@zeph-to/cli 1.20.0 → 1.22.0

package/README.md

@@ -33,36 +33,50 @@ npx @zeph-to/cli notify --title "Hello"
 
 ## Quick Start
 
-```bash
-# Sign in via browser — auto-fetches your API key + hook into
-# ~/.zeph/config.json (no copy-paste)
-npx @zeph-to/cli login
+Install the CLI globally, then run setup:
 
-# Install for your AI agents (rules + hooks + MCP). Reuses the saved
-# config; detects Claude Code / Cursor / Windsurf / Gemini / Codex / …
-npx @zeph-to/cli install
+```bash
+npm install -g @zeph-to/cli
+zeph install
 ```
 
-`login` opens a browser to the Zeph web app, asks you to confirm "connect
-this computer", then issues a fresh API key (labelled with your hostname)
-and reuses or creates a hook — writing both back to `~/.zeph/config.json`
-over a localhost loopback. No credential ever gets pasted into the
-terminal.
+`zeph install` opens a browser sign-in on a fresh machine — the web app
+issues an API key + hook as a matched pair and the CLI writes them to
+`~/.zeph/config.json` (no copy-paste). Then it installs rules + hooks +
+MCP for every detected agent (Claude Code / Cursor / Windsurf / Gemini /
+Codex / …). Safe to re-run: a saved login is reused untouched (no
+prompts), so a re-run just refreshes the agent integrations. To switch
+account, `zeph install --relogin` forces a fresh sign-in.
+
+**Why global, not `npx`?** `zeph cc` (drive a session from your phone)
+needs `zeph` on your `PATH`, and the agent hooks this installs are
+`$(command -v zeph || npx …)` — a global binary skips an npx cold-start
+on *every* notification. For notifications only, with no phone control,
+`npx @zeph-to/cli install` is a lighter alternative that skips the global
+binary.
 
-Prefer to paste credentials yourself (or on a headless box with no
-browser)? Skip `login` and pass them to `install` directly:
+`~/.zeph/config.json` is the single source of truth — the CLI, the MCP
+server, the plugin hooks, and the listener all read it. You never need
+`ZEPH_API_KEY`-style env vars for a normal setup; they exist as overrides
+(second account, CI).
+
+Variants:
 
 ```bash
-npx @zeph-to/cli install --key ak_... --hook hook_...
-```
+# Headless box (no browser): paste credentials from another machine's
+# ~/.zeph/config.json
+zeph install --key ak_... --hook hook_...
 
-Either way it saves to `~/.zeph/config.json`. All Zeph tools (CLI, MCP
-server, plugin hooks, listener) read this file.
+# Skip the interactive agent picker
+zeph install --only claude,cursor
 
-On a fresh machine `install` alone is enough: with no `--key` and no
-saved config it opens the same browser login automatically (headless
-boxes fall back to manual key entry). Pass `--only claude,cursor,…` to
-skip the interactive agent picker.
+# Switch account — force a fresh browser sign-in over a saved login
+zeph install --relogin
+
+# Refresh credentials only (no agent re-install) — assumes you already
+# ran `zeph install` once; on its own it does NOT wire MCP into agents
+zeph login
+```
 
 To **send** notifications:
 

package/dist/cli.js

@@ -107,10 +107,13 @@ Login options:
 
 Install options:
   (no --key, no saved config → opens browser login automatically;
-   headless falls back to manual key entry)
+   a saved login is reused untouched on re-run; headless falls back
+   to manual key entry)
   --key <api-key>    API key (non-interactive; skips browser login)
   --hook <hook-id>   Hook ID (non-interactive)
   --base-url <url>   Base URL (non-interactive)
+  --relogin          Force a fresh browser sign-in even if a login is
+                     already saved (switch account)
   --web-url <url>    Login web app URL [default: https://app.zeph.to]
   --only <agents>    Comma-separated agent ids to install for
                      (claude,cursor,windsurf,gemini,codex,copilot,cline,aider).

package/dist/installer.d.ts

@@ -3,7 +3,12 @@ import type { Agent } from './agents.js';
  * True when install should auto-open browser login (ADR 0002): interactive
  * context with no existing credential (--key/env/config all absent).
  */
-export declare const shouldTriggerLogin: (nonInteractive: boolean, currentKey: string | undefined) => boolean;
+/**
+ * Interactive install, past the `--key` path: open a browser login only when
+ * there's nothing saved yet, or the user explicitly asked to re-authenticate
+ * with `--relogin`. A plain re-run keeps the saved login untouched.
+ */
+export declare const shouldReauth: (currentKey: string | undefined, relogin: boolean) => boolean;
 /** Exported for tests (installGemini shells out to the real `gemini` binary,
  *  so the merge semantics can't be covered through it deterministically). */
 export declare const mergeJsonFile: (filePath: string, patch: Record<string, unknown>) => void;

package/dist/installer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"installer.d.ts","sourceRoot":"","sources":["../src/installer.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AA4BzC;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAAI,gBAAgB,OAAO,EAAE,YAAY,MAAM,GAAG,SAAS,KAAG,OAC7D,CAAC;AAoBjC;6EAC6E;AAC7E,eAAO,MAAM,aAAa,GAAI,UAAU,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,IAqBhF,CAAC;AAgQF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,UAAU,KAAK,EAAE,EAAE,MAAM,MAAM,KAAG,KAAK,EAKxE,CAAC;AA4FF,eAAO,MAAM,aAAa,GAAU,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,KAAG,OAAO,CAAC,MAAM,CAkG1F,CAAC"}
+{"version":3,"file":"installer.d.ts","sourceRoot":"","sources":["../src/installer.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AA4BzC;;;GAGG;AACH;;;;GAIG;AACH,eAAO,MAAM,YAAY,GAAI,YAAY,MAAM,GAAG,SAAS,EAAE,SAAS,OAAO,KAAG,OACxD,CAAC;AAoBzB;6EAC6E;AAC7E,eAAO,MAAM,aAAa,GAAI,UAAU,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,IAqBhF,CAAC;AAgQF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,UAAU,KAAK,EAAE,EAAE,MAAM,MAAM,KAAG,KAAK,EAKxE,CAAC;AA8EF,eAAO,MAAM,aAAa,GAAU,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,KAAG,OAAO,CAAC,MAAM,CAkG1F,CAAC"}

package/dist/installer.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.handleInstall = exports.filterAgentsByIds = exports.mergeJsonFile = exports.shouldTriggerLogin = void 0;
+exports.handleInstall = exports.filterAgentsByIds = exports.mergeJsonFile = exports.shouldReauth = void 0;
 const child_process_1 = require("child_process");
 const fs_1 = require("fs");
 const os_1 = require("os");
@@ -19,8 +19,13 @@ const fail = (msg) => console.log(`    - ${msg}`);
  * True when install should auto-open browser login (ADR 0002): interactive
  * context with no existing credential (--key/env/config all absent).
  */
-const shouldTriggerLogin = (nonInteractive, currentKey) => !nonInteractive && !currentKey;
-exports.shouldTriggerLogin = shouldTriggerLogin;
+/**
+ * Interactive install, past the `--key` path: open a browser login only when
+ * there's nothing saved yet, or the user explicitly asked to re-authenticate
+ * with `--relogin`. A plain re-run keeps the saved login untouched.
+ */
+const shouldReauth = (currentKey, relogin) => !currentKey || relogin;
+exports.shouldReauth = shouldReauth;
 const promptInput = (question) => {
     const rl = (0, readline_1.createInterface)({ input: process.stdin, output: process.stdout });
     return new Promise((resolve) => {
@@ -348,26 +353,12 @@ const testConnection = async (apiKey, baseUrl) => {
         return false;
     }
 };
-/** Interactive path when a credential already exists: prompt to keep/replace. */
-const promptExistingCredentials = async (currentKey, existing) => {
-    if (currentKey)
-        console.log(`  Current API Key: ${currentKey.slice(0, 12)}...`);
-    const keyInput = await promptInput(currentKey ? '  New API Key (Enter to keep): ' : '  API Key (from app > Settings > API Keys): ');
-    const currentHook = (0, config_js_1.resolvedEnv)('ZEPH_HOOK_ID') || existing.hookId;
-    if (currentHook)
-        console.log(`  Current Hook ID: ${currentHook}`);
-    const hookInput = await promptInput(currentHook ? '  New Hook ID (Enter to keep, "none" to remove): ' : '  Hook ID (optional, for prompt/input): ');
-    return {
-        apiKey: keyInput || currentKey,
-        hookId: hookInput === 'none' ? undefined : (hookInput || currentHook),
-        baseUrl: existing.baseUrl,
-    };
-};
 /**
- * Resolve API key + hook for install. Priority: --key/env/config (non-interactive
- * or "keep existing") → brand-new interactive opens browser login (ADR 0002),
- * falling back to manual paste when headless. wsUrl/deviceId from a login are
- * persisted by runLoginFlow and re-read at config-save time.
+ * Resolve API key + hook for install. Priority: --key/env/config (non-interactive)
+ * → a saved login is reused untouched on re-run → otherwise a brand-new
+ * interactive install opens browser login (ADR 0002), falling back to manual
+ * paste when headless. wsUrl/deviceId from a login are persisted by
+ * runLoginFlow and re-read at config-save time.
  */
 const collectCredentials = async (args, installArgs, nonInteractive, existing) => {
     if (nonInteractive) {
@@ -379,8 +370,15 @@ const collectCredentials = async (args, installArgs, nonInteractive, existing) =
     }
     console.log('');
     const currentKey = (0, config_js_1.resolvedEnv)('ZEPH_API_KEY') || existing.apiKey;
-    if (!(0, exports.shouldTriggerLogin)(nonInteractive, currentKey)) {
-        return promptExistingCredentials(currentKey, existing);
+    // Re-run with a saved login: reuse it silently and move on to agent wiring.
+    // Switching accounts is `zeph login` or `zeph install --relogin`.
+    if (!(0, exports.shouldReauth)(currentKey, args.relogin === true)) {
+        console.log(`  Using saved login (${currentKey.slice(0, 12)}…). Run \`zeph install --relogin\` to switch account.`);
+        return {
+            apiKey: currentKey,
+            hookId: (0, config_js_1.resolvedEnv)('ZEPH_HOOK_ID') || existing.hookId,
+            baseUrl: existing.baseUrl,
+        };
     }
     const result = await (0, login_js_1.runLoginFlow)({
         webUrl: (0, login_js_1.resolveWebUrl)(args['web-url']),

package/dist/listener.d.ts

@@ -266,6 +266,17 @@ export declare const gcAttachments: (now?: number, dir?: string, ttl?: number) =
 export declare const handlePush: (push: PushItem, deps?: HandlePushDeps) => Promise<boolean>;
 export declare const computeBackoff: (attempt: number) => number;
 export declare const computeListenerDeviceId: (host?: string) => string;
+/**
+ * A user who only set ZEPH_API_KEY (no `zeph login`, no config file) gets the
+ * prod socket by default — mirroring the DEFAULT_API_BASE fallback for REST.
+ * The default only applies when the base URL is also the prod default: with a
+ * custom base URL, silently pointing the listener at the prod socket while
+ * REST talks to another stage would split the device across environments, so
+ * that combination still errors loudly.
+ */
+export declare const resolveWsUrl: (args: Record<string, string | boolean>, config: {
+    wsUrl?: string;
+}, baseUrl: string) => string | null;
 export declare const handleListener: (args: Record<string, string | boolean>) => Promise<number>;
 export {};
 //# sourceMappingURL=listener.d.ts.map

package/dist/listener.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"listener.d.ts","sourceRoot":"","sources":["../src/listener.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAUH,OAAO,EAA2B,KAAK,SAAS,EAAE,KAAK,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACzG,OAAO,EAAiD,KAAK,UAAU,EAA4C,MAAM,kBAAkB,CAAC;AAoC5I,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAElD,UAAU,YAAY;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,SAAS,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,GAAI,UAAU,YAAY,EAAE,KAAG,MAS7C,CAAC;AAEnB;6BAC6B;AAC7B,eAAO,MAAM,iBAAiB,GAC1B,aAAa,MAAM,EACnB,qBAAqB,MAAM,GAAG,IAAI,EAClC,cAAc,MAAM,EACpB,OAAO,MAAM,KACd,OAEoD,CAAC;AAYxD,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAA+B,CAAC;AAenF,eAAO,MAAM,cAAc,GAAI,SAAS,MAAM,EAAE,MAAK,MAAmB,KAAG,OAgB1E,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,GAAI,SAAS,MAAM,KAAG,MAAM,GAAG,IAO7D,CAAC;AAiCF;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,MAAM,MAAM,EAAE,KAAG,MAAM,EAAE,GAAG,IAQvD,CAAC;AA0CF;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,QAAO,IAG5C,CAAC;AA8NF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM,MAAM,KAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAK3F,CAAC;AAEF,UAAU,QAAQ;IACd,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAiDD;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAAI,MAAM,QAAQ,KAAG,qBAAqB,GAAG,IAGhE,CAAC;AA0BZ,iBAAiB;AACjB,eAAO,MAAM,kBAAkB,QAAO,IAErC,CAAC;AAWF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAC3B,MAAM,MAAM,EACZ,WAAW,SAAS,EACpB,UAAU,MAAM,GAAG,IAAI,EACvB,MAAK,MAAmB,KACzB,IAAI,CAAC,YAAY,EAAE,OAAO,GAAG,gBAAgB,GAAG,aAAa,CAmB/D,CAAC;AAWF,MAAM,WAAW,YAAY;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACnB;AASD,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB,GAAI,KAAK,OAAO,KAAG,IAWhD,CAAC;AAEF,iBAAiB;AACjB,eAAO,MAAM,mBAAmB,QAAO,IAGtC,CAAC;AAEF,MAAM,WAAW,QAAQ;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GACzB,WAAW,WAAW,CAAC,MAAM,CAAC,EAC9B,UAAS,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAsB,KAC9D,QAAQ,EAgBV,CAAC;AAWF,MAAM,WAAW,aAAa;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC3B,OAAO,EAAE,uBAAuB,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,GAAI,KAAK,aAAa,KAAG,cAAc,GAAG,IAmBzE,CAAC;AA6BF;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,GAChC,aAAa,MAAM,EACnB,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,EAC7C,SAAQ,MAAM,EAA8B,KAC7C,IAiBF,CAAC;AAEF,MAAM,WAAW,aAAa;IAC1B,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,0EAA0E;IAC1E,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,QAAO,aAiEzC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,QAAO,YAAY,EAAuC,CAAC;AAIvF;;;;;GAKG;AACH,UAAU,kBAAkB;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,UAAU,QAAQ;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;sEACkE;IAClE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,uEAAuE;IACvE,KAAK,CAAC,EAAE,kBAAkB,EAAE,CAAC;CAChC;AAED,UAAU,cAAc;IACpB,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACpD,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;IAC1D,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,oEAAoE;IACpE,mBAAmB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACzF,+DAA+D;IAC/D,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAC7C;sEACkE;IAClE,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9C;AAwBD;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,GAC1B,SAAS,MAAM,EACf,MAAM,MAAM,EACZ,MAAK,MAAM,MAAiB,KAC7B,OAUF,CAAC;AAwCF,eAAO,MAAM,oBAAoB,GAAI,KAAK;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,IAE/E,CAAC;AA2FF;;;;GAIG;AACH,eAAO,MAAM,aAAa,GACtB,MAAK,MAAmB,EACxB,MAAK,MAAwB,EAC7B,MAAK,MAA0B,KAChC,MAaF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,GACnB,MAAM,QAAQ,EACd,OAAM,cAAmB,KAC1B,OAAO,CAAC,OAAO,CAoCjB,CAAC;AAcF,eAAO,MAAM,cAAc,GAAI,SAAS,MAAM,KAAG,MAIhD,CAAC;AA0BF,eAAO,MAAM,uBAAuB,GAAI,OAAO,MAAM,KAAG,MAUvD,CAAC;AAqRF,eAAO,MAAM,cAAc,GAAU,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,KAAG,OAAO,CAAC,MAAM,CA+H3F,CAAC"}
+{"version":3,"file":"listener.d.ts","sourceRoot":"","sources":["../src/listener.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAUH,OAAO,EAA2B,KAAK,SAAS,EAAE,KAAK,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACzG,OAAO,EAAiD,KAAK,UAAU,EAA4C,MAAM,kBAAkB,CAAC;AAoC5I,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAElD,UAAU,YAAY;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,SAAS,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,GAAI,UAAU,YAAY,EAAE,KAAG,MAS7C,CAAC;AAEnB;6BAC6B;AAC7B,eAAO,MAAM,iBAAiB,GAC1B,aAAa,MAAM,EACnB,qBAAqB,MAAM,GAAG,IAAI,EAClC,cAAc,MAAM,EACpB,OAAO,MAAM,KACd,OAEoD,CAAC;AAYxD,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAA+B,CAAC;AAenF,eAAO,MAAM,cAAc,GAAI,SAAS,MAAM,EAAE,MAAK,MAAmB,KAAG,OAgB1E,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,GAAI,SAAS,MAAM,KAAG,MAAM,GAAG,IAO7D,CAAC;AAiCF;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,MAAM,MAAM,EAAE,KAAG,MAAM,EAAE,GAAG,IAQvD,CAAC;AA0CF;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,QAAO,IAG5C,CAAC;AA8NF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM,MAAM,KAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAK3F,CAAC;AAEF,UAAU,QAAQ;IACd,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAiDD;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAAI,MAAM,QAAQ,KAAG,qBAAqB,GAAG,IAGhE,CAAC;AA0BZ,iBAAiB;AACjB,eAAO,MAAM,kBAAkB,QAAO,IAErC,CAAC;AAWF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAC3B,MAAM,MAAM,EACZ,WAAW,SAAS,EACpB,UAAU,MAAM,GAAG,IAAI,EACvB,MAAK,MAAmB,KACzB,IAAI,CAAC,YAAY,EAAE,OAAO,GAAG,gBAAgB,GAAG,aAAa,CAmB/D,CAAC;AAWF,MAAM,WAAW,YAAY;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACnB;AASD,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB,GAAI,KAAK,OAAO,KAAG,IAWhD,CAAC;AAEF,iBAAiB;AACjB,eAAO,MAAM,mBAAmB,QAAO,IAGtC,CAAC;AAEF,MAAM,WAAW,QAAQ;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GACzB,WAAW,WAAW,CAAC,MAAM,CAAC,EAC9B,UAAS,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAsB,KAC9D,QAAQ,EAgBV,CAAC;AAWF,MAAM,WAAW,aAAa;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC3B,OAAO,EAAE,uBAAuB,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,GAAI,KAAK,aAAa,KAAG,cAAc,GAAG,IAmBzE,CAAC;AA6BF;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,GAChC,aAAa,MAAM,EACnB,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,EAC7C,SAAQ,MAAM,EAA8B,KAC7C,IAiBF,CAAC;AAEF,MAAM,WAAW,aAAa;IAC1B,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,0EAA0E;IAC1E,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,QAAO,aAiEzC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,QAAO,YAAY,EAAuC,CAAC;AAIvF;;;;;GAKG;AACH,UAAU,kBAAkB;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,UAAU,QAAQ;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;sEACkE;IAClE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,uEAAuE;IACvE,KAAK,CAAC,EAAE,kBAAkB,EAAE,CAAC;CAChC;AAED,UAAU,cAAc;IACpB,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACpD,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;IAC1D,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,oEAAoE;IACpE,mBAAmB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACzF,+DAA+D;IAC/D,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAC7C;sEACkE;IAClE,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9C;AAwBD;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,GAC1B,SAAS,MAAM,EACf,MAAM,MAAM,EACZ,MAAK,MAAM,MAAiB,KAC7B,OAUF,CAAC;AAwCF,eAAO,MAAM,oBAAoB,GAAI,KAAK;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,IAE/E,CAAC;AA2FF;;;;GAIG;AACH,eAAO,MAAM,aAAa,GACtB,MAAK,MAAmB,EACxB,MAAK,MAAwB,EAC7B,MAAK,MAA0B,KAChC,MAaF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,GACnB,MAAM,QAAQ,EACd,OAAM,cAAmB,KAC1B,OAAO,CAAC,OAAO,CAoCjB,CAAC;AAcF,eAAO,MAAM,cAAc,GAAI,SAAS,MAAM,KAAG,MAIhD,CAAC;AA4DF,eAAO,MAAM,uBAAuB,GAAI,OAAO,MAAM,KAAG,MA2BvD,CAAC;AAuOF;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,GACrB,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EACtC,QAAQ;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EAC1B,SAAS,MAAM,KAChB,MAAM,GAAG,IAIX,CAAC;AA6CF,eAAO,MAAM,cAAc,GAAU,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,KAAG,OAAO,CAAC,MAAM,CA+H3F,CAAC"}

package/dist/listener.js

@@ -25,7 +25,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.handleListener = exports.computeListenerDeviceId = exports.computeBackoff = exports.handlePush = exports.gcAttachments = exports.setAttachmentContext = exports.writeRemoteMarker = exports.collectSessions = exports.collectSessionsVerbose = exports.scheduleInjectSnapshots = exports.handleScreenRequest = exports.collectWatchHits = exports.resetPatternWatches = exports.setPatternWatches = exports.deriveSessionState = exports.resetSessionStates = exports.detectRemoteAgent = exports.parseSessionName = exports.invalidateTmuxSocketCache = exports.resolveKeys = exports.paneCurrentCommand = exports.checkRateLimit = exports.AUTH_FAILURE_CODES = exports.sessionsReportDue = exports.sessionsFingerprint = exports.SESSION_REPORT_HEARTBEAT_MS = void 0;
+exports.handleListener = exports.resolveWsUrl = exports.computeListenerDeviceId = exports.computeBackoff = exports.handlePush = exports.gcAttachments = exports.setAttachmentContext = exports.writeRemoteMarker = exports.collectSessions = exports.collectSessionsVerbose = exports.scheduleInjectSnapshots = exports.handleScreenRequest = exports.collectWatchHits = exports.resetPatternWatches = exports.setPatternWatches = exports.deriveSessionState = exports.resetSessionStates = exports.detectRemoteAgent = exports.parseSessionName = exports.invalidateTmuxSocketCache = exports.resolveKeys = exports.paneCurrentCommand = exports.checkRateLimit = exports.AUTH_FAILURE_CODES = exports.sessionsReportDue = exports.sessionsFingerprint = exports.SESSION_REPORT_HEARTBEAT_MS = void 0;
 const child_process_1 = require("child_process");
 const crypto_1 = require("crypto");
 const fs_1 = require("fs");
@@ -1082,23 +1082,75 @@ exports.computeBackoff = computeBackoff;
  * time `zeph listener` rebinds). `dev_listener_<sha8(hostname)>` keeps it
  * human-recognisable in dev logs without leaking the raw hostname.
  *
- * The no-arg result is pinned for the process lifetime: macOS renames the
- * hostname with network changes, and a mid-run drift made the screen-peek
- * check (fresh recompute) reject requests addressed to the id we CONNECTED
- * with — the phone targets the id the sessions were reported under, so
- * every caller in one process must see the same value.
+ * The no-arg result must identify the MACHINE, stably:
+ * - NOT the hostname: macOS rewrites it on network changes (observed
+ *   flip-flopping between 'Mac' and '<name>.local' within hours), which
+ *   split one machine into several device rows — duplicated session lists
+ *   on the phone, and screen-peek requests addressed to an id no live
+ *   process answers for.
+ * - NOT a file under ~/.zeph alone: users copy ~/.zeph to a new machine
+ *   to carry their API key, and a copied id makes two machines answer for
+ *   each other.
+ * So: hash the platform machine id (IOPlatformUUID / /etc/machine-id) —
+ * deterministic per machine, immune to both. The sticky file is only the
+ * fallback for platforms where no machine id is readable.
  */
 let processListenerDeviceId;
+const LISTENER_ID_FILE = (0, path_1.join)((0, os_1.homedir)(), '.zeph', 'listener-device-id');
+const hashListenerId = (seed) => `dev_listener_${(0, crypto_1.createHash)('sha256').update(seed).digest('hex').slice(0, 8)}`;
+const readMachineId = () => {
+    try {
+        if (process.platform === 'darwin') {
+            const r = (0, child_process_1.spawnSync)('ioreg', ['-rd1', '-c', 'IOPlatformExpertDevice'], {
+                encoding: 'utf-8',
+                stdio: ['ignore', 'pipe', 'ignore'],
+            });
+            const m = r.stdout?.match(/"IOPlatformUUID"\s*=\s*"([^"]+)"/);
+            if (m)
+                return m[1];
+        }
+        if (process.platform === 'linux') {
+            for (const p of ['/etc/machine-id', '/var/lib/dbus/machine-id']) {
+                try {
+                    const v = (0, fs_1.readFileSync)(p, 'utf-8').trim();
+                    if (v)
+                        return v;
+                }
+                catch { /* try next */ }
+            }
+        }
+    }
+    catch { /* fall through to the sticky-file fallback */ }
+    return null;
+};
 const computeListenerDeviceId = (host) => {
-    if (host !== undefined) {
-        const h = (0, crypto_1.createHash)('sha256').update(host).digest('hex').slice(0, 8);
-        return `dev_listener_${h}`;
+    if (host !== undefined)
+        return hashListenerId(host);
+    if (processListenerDeviceId)
+        return processListenerDeviceId;
+    const machineId = readMachineId();
+    if (machineId) {
+        processListenerDeviceId = hashListenerId(machineId);
+        return processListenerDeviceId;
     }
-    if (!processListenerDeviceId) {
-        const h = (0, crypto_1.createHash)('sha256').update((0, os_1.hostname)()).digest('hex').slice(0, 8);
-        processListenerDeviceId = `dev_listener_${h}`;
+    // No readable machine id — pin the first hostname-derived id to a file
+    // so at least hostname drift can't split this machine.
+    try {
+        const saved = (0, fs_1.readFileSync)(LISTENER_ID_FILE, 'utf-8').trim();
+        if (/^dev_listener_[0-9a-f]{8}$/.test(saved)) {
+            processListenerDeviceId = saved;
+            return saved;
+        }
     }
-    return processListenerDeviceId;
+    catch { /* first run — fall through to compute + persist */ }
+    const fresh = hashListenerId((0, os_1.hostname)());
+    try {
+        (0, fs_1.mkdirSync)((0, path_1.join)((0, os_1.homedir)(), '.zeph'), { recursive: true });
+        (0, fs_1.writeFileSync)(LISTENER_ID_FILE, fresh);
+    }
+    catch { /* persistence is best-effort; in-memory pin still holds */ }
+    processListenerDeviceId = fresh;
+    return fresh;
 };
 exports.computeListenerDeviceId = computeListenerDeviceId;
 /**
@@ -1337,10 +1389,21 @@ const streamSession = (wsUrl, apiKey) => {
         terminate: () => { ws?.terminate(); },
     };
 };
-const resolveWsUrl = (args, config) => {
+const DEFAULT_WS_URL = 'wss://ws.zeph.to';
+/**
+ * A user who only set ZEPH_API_KEY (no `zeph login`, no config file) gets the
+ * prod socket by default — mirroring the DEFAULT_API_BASE fallback for REST.
+ * The default only applies when the base URL is also the prod default: with a
+ * custom base URL, silently pointing the listener at the prod socket while
+ * REST talks to another stage would split the device across environments, so
+ * that combination still errors loudly.
+ */
+const resolveWsUrl = (args, config, baseUrl) => {
     const fromArg = typeof args['ws-url'] === 'string' ? args['ws-url'] : null;
-    return fromArg || (0, config_js_1.resolvedEnv)('ZEPH_WS_URL') || config.wsUrl || null;
+    return fromArg || (0, config_js_1.resolvedEnv)('ZEPH_WS_URL') || config.wsUrl
+        || (baseUrl === DEFAULT_API_BASE ? DEFAULT_WS_URL : null);
 };
+exports.resolveWsUrl = resolveWsUrl;
 // ── Singleton guard (PID file) ──────────────────────────────────────
 const ZEPH_DIR = (0, path_1.join)((0, os_1.homedir)(), '.zeph');
 const LISTENER_PID_FILE = (0, path_1.join)(ZEPH_DIR, 'listener.pid');
@@ -1411,7 +1474,7 @@ const handleListener = async (args) => {
     // resolution order as the rest of the CLI; falls back to the prod API.
     const baseUrl = args['base-url'] || (0, config_js_1.resolvedEnv)('ZEPH_BASE_URL') || config.baseUrl || DEFAULT_API_BASE;
     (0, exports.setAttachmentContext)({ apiKey, baseUrl });
-    const wsUrl = resolveWsUrl(args, config);
+    const wsUrl = (0, exports.resolveWsUrl)(args, config, baseUrl);
     if (!wsUrl) {
         console.error('zeph listener: WebSocket URL not set. Either:\n' +
             '  • add "wsUrl": "wss://..." to ~/.zeph/config.json\n' +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zeph-to/cli",
-  "version": "1.20.0",
+  "version": "1.22.0",
   "description": "Zeph CLI + push notification SDK for AI agents",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",