@quantiya/codevibe-antigravity-plugin 2.0.9 → 2.0.11

package/dist/server.js

@@ -1121,13 +1121,16 @@ var TmuxPaneObserver = class _TmuxPaneObserver extends import_events2.EventEmitt
         if (kind === "question") {
           const q = extractQuestionHeader(snapshot);
           headerText = q ? q.body : null;
+        } else if (kind === "file_access") {
+          const fileAccess = extractFileAccessPrompt(snapshot);
+          headerText = fileAccess ? fileAccess.identity : null;
         } else if (kind === "approval") {
           headerText = extractHeader(snapshot);
         }
       }
-      return { active, headerText };
+      return { active, headerText, probeSucceeded: true };
     } catch {
-      return { active: false, headerText: null };
+      return { active: false, headerText: null, probeSucceeded: false };
     }
   }
   // ─── tmux pipe-pane plumbing ─────────────────────────────────────────────
@@ -1251,6 +1254,20 @@ var TmuxPaneObserver = class _TmuxPaneObserver extends import_events2.EventEmitt
     this.currentApprovalHeader = extractHeader(candidate.snapshot);
     this.emit("prompt-candidate", candidate);
   }
+  /**
+   * E1 (§6a-2b / F5) — clear the dedup `lastPromptHash` IF it still equals `hash`,
+   * so an UNCHANGED live pane re-emits a fresh 'prompt-candidate'. Called by the
+   * server when an emit-failure rollback discarded the durable record: without this
+   * the observer's `lastPromptHash` still matches the unchanged pane, so
+   * processFileChanges short-circuits (the `snapshotHash === this.lastPromptHash`
+   * guard) and the live prompt is never re-observed = under-nag. The equality guard
+   * targets the EXACT consumed hash so a newer prompt's hash is never clobbered.
+   */
+  resetPromptHash(hash) {
+    if (this.lastPromptHash === hash) {
+      this.lastPromptHash = null;
+    }
+  }
   /** Cancel any in-flight debounce timer + drop the pending candidate.
    *  Called from stop() so a wrapper exit / restart doesn't fire a
    *  prompt for a torn-down observer. Also bumps debounceCycleId so
@@ -1374,7 +1391,7 @@ var TmuxPaneObserver = class _TmuxPaneObserver extends import_events2.EventEmitt
 function looksLikePromptDelta(chunk) {
   return (
     // Approval UI signatures
-    /Requesting permission for:/i.test(chunk) || /Do you want to proceed\?/i.test(chunk) || /\besc to cancel\b/i.test(chunk) || /^\s*[1-9]\. (?:Yes|No)\b/im.test(chunk) || /\[(?:y\/n|Y\/n|y\/N)\]/.test(chunk) || /Question \d+\/\d+:/i.test(chunk) || /\benter Select\b/i.test(chunk)
+    /Requesting permission for:/i.test(chunk) || /Do you want to proceed\?/i.test(chunk) || /\besc to cancel\b/i.test(chunk) || /^\s*[1-9]\. (?:Yes|No)\b/im.test(chunk) || /\[(?:y\/n|Y\/n|y\/N)\]/.test(chunk) || /Question \d+\/\d+:/i.test(chunk) || /\benter Select\b/i.test(chunk) || /^File access\s*$/im.test(chunk) || /Allow access to this file\?/i.test(chunk) || /No, deny access/i.test(chunk)
   );
 }
 function looksLikePromptSnapshot(snapshot) {
@@ -1388,8 +1405,31 @@ function looksLikePromptSnapshot(snapshot) {
   const hasQuestionOptions = /^[>\s]+[1-9]\. \S/im.test(recent);
   const hasQuestionFooter = /\benter Select\b/i.test(recent);
   const isQuestion = hasQuestionHeader && hasQuestionOptions && hasQuestionFooter;
+  const hasFileAccessHeader = /^File access\s*$/im.test(recent);
+  const hasFileAccessQuestion = /Allow access to this file\?/i.test(recent);
+  const isFileAccess = hasFileAccessHeader && hasFileAccessQuestion && hasApprovalOptions && hasApprovalFooter;
   const legacyYN = /\[(?:y\/n|Y\/n|y\/N)\]/.test(recent) && /\b(?:apply|approve|allow|continue|proceed|run|execute|confirm)\b/i.test(recent);
-  return legacyYN || isApproval || isQuestion;
+  return legacyYN || isApproval || isQuestion || isFileAccess;
+}
+function extractFileAccessPrompt(snapshot) {
+  const stripped = snapshot.replace(ANSI_ESCAPE_REGEX, "");
+  const lines = stripped.split("\n");
+  let headingIndex = -1;
+  for (let index = lines.length - 1; index >= 0; index -= 1) {
+    if (/^\s*File access\s*$/i.test(lines[index])) {
+      headingIndex = index;
+      break;
+    }
+  }
+  if (headingIndex < 0) return null;
+  const block = lines.slice(headingIndex, headingIndex + 20);
+  const questionIndex = block.findIndex((line) => /Allow access to this file\?/i.test(line));
+  if (questionIndex < 0) return null;
+  const readLine = block.slice(0, questionIndex + 1).find((line) => /^\s*Read:\s*\S/i.test(line));
+  const identity = readLine?.replace(/^\s*Read:\s*/i, "").trim() || "non-workspace file access";
+  const fullLine = block[questionIndex].trim();
+  const body = block.slice(1, questionIndex).join("\n").trim();
+  return { identity, fullLine, body };
 }
 function extractHeader(snapshot) {
   const stripped = snapshot.replace(ANSI_ESCAPE_REGEX, "");
@@ -1408,8 +1448,10 @@ function detectActivePromptKind(snapshot) {
   const lines = stripped.split("\n");
   const approvalRe = /Requesting permission for:/i;
   const questionRe = /Question \d+\/\d+:/i;
+  const fileAccessRe = /^\s*File access\s*$/i;
   let lastApprovalLineIdx = -1;
   let lastQuestionLineIdx = -1;
+  let lastFileAccessLineIdx = -1;
   for (let i = lines.length - 1; i >= 0; i--) {
     if (lastApprovalLineIdx < 0 && approvalRe.test(lines[i])) {
       lastApprovalLineIdx = i;
@@ -1417,10 +1459,15 @@ function detectActivePromptKind(snapshot) {
     if (lastQuestionLineIdx < 0 && questionRe.test(lines[i])) {
       lastQuestionLineIdx = i;
     }
-    if (lastApprovalLineIdx >= 0 && lastQuestionLineIdx >= 0) break;
+    if (lastFileAccessLineIdx < 0 && fileAccessRe.test(lines[i])) {
+      lastFileAccessLineIdx = i;
+    }
+    if (lastApprovalLineIdx >= 0 && lastQuestionLineIdx >= 0 && lastFileAccessLineIdx >= 0) break;
   }
-  if (lastApprovalLineIdx < 0 && lastQuestionLineIdx < 0) return null;
-  if (lastQuestionLineIdx > lastApprovalLineIdx) return "question";
+  const latest = Math.max(lastApprovalLineIdx, lastQuestionLineIdx, lastFileAccessLineIdx);
+  if (latest < 0) return null;
+  if (latest === lastFileAccessLineIdx) return "file_access";
+  if (latest === lastQuestionLineIdx) return "question";
   return "approval";
 }
 function extractQuestionHeader(snapshot) {
@@ -1454,10 +1501,17 @@ var import_events3 = require("events");
 var import_uuid = require("uuid");
 
 // src/prompt-parser.ts
+var import_crypto2 = require("crypto");
 function parseApprovalSnapshot(snapshot) {
   if (!snapshot) return null;
   const stripped = stripAnsi(snapshot);
   const kind = detectActivePromptKind(stripped);
+  if (kind === "file_access") {
+    const fileAccess = extractFileAccessPrompt(stripped);
+    if (fileAccess) {
+      return parseFileAccessSnapshot(stripped, snapshot, fileAccess);
+    }
+  }
   if (kind === "question") {
     const questionHeader = extractQuestionHeader(stripped);
     if (questionHeader) {
@@ -1466,6 +1520,49 @@ function parseApprovalSnapshot(snapshot) {
   }
   return parseApprovalUISnapshot(stripped, snapshot);
 }
+function buildApprovalSemanticKey(candidate) {
+  const normalize = (value) => value.replace(/\s+/g, " ").trim();
+  const payload = {
+    kind: candidate.kind,
+    headerText: normalize(candidate.headerText),
+    body: normalize(candidate.body),
+    options: candidate.options.map((option) => ({
+      number: option.number,
+      text: normalize(option.text)
+    })),
+    submitMap: Object.fromEntries(
+      Object.entries(candidate.submitMap).sort(([left], [right]) => Number(left) - Number(right)).map(([number, keys]) => [number, [...keys]])
+    )
+  };
+  return (0, import_crypto2.createHash)("sha256").update(JSON.stringify(payload)).digest("hex");
+}
+function hasNegativeApprovalOption(options) {
+  return options.some((option) => /^(?:no|deny|reject|cancel)\b/i.test(option.text.trim()));
+}
+function parseFileAccessSnapshot(stripped, originalSnapshot, prompt) {
+  const lines = stripped.split("\n");
+  let questionIndex = -1;
+  for (let index = lines.length - 1; index >= 0; index -= 1) {
+    if (/Allow access to this file\?/i.test(lines[index])) {
+      questionIndex = index;
+      break;
+    }
+  }
+  const belowQuestion = questionIndex >= 0 ? lines.slice(questionIndex + 1).join("\n") : stripped;
+  const options = parseOptions(belowQuestion);
+  if (options.length < 2 || !hasNegativeApprovalOption(options)) return null;
+  return {
+    kind: "approval",
+    headerText: prompt.identity,
+    fullHeaderLine: prompt.fullLine,
+    command: void 0,
+    filePath: prompt.identity === "non-workspace file access" ? void 0 : prompt.identity,
+    options,
+    submitMap: buildApprovalSubmitMap(options),
+    body: prompt.body,
+    paneHash: hashPromptSnapshot(originalSnapshot)
+  };
+}
 function parseApprovalUISnapshot(stripped, originalSnapshot) {
   const headerText = extractHeader(stripped);
   if (!headerText) return null;
@@ -1480,7 +1577,7 @@ function parseApprovalUISnapshot(stripped, originalSnapshot) {
   }
   const belowHeader = headerIdx >= 0 ? lines.slice(headerIdx + 1).join("\n") : stripped;
   const options = parseOptions(belowHeader);
-  if (options.length < 2) return null;
+  if (options.length < 2 || !hasNegativeApprovalOption(options)) return null;
   const submitMap = buildApprovalSubmitMap(options);
   const { command, filePath } = extractIdentity(headerText);
   const body = extractBodyBetweenHeaderAndFirstOption(belowHeader);
@@ -1738,14 +1835,14 @@ var ApprovalDetector = class extends import_events3.EventEmitter {
    * Returns the emitted state, or null if dedupe (already emitted for
    * this paneHash) or disabled.
    */
-  emitPaneOnlyPrompt(candidate, conversationId) {
+  emitPaneOnlyPrompt(candidate, conversationId, forcedPromptId) {
     if (this.paneOnlyEmittedHashes.has(candidate.paneHash)) {
       logger.debug("Skipping pane-only re-emit for duplicate paneHash", {
         paneHash: candidate.paneHash.substring(0, 16)
       });
       return null;
     }
-    const promptId = (0, import_uuid.v4)();
+    const promptId = forcedPromptId ?? (0, import_uuid.v4)();
     const syntheticCall = {
       conversationId,
       intentStepIndex: -1,
@@ -1771,9 +1868,14 @@ var ApprovalDetector = class extends import_events3.EventEmitter {
       matchedPaneHeader: candidate.headerText,
       paneDisplayHeader: candidate.fullHeaderLine,
       body: candidate.body,
+      paneOptions: candidate.options,
+      paneSemanticKey: buildApprovalSemanticKey(candidate),
       emittedAt: Date.now(),
       ttlMs: this.promptTtlMs,
-      paneOptions: candidate.options
+      // E1 (§6a-2b / F5) — carry the consumed pane hash so an emit-failure
+      // rollback can reset the observer's lastPromptHash and let the unchanged
+      // live pane re-emit.
+      paneHash: candidate.paneHash
     };
     this.pendingPrompts.set(promptId, state);
     this.paneOnlyEmittedHashes.add(candidate.paneHash);
@@ -1956,6 +2058,8 @@ var ApprovalDetector = class extends import_events3.EventEmitter {
       matchedPaneHeader: candidate.headerText,
       paneDisplayHeader: candidate.fullHeaderLine,
       body: candidate.body,
+      paneOptions: candidate.options,
+      paneSemanticKey: buildApprovalSemanticKey(candidate),
       emittedAt: Date.now(),
       ttlMs: this.promptTtlMs
     };
@@ -2036,6 +2140,10 @@ var ApprovalDetector = class extends import_events3.EventEmitter {
   getPendingPrompt(promptId) {
     return this.pendingPrompts.get(promptId) ?? null;
   }
+  getPendingPromptsForConversation(conversationId) {
+    const pending = Array.from(this.pendingPrompts.values());
+    return conversationId ? pending.filter((state) => state.conversationId === conversationId) : pending;
+  }
   // ─── Read-only accessors ────────────────────────────────────────────────
   getPendingCalls() {
     return Array.from(this.pendingCalls.values());
@@ -2089,21 +2197,6 @@ var ApprovalDetector = class extends import_events3.EventEmitter {
         this.emit("pending-call-expired", call);
       }
     }
-    let anyExpired = false;
-    for (const [promptId, state] of this.pendingPrompts.entries()) {
-      if (now - state.emittedAt > state.ttlMs) {
-        this.pendingPrompts.delete(promptId);
-        this.resolvedPrompts.set(promptId, now);
-        anyExpired = true;
-        logger.debug("Pending prompt expired (TTL)", {
-          promptId,
-          ageMs: now - state.emittedAt
-        });
-      }
-    }
-    if (anyExpired) {
-      this.paneOnlyEmittedHashes.clear();
-    }
     for (const [promptId, resolvedAt] of this.resolvedPrompts.entries()) {
       if (now - resolvedAt > 5 * 6e4) {
         this.resolvedPrompts.delete(promptId);
@@ -2210,22 +2303,11 @@ var PromptResponder = class {
         };
       }
       if (this.paneObserver) {
-        const probe = await this.paneObserver.probeApprovalUIActive();
-        if (!probe.active) {
-          this.detector.resolvePrompt(promptId);
+        if (!state.paneSemanticKey) {
           return {
             ok: false,
-            reason: "prompt-superseded",
-            details: "approval UI vanished from pane (likely user approved on desktop)"
-          };
-        }
-        const expectedHeader = state.matchedPaneHeader;
-        if (expectedHeader && probe.headerText && !sameIdentity(probe.headerText, expectedHeader)) {
-          this.detector.resolvePrompt(promptId);
-          return {
-            ok: false,
-            reason: "prompt-superseded",
-            details: `pane shows '${probe.headerText}' but matched-against header was '${expectedHeader}'`
+            reason: "prompt-probe-failed",
+            details: "pending prompt has no exact semantic identity"
           };
         }
       }
@@ -2239,6 +2321,51 @@ var PromptResponder = class {
       }
       try {
         for (const key of keys) {
+          if (!this.detector || !this.paneObserver) {
+            return {
+              ok: false,
+              reason: "prompt-probe-failed",
+              details: "approval responder is missing its detector or pane observer"
+            };
+          }
+          if (this.detector.getPendingPrompt(promptId) !== state) {
+            return { ok: false, reason: "prompt-expired" };
+          }
+          let liveSemanticKey = null;
+          try {
+            const snapshot = await this.paneObserver.captureSnapshot();
+            const live = parseApprovalSnapshot(snapshot);
+            if (!live) {
+              if (detectActivePromptKind(snapshot) === null) {
+                this.detector.resolvePrompt(promptId);
+                return {
+                  ok: false,
+                  reason: "prompt-superseded",
+                  details: "the approval chooser is no longer active"
+                };
+              }
+              return {
+                ok: false,
+                reason: "prompt-probe-failed",
+                details: "the active chooser could not be parsed exactly"
+              };
+            }
+            liveSemanticKey = live ? buildApprovalSemanticKey(live) : null;
+          } catch (error) {
+            return {
+              ok: false,
+              reason: "prompt-probe-failed",
+              details: error instanceof Error ? error.message : String(error)
+            };
+          }
+          if (liveSemanticKey !== state.paneSemanticKey) {
+            this.detector.resolvePrompt(promptId);
+            return {
+              ok: false,
+              reason: "prompt-superseded",
+              details: "active chooser semantics differ from the mobile prompt"
+            };
+          }
           if (isNamedKey(key)) {
             await this.sendKey(target, key);
           } else {
@@ -2271,6 +2398,43 @@ var PromptResponder = class {
       };
     }
   }
+  async sendFreeFormWhenNoApprovalActive(text) {
+    const target = this.resolveTmuxTarget();
+    if (!target) return { ok: false, reason: "no-tmux-target" };
+    if (!this.paneObserver) {
+      return {
+        ok: false,
+        reason: "prompt-probe-failed",
+        details: "pane observer is required for safe free-form input"
+      };
+    }
+    const chooserIsAbsent = async () => {
+      const probe = await this.paneObserver.probeApprovalUIActive();
+      if (!probe.probeSucceeded) {
+        return { ok: false, reason: "prompt-probe-failed" };
+      }
+      if (probe.active) {
+        return { ok: false, reason: "prompt-superseded" };
+      }
+      return null;
+    };
+    try {
+      const beforeText = await chooserIsAbsent();
+      if (beforeText) return beforeText;
+      await this.typeLiteral(target, text);
+      await delay(ENTER_DELAY_MS);
+      const beforeEnter = await chooserIsAbsent();
+      if (beforeEnter) return beforeEnter;
+      await this.sendKey(target, "Enter");
+      return { ok: true };
+    } catch (error) {
+      return {
+        ok: false,
+        reason: "tmux-failed",
+        details: error instanceof Error ? error.message : String(error)
+      };
+    }
+  }
   // ─── Tmux primitives ────────────────────────────────────────────────────
   async typeLiteral(target, text) {
     const escaped = text.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\$/g, "\\$").replace(/`/g, "\\`");
@@ -2296,9 +2460,6 @@ function isNamedKey(key) {
 function delay(ms) {
   return new Promise((r) => setTimeout(r, ms));
 }
-function sameIdentity(headerFromPane, expected) {
-  return headerFromPane.trim() === expected.trim();
-}
 
 // src/mobile-prompt-dedupe.ts
 var DEFAULT_EXPIRY_MS = 15e3;
@@ -2816,7 +2977,7 @@ function truncate(s, maxBytes) {
 // src/server.ts
 var MOBILE_PROMPT_FLOOR_RECENCY_MS = 12e4;
 var LAUNCH_SETTLE_TIMEOUT_MS = 3e3;
-var McpServer = class {
+var McpServer = class _McpServer {
   constructor(options) {
     /** Per-session causal floor for transcript-event timestamps emitted right
      *  after a MOBILE prompt. The mobile USER_PROMPT is created by the iOS app
@@ -2833,6 +2994,59 @@ var McpServer = class {
      *  under this single sessionId. /resume does NOT create a new
      *  session — same row. */
     this.session = null;
+    // E1 (§4/§6a-4) — per-promptId durable raise entries for the agy producer.
+    // Keyed by the E1 promptId (= derive(ownerToken)); each holds the SECRET
+    // ownerToken so a resume/retirement re-raise re-commits the SAME promptId
+    // (WRITE_ROW on the ownerToken=:token branch → no duplicate row, no under-nag).
+    // This in-memory Map is the AUTHORITATIVE E1 ledger. It outlives the detector's
+    // 60s/5min timer (§3.1), so the TTL-refresh, wake, and retirement re-raises
+    // always cover every still-open prompt this daemon raised. Process-restart
+    // recovery is OUT of v1 scope (F1): a daemon crash is handled by disconnect-
+    // suppression + per-row TTL (design §8), and agy re-observes a live pane on
+    // restart — so there is NO disk persistence (removing it also stops writing the
+    // secret ownerToken to a tmp file). agy is single-session, so sessionId is the
+    // one live session's id.
+    this.e1PromptRaises = /* @__PURE__ */ new Map();
+    // E1 (§6a-2b) — session-scoped content-key → promptId index for the
+    // suppressed-prompt COLLAPSE rule. Key = `${sessionId}::${contentKey}`. A
+    // suppression whose content-key already maps to a LIVE ledger record collapses
+    // onto it (over-nag, never under-nag); an ABSENT content-key mints a fresh badge.
+    this.e1ContentKeyIndex = /* @__PURE__ */ new Map();
+    // E1 (§3.1) — periodic liveness TTL co-refresh for the open-prompt ledger.
+    this.e1TtlRefreshTimer = null;
+    // 5 min (7-day TTL)
+    // E1 (§6a-4) — single-flight guard for the retirement recovery re-raise.
+    this.retiredSessionRecoveryPromise = null;
+    // E1 (§6a-4 / F3) — promptIds whose re-raise (retirement re-point or return-
+    // driven full re-raise) exhausted reRaiseOneE1's bounded per-call attempts and
+    // must keep being retried until the backend acknowledges ("the prompt is never
+    // lost"). drainPendingE1ReRaises re-attempts each still-present entry every TTL
+    // tick; reRaiseOneE1 clears an id on ack and re-flags it on another exhaustion.
+    // Without this a failed retirement re-raise would leave the entry present so
+    // refreshE1Ttls finds it → refreshes → returns no aged-out → never re-fires,
+    // leaving the backend row permanently pointed at the RETIRED session = under-nag.
+    this.e1NeedsReRaise = /* @__PURE__ */ new Set();
+    // E1 (§6a-4 / F2) — bounded exponential backoff for the BLOCK-UNTIL-ACK
+    // retirement re-raise (the pre-heartbeat drain in createLaunchSession, which must
+    // ACK before the replacement's heartbeat advertises liveness — design line 93).
+    // The general (bounded, non-blocking) TTL-drain path keeps its shipped linear
+    // 250·attempt backoff. Overridable in tests so a multi-failure block-until-ack
+    // re-raise doesn't wait real seconds.
+    this.e1BlockingReRaiseBackoff = { baseMs: 250, maxMs: 2e3 };
+    // E1 (§6a-4) — DURABLE park for retirement-orphans awaiting re-home (G-1 fix).
+    // When the backend retires the live session, its still-open prompts are
+    // snapshotted here (FULL records — incl. the secret ownerToken + pre-encryption
+    // content) *before* the replacement-launch attempt, so a transient launch failure
+    // can NOT lose them (the pre-fix snapshot was a LOCAL closure var re-raised only
+    // inside the replacement's pre-heartbeat hook — if that launch failed before the
+    // hook ran, the snapshot was lost and the ledger rows stayed pointed at the
+    // RETIRED session = stranded badgeless live prompt). Drained + re-homed onto the
+    // NEXT successfully-launched session (in createLaunchSession, BEFORE its heartbeat
+    // — §F2) and, as a backstop, on every TTL tick — so a retirement whose OWN
+    // replacement launch failed is still recovered by a later normal activity launch.
+    // Keyed by promptId so re-parks dedupe. In-memory only (process-restart recovery
+    // is out of v1 scope, F1); cleared on a full doStop.
+    this.e1RetirementPark = /* @__PURE__ */ new Map();
     /** Single subscription for the launch session (v9 — was per-conv Map). */
     this.subscription = null;
     /** Wrapper-level disable flag (free-tier limit / collision). v9
@@ -2935,6 +3149,9 @@ var McpServer = class {
       getActiveSession: () => this.getAnySession()
     });
   }
+  static {
+    this.E1_TTL_REFRESH_MS = 5 * 60 * 1e3;
+  }
   // ─── Lifecycle ──────────────────────────────────────────────────────────
   async start() {
     if (this.started) throw new Error("McpServer.start() called twice");
@@ -3126,6 +3343,8 @@ var McpServer = class {
       logger.warn("appSyncClient.cleanupSubscriptions failed", { error: String(err) });
     }
     this.session = null;
+    this.stopE1TtlRefresh();
+    this.e1RetirementPark.clear();
     this.sessionDisabled = false;
     this.launchKeyUnavailable = false;
     this.ensureLaunchInFlight = null;
@@ -3185,6 +3404,16 @@ var McpServer = class {
    * events under this single sessionId. /resume does NOT create a new
    * row. (Codex Stage 2 R1 v5/v6/v7 switch machinery is now dead code,
    * removed.)
+   *
+   * E1 (§6a-4 / F2) — AFTER the session + subscription are wired but BEFORE the
+   * heartbeat advertises liveness, this drains the durable retirement park onto
+   * THIS session (see {@link drainE1RetirementPark}). So the open prompts of a
+   * retired session are re-pointed onto their replacement (backend-ACK'd) before the
+   * first `lastHeartbeatAt` write — otherwise the client would see a connected
+   * session whose rows still point at the RETIRED session = under-nag (design line
+   * 93). Running on EVERY successful launch (not just the retirement-recovery
+   * re-bootstrap) is what lets a later normal activity launch recover a retirement
+   * whose own replacement launch had failed transiently (G-1).
    */
   async createLaunchSession() {
     const gen = this.lifecycleGen;
@@ -3268,7 +3497,9 @@ var McpServer = class {
             logger.error("handleMobileEvent failed", { error: String(err) });
           });
         },
-        (err) => logger.warn("AppSync subscription error", { error: String(err) })
+        (err) => logger.warn("AppSync subscription error", { error: String(err) }),
+        // E1 (§6a-4) — recover open prompts if the backend retires this session.
+        { onSessionRetired: () => this.recoverRetiredBackendSession(sessionId) }
       );
       if (gen !== this.lifecycleGen || !this.started) {
         try {
@@ -3282,6 +3513,8 @@ var McpServer = class {
     } catch (err) {
       logger.error("subscribeToEvents failed (non-fatal)", { sessionId, error: String(err) });
     }
+    await this.drainE1RetirementPark({ retryUntilAck: true, gen });
+    if (gen !== this.lifecycleGen || !this.started) return;
     try {
       this.appSyncClient.startHeartbeat(sessionId);
     } catch (err) {
@@ -3444,6 +3677,395 @@ var McpServer = class {
       isEncrypted: true
     };
   }
+  // ─── E1 missed-prompt recovery (§4/§6a) — in-memory ledger + raise helpers ───
+  //
+  // The authoritative ledger is the in-memory `e1PromptRaises` Map (see its field
+  // docstring): it outlives the detector's timer, which is all §6a-4 durability
+  // requires. There is deliberately NO disk persistence — process-restart recovery
+  // is out of v1 scope (F1), and persisting the secret ownerToken to a tmp file was
+  // write-only dead code (never read back on startup).
+  /**
+   * Mint a NEW E1 raise for the agy producer: derive a committed promptId from a
+   * fresh secret, stash a durable entry (identity only — content added at
+   * emit-success via {@link stashE1RaiseContent}), start the TTL timer, and return
+   * the record. `mobileActionable=false` for a suppressed prompt (badge-only
+   * NOTIFICATION carrier, no fabricated options).
+   */
+  newE1Raise(sessionId, mobileActionable, title) {
+    const { record } = (0, import_codevibe_core4.newPromptRaise)({
+      sessionId,
+      producerKind: "PLUGIN_APPROVAL",
+      mobileActionable,
+      agentType: "ANTIGRAVITY",
+      ...title !== void 0 && { title }
+    });
+    this.e1PromptRaises.set(record.promptId, { record });
+    if (!this.e1TtlRefreshTimer) this.startE1TtlRefresh();
+    return record;
+  }
+  /**
+   * E1 (§6a-4) — stash the PRE-ENCRYPTION payload on an already-minted raise entry
+   * at emit-success, so a retirement re-raise can re-encrypt it for the
+   * (replacement) session's key and re-emit the SAME actionable prompt. No-op if
+   * the entry is gone (superseded) or the emit aborted.
+   */
+  stashE1RaiseContent(promptId, contentPlain, metadataPlain) {
+    const entry = this.e1PromptRaises.get(promptId);
+    if (!entry) return;
+    entry.contentPlain = contentPlain;
+    entry.metadataPlain = metadataPlain;
+  }
+  /**
+   * E1 (§6a-2b) — emit the badge-only carrier for a SUPPRESSED prompt (options
+   * couldn't be parsed → mobile must NOT fabricate any). A NOTIFICATION carrying
+   * the raise identity with mobileActionable=false, so the backend's classifyRaise
+   * records/updates the open-prompt row: mobile shows a banner + NO option buttons.
+   * Content is E2E-encrypted; the raise identity rides plaintext top-level.
+   * Fail-closed on a missing session key — never cleartext.
+   */
+  async emitSuppressedPromptCarrier(session, record) {
+    const bannerText = "\u26A0\uFE0F A prompt is waiting in your desktop terminal, but its options could not be shown here. Please answer it on your desktop.";
+    const input = {
+      sessionId: session.sessionId,
+      type: import_codevibe_core4.EventType.NOTIFICATION,
+      source: import_codevibe_core4.EventSource.DESKTOP,
+      content: bannerText,
+      metadata: { e1SuppressedPrompt: true },
+      ...(0, import_codevibe_core4.raiseFieldsFromRecord)(record),
+      notificationText: bannerText,
+      timestamp: (0, import_codevibe_core4.prepareEventTimestamp)({ orderingKey: session.sessionId })
+    };
+    const outbound = this.encryptOutbound(session, input);
+    if (!outbound) return false;
+    await this.appSyncClient.createEvent(outbound);
+    logger.info("E1: emitted suppressed-prompt badge carrier (mobileActionable=false)", {
+      sessionId: session.sessionId,
+      promptId: record.promptId
+    });
+    return true;
+  }
+  /**
+   * E1 (§6a-2b) — badge-only raise for a SUPPRESSED prompt, applying the content-key
+   * COLLAPSE rule. If a LIVE ledger record already covers this content-key in this
+   * session → COLLAPSE (its row keeps the session badge lit; over-nag, never
+   * under-nag). Otherwise mint a fresh mobileActionable:false raise + emit the
+   * NOTIFICATION carrier. A null content-key always mints (can't prove a
+   * re-observation) — never under-nag.
+   */
+  raiseSuppressedBadge(session, contentKey) {
+    if (contentKey) {
+      const idxKey = `${session.sessionId}::${contentKey}`;
+      const existingId = this.e1ContentKeyIndex.get(idxKey);
+      if (existingId && this.e1PromptRaises.has(existingId)) return;
+      if (existingId) this.e1ContentKeyIndex.delete(idxKey);
+    }
+    const record = this.newE1Raise(session.sessionId, false);
+    if (contentKey) this.e1ContentKeyIndex.set(`${session.sessionId}::${contentKey}`, record.promptId);
+    this.emitSuppressedPromptCarrier(session, record).catch((e) => {
+      logger.error("E1: failed to emit suppressed-prompt badge carrier", {
+        sessionId: session.sessionId,
+        promptId: record.promptId,
+        error: e instanceof Error ? e.message : String(e)
+      });
+    });
+  }
+  /** Snapshot the still-open E1 entries for a session (deep copy of the record). */
+  snapshotOpenE1(sessionId) {
+    return [...this.e1PromptRaises.values()].filter((e) => e.record.sessionId === sessionId).map((e) => ({
+      record: { ...e.record },
+      ...e.contentPlain !== void 0 && { contentPlain: e.contentPlain },
+      ...e.metadataPlain !== void 0 && { metadataPlain: e.metadataPlain }
+    }));
+  }
+  /**
+   * E1 (§6a-4) — re-raise a snapshot of still-open prompts from a RETIRED session
+   * onto its live REPLACEMENT session, re-committing the SAME promptId + ownerToken
+   * (the backend re-points the row's sessionId → the replacement; no orphan, no
+   * under-nag). Actionable → INTERACTIVE_PROMPT (re-encrypted real options);
+   * badge-only / content-less → NOTIFICATION carrier. Retries transient failures.
+   */
+  async reRaiseSnapshotE1(snapshot, replacementSession, opts) {
+    if (snapshot.length === 0) return [];
+    logger.info("E1: re-raising open prompts onto replacement session", {
+      replacementSessionId: replacementSession.sessionId,
+      count: snapshot.length
+    });
+    const unacked = [];
+    for (const snap of snapshot) {
+      const entry = {
+        record: { ...snap.record, sessionId: replacementSession.sessionId },
+        ...snap.contentPlain !== void 0 && { contentPlain: snap.contentPlain },
+        ...snap.metadataPlain !== void 0 && { metadataPlain: snap.metadataPlain }
+      };
+      this.e1PromptRaises.set(entry.record.promptId, entry);
+      const acked = await this.reRaiseOneE1(replacementSession, entry, opts);
+      if (!acked) unacked.push(snap);
+    }
+    if (!this.e1TtlRefreshTimer) this.startE1TtlRefresh();
+    return unacked;
+  }
+  /**
+   * E1 (§6a-4) — drain the DURABLE retirement park onto the current live session:
+   * re-home each parked orphan (record.sessionId → this session) and re-raise it
+   * ({@link reRaiseSnapshotE1} → {@link reRaiseOneE1}, retry-until-ack via
+   * `e1NeedsReRaise`). This is the second half of the G-1 fix: the park survives a
+   * failed replacement launch, so ANY later successful launch (or TTL tick) re-homes
+   * the orphans that the pre-fix closure snapshot would have lost. agy is
+   * single-session, so the re-home target is unambiguously `this.session`.
+   *
+   * The park entries are moved into the authoritative `e1PromptRaises` ledger by
+   * reRaiseSnapshotE1 (which stamps the new sessionId), so the park is CLEARED up
+   * front — the snapshot + clear are synchronous (no yield) so a concurrent drain
+   * can't double-process, and once handed off the ledger + retry-until-ack own the
+   * entries. No-op when the park is empty or no live session exists yet (retry on
+   * the next launch / tick — never lost).
+   */
+  async drainE1RetirementPark(opts) {
+    if (this.e1RetirementPark.size === 0) return;
+    const session = this.session;
+    if (!session) return;
+    const parked = [...this.e1RetirementPark.values()];
+    this.e1RetirementPark.clear();
+    const unacked = await this.reRaiseSnapshotE1(parked, session, opts);
+    if (unacked.length > 0) {
+      for (const snap of unacked) this.e1RetirementPark.set(snap.record.promptId, snap);
+      logger.info("E1: retirement park drain aborted before ACK \u2014 re-parked for next launch", {
+        sessionId: session.sessionId,
+        retained: unacked.length
+      });
+    }
+  }
+  /**
+   * E1 (§6a-4 / F2) — lifecycle-supersede predicate for the BLOCK-UNTIL-ACK
+   * retirement re-raise. True once the launch generation that started the drain has
+   * been superseded (`gen` mismatch — a stop()→start() ran) OR the daemon has
+   * stopped (`started` is false — a doStop() is in flight). A stopped daemon returns
+   * true even without a `gen`, so the block-until-ack loop can never hang past a
+   * stop. Only the F2 path consults this; the bounded general path ignores it.
+   */
+  reRaiseSuperseded(gen) {
+    if (!this.started) return true;
+    return gen !== void 0 && gen !== this.lifecycleGen;
+  }
+  /**
+   * E1 (§6a-4 / F2) — sleep up to `ms`, waking ~every 50ms to re-check
+   * {@link reRaiseSuperseded} so a stop()/stop()→start() breaks a block-until-ack
+   * backoff PROMPTLY (within ~50ms) rather than after a full backoff interval.
+   * Returns immediately once superseded/stopped.
+   */
+  async interruptibleBackoff(ms, gen) {
+    const deadline = Date.now() + ms;
+    while (Date.now() < deadline) {
+      if (this.reRaiseSuperseded(gen)) return;
+      const slice = Math.min(50, deadline - Date.now());
+      if (slice <= 0) return;
+      await new Promise((resolve3) => setTimeout(resolve3, slice));
+    }
+  }
+  /**
+   * Re-emit ONE E1 entry on `session`, retrying transient failures (§6.8).
+   *
+   * Two modes:
+   *  - BOUNDED general path (default): a per-call backoff over `MAX_ATTEMPTS`
+   *    (linear 250·attempt); on exhaustion it FLAGS the promptId in `e1NeedsReRaise`
+   *    (entry retained, F3) so drainPendingE1ReRaises keeps retrying every TTL tick
+   *    until the backend acknowledges — "the prompt is never lost" (§6a-4).
+   *  - BLOCK-UNTIL-ACK path (`opts.retryUntilAck`, F2 — the pre-heartbeat
+   *    retirement drain in createLaunchSession): retries with a bounded EXPONENTIAL
+   *    backoff and does NOT give up after `MAX_ATTEMPTS`, so the caller (and thus the
+   *    replacement session's heartbeat) waits until the row is re-pointed and
+   *    backend-ACK'd (design line 93 — re-point BEFORE advertising liveness). The
+   *    ONLY exit other than ACK is LIFECYCLE-SUPERSEDE ({@link reRaiseSuperseded}
+   *    on the captured `opts.gen` / `started`), which flags e1NeedsReRaise (entry
+   *    retained → the general net repairs it) and bails so a superseded/stopped
+   *    lifecycle never advertises liveness for a mis-pointed row. Bounded against a
+   *    hang because the re-raise createEvent and the heartbeat hit the SAME backend:
+   *    a down backend fails both (no false-connected), an up backend ACKs quickly.
+   *
+   * On ACK it clears the promptId from `e1NeedsReRaise`. A keyless fail-closed return
+   * leaves the flag as-is so a later tick re-attempts once a key resolves.
+   */
+  async reRaiseOneE1(session, entry, opts) {
+    const rec = entry.record;
+    const actionable = rec.mobileActionable && entry.contentPlain !== void 0;
+    const retryUntilAck = opts?.retryUntilAck === true;
+    const gen = opts?.gen;
+    const MAX_ATTEMPTS = 4;
+    for (let attempt = 1; ; attempt++) {
+      if (retryUntilAck && this.reRaiseSuperseded(gen)) {
+        this.e1NeedsReRaise.add(rec.promptId);
+        logger.warn("E1: block-until-ack re-raise aborted (lifecycle superseded/stopping) \u2014 flagged for retry-until-ack (entry retained)", {
+          sessionId: session.sessionId,
+          promptId: rec.promptId
+        });
+        return false;
+      }
+      try {
+        if (actionable) {
+          const input = {
+            sessionId: session.sessionId,
+            type: import_codevibe_core4.EventType.INTERACTIVE_PROMPT,
+            source: import_codevibe_core4.EventSource.DESKTOP,
+            content: entry.contentPlain,
+            metadata: entry.metadataPlain ?? {},
+            ...(0, import_codevibe_core4.raiseFieldsFromRecord)(rec),
+            timestamp: (0, import_codevibe_core4.prepareEventTimestamp)({ orderingKey: session.sessionId })
+          };
+          const outbound = this.encryptOutbound(session, input);
+          if (!outbound) return false;
+          await this.appSyncClient.createEvent(outbound);
+        } else {
+          rec.mobileActionable = false;
+          if (!await this.emitSuppressedPromptCarrier(session, rec)) return false;
+        }
+        this.e1NeedsReRaise.delete(rec.promptId);
+        logger.info("E1: re-raised prompt onto replacement session", {
+          sessionId: session.sessionId,
+          promptId: rec.promptId,
+          actionable
+        });
+        return true;
+      } catch (e) {
+        if (!retryUntilAck && attempt >= MAX_ATTEMPTS) {
+          this.e1NeedsReRaise.add(rec.promptId);
+          logger.error("E1: re-raise failed after bounded attempts \u2014 flagged for retry-until-ack (entry retained)", {
+            sessionId: session.sessionId,
+            promptId: rec.promptId,
+            error: e instanceof Error ? e.message : String(e)
+          });
+          return false;
+        }
+        if (retryUntilAck) {
+          const delay2 = Math.min(
+            this.e1BlockingReRaiseBackoff.baseMs * 2 ** (attempt - 1),
+            this.e1BlockingReRaiseBackoff.maxMs
+          );
+          await this.interruptibleBackoff(delay2, gen);
+        } else {
+          await new Promise((resolve3) => setTimeout(resolve3, 250 * attempt));
+        }
+      }
+    }
+  }
+  /**
+   * E1 (§6a-4 / F3) — retry-until-ack driver. Re-attempts reRaiseOneE1 for each
+   * promptId still flagged in `e1NeedsReRaise` whose ledger entry is present on the
+   * live session; reRaiseOneE1 clears the flag on ACK or re-flags it on another
+   * exhaustion. A flagged promptId whose ledger entry is gone (superseded/resolved)
+   * is dropped. Called at the top of every refreshE1Ttls tick so a failed
+   * retirement re-point is repaired even though the entry is present (so the row-
+   * exists refresh path never returns it as aged-out).
+   */
+  async drainPendingE1ReRaises() {
+    if (this.e1NeedsReRaise.size === 0) return;
+    const session = this.session;
+    for (const promptId of [...this.e1NeedsReRaise]) {
+      const entry = this.e1PromptRaises.get(promptId);
+      if (!entry) {
+        this.e1NeedsReRaise.delete(promptId);
+        continue;
+      }
+      if (!session || entry.record.sessionId !== session.sessionId) continue;
+      await this.reRaiseOneE1(session, entry);
+    }
+  }
+  /**
+   * E1 (§3.1) — one TTL-refresh tick for the current session's open prompts so a
+   * long-open prompt is never TTL-deleted (under-nag). Aged-out promptIds are
+   * re-materialized via reRaiseOneE1 (return-driven re-raise).
+   */
+  async refreshE1Ttls() {
+    await this.drainPendingE1ReRaises();
+    await this.drainE1RetirementPark();
+    const session = this.session;
+    if (!session) return;
+    const sid = session.sessionId;
+    const promptIds = [...this.e1PromptRaises.values()].filter((e) => e.record.sessionId === sid).map((e) => e.record.promptId);
+    if (promptIds.length === 0) return;
+    try {
+      const agedOut = await this.appSyncClient.refreshOpenPromptTtl(promptIds);
+      for (const promptId of agedOut) {
+        const entry = this.e1PromptRaises.get(promptId);
+        if (entry && this.session && entry.record.sessionId === this.session.sessionId) {
+          await this.reRaiseOneE1(this.session, entry);
+        }
+      }
+    } catch (e) {
+      logger.warn("E1: TTL-refresh tick failed (non-fatal, retries next tick)", {
+        error: e instanceof Error ? e.message : String(e)
+      });
+    }
+  }
+  /** Start the E1 TTL-refresh timer (idempotent — never stacks). */
+  startE1TtlRefresh() {
+    if (this.e1TtlRefreshTimer) clearInterval(this.e1TtlRefreshTimer);
+    this.e1TtlRefreshTimer = setInterval(() => {
+      void this.refreshE1Ttls();
+    }, _McpServer.E1_TTL_REFRESH_MS);
+  }
+  /** Stop the E1 TTL-refresh timer. */
+  stopE1TtlRefresh() {
+    if (this.e1TtlRefreshTimer) {
+      clearInterval(this.e1TtlRefreshTimer);
+      this.e1TtlRefreshTimer = null;
+    }
+  }
+  /**
+   * E1 (§6a-4) — recover from a backend session RETIREMENT (agy had no such path;
+   * built for E1). The backend retired the live session (RETIRED_SESSION_CANNOT_
+   * REACTIVATE); its open prompts would orphan. Recovery: snapshot the open E1
+   * prompts and PARK them durably (so a transient replacement-launch failure can
+   * NOT lose them — G-1), PARTIALLY tear down the retired session (drop the
+   * singleton + its subscription + heartbeat, but NOT the INACTIVE write — it's
+   * already retired — and keep the daemon + observers running), then re-bootstrap a
+   * FRESH replacement session via ensureLaunchSession (generateLaunchSessionId mints
+   * a unique id, so this never reactivates the retired one). createLaunchSession
+   * drains the park onto the replacement (same promptId+ownerToken → the backend
+   * re-points the row's sessionId; no orphan) BEFORE its heartbeat. If THIS launch
+   * fails, the park is retained and the NEXT successful launch / TTL tick re-homes
+   * it. Single-flight; a stale callback (session already replaced) is a no-op.
+   */
+  recoverRetiredBackendSession(expectedSessionId) {
+    if (this.retiredSessionRecoveryPromise) return this.retiredSessionRecoveryPromise;
+    if (!this.started) return Promise.resolve();
+    const recovery = (async () => {
+      const old = this.session;
+      if (!old || old.sessionId !== expectedSessionId) return;
+      logger.warn("Backend retired live agy session; creating replacement", {
+        sessionId: expectedSessionId
+      });
+      const openE1Snapshot = this.snapshotOpenE1(expectedSessionId);
+      for (const snap of openE1Snapshot) {
+        this.e1RetirementPark.set(snap.record.promptId, snap);
+        this.e1PromptRaises.delete(snap.record.promptId);
+      }
+      try {
+        this.appSyncClient.stopHeartbeat(old.sessionId);
+      } catch {
+      }
+      if (this.subscription) {
+        try {
+          this.subscription();
+        } catch {
+        }
+        this.subscription = null;
+      }
+      this.session = null;
+      await this.ensureLaunchSession();
+      if (this.session) await this.drainE1RetirementPark();
+      if (!this.session) {
+        logger.error("agy retirement recovery: replacement session not established; open prompts PARKED for the next successful launch / TTL tick", {
+          oldSessionId: expectedSessionId,
+          parked: this.e1RetirementPark.size
+        });
+        return;
+      }
+    })();
+    this.retiredSessionRecoveryPromise = recovery.finally(() => {
+      this.retiredSessionRecoveryPromise = null;
+    });
+    return this.retiredSessionRecoveryPromise;
+  }
   /**
    * If the inbound mobile event is marked isEncrypted, decrypt content +
    * metadata in place. Returns a new shallow-copied Event; never mutates
@@ -3488,17 +4110,33 @@ var McpServer = class {
     if (!this.started) return;
     if (this.sessionDisabled) return;
     await this.ensureLaunchSession();
-    if (!this.session) return;
+    const session = this.session;
+    if (!session) {
+      this.paneObserver.resetPromptHash(cand.snapshotHash);
+      return;
+    }
     const parsed = parseApprovalSnapshot(cand.snapshot);
-    if (!parsed) return;
+    if (!parsed) {
+      this.raiseSuppressedBadge(session, cand.snapshotHash);
+      return;
+    }
     const activeConvId = this.pickActiveConversationForPrompt();
     if (!activeConvId) {
       logger.warn("Prompt candidate fired but no active conversation known", {
         observedConvCount: this.observedMainConversationIds.size
       });
+      this.raiseSuppressedBadge(session, cand.snapshotHash);
       return;
     }
-    this.approvalDetector.emitPaneOnlyPrompt(parsed, activeConvId);
+    const e1rec = this.newE1Raise(session.sessionId, true);
+    const emitted = this.approvalDetector.emitPaneOnlyPrompt(parsed, activeConvId, e1rec.promptId);
+    if (emitted) {
+      if (cand.snapshotHash) {
+        this.e1ContentKeyIndex.set(`${session.sessionId}::${cand.snapshotHash}`, e1rec.promptId);
+      }
+    } else {
+      this.e1PromptRaises.delete(e1rec.promptId);
+    }
   }
   /**
    * Pick the agy conversation UUID that owns the current approval UI.
@@ -3528,6 +4166,9 @@ var McpServer = class {
       });
       return;
     }
+    const e1existing = this.e1PromptRaises.get(state.promptId);
+    const e1rec = e1existing ? e1existing.record : this.newE1Raise(session.sessionId, true);
+    if (!e1existing) state.promptId = e1rec.promptId;
     const optionsArr = state.paneOptions ? state.paneOptions.map((o) => ({ number: o.number, text: o.text })) : Object.keys(state.submitMap).map((n) => ({ number: n }));
     const diffParsed = parseFencedDiffFromBody(
       state.body,
@@ -3567,6 +4208,9 @@ var McpServer = class {
       source: import_codevibe_core4.EventSource.DESKTOP,
       content,
       metadata: optionsForMobile,
+      // E1 (§4) — raise identity top-level: promptId + ownerToken/producerKind/
+      // mobileActionable (the backend's classifyRaise upserts the open-prompt row).
+      ...(0, import_codevibe_core4.raiseFieldsFromRecord)(e1rec),
       // Per-conversation monotonic timestamp (event-timestamp-ordering fix
       // v5.4, 2026-05-24). orderingKey scopes the counter to this conv so
       // INTERACTIVE_PROMPT can't be forced to lastMs+1 by a newer event
@@ -3580,12 +4224,19 @@ var McpServer = class {
       const outbound = this.encryptOutbound(session, input);
       if (!outbound) return;
       await this.appSyncClient.createEvent(outbound);
+      this.stashE1RaiseContent(
+        e1rec.promptId,
+        content,
+        optionsForMobile
+      );
     } catch (err) {
       logger.error("createEvent INTERACTIVE_PROMPT failed", {
         promptId: state.promptId,
         error: String(err)
       });
       this.approvalDetector.rollbackPrompt(state.promptId);
+      if (state.paneHash) this.paneObserver.resetPromptHash(state.paneHash);
+      this.e1PromptRaises.delete(state.promptId);
     }
   }
   // ─── Mobile → desktop flow ──────────────────────────────────────────────
@@ -3734,8 +4385,63 @@ var McpServer = class {
           });
         }
       }
+      const pendingPrompts = this.approvalDetector.getPendingPromptsForConversation(
+        session.conversationId
+      );
+      if (pendingPrompts.length === 0) {
+        const probe = await this.paneObserver.probeApprovalUIActive();
+        if (!probe.probeSucceeded) {
+          await this.emitPromptSafetyNotification(
+            session,
+            "Your message was not sent because the desktop approval state could not be verified. Try again or resolve the prompt on the desktop."
+          );
+          return;
+        }
+        if (probe.active) {
+          await this.emitPromptSafetyNotification(
+            session,
+            "Your message was not sent because a desktop approval is active but its options are not yet available on mobile. Resolve it on the desktop and send the message again."
+          );
+          return;
+        }
+      }
+      if (pendingPrompts.length > 0) {
+        if (pendingPrompts.length !== 1) {
+          await this.emitPromptSafetyNotification(
+            session,
+            "Your message was not sent because more than one desktop approval is pending. Resolve the approvals and send it again."
+          );
+          return;
+        }
+        const activePrompt = pendingPrompts[0];
+        const rejectOption = activePrompt.paneOptions?.find(
+          (option) => /^(?:no|deny|reject|cancel)\b/i.test(option.text.trim()) && (activePrompt.submitMap[option.number]?.length ?? 0) > 0
+        );
+        if (!rejectOption) {
+          await this.emitPromptSafetyNotification(
+            session,
+            "Your message was not sent because the active desktop approval has no verified reject option. Resolve it on the desktop and send the message again."
+          );
+          return;
+        }
+        this.mobileDeduper.track(session.sessionId, rejectOption.number);
+        const rejectResult = await this.promptResponder.sendApprovalReply(
+          activePrompt.promptId,
+          rejectOption.number
+        );
+        if (!rejectResult.ok) {
+          this.mobileDeduper.forget(session.sessionId, rejectOption.number);
+          logger.warn("Reject-before-free-form failed", {
+            promptId: activePrompt.promptId,
+            reason: rejectResult.reason,
+            details: rejectResult.details
+          });
+          return;
+        }
+        await new Promise((resolve3) => setTimeout(resolve3, 250));
+      }
       this.mobileDeduper.track(session.sessionId, promptContent);
-      const result = await this.promptResponder.sendFreeForm(promptContent);
+      const result = await this.promptResponder.sendFreeFormWhenNoApprovalActive(promptContent);
       if (!result.ok) {
         this.mobileDeduper.forget(session.sessionId, promptContent);
         logger.warn("sendFreeForm failed", { reason: result.reason, details: result.details });
@@ -3770,6 +4476,23 @@ var McpServer = class {
       await this.markExecuted(evt);
     }
   }
+  async emitPromptSafetyNotification(session, content) {
+    const input = {
+      sessionId: session.sessionId,
+      type: import_codevibe_core4.EventType.NOTIFICATION,
+      source: import_codevibe_core4.EventSource.DESKTOP,
+      content,
+      metadata: { promptSafetyBlocked: true },
+      timestamp: (0, import_codevibe_core4.prepareEventTimestamp)({ orderingKey: session.sessionId })
+    };
+    const outbound = this.encryptOutbound(session, input);
+    if (!outbound) return;
+    try {
+      await this.appSyncClient.createEvent(outbound);
+    } catch (error) {
+      logger.warn("Failed to emit prompt-safety notification", { error: String(error) });
+    }
+  }
   /**
    * Transition a mobile event's deliveryStatus to DELIVERED. Called as
    * soon as the plugin receives + decrypts the event and BEFORE the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quantiya/codevibe-antigravity-plugin",
-  "version": "2.0.9",
+  "version": "2.0.11",
   "description": "Control Antigravity CLI from your iPhone and Android — real-time sync, approve file edits, send prompts by voice. Part of CodeVibe.",
   "main": "dist/server.js",
   "codevibe": {
@@ -48,7 +48,7 @@
     "node": ">=22.0.0"
   },
   "dependencies": {
-    "@quantiya/codevibe-core": "2.0.9",
+    "@quantiya/codevibe-core": "2.0.10",
     "chokidar": "^5.0.0",
     "dotenv": "^16.6.1",
     "express": "^5.1.0",