agent-yes 1.169.0 → 1.170.1

package/dist/{subcommands-BZPW0UVn.js → subcommands-BFlpV23b.js}

@@ -1,15 +1,485 @@
 import { t as invokedCliName } from "./invokedCli-uqM2YYA7.js";
-import { t as agentYesHome } from "./agentYesHome-_eJa3DaX.js";
-import { a as updateGlobalPidStatus, i as readGlobalPids } from "./globalPidIndex-DlmmJlO8.js";
-import { t as loadSharedCliDefaults } from "./configShared-CEyhl0WH.js";
-import { n as isWebrtcSpec } from "./webrtcLink-BG0Xc4-W.js";
-import { a as resolveRemoteSpec, i as readRemotes } from "./remotes-BmAPylU_.js";
+import { n as logger } from "./logger-CDIsZ-Pp.js";
+import { t as agentYesHome } from "./agentYesHome-CtHb5b71.js";
+import { a as updateGlobalPidStatus, i as readGlobalPids } from "./globalPidIndex-CoNr7tS8.js";
+import { t as loadSharedCliDefaults } from "./configShared-0MnIQ652.js";
+import { n as isWebrtcSpec } from "./webrtcLink-B7REGtK2.js";
+import { a as resolveRemoteSpec, i as readRemotes } from "./remotes-CC-4GuJb.js";
 import ms from "ms";
 import yargs from "yargs";
-import { appendFile, mkdir, open, readFile, stat, writeFile } from "fs/promises";
+import { appendFile, mkdir, open, readFile, readdir, rename, rm, stat, writeFile } from "fs/promises";
 import { homedir } from "os";
 import path from "path";
+import { randomUUID } from "node:crypto";
+import os from "node:os";
 
+//#region ts/notifyInbox.ts
+/**
+* Pure, fs-free core for the subagent→parent notification inbox — the storage
+* and watermark layer under `ay notify` / `ay notifyd`.
+*
+* Motivation (real incident): a parent agent fanned out sub-agents that finished
+* their work but sat at an idle `❯` prompt WITHOUT exiting (claude-yes does not
+* exit on idle). Claude Code's background-task notification only fires on process
+* EXIT, so the parent never learned the children went idle and left them parked
+* 16 minutes. `ay ls --watch` already streams transitions, but it is PULL: the
+* parent must run the watch loop. The whole point of this pain is the parent is
+* NOT watching. So we accumulate qualifying edges into a per-parent append-only
+* inbox that the parent drains on its own schedule (its Monitor loop), with a
+* persisted cursor so a parent that restarts reads only the unread edges.
+*
+* This module is the pure part (path math, NDJSON (de)serialization, seq/cursor
+* filtering, retention decisions) so it is trivially unit-testable, mirroring
+* `lsWatch.ts` / `needsInput.ts` / `resultEnvelope.ts`. The fs read/write + lock
+* + CLI live in `subcommands.ts`; the detection/debounce lives in
+* `notifyRouter.ts`.
+*/
+/** Root dir for all notification state. */
+function notifyDir() {
+	return path.join(agentYesHome(), "notify");
+}
+/** Per-host inbox directory (pids are only unique within a host). */
+function inboxDir(host) {
+	return path.join(notifyDir(), "inbox", sanitizeHost(host));
+}
+/** Absolute path of one parent's append-only NDJSON inbox. */
+function inboxPath(host, parentPid) {
+	return path.join(inboxDir(host), `${parentPid}.ndjson`);
+}
+/** Sidecar seq counter for a parent inbox (last allocated seq). */
+function seqPath(host, parentPid) {
+	return path.join(inboxDir(host), `${parentPid}.seq`);
+}
+/** Per-consumer cursor directory for a parent inbox. */
+function cursorDir(host, parentPid) {
+	return path.join(notifyDir(), "cursors", sanitizeHost(host), String(parentPid));
+}
+/** Absolute path of one consumer's cursor file for a parent inbox. */
+function cursorPath(host, parentPid, consumer = "parent") {
+	return path.join(cursorDir(host, parentPid), `${sanitizeConsumer(consumer)}.json`);
+}
+/** The daemon singleton lock dir (mkdir-based, like pidStore). */
+function daemonLockDir() {
+	return path.join(notifyDir(), "notifyd.lock");
+}
+/**
+* Owner metadata inside the lock dir ({pid, started_at, ts}) — the SINGLE source
+* of truth for the running daemon's identity, used for stale-lock steal and for
+* `notifyd status`/`stop` (a running daemon refreshes `ts` each tick).
+*/
+function daemonLockOwnerPath() {
+	return path.join(daemonLockDir(), "owner.json");
+}
+/** Registry dir of parents currently running `ay notify watch` (heartbeats). */
+function watchersDir() {
+	return path.join(notifyDir(), "watchers");
+}
+/** Heartbeat file for one watching parent. */
+function watcherPath(parentPid) {
+	return path.join(watchersDir(), `${parentPid}.json`);
+}
+/** A watcher heartbeat is "live" if refreshed within this window. */
+const WATCHER_TTL_MS = 15e3;
+function sanitizeSegment(s, fallback) {
+	const cleaned = s.replace(/[^A-Za-z0-9._-]/g, "_");
+	return cleaned === "" || cleaned === "." || cleaned === ".." ? fallback : cleaned;
+}
+function sanitizeHost(host) {
+	return sanitizeSegment(host, "localhost");
+}
+function sanitizeConsumer(consumer) {
+	return sanitizeSegment(consumer, "parent");
+}
+/** Serialize one event to its NDJSON line (no trailing newline). */
+function serializeEvent(ev) {
+	return JSON.stringify(ev);
+}
+/**
+* Parse an inbox's raw text into events. Tolerant by design: a torn final line
+* (a writer mid-append) or any unparseable line is skipped, never throws — a
+* reader must survive a concurrent writer. Order is file order (= seq order,
+* since a single locked writer appends in increasing seq).
+*/
+function parseInboxText(text) {
+	const out = [];
+	for (const line of text.split("\n")) {
+		const t = line.trim();
+		if (!t) continue;
+		try {
+			const ev = JSON.parse(t);
+			if (isValidEvent(ev)) out.push(ev);
+		} catch {}
+	}
+	return out;
+}
+const EDGES = new Set([
+	"needs_input",
+	"idle",
+	"exited"
+]);
+/**
+* Full shape validation at the storage boundary — a torn/partial line missing
+* the correlation fields must never flow through to a consumer's output. Every
+* event we surface has the fields a reader relies on.
+*/
+function isValidEvent(ev) {
+	if (!ev || typeof ev !== "object") return false;
+	const e = ev;
+	return typeof e.seq === "number" && typeof e.ts === "number" && typeof e.host === "string" && typeof e.parent_pid === "number" && typeof e.child_pid === "number" && typeof e.cli === "string" && typeof e.cwd === "string" && typeof e.edge === "string" && EDGES.has(e.edge) && typeof e.state === "string" && (e.question === null || typeof e.question === "string");
+}
+/** Next seq to allocate given the last stored seq counter (or the inbox max). */
+function nextSeq(lastSeq) {
+	return (Number.isFinite(lastSeq) && lastSeq > 0 ? lastSeq : 0) + 1;
+}
+/** Highest seq present in a parsed inbox (0 when empty). */
+function maxSeq(events) {
+	let m = 0;
+	for (const e of events) if (e.seq > m) m = e.seq;
+	return m;
+}
+/**
+* Filter events for `--since <seq>`: strictly-greater than the given seq. A
+* `since` of 0/undefined returns everything.
+*/
+function filterSinceSeq(events, sinceSeq) {
+	if (!sinceSeq || sinceSeq <= 0) return events.slice();
+	return events.filter((e) => e.seq > sinceSeq);
+}
+/** Filter events after a wall-clock `--since <ts>` (inclusive lower bound). */
+function filterSinceTs(events, sinceTs) {
+	if (!sinceTs || sinceTs <= 0) return events.slice();
+	return events.filter((e) => e.ts >= sinceTs);
+}
+/** Unread = seq strictly greater than the consumer's cursor. */
+function filterUnread(events, cursorSeq) {
+	return events.filter((e) => e.seq > (cursorSeq > 0 ? cursorSeq : 0));
+}
+/** Parse a cursor file's text; a missing/garbage cursor reads as seq 0. */
+function parseCursor(text) {
+	if (!text) return { seq: 0 };
+	try {
+		const c = JSON.parse(text);
+		return { seq: Number.isFinite(c?.seq) && c.seq > 0 ? c.seq : 0 };
+	} catch {
+		return { seq: 0 };
+	}
+}
+function serializeCursor(seq) {
+	return JSON.stringify({ seq: Math.max(0, Math.floor(seq)) });
+}
+/**
+* Rotation decision (pure): given an inbox's events, a byte cap, and the minimum
+* un-acked cursor across ALL consumers, return the events to KEEP after
+* rotating. Critically, an event with `seq > protectAboveSeq` is NEVER dropped —
+* that is the at-least-once guarantee: we must not evict an edge no consumer has
+* acknowledged yet, even under the byte cap. Below that watermark we keep the
+* newest events that fit the cap (and at least `minKeep`).
+*/
+function rotateKeep(events, capBytes, protectAboveSeq = 0, minKeep = 100) {
+	if (events.length <= minKeep) return events.slice();
+	const kept = [];
+	let bytes = 0;
+	for (let i = events.length - 1; i >= 0; i--) {
+		const e = events[i];
+		const line = serializeEvent(e) + "\n";
+		bytes += line.length;
+		if (e.seq > protectAboveSeq || kept.length < minKeep || bytes <= capBytes) kept.push(e);
+		else break;
+	}
+	kept.reverse();
+	return kept;
+}
+
+//#endregion
+//#region ts/notifyStore.ts
+/**
+* Filesystem side of the notification inbox — the impure half of the pure
+* `notifyInbox.ts` path/serialization core. Handles the locked append (so
+* concurrent daemon ticks / future writers never interleave a seq), inbox and
+* cursor reads/writes, and retention GC.
+*
+* The lock is a mkdir-based advisory lock (same primitive `pidStore` uses), held
+* only for the microseconds of a read-counter → append-line → write-counter, so
+* contention is negligible even with many parents.
+*/
+/** Stable local host id — the pid namespace is per-host. */
+function hostId() {
+	return os.hostname() || "localhost";
+}
+function pidAlive(pid) {
+	if (!Number.isFinite(pid) || pid <= 0) return false;
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (e) {
+		return e.code === "EPERM";
+	}
+}
+/**
+* Pure steal decision for a per-inbox lock (extracted so it's unit-testable):
+* steal the lock ONLY when its holder is provably gone (torn/missing owner on a
+* lock that has EXISTED longer than the grace, or a dead pid) or its heartbeat is
+* stale — NEVER merely because the contender has waited a while.
+*
+* Crucially, the torn-owner grace is measured from the LOCK INSTANCE's age
+* (`lockAgeMs` = now − lockDir mtime), NOT from how long the contender has been
+* waiting. Otherwise a contender that waited out one holder could instantly steal
+* the NEXT holder's freshly-created lock during its mkdir→write-owner window
+* (torn but brand-new) — letting two writers into the critical section.
+*/
+function shouldStealLock(ownerRaw, now, opts) {
+	const graceMs = opts.graceMs ?? 1e3;
+	let ownerPid = 0;
+	let ownerTs = 0;
+	let parsed = false;
+	try {
+		const o = JSON.parse(ownerRaw);
+		ownerPid = o?.pid ?? 0;
+		ownerTs = o?.ts ?? 0;
+		parsed = true;
+	} catch {}
+	if (!parsed || ownerPid <= 0 || ownerTs <= 0) return opts.lockAgeMs > graceMs;
+	const holderDead = ownerPid !== opts.selfPid && !opts.isAlive(ownerPid);
+	const holderStale = now - ownerTs > opts.staleMs;
+	return holderDead || holderStale;
+}
+async function ensureDir(dir) {
+	await mkdir(dir, { recursive: true }).catch(() => {});
+}
+/**
+* Atomically overwrite a single file (temp + rename) so a concurrent reader never
+* observes a torn/partial write — the sweep invariant for every single-file
+* mutation (cursor, watcher heartbeat, lock owner). Returns whether it landed.
+*/
+async function atomicWrite(file, data) {
+	const tmp = `${file}.${randomUUID()}.tmp`;
+	try {
+		await writeFile(tmp, data);
+		await rename(tmp, file);
+		return true;
+	} catch {
+		await rm(tmp, { force: true }).catch(() => {});
+		return false;
+	}
+}
+/**
+* Acquire a per-inbox lock; returns a release fn. Ownership is proven ONLY by a
+* successful `mkdir(recursive:false)` (atomic exclusive create), and stealing is
+* driven by HOLDER LIVENESS, not elapsed wait time: the holder writes an
+* `owner` file ({pid, ts}) on acquire AND heartbeats its ts for the whole time
+* it holds the lock, so a contender steals ONLY when that holder is dead or its
+* heartbeat is stale. A live holder whose critical section legitimately runs long
+* (a big GC rewrite, a slow disk) is never robbed — its heartbeat stays fresh;
+* and a wedged holder stops heartbeating, so staleMs still reclaims it. There is
+* deliberately NO wall-clock backstop: elapsed wait time alone never steals, so a
+* live holder is inviolable.
+*/
+async function acquireLock(lockDir, staleMs = 3e4) {
+	const ownerFile = path.join(lockDir, "owner");
+	const token = randomUUID();
+	const readOwnerToken = async () => {
+		try {
+			return JSON.parse(await readFile(ownerFile, "utf8")).token ?? null;
+		} catch {
+			return null;
+		}
+	};
+	const stampOwner = async () => {
+		const tmp = `${ownerFile}.${token}.tmp`;
+		try {
+			await writeFile(tmp, JSON.stringify({
+				pid: process.pid,
+				ts: Date.now(),
+				token
+			}));
+			await rename(tmp, ownerFile);
+			return true;
+		} catch {
+			await rm(tmp, { force: true }).catch(() => {});
+			return false;
+		}
+	};
+	const lockAgeMs = async () => {
+		const m = await stat(lockDir).then((s) => s.mtimeMs).catch(() => Date.now());
+		return Date.now() - m;
+	};
+	for (;;) try {
+		await mkdir(lockDir, { recursive: false });
+		if (!await stampOwner()) {
+			await rm(lockDir, {
+				recursive: true,
+				force: true
+			}).catch(() => {});
+			await new Promise((r) => setTimeout(r, 15));
+			continue;
+		}
+		const beat = setInterval(() => {
+			(async () => {
+				if (await readOwnerToken() !== token) {
+					clearInterval(beat);
+					return;
+				}
+				await stampOwner();
+			})();
+		}, Math.max(500, Math.floor(staleMs / 3)));
+		if (typeof beat.unref === "function") beat.unref();
+		return async () => {
+			clearInterval(beat);
+			if (await readOwnerToken() === token) await rm(lockDir, {
+				recursive: true,
+				force: true
+			}).catch(() => {});
+		};
+	} catch (e) {
+		if (e.code !== "EEXIST") throw e;
+		if (shouldStealLock(await readFile(ownerFile, "utf8").catch(() => ""), Date.now(), {
+			staleMs,
+			lockAgeMs: await lockAgeMs(),
+			selfPid: process.pid,
+			isAlive: pidAlive
+		})) {
+			await rm(lockDir, {
+				recursive: true,
+				force: true
+			}).catch(() => {});
+			continue;
+		}
+		await new Promise((r) => setTimeout(r, 15));
+	}
+}
+/**
+* Append one event to a parent's inbox under lock, allocating the next seq. The
+* caller passes the event WITHOUT seq (we stamp it). Returns the stamped seq.
+*/
+async function appendEvent(parentPid, ev) {
+	const host = ev.host;
+	const dir = inboxDir(host);
+	await ensureDir(dir);
+	const release = await acquireLock(path.join(dir, `${parentPid}.lock`));
+	try {
+		let last = 0;
+		const counterRaw = await readFile(seqPath(host, parentPid), "utf8").catch(() => "");
+		const parsed = parseInt(counterRaw.trim(), 10);
+		if (Number.isFinite(parsed) && parsed > 0) last = parsed;
+		else last = maxSeq(parseInboxText(await readFile(inboxPath(host, parentPid), "utf8").catch(() => "")));
+		const seq = nextSeq(last);
+		const full = {
+			...ev,
+			seq
+		};
+		await writeFile(seqPath(host, parentPid), String(seq));
+		await appendFile(inboxPath(host, parentPid), serializeEvent(full) + "\n");
+		return seq;
+	} finally {
+		await release();
+	}
+}
+/** Read + parse a parent's inbox (empty array when none). */
+async function readInbox(host, parentPid) {
+	return parseInboxText(await readFile(inboxPath(host, parentPid), "utf8").catch(() => ""));
+}
+/** All parent pids that currently have an inbox on this host. */
+async function listInboxParents(host) {
+	const names = await readdir(inboxDir(host)).catch(() => []);
+	const pids = [];
+	for (const n of names) {
+		const m = /^(\d+)\.ndjson$/.exec(n);
+		if (m) pids.push(parseInt(m[1], 10));
+	}
+	return pids;
+}
+async function getCursor(host, parentPid, consumer = "parent") {
+	return parseCursor(await readFile(cursorPath(host, parentPid, consumer), "utf8").catch(() => null)).seq;
+}
+/**
+* Minimum cursor across ALL consumers of a parent inbox — the watermark below
+* which rotation may evict events (nothing above it has been acked by every
+* reader). Returns 0 when there are no consumers — which PROTECTS EVERYTHING:
+* with a 0 watermark, `rotateKeep` treats every event as unacked and evicts
+* nothing (an inbox nobody reads is never trimmed).
+*/
+async function minConsumerCursor(host, parentPid) {
+	const cursors = (await readdir(cursorDir(host, parentPid)).catch(() => [])).filter((n) => n.endsWith(".json")).map((n) => n.slice(0, -5));
+	if (cursors.length === 0) return 0;
+	let min = Infinity;
+	for (const c of cursors) min = Math.min(min, await getCursor(host, parentPid, c));
+	return Number.isFinite(min) ? min : 0;
+}
+async function setCursor(host, parentPid, seq, consumer = "parent") {
+	const p = cursorPath(host, parentPid, consumer);
+	await ensureDir(path.dirname(p));
+	await atomicWrite(p, serializeCursor(seq));
+}
+/**
+* Retention: delete inboxes (+ their seq counter + cursors) for parents that are
+* both dead and unreferenced by any live child. `capBytes` also rotates a live
+* inbox that has grown past the cap, keeping the newest events.
+*/
+async function gcInboxes(host, livePids, liveChildParentPids, capBytes = 10 * 1024 * 1024) {
+	const parents = await listInboxParents(host);
+	for (const p of parents) {
+		const release = await acquireLock(path.join(inboxDir(host), `${p}.lock`));
+		try {
+			if (!livePids.has(p) && !liveChildParentPids.has(p)) {
+				await rm(inboxPath(host, p), { force: true }).catch(() => {});
+				await rm(seqPath(host, p), { force: true }).catch(() => {});
+				await rm(cursorDir(host, p), {
+					recursive: true,
+					force: true
+				}).catch(() => {});
+				continue;
+			}
+			const size = await stat(inboxPath(host, p)).then((s) => s.size).catch(() => 0);
+			if (size <= capBytes) continue;
+			const events = await readInbox(host, p);
+			const kept = rotateKeep(events, capBytes, await minConsumerCursor(host, p));
+			if (kept.length < events.length) await writeFile(inboxPath(host, p), kept.map(serializeEvent).join("\n") + "\n");
+			else logger.warn(`[notify] inbox for parent ${p} is ${size} bytes (> soft cap ${capBytes}) but all events are unacked — cursor not advancing?`);
+		} finally {
+			await release();
+		}
+	}
+}
+/** Register / refresh this parent's watch heartbeat (atomically, so a concurrent
+* liveWatchers never reads a torn file and transiently drops the watcher). */
+async function heartbeatWatcher(parentPid, startedAt) {
+	await ensureDir(watchersDir());
+	await atomicWrite(watcherPath(parentPid), JSON.stringify({
+		pid: parentPid,
+		started_at: startedAt,
+		ts: Date.now()
+	}));
+}
+/** Remove this parent's watch heartbeat (on watch exit). */
+async function clearWatcher(parentPid) {
+	await rm(watcherPath(parentPid), { force: true }).catch(() => {});
+}
+/**
+* Live watchers as a map of parent pid → the parent's own `started_at` (its
+* authoritative self-reported start time, so the daemon never has to guess it
+* from the registry and stamp a 0). A watcher counts as live ONLY if its
+* heartbeat is fresh AND its process is actually alive — so a crashed `watch`
+* whose heartbeat lingers for the TTL doesn't keep the daemon writing to a dead
+* parent's inbox (which would violate "nothing happens unless you watch"). A
+* heartbeat with a missing/non-positive `started_at` is treated as NOT live: the
+* daemon's cross-session scope guard keys off a positive parent start time, so a
+* 0 would defeat it — fail closed.
+*/
+async function liveWatchers(now = Date.now()) {
+	const names = await readdir(watchersDir()).catch(() => []);
+	const live = /* @__PURE__ */ new Map();
+	for (const n of names) {
+		if (!n.endsWith(".json")) continue;
+		const raw = await readFile(path.join(watchersDir(), n), "utf8").catch(() => "");
+		try {
+			const o = JSON.parse(raw);
+			if (typeof o?.pid === "number" && typeof o?.started_at === "number" && o.started_at > 0 && typeof o?.ts === "number" && now - o.ts <= WATCHER_TTL_MS && pidAlive(o.pid)) live.set(o.pid, o.started_at);
+		} catch {}
+	}
+	return live;
+}
+
+//#endregion
 //#region ts/agentTree.ts
 /**
 * Link records into a forest via parent_pid === wrapper_pid. Records whose
@@ -159,12 +629,26 @@ function parseTaskCounts(lines) {
 
 //#endregion
 //#region ts/badges.ts
-const BADGE_DEFS = [{
-	id: "goal-active",
-	label: "goal",
-	title: "A /goal Stop-hook loop is active on this agent",
-	pattern: /\/goal active/i
-}];
+const BADGE_DEFS = [
+	{
+		id: "goal-active",
+		label: "goal",
+		title: "A /goal Stop-hook loop is active on this agent",
+		pattern: /\/goal active/i
+	},
+	{
+		id: "session-limit",
+		label: "limit",
+		title: "Usage session limit hit — waiting for the reset time shown on screen",
+		pattern: /you['’]?ve hit your session limit/i
+	},
+	{
+		id: "retrying",
+		label: "retry",
+		title: "Waiting for the API — the CLI is auto-retrying on its own backoff (no action needed)",
+		pattern: /Waiting for API response[\s\S]{0,40}will retry in \d/i
+	}
+];
 /**
 * Which badge ids match the given rendered screen lines. Pure so it's
 * unit-tested without a live PTY/log file.
@@ -173,6 +657,22 @@ function matchBadges(lines, defs = BADGE_DEFS) {
 	const text = lines.join("\n");
 	return defs.filter((d) => d.pattern.test(text)).map((d) => d.id);
 }
+/**
+* A time-derived flag (NOT screen-matched): lit when the user typed at this
+* agent's terminal within the last few seconds. The ls code appends its id from
+* the Rust runner's stdin-activity marker, so it resolves through `badgeDef`
+* like any other chip — but `matchBadges` never produces it (it isn't in
+* BADGE_DEFS, and its pattern can't match), keeping screen matching pure.
+*/
+const TYPING_BADGE = {
+	id: "typing",
+	label: "typing",
+	title: "The user is typing at this agent's terminal — ay send backs off until they pause",
+	pattern: /(?!)/
+};
+function badgeDef(id, defs = BADGE_DEFS) {
+	return defs.find((d) => d.id === id) ?? (id === TYPING_BADGE.id ? TYPING_BADGE : void 0);
+}
 
 //#endregion
 //#region ts/needsInput.ts
@@ -549,6 +1049,8 @@ const SUBCOMMANDS = new Set([
 	"ps",
 	"status",
 	"result",
+	"notify",
+	"notifyd",
 	"read",
 	"cat",
 	"tail",
@@ -574,6 +1076,14 @@ const STUCK_THRESHOLD_MS = (() => {
 	const n = Number(process.env.AGENT_YES_STUCK_MS);
 	return Number.isFinite(n) && n > 0 ? n : 300 * 1e3;
 })();
+const SEND_SETTLE_QUIET_MS = 150;
+const SEND_SETTLE_MAX_MS = 1500;
+const SEND_CONFIRM_QUIET_MS = 400;
+const SEND_CONFIRM_MAX_MS = 1200;
+const SEND_CONFIRM_MIN_GROWTH_BYTES = 8;
+const SEND_SUBMIT_MAX_RETRIES = 2;
+const SEND_TYPING_POLL_MS = 200;
+const SEND_TYPING_MAX_WAIT_MS = 1e4;
 /**
 * Whether `name` is a subcommand. `managerCommands` (default true, for the
 * generic `ay`/`agent-yes` entry) additionally admits manager-only commands
@@ -600,6 +1110,8 @@ async function runSubcommand(argv) {
 			case "ps": return await cmdLs(rest);
 			case "status": return await cmdStatus(rest);
 			case "result": return await cmdResult(rest);
+			case "notify": return await cmdNotify(rest);
+			case "notifyd": return await cmdNotifyd(rest);
 			case "read":
 			case "cat": return await cmdRead(rest, { mode: "cat" });
 			case "tail": return await cmdRead(rest, { mode: "tail" });
@@ -614,23 +1126,23 @@ async function runSubcommand(argv) {
 			case "restart": return await cmdRestart(rest);
 			case "note": return await cmdNote(rest);
 			case "serve": {
-				const { cmdServe } = await import("./serve-D-joIHrL.js");
+				const { cmdServe } = await import("./serve-De1gAWNI.js");
 				return cmdServe(rest);
 			}
 			case "setup": {
-				const { cmdSetup } = await import("./setup-K6VTmirE.js");
+				const { cmdSetup } = await import("./setup-nlMqyEPB.js");
 				return cmdSetup(rest);
 			}
 			case "schedule": {
-				const { cmdSchedule } = await import("./schedule-DTHFMzDj.js");
+				const { cmdSchedule } = await import("./schedule-ChTPIcXf.js");
 				return cmdSchedule(rest);
 			}
 			case "remote": {
-				const { cmdRemote } = await import("./remotes-cx_GDFPj.js");
+				const { cmdRemote } = await import("./remotes-BQMr4_En.js");
 				return cmdRemote(rest);
 			}
 			case "reap":
-				await (await import("./reaper-BQgDb85W.js")).sweep();
+				await (await import("./reaper-jfSmog15.js")).sweep();
 				return 0;
 			case "help": return cmdHelp(managerCommands);
 			default: return null;
@@ -1019,7 +1531,7 @@ async function fetchRemoteRecordsRaw(url, token, opts) {
 		let base = url;
 		let bearer = token;
 		if (isWebrtcSpec(url)) {
-			const { startWebrtcBridge } = await import("./webrtcRemote-SybKurg9.js");
+			const { startWebrtcBridge } = await import("./webrtcRemote-Bx-eD_0I.js");
 			bridge = await startWebrtcBridge(url);
 			base = bridge.baseUrl;
 			bearer = bridge.token;
@@ -1052,41 +1564,85 @@ async function runAllRemotesLs(opts) {
 		host: alias,
 		records
 	})))]);
-	const rows = [];
-	if (localResult.status === "fulfilled") for (const r of localResult.value.records) rows.push({
-		host: "local",
-		rec: r
-	});
-	for (const res of remoteResults) if (res.status === "fulfilled") for (const r of res.value.records) rows.push({
+	const byHost = [];
+	const gitRootCache = /* @__PURE__ */ new Map();
+	const gitInfoCache = /* @__PURE__ */ new Map();
+	if (localResult.status === "fulfilled") {
+		const enriched = await Promise.all(localResult.value.records.map(async (r) => {
+			const { state, question } = await deriveLiveState(r);
+			const [tasks, badges, git, typing] = state !== "stopped" ? await Promise.all([
+				r.log_file ? extractTaskCounts(r.log_file) : Promise.resolve(null),
+				r.log_file ? extractBadges(r.log_file) : Promise.resolve([]),
+				gitStatusOnce(r.cwd, gitRootCache, gitInfoCache),
+				isUserTyping(r.pid)
+			]) : [
+				null,
+				[],
+				null,
+				false
+			];
+			return {
+				...r,
+				status: state,
+				question,
+				last_active_at: await deriveLastActiveAt(r),
+				tasks,
+				badges: typing ? [...badges, TYPING_BADGE.id] : badges,
+				git
+			};
+		}));
+		byHost.push({
+			host: "local",
+			records: enriched
+		});
+	}
+	for (const res of remoteResults) if (res.status === "fulfilled") byHost.push({
 		host: res.value.host,
-		rec: r
+		records: res.value.records
+	});
+	const rows = [];
+	for (const { host, records } of byHost) for (const { record, prefix } of flattenForest(buildAgentForest(records))) rows.push({
+		host,
+		rec: record,
+		prefix
 	});
 	if (rows.length === 0) {
 		process.stderr.write("no running agents\n");
 		return 0;
 	}
 	const termWidth = process.stdout.columns ?? 120;
+	const now = Date.now();
+	const ageOf = (rec) => humanizeAge(now - (rec.last_active_at ?? rec.started_at));
+	const badgeOf = (rec) => rec.tasks ? `${rec.tasks.done}/${rec.tasks.total} ` : "";
 	const hostW = Math.max(4, ...rows.map((r) => r.host.length));
 	const pidW = Math.max(3, ...rows.map((r) => String(r.rec.pid).length));
 	const cliW = Math.max(3, ...rows.map((r) => String(r.rec.cli).length));
 	const statusW = Math.max(6, ...rows.map((r) => String(r.rec.status).length));
+	const ageW = Math.max(3, ...rows.map((r) => ageOf(r.rec).length));
 	const cwdW = Math.max(3, ...rows.map((r) => shortenPath(String(r.rec.cwd)).length));
-	const promptBudget = Math.max(20, termWidth - hostW - pidW - cliW - statusW - cwdW - 10 - 1);
+	const promptBudget = Math.max(20, termWidth - hostW - pidW - cliW - statusW - ageW - cwdW - 12 - 1);
 	process.stdout.write([
 		"HOST".padEnd(hostW),
 		"PID".padEnd(pidW),
 		"CLI".padEnd(cliW),
 		"STATUS".padEnd(statusW),
+		"AGE".padEnd(ageW),
 		"CWD".padEnd(cwdW),
 		"PROMPT"
 	].join("  ") + "\n");
-	for (const { host, rec } of rows) {
-		const label = rec.prompt ? truncate(`→ ${rec.prompt}`, promptBudget) : "";
+	for (const { host, rec, prefix } of rows) {
+		const flagStr = badgeLabels(rec.badges);
+		const branchStr = branchLabel(rec.git);
+		const gitStr = gitLabel(rec.git);
+		const deco = badgeOf(rec) + (flagStr ? flagStr + " " : "") + (branchStr ? branchStr + " " : "") + (gitStr ? gitStr + " " : "");
+		const budget = Math.max(8, promptBudget - prefix.length - deco.length);
+		const label = prefix + deco + (rec.prompt ? truncate(`→ ${rec.prompt}`, budget) : "");
 		process.stdout.write([
 			host.padEnd(hostW),
 			String(rec.pid).padEnd(pidW),
 			String(rec.cli).padEnd(cliW),
 			String(rec.status).padEnd(statusW),
+			ageOf(rec).padEnd(ageW),
 			shortenPath(String(rec.cwd)).padEnd(cwdW),
 			label
 		].join("  ") + "\n");
@@ -1142,6 +1698,133 @@ async function deriveLiveState(r) {
 		question: null
 	};
 }
+/**
+* When the agent last wrote stdout — the log file's mtime, falling back to
+* started_at when there's no log yet (freshly spawned). Mirrors serve.ts's
+* `last_active_at`, so the `ay ls` AGE column measures STALENESS (time since the
+* agent last produced output) rather than lifetime — matching the console's
+* left-panel age. A long-lived but quiet agent then reads as stale, not "new".
+*/
+async function deriveLastActiveAt(r) {
+	if (!r.log_file) return r.started_at;
+	return stat(r.log_file).then((s) => s.mtimeMs).catch(() => r.started_at);
+}
+/**
+* Format a GitInfo into the console's compact tag: "±3" changed files, "⑂2"
+* submodule pin-bumps, "⊙1" submodule internal dirt, "↑1" ahead, "↓2" behind.
+* Mirrors gitLabel() in lab/ui/console-logic.js so `ay ls` and the web panel's
+* left rail read identically. "" when clean / in sync / not a repo.
+*/
+function gitLabel(g) {
+	if (!g) return "";
+	const parts = [];
+	if (g.changed > 0) parts.push("±" + g.changed);
+	if (g.pins > 0) parts.push("⑂" + g.pins);
+	if (g.subDirty > 0) parts.push("⊙" + g.subDirty);
+	if (g.ahead > 0) parts.push("↑" + g.ahead);
+	if (g.behind > 0) parts.push("↓" + g.behind);
+	return parts.join(" ");
+}
+/**
+* The checked-out branch as "⎇<name>" (⎇ = the branch/alt-key glyph). Shows the
+* ACTUAL git branch, which can differ from the worktree folder in the cwd (a
+* feature branch checked out in .../tree/main, a detached HEAD, etc.). "" when
+* detached / not a repo. Kept separate from gitLabel so gitLabel stays a mirror
+* of the web console's tag.
+*/
+function branchLabel(g) {
+	return g?.branch ? "⎇" + g.branch : "";
+}
+/**
+* Short status-flag chips ("goal", "retry", "limit") for a list of badge ids —
+* the same flags the console shows, resolved to their labels via badges.ts.
+* "" when none. (Remote records carry `badges` from /api/ls; local ones are
+* matched here via extractBadges.)
+*/
+function badgeLabels(ids) {
+	if (!ids || ids.length === 0) return "";
+	return ids.map((id) => badgeDef(id)?.label ?? id).join(" ");
+}
+function parseGitStatus(out) {
+	let branch = null;
+	let ahead = 0;
+	let behind = 0;
+	let changed = 0;
+	let pins = 0;
+	let subDirty = 0;
+	for (const line of out.split("\n")) {
+		if (line.length === 0) continue;
+		if (line[0] === "#") {
+			const head = /^# branch\.head (.+)$/.exec(line);
+			if (head) {
+				branch = head[1] === "(detached)" ? null : head[1];
+				continue;
+			}
+			const ab = /^# branch\.ab \+(\d+) -(\d+)/.exec(line);
+			if (ab) {
+				ahead = Number(ab[1]);
+				behind = Number(ab[2]);
+			}
+			continue;
+		}
+		const type = line[0];
+		if (type === "?" || type === "u") changed++;
+		else if (type === "1" || type === "2") {
+			const sub = line.split(" ")[2] ?? "N...";
+			if (sub[0] === "S") if (sub[1] === "C") pins++;
+			else subDirty++;
+			else changed++;
+		}
+	}
+	return {
+		branch,
+		dirty: changed > 0,
+		changed,
+		pins,
+		subDirty,
+		ahead,
+		behind
+	};
+}
+async function runGitCli(args, cwd) {
+	try {
+		const proc = Bun.spawn(["git", ...args], {
+			cwd,
+			stdout: "pipe",
+			stderr: "ignore",
+			signal: AbortSignal.timeout(2e3)
+		});
+		const out = await new Response(proc.stdout).text();
+		await proc.exited;
+		return proc.exitCode === 0 ? out : null;
+	} catch {
+		return null;
+	}
+}
+/**
+* One-shot git status for the `ay ls` CLI. serve.ts keeps a per-repo watcher so
+* its request path never spawns git; a one-shot CLI has no watcher, so it spawns
+* `git status` directly — but deduped per repo root via the two caches, so N
+* agents sharing a repo (or its submodules/subdirs) cost ONE `git status`.
+*/
+async function gitStatusOnce(cwd, rootCache, infoCache) {
+	if (!cwd) return null;
+	let root = rootCache.get(cwd);
+	if (root === void 0) {
+		root = (await runGitCli(["rev-parse", "--show-toplevel"], cwd) ?? "").trim();
+		rootCache.set(cwd, root);
+	}
+	if (!root) return null;
+	if (infoCache.has(root)) return infoCache.get(root);
+	const out = await runGitCli([
+		"status",
+		"--porcelain=v2",
+		"--branch"
+	], root);
+	const info = out != null ? parseGitStatus(out) : null;
+	infoCache.set(root, info);
+	return info;
+}
 async function cmdLs(rest) {
 	const y = yargs(rest).usage("Usage: ay ls [keyword] [options]\n       ay list [keyword] [options]\n       ay ps   [keyword] [options]\n\nList running agents. Optionally filter by keyword (pid, cwd substring, or prompt substring).").option("all", {
 		type: "boolean",
@@ -1259,37 +1942,57 @@ async function cmdLs(rest) {
 		return 0;
 	}
 	const termWidth = process.stdout.columns ?? 120;
+	const now = Date.now();
+	const lastActive = new Map(await Promise.all(records.map(async (r) => [r.pid, await deriveLastActiveAt(r)])));
+	const ageOf = (r) => humanizeAge(now - (lastActive.get(r.pid) ?? r.started_at));
 	const rawCwds = records.map((r) => shortenPath(r.cwd));
 	const widths = {
 		pid: Math.max(3, ...records.map((r) => String(r.pid).length)),
 		cli: Math.max(3, ...records.map((r) => r.cli.length)),
 		status: Math.max(6, ...records.map((r) => r.status.length)),
-		age: Math.max(3, ...records.map((r) => humanizeAge(Date.now() - r.started_at).length)),
+		age: Math.max(3, ...records.map((r) => ageOf(r).length)),
 		cwd: Math.max(3, ...rawCwds.map((c) => c.length))
 	};
 	const fixedWidth = widths.pid + widths.cli + widths.status + widths.age + widths.cwd + 10;
 	const promptBudget = Math.max(20, termWidth - fixedWidth - 1);
 	const forestRows = flattenForest(buildAgentForest(records));
 	const notes = await readNotes();
+	const gitRootCache = /* @__PURE__ */ new Map();
+	const gitInfoCache = /* @__PURE__ */ new Map();
 	const rows = await Promise.all(forestRows.map(async ({ record: r, prefix }) => {
 		const displayStatus = (await deriveLiveState(r)).state;
+		const alive = displayStatus !== "stopped";
 		const note = notes.get(r.pid);
-		const tasks = displayStatus !== "stopped" && r.log_file ? await extractTaskCounts(r.log_file) : null;
-		const badge = tasks ? `${tasks.done}/${tasks.total} ` : "";
-		const budget = Math.max(8, promptBudget - prefix.length - badge.length);
+		const [tasks, flags, git, typing] = alive ? await Promise.all([
+			r.log_file ? extractTaskCounts(r.log_file) : Promise.resolve(null),
+			r.log_file ? extractBadges(r.log_file) : Promise.resolve([]),
+			gitStatusOnce(r.cwd, gitRootCache, gitInfoCache),
+			isUserTyping(r.pid)
+		]) : [
+			null,
+			[],
+			null,
+			false
+		];
+		const taskBadge = tasks ? `${tasks.done}/${tasks.total} ` : "";
+		const flagStr = badgeLabels(typing ? [...flags, TYPING_BADGE.id] : flags);
+		const branchStr = branchLabel(git);
+		const gitStr = gitLabel(git);
+		const deco = taskBadge + (flagStr ? flagStr + " " : "") + (branchStr ? branchStr + " " : "") + (gitStr ? gitStr + " " : "");
+		const budget = Math.max(8, promptBudget - prefix.length - deco.length);
 		let label;
 		let hasNote = false;
 		if (note) {
 			label = truncate(note, budget);
 			hasNote = true;
-		} else if (r.log_file && displayStatus !== "stopped") label = truncate(await extractActivity(r.log_file) ?? (r.prompt ? `→ ${r.prompt}` : ""), budget);
+		} else if (r.log_file && alive) label = truncate(await extractActivity(r.log_file) ?? (r.prompt ? `→ ${r.prompt}` : ""), budget);
 		else label = truncate(r.prompt ? `→ ${r.prompt}` : "", budget);
-		label = prefix + (hasNote ? "* " : "") + badge + label;
+		label = prefix + (hasNote ? "* " : "") + deco + label;
 		return {
 			pid: String(r.pid),
 			cli: r.cli,
 			status: displayStatus,
-			age: humanizeAge(Date.now() - r.started_at),
+			age: ageOf(r),
 			cwd: shortenPath(r.cwd),
 			label,
 			hasNote,
@@ -1894,6 +2597,20 @@ async function extractBadges(logPath) {
 	if (!lines) return [];
 	return matchBadges(lines);
 }
+const TYPING_WINDOW_MS = 3e3;
+function stdinActivityPath(pid) {
+	return path.resolve(agentYesHome(), "activity", `${pid}.stdin`);
+}
+async function lastStdinAt(pid) {
+	const raw = await readFile(stdinActivityPath(pid), "utf-8").catch(() => null);
+	if (raw === null) return null;
+	const ms = Number(raw.trim());
+	return Number.isFinite(ms) && ms > 0 ? ms : null;
+}
+async function isUserTyping(pid, windowMs = TYPING_WINDOW_MS) {
+	const at = await lastStdinAt(pid);
+	return at !== null && Date.now() - at <= windowMs;
+}
 /**
 * Whether an alive agent is wedged: its log has been silent for at least
 * STUCK_THRESHOLD_MS yet its screen still shows a `working` busy marker (a live
@@ -2038,6 +2755,82 @@ async function extractMenu(logPath, cli) {
 		working: cfg.working
 	});
 }
+/**
+* Poll `logFile`'s size until it goes `quietMs` without changing, or `maxWaitMs`
+* total elapses (whichever first). Returns the final observed size, or null if
+* the file can't be stat'd. Used by `ay send` both to wait out a paste's render
+* (before submitting) and to detect whether a submit actually produced output
+* (after submitting).
+*/
+async function waitForLogQuiet(logFile, quietMs, maxWaitMs) {
+	const pollMs = 50;
+	let lastSize = null;
+	let lastChangeAt = Date.now();
+	const deadline = Date.now() + maxWaitMs;
+	while (Date.now() < deadline) {
+		const size = await stat(logFile).then((s) => s.size).catch(() => null);
+		if (size === null) return null;
+		if (size !== lastSize) {
+			lastSize = size;
+			lastChangeAt = Date.now();
+		} else if (Date.now() - lastChangeAt >= quietMs) return lastSize;
+		await new Promise((r) => setTimeout(r, pollMs));
+	}
+	return lastSize;
+}
+/**
+* Block while the user is typing at `pid`'s terminal, so `ay send` doesn't inject
+* mid-line. Polls the stdin-activity marker every SEND_TYPING_POLL_MS until the
+* user pauses (last keystroke older than the typing window) or `maxWaitMs`
+* elapses. Returns `{ clear, waitedMs }`: `clear` is true if they paused, false
+* if still typing at the deadline (caller sends anyway, with a warning).
+*/
+async function backoffWhileTyping(pid, maxWaitMs) {
+	const start = Date.now();
+	const deadline = start + maxWaitMs;
+	let waited = false;
+	while (Date.now() < deadline) {
+		if (!await isUserTyping(pid)) return {
+			clear: true,
+			waitedMs: waited ? Date.now() - start : 0
+		};
+		waited = true;
+		await new Promise((r) => setTimeout(r, SEND_TYPING_POLL_MS));
+	}
+	return {
+		clear: false,
+		waitedMs: Date.now() - start
+	};
+}
+/**
+* Send the trailing submit code and confirm the CLI actually acted on it —
+* either a `working` busy marker appears, or the log grows meaningfully. Retries
+* (re-sending just the trailing code) up to SEND_SUBMIT_MAX_RETRIES times when
+* neither shows, since a swallowed Enter looks identical to a slow one until we
+* check. Returns whether submission was confirmed, plus the final rendered tail
+* (for a caller to show the user when it wasn't).
+*/
+async function submitAndConfirm(record, fifoPath, trailing) {
+	const logFile = record.log_file;
+	const cfg = (await cliDefaults())[record.cli];
+	let screen = [];
+	for (let attempt = 0; attempt <= SEND_SUBMIT_MAX_RETRIES; attempt++) {
+		const sizeBefore = await stat(logFile).then((s) => s.size).catch(() => null) ?? 0;
+		const wasAlreadyWorking = isWorkingScreen(await renderLogTailLines(logFile, 40) ?? [], cfg?.working);
+		await writeToIpc(fifoPath, trailing);
+		const sizeAfter = await waitForLogQuiet(logFile, SEND_CONFIRM_QUIET_MS, SEND_CONFIRM_MAX_MS);
+		screen = await renderLogTailLines(logFile, 40) ?? [];
+		const grew = sizeAfter !== null && sizeAfter >= sizeBefore + SEND_CONFIRM_MIN_GROWTH_BYTES;
+		if (isWorkingScreen(screen, cfg?.working) && !wasAlreadyWorking || grew) return {
+			confirmed: true,
+			screen
+		};
+	}
+	return {
+		confirmed: false,
+		screen
+	};
+}
 /** Poll until the agent is no longer parked on a menu (selection accepted → it
 * resumed / moved on) or the deadline passes. Returns true if it cleared. */
 async function waitForNeedsInputClear(record, timeoutMs) {
@@ -2049,7 +2842,7 @@ async function waitForNeedsInputClear(record, timeoutMs) {
 	return false;
 }
 async function cmdSend(rest) {
-	const argv = await yargs(rest).usage("Usage: ay send <keyword> <msg|-> [options]").option("code", {
+	const argv = await yargs(rest).parserConfiguration({ "boolean-negation": false }).usage("Usage: ay send <keyword> <msg|-> [options]").option("code", {
 		type: "string",
 		default: "enter",
 		description: "Trailing control code (enter|esc|ctrl-c|ctrl-y|tab|none)"
@@ -2067,7 +2860,12 @@ async function cmdSend(rest) {
 	}).option("force", {
 		type: "boolean",
 		default: false,
-		description: "Skip the 'tailed recently' safety check (also: AGENT_YES_FORCE_SEND=1)"
+		description: "Skip the 'tailed recently' safety check and the wait-while-user-typing backoff (also: AGENT_YES_FORCE_SEND=1)"
+	}).option("no-wait", {
+		type: "boolean",
+		default: false,
+		alias: "async",
+		description: "Fire-and-forget: skip the paste-settle wait and submit confirmation, don't retry a swallowed Enter (also: AGENT_YES_SEND_NO_WAIT=1)"
 	}).help(false).version(false).exitProcess(false).parseAsync();
 	const opts = {
 		all: argv.all,
@@ -2094,7 +2892,8 @@ async function cmdSend(rest) {
 		for await (const chunk of process.stdin) chunks.push(chunk);
 		body = Buffer.concat(chunks).toString("utf-8").trimEnd();
 	} else body = rawMessage;
-	const sender = await enforceSendGuards(record, Boolean(argv.force) || process.env.AGENT_YES_FORCE_SEND === "1");
+	const force = Boolean(argv.force) || process.env.AGENT_YES_FORCE_SEND === "1";
+	const sender = await enforceSendGuards(record, force);
 	if (isExitRequest(body)) {
 		const reason = sender.agent ? `requested by ${sender.agent.cli} #${sender.agent.pid} @ ${shortenPath(sender.agent.cwd)}` : `requested via 'ay send ${keyword} exit'`;
 		const { strategy } = await gracefulExitAgent(record, reason);
@@ -2102,20 +2901,36 @@ async function cmdSend(rest) {
 		return 0;
 	}
 	const fullBody = (sender.agent && !isSlashCommand(body) ? `[from ${sender.agent.cli} #${sender.agent.pid} @ ${shortenPath(sender.agent.cwd)} — reply: ay send ${sender.agent.pid} "..."]\n` : "") + body;
+	const noWait = Boolean(argv.noWait) || process.env.AGENT_YES_SEND_NO_WAIT === "1";
+	if (fullBody && !noWait && !force) {
+		const { clear, waitedMs } = await backoffWhileTyping(record.pid, SEND_TYPING_MAX_WAIT_MS);
+		if (!clear) process.stderr.write(`warning: user still typing at pid ${record.pid} after ${Math.round(waitedMs / 1e3)}s — sending anyway (may interleave with their line). Use --force to skip this wait.\n`);
+		else if (waitedMs > 0) process.stderr.write(`waited ${Math.round(waitedMs / 1e3)}s for the user to pause typing before sending.\n`);
+	}
+	const canConfirm = trailing === "\r" && Boolean(fullBody) && !noWait;
+	let confirmed = true;
+	let lastScreen = [];
 	if (fullBody && trailing) {
 		await writeToIpc(fifoPath, fullBody);
-		await new Promise((r) => setTimeout(r, 200));
-		await writeToIpc(fifoPath, trailing);
+		if (canConfirm && record.log_file) {
+			await waitForLogQuiet(record.log_file, SEND_SETTLE_QUIET_MS, SEND_SETTLE_MAX_MS);
+			({confirmed, screen: lastScreen} = await submitAndConfirm(record, fifoPath, trailing));
+		} else {
+			await new Promise((r) => setTimeout(r, 200));
+			await writeToIpc(fifoPath, trailing);
+		}
 	} else await writeToIpc(fifoPath, fullBody + trailing);
 	const payload = body + trailing;
-	process.stdout.write(`sent to pid ${record.pid} (${record.cli}): ${truncate(payload, 80)}\n`);
+	const status = confirmed ? "sent" : "sent but NOT confirmed submitted";
+	process.stdout.write(`${status} to pid ${record.pid} (${record.cli}): ${truncate(payload, 80)}\n`);
+	if (!confirmed) process.stderr.write(`\nwarning: couldn't confirm the CLI acted on it after ${SEND_SUBMIT_MAX_RETRIES + 1} attempt(s) — it may still be sitting unsubmitted in the prompt. Last screen:\n` + lastScreen.slice(-8).map((l) => `  ${l}`).join("\n") + "\n");
 	const replyHint = sender.agent ? `  ay send ${sender.agent.pid} "..."              # reply to sender\n` : "";
 	process.stderr.write(`\n` + replyHint + `  ay tail ${record.pid}                  # watch output\n  ay ls                                  # list all agents\n`);
 	if (codeName === "ctrl-c" || codeName === "ctrlc") {
 		const tip = stopTipForCli(record.cli, record.pid);
 		if (tip) process.stderr.write(tip);
 	}
-	return 0;
+	return confirmed ? 0 : 1;
 }
 async function resolveWritableAgent(keyword, opts) {
 	const record = await resolveOne(keyword, opts);
@@ -3056,7 +3871,197 @@ async function cmdResultSet(rest) {
 	process.stdout.write(`result envelope written for pid ${pid}\n`);
 	return 0;
 }
+/** Resolve the parent pid a `ay notify` invocation is draining. */
+function resolveParentPid(explicit) {
+	if (Number.isFinite(explicit) && explicit > 0) return explicit;
+	const self = Number(process.env.AGENT_YES_PID);
+	if (Number.isFinite(self) && self > 0) return self;
+	throw new Error("ay notify: not running inside an agent (no AGENT_YES_PID) — pass --parent <pid>");
+}
+function printNotifyEvents(events, json) {
+	if (json) {
+		for (const e of events) process.stdout.write(JSON.stringify(e) + "\n");
+		return;
+	}
+	for (const e of events) {
+		const tag = `[${e.edge}]`;
+		const head = `[${e.seq}] ${tag} pid ${e.child_pid} (${e.cli}) ${e.cwd}`;
+		process.stdout.write(head + "\n");
+		if (e.git_head) process.stdout.write(`      HEAD ${e.git_head}\n`);
+		if (e.question) process.stdout.write(`      Q: ${e.question}\n`);
+		if (e.tail) process.stdout.write(e.tail.split("\n").map((l) => `      | ${l}`).join("\n") + "\n");
+	}
+}
+async function cmdNotify(rest) {
+	const verb = rest[0];
+	const args = rest.slice(1);
+	if (verb === "cursor") return cmdNotifyCursor(args);
+	if (verb !== "read" && verb !== "watch") {
+		process.stderr.write("usage: ay notify <read|watch|cursor> [--parent <pid>] [--since <seq>] [--since-ts <ms>] [--unread] [--ack] [--json]\n");
+		return 1;
+	}
+	const argv = await yargs(args).option("parent", {
+		type: "number",
+		description: "Parent pid whose inbox to drain (default: $AGENT_YES_PID)"
+	}).option("since", {
+		type: "number",
+		description: "Only edges with seq greater than this"
+	}).option("since-ts", {
+		type: "number",
+		description: "Only edges at/after this epoch-ms"
+	}).option("unread", {
+		type: "boolean",
+		default: false,
+		description: "Only edges past the saved cursor"
+	}).option("ack", {
+		type: "boolean",
+		default: false,
+		description: "Advance the cursor past what's shown (at-least-once: off by default)"
+	}).option("json", {
+		type: "boolean",
+		default: false,
+		description: "Emit raw NDJSON events"
+	}).option("consumer", {
+		type: "string",
+		default: "parent",
+		description: "Cursor identity (for multiple readers)"
+	}).option("interval", {
+		type: "number",
+		default: 2,
+		description: "Poll interval in seconds (watch)"
+	}).option("ensure-daemon", {
+		type: "boolean",
+		default: true,
+		description: "Start the notifyd singleton if not running (watch)"
+	}).help(false).version(false).exitProcess(false).parseAsync();
+	const parent = resolveParentPid(argv.parent);
+	const host = hostId();
+	const consumer = String(argv.consumer);
+	const selfStartedAt = await resolveParentStartedAt(parent);
+	if (selfStartedAt <= 0) throw new Error(`cannot resolve identity for pid ${parent} (no live agent record) — refusing to open the notification path (pass --parent for a live agent).`);
+	const drain = async (sinceSeqOverride) => {
+		let events = await readInbox(host, parent);
+		if (selfStartedAt > 0) events = events.filter((e) => e.parent_started_at === selfStartedAt);
+		if (argv.unread) {
+			const cursor = await getCursor(host, parent, consumer);
+			events = filterUnread(events, sinceSeqOverride ?? cursor);
+		} else {
+			if (sinceSeqOverride !== void 0) events = filterSinceSeq(events, sinceSeqOverride);
+			else if (Number.isFinite(argv.since)) events = filterSinceSeq(events, argv.since);
+			if (Number.isFinite(argv["since-ts"])) events = filterSinceTs(events, argv["since-ts"]);
+		}
+		printNotifyEvents(events, argv.json);
+		return maxSeq(events);
+	};
+	const ackTo = async (seq) => {
+		if (seq > await getCursor(host, parent, consumer)) await setCursor(host, parent, seq, consumer);
+	};
+	if (verb === "read") {
+		const top = await drain();
+		if (argv.ack && top > 0) await ackTo(top);
+		return 0;
+	}
+	const ensure = async () => {
+		if (!argv["ensure-daemon"]) return;
+		const { ensureDaemon } = await import("./notifyDaemon-D5jtpCAR.js");
+		await ensureDaemon().catch(() => null);
+	};
+	await heartbeatWatcher(parent, selfStartedAt);
+	await ensure();
+	const intervalMs = Math.max(500, (Number.isFinite(argv.interval) ? argv.interval : 2) * 1e3);
+	let lastSeq = argv.unread ? await getCursor(host, parent, consumer) : Number.isFinite(argv.since) ? argv.since : maxSeq(await readInbox(host, parent));
+	let acked = lastSeq;
+	let stop = false;
+	const onSig = () => {
+		stop = true;
+		clearWatcher(parent).finally(() => process.exit(0));
+	};
+	process.on("SIGINT", onSig);
+	process.on("SIGTERM", onSig);
+	try {
+		while (!stop) {
+			await heartbeatWatcher(parent, selfStartedAt);
+			await ensure();
+			const top = await drain(lastSeq);
+			if (top > lastSeq) lastSeq = top;
+			if (argv.ack && lastSeq > acked) {
+				await ackTo(lastSeq);
+				acked = lastSeq;
+			}
+			await new Promise((r) => setTimeout(r, intervalMs));
+		}
+	} finally {
+		await clearWatcher(parent);
+	}
+	return 0;
+}
+/**
+* Resolve the started_at of the LIVE agent whose wrapper pid is `parent`. Returns
+* 0 (→ the caller fails closed) when there is no such record, when the matching
+* record is stale (exited / pid not alive), or when the match is ambiguous
+* (>1 live record) — so a leftover stale record can't make a recycled parent pid
+* resolve to a PRIOR incarnation's start time and fail-open the identity guard.
+*/
+async function resolveParentStartedAt(parent) {
+	const live = (await listRecords(void 0, {
+		all: true,
+		active: false,
+		json: false,
+		latest: false,
+		cwdScope: null
+	}).catch(() => [])).filter((r) => (r.wrapper_pid === parent || r.pid === parent) && r.status !== "exited" && isPidAlive(r.pid));
+	if (live.length !== 1) return 0;
+	return live[0].started_at ?? 0;
+}
+async function cmdNotifyCursor(args) {
+	const action = args[0];
+	const argv = await yargs(args.slice(1)).option("parent", { type: "number" }).option("consumer", {
+		type: "string",
+		default: "parent"
+	}).help(false).version(false).exitProcess(false).parseAsync();
+	const parent = resolveParentPid(argv.parent);
+	const host = hostId();
+	const consumer = String(argv.consumer);
+	if (action === "get") {
+		process.stdout.write(String(await getCursor(host, parent, consumer)) + "\n");
+		return 0;
+	}
+	if (action === "set") {
+		const seq = Number(argv._[0]);
+		if (!Number.isFinite(seq) || seq < 0) throw new Error("ay notify cursor set <seq>");
+		await setCursor(host, parent, seq, consumer);
+		return 0;
+	}
+	process.stderr.write("usage: ay notify cursor <get|set <seq>> [--parent <pid>]\n");
+	return 1;
+}
+async function cmdNotifyd(rest) {
+	const sub = rest[0] ?? "status";
+	const daemon = await import("./notifyDaemon-D5jtpCAR.js");
+	switch (sub) {
+		case "run": return daemon.runDaemon();
+		case "once": return daemon.runDaemon({ once: true });
+		case "start": {
+			const pid = await daemon.ensureDaemon();
+			process.stdout.write(pid ? `notifyd running (pid ${pid})\n` : "notifyd: failed to start\n");
+			return pid ? 0 : 1;
+		}
+		case "status": {
+			const pid = await daemon.daemonStatus();
+			process.stdout.write(pid ? `notifyd running (pid ${pid})\n` : "notifyd: not running\n");
+			return pid ? 0 : 1;
+		}
+		case "stop": {
+			const pid = await daemon.requestDaemonStop();
+			process.stdout.write(pid ? `notifyd: stop requested (pid ${pid} will exit shortly)\n` : "notifyd: not running\n");
+			return 0;
+		}
+		default:
+			process.stderr.write("usage: ay notifyd <run|once|start|status|stop>\n");
+			return 1;
+	}
+}
 
 //#endregion
-export { stopTipForCli as A, renderRawLogLines as C, restartHintLines as D, resolveResumeArgs as E, writeToIpc as M, runSubcommand as O, renderRawLog as S, resolveReadWindow as T, listRecords as _, cursorAbs as a, readNotes as b, extractMenu as c, finalizedLines as d, isAgentStuck as f, isSubcommand as g, isSlashCommand as h, controlCodeFromName as i, writeKeysPaced as j, snapshotStatus as k, extractNeedsInput as l, isPidAlive as m, READ_PAGE_DEFAULT as n, deriveLiveStatus as o, isExitRequest as p, cmdHelp as r, extractBadges as s, GRACEFUL_EXIT_COMMANDS as t, extractTaskCounts as u, matchKeyword as v, resolveOne as w, readPtysize as x, menuSelectKeys as y };
-//# sourceMappingURL=subcommands-BZPW0UVn.js.map
+export { resolveOne as A, writeKeysPaced as B, matchKeyword as C, renderLogTailLines as D, readPtysize as E, snapshotStatus as F, hostId as G, TYPING_BADGE as H, stdinActivityPath as I, readInbox as J, listInboxParents as K, stopTipForCli as L, resolveResumeArgs as M, restartHintLines as N, renderRawLog as O, runSubcommand as P, notifyDir as Q, submitAndConfirm as R, listRecords as S, readNotes as T, appendEvent as U, writeToIpc as V, gcInboxes as W, daemonLockDir as X, shouldStealLock as Y, daemonLockOwnerPath as Z, isPidAlive as _, cmdHelp as a, isUserTyping as b, deriveLiveState as c, extractMenu as d, extractNeedsInput as f, isExitRequest as g, isAgentStuck as h, backoffWhileTyping as i, resolveReadWindow as j, renderRawLogLines as k, deriveLiveStatus as l, finalizedLines as m, READ_PAGE_DEFAULT as n, controlCodeFromName as o, extractTaskCounts as p, liveWatchers as q, TYPING_WINDOW_MS as r, cursorAbs as s, GRACEFUL_EXIT_COMMANDS as t, extractBadges as u, isSlashCommand as v, menuSelectKeys as w, lastStdinAt as x, isSubcommand as y, waitForLogQuiet as z };
+//# sourceMappingURL=subcommands-BFlpV23b.js.map