@zeph-to/cli 1.27.1 → 2.0.0

package/README.md

@@ -45,9 +45,11 @@ binary.
 
 Once installed, the hooks fire in **every** session of each configured
 agent — `zeph cc` is the phone-control bridge, not the notification
-switch. Turn the volume down without uninstalling: `/zeph-quiet --global`
-(blockers only, all projects), `/zeph-mute` (silence, current project),
-`/zeph-status` (what's in effect). See [Mute & push mode](#mute--push-mode).
+switch. In Claude Code the routine per-turn push starts off (`quiet` is
+the default); `/zeph-normal` turns it on for a project, `/zeph-loud`
+pushes on every turn, `/zeph-mute` silences a project entirely, and
+`/zeph-status` shows what's in effect. See
+[Mute & push mode](#mute--push-mode).
 
 `~/.zeph/config.json` is the single source of truth — the CLI, the MCP
 server, the plugin hooks, and the listener all read it. You never need
@@ -424,6 +426,7 @@ zeph notify --title "Hello" --json
 | `--device <id>` | Target device ID |
 | `--session <id>` | AI session ID so the push threads into that session's chat (or `ZEPH_SESSION_ID` env) |
 | `--auto` | Apply the push gate before sending — honors the `/zeph-quiet` / `/zeph-loud` push-mode dial, per project or machine-wide (`--global`); gated-out exits silently with code 0 |
+| `--pushmode-default <m>` | Mode `--auto` assumes when the project has no dial: `quiet` (built-in), `normal`, `loud`. A dial the user set always wins |
 | `--marker <m>` | Push Signal marker for `--auto`: `skip`, `push`, `high` |
 | `--tools <n>`, `--nonreadonly <n>` | Turn tool counts feeding `--auto`'s heuristic (defaults assume real work) |
 
@@ -491,13 +494,25 @@ this order — first hit wins:
 |-------|------|--------|
 | 1 | `$STATE_DIR/pushmode-<hash>` | `/zeph-quiet` · `/zeph-loud` · `/zeph-normal` |
 | 2 | `/tmp/zeph-pushmode-<hash>` | older versions (honored only when you own the file) |
-| 3 | `$STATE_DIR/pushmode-default` | `/zeph-quiet --global` — the machine-wide default |
-| 4 | *(none)* | `normal` |
-
-So `/zeph-quiet --global` quiets every project that has no dial of its
-own, and a per-project dial always overrides it. Mute has no `-default`
-form on purpose: it is keyed on presence, not content, so a global mute
-could never be lifted for a single project.
+| 3 | `$STATE_DIR/pushmode-default` | the `--global` form of any dial — the machine-wide default |
+| 4 | `--pushmode-default <mode>` | the calling hook (the installed ones pass `normal`) |
+| 5 | *(nothing above)* | `quiet` |
+
+**Row 5 changed**: an install with no dial anywhere used to be `normal`.
+It is now `quiet`, so upgrading turns the routine per-turn push off until
+you run `/zeph-normal`. Row 4 is why the hooks this CLI installs are
+unaffected: they name `normal` themselves, since a hook that supplies no
+turn counts also supplies no `high` marker, and `quiet` would make it
+permanently silent rather than merely quieter. Row 4 sits *below* the
+state files on purpose — the flag names a default, it does not override a
+dial the user set.
+
+A dial file that exists but reads empty resolves to `normal`, not to row
+5: an empty file is a failed write, and resolving breakage to silence
+leaves no symptom to debug.
+
+Mute has no `-default` form on purpose: it is keyed on presence, not
+content, so a global mute could never be lifted for a single project.
 
 Legacy `/tmp/zeph-muted-<hash>` files are still honored when owned by the
 current user (the state dir moved out of world-writable `/tmp`).
@@ -604,25 +619,40 @@ session.
 
 ## Encryption
 
-Push bodies are encrypted with AES-256-GCM. The wrapping key is derived
-via ECDH P-256 and synced across your own devices on first run so every
-device can read the same push. Toggle encryption in the Zeph app
-(Settings → Encryption); when disabled, the CLI sends plaintext. No
-configuration needed.
-
-**Threat model honesty:** keys are persisted on the Zeph backend to
-enable cross-device sync, so this is *device-shared* encryption — not
-true end-to-end. It protects push contents from passive network
-observers and from a leaked database snapshot taken without the key
-store, but it does **not** protect against the Zeph backend itself (it
-has the keys it serves to your devices). A true E2E mode (per-device
-keypairs, server stores only public keys, no key escrow) is on the
-roadmap.
-
-The `zeph listener` ignores `isEncrypted` pushes for now — it has no
-per-device key to decrypt them. Stop-hook auto-pushes and `zeph_ask`
-responses are not part of the `@<session>` injection path, so this
-doesn't affect normal use.
+Push bodies and long-body attachments are encrypted with AES-256-GCM.
+This host holds its own ECDH P-256 keypair in `~/.zeph/device-keys.json`
+— generated on first use, and the private half never leaves the machine.
+Each push is encrypted once, and its AES key is wrapped separately for
+every device on your account using ECDH against that device's public
+key.
+
+Toggle encryption in the Zeph app (Settings → Encryption); when it is
+off, the CLI sends plaintext. No configuration needed.
+
+**Threat model:** against a passive backend — a leaked snapshot, an
+operator reading the table — the stored ciphertext and wrapped keys are
+useless, so push contents stay private. Three limits worth knowing:
+
+- **No protection from an active malicious operator.** Recipient public
+  keys come from `GET /devices` on that same server, unsigned and
+  unpinned. A backend that injects a device record carrying its own key
+  gets the message key wrapped for it, and reads everything. Closing
+  this needs out-of-band device verification (ADR-0007 Phase 4, not
+  built).
+- **No forward secrecy.** The ECDH secret for a given sender/device pair
+  is static, so compromising either private key opens every past push
+  wrapped for that pair.
+- **`senderPublicKey` is unsigned**, so a swapped one makes a push
+  undecryptable — that direction fails closed rather than leaking.
+
+A device that has not registered a per-device public key cannot be sent
+to; it is skipped, and if no device qualifies the push goes out in the
+clear rather than arriving as something nothing can open.
+
+The `zeph listener` ignores `isEncrypted` pushes for now — it does not
+try to decrypt them. Stop-hook auto-pushes and `zeph_ask` responses are
+not part of the `@<session>` injection path, so this doesn't affect
+normal use.
 
 ## Requirements
 

package/dist/cli.js

@@ -96,6 +96,10 @@ Notify options:
   --session <id>     AI session ID (or set ZEPH_SESSION_ID env)
   --auto             Apply the push gate before sending (honors the
                      /zeph-quiet | /zeph-loud dial; silent exit when gated)
+  --pushmode-default <m>
+                     Mode --auto assumes when the project has no dial
+                     (quiet|normal|loud) [default: quiet]. A dial set with
+                     /zeph-quiet | /zeph-loud | /zeph-normal always wins
   --marker <m>       Push Signal marker for --auto (skip|push|high)
   --tools <n>        Turn tool count for --auto [default: assume real work]
   --nonreadonly <n>  Non-read-only tool count for --auto
@@ -254,13 +258,14 @@ const handleNotify = async (args) => {
     // GATE_DEFAULTS ("assume real work") so dumb hooks keep their historical
     // always-push behavior in normal mode, while the /zeph-quiet | /zeph-loud
     // dial now works for every hook-driven agent. Gated-out → silent success.
+    // With no dial the mode falls back to --pushmode-default, then to quiet.
     if (args.auto === true) {
         const verdict = (0, gate_js_1.decidePush)({
             toolCount: gateCount(args.tools, gate_js_1.GATE_DEFAULTS.toolCount),
             nonReadonlyCount: gateCount(args.nonreadonly, gate_js_1.GATE_DEFAULTS.nonReadonlyCount),
             alreadyAsked: gate_js_1.GATE_DEFAULTS.alreadyAsked,
             marker: (0, gate_js_1.normalizeMarker)(typeof args.marker === 'string' ? args.marker : undefined),
-            pushMode: (0, gate_js_1.readPushMode)(projectDir),
+            pushMode: (0, gate_js_1.autoPushMode)(projectDir, args[gate_js_1.PUSHMODE_DEFAULT_FLAG]),
         });
         if (!verdict.push)
             return 0;

package/dist/crypto.d.ts

@@ -1,31 +1,31 @@
 /**
- * Device-shared encryption for Hook SDK — self-contained ECDH P-256 +
+ * Per-device encryption for the Hook SDK — self-contained ECDH P-256 +
  * AES-256-GCM. Mirrors @zeph/crypto API but bundled inline (no external
  * dependency). Uses Web Crypto API via node:crypto webcrypto — Node.js 18+
  * (the `crypto` global only exists unflagged from Node 19, so we import it).
  *
- * Threat model honesty (do not call this "E2E" without a footnote):
+ * How it works (ADR-0007):
  *
- *   The Zeph backend persists the per-user private key in plaintext so it
- *   can be synced down to a fresh device (fetchServerKeys / uploadServerKeys
- *   below). That means the backend can decrypt any push body — this is NOT
- *   end-to-end in the standard sense. What it gives you is:
- *     • Protection against passive network observers
- *     • Protection against a leaked DB snapshot taken without the key store
- *     • Cross-device readability (all your devices share one keypair)
- *   What it does NOT give you:
- *     • Protection against the Zeph backend itself
- *     • Forward secrecy — encryptPushBodyForSelf / encryptFileForSelf do
- *       ECDH(self, self), which collapses to a static derived key. A single
- *       device compromise (since all your devices share the same keypair)
- *       lets the attacker decrypt every past push for which they have the
- *       ciphertext. The per-message AES key is random, but its wrap key is
- *       static, so wrapped keys are decryptable forever.
+ *   This host holds its own ECDH keypair in ~/.zeph/device-keys.json. The
+ *   private half is generated here and never leaves — the server only ever
+ *   sees public keys. A push is encrypted once with a random AES key, and
+ *   that key is wrapped separately for each of the user's registered devices
+ *   using ECDH(this host, that device). Same keypair the stream frames below
+ *   already used; push and file bodies now share it.
  *
- *   True E2E would require a per-device keypair (server stores only public
- *   keys; senders wrap the message key once per recipient device public
- *   key). That refactor is on the roadmap; until then, treat push bodies as
- *   sensitive-but-not-secret.
+ * What it does not give you:
+ *   • Forward secrecy — the ECDH secret for a given (sender, device) pair is
+ *     static, so a compromise of either private key retroactively opens every
+ *     push wrapped for that pair.
+ *   • Authenticity beyond the key pairing — nothing signs `senderPublicKey`.
+ *
+ * Superseded scheme: a single account-wide keypair whose private half the
+ * backend escrowed so it could sync to new devices. Key escrow was removed
+ * server-side (zeph@8a6d21b) and `GET /users/me/keys` has returned a public
+ * key only ever since. This client used to react by generating a fresh
+ * account keypair and PUTting it back — which overwrote the account public
+ * key and encrypted to a key no device held. Both that upload path and the
+ * account keypair are gone.
  */
 interface EncryptedPayload {
     ciphertext: string;
@@ -34,12 +34,40 @@ interface EncryptedPayload {
     keyIv: string;
 }
 /**
- * Initialize crypto: sync keys with server, then fallback to local/generate.
- * Server is source of truth for per-user key pair.
- * Safe to call concurrently — deduplicates to single init.
- * Returns the exported public key (Base64 SPKI).
+ * Initialize push/file encryption.
+ *
+ * Encryption turns on only when the account has explicitly opted in —
+ * `encryptionEnabled` from `GET /users/me/keys` is the single authoritative
+ * signal (ADR-0008). Server unreachable or flag off leaves it off and every
+ * send goes out in the clear.
+ *
+ * When it is on, this delegates to the per-device keypair: nothing is asked
+ * of the server but the flag, and nothing is ever uploaded.
+ *
+ * Safe to call concurrently — deduplicates to a single init.
+ * Returns this host's public key when encryption is active, '' otherwise.
  */
 export declare const initCrypto: (apiKey?: string, baseUrl?: string) => Promise<string>;
+/** One target device, as returned by `GET /devices`. */
+export interface DeviceRecipient {
+    deviceId: string;
+    /** Base64 SPKI of that device's per-device public key. */
+    publicKey: string;
+}
+/** deviceId → JSON `{ encryptedKey, keyIv }`, the wire shape the clients parse. */
+export type DeviceKeyMap = Record<string, string>;
+/**
+ * Keep only devices this host can actually encrypt for.
+ *
+ * A device without a public key has never run a build that registers one, and
+ * a device still advertising the account-wide key has not migrated to
+ * per-device E2E — wrapping for either produces a push it cannot open, which
+ * is worse than sending plaintext it can read.
+ */
+export declare const selectRecipients: (devices: {
+    deviceId: string;
+    publicKey?: string;
+}[]) => DeviceRecipient[];
 export declare const getKeyPair: () => CryptoKeyPair | null;
 export declare const getPublicKey: () => string | null;
 /**
@@ -55,48 +83,29 @@ export declare const getPublicKey: () => string | null;
  */
 export declare const disableCrypto: () => void;
 /**
- * Encrypt push body for a recipient.
- * Returns fields ready to merge into the sendPush payload.
- */
-export declare const encryptPushBody: (input: {
-    title?: string;
-    body?: string;
-    url?: string;
-}, recipientPublicKeyRaw: string) => Promise<{
-    body: string;
-    encryptedKey: string;
-    senderPublicKey: string;
-    isEncrypted: true;
-}>;
-/**
- * Encrypt push body for self (all own devices).
+ * Encrypt a push body for the given recipient devices.
+ *
+ * Returns the wire fields the API expects: `body` carries the ciphertext and
+ * IV, `deviceKeyMap` the per-device wrapped keys, `senderPublicKey` the half
+ * recipients need to derive the same secret back.
  */
-export declare const encryptPushBodyForSelf: (input: {
+export declare const encryptPushBodyForDevices: (input: {
     title?: string;
     body?: string;
     url?: string;
-}) => Promise<{
+}, recipients: DeviceRecipient[]) => Promise<{
     body: string;
-    encryptedKey: string;
+    deviceKeyMap: DeviceKeyMap;
     senderPublicKey: string;
     isEncrypted: true;
 }>;
 /**
- * Encrypt file content for a recipient.
- * Returns encrypted buffer + key material for file attachment metadata.
+ * Encrypt file content for the given recipient devices.
  */
-export declare const encryptFileForRecipient: (content: string, recipientPublicKeyRaw: string) => Promise<{
+export declare const encryptFileForDevices: (content: string | Buffer, recipients: DeviceRecipient[]) => Promise<{
     ciphertext: Buffer;
     iv: string;
-    encryptedKey: string;
-}>;
-/**
- * Encrypt file content for self (all own devices).
- */
-export declare const encryptFileForSelf: (content: string) => Promise<{
-    ciphertext: Buffer;
-    iv: string;
-    encryptedKey: string;
+    deviceKeyMap: DeviceKeyMap;
 }>;
 /**
  * Flat ephemeral envelope — field-for-field what the web's decrypt()

package/dist/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AA+EH,UAAU,gBAAgB;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf;AA6ED;;;;;GAKG;AACH,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,EAAE,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CAsE5E,CAAC;AA2CF,eAAO,MAAM,UAAU,QAAO,aAAa,GAAG,IAAqB,CAAC;AACpE,eAAO,MAAM,YAAY,QAAO,MAAM,GAAG,IAA+B,CAAC;AAEzE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa,QAAO,IAIhC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,eAAe,GAC1B,OAAO;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,EACtD,uBAAuB,MAAM,KAC5B,OAAO,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,IAAI,CAAC;CACnB,CAeA,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,sBAAsB,GACjC,OAAO;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,KACrD,OAAO,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,IAAI,CAAC;CACnB,CAaA,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,GAClC,SAAS,MAAM,EACf,uBAAuB,MAAM,KAC5B,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CASlE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,kBAAkB,GAC7B,SAAS,MAAM,KACd,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAQlE,CAAC;AAWF;;;;GAIG;AACH,MAAM,WAAW,yBAA0B,SAAQ,gBAAgB;IACjE,eAAe,EAAE,MAAM,CAAC;CACzB;AAsBD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,QAAO,OAAO,CAAC,MAAM,CAoBjD,CAAC;AAEF,eAAO,MAAM,kBAAkB,QAAO,MAAM,GAAG,IAA+B,CAAC;AAE/E;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GAC3B,WAAW,MAAM,EACjB,uBAAuB,MAAM,KAC5B,OAAO,CAAC,yBAAyB,CAKnC,CAAC"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AA+EH,UAAU,gBAAgB;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf;AAkDD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,EAAE,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CAyB5E,CAAC;AAsCF,wDAAwD;AACxD,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,mFAAmF;AACnF,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAElD;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,GAC3B,SAAS;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,KAClD,eAAe,EAG8C,CAAC;AA2CjE,eAAO,MAAM,UAAU,QAAO,aAAa,GAAG,IAAkD,CAAC;AACjG,eAAO,MAAM,YAAY,QAAO,MAAM,GAAG,IAA4D,CAAC;AAEtG;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa,QAAO,IAEhC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,GACpC,OAAO;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,EACtD,YAAY,eAAe,EAAE,KAC5B,OAAO,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,YAAY,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,IAAI,CAAC;CACnB,CAkBA,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,qBAAqB,GAChC,SAAS,MAAM,GAAG,MAAM,EACxB,YAAY,eAAe,EAAE,KAC5B,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,YAAY,CAAA;CAAE,CAsBxE,CAAC;AAcF;;;;GAIG;AACH,MAAM,WAAW,yBAA0B,SAAQ,gBAAgB;IACjE,eAAe,EAAE,MAAM,CAAC;CACzB;AAsBD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,QAAO,OAAO,CAAC,MAAM,CAoBjD,CAAC;AAEF,eAAO,MAAM,kBAAkB,QAAO,MAAM,GAAG,IAA+B,CAAC;AAE/E;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GAC3B,WAAW,MAAM,EACjB,uBAAuB,MAAM,KAC5B,OAAO,CAAC,yBAAyB,CAKnC,CAAC"}

package/dist/crypto.js

@@ -1,35 +1,35 @@
 "use strict";
 /**
- * Device-shared encryption for Hook SDK — self-contained ECDH P-256 +
+ * Per-device encryption for the Hook SDK — self-contained ECDH P-256 +
  * AES-256-GCM. Mirrors @zeph/crypto API but bundled inline (no external
  * dependency). Uses Web Crypto API via node:crypto webcrypto — Node.js 18+
  * (the `crypto` global only exists unflagged from Node 19, so we import it).
  *
- * Threat model honesty (do not call this "E2E" without a footnote):
+ * How it works (ADR-0007):
  *
- *   The Zeph backend persists the per-user private key in plaintext so it
- *   can be synced down to a fresh device (fetchServerKeys / uploadServerKeys
- *   below). That means the backend can decrypt any push body — this is NOT
- *   end-to-end in the standard sense. What it gives you is:
- *     • Protection against passive network observers
- *     • Protection against a leaked DB snapshot taken without the key store
- *     • Cross-device readability (all your devices share one keypair)
- *   What it does NOT give you:
- *     • Protection against the Zeph backend itself
- *     • Forward secrecy — encryptPushBodyForSelf / encryptFileForSelf do
- *       ECDH(self, self), which collapses to a static derived key. A single
- *       device compromise (since all your devices share the same keypair)
- *       lets the attacker decrypt every past push for which they have the
- *       ciphertext. The per-message AES key is random, but its wrap key is
- *       static, so wrapped keys are decryptable forever.
+ *   This host holds its own ECDH keypair in ~/.zeph/device-keys.json. The
+ *   private half is generated here and never leaves — the server only ever
+ *   sees public keys. A push is encrypted once with a random AES key, and
+ *   that key is wrapped separately for each of the user's registered devices
+ *   using ECDH(this host, that device). Same keypair the stream frames below
+ *   already used; push and file bodies now share it.
  *
- *   True E2E would require a per-device keypair (server stores only public
- *   keys; senders wrap the message key once per recipient device public
- *   key). That refactor is on the roadmap; until then, treat push bodies as
- *   sensitive-but-not-secret.
+ * What it does not give you:
+ *   • Forward secrecy — the ECDH secret for a given (sender, device) pair is
+ *     static, so a compromise of either private key retroactively opens every
+ *     push wrapped for that pair.
+ *   • Authenticity beyond the key pairing — nothing signs `senderPublicKey`.
+ *
+ * Superseded scheme: a single account-wide keypair whose private half the
+ * backend escrowed so it could sync to new devices. Key escrow was removed
+ * server-side (zeph@8a6d21b) and `GET /users/me/keys` has returned a public
+ * key only ever since. This client used to react by generating a fresh
+ * account keypair and PUTting it back — which overwrote the account public
+ * key and encrypted to a key no device held. Both that upload path and the
+ * account keypair are gone.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.encryptEphemeral = exports.getDevicePublicKey = exports.initDeviceCrypto = exports.encryptFileForSelf = exports.encryptFileForRecipient = exports.encryptPushBodyForSelf = exports.encryptPushBody = exports.disableCrypto = exports.getPublicKey = exports.getKeyPair = exports.initCrypto = void 0;
+exports.encryptEphemeral = exports.getDevicePublicKey = exports.initDeviceCrypto = exports.encryptFileForDevices = exports.encryptPushBodyForDevices = exports.disableCrypto = exports.getPublicKey = exports.getKeyPair = exports.selectRecipients = exports.initCrypto = void 0;
 /// <reference lib="dom" />
 const fs_1 = require("fs");
 const os_1 = require("os");
@@ -91,108 +91,61 @@ const encrypt = async (plaintext, senderPrivateKey, recipientPublicKey) => {
         keyIv: toBase64(keyIv.buffer),
     };
 };
-// ─── File encryption ───
-const encryptFileContent = async (content, senderPrivateKey, recipientPublicKey) => {
-    const buffer = new TextEncoder().encode(content).buffer;
-    const fileKey = await crypto.subtle.generateKey({ name: 'AES-GCM', length: 256 }, true, ['encrypt', 'decrypt']);
-    const iv = crypto.getRandomValues(new Uint8Array(12));
-    const ciphertext = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, fileKey, buffer);
-    const sharedKey = await deriveAesKey(senderPrivateKey, recipientPublicKey);
-    const rawFileKey = await crypto.subtle.exportKey('raw', fileKey);
-    const keyIv = crypto.getRandomValues(new Uint8Array(12));
-    const encryptedKey = await crypto.subtle.encrypt({ name: 'AES-GCM', iv: keyIv }, sharedKey, rawFileKey);
-    return {
-        ciphertext: Buffer.from(ciphertext),
-        iv: toBase64(iv.buffer),
-        encryptedKey: toBase64(encryptedKey),
-        keyIv: toBase64(keyIv.buffer),
-    };
-};
-// ─── Key persistence (~/.config/zeph/keys.json) ───
-const KEYS_DIR = (0, path_1.join)((0, os_1.homedir)(), '.config', 'zeph');
-const KEYS_PATH = (0, path_1.join)(KEYS_DIR, 'keys.json');
-const loadStoredKeys = () => {
+// ─── Superseded account keystore ───
+//
+// Held the escrowed account keypair. Nothing reads it any more; it is deleted
+// on sight so a private key the server no longer issues stops sitting on disk.
+const LEGACY_KEYS_PATH = (0, path_1.join)((0, os_1.homedir)(), '.config', 'zeph', 'keys.json');
+const deleteLegacyKeys = () => {
     try {
-        return JSON.parse((0, fs_1.readFileSync)(KEYS_PATH, 'utf-8'));
-    }
-    catch {
-        return null;
+        (0, fs_1.unlinkSync)(LEGACY_KEYS_PATH);
     }
-};
-const storeKeys = (exported) => {
-    (0, fs_1.mkdirSync)(KEYS_DIR, { recursive: true, mode: 0o700 });
-    (0, fs_1.writeFileSync)(KEYS_PATH, JSON.stringify(exported, null, 2), { mode: 0o600 });
+    catch { /* not present — fine */ }
 };
 // ─── Cached state ───
-let cachedKeyPair = null;
-let cachedExportedPublicKey = null;
-let cachedOwnPublicKey = null;
+/**
+ * Whether the account has opted into E2E (`encryptionEnabled`, ADR-0008).
+ * Kept separate from the device keypair because that keypair also backs
+ * stream frames, which are encrypted regardless — reading its presence as
+ * consent would turn push encryption on for everyone.
+ */
+let pushCryptoEnabled = false;
+let cachedLegacyPublicKey = null;
 let initPromise = null;
 /**
- * Initialize crypto: sync keys with server, then fallback to local/generate.
- * Server is source of truth for per-user key pair.
- * Safe to call concurrently — deduplicates to single init.
- * Returns the exported public key (Base64 SPKI).
+ * Initialize push/file encryption.
+ *
+ * Encryption turns on only when the account has explicitly opted in —
+ * `encryptionEnabled` from `GET /users/me/keys` is the single authoritative
+ * signal (ADR-0008). Server unreachable or flag off leaves it off and every
+ * send goes out in the clear.
+ *
+ * When it is on, this delegates to the per-device keypair: nothing is asked
+ * of the server but the flag, and nothing is ever uploaded.
+ *
+ * Safe to call concurrently — deduplicates to a single init.
+ * Returns this host's public key when encryption is active, '' otherwise.
  */
 const initCrypto = (apiKey, baseUrl) => {
     if (initPromise)
         return initPromise;
     initPromise = (async () => {
-        // Try local cache first
-        const stored = loadStoredKeys();
-        // Try server sync if API key available
-        if (apiKey) {
-            const serverResult = await fetchServerKeys(apiKey, baseUrl);
-            // Server says encryption disabled — skip crypto init
-            if (serverResult && !serverResult.encryptionEnabled) {
-                cachedKeyPair = null;
-                cachedExportedPublicKey = null;
-                cachedOwnPublicKey = null;
-                return '';
-            }
-            if (serverResult?.keys) {
-                // Server has keys — adopt them (server is source of truth)
-                if (!stored || stored.publicKey !== serverResult.keys.publicKey) {
-                    storeKeys(serverResult.keys);
-                }
-                cachedKeyPair = await importKeyPair(serverResult.keys);
-                cachedExportedPublicKey = serverResult.keys.publicKey;
-                cachedOwnPublicKey = cachedKeyPair.publicKey;
-                return serverResult.keys.publicKey;
-            }
-            // Server has no keys
-            if (stored) {
-                // Upload local keys to server
-                await uploadServerKeys(stored, apiKey, baseUrl);
-                cachedKeyPair = await importKeyPair(stored);
-                cachedExportedPublicKey = stored.publicKey;
-                cachedOwnPublicKey = cachedKeyPair.publicKey;
-                return stored.publicKey;
-            }
-            // No keys anywhere — generate + upload
-            const keyPair = await generateKeyPair();
-            const exported = await exportKeyPair(keyPair);
-            storeKeys(exported);
-            await uploadServerKeys(exported, apiKey, baseUrl);
-            cachedKeyPair = keyPair;
-            cachedExportedPublicKey = exported.publicKey;
-            cachedOwnPublicKey = keyPair.publicKey;
-            return exported.publicKey;
+        // Local-only mode (no apiKey): used by tests and offline setups. There is
+        // no flag to consult, so encryption stays off rather than being inferred.
+        if (!apiKey) {
+            pushCryptoEnabled = false;
+            return '';
         }
-        // No API key — local-only mode
-        if (stored) {
-            cachedKeyPair = await importKeyPair(stored);
-            cachedExportedPublicKey = stored.publicKey;
-            cachedOwnPublicKey = cachedKeyPair.publicKey;
-            return stored.publicKey;
+        const state = await fetchEncryptionState(apiKey, baseUrl);
+        if (state)
+            deleteLegacyKeys();
+        if (!state?.encryptionEnabled) {
+            pushCryptoEnabled = false;
+            return '';
         }
-        const keyPair = await generateKeyPair();
-        const exported = await exportKeyPair(keyPair);
-        storeKeys(exported);
-        cachedKeyPair = keyPair;
-        cachedExportedPublicKey = exported.publicKey;
-        cachedOwnPublicKey = keyPair.publicKey;
-        return exported.publicKey;
+        const publicKey = await (0, exports.initDeviceCrypto)();
+        pushCryptoEnabled = true;
+        return publicKey;
     })().catch((err) => {
         initPromise = null;
         throw err;
@@ -200,44 +153,74 @@ const initCrypto = (apiKey, baseUrl) => {
     return initPromise;
 };
 exports.initCrypto = initCrypto;
-const fetchServerKeys = async (apiKey, baseUrl) => {
+const fetchEncryptionState = async (apiKey, baseUrl) => {
     try {
         const url = `${(baseUrl ?? 'https://api.zeph.to/v1').replace(/\/$/, '')}/users/me/keys`;
         const res = await fetch(url, { headers: { 'X-API-Key': apiKey } });
         if (!res.ok)
             return null;
         const json = await res.json();
-        const keys = json.data?.encryptionKeys;
-        const encryptionEnabled = json.data?.encryptionEnabled ?? (keys ? true : false);
+        cachedLegacyPublicKey = json.data?.encryptionKeys?.publicKey ?? null;
         return {
-            keys: keys?.publicKey && keys?.privateKey ? keys : null,
-            encryptionEnabled,
+            encryptionEnabled: json.data?.encryptionEnabled === true,
+            legacyPublicKey: cachedLegacyPublicKey,
         };
     }
     catch {
         return null;
     }
 };
-// SECURITY: only the PUBLIC key is ever sent to the server. The server
-// rejects private-key uploads outright (per-device E2E — escrow removed),
-// and a private key must never leave this host. Sending the full
-// ExportedKeyPair previously leaked the private key onto the wire on every
-// init and the rejection was swallowed silently. The per-device migration
-// (see ADR-0007) reworks this path; until then, register the public key only.
-const uploadServerKeys = async (keys, apiKey, baseUrl) => {
-    try {
-        const url = `${(baseUrl ?? 'https://api.zeph.to/v1').replace(/\/$/, '')}/users/me/keys`;
-        await fetch(url, {
-            method: 'PUT',
-            headers: { 'X-API-Key': apiKey, 'Content-Type': 'application/json' },
-            body: JSON.stringify({ publicKey: keys.publicKey }),
-        });
+/**
+ * Keep only devices this host can actually encrypt for.
+ *
+ * A device without a public key has never run a build that registers one, and
+ * a device still advertising the account-wide key has not migrated to
+ * per-device E2E — wrapping for either produces a push it cannot open, which
+ * is worse than sending plaintext it can read.
+ */
+const selectRecipients = (devices) => devices
+    .filter((d) => !!d.publicKey && d.publicKey !== cachedLegacyPublicKey)
+    .map(({ deviceId, publicKey }) => ({ deviceId, publicKey }));
+exports.selectRecipients = selectRecipients;
+/**
+ * Wrap one raw AES key for every recipient device.
+ *
+ * The payload is encrypted once and only the wrapped key repeats, so an
+ * attachment costs one S3 object regardless of device count. A recipient
+ * whose public key will not import is dropped rather than failing the send —
+ * one broken device record must not silence every push.
+ */
+const wrapForDevices = async (rawKey, senderPrivateKey, recipients) => {
+    const entries = await Promise.all(recipients.map(async ({ deviceId, publicKey }) => {
+        try {
+            const sharedKey = await deriveAesKey(senderPrivateKey, await importPublicKey(publicKey));
+            const keyIv = crypto.getRandomValues(new Uint8Array(12));
+            const wrapped = await crypto.subtle.encrypt({ name: 'AES-GCM', iv: keyIv }, sharedKey, rawKey);
+            return [
+                deviceId,
+                JSON.stringify({ encryptedKey: toBase64(wrapped), keyIv: toBase64(keyIv.buffer) }),
+            ];
+        }
+        catch (err) {
+            console.error(`[Crypto] Skipping device ${deviceId} — unusable public key:`, err);
+            return null;
+        }
+    }));
+    const keyMap = {};
+    for (const entry of entries) {
+        if (entry)
+            keyMap[entry[0]] = entry[1];
     }
-    catch { /* non-critical */ }
+    if (Object.keys(keyMap).length === 0)
+        throw new Error('No recipient device accepted the wrapped key');
+    return keyMap;
 };
-const getKeyPair = () => cachedKeyPair;
+// Gated on the account opt-in, not on the keypair's existence: the same
+// keypair backs stream frames, which are encrypted regardless, so presence
+// alone would turn push encryption on for accounts that never asked.
+const getKeyPair = () => (pushCryptoEnabled ? deviceKeyPair : null);
 exports.getKeyPair = getKeyPair;
-const getPublicKey = () => cachedExportedPublicKey;
+const getPublicKey = () => (pushCryptoEnabled ? deviceExportedPublicKey : null);
 exports.getPublicKey = getPublicKey;
 /**
  * Drop the cached keys so every later send goes out as plaintext.
@@ -251,73 +234,55 @@ exports.getPublicKey = getPublicKey;
  * circuits on `cryptoInitialized`. A restart after an upgrade re-adopts them.
  */
 const disableCrypto = () => {
-    cachedKeyPair = null;
-    cachedExportedPublicKey = null;
-    cachedOwnPublicKey = null;
+    pushCryptoEnabled = false;
 };
 exports.disableCrypto = disableCrypto;
 /**
- * Encrypt push body for a recipient.
- * Returns fields ready to merge into the sendPush payload.
- */
-const encryptPushBody = async (input, recipientPublicKeyRaw) => {
-    if (!cachedKeyPair || !cachedExportedPublicKey)
-        throw new Error('Crypto not initialized');
-    const recipientKey = await importPublicKey(recipientPublicKeyRaw);
-    const payload = await encrypt(JSON.stringify({ title: input.title, body: input.body, url: input.url }), cachedKeyPair.privateKey, recipientKey);
-    return {
-        body: JSON.stringify({ ciphertext: payload.ciphertext, iv: payload.iv }),
-        encryptedKey: JSON.stringify({ encryptedKey: payload.encryptedKey, keyIv: payload.keyIv }),
-        senderPublicKey: cachedExportedPublicKey,
-        isEncrypted: true,
-    };
-};
-exports.encryptPushBody = encryptPushBody;
-/**
- * Encrypt push body for self (all own devices).
+ * Encrypt a push body for the given recipient devices.
+ *
+ * Returns the wire fields the API expects: `body` carries the ciphertext and
+ * IV, `deviceKeyMap` the per-device wrapped keys, `senderPublicKey` the half
+ * recipients need to derive the same secret back.
  */
-const encryptPushBodyForSelf = async (input) => {
-    if (!cachedKeyPair || !cachedExportedPublicKey || !cachedOwnPublicKey)
+const encryptPushBodyForDevices = async (input, recipients) => {
+    if (!deviceKeyPair || !deviceExportedPublicKey)
         throw new Error('Crypto not initialized');
-    const payload = await encrypt(JSON.stringify({ title: input.title, body: input.body, url: input.url }), cachedKeyPair.privateKey, cachedOwnPublicKey);
+    const messageKey = await crypto.subtle.generateKey({ name: 'AES-GCM', length: 256 }, true, ['encrypt', 'decrypt']);
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const ciphertext = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, messageKey, new TextEncoder().encode(JSON.stringify({ title: input.title, body: input.body, url: input.url })));
+    const rawMessageKey = await crypto.subtle.exportKey('raw', messageKey);
     return {
-        body: JSON.stringify({ ciphertext: payload.ciphertext, iv: payload.iv }),
-        encryptedKey: JSON.stringify({ encryptedKey: payload.encryptedKey, keyIv: payload.keyIv }),
-        senderPublicKey: cachedExportedPublicKey,
+        body: JSON.stringify({ ciphertext: toBase64(ciphertext), iv: toBase64(iv.buffer) }),
+        deviceKeyMap: await wrapForDevices(rawMessageKey, deviceKeyPair.privateKey, recipients),
+        senderPublicKey: deviceExportedPublicKey,
         isEncrypted: true,
     };
 };
-exports.encryptPushBodyForSelf = encryptPushBodyForSelf;
-/**
- * Encrypt file content for a recipient.
- * Returns encrypted buffer + key material for file attachment metadata.
- */
-const encryptFileForRecipient = async (content, recipientPublicKeyRaw) => {
-    if (!cachedKeyPair)
-        throw new Error('Crypto not initialized');
-    const recipientKey = await importPublicKey(recipientPublicKeyRaw);
-    const result = await encryptFileContent(content, cachedKeyPair.privateKey, recipientKey);
-    return {
-        ciphertext: result.ciphertext,
-        iv: result.iv,
-        encryptedKey: JSON.stringify({ encryptedKey: result.encryptedKey, keyIv: result.keyIv }),
-    };
-};
-exports.encryptFileForRecipient = encryptFileForRecipient;
+exports.encryptPushBodyForDevices = encryptPushBodyForDevices;
 /**
- * Encrypt file content for self (all own devices).
+ * Encrypt file content for the given recipient devices.
  */
-const encryptFileForSelf = async (content) => {
-    if (!cachedKeyPair || !cachedOwnPublicKey)
+const encryptFileForDevices = async (content, recipients) => {
+    if (!deviceKeyPair)
         throw new Error('Crypto not initialized');
-    const result = await encryptFileContent(content, cachedKeyPair.privateKey, cachedOwnPublicKey);
+    // Binary content must be encrypted byte for byte — running a Buffer through
+    // TextEncoder would UTF-8 mangle every non-ASCII byte. Today's only caller
+    // passes markdown, so this is a guard against the first binary sender rather
+    // than a live fix (the MCP twin took that bug in production).
+    const buffer = typeof content === 'string'
+        ? new TextEncoder().encode(content)
+        : new Uint8Array(content.buffer, content.byteOffset, content.byteLength);
+    const fileKey = await crypto.subtle.generateKey({ name: 'AES-GCM', length: 256 }, true, ['encrypt', 'decrypt']);
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const ciphertext = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, fileKey, buffer);
+    const rawFileKey = await crypto.subtle.exportKey('raw', fileKey);
     return {
-        ciphertext: result.ciphertext,
-        iv: result.iv,
-        encryptedKey: JSON.stringify({ encryptedKey: result.encryptedKey, keyIv: result.keyIv }),
+        ciphertext: Buffer.from(ciphertext),
+        iv: toBase64(iv.buffer),
+        deviceKeyMap: await wrapForDevices(rawFileKey, deviceKeyPair.privateKey, recipients),
     };
 };
-exports.encryptFileForSelf = encryptFileForSelf;
+exports.encryptFileForDevices = encryptFileForDevices;
 const DEVICE_KEYS_DIR = (0, path_1.join)((0, os_1.homedir)(), '.zeph');
 const DEVICE_KEYS_PATH = (0, path_1.join)(DEVICE_KEYS_DIR, 'device-keys.json');
 let deviceKeyPair = null;

package/dist/gate.d.ts

@@ -19,6 +19,11 @@ export interface GateVerdict {
  * (most non-Claude agents pass no counts): in normal mode the push still
  * fires — preserving the historical always-push behavior of the dumb
  * hooks — while quiet/loud now work everywhere.
+ *
+ * These defaults cannot rescue a quiet dial: quiet only lets a `high` marker
+ * through, and a hook with no turn facts has no marker either. That is why
+ * the installed templates pass `--pushmode-default normal` (see templates.ts)
+ * — for them quiet is not a lower volume, it is permanent silence.
  */
 export declare const GATE_DEFAULTS: {
     readonly toolCount: 2;
@@ -41,6 +46,46 @@ export declare const remoteMarkerPath: (hash: string) => string;
 export declare const remoteDigest: (text: string) => string;
 /** True when the user ran /zeph-mute for this project. */
 export declare const isMuted: (dir: string) => boolean;
-/** The user's session push-mode dial (/zeph-quiet | /zeph-loud), default normal. */
-export declare const readPushMode: (dir: string) => GatePushMode;
+/**
+ * Push mode for an install that has never set a dial. The twin is
+ * plugin/hooks/gate.sh's missing-5th-argument default; the shared vectors
+ * never reach either one (every vector passes pushMode explicitly), so both
+ * sides pin it in their own tests.
+ */
+export declare const PUSHMODE_DEFAULT: GatePushMode;
+/**
+ * `notify` flag naming the push mode to assume when the project has no dial.
+ * Written by templates.ts into every hook-driven agent's completion hook and
+ * read back in cli.ts — shared so the two can never drift apart.
+ */
+export declare const PUSHMODE_DEFAULT_FLAG = "pushmode-default";
+/**
+ * The user's session push-mode dial (/zeph-quiet | /zeph-loud | /zeph-normal).
+ *
+ * Three failure shapes, three answers — "no dial" is the only one that gets
+ * the quiet default:
+ *   - no dial file          → `fallback` (PUSHMODE_DEFAULT unless the caller
+ *                             overrides it with --pushmode-default)
+ *   - unusable dial file    → normal. A missing project hash, an unreadable
+ *                             file, or a garbled/empty value is a broken
+ *                             setting, and resolving breakage to silence
+ *                             leaves the user with no symptom to debug. The
+ *                             point of the new default is quiet, not hidden
+ *                             errors.
+ *   - readable dial file    → whatever it says.
+ */
+export declare const readPushMode: (dir: string, fallback?: GatePushMode) => GatePushMode;
+/**
+ * Push mode for a `--auto` notify: the user's dial if they set one, otherwise
+ * the mode named by `--pushmode-default`, otherwise the built-in quiet.
+ *
+ * The dial outranks the flag deliberately. The flag exists so an agent whose
+ * hook cannot participate in the heuristic still pushes out of the box; if it
+ * outranked the dial, `/zeph-quiet` would silently do nothing for that agent.
+ *
+ * A flag value that isn't one of the three modes resolves to `normal`, not to
+ * the quiet default — same rule as a garbled dial file. A caller that passes
+ * nonsense has a bug, and answering a bug with silence hides it.
+ */
+export declare const autoPushMode: (dir: string, flag: string | boolean | undefined) => GatePushMode;
 //# sourceMappingURL=gate.d.ts.map

package/dist/gate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAyBA,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAC3D,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEvD,MAAM,WAAW,SAAS;IACxB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,gBAAgB,EAAE,MAAM,CAAC;IACzB,yDAAyD;IACzD,YAAY,EAAE,OAAO,CAAC;IACtB,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,YAAY,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAAC;CAC7B;AAED;;;;;GAKG;AACH,eAAO,MAAM,aAAa;;;;CAIhB,CAAC;AAEX,eAAO,MAAM,eAAe,GAAI,KAAK,MAAM,GAAG,SAAS,KAAG,UACS,CAAC;AAEpE,eAAO,MAAM,iBAAiB,GAAI,KAAK,MAAM,GAAG,SAAS,KAAG,YACR,CAAC;AAErD,eAAO,MAAM,UAAU,GAAI,OAAO,SAAS,KAAG,WAW7C,CAAC;AAeF,eAAO,MAAM,QAAQ,QAAO,MACoD,CAAC;AA2BjF,eAAO,MAAM,WAAW,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,IAOlD,CAAC;AAWF,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,GAAI,MAAM,MAAM,KAAG,MAA4C,CAAC;AAE7F;;;;;GAKG;AACH,eAAO,MAAM,YAAY,GAAI,MAAM,MAAM,KAAG,MAG1B,CAAC;AAEnB,0DAA0D;AAC1D,eAAO,MAAM,OAAO,GAAI,KAAK,MAAM,KAAG,OAGrC,CAAC;AAEF,oFAAoF;AACpF,eAAO,MAAM,YAAY,GAAI,KAAK,MAAM,KAAG,YAU1C,CAAC"}
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAyBA,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAC3D,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEvD,MAAM,WAAW,SAAS;IACxB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,gBAAgB,EAAE,MAAM,CAAC;IACzB,yDAAyD;IACzD,YAAY,EAAE,OAAO,CAAC;IACtB,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,YAAY,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,MAAM,GAAG,QAAQ,CAAC;CAC7B;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa;;;;CAIhB,CAAC;AAEX,eAAO,MAAM,eAAe,GAAI,KAAK,MAAM,GAAG,SAAS,KAAG,UACS,CAAC;AAEpE,eAAO,MAAM,iBAAiB,GAAI,KAAK,MAAM,GAAG,SAAS,KAAG,YACR,CAAC;AAErD,eAAO,MAAM,UAAU,GAAI,OAAO,SAAS,KAAG,WAW7C,CAAC;AAeF,eAAO,MAAM,QAAQ,QAAO,MACoD,CAAC;AA2BjF,eAAO,MAAM,WAAW,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,IAOlD,CAAC;AAWF,+EAA+E;AAC/E,eAAO,MAAM,gBAAgB,GAAI,MAAM,MAAM,KAAG,MAA4C,CAAC;AAE7F;;;;;GAKG;AACH,eAAO,MAAM,YAAY,GAAI,MAAM,MAAM,KAAG,MAG1B,CAAC;AAEnB,0DAA0D;AAC1D,eAAO,MAAM,OAAO,GAAI,KAAK,MAAM,KAAG,OAGrC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,EAAE,YAAsB,CAAC;AAEtD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AAExD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,YAAY,GACvB,KAAK,MAAM,EACX,WAAU,YAA+B,KACxC,YAUF,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,YAAY,GAAI,KAAK,MAAM,EAAE,MAAM,MAAM,GAAG,OAAO,GAAG,SAAS,KAAG,YACW,CAAC"}

package/dist/gate.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.readPushMode = exports.isMuted = exports.remoteDigest = exports.remoteMarkerPath = exports.projectHash = exports.stateDir = exports.decidePush = exports.normalizePushMode = exports.normalizeMarker = exports.GATE_DEFAULTS = void 0;
+exports.autoPushMode = exports.readPushMode = exports.PUSHMODE_DEFAULT_FLAG = exports.PUSHMODE_DEFAULT = exports.isMuted = exports.remoteDigest = exports.remoteMarkerPath = exports.projectHash = exports.stateDir = exports.decidePush = exports.normalizePushMode = exports.normalizeMarker = exports.GATE_DEFAULTS = void 0;
 /**
  * Push-gate decision — the portable half of the Zeph Stop-hook logic.
  *
@@ -30,6 +30,11 @@ const path_1 = require("path");
  * (most non-Claude agents pass no counts): in normal mode the push still
  * fires — preserving the historical always-push behavior of the dumb
  * hooks — while quiet/loud now work everywhere.
+ *
+ * These defaults cannot rescue a quiet dial: quiet only lets a `high` marker
+ * through, and a hook with no turn facts has no marker either. That is why
+ * the installed templates pass `--pushmode-default normal` (see templates.ts)
+ * — for them quiet is not a lower volume, it is permanent silence.
  */
 exports.GATE_DEFAULTS = {
     toolCount: 2,
@@ -133,14 +138,41 @@ const isMuted = (dir) => {
     return hash !== null && findStateFile('muted', hash) !== null;
 };
 exports.isMuted = isMuted;
-/** The user's session push-mode dial (/zeph-quiet | /zeph-loud), default normal. */
-const readPushMode = (dir) => {
+/**
+ * Push mode for an install that has never set a dial. The twin is
+ * plugin/hooks/gate.sh's missing-5th-argument default; the shared vectors
+ * never reach either one (every vector passes pushMode explicitly), so both
+ * sides pin it in their own tests.
+ */
+exports.PUSHMODE_DEFAULT = 'quiet';
+/**
+ * `notify` flag naming the push mode to assume when the project has no dial.
+ * Written by templates.ts into every hook-driven agent's completion hook and
+ * read back in cli.ts — shared so the two can never drift apart.
+ */
+exports.PUSHMODE_DEFAULT_FLAG = 'pushmode-default';
+/**
+ * The user's session push-mode dial (/zeph-quiet | /zeph-loud | /zeph-normal).
+ *
+ * Three failure shapes, three answers — "no dial" is the only one that gets
+ * the quiet default:
+ *   - no dial file          → `fallback` (PUSHMODE_DEFAULT unless the caller
+ *                             overrides it with --pushmode-default)
+ *   - unusable dial file    → normal. A missing project hash, an unreadable
+ *                             file, or a garbled/empty value is a broken
+ *                             setting, and resolving breakage to silence
+ *                             leaves the user with no symptom to debug. The
+ *                             point of the new default is quiet, not hidden
+ *                             errors.
+ *   - readable dial file    → whatever it says.
+ */
+const readPushMode = (dir, fallback = exports.PUSHMODE_DEFAULT) => {
     const hash = (0, exports.projectHash)(dir);
     if (!hash)
         return 'normal';
     const file = findStateFile('pushmode', hash);
     if (!file)
-        return 'normal';
+        return fallback;
     try {
         return (0, exports.normalizePushMode)((0, fs_1.readFileSync)(file, 'utf-8').replace(/\s+/g, ''));
     }
@@ -149,3 +181,17 @@ const readPushMode = (dir) => {
     }
 };
 exports.readPushMode = readPushMode;
+/**
+ * Push mode for a `--auto` notify: the user's dial if they set one, otherwise
+ * the mode named by `--pushmode-default`, otherwise the built-in quiet.
+ *
+ * The dial outranks the flag deliberately. The flag exists so an agent whose
+ * hook cannot participate in the heuristic still pushes out of the box; if it
+ * outranked the dial, `/zeph-quiet` would silently do nothing for that agent.
+ *
+ * A flag value that isn't one of the three modes resolves to `normal`, not to
+ * the quiet default — same rule as a garbled dial file. A caller that passes
+ * nonsense has a bug, and answering a bug with silence hides it.
+ */
+const autoPushMode = (dir, flag) => (0, exports.readPushMode)(dir, typeof flag === 'string' ? (0, exports.normalizePushMode)(flag) : exports.PUSHMODE_DEFAULT);
+exports.autoPushMode = autoPushMode;

package/dist/installer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"installer.d.ts","sourceRoot":"","sources":["../src/installer.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AA4BzC;;;GAGG;AACH;;;;GAIG;AACH,eAAO,MAAM,YAAY,GAAI,YAAY,MAAM,GAAG,SAAS,EAAE,SAAS,OAAO,KAAG,OACxD,CAAC;AAoBzB;6EAC6E;AAC7E,eAAO,MAAM,aAAa,GAAI,UAAU,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,IAqBhF,CAAC;AAgQF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,UAAU,KAAK,EAAE,EAAE,MAAM,MAAM,KAAG,KAAK,EAKxE,CAAC;AA8EF,eAAO,MAAM,aAAa,GAAU,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,KAAG,OAAO,CAAC,MAAM,CA4G1F,CAAC"}
+{"version":3,"file":"installer.d.ts","sourceRoot":"","sources":["../src/installer.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AA4BzC;;;GAGG;AACH;;;;GAIG;AACH,eAAO,MAAM,YAAY,GAAI,YAAY,MAAM,GAAG,SAAS,EAAE,SAAS,OAAO,KAAG,OACxD,CAAC;AAoBzB;6EAC6E;AAC7E,eAAO,MAAM,aAAa,GAAI,UAAU,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,IAqBhF,CAAC;AAgQF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,UAAU,KAAK,EAAE,EAAE,MAAM,MAAM,KAAG,KAAK,EAKxE,CAAC;AA8EF,eAAO,MAAM,aAAa,GAAU,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,KAAG,OAAO,CAAC,MAAM,CAgH1F,CAAC"}

package/dist/installer.js

@@ -489,9 +489,13 @@ const handleInstall = async (args) => {
     // Hooks fire for every session of every configured agent, so say it here —
     // at the moment the hooks get installed — together with the volume dials.
     console.log('  Notifications now fire for EVERY session of each agent above');
-    console.log('  (not only sessions launched with `zeph cc`). Dial the volume');
-    console.log('  any time — in Claude Code:');
-    console.log('    /zeph-quiet --global   only blockers + high-priority, all projects');
+    console.log('  (not only sessions launched with `zeph cc`).');
+    console.log('');
+    console.log('  In Claude Code the default is QUIET: you get pushed when the agent');
+    console.log('  asks you something and when a session finishes, not on every turn.');
+    console.log('  Dial it any time:');
+    console.log('    /zeph-normal           push on every turn that did real work');
+    console.log('    /zeph-loud             push on every turn');
     console.log('    /zeph-mute             full silence, current project');
     console.log('    /zeph-status           show what is in effect\n');
     return 0;

package/dist/templates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../src/templates.ts"],"names":[],"mappings":"AA4FA,6EAA6E;AAC7E,eAAO,MAAM,WAAW,QAItB,CAAC;AAEH,6EAA6E;AAC7E,eAAO,MAAM,aAAa,QAAyE,CAAC;AAEpG,sDAAsD;AACtD,eAAO,MAAM,WAAW,QAAyE,CAAC;AAElG,oDAAoD;AACpD,eAAO,MAAM,UAAU,QAAyE,CAAC;AAEjG,oFAAoF;AACpF,eAAO,MAAM,YAAY,QAAyE,CAAC;AAEnG,gEAAgE;AAChE,eAAO,MAAM,UAAU,QAAkE,CAAC;AAE1F,4FAA4F;AAC5F,eAAO,MAAM,UAAU,QAAkE,CAAC;AAI1F,eAAO,MAAM,YAAY,QAKd,CAAC;AAEZ,eAAO,MAAM,cAAc,QAOhB,CAAC;AAEZ,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;CAuBxB,CAAC;AAYF,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;CASvB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,GAAI,OAAO,OAAO,KAAG,OAUhD,CAAC;AAEF,eAAO,MAAM,aAAa,QASf,CAAC;AASZ,eAAO,MAAM,eAAe,oFAA+E,CAAC;AAC5G,eAAO,MAAM,aAAa,sBAAsB,CAAC;AAQjD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,UAAU,MAAM,EAAE,MAAM,MAAM,KAAG,MAWnE,CAAC;AAEF,uEAAuE;AACvE,eAAO,MAAM,kBAAkB,GAAI,UAAU,MAAM,KAAG,MAOrD,CAAC"}
+{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../src/templates.ts"],"names":[],"mappings":"AAsGA,6EAA6E;AAC7E,eAAO,MAAM,WAAW,QAItB,CAAC;AAEH,6EAA6E;AAC7E,eAAO,MAAM,aAAa,QAAyE,CAAC;AAEpG,sDAAsD;AACtD,eAAO,MAAM,WAAW,QAAyE,CAAC;AAElG,oDAAoD;AACpD,eAAO,MAAM,UAAU,QAAyE,CAAC;AAEjG,oFAAoF;AACpF,eAAO,MAAM,YAAY,QAAyE,CAAC;AAEnG,gEAAgE;AAChE,eAAO,MAAM,UAAU,QAAkE,CAAC;AAE1F,4FAA4F;AAC5F,eAAO,MAAM,UAAU,QAAkE,CAAC;AAI1F,eAAO,MAAM,YAAY,QAKd,CAAC;AAEZ,eAAO,MAAM,cAAc,QAOhB,CAAC;AAEZ,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;CAuBxB,CAAC;AAYF,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;CASvB,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,GAAI,OAAO,OAAO,KAAG,OAUhD,CAAC;AAEF,eAAO,MAAM,aAAa,QASf,CAAC;AASZ,eAAO,MAAM,eAAe,oFAA+E,CAAC;AAC5G,eAAO,MAAM,aAAa,sBAAsB,CAAC;AAQjD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,UAAU,MAAM,EAAE,MAAM,MAAM,KAAG,MAWnE,CAAC;AAEF,uEAAuE;AACvE,eAAO,MAAM,kBAAkB,GAAI,UAAU,MAAM,KAAG,MAOrD,CAAC"}

package/dist/templates.js

@@ -19,6 +19,7 @@
 // and the agents can't drift apart.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.removeManagedBlock = exports.upsertManagedBlock = exports.ZEPH_MARK_END = exports.ZEPH_MARK_START = exports.COPILOT_HOOKS = exports.isZephHookGroup = exports.CODEX_HOOKS = exports.GEMINI_HOOKS = exports.WINDSURF_HOOKS = exports.CURSOR_HOOKS = exports.AIDER_RULE = exports.CLINE_RULE = exports.COPILOT_RULE = exports.CODEX_RULE = exports.GEMINI_RULE = exports.WINDSURF_RULE = exports.CURSOR_RULE = void 0;
+const gate_js_1 = require("./gate.js");
 const zeph_core_generated_js_1 = require("./zeph-core.generated.js");
 // Graceful resolution: prefer the installed `zeph` CLI, but fall back to
 // `npx -y @zeph-to/cli` so the hook still fires when the user
@@ -27,11 +28,20 @@ const zeph_core_generated_js_1 = require("./zeph-core.generated.js");
 // pattern in plugin/hooks/zeph-{stop,ask}.sh.
 //
 // `--auto` applies the shared push-gate before sending (see src/gate.ts):
-// in normal mode the push still fires (gate defaults assume real work), but
-// the /zeph-quiet | /zeph-loud dial now works for every hook-driven agent.
-// Older installed `zeph` versions parse `--auto` as an unknown boolean flag
-// and ignore it — graceful backward compatibility.
-const NOTIFY_CMD = '$(command -v zeph || echo "npx -y @zeph-to/cli") notify --title "Task done" --auto 2>/dev/null || true';
+// the push still fires (gate defaults assume real work), and the
+// /zeph-quiet | /zeph-loud dial works for every hook-driven agent.
+//
+// `--pushmode-default normal` is what keeps the first half of that true. The
+// built-in default for a project with no dial is quiet, and quiet only lets a
+// `high` Push Signal marker through — a marker these hooks have no way to
+// emit. Without the flag they would install and then never push again. The
+// user's own dial still outranks it, so /zeph-quiet keeps working here.
+//
+// Older installed `zeph` versions parse both flags as unknown booleans and
+// ignore them — graceful backward compatibility, and for `--pushmode-default`
+// specifically the old build's behavior was already "normal when no dial".
+const NOTIFY_CMD = '$(command -v zeph || echo "npx -y @zeph-to/cli") notify --title "Task done" --auto '
+    + `--${gate_js_1.PUSHMODE_DEFAULT_FLAG} normal 2>/dev/null || true`;
 // Prompt-submit hook command — remote-origin detection (ADR-0002). Reads
 // the hook JSON on stdin and prints additionalContext JSON on a marker
 // match (see src/remote-hook.ts). stdout IS the hook response, so only

package/dist/types.d.ts

@@ -37,6 +37,8 @@ export interface PushItem {
     title?: string;
     body?: string;
     createdAt: string;
+    /** E2E: when true, `title`/`body` are absent and the ciphertext is in `body`. */
+    isEncrypted?: boolean;
 }
 export interface ListResult {
     pushes: PushItem[];

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IACzC,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;IAChD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;oEAEgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;CACxD;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,QAAQ,EAAE,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IACzC,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;IAChD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;oEAEgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;CACxD;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,QAAQ,EAAE,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH"}

package/dist/zeph-hook.d.ts

@@ -5,6 +5,15 @@ export declare class ZephHook {
     private readonly timeoutMs;
     private cryptoInitialized;
     constructor(options: ZephOptions);
+    /**
+     * Resolve who this push can be encrypted for, or null when it cannot be.
+     *
+     * The device list is fetched per send rather than cached: a phone that
+     * registered its key a minute ago must be able to read the next push, and a
+     * long-lived listener would otherwise keep wrapping for a stale set.
+     * Failures here are not fatal — plaintext the user can read beats a
+     * notification that never arrives.
+     */
     private ensureCrypto;
     /**
      * A push must not be lost because E2E turned out to be unavailable.

package/dist/zeph-hook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"zeph-hook.d.ts","sourceRoot":"","sources":["../src/zeph-hook.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAY,gBAAgB,EAAE,gBAAgB,EAAoB,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAoCxL,qBAAa,QAAQ;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAEnC,OAAO,CAAC,iBAAiB,CAAS;gBAEtB,OAAO,EAAE,WAAW;YASlB,YAAY;IAY1B;;;;;;;;;;;OAWG;IACG,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;YAgB7C,UAAU;YAqCV,cAAc;IAsDtB,aAAa,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAK7G,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcrF,IAAI,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAmB9C,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAKlD,UAAU,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAK7C;;;;OAIG;IACG,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;YASxF,OAAO;IAiCrB,OAAO,CAAC,UAAU;CASnB"}
+{"version":3,"file":"zeph-hook.d.ts","sourceRoot":"","sources":["../src/zeph-hook.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAY,gBAAgB,EAAE,gBAAgB,EAAoB,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAoCxL,qBAAa,QAAQ;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAEnC,OAAO,CAAC,iBAAiB,CAAS;gBAEtB,OAAO,EAAE,WAAW;IAShC;;;;;;;;OAQG;YACW,YAAY;IAyB1B;;;;;;;;;;;OAWG;IACG,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;YAgB7C,UAAU;YAyCV,cAAc;IA6DtB,aAAa,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAK7G,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcrF,IAAI,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAuB9C,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAKlD,UAAU,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAK7C;;;;OAIG;IACG,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;YASxF,OAAO;IAiCrB,OAAO,CAAC,UAAU;CASnB"}

package/dist/zeph-hook.js

@@ -50,17 +50,39 @@ class ZephHook {
         this.baseUrl = (options.baseUrl ?? DEFAULT_BASE_URL).replace(/\/$/, '');
         this.timeoutMs = options.timeout ?? DEFAULT_TIMEOUT_MS;
     }
+    /**
+     * Resolve who this push can be encrypted for, or null when it cannot be.
+     *
+     * The device list is fetched per send rather than cached: a phone that
+     * registered its key a minute ago must be able to read the next push, and a
+     * long-lived listener would otherwise keep wrapping for a stale set.
+     * Failures here are not fatal — plaintext the user can read beats a
+     * notification that never arrives.
+     */
     async ensureCrypto() {
-        if (this.cryptoInitialized)
-            return !!(0, crypto_js_1.getKeyPair)();
-        try {
-            await (0, crypto_js_1.initCrypto)(this.apiKey, this.baseUrl);
+        if (!this.cryptoInitialized) {
+            try {
+                await (0, crypto_js_1.initCrypto)(this.apiKey, this.baseUrl);
+            }
+            catch {
+                // fall through — getKeyPair() stays null and we send plaintext
+            }
             this.cryptoInitialized = true;
-            return !!(0, crypto_js_1.getKeyPair)();
         }
-        catch {
-            this.cryptoInitialized = true;
-            return false;
+        if (!(0, crypto_js_1.getKeyPair)())
+            return null;
+        try {
+            const json = await this.request('GET', '/devices');
+            const recipients = (0, crypto_js_1.selectRecipients)(json.data ?? []);
+            if (recipients.length === 0) {
+                console.error('[Crypto] No device has a per-device public key — sending plaintext.');
+                return null;
+            }
+            return recipients;
+        }
+        catch (err) {
+            console.error('[Crypto] Could not list devices, sending plaintext:', err);
+            return null;
         }
     }
     /**
@@ -99,19 +121,23 @@ class ZephHook {
         // carry it. Explicit caller values win.
         if (agentCtx)
             payload = { ...agentCtx, ...payload };
-        const canEncrypt = await this.ensureCrypto();
+        const recipients = await this.ensureCrypto();
         const body = payload.body;
         const bodyBytes = body ? new TextEncoder().encode(body).byteLength : 0;
         const isLongBody = bodyBytes > BODY_FILE_THRESHOLD;
         if (isLongBody && body) {
-            return this.notifyWithFile(payload, body, bodyBytes, canEncrypt);
+            return this.notifyWithFile(payload, body, bodyBytes, recipients);
         }
         // Encrypt push body if possible
         let sendPayload = { ...payload };
-        if (canEncrypt) {
+        if (recipients) {
             try {
-                const enc = await (0, crypto_js_1.encryptPushBodyForSelf)({ title: payload.title, body: payload.body, url: payload.url });
-                sendPayload = { ...sendPayload, title: undefined, body: enc.body, isEncrypted: true, encryptedKey: enc.encryptedKey, senderPublicKey: enc.senderPublicKey };
+                const enc = await (0, crypto_js_1.encryptPushBodyForDevices)({ title: payload.title, body: payload.body, url: payload.url }, recipients);
+                // `url: undefined` alongside the title: it is already sealed inside the
+                // ciphertext, and on a link push it IS the payload. Spreading `payload`
+                // above left the plaintext copy at the top level, handing the server the
+                // one thing `isEncrypted` promises it cannot see.
+                sendPayload = { ...sendPayload, title: undefined, url: undefined, body: enc.body, isEncrypted: true, deviceKeyMap: enc.deviceKeyMap, senderPublicKey: enc.senderPublicKey };
             }
             catch (err) {
                 console.error('[Crypto] Push encryption failed, sending plaintext:', err);
@@ -124,46 +150,51 @@ class ZephHook {
         }
         return { pushId };
     }
-    async notifyWithFile(payload, body, fileSize, canEncrypt) {
+    async notifyWithFile(payload, body, fileSize, recipients) {
         const fileName = 'response.md';
-        let fileType = inferMimeType(fileName);
-        // Encrypt file content if possible
-        let uploadContent = body;
-        let uploadSize = fileSize;
-        let fileIv;
-        let fileEncryptedKey;
-        if (canEncrypt) {
+        const preview = body.length > PREVIEW_LENGTH ? body.slice(0, PREVIEW_LENGTH) + '...' : body;
+        // Encrypt the attachment and the push body together, before anything is
+        // uploaded. Doing them one at a time around the upload let a failure land
+        // in between and ship ciphertext under a push with no `isEncrypted` — an
+        // attachment no client would even try to open.
+        let encrypted = null;
+        if (recipients) {
             try {
-                const encrypted = await (0, crypto_js_1.encryptFileForSelf)(body);
-                uploadContent = encrypted.ciphertext;
-                uploadSize = encrypted.ciphertext.length;
-                fileType = 'application/octet-stream';
-                fileIv = encrypted.iv;
-                fileEncryptedKey = encrypted.encryptedKey;
+                encrypted = {
+                    file: await (0, crypto_js_1.encryptFileForDevices)(body, recipients),
+                    push: await (0, crypto_js_1.encryptPushBodyForDevices)({ title: payload.title, body: preview, url: payload.url }, recipients),
+                };
             }
             catch (err) {
-                console.error('[Crypto] File encryption failed, sending plaintext:', err);
+                console.error('[Crypto] Encryption failed, sending plaintext:', err);
             }
         }
-        const upload = await this.requestUpload({ fileName, fileType, fileSize: uploadSize });
-        await this.uploadToS3(upload.uploadUrl, uploadContent, fileType);
-        const preview = body.length > PREVIEW_LENGTH ? body.slice(0, PREVIEW_LENGTH) + '...' : body;
-        // Encrypt push body
-        let sendPayload = {
+        const uploadContent = encrypted?.file.ciphertext ?? body;
+        const uploadType = encrypted ? 'application/octet-stream' : inferMimeType(fileName);
+        const uploadSize = encrypted ? encrypted.file.ciphertext.length : fileSize;
+        const upload = await this.requestUpload({ fileName, fileType: uploadType, fileSize: uploadSize });
+        await this.uploadToS3(upload.uploadUrl, uploadContent, uploadType);
+        const sendPayload = {
             ...payload,
-            body: preview,
+            title: encrypted ? undefined : payload.title,
+            body: encrypted ? encrypted.push.body : preview,
             type: payload.type ?? 'file',
-            files: [{ fileKey: upload.fileKey, fileName, fileSize, fileType: inferMimeType(fileName), iv: fileIv, encryptedKey: fileEncryptedKey }],
+            files: [{
+                    fileKey: upload.fileKey,
+                    fileName,
+                    fileSize,
+                    fileType: inferMimeType(fileName),
+                    iv: encrypted?.file.iv,
+                    deviceKeyMap: encrypted?.file.deviceKeyMap,
+                }],
+            ...(encrypted && {
+                // See notifyOnce: the url must not survive in the clear either.
+                url: undefined,
+                isEncrypted: true,
+                deviceKeyMap: encrypted.push.deviceKeyMap,
+                senderPublicKey: encrypted.push.senderPublicKey,
+            }),
         };
-        if (canEncrypt) {
-            try {
-                const enc = await (0, crypto_js_1.encryptPushBodyForSelf)({ title: payload.title, body: preview, url: payload.url });
-                sendPayload = { ...sendPayload, title: undefined, body: enc.body, isEncrypted: true, encryptedKey: enc.encryptedKey, senderPublicKey: enc.senderPublicKey };
-            }
-            catch (err) {
-                console.error('[Crypto] Push encryption failed, sending plaintext:', err);
-            }
-        }
         const json = await this.request('POST', '/pushes/send', sendPayload);
         const pushId = json.data?.pushId;
         if (!pushId) {
@@ -199,8 +230,12 @@ class ZephHook {
         const pushes = json.data.map((p) => ({
             pushId: p.pushId,
             type: p.type,
-            title: p.title,
-            body: p.body?.slice(0, 100),
+            // An encrypted push carries no plaintext title and a JSON envelope in
+            // `body`; slicing that renders `{"ciphertext":"AAAB...` as if it were the
+            // message. This host cannot decrypt (send-only), so say so instead.
+            title: p.isEncrypted ? undefined : p.title,
+            body: p.isEncrypted ? '[encrypted]' : p.body?.slice(0, 100),
+            isEncrypted: p.isEncrypted,
             createdAt: p.createdAt,
         }));
         return { pushes, count: pushes.length, hasMore: json.pagination?.hasMore ?? false };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zeph-to/cli",
-  "version": "1.27.1",
+  "version": "2.0.0",
   "description": "Zeph CLI + push notification SDK for AI agents",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",