codehost 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 sno
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,112 @@
+# codehost
+
+Run VS Code on any machine and reach it from **codehost.dev** over a direct
+peer-to-peer **WebRTC** connection — no public ingress, no reverse proxy, no
+port forwarding. The daemon behind your NAT and the browser tab connect
+directly; a tiny Cloudflare Worker only brokers the handshake.
+
+```
+ Browser (codehost.dev)                          Your machine (codehost serve)
+ ┌──────────────────────────┐                    ┌──────────────────────────────┐
+ │ Discovery: list servers   │                    │ codehost CLI (yargs)          │
+ │ Service Worker: /vs/<id>/* │   WebRTC           │ node-datachannel peer         │
+ │ ─────────────────────────▶│◀═ data channel ══▶│ HTTP/WS proxy → code serve-web │
+ │ <iframe> VS Code           │                    │ in your project directory      │
+ └────────────┬─────────────┘                    └───────────────┬──────────────┘y -c
+              │ WebSocket (signaling)                             │ WebSocket (signaling)
+              └───────────────────► Cloudflare Worker + DO ◄──────┘
+                       per-token room: registry + SDP/ICE relay
+```
+
+## Quickstart
+
+On the machine you want to edit (needs the `code` CLI and [Bun](https://bun.sh)):
+
+```bash
+bunx codehost serve -d -t <token>
+```
+
+Then open **https://codehost.dev**, enter the same `<token>`, and your server
+appears in the list. Click **Connect** — VS Code loads in the page, served
+entirely over the peer-to-peer data channel.
+
+The `<token>` is a shared secret: anyone with it can see and connect to the
+servers in that room, so treat it like a password. It must be **at least 12
+characters, contain no whitespace, and mix at least 3 of {lowercase, uppercase,
+digits, symbols}** — the CLI, the web page, and the signaling Worker all reject
+weaker tokens (e.g. `Str0ng-Token-99`).
+
+## CLI
+
+```bash
+codehost serve [dir] -t <token> [options]   # serve a directory (default: cwd)
+codehost list                                # list daemonized servers (oxmgr)
+codehost stop <name>                         # stop a daemonized server
+```
+
+`serve` options:
+
+| flag | default | meaning |
+|------|---------|---------|
+| `-t, --token` | (required) | room token shared with the codehost.dev page |
+| `-d, --daemon` | `false` | run in the background under [oxmgr](https://www.npmjs.com/package/oxmgr) (auto-restart) |
+| `--name` | hostname | display name shown on the page |
+| `--signal` | `wss://signal.codehost.dev` | signaling server URL |
+| `--port` | ephemeral | fixed port for the local `code serve-web` |
+
+Daemon mode requires `oxmgr` (`npm i -g oxmgr`). Without `-d`, `serve` runs in
+the foreground and stops on Ctrl-C.
+
+## How it works
+
+1. **Signaling** — `worker/` is a Cloudflare Worker whose Durable Object hosts
+   one room per token. Daemons register their metadata; the page lists the
+   room's servers; the DO relays WebRTC offer/answer/ICE between them. STUN-only
+   (no TURN yet), so strict/symmetric NATs may not connect.
+2. **WebRTC** — the daemon uses `node-datachannel` (native, loaded via
+   `createRequire` so it resolves under Bun); the browser uses the standard
+   `RTCPeerConnection`. The browser is the offerer.
+3. **Tunnel** — `code serve-web` runs on `127.0.0.1` under base path
+   `/vs/<peerId>`. The browser Service Worker intercepts `/vs/<peerId>/*` and
+   forwards each HTTP request to the page, which ships it over the data channel;
+   the daemon (`src/cli/tunnel.ts`) replays it against the local VS Code server
+   and streams the response back. VS Code's WebSockets are routed the same way
+   via an injected `window.WebSocket` shim inside the iframe.
+
+## Development
+
+```bash
+bun install
+bun run dev          # web terminal scaffold (legacy) on :5173 + :3001
+bun run dev:signal   # signaling Worker locally (wrangler dev on :8787)
+bun run cli -- serve . -t test --signal ws://localhost:8787   # run the daemon
+bun run typecheck    # app + service worker + worker programs
+bun run build        # builds dist/public (app + /sw.js)
+```
+
+In local dev the page (on `localhost`) auto-targets `ws://localhost:8787`;
+override the signaling URL anytime via `localStorage["codehost.signal"]`.
+
+## Deploy
+
+```bash
+bun run deploy:signal   # cd worker && wrangler deploy   (Durable Object signaling)
+bun run deploy:pages    # vite build && wrangler pages deploy dist/public --project-name codehost
+```
+
+The signaling Worker is bound to a `signal.` subdomain of the zone; the page is
+the `codehost` Pages project on the `codehost.dev` custom domain (Cloudflare
+account `SNOLAB`). After deploying the Worker the first time, add its
+`signal.codehost.dev` custom-domain route (commented in `worker/wrangler.jsonc`).
+
+## Status / limitations
+
+- Verified live end-to-end across two networks: a daemon behind one NAT and a
+  browser on `codehost.dev` (another network) connect over STUN, the VS Code
+  workbench loads in the iframe, the Explorer lists the real workspace, and
+  files open in the editor — all HTTP + WebSocket traffic over the data channel.
+- Data-channel frames are capped at 16 KiB (the portable WebRTC limit); HTTP
+  bodies and WebSocket messages larger than that are fragmented and reassembled
+  (`src/shared/protocol.ts`).
+- STUN-only: add Cloudflare Realtime TURN for strict/symmetric-NAT reachability.
+- Token = bearer auth for now; no per-user identity yet.

package/index.html

@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>Codehost</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.tsx"></script>
+  </body>
+</html>

package/package.json

@@ -0,0 +1,50 @@
+{
+  "name": "codehost",
+  "version": "0.1.0",
+  "type": "module",
+  "bin": {
+    "codehost": "./src/cli/index.ts"
+  },
+  "scripts": {
+    "dev": "concurrently \"bun run dev:server\" \"vite --port 5173\"",
+    "dev:server": "bun --watch src/server.ts",
+    "dev:signal": "cd worker && wrangler dev",
+    "cli": "bun src/cli/index.ts",
+    "build": "vite build && vite build --config vite.sw.config.ts",
+    "deploy:signal": "cd worker && wrangler deploy",
+    "deploy:pages": "vite build && wrangler pages deploy dist/public --project-name codehost",
+    "start": "bun src/server.ts",
+    "typecheck": "tsc --noEmit && tsc --noEmit -p src/web/tsconfig.sw.json && tsc --noEmit -p worker/tsconfig.json"
+  },
+  "dependencies": {
+    "@xterm/addon-clipboard": "^0.2.0",
+    "@xterm/addon-fit": "^0.11.0",
+    "@xterm/addon-search": "^0.15.0",
+    "@xterm/addon-unicode11": "^0.9.0",
+    "@xterm/addon-web-links": "^0.11.0",
+    "@xterm/headless": "^6.0.0",
+    "@xterm/xterm": "^6.0.0",
+    "bun-pty": "^0.4.8",
+    "hono": "^4.12.16",
+    "node-datachannel": "^0.32.3",
+    "react": "^19.1.1",
+    "react-dom": "^19.1.1",
+    "yargs": "^17.7.2"
+  },
+  "devDependencies": {
+    "@types/bun": "^1.3.0",
+    "@types/react": "^19.1.9",
+    "@types/react-dom": "^19.1.7",
+    "@types/yargs": "^17.0.33",
+    "@cloudflare/workers-types": "^4.20250101.0",
+    "wrangler": "^4.95.0",
+    "@vitejs/plugin-react": "^6.0.1",
+    "concurrently": "^9.2.1",
+    "portless": "^0.12.0",
+    "typescript": "^5",
+    "vite": "^8.0.10"
+  },
+  "trustedDependencies": [
+    "node-datachannel"
+  ]
+}

package/portless.json

@@ -0,0 +1,3 @@
+{
+  "name": "codehost"
+}

package/src/App.tsx

@@ -0,0 +1,93 @@
+import { useState } from "react";
+import { Terminal } from "./components/Terminal";
+
+export function App() {
+  const [cwd, setCwd] = useState(() => {
+    const params = new URLSearchParams(window.location.search);
+    return params.get("cwd") ?? "/";
+  });
+
+  return (
+    <div style={{ display: "flex", flexDirection: "column", height: "100%", background: "#1f1f1f" }}>
+      <header
+        style={{
+          display: "flex",
+          alignItems: "center",
+          gap: 8,
+          padding: "6px 12px",
+          background: "#2d2d2d",
+          borderBottom: "1px solid #3d3d3d",
+          flexShrink: 0,
+        }}
+      >
+        <span style={{ color: "#cccccc", fontFamily: "monospace", fontSize: 13, fontWeight: 600 }}>
+          codehost
+        </span>
+        <span style={{ color: "#888", fontSize: 12 }}>|</span>
+        <CwdInput cwd={cwd} onChange={setCwd} />
+      </header>
+      <Terminal wsUrl="/ws" cwd={cwd} onCwdChange={setCwd} style={{ flex: 1, minHeight: 0 }} />
+    </div>
+  );
+}
+
+function CwdInput({ cwd, onChange }: { cwd: string; onChange: (cwd: string) => void }) {
+  const [editing, setEditing] = useState(false);
+  const [draft, setDraft] = useState(cwd);
+
+  if (editing) {
+    return (
+      <form
+        onSubmit={(e) => {
+          e.preventDefault();
+          onChange(draft);
+          setEditing(false);
+        }}
+        style={{ flex: 1 }}
+      >
+        <input
+          autoFocus
+          value={draft}
+          onChange={(e) => setDraft(e.target.value)}
+          onBlur={() => setEditing(false)}
+          onKeyDown={(e) => e.key === "Escape" && setEditing(false)}
+          style={{
+            width: "100%",
+            background: "#1f1f1f",
+            border: "1px solid #555",
+            color: "#ccc",
+            fontFamily: "monospace",
+            fontSize: 12,
+            padding: "2px 6px",
+            borderRadius: 3,
+            outline: "none",
+          }}
+        />
+      </form>
+    );
+  }
+
+  return (
+    <button
+      onClick={() => { setDraft(cwd); setEditing(true); }}
+      title="Click to change directory"
+      style={{
+        background: "none",
+        border: "none",
+        cursor: "pointer",
+        color: "#888",
+        fontFamily: "monospace",
+        fontSize: 12,
+        padding: "2px 4px",
+        borderRadius: 3,
+        textAlign: "left",
+        maxWidth: 500,
+        overflow: "hidden",
+        textOverflow: "ellipsis",
+        whiteSpace: "nowrap",
+      }}
+    >
+      {cwd}
+    </button>
+  );
+}

package/src/cli/commands/list.ts

@@ -0,0 +1,11 @@
+import type { CommandModule } from "yargs";
+import { listDaemons } from "../oxmgr";
+
+export const listCommand: CommandModule = {
+  command: "list",
+  aliases: ["ls"],
+  describe: "List codehost servers running under oxmgr",
+  handler: () => {
+    process.exit(listDaemons());
+  },
+};

package/src/cli/commands/serve.ts

@@ -0,0 +1,153 @@
+import { hostname } from "node:os";
+import { resolve } from "node:path";
+import type { CommandModule } from "yargs";
+import { type PeerMeta, newPeerId } from "../../shared/signaling";
+import { TOKEN_REQUIREMENTS, validateToken } from "../../shared/token";
+import { SignalingClient } from "../../shared/signaling-client";
+import { RtcDaemon } from "../rtc-daemon";
+import { launchVscode } from "../vscode";
+import { Tunnel } from "../tunnel";
+import { daemonName, startDaemon } from "../oxmgr";
+
+export const DEFAULT_SIGNAL_URL = "wss://signal.codehost.dev";
+
+interface ServeArgs {
+  dir: string;
+  token: string;
+  name?: string;
+  signal: string;
+  daemon: boolean;
+  port?: number;
+}
+
+export const serveCommand: CommandModule<{}, ServeArgs> = {
+  command: "serve [dir]",
+  describe: "Serve VS Code from a directory and peer it to codehost.dev over WebRTC",
+  builder: (y) =>
+    y
+      .positional("dir", {
+        describe: "Directory to serve (defaults to cwd)",
+        type: "string",
+        default: ".",
+      })
+      .option("token", {
+        alias: "t",
+        describe: "Room token shared with the codehost.dev page",
+        type: "string",
+        demandOption: true,
+      })
+      .option("name", {
+        describe: "Display name for this server (defaults to hostname)",
+        type: "string",
+      })
+      .option("signal", {
+        describe: "Signaling server URL",
+        type: "string",
+        default: DEFAULT_SIGNAL_URL,
+      })
+      .option("daemon", {
+        alias: "d",
+        describe: "Run in the background under oxmgr",
+        type: "boolean",
+        default: false,
+      })
+      .option("port", {
+        describe: "Fixed port for the local VS Code server (default: ephemeral)",
+        type: "number",
+      }) as any,
+  handler: async (argv) => {
+    argv.token = argv.token.trim();
+    const check = validateToken(argv.token);
+    if (!check.ok) {
+      console.error(`[codehost] ${check.reason}`);
+      console.error(`[codehost] room token requires: ${TOKEN_REQUIREMENTS}`);
+      process.exit(1);
+    }
+
+    const dir = resolve(process.cwd(), argv.dir);
+    const host = hostname();
+    const meta: PeerMeta = {
+      name: argv.name ?? host,
+      cwd: dir,
+      host,
+    };
+
+    // `-d`: re-launch this same `serve` (without -d) under oxmgr, then exit.
+    if (argv.daemon) {
+      const label = argv.name ?? dir.split("/").pop() ?? host;
+      const name = daemonName(label);
+      const command = buildForegroundCommand(dir, argv);
+      console.log(`[codehost] starting daemon "${name}" via oxmgr`);
+      const ok = startDaemon({ name, command, cwd: dir });
+      if (ok) {
+        console.log(`[codehost] daemon started. View: codehost list · Stop: codehost stop ${name}`);
+        process.exit(0);
+      }
+      process.exit(1);
+    }
+
+    // peerId is fixed up front so VS Code can be mounted under /vs/<peerId>,
+    // which the browser Service Worker uses to route requests to this daemon.
+    const peerId = newPeerId();
+    const basePath = `/vs/${peerId}`;
+
+    console.log(`[codehost] serving ${dir}`);
+    console.log(`[codehost] room token: ${argv.token}`);
+    console.log(`[codehost] signaling:  ${argv.signal}`);
+
+    const vscode = await launchVscode({ dir, basePath, port: argv.port });
+
+    let rtc: RtcDaemon;
+
+    const client = new SignalingClient({
+      url: argv.signal,
+      token: argv.token,
+      role: "server",
+      peerId,
+      meta,
+      onOpen: () => console.log(`[codehost] registered as "${meta.name}" (${peerId.slice(0, 8)})`),
+      onClose: () => console.log("[codehost] disconnected from signaling, reconnecting…"),
+      onSignal: (from, data) => rtc.handleSignal(from, data),
+    });
+
+    rtc = new RtcDaemon({
+      sendSignal: (to, data) => client.sendSignal(to, data),
+      // Each viewer's data channel is bridged to the local VS Code server.
+      onChannel: (viewerId, channel) => {
+        console.log(`[codehost] viewer ${viewerId.slice(0, 8)} connected; bridging to VS Code`);
+        new Tunnel(channel, vscode.port);
+      },
+    });
+
+    client.connect();
+
+    const shutdown = () => {
+      console.log("\n[codehost] shutting down");
+      rtc.closeAll();
+      client.close();
+      vscode.stop();
+      process.exit(0);
+    };
+    process.on("SIGINT", shutdown);
+    process.on("SIGTERM", shutdown);
+
+    // Keep the process alive.
+    await new Promise<never>(() => {});
+  },
+};
+
+/**
+ * Reconstruct the exact foreground `serve` invocation (without -d) for oxmgr to
+ * run. Uses the same runtime + entry script that launched us, so it works both
+ * for `bunx codehost` and local `bun src/cli/index.ts`.
+ */
+function buildForegroundCommand(dir: string, argv: ServeArgs): string {
+  const parts = [process.execPath, process.argv[1], "serve", dir, "-t", argv.token, "--signal", argv.signal];
+  if (argv.name) parts.push("--name", argv.name);
+  if (argv.port) parts.push("--port", String(argv.port));
+  return parts.map(quote).join(" ");
+}
+
+function quote(s: string): string {
+  return /[^A-Za-z0-9_\/:=.-]/.test(s) ? `'${s.replace(/'/g, `'\\''`)}'` : s;
+}

package/src/cli/commands/stop.ts

@@ -0,0 +1,20 @@
+import type { CommandModule } from "yargs";
+import { stopDaemon } from "../oxmgr";
+
+interface StopArgs {
+  name: string;
+}
+
+export const stopCommand: CommandModule<{}, StopArgs> = {
+  command: "stop <name>",
+  describe: "Stop a daemonized codehost server (name from `codehost list`)",
+  builder: (y) =>
+    y.positional("name", {
+      describe: "Daemon name, e.g. codehost-myproject (or just the label)",
+      type: "string",
+      demandOption: true,
+    }) as any,
+  handler: (argv) => {
+    process.exit(stopDaemon(argv.name));
+  },
+};

package/src/cli/index.ts

@@ -0,0 +1,19 @@
+#!/usr/bin/env bun
+import yargs from "yargs";
+import { hideBin } from "yargs/helpers";
+import { serveCommand } from "./commands/serve";
+import { listCommand } from "./commands/list";
+import { stopCommand } from "./commands/stop";
+
+yargs(hideBin(process.argv))
+  .scriptName("codehost")
+  .usage("$0 <command> [options]")
+  .command(serveCommand)
+  .command(listCommand)
+  .command(stopCommand)
+  .demandCommand(1, "Specify a command, e.g. `codehost serve`")
+  .strict()
+  .help()
+  .alias("h", "help")
+  .version()
+  .parse();

package/src/cli/oxmgr.ts

@@ -0,0 +1,64 @@
+import { spawnSync } from "node:child_process";
+
+// Thin wrapper around the `oxmgr` process manager (https://npmjs.com/package/oxmgr).
+// `codehost serve -d` re-launches the foreground `serve` under oxmgr so it
+// survives the shell and restarts on failure.
+
+export function hasOxmgr(): boolean {
+  const r = spawnSync("oxmgr", ["--version"], { stdio: "ignore" });
+  return r.status === 0;
+}
+
+const MISSING_MSG =
+  "[codehost] oxmgr not found. Install it with `npm i -g oxmgr` (or `bun add -g oxmgr`), then retry with -d.";
+
+/** Process name oxmgr will track this server under. */
+export function daemonName(label: string): string {
+  const slug = label.replace(/[^a-zA-Z0-9_-]+/g, "-").replace(/^-+|-+$/g, "").toLowerCase();
+  return `codehost-${slug || "server"}`;
+}
+
+export interface DaemonizeOptions {
+  name: string; // oxmgr process name
+  command: string; // full inline command oxmgr should run (the foreground serve)
+  cwd: string;
+}
+
+/** Start the foreground serve under oxmgr. Returns false if oxmgr is missing. */
+export function startDaemon(opts: DaemonizeOptions): boolean {
+  if (!hasOxmgr()) {
+    console.error(MISSING_MSG);
+    return false;
+  }
+  // Replace any previous instance with the same name.
+  spawnSync("oxmgr", ["delete", opts.name], { stdio: "ignore" });
+
+  const r = spawnSync(
+    "oxmgr",
+    ["start", opts.command, "--name", opts.name, "--cwd", opts.cwd, "--restart", "on-failure"],
+    { stdio: "inherit" },
+  );
+  return r.status === 0;
+}
+
+/** `codehost list` -> oxmgr's process table. */
+export function listDaemons(): number {
+  if (!hasOxmgr()) {
+    console.error(MISSING_MSG);
+    return 1;
+  }
+  const r = spawnSync("oxmgr", ["list"], { stdio: "inherit" });
+  return r.status ?? 0;
+}
+
+/** `codehost stop <name>` -> stop + delete the oxmgr process. */
+export function stopDaemon(name: string): number {
+  if (!hasOxmgr()) {
+    console.error(MISSING_MSG);
+    return 1;
+  }
+  const full = name.startsWith("codehost-") ? name : daemonName(name);
+  spawnSync("oxmgr", ["stop", full], { stdio: "inherit" });
+  const r = spawnSync("oxmgr", ["delete", full], { stdio: "inherit" });
+  return r.status ?? 0;
+}

package/src/cli/rtc-daemon.ts

@@ -0,0 +1,115 @@
+import { createRequire } from "node:module";
+import type {
+  DataChannel,
+  PeerConnection as PeerConnectionT,
+} from "node-datachannel";
+import { ICE_SERVERS, type RtcSignal } from "../shared/rtc";
+
+// node-datachannel is a native addon. Under Bun, the ESM `import` resolves the
+// package to the global cache (where the prebuilt .node isn't), but `require`
+// resolves correctly from the project's node_modules. So load it via require;
+// the `import type` above is erased at build time and triggers no runtime load.
+const require = createRequire(import.meta.url);
+const ndc = require("node-datachannel") as typeof import("node-datachannel");
+
+export interface RtcDaemonOptions {
+  /** Relay a signal to a viewer peer via the signaling channel. */
+  sendSignal: (to: string, data: RtcSignal) => void;
+  /** Called when a viewer's data channel opens. */
+  onChannel: (viewerId: string, channel: DataChannel) => void;
+}
+
+interface ViewerConn {
+  pc: PeerConnectionT;
+}
+
+/**
+ * Daemon-side WebRTC manager. The browser (viewer) is the offerer; for each
+ * viewer that sends an offer we create an answering PeerConnection and surface
+ * its data channel. STUN-only.
+ */
+export class RtcDaemon {
+  private viewers = new Map<string, ViewerConn>();
+
+  constructor(private opts: RtcDaemonOptions) {}
+
+  /** Route an inbound signaling payload from a viewer. */
+  handleSignal(from: string, data: unknown): void {
+    const sig = data as RtcSignal;
+    if (!sig || typeof sig !== "object") return;
+
+    if (sig.kind === "offer") {
+      this.acceptOffer(from, sig.sdp);
+    } else if (sig.kind === "candidate") {
+      const conn = this.viewers.get(from);
+      if (conn) {
+        try {
+          conn.pc.addRemoteCandidate(sig.candidate, sig.mid);
+        } catch (err) {
+          console.error(`[rtc] addRemoteCandidate failed for ${from.slice(0, 8)}:`, err);
+        }
+      }
+    }
+  }
+
+  private acceptOffer(viewerId: string, sdp: string): void {
+    // Replace any prior connection for this viewer (e.g. page reload).
+    this.dropViewer(viewerId);
+
+    const pc = new ndc.PeerConnection(`viewer-${viewerId.slice(0, 8)}`, {
+      iceServers: ICE_SERVERS,
+    });
+    this.viewers.set(viewerId, { pc });
+
+    pc.onLocalDescription((localSdp, type) => {
+      this.opts.sendSignal(viewerId, {
+        kind: type as "answer",
+        type: type as "answer",
+        sdp: localSdp,
+      });
+    });
+
+    pc.onLocalCandidate((candidate, mid) => {
+      this.opts.sendSignal(viewerId, { kind: "candidate", candidate, mid });
+    });
+
+    pc.onStateChange((state) => {
+      console.log(`[rtc] ${viewerId.slice(0, 8)} state: ${state}`);
+      if (state === "disconnected" || state === "failed" || state === "closed") {
+        this.dropViewer(viewerId);
+      }
+    });
+
+    pc.onDataChannel((dc) => {
+      console.log(`[rtc] ${viewerId.slice(0, 8)} channel "${dc.getLabel()}" open`);
+      this.opts.onChannel(viewerId, dc);
+    });
+
+    try {
+      pc.setRemoteDescription(sdp, "offer");
+    } catch (err) {
+      console.error(`[rtc] setRemoteDescription failed for ${viewerId.slice(0, 8)}:`, err);
+      this.dropViewer(viewerId);
+    }
+  }
+
+  private dropViewer(viewerId: string): void {
+    const conn = this.viewers.get(viewerId);
+    if (!conn) return;
+    this.viewers.delete(viewerId);
+    try {
+      conn.pc.close();
+    } catch {
+      // ignore
+    }
+  }
+
+  closeAll(): void {
+    for (const id of [...this.viewers.keys()]) this.dropViewer(id);
+    try {
+      ndc.cleanup();
+    } catch {
+      // ignore
+    }
+  }
+}