commandmate 0.26.0 → 0.27.0

package/dist/server/src/lib/push/failure-episode-state.js

@@ -0,0 +1,127 @@
+"use strict";
+/**
+ * The edge of an upstream-fault episode, and the one place it is observed
+ * (Issue #2000).
+ *
+ * ## Why an edge is needed at all
+ *
+ * `upstreamFault` is a **level**, not an event. `matchUpstreamFault` (#1839) is
+ * re-evaluated on every frame that is read, and the frame keeps the banner for
+ * as long as it is on screen — so "notify when a fault is visible" means
+ * "notify on every poll", which is the precise opposite of what Epic #2002 asks
+ * for. The signal has to be converted to an edge before it can ring a phone.
+ *
+ * ## Why not reuse `session/waiting-episode-state`
+ *
+ * #1786's store is the right *shape* and the wrong *store*. It is the single
+ * writer of the **waiting** edge, read by three surfaces (the status API, the
+ * WebSocket frame, the push notifier), and its episode identity is a boolean
+ * level per instance. An upstream fault differs on both counts:
+ *
+ *  - its identity includes **which** fault is on the frame, because a session
+ *    that goes from `retrying` to `limit-reached` has changed what the human
+ *    has to do about it;
+ *  - it has exactly one consumer (push), so nothing is gained by putting it on
+ *    a shared seam, and `observeWaitingEdge`'s listener fan-out would have to
+ *    grow a second event type to carry it.
+ *
+ * So this is a deliberate same-shape/second-store, and the shape is copied on
+ * purpose: one writer, `globalThis`-held (see the note below), a level in and
+ * an edge out, idempotent for an unchanged level.
+ *
+ * ## Why the edge alone is not enough: the cooldown
+ *
+ * The fault is judged on the **last 100 rows** of the pane, so a retry storm
+ * scrolls its own banner out of scope between polls. Measured shape of a 529
+ * storm (#1839): `API Error: Repeated 529 Overloaded errors …` followed by
+ * `Retrying in 34s · attempt 9/10`. Those match two different signatures
+ * (`overloaded` and `retrying`) and the agent keeps printing between them, so a
+ * pure open/close edge can legitimately fire many times for **one** incident —
+ * up to once per retry. That is a flood, and a flood is the thing this Epic
+ * exists to remove.
+ *
+ * The cooldown is therefore keyed on the **instance**, not on the fault id: the
+ * action a reader takes is the same for all four signatures ("go look at that
+ * session"), so telling them twice in ten minutes is not more informative, it
+ * is just louder. A genuinely separate incident later than
+ * {@link UPSTREAM_FAULT_COOLDOWN_MS} still rings.
+ *
+ * In-memory, like every other live-session state here: it describes a tmux pane
+ * and must not outlive the server that watched it.
+ *
+ * @module lib/push/failure-episode-state
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UPSTREAM_FAULT_COOLDOWN_MS = void 0;
+exports.observeUpstreamFaultEdge = observeUpstreamFaultEdge;
+exports.clearUpstreamFaultEpisodes = clearUpstreamFaultEpisodes;
+const auto_yes_state_1 = require("../../lib/auto-yes-state");
+/**
+ * How long after notifying about an upstream fault this instance stays quiet
+ * about upstream faults.
+ *
+ * 30 minutes is chosen against the two failure modes rather than against a
+ * cadence: shorter re-opens the retry-storm flood described above (a storm runs
+ * for minutes and re-matches throughout), and longer starts hiding incidents
+ * that really are new. An operator who wants the detail already has
+ * `capture --json`'s `upstreamFault` and the `[failure-push]` log lines; this
+ * bound only governs how often the *phone* is used.
+ */
+exports.UPSTREAM_FAULT_COOLDOWN_MS = 30 * 60_000;
+const states = globalThis.__upstreamFaultPushState ??
+    (globalThis.__upstreamFaultPushState = new Map());
+/**
+ * Record this frame's fault level and answer whether it is worth a phone.
+ *
+ * The single writer of this edge. Idempotent for an unchanged level: repeated
+ * frames carrying the same fault return `notify: false` with the episode's
+ * original `since`, so a caller may hand it every poll.
+ *
+ * Records the notification as it decides, exactly like `shouldSendWaitingPush`
+ * — so it must be called once per observation, and a caller that drops the
+ * notification afterwards has consumed the incident's one slot.
+ */
+function observeUpstreamFaultEdge({ worktreeId, cliToolId, instanceId, faultId, now = Date.now(), cooldownMs = exports.UPSTREAM_FAULT_COOLDOWN_MS, }) {
+    const key = (0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId);
+    const state = states.get(key);
+    if (faultId === null) {
+        // The episode closes, but `lastNotifiedAt` is kept: it is what stops the
+        // banner scrolling out of the window and straight back in from ringing
+        // twice. A state with nothing left to remember is dropped so an idle server
+        // does not accumulate one entry per session it ever polled.
+        if (state !== undefined) {
+            if (state.lastNotifiedAt === null)
+                states.delete(key);
+            else
+                state.current = null;
+        }
+        return { notify: false, reason: 'no-fault', since: null };
+    }
+    if (state !== undefined && state.current !== null && state.current.faultId === faultId) {
+        return { notify: false, reason: 'same-episode', since: state.current.since };
+    }
+    const lastNotifiedAt = state?.lastNotifiedAt ?? null;
+    const episode = { faultId, since: now };
+    if (lastNotifiedAt !== null && now - lastNotifiedAt < cooldownMs) {
+        // The episode is still opened — the level has to be tracked either way, or
+        // the next poll would read this same fault as new again.
+        states.set(key, { current: episode, lastNotifiedAt });
+        return {
+            notify: false,
+            reason: 'cooldown',
+            since: now,
+            cooldownRemainingMs: cooldownMs - (now - lastNotifiedAt),
+        };
+    }
+    states.set(key, { current: episode, lastNotifiedAt: now });
+    return { notify: true, reason: 'new-episode', since: now };
+}
+/**
+ * Drop every remembered fault. Test seam.
+ *
+ * CI runs with `fileParallelism: false`, so one process holds this map for the
+ * whole suite: a test that leaves a cooldown behind would mute the next file.
+ */
+function clearUpstreamFaultEpisodes() {
+    states.clear();
+}

package/dist/server/src/lib/push/failure-push-notifier.js

@@ -0,0 +1,344 @@
+"use strict";
+/**
+ * The one place a failure becomes a push notification (Issue #2000).
+ *
+ * Epic #2002 re-cut the notification axis from "what happened" to "do you have
+ * to act". Three failure signals already existed and none of them reached a
+ * phone; this module connects them, and it is the only module that decides
+ * whether a failure is worth ringing for:
+ *
+ * | signal              | producer                                   | shape  |
+ * |---------------------|--------------------------------------------|--------|
+ * | verification failed | `lib/verification/gate-runner`              | event  |
+ * | upstream API fault  | `lib/polling/response-checker` (#1839 match)| level  |
+ * | session start failed| `lib/cli-tools/base` (all 7 tools, #2009)   | event  |
+ *
+ * The shape column is the whole design. An **event** fires once by construction
+ * — a run closes once, a start attempt throws once — so its only guard is the
+ * existing 30 s content window in `push-sender`. A **level** is re-read on every
+ * poll and needs an edge built for it before it can be notified at all; that is
+ * `failure-episode-state`, and its docblock carries the reasoning and the
+ * measurement.
+ *
+ * ## Every decision is logged with a reason code
+ *
+ * A notification that never arrived is indistinguishable from a broken notifier
+ * from the outside (`docs/design/discoverability-principle.md`). So each call
+ * ends in exactly one `failure-push-raised` or `failure-push-suppressed` line
+ * carrying `reason`, the worktree and the instance. The single exception is
+ * `no-fault` — a clean frame — which is the outcome of most polls of most
+ * sessions and would drown the log it exists to make readable.
+ *
+ * ## Why none of this goes through `prompt-push-gate`
+ *
+ * #1999 mutes prompts that Auto-Yes is about to answer. No such claim can be
+ * made about a failure: Auto-Yes answers dialogs, it does not fix a failing
+ * gate, restore an upstream API or start a session that refused to start.
+ * Muting failures during Auto-Yes would silence exactly the pipelines that got
+ * stuck. The flood risk Auto-Yes creates is handled where it actually lives —
+ * per-incident edges here, and the contract-task exclusion below.
+ *
+ * Everything here is advisory and must never throw into its caller: the
+ * producers are a poller, a verification runner and a session starter, none of
+ * which may fail because a phone could not be reached.
+ *
+ * @module lib/push/failure-push-notifier
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.notifyVerificationFailurePush = notifyVerificationFailurePush;
+exports.notifyUpstreamFaultPush = notifyUpstreamFaultPush;
+exports.notifySessionStartFailurePush = notifySessionStartFailurePush;
+const db_instance_1 = require("../../lib/db/db-instance");
+const worktree_db_1 = require("../../lib/db/worktree-db");
+const logger_1 = require("../../lib/logger");
+const session_start_error_1 = require("../../lib/session/session-start-error");
+const failure_episode_state_1 = require("./failure-episode-state");
+const push_sender_1 = require("./push-sender");
+const vapid_1 = require("./vapid");
+const logger = (0, logger_1.createLogger)('push/failure-notifier');
+/**
+ * The worktree's display name, for the notification title.
+ *
+ * Falls back to the id rather than dropping the notification, exactly as
+ * `waiting-push-notifier` does: a database that cannot answer is a reason to
+ * send a less readable title, not a reason to leave a failure unreported.
+ */
+function resolveWorktreeName(worktreeId) {
+    try {
+        return (0, worktree_db_1.getWorktreeById)((0, db_instance_1.getDbInstance)(), worktreeId)?.name ?? worktreeId;
+    }
+    catch {
+        return worktreeId;
+    }
+}
+/**
+ * Fan one failure notification out, logging the decision. Never throws.
+ *
+ * Callers reach this only after their own edge/scope decision has said yes, so
+ * the only thing left to check here is whether push exists at all.
+ */
+async function raiseFailurePush(input) {
+    const context = {
+        worktreeId: input.worktreeId,
+        instanceId: input.instanceId,
+        failureReason: input.reason,
+        signature: input.signature,
+        ...input.logContext,
+    };
+    if (!(0, vapid_1.isPushConfigured)()) {
+        logger.debug('failure-push-suppressed', {
+            ...context,
+            reason: 'push-unconfigured',
+        });
+        return;
+    }
+    logger.info('failure-push-raised', context);
+    try {
+        await (0, push_sender_1.notifyPushSubscribers)({
+            worktreeId: input.worktreeId,
+            worktreeName: resolveWorktreeName(input.worktreeId),
+            kind: 'failure',
+            agentName: input.instanceId,
+            instanceId: input.instanceId,
+            excerpt: input.excerpt,
+            failure: { reason: input.reason, signature: input.signature },
+        });
+    }
+    catch (error) {
+        // `notifyPushSubscribers` already contains its own failures; this is the
+        // belt for a producer bug (a malformed event) that would otherwise reach a
+        // poller's catch and be reported as "no response found".
+        logger.warn('failure-push-failed', {
+            ...context,
+            error: error instanceof Error ? error.message : String(error),
+        });
+    }
+}
+/**
+ * Statuses that mean "your work was not shown to pass, and you have to do
+ * something about it".
+ *
+ * `not_started` is excluded because it is the work-evidence gate saying there
+ * was nothing to judge, and `cancelled` because somebody already knows. `error`
+ * IS included: an unusable `verify.yaml` or a runner that broke leaves the
+ * verdict just as absent as a red gate does, and the operator's next move is
+ * the same.
+ */
+const NOTIFIABLE_RUN_STATUSES = ['failed', 'error'];
+/**
+ * Notify about a verification run that did not pass — unless it judged a
+ * contract.
+ *
+ * ## The contract-task exclusion (adjudicated on Issue #2000)
+ *
+ * `/orchestrate` runs N workers in parallel and every one of them ends in a
+ * verification run. Ringing for each red one is N notifications about work a
+ * human deliberately delegated and is not watching gate-by-gate — the exact
+ * collision with Epic #2002 that the adjudication names. So the audience test
+ * is "was this run about an execution contract".
+ *
+ * ### The discriminator is the RESOLVED task, not `payload.taskId`
+ *
+ * The Issue's draft reading was that the API's `payload.taskId` separates them,
+ * because `commandmate verify` does not send one. Measured, that is not
+ * sufficient: `startVerification` calls `resolveTask`, which falls back to
+ * `getVerifiableTask(worktreeId)` (#1545) whenever no `taskId` was named — so a
+ * worker's `wait --verify` that happened not to bind a task id still attaches to
+ * the worktree's own contract. Keying on `input.taskId` would have let exactly
+ * the runs the adjudication excludes through. The resolved `taskId` written on
+ * the run row is the fact that says whether a contract was judged, so that is
+ * what is read here.
+ */
+async function notifyVerificationFailurePush(input) {
+    const instanceId = input.instanceId ?? undefined;
+    const context = {
+        worktreeId: input.worktreeId,
+        instanceId,
+        runId: input.runId,
+        status: input.status,
+        trigger: input.trigger,
+    };
+    if (!NOTIFIABLE_RUN_STATUSES.includes(input.status)) {
+        logger.debug('failure-push-suppressed', {
+            ...context,
+            reason: 'run-not-failed',
+        });
+        return;
+    }
+    if (input.taskId !== null) {
+        logger.info('failure-push-suppressed', {
+            ...context,
+            taskId: input.taskId,
+            reason: 'contract-task',
+        });
+        return;
+    }
+    const failed = input.failedGateIds ?? [];
+    await raiseFailurePush({
+        reason: 'verification-failed',
+        worktreeId: input.worktreeId,
+        instanceId,
+        // The run id, so two runs of the same worktree are two incidents even when
+        // the same gates fail with the same wording inside the 30 s window.
+        signature: `verification:${input.runId}`,
+        excerpt: failed.length > 0 ? failed.join(', ') : undefined,
+        logContext: { runId: input.runId, status: input.status, trigger: input.trigger },
+    });
+}
+/**
+ * Observe this frame's upstream-fault level and notify on a new incident.
+ *
+ * Safe to call on every poll — that is what it is for. The edge and the
+ * cooldown live in `failure-episode-state`; this function is the logging and
+ * fan-out half.
+ */
+async function notifyUpstreamFaultPush(input) {
+    // Checked before the edge, not after, so an install without VAPID keys is
+    // inert rather than merely quiet — no episode map, no cooldown state, nothing
+    // to go stale. `waiting-push-notifier` takes the same position for the same
+    // reason. The other two producers are event-shaped and check inside
+    // `raiseFailurePush`, where the decision is worth a log line.
+    if (!(0, vapid_1.isPushConfigured)())
+        return;
+    const instanceId = input.instanceId ?? input.cliToolId;
+    const edge = (0, failure_episode_state_1.observeUpstreamFaultEdge)({
+        worktreeId: input.worktreeId,
+        cliToolId: input.cliToolId,
+        instanceId: input.instanceId,
+        faultId: input.faultId,
+        now: input.now,
+    });
+    if (edge.reason === 'no-fault')
+        return;
+    if (!edge.notify) {
+        const reason = edge.reason === 'cooldown' ? 'upstream-cooldown' : 'upstream-same-episode';
+        // `same-episode` at debug, `cooldown` at info: the first is the ordinary
+        // steady state of a fault that is still on screen (once per poll), the
+        // second is the one an operator asks about — "it is broken again and my
+        // phone said nothing".
+        const line = {
+            worktreeId: input.worktreeId,
+            cliToolId: input.cliToolId,
+            instanceId,
+            faultId: input.faultId,
+            since: edge.since,
+            reason,
+            ...(edge.cooldownRemainingMs !== undefined
+                ? { cooldownRemainingMs: edge.cooldownRemainingMs }
+                : {}),
+        };
+        if (edge.reason === 'cooldown')
+            logger.info('failure-push-suppressed', line);
+        else
+            logger.debug('failure-push-suppressed', line);
+        return;
+    }
+    await raiseFailurePush({
+        reason: 'upstream-fault',
+        worktreeId: input.worktreeId,
+        instanceId,
+        // The episode's own start, so a genuinely new incident past the cooldown is
+        // a different signature even when the same banner text comes back.
+        signature: `upstream:${input.faultId}:${edge.since}`,
+        excerpt: input.matchedText,
+        logContext: { cliToolId: input.cliToolId, faultId: input.faultId, since: edge.since },
+    });
+}
+/**
+ * Decide what a session-start failure is, from the error alone.
+ *
+ * ## The excerpt never carries captured output
+ *
+ * A notification body leaves this machine. `SessionStartFailedError` is the one
+ * shape whose detail may be quoted, and it earns that by construction: its
+ * `detectedPattern` is a fixed string from `cli-patterns.ts` that this
+ * repository authored, never anything the CLI printed (`session-start-error`
+ * spells the argument out). Every other shape — a bare `Error` from a tool's own
+ * launch path, whose message interpolates raw tmux/CLI text — contributes only
+ * the tool NAME, which is the fact the Issue's acceptance asks the body to
+ * carry.
+ *
+ * @param input - The failure, as reported by the seam
+ * @param instanceId - Resolved instance id; part of every signature
+ */
+function classifySessionStartFailure(input, instanceId) {
+    // #1637: the session and its process are both alive and still initializing.
+    // Notifying here would be the "nothing needs repairing" case ringing a phone.
+    if ((0, session_start_error_1.isSessionStartTimeoutError)(input.error)) {
+        return { notify: false, reason: 'session-still-starting' };
+    }
+    if ((0, session_start_error_1.isSessionStartUnavailableError)(input.error)) {
+        return {
+            notify: true,
+            reason: 'session-start-unavailable',
+            // Just the name: the dictionary supplies "is not installed" in the
+            // reader's language, which an English error message could not.
+            excerpt: input.toolName,
+            // Not the message — copilot's carries an install hint that would make two
+            // attempts at the same missing binary look like two incidents.
+            signature: `session-start:${instanceId}:not-installed`,
+        };
+    }
+    if (readErrorCode(input.error) === session_start_error_1.SESSION_START_FAILED_CODE) {
+        const detectedPattern = input.error.detectedPattern;
+        const pattern = typeof detectedPattern === 'string' ? detectedPattern : '';
+        return {
+            notify: true,
+            reason: 'session-start-failed',
+            excerpt: pattern ? `${input.toolName}: ${pattern}` : input.toolName,
+            // Unchanged from #2000, so a claude start that keeps hitting the same
+            // pattern still collapses to one notification exactly as it did.
+            signature: `session-start:${instanceId}:${pattern}`,
+        };
+    }
+    return {
+        notify: true,
+        reason: 'session-start-failed',
+        excerpt: input.toolName,
+        signature: `session-start:${instanceId}:start-error`,
+    };
+}
+function readErrorCode(error) {
+    if (typeof error !== 'object' || error === null)
+        return undefined;
+    const code = error.code;
+    return typeof code === 'string' ? code : undefined;
+}
+/**
+ * Notify that a CLI session could not be started. Never throws.
+ *
+ * Called from exactly one place — `BaseCLITool.startSession`, the method all
+ * seven tools inherit (Issue #2009). Before that it was called from
+ * `claude-session`'s throw site, which is why six of the seven agents failed
+ * silently: the other six never had a line to call it from.
+ *
+ * No edge of its own, and deliberately: this is raised from a `throw`, so its
+ * rate is bounded by how often something asks to start the session rather than
+ * by a poll interval. The 30 s content window in `push-sender` collapses the
+ * burst a retrying caller produces; a human who retries minutes later gets a
+ * second notification, which is correct — that is a second failed attempt.
+ */
+async function notifySessionStartFailurePush(input) {
+    const instanceId = input.instanceId ?? input.cliToolId;
+    const verdict = classifySessionStartFailure(input, instanceId);
+    if (!verdict.notify) {
+        // At info, not debug: "the agent did not come up and my phone said nothing"
+        // is a question an operator actually asks, and this is the line that answers
+        // it. It is once per start attempt, not once per poll, so it cannot flood.
+        logger.info('failure-push-suppressed', {
+            worktreeId: input.worktreeId,
+            instanceId,
+            cliToolId: input.cliToolId,
+            reason: verdict.reason,
+        });
+        return;
+    }
+    await raiseFailurePush({
+        reason: verdict.reason,
+        worktreeId: input.worktreeId,
+        instanceId,
+        signature: verdict.signature,
+        excerpt: verdict.excerpt,
+        logContext: { cliToolId: input.cliToolId },
+    });
+}

package/dist/server/src/lib/push/index.js

@@ -1,7 +1,7 @@
 "use strict";
 /** Web Push module barrel (Issue #1125). */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MAX_ESCALATION_THRESHOLD_MINUTES = exports.MIN_ESCALATION_THRESHOLD_MINUTES = exports.ESCALATION_SETTINGS_KEY = exports.ESCALATION_THRESHOLD_CHOICES = exports.DEFAULT_ESCALATION_SETTINGS = exports.normalizeEscalationSettings = exports.setPushEscalationSettings = exports.getPushEscalationSettings = exports.ESCALATION_TICK_MS = exports.pendingEscalationCount = exports.runEscalationTick = exports.handleWaitingTransition = exports.isWaitingPushNotifierActive = exports.stopWaitingPushNotifier = exports.startWaitingPushNotifier = exports.resetWaitingPushDedup = exports.shouldSendWaitingPush = exports.DEFAULT_DEDUP_WINDOW_MS = exports.resetNotificationDedup = exports.shouldSendNotification = exports.resolvePushLocale = exports.buildExcerpt = exports.buildPushPayload = exports.notifyPushSubscribers = exports.getVapidPublicKey = exports.isPushConfigured = exports.getVapidConfig = void 0;
+exports.promptCardCount = exports.clearAllPromptCards = exports.clearPromptCard = exports.hasPromptCard = exports.markPromptCardShown = exports.MIN_DEVICES_FOR_CROSS_DEVICE_CLEAR = exports.notifyPromptResolved = exports.decidePromptResolution = exports.MAX_ESCALATION_THRESHOLD_MINUTES = exports.MIN_ESCALATION_THRESHOLD_MINUTES = exports.ESCALATION_SETTINGS_KEY = exports.ESCALATION_THRESHOLD_CHOICES = exports.DEFAULT_ESCALATION_SETTINGS = exports.normalizeEscalationSettings = exports.setPushEscalationSettings = exports.getPushEscalationSettings = exports.ESCALATION_TICK_MS = exports.pendingEscalationCount = exports.runEscalationTick = exports.handleWaitingTransition = exports.isWaitingPushNotifierActive = exports.stopWaitingPushNotifier = exports.startWaitingPushNotifier = exports.UPSTREAM_FAULT_COOLDOWN_MS = exports.clearUpstreamFaultEpisodes = exports.observeUpstreamFaultEdge = exports.notifySessionStartFailurePush = exports.notifyUpstreamFaultPush = exports.notifyVerificationFailurePush = exports.isPromptPushSuppressed = exports.decidePromptPush = exports.resetWaitingPushDedup = exports.shouldSendWaitingPush = exports.DEFAULT_DEDUP_WINDOW_MS = exports.resetNotificationDedup = exports.shouldSendNotification = exports.resolvePushLocale = exports.buildExcerpt = exports.buildPushPayload = exports.notifyPushSubscribers = exports.getVapidPublicKey = exports.isPushConfigured = exports.getVapidConfig = void 0;
 var vapid_1 = require("./vapid");
 Object.defineProperty(exports, "getVapidConfig", { enumerable: true, get: function () { return vapid_1.getVapidConfig; } });
 Object.defineProperty(exports, "isPushConfigured", { enumerable: true, get: function () { return vapid_1.isPushConfigured; } });
@@ -17,6 +17,26 @@ Object.defineProperty(exports, "resetNotificationDedup", { enumerable: true, get
 Object.defineProperty(exports, "DEFAULT_DEDUP_WINDOW_MS", { enumerable: true, get: function () { return notification_dedup_1.DEFAULT_DEDUP_WINDOW_MS; } });
 Object.defineProperty(exports, "shouldSendWaitingPush", { enumerable: true, get: function () { return notification_dedup_1.shouldSendWaitingPush; } });
 Object.defineProperty(exports, "resetWaitingPushDedup", { enumerable: true, get: function () { return notification_dedup_1.resetWaitingPushDedup; } });
+// Whether a prompt wait is worth notifying about at all (Issue #1999).
+// NOTE: the two producers import this from './prompt-push-gate' directly. A
+// suite that stubs the whole '@/lib/push' barrel would otherwise leave the gate
+// undefined on the path it guards.
+var prompt_push_gate_1 = require("./prompt-push-gate");
+Object.defineProperty(exports, "decidePromptPush", { enumerable: true, get: function () { return prompt_push_gate_1.decidePromptPush; } });
+Object.defineProperty(exports, "isPromptPushSuppressed", { enumerable: true, get: function () { return prompt_push_gate_1.isPromptPushSuppressed; } });
+// Failure notifications (Issue #2000).
+// NOTE: the producers import these from './failure-push-notifier' directly, for
+// the reason the prompt gate above gives — a suite that stubs the whole
+// '@/lib/push' barrel would otherwise leave the notifier undefined on the very
+// path it guards.
+var failure_push_notifier_1 = require("./failure-push-notifier");
+Object.defineProperty(exports, "notifyVerificationFailurePush", { enumerable: true, get: function () { return failure_push_notifier_1.notifyVerificationFailurePush; } });
+Object.defineProperty(exports, "notifyUpstreamFaultPush", { enumerable: true, get: function () { return failure_push_notifier_1.notifyUpstreamFaultPush; } });
+Object.defineProperty(exports, "notifySessionStartFailurePush", { enumerable: true, get: function () { return failure_push_notifier_1.notifySessionStartFailurePush; } });
+var failure_episode_state_1 = require("./failure-episode-state");
+Object.defineProperty(exports, "observeUpstreamFaultEdge", { enumerable: true, get: function () { return failure_episode_state_1.observeUpstreamFaultEdge; } });
+Object.defineProperty(exports, "clearUpstreamFaultEpisodes", { enumerable: true, get: function () { return failure_episode_state_1.clearUpstreamFaultEpisodes; } });
+Object.defineProperty(exports, "UPSTREAM_FAULT_COOLDOWN_MS", { enumerable: true, get: function () { return failure_episode_state_1.UPSTREAM_FAULT_COOLDOWN_MS; } });
 // Waiting-edge driven notifications (Issue #1790).
 var waiting_push_notifier_1 = require("./waiting-push-notifier");
 Object.defineProperty(exports, "startWaitingPushNotifier", { enumerable: true, get: function () { return waiting_push_notifier_1.startWaitingPushNotifier; } });
@@ -35,3 +55,17 @@ Object.defineProperty(exports, "ESCALATION_THRESHOLD_CHOICES", { enumerable: tru
 Object.defineProperty(exports, "ESCALATION_SETTINGS_KEY", { enumerable: true, get: function () { return escalation_settings_1.ESCALATION_SETTINGS_KEY; } });
 Object.defineProperty(exports, "MIN_ESCALATION_THRESHOLD_MINUTES", { enumerable: true, get: function () { return escalation_settings_1.MIN_ESCALATION_THRESHOLD_MINUTES; } });
 Object.defineProperty(exports, "MAX_ESCALATION_THRESHOLD_MINUTES", { enumerable: true, get: function () { return escalation_settings_1.MAX_ESCALATION_THRESHOLD_MINUTES; } });
+// Cross-device dismissal of a resolved wait (Issue #2001).
+// NOTE: `waiting-push-notifier` reaches the notifier through its own module
+// path, for the reason the two blocks above give — a suite that stubs the whole
+// '@/lib/push' barrel would otherwise leave the closing edge inert.
+var resolution_push_notifier_1 = require("./resolution-push-notifier");
+Object.defineProperty(exports, "decidePromptResolution", { enumerable: true, get: function () { return resolution_push_notifier_1.decidePromptResolution; } });
+Object.defineProperty(exports, "notifyPromptResolved", { enumerable: true, get: function () { return resolution_push_notifier_1.notifyPromptResolved; } });
+Object.defineProperty(exports, "MIN_DEVICES_FOR_CROSS_DEVICE_CLEAR", { enumerable: true, get: function () { return resolution_push_notifier_1.MIN_DEVICES_FOR_CROSS_DEVICE_CLEAR; } });
+var prompt_card_state_1 = require("./prompt-card-state");
+Object.defineProperty(exports, "markPromptCardShown", { enumerable: true, get: function () { return prompt_card_state_1.markPromptCardShown; } });
+Object.defineProperty(exports, "hasPromptCard", { enumerable: true, get: function () { return prompt_card_state_1.hasPromptCard; } });
+Object.defineProperty(exports, "clearPromptCard", { enumerable: true, get: function () { return prompt_card_state_1.clearPromptCard; } });
+Object.defineProperty(exports, "clearAllPromptCards", { enumerable: true, get: function () { return prompt_card_state_1.clearAllPromptCards; } });
+Object.defineProperty(exports, "promptCardCount", { enumerable: true, get: function () { return prompt_card_state_1.promptCardCount; } });

package/dist/server/src/lib/push/prompt-card-state.js

@@ -0,0 +1,93 @@
+"use strict";
+/**
+ * Which worktrees currently have a prompt notification card sitting on a
+ * subscriber's phone (Issue #2001).
+ *
+ * ## Why this has to exist at all
+ *
+ * The cross-device dismissal costs one extra push per resolved wait, and Epic
+ * #2002 exists to make the phone quieter — #1999 removed the Auto-Yes prompts
+ * and #2000 narrowed the default kinds. A resolution push sent for a wait that
+ * never rang would hand a chunk of that back for nothing. So the resolution is
+ * conditional on a card actually being out there, and something has to know.
+ *
+ * Nothing already did. `notification-dedup` remembers which *episode* was
+ * notified, keyed per instance, and it never forgets — it is a "have I said
+ * this already" store, not a "is it still on screen" one. The card is a
+ * different object: it is keyed by **worktree**, because that is the shape of
+ * the Service Worker `tag` (`<worktreeId>:prompt`, built in `push-sender`), so
+ * two instances waiting in one worktree leave exactly one card, and the second
+ * instance's notification replaces the first one's rather than stacking.
+ *
+ * ## Where it is written
+ *
+ * Marked in `notifyPushSubscribers`, past the point where the fan-out knows a
+ * payload is really going to at least one device — so a dedup drop, a missing
+ * VAPID config or an empty subscription table records nothing, and the
+ * resolution for that wait is correctly skipped. Cleared by
+ * `resolution-push-notifier` when the wait closes, whether or not it decided to
+ * send. There is exactly one writer per direction.
+ *
+ * ## Accuracy, and what it deliberately does not model
+ *
+ * This tracks what the *server* sent, not what each device still displays. A
+ * reader who taps or swipes the card away on one phone has closed it there and
+ * the server cannot know. That is the residual imprecision documented in
+ * `docs/design/cross-device-notification-dismissal.md`: on such a device the
+ * resolution arrives as a new (silent, accurate) card instead of replacing one.
+ * Modelling per-device state would need the devices to report back, which is a
+ * round trip per notification for a card that costs nothing to replace.
+ *
+ * In-memory via `globalThis`, like every other live-session store here (see the
+ * note in `agent-event-state` for the `next dev` bundling reason). One entry
+ * per worktree that has an outstanding card, so the map is bounded by the
+ * number of worktrees, and each entry is removed when its wait closes.
+ *
+ * @module lib/push/prompt-card-state
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.markPromptCardShown = markPromptCardShown;
+exports.hasPromptCard = hasPromptCard;
+exports.clearPromptCard = clearPromptCard;
+exports.clearAllPromptCards = clearAllPromptCards;
+exports.promptCardCount = promptCardCount;
+/** worktreeId -> epoch ms the most recent prompt card was fanned out. */
+const cards = globalThis.__promptPushCards ??
+    (globalThis.__promptPushCards = new Map());
+/**
+ * Record that a prompt notification for this worktree has left the server.
+ *
+ * Idempotent by overwrite: a second prompt in the same worktree (another
+ * instance, or the #1790 reminder) replaces the same card on the device, so it
+ * refreshes the timestamp rather than adding an entry.
+ */
+function markPromptCardShown(worktreeId, at = Date.now()) {
+    cards.set(worktreeId, at);
+}
+/** Whether a prompt card for this worktree was fanned out and not yet cleared. */
+function hasPromptCard(worktreeId) {
+    return cards.has(worktreeId);
+}
+/**
+ * Forget this worktree's card.
+ *
+ * @returns True when there was one to forget — the caller uses it to tell "the
+ *   wait is over and we cleared it" from "the wait is over and it never rang".
+ */
+function clearPromptCard(worktreeId) {
+    return cards.delete(worktreeId);
+}
+/**
+ * Drop every remembered card. Test seam.
+ *
+ * CI runs with `fileParallelism: false`, so one process holds this map for the
+ * whole suite: a card left behind would make the next file's first resolution
+ * decide `cross-device-clear` when its own fixture never sent a prompt.
+ */
+function clearAllPromptCards() {
+    cards.clear();
+}
+/** How many worktrees have an outstanding card. Test seam. */
+function promptCardCount() {
+    return cards.size;
+}