commandmate 0.37.0 → 0.38.1

package/dist/cli/commands/ls.d.ts

@@ -3,6 +3,70 @@
  * Issue #518: [DR1-08] Factory pattern with createLsCommand()
  */
 import { Command } from 'commander';
+import type { WorktreeItem } from '../types/api-responses';
+/** One entry of the per-CLI-tool status map the list API publishes. */
+export type CliStatusEntry = NonNullable<WorktreeItem['sessionStatusByCli']>[string];
+/**
+ * One instance's Auto-Yes arming, as `GET /api/worktrees` sends it (Issue #2512).
+ *
+ * Mirrors: src/types/auto-yes.ts AutoYesInstanceSummary.
+ *
+ * A copy rather than an import: `tsconfig.cli.json` sets `"paths": {}`, so
+ * nothing under `src/cli` can reach `@/types/auto-yes`. The copy is kept honest
+ * by a bidirectional `AssertAssignable` in
+ * `tests/unit/cli/commands/ls-auto-yes-2575.test.ts`, which `npx tsc --noEmit`
+ * evaluates — the same guard #1843 uses for the suppression-reason union.
+ *
+ * Only ARMED instances appear in the map: the server folds expired and
+ * turned-off states away as it reads them (`getEnabledAutoYesByWorktree`), so a
+ * missing key means "not armed right now" and carries no reason. Why it stopped
+ * lives in `commandmate capture --json`'s `autoYes.stopReason`.
+ */
+export type AutoYesInstanceWire = {
+    enabled: boolean;
+    expiresAt: number | null;
+};
+/**
+ * A list row with the two maps this command reads and `WorktreeItem` does not
+ * declare (Issue #2575).
+ *
+ * `src/cli/types/api-responses.ts` declares only the fields the CLI reads, and
+ * until this column nothing read either of these. Widened HERE rather than
+ * there, on the precedent of `PeerWorktreeItem` in `peers.ts`: the shared mirror
+ * keeps meaning what its header says, and a row from a server that predates
+ * #2512 (no `autoYesByInstance`) or answered `?includeStatus=0` (no
+ * `sessionStatusByInstance`) is still a valid row — hence both optional.
+ *
+ * `sessionStatusByInstance` is the UN-aggregated map. `sessionStatusByCli` next
+ * to it is the logical-OR over every instance of a tool, which is the right
+ * input for REASON (#1926) and the wrong one here: Auto-Yes is armed per
+ * INSTANCE, so an aggregate cannot say whether it was `claude` or `claude-2`
+ * that raised the wait.
+ *
+ * Exported so tests can assert against the wire shape rather than restate it.
+ */
+export interface LsWorktreeItem extends WorktreeItem {
+    autoYesByInstance?: Record<string, AutoYesInstanceWire>;
+    sessionStatusByInstance?: Partial<Record<string, CliStatusEntry>>;
+}
+/**
+ * `MM:SS`, or `H:MM:SS` from an hour up — the Web UI countdown's format.
+ *
+ * A second spelling of `formatTimeRemaining` (`src/config/auto-yes-config.ts`)
+ * on purpose, and the only duplication Issue #2575 accepts. That module imports
+ * `@/config/tmux-pane-config`, and `tsconfig.cli.json` sets `"paths": {}`, so a
+ * CLI module importing it compiles under lint / `tsc --noEmit` / vitest (all
+ * three resolve `@/`) and breaks only at `npm run build:cli` — a trap worth
+ * avoiding rather than walking into. The two are pinned to the same strings at
+ * the boundaries by `ls-auto-yes-2575.test.ts`, so an operator reads the same
+ * number in the browser and in the terminal.
+ *
+ * Takes a DURATION, not a deadline: the caller has already resolved `now` once
+ * for the whole table, and passing the deadline here would re-read the clock per
+ * row. Truncating means 0 < remaining < 1 s prints `00:00`, exactly as the
+ * browser countdown does one tick before it flips to OFF.
+ */
+export declare function formatAutoYesRemaining(remainingMs: number): string;
 /**
  * Create the ls command.
  * [DR1-08] Factory pattern for addCommand() registration.

package/dist/cli/commands/ls.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ls.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/ls.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA6LpC;;;GAGG;AACH,wBAAgB,eAAe,IAAI,OAAO,CA8CzC"}
+{"version":3,"file":"ls.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/ls.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,KAAK,EAAwB,YAAY,EAAE,MAAM,wBAAwB,CAAC;AA0BjF,uEAAuE;AACvE,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,YAAY,CAAC,oBAAoB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAErF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAEjF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,cAAe,SAAQ,YAAY;IAClD,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACxD,uBAAuB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;CACnE;AAoFD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAUlE;AAoOD;;;GAGG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAkFzC"}

package/dist/cli/commands/ls.js

@@ -4,6 +4,7 @@
  * Issue #518: [DR1-08] Factory pattern with createLsCommand()
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatAutoYesRemaining = formatAutoYesRemaining;
 exports.createLsCommand = createLsCommand;
 const commander_1 = require("commander");
 const api_client_1 = require("../utils/api-client");
@@ -31,6 +32,32 @@ function deriveStatus(wt) {
         return 'ready';
     return 'idle';
 }
+/**
+ * Whether this status entry is one of the sessions that produced `status`.
+ *
+ * `deriveStatus` folds every session of the worktree into one word, so any cell
+ * that claims to be ABOUT that word has to be sourced from a session that
+ * produced it. Two columns need the predicate and must not drift apart: REASON
+ * (#1926) applies it per tool, AUTO_YES (#2575) applies it per instance.
+ *
+ * `idle` is explained by exactly one thing (Issue #2070): `exited`, the tmux
+ * session still there with no agent in it. Everything else idle is unexplained
+ * — no entry matches, REASON stays `-`, and AUTO_YES falls back to every armed
+ * instance.
+ */
+function explainsStatus(entry, status) {
+    if (!entry)
+        return false;
+    if (status === 'waiting')
+        return entry.isWaitingForResponse;
+    if (status === 'running')
+        return entry.isProcessing;
+    if (status === 'ready')
+        return entry.isRunning;
+    if (status === 'idle')
+        return entry.sessionStatusReason === status_reason_1.STATUS_REASON.EXITED;
+    return false;
+}
 /**
  * The per-tool status entry that explains this row's STATUS (Issue #1926).
  *
@@ -48,28 +75,10 @@ function pickStatusEntry(wt, status) {
     const byCli = wt.sessionStatusByCli;
     if (!byCli)
         return undefined;
-    const explains = (entry) => {
-        if (!entry)
-            return false;
-        if (status === 'waiting')
-            return entry.isWaitingForResponse;
-        if (status === 'running')
-            return entry.isProcessing;
-        if (status === 'ready')
-            return entry.isRunning;
-        // Issue #2070: `idle` gets an explanation for the first time, and only for
-        // the one reason a stopped session can carry — `exited`. Everything else
-        // about an idle row is unchanged: no entry is picked, so the REASON cell is
-        // still `-`. That is what makes this additive rather than a fourth branch of
-        // `deriveStatus` (DR3-005 keeps the STATUS vocabulary at four words).
-        if (status === 'idle')
-            return entry.sessionStatusReason === status_reason_1.STATUS_REASON.EXITED;
-        return false;
-    };
     const preferred = wt.cliToolId ? byCli[wt.cliToolId] : undefined;
-    if (explains(preferred))
+    if (explainsStatus(preferred, status))
         return preferred;
-    return Object.values(byCli).find(explains);
+    return Object.values(byCli).find((entry) => explainsStatus(entry, status));
 }
 /**
  * The REASON cell: why the STATUS beside it says what it says (Issue #1926).
@@ -100,25 +109,180 @@ function deriveReason(wt) {
         return '-';
     return entry?.statusEvidence === 'none' ? `${reason} (no evidence)` : reason;
 }
+const MS_PER_SECOND = 1000;
+const MS_PER_MINUTE = 60_000;
+const MS_PER_HOUR = 3_600_000;
+/**
+ * `MM:SS`, or `H:MM:SS` from an hour up — the Web UI countdown's format.
+ *
+ * A second spelling of `formatTimeRemaining` (`src/config/auto-yes-config.ts`)
+ * on purpose, and the only duplication Issue #2575 accepts. That module imports
+ * `@/config/tmux-pane-config`, and `tsconfig.cli.json` sets `"paths": {}`, so a
+ * CLI module importing it compiles under lint / `tsc --noEmit` / vitest (all
+ * three resolve `@/`) and breaks only at `npm run build:cli` — a trap worth
+ * avoiding rather than walking into. The two are pinned to the same strings at
+ * the boundaries by `ls-auto-yes-2575.test.ts`, so an operator reads the same
+ * number in the browser and in the terminal.
+ *
+ * Takes a DURATION, not a deadline: the caller has already resolved `now` once
+ * for the whole table, and passing the deadline here would re-read the clock per
+ * row. Truncating means 0 < remaining < 1 s prints `00:00`, exactly as the
+ * browser countdown does one tick before it flips to OFF.
+ */
+function formatAutoYesRemaining(remainingMs) {
+    const remaining = Math.max(0, remainingMs);
+    const hours = Math.floor(remaining / MS_PER_HOUR);
+    const minutes = Math.floor((remaining % MS_PER_HOUR) / MS_PER_MINUTE);
+    const seconds = Math.floor((remaining % MS_PER_MINUTE) / MS_PER_SECOND);
+    if (hours > 0) {
+        return `${hours}:${minutes.toString().padStart(2, '0')}:${seconds.toString().padStart(2, '0')}`;
+    }
+    return `${minutes.toString().padStart(2, '0')}:${seconds.toString().padStart(2, '0')}`;
+}
+/**
+ * Milliseconds of Auto-Yes left on one instance: 0 when it is not armed,
+ * Infinity when it is armed with no deadline.
+ *
+ * Everything that is not positively armed collapses to 0 — no key, `enabled`
+ * anything but true, or a deadline already past. A past `expiresAt` reaches us
+ * even though the server folds expired states away as it reads them: these are
+ * two machines' clocks, and #959's `displayEnabled = enabled && !hasExpired`
+ * falls the same way. The direction is the whole point — this cell may under-
+ * report arming, never over-report it, because over-reporting hides a prompt
+ * that only a human can clear.
+ *
+ * Infinity is not a shape the current server produces (`AutoYesState.expiresAt`
+ * is a number), but an explicit `null` beside `enabled: true` is the server
+ * saying armed-with-no-deadline, which is a fact, and the Sessions tile reads
+ * the same input as ON. Infinity also makes it lose every `min` against a real
+ * deadline, which is what "unknown expiry" should do.
+ *
+ * `null` EXACTLY, not "anything that is not a number": a row missing the key
+ * altogether is malformed rather than eternal, and the rule above decides which
+ * way malformed falls — towards `off`.
+ */
+function remainingAutoYesMs(entry, now) {
+    if (!entry || entry.enabled !== true)
+        return 0;
+    if (entry.expiresAt === null)
+        return Number.POSITIVE_INFINITY;
+    if (typeof entry.expiresAt !== 'number')
+        return 0;
+    return entry.expiresAt > now ? entry.expiresAt - now : 0;
+}
+/**
+ * The AUTO_YES cell: how long before this row loses Auto-Yes (Issue #2575).
+ *
+ * In one sentence: the remaining time of the instance that will lose Auto-Yes
+ * FIRST, among the instances that explain this row's STATUS. One already without
+ * it makes the cell `off`.
+ *
+ * The minimum, rather than the longest or a list, is what closes the gap this
+ * Issue is about. On a row where `claude` is waiting unarmed and `codex` is
+ * waiting with ten minutes left, printing `10:00` buries a prompt nobody will
+ * answer under a countdown that has nothing to do with it; the minimum prints
+ * `off`. The cost is accepted and stated in `--help`: one unarmed instance
+ * sharing a `ready` row hides the armed one's countdown, which `ls --json` still
+ * has in full.
+ *
+ * `-` means "not known", and is deliberately not `off`:
+ *   - no `autoYesByInstance` at all — a server older than #2512;
+ *   - a non-idle row no instance explains. Impossible against the current
+ *     server, whose row-level flags are the OR of the per-instance ones. It is a
+ *     guard for the day that stops being true: falling back to "every armed
+ *     instance" on a `waiting` row would print a countdown beside a prompt no
+ *     instance is actually going to answer.
+ *
+ * The fallback to every armed instance is therefore `idle`-only, where nothing
+ * is running and there is no session whose wait could be misrepresented. An idle
+ * row with an `exited` instance is explained (#2070), so the fallback does not
+ * fire there.
+ *
+ * `status` and `now` are arguments rather than re-derived: `now` is read once
+ * per table so two rows cannot disagree about the time, and a test can freeze it.
+ */
+function deriveAutoYesCell(wt, status, now) {
+    const armedByInstance = wt.autoYesByInstance;
+    if (!armedByInstance)
+        return '-';
+    const byInstance = wt.sessionStatusByInstance ?? {};
+    let targets = Object.keys(byInstance).filter(id => explainsStatus(byInstance[id], status));
+    if (targets.length === 0) {
+        if (status !== 'idle')
+            return '-';
+        targets = Object.keys(armedByInstance);
+        if (targets.length === 0)
+            return 'off';
+    }
+    // Deterministic order first, so the cell never depends on the key order the
+    // server happened to serialise: the worktree default's primary, then
+    // lexicographic. The first strict minimum in that order wins, which is what
+    // makes an equal-remaining tie resolve to the default (printed bare) rather
+    // than to whichever instance the JSON listed first.
+    const ordered = [...targets].sort((a, b) => {
+        if (a === wt.cliToolId)
+            return -1;
+        if (b === wt.cliToolId)
+            return 1;
+        return a < b ? -1 : 1;
+    });
+    let pick = ordered[0];
+    let remaining = remainingAutoYesMs(armedByInstance[pick], now);
+    for (const id of ordered.slice(1)) {
+        const candidate = remainingAutoYesMs(armedByInstance[id], now);
+        if (candidate < remaining) {
+            pick = id;
+            remaining = candidate;
+        }
+    }
+    const value = remaining === 0
+        ? 'off'
+        : remaining === Number.POSITIVE_INFINITY
+            ? 'on'
+            : formatAutoYesRemaining(remaining);
+    // The instance is named whenever it is not the default agent's primary — the
+    // row where a second agent raised the wait is exactly the row where REASON
+    // cannot say so (it is a per-tool aggregate and loses the reason for a tool
+    // with two instances), so this parenthesis is sometimes the only thing on the
+    // line that identifies the session. It is an `--instance` value verbatim.
+    return pick === wt.cliToolId ? value : `${value} (${pick})`;
+}
 /**
  * Format worktrees as a table for terminal display.
  */
 function formatTable(worktrees) {
     if (worktrees.length === 0)
         return 'No worktrees found.';
-    const headers = ['ID', 'NAME', 'STATUS', 'REASON', 'DEFAULT'];
-    const rows = worktrees.map(wt => [
-        wt.id,
-        wt.name,
-        deriveStatus(wt),
-        deriveReason(wt),
-        wt.cliToolId || '-',
-    ]);
+    // Once per table, not once per row: two rows must not disagree about what
+    // "now" is, and a frozen clock in a test must produce one reading.
+    const now = Date.now();
+    // Issue #2575 APPENDS. The first five columns keep their order and their
+    // starting offsets, because operators (and the orchestrate recipes) read this
+    // table positionally — the same rule #1785 / #2038 / #2317 held for
+    // `commandmate instances`.
+    const headers = ['ID', 'NAME', 'STATUS', 'REASON', 'DEFAULT', 'AUTO_YES'];
+    const rows = worktrees.map(wt => {
+        const status = deriveStatus(wt);
+        return [
+            wt.id,
+            wt.name,
+            status,
+            deriveReason(wt),
+            wt.cliToolId || '-',
+            deriveAutoYesCell(wt, status, now),
+        ];
+    });
     // Calculate column widths
     const colWidths = headers.map((h, i) => Math.max(h.length, ...rows.map(r => r[i].length)));
-    const headerLine = headers.map((h, i) => h.padEnd(colWidths[i])).join('  ');
+    // The LAST column is not padded. An instance id runs to 64 characters, so one
+    // row carrying `off (some-very-long-instance-id)` would otherwise pad every
+    // other row out to that width and wrap the whole table on a narrow terminal.
+    // Before #2575 the last column was DEFAULT and every line did end in padding.
+    const lastCol = headers.length - 1;
+    const pad = (cell, i) => (i === lastCol ? cell : cell.padEnd(colWidths[i]));
+    const headerLine = headers.map(pad).join('  ');
     const separator = colWidths.map(w => '-'.repeat(w)).join('  ');
-    const dataLines = rows.map(r => r.map((cell, i) => cell.padEnd(colWidths[i])).join('  '));
+    const dataLines = rows.map(r => r.map(pad).join('  '));
     return [headerLine, separator, ...dataLines].join('\n');
 }
 /**
@@ -165,6 +329,14 @@ function deriveTmuxSession(wt) {
  * `WorktreeItem`, would need the same tool-picking rule the REASON column
  * applies for display, and would make `ls --json` disagree with
  * `GET /api/worktrees` — three costs for a shorter jq path.
+ *
+ * Issue #2575 adds a table column and nothing here, for the same reason plus
+ * one: the derived cell would be the LEAST accurate answer a machine can get.
+ * `autoYesByInstance` and `sessionStatusByInstance` are already in these rows
+ * verbatim, and a caller that needs "will anything answer this prompt" wants
+ * `commandmate wait`'s exit 10 or `capture --json`'s `autoYes`, both of which
+ * know about answers the contract policy withheld. The cell is a summary for a
+ * human reading a table.
  */
 function formatOutput(worktrees, options) {
     if (options.json) {
@@ -195,6 +367,42 @@ function createLsCommand() {
         .option('--branch <prefix>', 'Filter by branch name prefix')
         .option('--id <prefix>', 'Filter by worktree id prefix')
         .option('--token <token>', command_helpers_1.TOKEN_WARNING)
+        // Issue #2575: AUTO_YES is a derived cell with rules an operator can be
+        // surprised by (a `ready` row can read `off` while an instance is armed),
+        // and docs/** is outside this change's scope — so until the guides catch up,
+        // this is the only place a shipped build explains the column. Same reason
+        // `wait --help` carries the unclassified dwell (#1926).
+        .addHelpText('after', `
+AUTO_YES column (Issue #2575):
+  How much Auto-Yes is left on the instance that will lose it FIRST, among the
+  instances that explain this row's STATUS (waiting: the ones waiting; running:
+  the ones processing; ready: the ones running; idle: the ones that exited. A
+  bare idle row falls back to every armed instance).
+
+    MM:SS      time left, under an hour
+    H:MM:SS    time left, an hour or more
+    on         armed, with no expiry the server named
+    off        at least one of those instances is NOT armed, so a prompt on this
+               row waits for a human. This is the cell to look for
+    -          not known: the server predates the field, or this row is not idle
+               and no instance explains its STATUS
+
+  A time left is a fact about Auto-Yes, not a promise that the prompt gets
+  answered: a contract policy can withhold the answer, and a free-text prompt
+  has none to give. \`commandmate capture <id> --json --instance <instanceId>\`
+  carries autoYes.lastSuppression (what was withheld) and autoYes.stopReason
+  (why it stopped); \`commandmate wait <id>\` returns exit 10 for a prompt no
+  agent is going to clear.
+
+  The id in parentheses is the instance the cell is about, printed when that is
+  not the default agent's primary. Pass it to capture / send / respond as
+  --instance verbatim. It names an instance for THIS column only: REASON is
+  chosen per tool with the worktree default preferred (Issue #1926), so the two
+  cells on one row can be about different sessions.
+
+  Nothing here is derived in --json: it carries sessionStatusByInstance and
+  autoYesByInstance raw, which is where the per-instance breakdown is.
+`)
         .action(async (options) => {
         try {
             const client = new api_client_1.ApiClient({ token: options.token });

package/dist/cli/commands/respond.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"respond.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/respond.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA2JpC,wBAAgB,oBAAoB,IAAI,OAAO,CA4K9C"}
+{"version":3,"file":"respond.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/respond.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA2JpC,wBAAgB,oBAAoB,IAAI,OAAO,CA4L9C"}

package/dist/cli/commands/respond.js

@@ -226,6 +226,20 @@ function createRespondCommand() {
                 }
                 if (refusedBeforeSending) {
                     console.error(`Error: Answer was not sent. Reason: ${reason}${result.message ? ` (${result.message})` : ''}`);
+                    // Issue #2583: the operator who lands here typed WORDS at a dialog
+                    // that only takes a choice — a claude / agy Bash approval refused as
+                    // free text, or #2573's "No, tell … what to do differently" row. The
+                    // server's sentence ends with "answer with the option number", and
+                    // this is that command with the ids already filled in, so the next
+                    // step is a paste rather than a trip to the docs while a dialog sits
+                    // open. Printed only for the reason that means "this answer could not
+                    // be mapped onto a choice", and only when the answer was not already
+                    // a number (where the number itself is what was wrong).
+                    if (reason === 'unresolvable_answer' && answer !== undefined && !/^\d+$/.test(answer.trim())) {
+                        const target = options.instance ? ` --instance ${options.instance}` : '';
+                        console.error(`Hint: answer with the option number — \`commandmate respond ${worktreeId} <number>${target}\` ` +
+                            `(\`commandmate capture ${worktreeId}${target}\` prints the dialog and its numbers).`);
+                    }
                 }
                 else {
                     console.error(`Warning: Response may not have been applied. Reason: ${reason}`);

package/dist/cli/commands/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/status.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAA2C,aAAa,EAAE,MAAM,UAAU,CAAC;AA0PlF;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiG9E"}
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/status.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAA2C,aAAa,EAAE,MAAM,UAAU,CAAC;AAwZlF;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkG9E"}

package/dist/cli/commands/status.js

@@ -13,6 +13,7 @@ const types_1 = require("../types");
 const logger_1 = require("../utils/logger");
 const daemon_1 = require("../utils/daemon");
 const env_setup_1 = require("../utils/env-setup");
+const server_url_1 = require("../utils/server-url");
 const package_info_1 = require("../utils/package-info");
 const input_validators_1 = require("../utils/input-validators");
 const version_probes_1 = require("../../lib/detection/version-probes");
@@ -90,33 +91,166 @@ function printLocalhostConflict(status) {
         // Config dir unreadable, record unparsable: report the server, drop the hint.
     }
 }
+/** `src/app/api/push/vapid/route.ts` — public key + a `configured` flag, no secrets. */
+const VAPID_PROBE_PATH = '/api/push/vapid';
+/**
+ * Budget for the probe below. A loopback round trip to a healthy server is ~2ms;
+ * anything near this bound is a server that cannot answer, and an unanswered
+ * probe costs nothing but the fallback.
+ */
+const VAPID_PROBE_TIMEOUT_MS = 1000;
+/**
+ * Ask the running server whether it actually holds a VAPID key pair (Issue #2585).
+ *
+ * The daemon is the only process that can answer: it was handed its environment at
+ * launch and has held it ever since, while every reader in this CLI is reconstructing
+ * that environment from the outside. `GET /api/push/vapid` already exists for the web
+ * client and returns `{configured, publicKey}` — the public key only, so this adds no
+ * exposure that the browser did not already have.
+ *
+ * @returns The server's verdict, or `null` when it did not give one — unreachable,
+ *   unauthenticated, answered by something that is not this server (#2113), or not
+ *   JSON. Every one of those is "I do not know", never "not configured": inventing a
+ *   warning out of a failed probe is how a diagnostic starts lying.
+ */
+async function probeServerVapid(baseUrl) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), VAPID_PROBE_TIMEOUT_MS);
+    try {
+        // The one `process.env` read this path keeps, and deliberately: a token is a fact
+        // about THIS invocation (the caller's credential), not about the daemon's
+        // configuration. Without it an authenticated server answers 302 to /login, which
+        // `redirect: 'manual'` keeps visible instead of following it to an HTML 200.
+        const token = process.env.CM_AUTH_TOKEN;
+        const response = await fetch(`${baseUrl}${VAPID_PROBE_PATH}`, {
+            method: 'GET',
+            headers: {
+                Accept: 'application/json',
+                ...(token ? { Authorization: `Bearer ${token}` } : {}),
+            },
+            redirect: 'manual',
+            signal: controller.signal,
+        });
+        if (!response.ok)
+            return null;
+        const payload = await response.json();
+        const configured = payload?.configured;
+        return typeof configured === 'boolean' ? configured : null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Fold the server's answer into the verdict read off its `.env` (Issue #2585).
+ *
+ * They disagree in exactly two ways, and both are real situations rather than
+ * defensive padding:
+ *
+ * - **Server has keys, `.env` names none.** They were exported into the daemon at
+ *   launch. Unsupported (`commandmate init` writes the file), but real, and warning
+ *   about push being off on a server that is demonstrably sending it would be wrong.
+ * - **Server has none, `.env` names both.** The file was edited after the daemon
+ *   started. The warning stands — the running server still cannot send — and
+ *   {@link explainVapidMismatch} adds the sentence that makes it actionable.
+ *
+ * The subject (#2124) is never reconciled, because the endpoint does not report it:
+ * it stays whatever the `.env` says, which is the only VAPID value a running server
+ * cannot be asked about.
+ */
+function reconcileVapid(fileVerdict, serverConfigured) {
+    if (serverConfigured === null || serverConfigured === fileVerdict.configured) {
+        return fileVerdict;
+    }
+    if (serverConfigured) {
+        return {
+            ...fileVerdict,
+            configured: true,
+            status: fileVerdict.subjectIssue === null ? 'ok' : 'invalid-subject',
+        };
+    }
+    return { ...fileVerdict, configured: false, status: 'unconfigured' };
+}
+/**
+ * The sentence that closes the gap between "push is off" and "but I set those keys!"
+ * (Issue #2585) — appended to the shared lines, never replacing them.
+ *
+ * Both branches exist because both were measured: #2575 spent an investigation on a
+ * shell that exported the pair for a server that never had it, and a `.env` edited
+ * under a running daemon is the same confusion with the file in the shell's place.
+ *
+ * @returns Extra lines, or nothing at all when the report needs no qualifier.
+ */
+function explainVapidMismatch(verdict, fileVerdict, serverConfigured, envPath) {
+    // Push works. Nothing is being reported, so there is nothing to qualify.
+    if (verdict.configured)
+        return [];
+    if (serverConfigured === false && fileVerdict.configured) {
+        return [
+            `  ${envPath} does set both keys, so the running server predates that edit:`,
+            '  restart it ("commandmate stop && commandmate start") to pick them up.',
+        ];
+    }
+    // Names only, never values — the same rule the shared lines follow.
+    const shellOnly = fileVerdict.missingKeys.filter((key) => (process.env[key] ?? '').trim() !== '');
+    if (shellOnly.length === 0)
+        return [];
+    const pronoun = shellOnly.length > 1 ? 'them' : 'it';
+    return [
+        `  This shell exports ${shellOnly.join(' and ')}, but the server was not started`,
+        `  with ${pronoun}: set ${pronoun} in ${envPath} and restart the server.`,
+    ];
+}
 /**
  * Report the server's Web Push configuration, or nothing when it is healthy
- * (Issues #2123 / #2124).
+ * (Issues #2123 / #2124 / #2585).
  *
  * The Issues' acceptance condition is "the startup log OR `commandmate status`",
  * and this is the half that is still readable a week later — a daemon started in
  * the background writes its stdout wherever the launcher put it, and the reader
  * who notices "my phone stopped buzzing" reaches for `status`.
  *
- * Read from the env the DAEMON runs with (`getEffectiveEnv()`), not from this
- * process's own environment: `.env` outranks exported variables for the server
- * child (Issue #1266), so `process.env` here would report this shell's idea of
- * the configuration rather than the server's. Exactly what the `CM_ALLOWED_IPS`
- * line below already does.
+ * ## Who is asked, in order
+ *
+ *  1. **The running server**, over `GET /api/push/vapid`. It is the only party
+ *     that knows what it was launched with, and #2585 is the proof that everything
+ *     else is inference.
+ *  2. **Its `.env` files alone** ({@link loadEnvFileValues}) — for the subject,
+ *     which the endpoint does not report, and for the whole verdict when the probe
+ *     comes back `null`.
+ *
+ * `process.env` is NOT a layer under either, which is the fix. This used to read
+ * `getEffectiveEnv()`, whose `{...process.env, ...parsed}` reproduces what
+ * `daemon.start()` hands the child — exact for a key the `.env` defines, a guess
+ * for one it does not. `CM_VAPID_*` exported in the calling terminal therefore
+ * read as the daemon's own configuration and silenced this warning for a server
+ * that had none (#2575, measured 2026-09-16: `:60301` answered
+ * `{"configured":false}` while `status` said nothing).
  *
- * The residual imprecision is the same one that line carries: a variable exported
- * into the daemon's environment at launch and absent from `.env` is invisible
- * here. `commandmate init` writes all three VAPID variables into `.env`, so the
- * supported setup is covered; a hand-exported key pair would be reported as
- * unconfigured, which is why the startup log carries the same lines.
+ * ## When the server does not answer
+ *
+ * A stopped daemon never reaches this function — both callers return at
+ * "Not running". A *running* daemon that does not answer (auth on with no
+ * `CM_AUTH_TOKEN`, a wedged process, something else on the advertised port) falls
+ * back to the `.env` verdict, and never to the shell. The residual is then the
+ * mirror of the bug that was fixed: a pair exported into the daemon at launch and
+ * absent from `.env` reads as unconfigured, i.e. a warning that is not warranted.
+ * That direction is the deliberate one — a false warning names the variables and
+ * the file and can be checked in one command, whereas the silence it replaces is
+ * what #2575 could not diagnose at all.
  *
  * Silent on a healthy install — that silence is the negative control both Issues
  * ask for. Never throws: a diagnostic must not turn `status` into a failure.
  */
-function printVapidStatus(env) {
+async function printVapidStatus(status, envPath) {
     try {
-        const lines = (0, vapid_1.formatVapidReportLines)((0, vapid_1.inspectVapidConfig)(env));
+        const fileVerdict = (0, vapid_1.inspectVapidConfig)((0, server_url_1.loadEnvFileValues)(envPath));
+        const serverConfigured = status.url ? await probeServerVapid(status.url) : null;
+        const verdict = reconcileVapid(fileVerdict, serverConfigured);
+        const lines = (0, vapid_1.formatVapidReportLines)(verdict);
         if (lines.length === 0)
             return;
         console.log('');
@@ -124,6 +258,9 @@ function printVapidStatus(env) {
         for (const line of lines.slice(1)) {
             console.log(line);
         }
+        for (const line of explainVapidMismatch(verdict, fileVerdict, serverConfigured, envPath)) {
+            console.log(line);
+        }
     }
     catch {
         // Unreadable .env, unparsable value: report the server, drop the hint.
@@ -202,7 +339,8 @@ async function showSingleStatus(issueNo) {
     // Issue #2113: the advertised localhost URL may not reach this server at all
     printLocalhostConflict(status);
     // Issue #2123 / #2124: whether Web Push can work at all on this server
-    printVapidStatus(daemonManager.getEffectiveEnv());
+    // Issue #2585: asked of the server, and read off its .env — never off this shell
+    await printVapidStatus(status, envPath);
 }
 /**
  * Show status for all servers (main + all worktrees)
@@ -295,7 +433,8 @@ async function statusCommand(options = {}) {
         // Issue #2113: the advertised localhost URL may not reach this server at all
         printLocalhostConflict(status);
         // Issue #2123 / #2124: whether Web Push can work at all on this server
-        printVapidStatus(daemonManager.getEffectiveEnv());
+        // Issue #2585: asked of the server, and read off its .env — never off this shell
+        await printVapidStatus(status, envPath);
         // Issue #332: Show IP restriction status
         // Issue #1266: read the env the server actually runs with. An exported CM_ALLOWED_IPS
         // shadowed the .env one here, reporting an ACL the server does not enforce.