workoffdesk 0.0.0-stage → 1.0.0

package/CHANGELOG.md

@@ -0,0 +1,21 @@
+# Changelog
+
+## 1.0.0
+
+The first public release.
+
+- Chat with the Claude Code sessions on your Mac from your phone, in a web app you can add to the home
+  screen. The interface is in English or Chinese, following the phone.
+- Claude's questions, permission prompts and panels such as `/usage` become cards you answer with a tap.
+- Sessions run in tmux on the Mac and outlive the phone; `workoffdesk attach` joins one from the Mac's
+  terminal.
+- One user per install, with a password and passkeys; sign-ins can be revoked device by device.
+- Web push when Claude waits for you or finishes a turn.
+- `install.sh` installs the dependencies and the npm package; `workoffdesk install` runs the service under
+  launchd; `workoffdesk deploy` and `rollback` upgrade it and switch back when the new version does not start.
+- `workoffdesk doctor` checks tmux, Claude Code, the service, the address, idle sleep and the push key, and says
+  what to do about each problem. `setup` and `doctor` print the address as a QR code.
+- While the service runs, the Mac does not go to idle sleep.
+- `workoffdesk --version`.
+- An iPhone app you build with your own Apple Developer account, with notifications through APNs. It keeps
+  every account you sign in to, and you move between them from Settings.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 workoffdesk contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,200 @@
-# Temporary Holding Version
+# workoffdesk
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+**Chat with the Claude Code and Codex sessions on your Mac from your phone.**
+
+English · [简体中文](https://github.com/workoffdesk/workoffdesk/blob/main/README.zh-CN.md)
+
+<p align="center"><img src="https://raw.githubusercontent.com/workoffdesk/workoffdesk/main/docs/screens/demo.gif" alt="Giving a session on the Mac work from the phone, and answering its question with a tap" width="320"></p>
+
+## What makes it different
+
+- **No account, no relay of ours.** It is a small web app on your own Mac; your phone reaches it over the
+  path you choose, such as Tailscale, a Cloudflare Tunnel or your own server.
+- **Sessions outlive the phone.** Each one runs in tmux on the Mac: closing the page, locking the phone or
+  restarting the service does not end it.
+- **Leaving the desk, take it with you; back at it, keep going.** A Claude Code conversation running in a
+  terminal on the Mac can be taken over from the phone, and `workoffdesk attach` joins any session from the
+  Mac's terminal.
+- **Tap instead of typing keys.** Claude's questions, permission prompts and panels like `/usage` become
+  cards on the phone.
+- **Claude Code or Codex.** Start either in a project folder; each session is named after what its
+  conversation is about, so the list says what each one does.
+
+## Screens
+
+<table width="100%">
+  <tr><th width="33%">Chat</th><th width="33%">A question from Claude</th><th width="33%">Sessions</th></tr>
+  <tr><td width="33%"><img src="https://raw.githubusercontent.com/workoffdesk/workoffdesk/main/docs/screens/chat.png" alt="Chat" width="100%"></td><td width="33%"><img src="https://raw.githubusercontent.com/workoffdesk/workoffdesk/main/docs/screens/choice.png" alt="A choice card" width="100%"></td><td width="33%"><img src="https://raw.githubusercontent.com/workoffdesk/workoffdesk/main/docs/screens/sessions.png" alt="The session list" width="100%"></td></tr>
+</table>
+
+## How it fits together
+
+<p align="center"><img src="https://raw.githubusercontent.com/workoffdesk/workoffdesk/main/docs/screens/how-it-works.gif" alt="How it fits together: the phone, an HTTPS tunnel you pick, the service on your Mac, sessions in tmux" width="100%"></p>
+
+```text
+phone: the web app, or the iPhone app
+   │   HTTPS, over the path you choose: Tailscale, a Cloudflare Tunnel, your own server
+   ▼
+the workoffdesk service on your Mac   (listens on 127.0.0.1, runs as a launchd agent)
+   │
+   ▼
+tmux sessions: Claude Code or Codex, each in a project folder
+```
+
+Everything runs on your Mac, and everything it keeps is in `~/.workoffdesk`. You look after the service from
+any of four places; they run the same checks:
+
+| Where | What it is for |
+|---|---|
+| `workoffdesk` in a terminal | Set up, install, start, stop, check, join a session, upgrade and roll back. See [Commands](#commands). |
+| The setup page (`workoffdesk setup --web`) | The first setup, step by step in your browser: the checks, your account, the address, the service, and the address as a QR code. |
+| The menu bar app (`apps/mac`, built from source) | Whether the service runs at a glance; failed checks with their fixes, start, stop and restart, the QR code, the Claude account. |
+| Settings → **This Mac**, on the phone or the web | The checks, the version, the newest warnings and errors, Restart and Roll back, and which Claude account new sessions run on. |
+
+## Quick start
+
+On the Mac (macOS, with [Claude Code](https://docs.anthropic.com/en/docs/claude-code) installed, and
+[Codex](https://github.com/openai/codex) if you use it):
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/workoffdesk/workoffdesk/main/install.sh | bash
+```
+
+`install.sh` installs tmux and Node with Homebrew if they are missing and never uses `sudo`. Run in a terminal
+on a Mac not set up yet, it then opens the setup page in your browser. Without the script, or by hand:
+
+```bash
+npm i -g workoffdesk   # needs Node 22.13+ and tmux 3.3+
+workoffdesk setup --origin https://workoffdesk.example.com
+workoffdesk install    # then run the launchctl line it prints
+workoffdesk doctor
+```
+
+`setup` asks for a username and a password; `install` writes a launchd service and prints the command that
+starts it; `doctor` checks everything and says what to do about anything that fails. See
+[Install](https://github.com/workoffdesk/workoffdesk/blob/main/docs/guide/install.md).
+
+## Reach it from your phone
+
+The server listens on `127.0.0.1` only. Put HTTPS in front of it: `tailscale serve` keeps the traffic
+between your own devices, while a Cloudflare Tunnel works from any network but Cloudflare sees the traffic.
+[Remote access](https://github.com/workoffdesk/workoffdesk/blob/main/docs/guide/remote-access.md) compares the options and sets each one up.
+
+> [!WARNING]
+> Whoever signs in can run any command on your Mac as you. Use a strong password, keep the address to
+> yourself, and read [SECURITY.md](https://github.com/workoffdesk/workoffdesk/blob/main/SECURITY.md).
+
+## Using it
+
+A typical day: start a task at the desk with `workoffdesk claude`, or in a terminal as usual and take it over
+from the phone later. Away from the desk, answer Claude's questions and send the next steps from the phone.
+Back at the desk, `workoffdesk attach` joins the same session, with everything the phone did in it.
+
+### On the phone
+
+1. Open your address (`setup` prints it as a QR code) and sign in.
+2. Add it to the home screen.
+3. In Settings, add a passkey and turn on notifications.
+
+Then:
+
+- **Start or go on.** ⊕ starts Claude or Codex in a project folder, or opens a recent conversation from the
+  Mac to read and continue. One still open in a terminal on the Mac can be taken over, now or once its
+  current step is done.
+- **Read it as a chat.** Claude's replies are rendered as Markdown and tool calls are folded. Questions,
+  permission prompts and panels like `/usage` are cards to tap; **Screen** shows the Mac's screen as text
+  when the chat cannot show what Claude waits on.
+- **Send.** Type, hold to talk, or add pictures, videos and files. What you send while Claude works goes
+  into Claude's own queue. **Stop** interrupts it; **Rewind** goes back to an earlier point.
+- **Be told.** A notification comes when Claude waits for you or finishes a turn.
+
+Prefer a native app? [Build the iPhone app](https://github.com/workoffdesk/workoffdesk/blob/main/docs/guide/ios-app.md) with your own Apple Developer account.
+Everything else is in [Usage](https://github.com/workoffdesk/workoffdesk/blob/main/docs/guide/usage.md).
+
+### At the Mac
+
+```bash
+workoffdesk claude        # start Claude in this folder as a session, and join it
+workoffdesk codex         # the same for Codex
+workoffdesk attach        # join a session, picked from a list
+```
+
+It is the same tmux session the phone shows, so both can be on it at once. `Ctrl-b d` detaches and leaves
+it running. In a session on the phone, ⋯ → **Continue on the Mac** shows the `attach` command to copy.
+
+### Looking after the service
+
+`workoffdesk doctor` checks macOS, Node, tmux, Claude Code, Codex, the setup, the service, your address, idle
+sleep and the iPhone push key, and prints the fix for each failure. The same checks, with the service's
+newest warnings and errors, are on Settings → **This Mac** and in the menu bar app. A new version is installed
+with `workoffdesk deploy`, which smoke-tests it before switching and switches back if it does not come up;
+`workoffdesk rollback` goes back one release. See [Upgrade](https://github.com/workoffdesk/workoffdesk/blob/main/docs/guide/upgrade.md) and
+[Troubleshooting](https://github.com/workoffdesk/workoffdesk/blob/main/docs/guide/troubleshooting.md).
+
+While the service runs it keeps the Mac from idle sleep; the display still sleeps, and closing the lid still
+sleeps the Mac.
+
+## Commands
+
+Each is run as `workoffdesk <command>`.
+
+| Command | What it does |
+|---|---|
+| `setup` | Asks for a username and a password (12 characters or more) and writes the config. Run again, it sets a new password and signs every device out. |
+| `setup --web` | The setup as a page in your browser, including the address and the service. |
+| `install` | Writes the launchd agent and `~/.local/bin/workoffdesk`, starts nothing, and prints the commands to run. `--tunnel <name>` also sets up an existing Cloudflare tunnel. |
+| `start` | Starts the service and waits up to 30 seconds for it to answer. |
+| `stop` | Stops the service until the next login or `start`. |
+| `restart` | Restarts the service. Sessions keep running. |
+| `doctor` | Runs every check, prints the fix for each failure, and exits 1 while anything fails. |
+| `status --json` | The checks, the version, the releases, the address, whether the service runs, and its newest 20 warnings and errors. |
+| `claude [--resume <session id>]` | Starts Claude in this folder as a session and joins it; with `--resume`, going on with that conversation. |
+| `codex [--resume <thread id>]` | The same for Codex. |
+| `attach [id]` | Joins a session from this terminal; without an id, lists them to pick one. |
+| `serve` | Runs the server in this terminal instead of as the service. |
+| `deploy <build folder>` | Installs a build as a new release, smoke-tests it, switches to it and restarts the service; keeps the newest 3. |
+| `rollback` | Goes back to the release before. |
+| `--version` | Prints the installed version. |
+| `--help` | Prints this list, one line for each command; so does `workoffdesk` with no command. |
+
+Everything is kept in `~/.workoffdesk`; set `WORKOFFDESK_HOME` to keep it elsewhere. Settings such as
+`pinnedDirs` are in [Configuration](https://github.com/workoffdesk/workoffdesk/blob/main/docs/guide/configuration.md).
+
+## Compared with similar tools
+
+Checked on 2026-10-07. These products change quickly; check again before quoting this table.
+
+| | Works with | Traffic goes through | Account needed | After the network drops | Native apps | License |
+|---|---|---|---|---|---|---|
+| **workoffdesk** | Claude Code, Codex | Your Mac and the path you choose | None | Session keeps running in tmux | iPhone (build it yourself); web app | MIT |
+| [Claude Code Remote Control](https://code.claude.com/docs/en/remote-control) | Claude Code | Anthropic API | Claude Pro, Max, Team or Enterprise | Reconnects; the local process must keep running | Claude iOS and Android | Not stated |
+| [Happy](https://github.com/slopus/happy) | Claude Code, Codex | Happy Server, end-to-end encrypted | Not stated | Not stated | iOS, Android, macOS, web | MIT |
+| [zalify/offdesk](https://github.com/zalify/offdesk) | Anything in tmux | A hub, end-to-end encrypted | None to self-host | Session keeps running in tmux | iOS (TestFlight), Android, desktop | MIT |
+| [VibeTunnel](https://github.com/amantus-ai/vibetunnel) | Any terminal program | The tunnel you choose | Not stated | Not stated | macOS; iOS in progress | MIT |
+
+<!--
+Sources, read 2026-10-07:
+- workoffdesk: docs/facts.md (Codex: Sessions)
+- Claude Code Remote Control: https://code.claude.com/docs/en/remote-control
+  (traffic through the Anthropic API; Pro/Max/Team/Enterprise plan, API keys not supported;
+  "reconnects automatically"; the local process must keep running; Claude iOS and Android apps)
+- Happy: https://github.com/slopus/happy ("happy claude", "happy codex"; Happy Server with encrypted sync;
+  iOS, Android, macOS, web; MIT)
+- zalify/offdesk: https://github.com/zalify/offdesk ("anything that runs in tmux"; hub with end-to-end
+  encryption; "Self-hosting needs no vendor account"; tmux keeps sessions alive; releases:
+  https://github.com/zalify/offdesk/releases; MIT)
+- VibeTunnel: https://github.com/amantus-ai/vibetunnel ("Turn any browser into your Mac terminal";
+  Tailscale, ngrok, Cloudflare Quick Tunnel; native macOS app, iOS app in progress; MIT)
+-->
+
+## Documentation
+
+- [Install](https://github.com/workoffdesk/workoffdesk/blob/main/docs/guide/install.md) · [Remote access](https://github.com/workoffdesk/workoffdesk/blob/main/docs/guide/remote-access.md) · [Usage](https://github.com/workoffdesk/workoffdesk/blob/main/docs/guide/usage.md)
+- [Configuration](https://github.com/workoffdesk/workoffdesk/blob/main/docs/guide/configuration.md) · [Upgrade](https://github.com/workoffdesk/workoffdesk/blob/main/docs/guide/upgrade.md) ·
+  [Troubleshooting](https://github.com/workoffdesk/workoffdesk/blob/main/docs/guide/troubleshooting.md)
+- [How it works](https://github.com/workoffdesk/workoffdesk/blob/main/docs/guide/how-it-works.md) · [iPhone app](https://github.com/workoffdesk/workoffdesk/blob/main/docs/guide/ios-app.md)
+- [Contributing](https://github.com/workoffdesk/workoffdesk/blob/main/CONTRIBUTING.md) · [Changelog](https://github.com/workoffdesk/workoffdesk/blob/main/apps/server/CHANGELOG.md) · [Security](https://github.com/workoffdesk/workoffdesk/blob/main/SECURITY.md)
+
+## License
+
+MIT, see [LICENSE](https://github.com/workoffdesk/workoffdesk/blob/main/LICENSE). Not affiliated with Anthropic. Claude is a trademark of Anthropic.

package/SECURITY.md

@@ -0,0 +1,50 @@
+# Security
+
+## What you are putting on the internet
+
+workoffdesk is a remote terminal. **Whoever signs in can run anything your macOS user can run**: read your
+files, use your SSH keys and cloud credentials, start Claude Code with your account. Treat the password
+like your login password and the site like an SSH port.
+
+## What it does to keep others out
+
+- **One user.** There is exactly one account per install, made with `workoffdesk setup`. Running `setup`
+  again replaces the password and signs every device out.
+- **Password and passkeys.** Passwords (12 characters or more) are stored as scrypt hashes. After signing in
+  you can add passkeys (WebAuthn, e.g. Face ID) and sign in with those instead.
+- **Lockout.** Five failed sign-ins from one address within 15 minutes lock that address for 15 minutes;
+  twenty failures from anywhere within an hour lock sign-in for everyone for an hour. Every attempt is
+  written to `logs/audit.log`.
+- **Sessions you can revoke.** A sign-in lasts 30 days. Each signed-in device is listed in Settings and can
+  be revoked; it is sent back to the sign-in page on its next request.
+- **Origin checks.** Requests that change anything, and every WebSocket, must come from the configured
+  `origin`; anything else is refused.
+- **Content Security Policy.** Pages load scripts, styles and images only from the site itself; images
+  from the web inside Claude's replies are shown as links, never loaded.
+- **Loopback only.** The server listens on `127.0.0.1` and does not trust `X-Forwarded-*` headers.
+
+## Who can read your traffic
+
+The path between your phone and the Mac decides who else sees what you type and what Claude answers. See
+[Remote access](https://github.com/workoffdesk/workoffdesk/blob/main/docs/guide/remote-access.md).
+
+- **Tailscale** (`tailscale serve`): TLS ends on your Mac; only your own devices take part.
+- **A Cloudflare Tunnel**: Cloudflare terminates TLS at its edge, so Cloudflare can read the traffic.
+- **Your own server** with a reverse proxy: that server terminates TLS and can read the traffic.
+
+## How to run it safely
+
+- **Always serve it over HTTPS.** Never expose the port directly or forward it on your router: cookies are
+  `Secure` and passkeys need HTTPS, and a plain-HTTP site sends your password in the clear.
+- Choose a long password, add a passkey, and revoke devices you no longer use.
+- An access layer in front, such as a VPN or Tailscale, adds a second lock: only your devices can reach the
+  sign-in page at all.
+- **`claudeArgs` widens what a session does without you.** `--dangerously-skip-permissions` lets Claude run
+  any command and edit any file without asking; combined with remote access, a prompt injection in
+  something Claude reads can act on your Mac while you are away. Add it only if you accept that.
+
+## Reporting a vulnerability
+
+Report it privately through the repository's
+[security advisories](https://github.com/workoffdesk/workoffdesk/security/advisories/new). Please do not open a
+public issue for anything that lets someone sign in, read files or run commands without the password.

package/dist/build.json

@@ -0,0 +1 @@
+{"version":"1.0.0","commit":"25838a75d2ca44fe42cfbfff87f8a10964beda03","dirty":false}

package/dist/server/agents/claude/accounts.js

@@ -0,0 +1,105 @@
+import { execFile } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { existsSync, readdirSync, readFileSync, realpathSync } from 'node:fs';
+import { join } from 'node:path';
+const FRESH_MS = 10_000;
+const SECURITY_MS = 5_000;
+const real = (p) => {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        return null;
+    }
+};
+function readAccount(file) {
+    try {
+        const j = JSON.parse(readFileSync(file, 'utf8'));
+        const email = j.oauthAccount?.emailAddress;
+        return typeof email === 'string' && email ? { email, ready: j.hasCompletedOnboarding === true } : null;
+    }
+    catch {
+        return null;
+    }
+}
+// Only the item's attributes are read: no prompt, and no secret leaves the Keychain.
+const keychainHas = (service) => new Promise((resolve) => execFile('/usr/bin/security', ['find-generic-password', '-s', service], { timeout: SECURITY_MS }, (err) => resolve(!err)));
+export class ClaudeAccounts {
+    o;
+    last = null;
+    reading = null;
+    constructor(o) {
+        this.o = o;
+    }
+    // Read anew once the last read is FRESH_MS old, one read at a time.
+    list() {
+        if (this.last && Date.now() - this.last.at < FRESH_MS)
+            return Promise.resolve(this.last.accounts);
+        this.reading ??= this.read().finally(() => (this.reading = null));
+        return this.reading;
+    }
+    // The last read, for what cannot wait on one.
+    known() {
+        return this.last?.accounts ?? [];
+    }
+    pickable(a) {
+        return a.signedIn && a.ready && a.shared;
+    }
+    // The account a config dir is, however it is spelled; unset is the default. undefined: a dir that is gone.
+    idOf(dir) {
+        if (!dir)
+            return '';
+        const r = real(dir);
+        if (r === null)
+            return undefined;
+        if (r === real(join(this.o.home, '.claude')))
+            return '';
+        return this.known().find((a) => a.id && real(a.id) === r)?.id ?? r;
+    }
+    // The account this server's own environment gives a Claude.
+    ownId() {
+        return this.idOf(this.o.own) ?? '';
+    }
+    folder(dir) {
+        return dir.startsWith(`${this.o.home}/`) ? `~${dir.slice(this.o.home.length)}` : dir;
+    }
+    async read() {
+        const has = this.o.keychainHas ?? keychainHas;
+        const projects = real(this.o.projectsRoot);
+        const home = join(this.o.home, '.claude');
+        const dirs = this.o.own ? [this.o.own] : [];
+        for (const parent of [this.o.home, join(this.o.home, '.config')]) {
+            let names = [];
+            try {
+                names = readdirSync(parent);
+            }
+            catch {
+                continue;
+            }
+            for (const name of names)
+                if (parent !== this.o.home || name.startsWith('.'))
+                    dirs.push(join(parent, name));
+        }
+        const accounts = [];
+        const seen = new Set();
+        const add = async (id, dir, file, service) => {
+            const r = real(dir);
+            if (r === null || seen.has(r))
+                return;
+            const found = readAccount(file);
+            if (!found)
+                return;
+            seen.add(r);
+            const signedIn = (await has(service)) || existsSync(join(dir, '.credentials.json'));
+            accounts.push({ id, folder: this.folder(dir), email: found.email, signedIn, ready: found.ready, shared: projects !== null && real(join(dir, 'projects')) === projects });
+        };
+        await add('', home, join(this.o.home, '.claude.json'), 'Claude Code-credentials');
+        for (const dir of dirs) {
+            if (dir === home)
+                continue;
+            await add(dir, dir, join(dir, '.claude.json'), `Claude Code-credentials-${createHash('sha256').update(dir).digest('hex').slice(0, 8)}`);
+        }
+        this.last = { at: Date.now(), accounts };
+        return accounts;
+    }
+}

package/dist/server/agents/claude/hooks/asks.js

@@ -0,0 +1,135 @@
+import { randomUUID } from 'node:crypto';
+import { toolSummary } from '../transcript/chat.js';
+// Tools whose dialog says more than yes or no (Claude's questions, its plan): left to the screen.
+const ON_SCREEN = new Set(['AskUserQuestion', 'ExitPlanMode']);
+const DETAIL_MAX = 4000;
+// A prompt is let go a little before its hook would be stopped (PERMISSION_HOLD_S in hooks.ts), so the
+// hook ends with no word rather than being killed, which reads as the Mac's No.
+export const HOLD_MS = 3500_000;
+const DECLINED = 'The user declined this from their phone.';
+// Whether the prompt's dialog is one the phone leaves to the Mac's screen.
+export const leftToScreen = (payload) => typeof payload.tool_name === 'string' && ON_SCREEN.has(payload.tool_name);
+// What a prompt asks of the person: Claude's question, its plan, or the tool and what it would do with it.
+export function askedOf(payload) {
+    const tool = typeof payload.tool_name === 'string' ? payload.tool_name : '';
+    const input = isRecord(payload.tool_input) ? payload.tool_input : {};
+    if (tool === 'AskUserQuestion') {
+        const first = Array.isArray(input.questions) ? input.questions[0] : null;
+        return isRecord(first) ? str(first.question) : '';
+    }
+    if (tool === 'ExitPlanMode')
+        return str(input.plan);
+    return tool && `${tool} ${toolSummary(tool, input)}`.trim();
+}
+// The permission prompts Claude Code's PermissionRequest hooks hold open for the phone, per session. The
+// dialog stays on the Mac's screen all the while: whichever answers first is the answer, and a prompt is
+// over when the phone answers it, the Mac does, or the turn moves on without it.
+export class PermissionAsks {
+    changed;
+    held = new Map();
+    // changed: a session's asks came or went.
+    constructor(changed = () => { }) {
+        this.changed = changed;
+    }
+    // The ask the phone is shown for a prompt, or null when it is one left to the screen (and the hook has
+    // been answered with nothing).
+    hold(termId, payload, hook) {
+        const tool = typeof payload.tool_name === 'string' ? payload.tool_name : '';
+        const input = isRecord(payload.tool_input) ? payload.tool_input : null;
+        if (!tool || !input || ON_SCREEN.has(tool)) {
+            hook.reply(null);
+            return null;
+        }
+        const suggestions = Array.isArray(payload.permission_suggestions) ? payload.permission_suggestions.filter(isRecord) : [];
+        const ask = { id: randomUUID(), kind: 'permission', tool, title: toolSummary(tool, input), detail: detailOf(tool, input), always: alwaysOf(suggestions) };
+        const timer = setTimeout(() => this.take(termId, (h) => h.ask.id === ask.id)?.hook.reply(null), HOLD_MS).unref();
+        const list = this.held.get(termId) ?? [];
+        list.push({ ask, call: callKey(tool, input), suggestions, hook, timer });
+        this.held.set(termId, list);
+        this.changed(termId);
+        return ask;
+    }
+    list(termId) {
+        return (this.held.get(termId) ?? []).map((h) => h.ask);
+    }
+    // False when the ask is over. "From now on" takes every suggestion Claude Code made, as its own dialog's
+    // option does.
+    answer(termId, askId, answer) {
+        const now = this.take(termId, (h) => h.ask.id === askId);
+        if (!now)
+            return false;
+        const keep = answer.allow && answer.always && now.suggestions.length ? { updatedPermissions: now.suggestions } : {};
+        now.hook.reply(decision(answer.allow ? { behavior: 'allow', ...keep } : { behavior: 'deny', message: DECLINED, interrupt: true }));
+        return true;
+    }
+    // The hook ended without an answer from here: Claude Code stopped it. True when it was still held.
+    gone(termId, askId) {
+        return !!this.take(termId, (h) => h.ask.id === askId);
+    }
+    // The tool of a prompt ran (or failed): it was allowed at the Mac, and its hook waits on nothing.
+    toolDone(termId, tool, input) {
+        if (typeof tool !== 'string' || !isRecord(input))
+            return;
+        const call = callKey(tool, input);
+        this.take(termId, (h) => h.call === call)?.hook.reply(null);
+    }
+    // The turn is over or the session gone: nothing it held is asked any more.
+    endAll(termId) {
+        for (const h of this.held.get(termId) ?? []) {
+            clearTimeout(h.timer);
+            h.hook.reply(null);
+        }
+        if (this.held.delete(termId))
+            this.changed(termId);
+    }
+    take(termId, which) {
+        const list = this.held.get(termId) ?? [];
+        const i = list.findIndex(which);
+        if (i < 0)
+            return undefined;
+        const [h] = list.splice(i, 1);
+        if (!list.length)
+            this.held.delete(termId);
+        clearTimeout(h.timer);
+        this.changed(termId);
+        return h;
+    }
+}
+const decision = (d) => ({ hookSpecificOutput: { hookEventName: 'PermissionRequest', decision: d } });
+const isRecord = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+const str = (v) => (typeof v === 'string' ? v : '');
+const clip = (s) => (s.length > DETAIL_MAX ? `${s.slice(0, DETAIL_MAX)}…` : s);
+const marked = (mark, s) => s.split('\n').map((l) => `${mark} ${l}`).join('\n');
+// The whole of what the tool is asked to do, as far as the card has room for it.
+function detailOf(tool, input) {
+    if (tool === 'Bash')
+        return clip(str(input.command));
+    if (tool === 'Write')
+        return clip(str(input.content));
+    if (tool === 'Edit')
+        return clip(`${marked('-', str(input.old_string))}\n${marked('+', str(input.new_string))}`);
+    return clip(JSON.stringify(input, null, 2));
+}
+// What Claude Code's suggestions would allow from now on; null when it made none the phone can name.
+function alwaysOf(suggestions) {
+    const list = (v) => (Array.isArray(v) ? v : []);
+    const always = { rules: [], dirs: [], mode: null };
+    for (const s of suggestions) {
+        if (s.type === 'addRules' && s.behavior === 'allow') {
+            for (const r of list(s.rules).filter(isRecord))
+                always.rules.push(str(r.ruleContent) ? `${str(r.toolName)}(${str(r.ruleContent)})` : str(r.toolName));
+        }
+        else if (s.type === 'addDirectories')
+            always.dirs.push(...list(s.directories).map(str).filter(Boolean));
+        else if (s.type === 'setMode' && str(s.mode))
+            always.mode = str(s.mode);
+        else
+            return null;
+    }
+    return always.rules.length || always.dirs.length || always.mode ? always : null;
+}
+// A tool call as the same text however its input's keys are ordered, to know a PostToolUse for it.
+function callKey(tool, input) {
+    const sorted = (v) => Array.isArray(v) ? v.map(sorted) : isRecord(v) ? Object.fromEntries(Object.keys(v).sort().map((k) => [k, sorted(v[k])])) : v;
+    return JSON.stringify([tool, sorted(input)]);
+}

package/dist/server/agents/claude/hooks/hooks.js

@@ -0,0 +1,114 @@
+import { readFileSync, rmSync } from 'node:fs';
+import { createServer } from 'node:http';
+import { writeJsonAtomic } from '../../../system/paths.js';
+import { HOOK_EVENTS } from './status.js';
+const shq = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
+const hookCommand = (sockPath) => `curl -s -o /dev/null --max-time 2 --unix-socket ${shq(sockPath)} ` +
+    `-H "x-workoffdesk-session: $WORKOFFDESK_SESSION" --data-binary @- http://localhost/hook || true`;
+// How long a permission prompt's hook waits for the phone. The dialog is on the Mac's screen meanwhile.
+const PERMISSION_HOLD_S = 3600;
+// Prints what the server answers, which is the hook's decision; nothing when it cannot be reached.
+const permissionCommand = (sockPath) => `curl -s --max-time ${PERMISSION_HOLD_S} --unix-socket ${shq(sockPath)} ` +
+    `-H "x-workoffdesk-session: $WORKOFFDESK_SESSION" --data-binary @- http://localhost/permission || true`;
+const QUOTED = /^'(?:[^']|'\\'')*'$/;
+const OWN = [hookCommand, permissionCommand].map((make) => make('\0').split(shq('\0')));
+// Whether a hook command is one workoffdesk installs, for a service home anywhere.
+export function isOwnHookCommand(command) {
+    return OWN.some(([head, tail]) => command.startsWith(head) && command.endsWith(tail) && QUOTED.test(command.slice(head.length, command.length - tail.length)));
+}
+const statusPost = (sockPath) => `curl -s -o /dev/null --max-time 2 --unix-socket ${shq(sockPath)} ` +
+    `-H "x-workoffdesk-session: $WORKOFFDESK_SESSION" --data-binary @- http://localhost/status`;
+// The status line the user set for Claude Code themselves, which keeps drawing the terminal's.
+export function userStatusLine(settingsPath) {
+    try {
+        const s = JSON.parse(readFileSync(settingsPath, 'utf8'));
+        const l = s.statusLine;
+        if (l?.type !== 'command' || typeof l.command !== 'string' || !l.command)
+            return undefined;
+        return typeof l.padding === 'number' ? { type: 'command', command: l.command, padding: l.padding } : { type: 'command', command: l.command };
+    }
+    catch {
+        return undefined;
+    }
+}
+// What the status line is given goes to workoffdesk too, and the user's own status line still draws it.
+export function statusLineCommand(sockPath, own) {
+    const post = statusPost(sockPath);
+    if (!own)
+        return `${post} >/dev/null 2>&1 || true`;
+    return `input=$(cat); { printf '%s' "$input" | ${post} >/dev/null 2>&1 & } ; printf '%s' "$input" | { ${own}
+}`;
+}
+export function writeClaudeSettings(path, sockPath, own) {
+    const command = hookCommand(sockPath);
+    const hooks = {
+        ...Object.fromEntries(HOOK_EVENTS.map((event) => [event, [{ hooks: [{ type: 'command', command, timeout: 5 }] }]])),
+        PermissionRequest: [{ hooks: [{ type: 'command', command: permissionCommand(sockPath), timeout: PERMISSION_HOLD_S }] }],
+    };
+    const statusLine = { type: 'command', command: statusLineCommand(sockPath, own?.command) };
+    if (own?.padding !== undefined)
+        statusLine.padding = own.padding;
+    // Agent view moves a conversation out of its window, on quitting or by /background, into a session the
+    // phone cannot follow; what is typed afterwards starts new ones.
+    writeJsonAtomic(path, { hooks, statusLine, disableAgentView: true });
+}
+const MAX_BODY = 1 << 20;
+export async function startHookServer(sockPath, onEvent, onStatus = () => { }, 
+// A permission prompt, held open until `hook` is answered.
+onPermission = (_id, _p, hook) => hook.reply(null)) {
+    const server = createServer((req, res) => {
+        const termId = req.headers['x-workoffdesk-session'];
+        let size = 0;
+        const chunks = [];
+        req.on('data', (c) => {
+            size += c.length;
+            if (size > MAX_BODY)
+                req.destroy();
+            else
+                chunks.push(c);
+        });
+        req.on('end', () => {
+            const held = req.url === '/permission';
+            if (!held)
+                res.end();
+            let payload;
+            try {
+                payload = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+            }
+            catch {
+                payload = null;
+            }
+            if (typeof termId !== 'string' || !termId || !payload || typeof payload !== 'object') {
+                if (held)
+                    res.end();
+                return;
+            }
+            if (held) {
+                onPermission(termId, payload, {
+                    reply: (output) => res.writableEnded || res.end(output ? JSON.stringify(output) : ''),
+                    onGone: (cb) => res.on('close', () => res.writableEnded || cb()),
+                });
+            }
+            else if (req.url === '/status')
+                onStatus(termId, payload);
+            else
+                onEvent(termId, payload);
+        });
+    });
+    return listenOwnerOnly(server, sockPath);
+}
+// The umask makes the socket owner-only from the moment it exists.
+export async function listenOwnerOnly(server, sockPath) {
+    rmSync(sockPath, { force: true });
+    const oldMask = process.umask(0o177);
+    try {
+        await new Promise((resolve, reject) => {
+            server.once('error', reject);
+            server.listen(sockPath, () => resolve());
+        });
+    }
+    finally {
+        process.umask(oldMask);
+    }
+    return server;
+}