luang-cli 0.2.0 → 0.3.0

package/lib/commands.js

@@ -94,6 +94,61 @@ function permLine(label, val) {
   return `${val ? '✅' : '❌'} ${label}`;
 }
 
+// ── Telemetry (konsent ganda: lokal config + flag server) ────────────────────
+
+// Label satu baris status konsent ganda. serverOn: true/false/null (tak tahu).
+function telemetryConsentLabel(localOn, serverOn) {
+  const l = localOn ? 'lokal ✅' : 'lokal ❌';
+  const s = serverOn === true ? 'server ✅' : serverOn === false ? 'server ❌' : 'server ?';
+  const on = localOn && serverOn === true;
+  return `${l} · ${s} → efektif ${on ? '✅ DIKIRIM' : '❌ tidak dikirim'}`;
+}
+
+async function cmdTelemetry(rt, args) {
+  const sub = String(args.pos[1] || 'status').toLowerCase();
+  if (sub === 'on') {
+    rt.cfg.telemetry = true;
+    saveConfig(rt.cfg);
+    console.log('✅ Telemetry lokal: ON (config.json telemetry=true)');
+    console.log('⚡ Kirim hanya setelah flag server ikut ON (wajib dua-duanya).');
+  } else if (sub === 'off') {
+    rt.cfg.telemetry = false;
+    saveConfig(rt.cfg);
+    console.log('✅ Telemetry lokal: OFF');
+    console.log('🤐 Data run (telemetry.run) TIDAK akan dikirim dari mesin ini.');
+  } else if (sub !== 'status') {
+    return errExit('Pemakaian: luang-cli telemetry on|off|status');
+  }
+
+  // Flag server: agent_keys.telemetry_enabled (diubah dari dashboard).
+  let serverOn = null;
+  let note = null;
+  if (rt.key) {
+    try {
+      const me = await apiRequest(rt, 'GET', '/api/v1/agent/me');
+      serverOn = ((me && me.data) || {}).telemetry_enabled === true;
+    } catch (e) {
+      note = e.message;
+    }
+  } else {
+    note = 'belum login — flag server tidak bisa diperiksa (luang-cli login)';
+  }
+
+  console.log('');
+  console.log('📊 Telemetry — konsent ganda (opt-in, bukan opt-out)');
+  console.log(`   Lokal  : config.telemetry = ${rt.cfg.telemetry === true ? 'true ✅' : 'false ❌'} (${CONFIG_FILE})`);
+  if (serverOn === null) console.log(`   Server : ? — ${note || 'gagal cek /api/v1/agent/me'}`);
+  else console.log(`   Server : telemetry_enabled = ${serverOn ? 'true ✅' : 'false ❌'} (Agents → toggle Telemetry di dashboard)`);
+  console.log(`   Efektif: ${telemetryConsentLabel(rt.cfg.telemetry === true, serverOn)}`);
+  console.log('');
+  if (rt.cfg.telemetry === true && serverOn !== true) {
+    console.log('ℹ️  Bebannya harus ON bersamaan: lokal di sini, server di dashboard.');
+  }
+  console.log('🔐 Kirim pakai header X-CLI-Key (bukan JWT) via frame WS telemetry.run.');
+  console.log('   Bila salah satu OFF → CLI tidak mengirim apa pun (dan server pun men-drop).');
+  return 0;
+}
+
 // ── login (device flow) ──────────────────────────────────────────────────────
 
 async function cmdLogin(rt, args) {
@@ -222,6 +277,9 @@ async function cmdWhoami(rt) {
   console.log(`   ${permLine('Bisa update tugas  (can_update_tasks)', !!d.can_update_tasks)}`);
   console.log(`   ${permLine('Bisa buat tugas    (can_create_tasks)', !!d.can_create_tasks)}`);
   console.log('');
+  console.log(`📊 Telemetry: ${telemetryConsentLabel(rt.cfg.telemetry === true, d.telemetry_enabled === true)}`);
+  console.log('   (ubah lokal: luang-cli telemetry on|off · flag server: dashboard Agents)');
+  console.log('');
   console.log(`🛠  Provider terdaftar (server): ${providersLabel(d.providers)}`);
   return 0;
 }
@@ -260,22 +318,24 @@ async function cmdProvider(rt, args) {
       return 0;
     }
     printTable(
-      ['Provider', 'Path', 'Exec Template'],
+      ['Provider', 'Path', 'Exec Template', 'Model'],
       list.map((p) => [
         (p.is_default ? '★ ' : '') + p.provider_type,
         p.path || '-',
         p.exec_template || '-',
+        p.model || '-',
       ])
     );
     console.log('');
     console.log('★ = default provider · deteksi: ~/.claude, ~/.codex, ~/.config/opencode/~/.opencode, ~/.gemini + which(1)');
+    console.log('   {model} di exec_template diisi dari kolom Model (atau env LUANG_MODEL) saat mode --exec.');
     await syncIfKey(rt);
     return 0;
   }
 
   if (sub === 'add') {
     const type = args.pos[2];
-    if (!type) return errExit('Format: luang-cli provider add <type> [--path P] [--exec_template T]', `type: ${PROVIDER_TYPES.join(', ')}`);
+    if (!type) return errExit('Format: luang-cli provider add <type> [--path P] [--exec_template T] [--model M]', `type: ${PROVIDER_TYPES.join(', ')}`);
     if (!PROVIDER_TYPES.includes(type)) return errExit(`Tipe tidak dikenal: ${type}`, `Pilihan: ${PROVIDER_TYPES.join(', ')}`);
     const existing = collectProviders(rt.cfg).find((p) => p.provider_type === type) || {};
     const tPath = flags.path && flags.path !== true ? String(flags.path) : existing.path || null;
@@ -283,16 +343,22 @@ async function cmdProvider(rt, args) {
       flags.exec_template && flags.exec_template !== true
         ? String(flags.exec_template)
         : existing.exec_template || DEFAULT_TEMPLATES[type] || null;
+    let tModel = flags.model && flags.model !== true ? String(flags.model).trim() : existing.model || null;
+    if (tModel && !/^[\w.:+/-]+$/.test(tModel)) {
+      return errExit(`--model tidak valid: ${tModel}`, 'Karakter yang diizinkan: huruf, angka, `.` `_` `:` `+` `-` `/`');
+    }
     rt.cfg.providers[type] = {
       provider_type: type,
       display_name: DISPLAY_NAMES[type] || type,
       path: tPath,
       exec_template: tTpl,
+      ...(tModel ? { model: tModel } : {}),
     };
     saveConfig(rt.cfg);
     console.log(`➕ Provider ${type} tersimpan di config:`);
     console.log(`   Path          : ${tPath || '-'}`);
     console.log(`   Exec Template : ${tTpl || '-'}`);
+    if (tModel) console.log(`   Model         : ${tModel}`);
     if (!tTpl || !tTpl.includes('{task}')) {
       console.log('⚠️  Exec template tanpa {task} — tugas tidak bisa dieksekusi otomatis.');
     }
@@ -334,4 +400,4 @@ async function cmdProvider(rt, args) {
   return errExit(`Sub-command provider tidak dikenal: ${sub}`, 'Gunakan: list | add | remove | default');
 }
 
-module.exports = { cmdLogin, cmdLogout, cmdWhoami, cmdProvider, errExit, authFailMessage, taskIdOf, statusInputNorm, normalizeTaskList, ask, providersLabel, syncIfKey, permLine };
+module.exports = { cmdLogin, cmdLogout, cmdWhoami, cmdTelemetry, cmdProvider, errExit, authFailMessage, taskIdOf, statusInputNorm, normalizeTaskList, ask, providersLabel, syncIfKey, permLine, telemetryConsentLabel };

package/lib/core.js

@@ -20,6 +20,14 @@ const DEFAULT_CONFIG = {
   key: null,
   default_provider: null,
   providers: {},
+  // Telemetry konsent (lihat docs/agent-realtime-ws.md):
+  //   false = jangan kirim apa pun. Kirim hanya bila ini true DAN server flag
+  //   telemetry_enabled=true (dari GET /agent/me / hello.ok WS).
+  telemetry: false,
+  // Opsional: jumlah token diisi manual saat exec (jika user tahu) — hanya
+  // ikut dikirim bila consent aktif; selain itu biarkan null.
+  tokens_in: null,
+  tokens_out: null,
 };
 
 // ── Config ───────────────────────────────────────────────────────────────────

package/lib/ws.js

@@ -0,0 +1,552 @@
+'use strict';
+
+// lib/ws.js — klien WebSocket (RFC 6455) minimal TANPA dependensi (Node >= 18).
+// Dipakai daemon `luang-cli agent` untuk mode realtime. Cakupan kecil namun solid:
+//   • handshake GET ws://|wss://… (path + headers, mis. X-CLI-Key) + verifikasi Sec-WebSocket-Accept
+//   • semua frame client→server SELALU dimask (wajib RFC); pesan berupa teks (JSON)
+//   • baca: text/continuation (join fragmentasi), ping→pong otomatis, pong, close
+//   • keepalive: ping berkala + deteksi koneksi mati (tidak ada frame masuk)
+//   • auto-reconnect eksponensial 1s→30s (dengan jitter); close beres saat diminta
+//   • batas pesan 1 MB (masuk maupun keluar)
+// Tidak diimplementasikan: permessage-deflate, subprotocol, TLS opsi lanjutan.
+
+const { EventEmitter } = require('events');
+const crypto = require('crypto');
+const net = require('net');
+const tls = require('tls');
+
+const WS_GUID = '258EAFA5-E914-47DA-95CA-C5AB0DC85B11';
+const MAX_PAYLOAD = 1024 * 1024; // 1 MB per pesan
+const HS_MAX_HEAD = 16384;       // batas header respons handshake
+const CONNECT_TIMEOUT_MS = 10000;
+const PING_INTERVAL_MS = 25000;  // ping keepalive klien
+const DEAD_AFTER_MS = 75000;     // tanpa frame masuk (incl. pong) → koneksi dianggap mati
+const BASE_BACKOFF_MS = 1000;
+const MAX_BACKOFF_MS = 30000;
+const CLOSE_TIMEOUT_MS = 1500;
+
+const OP = { CONT: 0, TEXT: 1, BINARY: 2, CLOSE: 8, PING: 9, PONG: 10 };
+
+// ── Util ─────────────────────────────────────────────────────────────────────
+
+function wsTarget(url) {
+  let u;
+  try {
+    u = new URL(String(url));
+  } catch (e) {
+    throw new Error(`URL WebSocket tidak valid: ${url}`);
+  }
+  const secure = u.protocol === 'wss:' || u.protocol === 'https:';
+  if (!secure && u.protocol !== 'ws:' && u.protocol !== 'http:') {
+    throw new Error(`Skema WebSocket tidak didukung: ${u.protocol}`);
+  }
+  return {
+    host: u.hostname,
+    port: u.port ? Number(u.port) : secure ? 443 : 80,
+    path: (u.pathname || '/') + (u.search || ''),
+    secure,
+  };
+}
+
+function acceptKey(key) {
+  return crypto.createHash('sha1').update(String(key) + WS_GUID).digest('base64');
+}
+
+function encodeClosePayload(code, reason) {
+  const r = Buffer.from(String(reason || '').slice(0, 100), 'utf8');
+  const out = Buffer.allocUnsafe(2 + r.length);
+  out.writeUInt16BE((code || 1000) & 0xffff, 0);
+  r.copy(out, 2);
+  return out;
+}
+
+// Buat frame client→server: FIN + opcode + MASK (wajib) + payload termask.
+function encodeFrame(opcode, payload) {
+  const len = payload.length;
+  let header;
+  if (len < 126) {
+    header = Buffer.allocUnsafe(2);
+    header[1] = 0x80 | len;
+  } else if (len < 65536) {
+    header = Buffer.allocUnsafe(4);
+    header[1] = 0x80 | 126;
+    header.writeUInt16BE(len, 2);
+  } else {
+    header = Buffer.allocUnsafe(10);
+    header[1] = 0x80 | 127;
+    header.writeBigUInt64BE(BigInt(len), 2);
+  }
+  header[0] = 0x80 | opcode;
+  const mask = crypto.randomBytes(4);
+  const body = Buffer.from(payload);
+  for (let i = 0; i < body.length; i++) body[i] ^= mask[i & 3];
+  return Buffer.concat([header, mask, body]);
+}
+
+// Ambil satu frame dari buffer. null = data belum lengkap; {error} = protocol error.
+function extractFrame(buf) {
+  if (!buf || buf.length < 2) return null;
+  const b0 = buf[0];
+  const b1 = buf[1];
+  const fin = (b0 & 0x80) !== 0;
+  const opcode = b0 & 0x0f;
+  if (b0 & 0x70) return { error: new Error('Bit RSV ter-set tanpa ekstensi (RFC 6455)' + b0) };
+  const masked = (b1 & 0x80) !== 0;
+  let len = b1 & 0x7f;
+  let off = 2;
+  if (len === 126) {
+    if (buf.length < 4) return null;
+    len = buf.readUInt16BE(2);
+    off = 4;
+  } else if (len === 127) {
+    if (buf.length < 10) return null;
+    const big = buf.readBigUInt64BE(2);
+    len = Number(big);
+    off = 10;
+  }
+  if (len > MAX_PAYLOAD || !Number.isFinite(len)) return { error: new Error('Pesan melebihi batas 1 MB') };
+  const maskLen = masked ? 4 : 0;
+  const total = off + maskLen + len;
+  if (buf.length < total) return null;
+  const payload = Buffer.from(buf.subarray(off + maskLen, total));
+  if (masked) {
+    const mk = buf.subarray(off, off + 4);
+    for (let i = 0; i < payload.length; i++) payload[i] ^= mk[i & 3];
+  }
+  return { frame: { fin, opcode, payload }, rest: buf.subarray(total) };
+}
+
+// ── Klien ────────────────────────────────────────────────────────────────────
+
+class WsClient extends EventEmitter {
+  constructor(url, opts = {}) {
+    super();
+    this.url = String(url);
+    this.headers = opts.headers || {};
+    this.state = 'idle'; // idle | connecting | open | closing | closed | fatal
+    this.autoReconnect = opts.autoReconnect !== false;
+    this.pingIntervalMs = opts.pingIntervalMs || PING_INTERVAL_MS;
+    this.deadAfterMs = opts.deadAfterMs || DEAD_AFTER_MS;
+    this.baseBackoffMs = opts.baseBackoffMs || BASE_BACKOFF_MS;
+    this.maxBackoffMs = opts.maxBackoffMs || MAX_BACKOFF_MS;
+    this._sock = null;
+    this._buf = null;      // buffer frame masuk
+    this._hsBuf = null;    // buffer header handshake
+    this._frag = null;     // pesan terfragmentasi {opcode, parts, size}
+    this._queue = [];      // antrean kecil saat belum open / sedang reconnect
+    this._attempt = 0;
+    this._pendingKey = null;
+    this._lastRecvAt = 0;
+    this._connectErr = null;
+    this._pingTimer = null;
+    this._reconTimer = null;
+    this._closeTimer = null;
+    this._userClosed = false;
+  }
+
+  isOpen() {
+    return this.state === 'open';
+  }
+
+  connect() {
+    if (this._userClosed || this._reconTimer) return; // sudah jalan / dijadwalkan
+    if (this.state === 'open' || this.state === 'connecting') return;
+    if (this.state === 'fatal') return; // permanen gagal (401/403/404…/URL rusak)
+    this._userClosed = false;
+    this._connectNow();
+  }
+
+  // Kirim teks/objek (di-JSON-kan). false bila belum open → masuk antrean kecil.
+  send(data) {
+    let buf;
+    if (typeof data === 'string') buf = Buffer.from(data, 'utf8');
+    else if (Buffer.isBuffer(data)) buf = data;
+    else {
+      try {
+        buf = Buffer.from(JSON.stringify(data), 'utf8');
+      } catch (e) {
+        this.emit('error', new Error('Pesan tidak bisa diserialisasi: ' + e.message));
+        return false;
+      }
+    }
+    if (buf.length > MAX_PAYLOAD) {
+      this.emit('error', new Error(`Pesan ${buf.length} byte melebihi batas 1 MB`));
+      return false;
+    }
+    if (this.state === 'open' && this._sock) {
+      this._sendFrame(OP.TEXT, buf);
+      return true;
+    }
+    if (this._queue.length >= 100) this._queue.shift(); // buang terlama (heartbeat lama tak berharga)
+    this._queue.push(buf);
+    return false;
+  }
+
+  // Close beres: kirim frame close, tunggu sebentar, lalu hancurkan socket.
+  close(code, reason) {
+    this._userClosed = true;
+    if (this._reconTimer) {
+      clearTimeout(this._reconTimer);
+      this._reconTimer = null;
+    }
+    const sock = this._sock;
+    if (!sock) {
+      this._clearPing();
+      this.state = 'closed';
+      this.emit('close', { code: code || 1000, expected: true });
+      return;
+    }
+    if (this.state === 'open') {
+      this.state = 'closing';
+      this._sendFrame(OP.CLOSE, encodeClosePayload(code || 1000, reason));
+      this._clearPing();
+      this._closeTimer = setTimeout(() => {
+        try {
+          if (this._sock) this._sock.destroy();
+        } catch (e) { /* abaikan */ }
+      }, CLOSE_TIMEOUT_MS);
+      this._closeTimer.unref();
+    } else {
+      // connecting → bongkar langsung tanpa reconnect
+      this._clearPing();
+      this.state = 'closed';
+      try { sock.destroy(); } catch (e) { /* abaikan */ }
+      this.emit('close', { code: code || 1000, expected: true });
+    }
+  }
+
+  // ── internal ──
+
+  _clearPing() {
+    if (this._pingTimer) {
+      clearInterval(this._pingTimer);
+      this._pingTimer = null;
+    }
+  }
+
+  _scheduleReconnect(reason) {
+    if (this._userClosed || !this.autoReconnect || this._reconTimer) return;
+    const n = Math.max(0, this._attempt - 1);
+    let delay = Math.min(this.maxBackoffMs, this.baseBackoffMs * 2 ** n);
+    delay += Math.floor(Math.random() * 300); // jitter
+    this.emit('reconnecting', { attempt: this._attempt, delay, reason });
+    this._reconTimer = setTimeout(() => {
+      this._reconTimer = null;
+      if (!this._userClosed) this._connectNow();
+    }, delay);
+  }
+
+  _connectNow() {
+    if (this._userClosed || this.state === 'open') return;
+    this.state = 'connecting';
+    this._connectErr = null;
+    let target;
+    try {
+      target = wsTarget(this.url);
+    } catch (e) {
+      this.state = 'fatal';
+      this.emit('fatal', e);
+      return;
+    }
+    let sock;
+    try {
+      sock = target.secure
+        ? tls.connect({ host: target.host, port: target.port, servername: target.host }, () => this._onConnected(target))
+        : net.connect({ host: target.host, port: target.port }, () => this._onConnected(target));
+    } catch (e) {
+      this.state = 'closed';
+      this._connectErr = e;
+      this._onSockClose();
+      return;
+    }
+    sock.setNoDelay(true);
+    sock.setTimeout(CONNECT_TIMEOUT_MS, () => {
+      if (this.state === 'connecting') {
+        const err = new Error(`Waktu habis ${CONNECT_TIMEOUT_MS / 1000}s saat handshake`);
+        err.handshakeStatus = 0;
+        this._connectErr = err;
+        try { sock.destroy(); } catch (e2) { /* abaikan */ }
+      }
+    });
+    sock.on('data', (chunk) => this._onData(chunk));
+    sock.on('error', (e) => this._onSockError(e));
+    sock.on('close', () => this._onSockClose());
+    this._sock = sock;
+  }
+
+  _onConnected(target) {
+    const sock = this._sock;
+    if (!sock || this.state !== 'connecting') return;
+    const defaultPort = target.secure ? 443 : 80;
+    const hostHeader = target.port === defaultPort ? target.host : `${target.host}:${target.port}`;
+    const key = crypto.randomBytes(16).toString('base64');
+    this._pendingKey = key;
+    const lines = [
+      `GET ${target.path} HTTP/1.1`,
+      `Host: ${hostHeader}`,
+      'Upgrade: websocket',
+      'Connection: Upgrade',
+      `Sec-WebSocket-Key: ${key}`,
+      'Sec-WebSocket-Version: 13',
+    ];
+    for (const [k, v] of Object.entries(this.headers)) {
+      const kl = String(k).toLowerCase();
+      if (kl.startsWith('sec-websocket') || kl === 'connection' || kl === 'upgrade' || kl === 'host') continue;
+      lines.push(`${k}: ${v}`);
+    }
+    sock.write(lines.join('\r\n') + '\r\n\r\n', 'utf8');
+  }
+
+  _onData(chunk) {
+    if (this.state === 'open') {
+      this._lastRecvAt = Date.now();
+      this._feed(chunk);
+      return;
+    }
+    // masih handshaking
+    this._hsBuf = this._hsBuf ? Buffer.concat([this._hsBuf, chunk]) : chunk;
+    const idx = this._hsBuf.indexOf('\r\n\r\n');
+    if (idx === -1) {
+      if (this._hsBuf.length > HS_MAX_HEAD) {
+        const err = new Error('Header handshake terlalu besar');
+        err.handshakeStatus = 0;
+        this._connectErr = err;
+        try { this._sock.destroy(); } catch (e) { /* abaikan */ }
+      }
+      return;
+    }
+    const head = this._hsBuf.subarray(0, idx).toString('utf8');
+    const rest = this._hsBuf.subarray(idx + 4);
+    this._hsBuf = null;
+    this._finishHandshake(head, rest);
+  }
+
+  _finishHandshake(head, rest) {
+    const lines = head.split('\r\n');
+    const m = /^HTTP\/1\.\d\s+(\d{3})(?:\s+(.*))?$/.exec(String(lines[0] || '').trim());
+    const status = m ? Number(m[1]) : 0;
+    if (status !== 101) {
+      const err = new Error(`Handshake WebSocket ditolak (HTTP ${status})`);
+      err.handshakeStatus = status;
+      this._connectErr = err;
+      try { this._sock.destroy(); } catch (e) { /* abaikan */ }
+      return;
+    }
+    const headers = {};
+    for (const line of lines.slice(1)) {
+      const ci = line.indexOf(':');
+      if (ci > 0) headers[line.slice(0, ci).trim().toLowerCase()] = line.slice(ci + 1).trim();
+    }
+    if (!this._pendingKey || headers['sec-websocket-accept'] !== acceptKey(this._pendingKey)) {
+      const err = new Error('Sec-WebSocket-Accept tidak valid — server bukan WebSocket RFC 6455');
+      err.handshakeStatus = 101;
+      this._connectErr = err;
+      try { this._sock.destroy(); } catch (e) { /* abaikan */ }
+      return;
+    }
+    // 101 + accept valid → open
+    const sock = this._sock;
+    this.state = 'open';
+    this._attempt = 0;
+    this._frag = null;
+    this._pendingKey = null;
+    this._lastRecvAt = Date.now();
+    if (sock) sock.setTimeout(0);
+    this._startPing();
+    this.emit('open');
+    if (rest && rest.length) this._feed(rest);
+    const q = this._queue.splice(0);
+    for (const b of q) {
+      if (this.state === 'open') this._sendFrame(OP.TEXT, b);
+    }
+  }
+
+  _startPing() {
+    this._clearPing();
+    this._pingTimer = setInterval(() => {
+      if (this.state !== 'open' || !this._sock) return;
+      const now = Date.now();
+      if (this._lastRecvAt && now - this._lastRecvAt > this.deadAfterMs) {
+        this.emit('error', new Error(`Koneksi diam > ${Math.round(this.deadAfterMs / 1000)}s tanpa frame — diputus untuk sambung ulang`));
+        try { this._sock.destroy(); } catch (e) { /* abaikan */ }
+        return;
+      }
+      this._sendFrame(OP.PING, crypto.randomBytes(4));
+    }, this.pingIntervalMs);
+  }
+
+  _onSockError(e) {
+    if (this.state === 'open') {
+      this.emit('error', e);
+      try { this._sock.destroy(); } catch (e2) { /* abaikan */ }
+      return;
+    }
+    if (this.state === 'connecting') {
+      if (e && e.handshakeStatus === undefined) {
+        const err = e instanceof Error ? e : new Error(String(e));
+        err.handshakeStatus = 0;
+        this._connectErr = err;
+      }
+      try { this._sock.destroy(); } catch (e2) { /* abaikan */ }
+    }
+    // state 'closing'/'closed': socket error diabaikan — kita memang sedang memutus
+  }
+
+  _onSockClose() {
+    if (this._closeTimer) {
+      clearTimeout(this._closeTimer);
+      this._closeTimer = null;
+    }
+    this._clearPing();
+    const was = this.state;
+    this.state = 'closed';
+    this._sock = null;
+    this._buf = null;
+    this._hsBuf = null;
+    this._frag = null;
+    if (this._userClosed || was === 'closing') {
+      this.emit('close', { code: 1000, expected: true });
+      return;
+    }
+    if (was === 'open') {
+      this.emit('close', { code: 1006, expected: false });
+      this._scheduleReconnect('koneksi terputus');
+      return;
+    }
+    if (was === 'connecting') {
+      const err = this._connectErr || new Error('Gagal terhubung');
+      this._connectErr = null;
+      const st = Number(err.handshakeStatus || 0);
+      const permanent = st >= 400 && st < 500 && st !== 408 && st !== 429;
+      if (permanent) {
+        this.state = 'fatal';
+        this.emit('fatal', err);
+        return;
+      }
+      this.emit('error', err);
+      this._attempt += 1;
+      this._scheduleReconnect(err.message);
+    }
+  }
+
+  _protocolFail(err) {
+    this.emit('error', err);
+    const code = /1 MB/.test(err.message) ? 1009 : 1002;
+    if (this._sock && this.state === 'open') {
+      try { this._sock.write(encodeFrame(OP.CLOSE, encodeClosePayload(code, err.message))); } catch (e) { /* abaikan */ }
+      try { this._sock.end(); } catch (e2) { /* abaikan */ }
+      setTimeout(() => {
+        try { if (this._sock) this._sock.destroy(); } catch (e3) { /* abaikan */ }
+      }, 250).unref();
+    }
+  }
+
+  _feed(chunk) {
+    this._buf = this._buf ? Buffer.concat([this._buf, Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)]) : chunk;
+    for (;;) {
+      const r = extractFrame(this._buf);
+      if (r === null) break;
+      if (r.error) {
+        this._protocolFail(r.error);
+        return;
+      }
+      this._buf = r.rest;
+      this._onFrame(r.frame);
+      if (this.state !== 'open') return;
+    }
+    if (this._buf && this._buf.length > MAX_PAYLOAD + 16) {
+      this._protocolFail(new Error('Buffer frame melebihi batas 1 MB'));
+    }
+  }
+
+  _onFrame({ fin, opcode, payload }) {
+    switch (opcode) {
+      case OP.TEXT:
+      case OP.BINARY: {
+        if (this._frag) {
+          this._protocolFail(new Error('Frame teks baru saat fragmentasi belum selesai'));
+          return;
+        }
+        if (fin) {
+          this._deliver(opcode, payload);
+          return;
+        }
+        this._frag = { opcode, parts: [payload], size: payload.length };
+        return;
+      }
+      case OP.CONT: {
+        if (!this._frag) {
+          this._protocolFail(new Error('Continuation tanpa pesan induk'));
+          return;
+        }
+        this._frag.parts.push(payload);
+        this._frag.size += payload.length;
+        if (this._frag.size > MAX_PAYLOAD) {
+          const err = new Error('Pesan gabungan melebihi batas 1 MB');
+          this._frag = null;
+          this._protocolFail(err);
+          return;
+        }
+        if (fin) {
+          const { opcode: op, parts } = this._frag;
+          this._frag = null;
+          this._deliver(op, Buffer.concat(parts));
+        }
+        return;
+      }
+      case OP.PING: {
+        if (payload.length > 125) {
+          this._protocolFail(new Error('Ping > 125 byte'));
+          return;
+        }
+        this._sendFrame(OP.PONG, payload);
+        return;
+      }
+      case OP.PONG:
+        return;
+      case OP.CLOSE: {
+        let code = 1005;
+        let reason = '';
+        if (payload.length >= 2) {
+          code = payload.readUInt16BE(0);
+          reason = payload.subarray(2).toString('utf8');
+        }
+        // echo close lalu biarkan event 'close' yang memutus (reconnect bila perlu)
+        if (this._sock && this.state === 'open') {
+          try { this._sock.write(encodeFrame(OP.CLOSE, encodeClosePayload(code === 1005 ? 1000 : code, ''))); } catch (e) { /* abaikan */ }
+        }
+        setImmediate(() => {
+          try { if (this._sock) this._sock.destroy(); } catch (e) { /* abaikan */ }
+        });
+        return;
+      }
+      default:
+        this._protocolFail(new Error(`Opcode tidak dikenal: ${opcode}`));
+    }
+  }
+
+  _deliver(opcode, payload) {
+    if (opcode === OP.TEXT) {
+      let s = '';
+      try { s = payload.toString('utf8'); } catch (e) { s = ''; }
+      this.emit('message', s);
+    } else {
+      this.emit('binary', payload); // tidak dipakai CLI, tapi tetap tersedia
+    }
+  }
+
+  _sendFrame(opcode, payload) {
+    const sock = this._sock;
+    if (!sock || this.state !== 'open' || !sock.writable) return false;
+    try {
+      sock.write(encodeFrame(opcode, payload));
+      return true;
+    } catch (e) {
+      this.emit('error', e);
+      try { sock.destroy(); } catch (e2) { /* abaikan */ }
+      return false;
+    }
+  }
+}
+
+module.exports = { WsClient, MAX_PAYLOAD, acceptKey, encodeFrame, extractFrame, wsTarget };