commandmate 0.20.0 → 0.21.1

package/dist/server/src/lib/detection/prompt-detect-multiple-choice.js

@@ -1,6 +1,9 @@
 "use strict";
 /** Multiple choice prompt detection logic extracted from prompt-detector.ts (Issue #575). */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.APPROVAL_TARGET_MAX_LOOKBACK = void 0;
+exports.findApprovalContextStart = findApprovalContextStart;
+exports.joinApprovalTarget = joinApprovalTarget;
 exports.buildMultipleChoiceResult = buildMultipleChoiceResult;
 exports.detectMultipleChoicePrompt = detectMultipleChoicePrompt;
 const tui_detection_frame_1 = require("./tui-detection-frame");
@@ -56,6 +59,12 @@ const NORMAL_OPTION_PATTERN = /^\s*[^\d]{0,3}(\d+)(?:\.(?!\d)|\s+)\s*(.+)$/;
  * Anchored at both ends -- ReDoS safe (S4-001).
  */
 const SEPARATOR_LINE_PATTERN = /^[-─]+$/;
+/**
+ * How many lines above `questionEndIndex` the question text is collected from.
+ * Also the point the Issue #1699 approval-context scan starts walking up from,
+ * since everything inside this window is already part of `question`.
+ */
+const QUESTION_CONTEXT_LINES = 5;
 /**
  * Pattern for collapsed-output summary lines rendered by Codex/OpenAI TUI.
  * Example: "[… 12 lines] ctrl + a view all"
@@ -461,7 +470,7 @@ function extractQuestionText(lines, questionEndIndex) {
         return 'Please select an option:';
     }
     const questionLines = [];
-    for (let i = Math.max(0, questionEndIndex - 5); i <= questionEndIndex; i++) {
+    for (let i = Math.max(0, questionEndIndex - QUESTION_CONTEXT_LINES); i <= questionEndIndex; i++) {
         const line = lines[i].trim();
         if (line && !SEPARATOR_LINE_PATTERN.test(line)) {
             questionLines.push(line);
@@ -489,6 +498,108 @@ function extractInstructionText(lines, questionEndIndex, effectiveEnd) {
     const joined = blockLines.join('\n').trim();
     return joined.length > 0 ? joined : undefined;
 }
+/**
+ * Lines that mean "the previous turn ended here" when scanning upward.
+ *
+ * Every supported CLI renders its transcript as marker-prefixed rows — Claude's
+ * tool-use `⏺` and result `⎿`, Codex's activity `•`, its approval receipts `✔`
+ * / `✗`, the user's own `›` / `❯` / `>` echo, and its output continuation `└`.
+ * The lines a prompt panel puts above its question (a header such as "Bash
+ * command", the command itself, a one-line description) never carry one, which
+ * is what makes this usable as the panel's upper edge after `stripBoxDrawing`
+ * has erased the real box border.
+ *
+ * Horizontal rules count too: Codex draws one between turns.
+ *
+ * Anchored at the start of the trimmed line — ReDoS safe (no repetition).
+ */
+const TURN_BOUNDARY_PATTERN = /^[⏺⎿●○•✔✓✖✗✘›»❯└├>]/;
+/**
+ * How far above the question the approval context may reach (Issue #1699).
+ *
+ * The boundary marker above is the actual fix; this cap only exists so a frame
+ * that happens to contain no marker at all (a bare shell `(y/n)` prompt under
+ * plain command output) cannot drag an unbounded scrollback window into the
+ * deny surface the way the old fixed 19-line lookback did. Sized for the
+ * tallest real permission panel measured: header + blank + a wrapped multi-line
+ * command + description + blank.
+ */
+exports.APPROVAL_TARGET_MAX_LOOKBACK = 12;
+/** True when this line belongs to a previous turn rather than the prompt panel. */
+function isTurnBoundaryLine(rawLine) {
+    if (rawLine === undefined)
+        return false;
+    const line = rawLine.trim();
+    if (line === '')
+        return false;
+    return TURN_BOUNDARY_PATTERN.test(line) || SEPARATOR_LINE_PATTERN.test(line);
+}
+/**
+ * First line index that still belongs to *this* prompt, scanning upward.
+ *
+ * Walks up from `questionLineIndex - 1` and stops just below the nearest turn
+ * boundary; with no boundary in reach it falls back to the lookback cap.
+ * Everything above the returned index is a previous turn and must never reach a
+ * deny pattern — that poisoning is Issue #1699.
+ *
+ * Shared by both detector paths: multiple_choice passes its `questionEndIndex`,
+ * yes_no the line its pattern matched on.
+ *
+ * @param lines - Full frame, already ANSI/box stripped
+ * @param questionLineIndex - Line the prompt's own question sits on
+ * @returns Index of the first line of the current prompt's own block
+ */
+function findApprovalContextStart(lines, questionLineIndex) {
+    const floor = Math.max(0, questionLineIndex - exports.APPROVAL_TARGET_MAX_LOOKBACK);
+    for (let i = questionLineIndex - 1; i >= floor; i--) {
+        if (isTurnBoundaryLine(lines[i])) {
+            return i + 1;
+        }
+    }
+    return floor;
+}
+/**
+ * Join a slice of the frame into an approval-target string.
+ *
+ * @returns The trimmed block, or undefined when it is empty
+ */
+function joinApprovalTarget(lines, start, end) {
+    const joined = lines
+        .slice(start, end)
+        .map(l => l.trimEnd())
+        .join('\n')
+        .trim();
+    return joined.length > 0 ? joined : undefined;
+}
+/**
+ * Extract what this multiple-choice prompt is asking approval for (Issue #1699).
+ *
+ * Same lower bound as {@link extractInstructionText} — the panel runs through
+ * its options — but the upper bound is the previous turn's boundary instead of
+ * a fixed 19-line lookback.
+ *
+ * Measured against the live Codex captures in `fixtures/codex-live-1628`: the
+ * two `✔ You approved codex to run …` receipts and the `• Ran …` echoes that
+ * `instructionText` carries all fall outside, while the `$ git add …` the
+ * prompt is actually asking about, and the diff an apply-patch prompt is asking
+ * about, both stay inside.
+ *
+ * Residual, deliberately left alone: `question` itself is built from up to
+ * {@link QUESTION_CONTEXT_LINES} lines above `questionEndIndex` and is also part
+ * of the deny surface. Narrowing that would change prompt dedup keys and what
+ * the UI renders, and it is bounded by the options below it either way.
+ *
+ * @param lines - Array of output lines
+ * @param questionEndIndex - Index of the last line before options, or -1 if not found
+ * @param effectiveEnd - End index of non-trailing-empty lines
+ * @returns Approval target string, or undefined if no question line found
+ */
+function extractApprovalTarget(lines, questionEndIndex, effectiveEnd) {
+    if (questionEndIndex < 0) {
+        return undefined;
+    }
+    return joinApprovalTarget(lines, findApprovalContextStart(lines, questionEndIndex), effectiveEnd);
+}
 /**
  * Build the final PromptDetectionResult for a multiple choice prompt.
  * Maps collected options to the output format, checking each option for
@@ -496,14 +607,17 @@ function extractInstructionText(lines, questionEndIndex, effectiveEnd) {
  *
  * @param question - Extracted question text
  * @param collectedOptions - Options collected during Pass 2 scanning
- * @param instructionText - Instruction text for the prompt block
+ * @param context - Human-facing `instructionText` and machine-facing
+ *   `approvalTarget` for the prompt block (Issue #1699 split them; an
+ *   `undefined` here means neither, which is what the pre-#1699 callers meant)
  * @param output - Original output text (used for rawContent truncation)
  * @param truncateRawContentFn - Function to truncate raw content
  * @param submitMode - Optional submit mode for the prompt (Issue #616)
  * @param isAskUserQuestion - Whether this is a Claude Code v2.x AskUserQuestion picker (Issue #807)
  * @returns PromptDetectionResult with isPrompt: true and multiple_choice data
  */
-function buildMultipleChoiceResult(question, collectedOptions, instructionText, output, truncateRawContentFn, submitMode, isAskUserQuestion) {
+function buildMultipleChoiceResult(question, collectedOptions, context, output, truncateRawContentFn, submitMode, isAskUserQuestion) {
+    const { instructionText, approvalTarget } = context ?? {};
     return {
         isPrompt: true,
         promptData: {
@@ -520,6 +634,7 @@ function buildMultipleChoiceResult(question, collectedOptions, instructionText,
             }),
             status: 'pending',
             instructionText,
+            ...(approvalTarget !== undefined ? { approvalTarget } : {}),
             ...(submitMode ? { submitMode } : {}),
             ...(isAskUserQuestion ? { isAskUserQuestion: true } : {}),
         },
@@ -818,9 +933,12 @@ function detectMultipleChoicePrompt(output, options, truncateRawContentFn) {
     }
     const question = extractQuestionText(lines, questionEndIndex);
     const instructionText = extractInstructionText(lines, questionEndIndex, effectiveEnd);
+    // Issue #1699: the same block, cut at the previous turn's boundary. Display
+    // keeps the wide window; deny patterns are judged against this one.
+    const approvalTarget = extractApprovalTarget(lines, questionEndIndex, effectiveEnd);
     // Issue #616: Determine submitMode from confirmation footer (detected in single-pass above)
     const submitMode = hasConfirmationFooter
         ? (hasNumberFooter ? 'answer_only' : 'answer_then_enter')
         : undefined;
-    return buildMultipleChoiceResult(question, collectedOptions, instructionText, output, truncateRawContentFn, submitMode, hasAskUserQuestionFooter);
+    return buildMultipleChoiceResult(question, collectedOptions, { instructionText, approvalTarget }, output, truncateRawContentFn, submitMode, hasAskUserQuestionFooter);
 }

package/dist/server/src/lib/detection/prompt-detector.js

@@ -78,6 +78,33 @@ const YES_NO_PATTERNS = [
     // (yes/no) - no default
     { regex: /^(.+)\s+\(yes\/no\)\s*$/m },
 ];
+/**
+ * Where in `lines` a regex match against the joined tail window started and ended.
+ *
+ * The yes/no patterns are matched against the last 20 lines joined into one
+ * string, so a match carries no line number of its own. Issue #1699 needs one:
+ * the approval target is bounded relative to the line the prompt is actually on,
+ * not relative to the bottom of the pane.
+ */
+function locateMatchLines(tailText, tailStart, match) {
+    const offset = match.index ?? 0;
+    const countNewlines = (text) => text.split('\n').length - 1;
+    const startLine = tailStart + countNewlines(tailText.slice(0, offset));
+    return { startLine, endLine: startLine + countNewlines(match[0]) };
+}
+/**
+ * What a yes/no prompt is asking approval for (Issue #1699).
+ *
+ * Bounded on both sides, unlike `instructionText`: below at the prompt line
+ * itself (nothing printed after the question is part of what it approves) and
+ * above at the previous turn's boundary. A shell that echoes the command
+ * directly above its `(y/n)` — the case the deny patterns were written for —
+ * still lands inside; a command approved in an earlier turn does not.
+ */
+function yesNoApprovalTarget(lines, tailText, tailStart, match) {
+    const { startLine, endLine } = locateMatchLines(tailText, tailStart, match);
+    return (0, prompt_detect_multiple_choice_1.joinApprovalTarget)(lines, (0, prompt_detect_multiple_choice_1.findApprovalContextStart)(lines, startLine), endLine + 1);
+}
 /**
  * Creates a yes/no prompt detection result.
  * Centralizes the repeated construction of yes_no PromptDetectionResult objects
@@ -86,10 +113,11 @@ const YES_NO_PATTERNS = [
  * @param question - The question text
  * @param cleanContent - The clean content string
  * @param rawContent - The raw content string (last 20 lines, trimmed)
+ * @param approvalTarget - Issue #1699 deny-match surface for this prompt
  * @param defaultOption - Optional default option ('yes' or 'no')
  * @returns PromptDetectionResult with isPrompt: true and yes_no prompt data
  */
-function yesNoPromptResult(question, cleanContent, rawContent, defaultOption) {
+function yesNoPromptResult(question, cleanContent, rawContent, approvalTarget, defaultOption) {
     return {
         isPrompt: true,
         promptData: {
@@ -98,7 +126,12 @@ function yesNoPromptResult(question, cleanContent, rawContent, defaultOption) {
             options: ['yes', 'no'],
             status: 'pending',
             ...(defaultOption !== undefined && { defaultOption }),
+            // Issue #235: the wide window, for the human reading PromptPanel.
             instructionText: rawContent,
+            // Issue #1699: the narrow one, for machine judgement. Keeping the two
+            // apart is the whole fix — the wide window is a scrollback view and a
+            // deny pattern matched against it fires on turns that are already done.
+            ...(approvalTarget !== undefined && { approvalTarget }),
         },
         cleanContent,
         rawContent,
@@ -148,6 +181,9 @@ function detectPrompt(output, options) {
     lastOutputTail = tailForDedup;
     // [SF-003] [MF-S2-001] Expanded from 10 to 20 lines for rawContent coverage
     const lastLines = lines.slice(-20).join('\n');
+    // Absolute index of lastLines[0] in `lines`, so a match inside the joined tail
+    // can be mapped back to a line number (Issue #1699).
+    const tailStart = Math.max(0, lines.length - 20);
     // Pattern 0: Multiple choice (numbered options with indicator)
     // Example:
     // Do you want to proceed?
@@ -172,7 +208,7 @@ function detectPrompt(output, options) {
         const match = lastLines.match(pattern.regex);
         if (match) {
             const question = match[1].trim();
-            return yesNoPromptResult(question, question, trimmedLastLines, pattern.defaultOption);
+            return yesNoPromptResult(question, question, trimmedLastLines, yesNoApprovalTarget(lines, lastLines, tailStart, match), pattern.defaultOption);
         }
     }
     // Pattern 5: Approve?
@@ -183,7 +219,7 @@ function detectPrompt(output, options) {
         const content = approveMatch[1].trim();
         // If there's content before "Approve?", include it in the question
         const question = content ? `${content} Approve?` : 'Approve?';
-        return yesNoPromptResult(question, content || 'Approve?', trimmedLastLines);
+        return yesNoPromptResult(question, content || 'Approve?', trimmedLastLines, yesNoApprovalTarget(lines, lastLines, tailStart, approveMatch));
     }
     // No prompt detected
     // D2-005: Suppress duplicate complete log

package/dist/server/src/lib/polling/auto-yes-resolver.js

@@ -59,14 +59,23 @@ function resolveBaseAnswer(promptData) {
 /**
  * Every piece of prompt text a deny pattern is matched against.
  *
- * `instructionText` is included because that is where the dangerous part
- * usually is — Claude's permission prompts put the command being approved in the
- * lines above the question, not in the question itself.
+ * `approvalTarget` is included because that is where the dangerous part usually
+ * is — Claude's permission prompts put the command being approved in the lines
+ * above the question, not in the question itself.
+ *
+ * Issue #1699: it used to be `instructionText` that was included here, and that
+ * was the bug. `instructionText` is a scrollback window sized for a human to
+ * read, so a `rm -rf` approved several turns earlier stayed inside it and went
+ * on matching — suppressing every later prompt, including edits that had
+ * nothing to do with it, until the line scrolled off the pane. `approvalTarget`
+ * is the same block bounded at the previous turn, so what is judged here is
+ * what *this* prompt is asking for. Prompts detected before the field existed
+ * (an old row replayed from the database) simply match on question and options.
  */
 function collectDenyMatchTexts(promptData) {
     const texts = [promptData.question];
-    if (promptData.instructionText) {
-        texts.push(promptData.instructionText);
+    if (promptData.approvalTarget) {
+        texts.push(promptData.approvalTarget);
     }
     if (promptData.type === 'multiple_choice') {
         for (const option of promptData.options) {

package/dist/server/src/lib/polling/auto-yes-suppression-state.js

@@ -0,0 +1,54 @@
+"use strict";
+/**
+ * In-memory record of the last Auto-Yes answer withheld by a contract policy
+ * (Issue #1684).
+ *
+ * Until now a policy suppression (Issue #1547) was visible only in the server
+ * log (`poller:auto-yes-suppressed-by-policy`), so an unattended pipeline that
+ * stalled on a suppressed prompt looked identical to one that simply had no
+ * answer. This module keeps the last suppression per session so
+ * `buildCurrentOutput` can publish it and `commandmate capture --json` can show
+ * *why* the worker is waiting.
+ *
+ * Exposure only: nothing reads this to make a decision. The poller keeps
+ * re-evaluating a suppressed prompt every poll (the duplicate guard only
+ * remembers *answered* prompts), so while the prompt stays on screen the record
+ * is refreshed and `at` stays current; consumers combine it with
+ * `isPromptWaiting` to tell an active suppression from a historical one.
+ *
+ * In-memory and not in SQLite for the same reason `agent-event-state` is: the
+ * record describes a prompt on a live tmux session, and a session does not
+ * survive a server restart for the record to still be about.
+ *
+ * @module lib/polling/auto-yes-suppression-state
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.recordPolicySuppression = recordPolicySuppression;
+exports.getLastPolicySuppression = getLastPolicySuppression;
+exports.clearPolicySuppressions = clearPolicySuppressions;
+const auto_yes_state_1 = require("../../lib/auto-yes-state");
+/** compositeKey -> the most recent policy suppression for that session. */
+const lastPolicySuppressions = new Map();
+/**
+ * Record that the policy withheld an answer for `instanceId`'s current prompt.
+ *
+ * @param at - Epoch ms; defaults to now. Overridable so tests are deterministic.
+ */
+function recordPolicySuppression(worktreeId, cliToolId, instanceId, suppression, at = Date.now()) {
+    lastPolicySuppressions.set((0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId), {
+        ...suppression,
+        at,
+    });
+}
+/**
+ * @returns The last policy suppression for this session, or null when the
+ *   policy has never withheld an answer — the ordinary case for a session
+ *   running without a contract.
+ */
+function getLastPolicySuppression(worktreeId, cliToolId, instanceId) {
+    return lastPolicySuppressions.get((0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId)) ?? null;
+}
+/** Drop every recorded suppression. Test seam. */
+function clearPolicySuppressions() {
+    lastPolicySuppressions.clear();
+}

package/dist/server/src/lib/session/current-output-builder.js

@@ -14,6 +14,7 @@ const manager_1 = require("../../lib/cli-tools/manager");
 const cli_session_1 = require("../../lib/session/cli-session");
 const status_detector_1 = require("../../lib/detection/status-detector");
 const auto_yes_manager_1 = require("../../lib/polling/auto-yes-manager");
+const auto_yes_suppression_state_1 = require("../../lib/polling/auto-yes-suppression-state");
 const status_capture_config_1 = require("../../config/status-capture-config");
 const tmux_capture_cache_1 = require("../../lib/tmux/tmux-capture-cache");
 const agent_event_state_1 = require("../../lib/session/agent-event-state");
@@ -101,6 +102,7 @@ async function buildCurrentOutput(db, worktreeId, cliToolId, instanceId) {
             enabled: autoYesState?.enabled ?? false,
             expiresAt: autoYesState?.enabled ? autoYesState.expiresAt : null,
             stopReason: autoYesState?.stopReason,
+            lastSuppression: (0, auto_yes_suppression_state_1.getLastPolicySuppression)(worktreeId, cliToolId, instanceId),
         },
         isSelectionListActive,
         isPagerActive,

package/dist/server/src/lib/skills/install-apply.js

@@ -47,6 +47,8 @@ exports.inspectSkillDestination = inspectSkillDestination;
 exports.hasCommittedSkillPayload = hasCommittedSkillPayload;
 exports.writeSkillPayloadFile = writeSkillPayloadFile;
 exports.applySkillInstall = applySkillInstall;
+exports.directoriesForSkillPayload = directoriesForSkillPayload;
+exports.stageSkillRootPayload = stageSkillRootPayload;
 exports.completeSecondarySkillInstallRoots = completeSecondarySkillInstallRoots;
 exports.cleanupSkillInstallStaging = cleanupSkillInstallStaging;
 const fs_1 = require("fs");
@@ -397,7 +399,7 @@ function applySkillInstall(input) {
         }
         return { relativePath: file.path, bytes, executable: file.executable };
     });
-    const directories = directoriesFor(input.snapshot.files.map((f) => f.path), input.snapshot.directories);
+    const directories = directoriesForSkillPayload(input.snapshot.files.map((f) => f.path), input.snapshot.directories);
     // Every destination is proven safe and absent *before* the primary commits, so
     // a secondary that is already blocked cannot leave a committed primary behind.
     for (const prefix of rootPrefixes) {
@@ -463,7 +465,7 @@ function applySkillInstall(input) {
     };
 }
 /** Sorted set of directories a payload implies, plus any the package declared. */
-function directoriesFor(filePaths, declared = []) {
+function directoriesForSkillPayload(filePaths, declared = []) {
     const directories = new Set(declared);
     for (const filePath of filePaths) {
         const parents = filePath.split('/').slice(0, -1);
@@ -476,30 +478,29 @@ function directoriesFor(filePaths, declared = []) {
     return [...directories].sort();
 }
 /**
- * Stage the verified payload into one root and atomically publish it (#1460).
+ * Stage the verified payload for one root without publishing it (#1244).
  *
- * The single-root commit #1235 built, lifted to take the root prefix as a
- * parameter: staging lives under *that* root's reserved namespace so the rename
- * stays on one filesystem, and every check — ancestor lstat walk, exclusive
- * no-follow writes, tree-hash gate, destination-absent, same-filesystem — is
- * applied per root. Throws {@link SkillInstallError} on any failure, having
- * removed its own staging; the destination is untouched unless the rename ran.
+ * The staging half of {@link stageAndCommitSkillRoot}, exported so update can
+ * reuse the exact write path — exclusive no-follow writes, tree-hash gate,
+ * same-filesystem check — and supply its own rename sequence. On any failure the
+ * staging directory is removed and {@link SkillInstallError} is thrown; the
+ * destination is never touched. The caller owns the returned directory: it must
+ * either rename it into place or remove it.
+ *
+ * @internal Shared between install and update apply; not a public API.
  */
-function stageAndCommitSkillRoot(input) {
+function stageSkillRootPayload(input) {
+    if (!exports.SKILL_INSTALL_OPERATION_ID_PATTERN.test(input.stagingName)) {
+        fail(exports.SkillInstallErrorCode.STAGING_IO, { reason: 'staging-name' });
+    }
     const installRootAbs = resolveSkillInstallTargetFor(input.worktreePath, input.rootPrefix, input.skillId);
     assertAncestorsAreRealDirectories(input.worktreeRealPath, input.worktreePath, input.rootPrefix);
-    const destinationBefore = inspectSkillDestination(installRootAbs);
-    if (destinationBefore.present) {
-        fail(destinationBefore.managed
-            ? exports.SkillInstallErrorCode.DESTINATION_EXISTS
-            : exports.SkillInstallErrorCode.DESTINATION_UNMANAGED, destinationBefore.version ? { version: destinationBefore.version } : undefined);
-    }
     const stagingRoot = (0, operation_store_1.getSkillInstallStagingRoot)(input.worktreePath, input.rootPrefix);
     makeDirectory(path_1.default.dirname(stagingRoot), 0o755, true);
     makeDirectory(stagingRoot, exports.SKILL_INSTALL_DIR_MODE, true);
     // Not recursive: a staging directory that already exists means another
-    // operation is using this ID, and silently adopting it would merge two writes.
-    const stagingDir = path_1.default.join(stagingRoot, input.operationId);
+    // operation is using this name, and silently adopting it would merge two writes.
+    const stagingDir = path_1.default.join(stagingRoot, input.stagingName);
     makeDirectory(stagingDir, exports.SKILL_INSTALL_DIR_MODE, false);
     try {
         for (const directory of input.directories) {
@@ -520,6 +521,45 @@ function stageAndCommitSkillRoot(input) {
             fail(exports.SkillInstallErrorCode.PAYLOAD_MISMATCH, { reason: 'tree-hash' });
         }
         assertSameFilesystem(stagingDir, path_1.default.dirname(installRootAbs));
+    }
+    catch (error) {
+        (0, fs_1.rmSync)(stagingDir, { recursive: true, force: true });
+        pruneStagingRoot(stagingRoot);
+        throw error;
+    }
+    return { stagingDir, stagingRoot, installRootAbs };
+}
+/**
+ * Stage the verified payload into one root and atomically publish it (#1460).
+ *
+ * The single-root commit #1235 built, lifted to take the root prefix as a
+ * parameter: staging lives under *that* root's reserved namespace so the rename
+ * stays on one filesystem, and every check — ancestor lstat walk, exclusive
+ * no-follow writes, tree-hash gate, destination-absent, same-filesystem — is
+ * applied per root. Throws {@link SkillInstallError} on any failure, having
+ * removed its own staging; the destination is untouched unless the rename ran.
+ */
+function stageAndCommitSkillRoot(input) {
+    const installRootAbs = resolveSkillInstallTargetFor(input.worktreePath, input.rootPrefix, input.skillId);
+    assertAncestorsAreRealDirectories(input.worktreeRealPath, input.worktreePath, input.rootPrefix);
+    const destinationBefore = inspectSkillDestination(installRootAbs);
+    if (destinationBefore.present) {
+        fail(destinationBefore.managed
+            ? exports.SkillInstallErrorCode.DESTINATION_EXISTS
+            : exports.SkillInstallErrorCode.DESTINATION_UNMANAGED, destinationBefore.version ? { version: destinationBefore.version } : undefined);
+    }
+    const staged = stageSkillRootPayload({
+        worktreePath: input.worktreePath,
+        worktreeRealPath: input.worktreeRealPath,
+        rootPrefix: input.rootPrefix,
+        skillId: input.skillId,
+        stagingName: input.operationId,
+        payload: input.payload,
+        directories: input.directories,
+        receiptBytes: input.receiptBytes,
+        plannedTreeHash: input.plannedTreeHash,
+    });
+    try {
         // Re-checked immediately before the rename rather than only at entry: the
         // exclusive lock keeps CommandMate out, but nothing keeps the user's own
         // editor from creating this directory while the payload was being staged.
@@ -531,18 +571,18 @@ function stageAndCommitSkillRoot(input) {
                 : exports.SkillInstallErrorCode.DESTINATION_UNMANAGED);
         }
         try {
-            (0, fs_1.renameSync)(stagingDir, installRootAbs);
+            (0, fs_1.renameSync)(staged.stagingDir, installRootAbs);
         }
         catch {
             fail(exports.SkillInstallErrorCode.COMMIT_FAILED, { reason: 'rename' });
         }
     }
     catch (error) {
-        (0, fs_1.rmSync)(stagingDir, { recursive: true, force: true });
-        pruneStagingRoot(stagingRoot);
+        (0, fs_1.rmSync)(staged.stagingDir, { recursive: true, force: true });
+        pruneStagingRoot(staged.stagingRoot);
         throw error;
     }
-    pruneStagingRoot(stagingRoot);
+    pruneStagingRoot(staged.stagingRoot);
 }
 /**
  * Converge a committed install's secondary roots forward from the primary (#1460).
@@ -573,7 +613,7 @@ function completeSecondarySkillInstallRoots(worktreePath, worktreeRealPath, skil
         }
         return { relativePath: file.path, bytes, executable: file.executable };
     });
-    const directories = directoriesFor(receipt.files.map((file) => file.path));
+    const directories = directoriesForSkillPayload(receipt.files.map((file) => file.path));
     const plannedTreeHash = (0, preview_diff_1.computeSkillTreeHash)([
         ...receipt.files.map((file) => ({
             path: file.path,

package/dist/server/src/lib/skills/operation-audit.js

@@ -61,11 +61,10 @@ const SELECT_COLUMNS = `
  * The journal already holds the actor, target, source and typed error.
  *
  * The version transition (#1248) is derived from the journal rather than passed
- * in, because for the two operations that exist today the journal fully
- * determines it: an install ends at its target version and starts nowhere, an
- * uninstall starts at the version it removes and ends nowhere. An `update` is
- * the one case where `fromVersion` is not derivable — it has no writer yet
- * (#1243/#1244), and whoever adds one has to supply the replaced version here.
+ * in, because the journal fully determines it: an install ends at its target
+ * version and starts nowhere, an uninstall starts at the version it removes and
+ * ends nowhere, and an update (#1244) records the version it replaces on its
+ * own target (`fromVersion`) precisely so this derivation stays total.
  */
 function buildSkillOperationAuditInput(entry, result, recordedAt) {
     const isUninstall = entry.operation === 'uninstall';
@@ -81,7 +80,7 @@ function buildSkillOperationAuditInput(entry, result, recordedAt) {
         worktreeId: entry.target.worktreeId,
         skillId: entry.target.skillId,
         skillVersion: entry.target.version,
-        fromVersion: isUninstall ? entry.target.version : null,
+        fromVersion: isUninstall ? entry.target.version : (entry.target.fromVersion ?? null),
         toVersion: isUninstall ? null : entry.target.version,
         sourceOrigin: entry.source?.origin ?? null,
         sourceRepository: entry.source?.repository ?? null,

package/dist/server/src/lib/skills/startup-reconcile.js

@@ -32,6 +32,7 @@ const integrity_1 = require("../../lib/skills/integrity");
 const install_plan_1 = require("../../lib/skills/install-plan");
 const install_apply_1 = require("../../lib/skills/install-apply");
 const uninstall_apply_1 = require("../../lib/skills/uninstall-apply");
+const updater_1 = require("../../lib/skills/updater");
 const installed_state_1 = require("../../lib/skills/installed-state");
 const operation_audit_1 = require("../../lib/skills/operation-audit");
 const operation_journal_1 = require("../../lib/skills/operation-journal");
@@ -65,6 +66,19 @@ function buildSkillReconcilerPorts(db, options = {}) {
                 // and an uninstall's payload is by definition no longer present.
                 return isRemovalOperation(entry);
             }
+            if (entry.operation === 'update') {
+                // An interrupted two-rename switch can leave the root empty (old in
+                // the aside directory, or a verified staged payload unpublished), so
+                // the probe first converges the root to old-complete or new-complete
+                // (#1244) and only then answers whether the *new* receipt landed. The
+                // pre-existing old receipt is why the install probe would misread this
+                // entry: with no recorded digest it accepts any parseable receipt.
+                return (0, updater_1.reconcileSkillUpdateTarget)(worktreePath, entry.target.skillId, {
+                    operationId: entry.operationId,
+                    toVersion: entry.target.version,
+                    receiptDigest: entry.receiptDigest,
+                }).committed;
+            }
             return isRemovalOperation(entry)
                 ? (0, uninstall_apply_1.hasRemovedSkillPayload)(worktreePath, entry.target.skillId, entry.receiptDigest)
                 : (0, install_apply_1.hasCommittedSkillPayload)(worktreePath, entry.target.skillId, entry.receiptDigest);
@@ -80,12 +94,19 @@ function buildSkillReconcilerPorts(db, options = {}) {
             if (worktreePath === null) {
                 throw new Error('worktree path is unavailable for reindex');
             }
-            // Converge any secondary root a partial multi-root install did not reach,
-            // copying the byte-identical payload forward from the committed primary
-            // (#1460). Best-effort: a root blocked by a user file must not stall the
-            // index write, which is what actually makes the install visible.
+            // Converge any secondary root the operation did not reach, forward from
+            // the committed primary (#1460). An install only fills absent roots; an
+            // update (#1244) additionally switches a secondary that still holds the
+            // provably clean previous version. Best-effort: a root blocked by a user
+            // file must not stall the index write, which is what actually makes the
+            // operation visible.
             try {
-                (0, install_apply_1.completeSecondarySkillInstallRoots)(worktreePath, (0, fs_1.realpathSync)(worktreePath), entry.target.skillId);
+                if (entry.operation === 'update') {
+                    (0, updater_1.completeSecondarySkillUpdateRoots)(worktreePath, (0, fs_1.realpathSync)(worktreePath), entry.target.skillId);
+                }
+                else {
+                    (0, install_apply_1.completeSecondarySkillInstallRoots)(worktreePath, (0, fs_1.realpathSync)(worktreePath), entry.target.skillId);
+                }
             }
             catch (error) {
                 reconcileLogger.warn('skill-secondary-root-convergence-failed', {