Observe and drive GitHub Copilot from your phone — with zero code-sync to GitHub.
CloakCode is a local-to-remote bridge that lets you observe and drive GitHub Copilot in your local VS Code from a phone (a React PWA) or another machine. Your code never syncs to GitHub or any third party — only prompts and minimal, redacted context ever cross the bridge, over a secure tunnel to your own devices.
You keep VS Code's own Copilot chat — the interactive session you prefer, where you select code, point at specific things, and attach files or screenshots — which has no remote of its own. CloakCode adds one, and you switch fluidly between the desktop and your phone. When a long agent run stalls on a blocker — a confirmation, a multiple-choice question, or a tool-call approval — you get pinged and answer it remotely so the run keeps moving, instead of walking back hours later to find it waiting on a one-word answer. It's the tool for the cases the web and CLI don't cover: your repo isn't on GitHub, you want to bring your own models, or you just prefer the VS Code Copilot UI.
Status — M0 (dev experience + design). The read/observe half (list sessions, live mirror, blocker detection) is proven, and the answer/steer/stop actuator is wired end-to-end. The remaining pre-release work is the security core (redaction/egress gate + bridge auth, M4). See docs/05 — Roadmap.
- Models: the stable
vscode.lmAPI gives consented access to Copilot models. - Observation: Copilot writes a live, structured transcript to disk per session — CloakCode tails it (works even for stock Copilot sessions).
- Blocker detection: an awaiting-input prompt shows up as an unmatched interactive tool call carrying the full question + options — enough to render richly on a phone.
The full empirical account (experiments and wrong turns included) is in docs/02 — Research findings.
- Extension (the desktop side): install CloakCode from the
VS Code Marketplace, or run
code --install-extension rexwel.cloakcode. Each window serves its own phone PWA + bridge on loopback; run CloakCode: Set Up Phone Tunnel to get a phone-reachable URL. - Gateway (optional hub for many windows / machines):
@cloakcode/gatewayvianpx @cloakcode/gateway, or the Docker image. Point each window at it with"cloakcode.gatewayUrl": "ws://<host>:3543".
Open in the dev container (VS Code: Dev Containers: Reopen in Container). It mounts the repo at
/workspaces/cloakcode, sets up a persisted cache volume, and installs Node + pnpm + tooling. Then:
pnpm install
pnpm build
pnpm -r test # Vitest
pnpm -r test:coverage # coverage gate (85% statements/lines/functions, 75% branches)Common build/package/run flows are wrapped in a Taskfile.yml — the dev container
installs task, so run task (or task --list) to see them all:
| Task | What |
|---|---|
task build · task check |
build all · full gate (typecheck + lint + test) |
task package |
package everything — extension .vsix + assembled gateway |
task extension:install / extension:uninstall |
install / remove the packaged extension (+ its Copilot hook) |
task gateway:dev · task gateway:run -- --tunnel |
run the gateway (dev) · run the assembled hub with a tunnel |
task playground · task web:dev |
UI playground · PWA dev server |
task docker:gateway |
build the gateway image — run from your WSL/host (Docker isn't in the container) |
Try the research tools against your local Copilot sessions:
python3 research/list_sessions.py
python3 research/inspect_session.py <session-id-prefix>.devcontainer/ Dev container: fixed /workspaces/cloakcode mount + persisted cache volume
docs/ Design & the full research record (read docs/README.md first)
research/ Validated Python PoCs (session lister + blocker detector)
packages/
protocol/ SessionPart union + RPC schema (zod) — the contract
agent/ (planned) pausable tool-calling + confirmation loop — stub until the actuator (M4)
extension/ VS Code host: vscode.lm + transcript observer + localhost bridge
web/ Phone-first React/Vite PWA client
gateway/ Standalone hub: serves the PWA + a WebSocket hub for many windows
- Only
@cloakcode/extensionimportsvscode;protocolandagentstay pure and unit-testable. - Shared types come from
@cloakcode/protocol— never duplicated across packages.
CloakCode binds 127.0.0.1 by default and reaches your phone through a private tunnel — so
nothing sits on your LAN. Running the gateway wider (LAN / container / WSL) is trusted-network-only
until the security core lands, so prefer forward, don't widen.
- Deployment options (embedded vs gateway, per-client addressing, dev-container / WSL forwarding, host-firewall rules): docs/07 — Deployment.
- Security model (zero code-sync, bounded egress, provenance tagging, threat model): docs/04 — Security & compliance.
- Vision & requirements
- Research findings — the empirical record (+
02.xtopic files) - Architecture
- Security & compliance
- Roadmap & open questions
- Field notes — build/tooling gotchas & verified practices
- Deployment
Work milestone by milestone and slice by slice, following the dependency direction
protocol → agent/extension → web. Write the failing test first (TDD), keep the pure packages highly
covered, and run the narrowest relevant check before continuing (pnpm --filter @cloakcode/... test,
poetry run pytest research). See .github/copilot-instructions.md
for the full engineering discipline and the non-negotiable security rules.