commandmate 0.27.0 → 0.28.0

package/.next/types/routes.d.ts

@@ -2,7 +2,7 @@
 // Do not edit this file manually
 
 type AppRoutes = "/" | "/chat" | "/login" | "/more" | "/offline" | "/repositories" | "/review" | "/sessions" | "/skills" | "/skills/[skillId]" | "/skills/installed" | "/worktrees/[id]" | "/worktrees/[id]/files/[...path]" | "/worktrees/[id]/terminal"
-type AppRouteHandlerRoutes = "/api/app/update" | "/api/app/update-check" | "/api/assistant/conversation" | "/api/assistant/current-output" | "/api/assistant/messages" | "/api/assistant/session" | "/api/assistant/start" | "/api/assistant/terminal" | "/api/assistant/tools" | "/api/auth/login" | "/api/auth/logout" | "/api/auth/status" | "/api/capabilities" | "/api/daily-summary" | "/api/daily-summary/status" | "/api/external-apps" | "/api/external-apps/[id]" | "/api/external-apps/[id]/health" | "/api/fs/browse" | "/api/fs/recent-paths" | "/api/hooks/agent-event" | "/api/hooks/claude-done" | "/api/hooks/permission-request" | "/api/metrics/vibe" | "/api/ollama/models" | "/api/push/escalation" | "/api/push/subscriptions" | "/api/push/vapid" | "/api/repositories" | "/api/repositories/[id]" | "/api/repositories/[id]/todos" | "/api/repositories/[id]/todos/[todoId]" | "/api/repositories/clone" | "/api/repositories/clone/[jobId]" | "/api/repositories/excluded" | "/api/repositories/restore" | "/api/repositories/scan" | "/api/repositories/sync" | "/api/repositories/validate-path" | "/api/sidebar/group-order" | "/api/skills" | "/api/skills/[id]" | "/api/skills/installations" | "/api/skills/operations" | "/api/skills/reindex" | "/api/slash-commands" | "/api/tasks/[taskId]" | "/api/tasks/[taskId]/cancel" | "/api/templates" | "/api/templates/[id]" | "/api/todos" | "/api/verification/runs" | "/api/verification/runs/[runId]" | "/api/worktrees" | "/api/worktrees/[id]" | "/api/worktrees/[id]/auto-yes" | "/api/worktrees/[id]/capture" | "/api/worktrees/[id]/clear-composer" | "/api/worktrees/[id]/cli-tool" | "/api/worktrees/[id]/cmate/schedules" | "/api/worktrees/[id]/current-output" | "/api/worktrees/[id]/env" | "/api/worktrees/[id]/execution-logs" | "/api/worktrees/[id]/execution-logs/[logId]" | "/api/worktrees/[id]/files/[...path]" | "/api/worktrees/[id]/git/branch/create" | "/api/worktrees/[id]/git/branch/delete" | "/api/worktrees/[id]/git/branches" | "/api/worktrees/[id]/git/checkout" | "/api/worktrees/[id]/git/commit" | "/api/worktrees/[id]/git/diff" | "/api/worktrees/[id]/git/fetch" | "/api/worktrees/[id]/git/log" | "/api/worktrees/[id]/git/pull" | "/api/worktrees/[id]/git/push" | "/api/worktrees/[id]/git/reset" | "/api/worktrees/[id]/git/revert" | "/api/worktrees/[id]/git/show/[commitHash]" | "/api/worktrees/[id]/git/stage" | "/api/worktrees/[id]/git/staged" | "/api/worktrees/[id]/git/stash" | "/api/worktrees/[id]/git/stash/[index]" | "/api/worktrees/[id]/git/stash/apply" | "/api/worktrees/[id]/git/stash/pop" | "/api/worktrees/[id]/git/stash/push" | "/api/worktrees/[id]/git/status" | "/api/worktrees/[id]/git/unstage" | "/api/worktrees/[id]/git/working-diff" | "/api/worktrees/[id]/interrupt" | "/api/worktrees/[id]/kill-session" | "/api/worktrees/[id]/logs" | "/api/worktrees/[id]/logs/[filename]" | "/api/worktrees/[id]/marp-render" | "/api/worktrees/[id]/memos" | "/api/worktrees/[id]/memos/[memoId]" | "/api/worktrees/[id]/messages" | "/api/worktrees/[id]/prompt-response" | "/api/worktrees/[id]/resolve-target" | "/api/worktrees/[id]/respond" | "/api/worktrees/[id]/schedules" | "/api/worktrees/[id]/schedules/[scheduleId]" | "/api/worktrees/[id]/schedules/active" | "/api/worktrees/[id]/search" | "/api/worktrees/[id]/send" | "/api/worktrees/[id]/skills" | "/api/worktrees/[id]/skills/[skillId]/git-workflow" | "/api/worktrees/[id]/skills/[skillId]/install" | "/api/worktrees/[id]/skills/[skillId]/plan" | "/api/worktrees/[id]/skills/[skillId]/uninstall" | "/api/worktrees/[id]/skills/[skillId]/uninstall-plan" | "/api/worktrees/[id]/skills/[skillId]/update" | "/api/worktrees/[id]/skills/[skillId]/update-plan" | "/api/worktrees/[id]/slash-commands" | "/api/worktrees/[id]/special-keys" | "/api/worktrees/[id]/start-polling" | "/api/worktrees/[id]/tasks" | "/api/worktrees/[id]/terminal" | "/api/worktrees/[id]/timers" | "/api/worktrees/[id]/timers/history" | "/api/worktrees/[id]/todos" | "/api/worktrees/[id]/todos/[todoId]" | "/api/worktrees/[id]/tree" | "/api/worktrees/[id]/tree/[...path]" | "/api/worktrees/[id]/upload/[...path]" | "/api/worktrees/[id]/verify" | "/api/worktrees/[id]/verify/runs" | "/api/worktrees/[id]/verify/runs/[runId]" | "/api/worktrees/[id]/viewed" | "/proxy/[...path]"
+type AppRouteHandlerRoutes = "/api/app/update" | "/api/app/update-check" | "/api/assistant/conversation" | "/api/assistant/current-output" | "/api/assistant/messages" | "/api/assistant/session" | "/api/assistant/start" | "/api/assistant/terminal" | "/api/assistant/tools" | "/api/auth/login" | "/api/auth/logout" | "/api/auth/status" | "/api/capabilities" | "/api/daily-summary" | "/api/daily-summary/status" | "/api/external-apps" | "/api/external-apps/[id]" | "/api/external-apps/[id]/health" | "/api/fs/browse" | "/api/fs/recent-paths" | "/api/hooks/agent-event" | "/api/hooks/claude-done" | "/api/hooks/permission-request" | "/api/metrics/vibe" | "/api/ollama/models" | "/api/push/escalation" | "/api/push/subscriptions" | "/api/push/vapid" | "/api/repositories" | "/api/repositories/[id]" | "/api/repositories/[id]/todos" | "/api/repositories/[id]/todos/[todoId]" | "/api/repositories/clone" | "/api/repositories/clone/[jobId]" | "/api/repositories/excluded" | "/api/repositories/restore" | "/api/repositories/scan" | "/api/repositories/sync" | "/api/repositories/validate-path" | "/api/sidebar/group-order" | "/api/skills" | "/api/skills/[id]" | "/api/skills/installations" | "/api/skills/operations" | "/api/skills/reindex" | "/api/slash-commands" | "/api/tasks/[taskId]" | "/api/tasks/[taskId]/cancel" | "/api/templates" | "/api/templates/[id]" | "/api/todos" | "/api/verification/runs" | "/api/verification/runs/[runId]" | "/api/worktrees" | "/api/worktrees/[id]" | "/api/worktrees/[id]/auto-yes" | "/api/worktrees/[id]/capture" | "/api/worktrees/[id]/clear-composer" | "/api/worktrees/[id]/cli-tool" | "/api/worktrees/[id]/cmate/schedules" | "/api/worktrees/[id]/current-output" | "/api/worktrees/[id]/env" | "/api/worktrees/[id]/execution-logs" | "/api/worktrees/[id]/execution-logs/[logId]" | "/api/worktrees/[id]/files/[...path]" | "/api/worktrees/[id]/git/branch/create" | "/api/worktrees/[id]/git/branch/delete" | "/api/worktrees/[id]/git/branches" | "/api/worktrees/[id]/git/checkout" | "/api/worktrees/[id]/git/commit" | "/api/worktrees/[id]/git/diff" | "/api/worktrees/[id]/git/fetch" | "/api/worktrees/[id]/git/log" | "/api/worktrees/[id]/git/pull" | "/api/worktrees/[id]/git/push" | "/api/worktrees/[id]/git/reset" | "/api/worktrees/[id]/git/revert" | "/api/worktrees/[id]/git/show/[commitHash]" | "/api/worktrees/[id]/git/stage" | "/api/worktrees/[id]/git/staged" | "/api/worktrees/[id]/git/stash" | "/api/worktrees/[id]/git/stash/[index]" | "/api/worktrees/[id]/git/stash/apply" | "/api/worktrees/[id]/git/stash/pop" | "/api/worktrees/[id]/git/stash/push" | "/api/worktrees/[id]/git/status" | "/api/worktrees/[id]/git/unstage" | "/api/worktrees/[id]/git/working-diff" | "/api/worktrees/[id]/instances/opencode" | "/api/worktrees/[id]/interrupt" | "/api/worktrees/[id]/kill-session" | "/api/worktrees/[id]/logs" | "/api/worktrees/[id]/logs/[filename]" | "/api/worktrees/[id]/marp-render" | "/api/worktrees/[id]/memos" | "/api/worktrees/[id]/memos/[memoId]" | "/api/worktrees/[id]/messages" | "/api/worktrees/[id]/opencode/diff" | "/api/worktrees/[id]/opencode/session" | "/api/worktrees/[id]/opencode/share" | "/api/worktrees/[id]/prompt-response" | "/api/worktrees/[id]/resolve-target" | "/api/worktrees/[id]/respond" | "/api/worktrees/[id]/schedules" | "/api/worktrees/[id]/schedules/[scheduleId]" | "/api/worktrees/[id]/schedules/active" | "/api/worktrees/[id]/search" | "/api/worktrees/[id]/send" | "/api/worktrees/[id]/skills" | "/api/worktrees/[id]/skills/[skillId]/git-workflow" | "/api/worktrees/[id]/skills/[skillId]/install" | "/api/worktrees/[id]/skills/[skillId]/plan" | "/api/worktrees/[id]/skills/[skillId]/uninstall" | "/api/worktrees/[id]/skills/[skillId]/uninstall-plan" | "/api/worktrees/[id]/skills/[skillId]/update" | "/api/worktrees/[id]/skills/[skillId]/update-plan" | "/api/worktrees/[id]/slash-commands" | "/api/worktrees/[id]/special-keys" | "/api/worktrees/[id]/start-polling" | "/api/worktrees/[id]/tasks" | "/api/worktrees/[id]/terminal" | "/api/worktrees/[id]/timers" | "/api/worktrees/[id]/timers/history" | "/api/worktrees/[id]/todos" | "/api/worktrees/[id]/todos/[todoId]" | "/api/worktrees/[id]/tree" | "/api/worktrees/[id]/tree/[...path]" | "/api/worktrees/[id]/upload/[...path]" | "/api/worktrees/[id]/verify" | "/api/worktrees/[id]/verify/runs" | "/api/worktrees/[id]/verify/runs/[runId]" | "/api/worktrees/[id]/viewed" | "/proxy/[...path]"
 type PageRoutes = never
 type LayoutRoutes = "/" | "/worktrees/[id]"
 type RedirectRoutes = never
@@ -100,6 +100,7 @@ interface ParamMap {
   "/api/worktrees/[id]/git/status": { "id": string; }
   "/api/worktrees/[id]/git/unstage": { "id": string; }
   "/api/worktrees/[id]/git/working-diff": { "id": string; }
+  "/api/worktrees/[id]/instances/opencode": { "id": string; }
   "/api/worktrees/[id]/interrupt": { "id": string; }
   "/api/worktrees/[id]/kill-session": { "id": string; }
   "/api/worktrees/[id]/logs": { "id": string; }
@@ -108,6 +109,9 @@ interface ParamMap {
   "/api/worktrees/[id]/memos": { "id": string; }
   "/api/worktrees/[id]/memos/[memoId]": { "id": string; "memoId": string; }
   "/api/worktrees/[id]/messages": { "id": string; }
+  "/api/worktrees/[id]/opencode/diff": { "id": string; }
+  "/api/worktrees/[id]/opencode/session": { "id": string; }
+  "/api/worktrees/[id]/opencode/share": { "id": string; }
   "/api/worktrees/[id]/prompt-response": { "id": string; }
   "/api/worktrees/[id]/resolve-target": { "id": string; }
   "/api/worktrees/[id]/respond": { "id": string; }

package/.next/types/validator.ts

@@ -947,6 +947,15 @@ type RouteHandlerConfig<Route extends AppRouteHandlerRoutes = AppRouteHandlerRou
   type __Unused = __Check
 }
 
+// Validate ../../src/app/api/worktrees/[id]/instances/opencode/route.ts
+{
+  type __IsExpected<Specific extends RouteHandlerConfig<"/api/worktrees/[id]/instances/opencode">> = Specific
+  const handler = {} as typeof import("../../src/app/api/worktrees/[id]/instances/opencode/route.js")
+  type __Check = __IsExpected<typeof handler>
+  // @ts-ignore
+  type __Unused = __Check
+}
+
 // Validate ../../src/app/api/worktrees/[id]/interrupt/route.ts
 {
   type __IsExpected<Specific extends RouteHandlerConfig<"/api/worktrees/[id]/interrupt">> = Specific
@@ -1019,6 +1028,33 @@ type RouteHandlerConfig<Route extends AppRouteHandlerRoutes = AppRouteHandlerRou
   type __Unused = __Check
 }
 
+// Validate ../../src/app/api/worktrees/[id]/opencode/diff/route.ts
+{
+  type __IsExpected<Specific extends RouteHandlerConfig<"/api/worktrees/[id]/opencode/diff">> = Specific
+  const handler = {} as typeof import("../../src/app/api/worktrees/[id]/opencode/diff/route.js")
+  type __Check = __IsExpected<typeof handler>
+  // @ts-ignore
+  type __Unused = __Check
+}
+
+// Validate ../../src/app/api/worktrees/[id]/opencode/session/route.ts
+{
+  type __IsExpected<Specific extends RouteHandlerConfig<"/api/worktrees/[id]/opencode/session">> = Specific
+  const handler = {} as typeof import("../../src/app/api/worktrees/[id]/opencode/session/route.js")
+  type __Check = __IsExpected<typeof handler>
+  // @ts-ignore
+  type __Unused = __Check
+}
+
+// Validate ../../src/app/api/worktrees/[id]/opencode/share/route.ts
+{
+  type __IsExpected<Specific extends RouteHandlerConfig<"/api/worktrees/[id]/opencode/share">> = Specific
+  const handler = {} as typeof import("../../src/app/api/worktrees/[id]/opencode/share/route.js")
+  type __Check = __IsExpected<typeof handler>
+  // @ts-ignore
+  type __Unused = __Check
+}
+
 // Validate ../../src/app/api/worktrees/[id]/prompt-response/route.ts
 {
   type __IsExpected<Specific extends RouteHandlerConfig<"/api/worktrees/[id]/prompt-response">> = Specific

package/README.md

@@ -90,6 +90,12 @@ CommandMate is a Progressive Web App. On a mobile browser, use **Add to Home Scr
 
 > **HTTPS is required for installation.** Browsers only register a Service Worker (and offer install) on `https://` or `http://localhost`. When accessing a self-hosted instance over plain HTTP on the LAN (e.g. `http://192.168.x.x:3000`), install and offline support are disabled by the browser — use a tunnel or an HTTPS reverse proxy (see Security above) to enable them. The app itself remains fully usable without the PWA layer.
 
+### Phone notifications (Web Push)
+
+Once installed, CommandMate can push a notification to your phone **while the app is closed** — an agent waiting for you, a verification gate that failed, a session that could not start.
+
+**It is off until you generate a VAPID key pair.** `commandmate init` generates one and writes `CM_VAPID_PUBLIC_KEY` / `CM_VAPID_PRIVATE_KEY` / `CM_VAPID_SUBJECT` into `.env`; when they are missing, the startup log and `commandmate status` say so in one line. iOS/iPadOS additionally require the Home Screen install above — a Safari tab cannot subscribe. Full setup, including the HTTPS requirement and what to do when nothing arrives: [Web App Guide -> Phone Notifications](docs/user-guide/webapp-guide.md#phone-notifications-web-push).
+
 ---
 
 ## Browser Support
@@ -161,7 +167,9 @@ already running). Requires Node.js 22 or later.
 - Already have a `.env`? The setup questions are skipped.
 - Don't want the browser to open? Use `commandmate --no-open` (also skipped automatically
   on CI and headless sessions).
-- Otherwise, open http://localhost:3000 in your browser.
+- Otherwise, open http://127.0.0.1:3000 in your browser. CommandMate binds `127.0.0.1`
+  by default, and `localhost` can resolve to `::1` (IPv6) first — an address CommandMate
+  does not listen on, and another process may.
 
 See the [CLI Setup Guide](./docs/en/user-guide/cli-setup-guide.md) for details.
 For Windows users, see the [WSL2 Setup Guide](./docs/en/user-guide/wsl2-setup.md) — CommandMate depends on tmux, so it runs on Windows via WSL2 (native Windows is not supported).

package/dist/cli/commands/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/init.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AA0J5D;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CA0IvE;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAGrE"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/init.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AA6N5D;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAsJvE;AAED;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAGrE"}

package/dist/cli/commands/init.js

@@ -15,6 +15,10 @@ const logger_1 = require("../utils/logger");
 const preflight_1 = require("../utils/preflight");
 const ai_integration_messages_1 = require("../config/ai-integration-messages");
 const env_setup_1 = require("../utils/env-setup");
+const vapid_keygen_1 = require("../utils/vapid-keygen");
+// Relative, NOT `@/lib/push/vapid`: tsconfig.cli.json resets `paths` to {}. The module
+// file rather than the '@/lib/push' barrel, which pulls in web-push and better-sqlite3.
+const vapid_1 = require("../../lib/push/vapid");
 const prompt_1 = require("../utils/prompt");
 const security_logger_1 = require("../utils/security-logger");
 const security_messages_1 = require("../config/security-messages");
@@ -112,6 +116,53 @@ async function promptForConfig() {
         CM_LOG_FORMAT: env_setup_1.ENV_DEFAULTS.CM_LOG_FORMAT,
     };
 }
+/**
+ * Settle the three Web Push variables for the `.env` `init` is about to write
+ * (Issue #2123; the subject is Issue #2124).
+ *
+ * Push is off until `CM_VAPID_PUBLIC_KEY` / `CM_VAPID_PRIVATE_KEY` exist, and
+ * before this Issue nothing in CommandMate could produce them — the only route
+ * was to know that the bundled `web-push` exports `generateVAPIDKeys()` and type
+ * a `node -e` one-liner. So `init` generates a pair, unconditionally and in both
+ * modes: a key pair costs nothing while no device has subscribed, and making it
+ * a question would put the feature back behind knowing it exists.
+ *
+ * **An existing pair is always reused.** The public key is baked into every
+ * `PushSubscription` a browser has already created, so regenerating on
+ * `init --force` would orphan every subscribed device — silently, which is the
+ * failure mode this Issue pair exists to end.
+ *
+ * Fail-open: if `web-push` cannot be loaded the miss is reported and `init`
+ * finishes normally with push left unconfigured. That is exactly the state every
+ * install was in before this change, and the startup self-check now names it.
+ *
+ * @param envPath - The `.env` about to be written, read for keys to carry over.
+ * @returns The trio to write, or `{}` when no pair could be settled.
+ */
+async function resolveVapidConfig(envPath) {
+    const existing = (0, env_setup_1.readExistingVapidKeys)(envPath);
+    if (existing.CM_VAPID_PUBLIC_KEY && existing.CM_VAPID_PRIVATE_KEY) {
+        logger.info('Web Push: keeping the existing VAPID key pair');
+        logger.info('  (replacing it would orphan every device that has already subscribed)');
+        return {
+            CM_VAPID_PUBLIC_KEY: existing.CM_VAPID_PUBLIC_KEY,
+            CM_VAPID_PRIVATE_KEY: existing.CM_VAPID_PRIVATE_KEY,
+            CM_VAPID_SUBJECT: existing.CM_VAPID_SUBJECT || vapid_1.VAPID_DEFAULT_SUBJECT,
+        };
+    }
+    const result = await (0, vapid_keygen_1.generateVapidKeyPair)();
+    if (!result.ok) {
+        logger.warn(`Web Push: could not generate VAPID keys (${result.error})`);
+        logger.info('  Push notifications stay disabled; see docs/user-guide/webapp-guide.md');
+        return {};
+    }
+    logger.success('Web Push: generated a VAPID key pair');
+    return {
+        CM_VAPID_PUBLIC_KEY: result.keys.publicKey,
+        CM_VAPID_PRIVATE_KEY: result.keys.privateKey,
+        CM_VAPID_SUBJECT: existing.CM_VAPID_SUBJECT || vapid_1.VAPID_DEFAULT_SUBJECT,
+    };
+}
 /**
  * Display configuration summary
  * Issue #119: Show settings after configuration
@@ -129,6 +180,11 @@ function displayConfigSummary(config, envPath) {
     logger.info(`  CM_PORT:      ${config.CM_PORT}`);
     logger.info(`  CM_BIND:      ${config.CM_BIND}`);
     logger.info(`  CM_DB_PATH:   ${config.CM_DB_PATH}`);
+    // Issue #2123: the keys themselves are secrets, so the summary reports only
+    // whether push is configured — enough for the reader to know it is on.
+    logger.info(`  Web Push:     ${config.CM_VAPID_PUBLIC_KEY && config.CM_VAPID_PRIVATE_KEY
+        ? `configured (CM_VAPID_SUBJECT=${config.CM_VAPID_SUBJECT ?? vapid_1.VAPID_DEFAULT_SUBJECT})`
+        : 'not configured'}`);
     logger.blank();
     logger.info(`  Config file:  ${envPath}`);
     logger.blank();
@@ -215,6 +271,10 @@ async function runInit(options) {
         logger.blank();
         logger.info('--- Generating .env ---');
         logger.blank();
+        // Issue #2123 / #2124: settle the Web Push trio before the file is written.
+        // Reads `envPath` first, so `--force` carries an existing key pair across
+        // instead of orphaning every subscribed device.
+        Object.assign(config, await resolveVapidConfig(envPath));
         logger.info('Creating .env file...');
         await envSetup.createEnvFile(config, { force: options.force });
         logger.success('.env file created');
@@ -234,6 +294,12 @@ async function runInit(options) {
         else {
             logger.info('  1. Run "commandmate start" to start the server');
         }
+        if (config.CM_VAPID_PUBLIC_KEY && config.CM_VAPID_PRIVATE_KEY) {
+            // Issue #2123: keys alone are not the whole setup — a phone also needs
+            // HTTPS, and iOS needs the app installed to the Home Screen. Point at the
+            // one document that says so rather than repeating it here.
+            logger.info('  Phone notifications: docs/user-guide/webapp-guide.md');
+        }
         logger.blank();
         // Issue #264: Display AI tool integration guide
         console.log(ai_integration_messages_1.AI_INTEGRATION_GUIDE);

package/dist/cli/commands/instances.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"instances.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/instances.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,OAAO,EAAE,SAAS,EAAwC,MAAM,qBAAqB,CAAC;AAuEtF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,WAAW,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,IAAI,GAAE,oBAA+B,GACpC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAiB7B;AAkLD,wBAAgB,sBAAsB,IAAI,OAAO,CAqEhD"}
+{"version":3,"file":"instances.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/instances.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,OAAO,EAAE,SAAS,EAAwC,MAAM,qBAAqB,CAAC;AAiGtF;;;;;;;;;;GAUG;AACH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,WAAW,CAAC;AAE1D;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,IAAI,GAAE,oBAA+B,GACpC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAiB7B;AAwND,wBAAgB,sBAAsB,IAAI,OAAO,CAqEhD"}

package/dist/cli/commands/instances.js

@@ -19,6 +19,13 @@ const command_helpers_1 = require("../utils/command-helpers");
 const cli_tool_ids_1 = require("../config/cli-tool-ids");
 const agent_instances_1 = require("../utils/agent-instances");
 const session_target_1 = require("../utils/session-target");
+/**
+ * Longest session title printed in the table (Issue #2038).
+ *
+ * opencode titles the session after the first prompt, so they run to a whole
+ * sentence. `--json` carries the full string; the table is a table.
+ */
+const MAX_SESSION_TITLE_COLUMN = 40;
 /**
  * Format instance rows as a table for terminal display.
  * [DR1-08 consistency] Mirrors ls.ts's formatTable().
@@ -29,7 +36,12 @@ const session_target_1 = require("../utils/session-target");
 function formatInstancesTable(rows) {
     if (rows.length === 0)
         return 'No agent instances found.';
-    const headers = ['INSTANCE_ID', 'ALIAS', 'CLI_TOOL', 'RUNNING', 'AUTO_YES', 'MODEL', 'EFFORT'];
+    const headers = [
+        'INSTANCE_ID', 'ALIAS', 'CLI_TOOL', 'RUNNING', 'AUTO_YES', 'MODEL', 'EFFORT',
+        // Issue #2038 appends, exactly as #1785 did, so anything reading this table
+        // by column position keeps working.
+        'SESSION_ID', 'SESSION_TITLE',
+    ];
     const dataRows = rows.map(r => [
         r.instanceId,
         r.alias,
@@ -41,6 +53,8 @@ function formatInstancesTable(rows) {
         // column of `-` reads like a value the reader has to look up.
         r.model ?? '',
         r.reasoningEffort ?? '',
+        r.sessionId ?? '',
+        (r.sessionTitle ?? '').slice(0, MAX_SESSION_TITLE_COLUMN),
     ]);
     const colWidths = headers.map((h, i) => Math.max(h.length, ...dataRows.map(r => r[i].length)));
     const headerLine = headers.map((h, i) => h.padEnd(colWidths[i])).join('  ');
@@ -86,6 +100,30 @@ async function resolveInstanceCliTool(client, worktreeId, instanceId, requestedA
     }
     return target.cliToolId;
 }
+/**
+ * The opencode session each instance will resume, keyed by instance id
+ * (Issue #2038).
+ *
+ * Empty — never an error — when the roster has no opencode instance, when the
+ * daemon predates this endpoint (404), or when the request fails for any other
+ * reason. `instances` is a listing command: two new columns are worth one extra
+ * request, and never worth turning a working listing into a non-zero exit.
+ */
+async function fetchOpencodeSessions(client, worktreeId, instances) {
+    const result = new Map();
+    if (!instances.some(inst => inst.cliTool === 'opencode'))
+        return result;
+    try {
+        const response = await client.get(`/api/worktrees/${worktreeId}/opencode/session`);
+        for (const entry of response.instances ?? []) {
+            result.set(entry.instanceId, { sessionId: entry.sessionId, title: entry.title });
+        }
+    }
+    catch {
+        // An older server has no such route. The rest of the table is still true.
+    }
+    return result;
+}
 /**
  * List action: roster + live running/auto-yes status per instance.
  * Probes GET .../current-output?cliTool=&instance= per instance (same
@@ -94,6 +132,10 @@ async function resolveInstanceCliTool(client, worktreeId, instanceId, requestedA
 async function listInstances(worktreeId, options) {
     const client = new api_client_1.ApiClient({ token: options.token });
     const instances = await (0, agent_instances_1.fetchAgentInstances)(client, worktreeId);
+    // Issue #2038: one extra request for the whole worktree, and only when there
+    // is an opencode instance to ask about — the endpoint is opencode-only and a
+    // roster without one has nothing to learn from it.
+    const opencodeSessions = await fetchOpencodeSessions(client, worktreeId, instances);
     const rows = await Promise.all(instances.map(async (inst) => {
         const query = new URLSearchParams({ cliTool: inst.cliTool, instance: inst.id });
         const output = await client.get(`/api/worktrees/${worktreeId}/current-output?${query.toString()}`);
@@ -113,6 +155,9 @@ async function listInstances(worktreeId, options) {
             // two answers get to disagree.
             model: output.model ?? null,
             reasoningEffort: output.reasoningEffort ?? null,
+            // Issue #2038: additive, and absent for every tool that is not opencode.
+            sessionId: opencodeSessions.get(inst.id)?.sessionId ?? null,
+            sessionTitle: opencodeSessions.get(inst.id)?.title ?? null,
         };
     }));
     if (options.json) {

package/dist/cli/commands/interrupt.d.ts

@@ -0,0 +1,25 @@
+/**
+ * interrupt Command - Stop the turn an agent is currently generating
+ * Issue #2101: [DR1-08] Factory pattern
+ *
+ * The CLI face of `POST /api/worktrees/:id/interrupt`, which the browser UI has
+ * had since Issue #46 and which Issue #2034 taught to abort an opencode turn
+ * through the agent's own server (`POST /session/:id/abort`) before falling back
+ * to the measured Escape-Escape keystroke pair. Nothing in the subcommand list
+ * reached it: `stop` stops the CommandMate *server*, and an orchestration that
+ * wanted to cut a runaway turn short had to either curl the endpoint or attach
+ * to tmux.
+ *
+ * A thin client, deliberately. Every decision about WHAT gets interrupted —
+ * which instances are running, which transport applies, whether the abort took —
+ * belongs to the route and to `CLIToolManager`; this file validates its two
+ * inputs, POSTs, and translates the route's one expected refusal into an exit
+ * code a caller can branch on.
+ */
+import { Command } from 'commander';
+/**
+ * Create the interrupt command.
+ * [DR1-08] Factory pattern for addCommand() registration.
+ */
+export declare function createInterruptCommand(): Command;
+//# sourceMappingURL=interrupt.d.ts.map

package/dist/cli/commands/interrupt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interrupt.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/interrupt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAgDpC;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,OAAO,CA4FhD"}

package/dist/cli/commands/interrupt.js

@@ -0,0 +1,146 @@
+"use strict";
+/**
+ * interrupt Command - Stop the turn an agent is currently generating
+ * Issue #2101: [DR1-08] Factory pattern
+ *
+ * The CLI face of `POST /api/worktrees/:id/interrupt`, which the browser UI has
+ * had since Issue #46 and which Issue #2034 taught to abort an opencode turn
+ * through the agent's own server (`POST /session/:id/abort`) before falling back
+ * to the measured Escape-Escape keystroke pair. Nothing in the subcommand list
+ * reached it: `stop` stops the CommandMate *server*, and an orchestration that
+ * wanted to cut a runaway turn short had to either curl the endpoint or attach
+ * to tmux.
+ *
+ * A thin client, deliberately. Every decision about WHAT gets interrupted —
+ * which instances are running, which transport applies, whether the abort took —
+ * belongs to the route and to `CLIToolManager`; this file validates its two
+ * inputs, POSTs, and translates the route's one expected refusal into an exit
+ * code a caller can branch on.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createInterruptCommand = createInterruptCommand;
+const commander_1 = require("commander");
+const types_1 = require("../types");
+const api_client_1 = require("../utils/api-client");
+const command_helpers_1 = require("../utils/command-helpers");
+const agent_target_options_1 = require("../config/agent-target-options");
+/**
+ * The route's wording for "the worktree is fine, nothing was generating".
+ *
+ * Matched on the message rather than on a machine code because the route sends
+ * none: `POST /api/worktrees/:id/interrupt` answers a bare
+ * `{ error: 'No active sessions found' }` with status 404, exactly as it answers
+ * `{ error: "Worktree '<id>' not found" }` with the same status. Both would
+ * otherwise collapse into {@link ExitCode.UNEXPECTED_ERROR} through the generic
+ * 404 mapping in `handleApiError`, and the two need opposite recoveries — "you
+ * are already past the state you wanted" versus "your id is wrong".
+ *
+ * Adding a `code` to the route would be the better fix and is not available
+ * here: `src/app/api/**` is outside this change's file scope. The failure mode
+ * of this string going stale is benign and bounded — a renamed message stops
+ * being recognised and the command falls back to the generic 404 handling every
+ * other CLI command still uses. `tests/unit/cli/commands/interrupt-2101.test.ts`
+ * pins the string against the route's own source so the drift is caught here
+ * rather than in an orchestration loop.
+ */
+const NO_ACTIVE_SESSIONS_ERROR = 'No active sessions found';
+/**
+ * `--json` payload for the no-sessions outcome.
+ *
+ * `interrupted` is present and empty rather than absent: a caller that reads
+ * `.interrupted.length` must not have to special-case the one result where that
+ * count is the interesting number. This is the additive JSON contract Epic
+ * #2055 asks of every CLI surface — the success shape passes through verbatim,
+ * and the one shape the server cannot supply (it answers 404, not a 200 with an
+ * empty list) is filled in here using the same field names.
+ */
+function noActiveSessionsJson() {
+    const payload = {
+        success: false,
+        message: NO_ACTIVE_SESSIONS_ERROR,
+        interrupted: [],
+    };
+    return JSON.stringify(payload, null, 2);
+}
+/**
+ * Create the interrupt command.
+ * [DR1-08] Factory pattern for addCommand() registration.
+ */
+function createInterruptCommand() {
+    const cmd = new commander_1.Command('interrupt');
+    cmd
+        .description("Interrupt the turn an agent is generating (same as the GUI's interrupt button)")
+        .argument('<worktree-id>', 'Worktree ID')
+        .option('--json', 'JSON output (API response as-is)')
+        .option('--instance <id>', agent_target_options_1.INTERRUPT_INSTANCE_OPTION_DESCRIPTION)
+        .option('--token <token>', command_helpers_1.TOKEN_WARNING)
+        .action(async (worktreeId, options) => {
+        /**
+         * Report the no-sessions outcome, honouring `--json`.
+         * Declared here so the `--json` branch and the exit code stay together.
+         */
+        const reportNoActiveSessions = () => {
+            if (options.json) {
+                console.log(noActiveSessionsJson());
+            }
+            console.error(`Error: ${NO_ACTIVE_SESSIONS_ERROR} for worktree '${worktreeId}'`
+                + `${options.instance ? ` (instance '${options.instance}')` : ''}. Nothing was interrupted.`);
+            process.exit(types_1.InterruptExitCode.NO_ACTIVE_SESSIONS);
+        };
+        try {
+            // [SEC4-04] Validate worktree ID
+            if (!(0, api_client_1.isValidWorktreeId)(worktreeId)) {
+                console.error('Error: Invalid worktree ID format.');
+                process.exit(types_1.ExitCode.CONFIG_ERROR);
+                return;
+            }
+            // Issue #868: the id is embedded in a tmux session name server-side, so
+            // it is rejected here before it can reach one.
+            if (options.instance && !(0, api_client_1.isValidInstanceId)(options.instance)) {
+                console.error('Error: Invalid --instance. Must be an alphanumeric/underscore/hyphen identifier (max 64 chars).');
+                process.exit(types_1.ExitCode.CONFIG_ERROR);
+                return;
+            }
+            const client = new api_client_1.ApiClient({ token: options.token });
+            // No client-side instance -> tool resolution, unlike `respond` (#1629):
+            // this route resolves the backing tool from the roster itself and falls
+            // back to reading the instance id as a tool id, so there is no
+            // worktree-default fallback for a `--instance` to be silently caught by.
+            const body = {};
+            if (options.instance) {
+                body.instanceId = options.instance;
+            }
+            const data = await client.post(`/api/worktrees/${worktreeId}/interrupt`, body);
+            if (options.json) {
+                // Verbatim, on the `sync --json` precedent: a field the route grows
+                // later reaches the caller without a line of code here.
+                console.log(JSON.stringify(data, null, 2));
+                return;
+            }
+            console.log(data.message);
+            for (const session of data.interrupted ?? []) {
+                console.log(`  ${session.instanceId}  ${session.cliToolId}  ${session.sessionName}`);
+            }
+        }
+        catch (error) {
+            if (error instanceof api_client_1.ApiError
+                && error.statusCode === 404
+                && error.payload?.error === NO_ACTIVE_SESSIONS_ERROR) {
+                reportNoActiveSessions();
+                return;
+            }
+            // The route's only 400s name the input that could not be resolved
+            // ("Invalid instanceId parameter", "Could not resolve CLI tool for the
+            // specified instance. Provide cliToolId."), which is more use than the
+            // generic "Bad request. Check your input parameters." — same reasoning
+            // as `sync`'s 400 passthrough.
+            if (error instanceof api_client_1.ApiError && error.statusCode === 400 && error.payload?.error) {
+                console.error(`Error: ${error.payload.error}`);
+                process.exit(types_1.ExitCode.CONFIG_ERROR);
+                return;
+            }
+            (0, command_helpers_1.handleCommandError)(error);
+        }
+    });
+    return cmd;
+}

package/dist/cli/commands/report.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/report.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAiFpC,wBAAgB,mBAAmB,IAAI,OAAO,CA6K7C"}
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/report.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAwFpC,wBAAgB,mBAAmB,IAAI,OAAO,CA6K7C"}

package/dist/cli/commands/report.js

@@ -11,8 +11,15 @@ const types_1 = require("../types");
 const api_client_1 = require("../utils/api-client");
 const command_helpers_1 = require("../utils/command-helpers");
 const spinner_1 = require("../utils/spinner");
-/** Allowed tool values for report generation */
-const ALLOWED_TOOLS = ['claude', 'codex', 'copilot', 'antigravity'];
+/**
+ * Allowed tool values for report generation.
+ *
+ * Issue #2044: mirrors `SUMMARY_ALLOWED_TOOLS` (`src/config/review-config.ts`),
+ * which the server validates against. Duplicated rather than imported because
+ * the CLI bundle does not pull `@/config` — the cost of that is this comment,
+ * and `report-opencode-2044.test.ts` asserts the two lists still agree.
+ */
+const ALLOWED_TOOLS = ['claude', 'codex', 'copilot', 'antigravity', 'opencode'];
 /** Validate YYYY-MM-DD date format (client-side) */
 function isValidDate(date) {
     if (!/^\d{4}-\d{2}-\d{2}$/.test(date))
@@ -74,8 +81,8 @@ function createReportCommand() {
         .command('generate')
         .description('Generate a daily report')
         .option('--date <date>', 'Target date (YYYY-MM-DD, default: today)')
-        .option('--tool <tool>', 'AI tool to use (claude, codex, copilot, antigravity)', 'claude')
-        .option('--model <model>', 'Model name (for copilot)')
+        .option('--tool <tool>', `AI tool to use (${ALLOWED_TOOLS.join(', ')})`, 'claude')
+        .option('--model <model>', 'Model name (copilot: --model, opencode: provider/model)')
         .option('--template <id>', 'Template ID to use as instruction')
         .option('--instruction <text>', 'Custom instruction text')
         .option('--token <token>', command_helpers_1.TOKEN_WARNING)

package/dist/cli/commands/respond.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"respond.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/respond.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAUpC,wBAAgB,oBAAoB,IAAI,OAAO,CA6H9C"}
+{"version":3,"file":"respond.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/respond.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAsJpC,wBAAgB,oBAAoB,IAAI,OAAO,CAqK9C"}