Documentation / Orientation

Read the record.
Understand the gaps.

A guide to the local workflow and the terms in a Zyphr session. Public source publication is in preparation. These notes describe the local workflow and its limits.

Check source availability

01 / Begin locally

Run an ordinary task first.

  1. Build the CLI.

    Use the source setup. Read the repository's current Go requirement and security notes. There is no release binary linked from this site.

    Source installation

  2. Configure one native adapter.

    Choose Claude Code, Cursor, or Pi. Follow the repository's adapter instructions and preserve your existing hooks. Start in observe mode with prompt capture off.

  3. Run a task with synthetic data.

    Use a project that contains no credentials or private files. Exercise a normal tool call. If you configure the proxy, make a request to a destination you control or are allowed to use.

  4. Inspect the local session.

    Open the local console. Check the native session identity, event sources, capture status, and coverage gaps before interpreting a finding.

02 / Reading the console

Different records.
Different claims.

Session
The local record associated with a coding-agent run and its native session identity. Check the adapter and coverage before treating it as complete.
Event
An observed hook or proxy activity. Its source matters. A hook event does not by itself establish network behavior.
Policy decision
An allow or deny result for a request on the proxy path. The decision records what a rule did, not whether the agent was malicious.
Finding
A local security observation with supporting evidence. Review the evidence and inference separately. A finding does not veto tool execution.
Coverage gap
An unsupported, unavailable, or uncaptured source. Missing evidence is not evidence that an action did not happen.
Capture status
Whether content capture was enabled and what was actually captured. Do not assume event metadata includes prompt or request content.
See a synthetic example

03 / Integration scope

Three current native adapters.

Claude CodeNative hooks
CursorNative hooks
PiNative hooks

Adapter support is not a promise of OS-wide process visibility. Exact events depend on the adapter and session. Other agent adapters and OS-specific sensors remain architecture or roadmap work.

04 / Deliberate changes

Observation first.
Policy when you mean it.

Permissive hooks and egress rules are separate mechanisms. Enabling hooks does not turn on a system firewall. An explicit deny rule can block a request only when that request goes through the Zyphr proxy.

Before changing policy, confirm the runtime uses the proxy and trusts its per-runtime CA. Test both an allowed and a denied destination with synthetic data. Record traffic outside the proxy as a coverage gap.

Keep prompt capture off until you have a reason to enable it. Optional capture uses redaction and encryption, but neither removes the same-user trust limit.

Read failure behavior and trust limits

05 / Project lineage

Zyphr succeeds Lantern.

Lantern is the predecessor, not a second active product. The current development source and CLI use the Zyphr name.

Existing Lantern data and hooks should remain untouched until an explicit migration. Do not rename local data directories or replace an existing integration based only on the new project name. When published, check the source documentation for the supported migration path.

06 / The source of truth

Commands live with the code.

Availability and setupPublication status and prerequisitesCommon questionsAgents, local data, and coverageSecurity contactArrange a private channel before sharing detailsProject repositoryCheck source publication status

The project is under active development. This guide explains the model. When the source is available, check its documentation before changing hooks, trust settings, or policy.