@lawaty/lacode 0.8.0 → 0.10.0

package/dist/lacode.js

@@ -76,15 +76,21 @@ var safeText = (raw, fallback, max) => {
 };
 var safeTitle = (raw) => safeText(raw ?? "", "LaCode", 120);
 var safeMessage = (raw) => safeText(raw ?? "", "", 400);
+var safeRequestId = (raw) => {
+  const clean = (raw ?? "").replace(/[\u0000-\u001f\u007f]/g, "").trim();
+  if (!clean) return void 0;
+  return clean.length > 128 ? clean.slice(0, 128) : clean;
+};
 var FIELD_SEPARATOR = "\n";
 function parsePayload(raw) {
-  const [title, message, urgency, icon, sound] = raw.split(FIELD_SEPARATOR);
+  const [title, message, urgency, icon, sound, requestID] = raw.split(FIELD_SEPARATOR);
   return {
     title: safeTitle(title),
     message: safeMessage(message),
     urgency: normalizeUrgency(urgency),
     icon: normalizeIcon(icon),
-    sound: normalizeSound(sound)
+    sound: normalizeSound(sound),
+    requestID: safeRequestId(requestID)
   };
 }
 var encodePayload = (request) => [
@@ -92,7 +98,10 @@ var encodePayload = (request) => [
   safeMessage(request.message),
   normalizeUrgency(request.urgency),
   normalizeIcon(request.icon),
-  normalizeSound(request.sound)
+  normalizeSound(request.sound),
+  // The sixth field, empty when there is no request id: an absent id and an
+  // empty one mean the same thing, and the field count never changes.
+  safeRequestId(request.requestID) ?? ""
 ].join(FIELD_SEPARATOR);
 var SSH_OPTS = [
   "-o",
@@ -175,6 +184,13 @@ var NO_CHANNEL = {
   linux: "notify-send is not installed",
   darwin: "neither osascript nor terminal-notifier is installed"
 };
+var NEVER_EXPIRE_FLAG = "--expire-time=0";
+var NOTIFICATION_ACTIONS = [
+  ["once", "Allow once"],
+  ["always", "Always allow"],
+  ["reject", "Deny"]
+];
+var ACTION_WAIT_MS = 10 * 6e4;
 function sendLocal(request, platform = process.platform) {
   const sound = normalizeSound(request.sound);
   const playSound = () => {
@@ -195,35 +211,66 @@ function sendLocal(request, platform = process.platform) {
   }
   const title = safeTitle(request.title);
   const body = safeMessage(request.message);
+  const requestID = safeRequestId(request.requestID);
+  const actionable = channel === "notify-send" && requestID !== void 0;
+  const actionArgs = actionable ? NOTIFICATION_ACTIONS.map(([name, label]) => `--action=${name}=${label}`) : [];
   const args = channel === "osascript" ? ["-e", DARWIN_SCRIPT, DARWIN_ARGV_MARKER, title, body] : channel === "terminal-notifier" ? ["-title", title, "-message", body, "-appName", "LaCode", "-priority", normalizeUrgency(request.urgency)] : (
-    // Byte-identical to the notify-send call this package has always made.
-    [title, body, `--urgency=${normalizeUrgency(request.urgency)}`, `--icon=${normalizeIcon(request.icon)}`]
+    // Never auto-dismissed: the notification waits for the user to close it.
+    [title, body, `--urgency=${normalizeUrgency(request.urgency)}`, `--icon=${normalizeIcon(request.icon)}`, NEVER_EXPIRE_FLAG, ...actionArgs]
   );
-  const result = run(CHANNEL_BINARY[channel], args, 5e3);
+  const result = run(CHANNEL_BINARY[channel], args, actionable ? ACTION_WAIT_MS : 5e3);
   playSound();
-  return { ok: result.ok, detail: result.ok ? void 0 : result.stderr || result.detail, transport: "local" };
+  const action = actionable ? result.stdout.trim() : "";
+  return {
+    ok: result.ok,
+    detail: result.ok ? void 0 : result.stderr || result.detail,
+    transport: "local",
+    ...action ? { action } : {}
+  };
 }
 function sendRemote(request, tunnel) {
   if (!tunnel.user) return { ok: false, detail: "OC_LOCAL_USER is unset; the desktop user for the tunnel is unknown", transport: "remote" };
   const connect = ["-o", `ConnectTimeout=${Math.max(1, Math.round(tunnel.connectTimeoutMs / 1e3))}`];
+  const actionable = safeRequestId(request.requestID) !== void 0;
+  const timeoutMs = actionable ? Math.max(tunnel.connectTimeoutMs + 2e3, ACTION_WAIT_MS + 2e3) : tunnel.connectTimeoutMs + 2e3;
+  const deliver = (args) => {
+    const result = run("ssh", args, timeoutMs);
+    const action = actionable ? result.stdout.trim() : "";
+    return {
+      ok: result.ok,
+      detail: result.ok ? void 0 : result.stderr || result.detail,
+      transport: "remote",
+      ...action ? { action } : {}
+    };
+  };
   if (tunnel.host) {
-    const result2 = run(
-      "ssh",
-      [...SSH_OPTS, ...CONTROL_OPTS, ...connect, "-i", tunnel.key, `${tunnel.user}@${tunnel.host}`, "--", encodePayload(request)],
-      tunnel.connectTimeoutMs + 2e3
-    );
-    return { ok: result2.ok, detail: result2.ok ? void 0 : result2.stderr || result2.detail, transport: "remote" };
-  }
-  const result = run(
-    "ssh",
-    [...SSH_OPTS, ...connect, "-i", tunnel.key, "-p", String(tunnel.port), `${tunnel.user}@localhost`, "--", encodePayload(request)],
-    tunnel.connectTimeoutMs + 2e3
-  );
-  return { ok: result.ok, detail: result.ok ? void 0 : result.stderr || result.detail, transport: "remote" };
+    return deliver([
+      ...SSH_OPTS,
+      ...CONTROL_OPTS,
+      ...connect,
+      "-i",
+      tunnel.key,
+      `${tunnel.user}@${tunnel.host}`,
+      "--",
+      encodePayload(request)
+    ]);
+  }
+  return deliver([
+    ...SSH_OPTS,
+    ...connect,
+    "-i",
+    tunnel.key,
+    "-p",
+    String(tunnel.port),
+    `${tunnel.user}@localhost`,
+    "--",
+    encodePayload(request)
+  ]);
 }
 function notify(request, env = process.env, platform = process.platform) {
   try {
-    return isRemote(env) ? sendRemote(request, resolveTunnel(env)) : sendLocal(request, platform);
+    const result = isRemote(env) ? sendRemote(request, resolveTunnel(env)) : sendLocal(request, platform);
+    return result.action ? { ...result, action: result.action } : result;
   } catch (error) {
     return { ok: false, detail: String(error), transport: "none" };
   }
@@ -639,6 +686,8 @@ var USAGE = `lacode \u2014 portable notifications and remote exec for LaCode
       permission | error; an omitted or unrecognised SOUND is none, so a
       four-argument caller simply gets no sound. Fire-and-forget: always
       exits 0.
+      With LACODE_REQUEST_ID set, the notification carries buttons and the
+      name of the clicked one is printed on stdout.
 
   lacode forward HOST -- COMMAND [ARG...]
       Run COMMAND on HOST over ssh. Exits with the remote's status.
@@ -666,7 +715,9 @@ Environment:
   OC_LOCAL_USER        desktop user the tunnel authenticates as
   OC_TUNNEL_PORT       reverse-forward listener port (default 10022)
   OC_NOTIFY_KEY        dedicated key (default ~/.ssh/lacode_notify)
-  OC_CONNECT_TIMEOUT_MS / OC_SSH_TIMEOUT_MS`;
+  OC_CONNECT_TIMEOUT_MS / OC_SSH_TIMEOUT_MS
+  LACODE_REQUEST_ID    makes a notification actionable: it carries buttons, and
+                        the clicked one is printed on stdout`;
 var argv = process.argv.slice(2);
 var command = argv.shift();
 switch (command) {
@@ -684,8 +735,16 @@ switch (command) {
       console.error(USAGE);
       process.exit(2);
     }
-    const result = notify({ title: rawTitle, message, urgency, icon, sound: normalizeSound(sound) });
+    const result = notify({
+      title: rawTitle,
+      message,
+      urgency,
+      icon,
+      sound: normalizeSound(sound),
+      requestID: process.env.LACODE_REQUEST_ID
+    });
     if (!result.ok) console.error(`lacode: notification not delivered via ${result.transport}: ${result.detail ?? "unknown reason"}`);
+    if (result.action) console.log(result.action);
     process.exit(0);
     break;
   }
@@ -765,6 +824,7 @@ ${report.note}`);
     const request = parsePayload(process.env.SSH_ORIGINAL_COMMAND ?? "");
     const result = sendLocal(request);
     if (!result.ok) console.error(`lacode receive: ${result.detail ?? "not delivered"}`);
+    if (result.action) console.log(result.action);
     process.exit(result.ok ? 0 : 1);
     break;
   }

package/dist/pool.js

@@ -51,10 +51,10 @@ var USER_CONFIG_DIR = join2(homedir(), ".config", "lacode");
 var USER_MODELS_PATH = join2(USER_CONFIG_DIR, "pool.json");
 var USER_MODELS_TXT = join2(USER_CONFIG_DIR, "pool.txt");
 var FALLBACK_SLOTS = [
-  { index: 1, model: "opencode/space-bunny-free", weight: 3 },
-  { index: 2, model: "opencode-go/longcat-2.5-preview-free", weight: 2 },
-  { index: 3, model: "opencode/big-pickle", weight: 1 },
-  { index: 4, model: "opencode/longcat-2.5-preview-free", weight: 1 }
+  { index: 1, model: "opencode/big-pickle", weight: 3 },
+  { index: 2, model: "opencode-go/minimax-m3.1-flash-free", weight: 2 },
+  { index: 3, model: "opencode/deepseek-v4.1-flash-free", weight: 1 },
+  { index: 4, model: "opencode/glm-5.3-flash-free", weight: 1 }
 ];
 function parseSlots(parsed, origin) {
   const problems = [];

package/dist/tunnel.js

@@ -69,15 +69,21 @@ var safeText = (raw, fallback, max) => {
 };
 var safeTitle = (raw) => safeText(raw ?? "", "LaCode", 120);
 var safeMessage = (raw) => safeText(raw ?? "", "", 400);
+var safeRequestId = (raw) => {
+  const clean = (raw ?? "").replace(/[\u0000-\u001f\u007f]/g, "").trim();
+  if (!clean) return void 0;
+  return clean.length > 128 ? clean.slice(0, 128) : clean;
+};
 var FIELD_SEPARATOR = "\n";
 function parsePayload(raw) {
-  const [title, message, urgency, icon, sound] = raw.split(FIELD_SEPARATOR);
+  const [title, message, urgency, icon, sound, requestID] = raw.split(FIELD_SEPARATOR);
   return {
     title: safeTitle(title),
     message: safeMessage(message),
     urgency: normalizeUrgency(urgency),
     icon: normalizeIcon(icon),
-    sound: normalizeSound(sound)
+    sound: normalizeSound(sound),
+    requestID: safeRequestId(requestID)
   };
 }
 var encodePayload = (request) => [
@@ -85,7 +91,10 @@ var encodePayload = (request) => [
   safeMessage(request.message),
   normalizeUrgency(request.urgency),
   normalizeIcon(request.icon),
-  normalizeSound(request.sound)
+  normalizeSound(request.sound),
+  // The sixth field, empty when there is no request id: an absent id and an
+  // empty one mean the same thing, and the field count never changes.
+  safeRequestId(request.requestID) ?? ""
 ].join(FIELD_SEPARATOR);
 var SSH_OPTS = [
   "-o",
@@ -168,6 +177,13 @@ var NO_CHANNEL = {
   linux: "notify-send is not installed",
   darwin: "neither osascript nor terminal-notifier is installed"
 };
+var NEVER_EXPIRE_FLAG = "--expire-time=0";
+var NOTIFICATION_ACTIONS = [
+  ["once", "Allow once"],
+  ["always", "Always allow"],
+  ["reject", "Deny"]
+];
+var ACTION_WAIT_MS = 10 * 6e4;
 function sendLocal(request, platform = process.platform) {
   const sound = normalizeSound(request.sound);
   const playSound = () => {
@@ -188,35 +204,66 @@ function sendLocal(request, platform = process.platform) {
   }
   const title = safeTitle(request.title);
   const body = safeMessage(request.message);
+  const requestID = safeRequestId(request.requestID);
+  const actionable = channel === "notify-send" && requestID !== void 0;
+  const actionArgs = actionable ? NOTIFICATION_ACTIONS.map(([name, label]) => `--action=${name}=${label}`) : [];
   const args = channel === "osascript" ? ["-e", DARWIN_SCRIPT, DARWIN_ARGV_MARKER, title, body] : channel === "terminal-notifier" ? ["-title", title, "-message", body, "-appName", "LaCode", "-priority", normalizeUrgency(request.urgency)] : (
-    // Byte-identical to the notify-send call this package has always made.
-    [title, body, `--urgency=${normalizeUrgency(request.urgency)}`, `--icon=${normalizeIcon(request.icon)}`]
+    // Never auto-dismissed: the notification waits for the user to close it.
+    [title, body, `--urgency=${normalizeUrgency(request.urgency)}`, `--icon=${normalizeIcon(request.icon)}`, NEVER_EXPIRE_FLAG, ...actionArgs]
   );
-  const result = run(CHANNEL_BINARY[channel], args, 5e3);
+  const result = run(CHANNEL_BINARY[channel], args, actionable ? ACTION_WAIT_MS : 5e3);
   playSound();
-  return { ok: result.ok, detail: result.ok ? void 0 : result.stderr || result.detail, transport: "local" };
+  const action = actionable ? result.stdout.trim() : "";
+  return {
+    ok: result.ok,
+    detail: result.ok ? void 0 : result.stderr || result.detail,
+    transport: "local",
+    ...action ? { action } : {}
+  };
 }
 function sendRemote(request, tunnel) {
   if (!tunnel.user) return { ok: false, detail: "OC_LOCAL_USER is unset; the desktop user for the tunnel is unknown", transport: "remote" };
   const connect = ["-o", `ConnectTimeout=${Math.max(1, Math.round(tunnel.connectTimeoutMs / 1e3))}`];
+  const actionable = safeRequestId(request.requestID) !== void 0;
+  const timeoutMs = actionable ? Math.max(tunnel.connectTimeoutMs + 2e3, ACTION_WAIT_MS + 2e3) : tunnel.connectTimeoutMs + 2e3;
+  const deliver = (args) => {
+    const result = run("ssh", args, timeoutMs);
+    const action = actionable ? result.stdout.trim() : "";
+    return {
+      ok: result.ok,
+      detail: result.ok ? void 0 : result.stderr || result.detail,
+      transport: "remote",
+      ...action ? { action } : {}
+    };
+  };
   if (tunnel.host) {
-    const result2 = run(
-      "ssh",
-      [...SSH_OPTS, ...CONTROL_OPTS, ...connect, "-i", tunnel.key, `${tunnel.user}@${tunnel.host}`, "--", encodePayload(request)],
-      tunnel.connectTimeoutMs + 2e3
-    );
-    return { ok: result2.ok, detail: result2.ok ? void 0 : result2.stderr || result2.detail, transport: "remote" };
+    return deliver([
+      ...SSH_OPTS,
+      ...CONTROL_OPTS,
+      ...connect,
+      "-i",
+      tunnel.key,
+      `${tunnel.user}@${tunnel.host}`,
+      "--",
+      encodePayload(request)
+    ]);
   }
-  const result = run(
-    "ssh",
-    [...SSH_OPTS, ...connect, "-i", tunnel.key, "-p", String(tunnel.port), `${tunnel.user}@localhost`, "--", encodePayload(request)],
-    tunnel.connectTimeoutMs + 2e3
-  );
-  return { ok: result.ok, detail: result.ok ? void 0 : result.stderr || result.detail, transport: "remote" };
+  return deliver([
+    ...SSH_OPTS,
+    ...connect,
+    "-i",
+    tunnel.key,
+    "-p",
+    String(tunnel.port),
+    `${tunnel.user}@localhost`,
+    "--",
+    encodePayload(request)
+  ]);
 }
 function notify(request, env = process.env, platform = process.platform) {
   try {
-    return isRemote(env) ? sendRemote(request, resolveTunnel(env)) : sendLocal(request, platform);
+    const result = isRemote(env) ? sendRemote(request, resolveTunnel(env)) : sendLocal(request, platform);
+    return result.action ? { ...result, action: result.action } : result;
   } catch (error) {
     return { ok: false, detail: String(error), transport: "none" };
   }
@@ -249,6 +296,7 @@ function describe(env = process.env, platform = process.platform) {
 export {
   FIELD_SEPARATOR,
   ICONS,
+  NOTIFICATION_ACTIONS,
   SOUNDS,
   describe,
   encodePayload,
@@ -262,6 +310,7 @@ export {
   parsePayload,
   resolveTunnel,
   safeMessage,
+  safeRequestId,
   safeTitle,
   sendLocal,
   sendRemote,

package/docs/CONTEXT.md

@@ -29,10 +29,11 @@ the exploration it replaces is worse than no map:
   for order mutations", not "there is a file called OrderService in
   `src/orders/`". The cartographer is forbidden by name from writing directory
   listings, copying source, or restating what the README already says.
-- **One file per question.** Five files, each with a defined scope, so an agent
-  reads one of them rather than all of them.
+- **One file per question.** Five navigation files, each with a defined scope, so
+  an agent reads one of them rather than all of them. A sixth file,
+  `active.md`, holds the work in flight rather than a map of the repository.
 - **Canonical entry points.** The highest-value thing in the map is a short
-  "Start here" list per subsystem: the five files an agent should open, each
+  "Start here" list per subsystem: the canonical files an agent should open, each
   with a one-phrase reason.
 - **It links out.** Your project's own README, ADRs and docs are authoritative
   and are not duplicated here.
@@ -47,7 +48,8 @@ harness that produces a number for your own workload.
 
 ## The files in the map
 
-`.opencode/context/` holds the five generated files below:
+`.opencode/context/` holds the five navigation files below, plus one file that is
+a work list rather than a map:
 
 | File | What belongs in it |
 | --- | --- |
@@ -56,6 +58,7 @@ harness that produces a number for your own workload.
 | `conventions.md` | Repository-specific rules: naming, module layout, error handling, testing, persistence. Read this before writing code, not after. |
 | `workflows.md` | The few runtime flows worth tracing end to end — how a request becomes a mutation, how a plugin hook reaches the thing it hooks. Read this when you need to know what actually happens at runtime. |
 | `decisions.md` | Architectural decisions that the repository's own decision log does not already record. Concise, variable length. |
+| `active.md` | The active backlog: work in flight, grouped by the ISO week each task was opened in. A task that is not marked `[x]` is open and is never removed; a task that is finished and dated is kept for a week after it was finished, then dropped. The plugin enforces that window — see [How it stays current](#how-it-stays-current). Not a navigation file: there is no question it is the answer to. |
 
 The project's root `AGENTS.md` is the standing-instructions home: the client's
 own statement of intent, what they want worked on and how they want it
@@ -135,6 +138,18 @@ your source.
 If you have defined a command of the same name, yours wins and is left exactly
 as you wrote it — the same merge-without-clobber rule the agents follow.
 
+`active.md` is the one file in the directory the plugin maintains rather than
+the cartographer. The cartographer records what happened — work in flight, and a
+task marked finished with the date it finished — and the plugin decides what is
+still worth keeping: the file is regrouped by week and a task that was finished
+more than a week ago is dropped. The arithmetic lives in
+`src/lib/active-backlog.ts`, not in the cartographer's prompt, because a rule a
+model applies is a rule the model applies when it feels like it, and the failure
+is silent — the backlog just grows. The plugin normalizes the file on every
+edit of it and once when the session starts, so a hand edit is grouped and
+pruned whether the cartographer ran or not, and the file is rewritten only when
+its canonical form differs from what is on disk, so the write cannot loop.
+
 ## One writer
 
 Only `context` writes the map. Every other agent is told never to edit
@@ -152,7 +167,7 @@ naming the one writer, and the permission rule — a permission denial tells an
 agent nothing about what it should have done instead.
 
 This exists because two writers produce a map that is neither current nor
-trustworthy. Concurrent sessions rewriting the same five files produce
+trustworthy. Concurrent sessions rewriting the same files produce
 contradictions that no later reader can resolve, and the reader has no way to
 tell which version is newer.
 
@@ -193,7 +208,7 @@ startup check has no way to see a worktree it was not told about.
 
 How to detect it: open opencode from the repository root, not from a
 subdirectory of it. If `ls .opencode/context` from your shell's current
-directory does not list the five files, your shell is not at the root and
+directory does not list the map files, your shell is not at the root and
 neither is opencode's worktree. The cost of getting it wrong is not a crash —
 it is a map maintained only by prompt, with no mechanism enforcing who writes it.
 

package/docs/OMNIROUTE.md

@@ -103,8 +103,8 @@ work (exploration, implementation, cartography) through the gateway, add an
 ```
 # ~/.config/lacode/pool.txt
 omniroute/free-mix
-opencode/space-bunny-free
-opencode-go/longcat-2.5-preview-free
+opencode/big-pickle
+opencode-go/minimax-m3.1-flash-free
 ```
 
 OmniRoute is a provider like any other: the pool decides its place and weight,

package/docs/TUNNEL.md

@@ -15,8 +15,12 @@ gets it back.
   │      ▼           │   ONE argument:          │   forced command)      │
   │ lacode notify    │   title\nmessage\n       │      │                 │
   │                  │   urgency\nicon\nsound   │      ▼                 │
-  │                  │                          │  notify-send /         │
+  │                  │   \nrequestID            │  notify-send /         │
   │                  │                          │  osascript             │
+  │      ▲           │ ◄─────────────────────── │                        │
+  │                  │   the clicked button's   │                        │
+  │                  │   name, on the forced    │                        │
+  │                  │   command's stdout       │                        │
   └──────────────────┘                          └────────────────────────┘
 ```
 
@@ -27,27 +31,67 @@ listening port, no systemd unit and nothing to sync: the plugin owns the
 transport, and it exists only while opencode runs — which is the only time a
 notification matters.
 
-**One argument, not five.** ssh concatenates everything after the host into a
+**One argument, not six.** ssh concatenates everything after the host into a
 single command string, and a forced command starts with *no* positional
-parameters. A sender that passes five quoted arguments arrives as the single
-string `"a b c d e"`; a receiver reading `$1..$5` sees five empty strings, falls
-back to five defaults, and pops up a blank notification. So the payload crosses
-as one newline-delimited argument:
+parameters. A sender that passes six quoted arguments arrives as the single
+string `"a b c d e f"`; a receiver reading `$1..$6` sees six empty strings,
+falls back to six defaults, and pops up a blank notification. So the payload
+crosses as one newline-delimited argument:
 
 ```
-title\nmessage\nurgency\nicon\nsound
+title\nmessage\nurgency\nicon\nsound\nrequestID
 ```
 
-Five fields — `title`, `message`, `urgency`, `icon`, `sound`. `sound` is `none`,
-`done`, `question`, `permission` or `error`. A sender that stops at `icon`
-simply leaves it empty, and an empty or unrecognised name is `none`, so a
-four-field payload is a valid one.
+Six fields — `title`, `message`, `urgency`, `icon`, `sound`, `requestID`.
+`sound` is `none`, `done`, `question`, `permission` or `error`. The request id
+is **last**, and it is opaque: it is never shown to you, never passed to a
+command, and never used to build an argument — the only thing it decides is
+whether the notification carries buttons. A sender that stops at `icon`
+simply leaves the rest empty, and an empty or unrecognised name is `none`, so a
+four-field payload is a valid one; a payload with fewer than six fields carries
+no request id at all, and therefore no buttons, so an older sender still works
+against a receiver that expects six.
 
 Newline is safe as the delimiter because both ends strip control characters from
 the free-text fields before assembling or reading it, and `urgency`, `icon` and
 `sound` come from whitelists. No field can contain the delimiter, so a message
 full of spaces, quotes or `*` survives intact.
 
+## The way back
+
+The hop was one-way until now: the notification went up to the desktop and
+nothing came back, because there was nothing on the wire to carry an answer.
+It is two-way now, and what made it two-way was not a new mechanism. **The
+desktop end is an ssh forced command, so its stdout comes back down the same
+ssh connection the notification went up.** That channel was already there and
+nobody used it: a forced command's stdout is carried to whoever opened the
+connection, so the answer rides home on the connection that is already open —
+no second connection, no listener, no port, no new key, no HTTP server.
+
+A permission notification that carries a request id is raised with three
+buttons: **Allow once**, **Always allow** and **Deny**. `notify-send` waits
+for the click and prints the chosen button's *name* on stdout — `once`,
+`always` or `reject`, and "reject" is opencode's own word for deny, not ours.
+The name needs no translation: it is already one of the values the server
+accepts as a permission reply. The plugin reads it off the helper's stdout and
+answers the permission through opencode's own reply route.
+
+Two things follow from the shape. An **empty** stdout means the popup was
+dismissed without a button being chosen: nothing is answered, and the
+permission is left exactly as it was. And a permission that was **already
+answered** — most often in the terminal — comes back as "not found" rather
+than as a failure, because the user did what they had to do and clicking a
+stale notification is not an error.
+
+The wait is bounded: ten minutes on the desktop side, and the hop's own
+deadline is stretched to outlast it, because an answer cut off by a timeout is
+worse than no answer at all.
+
+The buttons are **Linux-only**. `notify-send --action` is the only one of the
+three channels that can offer one — `osascript` and `terminal-notifier` have no
+action support — so a macOS desktop gets a plain notice, and the answer there
+still has to be given in the terminal.
+
 ## Setting it up
 
 Once, on the **remote host** (where opencode runs):
@@ -95,11 +139,20 @@ SOUND is optional and last: `none`, `done`, `question`, `permission` or `error`,
 one bundled tone per outcome. Leave it off and nothing plays; the line above
 without a fifth word is correct.
 
-`notify` is fire-and-forget by design. An unreachable desktop, a missing key, no
-notifier installed at all — all of them print a warning on stderr and exit 0. A
-notification must never be able to fail the process that tried to send one; an
-agent must not go down because a laptop went to sleep. `forward` is the
-exception: it exits with the remote's status, because its caller wants to know.
+`LACODE_REQUEST_ID` in the environment is the one thing that makes a send
+actionable: it is the permission request id, it is opaque, and it is set on the
+helper by the plugin rather than by you. A send with it carries the three
+buttons on Linux and prints the name of the clicked one on stdout; a send
+without it is an ordinary notice that prints nothing.
+
+A plain `notify` is fire-and-forget by design. An unreachable desktop, a
+missing key, no notifier installed at all — all of them print a warning on
+stderr and exit 0. A notification must never be able to fail the process that
+tried to send one; an agent must not go down because a laptop went to sleep.
+`forward` is the exception: it exits with the remote's status, because its
+caller wants to know. An **actionable** notify is the other exception, and it
+is bounded rather than open-ended: it waits for the click, because the answer
+is the whole point of it, and it still exits 0 whatever happens.
 
 On macOS the text is passed to `osascript` as arguments to an `on run argv`
 handler, never spliced into the script source — a session title is not trusted
@@ -115,6 +168,14 @@ delivers locally through the platform channel — `notify-send` on Linux,
 channel as a local send, **the desktop half is not Linux-only**: a Mac desktop
 receives notifications too.
 
+The buttons are the exception to that. Only `notify-send` can offer one, so a
+payload with a request id is an actionable notification on Linux and a plain
+notice — one that prints nothing — on macOS. What the receiver prints on stdout
+is the chosen button's name, and that stdout is what carries the answer back up
+the connection (see [The way back](#the-way-back)). The request id itself is
+never passed to a command and never printed — only its emptiness is ever
+tested.
+
 It never forwards: `SSH_CLIENT` is set for a forced command as well, so it calls
 the local channel directly rather than `notify()` (which would loop back).
 
@@ -152,6 +213,11 @@ documented with the other plugin options in the README. Set it to `0`, `false`,
 `off` or `no` to silence notifications; anything else — a typo included — leaves
 sound on, because a misspelt variable must not be how you turn a feature off.
 
+`LACODE_REQUEST_ID` is absent for the same kind of reason, and it is not yours
+to set either: the plugin puts the permission request id on the helper
+process, and the helper carries it as the payload's sixth field. The hop only
+ever asks whether it is there.
+
 ## The reverse forward
 
 A host that sets `OC_TUNNEL_PORT` and leaves `OC_LOCAL_HOST` unset reaches the
@@ -161,3 +227,7 @@ desktop through a reverse forward: `sendRemote` falls back to an ssh call to
 (`bin/oc-notify-receiver`). That receiver is the Linux end of the hop: it
 delivers through `notify-send`, and libnotify is a Linux thing, so a Mac cannot
 be this end of the tunnel.
+
+The way back works the same way here: the receiver's stdout comes back down
+the forward, on the connection the notification went up, so a click on one of
+the three buttons is carried home the same way it is on the direct hop.

package/docs/USER-STORIES.md

@@ -193,7 +193,7 @@ does not.
 
 **Story ID(s) for tests:** US-11
 **Acceptance criteria:**
-- [ ] Given a session went busy and is now idle, When the idle event fires, Then a `done` notification is delivered.
+- [ ] Given a session went busy and is now idle, When the idle event fires, Then a `done` notification is delivered and stays on the desktop until the user closes it.
 - [ ] Given a session ends with an unrecognized error, When the error event fires, Then an `error` notification is delivered, it bypasses the duplicate-suppression cooldown, and it carries the error's own message.
 - [ ] Given a recognized rate-limit or quota error, or a user abort, When a session error event fires, Then no failure notification is raised — the pool already handles the former and the user already knows the latter.
 - [ ] Given a session that never went busy, When it goes idle, Then no notification is sent.
@@ -211,7 +211,7 @@ does not.
 - [ ] Given a question and a completion occur inside the same cooldown window, When both are evaluated, Then they are not deduplicated against each other.
 
 ### US-25: Notification when opencode asks for permission
-**As a** user, **I want** to be notified when opencode is blocked asking me for permission — including permission to reach a directory outside the worktree — **so that** a silent permission prompt is never mistaken for a hung agent.
+**As a** user, **I want** to be notified when opencode is blocked asking me for permission — including permission to reach a directory outside the worktree — **so that** a silent permission prompt is never mistaken for a hung agent, and so that I can allow or deny it where the notification reaches me instead of going back to the terminal.
 
 **Story ID(s) for tests:** US-25
 **Acceptance criteria:**
@@ -219,8 +219,14 @@ does not.
 - [ ] Given opencode asks to reach a directory outside the worktree, When the prompt fires, Then the notification names that directory, resolved from `metadata.parentDir`/`metadata.filepath` and with the trailing glob trimmed, because a glob is not something the user can judge.
 - [ ] Given the permission is granted, denied, or dismissed, When `permission.replied` fires, Then no notification is sent — the prompt was the thing worth interrupting for, not the answer — and only the parked-session block is cleared.
 - [ ] Given a session is parked on a permission prompt, When the idle event fires, Then no "finished" notification is sent, because nothing finished.
-- [ ] Given the plugin observes a permission prompt, When it handles the event, Then it is a read-only observer: the payload is not mutated and no `permission.ask` hook is registered, because that hook's `output.status` is the permission decision itself.
+- [ ] Given the plugin observes a permission prompt, When it handles the event, Then it registers no `permission.ask` hook and mutates nothing in the payload — that hook's `output.status` is the permission decision itself, and deciding a prompt inside a handler is not the same as answering the one the user was asked for. A permission is answered through the server's own reply route, and only when the user says which answer they meant.
 - [ ] Given a `permission` notification is raised, When it is evaluated against the cooldown, Then it bypasses it, since an unannounced block is the failure this story exists to remove.
+- [ ] Given a permission prompt on Linux, When the notification is delivered, Then it is exactly one notification carrying three buttons — **Allow once**, **Always allow** and **Deny** — and the click raises no second notification.
+- [ ] Given one of those buttons is clicked, When the answer comes back over the hop the notification came up, Then the permission is answered with that button's meaning through the server's reply route; the button names are opencode's own reply values (`once`, `always` and `reject` — the server's word for deny), so a click needs no translation to become an answer.
+- [ ] Given the popup is dismissed without a button being chosen, When the notification returns, Then nothing is answered and the permission is left exactly as it was.
+- [ ] Given the permission was already answered in the terminal, When a button is clicked, Then the reply is a no-op and is not reported as a failure.
+- [ ] Given the desktop is a macOS one, When the same prompt is delivered, Then it is a plain notice with no buttons, because `osascript` and `terminal-notifier` have no action support and the answer still has to be given in the terminal there.
+- [ ] Given a question is asked, When its notification is delivered, Then it carries no buttons and answers nothing, because a question is not a permission: the v1 client this plugin has has no question API at all, and the v2 routes need a bound socket the default TUI does not have.
 
 ### US-29: Notification sounds distinguish outcomes and can be switched off
 **As a** user running many parallel sessions, **I want** each notification to arrive with its own sound, **so that** I can tell a finished session from a question or a permission prompt without looking at the popup.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lawaty/lacode",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "description": "Ultimate opencode setup for Go users — cost-controlled pooled subagents, hang recovery, and notifications for opencode.",
   "license": "MIT",
   "type": "module",

package/presets/README.md

@@ -36,10 +36,10 @@ in place, no JSON and no objects:
 
 ```text
 # provider/model-id                       weight
-opencode-go/longcat-2.5-preview-free      3
-opencode/space-bunny-free                 2
-opencode/big-pickle                       1
-opencode/longcat-2.5-preview-free         1
+opencode/big-pickle                       3
+opencode-go/minimax-m3.1-flash-free       2
+opencode/deepseek-v4.1-flash-free         1
+opencode/glm-5.3-flash-free               1
 ```
 
 `#` starts a comment (whole-line or trailing), blank lines are ignored, and the