pyre-cli 2.0.0 → 3.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pyre-cli",
-  "version": "2.0.0",
+  "version": "3.0.0",
   "description": "CLI Mac monitoring tool: temps, system stats, live dashboard, packet monitor, battery predictor, export",
   "main": "dist/index.js",
   "type": "module",

package/src/index.ts

@@ -37,7 +37,17 @@ program
     .option('--limit <n>', 'Max number of processes to include in --once/--json/--csv/--tsv snapshots (0 = all)', '10')
     .option('--p2p-host <host>', 'P2P host address (server: bind address, client: server address)', '0.0.0.0')
     .option('--p2p-port <port>', 'P2P port number', '9876')
-    .option('--p2p-password <password>', 'Password for P2P authentication');
+    .option('--p2p-password <password>', 'Password for P2P authentication')
+    .option('--p2p-tls', 'Enable TLS encryption for P2P connections')
+    .option('--p2p-cert <file>', 'TLS certificate file (PEM) for P2P server')
+    .option('--p2p-key <file>', 'TLS private key file (PEM) for P2P server')
+    .option('--p2p-ca <file>', 'TLS CA certificate file (PEM) for P2P client')
+    .option('--p2p-insecure', 'Skip TLS certificate verification (client only)')
+    .option('--p2p-rate-limit <n>', 'Max auth attempts per IP per minute (default: 5)', '5')
+    .option('--p2p-allow <ips>', 'Comma-separated list of allowed IPs (empty = all)')
+    .option('--p2p-deny <ips>', 'Comma-separated list of denied IPs')
+    .option('--p2p-audit-log <dir>', 'Directory for P2P audit logs')
+    .option('--p2p-hmac-key <key>', 'HMAC key for message signing (default: derived from password)');
 
 program.parse(process.argv);
 
@@ -116,20 +126,56 @@ async function runP2PServer(): Promise<void> {
   const password = opts.p2pPassword || '';
   const interval = parseFloat(opts.interval) || 2;
   const detailed = !!opts.detailed;
+  const tlsCert = opts.p2pCert;
+  const tlsKey = opts.p2pKey;
+  const tlsCA = opts.p2pCA;
+  const rateLimit = parseInt(opts.p2pRateLimit, 10) || 5;
+  const allowList = opts.p2pAllow ? opts.p2pAllow.split(',').map((s: string) => s.trim()).filter(Boolean) : [];
+  const denyList = opts.p2pDeny ? opts.p2pDeny.split(',').map((s: string) => s.trim()).filter(Boolean) : [];
 
   if (!password) {
     console.log(chalk.red('Error: a password is required for P2P server mode. Use --p2p-password <password>'));
     process.exit(1);
   }
 
-  const server = new P2PServer({ host, port, password, intervalMs: interval * 1000, detailed });
+  if (tlsCert && !tlsKey) {
+    console.log(chalk.red('Error: --p2p-key is required when --p2p-cert is specified'));
+    process.exit(1);
+  }
+  if (tlsKey && !tlsCert) {
+    console.log(chalk.red('Error: --p2p-cert is required when --p2p-key is specified'));
+    process.exit(1);
+  }
+
+  const server = new P2PServer({
+    host,
+    port,
+    password,
+    intervalMs: interval * 1000,
+    detailed,
+    tlsCert,
+    tlsKey,
+    tlsCA,
+    rateLimitMaxAttempts: rateLimit,
+    rateLimitWindowMs: 60000,
+    allowedIPs: allowList,
+    deniedIPs: denyList,
+    auditLog: opts.p2pAuditLog,
+    hmacKey: opts.p2pHmacKey,
+  });
+
+  const tlsEnabled = !!(tlsCert && tlsKey);
 
   console.log(chalk.bold(`\n  pyre P2P Server`));
   console.log(chalk.dim(`  Host: ${host}`));
   console.log(chalk.dim(`  Port: ${port}`));
+  console.log(chalk.dim(`  Protocol: ${tlsEnabled ? 'TLS' : 'TCP'}`));
   console.log(chalk.dim(`  Password: ${password}`));
   console.log(chalk.dim(`  Interval: ${interval}s`));
   console.log(chalk.dim(`  Detailed: ${detailed ? 'on' : 'off'}`));
+  console.log(chalk.dim(`  Rate limit: ${rateLimit} attempts/min`));
+  if (allowList.length > 0) console.log(chalk.dim(`  Allowed IPs: ${allowList.join(', ')}`));
+  if (denyList.length > 0) console.log(chalk.dim(`  Denied IPs: ${denyList.join(', ')}`));
   console.log(chalk.dim(`  Waiting for peers...\n`));
 
   await server.start();
@@ -158,13 +204,25 @@ async function runP2PConnect(): Promise<void> {
   const host = opts.p2pHost || '127.0.0.1';
   const port = parseInt(opts.p2pPort, 10) || 9876;
   const password = opts.p2pPassword || '';
+  const useTLS = !!opts.p2pTls;
+  const tlsCA = opts.p2pCA;
+  const tlsInsecure = !!opts.p2pInsecure;
 
   if (!password) {
     console.log(chalk.red('Error: a password is required for P2P connect mode. Use --p2p-password <password>'));
     process.exit(1);
   }
 
-  const client = new P2PClient({ host, port, password });
+  const client = new P2PClient({
+    host,
+    port,
+    password,
+    tls: useTLS,
+    tlsCA,
+    tlsInsecure,
+    auditLog: opts.p2pAuditLog,
+    hmacKey: opts.p2pHmacKey,
+  });
 
   client.setOnStatus((msg) => {
     process.stdout.write(`\r${chalk.dim(msg)}${' '.repeat(40)}\r`);
@@ -183,7 +241,9 @@ async function runP2PConnect(): Promise<void> {
     }));
   });
 
+  const protocolLabel = useTLS ? 'TLS' : 'TCP';
   console.log(chalk.bold(`\n  pyre P2P Client`));
+  console.log(chalk.dim(`  Protocol: ${protocolLabel}`));
   console.log(chalk.dim(`  Connecting to ${host}:${port}...`));
   console.log(chalk.dim(`  Press Ctrl+C to disconnect\n`));
 

package/src/monitors/collectors.ts

@@ -627,7 +627,7 @@ export async function collectPackets(): Promise<PacketData | null> {
      let topProcesses: { pid: number; command: string; rxBytes: number; txBytes: number }[] = [];
      let allProcesses: { pid: number; command: string; rxBytes: number; txBytes: number; rxPackets?: number; txPackets?: number }[] = [];
      try {
-        const lsof = (await run('lsof -i -n -P -r 1 2>/dev/null | tail -n +2 | awk \'{print $1, $2}\' | sort | uniq -c | sort -rn', '')).trim();
+         const lsof = (await run('lsof -i -n -P 2>/dev/null | tail -n +2 | awk \'{print $1, $2}\' | sort | uniq -c | sort -rn', '')).trim();
         const lsofLines = lsof.split('\n');
         topProcesses = lsofLines.map(line => {
           const parts = line.trim().split(/\s+/);

package/src/p2p/client.ts

@@ -1,6 +1,9 @@
 import net from 'node:net';
+import tls from 'node:tls';
+import fs from 'node:fs';
+import crypto from 'node:crypto';
 import chalk from 'chalk';
-import { encodeAuth, encodePing, encodePong, encodeDisconnect } from './protocol.js';
+import { encodeChallenge, encodeAuth, encodePing, encodePong, encodeDisconnect, hashPassword, computeHMAC, verifyHMAC, signMessage, decodeMessage, generateNonce } from './protocol.js';
 import type { P2PClientOptions } from './types.js';
 import type { StatsData } from '../monitors/types.js';
 
@@ -11,7 +14,7 @@ interface ReadState {
 }
 
 export class P2PClient {
-  private socket: net.Socket | null = null;
+  private socket: net.Socket | tls.TLSSocket | null = null;
   private options: P2PClientOptions;
   private running = false;
   private readState: ReadState = { buffer: Buffer.alloc(0), expectingHeader: true, messageLength: 0 };
@@ -19,9 +22,13 @@ export class P2PClient {
   private onStatusCallback: ((msg: string) => void) | null = null;
   private reconnectTimer: NodeJS.Timeout | null = null;
   private pingHandle: NodeJS.Timeout | null = null;
+  private pendingNonce: string | null = null;
+  private auditStream: fs.WriteStream | null = null;
+  private hmacKey: string;
 
   constructor(options: P2PClientOptions) {
     this.options = options;
+    this.hmacKey = deriveHMACKey(options.password);
   }
 
   setOnData(cb: (data: StatsData) => void): void {
@@ -33,27 +40,50 @@ export class P2PClient {
   }
 
   async connect(): Promise<void> {
+    if (this.options.auditLog) {
+      try {
+        fs.mkdirSync(this.options.auditLog, { recursive: true });
+        const logFile = `${this.options.auditLog}/p2p-client-audit.log`;
+        this.auditStream = fs.createWriteStream(logFile, { flags: 'a' });
+      } catch {
+        console.log(chalk.yellow('Warning: could not open audit log'));
+      }
+    }
+
     return new Promise((resolve, reject) => {
-      this.socket = new net.Socket();
+      const useTLS = !!this.options.tls;
+
+      if (useTLS) {
+        const tlsOptions: tls.ConnectionOptions = {
+          host: this.options.host,
+          port: this.options.port,
+          rejectUnauthorized: !this.options.tlsInsecure,
+        };
+        if (this.options.tlsCA) {
+          tlsOptions.ca = fs.readFileSync(this.options.tlsCA);
+        }
+        this.socket = tls.connect(tlsOptions, () => {
+          this.status('Connecting...');
+        });
+      } else {
+        this.socket = new net.Socket();
+        this.socket.on('data', (data) => this.onData(data));
+        this.socket.on('close', () => this.onClose());
+        this.socket.on('error', (err) => this.onError(err));
+        this.socket.on('timeout', () => this.onTimeout());
+        this.socket.setTimeout(10000);
+        this.socket.connect(this.options.port, this.options.host, () => {
+          this.status('Connecting...');
+        });
+        this.socket.once('error', (err) => {
+          reject(err);
+        });
+      }
 
       this.socket.on('data', (data) => this.onData(data));
       this.socket.on('close', () => this.onClose());
       this.socket.on('error', (err) => this.onError(err));
       this.socket.on('timeout', () => this.onTimeout());
-
-      this.socket.setTimeout(10000);
-
-      this.socket.connect(this.options.port, this.options.host, () => {
-        this.running = true;
-        this.socket?.setTimeout(0);
-        this.socket?.write(encodeAuth(this.options.password));
-        this.status('Connecting...');
-        resolve();
-      });
-
-      this.socket.once('error', (err) => {
-        reject(err);
-      });
     });
   }
 
@@ -69,13 +99,17 @@ export class P2PClient {
     }
     if (this.socket) {
       try {
-        this.socket.write(encodeDisconnect('Client closing'));
+        this.sendSigned(encodeDisconnect('Client closing'));
       } catch {
         // ignore
       }
       this.socket.destroy();
       this.socket = null;
     }
+    if (this.auditStream) {
+      this.auditStream.end();
+      this.auditStream = null;
+    }
     this.status('Disconnected');
   }
 
@@ -108,29 +142,49 @@ export class P2PClient {
 
   private handleMessage(body: Buffer): void {
     try {
-      const msg = JSON.parse(body.toString('utf-8'));
+      const raw = body.toString('utf-8');
+      const msg = decodeMessage(body);
+
+      if (!verifyHMAC(raw, msg.hmac ?? '', this.hmacKey)) {
+        this.status('Message integrity check failed');
+        return;
+      }
 
       switch (msg.kind) {
+        case 'challenge':
+          const challengePayload = msg.payload as { nonce?: string };
+          if (challengePayload.nonce) {
+            this.pendingNonce = challengePayload.nonce;
+            const passwordHash = hashPassword(this.options.password, challengePayload.nonce);
+            this.sendSigned(signMessage('auth', { passwordHash, nonce: challengePayload.nonce }, this.hmacKey));
+            this.status('Authenticating...');
+          }
+          break;
+
         case 'auth-ok':
           this.status('Authenticated — receiving live data');
           this.startPing();
           break;
 
         case 'auth-fail':
-          this.status(`Authentication failed: ${(msg.payload as { reason: string }).reason}`);
+          const failPayload = msg.payload as { reason?: string };
+          this.status(`Authentication failed: ${failPayload.reason || 'unknown'}`);
           this.disconnect();
           break;
 
         case 'data':
-          if (this.onDataCallback && msg.payload?.stats) {
-            this.onDataCallback(msg.payload.stats as StatsData);
+          if (this.onDataCallback) {
+            const dataPayload = msg.payload as { stats?: StatsData };
+            if (dataPayload.stats) {
+              this.onDataCallback(dataPayload.stats);
+            }
           }
           break;
 
         case 'ping':
           if (this.socket && !this.socket.destroyed) {
             const ts = (msg.payload as { ts: number }).ts;
-            this.socket.write(encodePong(ts));
+            this.sendSigned(signMessage('pong', { ts }, this.hmacKey));
           }
           break;
 
@@ -138,7 +192,8 @@ export class P2PClient {
           break;
 
         case 'disconnect':
-          this.status(`Server disconnected: ${(msg.payload as { reason: string }).reason}`);
+          const disconnectPayload = msg.payload as { reason?: string };
+          this.status(`Server disconnected: ${disconnectPayload.reason || 'unknown'}`);
           this.disconnect();
           break;
 
@@ -150,10 +205,16 @@ export class P2PClient {
     }
   }
 
+  private sendSigned(message: Buffer): void {
+    if (this.socket && !this.socket.destroyed) {
+      this.socket.write(message);
+    }
+  }
+
   private startPing(): void {
     this.pingHandle = setInterval(() => {
       if (this.socket && !this.socket.destroyed) {
-        this.socket.write(encodePing());
+        this.sendSigned(signMessage('ping', { ts: Date.now() }, this.hmacKey));
       }
     }, 15000);
   }
@@ -173,6 +234,8 @@ export class P2PClient {
       this.status('Connection refused — is the server running?');
     } else if (code === 'ETIMEDOUT') {
       this.status('Connection timed out');
+    } else if (code === 'UNABLE_TO_VERIFY_LEAF_SIGNATURE') {
+      this.status('TLS certificate verification failed — use --p2p-insecure to skip');
     } else {
       this.status(`Connection error: ${err.message}`);
     }
@@ -188,6 +251,17 @@ export class P2PClient {
       this.onStatusCallback(msg);
     }
   }
+
+  audit(event: string, detail: string): void {
+    if (!this.auditStream) return;
+    const ts = new Date().toISOString();
+    const ip = this.options.host;
+    this.auditStream.write(`${ts} ${ip} ${event} ${detail}\n`);
+  }
+}
+
+function deriveHMACKey(password: string): string {
+  return crypto.createHash('sha256').update(password).digest('hex').slice(0, 32);
 }
 
 export async function connectP2PClient(options: P2PClientOptions): Promise<P2PClient> {

package/src/p2p/protocol.ts

@@ -1,19 +1,53 @@
-import type { P2PMessage, P2PMessageKind, P2PPayload } from './types.js';
+import crypto from 'node:crypto';
+import type { P2PMessage, P2PMessageKind, P2PPayload, ChallengeMessage, AuthMessage } from './types.js';
 import type { StatsData } from '../monitors/types.js';
 
 const HEADER_SIZE = 4;
 const MAX_MESSAGE_SIZE = 16 * 1024 * 1024;
+const HMAC_ALGO = 'sha256';
 
-function buildMessage(kind: P2PMessageKind, payload: P2PPayload): Buffer {
+function buildMessage(kind: P2PMessageKind, payload: P2PPayload, hmac?: string): Buffer {
   const envelope: P2PMessage = { kind, payload };
+  if (hmac) envelope.hmac = hmac;
   const body = Buffer.from(JSON.stringify(envelope), 'utf-8');
   const header = Buffer.alloc(HEADER_SIZE);
   header.writeUInt32BE(body.length, 0);
   return Buffer.concat([header, body]);
 }
 
-export function encodeAuth(password: string): Buffer {
-  return buildMessage('auth', { password });
+export function generateNonce(): string {
+  return crypto.randomBytes(32).toString('hex');
+}
+
+export function hashPassword(password: string, nonce: string): string {
+  return crypto.createHash('sha256').update(`${password}:${nonce}`).digest('hex');
+}
+
+export function computeHMAC(body: string, key?: string): string | undefined {
+  if (!key) return undefined;
+  return crypto.createHmac(HMAC_ALGO, key).update(body).digest('hex');
+}
+
+export function verifyHMAC(body: string, expectedHmac: string, key?: string): boolean {
+  if (!key) return expectedHmac === undefined;
+  if (!expectedHmac) return false;
+  try {
+    const parsed = JSON.parse(body) as P2PMessage;
+    const payloadWithoutHmac = { ...parsed, hmac: undefined };
+    const canonical = JSON.stringify(payloadWithoutHmac);
+    const computed = crypto.createHmac(HMAC_ALGO, key).update(canonical).digest('hex');
+    return crypto.timingSafeEqual(Buffer.from(computed), Buffer.from(expectedHmac));
+  } catch {
+    return false;
+  }
+}
+
+export function encodeChallenge(nonce: string): Buffer {
+  return buildMessage('challenge', { nonce });
+}
+
+export function encodeAuth(passwordHash: string, nonce: string): Buffer {
+  return buildMessage('auth', { passwordHash, nonce });
 }
 
 export function encodeAuthOk(): Buffer {
@@ -46,6 +80,13 @@ export function decodeMessage(buf: Buffer): P2PMessage {
   return msg;
 }
 
+export function signMessage(kind: P2PMessageKind, payload: P2PPayload, key?: string): Buffer {
+  const envelope: P2PMessage = { kind, payload };
+  const bodyJson = JSON.stringify(envelope);
+  const hmac = computeHMAC(bodyJson, key);
+  return buildMessage(kind, payload, hmac);
+}
+
 export function readMessage(stream: { read(n: number): Buffer | null }): Buffer | null {
   const header = stream.read(HEADER_SIZE);
   if (!header || header.length < HEADER_SIZE) return null;