ghostterm 1.1.0 → 1.1.2

package/README.md

@@ -1,37 +1,34 @@
-# GhostTerm 👻
-
-**A mobile terminal for Claude Code fans.** Control your PC from your phone — real CLI, not a toy.
-
-> *GhostTerm is not affiliated with Anthropic. Just a fan who couldn't stop using Claude Code.*
-
----
-
-## Screenshots
-
 <p align="center">
-  <img src="https://ghostterm.pages.dev/img/claude-code.jpg" width="250" alt="Claude Code running on phone">
-  <img src="https://ghostterm.pages.dev/img/terminal.jpg" width="250" alt="Terminal with dangerous mode">
-  <img src="https://ghostterm.pages.dev/img/pixel-office.jpg" width="250" alt="4 terminal sessions">
+  <img src="https://ghostterm.pages.dev/img/banner.png" width="500" alt="GhostTerm Banner">
 </p>
 
+<h1 align="center">GhostTerm</h1>
+<p align="center">
+  <strong>A mobile terminal for Claude Code fans.</strong><br>
+  Control your PC from your phone — real CLI, not a toy.
+</p>
 <p align="center">
-  <em>Left: Claude Code with <code>--dangerously-skip-permissions</code> running on your phone</em><br>
-  <em>Center: Full terminal + custom shortcut keys (y/n, Tab, Ctrl+C, arrows...)</em><br>
-  <em>Right: 4 ghost terminals in pixel office view</em>
+  <a href="https://www.npmjs.com/package/ghostterm"><img src="https://img.shields.io/npm/v/ghostterm.svg" alt="npm version"></a>
+  <a href="https://www.npmjs.com/package/ghostterm"><img src="https://img.shields.io/npm/dm/ghostterm.svg" alt="npm downloads"></a>
+  <img src="https://img.shields.io/node/v/ghostterm" alt="node version">
+  <img src="https://img.shields.io/badge/license-MIT-blue.svg" alt="license">
 </p>
 
+> *GhostTerm is not affiliated with Anthropic. Just a fan who couldn't stop using Claude Code.*
+
 ---
 
-## Why GhostTerm?
+## What is GhostTerm?
+
+GhostTerm lets you **control your PC terminal from your phone** over the internet. It's built specifically for [Claude Code](https://docs.anthropic.com/en/docs/claude-code) users who want to:
 
-You're running Claude Code on your PC. You walk away. Now what?
+- Run `claude --dangerously-skip-permissions` and monitor everything from their phone
+- Approve/deny tool calls from anywhere (bus, bed, coffee shop)
+- Manage 4 terminal sessions simultaneously
 
-- **Run `--dangerously-skip-permissions`** — let Claude go full auto, monitor from your phone while it codes for you
-- **4 terminal sessions at once** — more than Anthropic's official app
-- **Real xterm.js terminal** — full ANSI colors, scrollback, not a dumbed-down GUI
-- **Built-in shortcut keys** — `y` / `n` for approvals, `Tab`, `Ctrl+C`, arrow keys, all one-tap
-- **`claude` quick-launch button** — start new sessions, resume, or continue with one tap
-- **Pixel office mode** — see all 4 terminals as cute ghost desks
+No VPN. No Tailscale. No port forwarding. Just one command.
+
+---
 
 ## Quick Start
 
@@ -45,13 +42,83 @@ First run opens a browser for Google sign-in. After that, it remembers you.
 
 ### 2. On your phone
 
-Open **[ghostterm.pages.dev](https://ghostterm.pages.dev)** — sign in with the same Google account.
+Open **[ghostterm.pages.dev](https://ghostterm.pages.dev)** in any mobile browser. Sign in with the same Google account.
+
+**That's it.** Your terminal appears on your phone.
+
+---
+
+## Screenshots
+
+<p align="center">
+  <img src="https://ghostterm.pages.dev/img/office-busy.jpg" width="220" alt="Ghosts working">
+  <img src="https://ghostterm.pages.dev/img/pixel-office.jpg" width="220" alt="Pixel office">
+  <img src="https://ghostterm.pages.dev/img/claude-code.jpg" width="220" alt="Claude Code on phone">
+</p>
+<p align="center">
+  <em>Pixel ghost office · 4 terminal sessions · Claude Code on your phone</em>
+</p>
+
+---
+
+## Features
+
+### Terminal
+
+- **Real xterm.js terminal** — full ANSI colors, 256-color, scrollback buffer
+- **4 simultaneous sessions** — more than Anthropic's official mobile app
+- **Auto-resize** — terminal adapts to your phone's screen size
+- **Scrollback history** — scroll up to see previous output, page up/down buttons
+
+### Controls
+
+- **Quick keys** — one-tap `y`/`n` for Claude Code approvals
+- **D-pad** — arrow keys, Enter, Tab, Shift+Tab
+- **`claude` button** — quick-launch menu: new session, resume, continue, dangerous mode
+- **Ctrl+C** — interrupt running processes
+- **Text input** — full keyboard input with Send button
+- **Copy mode** — select and copy terminal text
+
+### File Transfer
+
+- **Screenshot** — capture your phone screen and send it to your PC terminal
+- **File upload** — upload files directly from your phone to your desktop
+
+### Visual
+
+- **Pixel office mode** — see all 4 terminals as cute ghost desks in a Halloween-themed pixel office
+- **Ghost cell previews** — live miniature terminal previews in the header
+- **Dark theme** — easy on the eyes, matches terminal aesthetics
+
+### Connection
+
+- **Google auto-pairing** — sign in once, auto-reconnects forever
+- **Encrypted relay** — all traffic over WSS (WebSocket Secure)
+- **Zero data stored** — the relay only forwards messages
+- **Auto-reconnect** — handles network drops gracefully
 
-That's it. Your terminal appears on your phone. No VPN. No Tailscale. No port forwarding.
+---
+
+## How It Works
+
+```
+Phone (browser)  ──WSS──>  Relay (Fly.io Tokyo)  <──WSS──  PC (ghostterm)
+                            encrypted WebSocket
+                            auto-pairs by Google account
+                            zero data stored
+```
+
+1. `npx ghostterm` starts a companion process on your PC that connects to the relay server
+2. The companion spawns a real PTY (pseudo-terminal) using `node-pty`
+3. Your phone connects to the same relay via WebSocket
+4. The relay matches both sides by Google account and forwards messages
+5. Terminal output streams to your phone; your input streams to the PTY
+
+---
 
 ## Use Cases
 
-### 🔥 The "Dangerous" Workflow
+### The "Dangerous" Workflow
 
 ```bash
 claude --dangerously-skip-permissions
@@ -59,75 +126,141 @@ claude --dangerously-skip-permissions
 
 Let Claude Code run fully autonomous on your PC. Monitor everything from your phone. Intervene when needed. Go make coffee.
 
-### 🖥️ Multi-Session Power
+### Multi-Session Power
 
 4 ghost cells = 4 terminals. Run Claude Code in one, `git log` in another, `npm test` in a third. Switch between them with a tap.
 
-### 📱 On-the-Go Approval
+### On-the-Go Approval
 
 Claude Code asking "May I edit server.js?" — tap `y` from the bus. No need to rush back to your desk.
 
-### 📸 Screenshot & Upload
+---
 
-Take a screenshot of your phone screen and send it to your PC terminal. Upload files directly from your phone to your desktop.
+## System Requirements
 
-## Features
+### PC (Companion)
 
-| Feature | GhostTerm | Anthropic Mobile |
-|---|---|---|
-| Real CLI terminal | ✅ | ❌ |
-| Simultaneous sessions | 4 | 1 |
-| `--dangerously-skip-permissions` | ✅ monitor from phone | ❌ |
-| Custom shortcut keys | ✅ y/n/Tab/Ctrl+C | ❌ |
-| Pixel office view | ✅ | ❌ |
-| File upload to PC | ✅ | ❌ |
-| No VPN needed | ✅ | N/A |
-| Google auto-pairing | ✅ | - |
+- **Node.js** 18 or later
+- **Operating System**: Windows, macOS, or Linux
+- **Platform-specific build tools** (for `node-pty`):
+  - **Windows**: Visual Studio Build Tools or `npm install -g windows-build-tools`
+  - **macOS**: `xcode-select --install`
+  - **Linux**: `apt install build-essential` (Debian/Ubuntu) or equivalent
+- **Google account** for pairing
 
-## Controls
+### Phone (Client)
 
-**Top bar**: 4 ghost cells (tap to switch terminals, `+` to create new) · `🏠` pixel office view · `A` font size · `▼` hide controls
+- Any modern browser (iOS Safari 15+, Chrome, Firefox, Edge)
+- Internet connection
+
+---
 
-**Quick keys**: `y` / `n` (approve/deny) · `S+Tab` (shift-tab) · `/ cmd` (slash commands) · `Tab` · `←Bksp`
+## Configuration
 
-**Left column**: `⏻ claude` (launch menu: new / resume / continue / dangerous mode) · `Stop` (Ctrl+C) · `Close` (kill session)
+### Environment Variables
 
-**Center**: D-pad (↑↓←→) + `Enter`
+| Variable | Default | Description |
+|---|---|---|
+| `GHOSTTERM_RELAY` | `wss://ghostterm-relay.fly.dev` | Custom relay server URL |
 
-**Right column**: `Line↵` (newline) · `⬇` (scroll to bottom) · `Space` · `▲▼` (page up/down) · `Copy` (select mode)
+### Custom Relay
 
-**Bottom**: Text input + `Send` · `📷 Shot` (screenshot to PC) · `📁 File` (upload to PC)
+If you want to self-host the relay:
+
+```bash
+GHOSTTERM_RELAY=wss://your-relay.example.com npx ghostterm
+```
+
+---
 
 ## Pricing
 
-- **Free**: 1 hour/day, full features
+- **Free**: 1 hour/day, all features included
 - **Pro**: $5/month or $12/quarter — unlimited access
 
-## How It Works
+---
+
+## Troubleshooting
+
+### "Failed to install node-pty" / build errors
+
+`node-pty` requires native compilation. Make sure you have build tools installed:
+
+```bash
+# Windows (run as Administrator)
+npm install -g windows-build-tools
+
+# macOS
+xcode-select --install
 
+# Linux (Debian/Ubuntu)
+sudo apt install build-essential python3
 ```
-Phone (browser)  ──WSS──▶  Relay (Fly.io Tokyo)  ◀──WSS──  PC (ghostterm)
-                            encrypted WebSocket
-                            auto-pairs by Google account
-                            zero data stored
+
+### "Google sign-in window doesn't open"
+
+- Make sure your default browser isn't blocking pop-ups
+- Try running `npx ghostterm` again — it retries automatically
+- If behind a corporate proxy, ensure `accounts.google.com` is accessible
+
+### "Phone can't connect" / "Waiting for companion..."
+
+- Ensure the PC companion is still running (`npx ghostterm`)
+- Both devices must use the **same Google account**
+- Check your phone's internet connection
+- Try refreshing the page on your phone
+
+### "Terminal shows garbled text"
+
+- Make sure your phone browser supports modern CSS/JS
+- Try switching to a different terminal session (tap a ghost cell)
+- Clear browser cache and reload
+
+### "Session keeps disconnecting"
+
+- Check your network stability on both PC and phone
+- The relay auto-reconnects with exponential backoff
+- If using a VPN, try disabling it (GhostTerm doesn't need one)
+
+### node-pty on Apple Silicon (M1/M2/M3)
+
+If you see architecture mismatch errors:
+
+```bash
+# Force rebuild for current architecture
+npm rebuild node-pty
 ```
 
-All traffic is encrypted (WSS). The relay only forwards messages — no terminal data is stored.
+---
 
-## Requirements
+## Uninstall
 
-- **PC**: Node.js 18+
-  - Windows: may need `npm install -g windows-build-tools`
-  - macOS: `xcode-select --install`
-  - Linux: `apt install build-essential`
-- **Phone**: Any modern browser (iOS Safari, Chrome, etc.)
+GhostTerm stores a refresh token in `~/.ghostterm/` for auto-login. To fully remove:
 
-## Environment Variables
+```bash
+rm -rf ~/.ghostterm
+```
 
-| Variable | Default | Description |
-|---|---|---|
-| `GHOSTTERM_RELAY` | `wss://ghostterm-relay.fly.dev` | Custom relay server URL |
+---
+
+## Security
+
+- All communication is encrypted via WSS (WebSocket Secure)
+- Google OAuth 2.0 for authentication — GhostTerm never sees your Google password
+- The relay server is stateless — no terminal data is stored
+- Pair codes expire after 5 minutes
+- Brute-force protection on pair code entry
+- Rate limiting on all WebSocket connections
+- Connection limits per IP address
+
+---
 
 ## License
 
 MIT
+
+---
+
+<p align="center">
+  Built with frustration and love by a Claude Code addict.
+</p>

package/bin/ghostterm.js

@@ -37,11 +37,23 @@ function loadToken() {
     if (fs.existsSync(CRED_FILE)) {
       const cred = JSON.parse(fs.readFileSync(CRED_FILE, 'utf8'));
       if (cred.id_token) {
-        const payload = JSON.parse(Buffer.from(cred.id_token.split('.')[1], 'base64').toString());
-        if (payload.exp * 1000 > Date.now()) {
-          return cred.id_token;
+        // Long token format: base64payload.signature (no dots in payload)
+        const parts = cred.id_token.split('.');
+        if (parts.length === 2) {
+          // Long token — check our own expiry
+          try {
+            const data = JSON.parse(Buffer.from(parts[0], 'base64').toString());
+            if (data.exp > Date.now()) return cred.id_token;
+            console.log('  Long token expired, need to re-login');
+          } catch {}
+        } else if (parts.length === 3) {
+          // Google JWT — check Google expiry
+          try {
+            const payload = JSON.parse(Buffer.from(parts[1], 'base64').toString());
+            if (payload.exp * 1000 > Date.now()) return cred.id_token;
+            console.log('  Google token expired, need to re-login');
+          } catch {}
         }
-        console.log('  Token expired, need to re-login');
       }
     }
   } catch {}
@@ -303,7 +315,12 @@ function handleRelayMessage(msg) {
     case 'auth_ok':
       console.log(`  Authenticated as: ${msg.email}`);
       console.log('  Phone will auto-connect with same Google account');
-      // Pre-spawn a standby terminal so first open is instant
+      // Save long token if provided (valid 30 days, no more Google expiry issues)
+      if (msg.longToken) {
+        saveToken(msg.longToken);
+        googleToken = msg.longToken;
+        console.log('  Long-lived token saved (30 days)');
+      }
       prepareStandby();
       break;
 
@@ -392,8 +409,19 @@ function handleRelayMessage(msg) {
 
     case 'upload':
       try {
+        const UPLOAD_MAX_SIZE = 5 * 1024 * 1024; // 5MB
+        const UPLOAD_EXT_WHITELIST = ['.png', '.jpg', '.jpeg', '.pdf', '.txt', '.md', '.json', '.csv', '.py', '.js', '.ts', '.html', '.css'];
+        const ext = (msg.ext || '.png').toLowerCase();
+        if (!UPLOAD_EXT_WHITELIST.includes(ext)) {
+          sendToRelay({ type: 'upload_error', message: `File type not allowed: ${ext}` });
+          break;
+        }
         const buf = Buffer.from(msg.data, 'base64');
-        const filename = `${Date.now()}-${Math.random().toString(36).slice(2, 6)}${msg.ext || '.png'}`;
+        if (buf.length > UPLOAD_MAX_SIZE) {
+          sendToRelay({ type: 'upload_error', message: `File too large: ${(buf.length / 1024 / 1024).toFixed(1)}MB (max 5MB)` });
+          break;
+        }
+        const filename = `${Date.now()}-${Math.random().toString(36).slice(2, 6)}${ext}`;
         const filePath = path.join(UPLOAD_DIR, filename);
         fs.writeFileSync(filePath, buf);
         sendToRelay({ type: 'upload_result', path: filePath, filename, size: buf.length });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ghostterm",
-  "version": "1.1.0",
+  "version": "1.1.2",
   "description": "Mobile terminal for Claude Code — control your PC from your phone",
   "bin": {
     "ghostterm": "bin/ghostterm.js"