@zeph-to/cli 1.27.0 → 2.0.0

package/dist/templates.js

@@ -19,6 +19,7 @@
 // and the agents can't drift apart.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.removeManagedBlock = exports.upsertManagedBlock = exports.ZEPH_MARK_END = exports.ZEPH_MARK_START = exports.COPILOT_HOOKS = exports.isZephHookGroup = exports.CODEX_HOOKS = exports.GEMINI_HOOKS = exports.WINDSURF_HOOKS = exports.CURSOR_HOOKS = exports.AIDER_RULE = exports.CLINE_RULE = exports.COPILOT_RULE = exports.CODEX_RULE = exports.GEMINI_RULE = exports.WINDSURF_RULE = exports.CURSOR_RULE = void 0;
+const gate_js_1 = require("./gate.js");
 const zeph_core_generated_js_1 = require("./zeph-core.generated.js");
 // Graceful resolution: prefer the installed `zeph` CLI, but fall back to
 // `npx -y @zeph-to/cli` so the hook still fires when the user
@@ -27,11 +28,20 @@ const zeph_core_generated_js_1 = require("./zeph-core.generated.js");
 // pattern in plugin/hooks/zeph-{stop,ask}.sh.
 //
 // `--auto` applies the shared push-gate before sending (see src/gate.ts):
-// in normal mode the push still fires (gate defaults assume real work), but
-// the /zeph-quiet | /zeph-loud dial now works for every hook-driven agent.
-// Older installed `zeph` versions parse `--auto` as an unknown boolean flag
-// and ignore it — graceful backward compatibility.
-const NOTIFY_CMD = '$(command -v zeph || echo "npx -y @zeph-to/cli") notify --title "Task done" --auto 2>/dev/null || true';
+// the push still fires (gate defaults assume real work), and the
+// /zeph-quiet | /zeph-loud dial works for every hook-driven agent.
+//
+// `--pushmode-default normal` is what keeps the first half of that true. The
+// built-in default for a project with no dial is quiet, and quiet only lets a
+// `high` Push Signal marker through — a marker these hooks have no way to
+// emit. Without the flag they would install and then never push again. The
+// user's own dial still outranks it, so /zeph-quiet keeps working here.
+//
+// Older installed `zeph` versions parse both flags as unknown booleans and
+// ignore them — graceful backward compatibility, and for `--pushmode-default`
+// specifically the old build's behavior was already "normal when no dial".
+const NOTIFY_CMD = '$(command -v zeph || echo "npx -y @zeph-to/cli") notify --title "Task done" --auto '
+    + `--${gate_js_1.PUSHMODE_DEFAULT_FLAG} normal 2>/dev/null || true`;
 // Prompt-submit hook command — remote-origin detection (ADR-0002). Reads
 // the hook JSON on stdin and prints additionalContext JSON on a marker
 // match (see src/remote-hook.ts). stdout IS the hook response, so only

package/dist/types.d.ts

@@ -37,6 +37,8 @@ export interface PushItem {
     title?: string;
     body?: string;
     createdAt: string;
+    /** E2E: when true, `title`/`body` are absent and the ciphertext is in `body`. */
+    isEncrypted?: boolean;
 }
 export interface ListResult {
     pushes: PushItem[];

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IACzC,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;IAChD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;oEAEgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;CACxD;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,QAAQ,EAAE,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IACzC,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;IAChD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;oEAEgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;CACxD;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,QAAQ,EAAE,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH"}

package/dist/zeph-hook.d.ts

@@ -5,8 +5,30 @@ export declare class ZephHook {
     private readonly timeoutMs;
     private cryptoInitialized;
     constructor(options: ZephOptions);
+    /**
+     * Resolve who this push can be encrypted for, or null when it cannot be.
+     *
+     * The device list is fetched per send rather than cached: a phone that
+     * registered its key a minute ago must be able to read the next push, and a
+     * long-lived listener would otherwise keep wrapping for a stale set.
+     * Failures here are not fatal — plaintext the user can read beats a
+     * notification that never arrives.
+     */
     private ensureCrypto;
+    /**
+     * A push must not be lost because E2E turned out to be unavailable.
+     *
+     * E2E is Pro-only (ADR-0008) and the server rejects `isEncrypted` from a free
+     * account with 403 `PRO_REQUIRED`. This process may have initialized crypto
+     * while still Pro — a long-lived listener outlives a downgrade — so the
+     * rejection is only visible at send time. Drop the keys and run the send
+     * again from the top: the retry re-encodes the payload as plaintext and, on
+     * the file path, re-uploads the file unencrypted (a payload patch would leave
+     * an undecryptable blob in S3). The first, encrypted object stays orphaned —
+     * accepted cost; the upload endpoint has no quota counter to burn.
+     */
     notify(payload: NotifyPayload): Promise<NotifyResult>;
+    private notifyOnce;
     private notifyWithFile;
     requestUpload(params: {
         fileName: string;

package/dist/zeph-hook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"zeph-hook.d.ts","sourceRoot":"","sources":["../src/zeph-hook.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAY,gBAAgB,EAAE,gBAAgB,EAAoB,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAoCxL,qBAAa,QAAQ;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAEnC,OAAO,CAAC,iBAAiB,CAAS;gBAEtB,OAAO,EAAE,WAAW;YASlB,YAAY;IAYpB,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;YAmC7C,cAAc;IAsDtB,aAAa,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAK7G,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcrF,IAAI,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAmB9C,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAKlD,UAAU,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAK7C;;;;OAIG;IACG,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;YASxF,OAAO;IAiCrB,OAAO,CAAC,UAAU;CASnB"}
+{"version":3,"file":"zeph-hook.d.ts","sourceRoot":"","sources":["../src/zeph-hook.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAY,gBAAgB,EAAE,gBAAgB,EAAoB,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAoCxL,qBAAa,QAAQ;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAEnC,OAAO,CAAC,iBAAiB,CAAS;gBAEtB,OAAO,EAAE,WAAW;IAShC;;;;;;;;OAQG;YACW,YAAY;IAyB1B;;;;;;;;;;;OAWG;IACG,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;YAgB7C,UAAU;YAyCV,cAAc;IA6DtB,aAAa,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAK7G,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcrF,IAAI,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAuB9C,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAKlD,UAAU,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAK7C;;;;OAIG;IACG,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;YASxF,OAAO;IAiCrB,OAAO,CAAC,UAAU;CASnB"}

package/dist/zeph-hook.js

@@ -50,40 +50,94 @@ class ZephHook {
         this.baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\/$/, '');
         this.timeoutMs = options.timeout ?? DEFAULT_TIMEOUT_MS;
     }
+    /**
+     * Resolve who this push can be encrypted for, or null when it cannot be.
+     *
+     * The device list is fetched per send rather than cached: a phone that
+     * registered its key a minute ago must be able to read the next push, and a
+     * long-lived listener would otherwise keep wrapping for a stale set.
+     * Failures here are not fatal — plaintext the user can read beats a
+     * notification that never arrives.
+     */
     async ensureCrypto() {
-        if (this.cryptoInitialized)
-            return !!(0, crypto_js_1.getKeyPair)();
-        try {
-            await (0, crypto_js_1.initCrypto)(this.apiKey, this.baseUrl);
+        if (!this.cryptoInitialized) {
+            try {
+                await (0, crypto_js_1.initCrypto)(this.apiKey, this.baseUrl);
+            }
+            catch {
+                // fall through — getKeyPair() stays null and we send plaintext
+            }
             this.cryptoInitialized = true;
-            return !!(0, crypto_js_1.getKeyPair)();
         }
-        catch {
-            this.cryptoInitialized = true;
-            return false;
+        if (!(0, crypto_js_1.getKeyPair)())
+            return null;
+        try {
+            const json = await this.request('GET', '/devices');
+            const recipients = (0, crypto_js_1.selectRecipients)(json.data ?? []);
+            if (recipients.length === 0) {
+                console.error('[Crypto] No device has a per-device public key — sending plaintext.');
+                return null;
+            }
+            return recipients;
+        }
+        catch (err) {
+            console.error('[Crypto] Could not list devices, sending plaintext:', err);
+            return null;
         }
     }
+    /**
+     * A push must not be lost because E2E turned out to be unavailable.
+     *
+     * E2E is Pro-only (ADR-0008) and the server rejects `isEncrypted` from a free
+     * account with 403 `PRO_REQUIRED`. This process may have initialized crypto
+     * while still Pro — a long-lived listener outlives a downgrade — so the
+     * rejection is only visible at send time. Drop the keys and run the send
+     * again from the top: the retry re-encodes the payload as plaintext and, on
+     * the file path, re-uploads the file unencrypted (a payload patch would leave
+     * an undecryptable blob in S3). The first, encrypted object stays orphaned —
+     * accepted cost; the upload endpoint has no quota counter to burn.
+     */
     async notify(payload) {
+        // Resolved once for both attempts: the lookup shells out to tmux, and a
+        // retry milliseconds later cannot land in a different session.
+        const agentCtx = agentSessionContext();
+        try {
+            return await this.notifyOnce(payload, agentCtx);
+        }
+        catch (err) {
+            // Held keys are what proves this send was encrypted, and dropping them is
+            // also the recursion guard — the retry has none, so a second 403 propagates.
+            if (!(err instanceof errors_js_1.ZephError) || err.code !== 'PRO_REQUIRED' || !(0, crypto_js_1.getKeyPair)())
+                throw err;
+            (0, crypto_js_1.disableCrypto)();
+            console.error('[Crypto] End-to-end encryption requires Zeph Pro — resending as plaintext.');
+            return this.notifyOnce(payload, agentCtx);
+        }
+    }
+    async notifyOnce(payload, agentCtx) {
         // Attach the stable session key when in a tmux agent session so the push
         // joins the agent chat. Merged into `payload` here so both the inline and
         // file-upload (notifyWithFile) paths — which each spread `...payload` —
         // carry it. Explicit caller values win.
-        const agentCtx = agentSessionContext();
         if (agentCtx)
             payload = { ...agentCtx, ...payload };
-        const canEncrypt = await this.ensureCrypto();
+        const recipients = await this.ensureCrypto();
         const body = payload.body;
         const bodyBytes = body ? new TextEncoder().encode(body).byteLength : 0;
         const isLongBody = bodyBytes > BODY_FILE_THRESHOLD;
         if (isLongBody && body) {
-            return this.notifyWithFile(payload, body, bodyBytes, canEncrypt);
+            return this.notifyWithFile(payload, body, bodyBytes, recipients);
         }
         // Encrypt push body if possible
         let sendPayload = { ...payload };
-        if (canEncrypt) {
+        if (recipients) {
             try {
-                const enc = await (0, crypto_js_1.encryptPushBodyForSelf)({ title: payload.title, body: payload.body, url: payload.url });
-                sendPayload = { ...sendPayload, title: undefined, body: enc.body, isEncrypted: true, encryptedKey: enc.encryptedKey, senderPublicKey: enc.senderPublicKey };
+                const enc = await (0, crypto_js_1.encryptPushBodyForDevices)({ title: payload.title, body: payload.body, url: payload.url }, recipients);
+                // `url: undefined` alongside the title: it is already sealed inside the
+                // ciphertext, and on a link push it IS the payload. Spreading `payload`
+                // above left the plaintext copy at the top level, handing the server the
+                // one thing `isEncrypted` promises it cannot see.
+                sendPayload = { ...sendPayload, title: undefined, url: undefined, body: enc.body, isEncrypted: true, deviceKeyMap: enc.deviceKeyMap, senderPublicKey: enc.senderPublicKey };
             }
             catch (err) {
                 console.error('[Crypto] Push encryption failed, sending plaintext:', err);
@@ -96,46 +150,51 @@ class ZephHook {
         }
         return { pushId };
     }
-    async notifyWithFile(payload, body, fileSize, canEncrypt) {
+    async notifyWithFile(payload, body, fileSize, recipients) {
         const fileName = 'response.md';
-        let fileType = inferMimeType(fileName);
-        // Encrypt file content if possible
-        let uploadContent = body;
-        let uploadSize = fileSize;
-        let fileIv;
-        let fileEncryptedKey;
-        if (canEncrypt) {
+        const preview = body.length > PREVIEW_LENGTH ? body.slice(0, PREVIEW_LENGTH) + '...' : body;
+        // Encrypt the attachment and the push body together, before anything is
+        // uploaded. Doing them one at a time around the upload let a failure land
+        // in between and ship ciphertext under a push with no `isEncrypted` — an
+        // attachment no client would even try to open.
+        let encrypted = null;
+        if (recipients) {
             try {
-                const encrypted = await (0, crypto_js_1.encryptFileForSelf)(body);
-                uploadContent = encrypted.ciphertext;
-                uploadSize = encrypted.ciphertext.length;
-                fileType = 'application/octet-stream';
-                fileIv = encrypted.iv;
-                fileEncryptedKey = encrypted.encryptedKey;
+                encrypted = {
+                    file: await (0, crypto_js_1.encryptFileForDevices)(body, recipients),
+                    push: await (0, crypto_js_1.encryptPushBodyForDevices)({ title: payload.title, body: preview, url: payload.url }, recipients),
+                };
             }
             catch (err) {
-                console.error('[Crypto] File encryption failed, sending plaintext:', err);
+                console.error('[Crypto] Encryption failed, sending plaintext:', err);
             }
         }
-        const upload = await this.requestUpload({ fileName, fileType, fileSize: uploadSize });
-        await this.uploadToS3(upload.uploadUrl, uploadContent, fileType);
-        const preview = body.length > PREVIEW_LENGTH ? body.slice(0, PREVIEW_LENGTH) + '...' : body;
-        // Encrypt push body
-        let sendPayload = {
+        const uploadContent = encrypted?.file.ciphertext ?? body;
+        const uploadType = encrypted ? 'application/octet-stream' : inferMimeType(fileName);
+        const uploadSize = encrypted ? encrypted.file.ciphertext.length : fileSize;
+        const upload = await this.requestUpload({ fileName, fileType: uploadType, fileSize: uploadSize });
+        await this.uploadToS3(upload.uploadUrl, uploadContent, uploadType);
+        const sendPayload = {
             ...payload,
-            body: preview,
+            title: encrypted ? undefined : payload.title,
+            body: encrypted ? encrypted.push.body : preview,
             type: payload.type ?? 'file',
-            files: [{ fileKey: upload.fileKey, fileName, fileSize, fileType: inferMimeType(fileName), iv: fileIv, encryptedKey: fileEncryptedKey }],
+            files: [{
+                    fileKey: upload.fileKey,
+                    fileName,
+                    fileSize,
+                    fileType: inferMimeType(fileName),
+                    iv: encrypted?.file.iv,
+                    deviceKeyMap: encrypted?.file.deviceKeyMap,
+                }],
+            ...(encrypted && {
+                // See notifyOnce: the url must not survive in the clear either.
+                url: undefined,
+                isEncrypted: true,
+                deviceKeyMap: encrypted.push.deviceKeyMap,
+                senderPublicKey: encrypted.push.senderPublicKey,
+            }),
         };
-        if (canEncrypt) {
-            try {
-                const enc = await (0, crypto_js_1.encryptPushBodyForSelf)({ title: payload.title, body: preview, url: payload.url });
-                sendPayload = { ...sendPayload, title: undefined, body: enc.body, isEncrypted: true, encryptedKey: enc.encryptedKey, senderPublicKey: enc.senderPublicKey };
-            }
-            catch (err) {
-                console.error('[Crypto] Push encryption failed, sending plaintext:', err);
-            }
-        }
         const json = await this.request('POST', '/pushes/send', sendPayload);
         const pushId = json.data?.pushId;
         if (!pushId) {
@@ -171,8 +230,12 @@ class ZephHook {
         const pushes = json.data.map((p) => ({
             pushId: p.pushId,
             type: p.type,
-            title: p.title,
-            body: p.body?.slice(0, 100),
+            // An encrypted push carries no plaintext title and a JSON envelope in
+            // `body`; slicing that renders `{"ciphertext":"AAAB...` as if it were the
+            // message. This host cannot decrypt (send-only), so say so instead.
+            title: p.isEncrypted ? undefined : p.title,
+            body: p.isEncrypted ? '[encrypted]' : p.body?.slice(0, 100),
+            isEncrypted: p.isEncrypted,
             createdAt: p.createdAt,
         }));
         return { pushes, count: pushes.length, hasMore: json.pagination?.hasMore ?? false };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zeph-to/cli",
-  "version": "1.27.0",
+  "version": "2.0.0",
   "description": "Zeph CLI + push notification SDK for AI agents",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",