forkoff 1.1.2 → 1.1.4

package/dist/cloud-client.js

@@ -118,7 +118,8 @@ class CloudRelayClient extends events_1.EventEmitter {
             });
             // Handle mobile connected notification from relay
             this.socket.on('mobile_connected', (data) => {
-                console.log(`[CloudRelay] Mobile connected: ${data.deviceId || 'unknown'}`);
+                const id = data.deviceId || 'unknown';
+                console.log(`[CloudRelay] Mobile connected: ${id.length > 8 ? id.substring(0, 8) + '...' : id}`);
                 this.emit('mobile_connected', { deviceId: data.deviceId || data.mobileDeviceId });
             });
             // Handle mobile disconnected notification from relay

package/dist/crypto/e2eeManager.js

@@ -200,10 +200,7 @@ class E2EEManager {
         const rawSharedKey = (0, keyExchange_1.computeSharedKey)(ephemeral.privateKey, init.ephemeralPublicKey);
         // Derive directional send/receive keys via HKDF
         const { sendKey, receiveKey } = (0, keyExchange_1.deriveSessionKeys)(rawSharedKey, this.deviceId, init.senderDeviceId);
-        // Log key fingerprint for debugging key mismatch
-        const sendKeyFP = (0, tweetnacl_util_1.encodeBase64)(sendKey).substring(0, 12);
-        const recvKeyFP = (0, tweetnacl_util_1.encodeBase64)(receiveKey).substring(0, 12);
-        console.log(`[E2EE] Init: sendKey=${sendKeyFP}, recvKey=${recvKeyFP}, peer=${init.senderDeviceId}, myEphPub=${ephemeral.publicKey.substring(0, 12)}, peerEphPub=${init.ephemeralPublicKey.substring(0, 12)}`);
+        console.log(`[E2EE] Key exchange init processed — session established with peer ${init.senderDeviceId.substring(0, 8)}...`);
         // Store session
         const sessionId = `session-${init.senderDeviceId}-${this.deviceId}-${Date.now()}`;
         this.sessions.set(init.senderDeviceId, {
@@ -249,7 +246,7 @@ class E2EEManager {
         // If there's exactly one pending exchange, use it regardless of key.
         if (!pendingEntry && this.pendingExchanges.size === 1) {
             const [fallbackKey, fallbackEntry] = this.pendingExchanges.entries().next().value;
-            console.log(`[E2EE] Pending exchange not found for ${peerId}, falling back to ${fallbackKey}`);
+            console.log(`[E2EE] Pending exchange not found for ${peerId.substring(0, 8)}..., using fallback`);
             pendingEntry = fallbackEntry;
             pendingKey = fallbackKey;
         }
@@ -262,10 +259,7 @@ class E2EEManager {
         const rawSharedKey = (0, keyExchange_1.computeSharedKey)(pending.privateKey, ack.ephemeralPublicKey);
         // Derive directional send/receive keys via HKDF
         const { sendKey, receiveKey } = (0, keyExchange_1.deriveSessionKeys)(rawSharedKey, this.deviceId, peerId);
-        // Log key fingerprint for debugging key mismatch
-        const sendKeyFP = (0, tweetnacl_util_1.encodeBase64)(sendKey).substring(0, 12);
-        const recvKeyFP = (0, tweetnacl_util_1.encodeBase64)(receiveKey).substring(0, 12);
-        console.log(`[E2EE] Ack: sendKey=${sendKeyFP}, recvKey=${recvKeyFP}, peer=${peerId}, myEphPub=${pending.publicKey.substring(0, 12)}, peerEphPub=${ack.ephemeralPublicKey.substring(0, 12)}`);
+        console.log(`[E2EE] Key exchange ack processed — session established with peer ${peerId.substring(0, 8)}...`);
         // Store session
         const sessionId = `session-${this.deviceId}-${peerId}-${Date.now()}`;
         this.sessions.set(peerId, {
@@ -338,10 +332,8 @@ class E2EEManager {
         }
         const payload = (0, encryption_1.encrypt)(plaintext, session.sendKey);
         session.outgoingCounter++;
-        // Log encryption key fingerprint (first message only to avoid spam)
         if (session.outgoingCounter === 1) {
-            const keyFP = (0, tweetnacl_util_1.encodeBase64)(session.sendKey).substring(0, 12);
-            console.log(`[E2EE] Encrypting first message with sendKey fingerprint=${keyFP}, recipient=${recipientDeviceId}`);
+            console.log(`[E2EE] First encrypted message sent to ${recipientDeviceId.substring(0, 8)}...`);
         }
         return {
             senderDeviceId: this.deviceId,
@@ -374,7 +366,7 @@ class E2EEManager {
         session.lastReceivedCounter = message.messageCounter;
         // Check expiry AFTER decrypting — valid messages still get through, but warn caller
         if (this.isSessionExpired(senderDeviceId)) {
-            console.warn(`[E2EE] Session with ${senderDeviceId} has expired after decryption — re-key required`);
+            console.warn(`[E2EE] Session with ${senderDeviceId.substring(0, 8)}... has expired — re-key required`);
         }
         return plaintext;
     }

package/dist/server.js

@@ -71,7 +71,8 @@ class EmbeddedRelayServer extends events_1.EventEmitter {
                 next();
             });
             this.io.on('connection', (socket) => {
-                console.log(`[Server] Mobile connected: ${socket.data.deviceId}`);
+                const devId = socket.data.deviceId || 'unknown';
+                console.log(`[Server] Mobile connected: ${devId.length > 8 ? devId.substring(0, 8) + '...' : devId}`);
                 // Track the mobile socket (only one active connection)
                 if (this.mobileSocket) {
                     console.log(`[Server] Replacing existing mobile connection`);

package/dist/websocket.js

@@ -158,7 +158,7 @@ class WebSocketClient extends events_1.EventEmitter {
             return;
         // When mobile connects, emit connected + start heartbeat + initiate E2EE
         this.server.on('mobile_connected', (data) => {
-            console.log(`[WS] Mobile connected: ${data.deviceId}`);
+            console.log(`[WS] Mobile connected: ${data.deviceId?.substring(0, 8)}...`);
             this.emit('connected');
             this.startHeartbeat();
             // SECURITY: Clear stale E2EE peer state on every mobile connect.
@@ -167,7 +167,7 @@ class WebSocketClient extends events_1.EventEmitter {
             // that mobile can't decrypt, causing "No session established" errors.
             // A fresh key exchange will re-establish the session after debounce.
             if (this.e2eePeerDeviceId) {
-                console.log(`[E2EE] Clearing stale peer state for ${this.e2eePeerDeviceId} (mobile reconnected)`);
+                console.log(`[E2EE] Clearing stale peer state (mobile reconnected)`);
                 this.e2eeManager?.clearSession(this.e2eePeerDeviceId);
                 this.e2eePeerDeviceId = null;
             }
@@ -188,7 +188,7 @@ class WebSocketClient extends events_1.EventEmitter {
                     return;
                 try {
                     this._keyExchangePending = true;
-                    console.log(`[E2EE] Initiating key exchange with ${targetId} (after debounce)`);
+                    console.log(`[E2EE] Initiating key exchange with ${targetId.substring(0, 8)}...`);
                     this.e2eeManager.clearSession(targetId);
                     const initPayload = this.e2eeManager.createKeyExchangeInit(targetId);
                     this.server?.emitToMobile('encrypted_key_exchange_init', {
@@ -249,7 +249,7 @@ class WebSocketClient extends events_1.EventEmitter {
                 return;
             }
             try {
-                console.log(`[E2EE] Received key exchange init from ${data.senderDeviceId}`);
+                console.log(`[E2EE] Received key exchange init from ${data.senderDeviceId.substring(0, 8)}...`);
                 const ack = this.e2eeManager.handleKeyExchangeInit(data);
                 this.e2eePeerDeviceId = data.senderDeviceId;
                 this.server?.emitToMobile('encrypted_key_exchange_ack', {
@@ -270,11 +270,11 @@ class WebSocketClient extends events_1.EventEmitter {
             if (!this.e2eeManager)
                 return;
             try {
-                console.log(`[E2EE] Received key exchange ack from ${data.senderDeviceId}`);
+                console.log(`[E2EE] Received key exchange ack from ${data.senderDeviceId.substring(0, 8)}...`);
                 this.e2eeManager.handleKeyExchangeAck(data);
                 this._keyExchangePending = false;
                 this.e2eePeerDeviceId = data.senderDeviceId;
-                console.log(`[E2EE] Key exchange complete — session established with ${data.senderDeviceId}`);
+                console.log(`[E2EE] Key exchange complete — session established`);
                 this.emit('e2ee_established', { peerDeviceId: data.senderDeviceId });
                 this.flushSensitiveQueue();
                 this.sendAllUsageStats();
@@ -283,7 +283,7 @@ class WebSocketClient extends events_1.EventEmitter {
                 const msg = err instanceof Error ? err.message : String(err);
                 // Only suppress if it's truly a duplicate ack (pending exchange already consumed)
                 if (msg.includes('No pending key exchange')) {
-                    console.log(`[E2EE] Duplicate ack from ${data.senderDeviceId} — ignored`);
+                    console.log(`[E2EE] Duplicate ack — ignored`);
                 }
                 else {
                     console.error(`[E2EE] Key exchange ack failed: ${msg}`);
@@ -520,7 +520,7 @@ class WebSocketClient extends events_1.EventEmitter {
         if (sessions.length > 0) {
             const peer = this.e2eePeerDeviceId;
             const hasE2EE = peer ? this.e2eeManager?.hasSessionKey(peer) : false;
-            console.log(`[WS] sendClaudeSessions: ${sessions.length} sessions, peer=${peer || 'none'}, e2ee=${hasE2EE}, queue=${this.pendingSensitiveMessages.length}`);
+            console.log(`[WS] sendClaudeSessions: ${sessions.length} sessions, e2ee=${hasE2EE}`);
             const withDeviceId = sessions.map(s => ({ ...s, deviceId: config_1.config.deviceId }));
             this.emitSensitive('claude_session_batch_update', { sessions: withDeviceId }, peer ?? undefined);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "forkoff",
-  "version": "1.1.2",
+  "version": "1.1.4",
   "description": "CLI tool to connect Claude Code to the ForkOff mobile app for remote monitoring and approvals",
   "main": "dist/integration.js",
   "types": "dist/integration.d.ts",