@clastres/groundcontrol 0.1.2 → 0.1.4

package/daemon.mjs

@@ -54,7 +54,7 @@ if (process.argv.includes('--help') || process.argv.includes('-h')) {
   process.exit(0);
 }
 if (process.argv.includes('--version')) {
-  console.log('0.1.2');
+  console.log('0.1.4');
   process.exit(0);
 }
 
@@ -88,6 +88,37 @@ function packageDirOf(dep) {
   return dir;
 }
 
+/// A node path that survives upgrades. process.execPath resolves symlinks, so
+/// on Homebrew it points into a versioned Cellar directory that the next
+/// `brew upgrade node` deletes. Prefer a stable symlink that leads to the
+/// same binary; fall back to the resolved path only when none does.
+function stableNodePath() {
+  const real = fs.realpathSync(process.execPath);
+  for (const c of ['/opt/homebrew/opt/node/bin/node', '/opt/homebrew/bin/node', '/usr/local/bin/node']) {
+    try { if (fs.realpathSync(c) === real) return c; } catch {}
+  }
+  return real;
+}
+
+/// Explain why a loaded service is not running, with the fix.
+function explainStoppedService(printOut) {
+  const uid = process.getuid();
+  const state = printOut.match(/state = (\S+)/)?.[1] || 'unknown';
+  const runs = printOut.match(/runs = (\d+)/)?.[1] || '0';
+  console.log(`  Service state: ${state}, runs: ${runs}`);
+  const disabled = new RegExp(`"${LABEL}" => (disabled|true)`).test(launchctl(`print-disabled gui/${uid}`));
+  if (disabled) {
+    console.log('  The service is switched off in launchd, usually from System');
+    console.log('  Settings, General, Login Items. Turn node back on there, or run:');
+    console.log(`  launchctl enable gui/${uid}/${LABEL} && launchctl kickstart -k gui/${uid}/${LABEL}`);
+  } else if (runs === '0') {
+    console.log(`  It never started. Try: launchctl kickstart -k gui/${uid}/${LABEL}`);
+    console.log(`  and check ${LOG_FILE}`);
+  } else {
+    console.log(`  It ran and stopped. Check ${LOG_FILE} and ${path.join(os.homedir(), '.groundcontrol', 'daemon.err.log')}`);
+  }
+}
+
 /// Stage a self contained copy of the daemon and register it with launchd.
 /// Returns true when launchd reports the job running.
 function installService() {
@@ -105,7 +136,7 @@ function installService() {
   }
 
   const esc = (s) => s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
-  const nodeBin = fs.realpathSync(process.execPath);
+  const nodeBin = stableNodePath();
   const plist = `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -134,14 +165,23 @@ function installService() {
 `;
   fs.mkdirSync(path.dirname(PLIST_PATH), { recursive: true });
   fs.writeFileSync(PLIST_PATH, plist);
+  // A persisted disabled state (for example the Login Items toggle) makes
+  // bootstrap load the job without ever running it, so enable explicitly and
+  // force the first start instead of trusting RunAtLoad.
+  launchctl(`enable gui/${uid}/${LABEL}`);
   launchctl(`bootstrap gui/${uid} ${PLIST_PATH}`);
+  launchctl(`kickstart -k gui/${uid}/${LABEL}`);
   // launchd reports the job async; give it a moment to reach running state.
   let out = '';
   for (let i = 0; i < 5 && !out.includes('state = running'); i++) {
     execSync('sleep 1');
     out = launchctl(`print gui/${uid}/${LABEL}`);
   }
-  return out.includes('state = running');
+  if (!out.includes('state = running')) {
+    explainStoppedService(out);
+    return false;
+  }
+  return true;
 }
 
 if (subcommand === 'service') {
@@ -180,7 +220,9 @@ if (subcommand === 'service') {
     if (out.includes('state = running')) {
       console.log('\n  Running in the background.');
     } else if (fs.existsSync(PLIST_PATH)) {
-      console.log('\n  Installed but not running. Reinstall with: groundcontrol service install');
+      console.log('\n  Installed but not running.');
+      explainStoppedService(out);
+      console.log('  Or reinstall with: groundcontrol service install');
     } else {
       console.log('\n  Not installed. Set it up with: groundcontrol service install');
     }
@@ -241,6 +283,8 @@ if (subcommand !== 'run' && !runsFromServiceDir && process.platform === 'darwin'
   if (installService()) {
     console.log('\n  Done. The daemon now runs in the background: it starts at');
     console.log('  login and restarts by itself. You can close this window.\n');
+    console.log('  If macOS asks to allow "node" to control Terminal or iTerm2,');
+    console.log('  click Allow. That is how phone messages reach your sessions.\n');
     console.log('  Scan the QR above with the Ground Control app to pair.');
     console.log('  Show it again:   npx @clastres/groundcontrol qr');
     console.log('  Check status:    npx @clastres/groundcontrol service status');
@@ -249,6 +293,7 @@ if (subcommand !== 'run' && !runsFromServiceDir && process.platform === 'darwin'
   }
   console.log('\n  Could not set up the background service, running here instead.');
   console.log('  Keep this window open to stay connected.\n');
+  try { fs.appendFileSync(LOG_FILE, '[daemon] background service failed to start at install, fell back to a foreground run\n'); } catch {}
 } else if (subcommand === 'run' || process.platform !== 'darwin') {
   console.log('  Keep this window open to stay connected.');
   if (process.platform === 'darwin') {
@@ -277,6 +322,34 @@ function open(b64) {
   return JSON.parse(pt.toString('utf8'));
 }
 
+// ---------- environment hardening ----------
+// launchd starts the service with a bare PATH (/usr/bin:/bin), which hides
+// tmux, claude, and anything from Homebrew or a version manager. Merge in the
+// user's login shell PATH plus the usual install locations so the background
+// daemon sees the same world a terminal does.
+
+function widenPath() {
+  const extra = [];
+  try {
+    const shell = process.env.SHELL || '/bin/zsh';
+    extra.push(...execSync(`${shell} -lc 'echo $PATH'`, { timeout: 5000, stdio: ['ignore', 'pipe', 'ignore'] })
+      .toString().trim().split(':'));
+  } catch {}
+  extra.push(
+    '/opt/homebrew/bin', '/usr/local/bin',
+    path.join(os.homedir(), '.local', 'bin'),
+    path.join(os.homedir(), '.claude', 'local'),
+  );
+  const seen = new Set((process.env.PATH || '').split(':').filter(Boolean));
+  for (const p of extra) if (p) seen.add(p);
+  process.env.PATH = [...seen].join(':');
+}
+widenPath();
+
+let claudeBin = null;
+try { claudeBin = execSync('command -v claude', { stdio: ['ignore', 'pipe', 'ignore'] }).toString().trim() || null; } catch {}
+console.log(`[daemon] claude binary: ${claudeBin || 'NOT FOUND (phone prompts to idle sessions without a visible terminal will fail)'}`);
+
 // ---------- Claude Code session discovery ----------
 
 const CLAUDE = path.join(os.homedir(), '.claude');
@@ -312,18 +385,53 @@ function terminalApps() {
       if (tty && id) tmuxPanes.set(tty, id);
     }
   } catch {}
+  const prev = termCache;
   termCache = { at: Date.now(), terminal: running('Terminal'), iterm: running('iTerm2'), tmuxPanes };
+  // The service usually starts at login, before any terminal app is open, so
+  // the startup Automation poke finds nothing. Poke again the first time a
+  // terminal app shows up, while the user is right there to click Allow.
+  if ((termCache.terminal && !prev.terminal) || (termCache.iterm && !prev.iterm)) {
+    requestAutomationGrant();
+  }
   return termCache;
 }
 
 const escapeAS = (s) => s.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 
+// macOS requires a one time Automation grant before this process may control
+// Terminal or iTerm2. A refusal surfaces as error -1743 on stderr; remember it
+// so prompt failures can tell the phone exactly what to fix.
+let automationDenied = false;
+
 async function osascript(script) {
   try {
     const { stdout } = await execFileP('osascript', ['-e', script]);
     return stdout.trim();
-  } catch { return null; }
+  } catch (e) {
+    if (`${e.stderr || ''}${e.message || ''}`.includes('1743')) automationDenied = true;
+    return null;
+  }
+}
+
+/// Poke each running terminal app once at startup so the Automation dialog
+/// appears while the user is still at the Mac (the grant is keyed to this
+/// node binary and covers every later injection).
+let lastGrantPokeAt = 0;
+async function requestAutomationGrant() {
+  if (Date.now() - lastGrantPokeAt < 10_000) return;
+  lastGrantPokeAt = Date.now();
+  const apps = terminalApps();
+  for (const [name, present] of [['Terminal', apps.terminal], ['iTerm2', apps.iterm]]) {
+    if (!present) continue;
+    automationDenied = false;
+    const r = await osascript(`tell application "${name}" to count windows`);
+    if (r === null && automationDenied) {
+      console.log(`[daemon] macOS is blocking control of ${name}. Open System Settings,`);
+      console.log(`[daemon] Privacy and Security, Automation, and allow node to control ${name}.`);
+      console.log('[daemon] Phone messages cannot reach your terminal until you do.');
+    }
+  }
 }
 
 function findTabScript(app, dev, action) {
@@ -551,26 +659,50 @@ async function handleCommand(cmd) {
         sendSnapshot(true);
         return;
       }
+      if (automationDenied) {
+        console.log('[daemon] prompt blocked: macOS Automation permission missing');
+        return ws?.send(seal({
+          type: 'promptResult', sessionId: cmd.sessionId, ok: false,
+          error: 'Your Mac is blocking terminal control. Open System Settings, Privacy and Security, Automation, and allow node to control your terminal app. Then send again.',
+        }));
+      }
+    }
+    if (session.status === 'busy') return ws?.send(seal({ type: 'promptResult', sessionId: cmd.sessionId, ok: false, error: 'session is busy, wait for it to go idle' }));
+    if (!claudeBin) {
+      console.log('[daemon] prompt failed: claude binary not found on PATH');
+      return ws?.send(seal({
+        type: 'promptResult', sessionId: cmd.sessionId, ok: false,
+        error: 'The daemon could not find the claude command on this Mac. Open a terminal, check that claude runs, then reinstall with: npx @clastres/groundcontrol',
+      }));
     }
-    if (session.status === 'busy') return ws?.send(seal({ type: 'promptResult', sessionId: cmd.sessionId, ok: false, error: 'session is busy — wait for it to go idle' }));
     console.log(`[daemon] prompt -> ${session.name}: ${cmd.text.slice(0, 60)}`);
     headlessActive.add(cmd.sessionId);
     sendSnapshot(true);
-    const child = spawn('claude', ['--resume', cmd.sessionId, '-p', cmd.text], {
+    const child = spawn(claudeBin, ['--resume', cmd.sessionId, '-p', cmd.text], {
       cwd: session.cwd || os.homedir(),
       env: process.env,
       stdio: ['ignore', 'pipe', 'pipe'],
     });
     let out = '', err = '';
+    let responded = false;
+    const respond = (payload) => {
+      if (responded) return;
+      responded = true;
+      headlessActive.delete(cmd.sessionId);
+      ws?.send(seal(payload));
+      sendSnapshot(true);
+    };
     child.stdout.on('data', (d) => { out += d; });
     child.stderr.on('data', (d) => { err += d; });
+    child.on('error', (e) => {
+      console.log(`[daemon] claude spawn failed: ${e.message}`);
+      respond({ type: 'promptResult', sessionId: cmd.sessionId, ok: false, error: `could not run claude: ${e.message}` });
+    });
     child.on('close', (code) => {
-      headlessActive.delete(cmd.sessionId);
-      ws?.send(seal({
+      respond({
         type: 'promptResult', sessionId: cmd.sessionId, ok: code === 0,
         text: (out || err).trim().slice(0, 4000),
-      }));
-      sendSnapshot(true);
+      });
     });
   }
 }
@@ -599,6 +731,7 @@ function connect() {
 }
 
 connect();
+if (process.platform === 'darwin') requestAutomationGrant();
 setInterval(sendSnapshot, 1500);
 // Heartbeat traffic keeps the Cloudflare socket alive in both directions and
 // lets the phone detect a dead link; missing pongs force a reconnect here.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clastres/groundcontrol",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "See and command your Claude Code sessions from your iPhone. Pairs the Ground Control app with the agents running on this Mac, end to end encrypted.",
   "bin": {
     "groundcontrol": "./bin/groundcontrol.mjs"