@clastres/groundcontrol 0.1.1 → 0.1.3

package/daemon.mjs

@@ -16,6 +16,7 @@ import path from 'node:path';
 import { spawn, execFile, execSync } from 'node:child_process';
 import { promisify } from 'node:util';
 import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
 
 const execFileP = promisify(execFile);
 
@@ -32,12 +33,15 @@ if (process.argv.includes('--help') || process.argv.includes('-h')) {
   the app and you are connected. No account needed.
 
   Commands:
-    (none)              Run the daemon in this terminal
-    service install     Keep the daemon running in the background, always.
-                        Starts at login and restarts if it ever stops.
-    service uninstall   Remove the background service
-    service status      Check whether the background service is running
+    (none)              Pair and set up the always on daemon (macOS): prints
+                        the QR, then keeps running in the background after
+                        you close the terminal. Starts at login, restarts
+                        by itself. Run it again anytime to update.
+    run                 Run the daemon in this terminal instead
     qr                  Print the pairing QR code and exit
+    service status      Check the background daemon
+    service install     Set up the background daemon without pairing output
+    service uninstall   Remove the background daemon
 
   Options:
     --relay <url>   Use a custom relay (default: wss://relay.groundcontrol.chat)
@@ -50,39 +54,59 @@ if (process.argv.includes('--help') || process.argv.includes('-h')) {
   process.exit(0);
 }
 if (process.argv.includes('--version')) {
-  console.log('0.1.1');
+  console.log('0.1.3');
   process.exit(0);
 }
 
 // ---------- background service (launchd) ----------
-// `groundcontrol service install` keeps the daemon alive with no terminal:
-// starts at login, restarts on crash, survives everything short of logout.
+// The daemon installs itself as a launchd LaunchAgent so it needs no open
+// terminal: starts at login, restarts on crash. The service runs from a
+// self contained copy under ~/.groundcontrol/service because the npx cache
+// this file usually executes from is disposable.
 
 const subcommand = process.argv[2];
-if (subcommand === 'service') {
-  const action = process.argv[3];
-  const LABEL = 'chat.groundcontrol.daemon';
-  const confDir = path.join(os.homedir(), '.groundcontrol');
-  const logFile = path.join(confDir, 'daemon.log');
-  const plistPath = path.join(os.homedir(), 'Library', 'LaunchAgents', `${LABEL}.plist`);
-  if (process.platform !== 'darwin') {
-    console.log('\n  The background service is macOS only for now. Keep the daemon');
-    console.log('  running in a terminal, tmux, or your own process manager.\n');
-    process.exit(1);
+const LABEL = 'chat.groundcontrol.daemon';
+const SERVICE_DIR = path.join(os.homedir(), '.groundcontrol', 'service');
+const PLIST_PATH = path.join(os.homedir(), 'Library', 'LaunchAgents', `${LABEL}.plist`);
+const LOG_FILE = path.join(os.homedir(), '.groundcontrol', 'daemon.log');
+const THIS_FILE = fs.realpathSync(fileURLToPath(import.meta.url));
+const runsFromServiceDir = THIS_FILE.startsWith(SERVICE_DIR + path.sep);
+
+const launchctl = (args) => {
+  try { return execSync(`launchctl ${args}`, { stdio: 'pipe' }).toString(); }
+  catch (e) { return (e.stdout?.toString() || '') + (e.stderr?.toString() || ''); }
+};
+
+/// Find the root directory of an installed dependency, wherever npm put it.
+function packageDirOf(dep) {
+  let dir = path.dirname(createRequire(THIS_FILE).resolve(dep));
+  while (!(path.basename(dir) === dep && path.basename(path.dirname(dir)) === 'node_modules')) {
+    const parent = path.dirname(dir);
+    if (parent === dir) throw new Error(`cannot locate package directory for ${dep}`);
+    dir = parent;
   }
+  return dir;
+}
+
+/// Stage a self contained copy of the daemon and register it with launchd.
+/// Returns true when launchd reports the job running.
+function installService() {
   const uid = process.getuid();
-  const launchctl = (args) => {
-    try { return execSync(`launchctl ${args}`, { stdio: 'pipe' }).toString(); }
-    catch (e) { return (e.stdout?.toString() || '') + (e.stderr?.toString() || ''); }
-  };
+  launchctl(`bootout gui/${uid}/${LABEL}`);
+  fs.rmSync(SERVICE_DIR, { recursive: true, force: true });
+  fs.mkdirSync(path.join(SERVICE_DIR, 'node_modules'), { recursive: true });
+  fs.copyFileSync(THIS_FILE, path.join(SERVICE_DIR, 'daemon.mjs'));
+  fs.writeFileSync(
+    path.join(SERVICE_DIR, 'package.json'),
+    JSON.stringify({ name: 'groundcontrol-service', private: true, type: 'module' }, null, 2),
+  );
+  for (const dep of ['ws', 'qrcode-terminal']) {
+    fs.cpSync(packageDirOf(dep), path.join(SERVICE_DIR, 'node_modules', dep), { recursive: true });
+  }
 
-  if (action === 'install') {
-    fs.mkdirSync(confDir, { recursive: true });
-    fs.mkdirSync(path.dirname(plistPath), { recursive: true });
-    const nodeBin = fs.realpathSync(process.execPath);
-    const daemonPath = fs.realpathSync(fileURLToPath(import.meta.url));
-    const esc = (s) => s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
-    const plist = `<?xml version="1.0" encoding="UTF-8"?>
+  const esc = (s) => s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+  const nodeBin = fs.realpathSync(process.execPath);
+  const plist = `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
@@ -91,10 +115,10 @@ if (subcommand === 'service') {
     <key>ProgramArguments</key>
     <array>
         <string>${esc(nodeBin)}</string>
-        <string>${esc(daemonPath)}</string>
+        <string>${esc(path.join(SERVICE_DIR, 'daemon.mjs'))}</string>
     </array>
     <key>WorkingDirectory</key>
-    <string>${esc(path.dirname(daemonPath))}</string>
+    <string>${esc(SERVICE_DIR)}</string>
     <key>RunAtLoad</key>
     <true/>
     <key>KeepAlive</key>
@@ -102,53 +126,65 @@ if (subcommand === 'service') {
     <key>ThrottleInterval</key>
     <integer>5</integer>
     <key>StandardOutPath</key>
-    <string>${esc(logFile)}</string>
+    <string>${esc(LOG_FILE)}</string>
     <key>StandardErrorPath</key>
-    <string>${esc(path.join(confDir, 'daemon.err.log'))}</string>
+    <string>${esc(path.join(os.homedir(), '.groundcontrol', 'daemon.err.log'))}</string>
 </dict>
 </plist>
 `;
-    fs.writeFileSync(plistPath, plist);
-    launchctl(`bootout gui/${uid}/${LABEL}`);
-    launchctl(`bootstrap gui/${uid} ${plistPath}`);
-    // launchd reports the job async; give it a moment to reach running state.
-    let out = '';
-    for (let i = 0; i < 5 && !out.includes('state = running'); i++) {
-      execSync('sleep 1');
-      out = launchctl(`print gui/${uid}/${LABEL}`);
-    }
-    if (out.includes('state = running')) {
+  fs.mkdirSync(path.dirname(PLIST_PATH), { recursive: true });
+  fs.writeFileSync(PLIST_PATH, plist);
+  launchctl(`bootstrap gui/${uid} ${PLIST_PATH}`);
+  // launchd reports the job async; give it a moment to reach running state.
+  let out = '';
+  for (let i = 0; i < 5 && !out.includes('state = running'); i++) {
+    execSync('sleep 1');
+    out = launchctl(`print gui/${uid}/${LABEL}`);
+  }
+  return out.includes('state = running');
+}
+
+if (subcommand === 'service') {
+  const action = process.argv[3];
+  if (process.platform !== 'darwin') {
+    console.log('\n  The background service is macOS only for now. Keep the daemon');
+    console.log('  running in a terminal, tmux, or your own process manager.\n');
+    process.exit(1);
+  }
+
+  if (action === 'install') {
+    if (installService()) {
       console.log('\n  Ground Control daemon is now running in the background.');
       console.log('  It starts at login and restarts automatically if it stops.\n');
-      console.log(`  Log:       ${logFile}`);
+      console.log(`  Log:       ${LOG_FILE}`);
       console.log('  Pair:      groundcontrol qr');
       console.log('  Check:     groundcontrol service status');
       console.log('  Remove:    groundcontrol service uninstall\n');
-    } else {
-      console.log('\n  Install finished but the service is not reporting as running.');
-      console.log(`  Check ${logFile} and try: launchctl bootstrap gui/${uid} ${plistPath}\n`);
-      process.exit(1);
+      process.exit(0);
     }
-    process.exit(0);
+    console.log('\n  Install finished but the service is not reporting as running.');
+    console.log(`  Check ${LOG_FILE} and try: launchctl bootstrap gui/${process.getuid()} ${PLIST_PATH}\n`);
+    process.exit(1);
   }
 
   if (action === 'uninstall') {
-    launchctl(`bootout gui/${uid}/${LABEL}`);
-    try { fs.unlinkSync(plistPath); } catch {}
-    console.log('\n  Background service removed. Run the daemon manually with: groundcontrol\n');
+    launchctl(`bootout gui/${process.getuid()}/${LABEL}`);
+    try { fs.unlinkSync(PLIST_PATH); } catch {}
+    fs.rmSync(SERVICE_DIR, { recursive: true, force: true });
+    console.log('\n  Background service removed. Run the daemon manually with: groundcontrol run\n');
     process.exit(0);
   }
 
   if (action === 'status') {
-    const out = launchctl(`print gui/${uid}/${LABEL}`);
+    const out = launchctl(`print gui/${process.getuid()}/${LABEL}`);
     if (out.includes('state = running')) {
       console.log('\n  Running in the background.');
-    } else if (fs.existsSync(plistPath)) {
+    } else if (fs.existsSync(PLIST_PATH)) {
       console.log('\n  Installed but not running. Reinstall with: groundcontrol service install');
     } else {
       console.log('\n  Not installed. Set it up with: groundcontrol service install');
     }
-    console.log(`  Log: ${logFile}\n`);
+    console.log(`  Log: ${LOG_FILE}\n`);
     process.exit(0);
   }
 
@@ -197,8 +233,31 @@ console.log(`\n  Pairing code (paste into the app):\n\n  ${pairString}\n`);
 
 if (subcommand === 'qr') process.exit(0);
 
-console.log('  Tip: keep this running without a terminal:');
-console.log('       npx @clastres/groundcontrol service install\n');
+// Default run on a Mac: install the background service so the daemon outlives
+// this terminal, then hand off to it. `groundcontrol run` stays foreground,
+// and the launchd copy in SERVICE_DIR must run itself rather than reinstall.
+if (subcommand !== 'run' && !runsFromServiceDir && process.platform === 'darwin') {
+  console.log('  Setting up the background daemon...');
+  if (installService()) {
+    console.log('\n  Done. The daemon now runs in the background: it starts at');
+    console.log('  login and restarts by itself. You can close this window.\n');
+    console.log('  If macOS asks to allow "node" to control Terminal or iTerm2,');
+    console.log('  click Allow. That is how phone messages reach your sessions.\n');
+    console.log('  Scan the QR above with the Ground Control app to pair.');
+    console.log('  Show it again:   npx @clastres/groundcontrol qr');
+    console.log('  Check status:    npx @clastres/groundcontrol service status');
+    console.log('  Turn it off:     npx @clastres/groundcontrol service uninstall\n');
+    process.exit(0);
+  }
+  console.log('\n  Could not set up the background service, running here instead.');
+  console.log('  Keep this window open to stay connected.\n');
+} else if (subcommand === 'run' || process.platform !== 'darwin') {
+  console.log('  Keep this window open to stay connected.');
+  if (process.platform === 'darwin') {
+    console.log('  Prefer background? npx @clastres/groundcontrol service install');
+  }
+  console.log('');
+}
 
 // ---------- crypto: wire format = base64( nonce(12) | ciphertext | tag(16) ) ----------
 
@@ -220,6 +279,34 @@ function open(b64) {
   return JSON.parse(pt.toString('utf8'));
 }
 
+// ---------- environment hardening ----------
+// launchd starts the service with a bare PATH (/usr/bin:/bin), which hides
+// tmux, claude, and anything from Homebrew or a version manager. Merge in the
+// user's login shell PATH plus the usual install locations so the background
+// daemon sees the same world a terminal does.
+
+function widenPath() {
+  const extra = [];
+  try {
+    const shell = process.env.SHELL || '/bin/zsh';
+    extra.push(...execSync(`${shell} -lc 'echo $PATH'`, { timeout: 5000, stdio: ['ignore', 'pipe', 'ignore'] })
+      .toString().trim().split(':'));
+  } catch {}
+  extra.push(
+    '/opt/homebrew/bin', '/usr/local/bin',
+    path.join(os.homedir(), '.local', 'bin'),
+    path.join(os.homedir(), '.claude', 'local'),
+  );
+  const seen = new Set((process.env.PATH || '').split(':').filter(Boolean));
+  for (const p of extra) if (p) seen.add(p);
+  process.env.PATH = [...seen].join(':');
+}
+widenPath();
+
+let claudeBin = null;
+try { claudeBin = execSync('command -v claude', { stdio: ['ignore', 'pipe', 'ignore'] }).toString().trim() || null; } catch {}
+console.log(`[daemon] claude binary: ${claudeBin || 'NOT FOUND (phone prompts to idle sessions without a visible terminal will fail)'}`);
+
 // ---------- Claude Code session discovery ----------
 
 const CLAUDE = path.join(os.homedir(), '.claude');
@@ -262,11 +349,36 @@ function terminalApps() {
 const escapeAS = (s) => s.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 
+// macOS requires a one time Automation grant before this process may control
+// Terminal or iTerm2. A refusal surfaces as error -1743 on stderr; remember it
+// so prompt failures can tell the phone exactly what to fix.
+let automationDenied = false;
+
 async function osascript(script) {
   try {
     const { stdout } = await execFileP('osascript', ['-e', script]);
     return stdout.trim();
-  } catch { return null; }
+  } catch (e) {
+    if (`${e.stderr || ''}${e.message || ''}`.includes('1743')) automationDenied = true;
+    return null;
+  }
+}
+
+/// Poke each running terminal app once at startup so the Automation dialog
+/// appears while the user is still at the Mac (the grant is keyed to this
+/// node binary and covers every later injection).
+async function requestAutomationGrant() {
+  const apps = terminalApps();
+  for (const [name, present] of [['Terminal', apps.terminal], ['iTerm2', apps.iterm]]) {
+    if (!present) continue;
+    automationDenied = false;
+    const r = await osascript(`tell application "${name}" to count windows`);
+    if (r === null && automationDenied) {
+      console.log(`[daemon] macOS is blocking control of ${name}. Open System Settings,`);
+      console.log(`[daemon] Privacy and Security, Automation, and allow node to control ${name}.`);
+      console.log('[daemon] Phone messages cannot reach your terminal until you do.');
+    }
+  }
 }
 
 function findTabScript(app, dev, action) {
@@ -494,26 +606,50 @@ async function handleCommand(cmd) {
         sendSnapshot(true);
         return;
       }
+      if (automationDenied) {
+        console.log('[daemon] prompt blocked: macOS Automation permission missing');
+        return ws?.send(seal({
+          type: 'promptResult', sessionId: cmd.sessionId, ok: false,
+          error: 'Your Mac is blocking terminal control. Open System Settings, Privacy and Security, Automation, and allow node to control your terminal app. Then send again.',
+        }));
+      }
+    }
+    if (session.status === 'busy') return ws?.send(seal({ type: 'promptResult', sessionId: cmd.sessionId, ok: false, error: 'session is busy, wait for it to go idle' }));
+    if (!claudeBin) {
+      console.log('[daemon] prompt failed: claude binary not found on PATH');
+      return ws?.send(seal({
+        type: 'promptResult', sessionId: cmd.sessionId, ok: false,
+        error: 'The daemon could not find the claude command on this Mac. Open a terminal, check that claude runs, then reinstall with: npx @clastres/groundcontrol',
+      }));
     }
-    if (session.status === 'busy') return ws?.send(seal({ type: 'promptResult', sessionId: cmd.sessionId, ok: false, error: 'session is busy — wait for it to go idle' }));
     console.log(`[daemon] prompt -> ${session.name}: ${cmd.text.slice(0, 60)}`);
     headlessActive.add(cmd.sessionId);
     sendSnapshot(true);
-    const child = spawn('claude', ['--resume', cmd.sessionId, '-p', cmd.text], {
+    const child = spawn(claudeBin, ['--resume', cmd.sessionId, '-p', cmd.text], {
       cwd: session.cwd || os.homedir(),
       env: process.env,
       stdio: ['ignore', 'pipe', 'pipe'],
     });
     let out = '', err = '';
+    let responded = false;
+    const respond = (payload) => {
+      if (responded) return;
+      responded = true;
+      headlessActive.delete(cmd.sessionId);
+      ws?.send(seal(payload));
+      sendSnapshot(true);
+    };
     child.stdout.on('data', (d) => { out += d; });
     child.stderr.on('data', (d) => { err += d; });
+    child.on('error', (e) => {
+      console.log(`[daemon] claude spawn failed: ${e.message}`);
+      respond({ type: 'promptResult', sessionId: cmd.sessionId, ok: false, error: `could not run claude: ${e.message}` });
+    });
     child.on('close', (code) => {
-      headlessActive.delete(cmd.sessionId);
-      ws?.send(seal({
+      respond({
         type: 'promptResult', sessionId: cmd.sessionId, ok: code === 0,
         text: (out || err).trim().slice(0, 4000),
-      }));
-      sendSnapshot(true);
+      });
     });
   }
 }
@@ -542,6 +678,7 @@ function connect() {
 }
 
 connect();
+if (process.platform === 'darwin') requestAutomationGrant();
 setInterval(sendSnapshot, 1500);
 // Heartbeat traffic keeps the Cloudflare socket alive in both directions and
 // lets the phone detect a dead link; missing pongs force a reconnect here.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clastres/groundcontrol",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "See and command your Claude Code sessions from your iPhone. Pairs the Ground Control app with the agents running on this Mac, end to end encrypted.",
   "bin": {
     "groundcontrol": "./bin/groundcontrol.mjs"