horncall 0.5.13__tar.gz

horncall-0.5.13/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Horncall contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

horncall-0.5.13/PKG-INFO

@@ -0,0 +1,113 @@
+Metadata-Version: 2.4
+Name: horncall
+Version: 0.5.13
+Summary: Approve AI coding agents' permission requests (Claude Code, Gemini CLI, Copilot CLI, Codex CLI) from your Android phone.
+Author-email: bitlionaire <bitlionaire.me@gmail.com>
+License-Expression: MIT
+Project-URL: Homepage, https://horncall.bitlionaire.me
+Project-URL: Source, https://github.com/bitlionaire/horncall
+Project-URL: Issues, https://github.com/bitlionaire/horncall/issues
+Keywords: claude-code,gemini-cli,copilot-cli,codex,permissions,hooks,android,approval
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Software Development
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: cryptography>=42
+Requires-Dist: qrcode>=7.4
+Dynamic: license-file
+
+# Horncall
+
+**One app to approve them all.** Answer your AI coding agents' permission requests from your Android
+phone — Claude Code, Gemini CLI, GitHub Copilot CLI and OpenAI Codex CLI, on any number of computers.
+
+This repository is the **PC add-on** (open source, MIT). It hooks into the agents' own, documented
+hook systems and forwards a permission question to the phone only while you switch it **on**
+(you're away from the desk). At the desk, everything works as before.
+
+- Guide: **https://horncall.bitlionaire.me** · phone app: Android (see the guide)
+- End-to-end encrypted: AES-256-GCM with a key made on your computer and handed to the phone only by
+  QR code. The relay sees ciphertext.
+- The phone **signs every decision** (Android Keystore, ECDSA P-256); the computer accepts only
+  answers signed by the phone it paired with. A stolen key file can read orders, but approve nothing.
+- Dangerous commands (`rm -rf`, force push, `DROP TABLE`, edits to secrets, hooks or CI…) get a red
+  card with the reasons and need a long press.
+
+## Install
+
+Pick one. All of them end with the same pairing step (`setup` shows a QR code to scan in the app).
+
+**Claude Code plugin** (Claude Code keeps it up to date):
+
+```
+/plugin marketplace add bitlionaire/horncall
+/plugin install horncall@horncall
+/horncall:approver setup
+```
+
+**pipx / uv** (a `horncall` command; hooks for every agent, Claude Code via its `settings.json`):
+
+```
+pipx install horncall        # or: uv tool install horncall
+horncall setup
+```
+
+**ZIP with a wizard** (no Python tooling needed beyond Python 3.10+): download `horncall-plugin.zip`
+from the guide, unpack anywhere and run `setup.cmd` (macOS/Linux: `sh setup.sh`). It copies itself to
+the per-user program folder (`%LOCALAPPDATA%\Horncall\app`, `~/Library/Application Support/Horncall/app`,
+`~/.local/share/horncall/app`); the unpacked folder can be deleted.
+
+**By hand**: see exactly what would be added, then paste it yourself or let it write:
+
+```
+horncall install gemini --print     # claude | gemini | copilot | codex | claude-statusline
+horncall install gemini
+```
+
+## What the install changes
+
+| Where | What |
+|---|---|
+| `~/.horncall` | pairing key, trusted phones, on/off mode, log (plugin/ZIP installs also a private `venv`) |
+| Claude Code | the `horncall` plugin, or (pipx) four hooks in `~/.claude/settings.json`; optionally a status line for plan limits |
+| `~/.gemini/settings.json`, `~/.codex/hooks.json`, `~/.copilot/hooks/horncall.json` | Horncall hook entries, only for the agents you pick |
+
+Other settings stay untouched; the first change to a file leaves a `*.horncall-backup` copy. The setup
+wizard lists the files and asks before writing. No services, autostart entries or admin rights.
+Remove everything: `horncall uninstall all` (in Claude: `/horncall:approver uninstall all`).
+
+## Every day
+
+| Command | |
+|---|---|
+| `horncall on` / `/horncall:approver on` | leaving the desk — questions go to the phone (`--hours 2` switches off by itself) |
+| `horncall off` | back — normal questions on the computer |
+| `horncall status` | pairing, mode, server, trusted phones, connected agents |
+| `horncall name "Shop backend"` | label this project's orders on the phone |
+
+Gemini CLI asks on its own first — start it with `gemini --yolo` (same as `--approval-mode yolo`) so only the phone asks.
+Codex CLI: open `/hooks` and enable the three Horncall hooks.
+
+## How it works
+
+The agent runs a hook (`horncall hook <agent>`) on a permission request. While Horncall is off it
+exits at once and the agent shows its normal dialog. While on, it encrypts the request, publishes it
+to an [ntfy](https://ntfy.sh) relay (ours by default, any ntfy server works: `horncall pair --server`)
+and waits for the phone's signed answer, which it returns to the agent as allow or deny. Answering
+on the computer instead removes the card from the phone.
+
+## Development
+
+```
+python -m pip install -r plugin/requirements.txt pytest
+python -m pytest
+```
+
+Issues and pull requests are welcome. Horncall is an independent project, not affiliated with
+Anthropic, OpenAI, Google or GitHub; their product names only describe compatibility.
+Contact: bitlionaire.me@gmail.com

horncall-0.5.13/README.md

@@ -0,0 +1,90 @@
+# Horncall
+
+**One app to approve them all.** Answer your AI coding agents' permission requests from your Android
+phone — Claude Code, Gemini CLI, GitHub Copilot CLI and OpenAI Codex CLI, on any number of computers.
+
+This repository is the **PC add-on** (open source, MIT). It hooks into the agents' own, documented
+hook systems and forwards a permission question to the phone only while you switch it **on**
+(you're away from the desk). At the desk, everything works as before.
+
+- Guide: **https://horncall.bitlionaire.me** · phone app: Android (see the guide)
+- End-to-end encrypted: AES-256-GCM with a key made on your computer and handed to the phone only by
+  QR code. The relay sees ciphertext.
+- The phone **signs every decision** (Android Keystore, ECDSA P-256); the computer accepts only
+  answers signed by the phone it paired with. A stolen key file can read orders, but approve nothing.
+- Dangerous commands (`rm -rf`, force push, `DROP TABLE`, edits to secrets, hooks or CI…) get a red
+  card with the reasons and need a long press.
+
+## Install
+
+Pick one. All of them end with the same pairing step (`setup` shows a QR code to scan in the app).
+
+**Claude Code plugin** (Claude Code keeps it up to date):
+
+```
+/plugin marketplace add bitlionaire/horncall
+/plugin install horncall@horncall
+/horncall:approver setup
+```
+
+**pipx / uv** (a `horncall` command; hooks for every agent, Claude Code via its `settings.json`):
+
+```
+pipx install horncall        # or: uv tool install horncall
+horncall setup
+```
+
+**ZIP with a wizard** (no Python tooling needed beyond Python 3.10+): download `horncall-plugin.zip`
+from the guide, unpack anywhere and run `setup.cmd` (macOS/Linux: `sh setup.sh`). It copies itself to
+the per-user program folder (`%LOCALAPPDATA%\Horncall\app`, `~/Library/Application Support/Horncall/app`,
+`~/.local/share/horncall/app`); the unpacked folder can be deleted.
+
+**By hand**: see exactly what would be added, then paste it yourself or let it write:
+
+```
+horncall install gemini --print     # claude | gemini | copilot | codex | claude-statusline
+horncall install gemini
+```
+
+## What the install changes
+
+| Where | What |
+|---|---|
+| `~/.horncall` | pairing key, trusted phones, on/off mode, log (plugin/ZIP installs also a private `venv`) |
+| Claude Code | the `horncall` plugin, or (pipx) four hooks in `~/.claude/settings.json`; optionally a status line for plan limits |
+| `~/.gemini/settings.json`, `~/.codex/hooks.json`, `~/.copilot/hooks/horncall.json` | Horncall hook entries, only for the agents you pick |
+
+Other settings stay untouched; the first change to a file leaves a `*.horncall-backup` copy. The setup
+wizard lists the files and asks before writing. No services, autostart entries or admin rights.
+Remove everything: `horncall uninstall all` (in Claude: `/horncall:approver uninstall all`).
+
+## Every day
+
+| Command | |
+|---|---|
+| `horncall on` / `/horncall:approver on` | leaving the desk — questions go to the phone (`--hours 2` switches off by itself) |
+| `horncall off` | back — normal questions on the computer |
+| `horncall status` | pairing, mode, server, trusted phones, connected agents |
+| `horncall name "Shop backend"` | label this project's orders on the phone |
+
+Gemini CLI asks on its own first — start it with `gemini --yolo` (same as `--approval-mode yolo`) so only the phone asks.
+Codex CLI: open `/hooks` and enable the three Horncall hooks.
+
+## How it works
+
+The agent runs a hook (`horncall hook <agent>`) on a permission request. While Horncall is off it
+exits at once and the agent shows its normal dialog. While on, it encrypts the request, publishes it
+to an [ntfy](https://ntfy.sh) relay (ours by default, any ntfy server works: `horncall pair --server`)
+and waits for the phone's signed answer, which it returns to the agent as allow or deny. Answering
+on the computer instead removes the card from the phone.
+
+## Development
+
+```
+python -m pip install -r plugin/requirements.txt pytest
+python -m pytest
+```
+
+Issues and pull requests are welcome. Horncall is an independent project, not affiliated with
+Anthropic, OpenAI, Google or GitHub; their product names only describe compatibility.
+Contact: bitlionaire.me@gmail.com

horncall-0.5.13/plugin/approver/__init__.py

@@ -0,0 +1,4 @@
+"""Horncall — approve Claude Code permission requests from your phone."""
+
+__version__ = "0.5.13"
+PROTOCOL_VERSION = 1

horncall-0.5.13/plugin/approver/__main__.py

@@ -0,0 +1,3 @@
+from .cli import main
+
+main()

horncall-0.5.13/plugin/approver/agents.py

@@ -0,0 +1,185 @@
+"""Adapters for the AI coding agents Horncall can answer for.
+
+Each agent calls our hook with its own JSON on stdin and expects its own JSON on stdout. An adapter
+turns the input into the common shape `protocol.build_request` takes (Claude Code's: tool_name,
+tool_input, cwd, session_id) and the phone's decision back into the agent's answer. Printing nothing
+always means "no opinion": the agent then asks the user its normal way.
+"""
+
+from __future__ import annotations
+
+import json
+from dataclasses import dataclass
+
+from . import protocol
+
+
+@dataclass
+class HookInput:
+    tool: str            # our tool name: Bash, Write, Edit, … (Claude Code's vocabulary)
+    tool_input: dict
+    cwd: str | None
+    session_id: str | None
+
+    def as_claude(self) -> dict:
+        return {"tool_name": self.tool, "tool_input": self.tool_input, "cwd": self.cwd, "session_id": self.session_id}
+
+
+class Agent:
+    name = "?"
+    title = "?"
+    # The agent kills the hook after its configured timeout; wait a bit less than that.
+    max_wait_s = 1850
+
+    def parse(self, raw: dict) -> HookInput | None:
+        """None = not something to ask the phone about (let the agent decide)."""
+        raise NotImplementedError
+
+    def allow(self) -> dict:
+        raise NotImplementedError
+
+    def deny(self, message: str) -> dict:
+        raise NotImplementedError
+
+
+class Claude(Agent):
+    """Claude Code `PermissionRequest` hook (the plugin's hooks.json)."""
+    name, title = "claude", "Claude Code"
+
+    def parse(self, raw):
+        tool_input = raw.get("tool_input") or {}
+        if not isinstance(tool_input, dict):
+            tool_input = {"input": tool_input}
+        return HookInput(str(raw.get("tool_name", "?")), tool_input, raw.get("cwd"), raw.get("session_id"))
+
+    def allow(self):
+        return {"hookSpecificOutput": {"hookEventName": "PermissionRequest", "decision": {"behavior": "allow"}}}
+
+    def deny(self, message):
+        return {"hookSpecificOutput": {"hookEventName": "PermissionRequest",
+                                       "decision": {"behavior": "deny", "message": message}}}
+
+
+class Gemini(Agent):
+    """Gemini CLI `BeforeTool` hook. It fires for every tool, so only risky ones go to the phone."""
+    name, title = "gemini", "Gemini CLI"
+
+    # Gemini tool → (our tool, how to map its arguments)
+    TOOLS = {
+        "run_shell_command": "Bash",
+        "write_file": "Write",
+        "replace": "Edit",
+    }
+
+    def parse(self, raw):
+        tool = str(raw.get("tool_name", ""))
+        ours = self.TOOLS.get(tool)
+        if ours is None:
+            return None  # reads, searches, web fetches: Gemini's own rules decide
+        args = raw.get("tool_input") or {}
+        if not isinstance(args, dict):
+            args = {"input": args}
+        if ours == "Bash":
+            tool_input = {"command": args.get("command", ""), "description": args.get("description")}
+            if args.get("dir_path") or args.get("directory"):
+                tool_input["description"] = (tool_input["description"] or "") + f" (in {args.get('dir_path') or args.get('directory')})"
+        elif ours == "Write":
+            tool_input = {"file_path": args.get("file_path") or args.get("path", ""), "content": args.get("content", "")}
+        else:
+            tool_input = {"file_path": args.get("file_path") or args.get("path", ""),
+                          "old_string": args.get("old_string", ""), "new_string": args.get("new_string", "")}
+        tool_input = {k: v for k, v in tool_input.items() if v is not None}
+        return HookInput(ours, tool_input, raw.get("cwd"), raw.get("session_id"))
+
+    def allow(self):
+        return {"decision": "allow"}
+
+    def deny(self, message):
+        return {"decision": "deny", "reason": message}
+
+
+class Copilot(Agent):
+    """GitHub Copilot CLI `permissionRequest` hook (runs only when Copilot would ask the user).
+
+    Its input schema isn't documented; this accepts the camelCase and snake_case shapes Copilot uses
+    for its other hooks. `hook.py` logs the input's field NAMES (never values) so a real sample can
+    confirm the mapping.
+    """
+    name, title = "copilot", "GitHub Copilot CLI"
+
+    SHELL = {"bash", "shell", "powershell", "run", "terminal", "run_in_terminal"}
+    WRITE = {"write", "create", "create_file", "write_file"}
+    EDIT = {"edit", "str_replace", "str_replace_editor", "replace", "edit_file"}
+
+    def parse(self, raw):
+        tool = str(raw.get("toolName") or raw.get("tool_name") or raw.get("kind") or raw.get("tool") or "?")
+        args = (raw.get("toolInput") or raw.get("toolArgs") or raw.get("tool_input") or raw.get("arguments")
+                or raw.get("args") or {})
+        if isinstance(args, str):
+            try:
+                args = json.loads(args)
+            except ValueError:
+                args = {"command": args}
+        if not isinstance(args, dict):
+            args = {"input": args}
+        low = tool.lower()
+        if low in self.SHELL or "command" in args and low not in self.WRITE | self.EDIT:
+            ours = "PowerShell" if low == "powershell" else "Bash"
+            tool_input = {"command": args.get("command") or args.get("fullCommandText") or "",
+                                        "description": args.get("description")}
+        elif low in self.WRITE:
+            ours, tool_input = "Write", {"file_path": args.get("path") or args.get("file_path", ""),
+                                         "content": args.get("content") or args.get("file_text", "")}
+        elif low in self.EDIT:
+            ours, tool_input = "Edit", {"file_path": args.get("path") or args.get("file_path", ""),
+                                        "old_string": args.get("old_str") or args.get("old_string", ""),
+                                        "new_string": args.get("new_str") or args.get("new_string", "")}
+        else:
+            ours, tool_input = tool, args
+        tool_input = {k: v for k, v in tool_input.items() if v is not None}
+        return HookInput(ours, tool_input, raw.get("cwd"), raw.get("sessionId") or raw.get("session_id"))
+
+    def allow(self):
+        return {"behavior": "allow"}
+
+    def deny(self, message):
+        return {"behavior": "deny", "message": message}
+
+
+class Codex(Claude):
+    """OpenAI Codex CLI `PermissionRequest` hook (~/.codex/hooks.json): Claude Code's wire format.
+
+    Its shell tool may pass the command as an argv list, and edits come as one apply_patch text.
+    """
+    name, title = "codex", "OpenAI Codex CLI"
+    # Its hooks.json keeps timeout 600: changing a trusted hook makes the user re-approve it in /hooks.
+    max_wait_s = 580
+
+    SHELL = {"shell", "bash", "exec_command", "local_shell", "container.exec", "unified_exec"}
+
+    def parse(self, raw):
+        hi = super().parse(raw)
+        low = hi.tool.lower()
+        args = hi.tool_input
+        if low in self.SHELL or isinstance(args.get("command"), list):
+            command = args.get("command") or args.get("cmd") or ""
+            if isinstance(command, list):
+                # ["bash", "-lc", "npm test"] → the script; anything else → joined argv
+                command = command[-1] if len(command) >= 3 and command[1] in ("-lc", "-c") else " ".join(map(str, command))
+            hi = HookInput("Bash", {"command": str(command), "description": args.get("justification")},
+                           hi.cwd, hi.session_id)
+        elif low in ("apply_patch", "applypatch"):
+            patch = str(args.get("input") or args.get("patch") or args.get("command") or json.dumps(args))
+            files, deletes = protocol.patch_files(patch, hi.cwd)
+            hi = HookInput("Edit", {"file_path": files[0] if files else protocol.PATCH_UNKNOWN, "old_string": "",
+                                    "new_string": patch, "patch_files": files, "patch_deletes": deletes},
+                           hi.cwd, hi.session_id)
+        hi.tool_input = {k: v for k, v in hi.tool_input.items() if v is not None}
+        return hi
+
+
+AGENTS: dict[str, Agent] = {a.name: a for a in (Claude(), Gemini(), Copilot(), Codex())}
+
+
+def get(name: str | None) -> Agent:
+    return AGENTS.get((name or "claude").lower(), AGENTS["claude"])