commandmate 0.31.2 → 0.32.0

package/dist/server/src/lib/hooks/sources/claude/model-switch.js

@@ -0,0 +1,169 @@
+"use strict";
+/**
+ * Claude Code's `PostModelSwitch` hook, as CommandMate reads it (Issue #2363).
+ *
+ * #2361 detected a `/model` switch off the pane, because the seven events
+ * CommandMate registered never mentioned it: Claude names its model on
+ * `SessionStart` and on nothing else. The same probe found the build emitting
+ * a pair of dedicated hooks, and this module is the structured half of the
+ * answer — the frame reader stays as the fallback (see
+ * `lib/session/agent-event-state`'s `FRAME_OVERTAKES_HOOK_MODEL_TOOLS`).
+ *
+ * ## Measured on claude 2.1.263 (2026-09-06, isolated `CLAUDE_CONFIG_DIR`)
+ *
+ * Re-taken for this Issue rather than inherited from #2361, whose numbers were
+ * a by-product. Payload, delivered verbatim by a `type: "http"` hook injected
+ * through `--settings` — the same channel every other event here uses:
+ *
+ * ```json
+ * {
+ *   "session_id": "…", "transcript_path": "…", "cwd": "…", "prompt_id": "…",
+ *   "hook_event_name": "PostModelSwitch",
+ *   "from_model": "claude-haiku-4-5-20251001",
+ *   "to_model": "claude-sonnet-5",
+ *   "requested_model": "sonnet",
+ *   "source": "command",
+ *   "context_tokens": 0, "prompt_cache_warm": false, "cache_ttl": "5m",
+ *   "estimated_cache_write_usd": 0, "pricing": "catalog"
+ * }
+ * ```
+ *
+ *  - **`to_model` is the model id in the `SessionStart` spelling** —
+ *    `claude-sonnet-5`, `claude-haiku-4-5-20251001`, `claude-opus-5`,
+ *    `claude-opus-5[1m]` — so the latch in `agent-event-state` compares like
+ *    with like, and the `[1m]` suffix travels with it.
+ *  - **`/fast` is a switch**: ON from Haiku reported `to_model:
+ *    "claude-opus-5[1m]"`, `requested_model: null`, `source: "command"`. That
+ *    is the fix for the spelling drift #2361 refused to read (the confirmation
+ *    line says `Opus 5`, the banner `Opus 5 (1M context)`): the hook spells it
+ *    the one way. `/fast` OFF fires nothing and the model stays on Opus.
+ *  - **`requested_model` is null** for `/model default` (→ `claude-opus-5[1m]`)
+ *    and for `/fast`, and is the user's alias (`sonnet`) otherwise. Never read.
+ *  - **`source`** is `command` for `/model <arg>` and `/fast`, `picker` for the
+ *    interactive list (measured with `s`). The schema also names `sdk`, `auto`
+ *    and `resume`; none were reproducible. Not read.
+ *  - **Nothing fires when the model does not change**: `/model haiku` while on
+ *    Haiku, `/fast` while already on Opus 1M, the picker's `Esc` (`Kept model
+ *    as`), and `/effort` all stay silent. `/clear` emits its usual
+ *    `SessionEnd` + `SessionStart` (no `model` key) and no switch.
+ *  - **There is no `model` key on this event.** The generic `modelFields:
+ *    ['model']` lookup answers null for it, which is why the extraction below
+ *    exists rather than a second entry in that list.
+ *
+ * ## Why `from_model` is never read
+ *
+ * It is the model the session was on BEFORE the switch. Reading it as "the
+ * model" would move the latch backwards on the very event that reports a
+ * forward move. It is also the field the paired `PreModelSwitch` got wrong:
+ * in the probe's second session that hook fired **twice per switch**, and on
+ * `/fast` the second of the two named `from_model: "claude-sonnet-5"` for a
+ * session that was on Haiku (`PostModelSwitch` fired once, and agreed with
+ * the screen, every time).
+ *
+ * ## Why `PreModelSwitch` is not registered
+ *
+ * Three measured reasons. It is a decision hook — its response body can block
+ * or redirect the switch — and the event receiver answers a fixed 202 that
+ * decides nothing, so registering it would put a blocking round-trip (5 s at
+ * worst, on a wedged server) in front of every `/model` for no information.
+ * It fired twice per switch with inconsistent values (above). And its
+ * `to_model` is the request, not the outcome — the second of that pair on
+ * `/model haiku` said `to_model: "claude-sonnet-5"`; `PostModelSwitch` alone
+ * is the event that says what happened. The Issue leaves this to
+ * implementation judgement, and this is it.
+ *
+ * ## Which of the seven words
+ *
+ * `notification`, with a subtype of its own ({@link modelSwitchDetail}). A
+ * model switch is the agent telling the human something and is neither a turn
+ * boundary nor a tool call; `agent-event-state` treats a `notification` whose
+ * subtype it does not recognise as evidence of nothing (no status, no dialog,
+ * no turn), and `status-mapping` answers null for it — measured behaviour, not
+ * a hope. The one thing every event does is run the model latch, and that is
+ * the whole point of delivering this one.
+ *
+ * @module lib/hooks/sources/claude/model-switch
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.claudeModelSwitchMapper = exports.MODEL_SWITCH_DETAIL = exports.CLAUDE_PRE_MODEL_SWITCH_EVENT_NAME = exports.CLAUDE_POST_MODEL_SWITCH_EVENT_NAME = void 0;
+exports.modelSwitchDetail = modelSwitchDetail;
+exports.isModelSwitchDetail = isModelSwitchDetail;
+exports.isClaudeModelSwitchPayload = isClaudeModelSwitchPayload;
+exports.extractClaudeSwitchedModel = extractClaudeSwitchedModel;
+const event_mapper_1 = require("../event-mapper");
+/** Claude's own name for the event; the key written into `--settings`. */
+exports.CLAUDE_POST_MODEL_SWITCH_EVENT_NAME = 'PostModelSwitch';
+/**
+ * The paired decision hook, which is deliberately NOT registered — see the
+ * module comment. Named here so the test that pins its absence from the
+ * injected settings spells it the way this module does.
+ */
+exports.CLAUDE_PRE_MODEL_SWITCH_EVENT_NAME = 'PreModelSwitch';
+/**
+ * The subtype a switch is filed under (Issue #2363).
+ *
+ * A word of CommandMate's own, beside Claude's `permission_prompt` /
+ * `idle_prompt` on the same event. Nothing branches on it — the model rides on
+ * the normalised event's `model`, not on the subtype — but two things read it:
+ * `structuredEvents.lastEventDetail` shows it, and the receiver's
+ * de-duplication key carries it. See {@link modelSwitchDetail} for why the
+ * target model is appended.
+ */
+exports.MODEL_SWITCH_DETAIL = 'model_switch';
+/** The payload key that names the model the session is now on. */
+const TO_MODEL_FIELD = 'to_model';
+/**
+ * `model_switch:<to_model>`, or the bare word when the switch names no target.
+ *
+ * The target is part of the subtype because the subtype is part of the
+ * receiver's de-duplication key: `(instance, event, detail, session_id)` within
+ * a 3 s window (`isDuplicateAgentEvent`). With a fixed word, two switches to
+ * DIFFERENT models inside that window — the picker's `s` followed by `/fast`,
+ * a `/model` typed twice to correct itself — would collapse into one and the
+ * second target would be lost until the frame caught up. With the target in
+ * the key, only a second delivery of the SAME switch collapses, which is the
+ * case the window exists for (a user's own `PostModelSwitch` hook is
+ * concatenated with the injected one, and both name the same `to_model`).
+ */
+function modelSwitchDetail(toModel) {
+    return toModel === null ? exports.MODEL_SWITCH_DETAIL : `${exports.MODEL_SWITCH_DETAIL}:${toModel}`;
+}
+/** Whether a recorded `detail` is one this module wrote, target or no target. */
+function isModelSwitchDetail(detail) {
+    return detail === exports.MODEL_SWITCH_DETAIL || (detail?.startsWith(`${exports.MODEL_SWITCH_DETAIL}:`) ?? false);
+}
+/** True for the one native event this module speaks for. */
+function isClaudeModelSwitchPayload(payload) {
+    return (0, event_mapper_1.readStringField)(payload, 'hook_event_name') === exports.CLAUDE_POST_MODEL_SWITCH_EVENT_NAME;
+}
+/**
+ * The rule that maps `PostModelSwitch` onto `notification(model_switch:<to_model>)`.
+ *
+ * Appended after the shared CamelCase table in `./source`, so every spelling
+ * that table already claims keeps its word.
+ */
+const claudeModelSwitchMapper = (nativeEventName, payload) => nativeEventName === exports.CLAUDE_POST_MODEL_SWITCH_EVENT_NAME
+    ? {
+        event: 'notification',
+        detail: modelSwitchDetail((0, event_mapper_1.readStringField)(payload, TO_MODEL_FIELD)),
+    }
+    : null;
+exports.claudeModelSwitchMapper = claudeModelSwitchMapper;
+/**
+ * The model a `PostModelSwitch` reports, or null for any other payload.
+ *
+ * `to_model` and only `to_model`: `from_model` is the value being left behind
+ * and `requested_model` is an alias that is null for `/model default` and
+ * `/fast`. Answers null for a switch that somehow carries no `to_model`, which
+ * the caller (`buildNormalizedEvent`) turns into "this event names no model"
+ * — the latch is left where it was rather than blanked or reversed.
+ *
+ * Declared as the source's `extractModel`, which runs before the flat
+ * `modelFields` lookup; for every other event it answers null and the lookup
+ * proceeds exactly as it did before this Issue.
+ */
+function extractClaudeSwitchedModel(payload) {
+    if (!isClaudeModelSwitchPayload(payload))
+        return null;
+    return (0, event_mapper_1.readStringField)(payload, TO_MODEL_FIELD);
+}

package/dist/server/src/lib/hooks/sources/claude/source.js

@@ -41,6 +41,7 @@ const permission_request_payload_1 = require("../../../../lib/hooks/permission-r
 const define_source_1 = require("../define-source");
 const event_mapper_1 = require("../event-mapper");
 const hook_event_vocabulary_1 = require("../hook-event-vocabulary");
+const model_switch_1 = require("./model-switch");
 const tool_id_1 = require("./tool-id");
 /**
  * The no-decision body, byte for byte what the #1721 spike returned for D5.
@@ -129,7 +130,12 @@ exports.claudeAgentEventSource = (0, define_source_1.definePushHookSource)({
     // word, no predicates — so it is expressed as rules built from the table
     // rather than as a table, and a source that needs conditions (opencode) adds
     // them to the same list.
-    mappers: (0, event_mapper_1.fromNameTable)(hook_event_vocabulary_1.CAMEL_CASE_HOOK_EVENT_NAMES),
+    //
+    // Issue #2363: plus the one spelling that is Claude's alone. `PostModelSwitch`
+    // is filed as `notification(model_switch:<to_model>)` — see `./model-switch`
+    // for the measurement and for why its `Pre` twin is not here. Appended after
+    // the shared table so nothing that table claims changes its word.
+    mappers: [...(0, event_mapper_1.fromNameTable)(hook_event_vocabulary_1.CAMEL_CASE_HOOK_EVENT_NAMES), model_switch_1.claudeModelSwitchMapper],
     nativeEventNameFields: ['hook_event_name'],
     conversationIdFields: hook_event_vocabulary_1.SESSION_ID_FIELDS,
     toolCallIdFields: hook_event_vocabulary_1.TOOL_CALL_ID_FIELDS,
@@ -140,6 +146,13 @@ exports.claudeAgentEventSource = (0, define_source_1.definePushHookSource)({
     // does that. The value arrives with its own suffix (`claude-opus-5[1m]`) and
     // is not parsed here: a display string the tool chose is the tool's to spell.
     modelFields: ['model'],
+    // Issue #2363. The second and only other event that names a model, and it
+    // names it under a different key: `PostModelSwitch` carries `to_model` (the
+    // model the session is now on) and no `model` at all. Read there, and only
+    // there — `from_model` is the value being left behind and must never reach
+    // the latch. `extractModel` runs before `modelFields`, and answers null for
+    // every other event so the flat lookup above is unchanged for them.
+    extractModel: model_switch_1.extractClaudeSwitchedModel,
     // S2.
     extractDetail: hook_event_vocabulary_1.extractSnakeCaseEventDetail,
     // S7. Both parsers are strict and answer null for anything they cannot vouch

package/dist/server/src/lib/polling/response-checker.js

@@ -3,6 +3,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.incompleteResult = incompleteResult;
 exports.buildPromptExtractionResult = buildPromptExtractionResult;
+exports.detectPromptOnCleanFrame = detectPromptOnCleanFrame;
 exports.detectPromptWithOptions = detectPromptWithOptions;
 exports.extractResponse = extractResponse;
 exports.checkForResponse = checkForResponse;
@@ -11,6 +12,7 @@ const db_instance_1 = require("../../lib/db/db-instance");
 const db_1 = require("../../lib/db");
 const ws_server_1 = require("../../lib/ws-server");
 const prompt_detector_1 = require("../../lib/detection/prompt-detector");
+const dialog_1 = require("../../lib/detection/tools/antigravity/dialog");
 const conversation_logger_1 = require("../../lib/conversation-logger");
 const types_1 = require("../../lib/cli-tools/types");
 const claude_output_1 = require("../../lib/claude-output");
@@ -28,6 +30,7 @@ const prompt_dedup_1 = require("./prompt-dedup");
 const prompt_dedup_state_1 = require("./prompt-dedup-state");
 const response_dedup_1 = require("./response-dedup");
 const structured_history_gate_1 = require("./structured-history-gate");
+const relay_triggers_1 = require("../../lib/relay/relay-triggers");
 // Issue #2317 Phase D: while a human holds the pane's geometry, the frame is
 // their terminal (44 rows), not the 1000-row canvas every rule below was
 // measured against. See the block in `checkForResponse` for what that changes.
@@ -179,6 +182,49 @@ function buildPromptExtractionResult(lines, lastCapturedLine, totalLines, buffer
         captureWindowSaturated,
     };
 }
+/**
+ * The one reading of a frame that every consumer of it shares, for a capture
+ * that has ALREADY been through `stripBoxDrawing(stripAnsi(…))`.
+ *
+ * Split out of {@link detectPromptWithOptions} by Issue #2368 so the Auto-Yes
+ * poller can reach it. That poller cleans its own capture once per tick
+ * (`captureAndCleanOutput`) and reuses the cleaned string and its line split for
+ * the stop-condition delta, the dialog gate and the thinking check, so handing
+ * it back through `detectPromptWithOptions` would clean it a SECOND time — and
+ * `stripBoxDrawing` is not idempotent (it removes one leading `│` per pass, so a
+ * doubly-bordered row loses a second character on the second pass). Taking the
+ * already-clean frame here is what keeps the two callers reading identical text.
+ *
+ * @param cleanOutput - tmux output with ANSI **and** box drawing already removed
+ * @param cliToolId - CLI tool identifier for building detection options
+ * @param precomputedLines - `cleanOutput.split('\n')` when the caller already has it
+ *   (Issue #499 Item 4); must be the split of THIS string, not of the raw capture
+ * @returns PromptDetectionResult with isPrompt, promptData, and cleanContent
+ */
+function detectPromptOnCleanFrame(cleanOutput, cliToolId, precomputedLines) {
+    // Issue #2364: agy's `↑/↓ Navigate` dialogs are read by agy's own reader
+    // before the generic pass, on the same spelling `tools/antigravity/detect.ts`
+    // reads them on. The generic multiple-choice parser takes one row per option
+    // and agy wraps a long command across several rows of one label, so without
+    // this the poller stored nothing for the frame the status API published as a
+    // prompt — and, on the file-creation menu, stored a question with the diff
+    // preview joined into it. One reader for both producers is what makes the
+    // stored `prompt` row, the push notification's excerpt and `/current-output`
+    // agree about one screen.
+    //
+    // Issue #2368: and the Auto-Yes poller, which was the one consumer #2364 left
+    // on the generic pass. agy's Bash approvals wrap their option labels with no
+    // indentation, `isContinuationLine` refuses those rows, and the frame came
+    // back `isPrompt: false` — so Auto-Yes sent nothing at all while the status
+    // API published the very same screen as an answerable four-option prompt.
+    if (cliToolId === 'antigravity') {
+        const dialog = (0, dialog_1.detectAntigravityNumberedDialogPrompt)(cleanOutput);
+        if (dialog !== null)
+            return dialog;
+    }
+    const promptOptions = (0, cli_patterns_1.buildDetectPromptOptions)(cliToolId);
+    return (0, prompt_detector_1.detectPrompt)(cleanOutput, precomputedLines ? { ...promptOptions, precomputedLines } : promptOptions);
+}
 /**
  * Internal helper: detect prompt with CLI-tool-specific options.
  *
@@ -190,8 +236,7 @@ function buildPromptExtractionResult(lines, lastCapturedLine, totalLines, buffer
  * @returns PromptDetectionResult with isPrompt, promptData, and cleanContent
  */
 function detectPromptWithOptions(output, cliToolId) {
-    const promptOptions = (0, cli_patterns_1.buildDetectPromptOptions)(cliToolId);
-    return (0, prompt_detector_1.detectPrompt)((0, cli_patterns_1.stripBoxDrawing)((0, cli_patterns_1.stripAnsi)(output)), promptOptions);
+    return detectPromptOnCleanFrame((0, cli_patterns_1.stripBoxDrawing)((0, cli_patterns_1.stripAnsi)(output)), cliToolId);
 }
 // ============================================================================
 // extractResponse (internal)
@@ -1030,6 +1075,14 @@ async function checkForResponse(worktreeId, cliToolId, instanceId) {
             });
             // Broadcast message to WebSocket clients
             (0, ws_server_1.broadcastMessage)('message', { worktreeId, message });
+            // Issue #2377: the scrape path's completion edge. `settled: false` is the
+            // whole difference from the gate's own announcement: this row was read off
+            // a SCREEN whose completion was judged by string analysis, so a relay
+            // waiting on this session re-reads after a few seconds of quiet before it
+            // delivers — the Issue's 「完了検知 + 数秒の静穏」 for the three tools that
+            // keep no transcript. Announced here rather than after the `if` because
+            // the suppressed branch means the gate already announced it, settled.
+            (0, relay_triggers_1.onRelayTurnCompleted)(worktreeId, cliToolId, resolvedInstanceId, false);
         }
         else {
             logger.info('structured-history-scrape-suppressed', {

package/dist/server/src/lib/polling/structured-history-gate.js

@@ -81,6 +81,7 @@ const tool_id_2 = require("../../lib/hooks/sources/codex/tool-id");
 const tool_id_3 = require("../../lib/hooks/sources/antigravity/tool-id");
 const tool_id_4 = require("../../lib/hooks/sources/command-code/tool-id");
 const registry_1 = require("../../lib/hooks/sources/registry");
+const relay_triggers_1 = require("../../lib/relay/relay-triggers");
 const logger = (0, logger_1.createLogger)('lib/polling/structured-history-gate');
 /**
  * One in-flight capture per instance (Issue #2246).
@@ -286,7 +287,19 @@ async function captureStructuredHistoryTurn(worktreeId, cliToolId, instanceId, c
     const resolvedInstanceId = instanceId ?? cliToolId;
     return serializePerInstance(captureKeyOf(worktreeId, cliToolId, resolvedInstanceId), async () => {
         try {
-            return await reader.capture({ worktreeId, cliToolId, instanceId: resolvedInstanceId }, capture);
+            const captured = await reader.capture({ worktreeId, cliToolId, instanceId: resolvedInstanceId }, capture);
+            // Issue #2377: the moment a relay is waiting for. This is the single
+            // point BOTH triggers of a pull capture pass through — the poller's save
+            // path and the Stop hook receiver — which is why the relay needs one
+            // hook here and not one in each of them. The turn is closed by the
+            // agent's own account, so the delivery needs no quiet window.
+            //
+            // Announced only when the capture actually wrote something: a `false`
+            // means the scraper is still the writer for this turn, and the poller's
+            // own call below will announce it.
+            if (captured)
+                (0, relay_triggers_1.onRelayTurnCompleted)(worktreeId, cliToolId, resolvedInstanceId, true);
+            return captured;
         }
         catch (error) {
             logger.warn('structured-history-capture-unavailable', {

package/dist/server/src/lib/push/index.js

@@ -2,7 +2,7 @@
 /** Web Push module barrel (Issue #1125). */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.notifyPromptResolved = exports.decidePromptResolution = exports.MAX_ESCALATION_THRESHOLD_MINUTES = exports.MIN_ESCALATION_THRESHOLD_MINUTES = exports.ESCALATION_SETTINGS_KEY = exports.ESCALATION_THRESHOLD_CHOICES = exports.DEFAULT_ESCALATION_SETTINGS = exports.normalizeEscalationSettings = exports.setPushEscalationSettings = exports.getPushEscalationSettings = exports.ESCALATION_TICK_MS = exports.pendingEscalationCount = exports.runEscalationTick = exports.handleWaitingTransition = exports.isWaitingPushNotifierActive = exports.stopWaitingPushNotifier = exports.startWaitingPushNotifier = exports.UPSTREAM_FAULT_COOLDOWN_MS = exports.clearUpstreamFaultEpisodes = exports.observeUpstreamFaultEdge = exports.notifySessionStartFailurePush = exports.notifyUpstreamFaultPush = exports.notifyVerificationFailurePush = exports.isPromptPushSuppressed = exports.decidePromptPush = exports.resetWaitingPushDedup = exports.shouldSendWaitingPush = exports.DEFAULT_DEDUP_WINDOW_MS = exports.resetNotificationDedup = exports.shouldSendNotification = exports.resolvePushLocale = exports.buildExcerpt = exports.buildPushPayload = exports.notifyPushSubscribers = exports.PUSH_DELIVERY_HEALTH_MAX_AGE_MS = exports.PUSH_DELIVERY_HEALTH_KEY_PREFIX = exports.clearAllPushDeliveryHealth = exports.clearPushDeliveryHealth = exports.recordPushDeliveryFailure = exports.getPushDeliveryHealth = exports.VAPID_ENV_KEYS = exports.VAPID_DEFAULT_SUBJECT = exports.extractVapidSubjectHost = exports.classifyVapidSubject = exports.runVapidSelfCheck = exports.formatVapidReportLines = exports.inspectVapidConfig = exports.getVapidPublicKey = exports.isPushConfigured = exports.getVapidConfig = void 0;
-exports.PROMPT_CARD_MAX_AGE_MS = exports.PROMPT_CARD_KEY_PREFIX = exports.promptCardCount = exports.forgetPromptCardMemory = exports.clearAllPromptCards = exports.clearPromptCard = exports.hasPromptCard = exports.markPromptCardShown = exports.MIN_DEVICES_FOR_CROSS_DEVICE_CLEAR = void 0;
+exports.MODEL_CHANGE_TAG_SUFFIX = exports.resolveReadersLocale = exports.buildModelChangedBodies = exports.buildModelChangedSentence = exports.notifyModelChangePush = exports.PROMPT_CARD_MAX_AGE_MS = exports.PROMPT_CARD_KEY_PREFIX = exports.promptCardCount = exports.forgetPromptCardMemory = exports.clearAllPromptCards = exports.clearPromptCard = exports.hasPromptCard = exports.markPromptCardShown = exports.MIN_DEVICES_FOR_CROSS_DEVICE_CLEAR = void 0;
 var vapid_1 = require("./vapid");
 Object.defineProperty(exports, "getVapidConfig", { enumerable: true, get: function () { return vapid_1.getVapidConfig; } });
 Object.defineProperty(exports, "isPushConfigured", { enumerable: true, get: function () { return vapid_1.isPushConfigured; } });
@@ -93,3 +93,15 @@ Object.defineProperty(exports, "forgetPromptCardMemory", { enumerable: true, get
 Object.defineProperty(exports, "promptCardCount", { enumerable: true, get: function () { return prompt_card_state_1.promptCardCount; } });
 Object.defineProperty(exports, "PROMPT_CARD_KEY_PREFIX", { enumerable: true, get: function () { return prompt_card_state_1.PROMPT_CARD_KEY_PREFIX; } });
 Object.defineProperty(exports, "PROMPT_CARD_MAX_AGE_MS", { enumerable: true, get: function () { return prompt_card_state_1.PROMPT_CARD_MAX_AGE_MS; } });
+// The model edge's push (Issue #2357).
+// NOTE: `realtime/model-change-broadcast` imports these from
+// './model-change-push-notifier' directly, for the reason every block above
+// gives — a suite that stubs the whole '@/lib/push' barrel would otherwise
+// leave the notifier undefined on the path it guards.
+var model_change_push_notifier_1 = require("./model-change-push-notifier");
+Object.defineProperty(exports, "notifyModelChangePush", { enumerable: true, get: function () { return model_change_push_notifier_1.notifyModelChangePush; } });
+Object.defineProperty(exports, "buildModelChangedSentence", { enumerable: true, get: function () { return model_change_push_notifier_1.buildModelChangedSentence; } });
+Object.defineProperty(exports, "buildModelChangedBodies", { enumerable: true, get: function () { return model_change_push_notifier_1.buildModelChangedBodies; } });
+Object.defineProperty(exports, "resolveReadersLocale", { enumerable: true, get: function () { return model_change_push_notifier_1.resolveReadersLocale; } });
+var push_sender_2 = require("./push-sender");
+Object.defineProperty(exports, "MODEL_CHANGE_TAG_SUFFIX", { enumerable: true, get: function () { return push_sender_2.MODEL_CHANGE_TAG_SUFFIX; } });

package/dist/server/src/lib/push/model-change-push-notifier.js

@@ -0,0 +1,174 @@
+"use strict";
+/**
+ * The wording of "the model changed", and the push that carries it
+ * (Issue #2357).
+ *
+ * ## What this module owns
+ *
+ * Three things, and the first is the reason the other two live together:
+ *
+ *  1. **The sentence.** `Model changed from gpt-5.6-sol to gpt-5-mini`, in the
+ *     reader's language, from `locales/<locale>/worktree.json` —
+ *     `agentModel.changed`, next to the session row that shows the value on the
+ *     phone. It is rendered here rather than in `push-sender` because it is also
+ *     what the history row says: the model edge writes one row into
+ *     `chat_messages` and sends one push, and a reader comparing the two must
+ *     find the same words.
+ *  2. **Which language the history row is written in.** A row is stored once,
+ *     and the server has no request to read a cookie from — the edge fires from
+ *     the hook route or the status poll, neither of which is the reader. The
+ *     best evidence it has is the language the readers registered their push
+ *     subscriptions in, so the newest subscription's locale is used, and the
+ *     default locale when nobody has registered one.
+ *  3. **The push itself.** One per transition, through `notifyPushSubscribers`,
+ *     on the `enabled_prompt` bucket (see `NotificationEvent.modelChange` for
+ *     why that bucket and why the transport kind reads `failure`).
+ *
+ * ## Why the dictionaries are static imports
+ *
+ * The same constraint `push-sender` documents: this module is reached from the
+ * custom server's graph (`ws-server` → `waiting-broadcast` →
+ * `model-change-broadcast` → here) and is therefore emitted into `dist/server`
+ * as CommonJS, where `next-intl` (ESM-only) cannot be required. The JSON is
+ * imported directly and `{from}` / `{to}` are substituted by hand.
+ *
+ * @module lib/push/model-change-push-notifier
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildModelChangedSentence = buildModelChangedSentence;
+exports.buildModelChangedBodies = buildModelChangedBodies;
+exports.resolveReadersLocale = resolveReadersLocale;
+exports.notifyModelChangePush = notifyModelChangePush;
+const i18n_config_1 = require("../../config/i18n-config");
+const db_instance_1 = require("../../lib/db/db-instance");
+const push_subscriptions_db_1 = require("../../lib/db/push-subscriptions-db");
+const worktree_db_1 = require("../../lib/db/worktree-db");
+const logger_1 = require("../../lib/logger");
+const worktree_json_1 = __importDefault(require("../../../locales/en/worktree.json"));
+const worktree_json_2 = __importDefault(require("../../../locales/ja/worktree.json"));
+const push_sender_1 = require("./push-sender");
+const vapid_1 = require("./vapid");
+const logger = (0, logger_1.createLogger)('push/model-change-notifier');
+/**
+ * The one sentence, per locale. Keyed by `SupportedLocale` so adding a locale
+ * without a dictionary is a type error here rather than an English push in a
+ * Japanese install.
+ */
+const MODEL_CHANGED_TEMPLATES = {
+    en: worktree_json_1.default.agentModel.changed,
+    ja: worktree_json_2.default.agentModel.changed,
+};
+/**
+ * "Model changed from {from} to {to}", in one language.
+ *
+ * `from` / `to` are the resolved values `sessionStatusByInstance[].model`
+ * publishes, verbatim — the same string the phone's session row shows, so the
+ * sentence and the row cannot name the same model two ways.
+ */
+function buildModelChangedSentence(locale, from, to) {
+    return MODEL_CHANGED_TEMPLATES[(0, push_sender_1.resolvePushLocale)(locale)]
+        .replace('{from}', from)
+        .replace('{to}', to);
+}
+/** The sentence in every supported language, for a per-device fan-out. */
+function buildModelChangedBodies(from, to) {
+    const bodies = {};
+    for (const locale of i18n_config_1.SUPPORTED_LOCALES) {
+        bodies[locale] = buildModelChangedSentence(locale, from, to);
+    }
+    return bodies;
+}
+/**
+ * The language the history row should be written in (Issue #2357).
+ *
+ * The newest push subscription's locale, because that is the only place the
+ * server has ever been told what language a reader reads in — registration
+ * resolves it the way the UI does (`resolveLocale`, cookie then
+ * `Accept-Language`) and stores it on the row. No subscription at all means the
+ * default locale, which is what the UI shows a reader who has chosen nothing.
+ *
+ * Never throws: a database that cannot answer is a reason to write the row in
+ * the default language, not a reason to write no row.
+ */
+function resolveReadersLocale(db) {
+    try {
+        const subscriptions = (0, push_subscriptions_db_1.getAllPushSubscriptions)(db);
+        let newest = null;
+        for (const sub of subscriptions) {
+            const updatedAt = sub.updatedAt.getTime();
+            if (newest === null || updatedAt > newest.updatedAt) {
+                newest = { updatedAt, locale: sub.locale };
+            }
+        }
+        return (0, push_sender_1.resolvePushLocale)(newest?.locale ?? i18n_config_1.DEFAULT_LOCALE);
+    }
+    catch {
+        return i18n_config_1.DEFAULT_LOCALE;
+    }
+}
+/**
+ * The worktree's display name, for the notification title. Falls back to the
+ * id rather than dropping the notification — the same rule
+ * `waiting-push-notifier` applies.
+ */
+function resolveWorktreeName(worktreeId) {
+    try {
+        return (0, worktree_db_1.getWorktreeById)((0, db_instance_1.getDbInstance)(), worktreeId)?.name ?? worktreeId;
+    }
+    catch {
+        return worktreeId;
+    }
+}
+/**
+ * Notify every opted-in device that this instance changed model (Issue #2357).
+ *
+ * States the fact and nothing more — no ranking, no "downgraded", because the
+ * Issue rules that out and because the server has no table that could say
+ * which of two models is the lesser. Never throws; push is advisory and the
+ * edge that called this has already been observed.
+ *
+ * @returns Null when a fan-out was attempted, otherwise why it was not.
+ */
+async function notifyModelChangePush(change) {
+    if (!(0, vapid_1.isPushConfigured)()) {
+        logger.debug('model-change-push-suppressed', {
+            worktreeId: change.worktreeId,
+            instanceId: change.instanceId,
+            reason: 'unconfigured',
+        });
+        return 'unconfigured';
+    }
+    try {
+        await (0, push_sender_1.notifyPushSubscribers)({
+            worktreeId: change.worktreeId,
+            worktreeName: resolveWorktreeName(change.worktreeId),
+            // The delivery bucket, not the meaning — see `NotificationEvent.modelChange`.
+            kind: 'failure',
+            agentName: change.instanceId,
+            instanceId: change.instanceId,
+            modelChange: {
+                from: change.from,
+                to: change.to,
+                body: buildModelChangedBodies(change.from, change.to),
+            },
+        }, change.at);
+        logger.info('model-change-push-raised', {
+            worktreeId: change.worktreeId,
+            instanceId: change.instanceId,
+            from: change.from,
+            to: change.to,
+            source: change.source,
+        });
+    }
+    catch (error) {
+        logger.warn('model-change-push-failed', {
+            worktreeId: change.worktreeId,
+            instanceId: change.instanceId,
+            error: error instanceof Error ? error.message : String(error),
+        });
+    }
+    return null;
+}

package/dist/server/src/lib/push/push-sender.js

@@ -27,6 +27,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.MODEL_CHANGE_TAG_SUFFIX = void 0;
 exports.resolvePushLocale = resolvePushLocale;
 exports.buildExcerpt = buildExcerpt;
 exports.buildPushPayload = buildPushPayload;
@@ -51,6 +52,11 @@ const PUSH_MESSAGES = {
     en: notifications_json_1.default.push,
     ja: notifications_json_2.default.push,
 };
+/**
+ * The `tag` segment a model-change card carries in place of its kind
+ * (Issue #2357). Exported so the notifier's tests can name the card they expect.
+ */
+exports.MODEL_CHANGE_TAG_SUFFIX = 'model';
 /**
  * Narrow a stored subscription locale to one we can actually render.
  * Subscriptions registered before v42 have `locale = NULL` and land on
@@ -147,25 +153,31 @@ function buildPushPayload(event, locale = i18n_config_1.DEFAULT_LOCALE, now = Da
     const excerpt = buildExcerpt(event.excerpt);
     const agentSuffix = event.agentName ? ` (${event.agentName})` : '';
     const title = `${event.worktreeName}${agentSuffix}`;
-    const messages = PUSH_MESSAGES[resolvePushLocale(locale)];
-    const body = event.kind === 'prompt'
-        ? // Issue #2001: the resolution's body replaces the stale card's, so it
-            // has to answer the question that card asked. It quotes no excerpt —
-            // the prompt is over, and repeating it would read as a new one.
-            event.resolved === true
-                ? messages.promptResolved
-                : buildWaitingBody(event, messages, excerpt, now)
-        : event.kind === 'failure'
-            ? buildFailureBody(event, messages, excerpt)
-            : // Issue #2045: an update notice is a completion by *bucket*, not by
-                // content, so it is the one completion whose body is not "Done".
-                event.updateAvailable
-                    ? messages.updateAvailable
-                        .replace('{agent}', event.updateAvailable.agent)
-                        .replace('{version}', event.updateAvailable.version)
-                    : excerpt
-                        ? messages.completionWithExcerpt.replace('{excerpt}', excerpt)
-                        : messages.completion;
+    const resolvedLocale = resolvePushLocale(locale);
+    const messages = PUSH_MESSAGES[resolvedLocale];
+    const body = 
+    // Issue #2357: read first, because the event's `kind` is the bucket it is
+    // delivered to and says nothing about what it is. See `modelChange`.
+    event.modelChange
+        ? event.modelChange.body[resolvedLocale]
+        : event.kind === 'prompt'
+            ? // Issue #2001: the resolution's body replaces the stale card's, so it
+                // has to answer the question that card asked. It quotes no excerpt —
+                // the prompt is over, and repeating it would read as a new one.
+                event.resolved === true
+                    ? messages.promptResolved
+                    : buildWaitingBody(event, messages, excerpt, now)
+            : event.kind === 'failure'
+                ? buildFailureBody(event, messages, excerpt)
+                : // Issue #2045: an update notice is a completion by *bucket*, not by
+                    // content, so it is the one completion whose body is not "Done".
+                    event.updateAvailable
+                        ? messages.updateAvailable
+                            .replace('{agent}', event.updateAvailable.agent)
+                            .replace('{version}', event.updateAvailable.version)
+                        : excerpt
+                            ? messages.completionWithExcerpt.replace('{excerpt}', excerpt)
+                            : messages.completion;
     return {
         kind: event.kind,
         title,
@@ -176,7 +188,12 @@ function buildPushPayload(event, locale = i18n_config_1.DEFAULT_LOCALE, now = Da
         // Unchanged by #1790, and deliberately: the escalation carries the same tag
         // as the notification it follows up, so the Service Worker replaces the
         // stale one instead of stacking a second card for the same wait.
-        tag: `${event.worktreeId}:${event.kind}`,
+        // Issue #2357: a model change gets a tag of its own, so it neither replaces
+        // a failure card (its transport bucket) nor is replaced by one; two changes
+        // of the same worktree do collapse, which is right — the newer is the fact.
+        tag: event.modelChange
+            ? `${event.worktreeId}:${exports.MODEL_CHANGE_TAG_SUFFIX}`
+            : `${event.worktreeId}:${event.kind}`,
         timestamp: now,
         ...(event.waitingKind ? { waitingKind: event.waitingKind } : {}),
         ...(event.resolved === true ? { resolved: true } : {}),
@@ -252,6 +269,17 @@ function passesDedup(event) {
     // uses, so the two would suppress each other on a 30 s window neither wants.
     if (event.resolved === true)
         return true;
+    // Issue #2357: keyed on the transition, not on its wording — the body is
+    // localized per device and the same change must not send twice because two
+    // readers speak different languages. The producer already emits one edge per
+    // transition; this is the second net, on the same 30 s window as the rest.
+    if (event.modelChange) {
+        return (0, notification_dedup_1.shouldSendNotification)({
+            worktreeId: event.worktreeId,
+            kind: event.kind,
+            content: `${exports.MODEL_CHANGE_TAG_SUFFIX}:${event.instanceId ?? event.agentName ?? ''}:${event.modelChange.from}>${event.modelChange.to}`,
+        });
+    }
     if (event.kind === 'prompt' && typeof event.waitingSince === 'number') {
         return (0, notification_dedup_1.shouldSendWaitingPush)({
             worktreeId: event.worktreeId,