@jdscript/opencode-notify 0.1.1 → 0.1.2

package/VERIFICATION.md

@@ -1,5 +1,20 @@
 # Verification — initial plugin / app integration
 
+## 0.1.2 scoped Live Activity encryption
+
+The `info` capability advertises `activityEncryption: "route-v1"`. An `attach`
+can provide a dedicated recipient public key/authentication secret for that
+activity; alerts retain the subscription key. Route encryption and its expiry
+cannot change under an existing route ID. Live jobs are capped by route expiry.
+
+Fourteen sender/crypto tests (85 assertions) pass, including cross-key rejection,
+immutable activity keys/expiry, persisted activity encryption across restart,
+and an explicit encrypted test update. The packed artifact passed the isolated
+upstream SDK → Rust relay → Swift receiver pipeline with six envelopes. The
+Swift activity path selects temporary route keys with a failing Keychain loader,
+proving that rendering does not depend on direct Keychain access. Legacy attach
+inputs without route encryption remain supported for older clients.
+
 ## 0.1.1 distribution check
 
 `@opencode/plugin` is a runtime dependency. The 0.1.0 CLI-install path resolved
@@ -11,6 +26,13 @@ loopback registry served the packed artifact and the real upstream SDK resolved
 its dependency graph in a fresh home. The complete Rust relay/Swift receiver
 pipeline accepted six encrypted envelopes. No model or Apple push was used.
 
+The published npm `@jdscript/opencode-notify@0.1.1` then passed both
+`python3 ../scripts/mock-plugin-install.py --package @jdscript/opencode-notify@0.1.1`
+and `python3 scripts/check-upstream.py --rust-relay --swift --package @jdscript/opencode-notify@0.1.1`.
+These freshly downloaded the release, verified CLI installation and automatic
+global RPC loading, and decrypted all six relay envelopes with the production
+Swift receiver. Published tarball SHA-1: `0b98f8d23f93277114a7a16ed8a2f599918ea746`.
+
 ## Passed
 
 - TypeScript typecheck and distributable build.

package/dist/index.js

@@ -33,7 +33,7 @@ function makePlugin() {
             })();
             const runtime = await shared.sender;
             const registration = await ctx.rpc.register(Definition, {
-                info: async () => ({ version: 1, encoding: "aes128gcm", applicationVersion: 1, activityScopes: ["session", "server", "workspace"] }),
+                info: async () => ({ version: 1, encoding: "aes128gcm", applicationVersion: 1, activityScopes: ["session", "server", "workspace"], activityEncryption: "route-v1" }),
                 subscribe: async (input, context) => runtime
                     .subscribe(input)
                     .catch((error) => context.error("invalid", "Notification setup failed", { code: code(error) })),
@@ -54,6 +54,8 @@ function makePlugin() {
                 detach: async (input, context) => runtime
                     .detach(input.subscriptionID, input.activityID)
                     .catch((error) => context.error("invalid", "Activity removal failed", { code: code(error) })),
+                test: async (input, context) => runtime.testActivity(input.subscriptionID, input.activityID)
+                    .catch((error) => context.error("invalid", "Activity test failed", { code: code(error) })),
             });
             const controller = new AbortController();
             const events = (async () => {

package/dist/rpc.d.ts

@@ -24,6 +24,10 @@ export declare const Route: z.ZodObject<{
     subscriptionID: z.ZodString;
     activityID: z.ZodString;
 }, z.core.$strict>;
+export declare const ActivityEncryption: z.ZodObject<{
+    recipientPublicKey: z.ZodString;
+    authSecret: z.ZodString;
+}, z.core.$strict>;
 export declare const Attach: z.ZodObject<{
     subscriptionID: z.ZodString;
     activityID: z.ZodString;
@@ -35,6 +39,10 @@ export declare const Attach: z.ZodObject<{
         workspace: "workspace";
     }>>;
     serverName: z.ZodOptional<z.ZodString>;
+    encryption: z.ZodOptional<z.ZodObject<{
+        recipientPublicKey: z.ZodString;
+        authSecret: z.ZodString;
+    }, z.core.$strict>>;
     seedComplete: z.ZodOptional<z.ZodBoolean>;
     seeds: z.ZodOptional<z.ZodArray<z.ZodObject<{
         sessionID: z.ZodString;
@@ -74,6 +82,7 @@ export declare const Definition: {
                     server: "server";
                     workspace: "workspace";
                 }>>>;
+                activityEncryption: z.ZodOptional<z.ZodLiteral<"route-v1">>;
             }, z.core.$strict>;
             readonly errors: {
                 invalid: z.ZodObject<{
@@ -161,6 +170,10 @@ export declare const Definition: {
                     workspace: "workspace";
                 }>>;
                 serverName: z.ZodOptional<z.ZodString>;
+                encryption: z.ZodOptional<z.ZodObject<{
+                    recipientPublicKey: z.ZodString;
+                    authSecret: z.ZodString;
+                }, z.core.$strict>>;
                 seedComplete: z.ZodOptional<z.ZodBoolean>;
                 seeds: z.ZodOptional<z.ZodArray<z.ZodObject<{
                     sessionID: z.ZodString;
@@ -195,5 +208,19 @@ export declare const Definition: {
                 }, z.core.$strict>;
             };
         };
+        readonly test: {
+            readonly input: z.ZodObject<{
+                subscriptionID: z.ZodString;
+                activityID: z.ZodString;
+            }, z.core.$strict>;
+            readonly output: z.ZodObject<{
+                ok: z.ZodLiteral<true>;
+            }, z.core.$strict>;
+            readonly errors: {
+                invalid: z.ZodObject<{
+                    code: z.ZodString;
+                }, z.core.$strict>;
+            };
+        };
     };
 };

package/dist/rpc.js

@@ -21,10 +21,12 @@ export const Subscribe = z
     .strict();
 export const Reference = z.object({ subscriptionID: UUID }).strict();
 export const Route = z.object({ subscriptionID: UUID, activityID: UUID }).strict();
+export const ActivityEncryption = z.object({ recipientPublicKey: z.string().length(87), authSecret: z.string().length(22) }).strict();
 export const Attach = Route.extend({
     sessionID: z.string().startsWith("ses").max(200), expiresAt: seconds,
     scope: z.enum(["session", "server", "workspace"]).optional(),
     serverName: z.string().max(160).optional(),
+    encryption: ActivityEncryption.optional(),
     seedComplete: z.boolean().optional(),
     seeds: z.array(z.object({ sessionID: z.string().startsWith("ses").max(200), running: z.boolean(), waiting: z.array(z.string().max(200)).max(64) }).strict()).max(512).optional(),
     shells: z.array(z.object({ id: z.string().max(200), sessionID: z.string().startsWith("ses").max(200).optional() }).strict()).max(512).optional(),
@@ -47,7 +49,7 @@ export const Definition = Rpc.define({
         info: {
             input: z.object({}).strict(),
             output: z
-                .object({ version: z.literal(1), encoding: z.literal("aes128gcm"), applicationVersion: z.literal(1), activityScopes: z.array(z.enum(["session", "server", "workspace"])).optional() })
+                .object({ version: z.literal(1), encoding: z.literal("aes128gcm"), applicationVersion: z.literal(1), activityScopes: z.array(z.enum(["session", "server", "workspace"])).optional(), activityEncryption: z.literal("route-v1").optional() })
                 .strict(),
             errors,
         },
@@ -56,5 +58,6 @@ export const Definition = Rpc.define({
         status: { input: Reference, output: Status, errors },
         attach: { input: Attach, output: ok, errors },
         detach: { input: Route, output: ok, errors },
+        test: { input: Route, output: ok, errors },
     },
 });

package/dist/sender.d.ts

@@ -51,6 +51,9 @@ export declare class Sender {
     detach(subscriptionID: string, activityID: string): Promise<{
         ok: true;
     }>;
+    testActivity(subscriptionID: string, activityID: string): Promise<{
+        ok: true;
+    }>;
     /** Semantic events only: no reasoning/text deltas, transcripts, tool arguments or outputs. */
     onEvent(event: Event): Promise<void>;
     private node;

package/dist/sender.js

@@ -1,7 +1,7 @@
 import { createECDH, createHash, randomUUID } from "node:crypto";
 import { basename } from "node:path";
 import { z } from "zod";
-import { Subscribe } from "./rpc.js";
+import { ActivityEncryption, Subscribe } from "./rpc.js";
 import { decode, encrypt } from "./crypto.js";
 const StoredSubscription = z.object({
     input: Subscribe,
@@ -20,6 +20,7 @@ const StoredActivity = z.object({
     lastSent: z.number(),
     scope: z.enum(["session", "server", "workspace"]).optional(),
     serverName: z.string().optional(),
+    encryption: ActivityEncryption.optional(),
 });
 const StoredJob = z.object({
     subscriptionID: z.string(),
@@ -163,6 +164,21 @@ export class Sender {
                 throw new SenderError("activity_binding_changed");
             if (old && (old.scope ?? "session") !== (input.scope ?? "session"))
                 throw new SenderError("activity_binding_changed");
+            if (old && (old.encryption?.recipientPublicKey !== input.encryption?.recipientPublicKey || old.encryption?.authSecret !== input.encryption?.authSecret))
+                throw new SenderError("activity_encryption_changed");
+            if (old?.encryption && old.expiresAt !== input.expiresAt)
+                throw new SenderError("activity_expiry_changed");
+            if (input.encryption) {
+                const probe = createECDH("prime256v1");
+                probe.generateKeys();
+                try {
+                    probe.computeSecret(decode(input.encryption.recipientPublicKey, 65));
+                    decode(input.encryption.authSecret, 16);
+                }
+                catch {
+                    throw new SenderError("invalid_activity_encryption");
+                }
+            }
             if (input.scope === "server" || input.scope === "workspace") {
                 if (input.sessionID !== "ses_workspace")
                     throw new SenderError("invalid_workspace_binding");
@@ -192,7 +208,7 @@ export class Sender {
             }
             const route = {
                 subscriptionID: input.subscriptionID, activityID: input.activityID, sessionID: input.sessionID,
-                expiresAt: input.expiresAt, scope: input.scope, serverName: input.serverName,
+                expiresAt: input.expiresAt, scope: input.scope, serverName: input.serverName, encryption: input.encryption,
                 ended: false,
                 unavailable: false,
                 lastTimestamp: old?.lastTimestamp ?? 0,
@@ -228,6 +244,28 @@ export class Sender {
             return { ok: true };
         });
     }
+    testActivity(subscriptionID, activityID) {
+        return this.serial(async () => {
+            const sub = this.requireSubscription(subscriptionID, true);
+            const route = this.activities.get(routeKey(subscriptionID, activityID));
+            if (!route || route.ended || route.unavailable || route.expiresAt <= now())
+                throw new SenderError("activity_unavailable");
+            if ((sub.billingUntil ?? 0) > now())
+                throw new SenderError("entitlement_required");
+            const timestamp = now();
+            if (timestamp <= route.lastTimestamp)
+                throw new SenderError("activity_update_pending");
+            const root = isOverview(route) ? undefined : await this.node(route.sessionID);
+            const content = root ? this.content(root) : this.workspaceContent(route);
+            content.detail = "Test update";
+            await this.queue("activity/" + routeKey(subscriptionID, activityID), sub, root ? { id: root.info.id, directory: root.info.location.directory } : { id: "ses_workspace", directory: "/" }, content, { activityID, event: "update", timestamp }, route.scope === "workspace" ? false : undefined, route);
+            route.lastTimestamp = timestamp;
+            route.lastSent = timestamp;
+            await this.save("activity/" + routeKey(subscriptionID, activityID), route);
+            this.schedule();
+            return { ok: true };
+        });
+    }
     /** Semantic events only: no reasoning/text deltas, transcripts, tool arguments or outputs. */
     onEvent(event) {
         return this.serial(async () => {
@@ -549,7 +587,7 @@ export class Sender {
             activityID: route.activityID,
             event,
             timestamp,
-        }, route.scope === "workspace" ? settled : undefined);
+        }, route.scope === "workspace" ? settled : undefined, route);
         route.lastTimestamp = timestamp;
         route.lastSent = timestamp;
         this.dirty.delete(routeKey(route.subscriptionID, route.activityID));
@@ -557,7 +595,7 @@ export class Sender {
             this.dirty.set(routeKey(route.subscriptionID, route.activityID), false);
         await this.save("activity/" + routeKey(route.subscriptionID, route.activityID), route);
     }
-    async queue(key, sub, binding, content, activity, settled) {
+    async queue(key, sub, binding, content, activity, settled, route) {
         if (this.jobs.size >= 512 && !this.jobs.has(key))
             throw new SenderError("outbox_full");
         const eventID = randomUUID();
@@ -570,7 +608,7 @@ export class Sender {
             kind: activity ? "live_activity" : "alert",
             producer: "server",
             issuedAt: now(),
-            expiresAt: Math.min(now() + 3600, sub.input.expiresAt),
+            expiresAt: Math.min(now() + 3600, sub.input.expiresAt, route?.expiresAt ?? Number.MAX_SAFE_INTEGER),
             sessionID: binding.id,
             directory: binding.directory,
             content,
@@ -579,7 +617,8 @@ export class Sender {
         const bytes = Buffer.from(JSON.stringify(payload));
         if (bytes.length > 2400 || Buffer.byteLength(payload.directory) > 1024)
             throw new SenderError("content_too_large");
-        const ciphertext = encrypt(bytes, sub.input.recipientPublicKey, sub.input.authSecret);
+        const recipient = route?.encryption ?? sub.input;
+        const ciphertext = encrypt(bytes, recipient.recipientPublicKey, recipient.authSecret);
         const job = {
             subscriptionID: sub.input.subscriptionID,
             expiresAt: payload.expiresAt,

package/dist/types.d.ts

@@ -56,6 +56,10 @@ export interface Activity {
     lastSent: number;
     scope?: "session" | "server" | "workspace";
     serverName?: string;
+    encryption?: {
+        recipientPublicKey: string;
+        authSecret: string;
+    };
 }
 export interface Push {
     event_id: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jdscript/opencode-notify",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "End-to-end encrypted mobile notifications and Live Activity updates for OpenCode v2",
   "type": "module",
   "main": "./dist/index.js",