pal-explorer-cli 0.4.0

package/lib/commands/revoke.js

@@ -0,0 +1,50 @@
+import chalk from 'chalk';
+import { removeShare, rotateShareKey, removeRecipientFromShare, listShares } from '../core/shares.js';
+
+export default function revokeCommand(program) {
+  program
+    .command('revoke <idOrPath>')
+    .description('revoke access to a shared resource or remove a specific recipient')
+    .option('--pal <palId>', 'Remove a specific pal from the share (triggers key rotation)')
+    .addHelpText('after', `
+Examples:
+  $ pe revoke abc123                Revoke share by ID
+  $ pe revoke ./photos              Revoke share by path
+  $ pe revoke abc123 --pal alice    Remove one recipient (rotates key)
+`)
+    .action(async (idOrPath, opts) => {
+      try {
+        if (opts.pal) {
+          // Remove a specific recipient and rotate keys
+          const shares = listShares();
+          const share = shares.find(s => s.id === idOrPath || s.path === idOrPath);
+          if (!share) {
+            console.error(chalk.red('Share not found.'));
+            process.exitCode = 1;
+            return;
+          }
+
+          removeRecipientFromShare(share.id, opts.pal);
+          console.log(chalk.yellow(`Removed ${opts.pal} from share ${share.id}`));
+
+          if (share.visibility === 'private' && (share.recipients || []).length > 0) {
+            console.log(chalk.blue('Rotating share key and re-encrypting...'));
+            const { newEncryptedShareKeys } = await rotateShareKey(share.id);
+            const remaining = Object.keys(newEncryptedShareKeys).length;
+            console.log(chalk.green(`Key rotated. ${remaining} recipient(s) will need new magnet on next serve.`));
+          }
+          return;
+        }
+
+        // Full revoke
+        const removed = removeShare(idOrPath);
+        if (removed) {
+          console.log(chalk.green(`Successfully revoked share: ${idOrPath}`));
+        } else {
+          console.error(chalk.red('Share not found.'));
+        }
+      } catch (err) {
+        console.error(chalk.red(`Error: ${err.message}`));
+      }
+    });
+}

package/lib/commands/scanner.js

@@ -0,0 +1,280 @@
+import chalk from 'chalk';
+import fs from 'fs';
+import path from 'path';
+
+const BUILTIN_RULES = [
+  { name: 'SSN', pattern: '\\d{3}-\\d{2}-\\d{4}', severity: 'critical', description: 'Social Security Number' },
+  { name: 'CreditCard', pattern: '4\\d{3}[\\s-]?\\d{4}[\\s-]?\\d{4}[\\s-]?\\d{4}', severity: 'critical', description: 'Credit card number (Visa)' },
+  { name: 'CreditCardMC', pattern: '5[1-5]\\d{2}[\\s-]?\\d{4}[\\s-]?\\d{4}[\\s-]?\\d{4}', severity: 'critical', description: 'Credit card number (Mastercard)' },
+  { name: 'APIKey', pattern: '(?:sk_|pk_|api_|key_)[a-zA-Z0-9]{16,}', severity: 'high', description: 'API key' },
+  { name: 'PrivateKey', pattern: '-----BEGIN PRIVATE KEY-----', severity: 'critical', description: 'Private key block' },
+  { name: 'AWSKey', pattern: 'AKIA[0-9A-Z]{16}', severity: 'critical', description: 'AWS access key' },
+  { name: 'Email', pattern: '\\b[\\w.-]+@[\\w.-]+\\.\\w{2,}\\b', severity: 'low', description: 'Email address' },
+];
+
+const SEVERITY_ORDER = { critical: 4, high: 3, medium: 2, low: 1 };
+const SEVERITY_COLORS = {
+  critical: chalk.red,
+  high: chalk.yellow,
+  medium: chalk.cyan,
+  low: chalk.gray,
+};
+
+function classifyFile(maxSeverity) {
+  if (maxSeverity === 'critical') return 'Restricted';
+  if (maxSeverity === 'high') return 'Confidential';
+  if (maxSeverity === 'medium') return 'Internal';
+  return 'Public';
+}
+
+function scanContent(content, rules) {
+  const findings = [];
+  const lines = content.split('\n');
+  for (const rule of rules) {
+    const re = new RegExp(rule.pattern, 'g');
+    for (let i = 0; i < lines.length; i++) {
+      let match;
+      while ((match = re.exec(lines[i])) !== null) {
+        findings.push({
+          rule: rule.name,
+          severity: rule.severity,
+          line: i + 1,
+          match: match[0].length > 40 ? match[0].slice(0, 37) + '...' : match[0],
+        });
+      }
+    }
+  }
+  return findings;
+}
+
+export default function scannerCommand(program) {
+  const cmd = program
+    .command('scanner')
+    .description('content scanning and DLP (Enterprise)')
+    .addHelpText('after', `
+Examples:
+  $ pe scanner scan ./documents              Scan directory for sensitive data
+  $ pe scanner scan ./secrets.txt            Scan a single file
+  $ pe scanner rules                         List active DLP rules
+  $ pe scanner rules --add MyRule "\\d{6}" high  Add a custom rule
+  $ pe scanner rules --remove MyRule         Remove a custom rule
+  $ pe scanner quarantine                    List quarantined files
+  $ pe scanner release <id>                  Release file from quarantine
+`)
+    .action(() => { cmd.outputHelp(); });
+
+  cmd
+    .command('scan <path>')
+    .description('scan a file or directory for sensitive data')
+    .action(async (targetPath) => {
+      try {
+        const extConfig = (await import('../utils/config.js')).default;
+        const extSettings = extConfig.get('ext.content-scanner') || {};
+        const customRules = extSettings.rules || [];
+        const allRules = [...BUILTIN_RULES, ...customRules];
+
+        const resolved = path.resolve(targetPath);
+        if (!fs.existsSync(resolved)) {
+          console.log(chalk.red(`Path not found: ${resolved}`));
+          process.exitCode = 1;
+          return;
+        }
+
+        const stat = fs.statSync(resolved);
+        const files = [];
+        if (stat.isDirectory()) {
+          const entries = fs.readdirSync(resolved, { recursive: true });
+          for (const entry of entries) {
+            const full = path.join(resolved, entry);
+            try {
+              if (fs.statSync(full).isFile()) files.push(full);
+            } catch { /* skip unreadable */ }
+          }
+        } else {
+          files.push(resolved);
+        }
+
+        if (files.length === 0) {
+          console.log(chalk.gray('No files to scan.'));
+          return;
+        }
+
+        console.log(chalk.cyan(`Scanning ${files.length} file(s)...\n`));
+        let totalFindings = 0;
+        let maxSeverity = 'low';
+
+        for (const file of files) {
+          let content;
+          try {
+            content = fs.readFileSync(file, 'utf8');
+          } catch {
+            continue;
+          }
+
+          const findings = scanContent(content, allRules);
+          if (findings.length === 0) continue;
+
+          totalFindings += findings.length;
+          const rel = path.relative(process.cwd(), file);
+          console.log(`  ${chalk.white(rel)}`);
+
+          for (const f of findings) {
+            const colorFn = SEVERITY_COLORS[f.severity] || chalk.white;
+            console.log(`    Line ${chalk.gray(f.line)}: ${colorFn(`[${f.severity.toUpperCase()}]`)} ${chalk.white(f.rule)} — ${chalk.dim(f.match)}`);
+            if (SEVERITY_ORDER[f.severity] > SEVERITY_ORDER[maxSeverity]) {
+              maxSeverity = f.severity;
+            }
+          }
+          console.log('');
+        }
+
+        if (totalFindings === 0) {
+          console.log(chalk.green('✔ No sensitive data found.'));
+          console.log(`  Classification: ${chalk.green('Public')}`);
+        } else {
+          const classification = classifyFile(maxSeverity);
+          console.log(chalk.gray('─'.repeat(50)));
+          console.log(`  Total findings: ${chalk.white(totalFindings)}`);
+          console.log(`  Classification: ${SEVERITY_COLORS[maxSeverity](classification)}`);
+        }
+      } catch (err) {
+        console.log(chalk.red(`Scan failed: ${err.message}`));
+        process.exitCode = 1;
+      }
+    });
+
+  cmd
+    .command('rules')
+    .description('list active DLP rules')
+    .option('--add <name>', 'add a custom rule (requires <pattern> <severity> as args)')
+    .option('--remove <name>', 'remove a custom rule')
+    .action(async (opts, command) => {
+      try {
+        const extConfig = (await import('../utils/config.js')).default;
+        const extSettings = extConfig.get('ext.content-scanner') || {};
+
+        if (opts.remove) {
+          const customRules = extSettings.rules || [];
+          const idx = customRules.findIndex(r => r.name === opts.remove);
+          if (idx === -1) {
+            console.log(chalk.yellow(`Rule not found: ${opts.remove}`));
+            process.exitCode = 1;
+            return;
+          }
+          customRules.splice(idx, 1);
+          extSettings.rules = customRules;
+          extConfig.set('ext.content-scanner', extSettings);
+          console.log(chalk.green(`✔ Rule removed: ${opts.remove}`));
+          return;
+        }
+
+        if (opts.add) {
+          const args = command.args;
+          if (args.length < 2) {
+            console.log(chalk.red('Usage: pe scanner rules --add <name> <pattern> <severity>'));
+            process.exitCode = 1;
+            return;
+          }
+          const pattern = args[0];
+          try {
+            const testRe = new RegExp(pattern);
+            const start = Date.now();
+            'a'.repeat(25).match(testRe);
+            if (Date.now() - start > 100) throw new Error('Pattern too complex');
+          } catch (e) {
+            console.error(chalk.red(`Invalid or unsafe regex pattern: ${e.message}`));
+            process.exitCode = 1;
+            return;
+          }
+          const severity = args[1] || 'medium';
+          if (!['critical', 'high', 'medium', 'low'].includes(severity)) {
+            console.log(chalk.red('Severity must be: critical, high, medium, or low'));
+            process.exitCode = 1;
+            return;
+          }
+          const customRules = extSettings.rules || [];
+          if (customRules.find(r => r.name === opts.add)) {
+            console.log(chalk.yellow(`Rule already exists: ${opts.add}`));
+            process.exitCode = 1;
+            return;
+          }
+          customRules.push({ name: opts.add, pattern, severity, description: `Custom rule: ${opts.add}` });
+          extSettings.rules = customRules;
+          extConfig.set('ext.content-scanner', extSettings);
+          console.log(chalk.green(`✔ Rule added: ${opts.add}`));
+          console.log(`  Pattern: ${chalk.white(pattern)}`);
+          console.log(`  Severity: ${SEVERITY_COLORS[severity](severity)}`);
+          return;
+        }
+
+        // List all rules
+        const customRules = extSettings.rules || [];
+        const allRules = [...BUILTIN_RULES, ...customRules];
+        console.log(chalk.bold(`DLP Rules (${allRules.length})\n`));
+        console.log(chalk.cyan('  Built-in:'));
+        for (const r of BUILTIN_RULES) {
+          const colorFn = SEVERITY_COLORS[r.severity] || chalk.white;
+          console.log(`    ${chalk.white(r.name)} ${colorFn(`[${r.severity}]`)} — ${chalk.dim(r.description)}`);
+        }
+        if (customRules.length > 0) {
+          console.log('');
+          console.log(chalk.cyan('  Custom:'));
+          for (const r of customRules) {
+            const colorFn = SEVERITY_COLORS[r.severity] || chalk.white;
+            console.log(`    ${chalk.white(r.name)} ${colorFn(`[${r.severity}]`)} — ${chalk.dim(r.pattern)}`);
+          }
+        }
+      } catch (err) {
+        console.log(chalk.red(`Rules failed: ${err.message}`));
+        process.exitCode = 1;
+      }
+    });
+
+  cmd
+    .command('quarantine')
+    .description('list quarantined files')
+    .action(async () => {
+      try {
+        const extConfig = (await import('../utils/config.js')).default;
+        const store = extConfig.get('ext_store.content-scanner') || {};
+        const quarantined = store.quarantined || [];
+        if (quarantined.length === 0) {
+          console.log(chalk.dim('No quarantined files.'));
+          return;
+        }
+        console.log(chalk.bold(`Quarantined Files (${quarantined.length})\n`));
+        for (const f of quarantined) {
+          const colorFn = SEVERITY_COLORS[f.severity] || chalk.white;
+          console.log(`  ${chalk.white(f.id)} ${colorFn(`[${f.severity}]`)} ${chalk.cyan(f.path)}`);
+          console.log(`    Reason: ${chalk.dim(f.reason || 'DLP violation')}  Quarantined: ${chalk.dim(f.quarantinedAt)}`);
+        }
+      } catch (err) {
+        console.log(chalk.red(`Quarantine list failed: ${err.message}`));
+        process.exitCode = 1;
+      }
+    });
+
+  cmd
+    .command('release <id>')
+    .description('release a file from quarantine')
+    .action(async (id) => {
+      try {
+        const extConfig = (await import('../utils/config.js')).default;
+        const store = extConfig.get('ext_store.content-scanner') || {};
+        const quarantined = store.quarantined || [];
+        const idx = quarantined.findIndex(f => f.id === id);
+        if (idx === -1) {
+          console.log(chalk.yellow(`Quarantined file not found: ${id}`));
+          process.exitCode = 1;
+          return;
+        }
+        const released = quarantined.splice(idx, 1)[0];
+        store.quarantined = quarantined;
+        extConfig.set('ext_store.content-scanner', store);
+        console.log(chalk.green(`✔ Released from quarantine: ${released.path}`));
+      } catch (err) {
+        console.log(chalk.red(`Release failed: ${err.message}`));
+        process.exitCode = 1;
+      }
+    });
+}

package/lib/commands/schedule.js

@@ -0,0 +1,344 @@
+import chalk from 'chalk';
+import config from '../utils/config.js';
+import { parseCommaList } from '../utils/cli.js';
+
+function loadTasks() {
+  return config.get('scheduledTasks') || [];
+}
+
+function saveTasks(tasks) {
+  config.set('scheduledTasks', tasks);
+}
+
+function formatDate(ts) {
+  return new Date(ts).toLocaleString();
+}
+
+const STATUS_COLORS = {
+  pending: chalk.blue,
+  running: chalk.yellow,
+  completed: chalk.green,
+  failed: chalk.red,
+  cancelled: chalk.gray,
+};
+
+const VALID_EVERY = ['hourly', 'daily', 'weekly', 'monthly'];
+
+export function parseEvery(val) {
+  if (!val) return null;
+  const lower = val.toLowerCase();
+  if (VALID_EVERY.includes(lower)) return lower;
+  const match = lower.match(/^(\d+)\s*(m|min|minutes?|h|hr|hours?|d|days?)$/);
+  if (match) {
+    const n = parseInt(match[1], 10);
+    const unit = match[2][0];
+    if (unit === 'm') return n * 60_000;
+    if (unit === 'h') return n * 3_600_000;
+    if (unit === 'd') return n * 86_400_000;
+  }
+  return null;
+}
+
+export function computeNextRun(task) {
+  if (!task.every) return null;
+  const raw = task.lastRunAt || task.executeAt || Date.now();
+  const base = typeof raw === 'string' ? new Date(raw).getTime() : raw;
+  if (typeof task.every === 'number') return base + task.every;
+  const d = new Date(base);
+  if (task.every === 'hourly') d.setHours(d.getHours() + 1);
+  else if (task.every === 'daily') d.setDate(d.getDate() + 1);
+  else if (task.every === 'weekly') d.setDate(d.getDate() + 7);
+  else if (task.every === 'monthly') d.setMonth(d.getMonth() + 1);
+  return d.getTime();
+}
+
+export function parseWindow(val) {
+  if (!val) return null;
+  const match = val.match(/^(\d{1,2}):(\d{2})\s*-\s*(\d{1,2}):(\d{2})$/);
+  if (!match) return null;
+  const sh = parseInt(match[1], 10), sm = parseInt(match[2], 10);
+  const eh = parseInt(match[3], 10), em = parseInt(match[4], 10);
+  if (sh > 23 || sm > 59 || eh > 23 || em > 59) return null;
+  return { startHour: sh, startMin: sm, endHour: eh, endMin: em };
+}
+
+export function isInWindow(window, now) {
+  if (!window) return true;
+  const d = now || new Date();
+  const current = d.getHours() * 60 + d.getMinutes();
+  const start = window.startHour * 60 + window.startMin;
+  const end = window.endHour * 60 + window.endMin;
+  if (start <= end) return current >= start && current < end;
+  // Overnight window (e.g. 22:00-06:00)
+  return current >= start || current < end;
+}
+
+export function isTaskReady(task, now) {
+  if (task.status !== 'pending') return false;
+  const ts = now || Date.now();
+  if (task.executeAt > ts) return false;
+  if (task.window && !isInWindow(task.window, new Date(ts))) return false;
+  return true;
+}
+
+export default function scheduleCommand(program) {
+  const cmd = program
+    .command('schedule')
+    .description('manage scheduled tasks (shares, downloads, auto-revokes)')
+    .addHelpText('after', `
+Examples:
+  $ pe schedule                                   List all scheduled tasks
+  $ pe schedule add share /path --at "2026-03-15 09:00"
+  $ pe schedule add share /path --at "2026-03-15 09:00" --every daily
+  $ pe schedule add download --magnet "magnet:..." --at "22:00" --window "22:00-06:00"
+  $ pe schedule add revoke --share-path /path --at "2026-04-01 00:00"
+  $ pe schedule cancel <taskId>
+  $ pe schedule run-once                          Execute due tasks once and exit
+  $ pe schedule daemon                            Run scheduler in foreground (30s interval)
+`)
+    .action(() => {
+      const tasks = loadTasks();
+      if (tasks.length === 0) {
+        console.log(chalk.gray('No scheduled tasks. Use `pe schedule add` to create one.'));
+        return;
+      }
+      console.log('');
+      console.log(chalk.cyan('Scheduled Tasks:'));
+      for (const t of tasks) {
+        const colorFn = STATUS_COLORS[t.status] || chalk.white;
+        console.log(`  ${chalk.white(t.id)}  [${colorFn(t.status)}]  ${chalk.yellow(t.type)}`);
+        console.log(`    Execute at: ${chalk.white(formatDate(t.executeAt))}`);
+        if (t.every) console.log(`    Repeat: ${chalk.cyan(typeof t.every === 'number' ? `${t.every / 60000}m` : t.every)}`);
+        if (t.window) console.log(`    Window: ${chalk.cyan(`${String(t.window.startHour).padStart(2, '0')}:${String(t.window.startMin).padStart(2, '0')}-${String(t.window.endHour).padStart(2, '0')}:${String(t.window.endMin).padStart(2, '0')}`)}`);
+        if (t.data.folderPath) console.log(`    Path: ${chalk.gray(t.data.folderPath)}`);
+        if (t.data.magnet) console.log(`    Magnet: ${chalk.gray(t.data.magnet.slice(0, 50))}...`);
+        if (t.data.sharePath) console.log(`    Share: ${chalk.gray(t.data.sharePath)}`);
+        if (t.completedAt) console.log(`    Completed: ${chalk.gray(t.completedAt)}`);
+        if (t.error) console.log(`    Error: ${chalk.red(t.error)}`);
+        if (t.runCount) console.log(`    Runs: ${chalk.gray(t.runCount)}`);
+      }
+    });
+
+  const addCmd = cmd
+    .command('add <type>')
+    .description('schedule a new task (share, download, revoke)')
+    .option('--at <datetime>', 'When to execute (ISO 8601 or local datetime string)')
+    .option('--every <interval>', 'Repeat: hourly, daily, weekly, monthly, or Nm/Nh/Nd (e.g. 30m, 2h, 1d)')
+    .option('--window <range>', 'Only run during time window (e.g. "22:00-06:00")')
+    .option('--magnet <uri>', 'Magnet URI (for download tasks)')
+    .option('--name <name>', 'Name for the download')
+    .option('--share-path <path>', 'Share path (for revoke tasks)')
+    .option('--visibility <vis>', 'Share visibility (global|private)', 'global')
+    .option('--recipients <handles>', 'Comma-separated recipient handles')
+    .action((type, opts) => {
+      if (!['share', 'download', 'revoke'].includes(type)) {
+        console.log(chalk.red('Invalid task type. Use: share, download, revoke'));
+        process.exitCode = 1;
+        return;
+      }
+
+      if (!opts.at) {
+        console.log(chalk.red('--at is required. Example: --at "2026-03-15 09:00"'));
+        process.exitCode = 1;
+        return;
+      }
+
+      const executeAt = new Date(opts.at).getTime();
+      if (isNaN(executeAt) || executeAt <= Date.now()) {
+        console.log(chalk.red('--at must be a valid future datetime.'));
+        process.exitCode = 1;
+        return;
+      }
+
+      let every = null;
+      if (opts.every) {
+        every = parseEvery(opts.every);
+        if (every === null) {
+          console.log(chalk.red('Invalid --every value. Use: hourly, daily, weekly, monthly, or Nm/Nh/Nd'));
+          process.exitCode = 1;
+          return;
+        }
+      }
+
+      let window = null;
+      if (opts.window) {
+        window = parseWindow(opts.window);
+        if (!window) {
+          console.log(chalk.red('Invalid --window format. Use: "HH:MM-HH:MM" (e.g. "22:00-06:00")'));
+          process.exitCode = 1;
+          return;
+        }
+      }
+
+      let data = {};
+      if (type === 'share') {
+        const folderPath = addCmd.args[1];
+        if (!folderPath) {
+          console.log(chalk.red('Usage: pe schedule add share <path> --at <datetime>'));
+          process.exitCode = 1;
+          return;
+        }
+        data = {
+          folderPath,
+          visibility: opts.visibility,
+          recipients: parseCommaList(opts.recipients),
+        };
+      } else if (type === 'download') {
+        if (!opts.magnet) {
+          console.log(chalk.red('--magnet is required for download tasks.'));
+          process.exitCode = 1;
+          return;
+        }
+        data = { magnet: opts.magnet, name: opts.name || 'Scheduled Download' };
+      } else if (type === 'revoke') {
+        if (!opts.sharePath) {
+          console.log(chalk.red('--share-path is required for revoke tasks.'));
+          process.exitCode = 1;
+          return;
+        }
+        data = { sharePath: opts.sharePath };
+      }
+
+      const tasks = loadTasks();
+      const task = {
+        id: Date.now().toString(36) + Math.random().toString(36).slice(2, 6),
+        type,
+        executeAt,
+        data,
+        status: 'pending',
+        createdAt: new Date().toISOString(),
+      };
+      if (every) task.every = every;
+      if (window) task.window = window;
+      tasks.push(task);
+      saveTasks(tasks);
+
+      console.log(chalk.green(`✔ Task scheduled: ${task.id}`));
+      console.log(`  Type: ${chalk.yellow(type)}`);
+      console.log(`  Execute at: ${chalk.white(formatDate(executeAt))}`);
+      if (every) console.log(`  Repeat: ${chalk.cyan(opts.every)}`);
+      if (window) console.log(`  Window: ${chalk.cyan(opts.window)}`);
+    });
+
+  cmd
+    .command('cancel <taskId>')
+    .description('cancel a pending scheduled task')
+    .action((taskId) => {
+      const tasks = loadTasks();
+      const task = tasks.find(t => t.id === taskId);
+      if (!task) {
+        console.log(chalk.red('Task not found.'));
+        process.exitCode = 1;
+        return;
+      }
+      if (task.status !== 'pending') {
+        console.log(chalk.red(`Cannot cancel task with status: ${task.status}`));
+        process.exitCode = 1;
+        return;
+      }
+      task.status = 'cancelled';
+      saveTasks(tasks);
+      console.log(chalk.green(`✔ Task ${taskId} cancelled.`));
+    });
+
+  cmd
+    .command('clear')
+    .description('remove all completed/failed/cancelled tasks')
+    .action(() => {
+      const tasks = loadTasks();
+      const remaining = tasks.filter(t => t.status === 'pending' || t.status === 'running');
+      const removed = tasks.length - remaining.length;
+      saveTasks(remaining);
+      console.log(chalk.green(`✔ Cleared ${removed} tasks. ${remaining.length} remaining.`));
+    });
+
+  cmd
+    .command('run-once')
+    .description('check and execute any due tasks, then exit')
+    .action(async () => {
+      const executed = await runCliScheduler();
+      if (executed === 0) {
+        console.log(chalk.gray('No tasks due.'));
+      } else {
+        console.log(chalk.green(`✔ Executed ${executed} task(s).`));
+      }
+    });
+
+  cmd
+    .command('daemon')
+    .description('run scheduler in foreground, checking every 30 seconds')
+    .option('--interval <seconds>', 'Check interval in seconds', '30')
+    .action(async (opts) => {
+      const interval = Math.max(5, parseInt(opts.interval, 10) || 30) * 1000;
+      console.log(chalk.cyan(`Scheduler daemon running (interval: ${interval / 1000}s). Press Ctrl+C to stop.`));
+      const run = async () => {
+        const executed = await runCliScheduler();
+        if (executed > 0) console.log(chalk.green(`[${new Date().toLocaleTimeString()}] Executed ${executed} task(s).`));
+      };
+      await run();
+      const timer = setInterval(run, interval);
+      process.on('SIGINT', () => { clearInterval(timer); process.exit(0); });
+      process.on('SIGTERM', () => { clearInterval(timer); process.exit(0); });
+      // Keep alive
+      await new Promise(() => {});
+    });
+}
+
+async function runCliScheduler() {
+  const tasks = loadTasks();
+  const now = Date.now();
+  let executed = 0;
+
+  for (const task of tasks) {
+    if (!isTaskReady(task, now)) continue;
+
+    task.status = 'running';
+
+    try {
+      if (task.type === 'share') {
+        console.log(chalk.cyan(`Sharing ${task.data.folderPath}...`));
+        const { default: shareAction } = await import('../core/shares.js');
+        if (typeof shareAction.addShare === 'function') {
+          await shareAction.addShare(task.data.folderPath, {
+            visibility: task.data.visibility,
+            recipients: task.data.recipients,
+          });
+        }
+      } else if (task.type === 'download') {
+        console.log(chalk.cyan(`Starting download: ${task.data.name}...`));
+        // CLI downloads need the torrent client - best-effort
+        console.log(chalk.gray(`  Magnet: ${task.data.magnet.slice(0, 60)}...`));
+        console.log(chalk.gray('  Note: CLI downloads require `pe serve` for full torrent support.'));
+      } else if (task.type === 'revoke') {
+        console.log(chalk.cyan(`Revoking share: ${task.data.sharePath}...`));
+        const shares = config.get('shares') || [];
+        const idx = shares.findIndex(s => s.path === task.data.sharePath);
+        if (idx >= 0) {
+          shares.splice(idx, 1);
+          config.set('shares', shares);
+        }
+      }
+
+      task.lastRunAt = new Date().toISOString();
+      task.runCount = (task.runCount || 0) + 1;
+
+      if (task.every) {
+        // Recurring: reschedule
+        task.executeAt = computeNextRun(task);
+        task.status = 'pending';
+        console.log(chalk.gray(`  Next run: ${formatDate(task.executeAt)}`));
+      } else {
+        task.status = 'completed';
+        task.completedAt = new Date().toISOString();
+      }
+      executed++;
+    } catch (err) {
+      console.error(chalk.red(`  Task ${task.id} failed: ${err.message}`));
+      task.status = 'failed';
+      task.error = err.message;
+    }
+  }
+
+  if (executed > 0) saveTasks(tasks);
+  return executed;
+}