@sksoftofficial/ocduet 0.2.1

package/src/daemon.js

@@ -0,0 +1,747 @@
+// ocduet daemon — the background bridge service.
+// Owns the LAN WebSocket server, the web client, the pairing token and the
+// machine-wide state file. opencode instances attach over an internal socket
+// (see src/plugin/ocduet-server.js) and stream events / execute RPCs.
+// Run with: node daemon.js  (managed by `ocduet start|stop|restart|status`)
+import http from "node:http";
+import https from "node:https";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import crypto from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { WebSocketServer } from "ws";
+import {
+  dataDir, tokenPath, daemonStatePath, daemonPidPath, daemonLogPath, daemonWebDir,
+} from "./paths.js";
+import {
+  daemonPub, daemonWords, signDaemon, verifySig, phoneByPub, addPhone, ephX25519, ecdh,
+  hsInfo, deriveKeys, frameEncrypt, frameDecrypt, hs1Msg, hs2Msg, pairMsg, PD_TAG, DP_TAG,
+  loadKeys,
+} from "./e2ee.js";
+import { startRelayClient, relayStatus, readRelayConfig } from "./relay-client.js";
+
+const VERSION = "0.2.1";
+const HOST = process.env.OCDUET_HOST || "0.0.0.0";
+const DATA_DIR = dataDir();
+const PORT_FILE = path.join(DATA_DIR, "port");
+const MAIN_PORT_FILE = path.join(DATA_DIR, "port.main");
+function lastBoundPort() {
+  try {
+    const p = parseInt(fs.readFileSync(PORT_FILE, "utf8").trim(), 10);
+    return p > 0 ? p : null;
+  } catch {
+    return null;
+  }
+}
+function lastMainPort() {
+  try {
+    const s = JSON.parse(fs.readFileSync(daemonStatePath(), "utf8"));
+    if (s?.port > 0) return s.port;
+  } catch {}
+  try {
+    const p = parseInt(fs.readFileSync(MAIN_PORT_FILE, "utf8").trim(), 10);
+    return p > 0 ? p : null;
+  } catch {}
+  return lastBoundPort(); // legacy: pre-dual-server port file held the main port
+}
+const BASE_PORT = parseInt(process.env.OCDUET_PORT || "0", 10) || lastMainPort() || 4098;
+const STARTED_AT = Date.now();
+const NETWORK_POLL_MS = 2000;
+let advertisedIp = null;
+
+const BAD_NIC = /^(lo|virbr|docker|veth|br-|zt|tailscale|tun|tap|utun|vmnet|wg|ppp|ipoib|wwan|rmnet)/i;
+
+function log(...args) {
+  try {
+    fs.appendFileSync(daemonLogPath(), `${new Date().toISOString()} ${args.join(" ")}\n`, { mode: 0o600 });
+  } catch {}
+}
+
+function lanIp() {
+  const candidates = [];
+  for (const [name, addrs] of Object.entries(os.networkInterfaces())) {
+    if (BAD_NIC.test(name)) continue;
+    for (const a of addrs || []) {
+      if (a.family !== "IPv4" || a.internal) continue;
+      if (/^192\.168\./.test(a.address)) candidates.push({ ip: a.address, rank: 0 });
+      else if (/^10\./.test(a.address)) candidates.push({ ip: a.address, rank: 1 });
+      else if (/^172\.(1[6-9]|2\d|3[01])\./.test(a.address)) candidates.push({ ip: a.address, rank: 2 });
+    }
+  }
+  candidates.sort((a, b) => a.rank - b.rank);
+  return candidates[0]?.ip ?? null;
+}
+
+function readToken() {
+  try {
+    return fs.readFileSync(tokenPath(), "utf8").trim() || null;
+  } catch {
+    return null;
+  }
+}
+
+function tokenOk(provided) {
+  if (!provided) return false;
+  const real = readToken();
+  if (!real) return false;
+  const a = Buffer.from(String(provided));
+  const b = Buffer.from(real);
+  return a.length === b.length && crypto.timingSafeEqual(a, b);
+}
+
+function ensureToken() {
+  if (readToken()) return;
+  fs.mkdirSync(DATA_DIR, { recursive: true });
+  const t = crypto.randomBytes(32).toString("base64url");
+  fs.writeFileSync(tokenPath(), t + "\n", { mode: 0o600 });
+  try { fs.chmodSync(tokenPath(), 0o600); } catch {}
+}
+
+// ---------- state ----------
+const phones = new Set();        // browser sockets
+const instances = new Map();     // instanceId -> { ws, info, sessions }
+
+// last-seen sessions per instance — survives instance shutdowns so the phone
+// keeps listing sessions of opencode processes that are not running
+const SESSIONS_CACHE_FILE = path.join(DATA_DIR, "sessions-cache.json");
+const sessionCache = new Map();
+try {
+  const raw = JSON.parse(fs.readFileSync(SESSIONS_CACHE_FILE, "utf8"));
+  for (const [id, e] of Object.entries(raw || {})) {
+    if (e?.info?.id) sessionCache.set(id, e);
+  }
+} catch {}
+let cacheStr = "";
+function persistSessionCache() {
+  const entries = [...sessionCache.entries()]
+    .sort((a, b) => (b[1].at || 0) - (a[1].at || 0))
+    .slice(0, 12);
+  sessionCache.clear();
+  for (const [id, e] of entries) sessionCache.set(id, e);
+  const str = JSON.stringify(Object.fromEntries(entries));
+  if (str === cacheStr) return;
+  cacheStr = str;
+  try {
+    // session titles/directories live here — same privacy as the token
+    fs.writeFileSync(SESSIONS_CACHE_FILE, str, { mode: 0o600 });
+    try { fs.chmodSync(SESSIONS_CACHE_FILE, 0o600); } catch {}
+  } catch {}
+}
+function pruneStaleCacheFor(sessions) {
+  // a fresh live list is authoritative for its WHOLE storage (the stub fans
+  // out over every project directory). Any cache entry whose sessions mostly
+  // appear in it belongs to the same storage and only contributes sessions
+  // the live list no longer has — i.e. deleted ghosts. Drop it.
+  const liveIds = new Set(sessions.map((s) => s?.id ?? s?.sessionID).filter(Boolean));
+  if (!liveIds.size) return;
+  for (const [key, e] of sessionCache) {
+    const ids = (e.sessions || []).map((s) => s?.id ?? s?.sessionID).filter(Boolean);
+    if (!ids.length) continue;
+    const overlap = ids.filter((id) => liveIds.has(id)).length;
+    if (overlap / ids.length >= 0.5) sessionCache.delete(key);
+  }
+}
+
+function cacheInstance(info, sessions) {
+  if (!info || !Array.isArray(sessions) || sessions.length === 0) return;
+  pruneStaleCacheFor(sessions);
+  const key = info.directory || info.id;
+  if (!key) return;
+  sessionCache.set(key, { info: { ...info, id: key }, sessions, at: Date.now() });
+  persistSessionCache();
+}
+
+function pruneDeletedSession(gone) {
+  // a deleted session must not survive anywhere — not in attached instances'
+  // snapshots and especially not in the offline cache, where it would keep
+  // surfacing as an unopenable "offline" row on the phone
+  let changed = false;
+  const hid = (s) => s?.id ?? s?.sessionID;
+  for (const inst of instances.values()) {
+    if (Array.isArray(inst.sessions) && inst.sessions.some((s) => hid(s) === gone)) {
+      inst.sessions = inst.sessions.filter((s) => hid(s) !== gone);
+      changed = true;
+    }
+  }
+  for (const [key, e] of sessionCache) {
+    if (Array.isArray(e.sessions) && e.sessions.some((s) => hid(s) === gone)) {
+      e.sessions = e.sessions.filter((s) => hid(s) !== gone);
+      if (!e.sessions.length) sessionCache.delete(key);
+      changed = true;
+    }
+  }
+  if (changed) {
+    persistSessionCache();
+    broadcastInstances();
+  }
+}
+
+function phoneInfo(ws) {
+  return { id: ws.__id, ua: ws.__ua, connectedAt: ws.__connectedAt };
+}
+
+function instanceList() {
+  const live = [...instances.values()].map((i) => ({
+    ...(i.info || {}),
+    sessions: i.sessions || [],
+    attached: true,
+  }));
+  // every attached instance lists the whole storage (cross-directory), so the
+  // same session would reach the phone once per instance. Assign each session
+  // to exactly ONE: its own directory's instance when attached, else the
+  // earliest instance that lists it; cached (offline) entries come last.
+  const byDir = new Map(live.map((i, idx) => [i.directory, idx]));
+  const claims = new Map(); // sessionID -> { rank, idx, session }
+  const claim = (s, idx, ownsDir) => {
+    const sid = s?.id ?? s?.sessionID;
+    if (!sid) return;
+    const rank = (ownsDir ? 0 : 1) * 100000 + idx;
+    const prev = claims.get(sid);
+    if (!prev || rank < prev.rank) claims.set(sid, { rank, idx, session: s });
+  };
+  live.forEach((i, idx) => {
+    for (const s of i.sessions) claim(s, idx, !!s.directory && byDir.get(s.directory) === idx);
+  });
+  const covered = new Set();
+  for (const i of live) {
+    if (i.directory) covered.add(i.directory);
+    for (const s of i.sessions) if (s.directory) covered.add(s.directory);
+  }
+  const cached = [];
+  for (const [key, e] of sessionCache) {
+    if (covered.has(e.info?.directory)) continue;
+    cached.push({ key, e, idx: live.length + cached.length, sessions: [] });
+  }
+  for (const c of cached) for (const s of c.e.sessions) claim(s, c.idx, false);
+  const out = live.map((i) => ({ ...i, sessions: [] }));
+  for (const { idx, session } of claims.values()) {
+    if (idx < out.length) out[idx].sessions.push(session);
+    else cached[idx - out.length].sessions.push(session);
+  }
+  for (const c of cached) {
+    if (c.sessions.length) out.push({ ...c.e.info, id: c.key, sessions: c.sessions, attached: false });
+  }
+  return out;
+}
+
+function writeState(port, localPort = LOCAL_PORT) {
+  try {
+    fs.mkdirSync(DATA_DIR, { recursive: true });
+    const tmp = path.join(DATA_DIR, `.state-${process.pid}.tmp`);
+    const state = {
+      version: VERSION,
+      pid: process.pid,
+      port,
+      localPort,
+      lanIp: advertisedIp,
+      startedAt: STARTED_AT,
+      words: daemonWords(),
+      clients: [...phones].map(phoneInfo),
+      instances: [...instances.values()].map((i) => ({
+        id: i.info?.id, directory: i.info?.directory, project: i.info?.project, pid: i.info?.pid,
+      })),
+    };
+    fs.writeFileSync(tmp, JSON.stringify(state), { mode: 0o600 });
+    fs.renameSync(tmp, daemonStatePath());
+  } catch (err) {
+    log("writeState failed:", String(err?.message || err));
+  }
+}
+
+function broadcast(msg, only) {
+  for (const ws of phones) {
+    if (only && ws !== only) continue;
+    phoneSend(ws, msg);
+  }
+}
+
+// phones speak only the encrypted protocol: hello/rpc/events ride inside
+// {t:"sec", n, ct} AES-256-GCM frames (see src/e2ee.js). A socket that has
+// not finished hs1 has no keys yet — it gets NOTHING, not even broadcasts,
+// otherwise an unauthenticated LAN/relay peer could passively read frames.
+function phoneSend(ws, msg) {
+  try {
+    if (!ws.__sec) return; // never speak plaintext to a phone socket
+    const { dp, sendN } = ws.__sec;
+    ws.__sec.sendN++;
+    ws.send(JSON.stringify({ t: "sec", n: sendN, ct: frameEncrypt(dp, DP_TAG, sendN, msg) }));
+  } catch {}
+}
+
+function broadcastInstances() {
+  broadcast({ t: "instances", instances: instanceList() });
+}
+
+function requestInstanceSessions(inst) {
+  return new Promise((resolve) => {
+    const id = `pull-${crypto.randomUUID()}`;
+    inst.__pulls = inst.__pulls || new Map();
+    const done = (v) => { inst.__pulls.delete(id); resolve(v); };
+    const timer = setTimeout(() => done(null), 2500);
+    inst.__pulls.set(id, (result) => { clearTimeout(timer); done(result); });
+    try {
+      inst.ws.send(JSON.stringify({ t: "rpc", id, method: "session.list", args: {} }));
+    } catch {
+      clearTimeout(timer);
+      done(null);
+    }
+  });
+}
+
+let pullPromise = null;
+let lastPullAt = 0;
+function pullInstanceSessions() {
+  if (pullPromise) return pullPromise;
+  if (Date.now() - lastPullAt < 700) return Promise.resolve();
+  pullPromise = (async () => {
+    await Promise.all([...instances.values()].map(async (inst) => {
+      const fresh = await requestInstanceSessions(inst);
+      if (Array.isArray(fresh)) {
+        inst.sessions = fresh;
+        cacheInstance(inst.info, fresh);
+      }
+    }));
+  })();
+  return pullPromise.finally(() => { pullPromise = null; lastPullAt = Date.now(); });
+}
+
+// ---------- static ----------
+function asset(name, file, type) {
+  try {
+    return { body: fs.readFileSync(path.join(daemonWebDir(), file)), type };
+  } catch {
+    return null;
+  }
+}
+
+const ASSETS = {
+  "/": ["index.html", "text/html; charset=utf-8"],
+  "/index.html": ["index.html", "text/html; charset=utf-8"],
+  "/app.js": ["app.js.txt", "application/javascript; charset=utf-8"],
+  "/app.css": ["app.css.txt", "text/css; charset=utf-8"],
+  "/pair": ["pair.html", "text/html; charset=utf-8"],
+  "/pair.html": ["pair.html", "text/html; charset=utf-8"],
+};
+
+// self-signed TLS cert — phones need a SECURE CONTEXT for WebCrypto, so the
+// phone-facing server speaks https. Accepted-once in the browser; the pinned
+// daemon key from pairing still guards against TLS MITM.
+function ensureCert(ip) {
+  const certP = path.join(DATA_DIR, "cert.pem");
+  const keyP = path.join(DATA_DIR, "cert.key.pem");
+  const metaP = path.join(DATA_DIR, "cert.meta.json");
+  let meta = null;
+  try { meta = JSON.parse(fs.readFileSync(metaP, "utf8")); } catch {}
+  if (meta?.sanIp === (ip ?? null) && fs.existsSync(certP) && fs.existsSync(keyP)) {
+    return { cert: fs.readFileSync(certP), key: fs.readFileSync(keyP) };
+  }
+  const san = `subjectAltName=DNS:localhost,IP:127.0.0.1${ip ? `,IP:${ip}` : ""}`;
+  fs.mkdirSync(DATA_DIR, { recursive: true });
+  const out = spawnSync("openssl", [
+    "req", "-x509", "-newkey", "ec", "-pkeyopt", "ec_paramgen_curve:prime256v1",
+    "-keyout", keyP, "-out", certP, "-days", "3650", "-nodes",
+    "-subj", "/CN=ocduet", "-addext", san,
+  ], { stdio: "ignore" });
+  if (out.status !== 0) throw new Error("openssl cert generation failed — is openssl installed?");
+  try { fs.chmodSync(keyP, 0o600); } catch {}
+  fs.writeFileSync(metaP, JSON.stringify({ sanIp: ip ?? null, at: Date.now() }));
+  log("generated tls cert for", san);
+  return { cert: fs.readFileSync(certP), key: fs.readFileSync(keyP) };
+}
+
+// ---------- server ----------
+const onRequest = (req, res) => {
+  const url = new URL(req.url, "http://x");
+  if (url.pathname === "/status") {
+    // full detail only for direct loopback callers (CLI/tests/stub health
+    // checks). LAN peers and relayed requests (marked by the relay client
+    // with x-ocduet-via-relay) get the bare minimum — pid, ports, lanIp,
+    // instance counts and relay coordinates are nobody's business off-box
+    const loop = /^(127\.0\.0\.1|::1|::ffff:127\.0\.0\.1)$/.test(req.socket.remoteAddress || "");
+    const relayed = req.headers["x-ocduet-via-relay"] === "1";
+    const body = loop && !relayed ? {
+      app: "ocduet", daemon: true, ok: true, version: VERSION,
+      instances: instances.size, clients: phones.size,
+      pid: process.pid, port: PORT, localPort: LOCAL_PORT, lanIp: advertisedIp, startedAt: STARTED_AT,
+      relay: relayStatus(),
+    } : { app: "ocduet", daemon: true, ok: true, version: VERSION };
+    res.writeHead(200, { "content-type": "application/json" });
+    res.end(JSON.stringify(body));
+    return;
+  }
+  if (url.pathname === "/pair/info") {
+    res.writeHead(200, { "content-type": "application/json", "cache-control": "no-store" });
+    res.end(JSON.stringify({ pub: daemonPub().toString("base64"), words: daemonWords() }));
+    return;
+  }
+  if (url.pathname === "/pair/register" && req.method === "POST") {
+    let body = "";
+    req.on("data", (c) => { body += c; if (body.length > 8192) req.destroy(); });
+    req.on("end", () => {
+      const fail = (why) => { res.writeHead(403, { "content-type": "application/json" }); res.end(JSON.stringify({ ok: false, error: why })); };
+      try {
+        const m = JSON.parse(body || "{}");
+        const phoneId = String(m.phoneId || "");
+        const phonePub = String(m.phonePub || "");
+        const pubBuf = Buffer.from(phonePub, "base64");
+        if (!phoneId || phoneId.length > 64) return fail("bad phoneId");
+        if (pubBuf.length !== 32) return fail("bad phonePub");
+        if (!tokenOk(m.token)) return fail("bad token");
+        if (!verifySig(pubBuf, pairMsg(phoneId, phonePub, m.token), m.sig)) return fail("bad signature");
+        addPhone({ id: phoneId, pub: phonePub });
+        log("phone paired:", phoneId);
+        res.writeHead(200, { "content-type": "application/json", "cache-control": "no-store" });
+        res.end(JSON.stringify({ ok: true }));
+      } catch {
+        fail("bad request");
+      }
+    });
+    return;
+  }
+  const a = ASSETS[url.pathname] ? asset(url.pathname, ASSETS[url.pathname][0], ASSETS[url.pathname][1]) : null;
+  if (a) {
+    res.writeHead(200, { "content-type": a.type, "cache-control": "no-store" });
+    res.end(a.body);
+    return;
+  }
+  res.writeHead(404);
+  res.end("not found");
+};
+
+const wss = new WebSocketServer({ noServer: true });
+const onUpgrade = (req, socket, head) => {
+  const url = new URL(req.url, "http://x");
+  const token = url.searchParams.get("t") || req.headers.authorization?.replace(/^Bearer\s+/i, "");
+  const internal = url.pathname === "/internal";
+  if (internal) {
+    // localhost stub hop — token auth, plaintext is fine on loopback
+    if (!tokenOk(token)) {
+      socket.write("HTTP/1.1 403 Forbidden\r\n\r\n");
+      socket.destroy();
+      return;
+    }
+  } else if (url.searchParams.get("e2ee") !== "1") {
+    // phone hop must be encrypted — no plaintext phone protocol anymore
+    socket.write("HTTP/1.1 426 Upgrade Required\r\n\r\nthis daemon requires end-to-end encryption; pair the phone via the QR url");
+    socket.destroy();
+    return;
+  }
+  wss.handleUpgrade(req, socket, head, (ws) => {
+    wss.emit(internal ? "internal" : "phone", ws, req);
+  });
+};
+
+// phones: https (secure context -> WebCrypto). stubs/CLI: loopback http.
+let LOCAL_PORT = null;
+const bootCert = ensureCert(lanIp());
+const server = https.createServer({ key: bootCert.key, cert: bootCert.cert }, onRequest);
+const localServer = http.createServer(onRequest);
+server.on("upgrade", onUpgrade);
+localServer.on("upgrade", onUpgrade);
+
+// ---- phone connections (encrypted; handshake then the old protocol inside) ----
+function handlePhoneMessage(ws, msg) {
+  if (msg.t !== "rpc" || !msg.id) return;
+
+  if (msg.method === "instances.list") {
+    (async () => {
+      await pullInstanceSessions();
+      broadcastInstances();
+      phoneSend(ws, { t: "rpcResult", id: msg.id, ok: true, result: instanceList() });
+    })();
+    return;
+  }
+  const inst = instances.get(msg.instanceId);
+  if (!inst) {
+    phoneSend(ws, { t: "rpcResult", id: msg.id, ok: false, error: "instance offline" });
+    return;
+  }
+  inst.__pending = inst.__pending || new Map();
+  inst.__pending.set(msg.id, { ws, method: msg.method, args: msg.args || {} });
+  try {
+    inst.ws.send(JSON.stringify({ t: "rpc", id: msg.id, method: msg.method, args: msg.args || {} }));
+  } catch (err) {
+    inst.__pending.delete(msg.id);
+    phoneSend(ws, { t: "rpcResult", id: msg.id, ok: false, error: String(err?.message || err) });
+  }
+}
+
+// relay coordinates for phones: sent inside the encrypted hello so an
+// already-paired phone can learn/migrate to the relay route without a new QR
+function relayRouteInfo() {
+  const s = relayStatus();
+  if (!s.linked) return null;
+  const cfg = readRelayConfig();
+  return { url: cfg.url, desktopId: cfg.desktopId, connected: s.connected };
+}
+
+function handleHandshake(ws, msg) {  const close = (code, why) => { try { ws.close(code, why); } catch {} };
+  if (msg?.t !== "hs1") return close(4001, "expected hs1");
+  const ts = Number(msg.ts) || 0;
+  if (Math.abs(Date.now() - ts) > 120_000) return close(4001, "stale handshake");
+  const phonePub = String(msg.phonePub || "");
+  const ephB64 = String(msg.eph || "");
+  if (Buffer.from(phonePub, "base64").length !== 32) return close(4001, "bad phonePub");
+  if (Buffer.from(ephB64, "base64").length !== 32) return close(4001, "bad eph");
+  if (!tokenOk(msg.token)) return close(4003, "bad token");
+  const phone = phoneByPub(Buffer.from(phonePub, "base64"));
+  if (!phone) return close(4003, "unknown phone — pair it first");
+  if (!verifySig(Buffer.from(phonePub, "base64"), hs1Msg(phonePub, ephB64, msg.token, msg.ts), msg.sig)) {
+    return close(4003, "bad signature");
+  }
+  const eph = ephX25519();
+  const ephB64d = eph.pub.toString("base64");
+  const shared = ecdh(eph.priv, Buffer.from(ephB64, "base64"));
+  const keys = deriveKeys(shared, hsInfo(phonePub, ephB64, ephB64d));
+  ws.__sec = { pd: keys.pd, dp: keys.dp, sendN: 0, recvN: 0, pending: sha256hex(ephB64d) };
+  ws.send(JSON.stringify({ t: "hs2", eph: ephB64d, sig: signDaemon(hs2Msg(phonePub, ephB64, ephB64d)) }));
+}
+
+function sha256hex(s) {
+  return crypto.createHash("sha256").update(s).digest("hex");
+}
+
+wss.on("phone", (ws) => {
+  ws.__id = crypto.randomUUID().slice(0, 8);
+  ws.__ua = "phone";
+  ws.__connectedAt = Date.now();
+  ws.alive = true;
+  phones.add(ws);
+  const hsTimer = setTimeout(() => { if (!ws.__sec || ws.__sec.pending) try { ws.close(4001, "handshake timeout"); } catch {} }, 10_000);
+  ws.on("pong", () => { ws.alive = true; });
+  ws.on("message", (raw) => {
+    let msg;
+    try { msg = JSON.parse(raw.toString()); } catch { return; }
+    if (!ws.__sec) return handleHandshake(ws, msg);
+    if (msg?.t !== "sec") return; // no plaintext after hs1
+    try {
+      if (ws.__sec.pending) {
+        if (msg.n !== 0) throw new Error("bad hs3 counter");
+        const m = frameDecrypt(ws.__sec.pd, PD_TAG, 0, msg.ct);
+        if (m?.t !== "hs3" || m.echo !== ws.__sec.pending) throw new Error("bad hs3");
+        delete ws.__sec.pending;
+        clearTimeout(hsTimer);
+        ws.__sec.recvN = 1;
+        phoneSend(ws, { t: "hs4", ok: true }); // dp frame at n=0
+        phoneSend(ws, {
+          t: "hello",
+          version: VERSION,
+          lanIp: advertisedIp,
+          port: PORT,
+          relay: relayRouteInfo(),
+          instances: instanceList(),
+          clients: [...phones].map(phoneInfo),
+        });
+        broadcast({ t: "clients", clients: [...phones].map(phoneInfo) }, undefined);
+        writeState(PORT);
+        return;
+      }
+      if (msg.n !== ws.__sec.recvN) throw new Error("replay/out-of-order frame");
+      ws.__sec.recvN++;
+      handlePhoneMessage(ws, frameDecrypt(ws.__sec.pd, PD_TAG, msg.n, msg.ct));
+    } catch (err) {
+      log("phone frame rejected:", String(err?.message || err));
+      try { ws.close(4002, "bad frame"); } catch {}
+    }
+  });
+  ws.on("close", () => {
+    clearTimeout(hsTimer);
+    phones.delete(ws);
+    broadcast({ t: "clients", clients: [...phones].map(phoneInfo) });
+    writeState(PORT);
+  });
+});
+
+// ---- plugin (internal) connections ----
+wss.on("internal", (ws) => {
+  ws.alive = true;
+  let registeredId = null;
+  ws.on("pong", () => { ws.alive = true; });
+  ws.on("message", (raw) => {
+    let msg;
+    try { msg = JSON.parse(raw.toString()); } catch { return; }
+    if (msg.t === "register") {
+      registeredId = msg.instance?.id;
+      if (!registeredId) return;
+      instances.set(registeredId, { ws, info: msg.instance, sessions: msg.sessions || [] });
+      cacheInstance(msg.instance, msg.sessions);
+      log("instance attached:", registeredId);
+      broadcastInstances();
+      writeState(PORT);
+    } else if (msg.t === "event") {
+      if (msg.event?.type === "session.deleted") {
+        const p = msg.event.properties ?? {};
+        const gone = p.info?.id ?? p.sessionID ?? p.id;
+        if (gone) pruneDeletedSession(String(gone));
+      }
+      broadcast({ t: "event", instanceId: registeredId, event: msg.event });
+    } else if (msg.t === "sessions" && registeredId) {
+      const inst = instances.get(registeredId);
+      if (inst) {
+        inst.sessions = msg.sessions || [];
+        cacheInstance(inst.info, inst.sessions);
+        broadcastInstances();
+      }
+    } else if (msg.t === "rpcResult" && msg.id) {
+      const inst = registeredId && instances.get(registeredId);
+      const pullCb = inst?.__pulls?.get(msg.id);
+      if (pullCb) {
+        inst.__pulls.delete(msg.id);
+        pullCb(msg.ok ? msg.result : null);
+        return;
+      }
+      const rec = inst?.__pending?.get(msg.id);
+      if (rec) {
+        inst.__pending.delete(msg.id);
+        // belt & suspenders: a successful delete RPC prunes even if the
+        // session.deleted event never reaches the daemon
+        if (msg.ok && rec.method === "session.delete" && rec.args?.id) {
+          pruneDeletedSession(String(rec.args.id));
+        }
+        phoneSend(rec.ws, { t: "rpcResult", id: msg.id, ok: !!msg.ok, ...(msg.ok ? { result: msg.result } : { error: msg.error }) });
+      }
+    }
+  });
+  const drop = () => {
+    if (registeredId && instances.get(registeredId)?.ws === ws) {
+      instances.delete(registeredId);
+      log("instance detached:", registeredId);
+      broadcastInstances();
+      writeState(PORT);
+    }
+  };
+  ws.on("close", drop);
+});
+
+// ---- keepalive: protocol pings; browsers pong automatically ----
+setInterval(() => {
+  for (const ws of phones) {
+    if (!ws.alive) { try { ws.terminate(); } catch {} continue; }
+    ws.alive = false;
+    try { ws.ping(); } catch {}
+  }
+  for (const inst of instances.values()) {
+    const ws = inst.ws;
+    if (!ws.alive) { try { ws.terminate(); } catch {} continue; }
+    ws.alive = false;
+    try { ws.ping(); } catch {}
+  }
+}, 30_000).unref();
+
+// ---- bind (step ports like the plugin did) ----
+function healthyDaemonOn(port) {
+  return fetch(`http://127.0.0.1:${port}/status`, { signal: AbortSignal.timeout(1000) })
+    .then(async (r) => {
+      if (!r.ok) return false;
+      try { return (await r.json())?.daemon === true; } catch { return false; }
+    })
+    .catch(() => false);
+}
+
+let PORT = null;
+{
+  for (let p = BASE_PORT; p < BASE_PORT + 20; p++) {
+    if ((await healthyDaemonOn(p)) || (await healthyDaemonOn(p + 1))) {
+      log(`another ocduet daemon already healthy near port ${p}; exiting`);
+      try {
+        if (Number(fs.readFileSync(daemonPidPath(), "utf8")) === process.pid) fs.rmSync(daemonPidPath());
+      } catch {}
+      process.exit(0);
+    }
+  }
+  let lastErr = null;
+  for (let p = BASE_PORT; p < BASE_PORT + 20 && PORT === null; p++) {
+    lastErr = null;
+    const ok = await new Promise((resolve) => {
+      const onError = (err) => { lastErr = err; resolve(false); };
+      server.once("error", onError);
+      server.listen(p, HOST, () => {
+        server.removeListener("error", onError);
+        server.on("error", (err) => log("server error:", String(err?.message || err)));
+        resolve(true);
+      });
+    });
+    if (ok) PORT = p;
+    else if ((await healthyDaemonOn(p)) || (await healthyDaemonOn(p + 1))) {
+      // a rival daemon bound the port between our health sweep and this bind
+      log(`another ocduet daemon took port ${p} during startup; exiting`);
+      try {
+        if (Number(fs.readFileSync(daemonPidPath(), "utf8")) === process.pid) fs.rmSync(daemonPidPath());
+      } catch {}
+      process.exit(0);
+    }
+  }
+  if (PORT === null) {
+    log("FATAL: no free port:", String(lastErr?.message || lastErr));
+    process.exit(1);
+  }
+  // loopback http for stubs + CLI (they verify via the pairing token; plaintext loopback)
+  for (let q = PORT + 1; q <= PORT + 5; q++) {
+    const ok = await new Promise((resolve) => {
+      localServer.once("error", () => resolve(false));
+      localServer.listen(q, "127.0.0.1", () => resolve(true));
+    });
+    if (ok) { LOCAL_PORT = q; break; }
+  }
+  if (LOCAL_PORT === null) {
+    log("FATAL: no free loopback port");
+    process.exit(1);
+  }
+}
+
+loadKeys(); // identity exists before anything reports words
+ensureToken();
+// tighten files created by older versions (0644) — state/cache rewrite with
+// mode 0600 anyway, the sweep covers daemon.log and anything not rewritten yet
+for (const f of [daemonLogPath(), SESSIONS_CACHE_FILE, daemonStatePath()]) {
+  try { fs.chmodSync(f, 0o600); } catch {}
+}
+fs.mkdirSync(DATA_DIR, { recursive: true });
+fs.writeFileSync(PORT_FILE, String(LOCAL_PORT), { mode: 0o600 });
+fs.writeFileSync(MAIN_PORT_FILE, String(PORT), { mode: 0o600 });
+fs.writeFileSync(daemonPidPath(), String(process.pid), { mode: 0o600 });
+advertisedIp = lanIp();
+writeState(PORT);
+log(`ocduet daemon: https on ${HOST}:${PORT} (lan ${lanIp()}), loopback http on 127.0.0.1:${LOCAL_PORT}`);
+
+// relayer tunnel: keeps this desktop reachable through a public relay when
+// the phone is off-LAN. Purely additive — no-op unless `ocduet relay link`
+// wrote an identity. The relay only ever sees ciphertext (see src/relayer.js).
+const relay = startRelayClient({ localPort: LOCAL_PORT });
+if (relay) log(`relay client started: ${readRelayConfig().url} (desktop id ${readRelayConfig().desktopId})`);
+process.on("exit", () => { try { relay && relay.stop(); } catch {} });
+
+// Listen on all interfaces; DHCP/Wi-Fi changes need no socket or daemon restart.
+// Sidebar polling notices the updated state and redraws even an already-open QR.
+const networkPoll = setInterval(() => {
+  const next = lanIp();
+  const changed = next !== advertisedIp;
+  if (changed) {
+    advertisedIp = next;
+    log(`LAN address changed: ${next ?? "offline"}`);
+    try {
+      const c = ensureCert(next);
+      server.setSecureContext({ key: c.key, cert: c.cert });
+    } catch (err) {
+      log("cert regen failed:", String(err?.message || err));
+    }
+  }
+  if (changed || !fs.existsSync(daemonStatePath())) writeState(PORT);
+}, NETWORK_POLL_MS);
+networkPoll.unref();
+
+const cleanup = () => {
+  clearInterval(networkPoll);
+  // A retiring process must not remove a replacement daemon's discovery files.
+  try {
+    if (JSON.parse(fs.readFileSync(daemonStatePath(), "utf8")).pid === process.pid) fs.rmSync(daemonStatePath());
+  } catch {}
+  try {
+    if (Number(fs.readFileSync(daemonPidPath(), "utf8")) === process.pid) fs.rmSync(daemonPidPath());
+  } catch {}
+};
+process.on("exit", cleanup);
+for (const sig of ["SIGTERM", "SIGINT"]) {
+  process.on(sig, () => { cleanup(); process.exit(0); });
+}