forkoff 1.0.17 → 1.0.19

package/dist/index.js

@@ -41,36 +41,53 @@ exports.createProgram = createProgram;
 const commander_1 = require("commander");
 const chalk_1 = __importDefault(require("chalk"));
 const qrcode_terminal_1 = __importDefault(require("qrcode-terminal"));
+const crypto = __importStar(require("crypto"));
 const config_1 = require("./config");
-const api_1 = require("./api");
 const websocket_1 = require("./websocket");
 const terminal_1 = require("./terminal");
 const approval_1 = require("./approval");
 const tools_1 = require("./tools");
 const transcript_streamer_1 = require("./transcript-streamer");
 const logger_1 = require("./logger");
+const usage_tracker_1 = require("./usage-tracker");
 const startup_1 = require("./startup");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const os = __importStar(require("os"));
+/** Get the local network IP (first non-internal IPv4 address) */
+function getLocalIp() {
+    const interfaces = os.networkInterfaces();
+    for (const name of Object.keys(interfaces)) {
+        for (const iface of interfaces[name]) {
+            if (iface.family === 'IPv4' && !iface.internal) {
+                return iface.address;
+            }
+        }
+    }
+    return '127.0.0.1';
+}
 function createProgram() {
     const program = new commander_1.Command();
     program
         .name('forkoff')
         .description('CLI tool for ForkOff - Connect your AI coding tools to mobile')
         .version(require('../package.json').version)
-        .option('-q, --quiet', 'Suppress all output (for background operation)');
+        .option('-q, --quiet', 'Suppress all output (for background operation)')
+        .option('--debug', 'Enable debug logging to file (~/.forkoff-cli/logs/)');
     program.hook('preAction', () => {
+        if (program.opts().debug) {
+            (0, logger_1.setDebug)(true);
+            (0, logger_1.cleanupOldLogs)(10);
+        }
         if (program.opts().quiet) {
             (0, logger_1.setQuiet)(true);
         }
     });
-    // Configure API/WS URLs
+    // Configure CLI settings
     program
         .command('config')
         .description('Configure ForkOff CLI settings')
-        .option('-a, --api <url>', 'Set API URL')
-        .option('-w, --ws <url>', 'Set WebSocket URL')
+        .option('-p, --port <port>', 'Set relay server port')
         .option('-n, --name <name>', 'Set device name')
         .option('--show', 'Show current configuration')
         .option('--reset', 'Reset all configuration')
@@ -80,22 +97,24 @@ function createProgram() {
             console.log(chalk_1.default.green('Configuration reset successfully'));
             return;
         }
-        if (options.api) {
-            config_1.config.apiUrl = options.api;
-            console.log(chalk_1.default.green(`API URL set to: ${options.api}`));
-        }
-        if (options.ws) {
-            config_1.config.wsUrl = options.ws;
-            console.log(chalk_1.default.green(`WebSocket URL set to: ${options.ws}`));
+        if (options.port) {
+            const port = parseInt(options.port, 10);
+            if (isNaN(port) || port < 1 || port > 65535) {
+                console.log(chalk_1.default.red('Invalid port number. Must be between 1 and 65535.'));
+                return;
+            }
+            config_1.config.relayPort = port;
+            console.log(chalk_1.default.green(`Relay port set to: ${port}`));
         }
         if (options.name) {
             config_1.config.deviceName = options.name;
             console.log(chalk_1.default.green(`Device name set to: ${options.name}`));
         }
-        if (options.show || (!options.api && !options.ws && !options.name && !options.reset)) {
+        if (options.show || (!options.port && !options.name && !options.reset)) {
+            const localIp = getLocalIp();
             console.log(chalk_1.default.bold('\nCurrent Configuration:'));
-            console.log(`  API URL:     ${chalk_1.default.cyan(config_1.config.apiUrl)}`);
-            console.log(`  WebSocket:   ${chalk_1.default.cyan(config_1.config.wsUrl)}`);
+            console.log(`  Relay URL:   ${chalk_1.default.cyan(`ws://${localIp}:${config_1.config.relayPort}`)}`);
+            console.log(`  Relay Port:  ${chalk_1.default.cyan(String(config_1.config.relayPort))}`);
             console.log(`  Device Name: ${chalk_1.default.cyan(config_1.config.deviceName)}`);
             console.log(`  Device ID:   ${chalk_1.default.cyan(config_1.config.deviceId || 'Not registered')}`);
             console.log(`  Paired:      ${config_1.config.isPaired ? chalk_1.default.green('Yes') : chalk_1.default.yellow('No')}`);
@@ -111,52 +130,39 @@ function createProgram() {
         .command('pair')
         .description('Generate pairing code to connect with mobile app')
         .action(async () => {
-        const spinner = (0, logger_1.createSpinner)('Connecting to ForkOff server...').start();
+        const spinner = (0, logger_1.createSpinner)('Starting relay server...').start();
         try {
-            // Check server health
-            const isHealthy = await api_1.api.healthCheck();
-            if (!isHealthy) {
-                spinner.fail('Cannot connect to ForkOff server');
-                console.log(chalk_1.default.yellow(`\nMake sure the server is running at ${config_1.config.apiUrl}`));
-                console.log(chalk_1.default.dim('Use "forkoff config --api <url>" to change the server URL'));
-                return;
-            }
-            spinner.text = 'Registering device...';
-            // Register device or refresh pairing code
-            let result;
-            if (config_1.config.deviceId) {
-                try {
-                    result = await api_1.api.refreshPairingCode(config_1.config.deviceId);
-                }
-                catch {
-                    // Device might not exist anymore, register fresh
-                    result = await api_1.api.registerDevice();
-                }
-            }
-            else {
-                result = await api_1.api.registerDevice();
-            }
-            // Save device info
-            config_1.config.deviceId = result.device.id;
-            config_1.config.pairingCode = result.pairingCode;
-            spinner.succeed('Device registered successfully!\n');
+            // Ensure we have a deviceId
+            config_1.config.ensureDeviceId();
+            // Start embedded relay server
+            await websocket_1.wsClient.startServer(config_1.config.relayPort);
+            // Generate random 8-char pairing code
+            const pairingCode = crypto.randomBytes(4).toString('hex').toUpperCase().slice(0, 8);
+            config_1.config.pairingCode = pairingCode;
+            // Set pairing code on server for in-process validation
+            websocket_1.wsClient.setPairingCode(pairingCode);
+            const localIp = getLocalIp();
+            const relayUrl = `ws://${localIp}:${config_1.config.relayPort}`;
+            spinner.succeed(`Relay server started on ${relayUrl}\n`);
             // Display pairing info
             console.log(chalk_1.default.bold('Scan this QR code with the ForkOff mobile app:\n'));
-            // Generate QR code with pairing URL
-            const pairingUrl = `forkoff://pair/${result.pairingCode}`;
+            const pairingUrl = `forkoff://pair/${pairingCode}?relay=${encodeURIComponent(relayUrl)}`;
             qrcode_terminal_1.default.generate(pairingUrl, { small: true }, (code) => {
                 console.log(code);
             });
             console.log(chalk_1.default.bold('\nOr enter this code manually:\n'));
-            console.log(chalk_1.default.bgBlue.white.bold(`  ${result.pairingCode}  `));
+            console.log(chalk_1.default.bgBlue.white.bold(`  ${pairingCode}  `));
             console.log();
-            const expiresAt = new Date(result.expiresAt);
-            console.log(chalk_1.default.dim(`Code expires at: ${expiresAt.toLocaleTimeString()}`));
+            console.log(chalk_1.default.dim(`Relay: ${relayUrl}`));
             console.log();
             // Wait for pairing
             console.log(chalk_1.default.yellow('Waiting for mobile app to scan...'));
             console.log(chalk_1.default.dim('Press Ctrl+C to cancel\n'));
-            await waitForPairing(result.device.id);
+            const pairData = await waitForPairing();
+            // Server already sent pair_device_ack to mobile
+            config_1.config.pairedAt = new Date().toISOString();
+            console.log(chalk_1.default.green('\n\u2713 Device paired successfully!'));
+            console.log(chalk_1.default.dim('\nStarting connection...\n'));
             // Auto-register startup if not explicitly disabled
             if (config_1.config.startupEnabled !== false) {
                 try {
@@ -167,11 +173,11 @@ function createProgram() {
                     // Non-critical — don't fail pairing over this
                 }
             }
-            // Auto-connect after successful pairing
+            // Continue to main connection (server already running)
             await startConnection();
         }
         catch (error) {
-            spinner.fail('Failed to register device');
+            spinner.fail('Failed to pair device');
             console.error(chalk_1.default.red(error.message || 'Unknown error'));
         }
     });
@@ -184,29 +190,15 @@ function createProgram() {
             console.log(chalk_1.default.yellow('Device not registered. Run "forkoff pair" first.'));
             return;
         }
-        const spinner = (0, logger_1.createSpinner)('Checking status...').start();
-        try {
-            const status = await api_1.api.checkPairingStatus(config_1.config.deviceId);
-            spinner.stop();
-            console.log(chalk_1.default.bold('\nDevice Status:'));
-            console.log(`  Device ID:   ${chalk_1.default.cyan(config_1.config.deviceId)}`);
-            console.log(`  Device Name: ${chalk_1.default.cyan(config_1.config.deviceName)}`);
-            console.log(`  Paired:      ${status.isPaired ? chalk_1.default.green('Yes') : chalk_1.default.yellow('No')}`);
-            if (status.isPaired) {
-                config_1.config.userId = status.userId;
-                config_1.config.pairedAt = config_1.config.pairedAt || new Date().toISOString();
-                console.log(`  User ID:     ${chalk_1.default.cyan(status.userId)}`);
-            }
-            if (websocket_1.wsClient.isConnected) {
-                console.log(`  WebSocket:   ${chalk_1.default.green('Connected')}`);
-            }
-            else {
-                console.log(`  WebSocket:   ${chalk_1.default.yellow('Disconnected')}`);
-            }
-        }
-        catch (error) {
-            spinner.fail('Failed to check status');
-            console.error(chalk_1.default.red(error.message || 'Unknown error'));
+        const localIp = getLocalIp();
+        console.log(chalk_1.default.bold('\nDevice Status:'));
+        console.log(`  Device ID:   ${chalk_1.default.cyan(config_1.config.deviceId)}`);
+        console.log(`  Device Name: ${chalk_1.default.cyan(config_1.config.deviceName)}`);
+        console.log(`  Paired:      ${config_1.config.isPaired ? chalk_1.default.green('Yes') : chalk_1.default.yellow('No')}`);
+        console.log(`  Relay URL:   ${chalk_1.default.cyan(`ws://${localIp}:${config_1.config.relayPort}`)}`);
+        console.log(`  Mobile:      ${websocket_1.wsClient.isConnected ? chalk_1.default.green('Connected') : chalk_1.default.yellow('Not connected')}`);
+        if (config_1.config.pairedAt) {
+            console.log(`  Paired At:   ${chalk_1.default.dim(config_1.config.pairedAt)}`);
         }
     });
     // Connect and stay online (for returning users who already paired)
@@ -232,6 +224,12 @@ function createProgram() {
                 // Non-critical
             }
         }
+        // Start embedded relay server before entering connection flow
+        const localIp = getLocalIp();
+        const relayUrl = `ws://${localIp}:${config_1.config.relayPort}`;
+        await websocket_1.wsClient.startServer(config_1.config.relayPort);
+        console.log(chalk_1.default.cyan(`Relay server started on ${relayUrl}`));
+        console.log(chalk_1.default.dim('Waiting for mobile app to connect...\n'));
         await startConnection();
     });
     // Disconnect/unpair device
@@ -247,7 +245,6 @@ function createProgram() {
             }
             catch { }
         }
-        config_1.config.userId = null;
         config_1.config.pairedAt = null;
         config_1.config.pairingCode = null;
         console.log(chalk_1.default.green('Device disconnected and unpaired.'));
@@ -404,24 +401,17 @@ function createProgram() {
             console.error(chalk_1.default.red(error.message));
         }
     });
-    // Helper function to start connection and set up event handlers
+    // Helper function to set up event handlers (server already started by caller)
     async function startConnection() {
-        const spinner = (0, logger_1.createSpinner)('Connecting to ForkOff...').start();
+        const spinner = (0, logger_1.createSpinner)('Initializing...').start();
         try {
-            await websocket_1.wsClient.connect();
             tools_1.PermissionIpcManager.cleanupStaleTempFiles();
-            spinner.succeed('Connected to ForkOff!\n');
-            // Detect and report connected tools
+            spinner.succeed('Ready!\n');
+            // Detect connected tools
             spinner.start('Detecting AI coding tools...');
             try {
                 const toolResult = await tools_1.toolDetector.detectAll();
                 if (toolResult.tools.length > 0) {
-                    const toolsToReport = toolResult.tools.map(tool => ({
-                        type: tool.type,
-                        name: tool.name,
-                        version: tool.version || null,
-                    }));
-                    await api_1.api.reportConnectedTools(config_1.config.deviceId, toolsToReport);
                     spinner.succeed(`Detected ${toolResult.tools.length} AI tool(s): ${toolResult.tools.map(t => t.name).join(', ')}`);
                 }
                 else {
@@ -443,7 +433,7 @@ function createProgram() {
             });
             // When a session is auto-created (command received before terminal_create), send the cwd
             terminal_1.terminalManager.on('session_created', (data) => {
-                console.log(chalk_1.default.dim(`[Terminal] Session auto-created: ${data.terminalSessionId} at ${data.cwd}`));
+                console.log(chalk_1.default.dim(`[Terminal] Session auto-created: ${data.terminalSessionId}`));
                 websocket_1.wsClient.sendTerminalCwd({
                     terminalSessionId: data.terminalSessionId,
                     cwd: data.cwd,
@@ -465,7 +455,7 @@ function createProgram() {
                     terminalSessionId: data.terminalSessionId,
                     cwd: session.cwd,
                 });
-                console.log(chalk_1.default.dim(`[Terminal] Session created with cwd: ${session.cwd}`));
+                console.log(chalk_1.default.dim(`[Terminal] Session created`));
             });
             // Set up event handlers
             websocket_1.wsClient.on('terminal_command', async (data) => {
@@ -496,11 +486,11 @@ function createProgram() {
                 console.log(chalk_1.default.cyan('[Claude] Scanning for Claude sessions...'));
                 // Attach event listeners BEFORE starting to watch (so we catch initial events)
                 tools_1.claudeSessionDetector.on('session_detected', (session) => {
-                    console.log(chalk_1.default.cyan(`[Claude] New session detected: ${session.directory}`));
+                    console.log(chalk_1.default.cyan(`[Claude] New session detected`));
                     websocket_1.wsClient.sendClaudeSessionUpdate(session);
                 });
                 tools_1.claudeSessionDetector.on('session_changed', (session) => {
-                    console.log(chalk_1.default.dim(`[Claude] Session updated: ${session.directory} (${session.state})`));
+                    console.log(chalk_1.default.dim(`[Claude] Session updated (${session.state})`));
                     websocket_1.wsClient.sendClaudeSessionUpdate(session);
                 });
                 tools_1.claudeSessionDetector.on('claude_running_changed', (isRunning) => {
@@ -535,18 +525,20 @@ function createProgram() {
             }
             // Log approval events
             approval_1.approvalManager.on('approved', (approval) => {
-                console.log(chalk_1.default.green(`[Approval] Approved: ${approval.description}`));
+                console.log(chalk_1.default.green(`[Approval] Approved: ${approval.approvalId}`));
             });
             approval_1.approvalManager.on('rejected', (approval) => {
-                console.log(chalk_1.default.red(`[Approval] Rejected: ${approval.description}`));
+                console.log(chalk_1.default.red(`[Approval] Rejected: ${approval.approvalId}`));
             });
             // Handle Claude start session request from mobile
             websocket_1.wsClient.on('claude_start_session', async (data) => {
-                console.log(chalk_1.default.cyan(`[Claude] Start session request: ${data.directory}`));
+                console.log(chalk_1.default.cyan(`[Claude] Start session request for ${data.terminalSessionId}`));
                 try {
                     const result = await tools_1.claudeProcessManager.startSession(data.directory, data.terminalSessionId, data.dangerouslySkipPermissions, data.interactivePermissions);
                     websocket_1.wsClient.sendToolStatusUpdate('claude_code', 'active');
                     websocket_1.wsClient.sendTerminalCwd({ terminalSessionId: data.terminalSessionId, cwd: result.cwd });
+                    // Track session start for analytics
+                    usageTracker.recordSessionStart();
                     // Notify mobile that the session is ready for input
                     websocket_1.wsClient.sendClaudeSessionEvent({
                         sessionKey: data.terminalSessionId,
@@ -563,13 +555,13 @@ function createProgram() {
             // Claude is only spawned when the user actually sends a message (via user_message event)
             // This prevents duplicate transcript entries from double spawns
             websocket_1.wsClient.on('claude_resume_session', async (data) => {
-                console.log(chalk_1.default.cyan(`[Claude] Resume session request: ${data.sessionKey} in ${data.directory}`));
+                console.log(chalk_1.default.cyan(`[Claude] Resume session request`));
                 // Look up the correct directory from our locally scanned sessions
                 // The mobile app may have a cached/stale directory (e.g. with corrupted hyphens)
                 let resolvedDir = data.directory;
                 const knownSession = tools_1.claudeSessionDetector.getSessions().find(s => s.sessionKey === data.sessionKey);
                 if (knownSession && knownSession.directory) {
-                    console.log(chalk_1.default.dim(`[Claude] Using local directory for session: ${knownSession.directory}`));
+                    console.log(chalk_1.default.dim(`[Claude] Using local directory for session`));
                     resolvedDir = knownSession.directory;
                 }
                 if (resolvedDir === '~' || resolvedDir.startsWith('~/')) {
@@ -607,7 +599,7 @@ function createProgram() {
                     sessionKey: data.sessionKey,
                     event: { type: 'ready' },
                 });
-                console.log(chalk_1.default.green(`[Claude] Session ready (will spawn on first message): ${data.sessionKey}`));
+                console.log(chalk_1.default.green(`[Claude] Session ready (will spawn on first message)`));
             });
             // Handle directory listing requests
             websocket_1.wsClient.on('directory_list', async (data) => {
@@ -622,8 +614,10 @@ function createProgram() {
                     const homeDir = os.homedir();
                     // SECURITY: Only allow access to directories under home directory
                     // This prevents accessing sensitive system files like /etc/passwd
-                    if (!resolvedPath.startsWith(homeDir)) {
-                        console.warn(chalk_1.default.yellow(`[Dir] Access denied - path outside home directory: ${resolvedPath}`));
+                    // Uses path.relative() for cross-platform safety (handles Windows case-insensitivity)
+                    const dirRelative = path.relative(homeDir, resolvedPath);
+                    if (dirRelative.startsWith('..') || path.isAbsolute(dirRelative)) {
+                        console.warn(chalk_1.default.yellow(`[Dir] Access denied — path outside home directory`));
                         websocket_1.wsClient.sendDirectoryListResponse({ requestId: data.requestId, entries: [], currentPath: data.path });
                         return;
                     }
@@ -648,13 +642,13 @@ function createProgram() {
             });
             // Handle read file requests from mobile (e.g., CLAUDE.md)
             websocket_1.wsClient.on('read_file', async (data) => {
-                console.log(chalk_1.default.dim(`[File] Read request: ${data.filePath}`));
+                console.log(chalk_1.default.dim(`[File] Read request received`));
                 try {
                     // SECURITY: Whitelist of allowed filenames
                     const allowedFiles = ['CLAUDE.md', 'README.md', 'package.json'];
                     const fileName = path.basename(data.filePath);
                     if (!allowedFiles.includes(fileName)) {
-                        console.warn(chalk_1.default.yellow(`[File] Access denied - file not in whitelist: ${fileName}`));
+                        console.warn(chalk_1.default.yellow(`[File] Access denied — file not in whitelist`));
                         websocket_1.wsClient.sendReadFileResponse({
                             requestId: data.requestId,
                             exists: false,
@@ -670,14 +664,16 @@ function createProgram() {
                     }
                     resolvedPath = path.resolve(resolvedPath);
                     // SECURITY: Only allow access under home directory
+                    // Uses path.relative() for cross-platform safety (handles Windows case-insensitivity)
                     const homeDir = os.homedir();
-                    if (!resolvedPath.startsWith(homeDir)) {
-                        console.warn(chalk_1.default.yellow(`[File] Access denied - path outside home directory: ${resolvedPath}`));
+                    const fileRelative = path.relative(homeDir, resolvedPath);
+                    if (fileRelative.startsWith('..') || path.isAbsolute(fileRelative)) {
+                        console.warn(chalk_1.default.yellow(`[File] Access denied — path outside home directory`));
                         websocket_1.wsClient.sendReadFileResponse({
                             requestId: data.requestId,
                             exists: false,
                             fileName,
-                            error: 'Path outside home directory',
+                            error: 'Access denied',
                         });
                         return;
                     }
@@ -710,20 +706,28 @@ function createProgram() {
                     });
                 }
                 catch (error) {
-                    console.error(chalk_1.default.red(`[File] Error: ${error.message}`));
+                    console.error(`[File] Error reading ${path.basename(data.filePath)}:`, error.message);
                     websocket_1.wsClient.sendReadFileResponse({
                         requestId: data.requestId,
                         exists: false,
                         fileName: path.basename(data.filePath),
-                        error: error.message,
+                        error: 'File read failed',
                     });
                 }
             });
             // Handle transcript fetch requests from mobile
             websocket_1.wsClient.on('transcript_fetch', async (data) => {
-                console.log(chalk_1.default.dim(`[Transcript] Fetching: ${data.sessionKey}, offset: ${data.offset}, limit: ${data.limit}, reverse: ${data.reverse}`));
+                console.log(chalk_1.default.dim(`[Transcript] Fetching: offset: ${data.offset}, limit: ${data.limit}`));
                 try {
-                    const result = await transcript_streamer_1.transcriptStreamer.fetchHistory(data.transcriptPath, data.offset || 0, data.limit || 100, data.reverse !== false // Default to true (most recent first)
+                    // SECURITY: Validate transcript path is under ~/.claude/projects/ to prevent path traversal
+                    const resolvedTranscriptPath = path.resolve(data.transcriptPath);
+                    const claudeProjectsDir = path.join(os.homedir(), '.claude', 'projects');
+                    const relPath = path.relative(claudeProjectsDir, resolvedTranscriptPath);
+                    if (relPath.startsWith('..') || path.isAbsolute(relPath)) {
+                        console.warn(chalk_1.default.yellow(`[Transcript] Access denied — path outside ~/.claude/projects/`));
+                        return;
+                    }
+                    const result = await transcript_streamer_1.transcriptStreamer.fetchHistory(resolvedTranscriptPath, data.offset || 0, data.limit || 100, data.reverse !== false // Default to true (most recent first)
                     );
                     const payload = JSON.stringify(result.entries);
                     console.log(chalk_1.default.dim(`[Transcript] Sending history: ${result.entries.length} entries, ${result.totalEntries} total, payload ~${(payload.length / 1024).toFixed(0)}KB`));
@@ -740,29 +744,22 @@ function createProgram() {
             });
             // Handle transcript subscribe
             websocket_1.wsClient.on('transcript_subscribe', (data) => {
-                console.log(chalk_1.default.dim(`[Transcript] Subscribing: ${data.sessionKey}`));
-                transcript_streamer_1.transcriptStreamer.subscribeToUpdates(data.sessionKey, data.transcriptPath);
+                console.log(chalk_1.default.dim(`[Transcript] Subscribing to session`));
+                // SECURITY: Validate transcript path to prevent path traversal
+                const resolvedSubPath = path.resolve(data.transcriptPath);
+                const claudeDir = path.join(os.homedir(), '.claude', 'projects');
+                const subRelPath = path.relative(claudeDir, resolvedSubPath);
+                if (subRelPath.startsWith('..') || path.isAbsolute(subRelPath)) {
+                    console.warn(chalk_1.default.yellow(`[Transcript] Subscribe denied — path outside ~/.claude/projects/`));
+                    return;
+                }
+                transcript_streamer_1.transcriptStreamer.subscribeToUpdates(data.sessionKey, resolvedSubPath);
             });
             // Handle transcript unsubscribe
             websocket_1.wsClient.on('transcript_unsubscribe', (data) => {
-                console.log(chalk_1.default.dim(`[Transcript] Unsubscribing: ${data.sessionKey}`));
+                console.log(chalk_1.default.dim(`[Transcript] Unsubscribing from session`));
                 transcript_streamer_1.transcriptStreamer.unsubscribeFromUpdates(data.sessionKey);
             });
-            // Handle SDK subscribe start - mobile wants live updates for a session
-            // This is sent by API when mobile uses transcript_subscribe_sdk
-            websocket_1.wsClient.on('transcript_subscribe_sdk_start', async (data) => {
-                console.log(chalk_1.default.cyan(`[Transcript] SDK subscribe start: ${data.sessionKey}`));
-                // Find the transcript file for this session
-                const sessions = tools_1.claudeSessionDetector.scanSessions();
-                const session = sessions.find(s => s.sessionKey === data.sessionKey);
-                if (session?.transcriptPath) {
-                    console.log(chalk_1.default.dim(`[Transcript] Starting watch for: ${session.transcriptPath}`));
-                    transcript_streamer_1.transcriptStreamer.subscribeToUpdates(data.sessionKey, session.transcriptPath);
-                }
-                else {
-                    console.log(chalk_1.default.yellow(`[Transcript] No transcript found for session: ${data.sessionKey}`));
-                }
-            });
             // Handle claude sessions request - mobile app wants current sessions
             websocket_1.wsClient.on('claude_sessions_request', () => {
                 console.log(chalk_1.default.cyan(`[Claude] Sessions requested by mobile`));
@@ -786,118 +783,6 @@ function createProgram() {
                     websocket_1.wsClient.sendToolStatusUpdate('claude_code', hasActiveSession ? 'active' : 'inactive');
                 }
             });
-            // Handle RPC requests from the API gateway
-            websocket_1.wsClient.on('rpc_request', async (data) => {
-                console.log(chalk_1.default.cyan(`[RPC] Request: ${data.method}, requestId: ${data.requestId}`));
-                try {
-                    if (data.method === 'get_session_history') {
-                        const { claudeSessionId, sessionKey, directory, limit = 400, offset = 0 } = data.params;
-                        console.log(chalk_1.default.dim(`[RPC] get_session_history request received`));
-                        // Find the transcript file
-                        let transcriptPath;
-                        // If claudeSessionId is provided, search for the JSONL file directly
-                        if (claudeSessionId) {
-                            // SECURITY: Validate claudeSessionId to prevent path traversal
-                            // Session IDs should be alphanumeric with hyphens/underscores only
-                            const sessionIdRegex = /^[a-zA-Z0-9_-]+$/;
-                            if (!sessionIdRegex.test(claudeSessionId)) {
-                                console.warn(chalk_1.default.yellow(`[RPC] Invalid claudeSessionId format - rejected`));
-                                websocket_1.wsClient.sendRpcResponse({
-                                    requestId: data.requestId,
-                                    error: { code: -32602, message: 'Invalid session ID format' }
-                                });
-                                return;
-                            }
-                            const claudeProjectsDir = path.join(os.homedir(), '.claude', 'projects');
-                            if (fs.existsSync(claudeProjectsDir)) {
-                                const projectDirs = fs.readdirSync(claudeProjectsDir);
-                                for (const projectDir of projectDirs) {
-                                    // SECURITY: Validate projectDir as well to prevent traversal
-                                    if (!sessionIdRegex.test(projectDir) && !/^[a-zA-Z0-9_.-]+$/.test(projectDir)) {
-                                        continue;
-                                    }
-                                    const potentialPath = path.join(claudeProjectsDir, projectDir, `${claudeSessionId}.jsonl`);
-                                    // SECURITY: Verify the resolved path is still under claudeProjectsDir
-                                    const resolvedPotentialPath = path.resolve(potentialPath);
-                                    if (!resolvedPotentialPath.startsWith(claudeProjectsDir)) {
-                                        continue;
-                                    }
-                                    if (fs.existsSync(potentialPath)) {
-                                        transcriptPath = potentialPath;
-                                        console.log(chalk_1.default.dim(`[RPC] Found JSONL transcript`));
-                                        break;
-                                    }
-                                }
-                            }
-                        }
-                        // If not found by claudeSessionId, search all sessions
-                        if (!transcriptPath && tools_1.claudeSessionDetector.isClaudeInstalled()) {
-                            const sessions = tools_1.claudeSessionDetector.scanSessions();
-                            // First try to match by sessionKey
-                            let session = sessions.find(s => s.sessionKey === sessionKey);
-                            // If no match by sessionKey, try to find most recent session for the same directory
-                            if (!session && sessions.length > 0 && directory) {
-                                const normalizedDir = path.resolve(directory);
-                                session = sessions.find(s => path.resolve(s.directory) === normalizedDir);
-                                if (session) {
-                                    console.log(chalk_1.default.dim(`[RPC] Using directory-matched session as fallback: ${session.sessionKey}`));
-                                }
-                                else {
-                                    console.log(chalk_1.default.dim(`[RPC] No session found for directory: ${normalizedDir}`));
-                                }
-                            }
-                            if (session?.transcriptPath) {
-                                transcriptPath = session.transcriptPath;
-                                console.log(chalk_1.default.dim(`[RPC] Found transcript path: ${transcriptPath}`));
-                            }
-                        }
-                        if (!transcriptPath || !fs.existsSync(transcriptPath)) {
-                            console.log(chalk_1.default.yellow(`[RPC] No transcript file found for session`));
-                            websocket_1.wsClient.sendRpcResponse({
-                                requestId: data.requestId,
-                                result: { entries: [], totalEntries: 0, hasMore: false }
-                            });
-                            return;
-                        }
-                        // Read the transcript file
-                        const result = await transcript_streamer_1.transcriptStreamer.fetchHistory(transcriptPath, offset, limit, true);
-                        console.log(chalk_1.default.green(`[RPC] Loaded ${result.entries.length} entries from transcript`));
-                        // IMPORTANT: Start watching this transcript for live updates
-                        // This is needed because SDK mode doesn't send transcript_subscribe
-                        // Use sessionKey from mobile for updates (must match what mobile is listening for)
-                        const updateSessionKey = sessionKey;
-                        if (!updateSessionKey) {
-                            console.log(chalk_1.default.yellow(`[RPC] No sessionKey provided, using claudeSessionId - updates may not route correctly`));
-                        }
-                        const watchKey = updateSessionKey || claudeSessionId || data.requestId;
-                        console.log(chalk_1.default.cyan(`[RPC] Starting file watch for live updates: ${watchKey}`));
-                        transcript_streamer_1.transcriptStreamer.subscribeToUpdates(watchKey, transcriptPath);
-                        websocket_1.wsClient.sendRpcResponse({
-                            requestId: data.requestId,
-                            result: {
-                                entries: result.entries,
-                                totalEntries: result.totalEntries,
-                                hasMore: result.hasMore,
-                                sessionKey: watchKey, // Tell mobile which sessionKey to listen for updates
-                            }
-                        });
-                    }
-                    else {
-                        console.log(chalk_1.default.yellow(`[RPC] Unknown method: ${data.method}`));
-                        websocket_1.wsClient.sendRpcResponse({
-                            requestId: data.requestId,
-                            error: { code: -32601, message: `Method not found: ${data.method}` }
-                        });
-                    }
-                }
-                catch (error) {
-                    console.error(chalk_1.default.red(`[RPC] Error handling ${data.method}:`, error.message));
-                    websocket_1.wsClient.sendRpcResponse({
-                        requestId: data.requestId,
-                        error: { code: -32603, message: error.message || 'Internal error' }
-                    });
-                }
-            });
             // Forward live transcript updates to WebSocket
             transcript_streamer_1.transcriptStreamer.on('update', (data) => {
                 console.log(chalk_1.default.green(`[Transcript] Sending update for ${data.sessionKey}: ${data.entry?.type}`));
@@ -927,7 +812,7 @@ function createProgram() {
             });
             // Forward tool activity events to mobile (non-blocking notifications)
             tools_1.claudeProcessManager.on('tool_activity', (data) => {
-                console.log(chalk_1.default.dim(`[Claude] Tool activity: ${data.toolName} - ${data.inputSummary?.substring(0, 60)}`));
+                console.log(chalk_1.default.dim(`[Claude] Tool activity: ${data.toolName}`));
                 websocket_1.wsClient.sendToolActivity(data);
             });
             // Forward permission prompts from hook system to mobile (interactive approval)
@@ -943,7 +828,7 @@ function createProgram() {
             });
             // Handle permission responses from mobile → route back to hook IPC
             websocket_1.wsClient.on('permission_response', (data) => {
-                console.log(chalk_1.default.green(`[Claude] Permission response: ${data.promptId} -> ${data.decision}`));
+                console.log(chalk_1.default.green(`[Claude] Permission response: ${data.promptId}`));
                 tools_1.claudeProcessManager.handlePermissionResponse(data.promptId, data.decision, data.reason);
             });
             // Handle permission rules sync from mobile — write rules to disk for hook script
@@ -953,16 +838,9 @@ function createProgram() {
                     tools_1.claudeProcessManager.updatePermissionRules(data.rules);
                 }
             });
-            // Handle mobile disconnect — full reset: clear taken-over, auto-allow pending, tear down hooks
-            websocket_1.wsClient.on('mobile_disconnected', () => {
-                console.log(chalk_1.default.yellow(`[Claude] Mobile disconnected — full permission reset`));
-                tools_1.claudeProcessManager.clearAllTakenOver();
-                tools_1.claudeProcessManager.autoAllowAllPendingPrompts();
-                tools_1.claudeProcessManager.cleanupAllPermissionState();
-            });
             // Handle Claude approval responses from mobile
             websocket_1.wsClient.on('claude_approval_response', (data) => {
-                console.log(chalk_1.default.green(`[Claude] Approval response: ${data.approvalId} -> ${data.response}`));
+                console.log(chalk_1.default.green(`[Claude] Approval response: ${data.approvalId}`));
                 tools_1.claudeProcessManager.handleApprovalResponse(data.approvalId, data.response);
             });
             // Handle user messages from mobile app (send to Claude session)
@@ -980,7 +858,7 @@ function createProgram() {
                 if (!tools_1.claudeProcessManager.isTakenOver(terminalSessionId)) {
                     // Fresh session from auto-prompt (quick action): start new session with directory
                     if (data.directory) {
-                        console.log(chalk_1.default.cyan(`[Claude] Starting fresh session for auto-prompt in ${data.directory}`));
+                        console.log(chalk_1.default.cyan(`[Claude] Starting fresh session for auto-prompt`));
                         const sent = await tools_1.claudeProcessManager.startAndSendMessage(data.directory, terminalSessionId, data.message, data.mode?.permissionMode === 'bypassPermissions', data.interactivePermissions);
                         if (sent) {
                             // Notify mobile that session is ready
@@ -1034,7 +912,7 @@ function createProgram() {
             // Forward thinking content to mobile
             tools_1.claudeProcessManager.on('thinking_content', (data) => {
                 if (data.content || !data.partial) {
-                    console.log(chalk_1.default.magenta(`[Claude] Thinking${data.partial ? ' (streaming)' : ' (complete)'}: ${data.content?.substring(0, 50) || '...'}`));
+                    console.log(chalk_1.default.magenta(`[Claude] Thinking${data.partial ? ' (streaming)' : ' (complete)'}: ${data.content?.length || 0} chars`));
                 }
                 websocket_1.wsClient.sendThinkingContent({
                     sessionKey: data.sessionKey,
@@ -1043,26 +921,35 @@ function createProgram() {
                     partial: data.partial,
                 });
             });
-            // Forward token usage to mobile
+            // Persistent usage tracker
+            const usageTracker = new usage_tracker_1.UsageTracker();
+            websocket_1.wsClient.setUsageTracker(usageTracker);
+            // Forward token usage to mobile and persist locally
             tools_1.claudeProcessManager.on('token_usage', (data) => {
                 console.log(chalk_1.default.blue(`[Claude] Tokens: ${data.usage.inputTokens} in / ${data.usage.outputTokens} out`));
+                usageTracker.recordUsage(data.usage.inputTokens || 0, data.usage.outputTokens || 0);
                 websocket_1.wsClient.sendTokenUsage({
                     sessionKey: data.sessionKey,
                     usage: data.usage,
                 });
             });
+            // Handle usage stats request from mobile (pull-refresh)
+            websocket_1.wsClient.on('usage_stats_request', () => {
+                console.log(chalk_1.default.blue('[Analytics] Usage stats requested by mobile'));
+                websocket_1.wsClient.sendAllUsageStats();
+            });
             // When a fresh session captures a real session_id, update the transcript
             // file watcher so the mobile gets real-time updates from the correct JSONL file.
             // This is critical for brainstorm/quick-action sessions where startAndSendMessage
             // creates a new Claude session with a new transcript file.
             tools_1.claudeProcessManager.on('session_id_captured', (data) => {
                 const { terminalSessionId, sessionId } = data;
-                console.log(chalk_1.default.green(`[Claude] New session_id captured for ${terminalSessionId}: ${sessionId}`));
+                console.log(chalk_1.default.green(`[Claude] New session_id captured for ${terminalSessionId}`));
                 // Re-scan to pick up the new session's transcript path
                 const sessions = tools_1.claudeSessionDetector.scanSessions();
                 const newSession = sessions.find((s) => s.sessionKey === sessionId);
                 if (newSession?.transcriptPath) {
-                    console.log(chalk_1.default.green(`[Claude] Updating transcript watcher → ${newSession.transcriptPath}`));
+                    console.log(chalk_1.default.green(`[Claude] Updating transcript watcher`));
                     transcript_streamer_1.transcriptStreamer.subscribeToUpdates(terminalSessionId, newSession.transcriptPath);
                 }
                 else {
@@ -1071,11 +958,11 @@ function createProgram() {
                         const retrySessions = tools_1.claudeSessionDetector.scanSessions();
                         const retrySession = retrySessions.find((s) => s.sessionKey === sessionId);
                         if (retrySession?.transcriptPath) {
-                            console.log(chalk_1.default.green(`[Claude] Retry: updating transcript watcher → ${retrySession.transcriptPath}`));
+                            console.log(chalk_1.default.green(`[Claude] Retry: updating transcript watcher`));
                             transcript_streamer_1.transcriptStreamer.subscribeToUpdates(terminalSessionId, retrySession.transcriptPath);
                         }
                         else {
-                            console.log(chalk_1.default.yellow(`[Claude] Retry: still not found for ${sessionId}`));
+                            console.log(chalk_1.default.yellow(`[Claude] Retry: transcript still not found`));
                         }
                     }, 1000);
                 }
@@ -1086,7 +973,7 @@ function createProgram() {
                     console.log(chalk_1.default.cyan(`[Claude] Task list: ${data.tasks?.length || 0} tasks`));
                 }
                 else {
-                    console.log(chalk_1.default.cyan(`[Claude] Task ${data.type}: ${data.task?.subject || data.task?.id}`));
+                    console.log(chalk_1.default.cyan(`[Claude] Task ${data.type}: ${data.task?.id || 'unknown'}`));
                 }
                 websocket_1.wsClient.sendTaskProgress({
                     sessionKey: data.sessionKey,
@@ -1096,10 +983,8 @@ function createProgram() {
                 });
             });
             websocket_1.wsClient.on('disconnected', (reason) => {
-                console.log(chalk_1.default.yellow(`\nDisconnected: ${reason}`));
-                if (reason !== 'io client disconnect') {
-                    console.log(chalk_1.default.dim('Attempting to reconnect...'));
-                }
+                console.log(chalk_1.default.yellow(`\nMobile disconnected: ${reason}`));
+                console.log(chalk_1.default.dim('Waiting for mobile to reconnect...'));
             });
             websocket_1.wsClient.on('error', (error) => {
                 console.error(chalk_1.default.red(`Connection error: ${error.message}`));
@@ -1107,9 +992,17 @@ function createProgram() {
             // Keep the process running
             process.on('SIGINT', () => {
                 console.log(chalk_1.default.yellow('\nDisconnecting...'));
+                tools_1.claudeProcessManager.cleanupAllPermissionState();
+                usageTracker.flush();
                 tools_1.claudeSessionDetector.stopWatching();
                 transcript_streamer_1.transcriptStreamer.cleanup();
                 websocket_1.wsClient.disconnect();
+                const logPath = (0, logger_1.getLogFilePath)();
+                (0, logger_1.closeDebugLog)();
+                if (logPath) {
+                    // Use original console since we just closed the debug log
+                    process.stdout.write(`\nDebug log saved: ${logPath}\n`);
+                }
                 process.exit(0);
             });
             // Keep alive
@@ -1120,34 +1013,64 @@ function createProgram() {
             console.error(chalk_1.default.red(error.message || 'Unknown error'));
         }
     }
-    // Helper function to wait for pairing
-    async function waitForPairing(deviceId) {
-        return new Promise((resolve, reject) => {
-            const checkInterval = setInterval(async () => {
-                try {
-                    const status = await api_1.api.checkPairingStatus(deviceId);
-                    if (status.isPaired) {
-                        clearInterval(checkInterval);
-                        config_1.config.userId = status.userId;
-                        config_1.config.pairedAt = new Date().toISOString();
-                        console.log(chalk_1.default.green('\n✓ Device paired successfully!'));
-                        console.log(chalk_1.default.dim('\nConnecting to receive commands...\n'));
-                        // Auto-connect after successful pairing
-                        resolve();
-                    }
-                }
-                catch (error) {
-                    // Continue waiting
-                }
-            }, 2000);
+    // Helper function to wait for pairing via WebSocket event
+    async function waitForPairing() {
+        return new Promise((resolve) => {
+            websocket_1.wsClient.on('pair_device', (data) => {
+                resolve({ mobileDeviceId: data.mobileDeviceId });
+            });
             // Handle Ctrl+C
             process.on('SIGINT', () => {
-                clearInterval(checkInterval);
                 console.log(chalk_1.default.yellow('\nPairing cancelled.'));
+                websocket_1.wsClient.disconnect();
                 process.exit(0);
             });
         });
     }
+    // Logs command — list and manage debug log files
+    program
+        .command('logs')
+        .description('List debug log files for troubleshooting')
+        .option('--clean', 'Delete all debug log files')
+        .option('--latest', 'Print path to the most recent log file')
+        .action((options) => {
+        const logDir = path.join(os.homedir(), '.forkoff-cli', 'logs');
+        if (!fs.existsSync(logDir)) {
+            console.log(chalk_1.default.dim('No debug logs found. Run with --debug to generate logs.'));
+            return;
+        }
+        const logFiles = fs.readdirSync(logDir)
+            .filter(f => f.startsWith('debug-') && f.endsWith('.log'))
+            .sort()
+            .reverse();
+        if (logFiles.length === 0) {
+            console.log(chalk_1.default.dim('No debug logs found. Run with --debug to generate logs.'));
+            return;
+        }
+        if (options.clean) {
+            for (const file of logFiles) {
+                try {
+                    fs.unlinkSync(path.join(logDir, file));
+                }
+                catch { }
+            }
+            console.log(chalk_1.default.green(`Deleted ${logFiles.length} log file(s).`));
+            return;
+        }
+        if (options.latest) {
+            console.log(path.join(logDir, logFiles[0]));
+            return;
+        }
+        console.log(chalk_1.default.bold('Debug log files:\n'));
+        for (const file of logFiles) {
+            const filePath = path.join(logDir, file);
+            const stat = fs.statSync(filePath);
+            const sizeKB = (stat.size / 1024).toFixed(1);
+            console.log(`  ${file}  ${chalk_1.default.dim(`(${sizeKB} KB)`)}`);
+        }
+        console.log(chalk_1.default.dim(`\nLog directory: ${logDir}`));
+        console.log(chalk_1.default.dim('Run with --debug to generate a new log file.'));
+    });
     // Help command
     program
         .command('help')