@clastres/groundcontrol 0.1.9 → 0.1.10

package/daemon.mjs

@@ -22,7 +22,7 @@ import { createRequire } from 'node:module';
 
 const execFileP = promisify(execFile);
 
-const VERSION = '0.1.9';
+const VERSION = '0.1.10';
 const PACKAGE = '@clastres/groundcontrol';
 
 // ---------- config / pairing ----------
@@ -1673,6 +1673,10 @@ function hostState() {
       settingsOk: settings !== null,
       socketOk: approvalServerUp,
     },
+    // Which agents the phone may start here. An empty list is a real answer
+    // (nothing launchable found); the whole field missing is an older daemon,
+    // and the app hides the button rather than offering one that cannot work.
+    launch: { providers: launchProviders() },
     updateAvailable: availableUpdate,
   };
   hostCache = { at: Date.now(), value };
@@ -2106,6 +2110,14 @@ async function handleCommand(cmd) {
       settleAsk(ask, { behavior: 'deny', message: reason || 'Denied from the Ground Control app.' },
         'denied', reason ? `from the phone: ${reason.slice(0, 60)}` : 'from the phone');
     }
+  } else if (cmd.type === 'projects') {
+    ws?.send(seal({
+      type: 'projects',
+      projects: knownProjects().map((p) => ({ path: p.path, name: p.name, at: p.at })),
+      providers: launchProviders(),
+    }));
+  } else if (cmd.type === 'launch') {
+    await launchSession(cmd);
   } else if (cmd.type === 'ping' && cmd.sessionId) {
     const s = readSessions().find((x) => x.id === cmd.sessionId);
     ws?.send(seal({ type: 'pong', sessionId: cmd.sessionId, alive: !!s, status: s?.status || 'gone', at: Date.now() }));
@@ -2258,6 +2270,166 @@ function promptHeadless(session, text) {
   watchTranscript(session.id);
 }
 
+// ---------- launching a new pilot ----------
+// Everything above answers a session that already exists. This starts one.
+//
+// The phone never sends a path. It picks from a list this daemon built out of
+// what is already on disk, and the launch validates the choice against that
+// same list before running anything, so the worst a stolen channel can do is
+// open a terminal in a folder you have already worked in today.
+
+const PROJECT_LIMIT = 40;
+/// A folder nobody has touched in three months is not what you meant to open
+/// from your phone, and the list has to fit on a phone screen.
+const PROJECT_MAX_AGE_MS = 90 * 24 * 60 * 60 * 1000;
+
+/// The real working directory behind one of Claude Code's project folders.
+///
+/// The folder name is the path with every slash turned into a dash, which
+/// cannot be undone: a directory with a dash in its own name decodes to
+/// something that was never there. The transcripts inside record the actual
+/// cwd, so read it rather than guess it.
+function projectCwd(dir) {
+  let files = [];
+  try {
+    files = fs.readdirSync(dir)
+      .filter((f) => f.endsWith('.jsonl'))
+      .map((f) => {
+        const p = path.join(dir, f);
+        try { return { p, at: fs.statSync(p).mtimeMs }; } catch { return null; }
+      })
+      .filter(Boolean)
+      .sort((a, b) => b.at - a.at);
+  } catch { return null; }
+  if (!files.length) return null;
+
+  for (const { p, at } of files.slice(0, 3)) {
+    let head = '';
+    try {
+      const fd = fs.openSync(p, 'r');
+      const buf = Buffer.alloc(64 * 1024);
+      const read = fs.readSync(fd, buf, 0, buf.length, 0);
+      fs.closeSync(fd);
+      head = buf.subarray(0, read).toString('utf8');
+    } catch { continue; }
+    for (const line of head.split('\n')) {
+      if (!line.trim()) continue;
+      let e; try { e = JSON.parse(line); } catch { continue; }
+      if (typeof e.cwd === 'string' && e.cwd) return { cwd: e.cwd, at };
+    }
+  }
+  return null;
+}
+
+let projectsCache = { at: 0, value: [] };
+function knownProjects() {
+  if (Date.now() - projectsCache.at < 60_000) return projectsCache.value;
+  const byPath = new Map();
+  const note = (cwd, at) => {
+    if (!cwd || !fs.existsSync(cwd)) return;
+    const prev = byPath.get(cwd);
+    if (!prev || prev.at < at) byPath.set(cwd, { path: cwd, name: path.basename(cwd) || cwd, at });
+  };
+
+  let dirs = [];
+  try { dirs = fs.readdirSync(PROJECTS_DIR); } catch {}
+  for (const d of dirs) {
+    const found = projectCwd(path.join(PROJECTS_DIR, d));
+    if (found) note(found.cwd, found.at);
+  }
+  // Whatever is flying right now, even if its transcript has not landed yet.
+  for (const s of readSessions()) note(s.cwd, Date.now());
+
+  const cutoff = Date.now() - PROJECT_MAX_AGE_MS;
+  const value = [...byPath.values()]
+    .filter((p) => p.at >= cutoff)
+    .sort((a, b) => b.at - a.at)
+    .slice(0, PROJECT_LIMIT);
+  projectsCache = { at: Date.now(), value };
+  return value;
+}
+
+/// Which agents this Mac can start from the phone.
+///
+/// Claude Code only, on purpose. Every provider here has to be one whose bare
+/// command opens an interactive session that then shows up on the island, and
+/// claude is the one that has been checked. Codex and the kimi CLIs are read
+/// and written by the daemon already, but nobody has watched either of them
+/// come up this way, so offering them would be a button that might do nothing.
+function launchProviders() {
+  return claudeBin() ? ['claude'] : [];
+}
+
+/// Single quotes for the shell, then AppleScript quoting on top. Both layers
+/// matter: the directory comes from disk and the first order comes from your
+/// thumbs.
+const shq = (s) => `'${String(s).replace(/'/g, `'\\''`)}'`;
+
+let lastLaunchAt = 0;
+
+async function launchSession(cmd) {
+  const fail = (error) => ws?.send(seal({ type: 'launchResult', ok: false, error }));
+
+  const providers = launchProviders();
+  const provider = cmd.provider || 'claude';
+  if (!providers.includes(provider)) {
+    return fail(`This Mac cannot start a ${provider} session from the phone. Ground Control could not find the ${provider} command on your PATH.`);
+  }
+  const target = knownProjects().find((p) => p.path === cmd.cwd);
+  if (!target) {
+    // The list is a minute old at most, so this is almost always a folder that
+    // was renamed or deleted since it was drawn.
+    return fail('That folder is not on this Mac any more. Pull the list again.');
+  }
+  if (Date.now() - lastLaunchAt < 5000) {
+    return fail('One at a time. Give the last launch a few seconds.');
+  }
+
+  const apps = terminalApps();
+  const first = (cmd.text || '').trim();
+  // Claude Code takes an opening prompt as a positional argument and starts the
+  // normal interactive session with it already submitted, which beats waiting a
+  // guessed number of seconds for a REPL to boot and then typing at it.
+  const line = `cd ${shq(target.path)} && ${provider}${first ? ` ${shq(first)}` : ''}`;
+
+  lastLaunchAt = Date.now();
+  let opened = null;
+  if (apps.iterm) {
+    const r = await osascript(`tell application "iTerm2"
+  activate
+  set w to (create window with default profile)
+  tell current session of w to write text "${escapeAS(line)}"
+  return "ok"
+end tell`);
+    if (r === 'ok') opened = 'iTerm2';
+  }
+  if (!opened) {
+    // Terminal.app is on every Mac, and telling it to do a script launches it
+    // if it was closed, so this is the path that always exists.
+    const r = await osascript(`tell application "Terminal"
+  activate
+  do script "${escapeAS(line)}"
+  return "ok"
+end tell`);
+    if (r === 'ok') opened = 'Terminal';
+  }
+
+  if (!opened) {
+    lastLaunchAt = 0;
+    if (automationDenied) {
+      return fail('Your Mac is blocking terminal control. Open System Settings, Privacy and Security, Automation, and allow node to control your terminal app. Then try again.');
+    }
+    return fail('Could not open a terminal window on your Mac.');
+  }
+
+  console.log(`[daemon] launched ${provider} in ${target.path} via ${opened}`);
+  // The new session reaches the island through the same discovery every other
+  // one does, which takes a few seconds. Say so rather than implying the pilot
+  // is already there.
+  ws?.send(seal({ type: 'launchResult', ok: true, cwd: target.path, note: `${provider} is starting in ${target.name}` }));
+  sendSnapshot(true);
+}
+
 let lastPongAt = Date.now();
 
 function connect() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clastres/groundcontrol",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "description": "See and command your coding agents from your iPhone. Pairs the Ground Control app with Claude Code, Codex, Kimi and Grok Bot sessions running on this Mac, end to end encrypted.",
   "bin": {
     "groundcontrol": "bin/groundcontrol.mjs"

package/test/launch.mjs

@@ -0,0 +1,73 @@
+// Starting a session from the phone crosses the two languages twice: the app
+// sends a command the daemon has to know, and the daemon answers with a reply
+// type the app has to decode. Either half can be renamed on its own and
+// nothing complains until a button on a phone quietly does nothing.
+//
+// Static checks on both sources, in the same spirit as providers.mjs. They do
+// not prove a terminal opens; they prove the two ends are still talking about
+// the same thing.
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const daemon = fs.readFileSync(path.join(here, '..', 'daemon.mjs'), 'utf8');
+const app = path.join(here, '..', '..', 'ios', 'GroundControl');
+const client = fs.readFileSync(path.join(app, 'RelayClient.swift'), 'utf8');
+const models = fs.readFileSync(path.join(app, 'Models.swift'), 'utf8');
+
+let failures = 0;
+const check = (label, cond, detail = '') => {
+  console.log(`${cond ? 'ok  ' : 'FAIL'} ${label}${detail ? `  ${detail}` : ''}`);
+  if (!cond) failures++;
+};
+
+// ---------- every command the app sends, the daemon handles ----------
+
+const sent = [...client.matchAll(/Command\(type:\s*"([^"]+)"/g)].map((m) => m[1]);
+check('the app sends commands at all', sent.length >= 8, `${sent.length} found`);
+for (const type of [...new Set(sent)].sort()) {
+  check(`the daemon handles "${type}"`, daemon.includes(`cmd.type === '${type}'`));
+}
+
+// ---------- every reply the daemon sends, the app decodes ----------
+
+// hb is the daemon's heartbeat. It carries nothing, and the app wants it only
+// for the fact that something arrived, which every message does: receiving it
+// stamps lastActivity and it falls through the switch on purpose.
+const replies = [...daemon.matchAll(/seal\(\{\s*\n?\s*type:\s*'([^']+)'/g)].map((m) => m[1]);
+for (const type of [...new Set(replies)].sort().filter((t) => t !== 'hb')) {
+  // The app switches on envelope type. "snapshot" and the rest each get a case.
+  check(`the app decodes "${type}"`, client.includes(`case "${type}"`));
+}
+
+// ---------- the launch payload ----------
+
+check('the launch command carries a folder', /var cwd: String\?/.test(models));
+check('the launch command carries a provider', /var provider: String\?/.test(models));
+check('the app models the folders the Mac offers', /struct ProjectDir/.test(models));
+check('the app models what the Mac will launch', /struct LaunchInfo/.test(models));
+check('the host block reports launchable providers', /launch:\s*\{\s*providers:\s*launchProviders\(\)\s*\}/.test(daemon));
+
+// ---------- the folder has to come from the Mac's own list ----------
+// The phone must never be able to name a path. If this stops being true, a
+// stolen channel turns into "run an agent anywhere on this Mac".
+
+const body = daemon.slice(daemon.indexOf('async function launchSession'));
+check('a launch validates the folder against the offered list',
+  /knownProjects\(\)\.find\(\(p\) => p\.path === cmd\.cwd\)/.test(body));
+check('a launch refuses a folder that is not on the list',
+  body.indexOf('return fail(') < body.indexOf('osascript'));
+
+// ---------- only what has actually been checked is offered ----------
+// Codex and the kimi CLIs are read and written elsewhere in this daemon, but
+// nobody has watched either of them come up from a cold terminal launch, so
+// they are deliberately not on this list. Adding one here without checking it
+// ships a button that may do nothing.
+
+const providers = daemon.slice(daemon.indexOf('function launchProviders'));
+const listed = providers.slice(0, providers.indexOf('}'));
+check('only claude is offered for launch', /claudeBin\(\) \? \['claude'\] : \[\]/.test(listed));
+
+console.log(failures ? `\n${failures} check(s) failed` : '\nall checks passed');
+process.exit(failures ? 1 : 0);