diff --git a/lib/core/sudo.sh b/lib/core/sudo.sh
index da443db..617dcaf 100644
--- a/lib/core/sudo.sh
+++ b/lib/core/sudo.sh
@@ -42,6 +42,11 @@ _request_password() {
     # Extra safety: ensure sudo cache is cleared before password input
     sudo -k 2> /dev/null
 
+    # Save original terminal settings and ensure they're restored on exit
+    local stty_orig
+    stty_orig=$(stty -g < "$tty_path" 2> /dev/null || echo "")
+    trap '[[ -n "$stty_orig" ]] && stty "$stty_orig" < "$tty_path" 2> /dev/null || true' RETURN
+
     while ((attempts < 3)); do
         local password=""
 
@@ -52,7 +57,13 @@ _request_password() {
         fi
 
         printf "${PURPLE}${ICON_ARROW}${NC} Password: " > "$tty_path"
-        IFS= read -r -s password < "$tty_path" || password=""
+
+        # Disable terminal echo to hide password input
+        stty -echo -icanon min 1 time 0 < "$tty_path" 2> /dev/null || true
+        IFS= read -r password < "$tty_path" || password=""
+        # Restore terminal echo immediately
+        stty echo icanon < "$tty_path" 2> /dev/null || true
+
         printf "\n" > "$tty_path"
 
         if [[ -z "$password" ]]; then
diff --git a/lib/optimize/maintenance.sh b/lib/optimize/maintenance.sh
index 0e8a685..2baaee6 100644
--- a/lib/optimize/maintenance.sh
+++ b/lib/optimize/maintenance.sh
@@ -100,6 +100,9 @@ fix_broken_login_items() {
             program=$(plutil -extract ProgramArguments.0 raw "$plist_file" 2> /dev/null || echo "")
         fi
 
+        # Expand tilde in path if present
+        program="${program/#\~/$HOME}"
+
         # Skip if no program found or program exists
         [[ -z "$program" ]] && continue
         [[ -e "$program" ]] && continue
diff --git a/mole b/mole
index f7a687f..90e5f48 100755
--- a/mole
+++ b/mole
@@ -22,7 +22,7 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "$SCRIPT_DIR/lib/core/common.sh"
 
 # Version info
-VERSION="1.13.1"
+VERSION="1.13.2"
 MOLE_TAGLINE="can dig deep to clean your Mac."
 
 # Check if Touch ID is already configured