@zeph-to/cli 1.17.0 → 1.19.0

package/README.md

@@ -5,13 +5,23 @@
 [![node](https://img.shields.io/node/v/@zeph-to/cli.svg)](https://nodejs.org)
 [![license](https://img.shields.io/npm/l/@zeph-to/cli.svg)](./LICENSE)
 
-Push notification SDK + CLI for [Zeph](https://zeph.to), with an optional
-resident listener that **drives Claude Code / Codex / Gemini sessions
-from your phone** by injecting messages into named tmux sessions.
+Push notification SDK + CLI for [Zeph](https://zeph.to) — the terminal
+side of the round trip: your agent works, hits a decision, and asks your
+phone; you tap a button (or type a reply), and the answer lands back in
+the live session so the agent keeps going.
 
 - `ZephHook` SDK — native `fetch`, no runtime deps. Send/list/dismiss pushes.
-- `zeph` CLI — install Zeph plugins, send pushes, run agents under tmux,
-  and listen for inbound messages from your phone.
+- `zeph` CLI — one-command setup for 8 AI agents, push sending, and an
+  optional resident listener that **drives Claude Code / Codex / Gemini
+  sessions from your phone** by injecting messages into named tmux
+  sessions.
+
+Part of the Zeph toolchain:
+[`@zeph-to/mcp-server`](https://github.com/zeph-to/mcp-server) (the MCP
+tools your agent calls, e.g. `zeph_ask`) ·
+[`zeph-to/plugin`](https://github.com/zeph-to/plugin) (Claude Code plugin
+bundling hooks + MCP + rules) · the [Zeph app](https://zeph.to) on your
+phone.
 
 ## Installation
 
@@ -49,6 +59,11 @@ npx @zeph-to/cli install --key ak_... --hook hook_...
 Either way it saves to `~/.zeph/config.json`. All Zeph tools (CLI, MCP
 server, plugin hooks, listener) read this file.
 
+On a fresh machine `install` alone is enough: with no `--key` and no
+saved config it opens the same browser login automatically (headless
+boxes fall back to manual key entry). Pass `--only claude,cursor,…` to
+skip the interactive agent picker.
+
 To **send** notifications:
 
 ```bash
@@ -63,8 +78,8 @@ To **drive a Claude Code / Codex / Gemini session from your phone**, see
 > Send messages from your phone *into* a live Claude Code / Codex /
 > Gemini session — even after a `zeph_ask` polling window has expired.
 
-The MCP tools `zeph_ask` / `zeph_prompt` / `zeph_input` open a polling
-loop on a fixed timeout (120–600 s). Once that window closes the
+The MCP tools `zeph_ask` / `zeph_prompt` / `zeph_input` wait on a fixed
+timeout (120–600 s). Once that window closes the
 session becomes unaddressable from the phone, even though it's still
 running. The `zeph listener` daemon fixes this by keeping a persistent
 WebSocket open to Zeph and injecting matching messages into a *named*
@@ -91,6 +106,25 @@ The listener also reports its tmux session inventory back to the server
 every 5 seconds, so the phone picker stays in sync — no manual
 configuration needed once a session is running.
 
+### Remote-origin detection (sticky REMOTE mode)
+
+A message injected via `send-keys` is indistinguishable from typing — so
+the listener also records each injection as a one-shot marker (epoch +
+sha256 of the text, keyed by the pane's project dir). A prompt-submit
+hook on the agent side matches the submitted prompt against that marker
+and, on an exact match, tells the model the user is driving the session
+from their phone — entering sticky REMOTE mode (every response ends with
+an answerable `zeph_ask`).
+
+| Agent | Hook | Installed by |
+|-------|------|--------------|
+| Claude Code | `UserPromptSubmit` → plugin's `zeph-remote.sh` | Zeph plugin |
+| Gemini CLI | `BeforeAgent` → `zeph remote-hook gemini` | `zeph setup` |
+| Codex CLI | `UserPromptSubmit` → `zeph remote-hook codex` | `zeph setup` |
+
+Detection is exact-match: a terminal keystroke racing a phone message
+can never false-flag. Muted projects are never flagged.
+
 ### Setup
 
 1. **Install tmux.** The listener uses `send-keys`; the wrapper spawns
@@ -293,7 +327,7 @@ zeph notify --title "Hello" --json
 | Command | Description |
 |---------|-------------|
 | `login` | Browser sign-in: auto-fetch API key + hook into `~/.zeph/config.json` over a localhost loopback (`--web-url`, `--timeout`). No copy-paste |
-| `install` | One-command setup: detect agents, save config, install rules + hooks + MCP |
+| `install` (alias: `setup`) | One-command setup: detect agents, save config, install rules + hooks + MCP. No saved config → opens browser login automatically. `--only claude,cursor,…` skips the picker |
 | `uninstall` | Remove Zeph from all detected agents (`--dry-run`, `--purge`) |
 | `verify` | Check installation health across detected agents (`--ping` for a live API call) |
 | `check-update` | Check whether a newer Zeph version is on npm |
@@ -314,6 +348,10 @@ zeph notify --title "Hello" --json
 | `--type <type>` | Push type: `note`, `link`, `file`, `hook` |
 | `--priority <p>` | Priority: `low`, `normal`, `high`, `urgent` |
 | `--device <id>` | Target device ID |
+| `--session <id>` | AI session ID so the push threads into that session's chat (or `ZEPH_SESSION_ID` env) |
+| `--auto` | Apply the push gate before sending — honors the `/zeph-quiet` / `/zeph-loud` push-mode dial; gated-out exits silently with code 0 |
+| `--marker <m>` | Push Signal marker for `--auto`: `skip`, `push`, `high` |
+| `--tools <n>`, `--nonreadonly <n>` | Turn tool counts feeding `--auto`'s heuristic (defaults assume real work) |
 
 The defaults are tuned for hook-driven invocations (e.g. Stop hooks
 calling `zeph notify --title "Task done"` without a body) — you'll see
@@ -326,6 +364,7 @@ which project + branch finished without writing per-IDE wrappers. Pass
 |------|-------------|
 | `--ws-url <url>` | WebSocket endpoint (or set `ZEPH_WS_URL` env, or `wsUrl` in `~/.zeph/config.json`) |
 | `--key <api-key>` | API key (or set `ZEPH_API_KEY` env) |
+| `--base-url <url>` | REST API base URL (or set `ZEPH_BASE_URL` env, or `baseUrl` in `~/.zeph/config.json`) |
 
 The listener reconnects with exponential backoff + jitter (1 s → 30 s
 cap). Heartbeat is ping every 25 s with a 10 s pong timeout. On an
@@ -454,11 +493,12 @@ try {
 |-------|-------------------|
 | Claude Code | Plugin (hooks + MCP server) |
 | Cursor | MCP server + stop hook + rules |
-| Windsurf | MCP server + response hook |
+| Windsurf | MCP server + response hook + rules |
 | Gemini CLI | MCP server + AfterAgent hook |
-| Codex CLI | Stop hook |
-| Copilot CLI | Session end hook |
-| Cline | Rules file |
+| Codex CLI | Stop hook + rules |
+| Copilot CLI | Session end hook + rules |
+| Cline | Rules file (`~/.cline/rules/zeph.md`) |
+| Aider | Conventions file + `read:` directive in `~/.aider.conf.yml` |
 
 For remote-control via `zeph listener` the per-agent setup is the same
 across CC/Codex/Gemini — the wrapper just spawns them in a named tmux

package/dist/check-update.js

@@ -49,7 +49,7 @@ const handleCheckUpdate = async (args) => {
     }
     if (isJson) {
         console.log(JSON.stringify({ results }, null, 2));
-        return results.some((r) => r.outdated) ? 0 : 0;
+        return 0;
     }
     console.log('\n  Zeph — update check\n');
     let anyOutdated = false;

package/dist/cli.js

@@ -14,6 +14,7 @@ const listener_js_1 = require("./listener.js");
 const config_js_1 = require("./config.js");
 const gate_js_1 = require("./gate.js");
 const remote_agents_js_1 = require("./remote-agents.js");
+const remote_hook_js_1 = require("./remote-hook.js");
 const detectBranchAndProject = () => {
     const dir = (0, config_js_1.detectProjectDir)();
     const project = dir.split('/').filter(Boolean).pop() ?? 'project';
@@ -164,6 +165,30 @@ const gateCount = (raw, fallback) => {
     const n = typeof raw === 'string' ? Number(raw) : NaN;
     return Number.isFinite(n) && n >= 0 ? n : fallback;
 };
+/**
+ * Internal — invoked by the Gemini/Codex prompt-submit hooks that
+ * `zeph setup` registers, never typed by users (hence absent from help).
+ * Reads the hook JSON on stdin; prints additionalContext JSON on a match
+ * (remote-origin detection, ADR-0002). Always exits 0: the hook only adds
+ * context and must never block a prompt.
+ */
+const handleRemoteHook = async (args) => {
+    const agent = args._arg1;
+    if (!(0, remote_hook_js_1.isRemoteHookAgent)(agent))
+        return 0;
+    try {
+        let stdin = '';
+        for await (const chunk of process.stdin)
+            stdin += chunk;
+        const out = (0, remote_hook_js_1.runRemoteHook)(agent, stdin);
+        if (out)
+            console.log(out);
+    }
+    catch {
+        /* never block a prompt */
+    }
+    return 0;
+};
 const handleNotify = async (args) => {
     const isJson = args.json === true;
     const projectDir = (0, config_js_1.detectProjectDir)();
@@ -229,7 +254,10 @@ const handleList = async (args) => {
     if (!hook)
         return 3;
     try {
-        const limit = args.limit ? Number(args.limit) : undefined;
+        // Clamp to the documented 1-20 range; a non-numeric value falls back to
+        // the server default instead of sending limit=NaN in the query string.
+        const rawLimit = args.limit ? Number(args.limit) : NaN;
+        const limit = Number.isFinite(rawLimit) ? Math.min(20, Math.max(1, Math.floor(rawLimit))) : undefined;
         const result = await hook.list({
             limit,
             type: args.type,
@@ -381,10 +409,15 @@ const main = async () => {
             return handleTest(args);
         case 'listener':
             return (0, listener_js_1.handleListener)(args);
+        case 'remote-hook':
+            return handleRemoteHook(args);
         default:
             printError(`Unknown command: ${command}`, args.json === true);
             printUsage();
             return 1;
     }
 };
-main().then((code) => process.exit(code));
+main().then((code) => process.exit(code), (err) => {
+    console.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+});

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,UAAU,QAA2B,CAAC;AACnD,eAAO,MAAM,WAAW,QAAkC,CAAC;AAE3D,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,WAAW,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,SAGlD,CAAC;AAMF,eAAO,MAAM,oBAAoB,+EAAgF,CAAC;AAElH,sFAAsF;AACtF,eAAO,MAAM,gBAAgB,QAAO,MAMnC,CAAC;AAEF,eAAO,MAAM,UAAU,QAAO,UAM7B,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,QAAQ,UAAU,KAAG,IAG/C,CAAC;AAEF,eAAO,MAAM,OAAO,QAOhB,CAAC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,UAAU,QAA2B,CAAC;AACnD,eAAO,MAAM,WAAW,QAAkC,CAAC;AAE3D,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,WAAW,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,SAGlD,CAAC;AAMF,eAAO,MAAM,oBAAoB,+EAAgF,CAAC;AAElH,sFAAsF;AACtF,eAAO,MAAM,gBAAgB,QAAO,MAMnC,CAAC;AAEF,eAAO,MAAM,UAAU,QAAO,UAM7B,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,QAAQ,UAAU,KAAG,IAM/C,CAAC;AAEF,eAAO,MAAM,OAAO,QAOhB,CAAC"}

package/dist/config.js

@@ -36,8 +36,11 @@ const loadConfig = () => {
 };
 exports.loadConfig = loadConfig;
 const saveConfig = (config) => {
-    (0, fs_1.mkdirSync)(exports.CONFIG_DIR, { recursive: true });
-    (0, fs_1.writeFileSync)(exports.CONFIG_FILE, JSON.stringify(config, null, 2) + '\n');
+    (0, fs_1.mkdirSync)(exports.CONFIG_DIR, { recursive: true, mode: 0o700 });
+    (0, fs_1.writeFileSync)(exports.CONFIG_FILE, JSON.stringify(config, null, 2) + '\n', { mode: 0o600 });
+    // `mode` only applies on creation — tighten pre-existing installs too,
+    // since this file holds the API key.
+    (0, fs_1.chmodSync)(exports.CONFIG_FILE, 0o600);
 };
 exports.saveConfig = saveConfig;
 exports.VERSION = (() => {

package/dist/crypto.d.ts

@@ -1,7 +1,8 @@
 /**
  * Device-shared encryption for Hook SDK — self-contained ECDH P-256 +
  * AES-256-GCM. Mirrors @zeph/crypto API but bundled inline (no external
- * dependency). Uses Web Crypto API (globalThis.crypto.subtle) — Node.js 18+.
+ * dependency). Uses Web Crypto API via node:crypto webcrypto — Node.js 18+
+ * (the `crypto` global only exists unflagged from Node 19, so we import it).
  *
  * Threat model honesty (do not call this "E2E" without a footnote):
  *

package/dist/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AA2JH;;;;;GAKG;AACH,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,EAAE,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CAsE5E,CAAC;AA2CF,eAAO,MAAM,UAAU,QAAO,aAAa,GAAG,IAAqB,CAAC;AACpE,eAAO,MAAM,YAAY,QAAO,MAAM,GAAG,IAA+B,CAAC;AAEzE;;;GAGG;AACH,eAAO,MAAM,eAAe,GAC1B,OAAO;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,EACtD,uBAAuB,MAAM,KAC5B,OAAO,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,IAAI,CAAC;CACnB,CAeA,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,sBAAsB,GACjC,OAAO;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,KACrD,OAAO,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,IAAI,CAAC;CACnB,CAaA,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,GAClC,SAAS,MAAM,EACf,uBAAuB,MAAM,KAC5B,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CASlE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,kBAAkB,GAC7B,SAAS,MAAM,KACd,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAQlE,CAAC"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAiKH;;;;;GAKG;AACH,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,EAAE,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CAsE5E,CAAC;AA2CF,eAAO,MAAM,UAAU,QAAO,aAAa,GAAG,IAAqB,CAAC;AACpE,eAAO,MAAM,YAAY,QAAO,MAAM,GAAG,IAA+B,CAAC;AAEzE;;;GAGG;AACH,eAAO,MAAM,eAAe,GAC1B,OAAO;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,EACtD,uBAAuB,MAAM,KAC5B,OAAO,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,IAAI,CAAC;CACnB,CAeA,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,sBAAsB,GACjC,OAAO;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,KACrD,OAAO,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,IAAI,CAAC;CACnB,CAaA,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,GAClC,SAAS,MAAM,EACf,uBAAuB,MAAM,KAC5B,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CASlE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,kBAAkB,GAC7B,SAAS,MAAM,KACd,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAQlE,CAAC"}

package/dist/crypto.js

@@ -2,7 +2,8 @@
 /**
  * Device-shared encryption for Hook SDK — self-contained ECDH P-256 +
  * AES-256-GCM. Mirrors @zeph/crypto API but bundled inline (no external
- * dependency). Uses Web Crypto API (globalThis.crypto.subtle) — Node.js 18+.
+ * dependency). Uses Web Crypto API via node:crypto webcrypto — Node.js 18+
+ * (the `crypto` global only exists unflagged from Node 19, so we import it).
  *
  * Threat model honesty (do not call this "E2E" without a footnote):
  *
@@ -33,6 +34,11 @@ exports.encryptFileForSelf = exports.encryptFileForRecipient = exports.encryptPu
 const fs_1 = require("fs");
 const os_1 = require("os");
 const path_1 = require("path");
+const node_crypto_1 = require("node:crypto");
+// Node 18 has no `crypto` global (unflagged only from 19.0.0) — resolve the
+// Web Crypto implementation explicitly so encryption works on the declared
+// minimum runtime instead of silently falling back to plaintext.
+const crypto = node_crypto_1.webcrypto;
 // ─── Base64 helpers ───
 const toBase64 = (buffer) => {
     const bytes = new Uint8Array(buffer);

package/dist/gate.d.ts

@@ -28,7 +28,17 @@ export declare const GATE_DEFAULTS: {
 export declare const normalizeMarker: (raw: string | undefined) => GateMarker;
 export declare const normalizePushMode: (raw: string | undefined) => GatePushMode;
 export declare const decidePush: (input: GateInput) => GateVerdict;
+export declare const stateDir: () => string;
 export declare const projectHash: (dir: string) => string | null;
+/** Marker path for a project hash: `<stateDir>/remote-<cksum(projectDir)>`. */
+export declare const remoteMarkerPath: (hash: string) => string;
+/**
+ * sha256 over the ASCII-only-trimmed text — recorded at inject time,
+ * recomputed at prompt submit. Trim strips ONLY ' \t\r\n\f\v', NOT
+ * String.trim(): trim() also eats Unicode whitespace (U+00A0 etc.) that
+ * the bash reader keeps, and both sides must hash identical bytes.
+ */
+export declare const remoteDigest: (text: string) => string;
 /** True when the user ran /zeph-mute for this project. */
 export declare const isMuted: (dir: string) => boolean;
 /** The user's session push-mode dial (/zeph-quiet | /zeph-loud), default normal. */

package/dist/gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAsBA,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAC3D,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEvD,MAAM,WAAW,SAAS;IACxB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,gBAAgB,EAAE,MAAM,CAAC;IACzB,yDAAyD;IACzD,YAAY,EAAE,OAAO,CAAC;IACtB,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,YAAY,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAAC;CAC7B;AAED;;;;;GAKG;AACH,eAAO,MAAM,aAAa;;;;CAIhB,CAAC;AAEX,eAAO,MAAM,eAAe,GAAI,KAAK,MAAM,GAAG,SAAS,KAAG,UACS,CAAC;AAEpE,eAAO,MAAM,iBAAiB,GAAI,KAAK,MAAM,GAAG,SAAS,KAAG,YACR,CAAC;AAErD,eAAO,MAAM,UAAU,GAAI,OAAO,SAAS,KAAG,WAW7C,CAAC;AAQF,eAAO,MAAM,WAAW,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,IAOlD,CAAC;AAEF,0DAA0D;AAC1D,eAAO,MAAM,OAAO,GAAI,KAAK,MAAM,KAAG,OAGrC,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,YAAY,GAAI,KAAK,MAAM,KAAG,YAQ1C,CAAC"}
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAyBA,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAC3D,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEvD,MAAM,WAAW,SAAS;IACxB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,gBAAgB,EAAE,MAAM,CAAC;IACzB,yDAAyD;IACzD,YAAY,EAAE,OAAO,CAAC;IACtB,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,YAAY,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAAC;CAC7B;AAED;;;;;GAKG;AACH,eAAO,MAAM,aAAa;;;;CAIhB,CAAC;AAEX,eAAO,MAAM,eAAe,GAAI,KAAK,MAAM,GAAG,SAAS,KAAG,UACS,CAAC;AAEpE,eAAO,MAAM,iBAAiB,GAAI,KAAK,MAAM,GAAG,SAAS,KAAG,YACR,CAAC;AAErD,eAAO,MAAM,UAAU,GAAI,OAAO,SAAS,KAAG,WAW7C,CAAC;AAeF,eAAO,MAAM,QAAQ,QAAO,MACoD,CAAC;AAmBjF,eAAO,MAAM,WAAW,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,IAOlD,CAAC;AAWF,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,GAAI,MAAM,MAAM,KAAG,MAA4C,CAAC;AAE7F;;;;;GAKG;AACH,eAAO,MAAM,YAAY,GAAI,MAAM,MAAM,KAAG,MAG1B,CAAC;AAEnB,0DAA0D;AAC1D,eAAO,MAAM,OAAO,GAAI,KAAK,MAAM,KAAG,OAGrC,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,YAAY,GAAI,KAAK,MAAM,KAAG,YAU1C,CAAC"}

package/dist/gate.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.readPushMode = exports.isMuted = exports.projectHash = exports.decidePush = exports.normalizePushMode = exports.normalizeMarker = exports.GATE_DEFAULTS = void 0;
+exports.readPushMode = exports.isMuted = exports.remoteDigest = exports.remoteMarkerPath = exports.projectHash = exports.stateDir = exports.decidePush = exports.normalizePushMode = exports.normalizeMarker = exports.GATE_DEFAULTS = void 0;
 /**
  * Push-gate decision — the portable half of the Zeph Stop-hook logic.
  *
@@ -21,7 +21,10 @@ exports.readPushMode = exports.isMuted = exports.projectHash = exports.decidePus
  *      (the B1 read-only floor).
  */
 const child_process_1 = require("child_process");
+const crypto_1 = require("crypto");
 const fs_1 = require("fs");
+const os_1 = require("os");
+const path_1 = require("path");
 /**
  * "Assume real work" defaults for hooks that can't supply turn facts
  * (most non-Claude agents pass no counts): in normal mode the push still
@@ -54,9 +57,35 @@ const decidePush = (input) => {
 exports.decidePush = decidePush;
 // ── Per-project gate state (mute + push-mode dial) ───────────────
 //
-// The plugin's bash hooks key these tmp files off `cksum` of the project
-// dir; shelling out to the same `cksum` here (instead of a pure-TS CRC)
+// State lives under ${XDG_STATE_HOME:-~/.local/state}/zeph — a per-user
+// directory. It used to live at predictable names in world-writable /tmp,
+// where any local user could pre-create a victim's mute file (and sticky
+// /tmp makes that file un-deletable by the victim). Legacy /tmp files are
+// still honored during the migration window, but only when owned by the
+// current user, which neutralizes planted files.
+//
+// The plugin's bash hooks key these files off `cksum` of the project dir;
+// shelling out to the same `cksum` here (instead of a pure-TS CRC)
 // guarantees hash parity with every already-written file.
+const stateDir = () => (0, path_1.join)(process.env.XDG_STATE_HOME || (0, path_1.join)((0, os_1.homedir)(), '.local', 'state'), 'zeph');
+exports.stateDir = stateDir;
+const ownedByCurrentUser = (path) => {
+    try {
+        const st = (0, fs_1.statSync)(path);
+        return typeof process.getuid !== 'function' || st.uid === process.getuid();
+    }
+    catch {
+        return false;
+    }
+};
+/** Resolve a state file: current location first, then user-owned legacy /tmp. */
+const findStateFile = (kind, hash) => {
+    const current = (0, path_1.join)((0, exports.stateDir)(), `${kind}-${hash}`);
+    if ((0, fs_1.existsSync)(current))
+        return current;
+    const legacy = `/tmp/zeph-${kind}-${hash}`;
+    return ownedByCurrentUser(legacy) ? legacy : null;
+};
 const projectHash = (dir) => {
     try {
         const raw = (0, child_process_1.execFileSync)('cksum', { input: dir, encoding: 'utf-8' });
@@ -67,10 +96,31 @@ const projectHash = (dir) => {
     }
 };
 exports.projectHash = projectHash;
+// ── Remote-origin marker (ADR-0002) ──────────────────────────────
+//
+// The listener records every phone→pane text injection as a one-shot
+// marker file; a prompt-submit hook (Claude Code plugin's zeph-remote.sh,
+// or `zeph remote-hook` for Gemini/Codex) consumes it on an exact-text
+// match and flags the prompt as remote-originated. Writer and TS reader
+// share these two helpers so their bytes can never diverge; the bash
+// reader is held to the same semantics by the plugin's test suite.
+/** Marker path for a project hash: `<stateDir>/remote-<cksum(projectDir)>`. */
+const remoteMarkerPath = (hash) => (0, path_1.join)((0, exports.stateDir)(), `remote-${hash}`);
+exports.remoteMarkerPath = remoteMarkerPath;
+/**
+ * sha256 over the ASCII-only-trimmed text — recorded at inject time,
+ * recomputed at prompt submit. Trim strips ONLY ' \t\r\n\f\v', NOT
+ * String.trim(): trim() also eats Unicode whitespace (U+00A0 etc.) that
+ * the bash reader keeps, and both sides must hash identical bytes.
+ */
+const remoteDigest = (text) => (0, crypto_1.createHash)('sha256')
+    .update(text.replace(/^[ \t\r\n\f\v]+|[ \t\r\n\f\v]+$/g, ''))
+    .digest('hex');
+exports.remoteDigest = remoteDigest;
 /** True when the user ran /zeph-mute for this project. */
 const isMuted = (dir) => {
     const hash = (0, exports.projectHash)(dir);
-    return hash !== null && (0, fs_1.existsSync)(`/tmp/zeph-muted-${hash}`);
+    return hash !== null && findStateFile('muted', hash) !== null;
 };
 exports.isMuted = isMuted;
 /** The user's session push-mode dial (/zeph-quiet | /zeph-loud), default normal. */
@@ -78,8 +128,11 @@ const readPushMode = (dir) => {
     const hash = (0, exports.projectHash)(dir);
     if (!hash)
         return 'normal';
+    const file = findStateFile('pushmode', hash);
+    if (!file)
+        return 'normal';
     try {
-        return (0, exports.normalizePushMode)((0, fs_1.readFileSync)(`/tmp/zeph-pushmode-${hash}`, 'utf-8').replace(/\s+/g, ''));
+        return (0, exports.normalizePushMode)((0, fs_1.readFileSync)(file, 'utf-8').replace(/\s+/g, ''));
     }
     catch {
         return 'normal';

package/dist/installer.d.ts

@@ -4,6 +4,9 @@ import type { Agent } from './agents.js';
  * context with no existing credential (--key/env/config all absent).
  */
 export declare const shouldTriggerLogin: (nonInteractive: boolean, currentKey: string | undefined) => boolean;
+/** Exported for tests (installGemini shells out to the real `gemini` binary,
+ *  so the merge semantics can't be covered through it deterministically). */
+export declare const mergeJsonFile: (filePath: string, patch: Record<string, unknown>) => void;
 /**
  * Resolve agents from a non-interactive `--only cursor,gemini` flag.
  * Matches on agent id; unknown ids are silently dropped. Exported for

package/dist/installer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"installer.d.ts","sourceRoot":"","sources":["../src/installer.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AA2BzC;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAAI,gBAAgB,OAAO,EAAE,YAAY,MAAM,GAAG,SAAS,KAAG,OAC7D,CAAC;AA+QjC;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,UAAU,KAAK,EAAE,EAAE,MAAM,MAAM,KAAG,KAAK,EAKxE,CAAC;AA4FF,eAAO,MAAM,aAAa,GAAU,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,KAAG,OAAO,CAAC,MAAM,CAkG1F,CAAC"}
+{"version":3,"file":"installer.d.ts","sourceRoot":"","sources":["../src/installer.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AA4BzC;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAAI,gBAAgB,OAAO,EAAE,YAAY,MAAM,GAAG,SAAS,KAAG,OAC7D,CAAC;AAoBjC;6EAC6E;AAC7E,eAAO,MAAM,aAAa,GAAI,UAAU,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,IAqBhF,CAAC;AAuPF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,UAAU,KAAK,EAAE,EAAE,MAAM,MAAM,KAAG,KAAK,EAKxE,CAAC;AA4FF,eAAO,MAAM,aAAa,GAAU,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,KAAG,OAAO,CAAC,MAAM,CAkG1F,CAAC"}

package/dist/installer.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.handleInstall = exports.filterAgentsByIds = exports.shouldTriggerLogin = void 0;
+exports.handleInstall = exports.filterAgentsByIds = exports.mergeJsonFile = exports.shouldTriggerLogin = void 0;
 const child_process_1 = require("child_process");
 const fs_1 = require("fs");
 const os_1 = require("os");
@@ -34,6 +34,9 @@ const writeFile = (filePath, content) => {
     (0, fs_1.mkdirSync)((0, path_1.dirname)(filePath), { recursive: true });
     (0, fs_1.writeFileSync)(filePath, content + '\n');
 };
+const isPlainObject = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+/** Exported for tests (installGemini shells out to the real `gemini` binary,
+ *  so the merge semantics can't be covered through it deterministically). */
 const mergeJsonFile = (filePath, patch) => {
     let data = {};
     try {
@@ -41,8 +44,23 @@ const mergeJsonFile = (filePath, patch) => {
     }
     catch { /* new file */ }
     const merged = { ...data, ...patch };
+    // `hooks` maps event names to matcher-group arrays, and the user may own
+    // entries at BOTH levels (their own events, and their own groups inside
+    // an event zeph also uses) — so instead of clobbering the whole object,
+    // merge events, and inside each event zeph writes keep the user's groups
+    // and replace only zeph's own (re-runs stay idempotent).
+    if (isPlainObject(data.hooks) && isPlainObject(patch.hooks)) {
+        const hooks = { ...data.hooks };
+        for (const [event, patchGroups] of Object.entries(patch.hooks)) {
+            const prev = hooks[event];
+            const userGroups = Array.isArray(prev) ? prev.filter((g) => !(0, templates_js_1.isZephHookGroup)(g)) : [];
+            hooks[event] = [...userGroups, ...(Array.isArray(patchGroups) ? patchGroups : [])];
+        }
+        merged.hooks = hooks;
+    }
     writeFile(filePath, JSON.stringify(merged, null, 2));
 };
+exports.mergeJsonFile = mergeJsonFile;
 /**
  * Write a Zeph rule into a SHARED agent rule file (Windsurf global_rules.md,
  * Gemini GEMINI.md, Codex AGENTS.md) without clobbering the user's own
@@ -168,8 +186,8 @@ const installGemini = () => {
         fail('MCP add failed. Manual: gemini mcp add zeph -- npx -y @zeph-to/mcp-server');
     }
     try {
-        mergeJsonFile((0, path_1.join)(HOME, '.gemini', 'settings.json'), templates_js_1.GEMINI_HOOKS);
-        ok('AfterAgent hook added');
+        (0, exports.mergeJsonFile)((0, path_1.join)(HOME, '.gemini', 'settings.json'), templates_js_1.GEMINI_HOOKS);
+        ok('BeforeAgent + AfterAgent hooks added');
     }
     catch {
         fail('Hook install failed');
@@ -185,8 +203,8 @@ const installGemini = () => {
 };
 const installCodex = () => {
     try {
-        writeFile((0, path_1.join)(HOME, '.codex', 'hooks.json'), templates_js_1.CODEX_HOOKS);
-        ok('Stop hook added');
+        (0, exports.mergeJsonFile)((0, path_1.join)(HOME, '.codex', 'hooks.json'), templates_js_1.CODEX_HOOKS);
+        ok('UserPromptSubmit + Stop hooks added');
     }
     catch {
         fail('Hook install failed. Manual: add zeph to ~/.codex/hooks.json');

package/dist/listener.d.ts

@@ -207,7 +207,18 @@ interface HandlePushDeps {
     now?: () => number;
     /** Injectable for tests; defaults to the REST-backed downloader. */
     downloadAttachments?: (pushId: string, files: PushFileAttachment[]) => Promise<string[]>;
+    /** Pane cwd lookup for the remote-origin marker (ADR-0002). */
+    paneCwd?: (session: string) => string | null;
 }
+/**
+ * Record a successful phone→pane text injection so a prompt-submit hook
+ * (Claude Code plugin's zeph-remote.sh, or `zeph remote-hook` for
+ * Gemini/Codex) can flag the matching prompt as remote-originated and
+ * enter sticky REMOTE mode (ADR-0002). One file per project dir,
+ * overwritten on every inject; the hook consumes it on an exact-text match.
+ * Best-effort: a write failure must never fail the injection itself.
+ */
+export declare const writeRemoteMarker: (paneCwd: string, text: string, now?: () => number) => boolean;
 export declare const setAttachmentContext: (ctx: {
     apiKey: string;
     baseUrl: string;

package/dist/listener.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"listener.d.ts","sourceRoot":"","sources":["../src/listener.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AASH,OAAO,EAA2B,KAAK,SAAS,EAAE,KAAK,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACzG,OAAO,EAAiD,KAAK,UAAU,EAA4C,MAAM,kBAAkB,CAAC;AA4B5I,UAAU,YAAY;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,SAAS,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAYD,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAA+B,CAAC;AAenF,eAAO,MAAM,cAAc,GAAI,SAAS,MAAM,EAAE,MAAK,MAAmB,KAAG,OAgB1E,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,GAAI,SAAS,MAAM,KAAG,MAAM,GAAG,IAO7D,CAAC;AAiCF;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,MAAM,MAAM,EAAE,KAAG,MAAM,EAAE,GAAG,IAQvD,CAAC;AA0CF;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,QAAO,IAG5C,CAAC;AA8NF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM,MAAM,KAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAK3F,CAAC;AAEF,UAAU,QAAQ;IACd,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAiDD;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAAI,MAAM,QAAQ,KAAG,qBAAqB,GAAG,IAGhE,CAAC;AA0BZ,iBAAiB;AACjB,eAAO,MAAM,kBAAkB,QAAO,IAErC,CAAC;AAWF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAC3B,MAAM,MAAM,EACZ,WAAW,SAAS,EACpB,UAAU,MAAM,GAAG,IAAI,EACvB,MAAK,MAAmB,KACzB,IAAI,CAAC,YAAY,EAAE,OAAO,GAAG,gBAAgB,GAAG,aAAa,CAmB/D,CAAC;AAWF,MAAM,WAAW,YAAY;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACnB;AASD,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB,GAAI,KAAK,OAAO,KAAG,IAWhD,CAAC;AAEF,iBAAiB;AACjB,eAAO,MAAM,mBAAmB,QAAO,IAGtC,CAAC;AAEF,MAAM,WAAW,QAAQ;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GACzB,WAAW,WAAW,CAAC,MAAM,CAAC,EAC9B,UAAS,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAsB,KAC9D,QAAQ,EAgBV,CAAC;AAWF,MAAM,WAAW,aAAa;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC3B,OAAO,EAAE,uBAAuB,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,GAAI,KAAK,aAAa,KAAG,cAAc,GAAG,IA8BzE,CAAC;AAEF,MAAM,WAAW,aAAa;IAC1B,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,0EAA0E;IAC1E,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,QAAO,aAiEzC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,QAAO,YAAY,EAAuC,CAAC;AAIvF;;;;;GAKG;AACH,UAAU,kBAAkB;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,UAAU,QAAQ;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;sEACkE;IAClE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,uEAAuE;IACvE,KAAK,CAAC,EAAE,kBAAkB,EAAE,CAAC;CAChC;AAED,UAAU,cAAc;IACpB,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACpD,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;IAC1D,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,oEAAoE;IACpE,mBAAmB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAC5F;AAwDD,eAAO,MAAM,oBAAoB,GAAI,KAAK;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,IAE/E,CAAC;AA2FF;;;;GAIG;AACH,eAAO,MAAM,aAAa,GACtB,MAAK,MAAmB,EACxB,MAAK,MAAwB,EAC7B,MAAK,MAA0B,KAChC,MAaF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,GACnB,MAAM,QAAQ,EACd,OAAM,cAAmB,KAC1B,OAAO,CAAC,OAAO,CAkCjB,CAAC;AAcF,eAAO,MAAM,cAAc,GAAI,SAAS,MAAM,KAAG,MAIhD,CAAC;AASF;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,GAAI,OAAM,MAAmB,KAAG,MAGnE,CAAC;AAwPF,eAAO,MAAM,cAAc,GAAU,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,KAAG,OAAO,CAAC,MAAM,CAoH3F,CAAC"}
+{"version":3,"file":"listener.d.ts","sourceRoot":"","sources":["../src/listener.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAUH,OAAO,EAA2B,KAAK,SAAS,EAAE,KAAK,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACzG,OAAO,EAAiD,KAAK,UAAU,EAA4C,MAAM,kBAAkB,CAAC;AA4B5I,UAAU,YAAY;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,SAAS,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAYD,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAA+B,CAAC;AAenF,eAAO,MAAM,cAAc,GAAI,SAAS,MAAM,EAAE,MAAK,MAAmB,KAAG,OAgB1E,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,GAAI,SAAS,MAAM,KAAG,MAAM,GAAG,IAO7D,CAAC;AAiCF;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,MAAM,MAAM,EAAE,KAAG,MAAM,EAAE,GAAG,IAQvD,CAAC;AA0CF;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,QAAO,IAG5C,CAAC;AA8NF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM,MAAM,KAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAK3F,CAAC;AAEF,UAAU,QAAQ;IACd,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAiDD;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAAI,MAAM,QAAQ,KAAG,qBAAqB,GAAG,IAGhE,CAAC;AA0BZ,iBAAiB;AACjB,eAAO,MAAM,kBAAkB,QAAO,IAErC,CAAC;AAWF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAC3B,MAAM,MAAM,EACZ,WAAW,SAAS,EACpB,UAAU,MAAM,GAAG,IAAI,EACvB,MAAK,MAAmB,KACzB,IAAI,CAAC,YAAY,EAAE,OAAO,GAAG,gBAAgB,GAAG,aAAa,CAmB/D,CAAC;AAWF,MAAM,WAAW,YAAY;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACnB;AASD,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB,GAAI,KAAK,OAAO,KAAG,IAWhD,CAAC;AAEF,iBAAiB;AACjB,eAAO,MAAM,mBAAmB,QAAO,IAGtC,CAAC;AAEF,MAAM,WAAW,QAAQ;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GACzB,WAAW,WAAW,CAAC,MAAM,CAAC,EAC9B,UAAS,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAsB,KAC9D,QAAQ,EAgBV,CAAC;AAWF,MAAM,WAAW,aAAa;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC3B,OAAO,EAAE,uBAAuB,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,GAAI,KAAK,aAAa,KAAG,cAAc,GAAG,IA8BzE,CAAC;AAEF,MAAM,WAAW,aAAa;IAC1B,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,0EAA0E;IAC1E,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,QAAO,aAiEzC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,QAAO,YAAY,EAAuC,CAAC;AAIvF;;;;;GAKG;AACH,UAAU,kBAAkB;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,UAAU,QAAQ;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;sEACkE;IAClE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,uEAAuE;IACvE,KAAK,CAAC,EAAE,kBAAkB,EAAE,CAAC;CAChC;AAED,UAAU,cAAc;IACpB,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACpD,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;IAC1D,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,oEAAoE;IACpE,mBAAmB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACzF,+DAA+D;IAC/D,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAChD;AAwBD;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,GAC1B,SAAS,MAAM,EACf,MAAM,MAAM,EACZ,MAAK,MAAM,MAAiB,KAC7B,OAUF,CAAC;AAwCF,eAAO,MAAM,oBAAoB,GAAI,KAAK;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,IAE/E,CAAC;AA2FF;;;;GAIG;AACH,eAAO,MAAM,aAAa,GACtB,MAAK,MAAmB,EACxB,MAAK,MAAwB,EAC7B,MAAK,MAA0B,KAChC,MAaF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,GACnB,MAAM,QAAQ,EACd,OAAM,cAAmB,KAC1B,OAAO,CAAC,OAAO,CAkCjB,CAAC;AAcF,eAAO,MAAM,cAAc,GAAI,SAAS,MAAM,KAAG,MAIhD,CAAC;AAWF;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,GAAI,OAAM,MAAmB,KAAG,MAGnE,CAAC;AA8PF,eAAO,MAAM,cAAc,GAAU,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,KAAG,OAAO,CAAC,MAAM,CA+H3F,CAAC"}

package/dist/listener.js

@@ -25,7 +25,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.handleListener = exports.computeListenerDeviceId = exports.computeBackoff = exports.handlePush = exports.gcAttachments = exports.setAttachmentContext = exports.collectSessions = exports.collectSessionsVerbose = exports.handleScreenRequest = exports.collectWatchHits = exports.resetPatternWatches = exports.setPatternWatches = exports.deriveSessionState = exports.resetSessionStates = exports.detectRemoteAgent = exports.parseSessionName = exports.invalidateTmuxSocketCache = exports.resolveKeys = exports.paneCurrentCommand = exports.checkRateLimit = exports.AUTH_FAILURE_CODES = void 0;
+exports.handleListener = exports.computeListenerDeviceId = exports.computeBackoff = exports.handlePush = exports.gcAttachments = exports.setAttachmentContext = exports.writeRemoteMarker = exports.collectSessions = exports.collectSessionsVerbose = exports.handleScreenRequest = exports.collectWatchHits = exports.resetPatternWatches = exports.setPatternWatches = exports.deriveSessionState = exports.resetSessionStates = exports.detectRemoteAgent = exports.parseSessionName = exports.invalidateTmuxSocketCache = exports.resolveKeys = exports.paneCurrentCommand = exports.checkRateLimit = exports.AUTH_FAILURE_CODES = void 0;
 const child_process_1 = require("child_process");
 const crypto_1 = require("crypto");
 const fs_1 = require("fs");
@@ -33,6 +33,7 @@ const os_1 = require("os");
 const path_1 = require("path");
 const ws_1 = __importDefault(require("ws"));
 const config_js_1 = require("./config.js");
+const gate_js_1 = require("./gate.js");
 const remote_agents_js_1 = require("./remote-agents.js");
 const agent_state_js_1 = require("./agent-state.js");
 const agent_rules_fetch_js_1 = require("./agent-rules-fetch.js");
@@ -772,6 +773,29 @@ const passesInjectGuards = (session, deps) => {
     }
     return true;
 };
+/**
+ * Record a successful phone→pane text injection so a prompt-submit hook
+ * (Claude Code plugin's zeph-remote.sh, or `zeph remote-hook` for
+ * Gemini/Codex) can flag the matching prompt as remote-originated and
+ * enter sticky REMOTE mode (ADR-0002). One file per project dir,
+ * overwritten on every inject; the hook consumes it on an exact-text match.
+ * Best-effort: a write failure must never fail the injection itself.
+ */
+const writeRemoteMarker = (paneCwd, text, now = Date.now) => {
+    const hash = (0, gate_js_1.projectHash)(paneCwd);
+    if (!hash)
+        return false;
+    try {
+        (0, fs_1.mkdirSync)((0, gate_js_1.stateDir)(), { recursive: true, mode: 0o700 });
+        (0, fs_1.writeFileSync)((0, gate_js_1.remoteMarkerPath)(hash), `${Math.floor(now() / 1000)} ${(0, gate_js_1.remoteDigest)(text)}\n`);
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+exports.writeRemoteMarker = writeRemoteMarker;
+const defaultPaneCwd = (session) => readPaneInfo(session).currentPath;
 const tryInject = (session, text, deps) => {
     if (!text) {
         log(`! ${session}: empty text — drop`);
@@ -782,6 +806,11 @@ const tryInject = (session, text, deps) => {
     const ok = (deps.inject ?? injectKeys)(session, text);
     const preview = text.length > 60 ? text.slice(0, 60) + '…' : text;
     log(`${ok ? '→' : '✗'} ${session}: ${preview}`);
+    if (ok) {
+        const cwd = (deps.paneCwd ?? defaultPaneCwd)(session);
+        if (cwd)
+            (0, exports.writeRemoteMarker)(cwd, text);
+    }
     return ok;
 };
 /** Key-event sibling of tryInject: same pane/shell/rate guards, but sends
@@ -990,11 +1019,16 @@ exports.computeListenerDeviceId = computeListenerDeviceId;
  */
 const streamSession = (wsUrl, apiKey) => {
     let ws = null;
+    let opened = false;
     const done = new Promise((resolve) => {
         // deviceId + listenerNickname let the backend attach the connection
         // to a DeviceRecord (auto-created on first connect for apiKey auth).
         // Without these the `listener.sessions` reports are silently dropped
         // server-side and the phone's picker stays empty.
+        // KNOWN TRADEOFF: apiKey rides the query string, so it can land in
+        // API Gateway access logs. The $connect route can't read custom
+        // headers from every WS client; moving to first-message auth needs a
+        // server-side change (tracked upstream).
         const deviceId = (0, exports.computeListenerDeviceId)();
         const nickname = (0, os_1.hostname)() || 'listener';
         const params = new URLSearchParams({
@@ -1099,6 +1133,7 @@ const streamSession = (wsUrl, apiKey) => {
                 clearTimeout(connectTimer);
                 connectTimer = null;
             }
+            opened = true;
             lastRoundTripAt = Date.now();
             log('connected');
             // Initial inventory so the phone's picker has something to
@@ -1183,7 +1218,7 @@ const streamSession = (wsUrl, apiKey) => {
         });
         sock.on('close', (code, reasonBuf) => {
             cleanup();
-            resolve({ closeCode: code, reason: reasonBuf?.toString('utf-8') ?? '' });
+            resolve({ closeCode: code, reason: reasonBuf?.toString('utf-8') ?? '', connected: opened });
         });
     });
     return {
@@ -1312,6 +1347,11 @@ const handleListener = async (args) => {
     rulesTimer.unref();
     let shuttingDown = false;
     let activeHandle = null;
+    // Resolved by stop() so the reconnect backoff sleep below can be
+    // interrupted — otherwise a SIGINT during the (up to 30s) backoff waits
+    // out the full delay before the loop notices shuttingDown.
+    let notifyStop = () => undefined;
+    const stopped = new Promise((resolve) => { notifyStop = resolve; });
     const stop = (sig) => {
         if (shuttingDown)
             return;
@@ -1320,6 +1360,7 @@ const handleListener = async (args) => {
         // Force-close any open WS so the streamSession promise resolves
         // immediately instead of waiting for the server to drop us.
         activeHandle?.terminate();
+        notifyStop();
     };
     process.on('SIGINT', () => stop('SIGINT'));
     process.on('SIGTERM', () => stop('SIGTERM'));
@@ -1335,9 +1376,14 @@ const handleListener = async (args) => {
         }
         if (shuttingDown)
             break;
+        // A session that actually connected resets the backoff — otherwise a
+        // long-lived daemon on a flaky link ratchets up to the 30s ceiling
+        // permanently, even when every reconnect succeeds instantly.
+        if (result.connected)
+            attempt = 0;
         const delay = (0, exports.computeBackoff)(attempt);
         log(`disconnected (code=${result.closeCode}) — reconnect in ${Math.round(delay / 1000)}s`);
-        await sleep(delay);
+        await Promise.race([sleep(delay), stopped]);
         attempt = Math.min(attempt + 1, 10);
     }
     removeListenerPid();