@zeph-to/cli 1.26.1 → 1.27.1

package/README.md

@@ -7,7 +7,7 @@
 
 **Your agent works, hits a decision, and asks your phone. You tap a button (or type a reply), and the answer lands back in the live session — so the agent keeps going.**
 
-`@zeph-to/cli` is the terminal side of that round trip: a zero-dependency push SDK, a `zeph` CLI that wires up 8 AI agents in one command, and a resident listener that lets your phone **drive Claude Code / Codex / Gemini sessions** by typing straight into named tmux sessions.
+`@zeph-to/cli` is the terminal side of that round trip: a zero-dependency push SDK, a `zeph` CLI that wires up 8 AI agents in one command, and a resident listener that lets your phone **drive Claude Code / Codex / Cursor / Gemini sessions** by typing straight into named tmux sessions.
 
 <p align="center">
   <img src="https://zeph.to/readme/demo.gif" alt="Agent asks 'Deploy to prod?' on your phone; you tap Deploy; the session ships" width="560"><br>
@@ -78,7 +78,7 @@ To **send** notifications:
 zeph notify --title "Deploy done" --body "v2.1.0 shipped"
 ```
 
-To **drive a Claude Code / Codex / Gemini session from your phone**, see
+To **drive a Claude Code / Codex / Cursor / Gemini session from your phone**, see
 [Remote Control](#remote-control) below.
 
 ## Remote Control
@@ -111,7 +111,7 @@ tmux session via `tmux send-keys`.
 [zeph listener — resident daemon, started by `zeph cc` automatically]
    │  tmux send-keys -l -t zeph-myapp "리팩토링 마무리해줘" + Enter
    ▼
-[tmux session "zeph-myapp" running claude / codex / gemini]
+[tmux session "zeph-myapp" running claude / codex / cursor-agent / gemini]
 ```
 
 The listener polls its tmux session inventory every 5 seconds and
@@ -136,10 +136,29 @@ an answerable `zeph_ask`).
 | Claude Code | `UserPromptSubmit` → plugin's `zeph-remote.sh` | Zeph plugin |
 | Gemini CLI | `BeforeAgent` → `zeph remote-hook gemini` | `zeph setup` |
 | Codex CLI | `UserPromptSubmit` → `zeph remote-hook codex` | `zeph setup` |
+| Cursor CLI | — none yet | — |
 
 Detection is exact-match: a terminal keystroke racing a phone message
 can never false-flag. Muted projects are never flagged.
 
+`zeph cursor` has no remote-origin hook, so it never enters sticky REMOTE
+mode by itself. **Just ask for it** — one line, once per session:
+
+> I'm driving this session from my phone. End every response with
+> `zeph_ask` so I can answer with a button.
+
+Nothing else is missing: injection works, and the MCP tools are all
+there, `zeph_ask` included. Check them with `cursor-agent mcp list-tools
+zeph` — `mcp list` prints only the *approved* list, not what's
+configured, so it reads as empty even when the server is wired up.
+
+Why it isn't automatic: `hooks.json` is honored by the Cursor IDE but not
+by `cursor-agent`, and `beforeSubmitPrompt`'s output schema is
+`{continue, user_message}` — no context channel to deliver a marker match
+through. Same reason the `stop`-hook auto-push `zeph setup` installs
+covers the Cursor **IDE** but not `zeph cursor` panes; ask for a
+`zeph_notify` when you want one.
+
 ### Setup
 
 1. **Install tmux.** The listener uses `send-keys`; the wrapper spawns
@@ -162,11 +181,16 @@ can never false-flag. Muted projects are never flagged.
 3. **Run agents through the wrapper.** That's it.
 
    ```bash
-   zeph cc        # claude  → tmux session "zeph-<project>"
-   zeph codex     # codex   → tmux session "zeph-<project>"
-   zeph gemini    # gemini  → tmux session "zeph-<project>"
+   zeph cc        # claude       → tmux session "zeph-<project>"
+   zeph codex     # codex        → tmux session "zeph-<project>"
+   zeph cursor    # cursor-agent → tmux session "zeph-<project>"
+   zeph gemini    # gemini       → tmux session "zeph-<project>"
    ```
 
+   `zeph cursor` runs **`cursor-agent`**, Cursor's terminal agent — a
+   separate install from the Cursor IDE (the bare `cursor` on your PATH
+   is the editor launcher, which exits immediately and can't be driven).
+
    The first `zeph cc` on a machine **auto-spawns a background
    listener** (singleton, PID file at `~/.zeph/listener.pid`,
    stdout/stderr at `~/.zeph/listener.log`). You never run
@@ -360,6 +384,7 @@ zeph test
 # Run an agent in a named tmux session (so the listener can reach it)
 zeph cc                       # claude
 zeph codex                    # codex
+zeph cursor                   # cursor-agent (Cursor CLI, not the IDE)
 zeph gemini                   # gemini
 
 # Run the resident listener (foreground; background it as you like)

package/dist/crypto.d.ts

@@ -42,6 +42,18 @@ interface EncryptedPayload {
 export declare const initCrypto: (apiKey?: string, baseUrl?: string) => Promise<string>;
 export declare const getKeyPair: () => CryptoKeyPair | null;
 export declare const getPublicKey: () => string | null;
+/**
+ * Drop the cached keys so every later send goes out as plaintext.
+ *
+ * Callers use this when the server rejects an encrypted send with
+ * `PRO_REQUIRED` (ADR-0008): E2E is a Pro feature, and a long-lived process
+ * that initialized crypto before a downgrade would otherwise 403 on every push.
+ * Same end state as the "server says encryption disabled" branch in initCrypto.
+ * Keys on disk are left alone, but this process will not pick them up again:
+ * `initCrypto` is memoized on `initPromise` and `ZephHook.ensureCrypto` short-
+ * circuits on `cryptoInitialized`. A restart after an upgrade re-adopts them.
+ */
+export declare const disableCrypto: () => void;
 /**
  * Encrypt push body for a recipient.
  * Returns fields ready to merge into the sendPush payload.

package/dist/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AA+EH,UAAU,gBAAgB;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf;AA6ED;;;;;GAKG;AACH,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,EAAE,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CAsE5E,CAAC;AA2CF,eAAO,MAAM,UAAU,QAAO,aAAa,GAAG,IAAqB,CAAC;AACpE,eAAO,MAAM,YAAY,QAAO,MAAM,GAAG,IAA+B,CAAC;AAEzE;;;GAGG;AACH,eAAO,MAAM,eAAe,GAC1B,OAAO;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,EACtD,uBAAuB,MAAM,KAC5B,OAAO,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,IAAI,CAAC;CACnB,CAeA,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,sBAAsB,GACjC,OAAO;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,KACrD,OAAO,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,IAAI,CAAC;CACnB,CAaA,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,GAClC,SAAS,MAAM,EACf,uBAAuB,MAAM,KAC5B,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CASlE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,kBAAkB,GAC7B,SAAS,MAAM,KACd,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAQlE,CAAC;AAWF;;;;GAIG;AACH,MAAM,WAAW,yBAA0B,SAAQ,gBAAgB;IACjE,eAAe,EAAE,MAAM,CAAC;CACzB;AAsBD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,QAAO,OAAO,CAAC,MAAM,CAoBjD,CAAC;AAEF,eAAO,MAAM,kBAAkB,QAAO,MAAM,GAAG,IAA+B,CAAC;AAE/E;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GAC3B,WAAW,MAAM,EACjB,uBAAuB,MAAM,KAC5B,OAAO,CAAC,yBAAyB,CAKnC,CAAC"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AA+EH,UAAU,gBAAgB;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf;AA6ED;;;;;GAKG;AACH,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,EAAE,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CAsE5E,CAAC;AA2CF,eAAO,MAAM,UAAU,QAAO,aAAa,GAAG,IAAqB,CAAC;AACpE,eAAO,MAAM,YAAY,QAAO,MAAM,GAAG,IAA+B,CAAC;AAEzE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa,QAAO,IAIhC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,eAAe,GAC1B,OAAO;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,EACtD,uBAAuB,MAAM,KAC5B,OAAO,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,IAAI,CAAC;CACnB,CAeA,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,sBAAsB,GACjC,OAAO;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,KACrD,OAAO,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,IAAI,CAAC;CACnB,CAaA,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,GAClC,SAAS,MAAM,EACf,uBAAuB,MAAM,KAC5B,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CASlE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,kBAAkB,GAC7B,SAAS,MAAM,KACd,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAQlE,CAAC;AAWF;;;;GAIG;AACH,MAAM,WAAW,yBAA0B,SAAQ,gBAAgB;IACjE,eAAe,EAAE,MAAM,CAAC;CACzB;AAsBD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,QAAO,OAAO,CAAC,MAAM,CAoBjD,CAAC;AAEF,eAAO,MAAM,kBAAkB,QAAO,MAAM,GAAG,IAA+B,CAAC;AAE/E;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GAC3B,WAAW,MAAM,EACjB,uBAAuB,MAAM,KAC5B,OAAO,CAAC,yBAAyB,CAKnC,CAAC"}

package/dist/crypto.js

@@ -29,7 +29,7 @@
  *   sensitive-but-not-secret.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.encryptEphemeral = exports.getDevicePublicKey = exports.initDeviceCrypto = exports.encryptFileForSelf = exports.encryptFileForRecipient = exports.encryptPushBodyForSelf = exports.encryptPushBody = exports.getPublicKey = exports.getKeyPair = exports.initCrypto = void 0;
+exports.encryptEphemeral = exports.getDevicePublicKey = exports.initDeviceCrypto = exports.encryptFileForSelf = exports.encryptFileForRecipient = exports.encryptPushBodyForSelf = exports.encryptPushBody = exports.disableCrypto = exports.getPublicKey = exports.getKeyPair = exports.initCrypto = void 0;
 /// <reference lib="dom" />
 const fs_1 = require("fs");
 const os_1 = require("os");
@@ -239,6 +239,23 @@ const getKeyPair = () => cachedKeyPair;
 exports.getKeyPair = getKeyPair;
 const getPublicKey = () => cachedExportedPublicKey;
 exports.getPublicKey = getPublicKey;
+/**
+ * Drop the cached keys so every later send goes out as plaintext.
+ *
+ * Callers use this when the server rejects an encrypted send with
+ * `PRO_REQUIRED` (ADR-0008): E2E is a Pro feature, and a long-lived process
+ * that initialized crypto before a downgrade would otherwise 403 on every push.
+ * Same end state as the "server says encryption disabled" branch in initCrypto.
+ * Keys on disk are left alone, but this process will not pick them up again:
+ * `initCrypto` is memoized on `initPromise` and `ZephHook.ensureCrypto` short-
+ * circuits on `cryptoInitialized`. A restart after an upgrade re-adopts them.
+ */
+const disableCrypto = () => {
+    cachedKeyPair = null;
+    cachedExportedPublicKey = null;
+    cachedOwnPublicKey = null;
+};
+exports.disableCrypto = disableCrypto;
 /**
  * Encrypt push body for a recipient.
  * Returns fields ready to merge into the sendPush payload.

package/dist/remote-agents.d.ts

@@ -54,13 +54,18 @@ declare const REMOTE_AGENT_TABLE: readonly [{
     readonly displayName: "Codex CLI";
     readonly binary: "codex";
     readonly subcommands: readonly ["codex"];
+}, {
+    readonly kind: "cursor";
+    readonly displayName: "Cursor CLI";
+    readonly binary: "cursor-agent";
+    readonly subcommands: readonly ["cursor", "cursor-agent"];
 }, {
     readonly kind: "gemini";
     readonly displayName: "Gemini CLI";
     readonly binary: "gemini";
     readonly subcommands: readonly ["gemini"];
 }];
-/** Closed union of remote-controllable agent kinds ('claude' | 'codex' | 'gemini'). */
+/** Closed union of remote-controllable agent kinds ('claude' | 'codex' | 'cursor' | 'gemini'). */
 export type AgentKind = (typeof REMOTE_AGENT_TABLE)[number]['kind'];
 /** A registry row: the uniform RemoteAgent shape with `kind` narrowed to the closed union. */
 export type RegisteredRemoteAgent = RemoteAgent & {

package/dist/remote-agents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-agents.d.ts","sourceRoot":"","sources":["../src/remote-agents.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,WAAW;IACxB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAC3E;AAyCD;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,IAiB5D,CAAC;AAaF,UAAU,gBAAgB;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;CACf;AA4ED,4CAA4C;AAC5C,MAAM,WAAW,cAAc;IAC3B,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC7B,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC7B;AAED;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,GACnC,SAAS,MAAM,EACf,SAAS,MAAM,GAAG,IAAI,EACtB,OAAM,cAAmB,KAC1B,MAAM,GAAG,IAOX,CAAC;AAIF,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;;;;EAwBmB,CAAC;AAE5C,uFAAuF;AACvF,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE,8FAA8F;AAC9F,MAAM,MAAM,qBAAqB,GAAG,WAAW,GAAG;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC;AAEtE,eAAO,MAAM,aAAa,EAAE,SAAS,qBAAqB,EAAuB,CAAC;AAElF,eAAO,MAAM,qBAAqB,GAAI,KAAK,MAAM,KAAG,qBAAqB,GAAG,SAClB,CAAC;AAE3D,eAAO,MAAM,uBAAuB,GAAI,MAAM,MAAM,KAAG,qBAAqB,GAAG,SAG9E,CAAC"}
+{"version":3,"file":"remote-agents.d.ts","sourceRoot":"","sources":["../src/remote-agents.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,WAAW;IACxB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,kCAAkC;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAC3E;AAyCD;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,IAiB5D,CAAC;AAaF,UAAU,gBAAgB;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;CACf;AA4ED,4CAA4C;AAC5C,MAAM,WAAW,cAAc;IAC3B,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAC7B,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC7B;AAED;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,GACnC,SAAS,MAAM,EACf,SAAS,MAAM,GAAG,IAAI,EACtB,OAAM,cAAmB,KAC1B,MAAM,GAAG,IAOX,CAAC;AAIF,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;EAkCmB,CAAC;AAE5C,kGAAkG;AAClG,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE,8FAA8F;AAC9F,MAAM,MAAM,qBAAqB,GAAG,WAAW,GAAG;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC;AAEtE,eAAO,MAAM,aAAa,EAAE,SAAS,qBAAqB,EAAuB,CAAC;AAElF,eAAO,MAAM,qBAAqB,GAAI,KAAK,MAAM,KAAG,qBAAqB,GAAG,SAClB,CAAC;AAE3D,eAAO,MAAM,uBAAuB,GAAI,MAAM,MAAM,KAAG,qBAAqB,GAAG,SAG9E,CAAC"}

package/dist/remote-agents.js

@@ -10,9 +10,11 @@ exports.matchAgentByPaneCommand = exports.findAgentBySubcommand = exports.REMOTE
  * and the phone picker, which may validate the enum).
  *
  * This is deliberately NOT merged into `agents.ts`: that table drives
- * install/uninstall/verify detection (8 agents, incl. Cursor/Windsurf
- * which can never be driven via tmux), and the two tables carry different
- * name axes — install id vs subcommand alias vs pane binary.
+ * install/uninstall/verify detection (8 agents, incl. Windsurf, which can
+ * never be driven via tmux), and the two tables carry different name axes
+ * — install id vs subcommand alias vs pane binary. Cursor is the clearest
+ * case for keeping them apart: the `cursor` install id there means the
+ * IDE, while the drivable binary here is `cursor-agent`, its terminal TUI.
  */
 const fs_1 = require("fs");
 const os_1 = require("os");
@@ -198,6 +200,16 @@ const REMOTE_AGENT_TABLE = [
         binary: 'codex',
         subcommands: ['codex'],
     },
+    {
+        // The pane binary is `cursor-agent`, Cursor's terminal TUI — NOT the
+        // bare `cursor` on PATH, which is the IDE launcher script: it opens
+        // the app and exits, so a pane started with it dies before the
+        // listener can address it.
+        kind: 'cursor',
+        displayName: 'Cursor CLI',
+        binary: 'cursor-agent',
+        subcommands: ['cursor', 'cursor-agent'],
+    },
     {
         kind: 'gemini',
         displayName: 'Gemini CLI',

package/dist/zeph-hook.d.ts

@@ -6,7 +6,20 @@ export declare class ZephHook {
     private cryptoInitialized;
     constructor(options: ZephOptions);
     private ensureCrypto;
+    /**
+     * A push must not be lost because E2E turned out to be unavailable.
+     *
+     * E2E is Pro-only (ADR-0008) and the server rejects `isEncrypted` from a free
+     * account with 403 `PRO_REQUIRED`. This process may have initialized crypto
+     * while still Pro — a long-lived listener outlives a downgrade — so the
+     * rejection is only visible at send time. Drop the keys and run the send
+     * again from the top: the retry re-encodes the payload as plaintext and, on
+     * the file path, re-uploads the file unencrypted (a payload patch would leave
+     * an undecryptable blob in S3). The first, encrypted object stays orphaned —
+     * accepted cost; the upload endpoint has no quota counter to burn.
+     */
     notify(payload: NotifyPayload): Promise<NotifyResult>;
+    private notifyOnce;
     private notifyWithFile;
     requestUpload(params: {
         fileName: string;

package/dist/zeph-hook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"zeph-hook.d.ts","sourceRoot":"","sources":["../src/zeph-hook.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAY,gBAAgB,EAAE,gBAAgB,EAAoB,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAoCxL,qBAAa,QAAQ;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAEnC,OAAO,CAAC,iBAAiB,CAAS;gBAEtB,OAAO,EAAE,WAAW;YASlB,YAAY;IAYpB,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;YAmC7C,cAAc;IAsDtB,aAAa,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAK7G,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcrF,IAAI,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAmB9C,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAKlD,UAAU,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAK7C;;;;OAIG;IACG,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;YASxF,OAAO;IAiCrB,OAAO,CAAC,UAAU;CASnB"}
+{"version":3,"file":"zeph-hook.d.ts","sourceRoot":"","sources":["../src/zeph-hook.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAY,gBAAgB,EAAE,gBAAgB,EAAoB,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAoCxL,qBAAa,QAAQ;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAEnC,OAAO,CAAC,iBAAiB,CAAS;gBAEtB,OAAO,EAAE,WAAW;YASlB,YAAY;IAY1B;;;;;;;;;;;OAWG;IACG,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;YAgB7C,UAAU;YAqCV,cAAc;IAsDtB,aAAa,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAK7G,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcrF,IAAI,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAmB9C,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAKlD,UAAU,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAK7C;;;;OAIG;IACG,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;YASxF,OAAO;IAiCrB,OAAO,CAAC,UAAU;CASnB"}

package/dist/zeph-hook.js

@@ -63,12 +63,40 @@ class ZephHook {
             return false;
         }
     }
+    /**
+     * A push must not be lost because E2E turned out to be unavailable.
+     *
+     * E2E is Pro-only (ADR-0008) and the server rejects `isEncrypted` from a free
+     * account with 403 `PRO_REQUIRED`. This process may have initialized crypto
+     * while still Pro — a long-lived listener outlives a downgrade — so the
+     * rejection is only visible at send time. Drop the keys and run the send
+     * again from the top: the retry re-encodes the payload as plaintext and, on
+     * the file path, re-uploads the file unencrypted (a payload patch would leave
+     * an undecryptable blob in S3). The first, encrypted object stays orphaned —
+     * accepted cost; the upload endpoint has no quota counter to burn.
+     */
     async notify(payload) {
+        // Resolved once for both attempts: the lookup shells out to tmux, and a
+        // retry milliseconds later cannot land in a different session.
+        const agentCtx = agentSessionContext();
+        try {
+            return await this.notifyOnce(payload, agentCtx);
+        }
+        catch (err) {
+            // Held keys are what proves this send was encrypted, and dropping them is
+            // also the recursion guard — the retry has none, so a second 403 propagates.
+            if (!(err instanceof errors_js_1.ZephError) || err.code !== 'PRO_REQUIRED' || !(0, crypto_js_1.getKeyPair)())
+                throw err;
+            (0, crypto_js_1.disableCrypto)();
+            console.error('[Crypto] End-to-end encryption requires Zeph Pro — resending as plaintext.');
+            return this.notifyOnce(payload, agentCtx);
+        }
+    }
+    async notifyOnce(payload, agentCtx) {
         // Attach the stable session key when in a tmux agent session so the push
         // joins the agent chat. Merged into `payload` here so both the inline and
         // file-upload (notifyWithFile) paths — which each spread `...payload` —
         // carry it. Explicit caller values win.
-        const agentCtx = agentSessionContext();
         if (agentCtx)
             payload = { ...agentCtx, ...payload };
         const canEncrypt = await this.ensureCrypto();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zeph-to/cli",
-  "version": "1.26.1",
+  "version": "1.27.1",
   "description": "Zeph CLI + push notification SDK for AI agents",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",