@clastres/groundcontrol 0.1.6 → 0.1.7

package/daemon.mjs

@@ -11,8 +11,10 @@ import { WebSocket } from 'ws';
 import qrcode from 'qrcode-terminal';
 import crypto from 'node:crypto';
 import fs from 'node:fs';
+import net from 'node:net';
 import os from 'node:os';
 import path from 'node:path';
+import readline from 'node:readline';
 import { spawn, execFile, execSync } from 'node:child_process';
 import { promisify } from 'node:util';
 import { fileURLToPath } from 'node:url';
@@ -20,6 +22,9 @@ import { createRequire } from 'node:module';
 
 const execFileP = promisify(execFile);
 
+const VERSION = '0.1.7';
+const PACKAGE = '@clastres/groundcontrol';
+
 // ---------- config / pairing ----------
 
 if (process.argv.includes('--help') || process.argv.includes('-h')) {
@@ -42,6 +47,12 @@ if (process.argv.includes('--help') || process.argv.includes('-h')) {
     service status      Check the background daemon
     service install     Set up the background daemon without pairing output
     service uninstall   Remove the background daemon
+    approvals status    Check remote permission approvals
+    approvals away      Send permission prompts to the phone only while you
+                        are away from the Mac (the default)
+    approvals always    Send them to the phone whenever it is connected
+    approvals off       Keep every permission prompt on the Mac
+    approvals uninstall Remove the permission hook from Claude Code
 
   Options:
     --relay <url>   Use a custom relay (default: wss://relay.groundcontrol.chat)
@@ -54,7 +65,7 @@ if (process.argv.includes('--help') || process.argv.includes('-h')) {
   process.exit(0);
 }
 if (process.argv.includes('--version')) {
-  console.log('0.1.6');
+  console.log(VERSION);
   process.exit(0);
 }
 
@@ -66,9 +77,10 @@ if (process.argv.includes('--version')) {
 
 const subcommand = process.argv[2];
 const LABEL = 'chat.groundcontrol.daemon';
-const SERVICE_DIR = path.join(os.homedir(), '.groundcontrol', 'service');
+const CONF_DIR = path.join(os.homedir(), '.groundcontrol');
+const SERVICE_DIR = path.join(CONF_DIR, 'service');
 const PLIST_PATH = path.join(os.homedir(), 'Library', 'LaunchAgents', `${LABEL}.plist`);
-const LOG_FILE = path.join(os.homedir(), '.groundcontrol', 'daemon.log');
+const LOG_FILE = path.join(CONF_DIR, 'daemon.log');
 const THIS_FILE = fs.realpathSync(fileURLToPath(import.meta.url));
 const runsFromServiceDir = THIS_FILE.startsWith(SERVICE_DIR + path.sep);
 
@@ -123,17 +135,36 @@ function explainStoppedService(printOut) {
 /// Returns true when launchd reports the job running.
 function installService() {
   const uid = process.getuid();
+
+  // Stage into a scratch directory first and only disturb the running service
+  // once every file is in place. The old order (bootout, delete, then copy)
+  // meant any failure mid copy left the user with no daemon at all, which is
+  // unacceptable now that self update runs this unattended.
+  const staging = `${SERVICE_DIR}.staging`;
+  try {
+    fs.rmSync(staging, { recursive: true, force: true });
+    fs.mkdirSync(path.join(staging, 'node_modules'), { recursive: true });
+    fs.copyFileSync(THIS_FILE, path.join(staging, 'daemon.mjs'));
+    // The permission hook ships beside the daemon and must travel with it, so a
+    // service copy can re-stage it after an upgrade without the npx cache.
+    fs.copyFileSync(hookSourceFile(), path.join(staging, 'hook.mjs'));
+    fs.writeFileSync(
+      path.join(staging, 'package.json'),
+      JSON.stringify({ name: 'groundcontrol-service', private: true, type: 'module' }, null, 2),
+    );
+    for (const dep of ['ws', 'qrcode-terminal']) {
+      fs.cpSync(packageDirOf(dep), path.join(staging, 'node_modules', dep), { recursive: true });
+    }
+  } catch (e) {
+    // Nothing has been touched yet, so the existing service keeps running.
+    console.log(`[daemon] could not stage the service, leaving the current one alone: ${e.message}`);
+    fs.rmSync(staging, { recursive: true, force: true });
+    return false;
+  }
+
   launchctl(`bootout gui/${uid}/${LABEL}`);
   fs.rmSync(SERVICE_DIR, { recursive: true, force: true });
-  fs.mkdirSync(path.join(SERVICE_DIR, 'node_modules'), { recursive: true });
-  fs.copyFileSync(THIS_FILE, path.join(SERVICE_DIR, 'daemon.mjs'));
-  fs.writeFileSync(
-    path.join(SERVICE_DIR, 'package.json'),
-    JSON.stringify({ name: 'groundcontrol-service', private: true, type: 'module' }, null, 2),
-  );
-  for (const dep of ['ws', 'qrcode-terminal']) {
-    fs.cpSync(packageDirOf(dep), path.join(SERVICE_DIR, 'node_modules', dep), { recursive: true });
-  }
+  fs.renameSync(staging, SERVICE_DIR);
 
   const esc = (s) => s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
   const nodeBin = stableNodePath();
@@ -184,6 +215,181 @@ function installService() {
   return true;
 }
 
+// ---------- remote approvals: Claude Code hook installation ----------
+// Claude Code fires a PermissionRequest hook whenever a tool call needs a
+// decision. Our hook hands the request to this daemon, which either holds it
+// for the phone or passes immediately so the terminal prompts as usual.
+
+const CLAUDE_SETTINGS = path.join(os.homedir(), '.claude', 'settings.json');
+const HOOK_FILE = path.join(CONF_DIR, 'hook.mjs');
+// Generous, because the daemon settles every request itself. This only caps
+// the case where the daemon wedges while holding.
+const HOOK_TIMEOUT_SECONDS = 12 * 60 * 60;
+
+const hookSourceFile = () => path.join(path.dirname(THIS_FILE), 'hook.mjs');
+
+/// Copy the hook next to the key material so it survives npx cache eviction.
+function stageHookFile() {
+  fs.mkdirSync(CONF_DIR, { recursive: true });
+  fs.copyFileSync(hookSourceFile(), HOOK_FILE);
+}
+
+const hookCommand = () => `${JSON.stringify(stableNodePath())} ${JSON.stringify(HOOK_FILE)}`;
+
+/// Every command string an entry can carry, flattened, so a hook can be
+/// recognised whether it uses the nested or the shorthand form.
+const commandsOf = (entry) => [entry?.command, entry?.bash, ...(Array.isArray(entry?.hooks) ? entry.hooks.map((h) => h?.command) : [])]
+  .filter((c) => typeof c === 'string').join(' ');
+
+const isOurHook = (cmd) => cmd.includes('.groundcontrol') && cmd.includes('hook.mjs');
+
+/// Read settings.json. Returns null when it exists but cannot be parsed, which
+/// must never be treated as "empty": overwriting it would destroy real config.
+function readClaudeSettings() {
+  if (!fs.existsSync(CLAUDE_SETTINGS)) return {};
+  try {
+    const parsed = JSON.parse(fs.readFileSync(CLAUDE_SETTINGS, 'utf8'));
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : null;
+  } catch { return null; }
+}
+
+function backupClaudeSettings() {
+  if (!fs.existsSync(CLAUDE_SETTINGS)) return null;
+  const dest = `${CLAUDE_SETTINGS}.groundcontrol-backup`;
+  try { fs.copyFileSync(CLAUDE_SETTINGS, dest); return dest; } catch { return null; }
+}
+
+/// Add our hook to settings.json. Strictly additive: the only entry it ever
+/// removes is our own previous one, so an upgrade replaces it instead of
+/// stacking duplicates. Another tool's hooks are reported, never touched.
+/// Writes only when something actually changes, so restarts are inert.
+///
+/// Nothing is written unless `consent` is true. Editing another tool's config
+/// is not something to do behind someone's back, so the caller has to have
+/// asked first, or the user has to have run `groundcontrol approvals on`.
+function installApprovalHook({ consent = false } = {}) {
+  try { stageHookFile(); } catch (e) { return { ok: false, reason: `could not stage the hook file: ${e.message}` }; }
+  if (!fs.existsSync(path.dirname(CLAUDE_SETTINGS))) return { ok: false, reason: 'no ~/.claude directory on this Mac' };
+
+  const settings = readClaudeSettings();
+  if (settings === null) return { ok: false, reason: '~/.claude/settings.json is not valid JSON, leaving it untouched' };
+
+  const before = JSON.stringify(settings.hooks?.PermissionRequest ?? null);
+  const existing = Array.isArray(settings.hooks?.PermissionRequest) ? settings.hooks.PermissionRequest : [];
+  const foreign = [];
+  const kept = existing.filter((entry) => {
+    const cmd = commandsOf(entry);
+    if (isOurHook(cmd)) return false;               // ours, re-added fresh below
+    if (cmd) foreign.push(cmd.trim().slice(0, 70));
+    return true;                                     // everyone else stays, always
+  });
+  const next = [...kept, {
+    matcher: '*',
+    hooks: [{ type: 'command', command: hookCommand(), timeout: HOOK_TIMEOUT_SECONDS }],
+  }];
+  if (JSON.stringify(next) === before) return { ok: true, unchanged: true, foreign };
+  if (!consent) return { ok: false, needsConsent: true, foreign, reason: 'the permission hook is not installed yet' };
+
+  const raw = fs.existsSync(CLAUDE_SETTINGS) ? fs.readFileSync(CLAUDE_SETTINGS, 'utf8') : '';
+  // A rewrite goes through JSON.parse/stringify, so any // comments in the
+  // file are lost. Worth saying out loud rather than quietly dropping them.
+  const hadComments = /^\s*\/\//m.test(raw);
+  const backup = backupClaudeSettings();
+  settings.hooks = settings.hooks && typeof settings.hooks === 'object' ? settings.hooks : {};
+  settings.hooks.PermissionRequest = next;
+  try { fs.writeFileSync(CLAUDE_SETTINGS, JSON.stringify(settings, null, 2) + '\n'); }
+  catch (e) { return { ok: false, reason: `could not write settings.json: ${e.message}` }; }
+  return { ok: true, installed: true, foreign, backup, hadComments };
+}
+
+/// Remove only our own entry, leaving anything else in place.
+function uninstallApprovalHook() {
+  const settings = readClaudeSettings();
+  if (settings === null) return { ok: false, reason: '~/.claude/settings.json is not valid JSON, leaving it untouched' };
+  const existing = Array.isArray(settings.hooks?.PermissionRequest) ? settings.hooks.PermissionRequest : [];
+  const kept = existing.filter((entry) => !isOurHook(commandsOf(entry)));
+  if (kept.length === existing.length) return { ok: true, unchanged: true };
+  backupClaudeSettings();
+  if (kept.length) settings.hooks.PermissionRequest = kept;
+  else delete settings.hooks.PermissionRequest;
+  if (settings.hooks && !Object.keys(settings.hooks).length) delete settings.hooks;
+  try { fs.writeFileSync(CLAUDE_SETTINGS, JSON.stringify(settings, null, 2) + '\n'); }
+  catch (e) { return { ok: false, reason: `could not write settings.json: ${e.message}` }; }
+  return { ok: true };
+}
+
+/// Another tool answering the same event is worth knowing about: Claude Code
+/// runs every PermissionRequest hook and any deny wins, so a second one can
+/// overrule your tap. Ground Control says so and leaves it alone. Removing it
+/// is your call, not ours.
+function reportForeignHooks(foreign) {
+  if (!foreign?.length) return;
+  console.log('\n  Another app also answers permission requests on this Mac:');
+  for (const cmd of foreign) console.log(`    ${cmd}`);
+  console.log('  Both will run. If either denies, the tool call is denied, so a');
+  console.log('  tap on your phone can be overruled. Ground Control leaves it in');
+  console.log('  place; remove it yourself if you want only one app deciding.');
+}
+
+/// Ask before editing ~/.claude/settings.json. Anything but an interactive
+/// terminal answers no: a background or piped run must never decide this.
+async function askYesNo(question) {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) return false;
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  const answer = await new Promise((resolve) => rl.question(question, resolve));
+  rl.close();
+  return /^y(es)?$/i.test(answer.trim()) || answer.trim() === '';
+}
+
+/// Offer remote approvals during pairing, then do exactly what was answered.
+async function offerApprovals() {
+  const state = installApprovalHook();
+  if (state.ok && state.unchanged) {
+    console.log('  Permission prompts already reach your phone.');
+    reportForeignHooks(state.foreign);
+    return;
+  }
+  if (!state.ok && !state.needsConsent) {
+    console.log(`  Remote approvals unavailable: ${state.reason}`);
+    return;
+  }
+  console.log('  One more thing. Claude Code stops and asks before it runs');
+  console.log('  risky commands. Ground Control can send those to your phone');
+  console.log('  while you are away from the Mac, so a session does not sit');
+  console.log('  blocked until you get back. Sitting at your Mac, prompts stay');
+  console.log('  in the terminal exactly as they do now.');
+  console.log('');
+  console.log('  This adds one hook to ~/.claude/settings.json. Nothing else in');
+  console.log('  that file is changed, and a backup is written first.');
+  reportForeignHooks(state.foreign);
+  console.log('');
+  if (!await askYesNo('  Turn on remote approvals? [Y/n] ')) {
+    console.log('\n  Left alone. Turn it on later with: groundcontrol approvals on\n');
+    return;
+  }
+  const done = installApprovalHook({ consent: true });
+  console.log('');
+  reportHookInstall(done);
+  console.log('  Change it anytime: groundcontrol approvals <away|always|off>\n');
+}
+
+function reportHookInstall(result) {
+  if (result.needsConsent) {
+    console.log('  Remote approvals are not set up yet. Turn them on with:');
+    console.log('  groundcontrol approvals on');
+    reportForeignHooks(result.foreign);
+    return;
+  }
+  if (!result.ok) {
+    console.log(`  Remote approvals are off: ${result.reason}`);
+    return;
+  }
+  if (result.installed) console.log('  Permission prompts can now reach your phone.');
+  if (result.backup) console.log(`  Backed up your settings to ${result.backup}`);
+  if (result.hadComments) console.log('  Heads up: comments in settings.json were dropped by the rewrite.');
+  reportForeignHooks(result.foreign);
+}
+
 if (subcommand === 'service') {
   const action = process.argv[3];
   if (process.platform !== 'darwin') {
@@ -196,7 +402,10 @@ if (subcommand === 'service') {
     if (installService()) {
       console.log('\n  Ground Control daemon is now running in the background.');
       console.log('  It starts at login and restarts automatically if it stops.\n');
+      // Deliberately not installing the hook here: this path is the scripted,
+      // non-interactive one, so there is nobody to ask.
       console.log(`  Log:       ${LOG_FILE}`);
+      console.log('  Approvals: groundcontrol approvals on');
       console.log('  Pair:      groundcontrol qr');
       console.log('  Check:     groundcontrol service status');
       console.log('  Remove:    groundcontrol service uninstall\n');
@@ -234,12 +443,91 @@ if (subcommand === 'service') {
   process.exit(1);
 }
 
+// ---------- remote approvals: policy config ----------
+
+const APPROVALS_CONF = path.join(CONF_DIR, 'approvals.json');
+const APPROVAL_DEFAULTS = {
+  // away:   hold for the phone only while you are not using the Mac
+  // always: hold whenever a phone is connected
+  // off:    never hold; the terminal prompts exactly as it always has
+  mode: 'away',
+  awayAfterSeconds: 90,
+  holdMinutes: 720,
+};
+
+let approvalConfCache = { at: 0, value: APPROVAL_DEFAULTS };
+function approvalConfig() {
+  if (Date.now() - approvalConfCache.at < 5000) return approvalConfCache.value;
+  let value = APPROVAL_DEFAULTS;
+  try {
+    const parsed = JSON.parse(fs.readFileSync(APPROVALS_CONF, 'utf8'));
+    if (parsed && typeof parsed === 'object') value = { ...APPROVAL_DEFAULTS, ...parsed };
+  } catch {}
+  if (!['away', 'always', 'off'].includes(value.mode)) value = { ...value, mode: 'away' };
+  approvalConfCache = { at: Date.now(), value };
+  return value;
+}
+
+function writeApprovalConfig(patch) {
+  fs.mkdirSync(CONF_DIR, { recursive: true });
+  let current = {};
+  try { current = JSON.parse(fs.readFileSync(APPROVALS_CONF, 'utf8')) || {}; } catch {}
+  const next = { ...APPROVAL_DEFAULTS, ...current, ...patch };
+  fs.writeFileSync(APPROVALS_CONF, JSON.stringify(next, null, 2) + '\n');
+  approvalConfCache = { at: 0, value: APPROVAL_DEFAULTS };
+  return next;
+}
+
+if (subcommand === 'approvals') {
+  const action = process.argv[3] || 'status';
+  if (action === 'on' || action === 'always' || action === 'away') {
+    const mode = action === 'on' ? 'away' : action;
+    console.log(`\n  Remote approvals: ${writeApprovalConfig({ mode }).mode}`);
+    reportHookInstall(installApprovalHook({ consent: true }));
+    console.log('');
+    process.exit(0);
+  }
+  if (action === 'off') {
+    writeApprovalConfig({ mode: 'off' });
+    console.log('\n  Remote approvals are off. Permission prompts stay on the Mac.');
+    console.log('  The hook stays installed and does nothing. Remove it fully with:');
+    console.log('  groundcontrol approvals uninstall\n');
+    process.exit(0);
+  }
+  if (action === 'install') {
+    reportHookInstall(installApprovalHook({ consent: true }));
+    console.log('');
+    process.exit(0);
+  }
+  if (action === 'uninstall') {
+    const r = uninstallApprovalHook();
+    console.log(r.ok ? '\n  Permission hook removed.\n' : `\n  ${r.reason}\n`);
+    process.exit(0);
+  }
+  if (action === 'status') {
+    const cfg = approvalConfig();
+    const settings = readClaudeSettings();
+    const entries = Array.isArray(settings?.hooks?.PermissionRequest) ? settings.hooks.PermissionRequest : [];
+    const installed = entries.some((e) => isOurHook(commandsOf(e)));
+    const others = entries.filter((e) => !isOurHook(commandsOf(e))).map((e) => commandsOf(e).trim().slice(0, 70));
+    console.log(`\n  Mode:        ${cfg.mode}${cfg.mode === 'away' ? ` (after ${cfg.awayAfterSeconds}s idle)` : ''}`);
+    console.log(`  Hook:        ${installed ? 'installed' : 'NOT installed'}`);
+    console.log(`  Hook file:   ${fs.existsSync(HOOK_FILE) ? HOOK_FILE : 'missing'}`);
+    console.log(`  Hold limit:  ${cfg.holdMinutes} minutes, then the Mac prompts instead`);
+    if (settings === null) console.log('  Settings:    ~/.claude/settings.json is not valid JSON');
+    for (const o of others) console.log(`  Also runs:   ${o}`);
+    console.log(`  Config:      ${APPROVALS_CONF}\n`);
+    process.exit(0);
+  }
+  console.log('\n  Usage: groundcontrol approvals <status|on|off|always|install|uninstall>\n');
+  process.exit(1);
+}
+
 const argRelay = (() => {
   const i = process.argv.indexOf('--relay');
   return i > -1 ? process.argv[i + 1] : null;
 })();
 
-const CONF_DIR = path.join(os.homedir(), '.groundcontrol');
 const KEY_FILE = path.join(CONF_DIR, 'key');
 const RELAY_FILE = path.join(CONF_DIR, 'relay');
 fs.mkdirSync(CONF_DIR, { recursive: true });
@@ -283,6 +571,7 @@ if (subcommand !== 'run' && !runsFromServiceDir && process.platform === 'darwin'
   if (installService()) {
     console.log('\n  Done. The daemon now runs in the background: it starts at');
     console.log('  login and restarts by itself. You can close this window.\n');
+    await offerApprovals();
     console.log('  If macOS asks to allow "node" to control Terminal or iTerm2,');
     console.log('  click Allow. That is how phone messages reach your sessions.\n');
     console.log('  Scan the QR above with the Ground Control app to pair.');
@@ -606,6 +895,10 @@ function readClaudeSessions() {
       cwd: s.cwd || '',
       project: path.basename(s.cwd || '?'),
       status: headlessActive.has(s.sessionId) ? 'busy' : (s.status || 'idle'),
+      // Claude Code's own view, kept separate because readSessions overwrites
+      // status to 'waiting' for a held request. Answering on the Mac is only
+      // detectable by watching this drop back out of 'waiting'.
+      rawStatus: s.status || 'idle',
       updatedAt: s.statusUpdatedAt || s.updatedAt || 0,
       startedAt: s.startedAt || 0,
       lastMessage: msgs.length ? msgs[msgs.length - 1] : null,
@@ -1019,12 +1312,417 @@ function readKimiSessions() {
   return kimiCache.sessions;
 }
 
+/// The phone-facing shape of a held request.
+const askPayload = (ask, queued) => ({
+  id: ask.id,
+  tool: ask.tool,
+  line: ask.line,
+  detail: ask.detail,
+  at: ask.at,
+  queued,
+});
+
 function readSessions() {
   const sessions = [...readClaudeSessions(), ...readCodexSessions(), ...readKimiSessions()];
+  const known = new Set(sessions.map((s) => s.id));
+  for (const s of sessions) {
+    const queue = askQueue.get(s.id);
+    const ask = queue?.length ? pendingAsks.get(queue[0]) : null;
+    if (!ask) continue;
+    // A held permission outranks busy: the session is stopped on a human, and
+    // that is the whole reason the invader turns pink on the island.
+    s.status = 'waiting';
+    s.ask = askPayload(ask, queue.length);
+  }
+
+  // A held request whose session is not in the fleet would never reach the
+  // phone, and one that cannot be seen cannot be answered, which strands the
+  // session until the hold expires. It happens for real: the session file is
+  // written slightly after the first tool call, a scan races a partial write,
+  // or the request comes from a session kind we do not discover. Surface the
+  // request on its own rather than dropping it.
+  for (const [sessionId, queue] of askQueue) {
+    if (known.has(sessionId) || !queue.length) continue;
+    const ask = pendingAsks.get(queue[0]);
+    if (!ask) continue;
+    sessions.push({
+      id: sessionId,
+      provider: 'claude',
+      name: path.basename(ask.cwd || '') || 'session',
+      cwd: ask.cwd || '',
+      project: path.basename(ask.cwd || '') || '?',
+      status: 'waiting',
+      updatedAt: ask.at,
+      startedAt: ask.at,
+      lastMessage: null,
+      tty: '',
+      live: false,
+      ask: askPayload(ask, queue.length),
+    });
+  }
+
   sessions.sort((a, b) => a.startedAt - b.startedAt);
   return sessions;
 }
 
+// ---------- remote approvals: runtime ----------
+// The hook connects here over a unix socket and blocks until this daemon
+// answers. Answering null means "no decision", which puts the prompt back on
+// the Mac exactly as it behaves without Ground Control installed.
+
+const ASK_SOCKET = path.join(CONF_DIR, 'approvals.sock');
+
+/// What the phone needs to render the approvals control without knowing
+/// anything about hooks or settings files. Cached: a snapshot goes out every
+/// 1.5s and this reads and parses settings.json.
+let hostCache = { at: 0, value: null };
+function hostState() {
+  if (Date.now() - hostCache.at < 5000 && hostCache.value) return hostCache.value;
+  const settings = readClaudeSettings();
+  const entries = Array.isArray(settings?.hooks?.PermissionRequest) ? settings.hooks.PermissionRequest : [];
+  const value = {
+    version: VERSION,
+    approvals: {
+      // Present at all means this daemon understands approvals; an older one
+      // simply omits the whole field and the app can say so.
+      installed: entries.some((e) => isOurHook(commandsOf(e))),
+      mode: approvalConfig().mode,
+      // Another app answering the same event can overrule a tap, so the phone
+      // should be able to say that out loud.
+      others: entries.filter((e) => !isOurHook(commandsOf(e))).length,
+      // A settings.json we cannot parse must not be silently overwritten, and
+      // the phone should explain why the toggle will not work.
+      settingsOk: settings !== null,
+      socketOk: approvalServerUp,
+    },
+    updateAvailable: availableUpdate,
+  };
+  hostCache = { at: Date.now(), value };
+  return value;
+}
+const bustHostCache = () => { hostCache.at = 0; };
+
+let approvalServerUp = false;
+let availableUpdate = null;   // version string once a newer release is seen
+
+const pendingAsks = new Map();  // askId -> ask record
+const askQueue = new Map();     // sessionId -> [askId], oldest first
+let askSeq = 0;
+
+/// Seconds since the last keyboard or mouse event on this Mac. A failure reads
+/// as 0 (you are here), which keeps prompts on the Mac rather than silently
+/// routing them to a phone that may not be watching.
+let idleCache = { at: 0, seconds: 0 };
+function macIdleSeconds() {
+  if (process.platform !== 'darwin') return Infinity; // no signal; treat a headless box as away
+  if (Date.now() - idleCache.at < 2000) return idleCache.seconds;
+  let seconds = 0;
+  try {
+    const out = execSync("ioreg -c IOHIDSystem -d 1 | awk '/HIDIdleTime/ {print $NF; exit}'", {
+      timeout: 3000, stdio: ['ignore', 'pipe', 'ignore'],
+    }).toString().trim();
+    const ns = Number(out);
+    if (Number.isFinite(ns) && ns >= 0) seconds = ns / 1e9;
+  } catch {}
+  idleCache = { at: Date.now(), seconds };
+  return seconds;
+}
+
+// Deliberately not a live presence check. iOS suspends the websocket the
+// moment the app is backgrounded, so a phone in a pocket looks offline, which
+// is exactly the situation this feature exists for. What matters is whether
+// this Mac belongs to someone who actually uses the app, so a request is worth
+// holding until they pick the phone up. Walking back to the Mac releases it
+// within seconds either way, so a hold costs a paired user nothing.
+const PHONE_SEEN_FILE = path.join(CONF_DIR, 'phone-seen');
+const PHONE_KNOWN_MS = 30 * 24 * 60 * 60 * 1000;
+
+let lastPhoneWrite = 0;
+function notePhoneSeen() {
+  if (Date.now() - lastPhoneWrite < 60_000) return; // the phone heartbeats; do not churn the disk
+  lastPhoneWrite = Date.now();
+  try { fs.writeFileSync(PHONE_SEEN_FILE, String(Date.now())); } catch {}
+}
+
+function phoneKnown() {
+  try { return Date.now() - Number(fs.readFileSync(PHONE_SEEN_FILE, 'utf8').trim()) < PHONE_KNOWN_MS; }
+  catch { return false; }
+}
+
+function holdPolicy() {
+  const cfg = approvalConfig();
+  if (cfg.mode === 'off') return { hold: false, why: 'remote approvals are off' };
+  if (!phoneKnown()) return { hold: false, why: 'no phone has paired with this Mac' };
+  if (cfg.mode === 'always') return { hold: true };
+  const idle = macIdleSeconds();
+  if (idle < cfg.awayAfterSeconds) return { hold: false, why: `you are at the Mac (idle ${Math.round(idle)}s)` };
+  return { hold: true };
+}
+
+const clip = (v, n) => {
+  const s = typeof v === 'string' ? v : (v == null ? '' : JSON.stringify(v));
+  return s.length > n ? `${s.slice(0, n)}\n...` : s;
+};
+
+/// Reduce a tool call to the one line that identifies it plus a longer preview.
+/// Tool inputs can carry whole file contents, and every byte here is encrypted,
+/// relayed, and rendered on a phone.
+function summarizeTool(tool, input) {
+  const i = input && typeof input === 'object' ? input : {};
+  switch (tool) {
+    case 'Bash':
+    case 'BashOutput':
+      return { line: clip(i.command, 400), detail: clip(i.description, 300) };
+    case 'Write':
+      return { line: clip(i.file_path, 300), detail: clip(i.content, 1000) };
+    case 'Edit':
+      return {
+        line: clip(i.file_path, 300),
+        detail: `${clip(i.old_string, 500)}\n\n->\n\n${clip(i.new_string, 500)}`,
+      };
+    case 'Read':
+      return { line: clip(i.file_path, 300), detail: '' };
+    case 'WebFetch':
+      return { line: clip(i.url, 300), detail: clip(i.prompt, 300) };
+    case 'WebSearch':
+      return { line: clip(i.query, 300), detail: '' };
+    default: {
+      // Unknown or MCP tools: show whichever field reads most like a target,
+      // and fall back to the whole input.
+      const pick = i.command || i.file_path || i.path || i.url || i.query || i.pattern;
+      return { line: clip(pick || tool, 300), detail: clip(i, 1000) };
+    }
+  }
+}
+
+function dropAsk(ask) {
+  pendingAsks.delete(ask.id);
+  const queue = askQueue.get(ask.sessionId);
+  if (!queue) return;
+  const at = queue.indexOf(ask.id);
+  if (at > -1) queue.splice(at, 1);
+  if (!queue.length) askQueue.delete(ask.sessionId);
+}
+
+/// Answer a held request exactly once. A null decision releases it back to the
+/// Mac; the hook prints nothing and Claude Code prompts in the terminal.
+function settleAsk(ask, decision, outcome, note) {
+  if (ask.done) return;
+  ask.done = true;
+  clearTimeout(ask.holdTimer);
+  dropAsk(ask);
+  try { ask.socket.write(JSON.stringify({ decision: decision || null }) + '\n'); } catch {}
+  try { ask.socket.end(); } catch {}
+  console.log(`[daemon] permission ${ask.tool} ${outcome}${note ? `: ${note}` : ''}`);
+  if (ws?.readyState === 1) {
+    ws.send(seal({ type: 'askResolved', askId: ask.id, sessionId: ask.sessionId, outcome, note: note || '' }));
+  }
+  sendSnapshot(true);
+}
+
+function onPermissionRequest(req, socket) {
+  const gate = holdPolicy();
+  if (!gate.hold) {
+    console.log(`[daemon] permission ${req.toolName} left on the Mac: ${gate.why}`);
+    try { socket.write('{"decision":null}\n'); } catch {}
+    try { socket.end(); } catch {}
+    return;
+  }
+  const { line, detail } = summarizeTool(req.toolName, req.toolInput);
+  const ask = {
+    id: `${Date.now().toString(36)}-${++askSeq}`,
+    sessionId: req.sessionId,
+    tool: req.toolName || 'tool',
+    line,
+    detail,
+    cwd: req.cwd || '',
+    at: Date.now(),
+    socket,
+    done: false,
+  };
+  ask.holdTimer = setTimeout(
+    () => settleAsk(ask, null, 'released', 'held too long, prompting on the Mac instead'),
+    Math.max(1, approvalConfig().holdMinutes) * 60_000,
+  );
+  // The hook dying (session quit, Ctrl+C, Claude restarted) closes the socket.
+  // Without this the card would linger on the phone with nothing behind it.
+  socket.on('close', () => settleAsk(ask, null, 'gone', 'the session stopped waiting'));
+  socket.on('error', () => {});
+  pendingAsks.set(ask.id, ask);
+  askQueue.set(ask.sessionId, [...(askQueue.get(ask.sessionId) || []), ask.id]);
+  console.log(`[daemon] permission held for the phone: ${ask.tool} ${ask.line.slice(0, 60)}`);
+  sendSnapshot(true);
+}
+
+function startApprovalServer(attempt = 0) {
+  // sun_path is 104 bytes on macOS. Over that, the bind fails in ways that
+  // read as EADDRINUSE rather than "path too long", so say it plainly.
+  if (Buffer.byteLength(ASK_SOCKET) > 100) {
+    console.log(`[daemon] home path too long for the approvals socket, permission prompts stay on the Mac: ${ASK_SOCKET}`);
+    return;
+  }
+  // A hard killed daemon leaves the socket file behind and bind fails with
+  // EADDRINUSE, so clear it first. If the bind still fails, another daemon is
+  // genuinely listening; it is about to be displaced on the relay and exit, so
+  // retry a few times rather than losing approvals until the next restart.
+  try { fs.unlinkSync(ASK_SOCKET); } catch {}
+  const server = net.createServer((socket) => {
+    socket.setEncoding('utf8');
+    let buf = '';
+    let handled = false;
+    socket.on('data', (chunk) => {
+      if (handled) return;
+      buf += chunk;
+      const nl = buf.indexOf('\n');
+      if (nl === -1) {
+        if (buf.length > 2_000_000) socket.destroy(); // a tool input this big is not real
+        return;
+      }
+      handled = true;
+      let req;
+      try { req = JSON.parse(buf.slice(0, nl)); } catch { req = null; }
+      if (!req || !req.sessionId) {
+        try { socket.write('{"decision":null}\n'); } catch {}
+        try { socket.end(); } catch {}
+        return;
+      }
+      onPermissionRequest(req, socket);
+    });
+    socket.on('error', () => {});
+  });
+  server.on('error', (e) => {
+    if (e.code === 'EADDRINUSE' && attempt < 5) {
+      setTimeout(() => startApprovalServer(attempt + 1), 1000);
+      return;
+    }
+    console.log(`[daemon] approvals socket unavailable, permission prompts stay on the Mac: ${e.message}`);
+  });
+  server.listen(ASK_SOCKET, () => {
+    try { fs.chmodSync(ASK_SOCKET, 0o600); } catch {}
+    approvalServerUp = true;
+    bustHostCache();
+    console.log(`[daemon] remote approvals ready (mode: ${approvalConfig().mode})`);
+  });
+}
+
+// Claude Code's own status for each session, as last seen on disk.
+const lastRawStatus = new Map(); // sessionId -> 'busy' | 'idle' | 'waiting' | ...
+
+/// Clear a held request that was answered on the Mac.
+///
+/// The socket closing is the fast path, but it cannot be relied on: Claude
+/// Code does not always kill the hook process when the human answers in the
+/// terminal, and a hook nobody killed keeps its socket open, so the phone
+/// would keep showing a card for a question that is already settled.
+///
+/// Claude Code writes "waiting" into its own session file while a prompt is
+/// on screen, so that dropping back to busy or idle is the real signal that
+/// the prompt is gone. The grace period covers the gap between our hook being
+/// called and Claude getting round to writing the status.
+const ANSWERED_GRACE_MS = 6000;
+function releaseAnsweredOnMac() {
+  if (!pendingAsks.size) return;
+  for (const ask of [...pendingAsks.values()]) {
+    if (Date.now() - ask.at < ANSWERED_GRACE_MS) continue;
+    const status = lastRawStatus.get(ask.sessionId);
+    // Unknown session: nothing to conclude, leave it to the socket or the cap.
+    if (!status || status === 'waiting') continue;
+    settleAsk(ask, null, 'gone', 'answered on the Mac');
+  }
+}
+
+/// Sitting back down at the Mac clears the phone card. Not because the Mac
+/// needs it back: Claude Code shows its own terminal prompt the whole time a
+/// hook is running (verified on 2.1.220), so the Mac is never blocked and can
+/// always answer. This just stops the phone showing a request you are about
+/// to deal with in front of you.
+function releaseAsksIfBack() {
+  if (!pendingAsks.size) return;
+  const cfg = approvalConfig();
+  if (cfg.mode !== 'away') return;
+  if (macIdleSeconds() >= cfg.awayAfterSeconds) return;
+  for (const ask of [...pendingAsks.values()]) {
+    settleAsk(ask, null, 'released', 'you came back to the Mac');
+  }
+}
+
+// ---------- self update ----------
+// The service runs from a frozen copy under ~/.groundcontrol/service, so
+// without this a user who installed once never sees another release. Checked
+// daily, always announced in the log and surfaced in the app.
+
+const UPDATE_CHECK_MS = 24 * 60 * 60 * 1000;
+const UPDATE_STAMP = path.join(CONF_DIR, 'last-update-check');
+
+/// Compare dotted numeric versions. Anything unparseable sorts as older, so a
+/// junk value from the registry can never trigger an update.
+function isNewer(candidate, current) {
+  const parse = (v) => String(v).split('.').map((n) => Number(n));
+  const a = parse(candidate), b = parse(current);
+  if (a.length !== 3 || a.some((n) => !Number.isInteger(n) || n < 0)) return false;
+  for (let i = 0; i < 3; i++) {
+    if ((a[i] || 0) > (b[i] || 0)) return true;
+    if ((a[i] || 0) < (b[i] || 0)) return false;
+  }
+  return false;
+}
+
+async function latestPublishedVersion() {
+  const res = await fetch(`https://registry.npmjs.org/${PACKAGE}/latest`, {
+    headers: { accept: 'application/vnd.npm.install-v1+json' },
+    signal: AbortSignal.timeout(15_000),
+  });
+  if (!res.ok) throw new Error(`registry ${res.status}`);
+  const body = await res.json();
+  if (!body?.version) throw new Error('registry response had no version');
+  return body.version;
+}
+
+/// Re-install the service from the newly published version. Runs detached
+/// because `service install` boots this very process out partway through;
+/// launchd then starts the replacement. installService stages everything
+/// before it touches the running service, so a failure here leaves the
+/// current daemon in place rather than nothing at all.
+function applyUpdate(version) {
+  console.log(`[daemon] updating to ${version}`);
+  const child = spawn('npx', ['-y', `${PACKAGE}@${version}`, 'service', 'install'], {
+    detached: true,
+    stdio: ['ignore', fs.openSync(LOG_FILE, 'a'), fs.openSync(LOG_FILE, 'a')],
+    env: process.env,
+  });
+  child.unref();
+}
+
+async function checkForUpdate({ force = false } = {}) {
+  // Only the launchd copy updates itself. A daemon someone is running by hand
+  // in a terminal must never swap itself out from under them.
+  if (!runsFromServiceDir && !force) return;
+  try {
+    const last = Number(fs.readFileSync(UPDATE_STAMP, 'utf8').trim());
+    if (!force && Number.isFinite(last) && Date.now() - last < UPDATE_CHECK_MS) return;
+  } catch {}
+  try { fs.writeFileSync(UPDATE_STAMP, String(Date.now())); } catch {}
+  let latest;
+  try { latest = await latestPublishedVersion(); }
+  catch (e) { console.log(`[daemon] update check failed: ${e.message}`); return; }
+  if (!isNewer(latest, VERSION)) return;
+  availableUpdate = latest;
+  bustHostCache();
+  sendSnapshot(true);
+  console.log(`[daemon] a newer version is available: ${latest} (running ${VERSION})`);
+  // Held requests belong to sessions that are about to lose their socket.
+  releaseAllAsks();
+  applyUpdate(latest);
+}
+
+/// A daemon shutting down must hand every held request back rather than leave
+/// sessions blocked on a socket that will never answer.
+function releaseAllAsks() {
+  for (const ask of [...pendingAsks.values()]) {
+    settleAsk(ask, null, 'released', 'the daemon stopped');
+  }
+}
+
 // ---------- relay connection ----------
 
 let ws = null;
@@ -1038,11 +1736,15 @@ function sendSnapshot(force = false) {
     console.log(`[daemon] snapshot failed: ${e.message}`);
     return;
   }
-  const json = JSON.stringify(sessions.map(({ lastMessage, ...s }) => ({ ...s, last: lastMessage?.text?.slice(0, 120) })));
+  for (const s of sessions) if (s.rawStatus) lastRawStatus.set(s.id, s.rawStatus);
+  const host = hostState();
+  // Host state joins the dedupe key, otherwise flipping approvals on would not
+  // reach a phone whose session list happened not to change.
+  const json = JSON.stringify([sessions.map(({ lastMessage, ...s }) => ({ ...s, last: lastMessage?.text?.slice(0, 120) })), host]);
   if (!force && json === lastSnapshotJson) return;
   lastSnapshotJson = json;
   if (ws?.readyState === 1) {
-    ws.send(seal({ type: 'snapshot', at: Date.now(), sessions }));
+    ws.send(seal({ type: 'snapshot', at: Date.now(), sessions, host }));
     console.log(`[daemon] snapshot -> ${sessions.length} session(s): ${sessions.map((s) => `${s.name}:${s.status}`).join(', ') || 'none'}`);
   }
 }
@@ -1079,6 +1781,46 @@ async function handleCommand(cmd) {
     ws?.send(seal({ type: 'transcript', sessionId: cmd.sessionId, messages: readMessages(cmd.sessionId) }));
   } else if (cmd.type === 'unwatch' && cmd.sessionId) {
     unwatchTranscript(cmd.sessionId);
+  } else if (cmd.type === 'setApprovals') {
+    // A deliberate tap in the app, with the app explaining what it adds, is
+    // the consent for this. A backup is still written before any change.
+    let result;
+    if (cmd.enabled === false) {
+      writeApprovalConfig({ mode: 'off' });
+      result = uninstallApprovalHook();
+      console.log('[daemon] remote approvals turned off from the phone');
+    } else {
+      const mode = ['away', 'always'].includes(cmd.mode) ? cmd.mode : 'away';
+      writeApprovalConfig({ mode });
+      result = installApprovalHook({ consent: true });
+      console.log(`[daemon] remote approvals turned on from the phone (mode: ${mode})`);
+    }
+    bustHostCache();
+    sendSnapshot(true);
+    ws?.send(seal({
+      type: 'approvalsResult',
+      ok: !!result.ok,
+      error: result.ok ? '' : (result.reason || 'could not change the setting'),
+      host: hostState(),
+    }));
+  } else if (cmd.type === 'approve' || cmd.type === 'deny') {
+    const ask = cmd.askId ? pendingAsks.get(cmd.askId) : null;
+    if (!ask) {
+      // Answered on the Mac, expired, or the session moved on while the tap
+      // was in flight. Tell the phone so the card clears instead of hanging.
+      return ws?.send(seal({
+        type: 'askResolved', askId: cmd.askId || '', sessionId: cmd.sessionId || '',
+        outcome: 'gone', note: 'that request is no longer waiting',
+      }));
+    }
+    if (cmd.type === 'approve') {
+      settleAsk(ask, { behavior: 'allow', ...(cmd.always ? { alwaysAllow: true } : {}) },
+        'allowed', cmd.always ? 'from the phone, and always from now on' : 'from the phone');
+    } else {
+      const reason = (cmd.text || '').trim();
+      settleAsk(ask, { behavior: 'deny', message: reason || 'Denied from the Ground Control app.' },
+        'denied', reason ? `from the phone: ${reason.slice(0, 60)}` : 'from the phone');
+    }
   } else if (cmd.type === 'ping' && cmd.sessionId) {
     const s = readSessions().find((x) => x.id === cmd.sessionId);
     ws?.send(seal({ type: 'pong', sessionId: cmd.sessionId, alive: !!s, status: s?.status || 'gone', at: Date.now() }));
@@ -1231,9 +1973,20 @@ function connect() {
   ws.on('pong', () => { lastPongAt = Date.now(); });
   ws.on('message', (data) => {
     const str = data.toString();
-    if (str === '{"sys":"client-joined"}') { console.log('[daemon] phone connected'); sendSnapshot(true); return; }
+    if (str === '{"sys":"client-joined"}') {
+      notePhoneSeen();
+      console.log('[daemon] phone connected');
+      sendSnapshot(true);
+      return;
+    }
     if (str.startsWith('{"sys"')) return;
-    try { handleCommand(open(str))?.catch?.(() => {}); } catch (e) { console.log('[daemon] bad message (wrong key?)'); }
+    // A command that decrypts proves a real paired phone is on the other end,
+    // which is what the approval policy checks before holding a prompt.
+    try {
+      const cmd = open(str);
+      notePhoneSeen();
+      handleCommand(cmd)?.catch?.(() => {});
+    } catch (e) { console.log('[daemon] bad message (wrong key?)'); }
   });
   ws.on('close', (code) => {
     if (code === 4001) {
@@ -1248,6 +2001,32 @@ function connect() {
 
 connect();
 if (process.platform === 'darwin') requestAutomationGrant();
+
+// Remote approvals. The daemon refreshes the hook script itself, which is our
+// own file, but never edits ~/.claude/settings.json: a background process is
+// the last thing that should rewrite another tool's config unasked. Turning it
+// on is an explicit `groundcontrol approvals on`.
+try { stageHookFile(); } catch (e) { console.log(`[daemon] could not refresh the permission hook: ${e.message}`); }
+const hookState = installApprovalHook();  // consent defaults to false: reports, never writes
+if (hookState.unchanged) console.log('[daemon] permission hook installed, remote approvals available');
+else if (hookState.needsConsent) console.log('[daemon] permission hook not installed (run: groundcontrol approvals on)');
+else if (!hookState.ok) console.log(`[daemon] permission hook unavailable: ${hookState.reason}`);
+for (const cmd of hookState.foreign || []) console.log(`[daemon] another app also answers permission requests: ${cmd}`);
+startApprovalServer();
+setInterval(releaseAsksIfBack, 3000);
+setInterval(releaseAnsweredOnMac, 2000);
+
+// Self update. Staggered off startup so a login storm does not hit the
+// registry at once, then re-checked hourly (the daily stamp does the gating).
+setTimeout(() => { checkForUpdate().catch(() => {}); }, 60_000);
+setInterval(() => { checkForUpdate().catch(() => {}); }, 60 * 60 * 1000);
+
+// Held requests are sockets a Claude session is blocked on. Hand them back
+// before going away, or those sessions sit frozen until the hook times out.
+for (const sig of ['SIGINT', 'SIGTERM']) {
+  process.on(sig, () => { releaseAllAsks(); process.exit(0); });
+}
+
 setInterval(sendSnapshot, 1500);
 // Heartbeat traffic keeps the Cloudflare socket alive in both directions and
 // lets the phone detect a dead link; missing pongs force a reconnect here.

package/hook.mjs

@@ -0,0 +1,109 @@
+// Ground Control PermissionRequest hook — runs inside Claude Code, not the daemon.
+//
+// Claude Code invokes this whenever a tool call needs a permission decision. It
+// hands the request to the local daemon over a unix socket; the daemon decides
+// whether to hold it for the phone or let it fall straight through.
+//
+// The one rule that matters here: when anything at all goes wrong (no daemon,
+// no answer, malformed reply, broken pipe) this exits 0 printing nothing, which
+// Claude Code reads as "no decision" and shows its normal terminal prompt. A
+// user who has never opened the app must not be able to tell this is installed.
+
+import fs from 'node:fs';
+import net from 'node:net';
+import os from 'node:os';
+import path from 'node:path';
+
+const SOCKET = path.join(os.homedir(), '.groundcontrol', 'approvals.sock');
+// Backstop only. The daemon settles every request itself, either with a
+// decision or with an explicit pass, so reaching this means the daemon wedged.
+const HARD_CAP_MS = 12 * 60 * 60 * 1000;
+const STDIN_MS = 5000;
+
+/// Exit without a decision. Claude Code prompts in the terminal as usual.
+function pass() {
+  process.exit(0);
+}
+
+function decide(decision) {
+  // An unrecognised behaviour would be a silent deny in some Claude versions,
+  // so anything that is not a clean allow/deny falls back to the prompt.
+  if (!decision || (decision.behavior !== 'allow' && decision.behavior !== 'deny')) pass();
+  const out = JSON.stringify({
+    hookSpecificOutput: { hookEventName: 'PermissionRequest', decision },
+  });
+  // writeSync, not process.stdout.write: stdout is a pipe here, so an async
+  // write followed by process.exit can truncate. Half a JSON object would be
+  // unparseable, which is safe (Claude prompts) but silently loses the answer.
+  try { fs.writeSync(1, out); } catch { /* nothing left to do but pass */ }
+  process.exit(0);
+}
+
+function readStdin() {
+  return new Promise((resolve) => {
+    let buf = '';
+    const done = (v) => { clearTimeout(timer); resolve(v); };
+    const timer = setTimeout(() => done(buf), STDIN_MS);
+    process.stdin.setEncoding('utf8');
+    process.stdin.on('data', (d) => { buf += d; });
+    process.stdin.on('end', () => done(buf));
+    process.stdin.on('error', () => done(''));
+  });
+}
+
+const raw = await readStdin();
+let payload;
+try { payload = JSON.parse(raw); } catch { pass(); }
+if (!payload || typeof payload !== 'object') pass();
+
+// Only session_id is genuinely required: it is what ties the request to a
+// session on the island. Claude Code 2.1.220 sends no tool_use_id on this
+// event (verified against a live session), and the daemon mints its own
+// request id anyway, so requiring one here would drop every real request.
+if (!payload.session_id) pass();
+
+const sock = net.connect(SOCKET);
+sock.setEncoding('utf8');
+
+let settled = false;
+const finish = (fn, arg) => {
+  if (settled) return;
+  settled = true;
+  try { sock.destroy(); } catch {}
+  fn(arg);
+};
+
+const cap = setTimeout(() => finish(pass), HARD_CAP_MS);
+cap.unref?.();
+
+// No daemon, stale socket file, wrong permissions: all of these land here and
+// all of them mean "behave exactly like Ground Control is not installed".
+sock.on('error', () => finish(pass));
+// A close before any reply means the daemon died mid-decision.
+sock.on('close', () => finish(pass));
+
+sock.on('connect', () => {
+  sock.write(JSON.stringify({
+    v: 1,
+    sessionId: payload.session_id,
+    toolUseId: payload.tool_use_id || '',
+    toolName: payload.tool_name || 'tool',
+    toolInput: payload.tool_input || {},
+    cwd: payload.cwd || '',
+    permissionMode: payload.permission_mode || '',
+    permissionContext: payload.permission_context || null,
+  }) + '\n');
+});
+
+let inbox = '';
+sock.on('data', (chunk) => {
+  inbox += chunk;
+  const nl = inbox.indexOf('\n');
+  if (nl === -1) return;
+  let reply;
+  try { reply = JSON.parse(inbox.slice(0, nl)); } catch { return finish(pass); }
+  // decision null is the daemon explicitly passing (you are at the Mac, the
+  // hold expired, or the phone never answered).
+  if (!reply || !reply.decision) return finish(pass);
+  finish(decide, reply.decision);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clastres/groundcontrol",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "See and command your Claude Code sessions from your iPhone. Pairs the Ground Control app with the agents running on this Mac, end to end encrypted.",
   "bin": {
     "groundcontrol": "bin/groundcontrol.mjs"