forkoff 1.0.17 → 1.0.19

package/dist/websocket.js

@@ -1,17 +1,108 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.wsClient = exports.WebSocketClient = void 0;
-const socket_io_client_1 = require("socket.io-client");
 const config_1 = require("./config");
 const events_1 = require("events");
 const uuid_1 = require("uuid");
+const e2eeManager_1 = require("./crypto/e2eeManager");
+const server_1 = require("./server");
+// Whitelist of events allowed via encrypted_message channel (inbound from mobile)
+const ALLOWED_ENCRYPTED_EVENTS = new Set([
+    'terminal_command',
+    'terminal_create',
+    'terminal_resize',
+    'terminal_close',
+    'claude_start_session',
+    'claude_resume_session',
+    'claude_stop_session',
+    'user_message',
+    'directory_list',
+    'read_file',
+    'transcript_fetch',
+    'transcript_subscribe',
+    'transcript_unsubscribe',
+    'permission_response',
+    'permission_rules_sync',
+    'session_settings_update',
+    'transcript_subscribe_sdk',
+    'tab_complete',
+    'claude_approval_response',
+    'approval_response',
+    'sdk_session_history',
+    'claude_abort',
+    'usage_stats_request',
+]);
+// Events that carry user data and MUST be encrypted — plaintext fallback is refused.
+// If E2EE is not established, these are queued (not sent in plaintext).
+const ENFORCED_SENSITIVE_EVENTS = new Set([
+    // Core sensitive data
+    'terminal_output',
+    'read_file_response',
+    'directory_list_response',
+    'permission_prompt',
+    // Transcript data (contains full code, file contents, conversation history)
+    'transcript_history',
+    'transcript_update',
+    // Claude reasoning and session data
+    'thinking_content',
+    'task_progress',
+    'tool_activity',
+    // Approval context
+    'claude_approval_request',
+    'approval_request',
+    // Session metadata (contains directory paths, file paths, working directories)
+    'claude_session_update',
+    'claude_session_batch_update',
+    'terminal_cwd',
+    'file_changed',
+    // Token usage (contains session identifiers)
+    'token_usage',
+    // Pending permissions (contains prompt details)
+    'pending_permissions_sync',
+    // Session events (may contain error messages with paths)
+    'claude_session_event',
+    // Usage analytics sync
+    'usage_stats_sync',
+    'daily_usage_sync',
+    'streak_info_sync',
+]);
+// SECURITY: Inbound events from mobile that MUST arrive via E2EE decryption when active.
+// Plaintext versions are dropped when E2EE session is established with mobile peer.
+const ENFORCED_INBOUND_EVENTS = new Set([
+    'terminal_command', 'user_message', 'read_file', 'directory_list',
+    'tab_complete', 'permission_response', 'claude_approval_response',
+    'approval_response', 'rpc_response', 'terminal_create',
+    'sdk_session_history', 'claude_abort', 'claude_start_session',
+    'claude_resume_session', 'transcript_fetch', 'transcript_subscribe',
+    'permission_rules_sync',
+    'usage_stats_request',
+]);
+/** Events forwarded from server that need plaintext-drop checking */
+const PLAINTEXT_DROP_EVENTS = [
+    'terminal_create', 'terminal_command', 'approval_response',
+    'user_message', 'claude_resume_session', 'claude_start_session',
+    'directory_list', 'transcript_fetch', 'transcript_subscribe',
+    'read_file', 'claude_approval_response', 'permission_response',
+    'permission_rules_sync', 'claude_abort', 'tab_complete',
+    'usage_stats_request',
+];
+/** Events forwarded from server that do NOT need plaintext-drop checking */
+const PASSTHROUGH_EVENTS = [
+    'transcript_unsubscribe', 'claude_sessions_request', 'pair_device',
+];
 class WebSocketClient extends events_1.EventEmitter {
     constructor() {
         super(...arguments);
-        this.socket = null;
-        this.reconnectAttempts = 0;
+        this.server = null;
         this.heartbeatInterval = null;
         this._sessionId = '';
+        this.e2eeManager = null;
+        this.e2eeInitialized = false;
+        // The mobile device ID learned from key exchange (used for encrypting CLI→mobile messages)
+        this.e2eePeerDeviceId = null;
+        // Queue for sensitive messages waiting for E2EE session establishment
+        this.pendingSensitiveMessages = [];
+        this.usageTracker = null;
     }
     // Unique session ID for this CLI connection
     get sessionId() {
@@ -20,173 +111,275 @@ class WebSocketClient extends events_1.EventEmitter {
         }
         return this._sessionId;
     }
-    connect() {
-        return new Promise((resolve, reject) => {
-            if (this.socket?.connected) {
-                resolve();
+    /** Start the embedded relay server and wire up event forwarding */
+    async startServer(port) {
+        const deviceId = config_1.config.deviceId;
+        if (!deviceId) {
+            throw new Error('Device not registered');
+        }
+        this.server = new server_1.EmbeddedRelayServer({
+            port,
+            deviceId,
+            deviceName: config_1.config.deviceName,
+        });
+        await this.server.start();
+        // When mobile connects, emit connected + start heartbeat + initiate E2EE
+        this.server.on('mobile_connected', (data) => {
+            console.log(`[WS] Mobile connected: ${data.deviceId}`);
+            this.emit('connected');
+            this.startHeartbeat();
+            // Initiate E2EE key exchange with the connected mobile device
+            if (this.e2eeManager && this.e2eeInitialized) {
+                try {
+                    // Clear any old session keys for this device — forces fresh key exchange.
+                    // Without this, queued messages would be encrypted with stale keys from
+                    // a previous connection that the mobile no longer has.
+                    this.e2eeManager.clearSession(data.deviceId);
+                    const initPayload = this.e2eeManager.createKeyExchangeInit(data.deviceId);
+                    this.server?.emitToMobile('encrypted_key_exchange_init', {
+                        ...initPayload,
+                        recipientDeviceId: data.deviceId,
+                    });
+                    // E2EE key exchange initiated
+                }
+                catch (err) {
+                    console.warn('[E2EE] Failed to initiate key exchange');
+                }
+            }
+        });
+        this.server.on('mobile_disconnected', (data) => {
+            console.log(`[WS] Mobile disconnected: ${data.reason}`);
+            this.emit('disconnected', data.reason);
+            this.stopHeartbeat();
+        });
+        // Forward events that need plaintext-drop check
+        for (const event of PLAINTEXT_DROP_EVENTS) {
+            this.server.on(event, (data) => {
+                if (this.shouldDropPlaintextInbound())
+                    return;
+                if (process.env.DEBUG) {
+                    console.log(`[WS] Received ${event}`);
+                }
+                this.emit(event, data);
+            });
+        }
+        // Forward events that pass through without plaintext-drop check
+        for (const event of PASSTHROUGH_EVENTS) {
+            this.server.on(event, (data) => {
+                if (process.env.DEBUG) {
+                    console.log(`[WS] Received ${event}`);
+                }
+                this.emit(event, data);
+            });
+        }
+        // On successful pairing, reset TOFU trust for that specific device (handles re-pair with new keys).
+        // Don't delete pending exchange or re-initiate — the init from mobile_connected is in-flight.
+        this.server.on('pair_device', (data) => {
+            const mobileDeviceId = data.mobileDeviceId;
+            if (mobileDeviceId && this.e2eeManager) {
+                this.e2eeManager.clearTrustOnly(mobileDeviceId);
+                // Reset TOFU trust for re-pair
+            }
+        });
+        // E2EE key exchange events — forwarded from server, handled here
+        this.server.on('encrypted_key_exchange_init', (data) => {
+            if (!this.e2eeManager)
                 return;
+            try {
+                const ack = this.e2eeManager.handleKeyExchangeInit(data);
+                this.e2eePeerDeviceId = data.senderDeviceId;
+                this.server?.emitToMobile('encrypted_key_exchange_ack', {
+                    ...ack,
+                    senderDeviceId: config_1.config.deviceId,
+                    recipientDeviceId: data.senderDeviceId,
+                });
+                this.emit('e2ee_established', { peerDeviceId: data.senderDeviceId });
+                this.flushSensitiveQueue();
+                this.sendAllUsageStats();
+            }
+            catch (err) {
+                console.error('[E2EE] Key exchange init failed');
             }
-            const deviceId = config_1.config.deviceId;
-            if (!deviceId) {
-                reject(new Error('Device not registered'));
+        });
+        this.server.on('encrypted_key_exchange_ack', (data) => {
+            if (!this.e2eeManager)
                 return;
+            try {
+                this.e2eeManager.handleKeyExchangeAck(data);
+                this.e2eePeerDeviceId = data.senderDeviceId;
+                this.emit('e2ee_established', { peerDeviceId: data.senderDeviceId });
+                this.flushSensitiveQueue();
+                this.sendAllUsageStats();
             }
-            // Generate unique session ID for this CLI connection
-            const sessionId = this.sessionId;
-            const userId = config_1.config.userId; // Pass userId from config for user-based routing
-            this.socket = (0, socket_io_client_1.io)(config_1.config.wsUrl, {
-                auth: {
-                    deviceId,
-                    userId, // Include userId so API can track by user even if device not in DB
-                    clientType: 'session-scoped',
-                    sessionId,
-                    cliVersion: require('../package.json').version,
-                },
-                transports: ['websocket'],
-                reconnection: true,
-                reconnectionAttempts: Infinity,
-                reconnectionDelay: 1000,
-                reconnectionDelayMax: 30000,
-                randomizationFactor: 0.5,
-            });
-            // Track whether the initial connect promise has been settled
-            let settled = false;
-            // 30-second timeout for initial connection attempt
-            const connectTimeout = setTimeout(() => {
-                if (!settled) {
-                    settled = true;
-                    reject(new Error('Initial connection timed out after 30 seconds'));
-                }
-            }, 30000);
-            // Debug logging — gated behind DEBUG env var to prevent flooding stdout
+            catch (err) {
+                console.error('[E2EE] Key exchange ack failed');
+            }
+        });
+        // Encrypted messages — decrypt and re-emit as original event
+        this.server.on('encrypted_message', (data) => {
+            if (!this.e2eeManager)
+                return;
+            let plaintext;
+            try {
+                plaintext = this.e2eeManager.decryptMessage(data, data.senderDeviceId);
+            }
+            catch {
+                console.error('[E2EE] Decryption failed — message dropped');
+                return;
+            }
+            // Validate JSON structure separately from decryption
+            let parsed;
+            try {
+                parsed = JSON.parse(plaintext);
+            }
+            catch {
+                console.error('[E2EE] Invalid JSON in decrypted message — dropped');
+                return;
+            }
+            // Validate payload structure
+            if (!parsed || typeof parsed !== 'object') {
+                console.error('[E2EE] Decrypted payload is not an object — dropped');
+                return;
+            }
+            const payload = parsed;
+            const eventName = payload._event;
+            if (typeof eventName !== 'string') {
+                console.error('[E2EE] Missing or invalid _event in decrypted payload — dropped');
+                return;
+            }
+            if (!ALLOWED_ENCRYPTED_EVENTS.has(eventName)) {
+                console.warn('[E2EE] Decrypted event not in whitelist — dropped');
+                return;
+            }
+            this.emit(eventName, payload._data);
+        });
+        // Initialize E2EE (non-blocking — don't delay server start)
+        this.initE2EE().catch((err) => {
+            console.warn('[E2EE] \u26a0 End-to-end encryption initialization failed. Messages will be sent without E2EE protection.');
             if (process.env.DEBUG) {
-                this.socket.onAny((eventName, ...args) => {
-                    if (eventName === 'device_heartbeat_ack' || eventName === 'pong' || eventName === 'ping')
-                        return;
-                    console.log(`[WS-DEBUG] ${eventName}`, JSON.stringify(args).substring(0, 200));
-                });
+                console.warn(`[E2EE] Init error detail:`, err.message);
+            }
+        });
+    }
+    /** Set pairing code on the embedded server for in-process validation */
+    setPairingCode(code) {
+        this.server?.setPairingCode(code);
+    }
+    /**
+     * Initialize E2EE manager: generate/load keys.
+     * Called automatically on startServer. Non-blocking.
+     */
+    async initE2EE() {
+        const deviceId = config_1.config.deviceId;
+        if (!deviceId)
+            return;
+        this.e2eeManager = new e2eeManager_1.E2EEManager(deviceId);
+        await this.e2eeManager.initialize();
+        this.e2eeInitialized = true;
+        // Restore any persisted sessions
+        const persisted = this.e2eeManager.listPersistedDevices();
+        for (const targetDeviceId of persisted) {
+            const restored = await this.e2eeManager.restorePersistedSession(targetDeviceId);
+            if (restored) {
+                // Restored persisted E2EE session
             }
-            this.socket.on('connect', () => {
-                if (this.reconnectAttempts > 0) {
-                    console.log(`[WS] Reconnected after ${this.reconnectAttempts} attempt(s)`);
-                    this.emit('reconnected', { attempts: this.reconnectAttempts });
-                    this.sendHeartbeat();
+        }
+        // E2EE initialized
+    }
+    /**
+     * Send a sensitive event: encrypt if E2EE session exists with the target device.
+     * For events in ENFORCED_SENSITIVE_EVENTS, plaintext fallback is REFUSED — messages
+     * are queued until E2EE session establishes, or dropped after timeout.
+     */
+    emitSensitive(event, data, targetDeviceId) {
+        // If E2EE session exists, encrypt and send
+        if (this.e2eeManager && targetDeviceId && this.e2eeManager.hasSessionKey(targetDeviceId)) {
+            try {
+                const plaintext = JSON.stringify({ _event: event, _data: data });
+                const encrypted = this.e2eeManager.encryptMessage(plaintext, targetDeviceId, this._sessionId || 'default');
+                this.server?.emitToMobile('encrypted_message', encrypted);
+                return;
+            }
+            catch (err) {
+                console.error('[E2EE] Encryption failed, message NOT sent (refusing plaintext fallback)');
+                return;
+            }
+        }
+        // For enforced sensitive events: NEVER send plaintext — queue until E2EE establishes
+        if (ENFORCED_SENSITIVE_EVENTS.has(event)) {
+            if (this.e2eeInitialized) {
+                // E2EE initialized but no session yet — queue for when session establishes
+                if (this.pendingSensitiveMessages.length >= WebSocketClient.MAX_PENDING_SENSITIVE) {
+                    const dropped = this.pendingSensitiveMessages.shift();
+                    if (dropped) {
+                        console.warn('[E2EE] Sensitive queue full, dropped oldest');
+                    }
                 }
-                this.reconnectAttempts = 0;
-                console.log(`[WS] Connected with deviceId: ${deviceId}, sessionId: ${sessionId}`);
-                this.emit('connected');
-                this.startHeartbeat();
-                if (!settled) {
-                    settled = true;
-                    clearTimeout(connectTimeout);
-                    resolve();
+                this.pendingSensitiveMessages.push({
+                    event,
+                    data,
+                    targetDeviceId: targetDeviceId || '__pending__',
+                    queuedAt: Date.now(),
+                });
+                if (this.pendingSensitiveMessages.length === 1) {
+                    console.warn('[E2EE] Queued sensitive event — waiting for E2EE session');
                 }
-            });
-            this.socket.on('disconnect', (reason) => {
-                console.log(`[WS] Disconnected: ${reason} — will continue retrying`);
-                this.emit('disconnected', reason);
-                this.stopHeartbeat();
-            });
-            this.socket.on('connect_error', (error) => {
-                this.reconnectAttempts++;
-                this.emit('error', error);
-                this.emit('reconnecting', { attempt: this.reconnectAttempts });
-            });
-            // Listen for terminal create requests from mobile app
-            this.socket.on('terminal_create', (data) => {
-                console.log(`[WS] Received terminal_create:`, JSON.stringify(data));
-                this.emit('terminal_create', data);
-            });
-            // Listen for terminal commands from mobile app
-            this.socket.on('terminal_command', (data) => {
-                console.log(`[WS] Received terminal_command:`, JSON.stringify(data));
-                this.emit('terminal_command', data);
-            });
-            // Listen for approval responses
-            this.socket.on('approval_response', (data) => {
-                this.emit('approval_response', data);
-            });
-            // Listen for user messages from mobile app
-            this.socket.on('user_message', (data) => {
-                console.log(`[WS] Received user_message: ${data.message.substring(0, 50)}...`);
-                this.emit('user_message', data);
-            });
-            // Listen for Claude session requests from mobile app
-            this.socket.on('claude_resume_session', (data) => {
-                console.log(`[WS] Received claude_resume_session:`, JSON.stringify(data));
-                this.emit('claude_resume_session', data);
-            });
-            this.socket.on('claude_start_session', (data) => {
-                console.log(`[WS] Received claude_start_session:`, JSON.stringify(data));
-                this.emit('claude_start_session', data);
-            });
-            this.socket.on('directory_list', (data) => {
-                console.log(`[WS] Received directory_list:`, JSON.stringify(data));
-                this.emit('directory_list', data);
-            });
-            // Listen for transcript fetch requests from mobile app
-            this.socket.on('transcript_fetch', (data) => {
-                console.log(`[WS] Received transcript_fetch:`, JSON.stringify(data));
-                this.emit('transcript_fetch', data);
-            });
-            // Listen for transcript subscribe requests
-            this.socket.on('transcript_subscribe', (data) => {
-                console.log(`[WS] Received transcript_subscribe:`, JSON.stringify(data));
-                this.emit('transcript_subscribe', data);
-            });
-            // Listen for transcript unsubscribe requests
-            this.socket.on('transcript_unsubscribe', (data) => {
-                console.log(`[WS] Received transcript_unsubscribe:`, JSON.stringify(data));
-                this.emit('transcript_unsubscribe', data);
-            });
-            // Listen for SDK subscribe start requests from API
-            // This is sent when mobile uses transcript_subscribe_sdk
-            this.socket.on('transcript_subscribe_sdk_start', (data) => {
-                console.log(`[WS] Received transcript_subscribe_sdk_start:`, JSON.stringify(data));
-                this.emit('transcript_subscribe_sdk_start', data);
-            });
-            // Listen for claude sessions request (mobile wants current state)
-            this.socket.on('claude_sessions_request', (data) => {
-                console.log(`[WS] Received claude_sessions_request`);
-                this.emit('claude_sessions_request', data);
-            });
-            // Listen for RPC requests from the API gateway
-            this.socket.on('rpc_request', (data) => {
-                console.log(`[WS] Received rpc_request: ${data.method}, requestId: ${data.requestId}`);
-                this.emit('rpc_request', data);
-            });
-            // Listen for read file requests from mobile app
-            this.socket.on('read_file', (data) => {
-                console.log(`[WS] Received read_file: ${data.filePath}`);
-                this.emit('read_file', data);
-            });
-            // Listen for Claude approval responses from mobile
-            this.socket.on('claude_approval_response', (data) => {
-                console.log(`[WS] Received claude_approval_response: ${data.approvalId}, response: ${data.response}`);
-                this.emit('claude_approval_response', data);
-            });
-            // Listen for permission responses from mobile (hook-based approval system)
-            this.socket.on('permission_response', (data) => {
-                console.log(`[WS] Received permission_response: ${data.promptId} -> ${data.decision}`);
-                this.emit('permission_response', data);
-            });
-            // Listen for permission rules sync from mobile
-            this.socket.on('permission_rules_sync', (data) => {
-                console.log(`[WS] Received permission_rules_sync: ${data.rules?.length || 0} rules`);
-                this.emit('permission_rules_sync', data);
-            });
-            // Listen for mobile disconnect notification from backend
-            this.socket.on('mobile_disconnected', (data) => {
-                console.log(`[WS] Received mobile_disconnected for user ${data.userId}`);
-                this.emit('mobile_disconnected', data);
-            });
-        });
+                return;
+            }
+            // E2EE not initialized — drop silently (no user data leaks)
+            console.error('[E2EE] Dropped sensitive event — E2EE not available, refusing plaintext');
+            return;
+        }
+        // Non-sensitive events: plaintext is acceptable
+        this.server?.emitToMobile(event, data);
+    }
+    /**
+     * Flush queued sensitive messages now that E2EE session is established.
+     * Drops messages older than SENSITIVE_QUEUE_TTL_MS.
+     */
+    flushSensitiveQueue() {
+        if (this.pendingSensitiveMessages.length === 0)
+            return;
+        const now = Date.now();
+        let sent = 0;
+        let dropped = 0;
+        for (const msg of this.pendingSensitiveMessages) {
+            if (now - msg.queuedAt > WebSocketClient.SENSITIVE_QUEUE_TTL_MS) {
+                dropped++;
+                continue;
+            }
+            // Resolve pending target device ID
+            const target = msg.targetDeviceId === '__pending__'
+                ? this.e2eePeerDeviceId ?? undefined
+                : msg.targetDeviceId;
+            // Attempt to send via encryption
+            this.emitSensitive(msg.event, msg.data, target);
+            sent++;
+        }
+        this.pendingSensitiveMessages = [];
+        // Flushed sensitive queue
+    }
+    /** Get the E2EE manager (for external key exchange initiation) */
+    getE2EEManager() {
+        return this.e2eeManager;
+    }
+    /** Check if E2EE session is active with a device */
+    isE2EEActive(deviceId) {
+        return this.e2eeManager?.hasSessionKey(deviceId) ?? false;
+    }
+    /** SECURITY: Check if plaintext inbound events should be dropped (E2EE active with peer) */
+    shouldDropPlaintextInbound() {
+        return !!(this.e2eePeerDeviceId && this.e2eeManager?.hasSessionKey(this.e2eePeerDeviceId));
     }
     disconnect() {
         this.stopHeartbeat();
-        if (this.socket) {
-            this.socket.disconnect();
-            this.socket = null;
+        this.e2eeManager?.cleanup(false);
+        this.e2eeManager = null;
+        this.e2eeInitialized = false;
+        this.e2eePeerDeviceId = null;
+        if (this.server) {
+            this.server.stop();
+            this.server = null;
         }
     }
     startHeartbeat() {
@@ -200,124 +393,135 @@ class WebSocketClient extends events_1.EventEmitter {
             this.heartbeatInterval = null;
         }
     }
-    // Send heartbeat to keep connection alive
+    // Send heartbeat to connected mobile
     sendHeartbeat(status = 'online') {
-        this.socket?.emit('device_heartbeat', { status });
+        this.server?.emitToMobile('device_status', { status, deviceId: config_1.config.deviceId });
     }
     // Update device status
     updateStatus(status) {
-        this.socket?.emit('device_heartbeat', { status });
-    }
-    // Send syncing status
-    setSyncing(syncing) {
-        this.socket?.emit('device_syncing', { syncing });
+        this.server?.emitToMobile('device_status', { status, deviceId: config_1.config.deviceId });
     }
-    // Send Claude session update
+    // Send Claude session update (sensitive — contains directory paths)
     sendClaudeSessionUpdate(session) {
-        this.socket?.emit('claude_session_update', session);
+        this.emitSensitive('claude_session_update', { ...session, deviceId: config_1.config.deviceId }, this.e2eePeerDeviceId ?? undefined);
     }
-    // Send multiple Claude sessions as a single batch event
+    // Send multiple Claude sessions as a single batch event (sensitive — contains directory paths)
     sendClaudeSessions(sessions) {
         if (sessions.length > 0) {
-            this.socket?.emit('claude_session_batch_update', { sessions });
+            const withDeviceId = sessions.map(s => ({ ...s, deviceId: config_1.config.deviceId }));
+            this.emitSensitive('claude_session_batch_update', { sessions: withDeviceId }, this.e2eePeerDeviceId ?? undefined);
         }
     }
     // Send tool status update (e.g., Claude active/inactive)
     sendToolStatusUpdate(toolType, status) {
-        this.socket?.emit('tool_status_update', {
+        this.server?.emitToMobile('tool_status_update', {
             toolType,
             status,
             timestamp: new Date().toISOString(),
         });
     }
-    // Send approval request
+    // Send approval request (sensitive — contains code change descriptions)
     sendApprovalRequest(data) {
-        this.socket?.emit('approval_request', data);
+        this.emitSensitive('approval_request', data, this.e2eePeerDeviceId ?? undefined);
     }
-    // Send terminal output
+    // Send terminal output (sensitive — encrypted if E2EE active)
     sendTerminalOutput(data) {
-        this.socket?.emit('terminal_output', data);
+        this.emitSensitive('terminal_output', data, this.e2eePeerDeviceId ?? undefined);
     }
-    // Send working directory change
+    // Send working directory change (sensitive — contains working directory path)
     sendTerminalCwd(data) {
-        this.socket?.emit('terminal_cwd', data);
+        this.emitSensitive('terminal_cwd', data, this.e2eePeerDeviceId ?? undefined);
     }
-    // Send directory listing response
+    // Send directory listing response (sensitive — encrypted if E2EE active)
     sendDirectoryListResponse(data) {
-        this.socket?.emit('directory_list_response', data);
+        this.emitSensitive('directory_list_response', data, this.e2eePeerDeviceId ?? undefined);
     }
-    // Send read file response
+    // Send read file response (sensitive — encrypted if E2EE active)
     sendReadFileResponse(data) {
-        this.socket?.emit('read_file_response', data);
+        this.emitSensitive('read_file_response', data, this.e2eePeerDeviceId ?? undefined);
     }
-    // Send file change notification
+    // Send file change notification (sensitive — contains file paths)
     sendFileChanged(data) {
-        this.socket?.emit('file_changed', data);
+        this.emitSensitive('file_changed', data, this.e2eePeerDeviceId ?? undefined);
     }
-    // Send transcript history to mobile app
+    // Send transcript history to mobile app (sensitive — contains code and conversation)
     sendTranscriptHistory(data) {
-        this.socket?.emit('transcript_history', data);
+        this.emitSensitive('transcript_history', data, this.e2eePeerDeviceId ?? undefined);
     }
-    // Send transcript update (new entry) to mobile app
+    // Send transcript update (new entry) to mobile app (sensitive — contains code)
     sendTranscriptUpdate(data) {
-        this.socket?.emit('transcript_update', data);
+        this.emitSensitive('transcript_update', data, this.e2eePeerDeviceId ?? undefined);
     }
-    // Send RPC response back to API gateway
-    sendRpcResponse(data) {
-        console.log(`[WS] Sending rpc_response: ${data.requestId}, hasResult: ${!!data.result}, hasError: ${!!data.error}`);
-        this.socket?.emit('rpc_response', data);
-    }
-    // Send Claude approval request to mobile
+    // Send Claude approval request to mobile (sensitive — contains context)
     sendClaudeApprovalRequest(data) {
         console.log(`[WS] Sending claude_approval_request: ${data.approvalId}`);
-        this.socket?.emit('claude_approval_request', data);
+        this.emitSensitive('claude_approval_request', data, this.e2eePeerDeviceId ?? undefined);
     }
-    // Send tool activity notification to mobile (non-blocking)
+    // Send tool activity notification to mobile (sensitive — contains tool inputs)
     sendToolActivity(data) {
         console.log(`[WS] Sending tool_activity: ${data.toolName} (${data.toolId})`);
-        this.socket?.emit('tool_activity', data);
+        this.emitSensitive('tool_activity', data, this.e2eePeerDeviceId ?? undefined);
     }
-    // Send permission prompt to mobile (interactive approval from hook system)
+    // Send permission prompt to mobile (sensitive — encrypted if E2EE active)
     sendPermissionPrompt(data) {
         console.log(`[WS] Sending permission_prompt: ${data.toolName} (${data.promptId})`);
-        this.socket?.emit('permission_prompt', data);
+        this.emitSensitive('permission_prompt', data, this.e2eePeerDeviceId ?? undefined);
     }
-    // Send thinking content to mobile
+    // Send thinking content to mobile (sensitive — contains Claude's reasoning about code)
     sendThinkingContent(data) {
-        this.socket?.emit('thinking_content', data);
+        this.emitSensitive('thinking_content', data, this.e2eePeerDeviceId ?? undefined);
     }
-    // Send token usage to mobile
+    // Send token usage to mobile (sensitive — contains session identifiers)
     sendTokenUsage(data) {
-        this.socket?.emit('token_usage', data);
+        this.emitSensitive('token_usage', data, this.e2eePeerDeviceId ?? undefined);
     }
-    // Send pending permissions sync to mobile (on take-over)
+    // Send pending permissions sync to mobile (sensitive — contains prompt details)
     sendPendingPermissionsSync(data) {
         console.log(`[WS] Sending pending_permissions_sync: ${data.prompts.length} prompt(s)`);
-        this.socket?.emit('pending_permissions_sync', data);
+        this.emitSensitive('pending_permissions_sync', data, this.e2eePeerDeviceId ?? undefined);
     }
-    // Send task progress to mobile
+    // Send task progress to mobile (sensitive — contains task subjects/descriptions)
     sendTaskProgress(data) {
-        this.socket?.emit('task_progress', data);
+        this.emitSensitive('task_progress', data, this.e2eePeerDeviceId ?? undefined);
     }
-    // E2EE event emitters
+    // E2EE event emitters — send to mobile via server
     emitKeyExchangeInit(data) {
-        this.socket?.emit('encrypted_key_exchange_init', data);
+        this.server?.emitToMobile('encrypted_key_exchange_init', data);
     }
     emitKeyExchangeAck(data) {
-        this.socket?.emit('encrypted_key_exchange_ack', data);
+        this.server?.emitToMobile('encrypted_key_exchange_ack', data);
     }
     emitEncryptedMessage(data) {
-        this.socket?.emit('encrypted_message', data);
-    }
-    // Send Claude session event
+        this.server?.emitToMobile('encrypted_message', data);
+    }
+    /** Set the usage tracker instance (called from index.ts after instantiation) */
+    setUsageTracker(tracker) {
+        this.usageTracker = tracker;
+    }
+    /** Send all usage stats to mobile (called after E2EE established and on request) */
+    sendAllUsageStats() {
+        if (!this.usageTracker)
+            return;
+        const deviceId = config_1.config.deviceId;
+        const stats = this.usageTracker.getUsageStats('all');
+        const daily = this.usageTracker.getDailyUsage();
+        const streak = this.usageTracker.getStreakInfo();
+        this.emitSensitive('usage_stats_sync', { ...stats, deviceId }, this.e2eePeerDeviceId ?? undefined);
+        this.emitSensitive('daily_usage_sync', { daily, deviceId }, this.e2eePeerDeviceId ?? undefined);
+        this.emitSensitive('streak_info_sync', { ...streak, deviceId }, this.e2eePeerDeviceId ?? undefined);
+        console.log(`[WS] Sent usage stats sync to mobile`);
+    }
+    // Send Claude session event (sensitive — may contain error messages with paths)
     sendClaudeSessionEvent(data) {
-        this.socket?.emit('claude_session_event', data);
+        this.emitSensitive('claude_session_event', data, this.e2eePeerDeviceId ?? undefined);
     }
     get isConnected() {
-        return this.socket?.connected ?? false;
+        return this.server?.hasMobileConnection() ?? false;
     }
 }
 exports.WebSocketClient = WebSocketClient;
+WebSocketClient.SENSITIVE_QUEUE_TTL_MS = 30000; // 30 seconds max wait
+WebSocketClient.MAX_PENDING_SENSITIVE = 200;
 exports.wsClient = new WebSocketClient();
 exports.default = exports.wsClient;
 //# sourceMappingURL=websocket.js.map