zooid 0.12.0 → 0.13.0

package/dist/bin.js

@@ -16,17 +16,17 @@ import {
   renderRegistration,
   startDaemonSocketServer,
   startWorkforcePublisher
-} from "./chunk-3Q4BPAZD.js";
+} from "./chunk-YZ4IO5MR.js";
 
 // src/bin.ts
-import { resolve as resolve6 } from "path";
+import { resolve as resolve7 } from "path";
 import { cac } from "cac";
 
 // src/commands/dev.ts
 import chalk from "chalk";
 import { Listr } from "listr2";
-import { existsSync as existsSync5, readFileSync as readFileSync6 } from "fs";
-import { dirname as dirname6, join as join12, resolve as resolve3 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync7 } from "fs";
+import { dirname as dirname6, join as join13, resolve as resolve3 } from "path";
 import { fileURLToPath } from "url";
 import { serve as serve2 } from "@hono/node-server";
 
@@ -83,6 +83,20 @@ function renderTuwunelToml(opts) {
     "allow_local_presence = true",
     'address = ["0.0.0.0"]',
     `port = [${TUWUNEL_INTERNAL_PORT}]`,
+    // NOT `suppress_push_when_active` ([[ZNC025]]). It reads Matrix presence,
+    // which is both too coarse and too slow for this: coarse because it is
+    // per-user, so reading room A kills the push for room B; slow because
+    // `currently_active` lingers for minutes after the last sync, so closing
+    // the tab and waiting for an agent to finish still delivers nothing —
+    // exactly the case this feature exists for. `public/sw.js` already does
+    // the suppression we actually want, precisely: it drops a push only when
+    // a *visible* window is on *that* room.
+    // DEV ONLY — disables an SSRF guard. Tuwunel is in Podman and the push
+    // gateway runs on the host, so the default ip_range_denylist (127/8,
+    // 10/8, 172.16/12, 192.168/16, ::1) silently drops every pusher delivery.
+    // Never set on a box: there the gateway is reached at the public
+    // hostname through Caddy.
+    "ip_range_denylist = []",
     ""
   ].join("\n");
 }
@@ -201,10 +215,10 @@ MATRIX_HS_TOKEN=${tokens.hsToken}
 }
 
 // src/daemon/start-daemon.ts
-import { readFileSync as readFileSync3 } from "fs";
+import { readFileSync as readFileSync4 } from "fs";
 import { mkdir, unlink } from "fs/promises";
 import { tmpdir } from "os";
-import { dirname as dirname2, isAbsolute, join as join5, resolve } from "path";
+import { dirname as dirname2, isAbsolute, join as join6, resolve } from "path";
 import { serve } from "@hono/node-server";
 
 // ../transport-http/src/server.ts
@@ -479,22 +493,131 @@ var defaultExec = async (cmd, args) => {
   }
 };
 
-// src/daemon/sync-cursors.ts
+// src/push-gateway/gateway.ts
+import { Hono as Hono2 } from "hono";
+import webpush from "web-push";
+
+// src/push-gateway/payload.ts
+var MAX_BODY = 140;
+var ZOOID_APP_ID = "dev.zooid.web";
+function truncate(s, max) {
+  return s.length > max ? s.slice(0, max - 1) + "\u2026" : s;
+}
+function buildPushPayload(n, device) {
+  const body = typeof n.content?.body === "string" ? truncate(n.content.body, MAX_BODY) : void 0;
+  const preview = typeof n.content?.last_message === "string" ? truncate(n.content.last_message, MAX_BODY) : void 0;
+  return {
+    event_id: n.event_id,
+    room_id: n.room_id,
+    room_name: n.room_name ?? n.room_id,
+    ...n.sender_display_name !== void 0 ? { sender_display_name: n.sender_display_name } : {},
+    type: n.type,
+    ...body !== void 0 ? { body } : {},
+    ...preview !== void 0 ? { preview } : {},
+    unread: n.counts?.unread ?? 0,
+    // Whether this makes a noise is a push-rule property the server evaluated,
+    // not a second decision made here (spec §12).
+    sound: device?.tweaks?.sound !== void 0
+  };
+}
+
+// src/push-gateway/gateway.ts
+function parseNotifyBody(raw) {
+  if (!raw || typeof raw !== "object") return null;
+  const notification = raw.notification;
+  if (!notification || typeof notification !== "object") return null;
+  const n = notification;
+  if (typeof n.event_id !== "string" || typeof n.room_id !== "string" || typeof n.type !== "string")
+    return null;
+  if (!Array.isArray(n.devices)) return null;
+  return n;
+}
+function pushGateway(opts) {
+  const app = new Hono2();
+  app.post("/_matrix/push/v1/notify", async (c) => {
+    const parsed = parseNotifyBody(await c.req.json().catch(() => null));
+    if (!parsed) {
+      console.warn("[push] notify: malformed body");
+      return c.json({ error: "malformed notification" }, 400);
+    }
+    console.log(
+      `[push] notify room=${parsed.room_id} type=${parsed.type} devices=${parsed.devices.length}`
+    );
+    let delivered = 0;
+    const rejected = [];
+    await Promise.all(
+      parsed.devices.map(async (device) => {
+        if (device.app_id !== ZOOID_APP_ID) return;
+        const endpoint = device.data?.endpoint;
+        const auth = device.data?.auth;
+        if (typeof endpoint !== "string" || typeof auth !== "string") return;
+        try {
+          await webpush.sendNotification(
+            { endpoint, keys: { p256dh: device.pushkey, auth } },
+            JSON.stringify(buildPushPayload(parsed, device)),
+            {
+              vapidDetails: { subject: opts.subject, ...opts.keys },
+              TTL: 60 * 60 * 12,
+              urgency: device.tweaks?.sound !== void 0 ? "high" : "normal"
+            }
+          );
+          delivered++;
+        } catch (err) {
+          const status = err.statusCode;
+          if (status === 404 || status === 410) rejected.push(device.pushkey);
+          else console.warn(`[push] delivery to ${device.pushkey} failed (${status ?? "?"}):`, err);
+        }
+      })
+    );
+    console.log(`[push] notify done: delivered=${delivered} rejected=${rejected.length}`);
+    return c.json({ rejected });
+  });
+  return app;
+}
+
+// src/push-gateway/vapid.ts
 import { mkdirSync as mkdirSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "fs";
 import { join as join4 } from "path";
+import webpush2 from "web-push";
+var VAPID_FILENAME = "vapid.json";
+function loadOrCreateVapidKeys(dataDir) {
+  const path = join4(dataDir, VAPID_FILENAME);
+  try {
+    const parsed = JSON.parse(readFileSync2(path, "utf8"));
+    if (typeof parsed.publicKey === "string" && typeof parsed.privateKey === "string")
+      return { publicKey: parsed.publicKey, privateKey: parsed.privateKey };
+    console.warn(`[push] ${path} is malformed; generating a new VAPID keypair.`);
+  } catch {
+  }
+  const keys = webpush2.generateVAPIDKeys();
+  mkdirSync3(dataDir, { recursive: true });
+  writeFileSync3(path, JSON.stringify(keys, null, 2), { mode: 384 });
+  return keys;
+}
+
+// src/push-gateway/index.ts
+function mountPushGateway(app, opts) {
+  const keys = loadOrCreateVapidKeys(opts.dataDir);
+  app.route("/", pushGateway({ keys, subject: opts.subject }));
+  return { publicKey: keys.publicKey };
+}
+
+// src/daemon/sync-cursors.ts
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "fs";
+import { join as join5 } from "path";
 function makeSyncCursorStore(agentsDir) {
-  const fileFor = (agentName) => join4(agentsDir, agentName, "sync-since");
+  const fileFor = (agentName) => join5(agentsDir, agentName, "sync-since");
   return {
     loadSince(agentName) {
       try {
-        return readFileSync2(fileFor(agentName), "utf8").trim() || null;
+        return readFileSync3(fileFor(agentName), "utf8").trim() || null;
       } catch {
         return null;
       }
     },
     saveSince(agentName, since) {
-      mkdirSync3(join4(agentsDir, agentName), { recursive: true });
-      writeFileSync3(fileFor(agentName), since, "utf8");
+      mkdirSync4(join5(agentsDir, agentName), { recursive: true });
+      writeFileSync4(fileFor(agentName), since, "utf8");
     }
   };
 }
@@ -506,18 +629,18 @@ function shouldBindHttpListener(mode) {
 
 // src/daemon/start-daemon.ts
 function listenAsync(server) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve8) => {
     const check = () => {
       const addr = server.address();
-      if (addr && typeof addr === "object") resolve7(addr.port);
+      if (addr && typeof addr === "object") resolve8(addr.port);
       else setImmediate(check);
     };
     check();
   });
 }
 function closeAsync(server) {
-  return new Promise((resolve7) => {
-    server.close(() => resolve7());
+  return new Promise((resolve8) => {
+    server.close(() => resolve8());
   });
 }
 async function startDaemon(opts = {}) {
@@ -525,10 +648,10 @@ async function startDaemon(opts = {}) {
   const found = opts.configPath ? { path: opts.configPath } : findConfigFile(cwd);
   if (!found) throw new Error("zooid.yaml is required");
   const configDir = dirname2(found.path);
-  const base = loadZooidConfig(readFileSync3(found.path, "utf8"), { configDir });
+  const base = loadZooidConfig(readFileSync4(found.path, "utf8"), { configDir });
   const config = mergeCliFlags(base, opts.cliFlags ?? {});
   const approvals = new ApprovalCorrelator();
-  const daemonSockPath = opts.agentsDir ? join5(opts.agentsDir, "..", "run", "context.sock") : join5(tmpdir(), `zooid-context-${process.pid}.sock`);
+  const daemonSockPath = opts.agentsDir ? join6(opts.agentsDir, "..", "run", "context.sock") : join6(tmpdir(), `zooid-context-${process.pid}.sock`);
   await mkdir(dirname2(daemonSockPath), { recursive: true }).catch(() => {
   });
   const contextSpawnRegistry = new SpawnRegistry();
@@ -574,6 +697,7 @@ async function startDaemon(opts = {}) {
   });
   const matrix = findMatrixTransport(config);
   let port;
+  let vapidPublicKey;
   if (matrix) {
     const mode = matrix.transport.mode ?? "appservice";
     if (mode === "client" && !opts.agentsDir) {
@@ -629,6 +753,12 @@ async function startDaemon(opts = {}) {
     });
     if (shouldBindHttpListener(mode)) {
       const requestedPort = matrix.transport.port ?? 9e3;
+      if (dataDir) {
+        vapidPublicKey = mountPushGateway(transport.app, {
+          dataDir,
+          subject: `https://${serverName}`
+        }).publicKey;
+      }
       server = serve({ fetch: transport.app.fetch, port: requestedPort, hostname: "0.0.0.0" });
       port = await listenAsync(server);
     } else {
@@ -724,7 +854,7 @@ async function startDaemon(opts = {}) {
     process.on("SIGINT", () => handler("SIGINT"));
     process.on("SIGTERM", () => handler("SIGTERM"));
   }
-  return { port, agentNames, stop, whenStopped };
+  return { port, agentNames, vapidPublicKey, stop, whenStopped };
 }
 
 // src/services/tuwunel.ts
@@ -769,9 +899,24 @@ var TuwunelService = class {
   }
   async stop() {
     if (this.child && this.child.exitCode === null) {
-      this.child.kill("SIGTERM");
-      await new Promise((resolve7) => {
-        this.child.on("exit", () => resolve7());
+      const child = this.child;
+      child.kill("SIGTERM");
+      await new Promise((resolve8) => {
+        let done = false;
+        const finish = () => {
+          if (done) return;
+          done = true;
+          clearTimeout(timer);
+          resolve8();
+        };
+        const timer = setTimeout(() => {
+          try {
+            child.kill("SIGKILL");
+          } catch {
+          }
+          finish();
+        }, 5e3);
+        child.once("exit", finish);
       });
     }
     this.child = null;
@@ -788,7 +933,7 @@ var TuwunelService = class {
           `Tuwunel container exited before serving HTTP (exit=${state.exitCode}${state.error ? `, error=${state.error}` : ""}). Check the engine logs (\`${this.opts.engine} logs ${this.opts.name}\`).`
         );
       }
-      await new Promise((resolve7) => setTimeout(resolve7, 500));
+      await new Promise((resolve8) => setTimeout(resolve8, 500));
     }
     while (Date.now() < deadline) {
       try {
@@ -796,7 +941,7 @@ var TuwunelService = class {
         if (r.ok) return;
       } catch {
       }
-      await new Promise((resolve7) => setTimeout(resolve7, 500));
+      await new Promise((resolve8) => setTimeout(resolve8, 500));
     }
     const finalState = await this.inspectState().catch(() => null);
     const detail = finalState ? ` (container status=${finalState.status}${finalState.exitCode !== void 0 ? `, exit=${finalState.exitCode}` : ""})` : "";
@@ -829,12 +974,12 @@ var TuwunelService = class {
   }
 };
 function execEngine(engine, args) {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve8, reject) => {
     const child = spawn(engine, args, { stdio: "pipe" });
     let stderr = "";
     child.stderr.on("data", (b) => stderr += String(b));
     child.on("exit", (code) => {
-      if (code === 0) resolve7();
+      if (code === 0) resolve8();
       else reject(new Error(`${engine} ${args.join(" ")} failed: ${stderr.trim()}`));
     });
     child.on("error", reject);
@@ -843,18 +988,18 @@ function execEngine(engine, args) {
 
 // src/web/resolve.ts
 import { existsSync as existsSync3 } from "fs";
-import { dirname as dirname3, join as join7, resolve as resolve2 } from "path";
+import { dirname as dirname3, join as join8, resolve as resolve2 } from "path";
 
 // src/web/fetch.ts
-import { mkdirSync as mkdirSync4, renameSync, rmSync, existsSync as existsSync2, readdirSync, writeFileSync as writeFileSync4 } from "fs";
-import { join as join6 } from "path";
+import { mkdirSync as mkdirSync5, renameSync, rmSync, existsSync as existsSync2, readdirSync, writeFileSync as writeFileSync5 } from "fs";
+import { join as join7 } from "path";
 import { createHash, randomUUID as randomUUID2 } from "crypto";
 import * as tar from "tar";
 var PKG = "@zooid/web";
 var DEFAULT_REGISTRY = "https://registry.npmjs.org";
 async function fetchWebBundle(opts) {
-  const target = join6(opts.cacheDir, opts.version);
-  if (existsSync2(join6(target, "index.html"))) return target;
+  const target = join7(opts.cacheDir, opts.version);
+  if (existsSync2(join7(target, "index.html"))) return target;
   if (existsSync2(target)) rmSync(target, { recursive: true, force: true });
   const f = opts.fetch ?? globalThis.fetch;
   const registry = (opts.registryUrl ?? DEFAULT_REGISTRY).replace(/\/$/, "");
@@ -882,11 +1027,11 @@ async function fetchWebBundle(opts) {
   Cause: ${err instanceof Error ? err.message : String(err)}`
     );
   }
-  const tmp = join6(opts.cacheDir, `.tmp-${randomUUID2().slice(0, 8)}`);
-  mkdirSync4(tmp, { recursive: true });
-  const tgzPath = join6(tmp, ".bundle.tgz");
+  const tmp = join7(opts.cacheDir, `.tmp-${randomUUID2().slice(0, 8)}`);
+  mkdirSync5(tmp, { recursive: true });
+  const tgzPath = join7(tmp, ".bundle.tgz");
   try {
-    writeFileSync4(tgzPath, tgz);
+    writeFileSync5(tgzPath, tgz);
     await tar.extract({
       file: tgzPath,
       cwd: tmp,
@@ -895,7 +1040,7 @@ async function fetchWebBundle(opts) {
       filter: (p) => p === "package/dist" || p.startsWith("package/dist/")
     });
     rmSync(tgzPath);
-    if (!existsSync2(join6(tmp, "index.html"))) {
+    if (!existsSync2(join7(tmp, "index.html"))) {
       throw new Error(`${PKG}@${opts.version} tarball has no dist/index.html`);
     }
     renameSync(tmp, target);
@@ -905,7 +1050,7 @@ async function fetchWebBundle(opts) {
   }
   for (const entry of readdirSync(opts.cacheDir)) {
     if (entry !== opts.version) {
-      rmSync(join6(opts.cacheDir, entry), { recursive: true, force: true });
+      rmSync(join7(opts.cacheDir, entry), { recursive: true, force: true });
     }
   }
   return target;
@@ -915,10 +1060,10 @@ async function fetchWebBundle(opts) {
 var ENV_OVERRIDE = "ZOOID_DEV_WEB_ROOT_OVERRIDE";
 async function ensureWebRoot(opts) {
   const override = process.env[ENV_OVERRIDE];
-  if (override && existsSync3(join7(override, "index.html"))) return resolve2(override);
+  if (override && existsSync3(join8(override, "index.html"))) return resolve2(override);
   const fromSource = webSourcePackage(opts.cliRoot);
-  if (fromSource && existsSync3(join7(fromSource, "dist", "index.html"))) {
-    return join7(fromSource, "dist");
+  if (fromSource && existsSync3(join8(fromSource, "dist", "index.html"))) {
+    return join8(fromSource, "dist");
   }
   if (!opts.version) {
     throw new Error(
@@ -932,16 +1077,16 @@ Set ${ENV_OVERRIDE} to a built dist, or run from the monorepo.`
 }
 function webSourcePackage(cliRoot) {
   const workspaceRoot = dirname3(dirname3(dirname3(cliRoot)));
-  const candidate = join7(workspaceRoot, "zooid-clients", "packages", "web");
-  return existsSync3(join7(candidate, "package.json")) ? candidate : null;
+  const candidate = join8(workspaceRoot, "zooid-clients", "packages", "web");
+  return existsSync3(join8(candidate, "package.json")) ? candidate : null;
 }
 
 // src/web/pin.ts
-import { readFileSync as readFileSync4 } from "fs";
-import { join as join8 } from "path";
+import { readFileSync as readFileSync5 } from "fs";
+import { join as join9 } from "path";
 function readZoonWebPin(cliRoot) {
   try {
-    const pkg = JSON.parse(readFileSync4(join8(cliRoot, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync5(join9(cliRoot, "package.json"), "utf8"));
     return pkg.zooid?.webVersion;
   } catch {
     return void 0;
@@ -949,9 +1094,9 @@ function readZoonWebPin(cliRoot) {
 }
 
 // src/web/static.ts
-import { readFileSync as readFileSync5, statSync } from "fs";
-import { extname, join as join9, normalize } from "path";
-import { Hono as Hono2 } from "hono";
+import { readFileSync as readFileSync6, statSync } from "fs";
+import { extname, join as join10, normalize } from "path";
+import { Hono as Hono3 } from "hono";
 var MIME = {
   ".html": "text/html; charset=utf-8",
   ".js": "application/javascript; charset=utf-8",
@@ -969,26 +1114,33 @@ function isAssetPath(p) {
   return p.startsWith("/assets/") || /\.[a-z0-9]+$/i.test(p);
 }
 function webStatic(opts) {
-  const app = new Hono2();
-  app.get("/config.json", (c) => c.json({ homeserver_url: opts.homeserverUrl }));
+  const app = new Hono3();
+  app.get(
+    "/config.json",
+    (c) => c.json({
+      homeserver_url: opts.homeserverUrl,
+      ...opts.pushGatewayUrl ? { push_gateway_url: opts.pushGatewayUrl } : {},
+      ...opts.vapidPublicKey ? { vapid_public_key: opts.vapidPublicKey } : {}
+    })
+  );
   app.get("*", (c) => {
     const url = new URL(c.req.url);
     const requested = decodeURIComponent(url.pathname);
     const wantFile = requested === "/" ? "/index.html" : requested;
     const safe = normalize(wantFile).replace(/^(\.\.[/\\])+/g, "");
-    const filePath = join9(opts.webRoot, safe);
+    const filePath = join10(opts.webRoot, safe);
     if (!filePath.startsWith(opts.webRoot)) return c.notFound();
     try {
       const stat = statSync(filePath);
       if (stat.isFile()) {
-        const body = readFileSync5(filePath);
+        const body = readFileSync6(filePath);
         const ct = MIME[extname(filePath)] ?? "application/octet-stream";
         return c.body(body, 200, { "content-type": ct });
       }
     } catch {
     }
     if (isAssetPath(requested)) return c.notFound();
-    const indexBytes = readFileSync5(join9(opts.webRoot, "index.html"));
+    const indexBytes = readFileSync6(join10(opts.webRoot, "index.html"));
     return c.body(indexBytes, 200, {
       "content-type": MIME[".html"]
     });
@@ -999,10 +1151,10 @@ function webStatic(opts) {
 // src/web/watch.ts
 import { spawn as spawn2 } from "child_process";
 import { existsSync as existsSync4, statSync as statSync2 } from "fs";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 async function startWebWatch(opts) {
-  const distPath = join10(opts.webPackageDir, "dist");
-  const indexPath = join10(distPath, "index.html");
+  const distPath = join11(opts.webPackageDir, "dist");
+  const indexPath = join11(distPath, "index.html");
   const timeoutMs = opts.firstBuildTimeoutMs ?? 6e4;
   const spawnTime = Date.now();
   const child = spawn2(
@@ -1056,12 +1208,12 @@ async function startWebWatch(opts) {
 async function stopChild(child) {
   if (child.exitCode !== null) return;
   child.kill("SIGTERM");
-  await new Promise((resolve7) => {
+  await new Promise((resolve8) => {
     let done = false;
     const finish = () => {
       if (done) return;
       done = true;
-      resolve7();
+      resolve8();
     };
     child.once("exit", finish);
     setTimeout(() => {
@@ -1076,7 +1228,7 @@ async function stopChild(child) {
 
 // src/observability/paths.ts
 import { mkdir as mkdir2, readdir, rm, symlink, unlink as unlink2 } from "fs/promises";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 function localDateSlug(d) {
   const y = d.getFullYear();
   const m = String(d.getMonth() + 1).padStart(2, "0");
@@ -1086,19 +1238,19 @@ function localDateSlug(d) {
 var DAY_RE = /^\d{4}-\d{2}-\d{2}$/;
 function resolveLogPaths({ dataDir, now }) {
   const slug = localDateSlug(now ?? /* @__PURE__ */ new Date());
-  const logsDir = join11(dataDir, "logs");
-  const dayDir = join11(logsDir, slug);
+  const logsDir = join12(dataDir, "logs");
+  const dayDir = join12(logsDir, slug);
   return {
     dataDir,
     logsDir,
     dayDir,
     daySlug: slug,
-    todayLink: join11(logsDir, "today"),
-    tuwunelLog: join11(dayDir, "tuwunel.log"),
-    daemonLog: join11(dayDir, "daemon.log"),
-    devLog: join11(dayDir, "dev.log"),
-    agentLog: (n) => join11(dayDir, `agent-${n}.log`),
-    agentTap: (n) => join11(dayDir, `agent-${n}.acp.jsonl`)
+    todayLink: join12(logsDir, "today"),
+    tuwunelLog: join12(dayDir, "tuwunel.log"),
+    daemonLog: join12(dayDir, "daemon.log"),
+    devLog: join12(dayDir, "dev.log"),
+    agentLog: (n) => join12(dayDir, `agent-${n}.log`),
+    agentTap: (n) => join12(dayDir, `agent-${n}.acp.jsonl`)
   };
 }
 async function ensureDayFolder(p) {
@@ -1111,7 +1263,7 @@ async function ensureDayFolder(p) {
 }
 async function pruneOldDays(opts) {
   if (opts.retainDays <= 0) return [];
-  const logsDir = join11(opts.dataDir, "logs");
+  const logsDir = join12(opts.dataDir, "logs");
   let entries;
   try {
     entries = await readdir(logsDir);
@@ -1130,7 +1282,7 @@ async function pruneOldDays(opts) {
     const [y, m, d] = name.split("-").map(Number);
     const t = new Date(y, m - 1, d).getTime();
     if (t < cutoff) {
-      await rm(join11(logsDir, name), { recursive: true, force: true });
+      await rm(join12(logsDir, name), { recursive: true, force: true });
       removed.push(name);
     }
   }
@@ -1159,14 +1311,14 @@ var JsonlSink = class {
     await this.readyPromise;
     const capped = capStrings(obj, this.maxStringLen);
     const line = JSON.stringify(capped) + "\n";
-    return new Promise((resolve7, reject) => {
-      this.stream.write(line, (err) => err ? reject(err) : resolve7());
+    return new Promise((resolve8, reject) => {
+      this.stream.write(line, (err) => err ? reject(err) : resolve8());
     });
   }
   async close() {
     await this.readyPromise;
-    return new Promise((resolve7) => {
-      this.stream.end(() => resolve7());
+    return new Promise((resolve8) => {
+      this.stream.end(() => resolve8());
     });
   }
 };
@@ -1241,8 +1393,8 @@ function captureChildToFile(child, path) {
     const stream = createWriteStream2(path, { flags: "a" });
     if (child.stdout) child.stdout.on("data", (b) => stream.write(b));
     if (child.stderr) child.stderr.on("data", (b) => stream.write(b));
-    await new Promise((resolve7) => {
-      child.on("exit", () => stream.end(() => resolve7()));
+    await new Promise((resolve8) => {
+      child.on("exit", () => stream.end(() => resolve8()));
     });
   })();
 }
@@ -1280,7 +1432,7 @@ var CLI_ROOT = (() => {
     const pkgPath = resolve3(dir, "package.json");
     if (existsSync5(pkgPath)) {
       try {
-        const pkg = JSON.parse(readFileSync6(pkgPath, "utf8"));
+        const pkg = JSON.parse(readFileSync7(pkgPath, "utf8"));
         if (pkg.name === "zooid" || pkg.name === "@zooid/cli") return dir;
       } catch {
       }
@@ -1303,7 +1455,7 @@ async function runDev(flags) {
   const tokens = ensureTokens(paths.envPath);
   process.env.MATRIX_AS_TOKEN = tokens.asToken;
   process.env.MATRIX_HS_TOKEN = tokens.hsToken;
-  const rawYaml = readFileSync6(found.path, "utf8");
+  const rawYaml = readFileSync7(found.path, "utf8");
   const preview = loadZooidConfig(rawYaml, { configDir: dirname6(found.path) });
   const matrix = findMatrixTransport(preview);
   if (!matrix) {
@@ -1416,13 +1568,26 @@ Pass an explicit path: --watch-web=/path/to/zooid-clients/packages/web`
         task: async (_, t) => {
           const webRoot = ctx.webWatch?.distPath ?? await ensureWebRoot({
             cliRoot: CLI_ROOT,
-            cacheDir: join12(layout.dataRoot, "web"),
+            cacheDir: join13(layout.dataRoot, "web"),
             version: readZoonWebPin(CLI_ROOT),
             onProgress: (msg) => {
               t.output = msg;
             }
           });
-          const app = webStatic({ webRoot, homeserverUrl: homeserver });
+          const app = webStatic({
+            webRoot,
+            homeserverUrl: homeserver,
+            ...ctx.daemon?.vapidPublicKey ? {
+              // Tuwunel runs in a container; `localhost` here would
+              // resolve to the container, not the daemon. Same shorthand
+              // as the AS registration url
+              // (bootstrap/registration-url.ts). This URL is stored in
+              // the pusher and fetched by the homeserver — the browser
+              // never requests it.
+              pushGatewayUrl: `http://host.docker.internal:${ctx.daemon.port}/_matrix/push/v1/notify`,
+              vapidPublicKey: ctx.daemon.vapidPublicKey
+            } : {}
+          });
           ctx.uiServer = serve2({ fetch: app.fetch, port: flags.uiPort });
         }
       }
@@ -1455,13 +1620,25 @@ Pass an explicit path: --watch-web=/path/to/zooid-clients/packages/web`
     }
   });
   if (flags.installSignalHandlers !== false) {
-    const handler = async () => {
-      process.stdout.write(chalk.dim("\nStopping\u2026\n"));
-      await shutdown();
-      process.exit(0);
+    let interrupts = 0;
+    const onSignal = () => {
+      interrupts += 1;
+      if (interrupts === 1) {
+        process.stdout.write(chalk.dim("\nStopping\u2026\n"));
+        void shutdown().then(() => process.exit(0));
+        return;
+      }
+      if (interrupts === 2) {
+        process.stdout.write(
+          chalk.dim("Still stopping \u2014 press Ctrl-C again to force quit.\n")
+        );
+        return;
+      }
+      process.stdout.write(chalk.dim("Forced.\n"));
+      process.exit(130);
     };
-    process.on("SIGINT", () => void handler());
-    process.on("SIGTERM", () => void handler());
+    process.on("SIGINT", onSignal);
+    process.on("SIGTERM", onSignal);
   }
   process.stdout.write(
     [
@@ -1494,9 +1671,9 @@ function loadEnvFiles(cwd) {
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync5, readdirSync as readdirSync2, symlinkSync, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync6, readdirSync as readdirSync2, symlinkSync, writeFileSync as writeFileSync6 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname7, join as join14, resolve as resolve4 } from "path";
+import { dirname as dirname7, join as join15, resolve as resolve4 } from "path";
 
 // src/commands/init/generators.ts
 function generateZooidYaml(opts) {
@@ -1677,20 +1854,20 @@ function findPiProvider(id) {
 }
 
 // src/commands/init/sniff.ts
-import { existsSync as existsSync6, readFileSync as readFileSync7 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync8 } from "fs";
 import { homedir } from "os";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 function sniffCredentials(preset, home = homedir()) {
   const rel = preset === "pi" ? PI_AUTH_FILE : findSimplePreset(preset)?.credentialDir;
   if (!rel) return { found: false };
-  const full = join13(home, rel);
+  const full = join14(home, rel);
   if (existsSync6(full)) return { found: true, path: full };
   return { found: false };
 }
 function sniffPiDefaults(home = homedir()) {
-  const source = join13(home, PI_SETTINGS_FILE);
+  const source = join14(home, PI_SETTINGS_FILE);
   try {
-    const raw = JSON.parse(readFileSync7(source, "utf8"));
+    const raw = JSON.parse(readFileSync8(source, "utf8"));
     const provider = raw.defaultProvider;
     const model = raw.defaultModel;
     if (typeof provider !== "string" || !provider) return void 0;
@@ -1715,7 +1892,7 @@ var IGNORED_PREEXISTING = /* @__PURE__ */ new Set([
 ]);
 async function runInit(opts) {
   const dir = resolve4(opts.dir);
-  mkdirSync5(dir, { recursive: true });
+  mkdirSync6(dir, { recursive: true });
   if (!opts.force) {
     const blocking = readdirSync2(dir).filter((n) => !IGNORED_PREEXISTING.has(n));
     if (blocking.length > 0) {
@@ -1811,14 +1988,14 @@ async function runInit(opts) {
   }
   writes.push({ path: ".gitignore", content: generateGitignore() });
   for (const w of writes) {
-    const full = join14(dir, w.path);
+    const full = join15(dir, w.path);
     const exists = existsSync7(full);
     if (exists && !opts.overwrite) {
       console.warn(`\u26A0 ${w.path} exists; left as-is (use --force --overwrite to replace)`);
       continue;
     }
-    mkdirSync5(dirname7(full), { recursive: true });
-    writeFileSync5(full, w.content);
+    mkdirSync6(dirname7(full), { recursive: true });
+    writeFileSync6(full, w.content);
     console.log(`\u2713 Created ${w.path}`);
   }
   if ((opts.preset === "claude" || opts.preset === "codex") && opts.auth === "subscription") {
@@ -1843,10 +2020,10 @@ async function runInit(opts) {
     }
     const s = sniffCredentials("pi", opts.home);
     if (opts.auth === "subscription" && s.found) {
-      const authSource = join14(opts.home ?? homedir2(), PI_AUTH_FILE);
-      const linkPath = join14(dir, `agents/zooid-assistant/${PI_AGENT_DIR}/auth.json`);
+      const authSource = join15(opts.home ?? homedir2(), PI_AUTH_FILE);
+      const linkPath = join15(dir, `agents/zooid-assistant/${PI_AGENT_DIR}/auth.json`);
       if (!existsSync7(linkPath)) {
-        mkdirSync5(dirname7(linkPath), { recursive: true });
+        mkdirSync6(dirname7(linkPath), { recursive: true });
         symlinkSync(authSource, linkPath);
       }
       console.log(
@@ -1979,7 +2156,7 @@ async function resolveOptions(flags) {
 // src/commands/logs.ts
 import { readFile, readdir as readdir2, readlink } from "fs/promises";
 import { existsSync as existsSync8 } from "fs";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 var KNOWN_SOURCES = ["tuwunel", "daemon", "dev"];
 async function runLogs(flags) {
   const writer = flags.writer ?? ((s) => process.stdout.write(s));
@@ -1998,7 +2175,7 @@ async function runLogs(flags) {
     writer("no logs yet\n");
     return;
   }
-  const dayDir = join15(flags.dataDir, "logs", day);
+  const dayDir = join16(flags.dataDir, "logs", day);
   if (!existsSync8(dayDir)) {
     writer(`no logs for ${day}
 `);
@@ -2027,7 +2204,7 @@ async function runLogs(flags) {
   writer(await readFile(path, "utf8"));
 }
 async function resolveTodaySlug(dataDir) {
-  const link = join15(dataDir, "logs", "today");
+  const link = join16(dataDir, "logs", "today");
   try {
     return await readlink(link);
   } catch {
@@ -2036,18 +2213,18 @@ async function resolveTodaySlug(dataDir) {
 }
 function resolveSourcePath(dayDir, source) {
   if (source.startsWith("agent-")) {
-    if (source.endsWith(".acp")) return join15(dayDir, `${source.slice(0, -4)}.acp.jsonl`);
-    return join15(dayDir, `${source}.log`);
+    if (source.endsWith(".acp")) return join16(dayDir, `${source.slice(0, -4)}.acp.jsonl`);
+    return join16(dayDir, `${source}.log`);
   }
   if (KNOWN_SOURCES.includes(source))
-    return join15(dayDir, `${source}.log`);
-  return join15(dayDir, source);
+    return join16(dayDir, `${source}.log`);
+  return join16(dayDir, source);
 }
 async function dumpByTurn(dayDir, turnId, writer) {
   const entries = await readdir2(dayDir);
   const taps = entries.filter((e) => e.endsWith(".acp.jsonl")).sort();
   for (const f of taps) {
-    const text = await readFile(join15(dayDir, f), "utf8");
+    const text = await readFile(join16(dayDir, f), "utf8");
     for (const line of text.split("\n")) {
       if (!line) continue;
       try {
@@ -2081,9 +2258,17 @@ async function runStart(flags) {
 }
 
 // src/commands/status.ts
-import { readFileSync as readFileSync8 } from "fs";
-import { dirname as dirname8 } from "path";
+import { readFileSync as readFileSync9 } from "fs";
+import { dirname as dirname8, join as join17, resolve as resolve6 } from "path";
 import chalk2 from "chalk";
+function readVapidPublicKey(dataDir) {
+  try {
+    const parsed = JSON.parse(readFileSync9(join17(dataDir, VAPID_FILENAME), "utf8"));
+    return typeof parsed.publicKey === "string" ? parsed.publicKey : void 0;
+  } catch {
+    return void 0;
+  }
+}
 async function probe(url, timeoutMs = 2e3) {
   try {
     const r = await fetch(url, { signal: AbortSignal.timeout(timeoutMs) });
@@ -2098,15 +2283,17 @@ async function collectStatus(opts) {
     status: tuwunelUp ? "up" : "down",
     url: opts.tuwunelUrl
   };
+  const vapidPublicKey = opts.dataDir ? readVapidPublicKey(opts.dataDir) : void 0;
   const found = findConfigFile(opts.cwd);
   if (!found) {
     return {
       tuwunel,
       daemon: { status: "unknown", reason: "no zooid.yaml" },
-      agents: []
+      agents: [],
+      ...vapidPublicKey ? { vapidPublicKey } : {}
     };
   }
-  const cfg = loadZooidConfig(readFileSync8(found.path, "utf8"), {
+  const cfg = loadZooidConfig(readFileSync9(found.path, "utf8"), {
     configDir: dirname8(found.path)
   });
   const matrixEntry = Object.entries(cfg.transports).find(
@@ -2128,7 +2315,8 @@ async function collectStatus(opts) {
   return {
     tuwunel,
     daemon: { status: daemonUp ? "up" : "down", url: daemonUrl },
-    agents
+    agents,
+    ...vapidPublicKey ? { vapidPublicKey } : {}
   };
 }
 async function runStatus(flags) {
@@ -2137,7 +2325,7 @@ async function runStatus(flags) {
   if (port === void 0) {
     const found = findConfigFile(cwd);
     if (found) {
-      const cfg = loadZooidConfig(readFileSync8(found.path, "utf8"), {
+      const cfg = loadZooidConfig(readFileSync9(found.path, "utf8"), {
         configDir: dirname8(found.path)
       });
       const matrix = findMatrixTransport(cfg);
@@ -2148,7 +2336,8 @@ async function runStatus(flags) {
     }
   }
   const tuwunelUrl = `http://localhost:${port ?? 8448}`;
-  const s = await collectStatus({ cwd, tuwunelUrl });
+  const dataDir = resolve6(cwd, flags.dataDir ?? "./data");
+  const s = await collectStatus({ cwd, tuwunelUrl, dataDir });
   const fmt = (st) => st === "up" ? chalk2.green("up") : st === "down" ? chalk2.red("down") : chalk2.yellow("unknown");
   process.stdout.write(
     [
@@ -2157,14 +2346,29 @@ async function runStatus(flags) {
       ...s.agents.map(
         (a) => `  agent: ${a.name} (${a.userId}, trigger: ${a.trigger})`
       ),
+      ...s.vapidPublicKey ? [`vapid public key: ${s.vapidPublicKey}`] : [],
       ""
     ].join("\n")
   );
 }
 
+// src/version.ts
+import { readFileSync as readFileSync10 } from "fs";
+function readCliVersion(url = import.meta.url) {
+  try {
+    const manifest = new URL("../package.json", url);
+    const raw = JSON.parse(readFileSync10(manifest, "utf8"));
+    if (typeof raw.version === "string" && raw.version) return raw.version;
+    return "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+var CLI_VERSION = readCliVersion();
+
 // src/bin.ts
 var cli = cac("zooid");
-cli.command("start", "Run the daemon (production entry-point)").option("--data <dir>", "Persistent data root dir", { default: "./data" }).option("--runtime <local|docker|podman>", "Agent runtime").option("--image <ref>", "Agent container image").option("--print-token", "Print a 32-byte hex token and exit").action(async (flags) => {
+cli.command("start", "Run the daemon (production entry-point)").option("--data <dir>", "Persistent data root dir", { default: "./data" }).option("--runtime <local|docker|podman>", "Agent runtime").option("--image <ref>", "Agent container image").option("--print-token", "Print a 32-byte hex token and exit").example("$ zooid start --data ./data").example("$ zooid start --runtime docker --image ghcr.io/zooid-ai/agent:latest").action(async (flags) => {
   await runStart({
     dataDir: flags.data,
     runtime: flags.runtime,
@@ -2175,7 +2379,7 @@ cli.command("start", "Run the daemon (production entry-point)").option("--data <
 cli.command("dev", "Tuwunel + daemon + UI for local development").option("--data <dir>", "Persistent data root dir", { default: "./data" }).option("--engine <docker|podman>", "Container engine", { default: "docker" }).option("--ui-port <n>", "UI HTTP port", { default: 5173 }).option("--admin-user <name>", "Admin username", { default: "admin" }).option("--admin-password <pw>", "Admin password", { default: "admin" }).option(
   "--watch-web [path]",
   "Run vite build --watch on @zooid/web. Path defaults to sibling ../zooid-clients/packages/web."
-).action(async (flags) => {
+).example("$ zooid dev").example("$ zooid dev --engine podman --ui-port 5174").action(async (flags) => {
   await runDev({
     dataDir: flags.data,
     engine: flags.engine,
@@ -2188,30 +2392,30 @@ cli.command("dev", "Tuwunel + daemon + UI for local development").option("--data
 cli.command(
   "logs [source]",
   'Read captured logs. source=tuwunel|daemon|dev|agent-<name>[.acp], or "prune" to delete old days'
-).option("--data <dir>", "Persistent data root dir", { default: "./data" }).option("--day <YYYY-MM-DD>", "Day partition (defaults to today)").option("--turn <id>", "Filter ACP taps to a single turn id").option("-f, --follow", "Tail the file (not yet implemented)").option("--keep <n>", "For `logs prune`: days to retain", { default: 14 }).action(async (source, flags) => {
+).option("--data <dir>", "Persistent data root dir", { default: "./data" }).option("--day <YYYY-MM-DD>", "Day partition (defaults to today)").option("--turn <id>", "Filter ACP taps to a single turn id").option("-f, --follow", "Tail the file (not yet implemented)").option("--keep <n>", "For `logs prune`: days to retain", { default: 14 }).example("$ zooid logs daemon").example("$ zooid logs agent-support.acp --turn 3f9c1a --day 2026-09-06").example("$ zooid logs prune --keep 7").action(async (source, flags) => {
   if (source === "prune") {
     await runLogs({
-      dataDir: resolve6(process.cwd(), flags.data),
+      dataDir: resolve7(process.cwd(), flags.data),
       subcommand: "prune",
       keep: Number(flags.keep)
     });
     return;
   }
   await runLogs({
-    dataDir: resolve6(process.cwd(), flags.data),
+    dataDir: resolve7(process.cwd(), flags.data),
     source,
     day: flags.day,
     turn: flags.turn,
     follow: Boolean(flags.follow)
   });
 });
-cli.command("status", "Print Tuwunel + daemon health").option("--data <dir>", "Persistent data root dir", { default: "./data" }).option("--port <n>", "Tuwunel host port (defaults to zooid.yaml)").action(async (flags) => {
+cli.command("status", "Print Tuwunel + daemon health").option("--data <dir>", "Persistent data root dir", { default: "./data" }).option("--port <n>", "Tuwunel host port (defaults to zooid.yaml)").example("$ zooid status").action(async (flags) => {
   await runStatus({
     dataDir: flags.data,
     port: flags.port !== void 0 ? Number(flags.port) : void 0
   });
 });
-cli.command("init [dir]", "Scaffold a new zooid workforce in the current (or named) directory").option("--preset <name>", "claude | codex | opencode | pi").option("--auth <mode>", "subscription | api-key (claude/codex/pi only)").option("--model <id>", "Model identifier").option("--provider <id>", "opencode provider: opencode-go | opencode | anthropic | openrouter | custom; pi provider: openrouter | anthropic | openai").option("--api-key <value>", "API key (api-key path; opencode always)").option("--force", "Allow scaffolding into a non-empty directory").option("--overwrite", "With --force, overwrite existing files").option("--no-interactive", "Disable prompts; require all flags up front").action(async (dir, flags) => {
+cli.command("init [dir]", "Scaffold a new zooid workforce in the current (or named) directory").option("--preset <name>", "claude | codex | opencode | pi").option("--auth <mode>", "subscription | api-key (claude/codex/pi only)").option("--model <id>", "Model identifier").option("--provider <id>", "opencode provider: opencode-go | opencode | anthropic | openrouter | custom; pi provider: openrouter | anthropic | openai").option("--api-key <value>", "API key (api-key path; opencode always)").option("--force", "Allow scaffolding into a non-empty directory").option("--overwrite", "With --force, overwrite existing files").option("--no-interactive", "Disable prompts; require all flags up front").example("$ zooid init").example("$ zooid init my-workforce --preset opencode --provider anthropic").example("$ zooid init --preset claude --auth api-key --api-key sk-... --no-interactive").action(async (dir, flags) => {
   const resolved = await resolveOptions({
     dir: dir ?? process.cwd(),
     preset: flags.preset,
@@ -2225,7 +2429,39 @@ cli.command("init [dir]", "Scaffold a new zooid workforce in the current (or nam
   });
   await runInit(resolved);
 });
-cli.help();
-cli.version("0.0.1");
-cli.parse();
+cli.command("help [command]", "Display help for zooid, or for a specific command").example("$ zooid help").example("$ zooid help init").action((commandName) => {
+  if (!commandName) {
+    cli.globalCommand.outputHelp();
+    return;
+  }
+  const target = cli.commands.find((c) => c.isMatched(commandName));
+  if (!target) {
+    console.error(`Unknown command: ${commandName}
+`);
+    cli.globalCommand.outputHelp();
+    process.exitCode = 1;
+    return;
+  }
+  target.outputHelp();
+});
+cli.help((sections) => {
+  sections.push({
+    title: "Docs",
+    body: "  https://zooid.dev/docs"
+  });
+  return sections;
+});
+cli.version(CLI_VERSION);
+cli.on("command:*", () => {
+  console.error(`Unknown command: ${cli.args.join(" ")}
+`);
+  cli.outputHelp();
+  process.exitCode = 1;
+});
+if (process.argv.slice(2).length === 0) {
+  cli.outputHelp();
+  process.exitCode = 1;
+} else {
+  cli.parse();
+}
 //# sourceMappingURL=bin.js.map