pyre-cli 2.0.0 → 3.0.0

package/dist/index.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import fs2 from "fs";
+import fs4 from "fs";
 import readline2 from "readline";
 import { Command } from "commander";
-import chalk8 from "chalk";
+import chalk9 from "chalk";
 
 // src/monitors/collectors.ts
 import chalk from "chalk";
@@ -511,7 +511,7 @@ async function collectPackets() {
     let topProcesses = [];
     let allProcesses = [];
     try {
-      const lsof = (await run("lsof -i -n -P -r 1 2>/dev/null | tail -n +2 | awk '{print $1, $2}' | sort | uniq -c | sort -rn", "")).trim();
+      const lsof = (await run("lsof -i -n -P 2>/dev/null | tail -n +2 | awk '{print $1, $2}' | sort | uniq -c | sort -rn", "")).trim();
       const lsofLines = lsof.split("\n");
       topProcesses = lsofLines.map((line) => {
         const parts = line.trim().split(/\s+/);
@@ -2176,42 +2176,67 @@ async function showSplash() {
 
 // src/p2p/server.ts
 import net from "net";
+import tls from "tls";
+import fs2 from "fs";
+import crypto2 from "crypto";
 import chalk7 from "chalk";
 
 // src/p2p/protocol.ts
+import crypto from "crypto";
 var HEADER_SIZE = 4;
 var MAX_MESSAGE_SIZE = 16 * 1024 * 1024;
-function buildMessage(kind, payload) {
+var HMAC_ALGO = "sha256";
+function buildMessage(kind, payload, hmac) {
   const envelope = { kind, payload };
+  if (hmac) envelope.hmac = hmac;
   const body = Buffer.from(JSON.stringify(envelope), "utf-8");
   const header2 = Buffer.alloc(HEADER_SIZE);
   header2.writeUInt32BE(body.length, 0);
   return Buffer.concat([header2, body]);
 }
-function encodeAuth(password) {
-  return buildMessage("auth", { password });
+function generateNonce() {
+  return crypto.randomBytes(32).toString("hex");
 }
-function encodeAuthOk() {
-  return buildMessage("auth-ok", { ok: true });
+function hashPassword(password, nonce) {
+  return crypto.createHash("sha256").update(`${password}:${nonce}`).digest("hex");
 }
-function encodeAuthFail(reason) {
-  return buildMessage("auth-fail", { ok: false, reason });
+function computeHMAC(body, key) {
+  if (!key) return void 0;
+  return crypto.createHmac(HMAC_ALGO, key).update(body).digest("hex");
 }
-function encodeData(stats) {
-  return buildMessage("data", { stats });
-}
-function encodePing() {
-  return buildMessage("ping", { ts: Date.now() });
-}
-function encodePong(ts) {
-  return buildMessage("pong", { ts });
+function verifyHMAC(body, expectedHmac, key) {
+  if (!key) return expectedHmac === void 0;
+  if (!expectedHmac) return false;
+  try {
+    const parsed = JSON.parse(body);
+    const payloadWithoutHmac = { ...parsed, hmac: void 0 };
+    const canonical = JSON.stringify(payloadWithoutHmac);
+    const computed = crypto.createHmac(HMAC_ALGO, key).update(canonical).digest("hex");
+    return crypto.timingSafeEqual(Buffer.from(computed), Buffer.from(expectedHmac));
+  } catch {
+    return false;
+  }
 }
 function encodeDisconnect(reason) {
   return buildMessage("disconnect", { reason });
 }
+function decodeMessage(buf) {
+  const str = buf.toString("utf-8");
+  const msg = JSON.parse(str);
+  return msg;
+}
+function signMessage(kind, payload, key) {
+  const envelope = { kind, payload };
+  const bodyJson = JSON.stringify(envelope);
+  const hmac = computeHMAC(bodyJson, key);
+  return buildMessage(kind, payload, hmac);
+}
 
 // src/p2p/server.ts
 var HEADER_SIZE2 = 4;
+var DEFAULT_RATE_LIMIT_MAX = 5;
+var DEFAULT_RATE_LIMIT_WINDOW = 6e4;
+var HMAC_KEY_LENGTH = 32;
 function readMessageFromPeer(peer) {
   while (peer.readBuffer.length > 0) {
     if (peer.readExpectingHeader) {
@@ -2236,13 +2261,36 @@ function readMessageFromPeer(peer) {
   }
   return null;
 }
+function isIPAllowed(ip, allowedIPs, deniedIPs) {
+  for (const denied of deniedIPs) {
+    if (ip === denied || ip.startsWith(denied)) {
+      return false;
+    }
+  }
+  if (allowedIPs.length === 0) {
+    return true;
+  }
+  for (const allowed of allowedIPs) {
+    if (ip === allowed || ip.startsWith(allowed)) {
+      return true;
+    }
+  }
+  return false;
+}
+function deriveHMACKey(password) {
+  return crypto2.createHash("sha256").update(password).digest("hex").slice(0, HMAC_KEY_LENGTH);
+}
 var P2PServer = class {
   server = null;
   peers = /* @__PURE__ */ new Map();
   options;
   running = false;
+  rateLimitMap = /* @__PURE__ */ new Map();
+  auditStream = null;
+  hmacKey;
   constructor(options) {
     this.options = options;
+    this.hmacKey = deriveHMACKey(options.password);
   }
   get info() {
     return {
@@ -2252,16 +2300,42 @@ var P2PServer = class {
     };
   }
   async start() {
+    if (this.options.auditLog) {
+      try {
+        fs2.mkdirSync(this.options.auditLog, { recursive: true });
+        const logFile = `${this.options.auditLog}/p2p-audit.log`;
+        this.auditStream = fs2.createWriteStream(logFile, { flags: "a" });
+      } catch {
+        console.log(chalk7.yellow("Warning: could not open audit log"));
+      }
+    }
     return new Promise((resolve, reject) => {
-      this.server = net.createServer((socket) => this.onConnection(socket));
+      const useTLS = !!(this.options.tlsCert && this.options.tlsKey);
+      if (useTLS) {
+        const tlsOptions = {
+          key: fs2.readFileSync(this.options.tlsKey),
+          cert: fs2.readFileSync(this.options.tlsCert)
+        };
+        if (this.options.tlsCA) {
+          tlsOptions.ca = fs2.readFileSync(this.options.tlsCA);
+        }
+        this.server = tls.createServer(tlsOptions, (socket) => this.onConnection(socket));
+      } else {
+        this.server = net.createServer((socket) => this.onConnection(socket));
+      }
       this.server.on("error", (err) => reject(err));
       this.server.listen(this.options.port, this.options.host, () => {
         this.running = true;
         const addr = this.server?.address();
         const bound = addr ? typeof addr === "object" ? `${addr.address}:${addr.port}` : String(addr) : "unknown";
-        console.log(chalk7.green(`P2P server listening on ${bound}`));
+        const protocol = useTLS ? "TLS" : "TCP";
+        console.log(chalk7.green(`P2P server listening on ${bound} (${protocol})`));
         console.log(chalk7.dim(`  Password: ${this.options.password}`));
         console.log(chalk7.dim(`  Interval: ${this.options.intervalMs}ms`));
+        const allowedIPs = this.options.allowedIPs ?? [];
+        const deniedIPs = this.options.deniedIPs ?? [];
+        if (allowedIPs.length > 0) console.log(chalk7.dim(`  Allowed IPs: ${allowedIPs.join(", ")}`));
+        if (deniedIPs.length > 0) console.log(chalk7.dim(`  Denied IPs: ${deniedIPs.join(", ")}`));
         resolve();
       });
     });
@@ -2272,12 +2346,68 @@ var P2PServer = class {
       this.disconnectPeer(peer, "Server shutting down");
     }
     this.peers.clear();
+    this.rateLimitMap.clear();
     if (this.server) {
       this.server.close();
       this.server = null;
     }
+    if (this.auditStream) {
+      this.auditStream.end();
+      this.auditStream = null;
+    }
+  }
+  audit(ip, event, detail) {
+    if (!this.auditStream) return;
+    const ts = (/* @__PURE__ */ new Date()).toISOString();
+    this.auditStream.write(`${ts} ${ip} ${event} ${detail}
+`);
+  }
+  getPeerIP(socket) {
+    const addr = socket.remoteAddress;
+    if (!addr) return "unknown";
+    if (addr.startsWith("::ffff:")) {
+      return addr.slice(7);
+    }
+    return addr;
+  }
+  checkRateLimit(ip) {
+    const maxAttempts = this.options.rateLimitMaxAttempts ?? DEFAULT_RATE_LIMIT_MAX;
+    const windowMs = this.options.rateLimitWindowMs ?? DEFAULT_RATE_LIMIT_WINDOW;
+    const now = Date.now();
+    const entry = this.rateLimitMap.get(ip);
+    if (!entry) {
+      this.rateLimitMap.set(ip, { attempts: 1, firstAttempt: now });
+      return true;
+    }
+    if (now - entry.firstAttempt > windowMs) {
+      this.rateLimitMap.set(ip, { attempts: 1, firstAttempt: now });
+      return true;
+    }
+    entry.attempts++;
+    if (entry.attempts > maxAttempts) {
+      return false;
+    }
+    return true;
+  }
+  cleanupRateLimit(ip) {
+    this.rateLimitMap.delete(ip);
   }
   onConnection(socket) {
+    const ip = this.getPeerIP(socket);
+    const allowedIPs = this.options.allowedIPs ?? [];
+    const deniedIPs = this.options.deniedIPs ?? [];
+    if (!isIPAllowed(ip, allowedIPs, deniedIPs)) {
+      this.audit(ip, "BLOCKED", "IP not allowed");
+      console.log(chalk7.yellow(`Blocked IP: ${ip}`));
+      socket.destroy();
+      return;
+    }
+    if (!this.checkRateLimit(ip)) {
+      this.audit(ip, "RATE_LIMITED", "Too many auth attempts");
+      console.log(chalk7.yellow(`Rate limit exceeded for IP: ${ip}`));
+      socket.destroy();
+      return;
+    }
     const peer = {
       socket,
       authenticated: false,
@@ -2285,11 +2415,14 @@ var P2PServer = class {
       pingHandle: null,
       readBuffer: Buffer.alloc(0),
       readExpectingHeader: true,
-      readMessageLength: 0
+      readMessageLength: 0,
+      ip,
+      pendingNonce: null
     };
     this.peers.set(socket, peer);
     const remoteAddr = socket.remoteAddress ? `${socket.remoteAddress}:${socket.remotePort}` : "unknown";
     console.log(chalk7.cyan(`Peer connected: ${remoteAddr}`));
+    this.audit(ip, "CONNECT", remoteAddr);
     socket.on("data", (data) => this.onData(peer, data));
     socket.on("close", () => this.onPeerClose(peer));
     socket.on("error", (err) => this.onPeerError(peer, err));
@@ -2299,6 +2432,9 @@ var P2PServer = class {
         this.disconnectPeer(peer, "Authentication timeout");
       }
     });
+    const nonce = generateNonce();
+    this.sendSigned(peer, signMessage("challenge", { nonce }, this.hmacKey));
+    peer.pendingNonce = nonce;
   }
   onData(peer, data) {
     peer.readBuffer = Buffer.concat([peer.readBuffer, data]);
@@ -2312,33 +2448,56 @@ var P2PServer = class {
   }
   handleAuthMessage(peer, body) {
     try {
-      const msg = JSON.parse(body.toString("utf-8"));
-      if (msg.kind === "auth" && typeof msg.payload?.password === "string") {
-        if (msg.payload.password === this.options.password) {
-          peer.authenticated = true;
-          peer.socket.write(encodeAuthOk());
-          console.log(chalk7.green(`Peer authenticated: ${peer.socket.remoteAddress}`));
-          this.startDataStream(peer);
-          this.startPing(peer);
-        } else {
-          peer.socket.write(encodeAuthFail("Invalid password"));
-          this.disconnectPeer(peer, "Authentication failed");
-        }
-      } else {
-        peer.socket.write(encodeAuthFail("Expected auth message first"));
+      const raw = body.toString("utf-8");
+      const msg = decodeMessage(body);
+      if (msg.kind !== "auth") {
+        peer.socket.write(signMessage("auth-fail", { ok: false, reason: "Expected auth message first" }, this.hmacKey));
         this.disconnectPeer(peer, "Expected auth message");
+        return;
+      }
+      const authPayload = msg.payload;
+      if (!authPayload.passwordHash || !authPayload.nonce) {
+        peer.socket.write(signMessage("auth-fail", { ok: false, reason: "Invalid auth payload" }, this.hmacKey));
+        this.disconnectPeer(peer, "Invalid auth payload");
+        return;
+      }
+      if (peer.pendingNonce && authPayload.nonce !== peer.pendingNonce) {
+        this.audit(peer.ip, "AUTH_FAIL", "Nonce mismatch");
+        peer.socket.write(signMessage("auth-fail", { ok: false, reason: "Invalid nonce" }, this.hmacKey));
+        this.disconnectPeer(peer, "Invalid nonce");
+        return;
       }
+      const expectedHash = hashPassword(this.options.password, authPayload.nonce);
+      if (authPayload.passwordHash !== expectedHash) {
+        this.audit(peer.ip, "AUTH_FAIL", "Invalid password hash");
+        peer.socket.write(signMessage("auth-fail", { ok: false, reason: "Invalid password" }, this.hmacKey));
+        this.disconnectPeer(peer, "Authentication failed");
+        return;
+      }
+      peer.authenticated = true;
+      this.cleanupRateLimit(peer.ip);
+      peer.pendingNonce = null;
+      peer.socket.write(signMessage("auth-ok", { ok: true }, this.hmacKey));
+      console.log(chalk7.green(`Peer authenticated: ${peer.socket.remoteAddress}`));
+      this.audit(peer.ip, "AUTH_OK", "Challenge-response successful");
+      this.startDataStream(peer);
+      this.startPing(peer);
     } catch {
-      peer.socket.write(encodeAuthFail("Invalid message format"));
+      peer.socket.write(signMessage("auth-fail", { ok: false, reason: "Invalid message format" }, this.hmacKey));
       this.disconnectPeer(peer, "Invalid message format");
     }
   }
+  sendSigned(peer, message) {
+    if (!peer.socket.destroyed) {
+      peer.socket.write(message);
+    }
+  }
   startDataStream(peer) {
     const send = async () => {
       if (!peer.authenticated || peer.socket.destroyed) return;
       try {
         const data = await collectAll({ detailed: this.options.detailed });
-        peer.socket.write(encodeData(data));
+        this.sendSigned(peer, signMessage("data", { stats: data }, this.hmacKey));
       } catch {
       }
     };
@@ -2348,25 +2507,28 @@ var P2PServer = class {
   startPing(peer) {
     peer.pingHandle = setInterval(() => {
       if (peer.socket.destroyed) return;
-      peer.socket.write(encodePing());
+      this.sendSigned(peer, signMessage("ping", { ts: Date.now() }, this.hmacKey));
     }, 5e3);
   }
   onPeerClose(peer) {
     this.cleanupPeer(peer);
     console.log(chalk7.yellow(`Peer disconnected: ${peer.socket.remoteAddress}`));
+    this.audit(peer.ip, "DISCONNECT", "Peer closed connection");
   }
   onPeerError(peer, err) {
     const code = err.code;
     if (code === "ECONNRESET") {
       console.log(chalk7.yellow(`Peer connection reset: ${peer.socket.remoteAddress}`));
+      this.audit(peer.ip, "ERROR", "Connection reset");
     } else {
       console.log(chalk7.red(`Peer error: ${err.message}`));
+      this.audit(peer.ip, "ERROR", err.message);
     }
     this.cleanupPeer(peer);
   }
   disconnectPeer(peer, reason) {
     try {
-      peer.socket.write(encodeDisconnect(reason));
+      this.sendSigned(peer, signMessage("disconnect", { reason }, this.hmacKey));
     } catch {
     }
     peer.socket.destroy();
@@ -2386,6 +2548,10 @@ var P2PServer = class {
 
 // src/p2p/client.ts
 import net2 from "net";
+import tls2 from "tls";
+import fs3 from "fs";
+import crypto3 from "crypto";
+import chalk8 from "chalk";
 var P2PClient = class {
   socket = null;
   options;
@@ -2395,8 +2561,12 @@ var P2PClient = class {
   onStatusCallback = null;
   reconnectTimer = null;
   pingHandle = null;
+  pendingNonce = null;
+  auditStream = null;
+  hmacKey;
   constructor(options) {
     this.options = options;
+    this.hmacKey = deriveHMACKey2(options.password);
   }
   setOnData(cb) {
     this.onDataCallback = cb;
@@ -2405,23 +2575,47 @@ var P2PClient = class {
     this.onStatusCallback = cb;
   }
   async connect() {
+    if (this.options.auditLog) {
+      try {
+        fs3.mkdirSync(this.options.auditLog, { recursive: true });
+        const logFile = `${this.options.auditLog}/p2p-client-audit.log`;
+        this.auditStream = fs3.createWriteStream(logFile, { flags: "a" });
+      } catch {
+        console.log(chalk8.yellow("Warning: could not open audit log"));
+      }
+    }
     return new Promise((resolve, reject) => {
-      this.socket = new net2.Socket();
+      const useTLS = !!this.options.tls;
+      if (useTLS) {
+        const tlsOptions = {
+          host: this.options.host,
+          port: this.options.port,
+          rejectUnauthorized: !this.options.tlsInsecure
+        };
+        if (this.options.tlsCA) {
+          tlsOptions.ca = fs3.readFileSync(this.options.tlsCA);
+        }
+        this.socket = tls2.connect(tlsOptions, () => {
+          this.status("Connecting...");
+        });
+      } else {
+        this.socket = new net2.Socket();
+        this.socket.on("data", (data) => this.onData(data));
+        this.socket.on("close", () => this.onClose());
+        this.socket.on("error", (err) => this.onError(err));
+        this.socket.on("timeout", () => this.onTimeout());
+        this.socket.setTimeout(1e4);
+        this.socket.connect(this.options.port, this.options.host, () => {
+          this.status("Connecting...");
+        });
+        this.socket.once("error", (err) => {
+          reject(err);
+        });
+      }
       this.socket.on("data", (data) => this.onData(data));
       this.socket.on("close", () => this.onClose());
       this.socket.on("error", (err) => this.onError(err));
       this.socket.on("timeout", () => this.onTimeout());
-      this.socket.setTimeout(1e4);
-      this.socket.connect(this.options.port, this.options.host, () => {
-        this.running = true;
-        this.socket?.setTimeout(0);
-        this.socket?.write(encodeAuth(this.options.password));
-        this.status("Connecting...");
-        resolve();
-      });
-      this.socket.once("error", (err) => {
-        reject(err);
-      });
     });
   }
   disconnect() {
@@ -2436,12 +2630,16 @@ var P2PClient = class {
     }
     if (this.socket) {
       try {
-        this.socket.write(encodeDisconnect("Client closing"));
+        this.sendSigned(encodeDisconnect("Client closing"));
       } catch {
       }
       this.socket.destroy();
       this.socket = null;
     }
+    if (this.auditStream) {
+      this.auditStream.end();
+      this.auditStream = null;
+    }
     this.status("Disconnected");
   }
   onData(data) {
@@ -2470,31 +2668,50 @@ var P2PClient = class {
   }
   handleMessage(body) {
     try {
-      const msg = JSON.parse(body.toString("utf-8"));
+      const raw = body.toString("utf-8");
+      const msg = decodeMessage(body);
+      if (!verifyHMAC(raw, msg.hmac ?? "", this.hmacKey)) {
+        this.status("Message integrity check failed");
+        return;
+      }
       switch (msg.kind) {
+        case "challenge":
+          const challengePayload = msg.payload;
+          if (challengePayload.nonce) {
+            this.pendingNonce = challengePayload.nonce;
+            const passwordHash = hashPassword(this.options.password, challengePayload.nonce);
+            this.sendSigned(signMessage("auth", { passwordHash, nonce: challengePayload.nonce }, this.hmacKey));
+            this.status("Authenticating...");
+          }
+          break;
         case "auth-ok":
           this.status("Authenticated \u2014 receiving live data");
           this.startPing();
           break;
         case "auth-fail":
-          this.status(`Authentication failed: ${msg.payload.reason}`);
+          const failPayload = msg.payload;
+          this.status(`Authentication failed: ${failPayload.reason || "unknown"}`);
           this.disconnect();
           break;
         case "data":
-          if (this.onDataCallback && msg.payload?.stats) {
-            this.onDataCallback(msg.payload.stats);
+          if (this.onDataCallback) {
+            const dataPayload = msg.payload;
+            if (dataPayload.stats) {
+              this.onDataCallback(dataPayload.stats);
+            }
           }
           break;
         case "ping":
           if (this.socket && !this.socket.destroyed) {
             const ts = msg.payload.ts;
-            this.socket.write(encodePong(ts));
+            this.sendSigned(signMessage("pong", { ts }, this.hmacKey));
           }
           break;
         case "pong":
           break;
         case "disconnect":
-          this.status(`Server disconnected: ${msg.payload.reason}`);
+          const disconnectPayload = msg.payload;
+          this.status(`Server disconnected: ${disconnectPayload.reason || "unknown"}`);
           this.disconnect();
           break;
         default:
@@ -2503,10 +2720,15 @@ var P2PClient = class {
     } catch {
     }
   }
+  sendSigned(message) {
+    if (this.socket && !this.socket.destroyed) {
+      this.socket.write(message);
+    }
+  }
   startPing() {
     this.pingHandle = setInterval(() => {
       if (this.socket && !this.socket.destroyed) {
-        this.socket.write(encodePing());
+        this.sendSigned(signMessage("ping", { ts: Date.now() }, this.hmacKey));
       }
     }, 15e3);
   }
@@ -2525,6 +2747,8 @@ var P2PClient = class {
       this.status("Connection refused \u2014 is the server running?");
     } else if (code === "ETIMEDOUT") {
       this.status("Connection timed out");
+    } else if (code === "UNABLE_TO_VERIFY_LEAF_SIGNATURE") {
+      this.status("TLS certificate verification failed \u2014 use --p2p-insecure to skip");
     } else {
       this.status(`Connection error: ${err.message}`);
     }
@@ -2538,11 +2762,21 @@ var P2PClient = class {
       this.onStatusCallback(msg);
     }
   }
+  audit(event, detail) {
+    if (!this.auditStream) return;
+    const ts = (/* @__PURE__ */ new Date()).toISOString();
+    const ip = this.options.host;
+    this.auditStream.write(`${ts} ${ip} ${event} ${detail}
+`);
+  }
 };
+function deriveHMACKey2(password) {
+  return crypto3.createHash("sha256").update(password).digest("hex").slice(0, 32);
+}
 
 // src/index.ts
 var program = new Command();
-program.name("pyre").version("2.0.0").description("Mac system monitoring CLI: interactive live dashboard, stats, graphs, export, packet monitor, battery predictor").option("-j, --json", "Output as JSON").option("-c, --csv", "Output as CSV").option("-t, --tsv", "Output as TSV").option("--detailed", "Include detailed system info and sensor readings").option("--interval <seconds>", "Refresh interval for live mode", "2").option("--once", "Show a single static snapshot instead of live feed").option("--out <file>", "Also write the snapshot output to a file (--once/--json/--csv/--tsv modes)").option("--export-dir <dir>", "Directory used for live-mode snapshot exports and logs", "./pyre-exports").option("--log", "Start continuous CSV logging immediately when live mode starts").option("--tree", "Show process tree view instead of flat list").option("--sort <key>", "Sort processes by: cpu, mem, pid, user, command, state, threads, runtime", "cpu").option("--packets", "Include packet monitor panel in output").option("--limit <n>", "Max number of processes to include in --once/--json/--csv/--tsv snapshots (0 = all)", "10").option("--p2p-host <host>", "P2P host address (server: bind address, client: server address)", "0.0.0.0").option("--p2p-port <port>", "P2P port number", "9876").option("--p2p-password <password>", "Password for P2P authentication");
+program.name("pyre").version("2.0.0").description("Mac system monitoring CLI: interactive live dashboard, stats, graphs, export, packet monitor, battery predictor").option("-j, --json", "Output as JSON").option("-c, --csv", "Output as CSV").option("-t, --tsv", "Output as TSV").option("--detailed", "Include detailed system info and sensor readings").option("--interval <seconds>", "Refresh interval for live mode", "2").option("--once", "Show a single static snapshot instead of live feed").option("--out <file>", "Also write the snapshot output to a file (--once/--json/--csv/--tsv modes)").option("--export-dir <dir>", "Directory used for live-mode snapshot exports and logs", "./pyre-exports").option("--log", "Start continuous CSV logging immediately when live mode starts").option("--tree", "Show process tree view instead of flat list").option("--sort <key>", "Sort processes by: cpu, mem, pid, user, command, state, threads, runtime", "cpu").option("--packets", "Include packet monitor panel in output").option("--limit <n>", "Max number of processes to include in --once/--json/--csv/--tsv snapshots (0 = all)", "10").option("--p2p-host <host>", "P2P host address (server: bind address, client: server address)", "0.0.0.0").option("--p2p-port <port>", "P2P port number", "9876").option("--p2p-password <password>", "Password for P2P authentication").option("--p2p-tls", "Enable TLS encryption for P2P connections").option("--p2p-cert <file>", "TLS certificate file (PEM) for P2P server").option("--p2p-key <file>", "TLS private key file (PEM) for P2P server").option("--p2p-ca <file>", "TLS CA certificate file (PEM) for P2P client").option("--p2p-insecure", "Skip TLS certificate verification (client only)").option("--p2p-rate-limit <n>", "Max auth attempts per IP per minute (default: 5)", "5").option("--p2p-allow <ips>", "Comma-separated list of allowed IPs (empty = all)").option("--p2p-deny <ips>", "Comma-separated list of denied IPs").option("--p2p-audit-log <dir>", "Directory for P2P audit logs").option("--p2p-hmac-key <key>", "HMAC key for message signing (default: derived from password)");
 program.parse(process.argv);
 var opts = program.opts();
 function isExportMode() {
@@ -2576,7 +2810,7 @@ async function main() {
       await runP2PConnect();
       return;
     } else {
-      console.log(chalk8.red("Usage: pyre p2p <server|connect> [options]"));
+      console.log(chalk9.red("Usage: pyre p2p <server|connect> [options]"));
       process.exit(1);
     }
   }
@@ -2590,13 +2824,13 @@ async function main() {
   else output = formatTable(data, { width: process.stdout.columns || 80, sortBy: opts.sort, treeView: opts.tree, visible: { packets: opts.packets ? true : void 0 } });
   console.log(output);
   if (opts.out) {
-    fs2.writeFileSync(opts.out, stripAnsi(output));
-    console.log(chalk8.dim(`
+    fs4.writeFileSync(opts.out, stripAnsi(output));
+    console.log(chalk9.dim(`
 Saved to ${opts.out}`));
   }
 }
 main().catch((err) => {
-  console.error(chalk8.red(`Error: ${err.message}`));
+  console.error(chalk9.red(`Error: ${err.message}`));
   process.exit(1);
 });
 async function runP2PServer() {
@@ -2605,19 +2839,53 @@ async function runP2PServer() {
   const password = opts.p2pPassword || "";
   const interval = parseFloat(opts.interval) || 2;
   const detailed = !!opts.detailed;
+  const tlsCert = opts.p2pCert;
+  const tlsKey = opts.p2pKey;
+  const tlsCA = opts.p2pCA;
+  const rateLimit = parseInt(opts.p2pRateLimit, 10) || 5;
+  const allowList = opts.p2pAllow ? opts.p2pAllow.split(",").map((s) => s.trim()).filter(Boolean) : [];
+  const denyList = opts.p2pDeny ? opts.p2pDeny.split(",").map((s) => s.trim()).filter(Boolean) : [];
   if (!password) {
-    console.log(chalk8.red("Error: a password is required for P2P server mode. Use --p2p-password <password>"));
+    console.log(chalk9.red("Error: a password is required for P2P server mode. Use --p2p-password <password>"));
+    process.exit(1);
+  }
+  if (tlsCert && !tlsKey) {
+    console.log(chalk9.red("Error: --p2p-key is required when --p2p-cert is specified"));
+    process.exit(1);
+  }
+  if (tlsKey && !tlsCert) {
+    console.log(chalk9.red("Error: --p2p-cert is required when --p2p-key is specified"));
     process.exit(1);
   }
-  const server = new P2PServer({ host, port, password, intervalMs: interval * 1e3, detailed });
-  console.log(chalk8.bold(`
+  const server = new P2PServer({
+    host,
+    port,
+    password,
+    intervalMs: interval * 1e3,
+    detailed,
+    tlsCert,
+    tlsKey,
+    tlsCA,
+    rateLimitMaxAttempts: rateLimit,
+    rateLimitWindowMs: 6e4,
+    allowedIPs: allowList,
+    deniedIPs: denyList,
+    auditLog: opts.p2pAuditLog,
+    hmacKey: opts.p2pHmacKey
+  });
+  const tlsEnabled = !!(tlsCert && tlsKey);
+  console.log(chalk9.bold(`
   pyre P2P Server`));
-  console.log(chalk8.dim(`  Host: ${host}`));
-  console.log(chalk8.dim(`  Port: ${port}`));
-  console.log(chalk8.dim(`  Password: ${password}`));
-  console.log(chalk8.dim(`  Interval: ${interval}s`));
-  console.log(chalk8.dim(`  Detailed: ${detailed ? "on" : "off"}`));
-  console.log(chalk8.dim(`  Waiting for peers...
+  console.log(chalk9.dim(`  Host: ${host}`));
+  console.log(chalk9.dim(`  Port: ${port}`));
+  console.log(chalk9.dim(`  Protocol: ${tlsEnabled ? "TLS" : "TCP"}`));
+  console.log(chalk9.dim(`  Password: ${password}`));
+  console.log(chalk9.dim(`  Interval: ${interval}s`));
+  console.log(chalk9.dim(`  Detailed: ${detailed ? "on" : "off"}`));
+  console.log(chalk9.dim(`  Rate limit: ${rateLimit} attempts/min`));
+  if (allowList.length > 0) console.log(chalk9.dim(`  Allowed IPs: ${allowList.join(", ")}`));
+  if (denyList.length > 0) console.log(chalk9.dim(`  Denied IPs: ${denyList.join(", ")}`));
+  console.log(chalk9.dim(`  Waiting for peers...
 `));
   await server.start();
   const rl = readline2.createInterface({ input: process.stdin });
@@ -2629,7 +2897,7 @@ async function runP2PServer() {
       process.exit(0);
     } else if (trimmed === "status") {
       const info = server.info;
-      console.log(chalk8.dim(`  Peers connected: ${info.peersConnected}`));
+      console.log(chalk9.dim(`  Peers connected: ${info.peersConnected}`));
     }
   });
   process.once("SIGINT", () => {
@@ -2642,18 +2910,30 @@ async function runP2PConnect() {
   const host = opts.p2pHost || "127.0.0.1";
   const port = parseInt(opts.p2pPort, 10) || 9876;
   const password = opts.p2pPassword || "";
+  const useTLS = !!opts.p2pTls;
+  const tlsCA = opts.p2pCA;
+  const tlsInsecure = !!opts.p2pInsecure;
   if (!password) {
-    console.log(chalk8.red("Error: a password is required for P2P connect mode. Use --p2p-password <password>"));
+    console.log(chalk9.red("Error: a password is required for P2P connect mode. Use --p2p-password <password>"));
     process.exit(1);
   }
-  const client = new P2PClient({ host, port, password });
+  const client = new P2PClient({
+    host,
+    port,
+    password,
+    tls: useTLS,
+    tlsCA,
+    tlsInsecure,
+    auditLog: opts.p2pAuditLog,
+    hmacKey: opts.p2pHmacKey
+  });
   client.setOnStatus((msg) => {
-    process.stdout.write(`\r${chalk8.dim(msg)}${" ".repeat(40)}\r`);
+    process.stdout.write(`\r${chalk9.dim(msg)}${" ".repeat(40)}\r`);
   });
   client.setOnData((data) => {
     process.stdout.write("\x1B[2J\x1B[H");
-    console.log(chalk8.bold(`  pyre P2P Client \u2014 ${data.header.hostname}`));
-    console.log(chalk8.dim(`  ${data.timestamp}`));
+    console.log(chalk9.bold(`  pyre P2P Client \u2014 ${data.header.hostname}`));
+    console.log(chalk9.dim(`  ${data.timestamp}`));
     console.log();
     console.log(formatTable(data, {
       width: process.stdout.columns || 80,
@@ -2662,15 +2942,17 @@ async function runP2PConnect() {
       visible: { packets: true }
     }));
   });
-  console.log(chalk8.bold(`
+  const protocolLabel = useTLS ? "TLS" : "TCP";
+  console.log(chalk9.bold(`
   pyre P2P Client`));
-  console.log(chalk8.dim(`  Connecting to ${host}:${port}...`));
-  console.log(chalk8.dim(`  Press Ctrl+C to disconnect
+  console.log(chalk9.dim(`  Protocol: ${protocolLabel}`));
+  console.log(chalk9.dim(`  Connecting to ${host}:${port}...`));
+  console.log(chalk9.dim(`  Press Ctrl+C to disconnect
 `));
   try {
     await client.connect();
   } catch (err) {
-    console.log(chalk8.red(`Connection failed: ${err.message}`));
+    console.log(chalk9.red(`Connection failed: ${err.message}`));
     process.exit(1);
   }
   process.once("SIGINT", () => {