pyre-cli 3.0.0 → 3.2.0

package/dist/index.js

@@ -859,7 +859,8 @@ var TAB_DEFS = [
   { id: "packets", label: "Packets", key: "8" },
   { id: "tasks", label: "Tasks", key: "9" },
   { id: "disk", label: "Disk", key: "0" },
-  { id: "process", label: "Process", key: "p" }
+  { id: "process", label: "Process", key: "P" },
+  { id: "p2p", label: "P2P", key: "R" }
 ];
 var TAB_BAR_INDENT = 2;
 var TAB_SEPARATOR_WIDTH = 3;
@@ -1485,8 +1486,15 @@ var state = {
     { id: "packets", label: "Packets", key: "8" },
     { id: "tasks", label: "Tasks", key: "9" },
     { id: "disk", label: "Disk", key: "0" },
-    { id: "process", label: "Process", key: "P" }
-  ]
+    { id: "process", label: "Process", key: "P" },
+    { id: "p2p", label: "P2P", key: "R" }
+  ],
+  p2pEvents: [],
+  p2pBind: "",
+  p2pServer: null,
+  p2pServerRunning: false,
+  p2pPort: 9876,
+  p2pPassword: "pyre"
 };
 function setStatus(msg, ms = 3e3) {
   state.statusMessage = msg;
@@ -1563,6 +1571,29 @@ function processRowBudget() {
   const reserved = 2 + cardRows * 8 + 11 + (state.showGraphs ? 9 : 0) + 4;
   return Math.max(3, Math.min(40, state.termHeight - reserved));
 }
+function p2pPanelLines() {
+  const events = state.p2pServer ? state.p2pServer.peerEventHistory : state.p2pEvents;
+  const body = [];
+  const bindAddr = state.p2pBind || `0.0.0.0:${state.p2pPort}`;
+  body.push(`Status:   ${state.p2pServerRunning ? chalk5.green("Running") : chalk5.red("Stopped")}`);
+  body.push(`Bind:     ${bindAddr}`);
+  body.push(`Password: ${state.p2pPassword}`);
+  body.push("");
+  const typeColor = (t) => {
+    if (t === "auth") return chalk5.green;
+    if (t === "disconnect") return chalk5.yellow;
+    if (t === "error" || t === "blocked" || t === "rate_limited") return chalk5.red;
+    return chalk5.cyan;
+  };
+  body.push(chalk5.dim("Events (most recent):"));
+  const recent = events.slice(-20).reverse();
+  for (const evt of recent) {
+    const time = new Date(evt.ts).toLocaleTimeString();
+    body.push(`${chalk5.dim(time)} ${typeColor(evt.type)(evt.type.padEnd(14))} ${evt.detail}`);
+  }
+  const title = `P2P \xB7 ${state.p2pServerRunning ? "ON" : "OFF"} \xB7 ${events.length} events`;
+  return { title, body };
+}
 function renderCustomizerOverlay() {
   const themesList = Object.keys(THEMES);
   const lines = [
@@ -1590,19 +1621,25 @@ function renderCustomizerOverlay() {
 function render() {
   if (!state.lastData) return;
   const lines = [];
-  lines.push(
-    formatTable(state.lastData, {
-      width: state.termWidth,
-      sortBy: state.sortMode,
-      filter: state.processFilter || void 0,
-      processLimit: processRowBudget(),
-      theme: state.currentTheme,
-      visible: state.visiblePanels,
-      treeView: state.treeView,
-      activePanel: state.activePanel
-    })
-  );
-  if (state.showGraphs) {
+  const theme = THEMES[state.currentTheme] || THEMES.default;
+  if (state.activePanel === "p2p") {
+    const panelLines = p2pPanelLines();
+    lines.push(...panel(panelLines.title, panelLines.body, state.termWidth, theme.process, theme.border));
+  } else {
+    lines.push(
+      formatTable(state.lastData, {
+        width: state.termWidth,
+        sortBy: state.sortMode,
+        filter: state.processFilter || void 0,
+        processLimit: processRowBudget(),
+        theme: state.currentTheme,
+        visible: state.visiblePanels,
+        treeView: state.treeView,
+        activePanel: state.activePanel
+      })
+    );
+  }
+  if (state.showGraphs && state.activePanel !== "p2p") {
     lines.push("");
     lines.push(formatGraphs(state.history, state.termWidth, state.currentTheme, state.graphMode));
   }
@@ -1620,6 +1657,8 @@ function render() {
     lines.push(chalk5.cyan(`  Signal: ${state.inputBuffer}_`));
     lines.push(chalk5.dim(`  ${sigList}`));
     lines.push(chalk5.dim("  \u2191/\u2193 to select, Enter to confirm, Esc to cancel"));
+  } else if (state.inputMode === "p2p") {
+    lines.push(chalk5.cyan(`  P2P password (${state.p2pPort}): ${state.inputBuffer}_  (enter to start, esc to cancel)`));
   } else if (state.statusMessage) {
     lines.push(`  ${state.statusMessage}`);
   }
@@ -1630,6 +1669,7 @@ function footerLine() {
   const keys = [
     ["q", "quit"],
     ["c", "customize UI"],
+    ["r", state.p2pServerRunning ? "stop p2p" : "start p2p"],
     ["p", state.paused ? "resume" : "pause"],
     ["g", state.showGraphs ? "hide graphs" : "show graphs"],
     ["b", `graph:${state.graphMode}`],
@@ -1651,6 +1691,7 @@ function footerLine() {
   if (state.paused) badges.push(chalk5.yellow.bold("\u23F8 PAUSED"));
   if (state.logging) badges.push(chalk5.red.bold("\u25CF REC"));
   if (state.activePanel !== "grid") badges.push(chalk5.cyan.bold(`\u25C9 ${state.activePanel.toUpperCase()}`));
+  if (state.p2pServerRunning) badges.push(chalk5.green.bold(`P2P ${state.p2pBind || "0.0.0.0"}:${state.p2pPort}`));
   const badgeStr = badges.join("  ");
   return badgeStr ? `${keyStr}    ${badgeStr}` : keyStr;
 }
@@ -1667,1111 +1708,1270 @@ function checkAlerts(data) {
   }
 }
 
-// src/live/input.ts
-function handleInputModeKey(str, key) {
-  if (key.name === "escape") {
-    state.inputMode = null;
-    state.inputBuffer = "";
-    render();
-    return;
+// src/p2p/server.ts
+import net from "net";
+import tls from "tls";
+import fs2 from "fs";
+import crypto2 from "crypto";
+import chalk6 from "chalk";
+
+// src/p2p/protocol.ts
+import crypto from "crypto";
+var HEADER_SIZE = 4;
+var MAX_MESSAGE_SIZE = 16 * 1024 * 1024;
+var HMAC_ALGO = "sha256";
+function buildMessage(kind, payload, hmac) {
+  const envelope = { kind, payload };
+  if (hmac) envelope.hmac = hmac;
+  const body = Buffer.from(JSON.stringify(envelope), "utf-8");
+  const header2 = Buffer.alloc(HEADER_SIZE);
+  header2.writeUInt32BE(body.length, 0);
+  return Buffer.concat([header2, body]);
+}
+function generateNonce() {
+  return crypto.randomBytes(32).toString("hex");
+}
+function hashPassword(password, nonce) {
+  return crypto.createHash("sha256").update(`${password}:${nonce}`).digest("hex");
+}
+function computeHMAC(body, key) {
+  if (!key) return void 0;
+  return crypto.createHmac(HMAC_ALGO, key).update(body).digest("hex");
+}
+function verifyHMAC(body, expectedHmac, key) {
+  if (!key) return expectedHmac === void 0;
+  if (!expectedHmac) return false;
+  try {
+    const parsed = JSON.parse(body);
+    const payloadWithoutHmac = { ...parsed, hmac: void 0 };
+    const canonical = JSON.stringify(payloadWithoutHmac);
+    const computed = crypto.createHmac(HMAC_ALGO, key).update(canonical).digest("hex");
+    return crypto.timingSafeEqual(Buffer.from(computed), Buffer.from(expectedHmac));
+  } catch {
+    return false;
   }
-  if (state.inputMode === "customizer") {
-    const themesList = Object.keys(THEMES);
-    if (key.name === "up" || str === "k") {
-      state.customizerIndex = (state.customizerIndex - 1 + state.CUSTOMIZER_OPTIONS.length) % state.CUSTOMIZER_OPTIONS.length;
-    } else if (key.name === "down" || str === "j") {
-      state.customizerIndex = (state.customizerIndex + 1) % state.CUSTOMIZER_OPTIONS.length;
-    } else if (key.name === "return" || str === " ") {
-      const selected = state.CUSTOMIZER_OPTIONS[state.customizerIndex];
-      if (selected === "Theme") {
-        const nextIdx = (themesList.indexOf(state.currentTheme) + 1) % themesList.length;
-        state.currentTheme = themesList[nextIdx];
-      } else if (selected === "Toggle Tree View") {
-        state.treeView = !state.treeView;
-      } else if (selected === "Graph Mode") {
-        state.graphMode = state.graphMode === "spark" ? "bar" : "spark";
+}
+function encodeDisconnect(reason) {
+  return buildMessage("disconnect", { reason });
+}
+function decodeMessage(buf) {
+  const str = buf.toString("utf-8");
+  const msg = JSON.parse(str);
+  return msg;
+}
+function signMessage(kind, payload, key) {
+  const envelope = { kind, payload };
+  const bodyJson = JSON.stringify(envelope);
+  const hmac = computeHMAC(bodyJson, key);
+  return buildMessage(kind, payload, hmac);
+}
+
+// src/p2p/server.ts
+var HEADER_SIZE2 = 4;
+var DEFAULT_RATE_LIMIT_MAX = 5;
+var DEFAULT_RATE_LIMIT_WINDOW = 6e4;
+var HMAC_KEY_LENGTH = 32;
+function readMessageFromPeer(peer) {
+  while (peer.readBuffer.length > 0) {
+    if (peer.readExpectingHeader) {
+      if (peer.readBuffer.length >= HEADER_SIZE2) {
+        peer.readMessageLength = peer.readBuffer.readUInt32BE(0);
+        peer.readBuffer = peer.readBuffer.subarray(HEADER_SIZE2);
+        peer.readExpectingHeader = false;
       } else {
-        const itemKey = selected.replace("Toggle ", "").toLowerCase();
-        state.visiblePanels[itemKey] = !state.visiblePanels[itemKey];
+        break;
       }
     }
-    render();
-    return;
-  }
-  if (state.inputMode === "signal") {
-    if (key.name === "up" || str === "k") {
-      const idx = state.SIGNAL_OPTIONS.indexOf(state.inputBuffer);
-      state.inputBuffer = state.SIGNAL_OPTIONS[(idx - 1 + state.SIGNAL_OPTIONS.length) % state.SIGNAL_OPTIONS.length];
-    } else if (key.name === "down" || str === "j") {
-      const idx = state.SIGNAL_OPTIONS.indexOf(state.inputBuffer);
-      state.inputBuffer = state.SIGNAL_OPTIONS[(idx + 1) % state.SIGNAL_OPTIONS.length];
-    } else if (key.name === "return" || str === " ") {
-      killProcess(state.inputBuffer.trim(), state.inputBuffer.trim());
-      state.inputMode = null;
-      state.inputBuffer = "";
-      render();
-      return;
+    if (!peer.readExpectingHeader) {
+      if (peer.readBuffer.length >= peer.readMessageLength) {
+        const body = peer.readBuffer.subarray(0, peer.readMessageLength);
+        peer.readBuffer = peer.readBuffer.subarray(peer.readMessageLength);
+        peer.readExpectingHeader = true;
+        return body;
+      } else {
+        break;
+      }
     }
-    render();
-    return;
   }
-  if (key.name === "return") {
-    if (state.inputMode === "filter") {
-      state.processFilter = state.inputBuffer.trim();
-      setStatus(state.processFilter ? `Filtering: "${state.processFilter}"` : "Filter cleared");
-    } else if (state.inputMode === "kill") {
-      killProcess(state.inputBuffer.trim());
+  return null;
+}
+function isIPAllowed(ip, allowedIPs, deniedIPs) {
+  for (const denied of deniedIPs) {
+    if (ip === denied || ip.startsWith(denied)) {
+      return false;
     }
-    state.inputMode = null;
-    state.inputBuffer = "";
-    render();
-    return;
-  }
-  if (key.name === "backspace") {
-    state.inputBuffer = state.inputBuffer.slice(0, -1);
-    render();
-    return;
-  }
-  if (str && str.length === 1 && !key.ctrl && !key.meta) {
-    state.inputBuffer += str;
-    render();
   }
-}
-function killProcess(pidStr, signal = "SIGTERM") {
-  const pid = parseInt(pidStr, 10);
-  if (!pid || pid <= 0) {
-    setStatus(`Invalid PID: ${pidStr}`);
-    return;
+  if (allowedIPs.length === 0) {
+    return true;
   }
-  try {
-    process.kill(pid, signal);
-    setStatus(`Sent ${signal} to PID ${pid}`);
-  } catch (err) {
-    setStatus(`Failed to send ${signal} to ${pid}: ${err.message}`);
+  for (const allowed of allowedIPs) {
+    if (ip === allowed || ip.startsWith(allowed)) {
+      return true;
+    }
   }
+  return false;
 }
-function onResize() {
-  state.termWidth = process.stdout.columns || 80;
-  state.termHeight = process.stdout.rows || 24;
-  state.history.setMaxLen(Math.max(20, Math.min(200, state.termWidth - 30)));
-  render();
-}
-function restartTicker() {
-  if (state.intervalHandle) clearInterval(state.intervalHandle);
-  state.intervalHandle = setInterval(tick, state.interval * 1e3);
+function deriveHMACKey(password) {
+  return crypto2.createHash("sha256").update(password).digest("hex").slice(0, HMAC_KEY_LENGTH);
 }
-async function tick() {
-  if (state.paused) return;
-  try {
-    const data = await collectAll({ detailed: state.detailed, processLimit: processRowBudget() });
-    state.lastData = data;
-    const temp = data.cpu.temperature ?? data.thermal.temperatures?.cpu_die ?? null;
-    state.history.push({
-      cpuUsage: data.cpu.usage,
-      memUsage: data.memory.usagePercent,
-      temp,
-      rxBytes: data.network.rxBytes,
-      txBytes: data.network.txBytes,
-      gpuUtil: data.gpu?.utilization,
-      powerWatts: data.power?.combinedWatts ?? data.power?.cpuWatts ?? 0,
-      rxPackets: data.network.rxPackets,
-      txPackets: data.network.txPackets,
-      connections: data.network.connections ?? 0
-    });
-    writeLogRow(data);
-    checkAlerts(data);
-    render();
-  } catch {
+var P2PServer = class {
+  server = null;
+  peers = /* @__PURE__ */ new Map();
+  options;
+  running = false;
+  rateLimitMap = /* @__PURE__ */ new Map();
+  auditStream = null;
+  hmacKey;
+  peerEvents = [];
+  boundAddress = "";
+  constructor(options) {
+    this.options = options;
+    this.hmacKey = deriveHMACKey(options.password);
   }
-}
-async function startLive(opts2) {
-  if (state.running) return;
-  state.running = true;
-  state.paused = false;
-  state.detailed = !!opts2.detailed;
-  state.interval = opts2.interval;
-  if (opts2.exportDir) state.exportDir = opts2.exportDir;
-  state.termWidth = process.stdout.columns || 80;
-  state.termHeight = process.stdout.rows || 24;
-  state.history.reset();
-  state.history.setMaxLen(Math.max(20, Math.min(200, state.termWidth - 30)));
-  process.stdout.write("\x1B[?1049h");
-  process.stdout.write("\x1B[?25l");
-  process.stdout.write("\x1B[2J\x1B[H");
-  process.title = "pyre";
-  if (state.mouseEnabled) {
-    process.stdout.write("\x1B[?1000h");
+  get peerEventHistory() {
+    return this.peerEvents;
   }
-  await tick();
-  restartTicker();
-  if (opts2.autoLog) startLogging();
-  readline.emitKeypressEvents(process.stdin);
-  if (process.stdin.isTTY) process.stdin.setRawMode(true);
-  process.stdin.resume();
-  process.stdout.on("resize", onResize);
-  state.keypressHandler = (str, key) => {
-    if (!key) return;
-    if (key.ctrl && key.name === "c") {
-      stopLive();
-      return;
-    }
-    if (state.inputMode) {
-      handleInputModeKey(str, key);
-      return;
+  log(msg) {
+    if (this.options.onLog) {
+      this.options.onLog(msg.replace(/\x1b\[[0-9;]*m/g, ""));
+    } else {
+      console.log(msg);
     }
-    if (key.mouse) {
-      handleMouseClick(key.mouse);
-      return;
+  }
+  emitPeerEvent(type, detail) {
+    const evt = { type, detail, ts: Date.now() };
+    this.peerEvents.push(evt);
+    if (this.peerEvents.length > 200) this.peerEvents.shift();
+    if (this.options.onPeerEvent) {
+      this.options.onPeerEvent(evt);
     }
-    if (key.sequence && key.sequence.startsWith("\x1B[M")) {
-      handleNormalMouse(key.sequence);
+  }
+  get info() {
+    return {
+      host: this.options.host,
+      port: this.options.port,
+      peersConnected: this.peers.size
+    };
+  }
+  async start() {
+    if (this.options.auditLog) {
+      try {
+        fs2.mkdirSync(this.options.auditLog, { recursive: true });
+        const logFile = `${this.options.auditLog}/p2p-audit.log`;
+        this.auditStream = fs2.createWriteStream(logFile, { flags: "a" });
+      } catch {
+        this.log(chalk6.yellow("Warning: could not open audit log"));
+      }
+    }
+    return new Promise((resolve, reject) => {
+      const useTLS = !!(this.options.tlsCert && this.options.tlsKey);
+      if (useTLS) {
+        const tlsOptions = {
+          key: fs2.readFileSync(this.options.tlsKey),
+          cert: fs2.readFileSync(this.options.tlsCert)
+        };
+        if (this.options.tlsCA) {
+          tlsOptions.ca = fs2.readFileSync(this.options.tlsCA);
+        }
+        this.server = tls.createServer(tlsOptions, (socket) => this.onConnection(socket));
+      } else {
+        this.server = net.createServer((socket) => this.onConnection(socket));
+      }
+      this.server.on("error", (err) => reject(err));
+      this.server.listen(this.options.port, this.options.host, () => {
+        this.running = true;
+        const addr = this.server?.address();
+        const bound = addr ? typeof addr === "object" ? `${addr.address}:${addr.port}` : String(addr) : "unknown";
+        this.boundAddress = typeof addr === "object" && addr ? addr.address : String(addr);
+        const protocol = useTLS ? "TLS" : "TCP";
+        this.log(chalk6.green(`P2P server listening on ${bound} (${protocol})`));
+        this.log(chalk6.dim(`  Password: ${this.options.password}`));
+        this.log(chalk6.dim(`  Interval: ${this.options.intervalMs}ms`));
+        const allowedIPs = this.options.allowedIPs ?? [];
+        const deniedIPs = this.options.deniedIPs ?? [];
+        if (allowedIPs.length > 0) this.log(chalk6.dim(`  Allowed IPs: ${allowedIPs.join(", ")}`));
+        if (deniedIPs.length > 0) this.log(chalk6.dim(`  Denied IPs: ${deniedIPs.join(", ")}`));
+        this.emitPeerEvent("connect", `Server listening on ${bound}`);
+        resolve();
+      });
+    });
+  }
+  stop() {
+    this.running = false;
+    for (const peer of this.peers.values()) {
+      this.disconnectPeer(peer, "Server shutting down");
+    }
+    this.peers.clear();
+    this.rateLimitMap.clear();
+    this.peerEvents = [];
+    if (this.server) {
+      this.server.close();
+      this.server = null;
+    }
+    if (this.auditStream) {
+      this.auditStream.end();
+      this.auditStream = null;
+    }
+  }
+  audit(ip, event, detail) {
+    if (!this.auditStream) return;
+    const ts = (/* @__PURE__ */ new Date()).toISOString();
+    this.auditStream.write(`${ts} ${ip} ${event} ${detail}
+`);
+  }
+  getPeerIP(socket) {
+    const addr = socket.remoteAddress;
+    if (!addr) return "unknown";
+    if (addr.startsWith("::ffff:")) {
+      return addr.slice(7);
+    }
+    return addr;
+  }
+  checkRateLimit(ip) {
+    const maxAttempts = this.options.rateLimitMaxAttempts ?? DEFAULT_RATE_LIMIT_MAX;
+    const windowMs = this.options.rateLimitWindowMs ?? DEFAULT_RATE_LIMIT_WINDOW;
+    const now = Date.now();
+    const entry = this.rateLimitMap.get(ip);
+    if (!entry) {
+      this.rateLimitMap.set(ip, { attempts: 1, firstAttempt: now });
+      return true;
+    }
+    if (now - entry.firstAttempt > windowMs) {
+      this.rateLimitMap.set(ip, { attempts: 1, firstAttempt: now });
+      return true;
+    }
+    entry.attempts++;
+    if (entry.attempts > maxAttempts) {
+      return false;
+    }
+    return true;
+  }
+  cleanupRateLimit(ip) {
+    this.rateLimitMap.delete(ip);
+  }
+  onConnection(socket) {
+    const ip = this.getPeerIP(socket);
+    const allowedIPs = this.options.allowedIPs ?? [];
+    const deniedIPs = this.options.deniedIPs ?? [];
+    if (!isIPAllowed(ip, allowedIPs, deniedIPs)) {
+      this.audit(ip, "BLOCKED", "IP not allowed");
+      this.log(chalk6.yellow(`Blocked IP: ${ip}`));
+      this.emitPeerEvent("blocked", ip);
+      socket.destroy();
       return;
     }
-    if (key.sequence && key.sequence.startsWith("\x1B[<")) {
-      handleSGRMouse(key.sequence);
+    if (!this.checkRateLimit(ip)) {
+      this.audit(ip, "RATE_LIMITED", "Too many auth attempts");
+      this.log(chalk6.yellow(`Rate limit exceeded for IP: ${ip}`));
+      this.emitPeerEvent("rate_limited", ip);
+      socket.destroy();
       return;
     }
-    switch (key.sequence) {
-      case "+":
-        state.interval += 1;
-        restartTicker();
-        setStatus(`Interval set to ${state.interval}s`);
-        return;
-      case "-":
-        state.interval = Math.max(1, state.interval - 1);
-        restartTicker();
-        setStatus(`Interval set to ${state.interval}s`);
+    const peer = {
+      socket,
+      authenticated: false,
+      intervalHandle: null,
+      pingHandle: null,
+      readBuffer: Buffer.alloc(0),
+      readExpectingHeader: true,
+      readMessageLength: 0,
+      ip,
+      pendingNonce: null
+    };
+    this.peers.set(socket, peer);
+    const remoteAddr = socket.remoteAddress ? `${socket.remoteAddress}:${socket.remotePort}` : "unknown";
+    this.log(chalk6.cyan(`Peer connected: ${remoteAddr}`));
+    this.audit(ip, "CONNECT", remoteAddr);
+    this.emitPeerEvent("connect", remoteAddr);
+    socket.on("data", (data) => this.onData(peer, data));
+    socket.on("close", () => this.onPeerClose(peer));
+    socket.on("error", (err) => this.onPeerError(peer, err));
+    socket.setTimeout(3e4);
+    socket.on("timeout", () => {
+      if (!peer.authenticated) {
+        this.disconnectPeer(peer, "Authentication timeout");
+      }
+    });
+    const nonce = generateNonce();
+    this.sendSigned(peer, signMessage("challenge", { nonce }, this.hmacKey));
+    peer.pendingNonce = nonce;
+  }
+  onData(peer, data) {
+    peer.readBuffer = Buffer.concat([peer.readBuffer, data]);
+    if (!peer.authenticated) {
+      const body = readMessageFromPeer(peer);
+      if (body) {
+        this.handleAuthMessage(peer, body);
+      }
+      return;
+    }
+  }
+  handleAuthMessage(peer, body) {
+    try {
+      const raw = body.toString("utf-8");
+      const msg = decodeMessage(body);
+      if (msg.kind !== "auth") {
+        peer.socket.write(signMessage("auth-fail", { ok: false, reason: "Expected auth message first" }, this.hmacKey));
+        this.disconnectPeer(peer, "Expected auth message");
+        this.emitPeerEvent("error", `Expected auth message from ${peer.ip}`);
         return;
-      case "/":
-        state.inputMode = "filter";
-        state.inputBuffer = state.processFilter;
-        render();
+      }
+      const authPayload = msg.payload;
+      if (!authPayload.passwordHash || !authPayload.nonce) {
+        peer.socket.write(signMessage("auth-fail", { ok: false, reason: "Invalid auth payload" }, this.hmacKey));
+        this.disconnectPeer(peer, "Invalid auth payload");
+        this.emitPeerEvent("error", `Invalid auth payload from ${peer.ip}`);
         return;
-      case "0":
-      case "1":
-      case "2":
-      case "3":
-      case "4":
-      case "5":
-      case "6":
-      case "7":
-      case "8":
-      case "9": {
-        const tabMap = {
-          "0": "disk",
-          "1": "cpu",
-          "2": "mem",
-          "3": "gpu",
-          "4": "power",
-          "5": "battery",
-          "6": "thermal",
-          "7": "network",
-          "8": "packets",
-          "9": "tasks"
-        };
-        const panelId = tabMap[key.sequence];
-        if (panelId) {
-          state.activePanel = state.activePanel === panelId ? "grid" : panelId;
-          setStatus(state.activePanel === "grid" ? "Grid view" : `${panelId} panel`);
-          render();
-        }
+      }
+      if (peer.pendingNonce && authPayload.nonce !== peer.pendingNonce) {
+        this.audit(peer.ip, "AUTH_FAIL", "Nonce mismatch");
+        peer.socket.write(signMessage("auth-fail", { ok: false, reason: "Invalid nonce" }, this.hmacKey));
+        this.disconnectPeer(peer, "Invalid nonce");
+        this.emitPeerEvent("error", `Invalid nonce from ${peer.ip}`);
         return;
       }
-      case "P": {
-        state.activePanel = state.activePanel === "process" ? "grid" : "process";
-        setStatus(state.activePanel === "grid" ? "Grid view" : "Process panel");
-        render();
+      const expectedHash = hashPassword(this.options.password, authPayload.nonce);
+      if (authPayload.passwordHash !== expectedHash) {
+        this.audit(peer.ip, "AUTH_FAIL", "Invalid password hash");
+        peer.socket.write(signMessage("auth-fail", { ok: false, reason: "Invalid password" }, this.hmacKey));
+        this.disconnectPeer(peer, "Authentication failed");
+        this.emitPeerEvent("error", `Invalid password from ${peer.ip}`);
         return;
       }
+      peer.authenticated = true;
+      this.cleanupRateLimit(peer.ip);
+      peer.pendingNonce = null;
+      peer.socket.write(signMessage("auth-ok", { ok: true }, this.hmacKey));
+      this.log(chalk6.green(`Peer authenticated: ${peer.socket.remoteAddress}`));
+      this.audit(peer.ip, "AUTH_OK", "Challenge-response successful");
+      this.emitPeerEvent("auth", peer.socket.remoteAddress ?? peer.ip);
+      this.startDataStream(peer);
+      this.startPing(peer);
+    } catch {
+      peer.socket.write(signMessage("auth-fail", { ok: false, reason: "Invalid message format" }, this.hmacKey));
+      this.disconnectPeer(peer, "Invalid message format");
     }
-    switch (key.name) {
-      case "q":
-        stopLive();
-        break;
-      case "left": {
-        const currentIdx = state.PANEL_TABS.findIndex((t) => t.id === state.activePanel);
-        if (currentIdx > 0) {
-          state.activePanel = state.PANEL_TABS[currentIdx - 1].id;
-        } else if (currentIdx === -1) {
-          state.activePanel = state.PANEL_TABS[state.PANEL_TABS.length - 1].id;
-        }
-        setStatus(`Panel: ${state.activePanel}`);
-        render();
-        break;
+  }
+  sendSigned(peer, message) {
+    if (!peer.socket.destroyed) {
+      peer.socket.write(message);
+    }
+  }
+  startDataStream(peer) {
+    const send = async () => {
+      if (!peer.authenticated || peer.socket.destroyed) return;
+      try {
+        const data = await collectAll({ detailed: this.options.detailed });
+        this.sendSigned(peer, signMessage("data", { stats: data }, this.hmacKey));
+      } catch {
       }
-      case "right": {
-        const currentIdx = state.PANEL_TABS.findIndex((t) => t.id === state.activePanel);
-        if (currentIdx < state.PANEL_TABS.length - 1) {
-          state.activePanel = state.PANEL_TABS[currentIdx + 1].id;
-        } else if (currentIdx === -1) {
-          state.activePanel = state.PANEL_TABS[0].id;
-        }
-        setStatus(`Panel: ${state.activePanel}`);
-        render();
-        break;
-      }
-      case "c":
-        state.inputMode = "customizer";
-        state.customizerIndex = 0;
-        render();
-        break;
-      case "p":
-        state.paused = !state.paused;
-        setStatus(state.paused ? "Paused" : "Resumed");
-        render();
-        break;
-      case "g":
-        state.showGraphs = !state.showGraphs;
-        render();
-        break;
-      case "b":
-        state.graphMode = state.graphMode === "spark" ? "bar" : "spark";
-        setStatus(`Graph mode: ${state.graphMode}`);
-        render();
-        break;
-      case "d":
-        state.detailed = !state.detailed;
-        setStatus(`Detailed sensor mode: ${state.detailed ? "on" : "off"}`);
-        break;
-      case "s":
-        const sortCycle = ["cpu", "mem", "pid", "user", "command", "state", "threads", "runtime"];
-        const curIdx = sortCycle.indexOf(state.sortMode);
-        state.sortMode = sortCycle[(curIdx + 1) % sortCycle.length];
-        setStatus(`Sorting by ${state.sortMode}`);
-        render();
-        break;
-      case "k":
-        state.inputMode = "kill";
-        state.inputBuffer = "";
-        render();
-        break;
-      case "S":
-        state.inputMode = "signal";
-        state.inputBuffer = "SIGTERM";
-        render();
-        break;
-      case "t":
-        state.treeView = !state.treeView;
-        setStatus(state.treeView ? "Tree view enabled" : "Flat view enabled");
-        render();
-        break;
-      case "e":
-        exportSnapshot();
-        render();
-        break;
-      case "l":
-        toggleLogging();
-        render();
-        break;
-      case "f":
-        state.exportFormat = state.exportFormat === "json" ? "csv" : state.exportFormat === "csv" ? "tsv" : "json";
-        setStatus(`Export format: ${state.exportFormat}`);
-        render();
-        break;
-      case "tab":
-        cycleTab(1);
-        break;
-      case "left":
-        cycleTab(-1);
-        break;
-      case "right":
-        cycleTab(1);
-        break;
-      default:
-        if (str && str.length === 1) {
-          const tabId = tabKeyToId(str);
-          if (tabId) {
-            state.activePanel = tabId;
-            setStatus(`Panel: ${tabId.toUpperCase()}`);
-            render();
-          }
-        }
+    };
+    send();
+    peer.intervalHandle = setInterval(send, this.options.intervalMs);
+  }
+  startPing(peer) {
+    peer.pingHandle = setInterval(() => {
+      if (peer.socket.destroyed) return;
+      this.sendSigned(peer, signMessage("ping", { ts: Date.now() }, this.hmacKey));
+    }, 5e3);
+  }
+  onPeerClose(peer) {
+    this.cleanupPeer(peer);
+    this.log(chalk6.yellow(`Peer disconnected: ${peer.socket.remoteAddress}`));
+    this.emitPeerEvent("disconnect", peer.socket.remoteAddress ?? peer.ip);
+    this.audit(peer.ip, "DISCONNECT", "Peer closed connection");
+  }
+  onPeerError(peer, err) {
+    const code = err.code;
+    if (code === "ECONNRESET") {
+      this.log(chalk6.yellow(`Peer connection reset: ${peer.socket.remoteAddress}`));
+      this.audit(peer.ip, "ERROR", "Connection reset");
+      this.emitPeerEvent("error", `connection reset: ${peer.socket.remoteAddress}`);
+    } else {
+      this.log(chalk6.red(`Peer error: ${err.message}`));
+      this.audit(peer.ip, "ERROR", err.message);
+      this.emitPeerEvent("error", err.message);
     }
-  };
-  process.stdin.on("keypress", state.keypressHandler);
-  process.once("SIGINT", () => stopLive());
-}
-function tabKeyToId(str) {
-  const map = { "1": "cpu", "2": "mem", "3": "gpu", "4": "power", "5": "battery", "6": "thermal", "7": "network", "8": "packets", "9": "tasks", "0": "disk", "p": "process" };
-  return map[str] ?? null;
-}
-function cycleTab(direction) {
-  const tabs = state.PANEL_TABS.map((t) => t.id);
-  const current = state.activePanel === "grid" ? -1 : tabs.indexOf(state.activePanel);
-  const next = (current + direction + tabs.length) % tabs.length;
-  state.activePanel = tabs[next];
-  setStatus(`Panel: ${state.activePanel.toUpperCase()}`);
-  render();
-}
-function handleNormalMouse(seq) {
-  if (seq.length < 6) return;
-  const cb = seq.charCodeAt(3) - 32;
-  const cx = seq.charCodeAt(4) - 32;
-  const cy = seq.charCodeAt(5) - 32;
-  if (cb === 0 || cb === 1) {
-    handleMouseClick(cy, cx);
+    this.cleanupPeer(peer);
   }
-}
-function handleSGRMouse(seq) {
-  const match = seq.match(/^\x1b\[<(\d+);(\d+);(\d+)([Mm])/);
-  if (!match) return;
-  const button = parseInt(match[1]);
-  const cx = parseInt(match[2]);
-  const cy = parseInt(match[3]);
-  if (button === 0 || button === 1) {
-    handleMouseClick(cy, cx);
+  disconnectPeer(peer, reason) {
+    try {
+      this.sendSigned(peer, signMessage("disconnect", { reason }, this.hmacKey));
+    } catch {
+    }
+    peer.socket.destroy();
   }
-}
-function handleMouseClick(y, x) {
-  if (y !== TAB_BAR_ROW) return;
-  const hitboxes = getTabHitboxes();
-  const hit = hitboxes.find((h) => x >= h.start && x < h.end);
-  if (hit) {
-    state.activePanel = state.activePanel === hit.id ? "grid" : hit.id;
-    setStatus(state.activePanel === "grid" ? "Grid view" : `Panel: ${hit.id.toUpperCase()}`);
-    render();
+  cleanupPeer(peer) {
+    if (peer.intervalHandle) {
+      clearInterval(peer.intervalHandle);
+      peer.intervalHandle = null;
+    }
+    if (peer.pingHandle) {
+      clearInterval(peer.pingHandle);
+      peer.pingHandle = null;
+    }
+    this.peers.delete(peer.socket);
   }
+};
+async function startP2PServer(options) {
+  const server = new P2PServer(options);
+  await server.start();
+  return server;
 }
-function stopLive() {
-  if (state.intervalHandle) {
-    clearInterval(state.intervalHandle);
-    state.intervalHandle = null;
-  }
-  if (state.statusTimer) {
-    clearTimeout(state.statusTimer);
-    state.statusTimer = null;
+
+// src/p2p/client.ts
+import net2 from "net";
+import tls2 from "tls";
+import fs3 from "fs";
+import crypto3 from "crypto";
+import chalk7 from "chalk";
+var P2PClient = class {
+  socket = null;
+  options;
+  running = false;
+  readState = { buffer: Buffer.alloc(0), expectingHeader: true, messageLength: 0 };
+  onDataCallback = null;
+  onStatusCallback = null;
+  reconnectTimer = null;
+  pingHandle = null;
+  pendingNonce = null;
+  auditStream = null;
+  hmacKey;
+  constructor(options) {
+    this.options = options;
+    this.hmacKey = deriveHMACKey2(options.password);
   }
-  if (state.logStream) {
-    state.logStream.end();
-    state.logStream = null;
+  setOnData(cb) {
+    this.onDataCallback = cb;
   }
-  if (state.keypressHandler) {
-    process.stdin.removeListener("keypress", state.keypressHandler);
-    state.keypressHandler = null;
+  setOnStatus(cb) {
+    this.onStatusCallback = cb;
   }
-  process.stdout.removeListener("resize", onResize);
-  state.running = false;
-  state.logging = false;
-  if (process.stdin.isTTY) process.stdin.setRawMode(false);
-  process.stdin.pause();
-  if (state.mouseEnabled) {
-    process.stdout.write("\x1B[?1000l");
+  async connect() {
+    if (this.options.auditLog) {
+      try {
+        fs3.mkdirSync(this.options.auditLog, { recursive: true });
+        const logFile = `${this.options.auditLog}/p2p-client-audit.log`;
+        this.auditStream = fs3.createWriteStream(logFile, { flags: "a" });
+      } catch {
+        console.log(chalk7.yellow("Warning: could not open audit log"));
+      }
+    }
+    return new Promise((resolve, reject) => {
+      const useTLS = !!this.options.tls;
+      if (useTLS) {
+        const tlsOptions = {
+          host: this.options.host,
+          port: this.options.port,
+          rejectUnauthorized: !this.options.tlsInsecure
+        };
+        if (this.options.tlsCA) {
+          tlsOptions.ca = fs3.readFileSync(this.options.tlsCA);
+        }
+        this.socket = tls2.connect(tlsOptions, () => {
+          this.status("Connecting...");
+        });
+      } else {
+        this.socket = new net2.Socket();
+        this.socket.on("data", (data) => this.onData(data));
+        this.socket.on("close", () => this.onClose());
+        this.socket.on("error", (err) => this.onError(err));
+        this.socket.on("timeout", () => this.onTimeout());
+        this.socket.setTimeout(1e4);
+        this.socket.connect(this.options.port, this.options.host, () => {
+          this.status("Connecting...");
+        });
+        this.socket.once("error", (err) => {
+          reject(err);
+        });
+      }
+      this.socket.on("data", (data) => this.onData(data));
+      this.socket.on("close", () => this.onClose());
+      this.socket.on("error", (err) => this.onError(err));
+      this.socket.on("timeout", () => this.onTimeout());
+    });
   }
-  process.stdout.write("\x1B[?25h");
-  process.stdout.write("\x1B[?1049l");
-  process.stdout.write("\x1B[2J\x1B[H");
-  process.exit(0);
-}
-
-// src/splash.ts
-import chalk6 from "chalk";
-var MAXV = 36;
-var CHAR_RAMP = [" ", ".", "`", ",", ":", ";", "+", "*", "?", "%", "#", "@"];
-var palette = [
-  "#0a0505",
-  "#1a0806",
-  "#2a0b06",
-  "#3f1004",
-  "#591404",
-  "#791804",
-  "#9e1c04",
-  "#c92004",
-  "#d63004",
-  "#e34004",
-  "#f05004",
-  "#fd6004",
-  "#ff7004",
-  "#ff8004",
-  "#ff9004",
-  "#ffa004",
-  "#ffb004",
-  "#ffc004",
-  "#ffd004",
-  "#ffe004",
-  "#fff004",
-  "#fff820",
-  "#ffff40",
-  "#ffff60",
-  "#ffff80",
-  "#ffffa0",
-  "#ffffc0",
-  "#ffffe0",
-  "#ffffff",
-  "#ffffff",
-  "#ffffff",
-  "#ffffff",
-  "#ffffff",
-  "#ffffff",
-  "#ffffff",
-  "#ffffff"
-];
-function getRgb(hex) {
-  const r = parseInt(hex.slice(1, 3), 16);
-  const g = parseInt(hex.slice(3, 5), 16);
-  const b = parseInt(hex.slice(5, 7), 16);
-  return { r, g, b };
-}
-var rgbPalette = palette.map(getRgb);
-function getChar(val) {
-  const idx = Math.min(CHAR_RAMP.length - 1, Math.floor(val / (MAXV + 1) * CHAR_RAMP.length));
-  return CHAR_RAMP[idx];
-}
-async function showSplash() {
-  const cols = 60;
-  const rows = 15;
-  let fire = new Uint8Array(cols * rows);
-  process.stdout.write("\x1B[2J");
-  const termRows = process.stdout.rows || 24;
-  const termCols = process.stdout.columns || 80;
-  const startRow = Math.max(0, Math.floor((termRows - rows) / 2));
-  const startCol = Math.max(0, Math.floor((termCols - cols) / 2));
-  return new Promise((resolve) => {
-    const interval = setInterval(() => {
-      for (let x = 0; x < cols; x++) {
-        fire[(rows - 1) * cols + x] = MAXV - Math.floor(Math.random() * 4);
+  disconnect() {
+    this.running = false;
+    if (this.reconnectTimer) {
+      clearTimeout(this.reconnectTimer);
+      this.reconnectTimer = null;
+    }
+    if (this.pingHandle) {
+      clearInterval(this.pingHandle);
+      this.pingHandle = null;
+    }
+    if (this.socket) {
+      try {
+        this.sendSigned(encodeDisconnect("Client closing"));
+      } catch {
       }
-      for (let y = rows - 1; y >= 1; y--) {
-        for (let x = 0; x < cols; x++) {
-          const src = y * cols + x;
-          const val = fire[src];
-          if (val === 0) {
-            fire[(y - 1) * cols + x] = 0;
-            continue;
-          }
-          const decay = Math.floor(Math.random() * 3);
-          const drift = Math.floor(Math.random() * 3) - 1;
-          let nx = x + drift;
-          if (nx < 0) nx = 0;
-          else if (nx >= cols) nx = cols - 1;
-          fire[(y - 1) * cols + nx] = Math.max(0, val - decay);
+      this.socket.destroy();
+      this.socket = null;
+    }
+    if (this.auditStream) {
+      this.auditStream.end();
+      this.auditStream = null;
+    }
+    this.status("Disconnected");
+  }
+  onData(data) {
+    this.readState.buffer = Buffer.concat([this.readState.buffer, data]);
+    while (this.readState.buffer.length > 0) {
+      if (this.readState.expectingHeader) {
+        if (this.readState.buffer.length >= 4) {
+          this.readState.messageLength = this.readState.buffer.readUInt32BE(0);
+          this.readState.buffer = this.readState.buffer.subarray(4);
+          this.readState.expectingHeader = false;
+        } else {
+          break;
         }
       }
-      let output = "";
-      for (let i = 0; i < startRow; i++) output += "\n";
-      for (let y = 0; y < rows; y++) {
-        output += " ".repeat(startCol);
-        for (let x = 0; x < cols; x++) {
-          const v = fire[y * cols + x];
-          const color = rgbPalette[Math.min(v, rgbPalette.length - 1)];
-          output += chalk6.rgb(color.r, color.g, color.b)(getChar(v));
+      if (!this.readState.expectingHeader) {
+        if (this.readState.buffer.length >= this.readState.messageLength) {
+          const body = this.readState.buffer.subarray(0, this.readState.messageLength);
+          this.readState.buffer = this.readState.buffer.subarray(this.readState.messageLength);
+          this.readState.expectingHeader = true;
+          this.handleMessage(body);
+        } else {
+          break;
         }
-        output += "\n";
       }
-      output += " ".repeat(Math.max(0, startCol + (cols - 45) / 2)) + chalk6.bold.white("\u{1F525} pyre \u2014 system monitor (warming up sensors...)\n");
-      output += " ".repeat(Math.max(0, startCol + (cols - 25) / 2)) + chalk6.dim("[Press Enter to continue]");
-      process.stdout.write(`\x1B[H${output}`);
-    }, 65);
-    const onEnter = () => {
-      process.stdin.removeListener("data", onEnter);
-      clearInterval(interval);
-      process.stdout.write("\x1B[2J\x1B[H");
-      resolve();
-    };
-    process.stdin.setRawMode(true);
-    process.stdin.resume();
-    process.stdin.on("data", onEnter);
-    setTimeout(onEnter, 5e3);
-  });
-}
-
-// src/p2p/server.ts
-import net from "net";
-import tls from "tls";
-import fs2 from "fs";
-import crypto2 from "crypto";
-import chalk7 from "chalk";
-
-// src/p2p/protocol.ts
-import crypto from "crypto";
-var HEADER_SIZE = 4;
-var MAX_MESSAGE_SIZE = 16 * 1024 * 1024;
-var HMAC_ALGO = "sha256";
-function buildMessage(kind, payload, hmac) {
-  const envelope = { kind, payload };
-  if (hmac) envelope.hmac = hmac;
-  const body = Buffer.from(JSON.stringify(envelope), "utf-8");
-  const header2 = Buffer.alloc(HEADER_SIZE);
-  header2.writeUInt32BE(body.length, 0);
-  return Buffer.concat([header2, body]);
-}
-function generateNonce() {
-  return crypto.randomBytes(32).toString("hex");
-}
-function hashPassword(password, nonce) {
-  return crypto.createHash("sha256").update(`${password}:${nonce}`).digest("hex");
-}
-function computeHMAC(body, key) {
-  if (!key) return void 0;
-  return crypto.createHmac(HMAC_ALGO, key).update(body).digest("hex");
-}
-function verifyHMAC(body, expectedHmac, key) {
-  if (!key) return expectedHmac === void 0;
-  if (!expectedHmac) return false;
-  try {
-    const parsed = JSON.parse(body);
-    const payloadWithoutHmac = { ...parsed, hmac: void 0 };
-    const canonical = JSON.stringify(payloadWithoutHmac);
-    const computed = crypto.createHmac(HMAC_ALGO, key).update(canonical).digest("hex");
-    return crypto.timingSafeEqual(Buffer.from(computed), Buffer.from(expectedHmac));
-  } catch {
-    return false;
+    }
   }
-}
-function encodeDisconnect(reason) {
-  return buildMessage("disconnect", { reason });
-}
-function decodeMessage(buf) {
-  const str = buf.toString("utf-8");
-  const msg = JSON.parse(str);
-  return msg;
-}
-function signMessage(kind, payload, key) {
-  const envelope = { kind, payload };
-  const bodyJson = JSON.stringify(envelope);
-  const hmac = computeHMAC(bodyJson, key);
-  return buildMessage(kind, payload, hmac);
-}
-
-// src/p2p/server.ts
-var HEADER_SIZE2 = 4;
-var DEFAULT_RATE_LIMIT_MAX = 5;
-var DEFAULT_RATE_LIMIT_WINDOW = 6e4;
-var HMAC_KEY_LENGTH = 32;
-function readMessageFromPeer(peer) {
-  while (peer.readBuffer.length > 0) {
-    if (peer.readExpectingHeader) {
-      if (peer.readBuffer.length >= HEADER_SIZE2) {
-        peer.readMessageLength = peer.readBuffer.readUInt32BE(0);
-        peer.readBuffer = peer.readBuffer.subarray(HEADER_SIZE2);
-        peer.readExpectingHeader = false;
-      } else {
-        break;
+  handleMessage(body) {
+    try {
+      const raw = body.toString("utf-8");
+      const msg = decodeMessage(body);
+      if (!verifyHMAC(raw, msg.hmac ?? "", this.hmacKey)) {
+        this.status("Message integrity check failed");
+        return;
       }
-    }
-    if (!peer.readExpectingHeader) {
-      if (peer.readBuffer.length >= peer.readMessageLength) {
-        const body = peer.readBuffer.subarray(0, peer.readMessageLength);
-        peer.readBuffer = peer.readBuffer.subarray(peer.readMessageLength);
-        peer.readExpectingHeader = true;
-        return body;
-      } else {
-        break;
+      switch (msg.kind) {
+        case "challenge":
+          const challengePayload = msg.payload;
+          if (challengePayload.nonce) {
+            this.pendingNonce = challengePayload.nonce;
+            const passwordHash = hashPassword(this.options.password, challengePayload.nonce);
+            this.sendSigned(signMessage("auth", { passwordHash, nonce: challengePayload.nonce }, this.hmacKey));
+            this.status("Authenticating...");
+          }
+          break;
+        case "auth-ok":
+          this.status("Authenticated \u2014 receiving live data");
+          this.startPing();
+          break;
+        case "auth-fail":
+          const failPayload = msg.payload;
+          this.status(`Authentication failed: ${failPayload.reason || "unknown"}`);
+          this.disconnect();
+          break;
+        case "data":
+          if (this.onDataCallback) {
+            const dataPayload = msg.payload;
+            if (dataPayload.stats) {
+              this.onDataCallback(dataPayload.stats);
+            }
+          }
+          break;
+        case "ping":
+          if (this.socket && !this.socket.destroyed) {
+            const ts = msg.payload.ts;
+            this.sendSigned(signMessage("pong", { ts }, this.hmacKey));
+          }
+          break;
+        case "pong":
+          break;
+        case "disconnect":
+          const disconnectPayload = msg.payload;
+          this.status(`Server disconnected: ${disconnectPayload.reason || "unknown"}`);
+          this.disconnect();
+          break;
+        default:
+          break;
       }
+    } catch {
     }
   }
-  return null;
-}
-function isIPAllowed(ip, allowedIPs, deniedIPs) {
-  for (const denied of deniedIPs) {
-    if (ip === denied || ip.startsWith(denied)) {
-      return false;
+  sendSigned(message) {
+    if (this.socket && !this.socket.destroyed) {
+      this.socket.write(message);
     }
   }
-  if (allowedIPs.length === 0) {
-    return true;
+  startPing() {
+    this.pingHandle = setInterval(() => {
+      if (this.socket && !this.socket.destroyed) {
+        this.sendSigned(signMessage("ping", { ts: Date.now() }, this.hmacKey));
+      }
+    }, 15e3);
   }
-  for (const allowed of allowedIPs) {
-    if (ip === allowed || ip.startsWith(allowed)) {
-      return true;
+  onClose() {
+    if (this.running) {
+      this.status("Connection closed \u2014 reconnecting in 3s");
+      this.reconnectTimer = setTimeout(() => {
+        if (this.running) this.connect().catch(() => {
+        });
+      }, 3e3);
     }
   }
-  return false;
-}
-function deriveHMACKey(password) {
-  return crypto2.createHash("sha256").update(password).digest("hex").slice(0, HMAC_KEY_LENGTH);
-}
-var P2PServer = class {
-  server = null;
-  peers = /* @__PURE__ */ new Map();
-  options;
-  running = false;
-  rateLimitMap = /* @__PURE__ */ new Map();
-  auditStream = null;
-  hmacKey;
-  constructor(options) {
-    this.options = options;
-    this.hmacKey = deriveHMACKey(options.password);
-  }
-  get info() {
-    return {
-      host: this.options.host,
-      port: this.options.port,
-      peersConnected: this.peers.size
-    };
-  }
-  async start() {
-    if (this.options.auditLog) {
-      try {
-        fs2.mkdirSync(this.options.auditLog, { recursive: true });
-        const logFile = `${this.options.auditLog}/p2p-audit.log`;
-        this.auditStream = fs2.createWriteStream(logFile, { flags: "a" });
-      } catch {
-        console.log(chalk7.yellow("Warning: could not open audit log"));
-      }
+  onError(err) {
+    const code = err.code;
+    if (code === "ECONNREFUSED") {
+      this.status("Connection refused \u2014 is the server running?");
+    } else if (code === "ETIMEDOUT") {
+      this.status("Connection timed out");
+    } else if (code === "UNABLE_TO_VERIFY_LEAF_SIGNATURE") {
+      this.status("TLS certificate verification failed \u2014 use --p2p-insecure to skip");
+    } else {
+      this.status(`Connection error: ${err.message}`);
     }
-    return new Promise((resolve, reject) => {
-      const useTLS = !!(this.options.tlsCert && this.options.tlsKey);
-      if (useTLS) {
-        const tlsOptions = {
-          key: fs2.readFileSync(this.options.tlsKey),
-          cert: fs2.readFileSync(this.options.tlsCert)
-        };
-        if (this.options.tlsCA) {
-          tlsOptions.ca = fs2.readFileSync(this.options.tlsCA);
-        }
-        this.server = tls.createServer(tlsOptions, (socket) => this.onConnection(socket));
-      } else {
-        this.server = net.createServer((socket) => this.onConnection(socket));
-      }
-      this.server.on("error", (err) => reject(err));
-      this.server.listen(this.options.port, this.options.host, () => {
-        this.running = true;
-        const addr = this.server?.address();
-        const bound = addr ? typeof addr === "object" ? `${addr.address}:${addr.port}` : String(addr) : "unknown";
-        const protocol = useTLS ? "TLS" : "TCP";
-        console.log(chalk7.green(`P2P server listening on ${bound} (${protocol})`));
-        console.log(chalk7.dim(`  Password: ${this.options.password}`));
-        console.log(chalk7.dim(`  Interval: ${this.options.intervalMs}ms`));
-        const allowedIPs = this.options.allowedIPs ?? [];
-        const deniedIPs = this.options.deniedIPs ?? [];
-        if (allowedIPs.length > 0) console.log(chalk7.dim(`  Allowed IPs: ${allowedIPs.join(", ")}`));
-        if (deniedIPs.length > 0) console.log(chalk7.dim(`  Denied IPs: ${deniedIPs.join(", ")}`));
-        resolve();
-      });
-    });
   }
-  stop() {
-    this.running = false;
-    for (const peer of this.peers.values()) {
-      this.disconnectPeer(peer, "Server shutting down");
-    }
-    this.peers.clear();
-    this.rateLimitMap.clear();
-    if (this.server) {
-      this.server.close();
-      this.server = null;
-    }
-    if (this.auditStream) {
-      this.auditStream.end();
-      this.auditStream = null;
+  onTimeout() {
+    this.status("Connection timed out");
+    this.disconnect();
+  }
+  status(msg) {
+    if (this.onStatusCallback) {
+      this.onStatusCallback(msg);
     }
   }
-  audit(ip, event, detail) {
+  audit(event, detail) {
     if (!this.auditStream) return;
     const ts = (/* @__PURE__ */ new Date()).toISOString();
+    const ip = this.options.host;
     this.auditStream.write(`${ts} ${ip} ${event} ${detail}
 `);
   }
-  getPeerIP(socket) {
-    const addr = socket.remoteAddress;
-    if (!addr) return "unknown";
-    if (addr.startsWith("::ffff:")) {
-      return addr.slice(7);
-    }
-    return addr;
-  }
-  checkRateLimit(ip) {
-    const maxAttempts = this.options.rateLimitMaxAttempts ?? DEFAULT_RATE_LIMIT_MAX;
-    const windowMs = this.options.rateLimitWindowMs ?? DEFAULT_RATE_LIMIT_WINDOW;
-    const now = Date.now();
-    const entry = this.rateLimitMap.get(ip);
-    if (!entry) {
-      this.rateLimitMap.set(ip, { attempts: 1, firstAttempt: now });
-      return true;
-    }
-    if (now - entry.firstAttempt > windowMs) {
-      this.rateLimitMap.set(ip, { attempts: 1, firstAttempt: now });
-      return true;
-    }
-    entry.attempts++;
-    if (entry.attempts > maxAttempts) {
-      return false;
-    }
-    return true;
-  }
-  cleanupRateLimit(ip) {
-    this.rateLimitMap.delete(ip);
+};
+function deriveHMACKey2(password) {
+  return crypto3.createHash("sha256").update(password).digest("hex").slice(0, 32);
+}
+
+// src/live/input.ts
+function handleInputModeKey(str, key) {
+  if (key.name === "escape") {
+    state.inputMode = null;
+    state.inputBuffer = "";
+    render();
+    return;
   }
-  onConnection(socket) {
-    const ip = this.getPeerIP(socket);
-    const allowedIPs = this.options.allowedIPs ?? [];
-    const deniedIPs = this.options.deniedIPs ?? [];
-    if (!isIPAllowed(ip, allowedIPs, deniedIPs)) {
-      this.audit(ip, "BLOCKED", "IP not allowed");
-      console.log(chalk7.yellow(`Blocked IP: ${ip}`));
-      socket.destroy();
-      return;
-    }
-    if (!this.checkRateLimit(ip)) {
-      this.audit(ip, "RATE_LIMITED", "Too many auth attempts");
-      console.log(chalk7.yellow(`Rate limit exceeded for IP: ${ip}`));
-      socket.destroy();
-      return;
-    }
-    const peer = {
-      socket,
-      authenticated: false,
-      intervalHandle: null,
-      pingHandle: null,
-      readBuffer: Buffer.alloc(0),
-      readExpectingHeader: true,
-      readMessageLength: 0,
-      ip,
-      pendingNonce: null
-    };
-    this.peers.set(socket, peer);
-    const remoteAddr = socket.remoteAddress ? `${socket.remoteAddress}:${socket.remotePort}` : "unknown";
-    console.log(chalk7.cyan(`Peer connected: ${remoteAddr}`));
-    this.audit(ip, "CONNECT", remoteAddr);
-    socket.on("data", (data) => this.onData(peer, data));
-    socket.on("close", () => this.onPeerClose(peer));
-    socket.on("error", (err) => this.onPeerError(peer, err));
-    socket.setTimeout(3e4);
-    socket.on("timeout", () => {
-      if (!peer.authenticated) {
-        this.disconnectPeer(peer, "Authentication timeout");
+  if (state.inputMode === "customizer") {
+    const themesList = Object.keys(THEMES);
+    if (key.name === "up" || str === "k") {
+      state.customizerIndex = (state.customizerIndex - 1 + state.CUSTOMIZER_OPTIONS.length) % state.CUSTOMIZER_OPTIONS.length;
+    } else if (key.name === "down" || str === "j") {
+      state.customizerIndex = (state.customizerIndex + 1) % state.CUSTOMIZER_OPTIONS.length;
+    } else if (key.name === "return" || str === " ") {
+      const selected = state.CUSTOMIZER_OPTIONS[state.customizerIndex];
+      if (selected === "Theme") {
+        const nextIdx = (themesList.indexOf(state.currentTheme) + 1) % themesList.length;
+        state.currentTheme = themesList[nextIdx];
+      } else if (selected === "Toggle Tree View") {
+        state.treeView = !state.treeView;
+      } else if (selected === "Graph Mode") {
+        state.graphMode = state.graphMode === "spark" ? "bar" : "spark";
+      } else {
+        const itemKey = selected.replace("Toggle ", "").toLowerCase();
+        state.visiblePanels[itemKey] = !state.visiblePanels[itemKey];
       }
-    });
-    const nonce = generateNonce();
-    this.sendSigned(peer, signMessage("challenge", { nonce }, this.hmacKey));
-    peer.pendingNonce = nonce;
+    }
+    render();
+    return;
   }
-  onData(peer, data) {
-    peer.readBuffer = Buffer.concat([peer.readBuffer, data]);
-    if (!peer.authenticated) {
-      const body = readMessageFromPeer(peer);
-      if (body) {
-        this.handleAuthMessage(peer, body);
-      }
+  if (state.inputMode === "signal") {
+    if (key.name === "up" || str === "k") {
+      const idx = state.SIGNAL_OPTIONS.indexOf(state.inputBuffer);
+      state.inputBuffer = state.SIGNAL_OPTIONS[(idx - 1 + state.SIGNAL_OPTIONS.length) % state.SIGNAL_OPTIONS.length];
+    } else if (key.name === "down" || str === "j") {
+      const idx = state.SIGNAL_OPTIONS.indexOf(state.inputBuffer);
+      state.inputBuffer = state.SIGNAL_OPTIONS[(idx + 1) % state.SIGNAL_OPTIONS.length];
+    } else if (key.name === "return" || str === " ") {
+      killProcess(state.inputBuffer.trim(), state.inputBuffer.trim());
+      state.inputMode = null;
+      state.inputBuffer = "";
+      render();
       return;
     }
+    render();
+    return;
   }
-  handleAuthMessage(peer, body) {
-    try {
-      const raw = body.toString("utf-8");
-      const msg = decodeMessage(body);
-      if (msg.kind !== "auth") {
-        peer.socket.write(signMessage("auth-fail", { ok: false, reason: "Expected auth message first" }, this.hmacKey));
-        this.disconnectPeer(peer, "Expected auth message");
-        return;
-      }
-      const authPayload = msg.payload;
-      if (!authPayload.passwordHash || !authPayload.nonce) {
-        peer.socket.write(signMessage("auth-fail", { ok: false, reason: "Invalid auth payload" }, this.hmacKey));
-        this.disconnectPeer(peer, "Invalid auth payload");
-        return;
-      }
-      if (peer.pendingNonce && authPayload.nonce !== peer.pendingNonce) {
-        this.audit(peer.ip, "AUTH_FAIL", "Nonce mismatch");
-        peer.socket.write(signMessage("auth-fail", { ok: false, reason: "Invalid nonce" }, this.hmacKey));
-        this.disconnectPeer(peer, "Invalid nonce");
-        return;
-      }
-      const expectedHash = hashPassword(this.options.password, authPayload.nonce);
-      if (authPayload.passwordHash !== expectedHash) {
-        this.audit(peer.ip, "AUTH_FAIL", "Invalid password hash");
-        peer.socket.write(signMessage("auth-fail", { ok: false, reason: "Invalid password" }, this.hmacKey));
-        this.disconnectPeer(peer, "Authentication failed");
-        return;
+  if (state.inputMode === "p2p") {
+    if (key.name === "escape") {
+      state.inputMode = null;
+      state.inputBuffer = "";
+      render();
+      return;
+    }
+    if (key.name === "return") {
+      const password = state.inputBuffer.trim();
+      if (password) {
+        state.p2pPassword = password;
+        startP2PServerFromTUI();
       }
-      peer.authenticated = true;
-      this.cleanupRateLimit(peer.ip);
-      peer.pendingNonce = null;
-      peer.socket.write(signMessage("auth-ok", { ok: true }, this.hmacKey));
-      console.log(chalk7.green(`Peer authenticated: ${peer.socket.remoteAddress}`));
-      this.audit(peer.ip, "AUTH_OK", "Challenge-response successful");
-      this.startDataStream(peer);
-      this.startPing(peer);
-    } catch {
-      peer.socket.write(signMessage("auth-fail", { ok: false, reason: "Invalid message format" }, this.hmacKey));
-      this.disconnectPeer(peer, "Invalid message format");
+      state.inputMode = null;
+      state.inputBuffer = "";
+      render();
+      return;
     }
-  }
-  sendSigned(peer, message) {
-    if (!peer.socket.destroyed) {
-      peer.socket.write(message);
+    if (key.name === "backspace") {
+      state.inputBuffer = state.inputBuffer.slice(0, -1);
+      render();
+      return;
     }
+    if (str && str.length === 1 && !key.ctrl && !key.meta) {
+      state.inputBuffer += str;
+      render();
+    }
+    return;
   }
-  startDataStream(peer) {
-    const send = async () => {
-      if (!peer.authenticated || peer.socket.destroyed) return;
-      try {
-        const data = await collectAll({ detailed: this.options.detailed });
-        this.sendSigned(peer, signMessage("data", { stats: data }, this.hmacKey));
-      } catch {
-      }
-    };
-    send();
-    peer.intervalHandle = setInterval(send, this.options.intervalMs);
+  if (key.name === "return") {
+    if (state.inputMode === "filter") {
+      state.processFilter = state.inputBuffer.trim();
+      setStatus(state.processFilter ? `Filtering: "${state.processFilter}"` : "Filter cleared");
+    } else if (state.inputMode === "kill") {
+      killProcess(state.inputBuffer.trim());
+    }
+    state.inputMode = null;
+    state.inputBuffer = "";
+    render();
+    return;
   }
-  startPing(peer) {
-    peer.pingHandle = setInterval(() => {
-      if (peer.socket.destroyed) return;
-      this.sendSigned(peer, signMessage("ping", { ts: Date.now() }, this.hmacKey));
-    }, 5e3);
+  if (key.name === "backspace") {
+    state.inputBuffer = state.inputBuffer.slice(0, -1);
+    render();
+    return;
   }
-  onPeerClose(peer) {
-    this.cleanupPeer(peer);
-    console.log(chalk7.yellow(`Peer disconnected: ${peer.socket.remoteAddress}`));
-    this.audit(peer.ip, "DISCONNECT", "Peer closed connection");
+  if (str && str.length === 1 && !key.ctrl && !key.meta) {
+    state.inputBuffer += str;
+    render();
   }
-  onPeerError(peer, err) {
-    const code = err.code;
-    if (code === "ECONNRESET") {
-      console.log(chalk7.yellow(`Peer connection reset: ${peer.socket.remoteAddress}`));
-      this.audit(peer.ip, "ERROR", "Connection reset");
-    } else {
-      console.log(chalk7.red(`Peer error: ${err.message}`));
-      this.audit(peer.ip, "ERROR", err.message);
-    }
-    this.cleanupPeer(peer);
+}
+function killProcess(pidStr, signal = "SIGTERM") {
+  const pid = parseInt(pidStr, 10);
+  if (!pid || pid <= 0) {
+    setStatus(`Invalid PID: ${pidStr}`);
+    return;
   }
-  disconnectPeer(peer, reason) {
-    try {
-      this.sendSigned(peer, signMessage("disconnect", { reason }, this.hmacKey));
-    } catch {
-    }
-    peer.socket.destroy();
+  try {
+    process.kill(pid, signal);
+    setStatus(`Sent ${signal} to PID ${pid}`);
+  } catch (err) {
+    setStatus(`Failed to send ${signal} to ${pid}: ${err.message}`);
   }
-  cleanupPeer(peer) {
-    if (peer.intervalHandle) {
-      clearInterval(peer.intervalHandle);
-      peer.intervalHandle = null;
-    }
-    if (peer.pingHandle) {
-      clearInterval(peer.pingHandle);
-      peer.pingHandle = null;
-    }
-    this.peers.delete(peer.socket);
+}
+async function startP2PServerFromTUI() {
+  if (state.p2pServerRunning) return;
+  try {
+    const server = await startP2PServer({
+      host: "0.0.0.0",
+      port: state.p2pPort,
+      password: state.p2pPassword,
+      intervalMs: state.interval * 1e3,
+      detailed: state.detailed,
+      onLog: (msg) => setStatus(msg, 5e3),
+      onPeerEvent: (evt) => {
+        state.p2pEvents.push(evt);
+        if (state.p2pEvents.length > 200) state.p2pEvents.shift();
+      }
+    });
+    state.p2pServer = server;
+    state.p2pServerRunning = true;
+    state.p2pBind = server.boundAddress || "0.0.0.0";
+    state.p2pEvents = [];
+    setStatus(`P2P server started on ${state.p2pBind}:${state.p2pPort}`);
+    render();
+  } catch (err) {
+    setStatus(`P2P server failed: ${err.message}`);
+    state.p2pServerRunning = false;
+    state.p2pServer = null;
+    state.p2pBind = "";
+    render();
   }
-};
-
-// src/p2p/client.ts
-import net2 from "net";
-import tls2 from "tls";
-import fs3 from "fs";
-import crypto3 from "crypto";
-import chalk8 from "chalk";
-var P2PClient = class {
-  socket = null;
-  options;
-  running = false;
-  readState = { buffer: Buffer.alloc(0), expectingHeader: true, messageLength: 0 };
-  onDataCallback = null;
-  onStatusCallback = null;
-  reconnectTimer = null;
-  pingHandle = null;
-  pendingNonce = null;
-  auditStream = null;
-  hmacKey;
-  constructor(options) {
-    this.options = options;
-    this.hmacKey = deriveHMACKey2(options.password);
+}
+function syncP2PEvents() {
+  if (!state.p2pServer) return;
+  const history = state.p2pServer.peerEventHistory;
+  if (history && history !== state.p2pEvents) {
+    state.p2pEvents = history;
   }
-  setOnData(cb) {
-    this.onDataCallback = cb;
+}
+function stopP2PServer() {
+  if (!state.p2pServer) return;
+  try {
+    state.p2pServer.stop();
+  } catch {
   }
-  setOnStatus(cb) {
-    this.onStatusCallback = cb;
+  state.p2pServer = null;
+  state.p2pServerRunning = false;
+  setStatus("P2P server stopped");
+}
+function onResize() {
+  state.termWidth = process.stdout.columns || 80;
+  state.termHeight = process.stdout.rows || 24;
+  state.history.setMaxLen(Math.max(20, Math.min(200, state.termWidth - 30)));
+  render();
+}
+function restartTicker() {
+  if (state.intervalHandle) clearInterval(state.intervalHandle);
+  state.intervalHandle = setInterval(tick, state.interval * 1e3);
+}
+async function doWarmup() {
+  try {
+    const data = await collectAll({ detailed: state.detailed, processLimit: processRowBudget() });
+    state.lastData = data;
+    const temp = data.cpu.temperature ?? data.thermal.temperatures?.cpu_die ?? null;
+    state.history.push({
+      cpuUsage: data.cpu.usage,
+      memUsage: data.memory.usagePercent,
+      temp,
+      rxBytes: data.network.rxBytes,
+      txBytes: data.network.txBytes,
+      gpuUtil: data.gpu?.utilization,
+      powerWatts: data.power?.combinedWatts ?? data.power?.cpuWatts ?? 0,
+      rxPackets: data.network.rxPackets,
+      txPackets: data.network.txPackets,
+      connections: data.network.connections ?? 0
+    });
+    writeLogRow(data);
+    checkAlerts(data);
+    syncP2PEvents();
+  } catch {
   }
-  async connect() {
-    if (this.options.auditLog) {
-      try {
-        fs3.mkdirSync(this.options.auditLog, { recursive: true });
-        const logFile = `${this.options.auditLog}/p2p-client-audit.log`;
-        this.auditStream = fs3.createWriteStream(logFile, { flags: "a" });
-      } catch {
-        console.log(chalk8.yellow("Warning: could not open audit log"));
-      }
-    }
-    return new Promise((resolve, reject) => {
-      const useTLS = !!this.options.tls;
-      if (useTLS) {
-        const tlsOptions = {
-          host: this.options.host,
-          port: this.options.port,
-          rejectUnauthorized: !this.options.tlsInsecure
-        };
-        if (this.options.tlsCA) {
-          tlsOptions.ca = fs3.readFileSync(this.options.tlsCA);
-        }
-        this.socket = tls2.connect(tlsOptions, () => {
-          this.status("Connecting...");
-        });
-      } else {
-        this.socket = new net2.Socket();
-        this.socket.on("data", (data) => this.onData(data));
-        this.socket.on("close", () => this.onClose());
-        this.socket.on("error", (err) => this.onError(err));
-        this.socket.on("timeout", () => this.onTimeout());
-        this.socket.setTimeout(1e4);
-        this.socket.connect(this.options.port, this.options.host, () => {
-          this.status("Connecting...");
-        });
-        this.socket.once("error", (err) => {
-          reject(err);
-        });
-      }
-      this.socket.on("data", (data) => this.onData(data));
-      this.socket.on("close", () => this.onClose());
-      this.socket.on("error", (err) => this.onError(err));
-      this.socket.on("timeout", () => this.onTimeout());
+}
+async function tick() {
+  if (state.paused) return;
+  try {
+    const data = await collectAll({ detailed: state.detailed, processLimit: processRowBudget() });
+    state.lastData = data;
+    const temp = data.cpu.temperature ?? data.thermal.temperatures?.cpu_die ?? null;
+    state.history.push({
+      cpuUsage: data.cpu.usage,
+      memUsage: data.memory.usagePercent,
+      temp,
+      rxBytes: data.network.rxBytes,
+      txBytes: data.network.txBytes,
+      gpuUtil: data.gpu?.utilization,
+      powerWatts: data.power?.combinedWatts ?? data.power?.cpuWatts ?? 0,
+      rxPackets: data.network.rxPackets,
+      txPackets: data.network.txPackets,
+      connections: data.network.connections ?? 0
     });
+    writeLogRow(data);
+    checkAlerts(data);
+    syncP2PEvents();
+    render();
+  } catch {
   }
-  disconnect() {
-    this.running = false;
-    if (this.reconnectTimer) {
-      clearTimeout(this.reconnectTimer);
-      this.reconnectTimer = null;
+}
+async function startLive(opts2, splashPromise) {
+  if (state.running) return;
+  state.running = true;
+  state.paused = false;
+  state.detailed = !!opts2.detailed;
+  state.interval = opts2.interval;
+  if (opts2.exportDir) state.exportDir = opts2.exportDir;
+  state.termWidth = process.stdout.columns || 80;
+  state.termHeight = process.stdout.rows || 24;
+  state.history.reset();
+  state.history.setMaxLen(Math.max(20, Math.min(200, state.termWidth - 30)));
+  const warmupPromise = doWarmup();
+  if (splashPromise) {
+    await splashPromise;
+  }
+  process.stdout.write("\x1B[?1049h");
+  process.stdout.write("\x1B[?25l");
+  process.stdout.write("\x1B[2J\x1B[H");
+  process.title = "pyre";
+  if (state.mouseEnabled) {
+    process.stdout.write("\x1B[?1000h");
+  }
+  await warmupPromise;
+  render();
+  restartTicker();
+  if (opts2.autoLog) startLogging();
+  readline.emitKeypressEvents(process.stdin);
+  if (process.stdin.isTTY) process.stdin.setRawMode(true);
+  process.stdin.resume();
+  process.stdout.on("resize", onResize);
+  state.keypressHandler = (str, key) => {
+    if (!key) return;
+    if (key.ctrl && key.name === "c") {
+      stopLive();
+      return;
     }
-    if (this.pingHandle) {
-      clearInterval(this.pingHandle);
-      this.pingHandle = null;
+    if (state.inputMode) {
+      handleInputModeKey(str, key);
+      return;
     }
-    if (this.socket) {
-      try {
-        this.sendSigned(encodeDisconnect("Client closing"));
-      } catch {
-      }
-      this.socket.destroy();
-      this.socket = null;
+    if (key.mouse) {
+      handleMouseClick(key.mouse);
+      return;
     }
-    if (this.auditStream) {
-      this.auditStream.end();
-      this.auditStream = null;
+    if (key.sequence && key.sequence.startsWith("\x1B[M")) {
+      handleNormalMouse(key.sequence);
+      return;
     }
-    this.status("Disconnected");
-  }
-  onData(data) {
-    this.readState.buffer = Buffer.concat([this.readState.buffer, data]);
-    while (this.readState.buffer.length > 0) {
-      if (this.readState.expectingHeader) {
-        if (this.readState.buffer.length >= 4) {
-          this.readState.messageLength = this.readState.buffer.readUInt32BE(0);
-          this.readState.buffer = this.readState.buffer.subarray(4);
-          this.readState.expectingHeader = false;
-        } else {
-          break;
+    if (key.sequence && key.sequence.startsWith("\x1B[<")) {
+      handleSGRMouse(key.sequence);
+      return;
+    }
+    switch (key.sequence) {
+      case "+":
+        state.interval += 1;
+        restartTicker();
+        setStatus(`Interval set to ${state.interval}s`);
+        return;
+      case "-":
+        state.interval = Math.max(1, state.interval - 1);
+        restartTicker();
+        setStatus(`Interval set to ${state.interval}s`);
+        return;
+      case "/":
+        state.inputMode = "filter";
+        state.inputBuffer = state.processFilter;
+        render();
+        return;
+      case "0":
+      case "1":
+      case "2":
+      case "3":
+      case "4":
+      case "5":
+      case "6":
+      case "7":
+      case "8":
+      case "9": {
+        const tabMap = {
+          "0": "disk",
+          "1": "cpu",
+          "2": "mem",
+          "3": "gpu",
+          "4": "power",
+          "5": "battery",
+          "6": "thermal",
+          "7": "network",
+          "8": "packets",
+          "9": "tasks"
+        };
+        const panelId = tabMap[key.sequence];
+        if (panelId) {
+          state.activePanel = state.activePanel === panelId ? "grid" : panelId;
+          setStatus(state.activePanel === "grid" ? "Grid view" : `${panelId} panel`);
+          render();
         }
+        return;
       }
-      if (!this.readState.expectingHeader) {
-        if (this.readState.buffer.length >= this.readState.messageLength) {
-          const body = this.readState.buffer.subarray(0, this.readState.messageLength);
-          this.readState.buffer = this.readState.buffer.subarray(this.readState.messageLength);
-          this.readState.expectingHeader = true;
-          this.handleMessage(body);
-        } else {
-          break;
-        }
+      case "P": {
+        state.activePanel = state.activePanel === "process" ? "grid" : "process";
+        setStatus(state.activePanel === "grid" ? "Grid view" : "Process panel");
+        render();
+        return;
       }
     }
-  }
-  handleMessage(body) {
-    try {
-      const raw = body.toString("utf-8");
-      const msg = decodeMessage(body);
-      if (!verifyHMAC(raw, msg.hmac ?? "", this.hmacKey)) {
-        this.status("Message integrity check failed");
+    switch (key.name) {
+      case "r":
+        if (state.p2pServerRunning) {
+          stopP2PServer();
+          setStatus("P2P server stopped");
+          render();
+        } else {
+          state.inputMode = "p2p";
+          state.inputBuffer = state.p2pPassword;
+          render();
+        }
         return;
+      case "q":
+        stopLive();
+        break;
+      case "left": {
+        const currentIdx = state.PANEL_TABS.findIndex((t) => t.id === state.activePanel);
+        if (currentIdx > 0) {
+          state.activePanel = state.PANEL_TABS[currentIdx - 1].id;
+        } else if (currentIdx === -1) {
+          state.activePanel = state.PANEL_TABS[state.PANEL_TABS.length - 1].id;
+        }
+        setStatus(`Panel: ${state.activePanel}`);
+        render();
+        break;
       }
-      switch (msg.kind) {
-        case "challenge":
-          const challengePayload = msg.payload;
-          if (challengePayload.nonce) {
-            this.pendingNonce = challengePayload.nonce;
-            const passwordHash = hashPassword(this.options.password, challengePayload.nonce);
-            this.sendSigned(signMessage("auth", { passwordHash, nonce: challengePayload.nonce }, this.hmacKey));
-            this.status("Authenticating...");
-          }
-          break;
-        case "auth-ok":
-          this.status("Authenticated \u2014 receiving live data");
-          this.startPing();
-          break;
-        case "auth-fail":
-          const failPayload = msg.payload;
-          this.status(`Authentication failed: ${failPayload.reason || "unknown"}`);
-          this.disconnect();
-          break;
-        case "data":
-          if (this.onDataCallback) {
-            const dataPayload = msg.payload;
-            if (dataPayload.stats) {
-              this.onDataCallback(dataPayload.stats);
-            }
-          }
-          break;
-        case "ping":
-          if (this.socket && !this.socket.destroyed) {
-            const ts = msg.payload.ts;
-            this.sendSigned(signMessage("pong", { ts }, this.hmacKey));
+      case "right": {
+        const currentIdx = state.PANEL_TABS.findIndex((t) => t.id === state.activePanel);
+        if (currentIdx < state.PANEL_TABS.length - 1) {
+          state.activePanel = state.PANEL_TABS[currentIdx + 1].id;
+        } else if (currentIdx === -1) {
+          state.activePanel = state.PANEL_TABS[0].id;
+        }
+        setStatus(`Panel: ${state.activePanel}`);
+        render();
+        break;
+      }
+      case "c":
+        state.inputMode = "customizer";
+        state.customizerIndex = 0;
+        render();
+        break;
+      case "p":
+        state.paused = !state.paused;
+        setStatus(state.paused ? "Paused" : "Resumed");
+        render();
+        break;
+      case "g":
+        state.showGraphs = !state.showGraphs;
+        render();
+        break;
+      case "b":
+        state.graphMode = state.graphMode === "spark" ? "bar" : "spark";
+        setStatus(`Graph mode: ${state.graphMode}`);
+        render();
+        break;
+      case "d":
+        state.detailed = !state.detailed;
+        setStatus(`Detailed sensor mode: ${state.detailed ? "on" : "off"}`);
+        break;
+      case "s":
+        const sortCycle = ["cpu", "mem", "pid", "user", "command", "state", "threads", "runtime"];
+        const curIdx = sortCycle.indexOf(state.sortMode);
+        state.sortMode = sortCycle[(curIdx + 1) % sortCycle.length];
+        setStatus(`Sorting by ${state.sortMode}`);
+        render();
+        break;
+      case "k":
+        state.inputMode = "kill";
+        state.inputBuffer = "";
+        render();
+        break;
+      case "S":
+        state.inputMode = "signal";
+        state.inputBuffer = "SIGTERM";
+        render();
+        break;
+      case "t":
+        state.treeView = !state.treeView;
+        setStatus(state.treeView ? "Tree view enabled" : "Flat view enabled");
+        render();
+        break;
+      case "e":
+        exportSnapshot();
+        render();
+        break;
+      case "l":
+        toggleLogging();
+        render();
+        break;
+      case "f":
+        state.exportFormat = state.exportFormat === "json" ? "csv" : state.exportFormat === "csv" ? "tsv" : "json";
+        setStatus(`Export format: ${state.exportFormat}`);
+        render();
+        break;
+      case "tab":
+        cycleTab(1);
+        break;
+      case "left":
+        cycleTab(-1);
+        break;
+      case "right":
+        cycleTab(1);
+        break;
+      default:
+        if (str && str.length === 1) {
+          const tabId = tabKeyToId(str);
+          if (tabId) {
+            state.activePanel = tabId;
+            setStatus(`Panel: ${tabId.toUpperCase()}`);
+            render();
           }
-          break;
-        case "pong":
-          break;
-        case "disconnect":
-          const disconnectPayload = msg.payload;
-          this.status(`Server disconnected: ${disconnectPayload.reason || "unknown"}`);
-          this.disconnect();
-          break;
-        default:
-          break;
-      }
-    } catch {
+        }
     }
+  };
+  process.stdin.on("keypress", state.keypressHandler);
+  process.once("SIGINT", () => stopLive());
+}
+function tabKeyToId(str) {
+  const map = { "1": "cpu", "2": "mem", "3": "gpu", "4": "power", "5": "battery", "6": "thermal", "7": "network", "8": "packets", "9": "tasks", "0": "disk", "p": "process", "r": "p2p" };
+  return map[str] ?? null;
+}
+function cycleTab(direction) {
+  const tabs = state.PANEL_TABS.map((t) => t.id);
+  const current = state.activePanel === "grid" ? -1 : tabs.indexOf(state.activePanel);
+  const next = (current + direction + tabs.length) % tabs.length;
+  state.activePanel = tabs[next];
+  setStatus(`Panel: ${state.activePanel.toUpperCase()}`);
+  render();
+}
+function handleNormalMouse(seq) {
+  if (seq.length < 6) return;
+  const cb = seq.charCodeAt(3) - 32;
+  const cx = seq.charCodeAt(4) - 32;
+  const cy = seq.charCodeAt(5) - 32;
+  if (cb === 0 || cb === 1) {
+    handleMouseClick(cy, cx);
   }
-  sendSigned(message) {
-    if (this.socket && !this.socket.destroyed) {
-      this.socket.write(message);
-    }
+}
+function handleSGRMouse(seq) {
+  const match = seq.match(/^\x1b\[<(\d+);(\d+);(\d+)([Mm])/);
+  if (!match) return;
+  const button = parseInt(match[1]);
+  const cx = parseInt(match[2]);
+  const cy = parseInt(match[3]);
+  if (button === 0 || button === 1) {
+    handleMouseClick(cy, cx);
   }
-  startPing() {
-    this.pingHandle = setInterval(() => {
-      if (this.socket && !this.socket.destroyed) {
-        this.sendSigned(signMessage("ping", { ts: Date.now() }, this.hmacKey));
-      }
-    }, 15e3);
+}
+function handleMouseClick(y, x) {
+  if (y !== TAB_BAR_ROW) return;
+  const hitboxes = getTabHitboxes();
+  const hit = hitboxes.find((h) => x >= h.start && x < h.end);
+  if (hit) {
+    state.activePanel = state.activePanel === hit.id ? "grid" : hit.id;
+    setStatus(state.activePanel === "grid" ? "Grid view" : `Panel: ${hit.id.toUpperCase()}`);
+    render();
   }
-  onClose() {
-    if (this.running) {
-      this.status("Connection closed \u2014 reconnecting in 3s");
-      this.reconnectTimer = setTimeout(() => {
-        if (this.running) this.connect().catch(() => {
-        });
-      }, 3e3);
-    }
+}
+function stopLive() {
+  if (state.intervalHandle) {
+    clearInterval(state.intervalHandle);
+    state.intervalHandle = null;
   }
-  onError(err) {
-    const code = err.code;
-    if (code === "ECONNREFUSED") {
-      this.status("Connection refused \u2014 is the server running?");
-    } else if (code === "ETIMEDOUT") {
-      this.status("Connection timed out");
-    } else if (code === "UNABLE_TO_VERIFY_LEAF_SIGNATURE") {
-      this.status("TLS certificate verification failed \u2014 use --p2p-insecure to skip");
-    } else {
-      this.status(`Connection error: ${err.message}`);
-    }
+  if (state.statusTimer) {
+    clearTimeout(state.statusTimer);
+    state.statusTimer = null;
   }
-  onTimeout() {
-    this.status("Connection timed out");
-    this.disconnect();
+  if (state.logStream) {
+    state.logStream.end();
+    state.logStream = null;
   }
-  status(msg) {
-    if (this.onStatusCallback) {
-      this.onStatusCallback(msg);
-    }
+  if (state.p2pServer) {
+    state.p2pServer.stop();
+    state.p2pServer = null;
+    state.p2pServerRunning = false;
   }
-  audit(event, detail) {
-    if (!this.auditStream) return;
-    const ts = (/* @__PURE__ */ new Date()).toISOString();
-    const ip = this.options.host;
-    this.auditStream.write(`${ts} ${ip} ${event} ${detail}
-`);
+  if (state.keypressHandler) {
+    process.stdin.removeListener("keypress", state.keypressHandler);
+    state.keypressHandler = null;
   }
-};
-function deriveHMACKey2(password) {
-  return crypto3.createHash("sha256").update(password).digest("hex").slice(0, 32);
+  process.stdout.removeListener("resize", onResize);
+  state.running = false;
+  state.logging = false;
+  if (process.stdin.isTTY) process.stdin.setRawMode(false);
+  process.stdin.pause();
+  if (state.mouseEnabled) {
+    process.stdout.write("\x1B[?1000l");
+  }
+  process.stdout.write("\x1B[?25h");
+  process.stdout.write("\x1B[?1049l");
+  process.stdout.write("\x1B[2J\x1B[H");
+  process.exit(0);
+}
+
+// src/splash.ts
+import chalk8 from "chalk";
+var MAXV = 36;
+var CHAR_RAMP = [" ", ".", "`", ",", ":", ";", "+", "*", "?", "%", "#", "@"];
+var palette = [
+  "#0a0505",
+  "#1a0806",
+  "#2a0b06",
+  "#3f1004",
+  "#591404",
+  "#791804",
+  "#9e1c04",
+  "#c92004",
+  "#d63004",
+  "#e34004",
+  "#f05004",
+  "#fd6004",
+  "#ff7004",
+  "#ff8004",
+  "#ff9004",
+  "#ffa004",
+  "#ffb004",
+  "#ffc004",
+  "#ffd004",
+  "#ffe004",
+  "#fff004",
+  "#fff820",
+  "#ffff40",
+  "#ffff60",
+  "#ffff80",
+  "#ffffa0",
+  "#ffffc0",
+  "#ffffe0",
+  "#ffffff",
+  "#ffffff",
+  "#ffffff",
+  "#ffffff",
+  "#ffffff",
+  "#ffffff",
+  "#ffffff",
+  "#ffffff"
+];
+function getRgb(hex) {
+  const r = parseInt(hex.slice(1, 3), 16);
+  const g = parseInt(hex.slice(3, 5), 16);
+  const b = parseInt(hex.slice(5, 7), 16);
+  return { r, g, b };
+}
+var rgbPalette = palette.map(getRgb);
+function getChar(val) {
+  const idx = Math.min(CHAR_RAMP.length - 1, Math.floor(val / (MAXV + 1) * CHAR_RAMP.length));
+  return CHAR_RAMP[idx];
+}
+async function showSplash() {
+  const cols = 60;
+  const rows = 15;
+  let fire = new Uint8Array(cols * rows);
+  process.stdout.write("\x1B[2J");
+  const termRows = process.stdout.rows || 24;
+  const termCols = process.stdout.columns || 80;
+  const startRow = Math.max(0, Math.floor((termRows - rows) / 2));
+  const startCol = Math.max(0, Math.floor((termCols - cols) / 2));
+  return new Promise((resolve) => {
+    const interval = setInterval(() => {
+      for (let x = 0; x < cols; x++) {
+        fire[(rows - 1) * cols + x] = MAXV - Math.floor(Math.random() * 4);
+      }
+      for (let y = rows - 1; y >= 1; y--) {
+        for (let x = 0; x < cols; x++) {
+          const src = y * cols + x;
+          const val = fire[src];
+          if (val === 0) {
+            fire[(y - 1) * cols + x] = 0;
+            continue;
+          }
+          const decay = Math.floor(Math.random() * 3);
+          const drift = Math.floor(Math.random() * 3) - 1;
+          let nx = x + drift;
+          if (nx < 0) nx = 0;
+          else if (nx >= cols) nx = cols - 1;
+          fire[(y - 1) * cols + nx] = Math.max(0, val - decay);
+        }
+      }
+      let output = "";
+      for (let i = 0; i < startRow; i++) output += "\n";
+      for (let y = 0; y < rows; y++) {
+        output += " ".repeat(startCol);
+        for (let x = 0; x < cols; x++) {
+          const v = fire[y * cols + x];
+          const color = rgbPalette[Math.min(v, rgbPalette.length - 1)];
+          output += chalk8.rgb(color.r, color.g, color.b)(getChar(v));
+        }
+        output += "\n";
+      }
+      output += " ".repeat(Math.max(0, startCol + (cols - 45) / 2)) + chalk8.bold.white("\u{1F525} pyre \u2014 system monitor (warming up sensors...)\n");
+      output += " ".repeat(Math.max(0, startCol + (cols - 25) / 2)) + chalk8.dim("[Press Enter to continue]");
+      process.stdout.write(`\x1B[H${output}`);
+    }, 65);
+    const onEnter = () => {
+      process.stdin.removeListener("data", onEnter);
+      clearInterval(interval);
+      process.stdout.write("\x1B[2J\x1B[H");
+      resolve();
+    };
+    process.stdin.setRawMode(true);
+    process.stdin.resume();
+    process.stdin.on("data", onEnter);
+    setTimeout(onEnter, 5e3);
+  });
 }
 
 // src/index.ts
@@ -2791,14 +2991,14 @@ async function main() {
     if (cmd === "live") {
       program.args.shift();
     }
-    await showSplash();
+    const splashPromise = showSplash();
     const interval = parseFloat(opts.interval) || 2;
     await startLive({
       interval,
       detailed: opts.detailed,
       exportDir: opts.exportDir,
       autoLog: opts.log
-    });
+    }, splashPromise);
     return;
   }
   if (cmd === "p2p") {