omp-mobile 0.4.4 → 0.6.0

package/src/server.mjs

@@ -21,6 +21,8 @@ import { AttentionTracker, serveEvents } from "./attention.mjs";
 import { listOmpSessions, oneLine, promptTitle, sessionOwners } from "./omp-sessions.mjs";
 import { askOwnerToLeave, forksOf, isOmpCommand, processInfo, sessionBusy, takeoverFarewell, tellTerminal } from "./takeover.mjs";
 import { TranscriptStore, deltaBody, deltaQuery } from "./transcripts.mjs";
+import { RELAY_HEADER, RelayHost } from "./relay.mjs";
+import { DEFAULT_RELAY, runRelayCli } from "./relay-control.mjs";
 
 const { version: VERSION } = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
 const PROTOCOL = 1;
@@ -28,6 +30,7 @@ const DEFAULT_PORT = 7390;
 const DEFAULT_TOKEN_FILE = join(homedir(), ".omp-mobile", "token");
 const DEFAULT_REGISTRY_FILE = join(homedir(), ".omp-mobile", "sessions.json");
 const DEFAULT_STATE_FILE = join(homedir(), ".omp-mobile", "daemon.json");
+const DEFAULT_RELAY_DIR = join(homedir(), ".omp-mobile", "relay");
 const DEFAULT_OMP_HOME = join(homedir(), ".omp");
 const MAX_BODY = 256 * 1024;
 /** Terminal sessions listed next to the daemon's own, newest first. */
@@ -116,7 +119,8 @@ const OPEN_FAILED_CLOSE_CODE = 4000;
 const BLOB_NAME = /^[0-9a-f]{64}$/;
 
 /** @typedef {{pid: number, busy: boolean, terminal: boolean}} SessionOwner */
-/** @typedef {{id: string, title: string, cwd: string, status: string, model?: string, createdAt: number, updatedAt: number, sessionFile?: string, origin: "daemon" | "omp", openElsewhere?: boolean, owner?: SessionOwner, waiting?: number}} SessionSummary */
+/** @typedef {{id: string, method: string, title: string, message?: string, options?: string[]}} PendingRequest */
+/** @typedef {{id: string, title: string, cwd: string, status: string, model?: string, createdAt: number, updatedAt: number, sessionFile?: string, origin: "daemon" | "omp", openElsewhere?: boolean, owner?: SessionOwner, waiting?: number, request?: PendingRequest}} SessionSummary */
 
 /** An error with the HTTP status it answers, and any detail its JSON answer carries. */
 function httpError(status, message, detail = {}) {
@@ -129,6 +133,29 @@ function errorBody(error) {
   return { error: error instanceof Error ? error.message : String(error), ...detail };
 }
 
+/**
+ * The part of an open extension request a session list shows: enough to answer
+ * a tool approval or a short choice from the home, nothing for a text prompt.
+ * @param {any} request
+ * @returns {PendingRequest | undefined}
+ */
+function pendingOf(request) {
+  if (request === null || typeof request !== "object" || typeof request.id !== "string") return undefined;
+  const pending = { id: request.id, method: String(request.method), title: typeof request.title === "string" ? request.title : "" };
+  if (typeof request.message === "string") pending.message = request.message;
+  if (Array.isArray(request.options)) pending.options = request.options.filter((option) => typeof option === "string");
+  return pending;
+}
+
+/** The answer fields a phone sends, over the session socket or `POST /sessions/:id/answer`. */
+function answerOf(message) {
+  const answer = {};
+  if (typeof message.value === "string") answer.value = message.value;
+  if (typeof message.confirmed === "boolean") answer.confirmed = message.confirmed;
+  if (message.cancelled === true) answer.cancelled = true;
+  return answer;
+}
+
 function parseArgs(argv) {
   const options = {
     host: "127.0.0.1",
@@ -146,6 +173,8 @@ function parseArgs(argv) {
     tailscale: "tailscale",
     whois: true,
     qr: true,
+    relay: "",
+    relayDir: DEFAULT_RELAY_DIR,
   };
   for (let i = 0; i < argv.length; i += 1) {
     const flag = argv[i];
@@ -208,6 +237,19 @@ function parseArgs(argv) {
       case "--no-qr":
         options.qr = false;
         break;
+      case "--relay":
+        // The server is optional: `--relay` alone means the public ds-harness-remote relay.
+        if (value !== undefined && !value.startsWith("--")) {
+          options.relay = value;
+          i += 1;
+        } else {
+          options.relay = DEFAULT_RELAY;
+        }
+        break;
+      case "--relay-dir":
+        options.relayDir = resolve(value);
+        i += 1;
+        break;
       case "--help":
       case "-h":
         printHelp();
@@ -245,6 +287,14 @@ Admission: on a non-loopback --host every request and WebSocket upgrade must nam
 this node in Host (421 otherwise) and come from a tailnet device of this node's
 user (403 otherwise), before the token is checked. Loopback hosts skip admission.
   --no-qr                Do not print the pairing QR code at startup
+  --relay [url]          Also serve paired phones through a ds-harness-remote relay (default ${DEFAULT_RELAY}),
+                         end-to-end encrypted; pair with \`omp-mobile relay pair\` or /mobile relay
+  --relay-dir <dir>      Relay identity and device tokens (default ~/.omp-mobile/relay)
+
+Relay commands (talk to the running daemon; same --state-file):
+  omp-mobile relay pair       Show a pairing QR code, then confirm the phone's 8-digit code
+  omp-mobile relay status     Relay server, connection and paired phones
+  omp-mobile relay revoke <phone device id>
 `);
 }
 
@@ -605,6 +655,8 @@ class SessionEntry {
       origin: "daemon",
       // OMP questions and tool approvals still waiting for an answer: the session needs the user.
       waiting: this.openRequests().length,
+      // The oldest of them, so a list can answer it without opening the session.
+      request: pendingOf(this.openRequests()[0]),
     };
   }
 
@@ -657,6 +709,8 @@ class SessionEntry {
       if (STATE_EVENTS.has(event.type)) void this.refreshState();
       // A `todo` tool call rewrites the list before any reminder fires.
       if (event.type === "tool_execution_end" && event.toolName === "todo") void this.refreshState();
+      // A run starting is what makes a session "running" in the list; OMP's state read would lag behind.
+      if (event.type === "agent_start" && this.state !== null && typeof this.state === "object") this.state = { ...this.state, isStreaming: true };
       if (event.type === "turn_end" || event.type === "agent_end") void this.refreshState();
       this.broadcast({ type: "event", event });
     });
@@ -746,6 +800,29 @@ class Daemon {
     // the phone's WebSocket client (OkHttp) asks for permessage-deflate on its own.
     this.wsServer = new WebSocketServer({ noServer: true, perMessageDeflate: { threshold: 1_024 } });
     this.server.on("upgrade", (req, socket, head) => void this.admitUpgrade(req, socket, head));
+    /**
+     * Phones paired through a relay reach the daemon through this loopback-only
+     * listener (`relay.mjs` adds the token): the same API, without the tailnet admission.
+     */
+    this.tunnelServer = undefined;
+    /** @type {RelayHost | undefined} */
+    this.relay = undefined;
+    if (options.relay) {
+      this.tunnelServer = createServer((req, res) => void this.handleHttp(req, res));
+      this.tunnelServer.on("upgrade", (req, socket, head) => {
+        socket.on("error", () => socket.destroy());
+        this.handleUpgrade(req, socket, head);
+      });
+      this.relay = new RelayHost({
+        serverUrl: options.relay,
+        dir: options.relayDir,
+        name: `omp-mobile on ${hostname().replace(/\.local$/, "")}`,
+        version: VERSION,
+        port: () => this.tunnelServer.address().port,
+        token: this.token,
+        log: (line) => this.log(line),
+      });
+    }
   }
 
   baseUrl() {
@@ -828,9 +905,14 @@ class Daemon {
         liveSessions: this.sessions.size,
         eventStreams: this.streams.size,
         lastPhone: this.lastPhone,
+        relay: this.relay === undefined ? null : await this.relay.status(),
       });
       return;
     }
+    if (url.pathname === "/relay" || url.pathname.startsWith("/relay/")) {
+      await this.handleRelay(req, res, url);
+      return;
+    }
     if (url.pathname === "/events" && req.method === "GET") {
       const end = serveEvents(this.attention, req, res);
       this.streams.add(end);
@@ -868,6 +950,18 @@ class Daemon {
         sendJson(res, 200, this.transcript(decodeURIComponent(transcript[1]), deltaQuery(url.searchParams)));
         return;
       }
+      const answer = /^\/sessions\/([^/]+)\/answer$/.exec(url.pathname);
+      if (answer !== null && req.method === "POST") {
+        const body = await readBody(req);
+        const live = this.sessions.get(decodeURIComponent(answer[1]));
+        if (live === undefined) throw httpError(404, "session is not running");
+        if (typeof body.id !== "string" || !live.openRequests().some((request) => request.id === body.id)) {
+          throw httpError(409, "that question was already answered");
+        }
+        live.rpc.respondExtension(body.id, answerOf(body));
+        sendJson(res, 200, { ok: true });
+        return;
+      }
       const match = /^\/sessions\/([^/]+)$/.exec(url.pathname);
       if (match !== null) {
         const id = decodeURIComponent(match[1]);
@@ -1264,11 +1358,7 @@ class Daemon {
           return;
         case "approval": {
           if (typeof message.id !== "string") throw new Error("missing approval id");
-          const answer = {};
-          if (typeof message.value === "string") answer.value = message.value;
-          if (typeof message.confirmed === "boolean") answer.confirmed = message.confirmed;
-          if (message.cancelled === true) answer.cancelled = true;
-          entry.rpc.respondExtension(message.id, answer);
+          entry.rpc.respondExtension(message.id, answerOf(message));
           ws.send(JSON.stringify({ type: "accepted", command: "approval" }));
           return;
         }
@@ -1328,17 +1418,72 @@ class Daemon {
    */
   noteClient(req) {
     if (req.headers["x-omp-mobile-probe"] !== undefined) return;
-    const address = String(req.socket?.remoteAddress ?? "").replace(/^::ffff:/i, "");
+    // Through the relay every request comes from loopback: name the path instead.
+    const address = req.headers[RELAY_HEADER] !== undefined ? "relay" : String(req.socket?.remoteAddress ?? "").replace(/^::ffff:/i, "");
     this.lastPhone = { address, at: Date.now() };
   }
 
-  listen() {
-    return new Promise((resolveListen) => {
-      this.server.listen(this.options.port, this.options.host, () => {
-        this.startTimers();
-        resolveListen();
-      });
-    });
+  /**
+   * Relay pairing and phones, for `omp-mobile relay` and `/mobile relay` on this
+   * computer; never through the relay itself (a paired phone cannot pair or revoke).
+   */
+  async handleRelay(req, res, url) {
+    if (req.headers[RELAY_HEADER] !== undefined) {
+      sendJson(res, 403, { error: "relay control is local only" });
+      return;
+    }
+    if (this.relay === undefined) {
+      sendJson(res, 409, { error: "the daemon runs without --relay" });
+      return;
+    }
+    try {
+      if (url.pathname === "/relay" && req.method === "GET") {
+        sendJson(res, 200, { ...(await this.relay.status()), phones: await this.relay.phones() });
+        return;
+      }
+      if (url.pathname === "/relay/pair" && req.method === "POST") {
+        sendJson(res, 200, await this.relay.pairStart());
+        return;
+      }
+      if (url.pathname === "/relay/pair" && req.method === "GET") {
+        sendJson(res, 200, { pairing: (await this.relay.pairStatus()) ?? null });
+        return;
+      }
+      if ((url.pathname === "/relay/pair/confirm" || url.pathname === "/relay/pair/cancel") && req.method === "POST") {
+        const body = await readBody(req);
+        if (typeof body.sessionId !== "string") {
+          sendJson(res, 400, { error: "sessionId is required" });
+          return;
+        }
+        const confirm = url.pathname.endsWith("/confirm");
+        if (confirm && (typeof body.code !== "string" || !/^\d{8}$/.test(body.code))) {
+          sendJson(res, 400, { error: "the code is 8 digits" });
+          return;
+        }
+        sendJson(res, 200, confirm ? await this.relay.pairConfirm(body.sessionId, body.code) : await this.relay.pairCancel(body.sessionId));
+        return;
+      }
+      const phone = /^\/relay\/phones\/([^/]+)$/.exec(url.pathname);
+      if (phone !== null && req.method === "DELETE") {
+        await this.relay.revoke(decodeURIComponent(phone[1]));
+        sendJson(res, 200, { ok: true });
+        return;
+      }
+      sendJson(res, 404, { error: "not found" });
+    } catch (error) {
+      // The relay's own refusals carry a code (PAIRING_EXPIRED, PAIRING_ATTEMPT_USED, ...): pass it on.
+      const code = typeof error?.code === "string" ? error.code : undefined;
+      sendJson(res, 502, { error: error instanceof Error ? error.message : String(error), ...(code === undefined ? {} : { code }) });
+    }
+  }
+
+  async listen() {
+    await new Promise((resolveListen) => this.server.listen(this.options.port, this.options.host, () => resolveListen()));
+    if (this.relay !== undefined) {
+      await new Promise((resolveListen) => this.tunnelServer.listen(0, "127.0.0.1", () => resolveListen()));
+      await this.relay.start();
+    }
+    this.startTimers();
   }
 
   /** Keepalive pings and the idle-session reaper, once the daemon listens; old stashed images go. */
@@ -1395,7 +1540,9 @@ class Daemon {
     const outcomes = await Promise.all(closing);
     const stuck = outcomes.filter((outcome) => outcome === "running").length;
     if (stuck > 0) console.error(`omp-mobile: ${stuck} omp process(es) ignored SIGINT and SIGTERM and are still running`);
+    await this.relay?.close();
     this.wsServer.close();
+    this.tunnelServer?.close();
     await new Promise((resolveClose) => this.server.close(() => resolveClose()));
   }
 }
@@ -1473,6 +1620,10 @@ function clearState(path) {
 }
 
 async function main() {
+  if (process.argv[2] === "relay") {
+    await runRelayCli(process.argv.slice(3));
+    return;
+  }
   const options = parseArgs(process.argv.slice(2));
   if (options.host === "tailscale") options.host = await tailscaleHost(options);
   const token = loadToken(options);
@@ -1481,21 +1632,26 @@ async function main() {
   await daemon.listen();
   const url = daemon.baseUrl();
   const pair = `omp-mobile://pair?url=${encodeURIComponent(url)}&token=${encodeURIComponent(token)}`;
-  writeState(options.stateFile, { pid: process.pid, version: VERSION, url, pair, startedAt: daemon.startedAt });
+  writeState(options.stateFile, { pid: process.pid, version: VERSION, url, pair, relay: options.relay || null, startedAt: daemon.startedAt });
   console.log(`omp-mobile daemon ${VERSION}`);
   console.log(`  listening  ${url}`);
   console.log(`  cwd        ${options.cwd}`);
   for (const line of identity.notes) (line.includes("WARNING") ? console.warn : console.log)(line);
   console.log(`  token      ${token}`);
   console.log(`  pair       ${pair}`);
-  if (options.qr) {
+  if (daemon.relay !== undefined) {
+    const relay = await daemon.relay.status();
+    console.log(`  relay      ${relay.server} · ${relay.paired ? "paired" : "no phone paired yet"} · pair a phone: omp-mobile relay pair`);
+  }
+  const tailnet = isTailnetAddress(options.host);
+  if (options.qr && (tailnet || daemon.relay === undefined)) {
     console.log("");
     console.log("  Scan with OMP on your phone (Machines > Scan to pair):");
     console.log(renderQr(pair));
     // The app accepts only tailnet addresses from a code; say so before the user tries.
-    if (!isTailnetAddress(options.host)) {
+    if (!tailnet) {
       console.log(`  note: ${options.host} is not a Tailscale address, so the app will refuse this code.`);
-      console.log("        Start with --host <this computer's Tailscale IP> to pair a phone.");
+      console.log("        Start with --host <this computer's Tailscale IP>, or --relay, to pair a phone.");
     }
   }
   const shutdown = async () => {

package/src/state.mjs

@@ -0,0 +1,36 @@
+/** The running daemon's state file, as `/mobile` and `omp-mobile relay` read it. */
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+export const STATE_FILE = join(homedir(), ".omp-mobile", "daemon.json");
+
+/**
+ * The running daemon's record, if its process is alive.
+ * @returns {{pid: number, version: string, url: string, pair: string, relay?: string | null, startedAt: number} | undefined}
+ */
+export function readState(path = STATE_FILE) {
+  let state;
+  try {
+    state = JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return undefined;
+  }
+  if (typeof state?.pid !== "number" || typeof state.url !== "string" || typeof state.pair !== "string") return undefined;
+  return alive(state.pid) ? state : undefined;
+}
+
+export function alive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    // EPERM: it exists but belongs to someone else.
+    return error?.code === "EPERM";
+  }
+}
+
+/** The token inside a pairing link. */
+export function tokenOf(pair) {
+  return new URL(pair.replace(/^omp-mobile:\/\//, "http://x/")).searchParams.get("token") ?? "";
+}

package/src/transcripts.mjs

@@ -136,7 +136,7 @@ export class TranscriptStore {
       base: Number.isSafeInteger(base) && base > 0 ? base : 0,
       messages,
       state: state !== null && typeof state === "object" ? { ...state, isStreaming: false } : state,
-      session: { ...session, status: "idle", waiting: 0 },
+      session: { ...session, status: "idle", waiting: 0, request: undefined },
     };
     try {
       mkdirSync(this.dir, { recursive: true, mode: 0o700 });

package/vendor/LICENSE.dsh-remote

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DSH Remote contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/vendor/README.md

@@ -0,0 +1,9 @@
+`dsh-remote-host.mjs` is the Host side of ds-harness-remote's relay (device pairing, the
+relay control connection and its Noise IK channel), bundled from
+[liguobao/ds-harness-remote](https://github.com/liguobao/ds-harness-remote) at commit
+ea1c0925f8be825a5f5afac32ad2d0b2c699f7f7 with `bun build --target=node --format=esm` over an
+entry that re-exports `HostPairing`, `HostServerConnection`, `ConnectionController`,
+`IdentityStore`, `HostServerApi`, `ServerCredentialStore` and `SafeLogger` from
+`packages/plugin/src`, and `createEvent`, `createRpcError`, `createRpcResponse` and
+`MAX_SECURE_MESSAGE_BYTES` from `@dsh-remote/protocol`. Not edited here; see
+`LICENSE.dsh-remote` (MIT).