@trygocode/notify 0.6.11 → 0.6.13

package/README.md

@@ -530,6 +530,44 @@ npm publish, real-device E2E), see
 
 ## Changelog
 
+### 0.6.13
+
+- **Fix: Cursor questions still didn't notify on real turns (the live race).**
+  `afterAgentResponse` fires per assistant *message* and can run BEFORE the
+  transcript records the final `AskQuestion` tool call, so it writes a `finished`
+  record; `on-stop` then trusted that stored `finished` and skipped the tool
+  recheck, silently dropping a real A/B/C-card question. Corrected the stop-time
+  precedence (Codex-reviewed) to: `error > stop-time AskQuestion tool > stored
+  awaiting_input > final-text awaiting_input > finished` — a stored `finished`
+  no longer has precedence, so `on-stop` ALWAYS re-checks the transcript for a
+  tool ask. Re-running detection is safe; delivery stays bounded by the per-turn
+  `--dedupe-key`.
+- **Fix (double-ping): Cursor-imported Claude questions.** Now that the native
+  Cursor `afterAgentResponse`→`stop` path detects in-Cursor questions, the
+  imported Claude `Notification` copy (carrying `cursor_version`) is suppressed
+  in `on-notification` so a Claude-in-Cursor question fires exactly one ping.
+  Standalone Claude questions (no `cursor_version`) still notify.
+- **Perf: bounded the stop-time transcript text scan.** The finished-turn text
+  classifier now reads only a bounded tail of the transcript (same cap as the
+  AskQuestion reader) instead of loading the whole growing JSONL every stop.
+- **Privacy: redact Windows paths from question snippets** (drive-letter
+  `C:\…` and UNC `\\host\share\…`), matching the existing Unix-path redaction.
+- **Diagnostics: added always-on evidence lines** to `on-agent-response` and
+  `on-stop` (`ON-AGENT-RESPONSE: …`, `question resolve → …`) so a real live turn
+  is diagnosable from `~/.gocode/notify.log` — id prefixes + verdicts only, no
+  raw text or paths.
+
+### 0.6.12
+
+- **Hardening for the 0.6.11 AskQuestion-tool detection** (Codex-reviewed): the
+  stop-time transcript recheck now only runs when there is no per-turn record
+  (removes a double-notify vector on a repeated stop); tool question snippets are
+  sanitized + length-capped like every other snippet; the bounded transcript
+  tail-reader keeps a complete first line when the read lands exactly on a line
+  boundary; snippet field precedence is `questions[0].question → question →
+  prompt → title → text`; and non-object JSONL records (`null`, scalars, arrays)
+  are skipped instead of dereferenced. Same behaviour as 0.6.11, just safer.
+
 ### 0.6.11
 
 - **Fixed: the `AskQuestion` TOOL (the A/B/C options card) now notifies you.**

package/dist/src/cli.js

@@ -12,7 +12,7 @@ import { VERSION } from "./version.js";
 import { login } from "./login.js";
 import { resolveServerUrl } from "./creds.js";
 import { launch } from "./launch.js";
-import { send, isNotifyKind, NOTIFY_KINDS, } from "./send.js";
+import { send, appendLog, isNotifyKind, NOTIFY_KINDS, } from "./send.js";
 import { enqueue, flush } from "./outbox.js";
 import { gatherStatus, formatStatus, formatStatusSteps } from "./status.js";
 import { isAgentDriven, stdoutSink } from "./agent.js";
@@ -20,7 +20,7 @@ import { serveStdio } from "./mcp.js";
 import { setup } from "./setup.js";
 import { uninstall } from "./uninstall.js";
 import { cmdConfig } from "./config.js";
-import { onStop, parseCursorStopStatus, cursorStopStatusToKind, clickTarget, projectLabel, } from "./on_stop.js";
+import { onStop, parseCursorStopStatus, cursorStopStatusToKind, isClaudeHookImportedByCursor, clickTarget, projectLabel, } from "./on_stop.js";
 import { classifyResponse } from "./question_classifier.js";
 import { detectAskToolFromHookStdin } from "./transcript_ask.js";
 import { writeTurnState, conversationIdFromHookStdin, } from "./turn_state.js";
@@ -803,23 +803,33 @@ export async function cmdOnNotification(args, deps = {}) {
     const hookStdin = deps.hookStdin !== undefined
         ? deps.hookStdin
         : await (deps.readStdin ?? readStdinIfPipe)();
-    // NOTE (2026-07-28): we DELIBERATELY do NOT suppress Cursor-imported Claude
-    // hooks here (unlike the `on-stop`/completion path). The `cursor_version`
-    // suppression exists to avoid DOUBLE notifications when BOTH a native Cursor
-    // hook AND the imported Claude hook fire for the same turn. That double-fire
-    // only happens for COMPLETION: Cursor's native `stop` hook works, so its
-    // imported Claude `Stop` would duplicate it → suppress.
+    // ── Cursor-imported Claude question suppression (Codex P1, 2026-08-31) ──────
+    // HISTORY: the 2026-07-28 build deliberately FORWARDED Cursor-imported Claude
+    // `Notification` questions because, at the time, Cursor had NO working native
+    // question signal (its `AskQuestion` `postToolUse` hook is broken upstream and
+    // it has no `Notification` event), so the imported Claude hook was the ONLY
+    // signal for an in-Cursor Claude question.
     //
-    // For QUESTIONS there is no competing native hook to dedupe against: Cursor's
-    // own question signal (the `AskQuestion` `postToolUse` hook) is BROKEN upstream
-    // (Cursor docs: "postToolUse ... excluding the AskQuestion tool, which is a
-    // known bug") and Cursor has NO `Notification` event at all. So when Claude
-    // runs inside Cursor and asks a question, the imported Claude `Notification`
-    // hook is the ONLY signal we get. Suppressing it (the old behaviour) silently
-    // dropped every in-Cursor Claude question — the exact "questions don't notify"
-    // regression. We now always forward a genuine input-requiring notification,
-    // regardless of whether Cursor imported it. The per-turn `--dedupe-key` still
-    // coalesces any accidental repeat of the SAME question.
+    // THAT IS NO LONGER TRUE. The `afterAgentResponse` → `stop` classifier path
+    // (turn-state + transcript AskQuestion reader) NOW gives Cursor a native
+    // question signal for EVERY turn, including Claude-in-Cursor ones (verified in
+    // notify.log: an in-Cursor Claude question fires `turn is a QUESTION
+    // (turn-state)` on the native `stop`). So forwarding the imported Claude
+    // `Notification` here as well produces TWO `awaiting_input` pings with
+    // DIFFERENT dedupe keys (`$CLAUDE_SESSION_ID-notify` vs `cursor-stop`) that the
+    // server can't coalesce → a double ping. Suppress the imported copy: the native
+    // Cursor path is authoritative when Cursor imported the hook (payload carries
+    // `cursor_version`). A STANDALONE Claude `Notification` (no `cursor_version`)
+    // is still forwarded — that's Claude's only question signal outside Cursor.
+    if (isClaudeHookImportedByCursor(source, hookStdin)) {
+        try {
+            await appendLog("ON-NOTIFICATION: Cursor-imported Claude question → suppressed (native Cursor path is authoritative)", { home: deps.home });
+        }
+        catch {
+            /* logging must never block */
+        }
+        return 0;
+    }
     const notificationType = parseClaudeNotificationType(hookStdin);
     if (notificationType !== undefined &&
         !CLAUDE_INPUT_NOTIFICATION_TYPES.has(notificationType)) {
@@ -944,7 +954,28 @@ export async function cmdOnAgentResponse(args, deps = {}) {
                 record.reason = reason;
         }
         const writeImpl = deps.writeTurnStateImpl ?? writeTurnState;
-        await writeImpl(record, { home: deps.home, ttlMs: deps.ttlMs, now: deps.now });
+        let stateWrite = "ok";
+        try {
+            await writeImpl(record, { home: deps.home, ttlMs: deps.ttlMs, now: deps.now });
+        }
+        catch {
+            stateWrite = "failed";
+        }
+        // Unconditional evidence line (independent of --quiet) so a real live turn is
+        // diagnosable from ~/.gocode/notify.log without a debug apparatus (Codex
+        // 2026-08-31). Redaction-safe: id PREFIXES + lengths + verdicts only, never
+        // raw response text or paths.
+        try {
+            const convShort = conversationId.slice(0, 8);
+            const genShort = generationId ? generationId.slice(0, 8) : "-";
+            await appendLog(`ON-AGENT-RESPONSE: conv=${convShort} gen=${genShort} text_len=${text.length} ` +
+                `text_verdict=${textVerdict.awaiting ? "awaiting_input" : "finished"} ` +
+                `ask_tool=${askVerdict.verdict} chosen=${awaiting ? "awaiting_input" : "finished"} ` +
+                `reason=${reason ?? "-"} state_write=${stateWrite}`, { home: deps.home });
+        }
+        catch {
+            /* logging must never block */
+        }
         const detail = awaiting
             ? `classified as awaiting_input (${reason})`
             : "classified as finished";

package/dist/src/on_stop.js

@@ -38,7 +38,7 @@ import { notifyDesktop, } from "./desktop_notify.js";
 import { decorateTitle, decorateBody } from "./notify_copy.js";
 import { readTurnState, conversationIdFromHookStdin, } from "./turn_state.js";
 import { classifyResponse } from "./question_classifier.js";
-import { detectAskToolFromHookStdin } from "./transcript_ask.js";
+import { detectAskToolFromHookStdin, transcriptPathFromHookStdin, readTail, } from "./transcript_ask.js";
 /**
  * Parse the Cursor `stop` hook stdin JSON and extract the `status` field.
  * Best-effort: returns `undefined` on absent/empty/unparseable input or when the
@@ -581,25 +581,22 @@ export function autopilotOwnsTurn(env = process.env) {
 export async function lastAssistantTextFromTranscript(hookStdin) {
     if (!hookStdin || hookStdin.trim() === "")
         return undefined;
-    let transcriptPath;
-    try {
-        const p = JSON.parse(hookStdin);
-        const v = p.transcript_path ?? p.transcriptPath;
-        if (typeof v === "string" && v.trim() !== "")
-            transcriptPath = v;
-    }
-    catch {
-        return undefined;
-    }
+    const transcriptPath = transcriptPathFromHookStdin(hookStdin);
     if (!transcriptPath)
         return undefined;
+    // Bounded tail read (Codex 2026-08-31): a long-lived conversation's transcript
+    // grows without bound, and this classifier runs on EVERY finished Cursor stop.
+    // We only need the tail (the current turn's assistant message), so cap the read
+    // exactly like the AskQuestion reader instead of loading O(total history).
     let raw;
     try {
-        raw = await fs.readFile(transcriptPath, "utf8");
+        raw = await readTail(transcriptPath);
     }
     catch {
         return undefined;
     }
+    if (raw == null)
+        return undefined;
     let lastText;
     for (const line of raw.split("\n")) {
         const t = line.trim();
@@ -662,37 +659,43 @@ export async function resolveTurnQuestion(hookStdin, opts = {}) {
     catch {
         record = undefined;
     }
-    // The turn-state record (written by `on-agent-response`) is authoritative when
-    // present — it ALREADY folds in the AskQuestion-tool signal (cli.ts writes
-    // `awaiting_input` with reason `askquestion_tool`). Consuming it exactly once
-    // per turn is what bounds this to a single notification, so when a record
-    // exists we DO NOT re-run the transcript tool check (that redundant recheck was
-    // a double-notify vector on a repeated stop — Codex 2026-08-31).
-    if (record) {
-        if (record.classification === "awaiting_input") {
-            return { awaiting: true, snippet: record.snippet, source: "turn-state" };
-        }
-        return { awaiting: false, source: "turn-state" };
-    }
-    // No record (e.g. `on-agent-response` never ran, or its record expired). The
-    // AskQuestion TOOL (A/B/C card) is still a DEFINITIVE signal Cursor won't
-    // surface any other way, so re-check the transcript's latest assistant turn.
-    // This only runs on the no-record path, so it can't double-fire against the
-    // record above. Best-effort, never throws.
+    // ── Precedence (Codex 2026-08-31, corrected) ──────────────────────────────
+    //   error (handled by the caller via stop status)
+    //   > stop-time AskQuestion TOOL   (ALWAYS re-checked — see below)
+    //   > stored awaiting_input        (afterAgentResponse's positive verdict)
+    //   > final-text awaiting_input    (transcript text classifier fallback)
+    //   > finished
+    // A stored `finished` has NO precedence — it is only fallback evidence. THE
+    // BUG we're fixing: `afterAgentResponse` fires PER ASSISTANT MESSAGE and can
+    // run BEFORE the transcript records the final AskQuestion `tool_use`, so it
+    // writes `finished`; if `on-stop` then trusts that record and skips the tool
+    // recheck, a real A/B/C-card question is silently dropped. So we ALWAYS run
+    // the transcript tool recheck here. Re-running DETECTION is safe; re-running
+    // DELIVERY is bounded by the send-layer `--dedupe-key cursor-stop` (a repeated
+    // stop for the same turn coalesces server-side), NOT by consuming the record.
     try {
         const ask = await (opts.detectAskToolImpl ?? detectAskToolFromHookStdin)(hookStdin);
         if (ask.verdict === "ask") {
             return {
+                // Prefer the record's snippet only if it too was a tool ask; otherwise
+                // the freshly-read tool question is the most accurate.
                 awaiting: true,
-                snippet: ask.snippet ?? "Agent asked you a question",
+                snippet: ask.snippet ?? record?.snippet ?? "Agent asked you a question",
                 source: "askquestion-tool",
             };
         }
     }
     catch {
-        /* fall through to the text classifier */
+        /* fall through to the record / text classifier */
     }
-    // Fallback: classify the transcript's last assistant message.
+    // Stored positive verdict from afterAgentResponse (a real free-text question).
+    if (record?.classification === "awaiting_input") {
+        return { awaiting: true, snippet: record.snippet, source: "turn-state" };
+    }
+    // A stored `finished` is NOT trusted to end the decision — fall through to the
+    // text classifier on the transcript (covers a text question the per-message
+    // classifier missed at afterAgentResponse time). Only when the transcript adds
+    // no signal do we honour `finished`.
     const readTranscript = opts.readTranscriptText ?? lastAssistantTextFromTranscript;
     let text;
     try {
@@ -701,8 +704,12 @@ export async function resolveTurnQuestion(hookStdin, opts = {}) {
     catch {
         text = undefined;
     }
-    if (!text)
+    if (!text) {
+        // No transcript text: honour a stored verdict if we have one, else no signal.
+        if (record)
+            return { awaiting: false, source: "turn-state" };
         return { awaiting: false, source: "none" };
+    }
     const verdict = classifyResponse(text);
     return verdict.awaiting
         ? { awaiting: true, snippet: verdict.snippet, source: "transcript-fallback" }
@@ -872,6 +879,9 @@ export async function onStop(opts = {}) {
                     ttlMs: opts.turnStateTtlMs,
                     now: opts.now,
                 });
+                // Unconditional evidence line so a real turn's decision is visible in the
+                // log (Codex 2026-08-31): shows which signal won.
+                await logLine(`question resolve → awaiting=${verdict.awaiting} source=${verdict.source}`);
                 if (verdict.awaiting) {
                     turnIsQuestion = true;
                     turnQuestionSnippet = verdict.snippet;

package/dist/src/question_classifier.js

@@ -157,6 +157,12 @@ export function questionSnippet(clause, maxLen = 160) {
         return undefined;
     // Redact absolute-ish paths (…/a/b/c) and long hex/token blobs from the body.
     s = s.replace(/(?:\/[\w.-]+){2,}\/?/g, "…").replace(/\b[0-9a-f]{16,}\b/gi, "…");
+    // Redact Windows path forms too (Codex 2026-08-31): drive-letter absolute
+    // paths (C:\Users\joe\repo) and UNC shares (\\host\share\dir). Both can leak a
+    // username or repo layout on a lock screen, same as the Unix form above.
+    s = s
+        .replace(/\\\\[\w.-]+(?:\\[\w.$-]+)+\\?/g, "…") // \\host\share\dir (UNC)
+        .replace(/\b[A-Za-z]:\\(?:[\w.$-]+\\?)+/g, "…"); // C:\a\b\c (drive-letter)
     s = s.replace(/\s+/g, " ").trim();
     if (s === "")
         return undefined;

package/dist/src/version.js

@@ -1,2 +1,2 @@
 // Single source of truth for the CLI version. Keep in sync with package.json.
-export const VERSION = "0.6.11";
+export const VERSION = "0.6.13";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trygocode/notify",
-  "version": "0.6.11",
+  "version": "0.6.13",
   "description": "Free phone + branded desktop notifications for any coding agent (Cursor, Claude Code, OpenCode, Ralph/Homer) via the GoCode app.",
   "license": "MIT",
   "type": "module",