@longleash/cli 0.1.0-rc.1

package/runtime/app/dist/sw.js

@@ -0,0 +1,138 @@
+/**
+ * Keeps the installed app bootable when the daemon is unreachable — which is the entire
+ * point of the relay: away from home, nothing can serve index.html, so the phone must
+ * already have it. Network-first with cache fallback: updates flow whenever the laptop is
+ * reachable, and the cached shell carries the app the rest of the time.
+ */
+const CACHE = 'longleash-shell-v3'
+
+self.addEventListener('install', () => {
+  self.skipWaiting()
+})
+
+self.addEventListener('activate', (event) => {
+  event.waitUntil(
+    (async () => {
+      // A new worker owns the cache outright; stale shells from old versions are the
+      // reason a phone can keep showing a design that no longer exists.
+      for (const name of await caches.keys()) {
+        if (name !== CACHE) await caches.delete(name)
+      }
+      await self.clients.claim()
+    })(),
+  )
+})
+
+/**
+ * Lock-screen alerts. The payload carries IDs only — the daemon enforces it — so the
+ * words shown here are deliberately generic. The in-app inbox is the source of truth;
+ * this is just the tap on the shoulder.
+ */
+self.addEventListener('push', (event) => {
+  let data = {}
+  try {
+    data = event.data ? event.data.json() : {}
+  } catch {
+    // An unreadable payload still means "something needs you".
+  }
+  event.waitUntil(
+    (async () => {
+      // A test alert always shows — its entire purpose is to be seen.
+      if (data.t === 'test') {
+        await self.registration.showNotification('LongLeash', {
+          body: 'Test alert — lock-screen alerts are working.',
+          tag: 'longleash-test',
+          data,
+          icon: '/icon-192.png',
+          badge: '/icon-192.png',
+        })
+        return
+      }
+      // If the app is open and visible the inbox already shows it; don't double-tap.
+      const windows = await self.clients.matchAll({ type: 'window', includeUncontrolled: true })
+      if (windows.some((w) => w.visibilityState === 'visible')) return
+      await self.registration.showNotification('LongLeash', {
+        // The kind, never the content: "a question" tells you what KIND of thirty
+        // seconds this will be, without putting a word of the question on a lock screen.
+        body: data.t === 'question' ? 'An agent has a question for you.' : 'A session needs you.',
+        tag: data.approvalId || 'longleash-approval',
+        data,
+        icon: '/icon-192.png',
+        badge: '/icon-192.png',
+      })
+    })(),
+  )
+})
+
+/**
+ * Tapping an alert must land on the thing the alert was about.
+ *
+ * It used to focus any window, or open '/', which dropped you on the home screen to hunt for
+ * the session that had just interrupted you. The payload has carried the session id all along.
+ *
+ * Two paths, because both really happen: the app may already be open (postMessage, so no
+ * reload and no lost scroll position), or it may be cold (carry the id in the URL).
+ */
+self.addEventListener('notificationclick', (event) => {
+  event.notification.close()
+  const data = event.notification.data ?? {}
+  const sessionId = typeof data.sessionId === 'string' ? data.sessionId : null
+
+  event.waitUntil(
+    (async () => {
+      const windows = await self.clients.matchAll({ type: 'window', includeUncontrolled: true })
+      // Preview/welcome pages may also be controlled clients. Pick the actual app shell;
+      // focusing an arbitrary window is what made a notification appear to land on Home.
+      const existing = windows.find((client) => {
+        try {
+          const url = new URL(client.url)
+          return url.origin === self.location.origin && (url.pathname === '/' || url.pathname === '/index.html')
+        } catch {
+          return false
+        }
+      })
+      if (existing) {
+        if (sessionId !== null) {
+          existing.postMessage({ type: 'longleash:open-session', sessionId })
+        }
+        return existing.focus()
+      }
+      // IDs only, exactly as the payload is — a session id names WHICH conversation, never
+      // anything about it.
+      return self.clients.openWindow(sessionId === null ? '/' : `/?session=${encodeURIComponent(sessionId)}`)
+    })(),
+  )
+})
+
+self.addEventListener('fetch', (event) => {
+  const request = event.request
+  if (request.method !== 'GET') return
+  const url = new URL(request.url)
+  if (url.origin !== location.origin) return
+  // Liveness and pairing must never be answered from cache: a cached /health would make an
+  // unreachable laptop look reachable, which is precisely the lie this app exists to avoid.
+  if (url.pathname === '/health' || url.pathname === '/pair' || url.pathname.startsWith('/api/')) return
+
+  // Navigations bypass the HTTP cache entirely: the shell must always revalidate with
+  // the server (cheap — it answers 304 unless the build changed).
+  const network = request.mode === 'navigate' ? fetch(request, { cache: 'no-cache' }) : fetch(request)
+  event.respondWith(
+    network
+      .then((response) => {
+        if (response.ok) {
+          const copy = response.clone()
+          caches.open(CACHE).then((cache) => cache.put(request, copy))
+        }
+        return response
+      })
+      .catch(async () => {
+        const cached = await caches.match(request)
+        if (cached) return cached
+        if (request.mode === 'navigate') {
+          const shell = await caches.match('/index.html')
+          if (shell) return shell
+        }
+        return Response.error()
+      }),
+  )
+})

package/runtime/app/dist/welcome.html

@@ -0,0 +1,44 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover" />
+    <meta name="color-scheme" content="dark" />
+    <meta name="theme-color" content="#0d0e10" />
+    <meta
+      name="description"
+      content="Run Claude Code and Codex on your laptop, then securely review, steer, approve, tune, delegate, and hand off their sessions from your phone."
+    />
+    <meta name="robots" content="index, follow" />
+    <meta property="og:type" content="website" />
+    <meta property="og:title" content="LongLeash | Leave the desk. Keep control." />
+    <meta
+      property="og:description"
+      content="A local-first, end-to-end encrypted control plane for Claude Code and Codex sessions on your laptop."
+    />
+    <meta name="twitter:card" content="summary" />
+    <link rel="icon" href="/favicon.png" type="image/png" />
+    <link
+      rel="preload"
+      href="/fonts/instrument-sans-latin.woff2"
+      as="font"
+      type="font/woff2"
+      crossorigin
+    />
+    <link
+      rel="preload"
+      href="/fonts/instrument-serif-latin.woff2"
+      as="font"
+      type="font/woff2"
+      crossorigin
+    />
+    <title>LongLeash | Leave the desk. Keep control.</title>
+    <script type="module" crossorigin src="/assets/welcome-CG_rEa--.js"></script>
+    <link rel="modulepreload" crossorigin href="/assets/styles-C-1gzhnT.js">
+    <link rel="stylesheet" crossorigin href="/assets/styles-CkAMG7sK.css">
+    <link rel="stylesheet" crossorigin href="/assets/welcome-ai7kxCj7.css">
+  </head>
+  <body>
+    <div id="root"></div>
+  </body>
+</html>

package/runtime/daemon/bin/longleash-devices.mjs

@@ -0,0 +1,203 @@
+#!/usr/bin/env node
+/**
+ * Paired devices, and how to un-pair one you no longer trust.
+ *
+ *   longleash devices              list every device that can reach this laptop
+ *   longleash revoke <id|name>     cut one off, immediately and permanently
+ *
+ * This runs on the LAPTOP on purpose. Revocation is authorised by a 0600 secret only a
+ * local process can read, which makes physical possession of the machine the root of
+ * trust: someone holding a stolen, unlocked phone can neither revoke your other devices
+ * nor un-revoke themselves.
+ *
+ * It talks to the RUNNING daemon rather than editing the database directly, because the
+ * things that make revocation real — closing the open socket, shutting the relay room,
+ * dropping the push subscription — live inside that process. A row updated behind its
+ * back would leave a stolen phone revoked on paper and still listening in practice.
+ */
+import { readFileSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join } from 'node:path'
+
+const dataDir = process.env.LONGLEASH_DATA ?? join(homedir(), '.longleash')
+
+function endpoint() {
+  let raw
+  try {
+    raw = JSON.parse(readFileSync(join(dataDir, 'hook-endpoint.json'), 'utf8'))
+  } catch {
+    return null
+  }
+  return raw?.url && raw?.secret ? raw : null
+}
+
+const NOT_RUNNING = [
+  'LongLeash does not appear to be running, so there is nothing to revoke against.',
+  '',
+  'Revoking has to go through the running daemon: that is what actually closes the',
+  'device’s connection and shuts its relay room. Start it and try again:',
+  '',
+  '  longleash',
+].join('\n')
+
+async function call(path, init) {
+  const ep = endpoint()
+  if (ep === null) {
+    console.error(NOT_RUNNING)
+    process.exit(1)
+  }
+  const base = ep.url.replace(/\/hook$/, '')
+  let response
+  try {
+    response = await fetch(`${base}${path}`, {
+      ...init,
+      headers: { 'content-type': 'application/json', 'x-longleash-hook': ep.secret, ...(init?.headers ?? {}) },
+      signal: AbortSignal.timeout(5_000),
+    })
+  } catch {
+    console.error(NOT_RUNNING)
+    process.exit(1)
+  }
+  if (response.status === 401) {
+    console.error('The daemon refused this request. Restart LongLeash and try again.')
+    process.exit(1)
+  }
+  return response
+}
+
+const ago = (ms) => {
+  if (ms === null || ms === undefined) return 'never'
+  const mins = Math.floor((Date.now() - ms) / 60_000)
+  if (mins < 1) return 'just now'
+  if (mins < 60) return `${mins}m ago`
+  const hours = Math.floor(mins / 60)
+  if (hours < 24) return `${hours}h ago`
+  return `${Math.floor(hours / 24)}d ago`
+}
+
+async function list() {
+  const response = await call('/devices', { method: 'GET' })
+  const { devices } = await response.json()
+  const live = devices.filter((d) => d.revokedAt === null)
+  if (live.length === 0) {
+    console.log('No devices are paired. Scan the QR code shown by `longleash` to add your phone.')
+    return devices
+  }
+  console.log('')
+  console.log('  DEVICE                                  LAST SEEN     STATUS')
+  for (const d of live) {
+    const status = d.connected ? 'connected' : 'idle'
+    console.log(`  ${d.deviceId.padEnd(38).slice(0, 38)}  ${ago(d.lastSeenAt).padEnd(12)}  ${status}`)
+    console.log(`    ${d.name.slice(0, 70)}`)
+  }
+  const revoked = devices.length - live.length
+  console.log('')
+  if (revoked > 0) console.log(`  (${revoked} revoked device${revoked === 1 ? '' : 's'} not shown)`)
+  console.log('  Lost a phone?  longleash revoke <device-id>')
+  console.log('')
+  return devices
+}
+
+/**
+ * Cut every paired device loose at once, for when testing has left a pile of them and you
+ * want one clean phone again. Deliberately a separate, explicit flag: `revoke <id>` should
+ * never be one typo away from cutting off everything.
+ */
+async function revokeAll() {
+  const response = await call('/devices', { method: 'GET' })
+  const { devices } = await response.json()
+  const live = devices.filter((d) => d.revokedAt === null)
+  if (live.length === 0) {
+    console.log('Nothing is paired. Scan the QR from `longleash` to add your phone.')
+    return
+  }
+
+  console.log('')
+  console.log(`About to revoke ALL ${live.length} paired device(s).`)
+  console.log('Every one of them disconnects immediately and cannot reconnect.')
+  console.log('You will pair again by scanning the QR code that `longleash` prints.')
+  console.log('')
+
+  let done = 0
+  for (const device of live) {
+    const result = await call('/devices/revoke', {
+      method: 'POST',
+      body: JSON.stringify({ deviceId: device.deviceId }),
+    })
+    if (result.ok) done += 1
+    else console.error(`  could not revoke ${device.deviceId}`)
+  }
+
+  console.log(`Revoked ${done} of ${live.length}.`)
+  console.log('Their relay rooms are shut and their notifications have stopped.')
+  console.log('')
+  console.log('Scan the QR code in the `longleash` terminal to pair your phone again.')
+  console.log('')
+}
+
+async function revoke(needle) {
+  const response = await call('/devices', { method: 'GET' })
+  const { devices } = await response.json()
+  const live = devices.filter((d) => d.revokedAt === null)
+
+  // Match on the full id, an unambiguous prefix, or the device name — nobody types a
+  // full opaque id from memory while their phone is in someone else's pocket.
+  const lower = needle.toLowerCase()
+  let matches = live.filter((d) => d.deviceId === needle)
+  if (matches.length === 0) {
+    matches = live.filter(
+      (d) => d.deviceId.toLowerCase().startsWith(lower) || d.name.toLowerCase().includes(lower),
+    )
+  }
+
+  if (matches.length === 0) {
+    console.error(`No paired device matches "${needle}".`)
+    console.error('Run `longleash devices` to see what is paired.')
+    process.exit(1)
+  }
+  if (matches.length > 1) {
+    // Never guess which device to cut off.
+    console.error(`"${needle}" matches ${matches.length} devices. Be more specific:`)
+    for (const d of matches) console.error(`  ${d.deviceId}  ${d.name.slice(0, 50)}`)
+    process.exit(1)
+  }
+
+  const target = matches[0]
+  const done = await call('/devices/revoke', {
+    method: 'POST',
+    body: JSON.stringify({ deviceId: target.deviceId }),
+  })
+  if (!done.ok) {
+    console.error(`Could not revoke ${target.deviceId}: ${(await done.json()).reason ?? done.status}`)
+    process.exit(1)
+  }
+
+  console.log('')
+  console.log(`Revoked ${target.deviceId}`)
+  console.log(`  ${target.name.slice(0, 70)}`)
+  console.log('')
+  console.log('That device is now disconnected, its relay room is shut, and it will receive')
+  console.log('no further notifications. It cannot reconnect, and this cannot be undone —')
+  console.log('pair the phone again from scratch if it turns out to be yours after all.')
+  console.log('')
+}
+
+const [command, argument] = process.argv.slice(2)
+try {
+  if (command === 'revoke' && (argument === '--all' || argument === 'all')) {
+    await revokeAll()
+  } else if (command === 'revoke') {
+    if (!argument) {
+      console.error('Which device? Run `longleash devices` to see them, then:')
+      console.error('  longleash revoke <device-id>      one device')
+      console.error('  longleash revoke --all           every device, to start fresh')
+      process.exit(1)
+    }
+    await revoke(argument)
+  } else {
+    await list()
+  }
+} catch (error) {
+  console.error(`Could not talk to LongLeash: ${error instanceof Error ? error.message : String(error)}`)
+  process.exit(1)
+}