agentwire-dev 1.65.0__tar.gz → 1.65.2__tar.gz

{agentwire_dev-1.65.0 → agentwire_dev-1.65.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentwire-dev
-Version: 1.65.0
+Version: 1.65.2
 Summary: Multi-session voice web interface for AI coding agents
 Project-URL: Homepage, https://agentwire.dev
 Project-URL: Repository, https://github.com/dotdevdotdev/agentwire-dev

{agentwire_dev-1.65.0 → agentwire_dev-1.65.2}/agentwire/__init__.py

@@ -1,3 +1,3 @@
 """AgentWire - Multi-session voice web interface for AI coding agents."""
 
-__version__ = "1.65.0"
+__version__ = "1.65.2"

{agentwire_dev-1.65.0 → agentwire_dev-1.65.2}/agentwire/core.py

@@ -479,9 +479,21 @@ def resolve_default_created_by(caller: str | None, target_path: Path) -> str | N
     `{project}-{name}`, and would misjudge same/cross-project); if the
     caller's real cwd can't be confirmed, treat it as unknown (no inheritance)
     rather than risk a wrong guess.
+
+    A service session (agentwire-portal, -tts, -stt, -kokoro, ...) never
+    qualifies as a parent: it's infrastructure, not an agent that will ever
+    drain its msg inbox, so anything parented to it dead-letters forever. A
+    subprocess the portal shells out to inherits its TMUX_PANE and resolves
+    ``caller`` right back to "agentwire-portal" — this was the root cause of
+    a 147-message dead-letter storm (each mailing the owner individually,
+    2026-07-19).
     """
     if not caller:
         return None
+    from .services import is_service_session
+
+    if is_service_session(caller):
+        return None
     caller_path = _live_session_cwd(caller)
     if caller_path is None:
         return None

{agentwire_dev-1.65.0 → agentwire_dev-1.65.2}/agentwire/inbox.py

@@ -453,6 +453,7 @@ def gc_sender(sender: str) -> dict:
             # delivered, not lost. Skip GC for this recipient this round.
             continue
         try:
+            newly_dead: list[Message] = []
             for path in paths:
                 if not path.exists():
                     continue  # delivered + unlinked just before we locked
@@ -472,7 +473,7 @@ def gc_sender(sender: str) -> dict:
                             attempts=msg.attempts, reason="sender_exited",
                         )
                         dead += 1
-                        _escalate_dead_letter(msg, "sender_exited")
+                        newly_dead.append(msg)
                     except OSError:
                         pass
                 else:
@@ -481,6 +482,8 @@ def gc_sender(sender: str) -> dict:
                         dropped += 1
                     except OSError:
                         pass
+            # One digest per recipient, not one email per message (#836).
+            _escalate_dead_letters(newly_dead, "sender_exited")
         finally:
             _release_lock(lock)
 
@@ -608,17 +611,32 @@ def _fmt_ts(ms: int) -> str:
     return time.strftime("%Y-%m-%d %H:%M:%S", time.localtime(ms / 1000))
 
 
-def _escalate_dead_letter(msg: Message, reason: str) -> None:
-    """Email the owner when a load-bearing report-back dead-letters.
+# A single stuck recipient (e.g. a session wrongly parented to a service
+# session that can never drain its inbox) can dead-letter dozens of messages
+# in one drain pass — cap the per-message detail in the digest so the email
+# stays readable instead of dumping an unbounded wall of text.
+_ESCALATE_DIGEST_DETAIL_CAP = 10
+
+
+def _escalate_dead_letters(messages: list[Message], reason: str) -> None:
+    """Email the owner once per batch when load-bearing report-backs dead-letter.
 
     ``done`` / ``request`` / ``escalation`` are load-bearing — a silently-dropped
     one is a real loss, so we surface it out-of-band via the shared Resend wiring
     (the same owner-escalation channel usage-limit parking uses). ``note`` and
-    ``ingest`` are not escalated. Best-effort: a missing key or send failure must
-    never break the drain — the corpse already sits in ``dead/`` for
-    ``agentwire msg dead``.
+    ``ingest`` are not escalated.
+
+    *messages* is everything dead-lettered by one caller's batch (one drain
+    pass for one recipient, or one sender's GC sweep) — a single digest email
+    covers the whole batch instead of one email per message, so a recipient
+    that's been permanently undeliverable for a while (e.g. parented to a
+    service session that never drains) can't spam the owner's inbox one email
+    per stuck message (147 individual emails in ~2s, 2026-07-19). Best-effort:
+    a missing key or send failure must never break the drain — each corpse
+    already sits in ``dead/`` for ``agentwire msg dead``.
     """
-    if msg.kind not in ESCALATE_KINDS:
+    batch = [m for m in messages if m.kind in ESCALATE_KINDS]
+    if not batch:
         return
     try:
         import socket
@@ -626,36 +644,47 @@ def _escalate_dead_letter(msg: Message, reason: str) -> None:
         from .channels.email import send_email
 
         host = socket.gethostname()
-        subject = (
-            f"[agentwire] undelivered {msg.kind}: {msg.sender} → {msg.to} (dead-lettered)"
-        )
-        body = "\n".join([
-            f"A **{msg.kind}** message from **{msg.sender}** to **{msg.to}** on "
-            f"`{host}` was never delivered after {msg.attempts} attempts and has "
-            f"been dead-lettered.",
-            "",
-            f"- **Kind:** {msg.kind}",
-            f"- **From:** {msg.sender}",
-            f"- **To:** {msg.to}",
-            f"- **Last defer reason:** {reason}",
-            f"- **Sent:** {_fmt_ts(msg.ts)}",
-            f"- **Dead-lettered:** {_fmt_ts(msg.dead_ts)}",
-            "",
-            "Message text:",
+        if len(batch) == 1:
+            msg = batch[0]
+            subject = (
+                f"[agentwire] undelivered {msg.kind}: {msg.sender} → {msg.to} (dead-lettered)"
+            )
+        else:
+            to = batch[0].to
+            subject = (
+                f"[agentwire] {len(batch)} undelivered messages → {to} (dead-lettered)"
+            )
+        noun = "message" if len(batch) == 1 else "messages"
+        verb = "was" if len(batch) == 1 else "were"
+        lines = [
+            f"{len(batch)} load-bearing {noun} on `{host}` {verb} never delivered "
+            f"and {'has' if len(batch) == 1 else 'have'} been dead-lettered "
+            f"(last defer reason: {reason}).",
             "",
-            "```",
-            msg.text,
-            "```",
+        ]
+        for msg in batch[:_ESCALATE_DIGEST_DETAIL_CAP]:
+            lines += [
+                f"- **{msg.kind}** {msg.sender} → {msg.to}, sent {_fmt_ts(msg.ts)}, "
+                f"dead-lettered {_fmt_ts(msg.dead_ts)}, {msg.attempts} attempts:",
+                "  ```",
+                f"  {msg.text}",
+                "  ```",
+            ]
+        remaining = len(batch) - _ESCALATE_DIGEST_DETAIL_CAP
+        if remaining > 0:
+            lines.append(f"- ...and {remaining} more.")
+        lines += [
             "",
-            f"Saved in the dead-letter store — review with `agentwire msg dead -s {msg.to}`.",
-        ])
-        result = send_email(subject=subject, body=body)
+            f"Saved in the dead-letter store — review with "
+            f"`agentwire msg dead -s {batch[0].to}`.",
+        ]
+        result = send_email(subject=subject, body="\n".join(lines))
         _log_event(
-            "dead_letter_escalated", id=msg.id, to=msg.to, kind=msg.kind,
+            "dead_letter_escalated", to=batch[0].to, count=len(batch), reason=reason,
             ok=bool(getattr(result, "success", False)),
         )
     except Exception as exc:  # escalation is best-effort; never break the drain
-        _log_event("dead_letter_escalate_failed", id=msg.id, to=msg.to, error=str(exc))
+        _log_event("dead_letter_escalate_failed", to=batch[0].to, count=len(batch), error=str(exc))
 
 
 def _bump_attempts(messages: list[Message], reason: str = "") -> int:
@@ -675,6 +704,7 @@ def _bump_attempts(messages: list[Message], reason: str = "") -> int:
     burns out on schedule.
     """
     dead = 0
+    newly_dead: list[Message] = []
     for msg in messages:
         if msg.path is None:
             continue
@@ -705,7 +735,7 @@ def _bump_attempts(messages: list[Message], reason: str = "") -> int:
                     attempts=msg.attempts, reason=reason,
                 )
                 dead += 1
-                _escalate_dead_letter(msg, reason)
+                newly_dead.append(msg)
             except OSError:
                 pass
         else:
@@ -713,6 +743,9 @@ def _bump_attempts(messages: list[Message], reason: str = "") -> int:
                 _write_message(msg.path, msg)
             except OSError:
                 pass
+    # One digest email for the whole batch (all share the same recipient —
+    # `messages` is always one session's inbox), not one per message (#836).
+    _escalate_dead_letters(newly_dead, reason)
     return dead
 
 

{agentwire_dev-1.65.0 → agentwire_dev-1.65.2}/agentwire/routes/desktop.py

@@ -10,6 +10,22 @@ through the composed server's MRO.
 from aiohttp import web
 
 
+def _artifact_url_hash(url: str) -> str:
+    """FNV-1a 32-bit hash of ``url``, as 8 lowercase hex chars.
+
+    Must match ``artifactUrlHash`` in static/js/desktop.js byte-for-byte —
+    the server and frontend both derive the same fallback artifact id from
+    the same URL, and a naive char-substitution slug (the prior approach)
+    let distinct URLs like "reports/jan.html" and "reports-jan.html" collide
+    onto the same id. A hash isn't lossy the way substitution is.
+    """
+    h = 0x811C9DC5
+    for b in url.encode("utf-8"):
+        h ^= b
+        h = (h * 0x01000193) & 0xFFFFFFFF
+    return f"{h:08x}"
+
+
 class DesktopRoutesMixin:
     async def api_desktop_windows(self, request):
         """GET /api/desktop/windows — query browser clients for open windows."""
@@ -173,7 +189,7 @@ class DesktopRoutesMixin:
                 "url": url,
                 "title": title,
                 "artifact_id": artifact.get("artifact_id")
-                or f"artifact-{url.replace('/', '-').replace('.', '-')}",
+                or f"artifact-{_artifact_url_hash(url)}",
             }
             if not text:
                 text = f"**{title}** is ready — click to open"

{agentwire_dev-1.65.0 → agentwire_dev-1.65.2}/agentwire/session_cli.py

@@ -62,6 +62,7 @@ from .worktree import (
     default_base_branch,
     ensure_worktree,
     git_root,
+    is_registered_worktree,
     is_valid_branch_name,
     parse_session_name,
     remove_worktree,
@@ -1561,7 +1562,17 @@ def _teardown_entry(
     Never reports worktree_removed=True while the dir is still on disk: if
     `git worktree remove --force` can't clear it, this fails LOUDLY
     (success: False) and leaves the registry entry in place, instead of
-    silently "unregistering" an orphan.
+    silently "unregistering" an orphan — UNLESS git *already had no record of
+    the path before we touched it* (see `is_registered_worktree`), in which
+    case there's no registered worktree left to protect and the leftover
+    directory (a stale build-tool cache, typically) is hard-deleted instead.
+
+    That pre-check matters: `git worktree prune` below runs unconditionally
+    and clears any entry git marks "prunable" (e.g. one whose linked `.git`
+    file was deleted) as a side effect of THIS call — checking registration
+    after prune would misread a worktree that was real and registered right
+    up until this attempt as a pre-existing orphan, and hard-delete content
+    the fail-loud path exists to protect.
 
     The worktree removal is attempted BEFORE the session is killed, and the
     session is only killed once removal is confirmed — never the reverse.
@@ -1569,10 +1580,17 @@ def _teardown_entry(
     disk with no session left to notice, on any removal failure (bad
     project_path, a stuck worktree, ...) (#740).
     """
+    was_registered = is_registered_worktree(project_path, worktree_path)
+
     # Force-remove the git worktree, then prune admin files either way.
     _, remove_error = remove_worktree(project_path, worktree_path, force=True)
     subprocess.run(["git", "-C", str(project_path), "worktree", "prune"], capture_output=True)
 
+    hard_deleted_orphan = False
+    if worktree_path.exists() and not was_registered:
+        shutil.rmtree(worktree_path, ignore_errors=True)
+        hard_deleted_orphan = not worktree_path.exists()
+
     if worktree_path.exists():
         reason = remove_error or "worktree directory still present after `git worktree remove --force`"
         return {"success": False, "session": session_name, "path": str(worktree_path),
@@ -1605,7 +1623,7 @@ def _teardown_entry(
     return {"success": True, "session": session_name, "path": str(worktree_path),
             "killed": killed, "worktree_removed": True,
             "branch": branch, "branch_deleted": branch_deleted, "branch_note": branch_note,
-            "orphaned_tabs": orphaned_tabs}
+            "orphaned_tabs": orphaned_tabs, "hard_deleted_orphan": hard_deleted_orphan}
 
 
 def _worktree_remove(args, project_path: Path, worktree_dir: Path, json_mode: bool) -> int:
@@ -1641,7 +1659,9 @@ def _worktree_remove(args, project_path: Path, worktree_dir: Path, json_mode: bo
     else:
         msg = (f"Removed worktree session '{result['session']}'"
                + (" (killed live session)" if result["killed"] else "")
-               + f"; worktree {result['path']} removed")
+               + f"; worktree {result['path']} removed"
+               + (" (git had no registration for it — hard-deleted the leftover directory)"
+                  if result.get("hard_deleted_orphan") else ""))
         if result["branch"]:
             msg += f"; branch '{result['branch']}' " + ("deleted" if result["branch_deleted"] else f"kept ({result['branch_note']})")
         if result["orphaned_tabs"]:

{agentwire_dev-1.65.0 → agentwire_dev-1.65.2}/agentwire/static/js/desktop.js

@@ -824,6 +824,24 @@ function _mountSessionWindow(session, mode, machine, id) {
     addTaskbarButton(id, sw);
 }
 
+/**
+ * FNV-1a 32-bit hash of `url`, as 8 lowercase hex chars. Must match
+ * `_artifact_url_hash` in routes/desktop.py byte-for-byte — server and
+ * frontend both derive the same fallback artifact id from the same URL. A
+ * hash isn't lossy the way the prior char-substitution slug was (distinct
+ * URLs like "reports/jan.html" and "reports-jan.html" collided onto the
+ * same id).
+ */
+function artifactUrlHash(url) {
+    let h = 0x811c9dc5;
+    const bytes = new TextEncoder().encode(url);
+    for (const b of bytes) {
+        h ^= b;
+        h = Math.imul(h, 0x01000193) >>> 0;
+    }
+    return h.toString(16).padStart(8, '0');
+}
+
 /**
  * Open an artifact window (agent-generated HTML or external URL).
  *
@@ -832,7 +850,7 @@ function _mountSessionWindow(session, mode, machine, id) {
  * @param {string|null} artifactId - Optional explicit window ID
  */
 export function openArtifactWindow(url, title = 'Artifact', artifactId = null) {
-    const id = artifactId || `artifact-${url.replace(/[\/\.]/g, '-')}`;
+    const id = artifactId || `artifact-${artifactUrlHash(url)}`;
 
     // Check if already open — restore if minimized, otherwise focus
     if (artifactWindows.has(id)) {

{agentwire_dev-1.65.0 → agentwire_dev-1.65.2}/agentwire/static/js/notifications-panel.js

@@ -86,10 +86,19 @@ class NotificationsPanel {
             this._removeToast(id, false);
         }
 
-        // Evict oldest if at capacity
+        // Evict the oldest toast NOT carrying an artifact notice, if at
+        // capacity. Artifact toasts are exempt regardless of priority: an
+        // unclicked deliverable must not silently fade (#817) — the cap
+        // only trims ordinary toasts (sticky `high`-priority ones included).
+        // If every current toast is an artifact notice, the panel
+        // temporarily exceeds MAX_TOASTS rather than dropping one.
         if (this.toasts.size >= MAX_TOASTS) {
-            const oldest = this.toasts.keys().next().value;
-            this._removeToast(oldest, false);
+            for (const id of this.toasts.keys()) {
+                if (!this.artifactNotices.has(id)) {
+                    this._removeToast(id, false);
+                    break;
+                }
+            }
         }
 
         // Resolve auto-fade: explicit timeout wins (0 = sticky); otherwise

{agentwire_dev-1.65.0 → agentwire_dev-1.65.2}/agentwire/worktree.py

@@ -309,6 +309,39 @@ def remove_worktree(project_path: Path, worktree_path: Path, *, force: bool = Tr
     return False, (result.stderr or result.stdout).strip()
 
 
+def is_registered_worktree(project_path: Path, worktree_path: Path) -> bool:
+    """Does git's own worktree registry (still) know about ``worktree_path``?
+
+    A directory can outlive its registration — e.g. `git worktree remove`
+    succeeded on a prior teardown attempt but the `rm -rf` half crashed
+    before clearing a build-tool cache dir left inside, or the admin file
+    under `.git/worktrees/` was pruned independently. In that state git
+    reports "fatal: ... is not a working tree" for every future removal
+    attempt, forever — this lets a caller distinguish that from a real
+    registered worktree that `remove --force` merely failed to clear. It
+    says nothing about whether the directory holds valuable content — that
+    judgment (e.g. "orphaned + unregistered is safe to hard-delete") belongs
+    to the caller, not this function.
+
+    Fails closed on an inconclusive read: if `git worktree list` itself
+    errors (corrupt repo, I/O, lock contention), that's reported as
+    registered rather than not — a caller gating a destructive action on
+    this should default to "assume real" when unsure, not "assume orphan".
+    """
+    result = subprocess.run(
+        ["git", "worktree", "list", "--porcelain"],
+        cwd=project_path, capture_output=True, text=True,
+    )
+    if result.returncode != 0:
+        return True
+    target = str(worktree_path.resolve())
+    for line in result.stdout.splitlines():
+        if line.startswith("worktree "):
+            if str(Path(line[len("worktree "):]).resolve()) == target:
+                return True
+    return False
+
+
 def worktree_status(worktree_path: Path) -> dict:
     """Read-only git status for a worktree. Local git only — no network, no gh.
 

{agentwire_dev-1.65.0 → agentwire_dev-1.65.2}/docs/wiki/sessions/messaging.md

@@ -143,8 +143,14 @@ lands in a durable inbox and is injected only at a safe boundary.
      / `escalation`) does dead-letter, the owner is emailed via the shared Resend
      wiring (the same channel usage-limit parking uses) so the loss is surfaced
      even if nobody runs `msg dead`. `note` is fire-and-forget and `ingest` never
-     auto-delivers, so neither is escalated. Escalation is best-effort — a send
-     failure is logged (`dead_letter_escalate_failed`) and never breaks the drain.
+     auto-delivers, so neither is escalated. Escalation is **batched per drain
+     pass, not per message** (#829/#830): every message dead-lettered in the
+     same batch for one recipient gets a single digest email (detail capped at
+     the first 10, "...and N more" beyond that) instead of one email each — a
+     recipient stuck permanently undeliverable (e.g. wrongly parented to a
+     service session that never drains) can't spam the owner one email per
+     stuck message. Escalation is best-effort — a send failure is logged
+     (`dead_letter_escalate_failed`) and never breaks the drain.
 
 ### `prompt_is_empty` — the collision detector
 

{agentwire_dev-1.65.0 → agentwire_dev-1.65.2}/tests/conftest.py

@@ -13,7 +13,7 @@ FIXTURES_DIR = Path(__file__).parent / "fixtures"
 def _no_real_outbound_email(request, monkeypatch):
     """No test may send real email — ever.
 
-    ``_escalate_dead_letter`` (and friends) call the live Resend wiring, so a
+    ``_escalate_dead_letters`` (and friends) call the live Resend wiring, so a
     test that dead-letters a done/request/escalation message without mocking
     ``send_email`` silently emails the owner on every suite run (found the hard
     way: ``test_purge_leaves_ingest_and_dead`` flooded the inbox with

{agentwire_dev-1.65.0 → agentwire_dev-1.65.2}/tests/integration/test_worktree_cmd.py

@@ -643,6 +643,38 @@ def test_remove_fails_loudly_when_dir_survives(tmp_path, monkeypatch, wt_env, ca
     assert payload["error"]
 
 
+def test_remove_hard_deletes_unregistered_orphan_directory(tmp_path, monkeypatch, wt_env, capsys):
+    """A directory git no longer registers as a worktree at all (its
+    `.git/worktrees/<name>` admin entry is gone, e.g. from a prior teardown
+    that crashed mid-way) must not get stuck failing `git worktree remove`
+    forever — since git has nothing left to lose, the leftover directory is
+    hard-deleted and teardown proceeds and succeeds."""
+    import shutil
+
+    _, clone = _origin_and_clone(tmp_path, default_branch="develop")
+    wt_dir = tmp_path / "worktrees"
+    cfg = _config(wt_dir)
+    assert _run(monkeypatch, cfg, name="orphan", project=str(clone)) == 0
+    wt_path = wt_dir / "clone-repo" / "orphan"
+    assert wt_path.exists()
+
+    # Simulate the crashed-partial-teardown state: git's own registration is
+    # gone, but the directory (with leftover content) survives on disk.
+    shutil.rmtree(clone / ".git" / "worktrees" / "orphan")
+    (wt_path / "stale-cache-file").write_text("leftover\n")
+
+    capsys.readouterr()
+    rc = _run(monkeypatch, cfg, name="orphan", project=str(clone), remove=True)
+    assert rc == 0
+    assert not wt_path.exists()
+    assert reg.entries(clone.resolve()) == []
+
+    payload = json.loads(capsys.readouterr().out)
+    assert payload["success"] is True
+    assert payload["worktree_removed"] is True
+    assert payload["hard_deleted_orphan"] is True
+
+
 def test_remove_kills_alive_session(tmp_path, monkeypatch, wt_env, capsys):
     _, clone = _origin_and_clone(tmp_path, default_branch="develop")
     wt_dir = tmp_path / "worktrees"

{agentwire_dev-1.65.0 → agentwire_dev-1.65.2}/tests/unit/test_core_created_by_rooting.py

@@ -115,3 +115,14 @@ class TestResolveDefaultCreatedBy:
         monkeypatch.setattr(core, "tmux_session_exists", lambda s: False)
         repo = _make_repo(tmp_path)
         assert core.resolve_default_created_by("myproject-fix-bug", repo) is None
+
+    def test_service_session_caller_returns_none(self, monkeypatch, tmp_path):
+        # Regression (2026-07-19): a session created via the portal web UI
+        # inherits the portal server subprocess's TMUX_PANE, so `caller`
+        # resolves to the "agentwire-portal" service session. Parenting to it
+        # is a bug even when same_project would otherwise match — a service
+        # session never drains its msg inbox, so anything parented to it
+        # dead-letters forever (147-message escalation-email storm).
+        repo = _make_repo(tmp_path)
+        monkeypatch.setattr(core, "_live_session_cwd", lambda s: repo)
+        assert core.resolve_default_created_by("agentwire-portal", repo) is None

{agentwire_dev-1.65.0 → agentwire_dev-1.65.2}/tests/unit/test_inbox.py

@@ -760,6 +760,8 @@ class TestDeadLetterEscalation:
         assert len(inbox.list_dead("s")) == 1  # still archived for audit
 
     def test_request_and_escalation_also_email(self, isolate, monkeypatch):
+        # Both dead-letter in the same drain pass (same recipient) — one
+        # digest email covers the batch, not one email per kind (#836).
         inbox.enqueue("s", "need creds", kind="request", sender="w")
         inbox.enqueue("s", "stuck!", kind="escalation", sender="w")
         self._occupied_agent(monkeypatch)
@@ -767,8 +769,9 @@ class TestDeadLetterEscalation:
         self._capture_email(monkeypatch, sent)
         for _ in range(inbox.MAX_ATTEMPTS):
             inbox.flush_session("s")
-        kinds = sorted(k["subject"].split("undelivered ")[1].split(":")[0] for k in sent)
-        assert kinds == ["escalation", "request"]
+        assert len(sent) == 1
+        assert "2 undelivered messages" in sent[0]["subject"]
+        assert "request" in sent[0]["body"] and "escalation" in sent[0]["body"]
 
     def test_note_dead_letter_does_not_email(self, isolate, monkeypatch):
         inbox.enqueue("s", "fyi", kind="note", sender="worker")
@@ -792,6 +795,49 @@ class TestDeadLetterEscalation:
             inbox.flush_session("s")
         assert len(inbox.list_dead("s")) == 1  # drain survived; corpse archived
 
+    def test_large_batch_sends_one_digest_not_one_per_message(self, isolate, monkeypatch):
+        # Regression (2026-07-19): a recipient stuck permanently undeliverable
+        # (e.g. wrongly parented to a service session) can accumulate a large
+        # backlog that all crosses MAX_ATTEMPTS in the same drain pass. That
+        # must fire ONE digest email, not one per message (147 individual
+        # emails in ~2s was the real incident).
+        for i in range(20):
+            inbox.enqueue("s", f"report {i}", kind="done", sender="w")
+        self._occupied_agent(monkeypatch)
+        sent = []
+        self._capture_email(monkeypatch, sent)
+        for _ in range(inbox.MAX_ATTEMPTS):
+            inbox.flush_session("s")
+        assert len(inbox.list_dead("s")) == 20
+        assert len(sent) == 1
+        assert "20 undelivered messages" in sent[0]["subject"]
+
+    def _msg(self, i):
+        return inbox.Message(
+            id=f"id{i}", sender="w", to="s", kind="done", text=f"report {i}",
+            ts=1000 + i, dead_ts=2000 + i,
+        )
+
+    def test_digest_detail_cap_boundary(self, isolate, monkeypatch):
+        # Exactly at the cap: every message gets detail, no truncation line.
+        sent = []
+        self._capture_email(monkeypatch, sent)
+        batch = [self._msg(i) for i in range(inbox._ESCALATE_DIGEST_DETAIL_CAP)]
+        inbox._escalate_dead_letters(batch, "target_gone")
+        assert len(sent) == 1
+        assert "...and" not in sent[0]["body"]
+        assert all(f"report {i}" in sent[0]["body"] for i in range(len(batch)))
+
+    def test_digest_detail_cap_truncates_beyond_boundary(self, isolate, monkeypatch):
+        # One over the cap: detail for the first CAP, a single "...and 1 more."
+        sent = []
+        self._capture_email(monkeypatch, sent)
+        batch = [self._msg(i) for i in range(inbox._ESCALATE_DIGEST_DETAIL_CAP + 1)]
+        inbox._escalate_dead_letters(batch, "target_gone")
+        assert len(sent) == 1
+        assert "...and 1 more." in sent[0]["body"]
+        assert f"report {inbox._ESCALATE_DIGEST_DETAIL_CAP}" not in sent[0]["body"]
+
 
 class TestIdempotentDelivery:
     """#621: a delivery_unverified false-negative must NOT re-inject a landed
@@ -959,8 +1005,8 @@ class TestForceFlush:
 class TestGcSender:
     def test_gc_dead_letters_load_bearing(self, isolate, monkeypatch):
         emailed = []
-        monkeypatch.setattr(inbox, "_escalate_dead_letter",
-                            lambda m, r: emailed.append((m.kind, r)))
+        monkeypatch.setattr(inbox, "_escalate_dead_letters",
+                            lambda batch, r: emailed.extend((m.kind, r) for m in batch))
         inbox.enqueue("orch", "PR drafted", kind="done", sender="worker")
         inbox.enqueue("orch", "need review", kind="request", sender="worker")
         res = inbox.gc_sender("worker")
@@ -970,7 +1016,7 @@ class TestGcSender:
         assert emailed and all(r == "sender_exited" for _, r in emailed)
 
     def test_gc_drops_non_load_bearing(self, isolate, monkeypatch):
-        monkeypatch.setattr(inbox, "_escalate_dead_letter", lambda m, r: None)
+        monkeypatch.setattr(inbox, "_escalate_dead_letters", lambda batch, r: None)
         inbox.enqueue("orch", "fyi", kind="note", sender="worker")
         res = inbox.gc_sender("worker")
         assert res["dropped"] == 1 and res["dead"] == 0
@@ -981,8 +1027,8 @@ class TestGcSender:
         # A flush draining this inbox holds the per-session lock; gc must NOT
         # dead-letter (and email) a message that flush is mid-delivery on.
         emailed = []
-        monkeypatch.setattr(inbox, "_escalate_dead_letter",
-                            lambda m, r: emailed.append(m.id))
+        monkeypatch.setattr(inbox, "_escalate_dead_letters",
+                            lambda batch, r: emailed.extend(m.id for m in batch))
         inbox.enqueue("orch", "in flight", kind="done", sender="worker")
         held = inbox._acquire_lock("orch")  # simulate an in-flight flush
         try:
@@ -1001,6 +1047,24 @@ class TestGcSender:
         assert len(inbox.list_messages("orch")) == 1  # other sender's done kept
         assert inbox.list_ingest("orch")  # ingest untouched
 
+    def test_gc_batches_one_email_per_recipient(self, isolate, monkeypatch):
+        # Regression (#829/#830): gc_sender must send ONE digest email per
+        # recipient, not one per dead-lettered message — exercised against the
+        # real send_email seam (not a stubbed _escalate_dead_letters), so a
+        # regression back to per-message escalation inside the gc loop would
+        # actually be caught here.
+        sent = []
+        monkeypatch.setattr(
+            "agentwire.channels.email.send_email",
+            lambda **kw: sent.append(kw) or SimpleNamespace(success=True),
+        )
+        inbox.enqueue("orch", "PR drafted", kind="done", sender="worker")
+        inbox.enqueue("orch", "need review", kind="request", sender="worker")
+        res = inbox.gc_sender("worker")
+        assert res["dead"] == 2
+        assert len(sent) == 1
+        assert "2 undelivered messages" in sent[0]["subject"]
+
 
 # =============================================================================
 # Session-name validation — path-traversal hardening

{agentwire_dev-1.65.0 → agentwire_dev-1.65.2}/tests/unit/test_mcp_tools_args.py

@@ -212,6 +212,35 @@ class TestVoiceTools:
         assert "parked" in result
 
 
+class TestNotifyUserArtifactParams:
+    """#822: notify_user's artifact_url/artifact_title params (#821) had zero
+    test coverage — cover the body it builds for /api/desktop/notification."""
+
+    @patch("agentwire.mcp_notify._portal_request")
+    def test_artifact_url_sets_artifact_body_with_default_title(self, mock_req):
+        from agentwire.mcp_notify import notify_user
+        mock_req.return_value = _success(id="n1", clients=1)
+        notify_user(text="ready", artifact_url="report.html")
+        body = mock_req.call_args[0][2]
+        assert body["artifact"] == {"url": "report.html", "title": "Artifact"}
+
+    @patch("agentwire.mcp_notify._portal_request")
+    def test_artifact_title_overrides_default(self, mock_req):
+        from agentwire.mcp_notify import notify_user
+        mock_req.return_value = _success(id="n1", clients=1)
+        notify_user(text="ready", artifact_url="report.html", artifact_title="Q3 Report")
+        body = mock_req.call_args[0][2]
+        assert body["artifact"] == {"url": "report.html", "title": "Q3 Report"}
+
+    @patch("agentwire.mcp_notify._portal_request")
+    def test_no_artifact_url_omits_artifact_body(self, mock_req):
+        from agentwire.mcp_notify import notify_user
+        mock_req.return_value = _success(id="n1", clients=1)
+        notify_user(text="plain toast", artifact_title="ignored without a url")
+        body = mock_req.call_args[0][2]
+        assert "artifact" not in body
+
+
 # ---------------------------------------------------------------------------
 # Desktop tools
 # ---------------------------------------------------------------------------