total-recall-brain 3.25.5 → 3.26.0

package/src/core/pairing.mjs

@@ -1,6 +1,18 @@
 /**
  * Mobile pairing endpoints — reachable URLs for QR codes.
  * Never hardcodes personal hostnames; derives from live interfaces + server port.
+ *
+ * `listenHosts` MUST be the addresses the server actually bound. This used to be
+ * derived as "loopback plus whatever getMeshIp() says right now", which is a
+ * guess that silently fabricates a binding: a brain that lost the boot race
+ * against the mesh client is listening on loopback alone, yet the derivation
+ * claimed the mesh address too. The card then recommended that address and drew
+ * a QR code for it, with no warning, because every reachability check below
+ * reads these hosts. One machine served that dead QR for a week.
+ *
+ * When the caller cannot observe the real bindings the result is still returned,
+ * but flagged `listen_hosts_source: 'derived'` and `reachable_from_other_devices:
+ * null` — unknown, which the UI must not render as working.
  */
 import { listLocalInterfaces, isLanIpv4, isOverlayIpv4 } from './network-interfaces.mjs';
 import { getMeshIp } from './mesh.mjs';
@@ -21,9 +33,9 @@ export function buildPairingInfo(opts = {}) {
     ? opts.listInterfaces()
     : listLocalInterfaces();
   const meshIp = opts.meshIp !== undefined ? opts.meshIp : getMeshIp();
-  const listenHosts = Array.isArray(opts.listenHosts)
-    ? opts.listenHosts
-    : deriveListenHosts(meshIp);
+  const observedHosts = Array.isArray(opts.listenHosts) && opts.listenHosts.length > 0;
+  const listenHosts = observedHosts ? opts.listenHosts : deriveListenHosts();
+  const listenHostsSource = observedHosts ? 'actual' : 'derived';
 
   /** @type {Array<{ kind: string, label: string, ip: string, url: string, interface?: string, recommended: boolean, reachable_hint: string }>} */
   const endpoints = [];
@@ -41,6 +53,8 @@ export function buildPairingInfo(opts = {}) {
       interface: ifaceName || null,
       recommended: !!recommended,
       reachable_hint: hint,
+      // Filled in below, once listenHosts is known to be observed or guessed.
+      listening: null,
     });
   };
 
@@ -143,10 +157,32 @@ export function buildPairingInfo(opts = {}) {
     warnings.push(`Mesh IP ${meshIp} is present but may not be the active listen address.`);
   }
 
+  // Only claim a per-endpoint verdict when the bindings were observed. A guess
+  // that renders as a green tick is worse than no tick at all.
+  for (const e of endpoints) {
+    e.listening = observedHosts ? isListening(e.ip) : null;
+  }
+
+  const reachable = observedHosts
+    ? listenHosts.some((h) => h !== '127.0.0.1' && h !== '::1' && h !== 'localhost')
+    : null;
+
+  if (reachable === false) {
+    // The headline problem, stated first: no QR on this card can work.
+    warnings.unshift(
+      `This brain is listening on loopback only (${listenHosts.join(', ')}), so no other `
+      + 'device can open its UI — a phone scanning any code here will fail to connect. '
+      + 'This usually means the mesh client was still starting when the brain launched. '
+      + 'Restart the brain once the mesh is up, or set a bind host, and this resolves.',
+    );
+  }
+
   return {
     port,
     protocol,
     listen_hosts: listenHosts,
+    listen_hosts_source: listenHostsSource,
+    reachable_from_other_devices: reachable,
     preferred_url: preferred?.url || null,
     endpoints,
     warnings,
@@ -154,15 +190,18 @@ export function buildPairingInfo(opts = {}) {
   };
 }
 
-function deriveListenHosts(meshIp) {
+/**
+ * Last-resort guess for callers that cannot observe the real sockets.
+ *
+ * Deliberately does NOT include the mesh address. `getMeshIp()` reporting one
+ * means the mesh client is up *now* — it says nothing about whether this
+ * process bound it, and assuming so is exactly the bug this module documents.
+ * Only an explicitly configured host is added, because that one was at least
+ * requested.
+ */
+function deriveListenHosts() {
   const hosts = new Set(['127.0.0.1']);
-  if (meshIp) hosts.add(meshIp);
   const envHost = process.env.HOST || process.env.TR_HOST;
   if (envHost) hosts.add(envHost);
-  // Production dual-bind pattern in server/index.mjs
-  if (meshIp && meshIp !== '127.0.0.1') {
-    hosts.add(meshIp);
-    hosts.add('127.0.0.1');
-  }
   return [...hosts];
 }

package/src/core/registration-watch.mjs

@@ -0,0 +1,193 @@
+/**
+ * registration-watch — arm the server to approve the next device that asks.
+ *
+ * The pairing UI was built backwards: it minted a key, drew a QR nobody can
+ * scan (no Tailscale client scans QR codes to authenticate — tailscale#8267,
+ * #13377, #14184 are still open feature requests), and asked the user to carry
+ * a 40-character secret from a laptop to a phone by hand.
+ *
+ * The direction that actually works is the reverse. The device generates a
+ * registration id and waits; the server approves it. Done as a watcher this is
+ * a single button: arm it, sign in on the phone, and it connects with nothing
+ * typed or copied anywhere.
+ *
+ * The constraint is that headscale exposes no pending-registration API — the
+ * entry lives in an in-memory cache and is visible only in the server's log
+ * output. So watch mode needs a log source, and where none is configured this
+ * module reports `unavailable` rather than pretending: the UI then falls back
+ * to pasting the id by hand.
+ *
+ * Nothing here names a host. The log command comes from configuration.
+ */
+import { execFile } from 'node:child_process';
+import { logger } from './logger.mjs';
+
+/** headscale prints the id in the register URL; this is the only shape we need. */
+const AUTH_ID = /hskey-authreq-[A-Za-z0-9._-]+/g;
+
+const DEFAULT_TTL_MS = 5 * 60 * 1000;
+const POLL_MS = 2000;
+// The registration cache entry only lives while the client holds the request
+// open, so a slow poll is the difference between catching it and missing it.
+const MAX_TTL_MS = 15 * 60 * 1000;
+
+/** @type {{state: string, since: number, expiresAt: number, id: string|null, node: object|null, error: string|null, timer: any}|null} */
+let current = null;
+// The terminal result must outlive the watch. The UI learns the outcome by
+// polling, so discarding it on stop meant a device could join and the page
+// would only ever see 'idle' -- a success nobody is told about.
+let last = null;
+
+/**
+ * Where to read headscale's log output from.
+ *
+ * Resolution order, all configuration — never a hardcoded host:
+ *   1. TR_HEADSCALE_LOG_CMD  — an explicit shell command
+ *   2. the `headscale_log_command` field on the stored headscale API key
+ *
+ * @returns {Promise<{cmd: string} | null>}
+ */
+export async function resolveLogSource(brainDir, { findMeta } = {}) {
+  const fromEnv = (process.env.TR_HEADSCALE_LOG_CMD || '').trim();
+  if (fromEnv) return { cmd: fromEnv, origin: 'TR_HEADSCALE_LOG_CMD' };
+  try {
+    const lookup = findMeta || (await import('./headscale-client.mjs')).findHeadscaleKeyMeta;
+    const meta = await lookup(brainDir);
+    const cmd = (meta?.headscale_log_command || '').trim();
+    if (cmd) return { cmd, origin: 'headscale key config' };
+  } catch {
+    /* not configured */
+  }
+  return null;
+}
+
+/** Run the configured log command and return its output. */
+function readLog(cmd, { timeoutMs = 8000 } = {}) {
+  return new Promise((resolve) => {
+    // Shell form is required: operators configure things like
+    // `ssh host 'docker logs --since 2m headscale'`.
+    execFile('/bin/sh', ['-c', cmd], { timeout: timeoutMs, maxBuffer: 8 * 1024 * 1024 }, (err, stdout, stderr) => {
+      if (err && !stdout) return resolve({ ok: false, error: (stderr || err.message || '').slice(0, 300) });
+      resolve({ ok: true, text: `${stdout || ''}\n${stderr || ''}` });
+    });
+  });
+}
+
+/** Newest registration id in a chunk of log text, or null. */
+export function latestAuthId(text) {
+  const found = String(text || '').match(AUTH_ID);
+  return found && found.length ? found[found.length - 1] : null;
+}
+
+export function getWatchStatus() {
+  if (!current) return last || { state: 'idle' };
+  const { timer, ...rest } = current;
+  return { ...rest, remaining_ms: Math.max(0, current.expiresAt - Date.now()) };
+}
+
+/** Forget the last terminal result, so a new watch starts from a clean slate. */
+export function clearWatchResult() {
+  last = null;
+}
+
+export function stopWatch(state = 'stopped') {
+  if (!current) {
+    const prior = last || { state: 'idle' };
+    last = null;
+    return prior.state === 'idle' ? prior : { ...prior, state: 'stopped' };
+  }
+  clearTimeout(current.timer);
+  const { timer, ...rest } = current;
+  const final = { ...rest, state, remaining_ms: 0 };
+  current = null;
+  // Keep registered/expired so the UI can report it; a manual stop is not news.
+  last = state === 'stopped' ? null : final;
+  return final;
+}
+
+/**
+ * Arm the watcher.
+ *
+ * @param {object} opts
+ * @param {string} opts.brainDir
+ * @param {number} [opts.ttlMs]
+ * @param {(id: string) => Promise<object>} opts.register  approve one id
+ * @param {() => Promise<{cmd: string}|null>} [opts.logSource]
+ */
+export async function startWatch({ brainDir, ttlMs, register, logSource } = {}) {
+  if (current) return { ...getWatchStatus(), already_running: true };
+  last = null;
+
+  const resolve = logSource || (() => resolveLogSource(brainDir));
+  const source = await resolve();
+  if (!source) {
+    return {
+      state: 'unavailable',
+      error:
+        'Watch mode needs to read the headscale server log, and no log source is configured. '
+        + 'headscale has no pending-registration API, so there is nowhere else to see a device waiting. '
+        + 'Set TR_HEADSCALE_LOG_CMD (for example a command that tails the headscale service on its host), '
+        + 'or paste the code from the device instead.',
+    };
+  }
+
+  const ttl = Math.min(Math.max(Number(ttlMs) || DEFAULT_TTL_MS, 30_000), MAX_TTL_MS);
+  // Ids already in the log are from earlier attempts. headscale has forgotten
+  // them, so approving one always fails -- and worse, it would consume the
+  // watch and report success on a device that never connected.
+  const seed = await readLog(source.cmd);
+  const seen = new Set();
+  if (seed.ok) {
+    for (const id of String(seed.text).match(AUTH_ID) || []) seen.add(id);
+  }
+
+  current = {
+    state: 'watching',
+    since: Date.now(),
+    expiresAt: Date.now() + ttl,
+    id: null,
+    node: null,
+    error: seed.ok ? null : `log source failed: ${seed.error}`,
+    source: source.origin,
+    ignored_existing: seen.size,
+    timer: null,
+  };
+
+  const tick = async () => {
+    if (!current || current.state !== 'watching') return;
+    if (Date.now() >= current.expiresAt) {
+      logger.info('registration-watch', 'watch expired with no new device');
+      stopWatch('expired');
+      return;
+    }
+    const out = await readLog(source.cmd);
+    if (out.ok) {
+      const ids = (String(out.text).match(AUTH_ID) || []).filter((id) => !seen.has(id));
+      if (ids.length) {
+        const id = ids[ids.length - 1];
+        seen.add(id);
+        current.id = id;
+        try {
+          const node = await register(id);
+          current.node = node;
+          logger.info('registration-watch', `approved ${node?.name || 'device'} from watch`);
+          stopWatch('registered');
+          return;
+        } catch (err) {
+          // A failure here is usually the cache having already dropped it.
+          // Keep watching: the next sign-in attempt produces a fresh id.
+          current.error = err?.message || 'register failed';
+          logger.warn('registration-watch', `approve failed for ${id}: ${current.error}`);
+        }
+      }
+    } else {
+      current.error = `log source failed: ${out.error}`;
+    }
+    current.timer = setTimeout(tick, POLL_MS);
+    current.timer.unref?.();
+  };
+
+  current.timer = setTimeout(tick, POLL_MS);
+  current.timer.unref?.();
+  return getWatchStatus();
+}

package/src/core/secrets-store.mjs

@@ -314,6 +314,11 @@ export function mergeSecretMeta(prev = {}, patch = {}) {
   assign('notes', (v) => (v == null || v === '' ? null : String(v)));
   assign('project_path', (v) => (v == null || v === '' ? null : String(v)));
   assign('headscale_url', (v) => (v == null || v === '' ? null : String(v)));
+  // Command that prints the headscale server log. Watch mode needs it because
+  // headscale exposes no pending-registration API -- a device waiting to be
+  // approved is visible only in the log. Kept as config so no host is ever
+  // named in code.
+  assign('headscale_log_command', (v) => (v == null || v === '' ? null : String(v)));
   // Live provider account / usage / subscription tracking (provider-account-sync)
   assign('tracking_exempt', (v) => !!v);
   assign('tracking_status', (v) => {
@@ -523,6 +528,7 @@ export async function listSecretsMeta(brainDir) {
       updated_at: m.updated_at || null,
       rotated_at: m.rotated_at || null,
       headscale_url: m.headscale_url || null,
+      headscale_log_command: m.headscale_log_command || null,
       usage_30d: usage,
       tiers: catalog?.tiers || [],
       // Provider account/usage tracking (must be ok or exempt — else error)
@@ -762,6 +768,8 @@ export async function setSecret(brainDir, key, value, opts = {}) {
     monthly_cap_usd: opts.monthly_cap_usd !== undefined ? opts.monthly_cap_usd : prev.monthly_cap_usd,
     api_docs_url: opts.api_docs_url !== undefined ? opts.api_docs_url : prev.api_docs_url,
     headscale_url: opts.headscale_url !== undefined ? opts.headscale_url : prev.headscale_url,
+    headscale_log_command:
+      opts.headscale_log_command !== undefined ? opts.headscale_log_command : prev.headscale_log_command,
     rotate_every_days: opts.rotate_every_days !== undefined ? opts.rotate_every_days : prev.rotate_every_days,
     auto_rotate: opts.auto_rotate !== undefined ? opts.auto_rotate : prev.auto_rotate,
     notes: opts.notes !== undefined ? opts.notes : prev.notes,

package/src/server/auth.mjs

@@ -36,7 +36,17 @@ export function loadSecurityConfig() {
       dashboard: {},
       api: { pats: [], allow_static_pats: false },
       network: { require_https: true, public_health: false, allowed_origins: [], trusted_proxies: [] },
-      bind: { host: '127.0.0.1', port: 3000, allow_public_bind: false },
+      // No `host` here, deliberately. This default used to say '127.0.0.1',
+      // which `resolveServerHost()` cannot tell apart from a user who typed
+      // that address on purpose — configuredHost wins over meshIp, so a mesh
+      // address was discovered and then thrown away. Every install without a
+      // config file bound loopback only, permanently and silently: the brain
+      // answered fine on its own console and was invisible to every other
+      // device, while the pairing card went on recommending the mesh URL.
+      // Leaving it unset lets the precedence do its job — explicit config,
+      // else mesh, else loopback. Public binds are still gated by
+      // allow_public_bind below.
+      bind: { port: 3000, allow_public_bind: false },
       rate_limits: { api_requests_per_minute: 1200 },
       sandbox: { enabled: false }
     };

package/src/server/index.mjs

@@ -783,6 +783,12 @@ const serverSecurityConfig = loadSecurityConfig();
 const PORT = configPort || serverSecurityConfig.bind?.port || 3000;
 import { getMeshIp } from '../core/mesh.mjs';
 import { resolveServerHost } from '../core/network-bind.mjs';
+import {
+  registerBoundHost,
+  getBoundHosts,
+  isReachableFromOtherDevices,
+} from '../core/bound-hosts.mjs';
+import { startMeshBindWatch } from '../core/mesh-late-bind.mjs';
 
 const meshIp = getMeshIp();
 const bindResolution = resolveServerHost({
@@ -835,10 +841,37 @@ try {
 
 const server = app.listen(PORT, HOST, () => {
   setupUpgradeHandler(server);
+  registerBoundHost(HOST);
   if (HOST !== configuredHost) {
     logger.error("server", `Refusing public bind '${configuredHost}' in production. Bound to ${HOST}.`);
   }
   logger.info("server", `Total Recall Brain v3.0.0 is listening on http://${HOST}:${PORT}`);
+
+  // Only meaningful once the socket is up: asking before the callback fires
+  // reads an empty set, which is "unknown", so the watch never armed.
+  if (isReachableFromOtherDevices() === false) {
+    logger.warn(
+      'server',
+      `Bound to loopback only — no other device can reach this brain at :${PORT}. `
+      + 'Watching for a mesh address in case the mesh client is still starting.',
+    );
+    startMeshBindWatch({
+      getMeshIp,
+      boundHosts: getBoundHosts,
+      logger,
+      // Never fatal: loopback is already serving, so a failure here is the
+      // status quo rather than an outage.
+      bind: (ip) =>
+        new Promise((resolve, reject) => {
+          const extra = app.listen(PORT, ip, () => {
+            setupUpgradeHandler(extra);
+            registerBoundHost(ip);
+            resolve();
+          });
+          extra.once('error', reject);
+        }),
+    });
+  }
 });
 server.on('error', (err) => {
   logger.error('server', `Failed to bind ${HOST}:${PORT}: ${err.message}. Exiting.`);
@@ -850,6 +883,7 @@ server.on('error', (err) => {
 if (HOST !== '127.0.0.1' && HOST !== '0.0.0.0') {
   const localServer = app.listen(PORT, '127.0.0.1', () => {
     setupUpgradeHandler(localServer);
+    registerBoundHost('127.0.0.1');
     logger.info("server", `Total Recall Brain v3.0.0 is ALSO listening on http://127.0.0.1:${PORT}`);
   });
   localServer.on('error', (err) => {
@@ -859,6 +893,7 @@ if (HOST !== '127.0.0.1' && HOST !== '0.0.0.0') {
   });
 }
 
+
   logger.info("server", "┌─────────────────────────────────────────────┐");
   logger.info("server", "│  Total Recall Brain v3.0.0                  │");
   logger.info("server", "│                                             │");

package/src/server/route-manifest.json

@@ -355,6 +355,18 @@
     "method": "POST",
     "path": "/api/mesh/register-node"
   },
+  {
+    "method": "DELETE",
+    "path": "/api/mesh/watch"
+  },
+  {
+    "method": "GET",
+    "path": "/api/mesh/watch"
+  },
+  {
+    "method": "POST",
+    "path": "/api/mesh/watch"
+  },
   {
     "method": "GET",
     "path": "/api/network/audit"

package/src/server/routes/auth.mjs

@@ -1,11 +1,13 @@
 import express from 'express';
 import {
   requireAuth,
+  isLocalRequest,
   loadSecurityConfig,
   loginHandler,
   logoutHandler,
   changePasswordHandler,
 } from '../auth.mjs';
+import { logger } from '../../core/logger.mjs';
 
 export const authRouter = express.Router();
 
@@ -22,11 +24,40 @@ authRouter.get("/auth/status", (req, res) => {
   res.json({ configured });
 });
 
+/**
+ * First-run: claim an unconfigured brain by setting its dashboard password.
+ *
+ * Unauthenticated by necessity -- there is no credential to present yet. That
+ * makes "who may call this" the only control, and it must be the machine the
+ * brain runs on.
+ *
+ * This was safe by accident for as long as a brain with no security.yml bound
+ * loopback only. Once such a brain binds its mesh address, every device on the
+ * tailnet can reach this route, and the first one to call it owns the brain --
+ * including a phone that later gets lost, or any node someone else was invited
+ * onto. A first-run window is exactly when there is nothing else to stop them.
+ *
+ * Headless hosts set the password over the CLI, which is already the documented
+ * path for a machine with no browser on it.
+ */
 authRouter.post("/auth/setup", async (req, res) => {
   const config = loadSecurityConfig();
   const alreadyConfigured = !!config.dashboard?.password_hash;
   if (alreadyConfigured) {
     return res.status(400).json({ error: "Dashboard password is already configured" });
   }
+  if (!isLocalRequest(req)) {
+    logger.warn(
+      'auth',
+      `Refused remote first-run setup from ${req.ip || req.socket?.remoteAddress || 'unknown'} `
+      + '— an unconfigured brain may only be claimed from the machine it runs on.',
+    );
+    return res.status(403).json({
+      error:
+        'First-run setup must come from the machine running this brain. '
+        + 'On a headless host, set the password with the CLI instead: '
+        + 'npx total-recall reset-password',
+    });
+  }
   return changePasswordHandler(req, res);
 });

package/src/server/routes/mesh.mjs

@@ -372,6 +372,61 @@ router.post('/api/mesh/register-node', requireAuth, requireScope('config:write')
   }
 });
 
+/**
+ * Watch mode: arm the server to approve the next device that asks.
+ *
+ * POST   /api/mesh/watch   arm    (body: { ttlMinutes? })
+ * GET    /api/mesh/watch   status
+ * DELETE /api/mesh/watch   disarm
+ *
+ * This is the flow that actually works. The device generates a registration id
+ * and waits; the server approves it. Nothing is typed, copied or scanned —
+ * which matters because no Tailscale client can scan a QR to authenticate, and
+ * carrying a 40-character key from a laptop to a phone by hand is not a flow
+ * anyone completes.
+ */
+router.post('/api/mesh/watch', requireAuth, requireScope('config:write'), async (req, res) => {
+  try {
+    const { startWatch } = await import('../../core/registration-watch.mjs');
+    const ttlMinutes = Number(req.body?.ttlMinutes);
+    const result = await startWatch({
+      brainDir: BRAIN_DIR,
+      ttlMs: Number.isFinite(ttlMinutes) ? ttlMinutes * 60_000 : undefined,
+      register: async (authId) => {
+        const user = await resolveHeadscaleUser(BRAIN_DIR);
+        const q = `?user=${encodeURIComponent(user)}&key=${encodeURIComponent(authId)}`;
+        const out = await headscaleFetch(`/api/v1/node/register${q}`, { method: 'POST' }, BRAIN_DIR);
+        const parsed = typeof out === 'string' ? JSON.parse(out) : out;
+        const node = parsed?.node || null;
+        return { id: node?.id ?? null, name: node?.givenName || node?.name || null, ip_addresses: node?.ipAddresses || [] };
+      },
+    });
+    // `unavailable` is a real answer, not a failure: it tells the UI to offer
+    // the manual paste box instead of a button that cannot work here.
+    res.status(result.state === 'unavailable' ? 409 : 200).json(result);
+  } catch (err) {
+    res.status(500).json({ state: 'error', error: err.message || 'could not start watch' });
+  }
+});
+
+router.get('/api/mesh/watch', requireAuth, requireScope('config:read'), async (_req, res) => {
+  try {
+    const { getWatchStatus } = await import('../../core/registration-watch.mjs');
+    res.json(getWatchStatus());
+  } catch (err) {
+    res.status(500).json({ state: 'error', error: err.message });
+  }
+});
+
+router.delete('/api/mesh/watch', requireAuth, requireScope('config:write'), async (_req, res) => {
+  try {
+    const { stopWatch } = await import('../../core/registration-watch.mjs');
+    res.json(stopWatch());
+  } catch (err) {
+    res.status(500).json({ state: 'error', error: err.message });
+  }
+});
+
 /**
  * This host's I/O capability profile for agent UI generation
  * (screen, touch, mic, speaker, keyboard, camera, headless, …).

package/src/server/routes/secrets.mjs

@@ -599,6 +599,7 @@ router.post('/api/secrets', requireAuth, requireScope('keys:write', 'config:writ
       monthly_cap_usd: body.monthly_cap_usd ?? catalog?.default_monthly_cap_usd,
       api_docs_url: body.api_docs_url || catalog?.docs_url,
       headscale_url: body.headscale_url,
+      headscale_log_command: body.headscale_log_command,
       rotate_every_days: body.rotate_every_days,
       auto_rotate: body.auto_rotate,
       notes: body.notes,

package/src/server/routes/system.mjs

@@ -126,12 +126,17 @@ router.get('/api/pairing', requireAuth, requireScope('config:read'), async (_req
   try {
     const { buildPairingInfo } = await import('../../core/pairing.mjs');
     const { getMeshIp } = await import('../../core/mesh.mjs');
+    const { getBoundHosts } = await import('../../core/bound-hosts.mjs');
     const protocol = _req.secure || String(_req.headers['x-forwarded-proto'] || '').includes('https')
       ? 'https'
       : 'http';
+    // The addresses this process actually bound — not a guess. Deriving them
+    // let the card recommend, and draw a QR code for, an address nothing was
+    // listening on, while reporting no problem at all.
     const info = buildPairingInfo({
       protocol,
       meshIp: getMeshIp(),
+      listenHosts: getBoundHosts(),
     });
     res.json(info);
   } catch (err) {