@clastres/groundcontrol 0.1.2 → 0.1.3

package/daemon.mjs

@@ -54,7 +54,7 @@ if (process.argv.includes('--help') || process.argv.includes('-h')) {
   process.exit(0);
 }
 if (process.argv.includes('--version')) {
-  console.log('0.1.2');
+  console.log('0.1.3');
   process.exit(0);
 }
 
@@ -241,6 +241,8 @@ if (subcommand !== 'run' && !runsFromServiceDir && process.platform === 'darwin'
   if (installService()) {
     console.log('\n  Done. The daemon now runs in the background: it starts at');
     console.log('  login and restarts by itself. You can close this window.\n');
+    console.log('  If macOS asks to allow "node" to control Terminal or iTerm2,');
+    console.log('  click Allow. That is how phone messages reach your sessions.\n');
     console.log('  Scan the QR above with the Ground Control app to pair.');
     console.log('  Show it again:   npx @clastres/groundcontrol qr');
     console.log('  Check status:    npx @clastres/groundcontrol service status');
@@ -277,6 +279,34 @@ function open(b64) {
   return JSON.parse(pt.toString('utf8'));
 }
 
+// ---------- environment hardening ----------
+// launchd starts the service with a bare PATH (/usr/bin:/bin), which hides
+// tmux, claude, and anything from Homebrew or a version manager. Merge in the
+// user's login shell PATH plus the usual install locations so the background
+// daemon sees the same world a terminal does.
+
+function widenPath() {
+  const extra = [];
+  try {
+    const shell = process.env.SHELL || '/bin/zsh';
+    extra.push(...execSync(`${shell} -lc 'echo $PATH'`, { timeout: 5000, stdio: ['ignore', 'pipe', 'ignore'] })
+      .toString().trim().split(':'));
+  } catch {}
+  extra.push(
+    '/opt/homebrew/bin', '/usr/local/bin',
+    path.join(os.homedir(), '.local', 'bin'),
+    path.join(os.homedir(), '.claude', 'local'),
+  );
+  const seen = new Set((process.env.PATH || '').split(':').filter(Boolean));
+  for (const p of extra) if (p) seen.add(p);
+  process.env.PATH = [...seen].join(':');
+}
+widenPath();
+
+let claudeBin = null;
+try { claudeBin = execSync('command -v claude', { stdio: ['ignore', 'pipe', 'ignore'] }).toString().trim() || null; } catch {}
+console.log(`[daemon] claude binary: ${claudeBin || 'NOT FOUND (phone prompts to idle sessions without a visible terminal will fail)'}`);
+
 // ---------- Claude Code session discovery ----------
 
 const CLAUDE = path.join(os.homedir(), '.claude');
@@ -319,11 +349,36 @@ function terminalApps() {
 const escapeAS = (s) => s.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 
+// macOS requires a one time Automation grant before this process may control
+// Terminal or iTerm2. A refusal surfaces as error -1743 on stderr; remember it
+// so prompt failures can tell the phone exactly what to fix.
+let automationDenied = false;
+
 async function osascript(script) {
   try {
     const { stdout } = await execFileP('osascript', ['-e', script]);
     return stdout.trim();
-  } catch { return null; }
+  } catch (e) {
+    if (`${e.stderr || ''}${e.message || ''}`.includes('1743')) automationDenied = true;
+    return null;
+  }
+}
+
+/// Poke each running terminal app once at startup so the Automation dialog
+/// appears while the user is still at the Mac (the grant is keyed to this
+/// node binary and covers every later injection).
+async function requestAutomationGrant() {
+  const apps = terminalApps();
+  for (const [name, present] of [['Terminal', apps.terminal], ['iTerm2', apps.iterm]]) {
+    if (!present) continue;
+    automationDenied = false;
+    const r = await osascript(`tell application "${name}" to count windows`);
+    if (r === null && automationDenied) {
+      console.log(`[daemon] macOS is blocking control of ${name}. Open System Settings,`);
+      console.log(`[daemon] Privacy and Security, Automation, and allow node to control ${name}.`);
+      console.log('[daemon] Phone messages cannot reach your terminal until you do.');
+    }
+  }
 }
 
 function findTabScript(app, dev, action) {
@@ -551,26 +606,50 @@ async function handleCommand(cmd) {
         sendSnapshot(true);
         return;
       }
+      if (automationDenied) {
+        console.log('[daemon] prompt blocked: macOS Automation permission missing');
+        return ws?.send(seal({
+          type: 'promptResult', sessionId: cmd.sessionId, ok: false,
+          error: 'Your Mac is blocking terminal control. Open System Settings, Privacy and Security, Automation, and allow node to control your terminal app. Then send again.',
+        }));
+      }
+    }
+    if (session.status === 'busy') return ws?.send(seal({ type: 'promptResult', sessionId: cmd.sessionId, ok: false, error: 'session is busy, wait for it to go idle' }));
+    if (!claudeBin) {
+      console.log('[daemon] prompt failed: claude binary not found on PATH');
+      return ws?.send(seal({
+        type: 'promptResult', sessionId: cmd.sessionId, ok: false,
+        error: 'The daemon could not find the claude command on this Mac. Open a terminal, check that claude runs, then reinstall with: npx @clastres/groundcontrol',
+      }));
     }
-    if (session.status === 'busy') return ws?.send(seal({ type: 'promptResult', sessionId: cmd.sessionId, ok: false, error: 'session is busy — wait for it to go idle' }));
     console.log(`[daemon] prompt -> ${session.name}: ${cmd.text.slice(0, 60)}`);
     headlessActive.add(cmd.sessionId);
     sendSnapshot(true);
-    const child = spawn('claude', ['--resume', cmd.sessionId, '-p', cmd.text], {
+    const child = spawn(claudeBin, ['--resume', cmd.sessionId, '-p', cmd.text], {
       cwd: session.cwd || os.homedir(),
       env: process.env,
       stdio: ['ignore', 'pipe', 'pipe'],
     });
     let out = '', err = '';
+    let responded = false;
+    const respond = (payload) => {
+      if (responded) return;
+      responded = true;
+      headlessActive.delete(cmd.sessionId);
+      ws?.send(seal(payload));
+      sendSnapshot(true);
+    };
     child.stdout.on('data', (d) => { out += d; });
     child.stderr.on('data', (d) => { err += d; });
+    child.on('error', (e) => {
+      console.log(`[daemon] claude spawn failed: ${e.message}`);
+      respond({ type: 'promptResult', sessionId: cmd.sessionId, ok: false, error: `could not run claude: ${e.message}` });
+    });
     child.on('close', (code) => {
-      headlessActive.delete(cmd.sessionId);
-      ws?.send(seal({
+      respond({
         type: 'promptResult', sessionId: cmd.sessionId, ok: code === 0,
         text: (out || err).trim().slice(0, 4000),
-      }));
-      sendSnapshot(true);
+      });
     });
   }
 }
@@ -599,6 +678,7 @@ function connect() {
 }
 
 connect();
+if (process.platform === 'darwin') requestAutomationGrant();
 setInterval(sendSnapshot, 1500);
 // Heartbeat traffic keeps the Cloudflare socket alive in both directions and
 // lets the phone detect a dead link; missing pongs force a reconnect here.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clastres/groundcontrol",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "See and command your Claude Code sessions from your iPhone. Pairs the Ground Control app with the agents running on this Mac, end to end encrypted.",
   "bin": {
     "groundcontrol": "./bin/groundcontrol.mjs"