@zeph-to/mcp-server 1.16.0 → 2.1.0

package/dist/response-files.js

@@ -0,0 +1,75 @@
+"use strict";
+/**
+ * Saving the files a user attached to a hook answer.
+ *
+ * `zeph_ask` and `zeph_input` hand the agent a JSON result, and an agent
+ * cannot look at an S3 key — so an answered screenshot only becomes useful
+ * once it is a path on this machine. This module downloads each attachment
+ * to `~/.zeph/attachments/hook-<eventId>/` and returns the absolute paths,
+ * which the tool then names in its result for the agent to read.
+ *
+ * The files are plaintext by contract: the hook route carries no sender key,
+ * so the server rejects an encrypted attachment on a response rather than
+ * let one arrive here as bytes nothing can open.
+ *
+ * Failure is per file, never fatal. A question that was answered has been
+ * answered; losing one image must not turn that into a tool error and make
+ * the user answer again.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.saveResponseFiles = exports.attachmentNote = void 0;
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+/** Shared with the `zeph listener` daemon, which writes push attachments here. */
+const ATTACHMENTS_DIR = (0, node_path_1.join)((0, node_os_1.homedir)(), '.zeph', 'attachments');
+/**
+ * Make a filesystem-safe single path segment: take the basename (drops any
+ * `../` prefix), strip control characters and embedded separators, remove
+ * leading dots, and cap the length. Empty or dot-only names use the fallback.
+ */
+const safeSegment = (raw, fallback) => {
+    const cleaned = (0, node_path_1.basename)(raw)
+        .replace(/[\x00-\x1f\x7f]/g, '')
+        .replace(/[/\\]/g, '_')
+        .replace(/^\.+/, '')
+        .trim();
+    return (cleaned || fallback).slice(0, 200);
+};
+/**
+ * The part of a tool result that tells the agent about saved attachments.
+ * Spread into the result object; empty when nothing was attached, so a plain
+ * answer keeps the shape it has always had.
+ *
+ * The instruction is explicit because a bare list of paths in a JSON result
+ * reads as metadata — the agent has to be told these are the user's answer
+ * and that opening them is part of reading it.
+ */
+const attachmentNote = (paths) => paths.length
+    ? {
+        attachments: paths,
+        attachmentsNote: `The user attached ${paths.length} file(s) to this answer. Read each path above to see them.`,
+    }
+    : {};
+exports.attachmentNote = attachmentNote;
+const saveResponseFiles = async (client, eventId, files, deps = {}) => {
+    if (!files?.length)
+        return [];
+    const fetchBytes = deps.fetchBytes ?? ((key) => client.downloadFile(key));
+    const dir = (0, node_path_1.join)(deps.dir ?? ATTACHMENTS_DIR, safeSegment(`hook-${eventId}`, 'hook'));
+    const paths = [];
+    for (const [i, file] of files.entries()) {
+        try {
+            const bytes = await fetchBytes(file.fileKey);
+            (0, node_fs_1.mkdirSync)(dir, { recursive: true });
+            const abs = (0, node_path_1.join)(dir, safeSegment(file.fileName || `file-${i}`, `file-${i}`));
+            (0, node_fs_1.writeFileSync)(abs, bytes);
+            paths.push(abs);
+        }
+        catch (err) {
+            console.error(`[zeph] attachment "${file.fileName}" failed to save: ${err.message}`);
+        }
+    }
+    return paths;
+};
+exports.saveResponseFiles = saveResponseFiles;

package/dist/tools/ask.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ask.d.ts","sourceRoot":"","sources":["../../src/tools/ask.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAItD,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAwBxD,eAAO,MAAM,eAAe,GAAI,QAAQ,SAAS,EAAE,QAAQ,aAAa,EAAE,QAAQ,eAAe,EAAE,SAAS,kBAAkB,SAmI7H,CAAC"}
+{"version":3,"file":"ask.d.ts","sourceRoot":"","sources":["../../src/tools/ask.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAItD,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAwBxD,eAAO,MAAM,eAAe,GAAI,QAAQ,SAAS,EAAE,QAAQ,aAAa,EAAE,QAAQ,eAAe,EAAE,SAAS,kBAAkB,SA+H7H,CAAC"}

package/dist/tools/ask.js

@@ -5,9 +5,9 @@ const zod_1 = require("zod");
 const error_format_js_1 = require("../error-format.js");
 const poll_js_1 = require("../poll.js");
 const config_js_1 = require("../config.js");
-const crypto_js_1 = require("../crypto.js");
 const mime_js_1 = require("../mime.js");
 const sanitize_js_1 = require("../sanitize.js");
+const response_files_js_1 = require("../response-files.js");
 // The device feed shows a short preview of the body. Anything longer than
 // this gets truncated there, so we attach the full text as a file — the
 // user can always open the complete content instead of squinting at a
@@ -23,7 +23,7 @@ const buildAskMarkdown = (title, body, actions) => {
 };
 const registerAskTool = (server, client, config, waiter) => {
     server.registerTool('zeph_ask', {
-        description: 'Ask the user a question with optional quick-reply buttons and a text input field. Combines prompt (buttons) and input (text) in a single notification. The user can either tap a button or type a response. Blocks until the user responds or the timeout is reached. Requires ZEPH_HOOK_ID environment variable.',
+        description: 'Ask the user a question with optional quick-reply buttons and a text input field. Combines prompt (buttons) and input (text) in a single notification. The user can either tap a button or type a response. Blocks until the user responds or the timeout is reached. Requires ZEPH_HOOK_ID environment variable. The user may also attach screenshots or files to the answer: those arrive as local absolute paths in the `attachments` field of the result, and reading them is part of reading the answer. NOTE: unlike zeph_notify and zeph_file, this tool is never end-to-end encrypted — the hook route it uses cannot carry the sender key — so do not put secrets in the question or expect a private answer.',
         annotations: {
             readOnlyHint: false,
             destructiveHint: false,
@@ -77,30 +77,21 @@ const registerAskTool = (server, client, config, waiter) => {
             if (exceedsPreview && cleanBody) {
                 const fileName = 'response.md';
                 const fileType = (0, mime_js_1.inferMimeType)(fileName);
-                const canEncrypt = !!(0, crypto_js_1.getKeyPair)() && !!(0, crypto_js_1.getPublicKey)();
                 // Self-contained Markdown so the file alone tells the whole story.
                 const fileMarkdown = buildAskMarkdown(title, cleanBody, effectiveActions);
                 const fileBytes = new TextEncoder().encode(fileMarkdown).byteLength;
-                let uploadContent = fileMarkdown;
-                let uploadContentType = fileType;
-                let fileIv;
-                let fileEncryptedKey;
-                if (canEncrypt) {
-                    try {
-                        const encrypted = await (0, crypto_js_1.encryptFileForSelf)(fileMarkdown);
-                        uploadContent = encrypted.ciphertext;
-                        uploadContentType = 'application/octet-stream';
-                        fileIv = encrypted.iv;
-                        fileEncryptedKey = encrypted.encryptedKey;
-                    }
-                    catch (err) {
-                        console.error('[Crypto] File encryption failed, sending plaintext:', err);
-                    }
-                }
-                const upload = await client.requestUpload({ fileName, fileType: uploadContentType, fileSize: typeof uploadContent === 'string' ? fileBytes : uploadContent.length });
-                await client.uploadToS3(upload.data.uploadUrl, uploadContent, uploadContentType);
+                // Deliberately NOT encrypted, unlike zeph_notify / zeph_file.
+                //
+                // This attachment rides `POST /hooks/:id/trigger`, which creates a
+                // plaintext push: it neither accepts nor persists `isEncrypted` or
+                // `senderPublicKey` (apps/server/src/functions/hooks.ts). Clients
+                // gate decryption on both, so an encrypted attachment here would be
+                // downloaded as raw ciphertext named response.md. Encrypting this
+                // path needs the hook route to carry the sender key first.
+                const upload = await client.requestUpload({ fileName, fileType, fileSize: fileBytes });
+                await client.uploadToS3(upload.data.uploadUrl, fileMarkdown, fileType);
                 triggerBody = cleanBody.slice(0, PREVIEW_LENGTH) + '...';
-                files = [{ fileKey: upload.data.fileKey, fileName, fileSize: fileBytes, fileType, iv: fileIv, encryptedKey: fileEncryptedKey }];
+                files = [{ fileKey: upload.data.fileKey, fileName, fileSize: fileBytes, fileType }];
             }
             const trigger = await client.triggerHook(config.hookId, {
                 title: pushTitle,
@@ -122,9 +113,14 @@ const registerAskTool = (server, client, config, waiter) => {
                 return (0, error_format_js_1.timeoutError)(timeout, 'Try again or use zeph_notify for one-way communication');
             }
             const response = event.data.response;
-            if (response?.actionId)
-                return (0, error_format_js_1.textResult)({ actionId: response.actionId, timedOut: false });
-            return (0, error_format_js_1.textResult)({ value: response?.value ?? '', timedOut: false });
+            // Saved before the button branch returns: a user can tap a quick reply
+            // AND attach a screenshot, and dropping the files there would lose them
+            // silently for the one caller that never looks at `value`.
+            const attachments = await (0, response_files_js_1.saveResponseFiles)(client, trigger.data.eventId, response?.files);
+            if (response?.actionId) {
+                return (0, error_format_js_1.textResult)({ actionId: response.actionId, timedOut: false, ...(0, response_files_js_1.attachmentNote)(attachments) });
+            }
+            return (0, error_format_js_1.textResult)({ value: response?.value ?? '', timedOut: false, ...(0, response_files_js_1.attachmentNote)(attachments) });
         }
         catch (err) {
             return (0, error_format_js_1.formatToolError)(err);

package/dist/tools/file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file.d.ts","sourceRoot":"","sources":["../../src/tools/file.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AA4BrE,eAAO,MAAM,gBAAgB,GAAI,QAAQ,SAAS,EAAE,QAAQ,aAAa,EAAE,QAAQ,eAAe,SAoHjG,CAAC"}
+{"version":3,"file":"file.d.ts","sourceRoot":"","sources":["../../src/tools/file.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AA4BrE,eAAO,MAAM,gBAAgB,GAAI,QAAQ,SAAS,EAAE,QAAQ,aAAa,EAAE,QAAQ,eAAe,SAmIjG,CAAC"}

package/dist/tools/file.js

@@ -81,53 +81,65 @@ const registerFileTool = (server, client, config) => {
         // Runs a second time as plaintext if the server refuses E2E (Pro-only,
         // ADR-0008). The retry re-uploads the file unencrypted, so the whole
         // upload-then-send sequence has to sit inside this closure.
-        const send = async (canEncrypt) => {
-            let fileType = (0, mime_js_1.inferMimeType)(fileName);
-            // Step 1: Optionally encrypt file content
-            let uploadContent = body;
-            let uploadSize = originalSize;
-            let fileIv;
-            let fileEncryptedKey;
-            if (canEncrypt) {
+        const send = async (recipients) => {
+            const pushTitle = (0, config_js_1.formatPushTitle)(config.projectName, title ?? fileName);
+            // Step 1: Encrypt the attachment and the push body together, before
+            // anything is uploaded. Doing them one at a time around the upload let
+            // a failure land in between and ship ciphertext under a push with no
+            // `isEncrypted` — an attachment no client would even try to open.
+            let encrypted = null;
+            if (recipients) {
                 try {
-                    const encrypted = await (0, crypto_js_1.encryptFileForSelf)(body);
-                    uploadContent = encrypted.ciphertext;
-                    uploadSize = encrypted.ciphertext.length;
-                    fileType = 'application/octet-stream';
-                    fileIv = encrypted.iv;
-                    fileEncryptedKey = encrypted.encryptedKey;
+                    encrypted = {
+                        file: await (0, crypto_js_1.encryptFileForDevices)(body, recipients),
+                        push: await (0, crypto_js_1.encryptPushBodyForDevices)({ title: pushTitle }, recipients),
+                    };
                 }
                 catch (err) {
-                    console.error('[Crypto] File encryption failed, sending plaintext:', err);
+                    console.error('[Crypto] Encryption failed, sending plaintext:', err);
                 }
             }
+            const uploadContent = encrypted?.file.ciphertext ?? body;
+            const uploadType = encrypted ? 'application/octet-stream' : (0, mime_js_1.inferMimeType)(fileName);
+            const uploadSize = encrypted ? encrypted.file.ciphertext.length : originalSize;
             // Step 2: Request upload URL
-            const upload = await client.requestUpload({ fileName, fileType, fileSize: uploadSize });
+            const upload = await client.requestUpload({ fileName, fileType: uploadType, fileSize: uploadSize });
             // Step 3: Upload content to S3
-            await client.uploadToS3(upload.data.uploadUrl, uploadContent, fileType);
-            // Step 4: Send file push (encrypt push body if possible)
-            const pushTitle = (0, config_js_1.formatPushTitle)(config.projectName, title ?? fileName);
-            let pushPayload = {
-                title: pushTitle,
+            await client.uploadToS3(upload.data.uploadUrl, uploadContent, uploadType);
+            // Step 4: Send the push. `fileType` on the descriptor stays the real
+            // type — it drives how the client renders the decrypted bytes.
+            const pushPayload = {
+                title: encrypted ? undefined : pushTitle,
                 type: 'file',
-                files: [{ fileKey: upload.data.fileKey, fileName, fileSize: originalSize, fileType: (0, mime_js_1.inferMimeType)(fileName), iv: fileIv, encryptedKey: fileEncryptedKey }],
+                files: [{
+                        fileKey: upload.data.fileKey,
+                        fileName,
+                        fileSize: originalSize,
+                        fileType: (0, mime_js_1.inferMimeType)(fileName),
+                        iv: encrypted?.file.iv,
+                        deviceKeyMap: encrypted?.file.deviceKeyMap,
+                    }],
                 targetDeviceId: targetDeviceId ?? config.deviceId,
                 sessionId: config.sessionId,
+                ...(encrypted && {
+                    body: encrypted.push.body,
+                    isEncrypted: encrypted.push.isEncrypted,
+                    deviceKeyMap: encrypted.push.deviceKeyMap,
+                    senderPublicKey: encrypted.push.senderPublicKey,
+                }),
             };
-            if (canEncrypt) {
-                try {
-                    const enc = await (0, crypto_js_1.encryptPushBodyForSelf)({ title: pushTitle });
-                    pushPayload = { ...pushPayload, title: undefined, body: enc.body, isEncrypted: enc.isEncrypted, encryptedKey: enc.encryptedKey, senderPublicKey: enc.senderPublicKey };
-                }
-                catch (err) {
-                    console.error('[Crypto] Push encryption failed, sending plaintext:', err);
-                }
-            }
             const result = await client.sendPush(pushPayload);
-            return (0, error_format_js_1.textResult)({ pushId: result.data.pushId, fileKey: upload.data.fileKey, fileSize: originalSize, encrypted: canEncrypt });
+            // Report what actually went out — an encryption failure above falls
+            // back to plaintext, so the recipient list alone would over-claim.
+            return (0, error_format_js_1.textResult)({
+                pushId: result.data.pushId,
+                fileKey: upload.data.fileKey,
+                fileSize: originalSize,
+                encrypted: !!encrypted,
+            });
         };
         try {
-            return await (0, e2e_fallback_js_1.withPlaintextFallback)(send);
+            return await (0, e2e_fallback_js_1.withPlaintextFallback)(client, send);
         }
         catch (err) {
             return (0, error_format_js_1.formatToolError)(err);

package/dist/tools/input.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"input.d.ts","sourceRoot":"","sources":["../../src/tools/input.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGtD,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AAErE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,eAAO,MAAM,iBAAiB,GAAI,QAAQ,SAAS,EAAE,QAAQ,aAAa,EAAE,QAAQ,eAAe,EAAE,SAAS,kBAAkB,SA2D/H,CAAC"}
+{"version":3,"file":"input.d.ts","sourceRoot":"","sources":["../../src/tools/input.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGtD,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AAGrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD,eAAO,MAAM,iBAAiB,GAAI,QAAQ,SAAS,EAAE,QAAQ,aAAa,EAAE,QAAQ,eAAe,EAAE,SAAS,kBAAkB,SAgE/H,CAAC"}

package/dist/tools/input.js

@@ -6,9 +6,10 @@ const error_format_js_1 = require("../error-format.js");
 const poll_js_1 = require("../poll.js");
 const config_js_1 = require("../config.js");
 const sanitize_js_1 = require("../sanitize.js");
+const response_files_js_1 = require("../response-files.js");
 const registerInputTool = (server, client, config, waiter) => {
     server.registerTool('zeph_input', {
-        description: 'Request text input from the user via push notification. The tool blocks until the user responds or the timeout is reached. Requires ZEPH_HOOK_ID environment variable.',
+        description: 'Request text input from the user via push notification. The tool blocks until the user responds or the timeout is reached. Requires ZEPH_HOOK_ID environment variable. The user may also attach screenshots or files: those arrive as local absolute paths in the `attachments` field of the result, and reading them is part of reading the answer.',
         annotations: {
             readOnlyHint: false,
             destructiveHint: false,
@@ -46,7 +47,12 @@ const registerInputTool = (server, client, config, waiter) => {
             const event = await (0, poll_js_1.pollForResponse)(client, config.hookId, trigger.data.eventId, timeout, ctx, waiter);
             if (!event)
                 return (0, error_format_js_1.timeoutError)(timeout, 'Try again with a longer timeout');
-            return (0, error_format_js_1.textResult)({ value: event.data.response?.value ?? '', timedOut: false });
+            const attachments = await (0, response_files_js_1.saveResponseFiles)(client, trigger.data.eventId, event.data.response?.files);
+            return (0, error_format_js_1.textResult)({
+                value: event.data.response?.value ?? '',
+                timedOut: false,
+                ...(0, response_files_js_1.attachmentNote)(attachments),
+            });
         }
         catch (err) {
             return (0, error_format_js_1.formatToolError)(err);

package/dist/tools/notify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"notify.d.ts","sourceRoot":"","sources":["../../src/tools/notify.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AAUrE,eAAO,MAAM,kBAAkB,GAAI,QAAQ,SAAS,EAAE,QAAQ,aAAa,EAAE,QAAQ,eAAe,SAgInG,CAAC"}
+{"version":3,"file":"notify.d.ts","sourceRoot":"","sources":["../../src/tools/notify.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AAUrE,eAAO,MAAM,kBAAkB,GAAI,QAAQ,SAAS,EAAE,QAAQ,aAAa,EAAE,QAAQ,eAAe,SAuInG,CAAC"}

package/dist/tools/notify.js

@@ -32,7 +32,7 @@ const registerNotifyTool = (server, client, config) => {
     }, async ({ title, body, url, priority, targetDeviceId }) => {
         // Runs a second time as plaintext if the server refuses E2E (Pro-only,
         // ADR-0008) — hence everything after the encryption decision lives here.
-        const send = async (canEncrypt) => {
+        const send = async (recipients) => {
             const deviceId = targetDeviceId ?? config.deviceId;
             const pushTitle = (0, config_js_1.formatPushTitle)(config.projectName, title);
             // Strip any tool-call markup that leaked into the body argument.
@@ -45,70 +45,74 @@ const registerNotifyTool = (server, client, config) => {
                 // Self-contained Markdown so the file alone carries the full text.
                 const fileMarkdown = `# ${title}\n\n${cleanBody}`;
                 const fileBytes = new TextEncoder().encode(fileMarkdown).byteLength;
-                // Encrypt file content if keys available
-                let uploadContent = fileMarkdown;
-                let uploadContentType = fileType;
-                let fileIv;
-                let fileEncryptedKey;
-                let fileEncrypted = false;
-                if (canEncrypt) {
+                const preview = cleanBody.slice(0, PREVIEW_LENGTH) + '...';
+                // Encrypt the attachment and the push body together, before anything
+                // is uploaded. Doing them one at a time around the upload let a
+                // failure land in between and ship ciphertext under a push with no
+                // `isEncrypted` — an attachment no client would even try to open.
+                let encrypted = null;
+                if (recipients) {
                     try {
-                        const encrypted = await (0, crypto_js_1.encryptFileForSelf)(fileMarkdown);
-                        uploadContent = encrypted.ciphertext;
-                        uploadContentType = 'application/octet-stream';
-                        fileIv = encrypted.iv;
-                        fileEncryptedKey = encrypted.encryptedKey;
-                        fileEncrypted = true;
+                        encrypted = {
+                            file: await (0, crypto_js_1.encryptFileForDevices)(fileMarkdown, recipients),
+                            push: await (0, crypto_js_1.encryptPushBodyForDevices)({ title: pushTitle, body: preview, url }, recipients),
+                        };
                     }
                     catch (err) {
-                        console.error('[Crypto] File encryption failed, sending plaintext:', err);
+                        console.error('[Crypto] Encryption failed, sending plaintext:', err);
                     }
                 }
+                const uploadContent = encrypted?.file.ciphertext ?? fileMarkdown;
+                const uploadContentType = encrypted ? 'application/octet-stream' : fileType;
                 const upload = await client.requestUpload({ fileName, fileType: uploadContentType, fileSize: typeof uploadContent === 'string' ? fileBytes : uploadContent.length });
                 await client.uploadToS3(upload.data.uploadUrl, uploadContent, uploadContentType);
-                const preview = cleanBody.slice(0, PREVIEW_LENGTH) + '...';
-                // Encrypt push body (title/preview/url) if keys available
-                let pushPayload = {
-                    title: pushTitle,
-                    body: preview,
-                    url,
+                const pushPayload = {
+                    title: encrypted ? undefined : pushTitle,
+                    body: encrypted ? encrypted.push.body : preview,
+                    // Dropped alongside the title when encrypted: the url is already
+                    // sealed inside the ciphertext, and for a link push it is the whole
+                    // payload. Leaving the plaintext copy here would hand the server the
+                    // one thing `isEncrypted` promises it cannot see.
+                    url: encrypted ? undefined : url,
                     type: 'file',
                     priority,
-                    files: [{ fileKey: upload.data.fileKey, fileName, fileSize: fileBytes, fileType, iv: fileIv, encryptedKey: fileEncryptedKey }],
+                    files: [{
+                            fileKey: upload.data.fileKey,
+                            fileName,
+                            fileSize: fileBytes,
+                            fileType,
+                            iv: encrypted?.file.iv,
+                            deviceKeyMap: encrypted?.file.deviceKeyMap,
+                        }],
                     targetDeviceId: deviceId,
                     sessionId: config.sessionId,
+                    ...(encrypted && {
+                        isEncrypted: encrypted.push.isEncrypted,
+                        deviceKeyMap: encrypted.push.deviceKeyMap,
+                        senderPublicKey: encrypted.push.senderPublicKey,
+                    }),
                 };
-                let pushEncrypted = false;
-                if (canEncrypt) {
-                    try {
-                        const enc = await (0, crypto_js_1.encryptPushBodyForSelf)({ title: pushTitle, body: preview, url });
-                        pushPayload = { ...pushPayload, title: undefined, body: enc.body, isEncrypted: enc.isEncrypted, encryptedKey: enc.encryptedKey, senderPublicKey: enc.senderPublicKey };
-                        pushEncrypted = true;
-                    }
-                    catch (err) {
-                        console.error('[Crypto] Push encryption failed, sending plaintext:', err);
-                    }
-                }
                 const result = await client.sendPush(pushPayload);
                 // Report what actually went out — an encryption failure above falls
-                // back to plaintext, so `canEncrypt` alone would over-claim.
-                return (0, error_format_js_1.textResult)({ pushId: result.data.pushId, fileKey: upload.data.fileKey, autoFile: true, encrypted: fileEncrypted && pushEncrypted });
+                // back to plaintext, so the recipient list alone would over-claim.
+                return (0, error_format_js_1.textResult)({ pushId: result.data.pushId, fileKey: upload.data.fileKey, autoFile: true, encrypted: !!encrypted });
             }
             // Short body — encrypt push only
             let pushPayload = {
                 title: pushTitle,
                 body: cleanBody,
-                url,
+                url, // replaced below when the encrypted envelope takes over
                 type: 'hook',
                 priority,
                 targetDeviceId: deviceId,
                 sessionId: config.sessionId,
             };
             let pushEncrypted = false;
-            if (canEncrypt) {
+            if (recipients) {
                 try {
-                    const enc = await (0, crypto_js_1.encryptPushBodyForSelf)({ title: pushTitle, body: cleanBody, url });
-                    pushPayload = { ...pushPayload, title: undefined, body: enc.body, isEncrypted: enc.isEncrypted, encryptedKey: enc.encryptedKey, senderPublicKey: enc.senderPublicKey };
+                    const enc = await (0, crypto_js_1.encryptPushBodyForDevices)({ title: pushTitle, body: cleanBody, url }, recipients);
+                    // `url: undefined` for the same reason as `title` — see the file branch.
+                    pushPayload = { ...pushPayload, title: undefined, url: undefined, body: enc.body, isEncrypted: enc.isEncrypted, deviceKeyMap: enc.deviceKeyMap, senderPublicKey: enc.senderPublicKey };
                     pushEncrypted = true;
                 }
                 catch (err) {
@@ -119,7 +123,7 @@ const registerNotifyTool = (server, client, config) => {
             return (0, error_format_js_1.textResult)({ pushId: result.data.pushId, encrypted: pushEncrypted });
         };
         try {
-            return await (0, e2e_fallback_js_1.withPlaintextFallback)(send);
+            return await (0, e2e_fallback_js_1.withPlaintextFallback)(client, send);
         }
         catch (err) {
             return (0, error_format_js_1.formatToolError)(err);

package/dist/types.d.ts

@@ -23,6 +23,9 @@ export interface HookEventResponse {
         response?: {
             actionId?: string;
             value?: string;
+            /** Screenshots and files the user attached to the answer — plaintext,
+             *  since the hook route carries no key this end could decrypt with. */
+            files?: AttachedFile[];
             respondedDeviceId?: string;
         };
     };
@@ -89,13 +92,24 @@ export interface UploadRequestResponse {
         uploadUrl: string;
     };
 }
+export interface DownloadUrlResponse {
+    data: {
+        downloadUrl: string;
+    };
+}
 export interface AttachedFile {
     fileKey: string;
     fileName: string;
     fileSize: number;
     fileType: string;
     iv?: string;
-    encryptedKey?: string;
+    /**
+     * E2E: the file AES key wrapped once per recipient device, keyed by
+     * `deviceId`. Each value is a JSON string `{ encryptedKey, keyIv }`.
+     * (The superseded account-wide `encryptedKey` field is not written here —
+     * nothing can unwrap it since key escrow was removed.)
+     */
+    deviceKeyMap?: Record<string, string>;
 }
 export interface ToolError {
     error: string;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE;QACJ,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE;QACJ,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE;QACJ,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,WAAW,GAAG,WAAW,CAAC;QAC5D,QAAQ,CAAC,EAAE;YACT,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;SAC5B,CAAC;KACH,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,YAAY,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,YAAY,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,UAAU,EAAE;QACV,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE;QACJ,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC;QAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,aAAa,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE;QACJ,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE;QACJ,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE;QACJ,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE;QACJ,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,WAAW,GAAG,WAAW,CAAC;QAC5D,QAAQ,CAAC,EAAE;YACT,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,KAAK,CAAC,EAAE,MAAM,CAAC;YACf;mFACuE;YACvE,KAAK,CAAC,EAAE,YAAY,EAAE,CAAC;YACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;SAC5B,CAAC;KACH,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,YAAY,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,YAAY,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,UAAU,EAAE;QACV,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE;QACJ,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC;QAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,aAAa,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE;QACJ,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE;QACJ,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zeph-to/mcp-server",
-  "version": "1.16.0",
+  "version": "2.1.0",
   "description": "Zeph MCP server — AI agent notifications, prompts, and input via MCP protocol",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",