code wiki / (root) / nx_torrent_daemon.nx
`nx_torrent_daemon.nx` source

↩ module page · 1321 lines · 79296 B
1// nx_torrent_daemon.nx -- the UI enabler (X-TORRENT-UI-001): an HTTP daemon that
2// serves the operator's torrent page and wires it to the LIVE download worker.
3//
4//   GET  /torrent            -> sites/nishifamily/torrent/index.html
5//   GET  /torrent/app.js     -> the page's last-mile JS (renders REAL state only)
6//   GET  /torrent/api/me     -> {"user":"local"}            (local single-operator)
7//   POST /torrent/api/login  -> {"ok":true}
8//   POST /torrent/api/add    {magnet} -> fork+execve the worker elf -> {"id":"1"}
9//   GET  /torrent/api/status -> reads outdir/download.status -> {downloads:[...]}
10//   POST /torrent/api/<id>/<action> -> {"ok":true}          (pause/resume/remove noop)
11//
12// Sovereign: composes nx_http_server (bind/listen/accept) + the worker elf the team
13// already built. NO mocked numbers -- /status emits exactly what the worker wrote to
14// disk; before any download the worker file is absent -> {downloads:[]} (honest empty).
15// license_tier: ORIGINAL  kind: last-mile-ui-bridge  layer: L6 (over L4 http + L5 worker)
16//
17// module: nishi-core.torrent.daemon
18// depends: nishi-core.http_server, nishi-core.syscalls
19import "nx_http_server.nx"
20import "nx_syscalls.nx"
21import "nx_itoa_lib.nx"   // shared MSB-first emitter: nxi_buf is the NUL-free buffer form
22import "nx_bencode.nx"   // parse download.meta to locate the video file's byte-range for streaming
23import "nx_torrent_access.nx"   // R2: deny-by-default AREA policy (SFW=media family+, NSFW=gallery owner-only)
24const TORRENT_MAGIC_131072: i64 = 131072
25const TORRENT_MAGIC_1024: i64 = 1024
26const TORRENT_MAGIC_8192: i64 = 8192
27const TORRENT_MAGIC_262144: i64 = 262144
28const TORRENT_MAGIC_4000: i64 = 4000
29const TORRENT_MAGIC_65536: i64 = 65536
30const TORRENT_MAGIC_2000: i64 = 2000
31const TORRENT_MAGIC_1048576: i64 = 1048576
32const TORRENT_MAGIC_4096: i64 = 4096
33const TORRENT_MAGIC_4095: i64 = 4095
34const TORRENT_MAGIC_16384: i64 = 16384
35const TORRENT_MAGIC_4200: i64 = 4200
36const TORRENT_MAGIC_8097: i64 = 8097
37const TORRENT_MAGIC_1000000000: i64 = 1000000000
38
39// R3 auth: the OPAQUE session->level resolution lives in the FRONT GATEWAY (runtime/_hdl_build/nx_torrent_authn,
40// proven by nx_torrent_authn_gate 14/14) -- NOT in this daemon, which stays LEAN (the full OPAQUE stack won't
41// co-compile here -> empty .s). The gateway authenticates, resolves the level, and injects it as a TRUSTED
42// internal header X-Nishi-Level (Cardinal 12: validate at the boundary, trust internal). LOCAL marker = the
43// operator's own box (a hub push never carries this workstation-local file) -> OWNER.
44const TORRENT_LOCAL_MARKER: *u8 = "/mnt/c/Users/elder/Downloads/nishi-torrents/.local_operator"
45
46// PERSISTENT RETRY (rung #2): how often the detached sweeper re-spawns workers for STUCK partials (a
47// worker gives up after ~20min of no new pieces, then the torrent sits idle). 10 min = tracker-friendly
48// re-announce cadence that still grabs a seed soon after it appears. Data-driven (Cardinal 11).
49const D_RETRY_INTERVAL_MS: i64 = 600000
50
51// ---- small buffer-building helpers -------------------------------
52func d_strlen(s: *u8) -> i64 { var i: i64=0; while s[i]!=(0 as u8){i=i+1} return i }
53
54func d_puts(dst: *u8, off: i64, s: *u8) -> i64 {
  var i: i64 = 0
  while s[i] != (0 as u8) { dst[off+i] = s[i]; i = i + 1 }
  return off + i
58}
59// MIGRATED to nxi_buf (debt 1785557603). The old body mmapped a reverse buffer per call and never
60// freed it -- 21 call sites in a LONG-LIVED daemon, so the leak was per-call. It also carried the
61// documented clone SIGN BUG: it did m = 0 - m for negatives but NEVER WROTE THE MINUS, so every
62// negative printed as positive. nxi_buf is MSB-first, allocates nothing, emits the sign (gate T9/T10)
63// and keeps this exact contract: digits only, NO NUL, returns off+len.
64func d_putn(dst: *u8, off: i64, v: i64) -> i64 { return nxi_buf(dst, off, v) }
65
66// read a whole file into buf (bounded by cap); returns bytes read or -1 if open fails
67func d_read_file(path: *u8, buf: *u8, cap: i64) -> i64 {
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return 0 - 1 }
  var off: i64 = 0; var go: i64 = 1
  while go == 1 {
      if off >= cap { go = 0 } else {
          let r: i64 = sys_read(fd, buf + off, cap - off)
          if r <= 0 { go = 0 } else { off = off + r }
      }
  }
  sys_close(fd)
  return off
79}
80
81// build outdir+suffix into out (NUL-terminated); returns out. (status/control/magnet sidecars)
82func d_path(outdir: *u8, suf: *u8, out: *u8) -> *u8 {
  var o: i64 = d_puts(out, 0, outdir)
  o = d_puts(out, o, suf)
  out[o] = 0 as u8
  return out
87}
88// write n bytes to path (O_CREAT|O_WRONLY|O_TRUNC) -- the control + magnet sidecar files
89func d_write_file(path: *u8, s: *u8, n: i64) -> i64 {
  let fd: i64 = sys_openat_wr(path, 0x1a4)
  if fd < 0 { return 0 - 1 }
  sys_write(fd, s, n)
  sys_close(fd)
  return 0
95}
96
97// ---- HTTP response writer (header + body, then close) ------------
98func d_send(cfd: i64, status: *u8, ctype: *u8, body: *u8, blen: i64) -> i64 {
  let h: *u8 = sys_mmap(512)
  var o: i64 = 0
  o = d_puts(h, o, "HTTP/1.1 " as *u8); o = d_puts(h, o, status)
  o = d_puts(h, o, "\r\nContent-Type: " as *u8); o = d_puts(h, o, ctype)
  o = d_puts(h, o, "\r\nContent-Length: " as *u8); o = d_putn(h, o, blen)
  o = d_puts(h, o, "\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: no-store\r\nConnection: close\r\n\r\n" as *u8)
  sys_write(cfd, h, o)
  if blen > 0 { sys_write(cfd, body, blen) }
  sys_close(cfd)
  return 0
109}
110func d_send_str(cfd: i64, status: *u8, ctype: *u8, s: *u8) -> i64 {
  return d_send(cfd, status, ctype, s, d_strlen(s))
112}
113func d_serve_file(cfd: i64, path: *u8, ctype: *u8) -> i64 {
  let buf: *u8 = sys_mmap(TORRENT_MAGIC_131072)
  let n: i64 = d_read_file(path, buf, TORRENT_MAGIC_131072)
  if n <= 0 { d_send_str(cfd, "404 Not Found" as *u8, "text/plain" as *u8, "missing\n" as *u8); return 0 }
  d_send(cfd, "200 OK" as *u8, ctype, buf, n)
  return 0
119}
120
121// ---- path matching on the parsed request -------------------------
122func d_streq(buf: *u8, off: i64, len: i64, s: *u8) -> i64 {
  var i: i64 = 0
  while s[i] != (0 as u8) {
      if i >= len { return 0 }
      if buf[off+i] != s[i] { return 0 }
      i = i + 1
  }
  if i != len { return 0 }
  return 1
131}
132func d_starts(buf: *u8, off: i64, len: i64, s: *u8) -> i64 {
  var i: i64 = 0
  while s[i] != (0 as u8) {
      if i >= len { return 0 }
      if buf[off+i] != s[i] { return 0 }
      i = i + 1
  }
  return 1
140}
141
142// ---- magnet extraction: copy the "magnet:..." value out of the JSON body ----
143// finds the byte run m a g n e t : (the value; the key "magnet" is followed by a quote)
144// and copies to the next double-quote. Returns length.
145func d_extract_magnet(body: *u8, blen: i64, out: *u8, ocap: i64) -> i64 {
  var i: i64 = 0; var start: i64 = 0 - 1
  while i + 7 <= blen {
      if body[i]==(109 as u8) { if body[i+1]==(97 as u8) { if body[i+2]==(103 as u8) { if body[i+3]==(110 as u8) { if body[i+4]==(101 as u8) { if body[i+5]==(116 as u8) { if body[i+6]==(58 as u8) {
          start = i; i = blen + 100
      }}}}}}}
      i = i + 1
  }
  if start < 0 { return 0 }
  var j: i64 = start; var k: i64 = 0; var go: i64 = 1
  while go == 1 {
      if j >= blen { go = 0 } else {
          if body[j]==(34 as u8) { go = 0 } else {
              if k < ocap - 1 { out[k] = body[j]; k = k + 1 }
              j = j + 1
          }
      }
  }
  out[k] = 0 as u8
  return k
165}
166
167// ---- spawn the worker elf (double-fork so it reparents to init: no zombie) ----
168// has this torrent already made progress? (non-empty donefile) -> re-add should RESUME, not truncate.
169func d_has_progress(outdir: *u8) -> i64 {
  let dp: *u8 = sys_mmap(640); var p: i64 = d_puts(dp, 0, outdir); p = d_puts(dp, p, "/download.done" as *u8); dp[p] = 0 as u8
  let fd: i64 = sys_openat_rd(dp); if fd < 0 { return 0 }
  let b: *u8 = sys_mmap(8); let r: i64 = sys_read(fd, b, 1); sys_close(fd)
  if r > 0 { return 1 }
  return 0
175}
176// Before exec in a forked child: close every fd the daemon held open (the listen socket + the
177// per-connection cfd + any transient fds). A long-lived worker must NEVER keep the client's
178// connection open -- if it did, an HTTP client that reads to EOF (rather than honoring
179// Content-Length) blocks until the whole download ends. The daemon's own gate hung exactly this
180// way. stdio (0,1,2 -> /dev/null) is kept; sys_close on an unopened fd returns EBADF, so the
181// blind 3..255 sweep is safe. This is the no-hang law extended to the client side.
182func d_close_inherited() -> i64 {
  var fdx: i64 = 3
  while fdx < 256 { sys_close(fdx); fdx = fdx + 1 }
  return 0
186}
187// The directory THIS daemon binary lives in, read from /proc/self/cmdline argv[0]. The spawn elfs (worker,
188// discover, hls, video, ts2fmp4) are deployed as its SIBLINGS, so they resolve correctly on BOTH the dev box
189// (/tmp, where the WOMB builds them) and the NAS hub (/volume1/ai/torrent, where the bundle is deployed AND
190// /tmp is mounted NOEXEC -- the reason the old hardcoded /tmp exec failed on the NAS). Fallback "/tmp".
191func d_self_dir() -> *u8 {
  let buf: *u8 = sys_mmap(TORRENT_MAGIC_1024)
  let fd: i64 = sys_openat_rd("/proc/self/cmdline" as *u8)
  var n: i64 = 0
  if fd >= 0 { n = sys_read(fd, buf, 1023); sys_close(fd) }
  if n <= 0 { let fb: *u8 = sys_mmap(8); fb[0]=47 as u8; fb[1]=116 as u8; fb[2]=109 as u8; fb[3]=112 as u8; fb[4]=0 as u8; return fb }
  var z: i64 = 0; var dz: i64 = 0
  while dz == 0 { if z >= n { dz = 1 } else { if buf[z] == (0 as u8) { dz = 1 } else { z = z + 1 } } }
  var i: i64 = z - 1; var df: i64 = 0
  while df == 0 { if i <= 0 { df = 1 } else { if buf[i] == (47 as u8) { buf[i] = 0 as u8; df = 1 } else { i = i - 1 } } }
  if buf[0] == (0 as u8) { let fb: *u8 = sys_mmap(8); fb[0]=47 as u8; fb[1]=116 as u8; fb[2]=109 as u8; fb[3]=112 as u8; fb[4]=0 as u8; return fb }
  return buf
203}
204func d_spawn_worker(magnet: *u8, outdir: *u8, resume: i64) -> i64 {
  let wpath: *u8 = d_path(d_self_dir(), "/nx_torrent_get.sov.elf" as *u8, sys_mmap(640))
  let argv: *i64 = sys_mmap(64) as *i64
  argv[0] = wpath as i64; argv[1] = magnet as i64; argv[2] = outdir as i64
  if resume == 1 { argv[3] = "r" as i64; argv[4] = 0 } else { argv[3] = 0 }
  let envp: *i64 = sys_mmap(16) as *i64; envp[0] = 0
  let p1: i64 = sys_fork()
  if p1 == 0 {
      let p2: i64 = sys_fork()
      if p2 == 0 { d_close_inherited(); sys_execve(wpath, argv, envp); sys_exit(127) }
      sys_exit(0)
  }
  let st: *i64 = sys_mmap(16) as *i64
  sys_wait4(p1, st, 0)
  return 0
219}
220
221// ---- /status: parse the worker's newline-delimited status file -> JSON ----
222func d_find_val(buf: *u8, n: i64, key: *u8) -> i64 {
  let kl: i64 = d_strlen(key)
  var i: i64 = 0
  while i + kl <= n {
      var j: i64 = 0; var ok: i64 = 1
      while j < kl { if buf[i+j] != key[j] { ok = 0; j = kl } else { j = j + 1 } }
      if ok == 1 { return i + kl }
      i = i + 1
  }
  return 0 - 1
232}
233func d_int_at(buf: *u8, n: i64, pos: i64) -> i64 {
  if pos < 0 { return 0 }
  var v: i64 = 0; var i: i64 = pos; var go: i64 = 1
  while go == 1 {
      if i >= n { go = 0 } else {
          let c: i64 = buf[i] as i64
          if c >= 48 { if c <= 57 { v = v*10 + (c-48); i = i+1 } else { go = 0 } } else { go = 0 }
      }
  }
  return v
243}
244func d_copy_line(buf: *u8, n: i64, pos: i64, out: *u8, ocap: i64) -> i64 {
  out[0] = 0 as u8
  if pos < 0 { return 0 }
  var i: i64 = pos; var k: i64 = 0; var go: i64 = 1
  while go == 1 {
      if i >= n { go = 0 } else {
          if buf[i]==(10 as u8) { go = 0 } else {
              if k < ocap-1 { out[k]=buf[i]; k=k+1 }
              i = i+1
          }
      }
  }
  out[k] = 0 as u8
  return k
258}
259func d_status(cfd: i64, statpath: *u8, ctlpath: *u8) -> i64 {
  // operator control overrides (file-based, written by pause/remove): removed -> empty list,
  // paused -> force the rendered state to "paused" (the worker has self-stopped).
  let cb: *u8 = sys_mmap(16); let cn: i64 = d_read_file(ctlpath, cb, 15)
  var removed: i64 = 0; var paused: i64 = 0
  if cn > 0 { let c0: i64 = cb[0] as i64; if c0 == 114 { removed = 1 } if c0 == 112 { paused = 1 } }
  let buf: *u8 = sys_mmap(TORRENT_MAGIC_8192)
  let n: i64 = d_read_file(statpath, buf, TORRENT_MAGIC_8192)
  let out: *u8 = sys_mmap(TORRENT_MAGIC_8192)
  var o: i64 = 0
  if removed == 1 {
      o = d_puts(out, o, "{\"downloads\":[]}" as *u8)
      d_send(cfd, "200 OK" as *u8, "application/json" as *u8, out, o); return 0
  }
  if n <= 0 {
      o = d_puts(out, o, "{\"downloads\":[]}" as *u8)
      d_send(cfd, "200 OK" as *u8, "application/json" as *u8, out, o); return 0
  }
  let total: i64 = d_int_at(buf, n, d_find_val(buf, n, "total=" as *u8))
  let done: i64  = d_int_at(buf, n, d_find_val(buf, n, "done=" as *u8))
  let have: i64  = d_int_at(buf, n, d_find_val(buf, n, "have=" as *u8))
  let pieces: i64= d_int_at(buf, n, d_find_val(buf, n, "pieces=" as *u8))
  let peers: i64 = d_int_at(buf, n, d_find_val(buf, n, "peers=" as *u8))
  let stateb: *u8 = sys_mmap(64); d_copy_line(buf, n, d_find_val(buf, n, "state=" as *u8), stateb, 64)
  if paused == 1 { var pz: i64 = 0; let ps2: *u8 = "paused" as *u8; while ps2[pz] != (0 as u8) { stateb[pz] = ps2[pz]; pz = pz + 1 } stateb[pz] = 0 as u8 }
  let nameb: *u8 = sys_mmap(512); d_copy_line(buf, n, d_find_val(buf, n, "name=" as *u8), nameb, 512)
  var vpct: i64 = 0; if pieces > 0 { vpct = have*100/pieces }
  o = d_puts(out, o, "{\"downloads\":[{\"id\":\"1\",\"name\":\"" as *u8)
  o = d_puts(out, o, nameb)
  o = d_puts(out, o, "\",\"size\":" as *u8); o = d_putn(out, o, total)
  o = d_puts(out, o, ",\"done\":" as *u8); o = d_putn(out, o, done)
  o = d_puts(out, o, ",\"peers\":" as *u8); o = d_putn(out, o, peers)
  o = d_puts(out, o, ",\"havePieces\":" as *u8); o = d_putn(out, o, have)
  o = d_puts(out, o, ",\"totalPieces\":" as *u8); o = d_putn(out, o, pieces)
  o = d_puts(out, o, ",\"verified\":" as *u8); o = d_putn(out, o, vpct)
  o = d_puts(out, o, ",\"status\":\"" as *u8); o = d_puts(out, o, stateb)
  o = d_puts(out, o, "\"}]}" as *u8)
  d_send(cfd, "200 OK" as *u8, "application/json" as *u8, out, o)
  return 0
298}
299
300// ---- discover: extract a page URL from the JSON body ----
301func d_extract_url(body: *u8, blen: i64, out: *u8, ocap: i64) -> i64 {
  var i: i64 = 0; var start: i64 = 0 - 1
  while i + 4 <= blen {
      if body[i]==(104 as u8) { if body[i+1]==(116 as u8) { if body[i+2]==(116 as u8) { if body[i+3]==(112 as u8) {
          start = i; i = blen + 100
      }}}}
      i = i + 1
  }
  if start < 0 { return 0 }
  var j: i64 = start; var k: i64 = 0; var go: i64 = 1
  while go == 1 {
      if j >= blen { go = 0 } else {
          let c: i64 = body[j] as i64
          if c==34 { go=0 } else { if c==39 { go=0 } else { if c==32 { go=0 } else { if c==60 { go=0 } else { if c==62 { go=0 } else { if c==10 { go=0 } else { if c==13 { go=0 } else {
              if k < ocap - 1 { out[k] = body[j]; k = k + 1 }
              j = j + 1
          }}}}}}}
      }
  }
  out[k] = 0 as u8
  return k
322}
323
324// spawn the discovery elf (double-fork, reparents to init)
325func d_spawn_discover(url: *u8, dpath: *u8) -> i64 {
  let wpath: *u8 = d_path(d_self_dir(), "/nx_magnet_discover.sov.elf" as *u8, sys_mmap(640))
  let argv: *i64 = sys_mmap(64) as *i64
  argv[0] = wpath as i64; argv[1] = url as i64; argv[2] = dpath as i64; argv[3] = 0
  let envp: *i64 = sys_mmap(16) as *i64; envp[0] = 0
  let p1: i64 = sys_fork()
  if p1 == 0 {
      let p2: i64 = sys_fork()
      if p2 == 0 { d_close_inherited(); sys_execve(wpath, argv, envp); sys_exit(127) }
      sys_exit(0)
  }
  let st: *i64 = sys_mmap(16) as *i64
  sys_wait4(p1, st, 0)
  return 0
339}
340
341// Build a same-origin Referer ("https://<host>/") from a media URL. Most CDNs gate direct .mp4 links on a
342// Referer header; the downloader already sends a browser UA, so an EMPTY referer is the #1 reason a
343// correctly-routed direct video still 403s. out = NUL-terminated referer (empty if the URL has no scheme).
344func d_url_referer(url: *u8, out: *u8) -> *u8 {
  var i: i64 = 0; var n: i64 = 0; while url[n] != (0 as u8) { n = n + 1 }
  var sce: i64 = 0 - 1
  while i + 3 <= n { if url[i]==(58 as u8) { if url[i+1]==(47 as u8) { if url[i+2]==(47 as u8) { sce = i + 3; i = n + 100 } } } i = i + 1 }
  if sce < 0 { out[0] = 0 as u8; return out }
  var he: i64 = sce; var hgo: i64 = 1
  while hgo == 1 { if he >= n { hgo = 0 } else { let c: i64 = url[he] as i64; if c==47 { hgo=0 } else { if c==58 { hgo=0 } else { if c==63 { hgo=0 } else { he = he + 1 } } } } }
  var o: i64 = 0; var k: i64 = 0
  while k < he { out[o] = url[k]; o = o + 1; k = k + 1 }
  out[o] = 47 as u8; o = o + 1
  out[o] = 0 as u8
  return out
356}
357
358// spawn the sovereign video downloader (double-fork). argv: elf, url, outpath, referer.
359func d_spawn_video(url: *u8, outpath: *u8, referer: *u8) -> i64 {
  let wpath: *u8 = d_path(d_self_dir(), "/nx_video_get.sov.elf" as *u8, sys_mmap(640))
  let argv: *i64 = sys_mmap(64) as *i64
  argv[0] = wpath as i64; argv[1] = url as i64; argv[2] = outpath as i64; argv[3] = referer as i64; argv[4] = 0
  let envp: *i64 = sys_mmap(16) as *i64; envp[0] = 0
  let p1: i64 = sys_fork()
  if p1 == 0 { let p2: i64 = sys_fork(); if p2 == 0 { d_close_inherited(); sys_execve(wpath, argv, envp); sys_exit(127) } sys_exit(0) }
  let st: *i64 = sys_mmap(16) as *i64; sys_wait4(p1, st, 0)
  return 0
368}
369// spawn the sovereign HLS downloader (double-fork). argv: elf, m3u8-url, outpath(.ts), referer.
370func d_spawn_hls(url: *u8, outpath: *u8, referer: *u8) -> i64 {
  let wpath: *u8 = d_path(d_self_dir(), "/nx_hls_get.sov.elf" as *u8, sys_mmap(640))
  let argv: *i64 = sys_mmap(64) as *i64
  argv[0] = wpath as i64; argv[1] = url as i64; argv[2] = outpath as i64; argv[3] = referer as i64; argv[4] = 0
  let envp: *i64 = sys_mmap(16) as *i64; envp[0] = 0
  let p1: i64 = sys_fork()
  if p1 == 0 { let p2: i64 = sys_fork(); if p2 == 0 { d_close_inherited(); sys_execve(wpath, argv, envp); sys_exit(127) } sys_exit(0) }
  let st: *i64 = sys_mmap(16) as *i64; sys_wait4(p1, st, 0)
  return 0
379}
380// is this URL an HLS playlist? (path ends with .m3u8, case-insensitive, before any '?')
381func d_is_hls(url: *u8) -> i64 {
  var n: i64 = 0; while url[n] != (0 as u8) { n = n + 1 }
  var e: i64 = n; var i: i64 = 0
  while i < n { if url[i] == (63 as u8) { e = i; i = n } else { i = i + 1 } }   // stop at '?'
  if e < 5 { return 0 }
  let s: i64 = e - 5
  if url[s] != (46 as u8) { return 0 }                                          // '.'
  var c0: i64 = url[s+1] as i64; if c0 >= 65 { if c0 <= 90 { c0 = c0 + 32 } }
  var c1: i64 = url[s+2] as i64; if c1 >= 65 { if c1 <= 90 { c1 = c1 + 32 } }
  var c2: i64 = url[s+3] as i64; if c2 >= 65 { if c2 <= 90 { c2 = c2 + 32 } }
  var c3: i64 = url[s+4] as i64; if c3 >= 65 { if c3 <= 90 { c3 = c3 + 32 } }
  if c0 != 109 { return 0 }   // m
  if c1 != 51  { return 0 }   // 3
  if c2 != 117 { return 0 }   // u
  if c3 != 56  { return 0 }   // 8
  return 1
397}
398// HLS output name: basename (up to the first '.') sanitized, then a forced .ts (stitched MPEG-TS).
399func d_hls_outname(url: *u8, outdir: *u8, out: *u8) -> *u8 {
  var ulen: i64 = 0; while url[ulen] != (0 as u8) { ulen = ulen + 1 }
  var qend: i64 = ulen; var qi: i64 = 0; while qi < ulen { if url[qi] == (63 as u8) { qend = qi; qi = ulen } else { qi = qi + 1 } }
  var seg: i64 = 0; var si: i64 = 0; while si < qend { if url[si] == (47 as u8) { seg = si + 1 } si = si + 1 }
  var o: i64 = d_puts(out, 0, outdir); o = d_puts(out, o, "/" as *u8)
  var nz: i64 = 0; var k: i64 = seg; var stop: i64 = 0
  while k < qend { if stop == 0 {
      let c: i64 = url[k] as i64
      if c == 46 { stop = 1 } else { var ok: i64 = 0; if c>=48 { if c<=57 { ok=1 } } if c>=65 { if c<=90 { ok=1 } } if c>=97 { if c<=122 { ok=1 } } if c==45 { ok=1 } if c==95 { ok=1 } if ok==1 { out[o]=url[k]; o=o+1; nz=nz+1 } }
  } k = k + 1 }
  if nz == 0 { o = d_puts(out, o, "video" as *u8) }
  o = d_puts(out, o, ".ts" as *u8)
  out[o] = 0 as u8
  return out
413}
414// derive outdir/<basename> from a video URL (last path segment before '?'; sanitized; fallback video.mp4).
415func d_vidname(url: *u8, outdir: *u8, out: *u8) -> *u8 {
  var ulen: i64 = 0; while url[ulen] != (0 as u8) { ulen = ulen + 1 }
  var qend: i64 = ulen; var qi: i64 = 0; while qi < ulen { if url[qi] == (63 as u8) { qend = qi; qi = ulen } else { qi = qi + 1 } }
  var seg: i64 = 0; var si: i64 = 0; while si < qend { if url[si] == (47 as u8) { seg = si + 1 } si = si + 1 }
  var o: i64 = d_puts(out, 0, outdir); o = d_puts(out, o, "/" as *u8)
  var nz: i64 = 0; var k: i64 = seg
  while k < qend { let c: i64 = url[k] as i64; var ok: i64 = 0; if c>=48 { if c<=57 { ok=1 } } if c>=65 { if c<=90 { ok=1 } } if c>=97 { if c<=122 { ok=1 } } if c==46 { ok=1 } if c==45 { ok=1 } if c==95 { ok=1 } if ok==1 { out[o]=url[k]; o=o+1; nz=nz+1 } k=k+1 }
  if nz == 0 { o = d_puts(out, o, "video.mp4" as *u8) }
  out[o] = 0 as u8
  return out
425}
426
427func d_scan_to(buf: *u8, n: i64, from: i64, delim: i64) -> i64 {
  var i: i64 = from
  while i < n { if (buf[i] as i64) == delim { return i } i = i + 1 }
  return n
431}
432func d_json_buf(dst: *u8, off: i64, src: *u8, from: i64, to: i64) -> i64 {
  var i: i64 = from
  while i < to {
      let c: i64 = src[i] as i64
      if c==34 { dst[off]=92 as u8; off=off+1; dst[off]=34 as u8; off=off+1 }
      else { if c==92 { dst[off]=92 as u8; off=off+1; dst[off]=92 as u8; off=off+1 }
      else { dst[off]=src[i]; off=off+1 } }
      i = i + 1
  }
  return off
442}
443func d_raw_buf(dst: *u8, off: i64, src: *u8, from: i64, to: i64) -> i64 {
  if from >= to { dst[off]=48 as u8; return off+1 }
  var i: i64 = from; while i < to { dst[off]=src[i]; off=off+1; i=i+1 }
  return off
447}
448// GET /discover_result -> read discover.tsv (+ .status) -> JSON
449func d_discover_result(cfd: i64, dpath: *u8) -> i64 {
  let sp: *u8 = sys_mmap(TORRENT_MAGIC_1024); var i: i64 = 0; while dpath[i]!=(0 as u8){sp[i]=dpath[i];i=i+1}
  let suf: *u8 = ".status" as *u8; var j: i64 = 0; while suf[j]!=(0 as u8){sp[i]=suf[j];i=i+1;j=j+1} sp[i]=0 as u8
  let sbuf: *u8 = sys_mmap(TORRENT_MAGIC_1024); let sn: i64 = d_read_file(sp, sbuf, TORRENT_MAGIC_1024)
  let stateb: *u8 = sys_mmap(64); stateb[0]=0 as u8
  var scount: i64 = 0; var sbytes: i64 = 0
  if sn > 0 {
      d_copy_line(sbuf, sn, d_find_val(sbuf, sn, "state=" as *u8), stateb, 64)
      scount = d_int_at(sbuf, sn, d_find_val(sbuf, sn, "count=" as *u8))
      sbytes = d_int_at(sbuf, sn, d_find_val(sbuf, sn, "bytes=" as *u8))
  } else { let df: *u8 = "fetching" as *u8; var z: i64 = 0; while df[z]!=(0 as u8){stateb[z]=df[z];z=z+1} stateb[z]=0 as u8 }
  let tbuf: *u8 = sys_mmap(TORRENT_MAGIC_262144); let tn: i64 = d_read_file(dpath, tbuf, TORRENT_MAGIC_262144)
  let out: *u8 = sys_mmap(TORRENT_MAGIC_262144); var o: i64 = 0
  o = d_puts(out, o, "{\"state\":\"" as *u8); o = d_json_buf(out, o, stateb, 0, d_strlen(stateb))
  o = d_puts(out, o, "\",\"count\":" as *u8); o = d_putn(out, o, scount)
  o = d_puts(out, o, ",\"bytes\":" as *u8); o = d_putn(out, o, sbytes)
  o = d_puts(out, o, ",\"magnets\":[" as *u8)
  if tn > 0 {
      var p: i64 = 0; var first: i64 = 1; var guard: i64 = 0
      while p < tn {
          if guard > TORRENT_MAGIC_4000 { p = tn } else {
              guard = guard + 1
              let a: i64 = d_scan_to(tbuf, tn, p, 9)
              let b: i64 = d_scan_to(tbuf, tn, a+1, 9)
              let c: i64 = d_scan_to(tbuf, tn, b+1, 9)
              let e: i64 = d_scan_to(tbuf, tn, c+1, 10)
              if a < tn {
                  if first == 0 { o = d_puts(out, o, "," as *u8) } first = 0
                  o = d_puts(out, o, "{\"hash\":\"" as *u8); o = d_json_buf(out, o, tbuf, p, a)
                  o = d_puts(out, o, "\",\"name\":\"" as *u8); o = d_json_buf(out, o, tbuf, a+1, b)
                  o = d_puts(out, o, "\",\"trackers\":" as *u8); o = d_raw_buf(out, o, tbuf, b+1, c)
                  o = d_puts(out, o, ",\"magnet\":\"" as *u8); o = d_json_buf(out, o, tbuf, c+1, e)
                  o = d_puts(out, o, "\"}" as *u8)
              }
              p = e + 1
          }
      }
  }
  o = d_puts(out, o, "]}" as *u8)
  d_send(cfd, "200 OK" as *u8, "application/json" as *u8, out, o)
  return 0
490}
491
492// ============ MULTI-TORRENT: per-info-hash isolation + a registry ============
493// Each torrent lives in outdir/<btih>/download.* (the worker already takes its outdir).
494// outdir/torrents.idx is a newline-list of active <btih> ids. No clobber between torrents.
495
496// extract the btih value from a magnet ("...btih:<id>&..." or end) -> the per-torrent id (hex/base32)
497func d_extract_btih(mag: *u8, n: i64, out: *u8, ocap: i64) -> i64 {
  var i: i64 = 0; var start: i64 = 0 - 1
  while i + 5 <= n {
      if mag[i]==(98 as u8) { if mag[i+1]==(116 as u8) { if mag[i+2]==(105 as u8) { if mag[i+3]==(104 as u8) { if mag[i+4]==(58 as u8) {
          start = i + 5; i = n + 100
      }}}}}
      i = i + 1
  }
  if start < 0 { return 0 }
  var j: i64 = start; var k: i64 = 0; var go: i64 = 1
  while go == 1 {
      if j >= n { go = 0 } else { if mag[j]==(38 as u8) { go = 0 } else {
          if k < ocap - 1 { out[k] = mag[j]; k = k + 1 }
          j = j + 1
      } }
  }
  out[k] = 0 as u8
  return k
515}
516// hex char -> 0..15 (else -1), for %XX url-decode in dn= names
517func d_hexv(c: i64) -> i64 {
  if c >= 48 { if c <= 57 { return c - 48 } }
  if c >= 97 { if c <= 102 { return c - 97 + 10 } }
  if c >= 65 { if c <= 70 { return c - 65 + 10 } }
  return 0 - 1
522}
523// extract dn= (display name) from the magnet, url-decode (%XX, '+'), make filesystem+URL-safe -> out.
524// Keeps [A-Za-z0-9._-]; every run of other chars collapses to a single '_' (never leading). So the user
525// sees a recognizable folder ("javdb.com_326FCT-218") in Downloads instead of a raw info-hash. 0 = no dn=.
526func d_extract_name(mag: *u8, n: i64, out: *u8, ocap: i64) -> i64 {
  var i: i64 = 0; var start: i64 = 0 - 1
  while i + 3 <= n {
      if mag[i]==(100 as u8) { if mag[i+1]==(110 as u8) { if mag[i+2]==(61 as u8) { start = i + 3; i = n + 100 } } }   // 'd','n','='
      i = i + 1
  }
  if start < 0 { return 0 }
  var j: i64 = start; var k: i64 = 0; var pendu: i64 = 0; var go: i64 = 1
  while go == 1 {
      if j >= n { go = 0 } else { if mag[j]==(38 as u8) { go = 0 } else {
          var c: i64 = mag[j] as i64
          if c == 37 { if j + 2 < n { let hi: i64 = d_hexv(mag[j+1] as i64); let lo: i64 = d_hexv(mag[j+2] as i64); if hi >= 0 { if lo >= 0 { c = hi*16+lo; j = j + 2 } } } }
          if c == 43 { c = 32 }
          var keep: i64 = 0
          if c >= 48 { if c <= 57 { keep = 1 } }
          if c >= 65 { if c <= 90 { keep = 1 } }
          if c >= 97 { if c <= 122 { keep = 1 } }
          if c == 46 { keep = 1 }
          if c == 45 { keep = 1 }
          if c == 95 { keep = 1 }
          if keep == 1 {
              if pendu == 1 { if k < ocap - 1 { out[k] = 95 as u8; k = k + 1 } pendu = 0 }
              if k < ocap - 1 { out[k] = c as u8; k = k + 1 }
          } else { if k > 0 { pendu = 1 } }
          j = j + 1
      } }
  }
  out[k] = 0 as u8
  return k
555}
556// build outdir/<id> into dir (NUL-terminated); returns dir.
557func d_subdir(outdir: *u8, id: *u8, dir: *u8) -> *u8 {
  var p: i64 = d_puts(dir, 0, outdir); p = d_puts(dir, p, "/" as *u8); p = d_puts(dir, p, id); dir[p] = 0 as u8
  return dir
560}
561func d_ends(buf: *u8, off: i64, len: i64, suf: *u8) -> i64 {
  let sl: i64 = d_strlen(suf)
  if sl > len { return 0 }
  var i: i64 = 0
  while i < sl { if buf[off+len-sl+i] != suf[i] { return 0 } i = i + 1 }
  return 1
567}
568// is id one of the newline-delimited lines in buf[0..n)?
569func d_idx_has(buf: *u8, n: i64, id: *u8) -> i64 {
  let idl: i64 = d_strlen(id)
  var i: i64 = 0
  while i < n {
      let e: i64 = d_scan_to(buf, n, i, 10)
      if (e - i) == idl { var j: i64 = 0; var m: i64 = 1; while j < idl { if buf[i+j] != id[j] { m = 0; j = idl } else { j = j + 1 } } if m == 1 { return 1 } }
      i = e + 1
  }
  return 0
578}
579// add id to the registry if absent (rewrite the small file; idempotent)
580func d_idx_add(idxpath: *u8, id: *u8) -> i64 {
  // best-effort dedup, then ATOMIC O_APPEND -- not read-modify-write. Two simultaneous adds used to
  // both rewrite the whole file, losing one entry (the gate's false-RED); O_APPEND can't clobber.
  let buf: *u8 = sys_mmap(TORRENT_MAGIC_65536); let n: i64 = d_read_file(idxpath, buf, TORRENT_MAGIC_65536); if n > 0 { if d_idx_has(buf, n, id) == 1 { return 0 } }
  let fd: i64 = __syscall(SYS_OPENAT, AT_FDCWD, idxpath as i64, O_WRONLY_CA, 0x1a4, 0, 0)
  if fd < 0 { return 0 - 1 }
  let line: *u8 = sys_mmap(160); var k: i64 = 0; while id[k] != (0 as u8) { line[k] = id[k]; k = k + 1 } line[k] = 10 as u8; k = k + 1
  sys_write(fd, line, k)
  sys_close(fd)
  return 0
590}
591// drop id's line from the registry (rewrite without it)
592func d_idx_remove(idxpath: *u8, id: *u8) -> i64 {
  let buf: *u8 = sys_mmap(TORRENT_MAGIC_65536); let n: i64 = d_read_file(idxpath, buf, TORRENT_MAGIC_65536); if n <= 0 { return 0 }
  let idl: i64 = d_strlen(id)
  let out: *u8 = sys_mmap(TORRENT_MAGIC_65536); var o: i64 = 0
  var i: i64 = 0
  while i < n {
      let e: i64 = d_scan_to(buf, n, i, 10)
      let len: i64 = e - i
      var keep: i64 = 1
      if len == idl { var j: i64 = 0; var m: i64 = 1; while j < idl { if buf[i+j] != id[j] { m = 0; j = idl } else { j = j + 1 } } if m == 1 { keep = 0 } }
      if keep == 1 { if len > 0 { var c: i64 = i; while c < e { out[o] = buf[c]; o = o + 1; c = c + 1 } out[o] = 10 as u8; o = o + 1 } }
      i = e + 1
  }
  d_write_file(idxpath, out, o)
  return 0
607}
608// append ONE Download JSON object (id + its dir's status, control-overridden) to out at o0; return new o.
609func d_status_one(out: *u8, o0: i64, id: *u8, dir: *u8) -> i64 {
  var o: i64 = o0
  let statpath: *u8 = d_path(dir, "/download.status" as *u8, sys_mmap(640))
  let ctl2: *u8 = d_path(dir, "/download.control" as *u8, sys_mmap(640))
  let cb: *u8 = sys_mmap(16); let cn: i64 = d_read_file(ctl2, cb, 15)
  var paused: i64 = 0; if cn > 0 { if (cb[0] as i64) == 112 { paused = 1 } }
  let buf: *u8 = sys_mmap(TORRENT_MAGIC_8192); let n: i64 = d_read_file(statpath, buf, TORRENT_MAGIC_8192)
  let total: i64 = d_int_at(buf, n, d_find_val(buf, n, "total=" as *u8))
  let done: i64  = d_int_at(buf, n, d_find_val(buf, n, "done=" as *u8))
  let have: i64  = d_int_at(buf, n, d_find_val(buf, n, "have=" as *u8))
  let pieces: i64= d_int_at(buf, n, d_find_val(buf, n, "pieces=" as *u8))
  let peers: i64 = d_int_at(buf, n, d_find_val(buf, n, "peers=" as *u8))
  let stateb: *u8 = sys_mmap(64); d_copy_line(buf, n, d_find_val(buf, n, "state=" as *u8), stateb, 64)
  if n <= 0 { var z: i64 = 0; let s0: *u8 = "started" as *u8; while s0[z] != (0 as u8) { stateb[z] = s0[z]; z = z + 1 } stateb[z] = 0 as u8 }
  if paused == 1 { var z2: i64 = 0; let s1: *u8 = "paused" as *u8; while s1[z2] != (0 as u8) { stateb[z2] = s1[z2]; z2 = z2 + 1 } stateb[z2] = 0 as u8 }
  let nameb: *u8 = sys_mmap(512); d_copy_line(buf, n, d_find_val(buf, n, "name=" as *u8), nameb, 512)
  if n <= 0 { var z3: i64 = 0; let s2: *u8 = "resolving" as *u8; while s2[z3] != (0 as u8) { nameb[z3] = s2[z3]; z3 = z3 + 1 } nameb[z3] = 0 as u8 }
  var vpct: i64 = 0; if pieces > 0 { vpct = have*100/pieces }
  o = d_puts(out, o, "{\"id\":\"" as *u8); o = d_puts(out, o, id)
  o = d_puts(out, o, "\",\"name\":\"" as *u8); o = d_json_buf(out, o, nameb, 0, d_strlen(nameb))
  o = d_puts(out, o, "\",\"size\":" as *u8); o = d_putn(out, o, total)
  o = d_puts(out, o, ",\"done\":" as *u8); o = d_putn(out, o, done)
  o = d_puts(out, o, ",\"peers\":" as *u8); o = d_putn(out, o, peers)
  o = d_puts(out, o, ",\"havePieces\":" as *u8); o = d_putn(out, o, have)
  o = d_puts(out, o, ",\"totalPieces\":" as *u8); o = d_putn(out, o, pieces)
  o = d_puts(out, o, ",\"verified\":" as *u8); o = d_putn(out, o, vpct)
  o = d_puts(out, o, ",\"status\":\"" as *u8); o = d_puts(out, o, stateb)
  o = d_puts(out, o, "\"}" as *u8)
  return o
638}
639// GET /status: aggregate every torrent in the registry into the downloads array.
640func d_status_all(cfd: i64, outdir: *u8, idxpath: *u8) -> i64 {
  let idx: *u8 = sys_mmap(TORRENT_MAGIC_65536); let n: i64 = d_read_file(idxpath, idx, TORRENT_MAGIC_65536)
  let out: *u8 = sys_mmap(TORRENT_MAGIC_262144); var o: i64 = 0
  o = d_puts(out, o, "{\"downloads\":[" as *u8)
  var first: i64 = 1
  if n > 0 {
      var i: i64 = 0; var guard: i64 = 0
      while i < n {
          if guard > TORRENT_MAGIC_2000 { i = n } else {
              guard = guard + 1
              let e: i64 = d_scan_to(idx, n, i, 10)
              let len: i64 = e - i
              if len > 0 {
                  let id: *u8 = sys_mmap(128); var k: i64 = 0; while k < len { if k < 127 { id[k] = idx[i+k]; k = k + 1 } else { k = len } } id[len] = 0 as u8
                  if d_idx_has(idx, i, id) == 0 {   // dedup: O_APPEND may leave a rare dup line; render each id once
                      let dir: *u8 = d_subdir(outdir, id, sys_mmap(640))
                      if first == 0 { o = d_puts(out, o, "," as *u8) } first = 0
                      o = d_status_one(out, o, id, dir)
                  }
              }
              i = e + 1
          }
      }
  }
  o = d_puts(out, o, "]}" as *u8)
  d_send(cfd, "200 OK" as *u8, "application/json" as *u8, out, o)
  return 0
667}
668
669// ---- stream-while-downloading: serve the VIDEO file's downloaded prefix from download.part (HTTP Range) ----
670// The torrent's LARGEST file is the video; its bytes live at [voff, voff+vlen) inside download.part. We serve
671// the contiguous-downloaded intersection so a <video> plays what has arrived. Works fully for a completed
672// download (streams straight from download.part, no extraction) and progressively in sequential stream-mode.
673
674// largest file's (offset,length) within download.part, from download.meta. out[0]=offset, out[1]=length.
675func d_video_extent(meta: *u8, msize: i64, out: *i64) -> i64 {
  out[0] = 0; out[1] = 0
  let filo: i64 = nx_bc_dict_get(meta, 0, msize, "files" as *u8, 5)
  if filo >= 0 { if (meta[filo] as i64) == 0x6C {                  // 'l' -> multi-file
      var p: i64 = filo + 1; var off: i64 = 0; var bestoff: i64 = 0; var bestlen: i64 = 0; var run: i64 = 1
      while run == 1 {
          if p >= msize { run = 0 } else { if (meta[p] as i64) == 0x65 { run = 0 } else {
              let lo: i64 = nx_bc_dict_get(meta, p, msize, "length" as *u8, 6); let lv: *i64 = sys_mmap(8) as *i64; lv[0]=0; if lo>=0 { nx_bc_int(meta, lo, msize, lv) }
              if lv[0] > bestlen { bestlen = lv[0]; bestoff = off }
              off = off + lv[0]; p = nx_bc_skip(meta, p, msize)
          } }
      }
      out[0] = bestoff; out[1] = bestlen; return 1
  } }
  let lno: i64 = nx_bc_dict_get(meta, 0, msize, "length" as *u8, 6); let lv2: *i64 = sys_mmap(8) as *i64; lv2[0]=0; if lno>=0 { nx_bc_int(meta, lno, msize, lv2) }
  out[0] = 0; out[1] = lv2[0]; return 1                           // single-file -> whole part is the file
691}
692
693// contiguous downloaded bytes from offset 0 (full pieces only) = read download.done + download.npc.
694func d_contig_bytes(dir: *u8) -> i64 {
  let donep: *u8 = d_path(dir, "/download.done" as *u8, sys_mmap(640))
  let db: *u8 = sys_mmap(TORRENT_MAGIC_262144); let dn: i64 = d_read_file(donep, db, TORRENT_MAGIC_262144)
  if dn <= 0 { return 0 }
  var contig: i64 = 0; var i: i64 = 0
  while i < dn { if (db[i] as i64) == 1 { contig = contig + 1; i = i + 1 } else { i = dn } }
  let npcp: *u8 = d_path(dir, "/download.npc" as *u8, sys_mmap(640))
  let nb: *u8 = sys_mmap(16); let nn: i64 = d_read_file(npcp, nb, 16)
  var plen: i64 = 0
  if nn >= 8 { plen = ((nb[4] as i64)<<24)|((nb[5] as i64)<<16)|((nb[6] as i64)<<8)|(nb[7] as i64) }
  return contig * plen
705}
706
707// extract + url-decode the urlencoded "magnet=" form field (the browser UI sends
708// magnet=<encodeURIComponent(...)>&area=...). %XX -> byte, '+' -> space; the value runs to the field
709// separator '&' or end. The magnet's OWN '&' (between dn=/tr=) arrive as %26, so they do NOT terminate
710// early. Returns the decoded length, or 0 if there's no magnet= field / it isn't a magnet (caller then
711// falls back to the JSON/raw scan the gate uses). FIXES: browser "Add" returning 400 "no magnet".
712func d_form_magnet(body: *u8, blen: i64, out: *u8, ocap: i64) -> i64 {
  var i: i64 = 0; var start: i64 = 0 - 1
  while i + 7 <= blen {
      if body[i]==(109 as u8){ if body[i+1]==(97 as u8){ if body[i+2]==(103 as u8){ if body[i+3]==(110 as u8){ if body[i+4]==(101 as u8){ if body[i+5]==(116 as u8){ if body[i+6]==(61 as u8){
          start = i + 7; i = blen + 100
      }}}}}}}
      i = i + 1
  }
  if start < 0 { return 0 }
  var j: i64 = start; var k: i64 = 0; var go: i64 = 1
  while go == 1 {
      if j >= blen { go = 0 } else {
          var c: i64 = body[j] as i64
          if c == 38 { go = 0 } else {                          // '&' = end of this form field
              if c == 37 { if j + 2 < blen { let hi: i64 = d_hexv(body[j+1] as i64); let lo: i64 = d_hexv(body[j+2] as i64); if hi >= 0 { if lo >= 0 { c = hi*16 + lo; j = j + 2 } } } }
              if c == 43 { c = 32 }                              // '+' -> space
              if k < ocap - 1 { out[k] = c as u8; k = k + 1 }
              j = j + 1
          }
      }
  }
  out[k] = 0 as u8
  if k < 7 { return 0 }                                          // must be at least "magnet:"
  if out[0]!=(109 as u8){ return 0 } if out[1]!=(97 as u8){ return 0 } if out[2]!=(103 as u8){ return 0 } if out[3]!=(110 as u8){ return 0 } if out[4]!=(101 as u8){ return 0 } if out[5]!=(116 as u8){ return 0 } if out[6]!=(58 as u8){ return 0 }
  return k
737}
738
739// size in bytes of a file (st_size @ off 48 of the x86_64 struct stat; mirrors the mtime@88 read in
740// d_autoresume). 0 if it doesn't exist. Lets /stream serve a (near-)complete video's full extent.
741func d_filesize(path: *u8) -> i64 {
  let stbuf: *u8 = sys_mmap(160)
  if sys_fstatat(path, stbuf) == 0 { let szp: *i64 = (((stbuf as i64) + 48)) as *i64; return szp[0] }
  return 0
745}
746
747// out[0] = pieces verified on disk (count of 1-bytes in download.done), out[1] = total pieces (download.npc).
748func d_have_npc(dir: *u8, out: *i64) -> i64 {
  out[0] = 0; out[1] = 0
  let donep: *u8 = d_path(dir, "/download.done" as *u8, sys_mmap(640))
  let db: *u8 = sys_mmap(TORRENT_MAGIC_262144); let dn: i64 = d_read_file(donep, db, TORRENT_MAGIC_262144)
  var have: i64 = 0; var i: i64 = 0
  while i < dn { if (db[i] as i64) == 1 { have = have + 1 } i = i + 1 }
  out[0] = have
  let npcp: *u8 = d_path(dir, "/download.npc" as *u8, sys_mmap(640))
  let nb: *u8 = sys_mmap(16); let nn: i64 = d_read_file(npcp, nb, 16)
  if nn >= 4 { out[1] = ((nb[0] as i64)<<24)|((nb[1] as i64)<<16)|((nb[2] as i64)<<8)|(nb[3] as i64) }
  return 0
759}
760
761// parse "Range: bytes=START-END" (END optional). out[0]=start, out[1]=end(-1 open). returns 1 if present.
762func d_parse_range(req: *u8, rn: i64, out: *i64) -> i64 {
  out[0] = 0; out[1] = 0 - 1
  let pat: *u8 = "Range: bytes=" as *u8; let pl: i64 = 13
  var i: i64 = 0; var pos: i64 = 0 - 1
  while i + pl <= rn { var j: i64 = 0; var m: i64 = 1; while j < pl { if req[i+j] != pat[j] { m = 0; j = pl } else { j = j + 1 } } if m == 1 { pos = i + pl; i = rn } else { i = i + 1 } }
  if pos < 0 { return 0 }
  var s: i64 = 0; var sgo: i64 = 1
  while sgo == 1 { if pos >= rn { sgo = 0 } else { let c: i64 = req[pos] as i64; if c >= 48 { if c <= 57 { s = s*10 + (c-48); pos = pos + 1 } else { sgo = 0 } } else { sgo = 0 } } }
  out[0] = s                                                       // pos now points at the first non-digit (the '-') or rn
  if pos < rn { if (req[pos] as i64) == 45 {                       // '-'
      pos = pos + 1; var e: i64 = 0; var he: i64 = 0
      while pos < rn { let c2: i64 = req[pos] as i64; if c2 >= 48 { if c2 <= 57 { e = e*10 + (c2-48); he = 1; pos = pos + 1 } else { pos = rn } } else { pos = rn } }
      if he == 1 { out[1] = e }
  } }
  return 1
777}
778
779func d_stream(cfd: i64, req: *u8, rn: i64, dir: *u8) -> i64 {
  // a /stream request means the operator is watching -> switch this torrent to SEQUENTIAL download so
  // the playable prefix grows in order (the worker reads download.stream each pick). Harmless if complete.
  d_write_file(d_path(dir, "/download.stream" as *u8, sys_mmap(640)), "1" as *u8, 1)
  let metap: *u8 = d_path(dir, "/download.meta" as *u8, sys_mmap(640))
  let meta: *u8 = sys_mmap(TORRENT_MAGIC_1048576); let msize: i64 = d_read_file(metap, meta, TORRENT_MAGIC_1048576)
  if msize <= 0 { d_send_str(cfd, "404 Not Found" as *u8, "text/plain" as *u8, "no metadata yet\n" as *u8); return 0 }
  let ext: *i64 = sys_mmap(16) as *i64; d_video_extent(meta, msize, ext)
  let voff: i64 = ext[0]; let vlen: i64 = ext[1]
  if vlen <= 0 { d_send_str(cfd, "404 Not Found" as *u8, "text/plain" as *u8, "no playable file\n" as *u8); return 0 }
  // AVAIL = how much of the video we can serve now. Near-complete or complete (>=90% of pieces) -> serve
  // the whole furthest-downloaded extent of download.part (any still-missing piece is a sparse-zero gap the
  // player skips), so a 99%-done OR finished torrent IS watchable. Early (<90%) -> only the contiguous
  // prefix from byte 0, so sequential stream-mode plays cleanly from the start. FIXES "can't watch 99%
  // done" + lets you watch one torrent while others keep downloading.
  let hn: *i64 = sys_mmap(16) as *i64; d_have_npc(dir, hn)
  let have: i64 = hn[0]; let npc: i64 = hn[1]
  // COMPLETE single-file MPEG-TS -> fly-remux to fMP4 so a plain <video> (Chrome/Firefox) plays it,
  // mirroring the gallery's gs_vid_remux_ts (rung 8). In-progress / multi-file fall through to the partial Range
  // serve below (watch-while-downloading + native mp4). The daemon forks per-connection, so execve here
  // replaces only this child.
  if npc > 0 { if have >= npc { if voff == 0 {
      let partp0: *u8 = d_path(dir, "/download.part" as *u8, sys_mmap(640))
      let mb0: *u8 = sys_mmap(64); let pf0: i64 = sys_openat_rd(partp0); var g0: i64 = 0; if pf0 >= 0 { g0 = sys_read(pf0, mb0, 16) }
      var is_ts: i64 = 0; if g0 >= 1 { if (mb0[0] as i64) == 0x47 { is_ts = 1 } }   // 0x47 = MPEG-TS sync byte
      var is_ftyp: i64 = 0; if g0 >= 16 { if mb0[4]==(102 as u8) { if mb0[5]==(116 as u8) { if mb0[6]==(121 as u8) { if mb0[7]==(112 as u8) { is_ftyp = 1 } } } } }   // 'ftyp' = mp4
      var is_fast: i64 = 0
      if is_ftyp == 1 {   // is the box AFTER ftyp already 'moov' (faststart)? then the Range serve below is seekable.
          let ftsz: i64 = ((mb0[0] as i64)<<24)|((mb0[1] as i64)<<16)|((mb0[2] as i64)<<8)|(mb0[3] as i64)
          let nb: *u8 = sys_mmap(16); var ng: i64 = 0; if pf0 >= 0 { sys_lseek(pf0, ftsz, 0); ng = sys_read(pf0, nb, 8) }
          if ng >= 8 { if nb[4]==(109 as u8) { if nb[5]==(111 as u8) { if nb[6]==(111 as u8) { if nb[7]==(118 as u8) { is_fast = 1 } } } } }   // 'moov'
      }
      if pf0 >= 0 { sys_close(pf0) }
      // COMPLETE single-file MPEG-TS -> fly-remux to fMP4 so a plain <video> (Chrome/Firefox) plays it.
      if is_ts == 1 {
          let fh: *u8 = "HTTP/1.1 200 OK\r\nContent-Type: video/mp4\r\nCache-Control: no-store\r\nConnection: close\r\n\r\n" as *u8
          sys_write(cfd, fh, d_strlen(fh)); sys_dup3(cfd, 1, 0)
          let wexe: *u8 = d_path(d_self_dir(), "/nx_ts2fmp4.sov.elf" as *u8, sys_mmap(640))   // sibling of the daemon (self-dir): /tmp on dev, /volume1/ai/torrent on the NAS
          let av2: *i64 = sys_mmap(64) as *i64; av2[0] = wexe as i64; av2[1] = partp0 as i64; av2[2] = 0
          let ev2: *i64 = sys_mmap(16) as *i64; ev2[0] = 0
          sys_execve(wexe, av2, ev2); sys_exit(127)
      }
      // NON-FASTSTART mp4 ([ftyp][mdat..][moov]): a browser streaming via Range reads the front, finds no moov
      // -> "no video, this format is not supported". Relocate moov to the FRONT on the fly (nx_mp4_faststart,
      // lossless, gate-proven) so a plain <video> plays it. Faststart mp4s (moov already front) fall through
      // to the seekable Range serve below.
      if is_ftyp == 1 { if is_fast == 0 {
          let fh2: *u8 = "HTTP/1.1 200 OK\r\nContent-Type: video/mp4\r\nCache-Control: no-store\r\nConnection: close\r\n\r\n" as *u8
          sys_write(cfd, fh2, d_strlen(fh2)); sys_dup3(cfd, 1, 0)
          let wexe2: *u8 = d_path(d_self_dir(), "/nx_mp4_faststart.sov.elf" as *u8, sys_mmap(640))
          let av3: *i64 = sys_mmap(64) as *i64; av3[0] = wexe2 as i64; av3[1] = partp0 as i64; av3[2] = 0
          let ev3: *i64 = sys_mmap(16) as *i64; ev3[0] = 0
          sys_execve(wexe2, av3, ev3); sys_exit(127)
      } }
  } } }
  var avail: i64 = 0
  if npc > 0 { if have * 100 >= npc * 90 {
      let partp0: *u8 = d_path(dir, "/download.part" as *u8, sys_mmap(640))
      avail = d_filesize(partp0) - voff
  } else { avail = d_contig_bytes(dir) - voff } }
  else { avail = d_contig_bytes(dir) - voff }
  if avail < 0 { avail = 0 } if avail > vlen { avail = vlen }
  if avail <= 0 { d_send_str(cfd, "425 Too Early" as *u8, "text/plain" as *u8, "not enough downloaded yet\n" as *u8); return 0 }
  let rng: *i64 = sys_mmap(16) as *i64; d_parse_range(req, rn, rng)
  var rs: i64 = rng[0]; var re: i64 = rng[1]
  if re < 0 { re = vlen - 1 }
  if rs < 0 { rs = 0 }
  if rs >= avail { d_send_str(cfd, "416 Range Not Satisfiable" as *u8, "text/plain" as *u8, "beyond available\n" as *u8); return 0 }
  if re > avail - 1 { re = avail - 1 }
  let served: i64 = re - rs + 1
  let h: *u8 = sys_mmap(512); var o: i64 = 0
  o = d_puts(h, o, "HTTP/1.1 206 Partial Content\r\nContent-Type: video/mp4\r\nAccept-Ranges: bytes\r\nContent-Range: bytes " as *u8)
  o = d_putn(h, o, rs); o = d_puts(h, o, "-" as *u8); o = d_putn(h, o, re); o = d_puts(h, o, "/" as *u8); o = d_putn(h, o, vlen)
  o = d_puts(h, o, "\r\nContent-Length: " as *u8); o = d_putn(h, o, served)
  o = d_puts(h, o, "\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: no-store\r\nConnection: close\r\n\r\n" as *u8)
  sys_write(cfd, h, o)
  let partp: *u8 = d_path(dir, "/download.part" as *u8, sys_mmap(640))
  let pfd: i64 = sys_openat_rd(partp)
  if pfd >= 0 {
      sys_lseek(pfd, voff + rs, 0)
      let chunk: *u8 = sys_mmap(TORRENT_MAGIC_1048576); var rem: i64 = served
      while rem > 0 { var want: i64 = TORRENT_MAGIC_1048576; if rem < want { want = rem } let g: i64 = sys_read(pfd, chunk, want); if g <= 0 { rem = 0 } else { sys_write(cfd, chunk, g); rem = rem - g } }
      sys_close(pfd)
  }
  sys_close(cfd)
  return 0
865}
866
867// DEDUP BY INFO-HASH: scan existing torrents' download.magnet for one whose btih == `btih`. Returns 1
868// + copies that torrent's id into out_id (so an add of the same content under a different display name
869// RESUMES the one download instead of creating a duplicate subdir). Works for torrents added before this
870// fix too (it reads their magnet, not a sidecar).
871func d_find_by_btih(outdir: *u8, idxpath: *u8, btih: *u8, btn: i64, out_id: *u8, ocap: i64) -> i64 {
  let idx: *u8 = sys_mmap(TORRENT_MAGIC_65536); let n: i64 = d_read_file(idxpath, idx, TORRENT_MAGIC_65536)
  if n <= 0 { return 0 }
  var i: i64 = 0; var guard: i64 = 0
  while i < n {
      if guard > TORRENT_MAGIC_2000 { i = n } else {
          guard = guard + 1
          let e: i64 = d_scan_to(idx, n, i, 10)
          let idlen: i64 = e - i
          if idlen > 0 { if idlen < 500 {
              let id: *u8 = sys_mmap(512); var k: i64 = 0; while k < idlen { id[k] = idx[i+k]; k = k + 1 } id[idlen] = 0 as u8
              let dir: *u8 = d_subdir(outdir, id, sys_mmap(640))
              let magp: *u8 = d_path(dir, "/download.magnet" as *u8, sys_mmap(640))
              let mb: *u8 = sys_mmap(TORRENT_MAGIC_4096); let mln: i64 = d_read_file(magp, mb, TORRENT_MAGIC_4095)
              if mln > 0 {
                  mb[mln] = 0 as u8
                  let eb: *u8 = sys_mmap(128); let ebn: i64 = d_extract_btih(mb, mln, eb, 128)
                  if ebn == btn {
                      var m: i64 = 1; var j: i64 = 0
                      while j < btn { if eb[j] != btih[j] { m = 0; j = btn } else { j = j + 1 } }
                      if m == 1 { var c: i64 = 0; while c < idlen { if c < ocap-1 { out_id[c] = id[c] } c = c + 1 } out_id[idlen] = 0 as u8; return 1 }
                  }
              }
          } }
          i = e + 1
      }
  }
  return 0
899}
900
901// STARTUP AUTO-RESUME (crash/reboot recovery): resume every torrent that is control=active AND has
902// on-disk progress AND whose status file is STALE (not touched in 60s = its worker is dead). The
903// staleness guard is load-bearing: a GRACEFUL daemon restart leaves the workers alive (they double-fork
904// + reparent to init, so they survive), and their status keeps updating -> NOT stale -> NOT re-spawned
905// (no duplicate worker). Only a crash/reboot (workers gone, status frozen) triggers a resume. Returns count.
906func d_autoresume(outdir: *u8, idxpath: *u8) -> i64 {
  let idx: *u8 = sys_mmap(TORRENT_MAGIC_65536); let n: i64 = d_read_file(idxpath, idx, TORRENT_MAGIC_65536)
  if n <= 0 { return 0 }
  let ts: *i64 = sys_mmap(16) as *i64; sys_clock_gettime_real(ts); let now: i64 = ts[0]
  let stbuf: *u8 = sys_mmap(160)
  var i: i64 = 0; var guard: i64 = 0; var resumed: i64 = 0
  while i < n {
      if guard > TORRENT_MAGIC_2000 { i = n } else {
          guard = guard + 1
          let e: i64 = d_scan_to(idx, n, i, 10)
          let idlen: i64 = e - i
          if idlen > 0 { if idlen < 500 {
              let id: *u8 = sys_mmap(512); var k: i64 = 0; while k < idlen { id[k] = idx[i+k]; k = k + 1 } id[idlen] = 0 as u8
              let dir: *u8 = d_subdir(outdir, id, sys_mmap(640))
              let ctlp: *u8 = d_path(dir, "/download.control" as *u8, sys_mmap(640)); let cb: *u8 = sys_mmap(16); let cn: i64 = d_read_file(ctlp, cb, 15)
              var active: i64 = 0; if cn > 0 { if (cb[0] as i64) == 97 { active = 1 } }   // 'a'ctive
              if active == 1 {
                  let hn: *i64 = sys_mmap(16) as *i64; d_have_npc(dir, hn)
                  // RESUMABLE = on-disk progress OR metadata-not-yet-resolved (npc==0). A magnet still fetching
                  // its info dict legitimately has NO progress yet -- the old `d_has_progress` gate skipped it
                  // FOREVER, so a magnet that failed metadata once was never retried (the BANK-155/MGFX-142
                  // "never resolved metadata" stuck bug). npc>0 && have>=npc = COMPLETE -> skip (no forever-respawn).
                  // RESUME ANY active torrent -- the `notdone` gate below is the sole COMPLETE-skip. The old gate
                  // (resumable only if d_has_progress OR npc==0) STRANDED FOREVER the torrents that resolved
                  // metadata (npc>0) but downloaded ZERO pieces (download.done absent -> d_has_progress=0): exactly
                  // BANK-155/ajvr-256/ajvr-166 (the "IGNORING" torrents). They got ONE worker at /add, and once it
                  // died without completing a piece they were NEVER re-spawned -> stuck at have=0 permanently. That
                  // was the REAL "IGNORING" root cause -- not the unchoke timeout, not reciprocity: they simply had
                  // no worker. notdone (npc==0 OR have<npc) already excludes COMPLETE, so resume-all is correct.
                  var resumable: i64 = 1
                  if resumable == 1 {
                      var notdone: i64 = 1; if hn[1] > 0 { if hn[0] >= hn[1] { notdone = 0 } }
                      if notdone == 1 {
                          let statp: *u8 = d_path(dir, "/download.status" as *u8, sys_mmap(640))
                          var stale: i64 = 1
                          if sys_fstatat(statp, stbuf) == 0 { let mtp: *i64 = (((stbuf as i64) + 88)) as *i64; if now - mtp[0] < 60 { stale = 0 } }
                          if stale == 1 {
                              let mp: *u8 = d_path(dir, "/download.magnet" as *u8, sys_mmap(640)); let mb: *u8 = sys_mmap(TORRENT_MAGIC_4096); let mln: i64 = d_read_file(mp, mb, TORRENT_MAGIC_4095)
                              if mln > 0 { mb[mln] = 0 as u8; d_spawn_worker(mb, dir, 1); resumed = resumed + 1 }
                          }
                      }
                  }
              }
          } }
          i = e + 1
      }
  }
  return resumed
954}
955
956// ---- AREA routing + access enforcement (R2: two areas; R3 wires the real session->level) ----
957// scan buf[0..n) for the NUL-terminated literal pat; return 1 if present.
958func d_buf_find(buf: *u8, n: i64, pat: *u8) -> i64 {
  let pln: i64 = d_strlen(pat)
  if pln <= 0 { return 0 }
  var i: i64 = 0
  while i + pln <= n {
      var j: i64 = 0; var m: i64 = 1
      while j < pln { if buf[i+j] != pat[j] { m = 0; j = pln } else { j = j + 1 } }
      if m == 1 { return 1 }
      i = i + 1
  }
  return 0
969}
970// which destination AREA does this request select? "area=gallery"/"area=nsfw" -> NSFW; default SFW ("media").
971// Default is the LOWER-privilege area so an unspecified/garbled flag can NEVER silently land in NSFW.
972func d_parse_area(req: *u8, n: i64) -> i64 {
  if d_buf_find(req, n, "area=gallery" as *u8) == 1 { return NX_TAREA_NSFW }
  if d_buf_find(req, n, "area=nsfw" as *u8) == 1 { return NX_TAREA_NSFW }
  return NX_TAREA_SFW
976}
977// is this file present? (the local-operator marker check)
978func d_marker_present(path: *u8) -> i64 { let fd: i64 = sys_openat_rd(path); if fd < 0 { return 0 } sys_close(fd); return 1 }
979// parse a non-negative int from the TRUSTED internal header "X-Nishi-Level:" (set by the front gateway). -1 if absent.
980func d_trusted_level(req: *u8, n: i64) -> i64 {
  let pat: *u8 = "X-Nishi-Level:" as *u8; let pl: i64 = 14
  var i: i64 = 0; var pos: i64 = 0 - 1
  while i + pl <= n { var j: i64 = 0; var m: i64 = 1; while j < pl { if req[i+j] != pat[j] { m = 0; j = pl } else { j = j + 1 } } if m == 1 { pos = i + pl; i = n } else { i = i + 1 } }
  if pos < 0 { return 0 - 1 }
  if pos < n { if req[pos]==(32 as u8) { pos = pos + 1 } }
  var v: i64 = 0; var got: i64 = 0
  while pos < n { let c: i64 = req[pos] as i64; if c >= 48 { if c <= 57 { v = v*10 + (c-48); got = 1; pos = pos + 1 } else { pos = n } } else { pos = n } }
  if got == 0 { return 0 - 1 }
  return v
990}
991// the requester's GRANTED level (R3 -- DENY-BY-DEFAULT).
992//   LOCAL mode (marker present = the operator's own box): OWNER -- today's single-operator behavior.
993//   HUB mode  (no marker): the front gateway already authenticated (OPAQUE) + resolved the level via
994//   nx_torrent_authn and injected the trusted internal header X-Nishi-Level. Read it; absent/garbled -> 0
995//   (ANON), so nx_taccess_allow denies every gated area. The daemon MUST bind localhost behind the gateway in
996//   hub mode so an outside client can't spoof the header (Cardinal 12: trust internal, validate at the boundary).
997func d_viewer_level(req: *u8, n: i64) -> i64 {
  if d_marker_present(TORRENT_LOCAL_MARKER) == 1 { return NX_TACCESS_OWNER }
  let lv: i64 = d_trusted_level(req, n)
  if lv < 0 { return 0 }
  return lv
1002}
1003// resolve the dir for torrent `id` in a root the viewer MAY access. SFW always; NSFW only for OWNER.
1004// returns 1 + fills out_dir + out_area[0]=area, else 0 (fail-closed: a family viewer cannot even ADDRESS
1005// an NSFW torrent, so /stream and the control verbs can't reach it by id-guessing).
1006func d_resolve_dir(id: *u8, level: i64, sfw_root: *u8, sfw_idx: *u8, nsfw_root: *u8, nsfw_idx: *u8, out_dir: *u8, out_area: *i64) -> i64 {
  let ib: *u8 = sys_mmap(TORRENT_MAGIC_65536); let n1: i64 = d_read_file(sfw_idx, ib, TORRENT_MAGIC_65536)
  if n1 > 0 { if d_idx_has(ib, n1, id) == 1 { d_subdir(sfw_root, id, out_dir); out_area[0] = NX_TAREA_SFW; return 1 } }
  if level >= NX_TACCESS_OWNER {
      let ib2: *u8 = sys_mmap(TORRENT_MAGIC_65536); let n2: i64 = d_read_file(nsfw_idx, ib2, TORRENT_MAGIC_65536)
      if n2 > 0 { if d_idx_has(ib2, n2, id) == 1 { d_subdir(nsfw_root, id, out_dir); out_area[0] = NX_TAREA_NSFW; return 1 } }
  }
  return 0
1014}
1015// append all torrents in ONE root's registry to out (sharing offset + first-flag across roots); return new o.
1016func d_status_root(out: *u8, o0: i64, first_p: *i64, root: *u8, idxpath: *u8) -> i64 {
  var o: i64 = o0
  let idx: *u8 = sys_mmap(TORRENT_MAGIC_65536); let n: i64 = d_read_file(idxpath, idx, TORRENT_MAGIC_65536)
  if n > 0 {
      var i: i64 = 0; var guard: i64 = 0
      while i < n {
          if guard > TORRENT_MAGIC_2000 { i = n } else {
              guard = guard + 1
              let e: i64 = d_scan_to(idx, n, i, 10)
              let len: i64 = e - i
              if len > 0 {
                  let id: *u8 = sys_mmap(128); var k: i64 = 0; while k < len { if k < 127 { id[k] = idx[i+k]; k = k + 1 } else { k = len } } id[len] = 0 as u8
                  if d_idx_has(idx, i, id) == 0 {
                      let dir: *u8 = d_subdir(root, id, sys_mmap(640))
                      if first_p[0] == 0 { o = d_puts(out, o, "," as *u8) } first_p[0] = 0
                      o = d_status_one(out, o, id, dir)
                  }
              }
              i = e + 1
          }
      }
  }
  return o
1039}
1040// GET /status: aggregate the torrents the viewer MAY see -- SFW always, NSFW only for OWNER. Isolation by
1041// construction: a family viewer never even scans the NSFW root, so an NSFW torrent cannot appear in their list.
1042func d_status_two(cfd: i64, level: i64, sfw_root: *u8, sfw_idx: *u8, nsfw_root: *u8, nsfw_idx: *u8) -> i64 {
  let out: *u8 = sys_mmap(TORRENT_MAGIC_262144); var o: i64 = 0
  o = d_puts(out, o, "{\"downloads\":[" as *u8)
  let fp: *i64 = sys_mmap(16) as *i64; fp[0] = 1
  o = d_status_root(out, o, fp, sfw_root, sfw_idx)
  if level >= NX_TACCESS_OWNER { o = d_status_root(out, o, fp, nsfw_root, nsfw_idx) }
  o = d_puts(out, o, "]}" as *u8)
  d_send(cfd, "200 OK" as *u8, "application/json" as *u8, out, o)
  return 0
1051}
1052
1053// ---- router ------------------------------------------------------
1054func d_route(cfd: i64, req: *u8, method: i64, po: i64, pl: i64, cl_: i64, bo: i64, rn: i64,
           sfw_root: *u8, sfw_idx: *u8, nsfw_root: *u8, nsfw_idx: *u8, indexp: *u8, appjsp: *u8, discpath: *u8) -> i64 {
  let level: i64 = d_viewer_level(req, rn)
  if method == 1 {
      if d_streq(req,po,pl,"/torrent" as *u8)==1 { d_serve_file(cfd, indexp, "text/html; charset=utf-8" as *u8); return 0 }
      if d_streq(req,po,pl,"/torrent/" as *u8)==1 { d_serve_file(cfd, indexp, "text/html; charset=utf-8" as *u8); return 0 }
      if d_streq(req,po,pl,"/" as *u8)==1 { d_serve_file(cfd, indexp, "text/html; charset=utf-8" as *u8); return 0 }
      if d_streq(req,po,pl,"/torrent/app.js" as *u8)==1 { d_serve_file(cfd, appjsp, "application/javascript" as *u8); return 0 }
      if d_streq(req,po,pl,"/torrent/api/me" as *u8)==1 { d_send_str(cfd, "200 OK" as *u8, "application/json" as *u8, "{\"user\":\"local\"}" as *u8); return 0 }
      if d_streq(req,po,pl,"/torrent/api/status" as *u8)==1 { d_status_two(cfd, level, sfw_root, sfw_idx, nsfw_root, nsfw_idx); return 0 }
      // STREAM the video file's downloaded prefix (HTTP Range) so a <video> can play while/after download.
      if d_starts(req,po,pl,"/torrent/stream/" as *u8)==1 {
          var idlen: i64 = pl - 16    // strip "/torrent/stream/" (16)
          if idlen > 511 { idlen = 511 }
          if idlen > 0 {
              let id: *u8 = sys_mmap(512); var k: i64 = 0; while k < idlen { id[k] = req[po+16+k]; k = k + 1 } id[idlen] = 0 as u8
              let dir: *u8 = sys_mmap(640); let sa: *i64 = sys_mmap(16) as *i64
              if d_resolve_dir(id, level, sfw_root, sfw_idx, nsfw_root, nsfw_idx, dir, sa) == 1 {
                  d_stream(cfd, req, rn, dir)
              } else { d_send_str(cfd, "404 Not Found" as *u8, "text/plain" as *u8, "not found\n" as *u8) }
          } else { d_send_str(cfd, "400 Bad Request" as *u8, "text/plain" as *u8, "no id\n" as *u8) }
          return 0
      }
      if d_streq(req,po,pl,"/torrent/api/discover_result" as *u8)==1 { d_discover_result(cfd, discpath); return 0 }
      d_send_str(cfd, "404 Not Found" as *u8, "text/plain" as *u8, "not found\n" as *u8); return 0
  }
  if method == 2 {
      if d_streq(req,po,pl,"/torrent/api/login" as *u8)==1 { d_send_str(cfd, "200 OK" as *u8, "application/json" as *u8, "{\"ok\":true}" as *u8); return 0 }
      if d_streq(req,po,pl,"/torrent/api/add" as *u8)==1 {
          // The POST body can trail the headers in a later TCP segment, and some clients
          // omit a parseable Content-Length. So: drain the socket (idle-bounded) into the
          // same buffer, then search the WHOLE request -- the "magnet:" run never occurs
          // in HTTP headers, so a full-buffer scan is unambiguous and Content-Length-free.
          sys_set_socket_timeout(cfd, 2)
          var tot: i64 = rn
          var go: i64 = 1
          while go == 1 {
              if tot >= TORRENT_MAGIC_16384 { go = 0 } else {
                  let r: i64 = sys_read(cfd, req + tot, TORRENT_MAGIC_16384 - tot)
                  if r <= 0 { go = 0 } else { tot = tot + r }
              }
          }
          let mag: *u8 = sys_mmap(TORRENT_MAGIC_4096)
          var mn: i64 = d_form_magnet(((req as i64) + bo) as *u8, tot - bo, mag, TORRENT_MAGIC_4096)   // browser UI: urlencoded magnet=<%XX> -> decode
          if mn <= 0 { mn = d_extract_magnet(req, tot, mag, TORRENT_MAGIC_4096) }                       // JSON/raw fallback (the gate path)
          if mn <= 0 { d_send_str(cfd, "400 Bad Request" as *u8, "application/json" as *u8, "{\"error\":\"no magnet\"}" as *u8); return 0 }
          // AREA + ACCESS (R2): which destination did the request flag, and may THIS viewer reach it?
          // Deny-by-default via nx_taccess_allow (SFW="media" needs FAMILY level; NSFW="gallery" needs OWNER).
          let area: i64 = d_parse_area(req, tot)
          if nx_taccess_allow(level, area) != NX_TACCESS_ALLOW {
              d_send_str(cfd, "403 Forbidden" as *u8, "application/json" as *u8, "{\"error\":\"access denied for this area\"}" as *u8); return 0
          }
          var aroot: *u8 = sfw_root; var aidx: *u8 = sfw_idx
          if area == NX_TAREA_NSFW { aroot = nsfw_root; aidx = nsfw_idx }
          // MULTI-TORRENT: id = the magnet's btih; each torrent gets its OWN <area-root>/<id> + a registry
          // entry, so concurrent downloads never clobber each other (the BBB-clobber bug).
          let hbv: *u8 = sys_mmap(128); let hbn: i64 = d_extract_btih(mag, mn, hbv, 128); if hbn <= 0 { d_send_str(cfd, "400 Bad Request" as *u8, "application/json" as *u8, "{\"error\":\"bad magnet (no btih)\"}" as *u8); return 0 }
          // DEDUP BY INFO-HASH (within the area): if this exact content is already here (any display name),
          // RESUME that one download instead of spawning a duplicate subdir (the 326FCT-218-added-twice bug).
          let exid: *u8 = sys_mmap(512)
          if d_find_by_btih(aroot, aidx, hbv, hbn, exid, 512) == 1 {
              let edir: *u8 = d_subdir(aroot, exid, sys_mmap(640))
              d_write_file(d_path(edir, "/download.control" as *u8, sys_mmap(640)), "active" as *u8, 6)
              d_spawn_worker(mag, edir, 1)
              let rb0: *u8 = sys_mmap(256); var r0: i64 = d_puts(rb0, 0, "{\"id\":\"" as *u8); r0 = d_puts(rb0, r0, exid); r0 = d_puts(rb0, r0, "\",\"dedup\":true}" as *u8); rb0[r0] = 0 as u8
              d_send_str(cfd, "200 OK" as *u8, "application/json" as *u8, rb0); return 0
          }
          // folder/id = the TITLE (dn=), sanitized -- so Downloads shows "javdb.com_326FCT-218/" not a raw
          // hash. Falls back to the info-hash only when the magnet carries no dn=.
          let id: *u8 = sys_mmap(512); var idl: i64 = d_extract_name(mag, mn, id, 512)
          if idl <= 0 { idl = d_extract_btih(mag, mn, id, 512) }
          let dir: *u8 = d_subdir(aroot, id, sys_mmap(640))
          sys_mkdir(dir, 0x1ff)
          d_write_file(d_path(dir, "/download.magnet" as *u8, sys_mmap(640)), mag, mn)
          d_write_file(d_path(dir, "/download.control" as *u8, sys_mmap(640)), "active" as *u8, 6)
          d_idx_add(aidx, id)
          d_spawn_worker(mag, dir, d_has_progress(dir))   // RESUME if a partial download already exists (idempotent re-add)
          let rb: *u8 = sys_mmap(256); var ro: i64 = d_puts(rb, 0, "{\"id\":\"" as *u8); ro = d_puts(rb, ro, id); ro = d_puts(rb, ro, "\"}" as *u8); rb[ro] = 0 as u8
          d_send_str(cfd, "200 OK" as *u8, "application/json" as *u8, rb); return 0
      }
      if d_streq(req,po,pl,"/torrent/api/discover" as *u8)==1 {
          sys_set_socket_timeout(cfd, 2)
          var tot: i64 = rn
          var go: i64 = 1
          while go == 1 {
              if tot >= TORRENT_MAGIC_16384 { go = 0 } else {
                  let r: i64 = sys_read(cfd, req + tot, TORRENT_MAGIC_16384 - tot)
                  if r <= 0 { go = 0 } else { tot = tot + r }
              }
          }
          let urlb: *u8 = sys_mmap(TORRENT_MAGIC_4096)
          let un: i64 = d_extract_url(req + bo, tot - bo, urlb, TORRENT_MAGIC_4096)
          if un <= 0 { d_send_str(cfd, "400 Bad Request" as *u8, "application/json" as *u8, "{\"error\":\"no url\"}" as *u8); return 0 }
          d_spawn_discover(urlb, discpath)
          d_send_str(cfd, "200 OK" as *u8, "application/json" as *u8, "{\"ok\":true}" as *u8); return 0
      }
      if d_streq(req,po,pl,"/torrent/api/video" as *u8)==1 {
          sys_set_socket_timeout(cfd, 2)
          var tot: i64 = rn; var go: i64 = 1
          while go == 1 { if tot >= TORRENT_MAGIC_16384 { go = 0 } else { let r: i64 = sys_read(cfd, req + tot, TORRENT_MAGIC_16384 - tot); if r <= 0 { go = 0 } else { tot = tot + r } } }
          let urlb: *u8 = sys_mmap(TORRENT_MAGIC_4096); let un: i64 = d_extract_url(req + bo, tot - bo, urlb, TORRENT_MAGIC_4096)
          if un <= 0 { d_send_str(cfd, "400 Bad Request" as *u8, "application/json" as *u8, "{\"error\":\"no url\"}" as *u8); return 0 }
          let varea: i64 = d_parse_area(req, tot)
          if nx_taccess_allow(level, varea) != NX_TACCESS_ALLOW { d_send_str(cfd, "403 Forbidden" as *u8, "application/json" as *u8, "{\"error\":\"access denied for this area\"}" as *u8); return 0 }
          var vroot: *u8 = sfw_root; if varea == NX_TAREA_NSFW { vroot = nsfw_root }
          let vdir: *u8 = d_path(vroot, "/videos" as *u8, sys_mmap(640)); sys_mkdir(vdir, 0x1ff)
          let vref: *u8 = d_url_referer(urlb, sys_mmap(TORRENT_MAGIC_4200))                   // same-origin Referer so CDNs that gate direct links serve the bytes (empty = #1 cause of 403)
          if d_is_hls(urlb) == 1 {                                              // HLS .m3u8 -> fetch+stitch (+AES decrypt) all segments via nx_hls_get
              let houtp: *u8 = d_hls_outname(urlb, vdir, sys_mmap(TORRENT_MAGIC_1024))
              d_spawn_hls(urlb, houtp, vref)
          } else {
              let outp: *u8 = d_vidname(urlb, vdir, sys_mmap(TORRENT_MAGIC_1024))
              d_spawn_video(urlb, outp, vref)
          }
          d_send_str(cfd, "200 OK" as *u8, "application/json" as *u8, "{\"ok\":true}" as *u8); return 0
      }
      // MULTI-TORRENT control: /torrent/api/<id>/{pause,resume,remove}, id = the torrent's btih.
      if d_starts(req,po,pl,"/torrent/api/" as *u8)==1 {
          var act: i64 = 0; var sl: i64 = 0
          if d_ends(req,po,pl,"/pause" as *u8)==1  { act = 1; sl = 6 }
          if d_ends(req,po,pl,"/resume" as *u8)==1 { act = 2; sl = 7 }
          if d_ends(req,po,pl,"/remove" as *u8)==1 { act = 3; sl = 7 }
          if d_ends(req,po,pl,"/reannounce" as *u8)==1 { act = 4; sl = 11 }   // the UNSTICK lever
          if d_ends(req,po,pl,"/recheck" as *u8)==1 { act = 5; sl = 8 }
          if act > 0 {
              var idlen: i64 = pl - 13 - sl    // strip "/torrent/api/" (13) + the action suffix
              if idlen > 127 { idlen = 127 }   // defensive: id buffer is 128
              if idlen > 0 {
                  let id: *u8 = sys_mmap(128); var k: i64 = 0; while k < idlen { if k < 127 { id[k] = req[po+13+k]; k = k + 1 } else { k = idlen } } id[idlen] = 0 as u8
                  let dir: *u8 = sys_mmap(640); let ca: *i64 = sys_mmap(16) as *i64
                  if d_resolve_dir(id, level, sfw_root, sfw_idx, nsfw_root, nsfw_idx, dir, ca) == 1 {
                      if act == 1 { d_write_file(d_path(dir, "/download.control" as *u8, sys_mmap(640)), "paused" as *u8, 6) }
                      if act == 2 {
                          d_write_file(d_path(dir, "/download.control" as *u8, sys_mmap(640)), "active" as *u8, 6)
                          let mp: *u8 = d_path(dir, "/download.magnet" as *u8, sys_mmap(640)); let mb2: *u8 = sys_mmap(TORRENT_MAGIC_4096); let mln: i64 = d_read_file(mp, mb2, TORRENT_MAGIC_4095)
                          if mln > 0 { mb2[mln] = 0 as u8; d_spawn_worker(mb2, dir, 1) }
                      }
                      if act == 3 {
                          d_write_file(d_path(dir, "/download.control" as *u8, sys_mmap(640)), "removed" as *u8, 7)
                          if ca[0] == NX_TAREA_NSFW { d_idx_remove(nsfw_idx, id) } else { d_idx_remove(sfw_idx, id) }
                      }
                      if act == 4 {   // force-reannounce: respawn the worker -> re-hits trackers/DHT + re-discovers peers (the UNSTICK for IGNORING torrents)
                          d_write_file(d_path(dir, "/download.control" as *u8, sys_mmap(640)), "active" as *u8, 6)
                          let mp4: *u8 = d_path(dir, "/download.magnet" as *u8, sys_mmap(640)); let mb4: *u8 = sys_mmap(TORRENT_MAGIC_4096); let ml4: i64 = d_read_file(mp4, mb4, TORRENT_MAGIC_4095)
                          if ml4 > 0 { mb4[ml4] = 0 as u8; d_spawn_worker(mb4, dir, 1) }
                      }
                      if act == 5 {   // force-recheck: signal the worker to re-verify on-disk pieces
                          d_write_file(d_path(dir, "/download.control" as *u8, sys_mmap(640)), "recheck" as *u8, 7)
                      }
                  }
              }
          }
          d_send_str(cfd, "200 OK" as *u8, "application/json" as *u8, "{\"ok\":true}" as *u8); return 0
      }
      d_send_str(cfd, "404 Not Found" as *u8, "text/plain" as *u8, "not found\n" as *u8); return 0
  }
  d_send_str(cfd, "405 Method Not Allowed" as *u8, "text/plain" as *u8, "method\n" as *u8)
  return 0
1212}
1213
1214func main(argc: i64, argv: *i64) -> i64 {
  // TWO download AREAS (operator 2026-06-20): a lower-privilege "media" area (family+) and an owner-only area.
  // Each area = its OWN root + registry, so a member's /status never even scans the owner root (isolation by
  // construction). DATA-DRIVEN ROOTS (CLAUDE.md #17): argv overrides the workstation defaults so the SAME binary
  // runs NAS-native -- argv[1]=media/SFW root (e.g. /volume1/movies), argv[2]=owner/NSFW root (e.g. /volume1/logging),
  // argv[3]=the UI shell file. idx/discover are derived from the roots. The worker stays /tmp (deployed at launch).
  var sfw_root: *u8  = "/mnt/c/Users/elder/Downloads/nishi-media" as *u8
  var nsfw_root: *u8 = "/mnt/c/Users/elder/Downloads/nishi-torrents" as *u8
  var indexp: *u8    = "/mnt/c/Users/elder/nishi-core/nxc2/sites/nishifamily/torrent/index.html" as *u8
  if argc > 1 { sfw_root = argv[1] as *u8 }
  if argc > 2 { nsfw_root = argv[2] as *u8 }
  if argc > 3 { indexp = argv[3] as *u8 }
  let sfw_idx: *u8  = d_path(sfw_root, "/torrents.idx" as *u8, sys_mmap(700))
  let nsfw_idx: *u8 = d_path(nsfw_root, "/torrents.idx" as *u8, sys_mmap(700))
  let discpath: *u8 = d_path(nsfw_root, "/discover.tsv" as *u8, sys_mmap(700))
  let appjsp: *u8   = indexp   // the emitted shell is self-contained; /torrent/app.js serves it too (harmless)
  sys_mkdir(sfw_root, 0x1ff); sys_mkdir(nsfw_root, 0x1ff)   // ensure both areas exist
1231
  let addr: *u8 = sys_mmap(16)
  nx_http_server_addr_any(addr, TORRENT_MAGIC_8097)   // 0.0.0.0:TORRENT_MAGIC_8097 base; tightened to loopback below unless bind_mode="any"
  // SECURITY (s-class): behind the OPAQUE gateway the daemon TRUSTS the injected X-Nishi-Level header, so a
  // LAN-direct client reaching 0.0.0.0:8097 could FORGE that header and bypass auth. Default + the NAS "hub"
  // profile therefore bind LOOPBACK (only the loopback gateway on :18793 reaches :8097). Only an explicit
  // bind_mode="any" (argv[4]) keeps 0.0.0.0 -- the dev laptop needs it for WSL2 localhost-forwarding.
  var bind_any: i64 = 0
  if argc > 4 { if d_streq(argv[4] as *u8, 0, 3, "any" as *u8) == 1 { bind_any = 1 } }
  if bind_any == 0 {
      addr[4] = 127 as u8; addr[5] = 0 as u8; addr[6] = 0 as u8; addr[7] = 1 as u8
      sys_write(1, "TORRENTD bind=LOOPBACK 127.0.0.1:8097 (gateway-only)\n" as *u8, 53)
  } else {
      sys_write(1, "TORRENTD bind=ANY 0.0.0.0:8097 (dev/WSL2)\n" as *u8, 42)
  }
  let vp: *i64 = sys_mmap(16) as *i64
  let lfd: i64 = nx_http_server_listen(addr, 16, vp)
  if lfd < 0 {
      sys_write(1, "TORRENTD bind FAILED (port 8097 in use?)\n" as *u8, 41); sys_exit(1); return 1
  }
  // FD_CLOEXEC on the listen socket: the download WORKERS are fork+execve'd from request-handling
  // children and would otherwise INHERIT this :8097 fd, holding the port alive after the daemon dies
  // and blocking every restart (the bug that wedged the redeploy). CLOEXEC closes it across execve.
  __syscall(72, lfd, 2, 1, 0, 0, 0)   // fcntl(lfd, F_SETFD=2, FD_CLOEXEC=1) -> x86_64 nr 72
  sys_write(1, "TORRENTD listening http://127.0.0.1:8097/torrent\n" as *u8, 48)
  let rsm: i64 = d_autoresume(nsfw_root, nsfw_idx) + d_autoresume(sfw_root, sfw_idx)   // crash/reboot recovery: resume active downloads in BOTH areas whose worker died
  let rb1: *u8 = sys_mmap(64); var ro1: i64 = d_puts(rb1, 0, "TORRENTD autoresume resumed=" as *u8); ro1 = d_putn(rb1, ro1, rsm); rb1[ro1] = 10 as u8; sys_write(1, rb1, ro1 + 1)
1258
  // ---- PERSISTENT RETRY SWEEP (rung #2: the poorly-seeded "stuck at 99%" fix) ----------------------
  // A detached child re-runs the resume sweep every D_RETRY_INTERVAL_MS so a torrent whose worker gave
  // up (~20min of no new pieces) keeps getting re-spawned -> re-announces (re-triggering the wide
  // tracker scan, rung #1) -> it finishes whenever a seed with the missing tail piece appears. The sweep
  // REUSES d_autoresume, which already skips COMPLETE + paused + live-worker torrents, so only genuinely
  // stuck ones are re-spawned. SINGLE-INSTANCE via a generation file (.sweeper.gen): on a daemon restart
  // the new sweeper claims a fresh gen, so the old (reparented-to-init) one retires on its next wake ->
  // no sweeper pile-up, no tracker-ban spam. fds 3..255 closed so it never holds the :8097 listen socket.
  let genp: *u8 = d_path(nsfw_root, "/.sweeper.gen" as *u8, sys_mmap(700))
  let swp1: i64 = sys_fork()
  if swp1 == 0 {
      let swp2: i64 = sys_fork()
      if swp2 == 0 {
          var sfdx: i64 = 3; while sfdx < 256 { sys_close(sfdx); sfdx = sfdx + 1 }
          let gts: *i64 = sys_mmap(16) as *i64; sys_clock_gettime_real(gts); let mygen: i64 = gts[0]*TORRENT_MAGIC_1000000000 + gts[1]
          let gbuf: *u8 = sys_mmap(32); let gl: i64 = d_putn(gbuf, 0, mygen); d_write_file(genp, gbuf, gl)
          var run: i64 = 1
          while run == 1 {
              sys_sleep_ms(D_RETRY_INTERVAL_MS)
              let rbuf: *u8 = sys_mmap(32); let rgn: i64 = d_read_file(genp, rbuf, 31)
              var cur: i64 = 0; if rgn > 0 { cur = d_int_at(rbuf, rgn, 0) }
              if cur != mygen { run = 0 } else {
                  let got: i64 = d_autoresume(nsfw_root, nsfw_idx) + d_autoresume(sfw_root, sfw_idx)
                  let lb: *u8 = sys_mmap(64); var lo: i64 = d_puts(lb, 0, "TORRENTD retry-sweep re-spawned=" as *u8); lo = d_putn(lb, lo, got); lb[lo] = 10 as u8; sys_write(1, lb, lo + 1)
              }
          }
          sys_exit(0)
      }
      sys_exit(0)
  }
  let swst: *i64 = sys_mmap(16) as *i64; sys_wait4(swp1, swst, 0)
1290
  let req: *u8 = sys_mmap(TORRENT_MAGIC_16384)
  let m: *i64  = sys_mmap(16) as *i64; let po: *i64 = sys_mmap(16) as *i64; let pl: *i64 = sys_mmap(16) as *i64
  let cl_: *i64= sys_mmap(16) as *i64; let bo: *i64 = sys_mmap(16) as *i64; let rn: *i64 = sys_mmap(16) as *i64
1294
  // fork-per-connection: a browser opens several sockets (page, app.js, /me, then
  // /status every second). A single blocking accept-loop would stall if any one client
  // is slow/half-open. Each connection is handled in a disposable child; the parent
  // just accepts + reaps. Children are bounded by a socket read timeout (no-hang law).
  let st: *i64 = sys_mmap(16) as *i64
  var serving: i64 = 1
  while serving == 1 {
      let cfd: i64 = nx_http_server_accept_one(lfd, vp)
      if cfd >= 0 {
          let pid: i64 = sys_fork()
          if pid == 0 {
              sys_set_socket_timeout(cfd, 10)
              let rc: i64 = nx_http_server_read_request(cfd, req, TORRENT_MAGIC_16384, m, po, pl, cl_, bo, rn)
              if rc == 0 {
                  d_route(cfd, req, m[0], po[0], pl[0], cl_[0], bo[0], rn[0], sfw_root, sfw_idx, nsfw_root, nsfw_idx, indexp, appjsp, discpath)
              } else {
                  d_send_str(cfd, "400 Bad Request" as *u8, "text/plain" as *u8, "bad request\n" as *u8)
              }
              sys_exit(0)
          }
          sys_close(cfd)
          var reap: i64 = 1
          while reap == 1 { let w: i64 = sys_wait4(0 - 1, st, WNOHANG); if w <= 0 { reap = 0 } }
      }
  }
  return 0
1321}
nx_torrent_daemon.nx source

`nx_torrent_daemon.nx` source
