agentvigil 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 AgentVigil Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,76 @@
+# AgentVigil
+
+Never babysit a stuck AI coding session again.
+
+## What it does
+
+AgentVigil watches your AI coding agents (Claude Code, Codex, Amp) for permission prompts, idle states, and completions, then pushes an encrypted notification to your phone the moment one needs your attention. Approve or deny right from the lock screen — no need to keep checking your terminal.
+
+<!-- screenshot here -->
+
+## How it works
+
+```
+Claude Code  →  hooks  →  AgentVigil companion  →  Cloudflare Tunnel  →  AgentVigil app (Android / iOS)
+```
+
+The companion runs quietly on your Mac, picks up hook events the instant they fire, encrypts them end-to-end, and relays them through a Cloudflare Tunnel to your phone. Replies (approve/deny) make the same trip in reverse.
+
+## Requirements
+
+- macOS (Apple Silicon or Intel)
+- Node.js >= 18
+- [cloudflared](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/) (`brew install cloudflared`)
+- AgentVigil app — [Android (Google Play)](https://play.google.com/store/apps/details?id=com.stacktree.agentvigil) · iOS (coming soon)
+
+## Quick Start
+
+```bash
+npx agentvigil setup
+```
+
+```bash
+npx agentvigil start
+```
+
+## Commands
+
+| Command | Description |
+|---|---|
+| `agentvigil setup` | First-time setup: register hooks and pair with mobile app |
+| `agentvigil start` | Start the AgentVigil daemon |
+| `agentvigil status` | Show all active agent sessions |
+| `agentvigil logs` | Tail the AgentVigil log file |
+| `agentvigil unpair` | Revoke mobile app pairing |
+| `agentvigil uninstall` | Remove AgentVigil hooks from Claude Code and Codex |
+| `agentvigil install-autostart` | Start AgentVigil automatically on login |
+| `agentvigil uninstall-autostart` | Remove autostart |
+
+## Supported Agents
+
+| Agent | Session Detection | Push Notifications | Approve/Deny |
+|---|---|---|---|
+| Claude Code | ✅ | ✅ | ✅ |
+| Codex CLI | ✅ | ✅ (coming soon) | ✅ (coming soon) |
+| Amp | ✅ | 🔜 | 🔜 |
+
+## Security
+
+- **End-to-end encrypted** — every message between your Mac and phone is encrypted with TweetNaCl (XSalsa20-Poly1305).
+- **Zero server storage** — there is no AgentVigil backend. Nothing about your sessions is ever stored on a server.
+- **Cloudflare Tunnel, no open ports** — your Mac is never directly reachable from the internet.
+- **Session content stays local** — prompts, code, and terminal output never leave your Mac except as encrypted relay traffic to your own paired phone.
+
+Audit this code — it's all here.
+
+## Why open source?
+
+AgentVigil runs as a daemon with access to your AI coding sessions and your terminal. That's a lot of trust to ask for, so the code that earns it should be inspectable by anyone. Open source lets you (or anyone) verify exactly what data is read, what gets encrypted, and where it goes before you let it run on your machine.
+
+## Contributing
+
+Issues and PRs welcome.
+
+## License
+
+MIT

package/dist/commands/autostart.d.ts

@@ -0,0 +1,3 @@
+export declare function runInstallAutostart(): Promise<void>;
+export declare function runUninstallAutostart(): Promise<void>;
+//# sourceMappingURL=autostart.d.ts.map

package/dist/commands/autostart.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"autostart.d.ts","sourceRoot":"","sources":["../../src/commands/autostart.ts"],"names":[],"mappings":"AA6CA,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC,CAYzD;AAED,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC,CAK3D"}

package/dist/commands/autostart.js

@@ -0,0 +1,57 @@
+import { execFile } from 'node:child_process';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'url';
+import { promisify } from 'node:util';
+import { logger } from '../utils/logger.js';
+const execFileAsync = promisify(execFile);
+// dist/commands/autostart.js → go up one level to reach dist/
+const __filename = fileURLToPath(import.meta.url);
+const distDir = path.dirname(path.dirname(__filename));
+const entryPoint = path.join(distDir, 'index.js');
+const LABEL = 'com.agentvigil.daemon';
+const PLIST_PATH = path.join(os.homedir(), 'Library', 'LaunchAgents', `${LABEL}.plist`);
+const LOG_PATH = path.join(os.homedir(), '.agentvigil', 'agentvigil.log');
+function buildPlist() {
+    return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+    <string>${process.execPath}</string>
+    <string>${entryPoint}</string>
+    <string>start</string>
+  </array>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>StandardOutPath</key>
+  <string>${LOG_PATH}</string>
+  <key>StandardErrorPath</key>
+  <string>${LOG_PATH}</string>
+</dict>
+</plist>
+`;
+}
+export async function runInstallAutostart() {
+    await fs.mkdir(path.dirname(PLIST_PATH), { recursive: true });
+    await fs.mkdir(path.dirname(LOG_PATH), { recursive: true });
+    await fs.writeFile(PLIST_PATH, buildPlist(), 'utf8');
+    // Reload in case it's already registered from a previous install.
+    await execFileAsync('launchctl', ['unload', PLIST_PATH]).catch(() => { });
+    await execFileAsync('launchctl', ['load', '-w', PLIST_PATH]);
+    logger.success('AgentVigil will now start automatically on login.');
+    logger.info(`Launch agent: ${PLIST_PATH}`);
+    logger.info(`Logs: ${LOG_PATH}`);
+}
+export async function runUninstallAutostart() {
+    await execFileAsync('launchctl', ['unload', PLIST_PATH]).catch(() => { });
+    await fs.rm(PLIST_PATH, { force: true });
+    logger.success('AgentVigil autostart removed.');
+}
+//# sourceMappingURL=autostart.js.map

package/dist/commands/autostart.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"autostart.js","sourceRoot":"","sources":["../../src/commands/autostart.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,8DAA8D;AAC9D,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,OAAO,GAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;AAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAElD,MAAM,KAAK,GAAQ,uBAAuB,CAAC;AAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC;AACxF,MAAM,QAAQ,GAAK,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC;AAE5E,SAAS,UAAU;IACjB,OAAO;;;;;YAKG,KAAK;;;cAGH,OAAO,CAAC,QAAQ;cAChB,UAAU;;;;;;;;YAQZ,QAAQ;;YAER,QAAQ;;;CAGnB,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,UAAU,EAAE,EAAE,MAAM,CAAC,CAAC;IAErD,kEAAkE;IAClE,MAAM,aAAa,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACzE,MAAM,aAAa,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;IAE7D,MAAM,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC;IACpE,MAAM,CAAC,IAAI,CAAC,iBAAiB,UAAU,EAAE,CAAC,CAAC;IAC3C,MAAM,CAAC,IAAI,CAAC,SAAS,QAAQ,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,MAAM,aAAa,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACzE,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAEzC,MAAM,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC;AAClD,CAAC"}

package/dist/commands/daemon.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Shared daemon runtime — used by both `setup` (post-pairing) and `start`.
+ *
+ * Caller is responsible for having already:
+ *   - created and started the AgentVigilWsServer
+ *   - set the shared secret on the WS server
+ *   - (optionally) started a cloudflared tunnel
+ */
+import { type Session, type SessionState } from '../sessions/session-manager.js';
+import type { AgentVigilWsServer } from '../tunnel/websocket-server.js';
+import type { TunnelManager } from '../tunnel/tunnel-manager.js';
+import type { AgentEvent, AgentEventType } from '../types.js';
+export declare const TMUX_POLL_INTERVAL_MS = 5000;
+export declare const SESSION_CLEANUP_INTERVAL_MS: number;
+export declare const EVENT_TYPE_FOR_STATE: Record<SessionState, AgentEventType>;
+/** Returns the first non-loopback IPv4 address of this machine. */
+export declare function getLocalIPv4(): string | undefined;
+export declare function toAgentEvent(session: Session): AgentEvent;
+export declare function syncTmuxPanes(): Promise<void>;
+export interface DaemonOptions {
+    wsServer: AgentVigilWsServer;
+    tunnelManager?: TunnelManager;
+    ntfyTopic: string;
+}
+/**
+ * Starts the relay, session watching, and tmux polling loops.
+ * Resolves when SIGINT/SIGTERM is received.
+ * The caller should NOT stop wsServer or tunnelManager before calling this.
+ */
+export declare function runDaemon({ wsServer, tunnelManager, ntfyTopic }: DaemonOptions): Promise<void>;
+//# sourceMappingURL=daemon.d.ts.map

package/dist/commands/daemon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../../src/commands/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,EAML,KAAK,OAAO,EACZ,KAAK,YAAY,EAClB,MAAM,gCAAgC,CAAC;AAIxC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE9D,eAAO,MAAM,qBAAqB,OAAQ,CAAC;AAC3C,eAAO,MAAM,2BAA2B,QAAgB,CAAC;AAEzD,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,YAAY,EAAE,cAAc,CAMrE,CAAC;AAEF,mEAAmE;AACnE,wBAAgB,YAAY,IAAI,MAAM,GAAG,SAAS,CAOjD;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,UAAU,CAazD;AAED,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAcnD;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAqEpG"}

package/dist/commands/daemon.js

@@ -0,0 +1,131 @@
+/**
+ * Shared daemon runtime — used by both `setup` (post-pairing) and `start`.
+ *
+ * Caller is responsible for having already:
+ *   - created and started the AgentVigilWsServer
+ *   - set the shared secret on the WS server
+ *   - (optionally) started a cloudflared tunnel
+ */
+import os from 'node:os';
+import { logger } from '../utils/logger.js';
+import { RelayHandler } from '../relay/relay-handler.js';
+import { cleanup, getActiveSessions, getAllSessions, updateSession, } from '../sessions/session-manager.js';
+import { startSessionPolling } from '../sessions/session-poller.js';
+import { watchSessions } from '../sessions/session-watcher.js';
+import { enumerateTmuxSessions, findTmuxPaneForSession } from '../sessions/tmux-bridge.js';
+export const TMUX_POLL_INTERVAL_MS = 5_000;
+export const SESSION_CLEANUP_INTERVAL_MS = 5 * 60 * 1000;
+export const EVENT_TYPE_FOR_STATE = {
+    working: 'session_started',
+    blocked: 'permission_prompt',
+    done: 'task_complete',
+    error: 'session_error',
+    idle: 'idle_waiting',
+};
+/** Returns the first non-loopback IPv4 address of this machine. */
+export function getLocalIPv4() {
+    for (const addrs of Object.values(os.networkInterfaces())) {
+        for (const addr of addrs ?? []) {
+            if (addr.family === 'IPv4' && !addr.internal)
+                return addr.address;
+        }
+    }
+    return undefined;
+}
+export function toAgentEvent(session) {
+    return {
+        type: EVENT_TYPE_FOR_STATE[session.state],
+        session_id: session.session_id,
+        project_name: session.project_name,
+        cwd: session.cwd,
+        agent: session.agent,
+        message: session.last_message ?? session.state,
+        timestamp: session.last_activity.toISOString(),
+        pid: session.pid,
+        permission_command: session.permission_command,
+        tool_name: session.tool_name,
+    };
+}
+export async function syncTmuxPanes() {
+    try {
+        const panes = await enumerateTmuxSessions();
+        if (panes.length === 0)
+            return;
+        for (const session of getAllSessions()) {
+            const pane = findTmuxPaneForSession(session.cwd, panes);
+            if (pane && pane.pane_id !== session.tmux_pane_id) {
+                updateSession(session.session_id, { tmux_pane_id: pane.pane_id, pid: pane.pid });
+            }
+        }
+    }
+    catch (err) {
+        logger.warn('Failed to sync tmux panes', err);
+    }
+}
+/**
+ * Starts the relay, session watching, and tmux polling loops.
+ * Resolves when SIGINT/SIGTERM is received.
+ * The caller should NOT stop wsServer or tunnelManager before calling this.
+ */
+export async function runDaemon({ wsServer, tunnelManager, ntfyTopic }) {
+    const relay = new RelayHandler(wsServer, ntfyTopic);
+    // ── Process-based session detection ─────────────────────────────────────
+    // Polls every 10 s via pgrep + lsof.  First poll is awaited so the store
+    // is fully populated before we advertise readiness.
+    const poller = await startSessionPolling((session) => {
+        // New session detected by the poller — push to phone immediately.
+        if (wsServer.isPhoneConnected) {
+            wsServer.sendEvent(toAgentEvent(session));
+        }
+    }, (sessionId) => {
+        // Session process died — remove from phone fleet immediately.
+        if (wsServer.isPhoneConnected) {
+            wsServer.sendEvent({
+                type: 'session_ended',
+                session_id: sessionId,
+                project_name: '',
+                cwd: '',
+                agent: 'claude-code',
+                message: 'Session terminated',
+                timestamp: new Date().toISOString(),
+            });
+        }
+    });
+    logger.info(`Session poll ready: ${getActiveSessions().length} active session(s)`);
+    // First poll complete — push fresh state if phone already connected.
+    if (wsServer.isPhoneConnected) {
+        wsServer.sendFullSync();
+        logger.info('Sent post-startup full sync to already-connected phone');
+    }
+    // ── JSONL watcher: live last_message updates for existing sessions ───────
+    // ignoreInitial=true — poller owns session creation; this is supplementary.
+    // Also the only signal that a `blocked` session resumed after the user
+    // approved/denied its permission prompt directly in the Mac terminal (no
+    // hook fires for that) — see RelayHandler.handleTranscriptActivity.
+    const watcher = watchSessions((update) => {
+        void relay.handleTranscriptActivity(update);
+    });
+    const tmuxTimer = setInterval(() => { void syncTmuxPanes(); }, TMUX_POLL_INTERVAL_MS);
+    const cleanTimer = setInterval(() => cleanup(), SESSION_CLEANUP_INTERVAL_MS);
+    void syncTmuxPanes();
+    logger.success('✅ AgentVigil is running — watching for Claude Code sessions');
+    await new Promise((resolve) => {
+        let shuttingDown = false;
+        const shutdown = async () => {
+            if (shuttingDown)
+                return;
+            shuttingDown = true;
+            logger.info('Shutting down AgentVigil...');
+            clearInterval(tmuxTimer);
+            clearInterval(cleanTimer);
+            poller.stop();
+            await watcher.close();
+            tunnelManager?.stop();
+            wsServer.stop();
+            resolve();
+        };
+        process.on('SIGINT', () => void shutdown());
+        process.on('SIGTERM', () => void shutdown());
+    });
+}
+//# sourceMappingURL=daemon.js.map

package/dist/commands/daemon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon.js","sourceRoot":"","sources":["../../src/commands/daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EACL,OAAO,EACP,iBAAiB,EACjB,cAAc,EACd,aAAa,GAId,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAK3F,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAC3C,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzD,MAAM,CAAC,MAAM,oBAAoB,GAAyC;IACxE,OAAO,EAAE,iBAAiB;IAC1B,OAAO,EAAE,mBAAmB;IAC5B,IAAI,EAAE,eAAe;IACrB,KAAK,EAAE,eAAe;IACtB,IAAI,EAAE,cAAc;CACrB,CAAC;AAEF,mEAAmE;AACnE,MAAM,UAAU,YAAY;IAC1B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,EAAE,CAAC;QAC1D,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;YAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC,OAAO,CAAC;QACpE,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAgB;IAC3C,OAAO;QACL,IAAI,EAAE,oBAAoB,CAAC,OAAO,CAAC,KAAK,CAAC;QACzC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,KAAK,EAAE,OAAO,CAAC,KAAyB;QACxC,OAAO,EAAE,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,KAAK;QAC9C,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,WAAW,EAAE;QAC9C,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAE/B,KAAK,MAAM,OAAO,IAAI,cAAc,EAAE,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,sBAAsB,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACxD,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC;gBAClD,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAQD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAiB;IACnF,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAEpD,2EAA2E;IAC3E,yEAAyE;IACzE,oDAAoD;IACpD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CACtC,CAAC,OAAO,EAAE,EAAE;QACV,kEAAkE;QAClE,IAAI,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YAC9B,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC,EACD,CAAC,SAAS,EAAE,EAAE;QACZ,8DAA8D;QAC9D,IAAI,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YAC9B,QAAQ,CAAC,SAAS,CAAC;gBACjB,IAAI,EAAE,eAAe;gBACrB,UAAU,EAAE,SAAS;gBACrB,YAAY,EAAE,EAAE;gBAChB,GAAG,EAAE,EAAE;gBACP,KAAK,EAAE,aAAa;gBACpB,OAAO,EAAE,oBAAoB;gBAC7B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CACF,CAAC;IACF,MAAM,CAAC,IAAI,CAAC,uBAAuB,iBAAiB,EAAE,CAAC,MAAM,oBAAoB,CAAC,CAAC;IAEnF,qEAAqE;IACrE,IAAI,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QAC9B,QAAQ,CAAC,YAAY,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IACxE,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,uEAAuE;IACvE,yEAAyE;IACzE,oEAAoE;IACpE,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,MAAM,EAAE,EAAE;QACvC,KAAK,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAI,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;IACvF,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,2BAA2B,CAAC,CAAC;IAC7E,KAAK,aAAa,EAAE,CAAC;IAErB,MAAM,CAAC,OAAO,CAAC,6DAA6D,CAAC,CAAC;IAE9E,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAClC,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,MAAM,QAAQ,GAAG,KAAK,IAAmB,EAAE;YACzC,IAAI,YAAY;gBAAE,OAAO;YACzB,YAAY,GAAG,IAAI,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;YAC3C,aAAa,CAAC,SAAS,CAAC,CAAC;YACzB,aAAa,CAAC,UAAU,CAAC,CAAC;YAC1B,MAAM,CAAC,IAAI,EAAE,CAAC;YACd,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;YACtB,aAAa,EAAE,IAAI,EAAE,CAAC;YACtB,QAAQ,CAAC,IAAI,EAAE,CAAC;YAChB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QAEF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAG,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;QAC7C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/commands/setup.d.ts

@@ -0,0 +1,5 @@
+export interface SetupOptions {
+    dryRun?: boolean;
+}
+export declare function runSetup(options?: SetupOptions): Promise<void>;
+//# sourceMappingURL=setup.d.ts.map

package/dist/commands/setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../src/commands/setup.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAID,wBAAsB,QAAQ,CAAC,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+JxE"}

package/dist/commands/setup.js

@@ -0,0 +1,158 @@
+import { v4 as uuidv4 } from 'uuid';
+import { logger } from '../utils/logger.js';
+import { isCloudflaredInstalled, getConfig, saveConfig } from '../utils/config.js';
+import { buildHookCommand, registerHooks } from '../hooks/hook-manager.js';
+import { deriveSharedSecret, encrypt, loadOrCreateKeyPair } from '../crypto/encryption.js';
+import { buildQrPayload, generateQrCode } from '../utils/qr.js';
+import { AgentVigilWsServer } from '../tunnel/websocket-server.js';
+import { TunnelManager } from '../tunnel/tunnel-manager.js';
+import { RelayHandler } from '../relay/relay-handler.js';
+import { getAllSessions } from '../sessions/session-manager.js';
+import { SERVICE_ACCOUNT_PATH, printFcmSetupInstructions } from '../notifications/fcm-client.js';
+import fs from 'node:fs';
+import { getLocalIPv4, runDaemon, toAgentEvent, } from './daemon.js';
+const MIN_NODE_MAJOR_VERSION = 18;
+export async function runSetup(options = {}) {
+    logger.banner('AgentVigil Setup');
+    logger.info('This will:');
+    logger.info('  1. Register hooks with Claude Code and Codex');
+    logger.info('  2. Generate encryption keys');
+    logger.info('  3. Start a secure tunnel');
+    logger.info('  4. Show a QR code to pair with your phone');
+    logger.info('');
+    if (!isNodeVersionSupported(process.version)) {
+        logger.error(`Node.js >= ${MIN_NODE_MAJOR_VERSION} is required (found ${process.version}) — please upgrade and re-run setup.`);
+        return;
+    }
+    const hasCloudflared = await isCloudflaredInstalled();
+    if (!hasCloudflared) {
+        logger.error('cloudflared is required but not installed.');
+        logger.info('');
+        logger.info('Install it with:');
+        logger.info('  brew install cloudflared');
+        logger.info('');
+        logger.info('Then run setup again:');
+        logger.info('  npx agentvigil setup');
+        logger.info('');
+        process.exit(1);
+    }
+    if (options.dryRun) {
+        printDryRunPlan();
+        return;
+    }
+    await registerHooks();
+    logger.info(`Hook command: ${buildHookCommand('permission_prompt')}`);
+    logger.info('Verify with: cat ~/.claude/settings.json | grep -A2 agentvigil');
+    const keyPair = await loadOrCreateKeyPair();
+    const config = await getConfig();
+    // ── Relay handler — wired up after pairing via closure reference ────────
+    let relay;
+    let wsServer;
+    let resolvePairing;
+    const paired = new Promise((resolve) => {
+        resolvePairing = resolve;
+    });
+    const handlePairRequest = (request, socket) => {
+        const sharedSecret = deriveSharedSecret(keyPair.secretKey, request.pub_key);
+        wsServer.setSharedSecret(sharedSecret);
+        const device = {
+            name: request.device_name,
+            device_id: uuidv4(),
+            public_key: request.pub_key,
+            shared_secret: sharedSecret,
+            paired_at: new Date().toISOString(),
+        };
+        // Encrypted confirmation — phone needs this to know pairing succeeded.
+        const confirmation = encrypt(JSON.stringify({ type: 'paired', device_id: config.device_id }), sharedSecret);
+        socket.send(JSON.stringify({ payload: confirmation }));
+        resolvePairing(device);
+    };
+    // Create the WS server with relay callbacks wired via closure so that
+    // commands and hook events work immediately after pairing, without
+    // needing to restart the server.
+    wsServer = new AgentVigilWsServer(config.ws_port, {
+        getSessions: () => getAllSessions().map(toAgentEvent),
+        onPairRequest: handlePairRequest,
+        onCommand: (command) => { void relay?.handlePhoneCommand(command); },
+        onHookEvent: (event) => { void relay?.handleAgentEvent(event); },
+        localToken: keyPair.secretKey,
+    });
+    wsServer.start();
+    // ── Tunnel ──────────────────────────────────────────────────────────────
+    const tunnelManager = new TunnelManager();
+    let tunnelUrl;
+    try {
+        tunnelUrl = await tunnelManager.start(config.ws_port);
+    }
+    catch (err) {
+        logger.warn('Could not start cloudflared tunnel — pairing will only work on the local network', err);
+    }
+    if (tunnelUrl) {
+        config.tunnel_url = tunnelUrl;
+        await saveConfig(config);
+    }
+    // Use the Mac's real LAN IP when there is no internet tunnel, so the phone
+    // (on the same Wi-Fi) can actually reach the WebSocket server.
+    const localIp = getLocalIPv4();
+    const lanUrl = localIp
+        ? `ws://${localIp}:${config.ws_port}`
+        : `ws://localhost:${config.ws_port}`;
+    const qrUrl = tunnelUrl ?? lanUrl;
+    if (!tunnelUrl && localIp) {
+        logger.info(`No tunnel — using LAN address ${lanUrl} (phone and Mac must share the same Wi-Fi).`);
+    }
+    const qrPayload = buildQrPayload({
+        tunnelUrl: qrUrl,
+        ntfyTopic: config.ntfy_topic,
+        deviceId: config.device_id,
+        publicKey: keyPair.publicKey,
+    });
+    logger.info('Scan this QR code with the AgentVigil mobile app:');
+    generateQrCode(qrPayload);
+    logger.info('Waiting for the app to pair...');
+    // ── Wait for pairing ────────────────────────────────────────────────────
+    const device = await paired;
+    config.paired_devices = [
+        ...config.paired_devices.filter((d) => d.public_key !== device.public_key),
+        device,
+    ];
+    await saveConfig(config);
+    logger.success(`✅ Paired with AgentVigil (${device.name})`);
+    if (!fs.existsSync(SERVICE_ACCOUNT_PATH)) {
+        printFcmSetupInstructions();
+    }
+    logger.info('');
+    logger.success('Setup complete!');
+    logger.info('');
+    logger.info('Next steps:');
+    logger.info('  1. Scan the QR code above with AgentVigil on your phone');
+    logger.info('  2. Download AgentVigil: https://agentvigil.app');
+    logger.info('  3. Start the daemon: npx agentvigil start');
+    logger.info('');
+    logger.info('To start automatically on login:');
+    logger.info('  npx agentvigil install-autostart');
+    logger.info('');
+    logger.info('Staying alive as daemon — watching for Claude Code sessions (Ctrl-C to quit).');
+    // ── Activate relay and run as daemon ────────────────────────────────────
+    // Assigning `relay` here makes the WS server's onCommand / onHookEvent
+    // callbacks live; sessions are now forwarded in real time.
+    relay = new RelayHandler(wsServer, config.ntfy_topic);
+    await runDaemon({
+        wsServer,
+        tunnelManager: tunnelUrl ? tunnelManager : undefined,
+        ntfyTopic: config.ntfy_topic,
+    });
+}
+function isNodeVersionSupported(version) {
+    const major = Number(version.replace(/^v/, '').split('.')[0]);
+    return Number.isFinite(major) && major >= MIN_NODE_MAJOR_VERSION;
+}
+function printDryRunPlan() {
+    logger.info('Dry run — no changes will be made. `setup` would:');
+    logger.info('  1. Register Claude Code hooks in ~/.claude/settings.json (merged, never overwritten)');
+    logger.info('  2. Generate an X25519 keypair and save it to ~/.agentvigil/keys.json');
+    logger.info('  3. Start a local WebSocket server and display a pairing QR code');
+    logger.info('  4. Start a cloudflared tunnel so the phone can pair from anywhere');
+    logger.info('  5. After pairing, run as daemon (no need to run `start` separately)');
+}
+//# sourceMappingURL=setup.js.map

package/dist/commands/setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.js","sourceRoot":"","sources":["../../src/commands/setup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEnF,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAoB,MAAM,+BAA+B,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AACjG,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EACL,YAAY,EACZ,SAAS,EACT,YAAY,GACb,MAAM,aAAa,CAAC;AAMrB,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAElC,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,UAAwB,EAAE;IACvD,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAClC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1B,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;IAC9D,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC7C,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAC1C,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC3D,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEhB,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,MAAM,CAAC,KAAK,CACV,cAAc,sBAAsB,uBAAuB,OAAO,CAAC,OAAO,sCAAsC,CACjH,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,sBAAsB,EAAE,CAAC;IACtD,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAC3D,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACrC,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,eAAe,EAAE,CAAC;QAClB,OAAO;IACT,CAAC;IAED,MAAM,aAAa,EAAE,CAAC;IACtB,MAAM,CAAC,IAAI,CAAC,iBAAiB,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;IACtE,MAAM,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC5C,MAAM,MAAM,GAAI,MAAM,SAAS,EAAE,CAAC;IAElC,2EAA2E;IAC3E,IAAI,KAA+B,CAAC;IAEpC,IAAI,QAA6B,CAAC;IAClC,IAAI,cAA+C,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,OAAO,CAAe,CAAC,OAAO,EAAE,EAAE;QACnD,cAAc,GAAG,OAAO,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,MAAM,iBAAiB,GAAG,CAAC,OAAoB,EAAE,MAAiB,EAAQ,EAAE;QAC1E,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5E,QAAQ,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;QAEvC,MAAM,MAAM,GAAiB;YAC3B,IAAI,EAAU,OAAO,CAAC,WAAW;YACjC,SAAS,EAAK,MAAM,EAAE;YACtB,UAAU,EAAI,OAAO,CAAC,OAAO;YAC7B,aAAa,EAAE,YAAY;YAC3B,SAAS,EAAK,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACvC,CAAC;QAEF,uEAAuE;QACvE,MAAM,YAAY,GAAG,OAAO,CAC1B,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,EAC/D,YAAY,CACb,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;QAEvD,cAAc,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC,CAAC;IAEF,sEAAsE;IACtE,mEAAmE;IACnE,iCAAiC;IACjC,QAAQ,GAAG,IAAI,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE;QAChD,WAAW,EAAG,GAAG,EAAE,CAAC,cAAc,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC;QACtD,aAAa,EAAE,iBAAiB;QAChC,SAAS,EAAK,CAAC,OAAO,EAAE,EAAE,GAAG,KAAK,KAAK,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACvE,WAAW,EAAG,CAAC,KAAK,EAAI,EAAE,GAAG,KAAK,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACnE,UAAU,EAAI,OAAO,CAAC,SAAS;KAChC,CAAC,CAAC;IACH,QAAQ,CAAC,KAAK,EAAE,CAAC;IAEjB,2EAA2E;IAC3E,MAAM,aAAa,GAAG,IAAI,aAAa,EAAE,CAAC;IAC1C,IAAI,SAA6B,CAAC;IAElC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,kFAAkF,EAAE,GAAG,CAAC,CAAC;IACvG,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC;QAC9B,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAED,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,OAAO,GAAI,YAAY,EAAE,CAAC;IAChC,MAAM,MAAM,GAAK,OAAO;QACtB,CAAC,CAAC,QAAQ,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE;QACrC,CAAC,CAAC,kBAAkB,MAAM,CAAC,OAAO,EAAE,CAAC;IACvC,MAAM,KAAK,GAAM,SAAS,IAAI,MAAM,CAAC;IAErC,IAAI,CAAC,SAAS,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,iCAAiC,MAAM,6CAA6C,CAAC,CAAC;IACpG,CAAC;IAED,MAAM,SAAS,GAAG,cAAc,CAAC;QAC/B,SAAS,EAAG,KAAK;QACjB,SAAS,EAAG,MAAM,CAAC,UAAU;QAC7B,QAAQ,EAAI,MAAM,CAAC,SAAS;QAC5B,SAAS,EAAG,OAAO,CAAC,SAAS;KAC9B,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;IACjE,cAAc,CAAC,SAAS,CAAC,CAAC;IAC1B,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAE9C,2EAA2E;IAC3E,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC;IAC5B,MAAM,CAAC,cAAc,GAAG;QACtB,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,CAAC;QAC1E,MAAM;KACP,CAAC;IACF,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;IAEzB,MAAM,CAAC,OAAO,CAAC,6BAA6B,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;IAE5D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACzC,yBAAyB,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChB,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAClC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChB,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC3B,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;IACzE,MAAM,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;IAChE,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC3D,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChB,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IAChD,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;IAClD,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEhB,MAAM,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;IAE7F,2EAA2E;IAC3E,uEAAuE;IACvE,2DAA2D;IAC3D,KAAK,GAAG,IAAI,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAEtD,MAAM,SAAS,CAAC;QACd,QAAQ;QACR,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;QACpD,SAAS,EAAE,MAAM,CAAC,UAAU;KAC7B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAAC,OAAe;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,sBAAsB,CAAC;AACnE,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;IACjE,MAAM,CAAC,IAAI,CAAC,wFAAwF,CAAC,CAAC;IACtG,MAAM,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;IACtF,MAAM,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;IACjF,MAAM,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;IACnF,MAAM,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;AACvF,CAAC"}

package/dist/commands/start.d.ts

@@ -0,0 +1,2 @@
+export declare function runStart(): Promise<void>;
+//# sourceMappingURL=start.d.ts.map

package/dist/commands/start.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"start.d.ts","sourceRoot":"","sources":["../../src/commands/start.ts"],"names":[],"mappings":"AAgBA,wBAAsB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CA0F9C"}

package/dist/commands/start.js

@@ -0,0 +1,89 @@
+import { v4 as uuidv4 } from 'uuid';
+import { logger } from '../utils/logger.js';
+import { ensureCloudflared, getConfig, saveConfig } from '../utils/config.js';
+import { deriveSharedSecret, encrypt, loadOrCreateKeyPair } from '../crypto/encryption.js';
+import { AgentVigilWsServer } from '../tunnel/websocket-server.js';
+import { TunnelManager } from '../tunnel/tunnel-manager.js';
+import { RelayHandler } from '../relay/relay-handler.js';
+import { getActiveSessions } from '../sessions/session-manager.js';
+import { getLocalIPv4, runDaemon, toAgentEvent, } from './daemon.js';
+export async function runStart() {
+    logger.banner('AgentVigil');
+    const config = await getConfig();
+    if (config.paired_devices.length === 0) {
+        logger.warn('No paired devices found — run `npx agentvigil setup` first.');
+        return;
+    }
+    const keyPair = await loadOrCreateKeyPair();
+    const hasCloudflared = await ensureCloudflared();
+    let wsServer;
+    let relay;
+    const handlePairRequest = (request, socket) => {
+        const sharedSecret = deriveSharedSecret(keyPair.secretKey, request.pub_key);
+        wsServer.setSharedSecret(sharedSecret);
+        const device = {
+            name: request.device_name,
+            device_id: uuidv4(),
+            public_key: request.pub_key,
+            shared_secret: sharedSecret,
+            paired_at: new Date().toISOString(),
+        };
+        const confirmation = encrypt(JSON.stringify({ type: 'paired', device_id: config.device_id }), sharedSecret);
+        socket.send(JSON.stringify({ payload: confirmation }));
+        config.paired_devices = [
+            ...config.paired_devices.filter((d) => d.public_key !== device.public_key),
+            device,
+        ];
+        void saveConfig(config);
+        logger.success(`Paired with a new device: ${device.name}`);
+    };
+    wsServer = new AgentVigilWsServer(config.ws_port, {
+        getSessions: () => {
+            // Deduplicate by cwd — poller and hook may both have created entries for
+            // the same project.  Prefer blocked state so the permission card shows.
+            const seen = new Set();
+            const deduped = getActiveSessions()
+                .sort((a, b) => (a.state === 'blocked' ? -1 : b.state === 'blocked' ? 1 : 0))
+                .filter(s => {
+                if (seen.has(s.cwd))
+                    return false;
+                seen.add(s.cwd);
+                return true;
+            });
+            logger.info(`Full sync: sending ${deduped.length} active session(s) to phone`);
+            return deduped.map(toAgentEvent);
+        },
+        onPairRequest: handlePairRequest,
+        onCommand: (command) => { void relay.handlePhoneCommand(command); },
+        onHookEvent: (event) => { void relay.handleAgentEvent(event); },
+        localToken: keyPair.secretKey,
+    });
+    relay = new RelayHandler(wsServer, config.ntfy_topic);
+    // Resume the most recently paired device without requiring a re-scan.
+    wsServer.setSharedSecret(config.paired_devices.at(-1)?.shared_secret);
+    wsServer.start();
+    // ── Tunnel ──────────────────────────────────────────────────────────────
+    let tunnelManager;
+    if (hasCloudflared) {
+        tunnelManager = new TunnelManager();
+        try {
+            const tunnelUrl = await tunnelManager.start(config.ws_port);
+            config.tunnel_url = tunnelUrl;
+            await saveConfig(config);
+            logger.info(`Tunnel: ${tunnelUrl}`);
+        }
+        catch (err) {
+            logger.warn('Could not start cloudflared tunnel — continuing with ntfy notifications only', err);
+            tunnelManager = undefined;
+        }
+    }
+    else {
+        const localIp = getLocalIPv4();
+        const lanUrl = localIp ? `ws://${localIp}:${config.ws_port}` : undefined;
+        logger.warn('cloudflared is not installed — continuing with ntfy notifications only.');
+        if (lanUrl)
+            logger.info(`LAN address (same Wi-Fi only): ${lanUrl}`);
+    }
+    await runDaemon({ wsServer, tunnelManager, ntfyTopic: config.ntfy_topic });
+}
+//# sourceMappingURL=start.js.map

package/dist/commands/start.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"start.js","sourceRoot":"","sources":["../../src/commands/start.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAE9E,OAAO,EAAE,kBAAkB,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAoB,MAAM,+BAA+B,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EACL,YAAY,EACZ,SAAS,EACT,YAAY,GACb,MAAM,aAAa,CAAC;AAErB,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAE5B,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;IAEjC,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;QAC3E,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAS,MAAM,mBAAmB,EAAE,CAAC;IAClD,MAAM,cAAc,GAAG,MAAM,iBAAiB,EAAE,CAAC;IAEjD,IAAI,QAA6B,CAAC;IAClC,IAAI,KAAoB,CAAC;IAEzB,MAAM,iBAAiB,GAAG,CAAC,OAAoB,EAAE,MAAiB,EAAQ,EAAE;QAC1E,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5E,QAAQ,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;QAEvC,MAAM,MAAM,GAAiB;YAC3B,IAAI,EAAW,OAAO,CAAC,WAAW;YAClC,SAAS,EAAM,MAAM,EAAE;YACvB,UAAU,EAAK,OAAO,CAAC,OAAO;YAC9B,aAAa,EAAE,YAAY;YAC3B,SAAS,EAAM,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACxC,CAAC;QAEF,MAAM,YAAY,GAAG,OAAO,CAC1B,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,EAC/D,YAAY,CACb,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;QAEvD,MAAM,CAAC,cAAc,GAAG;YACtB,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,CAAC;YAC1E,MAAM;SACP,CAAC;QACF,KAAK,UAAU,CAAC,MAAM,CAAC,CAAC;QACxB,MAAM,CAAC,OAAO,CAAC,6BAA6B,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC;IAEF,QAAQ,GAAG,IAAI,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE;QAChD,WAAW,EAAE,GAAG,EAAE;YAChB,yEAAyE;YACzE,wEAAwE;YACxE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,MAAM,OAAO,GAAG,iBAAiB,EAAE;iBAChC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;iBAC5E,MAAM,CAAC,CAAC,CAAC,EAAE;gBACV,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAClC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAChB,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;YACL,MAAM,CAAC,IAAI,CAAC,sBAAsB,OAAO,CAAC,MAAM,6BAA6B,CAAC,CAAC;YAC/E,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACnC,CAAC;QACD,aAAa,EAAE,iBAAiB;QAChC,SAAS,EAAK,CAAC,OAAO,EAAE,EAAE,GAAG,KAAK,KAAK,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACtE,WAAW,EAAG,CAAC,KAAK,EAAI,EAAE,GAAG,KAAK,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAClE,UAAU,EAAI,OAAO,CAAC,SAAS;KAChC,CAAC,CAAC;IACH,KAAK,GAAG,IAAI,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAEtD,sEAAsE;IACtE,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IACtE,QAAQ,CAAC,KAAK,EAAE,CAAC;IAEjB,2EAA2E;IAC3E,IAAI,aAAwC,CAAC;IAE7C,IAAI,cAAc,EAAE,CAAC;QACnB,aAAa,GAAG,IAAI,aAAa,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC5D,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC;YAC9B,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,WAAW,SAAS,EAAE,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,8EAA8E,EAAE,GAAG,CAAC,CAAC;YACjG,aAAa,GAAG,SAAS,CAAC;QAC5B,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAI,OAAO,CAAC,CAAC,CAAC,QAAQ,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,MAAM,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;QACvF,IAAI,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,kCAAkC,MAAM,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,SAAS,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;AAC7E,CAAC"}

package/dist/commands/uninstall.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Removes all AgentVigil hook entries from ~/.claude/settings.json.
+ * Only removes commands registered by AgentVigil — all other hooks
+ * (including other tools' hooks) are left completely untouched.
+ */
+export declare function runUninstall(): Promise<void>;
+//# sourceMappingURL=uninstall.d.ts.map

package/dist/commands/uninstall.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"uninstall.d.ts","sourceRoot":"","sources":["../../src/commands/uninstall.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAIlD"}