daemon: rpc/ws_server — loopback WebSocket transport + pairing (build step 1, second half)

The extension's fallback transport (docs/05 §4). veloxd now also listens
on 127.0.0.1, first free port in 52000-52016, and writes it to
<runtime>/ws.port (0600).

- rpc/ws_frame — RFC 6455 frame codec. Incremental; reassembles
  continuation frames; enforces "client frames MUST be masked" (§5.1);
  caps a reassembled message at 8 MiB. This is the attacker-adjacent
  parser, so it has its own test table.
- rpc/ws_handshake — HTTP upgrade parse, Sec-WebSocket-Accept
  (SHA-1 + base64 via libcrypto), and the two non-negotiable checks:
  an Origin header must be present and must be moz-extension:// (a page
  cannot pair). Version must be 13.
- rpc/ws_server — per-connection Handshake -> Open state machine on the
  shared EventLoop. Token gate: session.pair mints a token behind the
  approver + rate limiter; session.hello must present a valid one;
  every other method is -32002 until authed. Privileged methods are
  refused -32003 by the generated dispatch(). Ping -> Pong; Close
  echoed. session.hello major-version mismatch -> -32001.
- rpc/pairing — PairingApprover interface + EnvAutoApprover dev stub
  (approves iff VELOX_PAIR_AUTO=1); PairingRateLimiter (5 failures / 60 s
  per origin, then 60 s lockout -> -32014, survives reconnect); a
  four-digit code generator.
- store/pairings — the pairings table: create() returns the plaintext
  token once and stores only its SHA-256; find_active_by_token,
  touch, revoke, list_active.
- util/crypto — sha1 / sha256_hex / base64 / random_token over libcrypto.
- store/sqlite — pin the DB file (and -wal/-shm) to 0600.
- runtime_dir — resolve_data_dir() for $XDG_DATA_HOME/velox (velox.db).
- main.cpp — opens + migrates velox.db, starts both transports; a WS
  bind failure is logged, not fatal (capture must fail open, the Unix
  socket still serves the GUI/CLI).

Real gap, flagged not hidden: the pairing prompt is EnvAutoApprover for
now — a GUI dialog / desktop notification is build step 7. Pairing
needs VELOX_PAIR_AUTO=1 until then.

Tests (ASan+UBSan and TSan clean): veloxd.ws_frame (codec + handshake
vectors incl. the RFC 6455 §1.3 accept sample), veloxd.pairings (token
create/find/revoke, hash-not-token, rate-limit window + lockout +
per-origin isolation + success reset), veloxd.ws_server (full flow: 101
handshake, -32002 gate, deny-then-approve pairing, hello-with-token,
-32003 privileged refusal, real download.list). 27 daemon/cli tests
green; full tree green.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Upd9WhG9oppieig5nRDLig

daemon/src/main.cpp

@@ -1,8 +1,9 @@
 // veloxd — the Velox download-manager daemon.
 //
-// This drop wires up the Unix-socket RPC transport and a dispatcher skeleton so the CLI
-// and GUI have a real server to speak to (AGENT-DAEMON.md build order, step 1). The
-// WebSocket transport, the SQLite store and the scheduler land next.
+// Wires up both RPC transports (Unix socket + loopback WebSocket), the SQLite store,
+// and a dispatcher skeleton so the CLI and GUI have a real server to speak to
+// (AGENT-DAEMON.md build order, steps 1 and 3). The scheduler and the engine link land
+// next.
 
 #include <csignal>
 #include <cstdlib>
@@ -16,8 +17,12 @@
 
 #include "rpc/dispatcher.hpp"
 #include "rpc/event_loop.hpp"
+#include "rpc/pairing.hpp"
 #include "rpc/runtime_dir.hpp"
 #include "rpc/uds_server.hpp"
+#include "rpc/ws_server.hpp"
+#include "store/migrations.hpp"
+#include "store/sqlite.hpp"
 #include "version.hpp"
 
 namespace {
@@ -80,15 +85,46 @@ int main() {
     ::sigaction(SIGTERM, &sa, nullptr);
     ::signal(SIGPIPE, SIG_IGN);  // a client vanishing mid-write is EPIPE, never a signal
 
+    std::string data_dir;
+    if (const auto ec = velox::daemon::rpc::resolve_data_dir(data_dir)) {
+        std::cerr << "veloxd: cannot prepare data directory: " << ec.message() << "\n";
+        return 1;
+    }
+    auto db = velox::daemon::store::Db::open(data_dir + "/velox.db");
+    if (!db) {
+        std::cerr << "veloxd: cannot open " << data_dir << "/velox.db: "
+                  << db.error().to_string() << "\n";
+        return 1;
+    }
+    if (const auto m = velox::daemon::store::migrate_to_head(*db); !m) {
+        std::cerr << "veloxd: schema migration failed: " << m.error().to_string() << "\n";
+        return 1;
+    }
+
     velox::daemon::rpc::VeloxDispatcher dispatcher;
+
     velox::daemon::rpc::UdsServer uds(loop, dispatcher, rt.socket_path());
     if (const auto ec = uds.start()) {
         std::cerr << "veloxd: cannot listen on " << rt.socket_path() << ": " << ec.message()
                   << "\n";
         return 1;
     }
-
     std::cout << "veloxd: listening on " << uds.socket_path() << "\n";
+
+    // The WebSocket transport is the extension's fallback (docs/05 §4); the Unix socket is
+    // the primary. If every port in 52000-52016 is taken, log it and carry on rather than
+    // refusing to start — capture must fail open, and the GUI/CLI still have the socket.
+    // TODO(build step 7): replace EnvAutoApprover with a GUI-dialog / desktop-notification
+    // approver. Until then pairing needs VELOX_PAIR_AUTO=1.
+    velox::daemon::rpc::EnvAutoApprover approver;
+    velox::daemon::rpc::WsServer ws(loop, dispatcher, *db, approver, rt);
+    if (const auto ec = ws.start()) {
+        std::cerr << "veloxd: WebSocket transport unavailable (" << ec.message()
+                  << "); the extension fallback will not work this run\n";
+    } else {
+        std::cout << "veloxd: WebSocket transport on 127.0.0.1:" << ws.port() << "\n";
+    }
+
     loop.run();
     std::cout << "veloxd: shutting down\n";