@longleash/cli 0.1.0-rc.11 → 0.1.0-rc.12

package/README.md

@@ -42,3 +42,14 @@ See the [first-party setup guide](https://longleash.dev/docs/getting-started),
 - npm provenance is required for public releases from the official repository workflow.
 
 LongLeash is licensed under the MIT License.
+
+
+### Verified pairing
+
+Run `longleash pair` in an interactive terminal and keep it open. Compare all eight digits
+with the phone, type `yes` on the laptop, and choose **Codes match** on the phone. Both
+confirmations are required. A mismatch, cancellation, disconnect or expiry requires a new QR.
+Redirected input/output is refused so QR secrets cannot be written to service logs. Existing
+paired devices continue working; older daemons must be updated and restarted before creating
+new verified pairings. If a connection fails after both confirmations, use `longleash devices`
+and revoke any incomplete device before pairing again.

package/bin/longleash.mjs

@@ -1096,9 +1096,9 @@ var require_main = __commonJS({
 });
 
 // src/cli.ts
-import { existsSync as existsSync3, readFileSync as readFileSync4 } from "node:fs";
+import { existsSync as existsSync3, readFileSync as readFileSync5 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { delimiter, dirname as dirname4, join as join4, resolve as resolve4 } from "node:path";
+import { delimiter, dirname as dirname4, join as join5, resolve as resolve4 } from "node:path";
 import { fileURLToPath } from "node:url";
 import { spawn, spawnSync as spawnSync3 } from "node:child_process";
 import { createInterface } from "node:readline/promises";
@@ -2138,6 +2138,56 @@ function environmentQuote(value) {
   return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
 }
 
+// src/pairing.ts
+async function runVerifiedPairing(io) {
+  if (!io.interactive) throw new Error("Pairing requires an interactive terminal. Run longleash pair without redirecting input or output.");
+  if (io.signal.aborted) throw new Error("Pairing cancelled.");
+  const response = await io.request("/local/pairing", { method: "POST" });
+  if (!response.ok) throw new Error(response.status === 429 ? "Too many QRs. Wait one minute and retry." : "Could not create a QR. Update/restart the daemon and try again.");
+  const body = await response.json();
+  if (body.version !== 2 || !body.url || !body.challengeId || !body.expiresAt || !/^https?:\/\//.test(body.url)) {
+    throw new Error("Update and restart the laptop daemon: this CLI requires verified pairing v2.");
+  }
+  const request = (action, attemptId) => io.request(`/local/pairing/${action}`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ challengeId: body.challengeId, ...attemptId ? { attemptId } : {} })
+  });
+  const lifetime = AbortSignal.any([io.signal, AbortSignal.timeout(Math.max(1, body.expiresAt - Date.now()))]);
+  let completed = false;
+  let confirmed = false;
+  try {
+    io.showQr(body.url);
+    io.print("Keep this terminal open. Keep the QR and link private; do not share screenshots.");
+    while (!lifetime.aborted) {
+      const status = await request("status");
+      if (!status.ok) throw new Error("Pairing ended or expired. Generate a fresh QR.");
+      const result = await status.json();
+      if (result.state === "paired") {
+        completed = true;
+        io.print("Both devices confirmed. Your phone is paired.");
+        return;
+      }
+      if (result.verification && !confirmed) {
+        const { attemptId, code } = result.verification;
+        if (!/^\d{4} \d{4}$/.test(code) || !/^[A-Za-z0-9_-]{43}$/.test(attemptId)) throw new Error("Invalid laptop verification response.");
+        io.print(`Compare with your phone:  ${code}`);
+        const answer = await io.ask("Do all digits match? Type yes to confirm, or anything else to cancel: ", lifetime);
+        if (answer.trim().toLowerCase() !== "yes") throw new Error("Codes were not confirmed. Pairing cancelled; generate a fresh QR.");
+        if (lifetime.aborted) break;
+        if (!(await request("confirm", attemptId)).ok) throw new Error("This attempt ended before confirmation. Generate a fresh QR.");
+        confirmed = true;
+        io.print("Laptop confirmed. Choose Codes match on your phone to finish.");
+      }
+      await (io.wait ?? (() => new Promise((resolve5) => setTimeout(resolve5, 300))))();
+    }
+    throw new Error("Pairing cancelled or expired. Generate a fresh QR.");
+  } finally {
+    if (!completed) await request("cancel").catch(() => {
+    });
+  }
+}
+
 // src/terminal-qr.ts
 var import_qrcode_terminal = __toESM(require_main(), 1);
 function terminalQr(input2) {
@@ -2221,15 +2271,50 @@ function cell(top, bottom) {
   };
 }
 
+// src/diagnostics.ts
+import { readFileSync as readFileSync4 } from "node:fs";
+import { join as join4 } from "node:path";
+function readBuild(path) {
+  try {
+    const value = JSON.parse(readFileSync4(path, "utf8")).build;
+    return typeof value === "string" && value.length > 0 ? value : null;
+  } catch {
+    return null;
+  }
+}
+function compareBuilds(expected, actual) {
+  return !expected || !actual ? "unknown" : expected === actual ? "match" : "mismatch";
+}
+function inspectHooks(home, codexHome, hooks2) {
+  const quote = (value) => `'${value.replace(/'/g, `'"'"'`)}'`;
+  const events = ["SessionStart", "SessionEnd", "PreToolUse", "PermissionRequest"];
+  let claude = false;
+  let codex = false;
+  try {
+    const settings = JSON.parse(readFileSync4(join4(home, ".claude", "settings.json"), "utf8"));
+    const command = `${quote(process.execPath)} ${quote(join4(hooks2, "longleash-hook.mjs"))}`;
+    claude = settings.disableAllHooks !== true && events.every((event) => Array.isArray(settings.hooks?.[event]) && settings.hooks[event].some((entry) => Array.isArray(entry.hooks) && entry.hooks.some((hook) => hook.command === command || hook.command === `${command} --observe`)));
+  } catch {
+  }
+  try {
+    const config = readFileSync4(join4(codexHome, "config.toml"), "utf8");
+    const command = `${quote(process.execPath)} ${quote(join4(hooks2, "longleash-codex-hook.mjs"))}`;
+    const block = config.split("# >>> LongLeash \u2014 managed block, edits between these markers are overwritten")[1]?.split("# <<< LongLeash")[0] ?? "";
+    codex = events.every((event) => block.split("\n").some((line) => line.startsWith(`${event} = `) && line.includes(`command = ${JSON.stringify(event === "PreToolUse" ? `${command} --observe` : command)}`)));
+  } catch {
+  }
+  return { claude, codex };
+}
+
 // src/cli.ts
 var here = dirname4(fileURLToPath(import.meta.url));
 var packageRoot = resolve4(here, "..");
-var manifest = JSON.parse(readFileSync4(join4(packageRoot, "package.json"), "utf8"));
+var manifest = JSON.parse(readFileSync5(join5(packageRoot, "package.json"), "utf8"));
 var VERSION = manifest.version;
-var runtime = join4(packageRoot, "runtime", "daemon");
-var daemonEntry = join4(runtime, "bin", "longleashd.mjs");
-var hooks = join4(runtime, "hooks");
-var devicesEntry = join4(runtime, "bin", "longleash-devices.mjs");
+var runtime = join5(packageRoot, "runtime", "daemon");
+var daemonEntry = join5(runtime, "bin", "longleashd.mjs");
+var hooks = join5(runtime, "hooks");
+var devicesEntry = join5(runtime, "bin", "longleash-devices.mjs");
 async function main() {
   const args = process.argv.slice(2);
   const command = args[0];
@@ -2505,16 +2590,34 @@ function printServiceState(state, healthy) {
   console.log("");
 }
 async function pair() {
-  const response = await localDaemonRequest("/local/pairing", { method: "POST" });
-  if (!response.ok) throw new Error(`The running daemon could not create a pairing challenge (${response.status}).`);
-  const body = await response.json();
-  if (typeof body.url !== "string" || !/^https?:\/\//.test(body.url)) throw new Error("The daemon returned an invalid pairing challenge.");
-  console.log("\nScan this with your phone. The link is single-use and expires:\n");
-  console.log(terminalQr(body.url));
-  console.log(`
-  ${body.url}
+  const controller = new AbortController();
+  const cancel = () => controller.abort();
+  process.once("SIGINT", cancel);
+  process.once("SIGTERM", cancel);
+  const terminal = input.isTTY && output.isTTY ? createInterface({ input, output }) : null;
+  terminal?.on("SIGINT", cancel);
+  terminal?.on("close", cancel);
+  try {
+    await runVerifiedPairing({
+      interactive: Boolean(terminal),
+      request: localDaemonRequest,
+      signal: controller.signal,
+      showQr: (url) => {
+        console.log("\nScan this with your phone:\n");
+        console.log(terminalQr(url));
+        console.log(`
+  ${url}
 `);
-  return 0;
+      },
+      print: (text) => console.log(text),
+      ask: (prompt, signal) => terminal.question(prompt, { signal })
+    });
+    return 0;
+  } finally {
+    terminal?.close();
+    process.off("SIGINT", cancel);
+    process.off("SIGTERM", cancel);
+  }
 }
 async function runDaemon(explicitRoots) {
   if (!existsSync3(daemonEntry)) throw new Error("The npm package is incomplete: daemon runtime is missing.");
@@ -2551,22 +2654,32 @@ async function doctor(json) {
   } catch (error) {
     configError = message(error);
   }
-  const endpointPath = join4(process.env.LONGLEASH_DATA ?? join4(homedir4(), ".longleash"), "hook-endpoint.json");
   let daemon = { reachable: false };
   try {
-    const endpoint = JSON.parse(readFileSync4(endpointPath, "utf8"));
-    if (endpoint.url && endpoint.secret) {
-      const response = await fetch(endpoint.url.replace(/\/hook$/, "/health"), {
-        headers: { "x-longleash-hook": endpoint.secret },
-        signal: AbortSignal.timeout(1500)
-      });
-      if (response.ok) {
-        const health = await response.json();
-        daemon = { reachable: true, ...health.build ? { build: health.build } : {} };
-      }
+    const response = await localDaemonRequest("/health", { method: "GET" }, 1500);
+    if (response.ok) {
+      const health = await response.json();
+      daemon = { reachable: health.name === "longleash", ...health.build ? { build: health.build } : {}, ...health.pairingVersion ? { pairingVersion: health.pairingVersion } : {} };
     }
   } catch {
   }
+  const localBuild = readBuild(join5(packageRoot, "runtime", "app", "dist", "build.json"));
+  let relayBuild = null;
+  if (typeof config.relayUrl === "string") {
+    try {
+      const url = new URL(config.relayUrl);
+      url.protocol = url.protocol === "wss:" ? "https:" : "http:";
+      url.pathname = "/build.json";
+      url.search = "";
+      url.hash = "";
+      const response = await fetch(url, { signal: AbortSignal.timeout(3e3), headers: { "cache-control": "no-cache" } });
+      const value = response.ok ? await response.json() : null;
+      if (typeof value?.build === "string") relayBuild = value.build;
+    } catch {
+    }
+  }
+  const builds = { local: localBuild, daemon: compareBuilds(localBuild, daemon.build ?? null), relay: typeof config.relayUrl === "string" ? compareBuilds(localBuild, relayBuild) : "off", relayBuild };
+  const hookConfig = inspectHooks(homedir4(), process.env.CODEX_HOME || join5(homedir4(), ".codex"), hooks);
   const report = {
     package: { name: "@longleash/cli", version: VERSION, root: packageRoot },
     runtime: { node: process.version, platform: process.platform, architecture: process.arch },
@@ -2577,7 +2690,9 @@ async function doctor(json) {
       allowedRoots: configuredRoots(config),
       relay: typeof config.relayUrl === "string" ? config.relayUrl : "off"
     },
-    daemon
+    daemon,
+    builds,
+    hooks: hookConfig
   };
   if (json) console.log(JSON.stringify(report, null, 2));
   else {
@@ -2588,6 +2703,11 @@ LongLeash ${VERSION}`);
     console.log(`  config       ${configError ?? (configuredRoots(config).length > 0 ? "valid" : "not configured")}`);
     console.log(`  relay        ${report.config.relay}`);
     console.log(`  daemon       ${daemon.reachable ? `reachable \xB7 build ${daemon.build ?? "unknown"}` : "not running"}`);
+    console.log(`  code builds  ${builds.daemon} \xB7 packaged ${localBuild ?? "unknown"}`);
+    console.log(`  app builds   ${builds.relay} \xB7 relay ${relayBuild ?? "unavailable"}`);
+    console.log(`  pairing      ${daemon.pairingVersion === 2 ? "verified v2" : "unavailable/old \u2014 update and restart the daemon"}`);
+    for (const agent of ["claude", "codex"]) console.log(`  ${agent} hooks ${hookConfig[agent] ? "configured for this runtime" : "missing/stale \u2014 run longleash hooks"}`);
+    console.log("  Hook configuration does not prove provider trust. Restart agents after updates and test one new session.");
     console.log("");
   }
   return configError === null ? 0 : 1;
@@ -2595,8 +2715,8 @@ LongLeash ${VERSION}`);
 async function runHooks(args) {
   const remove = args.includes("--remove");
   let failed = false;
-  if (commandAvailable("claude") || remove) failed = await runNode(join4(hooks, "install-hooks.mjs"), remove ? ["--remove"] : []) !== 0 || failed;
-  if (commandAvailable("codex") || remove) failed = await runNode(join4(hooks, "install-codex-hooks.mjs"), remove ? ["--remove"] : []) !== 0 || failed;
+  if (commandAvailable("claude") || remove) failed = await runNode(join5(hooks, "install-hooks.mjs"), remove ? ["--remove"] : []) !== 0 || failed;
+  if (commandAvailable("codex") || remove) failed = await runNode(join5(hooks, "install-codex-hooks.mjs"), remove ? ["--remove"] : []) !== 0 || failed;
   return failed ? 1 : 0;
 }
 async function update(target) {
@@ -2653,10 +2773,10 @@ async function waitForDaemon(timeoutMs) {
   return false;
 }
 async function localDaemonRequest(path, init, timeoutMs = 5e3) {
-  const endpointPath = join4(process.env.LONGLEASH_DATA ?? join4(homedir4(), ".longleash"), "hook-endpoint.json");
+  const endpointPath = join5(process.env.LONGLEASH_DATA ?? join5(homedir4(), ".longleash"), "hook-endpoint.json");
   let endpoint;
   try {
-    endpoint = JSON.parse(readFileSync4(endpointPath, "utf8"));
+    endpoint = JSON.parse(readFileSync5(endpointPath, "utf8"));
   } catch {
     throw new Error("LongLeash is not reachable. Start it with `longleash service start` or `longleash run`.");
   }

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@longleash/cli",
-  "version": "0.1.0-rc.11",
+  "version": "0.1.0-rc.12",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@longleash/cli",
-      "version": "0.1.0-rc.11",
+      "version": "0.1.0-rc.12",
       "license": "MIT",
       "os": [
         "darwin",
@@ -19,7 +19,7 @@
         "@fastify/websocket": "11.3.0",
         "@modelcontextprotocol/sdk": "1.30.0",
         "better-sqlite3": "12.11.1",
-        "fastify": "5.11.0",
+        "fastify": "5.12.5",
         "qrcode-terminal": "0.12.0",
         "web-push": "3.6.7",
         "ws": "8.21.1",
@@ -241,9 +241,9 @@
       }
     },
     "node_modules/@fastify/ajv-compiler/node_modules/fast-uri": {
-      "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-4.1.2.tgz",
-      "integrity": "sha512-TyGmBcbDTZXcb2cj5MV89DrF42DKvb3y5DDUNh95iO+IMeAzMkVSxK1PZRrRIpc9yg8U2GhGdbofNa0LS/a4Bw==",
+      "version": "4.2.1",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-4.2.1.tgz",
+      "integrity": "sha512-TmHQgewjHtMq1E5QKA0tOE0yeYGQs25KZC/ziJpubRtWI15W92e6vPFydWOeZBVROSHBYw/QhD9d5OefdD6LDg==",
       "funding": [
         {
           "type": "github",
@@ -327,9 +327,9 @@
       }
     },
     "node_modules/@fastify/proxy-addr": {
-      "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/@fastify/proxy-addr/-/proxy-addr-5.1.0.tgz",
-      "integrity": "sha512-INS+6gh91cLUjB+PVHfu1UqcB76Sqtpyp7bnL+FYojhjygvOPA9ctiD/JDKsyD9Xgu4hUhCSJBPig/w7duNajw==",
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/@fastify/proxy-addr/-/proxy-addr-5.1.1.tgz",
+      "integrity": "sha512-zv07Y9GEuDsJPegZoDFd4SDWaZOW8N2pa0GSrYmKpId/tjt1Hgo3BjZBVjdVpfVrHaA+Qv5jawtS2O50J5xM9g==",
       "funding": [
         {
           "type": "github",
@@ -416,9 +416,9 @@
       }
     },
     "node_modules/@hono/node-server": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-2.1.1.tgz",
-      "integrity": "sha512-ELuehkj5VCBdgEw9zs+ivkKwyzzUCSQuE96YmiPvn1ECBoZCczbFXJLeEGMTYjphP6gydh4pHMqEYPVMYUVgQg==",
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-2.1.3.tgz",
+      "integrity": "sha512-TA//nWMqPhbfdfneACk6t5a9eqbS9lABEPyKn0/xZTah3H3U2XaVg85rJFl0/Fyit0I552YDHgXGVSf3GwqbUw==",
       "license": "MIT",
       "engines": {
         "node": ">=20"
@@ -697,9 +697,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.9",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
-      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "version": "5.0.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
+      "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
@@ -1099,9 +1099,9 @@
       }
     },
     "node_modules/express-rate-limit": {
-      "version": "8.6.2",
-      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.6.2.tgz",
-      "integrity": "sha512-YH4ru+eOJxQABscKFfRCy9R7x9QFGdezclVMwwgFFndzS2Xnm0uo6B0ABZsLhcpeptGv2qvuJVWlQr9gQZoC3A==",
+      "version": "8.7.0",
+      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.7.0.tgz",
+      "integrity": "sha512-hOwV7WOxXfjRpAM1DSJWZDXx3GhplwD8IfwuwvogD8i1Qnkgosw/H45s4ZnFAUHDAhPjlY9hLBvJhKmGMyY26g==",
       "license": "MIT",
       "dependencies": {
         "debug": "^4.4.3",
@@ -1167,9 +1167,9 @@
       }
     },
     "node_modules/fast-json-stringify/node_modules/fast-uri": {
-      "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-4.1.2.tgz",
-      "integrity": "sha512-TyGmBcbDTZXcb2cj5MV89DrF42DKvb3y5DDUNh95iO+IMeAzMkVSxK1PZRrRIpc9yg8U2GhGdbofNa0LS/a4Bw==",
+      "version": "4.2.1",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-4.2.1.tgz",
+      "integrity": "sha512-TmHQgewjHtMq1E5QKA0tOE0yeYGQs25KZC/ziJpubRtWI15W92e6vPFydWOeZBVROSHBYw/QhD9d5OefdD6LDg==",
       "funding": [
         {
           "type": "github",
@@ -1198,9 +1198,9 @@
       "license": "Unlicense"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz",
-      "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==",
+      "version": "3.1.8",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz",
+      "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==",
       "funding": [
         {
           "type": "github",
@@ -1214,9 +1214,9 @@
       "license": "BSD-3-Clause"
     },
     "node_modules/fastify": {
-      "version": "5.11.0",
-      "resolved": "https://registry.npmjs.org/fastify/-/fastify-5.11.0.tgz",
-      "integrity": "sha512-Y/Ecx1yt0hYzrQR+QVLbxaUN8wCX+MQzMevh29r5RRvlOIArmi4+WAXXaGl5Hw5gBr2wduZpZaT3gRCnXoyVgA==",
+      "version": "5.12.5",
+      "resolved": "https://registry.npmjs.org/fastify/-/fastify-5.12.5.tgz",
+      "integrity": "sha512-OB2k1dlxs5/NAABqeKV2FUHkSD2BbENsCak8yULVcymn3fHIPDVa9TI3SDnJSWYSllZmSYuZXy2gTnsT+Sut1A==",
       "funding": [
         {
           "type": "github",
@@ -1239,7 +1239,7 @@
         "find-my-way": "^9.6.0",
         "light-my-request": "^6.0.0",
         "pino": "^9.14.0 || ^10.1.0",
-        "process-warning": "^5.0.0",
+        "process-warning": "^5.1.0",
         "rfdc": "^1.3.1",
         "secure-json-parse": "^4.0.0",
         "semver": "^7.6.0",
@@ -1263,9 +1263,9 @@
       "license": "MIT"
     },
     "node_modules/fastq": {
-      "version": "1.20.1",
-      "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.20.1.tgz",
-      "integrity": "sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==",
+      "version": "1.20.3",
+      "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.20.3.tgz",
+      "integrity": "sha512-XKv5nnLs6nLF71NgiKJLIZFLkPyIEuOselLG7ujZnGrRfQK8HpvY+WqKhAJUAdLomwVHErVS4LfxFlPq0/FTAw==",
       "license": "ISC",
       "dependencies": {
         "reusify": "^1.0.4"
@@ -1299,9 +1299,9 @@
       }
     },
     "node_modules/find-my-way": {
-      "version": "9.8.0",
-      "resolved": "https://registry.npmjs.org/find-my-way/-/find-my-way-9.8.0.tgz",
-      "integrity": "sha512-JtyUgATO7qxRp2zKhrmWof74Mqxc1ikbwpwMY97p8ipuTj2QtreA4gK2JNAF6SOqqHnYYkwMUvsgQVi2AJxIyw==",
+      "version": "9.9.0",
+      "resolved": "https://registry.npmjs.org/find-my-way/-/find-my-way-9.9.0.tgz",
+      "integrity": "sha512-sJsgZ1sQH2UDuowPuMKg8az7Qc8F0jnj+SKkFWU/+T0xcFlgV5skgXOGUqmQzOdmW6ALA7AhJINWx3qFBkbLHA==",
       "license": "MIT",
       "dependencies": {
         "fast-deep-equal": "^3.1.3",
@@ -1442,9 +1442,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.13.2",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.2.tgz",
-      "integrity": "sha512-JydRilDRkYBQMt9qR9U92mXxmbGqsqSn/IKOrh4e7/gEbn+0zSr8igTu0obwJoNGN4sez28DIql7FBHWydoJpA==",
+      "version": "4.13.13",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.13.tgz",
+      "integrity": "sha512-CQ46U0ZkAGmbT/4UxdzzGJpacP2IeKgY4a5/tOI9AABbpOMfK739wfDXmv1usCk+3RkKj1hQy4/fjhiwa2xlrA==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"
@@ -1541,9 +1541,9 @@
       "license": "ISC"
     },
     "node_modules/ip-address": {
-      "version": "10.5.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.5.0.tgz",
-      "integrity": "sha512-R5SnVLJmgYYvf2F2ZgwSBnelz5G4q5AxIC277GDfUaNbrZKNANcBC7RHqYYePlszf4kBolVkJauG0ZjHHFh55g==",
+      "version": "10.7.3",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.7.3.tgz",
+      "integrity": "sha512-A1kdq/tSb5QjvKvAMgIoEvDBIgL7qaqVP/jkvSwYYRZ9iEzvPpopxp2wQfu3SuZRHtpHNxMn8Fs0bS+gf5Xmwg==",
       "license": "MIT",
       "engines": {
         "node": ">= 12"
@@ -1571,9 +1571,9 @@
       "license": "ISC"
     },
     "node_modules/jose": {
-      "version": "6.2.9",
-      "resolved": "https://registry.npmjs.org/jose/-/jose-6.2.9.tgz",
-      "integrity": "sha512-XrchZOFZUl/T3vTwRe8XK+cJrGtMF4th1ARnDfwbBXFKThGhlsxEE4Zu03AD/bjJSt/9jT/mxrOCkJWOg77aPA==",
+      "version": "6.2.12",
+      "resolved": "https://registry.npmjs.org/jose/-/jose-6.2.12.tgz",
+      "integrity": "sha512-9NiFmJEex0sy2Dk58j2UGBSHgUs2ypF9eZSu4L6vjOX3Dp96Sw1F3uL+H+D1sx02jZZdzUT0HgvCy59CuvXcWw==",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/panva"
@@ -1695,9 +1695,9 @@
       "license": "MIT"
     },
     "node_modules/lru-cache": {
-      "version": "11.5.2",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.2.tgz",
-      "integrity": "sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g==",
+      "version": "11.5.3",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.3.tgz",
+      "integrity": "sha512-U4N8FgzmWxc8k1VH8Kr6lQg18U7Fjvby6wXHVRX/ZZ7IwWbRMgrRbP0Wrb5q5NVinryp4SQampHKdvtecItxUg==",
       "license": "BlueOak-1.0.0",
       "engines": {
         "node": "20 || >=22"
@@ -1844,18 +1844,38 @@
       "license": "MIT"
     },
     "node_modules/negotiator": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-1.0.0.tgz",
-      "integrity": "sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg==",
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-1.1.0.tgz",
+      "integrity": "sha512-NMPBRMJgiQHjbd8phG3Vebdx4kZ1H121rbl5IkMqeOsahptB9BKo/d7oJ3zTXqTgagn2bWlNSXkh0QUGM31RYg==",
       "license": "MIT",
+      "dependencies": {
+        "content-type": "^2.1.0"
+      },
       "engines": {
-        "node": ">= 0.6"
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/negotiator/node_modules/content-type": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz",
+      "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/node-abi": {
-      "version": "3.94.0",
-      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.94.0.tgz",
-      "integrity": "sha512-W5ZNO5KRPB5TkYmGVD9F6YqhsglXJzE6etpbmT+f6EQElhiX/UTG551cnsRGvLG3fyZEg9HwaDmNmj5nwJ4z9g==",
+      "version": "3.96.0",
+      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.96.0.tgz",
+      "integrity": "sha512-rebQ/lz7i0EkoLzUVSrKRzA69zMkwLp95kKMWoMDkkM00Suxz0D7zEQPwRml5fQum24mj7bPvmlgLAmu2JCiYg==",
       "license": "MIT",
       "dependencies": {
         "semver": "^7.3.5"
@@ -1960,9 +1980,9 @@
       }
     },
     "node_modules/pino": {
-      "version": "10.3.1",
-      "resolved": "https://registry.npmjs.org/pino/-/pino-10.3.1.tgz",
-      "integrity": "sha512-r34yH/GlQpKZbU1BvFFqOjhISRo1MNx1tWYsYvmj6KIRHSPMT2+yHOEb1SG6NMvRoHRF0a07kCOox/9yakl1vg==",
+      "version": "10.4.0",
+      "resolved": "https://registry.npmjs.org/pino/-/pino-10.4.0.tgz",
+      "integrity": "sha512-bk1ZMTwG/Vymx+zPoa28MhNzucFvXJWp3csrSuxuHPSMeUettaCoQ5Jvg07mtC4JGNpcfTwz41oVCnNgBK9+vA==",
       "license": "MIT",
       "dependencies": {
         "@pinojs/redact": "^0.4.0",
@@ -1972,7 +1992,7 @@
         "pino-std-serializers": "^7.0.0",
         "process-warning": "^5.0.0",
         "quick-format-unescaped": "^4.0.3",
-        "real-require": "^0.2.0",
+        "real-require": "^1.0.0",
         "safe-stable-stringify": "^2.3.1",
         "sonic-boom": "^4.0.1",
         "thread-stream": "^4.0.0"
@@ -2049,9 +2069,9 @@
       "license": "MIT"
     },
     "node_modules/proxy-addr": {
-      "version": "2.0.7",
-      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
-      "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
+      "version": "2.0.8",
+      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz",
+      "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==",
       "license": "MIT",
       "dependencies": {
         "forwarded": "0.2.0",
@@ -2059,6 +2079,10 @@
       },
       "engines": {
         "node": ">= 0.10"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/proxy-addr/node_modules/ipaddr.js": {
@@ -2089,9 +2113,9 @@
       }
     },
     "node_modules/qs": {
-      "version": "6.15.3",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.3.tgz",
-      "integrity": "sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==",
+      "version": "6.16.0",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz",
+      "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==",
       "license": "BSD-3-Clause",
       "dependencies": {
         "es-define-property": "^1.0.1",
@@ -2168,13 +2192,10 @@
       }
     },
     "node_modules/real-require": {
-      "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/real-require/-/real-require-0.2.0.tgz",
-      "integrity": "sha512-57frrGM/OCTLqLOAh0mhVA9VBMHd+9U7Zb2THMGdBUoZVOtGbJzjxsYGDJ3A9AYYCP4hn6y1TVbaOfzWtm5GFg==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 12.13.0"
-      }
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/real-require/-/real-require-1.0.0.tgz",
+      "integrity": "sha512-P4nbQYQfePJxRSmY+v/KINxVucm4NF3p3s7pJveMTtom52FR4YGltUQLB8idDXwDDWW+eYrWDFbuzUnjoWHF7g==",
+      "license": "MIT"
     },
     "node_modules/require-from-string": {
       "version": "2.0.2",
@@ -2525,9 +2546,9 @@
       }
     },
     "node_modules/standardwebhooks": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/standardwebhooks/-/standardwebhooks-1.0.0.tgz",
-      "integrity": "sha512-BbHGOQK9olHPMvQNHWul6MYlrRTAOKn03rOe4A8O3CLWhNf4YHBqq2HJKKC+sfqpxiBY52pNeesD6jIiLDz8jg==",
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/standardwebhooks/-/standardwebhooks-1.1.1.tgz",
+      "integrity": "sha512-bCbX9ZEyFkWPsRz7Bl3NuQUJohmwGSev/yhr7vhaGPlc4AfIrspIRa6cPTBuI1ItmrTDJ4d/S2hCsfe4+vQGnQ==",
       "license": "MIT",
       "dependencies": {
         "@stablelib/base64": "^1.0.0",
@@ -2607,12 +2628,6 @@
         "node": ">=20"
       }
     },
-    "node_modules/thread-stream/node_modules/real-require": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/real-require/-/real-require-1.0.0.tgz",
-      "integrity": "sha512-P4nbQYQfePJxRSmY+v/KINxVucm4NF3p3s7pJveMTtom52FR4YGltUQLB8idDXwDDWW+eYrWDFbuzUnjoWHF7g==",
-      "license": "MIT"
-    },
     "node_modules/toad-cache": {
       "version": "3.7.4",
       "resolved": "https://registry.npmjs.org/toad-cache/-/toad-cache-3.7.4.tgz",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@longleash/cli",
-  "version": "0.1.0-rc.11",
+  "version": "0.1.0-rc.12",
   "description": "Securely control Claude Code and Codex sessions on your laptop from your phone.",
   "license": "MIT",
   "type": "module",
@@ -59,7 +59,7 @@
     "@fastify/websocket": "11.3.0",
     "@modelcontextprotocol/sdk": "1.30.0",
     "better-sqlite3": "12.11.1",
-    "fastify": "5.11.0",
+    "fastify": "5.12.5",
     "qrcode-terminal": "0.12.0",
     "web-push": "3.6.7",
     "ws": "8.21.1",