commandmate 0.20.0 → 0.21.1

package/.next/types/routes.d.ts

@@ -2,7 +2,7 @@
 // Do not edit this file manually
 
 type AppRoutes = "/" | "/chat" | "/login" | "/more" | "/offline" | "/repositories" | "/review" | "/sessions" | "/skills" | "/skills/[skillId]" | "/skills/installed" | "/worktrees/[id]" | "/worktrees/[id]/files/[...path]" | "/worktrees/[id]/terminal"
-type AppRouteHandlerRoutes = "/api/app/update" | "/api/app/update-check" | "/api/assistant/conversation" | "/api/assistant/current-output" | "/api/assistant/messages" | "/api/assistant/session" | "/api/assistant/start" | "/api/assistant/terminal" | "/api/assistant/tools" | "/api/auth/login" | "/api/auth/logout" | "/api/auth/status" | "/api/daily-summary" | "/api/daily-summary/status" | "/api/external-apps" | "/api/external-apps/[id]" | "/api/external-apps/[id]/health" | "/api/fs/browse" | "/api/fs/recent-paths" | "/api/hooks/agent-event" | "/api/hooks/claude-done" | "/api/metrics/vibe" | "/api/ollama/models" | "/api/push/subscriptions" | "/api/push/vapid" | "/api/repositories" | "/api/repositories/[id]" | "/api/repositories/[id]/todos" | "/api/repositories/[id]/todos/[todoId]" | "/api/repositories/clone" | "/api/repositories/clone/[jobId]" | "/api/repositories/excluded" | "/api/repositories/restore" | "/api/repositories/scan" | "/api/repositories/sync" | "/api/repositories/validate-path" | "/api/sidebar/group-order" | "/api/skills" | "/api/skills/[id]" | "/api/skills/installations" | "/api/skills/operations" | "/api/skills/reindex" | "/api/slash-commands" | "/api/tasks/[taskId]" | "/api/tasks/[taskId]/cancel" | "/api/templates" | "/api/templates/[id]" | "/api/todos" | "/api/verification/runs" | "/api/verification/runs/[runId]" | "/api/worktrees" | "/api/worktrees/[id]" | "/api/worktrees/[id]/auto-yes" | "/api/worktrees/[id]/capture" | "/api/worktrees/[id]/cli-tool" | "/api/worktrees/[id]/cmate/schedules" | "/api/worktrees/[id]/current-output" | "/api/worktrees/[id]/execution-logs" | "/api/worktrees/[id]/execution-logs/[logId]" | "/api/worktrees/[id]/files/[...path]" | "/api/worktrees/[id]/git/branch/create" | "/api/worktrees/[id]/git/branch/delete" | "/api/worktrees/[id]/git/branches" | "/api/worktrees/[id]/git/checkout" | "/api/worktrees/[id]/git/commit" | "/api/worktrees/[id]/git/diff" | "/api/worktrees/[id]/git/fetch" | "/api/worktrees/[id]/git/log" | "/api/worktrees/[id]/git/pull" | "/api/worktrees/[id]/git/push" | "/api/worktrees/[id]/git/reset" | "/api/worktrees/[id]/git/revert" | "/api/worktrees/[id]/git/show/[commitHash]" | "/api/worktrees/[id]/git/stage" | "/api/worktrees/[id]/git/staged" | "/api/worktrees/[id]/git/stash" | "/api/worktrees/[id]/git/stash/[index]" | "/api/worktrees/[id]/git/stash/apply" | "/api/worktrees/[id]/git/stash/pop" | "/api/worktrees/[id]/git/stash/push" | "/api/worktrees/[id]/git/status" | "/api/worktrees/[id]/git/unstage" | "/api/worktrees/[id]/git/working-diff" | "/api/worktrees/[id]/interrupt" | "/api/worktrees/[id]/kill-session" | "/api/worktrees/[id]/logs" | "/api/worktrees/[id]/logs/[filename]" | "/api/worktrees/[id]/marp-render" | "/api/worktrees/[id]/memos" | "/api/worktrees/[id]/memos/[memoId]" | "/api/worktrees/[id]/messages" | "/api/worktrees/[id]/prompt-response" | "/api/worktrees/[id]/respond" | "/api/worktrees/[id]/schedules" | "/api/worktrees/[id]/schedules/[scheduleId]" | "/api/worktrees/[id]/schedules/active" | "/api/worktrees/[id]/search" | "/api/worktrees/[id]/send" | "/api/worktrees/[id]/skills" | "/api/worktrees/[id]/skills/[skillId]/git-workflow" | "/api/worktrees/[id]/skills/[skillId]/install" | "/api/worktrees/[id]/skills/[skillId]/plan" | "/api/worktrees/[id]/skills/[skillId]/uninstall" | "/api/worktrees/[id]/skills/[skillId]/uninstall-plan" | "/api/worktrees/[id]/slash-commands" | "/api/worktrees/[id]/special-keys" | "/api/worktrees/[id]/start-polling" | "/api/worktrees/[id]/tasks" | "/api/worktrees/[id]/terminal" | "/api/worktrees/[id]/timers" | "/api/worktrees/[id]/timers/history" | "/api/worktrees/[id]/todos" | "/api/worktrees/[id]/todos/[todoId]" | "/api/worktrees/[id]/tree" | "/api/worktrees/[id]/tree/[...path]" | "/api/worktrees/[id]/upload/[...path]" | "/api/worktrees/[id]/verify" | "/api/worktrees/[id]/verify/runs" | "/api/worktrees/[id]/verify/runs/[runId]" | "/api/worktrees/[id]/viewed" | "/proxy/[...path]"
+type AppRouteHandlerRoutes = "/api/app/update" | "/api/app/update-check" | "/api/assistant/conversation" | "/api/assistant/current-output" | "/api/assistant/messages" | "/api/assistant/session" | "/api/assistant/start" | "/api/assistant/terminal" | "/api/assistant/tools" | "/api/auth/login" | "/api/auth/logout" | "/api/auth/status" | "/api/daily-summary" | "/api/daily-summary/status" | "/api/external-apps" | "/api/external-apps/[id]" | "/api/external-apps/[id]/health" | "/api/fs/browse" | "/api/fs/recent-paths" | "/api/hooks/agent-event" | "/api/hooks/claude-done" | "/api/metrics/vibe" | "/api/ollama/models" | "/api/push/subscriptions" | "/api/push/vapid" | "/api/repositories" | "/api/repositories/[id]" | "/api/repositories/[id]/todos" | "/api/repositories/[id]/todos/[todoId]" | "/api/repositories/clone" | "/api/repositories/clone/[jobId]" | "/api/repositories/excluded" | "/api/repositories/restore" | "/api/repositories/scan" | "/api/repositories/sync" | "/api/repositories/validate-path" | "/api/sidebar/group-order" | "/api/skills" | "/api/skills/[id]" | "/api/skills/installations" | "/api/skills/operations" | "/api/skills/reindex" | "/api/slash-commands" | "/api/tasks/[taskId]" | "/api/tasks/[taskId]/cancel" | "/api/templates" | "/api/templates/[id]" | "/api/todos" | "/api/verification/runs" | "/api/verification/runs/[runId]" | "/api/worktrees" | "/api/worktrees/[id]" | "/api/worktrees/[id]/auto-yes" | "/api/worktrees/[id]/capture" | "/api/worktrees/[id]/cli-tool" | "/api/worktrees/[id]/cmate/schedules" | "/api/worktrees/[id]/current-output" | "/api/worktrees/[id]/execution-logs" | "/api/worktrees/[id]/execution-logs/[logId]" | "/api/worktrees/[id]/files/[...path]" | "/api/worktrees/[id]/git/branch/create" | "/api/worktrees/[id]/git/branch/delete" | "/api/worktrees/[id]/git/branches" | "/api/worktrees/[id]/git/checkout" | "/api/worktrees/[id]/git/commit" | "/api/worktrees/[id]/git/diff" | "/api/worktrees/[id]/git/fetch" | "/api/worktrees/[id]/git/log" | "/api/worktrees/[id]/git/pull" | "/api/worktrees/[id]/git/push" | "/api/worktrees/[id]/git/reset" | "/api/worktrees/[id]/git/revert" | "/api/worktrees/[id]/git/show/[commitHash]" | "/api/worktrees/[id]/git/stage" | "/api/worktrees/[id]/git/staged" | "/api/worktrees/[id]/git/stash" | "/api/worktrees/[id]/git/stash/[index]" | "/api/worktrees/[id]/git/stash/apply" | "/api/worktrees/[id]/git/stash/pop" | "/api/worktrees/[id]/git/stash/push" | "/api/worktrees/[id]/git/status" | "/api/worktrees/[id]/git/unstage" | "/api/worktrees/[id]/git/working-diff" | "/api/worktrees/[id]/interrupt" | "/api/worktrees/[id]/kill-session" | "/api/worktrees/[id]/logs" | "/api/worktrees/[id]/logs/[filename]" | "/api/worktrees/[id]/marp-render" | "/api/worktrees/[id]/memos" | "/api/worktrees/[id]/memos/[memoId]" | "/api/worktrees/[id]/messages" | "/api/worktrees/[id]/prompt-response" | "/api/worktrees/[id]/respond" | "/api/worktrees/[id]/schedules" | "/api/worktrees/[id]/schedules/[scheduleId]" | "/api/worktrees/[id]/schedules/active" | "/api/worktrees/[id]/search" | "/api/worktrees/[id]/send" | "/api/worktrees/[id]/skills" | "/api/worktrees/[id]/skills/[skillId]/git-workflow" | "/api/worktrees/[id]/skills/[skillId]/install" | "/api/worktrees/[id]/skills/[skillId]/plan" | "/api/worktrees/[id]/skills/[skillId]/uninstall" | "/api/worktrees/[id]/skills/[skillId]/uninstall-plan" | "/api/worktrees/[id]/skills/[skillId]/update" | "/api/worktrees/[id]/skills/[skillId]/update-plan" | "/api/worktrees/[id]/slash-commands" | "/api/worktrees/[id]/special-keys" | "/api/worktrees/[id]/start-polling" | "/api/worktrees/[id]/tasks" | "/api/worktrees/[id]/terminal" | "/api/worktrees/[id]/timers" | "/api/worktrees/[id]/timers/history" | "/api/worktrees/[id]/todos" | "/api/worktrees/[id]/todos/[todoId]" | "/api/worktrees/[id]/tree" | "/api/worktrees/[id]/tree/[...path]" | "/api/worktrees/[id]/upload/[...path]" | "/api/worktrees/[id]/verify" | "/api/worktrees/[id]/verify/runs" | "/api/worktrees/[id]/verify/runs/[runId]" | "/api/worktrees/[id]/viewed" | "/proxy/[...path]"
 type PageRoutes = never
 type LayoutRoutes = "/" | "/worktrees/[id]"
 type RedirectRoutes = never
@@ -116,6 +116,8 @@ interface ParamMap {
   "/api/worktrees/[id]/skills/[skillId]/plan": { "id": string; "skillId": string; }
   "/api/worktrees/[id]/skills/[skillId]/uninstall": { "id": string; "skillId": string; }
   "/api/worktrees/[id]/skills/[skillId]/uninstall-plan": { "id": string; "skillId": string; }
+  "/api/worktrees/[id]/skills/[skillId]/update": { "id": string; "skillId": string; }
+  "/api/worktrees/[id]/skills/[skillId]/update-plan": { "id": string; "skillId": string; }
   "/api/worktrees/[id]/slash-commands": { "id": string; }
   "/api/worktrees/[id]/special-keys": { "id": string; }
   "/api/worktrees/[id]/start-polling": { "id": string; }

package/.next/types/validator.ts

@@ -1091,6 +1091,24 @@ type RouteHandlerConfig<Route extends AppRouteHandlerRoutes = AppRouteHandlerRou
   type __Unused = __Check
 }
 
+// Validate ../../src/app/api/worktrees/[id]/skills/[skillId]/update-plan/route.ts
+{
+  type __IsExpected<Specific extends RouteHandlerConfig<"/api/worktrees/[id]/skills/[skillId]/update-plan">> = Specific
+  const handler = {} as typeof import("../../src/app/api/worktrees/[id]/skills/[skillId]/update-plan/route.js")
+  type __Check = __IsExpected<typeof handler>
+  // @ts-ignore
+  type __Unused = __Check
+}
+
+// Validate ../../src/app/api/worktrees/[id]/skills/[skillId]/update/route.ts
+{
+  type __IsExpected<Specific extends RouteHandlerConfig<"/api/worktrees/[id]/skills/[skillId]/update">> = Specific
+  const handler = {} as typeof import("../../src/app/api/worktrees/[id]/skills/[skillId]/update/route.js")
+  type __Check = __IsExpected<typeof handler>
+  // @ts-ignore
+  type __Unused = __Check
+}
+
 // Validate ../../src/app/api/worktrees/[id]/skills/route.ts
 {
   type __IsExpected<Specific extends RouteHandlerConfig<"/api/worktrees/[id]/skills">> = Specific

package/dist/cli/commands/auto-yes.js

@@ -21,7 +21,7 @@ function createAutoYesCommand() {
         .option('--enable', 'Enable auto-yes')
         .option('--disable', 'Disable auto-yes')
         .option('--duration <duration>', `Duration (${duration_constants_1.ALLOWED_DURATIONS.join(', ')})`)
-        .option('--stop-pattern <pattern>', 'Stop pattern (regex, max 500 chars)')
+        .option('--stop-pattern <pattern>', 'Stop pattern (regex, max 500 chars). Matched against terminal output; cannot block commands (build logs mentioning the pattern also trigger it). To suppress auto-responses per command, use the task contract\'s autoYes.denyPatterns')
         .option('--instance <id>', agent_target_options_1.INSTANCE_OPTION_DESCRIPTION)
         .option('--agent <agent>', agent_target_options_1.AGENT_OPTION_DESCRIPTION)
         .option('--token <token>', command_helpers_1.TOKEN_WARNING)

package/dist/cli/commands/capture.d.ts

@@ -2,6 +2,7 @@
  * capture Command - Get current terminal output
  * Issue #518: [DR1-08] Factory pattern
  * Issue #1623: `--pane` reads the raw tmux pane as a transcript (案B)
+ * Issue #1685: `--prompts` lists the resolved-prompt audit trail
  */
 import { Command } from 'commander';
 export declare function createCaptureCommand(): Command;

package/dist/cli/commands/capture.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capture.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/capture.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA8HpC,wBAAgB,oBAAoB,IAAI,OAAO,CA+E9C"}
+{"version":3,"file":"capture.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/capture.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA8OpC,wBAAgB,oBAAoB,IAAI,OAAO,CAkG9C"}

package/dist/cli/commands/capture.js

@@ -3,11 +3,13 @@
  * capture Command - Get current terminal output
  * Issue #518: [DR1-08] Factory pattern
  * Issue #1623: `--pane` reads the raw tmux pane as a transcript (案B)
+ * Issue #1685: `--prompts` lists the resolved-prompt audit trail
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createCaptureCommand = createCaptureCommand;
 const commander_1 = require("commander");
 const types_1 = require("../types");
+const history_display_config_1 = require("../../config/history-display-config");
 const api_client_1 = require("../utils/api-client");
 const command_helpers_1 = require("../utils/command-helpers");
 const cli_tool_ids_1 = require("../config/cli-tool-ids");
@@ -73,6 +75,99 @@ async function resolvePaneCliTool(client, worktreeId, agent, instance) {
     const worktree = await client.get(`/api/worktrees/${worktreeId}`);
     return worktree.cliToolId || 'claude';
 }
+/** Default number of prompts `--prompts` lists (Issue #1685). */
+const DEFAULT_PROMPTS_LIMIT = 20;
+/**
+ * Parse and validate `--limit N` for the `--prompts` listing.
+ *
+ * @param raw - Raw option value, if the user passed one
+ * @returns The parsed count (defaults to {@link DEFAULT_PROMPTS_LIMIT})
+ */
+function parsePromptsLimit(raw) {
+    if (raw === undefined)
+        return DEFAULT_PROMPTS_LIMIT;
+    const value = Number(raw);
+    if (!Number.isInteger(value) || value < 1 || value > history_display_config_1.MAX_MESSAGES_LIMIT) {
+        console.error(`Error: --limit must be an integer between 1 and ${history_display_config_1.MAX_MESSAGES_LIMIT}.`);
+        process.exit(types_1.ExitCode.CONFIG_ERROR);
+    }
+    return value;
+}
+/**
+ * Render one prompt option for the text listing. Handles both the
+ * multiple-choice object shape ({number, label, isDefault}) and plain strings
+ * (yes_no options).
+ */
+function formatPromptOption(option) {
+    if (option !== null && typeof option === 'object') {
+        const { number: num, label, isDefault } = option;
+        const body = `${num !== undefined ? `${num}) ` : ''}${label ?? ''}`.trim();
+        return isDefault ? `${body} (default)` : body;
+    }
+    return String(option);
+}
+/**
+ * `--prompts` path (Issue #1685): list the resolved-prompt audit trail.
+ *
+ * Reads prompt messages from chat history instead of the live pane, so the
+ * question / options / answer / answeredBy of a prompt Auto-Yes already
+ * resolved remain retrievable after the fact — the case where `wait` never
+ * exited 10 and `capture --json`'s promptData is already null.
+ */
+async function capturePrompts(worktreeId, options) {
+    const client = new api_client_1.ApiClient({ token: options.token });
+    const limit = parsePromptsLimit(options.limit);
+    const query = new URLSearchParams({ messageType: 'prompt', limit: String(limit) });
+    if (options.agent)
+        query.set('cliTool', options.agent);
+    if (options.instance)
+        query.set('instance', options.instance);
+    const messages = await client.get(`/api/worktrees/${worktreeId}/messages?${query.toString()}`);
+    // Defensive: the endpoint already filters, but promptData-less rows would
+    // render as empty entries.
+    const prompts = messages.filter((m) => m.messageType === 'prompt' && m.promptData);
+    if (options.json) {
+        console.log(JSON.stringify({
+            worktreeId,
+            count: prompts.length,
+            prompts: prompts.map((m) => ({
+                id: m.id,
+                timestamp: m.timestamp,
+                cliToolId: m.cliToolId ?? null,
+                instanceId: m.instanceId ?? null,
+                type: m.promptData.type,
+                question: m.promptData.question,
+                options: m.promptData.options ?? null,
+                status: m.promptData.status ?? null,
+                answer: m.promptData.answer ?? null,
+                answeredAt: m.promptData.answeredAt ?? null,
+                answeredBy: m.promptData.answeredBy ?? null,
+                // Issue #1699: what the contract's denyPatterns were judged against.
+                // Null on rows recorded before the field existed.
+                approvalTarget: m.promptData.approvalTarget ?? null,
+            })),
+        }, null, 2));
+        return;
+    }
+    if (prompts.length === 0) {
+        console.log('No prompt history.');
+        return;
+    }
+    const blocks = prompts.map((m) => {
+        const p = m.promptData;
+        const answered = p.status === 'answered';
+        const header = `${m.timestamp}  ${m.cliToolId ?? '-'}/${m.instanceId ?? '-'}  [${answered ? `answered:${p.answeredBy ?? 'unknown'}` : 'pending'}]`;
+        const lines = [header, `  Q: ${p.question}`];
+        if (Array.isArray(p.options) && p.options.length > 0) {
+            lines.push(`  options: ${p.options.map(formatPromptOption).join('  ')}`);
+        }
+        if (answered) {
+            lines.push(`  A: ${p.answer ?? '-'}${p.answeredAt ? `  (${p.answeredAt})` : ''}`);
+        }
+        return lines.join('\n');
+    });
+    console.log(blocks.join('\n'));
+}
 /**
  * `--pane` path: read the raw tmux pane and render it as a readable transcript.
  *
@@ -117,6 +212,9 @@ function createCaptureCommand() {
         .option('--pane', 'Read the raw tmux pane as a transcript, with blank layout rows squeezed')
         .option('--tail <n>', 'With --pane: keep only the last N lines OF THE SQUEEZED transcript')
         .option('--raw', 'With --pane: skip the squeeze and print the pane verbatim')
+        // Issue #1685: audit trail of resolved prompts (question/options/answer/answeredBy)
+        .option('--prompts', 'List recent prompts from chat history (including ones Auto-Yes already resolved)')
+        .option('--limit <n>', `With --prompts: number of most recent prompts to list (default ${DEFAULT_PROMPTS_LIMIT})`)
         .option('--instance <id>', agent_target_options_1.INSTANCE_OPTION_DESCRIPTION)
         .option('--agent <agent>', agent_target_options_1.AGENT_OPTION_DESCRIPTION)
         .option('--token <token>', command_helpers_1.TOKEN_WARNING)
@@ -142,6 +240,20 @@ function createCaptureCommand() {
                 console.error('Error: --tail and --raw require --pane.');
                 process.exit(types_1.ExitCode.CONFIG_ERROR);
             }
+            // Issue #1685: --prompts reads history, --pane reads the live pane —
+            // asking for both at once has no meaningful answer.
+            if (options.prompts && options.pane) {
+                console.error('Error: --prompts cannot be combined with --pane.');
+                process.exit(types_1.ExitCode.CONFIG_ERROR);
+            }
+            if (!options.prompts && options.limit !== undefined) {
+                console.error('Error: --limit requires --prompts.');
+                process.exit(types_1.ExitCode.CONFIG_ERROR);
+            }
+            if (options.prompts) {
+                await capturePrompts(worktreeId, options);
+                return;
+            }
             if (options.pane) {
                 await capturePane(worktreeId, options);
                 return;

package/dist/cli/commands/respond.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"respond.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/respond.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAUpC,wBAAgB,oBAAoB,IAAI,OAAO,CAyE9C"}
+{"version":3,"file":"respond.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/respond.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAUpC,wBAAgB,oBAAoB,IAAI,OAAO,CAgG9C"}

package/dist/cli/commands/respond.js

@@ -19,7 +19,8 @@ function createRespondCommand() {
     cmd
         .description("Respond to an agent's prompt (yes/no, number, or text)")
         .argument('<worktree-id>', 'Worktree ID')
-        .argument('<answer>', 'Response answer (yes, no, number, or free text)')
+        .argument('[answer]', 'Response answer (yes, no, number, or free text)')
+        .option('--default', "Select the prompt's default option (mutually exclusive with <answer>)")
         .option('--instance <id>', agent_target_options_1.INSTANCE_OPTION_DESCRIPTION)
         .option('--agent <agent>', agent_target_options_1.AGENT_OPTION_DESCRIPTION)
         .option('--token <token>', command_helpers_1.TOKEN_WARNING)
@@ -40,9 +41,14 @@ function createRespondCommand() {
                 console.error('Error: Invalid --instance. Must be an alphanumeric/underscore/hyphen identifier (max 64 chars).');
                 process.exit(types_1.ExitCode.CONFIG_ERROR);
             }
-            // Validate answer is not empty
-            if (!answer.trim()) {
-                console.error('Error: Answer cannot be empty.');
+            // Issue #1681: exactly one of <answer> / --default
+            const useDefault = options.default === true;
+            if (useDefault && answer !== undefined) {
+                console.error('Error: <answer> and --default are mutually exclusive.');
+                process.exit(types_1.ExitCode.CONFIG_ERROR);
+            }
+            if (!useDefault && (answer === undefined || !answer.trim())) {
+                console.error('Error: Answer cannot be empty. Provide an answer or --default.');
                 process.exit(types_1.ExitCode.CONFIG_ERROR);
             }
             const client = new api_client_1.ApiClient({ token: options.token });
@@ -54,7 +60,7 @@ function createRespondCommand() {
                 ? await (0, instances_1.resolveInstanceCliTool)(client, worktreeId, options.instance, options.agent)
                 : options.agent;
             // [DR2-06] Use prompt-response API with cliTool (not cliToolId)
-            const body = { answer };
+            const body = useDefault ? { useDefault: true } : { answer };
             if (agent) {
                 body.cliTool = agent;
             }
@@ -66,9 +72,28 @@ function createRespondCommand() {
             if (result && !result.success) {
                 // [DR2-06] Check reason for failure
                 const reason = result.reason || 'unknown';
-                console.error(`Warning: Response may not have been applied. Reason: ${reason}`);
+                if (reason === 'unresolvable_answer') {
+                    // Issue #1681: nothing was sent to the terminal.
+                    console.error(`Error: Answer was not sent. Reason: ${reason}${result.message ? ` (${result.message})` : ''}`);
+                }
+                else {
+                    console.error(`Warning: Response may not have been applied. Reason: ${reason}`);
+                }
                 process.exit(types_1.ExitCode.UNEXPECTED_ERROR);
             }
+            // Issue #1681: audit trail — print which option was actually selected.
+            const resolved = result?.resolved;
+            if (resolved) {
+                if (resolved.via === 'semantic') {
+                    console.log(`Resolved "${answer}" to option ${resolved.optionNumber}: ${resolved.optionLabel}`);
+                }
+                else if (resolved.optionNumber !== undefined) {
+                    console.log(`Selected default option ${resolved.optionNumber}: ${resolved.optionLabel}`);
+                }
+                else {
+                    console.log(`Selected default answer: ${resolved.optionLabel}`);
+                }
+            }
             console.error('Response sent.');
         }
         catch (error) {

package/dist/cli/commands/send.js

@@ -137,9 +137,9 @@ function createSendCommand() {
         .option('--agent <agent>', agent_target_options_1.AGENT_OPTION_DESCRIPTION)
         .option('--register', 'Register the --instance session into the agent-instance roster (needs --agent unless the instance id is itself a CLI tool id)')
         .option('--model <model>', 'Specify AI model for Copilot or Antigravity agent')
-        .option('--auto-yes', 'Enable auto-yes before sending')
+        .option('--auto-yes', 'Enable auto-yes before sending (session-wide, no policy guard; for unattended runs prefer --contract with an autoYes policy)')
         .option('--duration <duration>', `Auto-yes duration (${duration_constants_1.ALLOWED_DURATIONS.join(', ')})`)
-        .option('--stop-pattern <pattern>', 'Auto-yes stop pattern (regex)')
+        .option('--stop-pattern <pattern>', 'Auto-yes stop pattern (regex). Matched against terminal output; cannot block commands (use the task contract\'s autoYes.denyPatterns for that)')
         .option('--contract <path>', 'Execution contract path relative to the worktree root (e.g. .commandmate/tasks/my-task.yaml). Records a task and sends the contract preamble plus its goal.')
         .option('--token <token>', command_helpers_1.TOKEN_WARNING)
         .action(async (worktreeId, message, options) => {

package/dist/cli/commands/skill-format.d.ts

@@ -7,7 +7,7 @@
  * Nothing here prints an absolute path, a token or an artifact URL: the API does
  * not serve them, and these functions must not reconstruct them either.
  */
-import type { SkillCatalogMeta, SkillCatalogSummary, SkillInstallPlan, SkillUninstallPlan } from '../types/api-responses';
+import type { SkillCatalogMeta, SkillCatalogSummary, SkillInstallPlan, SkillUninstallPlan, SkillUpdatePlan } from '../types/api-responses';
 /**
  * Freshness notice for a Catalog response, or null when it was confirmed current.
  * Belongs on stderr: it qualifies the listing rather than being part of it.
@@ -23,6 +23,12 @@ export declare function formatSkillDetail(skill: SkillCatalogSummary, version?:
 export declare function formatInstallRoots(roots: readonly string[] | undefined, primary: string): string;
 /** The install preview: what lands, where, at what risk, and what stands in the way. */
 export declare function formatInstallPlan(plan: SkillInstallPlan): string;
+/**
+ * The update preview (Issue #1243): the version move, the security-relevant
+ * differences, the file diff totals, and every reason the update is refused.
+ * Shows the same facts the browser dialog shows, in the same order.
+ */
+export declare function formatUpdatePlan(plan: SkillUpdatePlan): string;
 /** The uninstall preview: what would be deleted, what would stay, and why. */
 export declare function formatUninstallPlan(plan: SkillUninstallPlan): string;
 //# sourceMappingURL=skill-format.d.ts.map

package/dist/cli/commands/skill-format.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill-format.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/skill-format.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,wBAAwB,CAAC;AAgBhC;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAI/E;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,CAatE;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,mBAAmB,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CA2CtF;AAMD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEhG;AAED,wFAAwF;AACxF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CA8ChE;AAED,8EAA8E;AAC9E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,CA2BpE"}
+{"version":3,"file":"skill-format.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/skill-format.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EAChB,MAAM,wBAAwB,CAAC;AAgBhC;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,GAAG,IAAI,CAI/E;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,CAatE;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,mBAAmB,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CA2CtF;AAMD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEhG;AAED,wFAAwF;AACxF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CA8ChE;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,eAAe,GAAG,MAAM,CAwE9D;AAED,8EAA8E;AAC9E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,CA2BpE"}

package/dist/cli/commands/skill-format.js

@@ -14,6 +14,7 @@ exports.formatSkillTable = formatSkillTable;
 exports.formatSkillDetail = formatSkillDetail;
 exports.formatInstallRoots = formatInstallRoots;
 exports.formatInstallPlan = formatInstallPlan;
+exports.formatUpdatePlan = formatUpdatePlan;
 exports.formatUninstallPlan = formatUninstallPlan;
 /** [DR1-08 consistency] Mirrors ls.ts / instances.ts table rendering. */
 function formatTable(headers, rows) {
@@ -133,6 +134,72 @@ function formatInstallPlan(plan) {
     }
     return lines.join('\n');
 }
+/**
+ * The update preview (Issue #1243): the version move, the security-relevant
+ * differences, the file diff totals, and every reason the update is refused.
+ * Shows the same facts the browser dialog shows, in the same order.
+ */
+function formatUpdatePlan(plan) {
+    const { skill, target, update, securityDiff, stats } = plan;
+    const lines = [
+        `Update plan: ${skill.name} (${skill.id}) ${update.fromVersion} -> ${update.toVersion}`,
+        '',
+        `Target:       ${target.repositoryName} / ${target.worktreeName} (${target.worktreeId})`,
+        `Branch:       ${target.branch ?? `(${target.headState})`}${target.workingTreeDirty ? ' [working tree dirty]' : ''}`,
+        `Install root: ${formatInstallRoots(target.installRoots, target.installRoot)}`,
+        `Risk:         ${securityDiff.risk.from.effective} -> ${securityDiff.risk.to.effective}${securityDiff.risk.increased ? ' [RISK INCREASE]' : ''}`,
+        `Compatibility: ${skill.compatibility.commandmate.status} — ${skill.compatibility.commandmate.message}`,
+    ];
+    if (update.latestVersion && update.latestVersion !== update.toVersion) {
+        lines.push(`Newest:       ${update.latestVersion} (not selected)`);
+    }
+    if (securityDiff.permissions.added.length > 0) {
+        lines.push(formatList('Perms added:  ', securityDiff.permissions.added));
+    }
+    if (securityDiff.permissions.removed.length > 0) {
+        lines.push(formatList('Perms removed:', securityDiff.permissions.removed));
+    }
+    if (securityDiff.scripts.added.length > 0) {
+        lines.push(formatList('New scripts:  ', securityDiff.scripts.added));
+    }
+    if (securityDiff.scripts.removed.length > 0) {
+        lines.push(formatList('Scripts gone: ', securityDiff.scripts.removed));
+    }
+    if (securityDiff.executables.added.length > 0) {
+        lines.push(formatList('New execs:    ', securityDiff.executables.added));
+    }
+    lines.push(`Changes:      +${stats.added} added, ~${stats.updated} updated, -${stats.removed} removed, =${stats.unchanged} unchanged`);
+    const localFindings = stats.localModified + stats.localMissing + stats.localUnknown + stats.irregular;
+    if (localFindings > 0) {
+        lines.push(`Local:        ${stats.localModified} modified, ${stats.localMissing} missing, ${stats.localUnknown} unmanaged, ${stats.irregular} irregular`);
+    }
+    for (const entry of securityDiff.changelogs) {
+        lines.push(`Changelog ${entry.version}:`);
+        for (const changelogLine of entry.changelog.split('\n')) {
+            lines.push(`  ${changelogLine}`);
+        }
+    }
+    if (plan.warnings.length > 0) {
+        lines.push(`Warnings:     ${plan.warnings.join(', ')}`);
+    }
+    if (plan.blockers.length > 0) {
+        lines.push('Blockers:');
+        for (const blocker of plan.blockers) {
+            lines.push(`  - ${blocker.code}${blocker.detail ? ` (${blocker.detail})` : ''}${blocker.path ? `: ${blocker.path}` : ''}`);
+        }
+    }
+    lines.push(plan.updatable
+        ? 'Updatable:    yes'
+        : 'Updatable:    no — nothing would be written');
+    if (plan.requiresRiskAcknowledgement) {
+        lines.push(`High risk:    applying this update will require an explicit acknowledgement of ${skill.id}@${update.toVersion}`);
+    }
+    if (plan.riskIncreased) {
+        lines.push('Risk rises:   applying this update will require a separate risk-increase confirmation');
+    }
+    lines.push(`Next action:  ${plan.nextActionKey}`);
+    return lines.join('\n');
+}
 /** The uninstall preview: what would be deleted, what would stay, and why. */
 function formatUninstallPlan(plan) {
     const { skill, target, stats } = plan;

package/dist/cli/commands/skill.d.ts

@@ -5,6 +5,8 @@
  *   commandmate skill list [--json]
  *   commandmate skill info <skill-id> [--version <v>] [--json]
  *   commandmate skill plan <skill-id> --worktree <id> [--version <v>] [--json]
+ *   commandmate skill update-plan <skill-id> --worktree <id> [--version <v>] [--range <r>] [--json]
+ *   commandmate skill update <skill-id> --worktree <id> [--version <v>] [--dry-run] [--yes] [--ack-risk <id>@<version>] [--ack-risk-increase]
  *   commandmate skill install <skill-id> --worktree <id> --version <exact> [--dry-run] [--yes] [--ack-risk <id>@<version>] [--git current|dedicated] [--push] [--pr]
  *   commandmate skill uninstall <skill-id> --worktree <id> [--dry-run] [--yes] [--json]
  *   commandmate skill status <skill-id> --worktree <id> [--json]

package/dist/cli/commands/skill.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/skill.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA0gBpC,wBAAgB,kBAAkB,IAAI,OAAO,CAkJ5C"}
+{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/skill.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA2qBpC,wBAAgB,kBAAkB,IAAI,OAAO,CAgM5C"}

package/dist/cli/commands/skill.js

@@ -6,6 +6,8 @@
  *   commandmate skill list [--json]
  *   commandmate skill info <skill-id> [--version <v>] [--json]
  *   commandmate skill plan <skill-id> --worktree <id> [--version <v>] [--json]
+ *   commandmate skill update-plan <skill-id> --worktree <id> [--version <v>] [--range <r>] [--json]
+ *   commandmate skill update <skill-id> --worktree <id> [--version <v>] [--dry-run] [--yes] [--ack-risk <id>@<version>] [--ack-risk-increase]
  *   commandmate skill install <skill-id> --worktree <id> --version <exact> [--dry-run] [--yes] [--ack-risk <id>@<version>] [--git current|dedicated] [--push] [--pr]
  *   commandmate skill uninstall <skill-id> --worktree <id> [--dry-run] [--yes] [--json]
  *   commandmate skill status <skill-id> --worktree <id> [--json]
@@ -98,6 +100,36 @@ async function planInstall(skillId, options) {
     if (!plan.installable)
         process.exit(types_1.SkillExitCode.BLOCKED);
 }
+/** Ask the server to build an Update Plan. The only inputs are what to move to. */
+async function requestUpdatePlan(client, target, options) {
+    const body = {};
+    if (options.version)
+        body.version = options.version;
+    if (options.prerelease)
+        body.includePrerelease = true;
+    if (options.range)
+        body.range = options.range;
+    const response = await client.post(`/api/worktrees/${encodeURIComponent(target.worktreeId)}/skills/${encodeURIComponent(target.skillId)}/update-plan`, body);
+    return (0, api_client_1.assertResponseShape)(response, ['plan'], 'POST .../skills/update-plan').plan;
+}
+/**
+ * Preview updating an installed Skill to a newer exact version (Issue #1243).
+ *
+ * Plan-only by design: the server reads the installed version from the on-disk
+ * receipt, resolves the candidate against the Catalog, verifies the artifact
+ * and reports the version diff, the risk change and every blocker. Applying is
+ * `skill update` (#1244).
+ */
+async function planUpdate(skillId, options) {
+    const target = resolveTarget(skillId, options.worktree);
+    if (!target)
+        return;
+    const client = new api_client_1.ApiClient({ token: options.token });
+    const plan = await requestUpdatePlan(client, target, options);
+    console.log(options.json ? JSON.stringify({ plan }, null, 2) : (0, skill_format_1.formatUpdatePlan)(plan));
+    if (!plan.updatable)
+        process.exit(types_1.SkillExitCode.BLOCKED);
+}
 /**
  * Report whether one Skill is installed in one worktree.
  *
@@ -316,6 +348,83 @@ async function installSkill(skillId, options) {
         console.log(describeGitOutcome(git.result));
     }
 }
+/**
+ * Update an installed Skill to a newer exact version (Issue #1244).
+ *
+ * The same thin-client contract as install: the CLI shows the server-built
+ * plan, collects the confirmations the plan demands, and presents the token
+ * back unchanged. Both risk gates fail closed — a high-risk candidate needs
+ * `--ack-risk <id>@<version>`, and a risk *increase* additionally needs
+ * `--ack-risk-increase` — so `--yes` alone can never carry either.
+ */
+async function updateSkill(skillId, options) {
+    const target = resolveTarget(skillId, options.worktree);
+    if (!target)
+        return;
+    const client = new api_client_1.ApiClient({ token: options.token });
+    const plan = await requestUpdatePlan(client, target, options);
+    // --dry-run stops here by construction: the plan is the whole output and no
+    // token is ever presented back to the server.
+    if (options.dryRun) {
+        console.log(options.json ? JSON.stringify({ plan }, null, 2) : (0, skill_format_1.formatUpdatePlan)(plan));
+        if (!plan.updatable)
+            process.exit(types_1.SkillExitCode.BLOCKED);
+        return;
+    }
+    console.error((0, skill_format_1.formatUpdatePlan)(plan));
+    if (!plan.updatable) {
+        (0, skill_guards_1.refuse)('The update is blocked by the findings listed above; nothing was written.', types_1.SkillExitCode.BLOCKED);
+        return;
+    }
+    // Checked before the generic confirmation so `--yes` alone can never carry a
+    // high-risk update, in a TTY or out of one.
+    if (plan.requiresRiskAcknowledgement &&
+        !(0, skill_guards_1.riskAcknowledgementMatches)(options.ackRisk, plan.skill.id, plan.update.toVersion)) {
+        (0, skill_guards_1.refuse)(`${plan.skill.id} ${plan.update.toVersion} is high risk. Re-run with --ack-risk ${plan.skill.id}@${plan.update.toVersion} to acknowledge it explicitly.`, types_1.SkillExitCode.CONFIRMATION_REQUIRED);
+        return;
+    }
+    // The escalation gate is separate from the high-risk gate on purpose: a risk
+    // increase must be named as its own fact, not folded into a flag the caller
+    // may already be passing for other reasons.
+    if (plan.riskIncreased && options.ackRiskIncrease !== true) {
+        (0, skill_guards_1.refuse)(`Updating ${plan.skill.id} to ${plan.update.toVersion} raises its effective risk (${plan.securityDiff.risk.from.effective} -> ${plan.securityDiff.risk.to.effective}). Re-run with --ack-risk-increase to confirm the escalation explicitly.`, types_1.SkillExitCode.CONFIRMATION_REQUIRED);
+        return;
+    }
+    const outcome = await (0, skill_guards_1.resolveWriteConfirmation)(`Update ${plan.skill.id} ${plan.update.fromVersion} -> ${plan.update.toVersion} in ${plan.target.worktreeId} (${(0, skill_format_1.formatInstallRoots)(plan.target.installRoots, plan.target.installRoot)})?`, options);
+    if (outcome === 'non_interactive') {
+        (0, skill_guards_1.refuse)('Refusing to update without a confirmation. Pass --yes to update from a non-interactive environment.', types_1.SkillExitCode.CONFIRMATION_REQUIRED);
+        return;
+    }
+    if (outcome === 'declined') {
+        (0, skill_guards_1.refuse)('Update declined; nothing was written.', types_1.SkillExitCode.CONFIRMATION_REQUIRED);
+        return;
+    }
+    const response = await client.post(`/api/worktrees/${encodeURIComponent(target.worktreeId)}/skills/${encodeURIComponent(target.skillId)}/update`, {
+        planToken: plan.token,
+        version: plan.update.toVersion,
+        acknowledgeRisk: plan.requiresRiskAcknowledgement,
+        acknowledgeRiskIncrease: plan.riskIncreased,
+    });
+    const body = (0, api_client_1.assertResponseShape)(response, ['operation', 'update'], 'POST .../skills/update');
+    if (options.json) {
+        console.log(JSON.stringify(body, null, 2));
+    }
+    else {
+        console.log(`Updated ${body.update?.skillId ?? target.skillId} ${body.update?.fromVersion ?? plan.update.fromVersion} -> ${body.update?.toVersion ?? body.update?.version ?? plan.update.toVersion} in ${(0, skill_format_1.formatInstallRoots)(body.update?.installRoots, body.update?.installRoot ?? plan.target.installRoot)}`);
+        for (const agent of body.reload?.agents ?? []) {
+            console.error(`Reload: restart the ${agent.agent} session in this worktree to pick up the new version.`);
+        }
+        if (body.rollback?.available) {
+            console.error(`Rollback: version ${body.rollback.backup.fromVersion} is preserved in verified backup ${body.rollback.backup.backupId} (restore ships separately).`);
+        }
+    }
+    if (body.operation.result === 'committed_reconciling') {
+        // The new payload is on disk; saying "update failed" would contradict what
+        // the user can see. Report it as needing attention instead.
+        console.error(`Warning: the new version landed but the operation did not finish cleanly (${body.operation.nextActionKey}). Reconciliation will converge it.`);
+        process.exit(types_1.SkillExitCode.COMMITTED_RECONCILING);
+    }
+}
 async function uninstallSkill(skillId, options) {
     const target = resolveTarget(skillId, options.worktree);
     if (!target)
@@ -411,6 +520,24 @@ function createSkillCommand() {
             (0, skill_guards_1.handleSkillCommandError)(error);
         }
     });
+    skill
+        .command('update-plan')
+        .description('Preview updating an installed Skill to a newer version. Never writes.')
+        .argument('<skill-id>', 'Installed Skill ID')
+        .option('--worktree <id>', 'Target worktree ID (see: commandmate ls)')
+        .option('--version <version>', 'Exact candidate version (default: the recommended candidate)')
+        .option('--range <range>', 'Only consider candidates satisfying this version range')
+        .option('--json', 'JSON output (the API response body, verbatim)')
+        .option('--prerelease', 'Include prerelease candidates')
+        .option('--token <token>', command_helpers_1.TOKEN_WARNING)
+        .action(async (skillId, options) => {
+        try {
+            await planUpdate(skillId, options);
+        }
+        catch (error) {
+            (0, skill_guards_1.handleSkillCommandError)(error);
+        }
+    });
     skill
         .command('install')
         .description('Install a Skill into a worktree, after showing the plan and confirming')
@@ -434,6 +561,28 @@ function createSkillCommand() {
             (0, skill_guards_1.handleSkillCommandError)(error);
         }
     });
+    skill
+        .command('update')
+        .description('Update an installed Skill to a newer version, after showing the plan and confirming')
+        .argument('<skill-id>', 'Installed Skill ID')
+        .option('--worktree <id>', 'Target worktree ID (see: commandmate ls)')
+        .option('--version <version>', 'Exact candidate version (default: the recommended candidate)')
+        .option('--range <range>', 'Only consider candidates satisfying this version range')
+        .option('--dry-run', 'Build and print the plan, then stop without writing')
+        .option('-y, --yes', 'Skip the confirmation prompt (required for non-interactive use)')
+        .option('--ack-risk <skill-id@version>', 'Explicitly acknowledge a high-risk candidate. Required in addition to --yes.')
+        .option('--ack-risk-increase', 'Explicitly confirm an update that raises the Skill\'s effective risk. Required in addition to --yes.')
+        .option('--json', 'JSON output (the API response body, verbatim)')
+        .option('--prerelease', 'Include prerelease candidates')
+        .option('--token <token>', command_helpers_1.TOKEN_WARNING)
+        .action(async (skillId, options) => {
+        try {
+            await updateSkill(skillId, options);
+        }
+        catch (error) {
+            (0, skill_guards_1.handleSkillCommandError)(error);
+        }
+    });
     skill
         .command('uninstall')
         .description('Remove an installed Skill from a worktree, after showing the plan and confirming')