@raidiant/notifai 9.0.0 → 9.2.0

package/src/commands-init.ts

@@ -13,7 +13,7 @@ import { ApiCallError, NetworkError, type ApiClient } from './client.js'
 import { personalProjectConfigPath, type CliConfig } from './config.js'
 import { projectSlugFrom as inferredProjectSlugFrom } from './invocation-context.js'
 import { SKILLS_INSTALLER_SPEC, type SkillScope } from './native-skills.js'
-import { firstBlocker, type Readiness, type ReadinessRefresh, type ReadinessState } from './readiness.js'
+import { firstBlocker, readinessJson, type Readiness, type ReadinessRefresh, type ReadinessState } from './readiness.js'
 import { buildDraft, formatReceipt } from './send.js'
 import { loginCommand } from './commands-auth.js'
 import {
@@ -30,6 +30,8 @@ import { hooksInstallCommand, pickHarnessesToInstall } from './commands-hooks.js
 import {
   observedCompanionReceipt,
   readSetupProof,
+  setupProofProject,
+  setupProofApplies,
   setupProofIsStale,
   writeSetupProof,
 } from './commands-setup-proof.js'
@@ -49,6 +51,8 @@ export function projectSlugFrom(name: string): string {
 export type SetupScope = SkillScope
 
 export interface InitFlags {
+  /** Emit the final shared readiness model and never prompt. */
+  json?: boolean
   projectId?: string
   /**
    * Install the agent guidance skill. Tri-state on purpose:
@@ -397,19 +401,23 @@ async function runSetupProof(deps: CommandDeps): Promise<GapCloseResult> {
     return 'failed'
   }
   const candidates = readyCompanionDevices(devices)
-  const existing = readSetupProof(deps)
-  const target =
-    candidates.find(
-      (device) =>
-        device.device_id === existing?.device_id && existing.project === config.project.value,
-    ) ?? candidates[0]
+  const project = setupProofProject(deps, config.project.value)
+  const existing = readSetupProof(deps, project)
+  const existingApplies = setupProofApplies(
+    existing,
+    project,
+    candidates.map((device) => device.device_id),
+  )
+  const target = (existingApplies
+    ? candidates.find((device) => device.device_id === existing.device_id)
+    : undefined) ?? candidates[0]
   if (!target) {
     deps.io.err('Setup proof needs a receipt-capable iPhone or Android Companion App.')
     return 'pending'
   }
 
   let proof =
-    existing?.device_id === target.device_id && existing.project === config.project.value
+    existingApplies && existing.device_id === target.device_id
       ? existing
       : null
   const nowMs = (deps.now ?? Date.now)()
@@ -438,7 +446,7 @@ async function runSetupProof(deps: CommandDeps): Promise<GapCloseResult> {
     proof = {
       request_id: receipt.request_id,
       device_id: target.device_id,
-      project: config.project.value,
+      project,
       started_at: new Date((deps.now ?? Date.now)()).toISOString(),
     }
     if (!writeSetupProof(deps, proof)) return 'failed'
@@ -486,7 +494,7 @@ async function runSetupProof(deps: CommandDeps): Promise<GapCloseResult> {
         proof = {
           request_id: receipt.request_id,
           device_id: target.device_id,
-          project: config.project.value,
+          project,
           started_at: new Date(now()).toISOString(),
         }
         if (!writeSetupProof(deps, proof)) return 'failed'
@@ -621,19 +629,32 @@ async function resolveSetupScope(
 }
 
 export async function initCommand(deps: CommandDeps, flags: InitFlags): Promise<number> {
-  const setupScope = await resolveSetupScope(deps, flags)
+  const workingDeps: CommandDeps = flags.json === true
+    ? {
+        ...deps,
+        io: {
+          interactive: false,
+          out: () => {},
+          err: (line) => deps.io.err(line),
+          confirm: async () => false,
+          openUrl: (url) => deps.io.openUrl(url),
+        },
+      }
+    : deps
+  const setupScope = await resolveSetupScope(workingDeps, flags)
   if (setupScope === 'usage') return EXIT.usage
   const resolved: InitFlags = {
     ...flags,
     ...(setupScope === undefined ? {} : { setupScope, skillsScope: flags.skillsScope ?? setupScope }),
   }
-  await deps.io.intro?.('Notifai setup')
+  await workingDeps.io.intro?.('Notifai setup')
 
   const skillOpts = resolved.setupScope === undefined ? {} : { skillScope: resolved.setupScope }
-  let readiness = await assessReadiness(deps, skillOpts)
+  let readiness = await assessReadiness(workingDeps, { ...skillOpts, ...(flags.json === true ? { json: true } : {}) })
   const reassess = (refresh?: readonly ReadinessRefresh[]) =>
-    assessReadiness(deps, {
+    assessReadiness(workingDeps, {
       ...skillOpts,
+      ...(flags.json === true ? { json: true } : {}),
       ...(refresh === undefined ? {} : { previous: readiness, refresh }),
     })
   let failed = false
@@ -661,9 +682,9 @@ export async function initCommand(deps: CommandDeps, flags: InitFlags): Promise<
       }
 
       if (state.status === 'optional-gap') {
-        if (remedy.by !== 'cli' || !(await wantsOptional(deps, state, resolved))) continue
+        if (remedy.by !== 'cli' || !(await wantsOptional(workingDeps, state, resolved))) continue
         attempted.add(state.id)
-        const result = await closeGap(deps, state, resolved)
+        const result = await closeGap(workingDeps, state, resolved)
         if (result === 'failed') failed = true
         if (result === 'failed' && state.status === 'optional-gap') {
           readiness = await reassess(refreshAfterClose(state.id))
@@ -681,7 +702,7 @@ export async function initCommand(deps: CommandDeps, flags: InitFlags): Promise<
 
       if (remedy.by === 'cli') {
         attempted.add(state.id)
-        const result = await closeGap(deps, state, resolved)
+        const result = await closeGap(workingDeps, state, resolved)
         if (result === 'failed') failed = true
         if (result !== 'closed') {
           stop = true
@@ -697,11 +718,11 @@ export async function initCommand(deps: CommandDeps, flags: InitFlags): Promise<
       if (
         remedy.by === 'user-here' &&
         remedy.interactive === true &&
-        deps.io.interactive === true
+        workingDeps.io.interactive === true
       ) {
         attempted.add(state.id)
-        deps.io.out('Opening your browser to approve this machine — Ctrl-C to stop.')
-        if ((await loginCommand(deps, {})) !== EXIT.ok) {
+        workingDeps.io.out('Opening your browser to approve this machine — Ctrl-C to stop.')
+        if ((await loginCommand(workingDeps, {})) !== EXIT.ok) {
           failed = true
           stop = true
           break
@@ -714,10 +735,10 @@ export async function initCommand(deps: CommandDeps, flags: InitFlags): Promise<
       if (
         state.id === 'devices' &&
         remedy.by === 'user-elsewhere' &&
-        deps.io.interactive === true
+        workingDeps.io.interactive === true
       ) {
         attempted.add(state.id)
-        const result = await waitForReadyDevice(deps, state)
+        const result = await waitForReadyDevice(workingDeps, state)
         if (result === 'failed') failed = true
         if (result !== 'closed') {
           stop = true
@@ -736,10 +757,11 @@ export async function initCommand(deps: CommandDeps, flags: InitFlags): Promise<
     if (stop || !advanced) break
   }
 
-  await printInitClose(deps, readiness, resolved)
+  if (flags.json === true) deps.io.out(JSON.stringify(readinessJson(readiness), null, 2))
+  else await printInitClose(deps, readiness, resolved)
   const blocker = firstBlocker(readiness)
   if (blocker === null) return failed ? EXIT.failed : EXIT.ok
-  return failed || deps.io.interactive !== true ? EXIT.failed : EXIT.ok
+  return failed || workingDeps.io.interactive !== true ? EXIT.failed : EXIT.ok
 }
 
 function isHookSubstate(id: string): boolean {

package/src/commands-send.ts

@@ -6,10 +6,9 @@ import {
   type ReplyView,
   type SubmissionReceipt,
 } from '@raidiant/notifai-protocol'
-import { randomBytes } from 'node:crypto'
 import { ApiCallError, NetworkError } from './client.js'
 import type { FlagOverrides, loadConfig } from './config.js'
-import { MIN_REPLY_WINDOW_SECONDS, readProjectSession, readSessionState } from './hooks.js'
+import { MIN_REPLY_WINDOW_SECONDS, readSessionState } from './hooks.js'
 import {
   buildDraft,
   formatReceipt,
@@ -18,7 +17,7 @@ import {
   validateMediaInputs,
   type SendFlags,
 } from './send.js'
-import { recordObservedDeliveryProof } from './commands-setup-proof.js'
+import { recordObservedDeliveryProof, setupProofProject } from './commands-setup-proof.js'
 import {
   EXIT,
   authedClient,
@@ -28,6 +27,13 @@ import {
   type CommandDeps,
 } from './commands-core.js'
 import { activeHarnessSession } from './commands-harness-context.js'
+import { resolveCommandSession } from './command-session.js'
+import {
+  beginSendAttempt,
+  semanticMediaIds,
+  sendDraftFingerprint,
+  settleSendAttempt,
+} from './send-attempts.js'
 import {
   acknowledgementCommand,
   printAcknowledgementStatus,
@@ -49,9 +55,14 @@ export async function sendCommand(
     noWait?: boolean
     replyTimeout?: number
     idempotencyKey?: string
+    retry?: boolean
     baseUrl?: string
   },
 ): Promise<number> {
+  if (flags.retry === true && flags.idempotencyKey !== undefined) {
+    deps.io.err('Pass --retry or --idempotency-key, not both.')
+    return EXIT.usage
+  }
   const hasChoice = Array.isArray(flags.choice)
     ? flags.choice.length > 0
     : flags.choice !== undefined
@@ -139,6 +150,35 @@ export async function sendCommand(
   }
   const authed = authedClient(deps, config)
   if (!authed) return EXIT.auth
+  const credential = deps.store.load()!
+  let semanticImages: string[]
+  try {
+    semanticImages = semanticMediaIds(flags.image ?? [], deps.cwd)
+  } catch (err) {
+    deps.io.err(`Could not fingerprint an image for safe retry: ${String(err)}`)
+    return EXIT.usage
+  }
+  const semanticBuild = buildDraft(
+    config,
+    { ...flags, ...(semanticImages.length > 0 ? { image: semanticImages } : {}) },
+    source.invocation,
+  )
+  if (!semanticBuild.ok) {
+    deps.io.err(semanticBuild.error)
+    return EXIT.usage
+  }
+  const attempt = beginSendAttempt({
+    env: deps.env,
+    credential,
+    fingerprint: sendDraftFingerprint(semanticBuild.draft, credential),
+    retry: flags.retry === true,
+    ...(flags.idempotencyKey === undefined ? {} : { idempotencyKey: flags.idempotencyKey }),
+    now: (deps.now ?? Date.now)(),
+  })
+  if (!attempt.ok) {
+    deps.io.err(`${attempt.code}: ${attempt.message}`)
+    return EXIT.usage
+  }
   const mediaIds: string[] = []
   for (const image of flags.image ?? []) {
     if (image.startsWith('med_')) {
@@ -147,6 +187,7 @@ export async function sendCommand(
     }
     const uploaded = await uploadImage(deps, authed.client, image, config.media_origins.value)
     if (!uploaded.ok) {
+      settleSendAttempt(deps.env, attempt.attemptId)
       if (uploaded.error !== null) deps.io.err(uploaded.error)
       return uploaded.exit
     }
@@ -155,16 +196,19 @@ export async function sendCommand(
   flags = { ...flags, image: mediaIds }
   const build = buildDraft(config, flags, source.invocation)
   if (!build.ok) {
+    settleSendAttempt(deps.env, attempt.attemptId)
     deps.io.err(build.error)
     return EXIT.usage
   }
   const capabilities = CAPABILITIES_V1.describe(build.platform)
   if (!capabilities) {
+    settleSendAttempt(deps.env, attempt.attemptId)
     deps.io.err(`No capability contract is available for ${build.platform}.`)
     return EXIT.usage
   }
   const validation = validateDraft(build.draft, capabilities)
   if (!validation.ok) {
+    settleSendAttempt(deps.env, attempt.attemptId)
     for (const issue of validation.errors) deps.io.err(`${issue.path}: ${issue.message}`)
     return EXIT.usage
   }
@@ -181,15 +225,14 @@ export async function sendCommand(
     )
   }
   const waitSeconds = flags.noWait ? 0 : config.wait_seconds.value
-  const idempotencyKey = flags.idempotencyKey ?? `cli-${randomBytes(12).toString('base64url')}`
+  const idempotencyKey = attempt.idempotencyKey
   // Persist the retry identity before entering the ambiguous network boundary.
   // If the process is killed after the server accepts but before a response,
   // this is the only durable way to reconstruct the same Agent Event key.
   log(deps).info('send.attempt', {
+    attempt_id: attempt.attemptId,
     idempotency_key: idempotencyKey,
-    kind: flags.reply ? 'question' : (flags.kind ?? 'update'),
-    title: flags.title,
-    session_id: source.invocation.source?.session_id ?? null,
+    replay: attempt.replay,
   })
   let receipt: SubmissionReceipt
   try {
@@ -202,17 +245,23 @@ export async function sendCommand(
     if (exit === EXIT.network) {
       deps.io.err(
         'The server may have accepted this Notification Request before the connection failed. ' +
-          `Retry the same send with \`--idempotency-key ${idempotencyKey}\` so this Agent Event cannot create a duplicate.`,
+          'Re-run the exact semantic send with `--retry`; the CLI will reuse its opaque attempt identity.',
       )
     }
     if (err instanceof ApiCallError && err.code === 'no_active_devices') {
       deps.io.err(
-        'After setup succeeds, repeat this original Notification Request with ' +
-          `\`--idempotency-key ${idempotencyKey}\`; the setup verification request does not replace this Agent Event.`,
+        'After setup succeeds, repeat this exact original Notification Request with `--retry`; ' +
+          'the setup verification request does not replace this Agent Event.',
       )
     }
+    if (!(exit === EXIT.network || (err instanceof ApiCallError && err.code === 'no_active_devices'))) {
+      settleSendAttempt(deps.env, attempt.attemptId)
+    } else {
+      deps.io.err(`Opaque retry attempt: ${attempt.attemptId}. Re-run the exact semantic send with \`--retry\`; do not retry automatically.`)
+    }
     return exit
   }
+  settleSendAttempt(deps.env, attempt.attemptId)
   const receiptExit = receiptExitCode(receipt)
   // The single most useful line in the log: it ties the local invocation to
   // the server-side request id, which is what every later question about this
@@ -383,12 +432,15 @@ export async function repliesCommand(
     return EXIT.usage
   }
   let requestIds = requestedId === undefined ? [] : [requestedId]
+  let lifecycleSessionId: string | undefined
   if (flags.pending === true) {
-    const sessionId = readProjectSession(deps.cwd, deps.env, (deps.now ?? Date.now)())
-    if (sessionId === null) {
+    const session = resolveCommandSession(deps)
+    if (session === null) {
       deps.io.err('No active session pointer is available in this directory.')
       return EXIT.noReply
     }
+    const sessionId = session.sessionId
+    lifecycleSessionId = sessionId
     // Every delivered question in the session's queue, in registration order —
     // an agent may have several outstanding at once.
     const state = readSessionState(sessionId, deps.env)
@@ -445,7 +497,11 @@ export async function repliesCommand(
     return EXIT.usage
   }
 
-  const config = loadLoggedConfig(deps, { cwd: deps.cwd, env: deps.env })
+  const config = loadLoggedConfig(deps, {
+    cwd: deps.cwd,
+    env: deps.env,
+    ...(lifecycleSessionId === undefined ? {} : { sessionId: lifecycleSessionId }),
+  })
   const authed = authedClient(deps, config)
   if (!authed) return EXIT.auth
   try {
@@ -649,7 +705,7 @@ export async function statusCommand(
   if (!authed) return EXIT.auth
   try {
     const snapshot = await authed.client.evidence(requestId)
-    recordObservedDeliveryProof(deps, snapshot, config.project.value)
+    recordObservedDeliveryProof(deps, snapshot, setupProofProject(deps, config.project.value))
     if (flags.json) {
       deps.io.out(JSON.stringify(snapshot, null, 2))
       return EXIT.ok

package/src/commands-setup-proof.test.ts

@@ -0,0 +1,72 @@
+import { mkdtempSync, rmSync } from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { afterEach, describe, expect, it } from 'vitest'
+import type { CommandDeps } from './commands-core.js'
+import type { MachineCredential } from './credentials.js'
+import { readSetupProof, setupProofApplies, writeSetupProof } from './commands-setup-proof.js'
+
+const roots: string[] = []
+afterEach(() => {
+  while (roots.length > 0) rmSync(roots.pop()!, { recursive: true, force: true })
+})
+
+function deps(root: string, cwd: string, credential: MachineCredential): CommandDeps {
+  return {
+    cwd,
+    env: { XDG_STATE_HOME: path.join(root, 'state'), XDG_CONFIG_HOME: path.join(root, 'config') },
+    io: { out: () => {}, err: () => {}, confirm: async () => false, openUrl: () => {} },
+    store: {
+      load: () => credential,
+      save: () => {},
+      clear: () => {},
+      describe: () => 'test',
+    },
+  }
+}
+
+describe('stable setup delivery proof identity', () => {
+  it('is shared by linked checkouts of one Project and separated by Project', () => {
+    const root = mkdtempSync(path.join(os.tmpdir(), 'notifai-proof-identity-'))
+    roots.push(root)
+    const credential = {
+      machineId: 'mac_one',
+      machineName: 'One',
+      baseUrl: 'https://app.notifai.test',
+      secret: 'approval-one',
+    }
+    const first = deps(root, path.join(root, 'worktree-a'), credential)
+    const second = deps(root, path.join(root, 'worktree-b'), credential)
+    const proof = {
+      request_id: 'req_proof',
+      device_id: 'dev_one',
+      project: 'shared-project',
+      started_at: '2026-08-26T00:00:00.000Z',
+    }
+    expect(writeSetupProof(first, proof)).toBe(true)
+    expect(readSetupProof(second, 'shared-project')).toEqual(proof)
+    expect(readSetupProof(second, 'different-project')).toBeNull()
+  })
+
+  it('invalidates on service, machine approval, machine, or device change', () => {
+    const root = mkdtempSync(path.join(os.tmpdir(), 'notifai-proof-invalidation-'))
+    roots.push(root)
+    const credential = {
+      machineId: 'mac_one',
+      machineName: 'One',
+      baseUrl: 'https://app.notifai.test',
+      secret: 'approval-one',
+    }
+    const original = deps(root, root, credential)
+    expect(writeSetupProof(original, {
+      request_id: 'req_proof',
+      device_id: 'dev_one',
+      project: 'project',
+      started_at: '2026-08-26T00:00:00.000Z',
+    })).toBe(true)
+    expect(readSetupProof(deps(root, root, { ...credential, baseUrl: 'https://other.test' }), 'project')).toBeNull()
+    expect(readSetupProof(deps(root, root, { ...credential, machineId: 'mac_two' }), 'project')).toBeNull()
+    expect(readSetupProof(deps(root, root, { ...credential, secret: 'approval-two' }), 'project')).toBeNull()
+    expect(setupProofApplies(readSetupProof(original, 'project'), 'project', ['dev_two'])).toBe(false)
+  })
+})

package/src/commands-setup-proof.ts

@@ -4,34 +4,41 @@ import {
   existsSync,
   mkdirSync,
   readFileSync,
-  realpathSync,
   writeFileSync,
 } from 'node:fs'
 import path from 'node:path'
 import { stateDir } from './config.js'
 import type { CommandDeps } from './commands-core.js'
+import { inferInvocationContext } from './invocation-context.js'
 
-interface SetupProofRecord {
+export interface SetupProofRecord {
   request_id: string
   device_id: string
   project: string | null
   started_at: string
 }
 
-function setupProofPath(deps: CommandDeps): string {
-  let projectDir = path.resolve(deps.cwd)
-  try {
-    projectDir = realpathSync(projectDir)
-  } catch {
-    // A deleted or not-yet-created cwd cannot collide with a real directory:
-    // the resolved absolute path is still a stable local identity for it.
-  }
-  const digest = createHash('sha256').update(projectDir).digest('hex').slice(0, 32)
+export function setupProofProject(deps: CommandDeps, configured: string | null): string | null {
+  return configured ?? inferInvocationContext(deps.cwd).project
+}
+
+function setupProofPath(deps: CommandDeps, project: string | null): string | null {
+  const credential = deps.store.load()
+  if (credential === null) return null
+  const approval = createHash('sha256')
+    .update('notifai-setup-proof-approval-v1\0')
+    .update(credential.secret)
+    .digest('base64url')
+  const digest = createHash('sha256')
+    .update(JSON.stringify({ project, machine_id: credential.machineId, service: credential.baseUrl, approval }))
+    .digest('hex')
+    .slice(0, 32)
   return path.join(stateDir(deps.env), 'setup-proofs', `${digest}.json`)
 }
 
-export function readSetupProof(deps: CommandDeps): SetupProofRecord | null {
-  const file = setupProofPath(deps)
+export function readSetupProof(deps: CommandDeps, project: string | null): SetupProofRecord | null {
+  const file = setupProofPath(deps, project)
+  if (file === null) return null
   if (!existsSync(file)) return null
   try {
     const parsed = JSON.parse(readFileSync(file, 'utf8')) as Partial<SetupProofRecord>
@@ -48,7 +55,11 @@ export function readSetupProof(deps: CommandDeps): SetupProofRecord | null {
 }
 
 export function writeSetupProof(deps: CommandDeps, proof: SetupProofRecord): boolean {
-  const file = setupProofPath(deps)
+  const file = setupProofPath(deps, proof.project)
+  if (file === null) {
+    deps.io.err('Could not save setup proof without an Approved Machine credential.')
+    return false
+  }
   try {
     mkdirSync(path.dirname(file), { recursive: true })
     writeFileSync(file, `${JSON.stringify(proof, null, 2)}\n`, { mode: 0o600 })
@@ -82,6 +93,14 @@ export function setupProofIsStale(proof: SetupProofRecord, now: number): boolean
   return Number.isFinite(started) && now - started > SETUP_PROOF_STALE_MS
 }
 
+export function setupProofApplies(
+  proof: SetupProofRecord | null,
+  project: string | null,
+  deviceIds: readonly string[],
+): proof is SetupProofRecord {
+  return proof !== null && proof.project === project && deviceIds.includes(proof.device_id)
+}
+
 /**
  * Persist ordinary send/status Companion Receipts as the project's delivery
  * proof so doctor does not demand a second verification request.