Pocket Deck

Name: Pocket Deck
Author: @itzchill

@itzchillv2.1.0

Use your phone as a trackpad, media remote, and clipboard bridge.

Use your phone as a trackpad, media remote, and clipboard bridge for your PC.

Pocket Deck serves a small phone page from your PC. The phone opens it in a browser, enters an access token once, and then controls the desktop over your local network.

No phone app. No account. No cloud service.

What it does

Trackpad — left side: tap to click, press and hold to drag; right side: tap to right-click; drag to move the pointer and scroll.
Media row — play/pause, previous, next, mute, volume up/down.
Clipboard bridge
- type or paste text on the phone and send it to the PC clipboard
- pull the PC clipboard onto the phone
- type the text into the focused PC window
Marketplace shortcut — one button opens Rebind Marketplace on the PC.
Access token — required before the phone can send commands.
Local only — the phone page and control socket are on your LAN.

Requirements

Windows with PowerShell (built into Windows)
Rebind 3.9.0 or newer
Phone and PC on the same Wi-Fi or LAN
Rebind permissions: net and exec
Rebind may also ask for overlay-related permissions for the startup toast
Firewall permission for the page server

Setup

Install Pocket Deck and start it.
Open Rebind → Options → Pocket Deck.
Copy the Phone access token. A random token is generated if the field is blank.
On the PC, find the local IPv4 address:
```
ipconfig
```
Look for IPv4 Address on the Wi-Fi/Ethernet adapter.
On the phone, open:
```
http://<PC-IP>:19880
```
Example: http://192.168.1.24:19880 The PC address is filled from the page address automatically.
Tap the status pill at the top, enter the token, and connect. The phone stores it, so the connection panel does not reopen while you use the trackpad. If you prefer a one-time pairing link, append the token to the URL fragment:
```
http://<PC-IP>:19880/#token=<token>
```
The fragment stays on the phone and is removed after the page stores it.
Allow the page through Windows Firewall if prompted.

The WebSocket uses port 19881 by default. Use the status pill or settings gear whenever you need to change the address or token.

Marketplace shortcut

Tap BROWSE REBIND MARKETPLACE on the phone to open Rebind Marketplace on the PC (rebind://marketplace). Rebind deliberately does not let the link install anything on its own; the marketplace opens and you choose what to install.

Pocket Deck remains a standalone trackpad, media, and clipboard remote.

Security

This is a local-network tool, not an internet service.

The page is served over plain HTTP. Do not expose ports 19880 or 19881 to the internet.
The token protects the control socket, not the page itself.
The phone page has no exec, file, registry, or lua.exec commands.
exec is used only to start and stop the included PowerShell page server and to open the fixed rebind://marketplace deep link.
The server serves one file (phone/index.html) and nothing else.
On a shared or untrusted network, stop the script when you are not using it.
Anyone who can read the phone page can see the UI, but cannot send commands without the token.

How the pieces fit

Phone browser
  ├── HTTP :19880  →  included PowerShell static page server
  └── WS   :19881  →  Rebind Pocket Deck script
                         ├── HID
                         ├── clipboard
                         ├── system.type_text
                         └── Rebind shortcuts

The HTTP server is a small included PowerShell script. It is not a general web server and does not serve arbitrary files.

Limits

Windows only; the page server uses PowerShell.
The phone must be on the same network as the PC.
HTTP and WebSocket traffic are not encrypted.
No phone notifications (rb.phone is still a stub).
No screen mirroring or camera/mic access.
No public-internet remote access.
The page is a control surface; it does not run Rebind scripts on the phone.
The phone page is not a native app and has no offline mode.

Troubleshooting

The phone cannot open the page

Check that the phone and PC are on the same Wi-Fi.
Allow PowerShell through the Windows firewall.
Confirm the PC IP with ipconfig.
Stop any other program using ports 19880 or 19881.

The page opens but commands do nothing

Open the phone settings and check the token.
Make sure the Pocket Deck script is running.
Confirm the WebSocket port is 19881.

The page disconnects

The page reconnects automatically. If it stays offline, restart Pocket Deck and check the firewall.

Privacy

Pocket Deck does not capture the screen, read the clipboard unless you press the clipboard buttons, or send data to a cloud service. All traffic stays on your local network.

Pocket Deck v1.0.0 — your phone, at your desk.

Version 2.1.0 (current)

main.luau

--[[
  rebind: min_sdk=3.9.0
  rebind: permissions=net,exec
  rebind: tick_rate=10
  rebind: memory_limit_mb=24
]]

local HTTP_PORT = 19880
local WS_PORT = 19881
local MARKETPLACE_LINK = "rebind://marketplace"
local PHONE_DIR = "phone"
local SERVER_SCRIPT = "phone/server.ps1"
local PID_FILE = "http.pid"

local cfg = rb.ui.schema({
  auth_token = rb.ui.text("", {
    label = "Phone access token",
    placeholder = "generated automatically if blank",
    tooltip = "the phone must enter this before it can control this PC",
    group = "Security",
  }),
  show_start_toast = rb.ui.toggle(true, {
    label = "Show startup notice",
    group = "Behavior",
  }),
})

local state = {
  ws = nil,
  http_pid = nil,
  authed = {},
  mouse_held = {},
}

local function trim(value)
  return (tostring(value or ""):gsub("^%s+", ""):gsub("%s+$", ""))
end

local function token()
  return trim(cfg.auth_token)
end

local function token_ok(given)
  local expected = token()
  if expected == "" then
    return true
  end
  return rb.hash.sha256(tostring(given or "")) == rb.hash.sha256(expected)
end

local function make_token()
  local seed = tostring(rb.system.time()) .. tostring(math.random()) .. tostring({})
  return rb.hash.sha256(seed):sub(1, 16):lower()
end

local function notify(message)
  pcall(rb.overlay.toast, message, {
    title = "Pocket Deck",
    duration = 3200,
  })
end

local function send(client, payload)
  local ok, text = pcall(rb.json.stringify, payload)
  if not ok then
    return
  end
  pcall(function()
    client:send(text)
  end)
end

local function reply(client, request, payload)
  if request.id ~= nil then
    payload.id = request.id
  end
  send(client, payload)
end

local function fail(client, request, code, message)
  reply(client, request, {
    error = {
      code = code,
      message = message,
    },
  })
end

local function media_key(action)
  local keys = {
    -- The phone sends Rebind key names. Keep short aliases for any older
    -- cached page that used the original action names.
    MediaPlay = "MediaPlay",
    MediaNext = "MediaNext",
    MediaPrev = "MediaPrev",
    VolumeMute = "VolumeMute",
    VolumeUp = "VolumeUp",
    VolumeDown = "VolumeDown",
    play = "MediaPlay",
    next = "MediaNext",
    prev = "MediaPrev",
    mute = "VolumeMute",
    up = "VolumeUp",
    down = "VolumeDown",
  }
  return keys[tostring(action or "")]
end

local function handle(client, request)
  local kind = tostring(request.t or "")

  if kind == "auth" then
    if token_ok(request.token) then
      state.authed[client.id] = true
      reply(client, request, { ok = true })
    else
      fail(client, request, "bad_token", "wrong access token")
    end
    return
  end

  if not state.authed[client.id] then
    fail(client, request, "unauthenticated", "send auth first")
    return
  end

  if kind == "ping" then
    reply(client, request, { ok = true })
    return
  end

  if kind == "marketplace" then
    local ok, err = pcall(rb.system.exec_detached, "cmd.exe", {
      args = { "/c", "start", "", MARKETPLACE_LINK },
    })
    if not ok then
      rb.log.warn("Pocket Deck marketplace link: " .. tostring(err))
      fail(client, request, "marketplace_failed", "could not open Rebind Marketplace")
      return
    end
    reply(client, request, { ok = true })
    return
  end

  if kind == "move" then
    local dx = math.max(-2000, math.min(2000, math.floor(tonumber(request.dx) or 0)))
    local dy = math.max(-2000, math.min(2000, math.floor(tonumber(request.dy) or 0)))
    if dx ~= 0 or dy ~= 0 then
      pcall(rb.hid.move, dx, dy)
    end
    reply(client, request, { ok = true })
    return
  end

  if kind == "click" then
    local buttons = { left = "Mouse1", right = "Mouse2", middle = "Mouse3" }
    local key = buttons[tostring(request.button or "left")]
    if not key then
      fail(client, request, "bad_button", "button must be left, right, or middle")
      return
    end
    pcall(rb.hid.combo, key)
    reply(client, request, { ok = true })
    return
  end

  if kind == "mouse" then
    local buttons = { left = "Mouse1", right = "Mouse2", middle = "Mouse3" }
    local key = buttons[tostring(request.button or "left")]
    local action = tostring(request.action or "")
    if not key then
      fail(client, request, "bad_button", "button must be left, right, or middle")
      return
    end
    if action == "down" then
      if pcall(rb.hid.down, key) then
        state.mouse_held[client.id] = key
      end
    elseif action == "up" then
      pcall(rb.hid.up, key)
      if state.mouse_held[client.id] == key then
        state.mouse_held[client.id] = nil
      end
    elseif action == "click" then
      pcall(rb.hid.combo, key)
    else
      fail(client, request, "bad_mouse_action", "mouse action must be down, up, or click")
      return
    end
    reply(client, request, { ok = true })
    return
  end

  if kind == "scroll" then
    local delta = math.max(-10, math.min(10, math.floor(tonumber(request.delta) or 0)))
    if delta ~= 0 then
      pcall(rb.hid.scroll, delta)
    end
    reply(client, request, { ok = true })
    return
  end

  if kind == "media" then
    local key = media_key(request.action)
    if not key then
      fail(client, request, "bad_media", "unknown media action")
      return
    end
    pcall(rb.hid.combo, key)
    reply(client, request, { ok = true })
    return
  end

  if kind == "key" then
    local code = trim(request.code)
    if code == "" or #code > 80 then
      fail(client, request, "bad_key", "missing key code")
      return
    end
    pcall(rb.hid.combo, code)
    reply(client, request, { ok = true })
    return
  end

  if kind == "type" then
    local value = tostring(request.text or "")
    if #value > 8000 then
      fail(client, request, "too_long", "text is too long")
      return
    end
    pcall(rb.system.type_text, value)
    reply(client, request, { ok = true })
    return
  end

  if kind == "clipboard.set" then
    local value = tostring(request.text or "")
    if #value > 8000 then
      fail(client, request, "too_long", "text is too long")
      return
    end
    pcall(rb.clipboard.set, value)
    reply(client, request, { ok = true })
    return
  end

  if kind == "clipboard.get" then
    local value = ""
    local ok, text = pcall(rb.clipboard.get)
    if ok and type(text) == "string" then
      value = text
    end
    reply(client, request, { text = value })
    return
  end

  fail(client, request, "unknown_command", "unknown command '" .. kind .. "'")
end

local function kill_powershell(pid)
  pid = tonumber(pid)
  if not pid then
    return
  end
  local ok, processes = pcall(rb.process.list)
  if ok and type(processes) == "table" then
    for _, process in ipairs(processes) do
      if process.pid == pid
        and tostring(process.name or ""):lower():find("powershell", 1, true) then
        pcall(rb.process.kill, pid)
        return
      end
    end
  end
end

local function stop_http()
  if state.http_pid then
    kill_powershell(state.http_pid)
    state.http_pid = nil
  end
  pcall(rb.file.delete, PID_FILE)
end

local function start_http()
  local dir = rb.file.script_dir()
  -- Rebind reports extended-length paths on Windows; PowerShell's -File needs
  -- the ordinary drive-letter form.
  if dir:sub(1, 4) == "\\\\?\\" then
    dir = dir:sub(5)
  end
  local script_path = dir .. "/" .. SERVER_SCRIPT
  local phone_path = dir .. "/" .. PHONE_DIR
  rb.log.info("Pocket Deck page server: " .. script_path .. " root=" .. phone_path)

  if rb.file.exists(PID_FILE) then
    local old = tonumber(rb.file.read(PID_FILE) or "")
    kill_powershell(old)
    pcall(rb.file.delete, PID_FILE)
  end

  local ok, pid = pcall(rb.system.exec_detached, "powershell.exe", {
    args = {
      "-NoProfile",
      "-WindowStyle",
      "Hidden",
      "-ExecutionPolicy",
      "Bypass",
      "-File",
      script_path,
      "-Port",
      tostring(HTTP_PORT),
      "-Root",
      phone_path,
    },
  })
  if not ok then
    rb.log.warn("Pocket Deck: page server failed: " .. tostring(pid))
    notify("Could not start the phone page server.")
    return
  end
  state.http_pid = pid
  rb.log.info("Pocket Deck page server pid: " .. tostring(pid))
  pcall(rb.file.write, PID_FILE, tostring(pid))
end

local function start_ws()
  local ok, server = pcall(rb.net.ws_listen, WS_PORT, {
    on_connect = function(client)
      state.authed[client.id] = false
    end,
    on_message = function(client, payload)
      local parsed, request = pcall(rb.json.parse, payload)
      if not parsed or type(request) ~= "table" then
        return
      end
      local handled = pcall(handle, client, request)
      if not handled then
        fail(client, request, "handler_error", "command failed")
      end
    end,
    on_close = function(client)
      state.authed[client.id] = nil
      local held = state.mouse_held[client.id]
      if held then
        pcall(rb.hid.up, held)
        state.mouse_held[client.id] = nil
      end
    end,
  }, { host = "0.0.0.0" })

  if not ok then
    rb.log.warn("Pocket Deck: websocket failed: " .. tostring(server))
    notify("Could not start the phone control socket.")
    return
  end
  state.ws = server
end

function OnStart()
  if token() == "" then
    cfg.auth_token = make_token()
    rb.log.info("Pocket Deck: generated a phone access token in Options")
  end

  start_http()
  start_ws()

  if cfg.show_start_toast ~= false then
    notify("Open http://<this PC>:" .. HTTP_PORT .. " on your phone")
  end
end

function OnStop()
  for _, held in pairs(state.mouse_held) do
    pcall(rb.hid.up, held)
  end
  state.mouse_held = {}

  if state.ws then
    pcall(function()
      state.ws:stop()
    end)
    state.ws = nil
  end
  stop_http()
end

1 file without text previews

Link

BYOH

Pocket Deck

What it does

Requirements

Setup

Marketplace shortcut

Security

How the pieces fit

Limits

Troubleshooting

The phone cannot open the page

The page opens but commands do nothing

The page disconnects

Privacy

Pocket Deck

Readme

What it does

Requirements

Setup

Marketplace shortcut

Security

How the pieces fit

Limits

Troubleshooting

The phone cannot open the page

The page opens but commands do nothing

The page disconnects

Privacy

Files

Reviews