@zeph-to/mcp-server 1.16.0 → 2.1.0

package/dist/crypto.js

@@ -1,35 +1,38 @@
 "use strict";
 /**
- * Device-shared encryption for MCP server — self-contained ECDH P-256 +
+ * Per-device encryption for the MCP server — self-contained ECDH P-256 +
  * AES-256-GCM. Mirrors @zeph/crypto API but bundled inline (no external
  * dependency). Uses Web Crypto API via node:crypto webcrypto — Node.js 18+
  * (the `crypto` global only exists unflagged from Node 19, so we import it).
  *
- * Threat model honesty (do not call this "E2E" without a footnote):
+ * How it works (ADR-0007):
  *
- *   The Zeph backend persists the per-user private key in plaintext so it
- *   can be synced down to a fresh device (fetchServerKeys / uploadServerKeys
- *   below). That means the backend can decrypt any push body — this is NOT
- *   end-to-end in the standard sense. What it gives you is:
- *     • Protection against passive network observers
- *     • Protection against a leaked DB snapshot taken without the key store
- *     • Cross-device readability (all your devices share one keypair)
- *   What it does NOT give you:
- *     • Protection against the Zeph backend itself
- *     • Forward secrecy — encryptPushBodyForSelf / encryptFileForSelf do
- *       ECDH(self, self), which collapses to a static derived key. A single
- *       device compromise (since all your devices share the same keypair)
- *       lets the attacker decrypt every past push for which they have the
- *       ciphertext. The per-message AES key is random, but its wrap key is
- *       static, so wrapped keys are decryptable forever.
+ *   This process holds its own ECDH keypair. The private half is generated
+ *   here, written to ~/.config/zeph/device-keys.json, and never leaves the
+ *   host — the server only ever sees public keys. A push is encrypted once
+ *   with a random AES key, and that key is wrapped separately for each of the
+ *   user's registered devices using ECDH(this host, that device).
  *
- *   True E2E would require a per-device keypair (server stores only public
- *   keys; senders wrap the message key once per recipient device public
- *   key). That refactor is on the roadmap; until then, treat push bodies as
- *   sensitive-but-not-secret.
+ *   That makes it end-to-end in the standard sense: the backend stores
+ *   ciphertext plus wrapped keys it cannot unwrap.
+ *
+ * What it still does not give you:
+ *   • Forward secrecy — the ECDH secret for a given (sender, device) pair is
+ *     static, so a compromise of either private key retroactively opens every
+ *     push wrapped for that pair. The per-message AES key is random; its wrap
+ *     key is not.
+ *   • Authenticity beyond the key pairing — nothing signs `senderPublicKey`,
+ *     so a server that swapped it could make a push undecryptable, though not
+ *     readable.
+ *
+ * Superseded scheme: a single account-wide keypair whose private half the
+ * backend escrowed so it could sync to new devices. Key escrow was removed
+ * server-side (zeph@8a6d21b), which left this client waiting for a private key
+ * the API stopped returning — encryption was silently off for months. Nothing
+ * here asks for that key any more.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.encryptFileForSelf = exports.encryptPushBodyForSelf = exports.disableCrypto = exports.getPublicKey = exports.getKeyPair = exports.initCrypto = void 0;
+exports.encryptFileForDevices = exports.encryptPushBodyForDevices = exports.disableCrypto = exports.getPublicKey = exports.getKeyPair = exports.selectRecipients = exports.initCrypto = void 0;
 /// <reference lib="dom" />
 const fs_1 = require("fs");
 const os_1 = require("os");
@@ -49,8 +52,14 @@ const fromBase64 = (base64) => {
 };
 // ─── ECDH key management ───
 const ECDH_PARAMS = { name: 'ECDH', namedCurve: 'P-256' };
-// generateKeyPair / exportKeyPair were removed in fix/no-auto-encryption.
-// This module imports keys only; it never creates or exports them.
+const generateKeyPair = async () => crypto.subtle.generateKey(ECDH_PARAMS, true, ['deriveKey', 'deriveBits']);
+const exportKeyPair = async (keyPair) => {
+    const [publicRaw, privateRaw] = await Promise.all([
+        crypto.subtle.exportKey('spki', keyPair.publicKey),
+        crypto.subtle.exportKey('pkcs8', keyPair.privateKey),
+    ]);
+    return { publicKey: toBase64(publicRaw), privateKey: toBase64(privateRaw) };
+};
 const importPublicKey = async (base64) => crypto.subtle.importKey('spki', fromBase64(base64), ECDH_PARAMS, true, []);
 const importPrivateKey = async (base64) => crypto.subtle.importKey('pkcs8', fromBase64(base64), ECDH_PARAMS, true, ['deriveKey', 'deriveBits']);
 const importKeyPair = async (exported) => {
@@ -61,62 +70,60 @@ const importKeyPair = async (exported) => {
     return { publicKey, privateKey };
 };
 const deriveAesKey = async (privateKey, publicKey) => crypto.subtle.deriveKey({ name: 'ECDH', public: publicKey }, privateKey, { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']);
-const encrypt = async (plaintext, senderPrivateKey, recipientPublicKey) => {
-    const messageKey = await crypto.subtle.generateKey({ name: 'AES-GCM', length: 256 }, true, ['encrypt', 'decrypt']);
-    const iv = crypto.getRandomValues(new Uint8Array(12));
-    const ciphertext = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, messageKey, new TextEncoder().encode(plaintext));
-    const sharedKey = await deriveAesKey(senderPrivateKey, recipientPublicKey);
-    const rawMessageKey = await crypto.subtle.exportKey('raw', messageKey);
-    const keyIv = crypto.getRandomValues(new Uint8Array(12));
-    const encryptedKey = await crypto.subtle.encrypt({ name: 'AES-GCM', iv: keyIv }, sharedKey, rawMessageKey);
-    return {
-        ciphertext: toBase64(ciphertext),
-        iv: toBase64(iv.buffer),
-        encryptedKey: toBase64(encryptedKey),
-        keyIv: toBase64(keyIv.buffer),
-    };
-};
-// ─── File encryption ───
-const encryptFileContent = async (content, senderPrivateKey, recipientPublicKey) => {
-    // Binary attachments arrive as a Buffer and must be encrypted byte for byte —
-    // running them through TextEncoder would UTF-8 mangle every non-ASCII byte.
-    // Both branches are views; subtle.encrypt honours byteOffset/byteLength, so a
-    // Buffer carved out of Node's pool encrypts only its own bytes.
-    const buffer = typeof content === 'string'
-        ? new TextEncoder().encode(content)
-        : new Uint8Array(content.buffer, content.byteOffset, content.byteLength);
-    const fileKey = await crypto.subtle.generateKey({ name: 'AES-GCM', length: 256 }, true, ['encrypt', 'decrypt']);
-    const iv = crypto.getRandomValues(new Uint8Array(12));
-    const ciphertext = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, fileKey, buffer);
-    const sharedKey = await deriveAesKey(senderPrivateKey, recipientPublicKey);
-    const rawFileKey = await crypto.subtle.exportKey('raw', fileKey);
-    const keyIv = crypto.getRandomValues(new Uint8Array(12));
-    const encryptedKey = await crypto.subtle.encrypt({ name: 'AES-GCM', iv: keyIv }, sharedKey, rawFileKey);
-    return {
-        ciphertext: Buffer.from(ciphertext),
-        iv: toBase64(iv.buffer),
-        encryptedKey: toBase64(encryptedKey),
-        keyIv: toBase64(keyIv.buffer),
-    };
+/**
+ * Wrap one raw AES key for every recipient device.
+ *
+ * The payload is encrypted once and only the 44-byte wrapped key repeats, so
+ * an attachment costs one S3 object regardless of how many devices the account
+ * has. A recipient whose public key will not import is dropped rather than
+ * failing the send — one broken device record must not silence every push.
+ */
+const wrapForDevices = async (rawKey, senderPrivateKey, recipients) => {
+    const entries = await Promise.all(recipients.map(async ({ deviceId, publicKey }) => {
+        try {
+            const sharedKey = await deriveAesKey(senderPrivateKey, await importPublicKey(publicKey));
+            const keyIv = crypto.getRandomValues(new Uint8Array(12));
+            const wrapped = await crypto.subtle.encrypt({ name: 'AES-GCM', iv: keyIv }, sharedKey, rawKey);
+            return [
+                deviceId,
+                JSON.stringify({ encryptedKey: toBase64(wrapped), keyIv: toBase64(keyIv.buffer) }),
+            ];
+        }
+        catch (err) {
+            console.error(`[Crypto] Skipping device ${deviceId} — unusable public key:`, err);
+            return null;
+        }
+    }));
+    const keyMap = {};
+    for (const entry of entries) {
+        if (entry)
+            keyMap[entry[0]] = entry[1];
+    }
+    if (Object.keys(keyMap).length === 0)
+        throw new Error('No recipient device accepted the wrapped key');
+    return keyMap;
 };
-// ─── Key persistence (~/.config/zeph/keys.json) ───
+// ─── Key persistence ───
 const KEYS_DIR = (0, path_1.join)(process.env.XDG_CONFIG_HOME ?? (0, path_1.join)((0, os_1.homedir)(), '.config'), 'zeph');
-const KEYS_PATH = (0, path_1.join)(KEYS_DIR, 'keys.json');
-const loadStoredKeys = () => {
+// Superseded account-wide keypair. Never written any more; only deleted.
+const LEGACY_KEYS_PATH = (0, path_1.join)(KEYS_DIR, 'keys.json');
+const DEVICE_KEYS_PATH = (0, path_1.join)(KEYS_DIR, 'device-keys.json');
+const loadDeviceKeys = () => {
     try {
-        return JSON.parse((0, fs_1.readFileSync)(KEYS_PATH, 'utf-8'));
+        const parsed = JSON.parse((0, fs_1.readFileSync)(DEVICE_KEYS_PATH, 'utf-8'));
+        return parsed.publicKey && parsed.privateKey ? parsed : null;
     }
     catch {
         return null;
     }
 };
-const storeKeys = (exported) => {
+const storeDeviceKeys = (exported) => {
     (0, fs_1.mkdirSync)(KEYS_DIR, { recursive: true, mode: 0o700 });
-    (0, fs_1.writeFileSync)(KEYS_PATH, JSON.stringify(exported, null, 2), { mode: 0o600 });
+    (0, fs_1.writeFileSync)(DEVICE_KEYS_PATH, JSON.stringify(exported, null, 2), { mode: 0o600 });
 };
-const deleteStoredKeys = () => {
+const deleteLegacyKeys = () => {
     try {
-        (0, fs_1.unlinkSync)(KEYS_PATH);
+        (0, fs_1.unlinkSync)(LEGACY_KEYS_PATH);
     }
     catch { /* not present — fine */ }
 };
@@ -127,38 +134,32 @@ const envIsTrue = (key) => {
 // ─── Cached state ───
 let cachedKeyPair = null;
 let cachedExportedPublicKey = null;
-let cachedOwnPublicKey = null;
+let cachedLegacyPublicKey = null;
 let initPromise = null;
 /**
  * Initialize crypto.
  *
- * The MCP server is a CONSUMER of encryption keys, not a generator. Keys
- * are created in the Zeph app where the user explicitly opts in (Settings
- * → Encryption). This function only imports keys that the server already
- * has, and only when the server confirms encryption is enabled.
+ * Encryption turns on only when the account has explicitly opted in —
+ * `encryptionEnabled` from `GET /users/me/keys` is the single authoritative
+ * signal (ADR-0008), set from the Zeph app. Server unreachable, flag off, or
+ * the hard opt-out below all leave the cache empty and every send plaintext.
  *
- * Any other state — server says disabled, server has no keys, server is
- * unreachable — leaves encryption OFF (cache empty, no fallback). A
- * previous version generated and uploaded a fresh keypair on the "no keys
- * anywhere" path; combined with a transient fetch failure, that silently
- * turned encryption on without user consent and locked the account into
- * an "encryption enabled" state on the server.
+ * When it is on, this host generates its own keypair on first use and keeps
+ * it. Unlike the superseded scheme this asks the server for nothing but the
+ * flag: the private key is created here and stays here.
  *
  * Opt-out: `ZEPH_DISABLE_ENCRYPTION=1` forces crypto off regardless of
- * server state — useful while cleaning up legacy state or for users who
- * never want encryption.
+ * server state.
  *
- * Safe to call concurrently — deduplicates to single init.
- * Returns the exported public key when encryption is active, '' otherwise.
+ * Safe to call concurrently — deduplicates to a single init.
+ * Returns this host's public key when encryption is active, '' otherwise.
  *
  * NOTE: when `apiKey` is provided, `baseUrl` is required.
  */
 const initCrypto = (apiKey, baseUrl) => {
     // Hard opt-out — skip everything, leave cache empty.
     if (envIsTrue('ZEPH_DISABLE_ENCRYPTION')) {
-        cachedKeyPair = null;
-        cachedExportedPublicKey = null;
-        cachedOwnPublicKey = null;
+        (0, exports.disableCrypto)();
         return Promise.resolve('');
     }
     if (apiKey && !baseUrl) {
@@ -167,49 +168,43 @@ const initCrypto = (apiKey, baseUrl) => {
     }
     if (initPromise)
         return initPromise;
-    const baseUrlRequired = apiKey ? baseUrl : baseUrl;
     initPromise = (async () => {
-        if (apiKey) {
-            const serverResult = await fetchServerKeys(apiKey, baseUrlRequired);
-            // The only path that turns encryption ON: server confirms enabled AND
-            // hands us a real keypair. Everything else leaves the cache empty.
-            const haveServerKeys = !!serverResult && serverResult.encryptionEnabled && !!serverResult.keys;
-            if (!haveServerKeys) {
-                cachedKeyPair = null;
-                cachedExportedPublicKey = null;
-                cachedOwnPublicKey = null;
-                // If the server is reachable and explicitly says encryption is off,
-                // drop any stale local cache so a future regression can't resurrect
-                // a keypair that the user already disabled.
-                if (serverResult && !serverResult.encryptionEnabled) {
-                    deleteStoredKeys();
-                }
+        // Local-only mode (no apiKey): used by tests and offline setups. There is
+        // no flag to consult, so an existing device keypair is adopted and a
+        // missing one is not created — generating here would encrypt without any
+        // signal that the user asked for it.
+        if (!apiKey) {
+            const stored = loadDeviceKeys();
+            if (!stored) {
+                (0, exports.disableCrypto)();
                 return '';
             }
-            const keys = serverResult.keys;
-            const stored = loadStoredKeys();
-            if (!stored || stored.publicKey !== keys.publicKey) {
-                storeKeys(keys);
-            }
-            cachedKeyPair = await importKeyPair(keys);
-            cachedExportedPublicKey = keys.publicKey;
-            cachedOwnPublicKey = cachedKeyPair.publicKey;
-            return keys.publicKey;
+            cachedKeyPair = await importKeyPair(stored);
+            cachedExportedPublicKey = stored.publicKey;
+            return stored.publicKey;
         }
-        // Local-only mode (no apiKey): load stored keys if they exist; do NOT
-        // generate. Used by tests and offline / pre-provisioned setups where
-        // a keypair has been dropped into ~/.config/zeph/keys.json out-of-band.
-        const stored = loadStoredKeys();
-        if (!stored) {
-            cachedKeyPair = null;
-            cachedExportedPublicKey = null;
-            cachedOwnPublicKey = null;
+        const serverResult = await fetchEncryptionState(apiKey, baseUrl);
+        if (!serverResult?.encryptionEnabled) {
+            (0, exports.disableCrypto)();
+            // The account says encryption is off. Drop the escrowed account keypair
+            // if an old build left one on disk — it holds a private key this process
+            // has no use for and the server no longer accepts.
+            if (serverResult)
+                deleteLegacyKeys();
             return '';
         }
-        cachedKeyPair = await importKeyPair(stored);
-        cachedExportedPublicKey = stored.publicKey;
-        cachedOwnPublicKey = cachedKeyPair.publicKey;
-        return stored.publicKey;
+        const stored = loadDeviceKeys();
+        if (stored) {
+            cachedKeyPair = await importKeyPair(stored);
+            cachedExportedPublicKey = stored.publicKey;
+            return stored.publicKey;
+        }
+        const keyPair = await generateKeyPair();
+        const exported = await exportKeyPair(keyPair);
+        storeDeviceKeys(exported);
+        cachedKeyPair = keyPair;
+        cachedExportedPublicKey = exported.publicKey;
+        return exported.publicKey;
     })().catch((err) => {
         initPromise = null;
         throw err;
@@ -217,7 +212,7 @@ const initCrypto = (apiKey, baseUrl) => {
     return initPromise;
 };
 exports.initCrypto = initCrypto;
-const fetchServerKeys = async (apiKey, baseUrl) => {
+const fetchEncryptionState = async (apiKey, baseUrl) => {
     try {
         const url = `${baseUrl.replace(/\/$/, '')}/users/me/keys`;
         // Bounded: index.ts awaits initCrypto before connecting the MCP
@@ -229,20 +224,29 @@ const fetchServerKeys = async (apiKey, baseUrl) => {
         if (!res.ok)
             return null;
         const json = await res.json();
-        const keys = json.data?.encryptionKeys;
-        const encryptionEnabled = json.data?.encryptionEnabled ?? (keys ? true : false);
-        return {
-            keys: keys?.publicKey && keys?.privateKey ? keys : null,
-            encryptionEnabled,
+        const state = {
+            encryptionEnabled: json.data?.encryptionEnabled === true,
+            legacyPublicKey: json.data?.encryptionKeys?.publicKey ?? null,
         };
+        cachedLegacyPublicKey = state.legacyPublicKey;
+        return state;
     }
     catch {
         return null;
     }
 };
-// uploadServerKeys was removed in fix/no-auto-encryption — the MCP server
-// must never write to /users/me/keys. Keys are created by the Zeph app
-// where the user explicitly opts in.
+/**
+ * Keep only devices this host can actually encrypt for.
+ *
+ * A device without a public key has never run a build that registers one, and
+ * a device still advertising the account-wide key has not migrated to
+ * per-device E2E — wrapping for either produces a push it cannot open, which
+ * is worse than sending plaintext it can read.
+ */
+const selectRecipients = (devices) => devices
+    .filter((d) => !!d.publicKey && d.publicKey !== cachedLegacyPublicKey)
+    .map(({ deviceId, publicKey }) => ({ deviceId, publicKey }));
+exports.selectRecipients = selectRecipients;
 const getKeyPair = () => cachedKeyPair;
 exports.getKeyPair = getKeyPair;
 const getPublicKey = () => cachedExportedPublicKey;
@@ -259,35 +263,51 @@ exports.getPublicKey = getPublicKey;
 const disableCrypto = () => {
     cachedKeyPair = null;
     cachedExportedPublicKey = null;
-    cachedOwnPublicKey = null;
 };
 exports.disableCrypto = disableCrypto;
 /**
- * Encrypt push body for self (all own devices).
+ * Encrypt a push body for the given recipient devices.
+ *
+ * Returns the wire fields the API expects: `body` carries the ciphertext and
+ * IV, `deviceKeyMap` the per-device wrapped keys, `senderPublicKey` the half
+ * recipients need to derive the same secret back.
  */
-const encryptPushBodyForSelf = async (input) => {
-    if (!cachedKeyPair || !cachedExportedPublicKey || !cachedOwnPublicKey)
+const encryptPushBodyForDevices = async (input, recipients) => {
+    if (!cachedKeyPair || !cachedExportedPublicKey)
         throw new Error('Crypto not initialized');
-    const payload = await encrypt(JSON.stringify({ title: input.title, body: input.body, url: input.url }), cachedKeyPair.privateKey, cachedOwnPublicKey);
+    const messageKey = await crypto.subtle.generateKey({ name: 'AES-GCM', length: 256 }, true, ['encrypt', 'decrypt']);
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const ciphertext = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, messageKey, new TextEncoder().encode(JSON.stringify({ title: input.title, body: input.body, url: input.url })));
+    const rawMessageKey = await crypto.subtle.exportKey('raw', messageKey);
     return {
-        body: JSON.stringify({ ciphertext: payload.ciphertext, iv: payload.iv }),
-        encryptedKey: JSON.stringify({ encryptedKey: payload.encryptedKey, keyIv: payload.keyIv }),
+        body: JSON.stringify({ ciphertext: toBase64(ciphertext), iv: toBase64(iv.buffer) }),
+        deviceKeyMap: await wrapForDevices(rawMessageKey, cachedKeyPair.privateKey, recipients),
         senderPublicKey: cachedExportedPublicKey,
         isEncrypted: true,
     };
 };
-exports.encryptPushBodyForSelf = encryptPushBodyForSelf;
+exports.encryptPushBodyForDevices = encryptPushBodyForDevices;
 /**
- * Encrypt file content for self (all own devices).
+ * Encrypt file content for the given recipient devices.
  */
-const encryptFileForSelf = async (content) => {
-    if (!cachedKeyPair || !cachedOwnPublicKey)
+const encryptFileForDevices = async (content, recipients) => {
+    if (!cachedKeyPair)
         throw new Error('Crypto not initialized');
-    const result = await encryptFileContent(content, cachedKeyPair.privateKey, cachedOwnPublicKey);
+    // Binary attachments arrive as a Buffer and must be encrypted byte for byte —
+    // running them through TextEncoder would UTF-8 mangle every non-ASCII byte.
+    // Both branches are views; subtle.encrypt honours byteOffset/byteLength, so a
+    // Buffer carved out of Node's pool encrypts only its own bytes.
+    const buffer = typeof content === 'string'
+        ? new TextEncoder().encode(content)
+        : new Uint8Array(content.buffer, content.byteOffset, content.byteLength);
+    const fileKey = await crypto.subtle.generateKey({ name: 'AES-GCM', length: 256 }, true, ['encrypt', 'decrypt']);
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const ciphertext = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, fileKey, buffer);
+    const rawFileKey = await crypto.subtle.exportKey('raw', fileKey);
     return {
-        ciphertext: result.ciphertext,
-        iv: result.iv,
-        encryptedKey: JSON.stringify({ encryptedKey: result.encryptedKey, keyIv: result.keyIv }),
+        ciphertext: Buffer.from(ciphertext),
+        iv: toBase64(iv.buffer),
+        deviceKeyMap: await wrapForDevices(rawFileKey, cachedKeyPair.privateKey, recipients),
     };
 };
-exports.encryptFileForSelf = encryptFileForSelf;
+exports.encryptFileForDevices = encryptFileForDevices;

package/dist/e2e-fallback.d.ts

@@ -1,3 +1,15 @@
+import { type ZephApiClient } from './api-client.js';
+import { type DeviceRecipient } from './crypto.js';
+/**
+ * Resolve who a push can be encrypted for, or null when it cannot be.
+ *
+ * The device list is fetched per send rather than cached: a phone that
+ * registered its key a minute ago must be able to read the next push, and a
+ * long-lived MCP process would otherwise keep wrapping for a stale set.
+ * A failure here is not fatal — plaintext the user can read beats a
+ * notification that never arrives.
+ */
+export declare const resolveRecipients: (client: ZephApiClient) => Promise<DeviceRecipient[] | null>;
 /**
  * Run a send, and repeat it unencrypted if the server says E2E needs Pro.
  *
@@ -9,10 +21,11 @@
  * retry rebuilds the whole payload (a file re-uploads as plaintext instead of
  * leaving an undecryptable blob in S3).
  *
- * `send` receives whether it may encrypt, and must be safe to run twice — the
- * encrypted first upload is left orphaned in S3, which is the accepted cost of
- * not shipping an unreadable attachment. The retry is not itself retried: a
- * second `PRO_REQUIRED` propagates.
+ * `send` receives the recipient devices, or null when the push must go out in
+ * the clear, and must be safe to run twice — the encrypted first upload is
+ * left orphaned in S3, which is the accepted cost of not shipping an
+ * unreadable attachment. The retry is not itself retried: a second
+ * `PRO_REQUIRED` propagates.
  */
-export declare const withPlaintextFallback: <T>(send: (canEncrypt: boolean) => Promise<T>) => Promise<T>;
+export declare const withPlaintextFallback: <T>(client: ZephApiClient, send: (recipients: DeviceRecipient[] | null) => Promise<T>) => Promise<T>;
 //# sourceMappingURL=e2e-fallback.d.ts.map

package/dist/e2e-fallback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"e2e-fallback.d.ts","sourceRoot":"","sources":["../src/e2e-fallback.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,qBAAqB,GAAU,CAAC,EAC3C,MAAM,CAAC,UAAU,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,KACxC,OAAO,CAAC,CAAC,CAYX,CAAC"}
+{"version":3,"file":"e2e-fallback.d.ts","sourceRoot":"","sources":["../src/e2e-fallback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAA6D,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9G;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,GAAU,QAAQ,aAAa,KAAG,OAAO,CAAC,eAAe,EAAE,GAAG,IAAI,CAa/F,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,qBAAqB,GAAU,CAAC,EAC3C,QAAQ,aAAa,EACrB,MAAM,CAAC,UAAU,EAAE,eAAe,EAAE,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KACzD,OAAO,CAAC,CAAC,CAYX,CAAC"}

package/dist/e2e-fallback.js

@@ -1,8 +1,34 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.withPlaintextFallback = void 0;
+exports.withPlaintextFallback = exports.resolveRecipients = void 0;
 const api_client_js_1 = require("./api-client.js");
 const crypto_js_1 = require("./crypto.js");
+/**
+ * Resolve who a push can be encrypted for, or null when it cannot be.
+ *
+ * The device list is fetched per send rather than cached: a phone that
+ * registered its key a minute ago must be able to read the next push, and a
+ * long-lived MCP process would otherwise keep wrapping for a stale set.
+ * A failure here is not fatal — plaintext the user can read beats a
+ * notification that never arrives.
+ */
+const resolveRecipients = async (client) => {
+    if (!(0, crypto_js_1.getKeyPair)() || !(0, crypto_js_1.getPublicKey)())
+        return null;
+    try {
+        const recipients = (0, crypto_js_1.selectRecipients)((await client.listDevices()).data);
+        if (recipients.length === 0) {
+            console.error('[Crypto] No device has a per-device public key — sending plaintext.');
+            return null;
+        }
+        return recipients;
+    }
+    catch (err) {
+        console.error('[Crypto] Could not list devices, sending plaintext:', err);
+        return null;
+    }
+};
+exports.resolveRecipients = resolveRecipients;
 /**
  * Run a send, and repeat it unencrypted if the server says E2E needs Pro.
  *
@@ -14,24 +40,25 @@ const crypto_js_1 = require("./crypto.js");
  * retry rebuilds the whole payload (a file re-uploads as plaintext instead of
  * leaving an undecryptable blob in S3).
  *
- * `send` receives whether it may encrypt, and must be safe to run twice — the
- * encrypted first upload is left orphaned in S3, which is the accepted cost of
- * not shipping an unreadable attachment. The retry is not itself retried: a
- * second `PRO_REQUIRED` propagates.
+ * `send` receives the recipient devices, or null when the push must go out in
+ * the clear, and must be safe to run twice — the encrypted first upload is
+ * left orphaned in S3, which is the accepted cost of not shipping an
+ * unreadable attachment. The retry is not itself retried: a second
+ * `PRO_REQUIRED` propagates.
  */
-const withPlaintextFallback = async (send) => {
-    const canEncrypt = !!(0, crypto_js_1.getKeyPair)() && !!(0, crypto_js_1.getPublicKey)();
-    if (!canEncrypt)
-        return send(false);
+const withPlaintextFallback = async (client, send) => {
+    const recipients = await (0, exports.resolveRecipients)(client);
+    if (!recipients)
+        return send(null);
     try {
-        return await send(true);
+        return await send(recipients);
     }
     catch (err) {
         if (!(err instanceof api_client_js_1.ApiError) || err.code !== 'PRO_REQUIRED')
             throw err;
         (0, crypto_js_1.disableCrypto)();
         console.error('[Crypto] End-to-end encryption requires Zeph Pro — resending as plaintext.');
-        return send(false);
+        return send(null);
     }
 };
 exports.withPlaintextFallback = withPlaintextFallback;

package/dist/index.js

@@ -77,10 +77,15 @@ const createServer = (config) => {
 };
 const main = async () => {
     const config = (0, config_js_1.loadConfig)();
-    // Initialize E2E encryption keys (sync with server)
+    // Load or create this host's keypair, if the account has opted in. Runs once
+    // per process and caches, so toggling E2E in the app while this server is
+    // running has no effect until it restarts.
     try {
         const publicKey = await (0, crypto_js_1.initCrypto)(config.apiKey, config.baseUrl);
-        console.error(`[Crypto] E2E encryption ready (publicKey: ${publicKey.slice(0, 20)}...)`);
+        if (publicKey)
+            console.error(`[Crypto] E2E encryption ready for zeph_notify / zeph_file (publicKey: ${publicKey.slice(0, 20)}...) — zeph_ask stays plaintext`);
+        else
+            console.error('[Crypto] E2E encryption off — enable it in the Zeph app, then restart this server.');
     }
     catch (err) {
         console.error('[Crypto] E2E encryption unavailable:', err);

package/dist/response-files.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Saving the files a user attached to a hook answer.
+ *
+ * `zeph_ask` and `zeph_input` hand the agent a JSON result, and an agent
+ * cannot look at an S3 key — so an answered screenshot only becomes useful
+ * once it is a path on this machine. This module downloads each attachment
+ * to `~/.zeph/attachments/hook-<eventId>/` and returns the absolute paths,
+ * which the tool then names in its result for the agent to read.
+ *
+ * The files are plaintext by contract: the hook route carries no sender key,
+ * so the server rejects an encrypted attachment on a response rather than
+ * let one arrive here as bytes nothing can open.
+ *
+ * Failure is per file, never fatal. A question that was answered has been
+ * answered; losing one image must not turn that into a tool error and make
+ * the user answer again.
+ */
+import type { ZephApiClient } from './api-client.js';
+import type { AttachedFile } from './types.js';
+/**
+ * The part of a tool result that tells the agent about saved attachments.
+ * Spread into the result object; empty when nothing was attached, so a plain
+ * answer keeps the shape it has always had.
+ *
+ * The instruction is explicit because a bare list of paths in a JSON result
+ * reads as metadata — the agent has to be told these are the user's answer
+ * and that opening them is part of reading it.
+ */
+export declare const attachmentNote: (paths: string[]) => Record<string, unknown>;
+export interface SaveResponseFilesDeps {
+    /** Test seam for the two-step fetch (metadata → presigned URL → bytes). */
+    fetchBytes?: (fileKey: string) => Promise<Uint8Array>;
+    dir?: string;
+}
+export declare const saveResponseFiles: (client: ZephApiClient, eventId: string, files: AttachedFile[] | undefined, deps?: SaveResponseFilesDeps) => Promise<string[]>;
+//# sourceMappingURL=response-files.d.ts.map

package/dist/response-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"response-files.d.ts","sourceRoot":"","sources":["../src/response-files.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAmB/C;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,EAAE,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAM/D,CAAC;AAET,MAAM,WAAW,qBAAqB;IACpC,2EAA2E;IAC3E,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACtD,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,eAAO,MAAM,iBAAiB,GAC5B,QAAQ,aAAa,EACrB,SAAS,MAAM,EACf,OAAO,YAAY,EAAE,GAAG,SAAS,EACjC,OAAM,qBAA0B,KAC/B,OAAO,CAAC,MAAM,EAAE,CAiBlB,CAAC"}