@two7722/sentinel-guard 1.1.0

package/dist/transport/local.js

@@ -0,0 +1,320 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalTransport = void 0;
+const net_1 = __importDefault(require("net"));
+const crypto_1 = require("crypto");
+const child_process_1 = require("child_process");
+const tweetnacl_1 = __importDefault(require("tweetnacl"));
+const tweetnacl_util_1 = require("tweetnacl-util");
+const bonjour_service_1 = require("bonjour-service");
+const pending_1 = require("../relay/pending");
+const logger_1 = require("../lib/logger");
+const os_1 = require("os");
+const transport_encryption_1 = require("../crypto/transport-encryption");
+const claude_process_1 = require("../lib/claude-process");
+const TCP_PORT = 7750;
+const SERVICE_TYPE = 'sentinel';
+const PROTOCOL = 'tcp';
+/**
+ * Local transport — TCP server + Bonjour (mDNS) for LAN-direct mode.
+ *
+ * - Opens a TCP server on port 7750
+ * - Publishes _sentinel._tcp via Bonjour so iOS can auto-discover
+ * - iOS connects directly, same JSON message format as remote mode
+ * - Messages are newline-delimited JSON over raw TCP
+ */
+class LocalTransport {
+    mode = 'local';
+    server = null;
+    bonjour = null;
+    iosSocket = null;
+    buffer = '';
+    static MAX_BUFFER_SIZE = 1_048_576; // 1 MB
+    decisionCb = null;
+    rulesUpdateCb = null;
+    userMessageCb = null;
+    activeClaudeProcess = null;
+    get isConnected() {
+        return this.iosSocket !== null && !this.iosSocket.destroyed;
+    }
+    async start() {
+        return new Promise((resolve, reject) => {
+            this.server = net_1.default.createServer((socket) => {
+                // Accept one iOS connection at a time
+                if (this.iosSocket && !this.iosSocket.destroyed) {
+                    logger_1.log.warn('[local] New connection replacing old one');
+                    this.iosSocket.destroy();
+                }
+                this.iosSocket = socket;
+                this.buffer = '';
+                logger_1.log.success(`[local] iOS connected from ${socket.remoteAddress}`);
+                // Send handshake with X25519 ephemeral public key for key agreement.
+                // The transport key is derived: HMAC-SHA256(sharedSecret, "sentinel-transport-v2").
+                // This replaces sending the raw symmetric key in plaintext.
+                const ephemeral = tweetnacl_1.default.box.keyPair();
+                const handshake = JSON.stringify({
+                    event: 'handshake',
+                    data: {
+                        version: '3',
+                        x25519PublicKey: (0, tweetnacl_util_1.encodeBase64)(ephemeral.publicKey),
+                        // Still include ek for backward compatibility with older iOS versions
+                        ek: (0, transport_encryption_1.getTransportKeyBase64)(),
+                    },
+                }) + '\n';
+                socket.write(handshake);
+                // Store ephemeral secret key for this connection to derive shared key
+                // when iOS responds with its public key
+                socket._ephemeralSecretKey = ephemeral.secretKey;
+                setTimeout(() => {
+                    this.send('workspace_info', {
+                        cwd: process.cwd(),
+                        hostname: require('os').hostname(),
+                    });
+                }, 500);
+                socket.on('data', (chunk) => {
+                    this.buffer += chunk.toString();
+                    if (this.buffer.length > LocalTransport.MAX_BUFFER_SIZE) {
+                        logger_1.log.error('[local] Buffer exceeded 1MB, dropping connection');
+                        this.buffer = '';
+                        socket.destroy();
+                        return;
+                    }
+                    this.processBuffer();
+                });
+                socket.on('close', () => {
+                    logger_1.log.warn('[local] iOS disconnected');
+                    // Clear ephemeral key material
+                    if (socket._ephemeralSecretKey) {
+                        socket._ephemeralSecretKey = null;
+                    }
+                    if (this.iosSocket === socket)
+                        this.iosSocket = null;
+                });
+                socket.on('error', (err) => {
+                    logger_1.log.error(`[local] Socket error: ${err.message}`);
+                    if (this.iosSocket === socket)
+                        this.iosSocket = null;
+                });
+            });
+            this.server.listen(TCP_PORT, () => {
+                logger_1.log.success(`[local] TCP server listening on port ${TCP_PORT}`);
+                this.publishBonjour();
+                resolve();
+            });
+            this.server.on('error', (err) => {
+                logger_1.log.error(`[local] Server error: ${err.message}`);
+                reject(err);
+            });
+        });
+    }
+    publishBonjour() {
+        this.bonjour = new bonjour_service_1.Bonjour();
+        this.bonjour.publish({
+            name: `Sentinel-${process.env.USER ?? 'mac'}`,
+            type: SERVICE_TYPE,
+            protocol: PROTOCOL,
+            port: TCP_PORT,
+            txt: { version: '2', ek: (0, transport_encryption_1.getTransportKeyBase64)() }, // ek = encryption key
+        });
+        logger_1.log.success(`[local] Bonjour: publishing _${SERVICE_TYPE}._${PROTOCOL}`);
+        const ip = getLocalIP();
+        if (ip)
+            logger_1.log.info(`[local] LAN address: ${ip}:${TCP_PORT}`);
+    }
+    /** Process newline-delimited messages from buffer (encrypted or plain) */
+    processBuffer() {
+        const lines = this.buffer.split('\n');
+        this.buffer = lines.pop() ?? '';
+        const key = (0, transport_encryption_1.getTransportKey)();
+        for (const line of lines) {
+            if (!line.trim())
+                continue;
+            try {
+                // Try decrypt first (encrypted messages are base64, not JSON)
+                let json;
+                if (line.startsWith('{')) {
+                    json = line; // Plain JSON fallback (handshake)
+                }
+                else {
+                    const decrypted = (0, transport_encryption_1.decryptMessage)(line, key);
+                    if (!decrypted) {
+                        logger_1.log.debug('[local] Decrypt failed');
+                        continue;
+                    }
+                    json = decrypted;
+                }
+                const msg = JSON.parse(json);
+                this.handleMessage(msg);
+            }
+            catch {
+                logger_1.log.debug(`[local] Parse error: ${line.slice(0, 40)}`);
+            }
+        }
+    }
+    handleMessage(msg) {
+        if (msg.event === 'decision') {
+            const { requestId, action } = msg.data;
+            logger_1.log.info(`[local] Decision: ${requestId} → ${action}`);
+            pending_1.pending.resolve(requestId, action);
+            this.decisionCb?.(requestId, action);
+        }
+        else if (msg.event === 'rules_update') {
+            const rules = msg.data?.rules;
+            if (rules) {
+                logger_1.log.info(`[local] Rules update from iOS: ${rules.length} custom rules`);
+                this.rulesUpdateCb?.(rules);
+            }
+        }
+        else if (msg.event === 'user_message') {
+            const text = msg.data?.text;
+            if (text) {
+                logger_1.log.info(`[local] Message from iOS: ${text}`);
+                this.userMessageCb?.(text);
+                this.runClaude(text);
+            }
+        }
+        else if (msg.event === 'interrupt') {
+            logger_1.log.info('[local] Interrupt from iOS');
+            (0, claude_process_1.interruptClaude)();
+        }
+        else if (msg.event === 'heartbeat_ack') {
+            // iOS responded to heartbeat
+        }
+    }
+    /** Send a notification to iOS */
+    sendNotification(title, message) {
+        this.send('notification', { title, message });
+    }
+    sendEvent(data) {
+        const type = data.type;
+        if (type === 'terminal') {
+            this.send('terminal', data);
+        }
+        else {
+            this.send('activity', data);
+        }
+    }
+    runClaude(message) {
+        this.send('terminal', { type: 'terminal', text: `> ${message}` });
+        this.sendEvent({ type: 'claude_status', status: 'thinking', message });
+        // Kill any previous Claude process before starting a new one
+        if (this.activeClaudeProcess && !this.activeClaudeProcess.killed) {
+            this.activeClaudeProcess.kill('SIGTERM');
+        }
+        const child = (0, child_process_1.spawn)('claude', ['--continue', '--print', message], {
+            stdio: ['ignore', 'pipe', 'pipe'],
+            env: { ...process.env },
+        });
+        this.activeClaudeProcess = child;
+        let output = '';
+        let lineBuffer = '';
+        const streamLines = (chunk) => {
+            lineBuffer += chunk.toString();
+            const lines = lineBuffer.split('\n');
+            lineBuffer = lines.pop() ?? '';
+            for (const line of lines) {
+                if (line.trim()) {
+                    this.send('terminal', { type: 'terminal', text: line });
+                }
+            }
+            output += chunk.toString();
+        };
+        child.stdout?.on('data', streamLines);
+        child.stderr?.on('data', streamLines);
+        child.on('close', (code) => {
+            if (lineBuffer.trim()) {
+                this.send('terminal', { type: 'terminal', text: lineBuffer });
+            }
+            const trimmed = output.trim();
+            this.sendEvent({
+                type: 'claude_response',
+                message: trimmed || (code === 0 ? '完成（无输出）' : '无活跃会话'),
+                exitCode: code,
+            });
+            logger_1.log.success(`[local] Claude responded (${trimmed.length} chars, exit ${code})`);
+        });
+        child.on('error', (err) => {
+            logger_1.log.error(`[local] Claude error: ${err.message}`);
+            this.sendEvent({
+                type: 'claude_response',
+                message: `错误: ${err.message}`,
+                exitCode: -1,
+            });
+        });
+    }
+    /** Send a JSON message to connected iOS */
+    send(event, data) {
+        if (!this.iosSocket || this.iosSocket.destroyed)
+            return;
+        const msg = JSON.stringify({ event, data }) + '\n';
+        this.iosSocket.write(msg);
+    }
+    async sendApprovalRequest(payload) {
+        if (!this.isConnected)
+            throw new Error('iOS not connected');
+        const requestId = (0, crypto_1.randomBytes)(12).toString('hex');
+        // Map server risk levels to iOS RiskLevel enum values
+        const riskMap = {
+            low: 'require_confirm',
+            medium: 'require_confirm',
+            high: 'require_faceid',
+        };
+        this.send('approval_request', {
+            id: requestId,
+            toolName: payload.toolName,
+            toolInput: payload.toolInput,
+            riskLevel: riskMap[payload.riskLevel] ?? 'require_confirm',
+            macDeviceId: 'local',
+            timestamp: new Date().toISOString(),
+            timeoutAt: new Date(Date.now() + 120_000).toISOString(),
+            ...(payload.diff ? { diff: payload.diff } : {}),
+            ...(payload.contextSummary ? { contextSummary: payload.contextSummary } : {}),
+        });
+        return requestId;
+    }
+    onDecision(cb) {
+        this.decisionCb = cb;
+    }
+    /** Register callback for rules updates from iOS */
+    onRulesUpdate(cb) {
+        this.rulesUpdateCb = cb;
+    }
+    /** Register callback for user messages from iOS */
+    onUserMessage(cb) {
+        this.userMessageCb = cb;
+    }
+    stop() {
+        if (this.activeClaudeProcess && !this.activeClaudeProcess.killed) {
+            this.activeClaudeProcess.kill('SIGTERM');
+            this.activeClaudeProcess = null;
+        }
+        this.iosSocket?.destroy();
+        this.iosSocket = null;
+        this.server?.close();
+        this.server = null;
+        if (this.bonjour) {
+            this.bonjour.unpublishAll();
+            this.bonjour.destroy();
+            this.bonjour = null;
+        }
+    }
+    /** Get info for pairing display */
+    getConnectionInfo() {
+        return { ip: getLocalIP() ?? '0.0.0.0', port: TCP_PORT };
+    }
+}
+exports.LocalTransport = LocalTransport;
+function getLocalIP() {
+    const nets = (0, os_1.networkInterfaces)();
+    for (const name of Object.keys(nets)) {
+        for (const net of nets[name] ?? []) {
+            if (net.family === 'IPv4' && !net.internal)
+                return net.address;
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=local.js.map

package/dist/transport/local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.js","sourceRoot":"","sources":["../../src/transport/local.ts"],"names":[],"mappings":";;;;;;AAAA,8CAAsB;AACtB,mCAAqC;AACrC,iDAAiD;AACjD,0DAA6B;AAC7B,mDAA8C;AAC9C,qDAA0C;AAE1C,8CAA2C;AAC3C,0CAAoC;AACpC,2BAAuC;AAEvC,yEAAwH;AACxH,0DAAwD;AAExD,MAAM,QAAQ,GAAG,IAAI,CAAC;AACtB,MAAM,YAAY,GAAG,UAAU,CAAC;AAChC,MAAM,QAAQ,GAAG,KAAK,CAAC;AAEvB;;;;;;;GAOG;AACH,MAAa,cAAc;IAChB,IAAI,GAAG,OAAgB,CAAC;IAEzB,MAAM,GAAsB,IAAI,CAAC;IACjC,OAAO,GAAmB,IAAI,CAAC;IAC/B,SAAS,GAAsB,IAAI,CAAC;IACpC,MAAM,GAAG,EAAE,CAAC;IACZ,MAAM,CAAU,eAAe,GAAG,SAAS,CAAC,CAAC,OAAO;IACpD,UAAU,GAA6E,IAAI,CAAC;IAC5F,aAAa,GAAqC,IAAI,CAAC;IACvD,aAAa,GAAoC,IAAI,CAAC;IACtD,mBAAmB,GAAgD,IAAI,CAAC;IAEhF,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,KAAK;QACT,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,MAAM,GAAG,aAAG,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,EAAE;gBACxC,sCAAsC;gBACtC,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;oBAChD,YAAG,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;oBACrD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;gBAC3B,CAAC;gBAED,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC;gBACxB,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;gBACjB,YAAG,CAAC,OAAO,CAAC,8BAA8B,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;gBAElE,qEAAqE;gBACrE,oFAAoF;gBACpF,4DAA4D;gBAC5D,MAAM,SAAS,GAAG,mBAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;gBACrC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;oBAC/B,KAAK,EAAE,WAAW;oBAClB,IAAI,EAAE;wBACJ,OAAO,EAAE,GAAG;wBACZ,eAAe,EAAE,IAAA,6BAAY,EAAC,SAAS,CAAC,SAAS,CAAC;wBAClD,sEAAsE;wBACtE,EAAE,EAAE,IAAA,4CAAqB,GAAE;qBAC5B;iBACF,CAAC,GAAG,IAAI,CAAC;gBACV,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAExB,sEAAsE;gBACtE,wCAAwC;gBACvC,MAAc,CAAC,mBAAmB,GAAG,SAAS,CAAC,SAAS,CAAC;gBAE1D,UAAU,CAAC,GAAG,EAAE;oBACd,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE;wBAC1B,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;wBAClB,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;qBACnC,CAAC,CAAC;gBACL,CAAC,EAAE,GAAG,CAAC,CAAC;gBAER,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;oBAC1B,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;oBAChC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,cAAc,CAAC,eAAe,EAAE,CAAC;wBACxD,YAAG,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;wBAC9D,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;wBACjB,MAAM,CAAC,OAAO,EAAE,CAAC;wBACjB,OAAO;oBACT,CAAC;oBACD,IAAI,CAAC,aAAa,EAAE,CAAC;gBACvB,CAAC,CAAC,CAAC;gBAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;oBACtB,YAAG,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;oBACrC,+BAA+B;oBAC/B,IAAK,MAAc,CAAC,mBAAmB,EAAE,CAAC;wBACvC,MAAc,CAAC,mBAAmB,GAAG,IAAI,CAAC;oBAC7C,CAAC;oBACD,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM;wBAAE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;gBACvD,CAAC,CAAC,CAAC;gBAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;oBACzB,YAAG,CAAC,KAAK,CAAC,yBAAyB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;oBAClD,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM;wBAAE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;gBACvD,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE;gBAChC,YAAG,CAAC,OAAO,CAAC,wCAAwC,QAAQ,EAAE,CAAC,CAAC;gBAChE,IAAI,CAAC,cAAc,EAAE,CAAC;gBACtB,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC9B,YAAG,CAAC,KAAK,CAAC,yBAAyB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAClD,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,cAAc;QACpB,IAAI,CAAC,OAAO,GAAG,IAAI,yBAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;YACnB,IAAI,EAAE,YAAY,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,EAAE;YAC7C,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,QAAQ;YAClB,IAAI,EAAE,QAAQ;YACd,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,IAAA,4CAAqB,GAAE,EAAE,EAAE,sBAAsB;SAC3E,CAAC,CAAC;QACH,YAAG,CAAC,OAAO,CAAC,gCAAgC,YAAY,KAAK,QAAQ,EAAE,CAAC,CAAC;QAEzE,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,IAAI,EAAE;YAAE,YAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,IAAI,QAAQ,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,0EAA0E;IAClE,aAAa;QACnB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,IAAA,sCAAe,GAAE,CAAC;QAE9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;gBAAE,SAAS;YAC3B,IAAI,CAAC;gBACH,8DAA8D;gBAC9D,IAAI,IAAY,CAAC;gBACjB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzB,IAAI,GAAG,IAAI,CAAC,CAAC,kCAAkC;gBACjD,CAAC;qBAAM,CAAC;oBACN,MAAM,SAAS,GAAG,IAAA,qCAAc,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;oBAC5C,IAAI,CAAC,SAAS,EAAE,CAAC;wBAAC,YAAG,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;wBAAC,SAAS;oBAAC,CAAC;oBAClE,IAAI,GAAG,SAAS,CAAC;gBACnB,CAAC;gBACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC7B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,YAAG,CAAC,KAAK,CAAC,wBAAwB,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,GAAiC;QACrD,IAAI,GAAG,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YAC7B,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;YACvC,YAAG,CAAC,IAAI,CAAC,qBAAqB,SAAS,MAAM,MAAM,EAAE,CAAC,CAAC;YACvD,iBAAO,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACnC,IAAI,CAAC,UAAU,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC;aAAM,IAAI,GAAG,CAAC,KAAK,KAAK,cAAc,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,KAA2B,CAAC;YACpD,IAAI,KAAK,EAAE,CAAC;gBACV,YAAG,CAAC,IAAI,CAAC,kCAAkC,KAAK,CAAC,MAAM,eAAe,CAAC,CAAC;gBACxE,IAAI,CAAC,aAAa,EAAE,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;aAAM,IAAI,GAAG,CAAC,KAAK,KAAK,cAAc,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,IAA0B,CAAC;YAClD,IAAI,IAAI,EAAE,CAAC;gBACT,YAAG,CAAC,IAAI,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;gBAC9C,IAAI,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,CAAC;gBAC3B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;aAAM,IAAI,GAAG,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YACrC,YAAG,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YACvC,IAAA,gCAAe,GAAE,CAAC;QACpB,CAAC;aAAM,IAAI,GAAG,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;YACzC,6BAA6B;QAC/B,CAAC;IACH,CAAC;IAED,iCAAiC;IACjC,gBAAgB,CAAC,KAAa,EAAE,OAAe;QAC7C,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,SAAS,CAAC,IAA6B;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAA0B,CAAC;QAC7C,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,OAAe;QAC/B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,OAAO,EAAE,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;QAEvE,6DAA6D;QAC7D,IAAI,IAAI,CAAC,mBAAmB,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,CAAC;YACjE,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,KAAK,GAAG,IAAA,qBAAO,EAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE;YAClE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,mBAAmB,GAAG,KAAK,CAAC;QAEjC,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,UAAU,GAAG,EAAE,CAAC;QAEpB,MAAM,WAAW,GAAG,CAAC,KAAa,EAAE,EAAE;YACpC,UAAU,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACrC,UAAU,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;oBAChB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC1D,CAAC;YACH,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC,CAAC;QAEF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACtC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAEtC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,IAAI,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;gBACtB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAChE,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,CAAC,SAAS,CAAC;gBACb,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;gBACtD,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;YACH,YAAG,CAAC,OAAO,CAAC,6BAA6B,OAAO,CAAC,MAAM,gBAAgB,IAAI,GAAG,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,YAAG,CAAC,KAAK,CAAC,yBAAyB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAClD,IAAI,CAAC,SAAS,CAAC;gBACb,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,OAAO,GAAG,CAAC,OAAO,EAAE;gBAC7B,QAAQ,EAAE,CAAC,CAAC;aACb,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,2CAA2C;IACnC,IAAI,CAAC,KAAa,EAAE,IAAS;QACnC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,SAAS;YAAE,OAAO;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QACnD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,OAAwB;QAChD,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAE5D,MAAM,SAAS,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClD,sDAAsD;QACtD,MAAM,OAAO,GAA2B;YACtC,GAAG,EAAE,iBAAiB;YACtB,MAAM,EAAE,iBAAiB;YACzB,IAAI,EAAE,gBAAgB;SACvB,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE;YAC5B,EAAE,EAAE,SAAS;YACb,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,iBAAiB;YAC1D,WAAW,EAAE,OAAO;YACpB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,WAAW,EAAE;YACvD,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9E,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,UAAU,CAAC,EAAmE;QAC5E,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;IACvB,CAAC;IAED,mDAAmD;IACnD,aAAa,CAAC,EAA2B;QACvC,IAAI,CAAC,aAAa,GAAG,EAAE,CAAC;IAC1B,CAAC;IAED,mDAAmD;IACnD,aAAa,CAAC,EAA0B;QACtC,IAAI,CAAC,aAAa,GAAG,EAAE,CAAC;IAC1B,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,mBAAmB,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,CAAC;YACjE,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACvB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,iBAAiB;QACf,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC3D,CAAC;;AA5SH,wCA6SC;AAED,SAAS,UAAU;IACjB,MAAM,IAAI,GAAG,IAAA,sBAAiB,GAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACnC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ;gBAAE,OAAO,GAAG,CAAC,OAAO,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/transport/remote.d.ts

@@ -0,0 +1,17 @@
+import type { Transport, ApprovalPayload } from './interface';
+/**
+ * Remote transport — wraps existing Socket.IO client for server-relay mode.
+ */
+export declare class RemoteTransport implements Transport {
+    private serverURL;
+    private token;
+    readonly mode: "server";
+    private socket;
+    private decisionCb;
+    constructor(serverURL: string, token: string);
+    get isConnected(): boolean;
+    start(): Promise<void>;
+    sendApprovalRequest(payload: ApprovalPayload): Promise<string>;
+    onDecision(cb: (id: string, action: 'allowed' | 'blocked' | 'timeout') => void): void;
+    stop(): void;
+}

package/dist/transport/remote.js

@@ -0,0 +1,83 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RemoteTransport = void 0;
+const socket_io_client_1 = require("socket.io-client");
+const pending_1 = require("../relay/pending");
+const logger_1 = require("../lib/logger");
+/**
+ * Remote transport — wraps existing Socket.IO client for server-relay mode.
+ */
+class RemoteTransport {
+    serverURL;
+    token;
+    mode = 'server';
+    socket = null;
+    decisionCb = null;
+    constructor(serverURL, token) {
+        this.serverURL = serverURL;
+        this.token = token;
+    }
+    get isConnected() {
+        return this.socket?.connected ?? false;
+    }
+    async start() {
+        // Clean up previous socket to prevent duplicate listeners
+        if (this.socket) {
+            this.socket.removeAllListeners();
+            this.socket.disconnect();
+            this.socket = null;
+        }
+        this.socket = (0, socket_io_client_1.io)(this.serverURL, {
+            auth: { token: this.token },
+            transports: ['websocket', 'polling'],
+            reconnection: true,
+            reconnectionDelay: 1000,
+            reconnectionDelayMax: 30000,
+            reconnectionAttempts: 10,
+        });
+        this.socket.on('connect', () => {
+            logger_1.log.success(`[remote] Connected to ${this.serverURL}`);
+        });
+        this.socket.on('disconnect', (reason) => {
+            logger_1.log.warn(`[remote] Disconnected: ${reason}`);
+        });
+        this.socket.on('connect_error', (err) => {
+            logger_1.log.error(`[remote] Connection error: ${err.message}`);
+        });
+        this.socket.on('decision', (data) => {
+            logger_1.log.info(`[remote] Decision: ${data.requestId} → ${data.action}`);
+            pending_1.pending.resolve(data.requestId, data.action);
+            this.decisionCb?.(data.requestId, data.action);
+        });
+        this.socket.on('heartbeat', () => {
+            this.socket?.emit('heartbeat');
+        });
+        // Wait for initial connection
+        await new Promise((resolve) => {
+            const timeout = setTimeout(() => resolve(), 5000);
+            this.socket.once('connect', () => { clearTimeout(timeout); resolve(); });
+        });
+    }
+    async sendApprovalRequest(payload) {
+        return new Promise((resolve, reject) => {
+            if (!this.socket?.connected)
+                return reject(new Error('Not connected'));
+            this.socket.emit('approval_request', payload, (res) => {
+                if (res.success && res.requestId)
+                    resolve(res.requestId);
+                else
+                    reject(new Error(res.error ?? 'Failed'));
+            });
+        });
+    }
+    onDecision(cb) {
+        this.decisionCb = cb;
+    }
+    stop() {
+        this.socket?.removeAllListeners();
+        this.socket?.disconnect();
+        this.socket = null;
+    }
+}
+exports.RemoteTransport = RemoteTransport;
+//# sourceMappingURL=remote.js.map

package/dist/transport/remote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote.js","sourceRoot":"","sources":["../../src/transport/remote.ts"],"names":[],"mappings":";;;AAAA,uDAA8C;AAG9C,8CAA2C;AAC3C,0CAAoC;AAEpC;;GAEG;AACH,MAAa,eAAe;IAOhB;IACA;IAPD,IAAI,GAAG,QAAiB,CAAC;IAE1B,MAAM,GAAkB,IAAI,CAAC;IAC7B,UAAU,GAA6E,IAAI,CAAC;IAEpG,YACU,SAAiB,EACjB,KAAa;QADb,cAAS,GAAT,SAAS,CAAQ;QACjB,UAAK,GAAL,KAAK,CAAQ;IACpB,CAAC;IAEJ,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,MAAM,EAAE,SAAS,IAAI,KAAK,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,KAAK;QACT,0DAA0D;QAC1D,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,IAAA,qBAAE,EAAC,IAAI,CAAC,SAAS,EAAE;YAC/B,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;YAC3B,UAAU,EAAE,CAAC,WAAW,EAAE,SAAS,CAAC;YACpC,YAAY,EAAE,IAAI;YAClB,iBAAiB,EAAE,IAAI;YACvB,oBAAoB,EAAE,KAAK;YAC3B,oBAAoB,EAAE,EAAE;SACzB,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YAC7B,YAAG,CAAC,OAAO,CAAC,yBAAyB,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE;YACtC,YAAG,CAAC,IAAI,CAAC,0BAA0B,MAAM,EAAE,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,GAAG,EAAE,EAAE;YACtC,YAAG,CAAC,KAAK,CAAC,8BAA8B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,IAA2C,EAAE,EAAE;YACzE,YAAG,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,SAAS,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAClE,iBAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,MAA2C,CAAC,CAAC;YAClF,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,MAAa,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE;YAC/B,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QAEH,8BAA8B;QAC9B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;YAClD,IAAI,CAAC,MAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,OAAwB;QAChD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS;gBAAE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;YACvE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,OAAO,EAAE,CAAC,GAA6D,EAAE,EAAE;gBAC9G,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,SAAS;oBAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;;oBACpD,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,QAAQ,CAAC,CAAC,CAAC;YAChD,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,EAAmE;QAC5E,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;IACvB,CAAC;IAED,IAAI;QACF,IAAI,CAAC,MAAM,EAAE,kBAAkB,EAAE,CAAC;QAClC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;CACF;AAhFD,0CAgFC"}

package/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "@two7722/sentinel-guard",
+  "version": "1.1.0",
+  "description": "Sentinel CLI — Claude Code 本地 Hook 服务 + 移动端审批",
+  "main": "dist/cli/index.js",
+  "bin": {
+    "sentinel": "dist/cli/index.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsx src/cli/index.ts",
+    "start": "node dist/cli/index.js",
+    "clean": "rm -rf dist node_modules",
+    "test": "npx tsx --test src/__tests__/*.test.ts",
+    "lint": "tsc --noEmit",
+    "prepublish": "npm run build"
+  },
+  "dependencies": {
+    "bonjour-service": "^1.2.1",
+    "chalk": "^5.3.0",
+    "commander": "^12.0.0",
+    "express": "^4.18.2",
+    "qrcode-terminal": "^0.12.0",
+    "socket.io-client": "^4.7.4",
+    "strip-ansi": "^6.0.1",
+    "tweetnacl": "^1.0.3",
+    "tweetnacl-util": "^0.15.1",
+    "unicode-animations": "^1.0.3",
+    "zod": "^3.22.4"
+  },
+  "devDependencies": {
+    "@types/express": "^4.17.21",
+    "@types/node": "^20.11.0",
+    "@types/qrcode-terminal": "^0.12.2",
+    "tsx": "^4.7.0",
+    "typescript": "^5.3.3"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  }
+}