pyre-cli 2.0.0 → 3.1.0

package/dist/index.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import fs2 from "fs";
+import fs4 from "fs";
 import readline2 from "readline";
 import { Command } from "commander";
-import chalk8 from "chalk";
+import chalk9 from "chalk";
 
 // src/monitors/collectors.ts
 import chalk from "chalk";
@@ -511,7 +511,7 @@ async function collectPackets() {
     let topProcesses = [];
     let allProcesses = [];
     try {
-      const lsof = (await run("lsof -i -n -P -r 1 2>/dev/null | tail -n +2 | awk '{print $1, $2}' | sort | uniq -c | sort -rn", "")).trim();
+      const lsof = (await run("lsof -i -n -P 2>/dev/null | tail -n +2 | awk '{print $1, $2}' | sort | uniq -c | sort -rn", "")).trim();
       const lsofLines = lsof.split("\n");
       topProcesses = lsofLines.map((line) => {
         const parts = line.trim().split(/\s+/);
@@ -859,7 +859,8 @@ var TAB_DEFS = [
   { id: "packets", label: "Packets", key: "8" },
   { id: "tasks", label: "Tasks", key: "9" },
   { id: "disk", label: "Disk", key: "0" },
-  { id: "process", label: "Process", key: "p" }
+  { id: "process", label: "Process", key: "P" },
+  { id: "p2p", label: "P2P", key: "R" }
 ];
 var TAB_BAR_INDENT = 2;
 var TAB_SEPARATOR_WIDTH = 3;
@@ -1485,8 +1486,15 @@ var state = {
     { id: "packets", label: "Packets", key: "8" },
     { id: "tasks", label: "Tasks", key: "9" },
     { id: "disk", label: "Disk", key: "0" },
-    { id: "process", label: "Process", key: "P" }
-  ]
+    { id: "process", label: "Process", key: "P" },
+    { id: "p2p", label: "P2P", key: "R" }
+  ],
+  p2pEvents: [],
+  p2pBind: "",
+  p2pServer: null,
+  p2pServerRunning: false,
+  p2pPort: 9876,
+  p2pPassword: "pyre"
 };
 function setStatus(msg, ms = 3e3) {
   state.statusMessage = msg;
@@ -1563,6 +1571,29 @@ function processRowBudget() {
   const reserved = 2 + cardRows * 8 + 11 + (state.showGraphs ? 9 : 0) + 4;
   return Math.max(3, Math.min(40, state.termHeight - reserved));
 }
+function p2pPanelLines() {
+  const events = state.p2pServer ? state.p2pServer.peerEventHistory : state.p2pEvents;
+  const body = [];
+  const bindAddr = state.p2pBind || `0.0.0.0:${state.p2pPort}`;
+  body.push(`Status:   ${state.p2pServerRunning ? chalk5.green("Running") : chalk5.red("Stopped")}`);
+  body.push(`Bind:     ${bindAddr}`);
+  body.push(`Password: ${state.p2pPassword}`);
+  body.push("");
+  const typeColor = (t) => {
+    if (t === "auth") return chalk5.green;
+    if (t === "disconnect") return chalk5.yellow;
+    if (t === "error" || t === "blocked" || t === "rate_limited") return chalk5.red;
+    return chalk5.cyan;
+  };
+  body.push(chalk5.dim("Events (most recent):"));
+  const recent = events.slice(-20).reverse();
+  for (const evt of recent) {
+    const time = new Date(evt.ts).toLocaleTimeString();
+    body.push(`${chalk5.dim(time)} ${typeColor(evt.type)(evt.type.padEnd(14))} ${evt.detail}`);
+  }
+  const title = `P2P \xB7 ${state.p2pServerRunning ? "ON" : "OFF"} \xB7 ${events.length} events`;
+  return { title, body };
+}
 function renderCustomizerOverlay() {
   const themesList = Object.keys(THEMES);
   const lines = [
@@ -1590,19 +1621,25 @@ function renderCustomizerOverlay() {
 function render() {
   if (!state.lastData) return;
   const lines = [];
-  lines.push(
-    formatTable(state.lastData, {
-      width: state.termWidth,
-      sortBy: state.sortMode,
-      filter: state.processFilter || void 0,
-      processLimit: processRowBudget(),
-      theme: state.currentTheme,
-      visible: state.visiblePanels,
-      treeView: state.treeView,
-      activePanel: state.activePanel
-    })
-  );
-  if (state.showGraphs) {
+  const theme = THEMES[state.currentTheme] || THEMES.default;
+  if (state.activePanel === "p2p") {
+    const panelLines = p2pPanelLines();
+    lines.push(...panel(panelLines.title, panelLines.body, state.termWidth, theme.process, theme.border));
+  } else {
+    lines.push(
+      formatTable(state.lastData, {
+        width: state.termWidth,
+        sortBy: state.sortMode,
+        filter: state.processFilter || void 0,
+        processLimit: processRowBudget(),
+        theme: state.currentTheme,
+        visible: state.visiblePanels,
+        treeView: state.treeView,
+        activePanel: state.activePanel
+      })
+    );
+  }
+  if (state.showGraphs && state.activePanel !== "p2p") {
     lines.push("");
     lines.push(formatGraphs(state.history, state.termWidth, state.currentTheme, state.graphMode));
   }
@@ -1620,6 +1657,8 @@ function render() {
     lines.push(chalk5.cyan(`  Signal: ${state.inputBuffer}_`));
     lines.push(chalk5.dim(`  ${sigList}`));
     lines.push(chalk5.dim("  \u2191/\u2193 to select, Enter to confirm, Esc to cancel"));
+  } else if (state.inputMode === "p2p") {
+    lines.push(chalk5.cyan(`  P2P password (${state.p2pPort}): ${state.inputBuffer}_  (enter to start, esc to cancel)`));
   } else if (state.statusMessage) {
     lines.push(`  ${state.statusMessage}`);
   }
@@ -1630,6 +1669,7 @@ function footerLine() {
   const keys = [
     ["q", "quit"],
     ["c", "customize UI"],
+    ["r", state.p2pServerRunning ? "stop p2p" : "start p2p"],
     ["p", state.paused ? "resume" : "pause"],
     ["g", state.showGraphs ? "hide graphs" : "show graphs"],
     ["b", `graph:${state.graphMode}`],
@@ -1651,6 +1691,7 @@ function footerLine() {
   if (state.paused) badges.push(chalk5.yellow.bold("\u23F8 PAUSED"));
   if (state.logging) badges.push(chalk5.red.bold("\u25CF REC"));
   if (state.activePanel !== "grid") badges.push(chalk5.cyan.bold(`\u25C9 ${state.activePanel.toUpperCase()}`));
+  if (state.p2pServerRunning) badges.push(chalk5.green.bold(`P2P ${state.p2pBind || "0.0.0.0"}:${state.p2pPort}`));
   const badgeStr = badges.join("  ");
   return badgeStr ? `${keyStr}    ${badgeStr}` : keyStr;
 }
@@ -1667,781 +1708,511 @@ function checkAlerts(data) {
   }
 }
 
-// src/live/input.ts
-function handleInputModeKey(str, key) {
-  if (key.name === "escape") {
-    state.inputMode = null;
-    state.inputBuffer = "";
-    render();
-    return;
+// src/p2p/server.ts
+import net from "net";
+import tls from "tls";
+import fs2 from "fs";
+import crypto2 from "crypto";
+import chalk6 from "chalk";
+
+// src/p2p/protocol.ts
+import crypto from "crypto";
+var HEADER_SIZE = 4;
+var MAX_MESSAGE_SIZE = 16 * 1024 * 1024;
+var HMAC_ALGO = "sha256";
+function buildMessage(kind, payload, hmac) {
+  const envelope = { kind, payload };
+  if (hmac) envelope.hmac = hmac;
+  const body = Buffer.from(JSON.stringify(envelope), "utf-8");
+  const header2 = Buffer.alloc(HEADER_SIZE);
+  header2.writeUInt32BE(body.length, 0);
+  return Buffer.concat([header2, body]);
+}
+function generateNonce() {
+  return crypto.randomBytes(32).toString("hex");
+}
+function hashPassword(password, nonce) {
+  return crypto.createHash("sha256").update(`${password}:${nonce}`).digest("hex");
+}
+function computeHMAC(body, key) {
+  if (!key) return void 0;
+  return crypto.createHmac(HMAC_ALGO, key).update(body).digest("hex");
+}
+function verifyHMAC(body, expectedHmac, key) {
+  if (!key) return expectedHmac === void 0;
+  if (!expectedHmac) return false;
+  try {
+    const parsed = JSON.parse(body);
+    const payloadWithoutHmac = { ...parsed, hmac: void 0 };
+    const canonical = JSON.stringify(payloadWithoutHmac);
+    const computed = crypto.createHmac(HMAC_ALGO, key).update(canonical).digest("hex");
+    return crypto.timingSafeEqual(Buffer.from(computed), Buffer.from(expectedHmac));
+  } catch {
+    return false;
   }
-  if (state.inputMode === "customizer") {
-    const themesList = Object.keys(THEMES);
-    if (key.name === "up" || str === "k") {
-      state.customizerIndex = (state.customizerIndex - 1 + state.CUSTOMIZER_OPTIONS.length) % state.CUSTOMIZER_OPTIONS.length;
-    } else if (key.name === "down" || str === "j") {
-      state.customizerIndex = (state.customizerIndex + 1) % state.CUSTOMIZER_OPTIONS.length;
-    } else if (key.name === "return" || str === " ") {
-      const selected = state.CUSTOMIZER_OPTIONS[state.customizerIndex];
-      if (selected === "Theme") {
-        const nextIdx = (themesList.indexOf(state.currentTheme) + 1) % themesList.length;
-        state.currentTheme = themesList[nextIdx];
-      } else if (selected === "Toggle Tree View") {
-        state.treeView = !state.treeView;
-      } else if (selected === "Graph Mode") {
-        state.graphMode = state.graphMode === "spark" ? "bar" : "spark";
+}
+function encodeDisconnect(reason) {
+  return buildMessage("disconnect", { reason });
+}
+function decodeMessage(buf) {
+  const str = buf.toString("utf-8");
+  const msg = JSON.parse(str);
+  return msg;
+}
+function signMessage(kind, payload, key) {
+  const envelope = { kind, payload };
+  const bodyJson = JSON.stringify(envelope);
+  const hmac = computeHMAC(bodyJson, key);
+  return buildMessage(kind, payload, hmac);
+}
+
+// src/p2p/server.ts
+var HEADER_SIZE2 = 4;
+var DEFAULT_RATE_LIMIT_MAX = 5;
+var DEFAULT_RATE_LIMIT_WINDOW = 6e4;
+var HMAC_KEY_LENGTH = 32;
+function readMessageFromPeer(peer) {
+  while (peer.readBuffer.length > 0) {
+    if (peer.readExpectingHeader) {
+      if (peer.readBuffer.length >= HEADER_SIZE2) {
+        peer.readMessageLength = peer.readBuffer.readUInt32BE(0);
+        peer.readBuffer = peer.readBuffer.subarray(HEADER_SIZE2);
+        peer.readExpectingHeader = false;
       } else {
-        const itemKey = selected.replace("Toggle ", "").toLowerCase();
-        state.visiblePanels[itemKey] = !state.visiblePanels[itemKey];
+        break;
       }
     }
-    render();
-    return;
-  }
-  if (state.inputMode === "signal") {
-    if (key.name === "up" || str === "k") {
-      const idx = state.SIGNAL_OPTIONS.indexOf(state.inputBuffer);
-      state.inputBuffer = state.SIGNAL_OPTIONS[(idx - 1 + state.SIGNAL_OPTIONS.length) % state.SIGNAL_OPTIONS.length];
-    } else if (key.name === "down" || str === "j") {
-      const idx = state.SIGNAL_OPTIONS.indexOf(state.inputBuffer);
-      state.inputBuffer = state.SIGNAL_OPTIONS[(idx + 1) % state.SIGNAL_OPTIONS.length];
-    } else if (key.name === "return" || str === " ") {
-      killProcess(state.inputBuffer.trim(), state.inputBuffer.trim());
-      state.inputMode = null;
-      state.inputBuffer = "";
-      render();
-      return;
+    if (!peer.readExpectingHeader) {
+      if (peer.readBuffer.length >= peer.readMessageLength) {
+        const body = peer.readBuffer.subarray(0, peer.readMessageLength);
+        peer.readBuffer = peer.readBuffer.subarray(peer.readMessageLength);
+        peer.readExpectingHeader = true;
+        return body;
+      } else {
+        break;
+      }
     }
-    render();
-    return;
   }
-  if (key.name === "return") {
-    if (state.inputMode === "filter") {
-      state.processFilter = state.inputBuffer.trim();
-      setStatus(state.processFilter ? `Filtering: "${state.processFilter}"` : "Filter cleared");
-    } else if (state.inputMode === "kill") {
-      killProcess(state.inputBuffer.trim());
+  return null;
+}
+function isIPAllowed(ip, allowedIPs, deniedIPs) {
+  for (const denied of deniedIPs) {
+    if (ip === denied || ip.startsWith(denied)) {
+      return false;
     }
-    state.inputMode = null;
-    state.inputBuffer = "";
-    render();
-    return;
   }
-  if (key.name === "backspace") {
-    state.inputBuffer = state.inputBuffer.slice(0, -1);
-    render();
-    return;
+  if (allowedIPs.length === 0) {
+    return true;
   }
-  if (str && str.length === 1 && !key.ctrl && !key.meta) {
-    state.inputBuffer += str;
-    render();
+  for (const allowed of allowedIPs) {
+    if (ip === allowed || ip.startsWith(allowed)) {
+      return true;
+    }
   }
+  return false;
 }
-function killProcess(pidStr, signal = "SIGTERM") {
-  const pid = parseInt(pidStr, 10);
-  if (!pid || pid <= 0) {
-    setStatus(`Invalid PID: ${pidStr}`);
-    return;
+function deriveHMACKey(password) {
+  return crypto2.createHash("sha256").update(password).digest("hex").slice(0, HMAC_KEY_LENGTH);
+}
+var P2PServer = class {
+  server = null;
+  peers = /* @__PURE__ */ new Map();
+  options;
+  running = false;
+  rateLimitMap = /* @__PURE__ */ new Map();
+  auditStream = null;
+  hmacKey;
+  peerEvents = [];
+  boundAddress = "";
+  constructor(options) {
+    this.options = options;
+    this.hmacKey = deriveHMACKey(options.password);
   }
-  try {
-    process.kill(pid, signal);
-    setStatus(`Sent ${signal} to PID ${pid}`);
-  } catch (err) {
-    setStatus(`Failed to send ${signal} to ${pid}: ${err.message}`);
+  get peerEventHistory() {
+    return this.peerEvents;
   }
-}
-function onResize() {
-  state.termWidth = process.stdout.columns || 80;
-  state.termHeight = process.stdout.rows || 24;
-  state.history.setMaxLen(Math.max(20, Math.min(200, state.termWidth - 30)));
-  render();
-}
-function restartTicker() {
-  if (state.intervalHandle) clearInterval(state.intervalHandle);
-  state.intervalHandle = setInterval(tick, state.interval * 1e3);
-}
-async function tick() {
-  if (state.paused) return;
-  try {
-    const data = await collectAll({ detailed: state.detailed, processLimit: processRowBudget() });
-    state.lastData = data;
-    const temp = data.cpu.temperature ?? data.thermal.temperatures?.cpu_die ?? null;
-    state.history.push({
-      cpuUsage: data.cpu.usage,
-      memUsage: data.memory.usagePercent,
-      temp,
-      rxBytes: data.network.rxBytes,
-      txBytes: data.network.txBytes,
-      gpuUtil: data.gpu?.utilization,
-      powerWatts: data.power?.combinedWatts ?? data.power?.cpuWatts ?? 0,
-      rxPackets: data.network.rxPackets,
-      txPackets: data.network.txPackets,
-      connections: data.network.connections ?? 0
+  log(msg) {
+    if (this.options.onLog) {
+      this.options.onLog(msg.replace(/\x1b\[[0-9;]*m/g, ""));
+    } else {
+      console.log(msg);
+    }
+  }
+  emitPeerEvent(type, detail) {
+    const evt = { type, detail, ts: Date.now() };
+    this.peerEvents.push(evt);
+    if (this.peerEvents.length > 200) this.peerEvents.shift();
+    if (this.options.onPeerEvent) {
+      this.options.onPeerEvent(evt);
+    }
+  }
+  get info() {
+    return {
+      host: this.options.host,
+      port: this.options.port,
+      peersConnected: this.peers.size
+    };
+  }
+  async start() {
+    if (this.options.auditLog) {
+      try {
+        fs2.mkdirSync(this.options.auditLog, { recursive: true });
+        const logFile = `${this.options.auditLog}/p2p-audit.log`;
+        this.auditStream = fs2.createWriteStream(logFile, { flags: "a" });
+      } catch {
+        this.log(chalk6.yellow("Warning: could not open audit log"));
+      }
+    }
+    return new Promise((resolve, reject) => {
+      const useTLS = !!(this.options.tlsCert && this.options.tlsKey);
+      if (useTLS) {
+        const tlsOptions = {
+          key: fs2.readFileSync(this.options.tlsKey),
+          cert: fs2.readFileSync(this.options.tlsCert)
+        };
+        if (this.options.tlsCA) {
+          tlsOptions.ca = fs2.readFileSync(this.options.tlsCA);
+        }
+        this.server = tls.createServer(tlsOptions, (socket) => this.onConnection(socket));
+      } else {
+        this.server = net.createServer((socket) => this.onConnection(socket));
+      }
+      this.server.on("error", (err) => reject(err));
+      this.server.listen(this.options.port, this.options.host, () => {
+        this.running = true;
+        const addr = this.server?.address();
+        const bound = addr ? typeof addr === "object" ? `${addr.address}:${addr.port}` : String(addr) : "unknown";
+        this.boundAddress = typeof addr === "object" && addr ? addr.address : String(addr);
+        const protocol = useTLS ? "TLS" : "TCP";
+        this.log(chalk6.green(`P2P server listening on ${bound} (${protocol})`));
+        this.log(chalk6.dim(`  Password: ${this.options.password}`));
+        this.log(chalk6.dim(`  Interval: ${this.options.intervalMs}ms`));
+        const allowedIPs = this.options.allowedIPs ?? [];
+        const deniedIPs = this.options.deniedIPs ?? [];
+        if (allowedIPs.length > 0) this.log(chalk6.dim(`  Allowed IPs: ${allowedIPs.join(", ")}`));
+        if (deniedIPs.length > 0) this.log(chalk6.dim(`  Denied IPs: ${deniedIPs.join(", ")}`));
+        this.emitPeerEvent("connect", `Server listening on ${bound}`);
+        resolve();
+      });
     });
-    writeLogRow(data);
-    checkAlerts(data);
-    render();
-  } catch {
   }
-}
-async function startLive(opts2) {
-  if (state.running) return;
-  state.running = true;
-  state.paused = false;
-  state.detailed = !!opts2.detailed;
-  state.interval = opts2.interval;
-  if (opts2.exportDir) state.exportDir = opts2.exportDir;
-  state.termWidth = process.stdout.columns || 80;
-  state.termHeight = process.stdout.rows || 24;
-  state.history.reset();
-  state.history.setMaxLen(Math.max(20, Math.min(200, state.termWidth - 30)));
-  process.stdout.write("\x1B[?1049h");
-  process.stdout.write("\x1B[?25l");
-  process.stdout.write("\x1B[2J\x1B[H");
-  process.title = "pyre";
-  if (state.mouseEnabled) {
-    process.stdout.write("\x1B[?1000h");
+  stop() {
+    this.running = false;
+    for (const peer of this.peers.values()) {
+      this.disconnectPeer(peer, "Server shutting down");
+    }
+    this.peers.clear();
+    this.rateLimitMap.clear();
+    this.peerEvents = [];
+    if (this.server) {
+      this.server.close();
+      this.server = null;
+    }
+    if (this.auditStream) {
+      this.auditStream.end();
+      this.auditStream = null;
+    }
   }
-  await tick();
-  restartTicker();
-  if (opts2.autoLog) startLogging();
-  readline.emitKeypressEvents(process.stdin);
-  if (process.stdin.isTTY) process.stdin.setRawMode(true);
-  process.stdin.resume();
-  process.stdout.on("resize", onResize);
-  state.keypressHandler = (str, key) => {
-    if (!key) return;
-    if (key.ctrl && key.name === "c") {
-      stopLive();
-      return;
+  audit(ip, event, detail) {
+    if (!this.auditStream) return;
+    const ts = (/* @__PURE__ */ new Date()).toISOString();
+    this.auditStream.write(`${ts} ${ip} ${event} ${detail}
+`);
+  }
+  getPeerIP(socket) {
+    const addr = socket.remoteAddress;
+    if (!addr) return "unknown";
+    if (addr.startsWith("::ffff:")) {
+      return addr.slice(7);
     }
-    if (state.inputMode) {
-      handleInputModeKey(str, key);
-      return;
+    return addr;
+  }
+  checkRateLimit(ip) {
+    const maxAttempts = this.options.rateLimitMaxAttempts ?? DEFAULT_RATE_LIMIT_MAX;
+    const windowMs = this.options.rateLimitWindowMs ?? DEFAULT_RATE_LIMIT_WINDOW;
+    const now = Date.now();
+    const entry = this.rateLimitMap.get(ip);
+    if (!entry) {
+      this.rateLimitMap.set(ip, { attempts: 1, firstAttempt: now });
+      return true;
     }
-    if (key.mouse) {
-      handleMouseClick(key.mouse);
-      return;
+    if (now - entry.firstAttempt > windowMs) {
+      this.rateLimitMap.set(ip, { attempts: 1, firstAttempt: now });
+      return true;
     }
-    if (key.sequence && key.sequence.startsWith("\x1B[M")) {
-      handleNormalMouse(key.sequence);
+    entry.attempts++;
+    if (entry.attempts > maxAttempts) {
+      return false;
+    }
+    return true;
+  }
+  cleanupRateLimit(ip) {
+    this.rateLimitMap.delete(ip);
+  }
+  onConnection(socket) {
+    const ip = this.getPeerIP(socket);
+    const allowedIPs = this.options.allowedIPs ?? [];
+    const deniedIPs = this.options.deniedIPs ?? [];
+    if (!isIPAllowed(ip, allowedIPs, deniedIPs)) {
+      this.audit(ip, "BLOCKED", "IP not allowed");
+      this.log(chalk6.yellow(`Blocked IP: ${ip}`));
+      this.emitPeerEvent("blocked", ip);
+      socket.destroy();
       return;
     }
-    if (key.sequence && key.sequence.startsWith("\x1B[<")) {
-      handleSGRMouse(key.sequence);
+    if (!this.checkRateLimit(ip)) {
+      this.audit(ip, "RATE_LIMITED", "Too many auth attempts");
+      this.log(chalk6.yellow(`Rate limit exceeded for IP: ${ip}`));
+      this.emitPeerEvent("rate_limited", ip);
+      socket.destroy();
       return;
     }
-    switch (key.sequence) {
-      case "+":
-        state.interval += 1;
-        restartTicker();
-        setStatus(`Interval set to ${state.interval}s`);
-        return;
-      case "-":
-        state.interval = Math.max(1, state.interval - 1);
-        restartTicker();
-        setStatus(`Interval set to ${state.interval}s`);
+    const peer = {
+      socket,
+      authenticated: false,
+      intervalHandle: null,
+      pingHandle: null,
+      readBuffer: Buffer.alloc(0),
+      readExpectingHeader: true,
+      readMessageLength: 0,
+      ip,
+      pendingNonce: null
+    };
+    this.peers.set(socket, peer);
+    const remoteAddr = socket.remoteAddress ? `${socket.remoteAddress}:${socket.remotePort}` : "unknown";
+    this.log(chalk6.cyan(`Peer connected: ${remoteAddr}`));
+    this.audit(ip, "CONNECT", remoteAddr);
+    this.emitPeerEvent("connect", remoteAddr);
+    socket.on("data", (data) => this.onData(peer, data));
+    socket.on("close", () => this.onPeerClose(peer));
+    socket.on("error", (err) => this.onPeerError(peer, err));
+    socket.setTimeout(3e4);
+    socket.on("timeout", () => {
+      if (!peer.authenticated) {
+        this.disconnectPeer(peer, "Authentication timeout");
+      }
+    });
+    const nonce = generateNonce();
+    this.sendSigned(peer, signMessage("challenge", { nonce }, this.hmacKey));
+    peer.pendingNonce = nonce;
+  }
+  onData(peer, data) {
+    peer.readBuffer = Buffer.concat([peer.readBuffer, data]);
+    if (!peer.authenticated) {
+      const body = readMessageFromPeer(peer);
+      if (body) {
+        this.handleAuthMessage(peer, body);
+      }
+      return;
+    }
+  }
+  handleAuthMessage(peer, body) {
+    try {
+      const raw = body.toString("utf-8");
+      const msg = decodeMessage(body);
+      if (msg.kind !== "auth") {
+        peer.socket.write(signMessage("auth-fail", { ok: false, reason: "Expected auth message first" }, this.hmacKey));
+        this.disconnectPeer(peer, "Expected auth message");
+        this.emitPeerEvent("error", `Expected auth message from ${peer.ip}`);
         return;
-      case "/":
-        state.inputMode = "filter";
-        state.inputBuffer = state.processFilter;
-        render();
+      }
+      const authPayload = msg.payload;
+      if (!authPayload.passwordHash || !authPayload.nonce) {
+        peer.socket.write(signMessage("auth-fail", { ok: false, reason: "Invalid auth payload" }, this.hmacKey));
+        this.disconnectPeer(peer, "Invalid auth payload");
+        this.emitPeerEvent("error", `Invalid auth payload from ${peer.ip}`);
         return;
-      case "0":
-      case "1":
-      case "2":
-      case "3":
-      case "4":
-      case "5":
-      case "6":
-      case "7":
-      case "8":
-      case "9": {
-        const tabMap = {
-          "0": "disk",
-          "1": "cpu",
-          "2": "mem",
-          "3": "gpu",
-          "4": "power",
-          "5": "battery",
-          "6": "thermal",
-          "7": "network",
-          "8": "packets",
-          "9": "tasks"
-        };
-        const panelId = tabMap[key.sequence];
-        if (panelId) {
-          state.activePanel = state.activePanel === panelId ? "grid" : panelId;
-          setStatus(state.activePanel === "grid" ? "Grid view" : `${panelId} panel`);
-          render();
-        }
+      }
+      if (peer.pendingNonce && authPayload.nonce !== peer.pendingNonce) {
+        this.audit(peer.ip, "AUTH_FAIL", "Nonce mismatch");
+        peer.socket.write(signMessage("auth-fail", { ok: false, reason: "Invalid nonce" }, this.hmacKey));
+        this.disconnectPeer(peer, "Invalid nonce");
+        this.emitPeerEvent("error", `Invalid nonce from ${peer.ip}`);
         return;
       }
-      case "P": {
-        state.activePanel = state.activePanel === "process" ? "grid" : "process";
-        setStatus(state.activePanel === "grid" ? "Grid view" : "Process panel");
-        render();
+      const expectedHash = hashPassword(this.options.password, authPayload.nonce);
+      if (authPayload.passwordHash !== expectedHash) {
+        this.audit(peer.ip, "AUTH_FAIL", "Invalid password hash");
+        peer.socket.write(signMessage("auth-fail", { ok: false, reason: "Invalid password" }, this.hmacKey));
+        this.disconnectPeer(peer, "Authentication failed");
+        this.emitPeerEvent("error", `Invalid password from ${peer.ip}`);
         return;
       }
+      peer.authenticated = true;
+      this.cleanupRateLimit(peer.ip);
+      peer.pendingNonce = null;
+      peer.socket.write(signMessage("auth-ok", { ok: true }, this.hmacKey));
+      this.log(chalk6.green(`Peer authenticated: ${peer.socket.remoteAddress}`));
+      this.audit(peer.ip, "AUTH_OK", "Challenge-response successful");
+      this.emitPeerEvent("auth", peer.socket.remoteAddress ?? peer.ip);
+      this.startDataStream(peer);
+      this.startPing(peer);
+    } catch {
+      peer.socket.write(signMessage("auth-fail", { ok: false, reason: "Invalid message format" }, this.hmacKey));
+      this.disconnectPeer(peer, "Invalid message format");
     }
-    switch (key.name) {
-      case "q":
-        stopLive();
-        break;
-      case "left": {
-        const currentIdx = state.PANEL_TABS.findIndex((t) => t.id === state.activePanel);
-        if (currentIdx > 0) {
-          state.activePanel = state.PANEL_TABS[currentIdx - 1].id;
-        } else if (currentIdx === -1) {
-          state.activePanel = state.PANEL_TABS[state.PANEL_TABS.length - 1].id;
-        }
-        setStatus(`Panel: ${state.activePanel}`);
-        render();
-        break;
-      }
-      case "right": {
-        const currentIdx = state.PANEL_TABS.findIndex((t) => t.id === state.activePanel);
-        if (currentIdx < state.PANEL_TABS.length - 1) {
-          state.activePanel = state.PANEL_TABS[currentIdx + 1].id;
-        } else if (currentIdx === -1) {
-          state.activePanel = state.PANEL_TABS[0].id;
-        }
-        setStatus(`Panel: ${state.activePanel}`);
-        render();
-        break;
-      }
-      case "c":
-        state.inputMode = "customizer";
-        state.customizerIndex = 0;
-        render();
-        break;
-      case "p":
-        state.paused = !state.paused;
-        setStatus(state.paused ? "Paused" : "Resumed");
-        render();
-        break;
-      case "g":
-        state.showGraphs = !state.showGraphs;
-        render();
-        break;
-      case "b":
-        state.graphMode = state.graphMode === "spark" ? "bar" : "spark";
-        setStatus(`Graph mode: ${state.graphMode}`);
-        render();
-        break;
-      case "d":
-        state.detailed = !state.detailed;
-        setStatus(`Detailed sensor mode: ${state.detailed ? "on" : "off"}`);
-        break;
-      case "s":
-        const sortCycle = ["cpu", "mem", "pid", "user", "command", "state", "threads", "runtime"];
-        const curIdx = sortCycle.indexOf(state.sortMode);
-        state.sortMode = sortCycle[(curIdx + 1) % sortCycle.length];
-        setStatus(`Sorting by ${state.sortMode}`);
-        render();
-        break;
-      case "k":
-        state.inputMode = "kill";
-        state.inputBuffer = "";
-        render();
-        break;
-      case "S":
-        state.inputMode = "signal";
-        state.inputBuffer = "SIGTERM";
-        render();
-        break;
-      case "t":
-        state.treeView = !state.treeView;
-        setStatus(state.treeView ? "Tree view enabled" : "Flat view enabled");
-        render();
-        break;
-      case "e":
-        exportSnapshot();
-        render();
-        break;
-      case "l":
-        toggleLogging();
-        render();
-        break;
-      case "f":
-        state.exportFormat = state.exportFormat === "json" ? "csv" : state.exportFormat === "csv" ? "tsv" : "json";
-        setStatus(`Export format: ${state.exportFormat}`);
-        render();
-        break;
-      case "tab":
-        cycleTab(1);
-        break;
-      case "left":
-        cycleTab(-1);
-        break;
-      case "right":
-        cycleTab(1);
-        break;
-      default:
-        if (str && str.length === 1) {
-          const tabId = tabKeyToId(str);
-          if (tabId) {
-            state.activePanel = tabId;
-            setStatus(`Panel: ${tabId.toUpperCase()}`);
-            render();
-          }
-        }
+  }
+  sendSigned(peer, message) {
+    if (!peer.socket.destroyed) {
+      peer.socket.write(message);
     }
-  };
-  process.stdin.on("keypress", state.keypressHandler);
-  process.once("SIGINT", () => stopLive());
-}
-function tabKeyToId(str) {
-  const map = { "1": "cpu", "2": "mem", "3": "gpu", "4": "power", "5": "battery", "6": "thermal", "7": "network", "8": "packets", "9": "tasks", "0": "disk", "p": "process" };
-  return map[str] ?? null;
-}
-function cycleTab(direction) {
-  const tabs = state.PANEL_TABS.map((t) => t.id);
-  const current = state.activePanel === "grid" ? -1 : tabs.indexOf(state.activePanel);
-  const next = (current + direction + tabs.length) % tabs.length;
-  state.activePanel = tabs[next];
-  setStatus(`Panel: ${state.activePanel.toUpperCase()}`);
-  render();
-}
-function handleNormalMouse(seq) {
-  if (seq.length < 6) return;
-  const cb = seq.charCodeAt(3) - 32;
-  const cx = seq.charCodeAt(4) - 32;
-  const cy = seq.charCodeAt(5) - 32;
-  if (cb === 0 || cb === 1) {
-    handleMouseClick(cy, cx);
   }
-}
-function handleSGRMouse(seq) {
-  const match = seq.match(/^\x1b\[<(\d+);(\d+);(\d+)([Mm])/);
-  if (!match) return;
-  const button = parseInt(match[1]);
-  const cx = parseInt(match[2]);
-  const cy = parseInt(match[3]);
-  if (button === 0 || button === 1) {
-    handleMouseClick(cy, cx);
+  startDataStream(peer) {
+    const send = async () => {
+      if (!peer.authenticated || peer.socket.destroyed) return;
+      try {
+        const data = await collectAll({ detailed: this.options.detailed });
+        this.sendSigned(peer, signMessage("data", { stats: data }, this.hmacKey));
+      } catch {
+      }
+    };
+    send();
+    peer.intervalHandle = setInterval(send, this.options.intervalMs);
   }
-}
-function handleMouseClick(y, x) {
-  if (y !== TAB_BAR_ROW) return;
-  const hitboxes = getTabHitboxes();
-  const hit = hitboxes.find((h) => x >= h.start && x < h.end);
-  if (hit) {
-    state.activePanel = state.activePanel === hit.id ? "grid" : hit.id;
-    setStatus(state.activePanel === "grid" ? "Grid view" : `Panel: ${hit.id.toUpperCase()}`);
-    render();
+  startPing(peer) {
+    peer.pingHandle = setInterval(() => {
+      if (peer.socket.destroyed) return;
+      this.sendSigned(peer, signMessage("ping", { ts: Date.now() }, this.hmacKey));
+    }, 5e3);
   }
-}
-function stopLive() {
-  if (state.intervalHandle) {
-    clearInterval(state.intervalHandle);
-    state.intervalHandle = null;
+  onPeerClose(peer) {
+    this.cleanupPeer(peer);
+    this.log(chalk6.yellow(`Peer disconnected: ${peer.socket.remoteAddress}`));
+    this.emitPeerEvent("disconnect", peer.socket.remoteAddress ?? peer.ip);
+    this.audit(peer.ip, "DISCONNECT", "Peer closed connection");
   }
-  if (state.statusTimer) {
-    clearTimeout(state.statusTimer);
-    state.statusTimer = null;
+  onPeerError(peer, err) {
+    const code = err.code;
+    if (code === "ECONNRESET") {
+      this.log(chalk6.yellow(`Peer connection reset: ${peer.socket.remoteAddress}`));
+      this.audit(peer.ip, "ERROR", "Connection reset");
+      this.emitPeerEvent("error", `connection reset: ${peer.socket.remoteAddress}`);
+    } else {
+      this.log(chalk6.red(`Peer error: ${err.message}`));
+      this.audit(peer.ip, "ERROR", err.message);
+      this.emitPeerEvent("error", err.message);
+    }
+    this.cleanupPeer(peer);
   }
-  if (state.logStream) {
-    state.logStream.end();
-    state.logStream = null;
-  }
-  if (state.keypressHandler) {
-    process.stdin.removeListener("keypress", state.keypressHandler);
-    state.keypressHandler = null;
-  }
-  process.stdout.removeListener("resize", onResize);
-  state.running = false;
-  state.logging = false;
-  if (process.stdin.isTTY) process.stdin.setRawMode(false);
-  process.stdin.pause();
-  if (state.mouseEnabled) {
-    process.stdout.write("\x1B[?1000l");
+  disconnectPeer(peer, reason) {
+    try {
+      this.sendSigned(peer, signMessage("disconnect", { reason }, this.hmacKey));
+    } catch {
+    }
+    peer.socket.destroy();
   }
-  process.stdout.write("\x1B[?25h");
-  process.stdout.write("\x1B[?1049l");
-  process.stdout.write("\x1B[2J\x1B[H");
-  process.exit(0);
-}
-
-// src/splash.ts
-import chalk6 from "chalk";
-var MAXV = 36;
-var CHAR_RAMP = [" ", ".", "`", ",", ":", ";", "+", "*", "?", "%", "#", "@"];
-var palette = [
-  "#0a0505",
-  "#1a0806",
-  "#2a0b06",
-  "#3f1004",
-  "#591404",
-  "#791804",
-  "#9e1c04",
-  "#c92004",
-  "#d63004",
-  "#e34004",
-  "#f05004",
-  "#fd6004",
-  "#ff7004",
-  "#ff8004",
-  "#ff9004",
-  "#ffa004",
-  "#ffb004",
-  "#ffc004",
-  "#ffd004",
-  "#ffe004",
-  "#fff004",
-  "#fff820",
-  "#ffff40",
-  "#ffff60",
-  "#ffff80",
-  "#ffffa0",
-  "#ffffc0",
-  "#ffffe0",
-  "#ffffff",
-  "#ffffff",
-  "#ffffff",
-  "#ffffff",
-  "#ffffff",
-  "#ffffff",
-  "#ffffff",
-  "#ffffff"
-];
-function getRgb(hex) {
-  const r = parseInt(hex.slice(1, 3), 16);
-  const g = parseInt(hex.slice(3, 5), 16);
-  const b = parseInt(hex.slice(5, 7), 16);
-  return { r, g, b };
-}
-var rgbPalette = palette.map(getRgb);
-function getChar(val) {
-  const idx = Math.min(CHAR_RAMP.length - 1, Math.floor(val / (MAXV + 1) * CHAR_RAMP.length));
-  return CHAR_RAMP[idx];
-}
-async function showSplash() {
-  const cols = 60;
-  const rows = 15;
-  let fire = new Uint8Array(cols * rows);
-  process.stdout.write("\x1B[2J");
-  const termRows = process.stdout.rows || 24;
-  const termCols = process.stdout.columns || 80;
-  const startRow = Math.max(0, Math.floor((termRows - rows) / 2));
-  const startCol = Math.max(0, Math.floor((termCols - cols) / 2));
-  return new Promise((resolve) => {
-    const interval = setInterval(() => {
-      for (let x = 0; x < cols; x++) {
-        fire[(rows - 1) * cols + x] = MAXV - Math.floor(Math.random() * 4);
-      }
-      for (let y = rows - 1; y >= 1; y--) {
-        for (let x = 0; x < cols; x++) {
-          const src = y * cols + x;
-          const val = fire[src];
-          if (val === 0) {
-            fire[(y - 1) * cols + x] = 0;
-            continue;
-          }
-          const decay = Math.floor(Math.random() * 3);
-          const drift = Math.floor(Math.random() * 3) - 1;
-          let nx = x + drift;
-          if (nx < 0) nx = 0;
-          else if (nx >= cols) nx = cols - 1;
-          fire[(y - 1) * cols + nx] = Math.max(0, val - decay);
-        }
-      }
-      let output = "";
-      for (let i = 0; i < startRow; i++) output += "\n";
-      for (let y = 0; y < rows; y++) {
-        output += " ".repeat(startCol);
-        for (let x = 0; x < cols; x++) {
-          const v = fire[y * cols + x];
-          const color = rgbPalette[Math.min(v, rgbPalette.length - 1)];
-          output += chalk6.rgb(color.r, color.g, color.b)(getChar(v));
-        }
-        output += "\n";
-      }
-      output += " ".repeat(Math.max(0, startCol + (cols - 45) / 2)) + chalk6.bold.white("\u{1F525} pyre \u2014 system monitor (warming up sensors...)\n");
-      output += " ".repeat(Math.max(0, startCol + (cols - 25) / 2)) + chalk6.dim("[Press Enter to continue]");
-      process.stdout.write(`\x1B[H${output}`);
-    }, 65);
-    const onEnter = () => {
-      process.stdin.removeListener("data", onEnter);
-      clearInterval(interval);
-      process.stdout.write("\x1B[2J\x1B[H");
-      resolve();
-    };
-    process.stdin.setRawMode(true);
-    process.stdin.resume();
-    process.stdin.on("data", onEnter);
-    setTimeout(onEnter, 5e3);
-  });
-}
-
-// src/p2p/server.ts
-import net from "net";
-import chalk7 from "chalk";
-
-// src/p2p/protocol.ts
-var HEADER_SIZE = 4;
-var MAX_MESSAGE_SIZE = 16 * 1024 * 1024;
-function buildMessage(kind, payload) {
-  const envelope = { kind, payload };
-  const body = Buffer.from(JSON.stringify(envelope), "utf-8");
-  const header2 = Buffer.alloc(HEADER_SIZE);
-  header2.writeUInt32BE(body.length, 0);
-  return Buffer.concat([header2, body]);
-}
-function encodeAuth(password) {
-  return buildMessage("auth", { password });
-}
-function encodeAuthOk() {
-  return buildMessage("auth-ok", { ok: true });
-}
-function encodeAuthFail(reason) {
-  return buildMessage("auth-fail", { ok: false, reason });
-}
-function encodeData(stats) {
-  return buildMessage("data", { stats });
-}
-function encodePing() {
-  return buildMessage("ping", { ts: Date.now() });
-}
-function encodePong(ts) {
-  return buildMessage("pong", { ts });
-}
-function encodeDisconnect(reason) {
-  return buildMessage("disconnect", { reason });
-}
-
-// src/p2p/server.ts
-var HEADER_SIZE2 = 4;
-function readMessageFromPeer(peer) {
-  while (peer.readBuffer.length > 0) {
-    if (peer.readExpectingHeader) {
-      if (peer.readBuffer.length >= HEADER_SIZE2) {
-        peer.readMessageLength = peer.readBuffer.readUInt32BE(0);
-        peer.readBuffer = peer.readBuffer.subarray(HEADER_SIZE2);
-        peer.readExpectingHeader = false;
-      } else {
-        break;
-      }
+  cleanupPeer(peer) {
+    if (peer.intervalHandle) {
+      clearInterval(peer.intervalHandle);
+      peer.intervalHandle = null;
     }
-    if (!peer.readExpectingHeader) {
-      if (peer.readBuffer.length >= peer.readMessageLength) {
-        const body = peer.readBuffer.subarray(0, peer.readMessageLength);
-        peer.readBuffer = peer.readBuffer.subarray(peer.readMessageLength);
-        peer.readExpectingHeader = true;
-        return body;
-      } else {
-        break;
-      }
+    if (peer.pingHandle) {
+      clearInterval(peer.pingHandle);
+      peer.pingHandle = null;
     }
+    this.peers.delete(peer.socket);
   }
-  return null;
+};
+async function startP2PServer(options) {
+  const server = new P2PServer(options);
+  await server.start();
+  return server;
 }
-var P2PServer = class {
-  server = null;
-  peers = /* @__PURE__ */ new Map();
+
+// src/p2p/client.ts
+import net2 from "net";
+import tls2 from "tls";
+import fs3 from "fs";
+import crypto3 from "crypto";
+import chalk7 from "chalk";
+var P2PClient = class {
+  socket = null;
   options;
   running = false;
+  readState = { buffer: Buffer.alloc(0), expectingHeader: true, messageLength: 0 };
+  onDataCallback = null;
+  onStatusCallback = null;
+  reconnectTimer = null;
+  pingHandle = null;
+  pendingNonce = null;
+  auditStream = null;
+  hmacKey;
   constructor(options) {
     this.options = options;
+    this.hmacKey = deriveHMACKey2(options.password);
   }
-  get info() {
-    return {
-      host: this.options.host,
-      port: this.options.port,
-      peersConnected: this.peers.size
-    };
+  setOnData(cb) {
+    this.onDataCallback = cb;
   }
-  async start() {
+  setOnStatus(cb) {
+    this.onStatusCallback = cb;
+  }
+  async connect() {
+    if (this.options.auditLog) {
+      try {
+        fs3.mkdirSync(this.options.auditLog, { recursive: true });
+        const logFile = `${this.options.auditLog}/p2p-client-audit.log`;
+        this.auditStream = fs3.createWriteStream(logFile, { flags: "a" });
+      } catch {
+        console.log(chalk7.yellow("Warning: could not open audit log"));
+      }
+    }
     return new Promise((resolve, reject) => {
-      this.server = net.createServer((socket) => this.onConnection(socket));
-      this.server.on("error", (err) => reject(err));
-      this.server.listen(this.options.port, this.options.host, () => {
-        this.running = true;
-        const addr = this.server?.address();
-        const bound = addr ? typeof addr === "object" ? `${addr.address}:${addr.port}` : String(addr) : "unknown";
-        console.log(chalk7.green(`P2P server listening on ${bound}`));
-        console.log(chalk7.dim(`  Password: ${this.options.password}`));
-        console.log(chalk7.dim(`  Interval: ${this.options.intervalMs}ms`));
-        resolve();
-      });
+      const useTLS = !!this.options.tls;
+      if (useTLS) {
+        const tlsOptions = {
+          host: this.options.host,
+          port: this.options.port,
+          rejectUnauthorized: !this.options.tlsInsecure
+        };
+        if (this.options.tlsCA) {
+          tlsOptions.ca = fs3.readFileSync(this.options.tlsCA);
+        }
+        this.socket = tls2.connect(tlsOptions, () => {
+          this.status("Connecting...");
+        });
+      } else {
+        this.socket = new net2.Socket();
+        this.socket.on("data", (data) => this.onData(data));
+        this.socket.on("close", () => this.onClose());
+        this.socket.on("error", (err) => this.onError(err));
+        this.socket.on("timeout", () => this.onTimeout());
+        this.socket.setTimeout(1e4);
+        this.socket.connect(this.options.port, this.options.host, () => {
+          this.status("Connecting...");
+        });
+        this.socket.once("error", (err) => {
+          reject(err);
+        });
+      }
+      this.socket.on("data", (data) => this.onData(data));
+      this.socket.on("close", () => this.onClose());
+      this.socket.on("error", (err) => this.onError(err));
+      this.socket.on("timeout", () => this.onTimeout());
     });
   }
-  stop() {
+  disconnect() {
     this.running = false;
-    for (const peer of this.peers.values()) {
-      this.disconnectPeer(peer, "Server shutting down");
+    if (this.reconnectTimer) {
+      clearTimeout(this.reconnectTimer);
+      this.reconnectTimer = null;
     }
-    this.peers.clear();
-    if (this.server) {
-      this.server.close();
-      this.server = null;
-    }
-  }
-  onConnection(socket) {
-    const peer = {
-      socket,
-      authenticated: false,
-      intervalHandle: null,
-      pingHandle: null,
-      readBuffer: Buffer.alloc(0),
-      readExpectingHeader: true,
-      readMessageLength: 0
-    };
-    this.peers.set(socket, peer);
-    const remoteAddr = socket.remoteAddress ? `${socket.remoteAddress}:${socket.remotePort}` : "unknown";
-    console.log(chalk7.cyan(`Peer connected: ${remoteAddr}`));
-    socket.on("data", (data) => this.onData(peer, data));
-    socket.on("close", () => this.onPeerClose(peer));
-    socket.on("error", (err) => this.onPeerError(peer, err));
-    socket.setTimeout(3e4);
-    socket.on("timeout", () => {
-      if (!peer.authenticated) {
-        this.disconnectPeer(peer, "Authentication timeout");
-      }
-    });
-  }
-  onData(peer, data) {
-    peer.readBuffer = Buffer.concat([peer.readBuffer, data]);
-    if (!peer.authenticated) {
-      const body = readMessageFromPeer(peer);
-      if (body) {
-        this.handleAuthMessage(peer, body);
-      }
-      return;
-    }
-  }
-  handleAuthMessage(peer, body) {
-    try {
-      const msg = JSON.parse(body.toString("utf-8"));
-      if (msg.kind === "auth" && typeof msg.payload?.password === "string") {
-        if (msg.payload.password === this.options.password) {
-          peer.authenticated = true;
-          peer.socket.write(encodeAuthOk());
-          console.log(chalk7.green(`Peer authenticated: ${peer.socket.remoteAddress}`));
-          this.startDataStream(peer);
-          this.startPing(peer);
-        } else {
-          peer.socket.write(encodeAuthFail("Invalid password"));
-          this.disconnectPeer(peer, "Authentication failed");
-        }
-      } else {
-        peer.socket.write(encodeAuthFail("Expected auth message first"));
-        this.disconnectPeer(peer, "Expected auth message");
-      }
-    } catch {
-      peer.socket.write(encodeAuthFail("Invalid message format"));
-      this.disconnectPeer(peer, "Invalid message format");
-    }
-  }
-  startDataStream(peer) {
-    const send = async () => {
-      if (!peer.authenticated || peer.socket.destroyed) return;
-      try {
-        const data = await collectAll({ detailed: this.options.detailed });
-        peer.socket.write(encodeData(data));
-      } catch {
-      }
-    };
-    send();
-    peer.intervalHandle = setInterval(send, this.options.intervalMs);
-  }
-  startPing(peer) {
-    peer.pingHandle = setInterval(() => {
-      if (peer.socket.destroyed) return;
-      peer.socket.write(encodePing());
-    }, 5e3);
-  }
-  onPeerClose(peer) {
-    this.cleanupPeer(peer);
-    console.log(chalk7.yellow(`Peer disconnected: ${peer.socket.remoteAddress}`));
-  }
-  onPeerError(peer, err) {
-    const code = err.code;
-    if (code === "ECONNRESET") {
-      console.log(chalk7.yellow(`Peer connection reset: ${peer.socket.remoteAddress}`));
-    } else {
-      console.log(chalk7.red(`Peer error: ${err.message}`));
-    }
-    this.cleanupPeer(peer);
-  }
-  disconnectPeer(peer, reason) {
-    try {
-      peer.socket.write(encodeDisconnect(reason));
-    } catch {
-    }
-    peer.socket.destroy();
-  }
-  cleanupPeer(peer) {
-    if (peer.intervalHandle) {
-      clearInterval(peer.intervalHandle);
-      peer.intervalHandle = null;
-    }
-    if (peer.pingHandle) {
-      clearInterval(peer.pingHandle);
-      peer.pingHandle = null;
-    }
-    this.peers.delete(peer.socket);
-  }
-};
-
-// src/p2p/client.ts
-import net2 from "net";
-var P2PClient = class {
-  socket = null;
-  options;
-  running = false;
-  readState = { buffer: Buffer.alloc(0), expectingHeader: true, messageLength: 0 };
-  onDataCallback = null;
-  onStatusCallback = null;
-  reconnectTimer = null;
-  pingHandle = null;
-  constructor(options) {
-    this.options = options;
-  }
-  setOnData(cb) {
-    this.onDataCallback = cb;
-  }
-  setOnStatus(cb) {
-    this.onStatusCallback = cb;
-  }
-  async connect() {
-    return new Promise((resolve, reject) => {
-      this.socket = new net2.Socket();
-      this.socket.on("data", (data) => this.onData(data));
-      this.socket.on("close", () => this.onClose());
-      this.socket.on("error", (err) => this.onError(err));
-      this.socket.on("timeout", () => this.onTimeout());
-      this.socket.setTimeout(1e4);
-      this.socket.connect(this.options.port, this.options.host, () => {
-        this.running = true;
-        this.socket?.setTimeout(0);
-        this.socket?.write(encodeAuth(this.options.password));
-        this.status("Connecting...");
-        resolve();
-      });
-      this.socket.once("error", (err) => {
-        reject(err);
-      });
-    });
-  }
-  disconnect() {
-    this.running = false;
-    if (this.reconnectTimer) {
-      clearTimeout(this.reconnectTimer);
-      this.reconnectTimer = null;
-    }
-    if (this.pingHandle) {
-      clearInterval(this.pingHandle);
-      this.pingHandle = null;
+    if (this.pingHandle) {
+      clearInterval(this.pingHandle);
+      this.pingHandle = null;
     }
     if (this.socket) {
       try {
-        this.socket.write(encodeDisconnect("Client closing"));
+        this.sendSigned(encodeDisconnect("Client closing"));
       } catch {
       }
       this.socket.destroy();
       this.socket = null;
     }
+    if (this.auditStream) {
+      this.auditStream.end();
+      this.auditStream = null;
+    }
     this.status("Disconnected");
   }
   onData(data) {
@@ -2465,84 +2236,719 @@ var P2PClient = class {
         } else {
           break;
         }
-      }
+      }
+    }
+  }
+  handleMessage(body) {
+    try {
+      const raw = body.toString("utf-8");
+      const msg = decodeMessage(body);
+      if (!verifyHMAC(raw, msg.hmac ?? "", this.hmacKey)) {
+        this.status("Message integrity check failed");
+        return;
+      }
+      switch (msg.kind) {
+        case "challenge":
+          const challengePayload = msg.payload;
+          if (challengePayload.nonce) {
+            this.pendingNonce = challengePayload.nonce;
+            const passwordHash = hashPassword(this.options.password, challengePayload.nonce);
+            this.sendSigned(signMessage("auth", { passwordHash, nonce: challengePayload.nonce }, this.hmacKey));
+            this.status("Authenticating...");
+          }
+          break;
+        case "auth-ok":
+          this.status("Authenticated \u2014 receiving live data");
+          this.startPing();
+          break;
+        case "auth-fail":
+          const failPayload = msg.payload;
+          this.status(`Authentication failed: ${failPayload.reason || "unknown"}`);
+          this.disconnect();
+          break;
+        case "data":
+          if (this.onDataCallback) {
+            const dataPayload = msg.payload;
+            if (dataPayload.stats) {
+              this.onDataCallback(dataPayload.stats);
+            }
+          }
+          break;
+        case "ping":
+          if (this.socket && !this.socket.destroyed) {
+            const ts = msg.payload.ts;
+            this.sendSigned(signMessage("pong", { ts }, this.hmacKey));
+          }
+          break;
+        case "pong":
+          break;
+        case "disconnect":
+          const disconnectPayload = msg.payload;
+          this.status(`Server disconnected: ${disconnectPayload.reason || "unknown"}`);
+          this.disconnect();
+          break;
+        default:
+          break;
+      }
+    } catch {
+    }
+  }
+  sendSigned(message) {
+    if (this.socket && !this.socket.destroyed) {
+      this.socket.write(message);
+    }
+  }
+  startPing() {
+    this.pingHandle = setInterval(() => {
+      if (this.socket && !this.socket.destroyed) {
+        this.sendSigned(signMessage("ping", { ts: Date.now() }, this.hmacKey));
+      }
+    }, 15e3);
+  }
+  onClose() {
+    if (this.running) {
+      this.status("Connection closed \u2014 reconnecting in 3s");
+      this.reconnectTimer = setTimeout(() => {
+        if (this.running) this.connect().catch(() => {
+        });
+      }, 3e3);
+    }
+  }
+  onError(err) {
+    const code = err.code;
+    if (code === "ECONNREFUSED") {
+      this.status("Connection refused \u2014 is the server running?");
+    } else if (code === "ETIMEDOUT") {
+      this.status("Connection timed out");
+    } else if (code === "UNABLE_TO_VERIFY_LEAF_SIGNATURE") {
+      this.status("TLS certificate verification failed \u2014 use --p2p-insecure to skip");
+    } else {
+      this.status(`Connection error: ${err.message}`);
+    }
+  }
+  onTimeout() {
+    this.status("Connection timed out");
+    this.disconnect();
+  }
+  status(msg) {
+    if (this.onStatusCallback) {
+      this.onStatusCallback(msg);
+    }
+  }
+  audit(event, detail) {
+    if (!this.auditStream) return;
+    const ts = (/* @__PURE__ */ new Date()).toISOString();
+    const ip = this.options.host;
+    this.auditStream.write(`${ts} ${ip} ${event} ${detail}
+`);
+  }
+};
+function deriveHMACKey2(password) {
+  return crypto3.createHash("sha256").update(password).digest("hex").slice(0, 32);
+}
+
+// src/live/input.ts
+function handleInputModeKey(str, key) {
+  if (key.name === "escape") {
+    state.inputMode = null;
+    state.inputBuffer = "";
+    render();
+    return;
+  }
+  if (state.inputMode === "customizer") {
+    const themesList = Object.keys(THEMES);
+    if (key.name === "up" || str === "k") {
+      state.customizerIndex = (state.customizerIndex - 1 + state.CUSTOMIZER_OPTIONS.length) % state.CUSTOMIZER_OPTIONS.length;
+    } else if (key.name === "down" || str === "j") {
+      state.customizerIndex = (state.customizerIndex + 1) % state.CUSTOMIZER_OPTIONS.length;
+    } else if (key.name === "return" || str === " ") {
+      const selected = state.CUSTOMIZER_OPTIONS[state.customizerIndex];
+      if (selected === "Theme") {
+        const nextIdx = (themesList.indexOf(state.currentTheme) + 1) % themesList.length;
+        state.currentTheme = themesList[nextIdx];
+      } else if (selected === "Toggle Tree View") {
+        state.treeView = !state.treeView;
+      } else if (selected === "Graph Mode") {
+        state.graphMode = state.graphMode === "spark" ? "bar" : "spark";
+      } else {
+        const itemKey = selected.replace("Toggle ", "").toLowerCase();
+        state.visiblePanels[itemKey] = !state.visiblePanels[itemKey];
+      }
+    }
+    render();
+    return;
+  }
+  if (state.inputMode === "signal") {
+    if (key.name === "up" || str === "k") {
+      const idx = state.SIGNAL_OPTIONS.indexOf(state.inputBuffer);
+      state.inputBuffer = state.SIGNAL_OPTIONS[(idx - 1 + state.SIGNAL_OPTIONS.length) % state.SIGNAL_OPTIONS.length];
+    } else if (key.name === "down" || str === "j") {
+      const idx = state.SIGNAL_OPTIONS.indexOf(state.inputBuffer);
+      state.inputBuffer = state.SIGNAL_OPTIONS[(idx + 1) % state.SIGNAL_OPTIONS.length];
+    } else if (key.name === "return" || str === " ") {
+      killProcess(state.inputBuffer.trim(), state.inputBuffer.trim());
+      state.inputMode = null;
+      state.inputBuffer = "";
+      render();
+      return;
+    }
+    render();
+    return;
+  }
+  if (state.inputMode === "p2p") {
+    if (key.name === "escape") {
+      state.inputMode = null;
+      state.inputBuffer = "";
+      render();
+      return;
+    }
+    if (key.name === "return") {
+      const password = state.inputBuffer.trim();
+      if (password) {
+        state.p2pPassword = password;
+        startP2PServerFromTUI();
+      }
+      state.inputMode = null;
+      state.inputBuffer = "";
+      render();
+      return;
+    }
+    if (key.name === "backspace") {
+      state.inputBuffer = state.inputBuffer.slice(0, -1);
+      render();
+      return;
+    }
+    if (str && str.length === 1 && !key.ctrl && !key.meta) {
+      state.inputBuffer += str;
+      render();
+    }
+    return;
+  }
+  if (key.name === "return") {
+    if (state.inputMode === "filter") {
+      state.processFilter = state.inputBuffer.trim();
+      setStatus(state.processFilter ? `Filtering: "${state.processFilter}"` : "Filter cleared");
+    } else if (state.inputMode === "kill") {
+      killProcess(state.inputBuffer.trim());
+    }
+    state.inputMode = null;
+    state.inputBuffer = "";
+    render();
+    return;
+  }
+  if (key.name === "backspace") {
+    state.inputBuffer = state.inputBuffer.slice(0, -1);
+    render();
+    return;
+  }
+  if (str && str.length === 1 && !key.ctrl && !key.meta) {
+    state.inputBuffer += str;
+    render();
+  }
+}
+function killProcess(pidStr, signal = "SIGTERM") {
+  const pid = parseInt(pidStr, 10);
+  if (!pid || pid <= 0) {
+    setStatus(`Invalid PID: ${pidStr}`);
+    return;
+  }
+  try {
+    process.kill(pid, signal);
+    setStatus(`Sent ${signal} to PID ${pid}`);
+  } catch (err) {
+    setStatus(`Failed to send ${signal} to ${pid}: ${err.message}`);
+  }
+}
+async function startP2PServerFromTUI() {
+  if (state.p2pServerRunning) return;
+  try {
+    const server = await startP2PServer({
+      host: "0.0.0.0",
+      port: state.p2pPort,
+      password: state.p2pPassword,
+      intervalMs: state.interval * 1e3,
+      detailed: state.detailed,
+      onLog: (msg) => setStatus(msg, 5e3),
+      onPeerEvent: (evt) => {
+        state.p2pEvents.push(evt);
+        if (state.p2pEvents.length > 200) state.p2pEvents.shift();
+      }
+    });
+    state.p2pServer = server;
+    state.p2pServerRunning = true;
+    state.p2pBind = server.boundAddress || "0.0.0.0";
+    state.p2pEvents = [];
+    setStatus(`P2P server started on ${state.p2pBind}:${state.p2pPort}`);
+    render();
+  } catch (err) {
+    setStatus(`P2P server failed: ${err.message}`);
+    state.p2pServerRunning = false;
+    state.p2pServer = null;
+    state.p2pBind = "";
+    render();
+  }
+}
+function syncP2PEvents() {
+  if (!state.p2pServer) return;
+  const history = state.p2pServer.peerEventHistory;
+  if (history && history !== state.p2pEvents) {
+    state.p2pEvents = history;
+  }
+}
+function stopP2PServer() {
+  if (!state.p2pServer) return;
+  try {
+    state.p2pServer.stop();
+  } catch {
+  }
+  state.p2pServer = null;
+  state.p2pServerRunning = false;
+  setStatus("P2P server stopped");
+}
+function onResize() {
+  state.termWidth = process.stdout.columns || 80;
+  state.termHeight = process.stdout.rows || 24;
+  state.history.setMaxLen(Math.max(20, Math.min(200, state.termWidth - 30)));
+  render();
+}
+function restartTicker() {
+  if (state.intervalHandle) clearInterval(state.intervalHandle);
+  state.intervalHandle = setInterval(tick, state.interval * 1e3);
+}
+async function tick() {
+  if (state.paused) return;
+  try {
+    const data = await collectAll({ detailed: state.detailed, processLimit: processRowBudget() });
+    state.lastData = data;
+    const temp = data.cpu.temperature ?? data.thermal.temperatures?.cpu_die ?? null;
+    state.history.push({
+      cpuUsage: data.cpu.usage,
+      memUsage: data.memory.usagePercent,
+      temp,
+      rxBytes: data.network.rxBytes,
+      txBytes: data.network.txBytes,
+      gpuUtil: data.gpu?.utilization,
+      powerWatts: data.power?.combinedWatts ?? data.power?.cpuWatts ?? 0,
+      rxPackets: data.network.rxPackets,
+      txPackets: data.network.txPackets,
+      connections: data.network.connections ?? 0
+    });
+    writeLogRow(data);
+    checkAlerts(data);
+    syncP2PEvents();
+    render();
+  } catch {
+  }
+}
+async function startLive(opts2) {
+  if (state.running) return;
+  state.running = true;
+  state.paused = false;
+  state.detailed = !!opts2.detailed;
+  state.interval = opts2.interval;
+  if (opts2.exportDir) state.exportDir = opts2.exportDir;
+  state.termWidth = process.stdout.columns || 80;
+  state.termHeight = process.stdout.rows || 24;
+  state.history.reset();
+  state.history.setMaxLen(Math.max(20, Math.min(200, state.termWidth - 30)));
+  process.stdout.write("\x1B[?1049h");
+  process.stdout.write("\x1B[?25l");
+  process.stdout.write("\x1B[2J\x1B[H");
+  process.title = "pyre";
+  if (state.mouseEnabled) {
+    process.stdout.write("\x1B[?1000h");
+  }
+  await tick();
+  restartTicker();
+  if (opts2.autoLog) startLogging();
+  readline.emitKeypressEvents(process.stdin);
+  if (process.stdin.isTTY) process.stdin.setRawMode(true);
+  process.stdin.resume();
+  process.stdout.on("resize", onResize);
+  state.keypressHandler = (str, key) => {
+    if (!key) return;
+    if (key.ctrl && key.name === "c") {
+      stopLive();
+      return;
+    }
+    if (state.inputMode) {
+      handleInputModeKey(str, key);
+      return;
+    }
+    if (key.mouse) {
+      handleMouseClick(key.mouse);
+      return;
+    }
+    if (key.sequence && key.sequence.startsWith("\x1B[M")) {
+      handleNormalMouse(key.sequence);
+      return;
+    }
+    if (key.sequence && key.sequence.startsWith("\x1B[<")) {
+      handleSGRMouse(key.sequence);
+      return;
+    }
+    switch (key.sequence) {
+      case "+":
+        state.interval += 1;
+        restartTicker();
+        setStatus(`Interval set to ${state.interval}s`);
+        return;
+      case "-":
+        state.interval = Math.max(1, state.interval - 1);
+        restartTicker();
+        setStatus(`Interval set to ${state.interval}s`);
+        return;
+      case "/":
+        state.inputMode = "filter";
+        state.inputBuffer = state.processFilter;
+        render();
+        return;
+      case "0":
+      case "1":
+      case "2":
+      case "3":
+      case "4":
+      case "5":
+      case "6":
+      case "7":
+      case "8":
+      case "9": {
+        const tabMap = {
+          "0": "disk",
+          "1": "cpu",
+          "2": "mem",
+          "3": "gpu",
+          "4": "power",
+          "5": "battery",
+          "6": "thermal",
+          "7": "network",
+          "8": "packets",
+          "9": "tasks"
+        };
+        const panelId = tabMap[key.sequence];
+        if (panelId) {
+          state.activePanel = state.activePanel === panelId ? "grid" : panelId;
+          setStatus(state.activePanel === "grid" ? "Grid view" : `${panelId} panel`);
+          render();
+        }
+        return;
+      }
+      case "P": {
+        state.activePanel = state.activePanel === "process" ? "grid" : "process";
+        setStatus(state.activePanel === "grid" ? "Grid view" : "Process panel");
+        render();
+        return;
+      }
+    }
+    switch (key.name) {
+      case "r":
+        if (state.p2pServerRunning) {
+          stopP2PServer();
+          setStatus("P2P server stopped");
+          render();
+        } else {
+          state.inputMode = "p2p";
+          state.inputBuffer = state.p2pPassword;
+          render();
+        }
+        return;
+      case "q":
+        stopLive();
+        break;
+      case "left": {
+        const currentIdx = state.PANEL_TABS.findIndex((t) => t.id === state.activePanel);
+        if (currentIdx > 0) {
+          state.activePanel = state.PANEL_TABS[currentIdx - 1].id;
+        } else if (currentIdx === -1) {
+          state.activePanel = state.PANEL_TABS[state.PANEL_TABS.length - 1].id;
+        }
+        setStatus(`Panel: ${state.activePanel}`);
+        render();
+        break;
+      }
+      case "right": {
+        const currentIdx = state.PANEL_TABS.findIndex((t) => t.id === state.activePanel);
+        if (currentIdx < state.PANEL_TABS.length - 1) {
+          state.activePanel = state.PANEL_TABS[currentIdx + 1].id;
+        } else if (currentIdx === -1) {
+          state.activePanel = state.PANEL_TABS[0].id;
+        }
+        setStatus(`Panel: ${state.activePanel}`);
+        render();
+        break;
+      }
+      case "c":
+        state.inputMode = "customizer";
+        state.customizerIndex = 0;
+        render();
+        break;
+      case "p":
+        state.paused = !state.paused;
+        setStatus(state.paused ? "Paused" : "Resumed");
+        render();
+        break;
+      case "g":
+        state.showGraphs = !state.showGraphs;
+        render();
+        break;
+      case "b":
+        state.graphMode = state.graphMode === "spark" ? "bar" : "spark";
+        setStatus(`Graph mode: ${state.graphMode}`);
+        render();
+        break;
+      case "d":
+        state.detailed = !state.detailed;
+        setStatus(`Detailed sensor mode: ${state.detailed ? "on" : "off"}`);
+        break;
+      case "s":
+        const sortCycle = ["cpu", "mem", "pid", "user", "command", "state", "threads", "runtime"];
+        const curIdx = sortCycle.indexOf(state.sortMode);
+        state.sortMode = sortCycle[(curIdx + 1) % sortCycle.length];
+        setStatus(`Sorting by ${state.sortMode}`);
+        render();
+        break;
+      case "k":
+        state.inputMode = "kill";
+        state.inputBuffer = "";
+        render();
+        break;
+      case "S":
+        state.inputMode = "signal";
+        state.inputBuffer = "SIGTERM";
+        render();
+        break;
+      case "t":
+        state.treeView = !state.treeView;
+        setStatus(state.treeView ? "Tree view enabled" : "Flat view enabled");
+        render();
+        break;
+      case "e":
+        exportSnapshot();
+        render();
+        break;
+      case "l":
+        toggleLogging();
+        render();
+        break;
+      case "f":
+        state.exportFormat = state.exportFormat === "json" ? "csv" : state.exportFormat === "csv" ? "tsv" : "json";
+        setStatus(`Export format: ${state.exportFormat}`);
+        render();
+        break;
+      case "tab":
+        cycleTab(1);
+        break;
+      case "left":
+        cycleTab(-1);
+        break;
+      case "right":
+        cycleTab(1);
+        break;
+      default:
+        if (str && str.length === 1) {
+          const tabId = tabKeyToId(str);
+          if (tabId) {
+            state.activePanel = tabId;
+            setStatus(`Panel: ${tabId.toUpperCase()}`);
+            render();
+          }
+        }
     }
+  };
+  process.stdin.on("keypress", state.keypressHandler);
+  process.once("SIGINT", () => stopLive());
+}
+function tabKeyToId(str) {
+  const map = { "1": "cpu", "2": "mem", "3": "gpu", "4": "power", "5": "battery", "6": "thermal", "7": "network", "8": "packets", "9": "tasks", "0": "disk", "p": "process", "r": "p2p" };
+  return map[str] ?? null;
+}
+function cycleTab(direction) {
+  const tabs = state.PANEL_TABS.map((t) => t.id);
+  const current = state.activePanel === "grid" ? -1 : tabs.indexOf(state.activePanel);
+  const next = (current + direction + tabs.length) % tabs.length;
+  state.activePanel = tabs[next];
+  setStatus(`Panel: ${state.activePanel.toUpperCase()}`);
+  render();
+}
+function handleNormalMouse(seq) {
+  if (seq.length < 6) return;
+  const cb = seq.charCodeAt(3) - 32;
+  const cx = seq.charCodeAt(4) - 32;
+  const cy = seq.charCodeAt(5) - 32;
+  if (cb === 0 || cb === 1) {
+    handleMouseClick(cy, cx);
   }
-  handleMessage(body) {
-    try {
-      const msg = JSON.parse(body.toString("utf-8"));
-      switch (msg.kind) {
-        case "auth-ok":
-          this.status("Authenticated \u2014 receiving live data");
-          this.startPing();
-          break;
-        case "auth-fail":
-          this.status(`Authentication failed: ${msg.payload.reason}`);
-          this.disconnect();
-          break;
-        case "data":
-          if (this.onDataCallback && msg.payload?.stats) {
-            this.onDataCallback(msg.payload.stats);
-          }
-          break;
-        case "ping":
-          if (this.socket && !this.socket.destroyed) {
-            const ts = msg.payload.ts;
-            this.socket.write(encodePong(ts));
-          }
-          break;
-        case "pong":
-          break;
-        case "disconnect":
-          this.status(`Server disconnected: ${msg.payload.reason}`);
-          this.disconnect();
-          break;
-        default:
-          break;
-      }
-    } catch {
-    }
+}
+function handleSGRMouse(seq) {
+  const match = seq.match(/^\x1b\[<(\d+);(\d+);(\d+)([Mm])/);
+  if (!match) return;
+  const button = parseInt(match[1]);
+  const cx = parseInt(match[2]);
+  const cy = parseInt(match[3]);
+  if (button === 0 || button === 1) {
+    handleMouseClick(cy, cx);
   }
-  startPing() {
-    this.pingHandle = setInterval(() => {
-      if (this.socket && !this.socket.destroyed) {
-        this.socket.write(encodePing());
-      }
-    }, 15e3);
+}
+function handleMouseClick(y, x) {
+  if (y !== TAB_BAR_ROW) return;
+  const hitboxes = getTabHitboxes();
+  const hit = hitboxes.find((h) => x >= h.start && x < h.end);
+  if (hit) {
+    state.activePanel = state.activePanel === hit.id ? "grid" : hit.id;
+    setStatus(state.activePanel === "grid" ? "Grid view" : `Panel: ${hit.id.toUpperCase()}`);
+    render();
   }
-  onClose() {
-    if (this.running) {
-      this.status("Connection closed \u2014 reconnecting in 3s");
-      this.reconnectTimer = setTimeout(() => {
-        if (this.running) this.connect().catch(() => {
-        });
-      }, 3e3);
-    }
+}
+function stopLive() {
+  if (state.intervalHandle) {
+    clearInterval(state.intervalHandle);
+    state.intervalHandle = null;
   }
-  onError(err) {
-    const code = err.code;
-    if (code === "ECONNREFUSED") {
-      this.status("Connection refused \u2014 is the server running?");
-    } else if (code === "ETIMEDOUT") {
-      this.status("Connection timed out");
-    } else {
-      this.status(`Connection error: ${err.message}`);
-    }
+  if (state.statusTimer) {
+    clearTimeout(state.statusTimer);
+    state.statusTimer = null;
   }
-  onTimeout() {
-    this.status("Connection timed out");
-    this.disconnect();
+  if (state.logStream) {
+    state.logStream.end();
+    state.logStream = null;
   }
-  status(msg) {
-    if (this.onStatusCallback) {
-      this.onStatusCallback(msg);
-    }
+  if (state.p2pServer) {
+    state.p2pServer.stop();
+    state.p2pServer = null;
+    state.p2pServerRunning = false;
   }
-};
+  if (state.keypressHandler) {
+    process.stdin.removeListener("keypress", state.keypressHandler);
+    state.keypressHandler = null;
+  }
+  process.stdout.removeListener("resize", onResize);
+  state.running = false;
+  state.logging = false;
+  if (process.stdin.isTTY) process.stdin.setRawMode(false);
+  process.stdin.pause();
+  if (state.mouseEnabled) {
+    process.stdout.write("\x1B[?1000l");
+  }
+  process.stdout.write("\x1B[?25h");
+  process.stdout.write("\x1B[?1049l");
+  process.stdout.write("\x1B[2J\x1B[H");
+  process.exit(0);
+}
+
+// src/splash.ts
+import chalk8 from "chalk";
+var MAXV = 36;
+var CHAR_RAMP = [" ", ".", "`", ",", ":", ";", "+", "*", "?", "%", "#", "@"];
+var palette = [
+  "#0a0505",
+  "#1a0806",
+  "#2a0b06",
+  "#3f1004",
+  "#591404",
+  "#791804",
+  "#9e1c04",
+  "#c92004",
+  "#d63004",
+  "#e34004",
+  "#f05004",
+  "#fd6004",
+  "#ff7004",
+  "#ff8004",
+  "#ff9004",
+  "#ffa004",
+  "#ffb004",
+  "#ffc004",
+  "#ffd004",
+  "#ffe004",
+  "#fff004",
+  "#fff820",
+  "#ffff40",
+  "#ffff60",
+  "#ffff80",
+  "#ffffa0",
+  "#ffffc0",
+  "#ffffe0",
+  "#ffffff",
+  "#ffffff",
+  "#ffffff",
+  "#ffffff",
+  "#ffffff",
+  "#ffffff",
+  "#ffffff",
+  "#ffffff"
+];
+function getRgb(hex) {
+  const r = parseInt(hex.slice(1, 3), 16);
+  const g = parseInt(hex.slice(3, 5), 16);
+  const b = parseInt(hex.slice(5, 7), 16);
+  return { r, g, b };
+}
+var rgbPalette = palette.map(getRgb);
+function getChar(val) {
+  const idx = Math.min(CHAR_RAMP.length - 1, Math.floor(val / (MAXV + 1) * CHAR_RAMP.length));
+  return CHAR_RAMP[idx];
+}
+async function showSplash() {
+  const cols = 60;
+  const rows = 15;
+  let fire = new Uint8Array(cols * rows);
+  process.stdout.write("\x1B[2J");
+  const termRows = process.stdout.rows || 24;
+  const termCols = process.stdout.columns || 80;
+  const startRow = Math.max(0, Math.floor((termRows - rows) / 2));
+  const startCol = Math.max(0, Math.floor((termCols - cols) / 2));
+  return new Promise((resolve) => {
+    const interval = setInterval(() => {
+      for (let x = 0; x < cols; x++) {
+        fire[(rows - 1) * cols + x] = MAXV - Math.floor(Math.random() * 4);
+      }
+      for (let y = rows - 1; y >= 1; y--) {
+        for (let x = 0; x < cols; x++) {
+          const src = y * cols + x;
+          const val = fire[src];
+          if (val === 0) {
+            fire[(y - 1) * cols + x] = 0;
+            continue;
+          }
+          const decay = Math.floor(Math.random() * 3);
+          const drift = Math.floor(Math.random() * 3) - 1;
+          let nx = x + drift;
+          if (nx < 0) nx = 0;
+          else if (nx >= cols) nx = cols - 1;
+          fire[(y - 1) * cols + nx] = Math.max(0, val - decay);
+        }
+      }
+      let output = "";
+      for (let i = 0; i < startRow; i++) output += "\n";
+      for (let y = 0; y < rows; y++) {
+        output += " ".repeat(startCol);
+        for (let x = 0; x < cols; x++) {
+          const v = fire[y * cols + x];
+          const color = rgbPalette[Math.min(v, rgbPalette.length - 1)];
+          output += chalk8.rgb(color.r, color.g, color.b)(getChar(v));
+        }
+        output += "\n";
+      }
+      output += " ".repeat(Math.max(0, startCol + (cols - 45) / 2)) + chalk8.bold.white("\u{1F525} pyre \u2014 system monitor (warming up sensors...)\n");
+      output += " ".repeat(Math.max(0, startCol + (cols - 25) / 2)) + chalk8.dim("[Press Enter to continue]");
+      process.stdout.write(`\x1B[H${output}`);
+    }, 65);
+    const onEnter = () => {
+      process.stdin.removeListener("data", onEnter);
+      clearInterval(interval);
+      process.stdout.write("\x1B[2J\x1B[H");
+      resolve();
+    };
+    process.stdin.setRawMode(true);
+    process.stdin.resume();
+    process.stdin.on("data", onEnter);
+    setTimeout(onEnter, 5e3);
+  });
+}
 
 // src/index.ts
 var program = new Command();
-program.name("pyre").version("2.0.0").description("Mac system monitoring CLI: interactive live dashboard, stats, graphs, export, packet monitor, battery predictor").option("-j, --json", "Output as JSON").option("-c, --csv", "Output as CSV").option("-t, --tsv", "Output as TSV").option("--detailed", "Include detailed system info and sensor readings").option("--interval <seconds>", "Refresh interval for live mode", "2").option("--once", "Show a single static snapshot instead of live feed").option("--out <file>", "Also write the snapshot output to a file (--once/--json/--csv/--tsv modes)").option("--export-dir <dir>", "Directory used for live-mode snapshot exports and logs", "./pyre-exports").option("--log", "Start continuous CSV logging immediately when live mode starts").option("--tree", "Show process tree view instead of flat list").option("--sort <key>", "Sort processes by: cpu, mem, pid, user, command, state, threads, runtime", "cpu").option("--packets", "Include packet monitor panel in output").option("--limit <n>", "Max number of processes to include in --once/--json/--csv/--tsv snapshots (0 = all)", "10").option("--p2p-host <host>", "P2P host address (server: bind address, client: server address)", "0.0.0.0").option("--p2p-port <port>", "P2P port number", "9876").option("--p2p-password <password>", "Password for P2P authentication");
+program.name("pyre").version("2.0.0").description("Mac system monitoring CLI: interactive live dashboard, stats, graphs, export, packet monitor, battery predictor").option("-j, --json", "Output as JSON").option("-c, --csv", "Output as CSV").option("-t, --tsv", "Output as TSV").option("--detailed", "Include detailed system info and sensor readings").option("--interval <seconds>", "Refresh interval for live mode", "2").option("--once", "Show a single static snapshot instead of live feed").option("--out <file>", "Also write the snapshot output to a file (--once/--json/--csv/--tsv modes)").option("--export-dir <dir>", "Directory used for live-mode snapshot exports and logs", "./pyre-exports").option("--log", "Start continuous CSV logging immediately when live mode starts").option("--tree", "Show process tree view instead of flat list").option("--sort <key>", "Sort processes by: cpu, mem, pid, user, command, state, threads, runtime", "cpu").option("--packets", "Include packet monitor panel in output").option("--limit <n>", "Max number of processes to include in --once/--json/--csv/--tsv snapshots (0 = all)", "10").option("--p2p-host <host>", "P2P host address (server: bind address, client: server address)", "0.0.0.0").option("--p2p-port <port>", "P2P port number", "9876").option("--p2p-password <password>", "Password for P2P authentication").option("--p2p-tls", "Enable TLS encryption for P2P connections").option("--p2p-cert <file>", "TLS certificate file (PEM) for P2P server").option("--p2p-key <file>", "TLS private key file (PEM) for P2P server").option("--p2p-ca <file>", "TLS CA certificate file (PEM) for P2P client").option("--p2p-insecure", "Skip TLS certificate verification (client only)").option("--p2p-rate-limit <n>", "Max auth attempts per IP per minute (default: 5)", "5").option("--p2p-allow <ips>", "Comma-separated list of allowed IPs (empty = all)").option("--p2p-deny <ips>", "Comma-separated list of denied IPs").option("--p2p-audit-log <dir>", "Directory for P2P audit logs").option("--p2p-hmac-key <key>", "HMAC key for message signing (default: derived from password)");
 program.parse(process.argv);
 var opts = program.opts();
 function isExportMode() {
@@ -2576,7 +2982,7 @@ async function main() {
       await runP2PConnect();
       return;
     } else {
-      console.log(chalk8.red("Usage: pyre p2p <server|connect> [options]"));
+      console.log(chalk9.red("Usage: pyre p2p <server|connect> [options]"));
       process.exit(1);
     }
   }
@@ -2590,13 +2996,13 @@ async function main() {
   else output = formatTable(data, { width: process.stdout.columns || 80, sortBy: opts.sort, treeView: opts.tree, visible: { packets: opts.packets ? true : void 0 } });
   console.log(output);
   if (opts.out) {
-    fs2.writeFileSync(opts.out, stripAnsi(output));
-    console.log(chalk8.dim(`
+    fs4.writeFileSync(opts.out, stripAnsi(output));
+    console.log(chalk9.dim(`
 Saved to ${opts.out}`));
   }
 }
 main().catch((err) => {
-  console.error(chalk8.red(`Error: ${err.message}`));
+  console.error(chalk9.red(`Error: ${err.message}`));
   process.exit(1);
 });
 async function runP2PServer() {
@@ -2605,19 +3011,53 @@ async function runP2PServer() {
   const password = opts.p2pPassword || "";
   const interval = parseFloat(opts.interval) || 2;
   const detailed = !!opts.detailed;
+  const tlsCert = opts.p2pCert;
+  const tlsKey = opts.p2pKey;
+  const tlsCA = opts.p2pCA;
+  const rateLimit = parseInt(opts.p2pRateLimit, 10) || 5;
+  const allowList = opts.p2pAllow ? opts.p2pAllow.split(",").map((s) => s.trim()).filter(Boolean) : [];
+  const denyList = opts.p2pDeny ? opts.p2pDeny.split(",").map((s) => s.trim()).filter(Boolean) : [];
   if (!password) {
-    console.log(chalk8.red("Error: a password is required for P2P server mode. Use --p2p-password <password>"));
+    console.log(chalk9.red("Error: a password is required for P2P server mode. Use --p2p-password <password>"));
+    process.exit(1);
+  }
+  if (tlsCert && !tlsKey) {
+    console.log(chalk9.red("Error: --p2p-key is required when --p2p-cert is specified"));
     process.exit(1);
   }
-  const server = new P2PServer({ host, port, password, intervalMs: interval * 1e3, detailed });
-  console.log(chalk8.bold(`
+  if (tlsKey && !tlsCert) {
+    console.log(chalk9.red("Error: --p2p-cert is required when --p2p-key is specified"));
+    process.exit(1);
+  }
+  const server = new P2PServer({
+    host,
+    port,
+    password,
+    intervalMs: interval * 1e3,
+    detailed,
+    tlsCert,
+    tlsKey,
+    tlsCA,
+    rateLimitMaxAttempts: rateLimit,
+    rateLimitWindowMs: 6e4,
+    allowedIPs: allowList,
+    deniedIPs: denyList,
+    auditLog: opts.p2pAuditLog,
+    hmacKey: opts.p2pHmacKey
+  });
+  const tlsEnabled = !!(tlsCert && tlsKey);
+  console.log(chalk9.bold(`
   pyre P2P Server`));
-  console.log(chalk8.dim(`  Host: ${host}`));
-  console.log(chalk8.dim(`  Port: ${port}`));
-  console.log(chalk8.dim(`  Password: ${password}`));
-  console.log(chalk8.dim(`  Interval: ${interval}s`));
-  console.log(chalk8.dim(`  Detailed: ${detailed ? "on" : "off"}`));
-  console.log(chalk8.dim(`  Waiting for peers...
+  console.log(chalk9.dim(`  Host: ${host}`));
+  console.log(chalk9.dim(`  Port: ${port}`));
+  console.log(chalk9.dim(`  Protocol: ${tlsEnabled ? "TLS" : "TCP"}`));
+  console.log(chalk9.dim(`  Password: ${password}`));
+  console.log(chalk9.dim(`  Interval: ${interval}s`));
+  console.log(chalk9.dim(`  Detailed: ${detailed ? "on" : "off"}`));
+  console.log(chalk9.dim(`  Rate limit: ${rateLimit} attempts/min`));
+  if (allowList.length > 0) console.log(chalk9.dim(`  Allowed IPs: ${allowList.join(", ")}`));
+  if (denyList.length > 0) console.log(chalk9.dim(`  Denied IPs: ${denyList.join(", ")}`));
+  console.log(chalk9.dim(`  Waiting for peers...
 `));
   await server.start();
   const rl = readline2.createInterface({ input: process.stdin });
@@ -2629,7 +3069,7 @@ async function runP2PServer() {
       process.exit(0);
     } else if (trimmed === "status") {
       const info = server.info;
-      console.log(chalk8.dim(`  Peers connected: ${info.peersConnected}`));
+      console.log(chalk9.dim(`  Peers connected: ${info.peersConnected}`));
     }
   });
   process.once("SIGINT", () => {
@@ -2642,18 +3082,30 @@ async function runP2PConnect() {
   const host = opts.p2pHost || "127.0.0.1";
   const port = parseInt(opts.p2pPort, 10) || 9876;
   const password = opts.p2pPassword || "";
+  const useTLS = !!opts.p2pTls;
+  const tlsCA = opts.p2pCA;
+  const tlsInsecure = !!opts.p2pInsecure;
   if (!password) {
-    console.log(chalk8.red("Error: a password is required for P2P connect mode. Use --p2p-password <password>"));
+    console.log(chalk9.red("Error: a password is required for P2P connect mode. Use --p2p-password <password>"));
     process.exit(1);
   }
-  const client = new P2PClient({ host, port, password });
+  const client = new P2PClient({
+    host,
+    port,
+    password,
+    tls: useTLS,
+    tlsCA,
+    tlsInsecure,
+    auditLog: opts.p2pAuditLog,
+    hmacKey: opts.p2pHmacKey
+  });
   client.setOnStatus((msg) => {
-    process.stdout.write(`\r${chalk8.dim(msg)}${" ".repeat(40)}\r`);
+    process.stdout.write(`\r${chalk9.dim(msg)}${" ".repeat(40)}\r`);
   });
   client.setOnData((data) => {
     process.stdout.write("\x1B[2J\x1B[H");
-    console.log(chalk8.bold(`  pyre P2P Client \u2014 ${data.header.hostname}`));
-    console.log(chalk8.dim(`  ${data.timestamp}`));
+    console.log(chalk9.bold(`  pyre P2P Client \u2014 ${data.header.hostname}`));
+    console.log(chalk9.dim(`  ${data.timestamp}`));
     console.log();
     console.log(formatTable(data, {
       width: process.stdout.columns || 80,
@@ -2662,15 +3114,17 @@ async function runP2PConnect() {
       visible: { packets: true }
     }));
   });
-  console.log(chalk8.bold(`
+  const protocolLabel = useTLS ? "TLS" : "TCP";
+  console.log(chalk9.bold(`
   pyre P2P Client`));
-  console.log(chalk8.dim(`  Connecting to ${host}:${port}...`));
-  console.log(chalk8.dim(`  Press Ctrl+C to disconnect
+  console.log(chalk9.dim(`  Protocol: ${protocolLabel}`));
+  console.log(chalk9.dim(`  Connecting to ${host}:${port}...`));
+  console.log(chalk9.dim(`  Press Ctrl+C to disconnect
 `));
   try {
     await client.connect();
   } catch (err) {
-    console.log(chalk8.red(`Connection failed: ${err.message}`));
+    console.log(chalk9.red(`Connection failed: ${err.message}`));
     process.exit(1);
   }
   process.once("SIGINT", () => {