commandmate 0.21.4 → 0.22.0

package/dist/server/src/lib/hooks/hook-settings-generator.js

@@ -0,0 +1,411 @@
+"use strict";
+/**
+ * The `--settings` payload CommandMate injects when it starts a Claude session
+ * (Issue #1722).
+ *
+ * Issue #1549 gave the server a receiver for structured agent events and a
+ * relay script to post them, but left the wiring to the operator: the events
+ * only existed on machines where somebody had edited `~/.claude/settings.json`
+ * by hand. This module closes that gap by handing Claude its own hook config at
+ * launch, per (worktreeId, instanceId).
+ *
+ * Four facts from the live verification in Issue #1721
+ * (`docs/design/agent-hooks-live-verification.md`) shape everything below. They
+ * are not in Claude Code's documentation, and three of the four fail *silently*
+ * when ignored:
+ *
+ *  - **`SessionStart` silently ignores `type: "http"`** (D1). The debug log says
+ *    `HTTP hooks are not supported for SessionStart`; stdout and the TUI say
+ *    nothing at all. So `SessionStart` — and only `SessionStart` — goes through
+ *    a `type: "command"` relay.
+ *  - **`$VAR` in `headers` expands only for names listed in `allowedEnvVars`**
+ *    (D7). A bearer header without the matching entry authenticates as the
+ *    literal string `$CM_AUTH_TOKEN` and 401s.
+ *  - **`--settings` hooks are concatenated with the user's own, not substituted
+ *    for them**, and `~/.claude/settings.json` is left byte-identical. Manual
+ *    Stop hooks from #1549 keep firing; see `agent-event-state`'s dedup for
+ *    what happens when both arrive.
+ *  - **Every hook failure is fail-open.** A refused connection or a timeout
+ *    costs the event, never the session.
+ *
+ * The generated file is written rather than passed inline. `--settings` does
+ * accept a JSON string (D2), but the launch command travels to the CLI through
+ * `tmux send-keys` as a single line, and a ~1 KB argument of braces, quotes and
+ * a deliberately unexpanded `$CM_AUTH_TOKEN` is a worse thing to put on that
+ * line than a path.
+ *
+ * @module lib/hooks/hook-settings-generator
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PERMISSION_DENY_RULES = exports.TOOL_USE_MATCHER = exports.NOTIFICATION_MATCHER = exports.AUTH_TOKEN_ENV_VAR = exports.PERMISSION_REQUEST_TIMEOUT_SECONDS = exports.HOOK_TIMEOUT_SECONDS = exports.PERMISSION_REQUEST_PATH = exports.AGENT_EVENT_PATH = void 0;
+exports.isHookInjectionEnabled = isHookInjectionEnabled;
+exports.isAuthTokenExpected = isAuthTokenExpected;
+exports.getHookSettingsDirectory = getHookSettingsDirectory;
+exports.resolveTargetInstanceId = resolveTargetInstanceId;
+exports.getHookSettingsPath = getHookSettingsPath;
+exports.buildAgentEventUrl = buildAgentEventUrl;
+exports.buildPermissionRequestUrl = buildPermissionRequestUrl;
+exports.resolveRelayScriptPath = resolveRelayScriptPath;
+exports.shellQuote = shellQuote;
+exports.buildSessionStartCommand = buildSessionStartCommand;
+exports.buildAgentHookSettings = buildAgentHookSettings;
+exports.writeAgentHookSettings = writeAgentHookSettings;
+exports.buildClaudeLaunchCommand = buildClaudeLaunchCommand;
+const crypto_1 = require("crypto");
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path_1 = require("path");
+const env_1 = require("../../lib/env");
+const types_1 = require("../../lib/cli-tools/types");
+const permission_request_payload_1 = require("../../lib/hooks/permission-request-payload");
+const logger_1 = require("../../lib/logger");
+const logger = (0, logger_1.createLogger)('lib/hooks/hook-settings-generator');
+/** Loopback: the agent runs on the machine the server runs on, whatever CM_BIND says. */
+const HOOK_HOST = '127.0.0.1';
+/** Receiver path. Mirrors `src/app/api/hooks/agent-event/route.ts`. */
+exports.AGENT_EVENT_PATH = '/api/hooks/agent-event';
+/**
+ * Auto-Yes v2 receiver (Issue #1724). Mirrors
+ * `src/app/api/hooks/permission-request/route.ts`.
+ *
+ * Separate from {@link AGENT_EVENT_PATH} because the two have opposite
+ * contracts: that one is fire-and-forget, this one blocks the agent until it
+ * answers and its body is obeyed.
+ */
+exports.PERMISSION_REQUEST_PATH = '/api/hooks/permission-request';
+/**
+ * Seconds a hook may block the agent.
+ *
+ * The receiver answers 202 without doing any work of its own, so this only ever
+ * matters when the server is wedged or gone. It is well under the 30 s Claude
+ * defaults to for `UserPromptSubmit`, which is the one event whose hook the
+ * human is sitting and waiting for.
+ */
+exports.HOOK_TIMEOUT_SECONDS = 5;
+/**
+ * Seconds `PermissionRequest` may block the agent (Issue #1724).
+ *
+ * Claude's default for an `http` hook is 600 s, and there is no `async` for
+ * http (D4/§5.3.6), so this number is how long a wedged server delays every
+ * approval dialog on the machine. The receiver decides from in-memory Auto-Yes
+ * state and a TTL-cached policy, so the budget is generous by orders of
+ * magnitude; it is small because the failure mode it bounds is the server being
+ * gone, and a hook failure is fail-open — the dialog appears, five seconds late.
+ */
+exports.PERMISSION_REQUEST_TIMEOUT_SECONDS = 5;
+/**
+ * Environment variable carrying the bearer token, per
+ * `docs/user-guide/agent-event-hooks.md`. Must appear in `allowedEnvVars` for
+ * the `$`-reference in `headers` to expand at all (D7).
+ */
+exports.AUTH_TOKEN_ENV_VAR = 'CM_AUTH_TOKEN';
+/**
+ * `Notification` matcher.
+ *
+ * Matched against the payload's `notification_type`, not its human-facing
+ * `message` (D3). A matcher that names nothing is not an error — it simply
+ * fires zero times — so a typo here is another silent failure.
+ */
+exports.NOTIFICATION_MATCHER = 'permission_prompt|idle_prompt';
+/**
+ * `PreToolUse` / `PostToolUse` matcher (Issue #1726).
+ *
+ * Matched against `tool_name`. Deliberately the single tool whose input this
+ * server has a use for: `AskUserQuestion` is the only call whose arguments *are*
+ * the thing the human has to answer, and a matcher covering every tool would
+ * post two payloads per tool call for nothing — on a hot loop that is two
+ * requests per `Read`, each of which blocks the agent for as long as the
+ * receiver takes.
+ */
+exports.TOOL_USE_MATCHER = permission_request_payload_1.ASK_USER_QUESTION_TOOL;
+/**
+ * Bash spellings this server refuses to let an agent run (Issue #1739).
+ *
+ * On 2026-08-06 a delegated worker restarted its own isolated server with
+ * `pkill -f "node dist/server/server.js"`. `-f` matches the whole command line,
+ * so it also hit the operator's production server on port 3000 and the global
+ * instance on 60301 — two processes the worker did not know existed and could
+ * not see. Nothing was recovered until a human rebuilt and restarted by hand.
+ *
+ * Three earlier layers were in place and none of them stopped it:
+ *
+ *  - The delegation contract said "do not touch port 3000". That is a rule about
+ *    the *target*, and the worker's subjective target was its own server; the
+ *    blast radius is exactly what a pattern kill hides from its caller.
+ *  - A permission dialog did appear — and Auto-Yes approved it. Auto-Yes v2
+ *    answers the `PermissionRequest` hook (#1724), so anything that reaches a
+ *    dialog reaches its verdict.
+ *  - The contract's `autoYes.denyPatterns` would have escalated to a human, but
+ *    escalation is only as good as the pattern somebody remembered to write.
+ *
+ * `permissions.deny` sits *underneath* all three: a denied rule is refused
+ * before a dialog exists, so there is no `PermissionRequest` for Auto-Yes to
+ * answer and no wording in a contract for a worker to reinterpret. Verified
+ * live in `docs/design/agent-hooks-permission-deny-verification.md`.
+ *
+ * The list is deliberately about the *means*, not the target: every entry names
+ * a way of selecting processes by pattern rather than by identity. Stopping a
+ * process you started yourself stays available through its pid — `kill
+ * "$(cat pidfile)"` matches nothing here — which is the idiom
+ * `docs/user-guide/agent-event-hooks.md` §0.7 tells operators to use.
+ *
+ * `kill -9` is on the list even though it takes a pid, because `kill -9 -1`
+ * signals every process the user owns and `kill -9 -<pgid>` a whole group; the
+ * default `kill` (SIGTERM) is untouched, so the graceful spelling of the same
+ * intent is the one that survives.
+ */
+exports.PERMISSION_DENY_RULES = [
+    'Bash(pkill:*)',
+    'Bash(killall:*)',
+    'Bash(kill -9:*)',
+];
+/** Relay script shipped with the package (`files: ["scripts/hooks/"]`). */
+const RELAY_SCRIPT_RELATIVE_PATH = (0, path_1.join)('scripts', 'hooks', 'cmate-agent-event.sh');
+/**
+ * Whether to inject at all. `CM_AGENT_HOOKS_INJECT=0` is the rollback switch:
+ * sessions start exactly as they did before this Issue.
+ */
+function isHookInjectionEnabled() {
+    return process.env.CM_AGENT_HOOKS_INJECT !== '0';
+}
+/**
+ * Whether the agent's environment is expected to carry a bearer token.
+ *
+ * The server only ever sees `CM_AUTH_TOKEN_HASH`, so it cannot read the token
+ * itself — but a configured hash means every request to this receiver needs one,
+ * and the agent inherits the server's environment through tmux.
+ */
+function isAuthTokenExpected() {
+    return Boolean(process.env[exports.AUTH_TOKEN_ENV_VAR] || process.env.CM_AUTH_TOKEN_HASH);
+}
+/** Directory the generated settings files live in. */
+function getHookSettingsDirectory(options = {}) {
+    if (options.directory)
+        return options.directory;
+    const override = process.env.CM_AGENT_HOOKS_DIR;
+    if (override)
+        return override;
+    return (0, path_1.join)((0, os_1.homedir)(), '.commandmate', 'hooks');
+}
+/** The instance this settings file speaks for; primary when unspecified. */
+function resolveTargetInstanceId(target) {
+    const cliToolId = target.cliToolId ?? 'claude';
+    const instanceId = target.instanceId ?? cliToolId;
+    return instanceId;
+}
+/**
+ * Absolute path of the settings file for one (worktreeId, instanceId).
+ *
+ * The readable part is sanitised because it becomes a filename; the hash of the
+ * raw pair is appended so sanitisation cannot collapse two distinct instances
+ * onto one file. Deterministic: the same pair always names the same file, so a
+ * restart overwrites rather than accumulates.
+ */
+function getHookSettingsPath(target, options = {}) {
+    const cliToolId = target.cliToolId ?? 'claude';
+    const instanceId = resolveTargetInstanceId(target);
+    const slug = `${cliToolId}-${target.worktreeId}-${instanceId}`.replace(/[^a-zA-Z0-9_-]/g, '_');
+    const digest = (0, crypto_1.createHash)('sha256')
+        .update(JSON.stringify([cliToolId, target.worktreeId, instanceId]))
+        .digest('hex')
+        .slice(0, 12);
+    return (0, path_1.join)(getHookSettingsDirectory(options), `${slug.slice(0, 80)}-${digest}.json`);
+}
+/**
+ * Receiver URL with the correlation keys baked in.
+ *
+ * This is the whole of the instance correlation. `cwd` cannot do the job —
+ * `claude` and `claude-2` in the same worktree report the identical directory,
+ * which is why `route.ts` had to hard-code the primary instance — and
+ * `session_id` cannot either, because `/clear` issues a new one mid-session
+ * while the instance stays the same (D7 §1.1). The URL is fixed at injection
+ * time and outlives both.
+ */
+function buildAgentEventUrl(target, options = {}) {
+    return buildReceiverUrl(exports.AGENT_EVENT_PATH, target, options);
+}
+/**
+ * Auto-Yes v2 receiver URL, with the same correlation keys baked in
+ * (Issue #1724).
+ *
+ * They matter more here than on the event path: a verdict applied to the wrong
+ * instance is an approval the operator never asked for, and `cwd` cannot tell
+ * `claude` from `claude-2`.
+ */
+function buildPermissionRequestUrl(target, options = {}) {
+    return buildReceiverUrl(exports.PERMISSION_REQUEST_PATH, target, options);
+}
+function buildReceiverUrl(path, target, options) {
+    const cliToolId = target.cliToolId ?? 'claude';
+    const port = options.port ?? (0, env_1.getServerPort)();
+    const params = new URLSearchParams({
+        tool: cliToolId,
+        worktreeId: target.worktreeId,
+        instanceId: resolveTargetInstanceId(target),
+    });
+    return `http://${HOOK_HOST}:${port}${path}?${params.toString()}`;
+}
+/** Absolute path of the shipped relay script, or null when it is not on disk. */
+function resolveRelayScriptPath() {
+    const candidate = (0, path_1.resolve)(process.cwd(), RELAY_SCRIPT_RELATIVE_PATH);
+    return (0, fs_1.existsSync)(candidate) ? candidate : null;
+}
+/** Wrap a value so a POSIX shell reproduces it byte-for-byte. */
+function shellQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function buildHttpHandler(url, withAuthHeader, timeout = exports.HOOK_TIMEOUT_SECONDS) {
+    const headers = { 'Content-Type': 'application/json' };
+    const handler = {
+        type: 'http',
+        url,
+        headers,
+        timeout,
+    };
+    if (withAuthHeader) {
+        headers.Authorization = `Bearer $${exports.AUTH_TOKEN_ENV_VAR}`;
+        // D7: without this the header is sent as the literal `$CM_AUTH_TOKEN`.
+        handler.allowedEnvVars = [exports.AUTH_TOKEN_ENV_VAR];
+    }
+    return handler;
+}
+/**
+ * The `SessionStart` relay command (D1: http is skipped in silence there).
+ *
+ * Prefers the shipped script, which already knows how to read Claude's stdin
+ * payload and how to fail open. When the package layout puts it out of reach,
+ * an inline `curl` posts the same payload to the same URL — the receiver reads
+ * Claude's native shape as well as the script's.
+ */
+function buildSessionStartCommand(target, options = {}) {
+    const url = buildAgentEventUrl(target, options);
+    const withAuthHeader = options.withAuthHeader ?? isAuthTokenExpected();
+    const relay = options.relayScriptPath === undefined ? resolveRelayScriptPath() : options.relayScriptPath;
+    if (relay) {
+        return [
+            shellQuote(relay),
+            '--tool',
+            shellQuote(target.cliToolId ?? 'claude'),
+            '--event',
+            'session_start',
+            '--worktree-id',
+            shellQuote(target.worktreeId),
+            '--instance-id',
+            shellQuote(resolveTargetInstanceId(target)),
+            '--url',
+            shellQuote(url),
+            '--stdin-json',
+        ].join(' ');
+    }
+    const auth = withAuthHeader ? ` -H "Authorization: Bearer $${exports.AUTH_TOKEN_ENV_VAR}"` : '';
+    return (`curl -sS -m ${exports.HOOK_TIMEOUT_SECONDS} -X POST ` +
+        `-H 'Content-Type: application/json'${auth} ` +
+        `--data-binary @- ${shellQuote(url)} >/dev/null 2>&1 || true`);
+}
+/**
+ * The settings object handed to `claude --settings`.
+ *
+ * Deterministic for a given (worktreeId, instanceId, port): callers rely on
+ * regenerating it producing the same file.
+ *
+ * `PermissionRequest` is registered unconditionally (Issue #1724) — it is *not*
+ * gated on Auto-Yes being enabled. The receiver answers no-decision whenever
+ * Auto-Yes is off, and no-decision is measured to be indistinguishable from
+ * having no hook at all (#1721 D5), so a toggle here would only add a second
+ * place for the feature to be silently off. It also has to be: Auto-Yes is
+ * enabled mid-session, and a hook registered at launch is the only kind this
+ * session will have.
+ *
+ * `PreToolUse` / `PostToolUse` are registered for `AskUserQuestion` alone (Issue
+ * #1726), and they post to the *event* receiver rather than the permission one:
+ * they are observations, not verdicts. The distinction is not academic — a
+ * `PreToolUse` response body can block or redirect a tool call, and answering
+ * one for a question the human has not seen yet is the last thing this feature
+ * wants to be able to do. The event route answers 202 with a fixed body and
+ * cannot decide anything.
+ *
+ * `permissions.deny` rides along in the same file (Issue #1739). It is not a
+ * hook and nothing here delivers it — Claude enforces it itself, before any
+ * `PermissionRequest` exists — which is precisely why it belongs next to the
+ * hook that Auto-Yes answers rather than in the contract layer above it.
+ */
+function buildAgentHookSettings(target, options = {}) {
+    const url = buildAgentEventUrl(target, options);
+    const withAuthHeader = options.withAuthHeader ?? isAuthTokenExpected();
+    const http = () => buildHttpHandler(url, withAuthHeader);
+    const permissionHttp = () => buildHttpHandler(buildPermissionRequestUrl(target, options), withAuthHeader, exports.PERMISSION_REQUEST_TIMEOUT_SECONDS);
+    return {
+        hooks: {
+            SessionStart: [
+                {
+                    hooks: [
+                        {
+                            type: 'command',
+                            command: buildSessionStartCommand(target, options),
+                            timeout: exports.HOOK_TIMEOUT_SECONDS,
+                        },
+                    ],
+                },
+            ],
+            UserPromptSubmit: [{ hooks: [http()] }],
+            Stop: [{ hooks: [http()] }],
+            Notification: [{ matcher: exports.NOTIFICATION_MATCHER, hooks: [http()] }],
+            SessionEnd: [{ hooks: [http()] }],
+            // Issue #1726. The event receiver, not the permission one: observation.
+            PreToolUse: [{ matcher: exports.TOOL_USE_MATCHER, hooks: [http()] }],
+            PostToolUse: [{ matcher: exports.TOOL_USE_MATCHER, hooks: [http()] }],
+            // Issue #1724. Points at its own receiver, not the event one.
+            PermissionRequest: [{ hooks: [permissionHttp()] }],
+        },
+        // Issue #1739. Enforced by Claude below the hook layer: no dialog, so no
+        // PermissionRequest, so nothing for Auto-Yes to approve.
+        permissions: { deny: [...exports.PERMISSION_DENY_RULES] },
+    };
+}
+/**
+ * Write the settings file and return its absolute path.
+ *
+ * The directory is created 0700 and the file 0600: it names the endpoint and
+ * the instance of every session on the machine, which is nobody else's business
+ * even though it holds no secret.
+ */
+function writeAgentHookSettings(target, options = {}) {
+    const settingsPath = getHookSettingsPath(target, options);
+    (0, fs_1.mkdirSync)(getHookSettingsDirectory(options), { recursive: true, mode: 0o700 });
+    (0, fs_1.writeFileSync)(settingsPath, `${JSON.stringify(buildAgentHookSettings(target, options), null, 2)}\n`, { mode: 0o600 });
+    return settingsPath;
+}
+/**
+ * The command that launches Claude for this instance.
+ *
+ * Never throws. Injection is an enhancement to a session that has to start
+ * regardless, so a directory that cannot be written costs the structured
+ * events and nothing else — the same fail-open posture the hooks themselves
+ * have (§1.1 of the verification report).
+ *
+ * @param claudePath - Resolved Claude CLI path
+ * @returns `<claude> --settings <file>`, or bare `<claude>` when injection is
+ *   off or could not be prepared
+ */
+function buildClaudeLaunchCommand(claudePath, target, options = {}) {
+    if (!isHookInjectionEnabled()) {
+        return claudePath;
+    }
+    if (!(0, types_1.isValidInstanceId)(resolveTargetInstanceId(target))) {
+        // The instance id is about to be a URL parameter the receiver re-validates;
+        // a value that would be rejected there is not worth injecting.
+        logger.warn('hook-settings-invalid-instance-id', { worktreeId: target.worktreeId });
+        return claudePath;
+    }
+    try {
+        const settingsPath = writeAgentHookSettings(target, options);
+        return `${shellQuote(claudePath)} --settings ${shellQuote(settingsPath)}`;
+    }
+    catch (error) {
+        logger.warn('hook-settings-write-failed', {
+            worktreeId: target.worktreeId,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return claudePath;
+    }
+}

package/dist/server/src/lib/hooks/permission-request-payload.js

@@ -0,0 +1,144 @@
+"use strict";
+/**
+ * Reading Claude Code's `PermissionRequest` payload (Issue #1724).
+ *
+ * The shape here is taken from a real session, not from the documentation:
+ * `tests/fixtures/hooks/claude/permission-request.json` and
+ * `permission-request-ask-user-question.json`, captured by the Issue #1721
+ * spike. Two documented fields do not exist in practice (D2 of
+ * `docs/design/agent-hooks-live-verification.md`):
+ *
+ *  - **`tool_use_id` is absent.** Nothing here may key off it. Correlation with
+ *    `PreToolUse` is `prompt_id` + `tool_name` + `tool_input`.
+ *  - **`permission_requirements` is absent**; `permission_suggestions`
+ *    (`addRules` candidates) appears instead. It is carried through for the
+ *    audit trail and is never a decision input — it is Claude's *suggestion*,
+ *    which is exactly the thing the adjudicator is supposed to judge.
+ *
+ * Parsing is strict on purpose. Anything this module cannot vouch for becomes
+ * `null`, and the caller turns `null` into a no-decision — the fail-safe side,
+ * because the alternative to a dialog is executing a command.
+ *
+ * @module lib/hooks/permission-request-payload
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_TOOL_NAME_LENGTH = exports.ASK_USER_QUESTION_TOOL = exports.PERMISSION_REQUEST_EVENT_NAME = void 0;
+exports.parsePermissionRequestPayload = parsePermissionRequestPayload;
+exports.collectToolInputMatchTexts = collectToolInputMatchTexts;
+/** `hook_event_name` this receiver accepts. Anything else is not ours to judge. */
+exports.PERMISSION_REQUEST_EVENT_NAME = 'PermissionRequest';
+/**
+ * The tool whose permission request is never adjudicated (Issue #1726 owns it).
+ *
+ * `AskUserQuestion` raises a `PermissionRequest` like any other tool, but the
+ * spike measured that **returning `allow` still shows the picker** (§5.6). So an
+ * allow here buys nothing and an allow is not an answer to a question — the two
+ * reasons point the same way.
+ */
+exports.ASK_USER_QUESTION_TOOL = 'AskUserQuestion';
+/** Bound on `tool_name`; it is a Claude-side identifier, logged and stored. */
+exports.MAX_TOOL_NAME_LENGTH = 128;
+function readString(source, key) {
+    const value = source[key];
+    return typeof value === 'string' && value !== '' ? value : null;
+}
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * Parse a `PermissionRequest` body.
+ *
+ * @param body - Whatever was posted to the receiver
+ * @returns The payload, or null when it is not a `PermissionRequest` this
+ *   server recognises — which the caller must treat as "no decision".
+ */
+function parsePermissionRequestPayload(body) {
+    if (!isPlainObject(body))
+        return null;
+    if (body.hook_event_name !== exports.PERMISSION_REQUEST_EVENT_NAME)
+        return null;
+    const toolName = readString(body, 'tool_name');
+    if (!toolName || toolName.length > exports.MAX_TOOL_NAME_LENGTH)
+        return null;
+    // An absent or non-object `tool_input` means there is nothing to judge the
+    // deny patterns against, so the request cannot be adjudicated safely.
+    if (!isPlainObject(body.tool_input))
+        return null;
+    return {
+        toolName,
+        toolInput: body.tool_input,
+        promptId: readString(body, 'prompt_id'),
+        sessionId: readString(body, 'session_id'),
+        permissionMode: readString(body, 'permission_mode'),
+        permissionSuggestions: Array.isArray(body.permission_suggestions)
+            ? body.permission_suggestions
+            : null,
+    };
+}
+/**
+ * The arguments of each tool that carry what is actually being asked for.
+ *
+ * "Primary arguments" per the Issue: `Bash` is judged on its command line, a
+ * file tool on its path. Bulk payloads (`Write.content`, `Edit.new_string`) are
+ * deliberately excluded — a deny pattern is a statement about the *action*, and
+ * matching it against a file body would suppress an edit for quoting the very
+ * string the contract is trying to keep out of the shell.
+ *
+ * `Bash.description` is included: it is model-authored prose about the same
+ * command, so including it can only ever suppress more, never less.
+ */
+const PRIMARY_TOOL_INPUT_KEYS = {
+    Bash: ['command', 'description'],
+    BashOutput: ['bash_id'],
+    KillShell: ['shell_id'],
+    Read: ['file_path'],
+    Write: ['file_path'],
+    Edit: ['file_path'],
+    NotebookEdit: ['notebook_path'],
+    Glob: ['pattern', 'path'],
+    Grep: ['pattern', 'path'],
+    WebFetch: ['url', 'prompt'],
+    WebSearch: ['query'],
+    SlashCommand: ['command'],
+    Task: ['description', 'subagent_type', 'prompt'],
+};
+/**
+ * Every string a deny pattern is matched against for one request.
+ *
+ * **This is the whole of the matching surface, and it comes from a single
+ * request's `tool_input`.** Issue #1699 is the reason that sentence is worth
+ * writing down: the screen-based path used to match deny patterns against
+ * `instructionText`, a scrollback window, so an `rm -rf` a human had approved
+ * several turns earlier stayed on the pane and went on matching — suppressing
+ * every later approval, including edits with nothing to do with it, until the
+ * line scrolled off. A worker sat silent for an hour. Nothing on the pane, and
+ * nothing from any earlier request, can reach this function.
+ *
+ * Unknown tools fall back to the serialised input rather than to nothing:
+ * over-matching costs a dialog, under-matching costs the protection a contract
+ * asked for. The same fallback covers a known tool whose primary arguments are
+ * missing or non-string, so a Claude-side shape change cannot silently empty
+ * the surface.
+ *
+ * @param toolName - `tool_name` from the payload
+ * @param toolInput - `tool_input` from the payload
+ * @returns Texts to match, never empty for a non-empty input
+ */
+function collectToolInputMatchTexts(toolName, toolInput) {
+    const keys = PRIMARY_TOOL_INPUT_KEYS[toolName];
+    if (keys) {
+        const texts = keys
+            .map(key => toolInput[key])
+            .filter((value) => typeof value === 'string' && value !== '');
+        if (texts.length > 0)
+            return texts;
+    }
+    try {
+        return [JSON.stringify(toolInput) ?? ''];
+    }
+    catch {
+        // Circular or otherwise unserialisable input: judged on its keys alone, so
+        // the caller still gets a non-empty surface instead of a silent allow.
+        return [Object.keys(toolInput).join(' ')];
+    }
+}

package/dist/server/src/lib/polling/auto-yes-resolver.js

@@ -20,6 +20,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MAX_DENY_MATCH_TEXT_LENGTH = exports.MAX_DENY_PATTERN_LENGTH = void 0;
+exports.evaluatePolicyAgainstTexts = evaluatePolicyAgainstTexts;
 exports.resolveAutoAnswerWithPolicy = resolveAutoAnswerWithPolicy;
 exports.resolveAutoAnswer = resolveAutoAnswer;
 const auto_yes_config_1 = require("../../config/auto-yes-config");
@@ -85,7 +86,7 @@ function collectDenyMatchTexts(promptData) {
     else {
         texts.push(...promptData.options);
     }
-    return texts.map(text => text.length > exports.MAX_DENY_MATCH_TEXT_LENGTH ? text.slice(0, exports.MAX_DENY_MATCH_TEXT_LENGTH) : text);
+    return texts;
 }
 /**
  * Test the prompt against every deny pattern.
@@ -95,11 +96,11 @@ function collectDenyMatchTexts(promptData) {
  * same ReDoS defence the stop-pattern path uses. A pattern that fails screening
  * — or whose execution throws — is reported as `unusable`, not skipped.
  */
-function evaluateDenyPatterns(promptData, patterns) {
+function evaluateDenyPatterns(rawTexts, patterns) {
     if (patterns.length === 0) {
         return { outcome: 'no-match' };
     }
-    const texts = collectDenyMatchTexts(promptData);
+    const texts = rawTexts.map(text => text.length > exports.MAX_DENY_MATCH_TEXT_LENGTH ? text.slice(0, exports.MAX_DENY_MATCH_TEXT_LENGTH) : text);
     for (const pattern of patterns) {
         if (pattern.length > exports.MAX_DENY_PATTERN_LENGTH || !(0, auto_yes_config_1.validateStopPattern)(pattern).valid) {
             return { outcome: 'unusable', pattern };
@@ -118,21 +119,33 @@ function evaluateDenyPatterns(promptData, patterns) {
     return { outcome: 'no-match' };
 }
 /**
- * Decide whether the policy forbids answering this prompt.
+ * Decide whether the policy forbids answering, given the prompt type and the
+ * exact texts the deny patterns are to be judged against.
+ *
+ * Split out of {@link evaluatePolicy} for Issue #1724: the `PermissionRequest`
+ * hook adjudicates a structured tool call rather than a screen-scraped prompt,
+ * so it has no {@link PromptData} to pass — but it must reach *the same verdict*
+ * the screen path would. Two implementations of this ordering would be two
+ * chances for the hook to be quietly more permissive than the poller, and the
+ * hook's verdict is executed without a dialog.
  *
  * Deny patterns are honoured even when `mode` is null: a contract that lists
  * them has stated a policy, and a listed pattern that quietly did nothing is the
  * worst failure a contract can have. `mode` null with no deny patterns — what
  * the parser produces for a contract with no `autoYes` block — reaches none of
  * these branches and leaves behaviour identical.
+ *
+ * @param promptType - How the prompt would be classified on screen
+ * @param denyMatchTexts - The only strings deny patterns are matched against
+ * @param policy - Contract policy; null/undefined permits everything
  */
-function evaluatePolicy(promptData, policy) {
+function evaluatePolicyAgainstTexts(promptType, denyMatchTexts, policy) {
     if (!policy)
         return null;
     if (policy.mode === 'off') {
         return { reason: 'mode-off' };
     }
-    const deny = evaluateDenyPatterns(promptData, policy.denyPatterns);
+    const deny = evaluateDenyPatterns(denyMatchTexts, policy.denyPatterns);
     if (deny.outcome === 'match') {
         return { reason: 'deny-pattern', pattern: deny.pattern };
     }
@@ -140,15 +153,17 @@ function evaluatePolicy(promptData, policy) {
         return { reason: 'deny-pattern-unusable', pattern: deny.pattern };
     }
     if (policy.mode === 'safe') {
-        return promptData.type === 'yes_no' ? null : { reason: 'type-not-allowed' };
+        return promptType === 'yes_no' ? null : { reason: 'type-not-allowed' };
     }
     if (policy.mode === 'allow-listed') {
-        return policy.allowPromptTypes.includes(promptData.type)
-            ? null
-            : { reason: 'type-not-allowed' };
+        return policy.allowPromptTypes.includes(promptType) ? null : { reason: 'type-not-allowed' };
     }
     return null;
 }
+/** {@link evaluatePolicyAgainstTexts} over a detected on-screen prompt. */
+function evaluatePolicy(promptData, policy) {
+    return evaluatePolicyAgainstTexts(promptData.type, collectDenyMatchTexts(promptData), policy);
+}
 /**
  * Resolve the automatic answer, reporting whether a policy withheld it.
  *

package/dist/server/src/lib/polling/auto-yes-suppression-state.js

@@ -28,7 +28,8 @@ exports.getLastPolicySuppression = getLastPolicySuppression;
 exports.clearPolicySuppressions = clearPolicySuppressions;
 const auto_yes_state_1 = require("../../lib/auto-yes-state");
 /** compositeKey -> the most recent policy suppression for that session. */
-const lastPolicySuppressions = new Map();
+const lastPolicySuppressions = globalThis.__autoYesPolicySuppressions ??
+    (globalThis.__autoYesPolicySuppressions = new Map());
 /**
  * Record that the policy withheld an answer for `instanceId`'s current prompt.
  *