gsd-pi 2.76.0 → 2.77.0-dev.2daa994b6

package/src/resources/extensions/gsd/milestone-scope-classifier.ts

@@ -0,0 +1,366 @@
+// GSD-2 — Milestone scope classifier (#4781 / ADR-003 companion).
+//
+// Pure heuristics over milestone planning fields. Produces a PipelineVariant
+// that downstream dispatch logic can use to shape the auto-mode sequence.
+// No LLM calls, no file I/O, sub-millisecond.
+//
+// Distinct from `complexity-classifier.ts`, which decides *model tier*
+// (light/standard/heavy) for an individual unit. This module decides
+// *pipeline topology* for an entire milestone at plan-milestone time.
+//
+// This file ships the classifier in isolation. Dispatch-side wiring
+// lands in follow-up PRs so the classification contract can be reviewed
+// and tested before any behavior change reaches users.
+
+export type PipelineVariant = "trivial" | "standard" | "complex";
+
+export interface MilestoneScopeInput {
+  /** Milestone vision / elevator pitch. Free-form prose. */
+  vision?: string;
+  /** Success criteria, one per array entry. */
+  successCriteria?: string[];
+  /** Milestone title. */
+  title?: string;
+  /** Slice risks declared at plan-milestone time. */
+  keyRisks?: Array<{ risk?: string; whyItMatters?: string }>;
+  /** Definition-of-done lines. */
+  definitionOfDone?: string[];
+  /** Freeform "requirement coverage" marker. */
+  requirementCoverage?: string;
+  /** Verification hints (contract/integration/operational/uat). */
+  verificationContract?: string;
+  verificationIntegration?: string;
+  verificationOperational?: string;
+  verificationUat?: string;
+}
+
+export interface ScopeClassificationResult {
+  variant: PipelineVariant;
+  /** Short human-readable reasons, one per triggered signal. */
+  reasons: string[];
+  /** Sub-signals for telemetry / debugging. Stable across releases. */
+  signals: {
+    triggeredOverride: boolean;
+    complexCount: number;
+    trivialCount: number;
+    fileCountHint: number | null;
+  };
+}
+
+// ─── Keyword sets ─────────────────────────────────────────────────────────
+
+/**
+ * Override keywords that force `standard` (at minimum) regardless of
+ * apparent triviality. Presence of any of these signals work that is
+ * either security-sensitive, irreversible, or requires runtime verification
+ * a "trivial" pipeline would skip.
+ *
+ * Matched as case-insensitive word-boundary substrings. Conservative — err
+ * on the side of including a keyword; over-classifying to `standard` costs
+ * units, under-classifying could ship broken auth/security/migration work.
+ */
+const OVERRIDE_KEYWORDS: ReadonlyArray<string> = [
+  // Security-sensitive
+  "security", "auth", "authn", "authz", "authentication", "authorization",
+  "credential", "secret", "password", "token", "oauth", "encrypt", "decrypt",
+  "vulnerability", "exploit", "permission", "rbac", "acl",
+  // Data-migration / irreversible
+  "migration", "migrate", "schema change", "data migration",
+  "backfill", "drop column", "drop table",
+  // Compliance / regulatory
+  "compliance", "gdpr", "hipaa", "soc2", "pci",
+  // Infra / deploy — runtime verification needed
+  "deploy", "rollout", "canary", "production database",
+];
+
+/**
+ * Keywords that contribute to `complex` classification on their own.
+ * Different from OVERRIDE_KEYWORDS in that a single match bumps to
+ * complex, not just to standard.
+ */
+const COMPLEX_KEYWORDS: ReadonlyArray<string> = [
+  "multi-service", "distributed", "consensus", "saga", "eventual consistency",
+  "breaking change", "api contract change", "schema redesign",
+  "architect", "architecture", "refactor core",
+];
+
+/**
+ * Trivial-signal keywords: presence strongly suggests a simple, contained
+ * deliverable. Only effective when combined with low file count / no tests
+ * / no override keywords.
+ */
+const TRIVIAL_KEYWORDS: ReadonlyArray<string> = [
+  "single file", "one file", "static html", "static page",
+  "one-page", "landing page", "readme", "docs only", "typo", "rename",
+  "spelling", "comment", "changelog",
+  // Browser-only / no-build deliverable shapes (b23 forensic case).
+  "pure html", "browser-based", "no build step", "no build tooling",
+  "localstorage", "client-only", "no backend", "no server", "no backend.",
+];
+
+// ─── Heuristics ───────────────────────────────────────────────────────────
+
+/**
+ * Estimate how many distinct files the milestone will touch, based on
+ * explicit mentions in the input text. Returns `null` when no hint is
+ * discoverable — callers should treat that as "unknown, no signal."
+ */
+function extractFileCountHint(text: string): number | null {
+  // Explicit phrasing: "a single file", "two files", "3 files"
+  const singleFileMatch = /\b(a|one|single)\s+(file|page)\b/i.test(text);
+  if (singleFileMatch) return 1;
+
+  const digitMatch = text.match(/\b(\d+)\s+files?\b/i);
+  if (digitMatch) {
+    const n = parseInt(digitMatch[1], 10);
+    if (!Number.isNaN(n)) return n;
+  }
+
+  const wordMatch = text.match(/\b(two|three|four|five|six|seven|eight|nine|ten)\s+files?\b/i);
+  if (wordMatch) {
+    const wordMap: Record<string, number> = {
+      two: 2, three: 3, four: 4, five: 5,
+      six: 6, seven: 7, eight: 8, nine: 9, ten: 10,
+    };
+    return wordMap[wordMatch[1].toLowerCase()] ?? null;
+  }
+
+  return null;
+}
+
+function escapeRegExp(value: string): string {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+function containsAnyKeyword(haystack: string, keywords: ReadonlyArray<string>): string[] {
+  const lower = haystack.toLowerCase();
+  const hits: string[] = [];
+  for (const kw of keywords) {
+    // Word-boundary match to prevent substring collisions (e.g. "auth"
+    // must not match "author", "api" must not match "capital"). Phrases
+    // containing non-word characters (hyphens, slashes) still work because
+    // `\b` sits at the word-char / non-word-char transition, so
+    // `\bbrowser-based\b` matches "browser-based" bounded by whitespace
+    // or punctuation on either side.
+    const pattern = new RegExp(String.raw`\b${escapeRegExp(kw)}\b`, "i");
+    if (pattern.test(lower)) hits.push(kw);
+  }
+  return hits;
+}
+
+/**
+ * True when `term` appears in the text without an immediately preceding
+ * negator (no / without / not / zero / skip) in the same clause. Used to
+ * keep phrases like "no backend" or "no tests" from flipping a trivial-
+ * class milestone to standard. Best-effort; imperfect English parsing,
+ * biased toward false negatives (if unsure, treats term as present —
+ * which routes to standard, the safe pipeline).
+ */
+function mentionsWithoutNegation(text: string, term: string): boolean {
+  const lower = text.toLowerCase();
+  const termPattern = new RegExp(String.raw`\b${term}\b`, "gi");
+  const matches = Array.from(lower.matchAll(termPattern));
+  for (const m of matches) {
+    const start = m.index ?? 0;
+    const windowStart = Math.max(0, start - 30);
+    const window = lower.slice(windowStart, start);
+    // Negator anywhere in the 30-char lookback window counts as negation —
+    // covers "no backend", "without a server", "not using api", "zero
+    // dependencies on an api". If a sentence break intervenes between the
+    // negator and the term, treat as a different clause (positive mention).
+    const hasNegator = /(^|[^a-z0-9])(no|without|not|zero|skip(s|ping)?|drops?)\b/i.test(window);
+    const hasSentenceBreak = /[.;!?]/.test(window);
+    if (hasNegator && !hasSentenceBreak) continue;
+    return true;
+  }
+  return false;
+}
+
+function mentionsTests(haystack: string): boolean {
+  return mentionsWithoutNegation(haystack, "test")
+      || mentionsWithoutNegation(haystack, "tests")
+      || mentionsWithoutNegation(haystack, "testing")
+      || mentionsWithoutNegation(haystack, "spec")
+      || mentionsWithoutNegation(haystack, "unit test")
+      || mentionsWithoutNegation(haystack, "integration test");
+}
+
+function mentionsBackend(haystack: string): boolean {
+  return mentionsWithoutNegation(haystack, "api")
+      || mentionsWithoutNegation(haystack, "backend")
+      || mentionsWithoutNegation(haystack, "server")
+      || mentionsWithoutNegation(haystack, "database")
+      || mentionsWithoutNegation(haystack, "endpoint");
+}
+
+// ─── DB adapter ───────────────────────────────────────────────────────────
+
+/**
+ * Shape adapter: convert a milestone DB row into the classifier input
+ * object. Keeps `milestone-scope-classifier.ts` free of DB types at the
+ * module boundary — callers can either use this helper or hand-build the
+ * input themselves (e.g. from plan-milestone tool params before insert).
+ */
+export function milestoneRowToScopeInput(row: {
+  title?: string;
+  vision?: string;
+  success_criteria?: string[];
+  key_risks?: Array<{ risk?: string; whyItMatters?: string }>;
+  definition_of_done?: string[];
+  requirement_coverage?: string;
+  verification_contract?: string;
+  verification_integration?: string;
+  verification_operational?: string;
+  verification_uat?: string;
+}): MilestoneScopeInput {
+  return {
+    title: row.title,
+    vision: row.vision,
+    successCriteria: row.success_criteria,
+    keyRisks: row.key_risks,
+    definitionOfDone: row.definition_of_done,
+    requirementCoverage: row.requirement_coverage,
+    verificationContract: row.verification_contract,
+    verificationIntegration: row.verification_integration,
+    verificationOperational: row.verification_operational,
+    verificationUat: row.verification_uat,
+  };
+}
+
+/**
+ * Compute the pipeline variant for a milestone by reading its planning
+ * fields from the DB and running the classifier. Returns `null` when
+ * classification is unavailable (DB closed, milestone missing, unexpected
+ * error) — callers MUST treat null as "run the full pipeline" so a
+ * classification failure never silently downshifts dispatch.
+ */
+export async function getMilestonePipelineVariant(mid: string): Promise<PipelineVariant | null> {
+  try {
+    const { isDbAvailable, getMilestone } = await import("./gsd-db.js");
+    if (!isDbAvailable()) return null;
+    const row = getMilestone(mid);
+    if (!row) return null;
+    return classifyMilestoneScope(milestoneRowToScopeInput(row)).variant;
+  } catch {
+    return null;
+  }
+}
+
+// ─── Public API ───────────────────────────────────────────────────────────
+
+/**
+ * Classify a milestone's pipeline variant based on its planning inputs.
+ *
+ * Precedence (matches implementation order — complex-first so that
+ * security-sensitive architecture refactors correctly route to complex
+ * rather than standard; the override hit is still recorded in
+ * `signals.triggeredOverride` for telemetry):
+ *  1. Complex-signal keyword OR ≥ 8 file hint OR architecture/refactor-core
+ *     language → `complex`.
+ *  2. Override keyword → `standard` (at minimum). Prevents trivial
+ *     misclassification of security / auth / migration work.
+ *  3. Trivial-signal keyword AND ≤ 2 file hint AND no tests mentioned AND
+ *     no backend mentioned → `trivial`.
+ *  4. Otherwise → `standard`.
+ *
+ * Ambiguity → `standard` (today's default). Safe to run the full pipeline.
+ */
+export function classifyMilestoneScope(input: MilestoneScopeInput): ScopeClassificationResult {
+  const haystack = [
+    input.title ?? "",
+    input.vision ?? "",
+    (input.successCriteria ?? []).join("\n"),
+    (input.keyRisks ?? []).map(r => `${r.risk ?? ""} ${r.whyItMatters ?? ""}`).join("\n"),
+    (input.definitionOfDone ?? []).join("\n"),
+    input.requirementCoverage ?? "",
+    input.verificationContract ?? "",
+    input.verificationIntegration ?? "",
+    input.verificationOperational ?? "",
+    input.verificationUat ?? "",
+  ].join("\n");
+
+  const overrideHits = containsAnyKeyword(haystack, OVERRIDE_KEYWORDS);
+  const complexHits = containsAnyKeyword(haystack, COMPLEX_KEYWORDS);
+  const trivialHits = containsAnyKeyword(haystack, TRIVIAL_KEYWORDS);
+  const fileCountHint = extractFileCountHint(haystack);
+  const hasTests = mentionsTests(haystack);
+  const hasBackend = mentionsBackend(haystack);
+
+  const reasons: string[] = [];
+
+  // Rule 2: complex-class signals. Evaluated before override because a
+  // complex + override input should land in complex, not standard.
+  if (complexHits.length > 0) {
+    reasons.push(`complex keywords: ${complexHits.slice(0, 3).join(", ")}`);
+  }
+  if (fileCountHint !== null && fileCountHint >= 8) {
+    reasons.push(`file count hint: ${fileCountHint}`);
+  }
+
+  const isComplex = complexHits.length > 0 || (fileCountHint !== null && fileCountHint >= 8);
+
+  if (isComplex) {
+    return {
+      variant: "complex",
+      reasons,
+      signals: {
+        triggeredOverride: overrideHits.length > 0,
+        complexCount: complexHits.length,
+        trivialCount: trivialHits.length,
+        fileCountHint,
+      },
+    };
+  }
+
+  // Rule 1: override keywords force standard.
+  if (overrideHits.length > 0) {
+    return {
+      variant: "standard",
+      reasons: [`override keywords: ${overrideHits.slice(0, 3).join(", ")}`],
+      signals: {
+        triggeredOverride: true,
+        complexCount: complexHits.length,
+        trivialCount: trivialHits.length,
+        fileCountHint,
+      },
+    };
+  }
+
+  // Rule 3: trivial signals — require ALL of: trivial-keyword, low file
+  // hint (or nothing suggesting high count), no test mention, no backend
+  // mention.
+  const fileCountOk = fileCountHint === null || fileCountHint <= 2;
+  const trivial =
+    trivialHits.length > 0 &&
+    fileCountOk &&
+    !hasTests &&
+    !hasBackend;
+
+  if (trivial) {
+    reasons.push(`trivial keywords: ${trivialHits.slice(0, 3).join(", ")}`);
+    if (fileCountHint !== null) reasons.push(`file count hint: ${fileCountHint}`);
+    reasons.push("no tests mentioned", "no backend mentioned");
+    return {
+      variant: "trivial",
+      reasons,
+      signals: {
+        triggeredOverride: false,
+        complexCount: complexHits.length,
+        trivialCount: trivialHits.length,
+        fileCountHint,
+      },
+    };
+  }
+
+  // Rule 4: fallback.
+  return {
+    variant: "standard",
+    reasons: reasons.length > 0 ? reasons : ["no strong signals — default"],
+    signals: {
+      triggeredOverride: overrideHits.length > 0,
+      complexCount: complexHits.length,
+      trivialCount: trivialHits.length,
+      fileCountHint,
+    },
+  };
+}

package/src/resources/extensions/gsd/milestone-summary-classifier.ts

@@ -0,0 +1,42 @@
+/**
+ * Shared milestone SUMMARY classifier.
+ *
+ * SUMMARY presence alone is not enough to prove milestone completion: recovery
+ * and blocker paths also write SUMMARY files. Keep this leaf module free of
+ * state/auto imports so state derivation, dispatch guards, and recovery can
+ * share one definition without cycles.
+ */
+
+import { splitFrontmatter, parseFrontmatterMap } from "../shared/frontmatter.js";
+import { isClosedStatus } from "./status-guards.js";
+
+export type MilestoneSummaryOutcome = "success" | "failure" | "unknown";
+
+export function classifyMilestoneSummaryContent(content: string): MilestoneSummaryOutcome {
+  const [fmLines] = splitFrontmatter(content);
+  const fm = fmLines ? parseFrontmatterMap(fmLines) : null;
+  const rawStatus = typeof fm?.status === "string" ? fm.status.trim().toLowerCase() : "";
+  if (rawStatus) {
+    if (isClosedStatus(rawStatus)) return "success";
+    if (["active", "pending", "blocked", "failed", "failure", "incomplete"].includes(rawStatus)) {
+      return "failure";
+    }
+  }
+
+  const failureSignal =
+    /(?:^|\n)\s*#\s*BLOCKER\b/i.test(content)
+    || /auto-mode recovery failed/i.test(content)
+    || /verification\s+failed/i.test(content)
+    || /(?:^|\n)\s*(?:status|verdict|outcome|result)\s*[:=-]\s*not complete\b/i.test(content);
+  if (failureSignal) return "failure";
+  return "unknown";
+}
+
+/**
+ * Legacy-compatible terminal check for state derivation.
+ * Unknown summaries remain terminal to preserve old handwritten SUMMARY files;
+ * explicit failure summaries do not.
+ */
+export function isTerminalMilestoneSummaryContent(content: string): boolean {
+  return classifyMilestoneSummaryContent(content) !== "failure";
+}

package/src/resources/extensions/gsd/model-cost-table.ts

@@ -57,6 +57,9 @@ export const BUNDLED_COST_TABLE: ModelCostEntry[] = [
   { id: "gpt-5.3-codex-spark", inputPer1k: 0.0003, outputPer1k: 0.0012, updatedAt: "2026-03-29" },
   { id: "gpt-5.4", inputPer1k: 0.005, outputPer1k: 0.02, updatedAt: "2026-03-29" },
   { id: "gpt-5.4-mini", inputPer1k: 0.00075, outputPer1k: 0.0045, updatedAt: "2026-04-18" },
+  // GPT-5.5 API list price, also used for live Codex OAuth routing.
+  // Source: https://openai.com/api/pricing/
+  { id: "gpt-5.5", inputPer1k: 0.005, outputPer1k: 0.03, updatedAt: "2026-04-23" },
 
   // Google
   { id: "gemini-2.0-flash", inputPer1k: 0.0001, outputPer1k: 0.0004, updatedAt: "2025-03-15" },

package/src/resources/extensions/gsd/model-router.ts

@@ -109,6 +109,7 @@ export const MODEL_CAPABILITY_TIER: Record<string, ComplexityTier> = {
   "gpt-5.2-codex": "heavy",
   "gpt-5.3-codex": "heavy",
   "gpt-5.4": "heavy",
+  "gpt-5.5": "heavy",
   "o1": "heavy",
   "o3": "heavy",
   "o4-mini": "heavy",
@@ -144,6 +145,7 @@ const MODEL_COST_PER_1K_INPUT: Record<string, number> = {
   "gpt-5.3-codex": 0.005,
   "gpt-5.3-codex-spark": 0.0003,
   "gpt-5.4": 0.005,
+  "gpt-5.5": 0.005,
   "o4-mini": 0.005,
   "o4-mini-deep-research": 0.005,
   "gemini-2.0-flash": 0.0001,
@@ -187,6 +189,10 @@ export const MODEL_CAPABILITY_PROFILES: Record<string, ModelCapabilities> = {
   "gpt-5.3-codex":                { coding: 94, debugging: 91, research: 74, reasoning: 89, speed: 50, longContext: 80, instruction: 89 },
   "gpt-5.3-codex-spark":          { coding: 68, debugging: 58, research: 42, reasoning: 52, speed: 90, longContext: 50, instruction: 74 },
   "gpt-5.4":                      { coding: 95, debugging: 92, research: 88, reasoning: 94, speed: 42, longContext: 88, instruction: 92 },
+  // GPT-5.5 scores are relative to the existing gpt-5.4 profile and backed by
+  // OpenAI's 2026-04-23 published eval deltas across coding, tool use, and long context.
+  // Source: https://openai.com/index/introducing-gpt-5-5/
+  "gpt-5.5":                      { coding: 96, debugging: 93, research: 89, reasoning: 95, speed: 42, longContext: 90, instruction: 93 },
 
   // ── OpenAI o-series (reasoning-first) ──────────────────────────────────────
   "o1":                           { coding: 78, debugging: 82, research: 78, reasoning: 90, speed: 20, longContext: 65, instruction: 82 },
@@ -561,6 +567,23 @@ function bareModelId(modelId: string): string {
   return modelId.includes("/") ? modelId.split("/").pop()! : modelId;
 }
 
+// ─── Provider-specific Tool Limits ─────────────────────────────────────────
+
+/**
+ * Groq enforces a hard limit of 128 tools per request.
+ * Requests exceeding this limit receive a 400 error:
+ * "maximum number of items is 128"
+ * @see https://console.groq.com/docs/tool-use
+ */
+export const GROQ_MAX_TOOLS = 128;
+
+/**
+ * Provider IDs that map to the Groq API backend.
+ * Used to detect Groq at the GSD routing layer where only the provider string
+ * is available (the pi-ai openai-completions adapter is shared across providers).
+ */
+const GROQ_PROVIDER_IDS = new Set(["groq"]);
+
 // ─── Tool Compatibility Filter (ADR-005 Phase 3) ───────────────────────────
 
 /**
@@ -588,10 +611,17 @@ export function isToolCompatibleWithProvider(
 /**
  * Filter a list of tool names to only those compatible with a provider.
  * Used by the routing pipeline to adjust tool sets when switching providers.
+ *
+ * @param toolNames - The full list of active tool names to filter.
+ * @param providerApi - The pi-ai API string (e.g. "openai-completions").
+ * @param provider - Optional provider ID (e.g. "groq"). Used to apply
+ *   provider-specific limits that can't be expressed as API-level capabilities
+ *   (e.g. Groq's 128-tool hard limit on the shared openai-completions adapter).
  */
 export function filterToolsForProvider(
   toolNames: string[],
   providerApi: string,
+  provider?: string,
 ): { compatible: string[]; filtered: string[] } {
   const providerCaps = getProviderCapabilities(providerApi);
 
@@ -611,6 +641,17 @@ export function filterToolsForProvider(
     }
   }
 
+  // Groq enforces a hard limit of 128 tools per request (#4376).
+  // Trim the compatible list to GROQ_MAX_TOOLS and move the excess to filtered.
+  if (provider && GROQ_PROVIDER_IDS.has(provider) && compatible.length > GROQ_MAX_TOOLS) {
+    const trimmed = compatible.splice(GROQ_MAX_TOOLS);
+    filtered.push(...trimmed);
+    console.warn(
+      `[gsd] Groq tool limit: ${compatible.length + trimmed.length} tools active but Groq allows at most ${GROQ_MAX_TOOLS}. ` +
+        `Trimming to the first ${GROQ_MAX_TOOLS} tools. Removed: ${trimmed.join(", ")}`,
+    );
+  }
+
   return { compatible, filtered };
 }
 
@@ -620,11 +661,17 @@ export function filterToolsForProvider(
  *
  * This is a hard filter only — it removes tools that would fail at the
  * provider level. It does NOT remove tools based on soft heuristics.
+ *
+ * @param activeToolNames - The full list of currently active tool names.
+ * @param selectedModelApi - The pi-ai API string for the selected model.
+ * @param provider - Optional provider ID (e.g. "groq") for provider-specific
+ *   limits beyond what the API-level capability profile expresses.
  */
 export function adjustToolSet(
   activeToolNames: string[],
   selectedModelApi: string,
+  provider?: string,
 ): { toolNames: string[]; removedTools: string[] } {
-  const { compatible, filtered } = filterToolsForProvider(activeToolNames, selectedModelApi);
+  const { compatible, filtered } = filterToolsForProvider(activeToolNames, selectedModelApi, provider);
   return { toolNames: compatible, removedTools: filtered };
 }

package/src/resources/extensions/gsd/notifications.ts

@@ -4,7 +4,6 @@
 import { execFileSync } from "node:child_process";
 import type { NotificationPreferences } from "./types.js";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
-import { CmuxClient, emitOsc777Notification, resolveCmuxConfig } from "../cmux/index.js";
 import { sendRemoteNotification } from "../remote-questions/notify.js";
 
 export type NotifyLevel = "info" | "success" | "warning" | "error";
@@ -39,20 +38,33 @@ export function sendDesktopNotification(
 
   if (!shouldSendDesktopNotification(kind, loaded?.notifications)) return;
 
-  const cmux = resolveCmuxConfig(loaded);
-  if (cmux.notifications) {
-    const delivered = CmuxClient.fromPreferences(loaded).notify(title, message);
-    if (delivered) return;
-    emitOsc777Notification(title, message);
-  }
-
-  try {
-    const command = buildDesktopNotificationCommand(process.platform, title, message, level);
-    if (!command) return;
-    execFileSync(command.file, command.args, { timeout: 3000, stdio: "ignore" });
-  } catch {
-    // Non-fatal — desktop notifications are best-effort
-  }
+  // cmux delivery and desktop delivery are independent — if cmux import or
+  // delivery fails, we must still attempt the native desktop notification.
+  const runCmux = async () => {
+    try {
+      const { CmuxClient, emitOsc777Notification, resolveCmuxConfig } = await import("../cmux/index.js");
+      const cmux = resolveCmuxConfig(loaded);
+      if (cmux.notifications) {
+        const delivered = CmuxClient.fromPreferences(loaded).notify(title, message);
+        if (delivered) return true;
+        emitOsc777Notification(title, message);
+      }
+    } catch {
+      // cmux unavailable — fall through to desktop notification
+    }
+    return false;
+  };
+
+  void runCmux().then((deliveredByCmux) => {
+    if (deliveredByCmux) return;
+    try {
+      const command = buildDesktopNotificationCommand(process.platform, title, message, level);
+      if (!command) return;
+      execFileSync(command.file, command.args, { timeout: 3000, stdio: "ignore" });
+    } catch {
+      // Non-fatal — desktop notifications are best-effort
+    }
+  }).catch(() => {});
 }
 
 export function shouldSendDesktopNotification(