lazyufw 1.0.0

package/dist/index.js

@@ -0,0 +1,2968 @@
+#!/usr/bin/env node
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// cli/checkSudo.ts
+import { execFileSync } from "child_process";
+
+// utils/config.ts
+import { existsSync } from "fs";
+var COMMON_UFW_PATHS = [
+  "/usr/sbin/ufw",
+  "/usr/bin/ufw",
+  "/sbin/ufw",
+  "/usr/local/sbin/ufw",
+  "/usr/local/bin/ufw"
+];
+function findUfwPath() {
+  if (process.env.UFW_PATH && existsSync(process.env.UFW_PATH)) {
+    return process.env.UFW_PATH;
+  }
+  const found = COMMON_UFW_PATHS.find(existsSync);
+  return found ?? null;
+}
+function isUfwInstalled() {
+  return findUfwPath() !== null;
+}
+function getUfwPath() {
+  if (process.env.UFW_PATH) {
+    return process.env.UFW_PATH;
+  }
+  const detected = findUfwPath();
+  if (detected) {
+    return detected;
+  }
+  return "/usr/sbin/ufw";
+}
+var UFW_PATH = getUfwPath();
+var SUDOERS_FILE = "/etc/sudoers.d/lazyufw-nopasswd";
+var SUDO_USER = process.env.SUDO_USER || process.env.USER || "";
+
+// cli/checkSudo.ts
+import { spawnSync } from "child_process";
+function ensureSudoCached() {
+  const result = spawnSync("sudo", ["-v"], { stdio: "inherit" });
+  return result.status === 0;
+}
+function isSudoConfigured() {
+  try {
+    execFileSync("sudo", ["-n", UFW_PATH, "status"], { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// cli/setupSudo.ts
+import { writeFileSync, chmodSync, existsSync as existsSync2, unlinkSync } from "fs";
+import { execFileSync as execFileSync2, spawnSync as spawnSync2 } from "child_process";
+function setupSudo() {
+  if (process.platform !== "linux") {
+    console.warn("lazyufw: UFW and sudoers configuration are designed for Linux systems.");
+  }
+  if (process.getuid && process.getuid() !== 0) {
+    console.log("lazyufw: Sudoers configuration requires root. Re-running with sudo...");
+    const res = spawnSync2("sudo", [process.execPath, ...process.argv.slice(1)], {
+      stdio: "inherit"
+    });
+    if (res.status !== 0) {
+      console.error("Sudo authentication cancelled or failed. Run: sudo lazyufw setup");
+      process.exit(res.status ?? 1);
+    }
+    return;
+  }
+  const targetUser = process.env.SUDO_USER || process.env.USER;
+  if (!targetUser || targetUser === "root") {
+    console.log("lazyufw: Currently running as root. Passwordless sudo drop-in is not required for root.");
+    return;
+  }
+  const ufwPath = getUfwPath();
+  const line = `${targetUser} ALL=(root) NOPASSWD: ${ufwPath}
+`;
+  try {
+    writeFileSync(SUDOERS_FILE, line, { mode: 288 });
+    chmodSync(SUDOERS_FILE, 288);
+  } catch (err) {
+    console.error(`Failed to write sudoers file at ${SUDOERS_FILE}:`, err);
+    process.exit(1);
+  }
+  try {
+    execFileSync2("visudo", ["-c", "-f", SUDOERS_FILE]);
+  } catch {
+    if (existsSync2(SUDOERS_FILE)) {
+      unlinkSync(SUDOERS_FILE);
+    }
+    console.error("Generated sudoers rule failed validation (visudo). No changes were made.");
+    process.exit(1);
+  }
+  console.log(`
+  \u2705 lazyufw: passwordless sudo enabled for '${targetUser}' on ${ufwPath}`);
+  console.log(`  You can now run 'lazyufw' freely without password prompts!
+`);
+}
+
+// cli/teardownSudo.ts
+import { existsSync as existsSync3, unlinkSync as unlinkSync2 } from "fs";
+import { spawnSync as spawnSync3 } from "child_process";
+function teardownSudo() {
+  if (process.getuid && process.getuid() !== 0) {
+    console.log("lazyufw: Removing sudoers file requires root. Re-running with sudo...");
+    const res = spawnSync3("sudo", [process.execPath, ...process.argv.slice(1)], {
+      stdio: "inherit"
+    });
+    if (res.status !== 0) {
+      console.error("Authentication failed. Run manually: sudo lazyufw teardown");
+      process.exit(res.status ?? 1);
+    }
+    return;
+  }
+  if (existsSync3(SUDOERS_FILE)) {
+    try {
+      unlinkSync2(SUDOERS_FILE);
+      console.log(`
+  \u2705 lazyufw: removed sudoers rule from ${SUDOERS_FILE}
+`);
+    } catch (err) {
+      console.error(`Failed to remove ${SUDOERS_FILE}:`, err);
+      process.exit(1);
+    }
+  } else {
+    console.log("\n  lazyufw: no sudoers rule found, nothing to remove.\n");
+  }
+}
+
+// tui/dashboard.ts
+import blessed15 from "blessed";
+
+// tui/components/RulesPanel.ts
+import blessed from "blessed";
+
+// tui/theme.ts
+var theme = {
+  border: { idle: "gray", focus: "green", accent: "cyan" },
+  status: { active: "green", inactive: "red", unknown: "gray" },
+  action: {
+    ALLOW: "green",
+    DENY: "red",
+    REJECT: "red",
+    LIMIT: "yellow"
+  },
+  text: { muted: "gray", accent: "cyan", danger: "red", warn: "yellow" }
+};
+function focusable(widget, setBorder, setLabel) {
+  widget.on("focus", () => {
+    setBorder(theme.border.focus);
+    setLabel?.(theme.border.focus);
+  });
+  widget.on("blur", () => {
+    setBorder(theme.border.idle);
+    setLabel?.(theme.border.idle);
+  });
+}
+
+// tui/format.ts
+function truncate(str, max) {
+  if (str.length <= max) return str;
+  return str.slice(0, Math.max(0, max - 3)) + "...";
+}
+
+// tui/components/RulesPanel.ts
+var EMPTY_MESSAGE = "{gray-fg}No rules configured. Press 'a' to add one.{/gray-fg}";
+var NO_MATCH_MESSAGE = "{gray-fg}No rules match the current filter. Press 'c' to clear.{/gray-fg}";
+var LOADING_MESSAGE = "{gray-fg}Loading rules...{/gray-fg}";
+var RulesPanel = class {
+  widget;
+  rules = [];
+  displayedRules = [];
+  state = "loading";
+  filterQuery = "";
+  sortMode = "id";
+  constructor() {
+    this.widget = blessed.list({
+      label: " [2] Rules ",
+      top: "31%",
+      left: 0,
+      width: "35%",
+      height: "44%",
+      keys: true,
+      vi: true,
+      mouse: true,
+      tags: true,
+      border: { type: "line" },
+      style: {
+        selected: { fg: "black", bg: theme.border.focus, bold: true },
+        border: { fg: theme.border.idle },
+        label: { fg: theme.border.idle }
+      },
+      items: [LOADING_MESSAGE]
+    });
+    focusable(
+      this.widget,
+      (color) => this.widget.style.border.fg = color,
+      (color) => this.widget.style.label.fg = color
+    );
+    this.widget.key(["?", "S-/", "h", "S-h", "f1"], () => {
+      this.widget.screen.emit("key ?", "?", { full: "?" });
+    });
+    this.widget.key(["D", "S-d"], () => {
+      this.widget.screen.emit("key S-d", "D", { full: "S-d" });
+    });
+    this.widget.key(["/"], () => this.openSearchPrompt());
+    this.widget.key(["o", "S-s"], () => this.cycleSort());
+    this.widget.key(["c"], () => {
+      if (this.filterQuery) {
+        this.clearFilter();
+      }
+    });
+  }
+  setLoading() {
+    this.state = "loading";
+    this.widget.setItems([LOADING_MESSAGE]);
+  }
+  setRules(rules) {
+    this.state = "loaded";
+    this.rules = rules;
+    this.applyFilterAndSort();
+  }
+  applyFilterAndSort() {
+    const currentId = this.getSelectedRule()?.id;
+    let list = [...this.rules];
+    if (this.filterQuery) {
+      const q = this.filterQuery.toLowerCase();
+      list = list.filter(
+        (r) => r.to.toLowerCase().includes(q) || r.from.toLowerCase().includes(q) || r.action.toLowerCase().includes(q) || r.comment && r.comment.toLowerCase().includes(q) || String(r.id).includes(q)
+      );
+    }
+    if (this.sortMode === "action") {
+      list.sort((a, b) => a.action.localeCompare(b.action) || a.id - b.id);
+    } else if (this.sortMode === "to") {
+      list.sort((a, b) => a.to.localeCompare(b.to) || a.id - b.id);
+    } else if (this.sortMode === "from") {
+      list.sort((a, b) => a.from.localeCompare(b.from) || a.id - b.id);
+    } else {
+      list.sort((a, b) => a.id - b.id);
+    }
+    this.displayedRules = list;
+    this.renderItems();
+    this.updateLabel();
+    const restoredIndex = currentId != null ? list.findIndex((r) => r.id === currentId) : -1;
+    this.widget.select(restoredIndex >= 0 ? restoredIndex : 0);
+  }
+  renderItems() {
+    if (this.rules.length === 0) {
+      this.widget.setItems([EMPTY_MESSAGE]);
+      return;
+    }
+    if (this.displayedRules.length === 0) {
+      this.widget.setItems([NO_MATCH_MESSAGE]);
+      return;
+    }
+    this.widget.setItems(
+      this.displayedRules.map((rule) => {
+        const color = theme.action[rule.action] ?? "white";
+        const direction = rule.direction === "OUT" ? "\u2192" : "\u2190";
+        const actionBadge = `{${color}-fg}{bold}[${rule.action}]{/bold}{/${color}-fg}`;
+        const to = truncate(rule.to, 16).padEnd(16);
+        const from = truncate(rule.from, 14);
+        return `${String(rule.id).padStart(2)} ${direction} ${to} ${actionBadge} ${from}`;
+      })
+    );
+  }
+  updateLabel() {
+    let label = " [2] Rules ";
+    const badges = [];
+    if (this.sortMode !== "id") {
+      badges.push(`sort:${this.sortMode}`);
+    }
+    if (this.filterQuery) {
+      badges.push(`filter:"${this.filterQuery}"`);
+    }
+    if (badges.length > 0) {
+      label = ` [2] Rules (${badges.join(" | ")}) `;
+    }
+    this.widget.setLabel(label);
+  }
+  openSearchPrompt() {
+    const prompt = blessed.prompt({
+      parent: this.widget.screen,
+      top: "center",
+      left: "center",
+      width: "50%",
+      height: 7,
+      border: { type: "line" },
+      label: " Filter Rules [/] ",
+      style: { border: { fg: "cyan" }, label: { fg: "cyan" } },
+      tags: true,
+      shadow: true
+    });
+    prompt.input("Enter filter query (Enter empty to clear):", this.filterQuery, (_err, value) => {
+      if (value !== null && value !== void 0) {
+        this.filterQuery = value.trim();
+        this.applyFilterAndSort();
+      }
+      prompt.destroy();
+      this.widget.screen.render();
+      this.widget.focus();
+    });
+    this.widget.screen.render();
+  }
+  cycleSort() {
+    const modes = ["id", "action", "to", "from"];
+    const nextIdx = (modes.indexOf(this.sortMode) + 1) % modes.length;
+    this.sortMode = modes[nextIdx];
+    this.applyFilterAndSort();
+    this.widget.screen.render();
+  }
+  clearFilter() {
+    this.filterQuery = "";
+    this.applyFilterAndSort();
+    this.widget.screen.render();
+  }
+  getSelectedRule() {
+    if (this.displayedRules.length === 0) return void 0;
+    const index = this.widget.selected;
+    return this.displayedRules[index];
+  }
+  get isEmpty() {
+    return this.rules.length === 0;
+  }
+  get count() {
+    return this.rules.length;
+  }
+  get filter() {
+    return this.filterQuery;
+  }
+  get sort() {
+    return this.sortMode;
+  }
+  focus() {
+    this.widget.focus();
+  }
+};
+
+// tui/components/DetailPanel.ts
+import blessed2 from "blessed";
+var PLACEHOLDER = "{cyan-fg}{bold}Firewall Rule Inspector{/bold}{/cyan-fg}\n\n{gray-fg}Select a rule on the left [2] to inspect details, actions, and raw commands.\n\nQuick Actions:\n  [a] Add Rule        [i] Insert Rule\n  [P] App Profiles    [d] Delete Rule\n  [e] Enable UFW      [D] Disable UFW (SSH Protected)\n  [L] Log Level Modal [l] Quick Toggle Log\n  [/] Search / Filter [o] Sort Rules\n  [r] Refresh         [x] Action Menu\n  [?] Help Cheatsheet [q] Quit{/gray-fg}";
+var DetailPanel = class {
+  widget;
+  constructor() {
+    this.widget = blessed2.box({
+      label: " [4] Inspection / Details ",
+      top: 3,
+      left: "35%",
+      width: "65%",
+      height: "100%-6",
+      border: { type: "line" },
+      tags: true,
+      scrollable: true,
+      alwaysScroll: false,
+      keys: true,
+      vi: true,
+      mouse: true,
+      style: {
+        border: { fg: theme.border.idle },
+        label: { fg: theme.border.idle }
+      },
+      content: PLACEHOLDER
+    });
+    focusable(
+      this.widget,
+      (color) => this.widget.style.border.fg = color,
+      (color) => this.widget.style.label.fg = color
+    );
+  }
+  render(rule) {
+    if (!rule) {
+      this.widget.setContent(PLACEHOLDER);
+      return;
+    }
+    const color = theme.action[rule.action] ?? "white";
+    const actionBadge = `{${color}-bg}{black-fg}{bold} ${rule.action} {/bold}{/black-fg}{/${color}-bg}`;
+    const cleanTo = rule.to.replace(/\s*\(v6\)/i, "").trim();
+    const cleanFrom = rule.from.replace(/\s*\(v6\)/i, "").trim();
+    const isV6 = rule.to.includes("(v6)") || rule.from.includes("(v6)");
+    const isPortRule = /^\d+(?::\d+)?(\/\w+)?$/.test(cleanTo);
+    let cmdEquivalent;
+    let protoDisplay;
+    if (isPortRule) {
+      const protocolMatch = /\/(\w+)$/.exec(cleanTo);
+      const protocol = protocolMatch?.[1] ?? "any";
+      const portMatch = /^(\d+(?::\d+)?)/.exec(cleanTo);
+      const port = portMatch ? portMatch[1] : cleanTo;
+      protoDisplay = protocol.toUpperCase();
+      if (cleanFrom.toLowerCase() === "anywhere") {
+        cmdEquivalent = `ufw ${rule.action.toLowerCase()} ${cleanTo}${rule.comment ? ` comment "${rule.comment}"` : ""}`;
+      } else {
+        cmdEquivalent = `ufw ${rule.action.toLowerCase()} from ${cleanFrom} to any port ${port}${protocol !== "any" ? ` proto ${protocol}` : ""}${rule.comment ? ` comment "${rule.comment}"` : ""}`;
+      }
+    } else {
+      protoDisplay = "APP PROFILE";
+      if (cleanFrom.toLowerCase() === "anywhere") {
+        cmdEquivalent = `ufw ${rule.action.toLowerCase()} "${cleanTo}"${rule.comment ? ` comment "${rule.comment}"` : ""}`;
+      } else {
+        cmdEquivalent = `ufw ${rule.action.toLowerCase()} from ${cleanFrom} to any app "${cleanTo}"${rule.comment ? ` comment "${rule.comment}"` : ""}`;
+      }
+    }
+    const deleteCmd = `sudo ufw delete ${rule.id}`;
+    const lines = [
+      `{bold}{cyan-fg}RULE INSPECTION \u2014 #${rule.id}{/cyan-fg}{/bold}`,
+      `\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501`,
+      ` {bold}Action:{/bold}      ${actionBadge}`,
+      ` {bold}Direction:{/bold}   ${rule.direction === "OUT" ? "OUTGOING (OUT \u2192)" : "INCOMING (IN \u2190)"}`,
+      ` {bold}Destination:{/bold} ${rule.to}`,
+      ` {bold}Source:{/bold}      ${rule.from}`,
+      ` {bold}Protocol:{/bold}    ${protoDisplay}`,
+      ` {bold}IP Version:{/bold}  ${isV6 ? "IPv6" : "IPv4"}`,
+      rule.comment ? ` {bold}Comment:{/bold}     {yellow-fg}${rule.comment}{/yellow-fg}` : "",
+      "",
+      `{bold}CLI Equivalence:{/bold}`,
+      `  {green-fg}$ ${cmdEquivalent}{/green-fg}`,
+      `  {gray-fg}$ ${deleteCmd}{/gray-fg}`,
+      "",
+      `{bold}Keyboard Shortcuts for this rule:{/bold}`,
+      `  Press {bold}d{/bold} to delete rule #${rule.id}`,
+      `  Press {bold}i{/bold} to insert a new rule before #${rule.id}`,
+      `  Press {bold}x{/bold} to open the Lazydocker Action Menu`
+    ].filter(Boolean).join("\n");
+    this.widget.setContent(lines);
+  }
+  focus() {
+    this.widget.focus();
+  }
+};
+
+// tui/components/StatusPanel.ts
+import blessed3 from "blessed";
+var StatusPanel = class {
+  widget;
+  statusData = {};
+  isSudoReady = false;
+  constructor() {
+    this.widget = blessed3.box({
+      label: " [1] Status ",
+      top: 3,
+      left: 0,
+      width: "35%",
+      height: "28%",
+      border: { type: "line" },
+      tags: true,
+      scrollable: false,
+      keys: true,
+      mouse: true,
+      style: {
+        border: { fg: theme.border.idle },
+        label: { fg: theme.border.idle }
+      },
+      content: "{gray-fg}Loading firewall status...{/gray-fg}"
+    });
+    focusable(
+      this.widget,
+      (color) => this.widget.style.border.fg = color,
+      (color) => this.widget.style.label.fg = color
+    );
+  }
+  setStatus(data, sudoReady = false) {
+    this.statusData = data;
+    this.isSudoReady = sudoReady;
+    this.render();
+  }
+  render() {
+    const { status, logging, defaultIncoming, defaultOutgoing, defaultRouted, rules } = this.statusData;
+    const isAct = status === "active";
+    const statusBadge = isAct ? "{green-bg}{black-fg}{bold} ACTIVE {/bold}{/black-fg}{/green-bg}" : "{red-bg}{white-fg}{bold} INACTIVE {/bold}{/white-fg}{/red-bg}";
+    const logBadge = logging && logging.toLowerCase().includes("on") ? `{green-fg}\u25CF ON ${logging.replace(/^on\s*/i, "").trim() || "low"}{/green-fg}` : "{gray-fg}\u25CB OFF{/gray-fg}";
+    const sudoBadge = this.isSudoReady ? "{green-fg}Passwordless Sudo{/green-fg}" : "{yellow-fg}Standard Sudo{/yellow-fg}";
+    const inPolicy = defaultIncoming ? defaultIncoming.toUpperCase() : "DENY";
+    const outPolicy = defaultOutgoing ? defaultOutgoing.toUpperCase() : "ALLOW";
+    const routedPolicy = defaultRouted ? defaultRouted.toUpperCase() : "DISABLED";
+    const inColor = inPolicy === "ALLOW" ? "green" : "red";
+    const outColor = outPolicy === "ALLOW" ? "green" : "red";
+    const content = [
+      ` {bold}State:{/bold}   ${statusBadge}  {gray-fg}|{/gray-fg}  {bold}Log:{/bold} ${logBadge}`,
+      ` {bold}Policy:{/bold}  In: {${inColor}-fg}${inPolicy}{/${inColor}-fg} | Out: {${outColor}-fg}${outPolicy}{/${outColor}-fg} | Route: ${routedPolicy}`,
+      ` {bold}Rules:{/bold}   ${rules?.length ?? 0} loaded`,
+      ` {bold}Auth:{/bold}    ${sudoBadge}`
+    ].join("\n");
+    this.widget.setContent(content);
+  }
+  focus() {
+    this.widget.focus();
+  }
+};
+
+// tui/components/RawPanel.ts
+import blessed4 from "blessed";
+var RawPanel = class {
+  widget;
+  constructor() {
+    this.widget = blessed4.box({
+      label: " [3] Raw Output ",
+      top: 3,
+      left: "50%",
+      width: "50%",
+      height: "50%",
+      border: { type: "line" },
+      tags: true,
+      scrollable: true,
+      alwaysScroll: false,
+      keys: true,
+      vi: true,
+      mouse: true,
+      style: {
+        border: { fg: theme.border.idle },
+        label: { fg: theme.border.idle }
+      },
+      content: "{gray-fg}Loading raw rules...{/gray-fg}"
+    });
+    focusable(
+      this.widget,
+      (color) => this.widget.style.border.fg = color,
+      (color) => this.widget.style.label.fg = color
+    );
+  }
+  setContent(text) {
+    this.widget.setContent(text ? `{white-fg}${text.trim()}{/white-fg}` : "{gray-fg}No raw output available{/gray-fg}");
+  }
+  focus() {
+    this.widget.focus();
+  }
+};
+
+// tui/components/Focusmanager.ts
+var FocusManager = class {
+  constructor(screen) {
+    this.screen = screen;
+  }
+  screen;
+  stack = [];
+  previouslyFocused = null;
+  get isModalOpen() {
+    return this.stack.length > 0;
+  }
+  open(modal) {
+    if (this.stack.length === 0) {
+      this.previouslyFocused = this.screen.focused ?? null;
+    }
+    this.stack.push(modal);
+    modal.show();
+    modal.focus();
+    this.screen.render();
+  }
+  closeTop() {
+    const modal = this.stack.pop();
+    if (!modal) return;
+    modal.destroy();
+    const next = this.stack[this.stack.length - 1];
+    if (next) {
+      next.focus();
+    } else if (this.previouslyFocused) {
+      this.previouslyFocused.focus();
+    }
+    this.screen.render();
+  }
+  closeAll() {
+    while (this.stack.length) this.closeTop();
+  }
+};
+
+// tui/components/StatusBar.ts
+import blessed5 from "blessed";
+var DEFAULT_HINT = " {bold}[1-4]{/bold} Panels  {bold}[a]{/bold} Add  {bold}[P]{/bold} Apps  {bold}[i]{/bold} Insert  {bold}[d]{/bold} Del  {bold}[L]{/bold} Log  {bold}[/]{/bold} Find  {bold}[o]{/bold} Sort  {bold}[x]{/bold} Menu  {bold}[?]{/bold} Help  {bold}[q]{/bold} Quit";
+var COPYRIGHT_LINE = "{gray-fg}lazyufw \xB7 The lazier way to manage UFW \xB7 Press [x] for Actions Menu{/gray-fg}";
+function createHeader() {
+  return blessed5.box({
+    top: 0,
+    left: 0,
+    width: "100%",
+    height: 3,
+    border: { type: "line" },
+    tags: true,
+    style: { border: { fg: "cyan" } },
+    content: " {bold}{cyan-fg}lazyufw{/cyan-fg}{/bold}  {gray-fg}\u2502 Loading firewall status...{/gray-fg}"
+  });
+}
+function renderHeaderStatus(header, status) {
+  if (status.statusUnavailable) {
+    header.setContent(
+      " {bold}{cyan-fg}lazyufw{/cyan-fg}{/bold}  {gray-fg}\u2502{/gray-fg}  {red-bg}{white-fg}{bold} STATUS UNAVAILABLE {/bold}{/white-fg}{/red-bg}  {gray-fg}(run 'lazyufw setup' or check permissions){/gray-fg}"
+    );
+    return;
+  }
+  const fw = status.firewallActive ? "{green-bg}{black-fg}{bold} ACTIVE {/bold}{/black-fg}{/green-bg}" : "{red-bg}{white-fg}{bold} INACTIVE {/bold}{/white-fg}{/red-bg}";
+  const log = status.loggingOn ? "{green-fg}log: on{/green-fg}" : "{gray-fg}log: off{/gray-fg}";
+  const rules = status.ruleCount != null ? `{bold}${status.ruleCount}{/bold} rules` : "";
+  header.setContent(
+    ` {bold}{cyan-fg}lazyufw{/cyan-fg}{/bold}  {gray-fg}\u2502{/gray-fg}  ufw: ${fw}   ${log}   ${rules ? `{gray-fg}\u2502{/gray-fg}   ${rules}` : ""}`
+  );
+}
+function createFooter() {
+  const footer = blessed5.box({
+    bottom: 0,
+    left: 0,
+    width: "100%",
+    height: 3,
+    border: { type: "line" },
+    tags: true,
+    style: { border: { fg: "gray" } }
+  });
+  footer.setContent(`${DEFAULT_HINT}
+ ${COPYRIGHT_LINE}`);
+  return footer;
+}
+function setFooterHint(footer, text) {
+  footer.setContent(` ${text}
+ ${COPYRIGHT_LINE}`);
+}
+function resetFooterHint(footer) {
+  footer.setContent(`${DEFAULT_HINT}
+ ${COPYRIGHT_LINE}`);
+}
+
+// firewall/ufwParser.ts
+var NUMBERED_RULE = /^\[\s*(\d+)\]\s+(.+?)\s+(ALLOW|DENY|REJECT|LIMIT)(?:\s+(IN|OUT))?\s+(.+?)(?:\s+#\s*(.*))?$/i;
+function parseRules(output) {
+  const rules = [];
+  for (const line of output.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed.startsWith("[")) continue;
+    const match = NUMBERED_RULE.exec(trimmed);
+    if (!match) continue;
+    const id = Number(match[1]);
+    const to = match[2].trim();
+    const action = match[3].toUpperCase();
+    const direction = match[4]?.toUpperCase() || "IN";
+    const from = match[5].trim();
+    const comment = match[6]?.trim();
+    rules.push({
+      id,
+      to,
+      action,
+      direction,
+      from,
+      ...comment ? { comment } : {},
+      raw: trimmed
+    });
+  }
+  return rules;
+}
+function parseStatus(output) {
+  const statusLine = /^Status:\s*(active|inactive)/im.exec(output);
+  const loggingLine = /^Logging:\s*(.+)$/im.exec(output);
+  const defaultLine = /^Default:\s*(.+)$/im.exec(output);
+  let defaultIncoming;
+  let defaultOutgoing;
+  let defaultRouted;
+  if (defaultLine && defaultLine[1]) {
+    const parts = defaultLine[1].split(",").map((p) => p.trim());
+    for (const part of parts) {
+      const lower = part.toLowerCase();
+      if (lower.includes("incoming")) {
+        defaultIncoming = part.split("(")[0]?.trim();
+      } else if (lower.includes("outgoing")) {
+        defaultOutgoing = part.split("(")[0]?.trim();
+      } else if (lower.includes("routed")) {
+        defaultRouted = part.split("(")[0]?.trim();
+      }
+    }
+  }
+  const status = statusLine && statusLine[1] ? statusLine[1].toLowerCase() : "unknown";
+  return {
+    status,
+    logging: loggingLine?.[1]?.trim(),
+    defaultIncoming,
+    defaultOutgoing,
+    defaultRouted,
+    raw: output.trim()
+  };
+}
+function parseAppList(output) {
+  const apps = [];
+  let start = false;
+  for (const line of output.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    if (/available applications:/i.test(trimmed)) {
+      start = true;
+      continue;
+    }
+    if (start) {
+      apps.push(trimmed);
+    }
+  }
+  return apps;
+}
+function parseAppInfo(output) {
+  let title;
+  let description;
+  let ports;
+  const lines = output.split(/\r?\n/);
+  let inPorts = false;
+  const portLines = [];
+  for (const rawLine of lines) {
+    const line = rawLine.trim();
+    if (!line) continue;
+    const titleMatch = /^Title:\s*(.+)$/i.exec(line);
+    if (titleMatch) {
+      title = titleMatch[1]?.trim();
+      inPorts = false;
+      continue;
+    }
+    const descMatch = /^Description:\s*(.+)$/i.exec(line);
+    if (descMatch) {
+      description = descMatch[1]?.trim();
+      inPorts = false;
+      continue;
+    }
+    if (/^Ports:/i.test(line)) {
+      inPorts = true;
+      const remainder = line.replace(/^Ports:\s*/i, "").trim();
+      if (remainder) portLines.push(remainder);
+      continue;
+    }
+    if (inPorts) {
+      if (/^\w+:/.test(line)) {
+        inPorts = false;
+      } else {
+        portLines.push(line);
+      }
+    }
+  }
+  if (portLines.length > 0) {
+    ports = portLines.join(", ");
+  }
+  return { title, description, ports };
+}
+function getLocalAppProfiles(appDir = "/etc/ufw/applications.d") {
+  try {
+    const { readdirSync, readFileSync, existsSync: existsSync4 } = __require("fs");
+    if (!existsSync4(appDir)) return [];
+    const files = readdirSync(appDir);
+    const apps = [];
+    for (const file of files) {
+      const content = readFileSync(`${appDir}/${file}`, "utf-8");
+      for (const line of content.split(/\r?\n/)) {
+        const match = /^\[([^\]]+)\]/.exec(line.trim());
+        if (match && match[1]) {
+          apps.push(match[1].trim());
+        }
+      }
+    }
+    return Array.from(new Set(apps)).sort();
+  } catch {
+    return [];
+  }
+}
+
+// tui/components/Addrulemodal.ts
+import blessed7 from "blessed";
+
+// tui/components/BaseModal.ts
+import blessed6 from "blessed";
+var BaseModal = class {
+  constructor(screen, opts) {
+    this.screen = screen;
+    this.box = blessed6.box({
+      parent: screen,
+      label: ` ${opts.title} `,
+      top: "center",
+      left: "center",
+      width: opts.width ?? "60%",
+      height: opts.height ?? "40%",
+      border: { type: "line" },
+      style: {
+        border: { fg: "yellow" },
+        label: { fg: "yellow" }
+      },
+      shadow: true,
+      hidden: true
+    });
+  }
+  screen;
+  box;
+  screenBindings = [];
+  /**
+   * Modal chrome (Esc/Tab) can't be bound on `this.box` itself: blessed only
+   * emits "key <name>" on whichever element currently has focus, and focus
+   * always sits on a child field/button, not the box. Bind at the screen
+   * level instead and tear the listener down when the modal closes.
+   */
+  bindKey(keys, handler) {
+    this.screen.key(keys, handler);
+    this.screenBindings.push({ keys, handler });
+  }
+  show() {
+    this.box.show();
+    this.box.setFront();
+  }
+  destroy() {
+    for (const { keys, handler } of this.screenBindings) {
+      for (const key of keys) {
+        this.screen.removeKey(key, handler);
+      }
+    }
+    this.screenBindings.length = 0;
+    this.box.destroy();
+  }
+};
+
+// tui/components/Addrulemodal.ts
+var ACTIONS = ["allow", "deny", "reject", "limit"];
+var PROTOCOLS = ["any", "tcp", "udp"];
+var IP_OR_CIDR_RE = /^(\d{1,3}\.){3}\d{1,3}(\/\d{1,2})?$/;
+var AddRuleModal = class {
+  constructor(screen, callbacks) {
+    this.screen = screen;
+    this.callbacks = callbacks;
+    this.base = new BaseModal(screen, { title: "Add Rule", width: "55%", height: 16 });
+    const box = this.base.box;
+    blessed7.box({ parent: box, top: 0, left: 2, width: 14, content: "Action:" });
+    this.actionLabel = blessed7.box({
+      parent: box,
+      top: 0,
+      left: 16,
+      width: 28,
+      keys: true,
+      content: this.formatChoice(ACTIONS, this.actionIndex),
+      style: { fg: "cyan" }
+    });
+    blessed7.box({ parent: box, top: 1, left: 2, width: 14, content: "Port:" });
+    this.portInput = blessed7.textbox({
+      parent: box,
+      top: 1,
+      left: 16,
+      width: "70%-16",
+      height: 1,
+      keys: true,
+      style: { fg: "white", focus: { fg: "black", bg: "white" } }
+    });
+    blessed7.box({ parent: box, top: 2, left: 2, width: 14, content: "Protocol:" });
+    this.protocolLabel = blessed7.box({
+      parent: box,
+      top: 2,
+      left: 16,
+      width: 20,
+      keys: true,
+      content: this.formatChoice(PROTOCOLS, this.protocolIndex),
+      style: { fg: "cyan" }
+    });
+    blessed7.box({ parent: box, top: 3, left: 2, width: 14, content: "From (IP/CIDR):" });
+    this.fromInput = blessed7.textbox({
+      parent: box,
+      top: 3,
+      left: 16,
+      width: "70%-16",
+      height: 1,
+      keys: true,
+      style: { fg: "white", focus: { fg: "black", bg: "white" } }
+    });
+    blessed7.box({ parent: box, top: 4, left: 2, width: 14, content: "Comment:" });
+    this.commentInput = blessed7.textbox({
+      parent: box,
+      top: 4,
+      left: 16,
+      width: "70%-16",
+      height: 1,
+      keys: true,
+      style: { fg: "white", focus: { fg: "black", bg: "white" } }
+    });
+    this.errorLine = blessed7.box({
+      parent: box,
+      top: 6,
+      left: 2,
+      width: "90%",
+      height: 1,
+      content: "",
+      tags: true,
+      style: { fg: "red" }
+    });
+    this.submitBtn = blessed7.button({
+      parent: box,
+      top: 8,
+      left: 2,
+      width: 12,
+      height: 1,
+      keys: true,
+      content: "[ Submit ]",
+      align: "center",
+      style: { fg: "green", focus: { fg: "black", bg: "green" } }
+    });
+    blessed7.box({
+      parent: box,
+      top: 8,
+      right: 2,
+      width: 32,
+      height: 1,
+      content: "Tab: next  \u2190/\u2192: choice  Esc: cancel",
+      style: { fg: "gray" }
+    });
+    this.focusables = [
+      this.actionLabel,
+      this.portInput,
+      this.protocolLabel,
+      this.fromInput,
+      this.commentInput,
+      this.submitBtn
+    ];
+    this.bindKeys();
+    this.portInput.on("keypress", () => this.clearError());
+    this.fromInput.on("keypress", () => this.clearError());
+    this.commentInput.on("keypress", () => this.clearError());
+  }
+  screen;
+  callbacks;
+  base;
+  actionIndex = 0;
+  protocolIndex = 0;
+  actionLabel;
+  portInput;
+  protocolLabel;
+  fromInput;
+  commentInput;
+  errorLine;
+  submitBtn;
+  focusables;
+  focusIndex = 0;
+  formatChoice(options, index) {
+    return options.map((o, i) => i === index ? `[${o}]` : ` ${o} `).join(" ");
+  }
+  bindKeys() {
+    for (const widget of this.focusables) {
+      widget.key(["escape"], () => {
+        if (widget === this.portInput) this.portInput.cancel();
+        if (widget === this.fromInput) this.fromInput.cancel();
+        if (widget === this.commentInput) this.commentInput.cancel();
+        this.callbacks.onCancel();
+      });
+    }
+    this.actionLabel.key(["tab"], () => this.moveFocus(1));
+    this.actionLabel.key(["S-tab"], () => this.moveFocus(-1));
+    this.actionLabel.key(["left"], () => this.cycleCurrentSelect(-1));
+    this.actionLabel.key(["right"], () => this.cycleCurrentSelect(1));
+    this.actionLabel.key(["enter"], () => void this.trySubmit());
+    this.protocolLabel.key(["tab"], () => this.moveFocus(1));
+    this.protocolLabel.key(["S-tab"], () => this.moveFocus(-1));
+    this.protocolLabel.key(["left"], () => this.cycleCurrentSelect(-1));
+    this.protocolLabel.key(["right"], () => this.cycleCurrentSelect(1));
+    this.protocolLabel.key(["enter"], () => void this.trySubmit());
+    this.submitBtn.key(["tab"], () => this.moveFocus(1));
+    this.submitBtn.key(["S-tab"], () => this.moveFocus(-1));
+    this.submitBtn.key(["enter"], () => void this.trySubmit());
+    this.submitBtn.on("press", () => void this.trySubmit());
+    const wireTextbox = (tb) => {
+      tb.key(["tab"], () => {
+        tb.cancel();
+        this.moveFocus(1);
+      });
+      tb.key(["S-tab"], () => {
+        tb.cancel();
+        this.moveFocus(-1);
+      });
+      tb.key(["enter"], () => {
+        tb.submit();
+        void this.trySubmit();
+      });
+    };
+    wireTextbox(this.portInput);
+    wireTextbox(this.fromInput);
+    wireTextbox(this.commentInput);
+    this.base.bindKey(["escape"], () => this.callbacks.onCancel());
+  }
+  cycleCurrentSelect(delta) {
+    const current = this.focusables[this.focusIndex];
+    if (current === this.actionLabel) {
+      this.actionIndex = (this.actionIndex + delta + ACTIONS.length) % ACTIONS.length;
+      this.actionLabel.setContent(this.formatChoice(ACTIONS, this.actionIndex));
+      this.screen.render();
+    } else if (current === this.protocolLabel) {
+      this.protocolIndex = (this.protocolIndex + delta + PROTOCOLS.length) % PROTOCOLS.length;
+      this.protocolLabel.setContent(this.formatChoice(PROTOCOLS, this.protocolIndex));
+      this.screen.render();
+    }
+  }
+  moveFocus(delta) {
+    this.focusIndex = (this.focusIndex + delta + this.focusables.length) % this.focusables.length;
+    this.focus();
+  }
+  setError(message) {
+    this.errorLine.setContent(message ? `{red-fg}\u2717 ${message}{/red-fg}` : "");
+    this.screen.render();
+  }
+  clearError() {
+    if (this.errorLine.getContent()) this.setError("");
+  }
+  async trySubmit() {
+    const port = this.portInput.getValue().trim();
+    const from = this.fromInput.getValue().trim();
+    const comment = this.commentInput.getValue().trim();
+    if (!port) {
+      this.setError("Port is required.");
+      return;
+    }
+    if (!/^\d{1,5}(:\d{1,5})?$/.test(port)) {
+      this.setError("Port must be a number or a range like 8000:8100.");
+      return;
+    }
+    if (from && !IP_OR_CIDR_RE.test(from) && from.toLowerCase() !== "any") {
+      this.setError("From must be a valid IP/CIDR (e.g. 192.168.1.0/24) or empty.");
+      return;
+    }
+    this.setError("");
+    const protocol = PROTOCOLS[this.protocolIndex];
+    try {
+      await this.callbacks.onSubmit({
+        action: ACTIONS[this.actionIndex],
+        port,
+        protocol: protocol === "any" ? void 0 : protocol,
+        from: from ? from : void 0,
+        comment: comment ? comment : void 0
+      });
+    } catch (err) {
+      this.setError(err instanceof Error ? err.message : String(err));
+    }
+  }
+  show() {
+    this.base.show();
+  }
+  destroy() {
+    this.base.destroy();
+  }
+  focus() {
+    const current = this.focusables[this.focusIndex];
+    current.focus();
+    if (current === this.portInput || current === this.fromInput || current === this.commentInput) {
+      current.readInput();
+    }
+    this.screen.render();
+  }
+};
+
+// tui/components/Insertrulemodal.ts
+import blessed8 from "blessed";
+var IPV4_RE = /^(\d{1,3}\.){3}\d{1,3}(\/\d{1,2})?$/;
+var InsertRuleModal = class {
+  constructor(screen, defaultPosition, callbacks) {
+    this.screen = screen;
+    this.callbacks = callbacks;
+    this.base = new BaseModal(screen, { title: "Insert Rule (allow from IP)", width: "65%", height: "45%" });
+    const box = this.base.box;
+    blessed8.box({ parent: box, top: 1, left: 2, width: 16, content: "Insert at #:" });
+    this.ruleInput = blessed8.textbox({
+      parent: box,
+      top: 1,
+      left: 18,
+      width: 10,
+      height: 1,
+      inputOnFocus: true,
+      value: String(defaultPosition),
+      style: { fg: "white", focus: { fg: "black", bg: "white" } }
+    });
+    blessed8.box({ parent: box, top: 3, left: 2, width: 16, content: "From IP:" });
+    this.ipInput = blessed8.textbox({
+      parent: box,
+      top: 3,
+      left: 18,
+      width: "70%-20",
+      height: 1,
+      inputOnFocus: true,
+      style: { fg: "white", focus: { fg: "black", bg: "white" } }
+    });
+    this.errorLine = blessed8.box({
+      parent: box,
+      top: 5,
+      left: 2,
+      width: "90%",
+      height: 2,
+      content: "",
+      tags: true,
+      style: { fg: "red" }
+    });
+    this.submitBtn = blessed8.button({
+      parent: box,
+      bottom: 1,
+      left: 2,
+      width: 12,
+      height: 1,
+      content: "[ Submit ]",
+      align: "center",
+      style: { fg: "green", focus: { fg: "black", bg: "green" } }
+    });
+    this.focusables = [this.ruleInput, this.ipInput, this.submitBtn];
+    this.bindKeys();
+    this.ruleInput.on("keypress", () => this.clearError());
+    this.ipInput.on("keypress", () => this.clearError());
+  }
+  screen;
+  callbacks;
+  base;
+  ruleInput;
+  ipInput;
+  errorLine;
+  submitBtn;
+  focusables;
+  focusIndex = 0;
+  bindKeys() {
+    this.base.bindKey(["escape"], () => this.callbacks.onCancel());
+    this.base.bindKey(["tab"], () => this.moveFocus(1));
+    this.base.bindKey(["S-tab"], () => this.moveFocus(-1));
+    this.ruleInput.key(["enter"], () => this.moveFocus(1));
+    this.ipInput.key(["enter"], () => void this.trySubmit());
+    this.submitBtn.on("press", () => void this.trySubmit());
+    this.base.bindKey(["enter"], () => {
+      if (this.focusables[this.focusIndex] === this.submitBtn) void this.trySubmit();
+    });
+  }
+  moveFocus(delta) {
+    this.focusIndex = (this.focusIndex + delta + this.focusables.length) % this.focusables.length;
+    this.focus();
+  }
+  setError(message) {
+    this.errorLine.setContent(message ? `{red-fg}\u2717 ${message}{/red-fg}` : "");
+    this.screen.render();
+  }
+  clearError() {
+    if (this.errorLine.getContent()) this.setError("");
+  }
+  async trySubmit() {
+    const ruleStr = this.ruleInput.getValue().trim();
+    const ipAddr = this.ipInput.getValue().trim();
+    const rule = Number(ruleStr);
+    if (!Number.isInteger(rule) || rule < 1) {
+      this.setError("Position must be a positive integer.");
+      return;
+    }
+    if (!IPV4_RE.test(ipAddr)) {
+      this.setError("Enter a valid IPv4 address, e.g. 10.0.0.5 or 10.0.0.0/24.");
+      return;
+    }
+    this.setError("");
+    try {
+      await this.callbacks.onSubmit({ rule, ipAddr });
+    } catch (err) {
+      this.setError(err instanceof Error ? err.message : String(err));
+    }
+  }
+  show() {
+    this.base.show();
+  }
+  destroy() {
+    this.base.destroy();
+  }
+  focus() {
+    this.focusables[this.focusIndex].focus();
+    this.screen.render();
+  }
+};
+
+// tui/components/Confirmmodal.ts
+import blessed9 from "blessed";
+var ConfirmModal = class {
+  constructor(screen, opts, callbacks) {
+    this.screen = screen;
+    this.callbacks = callbacks;
+    this.base = new BaseModal(screen, { title: opts.title, width: "55%", height: "35%" });
+    const box = this.base.box;
+    blessed9.box({ parent: box, top: 1, left: 2, width: "90%", height: 3, content: opts.message });
+    this.errorLine = blessed9.box({
+      parent: box,
+      top: 4,
+      left: 2,
+      width: "90%",
+      height: 2,
+      content: "",
+      style: { fg: "red" }
+    });
+    this.yesBtn = blessed9.button({
+      parent: box,
+      bottom: 1,
+      left: 2,
+      width: (opts.confirmLabel?.length ?? 3) + 4,
+      height: 1,
+      content: `[ ${opts.confirmLabel ?? "Yes"} ]`,
+      align: "center",
+      style: { fg: "red", focus: { fg: "black", bg: "red" } }
+    });
+    this.noBtn = blessed9.button({
+      parent: box,
+      bottom: 1,
+      left: (opts.confirmLabel?.length ?? 3) + 8,
+      width: 10,
+      height: 1,
+      content: "[ No ]",
+      align: "center",
+      style: { fg: "white", focus: { fg: "black", bg: "white" } }
+    });
+    this.focusables = [this.yesBtn, this.noBtn];
+    this.focusIndex = opts.dangerous === false ? 0 : 1;
+    this.base.bindKey(["escape"], () => this.callbacks.onCancel());
+    this.base.bindKey(["tab", "left", "right"], () => {
+      this.focusIndex = 1 - this.focusIndex;
+      this.focus();
+    });
+    this.base.bindKey(["enter"], () => {
+      if (this.focusables[this.focusIndex] === this.yesBtn) void this.tryConfirm();
+      else this.callbacks.onCancel();
+    });
+    this.yesBtn.on("press", () => void this.tryConfirm());
+    this.noBtn.on("press", () => this.callbacks.onCancel());
+  }
+  screen;
+  callbacks;
+  base;
+  yesBtn;
+  noBtn;
+  focusables;
+  focusIndex;
+  errorLine;
+  async tryConfirm() {
+    try {
+      await this.callbacks.onConfirm();
+    } catch (err) {
+      this.errorLine.setContent(err instanceof Error ? err.message : String(err));
+      this.screen.render();
+    }
+  }
+  show() {
+    this.base.show();
+  }
+  destroy() {
+    this.base.destroy();
+  }
+  focus() {
+    this.focusables[this.focusIndex].focus();
+    this.screen.render();
+  }
+};
+
+// tui/components/Helpmodal.ts
+import blessed10 from "blessed";
+var HELP_TEXT = [
+  "{bold}{cyan-fg}Navigation & Layout:{/cyan-fg}{/bold}",
+  "  1 / 2 / 3 / 4     Jump to Panel (Status / Rules / Raw / Detail)",
+  "  Tab / Shift-Tab   Cycle focus forward / backward between panels",
+  "  Esc               Restore normal split layout from maximized view",
+  "  x                 Open Lazydocker Actions Menu",
+  "",
+  "{bold}{cyan-fg}Firewall Management Actions:{/cyan-fg}{/bold}",
+  "  a                 Add firewall rule (port, protocol, from IP/CIDR, comment)",
+  "  P                 Application profiles (browse, inspect, allow/deny apps)",
+  "  i                 Insert rule at specific position",
+  "  d                 Delete currently selected rule",
+  "  e                 Enable UFW firewall (ufw --force enable)",
+  "  D                 Disable UFW firewall (with SSH Lockout Protection)",
+  "  L                 Set UFW logging level modal (low, medium, high, off)",
+  "  l                 Quick toggle UFW logging (on / off)",
+  "  /                 Search / filter rules in Rules panel",
+  "  o                 Cycle sort mode in Rules panel (id, action, to, from)",
+  "  c                 Clear active search filter",
+  "  R                 Reset UFW firewall (factory reset rules)",
+  "  r                 Refresh firewall status and rules",
+  "  s                 Configure passwordless sudo (one-time setup)",
+  "",
+  "{bold}{cyan-fg}General:{/cyan-fg}{/bold}",
+  "  ?                 Toggle this help dialog",
+  "  q / Ctrl-C        Quit lazyufw",
+  "",
+  "{bold}{cyan-fg}Inside Dialogs / Modals:{/cyan-fg}{/bold}",
+  "  Tab / Shift-Tab   Switch between fields and buttons",
+  "  \u2190 / \u2192             Cycle selection values (allow/deny/protocol)",
+  "  Enter             Submit form or trigger focused button",
+  "  Esc               Close / Cancel"
+].join("\n");
+var HelpModal = class {
+  constructor(screen, onClose) {
+    this.screen = screen;
+    this.onClose = onClose;
+    this.base = new BaseModal(screen, { title: "Help", width: "60%", height: "60%" });
+    blessed10.box({
+      parent: this.base.box,
+      top: 1,
+      left: 2,
+      width: "90%",
+      height: "80%",
+      content: HELP_TEXT
+    });
+    this.base.bindKey(["escape", "?", "S-/", "h", "S-h", "q", "enter"], () => this.onClose());
+  }
+  screen;
+  onClose;
+  base;
+  show() {
+    this.base.show();
+  }
+  destroy() {
+    this.base.destroy();
+  }
+  focus() {
+    this.base.box.focus();
+    this.screen.render();
+  }
+};
+
+// tui/components/SshWarningModal.ts
+import blessed11 from "blessed";
+var SshWarningModal = class {
+  constructor(screen, sshInfo, callbacks) {
+    this.screen = screen;
+    this.callbacks = callbacks;
+    this.base = new BaseModal(screen, {
+      title: "\u26A0\uFE0F  SSH LOCKOUT PROTECTION WARNING",
+      width: "65%",
+      height: "55%"
+    });
+    const box = this.base.box;
+    box.style.border.fg = "red";
+    box.style.label = { fg: "red", bold: true };
+    const message = `{bold}{red-fg}\u26A0\uFE0F  DANGER: ACTIVE SSH SESSION DETECTED{/red-fg}{/bold}
+
+Disabling the firewall may disconnect your session or leave your server
+vulnerable to lockouts!
+
+{yellow-fg}Connection Info:{/yellow-fg} ${sshInfo.details || "SSH is active on port 22"}
+
+{white-fg}Are you sure you want to proceed with disabling UFW?{/white-fg}`;
+    blessed11.box({
+      parent: box,
+      top: 1,
+      left: 2,
+      width: "92%",
+      height: 8,
+      tags: true,
+      content: message
+    });
+    this.errorLine = blessed11.box({
+      parent: box,
+      top: 9,
+      left: 2,
+      width: "92%",
+      height: 2,
+      tags: true,
+      content: "",
+      style: { fg: "red" }
+    });
+    this.cancelBtn = blessed11.button({
+      parent: box,
+      bottom: 1,
+      left: 2,
+      width: 25,
+      height: 1,
+      content: "[ Cancel (Keep Safe) ]",
+      align: "center",
+      style: {
+        fg: "green",
+        bold: true,
+        focus: { fg: "black", bg: "green" }
+      }
+    });
+    this.confirmBtn = blessed11.button({
+      parent: box,
+      bottom: 1,
+      left: 30,
+      width: 26,
+      height: 1,
+      content: "[ Force Disable Firewall ]",
+      align: "center",
+      style: {
+        fg: "red",
+        bold: true,
+        focus: { fg: "white", bg: "red" }
+      }
+    });
+    this.focusables = [this.cancelBtn, this.confirmBtn];
+    this.focusIndex = 0;
+    this.base.bindKey(["escape"], () => this.callbacks.onCancel());
+    this.base.bindKey(["tab", "left", "right"], () => {
+      this.focusIndex = 1 - this.focusIndex;
+      this.focus();
+    });
+    this.base.bindKey(["enter"], () => {
+      if (this.focusables[this.focusIndex] === this.confirmBtn) {
+        void this.tryConfirm();
+      } else {
+        this.callbacks.onCancel();
+      }
+    });
+    this.cancelBtn.on("press", () => this.callbacks.onCancel());
+    this.confirmBtn.on("press", () => void this.tryConfirm());
+  }
+  screen;
+  callbacks;
+  base;
+  cancelBtn;
+  confirmBtn;
+  focusables;
+  focusIndex = 0;
+  errorLine;
+  async tryConfirm() {
+    try {
+      await this.callbacks.onConfirm();
+    } catch (err) {
+      this.errorLine.setContent(err instanceof Error ? err.message : String(err));
+      this.screen.render();
+    }
+  }
+  show() {
+    this.base.show();
+  }
+  destroy() {
+    this.base.destroy();
+  }
+  focus() {
+    this.focusables[this.focusIndex].focus();
+    this.screen.render();
+  }
+};
+
+// tui/components/LoggingModal.ts
+import blessed12 from "blessed";
+var LOG_OPTIONS = [
+  {
+    level: "low",
+    label: "Low (Recommended)",
+    description: "Logs all blocked packets (not matching default policy) and packets matching logged rules."
+  },
+  {
+    level: "medium",
+    label: "Medium",
+    description: "Low + logs all allowed packets not matching policy, INVALID packets, and all new connections."
+  },
+  {
+    level: "high",
+    label: "High",
+    description: "Medium + rate-limiting logs (very verbose; may produce high disk I/O)."
+  },
+  {
+    level: "off",
+    label: "Off (Disable Logging)",
+    description: "Completely disables UFW firewall packet logging."
+  }
+];
+var LoggingModal = class {
+  constructor(screen, currentLevel, callbacks) {
+    this.screen = screen;
+    this.callbacks = callbacks;
+    this.base = new BaseModal(screen, {
+      title: "Set UFW Logging Level [L]",
+      width: "55%",
+      height: 17
+    });
+    const box = this.base.box;
+    const normCurrent = (currentLevel ?? "").toLowerCase();
+    blessed12.box({
+      parent: box,
+      top: 0,
+      left: 2,
+      width: "90%",
+      height: 1,
+      tags: true,
+      content: `{bold}Select firewall logging level:{/bold}  Current: {yellow-fg}${currentLevel || "off"}{/yellow-fg}`
+    });
+    const items = LOG_OPTIONS.map((opt, i) => {
+      const isCur = normCurrent.includes(opt.level);
+      const marker = isCur ? "{green-fg}\u25CF{/green-fg} " : "\u25CB ";
+      return `${i + 1}. ${marker}${opt.label}`;
+    });
+    this.list = blessed12.list({
+      parent: box,
+      top: 2,
+      left: 2,
+      width: "90%",
+      height: 5,
+      keys: true,
+      vi: true,
+      mouse: true,
+      tags: true,
+      items,
+      style: {
+        selected: { fg: "black", bg: "cyan", bold: true },
+        item: { fg: "white" }
+      }
+    });
+    this.descBox = blessed12.box({
+      parent: box,
+      top: 8,
+      left: 2,
+      width: "90%",
+      height: 4,
+      border: { type: "line" },
+      style: { border: { fg: "gray" } },
+      tags: true,
+      content: `{gray-fg}${LOG_OPTIONS[0]?.description}{/gray-fg}`
+    });
+    this.errorLine = blessed12.box({
+      parent: box,
+      top: 12,
+      left: 2,
+      width: "90%",
+      height: 1,
+      tags: true,
+      content: "",
+      style: { fg: "red" }
+    });
+    blessed12.box({
+      parent: box,
+      top: 14,
+      left: 2,
+      width: "90%",
+      height: 1,
+      style: { fg: "gray" },
+      content: "\u2191/\u2193: select  Enter: apply  Esc: cancel"
+    });
+    const initialIdx = LOG_OPTIONS.findIndex((o) => normCurrent.includes(o.level));
+    this.list.select(initialIdx >= 0 ? initialIdx : 0);
+    this.updateDescription();
+    this.list.on("select item", () => this.updateDescription());
+    this.list.key(["enter"], () => void this.trySubmit());
+    this.list.on("select", () => void this.trySubmit());
+    this.base.bindKey(["escape"], () => this.callbacks.onCancel());
+    this.list.key(["1", "2", "3", "4"], (_ch, key) => {
+      const idx = Number(key.name) - 1;
+      if (idx >= 0 && idx < LOG_OPTIONS.length) {
+        this.list.select(idx);
+        this.updateDescription();
+        void this.trySubmit();
+      }
+    });
+  }
+  screen;
+  callbacks;
+  base;
+  list;
+  descBox;
+  errorLine;
+  updateDescription() {
+    const idx = this.list.selected;
+    const opt = LOG_OPTIONS[idx];
+    if (opt) {
+      this.descBox.setContent(`{gray-fg}${opt.description}{/gray-fg}`);
+      this.screen.render();
+    }
+  }
+  async trySubmit() {
+    const idx = this.list.selected;
+    const opt = LOG_OPTIONS[idx];
+    if (!opt) return;
+    try {
+      await this.callbacks.onSelect(opt.level);
+    } catch (err) {
+      this.errorLine.setContent(err instanceof Error ? err.message : String(err));
+      this.screen.render();
+    }
+  }
+  show() {
+    this.base.show();
+  }
+  destroy() {
+    this.base.destroy();
+  }
+  focus() {
+    this.list.focus();
+    this.screen.render();
+  }
+};
+
+// tui/components/AppProfilesModal.ts
+import blessed13 from "blessed";
+var ACTIONS2 = ["allow", "deny", "reject", "limit"];
+var AppProfilesModal = class {
+  constructor(screen, profiles, callbacks) {
+    this.screen = screen;
+    this.callbacks = callbacks;
+    this.base = new BaseModal(screen, {
+      title: "Application Profiles [P]",
+      width: "75%",
+      height: "75%"
+    });
+    const box = this.base.box;
+    this.allProfiles = [...profiles];
+    this.filteredProfiles = [...profiles];
+    blessed13.box({ parent: box, top: 0, left: 2, width: 8, height: 1, content: "Search:" });
+    this.searchInput = blessed13.textbox({
+      parent: box,
+      top: 0,
+      left: 11,
+      width: "40%-11",
+      height: 1,
+      keys: true,
+      style: { fg: "white", focus: { fg: "black", bg: "white" } }
+    });
+    this.profileList = blessed13.list({
+      parent: box,
+      top: 2,
+      left: 2,
+      width: "40%",
+      height: "100%-7",
+      border: { type: "line" },
+      keys: true,
+      vi: true,
+      mouse: true,
+      tags: true,
+      items: this.filteredProfiles.length > 0 ? this.filteredProfiles : ["{gray-fg}No profiles found{/gray-fg}"],
+      style: {
+        selected: { fg: "black", bg: "cyan", bold: true },
+        border: { fg: "gray" },
+        item: { fg: "white" }
+      }
+    });
+    this.detailBox = blessed13.box({
+      parent: box,
+      top: 0,
+      left: "44%",
+      width: "54%",
+      height: "100%-7",
+      border: { type: "line" },
+      tags: true,
+      style: { border: { fg: "gray" } },
+      content: "{gray-fg}Select an application profile to view details...{/gray-fg}"
+    });
+    blessed13.box({
+      parent: box,
+      bottom: 2,
+      left: 2,
+      width: 8,
+      height: 1,
+      content: "Action:"
+    });
+    this.actionLabel = blessed13.box({
+      parent: box,
+      bottom: 2,
+      left: 11,
+      width: 34,
+      height: 1,
+      keys: true,
+      content: this.formatActions(),
+      style: { fg: "cyan" }
+    });
+    this.applyBtn = blessed13.button({
+      parent: box,
+      bottom: 2,
+      left: 48,
+      width: 14,
+      height: 1,
+      keys: true,
+      content: "[ Apply Rule ]",
+      align: "center",
+      style: { fg: "green", focus: { fg: "black", bg: "green" } }
+    });
+    this.errorLine = blessed13.box({
+      parent: box,
+      bottom: 1,
+      left: 2,
+      width: "90%",
+      height: 1,
+      tags: true,
+      content: "",
+      style: { fg: "red" }
+    });
+    blessed13.box({
+      parent: box,
+      bottom: 0,
+      left: 2,
+      width: "90%",
+      height: 1,
+      style: { fg: "gray" },
+      content: "Tab: switch controls  \u2191/\u2193: select profile  \u2190/\u2192: change action  Enter: apply  Esc: close"
+    });
+    this.focusables = [this.searchInput, this.profileList, this.actionLabel, this.applyBtn];
+    this.bindEvents();
+    if (this.filteredProfiles.length > 0) {
+      void this.loadSelectedDetail();
+    }
+  }
+  screen;
+  callbacks;
+  base;
+  profileList;
+  searchInput;
+  detailBox;
+  actionLabel;
+  applyBtn;
+  errorLine;
+  focusables;
+  focusIndex = 0;
+  actionIndex = 0;
+  allProfiles = [];
+  filteredProfiles = [];
+  infoCache = /* @__PURE__ */ new Map();
+  formatActions() {
+    return ACTIONS2.map((a, i) => i === this.actionIndex ? `[${a}]` : ` ${a} `).join(" ");
+  }
+  bindEvents() {
+    this.base.bindKey(["escape"], () => {
+      if (this.screen.focused === this.searchInput) this.searchInput.cancel();
+      this.callbacks.onCancel();
+    });
+    this.searchInput.on("keypress", () => {
+      setTimeout(() => this.filterList(this.searchInput.getValue()), 10);
+    });
+    this.searchInput.key(["enter"], () => {
+      this.searchInput.cancel();
+      this.moveFocus(1);
+    });
+    this.searchInput.key(["tab"], () => {
+      this.searchInput.cancel();
+      this.moveFocus(1);
+    });
+    this.searchInput.key(["S-tab"], () => {
+      this.searchInput.cancel();
+      this.moveFocus(-1);
+    });
+    this.profileList.on("select item", () => void this.loadSelectedDetail());
+    this.profileList.key(["tab"], () => this.moveFocus(1));
+    this.profileList.key(["S-tab"], () => this.moveFocus(-1));
+    this.profileList.key(["enter"], () => void this.tryApply());
+    this.actionLabel.key(["tab"], () => this.moveFocus(1));
+    this.actionLabel.key(["S-tab"], () => this.moveFocus(-1));
+    this.actionLabel.key(["left"], () => this.cycleAction(-1));
+    this.actionLabel.key(["right"], () => this.cycleAction(1));
+    this.actionLabel.key(["enter"], () => void this.tryApply());
+    this.applyBtn.key(["tab"], () => this.moveFocus(1));
+    this.applyBtn.key(["S-tab"], () => this.moveFocus(-1));
+    this.applyBtn.key(["enter"], () => void this.tryApply());
+    this.applyBtn.on("press", () => void this.tryApply());
+  }
+  filterList(query) {
+    const q = query.trim().toLowerCase();
+    if (!q) {
+      this.filteredProfiles = [...this.allProfiles];
+    } else {
+      this.filteredProfiles = this.allProfiles.filter((p) => p.toLowerCase().includes(q));
+    }
+    if (this.filteredProfiles.length === 0) {
+      this.profileList.setItems(["{gray-fg}No matching profiles{/gray-fg}"]);
+      this.detailBox.setContent("{gray-fg}No profile selected{/gray-fg}");
+    } else {
+      this.profileList.setItems(this.filteredProfiles);
+      this.profileList.select(0);
+      void this.loadSelectedDetail();
+    }
+    this.screen.render();
+  }
+  getSelectedProfile() {
+    if (this.filteredProfiles.length === 0) return void 0;
+    const idx = this.profileList.selected;
+    return this.filteredProfiles[idx];
+  }
+  async loadSelectedDetail() {
+    const appName = this.getSelectedProfile();
+    if (!appName) return;
+    let info = this.infoCache.get(appName);
+    if (!info) {
+      this.detailBox.setContent(`{gray-fg}Loading details for ${appName}...{/gray-fg}`);
+      this.screen.render();
+      try {
+        info = await this.callbacks.onLoadInfo(appName);
+        this.infoCache.set(appName, info);
+      } catch (err) {
+        this.detailBox.setContent(`{red-fg}Failed to load profile: ${err instanceof Error ? err.message : String(err)}{/red-fg}`);
+        this.screen.render();
+        return;
+      }
+    }
+    const lines = [
+      `{bold}{cyan-fg}Profile:{/cyan-fg}     ${info.name}{/bold}`,
+      `\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501`,
+      info.title ? ` {bold}Title:{/bold}       ${info.title}` : "",
+      info.description ? ` {bold}Description:{/bold} ${info.description}` : "",
+      ` {bold}Ports:{/bold}       {green-fg}${info.ports || "N/A"}{/green-fg}`,
+      "",
+      `{bold}CLI Command Equivalent:{/bold}`,
+      `  {green-fg}$ sudo ufw ${ACTIONS2[this.actionIndex]} "${info.name}"{/green-fg}`
+    ].filter(Boolean);
+    this.detailBox.setContent(lines.join("\n"));
+    this.screen.render();
+  }
+  cycleAction(delta) {
+    this.actionIndex = (this.actionIndex + delta + ACTIONS2.length) % ACTIONS2.length;
+    this.actionLabel.setContent(this.formatActions());
+    void this.loadSelectedDetail();
+    this.screen.render();
+  }
+  moveFocus(delta) {
+    this.focusIndex = (this.focusIndex + delta + this.focusables.length) % this.focusables.length;
+    this.focus();
+  }
+  async tryApply() {
+    const appName = this.getSelectedProfile();
+    if (!appName) {
+      this.errorLine.setContent("{red-fg}No application profile selected.{/red-fg}");
+      this.screen.render();
+      return;
+    }
+    this.errorLine.setContent("");
+    const action = ACTIONS2[this.actionIndex];
+    try {
+      await this.callbacks.onApply(appName, action);
+    } catch (err) {
+      this.errorLine.setContent(`{red-fg}Error: ${err instanceof Error ? err.message : String(err)}{/red-fg}`);
+      this.screen.render();
+    }
+  }
+  show() {
+    this.base.show();
+  }
+  destroy() {
+    this.base.destroy();
+  }
+  focus() {
+    const current = this.focusables[this.focusIndex];
+    current.focus();
+    if (current === this.searchInput) {
+      this.searchInput.readInput();
+    }
+    this.screen.render();
+  }
+};
+
+// tui/components/ActionMenuModal.ts
+import blessed14 from "blessed";
+var ActionMenuModal = class {
+  constructor(screen, items, onClose) {
+    this.screen = screen;
+    this.items = items;
+    this.onClose = onClose;
+    const itemCount = items.length;
+    const boxHeight = itemCount + 3;
+    this.base = new BaseModal(screen, {
+      title: "Actions (Lazydocker Menu)",
+      width: "50%",
+      height: boxHeight
+    });
+    const box = this.base.box;
+    const renderedItems = items.map(
+      (item) => `{bold}{cyan-fg}[${item.key}]{/cyan-fg} ${item.label.padEnd(20)}{/bold} {gray-fg}${item.description}{/gray-fg}`
+    );
+    this.list = blessed14.list({
+      parent: box,
+      top: 0,
+      left: 1,
+      width: "96%",
+      height: itemCount,
+      keys: true,
+      mouse: true,
+      tags: true,
+      style: {
+        selected: { fg: "black", bg: theme.border.focus, bold: true },
+        item: { fg: "white" }
+      },
+      items: renderedItems
+    });
+    blessed14.box({
+      parent: box,
+      top: itemCount,
+      left: 2,
+      width: "90%",
+      height: 1,
+      content: "{gray-fg}Enter/Key: run action  |  Esc: close menu{/gray-fg}",
+      tags: true
+    });
+    this.base.bindKey(["escape"], () => this.onClose());
+    this.list.on("select", (_item, index) => {
+      const chosen = this.items[index];
+      this.onClose();
+      if (chosen) void chosen.action();
+    });
+    for (const item of items) {
+      const keys = [item.key];
+      if (item.key === item.key.toUpperCase() && item.key !== item.key.toLowerCase()) {
+        keys.push(`S-${item.key.toLowerCase()}`);
+      } else if (item.key === item.key.toLowerCase() && item.key !== item.key.toUpperCase()) {
+        keys.push(item.key.toLowerCase());
+      }
+      if (item.key === "?") {
+        keys.push("S-/", "h", "S-h", "f1");
+      }
+      this.base.bindKey(keys, () => {
+        this.onClose();
+        void item.action();
+      });
+    }
+  }
+  screen;
+  items;
+  onClose;
+  base;
+  list;
+  show() {
+    this.base.show();
+  }
+  destroy() {
+    this.base.destroy();
+  }
+  focus() {
+    this.list.focus();
+    this.screen.render();
+  }
+};
+
+// utils/exec.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+var execFileAsync = promisify(execFile);
+var execute = async (command, args) => {
+  try {
+    const result = await execFileAsync(command, args);
+    return {
+      stdout: result.stdout,
+      stderr: result.stderr,
+      code: 0
+    };
+  } catch (error) {
+    return {
+      stdout: error.stdout ?? "",
+      stderr: error.stderr || error.message || "",
+      code: typeof error.code === "number" ? error.code : 1
+    };
+  }
+};
+var exec_default = execute;
+
+// security/sshProtection.ts
+function parseSshEnv(env = process.env) {
+  const client = env.SSH_CLIENT;
+  const connection = env.SSH_CONNECTION;
+  const tty = env.SSH_TTY;
+  if (client) {
+    const [clientIp, clientPort, serverPort] = client.trim().split(/\s+/);
+    return {
+      isActive: true,
+      clientIp,
+      clientPort,
+      serverPort: serverPort || "22",
+      tty,
+      details: `Active SSH session from ${clientIp}:${clientPort || "unknown"} (port ${serverPort || "22"})${tty ? ` on ${tty}` : ""}`
+    };
+  }
+  if (connection) {
+    const [clientIp, clientPort, , serverPort] = connection.trim().split(/\s+/);
+    return {
+      isActive: true,
+      clientIp,
+      clientPort,
+      serverPort: serverPort || "22",
+      tty,
+      details: `Active SSH connection from ${clientIp}:${clientPort || "unknown"} (port ${serverPort || "22"})`
+    };
+  }
+  if (tty) {
+    return {
+      isActive: true,
+      tty,
+      details: `Active SSH TTY ${tty}`
+    };
+  }
+  return { isActive: false };
+}
+async function detectActiveSshSession(env = process.env) {
+  const envInfo = parseSshEnv(env);
+  if (envInfo.isActive) {
+    return envInfo;
+  }
+  try {
+    const ssRes = await exec_default("ss", ["-tlpn", "sport = :22"]);
+    if (ssRes.code === 0 && ssRes.stdout.includes(":22")) {
+      return {
+        isActive: true,
+        serverPort: "22",
+        details: "SSH service is listening on port 22"
+      };
+    }
+  } catch {
+  }
+  try {
+    const systemctlRes = await exec_default("systemctl", ["is-active", "ssh"]);
+    if (systemctlRes.code === 0 && systemctlRes.stdout.trim() === "active") {
+      return {
+        isActive: true,
+        serverPort: "22",
+        details: "SSH systemd service is active"
+      };
+    }
+  } catch {
+  }
+  return { isActive: false };
+}
+
+// tui/layout.ts
+var LayoutManager = class {
+  constructor(screen, panels) {
+    this.screen = screen;
+    this.panels = panels;
+    this.screen.on("resize", () => {
+      this.apply(false);
+    });
+  }
+  screen;
+  panels;
+  maximized = null;
+  leftActive = "rules";
+  rightActive = "detail";
+  animTimer = null;
+  currentGeometries = /* @__PURE__ */ new Map();
+  find(id) {
+    const panel = this.panels.find((p) => p.id === id);
+    if (!panel) throw new Error(`Unknown panel: ${id}`);
+    return panel;
+  }
+  setLabel(panel, suffix = "") {
+    panel.widget.setLabel(
+      ` ${panel.baseLabel}${suffix} `
+    );
+  }
+  computeTargets() {
+    const targets = /* @__PURE__ */ new Map();
+    const screenW = Number(this.screen.width) || 80;
+    const screenH = Number(this.screen.height) || 24;
+    const usableTop = 3;
+    const usableH = Math.max(12, screenH - 6);
+    const leftW = Math.floor(screenW / 2);
+    const rightW = screenW - leftW;
+    const spineH = Math.max(3, Math.min(5, Math.floor(usableH / 4)));
+    if (this.leftActive === "rules") {
+      targets.set("status", {
+        top: usableTop,
+        left: 0,
+        width: leftW,
+        height: spineH + 1
+      });
+      targets.set("rules", {
+        top: usableTop + spineH - 1,
+        left: 0,
+        width: leftW,
+        height: usableH - (spineH - 1)
+      });
+    } else {
+      targets.set("status", {
+        top: usableTop,
+        left: 0,
+        width: leftW,
+        height: usableH - spineH
+      });
+      targets.set("rules", {
+        top: usableTop + usableH - spineH,
+        left: 0,
+        width: leftW,
+        height: spineH
+      });
+    }
+    if (this.rightActive === "detail") {
+      targets.set("raw", {
+        top: usableTop,
+        left: leftW,
+        width: rightW,
+        height: spineH + 1
+      });
+      targets.set("detail", {
+        top: usableTop + spineH - 1,
+        left: leftW,
+        width: rightW,
+        height: usableH - (spineH - 1)
+      });
+    } else {
+      targets.set("raw", {
+        top: usableTop,
+        left: leftW,
+        width: rightW,
+        height: usableH - spineH
+      });
+      targets.set("detail", {
+        top: usableTop + usableH - spineH,
+        left: leftW,
+        width: rightW,
+        height: spineH
+      });
+    }
+    return targets;
+  }
+  applyGeometry(panel, geom) {
+    panel.widget.top = geom.top;
+    panel.widget.left = geom.left;
+    panel.widget.width = geom.width;
+    panel.widget.height = geom.height;
+  }
+  orderFront() {
+    const status = this.find("status");
+    const rules = this.find("rules");
+    const raw = this.find("raw");
+    const detail = this.find("detail");
+    if (this.leftActive === "rules") {
+      status.widget.setFront();
+      rules.widget.setFront();
+    } else {
+      rules.widget.setFront();
+      status.widget.setFront();
+    }
+    if (this.rightActive === "detail") {
+      raw.widget.setFront();
+      detail.widget.setFront();
+    } else {
+      detail.widget.setFront();
+      raw.widget.setFront();
+    }
+  }
+  apply(animate = false) {
+    if (this.animTimer) {
+      clearTimeout(this.animTimer);
+      this.animTimer = null;
+    }
+    if (this.maximized) {
+      for (const p of this.panels) {
+        if (p.id === this.maximized) {
+          p.widget.top = 3;
+          p.widget.left = 0;
+          p.widget.width = "100%";
+          p.widget.height = "100%-6";
+          p.widget.show();
+          p.widget.setFront();
+          this.setLabel(p, " [max]");
+        } else {
+          p.widget.hide();
+        }
+      }
+      this.screen.render();
+      return;
+    }
+    for (const p of this.panels) {
+      p.widget.show();
+      this.setLabel(p, "");
+    }
+    const targets = this.computeTargets();
+    if (!animate || this.currentGeometries.size === 0) {
+      for (const p of this.panels) {
+        const geom = targets.get(p.id);
+        this.applyGeometry(p, geom);
+        this.currentGeometries.set(p.id, { ...geom });
+      }
+      this.orderFront();
+      this.screen.render();
+      return;
+    }
+    const starts = /* @__PURE__ */ new Map();
+    for (const p of this.panels) {
+      const cur = this.currentGeometries.get(p.id) ?? targets.get(p.id);
+      starts.set(p.id, { ...cur });
+    }
+    this.orderFront();
+    const totalFrames = 7;
+    const frameIntervalMs = 15;
+    let currentFrame = 0;
+    const step = () => {
+      currentFrame++;
+      const progress = currentFrame / totalFrames;
+      const ease = 1 - Math.pow(1 - progress, 3);
+      for (const p of this.panels) {
+        const start = starts.get(p.id);
+        const target = targets.get(p.id);
+        const inter = {
+          top: Math.round(start.top + (target.top - start.top) * ease),
+          left: Math.round(start.left + (target.left - start.left) * ease),
+          width: Math.round(start.width + (target.width - start.width) * ease),
+          height: Math.round(start.height + (target.height - start.height) * ease)
+        };
+        this.applyGeometry(p, inter);
+        this.currentGeometries.set(p.id, inter);
+      }
+      this.screen.render();
+      if (currentFrame < totalFrames) {
+        this.animTimer = setTimeout(step, frameIntervalMs);
+      } else {
+        for (const p of this.panels) {
+          const finalGeom = targets.get(p.id);
+          this.applyGeometry(p, finalGeom);
+          this.currentGeometries.set(p.id, { ...finalGeom });
+        }
+        this.orderFront();
+        this.screen.render();
+        this.animTimer = null;
+      }
+    };
+    this.animTimer = setTimeout(step, frameIntervalMs);
+  }
+  /**
+   * Activates a panel and smoothly animates its stack to bring the book forward.
+   */
+  activatePanel(id, animate = true) {
+    let changed = false;
+    if (id === "status" && this.leftActive !== "status") {
+      this.leftActive = "status";
+      changed = true;
+    } else if (id === "rules" && this.leftActive !== "rules") {
+      this.leftActive = "rules";
+      changed = true;
+    } else if (id === "raw" && this.rightActive !== "raw") {
+      this.rightActive = "raw";
+      changed = true;
+    } else if (id === "detail" && this.rightActive !== "detail") {
+      this.rightActive = "detail";
+      changed = true;
+    }
+    if (this.maximized !== null) {
+      this.maximized = id;
+      this.apply(false);
+      return;
+    }
+    if (changed || this.currentGeometries.size === 0) {
+      this.apply(animate);
+    } else {
+      this.orderFront();
+      this.screen.render();
+    }
+  }
+  toggleMaximize(id) {
+    this.maximized = this.maximized === id ? null : id;
+    this.apply(false);
+  }
+  restoreSplit() {
+    if (this.maximized !== null) {
+      this.maximized = null;
+      this.apply(false);
+    }
+  }
+  isMaximized() {
+    return this.maximized !== null;
+  }
+};
+
+// tui/dashboard.ts
+var Dashboard = class {
+  constructor(client) {
+    this.client = client;
+    this.screen = blessed15.screen({
+      smartCSR: true,
+      title: "lazyufw - Lazydocker Style UFW Manager",
+      ignoreLocked: ["escape", "tab", "S-tab", "C-c"]
+    });
+    this.header = createHeader();
+    this.footer = createFooter();
+    this.statusPanel = new StatusPanel();
+    this.rulesPanel = new RulesPanel();
+    this.rawPanel = new RawPanel();
+    this.detailPanel = new DetailPanel();
+    this.focusManager = new FocusManager(this.screen);
+    this.layout = new LayoutManager(this.screen, [
+      { id: "status", widget: this.statusPanel.widget, baseLabel: "[1] Status" },
+      { id: "rules", widget: this.rulesPanel.widget, baseLabel: "[2] Rules" },
+      { id: "raw", widget: this.rawPanel.widget, baseLabel: "[3] Raw Output" },
+      { id: "detail", widget: this.detailPanel.widget, baseLabel: "[4] Detail" }
+    ]);
+    this.screen.append(this.header);
+    this.screen.append(this.statusPanel.widget);
+    this.screen.append(this.rulesPanel.widget);
+    this.screen.append(this.rawPanel.widget);
+    this.screen.append(this.detailPanel.widget);
+    this.screen.append(this.footer);
+    this.rulesPanel.widget.on("select item", () => this.renderDetail());
+    this.bindGlobalKeys();
+    this.layout.apply();
+  }
+  client;
+  screen;
+  header;
+  footer;
+  statusPanel;
+  rulesPanel;
+  rawPanel;
+  detailPanel;
+  layout;
+  focusManager;
+  focusOrder = ["status", "rules", "raw", "detail"];
+  focusIndex = 1;
+  // Start on rules panel
+  transientMessage = "";
+  transientTimer = null;
+  firewallActive = false;
+  loggingOn = false;
+  currentLoggingLevel = "off";
+  statusUnavailable = false;
+  bindGlobalKeys() {
+    const guarded = (handler) => () => {
+      if (this.focusManager.isModalOpen) return;
+      void handler();
+    };
+    const switchTo = (id) => {
+      const targetIndex = this.focusOrder.indexOf(id);
+      if (this.layout.isMaximized()) {
+        if (this.focusIndex === targetIndex) {
+          this.layout.restoreSplit();
+        } else {
+          this.focusPanel(targetIndex, false);
+          this.layout.toggleMaximize(id);
+        }
+      } else {
+        if (this.focusIndex === targetIndex) {
+          this.layout.toggleMaximize(id);
+        } else {
+          this.focusPanel(targetIndex, true);
+        }
+      }
+    };
+    this.screen.key(["1"], guarded(() => switchTo("status")));
+    this.screen.key(["2"], guarded(() => switchTo("rules")));
+    this.screen.key(["3"], guarded(() => switchTo("raw")));
+    this.screen.key(["4"], guarded(() => switchTo("detail")));
+    this.screen.key(["tab"], guarded(() => this.cycleFocus(1)));
+    this.screen.key(["S-tab"], guarded(() => this.cycleFocus(-1)));
+    this.screen.key(["escape"], guarded(() => this.layout.restoreSplit()));
+    this.screen.key(["a"], guarded(() => this.openAddModal()));
+    this.screen.key(["P", "S-p"], guarded(() => this.openAppProfilesModal()));
+    this.screen.key(["i"], guarded(() => this.openInsertModal()));
+    this.screen.key(["d"], guarded(() => this.openDeleteModal()));
+    this.screen.key(["e"], guarded(() => this.enableFirewall()));
+    this.screen.key(["D", "S-d"], guarded(() => this.handleDisableFirewall()));
+    this.screen.key(["L", "S-l"], guarded(() => this.openLoggingModal()));
+    this.screen.key(["l"], guarded(() => this.toggleLogging()));
+    this.screen.key(["R", "S-r"], guarded(() => this.openResetModal()));
+    this.screen.key(["x"], guarded(() => this.openActionMenu()));
+    this.screen.key(["r"], guarded(() => this.refresh()));
+    this.screen.key(["s"], guarded(() => this.handleSetupSudo()));
+    this.screen.key(["?", "S-/", "h", "S-h", "f1"], guarded(() => this.openHelpModal()));
+    this.screen.key(["q", "C-c"], guarded(() => process.exit(0)));
+    this.screen.on("keypress", (ch, key) => {
+      if (this.focusManager.isModalOpen) return;
+      if (ch === "D" || key && (key.full === "S-d" || key.name === "d" && key.shift)) {
+        void this.handleDisableFirewall();
+        return;
+      }
+      if (ch === "L" || key && (key.full === "S-l" || key.name === "l" && key.shift)) {
+        void this.openLoggingModal();
+        return;
+      }
+      if (ch === "P" || key && (key.full === "S-p" || key.name === "p" && key.shift)) {
+        void this.openAppProfilesModal();
+        return;
+      }
+      if (ch === "R" || key && (key.full === "S-r" || key.name === "r" && key.shift)) {
+        void this.openResetModal();
+        return;
+      }
+      if (ch === "?" || key && (key.full === "?" || key.full === "S-/" || key.name === "?" || key.sequence === "?")) {
+        void this.openHelpModal();
+        return;
+      }
+    });
+    this.focusPanel(this.focusIndex, false);
+  }
+  toggleMaximize(id) {
+    this.focusIndex = this.focusOrder.indexOf(id);
+    this.layout.toggleMaximize(id);
+    this.focusPanel(this.focusIndex, false);
+  }
+  cycleFocus(delta) {
+    const nextIndex = (this.focusIndex + delta + this.focusOrder.length) % this.focusOrder.length;
+    if (this.layout.isMaximized()) {
+      this.layout.restoreSplit();
+    }
+    this.focusPanel(nextIndex, true);
+  }
+  focusPanel(index, animate = true) {
+    this.focusIndex = index;
+    const id = this.focusOrder[index];
+    this.layout.activatePanel(id, animate);
+    if (id === "status") this.statusPanel.focus();
+    else if (id === "rules") this.rulesPanel.focus();
+    else if (id === "raw") this.rawPanel.focus();
+    else this.detailPanel.focus();
+    this.screen.render();
+  }
+  renderDetail() {
+    this.detailPanel.render(this.rulesPanel.getSelectedRule());
+    this.screen.render();
+  }
+  setTransientMessage(message, ttlMs = 2500) {
+    this.transientMessage = message;
+    this.renderFooterStatus();
+    if (this.transientTimer) clearTimeout(this.transientTimer);
+    if (ttlMs > 0) {
+      this.transientTimer = setTimeout(() => {
+        this.transientMessage = "";
+        this.transientTimer = null;
+        this.renderFooterStatus();
+      }, ttlMs);
+    }
+  }
+  renderFooterStatus() {
+    if (this.focusManager.isModalOpen) return;
+    if (this.transientMessage) {
+      setFooterHint(this.footer, this.transientMessage);
+    } else {
+      resetFooterHint(this.footer);
+    }
+    this.screen.render();
+  }
+  renderHeader() {
+    renderHeaderStatus(this.header, {
+      firewallActive: this.firewallActive,
+      loggingOn: this.loggingOn,
+      ruleCount: this.rulesPanel.count,
+      statusUnavailable: this.statusUnavailable
+    });
+  }
+  async refresh() {
+    this.rulesPanel.setLoading();
+    this.setTransientMessage("Refreshing firewall status...", 0);
+    this.screen.render();
+    try {
+      const [statusRes, rulesRes, rawRes] = await Promise.all([
+        this.client.status(),
+        this.client.numberedRules(),
+        this.client.rawRules()
+      ]);
+      if (statusRes.code !== 0) {
+        this.statusUnavailable = true;
+      } else {
+        this.statusUnavailable = false;
+        const parsedStatus = parseStatus(statusRes.stdout);
+        this.firewallActive = parsedStatus.status === "active";
+        this.loggingOn = Boolean(parsedStatus.logging && parsedStatus.logging.toLowerCase().includes("on"));
+        this.currentLoggingLevel = parsedStatus.logging ?? "off";
+        const parsedRules = parseRules(rulesRes.stdout);
+        this.rulesPanel.setRules(parsedRules);
+        this.statusPanel.setStatus({
+          ...parsedStatus,
+          rules: parsedRules
+        }, isSudoConfigured());
+      }
+      this.rawPanel.setContent(rawRes.stdout || statusRes.stdout || "");
+      this.renderHeader();
+      this.renderDetail();
+      this.transientMessage = "";
+      this.renderFooterStatus();
+    } catch (err) {
+      this.statusUnavailable = true;
+      this.renderHeader();
+      this.setTransientMessage(`Refresh failed: ${err instanceof Error ? err.message : String(err)}`, 4e3);
+    }
+  }
+  // --- Actions ---
+  async enableFirewall() {
+    try {
+      this.setTransientMessage("Enabling firewall...", 0);
+      await this.client.assertOk(this.client.enable());
+      await this.refresh();
+      this.setTransientMessage("Firewall ENABLED successfully!");
+    } catch (err) {
+      this.setTransientMessage(`Failed to enable: ${err instanceof Error ? err.message : String(err)}`, 4e3);
+    }
+  }
+  async handleDisableFirewall() {
+    const sshInfo = await detectActiveSshSession();
+    if (sshInfo.isActive) {
+      const modal2 = new SshWarningModal(this.screen, sshInfo, {
+        onCancel: () => {
+          resetFooterHint(this.footer);
+          this.focusManager.closeTop();
+          this.setTransientMessage("Firewall disable canceled (SSH protected).");
+        },
+        onConfirm: async () => {
+          this.focusManager.closeTop();
+          await this.client.assertOk(this.client.disable());
+          await this.refresh();
+          this.setTransientMessage("Firewall DISABLED.");
+        }
+      });
+      setFooterHint(this.footer, "\u26A0\uFE0F Active SSH Session! Tab: choose | Enter: confirm | Esc: cancel");
+      this.focusManager.open(modal2);
+      return;
+    }
+    const modal = new ConfirmModal(
+      this.screen,
+      {
+        title: "Disable Firewall",
+        message: "Are you sure you want to disable the UFW firewall?",
+        confirmLabel: "Disable",
+        dangerous: true
+      },
+      {
+        onCancel: () => {
+          resetFooterHint(this.footer);
+          this.focusManager.closeTop();
+        },
+        onConfirm: async () => {
+          this.focusManager.closeTop();
+          await this.client.assertOk(this.client.disable());
+          await this.refresh();
+          this.setTransientMessage("Firewall DISABLED.");
+        }
+      }
+    );
+    setFooterHint(this.footer, "Tab/\u2190\u2192: choose | Enter: confirm | Esc: cancel");
+    this.focusManager.open(modal);
+  }
+  async toggleLogging() {
+    try {
+      this.setTransientMessage("Toggling logging...", 0);
+      if (this.loggingOn) {
+        await this.client.assertOk(this.client.disableLog());
+        this.setTransientMessage("Logging turned OFF.");
+      } else {
+        await this.client.assertOk(this.client.enableLog());
+        this.setTransientMessage("Logging turned ON.");
+      }
+      await this.refresh();
+    } catch (err) {
+      this.setTransientMessage(`Log toggle failed: ${err instanceof Error ? err.message : String(err)}`, 4e3);
+    }
+  }
+  openLoggingModal() {
+    const modal = new LoggingModal(
+      this.screen,
+      this.currentLoggingLevel,
+      {
+        onCancel: () => {
+          resetFooterHint(this.footer);
+          this.focusManager.closeTop();
+        },
+        onSelect: async (level) => {
+          await this.client.assertOk(this.client.setLogging(level));
+          resetFooterHint(this.footer);
+          this.focusManager.closeTop();
+          await this.refresh();
+          this.setTransientMessage(`Logging level set to ${level}.`);
+        }
+      }
+    );
+    setFooterHint(this.footer, "\u2191/\u2193: select | Enter: apply | Esc: cancel");
+    this.focusManager.open(modal);
+  }
+  async openAppProfilesModal() {
+    let profiles = [];
+    try {
+      const res = await this.client.listAppProfiles();
+      if (res.code === 0) {
+        profiles = parseAppList(res.stdout);
+      }
+    } catch {
+    }
+    if (profiles.length === 0) {
+      profiles = getLocalAppProfiles();
+    }
+    const modal = new AppProfilesModal(
+      this.screen,
+      profiles,
+      {
+        onCancel: () => {
+          resetFooterHint(this.footer);
+          this.focusManager.closeTop();
+        },
+        onLoadInfo: async (appName) => {
+          const res = await this.client.appProfileInfo(appName);
+          if (res.code !== 0) {
+            throw new Error(res.stderr.trim() || `Failed to load profile: ${appName}`);
+          }
+          const info = parseAppInfo(res.stdout);
+          return { name: appName, ...info };
+        },
+        onApply: async (appName, action) => {
+          await this.client.assertOk(this.client.allowApp(appName, action));
+          resetFooterHint(this.footer);
+          this.focusManager.closeTop();
+          await this.refresh();
+          this.setTransientMessage(`Applied ${action} rule for app "${appName}".`);
+        }
+      }
+    );
+    setFooterHint(this.footer, "Tab: switch | \u2191\u2193: profile | \u2190\u2192: action | Enter: apply | Esc: close");
+    this.focusManager.open(modal);
+  }
+  openAddModal() {
+    const modal = new AddRuleModal(this.screen, {
+      onCancel: () => {
+        resetFooterHint(this.footer);
+        this.focusManager.closeTop();
+      },
+      onSubmit: async (input) => {
+        await this.client.assertOk(this.client.createRule(input));
+        resetFooterHint(this.footer);
+        this.focusManager.closeTop();
+        await this.refresh();
+        this.setTransientMessage(`Added rule: ${input.action} ${input.port}${input.protocol ? "/" + input.protocol : ""}`);
+      }
+    });
+    setFooterHint(this.footer, "Tab: next | \u2190\u2192 option | Enter: submit | Esc: cancel");
+    this.focusManager.open(modal);
+  }
+  openInsertModal() {
+    const currentRule = this.rulesPanel.getSelectedRule();
+    const nextPosition = currentRule ? currentRule.id : 1;
+    const modal = new InsertRuleModal(this.screen, nextPosition, {
+      onCancel: () => {
+        resetFooterHint(this.footer);
+        this.focusManager.closeTop();
+      },
+      onSubmit: async (input) => {
+        await this.client.assertOk(this.client.insertRule(input.rule, input.ipAddr, input.action || "allow"));
+        resetFooterHint(this.footer);
+        this.focusManager.closeTop();
+        await this.refresh();
+        this.setTransientMessage(`Inserted rule #${input.rule}: allow from ${input.ipAddr}`);
+      }
+    });
+    setFooterHint(this.footer, "Tab: next | Enter: submit | Esc: cancel");
+    this.focusManager.open(modal);
+  }
+  openDeleteModal() {
+    const rule = this.rulesPanel.getSelectedRule();
+    if (!rule) {
+      this.setTransientMessage("No rule selected to delete.");
+      return;
+    }
+    const modal = new ConfirmModal(
+      this.screen,
+      {
+        title: "Delete Rule",
+        message: `Delete rule #${rule.id}: ${rule.to} [${rule.action}] from ${rule.from}?`,
+        confirmLabel: "Delete",
+        dangerous: true
+      },
+      {
+        onCancel: () => {
+          resetFooterHint(this.footer);
+          this.focusManager.closeTop();
+        },
+        onConfirm: async () => {
+          await this.client.assertOk(this.client.deleteRule(String(rule.id)));
+          resetFooterHint(this.footer);
+          this.focusManager.closeTop();
+          await this.refresh();
+          this.setTransientMessage(`Deleted rule #${rule.id}.`);
+        }
+      }
+    );
+    setFooterHint(this.footer, "Tab/\u2190\u2192: choose | Enter: confirm | Esc: cancel");
+    this.focusManager.open(modal);
+  }
+  openResetModal() {
+    const modal = new ConfirmModal(
+      this.screen,
+      {
+        title: "RESET FIREWALL \u2014 CRITICAL",
+        message: "WARNING: This will reset UFW to default factory state and DELETE ALL custom rules! Continue?",
+        confirmLabel: "RESET ALL",
+        dangerous: true
+      },
+      {
+        onCancel: () => {
+          resetFooterHint(this.footer);
+          this.focusManager.closeTop();
+        },
+        onConfirm: async () => {
+          this.focusManager.closeTop();
+          await this.client.assertOk(this.client.reset());
+          await this.refresh();
+          this.setTransientMessage("Firewall has been reset to defaults.");
+        }
+      }
+    );
+    setFooterHint(this.footer, "Tab/\u2190\u2192: choose | Enter: confirm | Esc: cancel");
+    this.focusManager.open(modal);
+  }
+  handleSetupSudo() {
+    if (isSudoConfigured()) {
+      this.setTransientMessage("Passwordless sudo is already configured!");
+      return;
+    }
+    const modal = new ConfirmModal(
+      this.screen,
+      {
+        title: "Setup Passwordless Sudo",
+        message: "Enable passwordless sudo for ufw commands? (Installs /etc/sudoers.d/lazyufw-nopasswd)",
+        confirmLabel: "Configure",
+        dangerous: false
+      },
+      {
+        onCancel: () => {
+          this.focusManager.closeTop();
+        },
+        onConfirm: async () => {
+          this.focusManager.closeTop();
+          try {
+            setupSudo();
+            this.setTransientMessage("Passwordless sudo configured!");
+            await this.refresh();
+          } catch (err) {
+            this.setTransientMessage(`Sudo setup: ${err instanceof Error ? err.message : String(err)}`, 4e3);
+          }
+        }
+      }
+    );
+    this.focusManager.open(modal);
+  }
+  openActionMenu() {
+    const items = [
+      { key: "a", label: "Add Rule", description: "Create rule (allow/deny/reject/limit)", action: () => this.openAddModal() },
+      { key: "P", label: "Application Profiles", description: "Browse & allow/deny installed app profiles", action: () => this.openAppProfilesModal() },
+      { key: "i", label: "Insert Rule", description: "Insert rule at specific position", action: () => this.openInsertModal() },
+      { key: "d", label: "Delete Rule", description: "Delete selected rule", action: () => this.openDeleteModal() },
+      { key: "e", label: "Enable Firewall", description: "Activate UFW protection", action: () => this.enableFirewall() },
+      { key: "D", label: "Disable Firewall", description: "Turn off UFW (SSH Protected)", action: () => this.handleDisableFirewall() },
+      { key: "l", label: "Toggle Logging", description: `Turn logging ${this.loggingOn ? "OFF" : "ON"}`, action: () => this.toggleLogging() },
+      { key: "L", label: "Set Logging Level", description: `Set UFW logging level (current: ${this.currentLoggingLevel})`, action: () => this.openLoggingModal() },
+      { key: "R", label: "Reset Rules", description: "Reset all rules to factory defaults", action: () => this.openResetModal() },
+      { key: "r", label: "Refresh", description: "Reload rules and status", action: () => this.refresh() },
+      { key: "s", label: "Sudoless Setup", description: "Configure passwordless sudoers rule", action: () => this.handleSetupSudo() },
+      { key: "?", label: "Help Cheatsheet", description: "View all keyboard shortcuts", action: () => this.openHelpModal() },
+      { key: "q", label: "Quit", description: "Exit lazyufw", action: () => process.exit(0) }
+    ];
+    const modal = new ActionMenuModal(this.screen, items, () => {
+      resetFooterHint(this.footer);
+      this.focusManager.closeTop();
+    });
+    setFooterHint(this.footer, "\u2191\u2193/Key: select action | Enter: execute | Esc: close");
+    this.focusManager.open(modal);
+  }
+  openHelpModal() {
+    const modal = new HelpModal(this.screen, () => {
+      resetFooterHint(this.footer);
+      this.focusManager.closeTop();
+    });
+    setFooterHint(this.footer, "Esc / ? / Enter: close help");
+    this.focusManager.open(modal);
+  }
+  async start() {
+    await this.refresh();
+    this.focusPanel(this.focusIndex, false);
+    this.screen.render();
+  }
+};
+async function startDashboard(client) {
+  if (!isSudoConfigured()) {
+    if (!ensureSudoCached()) {
+      console.warn("lazyufw: sudo credentials not cached. Continuing; commands may prompt.");
+    }
+  }
+  const dashboard = new Dashboard(client);
+  await dashboard.start();
+}
+
+// firewall/ufwClient.ts
+var PORT_RE = /^\d{1,5}(:\d{1,5})?$/;
+var PROTO_RE = /^(tcp|udp)$/;
+var IPV4_RE2 = /^(\d{1,3}\.){3}\d{1,3}(\/\d{1,2})?$/;
+var RULE_NUM_RE = /^\d+$/;
+var DELETE_RULE_RE = /^\d+$|^(allow|deny|reject|limit)\b.*$/;
+function invalid(message) {
+  return { stdout: "", stderr: message, code: 1 };
+}
+var ufwClient = class {
+  async status() {
+    return exec_default("sudo", [UFW_PATH, "status", "verbose"]);
+  }
+  async rawRules() {
+    const res = await exec_default("sudo", [UFW_PATH, "status", "raw"]);
+    if (res.code === 0 && res.stdout.trim()) {
+      return res;
+    }
+    return exec_default("sudo", [UFW_PATH, "status", "verbose"]);
+  }
+  async numberedRules() {
+    return exec_default("sudo", [UFW_PATH, "status", "numbered"]);
+  }
+  async allow(port, protocol) {
+    if (!PORT_RE.test(port)) return invalid(`Invalid port: ${port}`);
+    if (protocol && !PROTO_RE.test(protocol)) return invalid(`Invalid protocol: ${protocol}`);
+    const args = [UFW_PATH, "allow", port];
+    if (protocol && protocol !== "any") args.push(protocol);
+    return exec_default("sudo", args);
+  }
+  async deny(port, protocol) {
+    if (!PORT_RE.test(port)) return invalid(`Invalid port: ${port}`);
+    if (protocol && !PROTO_RE.test(protocol)) return invalid(`Invalid protocol: ${protocol}`);
+    const args = [UFW_PATH, "deny", port];
+    if (protocol && protocol !== "any") args.push(protocol);
+    return exec_default("sudo", args);
+  }
+  async reject(port, protocol) {
+    if (!PORT_RE.test(port)) return invalid(`Invalid port: ${port}`);
+    if (protocol && !PROTO_RE.test(protocol)) return invalid(`Invalid protocol: ${protocol}`);
+    const args = [UFW_PATH, "reject", port];
+    if (protocol && protocol !== "any") args.push(protocol);
+    return exec_default("sudo", args);
+  }
+  async limit(port, protocol) {
+    if (!PORT_RE.test(port)) return invalid(`Invalid port: ${port}`);
+    if (protocol && !PROTO_RE.test(protocol)) return invalid(`Invalid protocol: ${protocol}`);
+    const args = [UFW_PATH, "limit", port];
+    if (protocol && protocol !== "any") args.push(protocol);
+    return exec_default("sudo", args);
+  }
+  async createRule(input) {
+    const action = input.action.toLowerCase();
+    const args = [UFW_PATH, action];
+    if (input.direction) {
+      args.push(input.direction.toLowerCase());
+    }
+    if (input.app && input.app.trim()) {
+      const app = input.app.trim();
+      if (input.from && input.from.trim()) {
+        args.push("from", input.from.trim(), "to", "any", "app", app);
+      } else {
+        args.push(app);
+      }
+    } else {
+      const port = String(input.port ?? "").trim();
+      if (!PORT_RE.test(port)) return invalid(`Invalid port: ${port}`);
+      const proto = input.protocol && input.protocol !== "any" ? input.protocol : void 0;
+      if (proto && !PROTO_RE.test(proto)) return invalid(`Invalid protocol: ${proto}`);
+      if (input.from && input.from.trim()) {
+        args.push("from", input.from.trim(), "to", "any", "port", port);
+      } else {
+        args.push(proto ? `${port}/${proto}` : port);
+      }
+    }
+    if (input.comment && input.comment.trim()) {
+      args.push("comment", input.comment.trim());
+    }
+    return exec_default("sudo", args);
+  }
+  async insertRule(rule, ipAddr, action = "allow") {
+    if (!Number.isInteger(rule) || rule < 1) return invalid(`Invalid rule number: ${rule}`);
+    const trimmedIp = ipAddr.trim();
+    if (!IPV4_RE2.test(trimmedIp)) return invalid(`Invalid IP address: ${trimmedIp}`);
+    return exec_default("sudo", [UFW_PATH, "insert", rule.toString(), action.toLowerCase(), "from", trimmedIp]);
+  }
+  async deleteRule(rule) {
+    const trimmed = rule.trim();
+    if (!DELETE_RULE_RE.test(trimmed)) return invalid(`Invalid rule: ${rule}`);
+    const args = RULE_NUM_RE.test(trimmed) ? [UFW_PATH, "--force", "delete", trimmed] : [UFW_PATH, "--force", "delete", ...trimmed.split(/\s+/)];
+    return exec_default("sudo", args);
+  }
+  async setLogging(level) {
+    const validLevels = ["off", "low", "medium", "high", "full"];
+    if (!validLevels.includes(level)) {
+      return invalid(`Invalid logging level: ${level}`);
+    }
+    return exec_default("sudo", [UFW_PATH, "logging", level]);
+  }
+  async enableLog() {
+    return this.setLogging("low");
+  }
+  async disableLog() {
+    return this.setLogging("off");
+  }
+  async listAppProfiles() {
+    return exec_default("sudo", [UFW_PATH, "app", "list"]);
+  }
+  async appProfileInfo(profile) {
+    const trimmed = profile.trim();
+    if (!trimmed) return invalid("Application profile name required");
+    return exec_default("sudo", [UFW_PATH, "app", "info", trimmed]);
+  }
+  async allowApp(profile, action = "allow") {
+    const trimmed = profile.trim();
+    if (!trimmed) return invalid("Application profile name required");
+    const act = action.toLowerCase();
+    if (!["allow", "deny", "reject", "limit"].includes(act)) {
+      return invalid(`Invalid action: ${action}`);
+    }
+    return exec_default("sudo", [UFW_PATH, act, trimmed]);
+  }
+  async enable() {
+    return exec_default("sudo", [UFW_PATH, "--force", "enable"]);
+  }
+  async disable() {
+    return exec_default("sudo", [UFW_PATH, "disable"]);
+  }
+  async reset() {
+    return exec_default("sudo", [UFW_PATH, "--force", "reset"]);
+  }
+  async assertOk(promise) {
+    const result = await promise;
+    if (result.code !== 0) {
+      throw new Error(result.stderr.trim() || `Command failed with exit code ${result.code}`);
+    }
+    return result;
+  }
+};
+
+// index.ts
+var VERSION = "1.0.0";
+function printHelp() {
+  console.log(`
+  \x1B[36m\x1B[1mlazyufw\x1B[0m v${VERSION} \u2014 The lazier way to manage UFW (Lazydocker style)
+
+  \x1B[1mUSAGE:\x1B[0m
+      lazyufw [command] [options]
+
+  \x1B[1mCOMMANDS:\x1B[0m
+      (default)       Launch the interactive Lazydocker-style TUI
+      setup           Configure passwordless sudoers rule (/etc/sudoers.d/lazyufw-nopasswd)
+      teardown        Remove the passwordless sudoers rule
+      status          Print verbose firewall status and exit
+
+  \x1B[1mOPTIONS:\x1B[0m
+      -h, --help      Display this help guide
+      -v, --version   Display lazyufw version
+
+  \x1B[1mKEYBINDINGS (in TUI):\x1B[0m
+      1, 2, 3, 4      Jump to Panel (Status, Rules, Raw, Details)
+      Tab / Shift-Tab Cycle focus across panels
+      x               Open Lazydocker Action Menu
+      a                (allow, deny, reject, limit)
+      i               Insert rule at specific index
+      d               Delete selected rule
+      e               Enable UFW firewall
+      D               Disable UFW firewall (SSH Lockout Protected)
+      l               Toggle logging (on / off)
+      R               Reset firewall to factory defaults
+      r               Refresh status
+      ?               Help Cheatsheet
+      q / Ctrl-C      Quit
+`);
+}
+async function printStatus() {
+  const client = new ufwClient();
+  try {
+    const res = await client.status();
+    console.log(res.stdout || res.stderr);
+    const rulesRes = await client.numberedRules();
+    if (rulesRes.stdout.trim()) {
+      console.log("\n" + rulesRes.stdout);
+    }
+  } catch (err) {
+    console.error("Failed to query UFW status:", err instanceof Error ? err.message : err);
+    process.exit(1);
+  }
+}
+async function main() {
+  const args = process.argv.slice(2);
+  const command = args[0];
+  if (command === "-h" || command === "--help" || command === "help") {
+    printHelp();
+    return;
+  }
+  if (command === "-v" || command === "--version" || command === "version") {
+    console.log(`lazyufw v${VERSION}`);
+    return;
+  }
+  switch (command) {
+    case "setup":
+      setupSudo();
+      break;
+    case "teardown":
+      teardownSudo();
+      break;
+    case "status":
+      await printStatus();
+      break;
+    default:
+      if (process.platform !== "linux" && !process.env.UFW_PATH) {
+        console.warn("\x1B[33mWarning: lazyufw is designed for Linux with UFW installed.\x1B[0m");
+      }
+      if (!isUfwInstalled() && process.platform === "linux") {
+        console.warn("\x1B[33mWarning: UFW binary not found in standard paths (/usr/sbin/ufw).\x1B[0m");
+        console.warn("Set UFW_PATH environment variable if installed elsewhere.\n");
+      }
+      await startDashboard(new ufwClient());
+      break;
+  }
+}
+main().catch((err) => {
+  console.error("lazyufw encountered an error:", err);
+  process.exit(1);
+});
+export {
+  main
+};