname, '../server.js');
+  const requireFromServer = createRequire(serverEntrypoint);
+  const requiredBrokerPackages = ['express', 'express-rate-limit', 'helmet'];
+  const missingPackages = requiredBrokerPackages.filter((pkg) => {
+    try {
+      requireFromServer.resolve(pkg);
+      return false;
+    } catch {
+      return true;
+    }
+  });
+
+  if (missingPackages.length > 0) {
+    console.log(chalk.yellow(`  ⚠️  Missing broker runtime packages: ${missingPackages.join(', ')}`));
+    const npmCmd = process.platform === 'win32' ? 'npm.cmd' : 'npm';
+    const installResult = await execa(
+      npmCmd,
+      ['install', '--no-save', '--no-audit', '--no-fund', ...missingPackages],
+      { cwd: packageRoot, reject: false, all: true }
+    );
+
+    if (installResult.exitCode !== 0) {
+      const installOutput = installResult.all?.trim();
+      throw new Error(
+        `Private broker dependencies failed to install (${missingPackages.join(', ')})`
+        + (installOutput ? `: ${installOutput}` : '')
+      );
+    }
+
+    // Verify modules are now resolvable for the server entrypoint context.
+    const unresolved = missingPackages.filter((pkg) => {
+      try {
+        requireFromServer.resolve(pkg);
+        return false;
+      } catch {
+        return true;
+      }
+    });
+    if (unresolved.length > 0) {
+      throw new Error(`Private broker dependencies are still missing after install: ${unresolved.join(', ')}`);
+    }
+  }
+
   // 1. Spawn the broker server process
-  const brokerProcess = execa('node', [path.join(__dirname, '../server.js')], {
+  const brokerProcess = execa('node', [serverEntrypoint], {
     env: { ...process.env, PORT: '4040' },
     reject: false,
     all: true,
+    buffer: false,
   });
   trackPID(brokerProcess.pid);
 
   let brokerExited = false;
-  let brokerOutput = '';
+  const maxBrokerOutputBytes = 64 * 1024;
+  let brokerOutput = Buffer.alloc(0);
   brokerProcess.all?.on('data', chunk => {
-    brokerOutput += chunk.toString();
+    const next = Buffer.concat([brokerOutput, Buffer.from(chunk)]);
+    brokerOutput = next.length > maxBrokerOutputBytes
+      ? next.subarray(next.length - maxBrokerOutputBytes)
+      : next;
   });
   brokerProcess.on('exit', () => {
     brokerExited = true;
@@ -643,7 +795,8 @@ async function spawnPrivateBroker() {
 
   await waitForValue(() => {
     if (brokerExited) {
-      throw new Error(`Private broker exited before tunnel was ready${brokerOutput ? `: ${brokerOutput.trim()}` : ''}`);
+      const output = brokerOutput.toString('utf8').trim();
+      throw new Error(`Private broker exited before tunnel was ready${output ? `: ${output}` : ''}`);
     }
     return brokerTunnelUrl;
   }, 30000, 'Private broker tunnel startup');
@@ -753,7 +906,7 @@ async function hostDashboard(uid, password, serviceConfig, tunnelProcess, sessio
             for (const request of pending) {
               let details = {};
               try {
-                details = JSON.parse(decrypt(request.iv, request.ciphertext, password, request.salt));
+                details = JSON.parse(await decryptAsync(request.iv, request.ciphertext, password, request.salt));
               } catch {
                 details = { error: 'Could not decrypt request metadata' };
               }
@@ -893,10 +1046,10 @@ async function hostDashboard(uid, password, serviceConfig, tunnelProcess, sessio
             } else {
               spinner.succeed(`Found ${data.clients.length} recent connection(s):`);
 
-              data.clients.forEach((clientBlob, i) => {
+              for (const [i, clientBlob] of data.clients.entries()) {
                 try {
                   // Decrypt using the unique salt the client generated for this payload
-                  const decrypted = decrypt(clientBlob.iv, clientBlob.ciphertext, password, clientBlob.salt);
+                  const decrypted = await decryptAsync(clientBlob.iv, clientBlob.ciphertext, password, clientBlob.salt);
                   const t = JSON.parse(decrypted);
 
                   console.log(chalk.bold.blue(`\n  Client #${i + 1} (${t.username})`));
@@ -910,7 +1063,7 @@ async function hostDashboard(uid, password, serviceConfig, tunnelProcess, sessio
                   console.log(chalk.yellow(`\n  Client #${i + 1}: Payload decryption failed (wrong password or corrupted).`));
                   logSessionEvent('host_telemetry_decrypt_failed', { index: i + 1 }, 'warn');
                 }
-              });
+              }
             }
           } catch (e) {
             spinner.fail('Could not reach broker.');

package/src/server.js

@@ -96,8 +96,8 @@ const hostLimiter = rateLimit({
 });
 
 // ─── Active Defense & IP Blacklisting (IDS) ──────────────────
-const ipViolations = new Map(); // ip → violation_count
-const blacklistedIPs = new Set();
+const ipViolations = new Map(); // ip → { count, lastSeen }
+const blacklistedIPs = new Map(); // ip → bannedAt
 const VIOLATION_THRESHOLD = 5; // Block IP after 5 malicious requests
 
 app.use((req, res, next) => {
@@ -111,12 +111,12 @@ app.use((req, res, next) => {
 
 function recordViolation(req) {
   const ip = req.ip || req.connection.remoteAddress;
-  const count = (ipViolations.get(ip) || 0) + 1;
-  ipViolations.set(ip, count);
+  const count = (ipViolations.get(ip)?.count || 0) + 1;
+  ipViolations.set(ip, { count, lastSeen: Date.now() });
   console.warn(`🚨 Violation recorded for IP ${ip} (${count}/${VIOLATION_THRESHOLD})`);
   
   if (count >= VIOLATION_THRESHOLD) {
-    blacklistedIPs.add(ip);
+    blacklistedIPs.set(ip, Date.now());
     console.error(`💥 HACKING DETECTED: Auto-banned IP ${ip} to defend server.`);
   }
 }
@@ -126,9 +126,19 @@ const TTL_MS = 60 * 60 * 1000; // 1 hour
 const MAX_UIDS = 50000;        // Max concurrent tunnels (prevent memory leak)
 const MAX_VIOLATIONS = 50000;  // Max tracked malicious IPs before reset
 const MAX_RESOLVES_PER_UID = 100; // Max resolves before auto-revoke (anti-scraping)
+const MAX_APPROVALS_PER_UID = 50;
+const MAX_CLIENTS_PER_UID = 50;
+const configuredPayloadMb = Number.parseInt(process.env.BROKER_MAX_PAYLOAD_MB || '64', 10);
+const MAX_BUFFERED_PAYLOAD_BYTES = (
+  Number.isFinite(configuredPayloadMb) && configuredPayloadMb > 0 ? configuredPayloadMb : 64
+) * 1024 * 1024;
+const APPROVAL_TTL_MS = TTL_MS;
+const TELEMETRY_TTL_MS = 30 * 60 * 1000;
+const VIOLATION_TTL_MS = 24 * 60 * 60 * 1000;
 const BROKER_SECRET = process.env.BROKER_HMAC_SECRET || crypto.randomBytes(32).toString('hex');
 
 const store = new Map(); // uid → { iv, ciphertext, salt, createdAt, clients: [], approvals: [], hostToken, resolveCount }
+let bufferedPayloadBytes = 0;
 
 // ─── Security Helpers ────────────────────────────────────────
 const SAFE_PARAM = /^[a-zA-Z0-9_-]{1,64}$/;
@@ -161,22 +171,61 @@ function isEncryptedPayload(body) {
     && /^[A-Za-z0-9+/]+={0,2}$/.test(body.ciphertext);
 }
 
+function encryptedPayloadBytes(payload) {
+  return Buffer.byteLength(payload?.ciphertext || '')
+    + Buffer.byteLength(payload?.iv || '')
+    + Buffer.byteLength(payload?.salt || '');
+}
+
+function entryPayloadBytes(entry) {
+  if (!entry) return 0;
+  return encryptedPayloadBytes(entry)
+    + entry.clients.reduce((sum, item) => sum + encryptedPayloadBytes(item), 0)
+    + entry.approvals.reduce((sum, item) => sum + encryptedPayloadBytes(item), 0);
+}
+
+function deleteStoreEntry(uid) {
+  const entry = store.get(uid);
+  if (!entry) return false;
+  bufferedPayloadBytes = Math.max(0, bufferedPayloadBytes - entryPayloadBytes(entry));
+  return store.delete(uid);
+}
+
 function pruneExpired() {
   const now = Date.now();
   for (const [uid, entry] of store) {
     if (now - entry.createdAt > TTL_MS) {
-      store.delete(uid);
+      deleteStoreEntry(uid);
       console.log(`🗑️  Expired UID: ${uid}`);
+      continue;
     }
+    const previousBytes = entryPayloadBytes(entry);
+    entry.approvals = entry.approvals
+      .filter(item => now - item.createdAt <= APPROVAL_TTL_MS)
+      .slice(-MAX_APPROVALS_PER_UID);
+    entry.clients = entry.clients
+      .filter(item => now - item.seenAt <= TELEMETRY_TTL_MS)
+      .slice(-MAX_CLIENTS_PER_UID);
+    bufferedPayloadBytes = Math.max(0, bufferedPayloadBytes - previousBytes + entryPayloadBytes(entry));
   }
 
-  // Strict check to prevent malicious OOM overflow
-  if (ipViolations.size > MAX_VIOLATIONS) ipViolations.clear();
-  if (blacklistedIPs.size > MAX_VIOLATIONS) blacklistedIPs.clear();
+  for (const [ip, violation] of ipViolations) {
+    if (now - violation.lastSeen > VIOLATION_TTL_MS) ipViolations.delete(ip);
+  }
+  for (const [ip, bannedAt] of blacklistedIPs) {
+    if (now - bannedAt > VIOLATION_TTL_MS) blacklistedIPs.delete(ip);
+  }
+  while (ipViolations.size > MAX_VIOLATIONS) {
+    ipViolations.delete(ipViolations.keys().next().value);
+  }
+  while (blacklistedIPs.size > MAX_VIOLATIONS) {
+    blacklistedIPs.delete(blacklistedIPs.keys().next().value);
+  }
 }
 
 // Run pruning every 5 minutes
-setInterval(pruneExpired, 5 * 60 * 1000);
+const pruneTimer = setInterval(pruneExpired, 5 * 60 * 1000);
+pruneTimer.unref?.();
 
 // ─── Routes ──────────────────────────────────────────────────
 
@@ -227,6 +276,11 @@ app.post('/register', strictLimiter, (req, res) => {
     if (store.size >= MAX_UIDS && !store.has(uid)) {
       return res.status(503).json({ error: 'Broker is at maximum capacity. Please try again later.' });
     }
+    const incomingBytes = encryptedPayloadBytes({ iv, ciphertext, salt });
+    const replacedBytes = entryPayloadBytes(store.get(uid));
+    if (bufferedPayloadBytes - replacedBytes + incomingBytes > MAX_BUFFERED_PAYLOAD_BYTES) {
+      return res.status(503).json({ error: 'Broker encrypted payload capacity reached. Please try again later.' });
+    }
 
     // Use provided host token if valid; otherwise generate a fresh one
     const hostToken = (typeof providedHostToken === 'string' && HOST_TOKEN_FORMAT.test(providedHostToken))
@@ -234,6 +288,7 @@ app.post('/register', strictLimiter, (req, res) => {
       : generateHostToken(uid + Date.now().toString());
 
     // Store the encrypted blob as-is — broker NEVER decrypts
+    if (store.has(uid)) deleteStoreEntry(uid);
     store.set(uid, {
       iv,
       ciphertext,
@@ -246,6 +301,7 @@ app.post('/register', strictLimiter, (req, res) => {
       hostToken,
       resolveCount: 0,
     });
+    bufferedPayloadBytes += incomingBytes;
 
     console.log(`✅ [${new Date().toLocaleTimeString()}] Registered UID: ${uid} (encrypted, ${ciphertext.length} bytes)`);
     // Return host token — this is the ONLY time it's sent; host must store it
@@ -277,19 +333,19 @@ app.get('/resolve/:uid', generalLimiter, (req, res) => {
 
     // Check TTL
     if (Date.now() - entry.createdAt > TTL_MS) {
-      store.delete(uid);
+      deleteStoreEntry(uid);
       return res.status(410).json({ error: 'UID expired' });
     }
 
     // Enforce one-time sharing: check BEFORE sending response (prevents race condition)
     if (entry.oneTime && entry.resolveCount > 0) {
-      store.delete(uid);
+      deleteStoreEntry(uid);
       return res.status(410).json({ error: 'One-time session already consumed' });
     }
 
     // Anti-scraping: cap total resolves per UID
     if (entry.resolveCount >= MAX_RESOLVES_PER_UID) {
-      store.delete(uid);
+      deleteStoreEntry(uid);
       return res.status(429).json({ error: 'Resolve limit exceeded — session revoked for security' });
     }
 
@@ -315,7 +371,7 @@ app.get('/resolve/:uid', generalLimiter, (req, res) => {
 
     // Enforce one-time sharing: auto-delete AFTER response sent
     if (entry.oneTime) {
-      store.delete(uid);
+      deleteStoreEntry(uid);
       console.log(`🔒 [${new Date().toLocaleTimeString()}] One-time UID ${uid} auto-revoked after first resolve`);
     }
   } catch (err) {
@@ -354,8 +410,18 @@ app.post('/approval-request/:uid', generalLimiter, (req, res) => {
       decidedAt: entry.approvalRequired ? null : Date.now(),
     };
 
+    const requestBytes = encryptedPayloadBytes(request);
+    const replacedBytes = entry.approvals.length >= MAX_APPROVALS_PER_UID
+      ? encryptedPayloadBytes(entry.approvals[0])
+      : 0;
+    if (bufferedPayloadBytes - replacedBytes + requestBytes > MAX_BUFFERED_PAYLOAD_BYTES) {
+      return res.status(503).json({ error: 'Broker encrypted payload capacity reached. Please try again later.' });
+    }
     entry.approvals.push(request);
-    if (entry.approvals.length > 50) entry.approvals.shift();
+    bufferedPayloadBytes += requestBytes;
+    if (entry.approvals.length > MAX_APPROVALS_PER_UID) {
+      bufferedPayloadBytes -= encryptedPayloadBytes(entry.approvals.shift());
+    }
     res.json({ requestId: id, status: request.status, approvalRequired: entry.approvalRequired });
   } catch {
     res.status(500).json({ error: 'Internal server error' });
@@ -426,10 +492,21 @@ app.post('/client-info/:uid', generalLimiter, (req, res) => {
       return res.status(400).json({ error: 'Invalid encrypted telemetry payload' });
     }
 
-    entry.clients.push({ iv: req.body.iv, ciphertext: req.body.ciphertext, salt: req.body.salt, seenAt: Date.now() });
+    const clientRecord = { iv: req.body.iv, ciphertext: req.body.ciphertext, salt: req.body.salt, seenAt: Date.now() };
+    const clientBytes = encryptedPayloadBytes(clientRecord);
+    const replacedBytes = entry.clients.length >= MAX_CLIENTS_PER_UID
+      ? encryptedPayloadBytes(entry.clients[0])
+      : 0;
+    if (bufferedPayloadBytes - replacedBytes + clientBytes > MAX_BUFFERED_PAYLOAD_BYTES) {
+      return res.status(503).json({ error: 'Broker encrypted payload capacity reached. Please try again later.' });
+    }
+    entry.clients.push(clientRecord);
+    bufferedPayloadBytes += clientBytes;
     
     // Keep max 50 recent client pings to prevent memory leaks
-    if (entry.clients.length > 50) entry.clients.shift();
+    if (entry.clients.length > MAX_CLIENTS_PER_UID) {
+      bufferedPayloadBytes -= encryptedPayloadBytes(entry.clients.shift());
+    }
 
     res.json({ status: 'ok' });
   } catch (err) {
@@ -470,7 +547,7 @@ app.delete('/revoke/:uid', strictLimiter, (req, res) => {
   const entry = store.get(uid);
   if (!entry) return res.json({ status: 'not_found' });
   if (!requireHostToken(req, res, entry)) return;
-  store.delete(uid);
+  deleteStoreEntry(uid);
   console.log(`🚫 [${new Date().toLocaleTimeString()}] Revoked UID: ${uid} (authenticated)`);
   res.json({ status: 'revoked' });
 });