ompchamber 0.4.0 → 0.6.0

package/src/server/lib/lifecycle/occupant.ts

@@ -0,0 +1,101 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Who is serving a port right now.
+ *
+ * Two independent sources answer that question, and they are deliberately
+ * combined: the instance record (written by the server itself) and the live
+ * `/api/health` probe. The record is the only source for a port whose server is
+ * deaf (hung, suspended, still starting), while the probe is the only source
+ * for a server started outside the CLI — a `bun run dev` server must be
+ * discoverable, and before this module it was invisible to every CLI command.
+ */
+
+import { getProcessState, isProcessAlive } from '@/server/lib/lifecycle/identity';
+import { readInstanceRecord } from '@/server/lib/lifecycle/instance';
+import { fetchHealth } from '@/server/lib/lifecycle/probe';
+
+export interface Occupant {
+  pid: number;
+  port: number;
+  host?: string;
+  version?: string;
+  /** `dev` | `prod` as reported by the live server, else from the record. */
+  mode?: string;
+  launchMode?: string;
+  startedAt?: string;
+  uptime?: number;
+  source: 'registry+probe' | 'probe' | 'registry';
+  /** True when the occupant answered `/api/health` as OMPChamber itself. */
+  confirmedByHealth: boolean;
+}
+
+/** The OMPChamber instance on `port`, or null when the port is free/foreign. */
+export async function findOccupant(port: number, host?: string | null): Promise<Occupant | null> {
+  const record = readInstanceRecord(port);
+  const recordIsLive = record !== null
+    && isProcessAlive(record.pid)
+    && getProcessState(record.pid) !== 'mismatched';
+
+  const health = await fetchHealth(port, record?.host ?? host);
+  const healthPid = health?.pid;
+  if (health && typeof healthPid === 'number' && isProcessAlive(healthPid)) {
+    return {
+      pid: healthPid,
+      port,
+      host: record?.host ?? host ?? undefined,
+      version: health.version ?? record?.version,
+      mode: health.mode ?? record?.mode,
+      launchMode: record?.launchMode,
+      startedAt: health.startedAt ?? record?.startedAt,
+      uptime: health.uptime,
+      source: recordIsLive && record.pid === healthPid ? 'registry+probe' : 'probe',
+      confirmedByHealth: true,
+    };
+  }
+
+  if (record && recordIsLive) {
+    return {
+      pid: record.pid,
+      port,
+      host: record.host,
+      version: record.version,
+      mode: record.mode,
+      launchMode: record.launchMode,
+      startedAt: record.startedAt,
+      source: 'registry',
+      confirmedByHealth: false,
+    };
+  }
+
+  return null;
+}
+
+/** One-line identity for logs and errors: `pid 1234 (dev, direct, v0.5.0, up 2m)`. */
+export function describeOccupant(occupant: Occupant): string {
+  const details: string[] = [];
+  if (occupant.mode) details.push(occupant.mode);
+  if (occupant.launchMode) details.push(occupant.launchMode);
+  if (occupant.version) details.push(`v${occupant.version}`);
+  const age = occupantAge(occupant);
+  if (age) details.push(`up ${age}`);
+  if (!occupant.confirmedByHealth) details.push('unconfirmed');
+  const suffix = details.length > 0 ? ` (${details.join(', ')})` : '';
+  return `pid ${occupant.pid}${suffix}`;
+}
+
+function occupantAge(occupant: Occupant): string | null {
+  const seconds = typeof occupant.uptime === 'number'
+    ? Math.round(occupant.uptime)
+    : occupant.startedAt
+      ? Math.round((Date.now() - Date.parse(occupant.startedAt)) / 1000)
+      : Number.NaN;
+  if (!Number.isFinite(seconds) || seconds < 0) return null;
+  if (seconds < 60) return `${seconds}s`;
+  const minutes = Math.floor(seconds / 60);
+  if (minutes < 60) return `${minutes}m`;
+  return `${Math.floor(minutes / 60)}h ${minutes % 60}m`;
+}

package/src/server/lib/lifecycle/paths.ts

@@ -0,0 +1,50 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Where OMPChamber keeps per-port runtime state.
+ *
+ * Both the server and the CLI need these paths, and they must agree: the server
+ * owns the record for the port it listens on, and the CLI reads that same record
+ * to answer `status` / `stop` / `logs`. One module is what makes the agreement
+ * structural — the previous split (CLI wrote, server never did) is why a server
+ * started outside the CLI was invisible to every CLI command.
+ */
+
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+
+/**
+ * Root of OMPChamber's own state (~/.ompchamber, or OMPCHAMBER_DATA_DIR).
+ *
+ * `os.homedir()` rather than HOME: a process started without a shell (cron,
+ * launchd, a service) has no HOME, and an empty value would silently move the
+ * data directory to a cwd-relative path.
+ */
+export function getDataDir(): string {
+  const override = (Bun.env.OMPCHAMBER_DATA_DIR ?? '').trim();
+  if (override) {
+    return path.resolve(override.startsWith('~') ? path.join(os.homedir(), override.slice(1)) : override);
+  }
+  return path.join(os.homedir(), '.ompchamber');
+}
+
+/** Directory holding per-instance records and handover locks (mode 0700). */
+export function getRunDir(): string {
+  const dir = path.join(getDataDir(), 'run');
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  return dir;
+}
+
+/** `<data>/run/<port>.json` — the record written by the server serving `port`. */
+export function getInstancePath(port: number | string): string {
+  return path.join(getRunDir(), `${port}.json`);
+}
+
+/** `<data>/run/<port>.lock` — held only while a port handover is in progress. */
+export function getLockPath(port: number | string): string {
+  return path.join(getRunDir(), `${port}.lock`);
+}

package/src/server/lib/lifecycle/port-guard.ts

@@ -0,0 +1,170 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Port guarding for a starting OMPChamber server.
+ *
+ * One port is served by exactly one process, and **a starting instance never
+ * stops another one** — not a CLI server, not a dev run. An occupant that
+ * identifies itself as OMPChamber makes the newcomer exit with the ways to pick
+ * a different port; freeing a port is what `ompchamber stop --port <port>` is
+ * for, done deliberately and per port.
+ *
+ * The refusal is load-bearing rather than defensive: a second bind is *not*
+ * refused by the runtime (Elysia's Bun adapter hardcodes `reusePort: true`), so
+ * two servers would coexist on one port and only the first-bound socket would
+ * receive connections. The newcomer would look healthy in its own log while the
+ * browser kept talking to the old build; the guard stops that state from being
+ * created in the first place.
+ */
+
+import fs from 'fs';
+
+import { getProcessState } from '@/server/lib/lifecycle/identity';
+import { describeOccupant, findOccupant } from '@/server/lib/lifecycle/occupant';
+import { getLockPath } from '@/server/lib/lifecycle/paths';
+import { isPortAvailable } from '@/server/lib/lifecycle/probe';
+
+const LOCK_WAIT_MS = 3_000;
+/** Grace period for a port that is settling (a server that just exited, or one that is starting). */
+const SETTLE_WAIT_MS = 3_000;
+
+export class PortInUseError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = 'PortInUseError';
+  }
+}
+
+export interface PortLock {
+  release: () => void;
+}
+
+/**
+ * Exclusive per-port startup lock.
+ *
+ * Two starters racing on one free port would each probe it as free and then
+ * fight over the bind, with the loser reporting a bare `EADDRINUSE` against a
+ * process it cannot identify yet. Holding the lock across probe-and-bind makes
+ * the loser fail with a message that names the actual situation. A lock whose
+ * holder is dead (or is not OMPChamber, i.e. a recycled PID) is reclaimed.
+ *
+ * Returns null when another starter holds the lock through the wait window.
+ */
+export async function acquirePortLock(port: number, waitMs = LOCK_WAIT_MS): Promise<PortLock | null> {
+  const lockPath = getLockPath(port);
+  const deadline = Date.now() + waitMs;
+  for (;;) {
+    try {
+      fs.writeFileSync(lockPath, String(process.pid), { flag: 'wx', mode: 0o600 });
+      return { release: () => releasePortLock(lockPath) };
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== 'EEXIST') return null;
+    }
+
+    let holder = Number.NaN;
+    try {
+      holder = Number(fs.readFileSync(lockPath, 'utf8').trim());
+    } catch {
+      continue;
+    }
+
+    const holderState = Number.isFinite(holder) && holder > 0 ? getProcessState(holder) : 'dead';
+    if (holderState === 'dead' || holderState === 'mismatched') {
+      fs.rmSync(lockPath, { force: true });
+      continue;
+    }
+    if (holder === process.pid) return { release: () => releasePortLock(lockPath) };
+    if (Date.now() >= deadline) return null;
+    await Bun.sleep(150);
+  }
+}
+
+function releasePortLock(lockPath: string): void {
+  try {
+    if (fs.readFileSync(lockPath, 'utf8').trim() === String(process.pid)) fs.rmSync(lockPath, { force: true });
+  } catch {
+    // Already gone, or never ours to remove.
+  }
+}
+
+export interface ClaimPortOptions {
+  port: number;
+  host: string;
+  /**
+   * Binds the port; must throw when the OS refuses. Retried while the port
+   * looks occupied by something that is not an identified OMPChamber instance.
+   */
+  listen: () => Promise<void>;
+}
+
+/**
+ * Bind `port`, or fail with an actionable error.
+ *
+ * The bind is the authoritative question ("can this process listen here") and
+ * `listen` is what answers it; the probe only short-circuits the common case.
+ * When either says the port is taken, the occupant is identified so the error
+ * can name it — and then the process exits, leaving every other instance
+ * running.
+ */
+export async function claimPort({ port, host, listen }: ClaimPortOptions): Promise<void> {
+  const deadline = Date.now() + SETTLE_WAIT_MS;
+  let bindError: unknown = null;
+
+  for (;;) {
+    if (await isPortAvailable(port, host)) {
+      try {
+        await listen();
+        return;
+      } catch (error) {
+        bindError = error;
+      }
+    }
+
+    const occupant = await findOccupant(port, host);
+
+    // `bun run --hot` re-evaluates this entry inside the running process, so the
+    // port is held by *us* and Bun swaps the fetch handler on the next `listen`.
+    // Treating that as a conflict would kill the dev loop on every save.
+    if (occupant && occupant.pid === process.pid) {
+      await listen();
+      return;
+    }
+
+    if (occupant) throw await buildPortInUseError(port, host, bindError);
+
+    if (Date.now() >= deadline) throw await buildPortInUseError(port, host, bindError);
+    await Bun.sleep(200);
+  }
+}
+
+/** Every way to point this server at another port. */
+function portGuidance(): string {
+  return [
+    '    ompchamber serve --port 3001',
+    '    OMPCHAMBER_PORT=3001 ompchamber serve',
+    '    PORT=3001 bun run dev          # or: PORT=3001 bun run start',
+  ].join('\n');
+}
+
+async function buildPortInUseError(port: number, host: string, bindError: unknown): Promise<PortInUseError> {
+  const occupant = await findOccupant(port, host);
+  const bindDetail = bindError instanceof Error ? `\n  Bind error: ${bindError.message}` : '';
+
+  if (occupant) {
+    return new PortInUseError(
+      `Port ${port} is already served by OMPChamber ${describeOccupant(occupant)}.\n`
+      + `  Nothing was stopped — a starting instance never stops another one.\n`
+      + `  Stop it first:  ompchamber stop --port ${port}\n`
+      + `  Or start on another port:\n${portGuidance()}`,
+    );
+  }
+
+  return new PortInUseError(
+    `Port ${port} is in use by another process (no OMPChamber instance answered on it).${bindDetail}\n`
+    + `  Find it with:  lsof -nP -iTCP:${port} -sTCP:LISTEN\n`
+    + `  Start on another port:\n${portGuidance()}`,
+  );
+}

package/src/server/lib/lifecycle/probe.ts

@@ -0,0 +1,121 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Port occupancy probing.
+ *
+ * Availability is decided by *attempting a bind*, not by inspecting a PID file.
+ * That matters on Bun: `Bun.serve` — and therefore Elysia's `listen`, which
+ * hardcodes `reusePort: true` — lets a second process bind a port already in
+ * use, so the only reliable question a starter can ask the OS is "can I bind
+ * this?" (`net.createServer` never sets SO_REUSEPORT, so a second bind fails as
+ * it should, regardless of who is already listening).
+ */
+
+import net from 'net';
+
+const HEALTH_TIMEOUT_MS = 1500;
+
+/**
+ * Address a local probe should use for a bind host.
+ *
+ * `0.0.0.0`/`::` are bind-any addresses and cannot be connected to; loopback is
+ * the address that reaches the same listener.
+ */
+export function probeHost(host?: string | null): string {
+  const value = (host ?? '').trim();
+  if (value.length === 0 || value === '0.0.0.0' || value === '::' || value === '[::]') return '127.0.0.1';
+  return value;
+}
+
+/**
+ * True when `port` can still be bound on `host`.
+ *
+ * The probe binds *the same address the server will bind* — a wildcard server
+ * is probed with a wildcard bind. Probing loopback instead would ask a
+ * different question: `net` sets SO_REUSEADDR, so a loopback bind can succeed
+ * while `0.0.0.0:<port>` is already taken, and the port would look free right
+ * up until the real `listen` failed.
+ */
+export async function isPortAvailable(port: number, host?: string | null): Promise<boolean> {
+  if (!Number.isFinite(port) || port <= 0) return false;
+  const bindHost = (host ?? '').trim() || 'localhost';
+  const { promise, resolve } = Promise.withResolvers<boolean>();
+  const probe = net.createServer();
+  probe.unref();
+  probe.once('error', () => resolve(false));
+  probe.listen({ port, host: bindHost }, () => {
+    probe.close(() => resolve(true));
+  });
+  return await promise;
+}
+
+/** Poll until the port can be bound, or the deadline passes. */
+export async function waitForPortFree(
+  port: number,
+  host: string | null | undefined,
+  timeoutMs: number,
+  intervalMs = 150,
+): Promise<boolean> {
+  const deadline = Date.now() + Math.max(0, timeoutMs);
+  for (;;) {
+    if (await isPortAvailable(port, host)) return true;
+    if (Date.now() >= deadline) return false;
+    await Bun.sleep(intervalMs);
+  }
+}
+
+export interface HealthPayload {
+  service: string;
+  pid?: number;
+  version?: string;
+  startedAt?: string;
+  uptime?: number;
+  mock?: boolean;
+  runtime?: string;
+  mode?: string;
+  port?: number;
+  host?: string;
+}
+
+/**
+ * `GET /api/health` for an OMPChamber listener, or null.
+ *
+ * Only payloads that identify themselves as OMPChamber are returned — every
+ * caller here is asking "is an OMPChamber server on this port", so a foreign
+ * HTTP service answers null rather than a half-trusted object.
+ */
+export async function fetchHealth(
+  port: number,
+  host?: string | null,
+  timeoutMs = HEALTH_TIMEOUT_MS,
+): Promise<HealthPayload | null> {
+  if (!Number.isFinite(port) || port <= 0) return null;
+  try {
+    const response = await fetch(`http://${probeHost(host)}:${port}/api/health`, {
+      headers: { accept: 'application/json' },
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    if (!response.ok) return null;
+    const body: unknown = await response.json();
+    if (!body || typeof body !== 'object') return null;
+    const payload = body as Record<string, unknown>;
+    if (payload.service !== 'ompchamber') return null;
+    return {
+      service: 'ompchamber',
+      pid: typeof payload.pid === 'number' ? payload.pid : undefined,
+      version: typeof payload.version === 'string' ? payload.version : undefined,
+      startedAt: typeof payload.startedAt === 'string' ? payload.startedAt : undefined,
+      uptime: typeof payload.uptime === 'number' ? payload.uptime : undefined,
+      mock: typeof payload.mock === 'boolean' ? payload.mock : undefined,
+      runtime: typeof payload.runtime === 'string' ? payload.runtime : undefined,
+      mode: typeof payload.mode === 'string' ? payload.mode : undefined,
+      port: typeof payload.port === 'number' ? payload.port : undefined,
+      host: typeof payload.host === 'string' ? payload.host : undefined,
+    };
+  } catch {
+    return null;
+  }
+}

package/src/server/lib/models/provider-registry.server.ts

@@ -23,12 +23,54 @@ export const PROVIDERS_SETTINGS_KEY = 'omp_providers_config';
 
 const RPC_CACHE_TTL_MS = 60_000;
 
-interface LoginProvider {
+/** Minimal shape of a get_login_providers entry, as the chamber reads it. */
+export interface DetectedLoginProvider {
   id: string;
   name: string;
   authenticated: boolean;
 }
 
+function isDetectedLoginProvider(provider: unknown): provider is DetectedLoginProvider {
+  return (
+    typeof provider === 'object' && provider !== null
+    && typeof (provider as { id?: unknown }).id === 'string'
+    && typeof (provider as { name?: unknown }).name === 'string'
+    && typeof (provider as { authenticated?: unknown }).authenticated === 'boolean'
+  );
+}
+
+function isOmpModel(model: unknown): model is OmpModel {
+  return (
+    typeof model === 'object' && model !== null
+    && typeof (model as OmpModel).id === 'string'
+    && typeof (model as OmpModel).provider === 'string'
+  );
+}
+
+export interface OmpRegistrySnapshot {
+  /** Login providers omp reports (authenticated or not). */
+  providers: DetectedLoginProvider[];
+  /** Every model omp currently serves. */
+  models: OmpModel[];
+}
+
+/**
+ * Raw omp registry probe — the two commands that define "detected" for the
+ * chamber: the login providers omp knows and the models they serve. Parsed here
+ * once so the provider settings page and the startup banner count the same set.
+ * Throws when the utility RPC is unreachable; each caller degrades its own way.
+ */
+export async function fetchOmpRegistrySnapshot(): Promise<OmpRegistrySnapshot> {
+  const [loginResponse, modelsResponse] = await Promise.all([
+    runUtilityCommand<{ providers?: unknown }>({ type: 'get_login_providers' }, 30_000),
+    runUtilityCommand<{ models?: unknown }>({ type: 'get_available_models' }, 60_000),
+  ]);
+  return {
+    providers: Array.isArray(loginResponse.providers) ? loginResponse.providers.filter(isDetectedLoginProvider) : [],
+    models: Array.isArray(modelsResponse.models) ? modelsResponse.models.filter(isOmpModel) : [],
+  };
+}
+
 /**
  * Provider registry straight from the omp agent: authenticated login providers
  * (omp auth) plus their registered models (get_available_models). This is the
@@ -38,25 +80,7 @@ async function loadRpcProviderItems(): Promise<ProviderItem[]> {
   const cached = globalThis.__ompChamberProvidersRpcCache;
   if (cached && cached.expiresAt > Date.now()) return cached.data;
   try {
-    const [loginResponse, modelsResponse] = await Promise.all([
-      runUtilityCommand<{ providers?: unknown }>({ type: 'get_login_providers' }, 30_000),
-      runUtilityCommand<{ models?: unknown }>({ type: 'get_available_models' }, 60_000),
-    ]);
-    const loginProviders = Array.isArray(loginResponse.providers)
-      ? loginResponse.providers.filter((provider): provider is LoginProvider => (
-          typeof provider === 'object' && provider !== null
-          && typeof (provider as { id?: unknown }).id === 'string'
-          && typeof (provider as { name?: unknown }).name === 'string'
-          && typeof (provider as { authenticated?: unknown }).authenticated === 'boolean'
-        ))
-      : [];
-    const available = Array.isArray(modelsResponse.models)
-      ? modelsResponse.models.filter((model): model is OmpModel => (
-          typeof model === 'object' && model !== null
-          && typeof (model as OmpModel).id === 'string'
-          && typeof (model as OmpModel).provider === 'string'
-        ))
-      : [];
+    const { providers: loginProviders, models: available } = await fetchOmpRegistrySnapshot();
     const disabled = await readDisabledProviders().catch(() => new Set<string>());
 
     const items = loginProviders.map((provider) => {

package/src/server/lib/omp/core/cli.ts

@@ -20,6 +20,7 @@ let cachedBin: string | null = null;
 let binMissAt = 0;
 
 const BIN_NAME = process.platform === 'win32' ? 'omp.exe' : 'omp';
+
 // Only successes are cached for the process lifetime. omp may be installed (or
 // PATH repaired) while the server runs; a permanently cached "not found" would
 // keep the UI reporting a missing binary until restart.
@@ -32,7 +33,7 @@ export function invalidateOmpCliCache(): void {
 }
 
 function probeOmpBin(): string | null {
-  const override = Bun.env.OMP_WEB_OMP_BIN;
+  const override = Bun.env.OMPCHAMBER_OMP_BIN;
   if (override) return existsSync(override) ? override : null;
 
   const onPath = Bun.which(BIN_NAME);
@@ -49,7 +50,7 @@ function probeOmpBin(): string | null {
   return Bun.which(BIN_NAME, { PATH: fallbackPath });
 }
 
-/** Resolve the omp binary: OMP_WEB_OMP_BIN override, then PATH lookup. Returns
+/** Resolve the omp binary: OMPCHAMBER_OMP_BIN override, then PATH lookup. Returns
  * null when omp is not installed. A hit is cached for the process lifetime; a
  * miss is re-probed after MISS_TTL_MS. */
 export function resolveOmpBin(): string | null {

package/src/server/lib/omp/core/startup.ts

@@ -0,0 +1,64 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Startup gate: the chamber must not run without a resolvable `omp` binary.
+ *
+ * Every live capability — RPC agent sessions, config get/set, session state,
+ * model lists, updates — shells out to that binary (see ./cli.ts), so a missing
+ * install is not a degraded mode to browse into: the UI would open onto an
+ * empty shell whose every action fails. Both entry points call this before
+ * binding a port (src/server/index.ts) or spawning a detached server
+ * (src/cli/lib/commands/serve.js), turning the failure into one actionable line
+ * instead of a health check that never passes.
+ *
+ * `MOCK=true` is exempt by definition — demo mode exists to run on presets
+ * without a real omp install.
+ */
+
+import { resolveOmpBin } from '@/server/lib/omp/core/cli';
+import { getAgentDir, getConfigRoot } from '@/server/lib/omp/core/paths';
+import { isMockMode } from '@/server/mock.server';
+
+/** Null when the app may start; otherwise the message to print before exiting. */
+export function ompStartupError(): string | null {
+  if (isMockMode()) return null;
+  if (resolveOmpBin()) return null;
+  return [
+    'omp binary not found — OMPChamber cannot start.',
+    'Agent sessions, omp config, session state and updates all run through the `omp` CLI,',
+    'so the binary must be resolvable before the server starts.',
+    'Install AI Oh-My-Pi and put `omp` on your PATH, or set OMPCHAMBER_OMP_BIN=/path/to/omp.',
+    'To run on demo data without an omp install, start with MOCK=true.',
+  ].join('\n');
+}
+
+interface OmpStartupPaths {
+  /** Resolved `omp` executable, or null when unresolved (mock mode). */
+  bin: string | null;
+  /** `~/.omp` — PI_CONFIG_DIR rename applied. */
+  configDir: string;
+  /** `~/.omp/agent` — PI_CODING_AGENT_DIR override applied. */
+  agentDir: string;
+}
+
+/** Startup banner lines. The caller owns the prefix.
+ *
+ *  These are the locations the running process actually uses: the executable it
+ *  spawns and the agent tree it reads. Printing them makes a misdirected install
+ *  (two omps on PATH, a stray PI_CODING_AGENT_DIR) visible in the log instead of
+ *  inferred from empty session lists. */
+export function ompStartupLogLines(): string[] {
+  const paths: OmpStartupPaths = {
+    bin: resolveOmpBin(),
+    configDir: getConfigRoot(),
+    agentDir: getAgentDir(),
+  };
+  return [
+    `omp binary:     ${paths.bin ?? 'not found (MOCK mode — presets only)'}`,
+    `omp config dir: ${paths.configDir}`,
+    `omp agent dir:  ${paths.agentDir}`,
+  ];
+}

package/src/server/lib/omp/rpc/process.ts

@@ -46,7 +46,7 @@ export class RpcProcess {
     const resolveBin = options.dependencies?.resolveOmpBin ?? resolveOmpBin;
     const bin = resolveBin();
     if (!bin) {
-      throw new Error('omp binary not found. Install oh-my-pi or set OMP_WEB_OMP_BIN.');
+      throw new Error('omp binary not found. Install oh-my-pi or set OMPCHAMBER_OMP_BIN.');
     }
     this.cwd = options.cwd;
     if (options.onFrame) this.frameListeners.add(options.onFrame);

package/src/server/mock.server.ts

@@ -5,29 +5,23 @@
 
 /**
  * Utility to determine whether the application is running in MOCK mode.
- * 
+ *
  * - When MOCK=true (or MOCK=1): all data uses mock / simulated presets (demo chat traces, mock token analytics, mock settings presets).
  * - When MOCK=false (or MOCK=0): all data uses real data (real SQLite persistence, real token calculations, real workspace state).
+ * - Unset (or any unrecognized value) defaults to REAL data — the chamber is a
+ *   diagnostic console for a live omp install, so demo presets must be opted
+ *   into explicitly rather than inherited by omission.
  */
 export function isMockMode(): boolean {
   const envVal = (Bun.env.MOCK || '').trim().toLowerCase();
-  
-  if (envVal === 'false' || envVal === '0' || envVal === 'off' || envVal === 'no') {
-    return false;
-  }
-  
-  if (envVal === 'true' || envVal === '1' || envVal === 'on' || envVal === 'yes') {
-    return true;
-  }
 
-  // Default to true for sandbox / preview demo mode if not explicitly set to false
-  return true;
+  return envVal === 'true' || envVal === '1' || envVal === 'on' || envVal === 'yes';
 }
 
 export function getMockModeInfo(): { isMock: boolean; rawEnv: string } {
   const isMock = isMockMode();
   return {
     isMock,
-    rawEnv: Bun.env.MOCK || (isMock ? 'true (default)' : 'false'),
+    rawEnv: Bun.env.MOCK || (isMock ? 'true' : 'false (default)'),
   };
 }