@raidiant/notifai 0.3.0 → 0.5.0

package/src/install-hooks.ts

@@ -1,12 +1,20 @@
 import {
   existsSync,
+  lstatSync,
   readFileSync,
+  realpathSync,
   statSync,
 } from 'node:fs'
+import { createHash } from 'node:crypto'
 import os from 'node:os'
 import path from 'node:path'
+import { parse as parseToml } from 'smol-toml'
 import { atomicWriteFileSync } from './atomic-file.js'
+import { hookAdapterPath } from './hook-adapter.js'
 import { opencodePluginPath, opencodePluginTarget } from './opencode-plugin.js'
+import { HARNESSES, type Harness } from './harnesses.js'
+
+export { HARNESSES, type Harness } from './harnesses.js'
 
 /**
  * The three joints the OpenCode plugin hooks into, as (harness event, the
@@ -32,13 +40,12 @@ const OPENCODE_EVENTS = [
  * adapter instead of being forced through this shared document shape.
  */
 
-export const HARNESSES = ['claude-code', 'codex', 'cursor', 'opencode'] as const
-export type Harness = (typeof HARNESSES)[number]
-
 export interface HookHandler {
   type: 'command'
   command: string
   timeout?: number
+  async?: boolean
+  statusMessage?: string
 }
 
 export interface HookGroup {
@@ -58,18 +65,17 @@ export interface InstallPlan {
 }
 
 /**
- * The command each hook runs. Uses the absolute interpreter and script path
- * rather than the bare binary name: hooks inherit a login-ish environment, and
- * a `notifai` that is only on an interactive shell's PATH fails silently.
+ * The command each hook runs. Harness definitions know only the stable
+ * user-level adapter. Mutable Node, package-manager, version, and checkout
+ * paths live behind that seam and never enter a trusted hook identity.
  */
 export function hookCommand(
-  execPath: string,
-  scriptPath: string,
+  adapterPath: string,
   event: string,
   harness?: Harness,
 ): string {
   return (
-    `${quote(execPath)} ${quote(scriptPath)} hook ${event} ${OWNER_MARKER}` +
+    `${quote(adapterPath)} hook ${event} ${OWNER_MARKER}` +
     (harness === undefined ? '' : ` --harness ${harness}`)
   )
 }
@@ -101,40 +107,67 @@ function quote(value: string): string {
 }
 
 export interface BuildOptions {
-  execPath: string
-  scriptPath: string
-  /** Seconds a blocking hook may wait for a companion-device answer. */
-  replyTimeoutSeconds: number
-  /** Seconds the question waits in the terminal before it is pushed at all. */
-  graceSeconds: number
+  /** Stable user-level executable installed by the hook adapter module. */
+  adapterPath: string
   /** The installed adapter stamps its exact harness into project pointers. */
   harness?: Harness
 }
 
-/** Command-hook harnesses kill at 600s; generated adapters use the same safe ceiling. */
-const HOOK_CEILING_SECONDS = 590
+/**
+ * Claude Code's Stop handler returns instantly and the same process lives on
+ * out of band as the escalation waiter, so this `timeout` bounds a background
+ * process rather than the user's turn.
+ *
+ * It is always declared, and declared far above the longest wait a waiter can
+ * take. Claude's default is 600 s and the kill is **silent** — the backgrounded
+ * process simply vanishes, no error is reported anywhere, and the answer the
+ * user already gave is never delivered. Sitting anywhere near that boundary
+ * turns a slow reply into a lost one, so this does not: an explicit value
+ * raises the ceiling (verified against a 660 s wait under an hour-long
+ * declaration), and an hour is several times the waiter's own ceiling.
+ */
+export const CLAUDE_ASYNC_STOP_TIMEOUT_SECONDS = 3600
+
+/**
+ * The declared process budget for a host that holds its turn while the waiter
+ * runs: the waiter's own ceiling plus a minute of host headroom, as one plain
+ * number rather than a budget carved into reserves.
+ *
+ * Codex is deliberately absent from this. It owns its Stop timeout today, and
+ * declaring one would change the serialized definition Codex hashes into
+ * `trusted_hash` — which silently stops every Notifai handler from running
+ * until the user re-approves them in `/hooks`.
+ */
+export const BLOCKING_STOP_TIMEOUT_SECONDS = 540
 
-/** Grace, reply wait, and teardown headroom for any blocking turn-end adapter. */
-export function blockingHookTimeoutSeconds(graceSeconds: number, replyTimeoutSeconds: number): number {
-  return Math.min(HOOK_CEILING_SECONDS, graceSeconds + replyTimeoutSeconds + 60)
+/**
+ * The turn-end handler, whose shape is the whole per-harness difference.
+ *
+ * Claude Code takes the answer over its own inbox socket, so its Stop hook is
+ * `async: true`: it returns immediately, the terminal is never held, and the
+ * waiter finishes out of band. Every other host still delivers by printing a
+ * continuation to this process's stdout, so its Stop hook blocks and needs a
+ * declared ceiling above the wait — except Codex, which owns that number
+ * itself and whose definition must stay byte-stable for its trust store.
+ */
+function stopHandler(adapterPath: string, harness: Harness | undefined): HookHandler {
+  const command = hookCommand(adapterPath, 'stop', harness)
+  if (harness === 'claude-code') {
+    return { type: 'command', command, timeout: CLAUDE_ASYNC_STOP_TIMEOUT_SECONDS, async: true }
+  }
+  if (harness === 'codex') return { type: 'command', command }
+  return { type: 'command', command, timeout: BLOCKING_STOP_TIMEOUT_SECONDS }
 }
 
 export function buildHookConfig(options: BuildOptions): HookConfig {
-  const { execPath, scriptPath } = options
-  // Stop can spend the grace window AND then the reply wait, so the declared
-  // timeout must cover both. Headroom on top so the harness never kills the
-  // hook first; a killed hook loses the answer the user already gave.
-  const blockingTimeout = blockingHookTimeoutSeconds(
-    options.graceSeconds,
-    options.replyTimeoutSeconds,
-  )
+  const { adapterPath } = options
   return {
     UserPromptSubmit: [
       {
         hooks: [
           {
             type: 'command',
-            command: hookCommand(execPath, scriptPath, 'user-prompt-submit', options.harness),
+            command: hookCommand(adapterPath, 'user-prompt-submit', options.harness),
             // Claude Code caps UserPromptSubmit at 30s; stay well inside it so
             // a slow network can never delay the user's own prompt.
             timeout: 15,
@@ -142,23 +175,13 @@ export function buildHookConfig(options: BuildOptions): HookConfig {
         ],
       },
     ],
-    Stop: [
-      {
-        hooks: [
-          {
-            type: 'command',
-            command: hookCommand(execPath, scriptPath, 'stop', options.harness),
-            timeout: blockingTimeout,
-          },
-        ],
-      },
-    ],
+    Stop: [{ hooks: [stopHandler(adapterPath, options.harness)] }],
     SessionEnd: [
       {
         hooks: [
           {
             type: 'command',
-            command: hookCommand(execPath, scriptPath, 'session-end', options.harness),
+            command: hookCommand(adapterPath, 'session-end', options.harness),
             // Both harnesses give SessionEnd a ~1-3s budget, so this handler
             // only touches local state.
             timeout: 3,
@@ -185,21 +208,17 @@ interface CursorSettingsDocument {
 
 /** Cursor's native schema is flat and uses lower-camel lifecycle event names. */
 export function buildCursorHookConfig(options: BuildOptions): CursorHookConfig {
-  const blockingTimeout = blockingHookTimeoutSeconds(
-    options.graceSeconds,
-    options.replyTimeoutSeconds,
-  )
   return {
     beforeSubmitPrompt: [
       {
-        command: hookCommand(options.execPath, options.scriptPath, 'user-prompt-submit', 'cursor'),
+        command: hookCommand(options.adapterPath, 'user-prompt-submit', 'cursor'),
         timeout: 15,
       },
     ],
     stop: [
       {
-        command: hookCommand(options.execPath, options.scriptPath, 'stop', 'cursor'),
-        timeout: blockingTimeout,
+        command: hookCommand(options.adapterPath, 'stop', 'cursor'),
+        timeout: BLOCKING_STOP_TIMEOUT_SECONDS,
         // A continuation may register a real follow-up question. Match the
         // session-state cap so those chains are useful but never unbounded.
         loop_limit: 3,
@@ -207,7 +226,7 @@ export function buildCursorHookConfig(options: BuildOptions): CursorHookConfig {
     ],
     sessionEnd: [
       {
-        command: hookCommand(options.execPath, options.scriptPath, 'session-end', 'cursor'),
+        command: hookCommand(options.adapterPath, 'session-end', 'cursor'),
         timeout: 3,
       },
     ],
@@ -225,24 +244,32 @@ export function settingsFile(
   cwd: string,
   env: NodeJS.ProcessEnv = process.env,
 ): string {
-  // OpenCode has no settings document to merge into — its adapter is a
-  // generated plugin module, so it owns a whole file rather than a handler
-  // inside one. `opencodePluginPath` is its equivalent.
-  if (harness === 'opencode') return opencodePluginPath(global, cwd, env)
-  if (harness === 'cursor') {
-    const home = env['HOME'] !== undefined && env['HOME'] !== '' ? env['HOME'] : os.homedir()
-    return global
-      ? path.join(home, '.cursor', 'hooks.json')
-      : path.join(cwd, '.cursor', 'hooks.json')
-  }
-  if (harness === 'claude-code') {
-    return global
-      ? path.join(configHome(env, 'CLAUDE_CONFIG_DIR', '.claude'), 'settings.json')
-      : path.join(cwd, '.claude', 'settings.local.json')
+  switch (harness) {
+    // OpenCode has no settings document to merge into — its adapter is a
+    // generated plugin module, so it owns a whole file instead.
+    case 'opencode':
+      return opencodePluginPath(global, cwd, env)
+    case 'cursor': {
+      const home = env['HOME'] !== undefined && env['HOME'] !== '' ? env['HOME'] : os.homedir()
+      return global
+        ? path.join(home, '.cursor', 'hooks.json')
+        : path.join(cwd, '.cursor', 'hooks.json')
+    }
+    case 'claude-code':
+      return global
+        ? path.join(configHome(env, 'CLAUDE_CONFIG_DIR', '.claude'), 'settings.json')
+        : path.join(cwd, '.claude', 'settings.local.json')
+    case 'codex':
+      return global
+        ? path.join(configHome(env, 'CODEX_HOME', '.codex'), 'hooks.json')
+        : path.join(codexProjectRoot(cwd), '.codex', 'hooks.json')
+    default:
+      return assertNeverHarness(harness)
   }
-  return global
-    ? path.join(configHome(env, 'CODEX_HOME', '.codex'), 'hooks.json')
-    : path.join(codexProjectRoot(cwd), '.codex', 'hooks.json')
+}
+
+function assertNeverHarness(harness: never): never {
+  throw new Error(`Unsupported harness: ${String(harness)}`)
 }
 
 /**
@@ -403,8 +430,9 @@ interface SettingsDocument {
 
 function readCursorSettings(file: string): CursorSettingsDocument {
   if (!existsSync(file)) return { version: 1 }
+  const source = readOwnedRegularFile(file)
   try {
-    const parsed: unknown = JSON.parse(readFileSync(file, 'utf8'))
+    const parsed: unknown = JSON.parse(source)
     return typeof parsed === 'object' && parsed !== null
       ? (parsed as CursorSettingsDocument)
       : { version: 1 }
@@ -418,7 +446,24 @@ function isOurCommand(command: string, scriptPath: string): boolean {
   return (
     command.includes(`${scriptPath}' hook `) ||
     command.includes(`${scriptPath}" hook `) ||
-    command.includes(`${scriptPath} hook `)
+    command.includes(`${scriptPath} hook `) ||
+    isLegacyNotifaiCommand(command)
+  )
+}
+
+/** Cleanup-only recognition for unmistakable pre-marker Notifai commands. */
+function isLegacyNotifaiCommand(command: string): boolean {
+  const hook = `['"]?\\s+hook (?:user-prompt-submit|stop|session-end)\\b`
+  return (
+    new RegExp(`(?:^|[\\s'"])notifai(?:\\.cmd)?${hook}`).test(command) ||
+    new RegExp(
+      `(?:^|[/\\\\])(?:notifai-public|notifai)[/\\\\]apps[/\\\\]cli[/\\\\]dist[/\\\\]main\\.js${hook}`,
+      'i',
+    ).test(command) ||
+    new RegExp(
+      `[/\\\\]node_modules[/\\\\]@raidiant[/\\\\]notifai[/\\\\]dist[/\\\\]main\\.js${hook}`,
+      'i',
+    ).test(command)
   )
 }
 
@@ -463,8 +508,9 @@ export function removeCursorHooks(
 
 function readSettings(file: string): SettingsDocument {
   if (!existsSync(file)) return {}
+  const source = readOwnedRegularFile(file)
   try {
-    const parsed: unknown = JSON.parse(readFileSync(file, 'utf8'))
+    const parsed: unknown = JSON.parse(source)
     return typeof parsed === 'object' && parsed !== null ? (parsed as SettingsDocument) : {}
   } catch {
     throw new Error(`Could not parse ${file}; fix or move it before installing hooks.`)
@@ -563,7 +609,9 @@ export function removeHooks(existing: SettingsDocument, scriptPath: string): Mer
  * support.
  */
 export function applyPlan(file: string, document: SettingsDocument | CursorSettingsDocument): void {
-  atomicWriteFileSync(file, `${JSON.stringify(document, null, 2)}\n`)
+  atomicWriteFileSync(file, `${JSON.stringify(document, null, 2)}\n`, {
+    requireCurrentUserOwner: true,
+  })
 }
 
 export function loadSettings(file: string): SettingsDocument {
@@ -588,6 +636,8 @@ export interface InstalledHandler {
   command: string
   /** Declared process lifetime, used to detect config/install drift. */
   timeout?: number
+  async?: boolean
+  statusMessage?: string
 }
 
 export interface Installation {
@@ -599,6 +649,112 @@ export interface Installation {
   problems?: string[]
 }
 
+/** Codex's canonical event spelling inside its persisted trust keys. */
+function codexEventName(event: string): string {
+  return event.replace(/([a-z0-9])([A-Z])/g, '$1_$2').toLowerCase()
+}
+
+/** Recursively sort object keys before hashing, matching Codex's canonical JSON. */
+function canonicalValue(value: unknown): unknown {
+  if (Array.isArray(value)) return value.map(canonicalValue)
+  if (typeof value !== 'object' || value === null) return value
+  return Object.fromEntries(
+    Object.entries(value as Record<string, unknown>)
+      .sort(([left], [right]) => left.localeCompare(right))
+      .map(([key, child]) => [key, canonicalValue(child)]),
+  )
+}
+
+/**
+ * Best-effort mirror of the identity current Codex builds compare with
+ * `hooks.state.*.trusted_hash`. This persisted format is diagnostic evidence,
+ * not an API: Codex's `/hooks` UI remains authoritative and Notifai never
+ * writes the trust store.
+ */
+export function codexHookIdentityHash(handler: InstalledHandler): string {
+  const command = {
+    type: 'command',
+    command: handler.command,
+    timeout: Math.max(1, handler.timeout ?? 600),
+    async: handler.async ?? false,
+    ...(handler.statusMessage === undefined ? {} : { statusMessage: handler.statusMessage }),
+  }
+  const normalized = canonicalValue({
+    event_name: codexEventName(handler.event),
+    hooks: [command],
+  })
+  return `sha256:${createHash('sha256').update(JSON.stringify(normalized)).digest('hex')}`
+}
+
+function codexTrustState(env: NodeJS.ProcessEnv): Record<string, unknown> {
+  const file = path.join(configHome(env, 'CODEX_HOME', '.codex'), 'config.toml')
+  if (!existsSync(file)) return {}
+  try {
+    const parsed = parseToml(readFileSync(file, 'utf8')) as Record<string, unknown>
+    const hooks = parsed['hooks']
+    if (typeof hooks !== 'object' || hooks === null) return {}
+    const state = (hooks as Record<string, unknown>)['state']
+    return typeof state === 'object' && state !== null ? state as Record<string, unknown> : {}
+  } catch {
+    return {}
+  }
+}
+
+/** Best-effort mirror of current Codex's persisted key for one handler. */
+export function codexTrustKey(
+  installation: Installation,
+  handler: InstalledHandler,
+): string {
+  let source = installation.file
+  try {
+    source = path.join(realpathSync(path.dirname(source)), path.basename(source))
+  } catch {
+    // Codex falls back to the logical source path when canonicalization fails,
+    // so the diagnostic must do the same.
+  }
+  return `${source}:${codexEventName(handler.event)}:${handler.groupIndex}:${handler.handlerIndex}`
+}
+
+/**
+ * Trust defects that make installed Codex handlers look present while Codex
+ * skips them. Trust is user-owned; the supported repair is Codex's `/hooks`
+ * review UI, never writing the trust store on the user's behalf. Because the
+ * persisted shape is not a public Codex contract, this diagnosis can drift;
+ * `/hooks` remains the source of truth.
+ */
+export function codexTrustProblems(
+  installations: Installation[],
+  env: NodeJS.ProcessEnv = process.env,
+): string[] {
+  const state = codexTrustState(env)
+  return installations
+    .filter((installation) => installation.harness === 'codex')
+    .flatMap((installation) =>
+      installation.handlers.flatMap((handler) => {
+        const key = codexTrustKey(installation, handler)
+        const entry = state[key]
+        const trustedHash =
+          typeof entry === 'object' && entry !== null
+            ? (entry as Record<string, unknown>)['trusted_hash']
+            : undefined
+        const currentHash = codexHookIdentityHash(handler)
+        if (
+          typeof entry === 'object' &&
+          entry !== null &&
+          (entry as Record<string, unknown>)['enabled'] === false
+        ) {
+          return [
+            `${handler.event} in ${installation.file} is disabled in Codex; open \`/hooks\` and enable the Notifai handler`,
+          ]
+        }
+        if (trustedHash === currentHash) return []
+        return [
+          `${handler.event} in ${installation.file} is ${typeof trustedHash === 'string' ? 'changed since it was trusted' : 'not trusted'}; open \`/hooks\` in Codex and approve the Notifai handler`,
+        ]
+      }),
+    )
+}
+
 /**
  * Any Notifai handler, whatever checkout wrote it.
  *
@@ -615,7 +771,11 @@ function isNotifaiHandler(handler: HookHandler): boolean {
 }
 
 /** Every place either harness would read a Notifai handler from. */
-export function findInstallations(cwd: string, env: NodeJS.ProcessEnv = process.env): Installation[] {
+export function findInstallations(
+  cwd: string,
+  env: NodeJS.ProcessEnv = process.env,
+  adapterHome?: string,
+): Installation[] {
   const found: Installation[] = []
   for (const harness of HARNESSES) {
     for (const global of [false, true]) {
@@ -625,15 +785,29 @@ export function findInstallations(cwd: string, env: NodeJS.ProcessEnv = process.
       // is reported as one installation covering all three events rather than
       // parsed for handlers.
       if (harness === 'opencode') {
-        const target = opencodePluginTarget(readFileSync(file, 'utf8'))
+        let source: string
+        try {
+          source = readOwnedRegularFile(file)
+        } catch {
+          continue
+        }
+        const target = opencodePluginTarget(source)
         if (target === null) continue
+        const problems = [
+          ...(!target.current
+            ? ['obsolete OpenCode event wiring; rerun `notifai hooks install --harness opencode`']
+            : []),
+          ...(target.adapter !== hookAdapterPath(adapterHome)
+            ? [
+                'OpenCode still names a mutable CLI or runtime path; rerun `notifai hooks install --harness opencode`',
+              ]
+            : []),
+        ]
         found.push({
           harness,
           file,
           global,
-          ...(!target.current
-            ? { problems: ['obsolete OpenCode event wiring; rerun `notifai hooks install --harness opencode`'] }
-            : {}),
+          ...(problems.length > 0 ? { problems } : {}),
           // Reported as the command line the plugin will actually run, not as
           // the plugin's own path: every check downstream asks which build a
           // handler invokes, and for a module that answer lives inside it.
@@ -641,7 +815,7 @@ export function findInstallations(cwd: string, env: NodeJS.ProcessEnv = process.
             event,
             groupIndex: 0,
             handlerIndex: 0,
-            command: hookCommand(target.exec, target.script, hookEvent),
+            command: hookCommand(target.adapter, hookEvent, 'opencode'),
             ...(target.timeoutSeconds === undefined ? {} : { timeout: target.timeoutSeconds }),
           })),
         })
@@ -656,7 +830,7 @@ export function findInstallations(cwd: string, env: NodeJS.ProcessEnv = process.
         }
         const handlers = locateCursorHandlers(document)
         if (handlers.length > 0) {
-          const problems = harnessMarkerProblems(harness, handlers)
+          const problems = harnessMarkerProblems(harness, handlers, adapterHome)
           found.push({ harness, file, global, handlers, ...(problems.length > 0 ? { problems } : {}) })
         }
         continue
@@ -669,7 +843,7 @@ export function findInstallations(cwd: string, env: NodeJS.ProcessEnv = process.
       }
       const handlers = locateHandlers(document)
       if (handlers.length > 0) {
-        const problems = harnessMarkerProblems(harness, handlers)
+        const problems = harnessMarkerProblems(harness, handlers, adapterHome)
         found.push({ harness, file, global, handlers, ...(problems.length > 0 ? { problems } : {}) })
       }
     }
@@ -677,12 +851,24 @@ export function findInstallations(cwd: string, env: NodeJS.ProcessEnv = process.
   return found
 }
 
-function harnessMarkerProblems(harness: Harness, handlers: InstalledHandler[]): string[] {
-  return handlers.every((handler) => handler.command.includes(`--harness ${harness}`))
-    ? []
-    : [
-        `installed commands do not stamp the ${harness} routing identity; rerun \`notifai hooks install --harness ${harness}\``,
-      ]
+function harnessMarkerProblems(
+  harness: Harness,
+  handlers: InstalledHandler[],
+  adapterHome?: string,
+): string[] {
+  const problems: string[] = []
+  if (!handlers.every((handler) => handler.command.includes(`--harness ${harness}`))) {
+    problems.push(
+      `installed commands do not stamp the ${harness} routing identity; rerun \`notifai hooks install --harness ${harness}\``,
+    )
+  }
+  const expected = `${quote(hookAdapterPath(adapterHome))} hook `
+  if (!handlers.every((handler) => handler.command.startsWith(expected))) {
+    problems.push(
+      'installed commands still name a mutable CLI or runtime path; rerun `notifai hooks install` to migrate to the stable adapter',
+    )
+  }
+  return problems
 }
 
 function locateCursorHandlers(document: CursorSettingsDocument): InstalledHandler[] {
@@ -715,6 +901,8 @@ function locateHandlers(document: SettingsDocument): InstalledHandler[] {
             handlerIndex,
             command: handler.command,
             ...(handler.timeout === undefined ? {} : { timeout: handler.timeout }),
+            ...(handler.async === undefined ? {} : { async: handler.async }),
+            ...(handler.statusMessage === undefined ? {} : { statusMessage: handler.statusMessage }),
           })
         }
       })
@@ -727,3 +915,15 @@ function locateHandlers(document: SettingsDocument): InstalledHandler[] {
 export function handlerEvent(command: string): string | null {
   return / hook ([a-z-]+)/.exec(command)?.[1] ?? null
 }
+
+function readOwnedRegularFile(file: string): string {
+  const stat = lstatSync(file)
+  if (stat.isSymbolicLink() || !stat.isFile()) {
+    throw new Error(`${file} is not a regular file; refusing to read it.`)
+  }
+  const uid = typeof process.getuid === 'function' ? process.getuid() : undefined
+  if (uid !== undefined && stat.uid !== uid) {
+    throw new Error(`${file} is owned by uid ${stat.uid}, not the current user.`)
+  }
+  return readFileSync(file, 'utf8')
+}

package/src/interactive.ts

@@ -593,17 +593,12 @@ async function routingScreen(deps: CommandDeps, readiness: Readiness): Promise<b
   const row = (label: string, value: string): string => `${style.dim(label.padEnd(16))}${value}`
   clack.note(
     'When an agent registers a question, it appears in your terminal first.\n' +
-      'If you are still here, it stays here. Once you step away, it goes to\n' +
-      'your phone and Mac as a notification with real answer buttons, and\n' +
-      'your answer comes back to the agent.\n\n' +
+      'After the grace below, it goes to your phone and Mac as a notification\n' +
+      'with real answer buttons, and your answer comes back to the agent —\n' +
+      'whether or not you are still at this machine.\n\n' +
       [
         row('Wired to', wiringSummary(hooks)),
         row('Send', config.ask_notifications.value ? 'yes' : 'no — questions stay in the terminal'),
-        row(
-          'Only when away',
-          config.require_idle.value ? 'yes' : 'no — reach me even while I am working',
-        ),
-        row('Away after', formatValue('away_after_seconds', config.away_after_seconds.value)),
         row('Grace', formatValue('ask_grace_seconds', config.ask_grace_seconds.value)),
       ].join('\n'),
     'Question routing',

package/src/logging-process-worker.test.ts

@@ -0,0 +1,39 @@
+import { existsSync, writeFileSync } from 'node:fs'
+import { describe, expect, it } from 'vitest'
+import { createLogger } from './logging.js'
+
+const worker = process.env['NOTIFAI_ROTATION_WORKER']
+
+if (worker === undefined) {
+  describe('rotation process worker', () => {
+    it('stays dormant outside the concurrency regression', () => {
+      expect(worker).toBeUndefined()
+    })
+  })
+} else {
+  describe('rotation process worker', () => {
+    it('writes one share of an overlapping log stream', async () => {
+      const readyPath = process.env['NOTIFAI_ROTATION_READY']!
+      const startPath = process.env['NOTIFAI_ROTATION_START']!
+      const records = Number(process.env['NOTIFAI_ROTATION_RECORDS'])
+      const maxBytes = Number(process.env['NOTIFAI_ROTATION_MAX_BYTES'])
+      const maxFiles = Number(process.env['NOTIFAI_ROTATION_MAX_FILES'])
+      writeFileSync(readyPath, 'ready')
+      const startDeadline = Date.now() + 10_000
+      while (!existsSync(startPath)) {
+        if (Date.now() >= startDeadline) throw new Error('rotation parent never released the barrier')
+        await new Promise((resolve) => setTimeout(resolve, 2))
+      }
+
+      const logger = createLogger({
+        runId: `r_worker_${worker}`,
+        settings: { maxBytes, maxFiles },
+      })
+      for (let sequence = 0; sequence < records; sequence += 1) {
+        logger.info('cli.end', { worker, sequence, pad: 'p'.repeat(140) })
+        await new Promise((resolve) => setTimeout(resolve, 1))
+      }
+      expect(logger.enabled).toBe(true)
+    })
+  })
+}