commandmate 0.22.2 → 0.24.0

package/dist/server/src/lib/cli-tools/codex.js

@@ -5,12 +5,15 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CodexTool = void 0;
+exports.isCodexHooksReviewDialog = isCodexHooksReviewDialog;
 const base_1 = require("./base");
 const tmux_1 = require("../tmux/tmux");
 const submit_verified_sender_1 = require("./submit-verified-sender");
 const tmux_capture_cache_1 = require("../tmux/tmux-capture-cache");
 const cli_patterns_1 = require("../detection/cli-patterns");
 const logger_1 = require("../../lib/logger");
+const sources_1 = require("../../lib/hooks/sources");
+const agent_session_lifecycle_1 = require("../../lib/session/agent-session-lifecycle");
 const cli_tool_timing_config_1 = require("../../config/cli-tool-timing-config");
 const logger = (0, logger_1.createLogger)('cli-tools/codex');
 /**
@@ -28,6 +31,63 @@ const CODEX_POLL_INTERVAL_MS = 1000;
 const CODEX_INIT_MAX_ATTEMPTS = 30;
 /** Timeout for waiting for prompt before sending a message */
 const CODEX_PROMPT_WAIT_TIMEOUT_MS = 15000;
+/**
+ * Anchors of codex's "Hooks need review" dialog (Issue #1760, measured on
+ * codex-cli 0.147.0):
+ *
+ * ```
+ *  Hooks need review
+ *  5 hooks are new or changed.
+ *  Hooks can run outside the sandbox after you trust them.
+ *
+ * > 1. Review hooks
+ *   2. Trust all and continue
+ *   3. Continue without trusting (hooks won't run)
+ * ```
+ *
+ * It has to be handled here rather than in `getCodexActiveDialog`, which
+ * classifies it as `null`: its wording matches none of that function's three
+ * anchors (`Skip until next version` / `Do you trust` / `Press enter to
+ * continue`). Measured consequence of leaving it alone, on a pane with the
+ * generated `hooks.json` present: `isCodexPromptReady` stays false for the full
+ * 30-attempt window and the session is then handed to `sendMessage` still
+ * sitting on the dialog. Every launch, because "continue without trusting" is
+ * not remembered — verified by relaunching and getting the same screen.
+ *
+ * Both strings are required so a "hooks" mention elsewhere cannot select an
+ * option on a live prompt.
+ */
+const CODEX_HOOKS_REVIEW_ANCHORS = ['Hooks need review', 'Continue without trusting'];
+/**
+ * Option 3, "Continue without trusting (hooks won't run)".
+ *
+ * Not option 2. Trusting writes `[hooks.state."<file>:<event>:0:0"]` entries
+ * into the operator's own `~/.codex/config.toml` — the file that carries, among
+ * other things, the `notify` command a Computer Use integration runs — and
+ * granting that on someone's behalf is not this server's call. So a session
+ * starts with the hooks inert and the screen scraper doing exactly what it did
+ * before Issue #1760; the human enables them once through codex's own review
+ * screen, or an operator sets `CM_CODEX_HOOK_TRUST=bypass`.
+ *
+ * Sent alone, like the other numbered dialogs (Issue #890): codex confirms a
+ * numbered selection instantly, and a trailing Enter would land on the next
+ * screen. Verified live — the prompt was ready on the following poll.
+ */
+const CODEX_HOOKS_REVIEW_DECLINE_KEY = '3';
+/**
+ * Whether the pane is sitting on the hooks review dialog.
+ *
+ * Position-independent on purpose, unlike `getCodexActiveDialog`: the only
+ * caller checks `isCodexPromptReady` first and returns when a genuine prompt
+ * exists, so residual dialog text above a live prompt is never reached, and a
+ * one-shot guard stops the key being sent twice.
+ *
+ * @param output - ANSI-stripped pane capture
+ * @returns True when both anchors of the dialog are present
+ */
+function isCodexHooksReviewDialog(output) {
+    return CODEX_HOOKS_REVIEW_ANCHORS.every((anchor) => output.includes(anchor));
+}
 /**
  * Codex CLI tool implementation
  * Manages Codex sessions using tmux
@@ -66,6 +126,18 @@ class CodexTool extends base_1.BaseCLITool {
             logger.info('codex-session-sessionname');
             return;
         }
+        // Issue #1760: everything the previous codex process reported through this
+        // (worktreeId, instanceId) belongs to a session that no longer exists, and
+        // the key is reused verbatim by the one about to be created. Without this
+        // fence the old process's last `user_prompt_submit` reads as the new one's
+        // and a brand-new session publishes `running` before anyone has typed into
+        // it (#1723).
+        //
+        // Creation path only — the reuse branch above has already returned — and
+        // before `createSession`, so no live pane is ever matched against a stale
+        // generation. Bumped even when the launch then fails: falling back to the
+        // scraper is always safe, trusting a dead session's events is not.
+        (0, agent_session_lifecycle_1.beginAgentSession)({ worktreeId, cliToolId: sources_1.CODEX_CLI_TOOL_ID, instanceId });
         try {
             // Create tmux session. Codex is inline-rendered, so its transcript lives in
             // the pane scrollback — depth comes from the shared TMUX_HISTORY_LIMIT
@@ -76,8 +148,18 @@ class CodexTool extends base_1.BaseCLITool {
             });
             // Wait a moment for the session to be created
             await new Promise((resolve) => setTimeout(resolve, cli_tool_timing_config_1.TUI_SESSION_CREATE_WAIT_MS));
+            // Issue #1760: hand this session its correlation keys, writing codex's
+            // hooks config first if it is not already there. codex has no
+            // `--settings`, so the keys ride in environment assignments on the launch
+            // line and the hook commands read them back — which is what tells `codex`
+            // from `codex-2` in one worktree, since `cwd` is identical for both.
+            //
+            // Falls back to the bare command on any failure and when
+            // `CM_AGENT_HOOKS_INJECT=0`; a session that starts without hooks is the
+            // pre-#1760 status quo, and a session that fails to start is not.
+            const launchCommand = (0, agent_session_lifecycle_1.prepareAgentLaunch)({ worktreeId, cliToolId: sources_1.CODEX_CLI_TOOL_ID, instanceId }, this.command).command;
             // Start Codex CLI in interactive mode
-            await (0, tmux_1.sendKeys)(sessionName, 'codex', true);
+            await (0, tmux_1.sendKeys)(sessionName, launchCommand, true);
             // Wait for Codex to initialize
             await new Promise((resolve) => setTimeout(resolve, CODEX_INIT_WAIT_MS));
             // Poll until Codex interactive prompt is ready
@@ -102,6 +184,7 @@ class CodexTool extends base_1.BaseCLITool {
         // update branch re-sends "2" every poll and the live prompt gets "222...".
         let updateDialogHandled = false;
         let trustDialogHandled = false;
+        let hooksReviewHandled = false;
         for (let i = 0; i < CODEX_INIT_MAX_ATTEMPTS; i++) {
             try {
                 const rawOutput = await (0, tmux_1.capturePane)(sessionName, 50);
@@ -114,6 +197,17 @@ class CodexTool extends base_1.BaseCLITool {
                     logger.info('codex-prompt-detected');
                     return;
                 }
+                // Issue #1760: "Hooks need review". Reached only when no genuine prompt
+                // exists (the check above returned), so this cannot fire on a live
+                // prompt, and the one-shot guard stops a second key on a re-render.
+                // Declines: granting trust would write the operator's config.toml.
+                if (!hooksReviewHandled && isCodexHooksReviewDialog(output)) {
+                    await (0, tmux_1.sendKeys)(sessionName, CODEX_HOOKS_REVIEW_DECLINE_KEY, false);
+                    hooksReviewHandled = true;
+                    logger.info('codex-hooks-review-declined');
+                    await new Promise((resolve) => setTimeout(resolve, cli_tool_timing_config_1.CODEX_DIALOG_SETTLE_MS));
+                    continue;
+                }
                 // Issue #892: classify the bottom-most ACTIVE dialog by position. A dialog
                 // whose text is only residual scrollback above a genuine prompt returns
                 // null here, so no stray key is sent after it has been dismissed.

package/dist/server/src/lib/cli-tools/copilot.js

@@ -17,6 +17,9 @@ const tmux_capture_cache_1 = require("../tmux/tmux-capture-cache");
 const cli_patterns_1 = require("../detection/cli-patterns");
 const copilot_constants_1 = require("../../config/copilot-constants");
 const cli_tool_timing_config_1 = require("../../config/cli-tool-timing-config");
+const agent_session_lifecycle_1 = require("../../lib/session/agent-session-lifecycle");
+const hook_settings_1 = require("../../lib/hooks/sources/copilot/hook-settings");
+const tool_id_1 = require("../../lib/hooks/sources/copilot/tool-id");
 const errors_1 = require("../../lib/errors");
 const logger_1 = require("../../lib/logger");
 const logger = (0, logger_1.createLogger)('cli-tools/copilot');
@@ -112,6 +115,18 @@ class CopilotTool extends base_1.BaseCLITool {
             logger.info('copilot-session-exists');
             return;
         }
+        // Issue #1761: fence this session off from the previous copilot process's
+        // events. The state is keyed by (worktree, tool, instance), a key the new
+        // session reuses verbatim, so without this the old process's last
+        // `user_prompt_submit` reads as the new one's and a session publishes
+        // `running` before anybody has typed into it (#1723).
+        //
+        // Creation path only — the reuse branch above has already returned — and
+        // before the pane exists, so no live pane is ever judged against a stale
+        // generation. Outside the try, so a launch that then fails is still fenced:
+        // falling back to the scraper is always safe, trusting a dead session's
+        // events is not.
+        (0, agent_session_lifecycle_1.beginAgentSession)({ worktreeId, cliToolId: tool_id_1.COPILOT_CLI_TOOL_ID, instanceId });
         try {
             // Create tmux session. Scrollback depth comes from the shared
             // TMUX_HISTORY_LIMIT default (Issue #1624) — do not re-hardcode it here.
@@ -121,8 +136,22 @@ class CopilotTool extends base_1.BaseCLITool {
             });
             // Wait a moment for the session to be created
             await new Promise((resolve) => setTimeout(resolve, cli_tool_timing_config_1.TUI_SESSION_CREATE_WAIT_MS));
+            // Issue #1761: hand this session its hook configuration, so structured
+            // lifecycle events and Auto-Yes adjudication exist without the operator
+            // having edited ~/.copilot/settings.json by hand.
+            //
+            // The returned command is `gh copilot` with two environment assignments
+            // in front of it. Copilot's config is one file for the whole machine, so
+            // unlike Claude's `--settings` it cannot carry the correlation keys —
+            // they ride in the environment and the hook reads them when it fires.
+            // See `lib/hooks/sources/copilot/hook-settings`.
+            //
+            // Fails open in every branch: with `CM_AGENT_HOOKS_INJECT=0`, or with a
+            // settings file that cannot be read or written, this is byte-for-byte the
+            // `gh copilot` this line has always sent.
+            const launchCommand = (0, agent_session_lifecycle_1.prepareAgentLaunch)({ worktreeId, cliToolId: tool_id_1.COPILOT_CLI_TOOL_ID, instanceId }, hook_settings_1.COPILOT_LAUNCH_COMMAND).command;
             // Start Copilot CLI in interactive mode
-            await (0, tmux_1.sendKeys)(sessionName, 'gh copilot', true);
+            await (0, tmux_1.sendKeys)(sessionName, launchCommand, true);
             // Wait for Copilot to initialize
             await new Promise((resolve) => setTimeout(resolve, COPILOT_INIT_WAIT_MS));
             // Poll until Copilot interactive prompt is ready

package/dist/server/src/lib/cli-tools/gemini.js

@@ -15,6 +15,9 @@ const tmux_1 = require("../tmux/tmux");
 const submit_verified_sender_1 = require("./submit-verified-sender");
 const tmux_capture_cache_1 = require("../tmux/tmux-capture-cache");
 const cli_patterns_1 = require("../detection/cli-patterns");
+const sources_1 = require("../../lib/hooks/sources");
+const source_1 = require("../../lib/hooks/sources/gemini/source");
+const agent_session_lifecycle_1 = require("../../lib/session/agent-session-lifecycle");
 const logger_1 = require("../../lib/logger");
 const cli_tool_timing_config_1 = require("../../config/cli-tool-timing-config");
 const logger = (0, logger_1.createLogger)('cli-tools/gemini');
@@ -73,6 +76,13 @@ class GeminiTool extends base_1.BaseCLITool {
             logger.info('gemini-session-sessionname');
             return;
         }
+        // Issue #1762: fence this instance's structured events off from the process
+        // that used to hold the same (worktree, tool, instance) key. On the creation
+        // path only — the reuse branch above has already returned — and before the
+        // pane exists, so no live pane is ever judged against a stale generation.
+        // Bumped even if the launch below then fails: falling back to the screen
+        // scraper is always safe, trusting a dead session's events is not.
+        (0, agent_session_lifecycle_1.beginAgentSession)({ worktreeId, cliToolId: sources_1.GEMINI_CLI_TOOL_ID, instanceId });
         try {
             // Create tmux session. Scrollback depth comes from the shared
             // TMUX_HISTORY_LIMIT default (Issue #1624) — do not re-hardcode it here.
@@ -82,8 +92,24 @@ class GeminiTool extends base_1.BaseCLITool {
             });
             // Wait a moment for the session to be created
             await new Promise((resolve) => setTimeout(resolve, cli_tool_timing_config_1.TUI_SESSION_CREATE_WAIT_MS));
-            // Start Gemini CLI in interactive mode (no flags = interactive REPL)
-            await (0, tmux_1.sendKeys)(sessionName, 'gemini', true);
+            // Issue #1762: hand this worktree its own hooks config, merged into any
+            // `.gemini/settings.json` that is already there. Written from here rather
+            // than from the source's `prepareLaunch` because the worktree path is the
+            // one input `AgentInstanceRef` does not carry, and gemini is the only tool
+            // whose config is scoped to a worktree. Fail-open: a config that cannot be
+            // written costs the events and nothing else.
+            (0, source_1.injectGeminiHookSettings)(worktreePath, {
+                worktreeId,
+                cliToolId: sources_1.GEMINI_CLI_TOOL_ID,
+                instanceId,
+            });
+            // Start Gemini CLI in interactive mode (no flags = interactive REPL).
+            // `prepareAgentLaunch` prefixes `CM_HOOK_URL`, which is what tells the
+            // receiver which instance an event came from — `.gemini/settings.json` is
+            // per worktree and cannot. `CM_AGENT_HOOKS_INJECT=0` returns the bare
+            // command, unchanged from before this Issue.
+            const launchCommand = (0, agent_session_lifecycle_1.prepareAgentLaunch)({ worktreeId, cliToolId: sources_1.GEMINI_CLI_TOOL_ID, instanceId }, this.command).command;
+            await (0, tmux_1.sendKeys)(sessionName, launchCommand, true);
             // Wait for Gemini to initialize (minimum wait for banner/auth)
             await new Promise((resolve) => setTimeout(resolve, GEMINI_INIT_WAIT_MS));
             // Poll until Gemini interactive prompt is ready

package/dist/server/src/lib/cli-tools/opencode.js

@@ -8,6 +8,22 @@
  * - sendMessage: sends text via tmux send-keys + Enter
  * - killSession: sends `/exit` command then falls back to tmux kill-session
  * - interrupt(): inherits BaseCLITool default (Escape key) [D2-008]
+ *
+ * ## Structured events (Issue #1763, Epic #1720 Phase 4-5)
+ *
+ * opencode is the one supported agent that does not push lifecycle events at
+ * CommandMate: it is *subscribed to*. #1758 §5.1.2 measured that the plain TUI
+ * serves the same HTTP API `opencode serve` does once it is given `--port`, so
+ * the whole of the launch change is that flag — no second process, no pid to
+ * track, no orphan to reap, and `killSession`'s `/exit`, the init wait and
+ * `reconcileExistingSession` are all untouched.
+ *
+ * What is added around it is three calls into
+ * `@/lib/hooks/sources/opencode/runtime`: reserve a port before the launch
+ * command is built, attach the event stream once the TUI is up, and release
+ * both when the pane is killed. Every one of them is fail-open — a session that
+ * starts without structured events is the pre-#1763 status quo, and the screen
+ * scraper keeps deciding for it exactly as before.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OpenCodeTool = exports.OPENCODE_INIT_WAIT_MS = exports.OPENCODE_PANE_HEIGHT = exports.OPENCODE_EXIT_COMMAND = void 0;
@@ -19,6 +35,8 @@ const opencode_config_1 = require("./opencode-config");
 const child_process_1 = require("child_process");
 const util_1 = require("util");
 const logger_1 = require("../../lib/logger");
+const agent_session_lifecycle_1 = require("../../lib/session/agent-session-lifecycle");
+const runtime_1 = require("../../lib/hooks/sources/opencode/runtime");
 const cli_tool_timing_config_1 = require("../../config/cli-tool-timing-config");
 const logger = (0, logger_1.createLogger)('cli-tools/opencode');
 const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
@@ -77,15 +95,29 @@ class OpenCodeTool extends base_1.BaseCLITool {
             throw new Error('OpenCode is not installed or not in PATH');
         }
         const sessionName = this.getSessionName(worktreeId, instanceId);
+        const target = (0, runtime_1.opencodeTarget)(worktreeId, instanceId);
         const exists = await (0, tmux_1.hasSession)(sessionName);
         if (exists) {
             await this.reconcileExistingSession(sessionName, {
                 windowWidth: 80,
                 windowHeight: exports.OPENCODE_PANE_HEIGHT,
             });
+            // Issue #1763: the pane outlived this process (a CommandMate restart), so
+            // the subscription that used to watch it is gone while its server is
+            // still listening. Recovered from the recorded port, health-checked, and
+            // skipped silently when there is nothing there. NOT a new generation —
+            // the pane is the same one, and fencing here would discard a still-valid
+            // verdict on every reconnect.
+            await (0, runtime_1.resumeOpencodeEventStream)(target, worktreePath);
             logger.info('opencode-session-sessionname');
             return;
         }
+        // Issue #1759 (S8) / #1763: everything the previous opencode process
+        // reported through this (worktreeId, instanceId) belongs to a session that
+        // no longer exists, and the key is reused verbatim by the one about to be
+        // created. On the creation path only, before the pane exists, and even if
+        // the launch then fails — falling back to the scraper is always safe.
+        (0, agent_session_lifecycle_1.beginAgentSession)(target);
         try {
             // Generate opencode.json if not present (non-fatal on failure)
             await (0, opencode_config_1.ensureOpencodeConfig)(worktreePath);
@@ -109,10 +141,23 @@ class OpenCodeTool extends base_1.BaseCLITool {
             catch {
                 // Non-fatal: resize may fail in some environments
             }
-            // Start OpenCode TUI
-            await (0, tmux_1.sendKeys)(sessionName, 'opencode', true);
+            // Issue #1763: pick the port before the command is built. The TUI is its
+            // own HTTP server once `--port` is passed (#1758 §5.1.2), and CommandMate
+            // assigns the number because opencode's `--port 0` is not an OS-assigned
+            // port — it tries 4096 first and only then falls back to an ephemeral one
+            // that nothing can read back (§5.9). Null means "no structured events",
+            // and the launch below is then the pre-#1763 bare command.
+            await (0, runtime_1.reserveOpencodeServerPort)(target, worktreePath);
+            // Start OpenCode TUI. `prepareAgentLaunch` asks the tool's own
+            // `AgentEventSource` for the command line (S3/S4/S5) and never throws.
+            const launchCommand = (0, agent_session_lifecycle_1.prepareAgentLaunch)(target, this.command).command;
+            await (0, tmux_1.sendKeys)(sessionName, launchCommand, true);
             // Wait for OpenCode to initialize (GPU model loading via Ollama)
             await new Promise((resolve) => setTimeout(resolve, exports.OPENCODE_INIT_WAIT_MS));
+            // Issue #1763: subscribe once the server has had the same time to come up
+            // that the TUI has. Health-checked first, so an opencode too old to know
+            // `--port` costs one probe and nothing else.
+            await (0, runtime_1.attachOpencodeEventStream)(target);
             logger.info('started-opencode-session:sessionname');
         }
         catch (error) {
@@ -164,6 +209,10 @@ class OpenCodeTool extends base_1.BaseCLITool {
      */
     async killSession(worktreeId, instanceId) {
         const sessionName = this.getSessionName(worktreeId, instanceId);
+        // Issue #1763: stop watching before the pane goes, so the stream is not
+        // reconnecting to a server that is being shut down. Also gives the port
+        // back — the pane is what held it. Never throws.
+        await (0, runtime_1.releaseOpencodeEventStream)((0, runtime_1.opencodeTarget)(worktreeId, instanceId));
         try {
             // Step 1: Check if the tmux session currently exists
             const exists = await (0, tmux_1.hasSession)(sessionName);

package/dist/server/src/lib/db/db.js

@@ -12,7 +12,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.setInProgressMessageId = exports.updateSessionState = exports.getSessionState = exports.getMessagesByDateRange = exports.ACTIVE_FILTER = exports.recordAnsweredPrompt = exports.markPendingPromptsAsAnswered = exports.updatePromptData = exports.getMessageById = exports.recomputeLastUserMessage = exports.clearLastUserMessage = exports.updateLastUserMessage = exports.deleteMessagesByInstance = exports.deleteMessagesByCliTool = exports.deleteMessageById = exports.deleteAllMessages = exports.getLastMessage = exports.getLastUserMessage = exports.getMessages = exports.updateMessageContent = exports.createMessage = exports.getLastAssistantMessageAt = exports.getAliasedWorktreeIds = exports.getAllWorktreeAliases = exports.getWorktreeAliases = exports.resolveWorktreeIdWithAlias = exports.recordWorktreeAlias = exports.deleteWorktreesByIds = exports.deleteRepositoryWorktrees = exports.migrateWorktreeIdPreservingChildren = exports.getAllWorktreePathIds = exports.getAllWorktreeIds = exports.getWorktreesByRepository = exports.getWorktreeIdsByRepository = exports.getInitialBranch = exports.saveInitialBranch = exports.updateVibeLocalContextWindow = exports.updateVibeLocalModel = exports.updateSelectedAgents = exports.updateCliToolId = exports.updateStatus = exports.updateFavorite = exports.updateLastViewedAt = exports.updateWorktreeLink = exports.updateWorktreeDescription = exports.upsertWorktree = exports.getWorktreeById = exports.getRepositories = exports.getWorktrees = exports.initDatabase = void 0;
 exports.createAssistantMessage = exports.updateAssistantConversation = exports.createAssistantConversation = exports.getAssistantConversationByRepositoryAndCliTool = exports.getAssistantConversationById = exports.updateDailyReportContent = exports.saveDailyReport = exports.getDailyReport = exports.recoverStuckSendingTimers = exports.clearTimerHistory = exports.cleanupOldTimers = exports.getPendingTimerCountByWorktree = exports.cancelTimersByWorktree = exports.cancelTimer = exports.updateTimerStatus = exports.getPendingTimers = exports.getTimerById = exports.getTimersByWorktree = exports.createTimer = exports.WORKTREE_TODO_STATUSES = exports.isWorktreeTodoStatus = exports.reorderWorktreeTodos = exports.deleteWorktreeTodo = exports.updateWorktreeTodo = exports.createWorktreeTodo = exports.getWorktreeTodoById = exports.getTodosByWorktreeId = exports.deleteTodo = exports.updateTodo = exports.createTodo = exports.getTodoById = exports.getAllTodos = exports.getTodosByRepositoryId = exports.MemoDbError = exports.reorderMemos = exports.deleteMemo = exports.updateMemo = exports.createMemo = exports.getMemoById = exports.getMemosByWorktreeId = exports.InvalidAgentInstanceError = exports.AgentInstanceLimitError = exports.removeAgentInstance = exports.addAgentInstance = exports.setAgentInstances = exports.countAgentInstances = exports.getAgentInstance = exports.getAgentInstances = exports.deleteSessionState = exports.clearInProgressMessageId = void 0;
-exports.listTaskEvents = exports.ACTIVE_TASK_STATUSES = exports.TERMINAL_TASK_STATUSES = exports.TASK_STATUSES = exports.isTerminalTaskStatus = exports.getActiveTaskForInstance = exports.getActiveTask = exports.listTasks = exports.getTask = exports.createTask = exports.VERIFICATION_TRIGGERS = exports.MAX_RUN_HISTORY_DAYS = exports.MAX_RUN_HISTORY_LIMIT = exports.DEFAULT_RUN_HISTORY_LIMIT = exports.listVerificationRunsForPeriod = exports.listRunningVerificationRuns = exports.getRunningVerificationRun = exports.listVerificationRuns = exports.getVerificationRun = exports.finishGateResult = exports.createGateResult = exports.finishVerificationRun = exports.createVerificationRun = exports.deletePushSubscriptionByEndpoint = exports.updatePushSubscriptionPreferences = exports.getPushSubscriptionsForKind = exports.getAllPushSubscriptions = exports.getPushSubscriptionByEndpoint = exports.upsertPushSubscription = exports.deleteAssistantSessionState = exports.updateAssistantSessionState = exports.getAssistantSessionState = exports.listRunningAssistantExecutions = exports.getRunningAssistantExecutionByConversation = exports.getLatestAssistantExecutionByConversation = exports.getAssistantExecutionById = exports.updateAssistantExecution = exports.createAssistantExecution = exports.archiveAssistantMessagesFrom = exports.archiveAllAssistantMessages = exports.getAssistantMessageById = exports.getAssistantMessages = exports.updateAssistantMessageStatus = void 0;
+exports.listTaskEvents = exports.ACTIVE_TASK_STATUSES = exports.TERMINAL_TASK_STATUSES = exports.TASK_STATUSES = exports.isTerminalTaskStatus = exports.getActiveTaskForInstance = exports.getActiveTask = exports.listTasks = exports.getTask = exports.createTask = exports.VERIFICATION_GATE_SOURCES = exports.VERIFICATION_TRIGGERS = exports.MAX_RUN_HISTORY_DAYS = exports.MAX_RUN_HISTORY_LIMIT = exports.DEFAULT_RUN_HISTORY_LIMIT = exports.listVerificationRunsForPeriod = exports.listRunningVerificationRuns = exports.getRunningVerificationRun = exports.listVerificationRuns = exports.getVerificationRun = exports.finishGateResult = exports.createGateResult = exports.finishVerificationRun = exports.createVerificationRun = exports.deletePushSubscriptionByEndpoint = exports.updatePushSubscriptionPreferences = exports.getPushSubscriptionsForKind = exports.getAllPushSubscriptions = exports.getPushSubscriptionByEndpoint = exports.upsertPushSubscription = exports.deleteAssistantSessionState = exports.updateAssistantSessionState = exports.getAssistantSessionState = exports.listRunningAssistantExecutions = exports.getRunningAssistantExecutionByConversation = exports.getLatestAssistantExecutionByConversation = exports.getAssistantExecutionById = exports.updateAssistantExecution = exports.createAssistantExecution = exports.archiveAssistantMessagesFrom = exports.archiveAllAssistantMessages = exports.getAssistantMessageById = exports.getAssistantMessages = exports.updateAssistantMessageStatus = void 0;
 // init-db
 var init_db_1 = require("./init-db");
 Object.defineProperty(exports, "initDatabase", { enumerable: true, get: function () { return init_db_1.initDatabase; } });
@@ -175,6 +175,7 @@ Object.defineProperty(exports, "DEFAULT_RUN_HISTORY_LIMIT", { enumerable: true,
 Object.defineProperty(exports, "MAX_RUN_HISTORY_LIMIT", { enumerable: true, get: function () { return verification_db_1.MAX_RUN_HISTORY_LIMIT; } });
 Object.defineProperty(exports, "MAX_RUN_HISTORY_DAYS", { enumerable: true, get: function () { return verification_db_1.MAX_RUN_HISTORY_DAYS; } });
 Object.defineProperty(exports, "VERIFICATION_TRIGGERS", { enumerable: true, get: function () { return verification_db_1.VERIFICATION_TRIGGERS; } });
+Object.defineProperty(exports, "VERIFICATION_GATE_SOURCES", { enumerable: true, get: function () { return verification_db_1.VERIFICATION_GATE_SOURCES; } });
 // tasks-db (execution contracts, Issue #1545)
 var tasks_db_1 = require("./tasks-db");
 Object.defineProperty(exports, "createTask", { enumerable: true, get: function () { return tasks_db_1.createTask; } });

package/dist/server/src/lib/db/migrations/index.js

@@ -39,6 +39,7 @@ const v52_orphaned_worktree_children_1 = require("./v52-orphaned-worktree-childr
 const v53_worktree_aliases_1 = require("./v53-worktree-aliases");
 const v54_worktree_id_path_derived_1 = require("./v54-worktree-id-path-derived");
 const v55_compact_churned_worktree_ids_1 = require("./v55-compact-churned-worktree-ids");
+const v56_gate_result_source_1 = require("./v56-gate-result-source");
 /**
  * Complete ordered list of all migrations.
  * Used internally by the barrel file (db-migrations.ts); NOT exported from the barrel (DR2-004).
@@ -81,4 +82,5 @@ exports.migrations = [
     ...v53_worktree_aliases_1.v53_migrations,
     ...v54_worktree_id_path_derived_1.v54_migrations,
     ...v55_compact_churned_worktree_ids_1.v55_migrations,
+    ...v56_gate_result_source_1.v56_migrations,
 ];

package/dist/server/src/lib/db/migrations/runner.js

@@ -17,7 +17,7 @@ const path_1 = __importDefault(require("path"));
  * Current schema version
  * Increment this when adding new migrations
  */
-exports.CURRENT_SCHEMA_VERSION = 55;
+exports.CURRENT_SCHEMA_VERSION = 56;
 /**
  * Get current schema version from database
  */

package/dist/server/src/lib/db/migrations/v56-gate-result-source.js

@@ -0,0 +1,58 @@
+"use strict";
+/**
+ * Migration v56: record where each verification gate was declared (Issue #1791).
+ *
+ * An execution contract can now carry gate *definitions* of its own, not just a
+ * selection of the repository's (#1756 案 B). That is what stops an orchestrator
+ * from having to append an Issue-specific gate to `.commandmate/verify.yaml` —
+ * a file that stays inside the work-evidence change set, so a worktree carrying
+ * nothing but that append reads as "the agent did work".
+ *
+ * The separation is only real if a reader can see it. Two gates in one report
+ * spell their ids the same way whether the repository declared them or one
+ * delegation did, and the contract's copy is not on disk to be checked against.
+ * Without this column, per-delegation gates are a second verify.yaml that
+ * nothing announces — a run could be green on criteria the repository never
+ * agreed to, and its report would look identical to one that passed the real
+ * ones.
+ *
+ * Nullable, with no backfill and no default. Rows written before this migration
+ * were produced by a runner that had no contract gates at all, so `verify.yaml`
+ * would be *almost* true of them and outright wrong for the built-ins — and
+ * verification history is evidence, which is not rewritten to make a column
+ * look complete. null therefore reads as "written before v56, nobody recorded
+ * this", the same discipline `timingsMeasured` uses for pre-#1625 timestamps.
+ *
+ * The CHECK mirrors VERIFICATION_GATE_SOURCES in verification-db.ts, for the
+ * reason v49's `trigger` CHECK does: a vocabulary that lives only in the writer
+ * lets a typo land as a new bucket nothing queries.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.v56_migrations = void 0;
+exports.v56_migrations = [
+    {
+        version: 56,
+        name: 'add-source-to-verification-gate-results',
+        up: (db) => {
+            // `ADD COLUMN IF NOT EXISTS` does not exist in SQLite, and the rollback
+            // below deliberately leaves the column in place — so a database rolled
+            // back past v56 and migrated forward again reaches this statement with
+            // the column already there. Without the guard that upgrade path dies on
+            // "duplicate column name".
+            const columns = db
+                .prepare('PRAGMA table_info(verification_gate_results)')
+                .all();
+            if (columns.some((column) => column.name === 'source'))
+                return;
+            db.exec(`
+        ALTER TABLE verification_gate_results ADD COLUMN source TEXT
+          CHECK (source IS NULL OR source IN ('builtin', 'verify.yaml', 'contract'));
+      `);
+        },
+        down: () => {
+            // SQLite drops columns only by rebuilding the table, which would rewrite
+            // every historical gate verdict to remove one nullable column. Same
+            // no-op rollback as v35/v36.
+        },
+    },
+];

package/dist/server/src/lib/db/verification-db.js

@@ -20,7 +20,7 @@
  * exactly the failure this table exists to make impossible.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MAX_RUN_HISTORY_DAYS = exports.MAX_RUN_HISTORY_LIMIT = exports.DEFAULT_RUN_HISTORY_LIMIT = exports.VERIFICATION_TRIGGERS = void 0;
+exports.MAX_RUN_HISTORY_DAYS = exports.MAX_RUN_HISTORY_LIMIT = exports.DEFAULT_RUN_HISTORY_LIMIT = exports.VERIFICATION_GATE_SOURCES = exports.VERIFICATION_TRIGGERS = void 0;
 exports.createVerificationRun = createVerificationRun;
 exports.finishVerificationRun = finishVerificationRun;
 exports.createGateResult = createGateResult;
@@ -38,11 +38,28 @@ exports.listVerificationRunsForPeriod = listVerificationRunsForPeriod;
  * trigger cannot be accepted by an API route and then rejected by SQLite.
  */
 exports.VERIFICATION_TRIGGERS = ['manual', 'wait', 'api', 'task'];
+/**
+ * Where a gate's definition came from (Issue #1791, migration v56).
+ *
+ * `builtin` = work-evidence / scope / env-clean (and the `config` pseudo-gate),
+ * which are the runner's own. `verify.yaml` = the repository's declared
+ * criterion of passing. `contract` = a gate the execution contract carried for
+ * this delegation alone.
+ *
+ * Recorded rather than inferred from the id, because the whole point of letting
+ * a contract carry gates is that a reader can tell the repository's definition
+ * of "passes" from one Issue's. Without it in the report, per-delegation gates
+ * are a second verify.yaml that nothing announces.
+ *
+ * The runtime tuple mirrors the CHECK constraint in migration v56.
+ */
+exports.VERIFICATION_GATE_SOURCES = ['builtin', 'verify.yaml', 'contract'];
 const RUN_COLUMNS = `
   id, worktree_id, instance_id, task_id, trigger, status, base_ref, started_at, finished_at
 `;
 const GATE_COLUMNS = `
-  id, run_id, gate_id, command, status, exit_code, duration_ms, log_tail, started_at, finished_at
+  id, run_id, gate_id, command, status, exit_code, duration_ms, log_tail, started_at, finished_at,
+  source
 `;
 function mapRunRow(row) {
     return {
@@ -69,6 +86,7 @@ function mapGateRow(row) {
         logTail: row.log_tail,
         startedAt: new Date(row.started_at),
         finishedAt: row.finished_at === null ? null : new Date(row.finished_at),
+        source: row.source ?? null,
         timingsMeasured: row.finished_at !== null &&
             row.duration_ms !== null &&
             row.finished_at - row.started_at === row.duration_ms,
@@ -108,11 +126,12 @@ function createGateResult(db, runId, input) {
     const info = db
         .prepare(`
       INSERT INTO verification_gate_results (
-        run_id, gate_id, command, status, exit_code, duration_ms, log_tail, started_at, finished_at
+        run_id, gate_id, command, status, exit_code, duration_ms, log_tail, started_at,
+        finished_at, source
       )
-      VALUES (?, ?, ?, 'running', NULL, NULL, NULL, ?, NULL)
+      VALUES (?, ?, ?, 'running', NULL, NULL, NULL, ?, NULL, ?)
     `)
-        .run(runId, input.gateId, input.command, now);
+        .run(runId, input.gateId, input.command, now, input.source);
     const row = db
         .prepare(`SELECT ${GATE_COLUMNS} FROM verification_gate_results WHERE id = ?`)
         .get(Number(info.lastInsertRowid));
@@ -266,7 +285,7 @@ function listVerificationRunsForPeriod(db, opts = {}) {
     const placeholders = runRows.map(() => '?').join(', ');
     const gateRows = db
         .prepare(`
-      SELECT run_id, gate_id, status, exit_code, duration_ms
+      SELECT run_id, gate_id, status, exit_code, duration_ms, source
       FROM verification_gate_results
       WHERE run_id IN (${placeholders})
       ORDER BY started_at ASC, id ASC
@@ -279,6 +298,7 @@ function listVerificationRunsForPeriod(db, opts = {}) {
             status: row.status,
             exitCode: row.exit_code,
             durationMs: row.duration_ms,
+            source: row.source ?? null,
         };
         const bucket = byRun.get(row.run_id);
         if (bucket)