From 3c3f8704275e2f941bfd60bef1be39b4adc6823f Mon Sep 17 00:00:00 2001
From: Nuno Duque Nunes <nunoduquenunes@gmail.com>
Date: Tue, 26 May 2026 01:34:48 +0000
Subject: [PATCH] feat: logs descending sort, gap/offline indicator, endpoint
 resolution

- wg_events: sort_order param (desc default), --ascending/--descending flags
- wg_events: endpoint cache fallback via _endpoint() helper
- wg_events: gap computed ascending always, then sliced/reversed correctly
- fw_events: sort_order param, descending default
- ui::logs::wg_row: gap suffix with 'offline' label when gap > threshold
- logs.command.sh: --ascending/--descending flags, pass sort_order to both functions
- daemon: endpoint cache fallback in poll_handshakes
- json.sh: json::wg_events passes ctx::endpoint_cache as arg
---
 commands/logs.command.sh                    |  30 ++--
 core/context.sh                             |   1 +
 core/json.sh                                |   2 +-
 core/json_helper.py                         |   7 +-
 core/lib/__pycache__/events.cpython-311.pyc | Bin 31056 -> 33035 bytes
 core/lib/events.py                          | 154 +++++++++++++-------
 daemon/wgctl-monitor.py                     |  10 +-
 modules/ui/logs.module.sh                   |  27 +++-
 8 files changed, 159 insertions(+), 72 deletions(-)

diff --git a/commands/logs.command.sh b/commands/logs.command.sh
index 99b1203..de5762d 100644
--- a/commands/logs.command.sh
+++ b/commands/logs.command.sh
@@ -20,6 +20,8 @@ function cmd::logs::on_load() {
   flag::register --detailed
   flag::register --service
   flag::register --event
+  flag::register --ascending
+  flag::register --descending
 }
 
 function cmd::logs::help() {
@@ -104,6 +106,7 @@ function cmd::logs::show() {
   local fw_only=false wg_only=false follow=false merged=false
   local raw=false detailed=false
   local filter_service="" filter_event=""
+  local sort_order="desc"
 
   while [[ $# -gt 0 ]]; do
     case "$1" in
@@ -181,11 +184,11 @@ function cmd::logs::show() {
 
   $wg_only || fw_output=$(cmd::logs::show_fw_events \
     "$filter_ip" "$name" "$type" "$limit" "$net_file" \
-    "$collapse" "$since" "$filter_dest_ip" "$filter_dest_port")
+    "$collapse" "$since" "$filter_dest_ip" "$filter_dest_port" "$sort_order")
 
   $fw_only || wg_output=$(cmd::logs::show_wg_events \
     "$filter_ip" "$name" "$type" "$limit" \
-    "$collapse" "$since" "$filter_event")
+    "$collapse" "$since" "$filter_event" "$sort_order")
 
   if [[ -z "$(echo "$fw_output" | tr -d '[:space:]')" && \
       -z "$(echo "$wg_output" | tr -d '[:space:]')" ]]; then
@@ -209,16 +212,18 @@ function cmd::logs::show() {
 function cmd::logs::show_fw_events() {
   local filter_ip="${1:-}" filter_name="${2:-}" filter_type="${3:-}" \
         limit="${4:-50}" net_file="${5:-}" collapse="${6:-1}" \
-        since="${7:-}" filter_dest_ip="${8:-}" filter_dest_port="${9:-}"
-
+        since="${7:-}" filter_dest_ip="${8:-}" filter_dest_port="${9:-}" \
+        sort_order="${10:-desc}"
+ 
   [[ ! -f "$FW_EVENTS_LOG" ]] && return 0
-
+ 
   local data
   data=$(json::fw_events \
     "$FW_EVENTS_LOG" "$filter_ip" "$filter_type" \
     "$(ctx::clients)" "${net_file:-}" \
     "$limit" "$collapse" "$since" \
     "$filter_dest_ip" "$filter_dest_port" \
+    "$sort_order" \
     2>/dev/null)
 
   [[ -z "$data" ]] && return 0
@@ -254,14 +259,15 @@ function cmd::logs::show_fw_events() {
 function cmd::logs::show_wg_events() {
   local filter_ip="${1:-}" filter_name="${2:-}" filter_type="${3:-}" \
         limit="${4:-50}" collapse="${5:-1}" \
-        since="${6:-}" filter_event="${7:-}"
-
+        since="${6:-}" filter_event="${7:-}" sort_order="${8:-desc}"
+ 
   [[ ! -f "$WG_EVENTS_LOG" ]] && return 0
-
+ 
   local data
   data=$(json::wg_events \
     "$WG_EVENTS_LOG" "$filter_name" "$filter_type" \
     "$limit" "$collapse" "$since" "$filter_event" \
+    "$(ctx::endpoint_cache)" "$sort_order" \
     2>/dev/null)
 
   [[ -z "$data" ]] && return 0
@@ -269,12 +275,12 @@ function cmd::logs::show_wg_events() {
   # Resolve endpoints and measure column widths
   local w_client=16 w_endpoint=16
   local resolved_data=""
-  while IFS='|' read -r ts client endpoint event count; do
+  while IFS='|' read -r ts client endpoint event count gap_seconds; do
     [[ -z "$ts" ]] && continue
     local endpoint_display
     endpoint_display=$(resolve::ip "$endpoint")
     [[ -z "$endpoint_display" ]] && endpoint_display="$endpoint"
-    resolved_data+="${ts}|${client}|${endpoint_display}|${event}|${count}"$'\n'
+    resolved_data+="${ts}|${client}|${endpoint_display}|${event}|${count}|${gap_seconds}"$'\n'
     (( ${#client}           > w_client   )) && w_client=${#client}
     (( ${#endpoint_display} > w_endpoint )) && w_endpoint=${#endpoint_display}
   done <<< "$data"
@@ -282,10 +288,10 @@ function cmd::logs::show_wg_events() {
   (( w_endpoint += 2 ))
 
   ui::logs::wg_section_header
-  while IFS='|' read -r ts client endpoint event count; do
+  while IFS='|' read -r ts client endpoint event count gap_seconds; do
     [[ -z "$ts" ]] && continue
     ui::logs::wg_row "$ts" "$client" "$endpoint" "$event" \
-      "$count" "$w_client" "$w_endpoint"
+      "$count" "$w_client" "$w_endpoint" "$gap_seconds"
   done <<< "$resolved_data"
   printf "\n"
 }
diff --git a/core/context.sh b/core/context.sh
index bbeada5..bd56cb1 100644
--- a/core/context.sh
+++ b/core/context.sh
@@ -52,6 +52,7 @@ function ctx::events_log()      { echo "$(ctx::daemon)/events.log"; }
 function ctx::fw_events_log()   { echo "$(ctx::daemon)/fw_events.log"; }
 function ctx::json_helper()     { echo "${_CTX_CORE}/json_helper.py"; }
 function ctx::monitor_script()  { echo "${_CTX_ROOT}/daemon/wgctl-monitor.py"; }
+function ctx::endpoint_cache()  { echo "${_CTX_DAEMON}/endpoint_cache.json"; }
 
 # ============================================
 # Path Helpers
diff --git a/core/json.sh b/core/json.sh
index 80401cb..afd0ef4 100644
--- a/core/json.sh
+++ b/core/json.sh
@@ -13,7 +13,7 @@ function json::filter_values()          { python3 "$JSON_HELPER" filter_values
 function json::last_event()             { python3 "$JSON_HELPER" last_event             "$@" </dev/null; }
 function json::events_for()             { python3 "$JSON_HELPER" events_for             "$@" </dev/null; }
 function json::fw_events()              { WGCTL_DATETIME_FMT="$FMT_DATETIME_SHORT" python3 "$JSON_HELPER" fw_events "$@" </dev/null; }
-function json::wg_events()              { WGCTL_DATETIME_FMT="$FMT_DATETIME_SHORT" python3 "$JSON_HELPER" wg_events "$@" </dev/null; }
+function json::wg_events()              { WGCTL_DATETIME_FMT="$FMT_DATETIME_SHORT" python3 "$JSON_HELPER" wg_events "$@" "$(ctx::endpoint_cache)" </dev/null; }
 function json::format_fw_event()        { echo "$1" | python3 "$JSON_HELPER" format_fw_event "$2"; }
 function json::format_wg_event()        { echo "$1" | python3 "$JSON_HELPER" format_wg_event; }
 function json::remove_events()          { python3 "$JSON_HELPER" remove_events          "$@" </dev/null; }
diff --git a/core/json_helper.py b/core/json_helper.py
index 01d5982..cbe6669 100644
--- a/core/json_helper.py
+++ b/core/json_helper.py
@@ -1689,13 +1689,16 @@ commands = {
                             args[6] if len(args) > 6 else '1',
                             args[7] if len(args) > 7 else '',
                             args[8] if len(args) > 8 else '',
-                            args[9] if len(args) > 9 else ''),
+                            args[9] if len(args) > 9 else '',
+                            args[10] if len(args) > 10 else 'desc'),
     'wg_events':        lambda args: __import__('lib.events', fromlist=['wg_events']).wg_events(
                             args[0], args[1], args[2],
                             args[3] if len(args) > 3 else '50',
                             args[4] if len(args) > 4 else '1',
                             args[5] if len(args) > 5 else '',
-                            args[6] if len(args) > 6 else ''),
+                            args[6] if len(args) > 6 else '',
+                            args[7] if len(args) > 7 else '',
+                            args[8] if len(args) > 8 else 'desc'),
     'parse_event':      lambda args: __import__('lib.events', fromlist=['parse_event']).parse_event(args[0]),
     'parse_fw_event':   lambda args: __import__('lib.events', fromlist=['parse_fw_event']).parse_fw_event(args[0]),
     'format_fw_event':  lambda args: __import__('lib.events', fromlist=['format_fw_event']).format_fw_event(args[0], args[1]),
diff --git a/core/lib/__pycache__/events.cpython-311.pyc b/core/lib/__pycache__/events.cpython-311.pyc
index be3ab5604abcc306005425bebb6ba2dfa5fc18ca..0152321633c6cb850ac2c628c73422baacf026d8 100644
GIT binary patch
delta 10203
zcmd^FdvIIjmA_Y4PfN1iPfM2kw)~JCCvg%dgv5C^X&fLxfQG1wubenhEc59)PSPu6
zC~Zxe7Q=;NXi@~50kd>lcfGq!%a*3J1%{cOl~e7a(KKylcREvMXSQYwI~jIoy61dX
zk|if}+TBk7*&F$H&;8!td41>Ho9utEUw%|k`-;(6!@$-3pZ4QlJN#trllvXK?lJZO
zhmO%Pyo0X++R5u5V;*qv20%A&1oZH=fL`7NSjU?IebCy;TcEX{x59HhZvzbQ_9y>+
zpZQg`pyy*F(TTXgj}8m3N_*LVXe=oCSaNt+kFysqGu%1&`|VUM!+fbvTBB%V_0l25
zHr60z6n?f(dIQiX{an%Fsh#c{VR_|a+LY-ilQNGoDT|H~j0_{K8gSRHWl~nrx}BL}
zAACJ!leTak&X&<hj|jcWlwGt-GhC?6Av%)m`E4RgG@?UfPvFc9Vb6bBpcFna479z@
zt>c`6>#1gk$tkdMF|Be+FKqR5E@(2Y37Ongb#`gq(BGc&h*}ukEo#f7|4h_DiAU6x
zOMXt*<C3}!md2D<@Kns;eHrF^tvqL{POOzStLl1Imit8CaZ{<^R0FT&4RPa1bIQ*$
zqAz2SUcAk&5dG3ORCOw73WL0%>hU;WT^`XnqD<BEwY-Tp^Og%-Dj)`cJI+swPTu^o
z0%nIl`AP-FdeL%<Ar`Stw21Y~3q1=eBnD5=W<)W=o}ZChY=RQeoUzOE+ogxqkE`@E
zEcs9}Xxc0dAhSl%Ooh}@k_zYeWOkZUo<CkRGaTitBIT7b54yu3X~&9fH7OX;M0w$Q
z86^K&S^BAFX^YAeSjp@bu}N+%Hj6D8Cv46kg>+U`tJom6N?UY(W2@MBiX|$sMQntU
z<GOWRW5x~2*C@TEb8Kr9+eDR~;khp;mRXo;7i)NDQ73%D>LSnKCahhi#dcXCo>IED
zwu|lCnFk*@1oBC>rdq_-Lu#O!Qtp%|<w`ZDLb#lY2|9#z6$7<od}s|vQk}xaisH_%
zGrUV|qUfgRq3EL6OtItZ%td3hVzSKn&+yy<1}w1){<@1&{o?;xs&!5fR9QW%YyyoJ
zMH+0X6T8UYi(S0CVwd5nw&7A+u15?@cNju!7;Lq@w#rn)V5-}o;yTyg3dYb2THbqt
zYCWj~J?=s6<~>F2wu;@nTe`#8z;(%b?G)`Rc_DVwDu=XSbk<c$^0o?2cZuE7ywdkn
ztu>rl^#{p*Ray47RpKgYHXN0{J=H;7Na#;#Jgf`tWz!#LFT(8=J1h(8&Oeckfn!mj
zmW8|v&E{4G9144_-|;(O%8&J<<Kc0V5E8?QI6>KwIs~8OvE9XXOL5!kU^f)J%D_>?
zo=&1i4Uz!h$J$Nt=*c5|bhGpwt3%4!d;<;GkS%a0VrL3mG&%e+E583bxZdxAZlPd-
zOA4gGjgARK2Q3L6p9D`aVwGC#P0d;)EeK$bOu;xp5+_HKiID_385Kx7R<ufSdrOZJ
ztF<uLh%kCGR!}DsM2PVP)u<3VnJg&dqe-ElC9zX6l8o`hEX~`UdhYD#I6+SzS}nb2
zAJ^Alr$~bEF(U1B^s+%|(y^NLORqT^)vY+yI_YPQ`!wprgfKoKNFB~imV#<LI!cnH
z9;%b5ozg?jur%dV`nFJx6m%n#5twyMNRo%4+KufFFTC#D#<6=Be&;#M_E`cMM@F5|
zWHdQT`?NZ*cg#Aj>g%)m`fCo)#r919qPHXG?O1el<{X{VJM+HAg)i1Q6@zB`GY4i}
znbt)|DCY<*nmcmlj=3Fk{d4Q)*5%Brr&X0B+1(f2nU?1Q7Xpj+P|hBj-jR3v7hd;&
z$gV}cmo8)mdhFjW0rjPxXBnR56>;VylhUzBb8+^hB2~jO5JC9*d8O=PQ+kmjCZS>=
zk*hZ2F_u@QI8g<y^pY>=?@^}=qL$Yb`x{4@b3LMl#05iXB@A<1Q=&6kJo5%cP4%E;
zAH*oOQX@DVSJXq;QY)ZB7q8=b>01qM?YSOajsK)fV>j!TvMOH<cv+J?7REar*io#d
zKEakULq+8v5ERK5oW-^1_0=hhXvvu9$rU?n4M3<=j)bh0k&vh$9?>dIwYxY4UnA8w
z)N#drEqY#8eU6Ii;_1bne@rxxqvaV)5t|*NLzXv!SS%?!%fNxFI}XDd-S!lm$H&VY
znW_^VvRmyF?Z?Y|_-1W28?lpUD0*b}{LjbCO^kqi@pC46AltWymg+7ngo5Xl*sR11
zhG}Mql4b748p|Yen!BHwWMQEzSnZnbfk4v)fu>W`&v4{XSbdG4WuzB_?m8F5Fm8~A
z2mZXGi3;G63htUB_7cY=;B=i8Iy+ac4Z^x2R~<KTHRTg}q=${(nv`Ex!MDLw{h0Np
z-Kaq0)v5aXnK5N)KcbH}7Z0<wVm;{-t#G9I#CnKFAZ|&o;1V2v0nsG}PAg7V#3sD;
zEU3^hH>{umT|jix=%yYH=m3_Se*;GKiFLp^TV+f$!a>OBA?HL7Z?8C_8-$*c48TK*
z4MjyXMJ&=AN|UOwToOBMQI;OkH*tn?vY}eaw^%`w7!;ez$GKl@q{q3Ve4KlE`|sN=
z=*B_OBP-QSf`jPVTMhtCwN%GG51P;{x-%Y(_XZ$BJ4w&zK&oC090Hf0vZm@%K8V+V
z%@s^(tqSw%Gj(XEid36q*144+E{xV1kBe;(fjLDh#X5>UimiwjYep2+{D8P@3^cSI
z))cCW^E{%r+InH3zorYdq*_bbDE-N_SDEq)x1kz4Q*FEs!WAFyD#~QH*iIF|o))b<
zTfHbq4;p#)1Rj(OX{++qML||?H`OV2mfM?zvNr}T>s-;YL-dR7qLnIiDC2|)q)WG1
zHbd#}WwD6Cul^QneqU_P1kmR@#ZdKBpd`(iAX?jM_hZaAJvY~i9ApFPO3MKaG7>xV
zYe2E@!686Eb}FEjlv&tOG9b*aRt|XH!K*7maoH&aDx4BHB9*ly<O4SuR?7DYPU;hl
zeA%F3J*9)CXwNNvh|(X2DE$*$z@OIxctOC`9>4+t{qOYv=RXp=P(h@>xXpSi5752r
z0X9(&fO#!iT)4{OAl|Q5?*Gpg7cN`eeg6lG3*W+U!qjlWvf-=;!wLVfh7<Ch%}asq
zwsco;I57cHa98kXbUYXx<Abp=emntze~`qIiTH#tnivb$1mRka!UuwF_*$zi*j{|$
z)fF6zO~#T!a0G&GArusYZIDwyeIgDGOT~1Q{WM4qj>kwaJ~}4-z+#l{3xi*T=_AS5
zaAJ&4(spu!qe7>MkuSlJhTvH;MAjpjK%i+6+g(u6P@XhnSqnlNz;OAM5<Fm<f)Utn
zrvaW}pJhZQ161jf4h_{v`*+whtjLas9#=?r3^}Fk2kO#_YJKKcJVTzQ94cr_JfjPu
zOAE1N5C#u%WEgG*MQprKTWS><jt(D-C2?E9;8ZamiIi&3`X-MSQ<LzfbUZN}jVCvU
z%hkVuUP;VAZ%i?HW9<|7oV#acV3sTz8*|3SX+_>-$(pvz9DdKycGb}~$9`M&m#VpA
zmlccc8*}X&FW<H3*phQ>$!fO{%m53Tr~rxBxIlX0iD35lK4cgS89;z{CKiTl0J5Mv
z2C9)f7CjM@61Lttntb+Q8_caLGEK5p3ibrqjndX0TN-B|{Q#jRIZf0<;u?<)qe>+S
z9(V+gCW3Dah!voqNI*_F9u<xi)Unf$8YanRti$a>u9%4OWG6mvLD-6bJTBBEg(wk{
zlcT~hLi53GSk<0J+>U@J3E71}Q`X%`?LokIv1A_tRh|7v;r?-Y0R&P|qS6;M#RQcM
zL0zbq+<{GuBcpL4Mk2%UQAi`nUD)>?gnJPVGEAB&7>aGEdKPRY5z7h?fyx+p09&JW
z$_)7oQilNwHE3ecV|45&iDGF4;Rph%lxzUUkfM7&j?@<c3Z`R;2@*dOkxumL*fD9M
zw=w;Btb7Dv6yYHRf`D(!$XSHXA&3Y9!UV!8gh_ycB_2%*k+Kp*ge0g$G9qW(1$~9_
z7C3kyr?KZ5?5PGfVuW|%<O}eWL^Z=yJRL0M;bmnf8K}FAjgG?G2GH)MT1M5FRW?-q
z^2)Ys_3xU^Idl5S+n&BHv+b&_ZEA16p*3p@KeKvf;>m%h2WAH52B&u9L*cA#{WBY9
zCl+ljIa^ECmTsBfKD9e<^Jg4aZLL##meh>XJvEfqc$XNJ%5srhn0(>k=O507w=M<-
zbAdrxx};F*EY~cKtTVJ|>Bw0+mKfF;o{L^<Xu0H>TlJ#vl5eJViGwm)LE!^z@*%=<
z8BpmJ&&KeL8#k(26dT;Q@hg)XDs+}*$Q#Vl+hHD^1v{ykTJzM-C52yQyk@k_G(Y~p
z`3II5ug){OD)06zF&?Am1B4mnlEQ8ATyy&_)MTV*@3TtttIo1{sk1NO%KJ8CtAF|C
zfy{0x?RHA9xC7GDeeK+JyI1;A-|Bl;!B|Tij87+_@BvQuA;NOmtth(3n_Jzu@ln5Y
zN75zz#-r<2D^y$ACFT=Q%V=#MFk2KVcfPK5cB6E9bwFLO>->PJmoBdE(gkPEWGqjL
zPm9uce`C#(k~4bqj?S6;B*mI}RwFH}X}vukY<@-il6KBL-?td-&jtH0D}Si{zV?di
zoyNuW`*Q2|<%6M&Zm#)7(<Re9H*cNia=|sg>|p=Q?&~hE)Uft&0C;Y-Pphx{T3*=y
z{QgB>ch1)h8loG5g#$_#*6v8>>zlK6d*PQkCEw?@^8NB!`F^E%hbI`mZXb)PGQ^^;
z;5ZeiW&DAx)|0n8r*+rdb+dc2?duoa8*=UqON>Q#1R5hgzI%G>^hDm}es<!iiCO8@
z)xj!ubf>R-ebamMCi|@Zs;Mb!YRY>%-}Cld_4drGFSCo@ft+_>Mw7RBXYYJ!<IKiu
zUjOWo%(~~|i{8$hw{vD&-i0-jGn3a^Lvu|p9=mjGR-f+*XUz@puFD*{Zg9M3@Le_d
zpx3?G#t8i8M&$eaX}oW0j9h7v3*IT-vv)lx7i9gPT{J{<hG>@lu4`+bFrG8cj4o<}
zIc+ej4NBMgT_KBW)-kJ|)y!(14$v2JXcGRs!TQ9|xuHdaFK6&&4Zgg~|J1tG`s)@K
z^2PrFW05wmt5l6M>-s?#=GTEP_<}F&etvi6zB#h!>&yB2=C^-$_h0Y6eDKPV#WkPG
zt@%{m*E0L54FBBz3;XA`&D}M(E$8b6Vfp%IwAXD;seXM33~2ZIP#0)~EF+6;T8%Q=
zmAQA(-Ia59;UXebM3JJ1q!(AW|CvQ&ePZ9aeY1U;)@<Mq{O0=Q`}}VCe&^*0nYdEC
zzw<fyIqQ9J(Qr6tIGm+F;OQSMfwpw=zrmURXq9QOn|YIQ3^s6YIt)lRC<j|KZ?<qq
zx3frxDBWE%IKaKRfd%|AV}e8a$0qfzHQbM#n|C>tKe4kw|HPq1+E3|vFVgENy}<|c
zPaR1A)agdLC%t)RkMgZ<EP5-<LeX12H9I$H-rAr*dLxVUCT#k)T>)+0cGm1_*1R3$
zkZxj;Zl-j*0haRi8s)C_nzz?;NN;43-h}i!OwDd1_l|)DeAjH=)1Y{_!LX-S^==QV
z*wee995}}EG_=4-m4;ICxm`Yxhe9eE-pDZx#uqfEAv=KzDVC4>B!*nUpd2jf$D{DN
zTn-Y+OHgroA-nO1igXip$A)q^vpi=bmdPIrfEo&ED&`!-IxPYX#^@60?8@cYNet`#
z07(qnAQ>pGq*h*u{4!k&VbCS0essZk`}16yPKs+7qEmmw0r@XePZJ;9NqMOsvjg&K
zG0qI><j)Nl@W~u0M|l-Xq!B7zqCsBb0c?H<VHkl&7@^Z2MY6p3f`*4E20li}LYS29
z+~%kYK$C(={&Ep1eH9?DLg`l*9@+MhBAvi7<b6<4ejcA+MxYTDuKO$}P96=ZE4aG6
z?&a00D;P=##n6h-;c%p+8UR^aVy?U>vk)o8NaQtW@zR27*DpAERk+8Y0y}wDvjg@-
z27-`wU~oz!`H*2bdS1y)8Vn-~3pJAjzQsT)7E99b7QXzPNy2v;0lv17f)c`T0XBw%
z7HUR$h;&CsMq{Kfppv^pake7}$oiYMU?j1ViBm;YO_INXHh;TtVXs}=f(+QXtfzOs
z%E^jPBXlZUNS&mAI?&7pq>m5mVt=+Uc=t)R7k6CQjeHjhidh!H=#ktBAm>(7QzRh$
z@}6DnHL301N7JukEv7i+uMnud84F7KT}m|q*@ZyPW5rhxzKT#zJ}TIUOOtbnZy|-|
z60#IDAR-Ls3mVWM8rOdhYjG{`sfi{EQs+V6!8fq<`v^b4sv4O+JV<z%9+@Ny*rJ-X
zbaP4MPB8e{&!Uo)E{LS1ZyfZg-iEq&7k+r~zx2zdCma3CINY+?h48Thp%bACVG7|D
z1k~~O%>V`V?vL5vS#D%fl$pgAfK3z0V=G+PS#I*Ec=Y+_@cQ2EAs2ZAGcVAim{3q9
z$K#{LZ-}>GF639S*a@18;a9*Yk4m-DiYUhiacRq5Y6c&-BcK3ans^K{Y|Gx*nInlP
zkuLMb^pCLi3Ia+&&d<<Ml#{aY7<_ajD3O95X_Olzbkvc+PC=T<f+`+85{t_!f$}J*
z_!vJizO3=o*%b705*Qhao{W(ZobKpG#Iom+6D@onPvSTXH<p-`**J$~n3WY2@YPdx
z22wf}a#O#gAAyWHF&T*`jwZ=3p;fJ7;Yw^soko8IZv0jnN?ApjMwL@5dxUj31?(yo
z=jp_dPeV$#LdlZI;gVj-XH5;w{N(p5{|dE76kuN63tx%fqfGw-o`;rgSYAC<HtOCU
zf$Fo0AgIu$zFzW=@D!@~<Q11)lKeiv1kGjZ(#spb$>an(f)q$&XNBjXX{x+{^4v*1
zG%W1~?!^tspM4|X@yV~Cfw1t(Lo-~u1;`=#-Ut?{#u-`>wjs15P;J|R6tY!bBs~w1
z)gi8+f$!h+Y@z)gg2Lh(p5nYZtQX*yB)^8rbI8Z90Rf4wQlpaoZes3k6|qBs{1S;C
z-V~fr27aANyrH0pMEJyTBqIB&+p+z(5x$I|M8L%twDHj+VR(5Lm$IkUr}5<qu^~K+
zkU@9};SvI#b@XVV{+Xa3p}Iy;-jqjl#iS1(8xT-8;Xf6eOz;!&*k<x?@W{en@){t-
z$1J;~P_RnK;sCS^E2Sp?d1sV8$}VyDE7&_A8ot$Si;CIGZfEnKzH5p5oPvd{_a@w;
MmM)(Dwi4IyKR8@_F#rGn

delta 8161
zcmd5>d2Afld7s(Y<=*!-yWAyrd9OrLq-5$oOzSY~gQg_gvMy5;XDO|;<kD}4qD;Is
ziBxfDN3Cf+yJqY<rcuM8YXf0Q6mZ%UbsXDKQO6-s77(^^p}6fI27;7oV$^U^q~G^u
zm%F6s97PIru>8&Uj(P9<zV}@-{Q6gP3;!WHzGb&t1i0Ql=DQF-_N?RC2Yia@ig?0r
z7R-X;SIj^M6w4LiL{PB;%8Cszq}Tz&iUY7xaRNqQc0h5#?5N^~c9r4*tX90w{``Jd
zLd;v0<Urp@T2)g0YJ%M>{z%tvVKJSrV%aVTU)#iX>Kcs}Y9LNkVx93Q`>HM`TG_wH
zBKoH{sb&^c!n&M|eWI%m+9x*+h>HG-Dd#vR<eVuX=Q0bbow+YX>)q6SK$sFw|8>p-
zeNGfiyDpfD6!oyqWF712aY|n5WjCDxcE;$n`=~D~UfoYcVx&Iyp%fCev5%~A(a);%
zL8o68i)#o1^|N=JQ7KSZp~vcV23L)1PfuFojWRXCnn7y1DB<%&y!sE+3_UV6uk`$+
zu#U^%y%<tMW&4C)hh5)X**O=ccJeUDR#}>J!BM2?+S!$~^1_N1CgO@ov8C;Uu3SVE
zXyuHXiLL&4<btR8{9E=lyTS9+&fYU@3i&_+nfeFxxv1h$oQg|v|EZL#qE(<lxl3`q
zt^+pVPrGu}G)i5U1mdP)>Y~w-L}OrWwE7~SMs!o+)hTVpZs?&-_KrQs?%U*KE{B1=
zP;tp%nG(qY^B5c5F*xWrb@JogkSjYn$@iNN!6~a;`5JeH`M=%K!jVWJY6UTaePASO
z<gC#N)WKB~cpY|lb7hxY?QeZZb+krXf!4AgH_2>YtIIS{k*lXMTF<^|k2q*Ojb9Rp
zf!5JDbPb!giE(zgA;6|A4)&qhf3$%%P=i%aq_65qnm!<$K5+_8Bv+rSqxGjMfU3y_
zb8;?_tIajy;-$H{CUuLZ8$?<+6K0)FHRvQ;66&_Hk;F^j=Cp=mkfY2oz_FHN6T4}N
zx;KDxZY-SFlfSR?s`S$`LtN!3n#09x@!BxmK)y#eD8VxMnpe$j=57yjr538uXN(?Q
zf$Xt**s{$oY6Fwjm}8agXx$%KV-4U7tzhP@7rEJ!N-*RWG;c*Nn74;+RDy7VadAV@
zu=U`08=(=n<_K2qC@EImRifzznDSUQ!nz$E7q@qbpQAU|RIpqKSpR2M&n<n|?_}xf
zo-*cF&f$M)IX*V$GK-=4zj8I`L<{?==Q~j^EdPZyHQYK(GHRwjlP0KfA|r&@x4lR7
z8-QewZE5o&@rLk*m=`Z+F=)m}gmwA$c2r@%n3palAOAw6pZ*H2Pn%&vqB<{SRg#xd
zLn<-CB!Y>8m=Rp;9bau7_>Dj?h7vtM-abGwgQ;w0AVUWGR8o%vwan<R7bVu>k0b~N
z<GgugM&2+?VC}p<oyw|tX)HBNAmIs#Hb(u!>~sGnG0K_(Tf{Is6{xAG#pUi`R|1c)
ze+}%?kxCZbx+5InOAd_oCNCw2)GWCKZ4^Emn13R;UlI?_zZ)JC?U4<$2WPj=Zkye<
z6xlLA6bb06<;crNXM(d0i_!L_X#1kPc}d<pcW`d&+_t%GOY*My52}7CMp5kIg}h-5
z`$Z2>F9@p0ZpA8{qL!#~Mk?_HT^Wy>bvcQrYXhchtCTZ=zndZE88HzzTBwCvZZKzs
zK2&Gnx?m_$)H+j9j53mq+St_L0Q;9NZ?&D;S5mQ^7WRg;c^}o05Tqk98PHRmQo#<N
z_nO74=V%4^9)G+}F)D`D5t>%4B-tyFh%agrWypkUCgvQ#sF%g`{!NZGS<p$H7pz6L
zA&Z(7OWHhW%elaroio5ttH0e<%EE71Z+{-LKVJaExH;si71S!$UK7z%^Nb50XTLh`
zu7YG}!ja-mf=~xWCkn@*qPgm4cO2ecQF_!wjZ+e7P-~gbSRZmja`eCfc;U}S&0O^_
z<qAp-tS4+q-;!OU1B&f7o%oAGx9K$(Q0v*uv2aB$Sk&9$wR)3>Jh#bX5Ft(F<m1AS
zepI+D9T!GL8c^(o7}`N)vYFbcp9ZKr<7I~%{o`v^g{T{%ZW_9*yIhv+6z3QiY`@g6
z<Ap?sdU(Q=sfUKJ=jxAO)d2M?lHw{)k^>S{R9^Bt^(yYNbWy3IWAh8Vo>ro5>QRjt
zm-V@b)&tfGS%VMy*0DT3kiK23>+leT+!0;LBS9MBdBn4lM|_I=*U1a^@fh`%Oi53D
z&;aF$PS)A#HNFgHQ3ZuB<Q=RTwnJ%<<|!qVlWFJ_h?ukI{7@KFqh`zW5K}i6^#E#+
z*<uqe5H-YUmA0EC&jitlAEj}~{a$M4=;w$vftSW!5?(eB=vKRgC|n&>+sl^ruC1(q
z#Tm|`Ef*^q;W|G1`!ZvFE~swN?0H4DZNcAJs8>NRVO0En-xc94|5~AG6_wU0(|lae
z>YQ~|sbyuiHhP27Q2`FG2L5Ube!aEm*BC5I&by9>YRcJty9MU_U+xVh%ZC%^QFX=e
z>vBO_1HMx8Wxn$N!BuL1qpR3xO}VSomb*%HyINkAm78b{l;`06&FdcF*NV2fs*YZ*
zK0Um@tYo>;!F_4eJ$ZXffv8(vjsIGoTWfq*ClxTJM4;~o)IIEnZH?Ag-;fgP&x}A#
z!7T1}Zw!i>Sf8pU2Zz;|R%@_b?!hgV7+eFXw3;MZ39>WRSeVurqp`;Guuk@T-^C<v
zHO89y(rk~XmW{RhQv6xs2UjNnfNqjPl2>$MOWweDA#v>EHC+u-bpUx&a!47@VCiHm
z>_u8|5G%Y-c|Eojo2U-b0RZJ+M_?1S+5n2hAGSBM?`?^VM?vZ=ROiBkFcY8Ye64Om
zAed?izW5}fWINJ$_QZv-69J2Ig6V@`g-iAV<SkjXkEq$vlzN_5gk&EMX>}k{cOrBm
z+=Z|o0V=BTLJ@fY+lLUaP$YLFaPjX!3d^s&KARyb>B9CO03_<jz1VFpoIrm%1yvxq
zAIEzT4kH}FDYo)MA`fBzBM8R@Auf=UNS;DCjld7$EK&+WE$i#>i|5&BN6nEj?06iZ
z9|6-4Nh92WkVQ}tMgZ~^nGtn(L?uJmlR+3pcnpC6Wbrszd$6vCM1abhN6!@t*(ag>
z7dXWURriGOnarLH*6qL1)Ux2&_WZ`_<f5l;$y2xBshhiFqU)yJIdN!NS8cF=Y<Ex9
zJ$2&hiDe;T4o$b;kVDHtr9E^DVM@QO3$tg{F#BZNn0S+&-d@f2h3;Y3w>KG<D+GTf
zbA`jqz9aN-2h3iUU<JMmhg-PdFA++8>rtP7{`vadpY3FHN8B!$ytjmtqG7-Iab*Mh
zyB*aPar4GoLY)14M>Ff*TVXyi>sbsoF9n;~k9XIYmi3Z7{INgE9@sf2TCVMC=(;IK
zUNOCBnvrKWFUqY;a_fykM{u@gQEpk1TZ$dw*&~Z`+mhTi=bfvW^DfC9%SL@HFx9ne
z5#&mi-1TVmrrSGNaU)Xy$^$Pxuo!7sinJ^Xdh=<KBl~36!Naoy3mZ?sZ|;(If5)WV
zuXkwog`<xYi15ip+o>hnsRjP~H@R~9o`t6Ei}H>odB?I~G#`dl0ofD#Hr*y@OaBd<
z=b8JTzJGf2Ov6HTH~eO|YWKM=?f&+Nc7LaEUkE?2XzN+B^(^q;O_Spp>(kb0$FyV8
zx@c-#GBqxk8gB%n(<9RZ)90qoJvYw&bI%s%4R>%^@R_5x5GFg>cXs=M8?RG-VdUD#
zbV>Oa_HKoD%vbj|u!U%-`Pj_aMPFjcm$>1RU+B8l#V7ijmwe5$M`zE@9$oUagKi_9
zDbuorwNxEz{|&EK%YwnYAM}CvRM%wZ<OrJ_t7YHaZNE)5fpMFA>fr@XC;X-dwEN6u
z?LJqp-QO<U7j1Vf+3s54zh!G_i|hyBN`K=#BnscRRUGV)zVF?8FsOgmEdu?n$Aom4
z)0JVQJ2<^H0`w0&;y6tDfmg;xbEob=oBq949Di?<2wm^BSq|(mzPD3{^llO9JvjA!
zzYgZSAG92-H@+X2kggMvuIF^Z2E4rAp+C68`2G$F>D?mIdyxJ>v>b9sAJ|2}>y<u7
zSDWs7o2_e~;rd>&Yu|jn^Sr3=z=*kmM|dq_t;DA8grO`z^Kgj)nupzlt`z99m{?-)
zApmZ9>u?{*CbjrOCZXrh{OkMwRyQ64Qp-SV_N>MM?Mnkt-3epao_st0eSjwq&H@Jg
zgub*p>BR-Y09ic%B+>#W4viD-t=<Fy{b?BPng7|L7o~B&Dazf=xBd*@$Um8Qj)dS&
zVhAYH7vfGWbzu5Sz$axKSSMwX5{sB$GzHl-7Q3<IVFaEN9!2U5<`U9}u)=)asASb%
z_)?-B0!H|(4FKgSUYdrT+Lw{u;^zwT3`{#Uf9&4RbmJ?zzguIRpXF8Dh$kDAV@#r>
z=Moj`%2DFJqD;YjQJ!*EOe2dDYiyM>#s0qAYIqighUfpO`=6zU_>-vX?z}iUW;{qp
zhU|<bM4oSXp^>nCX(6Cxc0BI9Wt61UWI8pJ%#tqVI2yW_Cu~bffkd4eNF_<$ppC9h
z!MCw#C&|IgrGj~8$&0Y~AI_7bK2tridPq|m+Qox!NW2=+K1^|&lgMfI=E*uS!WK^6
zExtN0pBfa~P`L8P$ji`?fT?gJ-$b|%AdB`Do0x!aWq*14Zt+d_->1J)^D2&Fu|*gH
zw=sKOucii*dBZ?D)2Fid9p1Zk;@}#iLw+>%JckteMZ%poLf(h^B$+pYX&^yf!O{EJ
zFCJ|?_8O8i2!95Uw`ht`dPmQd=z&r44V<xBiCm1V8wO&rGiS6z*YHk|=ds?1VGhQo
z=dbntm$l?rnoD!jD>+pIuHJ~ygpfeEjPOSY7#Kcv0p!I8zYt?%(!eOy)FPrnMzZJE
z1gJ4-^c+3+;y3X6?!H8jyf%(cOWCBFH)My?slpe>*Kzf4A<QD6Mxh2wCNJ_jF>fNt
zJ_XHZT{W+XK~LZccOszHVViU^Ih=Rjn|%CirjM|%r|si^j-ziN;Mr?+B!+>N>Tx)k
zBw2zd0^t&9JS-^vd6)o6;pDPl&wXc;X^m?<kGw%iDkH;XZi%5JZ`F#`-l4w1Bsl{;
zq;EfBFG3iBSCmPl1_1KXPzIa{n}3YZk9|7$W;%u~3=-KG092E)P$8fXWYX!(Xm2`m
zE=#V%*iXcHHrQP;j&1_c8nwAraa?EINKr`%ljiTp35u6YE1U!PWZMS;Z?&~$O)#ry
zWEuw+oL0yvAHryx4!CTYKchaRAO9h=3$YIQ(Zt|Z$7Mu;#&j{TrQMs`$lK6LSiYQN
zt~t*34qS^zLoR?-696~U-UyB(1&l|^>-|!Q)b?gQkNW~VDO$95y<Uji<Rf_WuKBUY
zr=;;3AiMd?7;uHji_{|QL*VZ_cOun^fNW?lPv|9DhLQ3{_zKQ*27eCUBD6?TOo8~7
zyjO)^mMp^HBdEAP0b)W})*B7%sod<io_KIUuDlh10JgdpLN-6{c;49Ct7Q6ndkJ@{
zUHI(t0APq<Cdqy^l^M$7>saAyzA2qL+d87A(!_v$6$nNIJZAVW0K4|Y#@<UvKZ!7j
zfO(oHHG-*x2Wf&KhFc#&3*buRA`$*VT7`Y6=`T#X2Q$h@I=PqpBQ!<$%l?!#jQ{MO
uBjSVNvUF4@_CUS3-c8jDo#FxUMt$S5biYo-vU0uKc|Ch%;@f)M@qYk=mN+l~

diff --git a/core/lib/events.py b/core/lib/events.py
index b4c9b00..1ce065f 100644
--- a/core/lib/events.py
+++ b/core/lib/events.py
@@ -22,7 +22,7 @@ from lib.util import (
 # ──────────────────────────────────────────
 
 def fw_events(file, filter_ip, filter_type, clients_dir, net_file,
-              limit, collapse='1', since='', filter_dest_ip='', filter_dest_port=''):
+              limit, collapse='1', since='', filter_dest_ip='', filter_dest_port='', sort_order='desc'):
     """
     Format firewall drop events with dedup, counts, and service annotation.
 
@@ -124,7 +124,10 @@ def fw_events(file, filter_ip, filter_type, clients_dir, net_file,
                 continue
 
         sorted_buckets = sorted(hourly_ts.items(), key=lambda x: x[1])
-        for hour_key, dt in sorted_buckets[-limit:]:
+        output = sorted_buckets[-limit:]
+        if sort_order != 'asc':
+            output = list(reversed(output))
+        for hour_key, dt in output:
             client, dst, port, proto, svc_name, _ = hour_key
             count  = hourly[hour_key]
             ts_fmt = fmt_ts_hour(dt.isoformat())
@@ -159,7 +162,10 @@ def fw_events(file, filter_ip, filter_type, clients_dir, net_file,
             deduped.append(e)
             counts.append(1)
 
-        for e, count in list(zip(deduped, counts))[-limit:]:
+        pairs = list(zip(deduped, counts))[-limit:]
+        if sort_order != 'asc':
+            pairs = list(reversed(pairs))
+        for e, count in pairs:
             src       = e.get('src_ip', '')
             dst       = e.get('dest_ip', '')
             port      = str(e.get('dest_port', ''))
@@ -176,21 +182,28 @@ def fw_events(file, filter_ip, filter_type, clients_dir, net_file,
 # ──────────────────────────────────────────
 
 def wg_events(file, filter_client, filter_type, limit, collapse='1',
-              since='', filter_event=''):
+              since='', filter_event='', endpoint_cache_file='', sort_order='desc'):
     """
-    Format WireGuard events with dedup and counts.
-
-    collapse='1' (default): hourly aggregation for attempt events
-    collapse='0': show all deduplicated events (--detailed mode)
-    since: relative or absolute time string
-    filter_event: 'attempt' | 'handshake' | '' (all)
-
-    Output per line: ts|client|endpoint|event|count
+    Format WireGuard events with dedup, counts, gap and endpoint resolution.
+    sort_order: 'desc' (default, newest first) | 'asc' (oldest first)
+    Output per line: ts|client|endpoint|event|count|gap_seconds
     """
-    do_collapse = str(collapse) != '0'
-    limit       = int(limit) if limit else 50
-    since_dt    = parse_since(since) if since else None
-
+    from datetime import datetime
+    from collections import defaultdict
+    do_collapse  = str(collapse) != '0'
+    limit        = int(limit) if limit else 50
+    since_dt     = parse_since(since) if since else None
+    descending   = sort_order != 'asc'
+ 
+    # Load endpoint cache once
+    endpoint_cache = {}
+    if endpoint_cache_file and os.path.exists(endpoint_cache_file):
+        try:
+            with open(endpoint_cache_file) as f:
+                endpoint_cache = json.load(f)
+        except Exception:
+            pass
+ 
     events = []
     try:
         with open(file) as f:
@@ -206,43 +219,45 @@ def wg_events(file, filter_client, filter_type, limit, collapse='1',
                         continue
                     if filter_event and e.get('event', '') != filter_event:
                         continue
-
                     if since_dt:
                         ts_str = e.get('timestamp', '')
                         try:
+                            from datetime import timezone
                             ev_dt = datetime.fromisoformat(ts_str)
                             if ev_dt.tzinfo is None:
-                                from datetime import timezone
                                 ev_dt = ev_dt.replace(tzinfo=timezone.utc)
                             if ev_dt < since_dt:
                                 continue
                         except Exception:
                             pass
-
                     events.append(e)
                 except Exception:
                     pass
     except Exception:
         pass
-
+ 
+    def _endpoint(e):
+        ep = e.get('endpoint', '')
+        return ep or endpoint_cache.get(e.get('client', ''), '')
+ 
     if do_collapse:
         hourly_attempts  = defaultdict(int)
         hourly_ts        = {}
         handshakes       = []
         handshake_counts = []
-
+ 
         for e in events:
             ts_str   = e.get('timestamp', '')
             client   = e.get('client', '')
-            endpoint = e.get('endpoint', '')
+            endpoint = _endpoint(e)
             event    = e.get('event', '')
             ts       = ts_to_unix(ts_str)
-
+ 
             try:
                 dt = datetime.fromisoformat(ts_str)
             except Exception:
                 dt = None
-
+ 
             if event == 'attempt':
                 if dt:
                     hour_key = (client, endpoint, event,
@@ -255,70 +270,105 @@ def wg_events(file, filter_client, filter_type, limit, collapse='1',
                 if handshakes:
                     prev     = handshakes[-1]
                     prev_ts  = ts_to_unix(prev.get('timestamp', ''))
-                    prev_key = (
-                        prev.get('client', ''),
-                        prev.get('event', ''),
-                        prev.get('endpoint', '')[:15]
-                    )
+                    prev_key = (prev.get('client', ''), prev.get('event', ''),
+                                _endpoint(prev)[:15])
                     if key == prev_key and (ts - prev_ts) < 300:
                         handshake_counts[-1] += 1
                         continue
                 handshakes.append(e)
                 handshake_counts.append(1)
-
+ 
+        # Build output list — always ascending first for correct gap calculation
         output = []
+ 
         for hour_key, dt in hourly_ts.items():
             client, endpoint, event, _ = hour_key
             count  = hourly_attempts[hour_key]
             ts_fmt = fmt_ts_hour(dt.isoformat())
-            output.append((dt.timestamp(), f"{ts_fmt}|{client}|{endpoint}|{event}|{count}"))
-
+            output.append((dt.timestamp(),
+                           f"{ts_fmt}|{client}|{endpoint}|{event}|{count}|"))
+ 
+        # Compute gaps ascending
+        last_handshake_ts = {}
+        hs_output = []
         for e, count in zip(handshakes, handshake_counts):
             ts_str   = e.get('timestamp', '')
             client   = e.get('client', '')
-            endpoint = e.get('endpoint', '')
+            endpoint = _endpoint(e)
             event    = e.get('event', '')
             ts       = ts_to_unix(ts_str)
             ts_fmt   = fmt_ts(ts_str)
-            output.append((ts, f"{ts_fmt}|{client}|{endpoint}|{event}|{count}"))
-
+ 
+            gap_seconds = ''
+            if event == 'handshake':
+                prev_ts = last_handshake_ts.get(client, 0)
+                if prev_ts > 0:
+                    gap = int(ts - prev_ts)
+                    if gap > 0:
+                        gap_seconds = str(gap)
+                last_handshake_ts[client] = ts
+ 
+            hs_output.append((ts, f"{ts_fmt}|{client}|{endpoint}|{event}|{count}|{gap_seconds}"))
+ 
+        output.extend(hs_output)
+        # Sort ascending first to get correct limit slice, then reverse if needed
         output.sort(key=lambda x: x[0])
-        for _, line in output[-limit:]:
+        output = output[-limit:]
+        if descending:
+            output.reverse()
+        for _, line in output:
             print(line)
-
+ 
     else:
         deduped = []
         counts  = []
+ 
         for e in events:
             client   = e.get('client', '')
             event    = e.get('event', '')
-            endpoint = e.get('endpoint', '')
+            endpoint = _endpoint(e)
             key      = (client, event, endpoint[:15])
             ts       = ts_to_unix(e.get('timestamp', ''))
-
+ 
             if deduped:
                 prev     = deduped[-1]
                 prev_ts  = ts_to_unix(prev.get('timestamp', ''))
-                prev_key = (
-                    prev.get('client', ''),
-                    prev.get('event', ''),
-                    prev.get('endpoint', '')[:15]
-                )
+                prev_key = (prev.get('client', ''), prev.get('event', ''),
+                            _endpoint(prev)[:15])
                 if key == prev_key and (ts - prev_ts) < 300:
                     counts[-1] += 1
                     continue
-
+ 
             deduped.append(e)
             counts.append(1)
-
-        for e, count in list(zip(deduped, counts))[-limit:]:
-            ts_fmt   = fmt_ts(e.get('timestamp', ''))
+ 
+        # Compute gaps ascending, then slice, then reverse if needed
+        last_handshake_ts = {}
+        result = []
+        for e, count in zip(deduped, counts):
+            ts_str   = e.get('timestamp', '')
             client   = e.get('client', '')
-            endpoint = e.get('endpoint', '')
+            endpoint = _endpoint(e)
             event    = e.get('event', '')
-            print(f"{ts_fmt}|{client}|{endpoint}|{event}|{count}")
-
-
+            ts       = ts_to_unix(ts_str)
+            ts_fmt   = fmt_ts(ts_str)
+ 
+            gap_seconds = ''
+            if event == 'handshake':
+                prev_ts = last_handshake_ts.get(client, 0)
+                if prev_ts > 0:
+                    gap = int(ts - prev_ts)
+                    if gap > 0:
+                        gap_seconds = str(gap)
+                last_handshake_ts[client] = ts
+ 
+            result.append((ts, f"{ts_fmt}|{client}|{endpoint}|{event}|{count}|{gap_seconds}"))
+ 
+        result = result[-limit:]
+        if descending:
+            result.reverse()
+        for _, line in result:
+            print(line)
 # ──────────────────────────────────────────
 # Single event parsers (used by watch)
 # ──────────────────────────────────────────
diff --git a/daemon/wgctl-monitor.py b/daemon/wgctl-monitor.py
index 9fbb342..a4e3236 100755
--- a/daemon/wgctl-monitor.py
+++ b/daemon/wgctl-monitor.py
@@ -208,7 +208,15 @@ def poll_handshakes():
  
                 # Get endpoint
                 endpoint = get_endpoint(pubkey) or ''
-                
+ 
+                if not endpoint:
+                    try:
+                        cache = json.loads(ENDPOINT_CACHE_FILE.read_text())
+                        endpoint = cache.get(client, '')
+                    except Exception:
+                        pass
+ 
+                        
                 # New session, log it
                 entry = {
                     "timestamp": datetime.fromtimestamp(ts, tz=timezone.utc).isoformat(),
diff --git a/modules/ui/logs.module.sh b/modules/ui/logs.module.sh
index c028422..f8dddd4 100644
--- a/modules/ui/logs.module.sh
+++ b/modules/ui/logs.module.sh
@@ -56,23 +56,42 @@ function ui::logs::fw_row_table() {
 }
 
 function ui::logs::wg_row() {
-  local ts="${1:-}" client="${2:-}" endpoint="${3:-}" event="${4:-}" count="${5:-1}" \
-        w_client="${6:-20}" w_endpoint="${7:-20}"
+  local ts="${1:-}" client="${2:-}" endpoint="${3:-}" event="${4:-}" \
+        count="${5:-1}" w_client="${6:-20}" w_endpoint="${7:-20}" \
+        gap_seconds="${8:-}"
+ 
   local event_color
   case "$event" in
     handshake) event_color="\033[1;32m" ;;
     attempt)   event_color="\033[1;31m" ;;
     *)         event_color="\033[0;37m" ;;
   esac
+ 
   local count_suffix=""
   [[ "$count" -gt 1 ]] && count_suffix=" \033[2m(x${count})\033[0m"
+ 
+  # Gap suffix — only for handshakes with a meaningful gap
+  local gap_suffix=""
+  if [[ "$event" == "handshake" && -n "$gap_seconds" && "$gap_seconds" -gt 0 ]]; then
+    local gap_int="$gap_seconds"
+    local threshold="${WG_HANDSHAKE_CHECK_TIME_SEC:-300}"
+    local offline_label=""
+    [[ "$gap_int" -gt "$threshold" ]] && offline_label=" offline"
+    if (( gap_int >= 3600 )); then
+      gap_suffix="  \033[2m↑ $(( gap_int / 3600 ))h${offline_label}\033[0m"
+    elif (( gap_int >= 60 )); then
+      gap_suffix="  \033[2m↑ $(( gap_int / 60 ))m${offline_label}\033[0m"
+    fi
+  fi
+ 
   local client_pad endpoint_pad_n
   client_pad=$(printf "%-${w_client}s" "$client")
   endpoint_pad_n=$(( w_endpoint - ${#endpoint} ))
   [[ $endpoint_pad_n -lt 0 ]] && endpoint_pad_n=0
-  printf "  %s  %s  %s%*s  %b%s\033[0m%b\n" \
+ 
+  printf "  %s  %s  %s%*s  %b%s\033[0m%b%b\n" \
     "$ts" "$client_pad" "$endpoint" "$endpoint_pad_n" "" \
-    "$event_color" "$event" "$count_suffix"
+    "$event_color" "$event" "$count_suffix" "$gap_suffix"
 }
 
 function ui::logs::wg_row_table() {