Conductor — Mobile Mirror for Claude Code

Saad relies on Claude Code locally in VSCode for most of his development work, but that ties him to his desk: there’s no way to know, once away from the screen, that a long-running task has finished or that a tool-use approval is pending. Claude Code exposes no official API to query that state remotely. The challenge was to build a reliable mirror of that working session on his phone, without exposing source code to a third-party server, without a fixed shared password, and while honestly scoping the limits of a tool built for a single user on a single machine.

Conductor was built as a TypeScript monorepo (pnpm workspaces, strict mode) around three components sharing a single @conductor/types package as the source of truth for the wire protocol:

• a NestJS 10 daemon, running as a Windows service, storing local state in better-sqlite3, watching session files with chokidar, and streaming updates over WebSocket;
• an installable Angular 18 PWA for the phone (standalone components, Signals, Angular Material, CodeMirror 6, xterm.js) receiving lockscreen push notifications via web-push/VAPID;
• a VSCode companion extension that watches Claude Code’s own JSONL transcript files and can remotely trigger opening a new conversation or accepting a proposed diff.

Once the MVP was complete, Saad ran his own four-pass code audit, uncovering 5 critical and 11 high-severity bugs — including the headline approval-notification feature being completely non-functional end-to-end (the service worker was never registered), every chat message rendering twice, and a silent, infinitely-reconnecting WebSocket loop. All 16 findings were fixed the very next day, in a dedicated remediation pass. That discipline of self-verification before trusting a build reflects a habit central to a Tech Lead’s mindset: never ship without first interrogating your own work.

The daemon binds only to localhost (loopback), with one port for the phone PWA (HTTP + WebSocket) and a second, secret-protected port reserved for the VSCode companion. Reachability from the phone off the local network runs through a Cloudflare Tunnel, needing no port-forwarding or public server — code and prompts never pass through a third-party server, only the tunnel relay does. Security rests on short-lived JWT access tokens paired with bcrypt-hashed rotating refresh tokens, timing-safe secret comparisons, and a 6-digit pairing code expiring after 10 minutes, rather than a fixed shared password.