@sksoftofficial/ocduet 0.2.1

package/README.md

@@ -0,0 +1 @@
+Coming Soon.

package/bin/ocduet.js

@@ -0,0 +1,61 @@
+#!/usr/bin/env node
+import { install } from "../src/commands/install.js";
+import { uninstall } from "../src/commands/uninstall.js";
+import { token } from "../src/commands/token.js";
+import { relay } from "../src/commands/relay.js";
+import { start, stop, restart, status } from "../src/commands/service.js";
+
+const HELP = `ocduet — pair your phone with a local opencode instance
+
+Usage:
+  ocduet install            install the plugins into opencode (idempotent)
+  ocduet install relayer    install the relayer service (run on a public VPS)
+  ocduet uninstall          remove the plugins (--purge also deletes token/state)
+  ocduet token [--regen]    print the pairing token + QR (--regen makes a new one)
+  ocduet relay serve        run the relayer server (on a public VPS)
+  ocduet relay link <url> <secret> [--insecure]   link this desktop to a relayer
+  ocduet relay status       tunnel state (also in ocduet status)
+
+After install: start the opencode TUI, open the "Connect" sidebar panel,
+click [connect] and scan the QR with your phone.
+`;
+
+async function main() {
+  const [cmd, ...rest] = process.argv.slice(2);
+  switch (cmd) {
+    case "install":
+      return install(rest);
+    case "uninstall":
+      return uninstall(rest);
+    case "token":
+    case "qr":
+      return token(rest);
+    case "relayer":
+      return relay(["serve", ...rest]);
+    case "relay":
+      return relay(rest);
+    case "start":
+      return start(rest);
+    case "stop":
+      return stop(rest);
+    case "restart":
+      return restart(rest);
+    case "status":
+      return status(rest);
+    case "--help":
+    case "-h":
+    case "help":
+    case undefined:
+      console.log(HELP);
+      return;
+    default:
+      console.error(`unknown command: ${cmd}\n`);
+      console.log(HELP);
+      process.exitCode = 1;
+  }
+}
+
+main().catch((err) => {
+  console.error(String(err?.stack || err));
+  process.exitCode = 1;
+});

package/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@sksoftofficial/ocduet",
+  "version": "0.2.1",
+  "description": "Duet for opencode: pair your phone with a local opencode TUI. Type on mobile, see it live on both screens. LAN-first, QR pairing, zero config.",
+  "type": "module",
+  "bin": {
+    "ocduet": "./bin/ocduet.js"
+  },
+  "files": [
+    "bin/",
+    "src/",
+    "README.md"
+  ],
+  "keywords": [
+    "opencode",
+    "opencode-plugin",
+    "ocduet",
+    "duet",
+    "remote",
+    "mobile",
+    "tui",
+    "lan",
+    "bridge"
+  ],
+  "author": "sksoftofficial",
+  "license": "ISC",
+  "engines": {
+    "node": ">=18"
+  },
+  "dependencies": {
+    "ws": "^8.18.0"
+  }
+}

package/src/commands/install.js

@@ -0,0 +1,222 @@
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import { spawn, spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { opencodeConfigDir, dataDir, pluginDir, ensureToken, daemonPointerPath, daemonWebDir, installationPath } from "../paths.js";
+import { relayerDir } from "../relayer.js";
+import { restart } from "./service.js";
+const PLUGIN_FILES = [
+  { src: "ocduet-server.js", dest: "ocduet-server.js" },
+  { src: "ocduet-sidebar.jsx", dest: "ocduet-sidebar.tsx" },
+];
+
+const WEB_FILES = [
+  { src: "web/index.html", dest: "index.html" },
+  { src: "web/app.js", dest: "app.js.txt" },
+  { src: "web/app.css", dest: "app.css.txt" },
+  { src: "web/pair.html", dest: "pair.html" },
+];
+
+const SERVER_ENTRY_PREFIX = "ocduet-server";
+
+function pkgRoot() {
+  return path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
+}
+
+function copy(from, to) {
+  fs.mkdirSync(path.dirname(to), { recursive: true });
+  fs.copyFileSync(from, to);
+}
+
+// Idempotently ensure the server plugin is in opencode.json(c)'s "plugin" array
+// as a file:// entry. Pure-regex JSONC surgery: no deps, preserves formatting.
+export function patchConfig() {
+  const dir = opencodeConfigDir();
+  const jsonc = path.join(dir, "opencode.jsonc");
+  const json = path.join(dir, "opencode.json");
+  const configPath = fs.existsSync(jsonc) ? jsonc : fs.existsSync(json) ? json : jsonc;
+  const entry = `file://${path.join(pluginDir(), "ocduet-server.js")}`;
+
+  let text = fs.existsSync(configPath) ? fs.readFileSync(configPath, "utf8") : '{\n  "$schema": "https://opencode.ai/config.json",\n  "plugin": []\n}\n';
+
+  if (text.includes(entry)) return configPath;
+
+  const arrayOpen = text.search(/"plugin"\s*:\s*\[/);
+  if (arrayOpen >= 0) {
+    const insertAt = text.indexOf("[", arrayOpen) + 1;
+    const before = text.slice(0, insertAt);
+    const after = text.slice(insertAt);
+    const needsComma = /^\s*"/.test(after);
+    text = before + `\n    ${JSON.stringify(entry)}${needsComma ? "," : ""}` + after;
+  } else {
+    const lastBrace = text.lastIndexOf("}");
+    if (lastBrace < 0) throw new Error(`cannot parse ${configPath}; add the plugin entry manually`);
+    const trailing = text.slice(0, lastBrace).trimEnd();
+    text = `${trailing.endsWith(",") || trailing.endsWith("{") ? "" : ","}\n  "plugin": [\n    ${JSON.stringify(entry)}\n  ]\n}\n`;
+  }
+  fs.mkdirSync(dir, { recursive: true });
+  fs.writeFileSync(configPath, text);
+  return configPath;
+}
+
+// Register the TUI sidebar plugin in tui.json (the TUI's own plugin registry).
+export function patchTuiJson() {
+  const p = path.join(opencodeConfigDir(), "tui.json");
+  const entry = "./plugin/ocduet-sidebar.tsx";
+  let cfg = {};
+  if (fs.existsSync(p)) {
+    try {
+      cfg = JSON.parse(fs.readFileSync(p, "utf8"));
+    } catch {
+      throw new Error(`cannot parse ${p}; add ["${entry}", {"enabled": true}] to its plugin array manually`);
+    }
+  }
+  if (!cfg || typeof cfg !== "object" || Array.isArray(cfg)) {
+    throw new Error(`unexpected content in ${p}`);
+  }
+  if (!cfg.$schema) cfg.$schema = "https://opencode.ai/tui.json";
+  if (!Array.isArray(cfg.plugin)) cfg.plugin = [];
+  const exists = cfg.plugin.some((e) => e === entry || (Array.isArray(e) && e[0] === entry));
+  if (!exists) cfg.plugin.push([entry, { enabled: true }]);
+  fs.writeFileSync(p, JSON.stringify(cfg, null, 2) + "\n");
+  return p;
+}
+
+function unitFlag(argv, name) {
+  const i = argv.indexOf(name);
+  return i !== -1 && argv[i + 1] ? argv[i + 1] : null;
+}
+
+// `ocduet install relayer` — set the relayer up as a boot-persistent service
+// on a public box. systemd user unit when available (enable-linger keeps it
+// alive without a login session), detached process + pid file otherwise.
+export async function installRelayer(argv = []) {
+  const root = pkgRoot();
+  const dir = relayerDir();
+  const port = unitFlag(argv, "--port") || process.env.OCDUET_RELAYER_PORT || "4290";
+  const cert = unitFlag(argv, "--cert");
+  const key = unitFlag(argv, "--key");
+  fs.mkdirSync(dir, { recursive: true });
+
+  // make sure the store (and the enroll secret) exists before we print it
+  const secret = spawnSync(process.execPath, [path.join(root, "bin/ocduet.js"), "relay", "secret"], { encoding: "utf8", env: { ...process.env, OCDUET_RELAYER_DIR: dir } });
+  const enroll = (secret.stdout || "").trim() || "(unknown — run `ocduet relayer secret`)";
+
+  const serveArgs = ["ocduet.js", "relayer", "serve", "--port", port];
+  if (cert && key) serveArgs.push("--cert", cert, "--key", key);
+
+  let managedBy = null;
+  const unitDir = path.join(os.homedir(), ".config/systemd/user");
+  const unitPath = path.join(unitDir, "ocduet-relayer.service");
+  try {
+    fs.mkdirSync(unitDir, { recursive: true });
+    fs.writeFileSync(unitPath, [
+      "[Unit]",
+      "Description=ocduet relayer — public tunnel for the ocduet daemon",
+      "After=network-online.target",
+      "Wants=network-online.target",
+      "",
+      "[Service]",
+      `WorkingDirectory=${root}`,
+      `ExecStart=${process.execPath} ${serveArgs.map((a) => a.includes(" ") ? JSON.stringify(a) : a).join(" ")}`,
+      "Environment=OCDUET_RELAYER_DIR=" + dir,
+      "Restart=always",
+      "RestartSec=3",
+      "",
+      "[Install]",
+      "WantedBy=default.target",
+      "",
+    ].join("\n"));
+    const ctl = spawnSync("systemctl", ["--user", "daemon-reload"], { encoding: "utf8" });
+    if (ctl.status === 0) {
+      spawnSync("systemctl", ["--user", "enable", "--now", "ocduet-relayer.service"], { encoding: "utf8" });
+      managedBy = "systemd --user";
+    }
+  } catch {}
+
+  if (!managedBy) {
+    const log = fs.openSync(path.join(dir, "relayer.log"), "a", 0o600);
+    const child = spawn(process.execPath, [path.join(root, "bin/ocduet.js"), ...serveArgs], {
+      env: { ...process.env, OCDUET_RELAYER_DIR: dir },
+      detached: true,
+      stdio: ["ignore", log, log],
+    });
+    child.unref();
+    fs.writeFileSync(path.join(dir, "relayer.pid"), String(child.pid));
+    managedBy = `detached process (pid ${child.pid}) — no systemd; restart it manually after reboot`;
+  }
+
+  const ips = [];
+  for (const [name, addrs] of Object.entries(os.networkInterfaces())) {
+    for (const a of addrs || []) {
+      if (a.family === "IPv4" && !a.internal) ips.push(a.address);
+    }
+  }
+  const host = ips[0] || "<this-host>";
+  console.log(`relayer installed (${managedBy})`);
+  console.log(`listening on: https://0.0.0.0:${port}`);
+  console.log(`enroll secret: ${enroll}`);
+  console.log("");
+  console.log("on your DESKTOP, link it:");
+  console.log(`  ocduet relay link https://${host}:${port} ${enroll}`);
+  if (ips.length > 1) console.log(`  (this box has multiple IPs: ${ips.join(", ")} — use the public one)`);
+  if (managedBy.startsWith("systemd")) {
+    console.log("");
+    console.log("to survive reboots without a login session, run once (may need root):");
+    console.log(`  sudo loginctl enable-linger $USER`);
+  }
+}
+
+export async function install(argv = []) {
+  if (argv[0] === "relayer") return installRelayer(argv.slice(1));
+  const root = pkgRoot();
+  const pdir = pluginDir();
+  const ddir = dataDir();
+
+  fs.mkdirSync(pdir, { recursive: true });
+  fs.writeFileSync(installationPath(), JSON.stringify({ dataDir: ddir }, null, 2) + "\n");
+
+  for (const { src, dest } of PLUGIN_FILES) {
+    const source = fs.readFileSync(path.join(root, "src/plugin", src), "utf8");
+    fs.writeFileSync(path.join(pdir, dest), source.replace(
+      "const INSTALLED_DATA_DIR = null;",
+      `const INSTALLED_DATA_DIR = ${JSON.stringify(ddir)};`,
+    ));
+    console.log(`installed plugin: ${path.join(pdir, dest)}`);
+  }
+  for (const { src, dest } of WEB_FILES) {
+    copy(path.join(root, "src/plugin/web", path.basename(src)), path.join(daemonWebDir(), dest));
+  }
+  console.log(`installed web client: ${daemonWebDir()}`);
+
+  copy(path.join(root, "src/qrcodegen.js"), path.join(ddir, "qrcodegen.js"));
+  fs.writeFileSync(daemonPointerPath(), JSON.stringify({
+    daemonPath: path.join(root, "src/daemon.js"),
+    dataDir: ddir,
+  }, null, 2) + "\n");
+  console.log(`daemon pointer: ${daemonPointerPath()}`);
+  for (const legacy of fs.readdirSync(ddir).filter((f) => /^state-.*\.json$/.test(f))) {
+    try { fs.rmSync(path.join(ddir, legacy)); } catch {}
+  }
+  const t = ensureToken();
+  console.log(`pairing token: ${ddir}/token`);
+
+  const configPath = patchConfig();
+  console.log(`registered server plugin in: ${configPath}`);
+
+  const tuiPath = patchTuiJson();
+  console.log(`registered TUI sidebar in: ${tuiPath}`);
+
+  await restart([]);
+
+  console.log(`
+Done. Now:
+  1. (Re)start opencode — plugins load automatically from ${pdir}
+  2. Open the Duet panel in the TUI sidebar
+  3. Click [connect] and scan the QR with your phone
+
+Token (already generated, shown here for reference):
+  ${t}
+`);
+}

package/src/commands/relay.js

@@ -0,0 +1,151 @@
+// `ocduet relay …` — manage the relayer tunnel.
+//   serve            run the relayer server (VPS side, foreground)
+//   secret           print the relayer's enroll secret (run on the VPS)
+//   link <url> [s]   enroll this desktop against a relayer and keep it linked
+//   unlink           remove the link (the relayer keeps the enrolled key)
+//   status           link + live tunnel state
+import fs from "node:fs";
+import path from "node:path";
+import crypto from "node:crypto";
+import https from "node:https";
+import { WebSocket } from "ws";
+import { serve, printSecret, relayerDir } from "../relayer.js";
+import { relayConfigPath, readRelayConfig, relayStatus } from "../relay-client.js";
+import { readDaemonControlPort } from "../paths.js";
+import { restart } from "./service.js";
+
+const REG_MSG = (desktopId, pubB64, ts) => `ocduet-relay-reg|${desktopId}|${pubB64}|${ts}`;
+
+// grab the relayer's cert PEM at first contact — stored and trusted as its
+// own CA from then on, which pins the relayer exactly (self-signed included)
+function fetchCertPem(url) {
+  return new Promise((resolve, reject) => {
+    const u = new URL(url);
+    const req = https.request({
+      hostname: u.hostname, port: u.port || 443, path: "/status",
+      method: "GET", rejectUnauthorized: false, timeout: 8000,
+    }, (res) => {
+      const cert = res.socket.getPeerCertificate();
+      res.resume();
+      if (cert?.raw) resolve(`-----BEGIN CERTIFICATE-----\n${cert.raw.toString("base64").replace(/(.{64})/g, "$1\n")}\n-----END CERTIFICATE-----\n`);
+      else reject(new Error("no peer certificate"));
+    });
+    req.on("timeout", () => { req.destroy(new Error("timeout")); });
+    req.on("error", reject);
+    req.end();
+  });
+}
+
+function registerOnce(url, desktopId, pubB64, sign, secret, certPem) {
+  return new Promise((resolve, reject) => {
+    const wsUrl = new URL("/desktop", url);
+    wsUrl.protocol = wsUrl.protocol === "http:" ? "ws:" : "wss:";
+    const tlsOpts = certPem ? { ca: certPem } : { rejectUnauthorized: false };
+    const ws = new WebSocket(wsUrl, { ...tlsOpts, handshakeTimeout: 10_000 });
+    const fail = (why) => { try { ws.close(); } catch {} reject(new Error(why)); };
+    const timer = setTimeout(() => fail("register timeout"), 12_000);
+    ws.on("open", () => {
+      const ts = Date.now();
+      ws.send(JSON.stringify({ t: "register", desktopId, pub: pubB64, ts, sig: sign(REG_MSG(desktopId, pubB64, ts)), secret: secret || undefined }));
+    });
+    ws.on("message", (raw) => {
+      let msg;
+      try { msg = JSON.parse(raw.toString()); } catch { return; }
+      if (msg.t === "registered") { clearTimeout(timer); try { ws.close(); } catch {} resolve(msg); return; }
+      if (msg.t === "error") { clearTimeout(timer); fail(msg.error || "rejected"); }
+    });
+    ws.on("close", () => { clearTimeout(timer); reject(new Error("connection closed before registration")); });
+    ws.on("error", (e) => { clearTimeout(timer); reject(e); });
+  });
+}
+
+function loadOrCreateIdentity() {
+  const existing = readRelayConfig();
+  if (existing) return existing;
+  const { publicKey, privateKey } = crypto.generateKeyPairSync("ed25519");
+  const pub = publicKey.export({ format: "der", type: "spki" }).slice(-32);
+  const priv = privateKey.export({ format: "der", type: "pkcs8" });
+  return { pub: pub.toString("base64"), priv: priv.toString("base64") };
+}
+
+export async function relay(argv = []) {
+  const [sub, ...rest] = argv;
+  switch (sub) {
+    case "serve":
+      return serve(rest);
+
+    case "secret":
+      printSecret();
+      return;
+
+    case "link": {
+      const insecure = rest.includes("--insecure");
+      const url = rest.find((a) => !a.startsWith("-"));
+      const secret = rest.filter((a) => !a.startsWith("-"))[1];
+      if (!url || !/^https?:\/\//.test(url)) {
+        console.error("usage: ocduet relay link https://<relayer-host>:<port> <enroll-secret> [--insecure]");
+        process.exitCode = 1;
+        return;
+      }
+      const certPem = await fetchCertPem(url).catch(() => null);
+      // the enroll secret must never travel over an unverified TLS connection —
+      // a link-time MITM could capture it (and pin its own cert for the future).
+      // http:// URLs (local testing) and an explicit --insecure are the opt-outs.
+      if (!certPem && new URL(url).protocol !== "http:" && !insecure) {
+        console.error("refusing to link: could not fetch the relayer's TLS certificate, so the");
+        console.error("enroll secret would be sent over an unverified connection (possible MITM).");
+        console.error("check the URL/host, or pass --insecure to link anyway without cert pinning.");
+        process.exitCode = 1;
+        return;
+      }
+      const id = loadOrCreateIdentity();
+      const desktopId = crypto.createHash("sha256").update(Buffer.from(id.pub, "base64")).digest("hex").slice(0, 10);
+      const sign = (msg) => crypto.sign(null, Buffer.from(msg, "utf8"), crypto.createPrivateKey({ key: Buffer.from(id.priv, "base64"), format: "der", type: "pkcs8" })).toString("base64");
+      console.log(`linking ${url} (desktop id ${desktopId})${certPem ? " — cert pinned" : insecure ? " — WARNING: --insecure, cert NOT pinned" : " — WARNING: plain http, cert NOT pinned"} ...`);
+      await registerOnce(url, desktopId, id.pub, sign, secret, certPem);
+      const cfgPath = relayConfigPath();
+      fs.mkdirSync(path.dirname(cfgPath), { recursive: true });
+      const tmp = cfgPath + `.${process.pid}.tmp`;
+      fs.writeFileSync(tmp, JSON.stringify({
+        url, desktopId, pub: id.pub, priv: id.priv, certPem, linkedAt: Date.now(),
+      }, null, 2) + "\n", { mode: 0o600 });
+      fs.renameSync(tmp, cfgPath);
+      console.log("linked — the daemon keeps the tunnel up from now on.");
+      await restart([]);
+      console.log(`next: ocduet qr  (scan once — the link works from any network)`);
+      return;
+    }
+
+    case "unlink": {
+      if (!readRelayConfig()) { console.log("not linked"); return; }
+      fs.unlinkSync(relayConfigPath());
+      console.log("unlinked. (the relayer still knows this desktop — enroll secret rotates it out)");
+      await restart([]);
+      return;
+    }
+
+    case "status": {
+      const cfg = readRelayConfig();
+      if (!cfg) { console.log("relay: not linked"); return; }
+      console.log(`relay: ${cfg.url}  desktop id ${cfg.desktopId}`);
+      let live = null;
+      try {
+        const port = readDaemonControlPort();
+        const res = await fetch(`http://127.0.0.1:${port}/status`, { signal: AbortSignal.timeout(1000) });
+        live = await res.json();
+      } catch {}
+      const r = live?.relay ?? relayStatus();
+      console.log(`tunnel: ${r.connected ? `connected since ${new Date(r.since).toLocaleString()}` : `down${r.lastError ? ` (${r.lastError})` : ""}`}${r.reconnects ? `  reconnects: ${r.reconnects}` : ""}`);
+      return;
+    }
+
+    default:
+      console.log(`usage:
+  ocduet relay serve [--port N] [--cert f --key f]   run the relayer (VPS)
+  ocduet relay secret                                print the enroll secret
+  ocduet relay link <url> <secret> [--insecure]      link this desktop
+  ocduet relay unlink                                unlink this desktop
+  ocduet relay status                                link + tunnel state`);
+      return;
+  }
+}

package/src/commands/service.js

@@ -0,0 +1,164 @@
+import fs from "node:fs";
+import path from "node:path";
+import { spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import {
+  daemonPidPath, daemonLogPath, daemonStatePath, readDaemonPort, readDaemonControlPort, ensureToken, dataDir,
+} from "../paths.js";
+
+const DAEMON_JS = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../daemon.js");
+
+function readPid() {
+  try {
+    return Number(fs.readFileSync(daemonPidPath(), "utf8").trim());
+  } catch {
+    return null;
+  }
+}
+
+function pidAlive(pid) {
+  if (!pid) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function healthy() {
+  const port = readDaemonControlPort();
+  if (!port) return false;
+  try {
+    const res = await fetch(`http://127.0.0.1:${port}/status`, { signal: AbortSignal.timeout(1000) });
+    if (!res.ok) return false;
+    const data = await res.json();
+    return data?.daemon === true;
+  } catch {
+    return false;
+  }
+}
+
+async function healthyInfo() {
+  const port = readDaemonControlPort();
+  if (!port) return null;
+  try {
+    const res = await fetch(`http://127.0.0.1:${port}/status`, { signal: AbortSignal.timeout(1000) });
+    if (!res.ok) return null;
+    const data = await res.json();
+    return data?.daemon === true ? data : null;
+  } catch {
+    return null;
+  }
+}
+
+async function waitFor(ms) {
+  const deadline = Date.now() + ms;
+  while (Date.now() < deadline) {
+    if (await healthy()) return true;
+    await new Promise((r) => setTimeout(r, 200));
+  }
+  return false;
+}
+
+export function isRunning() {
+  const pid = readPid();
+  return pid !== null && pidAlive(pid) ? pid : null;
+}
+
+export async function start(argv = []) {
+  if (argv.includes("--foreground")) {
+    return import("../daemon.js");
+  }
+
+  const existing = isRunning();
+  if (existing) {
+    console.log(`ocduet already running (pid ${existing})`);
+    return;
+  }
+
+  ensureToken();
+  fs.mkdirSync(path.dirname(daemonPidPath()), { recursive: true });
+  const out = fs.openSync(daemonLogPath(), "a", 0o600);
+  const child = spawn(process.execPath, [DAEMON_JS], {
+    env: { ...process.env, OCDUET_DATA_DIR: dataDir() },
+    detached: true,
+    stdio: ["ignore", out, out],
+  });
+  child.unref();
+  fs.writeFileSync(daemonPidPath(), String(child.pid));
+
+  console.log("starting ocduet daemon ...");
+  if ((await waitFor(15000)) && pidAlive(child.pid)) {
+    const info = await healthyInfo();
+    if (info && info.pid !== child.pid) {
+      console.log(`ocduet already running (pid ${info.pid})`);
+      try { fs.unlinkSync(daemonPidPath()); } catch {}
+      return;
+    }
+    console.log(`started (pid ${child.pid}, port ${readDaemonPort()})`);
+    console.log(`logs: ${daemonLogPath()}`);
+    console.log("stop: ocduet stop");
+  } else {
+    console.error("failed to start — last log lines:");
+    try {
+      const log = fs.readFileSync(daemonLogPath(), "utf8").trimEnd();
+      console.error(log.split("\n").slice(-10).join("\n"));
+    } catch {}
+    try { fs.unlinkSync(daemonPidPath()); } catch {}
+    process.exitCode = 1;
+  }
+}
+
+export async function stop(argv = []) {
+  const pid = isRunning();
+  if (!pid) {
+    console.log("ocduet not running");
+    try { fs.unlinkSync(daemonPidPath()); } catch {}
+    return;
+  }
+  try {
+    process.kill(pid, "SIGTERM");
+  } catch {}
+  const deadline = Date.now() + 8000;
+  while (Date.now() < deadline && pidAlive(pid)) {
+    await new Promise((r) => setTimeout(r, 200));
+  }
+  if (pidAlive(pid)) {
+    try { process.kill(pid, "SIGKILL"); } catch {}
+  }
+  try { fs.unlinkSync(daemonPidPath()); } catch {}
+  try { fs.unlinkSync(daemonStatePath()); } catch {}
+  console.log("stopped");
+}
+
+export async function restart(argv = []) {
+  await stop(argv);
+  await start(argv);
+}
+
+export async function status(_argv = []) {
+  const pid = isRunning();
+  if (!pid) {
+    console.log("ocduet: not running");
+    return;
+  }
+  const state = await (async () => {
+    try {
+      const port = readDaemonControlPort();
+      const res = await fetch(`http://127.0.0.1:${port}/status`, { signal: AbortSignal.timeout(1000) });
+      return await res.json();
+    } catch {
+      return null;
+    }
+  })();
+  if (!state) {
+    console.log(`ocduet: pid ${pid} alive but not answering`);
+    return;
+  }
+  console.log(`ocduet: running (pid ${pid}, port ${readDaemonPort()})`);
+  console.log(`  instances: ${state.instances}   phones: ${state.clients}`);
+  if (state.relay?.linked) {
+    console.log(`  relay: ${state.relay.connected ? "tunnel up" : "tunnel down"} → ${state.relay.url} (${state.relay.desktopId})`);
+  }
+}

package/src/commands/token.js

@@ -0,0 +1,49 @@
+import fs from "node:fs";
+import { generateToken, lanIp, readToken, daemonStatePath } from "../paths.js";
+import { qrText } from "../qrterm.js";
+import { daemonWords } from "../e2ee.js";
+import { readRelayConfig } from "../relay-client.js";
+
+function readAnyState() {
+  try {
+    return JSON.parse(fs.readFileSync(daemonStatePath(), "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+export async function token(argv = []) {
+  const regen = argv.includes("--regen");
+  const t = regen ? generateToken() : readToken();
+  if (!t) {
+    console.error("no token yet — run `ocduet install` first, or use --regen");
+    process.exitCode = 1;
+    return;
+  }
+  const state = readAnyState();
+  const ip = state?.lanIp || lanIp();
+  const port = state?.port || 4098;
+
+  const words = daemonWords();
+  console.log(`security words: ${words.join("  ")}`);
+  console.log("              (compare with the words your phone shows while pairing — a mismatch means");
+  console.log("               something between this machine and the phone is impersonating the daemon)");
+  console.log(`token: ${t}`);
+  if (ip) {
+    const url = `https://${ip}:${port}/pair#t=${t}`;
+    console.log(`url:   ${url}${state ? "" : "  (port guessed — start opencode for the live one)"}`);
+    console.log();
+    console.log(qrText(url));
+  } else {
+    console.log("no LAN IP found — are you on a network? The TUI sidebar QR will contain the right URL.");
+  }
+  const relay = readRelayConfig();
+  if (relay) {
+    const origin = new URL(relay.url).origin;
+    const url = `${origin}/pair?d=${relay.desktopId}#t=${t}`;
+    console.log();
+    console.log(`relay url (works from any network): ${url}`);
+    console.log(qrText(url));
+  }
+  if (regen) console.log("\nnote: paired phones authenticate with their own keys and stay connected; new pairings must re-scan.");
+}