wotann 0.5.0 → 0.5.39

package/dist/desktop/companion-server.js

@@ -35,14 +35,17 @@ import { execFileSync, spawn } from "node:child_process";
 import { hostname, networkInterfaces, platform as osPlatform } from "node:os";
 import { join as pathJoin } from "node:path";
 import { resolveWotannHomeSubdir } from "../utils/wotann-home.js";
+import { writeFileAtomic } from "../utils/atomic-io.js";
 import { createSqliteKvStore } from "../utils/sqlite-kv-store.js";
 import { resolveCompanionPort } from "../daemon/port-resolver.js";
 import { WebSocketServer } from "ws";
-import { takeScreenshot, click, moveMouse, drag, scroll, typeText, pressKey, detectPlatform, } from "../computer-use/platform-bindings.js";
+import { parse as yamlParse } from "yaml";
+import { takeScreenshot, click, moveMouse, drag, scroll, typeText, pressKey, detectPlatform, detectAvailableTools, listDesktopActions, } from "../computer-use/platform-bindings.js";
 import { ConversationSyncHandler, MobileVoiceHandler, TaskMonitorHandler, QuickActionHandler, FileShareHandler, PushNotificationHandler, WidgetDataHandler, LiveActivityHandler, } from "../mobile/ios-app.js";
 import { SecureAuthManager } from "../mobile/secure-auth.js";
 import { resolveHaptic } from "../mobile/haptic-feedback.js";
 import { isWithinWorkspace } from "../sandbox/security.js";
+import { getProviderService } from "../providers/provider-service.js";
 /**
  * GA-11 helper — translate a streaming chunk type into the discriminated
  * method name iOS subscribes to. Single source of truth so additions or
@@ -311,9 +314,21 @@ export class PairingManager {
     /**
      * Generate QR code data for pairing.
      * Format: wotann://pair?id=<requestId>&pin=<pin>&host=<host>&port=<port>
+     * When available, embeds remote access metadata so QR/deep-link pairing
+     * works beyond the LAN without requiring a second config.sync round-trip.
      */
-    generateQRData(requestId, pin, host, port) {
-        return `wotann://pair?id=${requestId}&pin=${pin}&host=${host}&port=${port}`;
+    generateQRData(requestId, pin, host, port, remoteAccess) {
+        const params = new URLSearchParams({
+            id: requestId,
+            pin,
+            host,
+            port: String(port),
+        });
+        if (remoteAccess) {
+            params.set("remoteAccess", JSON.stringify(remoteAccess));
+            params.set("remoteEndpoints", JSON.stringify(remoteAccess.endpoints));
+        }
+        return `wotann://pair?${params.toString()}`;
     }
 }
 // ── RPC Handler ─────────────────────────────────────────
@@ -360,6 +375,13 @@ export class CompanionRPCHandler {
         return [...this.handlers.keys()];
     }
 }
+function normalizeP256PublicKey(publicKey) {
+    if (publicKey.length === 65 && publicKey[0] === 0x04)
+        return publicKey;
+    if (publicKey.length === 64)
+        return Buffer.concat([Buffer.from([0x04]), publicKey]);
+    throw new Error(`Invalid P-256 public key: expected 64-byte raw X/Y or 65-byte X9.63, got ${publicKey.length} bytes`);
+}
 /**
  * Methods that DO NOT require an authToken. These are either bootstrapping
  * (to obtain a token in the first place), health-check, or the ECDH key
@@ -367,6 +389,7 @@ export class CompanionRPCHandler {
  */
 export const AUTH_EXEMPT_METHODS = new Set([
     "pair",
+    "pair.offer",
     "pair.local",
     "security.keyExchange",
     "ping",
@@ -374,8 +397,52 @@ export const AUTH_EXEMPT_METHODS = new Set([
 export class AuthTokenStore {
     tokens = new Map();
     sessionTimeoutMs;
-    constructor(sessionTimeoutMs = 24 * 60 * 60_000) {
+    persistence;
+    constructor(sessionTimeoutMs = 24 * 60 * 60_000, persistPath) {
         this.sessionTimeoutMs = sessionTimeoutMs;
+        const store = persistPath ? createSqliteKvStore(persistPath, "tokens") : null;
+        this.persistence = store?.usable ? store : null;
+        if (this.persistence) {
+            const now = Date.now();
+            for (const { key, value } of this.persistence.loadAll()) {
+                const tokenHash = typeof value.tokenHash === "string"
+                    ? value.tokenHash
+                    : typeof value.token === "string"
+                        ? AuthTokenStore.tokenHash(value.token)
+                        : key;
+                if (!tokenHash ||
+                    typeof value.sessionId !== "string" ||
+                    typeof value.deviceId !== "string" ||
+                    typeof value.issuedAt !== "number" ||
+                    typeof value.expiresAt !== "number") {
+                    this.persistence.delete(key);
+                    continue;
+                }
+                if (now > value.expiresAt) {
+                    this.persistence.delete(key);
+                    continue;
+                }
+                this.tokens.set(tokenHash, {
+                    token: "",
+                    sessionId: value.sessionId,
+                    deviceId: value.deviceId,
+                    issuedAt: value.issuedAt,
+                    expiresAt: value.expiresAt,
+                });
+            }
+        }
+    }
+    static tokenHash(token) {
+        return createHash("sha256").update(token).digest("hex");
+    }
+    persist(key, record) {
+        this.persistence?.put(key, {
+            tokenHash: key,
+            sessionId: record.sessionId,
+            deviceId: record.deviceId,
+            issuedAt: record.issuedAt,
+            expiresAt: record.expiresAt,
+        });
     }
     /**
      * Issue a new 32-byte (64 hex char) random token for the given session/device.
@@ -384,14 +451,17 @@ export class AuthTokenStore {
      */
     issue(sessionId, deviceId) {
         const token = randomBytes(32).toString("hex");
+        const key = AuthTokenStore.tokenHash(token);
         const now = Date.now();
-        this.tokens.set(token, {
+        const record = {
             token,
             sessionId,
             deviceId,
             issuedAt: now,
             expiresAt: now + this.sessionTimeoutMs,
-        });
+        };
+        this.tokens.set(key, record);
+        this.persist(key, record);
         return token;
     }
     /**
@@ -401,18 +471,23 @@ export class AuthTokenStore {
     validate(token) {
         if (!token || typeof token !== "string")
             return null;
-        const record = this.tokens.get(token);
+        const key = AuthTokenStore.tokenHash(token);
+        const record = this.tokens.get(key);
         if (!record)
             return null;
         if (Date.now() > record.expiresAt) {
-            this.tokens.delete(token);
+            this.tokens.delete(key);
+            this.persistence?.delete(key);
             return null;
         }
-        return record;
+        return { ...record, token };
     }
     /** Revoke a specific token (e.g. on unpair). */
     revoke(token) {
-        return this.tokens.delete(token);
+        const key = AuthTokenStore.tokenHash(token);
+        const removed = this.tokens.delete(key);
+        this.persistence?.delete(key);
+        return removed;
     }
     /** Revoke all tokens for a given device (e.g. on unpair by deviceId). */
     revokeForDevice(deviceId) {
@@ -420,6 +495,7 @@ export class AuthTokenStore {
         for (const [tok, rec] of this.tokens) {
             if (rec.deviceId === deviceId) {
                 this.tokens.delete(tok);
+                this.persistence?.delete(tok);
                 count++;
             }
         }
@@ -471,6 +547,7 @@ export class CompanionServer {
     connectedClients = new Set();
     running = false;
     runtime = null;
+    runtimeReady = null;
     bridgeRpcHandler = null;
     /** Per-device AES-256 symmetric keys derived from ECDH key exchange. */
     deviceEncryptionKeys = new Map();
@@ -497,6 +574,13 @@ export class CompanionServer {
      * (not module-global) so concurrent test daemons do not share state.
      */
     wsOriginAuditLog = [];
+    /**
+     * One-tap iOS pairing offer advertised through Bonjour TXT records.
+     * The offer is still verified by the same pending-request store as QR
+     * pairing; Bonjour only removes the need for the user to scan the code.
+     */
+    bonjourPairingOffer = null;
+    bonjourRefreshTimer = null;
     constructor(config) {
         // SECURITY (SB-3): default to loopback-only to prevent the companion
         // server from being reachable on every network interface (incl. public
@@ -541,8 +625,8 @@ export class CompanionServer {
         this.pairingManager = new PairingManager(this.config.maxDevices, resolveWotannHomeSubdir("companion-devices.db"));
         this.rpcHandler = new CompanionRPCHandler();
         this.secureAuth = new SecureAuthManager(this.config.sessionTimeoutMs);
-        this.authTokens = new AuthTokenStore(this.config.sessionTimeoutMs);
-        this.conversationSync = new ConversationSyncHandler();
+        this.authTokens = new AuthTokenStore(this.config.sessionTimeoutMs, resolveWotannHomeSubdir("companion-auth-tokens.db"));
+        this.conversationSync = new ConversationSyncHandler(resolveWotannHomeSubdir("mobile-conversations.json"));
         this.mobileVoice = new MobileVoiceHandler();
         this.taskMonitor = new TaskMonitorHandler();
         this.quickAction = new QuickActionHandler();
@@ -750,13 +834,14 @@ export class CompanionServer {
         const serviceName = `WOTANN (${hostname()})`;
         const serviceType = "_wotann._tcp";
         const port = String(this.config.port);
+        const txtRecords = this.getBonjourTxtRecords();
         const os = osPlatform();
         let proc = null;
         let advertiser = "";
         if (os === "darwin") {
             try {
                 // dns-sd is built into macOS — no npm package needed.
-                proc = spawn("dns-sd", ["-R", serviceName, serviceType, "local", port], {
+                proc = spawn("dns-sd", ["-R", serviceName, serviceType, "local", port, ...txtRecords], {
                     stdio: "ignore",
                     detached: true,
                 });
@@ -771,7 +856,7 @@ export class CompanionServer {
             // process; we detach so it survives daemon parent. Package is
             // typically `avahi-utils` (Debian/Ubuntu) or `avahi` (Arch/Fedora).
             try {
-                proc = spawn("avahi-publish-service", [serviceName, serviceType, port], {
+                proc = spawn("avahi-publish-service", [serviceName, serviceType, port, ...txtRecords], {
                     stdio: "ignore",
                     detached: true,
                 });
@@ -810,6 +895,7 @@ export class CompanionServer {
                 /* ignore write errors */
             }
         }
+        this.scheduleBonjourPairingRefresh();
     }
     stop() {
         this.running = false;
@@ -830,16 +916,7 @@ export class CompanionServer {
             this.httpServer = null;
         }
         this.wsServer = null;
-        // Kill Bonjour advertisement.
-        // CI runners restrict process.kill on subprocesses they didn't spawn,
-        // so swallow EPERM/ESRCH instead of letting it propagate.
-        const bonjourProc = this._bonjourProc;
-        try {
-            bonjourProc?.kill?.();
-        }
-        catch {
-            /* sandbox/CI may forbid kill() — non-fatal */
-        }
+        this.stopBonjourAdvertisement();
     }
     isRunning() {
         return this.running;
@@ -856,10 +933,13 @@ export class CompanionServer {
      * pipeline — tasks resolve with { success, result } when the underlying
      * stream ends, or { success:false, result:"error…" } on exception.
      */
-    setRuntime(runtime) {
+    setRuntime(runtime, ready) {
         this.runtime = runtime;
+        this.runtimeReady = ready ?? null;
         this.taskMonitor = new TaskMonitorHandler(async (prompt) => {
             try {
+                if (this.runtimeReady)
+                    await this.runtimeReady;
                 let collected = "";
                 for await (const chunk of runtime.query({ prompt })) {
                     if (typeof chunk === "string")
@@ -907,14 +987,335 @@ export class CompanionServer {
         }
         return hostname();
     }
+    getRemoteEndpoints() {
+        const endpoints = [];
+        const configured = this.parseConfiguredRemoteEndpoint();
+        if (configured)
+            endpoints.push(configured);
+        if (process.env.WOTANN_DISABLE_TAILSCALE_DETECTION !== "1") {
+            const nets = networkInterfaces();
+            for (const addresses of Object.values(nets)) {
+                for (const entry of addresses ?? []) {
+                    if (entry.family !== "IPv4" ||
+                        entry.internal ||
+                        !CompanionServer.isTailscaleIPv4(entry.address)) {
+                        continue;
+                    }
+                    endpoints.push({
+                        kind: "tailnet",
+                        label: "Tailscale",
+                        host: entry.address,
+                        port: this.config.port,
+                        scheme: "ws",
+                    });
+                }
+            }
+            const cliTailnetIp = this.getTailscaleIPv4FromCli();
+            if (cliTailnetIp) {
+                endpoints.push({
+                    kind: "tailnet",
+                    label: "Tailscale",
+                    host: cliTailnetIp,
+                    port: this.config.port,
+                    scheme: "ws",
+                });
+            }
+        }
+        const seen = new Set();
+        return endpoints.filter((endpoint) => {
+            const key = `${endpoint.scheme}://${endpoint.host}:${endpoint.port}`;
+            if (seen.has(key))
+                return false;
+            seen.add(key);
+            return true;
+        });
+    }
+    getRemoteAccessStatus() {
+        const endpoints = this.getRemoteEndpoints();
+        const hasConfiguredEndpoint = endpoints.some((endpoint) => endpoint.kind === "configured");
+        const hasTailnetEndpoint = endpoints.some((endpoint) => endpoint.kind === "tailnet");
+        const mode = hasConfiguredEndpoint ? "configured-url" : hasTailnetEndpoint ? "tailscale" : "unconfigured";
+        const status = endpoints.length > 0 ? "ready" : "missing-endpoint";
+        const setupOptions = [
+            {
+                id: "tailscale",
+                label: "Tailscale private mesh",
+                detail: "Install Tailscale on the Mac and iPhone, sign into the same tailnet, then reopen WOTANN link. WOTANN will advertise the 100.x tailnet address automatically.",
+                url: "https://tailscale.com/download",
+                recommended: true,
+            },
+            {
+                id: "configured-url",
+                label: "Bring your own remote URL",
+                detail: "Use any free tunnel or reverse proxy you already trust, then point WOTANN at its WebSocket URL.",
+                command: "printf '{\"remoteUrl\":\"wss://your-host.example\"}\\n' > ~/.wotann/remote-access.json",
+                recommended: false,
+            },
+        ];
+        return {
+            status,
+            mode,
+            endpoints,
+            setupOptions,
+            message: status === "ready"
+                ? "Off-WiFi access is ready through a remote endpoint advertised by this daemon."
+                : "No Tailscale or configured remote endpoint is available. Add Tailscale or set ~/.wotann/remote-access.json so iOS has an off-WiFi endpoint.",
+        };
+    }
+    getRemoteAccessSnapshot() {
+        return this.getRemoteAccessStatus();
+    }
+    configureRemoteAccessUrl(rawUrl) {
+        const endpoint = CompanionServer.parseRemoteEndpoint(rawUrl);
+        if (!endpoint) {
+            throw new Error("Remote URL must be a valid ws, wss, http, or https URL");
+        }
+        const configPath = resolveWotannHomeSubdir("remote-access.json");
+        mkdirSync(resolveWotannHomeSubdir(), { recursive: true });
+        writeFileAtomic(configPath, `${JSON.stringify({ remoteUrl: rawUrl.trim() }, null, 2)}\n`, { mode: 0o600 });
+        return this.getRemoteAccessStatus();
+    }
+    clearConfiguredRemoteAccessUrl() {
+        try {
+            unlinkSync(resolveWotannHomeSubdir("remote-access.json"));
+        }
+        catch {
+            /* already absent */
+        }
+        return this.getRemoteAccessStatus();
+    }
+    getTailscaleIPv4FromCli() {
+        try {
+            const output = execFileSync("tailscale", ["ip", "-4"], {
+                stdio: ["ignore", "pipe", "ignore"],
+                timeout: 1500,
+                encoding: "utf-8",
+            });
+            const candidate = output
+                .split(/\s+/)
+                .map((part) => part.trim())
+                .find((part) => CompanionServer.isTailscaleIPv4(part));
+            return candidate ?? null;
+        }
+        catch {
+            return null;
+        }
+    }
+    parseConfiguredRemoteEndpoint() {
+        const raw = this.resolveConfiguredRemoteUrl();
+        if (!raw)
+            return null;
+        try {
+            return CompanionServer.parseRemoteEndpoint(raw);
+        }
+        catch {
+            console.warn(`[CompanionServer] ignoring invalid WOTANN_COMPANION_REMOTE_URL=${JSON.stringify(raw)}`);
+            return null;
+        }
+    }
+    static parseRemoteEndpoint(rawValue) {
+        const raw = rawValue.trim();
+        if (!raw)
+            return null;
+        try {
+            const url = raw.includes("://") ? new URL(raw) : new URL(`wss://${raw}`);
+            const scheme = url.protocol === "ws:" || url.protocol === "http:"
+                ? "ws"
+                : url.protocol === "wss:" || url.protocol === "https:"
+                    ? "wss"
+                    : null;
+            if (!scheme || !url.hostname)
+                return null;
+            const port = url.port ? Number.parseInt(url.port, 10) : scheme === "wss" ? 443 : 80;
+            if (!Number.isInteger(port) || port <= 0 || port > 65_535)
+                return null;
+            const path = url.pathname && url.pathname !== "/" ? url.pathname : undefined;
+            const query = url.search ? url.search.slice(1) : undefined;
+            return {
+                kind: "configured",
+                label: "Remote Bridge",
+                host: url.hostname,
+                port,
+                scheme,
+                ...(path ? { path } : {}),
+                ...(query ? { query } : {}),
+                url: url.toString(),
+            };
+        }
+        catch {
+            return null;
+        }
+    }
+    resolveConfiguredRemoteUrl() {
+        const envUrl = (process.env.WOTANN_COMPANION_REMOTE_URL ?? "").trim();
+        if (envUrl)
+            return envUrl;
+        return this.readRemoteAccessJsonUrl() ?? this.readWotannYamlRemoteUrl();
+    }
+    readRemoteAccessJsonUrl() {
+        try {
+            const configPath = resolveWotannHomeSubdir("remote-access.json");
+            if (!existsSync(configPath))
+                return null;
+            const parsed = JSON.parse(readFileSync(configPath, "utf-8"));
+            return CompanionServer.firstConfigString(parsed, [
+                ["remoteUrl"],
+                ["url"],
+                ["endpoint"],
+                ["remoteAccess", "url"],
+                ["companion", "remoteUrl"],
+                ["companion", "remoteAccessUrl"],
+            ]);
+        }
+        catch {
+            return null;
+        }
+    }
+    readWotannYamlRemoteUrl() {
+        try {
+            const configPath = resolveWotannHomeSubdir("wotann.yaml");
+            if (!existsSync(configPath))
+                return null;
+            const parsed = yamlParse(readFileSync(configPath, "utf-8"));
+            return CompanionServer.firstConfigString(parsed, [
+                ["remoteAccess", "url"],
+                ["remote_access", "url"],
+                ["remote", "url"],
+                ["companion", "remoteUrl"],
+                ["companion", "remoteAccessUrl"],
+                ["companion", "remote_access_url"],
+            ]);
+        }
+        catch {
+            return null;
+        }
+    }
+    static firstConfigString(value, paths) {
+        for (const path of paths) {
+            let cursor = value;
+            for (const segment of path) {
+                if (!cursor || typeof cursor !== "object" || Array.isArray(cursor)) {
+                    cursor = undefined;
+                    break;
+                }
+                cursor = cursor[segment];
+            }
+            if (typeof cursor === "string" && cursor.trim().length > 0) {
+                return cursor.trim();
+            }
+        }
+        return null;
+    }
+    static isTailscaleIPv4(address) {
+        const parts = address.split(".").map((part) => Number.parseInt(part, 10));
+        if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part))) {
+            return false;
+        }
+        const [first, second] = parts;
+        if (first === undefined || second === undefined)
+            return false;
+        // Tailscale assigns IPv4 addresses from 100.64.0.0/10.
+        return first === 100 && second >= 64 && second <= 127;
+    }
+    getBonjourTxtRecords() {
+        const offer = this.getOrCreateBonjourPairingOffer();
+        return [
+            `host=${this.getAdvertisedHost()}`,
+            `port=${this.config.port}`,
+            "scheme=ws",
+            `requestId=${offer.requestId}`,
+            `pin=${offer.pin}`,
+            `expiresAt=${offer.expiresAt}`,
+        ];
+    }
+    getOrCreateBonjourPairingOffer() {
+        const current = this.bonjourPairingOffer;
+        if (current) {
+            const expiresAtMs = Date.parse(current.expiresAt);
+            if (Number.isFinite(expiresAtMs) && expiresAtMs - Date.now() > 30_000) {
+                return current;
+            }
+        }
+        const request = this.pairingManager.generatePairingRequest();
+        this.bonjourPairingOffer = {
+            requestId: request.requestId,
+            pin: request.pin,
+            expiresAt: request.expiresAt,
+        };
+        return this.bonjourPairingOffer;
+    }
+    setBonjourPairingOffer(offer) {
+        this.bonjourPairingOffer = offer;
+        if (this.running) {
+            this.restartBonjourAdvertisement({ regenerateOffer: false });
+        }
+    }
+    scheduleBonjourPairingRefresh() {
+        if (this.bonjourRefreshTimer) {
+            clearTimeout(this.bonjourRefreshTimer);
+            this.bonjourRefreshTimer = null;
+        }
+        const offer = this.bonjourPairingOffer;
+        if (!offer)
+            return;
+        const expiresAtMs = Date.parse(offer.expiresAt);
+        if (!Number.isFinite(expiresAtMs))
+            return;
+        const delayMs = Math.max(30_000, expiresAtMs - Date.now() - 30_000);
+        this.bonjourRefreshTimer = setTimeout(() => {
+            this.bonjourRefreshTimer = null;
+            this.restartBonjourAdvertisement({ regenerateOffer: true });
+        }, delayMs);
+        this.bonjourRefreshTimer.unref?.();
+    }
+    restartBonjourAdvertisement(options) {
+        if (options.regenerateOffer) {
+            this.bonjourPairingOffer = null;
+        }
+        this.stopBonjourAdvertisement();
+        if (this.running) {
+            this.advertiseBonjourService();
+        }
+    }
+    stopBonjourAdvertisement() {
+        if (this.bonjourRefreshTimer) {
+            clearTimeout(this.bonjourRefreshTimer);
+            this.bonjourRefreshTimer = null;
+        }
+        const bonjourProc = this._bonjourProc;
+        try {
+            bonjourProc?.kill?.();
+        }
+        catch {
+            /* sandbox/CI may forbid kill() — non-fatal */
+        }
+        this._bonjourProc = undefined;
+        try {
+            unlinkSync(resolveWotannHomeSubdir("bonjour.pid"));
+        }
+        catch {
+            /* ignore */
+        }
+    }
     /**
      * Generate a pairing QR code for iOS app connection.
      */
     generatePairingQR() {
         const { pin, requestId, expiresAt } = this.pairingManager.generatePairingRequest();
+        this.setBonjourPairingOffer({ requestId, pin, expiresAt });
+        const remoteAccess = this.getRemoteAccessStatus();
         const host = this.getAdvertisedHost();
-        const qrData = this.pairingManager.generateQRData(requestId, pin, host, this.config.port);
-        return { qrData, pin, expiresAt, host, port: this.config.port };
+        const qrData = this.pairingManager.generateQRData(requestId, pin, host, this.config.port, remoteAccess);
+        return {
+            qrData,
+            requestId,
+            pin,
+            expiresAt,
+            host,
+            port: this.config.port,
+            remoteEndpoints: remoteAccess.endpoints,
+            remoteAccess,
+        };
     }
     getConversationSync() {
         return this.conversationSync;
@@ -1124,6 +1525,10 @@ export class CompanionServer {
             }
         }
         if (parsed.method === "chat.send") {
+            if (this.bridgeRpcHandler) {
+                await this.handleBridgeRPC(ws, raw, parsed);
+                return;
+            }
             await this.handleChatSend(ws, parsed);
             return;
         }
@@ -1151,6 +1556,19 @@ export class CompanionServer {
         });
     }
     async handleBridgeRPC(ws, raw, parsed) {
+        const isChatSend = parsed.method === "chat.send";
+        const chatConversationId = this.conversationIdFromChatParams(parsed.params);
+        const chatPrompt = this.promptFromChatParams(parsed.params);
+        if (isChatSend && chatConversationId && chatPrompt) {
+            const provider = typeof parsed.params["provider"] === "string"
+                ? parsed.params["provider"]
+                : undefined;
+            const model = typeof parsed.params["model"] === "string" ? parsed.params["model"] : undefined;
+            this.conversationSync.receiveMessage(chatConversationId, chatPrompt, this.attachmentsFromChatParams(parsed.params), {
+                ...(provider ? { provider } : {}),
+                ...(model ? { model } : {}),
+            });
+        }
         const result = await this.bridgeRpcHandler?.handleMessage(raw);
         if (!result) {
             this.sendRPCResponse(ws, parsed.method, {
@@ -1178,12 +1596,26 @@ export class CompanionServer {
                 });
                 return;
             }
+            if (isChatSend && chatConversationId && content.length > 0) {
+                this.conversationSync.receiveAssistantMessage(chatConversationId, content);
+            }
             this.sendRPCResponse(ws, parsed.method, {
                 result: { content },
                 id: parsed.id,
             });
             return;
         }
+        if (isChatSend && chatConversationId) {
+            const responseContent = typeof result.result === "object" &&
+                result.result !== null &&
+                "content" in result.result &&
+                typeof result.result.content === "string"
+                ? result.result.content
+                : "";
+            if (responseContent.length > 0) {
+                this.conversationSync.receiveAssistantMessage(chatConversationId, responseContent);
+            }
+        }
         this.sendRPCResponse(ws, parsed.method, {
             result: result.result,
             error: result.error,
@@ -1224,14 +1656,35 @@ export class CompanionServer {
             });
             return;
         }
-        const prompt = message.params["content"] ??
-            message.params["prompt"] ??
-            "";
+        if (this.runtimeReady) {
+            try {
+                await this.runtimeReady;
+            }
+            catch (err) {
+                this.sendRPCResponse(ws, message.method, {
+                    error: {
+                        code: -32000,
+                        message: `Runtime initialization failed: ${err instanceof Error ? err.message : String(err)}`,
+                    },
+                    id: message.id,
+                });
+                return;
+            }
+        }
+        const prompt = this.promptFromChatParams(message.params);
         const conversationId = message.params["conversationId"] ?? this.runtime.getSession().id;
         const provider = message.params["provider"];
         const model = message.params["model"];
         const beforeSession = this.runtime.getSession();
         let content = "";
+        const beforeTokens = beforeSession.totalTokens;
+        const beforeCost = beforeSession.totalCost;
+        if (prompt.trim()) {
+            this.conversationSync.receiveMessage(conversationId, prompt, this.attachmentsFromChatParams(message.params), {
+                ...(provider ? { provider } : {}),
+                ...(model ? { model } : {}),
+            });
+        }
         try {
             for await (const chunk of this.runtime.query({ prompt, provider, model })) {
                 if (chunk.type === "text") {
@@ -1262,6 +1715,16 @@ export class CompanionServer {
                 }
             }
             const afterSession = this.runtime.getSession();
+            const tokensUsed = Math.max(0, afterSession.totalTokens - beforeTokens);
+            const cost = Math.max(0, afterSession.totalCost - beforeCost);
+            if (content.length > 0) {
+                this.conversationSync.receiveAssistantMessage(conversationId, content, {
+                    provider: afterSession.provider,
+                    model: afterSession.model,
+                    tokensUsed,
+                    cost,
+                });
+            }
             this.sendStreamEvent(ws, {
                 method: "stream.done",
                 params: {
@@ -1269,8 +1732,8 @@ export class CompanionServer {
                     content: "",
                     sessionId: conversationId,
                     conversationId,
-                    tokensUsed: Math.max(0, afterSession.totalTokens - beforeSession.totalTokens),
-                    cost: Math.max(0, afterSession.totalCost - beforeSession.totalCost),
+                    tokensUsed,
+                    cost,
                     provider: afterSession.provider,
                     model: afterSession.model,
                 },
@@ -1298,6 +1761,38 @@ export class CompanionServer {
             });
         }
     }
+    promptFromChatParams(params) {
+        return params["content"] ?? params["prompt"] ?? "";
+    }
+    conversationIdFromChatParams(params) {
+        const conversationId = params["conversationId"];
+        return typeof conversationId === "string" && conversationId.trim().length > 0
+            ? conversationId
+            : null;
+    }
+    attachmentsFromChatParams(params) {
+        const attachments = params["attachments"];
+        if (Array.isArray(attachments)) {
+            return attachments.filter((item) => {
+                if (typeof item !== "object" || item === null)
+                    return false;
+                const candidate = item;
+                return (typeof candidate["name"] === "string" &&
+                    typeof candidate["dataBase64"] === "string" &&
+                    typeof candidate["mimeType"] === "string");
+            });
+        }
+        const images = params["images"];
+        if (!Array.isArray(images))
+            return undefined;
+        return images
+            .filter((image) => typeof image === "string" && image.length > 0)
+            .map((dataBase64, index) => ({
+            name: `image-${index + 1}.jpg`,
+            dataBase64,
+            mimeType: "image/jpeg",
+        }));
+    }
     /**
      * Map RPC method outcomes to haptic trigger names for iOS feedback.
      */
@@ -1410,8 +1905,9 @@ export class CompanionServer {
                 return { success: false, error: "Missing publicKey parameter" };
             }
             try {
-                // Decode client's base64 public key to raw bytes
-                const clientPubRaw = Buffer.from(clientPublicKeyB64, "base64");
+                // Decode client's base64 public key. CryptoKit may send raw X/Y
+                // bytes, while Node ECDH expects X9.63 with the 0x04 prefix.
+                const clientPubRaw = normalizeP256PublicKey(Buffer.from(clientPublicKeyB64, "base64"));
                 // Generate server ECDH key pair on the same P-256 curve
                 const ecdh = createECDH("prime256v1");
                 ecdh.generateKeys();
@@ -1429,6 +1925,7 @@ export class CompanionServer {
                 return {
                     success: true,
                     publicKey: serverPubRaw.toString("base64"),
+                    serverPublicKey: serverPubRaw.toString("base64"),
                     algorithm: "ECDH-P256",
                 };
             }
@@ -1445,19 +1942,18 @@ export class CompanionServer {
         // This is the single source of truth: iOS never needs manual config entry
         // for anything the desktop already has configured.
         this.rpcHandler.register("config.sync", async () => {
-            // Gather relay config from disk
-            let relayConfig = null;
-            try {
-                const relayPath = resolveWotannHomeSubdir("relay.json");
-                if (existsSync(relayPath)) {
-                    relayConfig = JSON.parse(readFileSync(relayPath, "utf-8"));
+            // Gather runtime status (provider, model, etc.)
+            if (this.runtimeReady) {
+                try {
+                    await this.runtimeReady;
+                }
+                catch {
+                    /* status below honestly reflects whatever runtime has available */
                 }
             }
-            catch {
-                /* relay not configured — fine */
-            }
-            // Gather runtime status (provider, model, etc.)
             const status = this.runtime?.getStatus();
+            const remoteAccess = this.getRemoteAccessStatus();
+            const remoteEndpoints = remoteAccess.endpoints;
             // Gather user preferences from wotann.yaml if it exists
             let userPrefs = {};
             try {
@@ -1477,15 +1973,6 @@ export class CompanionServer {
                 /* no prefs file — fine */
             }
             return {
-                // Supabase relay credentials — iOS auto-configures from this
-                relay: relayConfig
-                    ? {
-                        supabaseUrl: relayConfig.supabaseUrl,
-                        supabaseAnonKey: relayConfig.supabaseAnonKey,
-                        channelId: relayConfig.channelId,
-                        devicePairId: relayConfig.devicePairId,
-                    }
-                    : null,
                 // Active provider/model attribution for the phone's "what desktop
                 // is using" badge. Empty-string sentinel when nothing is configured
                 // — the phone's UI then shows a neutral "No active model" hint
@@ -1493,6 +1980,13 @@ export class CompanionServer {
                 provider: status?.activeProvider ?? "",
                 model: status?.activeModel ?? "",
                 providers: status?.providers ?? [],
+                remoteEndpoints,
+                remoteAccess,
+                computerUse: {
+                    platform: detectPlatform(),
+                    tools: detectAvailableTools(),
+                    actions: listDesktopActions(),
+                },
                 // Desktop identity
                 hostname: hostname(),
                 version: "0.1.0",
@@ -1504,7 +1998,7 @@ export class CompanionServer {
                     voice: true,
                     localSend: true,
                     healthInsights: true,
-                    relay: relayConfig !== null && relayConfig.supabaseUrl !== "",
+                    remoteAccess: remoteAccess.status === "ready",
                 },
             };
         });
@@ -1648,22 +2142,9 @@ export class CompanionServer {
             };
         });
         this.rpcHandler.register("briefing.daily", async () => {
-            const status = this.runtime?.getStatus();
             return {
-                ciPassed: 0,
-                ciTotal: 0,
-                prsMerged: 0,
-                issuesAssigned: 0,
-                yesterdayCost: status?.totalCost ?? 0,
-                agentsCompleted: this.pairingManager.getActiveSessions().length,
-                uptimeHours: 0,
-                highlights: status
-                    ? [
-                        `Provider: ${status.activeProvider ?? "none"}`,
-                        `Mode: ${status.currentMode}`,
-                        `Messages: ${status.messageCount}`,
-                    ]
-                    : [],
+                available: false,
+                error: "Daily briefing is not connected to real overnight activity yet.",
             };
         });
         this.rpcHandler.register("meet.summarize", async (params) => {
@@ -1849,12 +2330,65 @@ export class CompanionServer {
             if (!this.runtime)
                 return { providers: [], count: 0 };
             const status = this.runtime.getStatus();
+            const snapshot = getProviderService().currentSnapshot();
+            if (snapshot.providers.length > 0) {
+                return {
+                    providers: snapshot.providers.map((provider) => ({
+                        id: provider.id,
+                        name: provider.name,
+                        configured: provider.configured,
+                        available: provider.configured,
+                        models: provider.models.map((model) => ({
+                            id: model.id,
+                            name: model.name,
+                            supportsVision: model.supportsVision ?? false,
+                            supportsTools: model.supportsTools ?? false,
+                            supportsThinking: model.supportsThinking ?? false,
+                        })),
+                        defaultModel: provider.defaultModel,
+                        authMethod: provider.credential?.method ?? null,
+                        error: provider.lastError,
+                    })),
+                    count: snapshot.providers.length,
+                    active: snapshot.active?.provider ?? status.activeProvider,
+                    activeModel: snapshot.active?.model ?? status.activeModel,
+                    lastRefreshedAt: snapshot.lastRefreshedAt,
+                };
+            }
             return {
-                providers: status.providers.map((p) => ({ name: p, available: true })),
+                providers: status.providers.map((p) => ({
+                    id: p,
+                    name: p,
+                    configured: true,
+                    available: true,
+                    models: [],
+                    defaultModel: p === status.activeProvider ? status.activeModel : null,
+                })),
                 count: status.providers.length,
                 active: status.activeProvider,
+                activeModel: status.activeModel,
             };
         });
+        this.rpcHandler.register("remote.access.status", async () => {
+            return this.getRemoteAccessStatus();
+        });
+        this.rpcHandler.register("remote.access.configure", async (params) => {
+            const url = typeof params["url"] === "string" ? params["url"].trim() : "";
+            if (!url)
+                return { success: false, error: "url required" };
+            try {
+                return this.configureRemoteAccessUrl(url);
+            }
+            catch (err) {
+                return {
+                    success: false,
+                    error: err instanceof Error ? err.message : String(err),
+                };
+            }
+        });
+        this.rpcHandler.register("remote.access.clear", async () => {
+            return this.clearConfiguredRemoteAccessUrl();
+        });
         this.rpcHandler.register("screen.stream", async () => {
             // Verify that screen capture is available before starting a stream
             const testCapture = takeScreenshot();
@@ -2055,6 +2589,19 @@ export class CompanionServer {
         // and return it to the client. The client includes this token as `authToken`
         // on every subsequent RPC call; requests without it (or with an expired
         // token) are rejected as unauthorized.
+        this.rpcHandler.register("pair.offer", async () => {
+            const pairing = this.generatePairingQR();
+            return {
+                requestId: pairing.requestId,
+                pin: pairing.pin,
+                expiresAt: pairing.expiresAt,
+                host: pairing.host,
+                port: pairing.port,
+                remoteEndpoints: pairing.remoteEndpoints,
+                remoteAccess: pairing.remoteAccess,
+                qrData: pairing.qrData,
+            };
+        });
         this.rpcHandler.register("pair", async (params) => {
             const requestId = params["requestId"];
             const pin = params["pin"];