@quantiya/codevibe-antigravity-plugin 2.0.63 → 2.0.64

package/dist/server.js

@@ -37,16 +37,18 @@ __export(server_exports, {
   __testing: () => __testing,
   classifyEntrypoint: () => classifyEntrypoint,
   classifyTmuxHasSessionError: () => classifyTmuxHasSessionError,
+  commandDigest: () => commandDigest,
   generateLaunchSessionId: () => generateLaunchSessionId,
   getActiveConversationFromCliLog: () => getActiveConversationFromCliLog,
   parseMaybeJson: () => parseMaybeJson,
+  readTranscriptFirstType: () => readTranscriptFirstType,
   runForeignSpawnIdle: () => runForeignSpawnIdle
 });
 module.exports = __toCommonJS(server_exports);
 var crypto3 = __toESM(require("crypto"));
-var path5 = __toESM(require("path"));
-var fs5 = __toESM(require("fs"));
-var os5 = __toESM(require("os"));
+var path8 = __toESM(require("path"));
+var fs7 = __toESM(require("fs"));
+var os7 = __toESM(require("os"));
 var import_child_process3 = require("child_process");
 var import_util3 = require("util");
 var import_codevibe_core6 = require("@quantiya/codevibe-core");
@@ -66,6 +68,60 @@ var fs = __toESM(require("fs"));
 var crypto = __toESM(require("crypto"));
 var http = __toESM(require("http"));
 var import_codevibe_core2 = require("@quantiya/codevibe-core");
+
+// src/agy-hook-paths.ts
+var os2 = __toESM(require("os"));
+var path2 = __toESM(require("path"));
+var HOOK_ENTRY_NAME = "codevibe-antigravity";
+var HOOK_ROUTE_PREFIX = "/agy-hook/v1/";
+var HOOK_EVENTS = ["PreInvocation", "PostToolUse"];
+var HOOK_SHELL_BASENAME = "agy-hook.sh";
+var HOOK_SCRIPT_BASENAME = "agy-hook.js";
+function isHookEvent(value) {
+  return typeof value === "string" && HOOK_EVENTS.includes(value);
+}
+function codevibeAgyDir(home = os2.homedir()) {
+  return path2.join(home, ".codevibe", "codevibe-agy");
+}
+function hooksDir(home = os2.homedir()) {
+  return path2.join(codevibeAgyDir(home), "hooks");
+}
+function globalHooksConfigPath(home = os2.homedir()) {
+  return path2.join(home, ".gemini", "config", "hooks.json");
+}
+
+// src/http-api.ts
+var HOOK_BODY_MAX_BYTES = 64 * 1024;
+var UUID_PATTERN = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+function parseAgyHookDelivery(event, raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const body = raw;
+  if (typeof body.conversationId !== "string" || !UUID_PATTERN.test(body.conversationId)) return null;
+  const delivery = { event, conversationId: body.conversationId };
+  for (const key of ["invocationNum", "initialNumSteps", "stepIdx"]) {
+    const value = body[key];
+    if (value === void 0) continue;
+    if (!Number.isInteger(value) || value < 0) return null;
+    delivery[key] = value;
+  }
+  if (body.toolName !== void 0) {
+    if (typeof body.toolName !== "string") return null;
+    delivery.toolName = body.toolName;
+  }
+  if (body.toolArgs !== void 0) {
+    if (!body.toolArgs || typeof body.toolArgs !== "object" || Array.isArray(body.toolArgs)) return null;
+    const args = {};
+    for (const [key, value] of Object.entries(body.toolArgs)) {
+      if (typeof value === "string") args[key] = value;
+    }
+    delivery.toolArgs = args;
+  }
+  if (body.hasError !== void 0) {
+    if (typeof body.hasError !== "boolean") return null;
+    delivery.hasError = body.hasError;
+  }
+  return delivery;
+}
 var HttpApi = class {
   constructor(options) {
     this.server = null;
@@ -160,8 +216,50 @@ var HttpApi = class {
       void this.handlePostEvent(req, res);
       return;
     }
+    if (req.method === "POST" && pathOnly.startsWith(HOOK_ROUTE_PREFIX)) {
+      void this.handleAgyHook(req, res, pathOnly.slice(HOOK_ROUTE_PREFIX.length));
+      return;
+    }
     this.sendJson(res, 404, { success: false, error: "not found" });
   }
+  async handleAgyHook(req, res, eventName) {
+    if (!isHookEvent(eventName)) {
+      this.sendJson(res, 404, { success: false, error: "unknown hook event" });
+      return;
+    }
+    const onAgyHook = this.handlers?.onAgyHook;
+    if (!onAgyHook) {
+      this.sendJson(res, 503, { success: false, error: "server not ready" });
+      return;
+    }
+    let body;
+    try {
+      body = await readBody(req, HOOK_BODY_MAX_BYTES);
+    } catch {
+      this.sendJson(res, 413, { success: false, error: "body too large or read failed" });
+      return;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(body);
+    } catch {
+      this.sendJson(res, 400, { success: false, error: "invalid JSON" });
+      return;
+    }
+    const delivery = parseAgyHookDelivery(eventName, parsed);
+    if (!delivery) {
+      this.sendJson(res, 400, { success: false, error: "invalid hook delivery" });
+      return;
+    }
+    try {
+      onAgyHook(delivery);
+    } catch (err) {
+      logger.error("agy hook handler failed", { event: eventName, error: String(err) });
+      this.sendJson(res, 500, { success: false, error: "hook handling failed" });
+      return;
+    }
+    this.sendJson(res, 200, { success: true });
+  }
   checkBearer(req) {
     const auth = req.headers["authorization"];
     if (typeof auth !== "string") return false;
@@ -239,6 +337,7 @@ var HttpApi = class {
     const content = JSON.stringify({
       port: this.assignedPort,
       token: this.bearerToken,
+      pid: process.pid,
       writtenAt: (/* @__PURE__ */ new Date()).toISOString()
     });
     const tmpPath = `${this.portFilePath}.tmp.${process.pid}`;
@@ -290,8 +389,8 @@ async function readBody(req, maxBytes) {
 // src/transcript-tailer.ts
 var import_events = require("events");
 var fs2 = __toESM(require("fs"));
-var os2 = __toESM(require("os"));
-var path2 = __toESM(require("path"));
+var os3 = __toESM(require("os"));
+var path3 = __toESM(require("path"));
 var import_chokidar = require("chokidar");
 
 // src/shutdown-bounds.ts
@@ -405,10 +504,10 @@ function watchOneFilePolled(target, options) {
   return watcher;
 }
 function defaultPaths() {
-  const home = os2.homedir();
+  const home = os3.homedir();
   return {
-    brainRoot: path2.join(home, ".gemini", "antigravity-cli", "brain"),
-    offsetFilePath: path2.join(home, ".codevibe", "codevibe-agy", "transcript-offsets.json")
+    brainRoot: path3.join(home, ".gemini", "antigravity-cli", "brain"),
+    offsetFilePath: path3.join(home, ".codevibe", "codevibe-agy", "transcript-offsets.json")
   };
 }
 var TranscriptTailer = class extends import_events.EventEmitter {
@@ -722,7 +821,7 @@ var TranscriptTailer = class extends import_events.EventEmitter {
   onConversationDirAdded(conversationId) {
     if (this.isShuttingDown) return;
     logger.info("New brain directory discovered (pre-prompt)", {
-      dirPath: path2.join(this.brainRoot, conversationId),
+      dirPath: path3.join(this.brainRoot, conversationId),
       conversationId
     });
     this.emit("conversation-discovered", conversationId);
@@ -914,7 +1013,7 @@ var TranscriptTailer = class extends import_events.EventEmitter {
     this.cursorResets.set(filePath, (this.cursorResets.get(filePath) ?? 0) + 1);
   }
   transcriptPathFor(conversationId) {
-    return path2.join(this.brainRoot, conversationId, SYSTEM_GENERATED_DIR, LOGS_DIR, TRANSCRIPT_BASENAME);
+    return path3.join(this.brainRoot, conversationId, SYSTEM_GENERATED_DIR, LOGS_DIR, TRANSCRIPT_BASENAME);
   }
   /** UUID-named directories directly under the brain root; null on failure. */
   listConversationDirs() {
@@ -1022,8 +1121,8 @@ var TranscriptTailer = class extends import_events.EventEmitter {
             this.snapshotTranscript(this.transcriptPathFor(conversationId))
           );
         }
-        const dirPath = path2.join(this.brainRoot, conversationId);
-        const transcriptPath = path2.join(
+        const dirPath = path3.join(this.brainRoot, conversationId);
+        const transcriptPath = path3.join(
           dirPath,
           ".system_generated",
           "logs",
@@ -1349,7 +1448,7 @@ var TranscriptTailer = class extends import_events.EventEmitter {
       return;
     }
     try {
-      const offsetDir = path2.dirname(this.offsetFilePath);
+      const offsetDir = path3.dirname(this.offsetFilePath);
       if (!fs2.existsSync(offsetDir)) {
         fs2.mkdirSync(offsetDir, { recursive: true, mode: 448 });
       }
@@ -1390,10 +1489,815 @@ var TranscriptTailer = class extends import_events.EventEmitter {
   }
 };
 
-// src/tmux-pane-observer.ts
+// src/conversation-router.ts
+var DEFAULT_HOLD_MS = 4e3;
+var DEFAULT_MAX_HELD_PER_CONVERSATION = 2e3;
+var DEFAULT_MAX_HELD_CONVERSATIONS = 16;
+var DEFAULT_MAX_PARKED_PER_CONVERSATION = 64;
+var VOUCHER_QUEUE_MS = 1e4;
+var PENDING_TURN_MS = 6e4;
+var ConversationRouter = class {
+  constructor(options) {
+    this.roles = /* @__PURE__ */ new Map();
+    this.lastInvoked = /* @__PURE__ */ new Map();
+    /** Reported by PostToolUse only, with an inconclusive transcript. Ours, not routed. */
+    this.unclassified = /* @__PURE__ */ new Set();
+    /** Held events of these were dropped as another session's (log dedupe + late-claim warning). */
+    this.foreign = /* @__PURE__ */ new Set();
+    this.legacy = /* @__PURE__ */ new Set();
+    /** Model output arrived without our PreInvocation: not kept at expiry until our next PreInvocation. */
+    this.unparkable = /* @__PURE__ */ new Set();
+    /** Our turn-start PreInvocation that came before its turn line: that line's step. */
+    this.turnTokens = /* @__PURE__ */ new Map();
+    /** A turn line processed straight away (line first, unshared) and not yet seen by a turn start: that start leaves no voucher for it. */
+    this.processedTurnSteps = /* @__PURE__ */ new Map();
+    this.held = /* @__PURE__ */ new Map();
+    /** `main` conversations, most recently invoked last; `bound` is the last. */
+    this.mainOrder = [];
+    this.hookReceived = false;
+    this.options = options;
+    this.holdMs = options.holdMs ?? DEFAULT_HOLD_MS;
+    this.maxHeldPerConversation = options.maxHeldPerConversation ?? DEFAULT_MAX_HELD_PER_CONVERSATION;
+    this.maxHeldConversations = options.maxHeldConversations ?? DEFAULT_MAX_HELD_CONVERSATIONS;
+    this.maxParkedPerConversation = options.maxParkedPerConversation ?? DEFAULT_MAX_PARKED_PER_CONVERSATION;
+    this.now = options.now ?? Date.now;
+  }
+  hasReceivedHook() {
+    return this.hookReceived;
+  }
+  /** The `main` conversation our PreInvocation hook reported most recently. */
+  getBound() {
+    return this.mainOrder.length > 0 ? this.mainOrder[this.mainOrder.length - 1] : null;
+  }
+  roleOf(conversationId) {
+    return this.roles.get(conversationId);
+  }
+  /** Reported by our own hooks, whatever its role. */
+  isOwn(conversationId) {
+    return this.roles.has(conversationId) || this.unclassified.has(conversationId);
+  }
+  route(conversationId, item) {
+    const role = this.roles.get(conversationId);
+    if (role === "main") {
+      const step = item === void 0 ? null : this.turnStepOf(item);
+      if (this.held.has(conversationId)) return "hold";
+      const token = this.turnTokens.get(conversationId);
+      if (item !== void 0 && token && this.now() - token.atMs <= VOUCHER_QUEUE_MS && (step === null || !this.tokenNames(token, step))) {
+        return "hold";
+      }
+      if (this.movedElsewhere(conversationId)) return "hold";
+      if (conversationId !== this.getBound()) return "hold";
+      if (step !== null) {
+        if (this.takeTurnToken(conversationId, step)) return "process";
+        if (this.options.isClaimedElsewhere(conversationId)) return "hold";
+        this.processedTurnSteps.set(conversationId, step);
+      }
+      return "process";
+    }
+    if (role === "subagent") return "drop";
+    if (this.legacy.has(conversationId)) {
+      if (this.options.isClaimedElsewhere(conversationId)) {
+        this.markForeign(conversationId, "claimed by another CodeVibe session");
+        return "drop";
+      }
+      return "legacy";
+    }
+    if (this.options.hooksArmed()) return "hold";
+    if (this.options.isClaimedElsewhere(conversationId)) {
+      this.markForeign(conversationId, "claimed by another CodeVibe session");
+      return "drop";
+    }
+    return "legacy";
+  }
+  /** Buffer one event for a conversation route() answered `hold` for. */
+  hold(conversationId, item) {
+    let entry = this.held.get(conversationId);
+    const itemStep = this.turnStepOf(item);
+    if (itemStep !== null) {
+      if (entry?.parked && !this.hasTurnLine(entry)) {
+        this.dropParked(conversationId, "a new turn started");
+        entry = void 0;
+      }
+      this.unparkable.delete(conversationId);
+    }
+    if (entry?.parked) {
+      const reason = this.parkedDropReason(conversationId, entry, item);
+      if (reason) {
+        this.dropParked(conversationId, reason);
+        entry = void 0;
+      }
+    }
+    if (!entry) {
+      if (this.held.size >= this.maxHeldConversations) {
+        this.evict(this.evictionCandidate());
+      }
+      entry = { items: [], timer: this.startTimer(conversationId), parked: false, overflowed: 0, behindVoucher: false, shared: false, moved: false };
+      this.held.set(conversationId, entry);
+      if (!this.looksForeign(conversationId)) {
+        this.options.onLog?.("Holding agy events until a hook claims the conversation", {
+          conversationId,
+          holdMs: this.holdMs
+        });
+      }
+    }
+    if (entry.items.length >= this.maxHeldPerConversation) {
+      entry.items.shift();
+      entry.overflowed += 1;
+    }
+    entry.items.push(item);
+    if (!entry.shared && this.isShared(conversationId)) entry.shared = true;
+    if (!entry.moved && this.movedElsewhere(conversationId)) entry.moved = true;
+    if (itemStep !== null && this.roles.get(conversationId) === "main") {
+      const token2 = this.takeTurnToken(conversationId, itemStep);
+      if (token2) {
+        this.releaseFromTurnLine(conversationId, itemStep, token2.earlierOwned);
+        return;
+      }
+    }
+    if (itemStep !== null && entry.parked) this.armPendingTurnDeadline(conversationId, entry);
+    const token = this.turnTokens.get(conversationId);
+    if (token && this.now() - token.atMs <= VOUCHER_QUEUE_MS) entry.behindVoucher = true;
+  }
+  heldCount(conversationId) {
+    return this.held.get(conversationId)?.items.length ?? 0;
+  }
+  /** Our PreInvocation hook reported this conversation. */
+  onPreInvocation(report) {
+    this.markHookReceived();
+    const id = report.conversationId;
+    const previous = this.roles.get(id);
+    const role = this.classify(report, previous);
+    const earlierOwned = previous === "main" && !this.movedElsewhere(id) && !this.held.get(id)?.moved;
+    this.lastInvoked.set(id, this.now());
+    this.unparkable.delete(id);
+    const parked = this.held.get(id)?.parked ? this.heldCount(id) : 0;
+    const turnStart = report.invocationNum === void 0 || report.invocationNum === 0;
+    const turnLineStep = report.initialNumSteps === void 0 ? null : report.initialNumSteps - 1;
+    const heldTurnSteps = this.heldTurnSteps(id);
+    const ownLineHeld = turnStart && heldTurnSteps.some((step) => turnLineStep === null || step === turnLineStep);
+    const releases = role !== "main" || heldTurnSteps.length === 0 || ownLineHeld;
+    if (releases && parked > 0) {
+      this.options.onLog?.("This session's hook arrived late; releasing the events kept for it", {
+        conversationId: id,
+        kept: parked
+      });
+    }
+    if (this.foreign.delete(id) && parked === 0) {
+      this.options.onLog?.("This session now owns a conversation whose earlier events were dropped as another session's", {
+        conversationId: id
+      });
+    }
+    this.setRole(id, role, previous, report);
+    this.mainOrder = this.mainOrder.filter((other) => other !== id);
+    if (role === "main") this.mainOrder.push(id);
+    this.publishClaims();
+    const lineAlreadyProcessed = turnStart && turnLineStep !== null && this.processedTurnSteps.get(id) === turnLineStep;
+    if (turnStart) this.processedTurnSteps.delete(id);
+    const vouches = role === "main" && turnStart && !ownLineHeld && !lineAlreadyProcessed;
+    if (vouches) {
+      this.turnTokens.set(id, { step: turnLineStep ?? Number.NaN, earlierOwned, atMs: this.now() });
+    } else if (role !== "main" || ownLineHeld || lineAlreadyProcessed) {
+      this.turnTokens.delete(id);
+    }
+    if (releases) {
+      if (role !== "main") {
+        this.releaseHeld(id, null);
+      } else if (ownLineHeld) {
+        this.releaseFromTurnLine(id, turnLineStep, earlierOwned);
+      } else {
+        const token = this.turnTokens.get(id);
+        const owned = token && this.held.get(id)?.behindVoucher ? token.earlierOwned : earlierOwned || !turnStart;
+        this.releaseHeld(id, owned ? "process" : null);
+      }
+    }
+    const remaining = this.held.get(id);
+    if (vouches && remaining) remaining.behindVoucher = true;
+    return { role, bound: this.getBound() };
+  }
+  /** Our PostToolUse hook reported this conversation. */
+  onPostToolUse(conversationId) {
+    this.markHookReceived();
+    if (this.roles.has(conversationId)) return;
+    const firstType = this.options.readTranscriptFirstType(conversationId);
+    const role = firstType === "USER_INPUT" ? "main" : firstType === "SYSTEM_MESSAGE" ? "subagent" : null;
+    if (role) {
+      this.setRole(conversationId, role, void 0, null);
+      this.foreign.delete(conversationId);
+      this.unparkable.delete(conversationId);
+      this.publishClaims();
+      this.releaseHeld(conversationId, role === "main" ? "process" : null);
+      return;
+    }
+    if (this.unclassified.has(conversationId)) return;
+    this.unclassified.add(conversationId);
+    this.publishClaims();
+  }
+  /** Clear all state (daemon stop). */
+  reset() {
+    for (const entry of this.held.values()) {
+      if (entry.timer) clearTimeout(entry.timer);
+    }
+    this.held.clear();
+    this.roles.clear();
+    this.lastInvoked.clear();
+    this.unclassified.clear();
+    this.foreign.clear();
+    this.legacy.clear();
+    this.unparkable.clear();
+    this.turnTokens.clear();
+    this.processedTurnSteps.clear();
+    this.mainOrder = [];
+    this.hookReceived = false;
+  }
+  setRole(id, role, previous, report) {
+    this.roles.set(id, role);
+    this.unclassified.delete(id);
+    this.legacy.delete(id);
+    if (previous !== role) {
+      this.options.onLog?.("agy conversation classified by hook", {
+        conversationId: id,
+        role,
+        previousRole: previous ?? null,
+        via: report ? "PreInvocation" : "PostToolUse",
+        invocationNum: report?.invocationNum ?? null,
+        initialNumSteps: report?.initialNumSteps ?? null
+      });
+    }
+  }
+  /** Another session's (as far as we know): claimed elsewhere or already dropped as foreign. */
+  looksForeign(conversationId) {
+    if (this.roles.get(conversationId) === "main" && !this.movedElsewhere(conversationId)) return false;
+    return this.foreign.has(conversationId) || this.options.isClaimedElsewhere(conversationId);
+  }
+  /** The held conversation to settle when the hold area is full. */
+  evictionCandidate() {
+    for (const id of this.held.keys()) {
+      if (this.looksForeign(id)) return id;
+    }
+    return this.held.keys().next().value;
+  }
+  /** Only the exact line our turn start named uses its voucher (NaN: step unknown, any line). */
+  tokenNames(token, step) {
+    return Number.isNaN(token.step) || step === token.step;
+  }
+  takeTurnToken(conversationId, step) {
+    const token = this.turnTokens.get(conversationId);
+    if (token === void 0 || !this.tokenNames(token, step)) return null;
+    this.turnTokens.delete(conversationId);
+    return token;
+  }
+  /**
+   * Release held events from our named turn line on. What came before it
+   * belongs to earlier turns: released with it only if we owned the
+   * conversation before this turn, dropped otherwise (Stage 2 R3-F1).
+   */
+  releaseFromTurnLine(conversationId, step, earlierOwned) {
+    const entry = this.held.get(conversationId);
+    if (!entry) return;
+    const named = (item) => {
+      const itemStep = this.turnStepOf(item);
+      return itemStep !== null && (step === null || itemStep === step);
+    };
+    let index = entry.items.findIndex(named);
+    if (step !== null) {
+      for (let i = entry.items.length - 1; i > index; i -= 1) {
+        if (named(entry.items[i])) {
+          index = i;
+          break;
+        }
+      }
+    }
+    if (index > 0 && !earlierOwned) {
+      this.options.onLog?.("Dropping agy events held from an earlier turn of another session", {
+        conversationId,
+        dropped: index
+      });
+      entry.items = entry.items.slice(index);
+    }
+    this.releaseHeld(conversationId, "process");
+  }
+  turnStepOf(item) {
+    return this.options.turnStep?.(item) ?? null;
+  }
+  hasTurnLine(entry) {
+    return entry.items.some((item) => this.turnStepOf(item) !== null);
+  }
+  heldTurnSteps(conversationId) {
+    const entry = this.held.get(conversationId);
+    if (!entry) return [];
+    return entry.items.map((item) => this.turnStepOf(item)).filter((step) => step !== null);
+  }
+  /** A turn line waiting for its owner (until PENDING_TURN_MS if the conversation was shared at any time while held; see Turn lines). */
+  keepPendingTurn(conversationId, entry) {
+    entry.parked = true;
+    if (!entry.shared && this.isShared(conversationId)) entry.shared = true;
+    if (!entry.moved && this.movedElsewhere(conversationId)) entry.moved = true;
+    this.armPendingTurnDeadline(conversationId, entry);
+    this.options.onLog?.("Waiting for the PreInvocation that owns this agy turn", {
+      conversationId,
+      held: entry.items.length
+    });
+  }
+  /**
+   * (Re)starts the deadline of a kept turn. It drops the batch only if another
+   * live session shared the conversation at any time while the batch was held,
+   * the only way a step can repeat (H23); a sharer that exits meanwhile does not
+   * make its never-run input ours (Stage 1 R14-F1). Otherwise it checks again
+   * later, so our own very late hook on an unshared conversation still finds its
+   * line (Stage 1 R13-F1).
+   */
+  armPendingTurnDeadline(conversationId, entry) {
+    if (entry.timer) clearTimeout(entry.timer);
+    const timer = setTimeout(() => {
+      if (this.held.get(conversationId) !== entry) return;
+      if (!entry.moved && this.movedElsewhere(conversationId)) entry.moved = true;
+      if (!entry.shared && this.isShared(conversationId)) entry.shared = true;
+      if (!entry.shared) {
+        this.armPendingTurnDeadline(conversationId, entry);
+        return;
+      }
+      this.options.onLog?.("Dropping an agy turn that no PreInvocation of this session claimed in time", {
+        conversationId,
+        dropped: entry.items.length,
+        pendingTurnMs: PENDING_TURN_MS
+      });
+      this.releaseHeld(conversationId, null);
+    }, PENDING_TURN_MS);
+    timer.unref?.();
+    entry.timer = timer;
+  }
+  /** Another live session claims or has invoked this conversation. */
+  isShared(conversationId) {
+    return this.options.isClaimedElsewhere(conversationId) || this.options.otherInvokedAt(conversationId) !== null;
+  }
+  /** Another live session invoked this conversation more recently than we did. */
+  movedElsewhere(conversationId) {
+    const other = this.options.otherInvokedAt(conversationId);
+    if (other === null) return false;
+    const own = this.lastInvoked.get(conversationId);
+    return own === void 0 || other > own;
+  }
+  classify(report, previous) {
+    const firstType = this.options.readTranscriptFirstType(report.conversationId);
+    if (firstType === "USER_INPUT") return "main";
+    if (firstType === "SYSTEM_MESSAGE") return "subagent";
+    if (previous) return previous;
+    return report.invocationNum === 0 && (report.initialNumSteps ?? 0) >= 1 ? "main" : "subagent";
+  }
+  markHookReceived() {
+    if (this.hookReceived) return;
+    this.hookReceived = true;
+    this.legacy.clear();
+  }
+  markForeign(conversationId, reason) {
+    if (this.foreign.has(conversationId)) return;
+    this.foreign.add(conversationId);
+    this.options.onLog?.("Ignoring agy conversation from another session", { conversationId, reason });
+  }
+  startTimer(conversationId) {
+    const timer = setTimeout(() => this.expire(conversationId), this.holdMs);
+    timer.unref?.();
+    return timer;
+  }
+  /** Why kept events can no longer be ours, or null. */
+  parkedDropReason(conversationId, entry, item) {
+    if (this.options.isModelOutput?.(item)) return "the model ran without this session's PreInvocation";
+    if (entry.items.length >= this.maxParkedPerConversation) return "more events than precede a model call";
+    if (!this.roles.has(conversationId) && !this.hasTurnLine(entry) && this.options.isClaimedElsewhere(conversationId)) {
+      return "claimed by another CodeVibe session";
+    }
+    return null;
+  }
+  dropParked(conversationId, reason) {
+    this.unparkable.add(conversationId);
+    this.options.onLog?.("Dropping agy events kept for a late hook", {
+      conversationId,
+      kept: this.heldCount(conversationId),
+      reason
+    });
+    this.releaseHeld(conversationId, null);
+  }
+  /**
+   * Foreign so far — no hook of ours, or another session invoked it more
+   * recently. Keep its events for a late PreInvocation of ours unless they
+   * already show an invocation that ran without it (Stage 2 R1-F3).
+   */
+  settleForeign(conversationId, reason) {
+    const entry = this.held.get(conversationId);
+    if (!entry) return;
+    const isModelOutput = this.options.isModelOutput;
+    if (isModelOutput && entry.items.some((item) => isModelOutput(item))) {
+      this.unparkable.add(conversationId);
+    }
+    if (!this.unparkable.has(conversationId) && entry.items.length <= this.maxParkedPerConversation) {
+      this.markForeign(conversationId, `${reason}; keeping its first events in case this session's hook is late`);
+      if (entry.timer) clearTimeout(entry.timer);
+      entry.timer = null;
+      entry.parked = true;
+      return;
+    }
+    this.markForeign(conversationId, reason);
+    this.releaseHeld(conversationId, null);
+  }
+  /** Free a slot when the hold area is full. */
+  evict(conversationId) {
+    const entry = this.held.get(conversationId);
+    if (!entry) return;
+    if (!entry.parked) this.expire(conversationId);
+    if (this.held.get(conversationId)?.parked) {
+      this.options.onLog?.("Hold area full; dropping agy events kept for a late hook", {
+        conversationId,
+        kept: this.heldCount(conversationId)
+      });
+      this.releaseHeld(conversationId, null);
+    }
+  }
+  releaseHeld(conversationId, decision) {
+    const entry = this.held.get(conversationId);
+    if (!entry) return;
+    if (entry.timer) clearTimeout(entry.timer);
+    this.held.delete(conversationId);
+    if (entry.overflowed > 0) {
+      this.options.onLog?.("Held agy events overflowed; oldest dropped", {
+        conversationId,
+        dropped: entry.overflowed
+      });
+    }
+    if (decision) this.options.onRelease(entry.items, decision);
+  }
+  expire(conversationId) {
+    const entry = this.held.get(conversationId);
+    if (!entry || entry.parked) return;
+    const token = this.turnTokens.get(conversationId);
+    if (entry.behindVoucher && token && this.roles.get(conversationId) === "main") {
+      if (token.earlierOwned) {
+        this.releaseHeld(conversationId, "process");
+      } else {
+        this.options.onLog?.("Dropping agy events held from an earlier turn of another session", {
+          conversationId,
+          dropped: entry.items.length
+        });
+        this.releaseHeld(conversationId, null);
+      }
+      return;
+    }
+    if (this.hasTurnLine(entry) && this.options.hooksHealthy()) {
+      const isModel = (item) => this.options.isModelOutput?.(item) ?? false;
+      const turnIndexes = entry.items.flatMap((item, index) => this.turnStepOf(item) !== null ? [index] : []);
+      const first = turnIndexes[0];
+      let tailStart = turnIndexes[turnIndexes.length - 1];
+      for (let k = turnIndexes.length - 2; k >= 0; k -= 1) {
+        if (entry.items.slice(turnIndexes[k], tailStart).some(isModel)) break;
+        tailStart = turnIndexes[k];
+      }
+      const earlier = entry.items.slice(0, first);
+      const ranEarlier = entry.items.slice(first, tailStart);
+      entry.items = entry.items.slice(tailStart);
+      if (earlier.length > 0) {
+        if (this.roles.get(conversationId) === "main" && !this.movedElsewhere(conversationId) && !entry.moved) {
+          this.options.onRelease(earlier, "process");
+        } else {
+          this.options.onLog?.("Dropping agy events held from an earlier turn of another session", {
+            conversationId,
+            dropped: earlier.length
+          });
+        }
+      }
+      if (ranEarlier.length > 0) {
+        this.options.onLog?.("Dropping earlier agy turns that ran without this session's PreInvocation", {
+          conversationId,
+          dropped: ranEarlier.length
+        });
+      }
+      if (entry.items.some(isModel)) {
+        this.markForeign(conversationId, "the model ran this turn without this session's PreInvocation");
+        this.releaseHeld(conversationId, null);
+      } else {
+        this.keepPendingTurn(conversationId, entry);
+      }
+      return;
+    }
+    const role = this.roles.get(conversationId);
+    if (role === "main") {
+      if (this.movedElsewhere(conversationId) || entry.moved) {
+        this.settleForeign(conversationId, "another session invoked it more recently");
+      } else {
+        this.releaseHeld(conversationId, "process");
+      }
+      return;
+    }
+    if (role === "subagent") {
+      this.releaseHeld(conversationId, null);
+      return;
+    }
+    if (this.options.isClaimedElsewhere(conversationId)) {
+      this.markForeign(conversationId, "claimed by another CodeVibe session");
+      this.releaseHeld(conversationId, null);
+      return;
+    }
+    if (this.options.hooksHealthy()) {
+      this.settleForeign(conversationId, `no hook from this session within ${this.holdMs} ms`);
+      return;
+    }
+    this.legacy.add(conversationId);
+    this.options.onLog?.("No agy hook seen; routing conversation by the CLI log (legacy)", {
+      conversationId,
+      held: entry.items.length
+    });
+    this.releaseHeld(conversationId, "legacy");
+  }
+  publishClaims() {
+    if (!this.options.onClaimsChanged) return;
+    const claims = /* @__PURE__ */ new Map();
+    for (const [id, role] of this.roles) {
+      const lastInvokedMs = this.lastInvoked.get(id);
+      claims.set(id, lastInvokedMs === void 0 ? { role } : { role, lastInvokedMs });
+    }
+    for (const id of this.unclassified) claims.set(id, { role: "unknown" });
+    this.options.onClaimsChanged(claims);
+  }
+};
+
+// src/claim-registry.ts
 var fs3 = __toESM(require("fs"));
-var os3 = __toESM(require("os"));
-var path3 = __toESM(require("path"));
+var os4 = __toESM(require("os"));
+var path4 = __toESM(require("path"));
+var CLAIMS_FILENAME = "claims.json";
+var SCAN_CACHE_MS = 1e3;
+var MAX_CLAIMS_FILE_BYTES = 256 * 1024;
+var MAX_CLAIMED_CONVERSATIONS = 500;
+var BOOT_TIME_SLACK_MS = 6e4;
+function isPidAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+var ClaimRegistry = class {
+  constructor(options) {
+    this.cache = null;
+    this.runtimeDir = options.runtimeDir;
+    this.wrapperPid = options.wrapperPid;
+    this.daemonPid = options.daemonPid ?? process.pid;
+    this.isPidAlive = options.isPidAlive ?? isPidAlive;
+    this.now = options.now ?? Date.now;
+    this.bootTimeMs = options.bootTimeMs ?? (() => Date.now() - os4.uptime() * 1e3);
+  }
+  isEnabled() {
+    return this.runtimeDir !== null && this.wrapperPid !== null;
+  }
+  /** Replace this daemon's claims file with `conversations` (best-effort). */
+  writeOwn(conversations) {
+    if (!this.runtimeDir || this.wrapperPid === null) return;
+    const entries = [...conversations.entries()].slice(-MAX_CLAIMED_CONVERSATIONS);
+    const file = {
+      version: 1,
+      wrapperPid: this.wrapperPid,
+      daemonPid: this.daemonPid,
+      conversations: entries.map(([id, claim]) => claim.lastInvokedMs === void 0 ? { id, role: claim.role } : { id, role: claim.role, lastInvokedMs: claim.lastInvokedMs }),
+      updatedAt: new Date(this.now()).toISOString()
+    };
+    const dest = path4.join(this.runtimeDir, CLAIMS_FILENAME);
+    const tmp = `${dest}.tmp.${process.pid}`;
+    try {
+      fs3.writeFileSync(tmp, JSON.stringify(file), { mode: 384 });
+      fs3.renameSync(tmp, dest);
+    } catch (error) {
+      try {
+        fs3.unlinkSync(tmp);
+      } catch {
+      }
+      logger.warn("Could not write conversation claims (other sessions may route by the CLI log)", {
+        error: String(error)
+      });
+    }
+  }
+  /** Remove this daemon's claims file (on stop). */
+  removeOwn() {
+    if (!this.runtimeDir) return;
+    try {
+      fs3.unlinkSync(path4.join(this.runtimeDir, CLAIMS_FILENAME));
+    } catch {
+    }
+  }
+  /** True when another live daemon has claimed this conversation. */
+  isClaimedElsewhere(conversationId) {
+    return this.scan()?.claimed.has(conversationId) ?? false;
+  }
+  /** Latest time another live daemon's agy invoked this conversation, or null. */
+  otherInvokedAt(conversationId) {
+    return this.scan()?.invokedAt.get(conversationId) ?? null;
+  }
+  scan() {
+    if (!this.runtimeDir) return null;
+    const now = this.now();
+    if (!this.cache || now - this.cache.atMs >= SCAN_CACHE_MS) {
+      this.cache = { atMs: now, ...this.scanOthers() };
+    }
+    return this.cache;
+  }
+  /** Drop the scan cache (tests, and right after a foreign claim is suspected). */
+  invalidate() {
+    this.cache = null;
+  }
+  scanOthers() {
+    const claimed = /* @__PURE__ */ new Set();
+    const invokedAt = /* @__PURE__ */ new Map();
+    if (!this.runtimeDir) return { claimed, invokedAt };
+    const base = path4.dirname(this.runtimeDir);
+    const own = path4.basename(this.runtimeDir);
+    const uid = process.getuid?.();
+    let names;
+    try {
+      names = fs3.readdirSync(base);
+    } catch {
+      return { claimed, invokedAt };
+    }
+    const bootedAt = this.bootTimeMs() - BOOT_TIME_SLACK_MS;
+    for (const name of names) {
+      if (name === own || !/^[0-9]{1,10}$/.test(name)) continue;
+      const file = path4.join(base, name, CLAIMS_FILENAME);
+      let parsed;
+      try {
+        const stat = fs3.lstatSync(file);
+        if (!stat.isFile() || stat.size > MAX_CLAIMS_FILE_BYTES) continue;
+        if (uid !== void 0 && stat.uid !== uid) continue;
+        if (stat.mtimeMs < bootedAt) continue;
+        parsed = JSON.parse(fs3.readFileSync(file, "utf8"));
+      } catch {
+        continue;
+      }
+      if (!parsed || typeof parsed !== "object") continue;
+      const claims = parsed;
+      if (claims.version !== 1 || claims.wrapperPid !== Number(name)) continue;
+      if (!Number.isInteger(claims.daemonPid) || !Array.isArray(claims.conversations)) continue;
+      if (!this.isPidAlive(claims.daemonPid)) continue;
+      for (const entry of claims.conversations) {
+        if (!entry || typeof entry.id !== "string") continue;
+        claimed.add(entry.id);
+        const at = entry.lastInvokedMs;
+        if (entry.role === "main" && typeof at === "number" && Number.isFinite(at)) {
+          invokedAt.set(entry.id, Math.max(at, invokedAt.get(entry.id) ?? 0));
+        }
+      }
+    }
+    return { claimed, invokedAt };
+  }
+};
+
+// src/installer.ts
+var fs4 = __toESM(require("fs"));
+var path5 = __toESM(require("path"));
+var HOOK_TIMEOUT_SECONDS = 5;
+function shellQuote(value) {
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function buildHookEntry(hooksFolder) {
+  const shell = shellQuote(path5.join(hooksFolder, HOOK_SHELL_BASENAME));
+  return {
+    PreInvocation: [
+      { type: "command", command: `${shell} PreInvocation`, timeout: HOOK_TIMEOUT_SECONDS }
+    ],
+    PostToolUse: [
+      {
+        matcher: "*",
+        hooks: [
+          { type: "command", command: `${shell} PostToolUse`, timeout: HOOK_TIMEOUT_SECONDS }
+        ]
+      }
+    ]
+  };
+}
+function readHooksConfigSync(hooksConfigPath) {
+  let stat;
+  try {
+    stat = fs4.lstatSync(hooksConfigPath);
+  } catch (err) {
+    if (err.code === "ENOENT") return { kind: "absent" };
+    return { kind: "unsupported", reason: `cannot stat: ${err.message}` };
+  }
+  if (stat.isSymbolicLink()) return { kind: "unsupported", reason: "is a symlink" };
+  if (!stat.isFile()) return { kind: "unsupported", reason: "is not a regular file" };
+  let raw;
+  try {
+    raw = fs4.readFileSync(hooksConfigPath, "utf8");
+  } catch (err) {
+    return { kind: "unsupported", reason: `cannot read: ${err.message}` };
+  }
+  if (raw.trim().length === 0) return { kind: "object", config: {}, mode: stat.mode & 511 };
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { kind: "unsupported", reason: "is not valid JSON" };
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return { kind: "unsupported", reason: "is not a JSON object" };
+  }
+  return { kind: "object", config: parsed, mode: stat.mode & 511 };
+}
+function sameJson(a, b) {
+  return JSON.stringify(a) === JSON.stringify(b);
+}
+function isUserDisabled(entry) {
+  if (!entry || typeof entry !== "object" || Array.isArray(entry)) return false;
+  const named = entry;
+  if (named.enabled === false) return true;
+  const visit = (value) => {
+    if (Array.isArray(value)) return value.some(visit);
+    if (!value || typeof value !== "object") return false;
+    const obj = value;
+    return obj.enabled === false || visit(obj.hooks);
+  };
+  return Object.entries(named).some(([key, value]) => key !== "enabled" && visit(value));
+}
+function inspectHookRegistration(paths) {
+  const read = readHooksConfigSync(paths.hooksConfigPath);
+  if (read.kind === "unsupported") return "unsupported";
+  if (read.kind === "absent") return "missing";
+  if (isUserDisabled(read.config[HOOK_ENTRY_NAME])) return "missing";
+  if (!sameJson(read.config[HOOK_ENTRY_NAME], buildHookEntry(paths.hooksDir))) return "missing";
+  for (const name of [HOOK_SHELL_BASENAME, HOOK_SCRIPT_BASENAME]) {
+    try {
+      if (!fs4.statSync(path5.join(paths.hooksDir, name)).isFile()) return "missing";
+    } catch {
+      return "missing";
+    }
+  }
+  return "registered";
+}
+
+// src/tool-prompt-match.ts
+var TOOL_COMMAND_KEYS = ["CommandLine", "Command", "command"];
+var TOOL_PATH_KEYS = [
+  "AbsolutePath",
+  "TargetFile",
+  "FilePath",
+  "file_path",
+  "filePath",
+  "path",
+  "DirectoryPath"
+];
+var EDIT_TOOLS = /* @__PURE__ */ new Set(["WRITE_TO_FILE", "REPLACE_FILE_CONTENT", "MULTI_REPLACE_FILE_CONTENT"]);
+function stripWrappingQuotes(value) {
+  return value.length >= 2 && value.startsWith('"') && value.endsWith('"') ? value.slice(1, -1) : value;
+}
+function collapsePlainSpacing(value) {
+  return /['"`$\\\r\n]/.test(value) ? value : value.replace(/[ \t]+/g, " ");
+}
+function normalizeCommand(value) {
+  if (!value) return null;
+  const normalized = collapsePlainSpacing(value.trim());
+  return normalized.length > 0 ? normalized : null;
+}
+function normalizePath(value) {
+  if (!value) return null;
+  const normalized = stripWrappingQuotes(value.trim());
+  return normalized.length > 0 ? normalized : null;
+}
+function fileLinks(text) {
+  if (!text) return [];
+  const found = [];
+  for (const match of text.matchAll(/file:\/\/([^\s)\]]+)/g)) {
+    try {
+      found.push(decodeURIComponent(match[1]));
+    } catch {
+      found.push(match[1]);
+    }
+  }
+  return found;
+}
+function isFileAccessPrompt(state) {
+  return /Allow access to this file\?/i.test(state.paneDisplayHeader ?? "");
+}
+function promptMatchesCompletedTool(state, toolName, toolArgs) {
+  if (!toolArgs || state.kind !== "approval") return false;
+  const promptCommand = normalizeCommand(state.pendingCall?.command);
+  if (promptCommand) {
+    for (const key of TOOL_COMMAND_KEYS) {
+      if (normalizeCommand(toolArgs[key]) === promptCommand) return true;
+    }
+    return false;
+  }
+  if (!isFileAccessPrompt(state) && !EDIT_TOOLS.has((toolName ?? "").toUpperCase())) return false;
+  const promptPaths = /* @__PURE__ */ new Set();
+  const declared = normalizePath(state.pendingCall?.filePath);
+  if (declared) promptPaths.add(declared);
+  for (const link of fileLinks(state.paneDisplayHeader)) promptPaths.add(link);
+  if (promptPaths.size === 0) return false;
+  for (const key of TOOL_PATH_KEYS) {
+    const toolPath = normalizePath(toolArgs[key]);
+    if (toolPath && promptPaths.has(toolPath)) return true;
+  }
+  return false;
+}
+
+// src/tmux-pane-observer.ts
+var fs5 = __toESM(require("fs"));
+var os5 = __toESM(require("os"));
+var path6 = __toESM(require("path"));
 var import_crypto = require("crypto");
 var import_child_process = require("child_process");
 var import_events2 = require("events");
@@ -1439,7 +2343,7 @@ var TmuxPaneObserver = class _TmuxPaneObserver extends import_events2.EventEmitt
      *  start()/stop() lifecycle and doesn't distinguish debounce
      *  cycles. (Stage 2 iter-4 R1 HIGH finding 2026-05-21.) */
     this.debounceCycleId = 0;
-    this.pipeFilePath = options.pipeFilePath ?? path3.join(os3.tmpdir(), `codevibe-agy-pane-${process.pid}.log`);
+    this.pipeFilePath = options.pipeFilePath ?? path6.join(os5.tmpdir(), `codevibe-agy-pane-${process.pid}.log`);
     this.skipTmuxCommands = options.skipTmuxCommands ?? false;
     this.captureFn = options.captureFn ?? null;
   }
@@ -1512,8 +2416,8 @@ var TmuxPaneObserver = class _TmuxPaneObserver extends import_events2.EventEmitt
     this.approvalUIActive = false;
     this.currentApprovalHeader = null;
     try {
-      fs3.mkdirSync(path3.dirname(this.pipeFilePath), { recursive: true });
-      fs3.writeFileSync(this.pipeFilePath, "");
+      fs5.mkdirSync(path6.dirname(this.pipeFilePath), { recursive: true });
+      fs5.writeFileSync(this.pipeFilePath, "");
       if (!this.skipTmuxCommands) {
         await this.enablePipePane();
       }
@@ -1566,7 +2470,7 @@ var TmuxPaneObserver = class _TmuxPaneObserver extends import_events2.EventEmitt
       this.watcher = null;
     }
     try {
-      fs3.unlinkSync(this.pipeFilePath);
+      fs5.unlinkSync(this.pipeFilePath);
     } catch {
     }
     logger.info("Tmux pane observer stopped", { sessionName: this.sessionName });
@@ -1668,7 +2572,7 @@ var TmuxPaneObserver = class _TmuxPaneObserver extends import_events2.EventEmitt
     await execAsync(cmd);
   }
   startFileWatcher() {
-    this.watcher = fs3.watch(this.pipeFilePath, (eventType) => {
+    this.watcher = fs5.watch(this.pipeFilePath, (eventType) => {
       if (eventType !== "change") return;
       void this.processFileChanges();
     });
@@ -1888,17 +2792,17 @@ var TmuxPaneObserver = class _TmuxPaneObserver extends import_events2.EventEmitt
     }
   }
   readAppendedChunk() {
-    const stat = fs3.statSync(this.pipeFilePath);
+    const stat = fs5.statSync(this.pipeFilePath);
     if (stat.size <= this.filePosition) return "";
-    const fd = fs3.openSync(this.pipeFilePath, "r");
+    const fd = fs5.openSync(this.pipeFilePath, "r");
     try {
       const length = stat.size - this.filePosition;
       const buffer = Buffer.alloc(length);
-      fs3.readSync(fd, buffer, 0, length, this.filePosition);
+      fs5.readSync(fd, buffer, 0, length, this.filePosition);
       this.filePosition = stat.size;
       return buffer.toString("utf-8");
     } finally {
-      fs3.closeSync(fd);
+      fs5.closeSync(fd);
     }
   }
 };
@@ -2687,6 +3591,7 @@ var ApprovalDetector = class extends import_events3.EventEmitter {
       body: candidate.body,
       paneOptions: candidate.options,
       paneSemanticKey: buildApprovalSemanticKey(candidate),
+      kind: candidate.kind,
       emittedAt: Date.now(),
       ttlMs: this.promptTtlMs,
       // E1 (§6a-2b / F5) — carry the consumed pane hash so an emit-failure
@@ -2877,6 +3782,7 @@ var ApprovalDetector = class extends import_events3.EventEmitter {
       body: candidate.body,
       paneOptions: candidate.options,
       paneSemanticKey: buildApprovalSemanticKey(candidate),
+      kind: candidate.kind,
       emittedAt: Date.now(),
       ttlMs: this.promptTtlMs
     };
@@ -2902,19 +3808,37 @@ var ApprovalDetector = class extends import_events3.EventEmitter {
    * fresh-emit. Without this, mobile prompt state dangles until TTL
    * AND the next identical approval is forever-suppressed by stale
    * dedup. (Stage 2 R1 MED finding 2026-05-21.)
+   *
+   * `emittedBeforeMs` (F1, Stage 2 R1-F2): a desktop input that waited in the
+   * routing hold proves only that prompts raised BEFORE it was typed are gone.
+   * A prompt emitted after that moment stays pending, and so does its dedup
+   * hash (clearing it would re-emit the still-visible chooser).
    */
-  onPanePromptCleared() {
+  onPanePromptCleared(emittedBeforeMs) {
     if (this.pendingPrompts.size === 0 && this.paneOnlyEmittedHashes.size === 0) {
       return [];
     }
     const now = Date.now();
     const cleared = [];
-    for (const [promptId] of this.pendingPrompts.entries()) {
+    let retained = false;
+    for (const [promptId, state] of this.pendingPrompts.entries()) {
+      if (emittedBeforeMs !== void 0 && state.emittedAt >= emittedBeforeMs) {
+        retained = true;
+        continue;
+      }
       this.resolvedPrompts.set(promptId, now);
       cleared.push(promptId);
     }
-    this.pendingPrompts.clear();
-    this.paneOnlyEmittedHashes.clear();
+    if (!retained) {
+      this.pendingPrompts.clear();
+      this.paneOnlyEmittedHashes.clear();
+    } else {
+      for (const promptId of cleared) {
+        const state = this.pendingPrompts.get(promptId);
+        if (state?.paneHash) this.paneOnlyEmittedHashes.delete(state.paneHash);
+        this.pendingPrompts.delete(promptId);
+      }
+    }
     if (cleared.length > 0) {
       logger.info("Pane prompt cleared \u2014 resolved pending prompts", {
         count: cleared.length
@@ -3441,10 +4365,10 @@ var MobilePromptDeduper = class {
 
 // src/daemon-telemetry.ts
 var crypto2 = __toESM(require("crypto"));
-var fs4 = __toESM(require("fs"));
+var fs6 = __toESM(require("fs"));
 var https = __toESM(require("https"));
-var os4 = __toESM(require("os"));
-var path4 = __toESM(require("path"));
+var os6 = __toESM(require("os"));
+var path7 = __toESM(require("path"));
 var MEASUREMENT_ID = "G-GS74YEQTB8";
 var API_SECRET = "lAfOF6OxRzSQ-NsLBRjhAg";
 var GA4_HOSTNAME = "www.google-analytics.com";
@@ -3452,8 +4376,8 @@ var GA4_PATH = `/mp/collect?measurement_id=${MEASUREMENT_ID}&api_secret=${API_SE
 var BEACON_TOTAL_TIMEOUT_MS = 800;
 function readPluginVersion() {
   try {
-    const pkgPath = path4.resolve(__dirname, "..", "package.json");
-    const raw = fs4.readFileSync(pkgPath, "utf-8");
+    const pkgPath = path7.resolve(__dirname, "..", "package.json");
+    const raw = fs6.readFileSync(pkgPath, "utf-8");
     const pkg = JSON.parse(raw);
     if (typeof pkg.version === "string" && pkg.version.length > 0 && pkg.version.length < 30) {
       return pkg.version;
@@ -3465,14 +4389,14 @@ function readPluginVersion() {
 var PLUGIN_VERSION = readPluginVersion();
 function getClientId() {
   const uid = typeof process.getuid === "function" ? process.getuid() : 0;
-  return crypto2.createHash("sha256").update(`${os4.hostname()}-${uid}`).digest("hex").substring(0, 36);
+  return crypto2.createHash("sha256").update(`${os6.hostname()}-${uid}`).digest("hex").substring(0, 36);
 }
 function sanitizeErrorMessage(msg) {
   if (!msg) return "";
-  const homedir4 = os4.homedir();
+  const homedir5 = os6.homedir();
   let out = msg.replace(/[\n\r\t]/g, " ");
-  if (homedir4 && homedir4.length > 0) {
-    const safeHome = homedir4.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  if (homedir5 && homedir5.length > 0) {
+    const safeHome = homedir5.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     out = out.replace(new RegExp(safeHome, "g"), "~");
   }
   out = out.replace(/\/Users\/[^/\s"'`]+/g, "/Users/<user>").replace(/\/home\/[^/\s"'`]+/g, "/home/<user>").replace(/[A-Za-z]:\\Users\\[^\\\s"'`]+/gi, "C:\\Users\\<user>").replace(/[^\x20-\x7E]/g, "");
@@ -3765,7 +4689,7 @@ function extractCommandFromArgs(toolName, args) {
   for (const key of ["CommandLine", "Command", "command", "cmd", "exec"]) {
     const v = a[key];
     if (typeof v === "string" && v.trim().length > 0) {
-      return stripWrappingQuotes(v.trim());
+      return stripWrappingQuotes2(v.trim());
     }
   }
   return void 0;
@@ -3785,7 +4709,7 @@ function extractFilePathFromArgs(toolName, args) {
   ]) {
     const v = a[key];
     if (typeof v === "string" && v.trim().length > 0) {
-      return stripWrappingQuotes(v.trim());
+      return stripWrappingQuotes2(v.trim());
     }
   }
   return void 0;
@@ -3796,12 +4720,12 @@ function extractCwdFromArgs(args) {
   for (const key of ["Cwd", "cwd", "workingDirectory", "WorkingDirectory"]) {
     const v = a[key];
     if (typeof v === "string" && v.trim().length > 0) {
-      return stripWrappingQuotes(v.trim());
+      return stripWrappingQuotes2(v.trim());
     }
   }
   return void 0;
 }
-function stripWrappingQuotes(s) {
+function stripWrappingQuotes2(s) {
   if (s.length >= 2 && s.startsWith('"') && s.endsWith('"')) {
     return s.slice(1, -1);
   }
@@ -4106,6 +5030,53 @@ var StoredAuthFailureError = class extends Error {
     this.name = "StoredAuthFailureError";
   }
 };
+var HOOK_REGISTRATION_CACHE_MS = 5e3;
+var TRANSCRIPT_FIRST_LINE_MAX_BYTES = 256 * 1024;
+var CONVERSATION_ID_PATTERN = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+function defaultHookRouting() {
+  if (process.env.JEST_WORKER_ID) return null;
+  return {
+    hooksDir: hooksDir(),
+    hooksConfigPath: globalHooksConfigPath(),
+    brainRoot: path8.join(os7.homedir(), ".gemini", "antigravity-cli", "brain")
+  };
+}
+function commandDigest(command) {
+  const normalized = normalizeCommand(command);
+  return normalized ? crypto3.createHash("sha256").update(normalized).digest("hex").slice(0, 12) : null;
+}
+function readTranscriptFirstType(transcriptPath) {
+  let fd = null;
+  try {
+    fd = fs7.openSync(transcriptPath, "r");
+    const buffer = Buffer.alloc(TRANSCRIPT_FIRST_LINE_MAX_BYTES);
+    let filled = 0;
+    while (filled < buffer.length) {
+      const read = fs7.readSync(fd, buffer, filled, buffer.length - filled, filled);
+      if (read === 0) break;
+      filled += read;
+      if (buffer.subarray(0, filled).includes(10)) break;
+    }
+    const newline = buffer.subarray(0, filled).indexOf(10);
+    if (newline < 0) {
+      if (filled < buffer.length) return null;
+      const head = buffer.subarray(0, 4096).toString("utf8");
+      const m = head.match(/^\{[^{}]*?"type"\s*:\s*"(USER_INPUT|SYSTEM_MESSAGE)"/);
+      return m ? m[1] : null;
+    }
+    const first = JSON.parse(buffer.subarray(0, newline).toString("utf8"));
+    return typeof first?.type === "string" ? first.type : null;
+  } catch {
+    return null;
+  } finally {
+    if (fd !== null) {
+      try {
+        fs7.closeSync(fd);
+      } catch {
+      }
+    }
+  }
+}
 var MOBILE_PROMPT_FLOOR_RECENCY_MS = 12e4;
 var LAUNCH_SETTLE_TIMEOUT_MS = 3e3;
 var TMUX_LIFECYCLE_POLL_MS = 1e3;
@@ -4152,6 +5123,10 @@ var McpServer = class _McpServer {
     this.nativeSources = /* @__PURE__ */ new Map();
     this.nativeToolStart = null;
     this.nativeAdmissionChain = Promise.resolve();
+    /** When each transcript event first reached the router (F1, Stage 2 R1-F2):
+     *  a desktop input released from the hold only clears prompts raised before
+     *  it was typed. */
+    this.transcriptObservedAt = /* @__PURE__ */ new WeakMap();
     this.toolActivityKeyRefresh = null;
     // E1 (§4/§6a-4) — per-promptId durable raise entries for the agy producer.
     // Keyed by the E1 promptId (= derive(ownerToken)); each holds the SECRET
@@ -4226,7 +5201,8 @@ var McpServer = class _McpServer {
     this.ensureLaunchInFlight = null;
     /** Registry of agy conv UUIDs the wrapper has observed this lifecycle.
      *  Populated from handleConversationDiscovered + handleTranscriptEmit
-     *  (after isMainConversation passes). Used by:
+     *  (after routing accepts the conversation) and from a PreInvocation hook
+     *  that classifies one as main (F1). Used by:
      *   (a) handlePromptCandidate — approvalDetector keys candidates by
      *       agy conv UUID, not backend session ID;
      *   (b) getSessionByConversation — defensive membership check before
@@ -4235,6 +5211,7 @@ var McpServer = class _McpServer {
      *  causes harmless extra candidate-buffer entries in approvalDetector
      *  bounded by TTL. (Codex Stage 2 R1 v12 HIGH.) */
     this.observedMainConversationIds = /* @__PURE__ */ new Set();
+    this.hookRegistrationCache = null;
     this.started = false;
     /** Monotonically-increasing counter incremented on every start(). Captured
      *  by async callbacks at entry; mismatch after an await means stop()→start()
@@ -4347,15 +5324,33 @@ var McpServer = class _McpServer {
       paneObserver: this.paneObserver,
       detector: this.approvalDetector
     });
-    const portFilePath = this.runtimeDir ? path5.join(this.runtimeDir, "conn.json") : void 0;
+    const portFilePath = this.runtimeDir ? path8.join(this.runtimeDir, "conn.json") : void 0;
     this.httpApi = options.httpApi ?? new HttpApi({
       bearerToken: this.bearerToken,
       preferredPort: this.preferredPort,
       portFilePath
     });
+    this.hookRouting = options.hookRouting !== void 0 ? options.hookRouting : defaultHookRouting();
+    this.claims = new ClaimRegistry({ runtimeDir: this.runtimeDir, wrapperPid: this.wrapperPid });
+    this.router = new ConversationRouter({
+      hooksArmed: () => this.router.hasReceivedHook() || this.isHookRegistrationIntact(),
+      hooksHealthy: () => this.router.hasReceivedHook() && (this.hookRouting === null || this.isHookRegistrationIntact()),
+      isClaimedElsewhere: (conversationId) => this.claims.isClaimedElsewhere(conversationId),
+      otherInvokedAt: (conversationId) => this.claims.otherInvokedAt(conversationId),
+      readTranscriptFirstType: (conversationId) => this.readConversationFirstType(conversationId),
+      onRelease: (emits, decision) => {
+        for (const emit of emits) this.dispatchTranscriptEmit(emit, decision);
+      },
+      isModelOutput: (emit) => emit.event?.source === "MODEL",
+      turnStep: (emit) => emit.event?.type === "USER_INPUT" ? typeof emit.event.step_index === "number" ? emit.event.step_index : -1 : null,
+      onClaimsChanged: (claimed) => this.claims.writeOwn(claimed),
+      onLog: (message, data) => logger.info(message, data),
+      holdMs: options.conversationHoldMs
+    });
     this.httpApi.setHandlers({
       pushEvent: (p) => this.handleHttpPushEvent(p),
-      getActiveSession: () => this.getAnySession()
+      getActiveSession: () => this.getAnySession(),
+      onAgyHook: (delivery) => this.handleAgyHook(delivery)
     });
   }
   static {
@@ -4453,14 +5448,7 @@ var McpServer = class _McpServer {
     this.addListener(this.transcriptTailer, "error", () => {
     });
     this.addListener(this.transcriptTailer, "event", (emit) => {
-      const task = this.handleTranscriptEmit(emit).catch((err) => {
-        logger.error("handleTranscriptEmit failed", { error: String(err) });
-      });
-      this.transcriptHandlers.add(task);
-      void task.then(
-        () => this.transcriptHandlers.delete(task),
-        () => this.transcriptHandlers.delete(task)
-      );
+      this.dispatchTranscriptEmit(emit);
     });
     this.addListener(this.transcriptTailer, "conversation-discovered", (conversationId) => {
       void this.handleConversationDiscovered(conversationId).catch((err) => {
@@ -4558,6 +5546,8 @@ var McpServer = class _McpServer {
       }
     }
     this.listenerHandles = [];
+    this.router.reset();
+    this.claims.removeOwn();
     await Promise.allSettled([...this.transcriptHandlers]);
     await this.transcriptTailer.waitForReads();
     await this.nativeAdmissionChain;
@@ -4591,6 +5581,7 @@ var McpServer = class _McpServer {
     await this.boundedTeardownStep("paneObserver.stop", () => this.paneObserver.stop());
     await this.boundedTeardownStep("approvalDetector.stop", () => this.approvalDetector.stop());
     await this.boundedTeardownStep("httpApi.stop", () => this.httpApi.stop());
+    this.removeOrphanedRuntimeDir();
     try {
       this.appSyncClient.cleanupSubscriptions();
     } catch (err) {
@@ -4629,8 +5620,10 @@ var McpServer = class _McpServer {
     if (this.sessionDisabled) return;
     await this.ensureLaunchSession();
     if (!this.session) return;
-    if (!this.isMainConversation(conversationId)) {
-      logger.debug("Ignoring discovery for non-main conversation (subagent)", { conversationId });
+    const decision = this.router.route(conversationId);
+    if (decision === "hold") this.registerHeldConversationBeforeFirstHook(conversationId);
+    if (decision !== "process" && !(decision === "legacy" && this.legacyAcceptsConversation(conversationId))) {
+      logger.debug("Ignoring discovery for a conversation not (yet) in this session", { conversationId, decision });
       return;
     }
     this.observedMainConversationIds.add(conversationId);
@@ -4874,19 +5867,180 @@ var McpServer = class _McpServer {
       if (this.ensureLaunchInFlight === attempt) this.ensureLaunchInFlight = null;
     }
   }
-  isMainConversation(conversationId) {
+  /**
+   * The pre-F1 rule, now only the fallback for conversations no hook has
+   * claimed when hooks do not fire (see conversation-router.ts): the newest
+   * agy CLI log names the active conversation. F1 amendment: a conversation
+   * another live CodeVibe daemon has claimed is never "the active one" here,
+   * so another session's busy log cannot make us drop our own turn.
+   */
+  legacyAcceptsConversation(conversationId) {
     if (process.env.JEST_WORKER_ID && !this.cliLogPath) {
       return true;
     }
-    const cliLogPath = this.cliLogPath ?? path5.join(os5.homedir(), ".gemini", "antigravity-cli", "cli.log");
+    if (this.claims.isClaimedElsewhere(conversationId)) {
+      return false;
+    }
+    const cliLogPath = this.cliLogPath ?? path8.join(os7.homedir(), ".gemini", "antigravity-cli", "cli.log");
     const activeId = getActiveConversationFromCliLog(cliLogPath);
-    if (!activeId) {
+    if (!activeId || this.claims.isClaimedElsewhere(activeId)) {
       return true;
     }
     return activeId === conversationId;
   }
+  /**
+   * F1 moved the runtime dir under ~/.codevibe, so it outlives reboots. The
+   * wrapper's EXIT trap removes it, except when the outer terminal closed while
+   * agy kept running in tmux (the wrapper is gone; this daemon outlived it).
+   * Then remove it here — only if empty: conn.json and claims.json are already
+   * gone, and anything else is left alone.
+   */
+  removeOrphanedRuntimeDir() {
+    if (!this.runtimeDir || this.wrapperPid === null || isPidAlive(this.wrapperPid)) return;
+    try {
+      fs7.rmdirSync(this.runtimeDir);
+      logger.info("Removed runtime dir left by a closed terminal", { runtimeDir: this.runtimeDir });
+    } catch (error) {
+      const code = error.code;
+      if (code !== "ENOENT") {
+        logger.warn("Could not remove runtime dir", { runtimeDir: this.runtimeDir, code: code ?? String(error) });
+      }
+    }
+  }
+  isHookRegistrationIntact() {
+    if (!this.hookRouting) return false;
+    const now = Date.now();
+    if (!this.hookRegistrationCache || now - this.hookRegistrationCache.atMs >= HOOK_REGISTRATION_CACHE_MS) {
+      this.hookRegistrationCache = {
+        atMs: now,
+        registered: inspectHookRegistration(this.hookRouting) === "registered"
+      };
+    }
+    return this.hookRegistrationCache.registered;
+  }
+  readConversationFirstType(conversationId) {
+    if (!this.hookRouting || !CONVERSATION_ID_PATTERN.test(conversationId)) return null;
+    return readTranscriptFirstType(path8.join(
+      this.hookRouting.brainRoot,
+      conversationId,
+      ".system_generated",
+      "logs",
+      "transcript.jsonl"
+    ));
+  }
+  // ─── agy hooks (F1) ─────────────────────────────────────────────────────
+  /**
+   * One hook delivery from OUR agy (agy-hook.js only posts here when the
+   * launcher's inline CODEVIBE_AGY_HOOK_OWNER names this daemon's runtime
+   * dir). Updates routing state synchronously; network work runs afterwards so
+   * the HTTP reply — which agy is waiting for — goes out at once.
+   */
+  handleAgyHook(delivery) {
+    if (!this.started) return;
+    const { conversationId } = delivery;
+    if (delivery.event === "PreInvocation") {
+      const previousBound = this.router.getBound();
+      const { role, bound } = this.router.onPreInvocation({
+        conversationId,
+        invocationNum: delivery.invocationNum,
+        initialNumSteps: delivery.initialNumSteps
+      });
+      if (role === "main") {
+        this.observedMainConversationIds.add(conversationId);
+      } else {
+        this.observedMainConversationIds.delete(conversationId);
+      }
+      if (bound !== previousBound) {
+        logger.info("agy session bound to conversation (hook)", {
+          conversationId: bound,
+          previousConversationId: previousBound,
+          launchSessionId: this.session?.sessionId ?? null
+        });
+      }
+      return;
+    }
+    this.router.onPostToolUse(conversationId);
+    void this.resolvePromptsForCompletedTool(delivery).catch((error) => {
+      logger.warn("PostToolUse prompt resolution failed", { error: String(error) });
+    });
+  }
+  /**
+   * A tool our agy just ran was blocked on its approval prompt, so a pending
+   * mobile card for that same command or file is answered: resolve it the way
+   * a mobile reply does. Identity match only (tool-prompt-match.ts).
+   */
+  async resolvePromptsForCompletedTool(delivery) {
+    const session = this.session;
+    if (!session) return;
+    const pending = this.approvalDetector.getPendingPromptsForConversation();
+    const matched = pending.filter((state) => promptMatchesCompletedTool(state, delivery.toolName, delivery.toolArgs));
+    logger.info("PostToolUse checked pending prompts", {
+      conversationId: delivery.conversationId,
+      toolName: delivery.toolName ?? null,
+      commandDigest: commandDigest(delivery.toolArgs?.CommandLine),
+      pending: pending.length,
+      matched: matched.length
+    });
+    for (const state of matched) {
+      const stillPending = this.approvalDetector.resolvePrompt(state.promptId) !== null;
+      const ownedByE1 = this.e1PromptRaises.has(state.promptId);
+      const resolved = await this.resolveE1PluginApproval(session.sessionId, state.promptId);
+      logger.info("Resolved interactive prompt answered on the desktop (PostToolUse)", {
+        promptId: state.promptId,
+        toolName: delivery.toolName ?? null,
+        stillPending,
+        ownedByE1,
+        backendAcknowledged: resolved
+      });
+    }
+  }
   // ─── Transcript flow ────────────────────────────────────────────────────
-  async handleTranscriptEmit(emit, admission) {
+  /**
+   * Route one transcript event synchronously, at arrival, so held events and
+   * later ones keep their order. `released` carries the router's decision for
+   * events leaving the hold buffer.
+   */
+  dispatchTranscriptEmit(emit, released) {
+    if (!this.started) return;
+    if (!this.transcriptObservedAt.has(emit)) this.transcriptObservedAt.set(emit, Date.now());
+    const decision = released ?? this.router.route(emit.conversationId, emit);
+    if (decision === "drop") {
+      logger.debug("Ignoring transcript event from a conversation outside this session", {
+        conversationId: emit.conversationId
+      });
+      return;
+    }
+    if (decision === "hold") {
+      this.router.hold(emit.conversationId, emit);
+      this.registerHeldConversationBeforeFirstHook(emit.conversationId);
+      return;
+    }
+    const task = this.handleTranscriptEmit(emit, decision).catch((err) => {
+      logger.error("handleTranscriptEmit failed", { error: String(err) });
+    });
+    this.transcriptHandlers.add(task);
+    void task.then(
+      () => this.transcriptHandlers.delete(task),
+      () => this.transcriptHandlers.delete(task)
+    );
+  }
+  /**
+   * Until this daemon's first hook arrives it cannot tell "hooks will claim
+   * this" from "hooks never fire here" (older agy, or an account where agy's
+   * hook gate is off). Keep the pre-F1 registration for a held conversation the
+   * legacy rule accepts, so an approval prompt raised during the hold still has
+   * an owning conversation and reaches the phone with its options. Registration
+   * only makes the conversation eligible for prompt ownership; its events still
+   * wait for the router. (Stage 1 R1-F2.)
+   */
+  registerHeldConversationBeforeFirstHook(conversationId) {
+    if (this.router.hasReceivedHook()) return;
+    if (this.observedMainConversationIds.has(conversationId)) return;
+    if (this.claims.isClaimedElsewhere(conversationId)) return;
+    if (!this.legacyAcceptsConversation(conversationId)) return;
+    this.observedMainConversationIds.add(conversationId);
+  }
+  async handleTranscriptEmit(emit, decision, admission) {
     if (!this.started) return;
     const { conversationId, byteOffset, event } = emit;
     if (this.sessionDisabled) {
@@ -4896,7 +6050,7 @@ var McpServer = class _McpServer {
     if (!this.session) {
       return;
     }
-    if (!this.isMainConversation(conversationId)) {
+    if (decision === "legacy" && !this.legacyAcceptsConversation(conversationId)) {
       logger.debug("Ignoring transcript emit for non-main conversation (subagent)", { conversationId });
       return;
     }
@@ -4951,8 +6105,9 @@ var McpServer = class _McpServer {
         }
       }
       if (input.type === import_codevibe_core6.EventType.USER_PROMPT && input.source === import_codevibe_core6.EventSource.DESKTOP) {
-        const clearedPromptIds = this.approvalDetector.onPanePromptCleared();
-        await this.resolveAcceptedInputPrompts(session, clearedPromptIds);
+        const inputObservedAtMs = this.transcriptObservedAt.get(emit);
+        const clearedPromptIds = this.approvalDetector.onPanePromptCleared(inputObservedAtMs);
+        await this.resolveAcceptedInputPrompts(session, clearedPromptIds, inputObservedAtMs);
         const dedupe = admission ? null : this.mobileDeduper.consumeIfDuplicate(session.sessionId, input.content);
         if (dedupe) {
           if (admission) admission.echoContent = input.content;
@@ -4998,10 +6153,13 @@ var McpServer = class _McpServer {
     if (!this.started || this.sessionDisabled) throw Error("SYNC_SOURCE_STOPPED");
     await this.ensureLaunchSession();
     const session = this.session;
-    if (!session || !this.isMainConversation(source.conversationId)) throw Error("SYNC_SOURCE_OWNERSHIP_UNAVAILABLE");
+    if (!session) throw Error("SYNC_SOURCE_OWNERSHIP_UNAVAILABLE");
     const selection = await this.selectNativeSource(session);
     if (!this.started || this.session !== session) throw Error("SYNC_SOURCE_OWNER_CHANGED");
     if (selection.protocol === "LEGACY") return null;
+    if (!this.legacyAcceptsConversation(source.conversationId) || this.router.roleOf(source.conversationId) === "subagent") {
+      throw Error("SYNC_SOURCE_OWNERSHIP_UNAVAILABLE");
+    }
     if (!this.toolActivity?.isActive(session.sessionId)) {
       if (this.nativeToolStart && this.nativeToolStart.session !== session) throw Error("SYNC_SOURCE_OWNER_CHANGED");
       if (!this.nativeToolStart) {
@@ -5058,7 +6216,7 @@ var McpServer = class _McpServer {
       this.assertNativeOwner(owner);
       if ((await owner.cursor.open(0)).byteOffset >= source.endOffset) return;
       const admission = { outputs: [null, null] };
-      await this.handleTranscriptEmit(emit, admission);
+      await this.handleTranscriptEmit(emit, "legacy", admission);
       this.assertNativeOwner(owner);
       const echoFrame = {
         streamSha256: owner.streamSha256,
@@ -5277,7 +6435,7 @@ var McpServer = class _McpServer {
       agentType: "ANTIGRAVITY",
       ...title !== void 0 && { title }
     });
-    this.e1PromptRaises.set(record.promptId, { record });
+    this.e1PromptRaises.set(record.promptId, { record, raisedAtMs: Date.now() });
     if (!this.e1TtlRefreshTimer) this.startE1TtlRefresh();
     return record;
   }
@@ -5337,10 +6495,12 @@ var McpServer = class _McpServer {
       }
     }
   }
-  async resolveAcceptedInputPrompts(session, observedPromptIds = []) {
+  async resolveAcceptedInputPrompts(session, observedPromptIds = [], inputObservedAtMs) {
     const promptIds = new Set(observedPromptIds);
     for (const entry of this.e1PromptRaises.values()) {
-      if (entry.record.sessionId === session.sessionId) promptIds.add(entry.record.promptId);
+      if (entry.record.sessionId !== session.sessionId) continue;
+      if (inputObservedAtMs !== void 0 && (entry.raisedAtMs ?? 0) >= inputObservedAtMs) continue;
+      promptIds.add(entry.record.promptId);
     }
     for (const promptId of promptIds) {
       await this.resolveE1PluginApproval(session.sessionId, promptId);
@@ -5437,6 +6597,7 @@ var McpServer = class _McpServer {
   snapshotOpenE1(sessionId) {
     return [...this.e1PromptRaises.values()].filter((e) => e.record.sessionId === sessionId).map((e) => ({
       record: { ...e.record },
+      ...e.raisedAtMs !== void 0 && { raisedAtMs: e.raisedAtMs },
       ...e.contentPlain !== void 0 && { contentPlain: e.contentPlain },
       ...e.metadataPlain !== void 0 && { metadataPlain: e.metadataPlain }
     }));
@@ -5458,6 +6619,7 @@ var McpServer = class _McpServer {
     for (const snap of snapshot) {
       const entry = {
         record: { ...snap.record, sessionId: replacementSession.sessionId },
+        ...snap.raisedAtMs !== void 0 && { raisedAtMs: snap.raisedAtMs },
         ...snap.contentPlain !== void 0 && { contentPlain: snap.contentPlain },
         ...snap.metadataPlain !== void 0 && { metadataPlain: snap.metadataPlain }
       };
@@ -5831,6 +6993,11 @@ var McpServer = class _McpServer {
       if (cand.snapshotHash) {
         this.e1ContentKeyIndex.set(`${session.sessionId}::${cand.snapshotHash}`, e1rec.promptId);
       }
+      logger.info("Pane prompt identity", {
+        promptId: e1rec.promptId,
+        conversationId: activeConvId,
+        commandDigest: commandDigest(parsed.command)
+      });
     } else {
       this.e1PromptRaises.delete(e1rec.promptId);
     }
@@ -5838,13 +7005,16 @@ var McpServer = class _McpServer {
   /**
    * Pick the agy conversation UUID that owns the current approval UI.
    * Priority:
-   *   1. cli.log says it's a specific conv → return that one if observed.
-   *   2. Otherwise, return the most recently observed main conv UUID.
-   *   3. Otherwise null (no active conv).
+   *   1. F1: the conversation our PreInvocation hook last bound.
+   *   2. cli.log says it's a specific conv → return that one if observed.
+   *   3. Otherwise, return the most recently observed main conv UUID.
+   *   4. Otherwise null (no active conv).
    */
   pickActiveConversationForPrompt() {
+    const bound = this.router.getBound();
+    if (bound && this.observedMainConversationIds.has(bound)) return bound;
     if (this.observedMainConversationIds.size === 0) return null;
-    const cliLogPath = this.cliLogPath ?? path5.join(os5.homedir(), ".gemini", "antigravity-cli", "cli.log");
+    const cliLogPath = this.cliLogPath ?? path8.join(os7.homedir(), ".gemini", "antigravity-cli", "cli.log");
     const cliActive = getActiveConversationFromCliLog(cliLogPath);
     if (cliActive && this.observedMainConversationIds.has(cliActive)) {
       return cliActive;
@@ -5982,13 +7152,13 @@ var McpServer = class _McpServer {
       } else if (shouldDecrypt && !sessionKey) {
         logger.warn("Cannot decrypt attachment - no session key available", { id: attachment.id });
       }
-      const attachmentsDir = path5.join(this.workingDirectory, ".codevibe-attachments");
-      if (!fs5.existsSync(attachmentsDir)) {
-        fs5.mkdirSync(attachmentsDir, { recursive: true });
+      const attachmentsDir = path8.join(this.workingDirectory, ".codevibe-attachments");
+      if (!fs7.existsSync(attachmentsDir)) {
+        fs7.mkdirSync(attachmentsDir, { recursive: true });
       }
       let extension = "";
       if (attachment.filename) {
-        const ext = path5.extname(attachment.filename);
+        const ext = path8.extname(attachment.filename);
         if (ext) extension = ext;
       }
       if (!extension) {
@@ -6003,8 +7173,8 @@ var McpServer = class _McpServer {
         extension = mimeToExt[attachment.type] || ".bin";
       }
       const filename = `attachment-${attachment.id}${extension}`;
-      const absolutePath = path5.join(attachmentsDir, filename);
-      fs5.writeFileSync(absolutePath, buffer);
+      const absolutePath = path8.join(attachmentsDir, filename);
+      fs7.writeFileSync(absolutePath, buffer);
       const relativePath = `./.codevibe-attachments/${filename}`;
       logger.info("Attachment saved to working directory", {
         id: attachment.id,
@@ -6520,7 +7690,7 @@ function getActiveConversationFromCliLog(cliLogPath) {
   try {
     let initialStat;
     try {
-      initialStat = fs5.lstatSync(cliLogPath);
+      initialStat = fs7.lstatSync(cliLogPath);
     } catch {
       return null;
     }
@@ -6532,19 +7702,19 @@ function getActiveConversationFromCliLog(cliLogPath) {
         if (cached && now - cached.lastScanMs < CLI_LOG_RESOLVE_TTL_MS) {
           resolvedPath = cached.resolvedPath;
         } else {
-          const logDir = path5.join(path5.dirname(cliLogPath), "log");
+          const logDir = path8.join(path8.dirname(cliLogPath), "log");
           let dirOk = false;
           try {
-            dirOk = fs5.statSync(logDir).isDirectory();
+            dirOk = fs7.statSync(logDir).isDirectory();
           } catch {
           }
           if (dirOk) {
             const entries = [];
-            for (const name of fs5.readdirSync(logDir)) {
+            for (const name of fs7.readdirSync(logDir)) {
               if (!/^cli-.*\.log$/.test(name)) continue;
-              const full = path5.join(logDir, name);
+              const full = path8.join(logDir, name);
               try {
-                const s = fs5.statSync(full);
+                const s = fs7.statSync(full);
                 if (s.isFile()) entries.push({ full, mtimeMs: s.mtimeMs });
               } catch {
               }
@@ -6563,7 +7733,7 @@ function getActiveConversationFromCliLog(cliLogPath) {
       resolvedPath = initialStat.isSymbolicLink() ? null : cliLogPath;
     }
     if (resolvedPath === null) return null;
-    const content = fs5.readFileSync(resolvedPath, "utf8");
+    const content = fs7.readFileSync(resolvedPath, "utf8");
     const regex = /(?:Created conversation|Streaming conversation|Starting conversation update stream for)\s+([0-9a-fA-F-]{36})/g;
     const matches = Array.from(content.matchAll(regex));
     if (matches.length === 0) return null;
@@ -6765,8 +7935,10 @@ var __testing = {
   __testing,
   classifyEntrypoint,
   classifyTmuxHasSessionError,
+  commandDigest,
   generateLaunchSessionId,
   getActiveConversationFromCliLog,
   parseMaybeJson,
+  readTranscriptFirstType,
   runForeignSpawnIdle
 });