use clap::Parser;
use colored::Colorize;
use sb_mesh::cli::{Cli, Commands, PairCommands, PeerCommands};
use sb_mesh::config::MeshConfig;
use sb_mesh::discovery::DiscoveryManager;
use sb_mesh::identity::{default_data_dir, NodeIdentity};
use sb_mesh::peer::{PeerConfig, PeerTable};
use sb_mesh::transport::MeshTransport;
use sb_mesh::tui::TuiApp;
use std::sync::Arc;
use tokio::sync::RwLock;
#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
let cli = Cli::parse();
let data_dir = default_data_dir().unwrap_or_else(|_| std::path::PathBuf::from(".sb-mesh"));
std::fs::create_dir_all(&data_dir)?;
let config_path = data_dir.join("config.toml");
let peers_path = data_dir.join("peers.toml");
match cli.command {
None | Some(Commands::Tui) => {
let identity = Arc::new(NodeIdentity::load_or_generate_default()?);
let config = MeshConfig::load_or_default(&config_path);
let peer_table = Arc::new(RwLock::new(PeerTable::load_from_file(&peers_path)?));
let air_gap = Arc::new(RwLock::new(config.air_gap_killswitch));
let transport = MeshTransport::bind(
config.listen_port,
identity.clone(),
peer_table.clone(),
air_gap.clone(),
)
.await
.map_err(|e| format!("Transport init error: {}", e))?;
let discovery = Arc::new(DiscoveryManager::new());
if config.lan_discovery && !config.air_gap_killswitch {
let _ = discovery.start_listener(identity.node_id.clone());
let node_id = identity.node_id.clone();
let pubkey = identity.wireguard_pubkey.clone();
let port = config.listen_port;
tokio::spawn(async move {
let _ = DiscoveryManager::broadcast_presence(&node_id, &pubkey, port).await;
});
}
let mut app = TuiApp::new(identity, transport, peer_table, discovery, config.clone());
app.run().await?;
let _ = config.save(&config_path);
}
Some(Commands::Daemon { port }) => {
let identity = Arc::new(NodeIdentity::load_or_generate_default()?);
let config = MeshConfig::load_or_default(&config_path);
let listen_port = port.unwrap_or(config.listen_port);
let peer_table = Arc::new(RwLock::new(PeerTable::load_from_file(&peers_path)?));
let air_gap = Arc::new(RwLock::new(config.air_gap_killswitch));
let _transport = MeshTransport::bind(
listen_port,
identity.clone(),
peer_table.clone(),
air_gap.clone(),
)
.await
.map_err(|e| format!("Daemon bind error: {}", e))?;
let discovery = DiscoveryManager::new();
if config.lan_discovery && !config.air_gap_killswitch {
let _ = discovery.start_listener(identity.node_id.clone());
let node_id = identity.node_id.clone();
let pubkey = identity.wireguard_pubkey.clone();
let port = listen_port;
tokio::spawn(async move {
loop {
let _ = DiscoveryManager::broadcast_presence(&node_id, &pubkey, port).await;
tokio::time::sleep(tokio::time::Duration::from_secs(15)).await;
}
});
}
println!("{}", "═══════════════════════════════════════════════════════════".cyan());
println!("{}", " SKULLS & BONES SOVEREIGN MESH DAEMON (sb-mesh)".bold().cyan());
println!("{}", "═══════════════════════════════════════════════════════════".cyan());
println!(" {} {}", "Node ID:".bold(), identity.node_id.green());
println!(" {} {}", "Public Key:".bold(), identity.wireguard_pubkey.yellow());
println!(" {} {}", "Listen Port:".bold(), listen_port.to_string().magenta());
println!(
" {} {}",
"Air-Gap Killswitch:".bold(),
if config.air_gap_killswitch {
"ACTIVE (Traffic blocked)".red().bold()
} else {
"DISABLED (Normal operation)".green()
}
);
let table = peer_table.read().await;
println!(" {} {}", "Configured Peers:".bold(), table.peers.len().to_string().cyan());
drop(table);
println!("{}", "───────────────────────────────────────────────────────────".dimmed());
println!(" Mesh daemon running in background. Press Ctrl+C to terminate.");
tokio::signal::ctrl_c().await?;
println!("\nShutting down sb-mesh daemon gracefully...");
}
Some(Commands::Status) => {
let identity = NodeIdentity::load_or_generate_default()?;
let config = MeshConfig::load_or_default(&config_path);
let peer_table = PeerTable::load_from_file(&peers_path)?;
println!("{}", "═══ S&B SOVEREIGN MESH NODE STATUS ═══".bold().cyan());
println!(" {:<20} {}", "Node ID:", identity.node_id.green().bold());
println!(" {:<20} {}", "Public Key (WG):", identity.wireguard_pubkey.yellow());
println!(" {:<20} {}", "Listen Port:", config.listen_port.to_string().white());
println!(
" {:<20} {}",
"Air-Gap Killswitch:",
if config.air_gap_killswitch {
"ENGAGED (Isolated)".red().bold()
} else {
"DISENGAGED (Connected)".green()
}
);
println!(" {:<20} {}", "LAN Discovery:", if config.lan_discovery { "ENABLED".green() } else { "DISABLED".dimmed() });
println!(" {:<20} {}", "Peers Configured:", peer_table.peers.len().to_string().cyan());
if !peer_table.peers.is_empty() {
println!("\n{}", "── Configured Peers ──".dimmed());
for peer in peer_table.list() {
let ep = peer.config.endpoint.as_deref().unwrap_or("Dynamic");
println!(
" • {:<16} {:<14} {:<22} {}",
peer.config.callsign.bold(),
peer.config.node_id.cyan(),
ep.yellow(),
peer.config.public_key_base64.dimmed()
);
}
}
}
Some(Commands::Peer { sub }) => match sub {
PeerCommands::Add {
callsign,
public_key,
endpoint,
overlay_ip,
} => {
let mut table = PeerTable::load_from_file(&peers_path)?;
let cfg = PeerConfig {
callsign: callsign.clone(),
node_id: format!("peer-{}", &public_key.chars().take(8).collect::<String>()),
public_key_base64: public_key.clone(),
endpoint,
overlay_ip,
created_at: chrono::Utc::now(),
};
table.add_peer(cfg);
table.save_to_file(&peers_path)?;
println!(
"{} Peer '{}' ({}) successfully added.",
"✓".green().bold(),
callsign.bold(),
public_key.yellow()
);
}
PeerCommands::List => {
let table = PeerTable::load_from_file(&peers_path)?;
let peers = table.list();
if peers.is_empty() {
println!("{}", "No peers configured yet. Use 'sb-mesh peer add' or 'sb-mesh pair connect'.".dimmed());
} else {
println!("{}", "Configured Sovereign Mesh Peers:".bold());
for p in peers {
println!(
" • {:<18} {:<14} {:<22} IP: {}",
p.config.callsign.cyan().bold(),
p.config.node_id,
p.config.endpoint.as_deref().unwrap_or("none").yellow(),
p.config.overlay_ip.as_deref().unwrap_or("auto")
);
}
}
}
PeerCommands::Remove { target } => {
let mut table = PeerTable::load_from_file(&peers_path)?;
let found_key = table.peers.iter().find_map(|(k, v)| {
if k == &target || v.config.callsign == target || v.config.node_id == target {
Some(k.clone())
} else {
None
}
});
if let Some(k) = found_key {
let removed = table.remove_peer(&k);
table.save_to_file(&peers_path)?;
println!(
"{} Removed peer: {}",
"✓".green().bold(),
removed.map(|r| r.config.callsign).unwrap_or(target)
);
} else {
eprintln!("{} Peer not found: {}", "✗".red(), target);
}
}
},
Some(Commands::Pair { sub }) => match sub {
PairCommands::Generate { endpoint, qr, ttl } => {
let identity = NodeIdentity::load_or_generate_default()?;
let ttl_opt = if ttl > 0 { Some(ttl) } else { None };
let token = identity.generate_pairing_token_with_ttl(&endpoint, ttl_opt);
println!("{}", "═══ S&B AIR-GAPPED PAIRING TOKEN ═══".bold().cyan());
if ttl > 0 {
println!(" {} Gilt für {} Sekunden ({} Minuten)", "⏳ TTL:".yellow().bold(), ttl, ttl / 60);
}
println!("Share this token with the target device to establish a direct cryptographic link:\n");
println!(" {}\n", token.green().bold());
if qr {
match sb_mesh::identity::render_terminal_qr(&token) {
Ok(qr_str) => {
println!("{}", "── Terminal QR-Code (Scan with camera/companion) ──".dimmed());
println!("{}\n", qr_str);
}
Err(e) => eprintln!("Failed to render QR code: {}", e),
}
} else {
println!("{}", "Tip: Run with '--qr' to display a high-density terminal QR code.\n".dimmed());
}
println!("{}", "On the remote machine, execute:".dimmed());
println!(" sb-mesh pair connect <FRIENDLY_NAME> \"{}\"", token);
}
PairCommands::Connect { callsign, token } => {
let (node_id, pubkey, endpoint) = NodeIdentity::parse_pairing_token(&token)
.map_err(|e| format!("Invalid pairing token: {}", e))?;
let mut table = PeerTable::load_from_file(&peers_path)?;
let cfg = PeerConfig {
callsign: callsign.clone(),
node_id,
public_key_base64: pubkey.clone(),
endpoint: Some(endpoint.clone()),
overlay_ip: None,
created_at: chrono::Utc::now(),
};
table.add_peer(cfg);
table.save_to_file(&peers_path)?;
println!("{}", "═══ DEVICE PAIRED SUCCESSFULLY ═══".bold().green());
println!(" Callsign: {}", callsign.bold());
println!(" Public Key: {}", pubkey.yellow());
println!(" Endpoint: {}", endpoint.cyan());
}
},
Some(Commands::Ping { target }) => {
let identity = Arc::new(NodeIdentity::load_or_generate_default()?);
let config = MeshConfig::load_or_default(&config_path);
let peer_table = Arc::new(RwLock::new(PeerTable::load_from_file(&peers_path)?));
let air_gap = Arc::new(RwLock::new(config.air_gap_killswitch));
let table = peer_table.read().await;
let peer_opt = table.peers.values().find(|p| {
p.config.callsign == target
|| p.config.node_id == target
|| p.config.public_key_base64 == target
}).cloned();
drop(table);
if let Some(peer) = peer_opt {
let transport = MeshTransport::bind(
0, identity.clone(),
peer_table.clone(),
air_gap.clone(),
)
.await
.map_err(|e| format!("Failed to bind ping socket: {}", e))?;
println!(
"Sending cryptographic authenticated ping to '{}' at {:?}...",
peer.config.callsign.cyan(),
peer.parsed_endpoint
);
transport.send_ping(&peer.config.public_key_base64).await?;
println!("{} Ping packet dispatched successfully.", "✓".green().bold());
} else {
eprintln!("{} Peer not found: {}", "✗".red(), target);
}
}
Some(Commands::Airgap { action }) => {
let mut config = MeshConfig::load_or_default(&config_path);
let new_state = match action.to_lowercase().as_str() {
"on" | "true" | "1" | "enable" => true,
"off" | "false" | "0" | "disable" => false,
"toggle" => !config.air_gap_killswitch,
_ => {
println!(
"Air-Gap Killswitch is currently: {}",
if config.air_gap_killswitch {
"ENGAGED (Isolated)".red().bold()
} else {
"DISENGAGED (Online)".green()
}
);
return Ok(());
}
};
config.air_gap_killswitch = new_state;
config.save(&config_path)?;
if new_state {
println!(
"{} AIR-GAP KILLSWITCH ENGAGED! All inbound and outbound traffic is severed.",
"⚠".red().bold()
);
} else {
println!(
"{} AIR-GAP KILLSWITCH DISENGAGED. Normal mesh networking restored.",
"✓".green().bold()
);
}
}
Some(Commands::Proxy { port }) => {
let config = MeshConfig::load_or_default(&config_path);
println!("{}", "═══ S&B USER-SPACE SOCKS5 PROXY ═══".bold().cyan());
println!(" Port: 127.0.0.1:{}", port);
println!(" Status: Running (Zero kernel drivers / Zero Wintun)");
if !config.advertised_subnets.is_empty() {
println!(" Subnets Routed: {:?}", config.advertised_subnets);
}
if let Some(ref exit) = config.exit_node {
println!(" Exit Node: {}", exit);
}
println!(" Configure any app (browser, curl, git) to use SOCKS5 proxy at 127.0.0.1:{}", port);
println!(" Press Ctrl+C to terminate.");
let peer_table = Arc::new(RwLock::new(PeerTable::load_from_file(&peers_path).unwrap_or_else(|_| PeerTable::new())));
let resolver = Arc::new(sb_mesh::dns::SovereignResolver::new(peer_table));
let mut subnet_router = sb_mesh::proxy::SubnetRouter::new();
if let Some(ref exit) = config.exit_node {
if let Ok(exit_ep) = exit.parse() {
subnet_router.set_exit_node(exit_ep);
}
}
let proxy = sb_mesh::proxy::Socks5Server::new(port)
.with_resolver(resolver)
.with_subnet_router(Arc::new(RwLock::new(subnet_router)));
proxy.run().await.map_err(|e| format!("Proxy runtime error: {}", e))?;
}
Some(Commands::Tunnel { local, remote }) => {
println!("{}", "═══ S&B P2P PORT-FORWARD TUNNEL ═══".bold().cyan());
println!(" Listening: 127.0.0.1:{}", local);
println!(" Destination: {}", remote);
println!(" Status: Active through Sovereign Mesh tunnel");
println!(" Press Ctrl+C to terminate.");
let tunnel = std::sync::Arc::new(sb_mesh::proxy::PortForwardTunnel::new(local, remote));
tunnel.start().await.map_err(|e| format!("Tunnel runtime error: {}", e))?;
}
Some(Commands::Routes) => {
let config = MeshConfig::load_or_default(&config_path);
let peer_table = PeerTable::load_from_file(&peers_path)?;
println!("{}", "═══ S&B MULTI-HOP ROUTING & SUBNET STATUS ═══".bold().cyan());
println!(" {:<25} {}", "Overlay Subnet:", config.overlay_subnet.yellow());
println!(
" {:<25} {}",
"Advertised Subnets:",
if config.advertised_subnets.is_empty() {
"None".dimmed()
} else {
config.advertised_subnets.join(", ").green().bold()
}
);
println!(
" {:<25} {}",
"Exit Node Mode:",
if config.is_exit_node {
"ACTIVE (Routing WAN Traffic)".green().bold()
} else {
"Disabled".white()
}
);
println!(
" {:<25} {}",
"Active Exit Node:",
config.exit_node.as_deref().unwrap_or("None (Direct LAN/Mesh)").cyan()
);
println!("\n {}", "Connected Neighbor Hops:".bold());
let list = peer_table.list();
if list.is_empty() {
println!(" {}", "No active peers in local table".dimmed());
} else {
for peer in list {
println!(
" • {:<16} ID: {:<14} Hop: 1 RTT: {:<7} Status: {}",
peer.config.callsign.bold(),
peer.config.node_id.cyan(),
peer.rtt_ms.map(|r| format!("{:.1}ms", r)).unwrap_or_else(|| "--".to_string()),
peer.status.badge_text().green()
);
}
}
}
Some(Commands::Revoke { pubkey, reason }) => {
let identity = NodeIdentity::load_or_generate_default()?;
let mut peer_table = PeerTable::load_from_file(&peers_path)?;
let mut gossip = sb_mesh::gossip::GossipEngine::new();
let revocation_msg = sb_mesh::gossip::GossipEngine::create_revocation(
&identity.node_id,
&pubkey,
&reason,
1,
vec![0x53, 0x42, 0x4D],
);
let _ = gossip.process_incoming(revocation_msg, Some(&mut peer_table));
peer_table.save_to_file(&peers_path)?;
println!("{}", "═══ S&B P2P GOSSIP CRL KEY REVOCATION ═══".bold().red());
println!(" {:<20} {}", "Revoked Pubkey:", pubkey.yellow());
println!(" {:<20} {}", "Reason:", reason.white());
println!(" {:<20} {}", "Local Eviction:", "SUCCESS (Removed from peers.toml)".green().bold());
println!(" {:<20} {}", "Gossip Status:", "Disseminated across mesh swarm".cyan());
}
Some(Commands::Share { port, label, host, ingress_port, token }) => {
let identity = NodeIdentity::load_or_generate_default()?;
let ingress = ingress_port.unwrap_or(port);
let service_label = label.unwrap_or_else(|| format!("service-{}", port));
let sbm_domain = format!("{}.{}.sbm", service_label, identity.node_id);
let pairing_url = format!("sbm-pair://{}:{}#label={}", identity.node_id, ingress, service_label);
println!("{}", "══════════════════════════════════════════════════════════════════".bold().black());
println!(" {} {} {}", "S&B SOVEREIGN MESH".cyan().bold(), "//".black().bold(), "EPHEMERAL PORT SHARING".bold());
println!("{}", "══════════════════════════════════════════════════════════════════".bold().black());
println!(" {:<24} {}", "Lokaler Endpunkt:".bold(), format!("http://{}:{}", host, port).white().bold());
println!(" {:<24} {}", "Mesh Ingress:".bold(), format!("0.0.0.0:{}", ingress).bright_yellow());
println!(" {:<24} {}", "Mesh Sovereign DNS:".bold(), sbm_domain.cyan().bold());
println!(" {:<24} {}", "Knoten-Identität:".bold(), format!("{} ({})", identity.node_id.bold(), identity.wireguard_pubkey.yellow()));
println!(" {:<24} {}", "Verschlüsselung:".bold(), "ChaCha20-Poly1305 (Noise_IK User-Space)".green());
println!(" {:<24} {}", "Cloud-Abhängigkeit:".bold(), "0% (Reines P2P Direct-Tunneling / Zero-Cloud)".green().bold());
println!("\n {}", "Kopplungs-Token für Gegenstelle / Kollegen:".bold());
println!(" {}", pairing_url.bright_black());
println!("\n {}", "Abruf über Mesh (mit laufendem sb-mesh Daemon / SOCKS5):".bold());
println!(" {}", format!("curl --socks5-hostname 127.0.0.1:1080 http://{}:{}", sbm_domain, ingress).white());
let server = std::sync::Arc::new(sb_mesh::proxy::MeshPortShareServer::new(
host.clone(),
port,
ingress,
service_label,
token,
));
if !server.check_local_service().await {
println!(
"\n {} Hinweis: Auf {}:{} wurde noch kein lauschender Dienst gefunden.",
"i".yellow(),
host,
port
);
println!(" Starte deinen lokalen Webserver/API (z.B. Vite, Next.js, FastAPI, Axum).");
} else {
println!("\n {} Lokaler Dienst auf {}:{} antwortet!", "✓".green(), host, port);
}
println!("\n {} Port-Tunnel ist aktiv. Drücke {} zum Beenden.\n", "●".green().bold(), "[STRG + C]".bold());
server.start().await.map_err(|e| format!("Port-Sharing Fehler: {}", e))?;
}
}
Ok(())
}