@songsid/agend 2.3.4-beta.5 → 2.3.5-alpha.2

package/dist/backend/claude-code.js

@@ -943,17 +943,87 @@ function claudeCommandRequestIdentity(pane) {
         .filter(row => !CLAUDE_AUTO_DENY_COUNTDOWN.test(row))
         .map(row => row.trim()).filter(Boolean).join("\n");
 }
+/**
+ * M-2296: Claude Code 2.1.317's connector file-send safety card (`circuitBreaker: "connectorFileSend"`): an MCP
+ * connector call (the email connector's attachments by reference) that would send files from this computer asks
+ * first. It is bypass-immune (`bypassImmune: true, waivableInBypass: false` in the bundle), so it appears under
+ * --dangerously-skip-permissions too, and its focus starts on "Yes" unless the request defaults to No — an Enter
+ * meant for a delivery would send the files. Never answered by AgEnD: held for a person, shown in Needs-you.
+ *
+ * Shape (2.1.317 bundle: TIe/Rwt/Njo/Ljo/Twt and the `* ` file gutter; chrome as captured from a real MCP card):
+ * the card's last question row is "Do you want to proceed?", or a refusal-only variant ending "…no files are sent."
+ * (a list too long to show, or a call that does not say which files) or "…or choose No." (a terminal too short to
+ * show every file); Yes / No options (numbered, or unnumbered when it defaults to No); the "Esc to cancel" footer
+ * last; and, between the card's top and its question, a file row `* "<path>"` / `* the file at "<path>"` or the
+ * `* Name may not be what it looks like.` warning — the marks of a file-send card that no other card carries. A
+ * question variant that only this card asks counts on its own. A Bash card (its own entry) never matches here.
+ */
+const FILE_SEND_ONLY_QUESTION = /(?:Choose No, and no files are sent\.|or choose No\.)[ \t]*$/;
+const FILE_SEND_QUESTION = /(?:Do you want to proceed\?|Choose No, and no files are sent\.|or choose No\.)[ \t]*$/;
+/** Pre-filter only (anywhere in the pane); claudeFileSendCardActive decides. */
+export const CLAUDE_FILE_SEND_PATTERN = /Do you want to proceed\?|Choose No, and no files are sent\.|or choose No\./;
+const FILE_SEND_MARK = /^[ \t│┃]*\* (?:the file at )?"|^[ \t│┃]*\* Name may not be what it looks like\./;
+const FILE_SEND_OPTION = /^[ \t]*[❯›]?[ \t]*(?:\d{1,2}\.[ \t]+)?(Yes|No)\b/;
+export function claudeFileSendCardActive(pane) {
+    const rows = claudeRows(pane).filter(row => row.trim() !== "");
+    if (!rows.length || !/^[ \t]*Esc(?:ape)? to cancel\b/.test(rows[rows.length - 1]))
+        return false;
+    // The question and the menu above the footer, as one bounded run of rows. A narrow pane wraps the question
+    // (#2992 review, Prism P2: "…Choose" / "No, and no files are sent."), and a wrapped row can even look like an
+    // option, so every split is tried from the bottom: the menu is the rows below it, the question is what the rows
+    // above it read as one line; the first split whose menu parses and whose question is a file-send question wins.
+    const block = rows.slice(Math.max(0, rows.length - 1 - 16), rows.length - 1);
+    for (let k = 1; k < block.length; k++) {
+        const menu = block.slice(block.length - k), above = block.slice(0, block.length - k);
+        const titles = [];
+        // The menu's first row is an option. (A wrapped question row may begin "No," too: the split that makes it one
+        // leaves "…Choose" as the question, which is no file-send question, so that split never wins.)
+        let parses = FILE_SEND_OPTION.test(menu[0]) || /^[ \t]*[❯›]?[ \t]*\d{1,2}\.[ \t]/.test(menu[0]);
+        for (const row of menu) {
+            const option = FILE_SEND_OPTION.exec(row);
+            if (option) {
+                titles.push(option[1]);
+                continue;
+            }
+            if (/^[ \t]*[❯›]?[ \t]*\d{1,2}\.[ \t]/.test(row) || /^[ \t]{3,}\S/.test(row))
+                continue; // another option, or a wrapped one
+            parses = false;
+            break;
+        }
+        if (!parses || !titles.includes("No"))
+            continue;
+        // The question: the rows just above the menu, read as one line (at most six physical rows).
+        const question = above.slice(-6).map(row => row.trim()).join(" ");
+        if (!FILE_SEND_QUESTION.test(question))
+            continue;
+        const refusalOnly = FILE_SEND_ONLY_QUESTION.test(question);
+        // A refusal-only variant may offer No alone; every other shape offers Yes as well.
+        if (!titles.includes("Yes") && !refusalOnly)
+            continue;
+        // The card's own rows: up from the menu to the rule that opens it (or 40 rows at most).
+        const card = [];
+        for (let i = rows.length - 2 - k; i >= 0 && rows.length - 2 - k - i <= 40; i--) {
+            if (/^[ \t]*─{20,}[ \t]*$/.test(rows[i]))
+                break;
+            card.push(rows[i]);
+        }
+        if (card.some(row => /^[ \t]*Bash command[ \t]*$/.test(row)))
+            return false;
+        return refusalOnly || card.some(row => FILE_SEND_MARK.test(row));
+    }
+    return false;
+}
 const dangerPromptOnYes = (pane) => {
     const state = claudeDangerousCommandPromptState(pane);
-    return state.active && state.cursor === "yes";
+    return state.active && state.cursor === "yes" && !claudeFileSendCardActive(pane);
 };
 const dangerPromptOnNo = (pane) => {
     const state = claudeDangerousCommandPromptState(pane);
-    return state.active && state.cursor === "no";
+    return state.active && state.cursor === "no" && !claudeFileSendCardActive(pane);
 };
 const dangerPromptUnknown = (pane) => {
     const state = claudeDangerousCommandPromptState(pane);
-    return state.active && state.cursor === "unknown";
+    return state.active && state.cursor === "unknown" && !claudeFileSendCardActive(pane);
 };
 /** This text is code-owned and intentionally never includes the command. */
 export const CLAUDE_DANGEROUS_COMMAND_BLOCKED_NOTICE = "[system:dangerous-command-blocked]\nThe previous command was classified as dangerous and was automatically denied. Do not retry it. Use a safe form instead (for example `${VAR:?}` validation, a literal path, or skip the destructive operation).";
@@ -1009,8 +1079,8 @@ const CLAUDE_BYPASS_ENTRIES = [
 ];
 /** Startup budget for a resuming claude-code launch (fresh starts keep the default). */
 export const CLAUDE_RESUME_STARTUP_BUDGET_MS = 60_000;
-export class ClaudeCodeBackend {
-    instanceDir;
+/** Pane-only detectors: construction performs no provider, config or session discovery. */
+export class ClaudePaneDetectors {
     binaryName = "claude";
     replyCompletionGuard = true;
     /**
@@ -1022,116 +1092,6 @@ export class ClaudeCodeBackend {
     getStartupBudgetMs(ctx) {
         return ctx.resume ? CLAUDE_RESUME_STARTUP_BUDGET_MS : undefined;
     }
-    binaryPath;
-    constructor(instanceDir) {
-        this.instanceDir = instanceDir;
-        this.binaryPath = resolveBinary("claude");
-    }
-    /** #1811: what the last launch left out and why — the Log tab and daemon.log, never a channel. */
-    quietLaunchNotes = [];
-    consumeQuietLaunchNotes() { const notes = this.quietLaunchNotes; this.quietLaunchNotes = []; return notes; }
-    buildCommand(config) {
-        const settingsPath = join(this.instanceDir, "claude-settings.json");
-        const mcpConfigPath = join(this.instanceDir, "mcp-config.json");
-        const envPrefix = ["CMUX_CLAUDE_HOOKS_DISABLED=1", "CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1"];
-        // #1699: a named credential profile is its own config dir — its login, account, trust and conversations. No profile:
-        // nothing added, nothing created (the command is exactly what it was).
-        const profileDir = claudeProfileConfigDir(config.backendOptions);
-        if (profileDir) {
-            prepareCredentialProfileHome(credentialHomeSpec("claude-code"), profileDir);
-            // #1754: the project's auto-memory is the shared one, as on the default login.
-            linkSharedClaudeMemory(profileDir, config.workingDirectory, credentialHomeSpec("claude-code").sharedRoot());
-            envPrefix.push(`CLAUDE_CONFIG_DIR=${shellQuote(profileDir)}`);
-        }
-        if (process.env.ANTHROPIC_BASE_URL)
-            envPrefix.push(`ANTHROPIC_BASE_URL=${shellQuote(process.env.ANTHROPIC_BASE_URL)}`);
-        // #2010: an opt-in prompt-cache TTL for the main thread and its subagents. Unset: nothing added, the CLI chooses.
-        const ttl = promptCacheTtl(config.backendOptions);
-        if (ttl)
-            envPrefix.push(`CLAUDE_CODE_PROMPT_CACHE_TTL=${ttl}`, `CLAUDE_CODE_SUBAGENT_PROMPT_CACHE_TTL=${ttl}`);
-        // The fleet's API key only where this instance's own config dir has no OAuth login: a key in the environment wins
-        // over the login, so reading another dir here bills the wrong account (#1699).
-        if (process.env.ANTHROPIC_API_KEY && !this.hasOAuthSession(profileDir)) {
-            envPrefix.push(`ANTHROPIC_API_KEY=${shellQuote(process.env.ANTHROPIC_API_KEY)}`);
-        }
-        let cmd = `${envPrefix.join(" ")} ${this.binaryPath} --settings ${settingsPath} --mcp-config ${mcpConfigPath}`;
-        if (config.skipPermissions !== false)
-            cmd += " --dangerously-skip-permissions";
-        const sessionIdFile = join(this.instanceDir, "session-id");
-        // `session-id` belongs to the instance, not the backend. A ClassicBot can
-        // switch from Kiro (or another CLI) to Claude while retaining that marker.
-        // Claude's bare `--continue` then looks for a conversation in this cwd and
-        // exits when the workspace has never had a Claude session. Treat Claude's
-        // own project transcript as the source of truth instead of the generic
-        // marker alone. This also makes an empty/missing Classic workspace start
-        // fresh rather than entering a resume crash loop.
-        if (!config.skipResume && existsSync(sessionIdFile) && this.hasProjectSession(config.workingDirectory, profileDir)) {
-            cmd += " --continue";
-        }
-        if (config.model) {
-            const model = validateModel(config.model);
-            warnIfModelMismatch("claude-code", model);
-            cmd += ` --model ${shellQuote(model)}`;
-        }
-        // #1811: the configured effort, where this claude takes it (launch-effort.ts); else a quiet note.
-        const effort = flagEffort("claude-code", config.effort, this.binaryPath);
-        if (effort.arg)
-            cmd += effort.arg;
-        this.quietLaunchNotes = effort.note ? [effort.note] : [];
-        // Additive system prompt: append fleet instructions without overriding Claude's built-in prompt
-        const instrFile = join(this.instanceDir, "fleet-instructions.md");
-        if (existsSync(instrFile)) {
-            cmd += ` --append-system-prompt-file ${instrFile}`;
-        }
-        return cmd;
-    }
-    hasProjectSession(workingDirectory, profileDir) {
-        const cwd = workingDirectory.trim();
-        if (!cwd)
-            return false;
-        const configDir = claudeConfigDirFor(profileDir);
-        const encodedCwd = claudeProjectKey(cwd);
-        try {
-            return readdirSync(join(configDir, "projects", encodedCwd), { withFileTypes: true })
-                .some(entry => entry.isFile() && entry.name.endsWith(".jsonl"));
-        }
-        catch {
-            return false;
-        }
-    }
-    writeConfig(config) {
-        // 1. Write mcp-config.json to instance dir (loaded via --mcp-config)
-        const mcpConfigPath = join(this.instanceDir, "mcp-config.json");
-        const mcpConfig = { mcpServers: config.mcpServers };
-        writeFileSync(mcpConfigPath, JSON.stringify(mcpConfig, null, 2));
-        // 2. Write statusline script
-        const statusLineCommand = this.writeStatusLineScript();
-        // 3. Write claude-settings.json (permissions handled by --dangerously-skip-permissions)
-        const settings = {
-            statusLine: {
-                type: "command",
-                command: statusLineCommand,
-            },
-        };
-        // The Bypass Permissions warning appears on a first run (and whenever the
-        // user's own settings have not recorded the acceptance) for every launch
-        // with --dangerously-skip-permissions. AgEnD passes that flag deliberately,
-        // so record the acceptance in the flag-level settings this file is loaded as
-        // (--settings): claude 2.1.286 then never paints the dialog (verified live).
-        // Only when the flag is actually passed — see buildCommand.
-        if (config.skipPermissions !== false)
-            settings.skipDangerousModePermissionPrompt = true;
-        writeFileSync(join(this.instanceDir, "claude-settings.json"), JSON.stringify(settings));
-        // 4. Pre-approve API key to skip interactive prompt on startup
-        this.preApproveApiKey(config);
-        // 5. Write fleet instructions file (loaded via --append-system-prompt-file)
-        if (config.instructions) {
-            try {
-                writeFileSync(join(this.instanceDir, "fleet-instructions.md"), config.instructions);
-            }
-            catch { /* best effort */ }
-        }
-    }
     /**
      * `❯` is the input box, which Claude Code renders persistently — it is on screen
      * while the agent works, not only when it is waiting. So this marks "the TUI has
@@ -1242,27 +1202,6 @@ export class ClaudeCodeBackend {
         const box = readClaudeInputBox(pane);
         return box !== null && box.queued !== true && !this.getBusyPattern().test(pane);
     }
-    getContextUsage() {
-        try {
-            const sf = join(this.instanceDir, "statusline.json");
-            const data = JSON.parse(readFileSync(sf, "utf-8"));
-            return data.context_window?.used_percentage ?? null;
-        }
-        catch (err) {
-            // File may not exist yet during startup — return null to signal unavailable
-            return null;
-        }
-    }
-    getSessionId() {
-        try {
-            const sf = join(this.instanceDir, "statusline.json");
-            const data = JSON.parse(readFileSync(sf, "utf-8"));
-            return data.session_id ?? null;
-        }
-        catch {
-            return null;
-        }
-    }
     getErrorPatterns() {
         return [
             { pattern: /API Error: Rate limit/i, type: "rate_limit", action: "failover", message: "API rate limit reached" },
@@ -1441,6 +1380,21 @@ export class ClaudeCodeBackend {
                 inputBlocked: true,
                 description: COLD_RESUME_HOLD_DESCRIPTION,
             },
+            // M-2296: the 2.1.317 connector file-send card — ahead of the dangerous-command entries, whose two-option
+            // shape it can share: it is never auto-answered (not even "No", which would tell the agent its call was a
+            // dangerous command) and never takes a delivery's keys.
+            {
+                pattern: CLAUDE_FILE_SEND_PATTERN,
+                isActive: claudeFileSendCardActive,
+                requestIdentity: pane => claudeSelectionCard(pane)?.identity ?? null,
+                interactionKind: "permission",
+                keys: [],
+                holdOnly: true,
+                blocksDelivery: true,
+                inputBlocked: true,
+                remoteCard: claudeSelectionCard,
+                description: "Claude connector file-send approval — waiting for a human choice, never auto-approving",
+            },
             // Claude's shell-command safety menu is the one runtime prompt AgEnD is
             // allowed to answer automatically. Keep cursor-known entries ahead of
             // the hold-only guard; unknown shapes are always held for a human.
@@ -1542,6 +1496,141 @@ export class ClaudeCodeBackend {
     getCompactCommand() { return "/compact"; }
     getClearCommand() { return "/clear"; }
     getCancelKey() { return "Escape"; }
+}
+export class ClaudeCodeBackend extends ClaudePaneDetectors {
+    instanceDir;
+    binaryPath;
+    constructor(instanceDir) {
+        super();
+        this.instanceDir = instanceDir;
+        this.binaryPath = resolveBinary("claude");
+    }
+    /** #1811: what the last launch left out and why — the Log tab and daemon.log, never a channel. */
+    quietLaunchNotes = [];
+    consumeQuietLaunchNotes() { const notes = this.quietLaunchNotes; this.quietLaunchNotes = []; return notes; }
+    buildCommand(config) {
+        const settingsPath = join(this.instanceDir, "claude-settings.json");
+        const mcpConfigPath = join(this.instanceDir, "mcp-config.json");
+        const envPrefix = ["CMUX_CLAUDE_HOOKS_DISABLED=1", "CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1"];
+        // #1699: a named credential profile is its own config dir — its login, account, trust and conversations. No profile:
+        // nothing added, nothing created (the command is exactly what it was).
+        const profileDir = claudeProfileConfigDir(config.backendOptions);
+        if (profileDir) {
+            prepareCredentialProfileHome(credentialHomeSpec("claude-code"), profileDir);
+            // #1754: the project's auto-memory is the shared one, as on the default login.
+            linkSharedClaudeMemory(profileDir, config.workingDirectory, credentialHomeSpec("claude-code").sharedRoot());
+            envPrefix.push(`CLAUDE_CONFIG_DIR=${shellQuote(profileDir)}`);
+        }
+        if (process.env.ANTHROPIC_BASE_URL)
+            envPrefix.push(`ANTHROPIC_BASE_URL=${shellQuote(process.env.ANTHROPIC_BASE_URL)}`);
+        // #2010: an opt-in prompt-cache TTL for the main thread and its subagents. Unset: nothing added, the CLI chooses.
+        const ttl = promptCacheTtl(config.backendOptions);
+        if (ttl)
+            envPrefix.push(`CLAUDE_CODE_PROMPT_CACHE_TTL=${ttl}`, `CLAUDE_CODE_SUBAGENT_PROMPT_CACHE_TTL=${ttl}`);
+        // The fleet's API key only where this instance's own config dir has no OAuth login: a key in the environment wins
+        // over the login, so reading another dir here bills the wrong account (#1699).
+        if (process.env.ANTHROPIC_API_KEY && !this.hasOAuthSession(profileDir)) {
+            envPrefix.push(`ANTHROPIC_API_KEY=${shellQuote(process.env.ANTHROPIC_API_KEY)}`);
+        }
+        let cmd = `${envPrefix.join(" ")} ${this.binaryPath} --settings ${settingsPath} --mcp-config ${mcpConfigPath}`;
+        if (config.skipPermissions !== false)
+            cmd += " --dangerously-skip-permissions";
+        const sessionIdFile = join(this.instanceDir, "session-id");
+        // `session-id` belongs to the instance, not the backend. A ClassicBot can
+        // switch from Kiro (or another CLI) to Claude while retaining that marker.
+        // Claude's bare `--continue` then looks for a conversation in this cwd and
+        // exits when the workspace has never had a Claude session. Treat Claude's
+        // own project transcript as the source of truth instead of the generic
+        // marker alone. This also makes an empty/missing Classic workspace start
+        // fresh rather than entering a resume crash loop.
+        if (!config.skipResume && existsSync(sessionIdFile) && this.hasProjectSession(config.workingDirectory, profileDir)) {
+            cmd += " --continue";
+        }
+        if (config.model) {
+            const model = validateModel(config.model);
+            warnIfModelMismatch("claude-code", model);
+            cmd += ` --model ${shellQuote(model)}`;
+        }
+        // #1811: the configured effort, where this claude takes it (launch-effort.ts); else a quiet note.
+        const effort = flagEffort("claude-code", config.effort, this.binaryPath);
+        if (effort.arg)
+            cmd += effort.arg;
+        this.quietLaunchNotes = effort.note ? [effort.note] : [];
+        // Additive system prompt: append fleet instructions without overriding Claude's built-in prompt
+        const instrFile = join(this.instanceDir, "fleet-instructions.md");
+        if (existsSync(instrFile)) {
+            cmd += ` --append-system-prompt-file ${instrFile}`;
+        }
+        return cmd;
+    }
+    hasProjectSession(workingDirectory, profileDir) {
+        const cwd = workingDirectory.trim();
+        if (!cwd)
+            return false;
+        const configDir = claudeConfigDirFor(profileDir);
+        const encodedCwd = claudeProjectKey(cwd);
+        try {
+            return readdirSync(join(configDir, "projects", encodedCwd), { withFileTypes: true })
+                .some(entry => entry.isFile() && entry.name.endsWith(".jsonl"));
+        }
+        catch {
+            return false;
+        }
+    }
+    writeConfig(config) {
+        // 1. Write mcp-config.json to instance dir (loaded via --mcp-config)
+        const mcpConfigPath = join(this.instanceDir, "mcp-config.json");
+        const mcpConfig = { mcpServers: config.mcpServers };
+        writeFileSync(mcpConfigPath, JSON.stringify(mcpConfig, null, 2));
+        // 2. Write statusline script
+        const statusLineCommand = this.writeStatusLineScript();
+        // 3. Write claude-settings.json (permissions handled by --dangerously-skip-permissions)
+        const settings = {
+            statusLine: {
+                type: "command",
+                command: statusLineCommand,
+            },
+        };
+        // The Bypass Permissions warning appears on a first run (and whenever the
+        // user's own settings have not recorded the acceptance) for every launch
+        // with --dangerously-skip-permissions. AgEnD passes that flag deliberately,
+        // so record the acceptance in the flag-level settings this file is loaded as
+        // (--settings): claude 2.1.286 then never paints the dialog (verified live).
+        // Only when the flag is actually passed — see buildCommand.
+        if (config.skipPermissions !== false)
+            settings.skipDangerousModePermissionPrompt = true;
+        writeFileSync(join(this.instanceDir, "claude-settings.json"), JSON.stringify(settings));
+        // 4. Pre-approve API key to skip interactive prompt on startup
+        this.preApproveApiKey(config);
+        // 5. Write fleet instructions file (loaded via --append-system-prompt-file)
+        if (config.instructions) {
+            try {
+                writeFileSync(join(this.instanceDir, "fleet-instructions.md"), config.instructions);
+            }
+            catch { /* best effort */ }
+        }
+    }
+    getContextUsage() {
+        try {
+            const sf = join(this.instanceDir, "statusline.json");
+            const data = JSON.parse(readFileSync(sf, "utf-8"));
+            return data.context_window?.used_percentage ?? null;
+        }
+        catch (err) {
+            // File may not exist yet during startup — return null to signal unavailable
+            return null;
+        }
+    }
+    getSessionId() {
+        try {
+            const sf = join(this.instanceDir, "statusline.json");
+            const data = JSON.parse(readFileSync(sf, "utf-8"));
+            return data.session_id ?? null;
+        }
+        catch {
+            return null;
+        }
+    }
     /** #1217: Claude's own words for a session that is not there to resume. */
     resumeMissingPattern() {
         return /no conversation found|no conversation to (continue|resume)|no previous (session|conversation)/i;