lunel-cli 0.1.41 → 0.1.45

package/dist/index.js

@@ -1,18 +1,21 @@
 #!/usr/bin/env node
 import { WebSocket } from "ws";
 import qrcode from "qrcode-terminal";
-import { createOpencodeServer, createOpencodeClient } from "@opencode-ai/sdk";
+import { createAiManager } from "./ai/index.js";
 import * as crypto from "crypto";
 import Ignore from "ignore";
 const ignore = Ignore.default;
 import * as fs from "fs/promises";
+import * as fssync from "fs";
 import * as path from "path";
 import * as os from "os";
-import { spawn, execSync, execFileSync } from "child_process";
+import { spawn, spawnSync, execSync, execFileSync } from "child_process";
 import { createServer, createConnection } from "net";
 import { createInterface } from "readline";
 const DEFAULT_PROXY_URL = normalizeGatewayUrl(process.env.LUNEL_PROXY_URL || "https://gateway.lunel.dev");
 const MANAGER_URL = normalizeGatewayUrl(process.env.LUNEL_MANAGER_URL || "https://manager.lunel.dev");
+const CLOUD_JOB_CONFIG_PATH = "/etc/lunel/job.json";
+const VM_HEARTBEAT_INTERVAL_MS = 10_000;
 const CLI_ARGS = process.argv.slice(2);
 import { createRequire } from "module";
 const __require = createRequire(import.meta.url);
@@ -31,8 +34,8 @@ const processes = new Map();
 const processOutputBuffers = new Map();
 // CPU usage tracking
 let lastCpuInfo = null;
-// OpenCode client
-let opencodeClient = null;
+// AI manager — runs OpenCode and Codex simultaneously, routes by backend
+let aiManager = null;
 // Proxy tunnel management
 let currentSessionCode = null;
 let currentSessionPassword = null;
@@ -44,6 +47,51 @@ let activeControlWs = null;
 let activeDataWs = null;
 const activeTunnels = new Map();
 const PORT_SYNC_INTERVAL_MS = 30_000;
+let cloudJobConfig = null;
+let vmHeartbeatTimer = null;
+async function readCloudJobConfig() {
+    try {
+        const data = await fs.readFile(CLOUD_JOB_CONFIG_PATH, "utf-8");
+        return JSON.parse(data);
+    }
+    catch {
+        return null;
+    }
+}
+function startVmHeartbeat(resumeToken) {
+    if (!cloudJobConfig?.session_code)
+        return;
+    if (vmHeartbeatTimer)
+        return;
+    const cfg = cloudJobConfig;
+    const sendHeartbeat = () => {
+        if (shuttingDown)
+            return;
+        fetch(`${MANAGER_URL}/v1/vm/heartbeat`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                sandboxId: cfg.sandbox_id,
+                resumeToken,
+                sandmanUrl: cfg.sandman_url || "",
+                repoUrl: cfg.repo_url,
+                branch: cfg.branch,
+                vmProfile: cfg.vm_profile || "",
+            }),
+        }).catch((err) => {
+            if (!shuttingDown)
+                console.warn("[vm] heartbeat failed:", err.message);
+        });
+    };
+    sendHeartbeat();
+    vmHeartbeatTimer = setInterval(sendHeartbeat, VM_HEARTBEAT_INTERVAL_MS);
+}
+function stopVmHeartbeat() {
+    if (vmHeartbeatTimer) {
+        clearInterval(vmHeartbeatTimer);
+        vmHeartbeatTimer = null;
+    }
+}
 const CLI_LOCAL_TCP_CONNECT_TIMEOUT_MS = 2_500;
 const PROXY_WS_CONNECT_TIMEOUT_MS = 12_000;
 const TUNNEL_SETUP_BUDGET_MS = 18_000;
@@ -220,11 +268,35 @@ function isProtocolResponse(value) {
 // Path Safety
 // ============================================================================
 function resolveSafePath(requestedPath) {
-    const resolved = path.resolve(ROOT_DIR, requestedPath);
-    if (!resolved.startsWith(ROOT_DIR)) {
+    // path.resolve handles ".." components, but on case-insensitive or symlinked
+    // filesystems a simple startsWith check can still be bypassed. We use
+    // realpathSync to canonicalise the path (resolves symlinks, normalises case on
+    // Windows) before comparing against ROOT_DIR, which is itself canonicalised at
+    // startup. If the path does not exist yet we fall back to the lexical resolve so
+    // that callers creating new files can still pass the check.
+    const lexical = path.resolve(ROOT_DIR, requestedPath);
+    let canonical;
+    try {
+        canonical = fssync.realpathSync(lexical);
+    }
+    catch {
+        // Path doesn't exist yet — verify lexically. Still safe because path.resolve
+        // already eliminated all ".." traversals in the resolved string.
+        canonical = lexical;
+    }
+    // Ensure ROOT_DIR itself is canonical for a reliable prefix comparison.
+    const canonicalRoot = (() => {
+        try {
+            return fssync.realpathSync(ROOT_DIR);
+        }
+        catch {
+            return ROOT_DIR;
+        }
+    })();
+    if (!canonical.startsWith(canonicalRoot + path.sep) && canonical !== canonicalRoot) {
         return null;
     }
-    return resolved;
+    return canonical;
 }
 function assertSafePath(requestedPath) {
     const safePath = resolveSafePath(requestedPath);
@@ -781,6 +853,167 @@ async function handleGitDiscard(payload) {
 // Terminal Handlers (delegates to Rust PTY binary)
 // ============================================================================
 let dataChannel = null;
+let e2eeKeyPair = null;
+let e2eeCliToAppKey = null; // AES-256-GCM key, CLI→App direction
+let e2eeAppToCliKey = null; // AES-256-GCM key, App→CLI direction
+let e2eeActive = false;
+let e2eeSentReady = false;
+let e2eeGotReady = false;
+// No outbound counter — we generate a full 96-bit random nonce per message.
+// AES-GCM nonce uniqueness is guaranteed by CSPRNG with negligible collision
+// probability (birthday bound: ~2^48 messages before 2^-32 collision risk).
+function e2eeReset() {
+    e2eeKeyPair = null;
+    e2eeCliToAppKey = null;
+    e2eeAppToCliKey = null;
+    e2eeActive = false;
+    e2eeSentReady = false;
+    e2eeGotReady = false;
+}
+function e2eeHandlePeerHello(peerPubkeyB64, dataWs) {
+    const kp = crypto.generateKeyPairSync("ec", { namedCurve: "P-256" });
+    e2eeKeyPair = kp;
+    const peerDer = Buffer.from(peerPubkeyB64, "base64url");
+    const peerPubKey = crypto.createPublicKey({ key: peerDer, type: "spki", format: "der" });
+    const sharedSecret = crypto.diffieHellman({ privateKey: kp.privateKey, publicKey: peerPubKey });
+    const salt = Buffer.alloc(32);
+    e2eeCliToAppKey = Buffer.from(crypto.hkdfSync("sha256", sharedSecret, salt, Buffer.from("lunel-cli-to-app"), 32));
+    e2eeAppToCliKey = Buffer.from(crypto.hkdfSync("sha256", sharedSecret, salt, Buffer.from("lunel-app-to-cli"), 32));
+    // Send our own pubkey so the app can derive the same shared secret
+    const mySpki = kp.publicKey.export({ type: "spki", format: "der" });
+    dataWs.send(JSON.stringify({ type: "e2ee_hello", pubkey: Buffer.from(mySpki).toString("base64url") }));
+    dataWs.send(JSON.stringify({ type: "e2ee_secure_ready" }));
+    e2eeSentReady = true;
+    if (e2eeGotReady) {
+        e2eeActive = true;
+        console.log("[e2ee] encryption active");
+    }
+}
+function e2eeHandlePeerReady() {
+    e2eeGotReady = true;
+    if (e2eeSentReady) {
+        e2eeActive = true;
+        console.log("[e2ee] encryption active");
+    }
+}
+function e2eeEncrypt(payload) {
+    if (!e2eeCliToAppKey)
+        throw new Error("[e2ee] CLI→App key not ready");
+    // Full 96-bit random nonce — safe across reconnects with no counter state.
+    const nonce = crypto.randomBytes(12);
+    const plain = Buffer.from(JSON.stringify(payload));
+    const cipher = crypto.createCipheriv("aes-256-gcm", e2eeCliToAppKey, nonce);
+    const ct = Buffer.concat([cipher.update(plain), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    // wire: nonce(12) || ct || tag(16) — consistent with WebCrypto AES-GCM format on app side
+    return Buffer.concat([nonce, ct, tag]).toString("base64url");
+}
+function e2eeDecrypt(enc) {
+    if (!e2eeAppToCliKey)
+        throw new Error("[e2ee] App→CLI key not ready");
+    const buf = Buffer.from(enc, "base64url");
+    const nonce = buf.subarray(0, 12);
+    const ct = buf.subarray(12, buf.length - 16);
+    const tag = buf.subarray(buf.length - 16);
+    const decipher = crypto.createDecipheriv("aes-256-gcm", e2eeAppToCliKey, nonce);
+    decipher.setAuthTag(tag);
+    return JSON.parse(Buffer.concat([decipher.update(ct), decipher.final()]).toString("utf-8"));
+}
+// ============================================================================
+// Replay buffer + backpressure
+// ============================================================================
+// Replay buffer for sequenced outbound data-channel messages
+let outboundSeq = 0;
+let lastSentSeq = 0; // highest seq actually flushed to the socket (not paused)
+const REPLAY_BUFFER_MAX_MESSAGES = 500;
+const REPLAY_BUFFER_MAX_BYTES = 10 * 1024 * 1024; // 10 MB
+const replayBuffer = [];
+let replayBufferBytes = 0;
+// Data-channel backpressure
+const DATA_CHANNEL_HIGH_WATER_BYTES = 1 * 1024 * 1024; // 1 MB — pause forwarding
+const DATA_CHANNEL_LOW_WATER_BYTES = 256 * 1024; // 256 KB — resume forwarding
+let dataChannelPaused = false;
+let dataChannelDrainTimer = null;
+function sendOnDataChannel(ws, msg) {
+    if (e2eeActive && e2eeCliToAppKey) {
+        const { payload, ...envelope } = msg;
+        ws.send(JSON.stringify({ ...envelope, enc: e2eeEncrypt(payload) }));
+    }
+    else {
+        ws.send(JSON.stringify(msg));
+    }
+}
+function sendSequenced(channel, msg) {
+    const seq = ++outboundSeq;
+    const msgWithSeq = { ...msg, seq };
+    const byteLen = Buffer.byteLength(JSON.stringify(msgWithSeq), "utf-8");
+    replayBuffer.push({ seq, msg: msgWithSeq, byteLen });
+    replayBufferBytes += byteLen;
+    while (replayBuffer.length > REPLAY_BUFFER_MAX_MESSAGES || replayBufferBytes > REPLAY_BUFFER_MAX_BYTES) {
+        const evicted = replayBuffer.shift();
+        if (evicted)
+            replayBufferBytes -= evicted.byteLen;
+    }
+    // Skip the actual send while backpressured — event is already in replay buffer
+    if (channel.readyState === WebSocket.OPEN && !dataChannelPaused) {
+        sendOnDataChannel(channel, msgWithSeq);
+        lastSentSeq = seq;
+    }
+}
+function resetReplayBuffer() {
+    outboundSeq = 0;
+    lastSentSeq = 0;
+    replayBuffer.length = 0;
+    replayBufferBytes = 0;
+    dataChannelPaused = false;
+    e2eeReset();
+    if (dataChannelDrainTimer) {
+        clearInterval(dataChannelDrainTimer);
+        dataChannelDrainTimer = null;
+    }
+}
+function resumeDataChannel() {
+    if (!dataChannelPaused)
+        return;
+    dataChannelPaused = false;
+    if (dataChannelDrainTimer) {
+        clearInterval(dataChannelDrainTimer);
+        dataChannelDrainTimer = null;
+    }
+    // Flush events that were buffered during the pause (re-encrypts with current key)
+    const toFlush = replayBuffer.filter((e) => e.seq > lastSentSeq);
+    if (dataChannel?.readyState === WebSocket.OPEN) {
+        for (const entry of toFlush) {
+            sendOnDataChannel(dataChannel, entry.msg);
+            lastSentSeq = entry.seq;
+        }
+    }
+    console.log(`[backpressure] data channel resumed, flushed ${toFlush.length} buffered events`);
+    if (activeControlWs?.readyState === WebSocket.OPEN) {
+        const buffered = dataChannel?.bufferedAmount ?? 0;
+        activeControlWs.send(JSON.stringify({ type: "data_channel_resumed", bufferedBytes: buffered }));
+    }
+}
+function checkDataChannelBackpressure() {
+    if (!dataChannel || dataChannel.readyState !== WebSocket.OPEN)
+        return;
+    const buffered = dataChannel.bufferedAmount ?? 0;
+    if (!dataChannelPaused && buffered > DATA_CHANNEL_HIGH_WATER_BYTES) {
+        dataChannelPaused = true;
+        console.warn(`[backpressure] data channel paused (${buffered} bytes buffered)`);
+        if (activeControlWs?.readyState === WebSocket.OPEN) {
+            activeControlWs.send(JSON.stringify({ type: "data_channel_paused", bufferedBytes: buffered }));
+        }
+        if (!dataChannelDrainTimer) {
+            dataChannelDrainTimer = setInterval(() => {
+                const current = dataChannel?.bufferedAmount ?? 0;
+                if (current < DATA_CHANNEL_LOW_WATER_BYTES || !dataChannel || dataChannel.readyState !== WebSocket.OPEN) {
+                    resumeDataChannel();
+                }
+            }, 100);
+        }
+    }
+}
 let ensurePtyBinaryPromise = null;
 function normalizeJsonWithTrailingCommas(text) {
     return text.replace(/,\s*([}\]])/g, "$1");
@@ -991,7 +1224,7 @@ async function ensurePtyProcess() {
                         scrollbackLength: event.scrollbackLength,
                     },
                 };
-                dataChannel.send(JSON.stringify(msg));
+                sendSequenced(dataChannel, msg);
             }
         }
         else if (event.event === "exit") {
@@ -1004,7 +1237,7 @@ async function ensurePtyProcess() {
                     action: "exit",
                     payload: { terminalId: event.id, code: event.code },
                 };
-                dataChannel.send(JSON.stringify(msg));
+                sendSequenced(dataChannel, msg);
             }
         }
         else if (event.event === "error") {
@@ -1126,7 +1359,7 @@ function handleProcessesSpawn(payload) {
         cwd: workDir,
         env: { ...process.env, ...extraEnv },
         stdio: ["pipe", "pipe", "pipe"],
-        shell: true,
+        shell: false,
     });
     const pid = proc.pid;
     const channel = `proc-${pid}`;
@@ -1155,7 +1388,7 @@ function handleProcessesSpawn(payload) {
                 action: "output",
                 payload: { pid, channel, stream, data: text },
             };
-            dataChannel.send(JSON.stringify(msg));
+            sendSequenced(dataChannel, msg);
         }
     };
     proc.stdout?.on("data", sendOutput("stdout"));
@@ -1269,9 +1502,10 @@ function handlePortsList() {
     return { ports };
 }
 function handlePortsIsAvailable(payload) {
-    const port = payload.port;
-    if (!port)
-        throw Object.assign(new Error("port is required"), { code: "EINVAL" });
+    const port = Math.floor(Number(payload.port));
+    if (!Number.isFinite(port) || port < 1 || port > 65535) {
+        throw Object.assign(new Error("port must be an integer between 1 and 65535"), { code: "EINVAL" });
+    }
     return new Promise((resolve) => {
         const server = createServer();
         server.once("error", (err) => {
@@ -1294,33 +1528,58 @@ function handlePortsKill(payload) {
     const port = payload.port;
     if (!port)
         throw Object.assign(new Error("port is required"), { code: "EINVAL" });
+    // Strict port range validation to prevent injection via crafted numeric values
+    const portNum = Math.floor(Number(port));
+    if (!Number.isFinite(portNum) || portNum < 1 || portNum > 65535) {
+        throw Object.assign(new Error("port must be an integer between 1 and 65535"), { code: "EINVAL" });
+    }
     const platform = os.platform();
     try {
         let pid = null;
         if (platform === "darwin" || platform === "linux") {
-            const output = execSync(`lsof -ti:${port} 2>/dev/null || true`, { encoding: "utf-8" });
-            const pids = output.trim().split("\n").filter(Boolean);
-            if (pids.length > 0) {
-                pid = parseInt(pids[0]);
-                execSync(`kill -9 ${pids.join(" ")}`, { encoding: "utf-8" });
+            // Use spawnSync with an explicit args array — never shell: true — so portNum
+            // cannot escape into a shell command even if it were somehow non-numeric.
+            const result = spawnSync("lsof", ["-ti", String(portNum)], { encoding: "utf-8" });
+            const pids = (result.stdout || "").trim().split("\n").filter(Boolean);
+            for (const pidStr of pids) {
+                const p = parseInt(pidStr, 10);
+                if (!Number.isFinite(p) || p <= 0)
+                    continue;
+                if (pid === null)
+                    pid = p;
+                // Send SIGKILL directly via process.kill — no shell involved.
+                try {
+                    process.kill(p, "SIGKILL");
+                }
+                catch { /* already dead */ }
             }
         }
         else if (platform === "win32") {
-            const output = execSync(`netstat -ano | findstr :${port}`, { encoding: "utf-8" });
-            const lines = output.trim().split("\n");
+            // Use netstat via args array, parse PIDs, then taskkill via args array.
+            const result = spawnSync("netstat", ["-ano"], { encoding: "utf-8" });
+            const lines = (result.stdout || "").trim().split("\n");
             for (const line of lines) {
                 const parts = line.trim().split(/\s+/);
-                if (parts.length >= 5) {
-                    pid = parseInt(parts[4]);
-                    execSync(`taskkill /F /PID ${pid}`, { encoding: "utf-8" });
-                    break;
-                }
+                // netstat -ano columns: Proto  Local  Foreign  State  PID
+                // Match only lines where the local address ends with :<portNum>
+                if (parts.length < 5)
+                    continue;
+                const localAddr = parts[1] ?? "";
+                if (!localAddr.endsWith(`:${portNum}`))
+                    continue;
+                const p = parseInt(parts[4], 10);
+                if (!Number.isFinite(p) || p <= 0)
+                    continue;
+                if (pid === null)
+                    pid = p;
+                spawnSync("taskkill", ["/F", "/PID", String(p)], { encoding: "utf-8" });
+                break;
             }
         }
-        return { port, pid };
+        return { port: portNum, pid };
     }
     catch (err) {
-        throw Object.assign(new Error(`Failed to kill process on port ${port}`), { code: "EPERM" });
+        throw Object.assign(new Error(`Failed to kill process on port ${portNum}`), { code: "EPERM" });
     }
 }
 // ============================================================================
@@ -1552,258 +1811,9 @@ async function handleHttpRequest(payload) {
     }
 }
 // ============================================================================
-// AI Handlers (OpenCode SDK)
+// AI Handlers — delegated to the active AIProvider
 // ============================================================================
-function requireData(response, label) {
-    if (!response.data) {
-        const errMsg = response.error
-            ? (typeof response.error === "string" ? response.error : JSON.stringify(response.error))
-            : `${label} returned no data`;
-        console.error(`[ai] ${label} failed:`, redactSensitive(errMsg), "raw response:", redactSensitive(JSON.stringify(response).substring(0, 500)));
-        throw new Error(errMsg);
-    }
-    return response.data;
-}
-async function handleAiCreateSession(payload) {
-    const title = payload.title || undefined;
-    if (VERBOSE_AI_LOGS)
-        console.log("[ai] createSession called");
-    try {
-        const response = await opencodeClient.session.create({ body: { title } });
-        if (VERBOSE_AI_LOGS) {
-            console.log("[ai] createSession response ok:", !!response.data, "error:", response.error ? redactSensitive(JSON.stringify(response.error).substring(0, 200)) : "none");
-        }
-        return { session: requireData(response, "session.create") };
-    }
-    catch (err) {
-        console.error("[ai] createSession exception:", redactSensitive(err.message));
-        throw err;
-    }
-}
-async function handleAiListSessions() {
-    if (VERBOSE_AI_LOGS)
-        console.log("[ai] listSessions called");
-    try {
-        const response = await opencodeClient.session.list();
-        const data = requireData(response, "session.list");
-        if (VERBOSE_AI_LOGS) {
-            console.log("[ai] listSessions returned", Array.isArray(data) ? data.length : typeof data, "sessions");
-        }
-        return { sessions: data };
-    }
-    catch (err) {
-        console.error("[ai] listSessions exception:", err.message);
-        throw err;
-    }
-}
-async function handleAiGetSession(payload) {
-    const id = payload.id;
-    const response = await opencodeClient.session.get({ path: { id } });
-    return { session: requireData(response, "session.get") };
-}
-async function handleAiDeleteSession(payload) {
-    const id = payload.id;
-    const response = await opencodeClient.session.delete({ path: { id } });
-    if (response.error)
-        throw new Error(JSON.stringify(response.error));
-    return {};
-}
-async function handleAiGetMessages(payload) {
-    const id = payload.id;
-    if (VERBOSE_AI_LOGS)
-        console.log("[ai] getMessages called");
-    try {
-        const response = await opencodeClient.session.messages({ path: { id } });
-        const raw = requireData(response, "session.messages");
-        // Transform SDK shape { info: { id, sessionID, role, ... }, parts: [...] }
-        // into app shape { id, role, parts }
-        const messages = raw.map((m) => ({
-            id: m.info.id,
-            role: m.info.role,
-            parts: m.parts || [],
-            time: m.info.time,
-        }));
-        if (VERBOSE_AI_LOGS)
-            console.log("[ai] getMessages returned", messages.length, "messages");
-        return { messages };
-    }
-    catch (err) {
-        console.error("[ai] getMessages exception:", err.message);
-        throw err;
-    }
-}
-async function handleAiPrompt(payload) {
-    const sessionId = payload.sessionId;
-    const text = payload.text;
-    const model = payload.model;
-    const agent = payload.agent;
-    if (VERBOSE_AI_LOGS) {
-        console.log("[ai] prompt called", {
-            hasSessionId: Boolean(sessionId),
-            model: redactSensitive(JSON.stringify(model || {})),
-            hasAgent: Boolean(agent),
-            textLength: typeof text === "string" ? text.length : 0,
-        });
-    }
-    // Fire and forget — results stream via SSE events forwarded on data channel
-    opencodeClient.session.prompt({
-        path: { id: sessionId },
-        body: {
-            parts: [{ type: "text", text }],
-            ...(model ? { model } : {}),
-            ...(agent ? { agent } : {}),
-        },
-    }).catch((err) => {
-        console.error("[ai] prompt error:", err.message);
-        if (dataChannel && dataChannel.readyState === WebSocket.OPEN) {
-            dataChannel.send(JSON.stringify({
-                v: 1,
-                id: `evt-${Date.now()}`,
-                ns: "ai",
-                action: "event",
-                payload: {
-                    type: "prompt_error",
-                    properties: { sessionId, error: err.message },
-                },
-            }));
-        }
-    });
-    return { ack: true };
-}
-async function handleAiAbort(payload) {
-    const id = payload.sessionId;
-    await opencodeClient.session.abort({ path: { id } });
-    return {};
-}
-async function handleAiAgents() {
-    if (VERBOSE_AI_LOGS)
-        console.log("[ai] getAgents called");
-    try {
-        const response = await opencodeClient.app.agents();
-        const data = requireData(response, "app.agents");
-        if (VERBOSE_AI_LOGS) {
-            console.log("[ai] getAgents returned:", redactSensitive(JSON.stringify(data).substring(0, 300)));
-        }
-        return { agents: data };
-    }
-    catch (err) {
-        console.error("[ai] getAgents exception:", err.message);
-        throw err;
-    }
-}
-async function handleAiProviders() {
-    if (VERBOSE_AI_LOGS)
-        console.log("[ai] getProviders called");
-    try {
-        const response = await opencodeClient.config.providers();
-        const data = requireData(response, "config.providers");
-        if (VERBOSE_AI_LOGS) {
-            console.log("[ai] getProviders returned", data.providers?.length, "providers, defaults:", redactSensitive(JSON.stringify(data.default)));
-        }
-        return { providers: data.providers, default: data.default };
-    }
-    catch (err) {
-        console.error("[ai] getProviders exception:", err.message);
-        throw err;
-    }
-}
-async function handleAiSetAuth(payload) {
-    const providerId = payload.providerId;
-    const key = payload.key;
-    await opencodeClient.auth.set({
-        path: { id: providerId },
-        body: { type: "api", key },
-    });
-    return {};
-}
-async function handleAiCommand(payload) {
-    const sessionId = payload.sessionId;
-    const command = payload.command;
-    const args = payload.arguments || "";
-    const response = await opencodeClient.session.command({
-        path: { id: sessionId },
-        body: { command, arguments: args },
-    });
-    return { result: response.data ?? null };
-}
-async function handleAiRevert(payload) {
-    const sessionId = payload.sessionId;
-    const messageId = payload.messageId;
-    await opencodeClient.session.revert({
-        path: { id: sessionId },
-        body: { messageID: messageId },
-    });
-    return {};
-}
-async function handleAiUnrevert(payload) {
-    const sessionId = payload.sessionId;
-    await opencodeClient.session.unrevert({ path: { id: sessionId } });
-    return {};
-}
-async function handleAiShare(payload) {
-    const sessionId = payload.sessionId;
-    const response = await opencodeClient.session.share({ path: { id: sessionId } });
-    return { share: requireData(response, "session.share") };
-}
-async function handleAiPermissionReply(payload) {
-    const permissionId = payload.permissionId;
-    const sessionId = payload.sessionId;
-    const response = payload.response;
-    const approved = payload.approved;
-    // Support new "once" | "always" | "reject" format, fallback to legacy boolean
-    let permResponse;
-    if (response === "once" || response === "always" || response === "reject") {
-        permResponse = response;
-    }
-    else {
-        permResponse = approved ? "once" : "reject";
-    }
-    await opencodeClient.postSessionIdPermissionsPermissionId({
-        path: { id: sessionId, permissionID: permissionId },
-        body: { response: permResponse },
-    });
-    return {};
-}
-// SSE event forwarding from OpenCode to mobile app
-async function subscribeToOpenCodeEvents(client) {
-    try {
-        const events = await client.event.subscribe();
-        for await (const raw of events.stream) {
-            // OpenCode SSE payload shapes vary across versions:
-            //   { type, properties, ... }
-            //   { payload: { type, properties, ... }, directory: "..." }
-            const parsed = raw;
-            const base = parsed?.payload && typeof parsed.payload === "object"
-                ? parsed.payload
-                : parsed;
-            if (!base || typeof base.type !== "string") {
-                console.warn("[sse] Dropped malformed event:", redactSensitive(JSON.stringify(parsed).substring(0, 200)));
-                continue;
-            }
-            console.log("[sse]", base.type);
-            if (dataChannel && dataChannel.readyState === WebSocket.OPEN) {
-                const msg = {
-                    v: 1,
-                    id: `evt-${Date.now()}-${Math.random().toString(36).substring(2, 6)}`,
-                    ns: "ai",
-                    action: "event",
-                    payload: {
-                        type: base.type,
-                        properties: base.properties || {},
-                    },
-                };
-                dataChannel.send(JSON.stringify(msg));
-            }
-        }
-        // Stream ended normally — reconnect
-        console.log("[sse] Event stream ended, reconnecting...");
-        setTimeout(() => subscribeToOpenCodeEvents(client), 1000);
-    }
-    catch (err) {
-        console.error("[sse] Event stream error:", err.message);
-        setTimeout(() => subscribeToOpenCodeEvents(client), 3000);
-    }
-}
+// (Implementation lives in cli/src/ai/opencode.ts or cli/src/ai/codex.ts)
 // Proxy Handlers
 // ============================================================================
 async function scanDevPorts() {
@@ -2344,57 +2354,67 @@ async function processMessage(message) {
                         throw Object.assign(new Error(`Unknown action: ${ns}.${action}`), { code: "EINVAL" });
                 }
                 break;
-            case "ai":
+            case "ai": {
+                if (!aiManager)
+                    throw Object.assign(new Error("AI manager not initialized"), { code: "EUNAVAILABLE" });
+                const backend = (payload.backend === "codex" ? "codex" : "opencode");
                 switch (action) {
+                    case "backends":
+                        result = { backends: aiManager.availableBackends() };
+                        break;
                     case "prompt":
-                        result = await handleAiPrompt(payload);
+                        result = await aiManager.prompt(backend, payload.sessionId, payload.text, payload.model, payload.agent);
                         break;
                     case "createSession":
-                        result = await handleAiCreateSession(payload);
+                        result = await aiManager.createSession(backend, payload.title);
                         break;
                     case "listSessions":
-                        result = await handleAiListSessions();
+                        result = await aiManager.listAllSessions();
                         break;
                     case "getSession":
-                        result = await handleAiGetSession(payload);
+                        result = await aiManager.getSession(backend, payload.id);
                         break;
                     case "deleteSession":
-                        result = await handleAiDeleteSession(payload);
+                        result = await aiManager.deleteSession(backend, payload.id);
                         break;
                     case "getMessages":
-                        result = await handleAiGetMessages(payload);
+                        result = await aiManager.getMessages(backend, payload.id);
                         break;
                     case "abort":
-                        result = await handleAiAbort(payload);
+                        result = await aiManager.abort(backend, payload.sessionId);
                         break;
                     case "agents":
-                        result = await handleAiAgents();
+                        result = await aiManager.agents(backend);
                         break;
                     case "providers":
-                        result = await handleAiProviders();
+                        result = await aiManager.providers(backend);
                         break;
                     case "setAuth":
-                        result = await handleAiSetAuth(payload);
+                        result = await aiManager.setAuth(backend, payload.providerId, payload.key);
                         break;
                     case "command":
-                        result = await handleAiCommand(payload);
+                        result = await aiManager.command(backend, payload.sessionId, payload.command, payload.arguments || "");
                         break;
                     case "revert":
-                        result = await handleAiRevert(payload);
+                        result = await aiManager.revert(backend, payload.sessionId, payload.messageId);
                         break;
                     case "unrevert":
-                        result = await handleAiUnrevert(payload);
+                        result = await aiManager.unrevert(backend, payload.sessionId);
                         break;
                     case "share":
-                        result = await handleAiShare(payload);
+                        result = await aiManager.share(backend, payload.sessionId);
                         break;
-                    case "permission":
-                        result = await handleAiPermissionReply(payload);
+                    case "permission": {
+                        const r = payload.response;
+                        const permResp = r === "once" || r === "always" || r === "reject" ? r : (payload.approved ? "once" : "reject");
+                        result = await aiManager.permissionReply(backend, payload.sessionId, payload.permissionId, permResp);
                         break;
+                    }
                     default:
                         throw Object.assign(new Error(`Unknown action: ${ns}.${action}`), { code: "EINVAL" });
                 }
                 break;
+            }
             case "proxy":
                 switch (action) {
                     case "connect":
@@ -2427,7 +2447,13 @@ async function processMessage(message) {
     }
 }
 function sendResponseOnData(response, dataWs) {
-    dataWs.send(JSON.stringify(response));
+    if (e2eeActive && e2eeCliToAppKey) {
+        const { payload, ...envelope } = response;
+        dataWs.send(JSON.stringify({ ...envelope, enc: e2eeEncrypt(payload) }));
+    }
+    else {
+        dataWs.send(JSON.stringify(response));
+    }
 }
 function normalizeGatewayUrl(input) {
     const raw = input.trim();
@@ -2461,6 +2487,13 @@ async function createSessionFromManager() {
     }
     return (await response.json());
 }
+async function connectToCloudSession(sessionCode) {
+    const response = await fetch(`${MANAGER_URL}/v1/session/${sessionCode}`);
+    if (!response.ok) {
+        throw new Error(`Failed to look up cloud session ${sessionCode}: ${response.status}`);
+    }
+    return (await response.json());
+}
 function displayQR(primaryGateway, backupGateway, code) {
     console.log("\n");
     qrcode.generate(code, { small: true }, (qr) => {
@@ -2498,6 +2531,8 @@ function buildWsUrl(gatewayUrl, role, channel) {
 function gracefulShutdown() {
     shuttingDown = true;
     console.log("\nShutting down...");
+    void aiManager?.destroy();
+    stopVmHeartbeat();
     stopPortSync();
     if (ptyProcess) {
         ptyProcess.kill();
@@ -2575,6 +2610,8 @@ async function connectWebSocket() {
                             if (message.type === "connected")
                                 return;
                             if (message.type === "session_password" && message.password) {
+                                if (!currentSessionPassword)
+                                    resetReplayBuffer(); // new session
                                 currentSessionPassword = message.password;
                                 console.log("[session] received reconnect password");
                                 return;
@@ -2640,9 +2677,41 @@ async function connectWebSocket() {
                 });
                 dataWs.on("message", async (data) => {
                     try {
-                        const message = JSON.parse(data.toString());
-                        if (message.type === "connected")
+                        const raw = JSON.parse(data.toString());
+                        if (raw.type === "connected")
+                            return;
+                        // E2EE handshake messages (always plaintext)
+                        if (raw.type === "e2ee_hello" && typeof raw.pubkey === "string") {
+                            e2eeHandlePeerHello(raw.pubkey, dataWs);
+                            return;
+                        }
+                        if (raw.type === "e2ee_secure_ready") {
+                            e2eeHandlePeerReady();
+                            return;
+                        }
+                        // Reconnect request: reset E2EE so fresh handshake happens, then replay
+                        if (raw.ns === "system" && raw.action === "reconnect") {
+                            e2eeReset();
+                            const lastSeq = Number(raw.payload?.lastSeq ?? 0);
+                            const toReplay = replayBuffer.filter((e) => e.seq > lastSeq);
+                            console.log(`[replay] replaying ${toReplay.length} messages after seq ${lastSeq}`);
+                            // Replay without encryption — E2EE handshake hasn't completed yet
+                            for (const entry of toReplay)
+                                dataWs.send(JSON.stringify(entry.msg));
                             return;
+                        }
+                        // Decrypt payload if E2EE is active
+                        let message = raw;
+                        if (e2eeActive && typeof raw.enc === "string") {
+                            try {
+                                message = { ...raw, payload: e2eeDecrypt(raw.enc) };
+                                delete message.enc;
+                            }
+                            catch (decErr) {
+                                console.error("[e2ee] decryption failed:", decErr.message);
+                                return;
+                            }
+                        }
                         if (isProtocolResponse(message)) {
                             // Ignore server/app responses forwarded over WS; CLI only processes requests.
                             return;
@@ -2659,6 +2728,12 @@ async function connectWebSocket() {
                     }
                 });
                 dataWs.on("close", (code, reason) => {
+                    // Reset backpressure state so reconnect starts fresh
+                    dataChannelPaused = false;
+                    if (dataChannelDrainTimer) {
+                        clearInterval(dataChannelDrainTimer);
+                        dataChannelDrainTimer = null;
+                    }
                     if (!settled) {
                         failConnection(`data close before ready (${code}: ${reason.toString()})`);
                         return;
@@ -2710,43 +2785,50 @@ async function main() {
     if (EXTRA_PORTS.length > 0) {
         console.log(`Extra ports enabled: ${EXTRA_PORTS.join(", ")}`);
     }
+    // Detect cloud VM mode
+    cloudJobConfig = await readCloudJobConfig();
+    if (cloudJobConfig?.session_code) {
+        console.log(`[cloud] Running in VM mode (sandbox: ${cloudJobConfig.sandbox_id})`);
+    }
     try {
         console.log("Checking PTY runtime...");
         await ensurePtyBinaryReady();
         console.log("PTY runtime ready.\n");
-        // Generate auth credentials (like CodeNomad does)
-        const opencodeUsername = "lunel";
-        const opencodePassword = crypto.randomBytes(32).toString("base64url");
-        const authHeader = `Basic ${Buffer.from(`${opencodeUsername}:${opencodePassword}`).toString("base64")}`;
-        // Set auth env vars BEFORE spawning opencode
-        process.env.OPENCODE_SERVER_USERNAME = opencodeUsername;
-        process.env.OPENCODE_SERVER_PASSWORD = opencodePassword;
-        // Start OpenCode server with random port (like CodeNomad: --port 0)
-        console.log("Starting OpenCode...");
-        const server = await createOpencodeServer({
-            hostname: "127.0.0.1",
-            port: 0,
-            timeout: 15000,
-        });
-        console.log(`OpenCode server listening on ${server.url}`);
-        // Create client with auth headers
-        const client = createOpencodeClient({
-            baseUrl: server.url,
-            headers: {
-                "Authorization": authHeader,
-            },
+        // Start both AI backends (OpenCode + Codex). Unavailable ones are skipped.
+        aiManager = await createAiManager();
+        // Wire provider events → mobile app data channel, tagged with backend name.
+        aiManager.subscribe((backend, event) => {
+            if (dataChannel && dataChannel.readyState === WebSocket.OPEN) {
+                sendSequenced(dataChannel, {
+                    v: 1,
+                    id: `evt-${Date.now()}`,
+                    ns: "ai",
+                    action: "event",
+                    payload: { ...event, backend },
+                });
+                checkDataChannelBackpressure();
+            }
         });
-        opencodeClient = client;
-        console.log("OpenCode ready.\n");
-        // Subscribe to OpenCode events
-        subscribeToOpenCodeEvents(client);
-        const session = await createSessionFromManager();
+        let session;
+        if (cloudJobConfig?.session_code) {
+            // Cloud mode: connect to an existing session assigned by the manager
+            session = await connectToCloudSession(cloudJobConfig.session_code);
+            console.log(`[cloud] Connected to session ${session.code} via ${session.primary}`);
+        }
+        else {
+            // Public mode: create a new session and show QR code
+            session = await createSessionFromManager();
+            displayQR(normalizeGatewayUrl(session.primary), session.backup ? normalizeGatewayUrl(session.backup) : null, session.code);
+        }
         currentPrimaryGateway = normalizeGatewayUrl(session.primary);
         currentBackupGateway = session.backup ? normalizeGatewayUrl(session.backup) : null;
         currentSessionPassword = session.password;
         activeGatewayUrl = currentPrimaryGateway;
         currentSessionCode = session.code;
-        displayQR(currentPrimaryGateway, currentBackupGateway, session.code);
+        // Start VM heartbeat in cloud mode (session.password = resumeToken)
+        if (cloudJobConfig?.session_code) {
+            startVmHeartbeat(session.password);
+        }
         await connectWebSocket();
     }
     catch (error) {