talon-agent 5.25.1 → 5.26.1

package/src/backend/codex/one-shot.ts

@@ -24,13 +24,17 @@ import { emitAssistantText } from "../runtime/one-shot-hooks.js";
 import { ensureCodex, getCodexAuthInfo } from "./init.js";
 import {
   CODEX_SYSTEM_PROMPT_SUFFIX,
-  CODEX_CHATGPT_DEFAULT_MODEL,
   CODEX_THREAD_PERMISSIONS,
 } from "./constants.js";
 import { isChatGptModelMismatchError } from "./auth.js";
-import { chatGptFallbackFor, isCodexOAuthIncompat } from "./models.js";
+import {
+  chatGptFallbackFor,
+  getCodexChatGptDefaultModel,
+  isCodexOAuthIncompat,
+} from "./models.js";
 import { markOAuthIncompat } from "./oauth-incompat.js";
 import { toCodexReasoningEffort } from "./effort.js";
+import { abortLogLine } from "../../core/agents/abort-reason.js";
 
 /**
  * Resolve the effective model for a one-shot run, applying the same
@@ -39,7 +43,8 @@ import { toCodexReasoningEffort } from "./effort.js";
  * Heartbeats and dream calls pass `params.model` straight through from
  * `config.heartbeatModel ?? config.model`. If that's an OAuth-incompat
  * id (curated `apiKeyOnly: true` or runtime-learned) AND the active
- * Codex credential is ChatGPT OAuth, swap to `gpt-5.5` to avoid the
+ * Codex credential is ChatGPT OAuth, swap to the resolved ChatGPT default
+ * (`getCodexChatGptDefaultModel`) to avoid the
  * silent exit-1 failure mode that hit a group chat on 2026-05-20 23:13Z.
  *
  * Returns the resolved model id, whether a swap occurred, and an
@@ -56,7 +61,8 @@ function resolveOneShotModel(requested: string): {
     return { model: requested, swapped: false };
   }
 
-  const fallback = chatGptFallbackFor(requested) ?? CODEX_CHATGPT_DEFAULT_MODEL;
+  const fallback =
+    chatGptFallbackFor(requested) ?? getCodexChatGptDefaultModel();
   if (fallback === requested) return { model: requested, swapped: false };
 
   return {
@@ -131,6 +137,14 @@ export async function runOneShotAgent(
     ...CODEX_THREAD_PERMISSIONS,
   });
 
+  // The real reason a run failed lives in the stream, not in whatever the
+  // SDK throws afterwards: a model the account can't use yields
+  // `turn.failed` ("404 … The model `gpt-5.5` does not exist …") and the
+  // SDK then throws only "Codex Exec exited with code 1: Reading prompt
+  // from stdin...". Capture both so the failure the caller records is the
+  // one that explains it.
+  const failure = new StreamFailure();
+
   try {
     if (abortController.signal.aborted) {
       throw new Error("Aborted before prompt was sent");
@@ -146,6 +160,7 @@ export async function runOneShotAgent(
     for await (const event of events) {
       if (abortController.signal.aborted) break;
       await appendCodexEvent(appendLog, event, onAssistantText);
+      failure.observe(event);
       if (event.type === "turn.completed") {
         const u = (event as { usage?: Record<string, number> }).usage;
         if (u) {
@@ -158,49 +173,136 @@ export async function runOneShotAgent(
         }
       }
     }
+    // A stream that ends cleanly after `turn.failed` is still a failed run
+    // — returning here is how 26/26 Codex cron runs were stored as "ok".
+    if (!abortController.signal.aborted && failure.message) {
+      throw new CodexOneShotError(failure.message);
+    }
     return usage;
   } catch (err) {
+    const thrown = err instanceof Error ? err.message : String(err);
     if (
-      abortController.signal.aborted ||
-      /abort/i.test(err instanceof Error ? err.message : String(err))
+      !(err instanceof CodexOneShotError) &&
+      (abortController.signal.aborted || /abort/i.test(thrown))
     ) {
       const ts = new Date().toISOString().slice(11, 19);
-      await appendLog(`\n### [${ts}] Aborted\nRun aborted by timeout.\n`);
+      await appendLog(
+        `\n### [${ts}] Aborted\n${abortLogLine(abortController.signal)}\n`,
+      );
       return;
     }
-    const msg = err instanceof Error ? err.message : String(err);
-
-    // Learn only from EXPLICIT mismatches in one-shot context.
-    // Silent-exit failures are ambiguous (transient outage vs real
-    // model-incompat) and persisting them would over-poison the
-    // learning store with the result that one bad heartbeat
-    // permanently downgrades the model. Explicit mismatches carry the
-    // unambiguous server message so they're safe to mark.
-    //
-    // Unlike the interactive handler, heartbeat/dream can't recurse for
-    // a retry (would mess with the timing contract and lock
-    // semantics), so silent-exit failures here simply surface to the
-    // run log; the next scheduled run takes a fresh swing.
-    const authInfo = getCodexAuthInfo();
-    if (
-      authInfo?.mode === "chatgpt" &&
-      activeModel !== CODEX_CHATGPT_DEFAULT_MODEL &&
-      isChatGptModelMismatchError(msg)
-    ) {
-      const recorded = await markOAuthIncompat(activeModel);
-      if (recorded) {
-        logWarn(
-          "agent",
-          `[${contextLabel}] Codex one-shot: recorded ${activeModel} as ` +
-            `OAuth-incompat (explicit mismatch) — next ${contextLabel} run ` +
-            `will pre-emptively swap to ${CODEX_CHATGPT_DEFAULT_MODEL}`,
-        );
-      }
-    }
-
+    const msg = failure.describe(thrown);
+    await learnFromMismatch(activeModel, msg, contextLabel);
     logWarn("agent", `Codex one-shot run failed: ${msg}`);
     const ts = new Date().toISOString().slice(11, 19);
     await appendLog(`\n### [${ts}] Error\n${msg}\n`);
+    throw err instanceof CodexOneShotError
+      ? err
+      : new CodexOneShotError(msg, { cause: err });
+  }
+}
+
+/**
+ * Record a model as OAuth-incompat when a one-shot failed on it with an
+ * explicit server mismatch, so the next run pre-emptively swaps.
+ */
+async function learnFromMismatch(
+  activeModel: string,
+  msg: string,
+  contextLabel: string,
+): Promise<void> {
+  // Learn only from EXPLICIT mismatches in one-shot context.
+  // Silent-exit failures are ambiguous (transient outage vs real
+  // model-incompat) and persisting them would over-poison the
+  // learning store with the result that one bad heartbeat
+  // permanently downgrades the model. Explicit mismatches (the 400
+  // "not supported … ChatGPT account" and the 404 "model … does not
+  // exist") carry the unambiguous server message so they're safe to
+  // mark.
+  //
+  // Unlike the interactive handler, heartbeat/dream can't recurse for
+  // a retry (would mess with the timing contract and lock
+  // semantics), so the failure is surfaced to the caller — the task
+  // settles as failed — and the next scheduled run takes a fresh
+  // swing on the learned fallback.
+  const authInfo = getCodexAuthInfo();
+  const fallback = getCodexChatGptDefaultModel();
+  if (
+    authInfo?.mode !== "chatgpt" ||
+    activeModel === fallback ||
+    !isChatGptModelMismatchError(msg)
+  ) {
+    return;
+  }
+  const recorded = await markOAuthIncompat(activeModel);
+  if (recorded) {
+    logWarn(
+      "agent",
+      `[${contextLabel}] Codex one-shot: recorded ${activeModel} as ` +
+        `OAuth-incompat (explicit mismatch) — next ${contextLabel} run ` +
+        `will pre-emptively swap to ${fallback}`,
+    );
+  }
+}
+
+/**
+ * A Codex one-shot that failed upstream. The message is the most specific
+ * reason the stream carried (the `turn.failed` text when there was one),
+ * so task tables, cron run records and the backend router see the cause
+ * rather than the SDK's generic exit wrapper.
+ */
+class CodexOneShotError extends Error {
+  constructor(message: string, options?: { cause?: unknown }) {
+    super(message, options);
+    this.name = "CodexOneShotError";
+  }
+}
+
+/**
+ * Codex emits `error` events for transient retries it handles itself
+ * ("Reconnecting... 2/5 (…)", "Falling back from WebSockets to HTTPS
+ * transport. …"). Those are progress, not failure — only the terminal
+ * `turn.failed` / final `error` count.
+ */
+const TRANSIENT_ERROR_RE = /^\s*(reconnecting\.\.\.|falling back from)/i;
+
+/** Tracks the terminal failure reported on a Codex event stream. */
+class StreamFailure {
+  private turnFailed: string | undefined;
+  private lastError: string | undefined;
+
+  observe(event: { type: string } & Record<string, unknown>): void {
+    if (event.type === "turn.failed") {
+      const err = (event as { error?: { message?: unknown } }).error;
+      const text =
+        typeof err?.message === "string" && err.message.trim()
+          ? err.message.trim()
+          : "turn failed (no message)";
+      this.turnFailed = text;
+      return;
+    }
+    if (event.type === "error" && typeof event.message === "string") {
+      const text = event.message.trim();
+      if (text && !TRANSIENT_ERROR_RE.test(text)) this.lastError = text;
+    }
+  }
+
+  /** The failure the stream reported, or undefined when it reported none. */
+  get message(): string | undefined {
+    return this.turnFailed ?? this.lastError;
+  }
+
+  /**
+   * Combine the stream's failure with whatever the SDK threw, most
+   * specific first, without repeating the same text twice.
+   */
+  describe(thrown: string): string {
+    const streamed = this.message;
+    if (!streamed) return thrown;
+    if (!thrown || thrown === streamed || streamed.includes(thrown)) {
+      return streamed;
+    }
+    return `${streamed} (${thrown.trim()})`;
   }
 }
 

package/src/backend/codex/state.ts

@@ -48,6 +48,15 @@ export interface CodexState {
    * when synthesising entries for ids absent from the curated table.
    */
   discoveredModelMetadata: Map<string, DiscoveredModelMetadata>;
+  /**
+   * The Codex CLI's own default model for the signed-in ChatGPT account:
+   * the listed, API-callable entry of `~/.codex/models_cache.json` with
+   * the lowest `priority` (the CLI sorts its picker the same way and
+   * treats the first entry as the default). `null` until the cache has
+   * been read, or when it lists nothing usable. Consumed by
+   * `getCodexChatGptDefaultModel()`.
+   */
+  discoveredDefaultModel: string | null;
   /**
    * In-flight discovery promise. Non-null while a fetch is pending;
    * cleared once the fetch settles (success or failure). Callers that
@@ -70,6 +79,7 @@ const state: CodexState = {
   frontendName: "telegram",
   discoveredModels: new Set<string>(),
   discoveredModelMetadata: new Map<string, DiscoveredModelMetadata>(),
+  discoveredDefaultModel: null,
   discoveryPromise: null,
   discoveryAt: null,
 };
@@ -87,6 +97,7 @@ export function resetState(): void {
   state.frontendName = "telegram";
   state.discoveredModels.clear();
   state.discoveredModelMetadata.clear();
+  state.discoveredDefaultModel = null;
   state.discoveryPromise = null;
   state.discoveryAt = null;
 }

package/src/core/agents/abort-reason.ts

@@ -0,0 +1,46 @@
+/**
+ * Why a run's AbortSignal fired — so logs and results can say "killed" for
+ * a deliberate kill_agent instead of blaming a timeout that never happened.
+ *
+ * Abort sites pass a typed reason (`controller.abort(reason)`); consumers
+ * read it back with `abortKind(signal)`. A bare `abort()` carries the
+ * runtime's default AbortError reason and reads as a plain "aborted".
+ */
+
+/** Reason passed when an operator/agent deliberately kills a run. */
+export class RunKilledError extends Error {
+  constructor(message = "run killed on request") {
+    super(message);
+    this.name = "RunKilledError";
+  }
+}
+
+export type AbortKind = "killed" | "timeout" | "aborted";
+
+/** Classify an abort reason (typically `signal.reason`). */
+export function abortKindOf(reason: unknown): AbortKind {
+  if (reason instanceof RunKilledError) return "killed";
+  const r = reason as { name?: unknown; message?: unknown } | null;
+  const name = typeof r?.name === "string" ? r.name : "";
+  const message = typeof r?.message === "string" ? r.message : "";
+  if (name === "RunKilledError") return "killed";
+  if (/timeout/i.test(name) || /timed out/i.test(message)) return "timeout";
+  return "aborted";
+}
+
+/** Classify why `signal` fired ("aborted" when it has not, or gave no reason). */
+export function abortKind(signal: AbortSignal): AbortKind {
+  return signal.aborted ? abortKindOf(signal.reason) : "aborted";
+}
+
+/** One-line run-log sentence for an aborted run. */
+export function abortLogLine(signal: AbortSignal): string {
+  switch (abortKind(signal)) {
+    case "killed":
+      return "Run killed on request.";
+    case "timeout":
+      return "Run aborted by timeout.";
+    default:
+      return "Run aborted.";
+  }
+}

package/src/core/agents/registry.ts

@@ -26,6 +26,7 @@ import type { AgentSettledEvent, AgentSpawnedEvent } from "../bus/events.js";
 import type { ReasoningEffortLevel } from "../types.js";
 import { bus } from "../bus/index.js";
 import { logWarn } from "../../util/log.js";
+import { RunKilledError } from "./abort-reason.js";
 
 /** Settled agents kept for status queries after they leave the live map. */
 const DEFAULT_HISTORY_LIMIT = 100;
@@ -224,7 +225,7 @@ export class AgentRegistry {
     // right after start() and settles the run as "killed".
     if (entry.killRequested) {
       try {
-        binding.abort.abort();
+        binding.abort.abort(new RunKilledError(`agent ${id} killed`));
       } catch (err) {
         logWarn(
           "agents",
@@ -312,7 +313,7 @@ export class AgentRegistry {
     if (!entry.killRequested) {
       entry.killRequested = true;
       try {
-        entry.abort?.abort();
+        entry.abort?.abort(new RunKilledError(`agent ${id} killed`));
       } catch (err) {
         // An abort hook must not be able to break the kill path — but a
         // throwing one may leave the agent running, so say so.

package/src/core/background/dream/index.ts

@@ -320,11 +320,11 @@ If commands fail, log the error and continue — this stage is optional.`
   const timeoutPromise = new Promise<never>((_, reject) => {
     const t = setTimeout(() => {
       try {
-        abortController.abort();
+        abortController.abort(new Error("Dream agent timed out"));
       } catch {
         /* ignore */
       }
-      reject(new Error("Dream agent timed out"));
+      reject(abortController.signal.reason as Error);
     }, DREAM_TIMEOUT_MS);
     t.unref(); // Don't prevent Node.js from exiting cleanly during shutdown
     timeoutHandle = t;

package/src/core/background/heartbeat/agent.ts

@@ -233,7 +233,7 @@ async function runOneShotWithTimeout(
     const t = setTimeout(() => {
       timeoutFired = true;
       try {
-        abortController.abort();
+        abortController.abort(new HeartbeatTimeoutError());
       } catch {
         /* ignore */
       }

package/src/core/background/isolated-agent.ts

@@ -94,7 +94,7 @@ export async function runIsolatedAgent(
     timer = setTimeout(() => {
       timeoutError = new IsolatedAgentTimeoutError(timeoutMs);
       try {
-        params.abortController.abort();
+        params.abortController.abort(timeoutError);
       } catch {
         /* ignore */
       }

package/src/core/backup/index.ts

@@ -49,6 +49,7 @@ export {
   formatBytes,
   formatRelative,
   formatSnapshotList,
+  type BackupStatus,
 } from "./status.js";
 
 export type { SnapshotSummary } from "./types.js";

package/src/core/backup/status.ts

@@ -16,7 +16,8 @@ import {
   type BackupTarget,
 } from "./targets.js";
 import { backupSettings, schedulerStatus } from "./scheduler.js";
-import type { SnapshotSummary } from "./types.js";
+import { PASSPHRASE_ENV } from "./passphrase.js";
+import type { BackupSettings, SnapshotSummary } from "./types.js";
 
 type TargetStatus = {
   id: string;
@@ -38,8 +39,35 @@ export type BackupStatus = {
   };
   targets: TargetStatus[];
   snapshots: SnapshotSummary[];
+  /** Retention and encryption, when the subsystem is initialised. */
+  policy?: BackupPolicy;
 };
 
+/** The settings a status panel renders alongside the numbers. */
+type BackupPolicy = {
+  keepLocal: number;
+  keepRemote: number;
+  /**
+   * Snapshots are written encrypted: `backup.encryption` is configured or
+   * the passphrase comes from the environment (see passphrase.ts). Off
+   * means they stay on this machine — upload refuses plaintext.
+   */
+  encrypted: boolean;
+};
+
+function describePolicy(
+  settings: BackupSettings | null,
+  env: NodeJS.ProcessEnv = process.env,
+): BackupPolicy | undefined {
+  if (!settings) return undefined;
+  return {
+    keepLocal: settings.keepLocal,
+    keepRemote: settings.keepRemote,
+    encrypted:
+      settings.encryption !== undefined || Boolean(env[PASSPHRASE_ENV]?.trim()),
+  };
+}
+
 export function formatBytes(bytes: number): string {
   if (bytes < 1024) return `${bytes} B`;
   if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
@@ -119,6 +147,7 @@ export async function collectBackupStatus(
     },
     targets,
     snapshots,
+    policy: describePolicy(settings),
   };
 }
 

package/src/core/config/index.ts

@@ -779,6 +779,14 @@ const configSchema = z.object({
    * Codex.
    */
   codexApiKey: z.string().optional(),
+  /**
+   * Model a ChatGPT-OAuth Codex session falls back to (pre-emptive swaps,
+   * mismatch retries, the default when no model is configured). Unset =
+   * the Codex CLI's own default for the signed-in account (first listed
+   * model in `~/.codex/models_cache.json`), else a bundled default. The
+   * TALON_CODEX_CHATGPT_MODEL env var overrides this.
+   */
+  codexChatGptDefaultModel: z.string().min(1).optional(),
   /**
    * OpenAI API key — used by the OpenAI Agents backend and accepted by
    * Codex only as a last-resort legacy fallback when no Codex-specific

package/src/core/engine/gateway.ts

@@ -275,6 +275,11 @@ export class Gateway {
     return this.port;
   }
 
+  /** True while the tool bridge's HTTP server is bound and accepting. */
+  isListening(): boolean {
+    return this.server?.listening === true;
+  }
+
   getActiveChats(): number {
     return this.loom.activeContextCount();
   }

package/src/core/frontend-runtime/admin-notify.ts

@@ -7,7 +7,10 @@
  * wiring, which does the same thing privately). Alerts raised before that
  * — early boot is exactly when restore reports and security alerts fire —
  * are held in a small bounded queue and flushed, oldest first, the moment
- * a notifier is wired. With nothing ever wired (tests, terminal mode with
+ * a notifier is wired. An alert carrying a key (operator alerts do) is
+ * deduplicated while it waits: a re-raise replaces the queued copy instead
+ * of queueing another, and a key that resolves before anyone could hear it
+ * is withdrawn outright. With nothing ever wired (tests, terminal mode with
  * no admin) they stay a log line; nothing throws.
  *
  * First consumer: WhatsApp pairing. When WhatsApp unlinks the device,
@@ -25,7 +28,14 @@ let deliver: Deliver | null = null;
 /** Most alerts held while no notifier is wired; the oldest are dropped past it. */
 export const ADMIN_NOTIFY_QUEUE_MAX = 20;
 
-type Pending = { text: string; at: number };
+type Pending = {
+  text: string;
+  at: number;
+  /** Dedup key (operator alert key); unkeyed alerts never coalesce. */
+  key?: string;
+  /** Re-raises folded into this entry while it waited. */
+  repeats: number;
+};
 const pending: Pending[] = [];
 let droppedWhileUnwired = 0;
 let flushing: Promise<void> | null = null;
@@ -68,6 +78,7 @@ async function flushPending(fn: Deliver): Promise<void> {
     batch.unshift({
       text: `${dropped} earlier admin alert(s) were dropped before a notifier was wired (queue holds ${ADMIN_NOTIFY_QUEUE_MAX}); see the daemon log.`,
       at: Date.now(),
+      repeats: 0,
     });
   }
   log("notify", `Flushing ${batch.length} queued admin alert(s)`);
@@ -79,7 +90,10 @@ async function flushPending(fn: Deliver): Promise<void> {
       continue;
     }
     const ageS = Math.round((Date.now() - item.at) / 1000);
-    const text = ageS >= 5 ? `(delayed ${ageS}s) ${item.text}` : item.text;
+    const repeated =
+      item.repeats > 0 ? `\n(raised ${item.repeats + 1}× while starting)` : "";
+    const text =
+      (ageS >= 5 ? `(delayed ${ageS}s) ${item.text}` : item.text) + repeated;
     try {
       await fn(text);
       log("notify", `Admin notified (queued): ${preview(item.text)}`);
@@ -95,6 +109,17 @@ async function flushPending(fn: Deliver): Promise<void> {
 }
 
 function enqueue(item: Pending): void {
+  if (item.key !== undefined) {
+    const i = pending.findIndex((p) => p.key === item.key);
+    if (i >= 0) {
+      // Same fault raised again while waiting: keep one entry, newest text,
+      // original timestamp (so the "delayed" note stays honest).
+      const prior = pending[i];
+      prior.text = item.text;
+      prior.repeats += item.repeats + 1;
+      return;
+    }
+  }
   pending.push(item);
   while (pending.length > ADMIN_NOTIFY_QUEUE_MAX) {
     const lost = pending.shift();
@@ -111,14 +136,29 @@ function preview(text: string): string {
   return text.slice(0, 80).replace(/\n/g, " ");
 }
 
+/**
+ * Withdraw a queued, not-yet-delivered alert by key (its fault cleared
+ * before a notifier was wired). Returns whether one was withdrawn.
+ */
+export function withdrawAdminNotification(key: string): boolean {
+  const i = pending.findIndex((p) => p.key === key);
+  if (i < 0) return false;
+  const [gone] = pending.splice(i, 1);
+  log("notify", `Withdrew queued admin alert ${key}: ${preview(gone.text)}`);
+  return true;
+}
+
 /**
  * Send `text` to the admin chat. Never throws; returns whether it was
  * delivered now (false = failed, or queued because no notifier is wired
- * yet — it is sent when one is).
+ * yet — it is sent when one is). `key` deduplicates while queued.
  */
-export async function notifyAdmin(text: string): Promise<boolean> {
+export async function notifyAdmin(
+  text: string,
+  key?: string,
+): Promise<boolean> {
   if (!deliver) {
-    enqueue({ text, at: Date.now() });
+    enqueue({ text, at: Date.now(), key, repeats: 0 });
     logWarn(
       "notify",
       `No admin notifier wired yet; queued (${pending.length}/${ADMIN_NOTIFY_QUEUE_MAX}): ${text.slice(0, 120)}`,

package/src/core/frontend-runtime/alerts.ts

@@ -15,7 +15,7 @@
  */
 
 import { log, logWarn } from "../../util/log.js";
-import { notifyAdmin } from "./admin-notify.js";
+import { notifyAdmin, withdrawAdminNotification } from "./admin-notify.js";
 
 export type AlertSeverity = "warn" | "error" | "critical";
 
@@ -39,7 +39,8 @@ const RANK: Record<AlertSeverity, number> = { warn: 0, error: 1, critical: 2 };
 const active = new Map<string, ActiveAlert>();
 let cooldownMs = DEFAULT_COOLDOWN_MS;
 let enabled = true;
-let send: (text: string) => Promise<unknown> = notifyAdmin;
+type Send = (text: string, key?: string) => Promise<unknown>;
+let send: Send = notifyAdmin;
 
 /** Apply operator settings (config `alerts`). */
 export function configureAlerts(opts: {
@@ -86,7 +87,9 @@ export function raiseAlert(
     // Nobody heard it: don't let the cooldown swallow the next raise.
     if (active.get(key) === entry) entry.lastSentAt = 0;
   };
-  void send(`${ICON[severity]} ${message}${repeat}`).then((ok) => {
+  // The key lets a still-queued copy (no notifier wired yet) be replaced by
+  // this raise rather than queued twice.
+  void send(`${ICON[severity]} ${message}${repeat}`, key).then((ok) => {
     if (ok === false) undelivered();
   }, undelivered);
 }
@@ -99,6 +102,9 @@ export function resolveAlert(key: string, message?: string): void {
   const mins = Math.max(1, Math.round((Date.now() - prior.firstAt) / 60_000));
   log("alert", `resolved ${key} after ${mins} min`);
   if (!enabled) return;
+  // Still queued for a notifier that never got to send it: withdraw it, and
+  // there is nothing to announce a recovery from.
+  if (withdrawAdminNotification(key)) return;
   void send(`✅ ${message ?? `Recovered: ${key}`} (after ${mins} min)`).catch(
     () => {},
   );
@@ -120,9 +126,7 @@ export function activeAlerts(): ReadonlyArray<{
 }
 
 /** Test seam: reset state and swap the delivery function. */
-export function resetAlertsForTest(
-  deliver: (text: string) => Promise<unknown> = notifyAdmin,
-): void {
+export function resetAlertsForTest(deliver: Send = notifyAdmin): void {
   active.clear();
   cooldownMs = DEFAULT_COOLDOWN_MS;
   enabled = true;