@sksoftofficial/ocduet 0.2.1

package/src/plugin/ocduet-server.js

@@ -0,0 +1,609 @@
+// ocduet attach-stub (opencode server plugin).
+// Runs inside each opencode core process. Its only job: make sure the ocduet
+// daemon is running (spawn it if not), attach to it over an internal socket,
+// forward every bus event, and execute RPCs from phones via the SDK client.
+// All the churn-heavy code (web UI, WS server, token QR) lives in the daemon,
+// so `ocduet restart` updates the bridge WITHOUT restarting opencode.
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import crypto from "node:crypto";
+
+const XDG_DATA = process.env.XDG_DATA_HOME && path.isAbsolute(process.env.XDG_DATA_HOME)
+  ? process.env.XDG_DATA_HOME
+  : path.join(os.homedir(), ".local", "share");
+// Filled by the installer so different opencode XDG profiles share one bridge.
+const INSTALLED_DATA_DIR = null;
+const DATA_DIR = INSTALLED_DATA_DIR || process.env.OCDUET_DATA_DIR || path.join(XDG_DATA, "ocduet");
+const TOKEN_PATH = path.join(DATA_DIR, "token");
+const STATE_PATH = path.join(DATA_DIR, "state.json");
+const DAEMON_POINTER = path.join(DATA_DIR, "daemon.json");
+const SPAWN_COOLDOWN_MS = 30_000;
+
+function slug(directory) {
+  const base = path.basename(String(directory || "").replace(/\/+$/, "")) || "project";
+  const safe = base.toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^[-.]+|[-.]+$/g, "") || "project";
+  const hash = crypto.createHash("sha256").update(String(directory || "")).digest("hex").slice(0, 8);
+  return `${safe}-${hash}`;
+}
+
+function readToken() {
+  try {
+    return fs.readFileSync(TOKEN_PATH, "utf8").trim() || null;
+  } catch {
+    return null;
+  }
+}
+
+function daemonPort() {
+  try {
+    const s = JSON.parse(fs.readFileSync(STATE_PATH, "utf8"));
+    // localPort = loopback http server (stubs/CLI); port = the https phone port
+    if (s && typeof s.localPort === "number" && s.localPort > 0) return s.localPort;
+    if (s && typeof s.port === "number" && s.port > 0) return s.port;
+  } catch {}
+  return parseInt(process.env.OCDUET_PORT || "4098", 10);
+}
+
+function daemonHealthy(port) {
+  return fetch(`http://127.0.0.1:${port}/status`, { signal: AbortSignal.timeout(1500) })
+    .then(async (r) => {
+      if (!r.ok) return false;
+      // only trust an answer that identifies as the daemon — old in-process
+      // bridges also answer /status with 200 on these ports
+      try {
+        const data = await r.json();
+        return data?.daemon === true;
+      } catch {
+        return false;
+      }
+    })
+    .catch(() => false);
+}
+
+function spawnDaemon() {
+  let daemonPath = null;
+  try {
+    daemonPath = JSON.parse(fs.readFileSync(DAEMON_POINTER, "utf8")).daemonPath;
+  } catch {}
+  if (!daemonPath || !fs.existsSync(daemonPath)) return false;
+  try {
+    const logFd = fs.openSync(path.join(DATA_DIR, "daemon.log"), "a", 0o600);
+    const child = Bun.spawn({
+      cmd: ["node", daemonPath],
+      env: { ...process.env, OCDUET_DATA_DIR: DATA_DIR },
+      detached: true,
+      stdin: "ignore",
+      stdout: logFd,
+      stderr: logFd,
+    });
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function unwrap(result) {
+  if (result && typeof result === "object" && ("data" in result || "error" in result)) {
+    if (result.error) {
+      const e = result.error;
+      throw new Error(e.message || e.statusText || JSON.stringify(e));
+    }
+    return result.data;
+  }
+  return result;
+}
+
+function userSessions(list) {
+  return (Array.isArray(list) ? list : []).filter((s) => s && !s.parentID);
+}
+
+async function listAllSessions(client, ownDir) {
+  // the host client injects its own directory into every request (empty strings
+  // get replaced too), so there is no "all directories" query available.
+  // Instead: enumerate projects, then one EXPLICIT per-directory query each —
+  // explicit directories survive the injection and each per-directory list is
+  // more complete than the capped global one anyway.
+  const dirs = new Set();
+  if (ownDir) dirs.add(ownDir);
+  try {
+    const pr = await client._client.get({ url: "/project" });
+    for (const p of pr?.data || []) if (p?.worktree) dirs.add(p.worktree);
+  } catch {}
+  const seen = new Set();
+  const merged = [];
+  const results = await Promise.allSettled(
+    [...dirs].map((d) => client._client.get({ url: "/session", query: { directory: d } })));
+  for (const r of results) {
+    for (const s of r?.value?.data || []) {
+      if (s?.id && !seen.has(s.id)) { seen.add(s.id); merged.push(s); }
+    }
+  }
+  return merged;
+}
+
+let sessionDirCache = { at: 0, map: new Map() };
+async function sessionDirOf(client, id, fallback) {
+  if (Date.now() - sessionDirCache.at > 5000) {
+    try {
+      const list = await listAllSessions(client, fallback);
+      sessionDirCache = { at: Date.now(), map: new Map(list.filter((s) => s.directory).map((s) => [s.id, s.directory])) };
+    } catch {
+      sessionDirCache = { at: Date.now(), map: new Map() };
+    }
+  }
+  return sessionDirCache.map.get(String(id)) || fallback;
+}
+
+const pendingPermissions = new Map();
+const pendingQuestions = new Map();
+let permissionLevel = "ask";
+
+// ---- usage quota (ported from the TUI quota-sidebar plugin) ----
+const QUOTA_ORDER = ["5h", "hourly", "weekly", "monthly", "mcp", "code review"];
+const clampPct = (v) => Math.max(0, Math.min(100, v));
+const quotaRank = (label) => { const i = QUOTA_ORDER.indexOf(label); return i < 0 ? 99 : i; };
+
+async function quotaFetchJson(url, headers) {
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), 5000);
+  try {
+    const resp = await fetch(url, { headers, signal: ctrl.signal });
+    const text = await resp.text();
+    let json = null;
+    try { json = JSON.parse(text); } catch {}
+    return { ok: resp.ok, status: resp.status, json };
+  } finally { clearTimeout(timer); }
+}
+
+function parseJwt(token) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  try {
+    const b64 = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const pad = (4 - (b64.length % 4)) % 4;
+    return JSON.parse(Buffer.from(b64 + "=".repeat(pad), "base64").toString("utf8"));
+  } catch { return null; }
+}
+
+async function quotaZai(entry) {
+  const key = typeof entry?.key === "string" ? entry.key.trim() : "";
+  if (!key) return { name: "Z.ai", ok: false, error: "no api key" };
+  try {
+    const r = await quotaFetchJson("https://api.z.ai/api/monitor/usage/quota/limit", {
+      Authorization: key, "User-Agent": "ocduet/1.0", "Content-Type": "application/json",
+    });
+    if (!r.ok) return { name: "Z.ai", ok: false, error: `HTTP ${r.status}` };
+    const limits = r.json?.data?.limits ?? r.json?.limits;
+    if (!Array.isArray(limits)) return { name: "Z.ai", ok: false, error: "no limits" };
+    const windows = [];
+    for (const limit of limits) {
+      const label = limit.type === "TIME_LIMIT" ? "mcp" : ({ 3: "5h", 6: "weekly" })[limit.unit];
+      if (!label) continue;
+      const resetMs = Number.isFinite(limit.nextResetTime) ? Math.round(limit.nextResetTime) : undefined;
+      windows.push({ label, remainingPct: Math.round(clampPct(100 - (limit.percentage ?? 0))), resetMs });
+    }
+    windows.sort((a, b) => quotaRank(a.label) - quotaRank(b.label));
+    return { name: "Z.ai", ok: true, windows };
+  } catch (err) { return { name: "Z.ai", ok: false, error: String(err?.message ?? err) }; }
+}
+
+async function quotaOpenAI(entry) {
+  const access = typeof entry?.access === "string" ? entry.access.trim() : "";
+  if (!access) return { name: "OpenAI", ok: false, error: "no access token" };
+  const accountId = parseJwt(access)?.["https://api.openai.com/auth"]?.chatgpt_account_id ?? entry?.accountId;
+  const headers = { Authorization: `Bearer ${access}`, "User-Agent": "ocduet/1.0" };
+  if (accountId) headers["ChatGPT-Account-Id"] = String(accountId);
+  try {
+    const r = await quotaFetchJson("https://chatgpt.com/backend-api/wham/usage", headers);
+    if (!r.ok) return { name: "OpenAI", ok: false, error: `HTTP ${r.status}` };
+    const rl = r.json?.rate_limit ?? {};
+    const windows = [];
+    const add = (w, fallback) => {
+      if (!w || typeof w.used_percent !== "number") return;
+      let label = fallback;
+      if (w.limit_window_seconds === 5 * 60 * 60) label = "5h";
+      else if (w.limit_window_seconds === 7 * 24 * 60 * 60) label = "weekly";
+      else if (w.limit_window_seconds === 60 * 60) label = "hourly";
+      let resetMs;
+      if (typeof w.reset_at === "number" && w.reset_at > 0) resetMs = Math.round(w.reset_at * 1000);
+      else if (typeof w.reset_after_seconds === "number" && w.reset_after_seconds > 0) resetMs = Date.now() + Math.round(w.reset_after_seconds * 1000);
+      windows.push({ label, remainingPct: Math.round(clampPct(100 - w.used_percent)), resetMs });
+    };
+    add(rl.primary_window, "5h");
+    add(rl.secondary_window, "weekly");
+    add(r.json?.code_review_rate_limit?.primary_window, "code review");
+    windows.sort((a, b) => quotaRank(a.label) - quotaRank(b.label));
+    const resets = r.json?.rate_limit_reset_credits?.available_count;
+    return { name: "OpenAI", ok: true, windows, resetsAvailable: typeof resets === "number" ? resets : undefined, resetWindow: "weekly" };
+  } catch (err) { return { name: "OpenAI", ok: false, error: String(err?.message ?? err) }; }
+}
+
+async function quotaOpenCodeGo(entry) {
+  const key = typeof entry?.key === "string" ? entry.key.trim() : typeof entry?.apiKey === "string" ? entry.apiKey.trim() : "";
+  if (!key) return { name: "OpenCode Go", ok: false, error: "no api key" };
+  try {
+    const r = await quotaFetchJson("https://opencode.ai/zen/go/v1/usage", {
+      Authorization: `Bearer ${key}`, "User-Agent": "ocduet/1.0",
+    });
+    if (!r.ok) return { name: "OpenCode Go", ok: false, error: `HTTP ${r.status}` };
+    const usage = r.json?.usage ?? {};
+    const windows = [];
+    const add = (label, w) => {
+      if (!w || typeof w.percent !== "number") return;
+      let resetMs;
+      const at = w.resetsAt ?? w.resets_at;
+      if (typeof at === "string" && at.trim() && Number.isFinite(Date.parse(at))) resetMs = Date.parse(at);
+      else if (typeof at === "number" && at > 0) resetMs = Math.round(at > 1e12 ? at : at * 1000);
+      else if (typeof w.reset_after_seconds === "number" && w.reset_after_seconds > 0) resetMs = Date.now() + Math.round(w.reset_after_seconds * 1000);
+      windows.push({ label, remainingPct: Math.round(clampPct(100 - w.percent)), resetMs });
+    };
+    add("5h", usage.rolling);
+    add("weekly", usage.weekly);
+    add("monthly", usage.monthly);
+    if (!windows.length) return { name: "OpenCode Go", ok: false, error: "no usage windows" };
+    windows.sort((a, b) => quotaRank(a.label) - quotaRank(b.label));
+    return { name: "OpenCode Go", ok: true, windows };
+  } catch (err) { return { name: "OpenCode Go", ok: false, error: String(err?.message ?? err) }; }
+}
+
+async function quotaLoad() {
+  let auth = null;
+  try { auth = JSON.parse(fs.readFileSync(path.join(XDG_DATA, "opencode", "auth.json"), "utf8")); } catch {}
+  if (!auth) return { ok: false, error: "auth.json not found" };
+  const tasks = [];
+  if (auth["zai-coding-plan"]) tasks.push(quotaZai(auth["zai-coding-plan"]));
+  if (auth.openai) tasks.push(quotaOpenAI(auth.openai));
+  if (auth["opencode-go"]) tasks.push(quotaOpenCodeGo(auth["opencode-go"]));
+  const providers = await Promise.all(tasks);
+  return { ok: true, providers, updatedAt: Date.now() };
+}
+
+// question.asked / permission.asked are NOT delivered to the plugin event
+// hook for cross-directory runs (opencode 1.18.x), so the in-memory Maps
+// miss them entirely and the phone would never see the card. The server
+// exposes authoritative pending registries at GET /question and
+// GET /permission — directory-scoped — so always merge a live query for
+// the caller-supplied directory (the session's own) plus this instance's.
+async function livePending(ctx, url, dirs) {
+  const out = [];
+  for (const d of dirs) {
+    try {
+      const res = await ctx.client._client.get({ url, query: { directory: d } });
+      const list = Array.isArray(res?.data) ? res.data : Array.isArray(res) ? res : [];
+      if (Array.isArray(list)) out.push(...list);
+    } catch {}
+  }
+  return out;
+}
+
+const RPC_METHODS = {
+  "session.create": (ctx, args) =>
+    ctx.client.session.create({
+      query: { directory: ctx.directory },
+      body: { ...(args.title ? { title: String(args.title) } : {}) },
+    }),
+  "session.list": async (ctx, _args) => userSessions(await listAllSessions(ctx.client, ctx.directory)),
+  "session.messages": (ctx, args) =>
+    ctx.client.session.messages({
+      path: { id: String(args.id) },
+      query: { directory: ctx.directory, ...(args.limit ? { limit: args.limit } : {}) },
+    }),
+  "session.message": (ctx, args) =>
+    ctx.client.session.message({ path: { id: String(args.id), messageID: String(args.messageID) }, query: { directory: ctx.directory } }),
+  "session.prompt": (ctx, args) =>
+    ctx.client.session.prompt({
+      path: { id: String(args.id) },
+      query: { directory: ctx.directory },
+      body: {
+        ...(args.agent ? { agent: String(args.agent) } : {}),
+        ...(args.model?.providerID && args.model?.modelID
+          ? { model: { providerID: String(args.model.providerID), modelID: String(args.model.modelID) } }
+          : {}),
+        ...(args.variant && args.variant !== "default" ? { variant: String(args.variant) } : {}),
+        parts: [{ type: "text", text: String(args.text ?? "") }],
+      },
+    }),
+  "session.abort": (ctx, args) =>
+    ctx.client.session.abort({ path: { id: String(args.id) }, query: { directory: ctx.directory } }),
+  "session.delete": (ctx, args) =>
+    ctx.client.session.delete
+      ? ctx.client.session.delete({ path: { id: String(args.id) }, query: { directory: ctx.directory } })
+      : ctx.client.session.remove({ path: { id: String(args.id) }, query: { directory: ctx.directory } }),
+  "session.rename": (ctx, args) =>
+    ctx.client.session.rename({ path: { id: String(args.id) }, query: { directory: ctx.directory }, body: { title: String(args.title ?? "") } }),
+  "quota.get": () => quotaLoad(),
+  "session.share": (ctx, args) => ctx.client.session.share({ path: { id: String(args.id) }, query: { directory: ctx.directory } }),
+  "session.compact": async (ctx, args) => {
+    const id = String(args.id);
+    let body;
+    try {
+      const list = unwrap(await ctx.client.session.list()) ?? [];
+      const m = list.find((s) => s.id === id)?.model;
+      if (m?.providerID && m?.id) body = { providerID: m.providerID, modelID: m.id };
+    } catch {}
+    if (!body) throw new Error("cannot resolve session model for compaction");
+    return ctx.client.session.summarize({ path: { id }, query: { directory: ctx.directory }, body });
+  },
+  "permission.list": async (ctx, args) => {
+    const sid = args && args.sessionID ? String(args.sessionID) : null;
+    const byId = new Map();
+    const seed = [];
+    if (sid) seed.push(...(pendingPermissions.get(sid)?.values() ?? []));
+    else for (const m of pendingPermissions.values()) seed.push(...m.values());
+    for (const p of seed) byId.set(String(p.permissionID ?? p.id), p);
+    const dirs = new Set([ctx.directory]);
+    if (args && args.directory) dirs.add(String(args.directory));
+    for (const p of await livePending(ctx, "/permission", dirs)) {
+      const id = p?.id ?? p?.permissionID ?? p?.requestID;
+      if (!id || !p?.sessionID) continue;
+      if (sid && String(p.sessionID) !== sid) continue;
+      byId.set(String(id), p);
+    }
+    return [...byId.values()];
+  },
+  "permission.respond": (ctx, args) =>
+    ctx.client.postSessionIdPermissionsPermissionId({
+      path: { id: String(args.sessionID), permissionID: String(args.permissionID) },
+      query: { directory: ctx.directory },
+      body: { response: ["once", "always", "reject"].includes(args.response) ? args.response : "once" },
+    }),
+  "permission.level": (_ctx, args) => {
+    if (args && ["ask", "auto"].includes(args.level)) permissionLevel = args.level;
+    return permissionLevel;
+  },
+  "question.list": async (ctx, args) => {
+    const sid = args && args.sessionID ? String(args.sessionID) : null;
+    const byId = new Map();
+    const seed = sid
+      ? [...(pendingQuestions.values() ?? [])].filter((q) => q.sessionID === sid)
+      : [...(pendingQuestions.values() ?? [])];
+    for (const q of seed) byId.set(String(q.id), q);
+    const dirs = new Set([ctx.directory]);
+    if (args && args.directory) dirs.add(String(args.directory));
+    for (const q of await livePending(ctx, "/question", dirs)) {
+      const id = q?.id ?? q?.requestID;
+      if (!id || !q?.sessionID) continue;
+      if (sid && String(q.sessionID) !== sid) continue;
+      if (!Array.isArray(q.questions)) continue;
+      byId.set(String(id), {
+        id: String(id),
+        sessionID: String(q.sessionID),
+        questions: q.questions,
+        tool: q.tool ?? null,
+        time: q.time ?? Date.now(),
+      });
+    }
+    return [...byId.values()];
+  },
+  "question.respond": async (ctx, args) => {
+    const answers = (Array.isArray(args.answers) ? args.answers : []).map((a) => (Array.isArray(a) ? a.map(String) : [String(a)]));
+    return unwrap(await ctx.client._client.post({
+      url: `/question/${encodeURIComponent(String(args.requestID))}/reply`,
+      query: { directory: ctx.directory },
+      body: { answers },
+      headers: { "Content-Type": "application/json" },
+    }));
+  },
+  "question.reject": async (ctx, args) =>
+    unwrap(await ctx.client._client.post({
+      url: `/question/${encodeURIComponent(String(args.requestID))}/reject`,
+      query: { directory: ctx.directory },
+    })),
+  "provider.list": async (ctx, _args) => {
+    const result = unwrap(await ctx.client.provider.list({ query: { directory: ctx.directory } }));
+    const connected = new Set(result?.connected || []);
+    const out = [];
+    for (const p of result?.all || []) {
+      if (!connected.has(p.id)) continue;
+      const models = (Array.isArray(p.models) ? p.models : Object.values(p.models || {}))
+        .filter((m) => m && m.id)
+        .map((m) => ({
+          id: m.id,
+          name: m.name || m.id,
+          reasoning: !!m.capabilities?.reasoning,
+          variants: Object.keys(m.variants || {}),
+          context: m.limit?.context,
+        }));
+      out.push({ id: p.id, name: p.name || p.id, models });
+    }
+    return out;
+  },
+};
+
+function trackPermission(event) {
+  if (!event || !event.type) return;
+  const p = event.properties ?? {};
+  if (event.type === "permission.updated" || event.type === "permission.asked" || event.type === "permission.v2.asked") {
+    const sid = p.sessionID;
+    const pid = p.id ?? p.requestID;
+    if (!sid || !pid) return;
+    if (!pendingPermissions.has(sid)) pendingPermissions.set(sid, new Map());
+    pendingPermissions.get(sid).set(pid, {
+      id: pid,
+      sessionID: sid,
+      type: p.type ?? p.permission ?? p.action ?? "tool",
+      pattern: p.pattern ?? p.patterns ?? p.resources,
+      title: p.title,
+      time: p.time?.created,
+    });
+  } else if (event.type === "permission.replied" || event.type === "permission.v2.replied") {
+    const m = pendingPermissions.get(p.sessionID);
+    if (m) {
+      m.delete(p.permissionID ?? p.requestID);
+      if (!m.size) pendingPermissions.delete(p.sessionID);
+    }
+  }
+}
+
+function trackQuestion(event) {
+  if (!event || !event.type) return;
+  const p = event.properties ?? {};
+  if (event.type === "question.asked" || event.type === "question.v2.asked") {
+    const id = p.id ?? p.requestID;
+    const sid = p.sessionID;
+    if (!id || !sid) return;
+    pendingQuestions.set(String(id), {
+      id: String(id),
+      sessionID: String(sid),
+      questions: Array.isArray(p.questions) ? p.questions : [],
+      time: Date.now(),
+    });
+  } else if (event.type === "question.replied" || event.type === "question.rejected"
+    || event.type === "question.v2.replied" || event.type === "question.v2.rejected") {
+    pendingQuestions.delete(String(p.requestID ?? p.id));
+  }
+}
+
+export default async function ocduetAttach({ client, directory, worktree, project }) {
+  if (typeof Bun === "undefined") return {};
+  if (globalThis.__ocduetAttach) return {};
+  globalThis.__ocduetAttach = true;
+
+  const ctx = { client, directory, worktree };
+  const instanceId = `${slug(directory)}-${process.pid}`;
+  const info = {
+    id: instanceId,
+    directory,
+    worktree,
+    project: project ? { id: project.id, name: project.name ?? null } : null,
+    pid: process.pid,
+  };
+
+  let ws = null;
+  let backoff = 1000;
+  let lastSpawnAttempt = 0;
+  let closed = false;
+
+  const register = () => {
+    (async () => {
+      let sessions = [];
+      try {
+        sessions = userSessions(unwrap(await Promise.race([
+          listAllSessions(client, directory),
+          new Promise((_, rej) => setTimeout(() => rej(new Error("timeout")), 3000)),
+        ]))) ?? [];
+      } catch {}
+      try {
+        ws.send(JSON.stringify({ t: "register", instance: info, sessions }));
+      } catch {}
+    })();
+  };
+
+  const connect = async () => {
+    while (!closed) {
+      const port = daemonPort();
+      if (!(await daemonHealthy(port))) {
+        if (Date.now() - lastSpawnAttempt > SPAWN_COOLDOWN_MS) {
+          lastSpawnAttempt = Date.now();
+          spawnDaemon();
+          // give it a moment to come up
+          for (let i = 0; i < 15 && !(await daemonHealthy(daemonPort())); i++) {
+            await new Promise((r) => setTimeout(r, 1000));
+          }
+        }
+        await new Promise((r) => setTimeout(r, 5000));
+        continue;
+      }
+      const token = readToken();
+      if (!token) {
+        await new Promise((r) => setTimeout(r, 10000));
+        continue;
+      }
+      await new Promise((resolve) => {
+        let settled = false;
+        try {
+          ws = new WebSocket(`ws://127.0.0.1:${daemonPort()}/internal?t=${encodeURIComponent(token)}`);
+        } catch {
+          resolve();
+          return;
+        }
+        const done = () => { if (!settled) { settled = true; resolve(); } };
+        ws.onopen = () => {
+          backoff = 1000;
+          register();
+          done();
+        };
+        ws.onmessage = (ev) => {
+          let msg;
+          try { msg = JSON.parse(ev.data); } catch { return; }
+          if (msg.t === "rpc" && msg.id) {
+            const handler = RPC_METHODS[msg.method];
+            if (!handler) {
+              ws.send(JSON.stringify({ t: "rpcResult", id: msg.id, ok: false, error: `unknown method: ${msg.method}` }));
+              return;
+            }
+            Promise.resolve()
+              .then(() => handler({ ...ctx, directory: (msg.args && msg.args.directory) || ctx.directory }, msg.args || {}))
+              .then((result) => ws.send(JSON.stringify({ t: "rpcResult", id: msg.id, ok: true, result: unwrap(result) })))
+              .catch((err) => ws.send(JSON.stringify({ t: "rpcResult", id: msg.id, ok: false, error: String(err?.message || err) })));
+          }
+        };
+        ws.onclose = () => { ws = null; done(); };
+        ws.onerror = () => { try { ws && ws.close(); } catch {} };
+        setTimeout(done, 8000);
+      });
+      if (!closed && !ws) {
+        await new Promise((r) => setTimeout(r, Math.min(backoff, 15000)));
+        backoff = Math.min(backoff * 1.7, 15000);
+      } else if (ws) {
+        // wait for close, then loop again
+        await new Promise((resolve) => {
+          const check = setInterval(() => {
+            if (!ws || ws.readyState > 1) { clearInterval(check); resolve(); }
+          }, 1000);
+        });
+      }
+    }
+  };
+
+  connect();
+
+  let sessionsTimer = null;
+  const pushSessions = () => {
+    clearTimeout(sessionsTimer);
+    sessionsTimer = setTimeout(async () => {
+      if (closed) return;
+      try {
+        const sessions = userSessions(unwrap(await Promise.race([
+          listAllSessions(client, directory),
+          new Promise((_, rej) => setTimeout(() => rej(new Error("timeout")), 3000)),
+        ]))) ?? [];
+        if (ws && ws.readyState === 1) ws.send(JSON.stringify({ t: "sessions", sessions }));
+      } catch {}
+    }, 500);
+  };
+
+  for (const sig of ["SIGTERM", "SIGINT"]) {
+    process.on(sig, () => {
+      closed = true;
+      try { ws && ws.close(); } catch {}
+    });
+  }
+
+  return {
+    event: async ({ event }) => {
+      trackPermission(event);
+      trackQuestion(event);
+      if (event?.type === "session.created" || event?.type === "session.updated" || event?.type === "session.deleted"
+        || event?.type === "session.idle" || event?.type === "message.updated") pushSessions();
+      if (permissionLevel === "auto" && (event?.type === "permission.updated" || event?.type === "permission.asked" || event?.type === "permission.v2.asked")) {
+        const p = event.properties ?? {};
+        const pid = p.id ?? p.requestID;
+        if (p.sessionID && pid) {
+          try {
+            await unwrap(await ctx.client.postSessionIdPermissionsPermissionId({
+              path: { id: String(p.sessionID), permissionID: String(pid) },
+              query: { directory: await sessionDirOf(client, String(p.sessionID), ctx.directory) },
+              body: { response: "once" },
+            }));
+          } catch {}
+        }
+      }
+      if (ws && ws.readyState === 1) {
+        try { ws.send(JSON.stringify({ t: "event", event })); } catch {}
+      }
+    },
+  };
+}