agent-yes 1.175.1 → 1.176.0

package/dist/{subcommands-DjA3FgJk.js → subcommands-BbSJ_nTU.js}

@@ -3,8 +3,8 @@ import { n as logger } from "./logger-CDIsZ-Pp.js";
 import { t as agentYesHome } from "./agentYesHome-CtHb5b71.js";
 import { a as updateGlobalPidStatus, i as readGlobalPids } from "./globalPidIndex-CoNr7tS8.js";
 import { t as loadSharedCliDefaults } from "./configShared-0MnIQ652.js";
-import { n as isWebrtcSpec } from "./webrtcLink-B7REGtK2.js";
-import { a as resolveRemoteSpec, i as readRemotes } from "./remotes-CC-4GuJb.js";
+import { n as isWebrtcSpec } from "./webrtcLink-BG0Xc4-W.js";
+import { a as resolveRemoteSpec, i as readRemotes } from "./remotes-DsTnQhyx.js";
 import ms from "ms";
 import yargs from "yargs";
 import { appendFile, mkdir, open, readFile, readdir, rename, rm, stat, writeFile } from "fs/promises";
@@ -13,798 +13,798 @@ import path from "path";
 import { randomUUID } from "node:crypto";
 import os from "node:os";
 
-//#region ts/notifyInbox.ts
-/**
-* Pure, fs-free core for the subagent→parent notification inbox — the storage
-* and watermark layer under `ay notify` / `ay notifyd`.
-*
-* Motivation (real incident): a parent agent fanned out sub-agents that finished
-* their work but sat at an idle `❯` prompt WITHOUT exiting (claude-yes does not
-* exit on idle). Claude Code's background-task notification only fires on process
-* EXIT, so the parent never learned the children went idle and left them parked
-* 16 minutes. `ay ls --watch` already streams transitions, but it is PULL: the
-* parent must run the watch loop. The whole point of this pain is the parent is
-* NOT watching. So we accumulate qualifying edges into a per-parent append-only
-* inbox that the parent drains on its own schedule (its Monitor loop), with a
-* persisted cursor so a parent that restarts reads only the unread edges.
-*
-* This module is the pure part (path math, NDJSON (de)serialization, seq/cursor
-* filtering, retention decisions) so it is trivially unit-testable, mirroring
-* `lsWatch.ts` / `needsInput.ts` / `resultEnvelope.ts`. The fs read/write + lock
-* + CLI live in `subcommands.ts`; the detection/debounce lives in
-* `notifyRouter.ts`.
-*/
-/** Root dir for all notification state. */
-function notifyDir() {
-	return path.join(agentYesHome(), "notify");
-}
-/** Per-host inbox directory (pids are only unique within a host). */
-function inboxDir(host) {
-	return path.join(notifyDir(), "inbox", sanitizeHost(host));
-}
-/** Absolute path of one parent's append-only NDJSON inbox. */
-function inboxPath(host, parentPid) {
-	return path.join(inboxDir(host), `${parentPid}.ndjson`);
-}
-/** Sidecar seq counter for a parent inbox (last allocated seq). */
-function seqPath(host, parentPid) {
-	return path.join(inboxDir(host), `${parentPid}.seq`);
-}
-/** Per-consumer cursor directory for a parent inbox. */
-function cursorDir(host, parentPid) {
-	return path.join(notifyDir(), "cursors", sanitizeHost(host), String(parentPid));
-}
-/** Absolute path of one consumer's cursor file for a parent inbox. */
-function cursorPath(host, parentPid, consumer = "parent") {
-	return path.join(cursorDir(host, parentPid), `${sanitizeConsumer(consumer)}.json`);
-}
-/** The daemon singleton lock dir (mkdir-based, like pidStore). */
-function daemonLockDir() {
-	return path.join(notifyDir(), "notifyd.lock");
-}
-/**
-* Owner metadata inside the lock dir ({pid, started_at, ts}) — the SINGLE source
-* of truth for the running daemon's identity, used for stale-lock steal and for
-* `notifyd status`/`stop` (a running daemon refreshes `ts` each tick).
-*/
-function daemonLockOwnerPath() {
-	return path.join(daemonLockDir(), "owner.json");
-}
-/** Registry dir of parents currently running `ay notify watch` (heartbeats). */
-function watchersDir() {
-	return path.join(notifyDir(), "watchers");
-}
-/** Heartbeat file for one watching parent. */
-function watcherPath(parentPid) {
-	return path.join(watchersDir(), `${parentPid}.json`);
-}
-/** A watcher heartbeat is "live" if refreshed within this window. */
-const WATCHER_TTL_MS = 15e3;
-function sanitizeSegment(s, fallback) {
-	const cleaned = s.replace(/[^A-Za-z0-9._-]/g, "_");
-	return cleaned === "" || cleaned === "." || cleaned === ".." ? fallback : cleaned;
-}
-function sanitizeHost(host) {
-	return sanitizeSegment(host, "localhost");
-}
-function sanitizeConsumer(consumer) {
-	return sanitizeSegment(consumer, "parent");
-}
-/** Serialize one event to its NDJSON line (no trailing newline). */
-function serializeEvent(ev) {
-	return JSON.stringify(ev);
-}
+//#region ts/agentTree.ts
 /**
-* Parse an inbox's raw text into events. Tolerant by design: a torn final line
-* (a writer mid-append) or any unparseable line is skipped, never throws — a
-* reader must survive a concurrent writer. Order is file order (= seq order,
-* since a single locked writer appends in increasing seq).
+* Link records into a forest via parent_pid === wrapper_pid. Records whose
+* parent isn't present in the set (top-level agents, or links into agents
+* filtered out by a keyword/scope) become roots. Root and sibling order follows
+* the input order, so a caller that pre-sorts (e.g. newest-first) is preserved.
 */
-function parseInboxText(text) {
-	const out = [];
-	for (const line of text.split("\n")) {
-		const t = line.trim();
-		if (!t) continue;
-		try {
-			const ev = JSON.parse(t);
-			if (isValidEvent(ev)) out.push(ev);
-		} catch {}
+function buildAgentForest(records) {
+	const nodes = records.map((record) => ({
+		record,
+		children: []
+	}));
+	const byWrapper = /* @__PURE__ */ new Map();
+	for (const n of nodes) {
+		const w = n.record.wrapper_pid;
+		if (typeof w === "number" && w > 0) byWrapper.set(w, n);
 	}
-	return out;
+	const roots = [];
+	for (const n of nodes) {
+		const p = n.record.parent_pid;
+		const parent = typeof p === "number" && p > 0 ? byWrapper.get(p) : void 0;
+		if (parent && parent !== n) parent.children.push(n);
+		else roots.push(n);
+	}
+	const seen = /* @__PURE__ */ new Set();
+	const mark = (n) => {
+		if (seen.has(n)) return;
+		seen.add(n);
+		n.children.forEach(mark);
+	};
+	roots.forEach(mark);
+	for (const n of nodes) if (!seen.has(n)) roots.push(n);
+	return roots;
 }
-const EDGES = new Set([
-	"needs_input",
-	"idle",
-	"exited"
-]);
 /**
-* Full shape validation at the storage boundary — a torn/partial line missing
-* the correlation fields must never flow through to a consumer's output. Every
-* event we surface has the fields a reader relies on.
+* Depth-first flatten a forest into rows carrying a box-drawing branch prefix.
+* A `visited` guard makes a pathological parent_pid cycle terminate instead of
+* recursing forever.
 */
-function isValidEvent(ev) {
-	if (!ev || typeof ev !== "object") return false;
-	const e = ev;
-	return typeof e.seq === "number" && typeof e.ts === "number" && typeof e.host === "string" && typeof e.parent_pid === "number" && typeof e.child_pid === "number" && typeof e.cli === "string" && typeof e.cwd === "string" && typeof e.edge === "string" && EDGES.has(e.edge) && typeof e.state === "string" && (e.question === null || typeof e.question === "string");
-}
-/** Next seq to allocate given the last stored seq counter (or the inbox max). */
-function nextSeq(lastSeq) {
-	return (Number.isFinite(lastSeq) && lastSeq > 0 ? lastSeq : 0) + 1;
-}
-/** Highest seq present in a parsed inbox (0 when empty). */
-function maxSeq(events) {
-	let m = 0;
-	for (const e of events) if (e.seq > m) m = e.seq;
-	return m;
+function flattenForest(roots) {
+	const rows = [];
+	const visited = /* @__PURE__ */ new Set();
+	const walk = (node, ancestorsLast) => {
+		if (visited.has(node)) return;
+		visited.add(node);
+		const depth = ancestorsLast.length;
+		let prefix = "";
+		for (let i = 0; i < depth - 1; i++) prefix += ancestorsLast[i] ? "   " : "│  ";
+		if (depth > 0) prefix += ancestorsLast[depth - 1] ? "└─ " : "├─ ";
+		rows.push({
+			record: node.record,
+			prefix,
+			depth
+		});
+		node.children.forEach((c, i) => walk(c, [...ancestorsLast, i === node.children.length - 1]));
+	};
+	for (const r of roots) walk(r, []);
+	return rows;
 }
+
+//#endregion
+//#region ts/todoParse.ts
 /**
-* Filter events for `--since <seq>`: strictly-greater than the given seq. A
-* `since` of 0/undefined returns everything.
+* Parse an agent's todo/task list out of its RENDERED TUI screen.
+*
+* Source of truth for EVERY CLI (claude, codex, gemini, …) is the screen the
+* agent draws — never a CLI-specific session file. The durable copy is the
+* per-pid raw log (`<cwd>/.agent-yes/<pid>.raw.log`); rendering it through a
+* headless xterm (see renderRawLog) collapses the reflow/redraw frames into the
+* final coherent text, which is what we scan here.
+*
+* The todo list in these TUIs renders as a tree block anchored by the `⎿`
+* branch glyph, one marker per line:
+*
+*     ⎿  ☒ Wire up the parser
+*        ☒ Add the badge
+*        ◼ Compute in /api/ls      ← in progress
+*        ◻ Render in the console   ← pending
+*        ◻ Tests
+*
+* Badge = `${done}/${total}` (done is the numerator → "2/5").
+*
+* This parse is deliberately conservative: we only report a count when a block
+* is confidently detected (the `⎿` anchor + ≥2 consecutive marker lines), so an
+* agent that merely prints a check glyph in prose never produces a phantom badge.
 */
-function filterSinceSeq(events, sinceSeq) {
-	if (!sinceSeq || sinceSeq <= 0) return events.slice();
-	return events.filter((e) => e.seq > sinceSeq);
-}
-/** Filter events after a wall-clock `--since <ts>` (inclusive lower bound). */
-function filterSinceTs(events, sinceTs) {
-	if (!sinceTs || sinceTs <= 0) return events.slice();
-	return events.filter((e) => e.ts >= sinceTs);
-}
-/** Unread = seq strictly greater than the consumer's cursor. */
-function filterUnread(events, cursorSeq) {
-	return events.filter((e) => e.seq > (cursorSeq > 0 ? cursorSeq : 0));
-}
-/** Parse a cursor file's text; a missing/garbage cursor reads as seq 0. */
-function parseCursor(text) {
-	if (!text) return { seq: 0 };
-	try {
-		const c = JSON.parse(text);
-		return { seq: Number.isFinite(c?.seq) && c.seq > 0 ? c.seq : 0 };
-	} catch {
-		return { seq: 0 };
-	}
-}
-function serializeCursor(seq) {
-	return JSON.stringify({ seq: Math.max(0, Math.floor(seq)) });
+const DONE = new Set([
+	"✔",
+	"☑",
+	"✓",
+	"☒"
+]);
+const IN_PROGRESS = new Set(["◼"]);
+const PENDING = new Set(["◻", "☐"]);
+const ANCHOR = "⎿";
+function markerOf(line) {
+	let s = line.replace(/^\s+/, "");
+	if (s.startsWith(ANCHOR)) s = s.slice(1).replace(/^\s+/, "");
+	const ch = [...s][0];
+	if (ch === void 0) return null;
+	if (DONE.has(ch)) return "done";
+	if (IN_PROGRESS.has(ch)) return "inprogress";
+	if (PENDING.has(ch)) return "pending";
+	return null;
 }
 /**
-* Rotation decision (pure): given an inbox's events, a byte cap, and the minimum
-* un-acked cursor across ALL consumers, return the events to KEEP after
-* rotating. Critically, an event with `seq > protectAboveSeq` is NEVER dropped —
-* that is the at-least-once guarantee: we must not evict an edge no consumer has
-* acknowledged yet, even under the byte cap. Below that watermark we keep the
-* newest events that fit the cap (and at least `minKeep`).
+* Find the MOST RECENT confidently-detected todo block in the rendered lines and
+* return its {done, total}. Returns null when none qualifies (caller omits the
+* badge entirely — never shows "0/0").
+*
+* A block is a maximal run of consecutive marker lines. It only counts when it
+* is anchored — the `⎿` glyph appears on the run's first line or the line
+* directly above it — and has ≥2 marker lines. The last qualifying block wins,
+* since the agent's current todo state is the one drawn most recently.
 */
-function rotateKeep(events, capBytes, protectAboveSeq = 0, minKeep = 100) {
-	if (events.length <= minKeep) return events.slice();
-	const kept = [];
-	let bytes = 0;
-	for (let i = events.length - 1; i >= 0; i--) {
-		const e = events[i];
-		const line = serializeEvent(e) + "\n";
-		bytes += line.length;
-		if (e.seq > protectAboveSeq || kept.length < minKeep || bytes <= capBytes) kept.push(e);
-		else break;
+function parseTaskCounts(lines) {
+	let best = null;
+	const n = lines.length;
+	let i = 0;
+	while (i < n) {
+		if (markerOf(lines[i]) === null) {
+			i++;
+			continue;
+		}
+		let hasAnchor = i > 0 && lines[i - 1].includes(ANCHOR);
+		const counts = {
+			done: 0,
+			inprogress: 0,
+			pending: 0
+		};
+		let j = i;
+		for (; j < n; j++) {
+			const mk = markerOf(lines[j]);
+			if (mk === null) break;
+			if (lines[j].includes(ANCHOR)) hasAnchor = true;
+			counts[mk]++;
+		}
+		const total = counts.done + counts.inprogress + counts.pending;
+		if (hasAnchor && total >= 2) best = {
+			done: counts.done,
+			total
+		};
+		i = j === i ? i + 1 : j;
 	}
-	kept.reverse();
-	return kept;
+	return best;
 }
 
 //#endregion
-//#region ts/notifyStore.ts
+//#region ts/badges.ts
+const BADGE_DEFS = [
+	{
+		id: "goal-active",
+		label: "goal",
+		title: "A /goal Stop-hook loop is active on this agent",
+		pattern: /\/goal active/i
+	},
+	{
+		id: "session-limit",
+		label: "limit",
+		title: "Usage session limit hit — waiting for the reset time shown on screen",
+		pattern: /you['’]?ve hit your session limit/i
+	},
+	{
+		id: "retrying",
+		label: "retry",
+		title: "Waiting for the API — the CLI is auto-retrying on its own backoff (no action needed)",
+		pattern: /Waiting for API response[\s\S]{0,40}will retry in \d/i
+	}
+];
 /**
-* Filesystem side of the notification inbox — the impure half of the pure
-* `notifyInbox.ts` path/serialization core. Handles the locked append (so
-* concurrent daemon ticks / future writers never interleave a seq), inbox and
-* cursor reads/writes, and retention GC.
-*
-* The lock is a mkdir-based advisory lock (same primitive `pidStore` uses), held
-* only for the microseconds of a read-counter → append-line → write-counter, so
-* contention is negligible even with many parents.
+* Which badge ids match the given rendered screen lines. Pure so it's
+* unit-tested without a live PTY/log file.
 */
-/** Stable local host id — the pid namespace is per-host. */
-function hostId() {
-	return os.hostname() || "localhost";
-}
-function pidAlive(pid) {
-	if (!Number.isFinite(pid) || pid <= 0) return false;
-	try {
-		process.kill(pid, 0);
-		return true;
-	} catch (e) {
-		return e.code === "EPERM";
-	}
+function matchBadges(lines, defs = BADGE_DEFS) {
+	const text = lines.join("\n");
+	return defs.filter((d) => d.pattern.test(text)).map((d) => d.id);
 }
 /**
-* Pure steal decision for a per-inbox lock (extracted so it's unit-testable):
-* steal the lock ONLY when its holder is provably gone (torn/missing owner on a
-* lock that has EXISTED longer than the grace, or a dead pid) or its heartbeat is
-* stale — NEVER merely because the contender has waited a while.
-*
-* Crucially, the torn-owner grace is measured from the LOCK INSTANCE's age
-* (`lockAgeMs` = now − lockDir mtime), NOT from how long the contender has been
-* waiting. Otherwise a contender that waited out one holder could instantly steal
-* the NEXT holder's freshly-created lock during its mkdir→write-owner window
-* (torn but brand-new) — letting two writers into the critical section.
+* A time-derived flag (NOT screen-matched): lit when the user typed at this
+* agent's terminal within the last few seconds. The ls code appends its id from
+* the Rust runner's stdin-activity marker, so it resolves through `badgeDef`
+* like any other chip — but `matchBadges` never produces it (it isn't in
+* BADGE_DEFS, and its pattern can't match), keeping screen matching pure.
 */
-function shouldStealLock(ownerRaw, now, opts) {
-	const graceMs = opts.graceMs ?? 1e3;
-	let ownerPid = 0;
-	let ownerTs = 0;
-	let parsed = false;
-	try {
-		const o = JSON.parse(ownerRaw);
-		ownerPid = o?.pid ?? 0;
-		ownerTs = o?.ts ?? 0;
-		parsed = true;
-	} catch {}
-	if (!parsed || ownerPid <= 0 || ownerTs <= 0) return opts.lockAgeMs > graceMs;
-	const holderDead = ownerPid !== opts.selfPid && !opts.isAlive(ownerPid);
-	const holderStale = now - ownerTs > opts.staleMs;
-	return holderDead || holderStale;
+const TYPING_BADGE = {
+	id: "typing",
+	label: "typing",
+	title: "The user is typing at this agent's terminal — ay send backs off until they pause",
+	pattern: /(?!)/
+};
+function badgeDef(id, defs = BADGE_DEFS) {
+	return defs.find((d) => d.id === id) ?? (id === TYPING_BADGE.id ? TYPING_BADGE : void 0);
 }
-async function ensureDir(dir) {
-	await mkdir(dir, { recursive: true }).catch(() => {});
+
+//#endregion
+//#region ts/needsInput.ts
+function reTest(re, s) {
+	return (re.global || re.sticky ? new RegExp(re.source, re.flags.replace(/[gy]/g, "")) : re).test(s);
+}
+function isChromeLine(s) {
+	const t = s.trim();
+	return !t || /^─+$/.test(t) || /^esc to (interrupt|cancel)/i.test(t) || /\? for shortcuts/.test(t) || /\d+%\s*until auto-compact/i.test(t);
 }
 /**
-* Atomically overwrite a single file (temp + rename) so a concurrent reader never
-* observes a torn/partial write — the sweep invariant for every single-file
-* mutation (cursor, watcher heartbeat, lock owner). Returns whether it landed.
+* Returns a NeedsInput when the screen shows an unresolved selection menu, else
+* null. `cfg.working` short-circuits to null (an actively-working agent isn't
+* blocked). Pure + synchronous so it's trivially unit-testable.
 */
-async function atomicWrite(file, data) {
-	const tmp = `${file}.${randomUUID()}.tmp`;
-	try {
-		await writeFile(tmp, data);
-		await rename(tmp, file);
-		return true;
-	} catch {
-		await rm(tmp, { force: true }).catch(() => {});
-		return false;
-	}
+function classifyNeedsInput(lines, cfg) {
+	const patterns = cfg.needsInput ?? [];
+	if (patterns.length === 0) return null;
+	const text = lines.join("\n");
+	if ((cfg.working ?? []).some((re) => reTest(re, text))) return null;
+	if (!patterns.some((re) => reTest(re, text))) return null;
+	let last = -1;
+	for (let i = 0; i < lines.length; i++) if (patterns.some((re) => reTest(re, lines[i]))) last = i;
+	const start = Math.max(0, last - 6);
+	const end = Math.min(lines.length, last + 6);
+	return { question: lines.slice(start, end).map((l) => l.trim()).filter((l) => l && !isChromeLine(l)).join(" • ").slice(0, 400) };
 }
+const OPTION_LINE = /^[\s❯›>▶◉○●·*-]*?(\d+)\.\s/;
 /**
-* Acquire a per-inbox lock; returns a release fn. Ownership is proven ONLY by a
-* successful `mkdir(recursive:false)` (atomic exclusive create), and stealing is
-* driven by HOLDER LIVENESS, not elapsed wait time: the holder writes an
-* `owner` file ({pid, ts}) on acquire AND heartbeats its ts for the whole time
-* it holds the lock, so a contender steals ONLY when that holder is dead or its
-* heartbeat is stale. A live holder whose critical section legitimately runs long
-* (a big GC rewrite, a slow disk) is never robbed — its heartbeat stays fresh;
-* and a wedged holder stops heartbeating, so staleMs still reclaims it. There is
-* deliberately NO wall-clock backstop: elapsed wait time alone never steals, so a
-* live holder is inviolable.
+* Parse the selection menu a `needs_input` agent is parked on into a cursor
+* position + the available option numbers, so a caller can compute how far the
+* cursor must move (Down/Up) to reach a target option. Returns null when the
+* screen isn't a menu (delegates that judgement to {@link classifyNeedsInput},
+* so `working` still wins) or no numbered cursor line is found. Pure — the
+* `ay select` action reuses the exact detection `ay ls` renders with.
 */
-async function acquireLock(lockDir, staleMs = 3e4) {
-	const ownerFile = path.join(lockDir, "owner");
-	const token = randomUUID();
-	const readOwnerToken = async () => {
-		try {
-			return JSON.parse(await readFile(ownerFile, "utf8")).token ?? null;
-		} catch {
-			return null;
+function parseMenu(lines, cfg) {
+	const ni = classifyNeedsInput(lines, cfg);
+	if (!ni) return null;
+	const patterns = cfg.needsInput ?? [];
+	let cursorLine = -1;
+	for (let i = 0; i < lines.length; i++) if (patterns.some((re) => reTest(re, lines[i]))) cursorLine = i;
+	if (cursorLine < 0) return null;
+	const cm = /(\d+)\./.exec(lines[cursorLine]);
+	if (!cm) return null;
+	const cursor = parseInt(cm[1], 10);
+	const start = Math.max(0, cursorLine - 12);
+	const end = Math.min(lines.length, cursorLine + 12);
+	const options = [];
+	for (let i = start; i < end; i++) {
+		const m = OPTION_LINE.exec(lines[i]);
+		if (m) {
+			const v = parseInt(m[1], 10);
+			if (!options.includes(v)) options.push(v);
 		}
+	}
+	if (!options.includes(cursor)) options.push(cursor);
+	options.sort((a, b) => a - b);
+	return {
+		cursor,
+		options,
+		question: ni.question
 	};
-	const stampOwner = async () => {
-		const tmp = `${ownerFile}.${token}.tmp`;
-		try {
-			await writeFile(tmp, JSON.stringify({
-				pid: process.pid,
-				ts: Date.now(),
-				token
-			}));
-			await rename(tmp, ownerFile);
-			return true;
-		} catch {
-			await rm(tmp, { force: true }).catch(() => {});
-			return false;
-		}
+}
+/**
+* True when the rendered screen still shows a "busy" marker (config `working`,
+* e.g. claude's `esc to interrupt`). Paired with a long-quiet log this is the
+* `stuck` signal: a live spinner writes to the log every frame, so a busy marker
+* on screen WITHOUT recent output means the agent wedged mid-stream (a silent
+* API stream stall) rather than finishing. Pure + synchronous like the rest of
+* this module so it's trivially unit-testable.
+*/
+function isWorkingScreen(lines, working) {
+	if (!working?.length) return false;
+	const text = lines.join("\n");
+	return working.some((re) => reTest(re, text));
+}
+
+//#endregion
+//#region ts/lsWatch.ts
+/**
+* Diff the previous per-pid states against the current snapshot and return the
+* transition events to emit plus the next prev-map. Pure: no I/O, no clock —
+* the caller passes `ts`.
+*
+* Emits an event when:
+*  - an agent is seen for the first time (baseline, `prev_state: null`)
+*  - its `state` or `question` changed since last tick
+*  - it vanished from the live set without us ever seeing it `stopped` (reaped
+*    between ticks) — a synthetic `stopped` event so a "done" transition is
+*    never silently dropped.
+*/
+function diffLsStates(prev, cur, ts) {
+	const events = [];
+	const next = /* @__PURE__ */ new Map();
+	const curPids = /* @__PURE__ */ new Set();
+	for (const a of cur) {
+		curPids.add(a.pid);
+		next.set(a.pid, a);
+		const p = prev.get(a.pid);
+		if (!p) events.push({
+			...toEvent(a, ts),
+			prev_state: null
+		});
+		else if (p.state !== a.state || p.question !== a.question) events.push({
+			...toEvent(a, ts),
+			prev_state: p.state
+		});
+	}
+	for (const [pid, p] of prev) if (!curPids.has(pid) && p.state !== "stopped") events.push({
+		ts,
+		pid,
+		cli: p.cli,
+		cwd: p.cwd,
+		state: "stopped",
+		question: null,
+		prev_state: p.state
+	});
+	return {
+		events,
+		next
 	};
-	const lockAgeMs = async () => {
-		const m = await stat(lockDir).then((s) => s.mtimeMs).catch(() => Date.now());
-		return Date.now() - m;
+}
+function toEvent(a, ts) {
+	return {
+		ts,
+		pid: a.pid,
+		cli: a.cli,
+		cwd: a.cwd,
+		state: a.state,
+		question: a.question
 	};
-	for (;;) try {
-		await mkdir(lockDir, { recursive: false });
-		if (!await stampOwner()) {
-			await rm(lockDir, {
-				recursive: true,
-				force: true
-			}).catch(() => {});
-			await new Promise((r) => setTimeout(r, 15));
-			continue;
-		}
-		const beat = setInterval(() => {
-			(async () => {
-				if (await readOwnerToken() !== token) {
-					clearInterval(beat);
-					return;
-				}
-				await stampOwner();
-			})();
-		}, Math.max(500, Math.floor(staleMs / 3)));
-		if (typeof beat.unref === "function") beat.unref();
-		return async () => {
-			clearInterval(beat);
-			if (await readOwnerToken() === token) await rm(lockDir, {
-				recursive: true,
-				force: true
-			}).catch(() => {});
-		};
-	} catch (e) {
-		if (e.code !== "EEXIST") throw e;
-		if (shouldStealLock(await readFile(ownerFile, "utf8").catch(() => ""), Date.now(), {
-			staleMs,
-			lockAgeMs: await lockAgeMs(),
-			selfPid: process.pid,
-			isAlive: pidAlive
-		})) {
-			await rm(lockDir, {
-				recursive: true,
-				force: true
-			}).catch(() => {});
-			continue;
-		}
-		await new Promise((r) => setTimeout(r, 15));
-	}
 }
+
+//#endregion
+//#region ts/notifyInbox.ts
 /**
-* Append one event to a parent's inbox under lock, allocating the next seq. The
-* caller passes the event WITHOUT seq (we stamp it). Returns the stamped seq.
+* Pure, fs-free core for the subagent→parent notification inbox — the storage
+* and watermark layer under `ay notify` / `ay notifyd`.
+*
+* Motivation (real incident): a parent agent fanned out sub-agents that finished
+* their work but sat at an idle `❯` prompt WITHOUT exiting (claude-yes does not
+* exit on idle). Claude Code's background-task notification only fires on process
+* EXIT, so the parent never learned the children went idle and left them parked
+* 16 minutes. `ay ls --watch` already streams transitions, but it is PULL: the
+* parent must run the watch loop. The whole point of this pain is the parent is
+* NOT watching. So we accumulate qualifying edges into a per-parent append-only
+* inbox that the parent drains on its own schedule (its Monitor loop), with a
+* persisted cursor so a parent that restarts reads only the unread edges.
+*
+* This module is the pure part (path math, NDJSON (de)serialization, seq/cursor
+* filtering, retention decisions) so it is trivially unit-testable, mirroring
+* `lsWatch.ts` / `needsInput.ts` / `resultEnvelope.ts`. The fs read/write + lock
+* + CLI live in `subcommands.ts`; the detection/debounce lives in
+* `notifyRouter.ts`.
 */
-async function appendEvent(parentPid, ev) {
-	const host = ev.host;
-	const dir = inboxDir(host);
-	await ensureDir(dir);
-	const release = await acquireLock(path.join(dir, `${parentPid}.lock`));
-	try {
-		let last = 0;
-		const counterRaw = await readFile(seqPath(host, parentPid), "utf8").catch(() => "");
-		const parsed = parseInt(counterRaw.trim(), 10);
-		if (Number.isFinite(parsed) && parsed > 0) last = parsed;
-		else last = maxSeq(parseInboxText(await readFile(inboxPath(host, parentPid), "utf8").catch(() => "")));
-		const seq = nextSeq(last);
-		const full = {
-			...ev,
-			seq
-		};
-		await writeFile(seqPath(host, parentPid), String(seq));
-		await appendFile(inboxPath(host, parentPid), serializeEvent(full) + "\n");
-		return seq;
-	} finally {
-		await release();
-	}
+/** Root dir for all notification state. */
+function notifyDir() {
+	return path.join(agentYesHome(), "notify");
+}
+/** Per-host inbox directory (pids are only unique within a host). */
+function inboxDir(host) {
+	return path.join(notifyDir(), "inbox", sanitizeHost(host));
 }
-/** Read + parse a parent's inbox (empty array when none). */
-async function readInbox(host, parentPid) {
-	return parseInboxText(await readFile(inboxPath(host, parentPid), "utf8").catch(() => ""));
+/** Absolute path of one parent's append-only NDJSON inbox. */
+function inboxPath(host, parentPid) {
+	return path.join(inboxDir(host), `${parentPid}.ndjson`);
 }
-/** All parent pids that currently have an inbox on this host. */
-async function listInboxParents(host) {
-	const names = await readdir(inboxDir(host)).catch(() => []);
-	const pids = [];
-	for (const n of names) {
-		const m = /^(\d+)\.ndjson$/.exec(n);
-		if (m) pids.push(parseInt(m[1], 10));
-	}
-	return pids;
+/** Sidecar seq counter for a parent inbox (last allocated seq). */
+function seqPath(host, parentPid) {
+	return path.join(inboxDir(host), `${parentPid}.seq`);
 }
-async function getCursor(host, parentPid, consumer = "parent") {
-	return parseCursor(await readFile(cursorPath(host, parentPid, consumer), "utf8").catch(() => null)).seq;
+/** Per-consumer cursor directory for a parent inbox. */
+function cursorDir(host, parentPid) {
+	return path.join(notifyDir(), "cursors", sanitizeHost(host), String(parentPid));
 }
-/**
-* Minimum cursor across ALL consumers of a parent inbox — the watermark below
-* which rotation may evict events (nothing above it has been acked by every
-* reader). Returns 0 when there are no consumers — which PROTECTS EVERYTHING:
-* with a 0 watermark, `rotateKeep` treats every event as unacked and evicts
-* nothing (an inbox nobody reads is never trimmed).
-*/
-async function minConsumerCursor(host, parentPid) {
-	const cursors = (await readdir(cursorDir(host, parentPid)).catch(() => [])).filter((n) => n.endsWith(".json")).map((n) => n.slice(0, -5));
-	if (cursors.length === 0) return 0;
-	let min = Infinity;
-	for (const c of cursors) min = Math.min(min, await getCursor(host, parentPid, c));
-	return Number.isFinite(min) ? min : 0;
+/** Absolute path of one consumer's cursor file for a parent inbox. */
+function cursorPath(host, parentPid, consumer = "parent") {
+	return path.join(cursorDir(host, parentPid), `${sanitizeConsumer(consumer)}.json`);
 }
-async function setCursor(host, parentPid, seq, consumer = "parent") {
-	const p = cursorPath(host, parentPid, consumer);
-	await ensureDir(path.dirname(p));
-	await atomicWrite(p, serializeCursor(seq));
+/** The daemon singleton lock dir (mkdir-based, like pidStore). */
+function daemonLockDir() {
+	return path.join(notifyDir(), "notifyd.lock");
 }
 /**
-* Retention: delete inboxes (+ their seq counter + cursors) for parents that are
-* both dead and unreferenced by any live child. `capBytes` also rotates a live
-* inbox that has grown past the cap, keeping the newest events.
+* Owner metadata inside the lock dir ({pid, started_at, ts}) — the SINGLE source
+* of truth for the running daemon's identity, used for stale-lock steal and for
+* `notifyd status`/`stop` (a running daemon refreshes `ts` each tick).
 */
-async function gcInboxes(host, livePids, liveChildParentPids, capBytes = 10 * 1024 * 1024) {
-	const parents = await listInboxParents(host);
-	for (const p of parents) {
-		const release = await acquireLock(path.join(inboxDir(host), `${p}.lock`));
-		try {
-			if (!livePids.has(p) && !liveChildParentPids.has(p)) {
-				await rm(inboxPath(host, p), { force: true }).catch(() => {});
-				await rm(seqPath(host, p), { force: true }).catch(() => {});
-				await rm(cursorDir(host, p), {
-					recursive: true,
-					force: true
-				}).catch(() => {});
-				continue;
-			}
-			const size = await stat(inboxPath(host, p)).then((s) => s.size).catch(() => 0);
-			if (size <= capBytes) continue;
-			const events = await readInbox(host, p);
-			const kept = rotateKeep(events, capBytes, await minConsumerCursor(host, p));
-			if (kept.length < events.length) await writeFile(inboxPath(host, p), kept.map(serializeEvent).join("\n") + "\n");
-			else logger.warn(`[notify] inbox for parent ${p} is ${size} bytes (> soft cap ${capBytes}) but all events are unacked — cursor not advancing?`);
-		} finally {
-			await release();
-		}
-	}
+function daemonLockOwnerPath() {
+	return path.join(daemonLockDir(), "owner.json");
 }
-/** Register / refresh this parent's watch heartbeat (atomically, so a concurrent
-* liveWatchers never reads a torn file and transiently drops the watcher). */
-async function heartbeatWatcher(parentPid, startedAt) {
-	await ensureDir(watchersDir());
-	await atomicWrite(watcherPath(parentPid), JSON.stringify({
-		pid: parentPid,
-		started_at: startedAt,
-		ts: Date.now()
-	}));
+/** Registry dir of parents currently running `ay notify watch` (heartbeats). */
+function watchersDir() {
+	return path.join(notifyDir(), "watchers");
 }
-/** Remove this parent's watch heartbeat (on watch exit). */
-async function clearWatcher(parentPid) {
-	await rm(watcherPath(parentPid), { force: true }).catch(() => {});
+/** Heartbeat file for one watching parent. */
+function watcherPath(parentPid) {
+	return path.join(watchersDir(), `${parentPid}.json`);
+}
+/** A watcher heartbeat is "live" if refreshed within this window. */
+const WATCHER_TTL_MS = 15e3;
+function sanitizeSegment(s, fallback) {
+	const cleaned = s.replace(/[^A-Za-z0-9._-]/g, "_");
+	return cleaned === "" || cleaned === "." || cleaned === ".." ? fallback : cleaned;
+}
+function sanitizeHost(host) {
+	return sanitizeSegment(host, "localhost");
+}
+function sanitizeConsumer(consumer) {
+	return sanitizeSegment(consumer, "parent");
+}
+/** Serialize one event to its NDJSON line (no trailing newline). */
+function serializeEvent(ev) {
+	return JSON.stringify(ev);
 }
 /**
-* Live watchers as a map of parent pid → the parent's own `started_at` (its
-* authoritative self-reported start time, so the daemon never has to guess it
-* from the registry and stamp a 0). A watcher counts as live ONLY if its
-* heartbeat is fresh AND its process is actually alive — so a crashed `watch`
-* whose heartbeat lingers for the TTL doesn't keep the daemon writing to a dead
-* parent's inbox (which would violate "nothing happens unless you watch"). A
-* heartbeat with a missing/non-positive `started_at` is treated as NOT live: the
-* daemon's cross-session scope guard keys off a positive parent start time, so a
-* 0 would defeat it — fail closed.
+* Parse an inbox's raw text into events. Tolerant by design: a torn final line
+* (a writer mid-append) or any unparseable line is skipped, never throws — a
+* reader must survive a concurrent writer. Order is file order (= seq order,
+* since a single locked writer appends in increasing seq).
 */
-async function liveWatchers(now = Date.now()) {
-	const names = await readdir(watchersDir()).catch(() => []);
-	const live = /* @__PURE__ */ new Map();
-	for (const n of names) {
-		if (!n.endsWith(".json")) continue;
-		const raw = await readFile(path.join(watchersDir(), n), "utf8").catch(() => "");
+function parseInboxText(text) {
+	const out = [];
+	for (const line of text.split("\n")) {
+		const t = line.trim();
+		if (!t) continue;
 		try {
-			const o = JSON.parse(raw);
-			if (typeof o?.pid === "number" && typeof o?.started_at === "number" && o.started_at > 0 && typeof o?.ts === "number" && now - o.ts <= WATCHER_TTL_MS && pidAlive(o.pid)) live.set(o.pid, o.started_at);
+			const ev = JSON.parse(t);
+			if (isValidEvent(ev)) out.push(ev);
 		} catch {}
 	}
-	return live;
+	return out;
 }
-
-//#endregion
-//#region ts/agentTree.ts
+const EDGES = new Set([
+	"needs_input",
+	"idle",
+	"exited"
+]);
 /**
-* Link records into a forest via parent_pid === wrapper_pid. Records whose
-* parent isn't present in the set (top-level agents, or links into agents
-* filtered out by a keyword/scope) become roots. Root and sibling order follows
-* the input order, so a caller that pre-sorts (e.g. newest-first) is preserved.
+* Full shape validation at the storage boundary — a torn/partial line missing
+* the correlation fields must never flow through to a consumer's output. Every
+* event we surface has the fields a reader relies on.
 */
-function buildAgentForest(records) {
-	const nodes = records.map((record) => ({
-		record,
-		children: []
-	}));
-	const byWrapper = /* @__PURE__ */ new Map();
-	for (const n of nodes) {
-		const w = n.record.wrapper_pid;
-		if (typeof w === "number" && w > 0) byWrapper.set(w, n);
-	}
-	const roots = [];
-	for (const n of nodes) {
-		const p = n.record.parent_pid;
-		const parent = typeof p === "number" && p > 0 ? byWrapper.get(p) : void 0;
-		if (parent && parent !== n) parent.children.push(n);
-		else roots.push(n);
+function isValidEvent(ev) {
+	if (!ev || typeof ev !== "object") return false;
+	const e = ev;
+	return typeof e.seq === "number" && typeof e.ts === "number" && typeof e.host === "string" && typeof e.parent_pid === "number" && typeof e.child_pid === "number" && typeof e.cli === "string" && typeof e.cwd === "string" && typeof e.edge === "string" && EDGES.has(e.edge) && typeof e.state === "string" && (e.question === null || typeof e.question === "string");
+}
+/** Next seq to allocate given the last stored seq counter (or the inbox max). */
+function nextSeq(lastSeq) {
+	return (Number.isFinite(lastSeq) && lastSeq > 0 ? lastSeq : 0) + 1;
+}
+/** Highest seq present in a parsed inbox (0 when empty). */
+function maxSeq(events) {
+	let m = 0;
+	for (const e of events) if (e.seq > m) m = e.seq;
+	return m;
+}
+/**
+* Filter events for `--since <seq>`: strictly-greater than the given seq. A
+* `since` of 0/undefined returns everything.
+*/
+function filterSinceSeq(events, sinceSeq) {
+	if (!sinceSeq || sinceSeq <= 0) return events.slice();
+	return events.filter((e) => e.seq > sinceSeq);
+}
+/** Filter events after a wall-clock `--since <ts>` (inclusive lower bound). */
+function filterSinceTs(events, sinceTs) {
+	if (!sinceTs || sinceTs <= 0) return events.slice();
+	return events.filter((e) => e.ts >= sinceTs);
+}
+/** Unread = seq strictly greater than the consumer's cursor. */
+function filterUnread(events, cursorSeq) {
+	return events.filter((e) => e.seq > (cursorSeq > 0 ? cursorSeq : 0));
+}
+/** Parse a cursor file's text; a missing/garbage cursor reads as seq 0. */
+function parseCursor(text) {
+	if (!text) return { seq: 0 };
+	try {
+		const c = JSON.parse(text);
+		return { seq: Number.isFinite(c?.seq) && c.seq > 0 ? c.seq : 0 };
+	} catch {
+		return { seq: 0 };
 	}
-	const seen = /* @__PURE__ */ new Set();
-	const mark = (n) => {
-		if (seen.has(n)) return;
-		seen.add(n);
-		n.children.forEach(mark);
-	};
-	roots.forEach(mark);
-	for (const n of nodes) if (!seen.has(n)) roots.push(n);
-	return roots;
+}
+function serializeCursor(seq) {
+	return JSON.stringify({ seq: Math.max(0, Math.floor(seq)) });
 }
 /**
-* Depth-first flatten a forest into rows carrying a box-drawing branch prefix.
-* A `visited` guard makes a pathological parent_pid cycle terminate instead of
-* recursing forever.
+* Rotation decision (pure): given an inbox's events, a byte cap, and the minimum
+* un-acked cursor across ALL consumers, return the events to KEEP after
+* rotating. Critically, an event with `seq > protectAboveSeq` is NEVER dropped —
+* that is the at-least-once guarantee: we must not evict an edge no consumer has
+* acknowledged yet, even under the byte cap. Below that watermark we keep the
+* newest events that fit the cap (and at least `minKeep`).
 */
-function flattenForest(roots) {
-	const rows = [];
-	const visited = /* @__PURE__ */ new Set();
-	const walk = (node, ancestorsLast) => {
-		if (visited.has(node)) return;
-		visited.add(node);
-		const depth = ancestorsLast.length;
-		let prefix = "";
-		for (let i = 0; i < depth - 1; i++) prefix += ancestorsLast[i] ? "   " : "│  ";
-		if (depth > 0) prefix += ancestorsLast[depth - 1] ? "└─ " : "├─ ";
-		rows.push({
-			record: node.record,
-			prefix,
-			depth
-		});
-		node.children.forEach((c, i) => walk(c, [...ancestorsLast, i === node.children.length - 1]));
-	};
-	for (const r of roots) walk(r, []);
-	return rows;
+function rotateKeep(events, capBytes, protectAboveSeq = 0, minKeep = 100) {
+	if (events.length <= minKeep) return events.slice();
+	const kept = [];
+	let bytes = 0;
+	for (let i = events.length - 1; i >= 0; i--) {
+		const e = events[i];
+		const line = serializeEvent(e) + "\n";
+		bytes += line.length;
+		if (e.seq > protectAboveSeq || kept.length < minKeep || bytes <= capBytes) kept.push(e);
+		else break;
+	}
+	kept.reverse();
+	return kept;
 }
 
 //#endregion
-//#region ts/todoParse.ts
+//#region ts/notifyStore.ts
 /**
-* Parse an agent's todo/task list out of its RENDERED TUI screen.
-*
-* Source of truth for EVERY CLI (claude, codex, gemini, …) is the screen the
-* agent draws — never a CLI-specific session file. The durable copy is the
-* per-pid raw log (`<cwd>/.agent-yes/<pid>.raw.log`); rendering it through a
-* headless xterm (see renderRawLog) collapses the reflow/redraw frames into the
-* final coherent text, which is what we scan here.
-*
-* The todo list in these TUIs renders as a tree block anchored by the `⎿`
-* branch glyph, one marker per line:
-*
-*     ⎿  ☒ Wire up the parser
-*        ☒ Add the badge
-*        ◼ Compute in /api/ls      ← in progress
-*        ◻ Render in the console   ← pending
-*        ◻ Tests
-*
-* Badge = `${done}/${total}` (done is the numerator → "2/5").
+* Filesystem side of the notification inbox — the impure half of the pure
+* `notifyInbox.ts` path/serialization core. Handles the locked append (so
+* concurrent daemon ticks / future writers never interleave a seq), inbox and
+* cursor reads/writes, and retention GC.
 *
-* This parse is deliberately conservative: we only report a count when a block
-* is confidently detected (the `⎿` anchor + ≥2 consecutive marker lines), so an
-* agent that merely prints a check glyph in prose never produces a phantom badge.
+* The lock is a mkdir-based advisory lock (same primitive `pidStore` uses), held
+* only for the microseconds of a read-counter → append-line → write-counter, so
+* contention is negligible even with many parents.
 */
-const DONE = new Set([
-	"✔",
-	"☑",
-	"✓",
-	"☒"
-]);
-const IN_PROGRESS = new Set(["◼"]);
-const PENDING = new Set(["◻", "☐"]);
-const ANCHOR = "⎿";
-function markerOf(line) {
-	let s = line.replace(/^\s+/, "");
-	if (s.startsWith(ANCHOR)) s = s.slice(1).replace(/^\s+/, "");
-	const ch = [...s][0];
-	if (ch === void 0) return null;
-	if (DONE.has(ch)) return "done";
-	if (IN_PROGRESS.has(ch)) return "inprogress";
-	if (PENDING.has(ch)) return "pending";
-	return null;
+/** Stable local host id — the pid namespace is per-host. */
+function hostId() {
+	return os.hostname() || "localhost";
+}
+function pidAlive(pid) {
+	if (!Number.isFinite(pid) || pid <= 0) return false;
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (e) {
+		return e.code === "EPERM";
+	}
 }
 /**
-* Find the MOST RECENT confidently-detected todo block in the rendered lines and
-* return its {done, total}. Returns null when none qualifies (caller omits the
-* badge entirely — never shows "0/0").
+* Pure steal decision for a per-inbox lock (extracted so it's unit-testable):
+* steal the lock ONLY when its holder is provably gone (torn/missing owner on a
+* lock that has EXISTED longer than the grace, or a dead pid) or its heartbeat is
+* stale — NEVER merely because the contender has waited a while.
 *
-* A block is a maximal run of consecutive marker lines. It only counts when it
-* is anchored — the `⎿` glyph appears on the run's first line or the line
-* directly above it — and has ≥2 marker lines. The last qualifying block wins,
-* since the agent's current todo state is the one drawn most recently.
+* Crucially, the torn-owner grace is measured from the LOCK INSTANCE's age
+* (`lockAgeMs` = now − lockDir mtime), NOT from how long the contender has been
+* waiting. Otherwise a contender that waited out one holder could instantly steal
+* the NEXT holder's freshly-created lock during its mkdir→write-owner window
+* (torn but brand-new) — letting two writers into the critical section.
 */
-function parseTaskCounts(lines) {
-	let best = null;
-	const n = lines.length;
-	let i = 0;
-	while (i < n) {
-		if (markerOf(lines[i]) === null) {
-			i++;
-			continue;
-		}
-		let hasAnchor = i > 0 && lines[i - 1].includes(ANCHOR);
-		const counts = {
-			done: 0,
-			inprogress: 0,
-			pending: 0
-		};
-		let j = i;
-		for (; j < n; j++) {
-			const mk = markerOf(lines[j]);
-			if (mk === null) break;
-			if (lines[j].includes(ANCHOR)) hasAnchor = true;
-			counts[mk]++;
-		}
-		const total = counts.done + counts.inprogress + counts.pending;
-		if (hasAnchor && total >= 2) best = {
-			done: counts.done,
-			total
-		};
-		i = j === i ? i + 1 : j;
-	}
-	return best;
+function shouldStealLock(ownerRaw, now, opts) {
+	const graceMs = opts.graceMs ?? 1e3;
+	let ownerPid = 0;
+	let ownerTs = 0;
+	let parsed = false;
+	try {
+		const o = JSON.parse(ownerRaw);
+		ownerPid = o?.pid ?? 0;
+		ownerTs = o?.ts ?? 0;
+		parsed = true;
+	} catch {}
+	if (!parsed || ownerPid <= 0 || ownerTs <= 0) return opts.lockAgeMs > graceMs;
+	const holderDead = ownerPid !== opts.selfPid && !opts.isAlive(ownerPid);
+	const holderStale = now - ownerTs > opts.staleMs;
+	return holderDead || holderStale;
 }
-
-//#endregion
-//#region ts/badges.ts
-const BADGE_DEFS = [
-	{
-		id: "goal-active",
-		label: "goal",
-		title: "A /goal Stop-hook loop is active on this agent",
-		pattern: /\/goal active/i
-	},
-	{
-		id: "session-limit",
-		label: "limit",
-		title: "Usage session limit hit — waiting for the reset time shown on screen",
-		pattern: /you['’]?ve hit your session limit/i
-	},
-	{
-		id: "retrying",
-		label: "retry",
-		title: "Waiting for the API — the CLI is auto-retrying on its own backoff (no action needed)",
-		pattern: /Waiting for API response[\s\S]{0,40}will retry in \d/i
+async function ensureDir(dir) {
+	await mkdir(dir, { recursive: true }).catch(() => {});
+}
+/**
+* Atomically overwrite a single file (temp + rename) so a concurrent reader never
+* observes a torn/partial write — the sweep invariant for every single-file
+* mutation (cursor, watcher heartbeat, lock owner). Returns whether it landed.
+*/
+async function atomicWrite(file, data) {
+	const tmp = `${file}.${randomUUID()}.tmp`;
+	try {
+		await writeFile(tmp, data);
+		await rename(tmp, file);
+		return true;
+	} catch {
+		await rm(tmp, { force: true }).catch(() => {});
+		return false;
 	}
-];
+}
 /**
-* Which badge ids match the given rendered screen lines. Pure so it's
-* unit-tested without a live PTY/log file.
+* Acquire a per-inbox lock; returns a release fn. Ownership is proven ONLY by a
+* successful `mkdir(recursive:false)` (atomic exclusive create), and stealing is
+* driven by HOLDER LIVENESS, not elapsed wait time: the holder writes an
+* `owner` file ({pid, ts}) on acquire AND heartbeats its ts for the whole time
+* it holds the lock, so a contender steals ONLY when that holder is dead or its
+* heartbeat is stale. A live holder whose critical section legitimately runs long
+* (a big GC rewrite, a slow disk) is never robbed — its heartbeat stays fresh;
+* and a wedged holder stops heartbeating, so staleMs still reclaims it. There is
+* deliberately NO wall-clock backstop: elapsed wait time alone never steals, so a
+* live holder is inviolable.
 */
-function matchBadges(lines, defs = BADGE_DEFS) {
-	const text = lines.join("\n");
-	return defs.filter((d) => d.pattern.test(text)).map((d) => d.id);
+async function acquireLock(lockDir, staleMs = 3e4) {
+	const ownerFile = path.join(lockDir, "owner");
+	const token = randomUUID();
+	const readOwnerToken = async () => {
+		try {
+			return JSON.parse(await readFile(ownerFile, "utf8")).token ?? null;
+		} catch {
+			return null;
+		}
+	};
+	const stampOwner = async () => {
+		const tmp = `${ownerFile}.${token}.tmp`;
+		try {
+			await writeFile(tmp, JSON.stringify({
+				pid: process.pid,
+				ts: Date.now(),
+				token
+			}));
+			await rename(tmp, ownerFile);
+			return true;
+		} catch {
+			await rm(tmp, { force: true }).catch(() => {});
+			return false;
+		}
+	};
+	const lockAgeMs = async () => {
+		const m = await stat(lockDir).then((s) => s.mtimeMs).catch(() => Date.now());
+		return Date.now() - m;
+	};
+	for (;;) try {
+		await mkdir(lockDir, { recursive: false });
+		if (!await stampOwner()) {
+			await rm(lockDir, {
+				recursive: true,
+				force: true
+			}).catch(() => {});
+			await new Promise((r) => setTimeout(r, 15));
+			continue;
+		}
+		const beat = setInterval(() => {
+			(async () => {
+				if (await readOwnerToken() !== token) {
+					clearInterval(beat);
+					return;
+				}
+				await stampOwner();
+			})();
+		}, Math.max(500, Math.floor(staleMs / 3)));
+		if (typeof beat.unref === "function") beat.unref();
+		return async () => {
+			clearInterval(beat);
+			if (await readOwnerToken() === token) await rm(lockDir, {
+				recursive: true,
+				force: true
+			}).catch(() => {});
+		};
+	} catch (e) {
+		if (e.code !== "EEXIST") throw e;
+		if (shouldStealLock(await readFile(ownerFile, "utf8").catch(() => ""), Date.now(), {
+			staleMs,
+			lockAgeMs: await lockAgeMs(),
+			selfPid: process.pid,
+			isAlive: pidAlive
+		})) {
+			await rm(lockDir, {
+				recursive: true,
+				force: true
+			}).catch(() => {});
+			continue;
+		}
+		await new Promise((r) => setTimeout(r, 15));
+	}
 }
 /**
-* A time-derived flag (NOT screen-matched): lit when the user typed at this
-* agent's terminal within the last few seconds. The ls code appends its id from
-* the Rust runner's stdin-activity marker, so it resolves through `badgeDef`
-* like any other chip — but `matchBadges` never produces it (it isn't in
-* BADGE_DEFS, and its pattern can't match), keeping screen matching pure.
+* Append one event to a parent's inbox under lock, allocating the next seq. The
+* caller passes the event WITHOUT seq (we stamp it). Returns the stamped seq.
 */
-const TYPING_BADGE = {
-	id: "typing",
-	label: "typing",
-	title: "The user is typing at this agent's terminal — ay send backs off until they pause",
-	pattern: /(?!)/
-};
-function badgeDef(id, defs = BADGE_DEFS) {
-	return defs.find((d) => d.id === id) ?? (id === TYPING_BADGE.id ? TYPING_BADGE : void 0);
+async function appendEvent(parentPid, ev) {
+	const host = ev.host;
+	const dir = inboxDir(host);
+	await ensureDir(dir);
+	const release = await acquireLock(path.join(dir, `${parentPid}.lock`));
+	try {
+		let last = 0;
+		const counterRaw = await readFile(seqPath(host, parentPid), "utf8").catch(() => "");
+		const parsed = parseInt(counterRaw.trim(), 10);
+		if (Number.isFinite(parsed) && parsed > 0) last = parsed;
+		else last = maxSeq(parseInboxText(await readFile(inboxPath(host, parentPid), "utf8").catch(() => "")));
+		const seq = nextSeq(last);
+		const full = {
+			...ev,
+			seq
+		};
+		await writeFile(seqPath(host, parentPid), String(seq));
+		await appendFile(inboxPath(host, parentPid), serializeEvent(full) + "\n");
+		return seq;
+	} finally {
+		await release();
+	}
 }
-
-//#endregion
-//#region ts/needsInput.ts
-function reTest(re, s) {
-	return (re.global || re.sticky ? new RegExp(re.source, re.flags.replace(/[gy]/g, "")) : re).test(s);
+/** Read + parse a parent's inbox (empty array when none). */
+async function readInbox(host, parentPid) {
+	return parseInboxText(await readFile(inboxPath(host, parentPid), "utf8").catch(() => ""));
 }
-function isChromeLine(s) {
-	const t = s.trim();
-	return !t || /^─+$/.test(t) || /^esc to (interrupt|cancel)/i.test(t) || /\? for shortcuts/.test(t) || /\d+%\s*until auto-compact/i.test(t);
+/** All parent pids that currently have an inbox on this host. */
+async function listInboxParents(host) {
+	const names = await readdir(inboxDir(host)).catch(() => []);
+	const pids = [];
+	for (const n of names) {
+		const m = /^(\d+)\.ndjson$/.exec(n);
+		if (m) pids.push(parseInt(m[1], 10));
+	}
+	return pids;
+}
+async function getCursor(host, parentPid, consumer = "parent") {
+	return parseCursor(await readFile(cursorPath(host, parentPid, consumer), "utf8").catch(() => null)).seq;
 }
 /**
-* Returns a NeedsInput when the screen shows an unresolved selection menu, else
-* null. `cfg.working` short-circuits to null (an actively-working agent isn't
-* blocked). Pure + synchronous so it's trivially unit-testable.
+* Minimum cursor across ALL consumers of a parent inbox — the watermark below
+* which rotation may evict events (nothing above it has been acked by every
+* reader). Returns 0 when there are no consumers — which PROTECTS EVERYTHING:
+* with a 0 watermark, `rotateKeep` treats every event as unacked and evicts
+* nothing (an inbox nobody reads is never trimmed).
 */
-function classifyNeedsInput(lines, cfg) {
-	const patterns = cfg.needsInput ?? [];
-	if (patterns.length === 0) return null;
-	const text = lines.join("\n");
-	if ((cfg.working ?? []).some((re) => reTest(re, text))) return null;
-	if (!patterns.some((re) => reTest(re, text))) return null;
-	let last = -1;
-	for (let i = 0; i < lines.length; i++) if (patterns.some((re) => reTest(re, lines[i]))) last = i;
-	const start = Math.max(0, last - 6);
-	const end = Math.min(lines.length, last + 6);
-	return { question: lines.slice(start, end).map((l) => l.trim()).filter((l) => l && !isChromeLine(l)).join(" • ").slice(0, 400) };
+async function minConsumerCursor(host, parentPid) {
+	const cursors = (await readdir(cursorDir(host, parentPid)).catch(() => [])).filter((n) => n.endsWith(".json")).map((n) => n.slice(0, -5));
+	if (cursors.length === 0) return 0;
+	let min = Infinity;
+	for (const c of cursors) min = Math.min(min, await getCursor(host, parentPid, c));
+	return Number.isFinite(min) ? min : 0;
+}
+async function setCursor(host, parentPid, seq, consumer = "parent") {
+	const p = cursorPath(host, parentPid, consumer);
+	await ensureDir(path.dirname(p));
+	await atomicWrite(p, serializeCursor(seq));
 }
-const OPTION_LINE = /^[\s❯›>▶◉○●·*-]*?(\d+)\.\s/;
 /**
-* Parse the selection menu a `needs_input` agent is parked on into a cursor
-* position + the available option numbers, so a caller can compute how far the
-* cursor must move (Down/Up) to reach a target option. Returns null when the
-* screen isn't a menu (delegates that judgement to {@link classifyNeedsInput},
-* so `working` still wins) or no numbered cursor line is found. Pure — the
-* `ay select` action reuses the exact detection `ay ls` renders with.
+* Retention: delete inboxes (+ their seq counter + cursors) for parents that are
+* both dead and unreferenced by any live child. `capBytes` also rotates a live
+* inbox that has grown past the cap, keeping the newest events.
 */
-function parseMenu(lines, cfg) {
-	const ni = classifyNeedsInput(lines, cfg);
-	if (!ni) return null;
-	const patterns = cfg.needsInput ?? [];
-	let cursorLine = -1;
-	for (let i = 0; i < lines.length; i++) if (patterns.some((re) => reTest(re, lines[i]))) cursorLine = i;
-	if (cursorLine < 0) return null;
-	const cm = /(\d+)\./.exec(lines[cursorLine]);
-	if (!cm) return null;
-	const cursor = parseInt(cm[1], 10);
-	const start = Math.max(0, cursorLine - 12);
-	const end = Math.min(lines.length, cursorLine + 12);
-	const options = [];
-	for (let i = start; i < end; i++) {
-		const m = OPTION_LINE.exec(lines[i]);
-		if (m) {
-			const v = parseInt(m[1], 10);
-			if (!options.includes(v)) options.push(v);
+async function gcInboxes(host, livePids, liveChildParentPids, capBytes = 10 * 1024 * 1024) {
+	const parents = await listInboxParents(host);
+	for (const p of parents) {
+		const release = await acquireLock(path.join(inboxDir(host), `${p}.lock`));
+		try {
+			if (!livePids.has(p) && !liveChildParentPids.has(p)) {
+				await rm(inboxPath(host, p), { force: true }).catch(() => {});
+				await rm(seqPath(host, p), { force: true }).catch(() => {});
+				await rm(cursorDir(host, p), {
+					recursive: true,
+					force: true
+				}).catch(() => {});
+				continue;
+			}
+			const size = await stat(inboxPath(host, p)).then((s) => s.size).catch(() => 0);
+			if (size <= capBytes) continue;
+			const events = await readInbox(host, p);
+			const kept = rotateKeep(events, capBytes, await minConsumerCursor(host, p));
+			if (kept.length < events.length) await writeFile(inboxPath(host, p), kept.map(serializeEvent).join("\n") + "\n");
+			else logger.warn(`[notify] inbox for parent ${p} is ${size} bytes (> soft cap ${capBytes}) but all events are unacked — cursor not advancing?`);
+		} finally {
+			await release();
 		}
 	}
-	if (!options.includes(cursor)) options.push(cursor);
-	options.sort((a, b) => a - b);
-	return {
-		cursor,
-		options,
-		question: ni.question
-	};
 }
-/**
-* True when the rendered screen still shows a "busy" marker (config `working`,
-* e.g. claude's `esc to interrupt`). Paired with a long-quiet log this is the
-* `stuck` signal: a live spinner writes to the log every frame, so a busy marker
-* on screen WITHOUT recent output means the agent wedged mid-stream (a silent
-* API stream stall) rather than finishing. Pure + synchronous like the rest of
-* this module so it's trivially unit-testable.
-*/
-function isWorkingScreen(lines, working) {
-	if (!working?.length) return false;
-	const text = lines.join("\n");
-	return working.some((re) => reTest(re, text));
+/** Register / refresh this parent's watch heartbeat (atomically, so a concurrent
+* liveWatchers never reads a torn file and transiently drops the watcher). */
+async function heartbeatWatcher(parentPid, startedAt) {
+	await ensureDir(watchersDir());
+	await atomicWrite(watcherPath(parentPid), JSON.stringify({
+		pid: parentPid,
+		started_at: startedAt,
+		ts: Date.now()
+	}));
+}
+/** Remove this parent's watch heartbeat (on watch exit). */
+async function clearWatcher(parentPid) {
+	await rm(watcherPath(parentPid), { force: true }).catch(() => {});
 }
-
-//#endregion
-//#region ts/lsWatch.ts
 /**
-* Diff the previous per-pid states against the current snapshot and return the
-* transition events to emit plus the next prev-map. Pure: no I/O, no clock —
-* the caller passes `ts`.
-*
-* Emits an event when:
-*  - an agent is seen for the first time (baseline, `prev_state: null`)
-*  - its `state` or `question` changed since last tick
-*  - it vanished from the live set without us ever seeing it `stopped` (reaped
-*    between ticks) — a synthetic `stopped` event so a "done" transition is
-*    never silently dropped.
+* Live watchers as a map of parent pid → the parent's own `started_at` (its
+* authoritative self-reported start time, so the daemon never has to guess it
+* from the registry and stamp a 0). A watcher counts as live ONLY if its
+* heartbeat is fresh AND its process is actually alive — so a crashed `watch`
+* whose heartbeat lingers for the TTL doesn't keep the daemon writing to a dead
+* parent's inbox (which would violate "nothing happens unless you watch"). A
+* heartbeat with a missing/non-positive `started_at` is treated as NOT live: the
+* daemon's cross-session scope guard keys off a positive parent start time, so a
+* 0 would defeat it — fail closed.
 */
-function diffLsStates(prev, cur, ts) {
-	const events = [];
-	const next = /* @__PURE__ */ new Map();
-	const curPids = /* @__PURE__ */ new Set();
-	for (const a of cur) {
-		curPids.add(a.pid);
-		next.set(a.pid, a);
-		const p = prev.get(a.pid);
-		if (!p) events.push({
-			...toEvent(a, ts),
-			prev_state: null
-		});
-		else if (p.state !== a.state || p.question !== a.question) events.push({
-			...toEvent(a, ts),
-			prev_state: p.state
-		});
+async function liveWatchers(now = Date.now()) {
+	const names = await readdir(watchersDir()).catch(() => []);
+	const live = /* @__PURE__ */ new Map();
+	for (const n of names) {
+		if (!n.endsWith(".json")) continue;
+		const raw = await readFile(path.join(watchersDir(), n), "utf8").catch(() => "");
+		try {
+			const o = JSON.parse(raw);
+			if (typeof o?.pid === "number" && typeof o?.started_at === "number" && o.started_at > 0 && typeof o?.ts === "number" && now - o.ts <= WATCHER_TTL_MS && pidAlive(o.pid)) live.set(o.pid, o.started_at);
+		} catch {}
 	}
-	for (const [pid, p] of prev) if (!curPids.has(pid) && p.state !== "stopped") events.push({
-		ts,
-		pid,
-		cli: p.cli,
-		cwd: p.cwd,
-		state: "stopped",
-		question: null,
-		prev_state: p.state
-	});
-	return {
-		events,
-		next
-	};
-}
-function toEvent(a, ts) {
-	return {
-		ts,
-		pid: a.pid,
-		cli: a.cli,
-		cwd: a.cwd,
-		state: a.state,
-		question: a.question
-	};
+	return live;
 }
 
 //#endregion
@@ -968,6 +968,25 @@ async function recordRead(by, target) {
 async function lastReadAt(by, target) {
 	return (await readReads()).get(`${by}${READS_KEY_SEP}${target}`) ?? null;
 }
+async function recentReadEdges(windowMs = READ_WINDOW_MS) {
+	const now = Date.now();
+	const map = await readReads();
+	const out = [];
+	for (const [key, at] of map) {
+		if (now - at > windowMs) continue;
+		const i = key.indexOf(READS_KEY_SEP);
+		const by = key.slice(0, i);
+		if (!by.startsWith("agent:")) continue;
+		const byPid = Number(by.slice(6));
+		const target = Number(key.slice(i + 1));
+		if (byPid && target && byPid !== target) out.push({
+			by: byPid,
+			target,
+			at
+		});
+	}
+	return out;
+}
 async function resolveSender() {
 	const envPid = process.env.AGENT_YES_PID ? Number(process.env.AGENT_YES_PID) : null;
 	if (!envPid || Number.isNaN(envPid)) return null;
@@ -1126,19 +1145,19 @@ async function runSubcommand(argv) {
 			case "restart": return await cmdRestart(rest);
 			case "note": return await cmdNote(rest);
 			case "serve": {
-				const { cmdServe } = await import("./serve-DgQjFYQC.js");
+				const { cmdServe } = await import("./serve-B5PQdiOb.js");
 				return cmdServe(rest);
 			}
 			case "setup": {
-				const { cmdSetup } = await import("./setup-DHVydU-j.js");
+				const { cmdSetup } = await import("./setup-BCqFNJoB.js");
 				return cmdSetup(rest);
 			}
 			case "schedule": {
-				const { cmdSchedule } = await import("./schedule-DXGDI0Uo.js");
+				const { cmdSchedule } = await import("./schedule-BQtFOk0z.js");
 				return cmdSchedule(rest);
 			}
 			case "remote": {
-				const { cmdRemote } = await import("./remotes-BQMr4_En.js");
+				const { cmdRemote } = await import("./remotes-BIHNxn1a.js");
 				return cmdRemote(rest);
 			}
 			case "reap":
@@ -1531,7 +1550,7 @@ async function fetchRemoteRecordsRaw(url, token, opts) {
 		let base = url;
 		let bearer = token;
 		if (isWebrtcSpec(url)) {
-			const { startWebrtcBridge } = await import("./webrtcRemote-Bx-eD_0I.js");
+			const { startWebrtcBridge } = await import("./webrtcRemote-BLEbZnbY.js");
 			bridge = await startWebrtcBridge(url);
 			base = bridge.baseUrl;
 			bearer = bridge.token;
@@ -3040,7 +3059,10 @@ function stopTipForCli(cli, pid) {
 const GRACEFUL_EXIT_COMMANDS = {
 	claude: "/exit",
 	codex: "/exit",
-	gemini: "/quit"
+	gemini: "/quit",
+	bash: "exit",
+	cmd: "exit",
+	powershell: "exit"
 };
 function controlCodeFromName(name) {
 	switch (name) {
@@ -3969,7 +3991,7 @@ async function cmdNotify(rest) {
 	}
 	const ensure = async () => {
 		if (!argv["ensure-daemon"]) return;
-		const { ensureDaemon } = await import("./notifyDaemon-CLRNmdHy.js");
+		const { ensureDaemon } = await import("./notifyDaemon-C08fJ2Ai.js");
 		await ensureDaemon().catch(() => null);
 	};
 	await heartbeatWatcher(parent, selfStartedAt);
@@ -4043,7 +4065,7 @@ async function cmdNotifyCursor(args) {
 }
 async function cmdNotifyd(rest) {
 	const sub = rest[0] ?? "status";
-	const daemon = await import("./notifyDaemon-CLRNmdHy.js");
+	const daemon = await import("./notifyDaemon-C08fJ2Ai.js");
 	switch (sub) {
 		case "run": return daemon.runDaemon();
 		case "once": return daemon.runDaemon({ once: true });
@@ -4069,5 +4091,5 @@ async function cmdNotifyd(rest) {
 }
 
 //#endregion
-export { resolveOne as A, writeKeysPaced as B, matchKeyword as C, renderLogTailLines as D, readPtysize as E, snapshotStatus as F, hostId as G, TYPING_BADGE as H, stdinActivityPath as I, readInbox as J, listInboxParents as K, stopTipForCli as L, resolveResumeArgs as M, restartHintLines as N, renderRawLog as O, runSubcommand as P, notifyDir as Q, submitAndConfirm as R, listRecords as S, readNotes as T, appendEvent as U, writeToIpc as V, gcInboxes as W, daemonLockDir as X, shouldStealLock as Y, daemonLockOwnerPath as Z, isPidAlive as _, cmdHelp as a, isUserTyping as b, deriveLiveState as c, extractMenu as d, extractNeedsInput as f, isExitRequest as g, isAgentStuck as h, backoffWhileTyping as i, resolveReadWindow as j, renderRawLogLines as k, deriveLiveStatus as l, finalizedLines as m, READ_PAGE_DEFAULT as n, controlCodeFromName as o, extractTaskCounts as p, liveWatchers as q, TYPING_WINDOW_MS as r, cursorAbs as s, GRACEFUL_EXIT_COMMANDS as t, extractBadges as u, isSlashCommand as v, menuSelectKeys as w, lastStdinAt as x, isSubcommand as y, waitForLogQuiet as z };
-//# sourceMappingURL=subcommands-DjA3FgJk.js.map
+export { TYPING_BADGE as $, renderRawLogLines as A, waitForLogQuiet as B, matchKeyword as C, recentReadEdges as D, readPtysize as E, runSubcommand as F, hostId as G, writeToIpc as H, snapshotStatus as I, readInbox as J, listInboxParents as K, stdinActivityPath as L, resolveReadWindow as M, resolveResumeArgs as N, renderLogTailLines as O, restartHintLines as P, notifyDir as Q, stopTipForCli as R, listRecords as S, readNotes as T, appendEvent as U, writeKeysPaced as V, gcInboxes as W, daemonLockDir as X, shouldStealLock as Y, daemonLockOwnerPath as Z, isPidAlive as _, cmdHelp as a, isUserTyping as b, deriveLiveState as c, extractMenu as d, extractNeedsInput as f, isExitRequest as g, isAgentStuck as h, backoffWhileTyping as i, resolveOne as j, renderRawLog as k, deriveLiveStatus as l, finalizedLines as m, READ_PAGE_DEFAULT as n, controlCodeFromName as o, extractTaskCounts as p, liveWatchers as q, TYPING_WINDOW_MS as r, cursorAbs as s, GRACEFUL_EXIT_COMMANDS as t, extractBadges as u, isSlashCommand as v, menuSelectKeys as w, lastStdinAt as x, isSubcommand as y, submitAndConfirm as z };
+//# sourceMappingURL=subcommands-BbSJ_nTU.js.map