commandmate 0.19.0 → 0.21.0

package/dist/server/src/lib/db/worktree-alias-db.js

@@ -0,0 +1,155 @@
+"use strict";
+/**
+ * Historical worktree IDs and the worktree they now resolve to (Issue #1621,
+ * Phase 2; table created by migration v53).
+ *
+ * A worktree ID leaks out of the database the moment it is minted: into URLs
+ * the user bookmarks, into tabs they leave open, into `commandmate send <id>`
+ * lines in someone's script. #1644 stops the ID from moving on its own, but IDs
+ * written under the old branch-derived scheme still have to be renumbered
+ * (#1645), and a directory can still be moved. Recording the old ID is what
+ * keeps every one of those references answering instead of 404ing.
+ *
+ * Deliberately free of any dependency on the request/singleton layer: every
+ * function takes the `db` it should act on. The route-boundary wrapper that
+ * reaches for the singleton lives in `@/lib/git/git-route-worktree`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.recordWorktreeAlias = recordWorktreeAlias;
+exports.resolveWorktreeIdWithAlias = resolveWorktreeIdWithAlias;
+exports.getWorktreeAliases = getWorktreeAliases;
+exports.getAllWorktreeAliases = getAllWorktreeAliases;
+exports.getAliasedWorktreeIds = getAliasedWorktreeIds;
+const worktree_id_rename_1 = require("./migrations/worktree-id-rename");
+/**
+ * Whether `worktree_aliases` exists in this database.
+ *
+ * A database opened by `getDbInstance` is always migrated, but tests hand
+ * hand-built connections around and the CLI can point at an older file. Callers
+ * on the request path must degrade to "no alias" rather than throw, so the
+ * lookups below check first.
+ */
+function hasAliasTable(db) {
+    const row = db
+        .prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'worktree_aliases'")
+        .get();
+    return row !== undefined;
+}
+/**
+ * Record that `oldId` used to name the worktree now known as `worktreeId`.
+ *
+ * Idempotent, and safe to call from inside the rename transaction:
+ *
+ * - a self-alias (`oldId === worktreeId`) is dropped — it would resolve to
+ *   itself and shadow nothing useful;
+ * - an alias whose `old_id` equals the *destination* is deleted, because that
+ *   ID is a live worktree again and the live row must win;
+ * - re-recording an existing `old_id` re-points it (`ON CONFLICT DO UPDATE`),
+ *   so an ID renamed A→B→C resolves A→C in one hop rather than a chain.
+ *
+ * @param db - Database instance (caller supplies the transaction, if any)
+ * @param oldId - The ID that is being retired
+ * @param worktreeId - The ID it should resolve to from now on
+ * @param now - Timestamp in epoch milliseconds
+ */
+function recordWorktreeAlias(db, oldId, worktreeId, now = Date.now()) {
+    // The statements live in `migrations/worktree-id-rename.ts`: the rename that
+    // records the alias has to be callable from a migration, and a migration that
+    // imports a `@/lib/db/*` module inherits every `vi.mock` of it in the suite
+    // (Issue #1621, #1645). This function stays the public entry point.
+    (0, worktree_id_rename_1.recordWorktreeAliasRow)(db, oldId, worktreeId, now);
+}
+/**
+ * Resolve an ID that may be historical to the ID that is current.
+ *
+ * Live worktrees win over aliases, always. An ID can be both — a worktree
+ * created at a directory whose basename matches an ID some other worktree used
+ * to have — and in that case the thing that exists now is the answer.
+ *
+ * @param db - Database instance
+ * @param id - A worktree ID as supplied by a URL, a CLI argument, …
+ * @returns The current worktree ID, or `null` when nothing resolves
+ */
+function resolveWorktreeIdWithAlias(db, id) {
+    if (!id)
+        return null;
+    const live = db.prepare('SELECT 1 FROM worktrees WHERE id = ?').get(id);
+    if (live)
+        return id;
+    if (!hasAliasTable(db))
+        return null;
+    const row = db
+        .prepare('SELECT worktree_id FROM worktree_aliases WHERE old_id = ?')
+        .get(id);
+    if (!row)
+        return null;
+    // An alias pointing at a worktree that is gone is not a redirect, it is a
+    // dangling row (only reachable if foreign keys were off when it was deleted).
+    const target = db.prepare('SELECT 1 FROM worktrees WHERE id = ?').get(row.worktree_id);
+    return target ? row.worktree_id : null;
+}
+/**
+ * Every historical ID recorded for one worktree, newest first.
+ *
+ * @param db - Database instance
+ * @param worktreeId - Current worktree ID
+ */
+function getWorktreeAliases(db, worktreeId) {
+    if (!hasAliasTable(db))
+        return [];
+    const rows = db
+        .prepare(`SELECT old_id, worktree_id, created_at
+       FROM worktree_aliases
+       WHERE worktree_id = ?
+       ORDER BY created_at DESC, old_id ASC`)
+        .all(worktreeId);
+    return rows.map((row) => ({
+        oldId: row.old_id,
+        worktreeId: row.worktree_id,
+        createdAt: row.created_at,
+    }));
+}
+/**
+ * Every alias in the database, oldest first.
+ *
+ * Feeds the startup session reconciliation (Issue #1621 Phase 3/4): each row is
+ * an ID that used to name a worktree, so `mcbd-<cli>-<old_id>` is exactly the
+ * tmux session name a still-running agent may be sitting under. Ordering by
+ * `created_at` makes the pass deterministic; the rename itself is
+ * order-independent because it runs in two stages.
+ *
+ * Returns `[]` rather than throwing when the table has not been created yet, so
+ * a caller on an older database degrades to "nothing to reconcile".
+ *
+ * @param db - Database instance
+ */
+function getAllWorktreeAliases(db) {
+    if (!hasAliasTable(db))
+        return [];
+    const rows = db
+        .prepare(`SELECT old_id, worktree_id, created_at
+       FROM worktree_aliases
+       ORDER BY created_at ASC, old_id ASC`)
+        .all();
+    return rows.map((row) => ({
+        oldId: row.old_id,
+        worktreeId: row.worktree_id,
+        createdAt: row.created_at,
+    }));
+}
+/**
+ * Every ID that is currently answerable as an alias.
+ *
+ * Feeds `deriveWorktreeId`'s taken set: a brand-new worktree must not be minted
+ * an ID that an alias already redirects somewhere else, or the redirect would
+ * be shadowed and one of the two references would start pointing at the wrong
+ * worktree (Issue #1621).
+ *
+ * @param db - Database instance
+ */
+function getAliasedWorktreeIds(db) {
+    if (!hasAliasTable(db))
+        return [];
+    const rows = db.prepare('SELECT old_id FROM worktree_aliases').all();
+    return rows.map((row) => row.old_id);
+}

package/dist/server/src/lib/db/worktree-db.js

@@ -23,12 +23,14 @@ exports.updateVibeLocalContextWindow = updateVibeLocalContextWindow;
 exports.saveInitialBranch = saveInitialBranch;
 exports.getInitialBranch = getInitialBranch;
 exports.getWorktreeIdsByRepository = getWorktreeIdsByRepository;
+exports.getAllWorktreeIds = getAllWorktreeIds;
+exports.getAllWorktreePathIds = getAllWorktreePathIds;
 exports.getWorktreesByRepository = getWorktreesByRepository;
 exports.deleteRepositoryWorktrees = deleteRepositoryWorktrees;
 exports.deleteWorktreesByIds = deleteWorktreesByIds;
 const selected_agents_validator_1 = require("../../lib/selected-agents-validator");
 const chat_db_1 = require("./chat-db");
-const worktree_child_tables_1 = require("./migrations/worktree-child-tables");
+const worktree_id_rename_1 = require("./migrations/worktree-id-rename");
 /**
  * Get latest user message per CLI tool for multiple worktrees (batch query)
  * Optimized to avoid N+1 query problem
@@ -269,80 +271,20 @@ function upsertWorktree(db, worktree) {
     });
     run();
 }
-/**
- * Delete every child row pointing at any of `worktreeIds`.
- *
- * Deliberately covers *all* deletable child tables, not just the FK-less ones:
- * doing so makes deletion correct even when `PRAGMA foreign_keys` is off, and
- * the extra statements against CASCADE tables remove rows that would have been
- * removed anyway. Append-only ledgers are skipped (see getWriteGuardedTables).
- * Must run before the parent row is deleted (Issue #1621).
- */
-function deleteWorktreeChildRows(db, worktreeIds, children = (0, worktree_child_tables_1.getWorktreeChildTables)(db)) {
-    if (worktreeIds.length === 0)
-        return;
-    const { noDelete } = (0, worktree_child_tables_1.getWriteGuardedTables)(db);
-    const placeholders = worktreeIds.map(() => '?').join(',');
-    for (const { table, column } of children) {
-        if (noDelete.has(table))
-            continue;
-        db.prepare(`DELETE FROM "${table}" WHERE "${column}" IN (${placeholders})`).run(...worktreeIds);
-    }
-}
 /**
  * Rename a worktree row's primary key from `oldId` to `newId`, re-pointing every
- * child table's foreign key so no CASCADE deletion occurs. This is what makes a
- * same-directory branch switch preserve chat history and all related data
- * instead of destroying it (Issue #1151).
+ * child table's foreign key so no CASCADE deletion occurs (Issue #1151, #1621).
  *
- * "Every child table" means every table carrying a worktree reference, not just
- * the ones that declare a foreign key: `tasks`, `verification_runs` and
- * `skill_operations` do not, and used to be left addressing an ID that no
- * longer resolves (Issue #1621).
+ * The implementation lives in `migrations/worktree-id-rename.ts` because the
+ * Phase 4 renumbering (#1645) needs it from inside a migration, and a migration
+ * that imports THIS module inherits every `vi.mock('@/lib/db/worktree-db')` in
+ * the suite (measured — see that module's header). This wrapper keeps the
+ * public API and its import path unchanged.
  *
- * Append-only ledgers are the one exception, and the schema states it itself —
- * `skill_operations` aborts any UPDATE (#1234). An immutable audit row records
- * what happened under the identity in force at the time, and rewriting it is
- * precisely what its trigger exists to prevent; attempting it does not fail
- * quietly either, it aborts the enclosing transaction and takes the rename with
- * it (measured). See getWriteGuardedTables.
- *
- * Must be called inside a transaction. `PRAGMA defer_foreign_keys` defers FK
- * enforcement to COMMIT, letting us repoint the parent PK and its children in
- * any order without needing `ON UPDATE CASCADE` on every constraint.
+ * Must be called inside a transaction.
  */
 function migrateWorktreeIdPreservingChildren(db, oldId, newId) {
-    if (oldId === newId)
-        return;
-    const oldExists = db.prepare('SELECT 1 FROM worktrees WHERE id = ?').get(oldId);
-    if (!oldExists)
-        return;
-    // Defer FK checks until COMMIT so the parent PK and child FKs can be updated
-    // independently. Resets automatically at the end of the transaction.
-    db.pragma('defer_foreign_keys = ON');
-    const newExists = db.prepare('SELECT 1 FROM worktrees WHERE id = ?').get(newId);
-    const { noUpdate } = (0, worktree_child_tables_1.getWriteGuardedTables)(db);
-    const allChildren = (0, worktree_child_tables_1.getWorktreeChildTables)(db);
-    const children = allChildren.filter(({ table }) => !noUpdate.has(table));
-    if (newExists) {
-        // Collision guard. `path` is UNIQUE so two rows for the same directory
-        // should never coexist, but if the DB is already inconsistent keep the
-        // destination row's data and fold in the source's non-conflicting children.
-        for (const { table, column } of children) {
-            db.prepare(`UPDATE OR IGNORE "${table}" SET "${column}" = ? WHERE "${column}" = ?`).run(newId, oldId);
-        }
-        // Conflicting leftovers are dropped explicitly rather than left to CASCADE:
-        // tables without a foreign key never cascade, so relying on the parent
-        // delete alone would strand their rows on a dead ID (#1621).
-        deleteWorktreeChildRows(db, [oldId], allChildren);
-        db.prepare('DELETE FROM worktrees WHERE id = ?').run(oldId);
-        return;
-    }
-    // Normal rename: move the parent PK, then repoint all child rows.
-    db.prepare('UPDATE worktrees SET id = ? WHERE id = ?').run(newId, oldId);
-    for (const { table, column } of children) {
-        db.prepare(`UPDATE "${table}" SET "${column}" = ? WHERE "${column}" = ?`).run(newId, oldId);
-    }
+    (0, worktree_id_rename_1.renameWorktreeIdPreservingChildren)(db, oldId, newId);
 }
 /**
  * Update worktree description
@@ -516,6 +458,46 @@ function getWorktreeIdsByRepository(db, repositoryPath) {
     const rows = stmt.all(repositoryPath);
     return rows.map(r => r.id);
 }
+/**
+ * Every worktree ID currently stored, across all repositories.
+ *
+ * Issue #1621: `deriveWorktreeId` mints an ID from a directory's basename, and
+ * two repositories can easily hold same-named directories (`.../a/main`,
+ * `.../b/main`). The ID is the global primary key of `worktrees`, so the
+ * "already taken" set the derivation consults has to be global too;
+ * {@link getWorktreeIdsByRepository} would silently allow a cross-repository
+ * collision, which then surfaces as a UNIQUE(path) failure on upsert.
+ *
+ * @param db - Database instance
+ * @returns Every `worktrees.id` value
+ */
+function getAllWorktreeIds(db) {
+    const rows = db.prepare('SELECT id FROM worktrees').all();
+    return rows.map(row => row.id);
+}
+/**
+ * Every worktree row's `(id, path)` pair, across all repositories.
+ *
+ * The global counterpart of {@link getWorktreesByRepository}, and the difference
+ * matters (Issue #1658): `path` is the identity of a worktree — the column is
+ * `NOT NULL UNIQUE` — whereas `repository_path` merely records which scan root
+ * last upserted the row. When the *same* git repository is registered under two
+ * scan roots (a repo and one of its own linked worktrees, both in
+ * `WORKTREE_REPOS`), `git worktree list` returns the identical path set from
+ * either one, and `repository_path` ping-pongs between them on every sync.
+ * Looking an existing ID up per repository then misses the row half the time and
+ * re-derives its ID, which appends another 8 hex digits — forever.
+ *
+ * Resolving "which ID does this path already own?" must therefore be global.
+ * Pruning stays per-repository ({@link getWorktreesByRepository}): that question
+ * really is scoped to one scan root.
+ *
+ * @param db - Database instance
+ * @returns `{ id, path }` for every worktree row
+ */
+function getAllWorktreePathIds(db) {
+    return db.prepare('SELECT id, path FROM worktrees').all();
+}
 /**
  * Get all worktree rows (id + path) for a given repository path.
  *
@@ -553,7 +535,7 @@ function deleteRepositoryWorktrees(db, repositoryPath) {
             .all(repositoryPath)
             .map((row) => row.id)
             .filter((id) => id !== null);
-        deleteWorktreeChildRows(db, ids);
+        (0, worktree_id_rename_1.deleteWorktreeChildRows)(db, ids);
         return db
             .prepare('DELETE FROM worktrees WHERE repository_path = ?')
             .run(repositoryPath).changes;
@@ -578,7 +560,7 @@ function deleteWorktreesByIds(db, worktreeIds) {
     }
     const placeholders = worktreeIds.map(() => '?').join(',');
     const run = db.transaction(() => {
-        deleteWorktreeChildRows(db, worktreeIds);
+        (0, worktree_id_rename_1.deleteWorktreeChildRows)(db, worktreeIds);
         return db
             .prepare(`DELETE FROM worktrees WHERE id IN (${placeholders})`)
             .run(...worktreeIds).changes;

package/dist/server/src/lib/detection/cli-patterns.js

@@ -4,7 +4,8 @@
  * Shared between response-poller.ts and API routes
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CLAUDE_SESSION_ERROR_REGEX_PATTERNS = exports.CLAUDE_SESSION_ERROR_PATTERNS = exports.extractAnsiSequences = exports.stripAnsi = exports.ANTIGRAVITY_SKIP_PATTERNS = exports.ANTIGRAVITY_SELECTION_LIST_PATTERN = exports.ANTIGRAVITY_SEPARATOR_PATTERN = exports.ANTIGRAVITY_THINKING_PATTERN = exports.ANTIGRAVITY_PROMPT_PATTERN = exports.VIBE_LOCAL_THINKING_PATTERN = exports.VIBE_LOCAL_PROMPT_PATTERN = exports.COPILOT_SKIP_PATTERNS = exports.COPILOT_SELECTION_LIST_PATTERN = exports.COPILOT_SEPARATOR_PATTERN = exports.COPILOT_THINKING_PATTERN = exports.COPILOT_PROMPT_PATTERN = exports.OPENCODE_SKIP_PATTERNS = exports.OPENCODE_SEPARATOR_PATTERN = exports.CLAUDE_SELECTION_LIST_FOOTER = exports.CLAUDE_MODEL_OVERLAY_FOOTER_PATTERN = exports.OPENCODE_SELECTION_LIST_PATTERN = exports.OPENCODE_PROCESSING_INDICATOR = exports.OPENCODE_RESPONSE_COMPLETE = exports.OPENCODE_LOADING_PATTERN = exports.OPENCODE_THINKING_PATTERN = exports.OPENCODE_PROMPT_AFTER_RESPONSE = exports.OPENCODE_PROMPT_PATTERN = exports.GEMINI_THINKING_PATTERN = exports.GEMINI_PROMPT_PATTERN = exports.MAX_PASTED_TEXT_RETRIES = exports.PASTED_TEXT_DETECT_DELAY = exports.PASTED_TEXT_PATTERN = exports.CODEX_STATUS_BAR_PATTERN = exports.CODEX_PAGER_FOOTER_PATTERN = exports.CODEX_APPROVAL_FOOTER_PATTERN = exports.CODEX_SELECTION_LIST_PATTERN = exports.CODEX_SEPARATOR_PATTERN = exports.CODEX_DIALOG_PATTERN = exports.CODEX_PROMPT_PATTERN = exports.CLAUDE_TRUST_DIALOG_PATTERN = exports.CLAUDE_SEPARATOR_PATTERN = exports.CLAUDE_PROMPT_PATTERN = exports.CODEX_THINKING_PATTERN = exports.CLAUDE_INTERRUPT_HINT_PATTERN = exports.CLAUDE_THINKING_PATTERN = exports.CLAUDE_SPINNER_CHARS = void 0;
+exports.CLAUDE_SESSION_ERROR_REGEX_PATTERNS = exports.CLAUDE_SESSION_ERROR_PATTERNS = exports.extractAnsiSequences = exports.stripAnsi = exports.ANTIGRAVITY_SKIP_PATTERNS = exports.ANTIGRAVITY_SELECTION_LIST_PATTERN = exports.ANTIGRAVITY_SEPARATOR_PATTERN = exports.ANTIGRAVITY_THINKING_PATTERN = exports.ANTIGRAVITY_PROMPT_PATTERN = exports.VIBE_LOCAL_THINKING_PATTERN = exports.VIBE_LOCAL_PROMPT_PATTERN = exports.COPILOT_SKIP_PATTERNS = exports.COPILOT_SELECTION_LIST_PATTERN = exports.COPILOT_SEPARATOR_PATTERN = exports.COPILOT_THINKING_PATTERN = exports.COPILOT_PROMPT_PATTERN = exports.OPENCODE_SKIP_PATTERNS = exports.OPENCODE_SEPARATOR_PATTERN = exports.CLAUDE_SELECTION_LIST_FOOTER = exports.CLAUDE_MODEL_OVERLAY_FOOTER_PATTERN = exports.OPENCODE_SELECTION_LIST_PATTERN = exports.OPENCODE_PROCESSING_INDICATOR = exports.OPENCODE_RESPONSE_COMPLETE = exports.OPENCODE_LOADING_PATTERN = exports.OPENCODE_THINKING_PATTERN = exports.OPENCODE_PROMPT_AFTER_RESPONSE = exports.OPENCODE_PROMPT_PATTERN = exports.GEMINI_THINKING_PATTERN = exports.GEMINI_PROMPT_PATTERN = exports.MAX_PASTED_TEXT_RETRIES = exports.PASTED_TEXT_DETECT_DELAY = exports.PASTED_TEXT_PATTERN = exports.CODEX_STATUS_BAR_PATTERN = exports.CODEX_PAGER_FOOTER_PATTERN = exports.CODEX_APPROVAL_FOOTER_PATTERN = exports.CODEX_SELECTION_LIST_PATTERN = exports.CODEX_SEPARATOR_PATTERN = exports.CODEX_DIALOG_PATTERN = exports.CODEX_PROMPT_PATTERN = exports.CLAUDE_TRUST_DIALOG_PATTERN = exports.CLAUDE_SEPARATOR_PATTERN = exports.CLAUDE_PROMPT_PATTERN = exports.CODEX_INTERRUPT_HINT_PATTERN = exports.CODEX_THINKING_PATTERN = exports.CLAUDE_INTERRUPT_HINT_PATTERN = exports.CLAUDE_THINKING_PATTERN = exports.CLAUDE_SPINNER_CHARS = void 0;
+exports.isCodexTurnActive = isCodexTurnActive;
 exports.findClaudeChromeStart = findClaudeChromeStart;
 exports.isCodexPromptReady = isCodexPromptReady;
 exports.getCodexActiveDialog = getCodexActiveDialog;
@@ -14,6 +15,7 @@ exports.stripBoxDrawing = stripBoxDrawing;
 exports.buildDetectPromptOptions = buildDetectPromptOptions;
 const logger_1 = require("../../lib/logger");
 const ansi_1 = require("./ansi");
+const thinking_constants_1 = require("../../config/thinking-constants");
 const logger = (0, logger_1.createLogger)('cli-patterns');
 /**
  * Claude CLI spinner characters (expanded set)
@@ -56,11 +58,93 @@ exports.CLAUDE_THINKING_PATTERN = new RegExp(`[${exports.CLAUDE_SPINNER_CHARS.jo
  */
 exports.CLAUDE_INTERRUPT_HINT_PATTERN = /esc to interrupt/;
 /**
- * Codex thinking pattern
+ * Codex activity-marker pattern
  * Matches activity indicators like "• Planning", "• Searching", etc.
  * T1.1: Extended to include "Ran" and "Deciding"
+ *
+ * Issue #1671: these are *transcript records*, not a liveness signal. Codex is
+ * inline-rendered (no alternate screen), so every "• Ran <cmd>" / "• Running
+ * <cmd>" step it ever printed stays in the pane scrollback forever — measured on
+ * a live `mcbd-codex-*` pane: 396 "• Ran" and 11 "• Running" rows, all of them
+ * from finished steps. Matching this pattern against a fixed tail window
+ * therefore answers "did a step happen recently", not "is Codex working now".
+ * Use {@link isCodexTurnActive} for the latter.
  */
 exports.CODEX_THINKING_PATTERN = /•\s*(Planning|Searching|Exploring|Running|Thinking|Working|Reading|Writing|Analyzing|Ran|Deciding)/m;
+/**
+ * Codex live status-line hint (Issue #1671)
+ *
+ * While a turn is in flight Codex pins a status row directly above the composer:
+ *
+ *     • Working (13s • esc to interrupt) · 1 background terminal running · /ps to view
+ *
+ * It is repainted in place every tick and erased the moment the turn ends, so —
+ * unlike the "• Ran"/"• Running" step records — it never lingers in scrollback.
+ * Measured on a 11,000-line capture of an idle Codex pane: zero occurrences of
+ * "esc to interrupt", against 396 lingering "• Ran" rows. That makes it the one
+ * unambiguous "Codex is still generating" token, mirroring Claude's
+ * {@link CLAUDE_INTERRUPT_HINT_PATTERN}.
+ */
+exports.CODEX_INTERRUPT_HINT_PATTERN = /esc to interrupt/;
+/**
+ * How far above the last content row Codex's composer ("› …") may sit.
+ *
+ * Codex pins the composer and the status bar to the bottom of the pane, so the
+ * composer lands 2-3 rows above the last non-blank row in every observed frame.
+ * The small allowance keeps the search from walking up into the transcript and
+ * latching onto the echoed user message, which uses the same "› " marker.
+ */
+const CODEX_COMPOSER_SEARCH_ROWS = 8;
+/**
+ * Decide whether a Codex turn is still in flight (Issue #1671).
+ *
+ * Completion detection used to answer this with {@link CODEX_THINKING_PATTERN}
+ * over a fixed 20-row tail. Because "• Ran <cmd>" is a *past-tense record* that
+ * never leaves the transcript, a turn that ended with a short final message kept
+ * that record inside the tail window and was reported as "still thinking"
+ * forever — so its reply was never saved, while a turn whose final message
+ * happened to be longer than 20 rows pushed the record out of the window and was
+ * saved. Whether a reply reached Message History depended on how long it was.
+ *
+ * Two signals, both measured against live codex-cli 0.146.0 captures:
+ *
+ * 1. The live status line ({@link CODEX_INTERRUPT_HINT_PATTERN}) anywhere in the
+ *    tail window. Present in every generating frame from 1s onwards, absent from
+ *    every idle frame.
+ * 2. An activity marker in the rows immediately above the composer — the band
+ *    Codex reserves for that status line. Version-agnostic backstop for a Codex
+ *    build whose status row drops the "esc to interrupt" wording; deliberately
+ *    narrow (THINKING_TAIL_LINE_COUNT rows, matching the window status-detector
+ *    already uses) so records further up the transcript cannot reach it.
+ *
+ * When no composer can be located the frame is not a normal Codex layout (an
+ * overlay is up, or the pane is mid-redraw), so signal 2 falls back to the whole
+ * tail window — the pre-#1671 behaviour, which errs towards "still active".
+ *
+ * @param lines - Captured pane lines with trailing blank rows already trimmed
+ * @param tailLineCount - Size of the tail window completion detection looks at
+ * @returns True while Codex is still generating
+ */
+function isCodexTurnActive(lines, tailLineCount) {
+    const tailWindow = (0, ansi_1.stripAnsi)(lines.slice(Math.max(0, lines.length - tailLineCount)).join('\n'));
+    // 1. Live status line — unambiguous, never survives the end of a turn.
+    if (exports.CODEX_INTERRUPT_HINT_PATTERN.test(tailWindow))
+        return true;
+    // 2. Activity marker in the status-line band directly above the composer.
+    //    Searched bottom-up so the composer wins over the echoed user message.
+    let composerIndex = -1;
+    for (let i = lines.length - 1; i >= Math.max(0, lines.length - CODEX_COMPOSER_SEARCH_ROWS); i--) {
+        if (exports.CODEX_PROMPT_PATTERN.test((0, ansi_1.stripAnsi)(lines[i]))) {
+            composerIndex = i;
+            break;
+        }
+    }
+    if (composerIndex < 0)
+        return exports.CODEX_THINKING_PATTERN.test(tailWindow);
+    const bandStart = Math.max(0, composerIndex - thinking_constants_1.THINKING_TAIL_LINE_COUNT + 1);
+    const band = (0, ansi_1.stripAnsi)(lines.slice(bandStart, composerIndex + 1).join('\n'));
+    return exports.CODEX_THINKING_PATTERN.test(band);
+}
 /**
  * Claude prompt pattern (waiting for input)
  * Supports both legacy '>' and new '❯' (U+276F) prompt characters

package/dist/server/src/lib/detection/prompt-detect-multiple-choice.js

@@ -783,7 +783,16 @@ function detectMultipleChoicePrompt(output, options, truncateRawContentFn) {
     // Layer 5 [SEC-001]: Enhanced question line validation for requireDefaultIndicator=false.
     // When requireDefault is false, apply stricter validation to prevent false positives
     // from normal numbered lists (e.g., "Recommendations:\n1. Add tests\n2. Update docs").
-    if (!requireDefault) {
+    //
+    // [Issue #1676] Frames where a ❯/●/› default indicator was actually collected are
+    // exempt from Layer 5: the cursor existence check (Layer 2 semantics) is the same
+    // false-positive defense that requireDefaultIndicator=true tools (codex/gemini)
+    // rely on without any question-line validation. This lets declarative permission
+    // dialogs with no question line ("Claude in Chrome wants to run JavaScript on …"
+    // + ❯ 1. Allow / 2. … / 3. Deny) and imperative AskUserQuestion headers
+    // (「実装方針を選んでください」) be detected. Indicator-less frames (#193 capture
+    // artifacts) still go through SEC-001a/b unchanged.
+    if (!requireDefault && !hasDefaultIndicator) {
         // SEC-001a: No question line found (questionEndIndex === -1) - reject.
         // Prevents generic question fallback from triggering Auto-Yes
         // on plain numbered lists that happen to be consecutive from 1.

package/dist/server/src/lib/git/worktree-id.js

@@ -0,0 +1,145 @@
+"use strict";
+/**
+ * Minting a worktree ID from its directory — the pure half of Issue #1621.
+ *
+ * Split out of `worktrees.ts` for one reason: a **migration** has to mint IDs
+ * (the Phase 4 renumbering in #1645), and `worktrees.ts` imports `@/lib/db`,
+ * which re-exports `db-migrations` — importing it from a migration closes a
+ * cycle. It also drags every `vi.mock('@/lib/git/worktrees')` in the suite into
+ * `runMigrations`, which is exactly how v52 was made to throw before it was
+ * moved (see `migrations/worktree-child-tables.ts`).
+ *
+ * This module imports nothing but `crypto` and `path`, so it is safe from both
+ * directions.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FALLBACK_ID_BASE = void 0;
+exports.sanitizeIdSegment = sanitizeIdSegment;
+exports.deriveWorktreeId = deriveWorktreeId;
+exports.isDerivedWorktreeId = isDerivedWorktreeId;
+const crypto_1 = require("crypto");
+const path_1 = __importDefault(require("path"));
+/**
+ * Lower-case, URL- and shell-safe slug of one identifier segment.
+ *
+ * Kept byte-identical to the rule the branch-derived `generateWorktreeId` has
+ * always used so the path-derived scheme produces IDs from the same alphabet:
+ * lower-case, `[^a-z0-9-]` collapsed to `-`, runs of `-` compressed, edges
+ * trimmed. The result always satisfies `isValidWorktreeId`.
+ */
+function sanitizeIdSegment(str) {
+    return str
+        .toLowerCase()
+        .replace(/[^a-z0-9-]/g, '-') // Replace non-alphanumeric (except hyphen) with hyphen
+        .replace(/-+/g, '-') // Replace consecutive hyphens with single hyphen
+        .replace(/^-|-$/g, ''); // Remove leading/trailing hyphens
+}
+/**
+ * Base used when a directory name sanitizes to the empty string (`/`, `///`,
+ * a name made entirely of separators…). Without it the ID would be `''`, which
+ * `isValidWorktreeId` rejects and SQLite would happily store.
+ */
+exports.FALLBACK_ID_BASE = 'worktree';
+/**
+ * Mint the ID for a worktree that has never been registered before.
+ *
+ * The ID is a function of the **directory**, never of the branch, and — this is
+ * the part that actually buys stability — it is computed **once**, at first
+ * registration. `syncWorktreesToDB` looks an existing row up by path and keeps
+ * whatever ID that row already carries, so this function is only reached for a
+ * genuinely new path. A worktree's ID therefore survives every branch switch,
+ * every detached-HEAD commit, and any future change to the rule below.
+ *
+ * Rule (Issue #1621):
+ *
+ *     id = sanitize(basename(resolvedPath))
+ *     on collision only: `${id}-${sha256(resolvedPath).slice(0, 8)}`
+ *
+ * `takenIds` must contain every ID that is already spoken for — worktree rows
+ * across *all* repositories (the ID is a global primary key, not a per-repo one)
+ * plus historical IDs still resolvable as aliases, so a fresh worktree can never
+ * shadow an old ID that redirects somewhere else.
+ *
+ * Deterministic: same `(resolvedPath, takenIds)` always yields the same ID.
+ *
+ * @param resolvedPath - Absolute, `path.resolve()`d worktree directory
+ * @param takenIds - IDs that are unavailable
+ * @returns A URL-safe ID satisfying `isValidWorktreeId`
+ *
+ * @example
+ * ```typescript
+ * deriveWorktreeId('/repos/commandmate-issue-1644', []) // => 'commandmate-issue-1644'
+ * deriveWorktreeId('/b/main', ['main'])                 // => 'main-3f2a91cc'
+ * ```
+ */
+function deriveWorktreeId(resolvedPath, takenIds = []) {
+    const taken = takenIds instanceof Set ? takenIds : new Set(takenIds);
+    const base = sanitizeIdSegment(path_1.default.basename(resolvedPath)) || exports.FALLBACK_ID_BASE;
+    if (!taken.has(base)) {
+        return base;
+    }
+    // Collision. Disambiguate with a digest of the path itself (not a counter):
+    // the result stays a pure function of the directory, so re-deriving the same
+    // path against the same set never produces a second, different ID.
+    const digest = (0, crypto_1.createHash)('sha256').update(resolvedPath).digest('hex');
+    for (let length = 8; length <= digest.length; length += 8) {
+        const candidate = `${base}-${digest.slice(0, length)}`;
+        if (!taken.has(candidate)) {
+            return candidate;
+        }
+    }
+    // Unreachable short of a full SHA-256 collision on two different paths with
+    // the same basename; kept so the function is total rather than returning a
+    // duplicate ID and violating the worktrees PK.
+    for (let ordinal = 2;; ordinal++) {
+        const candidate = `${base}-${digest}-${ordinal}`;
+        if (!taken.has(candidate)) {
+            return candidate;
+        }
+    }
+}
+/**
+ * Whether `id` is one that {@link deriveWorktreeId} could have minted for
+ * `resolvedPath` — i.e. the basename, or the basename followed by a prefix of
+ * the path's SHA-256 in 8-hex steps.
+ *
+ * The inverse of the derivation, and it exists to tell two kinds of retired ID
+ * apart (Issue #1658). When the same directory was re-derived over and over, it
+ * left a ladder of aliases — `foo`, `foo-2f4530fe`, `foo-2f4530fe1cf1f9f8`, … —
+ * every rung pointing at the same worktree, none of them ever handed out for
+ * longer than the second it took the next sync to replace it. Those are safe to
+ * discard, and must be, because the minter treats an alias as taken and the
+ * ladder would otherwise reserve those IDs forever. An ID like
+ * `commandagent-develop-develop` — a genuine former name, from the
+ * branch-derived scheme — is not of this shape and is kept.
+ *
+ * Note this is a statement about *shape*, not about history: an ID that happens
+ * to match is one this path would produce today.
+ *
+ * @param id - Candidate ID
+ * @param resolvedPath - Absolute, `path.resolve()`d worktree directory
+ */
+function isDerivedWorktreeId(id, resolvedPath) {
+    if (!id)
+        return false;
+    const base = sanitizeIdSegment(path_1.default.basename(resolvedPath)) || exports.FALLBACK_ID_BASE;
+    if (id === base)
+        return true;
+    if (!id.startsWith(`${base}-`))
+        return false;
+    const suffix = id.slice(base.length + 1);
+    const digest = (0, crypto_1.createHash)('sha256').update(resolvedPath).digest('hex');
+    // The collision ladder: 8 hex digits at a time, always a prefix of the digest.
+    if (suffix.length > 0 &&
+        suffix.length % 8 === 0 &&
+        suffix.length <= digest.length &&
+        digest.startsWith(suffix)) {
+        return true;
+    }
+    // The exhausted-digest tail (`<digest>-<ordinal>`), unreachable short of a
+    // SHA-256 collision but part of the function's range all the same.
+    return /^-[0-9]+$/.test(suffix.slice(digest.length)) && suffix.startsWith(digest);
+}