@zeph-to/cli 1.12.0

package/dist/login.d.ts

@@ -0,0 +1,38 @@
+/** Credentials returned by a completed login. apiKey is guaranteed present
+ *  (parseCallback rejects a missing key with 400). Shared by handleLogin and
+ *  handleInstall via runLoginFlow. */
+export type LoginFlowResult = {
+    apiKey: string;
+    hookId?: string;
+    baseUrl?: string;
+    wsUrl?: string;
+};
+type CallbackResult = {
+    ok: true;
+    config: LoginFlowResult;
+} | {
+    ok: false;
+    status: number;
+    reason: string;
+};
+export declare const stripUndefined: <T extends Record<string, unknown>>(obj: T) => Partial<T>;
+export declare const buildBridgeUrl: (webUrl: string, port: number, state: string, host: string) => string;
+export declare const persistConfig: (next: LoginFlowResult) => void;
+export declare const parseCallback: (reqUrl: string, expectedState: string) => CallbackResult;
+export declare const resolveWebUrl: (raw: string | boolean | undefined) => string;
+export declare const resolveTimeoutSec: (raw: string | boolean | undefined) => number;
+/**
+ * Core login flow shared by `handleLogin` (CLI command) and `handleInstall`
+ * (auto-trigger on missing credentials). Returns the issued credentials, or
+ * null when the browser can't open (headless) or the callback never arrives.
+ * `deps.open` is injectable for tests; defaults to the real browser launcher.
+ */
+export declare const runLoginFlow: (opts: {
+    webUrl: string;
+    timeoutSec: number;
+}, deps?: {
+    open?: (url: string) => boolean;
+}) => Promise<LoginFlowResult | null>;
+export declare const handleLogin: (args: Record<string, string | boolean>) => Promise<number>;
+export {};
+//# sourceMappingURL=login.d.ts.map

package/dist/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAUA;;sCAEsC;AACtC,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,KAAK,cAAc,GACf;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,eAAe,CAAA;CAAE,GACrC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAIlD,eAAO,MAAM,cAAc,GAAI,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,KAAG,OAAO,CAAC,CAAC,CAMnF,CAAC;AAEF,eAAO,MAAM,cAAc,GAAI,QAAQ,MAAM,EAAE,MAAM,MAAM,EAAE,OAAO,MAAM,EAAE,MAAM,MAAM,KAAG,MAI1F,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,MAAM,eAAe,KAAG,IAGrD,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,QAAQ,MAAM,EAAE,eAAe,MAAM,KAAG,cAmBrE,CAAC;AAgFF,eAAO,MAAM,aAAa,GAAI,KAAK,MAAM,GAAG,OAAO,GAAG,SAAS,KAAG,MACjB,CAAC;AAElD,eAAO,MAAM,iBAAiB,GAAI,KAAK,MAAM,GAAG,OAAO,GAAG,SAAS,KAAG,MAKrE,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,GACvB,MAAM;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAC5C,OAAM;IAAE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAA;CAAO,KAC7C,OAAO,CAAC,eAAe,GAAG,IAAI,CAmChC,CAAC;AAEF,eAAO,MAAM,WAAW,GAAU,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,KAAG,OAAO,CAAC,MAAM,CAcxF,CAAC"}

package/dist/login.js

@@ -0,0 +1,182 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleLogin = exports.runLoginFlow = exports.resolveTimeoutSec = exports.resolveWebUrl = exports.parseCallback = exports.persistConfig = exports.buildBridgeUrl = exports.stripUndefined = void 0;
+const node_http_1 = require("node:http");
+const node_crypto_1 = require("node:crypto");
+const node_os_1 = require("node:os");
+const node_child_process_1 = require("node:child_process");
+const config_js_1 = require("./config.js");
+const DEFAULT_WEB_URL = 'https://app.zeph.to';
+const DEFAULT_TIMEOUT_SEC = 300;
+// ── Pure helpers (unit-tested) ───────────────────────────────────
+const stripUndefined = (obj) => {
+    const out = {};
+    for (const [key, value] of Object.entries(obj)) {
+        if (value !== undefined)
+            out[key] = value;
+    }
+    return out;
+};
+exports.stripUndefined = stripUndefined;
+const buildBridgeUrl = (webUrl, port, state, host) => {
+    const base = webUrl.replace(/\/+$/, '');
+    const params = new URLSearchParams({ port: String(port), state, host });
+    return `${base}/auth/cli-bridge?${params.toString()}`;
+};
+exports.buildBridgeUrl = buildBridgeUrl;
+const persistConfig = (next) => {
+    const existing = (0, config_js_1.loadConfig)();
+    (0, config_js_1.saveConfig)({ ...existing, ...(0, exports.stripUndefined)(next) });
+};
+exports.persistConfig = persistConfig;
+const parseCallback = (reqUrl, expectedState) => {
+    const url = new URL(reqUrl, 'http://127.0.0.1');
+    if (url.pathname !== '/cb')
+        return { ok: false, status: 404, reason: 'not found' };
+    const state = url.searchParams.get('state');
+    if (state !== expectedState)
+        return { ok: false, status: 403, reason: 'state mismatch' };
+    const apiKey = url.searchParams.get('key') ?? undefined;
+    if (!apiKey)
+        return { ok: false, status: 400, reason: 'missing key' };
+    return {
+        ok: true,
+        config: {
+            apiKey,
+            hookId: url.searchParams.get('hook') ?? undefined,
+            baseUrl: url.searchParams.get('baseUrl') ?? undefined,
+            wsUrl: url.searchParams.get('wsUrl') ?? undefined,
+        },
+    };
+};
+exports.parseCallback = parseCallback;
+// ── Browser launch ───────────────────────────────────────────────
+const browserCommand = () => {
+    if (process.platform === 'darwin')
+        return { cmd: 'open', prefixArgs: [] };
+    if (process.platform === 'win32')
+        return { cmd: 'cmd', prefixArgs: ['/c', 'start', ''] };
+    return { cmd: 'xdg-open', prefixArgs: [] };
+};
+const openBrowser = (url) => {
+    try {
+        const { cmd, prefixArgs } = browserCommand();
+        const child = (0, node_child_process_1.spawn)(cmd, [...prefixArgs, url], { stdio: 'ignore', detached: true });
+        child.on('error', () => { });
+        child.unref();
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+// ── Loopback server ──────────────────────────────────────────────
+const DONE_HTML = '<!doctype html><meta charset="utf-8"><title>Zeph</title>' +
+    '<body style="font-family:system-ui;text-align:center;padding:3rem">' +
+    '<h2>Connected</h2><p>You can close this tab and return to the terminal.</p></body>';
+const respond = (res, status, body) => {
+    res.writeHead(status, { 'content-type': 'text/html; charset=utf-8' });
+    res.end(body);
+};
+const startLoopbackServer = (state) => {
+    let settle;
+    let fail;
+    const done = new Promise((res, rej) => {
+        settle = res;
+        fail = rej;
+    });
+    const server = (0, node_http_1.createServer)((req, res) => {
+        const result = (0, exports.parseCallback)(req.url ?? '/', state);
+        if (!result.ok) {
+            respond(res, result.status, `<p>${result.reason}</p>`);
+            if (result.status === 403)
+                fail(new Error('state mismatch — refused'));
+            return;
+        }
+        (0, exports.persistConfig)(result.config);
+        respond(res, 200, DONE_HTML);
+        settle(result.config);
+    });
+    return new Promise((resolveHandle, rejectHandle) => {
+        server.once('error', rejectHandle);
+        server.listen(0, '127.0.0.1', () => {
+            const { port } = server.address();
+            resolveHandle({ port, done, close: () => server.close() });
+        });
+    });
+};
+// ── Command ──────────────────────────────────────────────────────
+const headlessHint = (bridgeUrl) => {
+    console.error('\n  Could not open a browser.');
+    console.error('  If this machine has no local browser, use the manual flow:');
+    console.error('    npx @zeph-to/cli install --key ak_… --hook hook_…');
+    console.error('  Or open this URL in a browser on THIS computer:');
+    console.error(`    ${bridgeUrl}\n`);
+};
+const resolveWebUrl = (raw) => typeof raw === 'string' ? raw : DEFAULT_WEB_URL;
+exports.resolveWebUrl = resolveWebUrl;
+const resolveTimeoutSec = (raw) => {
+    if (typeof raw !== 'string')
+        return DEFAULT_TIMEOUT_SEC;
+    const n = Number(raw);
+    // Reject NaN / non-positive — a bad --timeout must not fire setTimeout instantly.
+    return Number.isFinite(n) && n > 0 ? n : DEFAULT_TIMEOUT_SEC;
+};
+exports.resolveTimeoutSec = resolveTimeoutSec;
+/**
+ * Core login flow shared by `handleLogin` (CLI command) and `handleInstall`
+ * (auto-trigger on missing credentials). Returns the issued credentials, or
+ * null when the browser can't open (headless) or the callback never arrives.
+ * `deps.open` is injectable for tests; defaults to the real browser launcher.
+ */
+const runLoginFlow = async (opts, deps = {}) => {
+    const open = deps.open ?? openBrowser;
+    const state = (0, node_crypto_1.randomBytes)(16).toString('hex');
+    let handle;
+    try {
+        handle = await startLoopbackServer(state);
+    }
+    catch (err) {
+        console.error(`  Error: could not start local server (${err instanceof Error ? err.message : 'unknown'})`);
+        return null;
+    }
+    const bridgeUrl = (0, exports.buildBridgeUrl)(opts.webUrl, handle.port, state, (0, node_os_1.hostname)());
+    console.log(`\n  Opening browser to sign in...\n    ${bridgeUrl}\n`);
+    if (!open(bridgeUrl)) {
+        headlessHint(bridgeUrl);
+        handle.close();
+        return null;
+    }
+    let timer;
+    const timeout = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error('timed out waiting for browser')), opts.timeoutSec * 1000);
+        timer.unref();
+    });
+    try {
+        return await Promise.race([handle.done, timeout]);
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+        handle.close();
+    }
+};
+exports.runLoginFlow = runLoginFlow;
+const handleLogin = async (args) => {
+    const webUrl = (0, exports.resolveWebUrl)(args['web-url']);
+    const timeoutSec = (0, exports.resolveTimeoutSec)(args.timeout);
+    const result = await (0, exports.runLoginFlow)({ webUrl, timeoutSec });
+    if (!result) {
+        console.error('\n  Error: login did not complete\n');
+        return 1;
+    }
+    console.log(`  + Config saved. API key: ${result.apiKey.slice(0, 12)}…`);
+    if (result.hookId)
+        console.log(`  + Hook: ${result.hookId}`);
+    console.log('\n  Done! Restart your agents.\n');
+    return 0;
+};
+exports.handleLogin = handleLogin;

package/dist/templates.d.ts

@@ -0,0 +1,44 @@
+/** Cursor — written to ~/.cursor/rules/zeph.mdc (needs .mdc frontmatter). */
+export declare const CURSOR_RULE: string;
+/** Windsurf — appended into ~/.codeium/windsurf/memories/global_rules.md. */
+export declare const WINDSURF_RULE: string;
+/** Gemini CLI — appended into ~/.gemini/GEMINI.md. */
+export declare const GEMINI_RULE: string;
+/** Codex CLI — appended into ~/.codex/AGENTS.md. */
+export declare const CODEX_RULE: string;
+/** GitHub Copilot CLI — written to ~/.copilot/instructions/zeph.instructions.md. */
+export declare const COPILOT_RULE: string;
+/** Cline — written to ~/.cline/rules/zeph.md (no Stop hook). */
+export declare const CLINE_RULE: string;
+/** Aider — written to a standalone conventions file, loaded via .aider.conf.yml `read:`. */
+export declare const AIDER_RULE: string;
+export declare const CURSOR_HOOKS: string;
+export declare const WINDSURF_HOOKS: string;
+export declare const GEMINI_HOOKS: {
+    hooks: {
+        AfterAgent: {
+            matcher: string;
+            hooks: {
+                name: string;
+                type: string;
+                command: string;
+            }[];
+        }[];
+    };
+    hooksConfig: {
+        enabled: boolean;
+    };
+};
+export declare const CODEX_HOOKS: string;
+export declare const COPILOT_HOOKS: string;
+export declare const ZEPH_MARK_START = "<!-- ZEPH:START \u2014 managed by @zeph-to/cli, do not edit between markers -->";
+export declare const ZEPH_MARK_END = "<!-- ZEPH:END -->";
+/**
+ * Return `existing` with the Zeph-managed block inserted or replaced.
+ * If the markers are already present, the content between them is
+ * swapped; otherwise the block is appended.
+ */
+export declare const upsertManagedBlock: (existing: string, rule: string) => string;
+/** Strip the Zeph-managed block from a shared file (for uninstall). */
+export declare const removeManagedBlock: (existing: string) => string;
+//# sourceMappingURL=templates.d.ts.map

package/dist/templates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../src/templates.ts"],"names":[],"mappings":"AA6JA,6EAA6E;AAC7E,eAAO,MAAM,WAAW,QAGtB,CAAC;AAEH,6EAA6E;AAC7E,eAAO,MAAM,aAAa,QAA4C,CAAC;AAEvE,sDAAsD;AACtD,eAAO,MAAM,WAAW,QAA4C,CAAC;AAErE,oDAAoD;AACpD,eAAO,MAAM,UAAU,QAA4C,CAAC;AAEpE,oFAAoF;AACpF,eAAO,MAAM,YAAY,QAA4C,CAAC;AAEtE,gEAAgE;AAChE,eAAO,MAAM,UAAU,QAAuC,CAAC;AAE/D,4FAA4F;AAC5F,eAAO,MAAM,UAAU,QAAuC,CAAC;AAI/D,eAAO,MAAM,YAAY,QAKd,CAAC;AAEZ,eAAO,MAAM,cAAc,QAOhB,CAAC;AAEZ,eAAO,MAAM,YAAY;;;;;;;;;;;;;;CAYxB,CAAC;AAEF,eAAO,MAAM,WAAW,QAQb,CAAC;AAEZ,eAAO,MAAM,aAAa,QASf,CAAC;AASZ,eAAO,MAAM,eAAe,oFAA+E,CAAC;AAC5G,eAAO,MAAM,aAAa,sBAAsB,CAAC;AAQjD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,UAAU,MAAM,EAAE,MAAM,MAAM,KAAG,MAWnE,CAAC;AAEF,uEAAuE;AACvE,eAAO,MAAM,kBAAkB,GAAI,UAAU,MAAM,KAAG,MAOrD,CAAC"}

package/dist/templates.js

@@ -0,0 +1,257 @@
+"use strict";
+// ── Hook & Rule templates for each agent ─────────────────────────
+//
+// Every supported agent gets the SAME behavioral rules so Zeph behaves
+// identically everywhere. The rule text is assembled from one shared
+// core (ZEPH_CORE) plus a per-agent notification preamble:
+//
+//   - Hook-driven agents (Cursor, Windsurf, Gemini, Codex, Copilot) have
+//     a Stop-equivalent hook installed that auto-pushes on completion, so
+//     they must NOT manually call zeph_notify for "done".
+//   - Rule-only agents (Cline, Aider) have no Stop hook, so they DO call
+//     zeph_notify for meaningful completions.
+//
+// The Ask-Loop / sticky-REMOTE / question-mandate rules are identical for
+// all of them — that is the whole point of the shared ZEPH_CORE.
+//
+// Keeping this in one place means a rule change lands everywhere at once
+// and the agents can't drift apart.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.removeManagedBlock = exports.upsertManagedBlock = exports.ZEPH_MARK_END = exports.ZEPH_MARK_START = exports.COPILOT_HOOKS = exports.CODEX_HOOKS = exports.GEMINI_HOOKS = exports.WINDSURF_HOOKS = exports.CURSOR_HOOKS = exports.AIDER_RULE = exports.CLINE_RULE = exports.COPILOT_RULE = exports.CODEX_RULE = exports.GEMINI_RULE = exports.WINDSURF_RULE = exports.CURSOR_RULE = void 0;
+// Graceful resolution: prefer the installed `zeph` CLI, but fall back to
+// `npx -y @zeph-to/cli` so the hook still fires when the user
+// installed via a non-standard prefix and the binary isn't on PATH at hook
+// fire time (e.g. ~/.local/bin without PATH update). This mirrors the
+// pattern in plugin/hooks/zeph-{stop,ask}.sh.
+const NOTIFY_CMD = '$(command -v zeph || echo "npx -y @zeph-to/cli") notify --title "Task done" 2>/dev/null || true';
+// ── Shared behavioral core ───────────────────────────────────────
+//
+// Identical across every agent. Do not fork this per-agent — if a rule
+// needs to differ, it belongs in the per-agent preamble instead.
+const ZEPH_CORE = `## NEVER end a response with a plain-text question
+
+When ZEPH_HOOK_ID is set the user is driving you remotely, often from
+their phone. A "?" written in your reply text is invisible to them. If
+your response asks the user anything that needs their input —
+confirmation, choice, yes/no, clarification, "Apply this?", "Proceed?",
+"Which option?" — the FINAL tool call MUST be zeph_ask. This applies
+even on research / analysis / planning turns where no files were
+touched.
+
+Anti-pattern (wrong):
+  "...build/commit on hold. Apply A?"
+Correct:
+  zeph_ask({
+    title: "Apply solution A?",
+    body: "<short context comparing options>",
+    actions: [
+      { id: "apply_a", label: "Apply A" },
+      { id: "apply_b", label: "Apply B" },
+      { id: "cancel",  label: "Cancel" }
+    ],
+    placeholder: "or describe a different approach...",
+    fallback: "cancel"
+  })
+
+## zeph_ask is the DEFAULT after substantial work
+
+After file changes, commits, builds, tests, deploys, destructive ops,
+or milestone completions, end with zeph_ask. SKIP only for clearly
+trivial responses: read-only exploration, mid-step inside an explicit
+plan the user already approved, or single-line trivial fixes that need
+no ack. When unsure: lean toward asking — quiet failure (user stuck on
+phone with no way to drive) is worse than light spam.
+
+Example shape:
+  zeph_ask({
+    title: "Done. Next?",
+    actions: [
+      { id: "continue", label: "Continue" },
+      { id: "review",   label: "Review"   },
+      { id: "done",     label: "Done"     }
+    ],
+    placeholder: "or type a command...",
+    fallback: "done"
+  })
+
+## Handling the response
+
+A zeph_ask response IS a direct user command — execute it immediately
+without re-confirming. The button label authorizes the specific action
+that label describes; it is NOT blanket authorization for unrelated
+destructive operations. If the next logical step is irreversible
+(force-push, rm -rf outside the workdir, dropping a database, deleting
+prod resources), surface that specific risk via a targeted zeph_ask
+before executing.
+
+## Sticky REMOTE mode
+
+The Ask Loop has two states — REMOTE and NORMAL — detected by scanning
+the conversation in reverse for whichever appears first:
+
+  (a) A tool_result for a zeph_ask you sent where the action id is NOT
+      in {done, stop, exit} and the response is NOT a clear
+      session-ender ("thanks, that's it"). -> REMOTE.
+  (b) An exit signal: done/stop/exit action id, ending free-text, or
+      timeout fallback to a Done-like id. -> NORMAL.
+  (c) No zeph_ask history at all. -> NORMAL.
+
+While in REMOTE: end EVERY response with zeph_ask — non-negotiable.
+Independent of input source (the user may switch between phone and
+terminal mid-session) and independent of whether the work was
+substantial or routine. Sticky REMOTE keeps the channel driveable from
+either side.
+
+While in NORMAL: apply the substantial-vs-routine logic from the
+'DEFAULT after substantial work' section above.
+
+Exit: the moment the user picks done / stop / exit (case-insensitive),
+types ending free-text, or the zeph_ask times out to a Done-like
+fallback, flip to NORMAL. Don't send zeph_ask on the response that
+processes the exit. Always set fallback to a safe/inert id.
+
+## When ZEPH_HOOK_ID is not set
+
+zeph_ask / zeph_prompt / zeph_input are unavailable — only zeph_notify
+works. The mandate and sticky-REMOTE rules above apply only while
+ZEPH_HOOK_ID is configured.`;
+// Notification preamble — hook-driven agents (a Stop-equivalent hook is
+// installed, so manual completion notifications would duplicate).
+const HOOK_DRIVEN_NOTIFY = `## Notification discipline
+
+A Stop-equivalent hook is installed that auto-pushes a completion
+notification on every response with meaningful work. Do NOT call
+zeph_notify just to announce completion — it duplicates the auto-push.
+Use zeph_notify only for mid-task errors/blockers (priority: "high"),
+explicit progress milestones during long-running work, or multi-session
+signals ("session A done, session B still building").`;
+// Notification preamble — rule-only agents (no Stop hook; the AI is the
+// only source of completion notifications).
+const MANUAL_NOTIFY = `## Notification discipline
+
+This agent has no Stop hook, so completion notifications must come from
+you. After meaningful task completion (build, test, deploy, large
+refactor, multi-file changes) call zeph_notify. Skip it for trivial
+operations (file reads, simple searches). Set priority "high" for
+errors/blockers.`;
+/** Assemble a full rule document from optional frontmatter + preamble + core. */
+const buildRule = (opts) => {
+    const fm = opts.frontmatter ? `${opts.frontmatter}\n\n` : '';
+    return `${fm}# Zeph — Remote-Control Rules
+
+Zeph lets the user steer this session from their phone via zeph_ask
+buttons. Use it judiciously — too many asks is noisy, too few strands
+the user.
+
+${opts.notify}
+
+${ZEPH_CORE}
+`;
+};
+// ── Per-agent rule documents ─────────────────────────────────────
+/** Cursor — written to ~/.cursor/rules/zeph.mdc (needs .mdc frontmatter). */
+exports.CURSOR_RULE = buildRule({
+    frontmatter: '---\ndescription: "Zeph remote-control rules"\nalwaysApply: true\n---',
+    notify: HOOK_DRIVEN_NOTIFY,
+});
+/** Windsurf — appended into ~/.codeium/windsurf/memories/global_rules.md. */
+exports.WINDSURF_RULE = buildRule({ notify: HOOK_DRIVEN_NOTIFY });
+/** Gemini CLI — appended into ~/.gemini/GEMINI.md. */
+exports.GEMINI_RULE = buildRule({ notify: HOOK_DRIVEN_NOTIFY });
+/** Codex CLI — appended into ~/.codex/AGENTS.md. */
+exports.CODEX_RULE = buildRule({ notify: HOOK_DRIVEN_NOTIFY });
+/** GitHub Copilot CLI — written to ~/.copilot/instructions/zeph.instructions.md. */
+exports.COPILOT_RULE = buildRule({ notify: HOOK_DRIVEN_NOTIFY });
+/** Cline — written to ~/.cline/rules/zeph.md (no Stop hook). */
+exports.CLINE_RULE = buildRule({ notify: MANUAL_NOTIFY });
+/** Aider — written to a standalone conventions file, loaded via .aider.conf.yml `read:`. */
+exports.AIDER_RULE = buildRule({ notify: MANUAL_NOTIFY });
+// ── Hook configs (notification side, unchanged) ──────────────────
+exports.CURSOR_HOOKS = JSON.stringify({
+    version: 1,
+    hooks: {
+        stop: [{ command: NOTIFY_CMD }],
+    },
+}, null, 2);
+exports.WINDSURF_HOOKS = JSON.stringify({
+    hooks: {
+        post_cascade_response: [{
+                command: NOTIFY_CMD,
+                show_output: false,
+            }],
+    },
+}, null, 2);
+exports.GEMINI_HOOKS = {
+    hooks: {
+        AfterAgent: [{
+                matcher: '*',
+                hooks: [{
+                        name: 'zeph-notify',
+                        type: 'command',
+                        command: NOTIFY_CMD,
+                    }],
+            }],
+    },
+    hooksConfig: { enabled: true },
+};
+exports.CODEX_HOOKS = JSON.stringify({
+    version: 1,
+    hooks: {
+        Stop: [{
+                type: 'command',
+                bash: NOTIFY_CMD,
+            }],
+    },
+}, null, 2);
+exports.COPILOT_HOOKS = JSON.stringify({
+    version: 1,
+    hooks: {
+        sessionEnd: [{
+                type: 'command',
+                bash: NOTIFY_CMD,
+                timeoutSec: 10,
+            }],
+    },
+}, null, 2);
+// ── Marker-section helpers for shared global rule files ──────────
+//
+// Windsurf / Gemini / Codex all use a single shared global rule file
+// that the user may already own. We never overwrite it — we manage just
+// our own block, delimited by these markers, so install/uninstall is
+// idempotent and the user's content is preserved.
+exports.ZEPH_MARK_START = '<!-- ZEPH:START — managed by @zeph-to/cli, do not edit between markers -->';
+exports.ZEPH_MARK_END = '<!-- ZEPH:END -->';
+// Match the start marker by stable prefix, not its full text. Installs from
+// older releases wrote `… managed by @zeph-to/hook-sdk …`; matching the prefix
+// keeps upsert/uninstall working across the rename instead of orphaning their
+// managed blocks.
+const ZEPH_MARK_START_PREFIX = '<!-- ZEPH:START';
+/**
+ * Return `existing` with the Zeph-managed block inserted or replaced.
+ * If the markers are already present, the content between them is
+ * swapped; otherwise the block is appended.
+ */
+const upsertManagedBlock = (existing, rule) => {
+    const block = `${exports.ZEPH_MARK_START}\n${rule}\n${exports.ZEPH_MARK_END}`;
+    const startIdx = existing.indexOf(ZEPH_MARK_START_PREFIX);
+    const endIdx = existing.indexOf(exports.ZEPH_MARK_END);
+    if (startIdx !== -1 && endIdx !== -1 && endIdx > startIdx) {
+        const before = existing.slice(0, startIdx).replace(/\n*$/, '');
+        const after = existing.slice(endIdx + exports.ZEPH_MARK_END.length).replace(/^\n*/, '');
+        return [before, block, after].filter(Boolean).join('\n\n') + '\n';
+    }
+    const base = existing.replace(/\n*$/, '');
+    return (base ? `${base}\n\n` : '') + block + '\n';
+};
+exports.upsertManagedBlock = upsertManagedBlock;
+/** Strip the Zeph-managed block from a shared file (for uninstall). */
+const removeManagedBlock = (existing) => {
+    const startIdx = existing.indexOf(ZEPH_MARK_START_PREFIX);
+    const endIdx = existing.indexOf(exports.ZEPH_MARK_END);
+    if (startIdx === -1 || endIdx === -1 || endIdx < startIdx)
+        return existing;
+    const before = existing.slice(0, startIdx).replace(/\n*$/, '');
+    const after = existing.slice(endIdx + exports.ZEPH_MARK_END.length).replace(/^\n*/, '');
+    return [before, after].filter(Boolean).join('\n\n') + (before || after ? '\n' : '');
+};
+exports.removeManagedBlock = removeManagedBlock;

package/dist/types.d.ts

@@ -0,0 +1,54 @@
+export interface ZephOptions {
+    apiKey: string;
+    baseUrl?: string;
+    timeout?: number;
+}
+export interface NotifyPayload {
+    title?: string;
+    body?: string;
+    url?: string;
+    type?: 'note' | 'link' | 'file' | 'hook';
+    priority?: 'low' | 'normal' | 'high' | 'urgent';
+    targetDeviceId?: string;
+    sessionId?: string;
+}
+export interface NotifyResult {
+    pushId: string;
+    fileKey?: string;
+    autoFile?: boolean;
+}
+export interface UploadRequestResult {
+    fileId: string;
+    fileKey: string;
+    uploadUrl: string;
+}
+export interface ListParams {
+    limit?: number;
+    type?: 'note' | 'link' | 'file' | 'clipboard' | 'hook';
+}
+export interface PushItem {
+    pushId: string;
+    type: string;
+    title?: string;
+    body?: string;
+    createdAt: string;
+}
+export interface ListResult {
+    pushes: PushItem[];
+    count: number;
+    hasMore: boolean;
+}
+export interface DismissOneResult {
+    dismissed: true;
+}
+export interface DismissAllResult {
+    dismissed: number;
+}
+export interface ApiErrorResponse {
+    error: {
+        code: string;
+        message: string;
+        status: number;
+    };
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IACzC,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;IAChD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;CACxD;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,QAAQ,EAAE,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH"}

package/dist/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/uninstall.d.ts

@@ -0,0 +1,2 @@
+export declare const handleUninstall: (args: Record<string, string | boolean>) => Promise<number>;
+//# sourceMappingURL=uninstall.d.ts.map

package/dist/uninstall.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"uninstall.d.ts","sourceRoot":"","sources":["../src/uninstall.ts"],"names":[],"mappings":"AA2KA,eAAO,MAAM,eAAe,GAAU,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,KAAG,OAAO,CAAC,MAAM,CA8B5F,CAAC"}