commandmate 0.22.2 → 0.23.0

package/dist/server/src/config/log-config.js

@@ -18,6 +18,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getLogDir = getLogDir;
 const path_1 = __importDefault(require("path"));
 const env_1 = require("../lib/env");
+const safe_directory_1 = require("./safe-directory");
 /**
  * Get the log directory path.
  *
@@ -25,6 +26,13 @@ const env_1 = require("../lib/env");
  * 1. CM_LOG_DIR environment variable (with MCBD_LOG_DIR fallback via getEnvByKey)
  * 2. Default: `${process.cwd()}/data/logs`
  *
+ * Issue #1774: a CM_LOG_DIR inside `/proc`, `/sys` or `/dev` falls back to the
+ * default with a warning. `log-manager.ensureLogDirectory()` calls
+ * `fs.mkdir(dir, {recursive:true})` on the result, and on Linux that promise
+ * never settles for such a path — it holds a libuv threadpool thread for the
+ * life of the process instead. Throwing is not an option here: the log
+ * directory is where the complaint would have to go.
+ *
  * @returns Absolute path to the log directory
  *
  * @example
@@ -37,5 +45,6 @@ const env_1 = require("../lib/env");
  * ```
  */
 function getLogDir() {
-    return (0, env_1.getEnvByKey)('CM_LOG_DIR') || path_1.default.join(process.cwd(), 'data', 'logs');
+    const fallback = path_1.default.join(process.cwd(), 'data', 'logs');
+    return (0, safe_directory_1.resolveSafeDirectory)((0, env_1.getEnvByKey)('CM_LOG_DIR'), fallback, 'CM_LOG_DIR');
 }

package/dist/server/src/config/safe-directory.js

@@ -0,0 +1,103 @@
+"use strict";
+/**
+ * The one place a configured directory becomes a directory this process is
+ * willing to create (Issue #1774).
+ *
+ * ## What this is defending against
+ *
+ * Pointing a configured path at `/proc`, `/sys` or `/dev` does not make
+ * CommandMate fail — it makes it **stop**. procfs answers a `mkdir` for a child
+ * that cannot exist with ENOENT rather than EPERM, and Node's recursive mkdir
+ * reads ENOENT as "the parent is missing", creates the parent, and retries; the
+ * parent is created with EEXIST, so one level is enough to loop. Measured in a
+ * container: `mkdirSync('/proc/x/y', {recursive:true})` had not returned after
+ * 25s at 100.4% CPU, and `fs.promises.mkdir` on the same path never settled and
+ * held a libuv threadpool thread (there are four) forever. The synchronous form
+ * stops the event loop outright, which is also why the `try/catch` these call
+ * sites already have does nothing: control never reaches it. There is no error
+ * log, no OOM and no timeout — the process simply goes quiet. PR #1773's CI job
+ * ran 5h31m that way.
+ *
+ * On macOS none of the three paths exist, so the same call throws instantly and
+ * everything looks fine. The failure is Linux- and container-only.
+ *
+ * ## Why a resolver rather than a check at each mkdir
+ *
+ * Five settings reach a recursive mkdir this way (`CM_AGENT_HOOKS_DIR`,
+ * `CM_LOG_DIR`, `CODEX_HOME`, `COPILOT_HOME`, `CM_OPENCODE_PORT_FILE`), and
+ * three of the five arrived with Phase 4 (#1760 / #1761 / #1763) as copies of
+ * the first. Guarding the mkdir sites individually invites a sixth copy; putting
+ * the guard on the *resolution* of the value means a new tool is protected by
+ * calling the resolver its siblings already call.
+ *
+ * ## Why it never throws
+ *
+ * A bad log directory must not take out logging, and hook injection is
+ * fail-open by design (`hook-settings-generator.buildClaudeLaunchCommand`).
+ * Falling back to the built-in default and saying so keeps a misconfigured
+ * server running with its events intact.
+ *
+ * @module config/safe-directory
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resetSafeDirectoryWarnings = resetSafeDirectoryWarnings;
+exports.resolveSafeDirectory = resolveSafeDirectory;
+const logger_1 = require("../lib/logger");
+const system_directories_1 = require("./system-directories");
+const logger = (0, logger_1.createLogger)('safe-directory');
+/**
+ * Settings already warned about, so a rejection is reported once rather than on
+ * every call.
+ *
+ * `getLogDir()` runs on the path of every log write; an unconditional warning
+ * would turn one misconfigured variable into a log flood, in the log directory
+ * that is already not the one the operator asked for.
+ */
+const warnedRejections = new Set();
+/** Forget which rejections have been warned about. For tests. */
+function resetSafeDirectoryWarnings() {
+    warnedRejections.clear();
+}
+/**
+ * The directory to actually use for `candidate`, which is `candidate` unless
+ * using it would hang the process.
+ *
+ * Pure with respect to the filesystem in the sense that matters here: it reads
+ * (symlink resolution) but creates nothing, so it is safe to call — and to test
+ * — with a path that no `mkdir` could survive.
+ *
+ * A *file* path is a valid candidate. The check is prefix-based, so a file
+ * inside a virtual filesystem is rejected exactly as its directory would be;
+ * `CM_OPENCODE_PORT_FILE` relies on that.
+ *
+ * @param candidate - The configured path. Empty or undefined means "unset"
+ * @param fallback - The built-in default to use when the candidate is refused
+ * @param source - What supplied the candidate, e.g. `'CM_LOG_DIR'`. Appears in
+ *   the warning, because the operator's next question is which setting to fix
+ * @returns `candidate`, or `fallback` when the candidate is inside `/proc`,
+ *   `/sys` or `/dev`
+ *
+ * @example
+ * ```typescript
+ * const fallback = join(homedir(), '.commandmate', 'hooks');
+ * return resolveSafeDirectory(process.env.CM_AGENT_HOOKS_DIR, fallback, 'CM_AGENT_HOOKS_DIR');
+ * ```
+ */
+function resolveSafeDirectory(candidate, fallback, source) {
+    if (!candidate)
+        return fallback;
+    if (!(0, system_directories_1.isVirtualFilesystemPath)(candidate))
+        return candidate;
+    const key = `${source}|${candidate}`;
+    if (!warnedRejections.has(key)) {
+        warnedRejections.add(key);
+        logger.warn('virtual-filesystem-path-rejected', {
+            source,
+            candidate,
+            fallback,
+            reason: 'A recursive mkdir under /proc, /sys or /dev never returns on Linux; ' +
+                'the built-in default is used instead (Issue #1774).',
+        });
+    }
+    return fallback;
+}

package/dist/server/src/config/system-directories.js

@@ -13,9 +13,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SYSTEM_DIRECTORIES = void 0;
+exports.VIRTUAL_FILESYSTEM_ROOTS = exports.SYSTEM_DIRECTORIES = void 0;
 exports.isPathWithin = isPathWithin;
 exports.isSystemDirectory = isSystemDirectory;
+exports.isVirtualFilesystemPath = isVirtualFilesystemPath;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 /**
@@ -36,6 +37,35 @@ exports.SYSTEM_DIRECTORIES = [
     '/sys',
     '/proc',
 ];
+/**
+ * The subset of {@link SYSTEM_DIRECTORIES} that is not a filesystem at all.
+ *
+ * Issue #1774: these three are kernel-backed namespaces, and their `mkdir`
+ * error codes are not the ones `fs` callers assume. procfs answers a `mkdir`
+ * for a child that cannot exist with **ENOENT rather than EPERM**, and Node's
+ * recursive mkdir reads ENOENT as "the parent is missing", so it creates the
+ * parent and retries — forever. Measured in a container: `mkdirSync('/proc/x/y',
+ * {recursive:true})` had not returned after 25s at 100.4% CPU; the promise from
+ * `fs.promises.mkdir` never settled and held a libuv threadpool thread (4 by
+ * default) for the life of the process. Neither logs anything, and the
+ * synchronous form stops the event loop, so a surrounding `try/catch` is never
+ * reached. On macOS the paths do not exist and the call throws at once, which
+ * is why this is invisible outside Linux and containers.
+ *
+ * Kept as a named subset rather than reusing the whole list because the two
+ * lists answer different questions. {@link isSystemDirectory} answers "may a
+ * database live here", and rejects `/tmp` and `/var` for that; but `/tmp` and
+ * `/var/log` are ordinary writable directories that a log or hook directory may
+ * legitimately be pointed at — `os.tmpdir()` is *inside* one on both platforms
+ * (`/tmp` on Linux, `/var/folders/…` on macOS), which is where every isolated
+ * test directory in this repository lives. Rejecting those would not prevent a
+ * hang; it would redirect isolated test runs and container deployments back
+ * onto the real `~/.codex` and `~/.commandmate`.
+ *
+ * `SYSTEM_DIRECTORIES` remains the superset — `tests/unit/config/system-directories.test.ts`
+ * pins that, so the two cannot drift apart.
+ */
+exports.VIRTUAL_FILESYSTEM_ROOTS = ['/proc', '/sys', '/dev'];
 /**
  * POSIX separator. SYSTEM_DIRECTORIES are POSIX absolute paths and this guard
  * protects POSIX platforms, so the boundary is always '/' rather than path.sep.
@@ -66,13 +96,14 @@ function isPathWithin(target, dir) {
  *
  * Mount layout does not change while the process runs, so this is computed once.
  */
-let resolvedSystemDirectoriesCache = null;
-function getSystemDirectoryCandidates() {
-    if (resolvedSystemDirectoriesCache !== null) {
-        return resolvedSystemDirectoriesCache;
+const resolvedDirectoryCandidatesCache = new Map();
+function getDirectoryCandidates(directories) {
+    const cached = resolvedDirectoryCandidatesCache.get(directories);
+    if (cached !== undefined) {
+        return cached;
     }
     const candidates = new Set();
-    for (const dir of exports.SYSTEM_DIRECTORIES) {
+    for (const dir of directories) {
         // Always keep the literal form: it must stay enforced even when the
         // directory does not exist on this platform (e.g. /proc and /sys on macOS).
         candidates.add(dir);
@@ -83,8 +114,9 @@ function getSystemDirectoryCandidates() {
             // Not present on this platform; the literal form still applies.
         }
     }
-    resolvedSystemDirectoriesCache = Array.from(candidates);
-    return resolvedSystemDirectoriesCache;
+    const resolved = Array.from(candidates);
+    resolvedDirectoryCandidatesCache.set(directories, resolved);
+    return resolved;
 }
 /**
  * Resolve symlinks in an absolute path, tolerating components that do not exist.
@@ -140,7 +172,40 @@ function resolvePhysicalPath(absolutePath) {
  * @returns true if the path is within a system directory
  */
 function isSystemDirectory(inputPath) {
+    return matchesAnyDirectory(inputPath, exports.SYSTEM_DIRECTORIES);
+}
+/**
+ * Check if a path is inside a virtual filesystem ({@link VIRTUAL_FILESYSTEM_ROOTS}).
+ *
+ * Issue #1774: the question `isSystemDirectory` cannot answer for a directory
+ * that is about to be created. A recursive `mkdir` under one of these roots does
+ * not fail — it hangs the process, unrecoverably and without a log line — so
+ * every path that reaches a `mkdir(…, {recursive:true})` has to be filtered
+ * through this first. See {@link VIRTUAL_FILESYSTEM_ROOTS} for the measurements
+ * and for why this is a subset of `SYSTEM_DIRECTORIES` rather than all of it.
+ *
+ * Matching is the same as `isSystemDirectory`: lexical *and* physical form, so a
+ * symlink that points into `/proc` is rejected along with a literal `/proc/…`.
+ * That is the direction that matters — a missed one hangs the server.
+ *
+ * Reads the filesystem (symlink resolution); it never creates anything, and
+ * `realpath` on a procfs path returns ENOENT immediately rather than spinning.
+ *
+ * @param inputPath - The path to check (relative paths are resolved against cwd)
+ * @returns true if a recursive mkdir for this path could spin
+ */
+function isVirtualFilesystemPath(inputPath) {
+    return matchesAnyDirectory(inputPath, exports.VIRTUAL_FILESYSTEM_ROOTS);
+}
+/**
+ * Shared matcher for {@link isSystemDirectory} and {@link isVirtualFilesystemPath}.
+ *
+ * @param inputPath - The path to check
+ * @param directories - Absolute directory prefixes to test against
+ * @returns true if either the lexical or the physical form lands in one of them
+ */
+function matchesAnyDirectory(inputPath, directories) {
     const lexicalPath = path_1.default.resolve(inputPath);
     const physicalPath = resolvePhysicalPath(lexicalPath);
-    return getSystemDirectoryCandidates().some((dir) => isPathWithin(lexicalPath, dir) || isPathWithin(physicalPath, dir));
+    return getDirectoryCandidates(directories).some((dir) => isPathWithin(lexicalPath, dir) || isPathWithin(physicalPath, dir));
 }

package/dist/server/src/lib/cli-tools/antigravity.js

@@ -16,6 +16,8 @@ const tmux_1 = require("../tmux/tmux");
 const submit_verified_sender_1 = require("./submit-verified-sender");
 const tmux_capture_cache_1 = require("../tmux/tmux-capture-cache");
 const cli_patterns_1 = require("../detection/cli-patterns");
+const sources_1 = require("../../lib/hooks/sources");
+const agent_session_lifecycle_1 = require("../../lib/session/agent-session-lifecycle");
 const logger_1 = require("../../lib/logger");
 const cli_tool_timing_config_1 = require("../../config/cli-tool-timing-config");
 const logger = (0, logger_1.createLogger)('cli-tools/antigravity');
@@ -116,6 +118,11 @@ class AntigravityTool extends base_1.BaseCLITool {
             logger.info('antigravity-session-exists');
             return;
         }
+        // Issue #1762: fence this instance's structured events off from the process
+        // that used to hold the same (worktree, tool, instance) key. Creation path
+        // only — the reuse branch above has already returned — and before the pane
+        // exists. Bumped even if the launch below then fails.
+        (0, agent_session_lifecycle_1.beginAgentSession)({ worktreeId, cliToolId: sources_1.ANTIGRAVITY_CLI_TOOL_ID, instanceId });
         try {
             // Create tmux session with large history buffer for agy output
             // (agy is inline-rendered and retains scrollback, like Codex)
@@ -127,8 +134,18 @@ class AntigravityTool extends base_1.BaseCLITool {
             });
             // Wait a moment for the session to be created
             await new Promise((resolve) => setTimeout(resolve, cli_tool_timing_config_1.TUI_SESSION_CREATE_WAIT_MS));
-            // Start agy in interactive mode, optionally pinned to a model
-            const launchCommand = model ? `agy --model ${shellSingleQuote(model)}` : 'agy';
+            // Start agy in interactive mode, optionally pinned to a model.
+            //
+            // Issue #1762: `prepareAgentLaunch` merges CommandMate's named hook into
+            // `~/.gemini/config/hooks.json` — agy's single global config, shared with
+            // gemini's tree and with whatever the user has in it — and prefixes
+            // `CM_HOOK_URL`. That variable is the *only* correlation channel agy has:
+            // its payloads carry no `cwd`, its hooks run in `~/.gemini/config`, and
+            // one file serves every worktree on the machine. `--model` is appended
+            // after, so the env prefix stays in front of the command.
+            // `CM_AGENT_HOOKS_INJECT=0` returns bare `agy`, unchanged from before.
+            const base = (0, agent_session_lifecycle_1.prepareAgentLaunch)({ worktreeId, cliToolId: sources_1.ANTIGRAVITY_CLI_TOOL_ID, instanceId }, this.command).command;
+            const launchCommand = model ? `${base} --model ${shellSingleQuote(model)}` : base;
             await (0, tmux_1.sendKeys)(sessionName, launchCommand, true);
             // Wait for agy to initialize
             await new Promise((resolve) => setTimeout(resolve, ANTIGRAVITY_INIT_WAIT_MS));

package/dist/server/src/lib/cli-tools/codex.js

@@ -5,12 +5,15 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CodexTool = void 0;
+exports.isCodexHooksReviewDialog = isCodexHooksReviewDialog;
 const base_1 = require("./base");
 const tmux_1 = require("../tmux/tmux");
 const submit_verified_sender_1 = require("./submit-verified-sender");
 const tmux_capture_cache_1 = require("../tmux/tmux-capture-cache");
 const cli_patterns_1 = require("../detection/cli-patterns");
 const logger_1 = require("../../lib/logger");
+const sources_1 = require("../../lib/hooks/sources");
+const agent_session_lifecycle_1 = require("../../lib/session/agent-session-lifecycle");
 const cli_tool_timing_config_1 = require("../../config/cli-tool-timing-config");
 const logger = (0, logger_1.createLogger)('cli-tools/codex');
 /**
@@ -28,6 +31,63 @@ const CODEX_POLL_INTERVAL_MS = 1000;
 const CODEX_INIT_MAX_ATTEMPTS = 30;
 /** Timeout for waiting for prompt before sending a message */
 const CODEX_PROMPT_WAIT_TIMEOUT_MS = 15000;
+/**
+ * Anchors of codex's "Hooks need review" dialog (Issue #1760, measured on
+ * codex-cli 0.147.0):
+ *
+ * ```
+ *  Hooks need review
+ *  5 hooks are new or changed.
+ *  Hooks can run outside the sandbox after you trust them.
+ *
+ * > 1. Review hooks
+ *   2. Trust all and continue
+ *   3. Continue without trusting (hooks won't run)
+ * ```
+ *
+ * It has to be handled here rather than in `getCodexActiveDialog`, which
+ * classifies it as `null`: its wording matches none of that function's three
+ * anchors (`Skip until next version` / `Do you trust` / `Press enter to
+ * continue`). Measured consequence of leaving it alone, on a pane with the
+ * generated `hooks.json` present: `isCodexPromptReady` stays false for the full
+ * 30-attempt window and the session is then handed to `sendMessage` still
+ * sitting on the dialog. Every launch, because "continue without trusting" is
+ * not remembered — verified by relaunching and getting the same screen.
+ *
+ * Both strings are required so a "hooks" mention elsewhere cannot select an
+ * option on a live prompt.
+ */
+const CODEX_HOOKS_REVIEW_ANCHORS = ['Hooks need review', 'Continue without trusting'];
+/**
+ * Option 3, "Continue without trusting (hooks won't run)".
+ *
+ * Not option 2. Trusting writes `[hooks.state."<file>:<event>:0:0"]` entries
+ * into the operator's own `~/.codex/config.toml` — the file that carries, among
+ * other things, the `notify` command a Computer Use integration runs — and
+ * granting that on someone's behalf is not this server's call. So a session
+ * starts with the hooks inert and the screen scraper doing exactly what it did
+ * before Issue #1760; the human enables them once through codex's own review
+ * screen, or an operator sets `CM_CODEX_HOOK_TRUST=bypass`.
+ *
+ * Sent alone, like the other numbered dialogs (Issue #890): codex confirms a
+ * numbered selection instantly, and a trailing Enter would land on the next
+ * screen. Verified live — the prompt was ready on the following poll.
+ */
+const CODEX_HOOKS_REVIEW_DECLINE_KEY = '3';
+/**
+ * Whether the pane is sitting on the hooks review dialog.
+ *
+ * Position-independent on purpose, unlike `getCodexActiveDialog`: the only
+ * caller checks `isCodexPromptReady` first and returns when a genuine prompt
+ * exists, so residual dialog text above a live prompt is never reached, and a
+ * one-shot guard stops the key being sent twice.
+ *
+ * @param output - ANSI-stripped pane capture
+ * @returns True when both anchors of the dialog are present
+ */
+function isCodexHooksReviewDialog(output) {
+    return CODEX_HOOKS_REVIEW_ANCHORS.every((anchor) => output.includes(anchor));
+}
 /**
  * Codex CLI tool implementation
  * Manages Codex sessions using tmux
@@ -66,6 +126,18 @@ class CodexTool extends base_1.BaseCLITool {
             logger.info('codex-session-sessionname');
             return;
         }
+        // Issue #1760: everything the previous codex process reported through this
+        // (worktreeId, instanceId) belongs to a session that no longer exists, and
+        // the key is reused verbatim by the one about to be created. Without this
+        // fence the old process's last `user_prompt_submit` reads as the new one's
+        // and a brand-new session publishes `running` before anyone has typed into
+        // it (#1723).
+        //
+        // Creation path only — the reuse branch above has already returned — and
+        // before `createSession`, so no live pane is ever matched against a stale
+        // generation. Bumped even when the launch then fails: falling back to the
+        // scraper is always safe, trusting a dead session's events is not.
+        (0, agent_session_lifecycle_1.beginAgentSession)({ worktreeId, cliToolId: sources_1.CODEX_CLI_TOOL_ID, instanceId });
         try {
             // Create tmux session. Codex is inline-rendered, so its transcript lives in
             // the pane scrollback — depth comes from the shared TMUX_HISTORY_LIMIT
@@ -76,8 +148,18 @@ class CodexTool extends base_1.BaseCLITool {
             });
             // Wait a moment for the session to be created
             await new Promise((resolve) => setTimeout(resolve, cli_tool_timing_config_1.TUI_SESSION_CREATE_WAIT_MS));
+            // Issue #1760: hand this session its correlation keys, writing codex's
+            // hooks config first if it is not already there. codex has no
+            // `--settings`, so the keys ride in environment assignments on the launch
+            // line and the hook commands read them back — which is what tells `codex`
+            // from `codex-2` in one worktree, since `cwd` is identical for both.
+            //
+            // Falls back to the bare command on any failure and when
+            // `CM_AGENT_HOOKS_INJECT=0`; a session that starts without hooks is the
+            // pre-#1760 status quo, and a session that fails to start is not.
+            const launchCommand = (0, agent_session_lifecycle_1.prepareAgentLaunch)({ worktreeId, cliToolId: sources_1.CODEX_CLI_TOOL_ID, instanceId }, this.command).command;
             // Start Codex CLI in interactive mode
-            await (0, tmux_1.sendKeys)(sessionName, 'codex', true);
+            await (0, tmux_1.sendKeys)(sessionName, launchCommand, true);
             // Wait for Codex to initialize
             await new Promise((resolve) => setTimeout(resolve, CODEX_INIT_WAIT_MS));
             // Poll until Codex interactive prompt is ready
@@ -102,6 +184,7 @@ class CodexTool extends base_1.BaseCLITool {
         // update branch re-sends "2" every poll and the live prompt gets "222...".
         let updateDialogHandled = false;
         let trustDialogHandled = false;
+        let hooksReviewHandled = false;
         for (let i = 0; i < CODEX_INIT_MAX_ATTEMPTS; i++) {
             try {
                 const rawOutput = await (0, tmux_1.capturePane)(sessionName, 50);
@@ -114,6 +197,17 @@ class CodexTool extends base_1.BaseCLITool {
                     logger.info('codex-prompt-detected');
                     return;
                 }
+                // Issue #1760: "Hooks need review". Reached only when no genuine prompt
+                // exists (the check above returned), so this cannot fire on a live
+                // prompt, and the one-shot guard stops a second key on a re-render.
+                // Declines: granting trust would write the operator's config.toml.
+                if (!hooksReviewHandled && isCodexHooksReviewDialog(output)) {
+                    await (0, tmux_1.sendKeys)(sessionName, CODEX_HOOKS_REVIEW_DECLINE_KEY, false);
+                    hooksReviewHandled = true;
+                    logger.info('codex-hooks-review-declined');
+                    await new Promise((resolve) => setTimeout(resolve, cli_tool_timing_config_1.CODEX_DIALOG_SETTLE_MS));
+                    continue;
+                }
                 // Issue #892: classify the bottom-most ACTIVE dialog by position. A dialog
                 // whose text is only residual scrollback above a genuine prompt returns
                 // null here, so no stray key is sent after it has been dismissed.

package/dist/server/src/lib/cli-tools/copilot.js

@@ -17,6 +17,9 @@ const tmux_capture_cache_1 = require("../tmux/tmux-capture-cache");
 const cli_patterns_1 = require("../detection/cli-patterns");
 const copilot_constants_1 = require("../../config/copilot-constants");
 const cli_tool_timing_config_1 = require("../../config/cli-tool-timing-config");
+const agent_session_lifecycle_1 = require("../../lib/session/agent-session-lifecycle");
+const hook_settings_1 = require("../../lib/hooks/sources/copilot/hook-settings");
+const tool_id_1 = require("../../lib/hooks/sources/copilot/tool-id");
 const errors_1 = require("../../lib/errors");
 const logger_1 = require("../../lib/logger");
 const logger = (0, logger_1.createLogger)('cli-tools/copilot');
@@ -112,6 +115,18 @@ class CopilotTool extends base_1.BaseCLITool {
             logger.info('copilot-session-exists');
             return;
         }
+        // Issue #1761: fence this session off from the previous copilot process's
+        // events. The state is keyed by (worktree, tool, instance), a key the new
+        // session reuses verbatim, so without this the old process's last
+        // `user_prompt_submit` reads as the new one's and a session publishes
+        // `running` before anybody has typed into it (#1723).
+        //
+        // Creation path only — the reuse branch above has already returned — and
+        // before the pane exists, so no live pane is ever judged against a stale
+        // generation. Outside the try, so a launch that then fails is still fenced:
+        // falling back to the scraper is always safe, trusting a dead session's
+        // events is not.
+        (0, agent_session_lifecycle_1.beginAgentSession)({ worktreeId, cliToolId: tool_id_1.COPILOT_CLI_TOOL_ID, instanceId });
         try {
             // Create tmux session. Scrollback depth comes from the shared
             // TMUX_HISTORY_LIMIT default (Issue #1624) — do not re-hardcode it here.
@@ -121,8 +136,22 @@ class CopilotTool extends base_1.BaseCLITool {
             });
             // Wait a moment for the session to be created
             await new Promise((resolve) => setTimeout(resolve, cli_tool_timing_config_1.TUI_SESSION_CREATE_WAIT_MS));
+            // Issue #1761: hand this session its hook configuration, so structured
+            // lifecycle events and Auto-Yes adjudication exist without the operator
+            // having edited ~/.copilot/settings.json by hand.
+            //
+            // The returned command is `gh copilot` with two environment assignments
+            // in front of it. Copilot's config is one file for the whole machine, so
+            // unlike Claude's `--settings` it cannot carry the correlation keys —
+            // they ride in the environment and the hook reads them when it fires.
+            // See `lib/hooks/sources/copilot/hook-settings`.
+            //
+            // Fails open in every branch: with `CM_AGENT_HOOKS_INJECT=0`, or with a
+            // settings file that cannot be read or written, this is byte-for-byte the
+            // `gh copilot` this line has always sent.
+            const launchCommand = (0, agent_session_lifecycle_1.prepareAgentLaunch)({ worktreeId, cliToolId: tool_id_1.COPILOT_CLI_TOOL_ID, instanceId }, hook_settings_1.COPILOT_LAUNCH_COMMAND).command;
             // Start Copilot CLI in interactive mode
-            await (0, tmux_1.sendKeys)(sessionName, 'gh copilot', true);
+            await (0, tmux_1.sendKeys)(sessionName, launchCommand, true);
             // Wait for Copilot to initialize
             await new Promise((resolve) => setTimeout(resolve, COPILOT_INIT_WAIT_MS));
             // Poll until Copilot interactive prompt is ready

package/dist/server/src/lib/cli-tools/gemini.js

@@ -15,6 +15,9 @@ const tmux_1 = require("../tmux/tmux");
 const submit_verified_sender_1 = require("./submit-verified-sender");
 const tmux_capture_cache_1 = require("../tmux/tmux-capture-cache");
 const cli_patterns_1 = require("../detection/cli-patterns");
+const sources_1 = require("../../lib/hooks/sources");
+const source_1 = require("../../lib/hooks/sources/gemini/source");
+const agent_session_lifecycle_1 = require("../../lib/session/agent-session-lifecycle");
 const logger_1 = require("../../lib/logger");
 const cli_tool_timing_config_1 = require("../../config/cli-tool-timing-config");
 const logger = (0, logger_1.createLogger)('cli-tools/gemini');
@@ -73,6 +76,13 @@ class GeminiTool extends base_1.BaseCLITool {
             logger.info('gemini-session-sessionname');
             return;
         }
+        // Issue #1762: fence this instance's structured events off from the process
+        // that used to hold the same (worktree, tool, instance) key. On the creation
+        // path only — the reuse branch above has already returned — and before the
+        // pane exists, so no live pane is ever judged against a stale generation.
+        // Bumped even if the launch below then fails: falling back to the screen
+        // scraper is always safe, trusting a dead session's events is not.
+        (0, agent_session_lifecycle_1.beginAgentSession)({ worktreeId, cliToolId: sources_1.GEMINI_CLI_TOOL_ID, instanceId });
         try {
             // Create tmux session. Scrollback depth comes from the shared
             // TMUX_HISTORY_LIMIT default (Issue #1624) — do not re-hardcode it here.
@@ -82,8 +92,24 @@ class GeminiTool extends base_1.BaseCLITool {
             });
             // Wait a moment for the session to be created
             await new Promise((resolve) => setTimeout(resolve, cli_tool_timing_config_1.TUI_SESSION_CREATE_WAIT_MS));
-            // Start Gemini CLI in interactive mode (no flags = interactive REPL)
-            await (0, tmux_1.sendKeys)(sessionName, 'gemini', true);
+            // Issue #1762: hand this worktree its own hooks config, merged into any
+            // `.gemini/settings.json` that is already there. Written from here rather
+            // than from the source's `prepareLaunch` because the worktree path is the
+            // one input `AgentInstanceRef` does not carry, and gemini is the only tool
+            // whose config is scoped to a worktree. Fail-open: a config that cannot be
+            // written costs the events and nothing else.
+            (0, source_1.injectGeminiHookSettings)(worktreePath, {
+                worktreeId,
+                cliToolId: sources_1.GEMINI_CLI_TOOL_ID,
+                instanceId,
+            });
+            // Start Gemini CLI in interactive mode (no flags = interactive REPL).
+            // `prepareAgentLaunch` prefixes `CM_HOOK_URL`, which is what tells the
+            // receiver which instance an event came from — `.gemini/settings.json` is
+            // per worktree and cannot. `CM_AGENT_HOOKS_INJECT=0` returns the bare
+            // command, unchanged from before this Issue.
+            const launchCommand = (0, agent_session_lifecycle_1.prepareAgentLaunch)({ worktreeId, cliToolId: sources_1.GEMINI_CLI_TOOL_ID, instanceId }, this.command).command;
+            await (0, tmux_1.sendKeys)(sessionName, launchCommand, true);
             // Wait for Gemini to initialize (minimum wait for banner/auth)
             await new Promise((resolve) => setTimeout(resolve, GEMINI_INIT_WAIT_MS));
             // Poll until Gemini interactive prompt is ready

package/dist/server/src/lib/cli-tools/opencode.js

@@ -8,6 +8,22 @@
  * - sendMessage: sends text via tmux send-keys + Enter
  * - killSession: sends `/exit` command then falls back to tmux kill-session
  * - interrupt(): inherits BaseCLITool default (Escape key) [D2-008]
+ *
+ * ## Structured events (Issue #1763, Epic #1720 Phase 4-5)
+ *
+ * opencode is the one supported agent that does not push lifecycle events at
+ * CommandMate: it is *subscribed to*. #1758 §5.1.2 measured that the plain TUI
+ * serves the same HTTP API `opencode serve` does once it is given `--port`, so
+ * the whole of the launch change is that flag — no second process, no pid to
+ * track, no orphan to reap, and `killSession`'s `/exit`, the init wait and
+ * `reconcileExistingSession` are all untouched.
+ *
+ * What is added around it is three calls into
+ * `@/lib/hooks/sources/opencode/runtime`: reserve a port before the launch
+ * command is built, attach the event stream once the TUI is up, and release
+ * both when the pane is killed. Every one of them is fail-open — a session that
+ * starts without structured events is the pre-#1763 status quo, and the screen
+ * scraper keeps deciding for it exactly as before.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OpenCodeTool = exports.OPENCODE_INIT_WAIT_MS = exports.OPENCODE_PANE_HEIGHT = exports.OPENCODE_EXIT_COMMAND = void 0;
@@ -19,6 +35,8 @@ const opencode_config_1 = require("./opencode-config");
 const child_process_1 = require("child_process");
 const util_1 = require("util");
 const logger_1 = require("../../lib/logger");
+const agent_session_lifecycle_1 = require("../../lib/session/agent-session-lifecycle");
+const runtime_1 = require("../../lib/hooks/sources/opencode/runtime");
 const cli_tool_timing_config_1 = require("../../config/cli-tool-timing-config");
 const logger = (0, logger_1.createLogger)('cli-tools/opencode');
 const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
@@ -77,15 +95,29 @@ class OpenCodeTool extends base_1.BaseCLITool {
             throw new Error('OpenCode is not installed or not in PATH');
         }
         const sessionName = this.getSessionName(worktreeId, instanceId);
+        const target = (0, runtime_1.opencodeTarget)(worktreeId, instanceId);
         const exists = await (0, tmux_1.hasSession)(sessionName);
         if (exists) {
             await this.reconcileExistingSession(sessionName, {
                 windowWidth: 80,
                 windowHeight: exports.OPENCODE_PANE_HEIGHT,
             });
+            // Issue #1763: the pane outlived this process (a CommandMate restart), so
+            // the subscription that used to watch it is gone while its server is
+            // still listening. Recovered from the recorded port, health-checked, and
+            // skipped silently when there is nothing there. NOT a new generation —
+            // the pane is the same one, and fencing here would discard a still-valid
+            // verdict on every reconnect.
+            await (0, runtime_1.resumeOpencodeEventStream)(target, worktreePath);
             logger.info('opencode-session-sessionname');
             return;
         }
+        // Issue #1759 (S8) / #1763: everything the previous opencode process
+        // reported through this (worktreeId, instanceId) belongs to a session that
+        // no longer exists, and the key is reused verbatim by the one about to be
+        // created. On the creation path only, before the pane exists, and even if
+        // the launch then fails — falling back to the scraper is always safe.
+        (0, agent_session_lifecycle_1.beginAgentSession)(target);
         try {
             // Generate opencode.json if not present (non-fatal on failure)
             await (0, opencode_config_1.ensureOpencodeConfig)(worktreePath);
@@ -109,10 +141,23 @@ class OpenCodeTool extends base_1.BaseCLITool {
             catch {
                 // Non-fatal: resize may fail in some environments
             }
-            // Start OpenCode TUI
-            await (0, tmux_1.sendKeys)(sessionName, 'opencode', true);
+            // Issue #1763: pick the port before the command is built. The TUI is its
+            // own HTTP server once `--port` is passed (#1758 §5.1.2), and CommandMate
+            // assigns the number because opencode's `--port 0` is not an OS-assigned
+            // port — it tries 4096 first and only then falls back to an ephemeral one
+            // that nothing can read back (§5.9). Null means "no structured events",
+            // and the launch below is then the pre-#1763 bare command.
+            await (0, runtime_1.reserveOpencodeServerPort)(target, worktreePath);
+            // Start OpenCode TUI. `prepareAgentLaunch` asks the tool's own
+            // `AgentEventSource` for the command line (S3/S4/S5) and never throws.
+            const launchCommand = (0, agent_session_lifecycle_1.prepareAgentLaunch)(target, this.command).command;
+            await (0, tmux_1.sendKeys)(sessionName, launchCommand, true);
             // Wait for OpenCode to initialize (GPU model loading via Ollama)
             await new Promise((resolve) => setTimeout(resolve, exports.OPENCODE_INIT_WAIT_MS));
+            // Issue #1763: subscribe once the server has had the same time to come up
+            // that the TUI has. Health-checked first, so an opencode too old to know
+            // `--port` costs one probe and nothing else.
+            await (0, runtime_1.attachOpencodeEventStream)(target);
             logger.info('started-opencode-session:sessionname');
         }
         catch (error) {
@@ -164,6 +209,10 @@ class OpenCodeTool extends base_1.BaseCLITool {
      */
     async killSession(worktreeId, instanceId) {
         const sessionName = this.getSessionName(worktreeId, instanceId);
+        // Issue #1763: stop watching before the pane goes, so the stream is not
+        // reconnecting to a server that is being shut down. Also gives the port
+        // back — the pane is what held it. Never throws.
+        await (0, runtime_1.releaseOpencodeEventStream)((0, runtime_1.opencodeTarget)(worktreeId, instanceId));
         try {
             // Step 1: Check if the tmux session currently exists
             const exists = await (0, tmux_1.hasSession)(sessionName);