commandmate 0.27.0 → 0.28.0

package/dist/server/src/lib/push/index.js

@@ -1,11 +1,31 @@
 "use strict";
 /** Web Push module barrel (Issue #1125). */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.promptCardCount = exports.clearAllPromptCards = exports.clearPromptCard = exports.hasPromptCard = exports.markPromptCardShown = exports.MIN_DEVICES_FOR_CROSS_DEVICE_CLEAR = exports.notifyPromptResolved = exports.decidePromptResolution = exports.MAX_ESCALATION_THRESHOLD_MINUTES = exports.MIN_ESCALATION_THRESHOLD_MINUTES = exports.ESCALATION_SETTINGS_KEY = exports.ESCALATION_THRESHOLD_CHOICES = exports.DEFAULT_ESCALATION_SETTINGS = exports.normalizeEscalationSettings = exports.setPushEscalationSettings = exports.getPushEscalationSettings = exports.ESCALATION_TICK_MS = exports.pendingEscalationCount = exports.runEscalationTick = exports.handleWaitingTransition = exports.isWaitingPushNotifierActive = exports.stopWaitingPushNotifier = exports.startWaitingPushNotifier = exports.UPSTREAM_FAULT_COOLDOWN_MS = exports.clearUpstreamFaultEpisodes = exports.observeUpstreamFaultEdge = exports.notifySessionStartFailurePush = exports.notifyUpstreamFaultPush = exports.notifyVerificationFailurePush = exports.isPromptPushSuppressed = exports.decidePromptPush = exports.resetWaitingPushDedup = exports.shouldSendWaitingPush = exports.DEFAULT_DEDUP_WINDOW_MS = exports.resetNotificationDedup = exports.shouldSendNotification = exports.resolvePushLocale = exports.buildExcerpt = exports.buildPushPayload = exports.notifyPushSubscribers = exports.getVapidPublicKey = exports.isPushConfigured = exports.getVapidConfig = void 0;
+exports.notifyPromptResolved = exports.decidePromptResolution = exports.MAX_ESCALATION_THRESHOLD_MINUTES = exports.MIN_ESCALATION_THRESHOLD_MINUTES = exports.ESCALATION_SETTINGS_KEY = exports.ESCALATION_THRESHOLD_CHOICES = exports.DEFAULT_ESCALATION_SETTINGS = exports.normalizeEscalationSettings = exports.setPushEscalationSettings = exports.getPushEscalationSettings = exports.ESCALATION_TICK_MS = exports.pendingEscalationCount = exports.runEscalationTick = exports.handleWaitingTransition = exports.isWaitingPushNotifierActive = exports.stopWaitingPushNotifier = exports.startWaitingPushNotifier = exports.UPSTREAM_FAULT_COOLDOWN_MS = exports.clearUpstreamFaultEpisodes = exports.observeUpstreamFaultEdge = exports.notifySessionStartFailurePush = exports.notifyUpstreamFaultPush = exports.notifyVerificationFailurePush = exports.isPromptPushSuppressed = exports.decidePromptPush = exports.resetWaitingPushDedup = exports.shouldSendWaitingPush = exports.DEFAULT_DEDUP_WINDOW_MS = exports.resetNotificationDedup = exports.shouldSendNotification = exports.resolvePushLocale = exports.buildExcerpt = exports.buildPushPayload = exports.notifyPushSubscribers = exports.PUSH_DELIVERY_HEALTH_MAX_AGE_MS = exports.PUSH_DELIVERY_HEALTH_KEY_PREFIX = exports.clearAllPushDeliveryHealth = exports.clearPushDeliveryHealth = exports.recordPushDeliveryFailure = exports.getPushDeliveryHealth = exports.VAPID_ENV_KEYS = exports.VAPID_DEFAULT_SUBJECT = exports.extractVapidSubjectHost = exports.classifyVapidSubject = exports.runVapidSelfCheck = exports.formatVapidReportLines = exports.inspectVapidConfig = exports.getVapidPublicKey = exports.isPushConfigured = exports.getVapidConfig = void 0;
+exports.PROMPT_CARD_MAX_AGE_MS = exports.PROMPT_CARD_KEY_PREFIX = exports.promptCardCount = exports.forgetPromptCardMemory = exports.clearAllPromptCards = exports.clearPromptCard = exports.hasPromptCard = exports.markPromptCardShown = exports.MIN_DEVICES_FOR_CROSS_DEVICE_CLEAR = void 0;
 var vapid_1 = require("./vapid");
 Object.defineProperty(exports, "getVapidConfig", { enumerable: true, get: function () { return vapid_1.getVapidConfig; } });
 Object.defineProperty(exports, "isPushConfigured", { enumerable: true, get: function () { return vapid_1.isPushConfigured; } });
 Object.defineProperty(exports, "getVapidPublicKey", { enumerable: true, get: function () { return vapid_1.getVapidPublicKey; } });
+// The startup self-check both #2123 and #2124 report through. `server.ts` and
+// `src/cli/commands/status.ts` import it from './vapid' directly rather than
+// through this barrel: that file must stay reachable from `tsconfig.cli.json`
+// (`paths: {}`), and this barrel pulls in web-push and better-sqlite3.
+Object.defineProperty(exports, "inspectVapidConfig", { enumerable: true, get: function () { return vapid_1.inspectVapidConfig; } });
+Object.defineProperty(exports, "formatVapidReportLines", { enumerable: true, get: function () { return vapid_1.formatVapidReportLines; } });
+Object.defineProperty(exports, "runVapidSelfCheck", { enumerable: true, get: function () { return vapid_1.runVapidSelfCheck; } });
+Object.defineProperty(exports, "classifyVapidSubject", { enumerable: true, get: function () { return vapid_1.classifyVapidSubject; } });
+Object.defineProperty(exports, "extractVapidSubjectHost", { enumerable: true, get: function () { return vapid_1.extractVapidSubjectHost; } });
+Object.defineProperty(exports, "VAPID_DEFAULT_SUBJECT", { enumerable: true, get: function () { return vapid_1.VAPID_DEFAULT_SUBJECT; } });
+Object.defineProperty(exports, "VAPID_ENV_KEYS", { enumerable: true, get: function () { return vapid_1.VAPID_ENV_KEYS; } });
+// Per-device delivery health (Issue #2124, extensible for #2126).
+var delivery_health_1 = require("./delivery-health");
+Object.defineProperty(exports, "getPushDeliveryHealth", { enumerable: true, get: function () { return delivery_health_1.getPushDeliveryHealth; } });
+Object.defineProperty(exports, "recordPushDeliveryFailure", { enumerable: true, get: function () { return delivery_health_1.recordPushDeliveryFailure; } });
+Object.defineProperty(exports, "clearPushDeliveryHealth", { enumerable: true, get: function () { return delivery_health_1.clearPushDeliveryHealth; } });
+Object.defineProperty(exports, "clearAllPushDeliveryHealth", { enumerable: true, get: function () { return delivery_health_1.clearAllPushDeliveryHealth; } });
+Object.defineProperty(exports, "PUSH_DELIVERY_HEALTH_KEY_PREFIX", { enumerable: true, get: function () { return delivery_health_1.PUSH_DELIVERY_HEALTH_KEY_PREFIX; } });
+Object.defineProperty(exports, "PUSH_DELIVERY_HEALTH_MAX_AGE_MS", { enumerable: true, get: function () { return delivery_health_1.PUSH_DELIVERY_HEALTH_MAX_AGE_MS; } });
 var push_sender_1 = require("./push-sender");
 Object.defineProperty(exports, "notifyPushSubscribers", { enumerable: true, get: function () { return push_sender_1.notifyPushSubscribers; } });
 Object.defineProperty(exports, "buildPushPayload", { enumerable: true, get: function () { return push_sender_1.buildPushPayload; } });
@@ -63,9 +83,13 @@ var resolution_push_notifier_1 = require("./resolution-push-notifier");
 Object.defineProperty(exports, "decidePromptResolution", { enumerable: true, get: function () { return resolution_push_notifier_1.decidePromptResolution; } });
 Object.defineProperty(exports, "notifyPromptResolved", { enumerable: true, get: function () { return resolution_push_notifier_1.notifyPromptResolved; } });
 Object.defineProperty(exports, "MIN_DEVICES_FOR_CROSS_DEVICE_CLEAR", { enumerable: true, get: function () { return resolution_push_notifier_1.MIN_DEVICES_FOR_CROSS_DEVICE_CLEAR; } });
+// The card mark itself, durable across a restart since Issue #2057.
 var prompt_card_state_1 = require("./prompt-card-state");
 Object.defineProperty(exports, "markPromptCardShown", { enumerable: true, get: function () { return prompt_card_state_1.markPromptCardShown; } });
 Object.defineProperty(exports, "hasPromptCard", { enumerable: true, get: function () { return prompt_card_state_1.hasPromptCard; } });
 Object.defineProperty(exports, "clearPromptCard", { enumerable: true, get: function () { return prompt_card_state_1.clearPromptCard; } });
 Object.defineProperty(exports, "clearAllPromptCards", { enumerable: true, get: function () { return prompt_card_state_1.clearAllPromptCards; } });
+Object.defineProperty(exports, "forgetPromptCardMemory", { enumerable: true, get: function () { return prompt_card_state_1.forgetPromptCardMemory; } });
 Object.defineProperty(exports, "promptCardCount", { enumerable: true, get: function () { return prompt_card_state_1.promptCardCount; } });
+Object.defineProperty(exports, "PROMPT_CARD_KEY_PREFIX", { enumerable: true, get: function () { return prompt_card_state_1.PROMPT_CARD_KEY_PREFIX; } });
+Object.defineProperty(exports, "PROMPT_CARD_MAX_AGE_MS", { enumerable: true, get: function () { return prompt_card_state_1.PROMPT_CARD_MAX_AGE_MS; } });

package/dist/server/src/lib/push/prompt-card-state.js

@@ -1,7 +1,7 @@
 "use strict";
 /**
  * Which worktrees currently have a prompt notification card sitting on a
- * subscriber's phone (Issue #2001).
+ * subscriber's phone (Issue #2001, made restart-durable in Issue #2057).
  *
  * ## Why this has to exist at all
  *
@@ -28,6 +28,47 @@
  * `resolution-push-notifier` when the wait closes, whether or not it decided to
  * send. There is exactly one writer per direction.
  *
+ * ## Why the mark outlives the process (Issue #2057)
+ *
+ * A card on a lock screen is not a live-session fact. Every other store in this
+ * directory describes a tmux pane and *must* die with the server that watched
+ * it; this one describes something that is still on a device the server cannot
+ * see, and a restart does not take it off that device. #2001 shipped it as an
+ * in-memory map anyway, and the hole that leaves is narrower than it looks but
+ * real — the measurement is in the commit that added this section, and in
+ * `docs/design/cross-device-notification-dismissal.md` §6.2:
+ *
+ *  - A plain restart does **not** lose the mark's effect. The status probe
+ *    re-observes the still-open wait, `waiting-episode-state` reports that as a
+ *    fresh opening edge, and the prompt push that follows re-marks the card. So
+ *    the closing edge still decides `cross-device-clear`.
+ *  - It is lost when that re-opening push is itself **gated**. Auto-Yes running
+ *    at the moment the wait is re-observed makes `prompt-push-gate` suppress it
+ *    (#1999), nothing re-marks, and the resolution then decides `no-card` — the
+ *    card #2001 exists to replace stays on the other phone for good.
+ *
+ * So the mark is written through to `app_settings` and read back from there
+ * when this process has no memory of it. The in-memory map is kept in front as
+ * the process-local answer — it is on the closing edge of every wait — and both
+ * layers carry the same timestamp, so the DB is a backing store and never a
+ * second opinion.
+ *
+ * ## Why `app_settings`, and why the SQL is here
+ *
+ * Same trade `escalation-settings` made two files over, for the same reasons:
+ * `app_settings` (migration v27) is the generic key-value table, so this adds
+ * **no migration**, and the accessor lives beside its only consumer rather than
+ * becoming a fourth reader of that table in `db/app-settings-db` with no shared
+ * logic to gain. One row per worktree that has an outstanding card, keyed
+ * {@link PROMPT_CARD_KEY_PREFIX}`<worktreeId>` — per row rather than one JSON
+ * map, so marking and clearing are single statements with no read-modify-write
+ * between two processes that share the database file.
+ *
+ * Every database call here is total: an unopenable database, a missing table or
+ * a malformed value all resolve to the in-memory answer rather than throwing.
+ * The callers are a push fan-out and a status probe, and neither may be
+ * disturbed by storage.
+ *
  * ## Accuracy, and what it deliberately does not model
  *
  * This tracks what the *server* sent, not what each device still displays. A
@@ -38,22 +79,156 @@
  * Modelling per-device state would need the devices to report back, which is a
  * round trip per notification for a card that costs nothing to replace.
  *
- * In-memory via `globalThis`, like every other live-session store here (see the
- * note in `agent-event-state` for the `next dev` bundling reason). One entry
- * per worktree that has an outstanding card, so the map is bounded by the
- * number of worktrees, and each entry is removed when its wait closes.
+ * Durability also does not buy the case where **no closing edge is observed at
+ * all**: `observeWaitingEdge` emits nothing for a `waiting: false` poll on an
+ * instance it has no episode for, so a wait that ended while the server was
+ * down — or before any probe re-opened it — never reaches
+ * `resolution-push-notifier` in the first place. Closing that would mean making
+ * the waiting episode itself durable, which is `lib/session`'s call and not
+ * this module's; it is written up as a remaining limitation in §6.2 of the
+ * design note and pinned by `tests/unit/push/restart-card-state-2057.test.ts`.
  *
  * @module lib/push/prompt-card-state
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROMPT_CARD_MAX_AGE_MS = exports.PROMPT_CARD_KEY_PREFIX = void 0;
 exports.markPromptCardShown = markPromptCardShown;
 exports.hasPromptCard = hasPromptCard;
 exports.clearPromptCard = clearPromptCard;
 exports.clearAllPromptCards = clearAllPromptCards;
+exports.forgetPromptCardMemory = forgetPromptCardMemory;
 exports.promptCardCount = promptCardCount;
+const db_instance_1 = require("../../lib/db/db-instance");
+const logger_1 = require("../../lib/logger");
+const logger = (0, logger_1.createLogger)('push/prompt-card-state');
+/**
+ * `app_settings.key` prefix for one worktree's outstanding card.
+ *
+ * Safe as a prefix because `buildCompositeKey`'s precondition already holds for
+ * every worktree id in this table: `isValidWorktreeId` restricts them to
+ * alphanumerics, hyphens and underscores, so none can contain `:` and no id can
+ * spell another id's key.
+ */
+exports.PROMPT_CARD_KEY_PREFIX = 'push_prompt_card:';
+/**
+ * How long a persisted mark is believed.
+ *
+ * The Issue offered two existing lifetimes to copy, and **both are measurably
+ * wrong here**, in opposite directions:
+ *
+ *  - `STRUCTURED_STATE_MAX_AGE_MS` (30 min) bounds how long a *structured claim
+ *    about the present* is trusted. `provisional-turn` states in as many words
+ *    that a turn running past 30 minutes is ordinary, and #1790's reminder
+ *    exists precisely because waits outlive that — its threshold can be set to
+ *    60 minutes from the settings screen. Copying it would expire the mark
+ *    exactly for the long waits whose stale card is the most misleading.
+ *  - The waiting episode has **no clock lifetime at all**:
+ *    `waiting-episode-state` removes an episode only at the closing edge. So
+ *    "match the episode's lifetime" resolves to "never expire", which lets a
+ *    mark left by a wait that ended while the server was down ring a resolution
+ *    weeks later.
+ *
+ * A day is the one bound this repository already commits to for "how long a
+ * wait may still legitimately be open": `MAX_ESCALATION_THRESHOLD_MINUTES` is
+ * 1440, i.e. an install is already allowed to say "remind me about this wait in
+ * 24 hours". Past that the server is guessing about a lock screen it has not
+ * been able to see for a day.
+ *
+ * The two failure modes are not symmetric, which is what settles the direction
+ * of the rounding: too short brings the defect back (a card that lies stays on
+ * the phone), while too long costs at most one silent, *accurate* "handled"
+ * card, and only on an install with at least
+ * {@link resolution-push-notifier!MIN_DEVICES_FOR_CROSS_DEVICE_CLEAR} devices.
+ */
+exports.PROMPT_CARD_MAX_AGE_MS = 24 * 60 * 60 * 1000;
 /** worktreeId -> epoch ms the most recent prompt card was fanned out. */
 const cards = globalThis.__promptPushCards ??
     (globalThis.__promptPushCards = new Map());
+function keyFor(worktreeId) {
+    return `${exports.PROMPT_CARD_KEY_PREFIX}${worktreeId}`;
+}
+function isExpired(at, now) {
+    return now - at >= exports.PROMPT_CARD_MAX_AGE_MS;
+}
+/** The persisted mark for one worktree, or null. Never throws. */
+function readRow(worktreeId) {
+    try {
+        const row = (0, db_instance_1.getDbInstance)()
+            .prepare('SELECT value FROM app_settings WHERE key = ?')
+            .get(keyFor(worktreeId));
+        if (!row)
+            return null;
+        const at = Number.parseInt(row.value, 10);
+        // A value nobody can read is treated as no card: it fails towards *not*
+        // spending a push, the same direction `decidePromptResolution` chose for a
+        // database that cannot answer.
+        return Number.isFinite(at) ? at : null;
+    }
+    catch (error) {
+        logger.debug('prompt-card-read-failed', {
+            worktreeId,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return null;
+    }
+}
+/** Every persisted mark, as `[worktreeId, at]`. Never throws. */
+function readAllRows() {
+    try {
+        // GLOB rather than LIKE: the prefix contains `_`, which LIKE would treat as
+        // a single-character wildcard and match neighbouring keys with.
+        const rows = (0, db_instance_1.getDbInstance)()
+            .prepare('SELECT key, value FROM app_settings WHERE key GLOB ?')
+            .all(`${exports.PROMPT_CARD_KEY_PREFIX}*`);
+        const out = [];
+        for (const row of rows) {
+            const at = Number.parseInt(row.value, 10);
+            if (Number.isFinite(at))
+                out.push([row.key.slice(exports.PROMPT_CARD_KEY_PREFIX.length), at]);
+        }
+        return out;
+    }
+    catch (error) {
+        logger.debug('prompt-card-scan-failed', {
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return [];
+    }
+}
+/** Write one worktree's mark through to storage. Never throws. */
+function writeRow(worktreeId, at) {
+    try {
+        (0, db_instance_1.getDbInstance)()
+            .prepare(`
+        INSERT INTO app_settings (key, value, created_at, updated_at)
+        VALUES (?, ?, ?, ?)
+        ON CONFLICT(key) DO UPDATE SET
+          value = excluded.value,
+          updated_at = excluded.updated_at
+      `)
+            .run(keyFor(worktreeId), String(at), at, at);
+    }
+    catch (error) {
+        logger.debug('prompt-card-write-failed', {
+            worktreeId,
+            error: error instanceof Error ? error.message : String(error),
+        });
+    }
+}
+/** @returns True when a row was actually removed. Never throws. */
+function deleteRow(worktreeId) {
+    try {
+        return ((0, db_instance_1.getDbInstance)().prepare('DELETE FROM app_settings WHERE key = ?').run(keyFor(worktreeId))
+            .changes > 0);
+    }
+    catch (error) {
+        logger.debug('prompt-card-delete-failed', {
+            worktreeId,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return false;
+    }
+}
 /**
  * Record that a prompt notification for this worktree has left the server.
  *
@@ -63,22 +238,51 @@ const cards = globalThis.__promptPushCards ??
  */
 function markPromptCardShown(worktreeId, at = Date.now()) {
     cards.set(worktreeId, at);
+    writeRow(worktreeId, at);
 }
-/** Whether a prompt card for this worktree was fanned out and not yet cleared. */
-function hasPromptCard(worktreeId) {
-    return cards.has(worktreeId);
+/**
+ * Whether a prompt card for this worktree was fanned out and not yet cleared.
+ *
+ * Answers from memory when this process marked it, and from `app_settings` when
+ * it did not — which after a restart is every outstanding card. A mark read
+ * back from storage is adopted into the map, so the next question (the second
+ * closing edge for the same wait, which both producers raise) is answered
+ * without a second query.
+ *
+ * @param now Epoch ms, overridable so a test can exercise
+ *   {@link PROMPT_CARD_MAX_AGE_MS} without a fake clock.
+ */
+function hasPromptCard(worktreeId, now = Date.now()) {
+    const at = cards.get(worktreeId) ?? readRow(worktreeId);
+    if (at === null || at === undefined)
+        return false;
+    if (isExpired(at, now)) {
+        // Dropped as it is read rather than by a sweep: this is the only question
+        // asked about a given worktree's card, so the read is the moment the
+        // expiry becomes observable, and there is nothing a background pass would
+        // catch earlier.
+        cards.delete(worktreeId);
+        deleteRow(worktreeId);
+        return false;
+    }
+    cards.set(worktreeId, at);
+    return true;
 }
 /**
- * Forget this worktree's card.
+ * Forget this worktree's card, in memory and in storage.
  *
  * @returns True when there was one to forget — the caller uses it to tell "the
  *   wait is over and we cleared it" from "the wait is over and it never rang".
+ *   True if *either* layer held one, so a mark this process only ever read back
+ *   from `app_settings` still reports as cleared.
  */
 function clearPromptCard(worktreeId) {
-    return cards.delete(worktreeId);
+    const wasInMemory = cards.delete(worktreeId);
+    const wasPersisted = deleteRow(worktreeId);
+    return wasInMemory || wasPersisted;
 }
 /**
- * Drop every remembered card. Test seam.
+ * Drop every remembered card, from both layers. Test seam.
  *
  * CI runs with `fileParallelism: false`, so one process holds this map for the
  * whole suite: a card left behind would make the next file's first resolution
@@ -86,8 +290,44 @@ function clearPromptCard(worktreeId) {
  */
 function clearAllPromptCards() {
     cards.clear();
+    try {
+        (0, db_instance_1.getDbInstance)()
+            .prepare('DELETE FROM app_settings WHERE key GLOB ?')
+            .run(`${exports.PROMPT_CARD_KEY_PREFIX}*`);
+    }
+    catch (error) {
+        logger.debug('prompt-card-clear-all-failed', {
+            error: error instanceof Error ? error.message : String(error),
+        });
+    }
 }
-/** How many worktrees have an outstanding card. Test seam. */
-function promptCardCount() {
-    return cards.size;
+/**
+ * Drop only this process's memory of the cards, keeping the persisted rows.
+ *
+ * Test seam, and the only honest way to write down what a restart does: the
+ * server comes back with every `globalThis` store empty and the database file
+ * exactly as it was. `tests/unit/push/restart-card-state-2057.test.ts` uses it
+ * for that and for nothing else — production code has no reason to forget a
+ * mark without also clearing it.
+ */
+function forgetPromptCardMemory() {
+    cards.clear();
+}
+/**
+ * How many worktrees have an outstanding, unexpired card. Test seam.
+ *
+ * Counts the union of both layers, so it reports the same number before and
+ * after a restart rather than dropping to zero with the map.
+ */
+function promptCardCount(now = Date.now()) {
+    const live = new Set();
+    for (const [worktreeId, at] of cards) {
+        if (!isExpired(at, now))
+            live.add(worktreeId);
+    }
+    for (const [worktreeId, at] of readAllRows()) {
+        if (!isExpired(at, now))
+            live.add(worktreeId);
+    }
+    return live.size;
 }

package/dist/server/src/lib/push/push-sender.js

@@ -19,8 +19,9 @@
  * via next-intl's `createTranslator`: this module is compiled to CommonJS for
  * `dist/server` (what `npm start` runs) and next-intl is ESM-only, so importing
  * it here would `require()` an ES module — fatal below Node 22.12, which our
- * `engines: ">=22.0.0"` still admits. These four strings only ever substitute
- * `{excerpt}`, so a dependency-free replace covers them.
+ * `engines: ">=22.0.0"` still admits. The bodies only ever substitute a handful
+ * of named placeholders — `{excerpt}`, `{minutes}` (#1790), `{agent}` /
+ * `{version}` (#2045) — so a dependency-free replace covers them.
  */
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
@@ -38,6 +39,7 @@ const i18n_config_1 = require("../../config/i18n-config");
 const notifications_json_1 = __importDefault(require("../../../locales/en/notifications.json"));
 const notifications_json_2 = __importDefault(require("../../../locales/ja/notifications.json"));
 const vapid_1 = require("./vapid");
+const delivery_health_1 = require("./delivery-health");
 const notification_dedup_1 = require("./notification-dedup");
 const prompt_card_state_1 = require("./prompt-card-state");
 const logger = (0, logger_1.createLogger)('push/sender');
@@ -122,6 +124,10 @@ const FAILURE_BODY_KEYS = {
         withExcerpt: 'failureSessionUnavailableWithExcerpt',
         plain: 'failureSessionUnavailable',
     },
+    'agent-session-error': {
+        withExcerpt: 'failureAgentSessionWithExcerpt',
+        plain: 'failureAgentSession',
+    },
 };
 function buildFailureBody(event, messages, excerpt) {
     // An event that claims `kind: 'failure'` without saying which failure is a
@@ -151,15 +157,22 @@ function buildPushPayload(event, locale = i18n_config_1.DEFAULT_LOCALE, now = Da
                 : buildWaitingBody(event, messages, excerpt, now)
         : event.kind === 'failure'
             ? buildFailureBody(event, messages, excerpt)
-            : excerpt
-                ? messages.completionWithExcerpt.replace('{excerpt}', excerpt)
-                : messages.completion;
+            : // Issue #2045: an update notice is a completion by *bucket*, not by
+                // content, so it is the one completion whose body is not "Done".
+                event.updateAvailable
+                    ? messages.updateAvailable
+                        .replace('{agent}', event.updateAvailable.agent)
+                        .replace('{version}', event.updateAvailable.version)
+                    : excerpt
+                        ? messages.completionWithExcerpt.replace('{excerpt}', excerpt)
+                        : messages.completion;
     return {
         kind: event.kind,
         title,
         body,
         worktreeId: event.worktreeId,
-        url: `/worktrees/${event.worktreeId}`,
+        // Issue #2022: the worktree page is the default, not the only answer.
+        url: event.url ?? `/worktrees/${event.worktreeId}`,
         // Unchanged by #1790, and deliberately: the escalation carries the same tag
         // as the notification it follows up, so the Service Worker replaces the
         // stale one instead of stacking a second card for the same wait.
@@ -169,19 +182,50 @@ function buildPushPayload(event, locale = i18n_config_1.DEFAULT_LOCALE, now = Da
         ...(event.resolved === true ? { resolved: true } : {}),
     };
 }
-async function sendToOne(sub, payload) {
+/**
+ * Send to one device, and record what happened where the reader can see it.
+ *
+ * The two failure handlings are UNCHANGED (Issue #2124 verifies that explicitly):
+ * 404/410 removes the subscription because the push service says the endpoint is
+ * gone, and every other status — 403 from APNs over a bad `sub`, the 4xx #2126 is
+ * about — leaves the subscription alone, because a configuration mistake must
+ * never delete a reader's subscription.
+ *
+ * What is new is that both outcomes now also land in `delivery-health`, keyed by
+ * a hash of the endpoint, so `GET /api/push/subscriptions` can tell the device
+ * "you are not receiving" instead of the failure ending in a server log the
+ * phone's owner never reads.
+ *
+ * @returns True when the payload was accepted by the push service.
+ */
+async function sendToOne(sub, payload, now = Date.now()) {
     try {
         await web_push_1.default.sendNotification({ endpoint: sub.endpoint, keys: sub.keys }, payload);
+        // Only the recovery edge is logged: a device that was failing and is now
+        // receiving again is the one success worth a line. Logging every success
+        // would put one line per device per notification into the log.
+        if ((0, delivery_health_1.clearPushDeliveryHealth)(sub.endpoint)) {
+            logger.info('push-delivery-recovered');
+        }
+        return true;
     }
     catch (err) {
         const statusCode = err.statusCode;
         if (statusCode === 404 || statusCode === 410) {
             // Subscription expired / unsubscribed at the push service — auto-remove.
             (0, push_subscriptions_db_1.deletePushSubscriptionByEndpoint)((0, db_instance_1.getDbInstance)(), sub.endpoint);
+            (0, delivery_health_1.recordPushDeliveryFailure)(sub.endpoint, { statusCode, removed: true }, now);
             logger.info('push-subscription-removed', { statusCode });
-            return;
+            return false;
         }
-        logger.warn('push-send-failed', { statusCode: statusCode ?? 'unknown' });
+        const health = (0, delivery_health_1.recordPushDeliveryFailure)(sub.endpoint, { statusCode: statusCode ?? null }, now);
+        logger.warn('push-send-failed', {
+            statusCode: statusCode ?? 'unknown',
+            // Issue #2124: one 403 is a blip, a streak of them is a misconfigured
+            // `CM_VAPID_SUBJECT`. The count is what tells the two apart in a log.
+            consecutiveFailures: health.failureCount,
+        });
+        return false;
     }
 }
 /**
@@ -265,10 +309,17 @@ async function notifyPushSubscribers(event, now = Date.now()) {
             else
                 byLocale.set(locale, [sub]);
         }
-        await Promise.all(Array.from(byLocale, ([locale, subs]) => {
+        const outcomes = (await Promise.all(Array.from(byLocale, ([locale, subs]) => {
             const payload = JSON.stringify(buildPushPayload(event, locale, now));
-            return Promise.all(subs.map((sub) => sendToOne(sub, payload)));
-        }));
+            return Promise.all(subs.map((sub) => sendToOne(sub, payload, now)));
+        }))).flat();
+        // Issue #2124: a fan-out that reached nobody used to be indistinguishable
+        // from one that was never attempted — `push-send-failed` is per device and
+        // sits below the default log level's attention, and success said nothing at
+        // all. One line per fan-out names both halves, and no endpoint.
+        const delivered = outcomes.filter(Boolean).length;
+        const failed = outcomes.length - delivered;
+        logger.info('push-fanout-complete', { kind: event.kind, delivered, failed });
     }
     catch (err) {
         logger.warn('push-fanout-error', {

package/dist/server/src/lib/push/resolution-push-notifier.js

@@ -45,6 +45,10 @@
  *  - **A card was actually fanned out** (`prompt-card-state`). A wait Auto-Yes
  *    answered never rang anybody (#1999), so there is nothing to clear and
  *    nothing is sent. This is the condition that keeps #1999's saving intact.
+ *    Issue #2057 made that mark survive a restart, so this condition now
+ *    answers about the device rather than about the process: before it, a
+ *    server that came back while a wait was still open could read `no-card`
+ *    for a card that was demonstrably still on the reader's other phone.
  *  - **Nothing in the worktree is still waiting.** The card is per worktree, so
  *    a second instance still waiting means it is still true.
  *  - **At least {@link MIN_DEVICES_FOR_CROSS_DEVICE_CLEAR} devices are
@@ -93,12 +97,20 @@ exports.MIN_DEVICES_FOR_CROSS_DEVICE_CLEAR = 2;
  * Pure: reads the card state, the episode store and the subscription count and
  * writes none of them, so a test can assert the reason without the fan-out and
  * {@link notifyPromptResolved} can log the same decision it acts on.
+ *
+ * @param now Epoch ms the closing edge was observed. Overridable so a test can
+ *   exercise {@link prompt-card-state!PROMPT_CARD_MAX_AGE_MS} without a fake
+ *   clock.
  */
-function decidePromptResolution(worktreeId) {
+function decidePromptResolution(worktreeId, now = Date.now()) {
     if (!(0, vapid_1.isPushConfigured)()) {
         return { send: false, reason: 'push-unconfigured' };
     }
-    if (!(0, prompt_card_state_1.hasPromptCard)(worktreeId)) {
+    // Issue #2057: `now` reaches exactly one place — the card mark's age. The
+    // mark is durable now, so it is the one input to this decision that can be
+    // older than the process asking about it, and the closing edge already knows
+    // when it was observed (`PromptResolvedInput.at`).
+    if (!(0, prompt_card_state_1.hasPromptCard)(worktreeId, now)) {
         return { send: false, reason: 'no-card' };
     }
     if ((0, waiting_episode_state_1.hasOpenWaitingEpisode)(worktreeId)) {
@@ -151,7 +163,7 @@ function resolveWorktreeName(worktreeId) {
  */
 async function notifyPromptResolved(input) {
     const { worktreeId, agentName, at = Date.now() } = input;
-    const decision = decidePromptResolution(worktreeId);
+    const decision = decidePromptResolution(worktreeId, at);
     const context = {
         worktreeId,
         instanceId: agentName,