@miraj181/ipingyou 2.1.9 → 2.1.18

package/src/lib/session-log.js

@@ -6,13 +6,47 @@ import { redactSensitive } from './ai/safety.js';
 const LOG_DIR = path.join(os.homedir(), '.ipingyou', 'logs');
 const LOG_FILE = path.join(LOG_DIR, 'session-events.jsonl');
 const SESSION_LOG_DIR = path.join(os.tmpdir(), 'ipingyou-session-logs');
+const MAX_HISTORY_LOG_BYTES = 5 * 1024 * 1024;
+const MAX_SESSION_LOG_BYTES = 2 * 1024 * 1024;
+const MAX_LOG_STRING_LENGTH = 16 * 1024;
+const SESSION_LOG_FLUSH_BYTES = 64 * 1024;
+const SESSION_LOG_FLUSH_MS = 250;
 
 let sessionLogPath = null;
 let sessionLogDisabled = false;
 let cleanupRegistered = false;
+let sessionLogBytes = 0;
+let historyLogBytes = null;
+let sessionLogBuffer = '';
+let sessionLogFlushTimer = null;
+
+function flushSessionLog() {
+  if (sessionLogFlushTimer) clearTimeout(sessionLogFlushTimer);
+  sessionLogFlushTimer = null;
+  if (!sessionLogPath || !sessionLogBuffer) return;
+  const buffered = sessionLogBuffer;
+  sessionLogBuffer = '';
+  try {
+    fs.appendFileSync(sessionLogPath, buffered, { mode: 0o600 });
+  } catch (err) {
+    sessionLogDisabled = true;
+    console.error(`Session log write failed: ${err.message}`);
+  }
+}
+
+function scheduleSessionLogFlush() {
+  if (sessionLogFlushTimer) return;
+  sessionLogFlushTimer = setTimeout(flushSessionLog, SESSION_LOG_FLUSH_MS);
+  sessionLogFlushTimer.unref?.();
+}
 
 function sanitize(value) {
-  if (typeof value === 'string') return redactSensitive(value);
+  if (typeof value === 'string') {
+    const redacted = redactSensitive(value);
+    return redacted.length > MAX_LOG_STRING_LENGTH
+      ? `${redacted.slice(0, MAX_LOG_STRING_LENGTH)}…[truncated]`
+      : redacted;
+  }
   if (Array.isArray(value)) return value.map(sanitize);
   if (value && typeof value === 'object') {
     return Object.fromEntries(
@@ -28,11 +62,23 @@ export function initSessionLog(scope = 'session') {
   if (sessionLogPath || sessionLogDisabled) return sessionLogPath;
   try {
     fs.mkdirSync(SESSION_LOG_DIR, { recursive: true, mode: 0o700 });
+    const staleBefore = Date.now() - (24 * 60 * 60 * 1000);
+    for (const name of fs.readdirSync(SESSION_LOG_DIR)) {
+      if (!name.startsWith('ipingyou-')) continue;
+      const candidate = path.join(SESSION_LOG_DIR, name);
+      try {
+        if (fs.statSync(candidate).mtimeMs < staleBefore) fs.unlinkSync(candidate);
+      } catch {
+        // Best-effort cleanup; another process may own or remove the file.
+      }
+    }
     sessionLogPath = path.join(
       SESSION_LOG_DIR,
       `ipingyou-${scope}-${Date.now()}-${process.pid}.log`
     );
     fs.writeFileSync(sessionLogPath, '', { mode: 0o600 });
+    sessionLogBytes = 0;
+    sessionLogBuffer = '';
     if (!cleanupRegistered) {
       process.on('exit', () => cleanupSessionLog());
       cleanupRegistered = true;
@@ -59,7 +105,19 @@ export function logSessionEvent(type, details = {}, level = 'info') {
     details: sanitize(details),
   };
   try {
-    fs.appendFileSync(sessionLogPath, `${JSON.stringify(entry)}\n`, { mode: 0o600 });
+    const line = `${JSON.stringify(entry)}\n`;
+    const lineBytes = Buffer.byteLength(line);
+    if (sessionLogBytes + lineBytes > MAX_SESSION_LOG_BYTES) {
+      sessionLogDisabled = true;
+      return;
+    }
+    sessionLogBuffer += line;
+    sessionLogBytes += lineBytes;
+    if (Buffer.byteLength(sessionLogBuffer) >= SESSION_LOG_FLUSH_BYTES) {
+      flushSessionLog();
+    } else {
+      scheduleSessionLogFlush();
+    }
   } catch (err) {
     sessionLogDisabled = true;
     console.error(`Session log write failed: ${err.message}`);
@@ -68,6 +126,7 @@ export function logSessionEvent(type, details = {}, level = 'info') {
 
 export function cleanupSessionLog() {
   if (!sessionLogPath) return;
+  flushSessionLog();
   const target = sessionLogPath;
   sessionLogPath = null;
   try {
@@ -85,7 +144,23 @@ export function recordEvent(type, details = {}) {
       type,
       details: sanitize(details),
     };
-    fs.appendFileSync(LOG_FILE, `${JSON.stringify(event)}\n`, { mode: 0o600 });
+    const line = `${JSON.stringify(event)}\n`;
+    const lineBytes = Buffer.byteLength(line);
+    if (historyLogBytes === null) {
+      historyLogBytes = fs.existsSync(LOG_FILE) ? fs.statSync(LOG_FILE).size : 0;
+    }
+    if (historyLogBytes + lineBytes > MAX_HISTORY_LOG_BYTES) {
+      const previousLog = `${LOG_FILE}.1`;
+      try {
+        if (fs.existsSync(previousLog)) fs.unlinkSync(previousLog);
+        if (fs.existsSync(LOG_FILE)) fs.renameSync(LOG_FILE, previousLog);
+      } catch {
+        fs.writeFileSync(LOG_FILE, '', { mode: 0o600 });
+      }
+      historyLogBytes = 0;
+    }
+    fs.appendFileSync(LOG_FILE, line, { mode: 0o600 });
+    historyLogBytes += lineBytes;
     logSessionEvent(type, details);
   } catch {
     // Session recording is best-effort.

package/src/lib/socket-firewall.js

@@ -0,0 +1,34 @@
+import { execa } from 'execa';
+
+export async function getSocketFirewallStatus() {
+  try {
+    const result = await execa('sfw', ['--version'], {
+      reject: false,
+      timeout: 15000,
+      maxBuffer: 64 * 1024,
+      env: { ...process.env, SFW_SKIP_UPDATE_CHECK: '1' },
+    });
+    return {
+      available: result.exitCode === 0,
+      version: String(result.stdout || result.stderr || '').trim() || null,
+    };
+  } catch {
+    return { available: false, version: null };
+  }
+}
+
+export async function runProtectedNpmInstall(args, options = {}) {
+  const status = await getSocketFirewallStatus();
+  if (!status.available) {
+    throw new Error(
+      'Socket Firewall is required for package installation. '
+      + 'Install it first with: npm install -g sfw'
+    );
+  }
+
+  return execa('sfw', ['npm', 'install', ...args], {
+    ...options,
+    reject: true,
+    env: { ...process.env, ...options.env },
+  });
+}

package/src/lib/ssh.js

@@ -1,11 +1,26 @@
 import crypto from 'node:crypto';
 
+const SAFE_HOSTNAME_PATTERN = /^(?=.{1,253}$)(?!.*\.\.)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/i;
+
+export function assertSafeHostname(hostname, label = 'hostname') {
+  const normalized = String(hostname || '').trim().replace(/\.$/, '').toLowerCase();
+  if (!normalized || !SAFE_HOSTNAME_PATTERN.test(normalized)) {
+    throw new Error(`Invalid ${label}`);
+  }
+  return normalized;
+}
+
 export function extractHostname(url) {
+  let parsed;
   try {
-    return new URL(url).hostname;
+    parsed = new URL(url);
   } catch {
-    return url.replace(/^https?:\/\//, '').replace(/\/$/, '');
+    throw new Error('Invalid tunnel URL');
+  }
+  if (parsed.protocol !== 'https:') {
+    throw new Error('Tunnel URL must use HTTPS');
   }
+  return assertSafeHostname(parsed.hostname, 'tunnel hostname');
 }
 
 export function quoteRemoteShell(value) {
@@ -21,12 +36,19 @@ export function formatRemoteCd(remotePath) {
 export function formatScpRemotePath(remotePath) {
   const trimmed = String(remotePath || '').trim();
   if (!trimmed || trimmed === '~') return trimmed || '~';
-  return trimmed;
+  if (/[\u0000\r\n]/.test(trimmed) || trimmed.length > 4096) {
+    throw new Error('Invalid remote path');
+  }
+  if (trimmed.startsWith('~/')) {
+    return `~/${quoteRemoteShell(trimmed.slice(2))}`;
+  }
+  return quoteRemoteShell(trimmed);
 }
 
 export function getSshControlOptions(hostname) {
+  const safeHostname = assertSafeHostname(hostname, 'ssh hostname');
   if (process.platform === 'win32') return [];
-  const hash = crypto.createHash('sha256').update(hostname).digest('hex').slice(0, 10);
+  const hash = crypto.createHash('sha256').update(safeHostname).digest('hex').slice(0, 10);
   return [
     '-o', 'ControlMaster=auto',
     '-o', 'ControlPersist=5m',
@@ -34,6 +56,11 @@ export function getSshControlOptions(hostname) {
   ];
 }
 
+export function buildProxyCommandOption(hostname) {
+  const safeHostname = assertSafeHostname(hostname, 'tunnel hostname');
+  return ['-o', `ProxyCommand=cloudflared access tcp --hostname ${safeHostname}`];
+}
+
 export function getKnownHostsOptions(persistKnownHosts = true) {
   if (persistKnownHosts) {
     return ['-o', 'StrictHostKeyChecking=accept-new'];
@@ -48,9 +75,8 @@ export function getKnownHostsOptions(persistKnownHosts = true) {
 
 export function buildSshArgs(hostname, privateKeyPath, extraOptions = [], options = {}) {
   const { persistKnownHosts = true } = options;
-  const proxyCommand = `cloudflared access tcp --hostname ${hostname}`;
   const sshArgs = [
-    '-o', `ProxyCommand=${proxyCommand}`,
+    ...buildProxyCommandOption(hostname),
     ...getKnownHostsOptions(persistKnownHosts),
     '-o', 'IdentitiesOnly=yes',
     ...getSshControlOptions(hostname),

package/src/lib/tunnel.js

@@ -15,6 +15,7 @@ export async function spawnTunnelSupervised(targetUrl, onUrlGenerated) {
         activeChild = execa('cloudflared', ['tunnel', '--url', targetUrl], {
           reject: false,
           all: true,
+          buffer: false,
         });
 
         trackPID(activeChild.pid);

package/src/lib/uid.js

@@ -8,16 +8,19 @@
  * ============================================================
  */
 
-import { customAlphabet } from 'nanoid';
+import crypto from 'node:crypto';
 
 // Use lowercase alphanumeric only — easy to share verbally
 const alphabet = 'abcdefghijklmnopqrstuvwxyz0123456789';
-const generate = customAlphabet(alphabet, 8);
 
 /**
  * Generate a random 8-character session UID.
  * @returns {string}
  */
 export function generateUID() {
-  return generate();
+  let uid = '';
+  for (let index = 0; index < 8; index += 1) {
+    uid += alphabet[crypto.randomInt(0, alphabet.length)];
+  }
+  return uid;
 }

package/src/lib/worker-runtime.js

@@ -0,0 +1,81 @@
+import { Worker } from 'node:worker_threads';
+
+const workerUrl = new URL('./workers/crypto-checksum-worker.js', import.meta.url);
+const workersDisabled = process.env.IPINGYOU_DISABLE_WORKERS === '1';
+const MAX_PENDING_TASKS = 128;
+
+let worker = null;
+let requestCounter = 0;
+const pending = new Map();
+
+function resetWorker(err) {
+  for (const { reject } of pending.values()) {
+    reject(err);
+  }
+  pending.clear();
+  worker = null;
+}
+
+function ensureWorker() {
+  if (worker || workersDisabled) return worker;
+
+  worker = new Worker(workerUrl, {
+    resourceLimits: {
+      maxOldGenerationSizeMb: 128,
+    },
+  });
+  worker.unref();
+
+  worker.on('message', (message) => {
+    const { id, ok, result, error } = message || {};
+    const entry = pending.get(id);
+    if (!entry) return;
+    pending.delete(id);
+    if (pending.size === 0) worker?.unref();
+    if (ok) {
+      entry.resolve(result);
+      return;
+    }
+    entry.reject(new Error(error || 'Worker task failed'));
+  });
+
+  worker.on('error', (err) => {
+    resetWorker(err);
+  });
+
+  worker.on('exit', (code) => {
+    if (code !== 0) {
+      resetWorker(new Error(`Worker exited with code ${code}`));
+    } else {
+      worker = null;
+    }
+  });
+
+  return worker;
+}
+
+export function canUseWorkers() {
+  return !workersDisabled;
+}
+
+export function runWorkerTask(type, payload) {
+  if (!canUseWorkers()) {
+    throw new Error('Worker threads are disabled');
+  }
+  const activeWorker = ensureWorker();
+  if (!activeWorker) {
+    throw new Error('Worker is not available');
+  }
+  if (pending.size >= MAX_PENDING_TASKS) {
+    const error = new Error('Worker task queue is at capacity');
+    error.code = 'WORKER_QUEUE_FULL';
+    throw error;
+  }
+
+  const id = ++requestCounter;
+  return new Promise((resolve, reject) => {
+    pending.set(id, { resolve, reject });
+    activeWorker.ref();
+    activeWorker.postMessage({ id, type, payload });
+  });
+}

package/src/lib/workers/crypto-checksum-worker.js

@@ -0,0 +1,70 @@
+import { parentPort } from 'node:worker_threads';
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+
+function deriveKey(password, salt) {
+  return crypto.pbkdf2Sync(password, salt, 100000, 32, 'sha256');
+}
+
+function encryptPayload(plaintext, password) {
+  const salt = crypto.randomBytes(16);
+  const key = deriveKey(password, salt);
+  const iv = crypto.randomBytes(16);
+
+  const cipher = crypto.createCipheriv('aes-256-cbc', key, iv);
+  let enc = cipher.update(plaintext, 'utf8', 'base64');
+  enc += cipher.final('base64');
+
+  return {
+    iv: iv.toString('hex'),
+    ciphertext: enc,
+    salt: salt.toString('hex'),
+  };
+}
+
+function decryptPayload(ivHex, cipherBase64, password, saltHex) {
+  const salt = Buffer.from(saltHex, 'hex');
+  const key = deriveKey(password, salt);
+  const iv = Buffer.from(ivHex, 'hex');
+  const decipher = crypto.createDecipheriv('aes-256-cbc', key, iv);
+  let dec = decipher.update(cipherBase64, 'base64', 'utf8');
+  dec += decipher.final('utf8');
+  return dec;
+}
+
+function checksumFile(filePath) {
+  return new Promise((resolve, reject) => {
+    const hash = crypto.createHash('sha256');
+    const stream = fs.createReadStream(filePath);
+    stream.on('error', reject);
+    stream.on('data', (chunk) => hash.update(chunk));
+    stream.on('end', () => resolve(hash.digest('hex')));
+  });
+}
+
+async function executeTask(type, payload) {
+  switch (type) {
+    case 'encrypt':
+      return encryptPayload(payload.plaintext, payload.password);
+    case 'decrypt':
+      return {
+        plaintext: decryptPayload(payload.ivHex, payload.cipherBase64, payload.password, payload.saltHex),
+      };
+    case 'checksum':
+      return {
+        digest: await checksumFile(payload.filePath),
+      };
+    default:
+      throw new Error(`Unsupported worker task: ${type}`);
+  }
+}
+
+parentPort.on('message', async (message) => {
+  const { id, type, payload } = message || {};
+  try {
+    const result = await executeTask(type, payload || {});
+    parentPort.postMessage({ id, ok: true, result });
+  } catch (err) {
+    parentPort.postMessage({ id, ok: false, error: err.message });
+  }
+});

package/src/modes/ai.js

@@ -3,7 +3,6 @@
  */
 
 import { execa } from 'execa';
-import { parse as shellParse } from 'shell-quote';
 import chalk from 'chalk';
 import inquirer from 'inquirer';
 import fs from 'node:fs';
@@ -11,13 +10,13 @@ import os from 'node:os';
 import path from 'node:path';
 import { getAlias } from '../lib/config.js';
 import { resolveUID } from '../lib/broker.js';
-import { buildSshArgs, extractHostname } from '../lib/ssh.js';
+import { buildSshArgs, extractHostname, quoteRemoteShell } from '../lib/ssh.js';
 import { addCleanupHook, cleanupAll } from '../lib/cleanup.js';
 import { startHostMode } from './host.js';
 import { startClientMode } from './client.js';
 import { performSCPNonInteractive } from './client.js';
 import { DEFAULT_AI_MODEL, createGroqChatCompletion, getGroqApiKey, getRateLimitWarnings, listGroqModels, estimateTokensForMessages } from '../lib/ai/groq.js';
-import { classifyCommand, redactSensitive, sanitizeUserTask, truncateForModel } from '../lib/ai/safety.js';
+import { assertSafeReadablePath, classifyCommand, redactSensitive, sanitizeUserTask, truncateForModel } from '../lib/ai/safety.js';
 import { recordEvent } from '../lib/session-log.js';
 
 let BROKER_URL = process.env.BROKER_URL || 'https://ipingyou.onrender.com';
@@ -139,13 +138,8 @@ async function confirmCommand(scope, command, reason, classification) {
     return false;
   }
 
-  if (!classification.needsApproval) {
-    console.log(chalk.dim(`  AI tool: ${scope} $ ${command}`));
-    return true;
-  }
-
   console.log('');
-  console.log(chalk.yellow('  AI wants to run a command that needs approval:'));
+  console.log(chalk.yellow('  AI wants to run a command:'));
   console.log(chalk.dim(`  Scope:  ${scope}`));
   console.log(chalk.dim(`  Reason: ${reason || classification.reason}`));
   console.log(chalk.cyan(`  ${command}`));
@@ -160,13 +154,27 @@ async function confirmCommand(scope, command, reason, classification) {
   return allow;
 }
 
+async function confirmFileRead(scope, filePath) {
+  console.log('');
+  console.log(chalk.yellow('  AI wants to read a text file and send redacted content to Groq:'));
+  console.log(chalk.dim(`  Scope: ${scope}`));
+  console.log(chalk.cyan(`  ${filePath}`));
+  const { allow } = await inquirer.prompt([{
+    type: 'confirm',
+    name: 'allow',
+    message: 'Allow this file read?',
+    default: false,
+  }]);
+  return allow;
+}
+
 function matchAppAction(task) {
   const lowered = String(task || '').toLowerCase();
   if (/\b(panic|self[- ]?destruct|wipe traces)\b/i.test(lowered)) {
     return {
       id: 'panic_blocked',
-      label: 'Panic mode',
-      description: 'Panic mode is intentionally not launched from AI mode. Run `ipingyou panic` directly if you mean it.',
+      label: 'Emergency shutdown',
+      description: 'Emergency shutdown is never launched from AI mode. Run `ipingyou panic` directly and confirm it locally.',
       blocked: true,
     };
   }
@@ -211,9 +219,7 @@ function showRateLimitWarnings(rateLimit) {
 }
 
 async function runLocalCommand(command) {
-  const parsed = shellParse(command);
-  // Filter out non-string tokens (shell operators like |, &&, ; etc.) to prevent injection
-  const args = parsed.filter(token => typeof token === 'string');
+  const args = parseLocalCommand(command);
   if (args.length === 0) {
     return { exitCode: 1, stdout: '', stderr: 'Empty or unsafe command after parsing' };
   }
@@ -230,6 +236,57 @@ async function runLocalCommand(command) {
   };
 }
 
+export function parseLocalCommand(command) {
+  const input = String(command || '');
+  if (!input || input.length > 8192 || /[\u0000\r\n]/.test(input)) {
+    throw new Error('Command is empty, too long, or contains control characters');
+  }
+
+  const args = [];
+  let current = '';
+  let quote = null;
+  let tokenStarted = false;
+
+  for (let index = 0; index < input.length; index += 1) {
+    const char = input[index];
+    if (quote) {
+      if (char === quote) {
+        quote = null;
+      } else if (char === '\\' && quote === '"' && index + 1 < input.length) {
+        current += input[++index];
+      } else {
+        current += char;
+      }
+      tokenStarted = true;
+      continue;
+    }
+
+    if (char === "'" || char === '"') {
+      quote = char;
+      tokenStarted = true;
+    } else if (/\s/.test(char)) {
+      if (tokenStarted) {
+        args.push(current);
+        current = '';
+        tokenStarted = false;
+      }
+    } else if (char === '\\') {
+      if (index + 1 >= input.length) throw new Error('Command ends with an incomplete escape');
+      current += input[++index];
+      tokenStarted = true;
+    } else if (/[;&|`$()<>]/.test(char)) {
+      throw new Error('Local AI commands do not support shell operators');
+    } else {
+      current += char;
+      tokenStarted = true;
+    }
+  }
+
+  if (quote) throw new Error('Command contains an unterminated quote');
+  if (tokenStarted) args.push(current);
+  return args;
+}
+
 async function runRemoteCommand(context, command) {
   const sshArgs = buildSshArgs(context.hostname, context.privateKeyPath);
   sshArgs.push(`${context.username}@${context.hostname}`, command);
@@ -246,24 +303,34 @@ async function runRemoteCommand(context, command) {
   };
 }
 
-function assertReadablePath(filePath) {
-  const classification = classifyCommand(`cat ${filePath}`);
-  if (classification.blocked) {
-    throw new Error(classification.reason);
-  }
-}
-
 async function readLocalTextFile(filePath) {
-  assertReadablePath(filePath);
-  const stat = fs.statSync(filePath);
+  const requestedPath = assertSafeReadablePath(filePath);
+  const expandedPath = requestedPath === '~'
+    ? os.homedir()
+    : requestedPath.replace(/^~(?=[/\\])/, os.homedir());
+  const resolvedPath = fs.realpathSync(path.resolve(expandedPath));
+  assertSafeReadablePath(resolvedPath);
+  const stat = fs.statSync(resolvedPath);
   if (!stat.isFile()) throw new Error('Path is not a file');
   if (stat.size > 256 * 1024) throw new Error('File is too large for AI mode; use a targeted command instead');
-  return redactSensitive(fs.readFileSync(filePath, 'utf8'));
+  return redactSensitive(fs.readFileSync(resolvedPath, 'utf8'));
 }
 
 async function readRemoteTextFile(context, filePath) {
-  assertReadablePath(filePath);
-  return runRemoteCommand(context, `python3 - <<'PY'\nfrom pathlib import Path\np=Path(${JSON.stringify(filePath)})\nif not p.is_file(): raise SystemExit('Path is not a file')\nif p.stat().st_size > 262144: raise SystemExit('File is too large for AI mode')\nprint(p.read_text(errors='replace'), end='')\nPY`);
+  const safePath = assertSafeReadablePath(filePath);
+  const script = [
+    'import pathlib, sys',
+    'p = pathlib.Path(sys.argv[1]).expanduser().resolve()',
+    'parts = {part.lower() for part in p.parts}',
+    "blocked = {'.ssh','.gnupg','.aws','.ipingyou','.kube','.docker'}",
+    "name = p.name.lower()",
+    "if parts & blocked or name in {'.npmrc','.netrc','.pypirc','credentials','credentials.json','known_hosts','authorized_keys','shadow','sudoers'} or name.startswith('.env') or name in {'id_rsa','id_dsa','id_ecdsa','id_ed25519'}: raise SystemExit('Protected path')",
+    "if not p.is_file(): raise SystemExit('Path is not a file')",
+    "if p.stat().st_size > 262144: raise SystemExit('File is too large for AI mode')",
+    "sys.stdout.write(p.read_text(errors='replace'))",
+  ].join('\n');
+  const command = `python3 -c ${quoteRemoteShell(script)} -- ${quoteRemoteShell(safePath)}`;
+  return runRemoteCommand(context, command);
 }
 
 async function setupRemoteContext() {
@@ -391,6 +458,15 @@ async function executeToolCall(context, call) {
   if (name === 'read_text_file') {
     const filePath = String(args.filePath || '').trim();
     if (!filePath) return buildToolResult({ ok: false, error: 'Missing filePath' });
+    try {
+      assertSafeReadablePath(filePath);
+    } catch (err) {
+      return buildToolResult({ ok: false, blocked: true, error: err.message });
+    }
+    if (!await confirmFileRead(context.scope, filePath)) {
+      return buildToolResult({ ok: false, blocked: true, error: 'User denied file access' });
+    }
+    recordEvent('ai_file_read_approved', { scope: context.scope });
 
     if (context.scope === 'remote') {
       const result = await readRemoteTextFile(context, filePath);
@@ -574,12 +650,10 @@ async function tryAITransfer(task, context) {
   if (context && context.scope === 'remote' && context.hostname && context.username) {
     console.log(chalk.dim(`  Using active remote session: ${context.username}@${context.hostname}`));
 
-    const { getSshControlOptions, formatScpRemotePath } = await import('../lib/ssh.js');
-
-    const proxyCommand = `cloudflared access tcp --hostname ${context.hostname}`;
+    const { buildProxyCommandOption, getSshControlOptions, formatScpRemotePath } = await import('../lib/ssh.js');
     const scpArgs = [
       '-r',
-      '-o', `ProxyCommand=${proxyCommand}`,
+      ...buildProxyCommandOption(context.hostname),
       '-o', 'StrictHostKeyChecking=accept-new',
       '-o', 'IdentitiesOnly=yes',
       ...getSshControlOptions(context.hostname),
@@ -630,4 +704,3 @@ async function tryAITransfer(task, context) {
     return true;
   }
 }
-