@pi-unipi/unipi 3.0.0-alpha.34 → 3.0.0-alpha.35

package/CHANGELOG.md

@@ -6,6 +6,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [3.0.0-alpha.35] — 2026-10-08
+
+### Added
+- `notify`: **end-to-end encrypted phone push.** With the per-pairing key the UniPi host creates (`~/.unipi/app-host/notify-key`), app pushes are sealed with AES-256-GCM (`unipi1:` envelope): the ntfy server — now self-hosted — only sees a neutral "UniPi" title and ciphertext; the deep link carries no content. Without a key nothing changes. Pushes also go to the phone's registered UnifiedPush endpoints. (UNI-161)
+
 ## [3.0.0-alpha.34] — 2026-10-08
 
 Everything the UniPi phone app (unipi-app 0.3.0) needs from pi.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-unipi/unipi",
-  "version": "3.0.0-alpha.34",
+  "version": "3.0.0-alpha.35",
   "description": "All-in-one extension suite for Pi coding agent",
   "type": "module",
   "license": "MIT",
@@ -83,27 +83,27 @@
     "typebox": "^1.1.38"
   },
   "dependencies": {
-    "@pi-unipi/app-bridge": "3.0.0-alpha.34",
-    "@pi-unipi/ask-user": "3.0.0-alpha.34",
-    "@pi-unipi/background-tasks": "3.0.0-alpha.34",
-    "@pi-unipi/btw": "3.0.0-alpha.34",
-    "@pi-unipi/command-enchantment": "3.0.0-alpha.34",
-    "@pi-unipi/compactor": "3.0.0-alpha.34",
-    "@pi-unipi/core": "3.0.0-alpha.34",
-    "@pi-unipi/footer": "3.0.0-alpha.34",
-    "@pi-unipi/fusion": "3.0.0-alpha.34",
-    "@pi-unipi/info-screen": "3.0.0-alpha.34",
-    "@pi-unipi/input-shortcuts": "3.0.0-alpha.34",
-    "@pi-unipi/kanboard": "3.0.0-alpha.34",
-    "@pi-unipi/mcp": "3.0.0-alpha.34",
-    "@pi-unipi/memory": "3.0.0-alpha.34",
-    "@pi-unipi/notify": "3.0.0-alpha.34",
-    "@pi-unipi/skill-registry": "3.0.0-alpha.34",
-    "@pi-unipi/subagents": "3.0.0-alpha.34",
-    "@pi-unipi/updater": "3.0.0-alpha.34",
-    "@pi-unipi/utility": "3.0.0-alpha.34",
-    "@pi-unipi/web-api": "3.0.0-alpha.34",
-    "@pi-unipi/workflow": "3.0.0-alpha.34"
+    "@pi-unipi/app-bridge": "3.0.0-alpha.35",
+    "@pi-unipi/ask-user": "3.0.0-alpha.35",
+    "@pi-unipi/background-tasks": "3.0.0-alpha.35",
+    "@pi-unipi/btw": "3.0.0-alpha.35",
+    "@pi-unipi/command-enchantment": "3.0.0-alpha.35",
+    "@pi-unipi/compactor": "3.0.0-alpha.35",
+    "@pi-unipi/core": "3.0.0-alpha.35",
+    "@pi-unipi/footer": "3.0.0-alpha.35",
+    "@pi-unipi/fusion": "3.0.0-alpha.35",
+    "@pi-unipi/info-screen": "3.0.0-alpha.35",
+    "@pi-unipi/input-shortcuts": "3.0.0-alpha.35",
+    "@pi-unipi/kanboard": "3.0.0-alpha.35",
+    "@pi-unipi/mcp": "3.0.0-alpha.35",
+    "@pi-unipi/memory": "3.0.0-alpha.35",
+    "@pi-unipi/notify": "3.0.0-alpha.35",
+    "@pi-unipi/skill-registry": "3.0.0-alpha.35",
+    "@pi-unipi/subagents": "3.0.0-alpha.35",
+    "@pi-unipi/updater": "3.0.0-alpha.35",
+    "@pi-unipi/utility": "3.0.0-alpha.35",
+    "@pi-unipi/web-api": "3.0.0-alpha.35",
+    "@pi-unipi/workflow": "3.0.0-alpha.35"
   },
   "devDependencies": {
     "@earendil-works/pi-agent-core": "^0.87.1",

package/packages/app-bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-unipi/app-bridge",
-  "version": "3.0.0-alpha.34",
+  "version": "3.0.0-alpha.35",
   "description": "Live bridge between a pi TUI session and the UniPi phone app — streaming chat, prompts, steering and dialogs from the phone",
   "type": "module",
   "main": "index.ts",
@@ -31,7 +31,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@pi-unipi/core": "3.0.0-alpha.34"
+    "@pi-unipi/core": "3.0.0-alpha.35"
   },
   "peerDependencies": {
     "@earendil-works/pi-coding-agent": "^0.87.1",

package/packages/ask-user/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-unipi/ask-user",
-  "version": "3.0.0-alpha.34",
+  "version": "3.0.0-alpha.35",
   "description": "Structured user input tool for Pi coding agent — single-select, multi-select, freeform",
   "type": "module",
   "main": "index.ts",
@@ -40,7 +40,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@pi-unipi/core": "3.0.0-alpha.34"
+    "@pi-unipi/core": "3.0.0-alpha.35"
   },
   "peerDependencies": {
     "@earendil-works/pi-coding-agent": "^0.87.1",

package/packages/autocomplete/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-unipi/command-enchantment",
-  "version": "3.0.0-alpha.34",
+  "version": "3.0.0-alpha.35",
   "description": "Enhanced TUI autocomplete for /unipi:* commands — colored, sorted, and grouped by package",
   "type": "module",
   "main": "src/index.ts",

package/packages/background-tasks/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-unipi/background-tasks",
-  "version": "3.0.0-alpha.34",
+  "version": "3.0.0-alpha.35",
   "description": "Background tasks for UniPi — durable shell jobs and delegated background agents with a footer dock",
   "type": "module",
   "main": "src/index.ts",
@@ -10,7 +10,7 @@
   },
   "dependencies": {
     "@earendil-works/pi-ai": "^0.87.1",
-    "@pi-unipi/core": "3.0.0-alpha.34",
+    "@pi-unipi/core": "3.0.0-alpha.35",
     "turndown": "^7.2.4"
   },
   "devDependencies": {

package/packages/btw/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-unipi/btw",
-  "version": "3.0.0-alpha.34",
+  "version": "3.0.0-alpha.35",
   "description": "A pi extension for parallel side conversations with /unipi:btw — part of the Unipi suite",
   "type": "module",
   "main": "extensions/btw.ts",
@@ -37,7 +37,7 @@
     "@earendil-works/pi-tui": "^0.87.1"
   },
   "dependencies": {
-    "@pi-unipi/core": "3.0.0-alpha.34"
+    "@pi-unipi/core": "3.0.0-alpha.35"
   },
   "pi": {
     "extensions": [

package/packages/compactor/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-unipi/compactor",
-  "version": "3.0.0-alpha.34",
+  "version": "3.0.0-alpha.35",
   "description": "Compaction for Pi — lossless zero-LLM or model summaries, rebuilt from full history, with session recall",
   "type": "module",
   "main": "src/index.ts",
@@ -33,8 +33,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@pi-unipi/core": "3.0.0-alpha.34",
-    "@pi-unipi/info-screen": "3.0.0-alpha.34",
+    "@pi-unipi/core": "3.0.0-alpha.35",
+    "@pi-unipi/info-screen": "3.0.0-alpha.35",
     "@earendil-works/pi-agent-core": "^0.87.1"
   },
   "peerDependencies": {

package/packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-unipi/core",
-  "version": "3.0.0-alpha.34",
+  "version": "3.0.0-alpha.35",
   "description": "Shared utilities, event types, and constants for Unipi extension suite",
   "type": "module",
   "license": "MIT",

package/packages/footer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-unipi/footer",
-  "version": "3.0.0-alpha.34",
+  "version": "3.0.0-alpha.35",
   "description": "Persistent status bar for Unipi — subscribes to UNIPI_EVENTS and renders key stats from all unipi packages",
   "type": "module",
   "main": "index.ts",
@@ -32,8 +32,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@pi-unipi/core": "3.0.0-alpha.34",
-    "@pi-unipi/background-tasks": "3.0.0-alpha.34"
+    "@pi-unipi/core": "3.0.0-alpha.35",
+    "@pi-unipi/background-tasks": "3.0.0-alpha.35"
   },
   "peerDependencies": {
     "@earendil-works/pi-coding-agent": "^0.87.1",

package/packages/fusion/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-unipi/fusion",
-  "version": "3.0.0-alpha.34",
+  "version": "3.0.0-alpha.35",
   "description": "Devin-style model picker, fusion presets (lead + sidekick), and Local Fusion runtime for UniPi",
   "type": "module",
   "main": "src/index.ts",
@@ -32,9 +32,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@pi-unipi/core": "3.0.0-alpha.34",
-    "@pi-unipi/subagents": "3.0.0-alpha.34",
-    "@pi-unipi/utility": "3.0.0-alpha.34"
+    "@pi-unipi/core": "3.0.0-alpha.35",
+    "@pi-unipi/subagents": "3.0.0-alpha.35",
+    "@pi-unipi/utility": "3.0.0-alpha.35"
   },
   "peerDependencies": {
     "@earendil-works/pi-ai": "^0.87.1",

package/packages/info-screen/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-unipi/info-screen",
-  "version": "3.0.0-alpha.34",
+  "version": "3.0.0-alpha.35",
   "description": "Unicrab startup splash and the /unipi:info dashboard — this session, context, usage, compaction savings",
   "type": "module",
   "main": "index.ts",
@@ -33,7 +33,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@pi-unipi/core": "3.0.0-alpha.34"
+    "@pi-unipi/core": "3.0.0-alpha.35"
   },
   "peerDependencies": {
     "@earendil-works/pi-coding-agent": "^0.87.1",

package/packages/input-shortcuts/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-unipi/input-shortcuts",
-  "version": "3.0.0-alpha.34",
+  "version": "3.0.0-alpha.35",
   "description": "Keyboard shortcuts for stash/restore, undo/redo, clipboard, and thinking toggle — chord-based overlay system",
   "type": "module",
   "main": "src/index.ts",
@@ -33,7 +33,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@pi-unipi/core": "3.0.0-alpha.34"
+    "@pi-unipi/core": "3.0.0-alpha.35"
   },
   "peerDependencies": {
     "@earendil-works/pi-coding-agent": "^0.87.1",

package/packages/kanboard/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-unipi/kanboard",
-  "version": "3.0.0-alpha.34",
+  "version": "3.0.0-alpha.35",
   "description": "Kanboard v3 — deferred-work board: CLI/daemon bridge, task runner and skill",
   "type": "module",
   "main": "index.ts",
@@ -31,7 +31,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@pi-unipi/core": "3.0.0-alpha.34"
+    "@pi-unipi/core": "3.0.0-alpha.35"
   },
   "peerDependencies": {
     "@earendil-works/pi-coding-agent": "^0.87.1",
@@ -48,10 +48,10 @@
     "themes": []
   },
   "optionalDependencies": {
-    "@pi-unipi/kanboard-linux-x64": "3.0.0-alpha.34",
-    "@pi-unipi/kanboard-linux-arm64": "3.0.0-alpha.34",
-    "@pi-unipi/kanboard-darwin-x64": "3.0.0-alpha.34",
-    "@pi-unipi/kanboard-darwin-arm64": "3.0.0-alpha.34",
-    "@pi-unipi/kanboard-win32-x64": "3.0.0-alpha.34"
+    "@pi-unipi/kanboard-linux-x64": "3.0.0-alpha.35",
+    "@pi-unipi/kanboard-linux-arm64": "3.0.0-alpha.35",
+    "@pi-unipi/kanboard-darwin-x64": "3.0.0-alpha.35",
+    "@pi-unipi/kanboard-darwin-arm64": "3.0.0-alpha.35",
+    "@pi-unipi/kanboard-win32-x64": "3.0.0-alpha.35"
   }
 }

package/packages/long-horizon/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-unipi/long-horizon",
-  "version": "3.0.0-alpha.34",
+  "version": "3.0.0-alpha.35",
   "description": "Long-horizon execution for Pi — mode-gated /goal /ralph /swarm /graph orchestration with a TypeSafe prompt judge",
   "type": "module",
   "main": "index.ts",
@@ -37,7 +37,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@pi-unipi/core": "3.0.0-alpha.34"
+    "@pi-unipi/core": "3.0.0-alpha.35"
   },
   "peerDependencies": {
     "@earendil-works/pi-coding-agent": "^0.87.1",

package/packages/mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-unipi/mcp",
-  "version": "3.0.0-alpha.34",
+  "version": "3.0.0-alpha.35",
   "description": "MCP server management extension for Pi coding agent — browse, add, configure, and use MCP servers",
   "type": "module",
   "main": "src/index.ts",
@@ -30,7 +30,7 @@
     "test": "npx tsx --test tests/**/*.test.ts"
   },
   "dependencies": {
-    "@pi-unipi/core": "3.0.0-alpha.34"
+    "@pi-unipi/core": "3.0.0-alpha.35"
   },
   "peerDependencies": {
     "@earendil-works/pi-coding-agent": "^0.87.1",

package/packages/memory/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-unipi/memory",
-  "version": "3.0.0-alpha.34",
+  "version": "3.0.0-alpha.35",
   "description": "Persistent cross-session memory on MemPalace (auto-installed): daemon-routed writes, shared palace with other agents, for Pi coding agent",
   "type": "module",
   "main": "index.ts",
@@ -43,8 +43,8 @@
     "README.md"
   ],
   "dependencies": {
-    "@pi-unipi/core": "3.0.0-alpha.34",
-    "@pi-unipi/info-screen": "3.0.0-alpha.34",
+    "@pi-unipi/core": "3.0.0-alpha.35",
+    "@pi-unipi/info-screen": "3.0.0-alpha.35",
     "js-yaml": "^4.1.0"
   },
   "peerDependencies": {

package/packages/notify/README.md

@@ -90,6 +90,7 @@ Open `/unipi:settings` → **Notify**. The file is `~/.unipi/config/notify/confi
 | `gotify.serverUrl`, `gotify.appToken`, `gotify.priority` | priority `5` | Gotify server, token and priority (0–10). |
 | `telegram.botToken`, `telegram.chatId` | unset | Telegram bot and chat. |
 | `ntfy.serverUrl`, `ntfy.topic`, `ntfy.token`, `ntfy.priority` | `https://ntfy.sh`, priority `3` | ntfy server, topic, token and priority (1–5). |
+| `ntfy.appDetail` | `"minimal"` | `"minimal"` sends a generic "Tap to open in UniPi" body (just the deep link); `"full"` sends the real question text. Controls what goes *inside* the encrypted payload too (see below) — never changes whether encryption happens. |
 | `silenceAfterInput.enabled` | `false` | Stops notifications for a time after you press a key. |
 | `silenceAfterInput.windowMs` | `10000` | Length of that quiet time, in milliseconds. |
 | `silenceAfterInput.platforms` | `["native"]` | Platforms to keep quiet. |
@@ -118,6 +119,32 @@ Native notifications use [node-notifier](https://github.com/mikaelbr/node-notifi
 
 Each sent notification emits a `NOTIFICATION_SENT` event on the [event bus](../../docs/architecture/event-bus.md).
 
+## UniPi app push (end-to-end encrypted)
+
+When the UniPi phone app is paired with this machine, ntfy notifications
+also carry a deep link so a tap opens the right chat/dialog, and — once a
+key exists — the whole payload is encrypted so the ntfy server (even a
+public one) only ever sees ciphertext:
+
+- **Key**: `unipi-host` generates a random 256-bit key at
+  `$UNIPI_HOST_DIR/notify-key` (default `~/.unipi/app-host/notify-key`) the
+  first time the app asks for it (`notify_config`). This package reads the
+  same file (`notify-key.ts`) — if present, `platforms/ntfy.ts` encrypts
+  the ntfy `message` with AES-256-GCM and pins `title` to a fixed neutral
+  `"UniPi"`; `click` still carries the deep link (`host`/`pid`/`dialog`
+  query params only, never question text). No key yet → unchanged
+  plaintext/`appDetail` behaviour.
+- **Wire format**: `unipi1:` + base64(12-byte IV + AES-256-GCM ciphertext +
+  16-byte tag) of a small JSON object (`{title, body, kind, host, pid,
+  session, dialogId, options?}`). Full format and the host/app sides are
+  documented in `unipi-app`'s `docs/m6/PROTOCOL.md`.
+- **Fan-out**: the UniPi app can also register a
+  [UnifiedPush](https://unifiedpush.org) endpoint (`notify_register` on the
+  host) so notifications reach it even when it has no ntfy topic/token of
+  its own — `app-endpoints.ts` persists the list at `~/.unipi/config/
+  notify/app-endpoints.json`, and every send fans out to each registered
+  endpoint in addition to the configured topic.
+
 ## See also
 
 - [Ask User](../ask-user/README.md)

package/packages/notify/events.ts

@@ -14,6 +14,7 @@ import { sendGotifyNotification } from "./platforms/gotify.js";
 import { sendTelegramNotification } from "./platforms/telegram.js";
 import { sendNtfyNotification, publishToEndpoint } from "./platforms/ntfy.js";
 import { loadAppEndpoints } from "./app-endpoints.js";
+import { loadNotifyKey } from "./notify-key.js";
 import { hostname } from "node:os";
 import { buildAskUserPromptMessage } from "./ask-user-prompt-message.js";
 import { buildPermissionPromptMessage } from "./permission-prompt-message.js";
@@ -515,7 +516,7 @@ async function sendToPlatform(
       // paired host). appDetail controls whether the prompt text itself
       // rides along or just a generic "tap to open" message.
       const route = { host: hostnameForRoute(), kind: eventType };
-      const options = { route, appDetail: ntfyConfig.appDetail ?? "minimal" } as const;
+      const options = { route, appDetail: ntfyConfig.appDetail ?? "minimal", encryptKey: loadNotifyKey() };
       await sendNtfyNotification(ntfyConfig.serverUrl, ntfyConfig.topic, title, message, effective, ntfyConfig.token, options);
       // Fan out to every phone that registered a UnifiedPush endpoint
       // (notify_register) — best-effort, never blocks/fails the primary send.

package/packages/notify/notify-key.ts

@@ -0,0 +1,36 @@
+/**
+ * @pi-unipi/notify — the per-pairing E2E key (UNI-161 §1).
+ *
+ * The `unipi-host` daemon generates a random 32-byte key at first use and
+ * persists it at `$UNIPI_HOST_DIR/notify-key` (default
+ * `~/.unipi/app-host/notify-key`, mode 0600 — see
+ * `crates/host/src/notify.rs::notify_key_or_create`). The phone receives
+ * the same key (base64) over the `notify_config` request's response.
+ *
+ * This module reads that same file from the pi side, so the ntfy platform
+ * can encrypt notification payloads before they ever leave this machine —
+ * the ntfy server (self-hosted or not) only ever sees ciphertext.
+ */
+import { readFileSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+
+/** `$UNIPI_HOST_DIR/notify-key`, or `~/.unipi/app-host/notify-key` if unset. */
+export function notifyKeyPath(): string {
+  const dir = process.env.UNIPI_HOST_DIR;
+  if (dir && dir.trim() !== "") return join(dir, "notify-key");
+  return join(homedir(), ".unipi", "app-host", "notify-key");
+}
+
+/** Reads the 32-byte key if present; `undefined` if the host hasn't
+ *  generated one yet (first `notify_config` request on the phone creates
+ *  it) or the file is malformed. Never throws. */
+export function loadNotifyKey(): Buffer | undefined {
+  try {
+    const bytes = readFileSync(notifyKeyPath());
+    if (bytes.length !== 32) return undefined;
+    return bytes;
+  } catch {
+    return undefined;
+  }
+}

package/packages/notify/ntfy-crypto.ts

@@ -0,0 +1,64 @@
+/**
+ * @pi-unipi/notify — app payload encryption (UNI-161 §1).
+ *
+ * When the per-pairing key (notify-key.ts) is present, the ntfy platform
+ * encrypts the whole app payload before it's handed to ntfy: the ntfy
+ * `title` stays a fixed neutral "UniPi", `message` becomes the ciphertext
+ * envelope below, and `click` carries only `host`/`pid`/`dialog` — never
+ * prompt text. Without a key: unchanged legacy behaviour (plaintext/minimal
+ * message, same as before UNI-161 §1).
+ *
+ * Wire format: `unipi1:` + base64(iv(12) || AES-256-GCM(ciphertext || tag))
+ * of the JSON-encoded `NotifyPayload`. The IV is random per message. This
+ * exact format is mirrored by the app (Kotlin `javax.crypto` / WebCrypto)
+ * — see `apps/mobile/src-tauri/gen/android/.../NotifyCrypto.kt` and
+ * `apps/mobile/src/lib/notifyCrypto.ts` on the unipi-app side, and
+ * documented in `docs/m6/PROTOCOL.md`.
+ */
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+
+export const ENVELOPE_PREFIX = "unipi1:";
+
+/** The plaintext JSON object encrypted into the ntfy `message` field. */
+export interface NotifyPayload {
+  title: string;
+  body: string;
+  kind?: string;
+  host?: string;
+  pid?: number;
+  session?: string;
+  dialogId?: number;
+  options?: string[];
+}
+
+/** AES-256-GCM-encrypts `payload` with `key` (32 raw bytes), returning the
+ * full `unipi1:...` envelope string. */
+export function encryptNotifyPayload(key: Buffer, payload: NotifyPayload): string {
+  if (key.length !== 32) throw new Error(`notify key must be 32 bytes, got ${key.length}`);
+  const iv = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const plaintext = Buffer.from(JSON.stringify(payload), "utf-8");
+  const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  const combined = Buffer.concat([iv, ciphertext, tag]);
+  return `${ENVELOPE_PREFIX}${combined.toString("base64")}`;
+}
+
+/** Decrypts one `unipi1:...` envelope. Throws on a bad prefix, length,
+ * key, or authentication tag — callers should treat any throw as "drop
+ * this notification" rather than show anything. Exported mainly for the
+ * Node-side test fixture (`__tests__/ntfy-crypto.test.ts`) that proves the
+ * format round-trips; the app does the real decrypt with WebCrypto/
+ * javax.crypto so no plaintext secret ever needs Node again. */
+export function decryptNotifyPayload(key: Buffer, envelope: string): NotifyPayload {
+  if (!envelope.startsWith(ENVELOPE_PREFIX)) throw new Error("missing unipi1: prefix");
+  const combined = Buffer.from(envelope.slice(ENVELOPE_PREFIX.length), "base64");
+  if (combined.length < 12 + 16) throw new Error("envelope too short");
+  const iv = combined.subarray(0, 12);
+  const tag = combined.subarray(combined.length - 16);
+  const ciphertext = combined.subarray(12, combined.length - 16);
+  const decipher = createDecipheriv("aes-256-gcm", key, iv);
+  decipher.setAuthTag(tag);
+  const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  return JSON.parse(plaintext.toString("utf-8")) as NotifyPayload;
+}

package/packages/notify/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-unipi/notify",
-  "version": "3.0.0-alpha.34",
+  "version": "3.0.0-alpha.35",
   "description": "Cross-platform notification extension for Pi — native OS, Gotify, and Telegram notifications for agent lifecycle events",
   "type": "module",
   "main": "index.ts",
@@ -34,7 +34,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@pi-unipi/core": "3.0.0-alpha.34",
+    "@pi-unipi/core": "3.0.0-alpha.35",
     "node-notifier": "^10.0.1"
   },
   "peerDependencies": {

package/packages/notify/platforms/ntfy.ts

@@ -10,7 +10,15 @@
  * `appDetail` to control how much of the prompt text ntfy ever carries (the
  * server-side notify config has no app secrets, but "minimal" keeps the
  * question text itself off a third-party ntfy.sh server by default).
+ *
+ * UNI-161 §1: when `encryptKey` is set (notify-key.ts), the whole payload
+ * is AES-256-GCM-encrypted (ntfy-crypto.ts) into the ntfy `message`; the
+ * ntfy `title` is pinned to a fixed neutral "UniPi" and `click` carries no
+ * content beyond host/pid/dialog (deep-link routing only, never prompt
+ * text) — so a self-hosted *or* public ntfy server only ever sees
+ * ciphertext. Without a key: unchanged legacy minimal/full behaviour.
  */
+import { encryptNotifyPayload } from "../ntfy-crypto.js";
 
 /** What the phone needs to open the right chat (UNI-161 §4): the deep link's
  * query params. `host`: the paired host's id, or (when unknown on the pi
@@ -28,8 +36,17 @@ export interface NtfyPublishOptions {
   route?: NtfyAppRoute;
   /** "minimal" (default): generic title/message, no prompt text — only the
    *  route data. "full": the message argument is sent as-is. Controlled by
-   *  the user's `notify.ntfy.appDetail` setting. */
+   *  the user's `notify.ntfy.appDetail` setting. Also governs whether the
+   *  encrypted payload (when `encryptKey` is set) includes the message
+   *  text or just a generic body. */
   appDetail?: "minimal" | "full";
+  /** UNI-161 §1: the per-pairing E2E key. When present, the payload is
+   *  encrypted end to end and `appDetail`/`route` only ever affect what
+   *  goes *inside* the ciphertext, never the ntfy title/message/click. */
+  encryptKey?: Buffer;
+  /** Folded into the encrypted payload (ignored without `encryptKey`). */
+  session?: string;
+  dialogId?: number;
 }
 
 /** `unipi://chat?host=<id>&pid=<pid>&dialog=<id>` — the app's existing
@@ -42,21 +59,50 @@ export function buildDeepLink(route: NtfyAppRoute): string {
   return `unipi://chat?${params.toString()}`;
 }
 
+/** The fixed neutral ntfy title used once a payload is encrypted — the
+ * server must never see a hint of the real title. */
+const ENCRYPTED_TITLE = "UniPi";
+
 /** Builds the ntfy JSON publish body shared by the topic send and every
- * registered app-endpoint send (UNI-161 §4b: notify_register{endpoint}). */
+ * registered app-endpoint send (UNI-161 §4b: notify_register{endpoint}).
+ * `topicField` lets `publishToEndpoint` omit the `topic` key (the endpoint
+ * URL already names it) while sharing the same body-building logic. */
 export function buildNtfyBody(
-  topic: string,
+  topicOrNull: string | null,
   title: string,
   message: string,
   priority: number,
   options?: NtfyPublishOptions,
 ): Record<string, unknown> {
+  const clamped = Math.max(1, Math.min(5, priority));
+  if (options?.encryptKey) {
+    const route = options.route;
+    const envelope = encryptNotifyPayload(options.encryptKey, {
+      title,
+      body: options.appDetail === "full" || !route ? message : "Tap to open in UniPi",
+      kind: route?.kind,
+      host: route?.host,
+      pid: route?.pid,
+      session: options.session,
+      dialogId: options.dialogId,
+    });
+    const body: Record<string, unknown> = {
+      title: ENCRYPTED_TITLE,
+      message: envelope,
+      priority: clamped,
+    };
+    if (topicOrNull !== null) body.topic = topicOrNull;
+    // The click target itself must stay content-free: host/pid/dialog
+    // only, same shape as the unencrypted route, never prompt text.
+    if (route) body.click = buildDeepLink(route);
+    return body;
+  }
   const body: Record<string, unknown> = {
-    topic,
     title,
     message: options?.appDetail === "full" || !options?.route ? message : "Tap to open in UniPi",
-    priority: Math.max(1, Math.min(5, priority)),
+    priority: clamped,
   };
+  if (topicOrNull !== null) body.topic = topicOrNull;
   if (options?.route) {
     body.click = buildDeepLink(options.route);
     if (options.route.kind) body.tags = [options.route.kind];
@@ -110,15 +156,7 @@ export async function sendNtfyNotification(
  * Best-effort: endpoint failures never block the primary ntfy send.
  */
 export async function publishToEndpoint(endpoint: string, title: string, message: string, priority: number, options?: NtfyPublishOptions): Promise<void> {
-  const body: Record<string, unknown> = {
-    title,
-    message: options?.appDetail === "full" || !options?.route ? message : "Tap to open in UniPi",
-    priority: Math.max(1, Math.min(5, priority)),
-  };
-  if (options?.route) {
-    body.click = buildDeepLink(options.route);
-    if (options.route.kind) body.tags = [options.route.kind];
-  }
+  const body = buildNtfyBody(null, title, message, priority, options);
   const response = await fetch(endpoint, {
     method: "POST",
     headers: { "Content-Type": "application/json" },

package/packages/skill-registry/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pi-unipi/skill-registry",
-  "version": "3.0.0-alpha.34",
+  "version": "3.0.0-alpha.35",
   "description": "Skill registry for pi — per-project skill on/off, a skill vault, and jev-judged skill exposure",
   "type": "module",
   "license": "MIT",
@@ -33,7 +33,7 @@
   },
   "main": "index.ts",
   "dependencies": {
-    "@pi-unipi/core": "3.0.0-alpha.34"
+    "@pi-unipi/core": "3.0.0-alpha.35"
   },
   "peerDependencies": {
     "@earendil-works/pi-coding-agent": "^0.87.1",