import os
import sys
import re
import json
import time
import socket
import base64
import hashlib
import random
import secrets
import subprocess
import webbrowser
import threading
import asyncio
import winreg
from io import BytesIO
from concurrent.futures import ThreadPoolExecutor

import tkinter as tk
from tkinter import ttk, messagebox, simpledialog, filedialog
import pyotp
import qrcode
import mss
from PIL import Image, ImageTk
from pynput.mouse import Button, Controller as MouseController
from pynput.keyboard import Listener as KeyListener, Key
import websockets
import requests

SERVER_HTTP = "https://signal.pez4.app"
SERVER_WS   = "wss://signal.pez4.app/ws"
DONATE_URL  = "https://pez4.app"

IMMUTABLE_FOUNDER_HANDLES = {"@p", "@p1"}
mouse_ctrl = MouseController()

MAC_VENDOR_OUI = {
    "00:1a:11": "Google / Nest",
    "b8:27:eb": "Raspberry Pi",
    "dc:a6:32": "Raspberry Pi 4",
    "f0:18:98": "Apple (Mac/iOS)",
    "3c:22:fb": "Apple MacBook",
    "c0:56:e3": "Hikvision ONVIF Camera",
    "a4:14:37": "Dahua / Amcrest ONVIF Camera",
    "00:11:32": "Synology NAS",
    "00:80:77": "Brother Network Printer",
    "00:15:5d": "Microsoft Windows / Hyper-V",
}

SWIM_PORTS = {
    21:   "FTP File Transfer",
    22:   "SSH Secure Shell",
    53:   "DNS Router Resolver",
    80:   "HTTP Web Admin / Camera UI",
    139:  "NetBIOS Windows Share",
    443:  "HTTPS Secure Portal",
    445:  "SMBv3 Windows / NAS Share",
    554:  "RTSP Live Camera Stream",
    631:  "IPP Network Printer",
    3389: "Windows Remote Desktop (RDP)",
    5000: "UPnP / NAS Control",
    8000: "ONVIF Camera Port",
    8080: "HTTP Proxy / Web Alt",
    9100: "JetDirect Raw Printer"
}

HABITAT_THEMES = {
    "Abyssal Tin (Default)": {"bg": "#060b10", "panel": "#0e1720", "accent": "#00f2fe", "fg": "#f1f5f9"},
    "Dark Ocean (Midnight)": {"bg": "#020408", "panel": "#070d16", "accent": "#38bdf8", "fg": "#e2e8f0"},
    "Red Sea (Coral)":       {"bg": "#140507", "panel": "#240a0e", "accent": "#ff4d6d", "fg": "#fff0f3"},
    "Sandy Beach (Light)":   {"bg": "#f5f0e6", "panel": "#e8dfd1", "accent": "#0284c7", "fg": "#0f172a"},
    "Kelp Forest (Emerald)": {"bg": "#04100b", "panel": "#091e15", "accent": "#10b981", "fg": "#ecfdf5"},
}

def get_windows11_hw_uuid() -> str:
    try:
        key = winreg.OpenKey(winreg.HKEY_LOCAL_MACHINE, r"SOFTWARE\Microsoft\Cryptography", 0,
                             winreg.KEY_READ | winreg.KEY_WOW64_64KEY)
        guid, _ = winreg.QueryValueEx(key, "MachineGuid")
        winreg.CloseKey(key)
        return hashlib.sha256(f"PEZ4-WIN11-{guid}".encode()).hexdigest()
    except Exception:
        return hashlib.sha256(os.environ.get("COMPUTERNAME", "WIN11").encode()).hexdigest()

def get_lan_and_gateway_info() -> dict:
    local_ip = "127.0.0.1"
    try:
        s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
        s.connect(("1.1.1.1", 80))
        local_ip = s.getsockname()[0]
        s.close()
    except Exception:
        pass
    gw = ".".join(local_ip.split(".")[:3]) + ".1"
    return {"local_ip": local_ip, "gateway": f"@roe-{gw}"}

def get_windows11_wifi_sonar() -> dict:
    try:
        out = subprocess.check_output("netsh wlan show interfaces", shell=True).decode(errors="ignore")
        ssid = re.search(r"^\s*SSID\s*:\s*(.+)$", out, re.M)
        sig  = re.search(r"^\s*Signal\s*:\s*(\d+)%", out, re.M)
        chan = re.search(r"^\s*Channel\s*:\s*(\d+)", out, re.M)
        pct = int(sig.group(1)) if sig else 0
        dbm = int((pct / 2) - 100) if pct > 0 else -100
        return {
            "ssid": ssid.group(1).strip() if ssid else "Wired Ethernet LAN",
            "signal_pct": pct,
            "rssi_dbm": f"{dbm} dBm",
            "channel": chan.group(1).strip() if chan else "N/A"
        }
    except Exception:
        return {"ssid": "Wired / Unknown", "signal_pct": 100, "rssi_dbm": "-40 dBm", "channel": "LAN"}

class Pez4MasterWindowsApp:
    def __init__(self, root: tk.Tk):
        self.root = root
        self.root.title("pez4 // P2P Remote Tin, Countershading Firewall, The Ocean & @roe Suite")
        self.root.geometry("1080x720")
        self.root.configure(bg="#060b10")

        self.hw_hash = get_windows11_hw_uuid()
        self.net_info = get_lan_and_gateway_info()
        self.appdata_dir = os.path.join(os.environ.get("LOCALAPPDATA", "."), "pez4")
        self.id_file = os.path.join(self.appdata_dir, "identity.key")
        self.installed = os.path.exists(self.id_file)

        self.ws = None
        self.loop = None
        self.countershading_enabled = False  # Anti-Marlin Firewall state
        self.remote_controlling_peer = None
        self.sharing_screen_to = None
        self.avatar_badge = "🐟 Standard Sardine"
        self.status_text = "🐟 Swimming in the Shoal"
        self.my_aliases = []
        self.tin_credentials = {}
        self.active_torrents = []
        self.clupeidae_folder = os.path.expanduser("~")

        if self.installed:
            with open(self.id_file, "r") as f:
                data = json.load(f)
                self.tin_id = data["tin_id"]
                self.username = data["username"]
                self.totp_secret = data["totp_secret"]
                self.avatar_badge = data.get("avatar", "🐟 Standard Sardine")
                self.status_text = data.get("status_text", "🐟 Swimming in the Shoal")
                self.my_aliases = data.get("my_aliases", [self.username])
                self.tin_credentials = data.get("tin_credentials", {})
                self.clupeidae_folder = data.get("clupeidae_folder", self.clupeidae_folder)
        else:
            self.tin_id = hashlib.sha256(secrets.token_bytes(32)).hexdigest()[:24]
            self.totp_secret = pyotp.random_base32()
            words = ["sardine", "pilchard", "iwashi", "sardinha", "brislings"]
            self.username = f"@temp_{random.choice(words)}_{random.randint(100,999)}"
            self.my_aliases = [self.username]

        self.totp = pyotp.TOTP(self.totp_secret, interval=30)

        self.build_ui()
        self.update_can_opener_loop()
        self.start_esc_killswitch()
        threading.Thread(target=self.fetch_plankton_meter, daemon=True).start()
        threading.Thread(target=self.run_network_loop, daemon=True).start()

    def save_local_identity(self):
        os.makedirs(self.appdata_dir, exist_ok=True)
        with open(self.id_file, "w") as f:
            json.dump({
                "tin_id": self.tin_id,
                "username": self.username,
                "totp_secret": self.totp_secret,
                "avatar": self.avatar_badge,
                "status_text": self.status_text,
                "my_aliases": self.my_aliases,
                "tin_credentials": self.tin_credentials,
                "clupeidae_folder": self.clupeidae_folder
            }, f)

    def build_ui(self):
        # 1. Top Bar: Plankton + Countershading (Anti-Marlin Firewall) Toggle
        top = tk.Frame(self.root, bg="#09131c", pady=6, padx=12)
        top.pack(fill="x")
        self.plankton_lbl = tk.Label(
            top,
            text=f"🌿 Plankton: 72g/150g • 🌊 15% Oceana/SFP • LAN: {self.net_info['local_ip']} • Gateway: {self.net_info['gateway']}",
            fg="#10b981", bg="#09131c", font=("Consolas", 9, "bold")
        )
        self.plankton_lbl.pack(side="left")

        self.cs_btn = tk.Button(
            top,
            text="🛡️ Countershading Firewall: OFF (Click to Cloak)",
            bg="#10b981", fg="#060b10", font=("Consolas", 8, "bold"),
            command=self.toggle_countershading
        )
        self.cs_btn.pack(side="right", padx=(8, 0))

        tk.Button(top, text="🎁 Redeem Plankton", bg="#162432", fg="#00f2fe", font=("Consolas", 8, "bold"),
                  command=self.redeem_plankton_dialog).pack(side="right")

        # 2. Header Bar
        hdr = tk.Frame(self.root, bg="#0e1720", pady=8, padx=14)
        hdr.pack(fill="x")
        self.title_lbl = tk.Label(hdr, text=f"🦈 pez4 // {self.avatar_badge} ({self.username}) — [{self.status_text}]",
                                  fg="#00f2fe", bg="#0e1720", font=("Consolas", 11, "bold"))
        self.title_lbl.pack(side="left")
        self.status_lbl = tk.Label(hdr, text="Connecting to signal.pez4.app...", fg="#f59e0b", bg="#0e1720", font=("Consolas", 9))
        self.status_lbl.pack(side="right")

        # 3. 6-Tab Master Suite
        style = ttk.Style()
        style.theme_use("default")
        style.configure("TNotebook", background="#060b10", borderwidth=0)
        style.configure("TNotebook.Tab", background="#162432", foreground="#cbd5e1", padding=[10, 6], font=("Consolas", 9, "bold"))
        style.map("TNotebook.Tab", background=[("selected", "#00f2fe")], foreground=[("selected", "#060b10")])

        self.nb = ttk.Notebook(self.root)
        self.nb.pack(fill="both", expand=True, padx=10, pady=8)

        self.tab_remote = tk.Frame(self.nb, bg="#060b10")
        self.tab_cs     = tk.Frame(self.nb, bg="#060b10")
        self.tab_ocean  = tk.Frame(self.nb, bg="#060b10")
        self.tab_roe    = tk.Frame(self.nb, bg="#060b10")
        self.tab_nas    = tk.Frame(self.nb, bg="#060b10")
        self.tab_theme  = tk.Frame(self.nb, bg="#060b10")

        self.nb.add(self.tab_remote, text="🥫 1. Can Opener & Remote")
        self.nb.add(self.tab_cs,     text="🛡️ 2. Countershading Firewall")
        self.nb.add(self.tab_ocean,  text="🌊 3. 'The Ocean' & Plankton/Hook")
        self.nb.add(self.tab_roe,    text="📡 4. @roe LAN, Swim & Wi-Fi Sonar")
        self.nb.add(self.tab_nas,    text="🧲 5. Torrents & Clupeidae NAS")
        self.nb.add(self.tab_theme,  text="🎨 6. Habitat Themes & Profile")

        self.build_tab_remote()
        self.build_tab_countershading()
        self.build_tab_ocean()
        self.build_tab_roe()
        self.build_tab_nas()
        self.build_tab_theme()

    # -------------------------------------------------------------------------
    # TAB 1: CAN OPENER REMOTE DESKTOP & MULTI-DEVICE QR LINK
    # -------------------------------------------------------------------------
    def build_tab_remote(self):
        left = tk.Frame(self.tab_remote, bg="#0e1720", padx=14, pady=12, width=340)
        left.pack(side="left", fill="y", padx=(0, 10), pady=4)
        left.pack_propagate(False)

        tk.Label(left, text="🥫 THIS PC'S HANDLE", fg="#00f2fe", bg="#0e1720", font=("Consolas", 10, "bold")).pack(anchor="w")
        self.handle_lbl = tk.Label(left, text=self.username, fg="#fff", bg="#05090e", font=("Consolas", 13, "bold"), pady=6)
        self.handle_lbl.pack(fill="x", pady=(4, 8))

        tk.Label(left, text="🔓 MY 6-DIGIT 'CAN OPENER' CODE", fg="#94a3b8", bg="#0e1720", font=("Consolas", 8)).pack(anchor="w")
        self.code_lbl = tk.Label(left, text="--- ---", fg="#10b981", bg="#05090e", font=("Consolas", 18, "bold"), pady=6)
        self.code_lbl.pack(fill="x", pady=(2, 2))
        self.timer_lbl = tk.Label(left, text="Rotates in 30s • ESC slams tin lid", fg="#94a3b8", bg="#0e1720", font=("Consolas", 8))
        self.timer_lbl.pack(anchor="w", pady=(0, 10))

        tk.Button(left, text="🔗 Link Work/Home PC (QR & 4 Aliases)", bg="#162432", fg="#00f2fe", font=("Consolas", 9, "bold"),
                  command=self.open_device_link_modal).pack(fill="x", pady=3)
        tk.Button(left, text="🔄 Molt / Recycle Handle (3-Yr Vault)", bg="#162432", fg="#cbd5e1", font=("Consolas", 9),
                  command=self.molt_current_handle).pack(fill="x", pady=3)

        tk.Label(left, text="🎮 CONTROL ANOTHER PC", fg="#00f2fe", bg="#0e1720", font=("Consolas", 10, "bold")).pack(anchor="w", pady=(10, 2))
        tk.Label(left, text="Target @Username:", fg="#94a3b8", bg="#0e1720", font=("Consolas", 8)).pack(anchor="w")
        self.target_entry = tk.Entry(left, bg="#05090e", fg="#fff", insertbackground="#fff", font=("Consolas", 11))
        self.target_entry.pack(fill="x", pady=(2, 6))

        tk.Label(left, text="Their 6-Digit Can Opener Code:", fg="#94a3b8", bg="#0e1720", font=("Consolas", 8)).pack(anchor="w")
        self.opener_entry = tk.Entry(left, bg="#05090e", fg="#10b981", insertbackground="#fff", font=("Consolas", 12, "bold"))
        self.opener_entry.pack(fill="x", pady=(2, 8))

        tk.Button(left, text="🔓 Open Tin & Connect Screen", bg="#00f2fe", fg="#060b10", font=("Consolas", 10, "bold"),
                  command=self.request_remote_control).pack(fill="x", pady=4)

        if not self.installed:
            tk.Button(left, text="⚡ Install Full Suite & Claim @Handle", bg="#f59e0b", fg="#060b10", font=("Consolas", 9, "bold"),
                      command=self.upgrade_to_installed).pack(fill="x", side="bottom")

        right = tk.Frame(self.tab_remote, bg="#04080c", highlightbackground="#1e293b", highlightthickness=1)
        right.pack(side="right", fill="both", expand=True, pady=4)
        self.canvas = tk.Label(right, text="🐟 pez4 Remote Desktop Viewport\nConnect to a peer's @handle with their 6-digit Can Opener code.\n(Or enable Countershading Mode anytime to block all inbound access!)",
                               fg="#94a3b8", bg="#04080c", font=("Consolas", 10))
        self.canvas.pack(fill="both", expand=True)
        self.canvas.bind("<Button-1>", self.send_remote_click)

    # -------------------------------------------------------------------------
    # TAB 2: COUNTERSHADING MODE (ANTI-MARLIN STEALTH FIREWALL)
    # -------------------------------------------------------------------------
    def build_tab_countershading(self):
        card = tk.Frame(self.tab_cs, bg="#0e1720", padx=20, pady=18)
        card.pack(fill="both", expand=True, pady=4)

        tk.Label(card, text="🛡️ COUNTERSHADING MODE — THE ANTI-MARLIN STEALTH FIREWALL",
                 fg="#10b981", bg="#0e1720", font=("Consolas", 13, "bold")).pack(anchor="w")
        tk.Label(card, text="When you are active and paying attention, it is easy to spot a fast predator like a Marlin.\n"
                            "When you are resting, away from your desk, or working on sensitive files, enable Countershading:\n"
                            "• Your PC becomes 100% INVISIBLE and UNREACHABLE to all inbound remote control, NAS, and torrent requests.\n"
                            "• Anyone probing your @handle receives a standard PEER_OFFLINE response.\n"
                            "• You keep 100% OUTBOUND access to browse The Ocean, chat, scan @roe LAN nodes, and use all tools!",
                 fg="#cbd5e1", bg="#0e1720", font=("Consolas", 9), justify="left").pack(anchor="w", pady=(8, 16))

        self.cs_big_status = tk.Label(
            card,
            text="🟢 CURRENT STATE: NORMAL SWIMMING (Inbound Can Opener 2FA Active)",
            fg="#00f2fe", bg="#05090e", font=("Consolas", 12, "bold"), pady=16
        )
        self.cs_big_status.pack(fill="x", pady=10)

        tk.Button(card, text="🛡️ Toggle Countershading Stealth Firewall ON / OFF", bg="#10b981", fg="#060b10",
                  font=("Consolas", 11, "bold"), pady=8, command=self.toggle_countershading).pack(fill="x", pady=6)

    def toggle_countershading(self):
        self.countershading_enabled = not self.countershading_enabled
        if self.countershading_enabled:
            # Immediately sever any active inbound screen share
            self.sharing_screen_to = None
            self.cs_btn.config(text="🛡️ Countershading: ON (Invisible to Marlins)", bg="#ff5e62", fg="#060b10")
            self.cs_big_status.config(
                text="🛡️ COUNTERSHADING ACTIVE: All Inbound Remote/NAS/Torrent Connections HARD-BLOCKED!\n(100% Outbound Chat, Ocean & Network Tools Remain Active)",
                fg="#10b981"
            )
            self.status_lbl.config(text=f"🛡️ Countershaded ({self.username} Cloaked)", fg="#10b981")
        else:
            self.cs_btn.config(text="🛡️ Countershading Firewall: OFF (Click to Cloak)", bg="#10b981", fg="#060b10")
            self.cs_big_status.config(
                text="🟢 CURRENT STATE: NORMAL SWIMMING (Inbound Can Opener 2FA Active)",
                fg="#00f2fe"
            )
            self.status_lbl.config(text=f"🟢 Online as {self.username}", fg="#10b981")

        # Notify signaling server over WebSocket & REST
        if self.ws and self.loop:
            asyncio.run_coroutine_threadsafe(
                self.ws.send(json.dumps({"type": "SET_COUNTERSHADING", "enabled": self.countershading_enabled})),
                self.loop
            )
        threading.Thread(
            target=lambda: requests.post(f"{SERVER_HTTP}/api/countershading",
                                         json={"username": self.username, "enabled": self.countershading_enabled}, timeout=4),
            daemon=True
        ).start()

    # -------------------------------------------------------------------------
    # TAB 3: "THE OCEAN" SOCIAL COMMUNITIES & PLANKTON vs. HOOK
    # -------------------------------------------------------------------------
    def build_tab_ocean(self):
        top = tk.Frame(self.tab_ocean, bg="#0e1720", padx=14, pady=12)
        top.pack(fill="both", expand=True, pady=4)

        tk.Label(top, text="🌊 'THE OCEAN' — SHARK-TESTED P2P SHOALS (PLANKTON BOOST vs. HOOK)",
                 fg="#00f2fe", bg="#0e1720", font=("Consolas", 11, "bold")).pack(anchor="w")

        btn_bar = tk.Frame(top, bg="#0e1720")
        btn_bar.pack(fill="x", pady=6)
        tk.Button(btn_bar, text="🔄 Refresh Ocean Shoals", bg="#00f2fe", fg="#060b10", font=("Consolas", 9, "bold"),
                  command=self.refresh_ocean_feed).pack(side="left", padx=(0, 8))
        tk.Button(btn_bar, text="+ Post to The Ocean", bg="#10b981", fg="#060b10", font=("Consolas", 9, "bold"),
                  command=self.create_ocean_post_dialog).pack(side="left", padx=(0, 8))
        tk.Button(btn_bar, text="🌿 Plankton Boost Selected", bg="#f59e0b", fg="#060b10", font=("Consolas", 9, "bold"),
                  command=lambda: self.react_selected_ocean("PLANKTON")).pack(side="left", padx=(0, 8))
        tk.Button(btn_bar, text="🪝 Hook Selected (Save Offline P2P)", bg="#ff5e62", fg="#060b10", font=("Consolas", 9, "bold"),
                  command=lambda: self.react_selected_ocean("HOOK")).pack(side="left")

        self.ocean_listbox = tk.Listbox(top, bg="#05090e", fg="#f1f5f9", selectbackground="#00f2fe", selectforeground="#060b10", font=("Consolas", 9))
        self.ocean_listbox.pack(fill="both", expand=True, pady=6)
        self.ocean_posts_cache = []
        threading.Thread(target=self.refresh_ocean_feed, daemon=True).start()

    def refresh_ocean_feed(self):
        try:
            r = requests.get(f"{SERVER_HTTP}/api/ocean/feed", timeout=5).json()
            self.ocean_posts_cache = r.get("posts", [])
            self.ocean_listbox.delete(0, tk.END)
            for p in self.ocean_posts_cache:
                tag = "📌 PERSISTENT" if p["persistent"] else "🌊 LIVE P2P"
                self.ocean_listbox.insert(
                    tk.END,
                    f"[{tag}] [{p['shoal']}] {p['title']} (by {p['author']}) | 🌿 {p['plankton']}g | 🪝 {p['hooks']}"
                )
        except Exception:
            pass

    def create_ocean_post_dialog(self):
        shoal = simpledialog.askstring("New Ocean Post", "Community Shoal (e.g. s/studio-stems):", initialvalue="s/official-pez4")
        title = simpledialog.askstring("New Ocean Post", "Post Title:")
        ptype = simpledialog.askstring("New Ocean Post", "Type (TEXT or MEDIA):", initialvalue="TEXT")
        if shoal and title:
            requests.post(f"{SERVER_HTTP}/api/ocean/post", json={
                "shoal_community": shoal, "author": self.username,
                "post_type": ptype or "TEXT", "title": title, "body_or_url": "Hosted via P2P Ocean Node"
            }, timeout=5)
            self.refresh_ocean_feed()

    def react_selected_ocean(self, reaction: str):
        sel = self.ocean_listbox.curselection()
        if not sel:
            return
        post = self.ocean_posts_cache[sel[0]]
        r = requests.post(f"{SERVER_HTTP}/api/ocean/react", json={
            "post_id": post["post_id"], "reaction": reaction, "grams": 5
        }, timeout=5).json()
        if reaction == "PLANKTON":
            messagebox.showinfo("🌿 Plankton Boost", f"Boosted +5g! Recipient: {r.get('recipient')}")
        else:
            messagebox.showinfo("🪝 Hooked!", f"Post '{post['title']}' hooked and saved to your local offline P2P cache!")
        self.refresh_ocean_feed()

    # -------------------------------------------------------------------------
    # TAB 4: @roe LAN DISCOVERY, "SWIM" PORT SCANNER & WI-FI SONAR
    # -------------------------------------------------------------------------
    def build_tab_roe(self):
        left = tk.Frame(self.tab_roe, bg="#0e1720", padx=12, pady=12, width=340)
        left.pack(side="left", fill="y", padx=(0, 10), pady=4)
        left.pack_propagate(False)

        tk.Label(left, text="🥚 @roe LOCAL SUBNET NODES", fg="#00f2fe", bg="#0e1720", font=("Consolas", 10, "bold")).pack(anchor="w")
        tk.Button(left, text="🔄 ARP Scan Local Network", bg="#00f2fe", fg="#060b10", font=("Consolas", 9, "bold"),
                  command=self.scan_roe_lan).pack(fill="x", pady=6)

        self.roe_listbox = tk.Listbox(left, bg="#05090e", fg="#fff", font=("Consolas", 9))
        self.roe_listbox.pack(fill="both", expand=True, pady=4)

        right = tk.Frame(self.tab_roe, bg="#0e1720", padx=14, pady=12)
        right.pack(side="right", fill="both", expand=True, pady=4)

        btn_row = tk.Frame(right, bg="#0e1720")
        btn_row.pack(fill="x", pady=4)
        tk.Button(btn_row, text="🏊 'Swim' Selected Device (Scan Open Ports)", bg="#00f2fe", fg="#060b10",
                  font=("Consolas", 9, "bold"), command=self.swim_selected_roe).pack(side="left", padx=(0, 8))
        tk.Button(btn_row, text="📶 Pulse Wi-Fi Signal Sonar", bg="#10b981", fg="#060b10",
                  font=("Consolas", 9, "bold"), command=self.pulse_wifi_sonar).pack(side="left", padx=(0, 8))
        tk.Button(btn_row, text="📹 Open ONVIF / Web UI", bg="#162432", fg="#fff",
                  font=("Consolas", 9), command=self.open_roe_browser).pack(side="left")

        self.swim_output = tk.Text(right, bg="#05090e", fg="#10b981", font=("Consolas", 9))
        self.swim_output.pack(fill="both", expand=True, pady=6)
        self.discovered_roe = []
        self.scan_roe_lan()

    def scan_roe_lan(self):
        self.roe_listbox.delete(0, tk.END)
        self.discovered_roe = []
        try:
            out = subprocess.check_output("arp -a", shell=True).decode(errors="ignore")
            for line in out.splitlines():
                m = re.search(r"(\d+\.\d+\.\d+\.\d+)\s+([0-9a-fA-F\-:]{17})", line)
                if m:
                    ip, raw_mac = m.groups()
                    if ip.endswith(".255") or ip.startswith("224.") or ip.startswith("239."):
                        continue
                    mac = raw_mac.replace("-", ":").lower()
                    vendor = MAC_VENDOR_OUI.get(mac[:8], "LAN Workstation / Device")
                    self.discovered_roe.append({"handle": f"@roe-{ip}", "ip": ip, "mac": mac.upper(), "vendor": vendor})
                    self.roe_listbox.insert(tk.END, f"@roe-{ip} [{vendor}]")
        except Exception:
            pass

    def swim_selected_roe(self):
        sel = self.roe_listbox.curselection()
        if not sel:
            return
        d = self.discovered_roe[sel[0]]
        ip = d["ip"]
        self.swim_output.delete("1.0", tk.END)
        self.swim_output.insert(tk.END, f"🏊 Swimming around {d['handle']} (MAC: {d['mac']} | {d['vendor']})...\n\n")

        def run_scan():
            def probe(item):
                port, proto = item
                with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
                    s.settimeout(0.25)
                    if s.connect_ex((ip, port)) == 0:
                        return f"  [OPEN] Port {port:<5} -> {proto}\n"
                return None
            with ThreadPoolExecutor(max_workers=14) as ex:
                for res in ex.map(probe, SWIM_PORTS.items()):
                    if res:
                        self.swim_output.insert(tk.END, res)
        threading.Thread(target=run_scan, daemon=True).start()

    def pulse_wifi_sonar(self):
        w = get_windows11_wifi_sonar()
        self.swim_output.insert(tk.END, f"\n📶 WI-FI SONAR: SSID={w['ssid']} | Signal={w['signal_pct']}% ({w['rssi_dbm']}) | Ch={w['channel']}\n")

    def open_roe_browser(self):
        sel = self.roe_listbox.curselection()
        if sel:
            webbrowser.open(f"http://{self.discovered_roe[sel[0]]['ip']}")

    # -------------------------------------------------------------------------
    # TAB 5: CAN-OPENER TORRENTS (.peztorrent) & CLUPEIDAE NAS
    # -------------------------------------------------------------------------
    def build_tab_nas(self):
        frame = tk.Frame(self.tab_nas, bg="#0e1720", padx=14, pady=12)
        frame.pack(fill="both", expand=True, pady=4)
        tk.Label(frame, text="🧲 CAN-OPENER 2FA TORRENTS & 'CLUPEIDAE' PERSONAL HOME NAS",
                 fg="#00f2fe", bg="#0e1720", font=("Consolas", 10, "bold")).pack(anchor="w")
        tk.Button(frame, text="📂 Select Clupeidae Home NAS Folder", bg="#00f2fe", fg="#060b10",
                  font=("Consolas", 9, "bold"), command=self.choose_clupeidae_folder).pack(anchor="w", pady=6)
        self.nas_listbox = tk.Listbox(frame, bg="#05090e", fg="#cbd5e1", font=("Consolas", 9))
        self.nas_listbox.pack(fill="both", expand=True, pady=4)
        self.refresh_clupeidae_files()

    def choose_clupeidae_folder(self):
        folder = filedialog.askdirectory()
        if folder:
            self.clupeidae_folder = folder
            self.refresh_clupeidae_files()

    def refresh_clupeidae_files(self):
        self.nas_listbox.delete(0, tk.END)
        try:
            for f in os.listdir(self.clupeidae_folder)[:50]:
                self.nas_listbox.insert(tk.END, f"🥫 {f}")
        except Exception:
            pass

    # -------------------------------------------------------------------------
    # TAB 6: SARDINE HABITAT THEMES & PROFILE STATUS
    # -------------------------------------------------------------------------
    def build_tab_theme(self):
        frame = tk.Frame(self.tab_theme, bg="#0e1720", padx=16, pady=14)
        frame.pack(fill="both", expand=True, pady=4)
        tk.Label(frame, text="🎨 SARDINE HABITAT THEMES & CUSTOM STATUS", fg="#00f2fe", bg="#0e1720", font=("Consolas", 11, "bold")).pack(anchor="w")

        for tname, cols in HABITAT_THEMES.items():
            tk.Button(frame, text=f"Apply Theme: {tname}", bg=cols["panel"], fg=cols["accent"],
                      font=("Consolas", 9, "bold"), command=lambda c=cols: self.apply_theme(c)).pack(fill="x", pady=3)

        tk.Label(frame, text="Update Text Status:", fg="#cbd5e1", bg="#0e1720", font=("Consolas", 9)).pack(anchor="w", pady=(10, 2))
        self.status_entry = tk.Entry(frame, bg="#05090e", fg="#10b981", font=("Consolas", 10))
        self.status_entry.insert(0, self.status_text)
        self.status_entry.pack(fill="x", pady=4)
        tk.Button(frame, text="Save Status", bg="#10b981", fg="#060b10", font=("Consolas", 9, "bold"),
                  command=self.save_status_text).pack(anchor="w")

    def apply_theme(self, cols: dict):
        self.root.configure(bg=cols["bg"])
        self.title_lbl.config(fg=cols["accent"])

    def save_status_text(self):
        self.status_text = self.status_entry.get().strip()
        self.title_lbl.config(text=f"🦈 pez4 // {self.avatar_badge} ({self.username}) — [{self.status_text}]")
        if self.installed:
            self.save_local_identity()

    # -------------------------------------------------------------------------
    # CORE SECURITY, MOLTING (WITH @p/@p1 LOCK) & WEBSOCKET LOOP
    # -------------------------------------------------------------------------
    def molt_current_handle(self):
        if self.username.lower() in IMMUTABLE_FOUNDER_HANDLES:
            messagebox.showerror(
                "Founder Lock Active",
                f"Handle {self.username} is permanently locked to the Founder/Root and CANNOT be relinquished!"
            )
            return
        new_u = simpledialog.askstring("Molt Handle (3-Year Vault)", f"Relinquish {self.username} to 3-Year Vault and claim new @handle (>3 chars):")
        if not new_u:
            return
        r = requests.post(f"{SERVER_HTTP}/api/molt", json={
            "old_username": self.username, "new_username": new_u, "hw_hash": self.hw_hash, "pubkey": "ED25519"
        }, timeout=5)
        if r.status_code == 200:
            self.username = r.json()["active"]
            self.handle_lbl.config(text=self.username)
            if self.installed:
                self.save_local_identity()
            messagebox.showinfo("Molted!", f"You are now {self.username}. Old handle locked for 3 years.")
        else:
            messagebox.showerror("Error", r.json().get("detail", "Molt failed"))

    def fetch_plankton_meter(self):
        try:
            r = requests.get(f"{SERVER_HTTP}/api/plankton/status", timeout=5).json()
            ocean_usd = r.get("yearly_conservation", {}).get("pledged_grams_usd", 0.0)
            pct = min(100, round((r["grams_collected"] / r["goal_grams"]) * 100, 1))
            self.plankton_lbl.config(
                text=f"🌿 Plankton: {r['grams_collected']}g/{r['goal_grams']}g ({pct}%) • 🌊 Oceana/SFP: ${ocean_usd:.2f} • LAN: {self.net_info['local_ip']}"
            )
        except Exception:
            pass

    def redeem_plankton_dialog(self):
        code = simpledialog.askstring("Redeem Plankton Code", "Paste your untraceable Plankton Code:")
        if not code:
            return
        res = requests.post(f"{SERVER_HTTP}/api/plankton/redeem", json={"code": code}, timeout=5)
        if res.status_code == 200:
            d = res.json()
            self.avatar_badge = d["avatar"]
            self.title_lbl.config(text=f"🦈 pez4 // {self.avatar_badge} ({self.username}) — [{self.status_text}]")
            if self.installed:
                self.save_local_identity()
            messagebox.showinfo("Unlocked!", f"Avatar: {d['avatar']}")
        else:
            messagebox.showerror("pez4", "Invalid or already used Plankton code.")

    def open_device_link_modal(self):
        win = tk.Toplevel(self.root)
        win.title("Link Work/Home PC & Google Authenticator Can Opener")
        win.geometry("440x520")
        win.configure(bg="#0e1720", padx=16, pady=12)

        otp_uri = self.totp.provisioning_uri(name=self.username, issuer_name="pez4.app")
        qr_img = qrcode.make(otp_uri).resize((180, 180))
        tk_qr = ImageTk.PhotoImage(qr_img)

        tk.Label(win, text="SCAN WITH GOOGLE AUTHENTICATOR", fg="#00f2fe", bg="#0e1720", font=("Consolas", 10, "bold")).pack()
        lbl = tk.Label(win, image=tk_qr, bg="#0e1720")
        lbl.image = tk_qr
        lbl.pack(pady=6)

        tk.Button(win, text="Generate 5-Min Pairing Code for Second PC", bg="#00f2fe", fg="#060b10", font=("Consolas", 9, "bold"),
                  command=self.generate_pairing_token).pack(fill="x", pady=6)

        tk.Label(win, text="Enter Pairing Code from Primary PC:", fg="#94a3b8", bg="#0e1720", font=("Consolas", 8)).pack(anchor="w")
        token_entry = tk.Entry(win, bg="#05090e", fg="#fff", font=("Consolas", 10))
        token_entry.pack(fill="x", pady=2)

        tk.Label(win, text="Assign Alias for THIS PC (e.g. @work_pilchard):", fg="#94a3b8", bg="#0e1720", font=("Consolas", 8)).pack(anchor="w")
        alias_entry = tk.Entry(win, bg="#05090e", fg="#10b981", font=("Consolas", 10))
        alias_entry.pack(fill="x", pady=2)

        def do_claim():
            r = requests.post(f"{SERVER_HTTP}/api/device/claim_qr", json={
                "qr_token": token_entry.get().strip(),
                "new_hw_hash": self.hw_hash,
                "device_label": os.environ.get("COMPUTERNAME", "Win11-PC"),
                "assign_alias": alias_entry.get().strip(),
                "pubkey": "ED25519_PUB"
            }, timeout=5)
            if r.status_code == 200:
                d = r.json()
                self.tin_id = d["tin_id"]
                self.totp_secret = d["totp_secret"]
                self.totp = pyotp.TOTP(self.totp_secret, interval=30)
                self.username = d["assigned_alias"]
                self.my_aliases = d["all_my_aliases"]
                self.installed = True
                self.save_local_identity()
                self.handle_lbl.config(text=self.username)
                messagebox.showinfo("Linked!", f"Bound as {self.username}!")
                win.destroy()
            else:
                messagebox.showerror("Error", r.json().get("detail", "Failed"))

        tk.Button(win, text="🔗 Bind This PC", bg="#10b981", fg="#060b10", font=("Consolas", 9, "bold"), command=do_claim).pack(fill="x", pady=10)

    def generate_pairing_token(self):
        r = requests.post(f"{SERVER_HTTP}/api/device/create_qr", json={"tin_id": self.tin_id, "hw_hash": self.hw_hash}, timeout=5).json()
        messagebox.showinfo("Pairing Code", f"Enter this code on your second PC:\n\n{r['qr_token']}")

    def upgrade_to_installed(self):
        custom_u = simpledialog.askstring("Install Full Suite", "Pick your permanent @username (>3 characters):")
        if not custom_u:
            return
        if not custom_u.startswith("@"):
            custom_u = "@" + custom_u
        self.username = custom_u.lower()
        self.installed = True
        self.save_local_identity()
        self.handle_lbl.config(text=self.username)
        messagebox.showinfo("Installed!", f"Bound to Windows 11 Hardware UUID as {self.username}!")

    def update_can_opener_loop(self):
        code = self.totp.now()
        rem = 30 - (int(time.time()) % 30)
        self.code_lbl.config(text=f"{code[:3]} {code[3:]}")
        self.timer_lbl.config(text=f"Rotates in {rem}s • Press ESC anytime to slam lid")
        self.root.after(1000, self.update_can_opener_loop)

    def start_esc_killswitch(self):
        def on_press(key):
            if key == Key.esc and self.sharing_screen_to:
                self.sharing_screen_to = None
                self.status_lbl.config(text="🛑 Tin Lid Slammed! Remote session terminated.", fg="#ff5e62")
        listener = KeyListener(on_press=on_press)
        listener.daemon = True
        listener.start()

    def request_remote_control(self):
        target = self.target_entry.get().strip()
        code = self.opener_entry.get().strip().replace(" ", "")
        if not target or len(code) != 6:
            messagebox.showwarning("pez4", "Enter target @username and 6-digit Can Opener code.")
            return
        if self.ws and self.loop:
            asyncio.run_coroutine_threadsafe(
                self.ws.send(json.dumps({"type": "CAN_OPENER_REQUEST", "target": target, "code": code})),
                self.loop
            )

    def send_remote_click(self, event):
        if not self.remote_controlling_peer or not self.ws:
            return
        w, h = max(1, self.canvas.winfo_width()), max(1, self.canvas.winfo_height())
        asyncio.run_coroutine_threadsafe(
            self.ws.send(json.dumps({"type": "REMOTE_INPUT", "target": self.remote_controlling_peer, "rx": event.x / w, "ry": event.y / h})),
            self.loop
        )

    def stream_my_screen_loop(self):
        with mss.mss() as sct:
            mon = sct.monitors[1]
            while self.sharing_screen_to and self.ws and not self.countershading_enabled:
                raw = sct.grab(mon)
                img = Image.frombytes("RGB", raw.size, raw.bgra, "raw", "BGRX")
                img.thumbnail((960, 540))
                buf = BytesIO()
                img.save(buf, format="JPEG", quality=55)
                b64 = base64.b64encode(buf.getvalue()).decode("ascii")
                asyncio.run_coroutine_threadsafe(
                    self.ws.send(json.dumps({"type": "REMOTE_FRAME", "target": self.sharing_screen_to, "frame": b64})),
                    self.loop
                )
                time.sleep(0.08)

    def run_network_loop(self):
        self.loop = asyncio.new_event_loop()
        asyncio.set_event_loop(self.loop)
        self.loop.run_until_complete(self.ws_client())

    async def ws_client(self):
        while True:
            try:
                requests.post(f"{SERVER_HTTP}/api/claim", json={
                    "tin_id": self.tin_id, "totp_secret": self.totp_secret, "hw_hash": self.hw_hash,
                    "device_label": os.environ.get("COMPUTERNAME", "Win11"), "username": self.username, "pubkey": "ED25519"
                }, timeout=5)
                async with websockets.connect(f"{SERVER_WS}/{self.username}", max_size=4_000_000) as ws:
                    self.ws = ws
                    self.status_lbl.config(text=f"🟢 Online as {self.username}", fg="#10b981")
                    async for raw_msg in ws:
                        msg = json.loads(raw_msg)
                        mtype = msg.get("type")
                        if mtype == "CAN_OPENER_REQUEST":
                            # Local Countershading Firewall Guard
                            if self.countershading_enabled:
                                continue
                            caller = msg.get("from")
                            if self.totp.verify(msg.get("code", ""), valid_window=1):
                                self.sharing_screen_to = caller
                                await ws.send(json.dumps({"type": "CAN_OPENER_VERIFY", "target": caller, "ok": True}))
                                threading.Thread(target=self.stream_my_screen_loop, daemon=True).start()
                            else:
                                await ws.send(json.dumps({"type": "CAN_OPENER_VERIFY", "target": caller, "ok": False}))
                        elif mtype == "CAN_OPENER_VERIFY":
                            if msg.get("ok"):
                                self.remote_controlling_peer = msg.get("from")
                                self.status_lbl.config(text=f"🔓 Controlling {self.remote_controlling_peer}", fg="#00f2fe")
                            else:
                                messagebox.showerror("Denied", "Invalid 6-digit Can Opener code.")
                        elif mtype == "PEER_OFFLINE":
                            messagebox.showwarning("Unreachable", f"Peer {msg.get('target')} is Offline (or Cloaked via Countershading Firewall).")
                        elif mtype == "REMOTE_FRAME":
                            pil_img = Image.open(BytesIO(base64.b64decode(msg["frame"])))
                            tk_img = ImageTk.PhotoImage(pil_img)
                            self.canvas.config(image=tk_img, text="")
                            self.canvas.image = tk_img
                        elif mtype == "REMOTE_INPUT" and self.sharing_screen_to == msg.get("from") and not self.countershading_enabled:
                            with mss.mss() as sct:
                                mon = sct.monitors[1]
                                mouse_ctrl.position = (int(mon["left"] + msg["rx"] * mon["width"]),
                                                       int(mon["top"] + msg["ry"] * mon["height"]))
                                mouse_ctrl.click(Button.left, 1)
            except Exception:
                self.status_lbl.config(text="🔴 Reconnecting to signal.pez4.app...", fg="#ff5e62")
                await asyncio.sleep(3)

if __name__ == "__main__":
    root = tk.Tk()
    app = Pez4MasterWindowsApp(root)
    root.mainloop()