@nightowne/tas-cli 2.0.0 → 2.3.0

package/src/cli.js

@@ -15,13 +15,31 @@ import { Compressor } from './utils/compression.js';
 import { FileIndex } from './db/index.js';
 import { processFile, retrieveFile } from './index.js';
 import { printBanner, LOGO, TAGLINE, VERSION } from './utils/branding.js';
-import { getPassword, verifyPassword, loadConfig, requireConfig, getAndVerifyPassword } from './utils/cli-helpers.js';
+import { getPassword, verifyPassword, loadConfig, requireConfig, getAndVerifyPassword, decryptBotToken, resolveConfig } from './utils/cli-helpers.js';
 import fs from 'fs';
 import path from 'path';
-import { fileURLToPath } from 'url';
+import os from 'os';
 
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const DATA_DIR = path.join(__dirname, '..', 'data');
+const DATA_DIR = process.env.TAS_DATA_DIR || path.join(os.homedir(), '.tas');
+
+// Global error handlers — prevent silent crashes
+process.on('unhandledRejection', (reason) => {
+    console.error(chalk.red('\n✗ Unhandled error:'), reason?.message || reason);
+    process.exit(1);
+});
+
+process.on('uncaughtException', (err) => {
+    console.error(chalk.red('\n✗ Fatal error:'), err.message);
+    process.exit(1);
+});
+
+// Graceful shutdown on signals
+const cleanupAndExit = (signal) => {
+    console.log(chalk.dim(`\n${signal} received, shutting down...`));
+    process.exit(0);
+};
+process.on('SIGINT', () => cleanupAndExit('SIGINT'));
+process.on('SIGTERM', () => cleanupAndExit('SIGTERM'));
 
 const program = new Command();
 
@@ -104,14 +122,16 @@ program
             const userInfo = await client.waitForChatId(120000);
             spinner.succeed(`Linked to ${userInfo.firstName} (@${userInfo.username})`);
 
-            // Save config
+            // Save config (bot token encrypted with user's password)
             const configPath = path.join(DATA_DIR, 'config.json');
+            const encryptedToken = encryptor.encrypt(Buffer.from(token, 'utf-8')).toString('base64');
             fs.writeFileSync(configPath, JSON.stringify({
-                botToken: token,
+                encryptedBotToken: encryptedToken,
                 chatId: userInfo.chatId,
                 passwordHash: encryptor.getPasswordHash(),
                 username: userInfo.username,
-                createdAt: new Date().toISOString()
+                createdAt: new Date().toISOString(),
+                configVersion: 2
             }, null, 2));
 
             // Initialize database
@@ -152,11 +172,12 @@ program
                 process.exit(1);
             }
 
-            const config = requireConfig(DATA_DIR);
+            const rawConfig = requireConfig(DATA_DIR);
             spinner.stop();
 
             // Get and verify password
             const password = await getAndVerifyPassword(options.password, DATA_DIR);
+            const config = resolveConfig(rawConfig, password);
 
             spinner.start('Processing file...');
 
@@ -207,7 +228,7 @@ program
         const spinner = ora('Looking up file...').start();
 
         try {
-            const config = requireConfig(DATA_DIR);
+            const rawConfig = requireConfig(DATA_DIR);
 
             // Find file in index
             const db = new FileIndex(path.join(DATA_DIR, 'index.db'));
@@ -223,6 +244,7 @@ program
 
             // Get and verify password
             const password = await getAndVerifyPassword(options.password, DATA_DIR);
+            const config = resolveConfig(rawConfig, password);
 
             spinner.start('Downloading...');
 
@@ -266,6 +288,7 @@ program
     .alias('ls')
     .description('List all stored files')
     .option('-l, --long', 'Show detailed information')
+    .option('--json', 'Output as JSON (for scripting)')
     .action(async (options) => {
         try {
             const db = new FileIndex(path.join(DATA_DIR, 'index.db'));
@@ -273,8 +296,15 @@ program
 
             const files = db.listAll();
 
+            if (options.json) {
+                console.log(JSON.stringify(files, null, 2));
+                db.close();
+                return;
+            }
+
             if (files.length === 0) {
                 console.log(chalk.yellow('\n📭 No files stored yet. Use `tas push <file>` to upload.\n'));
+                db.close();
                 return;
             }
 
@@ -298,6 +328,7 @@ program
             }
 
             console.log();
+            db.close();
 
         } catch (err) {
             console.error(chalk.red('Error listing files:'), err.message);
@@ -311,6 +342,7 @@ program
     .alias('rm')
     .description('Remove a file from the index (optionally from Telegram too)')
     .option('--hard', 'Also delete from Telegram')
+    .option('-p, --password <password>', 'Encryption password (required for --hard)')
     .action(async (identifier, options) => {
         try {
             const db = new FileIndex(path.join(DATA_DIR, 'index.db'));
@@ -334,8 +366,9 @@ program
             if (confirm) {
                 // If hard delete, also remove from Telegram
                 if (options.hard) {
-                    const configPath = path.join(DATA_DIR, 'config.json');
-                    const config = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
+                    const rawConfig = requireConfig(DATA_DIR);
+                    const password = await getAndVerifyPassword(options.password, DATA_DIR);
+                    const config = resolveConfig(rawConfig, password);
 
                     const client = new TelegramClient(DATA_DIR);
                     await client.initialize(config.botToken);
@@ -361,11 +394,16 @@ program
 program
     .command('status')
     .description('Show TAS status and statistics')
-    .action(async () => {
+    .option('--json', 'Output as JSON (for scripting)')
+    .action(async (options) => {
         const configPath = path.join(DATA_DIR, 'config.json');
 
         if (!fs.existsSync(configPath)) {
-            console.log(chalk.yellow('\n⚠️  TAS not initialized. Run `tas init` first.\n'));
+            if (options.json) {
+                console.log(JSON.stringify({ initialized: false }));
+            } else {
+                console.log(chalk.yellow('\n⚠️  TAS not initialized. Run `tas init` first.\n'));
+            }
             return;
         }
 
@@ -378,13 +416,30 @@ program
         const storedSize = files.reduce((acc, f) => acc + f.stored_size, 0);
         const savings = totalSize > 0 ? Math.round((1 - storedSize / totalSize) * 100) : 0;
 
+        if (options.json) {
+            console.log(JSON.stringify({
+                initialized: true,
+                createdAt: config.createdAt,
+                username: config.username || 'unknown',
+                fileCount: files.length,
+                totalSize,
+                storedSize,
+                savingsPercent: savings,
+                dataDir: DATA_DIR
+            }, null, 2));
+            db.close();
+            return;
+        }
+
         console.log(chalk.cyan('\n📊 TAS Status\n'));
         console.log(`  Initialized: ${chalk.white(new Date(config.createdAt).toLocaleDateString())}`);
         console.log(`  Telegram user: ${chalk.white('@' + (config.username || 'unknown'))}`);
+        console.log(`  Data dir: ${chalk.white(DATA_DIR)}`);
         console.log(`  Files stored: ${chalk.white(files.length)}`);
         console.log(`  Total size: ${chalk.white(formatBytes(totalSize))}`);
         console.log(`  Compressed: ${chalk.white(formatBytes(storedSize))} ${chalk.dim(`(${savings}% saved)`)}`);
         console.log();
+        db.close();
     });
 
 // ============== MOUNT COMMAND ==============
@@ -395,8 +450,9 @@ program
     .action(async (mountpoint, options) => {
         console.log(chalk.cyan('\n🗂️  Mounting Telegram as filesystem...\n'));
 
-        const config = requireConfig(DATA_DIR);
+        const rawConfig = requireConfig(DATA_DIR);
         const password = await getAndVerifyPassword(options.password, DATA_DIR);
+        const config = resolveConfig(rawConfig, password);
 
         const spinner = ora('Initializing filesystem...').start();
 
@@ -674,11 +730,30 @@ syncCmd
     .command('start')
     .description('Start syncing all registered folders')
     .option('-p, --password <password>', 'Encryption password (uses TAS_PASSWORD env var if not provided)')
+    .option('-l, --limit <limit>', 'Bandwidth limit (e.g. 500k, 1m)')
     .action(async (options) => {
         console.log(chalk.cyan('\n🔄 Starting folder sync...\n'));
 
-        const config = requireConfig(DATA_DIR);
+        const rawConfig = requireConfig(DATA_DIR);
         const password = await getAndVerifyPassword(options.password, DATA_DIR);
+        const config = resolveConfig(rawConfig, password);
+
+        let limitRate = null;
+        if (options.limit) {
+            const match = options.limit.match(/^(\d+)([kmg]?)$/i);
+            if (!match) {
+                console.error(chalk.red('Invalid limit format. Use e.g. 500{}, 1m'));
+                process.exit(1);
+            }
+            const val = parseInt(match[1]);
+            const unit = match[2].toLowerCase();
+            if (unit === 'k') limitRate = val * 1024;
+            else if (unit === 'm') limitRate = val * 1024 * 1024;
+            else if (unit === 'g') limitRate = val * 1024 * 1024 * 1024;
+            else limitRate = val;
+
+            console.log(chalk.dim(`   Bandwidth limit: ${options.limit}/s`));
+        }
 
         try {
             const { SyncEngine } = await import('./sync/sync.js');
@@ -686,7 +761,8 @@ syncCmd
             const syncEngine = new SyncEngine({
                 dataDir: DATA_DIR,
                 password,
-                config
+                config,
+                limitRate
             });
 
             await syncEngine.initialize();
@@ -749,8 +825,9 @@ syncCmd
     .action(async (options) => {
         console.log(chalk.cyan('\n📥 Pulling files from Telegram...\n'));
 
-        const config = requireConfig(DATA_DIR);
+        const rawConfig = requireConfig(DATA_DIR);
         const password = await getAndVerifyPassword(options.password, DATA_DIR);
+        const config = resolveConfig(rawConfig, password);
 
         const spinner = ora('Loading...').start();
 
@@ -835,10 +912,13 @@ syncCmd
 program
     .command('verify')
     .description('Verify file integrity and check for missing Telegram messages')
-    .action(async () => {
+    .option('-p, --password <password>', 'Encryption password')
+    .action(async (options) => {
         console.log(chalk.cyan('\n🔍 Verifying file integrity...\n'));
 
-        const config = requireConfig(DATA_DIR);
+        const rawConfig = requireConfig(DATA_DIR);
+        const password = await getAndVerifyPassword(options.password, DATA_DIR);
+        const config = resolveConfig(rawConfig, password);
 
         const spinner = ora('Checking files...').start();
 
@@ -925,10 +1005,11 @@ program
 
 // Helper function
 function formatBytes(bytes) {
+    if (!Number.isFinite(bytes) || bytes < 0) return '0 B';
     if (bytes === 0) return '0 B';
     const k = 1024;
-    const sizes = ['B', 'KB', 'MB', 'GB'];
-    const i = Math.floor(Math.log(bytes) / Math.log(k));
+    const sizes = ['B', 'KB', 'MB', 'GB', 'TB'];
+    const i = Math.min(Math.floor(Math.log(bytes) / Math.log(k)), sizes.length - 1);
     return parseFloat((bytes / Math.pow(k, i)).toFixed(2)) + ' ' + sizes[i];
 }
 
@@ -1033,8 +1114,8 @@ program
             }
 
             // Resume uploads
-            const config = loadConfig(DATA_DIR);
-            if (!config) {
+            const rawConfig = loadConfig(DATA_DIR);
+            if (!rawConfig) {
                 console.log(chalk.red('✗ TAS not initialized.'));
                 db.close();
                 return;
@@ -1042,6 +1123,7 @@ program
 
             // Get and verify password
             const password = await getAndVerifyPassword(options.password, DATA_DIR);
+            const config = resolveConfig(rawConfig, password);
 
             // Connect to Telegram
             const { TelegramClient } = await import('./telegram/client.js');
@@ -1128,8 +1210,9 @@ shareCmd
     .action(async (file, options) => {
         console.log(chalk.cyan('\n🔗 Creating share link...\n'));
 
-        const config = requireConfig(DATA_DIR);
+        const rawConfig = requireConfig(DATA_DIR);
         const password = await getAndVerifyPassword(options.password, DATA_DIR);
+        const config = resolveConfig(rawConfig, password);
 
         const spinner = ora('Setting up...').start();
 
@@ -1280,6 +1363,98 @@ shareCmd
         }
     });
 
+// ============== DOCTOR COMMAND ==============
+program
+    .command('doctor')
+    .description('🩺 Run self-diagnostics and check system health')
+    .action(async () => {
+        console.log(chalk.cyan('\n🩺 TAS Doctor — System Health Check\n'));
+
+        const checks = [];
+        const ok = (label) => { checks.push({ label, status: 'ok' }); console.log(chalk.green(`  ✓ ${label}`)); };
+        const warn = (label, detail) => { checks.push({ label, status: 'warn', detail }); console.log(chalk.yellow(`  ⚠ ${label}`) + chalk.dim(` — ${detail}`)); };
+        const fail = (label, detail) => { checks.push({ label, status: 'fail', detail }); console.log(chalk.red(`  ✗ ${label}`) + chalk.dim(` — ${detail}`)); };
+
+        // 1. Check Node.js version
+        const nodeVer = process.versions.node;
+        const major = parseInt(nodeVer.split('.')[0]);
+        if (major >= 18) ok(`Node.js ${nodeVer}`);
+        else warn(`Node.js ${nodeVer}`, 'Requires >= 18.0.0');
+
+        // 2. Check data directory
+        if (fs.existsSync(DATA_DIR)) ok(`Data directory: ${DATA_DIR}`);
+        else warn('Data directory missing', `Run \`tas init\` to create ${DATA_DIR}`);
+
+        // 3. Check config
+        const configPath = path.join(DATA_DIR, 'config.json');
+        if (fs.existsSync(configPath)) {
+            try {
+                const config = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
+                if (config.configVersion === 2) ok('Config v2 (encrypted token)');
+                else if (config.botToken) warn('Config v1 (plaintext token)', 'Re-run `tas init` to encrypt token');
+                else fail('Config invalid', 'Missing bot token');
+
+                if (config.chatId) ok(`Chat ID: ${config.chatId}`);
+                else fail('Chat ID missing', 'Run `tas init`');
+            } catch (e) {
+                fail('Config corrupted', e.message);
+            }
+        } else {
+            warn('Config not found', 'Run `tas init`');
+        }
+
+        // 4. Check database
+        const dbPath = path.join(DATA_DIR, 'index.db');
+        if (fs.existsSync(dbPath)) {
+            try {
+                const db = new FileIndex(dbPath);
+                db.init();
+                const stats = db.getStats();
+                ok(`Database: ${stats.file_count} files, ${formatBytes(stats.total_original)} total`);
+                db.close();
+            } catch (e) {
+                fail('Database error', e.message);
+            }
+        } else {
+            warn('Database not found', 'Will be created on first upload');
+        }
+
+        // 5. Check FUSE availability
+        try {
+            await import('fuse-native');
+            ok('FUSE support available');
+        } catch (e) {
+            warn('FUSE not available', 'Install libfuse for mount support');
+        }
+
+        // 6. Check disk space
+        try {
+            const { execSync } = await import('child_process');
+            const df = execSync(`df -h "${DATA_DIR}" 2>/dev/null || echo "unknown"`).toString().trim();
+            const lines = df.split('\n');
+            if (lines.length > 1) {
+                const parts = lines[1].split(/\s+/);
+                const avail = parts[3] || 'unknown';
+                const usage = parts[4] || 'unknown';
+                if (parseInt(usage) > 90) warn(`Disk space: ${avail} free (${usage} used)`, 'Running low!');
+                else ok(`Disk space: ${avail} free (${usage} used)`);
+            }
+        } catch (e) { /* ignore */ }
+
+        // 7. Security check
+        const iterations = 600000;
+        ok(`Encryption: AES-256-GCM, PBKDF2-SHA512 ${iterations.toLocaleString()} iterations`);
+
+        // Summary
+        const fails = checks.filter(c => c.status === 'fail').length;
+        const warns = checks.filter(c => c.status === 'warn').length;
+        console.log();
+        if (fails > 0) console.log(chalk.red(`  ${fails} issue(s) found. Please fix them above.`));
+        else if (warns > 0) console.log(chalk.yellow(`  ${warns} warning(s). System is functional.`));
+        else console.log(chalk.green('  ✨ All systems go! TAS is healthy.'));
+        console.log();
+    });
+
 program.parse();
 
 

package/src/crypto/encryption.js

@@ -3,13 +3,14 @@
  */
 
 import crypto from 'crypto';
+import { Transform } from 'stream';
 
 const ALGORITHM = 'aes-256-gcm';
 const KEY_LENGTH = 32; // 256 bits
 const IV_LENGTH = 12;  // 96 bits for GCM
 const TAG_LENGTH = 16; // 128 bits auth tag
 const SALT_LENGTH = 32;
-const PBKDF2_ITERATIONS = 100000;
+const PBKDF2_ITERATIONS = 600000; // OWASP 2025 recommendation for SHA-512
 
 export class Encryptor {
     constructor(password) {
@@ -18,11 +19,29 @@ export class Encryptor {
 
     /**
      * Get a hash of the password for verification (not the actual key!)
+     * Uses PBKDF2 with a fixed salt derived from the password domain to make brute-force expensive.
      */
     getPasswordHash() {
-        return crypto.createHash('sha256')
-            .update(this.password + 'was-verify')
+        const verifySalt = Buffer.from('tas-password-verify-v2', 'utf-8');
+        return crypto.pbkdf2Sync(this.password, verifySalt, PBKDF2_ITERATIONS, 32, 'sha512').toString('hex');
+    }
+
+    /**
+     * Check password against a stored hash (supports both legacy SHA-256 and new PBKDF2 formats)
+     */
+    static verifyPasswordHash(password, storedHash) {
+        const encryptor = new Encryptor(password);
+
+        // Try new PBKDF2-based verification first
+        if (encryptor.getPasswordHash() === storedHash) {
+            return true;
+        }
+
+        // Fallback: legacy SHA-256 verification for backward compatibility
+        const legacyHash = crypto.createHash('sha256')
+            .update(password + 'was-verify')
             .digest('hex');
+        return legacyHash === storedHash;
     }
 
     /**
@@ -66,6 +85,45 @@ export class Encryptor {
         return Buffer.concat([salt, iv, encrypted, authTag]);
     }
 
+    /**
+     * Get an encryption transform stream
+     * Needs to append the salt/iv to the stream begin, and authTag to the stream end
+     */
+    getEncryptStream() {
+        const salt = crypto.randomBytes(SALT_LENGTH);
+        const iv = crypto.randomBytes(IV_LENGTH);
+        const key = this.deriveKey(salt);
+        const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
+
+        let headerWritten = false;
+
+        return new Transform({
+            transform(chunk, encoding, callback) {
+                if (!headerWritten) {
+                    this.push(Buffer.concat([salt, iv]));
+                    headerWritten = true;
+                }
+                const encrypted = cipher.update(chunk);
+                if (encrypted.length > 0) {
+                    this.push(encrypted);
+                }
+                callback();
+            },
+            flush(callback) {
+                if (!headerWritten) {
+                    this.push(Buffer.concat([salt, iv]));
+                    headerWritten = true;
+                }
+                const final = cipher.final();
+                if (final.length > 0) {
+                    this.push(final);
+                }
+                this.push(cipher.getAuthTag());
+                callback();
+            }
+        });
+    }
+
     /**
      * Decrypt data
      * Input: Buffer containing [salt (32) | iv (12) | ciphertext | authTag (16)]
@@ -90,6 +148,98 @@ export class Encryptor {
             decipher.final()
         ]);
     }
+
+    /**
+     * Get a decryption transform stream
+     * Expects [salt (32) | iv (12) | ciphertext | authTag (16)]
+     */
+    getDecryptStream() {
+        let salt = null;
+        let iv = null;
+        let authTag = null;
+        let key = null;
+        let decipher = null;
+
+        // Buffer for storing the salt and iv during the first few chunks
+        let headerBuffer = Buffer.alloc(0);
+        let headerRead = false;
+
+        // We must buffer the last 16 bytes across chunks because it's the authTag
+        let tailBuffer = Buffer.alloc(0);
+
+        const self = this;
+
+        return new Transform({
+            transform(chunk, encoding, callback) {
+                try {
+                    // 1. Read the header (salt + iv)
+                    if (!headerRead) {
+                        headerBuffer = Buffer.concat([headerBuffer, chunk]);
+
+                        if (headerBuffer.length >= SALT_LENGTH + IV_LENGTH) {
+                            salt = headerBuffer.subarray(0, SALT_LENGTH);
+                            iv = headerBuffer.subarray(SALT_LENGTH, SALT_LENGTH + IV_LENGTH);
+                            key = self.deriveKey(salt);
+                            decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
+
+                            // The rest of the header buffer is ciphertext
+                            const remaining = headerBuffer.subarray(SALT_LENGTH + IV_LENGTH);
+                            headerBuffer = null; // free memory
+                            headerRead = true;
+
+                            // Push remaining into tailBuffer for processing
+                            if (remaining.length > 0) {
+                                tailBuffer = Buffer.concat([tailBuffer, remaining]);
+                            }
+                        }
+                    } else {
+                        tailBuffer = Buffer.concat([tailBuffer, chunk]);
+                    }
+
+                    // 2. Process ciphertext, keeping exactly TAG_LENGTH bytes in tailBuffer
+                    if (headerRead && tailBuffer.length > TAG_LENGTH) {
+                        const processLength = tailBuffer.length - TAG_LENGTH;
+                        const toProcess = tailBuffer.subarray(0, processLength);
+
+                        const decrypted = decipher.update(toProcess);
+                        if (decrypted.length > 0) {
+                            this.push(decrypted);
+                        }
+
+                        // Keep only the end
+                        tailBuffer = tailBuffer.subarray(processLength);
+                    }
+
+                    callback();
+                } catch (err) {
+                    callback(err);
+                }
+            },
+            flush(callback) {
+                try {
+                    if (!headerRead) {
+                        return callback(new Error('Invalid encrypted data stream: too short'));
+                    }
+
+                    if (tailBuffer.length !== TAG_LENGTH) {
+                        return callback(new Error(`Invalid encrypted data stream: missing auth tag. Got ${tailBuffer.length} bytes, expected ${TAG_LENGTH}`));
+                    }
+
+                    authTag = tailBuffer;
+                    decipher.setAuthTag(authTag);
+
+                    const final = decipher.final();
+                    if (final.length > 0) {
+                        this.push(final);
+                    }
+
+                    callback();
+                } catch (err) {
+                    callback(new Error(`Decryption failed: wrong password or corrupt data (${err.message})`));
+                }
+            }
+        });
+    }
 }
 
 /**

package/src/db/index.js

@@ -171,25 +171,32 @@ export class FileIndex {
   }
 
   /**
-   * Find file by hash
+   * Escape SQL LIKE wildcard characters
+   */
+  _escapeLike(str) {
+    return str.replace(/[%_\\]/g, '\\$&');
+  }
+
+  /**
+   * Find file by hash (exact match or prefix match)
    */
   findByHash(hash) {
     const stmt = this.db.prepare(`
-      SELECT * FROM files WHERE hash = ? OR hash LIKE ?
+      SELECT * FROM files WHERE hash = ? OR hash LIKE ? ESCAPE '\\'
     `);
 
-    return stmt.get(hash, hash + '%');
+    return stmt.get(hash, this._escapeLike(hash) + '%');
   }
 
   /**
-   * Find file by filename
+   * Find file by filename (exact match or substring match)
    */
   findByName(filename) {
     const stmt = this.db.prepare(`
-      SELECT * FROM files WHERE filename = ? OR filename LIKE ?
+      SELECT * FROM files WHERE filename = ? OR filename LIKE ? ESCAPE '\\'
     `);
 
-    return stmt.get(filename, '%' + filename + '%');
+    return stmt.get(filename, '%' + this._escapeLike(filename) + '%');
   }
 
   /**
@@ -399,11 +406,11 @@ export class FileIndex {
       SELECT f.*, GROUP_CONCAT(t.tag) as tags
       FROM files f
       LEFT JOIN tags t ON f.id = t.file_id
-      WHERE f.filename LIKE ?
+      WHERE f.filename LIKE ? ESCAPE '\\'
       GROUP BY f.id
       ORDER BY f.created_at DESC
     `);
-    return stmt.all(`%${query}%`);
+    return stmt.all(`%${this._escapeLike(query)}%`);
   }
 
   /**
@@ -414,11 +421,11 @@ export class FileIndex {
       SELECT f.*, GROUP_CONCAT(t.tag) as tags
       FROM files f
       INNER JOIN tags t ON f.id = t.file_id
-      WHERE t.tag LIKE ?
+      WHERE t.tag LIKE ? ESCAPE '\\'
       GROUP BY f.id
       ORDER BY f.created_at DESC
     `);
-    return stmt.all(`%${query}%`);
+    return stmt.all(`%${this._escapeLike(query)}%`);
   }
 
   // ============== RESUME UPLOAD METHODS ==============
@@ -572,10 +579,9 @@ export class FileIndex {
    */
   cleanExpiredShares() {
     const stmt = this.db.prepare(`
-      DELETE FROM shares WHERE
-        REPLACE(REPLACE(expires_at, 'T', ' '), 'Z', '') < strftime('%Y-%m-%d %H:%M:%f', 'now')
+      DELETE FROM shares WHERE expires_at < ?
     `);
-    return stmt.run().changes;
+    return stmt.run(new Date().toISOString()).changes;
   }
 
   /**