commandmate 0.26.1 → 0.27.0

package/dist/server/src/lib/push/prompt-push-gate.js

@@ -0,0 +1,130 @@
+"use strict";
+/**
+ * Whether a prompt push notification still describes something a human has to
+ * do (Issue #1999).
+ *
+ * Auto-Yes is a standing declaration that this session's prompts get answered
+ * without a human, so a phone that buzzes for every one of them tells the
+ * reader the opposite of the truth: by the time the notification is opened the
+ * answer has already been sent. During a parallel orchestration — several
+ * workers all running under Auto-Yes — that is most of the traffic, which is
+ * what makes the phone unusable rather than merely noisy.
+ *
+ * ## Why the gate is here and not inside `notifyPushSubscribers`
+ *
+ * `NotificationEvent` carries `instanceId` but no `cliToolId`, and every
+ * Auto-Yes lookup is keyed by `buildCompositeKey(worktreeId, cliToolId,
+ * instanceId)`. An alias instance (`claude-2`) does not name its tool, so the
+ * tool cannot be recovered from the event — the fan-out does not hold enough to
+ * ask the question with. Both producers do, so the gate runs there.
+ *
+ * It also has to run *before* the fan-out for a second, independent reason:
+ * `shouldSendWaitingPush` records the episode at the moment it decides to send
+ * (`notification-dedup`), so a notification dropped after that call would still
+ * consume the episode's one slot and take the escalation reminder down with it.
+ *
+ * ## What still notifies
+ *
+ * Everything that is not "Auto-Yes will deal with this in a moment":
+ *
+ *  - **No Auto-Yes, or Auto-Yes off.** `getAutoYesState` collapses every stop
+ *    into `enabled === false`: it calls `disableAutoYes(…, 'expired', …)` on an
+ *    expired state before returning it, and `disableAutoYes` writes
+ *    `enabled: false` for `stop_pattern_matched` and `consecutive_errors`
+ *    alike. One `enabled` read therefore covers all four rows of the Issue's
+ *    table, and a stop reason nobody remembered to enumerate here fails towards
+ *    notifying rather than towards silence.
+ *  - **The contract policy withheld the answer** (#1547 / #1684). Auto-Yes is
+ *    on but has decided *not* to answer this prompt, so nothing moves until a
+ *    human acts.
+ *  - **The escalation reminder** (#1790). See below.
+ *
+ * ## Which suppression record belongs to which wait
+ *
+ * `getLastPolicySuppression` keeps the *last* withheld answer per session and
+ * never clears it, so the record outlives the wait it was about. #1684 defines
+ * the reading: a record is the reason the session is stopped right now when its
+ * `at` lines up with the current wait. Here that is `at >= waitingSince` — the
+ * suppression was recorded at or after this episode opened. A record from an
+ * earlier episode is older than `since` and is ignored.
+ *
+ * The poller re-evaluates a suppressed prompt on every poll (the duplicate
+ * guard only remembers *answered* prompts), so `at` stays current for as long
+ * as the prompt is on screen. At the opening edge the record may not exist yet
+ * — the poller writes it on its own interval — and the wait is then treated as
+ * one Auto-Yes is about to answer. That is deliberate: it is the common case,
+ * it resolves in seconds, and the reminder below is what catches it when it
+ * does not.
+ *
+ * ## The reminder is never muted
+ *
+ * `runEscalationTick` has already established that the wait is still open — it
+ * re-reads `getWaitingEpisode` and drops anything Auto-Yes answered — so a wait
+ * that reaches the threshold is one Auto-Yes did not resolve after ten minutes
+ * of re-evaluating it every couple of seconds. The suppression record cannot be
+ * relied on to explain why: a prompt the resolver has no answer for (free text,
+ * or a type it does not recognise) returns `suppressedBy: null`, so nothing is
+ * recorded and that stall is invisible to the check above. Muting the reminder
+ * as well would make Auto-Yes a permanent mute for exactly the pipelines that
+ * got stuck.
+ *
+ * @module lib/push/prompt-push-gate
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decidePromptPush = decidePromptPush;
+exports.isPromptPushSuppressed = isPromptPushSuppressed;
+const auto_yes_state_1 = require("../../lib/auto-yes-state");
+const logger_1 = require("../../lib/logger");
+const auto_yes_suppression_state_1 = require("../../lib/polling/auto-yes-suppression-state");
+const logger = (0, logger_1.createLogger)('push/prompt-gate');
+/**
+ * Decide whether this prompt notification is worth a human's attention.
+ *
+ * Reads Auto-Yes state and the policy-suppression record; writes neither.
+ * Separated from {@link isPromptPushSuppressed} so a test can assert the reason
+ * rather than only the outcome.
+ */
+function decidePromptPush(input) {
+    const { worktreeId, cliToolId, instanceId, waitingSince } = input;
+    const state = (0, auto_yes_state_1.getAutoYesState)(worktreeId, cliToolId, instanceId);
+    if (state === null || !state.enabled) {
+        return { suppress: false, reason: 'auto-yes-inactive', stopReason: state?.stopReason };
+    }
+    const suppression = (0, auto_yes_suppression_state_1.getLastPolicySuppression)(worktreeId, cliToolId, instanceId);
+    if (suppression !== null && suppression.at >= waitingSince) {
+        return { suppress: false, reason: 'policy-withheld', suppressedBy: suppression.reason };
+    }
+    if (input.escalated === true) {
+        return { suppress: false, reason: 'escalation-reminder' };
+    }
+    return { suppress: true, reason: 'auto-yes-answering' };
+}
+/**
+ * {@link decidePromptPush}, logged.
+ *
+ * The single call both prompt-push producers make. A suppression is logged at
+ * `info` because a notification that never arrived is indistinguishable from a
+ * broken notifier from the outside, and the operator needs the worktree, the
+ * instance, the wait and the reason to tell them apart
+ * (`docs/design/discoverability-principle.md`). The notifying decisions are
+ * logged at `debug`: they end in a notification the operator can already see,
+ * so the line is only there for the "why did this one ring?" question.
+ */
+function isPromptPushSuppressed(input) {
+    const decision = decidePromptPush(input);
+    const context = {
+        worktreeId: input.worktreeId,
+        cliToolId: input.cliToolId,
+        instanceId: input.instanceId ?? input.cliToolId,
+        waitingSince: input.waitingSince,
+        escalated: input.escalated === true,
+        reason: decision.reason,
+        ...(decision.stopReason !== undefined ? { stopReason: decision.stopReason } : {}),
+        ...(decision.suppressedBy !== undefined ? { suppressedBy: decision.suppressedBy } : {}),
+    };
+    if (decision.suppress)
+        logger.info('prompt-push-suppressed', context);
+    else
+        logger.debug('prompt-push-allowed', context);
+    return decision.suppress;
+}

package/dist/server/src/lib/push/push-sender.js

@@ -2,8 +2,9 @@
 /**
  * Web Push fan-out (Issue #1125).
  *
- * Thin layer over detection: given an agent event (prompt-waiting / completion),
- * fan out a minimal notification to every opted-in subscription. Expired
+ * Thin layer over detection: given an agent event (prompt-waiting / completion /
+ * failure, Issue #2000), fan out a minimal notification to every opted-in
+ * subscription. Expired
  * endpoints (404/410 Gone) are auto-removed. This module NEVER logs endpoints or
  * VAPID secrets.
  *
@@ -38,6 +39,7 @@ const notifications_json_1 = __importDefault(require("../../../locales/en/notifi
 const notifications_json_2 = __importDefault(require("../../../locales/ja/notifications.json"));
 const vapid_1 = require("./vapid");
 const notification_dedup_1 = require("./notification-dedup");
+const prompt_card_state_1 = require("./prompt-card-state");
 const logger = (0, logger_1.createLogger)('push/sender');
 const MAX_EXCERPT_LENGTH = 120;
 /** The notification bodies, per locale. Keyed by SupportedLocale so a new locale
@@ -94,6 +96,46 @@ function buildWaitingBody(event, messages, excerpt, now) {
         ? messages.promptWaitingWithExcerpt.replace('{excerpt}', excerpt)
         : messages.promptWaiting;
 }
+/**
+ * The body for a failure notification, in the reader's language (Issue #2000).
+ *
+ * Every wording names the failure explicitly ("不合格" / "failed", "障害" /
+ * "fault", "起動できません" / "could not start") so the acceptance criterion —
+ * a reader tells success from failure from the body alone — holds without
+ * having to open the app. A `reason` nobody added copy for would be a type
+ * error at {@link FAILURE_BODY_KEYS}, not a blank notification.
+ */
+const FAILURE_BODY_KEYS = {
+    'verification-failed': {
+        withExcerpt: 'failureVerificationWithExcerpt',
+        plain: 'failureVerification',
+    },
+    'upstream-fault': {
+        withExcerpt: 'failureUpstreamWithExcerpt',
+        plain: 'failureUpstream',
+    },
+    'session-start-failed': {
+        withExcerpt: 'failureSessionStartWithExcerpt',
+        plain: 'failureSessionStart',
+    },
+    'session-start-unavailable': {
+        withExcerpt: 'failureSessionUnavailableWithExcerpt',
+        plain: 'failureSessionUnavailable',
+    },
+};
+function buildFailureBody(event, messages, excerpt) {
+    // An event that claims `kind: 'failure'` without saying which failure is a
+    // producer bug. Falling back to the verification wording would misreport it,
+    // so the generic "something failed" copy is used instead.
+    const reason = event.failure?.reason;
+    if (reason === undefined) {
+        return excerpt ? messages.failureWithExcerpt.replace('{excerpt}', excerpt) : messages.failure;
+    }
+    const keys = FAILURE_BODY_KEYS[reason];
+    return excerpt
+        ? messages[keys.withExcerpt].replace('{excerpt}', excerpt)
+        : messages[keys.plain];
+}
 /** Build the minimal notification payload for an event, in the reader's language. */
 function buildPushPayload(event, locale = i18n_config_1.DEFAULT_LOCALE, now = Date.now()) {
     const excerpt = buildExcerpt(event.excerpt);
@@ -101,10 +143,17 @@ function buildPushPayload(event, locale = i18n_config_1.DEFAULT_LOCALE, now = Da
     const title = `${event.worktreeName}${agentSuffix}`;
     const messages = PUSH_MESSAGES[resolvePushLocale(locale)];
     const body = event.kind === 'prompt'
-        ? buildWaitingBody(event, messages, excerpt, now)
-        : excerpt
-            ? messages.completionWithExcerpt.replace('{excerpt}', excerpt)
-            : messages.completion;
+        ? // Issue #2001: the resolution's body replaces the stale card's, so it
+            // has to answer the question that card asked. It quotes no excerpt —
+            // the prompt is over, and repeating it would read as a new one.
+            event.resolved === true
+                ? messages.promptResolved
+                : buildWaitingBody(event, messages, excerpt, now)
+        : event.kind === 'failure'
+            ? buildFailureBody(event, messages, excerpt)
+            : excerpt
+                ? messages.completionWithExcerpt.replace('{excerpt}', excerpt)
+                : messages.completion;
     return {
         kind: event.kind,
         title,
@@ -117,6 +166,7 @@ function buildPushPayload(event, locale = i18n_config_1.DEFAULT_LOCALE, now = Da
         tag: `${event.worktreeId}:${event.kind}`,
         timestamp: now,
         ...(event.waitingKind ? { waitingKind: event.waitingKind } : {}),
+        ...(event.resolved === true ? { resolved: true } : {}),
     };
 }
 async function sendToOne(sub, payload) {
@@ -141,8 +191,23 @@ async function sendToOne(sub, payload) {
  * everything else — every completion, and any prompt event that predates the
  * episode store — keeps the content hash and its 30 s window. Both record as
  * they decide, so this must be called exactly once per event.
+ *
+ * Issue #2000: a failure hashes its {@link FailureContext.signature} instead of
+ * its excerpt. The producers already collapse a failure to one notification per
+ * incident (`failure-push-notifier`), so this is the second net rather than the
+ * first — but the excerpt is the wrong key for it either way: a retry storm
+ * prints a different attempt counter every few seconds, which would defeat a
+ * content hash, while two *distinct* incidents can share a line of prose.
  */
 function passesDedup(event) {
+    // Issue #2001: a resolution is guarded by the card state instead, which is
+    // exact — `resolution-push-notifier` clears the mark as it sends, so a second
+    // resolution for the same card decides `no-card` and never reaches here.
+    // Running the content hash for it would be worse than redundant: its key is
+    // `${worktreeId}:prompt`, the same slot a legacy (pre-#1790) prompt event
+    // uses, so the two would suppress each other on a 30 s window neither wants.
+    if (event.resolved === true)
+        return true;
     if (event.kind === 'prompt' && typeof event.waitingSince === 'number') {
         return (0, notification_dedup_1.shouldSendWaitingPush)({
             worktreeId: event.worktreeId,
@@ -154,7 +219,7 @@ function passesDedup(event) {
     return (0, notification_dedup_1.shouldSendNotification)({
         worktreeId: event.worktreeId,
         kind: event.kind,
-        content: event.excerpt,
+        content: event.kind === 'failure' ? event.failure?.signature : event.excerpt,
     });
 }
 /**
@@ -178,6 +243,16 @@ async function notifyPushSubscribers(event, now = Date.now()) {
         const subscriptions = (0, push_subscriptions_db_1.getPushSubscriptionsForKind)(db, event.kind);
         if (subscriptions.length === 0)
             return;
+        // Issue #2001: this is the only line in the process that knows a prompt card
+        // is really going to reach a device — past the VAPID check, past the dedup,
+        // past an empty subscription table. Recording it anywhere earlier would tell
+        // `resolution-push-notifier` to clear cards that were never shown, which is
+        // exactly the extra push Epic #2002 is trying not to spend. The resolution
+        // itself does not mark; it clears, and it does so in its own module so each
+        // direction has one writer.
+        if (event.kind === 'prompt' && event.resolved !== true) {
+            (0, prompt_card_state_1.markPromptCardShown)(event.worktreeId, now);
+        }
         web_push_1.default.setVapidDetails(config.subject, config.publicKey, config.privateKey);
         // Devices can be registered in different languages, so the body is built per
         // distinct locale rather than once for the whole fan-out.

package/dist/server/src/lib/push/resolution-push-notifier.js

@@ -0,0 +1,193 @@
+"use strict";
+/**
+ * Clear the notification a resolved wait left on the reader's *other* devices
+ * (Issue #2001).
+ *
+ * A prompt notification fans out to every subscribed device, and each device's
+ * copy is its own object: the `tag` (`<worktreeId>:prompt`) collapses cards
+ * *within* one device, and `notificationclick`'s `close()` closes the card on
+ * the phone that was tapped. FCM and APNs hold no cross-device state. So a
+ * reader with an iPhone and an Android answers on one and the other keeps a
+ * card that is now a lie — and the longer Epic #2002 succeeds at only notifying
+ * when something needs doing, the more misleading a stale "needs doing" card is.
+ *
+ * The only channel that reaches the other device is another push. This module
+ * decides whether to spend one.
+ *
+ * ## Why the resolution *shows* a notification instead of only closing one
+ *
+ * The Issue proposed a silent push whose Service Worker calls
+ * `getNotifications({tag})` → `close()` and never calls `showNotification`, and
+ * asked whether iOS permits it. Measured against the specs and the three engine
+ * implementations, the answer is that **no engine permits it** — this is not an
+ * iOS restriction. Every subscription in this app is created with
+ * `userVisibleOnly: true` (`NotificationsSettings`), which is the only value
+ * Chrome, Firefox and Safari accept from a web page, and it is a promise that
+ * each delivered push leaves a notification on screen. Chrome answers a push
+ * event that ends with nothing displayed by showing its own "This site has been
+ * updated in the background" card; Firefox charges it to a per-subscription
+ * silent-push quota and drops the subscription when that runs out; WebKit
+ * revokes the push subscription outright. The full citation list, the rejected
+ * alternatives and the numbers are in
+ * `docs/design/cross-device-notification-dismissal.md`.
+ *
+ * So the resolution is a real notification that *replaces* the stale one: same
+ * `tag`, silent, `renotify: false`, and a body that says the wait is over. The
+ * card count on the device does not go up, the phone does not make a sound, and
+ * the contract is kept on every engine rather than gambled with on three.
+ *
+ * ## Why it does not undo #1999 and #2000
+ *
+ * An extra push per resolved wait would give back a slice of what those two
+ * Issues removed, so three conditions have to hold before one is spent, and
+ * each is a reason code in the log:
+ *
+ *  - **A card was actually fanned out** (`prompt-card-state`). A wait Auto-Yes
+ *    answered never rang anybody (#1999), so there is nothing to clear and
+ *    nothing is sent. This is the condition that keeps #1999's saving intact.
+ *  - **Nothing in the worktree is still waiting.** The card is per worktree, so
+ *    a second instance still waiting means it is still true.
+ *  - **At least {@link MIN_DEVICES_FOR_CROSS_DEVICE_CLEAR} devices are
+ *    subscribed.** With one device the problem this Issue describes cannot
+ *    exist, so a single-device install sends exactly as many pushes as it did
+ *    before this module was written — zero extra.
+ *
+ * `completion` and `failure` cards are deliberately left alone; the reasoning
+ * for each is in the design note under "which kinds are cleared".
+ *
+ * Everything here is advisory. It is called from the waiting edge, which runs
+ * inside the status probe and inside the poller, and neither may be disturbed
+ * by a push that failed.
+ *
+ * @module lib/push/resolution-push-notifier
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MIN_DEVICES_FOR_CROSS_DEVICE_CLEAR = void 0;
+exports.decidePromptResolution = decidePromptResolution;
+exports.notifyPromptResolved = notifyPromptResolved;
+const db_instance_1 = require("../../lib/db/db-instance");
+const push_subscriptions_db_1 = require("../../lib/db/push-subscriptions-db");
+const worktree_db_1 = require("../../lib/db/worktree-db");
+const logger_1 = require("../../lib/logger");
+const waiting_episode_state_1 = require("../../lib/session/waiting-episode-state");
+const prompt_card_state_1 = require("./prompt-card-state");
+const push_sender_1 = require("./push-sender");
+const vapid_1 = require("./vapid");
+const logger = (0, logger_1.createLogger)('push/resolution');
+/**
+ * How many devices must be subscribed to the acting bucket before clearing is
+ * worth a push.
+ *
+ * Two, because two is the smallest fleet in which the defect can occur: with
+ * one subscription the device that answered is the device that holds the card,
+ * and it either closed it by being tapped or is in the reader's hand. Sending
+ * anyway would spend a push to replace a card on the one screen that already
+ * knows — measurable cost, no information. This bound is also what makes the
+ * Issue's "with one device nothing changes" criterion true by construction
+ * rather than by inspection.
+ */
+exports.MIN_DEVICES_FOR_CROSS_DEVICE_CLEAR = 2;
+/**
+ * Whether this worktree's resolved wait is worth a clearing push.
+ *
+ * Pure: reads the card state, the episode store and the subscription count and
+ * writes none of them, so a test can assert the reason without the fan-out and
+ * {@link notifyPromptResolved} can log the same decision it acts on.
+ */
+function decidePromptResolution(worktreeId) {
+    if (!(0, vapid_1.isPushConfigured)()) {
+        return { send: false, reason: 'push-unconfigured' };
+    }
+    if (!(0, prompt_card_state_1.hasPromptCard)(worktreeId)) {
+        return { send: false, reason: 'no-card' };
+    }
+    if ((0, waiting_episode_state_1.hasOpenWaitingEpisode)(worktreeId)) {
+        return { send: false, reason: 'still-waiting' };
+    }
+    // A database that cannot answer is treated as a single-device install: the
+    // conservative direction here is *not* sending, because the cost of a missed
+    // clear is a stale card and the cost of a wrong send is a push to every
+    // device plus a card where there was none.
+    let deviceCount;
+    try {
+        deviceCount = (0, push_subscriptions_db_1.countPushSubscriptionsForKind)((0, db_instance_1.getDbInstance)(), 'prompt');
+    }
+    catch {
+        return { send: false, reason: 'single-device', deviceCount: 0 };
+    }
+    if (deviceCount < exports.MIN_DEVICES_FOR_CROSS_DEVICE_CLEAR) {
+        return { send: false, reason: 'single-device', deviceCount };
+    }
+    return { send: true, reason: 'cross-device-clear', deviceCount };
+}
+/**
+ * The worktree's display name, for the title of the replacement card.
+ *
+ * The same fallback `waiting-push-notifier` uses, and duplicated rather than
+ * shared because that module imports this one — sharing it the other way round
+ * would be an import cycle for four lines. Falling back to the id keeps the
+ * replacement happening with a less readable title instead of leaving the lie
+ * on screen.
+ */
+function resolveWorktreeName(worktreeId) {
+    try {
+        return (0, worktree_db_1.getWorktreeById)((0, db_instance_1.getDbInstance)(), worktreeId)?.name ?? worktreeId;
+    }
+    catch {
+        return worktreeId;
+    }
+}
+/**
+ * Replace this worktree's stale prompt card on every subscribed device.
+ *
+ * Never throws and never rejects: it is called with `void` from the waiting
+ * edge, which runs inside the status API probe and inside the response poller.
+ *
+ * The card mark is dropped for every terminal decision — including the ones
+ * that send nothing — because the wait is over either way and a mark left
+ * behind would make the *next* worktree-level question answer about a card that
+ * no longer exists. `still-waiting` is the one reason that keeps it: that card
+ * is still on screen and still accurate.
+ */
+async function notifyPromptResolved(input) {
+    const { worktreeId, agentName, at = Date.now() } = input;
+    const decision = decidePromptResolution(worktreeId);
+    const context = {
+        worktreeId,
+        instanceId: agentName,
+        reason: decision.reason,
+        ...(decision.deviceCount !== undefined ? { deviceCount: decision.deviceCount } : {}),
+    };
+    if (decision.reason !== 'still-waiting') {
+        (0, prompt_card_state_1.clearPromptCard)(worktreeId);
+    }
+    if (!decision.send) {
+        // `single-device` is logged at info because it is the reason that explains
+        // the symptom a reader would report ("my other phone still shows it") in an
+        // install that has since added a second device but not re-subscribed it.
+        // `no-card` and `still-waiting` are the structural defaults — the first is
+        // every Auto-Yes-answered wait — so they stay at debug, exactly as #2000
+        // kept its `no-fault` out of the operator's way.
+        if (decision.reason === 'single-device')
+            logger.info('resolution-push-skipped', context);
+        else
+            logger.debug('resolution-push-skipped', context);
+        return;
+    }
+    try {
+        await (0, push_sender_1.notifyPushSubscribers)({
+            worktreeId,
+            worktreeName: resolveWorktreeName(worktreeId),
+            kind: 'prompt',
+            agentName,
+            resolved: true,
+        }, at);
+        logger.info('resolution-push-sent', context);
+    }
+    catch (error) {
+        logger.warn('resolution-push-failed', {
+            ...context,
+            error: error instanceof Error ? error.message : String(error),
+        });
+    }
+}

package/dist/server/src/lib/push/waiting-push-notifier.js

@@ -58,7 +58,9 @@ const worktree_db_1 = require("../../lib/db/worktree-db");
 const logger_1 = require("../../lib/logger");
 const waiting_episode_state_1 = require("../../lib/session/waiting-episode-state");
 const escalation_settings_1 = require("./escalation-settings");
+const prompt_push_gate_1 = require("./prompt-push-gate");
 const push_sender_1 = require("./push-sender");
+const resolution_push_notifier_1 = require("./resolution-push-notifier");
 const vapid_1 = require("./vapid");
 const logger = (0, logger_1.createLogger)('push/waiting-notifier');
 /** How often outstanding waits are re-checked. Minute granularity is enough. */
@@ -143,6 +145,18 @@ function handleWaitingTransition(transition) {
     if (!transition.waiting || transition.since === null) {
         pending.delete(key);
         stopEscalationTimerIfIdle();
+        // Issue #2001: this is the moment the notification on every *other* device
+        // stopped being true. It is the only edge that sees it — the poller closes
+        // the episode here (`response-checker`) and so does the status probe
+        // (`worktree-status-helper`), so hooking the edge covers both producers the
+        // way #1790 already does for the opening one. Fire-and-forget: the notifier
+        // never rejects, and the `void` keeps the synchronous listener contract
+        // `emit` relies on.
+        void (0, resolution_push_notifier_1.notifyPromptResolved)({
+            worktreeId: transition.worktreeId,
+            agentName: transition.instanceId ?? transition.cliToolId,
+            at: transition.at,
+        });
         return;
     }
     const wait = {
@@ -152,8 +166,21 @@ function handleWaitingTransition(transition) {
         since: transition.since,
         kind: transition.kind,
     };
+    // Issue #1999: the wait is tracked and the reminder armed either way — only
+    // the notification is gated. Dropping the wait from `pending` instead would
+    // discard the escalation that makes the suppression safe, and the gate has to
+    // run before `sendWaitingPush` because `shouldSendWaitingPush` records the
+    // episode at the moment it decides to send.
     pending.set(key, wait);
     startEscalationTimer();
+    if ((0, prompt_push_gate_1.isPromptPushSuppressed)({
+        worktreeId: wait.worktreeId,
+        cliToolId: wait.cliToolId,
+        instanceId: wait.instanceId,
+        waitingSince: wait.since,
+    })) {
+        return;
+    }
     void sendWaitingPush(wait, false, transition.at);
 }
 /**
@@ -182,6 +209,21 @@ function runEscalationTick(now = Date.now()) {
             continue;
         if (now - wait.since < thresholdMs)
             continue;
+        // Issue #1999: the same gate, asked with `escalated`. It never suppresses a
+        // reminder — the episode check above has already proved Auto-Yes did not
+        // resolve this wait — but routing the reminder through it keeps the rule in
+        // one place and puts the decision in the log next to the opening edge's.
+        // The wait is left in `pending` if it ever does suppress, so a later tick
+        // can reconsider rather than losing the reminder outright.
+        if ((0, prompt_push_gate_1.isPromptPushSuppressed)({
+            worktreeId: wait.worktreeId,
+            cliToolId: wait.cliToolId,
+            instanceId: wait.instanceId,
+            waitingSince: wait.since,
+            escalated: true,
+        })) {
+            continue;
+        }
         // Dropped before sending, not after: the reminder is once per episode, and
         // an in-flight fan-out must not be able to earn a second one.
         pending.delete(key);