lunel-cli 0.1.84 → 0.1.86

package/dist/index.js

@@ -2,13 +2,14 @@
 import { WebSocket } from "ws";
 import qrcode from "qrcode-terminal";
 import { createAiManager } from "./ai/index.js";
-import * as crypto from "crypto";
+import { V2SessionTransport } from "./transport/v2.js";
 import Ignore from "ignore";
 const ignore = Ignore.default;
 import * as fs from "fs/promises";
 import * as fssync from "fs";
 import * as path from "path";
 import * as os from "os";
+import { randomBytes } from "crypto";
 import { spawn, spawnSync, execSync, execFileSync } from "child_process";
 import { createServer, createConnection } from "net";
 import { createInterface } from "readline";
@@ -68,8 +69,7 @@ let currentSessionPassword = null;
 let currentPrimaryGateway = DEFAULT_PROXY_URL;
 let activeGatewayUrl = DEFAULT_PROXY_URL;
 let shuttingDown = false;
-let activeControlWs = null;
-let activeDataWs = null;
+let activeV2Transport = null;
 function logWithTimestamp(scope, message, fields) {
     if (!DEBUG_MODE)
         return;
@@ -258,24 +258,6 @@ function samePortSet(a, b) {
     }
     return true;
 }
-function isProtocolRequest(value) {
-    if (!value || typeof value !== "object")
-        return false;
-    const msg = value;
-    return (msg.v === 1 &&
-        typeof msg.id === "string" &&
-        typeof msg.ns === "string" &&
-        typeof msg.action === "string" &&
-        typeof msg.payload === "object" &&
-        msg.payload !== null &&
-        typeof msg.ok === "undefined");
-}
-function isProtocolResponse(value) {
-    if (!value || typeof value !== "object")
-        return false;
-    const msg = value;
-    return msg.v === 1 && typeof msg.id === "string" && typeof msg.ok === "boolean";
-}
 // ============================================================================
 // Path Safety
 // ============================================================================
@@ -321,7 +303,7 @@ function assertSafePath(requestedPath) {
 }
 function generatePersistentSecret(length) {
     const alphabet = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
-    const bytes = crypto.randomBytes(length);
+    const bytes = randomBytes(length);
     let out = "";
     for (let i = 0; i < length; i++) {
         out += alphabet[bytes[i] % alphabet.length];
@@ -947,169 +929,12 @@ async function handleGitDiscard(payload) {
     }
     return {};
 }
-// ============================================================================
-// Terminal Handlers (delegates to Rust PTY binary)
-// ============================================================================
-let dataChannel = null;
-let e2eeKeyPair = null;
-let e2eeCliToAppKey = null; // AES-256-GCM key, CLI→App direction
-let e2eeAppToCliKey = null; // AES-256-GCM key, App→CLI direction
-let e2eeActive = false;
-let e2eeSentReady = false;
-let e2eeGotReady = false;
-// No outbound counter — we generate a full 96-bit random nonce per message.
-// AES-GCM nonce uniqueness is guaranteed by CSPRNG with negligible collision
-// probability (birthday bound: ~2^48 messages before 2^-32 collision risk).
-function e2eeReset() {
-    e2eeKeyPair = null;
-    e2eeCliToAppKey = null;
-    e2eeAppToCliKey = null;
-    e2eeActive = false;
-    e2eeSentReady = false;
-    e2eeGotReady = false;
-}
-function e2eeHandlePeerHello(peerPubkeyB64, dataWs) {
-    const kp = crypto.generateKeyPairSync("ec", { namedCurve: "P-256" });
-    e2eeKeyPair = kp;
-    const peerDer = Buffer.from(peerPubkeyB64, "base64url");
-    const peerPubKey = crypto.createPublicKey({ key: peerDer, type: "spki", format: "der" });
-    const sharedSecret = crypto.diffieHellman({ privateKey: kp.privateKey, publicKey: peerPubKey });
-    const salt = Buffer.alloc(32);
-    e2eeCliToAppKey = Buffer.from(crypto.hkdfSync("sha256", sharedSecret, salt, Buffer.from("lunel-cli-to-app"), 32));
-    e2eeAppToCliKey = Buffer.from(crypto.hkdfSync("sha256", sharedSecret, salt, Buffer.from("lunel-app-to-cli"), 32));
-    // Send our own pubkey so the app can derive the same shared secret
-    const mySpki = kp.publicKey.export({ type: "spki", format: "der" });
-    dataWs.send(JSON.stringify({ type: "e2ee_hello", pubkey: Buffer.from(mySpki).toString("base64url") }));
-    dataWs.send(JSON.stringify({ type: "e2ee_secure_ready" }));
-    e2eeSentReady = true;
-    if (e2eeGotReady) {
-        e2eeActive = true;
-        debugLog("[e2ee] encryption active");
-    }
-}
-function e2eeHandlePeerReady() {
-    e2eeGotReady = true;
-    if (e2eeSentReady) {
-        e2eeActive = true;
-        debugLog("[e2ee] encryption active");
-    }
-}
-function e2eeEncrypt(payload) {
-    if (!e2eeCliToAppKey)
-        throw new Error("[e2ee] CLI→App key not ready");
-    // Full 96-bit random nonce — safe across reconnects with no counter state.
-    const nonce = crypto.randomBytes(12);
-    const plain = Buffer.from(JSON.stringify(payload));
-    const cipher = crypto.createCipheriv("aes-256-gcm", e2eeCliToAppKey, nonce);
-    const ct = Buffer.concat([cipher.update(plain), cipher.final()]);
-    const tag = cipher.getAuthTag();
-    // wire: nonce(12) || ct || tag(16) — consistent with WebCrypto AES-GCM format on app side
-    return Buffer.concat([nonce, ct, tag]).toString("base64url");
-}
-function e2eeDecrypt(enc) {
-    if (!e2eeAppToCliKey)
-        throw new Error("[e2ee] App→CLI key not ready");
-    const buf = Buffer.from(enc, "base64url");
-    const nonce = buf.subarray(0, 12);
-    const ct = buf.subarray(12, buf.length - 16);
-    const tag = buf.subarray(buf.length - 16);
-    const decipher = crypto.createDecipheriv("aes-256-gcm", e2eeAppToCliKey, nonce);
-    decipher.setAuthTag(tag);
-    return JSON.parse(Buffer.concat([decipher.update(ct), decipher.final()]).toString("utf-8"));
-}
-// ============================================================================
-// Replay buffer + backpressure
-// ============================================================================
-// Replay buffer for sequenced outbound data-channel messages
-let outboundSeq = 0;
-let lastSentSeq = 0; // highest seq actually flushed to the socket (not paused)
-const REPLAY_BUFFER_MAX_MESSAGES = 500;
-const REPLAY_BUFFER_MAX_BYTES = 10 * 1024 * 1024; // 10 MB
-const replayBuffer = [];
-let replayBufferBytes = 0;
-// Data-channel backpressure
-const DATA_CHANNEL_HIGH_WATER_BYTES = 1 * 1024 * 1024; // 1 MB — pause forwarding
-const DATA_CHANNEL_LOW_WATER_BYTES = 256 * 1024; // 256 KB — resume forwarding
-let dataChannelPaused = false;
-let dataChannelDrainTimer = null;
-function sendOnDataChannel(ws, msg) {
-    if (e2eeActive && e2eeCliToAppKey) {
-        const { payload, ...envelope } = msg;
-        ws.send(JSON.stringify({ ...envelope, enc: e2eeEncrypt(payload) }));
-    }
-    else {
-        ws.send(JSON.stringify(msg));
-    }
-}
-function sendSequenced(channel, msg) {
-    const seq = ++outboundSeq;
-    const msgWithSeq = { ...msg, seq };
-    const byteLen = Buffer.byteLength(JSON.stringify(msgWithSeq), "utf-8");
-    replayBuffer.push({ seq, msg: msgWithSeq, byteLen });
-    replayBufferBytes += byteLen;
-    while (replayBuffer.length > REPLAY_BUFFER_MAX_MESSAGES || replayBufferBytes > REPLAY_BUFFER_MAX_BYTES) {
-        const evicted = replayBuffer.shift();
-        if (evicted)
-            replayBufferBytes -= evicted.byteLen;
-    }
-    // Skip the actual send while backpressured — event is already in replay buffer
-    if (channel.readyState === WebSocket.OPEN && !dataChannelPaused) {
-        sendOnDataChannel(channel, msgWithSeq);
-        lastSentSeq = seq;
-    }
-}
-function resetReplayBuffer() {
-    outboundSeq = 0;
-    lastSentSeq = 0;
-    replayBuffer.length = 0;
-    replayBufferBytes = 0;
-    dataChannelPaused = false;
-    e2eeReset();
-    if (dataChannelDrainTimer) {
-        clearInterval(dataChannelDrainTimer);
-        dataChannelDrainTimer = null;
-    }
-}
-function resumeDataChannel() {
-    if (!dataChannelPaused)
-        return;
-    dataChannelPaused = false;
-    if (dataChannelDrainTimer) {
-        clearInterval(dataChannelDrainTimer);
-        dataChannelDrainTimer = null;
-    }
-    // Flush events that were buffered during the pause (re-encrypts with current key)
-    const toFlush = replayBuffer.filter((e) => e.seq > lastSentSeq);
-    if (dataChannel?.readyState === WebSocket.OPEN) {
-        for (const entry of toFlush) {
-            sendOnDataChannel(dataChannel, entry.msg);
-            lastSentSeq = entry.seq;
-        }
-    }
-    debugLog(`[backpressure] data channel resumed, flushed ${toFlush.length} buffered events`);
-    if (activeControlWs?.readyState === WebSocket.OPEN) {
-        const buffered = dataChannel?.bufferedAmount ?? 0;
-        activeControlWs.send(JSON.stringify({ type: "data_channel_resumed", bufferedBytes: buffered }));
-    }
-}
-function checkDataChannelBackpressure() {
-    if (!dataChannel || dataChannel.readyState !== WebSocket.OPEN)
-        return;
-    const buffered = dataChannel.bufferedAmount ?? 0;
-    if (!dataChannelPaused && buffered > DATA_CHANNEL_HIGH_WATER_BYTES) {
-        dataChannelPaused = true;
-        debugWarn(`[backpressure] data channel paused (${buffered} bytes buffered)`);
-        if (activeControlWs?.readyState === WebSocket.OPEN) {
-            activeControlWs.send(JSON.stringify({ type: "data_channel_paused", bufferedBytes: buffered }));
-        }
-        if (!dataChannelDrainTimer) {
-            dataChannelDrainTimer = setInterval(() => {
-                const current = dataChannel?.bufferedAmount ?? 0;
-                if (current < DATA_CHANNEL_LOW_WATER_BYTES || !dataChannel || dataChannel.readyState !== WebSocket.OPEN) {
-                    resumeDataChannel();
-                }
-            }, 100);
-        }
+function emitAppEvent(msg) {
+    if (activeV2Transport) {
+        void activeV2Transport.sendMessage(msg).catch((error) => {
+            if (DEBUG_MODE)
+                console.error("[transport:v2] failed to send event:", error instanceof Error ? error.message : String(error));
+        });
     }
 }
 let ensurePtyBinaryPromise = null;
@@ -1298,45 +1123,41 @@ async function ensurePtyProcess() {
         }
         else if (event.event === "state") {
             // Forward screen state to app via data channel
-            if (dataChannel && dataChannel.readyState === WebSocket.OPEN) {
-                const msg = {
-                    v: 1,
-                    id: `evt-${Date.now()}`,
-                    ns: "terminal",
-                    action: "state",
-                    payload: {
-                        terminalId: event.id,
-                        cells: event.cells,
-                        cursorX: event.cursorX,
-                        cursorY: event.cursorY,
-                        cols: event.cols,
-                        rows: event.rows,
-                        cursorVisible: event.cursorVisible,
-                        cursorStyle: event.cursorStyle,
-                        appCursorKeys: event.appCursorKeys,
-                        bracketedPaste: event.bracketedPaste,
-                        mouseMode: event.mouseMode,
-                        mouseEncoding: event.mouseEncoding,
-                        reverseVideo: event.reverseVideo,
-                        title: event.title,
-                        scrollbackLength: event.scrollbackLength,
-                    },
-                };
-                sendSequenced(dataChannel, msg);
-            }
+            const msg = {
+                v: 1,
+                id: `evt-${Date.now()}`,
+                ns: "terminal",
+                action: "state",
+                payload: {
+                    terminalId: event.id,
+                    cells: event.cells,
+                    cursorX: event.cursorX,
+                    cursorY: event.cursorY,
+                    cols: event.cols,
+                    rows: event.rows,
+                    cursorVisible: event.cursorVisible,
+                    cursorStyle: event.cursorStyle,
+                    appCursorKeys: event.appCursorKeys,
+                    bracketedPaste: event.bracketedPaste,
+                    mouseMode: event.mouseMode,
+                    mouseEncoding: event.mouseEncoding,
+                    reverseVideo: event.reverseVideo,
+                    title: event.title,
+                    scrollbackLength: event.scrollbackLength,
+                },
+            };
+            emitAppEvent(msg);
         }
         else if (event.event === "exit") {
             terminals.delete(event.id);
-            if (dataChannel && dataChannel.readyState === WebSocket.OPEN) {
-                const msg = {
-                    v: 1,
-                    id: `evt-${Date.now()}`,
-                    ns: "terminal",
-                    action: "exit",
-                    payload: { terminalId: event.id, code: event.code },
-                };
-                sendSequenced(dataChannel, msg);
-            }
+            const msg = {
+                v: 1,
+                id: `evt-${Date.now()}`,
+                ns: "terminal",
+                action: "exit",
+                payload: { terminalId: event.id, code: event.code },
+            };
+            emitAppEvent(msg);
         }
         else if (event.event === "error") {
             console.error(`[pty] Error for ${event.id}: ${event.message}`);
@@ -1478,30 +1299,26 @@ function handleProcessesSpawn(payload) {
         const text = data.toString();
         managedProc.output.push(text);
         processOutputBuffers.set(channel, (processOutputBuffers.get(channel) || "") + text);
-        if (dataChannel && dataChannel.readyState === WebSocket.OPEN) {
-            const msg = {
-                v: 1,
-                id: `evt-${Date.now()}`,
-                ns: "processes",
-                action: "output",
-                payload: { pid, channel, stream, data: text },
-            };
-            sendSequenced(dataChannel, msg);
-        }
+        const msg = {
+            v: 1,
+            id: `evt-${Date.now()}`,
+            ns: "processes",
+            action: "output",
+            payload: { pid, channel, stream, data: text },
+        };
+        emitAppEvent(msg);
     };
     proc.stdout?.on("data", sendOutput("stdout"));
     proc.stderr?.on("data", sendOutput("stderr"));
     proc.on("close", (code, signal) => {
-        if (dataChannel && dataChannel.readyState === WebSocket.OPEN) {
-            const msg = {
-                v: 1,
-                id: `evt-${Date.now()}`,
-                ns: "processes",
-                action: "exit",
-                payload: { pid, channel, code, signal },
-            };
-            dataChannel.send(JSON.stringify(msg));
-        }
+        const msg = {
+            v: 1,
+            id: `evt-${Date.now()}`,
+            ns: "processes",
+            action: "exit",
+            payload: { pid, channel, code, signal },
+        };
+        emitAppEvent(msg);
     });
     return { pid, channel };
 }
@@ -1953,10 +1770,10 @@ async function scanDevPorts() {
     await Promise.all(checks);
     return openPorts.sort((a, b) => a - b);
 }
-async function publishDiscoveredPorts(ws, force = false) {
+async function publishDiscoveredPorts(force = false) {
     if (portScanInFlight)
         return;
-    if (ws.readyState !== WebSocket.OPEN)
+    if (!activeV2Transport)
         return;
     portScanInFlight = true;
     try {
@@ -1965,13 +1782,13 @@ async function publishDiscoveredPorts(ws, force = false) {
             return;
         }
         lastDiscoveredPorts = openPorts;
-        ws.send(JSON.stringify({
+        emitAppEvent({
             v: 1,
             id: `evt-${Date.now()}`,
             ns: "proxy",
             action: "ports_discovered",
             payload: { ports: openPorts },
-        }));
+        });
         debugLog(`[proxy] ports updated (${openPorts.length}): ${openPorts.join(", ") || "-"}`);
     }
     catch (err) {
@@ -1988,11 +1805,11 @@ function stopPortSync() {
     }
     portScanInFlight = false;
 }
-function startPortSync(ws) {
+function startPortSync() {
     stopPortSync();
-    void publishDiscoveredPorts(ws, true);
+    void publishDiscoveredPorts(true);
     portSyncTimer = setInterval(() => {
-        void publishDiscoveredPorts(ws, false);
+        void publishDiscoveredPorts(false);
     }, PORT_SYNC_INTERVAL_MS);
 }
 async function handleProxyConnect(payload) {
@@ -2576,23 +2393,6 @@ async function processMessage(message) {
         };
     }
 }
-function sendResponseOnData(response, dataWs) {
-    const pathValue = typeof response.payload?.path === "string" ? response.payload.path : null;
-    logWithTimestamp("router", "sending response on data", {
-        id: response.id,
-        ns: response.ns,
-        action: response.action,
-        path: pathValue,
-        ok: response.ok,
-    });
-    if (e2eeActive && e2eeCliToAppKey) {
-        const { payload, ...envelope } = response;
-        dataWs.send(JSON.stringify({ ...envelope, enc: e2eeEncrypt(payload) }));
-    }
-    else {
-        dataWs.send(JSON.stringify(response));
-    }
-}
 function normalizeGatewayUrl(input) {
     const raw = input.trim();
     if (!raw) {
@@ -2726,25 +2526,13 @@ function displayQR(code) {
         console.log("  Press Ctrl+C to exit.\n");
     });
 }
-function buildWsUrl(gatewayUrl, role, channel) {
-    const wsBase = gatewayUrl.replace(/^https:/, "wss:");
-    if (!wsBase.startsWith("wss://")) {
-        throw new Error("Gateway URL must use https://");
-    }
-    const query = new URLSearchParams();
-    if (currentSessionPassword) {
-        query.set("password", currentSessionPassword);
-    }
-    else {
-        throw new Error("missing password for websocket connect");
-    }
-    return `${wsBase}/v1/ws/${role}/${channel}?${query.toString()}`;
-}
 function gracefulShutdown() {
     shuttingDown = true;
     console.log("\nShutting down...");
     void aiManager?.destroy();
     stopPortSync();
+    activeV2Transport?.close();
+    activeV2Transport = null;
     if (ptyProcess) {
         ptyProcess.kill();
         ptyProcess = null;
@@ -2756,208 +2544,72 @@ function gracefulShutdown() {
     processes.clear();
     processOutputBuffers.clear();
     cleanupAllTunnels();
-    if (activeControlWs && (activeControlWs.readyState === WebSocket.OPEN || activeControlWs.readyState === WebSocket.CONNECTING)) {
-        activeControlWs.close();
-    }
-    if (activeDataWs && (activeDataWs.readyState === WebSocket.OPEN || activeDataWs.readyState === WebSocket.CONNECTING)) {
-        activeDataWs.close();
-    }
     process.exit(0);
 }
-async function connectWebSocket() {
+async function connectWebSocketV2() {
     const gatewayUrl = currentPrimaryGateway;
-    await new Promise((resolve, reject) => {
-        activeGatewayUrl = gatewayUrl;
-        const controlUrl = buildWsUrl(gatewayUrl, "cli", "control");
-        const dataUrl = buildWsUrl(gatewayUrl, "cli", "data");
-        console.log(`Connecting to gateway ${gatewayUrl}...`);
-        const controlWs = new WebSocket(controlUrl);
-        const dataWs = new WebSocket(dataUrl);
-        activeControlWs = controlWs;
-        activeDataWs = dataWs;
-        dataChannel = dataWs;
-        let controlConnected = false;
-        let dataConnected = false;
-        let settled = false;
-        let closeHandled = false;
-        let closeReason = "";
-        const failConnection = (reason) => {
-            if (settled)
-                return;
-            settled = true;
-            reject(new Error(reason));
-        };
-        const checkFullyConnected = () => {
-            if (controlConnected && dataConnected && !settled) {
-                settled = true;
-                console.log("Connected to gateway (control + data channels).\n");
-                resolve();
-            }
-        };
-        const handleClose = (reason) => {
-            if (closeHandled || shuttingDown)
-                return;
-            closeHandled = true;
-            closeReason = reason;
-            stopPortSync();
-            cleanupAllTunnels();
-            setTimeout(() => {
-                if (shuttingDown)
-                    return;
-                void handleConnectionDrop(closeReason);
-            }, 50);
-        };
-        controlWs.on("open", () => {
-            controlConnected = true;
-            checkFullyConnected();
-        });
-        controlWs.on("message", async (data) => {
-            try {
-                const message = JSON.parse(data.toString());
-                if ("type" in message) {
-                    if (message.type === "connected")
-                        return;
-                    if (message.type === "peer_connected") {
-                        console.log("App connected!\n");
-                        startPortSync(controlWs);
-                        return;
-                    }
-                    if (message.type === "peer_disconnected") {
-                        console.log("App disconnected. Waiting for reconnect window.\n");
-                        stopPortSync();
-                        return;
-                    }
-                    if (message.type === "app_disconnected") {
-                        if (message.reconnectDeadline) {
-                            console.log(`[session] app disconnected, waiting until ${new Date(message.reconnectDeadline).toISOString()}`);
-                        }
-                        return;
-                    }
-                    if (message.type === "close_connection") {
-                        const reason = message.reason || "expired";
-                        console.log(`[session] closed by gateway: ${reason}`);
-                        if (reason === "session ended from app") {
-                            console.log("[session] Run `npx lunel-cli` again and scan the new QR code to reconnect.");
-                        }
-                        gracefulShutdown();
-                        return;
-                    }
-                }
-                if (isProtocolResponse(message)) {
-                    // Ignore server/app responses forwarded over WS; CLI only processes requests.
-                    return;
-                }
-                if (isProtocolRequest(message)) {
-                    const response = await processMessage(message);
-                    sendResponseOnData(response, dataWs);
-                    return;
-                }
-                debugWarn("[router] Ignoring non-request control frame");
-            }
-            catch (error) {
-                if (DEBUG_MODE)
-                    console.error("Error processing control message:", error);
-            }
-        });
-        controlWs.on("close", (code, reason) => {
-            if (!settled) {
-                failConnection(`control close before ready (${code}: ${reason.toString()})`);
-                return;
-            }
-            handleClose(`control closed (${code}: ${reason.toString()})`);
-        });
-        controlWs.on("error", (error) => {
-            if (!settled) {
-                failConnection(`control ws error: ${error.message}`);
-                return;
-            }
-            if (DEBUG_MODE)
-                console.error("Control WebSocket error:", error.message);
-        });
-        dataWs.on("open", () => {
-            dataConnected = true;
-            checkFullyConnected();
-        });
-        dataWs.on("message", async (data) => {
-            try {
-                const raw = JSON.parse(data.toString());
-                if (raw.type === "connected")
+    if (!currentSessionPassword) {
+        throw new Error("missing password for websocket connect");
+    }
+    console.log(`Connecting to gateway ${gatewayUrl}...`);
+    activeGatewayUrl = gatewayUrl;
+    const transport = new V2SessionTransport({
+        gatewayUrl,
+        password: currentSessionPassword,
+        role: "cli",
+        debugLog: DEBUG_MODE ? debugLog : undefined,
+        handlers: {
+            onSystemMessage: async (message) => {
+                if (message.type === "connected")
                     return;
-                // E2EE handshake messages (always plaintext)
-                if (raw.type === "e2ee_hello" && typeof raw.pubkey === "string") {
-                    e2eeHandlePeerHello(raw.pubkey, dataWs);
+                if (message.type === "peer_connected") {
+                    console.log("App connected!\n");
+                    startPortSync();
                     return;
                 }
-                if (raw.type === "e2ee_secure_ready") {
-                    e2eeHandlePeerReady();
+                if (message.type === "peer_disconnected") {
+                    console.log("App disconnected. Waiting for reconnect window.\n");
+                    stopPortSync();
                     return;
                 }
-                // Reconnect request: reset E2EE so fresh handshake happens, then replay
-                if (raw.ns === "system" && raw.action === "reconnect") {
-                    e2eeReset();
-                    const lastSeq = Number(raw.payload?.lastSeq ?? 0);
-                    const toReplay = replayBuffer.filter((e) => e.seq > lastSeq);
-                    debugLog(`[replay] replaying ${toReplay.length} messages after seq ${lastSeq}`);
-                    // Replay without encryption — E2EE handshake hasn't completed yet
-                    for (const entry of toReplay)
-                        dataWs.send(JSON.stringify(entry.msg));
+                if (message.type === "app_disconnected") {
+                    if (message.reconnectDeadline) {
+                        console.log(`[session] app disconnected, waiting until ${new Date(message.reconnectDeadline).toISOString()}`);
+                    }
                     return;
                 }
-                // Decrypt payload if E2EE is active
-                let message = raw;
-                if (e2eeActive && typeof raw.enc === "string") {
-                    try {
-                        message = { ...raw, payload: e2eeDecrypt(raw.enc) };
-                        delete message.enc;
+                if (message.type === "close_connection") {
+                    const reason = message.reason || "expired";
+                    console.log(`[session] closed by gateway: ${reason}`);
+                    if (reason === "session ended from app") {
+                        console.log("[session] Run `npx lunel-cli` again and scan the new QR code to reconnect.");
                     }
-                    catch (decErr) {
-                        console.error("[e2ee] decryption failed:", decErr.message);
-                        return;
-                    }
-                }
-                if (isProtocolResponse(message)) {
-                    // Ignore server/app responses forwarded over WS; CLI only processes requests.
-                    return;
+                    gracefulShutdown();
                 }
-                if (isProtocolRequest(message)) {
-                    const response = await processMessage(message);
-                    sendResponseOnData(response, dataWs);
+            },
+            onProtocolRequest: async (message) => {
+                return await processMessage(message);
+            },
+            onProtocolResponse: async () => {
+                // CLI does not currently await app responses outside request/reply routing.
+            },
+            onClose: (reason) => {
+                if (shuttingDown)
                     return;
-                }
-                debugWarn("[router] Ignoring non-request data frame");
-            }
-            catch (error) {
-                if (DEBUG_MODE)
-                    console.error("Error processing data message:", error);
-            }
-        });
-        dataWs.on("close", (code, reason) => {
-            // Reset backpressure state so reconnect starts fresh
-            dataChannelPaused = false;
-            if (dataChannelDrainTimer) {
-                clearInterval(dataChannelDrainTimer);
-                dataChannelDrainTimer = null;
-            }
-            if (!settled) {
-                failConnection(`data close before ready (${code}: ${reason.toString()})`);
-                return;
-            }
-            handleClose(`data closed (${code}: ${reason.toString()})`);
-        });
-        dataWs.on("error", (error) => {
-            if (!settled) {
-                failConnection(`data ws error: ${error.message}`);
-                return;
-            }
-            if (DEBUG_MODE)
-                console.error("Data WebSocket error:", error.message);
-        });
-        setTimeout(() => {
-            if (!settled) {
-                failConnection("connection timeout");
-            }
-        }, 10000);
+                stopPortSync();
+                cleanupAllTunnels();
+                activeV2Transport = null;
+                setTimeout(() => {
+                    if (shuttingDown)
+                        return;
+                    void handleConnectionDrop(reason);
+                }, 50);
+            },
+        },
     });
+    activeV2Transport = transport;
+    await transport.connect();
+    console.log("Connected to gateway (single secure session).\n");
 }
 async function handleConnectionDrop(reason) {
     if (shuttingDown)
@@ -2975,7 +2627,7 @@ async function handleConnectionDrop(reason) {
         const delayMs = Math.round(base * (0.8 + Math.random() * 0.4));
         try {
             currentPrimaryGateway = await getAssignedProxyUrl(currentSessionPassword);
-            await connectWebSocket();
+            await connectWebSocketV2();
             debugLog(`[reconnect] connected via ${activeGatewayUrl}`);
             return;
         }
@@ -3007,16 +2659,13 @@ async function main() {
         aiManager = await createAiManager();
         // Wire provider events → mobile app data channel, tagged with backend name.
         aiManager.subscribe((backend, event) => {
-            if (dataChannel && dataChannel.readyState === WebSocket.OPEN) {
-                sendSequenced(dataChannel, {
-                    v: 1,
-                    id: `evt-${Date.now()}`,
-                    ns: "ai",
-                    action: "event",
-                    payload: { ...event, backend },
-                });
-                checkDataChannelBackpressure();
-            }
+            emitAppEvent({
+                v: 1,
+                id: `evt-${Date.now()}`,
+                ns: "ai",
+                action: "event",
+                payload: { ...event, backend },
+            });
         });
         let sessionCodeToUse = null;
         let sessionPasswordToUse;
@@ -3046,12 +2695,11 @@ async function main() {
             sessionPasswordToUse = assembled.password;
             await saveSessionForRoot(sessionCodeToUse, sessionPasswordToUse);
         }
-        resetReplayBuffer();
         currentSessionCode = sessionCodeToUse;
         currentSessionPassword = sessionPasswordToUse;
         currentPrimaryGateway = await getAssignedProxyUrl(sessionPasswordToUse);
         activeGatewayUrl = currentPrimaryGateway;
-        await connectWebSocket();
+        await connectWebSocketV2();
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);

package/dist/transport/protocol.d.ts

@@ -0,0 +1,56 @@
+export interface Message {
+    v: 1;
+    id: string;
+    ns: string;
+    action: string;
+    payload: Record<string, unknown>;
+}
+export interface Response {
+    v: 1;
+    id: string;
+    ns: string;
+    action: string;
+    ok: boolean;
+    payload: Record<string, unknown>;
+    error?: {
+        code: string;
+        message: string;
+    };
+}
+export interface SystemMessage {
+    type: "connected" | "peer_connected" | "peer_disconnected" | "error" | "app_disconnected" | "close_connection" | "e2ee_hello" | "e2ee_secure_ready";
+    role?: string;
+    channel?: string;
+    peer?: string;
+    pubkey?: string;
+    reconnectDeadline?: number;
+    reason?: string;
+    payload?: Record<string, unknown>;
+}
+export type V2HandshakeFrame = {
+    t: "lunel_v2";
+    kind: "client_hello";
+    pubkey: string;
+} | {
+    t: "lunel_v2";
+    kind: "server_hello";
+    pubkey: string;
+    header: string;
+} | {
+    t: "lunel_v2";
+    kind: "client_ready";
+    header: string;
+};
+export declare const V2_BINARY_MAGIC_0 = 76;
+export declare const V2_BINARY_MAGIC_1 = 50;
+export declare const V2_FRAME_ENCRYPTED_MESSAGE = 1;
+export declare function isProtocolRequest(value: unknown): value is Message;
+export declare function isProtocolResponse(value: unknown): value is Response;
+export declare function isV2HandshakeFrame(value: unknown): value is V2HandshakeFrame;
+export declare function encodeV2EncryptedFrame(payload: Uint8Array): Uint8Array;
+export declare function decodeV2BinaryFrame(data: Uint8Array): {
+    type: number;
+    payload: Uint8Array;
+} | null;
+export declare function buildSessionV1WsUrl(gatewayUrl: string, role: "cli" | "app", channel: "control" | "data", password: string): string;
+export declare function buildSessionV2WsUrl(gatewayUrl: string, role: "cli" | "app", password: string): string;

package/dist/transport/protocol.js

@@ -0,0 +1,69 @@
+export const V2_BINARY_MAGIC_0 = 0x4c; // L
+export const V2_BINARY_MAGIC_1 = 0x32; // 2
+export const V2_FRAME_ENCRYPTED_MESSAGE = 0x01;
+export function isProtocolRequest(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const msg = value;
+    return (msg.v === 1 &&
+        typeof msg.id === "string" &&
+        typeof msg.ns === "string" &&
+        typeof msg.action === "string" &&
+        typeof msg.payload === "object" &&
+        msg.payload !== null &&
+        typeof msg.ok === "undefined");
+}
+export function isProtocolResponse(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const msg = value;
+    return msg.v === 1 && typeof msg.id === "string" && typeof msg.ok === "boolean";
+}
+export function isV2HandshakeFrame(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const frame = value;
+    if (frame.t !== "lunel_v2" || typeof frame.kind !== "string")
+        return false;
+    if (frame.kind === "client_hello")
+        return typeof frame.pubkey === "string";
+    if (frame.kind === "server_hello")
+        return typeof frame.pubkey === "string" && typeof frame.header === "string";
+    if (frame.kind === "client_ready")
+        return typeof frame.header === "string";
+    return false;
+}
+export function encodeV2EncryptedFrame(payload) {
+    const frame = new Uint8Array(payload.length + 3);
+    frame[0] = V2_BINARY_MAGIC_0;
+    frame[1] = V2_BINARY_MAGIC_1;
+    frame[2] = V2_FRAME_ENCRYPTED_MESSAGE;
+    frame.set(payload, 3);
+    return frame;
+}
+export function decodeV2BinaryFrame(data) {
+    if (data.length < 3)
+        return null;
+    if (data[0] !== V2_BINARY_MAGIC_0 || data[1] !== V2_BINARY_MAGIC_1)
+        return null;
+    return {
+        type: data[2],
+        payload: data.subarray(3),
+    };
+}
+export function buildSessionV1WsUrl(gatewayUrl, role, channel, password) {
+    const wsBase = gatewayUrl.replace(/^https:/, "wss:");
+    if (!wsBase.startsWith("wss://")) {
+        throw new Error("Gateway URL must use https://");
+    }
+    const query = new URLSearchParams({ password });
+    return `${wsBase}/v1/ws/${role}/${channel}?${query.toString()}`;
+}
+export function buildSessionV2WsUrl(gatewayUrl, role, password) {
+    const wsBase = gatewayUrl.replace(/^https:/, "wss:");
+    if (!wsBase.startsWith("wss://")) {
+        throw new Error("Gateway URL must use https://");
+    }
+    const query = new URLSearchParams({ password });
+    return `${wsBase}/v2/ws/${role}?${query.toString()}`;
+}

package/dist/transport/v2.d.ts

@@ -0,0 +1,41 @@
+import type { Message, Response, SystemMessage } from "./protocol.js";
+export interface V2TransportHandlers {
+    onSystemMessage: (message: SystemMessage) => Promise<void> | void;
+    onProtocolRequest: (message: Message) => Promise<Response>;
+    onProtocolResponse?: (message: Response) => Promise<void> | void;
+    onClose: (reason: string) => void;
+}
+export interface V2TransportOptions {
+    gatewayUrl: string;
+    password: string;
+    role: "cli" | "app";
+    handlers: V2TransportHandlers;
+    debugLog?: (message: string, ...args: unknown[]) => void;
+}
+export declare class V2SessionTransport {
+    private readonly options;
+    private ws;
+    private closed;
+    private state;
+    private keyPair;
+    private sessionKeys;
+    private pushState;
+    private pullState;
+    private secureReadyResolve;
+    private secureReadyReject;
+    private secureReadyPromise;
+    constructor(options: V2TransportOptions);
+    connect(): Promise<void>;
+    sendMessage(message: Message): Promise<void>;
+    sendResponse(response: Response): Promise<void>;
+    close(): void;
+    private handleMessage;
+    private maybeStartHandshake;
+    private handleHandshakeFrame;
+    private encryptMessage;
+    private ensureKeyPair;
+    private sendJsonFrame;
+    private sendBinaryFrame;
+    private markSecure;
+    private failSecure;
+}

package/dist/transport/v2.js

@@ -0,0 +1,275 @@
+import { WebSocket } from "ws";
+import { createRequire } from "module";
+import { V2_FRAME_ENCRYPTED_MESSAGE, buildSessionV2WsUrl, decodeV2BinaryFrame, encodeV2EncryptedFrame, isProtocolRequest, isProtocolResponse, isV2HandshakeFrame, } from "./protocol.js";
+const require = createRequire(import.meta.url);
+const sodium = require("libsodium-wrappers");
+function toUint8Array(data) {
+    if (data instanceof Uint8Array)
+        return data;
+    if (Array.isArray(data))
+        return new Uint8Array(Buffer.concat(data.map((chunk) => Buffer.from(chunk))));
+    return new Uint8Array(data);
+}
+export class V2SessionTransport {
+    options;
+    ws = null;
+    closed = false;
+    state = "idle";
+    keyPair = null;
+    sessionKeys = null;
+    pushState = null;
+    pullState = null;
+    secureReadyResolve = null;
+    secureReadyReject = null;
+    secureReadyPromise = null;
+    constructor(options) {
+        this.options = options;
+    }
+    async connect() {
+        if (this.ws && (this.ws.readyState === WebSocket.OPEN || this.ws.readyState === WebSocket.CONNECTING)) {
+            if (this.secureReadyPromise) {
+                return await this.secureReadyPromise;
+            }
+            return;
+        }
+        await sodium.ready;
+        this.secureReadyPromise = new Promise((resolve, reject) => {
+            this.secureReadyResolve = resolve;
+            this.secureReadyReject = reject;
+        });
+        const wsUrl = buildSessionV2WsUrl(this.options.gatewayUrl, this.options.role, this.options.password);
+        await new Promise((resolve, reject) => {
+            const ws = new WebSocket(wsUrl);
+            let opened = false;
+            this.ws = ws;
+            this.closed = false;
+            this.state = "connecting";
+            ws.on("open", () => {
+                opened = true;
+                this.state = "open";
+                resolve();
+            });
+            ws.on("message", async (data) => {
+                try {
+                    await this.handleMessage(data);
+                }
+                catch (error) {
+                    this.options.debugLog?.("[transport:v2] message handling failed", error);
+                    this.failSecure(new Error(error instanceof Error ? error.message : String(error)));
+                    this.close();
+                }
+            });
+            ws.on("close", (code, reason) => {
+                this.ws = null;
+                this.state = "closed";
+                if (!opened) {
+                    reject(new Error(`v2 socket closed during setup (${code}: ${reason.toString()})`));
+                    return;
+                }
+                if (!this.closed) {
+                    this.closed = true;
+                    this.failSecure(new Error(`v2 socket closed (${code}: ${reason.toString()})`));
+                    this.options.handlers.onClose(`v2 socket closed (${code}: ${reason.toString()})`);
+                }
+            });
+            ws.on("error", (error) => {
+                if (!opened) {
+                    reject(new Error(`v2 socket error: ${error.message}`));
+                    return;
+                }
+                this.options.debugLog?.("[transport:v2] websocket error", error.message);
+            });
+        });
+        if (!this.secureReadyPromise) {
+            throw new Error("secure readiness promise missing");
+        }
+        await this.secureReadyPromise;
+    }
+    async sendMessage(message) {
+        const ciphertext = await this.encryptMessage(message);
+        this.sendBinaryFrame(ciphertext);
+    }
+    async sendResponse(response) {
+        const ciphertext = await this.encryptMessage(response);
+        this.sendBinaryFrame(ciphertext);
+    }
+    close() {
+        this.closed = true;
+        this.state = "closed";
+        if (!this.ws)
+            return;
+        if (this.ws.readyState === WebSocket.OPEN || this.ws.readyState === WebSocket.CONNECTING) {
+            this.ws.close();
+        }
+        this.ws = null;
+    }
+    async handleMessage(data) {
+        if (typeof data === "string") {
+            const raw = JSON.parse(data);
+            if ("type" in raw) {
+                await this.options.handlers.onSystemMessage(raw);
+                if (raw.type === "peer_connected") {
+                    await this.maybeStartHandshake();
+                }
+                return;
+            }
+            if (isV2HandshakeFrame(raw)) {
+                await this.handleHandshakeFrame(raw);
+                return;
+            }
+            if (this.state !== "secure") {
+                throw new Error("received plaintext app message before secure transport");
+            }
+            if (isProtocolResponse(raw)) {
+                await this.options.handlers.onProtocolResponse?.(raw);
+                return;
+            }
+            if (isProtocolRequest(raw)) {
+                const response = await this.options.handlers.onProtocolRequest(raw);
+                await this.sendResponse(response);
+                return;
+            }
+            return;
+        }
+        const bytes = toUint8Array(data);
+        const frame = decodeV2BinaryFrame(bytes);
+        if (!frame) {
+            throw new Error("invalid binary v2 frame");
+        }
+        if (frame.type !== V2_FRAME_ENCRYPTED_MESSAGE) {
+            throw new Error(`unsupported v2 frame type ${frame.type}`);
+        }
+        if (this.state !== "secure" || !this.pullState) {
+            throw new Error("received encrypted frame before secure transport");
+        }
+        const pulled = sodium.crypto_secretstream_xchacha20poly1305_pull(this.pullState, frame.payload);
+        if (!pulled.message) {
+            throw new Error("failed to decrypt v2 frame");
+        }
+        const parsed = JSON.parse(sodium.to_string(pulled.message));
+        if (isProtocolResponse(parsed)) {
+            await this.options.handlers.onProtocolResponse?.(parsed);
+            return;
+        }
+        if (isProtocolRequest(parsed)) {
+            const response = await this.options.handlers.onProtocolRequest(parsed);
+            await this.sendResponse(response);
+            return;
+        }
+        throw new Error("invalid decrypted protocol message");
+    }
+    async maybeStartHandshake() {
+        if (this.state === "secure" || this.state === "handshaking")
+            return;
+        if (this.options.role !== "app")
+            return;
+        this.state = "handshaking";
+        const keyPair = this.ensureKeyPair();
+        const hello = {
+            t: "lunel_v2",
+            kind: "client_hello",
+            pubkey: sodium.to_base64(keyPair.publicKey, sodium.base64_variants.URLSAFE_NO_PADDING),
+        };
+        this.sendJsonFrame(hello);
+    }
+    async handleHandshakeFrame(frame) {
+        this.state = "handshaking";
+        if (frame.kind === "client_hello") {
+            if (this.options.role !== "cli") {
+                throw new Error("unexpected client_hello on app transport");
+            }
+            const clientPublicKey = sodium.from_base64(frame.pubkey, sodium.base64_variants.URLSAFE_NO_PADDING);
+            const keyPair = this.ensureKeyPair();
+            const keys = sodium.crypto_kx_server_session_keys(keyPair.publicKey, keyPair.privateKey, clientPublicKey);
+            this.sessionKeys = { rx: keys.sharedRx, tx: keys.sharedTx };
+            const pushInit = sodium.crypto_secretstream_xchacha20poly1305_init_push(keys.sharedTx);
+            this.pushState = pushInit.state;
+            const response = {
+                t: "lunel_v2",
+                kind: "server_hello",
+                pubkey: sodium.to_base64(keyPair.publicKey, sodium.base64_variants.URLSAFE_NO_PADDING),
+                header: sodium.to_base64(pushInit.header, sodium.base64_variants.URLSAFE_NO_PADDING),
+            };
+            this.sendJsonFrame(response);
+            return;
+        }
+        if (frame.kind === "server_hello") {
+            if (this.options.role !== "app") {
+                throw new Error("unexpected server_hello on cli transport");
+            }
+            const serverPublicKey = sodium.from_base64(frame.pubkey, sodium.base64_variants.URLSAFE_NO_PADDING);
+            const serverHeader = sodium.from_base64(frame.header, sodium.base64_variants.URLSAFE_NO_PADDING);
+            const keyPair = this.ensureKeyPair();
+            const keys = sodium.crypto_kx_client_session_keys(keyPair.publicKey, keyPair.privateKey, serverPublicKey);
+            this.sessionKeys = { rx: keys.sharedRx, tx: keys.sharedTx };
+            this.pullState = sodium.crypto_secretstream_xchacha20poly1305_init_pull(serverHeader, keys.sharedRx);
+            const pushInit = sodium.crypto_secretstream_xchacha20poly1305_init_push(keys.sharedTx);
+            this.pushState = pushInit.state;
+            const ready = {
+                t: "lunel_v2",
+                kind: "client_ready",
+                header: sodium.to_base64(pushInit.header, sodium.base64_variants.URLSAFE_NO_PADDING),
+            };
+            this.sendJsonFrame(ready);
+            this.markSecure();
+            return;
+        }
+        if (frame.kind === "client_ready") {
+            if (this.options.role !== "cli") {
+                throw new Error("unexpected client_ready on app transport");
+            }
+            if (!this.sessionKeys) {
+                throw new Error("missing session keys before client_ready");
+            }
+            const clientHeader = sodium.from_base64(frame.header, sodium.base64_variants.URLSAFE_NO_PADDING);
+            this.pullState = sodium.crypto_secretstream_xchacha20poly1305_init_pull(clientHeader, this.sessionKeys.rx);
+            this.markSecure();
+        }
+    }
+    async encryptMessage(message) {
+        await sodium.ready;
+        if (this.state !== "secure" || !this.pushState) {
+            throw new Error("secure transport is not active");
+        }
+        const plaintext = sodium.from_string(JSON.stringify(message));
+        return sodium.crypto_secretstream_xchacha20poly1305_push(this.pushState, plaintext, null, sodium.crypto_secretstream_xchacha20poly1305_TAG_MESSAGE);
+    }
+    ensureKeyPair() {
+        if (this.keyPair)
+            return this.keyPair;
+        const pair = sodium.crypto_kx_keypair();
+        this.keyPair = {
+            publicKey: pair.publicKey,
+            privateKey: pair.privateKey,
+        };
+        return this.keyPair;
+    }
+    sendJsonFrame(frame) {
+        if (!this.ws || this.ws.readyState !== WebSocket.OPEN) {
+            throw new Error("v2 transport is not connected");
+        }
+        this.ws.send(JSON.stringify(frame));
+    }
+    sendBinaryFrame(ciphertext) {
+        if (!this.ws || this.ws.readyState !== WebSocket.OPEN) {
+            throw new Error("v2 transport is not connected");
+        }
+        const framed = encodeV2EncryptedFrame(ciphertext);
+        this.ws.send(Buffer.from(framed));
+    }
+    markSecure() {
+        this.state = "secure";
+        if (this.secureReadyResolve) {
+            this.secureReadyResolve();
+            this.secureReadyResolve = null;
+            this.secureReadyReject = null;
+        }
+    }
+    failSecure(error) {
+        if (this.secureReadyReject) {
+            this.secureReadyReject(error);
+            this.secureReadyResolve = null;
+            this.secureReadyReject = null;
+        }
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lunel-cli",
-  "version": "0.1.84",
+  "version": "0.1.86",
   "author": [
     {
       "name": "Soham Bharambe",
@@ -28,6 +28,7 @@
   "dependencies": {
     "@opencode-ai/sdk": "^1.1.56",
     "ignore": "^6.0.2",
+    "libsodium-wrappers": "^0.7.15",
     "qrcode-terminal": "^0.12.0",
     "ws": "^8.18.0"
   },