Repository navigation
Release 0.2.0 - #2
Merged
Merged
Conversation
`pair <code>` redeems the code the app shows for a token bound to that one phone, sending only the code and a name (never the hostname). Events then go to the relay as they are, with the token only in a header; a failed push is retried once with the same ID, which the relay dedupes. Pairing keeps the ntfy settings, and one transport sends at a time, never both. `status --last` reads back what the phone did with the last alert. The relay isn't public yet, so `pair` needs --relay or CODE_ALARM_RELAY.
The relay is deployed at https://relay.codealarm.workers.dev, so pair no longer needs --relay. The tests point every run at their fake relay through CODE_ALARM_RELAY, so none reaches the real one.
docs/protocol-examples.json holds valid and invalid version 1 events. The CLI's new test checks that every event it can build follows the same rules, and the Code Alarm relay's tests check that it accepts the valid ones and refuses the invalid ones with the stated status. protocol.md now states those rules exactly.
Codex's hooks run the copy `install codex` made. An old copy can't read settings a newer version wrote (16 Oct: a 14 Oct copy refused `transport: "app"`), and since hooks always exit 0, every Codex alert would have been dropped silently. `status` now reports a copy that is missing, older or a different build. `init`, `pair`, `unpair` and `use` replace it after saving settings, unless the copy is newer. Only the copy changes, so the hook commands stay byte-identical and Codex doesn't ask to trust them again. The bundle's banner carries the version so an older copy can be named.
code-alarm pair with no code makes a sender token here, sends the relay only its SHA-256 and the computer's name, shows the returned code as a QR, and polls with the token until the phone approves. The typed-code flow stays. The QR is drawn with Project Nayuki's MIT QR Code generator, vendored unchanged; the bundle keeps its notice as a legal comment.
Pairing with the Code Alarm app, by QR or by code, and alerts through its relay; the protocol examples both sides test against; Codex's copy of the CLI kept current.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this changes
Release 0.2.0: pairing with the Code Alarm app, by QR or by code, and alerts through its relay. Also the protocol examples both the CLI and the relay test against, and Codex's copy of the CLI kept current. Details are in the changelog's 0.2.0 section.
Checks
cd cli && npm run checkpasses (98 tests), and the rebuilt bundle, plugin binary and skill are committedcli/test/privacy.test.tspasses, and the event protocol is unchanged (version 1). The new pairing request sends only a name and a token's SHA-256[0.2.0] — 2026-10-16Versions:
cli/package.jsonandplugins/claude-code/.claude-plugin/plugin.jsonare 0.2.0. After merging: tagv0.2.0on main, thennpm publishfromcli/(the owner approves with 2FA).Third-party code: the bundle includes Project Nayuki's QR Code generator (MIT), vendored unchanged in
cli/src/vendor/qrcodegen.ts, with its notice kept at the end of the bundle.