github-issue-tower-defence-management 1.148.24 → 1.149.0

package/src/domain/usecases/DailySecurityScanUseCase.ts

@@ -1,6 +1,8 @@
 import { LocalCommandRunner } from './adapter-interfaces/LocalCommandRunner';
 import { IssueRepository } from './adapter-interfaces/IssueRepository';
 import { HttpRepository } from './adapter-interfaces/HttpRepository';
+import { KevReportWatermarkRepository } from './adapter-interfaces/KevReportWatermarkRepository';
+import { KevReportWatermark } from '../entities/KevReportWatermark';
 import { Member } from '../entities/Member';
 
 export type DailySecurityScanConfig = {
@@ -122,6 +124,40 @@ const renderScannerFindings = (
 const KEV_CATALOG_URL =
   'https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json';
 
+const dayBeforeUtcYmd = (date: Date): string => {
+  const dayBefore = new Date(date);
+  dayBefore.setUTCDate(dayBefore.getUTCDate() - 1);
+  return dayBefore.toISOString().slice(0, 10);
+};
+
+const advanceWatermark = (
+  storedWatermark: KevReportWatermark | null,
+  reportedVulnerabilities: KevVulnerability[],
+): KevReportWatermark => {
+  const lastReportedDateAdded = reportedVulnerabilities.reduce(
+    (latest, vulnerability) =>
+      vulnerability.dateAdded > latest ? vulnerability.dateAdded : latest,
+    storedWatermark === null ? '' : storedWatermark.lastReportedDateAdded,
+  );
+  const reportedCveIdsOnLastReportedDateAdded = new Set<string>(
+    storedWatermark !== null &&
+      storedWatermark.lastReportedDateAdded === lastReportedDateAdded
+      ? storedWatermark.reportedCveIdsOnLastReportedDateAdded
+      : [],
+  );
+  for (const vulnerability of reportedVulnerabilities) {
+    if (vulnerability.dateAdded === lastReportedDateAdded) {
+      reportedCveIdsOnLastReportedDateAdded.add(vulnerability.cveID);
+    }
+  }
+  return {
+    lastReportedDateAdded,
+    reportedCveIdsOnLastReportedDateAdded: Array.from(
+      reportedCveIdsOnLastReportedDateAdded,
+    ),
+  };
+};
+
 export class DailySecurityScanUseCase {
   constructor(
     readonly localCommandRunner: LocalCommandRunner,
@@ -130,6 +166,7 @@ export class DailySecurityScanUseCase {
       'createNewIssue' | 'searchIssue' | 'createCommentByUrl'
     >,
     readonly httpRepository: HttpRepository,
+    readonly kevReportWatermarkRepository: KevReportWatermarkRepository,
   ) {}
 
   run = async (input: {
@@ -344,9 +381,26 @@ export class DailySecurityScanUseCase {
       return;
     }
 
-    const yesterday = new Date(lastTargetDate);
-    yesterday.setUTCDate(yesterday.getUTCDate() - 1);
-    const yesterdayYmd = yesterday.toISOString().slice(0, 10);
+    const watermarkLoadResult = await this.kevReportWatermarkRepository.load();
+    if (watermarkLoadResult.type === 'unreadable') {
+      console.error(
+        `Skipping the CISA KEV report for this run because ${watermarkLoadResult.reason}. The stored watermark is left unchanged and no issue was created; reporting resumes once the stored watermark is readable again.`,
+      );
+      return;
+    }
+    const storedWatermark =
+      watermarkLoadResult.type === 'stored'
+        ? watermarkLoadResult.watermark
+        : null;
+    const reportBoundaryDateAdded =
+      storedWatermark === null
+        ? dayBeforeUtcYmd(lastTargetDate)
+        : storedWatermark.lastReportedDateAdded;
+    const alreadyReportedCveIdsOnBoundary = new Set<string>(
+      storedWatermark === null
+        ? []
+        : storedWatermark.reportedCveIdsOnLastReportedDateAdded,
+    );
 
     const kevJson = await this.httpRepository.get(KEV_CATALOG_URL);
     const parsedKev: unknown = JSON.parse(kevJson);
@@ -356,10 +410,30 @@ export class DailySecurityScanUseCase {
       );
     }
 
-    const newKevEntries = parsedKev.vulnerabilities.filter(
-      (vulnerability) => vulnerability.dateAdded >= yesterdayYmd,
+    const unreportedVulnerabilities = parsedKev.vulnerabilities.filter(
+      (vulnerability) =>
+        vulnerability.dateAdded > reportBoundaryDateAdded ||
+        (vulnerability.dateAdded === reportBoundaryDateAdded &&
+          !alreadyReportedCveIdsOnBoundary.has(vulnerability.cveID)),
+    );
+    if (unreportedVulnerabilities.length === 0) {
+      return;
+    }
+    const advancedWatermark = advanceWatermark(
+      storedWatermark,
+      unreportedVulnerabilities,
     );
-    const affectingKevEntries = newKevEntries
+    const saveAdvancedWatermark = async (): Promise<void> => {
+      try {
+        await this.kevReportWatermarkRepository.save(advancedWatermark);
+      } catch (error) {
+        console.error(
+          `The CISA KEV additions considered in this run were not recorded because the KEV report watermark file did not advance to ${advancedWatermark.lastReportedDateAdded}: ${String(error)}. Those additions will be considered again on the next run, and the rest of the scheduled work continues.`,
+        );
+      }
+    };
+
+    const affectingKevEntries = unreportedVulnerabilities
       .map((vulnerability) => ({
         vulnerability,
         affectedPackages: scannedVulnerablePackages.filter((scannedPackage) =>
@@ -368,13 +442,14 @@ export class DailySecurityScanUseCase {
       }))
       .filter((entry) => entry.affectedPackages.length > 0);
     if (affectingKevEntries.length === 0) {
+      await saveAdvancedWatermark();
       return;
     }
 
     await this.issueRepository.createNewIssue(
       org,
       config.kevReportRepo,
-      `CISA KEV new additions since ${yesterdayYmd}`,
+      `CISA KEV new additions since ${reportBoundaryDateAdded}`,
       affectingKevEntries
         .map((entry) =>
           [
@@ -389,5 +464,7 @@ export class DailySecurityScanUseCase {
       [manager],
       [],
     );
+
+    await saveAdvancedWatermark();
   };
 }

package/src/domain/usecases/DefaultSilentSessionMessageComposer.test.ts

@@ -15,6 +15,7 @@ describe('DefaultSilentSessionMessageComposer', () => {
       silentSeconds: 360,
       runningSeconds: 1200,
       waitingOnExternalProcess: false,
+      finishedResultUnconsumed: false,
     };
     const section = composer.composeSubAgentSection({
       idleSubAgents: [subAgent],
@@ -23,6 +24,45 @@ describe('DefaultSilentSessionMessageComposer', () => {
     expect(section).toContain(SILENT_SESSION_REMINDER_SENTINEL);
   });
 
+  it('embeds the reminder sentinel in the unconsumed-result section', () => {
+    const section = composer.composeSubAgentUnconsumedResultSection([
+      {
+        label: 'agent-aaabbbbcccc30001',
+        silentSeconds: 5220,
+        runningSeconds: 5400,
+        waitingOnExternalProcess: false,
+        finishedResultUnconsumed: true,
+      },
+    ]);
+    expect(section).toContain(SILENT_SESSION_REMINDER_SENTINEL);
+  });
+
+  it('names every finished sub-agent and the whole minutes its result has stayed unconsumed', () => {
+    const section = composer.composeSubAgentUnconsumedResultSection([
+      {
+        label: 'agent-aaabbbbcccc30001',
+        silentSeconds: 5220,
+        runningSeconds: 5400,
+        waitingOnExternalProcess: false,
+        finishedResultUnconsumed: true,
+      },
+      {
+        label: 'agent-aaabbbbcccc30002',
+        silentSeconds: 359,
+        runningSeconds: 900,
+        waitingOnExternalProcess: false,
+        finishedResultUnconsumed: true,
+      },
+    ]);
+    expect(section).toContain('This is an automated status check.');
+    expect(section).toContain(
+      'agent-aaabbbbcccc30001: result unconsumed for 87m',
+    );
+    expect(section).toContain(
+      'agent-aaabbbbcccc30002: result unconsumed for 5m',
+    );
+  });
+
   it('renders the main-stalled message as a neutral automated status notice with the silent minutes substituted', () => {
     const section = composer.composeMainStalledSection(600);
     expect(section).toContain('This is an automated status check.');
@@ -148,6 +188,7 @@ describe('DefaultSilentSessionMessageComposer', () => {
       silentSeconds: 360,
       runningSeconds: 1200,
       waitingOnExternalProcess: false,
+      finishedResultUnconsumed: false,
     };
     const section = composer.composeSubAgentSection({
       idleSubAgents: [subAgent],
@@ -258,6 +299,7 @@ describe('DefaultSilentSessionMessageComposer', () => {
           silentSeconds: 360,
           runningSeconds: 60,
           waitingOnExternalProcess: false,
+          finishedResultUnconsumed: false,
         },
       ],
       longRunningSubAgents: [],
@@ -277,6 +319,7 @@ describe('DefaultSilentSessionMessageComposer', () => {
           silentSeconds: 360,
           runningSeconds: 60,
           waitingOnExternalProcess: false,
+          finishedResultUnconsumed: false,
         },
       ],
       longRunningSubAgents: [],
@@ -296,6 +339,7 @@ describe('DefaultSilentSessionMessageComposer', () => {
           silentSeconds: 360,
           runningSeconds: 60,
           waitingOnExternalProcess: false,
+          finishedResultUnconsumed: false,
         },
       ],
       longRunningSubAgents: [],
@@ -317,6 +361,7 @@ describe('DefaultSilentSessionMessageComposer', () => {
           silentSeconds: 30,
           runningSeconds: 1200,
           waitingOnExternalProcess: false,
+          finishedResultUnconsumed: false,
         },
       ],
     });
@@ -340,6 +385,7 @@ describe('DefaultSilentSessionMessageComposer', () => {
           silentSeconds: 30,
           runningSeconds: 1200,
           waitingOnExternalProcess: false,
+          finishedResultUnconsumed: false,
         },
       ],
     });
@@ -353,6 +399,7 @@ describe('DefaultSilentSessionMessageComposer', () => {
       silentSeconds: 360,
       runningSeconds: 1200,
       waitingOnExternalProcess: false,
+      finishedResultUnconsumed: false,
     };
     const section = composer.composeSubAgentSection({
       idleSubAgents: [subAgent],
@@ -374,6 +421,7 @@ describe('DefaultSilentSessionMessageComposer', () => {
           silentSeconds: 360,
           runningSeconds: 60,
           waitingOnExternalProcess: false,
+          finishedResultUnconsumed: false,
         },
       ],
       longRunningSubAgents: [
@@ -382,6 +430,7 @@ describe('DefaultSilentSessionMessageComposer', () => {
           silentSeconds: 10,
           runningSeconds: 960,
           waitingOnExternalProcess: false,
+          finishedResultUnconsumed: false,
         },
       ],
     });
@@ -411,6 +460,7 @@ describe('DefaultSilentSessionMessageComposer', () => {
       silentSeconds: 360,
       runningSeconds: 1200,
       waitingOnExternalProcess: false,
+      finishedResultUnconsumed: false,
     };
     const composedDefaultTexts = [
       composer.composeMainStalledSection(600),
@@ -419,6 +469,7 @@ describe('DefaultSilentSessionMessageComposer', () => {
         idleSubAgents: [subAgent],
         longRunningSubAgents: [subAgent],
       }),
+      composer.composeSubAgentUnconsumedResultSection([subAgent]),
     ];
     for (const text of composedDefaultTexts) {
       for (const pattern of flaggedPatterns) {
@@ -435,6 +486,7 @@ describe('DefaultSilentSessionMessageComposer', () => {
       silentSeconds: 360,
       runningSeconds: 1200,
       waitingOnExternalProcess: false,
+      finishedResultUnconsumed: false,
     };
     const composedDefaultTexts = [
       composer.composeMainStalledSection(600),
@@ -443,6 +495,7 @@ describe('DefaultSilentSessionMessageComposer', () => {
         idleSubAgents: [subAgent],
         longRunningSubAgents: [subAgent],
       }),
+      composer.composeSubAgentUnconsumedResultSection([subAgent]),
     ];
     for (const text of composedDefaultTexts) {
       expect(text).not.toContain('<');
@@ -462,12 +515,16 @@ describe('DefaultSilentSessionMessageComposer', () => {
       silentSeconds: 360,
       runningSeconds: 1200,
       waitingOnExternalProcess: false,
+      finishedResultUnconsumed: false,
     };
     const subSection = composer.composeSubAgentSection({
       idleSubAgents: [subAgent],
       longRunningSubAgents: [subAgent],
     });
-    const combined = `${mainSection}\n${subSection}`.toLowerCase();
+    const unconsumedResultSection =
+      composer.composeSubAgentUnconsumedResultSection([subAgent]);
+    const combined =
+      `${mainSection}\n${subSection}\n${unconsumedResultSection}`.toLowerCase();
     expect(combined).not.toContain('claude');
     expect(combined).not.toContain('take ownership');
     expect(combined).not.toContain('/home/');

package/src/domain/usecases/DefaultSilentSessionMessageComposer.ts

@@ -42,6 +42,22 @@ const composeLongRunningSubAgentSection = (
   ].join('\n');
 };
 
+const composeUnconsumedResultSubAgentSection = (
+  unconsumedResultSubAgents: SubAgentActivity[],
+): string => {
+  const lines = unconsumedResultSubAgents.map(
+    (subAgent) =>
+      `- ${subAgent.label}: result unconsumed for ${formatMinutes(
+        subAgent.silentSeconds,
+      )}`,
+  );
+  return [
+    `${SILENT_SESSION_REMINDER_SENTINEL} This is an automated status check. The following sub-process(es) have finished and their results have been waiting unread for about the minutes shown:`,
+    ...lines,
+    'For each one: please read its result, act on it, and then mark the sub-process as finished so it is no longer tracked as running. If you have already acted on the result, marking it finished is all that remains.',
+  ].join('\n');
+};
+
 export const composeOwnerCallFormatGuidance = (): string => {
   return 'Please share it through a new owner-call in the format documented for this session, written to be self-contained so the owner can understand the situation from that single message.';
 };
@@ -98,4 +114,9 @@ export class DefaultSilentSessionMessageComposer implements SilentSessionMessage
     }
     return sections.join('\n\n');
   };
+
+  composeSubAgentUnconsumedResultSection = (
+    unconsumedResultSubAgents: SubAgentActivity[],
+  ): string =>
+    composeUnconsumedResultSubAgentSection(unconsumedResultSubAgents);
 }

package/src/domain/usecases/NotifyFinishedIssuePreparationUseCase.test.ts

@@ -281,6 +281,34 @@ describe('NotifyFinishedIssuePreparationUseCase', () => {
     expect(mockIssueRepository.updateStatus).not.toHaveBeenCalled();
   });
 
+  it('should read the issue scoped to the project it was given and throw IssueNotFoundError when the issue has no item on that project', async () => {
+    const issueUrlOnAnotherProjectOnly =
+      'https://github.com/user/repo/issues/7';
+    mockProjectRepository.getByUrl.mockResolvedValue(mockProject);
+    mockIssueRepository.get.mockImplementation(
+      async (issueUrl: string, project: Project) =>
+        project.id === mockProject.id
+          ? null
+          : createMockIssue({ url: issueUrl, status: 'Preparation' }),
+    );
+
+    await expect(
+      useCase.run({
+        projectUrl: 'https://github.com/users/user/projects/1',
+        issueUrl: issueUrlOnAnotherProjectOnly,
+        thresholdForAutoReject: 3,
+        workflowBlockerResolvedWebhookUrl: null,
+        allowedIssueAuthors: null,
+      }),
+    ).rejects.toThrow(`Issue not found: ${issueUrlOnAnotherProjectOnly}`);
+    expect(mockIssueRepository.get.mock.calls).toEqual([
+      [issueUrlOnAnotherProjectOnly, mockProject],
+    ]);
+    expect(mockIssueRepository.update).not.toHaveBeenCalled();
+    expect(mockIssueRepository.updateStatus).not.toHaveBeenCalled();
+    expect(mockIssueCommentRepository.createComment).not.toHaveBeenCalled();
+  });
+
   it('should process a pull request URL the same as an issue URL when the project item resolves', async () => {
     const prIssue = createMockIssue({
       url: 'https://github.com/user/repo/pull/77',

package/src/domain/usecases/NotifySilentLiveSessionsUseCase.test.ts

@@ -33,6 +33,7 @@ const MAIN_STALLED_SECTION = 'MAIN_STALLED_SECTION';
 const MAIN_STALLED_STALE_OWNER_CALL_SECTION =
   'MAIN_STALLED_STALE_OWNER_CALL_SECTION';
 const SUBAGENT_SECTION = 'SUBAGENT_SECTION';
+const SUBAGENT_UNCONSUMED_RESULT_SECTION = 'SUBAGENT_UNCONSUMED_RESULT_SECTION';
 
 class EveryNameRecentSet extends Set<string> {
   override has = (): boolean => true;
@@ -176,6 +177,9 @@ describe('NotifySilentLiveSessionsUseCase', () => {
         .fn()
         .mockReturnValue(MAIN_STALLED_STALE_OWNER_CALL_SECTION),
       composeSubAgentSection: jest.fn().mockReturnValue(SUBAGENT_SECTION),
+      composeSubAgentUnconsumedResultSection: jest
+        .fn()
+        .mockReturnValue(SUBAGENT_UNCONSUMED_RESULT_SECTION),
     };
     mockSleeper = {
       sleep: jest.fn().mockResolvedValue(undefined),
@@ -571,6 +575,7 @@ describe('NotifySilentLiveSessionsUseCase', () => {
         silentSeconds: DEFAULT_SUBAGENT_SILENT_THRESHOLD_SECONDS,
         runningSeconds: 60,
         waitingOnExternalProcess: false,
+        finishedResultUnconsumed: false,
       },
     ];
     mockSubAgentActivityRepository.listSubAgentActivitiesBySessionName.mockResolvedValue(
@@ -596,6 +601,7 @@ describe('NotifySilentLiveSessionsUseCase', () => {
         silentSeconds: DEFAULT_SUBAGENT_SILENT_THRESHOLD_SECONDS,
         runningSeconds: 600,
         waitingOnExternalProcess: false,
+        finishedResultUnconsumed: false,
       },
     ];
     mockSubAgentActivityRepository.listSubAgentActivitiesBySessionName.mockResolvedValue(
@@ -613,7 +619,7 @@ describe('NotifySilentLiveSessionsUseCase', () => {
     });
   });
 
-  it('suppresses the long-running section for a sub-agent that produced output recently even past the running threshold', async () => {
+  it('reports a sub-agent past the running threshold that produced output moments ago', async () => {
     setupLiveInteractiveSession(GITHUB_SESSION);
     const subAgents: SubAgentActivity[] = [
       {
@@ -621,6 +627,7 @@ describe('NotifySilentLiveSessionsUseCase', () => {
         silentSeconds: 10,
         runningSeconds: DEFAULT_SUBAGENT_RUNNING_THRESHOLD_SECONDS,
         waitingOnExternalProcess: false,
+        finishedResultUnconsumed: false,
       },
     ];
     mockSubAgentActivityRepository.listSubAgentActivitiesBySessionName.mockResolvedValue(
@@ -629,10 +636,13 @@ describe('NotifySilentLiveSessionsUseCase', () => {
 
     await useCase.run(runParams());
 
-    expect(mockMessageComposer.composeSubAgentSection).not.toHaveBeenCalled();
+    expect(mockMessageComposer.composeSubAgentSection).toHaveBeenCalledWith({
+      idleSubAgents: [],
+      longRunningSubAgents: subAgents,
+    });
     expect(
       mockNotificationRepository.sendSelfCheckNotification,
-    ).not.toHaveBeenCalled();
+    ).toHaveBeenCalledWith(GITHUB_SESSION, SUBAGENT_SECTION);
   });
 
   it('excludes an owner-handover spawn from selection so no notification is sent', async () => {
@@ -981,12 +991,14 @@ describe('NotifySilentLiveSessionsUseCase', () => {
       silentSeconds: DEFAULT_SUBAGENT_SILENT_THRESHOLD_SECONDS,
       runningSeconds: 60,
       waitingOnExternalProcess: false,
+      finishedResultUnconsumed: false,
     });
     const waitingSubAgent = (label: string): SubAgentActivity => ({
       label,
       silentSeconds: DEFAULT_SUBAGENT_SILENT_THRESHOLD_SECONDS,
       runningSeconds: 60,
       waitingOnExternalProcess: true,
+      finishedResultUnconsumed: false,
     });
     const quietLongRunningSubAgent = (
       label: string,
@@ -996,12 +1008,14 @@ describe('NotifySilentLiveSessionsUseCase', () => {
       silentSeconds: DEFAULT_SUBAGENT_SILENT_THRESHOLD_SECONDS,
       runningSeconds: DEFAULT_SUBAGENT_RUNNING_THRESHOLD_SECONDS,
       waitingOnExternalProcess,
+      finishedResultUnconsumed: false,
     });
     const producingLongRunningSubAgent = (label: string): SubAgentActivity => ({
       label,
       silentSeconds: 30,
       runningSeconds: DEFAULT_SUBAGENT_RUNNING_THRESHOLD_SECONDS,
       waitingOnExternalProcess: false,
+      finishedResultUnconsumed: false,
     });
 
     const setupSubAgents = (subAgents: SubAgentActivity[]): void => {
@@ -1011,6 +1025,26 @@ describe('NotifySilentLiveSessionsUseCase', () => {
       );
     };
 
+    it('reports every long-running sub-agent on runtime alone, whether it keeps producing output or waits on an external process', async () => {
+      setupSubAgents([
+        producingLongRunningSubAgent('sub-process-producing-output'),
+        quietLongRunningSubAgent('sub-process-waiting-on-external', true),
+      ]);
+
+      await useCase.run(runParams());
+
+      expect(mockMessageComposer.composeSubAgentSection).toHaveBeenCalledWith({
+        idleSubAgents: [],
+        longRunningSubAgents: [
+          producingLongRunningSubAgent('sub-process-producing-output'),
+          quietLongRunningSubAgent('sub-process-waiting-on-external', true),
+        ],
+      });
+      expect(
+        mockNotificationRepository.sendSelfCheckNotification,
+      ).toHaveBeenCalledWith(GITHUB_SESSION, SUBAGENT_SECTION);
+    });
+
     it('never selects a waiting sub-agent as a silent-reminder candidate', async () => {
       setupSubAgents([waitingSubAgent('sub-process-1')]);
 
@@ -1047,19 +1081,119 @@ describe('NotifySilentLiveSessionsUseCase', () => {
       ).toHaveBeenCalledTimes(2);
     });
 
-    it('never selects a waiting sub-agent for the long-running section even when quiet past both thresholds', async () => {
-      setupSubAgents([quietLongRunningSubAgent('sub-process-1', true)]);
+    const unconsumedResultSubAgent = (label: string): SubAgentActivity => ({
+      label,
+      silentSeconds: DEFAULT_SUBAGENT_SILENT_THRESHOLD_SECONDS,
+      runningSeconds: DEFAULT_SUBAGENT_SILENT_THRESHOLD_SECONDS + 60,
+      waitingOnExternalProcess: false,
+      finishedResultUnconsumed: true,
+    });
+    const justFinishedSubAgent = (label: string): SubAgentActivity => ({
+      label,
+      silentSeconds: DEFAULT_SUBAGENT_SILENT_THRESHOLD_SECONDS - 1,
+      runningSeconds: DEFAULT_SUBAGENT_SILENT_THRESHOLD_SECONDS + 60,
+      waitingOnExternalProcess: false,
+      finishedResultUnconsumed: true,
+    });
+
+    const setupRecentlyProducingMainSession = (sessionName: string): void => {
+      mockSessionOutputActivityRepository.listSessionOutputActivities.mockResolvedValue(
+        [{ sessionName, lastOutputEpochSeconds: nowEpochSeconds - 60 }],
+      );
+    };
+
+    it('notifies a session whose finished sub-agent result stayed unconsumed past the threshold while the main session keeps producing output', async () => {
+      setupSubAgents([unconsumedResultSubAgent('agent-aaabbbbcccc30001')]);
+      setupRecentlyProducingMainSession(GITHUB_SESSION);
+
+      await useCase.run(runParams());
+
+      expect(
+        mockMessageComposer.composeSubAgentUnconsumedResultSection,
+      ).toHaveBeenCalledWith([
+        unconsumedResultSubAgent('agent-aaabbbbcccc30001'),
+      ]);
+      expect(
+        mockNotificationRepository.sendSelfCheckNotification,
+      ).toHaveBeenCalledWith(
+        GITHUB_SESSION,
+        SUBAGENT_UNCONSUMED_RESULT_SECTION,
+      );
+    });
+
+    it('never selects a finished sub-agent whose result has been unconsumed for less than the threshold', async () => {
+      setupSubAgents([justFinishedSubAgent('agent-aaabbbbcccc30002')]);
+      setupRecentlyProducingMainSession(GITHUB_SESSION);
 
       await useCase.run(runParams());
 
-      expect(mockMessageComposer.composeSubAgentSection).not.toHaveBeenCalled();
+      expect(
+        mockMessageComposer.composeSubAgentUnconsumedResultSection,
+      ).not.toHaveBeenCalled();
       expect(
         mockNotificationRepository.sendSelfCheckNotification,
       ).not.toHaveBeenCalled();
     });
 
-    it('never selects a long-running sub-agent that produced output within the silent threshold', async () => {
-      setupSubAgents([producingLongRunningSubAgent('sub-process-1')]);
+    it('never selects a still-working idle sub-agent as an unconsumed result', async () => {
+      setupSubAgents([hungSubAgent('sub-process-1')]);
+
+      await useCase.run(runParams());
+
+      expect(
+        mockMessageComposer.composeSubAgentUnconsumedResultSection,
+      ).not.toHaveBeenCalled();
+      expect(mockMessageComposer.composeSubAgentSection).toHaveBeenCalledWith({
+        idleSubAgents: [hungSubAgent('sub-process-1')],
+        longRunningSubAgents: [],
+      });
+    });
+
+    it('keeps an unconsumed finished sub-agent out of the idle and long-running sections', async () => {
+      setupSubAgents([unconsumedResultSubAgent('agent-aaabbbbcccc30003')]);
+
+      await useCase.run(runParams());
+
+      expect(mockMessageComposer.composeSubAgentSection).not.toHaveBeenCalled();
+    });
+
+    it('delivers the idle section and the unconsumed-result section together when both conditions hold', async () => {
+      setupSubAgents([
+        hungSubAgent('sub-process-1'),
+        unconsumedResultSubAgent('agent-aaabbbbcccc30004'),
+      ]);
+
+      await useCase.run(runParams());
+
+      expect(
+        mockNotificationRepository.sendSelfCheckNotification,
+      ).toHaveBeenCalledWith(
+        GITHUB_SESSION,
+        `${SUBAGENT_SECTION}\n\n${SUBAGENT_UNCONSUMED_RESULT_SECTION}`,
+      );
+    });
+
+    it('reports a waiting long-running sub-agent as long-running while keeping it out of the idle section', async () => {
+      setupSubAgents([quietLongRunningSubAgent('sub-process-1', true)]);
+
+      await useCase.run(runParams());
+
+      expect(mockMessageComposer.composeSubAgentSection).toHaveBeenCalledWith({
+        idleSubAgents: [],
+        longRunningSubAgents: [quietLongRunningSubAgent('sub-process-1', true)],
+      });
+      expect(
+        mockNotificationRepository.sendSelfCheckNotification,
+      ).toHaveBeenCalledWith(GITHUB_SESSION, SUBAGENT_SECTION);
+    });
+
+    it('never selects a producing sub-agent that is one second short of the running threshold', async () => {
+      setupSubAgents([
+        {
+          ...producingLongRunningSubAgent('sub-process-1'),
+          runningSeconds: DEFAULT_SUBAGENT_RUNNING_THRESHOLD_SECONDS - 1,
+        },
+      ]);
 
       await useCase.run(runParams());
 
@@ -1677,6 +1811,7 @@ describe('NotifySilentLiveSessionsUseCase', () => {
           silentSeconds: DEFAULT_SUBAGENT_SILENT_THRESHOLD_SECONDS,
           runningSeconds: 60,
           waitingOnExternalProcess: false,
+          finishedResultUnconsumed: false,
         },
       ];
       mockSubAgentActivityRepository.listSubAgentActivitiesBySessionName.mockResolvedValue(
@@ -1806,12 +1941,14 @@ describe('NotifySilentLiveSessionsUseCase', () => {
         silentSeconds: DEFAULT_SUBAGENT_SILENT_THRESHOLD_SECONDS,
         runningSeconds: 60,
         waitingOnExternalProcess: false,
+        finishedResultUnconsumed: false,
       };
       const quietLongRunningSubAgent: SubAgentActivity = {
         label: 'agent-long-1',
         silentSeconds: DEFAULT_SUBAGENT_SILENT_THRESHOLD_SECONDS,
         runningSeconds: DEFAULT_SUBAGENT_RUNNING_THRESHOLD_SECONDS,
         waitingOnExternalProcess: false,
+        finishedResultUnconsumed: false,
       };
       mockSubAgentActivityRepository.listSubAgentActivitiesBySessionName.mockResolvedValue(
         new Map([
@@ -1838,6 +1975,7 @@ describe('NotifySilentLiveSessionsUseCase', () => {
                 silentSeconds: DEFAULT_SUBAGENT_SILENT_THRESHOLD_SECONDS,
                 runningSeconds: 60,
                 waitingOnExternalProcess: false,
+                finishedResultUnconsumed: false,
               },
             ],
           ],