unsnooze 1.10.0 → 1.12.2

package/src/multiplexers/tmux.js

@@ -30,6 +30,25 @@ function wrappedSessionName(env) {
 // calls with a pause between them, or Ink treats Enter as bracketed paste.
 export const SUBMIT_DELAY_MS = 150;
 
+// tmux stderr signatures that mean the wrapped session never started (vs the
+// session running and ending). Only these may trigger the unwatched fallback —
+// anything broader risks double-running an agent that already ran. All of
+// these are printed by the tmux client BEFORE the inner command executes
+// (name collision, tty/socket problems, nesting refusal, fatal startup).
+const SESSION_START_ERROR_RE = new RegExp([
+  'duplicate session',
+  'open terminal failed',
+  'error connecting',
+  'server exited unexpectedly',
+  'no server running',
+  'create session failed',
+  'sessions should be nested',
+  'not a terminal',
+  'permission denied',
+  "couldn'?t create",
+  '^fatal:',
+].join('|'), 'im');
+
 export { SessionCreateError };
 
 export function createTmux({ spawner = defaultSpawner, env = process.env } = {}) {
@@ -153,6 +172,30 @@ export function createTmux({ spawner = defaultSpawner, env = process.env } = {})
       }
     },
 
+    // Ownership stamp: a pane user option written at creation. It survives
+    // the agent process exiting but dies with the pane, so a recycled pane id
+    // never carries a stale stamp. Requires tmux >= 3.0 (-p pane options) —
+    // older tmux fails quietly and callers fall back to lease checks.
+    async stampPaneOwner(pane, leaseId) {
+      try {
+        await run('set-option', '-p', '-t', pane, '@unsnooze_owner', String(leaseId));
+        return true;
+      } catch {
+        return false;
+      }
+    },
+
+    // Read the stamp back. Blank (unset option / missing pane) and errors are
+    // both null — trust stdout, not the exit code (tmux 3.7b blank-success).
+    async paneOwnerStamp(pane) {
+      try {
+        const out = (await run('display-message', '-t', pane, '-p', '#{@unsnooze_owner}')).trim();
+        return out || null;
+      } catch {
+        return null;
+      }
+    },
+
     async sessionExists(name) {
       try {
         await run('has-session', '-t', name);
@@ -224,14 +267,30 @@ export function createTmux({ spawner = defaultSpawner, env = process.env } = {})
       // spawned from the agent via {...process.env}).
       const args = ['new-session', '-s', name,
         ...envArgs(launchSpec.env), launchSpec.file, ...(launchSpec.args || [])];
-      const result = spawner('tmux', args, { sync: true, stdio: 'inherit', env });
+      // stderr is piped, not inherited: the tmux client draws its UI on the
+      // stdin/stdout tty; stderr carries only tmux's own error messages, and
+      // capturing them is how a session-start failure is told apart from the
+      // session simply ending (tmux exits non-zero for both us and the shell).
+      const result = spawner('tmux', args,
+        { sync: true, stdio: ['inherit', 'inherit', 'pipe'], env });
       if (result?.error) {
         throw new SessionCreateError(
           `failed to start tmux session "${name}": ${result.error.message}`,
           result.error,
         );
       }
-      return exitStatus(result);
+      const status = exitStatus(result);
+      const stderr = result?.stderr == null ? '' : String(result.stderr);
+      if (status !== 0 && SESSION_START_ERROR_RE.test(stderr)) {
+        // The session never ran the agent — safe (and required) to fall back
+        // to an unwatched launch without any double-run risk.
+        throw new SessionCreateError(
+          `tmux could not start session "${name}": ${stderr.trim()}`);
+      }
+      // Any other tmux chatter stays visible — it was headed for the user's
+      // terminal before we piped it.
+      if (stderr.trim()) process.stderr.write(stderr);
+      return status;
     },
 
     // tmux pane ids are server-global, so owner binding is intentionally inert.

package/src/multiplexers/zellij.js

@@ -75,6 +75,11 @@ export function createZellij({ spawner = defaultSpawner, env = process.env } = {
   const childEnv = () => scrubZellijEnv(env);
   const run = (args, options = {}) => spawner('zellij', args, { env: childEnv(), ...options });
 
+  // dump-screen --full (scrollback) exists on zellij >= 0.35; older builds
+  // reject the flag. Shared across binds: learn once, never fail every tick.
+  // null = untested, true = supported, false = degrade to viewport-only.
+  let fullDumpSupported = null;
+
   // Sync counterpart of sessionExists, for the sync launchWrapped path. Rows can
   // carry ANSI colour and an "(EXITED …)" suffix, so only the leading name token
   // is compared. Probe failure → empty set: assume free and let zellij arbitrate.
@@ -121,10 +126,22 @@ export function createZellij({ spawner = defaultSpawner, env = process.env } = {
         return env.ZELLIJ_PANE_ID || null;
       },
 
-      // v1 limitation: dump-screen is viewport-only, so `lines` is ignored;
-      // unlike tmux, a banner/menu that scrolls away between polls is missed.
-      // `dump-screen --full` may provide a future scrollback-capable option.
+      // --full includes scrollback, so a banner/menu that scrolled away
+      // between polls is still seen; `lines` is still ignored — zellij offers
+      // no line-count bound on the dump. Pre-0.35 zellij rejects the flag:
+      // fall back to the viewport-only form (1.10.x behavior) rather than
+      // failing every capture, and remember the answer.
       async capturePane(pane, _lines = 200) {
+        if (fullDumpSupported !== false) {
+          try {
+            const out = await owned('action', 'dump-screen', '--full', '--pane-id', String(pane));
+            fullDumpSupported = true;
+            return out;
+          } catch (err) {
+            if (fullDumpSupported === true) throw err;   // flag is fine — real capture error
+            fullDumpSupported = false;
+          }
+        }
         return owned('action', 'dump-screen', '--pane-id', String(pane));
       },
 

package/src/notify-ntfy.js

@@ -0,0 +1,76 @@
+// ntfy push channel (https://docs.ntfy.sh) — fire-and-forget phone/desktop
+// push that rides ALONGSIDE the local notifyChannel; the whole point is
+// reaching a user who is away from the machine.
+//
+// Dispatch is the JSON-to-root form (POST {server}/ with a JSON body) rather
+// than POST-to-/topic with header metadata: every unsnooze title carries an
+// emoji, and HTTP headers mangle non-ASCII unless RFC 2047-encoded — JSON
+// string values are natively UTF-8. One code path, no escaping.
+//
+// SECURITY: topics on ntfy.sh are a public namespace — the topic name is
+// effectively the password (read AND write for anyone who knows it). Use
+// generateNtfyTopic() for an unguessable name, or a self-hosted/authed
+// server; ntfyPrivacy=terse keeps cwd paths out of the pushed body entirely.
+//
+// Same contract as every other notifier: never throws, never blocks the
+// detection/resume paths, all deps injectable, no network in tests.
+
+import { randomBytes } from 'node:crypto';
+import { getConfig } from './settings.js';
+
+const BODY_MAX = 1024;          // far under ntfy's ~4K push ceiling
+const TIMEOUT_MS = 5000;
+
+const TOPIC_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
+
+/** Unguessable, ntfy-legal ([-_A-Za-z0-9], <=64 chars) topic name. */
+export function generateNtfyTopic() {
+  const bytes = randomBytes(16);
+  let suffix = '';
+  for (const b of bytes) suffix += TOPIC_ALPHABET[b % TOPIC_ALPHABET.length];
+  return `unsnooze-${suffix}`;
+}
+
+/**
+ * Push one notification. Resolution: config/env (ntfyTopic/ntfyServer/
+ * ntfyToken/ntfyPrivacy). No topic → quiet no-op. Returns true only on an
+ * accepted (2xx) publish; every failure path returns false without throwing.
+ */
+export async function sendNtfy(title, message, {
+  fetcher = globalThis.fetch,
+  priority = 3,
+  timeoutMs = TIMEOUT_MS,
+} = {}) {
+  try {
+    const topic = getConfig('ntfyTopic');
+    if (!topic) return false;
+    const server = String(getConfig('ntfyServer') || 'https://ntfy.sh').replace(/\/+$/, '');
+    const token = getConfig('ntfyToken');
+    const terse = getConfig('ntfyPrivacy') === 'terse';
+
+    // terse: the body may embed cwd paths — never send those to a topic that
+    // is only as private as its name. The title alone still tells the story.
+    const body = terse
+      ? 'details withheld (ntfyPrivacy=terse) — run: unsnooze status'
+      : String(message ?? '').slice(0, BODY_MAX);
+
+    const headers = { 'Content-Type': 'application/json' };
+    if (token) headers.Authorization = `Bearer ${token}`;
+
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+    try {
+      const res = await fetcher(`${server}/`, {
+        method: 'POST',
+        headers,
+        body: JSON.stringify({ topic, title: String(title ?? ''), message: body, priority }),
+        signal: ctrl.signal,
+      });
+      return !!res?.ok;
+    } finally {
+      clearTimeout(timer);
+    }
+  } catch {
+    return false;   // offline, DNS, 4xx/5xx, abort — never the caller's problem
+  }
+}

package/src/notify.js

@@ -15,6 +15,7 @@ import { release as osRelease } from 'node:os';
 import { getConfig } from './settings.js';
 import { getMultiplexer } from './multiplexer.js';
 import { sendOsc as defaultSendOsc, sendBell as defaultSendBell } from './notify-tty.js';
+import { sendNtfy } from './notify-ntfy.js';
 
 function defaultSpawner(cmd, args) {
   const child = spawn(cmd, args, { detached: true, stdio: 'ignore' });
@@ -113,10 +114,18 @@ export function notify(title, message, {
   channel = null,
   tty = { sendOsc: defaultSendOsc, sendBell: defaultSendBell },
   getMux = getMultiplexer,
+  ntfyFetcher = undefined,
+  priority = 3,
 } = {}) {
   try {
     if (!getConfig('notifications')) return;
 
+    // ntfy push is ADDITIVE: a phone buzz complements the local toast — the
+    // scenarios unsnooze exists for are exactly the ones where the user is
+    // not looking at this machine. No-op until ntfyTopic is configured;
+    // fire-and-forget so an offline push can never slow a resume.
+    sendNtfy(title, message, { fetcher: ntfyFetcher, priority }).catch(() => {});
+
     const nativeOpts = { platform, wsl, spawner };
     const fireNative = () => nativeNotify(title, message, nativeOpts);
 

package/src/reap.js

@@ -5,6 +5,7 @@ import { MUX_SESSION_NAME, RESUME_SESSION_NAME } from './config.js';
 import { getMultiplexer } from './multiplexer.js';
 import { readState, setStatus, updateState } from './state.js';
 import { getConfig } from './settings.js';
+import { paneOwnedByRecord } from './lease.js';
 import { makeLogger } from './logger.js';
 
 const log = makeLogger('reap');
@@ -84,10 +85,24 @@ export async function reap({
   const terminal = Object.values(state.sessions).filter(s =>
     ['resumed', 'failed', 'cancelled'].includes(s.status) && s.pane);
 
+  const reapIdleAfter = getConfig('reapIdleAfter');
+  const now = Date.now();
   for (const rec of terminal) {
+    // 'resumed' is not really terminal — the agent may be mid-task in that
+    // pane right now. Honor the module contract ("never kill a live agent")
+    // by requiring the same idle threshold as auto-reap before closing.
+    if (rec.status === 'resumed') {
+      const ts = rec.lastAttemptAt || rec.detectedAt || 0;
+      if (ts > now - reapIdleAfter) {
+        actions.push({ kind: 'skip-active', key: rec.key, pane: rec.pane,
+          reason: `resumed and active within reapIdleAfter — not closing` });
+        continue;
+      }
+    }
     let alive = false;
+    let mux = null;
     try {
-      const mux = resolveMux(rec);
+      mux = resolveMux(rec);
       alive = await mux.paneAlive(rec.pane);
     } catch { alive = false; }
     if (!alive) {
@@ -97,6 +112,24 @@ export async function reap({
       }
       continue;
     }
+    // Pane ids get recycled — closing by bare id could kill someone else's
+    // pane. Positive ownership (stamp or lease) is required to close; a
+    // demonstrably foreign pane means the record is stale, so drop it.
+    let owned = null;
+    try { owned = await paneOwnedByRecord(rec, { mux }); } catch { owned = null; }
+    if (owned === false) {
+      actions.push({ kind: 'drop-record', key: rec.key, reason: 'pane recycled — not ours' });
+      if (!dryRun) {
+        updateState(s => { delete s.sessions[rec.key]; return s; });
+      }
+      continue;
+    }
+    if (owned === null) {
+      // Legacy record with no lease: no proof either way — never close.
+      actions.push({ kind: 'skip-unowned', key: rec.key, pane: rec.pane,
+        reason: 'ownership unprovable (pre-lease record) — close it manually' });
+      continue;
+    }
     actions.push({
       kind: 'close-pane',
       key: rec.key,
@@ -107,7 +140,6 @@ export async function reap({
     });
     if (!dryRun) {
       try {
-        const mux = resolveMux(rec);
         if (typeof mux.closePane === 'function') await mux.closePane(rec.pane);
         setStatus(rec.key, rec.status, { pane: null });
         updateState(s => { delete s.sessions[rec.key]; return s; });
@@ -173,6 +205,15 @@ export async function autoReapIfEnabled({
         updateState(s => { delete s.sessions[rec.key]; return s; });
         continue;
       }
+      // Same recycled-pane rule as reap(): positive ownership or no close.
+      const owned = await paneOwnedByRecord(rec, { mux });
+      if (owned !== true) {
+        if (owned === false) {
+          updateState(s => { delete s.sessions[rec.key]; return s; });
+          log(`${rec.key}: auto-reap skipped — pane ${rec.pane} recycled, record dropped`);
+        }
+        continue;
+      }
       if (typeof mux.closePane === 'function') {
         await mux.closePane(rec.pane);
         closed += 1;