forkoff 1.0.19 → 1.1.1

package/dist/crypto/sessionPersistence.js

@@ -103,11 +103,13 @@ function persistSessionKey(deviceId, targetDeviceId, sessionKeys) {
     try {
         ensureSessionStoreExists();
         const plainData = JSON.stringify({
-            sharedKey: Array.from(sessionKeys.sharedKey),
+            sendKey: Array.from(sessionKeys.sendKey),
+            receiveKey: Array.from(sessionKeys.receiveKey),
             sessionId: sessionKeys.sessionId,
             deviceId: sessionKeys.deviceId,
             messageCounter: sessionKeys.messageCounter,
             lastReceivedCounter: sessionKeys.lastReceivedCounter,
+            createdAt: sessionKeys.createdAt ?? Date.now(),
             timestamp: new Date().toISOString(),
         });
         const filePath = getSessionFilePath(deviceId, targetDeviceId);
@@ -180,12 +182,32 @@ function loadPersistedSessionKey(deviceId, targetDeviceId) {
             fs.unlinkSync(filePath);
             return null;
         }
+        // Support both new (sendKey/receiveKey) and legacy (sharedKey) formats
+        let sendKey;
+        let receiveKey;
+        if (data.sendKey && data.receiveKey) {
+            sendKey = new Uint8Array(data.sendKey);
+            receiveKey = new Uint8Array(data.receiveKey);
+        }
+        else if (data.sharedKey) {
+            // Legacy format: same key for both directions (pre-HKDF)
+            const legacyKey = new Uint8Array(data.sharedKey);
+            sendKey = legacyKey;
+            receiveKey = legacyKey;
+        }
+        else {
+            console.error('[Security] Persisted session has no valid key data');
+            fs.unlinkSync(filePath);
+            return null;
+        }
         return {
-            sharedKey: new Uint8Array(data.sharedKey),
+            sendKey,
+            receiveKey,
             sessionId: data.sessionId,
             deviceId: data.deviceId || targetDeviceId,
             messageCounter: data.messageCounter || 0,
             lastReceivedCounter: data.lastReceivedCounter || -1,
+            createdAt: data.createdAt,
         };
     }
     catch (error) {

package/dist/crypto/types.d.ts

@@ -25,11 +25,13 @@ export interface EncryptedMessage {
 }
 /** Derived session keys for a specific device-to-device connection */
 export interface SessionKeys {
-    sharedKey: Uint8Array;
+    sendKey: Uint8Array;
+    receiveKey: Uint8Array;
     sessionId: string;
     deviceId: string;
     messageCounter: number;
     lastReceivedCounter: number;
+    createdAt?: number;
 }
 /** Ed25519 signing key pair for identity verification during key exchange */
 export interface SigningKeyPair {

package/dist/index.js

@@ -112,9 +112,16 @@ function createProgram() {
         }
         if (options.show || (!options.port && !options.name && !options.reset)) {
             const localIp = getLocalIp();
+            const isCloud = config_1.config.relayMode === 'cloud';
             console.log(chalk_1.default.bold('\nCurrent Configuration:'));
-            console.log(`  Relay URL:   ${chalk_1.default.cyan(`ws://${localIp}:${config_1.config.relayPort}`)}`);
-            console.log(`  Relay Port:  ${chalk_1.default.cyan(String(config_1.config.relayPort))}`);
+            console.log(`  Relay Mode:  ${isCloud ? chalk_1.default.green('Cloud') : chalk_1.default.cyan('Local')}`);
+            if (isCloud) {
+                console.log(`  Relay URL:   ${chalk_1.default.cyan(config_1.config.wsUrl)}`);
+            }
+            else {
+                console.log(`  Relay URL:   ${chalk_1.default.cyan(`ws://${localIp}:${config_1.config.relayPort}`)}`);
+            }
+            console.log(`  Relay Port:  ${chalk_1.default.cyan(String(config_1.config.relayPort))} ${isCloud ? chalk_1.default.dim('(local mode only)') : ''}`);
             console.log(`  Device Name: ${chalk_1.default.cyan(config_1.config.deviceName)}`);
             console.log(`  Device ID:   ${chalk_1.default.cyan(config_1.config.deviceId || 'Not registered')}`);
             console.log(`  Paired:      ${config_1.config.isPaired ? chalk_1.default.green('Yes') : chalk_1.default.yellow('No')}`);
@@ -129,37 +136,59 @@ function createProgram() {
     program
         .command('pair')
         .description('Generate pairing code to connect with mobile app')
-        .action(async () => {
-        const spinner = (0, logger_1.createSpinner)('Starting relay server...').start();
+        .option('--local', 'Use local network relay instead of cloud relay')
+        .action(async (options) => {
+        const isLocal = options.local;
+        const spinner = (0, logger_1.createSpinner)(isLocal ? 'Starting local relay server...' : 'Connecting to cloud relay...').start();
         try {
             // Ensure we have a deviceId
             config_1.config.ensureDeviceId();
-            // Start embedded relay server
-            await websocket_1.wsClient.startServer(config_1.config.relayPort);
             // Generate random 8-char pairing code
             const pairingCode = crypto.randomBytes(4).toString('hex').toUpperCase().slice(0, 8);
             config_1.config.pairingCode = pairingCode;
-            // Set pairing code on server for in-process validation
-            websocket_1.wsClient.setPairingCode(pairingCode);
-            const localIp = getLocalIp();
-            const relayUrl = `ws://${localIp}:${config_1.config.relayPort}`;
-            spinner.succeed(`Relay server started on ${relayUrl}\n`);
-            // Display pairing info
-            console.log(chalk_1.default.bold('Scan this QR code with the ForkOff mobile app:\n'));
-            const pairingUrl = `forkoff://pair/${pairingCode}?relay=${encodeURIComponent(relayUrl)}`;
-            qrcode_terminal_1.default.generate(pairingUrl, { small: true }, (code) => {
-                console.log(code);
-            });
-            console.log(chalk_1.default.bold('\nOr enter this code manually:\n'));
-            console.log(chalk_1.default.bgBlue.white.bold(`  ${pairingCode}  `));
-            console.log();
-            console.log(chalk_1.default.dim(`Relay: ${relayUrl}`));
+            if (isLocal) {
+                // Local mode: start embedded relay server (existing behavior)
+                config_1.config.relayMode = 'local';
+                await websocket_1.wsClient.startServer(config_1.config.relayPort);
+                // Set pairing code on server for in-process validation
+                websocket_1.wsClient.setPairingCode(pairingCode);
+                const localIp = getLocalIp();
+                const relayUrl = `ws://${localIp}:${config_1.config.relayPort}`;
+                spinner.succeed(`Local relay server started on ${relayUrl}\n`);
+                // QR includes relay URL for local mode
+                const pairingUrl = `forkoff://pair/${pairingCode}?relay=${encodeURIComponent(relayUrl)}`;
+                console.log(chalk_1.default.bold('Scan this QR code with the ForkOff mobile app:\n'));
+                qrcode_terminal_1.default.generate(pairingUrl, { small: true }, (code) => {
+                    console.log(code);
+                });
+                console.log(chalk_1.default.bold('\nOr enter this code manually:\n'));
+                console.log(chalk_1.default.bgBlue.white.bold(`  ${pairingCode}  `));
+                console.log();
+                console.log(chalk_1.default.dim(`Relay: ${relayUrl}`));
+            }
+            else {
+                // Cloud mode (default): connect to cloud relay as a client
+                config_1.config.relayMode = 'cloud';
+                await websocket_1.wsClient.connectToRelay(config_1.config.wsUrl);
+                // Register pairing code with the relay
+                websocket_1.wsClient.setPairingCode(pairingCode);
+                spinner.succeed(`Connected to cloud relay\n`);
+                // QR without relay URL — mobile uses its default cloud connection
+                const pairingUrl = `forkoff://pair/${pairingCode}`;
+                console.log(chalk_1.default.bold('Scan this QR code with the ForkOff mobile app:\n'));
+                qrcode_terminal_1.default.generate(pairingUrl, { small: true }, (code) => {
+                    console.log(code);
+                });
+                console.log(chalk_1.default.bold('\nOr enter this code manually:\n'));
+                console.log(chalk_1.default.bgBlue.white.bold(`  ${pairingCode}  `));
+                console.log();
+                console.log(chalk_1.default.dim(`Cloud relay: ${config_1.config.wsUrl}`));
+            }
             console.log();
             // Wait for pairing
             console.log(chalk_1.default.yellow('Waiting for mobile app to scan...'));
             console.log(chalk_1.default.dim('Press Ctrl+C to cancel\n'));
             const pairData = await waitForPairing();
-            // Server already sent pair_device_ack to mobile
             config_1.config.pairedAt = new Date().toISOString();
             console.log(chalk_1.default.green('\n\u2713 Device paired successfully!'));
             console.log(chalk_1.default.dim('\nStarting connection...\n'));
@@ -173,7 +202,7 @@ function createProgram() {
                     // Non-critical — don't fail pairing over this
                 }
             }
-            // Continue to main connection (server already running)
+            // Continue to main connection (transport already running)
             await startConnection();
         }
         catch (error) {
@@ -191,11 +220,18 @@ function createProgram() {
             return;
         }
         const localIp = getLocalIp();
+        const isCloud = config_1.config.relayMode === 'cloud';
         console.log(chalk_1.default.bold('\nDevice Status:'));
         console.log(`  Device ID:   ${chalk_1.default.cyan(config_1.config.deviceId)}`);
         console.log(`  Device Name: ${chalk_1.default.cyan(config_1.config.deviceName)}`);
         console.log(`  Paired:      ${config_1.config.isPaired ? chalk_1.default.green('Yes') : chalk_1.default.yellow('No')}`);
-        console.log(`  Relay URL:   ${chalk_1.default.cyan(`ws://${localIp}:${config_1.config.relayPort}`)}`);
+        console.log(`  Relay Mode:  ${isCloud ? chalk_1.default.green('Cloud') : chalk_1.default.cyan('Local')}`);
+        if (isCloud) {
+            console.log(`  Relay URL:   ${chalk_1.default.cyan(config_1.config.wsUrl)}`);
+        }
+        else {
+            console.log(`  Relay URL:   ${chalk_1.default.cyan(`ws://${localIp}:${config_1.config.relayPort}`)}`);
+        }
         console.log(`  Mobile:      ${websocket_1.wsClient.isConnected ? chalk_1.default.green('Connected') : chalk_1.default.yellow('Not connected')}`);
         if (config_1.config.pairedAt) {
             console.log(`  Paired At:   ${chalk_1.default.dim(config_1.config.pairedAt)}`);
@@ -205,7 +241,8 @@ function createProgram() {
     program
         .command('connect')
         .description('Reconnect to ForkOff (for previously paired devices)')
-        .action(async () => {
+        .option('--local', 'Use local network relay instead of cloud relay')
+        .action(async (options) => {
         if (!config_1.config.deviceId) {
             console.log(chalk_1.default.yellow('Device not registered. Run "forkoff pair" first.'));
             return;
@@ -224,11 +261,20 @@ function createProgram() {
                 // Non-critical
             }
         }
-        // Start embedded relay server before entering connection flow
-        const localIp = getLocalIp();
-        const relayUrl = `ws://${localIp}:${config_1.config.relayPort}`;
-        await websocket_1.wsClient.startServer(config_1.config.relayPort);
-        console.log(chalk_1.default.cyan(`Relay server started on ${relayUrl}`));
+        // Determine relay mode: explicit flag > saved config
+        const useLocal = options.local || config_1.config.relayMode === 'local';
+        if (useLocal) {
+            // Local mode: start embedded relay server
+            const localIp = getLocalIp();
+            const relayUrl = `ws://${localIp}:${config_1.config.relayPort}`;
+            await websocket_1.wsClient.startServer(config_1.config.relayPort);
+            console.log(chalk_1.default.cyan(`Local relay server started on ${relayUrl}`));
+        }
+        else {
+            // Cloud mode (default): connect to cloud relay
+            await websocket_1.wsClient.connectToRelay(config_1.config.wsUrl);
+            console.log(chalk_1.default.cyan(`Connected to cloud relay (${config_1.config.wsUrl})`));
+        }
         console.log(chalk_1.default.dim('Waiting for mobile app to connect...\n'));
         await startConnection();
     });
@@ -247,6 +293,8 @@ function createProgram() {
         }
         config_1.config.pairedAt = null;
         config_1.config.pairingCode = null;
+        config_1.config.relayToken = null;
+        config_1.config.pairId = null;
         console.log(chalk_1.default.green('Device disconnected and unpaired.'));
         console.log(chalk_1.default.dim('Run "forkoff pair" to pair again.'));
     });
@@ -406,6 +454,7 @@ function createProgram() {
         const spinner = (0, logger_1.createSpinner)('Initializing...').start();
         try {
             tools_1.PermissionIpcManager.cleanupStaleTempFiles();
+            tools_1.claudeProcessManager.cleanupAllPermissionState();
             spinner.succeed('Ready!\n');
             // Detect connected tools
             spinner.start('Detecting AI coding tools...');
@@ -718,6 +767,8 @@ function createProgram() {
             // Handle transcript fetch requests from mobile
             websocket_1.wsClient.on('transcript_fetch', async (data) => {
                 console.log(chalk_1.default.dim(`[Transcript] Fetching: offset: ${data.offset}, limit: ${data.limit}`));
+                // Signal loading state to mobile
+                websocket_1.wsClient.sendSessionLoading({ sessionKey: data.sessionKey, state: 'loading' });
                 try {
                     // SECURITY: Validate transcript path is under ~/.claude/projects/ to prevent path traversal
                     const resolvedTranscriptPath = path.resolve(data.transcriptPath);
@@ -725,6 +776,7 @@ function createProgram() {
                     const relPath = path.relative(claudeProjectsDir, resolvedTranscriptPath);
                     if (relPath.startsWith('..') || path.isAbsolute(relPath)) {
                         console.warn(chalk_1.default.yellow(`[Transcript] Access denied — path outside ~/.claude/projects/`));
+                        websocket_1.wsClient.sendSessionLoading({ sessionKey: data.sessionKey, state: 'error', error: 'Access denied' });
                         return;
                     }
                     const result = await transcript_streamer_1.transcriptStreamer.fetchHistory(resolvedTranscriptPath, data.offset || 0, data.limit || 100, data.reverse !== false // Default to true (most recent first)
@@ -737,9 +789,12 @@ function createProgram() {
                         offset: data.offset || 0,
                         requestedBy: data.requestedBy,
                     });
+                    // Signal ready state to mobile
+                    websocket_1.wsClient.sendSessionLoading({ sessionKey: data.sessionKey, state: 'ready' });
                 }
                 catch (error) {
                     console.error(chalk_1.default.red(`[Transcript] Error: ${error.message}`));
+                    websocket_1.wsClient.sendSessionLoading({ sessionKey: data.sessionKey, state: 'error', error: error.message });
                 }
             });
             // Handle transcript subscribe
@@ -760,6 +815,16 @@ function createProgram() {
                 console.log(chalk_1.default.dim(`[Transcript] Unsubscribing from session`));
                 transcript_streamer_1.transcriptStreamer.unsubscribeFromUpdates(data.sessionKey);
             });
+            // Re-send all sessions when E2EE establishes (bypasses queue TTL expiry)
+            websocket_1.wsClient.on('e2ee_established', () => {
+                if (tools_1.claudeSessionDetector.isClaudeInstalled()) {
+                    const sessions = tools_1.claudeSessionDetector.scanSessions();
+                    if (sessions.length > 0) {
+                        console.log(chalk_1.default.cyan(`[Claude] E2EE established — re-sending ${sessions.length} session(s)`));
+                        websocket_1.wsClient.sendClaudeSessions(sessions);
+                    }
+                }
+            });
             // Handle claude sessions request - mobile app wants current sessions
             websocket_1.wsClient.on('claude_sessions_request', () => {
                 console.log(chalk_1.default.cyan(`[Claude] Sessions requested by mobile`));
@@ -783,6 +848,54 @@ function createProgram() {
                     websocket_1.wsClient.sendToolStatusUpdate('claude_code', hasActiveSession ? 'active' : 'inactive');
                 }
             });
+            // Handle SDK session history requests from mobile (local JSONL lookup)
+            // Mobile sends this when opening a session — CLI resolves it locally from disk
+            websocket_1.wsClient.on('sdk_session_history', async (data) => {
+                console.log(chalk_1.default.dim(`[Transcript] SDK session history requested`));
+                // Signal loading state to mobile
+                websocket_1.wsClient.sendSessionLoading({ sessionKey: data.sessionKey, state: 'loading' });
+                try {
+                    // Find session locally by sessionKey or claudeSessionId
+                    let sessions = tools_1.claudeSessionDetector.getSessions();
+                    let session = sessions.find((s) => s.sessionKey === data.sessionKey);
+                    if (!session && data.claudeSessionId) {
+                        session = sessions.find((s) => s.sessionKey === data.claudeSessionId);
+                    }
+                    // Fallback: rescan if not cached
+                    if (!session) {
+                        const freshSessions = tools_1.claudeSessionDetector.scanSessions();
+                        session = freshSessions.find((s) => s.sessionKey === data.sessionKey ||
+                            (data.claudeSessionId && s.sessionKey === data.claudeSessionId));
+                    }
+                    if (session?.transcriptPath) {
+                        const result = await transcript_streamer_1.transcriptStreamer.fetchHistory(session.transcriptPath, data.offset || 0, data.limit || 200, true);
+                        console.log(chalk_1.default.dim(`[Transcript] Sending history: ${result.entries.length} entries`));
+                        websocket_1.wsClient.sendTranscriptHistory({
+                            sessionKey: data.sessionKey,
+                            ...result,
+                            offset: data.offset || 0,
+                            requestedBy: data.requestedBy,
+                        });
+                    }
+                    else {
+                        // No local transcript — send empty response so mobile stops loading
+                        websocket_1.wsClient.sendTranscriptHistory({
+                            sessionKey: data.sessionKey,
+                            entries: [],
+                            totalEntries: 0,
+                            offset: 0,
+                            hasMore: false,
+                            requestedBy: data.requestedBy,
+                        });
+                    }
+                    // Signal ready state
+                    websocket_1.wsClient.sendSessionLoading({ sessionKey: data.sessionKey, state: 'ready' });
+                }
+                catch (error) {
+                    console.error(chalk_1.default.red(`[Transcript] SDK session history error: ${error.message}`));
+                    websocket_1.wsClient.sendSessionLoading({ sessionKey: data.sessionKey, state: 'error', error: error.message });
+                }
+            });
             // Forward live transcript updates to WebSocket
             transcript_streamer_1.transcriptStreamer.on('update', (data) => {
                 console.log(chalk_1.default.green(`[Transcript] Sending update for ${data.sessionKey}: ${data.entry?.type}`));
@@ -985,6 +1098,13 @@ function createProgram() {
             websocket_1.wsClient.on('disconnected', (reason) => {
                 console.log(chalk_1.default.yellow(`\nMobile disconnected: ${reason}`));
                 console.log(chalk_1.default.dim('Waiting for mobile to reconnect...'));
+                tools_1.claudeProcessManager.autoAllowAllPendingPrompts();
+                tools_1.claudeProcessManager.cleanupAllPermissionState();
+                tools_1.claudeProcessManager.clearAllTakenOver();
+            });
+            websocket_1.wsClient.on('session_release', (data) => {
+                console.log(chalk_1.default.dim(`[Session] Mobile released session: ${data.sessionKey}`));
+                tools_1.claudeProcessManager.releaseSession(data.sessionKey);
             });
             websocket_1.wsClient.on('error', (error) => {
                 console.error(chalk_1.default.red(`Connection error: ${error.message}`));

package/dist/tools/claude-process.d.ts

@@ -241,6 +241,11 @@ declare class ClaudeProcessManager extends EventEmitter {
      * Clear all taken-over sessions (e.g., when mobile disconnects).
      */
     clearAllTakenOver(): void;
+    /**
+     * Release a single session — clean up its hooks and IPC.
+     * Called when mobile navigates away from the session screen after taking over.
+     */
+    releaseSession(sessionKey: string): void;
     /**
      * Get all pending permission prompts across all IPC managers.
      * Used to sync pending permissions to mobile on take-over.

package/dist/tools/claude-process.js

@@ -822,6 +822,50 @@ class ClaudeProcessManager extends events_1.EventEmitter {
         this.takenOverSessions.clear();
         console.log(`[Claude Process] All taken-over sessions cleared`);
     }
+    /**
+     * Release a single session — clean up its hooks and IPC.
+     * Called when mobile navigates away from the session screen after taking over.
+     */
+    releaseSession(sessionKey) {
+        // Find the process by sessionKey or terminalSessionId
+        let terminalSessionId;
+        let directory;
+        for (const [id, info] of this.processes) {
+            if (id === sessionKey || info.sessionKey === sessionKey) {
+                terminalSessionId = id;
+                directory = info.directory;
+                break;
+            }
+        }
+        // Also check closed sessions in case the process already exited
+        if (!terminalSessionId) {
+            for (const [id, info] of this.closedSessions) {
+                if (id === sessionKey || info.sessionKey === sessionKey) {
+                    terminalSessionId = id;
+                    directory = info.directory;
+                    break;
+                }
+            }
+        }
+        if (terminalSessionId) {
+            // Stop permission IPC for this session
+            this.stopPermissionIpc(terminalSessionId);
+            // Remove hook from directory if no other active sessions use it
+            if (directory) {
+                const otherSessionsInDir = Array.from(this.processes.values())
+                    .filter(p => p.directory === directory && p.terminalSessionId !== terminalSessionId);
+                if (otherSessionsInDir.length === 0) {
+                    this.removeHook(directory);
+                }
+            }
+            // Clear taken-over state
+            this.takenOverSessions.delete(terminalSessionId);
+            console.log(`[Claude Process] Session released: ${terminalSessionId}`);
+        }
+        else {
+            console.log(`[Claude Process] Session release: no matching session found for ${sessionKey}`);
+        }
+    }
     /**
      * Get all pending permission prompts across all IPC managers.
      * Used to sync pending permissions to mobile on take-over.

package/dist/websocket.d.ts

@@ -38,9 +38,13 @@ export declare class WebSocketClient extends EventEmitter {
     private server;
     private heartbeatInterval;
     private _sessionId;
+    private isCloudRelay;
     private e2eeManager;
     private e2eeInitialized;
     private e2eePeerDeviceId;
+    private _keyExchangePending;
+    private _keyExchangeDebounceTimer;
+    private _keyExchangeDebounceTarget;
     private pendingSensitiveMessages;
     private static readonly SENSITIVE_QUEUE_TTL_MS;
     private static readonly MAX_PENDING_SENSITIVE;
@@ -48,7 +52,11 @@ export declare class WebSocketClient extends EventEmitter {
     get sessionId(): string;
     /** Start the embedded relay server and wire up event forwarding */
     startServer(port: number): Promise<void>;
-    /** Set pairing code on the embedded server for in-process validation */
+    /** Connect to a cloud relay as a Socket.io client (instead of running a local server) */
+    connectToRelay(url: string): Promise<void>;
+    /** Wire up event forwarding from the transport (shared between startServer and connectToRelay) */
+    private wireUpTransportEvents;
+    /** Set pairing code on the transport for validation */
     setPairingCode(code: string): void;
     /**
      * Initialize E2EE manager: generate/load keys.
@@ -195,6 +203,11 @@ export declare class WebSocketClient extends EventEmitter {
     setUsageTracker(tracker: UsageTracker): void;
     /** Send all usage stats to mobile (called after E2EE established and on request) */
     sendAllUsageStats(): void;
+    sendSessionLoading(data: {
+        sessionKey: string;
+        state: 'loading' | 'ready' | 'error';
+        error?: string;
+    }): void;
     sendClaudeSessionEvent(data: {
         sessionKey: string;
         event: {