ocremote 2.0.1 → 2.1.1

package/README.md

@@ -1,16 +1,14 @@
 # oc-remote
 
 > **Plataformas.** El companion requiere Node >= 22.13 y soporta macOS, Linux y
-> Windows: `npx ocremote --pair` en cualquiera de los tres. Solo en macOS:
-> `--daemon` (LaunchAgent) y mDNS (`--no-mdns` lo desactiva; en otros sistemas ni
-> se intenta). En Linux, para tenerlo siempre activo usa una unidad de usuario de
-> systemd ejecutando `npx ocremote --pair`; en Windows, una tarea del Programador
-> de tareas al iniciar sesión. Los túneles (`--tunnel cloudflare`) descargan
+> Windows: `npx ocremote --pair` en cualquiera de los tres. El proceso se mantiene
+> en primer plano y la terminal debe seguir abierta. En macOS, mDNS está activo por
+> defecto (`--no-mdns` lo desactiva; en otros sistemas no se intenta). Los túneles (`--tunnel cloudflare`) descargan
 > `cloudflared` para la plataforma correcta. Windows está corregido en código
 > (rutas, `.exe`, `;` en PATH, cloudflared .exe) pero no verificado en una máquina
 > Windows real.
 
-## Primer arranque (2.0.0, preparado para publicar)
+## Primer arranque (2.1.1)
 
 ```bash
 npm install -g opencode-ai
@@ -22,12 +20,11 @@ npx ocremote --pair
 de red local. El proxy queda en loopback. El QR sólo se muestra cuando la invitación
 está registrada: abre la app, escanéalo y conserva la terminal abierta mientras la
 usas. Caduca en 15 minutos y es de un solo uso. Para mostrar otro QR de una instancia
-en marcha: `npx ocremote pair`. En macOS, `npx ocremote --daemon` instala el servicio.
+en marcha: `npx ocremote pair`.
 
 La nueva app comprueba la firma del ordenador contra la clave fijada por el QR. Es
 necesario actualizar app, companion y relay juntos y volver a emparejar las entradas
-antiguas que no tengan esa clave. La versión publicada no cambia hasta publicar el
-paquete; este repositorio prepara 2.0.0.
+antiguas que no tengan esa clave.
 
 Las secciones de proxy/túneles de abajo describen también el modo directo opcional.
 Con `--relay` o `--pair`, el valor predeterminado de `--host` es `127.0.0.1`, el túnel
@@ -100,11 +97,9 @@ para tests).
 
 | Comando | Qué hace |
 |---|---|
-| `oc-remote doctor` | Verifica toda la cadena: binario de opencode, token, puerto, auth, upstream, LaunchAgent, LAN, Tailscale/Funnel, endpoint público y ntfy. Salida `ok`/`FAIL` con el arreglo de cada fallo |
-| `oc-remote status` | Config, estado del LaunchAgent, endpoint actual (de `endpoint.json`) y prueba de auth |
-| `oc-remote restart` | `launchctl kickstart -k` del LaunchAgent |
-| `oc-remote logs` | Ruta del log y últimas 40 líneas |
-| `oc-remote funnel on\|off\|status` | Activa/desactiva el Funnel de Tailscale (la primera vez imprime el link de aprobación). El daemon en `auto` lo adopta solo |
+| `oc-remote doctor` | Verifica toda la cadena: binario de opencode, token, puerto, auth, upstream, LAN, Tailscale/Funnel, endpoint público y ntfy. Salida `ok`/`FAIL` con el arreglo de cada fallo |
+| `oc-remote status` | Config, endpoint actual (de `endpoint.json`) y prueba de auth |
+| `oc-remote funnel on\|off\|status` | Activa/desactiva el Funnel de Tailscale (la primera vez imprime el link de aprobación). El proceso en primer plano lo adopta automáticamente |
 | `oc-remote version` | Versión |
 
 ## Beacons de endpoint (auto-reparación)
@@ -249,25 +244,6 @@ node companion/oc-remote.mjs --ntfy ocremote-raul-a8f3k2
   `--ntfy https://ntfy.midominio.dev/mi-topic`.
 - Los topics de ntfy.sh son publicos: usa uno largo y aleatorio.
 
-## Instalacion como LaunchAgent
-
-```bash
-bash companion/install.sh --dir /Users/raul/Desktop/Projects/opencode-remote
-bash companion/install.sh --port 4190 --token mi-token      # idempotente
-bash companion/install.sh --uninstall
-```
-
-Crea:
-
-- symlink `~/.local/bin/oc-remote` → `companion/oc-remote.mjs`
-- `~/Library/LaunchAgents/com.raul.ocremote.plist` (`KeepAlive`, `RunAtLoad`,
-  `WorkingDirectory`, `ThrottleInterval` 10 s, permisos 0600)
-- logs en `~/Library/Logs/oc-remote.log` (stdout y stderr)
-
-El QR y el token quedan en el log: `tail -f ~/Library/Logs/oc-remote.log`.
-`--no-load` genera los ficheros sin cargar el agente (util para inspeccionar
-el plist). No borra `~/.config/oc-remote/config.json` al desinstalar.
-
 ## Seguridad
 
 - Token de 32 hex comparado con `crypto.timingSafeEqual`; el config se escribe

package/lib/rpc.mjs

@@ -1,8 +1,17 @@
 import { b64 } from './crypto.mjs'
 
+function sendChunks(session, id, buffer, size) {
+  for (let offset = 0; offset < buffer.length; offset += size) {
+    session.sendSealed({ t: 'chunk', id, data: b64(buffer.subarray(offset, offset + size)) })
+  }
+}
+
 const MAX_CONCURRENT = 8
 const MAX_UPLOAD = 24 << 20
-const MAX_RESPONSE = 700 * 1024
+const MAX_RESPONSE = 64 << 20
+const SMALL_RESPONSE = 256 << 10
+const RESPONSE_CHUNK = 256 << 10
+const STREAM_CHUNK = 64 << 10
 
 export class RpcAdapter {
   constructor({ baseUrl, authHeader, logger }) {
@@ -92,6 +101,7 @@ export class RpcAdapter {
       }
 
       const res = await fetch(url, init)
+      const contentType = res.headers.get('content-type') || ''
       if (!stream) {
         const chunks = []
         let size = 0
@@ -99,33 +109,32 @@ export class RpcAdapter {
           size += chunk.length
           if (size > MAX_RESPONSE) {
             controller.abort()
-            session.sendSealed({ t: 'res', id, error: 'Response exceeds the relay limit. Narrow the request and try again.' })
+            session.sendSealed({ t: 'res', id, error: 'response_too_large' })
             return
           }
           chunks.push(Buffer.from(chunk))
         }
         const buffer = Buffer.concat(chunks)
-        session.sendSealed({
-          t: 'res',
-          id,
-          status: res.status,
-          contentType: res.headers.get('content-type') || '',
-          body: b64(buffer),
-        })
+        if (buffer.length <= SMALL_RESPONSE) {
+          session.sendSealed({ t: 'res', id, status: res.status, contentType, body: b64(buffer) })
+          return
+        }
+        opened = true
+        session.sendSealed({ t: 'open', id, status: res.status, contentType })
+        sendChunks(session, id, buffer, RESPONSE_CHUNK)
+        session.sendSealed({ t: 'end', id })
         return
       }
 
       opened = true
-      session.sendSealed({ t: 'open', id, status: res.status, contentType: res.headers.get('content-type') || '' })
+      session.sendSealed({ t: 'open', id, status: res.status, contentType })
       if (!res.body) {
         session.sendSealed({ t: 'end', id })
         return
       }
       for await (const chunk of res.body) {
         if (controller.signal.aborted) break
-        for (let offset = 0; offset < chunk.length; offset += 64 * 1024) {
-          session.sendSealed({ t: 'chunk', id, data: b64(chunk.subarray(offset, offset + 64 * 1024)) })
-        }
+        sendChunks(session, id, chunk, STREAM_CHUNK)
       }
       session.sendSealed({ t: 'end', id })
     } catch (err) {

package/oc-remote.mjs

@@ -17,12 +17,7 @@ import { b64 } from './lib/crypto.mjs'
 
 const require = createRequire(import.meta.url)
 const NAME = 'oc-remote'
-const VERSION = '2.0.1'
-const LAUNCH_LABEL = 'com.raul.ocremote'
-const LOG_PATH =
-  process.platform === 'darwin'
-    ? path.join(os.homedir(), 'Library', 'Logs', 'oc-remote.log')
-    : path.join(os.homedir(), '.config', 'oc-remote', 'oc-remote.log')
+const VERSION = '2.1.1'
 const STARTED_AT = Date.now()
 const HERE = path.dirname(fileURLToPath(import.meta.url))
 const LOOPBACK = '127.0.0.1'
@@ -51,13 +46,10 @@ augmentPath()
 const HELP = `oc-remote v${VERSION} - remote companion for opencode
 
 Usage:
-  oc-remote [options]              Start the companion (and the daemon entry point)
+  oc-remote [options]              Start the companion in the foreground
   npx ocremote [--pair]            Start and show the pairing QR (Node 22.13+)
-  npx ocremote --daemon            Install as a background service (LaunchAgent)
   oc-remote doctor                 Diagnose every link in the connection chain
-  oc-remote status                 Show config, daemon state and live endpoint
-  oc-remote restart                Restart the installed LaunchAgent
-  oc-remote logs                   Show the daemon log path and last lines
+  oc-remote status                 Show config and the live endpoint
   oc-remote funnel on|off|status   Enable/disable the stable Tailscale Funnel URL
   oc-remote pair                   Print a fresh pairing QR for OpenCode Remote v2
   oc-remote relay-status           Relay identity, connection and paired devices
@@ -91,7 +83,7 @@ Options:
   --help                    Show this help
 `
 
-const SUBCOMMANDS = new Set(['doctor', 'status', 'restart', 'logs', 'version', 'funnel', 'pair', 'relay-status', 'unpair'])
+const SUBCOMMANDS = new Set(['doctor', 'status', 'version', 'funnel', 'pair', 'relay-status', 'unpair'])
 
 const VALUE_FLAGS = new Set([
   'dir',
@@ -107,7 +99,7 @@ const VALUE_FLAGS = new Set([
   'relay',
   'device-name',
 ])
-const BOOL_FLAGS = new Set(['new-token', 'no-auth', 'mdns', 'no-mdns', 'print-qr', 'no-print-qr', 'help', 'pair', 'daemon'])
+const BOOL_FLAGS = new Set(['new-token', 'no-auth', 'mdns', 'no-mdns', 'print-qr', 'no-print-qr', 'help', 'pair'])
 const TUNNEL_MODES = new Set(['auto', 'funnel', 'cloudflare', 'tailscale', 'none'])
 const ALLOWED_METHODS = new Set(['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'])
 
@@ -1939,14 +1931,6 @@ function probeLocal(path, headers = {}, timeout = 3000) {
   })
 }
 
-async function launchAgentState() {
-  if (process.platform !== 'darwin' || typeof process.getuid !== 'function') return 'not applicable (macOS only)'
-  const result = await execCommand('launchctl', ['print', `gui/${process.getuid()}/${LAUNCH_LABEL}`], 5000)
-  if (!result.ok) return 'not loaded'
-  const match = /state = ([a-z]+)/.exec(result.stdout)
-  return match ? match[1] : 'loaded'
-}
-
 async function runSubcommand(name, argv) {
   const parsed = parseArgs(argv)
   const flags = parsed.error ? {} : parsed.flags
@@ -2071,35 +2055,8 @@ async function runSubcommand(name, argv) {
     return 0
   }
 
-  if (name === 'logs') {
-    out(LOG_PATH)
-    if (fs.existsSync(LOG_PATH)) {
-      const lines = fs.readFileSync(LOG_PATH, 'utf8').trimEnd().split('\n')
-      out(lines.slice(-40).join('\n'))
-    } else {
-      out('(no log file yet)')
-    }
-    return 0
-  }
-
-  if (name === 'restart') {
-    if (process.platform !== 'darwin') {
-      out('the LaunchAgent only exists on macOS; run the companion in the foreground or use your service manager')
-      return 1
-    }
-    const result = await execCommand('launchctl', ['kickstart', '-k', `gui/${process.getuid()}/${LAUNCH_LABEL}`], 8000)
-    if (!result.ok) {
-      error(`could not restart ${LAUNCH_LABEL}: ${result.stderr.trim() || 'agent not loaded'}`)
-      out('hint: bash companion/install.sh --dir <project> --tunnel <mode>')
-      return 1
-    }
-    out(`restarted ${LAUNCH_LABEL}`)
-    return 0
-  }
-
   if (name === 'status') {
     const endpoint = readEndpointFile()
-    const state = await launchAgentState()
     const health = await probeLocal('/_ocremote/health')
     const authenticated = token
       ? await probeLocal('/_ocremote/status', authHeader)
@@ -2107,7 +2064,6 @@ async function runSubcommand(name, argv) {
     out(`oc-remote v${VERSION}`)
     out(`config: ${configPaths().file}`)
     out(`token: ${maskToken(token)}`)
-    out(`launch agent: ${state}`)
     out(`companion: ${health.ok ? `reachable on 127.0.0.1:${port}` : `NOT reachable on 127.0.0.1:${port}`}`)
     out(`auth: ${authenticated.ok ? 'token accepted' : `token rejected (HTTP ${authenticated.status})`}`)
     if (endpoint) {
@@ -2148,24 +2104,14 @@ async function runSubcommand(name, argv) {
     check(
       health.ok,
       `companion reachable on 127.0.0.1:${port}`,
-      'start it (`oc-remote --dir <project>`) or `bash companion/install.sh --dir <project>`'
+      'start it in a terminal with `oc-remote --dir <project>`'
     )
 
     if (health.ok) {
       const status = await probeLocal('/_ocremote/status', authHeader)
       check(status.ok, `token accepted by the companion (HTTP ${status.status})`, 'rotate the token with `oc-remote --new-token`')
       const upstream = await probeLocal('/global/health', authHeader, 5000)
-      check(upstream.ok, `opencode upstream healthy (HTTP ${upstream.status})`, 'restart with `oc-remote restart`')
-    }
-
-    const state = await launchAgentState()
-    if (state === 'running' || state === 'loaded') {
-      check(true, `LaunchAgent ${LAUNCH_LABEL}: ${state}`)
-    } else {
-      note(
-        `LaunchAgent ${LAUNCH_LABEL}: ${state}`,
-        'install it for always-on access: `bash companion/install.sh --dir <project> --tunnel auto`'
-      )
+      check(upstream.ok, `opencode upstream healthy (HTTP ${upstream.status})`, 'restart the foreground companion')
     }
 
     const lan = lanIPv4()
@@ -2206,7 +2152,7 @@ async function runSubcommand(name, argv) {
       check(
         endpointProbe.ok,
         `endpoint reachable: ${endpoint.url} (HTTP ${endpointProbe.status})`,
-        'check the tunnel: `oc-remote logs` or restart with `oc-remote restart`'
+        'check the tunnel output or restart the foreground companion'
       )
     } else {
       note('no endpoint published yet (LAN/tailscale only)', 'run the companion once to publish endpoint.json')
@@ -2263,7 +2209,7 @@ async function main() {
   opts.ntfy = flags.ntfy !== undefined ? flags.ntfy : (cfg.ntfy ?? null)
   opts.pair = Boolean(flags.pair)
   opts.relay = flags.relay !== undefined ? String(flags.relay) :
-    (cfg.relay ?? ((flags.pair || flags.daemon) && flags.tunnel === undefined ? 'wss://relay-production-9c9b.up.railway.app' : null))
+    (cfg.relay ?? (flags.pair && flags.tunnel === undefined ? 'wss://relay-production-9c9b.up.railway.app' : null))
   if (opts.relay && flags.tunnel === undefined) opts.tunnel = 'none'
   if (opts.relay && flags.host === undefined) opts.host = LOOPBACK
   opts.deviceName = flags['device-name'] !== undefined ? String(flags['device-name']) : (cfg.deviceName ?? null)
@@ -2309,26 +2255,6 @@ async function main() {
   if (!stat.isDirectory()) abort(`not a directory: ${dir}`)
   opts.dir = dir
 
-  if (flags.daemon) {
-    if (process.platform !== 'darwin') {
-      const say = (line) => process.stdout.write(`${line}\n`)
-      say('--daemon installs a macOS LaunchAgent.')
-      say('On Linux: create a systemd user unit running `npx ocremote --pair` (systemctl --user enable --now ocremote).')
-      say('On Windows: add a Task Scheduler entry running `npx ocremote --pair` at logon.')
-      say('Either way the foreground mode below works everywhere: npx ocremote --pair')
-      return 1
-    }
-    const installer = path.join(HERE, 'install.sh')
-    if (!fs.existsSync(installer)) abort(`install.sh not found next to oc-remote.mjs`)
-    const args = [installer, '--dir', dir, '--port', String(opts.port)]
-    if (opts.tunnel) args.push('--tunnel', opts.tunnel)
-    if (opts.relay) args.push('--relay', opts.relay)
-    if (opts.ntfy) args.push('--ntfy', String(opts.ntfy))
-    if (opts.deviceName) args.push('--device-name', opts.deviceName)
-    const child = spawn('bash', args, { stdio: 'inherit' })
-    return await new Promise((resolve) => child.on('exit', (code) => resolve(code ?? 0)))
-  }
-
   if (flags.pair && cfg.token && !flags['new-token'] && flags.token === undefined && opts.port === Number(cfg.port)) {
     const running = await probeLocal('/_ocremote/status', { authorization: `Bearer ${cfg.token}` })
     if (running.ok) {
@@ -2356,7 +2282,7 @@ async function main() {
 
   if (flags.pair) {
     info('first run: starting opencode and preparing the pairing QR')
-    info('keep this terminal open while you pair; for an always-on service use --daemon')
+    info('keep this terminal open while you use the app')
   }
 
   if (opts.ntfy) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ocremote",
-  "version": "2.0.1",
+  "version": "2.1.1",
   "description": "Control opencode on your computer from the OpenCode Remote iOS app: supervisor, pairing QR, relay and tunnel transports",
   "type": "module",
   "bin": {
@@ -9,8 +9,7 @@
   "files": [
     "oc-remote.mjs",
     "lib/",
-    "vendor/",
-    "install.sh"
+    "vendor/"
   ],
   "engines": {
     "node": ">=22.13.0"

package/install.sh

@@ -1,262 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-LABEL="com.raul.ocremote"
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-ENTRY="$SCRIPT_DIR/oc-remote.mjs"
-BIN_DIR="$HOME/.local/bin"
-PLIST="$HOME/Library/LaunchAgents/$LABEL.plist"
-LOG_PATH="$HOME/Library/Logs/oc-remote.log"
-PROJECT_DIR=""
-PORT="4190"
-TOKEN=""
-TUNNEL="auto"
-NTFY=""
-RELAY=""
-DEVICE_NAME=""
-NO_LOAD="0"
-UNINSTALL="0"
-
-usage() {
-  cat <<USAGE
-oc-remote installer
-
-Usage:
-  companion/install.sh [--dir <path>] [--port <n>] [--token <str>] [--tunnel <mode>] [--ntfy <topic>]
-                       [--relay <wss://url>] [--device-name <name>]
-  companion/install.sh --uninstall
-
-Options:
-  --dir <path>     Project directory opencode runs in (default: repo root)
-  --port <n>       Companion port (default: 4190)
-  --token <str>    Pairing token to persist (default: companion generates one)
-  --tunnel <mode>  Remote access: auto | funnel | cloudflare | tailscale | none (default: auto)
-                   funnel     stable public HTTPS URL via Tailscale Funnel (one-time approval)
-                   cloudflare public URL from anywhere with zero setup (downloads cloudflared)
-  --ntfy <topic>   ntfy topic for push notifications + endpoint beacons
-  --relay <url>    Relay v2 URL (wss://...) for anywhere access without tunnels
-  --device-name <name>  Name shown on the phone when pairing (default: hostname)
-  --no-load        Write the symlink and plist but do not load the LaunchAgent
-  --uninstall      Unload the LaunchAgent, remove the plist and the symlink
-  -h, --help       Show this help
-
-Files:
-  symlink   $BIN_DIR/oc-remote
-  plist     $PLIST
-  log       $LOG_PATH
-  config    ~/.config/oc-remote/config.json (0600, written by oc-remote)
-USAGE
-}
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --dir)
-      [[ $# -ge 2 ]] || { echo "error: --dir needs a value" >&2; exit 2; }
-      PROJECT_DIR="$2"
-      shift 2
-      ;;
-    --port)
-      [[ $# -ge 2 ]] || { echo "error: --port needs a value" >&2; exit 2; }
-      PORT="$2"
-      shift 2
-      ;;
-    --token)
-      [[ $# -ge 2 ]] || { echo "error: --token needs a value" >&2; exit 2; }
-      TOKEN="$2"
-      shift 2
-      ;;
-    --tunnel)
-      [[ $# -ge 2 ]] || { echo "error: --tunnel needs a value" >&2; exit 2; }
-      case "$2" in
-        auto|funnel|cloudflare|tailscale|none) TUNNEL="$2" ;;
-        *) echo "error: invalid --tunnel: $2 (expected auto | funnel | cloudflare | tailscale | none)" >&2; exit 2 ;;
-      esac
-      shift 2
-      ;;
-    --ntfy)
-      [[ $# -ge 2 ]] || { echo "error: --ntfy needs a value" >&2; exit 2; }
-      NTFY="$2"
-      shift 2
-      ;;
-    --relay)
-      [[ $# -ge 2 ]] || { echo "error: --relay needs a value" >&2; exit 2; }
-      RELAY="$2"
-      shift 2
-      ;;
-    --device-name)
-      [[ $# -ge 2 ]] || { echo "error: --device-name needs a value" >&2; exit 2; }
-      DEVICE_NAME="$2"
-      shift 2
-      ;;
-    --no-load)
-      NO_LOAD="1"
-      shift
-      ;;
-    --uninstall)
-      UNINSTALL="1"
-      shift
-      ;;
-    -h|--help)
-      usage
-      exit 0
-      ;;
-    *)
-      echo "error: unknown argument: $1" >&2
-      usage >&2
-      exit 2
-      ;;
-  esac
-done
-
-UID_NUM="$(id -u)"
-DOMAIN="gui/$UID_NUM"
-
-if [[ "$UNINSTALL" == "1" ]]; then
-  if launchctl bootout "$DOMAIN/$LABEL" >/dev/null 2>&1; then
-    echo "unloaded LaunchAgent $LABEL"
-  elif [[ -f "$PLIST" ]] && launchctl unload "$PLIST" >/dev/null 2>&1; then
-    echo "unloaded LaunchAgent $LABEL (legacy launchctl unload)"
-  else
-    echo "LaunchAgent $LABEL was not loaded"
-  fi
-  rm -f "$PLIST"
-  rm -f "$BIN_DIR/oc-remote"
-  echo "removed $PLIST"
-  echo "removed $BIN_DIR/oc-remote"
-  echo "kept ~/.config/oc-remote/config.json (delete it manually to forget the token)"
-  exit 0
-fi
-
-if [[ -z "$PROJECT_DIR" ]]; then
-  PROJECT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
-fi
-if [[ ! -d "$PROJECT_DIR" ]]; then
-  echo "error: directory not found: $PROJECT_DIR" >&2
-  exit 1
-fi
-PROJECT_DIR="$(cd "$PROJECT_DIR" && pwd)"
-
-if [[ ! -f "$ENTRY" ]]; then
-  echo "error: oc-remote.mjs not found next to install.sh" >&2
-  exit 1
-fi
-
-if [[ ! "$PORT" =~ ^[0-9]+$ ]] || (( PORT < 1 || PORT > 65535 )); then
-  echo "error: invalid port: $PORT" >&2
-  exit 1
-fi
-
-NODE_BIN="$(command -v node || true)"
-if [[ -z "$NODE_BIN" ]]; then
-  echo "error: node not found in PATH" >&2
-  exit 1
-fi
-
-xml_escape() {
-  local value="$1"
-  value="${value//&/&amp;}"
-  value="${value//</&lt;}"
-  value="${value//>/&gt;}"
-  printf '%s' "$value"
-}
-
-mkdir -p "$BIN_DIR" "$HOME/Library/LaunchAgents" "$HOME/Library/Logs"
-chmod +x "$ENTRY"
-ln -sfn "$ENTRY" "$BIN_DIR/oc-remote"
-
-{
-  echo '<?xml version="1.0" encoding="UTF-8"?>'
-  echo '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">'
-  echo '<plist version="1.0">'
-  echo '<dict>'
-  echo '  <key>Label</key>'
-  echo "  <string>$LABEL</string>"
-  echo '  <key>ProgramArguments</key>'
-  echo '  <array>'
-  echo "    <string>$(xml_escape "$NODE_BIN")</string>"
-  echo "    <string>$(xml_escape "$BIN_DIR/oc-remote")</string>"
-  echo '    <string>--no-print-qr</string>'
-  echo '    <string>--dir</string>'
-  echo "    <string>$(xml_escape "$PROJECT_DIR")</string>"
-  echo '    <string>--port</string>'
-  echo "    <string>$PORT</string>"
-  echo '    <string>--tunnel</string>'
-  echo "    <string>$TUNNEL</string>"
-  if [[ -n "$NTFY" ]]; then
-    echo '    <string>--ntfy</string>'
-    echo "    <string>$(xml_escape "$NTFY")</string>"
-  fi
-  if [[ -n "$RELAY" ]]; then
-    echo '    <string>--relay</string>'
-    echo "    <string>$(xml_escape "$RELAY")</string>"
-  fi
-  if [[ -n "$DEVICE_NAME" ]]; then
-    echo '    <string>--device-name</string>'
-    echo "    <string>$(xml_escape "$DEVICE_NAME")</string>"
-  fi
-  if [[ -n "$TOKEN" ]]; then
-    echo '    <string>--token</string>'
-    echo "    <string>$(xml_escape "$TOKEN")</string>"
-  fi
-  echo '  </array>'
-  echo '  <key>WorkingDirectory</key>'
-  echo "  <string>$(xml_escape "$PROJECT_DIR")</string>"
-  echo '  <key>EnvironmentVariables</key>'
-  echo '  <dict>'
-  echo '    <key>PATH</key>'
-  echo "    <string>$(xml_escape "$(dirname "$NODE_BIN"):/opt/homebrew/bin:/usr/local/bin:$BIN_DIR:$HOME/.opencode/bin:/usr/bin:/bin:/usr/sbin:/sbin")</string>"
-  echo '  </dict>'
-  echo '  <key>RunAtLoad</key>'
-  echo '  <true/>'
-  echo '  <key>KeepAlive</key>'
-  echo '  <true/>'
-  echo '  <key>ThrottleInterval</key>'
-  echo '  <integer>10</integer>'
-  echo '  <key>StandardOutPath</key>'
-  echo "  <string>$(xml_escape "$LOG_PATH")</string>"
-  echo '  <key>StandardErrorPath</key>'
-  echo "  <string>$(xml_escape "$LOG_PATH")</string>"
-  echo '</dict>'
-  echo '</plist>'
-} > "$PLIST"
-chmod 600 "$PLIST"
-
-plutil -lint "$PLIST"
-
-if [[ "$NO_LOAD" == "1" ]]; then
-  echo "wrote $PLIST (not loaded)"
-  echo "wrote $BIN_DIR/oc-remote -> $ENTRY"
-  exit 0
-fi
-
-launchctl bootout "$DOMAIN/$LABEL" >/dev/null 2>&1 || true
-if ! launchctl bootstrap "$DOMAIN" "$PLIST" >/dev/null 2>&1; then
-  launchctl load -w "$PLIST"
-fi
-launchctl kickstart -k "$DOMAIN/$LABEL" >/dev/null 2>&1 || true
-
-echo "installed LaunchAgent $LABEL"
-echo "  binary: $BIN_DIR/oc-remote -> $ENTRY"
-echo "  plist:  $PLIST"
-echo "  log:    $LOG_PATH"
-echo "  port:   $PORT"
-echo "  tunnel: $TUNNEL"
-[[ -n "$RELAY" ]] && echo "  relay:  $RELAY"
-echo
-ENDPOINT_JSON="$HOME/.config/oc-remote/endpoint.json"
-for _ in $(seq 1 15); do
-  [[ -f "$ENDPOINT_JSON" ]] && break
-  sleep 1
-done
-if [[ -f "$ENDPOINT_JSON" ]]; then
-  ENDPOINT_URL="$(node -e "try{const e=require('$ENDPOINT_JSON');process.stdout.write(e.url||'')}catch{}" 2>/dev/null || true)"
-  if [[ -n "$ENDPOINT_URL" ]]; then
-    echo "endpoint: $ENDPOINT_URL"
-  fi
-fi
-echo "Pairing details (URL, token, QR) are in the log:"
-echo "  tail -f \"$LOG_PATH\""
-echo
-echo "Verify the whole chain with:  oc-remote doctor"
-echo "Restart the daemon with:      oc-remote restart"
-echo "Uninstall with:               $0 --uninstall"