pyre-cli 2.0.0 → 3.1.0

package/src/p2p/client.ts

@@ -1,6 +1,9 @@
 import net from 'node:net';
+import tls from 'node:tls';
+import fs from 'node:fs';
+import crypto from 'node:crypto';
 import chalk from 'chalk';
-import { encodeAuth, encodePing, encodePong, encodeDisconnect } from './protocol.js';
+import { encodeChallenge, encodeAuth, encodePing, encodePong, encodeDisconnect, hashPassword, computeHMAC, verifyHMAC, signMessage, decodeMessage, generateNonce } from './protocol.js';
 import type { P2PClientOptions } from './types.js';
 import type { StatsData } from '../monitors/types.js';
 
@@ -11,7 +14,7 @@ interface ReadState {
 }
 
 export class P2PClient {
-  private socket: net.Socket | null = null;
+  private socket: net.Socket | tls.TLSSocket | null = null;
   private options: P2PClientOptions;
   private running = false;
   private readState: ReadState = { buffer: Buffer.alloc(0), expectingHeader: true, messageLength: 0 };
@@ -19,9 +22,13 @@ export class P2PClient {
   private onStatusCallback: ((msg: string) => void) | null = null;
   private reconnectTimer: NodeJS.Timeout | null = null;
   private pingHandle: NodeJS.Timeout | null = null;
+  private pendingNonce: string | null = null;
+  private auditStream: fs.WriteStream | null = null;
+  private hmacKey: string;
 
   constructor(options: P2PClientOptions) {
     this.options = options;
+    this.hmacKey = deriveHMACKey(options.password);
   }
 
   setOnData(cb: (data: StatsData) => void): void {
@@ -33,27 +40,50 @@ export class P2PClient {
   }
 
   async connect(): Promise<void> {
+    if (this.options.auditLog) {
+      try {
+        fs.mkdirSync(this.options.auditLog, { recursive: true });
+        const logFile = `${this.options.auditLog}/p2p-client-audit.log`;
+        this.auditStream = fs.createWriteStream(logFile, { flags: 'a' });
+      } catch {
+        console.log(chalk.yellow('Warning: could not open audit log'));
+      }
+    }
+
     return new Promise((resolve, reject) => {
-      this.socket = new net.Socket();
+      const useTLS = !!this.options.tls;
+
+      if (useTLS) {
+        const tlsOptions: tls.ConnectionOptions = {
+          host: this.options.host,
+          port: this.options.port,
+          rejectUnauthorized: !this.options.tlsInsecure,
+        };
+        if (this.options.tlsCA) {
+          tlsOptions.ca = fs.readFileSync(this.options.tlsCA);
+        }
+        this.socket = tls.connect(tlsOptions, () => {
+          this.status('Connecting...');
+        });
+      } else {
+        this.socket = new net.Socket();
+        this.socket.on('data', (data) => this.onData(data));
+        this.socket.on('close', () => this.onClose());
+        this.socket.on('error', (err) => this.onError(err));
+        this.socket.on('timeout', () => this.onTimeout());
+        this.socket.setTimeout(10000);
+        this.socket.connect(this.options.port, this.options.host, () => {
+          this.status('Connecting...');
+        });
+        this.socket.once('error', (err) => {
+          reject(err);
+        });
+      }
 
       this.socket.on('data', (data) => this.onData(data));
       this.socket.on('close', () => this.onClose());
       this.socket.on('error', (err) => this.onError(err));
       this.socket.on('timeout', () => this.onTimeout());
-
-      this.socket.setTimeout(10000);
-
-      this.socket.connect(this.options.port, this.options.host, () => {
-        this.running = true;
-        this.socket?.setTimeout(0);
-        this.socket?.write(encodeAuth(this.options.password));
-        this.status('Connecting...');
-        resolve();
-      });
-
-      this.socket.once('error', (err) => {
-        reject(err);
-      });
     });
   }
 
@@ -69,13 +99,17 @@ export class P2PClient {
     }
     if (this.socket) {
       try {
-        this.socket.write(encodeDisconnect('Client closing'));
+        this.sendSigned(encodeDisconnect('Client closing'));
       } catch {
         // ignore
       }
       this.socket.destroy();
       this.socket = null;
     }
+    if (this.auditStream) {
+      this.auditStream.end();
+      this.auditStream = null;
+    }
     this.status('Disconnected');
   }
 
@@ -108,29 +142,49 @@ export class P2PClient {
 
   private handleMessage(body: Buffer): void {
     try {
-      const msg = JSON.parse(body.toString('utf-8'));
+      const raw = body.toString('utf-8');
+      const msg = decodeMessage(body);
+
+      if (!verifyHMAC(raw, msg.hmac ?? '', this.hmacKey)) {
+        this.status('Message integrity check failed');
+        return;
+      }
 
       switch (msg.kind) {
+        case 'challenge':
+          const challengePayload = msg.payload as { nonce?: string };
+          if (challengePayload.nonce) {
+            this.pendingNonce = challengePayload.nonce;
+            const passwordHash = hashPassword(this.options.password, challengePayload.nonce);
+            this.sendSigned(signMessage('auth', { passwordHash, nonce: challengePayload.nonce }, this.hmacKey));
+            this.status('Authenticating...');
+          }
+          break;
+
         case 'auth-ok':
           this.status('Authenticated — receiving live data');
           this.startPing();
           break;
 
         case 'auth-fail':
-          this.status(`Authentication failed: ${(msg.payload as { reason: string }).reason}`);
+          const failPayload = msg.payload as { reason?: string };
+          this.status(`Authentication failed: ${failPayload.reason || 'unknown'}`);
           this.disconnect();
           break;
 
         case 'data':
-          if (this.onDataCallback && msg.payload?.stats) {
-            this.onDataCallback(msg.payload.stats as StatsData);
+          if (this.onDataCallback) {
+            const dataPayload = msg.payload as { stats?: StatsData };
+            if (dataPayload.stats) {
+              this.onDataCallback(dataPayload.stats);
+            }
           }
           break;
 
         case 'ping':
           if (this.socket && !this.socket.destroyed) {
             const ts = (msg.payload as { ts: number }).ts;
-            this.socket.write(encodePong(ts));
+            this.sendSigned(signMessage('pong', { ts }, this.hmacKey));
           }
           break;
 
@@ -138,7 +192,8 @@ export class P2PClient {
           break;
 
         case 'disconnect':
-          this.status(`Server disconnected: ${(msg.payload as { reason: string }).reason}`);
+          const disconnectPayload = msg.payload as { reason?: string };
+          this.status(`Server disconnected: ${disconnectPayload.reason || 'unknown'}`);
           this.disconnect();
           break;
 
@@ -150,10 +205,16 @@ export class P2PClient {
     }
   }
 
+  private sendSigned(message: Buffer): void {
+    if (this.socket && !this.socket.destroyed) {
+      this.socket.write(message);
+    }
+  }
+
   private startPing(): void {
     this.pingHandle = setInterval(() => {
       if (this.socket && !this.socket.destroyed) {
-        this.socket.write(encodePing());
+        this.sendSigned(signMessage('ping', { ts: Date.now() }, this.hmacKey));
       }
     }, 15000);
   }
@@ -173,6 +234,8 @@ export class P2PClient {
       this.status('Connection refused — is the server running?');
     } else if (code === 'ETIMEDOUT') {
       this.status('Connection timed out');
+    } else if (code === 'UNABLE_TO_VERIFY_LEAF_SIGNATURE') {
+      this.status('TLS certificate verification failed — use --p2p-insecure to skip');
     } else {
       this.status(`Connection error: ${err.message}`);
     }
@@ -188,6 +251,17 @@ export class P2PClient {
       this.onStatusCallback(msg);
     }
   }
+
+  audit(event: string, detail: string): void {
+    if (!this.auditStream) return;
+    const ts = new Date().toISOString();
+    const ip = this.options.host;
+    this.auditStream.write(`${ts} ${ip} ${event} ${detail}\n`);
+  }
+}
+
+function deriveHMACKey(password: string): string {
+  return crypto.createHash('sha256').update(password).digest('hex').slice(0, 32);
 }
 
 export async function connectP2PClient(options: P2PClientOptions): Promise<P2PClient> {

package/src/p2p/protocol.ts

@@ -1,19 +1,53 @@
-import type { P2PMessage, P2PMessageKind, P2PPayload } from './types.js';
+import crypto from 'node:crypto';
+import type { P2PMessage, P2PMessageKind, P2PPayload, ChallengeMessage, AuthMessage } from './types.js';
 import type { StatsData } from '../monitors/types.js';
 
 const HEADER_SIZE = 4;
 const MAX_MESSAGE_SIZE = 16 * 1024 * 1024;
+const HMAC_ALGO = 'sha256';
 
-function buildMessage(kind: P2PMessageKind, payload: P2PPayload): Buffer {
+function buildMessage(kind: P2PMessageKind, payload: P2PPayload, hmac?: string): Buffer {
   const envelope: P2PMessage = { kind, payload };
+  if (hmac) envelope.hmac = hmac;
   const body = Buffer.from(JSON.stringify(envelope), 'utf-8');
   const header = Buffer.alloc(HEADER_SIZE);
   header.writeUInt32BE(body.length, 0);
   return Buffer.concat([header, body]);
 }
 
-export function encodeAuth(password: string): Buffer {
-  return buildMessage('auth', { password });
+export function generateNonce(): string {
+  return crypto.randomBytes(32).toString('hex');
+}
+
+export function hashPassword(password: string, nonce: string): string {
+  return crypto.createHash('sha256').update(`${password}:${nonce}`).digest('hex');
+}
+
+export function computeHMAC(body: string, key?: string): string | undefined {
+  if (!key) return undefined;
+  return crypto.createHmac(HMAC_ALGO, key).update(body).digest('hex');
+}
+
+export function verifyHMAC(body: string, expectedHmac: string, key?: string): boolean {
+  if (!key) return expectedHmac === undefined;
+  if (!expectedHmac) return false;
+  try {
+    const parsed = JSON.parse(body) as P2PMessage;
+    const payloadWithoutHmac = { ...parsed, hmac: undefined };
+    const canonical = JSON.stringify(payloadWithoutHmac);
+    const computed = crypto.createHmac(HMAC_ALGO, key).update(canonical).digest('hex');
+    return crypto.timingSafeEqual(Buffer.from(computed), Buffer.from(expectedHmac));
+  } catch {
+    return false;
+  }
+}
+
+export function encodeChallenge(nonce: string): Buffer {
+  return buildMessage('challenge', { nonce });
+}
+
+export function encodeAuth(passwordHash: string, nonce: string): Buffer {
+  return buildMessage('auth', { passwordHash, nonce });
 }
 
 export function encodeAuthOk(): Buffer {
@@ -46,6 +80,13 @@ export function decodeMessage(buf: Buffer): P2PMessage {
   return msg;
 }
 
+export function signMessage(kind: P2PMessageKind, payload: P2PPayload, key?: string): Buffer {
+  const envelope: P2PMessage = { kind, payload };
+  const bodyJson = JSON.stringify(envelope);
+  const hmac = computeHMAC(bodyJson, key);
+  return buildMessage(kind, payload, hmac);
+}
+
 export function readMessage(stream: { read(n: number): Buffer | null }): Buffer | null {
   const header = stream.read(HEADER_SIZE);
   if (!header || header.length < HEADER_SIZE) return null;

package/src/p2p/server.ts

@@ -1,7 +1,10 @@
 import net from 'node:net';
+import tls from 'node:tls';
+import fs from 'node:fs';
+import crypto from 'node:crypto';
 import chalk from 'chalk';
 import { collectAll } from '../monitors/index.js';
-import { encodeAuthOk, encodeAuthFail, encodeData, encodePing, encodePong, encodeDisconnect } from './protocol.js';
+import { encodeAuthOk, encodeAuthFail, encodeData, encodePing, encodePong, encodeDisconnect, hashPassword, computeHMAC, verifyHMAC, signMessage, decodeMessage, generateNonce } from './protocol.js';
 import type { P2PServerOptions, P2PConnectionInfo } from './types.js';
 
 interface Peer {
@@ -12,9 +15,14 @@ interface Peer {
   readBuffer: Buffer;
   readExpectingHeader: boolean;
   readMessageLength: number;
+  ip: string;
+  pendingNonce: string | null;
 }
 
 const HEADER_SIZE = 4;
+const DEFAULT_RATE_LIMIT_MAX = 5;
+const DEFAULT_RATE_LIMIT_WINDOW = 60000;
+const HMAC_KEY_LENGTH = 32;
 
 function readMessageFromPeer(peer: Peer): Buffer | null {
   while (peer.readBuffer.length > 0) {
@@ -42,14 +50,67 @@ function readMessageFromPeer(peer: Peer): Buffer | null {
   return null;
 }
 
+function isIPAllowed(ip: string, allowedIPs: string[], deniedIPs: string[]): boolean {
+  for (const denied of deniedIPs) {
+    if (ip === denied || ip.startsWith(denied)) {
+      return false;
+    }
+  }
+  if (allowedIPs.length === 0) {
+    return true;
+  }
+  for (const allowed of allowedIPs) {
+    if (ip === allowed || ip.startsWith(allowed)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+interface RateLimitEntry {
+  attempts: number;
+  firstAttempt: number;
+}
+
+function deriveHMACKey(password: string): string {
+  return crypto.createHash('sha256').update(password).digest('hex').slice(0, HMAC_KEY_LENGTH);
+}
+
 export class P2PServer {
-  private server: net.Server | null = null;
+  private server: net.Server | tls.Server | null = null;
   private peers: Map<net.Socket, Peer> = new Map();
   private options: P2PServerOptions;
   private running = false;
+  private rateLimitMap: Map<string, RateLimitEntry> = new Map();
+  private auditStream: fs.WriteStream | null = null;
+  private hmacKey: string;
+  private peerEvents: { type: string; detail: string; ts: number }[] = [];
+  private boundAddress = '';
 
   constructor(options: P2PServerOptions) {
     this.options = options;
+    this.hmacKey = deriveHMACKey(options.password);
+  }
+
+  get peerEventHistory(): { type: string; detail: string; ts: number }[] {
+    return this.peerEvents;
+  }
+
+  private log(msg: string): void {
+    if (this.options.onLog) {
+      this.options.onLog(msg.replace(/\x1b\[[0-9;]*m/g, ''));
+    } else {
+      console.log(msg);
+    }
+  }
+
+  private emitPeerEvent(type: string, detail: string): void {
+    const evt = { type, detail, ts: Date.now() };
+    this.peerEvents.push(evt);
+    if (this.peerEvents.length > 200) this.peerEvents.shift();
+    if (this.options.onPeerEvent) {
+      this.options.onPeerEvent(evt as any);
+    }
   }
 
   get info(): P2PConnectionInfo {
@@ -61,16 +122,47 @@ export class P2PServer {
   }
 
   async start(): Promise<void> {
+    if (this.options.auditLog) {
+      try {
+        fs.mkdirSync(this.options.auditLog, { recursive: true });
+        const logFile = `${this.options.auditLog}/p2p-audit.log`;
+        this.auditStream = fs.createWriteStream(logFile, { flags: 'a' });
+      } catch {
+        this.log(chalk.yellow('Warning: could not open audit log'));
+      }
+    }
+
     return new Promise((resolve, reject) => {
-      this.server = net.createServer((socket) => this.onConnection(socket));
-      this.server.on('error', (err) => reject(err));
+      const useTLS = !!(this.options.tlsCert && this.options.tlsKey);
+
+      if (useTLS) {
+        const tlsOptions: tls.SecureContextOptions = {
+          key: fs.readFileSync(this.options.tlsKey!),
+          cert: fs.readFileSync(this.options.tlsCert!),
+        };
+        if (this.options.tlsCA) {
+          tlsOptions.ca = fs.readFileSync(this.options.tlsCA!);
+        }
+        this.server = tls.createServer(tlsOptions, (socket) => this.onConnection(socket));
+      } else {
+        this.server = net.createServer((socket) => this.onConnection(socket));
+      }
+
+      this.server.on('error', (err: Error) => reject(err));
       this.server.listen(this.options.port, this.options.host, () => {
         this.running = true;
         const addr = this.server?.address();
         const bound = addr ? (typeof addr === 'object' ? `${addr.address}:${addr.port}` : String(addr)) : 'unknown';
-        console.log(chalk.green(`P2P server listening on ${bound}`));
-        console.log(chalk.dim(`  Password: ${this.options.password}`));
-        console.log(chalk.dim(`  Interval: ${this.options.intervalMs}ms`));
+        this.boundAddress = typeof addr === 'object' && addr ? addr.address : String(addr);
+        const protocol = useTLS ? 'TLS' : 'TCP';
+        this.log(chalk.green(`P2P server listening on ${bound} (${protocol})`));
+        this.log(chalk.dim(`  Password: ${this.options.password}`));
+        this.log(chalk.dim(`  Interval: ${this.options.intervalMs}ms`));
+        const allowedIPs = this.options.allowedIPs ?? [];
+        const deniedIPs = this.options.deniedIPs ?? [];
+        if (allowedIPs.length > 0) this.log(chalk.dim(`  Allowed IPs: ${allowedIPs.join(', ')}`));
+        if (deniedIPs.length > 0) this.log(chalk.dim(`  Denied IPs: ${deniedIPs.join(', ')}`));
+        this.emitPeerEvent('connect', `Server listening on ${bound}`);
         resolve();
       });
     });
@@ -82,13 +174,82 @@ export class P2PServer {
       this.disconnectPeer(peer, 'Server shutting down');
     }
     this.peers.clear();
+    this.rateLimitMap.clear();
+    this.peerEvents = [];
     if (this.server) {
       this.server.close();
       this.server = null;
     }
+    if (this.auditStream) {
+      this.auditStream.end();
+      this.auditStream = null;
+    }
+  }
+
+  private audit(ip: string, event: string, detail: string): void {
+    if (!this.auditStream) return;
+    const ts = new Date().toISOString();
+    this.auditStream.write(`${ts} ${ip} ${event} ${detail}\n`);
+  }
+
+  private getPeerIP(socket: net.Socket): string {
+    const addr = socket.remoteAddress;
+    if (!addr) return 'unknown';
+    if (addr.startsWith('::ffff:')) {
+      return addr.slice(7);
+    }
+    return addr;
+  }
+
+  private checkRateLimit(ip: string): boolean {
+    const maxAttempts = this.options.rateLimitMaxAttempts ?? DEFAULT_RATE_LIMIT_MAX;
+    const windowMs = this.options.rateLimitWindowMs ?? DEFAULT_RATE_LIMIT_WINDOW;
+    const now = Date.now();
+
+    const entry = this.rateLimitMap.get(ip);
+    if (!entry) {
+      this.rateLimitMap.set(ip, { attempts: 1, firstAttempt: now });
+      return true;
+    }
+
+    if (now - entry.firstAttempt > windowMs) {
+      this.rateLimitMap.set(ip, { attempts: 1, firstAttempt: now });
+      return true;
+    }
+
+    entry.attempts++;
+    if (entry.attempts > maxAttempts) {
+      return false;
+    }
+    return true;
+  }
+
+  private cleanupRateLimit(ip: string): void {
+    this.rateLimitMap.delete(ip);
   }
 
   private onConnection(socket: net.Socket): void {
+    const ip = this.getPeerIP(socket);
+
+    const allowedIPs = this.options.allowedIPs ?? [];
+    const deniedIPs = this.options.deniedIPs ?? [];
+
+    if (!isIPAllowed(ip, allowedIPs, deniedIPs)) {
+      this.audit(ip, 'BLOCKED', 'IP not allowed');
+      this.log(chalk.yellow(`Blocked IP: ${ip}`));
+      this.emitPeerEvent('blocked', ip);
+      socket.destroy();
+      return;
+    }
+
+    if (!this.checkRateLimit(ip)) {
+      this.audit(ip, 'RATE_LIMITED', 'Too many auth attempts');
+      this.log(chalk.yellow(`Rate limit exceeded for IP: ${ip}`));
+      this.emitPeerEvent('rate_limited', ip);
+      socket.destroy();
+      return;
+    }
+
     const peer: Peer = {
       socket,
       authenticated: false,
@@ -97,13 +258,17 @@ export class P2PServer {
       readBuffer: Buffer.alloc(0),
       readExpectingHeader: true,
       readMessageLength: 0,
+      ip,
+      pendingNonce: null,
     };
     this.peers.set(socket, peer);
 
     const remoteAddr = socket.remoteAddress
       ? `${socket.remoteAddress}:${socket.remotePort}`
       : 'unknown';
-    console.log(chalk.cyan(`Peer connected: ${remoteAddr}`));
+    this.log(chalk.cyan(`Peer connected: ${remoteAddr}`));
+    this.audit(ip, 'CONNECT', remoteAddr);
+    this.emitPeerEvent('connect', remoteAddr);
 
     socket.on('data', (data) => this.onData(peer, data));
     socket.on('close', () => this.onPeerClose(peer));
@@ -115,6 +280,10 @@ export class P2PServer {
         this.disconnectPeer(peer, 'Authentication timeout');
       }
     });
+
+    const nonce = generateNonce();
+    this.sendSigned(peer, signMessage('challenge', { nonce }, this.hmacKey));
+    peer.pendingNonce = nonce;
   }
 
   private onData(peer: Peer, data: Buffer): void {
@@ -131,34 +300,67 @@ export class P2PServer {
 
   private handleAuthMessage(peer: Peer, body: Buffer): void {
     try {
-      const msg = JSON.parse(body.toString('utf-8'));
-      if (msg.kind === 'auth' && typeof msg.payload?.password === 'string') {
-        if (msg.payload.password === this.options.password) {
-          peer.authenticated = true;
-          peer.socket.write(encodeAuthOk());
-          console.log(chalk.green(`Peer authenticated: ${peer.socket.remoteAddress}`));
-          this.startDataStream(peer);
-          this.startPing(peer);
-        } else {
-          peer.socket.write(encodeAuthFail('Invalid password'));
-          this.disconnectPeer(peer, 'Authentication failed');
-        }
-      } else {
-        peer.socket.write(encodeAuthFail('Expected auth message first'));
+      const raw = body.toString('utf-8');
+      const msg = decodeMessage(body);
+      if (msg.kind !== 'auth') {
+        peer.socket.write(signMessage('auth-fail', { ok: false, reason: 'Expected auth message first' }, this.hmacKey));
         this.disconnectPeer(peer, 'Expected auth message');
+        this.emitPeerEvent('error', `Expected auth message from ${peer.ip}`);
+        return;
+      }
+
+      const authPayload = msg.payload as { passwordHash?: string; nonce?: string };
+      if (!authPayload.passwordHash || !authPayload.nonce) {
+        peer.socket.write(signMessage('auth-fail', { ok: false, reason: 'Invalid auth payload' }, this.hmacKey));
+        this.disconnectPeer(peer, 'Invalid auth payload');
+        this.emitPeerEvent('error', `Invalid auth payload from ${peer.ip}`);
+        return;
       }
+
+      if (peer.pendingNonce && authPayload.nonce !== peer.pendingNonce) {
+        this.audit(peer.ip, 'AUTH_FAIL', 'Nonce mismatch');
+        peer.socket.write(signMessage('auth-fail', { ok: false, reason: 'Invalid nonce' }, this.hmacKey));
+        this.disconnectPeer(peer, 'Invalid nonce');
+        this.emitPeerEvent('error', `Invalid nonce from ${peer.ip}`);
+        return;
+      }
+
+      const expectedHash = hashPassword(this.options.password, authPayload.nonce);
+      if (authPayload.passwordHash !== expectedHash) {
+        this.audit(peer.ip, 'AUTH_FAIL', 'Invalid password hash');
+        peer.socket.write(signMessage('auth-fail', { ok: false, reason: 'Invalid password' }, this.hmacKey));
+        this.disconnectPeer(peer, 'Authentication failed');
+        this.emitPeerEvent('error', `Invalid password from ${peer.ip}`);
+        return;
+      }
+
+      peer.authenticated = true;
+      this.cleanupRateLimit(peer.ip);
+      peer.pendingNonce = null;
+      peer.socket.write(signMessage('auth-ok', { ok: true }, this.hmacKey));
+      this.log(chalk.green(`Peer authenticated: ${peer.socket.remoteAddress}`));
+      this.audit(peer.ip, 'AUTH_OK', 'Challenge-response successful');
+      this.emitPeerEvent('auth', peer.socket.remoteAddress ?? peer.ip);
+      this.startDataStream(peer);
+      this.startPing(peer);
     } catch {
-      peer.socket.write(encodeAuthFail('Invalid message format'));
+      peer.socket.write(signMessage('auth-fail', { ok: false, reason: 'Invalid message format' }, this.hmacKey));
       this.disconnectPeer(peer, 'Invalid message format');
     }
   }
 
+  private sendSigned(peer: Peer, message: Buffer): void {
+    if (!peer.socket.destroyed) {
+      peer.socket.write(message);
+    }
+  }
+
   private startDataStream(peer: Peer): void {
     const send = async () => {
       if (!peer.authenticated || peer.socket.destroyed) return;
       try {
         const data = await collectAll({ detailed: this.options.detailed });
-        peer.socket.write(encodeData(data));
+        this.sendSigned(peer, signMessage('data', { stats: data }, this.hmacKey));
       } catch {
         // skip failed tick
       }
@@ -171,28 +373,34 @@ export class P2PServer {
   private startPing(peer: Peer): void {
     peer.pingHandle = setInterval(() => {
       if (peer.socket.destroyed) return;
-      peer.socket.write(encodePing());
+      this.sendSigned(peer, signMessage('ping', { ts: Date.now() }, this.hmacKey));
     }, 5000);
   }
 
   private onPeerClose(peer: Peer): void {
     this.cleanupPeer(peer);
-    console.log(chalk.yellow(`Peer disconnected: ${peer.socket.remoteAddress}`));
+    this.log(chalk.yellow(`Peer disconnected: ${peer.socket.remoteAddress}`));
+    this.emitPeerEvent('disconnect', peer.socket.remoteAddress ?? peer.ip);
+    this.audit(peer.ip, 'DISCONNECT', 'Peer closed connection');
   }
 
   private onPeerError(peer: Peer, err: Error): void {
     const code = (err as any).code;
     if (code === 'ECONNRESET') {
-      console.log(chalk.yellow(`Peer connection reset: ${peer.socket.remoteAddress}`));
+      this.log(chalk.yellow(`Peer connection reset: ${peer.socket.remoteAddress}`));
+      this.audit(peer.ip, 'ERROR', 'Connection reset');
+      this.emitPeerEvent('error', `connection reset: ${peer.socket.remoteAddress}`);
     } else {
-      console.log(chalk.red(`Peer error: ${err.message}`));
+      this.log(chalk.red(`Peer error: ${err.message}`));
+      this.audit(peer.ip, 'ERROR', err.message);
+      this.emitPeerEvent('error', err.message);
     }
     this.cleanupPeer(peer);
   }
 
   private disconnectPeer(peer: Peer, reason: string): void {
     try {
-      peer.socket.write(encodeDisconnect(reason));
+      this.sendSigned(peer, signMessage('disconnect', { reason }, this.hmacKey));
     } catch {
       // socket may already be closed
     }