Keep clicking a notification working after a shell restart (#6636)

* Keep clicking a notification working after a shell restart

Notification actions lived only in the sending process: `-a` appended
`-A default=default`, so notify-send blocked on a D-Bus ActionInvoked signal and
the caller ran the command when it arrived. Nothing about that reached disk, so a
restored popup had no action to run and its sender stayed blocked forever.

Replace `-a` with `--exec <command>`, carried as an `omarchy-exec` hint into the
snapshot's `exec` role. It travels through the popup files and history, and the
shell runs it on click, so restored toasts behave exactly like live ones and the
sender exits immediately.

That drops the scaffolding whose only job was keeping a blocked sender alive: the
first-run invitations lose their `--show` re-entry and two transient units each,
omarchy-migrate-notify loses its transient service, and the screenshot,
recording, download, and taildrop toasts lose their wrapper subshells.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Keep a failed toast from failing the work it announces

Moving these sends out of their backgrounded subshells put a fallible command
on the foreground path, where the `&` used to swallow its exit status. A
notification outage — including the shell restart this branch targets — now
propagates:

- taildrop's receiver dies under `set -e` mid-delivery
- omarchy-capture-screenshot reports failure for a screenshot it already saved
- a completed download exits before scheduling its thumbnail cleanup, leaking
  the mktemp file

Announcing is best-effort in all three: the work is already done by the time
the toast goes out.

Also drop the first-run sleep that spaced out the welcome and Wi-Fi toasts.
It compensated for the background notify-send processes this branch removes;
each send now returns only once the server has taken the toast, so sending in
order is enough to stack them newest-on-top.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Stop tying the preview cleanup to the toast's expiry

The shell loads a notification thumbnail into memory when the toast appears and
never re-reads the file, so the preview only has to outlive that load. Deriving
the cleanup delay from the expiry was false precision, and it turned -t into a
variable for no reason: -t is already the helper's expiry setting.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

test/shell.d/fingerprint-invitation-test.sh

@@ -31,27 +31,18 @@ chmod +x "$test_bin/omarchy-hw-fingerprint"
 cat >"$test_bin/omarchy-notification-send" <<'EOF'
 #!/bin/bash
 echo notification >>"$TEST_LOG"
-echo action
+while (($# > 0)); do
+  [[ $1 == "--exec" ]] && echo "exec:$2" >>"$TEST_LOG"
+  shift
+done
 EOF
 chmod +x "$test_bin/omarchy-notification-send"
 
-cat >"$test_bin/omarchy-launch-floating-terminal-with-presentation" <<'EOF'
-#!/bin/bash
-echo launch >>"$TEST_LOG"
-EOF
-chmod +x "$test_bin/omarchy-launch-floating-terminal-with-presentation"
-
+# The shell runs the click command, so the invitation must not need a unit of its
+# own to keep a blocked sender alive until the toast is answered.
 cat >"$test_bin/systemd-run" <<'EOF'
 #!/bin/bash
 echo "systemd-run:$*" >>"$TEST_LOG"
-while (($# > 0)); do
-  case $1 in
-    -p) shift 2 ;;
-    -*) shift ;;
-    *) break ;;
-  esac
-done
-exec "$@"
 EOF
 chmod +x "$test_bin/systemd-run"
 
@@ -70,17 +61,13 @@ run_invitation_hook
 
 [[ -f $test_home/.local/state/omarchy/done/fingerprint-setup-invitation ]] || fail "fingerprint invitation records completion"
 [[ -f $hook_path ]] || fail "fingerprint invitation keeps its hook installed"
-[[ $(grep -c '^systemd-run:' "$log_file") -eq 2 ]] || fail "fingerprint invitation uses durable user services"
-grep -q -- '--user --collect --quiet --service-type=exec --unit=omarchy-fingerprint-setup-invitation' "$log_file" || fail "fingerprint invitation configures its user service"
-# KillMode=process keeps the launcher's setsid child alive once the short-lived
-# main process exits, otherwise the setup terminal never appears.
-grep -q -- '--user --collect --quiet -p KillMode=process --unit=omarchy-setup-security-fingerprint ' "$log_file" || fail "fingerprint invitation outlives its launcher unit"
 [[ $(grep -c '^notification$' "$log_file") -eq 1 ]] || fail "fingerprint invitation sends one notification"
-[[ $(grep -c '^launch$' "$log_file") -eq 1 ]] || fail "fingerprint invitation handles the notification action"
+grep -qx 'exec:omarchy-launch-floating-terminal-with-presentation omarchy-setup-security-fingerprint' "$log_file" ||
+  fail "fingerprint invitation attaches the setup to the notification"
+grep -q '^systemd-run:' "$log_file" && fail "fingerprint invitation needs no unit to hold an unanswered toast"
 
 HOME="$test_home" PATH="$test_bin:$ROOT/bin:$PATH" TEST_LOG="$log_file" TEST_HW_MARKER="$hw_marker" bash "$hook_path"
 
-[[ $(grep -c '^systemd-run:' "$log_file") -eq 2 ]] || fail "completed fingerprint invitation does not schedule again"
 [[ $(grep -c '^notification$' "$log_file") -eq 1 ]] || fail "completed fingerprint invitation hook does not notify again"
 
 pass "fingerprint invitation waits for a reader and only runs once"

test/shell.d/migrate-notify-test.sh

@@ -22,23 +22,6 @@ fi
 SH
 chmod +x "$stub_bin/omarchy-migrate"
 
-cat >"$stub_bin/systemd-run" <<'SH'
-#!/bin/bash
-if [[ ${OMARCHY_TEST_SYSTEMD_RUN:-run} == "fail" ]]; then
-  exit 1
-fi
-
-command=${!#}
-
-# --scope blocks on the command, a transient service detaches it.
-if [[ " $* " == *" --scope "* ]]; then
-  bash -c "$command"
-else
-  setsid bash -c "$command" >/dev/null 2>&1 &
-fi
-SH
-chmod +x "$stub_bin/systemd-run"
-
 # Waiting for the notification server is the notifier's one long pause, so it is
 # also where an update can start underneath it. Stand one up from inside the
 # wait to prove the notifier re-checks afterwards instead of sending a toast it
@@ -67,18 +50,8 @@ chmod +x "$stub_bin/omarchy-notification-wait"
 
 cat >"$stub_bin/omarchy-notification-send" <<'SH'
 #!/bin/bash
-# Written whole so a reader polling for the file never sees half the arguments.
-printf '%s\n' "$@" >"$OMARCHY_TEST_NOTIFY_ARGS.partial"
-mv "$OMARCHY_TEST_NOTIFY_ARGS.partial" "$OMARCHY_TEST_NOTIFY_ARGS"
-
-# Stands in for a toast nobody has answered yet, until the test releases it.
-if [[ -n ${OMARCHY_TEST_NOTIFY_HOLD:-} ]]; then
-  for _ in {1..200}; do
-    [[ -e $OMARCHY_TEST_NOTIFY_HOLD ]] || break
-    sleep 0.05
-  done
-  : >"$OMARCHY_TEST_NOTIFY_ANSWERED"
-fi
+[[ ${OMARCHY_TEST_NOTIFY_SEND:-send} == "fail" ]] && exit 1
+printf '%s\n' "$@" >"$OMARCHY_TEST_NOTIFY_ARGS"
 SH
 chmod +x "$stub_bin/omarchy-notification-send"
 
@@ -91,21 +64,14 @@ run_notify() {
   XDG_RUNTIME_DIR="$runtime_dir" \
   OMARCHY_TEST_PENDING_MIGRATIONS="$1" \
   OMARCHY_TEST_NOTIFY_ARGS="$test_tmp/notify-args" \
-  OMARCHY_TEST_SYSTEMD_RUN="${2:-run}" \
+  OMARCHY_TEST_NOTIFY_SEND="${2:-send}" \
   OMARCHY_TEST_LOCK_DURING_WAIT="${OMARCHY_TEST_LOCK_DURING_WAIT:-0}" \
   OMARCHY_TEST_LOCK_HOLDER_PID="$test_tmp/lock-holder-pid" \
-  OMARCHY_TEST_NOTIFY_HOLD="${OMARCHY_TEST_NOTIFY_HOLD:-}" \
-  OMARCHY_TEST_NOTIFY_ANSWERED="$test_tmp/notify-answered" \
     "$ROOT/bin/omarchy-migrate-notify"
 }
 
-# The notification outlives the notifier, so its arguments land after it exits.
-wait_for_notify_args() {
-  for _ in {1..200}; do
-    [[ -s $test_tmp/notify-args ]] && return 0
-    sleep 0.05
-  done
-  return 1
+notify_args_written() {
+  [[ -s $test_tmp/notify-args ]]
 }
 
 run_notify 0 >"$test_tmp/not-pending.out" 2>"$test_tmp/not-pending.err"
@@ -119,7 +85,7 @@ grep -q '200-migration.sh' "$test_tmp/pending.err" || fail "migration notifier l
 pass "migration notifier reports pending migrations"
 
 run_notify 1 >"$test_tmp/notified.out" 2>"$test_tmp/notified.err"
-wait_for_notify_args || fail "migration notifier sends a notification for pending migrations"
+notify_args_written || fail "migration notifier sends a notification for pending migrations"
 grep -Fx 'Pending Omarchy Migrations' "$test_tmp/notify-args" >/dev/null || fail "migration notifier uses pending migrations title"
 grep -Fx 'Click to run 1 pending migration.' "$test_tmp/notify-args" >/dev/null || fail "migration notifier describes the pending migration"
 grep -Fx '' "$test_tmp/notify-args" >/dev/null || fail "migration notifier includes the large-slot glyph"
@@ -143,7 +109,7 @@ pass "migration notifier stays quiet while omarchy update holds its lock"
 exec {update_lock_fd}>&-
 
 run_notify 1 >/dev/null 2>&1
-wait_for_notify_args &&
+notify_args_written &&
   grep -Fx 'Pending Omarchy Migrations' "$test_tmp/notify-args" >/dev/null ||
   fail "migration notifier resumes notifying once the update lock is released"
 pass "migration notifier resumes notifying after the update releases its lock"
@@ -172,20 +138,22 @@ exec {foreign_lock_fd}>"$foreign_lock"
 flock -n "$foreign_lock_fd" || fail "test could not hold the foreign update lock"
 
 run_notify 1 >/dev/null 2>&1
-wait_for_notify_args &&
+notify_args_written &&
   grep -Fx 'Pending Omarchy Migrations' "$test_tmp/notify-args" >/dev/null ||
   fail "migration notifier ignores update locks outside its own runtime directory"
 pass "migration notifier ignores update locks outside its own runtime directory"
 
 exec {foreign_lock_fd}>&-
 
-# The notifier is a Type=oneshot with no start timeout, so blocking on the toast
-# leaves it activating until the user answers.
-rm -f "$test_tmp/notify-args" "$test_tmp/notify-answered"
-: >"$test_tmp/notify-hold"
-OMARCHY_TEST_NOTIFY_HOLD="$test_tmp/notify-hold" run_notify 1 >/dev/null 2>&1
-wait_for_notify_args || fail "migration notifier sends the notification it detaches"
-[[ ! -e $test_tmp/notify-answered ]] ||
-  fail "migration notifier waited for the toast to be answered before exiting"
-rm -f "$test_tmp/notify-hold"
-pass "migration notifier exits while the toast is still unanswered"
+# The notifier is a Type=oneshot with no start timeout, so it must not stay
+# activating until the toast is answered. Handing the click command to the shell
+# is what lets it exit immediately -- and what keeps the toast working after the
+# shell restart an update performs.
+rm -f "$test_tmp/notify-args"
+run_notify 1 >/dev/null 2>&1
+notify_args_written || fail "migration notifier sends the notification before exiting"
+grep -Fx -- '--exec' "$test_tmp/notify-args" >/dev/null ||
+  fail "migration notifier attaches the click command to the toast"
+grep -Fx 'omarchy-launch-floating-terminal-with-presentation omarchy-migrate' "$test_tmp/notify-args" >/dev/null ||
+  fail "migration notifier points the click command at omarchy-migrate"
+pass "migration notifier lets the shell own the click instead of waiting for it"

test/shell.d/notification-send-test.sh

@@ -17,7 +17,8 @@ printf '%s\n' \
 chmod +x "$stub"
 
 OMARCHY_TEST_NOTIFY_ARGS="$args_file" PATH="$tmpdir:$ROOT/bin:$PATH" \
-  omarchy-notification-send --app-name custom-app -g K -u critical --image /tmp/image.png "Learn Keybindings" "Body" -a
+  omarchy-notification-send --app-name custom-app -g K -u critical --image /tmp/image.png \
+  --exec "omarchy-menu-keybindings 'a b'" "Learn Keybindings" "Body"
 
 mapfile -t args <"$args_file"
 
@@ -27,8 +28,24 @@ mapfile -t args <"$args_file"
 [[ ${args[3]} == "critical" ]] || fail "notification wrapper uses custom urgency"
 [[ ${args[4]} == "--hint=string:omarchy-glyph:K" ]] || fail "notification wrapper converts glyph to hint"
 [[ ${args[5]} == "--hint=string:image-path:/tmp/image.png" ]] || fail "notification wrapper converts image to hint"
-[[ ${args[6]} == "-A" ]] || fail "notification wrapper passes default action flag"
-[[ ${args[7]} == "default=default" ]] || fail "notification wrapper enables default action"
-[[ ${args[8]} == "Learn Keybindings" ]] || fail "notification wrapper preserves headline"
-[[ ${args[9]} == "Body" ]] || fail "notification wrapper preserves description"
-pass "notification wrapper supports app, glyph, urgency, image, and action options"
+[[ ${args[6]} == "--hint=string:omarchy-exec:omarchy-menu-keybindings 'a b'" ]] || fail "notification wrapper converts exec to hint"
+[[ ${args[7]} == "Learn Keybindings" ]] || fail "notification wrapper preserves headline"
+[[ ${args[8]} == "Body" ]] || fail "notification wrapper preserves description"
+pass "notification wrapper supports app, glyph, urgency, image, and exec options"
+
+# The shell runs the click command itself, so nothing may block the sender on a
+# libnotify action round-trip.
+grep -q -- "-A" "$args_file" && fail "notification wrapper must not register a libnotify action"
+
+: >"$args_file"
+OMARCHY_TEST_NOTIFY_ARGS="$args_file" PATH="$tmpdir:$ROOT/bin:$PATH" \
+  omarchy-notification-send "Plain" >/dev/null
+
+grep -q "omarchy-exec" "$args_file" && fail "notification wrapper adds no exec hint without --exec"
+pass "notification wrapper omits the exec hint when no command is given"
+
+if OMARCHY_TEST_NOTIFY_ARGS="$args_file" PATH="$tmpdir:$ROOT/bin:$PATH" \
+  omarchy-notification-send "Headline" --exec 2>/dev/null; then
+  fail "notification wrapper rejects --exec without a command"
+fi
+pass "notification wrapper rejects --exec without a command"

test/shell.d/notifications-test.sh

@@ -255,6 +255,43 @@ assertEqual(
   'notifications omit the deadline field until a restore sets it'
 )
 
+// A click action carried as a command is the only kind that survives a shell
+// restart: a libnotify action leaves its sender waiting on an id from a server
+// generation that no longer exists.
+assertEqual(
+  notifications.snapshotOf({ id: 3, hints: { 'omarchy-exec': 'omarchy-menu-keybindings' } }, 1).exec,
+  'omarchy-menu-keybindings',
+  'notifications capture the click command from the exec hint'
+)
+assertEqual(
+  notifications.snapshotOf({ id: 3, hints: { 'omarchy-glyph': '!' } }, 1).exec,
+  '',
+  'notifications leave the click command empty without an exec hint'
+)
+assertEqual(
+  notifications.popupEntry(
+    JSON.parse(notifications.serializePopup({ id: 1, originalId: 1, timestamp: 5, exec: "mpv '/tmp/a b.mp4'" }, 1)),
+    1
+  ).exec,
+  "mpv '/tmp/a b.mp4'",
+  'notifications round-trip the click command through popup files'
+)
+assertEqual(
+  notifications.popupEntry({ id: 1, originalId: 1, timestamp: 5 }, 1).exec,
+  '',
+  'notifications restore an empty click command for popups without one'
+)
+assertEqual(
+  notifications.historyEntry({ id: 1, exec: 'xdg-open /tmp/received' }, 1).exec,
+  'xdg-open /tmp/received',
+  'notifications keep the click command on history rows'
+)
+assertEqual(
+  notifications.dumpRows([{ id: 1, exec: 'xdg-open /tmp/received' }])[0].exec,
+  'xdg-open /tmp/received',
+  'notifications write the click command back out with history'
+)
+
 assertEqual(notifications.imageExtension('/tmp/screenshot.PNG'), 'png', 'notifications normalize image extensions')
 assertEqual(notifications.imageExtension('/tmp/no-extension'), 'png', 'notifications default missing image extension')
 assertEqual(notifications.imageExtension('/tmp/archive.reallylong'), 'png', 'notifications reject suspicious image extensions')
@@ -304,4 +341,16 @@ assert(
   /awk 1 \\"\$1\\"\/\*\.json/.test(serviceQml),
   'notifications service delimits every popup file during restore'
 )
+assert(
+  /var command = entry \? String\(entry\.exec \|\| ""\) : ""[\s\S]{0,300}?Util\.execDetached\(command\)/.test(serviceQml),
+  'notifications service runs the popup click command itself instead of a libnotify action'
+)
+assert(
+  /exec: row\.exec \|\| ""/.test(serviceQml),
+  'notifications service carries the click command between models'
+)
+assert(
+  /exec: r\.exec \|\| ""/.test(serviceQml),
+  'notifications service saves the click command with history'
+)
 JS

test/shell.d/tailscale-receive-test.sh

@@ -25,14 +25,6 @@ SH
 cat >"$WORKDIR/bin/omarchy-notification-send" <<SH
 #!/bin/bash
 printf '%s\n' "\$*" >>"$WORKDIR/notifications"
-# Only the photo notification gets clicked.
-[[ \$* == *photo.png* ]] && echo default
-exit 0
-SH
-
-cat >"$WORKDIR/bin/xdg-open" <<SH
-#!/bin/bash
-printf '%s\n' "\$1" >>"$WORKDIR/opened"
 SH
 
 chmod +x "$WORKDIR/bin/"*
@@ -68,9 +60,14 @@ grep -q "^Received notes with space.pdf .* -g " <<<"$notifications" ||
   fail "taildrop receive announces other files with a glyph" "$notifications"
 pass "taildrop receive announces other files with a glyph"
 
-grep -qxF "$downloads/photo.png" "$WORKDIR/opened" ||
-  fail "taildrop receive opens a clicked file" "$(cat "$WORKDIR/opened" 2>/dev/null)"
-pass "taildrop receive opens a clicked file"
+# The shell keeps the click command with the toast, so receiving does not have
+# to sit blocked on an answer -- and the toast still opens the file after a shell
+# restart. Names with spaces have to arrive quoted for the shell to run them.
+grep -qF -- "--exec xdg-open $downloads/photo.png" <<<"$notifications" ||
+  fail "taildrop receive attaches the open command to the notification" "$notifications"
+grep -qF -- "--exec xdg-open $(printf %q "$downloads/notes with space.pdf")" <<<"$notifications" ||
+  fail "taildrop receive quotes spaced names in the open command" "$notifications"
+pass "taildrop receive lets a click open the received file"
 
 grep -q "unrelated.txt" <<<"$notifications" &&
   fail "taildrop receive leaves the rest of the downloads directory alone" "$notifications"

test/shell.d/voxtype-invitation-test.sh

@@ -18,27 +18,18 @@ mkdir -p "$(dirname "$hook_path")"
 cat >"$test_bin/omarchy-notification-send" <<'EOF'
 #!/bin/bash
 echo notification >>"$TEST_LOG"
-echo action
+while (($# > 0)); do
+  [[ $1 == "--exec" ]] && echo "exec:$2" >>"$TEST_LOG"
+  shift
+done
 EOF
 chmod +x "$test_bin/omarchy-notification-send"
 
-cat >"$test_bin/omarchy-launch-floating-terminal-with-presentation" <<'EOF'
-#!/bin/bash
-echo launch >>"$TEST_LOG"
-EOF
-chmod +x "$test_bin/omarchy-launch-floating-terminal-with-presentation"
-
+# The shell runs the click command, so the invitation must not need a unit of its
+# own to keep a blocked sender alive until the toast is answered.
 cat >"$test_bin/systemd-run" <<'EOF'
 #!/bin/bash
 echo "systemd-run:$*" >>"$TEST_LOG"
-while (($# > 0)); do
-  case $1 in
-    -p) shift 2 ;;
-    -*) shift ;;
-    *) break ;;
-  esac
-done
-exec "$@"
 EOF
 chmod +x "$test_bin/systemd-run"
 
@@ -51,19 +42,14 @@ run_invitation_hook
 
 [[ -f $test_home/.local/state/omarchy/done/voxtype-install-invitation ]] || fail "Voxtype invitation records completion"
 [[ -f $hook_path ]] || fail "Voxtype invitation keeps its hook installed"
-[[ $(grep -c '^systemd-run:' "$log_file") -eq 2 ]] || fail "Voxtype invitation uses durable user services"
-grep -q -- '--user --collect --quiet --service-type=exec --unit=omarchy-voxtype-install-invitation' "$log_file" || fail "Voxtype invitation configures its user service"
-# KillMode=process keeps the launcher's setsid child alive once the short-lived
-# main process exits, otherwise the install terminal never appears.
-grep -q -- '--user --collect --quiet -p KillMode=process --unit=omarchy-voxtype-install ' "$log_file" || fail "Voxtype invitation outlives its launcher unit"
 [[ $(grep -c '^notification$' "$log_file") -eq 1 ]] || fail "Voxtype invitation sends one notification"
-[[ $(grep -c '^launch$' "$log_file") -eq 1 ]] || fail "Voxtype invitation handles the notification action"
+grep -qx 'exec:omarchy-launch-floating-terminal-with-presentation omarchy-voxtype-install' "$log_file" ||
+  fail "Voxtype invitation attaches the installer to the notification"
+grep -q '^systemd-run:' "$log_file" && fail "Voxtype invitation needs no unit to hold an unanswered toast"
 
 HOME="$test_home" PATH="$test_bin:$ROOT/bin:$PATH" TEST_LOG="$log_file" bash "$hook_path"
 
 [[ -f $hook_path ]] || fail "completed Voxtype invitation keeps its hook installed"
-[[ $(grep -c '^systemd-run:' "$log_file") -eq 2 ]] || fail "completed Voxtype invitation does not schedule again"
 [[ $(grep -c '^notification$' "$log_file") -eq 1 ]] || fail "completed Voxtype invitation hook does not notify again"
-[[ $(grep -c '^launch$' "$log_file") -eq 1 ]] || fail "completed Voxtype invitation hook does not launch again"
 
 pass "Voxtype invitation only runs once"