@sym-bot/sym 0.2.0 → 0.2.1

package/README.md

@@ -6,7 +6,7 @@ Your AI agents share everything or nothing. There's no intelligence in the decis
 
 [![npm](https://img.shields.io/npm/v/@sym-bot/sym)](https://www.npmjs.com/package/@sym-bot/sym)
 [![License](https://img.shields.io/badge/license-Apache%202.0-blue)](LICENSE)
-[![MMP](https://img.shields.io/badge/protocol-MMP%20v0.1.0-purple)](https://sym.bot/protocol)
+[![MMP](https://img.shields.io/badge/protocol-MMP%20v0.2.0-purple)](https://sym.bot/protocol)
 
 ---
 
@@ -33,6 +33,48 @@ await node.stop();
 
 Peers on the same network discover each other automatically via Bonjour. Peers across the internet connect through the WebSocket relay. The coupling engine decides what to share.
 
+## sym-daemon
+
+The daemon is your device's persistent mesh presence — a **physical node** that runs continuously as a background service. It maintains relay connections, Bonjour discovery, and peer state even when no apps are running.
+
+### Installation
+
+```bash
+# Install the daemon as a launchd LaunchAgent (macOS)
+node bin/sym-daemon.js --install
+
+# Check daemon status
+node bin/sym-daemon.js --status
+
+# Remove the daemon
+node bin/sym-daemon.js --uninstall
+```
+
+On macOS, the daemon installs as a launchd LaunchAgent that:
+- **Auto-starts on login** — mesh presence begins immediately
+- **Auto-restarts on crash** — the mesh never goes down
+- **Maintains relay connection permanently** — internet peers always reachable
+
+### Physical and Virtual Nodes
+
+The daemon introduces a two-tier node model:
+
+- **Physical node** (sym-daemon) — the device itself. One per machine. Always running. Owns the relay connection, Bonjour identity, and peer state.
+- **Virtual nodes** (apps) — Claude Code, MeloTune Mac, or any app that connects to the daemon via Unix socket IPC at `/tmp/sym.sock`.
+
+```
+MacBook (sym-daemon, always running)
+├── Claude Code (virtual node, via IPC)
+├── MeloTune Mac (virtual node, via IPC)
+│
+├── Bonjour (LAN peers)
+└── Relay (internet peers)
+    ├── MeloTune iPhone
+    └── Telegram bot
+```
+
+When Claude Code restarts, the mesh doesn't break. The daemon holds the connection. When Claude Code starts again, it reconnects to the daemon via IPC and resumes where it left off. The mesh is the daemon — apps come and go.
+
 ## Cognitive Coupling
 
 SYM doesn't blindly broadcast. Each node encodes its memories into a hidden state vector. When peers connect, the coupling engine evaluates cognitive drift:
@@ -57,25 +99,20 @@ The blogger never sees the API bug. The architecture decided — no policy, no r
 
 ## How It Works
 
-There is no central service. Each agent embeds its own SymNode with its own identity, memory, and cognitive state. The mesh emerges from peer connections.
+There is no central service. Each device runs a sym-daemon that maintains its mesh identity, memory, and cognitive state. Apps connect to the daemon as virtual nodes. The mesh emerges from peer connections between physical nodes.
 
 ```
-┌────────────────┐  ┌────────────────┐  ┌────────────────┐
-│  Claude Code    │  │  MeloTune     │  │  Telegram Bot  │
-│  (Mac/Windows)  │  │  (iPhone)     │  │  (any device)  │
-│                 │  │                │  │                │
-│  ┌───────────┐  │  │  ┌───────────┐ │  │  ┌───────────┐ │
-│  │ SYM Node  │  │  │  │ SYM Node  │ │  │  │ SYM Node  │ │
-│  │ Node.js   │  │  │  │ Swift     │ │  │  │ Node.js   │ │
-│  └─────┬─────┘  │  └─────┬───────┘ │  │  └─────┬─────┘ │
-└────────┼────────┘  └──────┼────────┘  └────────┼───────┘
-         │                  │                     │
-         ├── Bonjour (LAN) ─┤                     │
-         │                  │                     │
-         └──── WebSocket Relay (internet) ────────┘
+MacBook (sym-daemon, always running)
+├── Claude Code (virtual node, via IPC)
+├── MeloTune Mac (virtual node, via IPC)
+│
+├── Bonjour (LAN peers)
+└── Relay (internet peers)
+    ├── MeloTune iPhone
+    └── Telegram bot
 ```
 
-Each node:
+Each physical node:
 - Declares its cognitive identity via `cognitiveProfile`
 - Encodes context into a hidden state vector (context encoder)
 - Discovers local peers via Bonjour/mDNS (`_sym._tcp`)
@@ -84,6 +121,13 @@ Each node:
 - Shares memories only with aligned peers (drift ≤ 0.5)
 - Evaluates incoming mood with configurable `moodThreshold` (default 0.8)
 - Re-encodes periodically as context evolves
+- Accepts virtual node connections via Unix socket IPC (`/tmp/sym.sock`)
+
+Each virtual node:
+- Connects to the local daemon via IPC — no direct network access needed
+- Sends memories, moods, and messages through the daemon
+- Receives mesh events (peer joins, coupling decisions, incoming memories)
+- Can start and stop independently without disrupting the mesh
 
 One engine makes every decision. Memory sharing, peer coupling, and mood relevance all go through the [Mesh Cognition SDK](https://github.com/sym-bot/mesh-cognition-sdk)'s `SemanticCoupler`.
 
@@ -135,7 +179,7 @@ await node.stop();
 
 ## Transport
 
-SYM supports two transport modes that can run simultaneously:
+SYM supports multiple transport layers that can run simultaneously:
 
 ### Bonjour (LAN)
 
@@ -143,7 +187,7 @@ Zero-configuration discovery on the local network. Peers find each other automat
 
 ### WebSocket Relay (Internet)
 
-For mesh cognition across the internet. A lightweight relay server forwards frames between authenticated nodes. The relay is dumb transport — all coupling decisions remain on-device.
+For mesh cognition across the internet. A lightweight relay server forwards frames between authenticated nodes. The relay is a **peer, not infrastructure** — it participates in the mesh with its own identity but makes no coupling decisions on behalf of other nodes.
 
 ```bash
 # Deploy your own relay
@@ -170,6 +214,23 @@ The relay server provides:
 - Peer join/leave notifications
 - Targeted or broadcast frame forwarding
 
+### Peer Gossip
+
+Wake channels propagate through the relay via **SWIM-style gossip**. When a node announces a wake channel (e.g., APNs device token), the relay gossips this to all connected peers. Peers cache wake routes so they can reach sleeping nodes without centralized routing tables. The relay participates in gossip as a peer — it doesn't manage routing, it just propagates what it hears.
+
+### Wake Transport (APNs)
+
+For nodes that sleep — like MeloTune on a backgrounded iPhone. When an iOS app is suspended, it can't maintain a WebSocket connection. SYM solves this with **push notification wake**.
+
+When Claude Code broadcasts a mood and MeloTune's iPhone is sleeping:
+1. Claude Code sends the mood frame to the relay
+2. The relay knows MeloTune's APNs device token (via gossip)
+3. The relay sends a push notification to wake MeloTune
+4. MeloTune wakes, reconnects to the relay, receives the mood frame
+5. The coupling engine evaluates drift — MeloTune decides whether to act
+
+The mesh reaches every node, even sleeping ones. No polling. No battery drain. The push is a wake signal only — payload evaluation happens on-device after wake.
+
 ## Integrations
 
 ### Claude Code
@@ -182,6 +243,8 @@ cd node_modules/@sym-bot/sym
 
 One command. Adds MCP server, auto-approves `sym_mood` (no permission prompts), and installs CLAUDE.md instructions for autonomous mood detection. Restart Claude Code and it just works.
 
+With sym-daemon running, Claude Code connects as a virtual node via IPC — no direct relay connection needed.
+
 **Outbound:** Claude Code saves a memory → SYM detects it → encodes cognitive state → shares with aligned peers only.
 
 **Inbound:** Peer memory arrives → coupling engine accepts it → SYM writes it to your Claude Code memory directory → Claude Code reads it in the next conversation.
@@ -237,7 +300,7 @@ You (in Claude Code):  "I'm exhausted"
 Claude Code:   detects fatigue → calls sym_mood silently
                → broadcasts "exhausted, persistently fatigued, urgently needs rest"
                     │
-               SYM mesh (Bonjour + Relay)
+               SYM mesh (daemon → Relay → APNs wake → MeloTune)
                     │
 MeloTune (iPhone):  SymNode receives mood frame
                     → SDK coupling engine evaluates drift: 0.62
@@ -267,10 +330,11 @@ You (in Telegram):  @sym_mesh_bot → "Play classic music"
 
 ## Verified in Production
 
-- Mac Claude Code → iPhone MeloTune — autonomous mood-based playback via SYM mesh
+- Mac Claude Code → iPhone MeloTune — autonomous mood-based playback via SYM mesh (APNs wake for backgrounded iOS)
 - Telegram [@sym_mesh_bot](https://t.me/sym_mesh_bot) → Relay → MeloTune — internet-scale mood relay (multi-tenant)
 - Mac Claude Code ↔ Windows Claude Code — P2P memory sharing via Bonjour
 - Node.js ↔ Swift — cross-platform mesh via Bonjour and WebSocket relay
+- sym-daemon → Claude Code + MeloTune Mac — persistent mesh via IPC, survives app restarts
 
 ## Semantic vs Neural Coupling
 
@@ -305,11 +369,13 @@ The coupling engine blends peer state into the local trajectory at each inferenc
 ## Privacy
 
 - All coupling decisions stay on-device
-- The relay is dumb transport — it never inspects frame payloads
+- The relay is a peer — it never inspects frame payloads
+- The daemon runs locally — no cloud dependency
 - Memories stored locally — delete the directory, everything is gone
 - Bonjour discovery only on local network
 - Relay connections authenticated via shared token
 - Rejected peers never receive your memories
+- APNs wake is a signal only — no payload leaves the device until the coupling engine approves
 - No cloud AI. No account. No telemetry.
 
 ## Platforms
@@ -321,7 +387,7 @@ The coupling engine blends peer state into the local trajectory at each inferenc
 
 SYM is the reference implementation of the [Mesh Memory Protocol (MMP)](https://sym.bot/protocol). MMP is the protocol for collective intelligence. SYM implements it.
 
-- [MMP Protocol Spec](https://sym.bot/protocol) — the protocol specification (v0.1.0)
+- [MMP Protocol Spec](https://sym.bot/protocol) — the protocol specification (v0.2.0)
 - [Whitepaper](https://sym.bot/research/mesh-cognition) — the science behind cognitive coupling
 - [Mesh Cognition SDK](https://github.com/sym-bot/mesh-cognition-sdk) — the coupling engine (TypeScript, Python, Swift)
 

package/bin/sym-daemon.js

@@ -0,0 +1,437 @@
+#!/usr/bin/env node
+'use strict';
+
+// ── EPIPE/EIO Safety (must be first — OpenClaw issue #4632) ────
+// launchd may close stdout/stderr pipes during restart. Without this,
+// Node.js throws uncaught EPIPE and enters a crash loop with exponential
+// throttle, causing hours-long outages.
+function suppressEpipe(stream) {
+  stream.on('error', (err) => {
+    if (err.code === 'EPIPE' || err.code === 'EIO') process.exit(0);
+    throw err;
+  });
+}
+suppressEpipe(process.stdout);
+suppressEpipe(process.stderr);
+
+/**
+ * sym-daemon — persistent physical mesh node for macOS/Linux.
+ *
+ * Runs as a background service (launchd LaunchAgent on macOS, systemd on Linux).
+ * Maintains relay connection, Bonjour discovery, peer state, and wake channels
+ * independently of any application. Virtual nodes (Claude Code, MeloTune Mac, etc.)
+ * connect via Unix socket IPC.
+ *
+ * MMP v0.2.0: The daemon IS the device's mesh presence.
+ *
+ * Usage:
+ *   sym-daemon                    # Run in foreground
+ *   sym-daemon --install          # Install as launchd LaunchAgent (macOS)
+ *   sym-daemon --uninstall        # Remove LaunchAgent
+ *   sym-daemon --status           # Show daemon status
+ *
+ * Copyright (c) 2026 SYM.BOT Ltd. Apache 2.0 License.
+ */
+
+const net = require('net');
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const { SymNode } = require('../lib/node');
+
+// ── Configuration ──────────────────────────────────────────────
+
+const SOCKET_PATH = process.env.SYM_SOCKET || '/tmp/sym.sock';
+const NODE_NAME = process.env.SYM_NODE_NAME || os.hostname().split('.')[0].toLowerCase();
+const LOG_DIR = path.join(os.homedir(), 'Library', 'Logs', 'sym-daemon');
+
+// Load relay config from ~/.sym/relay.env if env vars not set
+if (!process.env.SYM_RELAY_URL) {
+  const envFile = path.join(os.homedir(), '.sym', 'relay.env');
+  if (fs.existsSync(envFile)) {
+    for (const line of fs.readFileSync(envFile, 'utf8').split('\n')) {
+      const m = line.match(/^(\w+)=(.*)$/);
+      if (m && !process.env[m[1]]) process.env[m[1]] = m[2].trim();
+    }
+  }
+}
+
+const relayUrl = process.env.SYM_RELAY_URL || null;
+const relayToken = process.env.SYM_RELAY_TOKEN || null;
+
+// ── CLI Commands ───────────────────────────────────────────────
+
+const args = process.argv.slice(2);
+
+if (args.includes('--install')) {
+  installLaunchAgent();
+  process.exit(0);
+}
+
+if (args.includes('--uninstall')) {
+  uninstallLaunchAgent();
+  process.exit(0);
+}
+
+if (args.includes('--status')) {
+  showStatus();
+  process.exit(0);
+}
+
+// ── SYM Node ───────────────────────────────────────────────────
+
+const node = new SymNode({
+  name: NODE_NAME,
+  cognitiveProfile: `Physical mesh node for ${os.hostname()}. Routes frames between virtual nodes and the mesh.`,
+  relay: relayUrl,
+  relayToken: relayToken,
+  silent: false,
+});
+
+// ── IPC Server (Unix Socket) ───────────────────────────────────
+
+/** Connected virtual nodes. socketId → { socket, name, cognitiveProfile } */
+const virtualNodes = new Map();
+let nextSocketId = 1;
+
+function startIPCServer() {
+  // Clean up stale socket
+  if (fs.existsSync(SOCKET_PATH)) {
+    try { fs.unlinkSync(SOCKET_PATH); } catch {}
+  }
+
+  const server = net.createServer((socket) => {
+    const socketId = nextSocketId++;
+    let buffer = '';
+
+    socket.on('data', (data) => {
+      buffer += data.toString();
+      let idx;
+      while ((idx = buffer.indexOf('\n')) !== -1) {
+        const line = buffer.slice(0, idx);
+        buffer = buffer.slice(idx + 1);
+        if (line.trim()) {
+          try {
+            handleIPCMessage(socketId, socket, JSON.parse(line));
+          } catch (err) {
+            log(`IPC parse error: ${err.message}`);
+          }
+        }
+      }
+    });
+
+    socket.on('close', () => {
+      const vn = virtualNodes.get(socketId);
+      if (vn) {
+        log(`Virtual node disconnected: ${vn.name}`);
+        virtualNodes.delete(socketId);
+      }
+    });
+
+    socket.on('error', (err) => {
+      if (err.code !== 'EPIPE' && err.code !== 'ECONNRESET') {
+        log(`IPC socket error: ${err.message}`);
+      }
+      virtualNodes.delete(socketId);
+    });
+  });
+
+  server.listen(SOCKET_PATH, () => {
+    fs.chmodSync(SOCKET_PATH, 0o700);
+    log(`IPC server listening: ${SOCKET_PATH}`);
+  });
+
+  server.on('error', (err) => {
+    log(`IPC server error: ${err.message}`);
+    process.exit(1);
+  });
+
+  return server;
+}
+
+function handleIPCMessage(socketId, socket, msg) {
+  switch (msg.type) {
+    case 'register': {
+      virtualNodes.set(socketId, {
+        socket,
+        name: msg.name || `virtual-${socketId}`,
+        cognitiveProfile: msg.cognitiveProfile || null,
+      });
+      sendIPC(socket, {
+        type: 'registered',
+        nodeId: node._identity?.nodeId,
+        name: node.name,
+        relay: relayUrl,
+      });
+      log(`Virtual node registered: ${msg.name}`);
+      break;
+    }
+
+    case 'mood':
+      if (msg.mood) {
+        node.broadcastMood(msg.mood, { context: msg.context });
+        sendIPC(socket, { type: 'result', action: 'mood', peers: node.peers().length });
+      }
+      break;
+
+    case 'message':
+      if (msg.content) {
+        node.send(msg.content, msg.to ? { to: msg.to } : {});
+        sendIPC(socket, { type: 'result', action: 'message', peers: node.peers().length });
+      }
+      break;
+
+    case 'remember':
+      if (msg.content) {
+        const entry = node.remember(msg.content, { tags: msg.tags });
+        sendIPC(socket, { type: 'result', action: 'remember', key: entry.key });
+      }
+      break;
+
+    case 'recall': {
+      const results = node.recall(msg.query || '');
+      sendIPC(socket, { type: 'result', action: 'recall', results });
+      break;
+    }
+
+    case 'send':
+      if (msg.message) {
+        node.send(msg.message);
+        sendIPC(socket, { type: 'result', action: 'send', peers: node.peers().length });
+      }
+      break;
+
+    case 'peers':
+      sendIPC(socket, { type: 'result', action: 'peers', peers: node.peers() });
+      break;
+
+    case 'status':
+      sendIPC(socket, {
+        type: 'result',
+        action: 'status',
+        status: node.status(),
+        virtualNodes: Array.from(virtualNodes.values()).map(v => v.name),
+      });
+      break;
+
+    default:
+      log(`Unknown IPC message type: ${msg.type}`);
+  }
+}
+
+function sendIPC(socket, msg) {
+  try { socket.write(JSON.stringify(msg) + '\n'); } catch {}
+}
+
+/** Forward mesh events to all registered virtual nodes. */
+function forwardEventsToVirtualNodes() {
+  const events = [
+    ['mood-accepted', (d) => ({ type: 'event', event: 'mood-accepted', data: d })],
+    ['mood-rejected', (d) => ({ type: 'event', event: 'mood-rejected', data: d })],
+    ['peer-joined', (d) => ({ type: 'event', event: 'peer-joined', data: d })],
+    ['peer-left', (d) => ({ type: 'event', event: 'peer-left', data: d })],
+    ['coupling-decision', (d) => ({ type: 'event', event: 'coupling-decision', data: d })],
+  ];
+
+  for (const [event, formatter] of events) {
+    node.on(event, (data) => broadcastToVirtualNodes(formatter(data)));
+  }
+
+  node.on('message', (from, content) => {
+    broadcastToVirtualNodes({ type: 'event', event: 'message', data: { from, content } });
+  });
+
+  node.on('memory-received', ({ from, entry, decision }) => {
+    broadcastToVirtualNodes({ type: 'event', event: 'memory-received', data: { from, content: entry.content, decision } });
+  });
+}
+
+function broadcastToVirtualNodes(msg) {
+  const data = JSON.stringify(msg) + '\n';
+  for (const [id, vn] of virtualNodes) {
+    try { vn.socket.write(data); } catch { virtualNodes.delete(id); }
+  }
+}
+
+// ── launchd Install/Uninstall ──────────────────────────────────
+
+function launchAgentPlist() {
+  // Resolve node binary — prefer stable symlink over Cellar path
+  const nodePath = fs.existsSync('/opt/homebrew/bin/node')
+    ? '/opt/homebrew/bin/node'
+    : fs.existsSync('/usr/local/bin/node')
+      ? '/usr/local/bin/node'
+      : process.execPath;
+
+  const scriptPath = path.resolve(__dirname, 'sym-daemon.js');
+  const symDir = path.resolve(__dirname, '..');
+
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>bot.sym.daemon</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${nodePath}</string>
+    <string>${scriptPath}</string>
+  </array>
+  <key>WorkingDirectory</key>
+  <string>${symDir}</string>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>PATH</key>
+    <string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin</string>
+    <key>HOME</key>
+    <string>${os.homedir()}</string>
+    <key>NODE_ENV</key>
+    <string>production</string>
+  </dict>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>ThrottleInterval</key>
+  <integer>5</integer>
+  <key>ProcessType</key>
+  <string>Background</string>
+  <key>ExitTimeOut</key>
+  <integer>15</integer>
+  <key>StandardOutPath</key>
+  <string>${LOG_DIR}/stdout.log</string>
+  <key>StandardErrorPath</key>
+  <string>${LOG_DIR}/stderr.log</string>
+</dict>
+</plist>`;
+}
+
+function installLaunchAgent() {
+  if (process.platform !== 'darwin') {
+    console.error('--install is macOS only. On Linux, create a systemd service.');
+    process.exit(1);
+  }
+
+  const plistDir = path.join(os.homedir(), 'Library', 'LaunchAgents');
+  const plistPath = path.join(plistDir, 'bot.sym.daemon.plist');
+
+  // Ensure directories exist
+  if (!fs.existsSync(plistDir)) fs.mkdirSync(plistDir, { recursive: true });
+  if (!fs.existsSync(LOG_DIR)) fs.mkdirSync(LOG_DIR, { recursive: true });
+
+  // Write plist with correct permissions (644 — launchd rejects writable plists)
+  fs.writeFileSync(plistPath, launchAgentPlist(), { mode: 0o644 });
+  console.log(`Installed: ${plistPath}`);
+
+  // Load using modern launchctl API
+  const { execSync } = require('child_process');
+  const uid = process.getuid();
+  try { execSync(`launchctl bootout gui/${uid}/bot.sym.daemon 2>/dev/null`); } catch {}
+  execSync(`launchctl bootstrap gui/${uid} "${plistPath}"`);
+  console.log(`sym-daemon started. Logs: ${LOG_DIR}/`);
+  console.log('Check status: sym-daemon --status');
+}
+
+function uninstallLaunchAgent() {
+  if (process.platform !== 'darwin') {
+    console.error('--uninstall is macOS only.');
+    process.exit(1);
+  }
+
+  const plistPath = path.join(os.homedir(), 'Library', 'LaunchAgents', 'bot.sym.daemon.plist');
+  const { execSync } = require('child_process');
+
+  try { execSync(`launchctl bootout gui/${process.getuid()}/bot.sym.daemon`); } catch {}
+
+  if (fs.existsSync(plistPath)) {
+    fs.unlinkSync(plistPath);
+    console.log('sym-daemon uninstalled.');
+  } else {
+    console.log('sym-daemon is not installed.');
+  }
+
+  if (fs.existsSync(SOCKET_PATH)) {
+    try { fs.unlinkSync(SOCKET_PATH); } catch {}
+  }
+}
+
+function showStatus() {
+  if (!fs.existsSync(SOCKET_PATH)) {
+    console.log('sym-daemon: not running (no socket)');
+    return;
+  }
+
+  const client = net.createConnection(SOCKET_PATH, () => {
+    client.write(JSON.stringify({ type: 'status' }) + '\n');
+  });
+
+  let data = '';
+  client.on('data', (chunk) => {
+    data += chunk;
+    if (data.includes('\n')) {
+      try {
+        const msg = JSON.parse(data.split('\n')[0]);
+        if (msg.type === 'result' && msg.status) {
+          const s = msg.status;
+          console.log('sym-daemon: running');
+          console.log(`  node:     ${s.name} (${s.nodeId})`);
+          console.log(`  relay:    ${s.relayConnected ? 'connected' : 'disconnected'} (${s.relay || 'none'})`);
+          console.log(`  peers:    ${s.peerCount}`);
+          console.log(`  memories: ${s.memoryCount}`);
+          console.log(`  virtual:  ${(msg.virtualNodes || []).join(', ') || 'none'}`);
+          console.log(`  socket:   ${SOCKET_PATH}`);
+        }
+      } catch {}
+      client.end();
+    }
+  });
+
+  client.on('error', () => {
+    console.log('sym-daemon: socket exists but not responding');
+  });
+
+  setTimeout(() => client.destroy(), 3000);
+}
+
+// ── Logging ────────────────────────────────────────────────────
+
+function log(msg) {
+  const ts = new Date().toISOString().slice(11, 19);
+  console.log(`[${ts}] ${msg}`);
+}
+
+// ── Startup ────────────────────────────────────────────────────
+
+async function main() {
+  log(`sym-daemon starting: ${NODE_NAME}`);
+  log(`  relay: ${relayUrl || 'none'}`);
+  log(`  socket: ${SOCKET_PATH}`);
+
+  await node.start();
+  log(`SYM node started (${node._identity?.nodeId?.slice(0, 8)})`);
+
+  forwardEventsToVirtualNodes();
+
+  const ipcServer = startIPCServer();
+
+  log('sym-daemon ready');
+
+  // Graceful shutdown (launchd sends SIGTERM, then SIGKILL after ExitTimeOut)
+  const shutdown = () => {
+    log('Shutting down...');
+    node.stop();
+    ipcServer.close();
+    if (fs.existsSync(SOCKET_PATH)) {
+      try { fs.unlinkSync(SOCKET_PATH); } catch {}
+    }
+    process.exit(0);
+  };
+
+  process.on('SIGTERM', shutdown);
+  process.on('SIGINT', shutdown);
+}
+
+main().catch((err) => {
+  log(`Fatal: ${err.message}`);
+  process.exit(1);
+});