@zeph-to/cli 2.0.0 → 2.1.0

package/dist/crypto.d.ts

@@ -127,5 +127,21 @@ export declare const getDevicePublicKey: () => string | null;
  * device. Requires initDeviceCrypto() to have completed.
  */
 export declare const encryptEphemeral: (plaintext: string, recipientPublicKeyRaw: string) => Promise<EncryptedEphemeralPayload>;
+/**
+ * Open an ephemeral envelope addressed to this device — the exact inverse of
+ * encryptEphemeral, and of the web's `encrypt` from @zeph/crypto, which
+ * produces the same five fields.
+ *
+ * Rejects rather than returning null: AES-GCM is authenticated, so a throw
+ * here means the envelope was sealed for another key, tampered with, or is not
+ * an envelope at all. Callers must treat every rejection as a refusal — there
+ * is no partial result to fall back on. Requires initDeviceCrypto().
+ *
+ * Note that opening an envelope proves only that its sender holds the private
+ * half of `senderPublicKey`; nothing signs that field, so it authenticates the
+ * key pairing and not the sender. A caller that needs to know *which* peer
+ * sent this must compare `senderPublicKey` against a key it already trusts.
+ */
+export declare const decryptEphemeral: (payload: EncryptedEphemeralPayload) => Promise<string>;
 export {};
 //# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AA+EH,UAAU,gBAAgB;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf;AAkDD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,EAAE,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CAyB5E,CAAC;AAsCF,wDAAwD;AACxD,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,mFAAmF;AACnF,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAElD;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,GAC3B,SAAS;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,KAClD,eAAe,EAG8C,CAAC;AA2CjE,eAAO,MAAM,UAAU,QAAO,aAAa,GAAG,IAAkD,CAAC;AACjG,eAAO,MAAM,YAAY,QAAO,MAAM,GAAG,IAA4D,CAAC;AAEtG;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa,QAAO,IAEhC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,GACpC,OAAO;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,EACtD,YAAY,eAAe,EAAE,KAC5B,OAAO,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,YAAY,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,IAAI,CAAC;CACnB,CAkBA,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,qBAAqB,GAChC,SAAS,MAAM,GAAG,MAAM,EACxB,YAAY,eAAe,EAAE,KAC5B,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,YAAY,CAAA;CAAE,CAsBxE,CAAC;AAcF;;;;GAIG;AACH,MAAM,WAAW,yBAA0B,SAAQ,gBAAgB;IACjE,eAAe,EAAE,MAAM,CAAC;CACzB;AAsBD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,QAAO,OAAO,CAAC,MAAM,CAoBjD,CAAC;AAEF,eAAO,MAAM,kBAAkB,QAAO,MAAM,GAAG,IAA+B,CAAC;AAE/E;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GAC3B,WAAW,MAAM,EACjB,uBAAuB,MAAM,KAC5B,OAAO,CAAC,yBAAyB,CAKnC,CAAC"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AA+EH,UAAU,gBAAgB;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf;AAsED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,EAAE,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CAyB5E,CAAC;AAsCF,wDAAwD;AACxD,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,mFAAmF;AACnF,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAElD;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,GAC3B,SAAS;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,KAClD,eAAe,EAG8C,CAAC;AA2CjE,eAAO,MAAM,UAAU,QAAO,aAAa,GAAG,IAAkD,CAAC;AACjG,eAAO,MAAM,YAAY,QAAO,MAAM,GAAG,IAA4D,CAAC;AAEtG;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa,QAAO,IAEhC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,GACpC,OAAO;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,EACtD,YAAY,eAAe,EAAE,KAC5B,OAAO,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,YAAY,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,IAAI,CAAC;CACnB,CAkBA,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,qBAAqB,GAChC,SAAS,MAAM,GAAG,MAAM,EACxB,YAAY,eAAe,EAAE,KAC5B,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,YAAY,CAAA;CAAE,CAsBxE,CAAC;AAcF;;;;GAIG;AACH,MAAM,WAAW,yBAA0B,SAAQ,gBAAgB;IACjE,eAAe,EAAE,MAAM,CAAC;CACzB;AAsBD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,QAAO,OAAO,CAAC,MAAM,CAoBjD,CAAC;AAEF,eAAO,MAAM,kBAAkB,QAAO,MAAM,GAAG,IAA+B,CAAC;AAE/E;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GAC3B,WAAW,MAAM,EACjB,uBAAuB,MAAM,KAC5B,OAAO,CAAC,yBAAyB,CAKnC,CAAC;AAEF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,gBAAgB,GAC3B,SAAS,yBAAyB,KACjC,OAAO,CAAC,MAAM,CAIhB,CAAC"}

package/dist/crypto.js

@@ -29,7 +29,7 @@
  * account keypair are gone.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.encryptEphemeral = exports.getDevicePublicKey = exports.initDeviceCrypto = exports.encryptFileForDevices = exports.encryptPushBodyForDevices = exports.disableCrypto = exports.getPublicKey = exports.getKeyPair = exports.selectRecipients = exports.initCrypto = void 0;
+exports.decryptEphemeral = exports.encryptEphemeral = exports.getDevicePublicKey = exports.initDeviceCrypto = exports.encryptFileForDevices = exports.encryptPushBodyForDevices = exports.disableCrypto = exports.getPublicKey = exports.getKeyPair = exports.selectRecipients = exports.initCrypto = void 0;
 /// <reference lib="dom" />
 const fs_1 = require("fs");
 const os_1 = require("os");
@@ -91,6 +91,13 @@ const encrypt = async (plaintext, senderPrivateKey, recipientPublicKey) => {
         keyIv: toBase64(keyIv.buffer),
     };
 };
+const decrypt = async (payload, recipientPrivateKey, senderPublicKey) => {
+    const sharedKey = await deriveAesKey(recipientPrivateKey, senderPublicKey);
+    const rawMessageKey = await crypto.subtle.decrypt({ name: 'AES-GCM', iv: new Uint8Array(fromBase64(payload.keyIv)) }, sharedKey, fromBase64(payload.encryptedKey));
+    const messageKey = await crypto.subtle.importKey('raw', rawMessageKey, { name: 'AES-GCM' }, false, ['decrypt']);
+    const plaintext = await crypto.subtle.decrypt({ name: 'AES-GCM', iv: new Uint8Array(fromBase64(payload.iv)) }, messageKey, fromBase64(payload.ciphertext));
+    return new TextDecoder().decode(plaintext);
+};
 // ─── Superseded account keystore ───
 //
 // Held the escrowed account keypair. Nothing reads it any more; it is deleted
@@ -342,3 +349,25 @@ const encryptEphemeral = async (plaintext, recipientPublicKeyRaw) => {
     return { ...payload, senderPublicKey: deviceExportedPublicKey };
 };
 exports.encryptEphemeral = encryptEphemeral;
+/**
+ * Open an ephemeral envelope addressed to this device — the exact inverse of
+ * encryptEphemeral, and of the web's `encrypt` from @zeph/crypto, which
+ * produces the same five fields.
+ *
+ * Rejects rather than returning null: AES-GCM is authenticated, so a throw
+ * here means the envelope was sealed for another key, tampered with, or is not
+ * an envelope at all. Callers must treat every rejection as a refusal — there
+ * is no partial result to fall back on. Requires initDeviceCrypto().
+ *
+ * Note that opening an envelope proves only that its sender holds the private
+ * half of `senderPublicKey`; nothing signs that field, so it authenticates the
+ * key pairing and not the sender. A caller that needs to know *which* peer
+ * sent this must compare `senderPublicKey` against a key it already trusts.
+ */
+const decryptEphemeral = async (payload) => {
+    if (!deviceKeyPair)
+        throw new Error('Device crypto not initialized');
+    const senderKey = await importPublicKey(payload.senderPublicKey);
+    return decrypt(payload, deviceKeyPair.privateKey, senderKey);
+};
+exports.decryptEphemeral = decryptEphemeral;

package/dist/input-sequencer.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Inbound ordering guard for keys/text arriving over the ephemeral relay.
+ *
+ * The outbound stream stamps every frame with `seq` + `epoch` so the viewer
+ * can drop what it has already painted (see listener.ts buildStreamFrame's
+ * send site); this is the inverse for the inbound direction. A dropped or
+ * reordered keystroke is not a cosmetic glitch the way a stale frame is —
+ * it lands in a real editor buffer — so the rules differ:
+ *
+ * - in-order seq delivers immediately (typing latency is the whole point of
+ *   this path; nothing is buffered on the happy path)
+ * - a gap holds later keys for `holdMs`, then delivers what arrived anyway.
+ *   Approximate order beats dropped keys: the relay is at-most-once, so a
+ *   never-arriving seq must not wedge everything behind it forever.
+ * - a new epoch (sender restart) resets the high-water mark, and the old
+ *   epoch's held keys are discarded rather than typed into the new run
+ * - a seq at or below the high-water mark is a straggler the hold already
+ *   flushed past — typing it now would put it out of order. The transport is
+ *   at-most-once, so this is never a transport duplicate; the sender is told
+ *   (`stale`) so it can decide whether the key still matters.
+ *
+ * Every outcome that drops a message is reported — as a non-'ok' AcceptResult
+ * for the message being accepted, or through `onDiscard` for held messages
+ * swept out by an epoch change or reset. The caller's contract ("every
+ * refusal reaches the sender") is only as honest as this accounting.
+ */
+/** How long a key waits for the gap in front of it to fill. */
+export declare const INPUT_HOLD_MS = 500;
+/** Ceiling on the reorder buffer. A gap that never fills lets every later key
+ *  pile up for the whole hold, and the flush then delivers them back to back —
+ *  one blocking tmux inject each. 32 is far past any real burst at
+ *  INPUT_HOLD_MS, so this only bites on a stuck or hostile sender. */
+export declare const MAX_PENDING_INPUTS = 32;
+/** Non-'ok' means this message was dropped and the caller owes its sender a
+ *  refusal: `overflow` (buffer full), `superseded` (older epoch than the
+ *  current run), `stale` (at or below the high-water mark — the hold already
+ *  flushed past it). 'ok' covers delivered AND held; held messages that are
+ *  later swept out surface through `onDiscard` instead. */
+export type AcceptResult = 'ok' | 'overflow' | 'superseded' | 'stale';
+/** Cancels a pending flush. */
+type CancelFlush = () => void;
+/** Injectable timer so tests drive the hold deadline instead of sleeping. */
+export type ScheduleFlush = (fn: () => void, ms: number) => CancelFlush;
+export type SequencedInput = {
+    /** Sender-side monotonic counter within `epoch`. */
+    seq: number;
+    /** Sender incarnation — a restart bumps it and restarts `seq`. */
+    epoch: number;
+};
+export type InputSequencerOptions<T> = {
+    holdMs?: number;
+    schedule?: ScheduleFlush;
+    /** Called for each HELD message dropped without delivery — an epoch change
+     *  or reset() sweeping the buffer. Accept-time drops are reported via the
+     *  AcceptResult instead, so no message can vanish through both cracks. */
+    onDiscard?: (msg: T) => void;
+};
+export type InputSequencer<T extends SequencedInput> = {
+    accept: (msg: T) => AcceptResult;
+    /** Drop everything held (reported via onDiscard) and forget the epoch —
+     *  the run is over. */
+    reset: () => void;
+};
+export declare const createInputSequencer: <T extends SequencedInput>(deliver: (msg: T) => void, opts?: InputSequencerOptions<T>) => InputSequencer<T>;
+export {};
+//# sourceMappingURL=input-sequencer.d.ts.map

package/dist/input-sequencer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-sequencer.d.ts","sourceRoot":"","sources":["../src/input-sequencer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,+DAA+D;AAC/D,eAAO,MAAM,aAAa,MAAM,CAAC;AAEjC;;;sEAGsE;AACtE,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC;;;;2DAI2D;AAC3D,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,UAAU,GAAG,YAAY,GAAG,OAAO,CAAC;AAEtE,+BAA+B;AAC/B,KAAK,WAAW,GAAG,MAAM,IAAI,CAAC;AAE9B,6EAA6E;AAC7E,MAAM,MAAM,aAAa,GAAG,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,KAAK,WAAW,CAAC;AAExE,MAAM,MAAM,cAAc,GAAG;IACzB,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,qBAAqB,CAAC,CAAC,IAAI;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB;;8EAE0E;IAC1E,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,cAAc,CAAC,CAAC,SAAS,cAAc,IAAI;IACnD,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,YAAY,CAAC;IACjC;2BACuB;IACvB,KAAK,EAAE,MAAM,IAAI,CAAC;CACrB,CAAC;AASF,eAAO,MAAM,oBAAoB,GAAI,CAAC,SAAS,cAAc,EACzD,SAAS,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EACzB,OAAM,qBAAqB,CAAC,CAAC,CAAM,KACpC,cAAc,CAAC,CAAC,CAmFlB,CAAC"}

package/dist/input-sequencer.js

@@ -0,0 +1,127 @@
+"use strict";
+/**
+ * Inbound ordering guard for keys/text arriving over the ephemeral relay.
+ *
+ * The outbound stream stamps every frame with `seq` + `epoch` so the viewer
+ * can drop what it has already painted (see listener.ts buildStreamFrame's
+ * send site); this is the inverse for the inbound direction. A dropped or
+ * reordered keystroke is not a cosmetic glitch the way a stale frame is —
+ * it lands in a real editor buffer — so the rules differ:
+ *
+ * - in-order seq delivers immediately (typing latency is the whole point of
+ *   this path; nothing is buffered on the happy path)
+ * - a gap holds later keys for `holdMs`, then delivers what arrived anyway.
+ *   Approximate order beats dropped keys: the relay is at-most-once, so a
+ *   never-arriving seq must not wedge everything behind it forever.
+ * - a new epoch (sender restart) resets the high-water mark, and the old
+ *   epoch's held keys are discarded rather than typed into the new run
+ * - a seq at or below the high-water mark is a straggler the hold already
+ *   flushed past — typing it now would put it out of order. The transport is
+ *   at-most-once, so this is never a transport duplicate; the sender is told
+ *   (`stale`) so it can decide whether the key still matters.
+ *
+ * Every outcome that drops a message is reported — as a non-'ok' AcceptResult
+ * for the message being accepted, or through `onDiscard` for held messages
+ * swept out by an epoch change or reset. The caller's contract ("every
+ * refusal reaches the sender") is only as honest as this accounting.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createInputSequencer = exports.MAX_PENDING_INPUTS = exports.INPUT_HOLD_MS = void 0;
+/** How long a key waits for the gap in front of it to fill. */
+exports.INPUT_HOLD_MS = 500;
+/** Ceiling on the reorder buffer. A gap that never fills lets every later key
+ *  pile up for the whole hold, and the flush then delivers them back to back —
+ *  one blocking tmux inject each. 32 is far past any real burst at
+ *  INPUT_HOLD_MS, so this only bites on a stuck or hostile sender. */
+exports.MAX_PENDING_INPUTS = 32;
+const defaultSchedule = (fn, ms) => {
+    const timer = setTimeout(fn, ms);
+    // A pending flush must not keep the daemon's event loop alive.
+    timer.unref?.();
+    return () => clearTimeout(timer);
+};
+const createInputSequencer = (deliver, opts = {}) => {
+    const holdMs = opts.holdMs ?? exports.INPUT_HOLD_MS;
+    const schedule = opts.schedule ?? defaultSchedule;
+    let epoch = null;
+    let highWater = 0;
+    let cancelFlush = null;
+    const pending = new Map();
+    const disarm = () => {
+        cancelFlush?.();
+        cancelFlush = null;
+    };
+    /** Sweep the hold buffer without delivering — each swept message is a
+     *  keystroke its sender still waits on, so each is reported. */
+    const discardPending = () => {
+        const swept = [...pending.values()];
+        pending.clear();
+        disarm();
+        for (const msg of swept)
+            opts.onDiscard?.(msg);
+    };
+    const emit = (msg) => {
+        highWater = msg.seq;
+        deliver(msg);
+    };
+    /** Release the unbroken run sitting on top of the high-water mark. */
+    const drain = () => {
+        for (;;) {
+            const next = pending.get(highWater + 1);
+            if (!next)
+                break;
+            pending.delete(next.seq);
+            emit(next);
+        }
+        if (!pending.size)
+            disarm();
+    };
+    /** Hold expired: the missing seq is not coming. Deliver the rest in seq
+     *  order, which also moves the high-water mark past the hole. */
+    const flush = () => {
+        cancelFlush = null;
+        const held = [...pending.values()].sort((a, b) => a.seq - b.seq);
+        pending.clear();
+        for (const msg of held)
+            emit(msg);
+    };
+    const accept = (msg) => {
+        if (epoch === null || msg.epoch > epoch) {
+            // First message of a run — whatever seq it carries is in order by
+            // definition, so joining a stream mid-flight costs no hold.
+            discardPending();
+            epoch = msg.epoch;
+            highWater = msg.seq - 1;
+        }
+        else if (msg.epoch < epoch) {
+            return 'superseded';
+        }
+        if (msg.seq <= highWater || pending.has(msg.seq))
+            return 'stale';
+        if (msg.seq === highWater + 1) {
+            emit(msg);
+            drain();
+            return 'ok';
+        }
+        // Drop the NEW message, not a held one: the buffer already holds the
+        // keys closest to the gap, and evicting those would reorder what is
+        // about to be typed.
+        if (pending.size >= exports.MAX_PENDING_INPUTS)
+            return 'overflow';
+        pending.set(msg.seq, msg);
+        // One deadline per gap: it dates from when the hole opened, so a
+        // steady stream of later keys can't extend the wait indefinitely.
+        if (!cancelFlush)
+            cancelFlush = schedule(flush, holdMs);
+        return 'ok';
+    };
+    return {
+        accept,
+        reset: () => {
+            discardPending();
+            epoch = null;
+            highWater = 0;
+        },
+    };
+};
+exports.createInputSequencer = createInputSequencer;

package/dist/listener.d.ts

@@ -23,6 +23,7 @@
 import { type AgentKind, type RegisteredRemoteAgent } from './remote-agents.js';
 import { type AgentState } from './agent-state.js';
 import { type EncryptedEphemeralPayload } from './crypto.js';
+import { type SequencedInput } from './input-sequencer.js';
 export declare const SESSION_REPORT_HEARTBEAT_MS = 30000;
 interface AgentSession {
     name: string;
@@ -181,6 +182,29 @@ export interface StreamControl {
      */
     renew?: boolean;
 }
+export declare const STREAM_INTERVAL_MS = 400;
+export declare const BURST_INTERVAL_MS = 120;
+export declare const BURST_WINDOW_MS = 2500;
+export declare const MAX_FRAMES_PER_SEC = 8;
+/**
+ * Delay before the next capture: burst while the last input is still echoing,
+ * idle otherwise. Exclusive at the boundary — exactly BURST_WINDOW_MS after
+ * the input is already idle, so the window can't stretch. A lastInputAt in the
+ * future (wall-clock jump) reads as fresh input rather than as an expired
+ * window: bursting is the recoverable side of that.
+ */
+export declare const streamCadence: (lastInputAt: number | null, now: number) => number;
+/** Rolling one-second send budget for a single stream. */
+export interface FrameBudget {
+    windowStartedAt: number;
+    sent: number;
+}
+/**
+ * Claim one send from the budget, rolling the window over when the second has
+ * passed. False means this tick must skip WITHOUT marking the frame as sent —
+ * the diff-gate would otherwise swallow that content for good.
+ */
+export declare const claimFrameSend: (budget: FrameBudget, now: number) => boolean;
 export declare const STREAM_LEASE_MS = 15000;
 export declare const MAX_CONCURRENT_STREAMS = 3;
 export declare const stopStream: (sessionName: string) => void;
@@ -201,11 +225,23 @@ export type StreamFramePayload = {
     /** E2EE envelope — replaces `content` on encrypted streams. */
     encrypted?: EncryptedEphemeralPayload;
 };
-/** Wire shape of a live-mirror error frame — same subtype, no pane data. */
+/** Wire shape of a live-mirror error frame — same subtype, no pane data.
+ *  `input_rejected` refuses an ephemeral `agent.command.input`; it rides this
+ *  frame so a viewer already handling stream errors can fall back to the REST
+ *  push path without a second error channel. */
 export type StreamErrorFrame = {
     subtype: 'agent.stream.frame';
     sessionName: string;
-    error: 'unknown_session' | 'e2ee_unavailable' | 'encrypt_failed' | 'stream_limit' | 'stream_gone';
+    error: 'unknown_session' | 'e2ee_unavailable' | 'encrypt_failed' | 'stream_limit' | 'stream_gone' | 'input_rejected';
+    /** `input_rejected` only: the refused message's ordering stamp echoed back.
+     *  A sender with several keystrokes in flight can't tell which one was
+     *  refused without it. Absent when the message carried no usable stamp. */
+    seq?: number;
+    epoch?: number;
+    /** `input_rejected` only: the refused sender's deviceId, echoed so a second
+     *  device whose (seq, epoch) happens to collide doesn't claim the refusal
+     *  and fire a REST resend for an input that was never refused. */
+    inputDeviceId?: string;
 };
 /**
  * Per-listener concurrency guard, as a pure predicate so the boundary is
@@ -228,6 +264,87 @@ export declare const buildStreamFrame: (captured: {
  * path). start is idempotent — a repeat restarts the loop.
  */
 export declare const handleStreamControl: (req: StreamControl, send: (data: Record<string, unknown>) => void) => boolean;
+/** Wire shape of one inbound injection. Every field is optional, and none of
+ *  them is proven: this shape is an unchecked cast over relay JSON, so
+ *  validateInputMessage re-checks the types it acts on rather than trusting
+ *  the declaration. */
+export interface AgentCommandInput {
+    subtype?: string;
+    targetDeviceId?: string;
+    sessionName?: string;
+    /** Which device's seq/epoch run this is. Current relays stamp it from the
+     *  sending connection unconditionally; relays older than that overwrite
+     *  only a missing value, so a sender there can claim another device's id.
+     *  Treat it as an ordering namespace, never as authentication — the worst
+     *  a forged id buys is a different reorder lane for its own keystrokes. */
+    deviceId?: string;
+    /** Named keys, ALLOWED_KEYS-validated. Mutually exclusive with `body`. */
+    keys?: string[];
+    /** Literal text; the injector appends the Enter, as on the REST path. */
+    body?: string;
+    /** Sender's monotonic counter, and the incarnation it counts within. */
+    seq?: number;
+    epoch?: number;
+    /** E2EE envelope sealing `{ keys | body }` plus a copy of the
+     *  `sessionName`/`seq`/`epoch` stamp as JSON — the only way in on an
+     *  encrypted stream, where `keys`/`body` above are refused. Present means
+     *  the plaintext pair is ignored entirely: on a message the relay can
+     *  append to, only the ciphertext decides what gets typed, and the sealed
+     *  stamp is what proves the plaintext one was not re-written for a replay. */
+    encrypted?: unknown;
+}
+/** Parity with the REST path, which refuses more than MAX_KEYS_PER_COMMAND per
+ *  agent.command (zeph apps/server/src/functions/pushes.ts). The lower-latency
+ *  door into the same pane must not also be the wider one. */
+export declare const MAX_INPUT_KEYS = 10;
+/** The REST path caps no body length, so this bound is ours alone: an
+ *  unbounded body is one tmux send-keys argv of unbounded size, and what it
+ *  lands in is an agent prompt, not a paste buffer. */
+export declare const MAX_INPUT_BODY_CHARS = 4096;
+/** The relay socket a message arrived on, and the only way back to its sender. */
+type SendEphemeral = (data: Record<string, unknown>) => void;
+/** One validated injection. */
+type ValidatedInput = SequencedInput & {
+    sessionName: string;
+    /** Sender's device, when the relay stamped one — rides along so a refusal
+     *  frame can name whose input was refused (inputDeviceId). */
+    deviceId?: string;
+    /** Exactly one of these is set. */
+    tokens: string[] | null;
+    text: string | null;
+};
+type InputCheck = {
+    ok: true;
+    input: ValidatedInput;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Parse and whitelist an inbound input message. Pure — the lease gate and the
+ * tmux-side guards stay in the caller, so this is testable on its own.
+ */
+export declare const validateInputMessage: (msg: AgentCommandInput) => InputCheck;
+/** Ceiling on concurrent sender lanes. The lane key includes a relay-stamped
+ *  deviceId, but a relay older than the unconditional stamp lets a sender vary
+ *  it per message — without a cap that grows the map for the lease's whole
+ *  life. Real senders are one per device; 16 is generous. */
+export declare const MAX_INPUT_LANES = 16;
+/** Ceiling on queued decrypts. The subscriber-key binding is a string compare
+ *  against a public key the relay fanned out to every same-account connection,
+ *  so it gates WHO can enqueue an ECDH derive, not how many — a flooding
+ *  client would otherwise grow the chain without bound. Mirrors
+ *  MAX_PENDING_INPUTS' role on the plaintext side. */
+export declare const MAX_PENDING_DECRYPTS = 32;
+/** Resolves once every encrypted input accepted so far has been routed. */
+export declare const pendingInputDecrypts: () => Promise<void>;
+/**
+ * Handle agent.command.input. Returns true when the message was ours to
+ * answer, so the caller stops routing it. Encrypted messages finish
+ * asynchronously — the return value reports routing, not delivery, exactly as
+ * it already did for a message the sequencer holds.
+ */
+export declare const handleCommandInput: (msg: AgentCommandInput, send: SendEphemeral) => boolean;
 export interface CollectResult {
     sessions: AgentSession[];
     /** Diagnostic notes per rejected session — surfaced under `--verbose`. */

package/dist/listener.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"listener.d.ts","sourceRoot":"","sources":["../src/listener.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAoBH,OAAO,EAA2B,KAAK,SAAS,EAAE,KAAK,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACzG,OAAO,EAAiD,KAAK,UAAU,EAA4C,MAAM,kBAAkB,CAAC;AAE5I,OAAO,EAA0D,KAAK,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAmCrH,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAElD,UAAU,YAAY;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,SAAS,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,GAAI,UAAU,YAAY,EAAE,KAAG,MAS7C,CAAC;AAEnB;6BAC6B;AAC7B,eAAO,MAAM,iBAAiB,GAC1B,aAAa,MAAM,EACnB,qBAAqB,MAAM,GAAG,IAAI,EAClC,cAAc,MAAM,EACpB,OAAO,MAAM,KACd,OAEoD,CAAC;AAYxD,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAA+B,CAAC;AAenF,eAAO,MAAM,cAAc,GAAI,SAAS,MAAM,EAAE,MAAK,MAAmB,KAAG,OAgB1E,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,GAAI,SAAS,MAAM,KAAG,MAAM,GAAG,IAO7D,CAAC;AAsCF;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,MAAM,MAAM,EAAE,KAAG,MAAM,EAAE,GAAG,IAQvD,CAAC;AA0CF;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,QAAO,IAG5C,CAAC;AA8NF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM,MAAM,KAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAK3F,CAAC;AAEF,UAAU,QAAQ;IACd,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAiDD;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAAI,MAAM,QAAQ,KAAG,qBAAqB,GAAG,IAGhE,CAAC;AA0BZ,iBAAiB;AACjB,eAAO,MAAM,kBAAkB,QAAO,IAErC,CAAC;AAWF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAC3B,MAAM,MAAM,EACZ,WAAW,SAAS,EACpB,UAAU,MAAM,GAAG,IAAI,EACvB,MAAK,MAAmB,KACzB,IAAI,CAAC,YAAY,EAAE,OAAO,GAAG,gBAAgB,GAAG,aAAa,CAmB/D,CAAC;AAWF,MAAM,WAAW,YAAY;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACnB;AASD,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB,GAAI,KAAK,OAAO,KAAG,IAWhD,CAAC;AAEF,iBAAiB;AACjB,eAAO,MAAM,mBAAmB,QAAO,IAGtC,CAAC;AAEF,MAAM,WAAW,QAAQ;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GACzB,WAAW,WAAW,CAAC,MAAM,CAAC,EAC9B,UAAS,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAsB,KAC9D,QAAQ,EAgBV,CAAC;AAWF,MAAM,WAAW,aAAa;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC3B,OAAO,EAAE,uBAAuB,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,GAAI,KAAK,aAAa,KAAG,cAAc,GAAG,IAmBzE,CAAC;AAyCF;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,GAChC,aAAa,MAAM,EACnB,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,EAC7C,SAAQ,MAAM,EAA8B,KAC7C,IAiBF,CAAC;AAcF,MAAM,WAAW,aAAa;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACnB;AA8BD,eAAO,MAAM,eAAe,QAAS,CAAC;AAMtC,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAgDxC,eAAO,MAAM,UAAU,GAAI,aAAa,MAAM,KAAG,IAYhD,CAAC;AAEF,eAAO,MAAM,cAAc,QAAO,IAGjC,CAAC;AAEF,oFAAoF;AACpF,MAAM,MAAM,kBAAkB,GAAG;IAC7B,OAAO,EAAE,oBAAoB,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,4EAA4E;IAC5E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;mEAC+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,yBAAyB,CAAC;CACzC,CAAC;AAEF,4EAA4E;AAC5E,MAAM,MAAM,gBAAgB,GAAG;IAC3B,OAAO,EAAE,oBAAoB,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,iBAAiB,GAAG,kBAAkB,GAAG,gBAAgB,GAAG,cAAc,GAAG,aAAa,CAAC;CACrG,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAAI,aAAa,MAAM,KAAG,OAChB,CAAC;AA4B1C;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,GACzB,UAAU;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,EACjD,aAAa,MAAM,EACnB,sBAAsB,MAAM,KAC7B,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAenC,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAC5B,KAAK,aAAa,EAClB,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,KAC9C,OAiJF,CAAC;AAEF,MAAM,WAAW,aAAa;IAC1B,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,0EAA0E;IAC1E,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,QAAO,aAiEzC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,QAAO,YAAY,EAAuC,CAAC;AAIvF;;;;;GAKG;AACH,UAAU,kBAAkB;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,UAAU,QAAQ;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;sEACkE;IAClE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,uEAAuE;IACvE,KAAK,CAAC,EAAE,kBAAkB,EAAE,CAAC;CAChC;AAED,UAAU,cAAc;IACpB,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACpD,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;IAC1D,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,oEAAoE;IACpE,mBAAmB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACzF,+DAA+D;IAC/D,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAC7C;sEACkE;IAClE,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9C;AAwBD;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,GAC1B,SAAS,MAAM,EACf,MAAM,MAAM,EACZ,MAAK,MAAM,MAAiB,KAC7B,OAUF,CAAC;AAwCF,eAAO,MAAM,oBAAoB,GAAI,KAAK;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,IAE/E,CAAC;AA2FF;;;;GAIG;AACH,eAAO,MAAM,aAAa,GACtB,MAAK,MAAmB,EACxB,MAAK,MAAwB,EAC7B,MAAK,MAA0B,KAChC,MAaF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,GACnB,MAAM,QAAQ,EACd,OAAM,cAAmB,KAC1B,OAAO,CAAC,OAAO,CAoCjB,CAAC;AAcF,eAAO,MAAM,cAAc,GAAI,SAAS,MAAM,KAAG,MAIhD,CAAC;AA4DF,eAAO,MAAM,uBAAuB,GAAI,OAAO,MAAM,KAAG,MA2BvD,CAAC;AAgPF;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,GACrB,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EACtC,QAAQ;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EAC1B,SAAS,MAAM,KAChB,MAAM,GAAG,IAIX,CAAC;AA0DF,eAAO,MAAM,cAAc,GAAU,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,KAAG,OAAO,CAAC,MAAM,CAsI3F,CAAC"}
+{"version":3,"file":"listener.d.ts","sourceRoot":"","sources":["../src/listener.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAoBH,OAAO,EAA2B,KAAK,SAAS,EAAE,KAAK,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AACzG,OAAO,EAAiD,KAAK,UAAU,EAA4C,MAAM,kBAAkB,CAAC;AAE5I,OAAO,EAA4E,KAAK,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACvI,OAAO,EAA6C,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAmCtG,eAAO,MAAM,2BAA2B,QAAS,CAAC;AAElD,UAAU,YAAY;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,SAAS,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,GAAI,UAAU,YAAY,EAAE,KAAG,MAS7C,CAAC;AAEnB;6BAC6B;AAC7B,eAAO,MAAM,iBAAiB,GAC1B,aAAa,MAAM,EACnB,qBAAqB,MAAM,GAAG,IAAI,EAClC,cAAc,MAAM,EACpB,OAAO,MAAM,KACd,OAEoD,CAAC;AAYxD,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAA+B,CAAC;AAenF,eAAO,MAAM,cAAc,GAAI,SAAS,MAAM,EAAE,MAAK,MAAmB,KAAG,OAgB1E,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,kBAAkB,GAAI,SAAS,MAAM,KAAG,MAAM,GAAG,IAO7D,CAAC;AAyCF;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,MAAM,MAAM,EAAE,KAAG,MAAM,EAAE,GAAG,IAQvD,CAAC;AA0CF;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,QAAO,IAG5C,CAAC;AA8NF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM,MAAM,KAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAK3F,CAAC;AAEF,UAAU,QAAQ;IACd,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAiDD;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,GAAI,MAAM,QAAQ,KAAG,qBAAqB,GAAG,IAGhE,CAAC;AA0BZ,iBAAiB;AACjB,eAAO,MAAM,kBAAkB,QAAO,IAErC,CAAC;AAWF;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,GAC3B,MAAM,MAAM,EACZ,WAAW,SAAS,EACpB,UAAU,MAAM,GAAG,IAAI,EACvB,MAAK,MAAmB,KACzB,IAAI,CAAC,YAAY,EAAE,OAAO,GAAG,gBAAgB,GAAG,aAAa,CAmB/D,CAAC;AAWF,MAAM,WAAW,YAAY;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACnB;AASD,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB,GAAI,KAAK,OAAO,KAAG,IAWhD,CAAC;AAEF,iBAAiB;AACjB,eAAO,MAAM,mBAAmB,QAAO,IAGtC,CAAC;AAEF,MAAM,WAAW,QAAQ;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GACzB,WAAW,WAAW,CAAC,MAAM,CAAC,EAC9B,UAAS,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAsB,KAC9D,QAAQ,EAgBV,CAAC;AAWF,MAAM,WAAW,aAAa;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC3B,OAAO,EAAE,uBAAuB,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,GAAI,KAAK,aAAa,KAAG,cAAc,GAAG,IAmBzE,CAAC;AAyCF;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,GAChC,aAAa,MAAM,EACnB,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,EAC7C,SAAQ,MAAM,EAA8B,KAC7C,IAiBF,CAAC;AAcF,MAAM,WAAW,aAAa;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACnB;AASD,eAAO,MAAM,kBAAkB,MAAM,CAAC;AAKtC,eAAO,MAAM,iBAAiB,MAAM,CAAC;AACrC,eAAO,MAAM,eAAe,OAAQ,CAAC;AAOrC,eAAO,MAAM,kBAAkB,IAAI,CAAC;AAEpC;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,GAAI,aAAa,MAAM,GAAG,IAAI,EAAE,KAAK,MAAM,KAAG,MACgC,CAAC;AAEzG,0DAA0D;AAC1D,MAAM,WAAW,WAAW;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,GAAI,QAAQ,WAAW,EAAE,KAAK,MAAM,KAAG,OAYjE,CAAC;AAqBF,eAAO,MAAM,eAAe,QAAS,CAAC;AAMtC,eAAO,MAAM,sBAAsB,IAAI,CAAC;AA6GxC,eAAO,MAAM,UAAU,GAAI,aAAa,MAAM,KAAG,IAuBhD,CAAC;AAEF,eAAO,MAAM,cAAc,QAAO,IAGjC,CAAC;AAEF,oFAAoF;AACpF,MAAM,MAAM,kBAAkB,GAAG;IAC7B,OAAO,EAAE,oBAAoB,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,4EAA4E;IAC5E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;mEAC+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,SAAS,CAAC,EAAE,yBAAyB,CAAC;CACzC,CAAC;AAEF;;;gDAGgD;AAChD,MAAM,MAAM,gBAAgB,GAAG;IAC3B,OAAO,EAAE,oBAAoB,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,iBAAiB,GAAG,kBAAkB,GAAG,gBAAgB,GAAG,cAAc,GAAG,aAAa,GAAG,gBAAgB,CAAC;IACrH;;+EAE2E;IAC3E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;sEAEkE;IAClE,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAAI,aAAa,MAAM,KAAG,OAChB,CAAC;AAqC1C;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,GACzB,UAAU;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,EACjD,aAAa,MAAM,EACnB,sBAAsB,MAAM,KAC7B,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAenC,CAAC;AAEF;;;;GAIG;AASH,eAAO,MAAM,mBAAmB,GAC5B,KAAK,aAAa,EAClB,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,KAC9C,OAqNF,CAAC;AAWF;;;uBAGuB;AACvB,MAAM,WAAW,iBAAiB;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;+EAI2E;IAC3E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,yEAAyE;IACzE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wEAAwE;IACxE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;kFAK8E;IAC9E,SAAS,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;8DAE8D;AAC9D,eAAO,MAAM,cAAc,KAAK,CAAC;AACjC;;uDAEuD;AACvD,eAAO,MAAM,oBAAoB,OAAO,CAAC;AAEzC,kFAAkF;AAClF,KAAK,aAAa,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;AAE7D,+BAA+B;AAC/B,KAAK,cAAc,GAAG,cAAc,GAAG;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB;kEAC8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAOF,KAAK,UAAU,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,cAAc,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAuCtF;;;GAGG;AACH,eAAO,MAAM,oBAAoB,GAAI,KAAK,iBAAiB,KAAG,UA4B7D,CAAC;AAoBF;;;6DAG6D;AAC7D,eAAO,MAAM,eAAe,KAAK,CAAC;AAkDlC;;;;sDAIsD;AACtD,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAEvC,2EAA2E;AAC3E,eAAO,MAAM,oBAAoB,QAAO,OAAO,CAAC,IAAI,CAAsB,CAAC;AAuG3E;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC3B,KAAK,iBAAiB,EACtB,MAAM,aAAa,KACpB,OA2CF,CAAC;AAEF,MAAM,WAAW,aAAa;IAC1B,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,0EAA0E;IAC1E,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,QAAO,aAiEzC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,QAAO,YAAY,EAAuC,CAAC;AAIvF;;;;;GAKG;AACH,UAAU,kBAAkB;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,UAAU,QAAQ;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;sEACkE;IAClE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,uEAAuE;IACvE,KAAK,CAAC,EAAE,kBAAkB,EAAE,CAAC;CAChC;AAED,UAAU,cAAc;IACpB,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACjD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IACpD,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;IAC1D,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACzC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,oEAAoE;IACpE,mBAAmB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACzF,+DAA+D;IAC/D,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAC7C;sEACkE;IAClE,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9C;AA2BD;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,GAC1B,SAAS,MAAM,EACf,MAAM,MAAM,EACZ,MAAK,MAAM,MAAiB,KAC7B,OAUF,CAAC;AA0CF,eAAO,MAAM,oBAAoB,GAAI,KAAK;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,IAE/E,CAAC;AA2FF;;;;GAIG;AACH,eAAO,MAAM,aAAa,GACtB,MAAK,MAAmB,EACxB,MAAK,MAAwB,EAC7B,MAAK,MAA0B,KAChC,MAaF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,GACnB,MAAM,QAAQ,EACd,OAAM,cAAmB,KAC1B,OAAO,CAAC,OAAO,CAoCjB,CAAC;AAcF,eAAO,MAAM,cAAc,GAAI,SAAS,MAAM,KAAG,MAIhD,CAAC;AA4DF,eAAO,MAAM,uBAAuB,GAAI,OAAO,MAAM,KAAG,MA2BvD,CAAC;AAsPF;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,GACrB,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,EACtC,QAAQ;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EAC1B,SAAS,MAAM,KAChB,MAAM,GAAG,IAIX,CAAC;AA0DF,eAAO,MAAM,cAAc,GAAU,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,KAAG,OAAO,CAAC,MAAM,CAsI3F,CAAC"}

package/dist/listener.js

@@ -25,7 +25,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.handleListener = exports.resolveWsUrl = exports.computeListenerDeviceId = exports.computeBackoff = exports.handlePush = exports.gcAttachments = exports.setAttachmentContext = exports.writeRemoteMarker = exports.collectSessions = exports.collectSessionsVerbose = exports.handleStreamControl = exports.buildStreamFrame = exports.isStreamCapReached = exports.stopAllStreams = exports.stopStream = exports.MAX_CONCURRENT_STREAMS = exports.STREAM_LEASE_MS = exports.scheduleInjectSnapshots = exports.handleScreenRequest = exports.collectWatchHits = exports.resetPatternWatches = exports.setPatternWatches = exports.deriveSessionState = exports.resetSessionStates = exports.detectRemoteAgent = exports.parseSessionName = exports.invalidateTmuxSocketCache = exports.resolveKeys = exports.paneCurrentCommand = exports.checkRateLimit = exports.AUTH_FAILURE_CODES = exports.sessionsReportDue = exports.sessionsFingerprint = exports.SESSION_REPORT_HEARTBEAT_MS = void 0;
+exports.handleListener = exports.resolveWsUrl = exports.computeListenerDeviceId = exports.computeBackoff = exports.handlePush = exports.gcAttachments = exports.setAttachmentContext = exports.writeRemoteMarker = exports.collectSessions = exports.collectSessionsVerbose = exports.handleCommandInput = exports.pendingInputDecrypts = exports.MAX_PENDING_DECRYPTS = exports.MAX_INPUT_LANES = exports.validateInputMessage = exports.MAX_INPUT_BODY_CHARS = exports.MAX_INPUT_KEYS = exports.handleStreamControl = exports.buildStreamFrame = exports.isStreamCapReached = exports.stopAllStreams = exports.stopStream = exports.MAX_CONCURRENT_STREAMS = exports.STREAM_LEASE_MS = exports.claimFrameSend = exports.streamCadence = exports.MAX_FRAMES_PER_SEC = exports.BURST_WINDOW_MS = exports.BURST_INTERVAL_MS = exports.STREAM_INTERVAL_MS = exports.scheduleInjectSnapshots = exports.handleScreenRequest = exports.collectWatchHits = exports.resetPatternWatches = exports.setPatternWatches = exports.deriveSessionState = exports.resetSessionStates = exports.detectRemoteAgent = exports.parseSessionName = exports.invalidateTmuxSocketCache = exports.resolveKeys = exports.paneCurrentCommand = exports.checkRateLimit = exports.AUTH_FAILURE_CODES = exports.sessionsReportDue = exports.sessionsFingerprint = exports.SESSION_REPORT_HEARTBEAT_MS = void 0;
 const child_process_1 = require("child_process");
 const crypto_1 = require("crypto");
 const fs_1 = require("fs");
@@ -39,6 +39,7 @@ const remote_agents_js_1 = require("./remote-agents.js");
 const agent_state_js_1 = require("./agent-state.js");
 const agent_rules_fetch_js_1 = require("./agent-rules-fetch.js");
 const crypto_js_1 = require("./crypto.js");
+const input_sequencer_js_1 = require("./input-sequencer.js");
 const PING_INTERVAL_MS = 25_000;
 const PONG_TIMEOUT_MS = 10_000;
 const RECONNECT_BASE_MS = 1_000;
@@ -159,19 +160,22 @@ const injectKeys = (session, text) => {
 // Maps a lowercase wire name to the exact tmux key token. Whitelist-ONLY:
 // anything outside this map is refused so a compromised sender can't smuggle
 // `C-c`, `M-x`, or a shell command through send-keys' key-name syntax.
-const ALLOWED_KEYS = {
-    escape: 'Escape',
-    up: 'Up',
-    down: 'Down',
-    left: 'Left',
-    right: 'Right',
-    enter: 'Enter',
-    tab: 'Tab',
-    backtab: 'BTab',
-    backspace: 'BSpace',
-    delete: 'DC',
-    space: 'Space',
-};
+// A Map, not a plain object: object indexing leaks the prototype chain, so
+// `keys: ['constructor']` resolved to a function that spawnSync happily
+// stringified into the pane. Map lookups know only what was put in.
+const ALLOWED_KEYS = new Map([
+    ['escape', 'Escape'],
+    ['up', 'Up'],
+    ['down', 'Down'],
+    ['left', 'Left'],
+    ['right', 'Right'],
+    ['enter', 'Enter'],
+    ['tab', 'Tab'],
+    ['backtab', 'BTab'],
+    ['backspace', 'BSpace'],
+    ['delete', 'DC'],
+    ['space', 'Space'],
+]);
 /**
  * Translate a phone-supplied key list to tmux tokens. Returns null if ANY
  * key is unknown — a partial injection (some keys land, one is dropped)
@@ -181,7 +185,7 @@ const ALLOWED_KEYS = {
 const resolveKeys = (keys) => {
     const out = [];
     for (const k of keys) {
-        const token = ALLOWED_KEYS[k.toLowerCase().trim()];
+        const token = ALLOWED_KEYS.get(k.toLowerCase().trim());
         if (!token)
             return null;
         out.push(token);
@@ -758,14 +762,56 @@ const scheduleInjectSnapshots = (sessionName, send, delays = INJECT_SNAPSHOT_DEL
     pendingInjectSnapshots.set(sessionName, timers);
 };
 exports.scheduleInjectSnapshots = scheduleInjectSnapshots;
-// ~2.5 fps ceiling. Cadence + diff-gating are the ONLY bound on API Gateway
-// WS cost (the $default route has no per-message limit), so keep it modest
-// and let unchanged frames drop.
+// ~2.5 fps idle ceiling. Cadence + diff-gating + the per-second send budget
+// are the ONLY bound on API Gateway WS cost (the $default route has no
+// per-message limit), so keep it modest and let unchanged frames drop.
 // How far back the live-stream capture reaches — more than the screen-peek
 // window so the mirror has scrollback to scroll through. SCREEN_PEEK_MAX_BYTES
 // still caps the actual payload, so very wide panes get top-truncated.
 const STREAM_CAPTURE_LINES = 200;
-const STREAM_INTERVAL_MS = 400;
+exports.STREAM_INTERVAL_MS = 400;
+// Burst cadence: right after a keystroke lands, the pane IS what the user is
+// staring at, so captures tighten for BURST_WINDOW_MS and then fall back to
+// the idle cadence. The window is what keeps this affordable — one keypress
+// costs a bounded number of extra frames instead of raising the steady rate.
+exports.BURST_INTERVAL_MS = 120;
+exports.BURST_WINDOW_MS = 2_500;
+// Cost bound the burst must not break: MAX_CONCURRENT_STREAMS × 8 = 24 msg/s
+// worst case, under half of the API Gateway WS stage throttle (50 rps) that is
+// SHARED across every user, so a bursting host still leaves headroom for push
+// delivery and presence. At BURST_INTERVAL_MS the chain tops out at 8.3 fps,
+// so this budget bites only in the last fraction of a fully bursting second —
+// it is what holds the line if the burst cadence is ever tightened further.
+exports.MAX_FRAMES_PER_SEC = 8;
+/**
+ * Delay before the next capture: burst while the last input is still echoing,
+ * idle otherwise. Exclusive at the boundary — exactly BURST_WINDOW_MS after
+ * the input is already idle, so the window can't stretch. A lastInputAt in the
+ * future (wall-clock jump) reads as fresh input rather than as an expired
+ * window: bursting is the recoverable side of that.
+ */
+const streamCadence = (lastInputAt, now) => lastInputAt !== null && now - lastInputAt < exports.BURST_WINDOW_MS ? exports.BURST_INTERVAL_MS : exports.STREAM_INTERVAL_MS;
+exports.streamCadence = streamCadence;
+/**
+ * Claim one send from the budget, rolling the window over when the second has
+ * passed. False means this tick must skip WITHOUT marking the frame as sent —
+ * the diff-gate would otherwise swallow that content for good.
+ */
+const claimFrameSend = (budget, now) => {
+    // `now < windowStartedAt` = the clock ran backwards (NTP step, resume).
+    // Without the guard the window never rolls again and a spent budget
+    // freezes the mirror for the whole regression — same failure streamCadence
+    // already defends against, so the two must agree.
+    if (now - budget.windowStartedAt >= 1_000 || now < budget.windowStartedAt) {
+        budget.windowStartedAt = now;
+        budget.sent = 0;
+    }
+    if (budget.sent >= exports.MAX_FRAMES_PER_SEC)
+        return false;
+    budget.sent++;
+    return true;
+};
+exports.claimFrameSend = claimFrameSend;
 // Orphan guard for subscribers that can't renew (clients older than the renew
 // protocol): a phone that dies without sending agent.stream.stop must not leak
 // an interval forever. Auto-stop after this long; the phone re-subscribes on
@@ -805,29 +851,69 @@ const STREAM_LOG_INTERVAL_MS = 5_000;
 /** How far a start (and each renew) pushes the deadline out. */
 const leaseFor = (renewing) => (renewing ? exports.STREAM_LEASE_MS : STREAM_MAX_MS);
 const activeStreams = new Map();
+/** Inbound key ordering, one per (streamed session, sender device) — see the
+ *  `agent.command.input` section below. Lives here so stopStream can drop them
+ *  with the lease they belong to. Keyed `<session>#<deviceId>`, or the bare
+ *  session name from a relay too old to stamp the sender. */
+const inputSequencers = new Map();
+/** Frames per second for one cadence phase. A phase that got no wall time in
+ *  the window (a stream that never bursted) reads 0.0, never NaN. */
+const phaseFps = (frames, ms) => (ms > 0 ? (frames / (ms / 1000)).toFixed(1) : '0.0');
 const maybeLogStreamStats = (sessionName, stats) => {
     const elapsed = Date.now() - stats.lastLogAt;
     if (elapsed < STREAM_LOG_INTERVAL_MS)
         return;
     const secs = elapsed / 1000;
-    const fps = (stats.frames - stats.lastLogFrames) / secs;
+    const frames = stats.frames - stats.lastLogFrames;
+    const fps = frames / secs;
     const kbps = (stats.bytes - stats.lastLogBytes) / 1024 / secs;
-    log(`⧉ stream ${sessionName}: ${fps.toFixed(1)} fps, ${kbps.toFixed(1)} KB/s (${stats.frames} sent, ${stats.skipped} diff-skipped)`);
+    // burstMs is charged when a burst tick is armed, so it can overshoot the
+    // window by at most one interval — phaseFps clamps the idle remainder.
+    const burstMs = stats.burstMs - stats.lastLogBurstMs;
+    const burstFrames = stats.framesBurst - stats.lastLogFramesBurst;
+    log(`⧉ stream ${sessionName}: ${fps.toFixed(1)} fps, ${kbps.toFixed(1)} KB/s ` +
+        `(${stats.frames} sent, ${stats.skipped} skipped incl. ${stats.rateCapped} rate-capped) ` +
+        `[burst ${phaseFps(burstFrames, burstMs)} fps · idle ${phaseFps(frames - burstFrames, elapsed - burstMs)} fps]`);
     stats.lastLogAt = Date.now();
     stats.lastLogFrames = stats.frames;
     stats.lastLogBytes = stats.bytes;
+    stats.lastLogFramesBurst = stats.framesBurst;
+    stats.lastLogBurstMs = stats.burstMs;
+};
+/** A keystroke landed in this pane, so the next captures run at the burst
+ *  cadence and the echo is visible instead of up to STREAM_INTERVAL_MS late.
+ *  Called from the shared inject helpers, which is what both the ephemeral
+ *  (agent.command.input) and the REST (agent.command) paths funnel through. */
+const noteStreamInput = (sessionName) => {
+    const entry = activeStreams.get(sessionName);
+    if (!entry)
+        return;
+    entry.lastInputAt = Date.now();
+    entry.wake();
 };
 const stopStream = (sessionName) => {
     const entry = activeStreams.get(sessionName);
     if (!entry)
         return;
-    clearInterval(entry.timer);
+    clearTimeout(entry.timer);
     activeStreams.delete(sessionName);
+    // The next stream is a new run: a sequencer carrying this one's high-water
+    // mark would swallow its first keys if the sender restarts its counter.
+    // Every sender that typed into this session holds its own, so drop the
+    // whole `<session>#…` family, not just the bare-name key.
+    for (const [key, sequencer] of inputSequencers) {
+        if (key !== sessionName && !key.startsWith(`${sessionName}#`))
+            continue;
+        sequencer.reset();
+        inputSequencers.delete(key);
+    }
     const { stats } = entry;
     const secs = Math.max(0.001, (Date.now() - stats.startedAt) / 1000);
     log(`⧉ stream ${sessionName} stopped: ${stats.frames} frames / ` +
         `${(stats.bytes / 1024).toFixed(1)} KB over ${secs.toFixed(1)}s ` +
-        `(${(stats.frames / secs).toFixed(1)} fps avg, ${stats.skipped} diff-skipped)`);
+        `(${(stats.frames / secs).toFixed(1)} fps avg, ${stats.skipped} skipped incl. ${stats.rateCapped} rate-capped) ` +
+        `[burst ${stats.framesBurst} frames / ${(stats.bytesBurst / 1024).toFixed(1)} KB ` +
+        `over ${(stats.burstMs / 1000).toFixed(1)}s = ${phaseFps(stats.framesBurst, stats.burstMs)} fps]`);
 };
 exports.stopStream = stopStream;
 const stopAllStreams = () => {
@@ -864,11 +950,20 @@ const evictStalestStream = (now) => {
     (0, exports.stopStream)(victim.name);
     return victim.name;
 };
-const streamErrorFrame = (sessionName, error) => ({
-    subtype: 'agent.stream.frame',
-    sessionName,
-    error,
-});
+const streamErrorFrame = (sessionName, error, 
+/** The message being refused, when there is one to echo. */
+echo) => {
+    const frame = { subtype: 'agent.stream.frame', sessionName, error };
+    // A malformed message may carry no stamp at all, or garbage — omitting the
+    // field beats echoing something the sender can't match.
+    if (isSeqNumber(echo?.seq))
+        frame.seq = echo.seq;
+    if (isSeqNumber(echo?.epoch))
+        frame.epoch = echo.epoch;
+    if (typeof echo?.deviceId === 'string' && echo.deviceId)
+        frame.inputDeviceId = echo.deviceId;
+    return frame;
+};
 /**
  * Build the wire payload for one stream frame. With a subscriber public key
  * the pane content rides ONLY inside the E2EE envelope; an encrypt failure
@@ -899,6 +994,14 @@ exports.buildStreamFrame = buildStreamFrame;
  * was a stream-control message (so the caller skips the one-shot screen-peek
  * path). start is idempotent — a repeat restarts the loop.
  */
+// deep: over the body-length limit on purpose. Everything past the guards is
+// one capture loop whose state (lastContent, wireSeq, encryptFailures, budget,
+// and `stats` as the incarnation token) is only correct while it stays private
+// to a single start. Hoisting it into a factory would turn those five into
+// parameters and expose the incarnation invariant — the one that keeps an
+// orphaned chain from capturing forever — to callers that have no reason to
+// know it exists. Nothing outside needs the internals; deleting this deletes
+// the live mirror whole.
 const handleStreamControl = (req, send) => {
     if (req.subtype !== 'agent.stream.start' && req.subtype !== 'agent.stream.stop' && req.subtype !== 'agent.stream.renew') {
         return false;
@@ -955,10 +1058,16 @@ const handleStreamControl = (req, send) => {
         startedAt: Date.now(),
         frames: 0,
         bytes: 0,
+        framesBurst: 0,
+        bytesBurst: 0,
+        burstMs: 0,
         skipped: 0,
+        rateCapped: 0,
         lastLogAt: Date.now(),
         lastLogFrames: 0,
         lastLogBytes: 0,
+        lastLogFramesBurst: 0,
+        lastLogBurstMs: 0,
     };
     // E2EE handshake: load-or-create this device's keypair up front. The
     // subscriber asked for encryption, so key failure is FAIL-CLOSED: refuse
@@ -979,21 +1088,41 @@ const handleStreamControl = (req, send) => {
     }
     let wireSeq = 0;
     let encryptFailures = 0;
-    const timer = setInterval(() => {
+    const budget = { windowStartedAt: Date.now(), sent: 0 };
+    /**
+     * One capture. Returns false only when the stream is gone and the chain
+     * must NOT re-arm — every other outcome re-arms at the single call site in
+     * runTick, so no early return can silently freeze the mirror.
+     */
+    const captureTick = (entry) => {
         // Lease check rides the capture tick: one deadline field, no second
         // timer to leak. (The previous per-start expiry setTimeout was never
         // cleared on stop, so a restart left the old one armed to kill the new
         // incarnation.) Reaping here is what frees the slot for everyone whose
         // stop never arrived.
-        if (Date.now() >= (activeStreams.get(sessionName)?.expiresAt ?? 0)) {
+        if (Date.now() >= entry.expiresAt) {
             (0, exports.stopStream)(sessionName);
-            return;
+            return false;
         }
         const captured = capturePane(sessionName, true, STREAM_CAPTURE_LINES);
         if (!captured || captured.content === lastContent) {
             stats.skipped++;
-            return; // diff-gate
+            return true; // diff-gate
         }
+        const now = Date.now();
+        // Send budget BEFORE the diff-gate is marked: a frame refused here has
+        // to stay "changed" so a later tick retries it, or this content is
+        // never sent at all — the next tick would diff-skip it as unchanged.
+        if (!(0, exports.claimFrameSend)(budget, now)) {
+            stats.skipped++;
+            stats.rateCapped++;
+            return true;
+        }
+        // Phase = the gap that PRODUCED this tick (armedDelay), matching how
+        // burstMs is charged in arm() — deciding by wall-clock here instead
+        // made the last burst-armed frame count idle, under-reporting burst
+        // fps by one frame per episode in the R2 numbers.
+        const inBurst = armedDelay === exports.BURST_INTERVAL_MS;
         lastContent = captured.content;
         // Stamp the sequence in CAPTURE order, synchronously — frame assembly
         // is async (encryption) and fire-and-forget, so resolve order is not
@@ -1010,7 +1139,7 @@ const handleStreamControl = (req, send) => {
                 // Encrypt failure — frame dropped, diff-gate un-marked so the
                 // next tick retries. A key that keeps failing (malformed
                 // subscriber key) never recovers: fail closed after a few
-                // strikes instead of retrying every 400ms for 5 minutes.
+                // strikes instead of retrying every tick for 5 minutes.
                 lastContent = null;
                 // Init still in flight (or failed — its own path fail-closes):
                 // a not-yet-ready key is not a malformed key, don't strike.
@@ -1029,7 +1158,12 @@ const handleStreamControl = (req, send) => {
             // ~1.4× the plaintext; base fields now count too, so plaintext
             // streams read slightly higher than the pre-E2EE content-only
             // metric) — this feeds the R2 cost instrumentation.
-            stats.bytes += Buffer.byteLength(JSON.stringify(frame), 'utf-8');
+            const bytes = Buffer.byteLength(JSON.stringify(frame), 'utf-8');
+            stats.bytes += bytes;
+            if (inBurst) {
+                stats.framesBurst++;
+                stats.bytesBurst += bytes;
+            }
             // seq = capture order; epoch = this stream incarnation, so the
             // receiver's ordering guard resets across daemon-side restarts.
             send({ ...frame, seq, epoch: stats.startedAt });
@@ -1039,7 +1173,46 @@ const handleStreamControl = (req, send) => {
             // from send()/logging — report and let the next tick carry on.
             log(`⧉ stream ${sessionName}: frame send failed (${err instanceof Error ? err.message : err})`);
         });
-    }, STREAM_INTERVAL_MS);
+        return true;
+    };
+    /** Arm the next tick. A chain that outlived its incarnation (restart, or a
+     *  stop racing this tick) must die here instead of capturing forever into
+     *  a stream nobody can cancel — `stats` is the incarnation token. */
+    let armedDelay = exports.STREAM_INTERVAL_MS;
+    const arm = (delay) => {
+        const entry = activeStreams.get(sessionName);
+        if (entry?.stats !== stats)
+            return;
+        if (delay === exports.BURST_INTERVAL_MS)
+            stats.burstMs += delay;
+        armedDelay = delay;
+        const next = setTimeout(runTick, delay);
+        next.unref?.();
+        entry.timer = next;
+    };
+    const runTick = () => {
+        const entry = activeStreams.get(sessionName);
+        if (entry?.stats !== stats)
+            return;
+        if (!captureTick(entry))
+            return;
+        // The cadence is re-read every tick, so input that lands mid-stream
+        // tightens the NEXT gap rather than the current one.
+        arm((0, exports.streamCadence)(entry.lastInputAt, Date.now()));
+    };
+    /** Swap an idle-armed tick for an immediate burst tick (see ActiveStream.wake).
+     *  Only when the armed gap is the idle one: replacing an armed burst tick
+     *  on every keystroke would push the next capture away indefinitely. */
+    const wake = () => {
+        const entry = activeStreams.get(sessionName);
+        if (entry?.stats !== stats)
+            return;
+        if (armedDelay === exports.BURST_INTERVAL_MS)
+            return;
+        clearTimeout(entry.timer);
+        arm(exports.BURST_INTERVAL_MS);
+    };
+    const timer = setTimeout(runTick, exports.STREAM_INTERVAL_MS);
     timer.unref?.();
     // A renewing subscriber gets the short lease; anything older keeps the
     // 5-minute orphan guard so a version-skewed client isn't cut off mid-view.
@@ -1047,12 +1220,338 @@ const handleStreamControl = (req, send) => {
     activeStreams.set(sessionName, {
         timer,
         stats,
+        lastInputAt: null,
+        inputDecryptFailures: 0,
         expiresAt: Date.now() + leaseFor(renewing),
         renewing,
+        subscriberPublicKey,
+        wake,
     });
     return true;
 };
 exports.handleStreamControl = handleStreamControl;
+/** Parity with the REST path, which refuses more than MAX_KEYS_PER_COMMAND per
+ *  agent.command (zeph apps/server/src/functions/pushes.ts). The lower-latency
+ *  door into the same pane must not also be the wider one. */
+exports.MAX_INPUT_KEYS = 10;
+/** The REST path caps no body length, so this bound is ours alone: an
+ *  unbounded body is one tmux send-keys argv of unbounded size, and what it
+ *  lands in is an agent prompt, not a paste buffer. */
+exports.MAX_INPUT_BODY_CHARS = 4096;
+// Both fields are relay JSON, so both are attacker-shaped. Number.isFinite
+// admits 1e21 — which parks the high-water mark past anything a sender can
+// count back to — and 1.5, which no later integer can ever equal, so every
+// following key would sit out the hold before being typed out of order.
+const isSeqNumber = (v) => typeof v === 'number' && Number.isSafeInteger(v) && v >= 0;
+// A malformed `keys` would throw where it is consumed (resolveKeys iterates
+// it, tmux args must be strings), and a throw inside the WebSocket message
+// handler takes the whole daemon down. Type-check before acting.
+const isKeyList = (v) => Array.isArray(v) && v.length > 0 && v.every((k) => typeof k === 'string');
+/** Every field of an inbound envelope, all of them relay JSON. A missing or
+ *  ill-typed one would reach WebCrypto as a string it cannot Base64-decode;
+ *  refusing here keeps the failure a refusal rather than a thrown rejection. */
+const isInputEnvelope = (v) => typeof v === 'object' && v !== null && !Array.isArray(v)
+    && ['ciphertext', 'iv', 'encryptedKey', 'keyIv', 'senderPublicKey']
+        .every((field) => typeof v[field] === 'string');
+/** The decrypted payload, under the same stance as the outer message: an
+ *  unchecked cast that validateInputMessage re-checks field by field. Only the
+ *  envelope's authenticity is proven at this point, never its contents —
+ *  a subscriber can seal anything, including 400 keys. */
+const parseSealedInput = (json) => {
+    try {
+        const parsed = JSON.parse(json);
+        if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+};
+/**
+ * Parse and whitelist an inbound input message. Pure — the lease gate and the
+ * tmux-side guards stay in the caller, so this is testable on its own.
+ */
+const validateInputMessage = (msg) => {
+    const { sessionName, seq, epoch } = msg;
+    if (typeof sessionName !== 'string' || !sessionName)
+        return { ok: false, reason: 'no sessionName' };
+    // This function reads plaintext `keys`/`body` and nothing else, so it must
+    // never see a message that still carries an envelope: the encrypted path
+    // opens one and hands the decrypted fields back through here with the
+    // envelope stripped. A message arriving with both would otherwise get the
+    // plaintext half injected while its sender believed the sealed half was
+    // what landed. Fail closed instead.
+    if (msg.encrypted !== undefined)
+        return { ok: false, reason: 'envelope reached the plaintext validator' };
+    if (!isSeqNumber(seq) || !isSeqNumber(epoch))
+        return { ok: false, reason: 'missing seq/epoch' };
+    const base = {
+        sessionName,
+        seq,
+        epoch,
+        ...(typeof msg.deviceId === 'string' && msg.deviceId ? { deviceId: msg.deviceId } : {}),
+    };
+    if (msg.keys !== undefined) {
+        if (!isKeyList(msg.keys))
+            return { ok: false, reason: 'malformed keys' };
+        if (msg.keys.length > exports.MAX_INPUT_KEYS)
+            return { ok: false, reason: `too many keys (${msg.keys.length})` };
+        if (msg.body !== undefined)
+            return { ok: false, reason: 'keys and body are mutually exclusive' };
+        const tokens = (0, exports.resolveKeys)(msg.keys);
+        if (!tokens)
+            return { ok: false, reason: `unknown key(s) [${msg.keys.join(' ')}]` };
+        return { ok: true, input: { ...base, tokens, text: null } };
+    }
+    if (typeof msg.body !== 'string' || !msg.body)
+        return { ok: false, reason: 'empty input' };
+    if (msg.body.length > exports.MAX_INPUT_BODY_CHARS)
+        return { ok: false, reason: `body too long (${msg.body.length})` };
+    return { ok: true, input: { ...base, tokens: null, text: msg.body } };
+};
+exports.validateInputMessage = validateInputMessage;
+/**
+ * Type one ordered message into the pane. Unlike the REST key path this
+ * schedules no follow-up snapshot: the message only got this far because a
+ * live stream is already repainting the pane at frame rate.
+ */
+const deliverInput = (input) => {
+    // The reorder hold can outlive the lease that admitted the message.
+    const injected = activeStreams.has(input.sessionName)
+        && (input.tokens
+            ? tryInjectKeys(input.sessionName, input.tokens, {})
+            : tryInject(input.sessionName, input.text ?? '', {}));
+    // Every refusal reachable from here — dead lease, shell pane, rate limit,
+    // a failed send-keys — used to be silent, which contradicts the contract
+    // above: the sender would keep waiting on a keystroke that never lands
+    // instead of falling back to the REST push path.
+    if (!injected)
+        input.send(streamErrorFrame(input.sessionName, 'input_rejected', input));
+};
+/** Ceiling on concurrent sender lanes. The lane key includes a relay-stamped
+ *  deviceId, but a relay older than the unconditional stamp lets a sender vary
+ *  it per message — without a cap that grows the map for the lease's whole
+ *  life. Real senders are one per device; 16 is generous. */
+exports.MAX_INPUT_LANES = 16;
+const inputSequencerFor = (key) => {
+    const existing = inputSequencers.get(key);
+    if (existing)
+        return existing;
+    if (inputSequencers.size >= exports.MAX_INPUT_LANES)
+        return null;
+    const created = (0, input_sequencer_js_1.createInputSequencer)(deliverInput, {
+        // Held keys swept out by an epoch change or stream stop are keystrokes
+        // their sender still waits on — refuse them so it can fall back.
+        onDiscard: (input) => input.send(streamErrorFrame(input.sessionName, 'input_rejected', input)),
+    });
+    inputSequencers.set(key, created);
+    return created;
+};
+/** Hand a validated injection to its sender's ordering lane. Shared by both
+ *  inbound paths — plaintext and decrypted input order against each other. */
+const enqueueInput = (input, send) => {
+    // One ordering run per sender, not per session: two devices typing into
+    // the same pane each carry their own seq/epoch, and a shared sequencer
+    // would let the higher epoch supersede the other and silence it.
+    const senderKey = input.deviceId ? `${input.sessionName}#${input.deviceId}` : input.sessionName;
+    const sequencer = inputSequencerFor(senderKey);
+    if (!sequencer) {
+        log(`! input ${input.sessionName}: sender lane cap reached — drop`);
+        send(streamErrorFrame(input.sessionName, 'input_rejected', input));
+        return;
+    }
+    const accepted = sequencer.accept({ ...input, send });
+    if (accepted !== 'ok') {
+        // overflow / superseded / stale — the message was dropped, and the
+        // sender must hear so instead of waiting on a keystroke that never
+        // lands (the sequencer reports swept HELD messages via onDiscard).
+        log(`! input ${input.sessionName}: ${accepted} — drop`);
+        send(streamErrorFrame(input.sessionName, 'input_rejected', input));
+    }
+};
+/**
+ * Tail of the encrypted-input decrypt chain.
+ *
+ * Encrypted inputs are opened one at a time rather than concurrently. That
+ * bounds the ECDH work one socket can have in flight, and it keeps arrival
+ * order into the sequencer — two keystrokes whose decrypts race would
+ * otherwise reach it in whichever order WebCrypto finished, turning an
+ * in-order pair into a gap and a 500 ms hold.
+ */
+let inputDecryptChain = Promise.resolve();
+let inputDecryptDepth = 0;
+/** Ceiling on queued decrypts. The subscriber-key binding is a string compare
+ *  against a public key the relay fanned out to every same-account connection,
+ *  so it gates WHO can enqueue an ECDH derive, not how many — a flooding
+ *  client would otherwise grow the chain without bound. Mirrors
+ *  MAX_PENDING_INPUTS' role on the plaintext side. */
+exports.MAX_PENDING_DECRYPTS = 32;
+/** Resolves once every encrypted input accepted so far has been routed. */
+const pendingInputDecrypts = () => inputDecryptChain;
+exports.pendingInputDecrypts = pendingInputDecrypts;
+/**
+ * Open an E2EE input envelope and route what was inside it.
+ *
+ * Every cheap guard runs synchronously, before any crypto: an envelope from
+ * anyone but the subscriber costs a string compare, not an ECDH derive. What
+ * comes out of the decrypt is then re-validated by exactly the checks the
+ * plaintext path runs — the envelope hides the payload from the relay, never
+ * from the whitelist or the caps.
+ */
+const handleEncryptedInput = (msg, send) => {
+    const { sessionName } = msg;
+    const refuse = (reason) => {
+        log(`! input ${sessionName ?? '(no session)'}: ${reason} — drop`);
+        // No sessionName means the sender can't match the error to anything.
+        // The reason never rides along: it is derived from plaintext the relay
+        // must not learn, so it stays in this host's log.
+        if (typeof sessionName === 'string' && sessionName) {
+            send(streamErrorFrame(sessionName, 'input_rejected', msg));
+        }
+    };
+    if (typeof sessionName !== 'string' || !sessionName)
+        return refuse('no sessionName');
+    const stream = activeStreams.get(sessionName);
+    if (!stream)
+        return refuse('encrypted input with no live stream');
+    // A stream that handshook no subscriber key has no key to bind this
+    // envelope against — and its own frames go out in the clear, so there is
+    // nothing here worth protecting and no way to prove who sent it.
+    const { subscriberPublicKey } = stream;
+    if (!subscriberPublicKey)
+        return refuse('encrypted input on a plaintext stream');
+    if (!isInputEnvelope(msg.encrypted))
+        return refuse('malformed encrypted envelope');
+    // THE binding. Opening an envelope proves only that its sender holds some
+    // private key; it is this comparison that makes it the key the subscriber
+    // handshook with, and so makes ephemeral input exclusive to the device
+    // actually watching the pane. Without it, anyone who learned this host's
+    // public key could type into it.
+    const envelope = msg.encrypted;
+    if (envelope.senderPublicKey !== subscriberPublicKey) {
+        return refuse('envelope not sealed by the stream subscriber');
+    }
+    // The incarnation this message was admitted under. A stream can stop and
+    // restart — with a different subscriber key — while the decrypt is in
+    // flight, and the lease check inside deliverInput only asks whether SOME
+    // stream of this name exists.
+    const incarnation = stream.stats;
+    if (inputDecryptDepth >= exports.MAX_PENDING_DECRYPTS) {
+        return refuse('decrypt queue full');
+    }
+    // The binding compares against a public key the relay has seen, so it says
+    // who MAY enqueue an ECDH derive, not that they can produce an openable
+    // envelope. Sustained garbage would otherwise spend the one shared decrypt
+    // chain on every stream at once. Same fail-closed shape as the outbound
+    // half (STREAM_MAX_ENCRYPT_FAILURES): after a few consecutive failures this
+    // stream takes no more sealed input until it is re-subscribed.
+    if (stream.inputDecryptFailures >= STREAM_MAX_ENCRYPT_FAILURES) {
+        return refuse('too many failed decrypts on this stream');
+    }
+    inputDecryptDepth++;
+    inputDecryptChain = inputDecryptChain.then(async () => {
+        inputDecryptDepth--;
+        let opened;
+        try {
+            opened = await (0, crypto_js_1.decryptEphemeral)(envelope);
+        }
+        catch (err) {
+            // AES-GCM is authenticated, so this is a forged, truncated or
+            // misaddressed envelope — never a partially readable one.
+            const live = activeStreams.get(sessionName);
+            if (live?.stats === incarnation)
+                live.inputDecryptFailures++;
+            return refuse(`decrypt failed (${err instanceof Error ? err.message : err})`);
+        }
+        // A real envelope clears the strikes: the cap is there to stop a flood,
+        // not to retire a stream that saw one corrupted message.
+        const live = activeStreams.get(sessionName);
+        if (live?.stats === incarnation)
+            live.inputDecryptFailures = 0;
+        if (activeStreams.get(sessionName)?.stats !== incarnation) {
+            return refuse('stream replaced while decrypting');
+        }
+        const payload = parseSealedInput(opened);
+        if (!payload)
+            return refuse('sealed payload is not an input object');
+        // Replay binding: the ciphertext must vouch for the plaintext stamps.
+        // AES-GCM stops the relay from forging content, but without this check
+        // it could replay a captured envelope under a fresh seq and type a
+        // real keystroke twice — the relay is exactly the party E2EE distrusts.
+        if (payload.seq !== msg.seq || payload.epoch !== msg.epoch || payload.sessionName !== sessionName) {
+            return refuse('sealed stamps do not match the plaintext ones (replay?)');
+        }
+        const checked = (0, exports.validateInputMessage)({
+            sessionName,
+            seq: msg.seq,
+            epoch: msg.epoch,
+            deviceId: msg.deviceId,
+            keys: payload.keys,
+            body: payload.body,
+        });
+        if (!checked.ok)
+            return refuse(checked.reason);
+        enqueueInput(checked.input, send);
+    }).catch((err) => {
+        // Nothing above should throw outside the decrypt, but one broken link
+        // must not stall every keystroke queued behind it.
+        log(`! input ${sessionName}: encrypted routing failed (${err instanceof Error ? err.message : err})`);
+    });
+};
+/**
+ * Handle agent.command.input. Returns true when the message was ours to
+ * answer, so the caller stops routing it. Encrypted messages finish
+ * asynchronously — the return value reports routing, not delivery, exactly as
+ * it already did for a message the sequencer holds.
+ */
+const handleCommandInput = (msg, send) => {
+    if (msg.subtype !== 'agent.command.input')
+        return false;
+    // Addressing gate, as on stream control: the relay fans every ephemeral
+    // message out to all of this user's connections, and two machines can run
+    // the same tmux session name — an unaddressed inject would type into both.
+    if (msg.targetDeviceId !== (0, exports.computeListenerDeviceId)())
+        return false;
+    // An envelope decides the message on its own. Branching here rather than
+    // inside the validator is what keeps the plaintext `keys`/`body` a relay
+    // could staple alongside it out of reach.
+    if (msg.encrypted !== undefined) {
+        handleEncryptedInput(msg, send);
+        return true;
+    }
+    const checked = (0, exports.validateInputMessage)(msg);
+    if (!checked.ok) {
+        log(`! input ${msg.sessionName ?? '(no session)'}: ${checked.reason} — drop`);
+        // No sessionName means the sender can't match the error to anything.
+        if (typeof msg.sessionName === 'string' && msg.sessionName) {
+            send(streamErrorFrame(msg.sessionName, 'input_rejected', msg));
+        }
+        return true;
+    }
+    const { input } = checked;
+    // Input rides the stream lease: without one, nobody is watching the pane
+    // this would type into, and seq/epoch have no incarnation to order
+    // against. The sender learns in one hop and falls back to a REST push.
+    const stream = activeStreams.get(input.sessionName);
+    if (!stream) {
+        log(`! input ${input.sessionName}: no live stream — drop`);
+        send(streamErrorFrame(input.sessionName, 'input_rejected', input));
+        return true;
+    }
+    // This stream's outbound half is E2EE for that subscriber, so accepting a
+    // plaintext keystroke would leave the inbound leg the only one in clear —
+    // and nothing about it proves the subscriber sent it. An encrypted stream
+    // takes sealed input (above) or none.
+    if (stream.subscriberPublicKey) {
+        log(`! input ${input.sessionName}: stream is E2EE, plaintext input refused — drop`);
+        send(streamErrorFrame(input.sessionName, 'input_rejected', input));
+        return true;
+    }
+    enqueueInput(input, send);
+    return true;
+};
+exports.handleCommandInput = handleCommandInput;
 /**
  * Inventory pass that also records *why* each `zeph-*` session was
  * skipped. The verbose log uses the rejection notes to explain empty
@@ -1141,6 +1640,13 @@ exports.collectSessions = collectSessions;
  * prefix path route through here so the defense layers can't diverge.
  */
 const passesInjectGuards = (session, deps) => {
+    // Rate bucket first: the pane probe below is a blocking tmux spawnSync,
+    // and the sequencer can flush several held messages back-to-back — an
+    // empty bucket must refuse before paying that probe N times, not after.
+    if (!(deps.rateLimit ?? exports.checkRateLimit)(session)) {
+        log(`! ${session}: rate-limited — drop`);
+        return false;
+    }
     const cmd = (deps.paneCommand ?? exports.paneCurrentCommand)(session);
     if (cmd === null) {
         log(`! ${session}: no such tmux session — drop`);
@@ -1150,10 +1656,6 @@ const passesInjectGuards = (session, deps) => {
         log(`! ${session}: pane is at shell (${cmd}) — refusing (would be RCE)`);
         return false;
     }
-    if (!(deps.rateLimit ?? exports.checkRateLimit)(session)) {
-        log(`! ${session}: rate-limited — drop`);
-        return false;
-    }
     return true;
 };
 /**
@@ -1190,6 +1692,7 @@ const tryInject = (session, text, deps) => {
     const preview = text.length > 60 ? text.slice(0, 60) + '…' : text;
     log(`${ok ? '→' : '✗'} ${session}: ${preview}`);
     if (ok) {
+        noteStreamInput(session);
         const cwd = (deps.paneCwd ?? defaultPaneCwd)(session);
         if (cwd)
             (0, exports.writeRemoteMarker)(cwd, text);
@@ -1202,6 +1705,8 @@ const tryInjectKeys = (session, tokens, deps) => {
     if (!passesInjectGuards(session, deps))
         return false;
     const ok = (deps.sendKeys ?? injectNamedKeys)(session, tokens);
+    if (ok)
+        noteStreamInput(session);
     log(`${ok ? '⌨' : '✗'} ${session}: [${tokens.join(' ')}]`);
     return ok;
 };
@@ -1674,7 +2179,11 @@ const streamSession = (wsUrl, apiKey) => {
                 // Live mirror (PoC): agent.stream.start/stop drives a
                 // continuous, diff-gated frame loop; falls through to the
                 // one-shot screen-peek when it isn't a stream-control message.
-                if (!(0, exports.handleStreamControl)(m.data, sendEphemeral)) {
+                // agent.command.input types into a streamed pane without the
+                // REST round-trip; it is only accepted while that stream's
+                // lease is live, so it sits behind the same routing chain.
+                if (!(0, exports.handleCommandInput)(m.data, sendEphemeral) &&
+                    !(0, exports.handleStreamControl)(m.data, sendEphemeral)) {
                     const reply = (0, exports.handleScreenRequest)(m.data);
                     if (reply)
                         sendEphemeral(reply);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zeph-to/cli",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "description": "Zeph CLI + push notification SDK for AI agents",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",