Carry each request's answer, who gave it and its delivery through the journal, replay and the phone (CF-6, request half) (#308)

* Record who answered each request and whether the answer reached the CLI

A card is the record of its request across the journal, snapshots, paired desktops and the phone
(CF-6, request half). An accepted answer now saves answeredBy ("desktop" or "phone") and
delivery "sending" before the CLI hears anything, then delivery "sent" after the hand-off. They
travel as whole field values in the existing item events, so the journal stores and replays them
with no new event type.

On a restart, a card still "sending" becomes "uncertain": Modex stopped between taking the answer
and recording its hand-off. The answer is never sent again, and a late answer is refused. The
phone gets answeredBy, delivery and withdrawn on approvals, and a question's notice says when
delivery is uncertain.

test/request-journal.test.ts failed first on each missing field: replay once and twice, a
restart, desktop and phone answering at once (one accepted, the phone's a 409), a paired desktop
resuming after the decision, an expired cursor, a crash mid-send, and a secret kept out of every
file with the journal on.

Refs #279

Coven-Harness: Claude Code / claude-opus-5-5

* Say on a card when the phone answered or delivery is uncertain

answerNote adds "Answered on your phone." under a card the phone answered, and "Modex stopped
before it could confirm the agent received this answer." when delivery is uncertain. An answer
given in the window and sent adds nothing. Its unit test failed first (no such export).

e2e/human-requests.spec.ts runs the Codex question fixture with the journal on, closes Modex,
marks the answered card as if Modex died mid-send, and restarts: the answered and stopped cards
are inert, the uncertain one says so, a second answer is refused, Codex hears nothing more, and no
file holds the secret.

Refs #279

Coven-Harness: Claude Code / claude-opus-5-5

* Document the request lifecycle across replay and reconnect

docs/human-requests.md maps each broker step to the card fields that carry it, and says what a
restart, replay, a late answer, two clients at once, the phone and the window do with them.
docs/event-journal.md points there instead of saying the lifecycle is still to come.

Refs #279

Coven-Harness: Claude Code / claude-opus-5-5

* Let the phone act on threads started on the Mac

Since #181 (v0.0.12), a thread created from a Mac draft keeps the full UUID its draft reserved,
but the companion's thread routes accepted only 8 hex characters. So the phone got a 404 when it
answered an approval, sent a follow-up, set the approval policy or archived any thread started on
the Mac; threads started on the phone, with short ids, worked. CF-8's fidelity e2e found it.

The routes now take any id the store accepts, and the thread must still exist. The new companion
test failed first with 404 for a UUID thread.

Refs #279

Coven-Harness: Claude Code / claude-opus-5-5

* Record CF-6's request half and the phone fix in status

Refs #279

Coven-Harness: Claude Code / claude-opus-5-5

Author: BunsDev

apps/desktop/e2e/human-requests.spec.ts

@@ -149,3 +149,71 @@ test("Codex questions: the card answers by its schema, the CLI hears once, the s
     fs.rmSync(logs, { recursive: true, force: true });
   }
 });
+
+test("with the journal on, a restart shows answered and stopped cards inert, says when an answer was never confirmed, and re-sends nothing", async () => {
+  const { home } = seedHome({ default_backend: "codex", default_mode: "agent" });
+  const logs = fs.mkdtempSync(path.join(os.tmpdir(), "modex-e2e-codex-questions-"));
+  const statePath = path.join(home, "app/state.json");
+  const state = JSON.parse(fs.readFileSync(statePath, "utf8"));
+  state.settings.codex_bin = fixture(logs);
+  fs.writeFileSync(statePath, JSON.stringify(state));
+  const journal = process.env.MODEX_EVENT_JOURNAL;
+  process.env.MODEX_EVENT_JOURNAL = "1";
+  let app: ElectronApplication | undefined;
+  try {
+    let opened = await launch(home); app = opened.app;
+    let page = opened.page;
+    await send(page, "deploy it");
+    const card = items(page, "question").first();
+    await card.getByRole("radio", { name: "staging" }).check();
+    await card.getByLabel("Token").fill("s3cr3t-token");
+    await tid(card, "question-submit").click();
+    await expect(tid(card, "question-answer")).toHaveText(["staging", "(hidden)"]);
+    await expect(currentRow(page)).toHaveAttribute("data-status", "idle");
+    await expect(tid(card, "answer-note")).toHaveCount(0);
+    // A follow-up in the same thread asks again; Stop closes that card unanswered.
+    await tid(page, "composer-input").fill("deploy again");
+    await page.keyboard.press("Meta+Enter");
+    await expect(tid(items(page, "question").nth(1), "question-submit")).toBeVisible();
+    await tid(page, "stop").click();
+    await expect(currentRow(page)).toHaveAttribute("data-status", "idle");
+    const threadId = (await currentRow(page).getAttribute("data-thread-id"))!;
+    const lifecycle = (list: { kind: string; answeredBy?: string; delivery?: string; withdrawn?: string }[]) =>
+      list.filter((i) => i.kind === "question").map((i) => [i.answeredBy ?? null, i.delivery ?? null, i.withdrawn ?? null]);
+    expect(lifecycle(await page.evaluate((id) => window.modex!.invoke("thread:items", { threadId: id }), threadId) as never)).toEqual([["desktop", "sent", null], [null, null, "stopped"]]);
+    await app.close();
+    app = undefined;
+    expect(replies(logs)).toHaveLength(2);
+
+    // As if Modex had died after taking the first answer and before recording its hand-off to Codex.
+    const file = path.join(home, "app", "threads", `${threadId}.json`);
+    const saved = JSON.parse(fs.readFileSync(file, "utf8")) as { kind: string; delivery?: string }[];
+    saved.find((i) => i.kind === "question")!.delivery = "sending";
+    fs.writeFileSync(file, JSON.stringify(saved));
+
+    opened = await launch(home); app = opened.app;
+    page = opened.page;
+    await page.locator(`[data-testid="thread-row"][data-thread-id="${threadId}"] button.thread-main`).click();
+    const [first, second] = [items(page, "question").first(), items(page, "question").nth(1)];
+    await expect(tid(first, "question-answer")).toHaveText(["staging", "(hidden)"]);
+    await expect(tid(first, "answer-note")).toHaveText("Modex stopped before it could confirm the agent received this answer.");
+    await expect(tid(second, "question-closed")).toHaveText("Not answered — the turn was stopped");
+    await expect(page.locator('[data-testid="question-submit"]')).toHaveCount(0);
+    expect(lifecycle(await page.evaluate((id) => window.modex!.invoke("thread:items", { threadId: id }), threadId) as never)).toEqual([["desktop", "uncertain", null], [null, null, "stopped"]]);
+    // An old window answering the uncertain card again is refused, and nothing reaches Codex.
+    expect(await page.evaluate(async (id) => {
+      const list = await window.modex!.invoke("thread:items", { threadId: id }) as { id: string; kind: string }[];
+      return window.modex!.invoke("thread:answer-question", { threadId: id, itemId: list.find((i) => i.kind === "question")!.id, answers: { "q-env": ["production"], "q-token": ["other"] } });
+    }, threadId)).toEqual({ ok: false, reason: "already-resolved" });
+    expect(replies(logs)).toHaveLength(2);
+    await app.close();
+    app = undefined;
+    // The journal recorded all of it, and no file Modex wrote holds the secret.
+    expect(fs.existsSync(path.join(home, "app", "events.sqlite"))).toBe(true);
+    expect(everything(path.join(home, "app")).includes("s3cr3t-token")).toBe(false);
+  } finally {
+    if (journal === undefined) delete process.env.MODEX_EVENT_JOURNAL; else process.env.MODEX_EVENT_JOURNAL = journal;
+    await app?.close();
+    fs.rmSync(logs, { recursive: true, force: true });
+  }
+});

apps/desktop/src/main/engine/companion.ts

@@ -308,7 +308,9 @@ export class CompanionServer {
       this.reply(res, 201, { thread: mobileThread(thread, this.source.status(thread.id), this.source.pullRequest?.(thread.id)) });
       return;
     }
-    const match = /^\/v1\/threads\/([a-f0-9]{8})\/(send|answer|policy|archive)$/.exec(url.pathname);
+    // Any id the store accepts: 8 hex characters for threads made here or by older builds, the full UUID a
+    // Mac draft reserved (#181). The thread must still exist.
+    const match = /^\/v1\/threads\/([A-Za-z0-9_-]{1,128})\/(send|answer|policy|archive)$/.exec(url.pathname);
     if (req.method !== "POST" || !match) { this.reply(res, 404, { error: "Not found." }); return; }
     const threadId = match[1]!;
     const action = match[2]!;
@@ -385,7 +387,9 @@ export function mobileItem(item: ThreadItem): Record<string, unknown> {
     case "assistant": return { id: item.id, kind: item.kind, text: item.text, at: item.at, ...(item.phase ? { phase: item.phase } : {}), ...(item.outcome ? { outcome: item.outcome } : {}) };
     case "thinking": return { id: item.id, kind: item.kind, text: item.text, at: item.at, ...(item.reasoning ? { reasoning: item.reasoning } : {}), ...(item.outcome ? { outcome: item.outcome } : {}) };
     case "user": case "notice": return { id: item.id, kind: item.kind, text: item.text, at: item.at, ...(item.kind === "notice" ? { level: item.level } : {}) };
-    case "approval": return { id: item.id, kind: item.kind, question: item.question, detail: item.detail, answer: item.answer, ...(item.decidedBy?.source === "policy" ? { auto: item.decidedBy.ruleId.slice("policy:".length) } : item.decidedBy && item.decidedBy.decision !== "ask" ? { auto: "rule" } : {}), at: item.at };
+    // Who answered, whether it reached the CLI and why an unanswered card closed ride along the same way.
+    case "approval": return { id: item.id, kind: item.kind, question: item.question, detail: item.detail, answer: item.answer, ...(item.decidedBy?.source === "policy" ? { auto: item.decidedBy.ruleId.slice("policy:".length) } : item.decidedBy && item.decidedBy.decision !== "ask" ? { auto: "rule" } : {}),
+      ...(item.answeredBy ? { answeredBy: item.answeredBy } : {}), ...(item.delivery ? { delivery: item.delivery } : {}), ...(item.withdrawn ? { withdrawn: item.withdrawn } : {}), at: item.at };
     // A phone that reads only title and status shows every finished tool as done, so a finished tool
     // that did not succeed says how it ended in its title.
     case "tool": return { id: item.id, kind: item.kind, title: item.status === "done" && (item.outcome ? item.outcome !== "succeeded" : item.ok === false) ? `${item.title} · ${toolStatusLabel(item)}` : item.title,
@@ -395,7 +399,7 @@ export function mobileItem(item: ThreadItem): Record<string, unknown> {
     case "plan": return { id: item.id, kind: item.kind, text: `Plan · ${item.steps.filter((s) => s.status === "completed").length} of ${item.steps.length} reported done`, steps: item.steps, revision: item.revision, ...(item.outcome ? { outcome: item.outcome } : {}), at: item.at };
     // Phones cannot answer questions yet: a notice every client can show, with the questions and never the answers.
     case "question": return { id: item.id, kind: "notice", level: "info", at: item.at,
-      text: `The agent asked: ${item.questions.map((q) => q.text).join(" · ")}\n${item.answers ? "Answered on your Mac." : item.withdrawn ? "Not answered." : "Answer it in Modex on your Mac."}` };
+      text: `The agent asked: ${item.questions.map((q) => q.text).join(" · ")}\n${item.answers ? (item.delivery === "uncertain" ? "Answered on your Mac; Modex can't tell whether the agent received it." : "Answered on your Mac.") : item.withdrawn ? "Not answered." : "Answer it in Modex on your Mac."}` };
   }
 }
 

apps/desktop/src/main/engine/runner.ts

@@ -217,6 +217,9 @@ export class ThreadRunner {
         // A card nobody answered: the process that could take the answer is gone, so it closes as ended.
         if (item.kind === "approval" && !item.answer) return { ...item, answer: "no", withdrawn: "ended" };
         if (item.kind === "question" && !item.answers && !item.withdrawn) return { ...item, withdrawn: "ended" };
+        // An answer taken but not recorded as handed to the CLI: nobody can tell whether the CLI got it, and it is
+        // never sent again.
+        if ((item.kind === "approval" || item.kind === "question") && item.delivery === "sending") return { ...item, delivery: "uncertain" };
         if (item.kind !== "tool" || !item.agent || !["running", "waiting"].includes(item.agent.state)) return item;
         return { ...item, status: "done", ok: undefined, agent: { ...item.agent, state: "unknown", detail: "Modex restarted without a final agent status" } };
       });
@@ -931,10 +934,10 @@ export class ThreadRunner {
     const pending = l.pending.get(itemId);
     if (!accepted.ok || pending?.kind !== "approval") return accepted.ok ? { ok: false, reason: "invalid" } : accepted;
     l.pending.delete(itemId);
-    this.patchItem(threadId, itemId, { answer });
+    this.patchItem(threadId, itemId, { answer, answeredBy: by, delivery: "sending" });
     if (l.pending.size === 0 && l.status === "waiting") this.setStatus(threadId, "running");
     pending.settle(answer);
-    l.requests = settleRequest(l.requests, itemId, "sent");
+    this.sent(threadId, l, itemId);
     return { ok: true };
   }
 
@@ -953,13 +956,19 @@ export class ThreadRunner {
     if (!accepted.ok || pending?.kind !== "question") return accepted.ok ? { ok: false, reason: "invalid" } : accepted;
     const given = answers as Record<string, string[]>;
     l.pending.delete(itemId);
-    this.patchItem(threadId, itemId, { answers: publicAnswers(pending.questions, given) });
+    this.patchItem(threadId, itemId, { answers: publicAnswers(pending.questions, given), answeredBy: by, delivery: "sending" });
     if (l.pending.size === 0 && l.status === "waiting") this.setStatus(threadId, "running");
     pending.settle({ answers: given });
-    l.requests = settleRequest(l.requests, itemId, "sent");
+    this.sent(threadId, l, itemId);
     return { ok: true };
   }
 
+  /** Records that an accepted answer was handed to the CLI, in the broker and on the card. */
+  private sent(threadId: string, l: Live, itemId: string): void {
+    l.requests = settleRequest(l.requests, itemId, "sent");
+    this.patchItem(threadId, itemId, { delivery: "sent" });
+  }
+
   /** Takes one answer for a waiting request through the broker, or says why not. */
   private accept(l: Live, itemId: string, resolution: Resolution, by: string): AnswerResult {
     const record = l.requests.requests[itemId];

apps/desktop/src/renderer/components/ThreadView.tsx

@@ -4,6 +4,7 @@ import type { AnswerResult, ApprovalPolicy, ApprovalReceipt, BackendId, FollowUp
 import { failureReport } from "../../shared/failures";
 import { askedBecause, jevNotConsulted, receiptVia } from "../../shared/approval-receipt";
 import { safeHref } from "../../shared/inline";
+import { answerNote } from "../../shared/human-requests";
 import { parseWebSearch, splitSources, type SourceLink, type WebSearch } from "../../shared/sources";
 import type { AttachmentActions } from "../composer-attachments";
 import type { Attachment } from "../../shared/attachments";
@@ -376,7 +377,10 @@ function ApprovalItem({ item, onAnswer, onPolicy }: { item: ApprovalEntry; onAns
       {r?.decision === "ask" && <div className="approval-reason" data-testid="approval-reason">{askedBecause(r)}</div>}
       {item.detail && <pre className="detail">{item.detail}</pre>}
       {item.answer ? (
-        <div className="approval-answer" data-testid="approval-answer" data-withdrawn={item.withdrawn}>{item.withdrawn ? WITHDRAWN[item.withdrawn] : item.answer === "yes" ? "Approved" : item.answer === "always" ? "Approved — always for this command" : "Denied"}</div>
+        <>
+          <div className="approval-answer" data-testid="approval-answer" data-withdrawn={item.withdrawn}>{item.withdrawn ? WITHDRAWN[item.withdrawn] : item.answer === "yes" ? "Approved" : item.answer === "always" ? "Approved — always for this command" : "Denied"}</div>
+          {!item.withdrawn && answerNote(item) && <div className="answer-note" data-testid="answer-note" data-delivery={item.delivery}>{answerNote(item)}</div>}
+        </>
       ) : (
         <div className="row">
           <button className="btn primary small" onClick={() => onAnswer(item.id, "yes")}>Approve</button>

apps/desktop/src/renderer/components/transcript/QuestionCard.tsx

@@ -1,6 +1,6 @@
 import { useState } from "react";
 import type { AnswerResult, ThreadItem } from "../../../shared/types";
-import type { Question } from "../../../shared/human-requests";
+import { answerNote, type Question } from "../../../shared/human-requests";
 
 type QuestionEntry = Extract<ThreadItem, { kind: "question" }>;
 
@@ -85,6 +85,7 @@ export function QuestionCard({ item, onAnswer }: { item: QuestionEntry; onAnswer
           )}
         </div>
       ))}
+      {item.answers && answerNote(item) && <div className="answer-note" data-testid="answer-note" data-delivery={item.delivery}>{answerNote(item)}</div>}
       {item.withdrawn ? <div className="approval-answer" data-testid="question-closed">{CLOSED[item.withdrawn]}</div> : open && (
         <div className="row">
           <button className="btn primary small" data-testid="question-submit" disabled={sending} onClick={() => void submit()}>Send answers</button>

apps/desktop/src/renderer/styles.css

@@ -641,6 +641,7 @@ a.thread-pr:hover { text-decoration: underline; }
 .shield { color: var(--warn); }
 .approval .detail { max-height: 200px; margin: 0 0 12px; padding: 8px 10px; overflow: auto; border-radius: var(--radius-sm); background: var(--bg-sunken); color: var(--text-2); white-space: pre-wrap; }
 .approval-answer { color: var(--text-3); font-size: var(--text-sm); }
+.answer-note { margin-top: 4px; color: var(--text-3); font-size: var(--text-sm); }
 .approval-reason { margin: -4px 0 10px; color: var(--text-3); font-size: var(--text-sm); }
 /* Question card: the approval frame, one block per question, each with its own control. */
 .question-field { margin: 0 0 12px; }

apps/desktop/src/shared/human-requests.ts

@@ -7,7 +7,7 @@
  *
  * Pure and serializable, shared by main (which owns the authoritative state) and clients.
  */
-import type { BackendId } from "./types.js";
+import type { AnswerDelivery, BackendId } from "./types.js";
 
 export const HUMAN_REQUEST_SCHEMA = 1 as const;
 
@@ -135,6 +135,18 @@ export function validateAnswers(questions: readonly Question[], answers: unknown
   return { ok: true, answers: answers as Record<string, string[]> };
 }
 
+/**
+ * What a closed card adds under its answer: that the phone gave it, and that nobody can tell whether the CLI
+ * received it. An answer given in this window and sent, or saved before these fields existed, adds nothing.
+ */
+export function answerNote(card: { answeredBy?: string; delivery?: AnswerDelivery }): string | null {
+  const notes = [
+    card.answeredBy === "phone" ? "Answered on your phone." : "",
+    card.delivery === "uncertain" ? "Modex stopped before it could confirm the agent received this answer." : "",
+  ].filter(Boolean);
+  return notes.length ? notes.join(" ") : null;
+}
+
 /** Answers as they may be shown, saved or exported: a secret answer is "(hidden)". */
 export function publicAnswers(questions: readonly Question[], answers: Record<string, string[]>): Record<string, string[]> {
   const secret = new Set(questions.filter((q) => q.secret).map((q) => q.id));

apps/desktop/src/shared/types.ts

@@ -119,14 +119,16 @@ export type ThreadItem =
   /**
    * `withdrawn` says why a card closed without a human answer: the CLI withdrew the request (`native`), the turn
    * was stopped (`stopped`), or it ended first (`ended`). Such a card also carries `answer: "no"`, so clients
-   * that predate the field show it closed, never actionable.
+   * that predate the field show it closed, never actionable. `answeredBy` and `delivery` are a person's answer's
+   * lifecycle (docs/human-requests.md#across-replay-and-reconnect).
    */
-  | { id: string; kind: "approval"; question: string; detail?: string; canAlways?: boolean; title?: string; answer?: ApprovalAnswer; decidedBy?: ApprovalReceipt; withdrawn?: "native" | "stopped" | "ended"; at: string }
+  | { id: string; kind: "approval"; question: string; detail?: string; canAlways?: boolean; title?: string; answer?: ApprovalAnswer; decidedBy?: ApprovalReceipt; withdrawn?: "native" | "stopped" | "ended"; answeredBy?: string; delivery?: AnswerDelivery; at: string }
   /**
    * A question the CLI asked a person (docs/human-requests.md; Codex `item/tool/requestUserInput`). `answers`
-   * are the answers as they may be shown, saved or exported: a secret one is "(hidden)". `withdrawn` as on approvals.
+   * are the answers as they may be shown, saved or exported: a secret one is "(hidden)". `withdrawn`, `answeredBy`
+   * and `delivery` as on approvals.
    */
-  | { id: string; kind: "question"; questions: Question[]; blocking: boolean; answers?: Record<string, string[]>; withdrawn?: "native" | "stopped" | "ended"; at: string }
+  | { id: string; kind: "question"; questions: Question[]; blocking: boolean; answers?: Record<string, string[]>; withdrawn?: "native" | "stopped" | "ended"; answeredBy?: string; delivery?: AnswerDelivery; at: string }
   /** `failure` is set on the error notice that ends a turn: it carries the CLI's message, a remedy, and debug context. */
   | { id: string; kind: "notice"; level: "info" | "warn" | "error"; text: string; at: string; failure?: TurnFailure; knowledge?: import("./knowledge.js").KnowledgeChange; pages?: import("./pages.js").PagesChange }
   /** Model reasoning: Codex reasoning summaries or Claude extended thinking. Collapsible in the UI. `reasoning` says which. */
@@ -136,6 +138,12 @@ export type ThreadItem =
   /** An Auto routing decision made before a turn: what was picked and why. */
   | { id: string; kind: "route"; backend: BackendId; model: string; effort?: string; fast: boolean; source: "jev" | "heuristic"; task: string; confidence: number; complexity: number; pinned: boolean; blocked?: true; held?: true; reasons: string[]; durationMs: number; at: string };
 
+/**
+ * Whether a person's accepted answer reached the CLI: `sending` from acceptance until the hand-off, then `sent`.
+ * `uncertain` when Modex stopped in between, so nobody can tell; such an answer is never sent again.
+ */
+export type AnswerDelivery = "sending" | "sent" | "uncertain";
+
 /** Why a turn did not complete, read from the CLI's own message (see shared/failures.ts). */
 export type FailureCode = "auth" | "not_installed" | "rate_limited" | "network" | "crashed" | "unsupported_history" | "unknown";