@raidiant/notifai 8.0.0 → 9.0.0

package/src/install-hooks.test.ts

@@ -1,4 +1,5 @@
 import {
+  existsSync,
   lstatSync,
   mkdirSync,
   mkdtempSync,
@@ -20,6 +21,7 @@ import {
   opencodePluginSource,
   opencodePluginTarget,
 } from './opencode-plugin.js'
+import { SESSION_ACTIVATION_CONTEXT } from './session-activation.js'
 import { hookAdapterPath, installHookAdapter } from './hook-adapter.js'
 import {
   BLOCKING_STOP_TIMEOUT_SECONDS,
@@ -27,6 +29,7 @@ import {
   applyPlan,
   detectHarness,
   detectedHarnesses,
+  buildCursorHookConfig,
   buildHookConfig,
   codexLayerDir,
   codexProjectRoot,
@@ -85,6 +88,33 @@ describe('choice labels', () => {
 })
 
 describe('hook config', () => {
+  it('activates Notifai at the session lifecycle seam for every native hook adapter', () => {
+    const claude = buildHookConfig({ adapterPath: ADAPTER, harness: 'claude-code' })
+    const codex = buildHookConfig({ adapterPath: ADAPTER, harness: 'codex' })
+    const cursor = buildCursorHookConfig({ adapterPath: ADAPTER, harness: 'cursor' })
+
+    expect(claude['SessionStart']?.[0]?.hooks[0]).toMatchObject({
+      command: hookCommand(ADAPTER, 'session-start', 'claude-code'),
+    })
+    expect(codex['SessionStart']?.[0]?.hooks[0]).toMatchObject({
+      command: hookCommand(ADAPTER, 'session-start', 'codex'),
+    })
+    expect(cursor['sessionStart']?.[0]).toMatchObject({
+      command: hookCommand(ADAPTER, 'session-start', 'cursor'),
+    })
+    expect(claude['SubagentStart']?.[0]?.hooks[0]).toMatchObject({
+      command: hookCommand(ADAPTER, 'subagent-start', 'claude-code'),
+    })
+    expect(codex['SubagentStart']?.[0]?.hooks[0]).toMatchObject({
+      command: hookCommand(ADAPTER, 'subagent-start', 'codex'),
+    })
+    expect(cursor['subagentStart']).toBeUndefined()
+    expect(cursor['stop']?.[0]).toMatchObject({
+      command: hookCommand(ADAPTER, 'activation-stop', 'cursor'),
+      loop_limit: 1,
+    })
+  })
+
   it('invokes one stable adapter so a sparse hook PATH still works', () => {
     expect(hookCommand(ADAPTER, 'stop')).toBe(`'${ADAPTER}' hook stop --owner notifai`)
   })
@@ -101,7 +131,7 @@ describe('hook config', () => {
     const config = buildHookConfig({ adapterPath: ADAPTER })
     expect(config['Stop']?.[0]?.hooks[0]?.timeout).toBe(540)
     expect(config['Stop']?.[0]?.hooks[0]?.async).toBeUndefined()
-    // Claude Code caps UserPromptSubmit at 30s; Codex gives SessionEnd 1-3s.
+    // Claude Code defaults UserPromptSubmit to 30s; Codex gives SessionEnd 1-3s.
     expect(config['UserPromptSubmit']?.[0]?.hooks[0]?.timeout).toBe(15)
     expect(config['SessionEnd']?.[0]?.hooks[0]?.timeout).toBe(3)
   })
@@ -174,7 +204,7 @@ describe('hook config', () => {
       SCRIPT,
     )
 
-    for (const event of ['UserPromptSubmit', 'Stop', 'SessionEnd']) {
+    for (const event of ['SessionStart', 'SubagentStart', 'UserPromptSubmit', 'Stop', 'SessionEnd']) {
       const groups = migrated.document.hooks?.[event] ?? []
       expect(groups.flatMap((group) => group.hooks)).toHaveLength(1)
     }
@@ -182,7 +212,13 @@ describe('hook config', () => {
       timeout: 3600,
       async: true,
     })
-    expect(migrated.replaced.sort()).toEqual(['SessionEnd', 'Stop', 'UserPromptSubmit'])
+    expect(migrated.replaced.sort()).toEqual([
+      'SessionEnd',
+      'SessionStart',
+      'Stop',
+      'SubagentStart',
+      'UserPromptSubmit',
+    ])
   })
 })
 
@@ -272,13 +308,7 @@ describe('settings locations', () => {
     expect(settingsFile('codex', false, repo, {})).toBe(path.join(repo, '.codex', 'hooks.json'))
   })
 
-  /**
-   * A `hooks.json` nobody has proven is Notifai's is not Notifai's to write.
-   * Joining it would avoid Codex's dual-representation warning, but a hook
-   * entry carries no owner, so the file may belong to a tool that regenerates
-   * it wholesale and would drop our handlers without a word.
-   */
-  it('writes config.toml rather than joining a hooks.json that is not ours', () => {
+  it('joins the only populated hook representation without special-casing its owner', () => {
     const repo = mkdtempSync(path.join(os.tmpdir(), 'notifai-codex-foreign-json-'))
     const layer = path.join(repo, '.codex')
     mkdirSync(layer, { recursive: true })
@@ -292,6 +322,20 @@ describe('settings locations', () => {
       },
     })
 
+    expect(settingsFile('codex', false, repo, {})).toBe(path.join(layer, 'hooks.json'))
+  })
+
+  it('keeps inline hooks when config.toml is the only populated representation', () => {
+    const repo = mkdtempSync(path.join(os.tmpdir(), 'notifai-codex-foreign-toml-'))
+    const layer = path.join(repo, '.codex')
+    mkdirSync(layer, { recursive: true })
+    writeFileSync(
+      path.join(layer, 'config.toml'),
+      ['[[hooks.Stop]]', '', '[[hooks.Stop.hooks]]', 'type = "command"', 'command = "gdh-stop"', ''].join(
+        '\n',
+      ),
+    )
+
     expect(settingsFile('codex', false, repo, {})).toBe(path.join(layer, 'config.toml'))
   })
 
@@ -640,7 +684,9 @@ describe('finding what is installed', () => {
     expect(problems[0]).toContain(path.join(layer, 'hooks.json'))
     expect(problems[0]).toContain(path.join(layer, 'config.toml'))
     expect(problems[0]).toMatch(/Stop/)
-    expect(problems[0]).toMatch(/notifies twice per turn for UserPromptSubmit, Stop, SessionEnd/)
+    expect(problems[0]).toMatch(
+      /notifies twice per turn for SessionStart, SubagentStart, UserPromptSubmit, Stop, SessionEnd/,
+    )
     expect(problems[0]).toMatch(/notifai hooks uninstall --harness codex/)
     expect(problems[0]).not.toMatch(/--global/)
   })
@@ -692,7 +738,9 @@ describe('finding what is installed', () => {
     expect(claude).toBeDefined()
     expect(claude?.handlers.map((h) => h.event).sort()).toEqual([
       'SessionEnd',
+      'SessionStart',
       'Stop',
+      'SubagentStart',
       'UserPromptSubmit',
     ])
     expect(claude?.handlers.every((h) => h.groupIndex === 0 && h.handlerIndex === 0)).toBe(true)
@@ -725,17 +773,23 @@ describe('finding what is installed', () => {
     )
 
     const stale = codexTrustProblems(installations, env)
-    expect(stale).toHaveLength(3)
+    expect(stale).toHaveLength(5)
     expect(stale).toEqual(expect.arrayContaining([expect.stringMatching(/Stop.*changed.*\/hooks/i)]))
 
     writeFileSync(
       trustFile,
       `[hooks.state.${JSON.stringify(codexTrustKey(codex!, stop!))}]\ntrusted_hash = "${codexHookIdentityHash(stop!)}"\n`,
     )
-    expect(codexTrustProblems(installations, env)).toEqual([
-      expect.stringMatching(/UserPromptSubmit.*not trusted.*\/hooks/i),
-      expect.stringMatching(/SessionEnd.*not trusted.*\/hooks/i),
-    ])
+    const untrusted = codexTrustProblems(installations, env)
+    expect(untrusted).toHaveLength(4)
+    expect(untrusted).toEqual(
+      expect.arrayContaining([
+        expect.stringMatching(/SessionStart.*not trusted.*\/hooks/i),
+        expect.stringMatching(/SubagentStart.*not trusted.*\/hooks/i),
+        expect.stringMatching(/UserPromptSubmit.*not trusted.*\/hooks/i),
+        expect.stringMatching(/SessionEnd.*not trusted.*\/hooks/i),
+      ]),
+    )
 
     writeFileSync(
       trustFile,
@@ -828,6 +882,34 @@ describe('the OpenCode adapter', () => {
     expect(source).not.toContain('"permission.ask"')
   })
 
+  it('adds session activation through OpenCode system context without setup or network', async () => {
+    expect(source).toContain('"experimental.chat.system.transform"')
+    const generated = (await import(
+      `data:text/javascript;base64,${Buffer.from(source).toString('base64')}`
+    )) as {
+      NotifAIPlugin(input: { directory: string; client: object }): Promise<{
+        'experimental.chat.system.transform'?: (
+          input: object,
+          output: { system: string[] },
+        ) => Promise<void>
+      }>
+    }
+    const plugin = await generated.NotifAIPlugin({ directory: '/repo', client: {} })
+    const output = { system: ['existing context'] }
+
+    await plugin['experimental.chat.system.transform']?.({ sessionID: 'ses_1' }, output)
+
+    expect(output.system).toEqual([`existing context\n\n${SESSION_ACTIVATION_CONTEXT}`])
+
+    const internal = { system: ['internal agent-generation context'] }
+    await plugin['experimental.chat.system.transform']?.({}, internal)
+    expect(internal.system).toEqual(['internal agent-generation context'])
+
+    const empty = { system: [] as string[] }
+    await plugin['experimental.chat.system.transform']?.({ sessionID: 'ses_2' }, empty)
+    expect(empty.system).toEqual([SESSION_ACTIVATION_CONTEXT])
+  })
+
   it('publishes the session pointer on a user message without injecting content', () => {
     // The CLI has never emitted `hookSpecificOutput.additionalContext`, so the
     // injection this used to assert could not fire. The handler earns its place
@@ -1262,4 +1344,41 @@ describe('writing config.toml around what is already there', () => {
     expect(after).toContain('[[hooks.Stop]]')
     expect(after).not.toContain('hooks = {}')
   })
+
+  it('is a no-op when the serialized document already matches the file', () => {
+    const layer = layerFor('notifai-toml-noop-')
+    const file = path.join(layer, 'config.toml')
+    writeFileSync(file, '# keep me\nmodel = "gpt-5.6"\n')
+    applyPlan(file, { ...loadSettings(file), hooks: ours() })
+    const once = readFileSync(file, 'utf8')
+    applyPlan(file, { ...loadSettings(file), hooks: ours() })
+    expect(readFileSync(file, 'utf8')).toBe(once)
+  })
+})
+
+describe('emptied Codex representations', () => {
+  it('deletes an empty JSON hooks file instead of writing {}', () => {
+    const repo = mkdtempSync(path.join(os.tmpdir(), 'notifai-empty-json-'))
+    const file = path.join(repo, 'hooks.json')
+    applyPlan(file, { hooks: ours() })
+    expect(existsSync(file)).toBe(true)
+    const stripped = removeHooks(loadSettings(file), SCRIPT)
+    applyPlan(file, stripped.document)
+    expect(existsSync(file)).toBe(false)
+  })
+
+  it('keeps a trust-only TOML file and drops empty event tables', () => {
+    const repo = mkdtempSync(path.join(os.tmpdir(), 'notifai-trust-only-'))
+    const file = path.join(repo, 'config.toml')
+    writeFileSync(
+      file,
+      `model = "gpt-5.6"\n\n[hooks.state."${file}:stop:0:0"]\ntrusted_hash = "sha256:abc"\n`,
+    )
+    const stripped = removeHooks(loadSettings(file), SCRIPT)
+    applyPlan(file, stripped.document)
+    const after = readFileSync(file, 'utf8')
+    expect(after).toContain('model = "gpt-5.6"')
+    expect(after).toContain('trusted_hash')
+    expect(after).not.toContain('[[hooks.Stop]]')
+  })
 })

package/src/install-hooks.ts

@@ -2,7 +2,10 @@ import {
   existsSync,
   lstatSync,
   readFileSync,
+  readdirSync,
   realpathSync,
+  rmdirSync,
+  rmSync,
   statSync,
 } from 'node:fs'
 import { createHash } from 'node:crypto'
@@ -43,8 +46,7 @@ const OPENCODE_EVENTS = [
  * `hooks.json` or inline `[hooks]` tables in the same layer's `config.toml`.
  * We default a hook-empty layer to inline config and preserve whichever single
  * representation a populated layer already uses. Notifai lives in one of them,
- * never both — a layer whose other file holds someone else's hooks is that
- * other tool's arrangement, and stays untouched.
+ * never both.
  *
  * Cursor's native format is flat and lower-camel-cased, while OpenCode's
  * extension point is a JavaScript plugin module. Each therefore has a bounded
@@ -251,14 +253,37 @@ export function buildHookConfig(options: BuildOptions): HookConfig {
   const { adapterPath } = options
   const commandOptions = commandOptionsFrom(options)
   return {
+    SessionStart: [
+      {
+        hooks: [
+          {
+            type: 'command',
+            command: hookCommand(adapterPath, 'session-start', options.harness, commandOptions),
+            // Activation is local context only: no config, credentials, or network.
+            timeout: 5,
+          },
+        ],
+      },
+    ],
+    SubagentStart: [
+      {
+        hooks: [
+          {
+            type: 'command',
+            command: hookCommand(adapterPath, 'subagent-start', options.harness, commandOptions),
+            timeout: 5,
+          },
+        ],
+      },
+    ],
     UserPromptSubmit: [
       {
         hooks: [
           {
             type: 'command',
             command: hookCommand(adapterPath, 'user-prompt-submit', options.harness, commandOptions),
-            // Claude Code caps UserPromptSubmit at 30s; stay well inside it so
-            // a slow network can never delay the user's own prompt.
+            // Claude Code defaults UserPromptSubmit to 30s. Choose a shorter
+            // explicit budget so a slow network cannot delay the user's prompt.
             timeout: 15,
           },
         ],
@@ -299,13 +324,30 @@ interface CursorSettingsDocument {
 export function buildCursorHookConfig(options: BuildOptions): CursorHookConfig {
   const commandOptions = commandOptionsFrom(options)
   return {
+    sessionStart: [
+      {
+        command: hookCommand(options.adapterPath, 'session-start', 'cursor', commandOptions),
+        // Activation only emits local context and must not depend on setup.
+        timeout: 5,
+      },
+    ],
     beforeSubmitPrompt: [
       {
-        command: hookCommand(options.adapterPath, 'user-prompt-submit', 'cursor', commandOptions),
+        command: hookCommand(
+          options.adapterPath,
+          'user-prompt-submit',
+          'cursor',
+          commandOptions,
+        ),
         timeout: 15,
       },
     ],
     stop: [
+      {
+        command: hookCommand(options.adapterPath, 'activation-stop', 'cursor', commandOptions),
+        timeout: 5,
+        loop_limit: 1,
+      },
       {
         command: hookCommand(options.adapterPath, 'stop', 'cursor', commandOptions),
         timeout: BLOCKING_STOP_TIMEOUT_SECONDS,
@@ -527,24 +569,15 @@ export interface CodexLayerInspection {
 }
 
 /**
- * Where Notifai writes in this Codex layer: wherever Notifai already is, and
- * inline `config.toml` otherwise.
+ * Where Notifai writes in this Codex layer: wherever Notifai already is, then
+ * whichever single hook representation the layer already uses, and inline
+ * `config.toml` for a hook-empty or already-mixed layer.
  *
  * Codex supports `hooks.json` and inline `[hooks]` side by side, loads both,
- * and runs every matching handler. The tempting rule is to join whichever
- * representation the layer already uses, so Notifai never adds Codex's "prefer
- * one representation per layer" startup warning. Notifai must not do that,
- * because a hook entry carries no marker saying who owns it: a `hooks.json`
- * full of foreign handlers may be one a person wrote by hand or one a tool
- * regenerates wholesale, and those two look identical from here. Appending to
- * the second kind gets Notifai's handlers deleted the next time that tool
- * rewrites its file — silently, on a product whose entire job is reaching
- * someone who is not at the keyboard to notice it stopped.
- *
- * So Notifai only ever writes a file it owns. The warning it may cause is
- * Codex accurately reporting that two handler sets merge and all of them fire;
- * it is noise, and `codexCoexistenceNotes` explains it. That trade is
- * deliberate: visible noise over silent non-delivery.
+ * and runs every matching handler. Reusing the one populated representation is
+ * the generic layer contract: it avoids creating Codex's dual-representation
+ * warning and, for a managed layer, writes through the same authority that
+ * persists the layer rather than a sibling file it may regenerate away.
  *
  * Staying put where Notifai already is also keeps reinstalls idempotent and
  * preserves the `[hooks.state]` trust hash, which Codex keys by file path and
@@ -559,7 +592,13 @@ export function inspectCodexLayer(paths: CodexLayerPaths): CodexLayerInspection
   const ourJsonEvents = ourHandlerEvents(jsonDocument)
   const ourTomlEvents = ourHandlerEvents(tomlDocument)
   const writeTarget =
-    ourJsonEvents.length > 0 && ourTomlEvents.length === 0 ? paths.hooksJson : paths.configToml
+    ourJsonEvents.length > 0 && ourTomlEvents.length === 0
+      ? paths.hooksJson
+      : ourTomlEvents.length > 0
+        ? paths.configToml
+        : jsonEvents.length > 0 && tomlEvents.length === 0
+          ? paths.hooksJson
+          : paths.configToml
   return {
     paths,
     jsonEvents,
@@ -812,7 +851,7 @@ function isOurCommand(command: string, scriptPath: string): boolean {
 
 /** Cleanup-only recognition for unmistakable pre-marker Notifai commands. */
 function isLegacyNotifaiCommand(command: string): boolean {
-  const hook = `['"]?\\s+hook (?:user-prompt-submit|stop|session-end)\\b`
+  const hook = `['"]?\\s+hook (?:session-start|subagent-start|activation-stop|user-prompt-submit|stop|session-end)\\b`
   return (
     new RegExp(`(?:^|[\\s'"])notifai(?:\\.cmd)?${hook}`).test(command) ||
     new RegExp(
@@ -963,7 +1002,11 @@ export function removeHooks(existing: SettingsDocument, scriptPath: string): Mer
     if (removed) replaced.push(event)
     if (foreign.length > 0) hooks[event] = foreign
   }
-  return { document: { ...existing, hooks }, added: [], replaced, removed: [] }
+  const remaining = Object.keys(hooks).length > 0 ? hooks : undefined
+  const document = { ...existing }
+  if (remaining === undefined) delete document.hooks
+  else document.hooks = remaining
+  return { document, added: [], replaced, removed: [] }
 }
 
 /**
@@ -980,11 +1023,56 @@ export function applyPlan(file: string, document: SettingsDocument | CursorSetti
   const body = isTomlSettingsPath(file)
     ? tomlBody(file, document as SettingsDocument)
     : `${JSON.stringify(document, null, 2)}\n`
+  if (
+    (path.basename(file) === 'hooks.json' && isEmptyJsonDocument(body)) ||
+    (isTomlSettingsPath(file) && body.trim() === '')
+  ) {
+    if (existsSync(file)) rmSync(file, { force: true })
+    return
+  }
+  if (existsSync(file)) {
+    try {
+      if (readOwnedRegularFile(file) === body) return
+    } catch {
+      // A file we cannot re-read still needs the replacement below.
+    }
+  }
   atomicWriteFileSync(file, body, {
     requireCurrentUserOwner: true,
   })
 }
 
+function isEmptyJsonDocument(body: string): boolean {
+  try {
+    const parsed: unknown = JSON.parse(body)
+    return typeof parsed === 'object' && parsed !== null && !Array.isArray(parsed) && Object.keys(parsed).length === 0
+  } catch {
+    return false
+  }
+}
+
+/** Delete an emptied Codex hooks.json and a now-empty layer directory. */
+export function cleanupEmptiedCodexLayer(paths: CodexLayerPaths): void {
+  if (existsSync(paths.hooksJson)) {
+    try {
+      const document = loadSettings(paths.hooksJson)
+      const keys = Object.keys(document)
+      const hooksEmpty = document.hooks === undefined || Object.keys(document.hooks).length === 0
+      if (keys.every((key) => key === 'hooks') && hooksEmpty) {
+        rmSync(paths.hooksJson, { force: true })
+      }
+    } catch {
+      // Leave a file uninstall could not parse; the caller already reported it.
+    }
+  }
+  if (!existsSync(paths.dir)) return
+  try {
+    if (readdirSync(paths.dir).length === 0) rmdirSync(paths.dir)
+  } catch {
+    // A concurrently replaced directory is not ours to fight.
+  }
+}
+
 /**
  * A TOML file rewritten around its `[hooks]` tables, not over them.
  *
@@ -1243,7 +1331,7 @@ export function codexTrustProblems(
  * evidence that it has (and is itself worth reporting).
  */
 function isNotifaiCommand(command: string): boolean {
-  return / hook (user-prompt-submit|stop|session-end)\b/.test(command)
+  return / hook (session-start|subagent-start|activation-stop|user-prompt-submit|stop|session-end)\b/.test(command)
 }
 
 /** Every place either harness would read a Notifai handler from. */

package/src/interactive.ts

@@ -701,7 +701,7 @@ async function chooseLayer(): Promise<'global' | 'project' | 'local' | null> {
     options: [
       { value: 'global', label: 'This machine', hint: 'every project you work on here' },
       { value: 'project', label: 'This project, shared', hint: '.notifai/config.toml — commit it' },
-      { value: 'local', label: 'This project, just me', hint: 'config.local.toml — keep it gitignored' },
+      { value: 'local', label: 'This project, just me', hint: 'stored on this machine, not in the repo' },
     ],
     initialValue: 'global',
   })

package/src/logging.test.ts

@@ -14,6 +14,7 @@ import {
   LOG_SCHEMA_VERSION,
   activeLogPath,
   archiveLogPaths,
+  argvFlagNames,
   createLogger,
   logsDiskUsage,
   nullLogger,
@@ -182,9 +183,71 @@ describe('redaction', () => {
   })
 
   it('truncates a long string instead of carrying it whole', () => {
-    const shaped = shape({ body: 'x'.repeat(1000) }) as { body: string }
-    expect(shaped.body.length).toBeLessThan(500)
-    expect(shaped.body).toContain('+600 chars')
+    const shaped = shape({ detail: 'x'.repeat(1000) }) as { detail: string }
+    expect(shaped.detail.length).toBeLessThan(500)
+    expect(shaped.detail).toContain('+600 chars')
+  })
+
+  it('never persists notification content, answers, or raw argv at debug', () => {
+    const env = sandbox()
+    const logger = createLogger({ env, settings: { level: 'debug' } })
+    logger.debug('cli.start', {
+      argv: ['send', '--title', 'SECRET_TITLE', '--body', 'SECRET_BODY'],
+      title: 'SECRET_TITLE',
+      body: 'SECRET_BODY',
+      question: 'SECRET_QUESTION',
+      text: 'SECRET_REPLY',
+      answers: ['SECRET_ANSWER'],
+      choices: ['SECRET_CHOICE'],
+    })
+
+    const raw = readFileSync(activeLogPath(env), 'utf8')
+    expect(raw).not.toContain('SECRET_TITLE')
+    expect(raw).not.toContain('SECRET_BODY')
+    expect(raw).not.toContain('SECRET_QUESTION')
+    expect(raw).not.toContain('SECRET_REPLY')
+    expect(raw).not.toContain('SECRET_ANSWER')
+    expect(raw).not.toContain('SECRET_CHOICE')
+    const record = JSON.parse(raw) as LogRecord
+    expect(record.data).toMatchObject({
+      title_chars: 'SECRET_TITLE'.length,
+      body_chars: 'SECRET_BODY'.length,
+      question_chars: 'SECRET_QUESTION'.length,
+      text_chars: 'SECRET_REPLY'.length,
+      answers_count: 1,
+      choices_count: 1,
+      argv_count: 5,
+      flags: ['--title', '--body'],
+    })
+    expect(record.data).not.toHaveProperty('argv')
+    expect(record.data).not.toHaveProperty('title')
+  })
+
+  it('strips inline --name=value assignments so notification content is never logged', () => {
+    const inlineTitle = 'private title words'
+    const inlineBody = 'private body words'
+    expect(
+      argvFlagNames(['send', `--title=${inlineTitle}`, `--body=${inlineBody}`, '--reply', '--']),
+    ).toEqual(['--title', '--body', '--reply'])
+
+    const env = sandbox()
+    const logger = createLogger({ env, settings: { level: 'debug' } })
+    logger.debug('cli.start', {
+      argv: ['send', `--title=${inlineTitle}`, `--body=${inlineBody}`, 'plain'],
+    })
+
+    const raw = readFileSync(activeLogPath(env), 'utf8')
+    expect(raw).not.toContain(inlineTitle)
+    expect(raw).not.toContain(inlineBody)
+    expect(shape({ argv: ['send', `--title=${inlineTitle}`, '--choice=yes'] })).toEqual({
+      flags: ['--title', '--choice'],
+      argv_count: 3,
+    })
+    const record = JSON.parse(raw) as LogRecord
+    expect(record.data).toMatchObject({
+      flags: ['--title', '--body'],
+      argv_count: 4,
+    })
   })
 
   it('refuses to recurse for ever into a cyclic object', () => {

package/src/logging.ts

@@ -80,7 +80,7 @@ const LEVEL_RANK: Record<LogLevel, number> = { off: 0, error: 1, info: 2, debug:
  * existing one, and keep each event answering exactly one question.
  */
 export const LOG_EVENTS = [
-  /** A CLI invocation began: which command, which arguments, which version. */
+  /** A CLI invocation began: which command, which flag names, which version. */
   'cli.start',
   /** It ended: exit code and how long it took. */
   'cli.end',
@@ -90,6 +90,8 @@ export const LOG_EVENTS = [
   'config.resolved',
   /** One HTTP call to the service: method, path, status, duration. */
   'http.call',
+  /** A send crossed its ambiguous network boundary with this retry identity. */
+  'send.attempt',
   /** A notification was accepted by the service. */
   'send.submitted',
   /** What became of it per device. */
@@ -108,6 +110,8 @@ export const LOG_EVENTS = [
   'hook.gate',
   /** A question reached the user's devices. */
   'hook.pushed',
+  /** A retirement close was attempted, and whether the server proved it. */
+  'hook.retirement',
   /** The hook handed an answer back to the agent. */
   'hook.answer',
   /** The hook finished, with or without a decision. */
@@ -155,6 +159,10 @@ const MAX_DEPTH = 4
  */
 const SECRET_KEY_PATTERN = /secret|token|password|authorization|credential|verifier|api[_-]?key/i
 const MACHINE_TOKEN_PATTERN = /nfm_[A-Za-z0-9._-]{6,}/g
+/** Notification and question content: persist length, never the words. */
+const CONTENT_STRING_KEYS = new Set(['title', 'subtitle', 'body', 'text', 'question'])
+/** Choice labels, reply answers, and raw argv: persist counts, never values. */
+const CONTENT_LIST_KEYS = new Set(['answers', 'choices', 'argv'])
 
 export const REDACTED = '[redacted]'
 
@@ -207,6 +215,22 @@ function redactString(value: string): string {
   return `${scrubbed.slice(0, MAX_STRING_CHARS)}…(+${scrubbed.length - MAX_STRING_CHARS} chars)`
 }
 
+/**
+ * Flag names only — argv values are notification content and user text.
+ *
+ * `--title=SECRET` must become `--title`. Filtering on a `--` prefix is not
+ * enough: inline assignment would otherwise persist the value.
+ */
+export function argvFlagNames(argv: readonly string[]): string[] {
+  const names: string[] = []
+  for (const token of argv) {
+    if (!token.startsWith('--') || token === '--') continue
+    const eq = token.indexOf('=')
+    names.push(eq === -1 ? token : token.slice(0, eq))
+  }
+  return names
+}
+
 /**
  * Shape a value for the record: drop what must never be written, truncate what
  * would flood a reader, and refuse to recurse for ever into a cyclic object.
@@ -226,7 +250,26 @@ export function shape(value: unknown, depth = 0): unknown {
     const out: Record<string, unknown> = {}
     for (const [key, nested] of Object.entries(value as Record<string, unknown>)) {
       if (nested === undefined) continue
-      out[key] = SECRET_KEY_PATTERN.test(key) ? REDACTED : shape(nested, depth + 1)
+      if (SECRET_KEY_PATTERN.test(key)) {
+        out[key] = REDACTED
+        continue
+      }
+      if (CONTENT_STRING_KEYS.has(key) && typeof nested === 'string') {
+        out[`${key}_chars`] = nested.length
+        continue
+      }
+      if (key === 'argv' && Array.isArray(nested)) {
+        out.flags = argvFlagNames(
+          nested.filter((token): token is string => typeof token === 'string'),
+        )
+        out.argv_count = nested.length
+        continue
+      }
+      if (CONTENT_LIST_KEYS.has(key) && Array.isArray(nested)) {
+        out[`${key}_count`] = nested.length
+        continue
+      }
+      out[key] = shape(nested, depth + 1)
     }
     return out
   }