commandmate 0.22.2 → 0.24.0

package/dist/server/src/lib/hooks/sources/antigravity/hooks-config.js

@@ -0,0 +1,372 @@
+"use strict";
+/**
+ * The hooks CommandMate writes into `~/.gemini/config/hooks.json`, and the
+ * command that launches `agy` against them (Issue #1762).
+ *
+ * ## One file, for the whole machine
+ *
+ * antigravity has no per-workspace hook configuration. #1757 §5.4.2 put a
+ * differently-sized `hooks.json` at each candidate path and read agy's own
+ * `loaded N named hooks from M hooks.json file(s)` log line to see which one it
+ * had picked: the documented `<workspace>/.agents/hooks.json` is **never read**,
+ * even in a trusted workspace with a `.git` in it, and `~/.gemini/config/hooks.json`
+ * is. Always exactly one file (`from 1 hooks.json file(s)`).
+ *
+ * So there is no per-worktree file to write and no per-instance one either, and
+ * the two obvious escapes are both closed:
+ *
+ *  - **Swapping `HOME`** would move agy's own state — `~/.gemini/antigravity-cli/`
+ *    holds its settings, its conversation database and its credentials — and
+ *    hand every session a machine it has never seen.
+ *  - **Rewriting the file per launch** would race two worktrees against each
+ *    other, and the loser would be whichever session started first.
+ *
+ * **The resolution is that the file carries no correlation at all.** It says
+ * "post this event, for tool `antigravity`, to whatever `CM_HOOK_URL` names",
+ * and the worktree and instance travel in the environment of each launched
+ * session — see {@link buildAntigravityLaunchCommand}. One global file therefore
+ * serves any number of worktrees and instances at once, and a session started
+ * outside CommandMate posts to the default endpoint with a `cwd` of
+ * `~/.gemini/config`, which resolves to no worktree and is dropped. A dropped
+ * event is the correct outcome there; a misattributed one would not be.
+ *
+ * ## Which events are registered
+ *
+ * `SessionStart`, `PostToolUse` and `Stop` go to the fire-and-forget event
+ * receiver through the relay. `PreToolUse` goes somewhere else entirely, and
+ * that split is the single most important thing in this module.
+ *
+ * The other three are safe *and measured to be safe*, which is not the same
+ * claim twice:
+ *
+ *  - `PostToolUse`'s documented reply is "an empty JSON object `{}`", and the
+ *    spike ran it against a server that answered exactly that while tools kept
+ *    executing.
+ *  - `Stop`'s `decision` is also documented as required, but "**any value other
+ *    than `continue` allows the agent to stop**" — and the spike's `Stop` hook
+ *    answered `{}` throughout a session that ended normally.
+ *  - `SessionStart` is undocumented, fires anyway, and has no reply contract.
+ *
+ * ## Why `PreToolUse` is not on the relay (Issue #1779)
+ *
+ * agy's `PreToolUse` reply contract has a *required* `decision` field, and
+ * #1757 P10 measured what "required" means: a hook that answers `{}` has every
+ * tool call denied. Re-measured live for #1779 against agy **1.1.12**, in an
+ * isolated `HOME`, in an interactive session — a hook answering `{}` prints
+ * `⚠ Tool call denied by pre-tool hook:` and the command does not run.
+ *
+ * `scripts/hooks/cmate-agent-event.sh` writes **nothing** to stdout (`curl …
+ * >/dev/null`). That is why #1762 registered no `PreToolUse` at all. #1779
+ * measured the third case the two Issues before it had not: a hook that exits 0
+ * having printed *nothing* is **not** treated as `{}` — agy 1.1.12 falls
+ * through to its ordinary approval flow, exactly as with no hook installed. So
+ * "empty reply" and "no reply" are opposites here, and only one of them is a
+ * denial.
+ *
+ * Either way the relay cannot *adjudicate*, because it discards the response
+ * body. So `PreToolUse` is built here as an inline `curl` whose stdout is the
+ * verdict — the same shape codex's `PermissionRequest` and copilot's
+ * `PreToolUse` already use ({@link buildAntigravityPermissionHookCommand}).
+ *
+ * @module lib/hooks/sources/antigravity/hooks-config
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ANTIGRAVITY_ABSTAIN_BODY = exports.ANTIGRAVITY_PERMISSION_TIMEOUT_SECONDS = exports.ANTIGRAVITY_PERMISSION_CURL_TIMEOUT_SECONDS = exports.ANTIGRAVITY_PERMISSION_URL_ENV_VAR = exports.ANTIGRAVITY_PERMISSION_HOOK_EVENT = exports.ANTIGRAVITY_REGISTERED_HOOKS = exports.ANTIGRAVITY_TOOL_MATCHER = exports.ANTIGRAVITY_HOOK_NAME = void 0;
+exports.getAntigravityHooksConfigPath = getAntigravityHooksConfigPath;
+exports.buildAntigravityHookCommand = buildAntigravityHookCommand;
+exports.buildAntigravityPermissionHookCommand = buildAntigravityPermissionHookCommand;
+exports.buildAntigravityHookConfig = buildAntigravityHookConfig;
+exports.mergeAntigravityHooksConfig = mergeAntigravityHooksConfig;
+exports.writeAntigravityHooksConfig = writeAntigravityHooksConfig;
+exports.buildAntigravityLaunchCommand = buildAntigravityLaunchCommand;
+const os_1 = require("os");
+const path_1 = require("path");
+const types_1 = require("../../../../lib/cli-tools/types");
+const hook_settings_generator_1 = require("../../../../lib/hooks/hook-settings-generator");
+const logger_1 = require("../../../../lib/logger");
+// The `~/.gemini` tree belongs to gemini; agy lives inside it. The merge that
+// keeps the two from erasing each other is written once, there.
+const shared_config_tree_1 = require("../gemini/shared-config-tree");
+const tool_id_1 = require("./tool-id");
+const logger = (0, logger_1.createLogger)('lib/hooks/sources/antigravity/hooks-config');
+/**
+ * The top-level key CommandMate owns in agy's named-hook map.
+ *
+ * agy's `hooks.json` is `{ "<hook name>": { "<Event>": [...] } }` — two levels,
+ * unlike every other tool's `{ "hooks": { "<Event>": [...] } }` — and its own
+ * documentation says named hooks from different sources "are merged and executed
+ * sequentially". So occupying one key is the whole of co-existing with whatever
+ * the user has: their `lint-checker` and `safety-gate` keep running, in the same
+ * file, untouched.
+ */
+exports.ANTIGRAVITY_HOOK_NAME = 'commandmate';
+/** Matcher for the grouped events. `*` is agy's spelling of "every tool". */
+exports.ANTIGRAVITY_TOOL_MATCHER = '*';
+/**
+ * The agy events CommandMate relays to the fire-and-forget event receiver.
+ *
+ * `PreToolUse` is deliberately absent from *this* list and registered
+ * separately: its stdout is a verdict, not an observation. See
+ * {@link ANTIGRAVITY_PERMISSION_HOOK_EVENT}.
+ */
+exports.ANTIGRAVITY_REGISTERED_HOOKS = [
+    ['SessionStart', 'session_start'],
+    ['PostToolUse', 'post_tool_use'],
+    ['Stop', 'stop'],
+];
+/**
+ * agy's spelling of the event whose reply is a verdict (Issue #1779).
+ *
+ * agy has no `PermissionRequest`. `PreToolUse` is the approval gate, the same
+ * way it is for copilot, so this one event is pointed at
+ * `/api/hooks/permission-request` and never reaches the event store.
+ */
+exports.ANTIGRAVITY_PERMISSION_HOOK_EVENT = 'PreToolUse';
+/** Auto-Yes v2 receiver URL, with the correlation keys already in its query. */
+exports.ANTIGRAVITY_PERMISSION_URL_ENV_VAR = 'CM_PERMISSION_HOOK_URL';
+/**
+ * `curl --max-time` for the adjudication hook, in seconds.
+ *
+ * Strictly under {@link PERMISSION_REQUEST_TIMEOUT_SECONDS}, which is the
+ * `timeout` written into the handler, so that **CommandMate decides what a slow
+ * server means rather than agy does**. If curl were allowed to outlive the
+ * handler, agy would kill the hook and the reply would be the empty string —
+ * which on this tool is the one output that must never be produced by accident.
+ */
+exports.ANTIGRAVITY_PERMISSION_CURL_TIMEOUT_SECONDS = 4;
+/**
+ * The `timeout` written into the adjudication handler, in seconds.
+ *
+ * agy's own default is 30 (its bundled `hooks.md`), and the units really are
+ * seconds here — the same number in gemini's file means milliseconds. Shared
+ * with every other tool's permission hook so one number bounds how long a wedged
+ * server can hold up an approval anywhere.
+ */
+exports.ANTIGRAVITY_PERMISSION_TIMEOUT_SECONDS = hook_settings_generator_1.PERMISSION_REQUEST_TIMEOUT_SECONDS;
+/**
+ * What the adjudication hook prints when it has no verdict to report.
+ *
+ * **The most important string in this module.** `ask` is agy's own word for
+ * "prompt the user for permission (respects the Always Allow cache)" — i.e. the
+ * behaviour of a machine with no hook installed — and it is what every failure
+ * path below falls back to: a server that is down, a server that is slow, a 4xx,
+ * a body that is not JSON, a body with no `decision`, and an agy session
+ * CommandMate did not start.
+ *
+ * It is emphatically **not** `{}`, which agy reads as a denial and which would
+ * stop every tool call on the machine (#1757 P10, re-measured on 1.1.12 for
+ * #1779). It is also emphatically **not** `allow`: this config file is global,
+ * so an `allow` fallback would mean that stopping CommandMate silently
+ * auto-approves every tool call in every agy session on the machine, including
+ * ones CommandMate never started. Measured live for #1779: an `ask` reply draws
+ * agy's ordinary `Do you want to proceed?` dialog.
+ */
+exports.ANTIGRAVITY_ABSTAIN_BODY = '{"decision":"ask"}';
+/** Events agy wraps in a `matcher` + `hooks` group; the rest are flat handler lists. */
+const ANTIGRAVITY_GROUPED_EVENTS = new Set(['PreToolUse', 'PostToolUse']);
+/**
+ * The one file agy reads.
+ *
+ * Not overridable by an environment variable, deliberately: an override
+ * CommandMate honoured and agy did not would produce a config nothing reads,
+ * which is the failure this path is least able to notice. `options.path` exists
+ * for tests, which are the only caller that may point it elsewhere.
+ */
+function getAntigravityHooksConfigPath(options = {}) {
+    return options.path ?? (0, path_1.join)((0, os_1.homedir)(), '.gemini', 'config', 'hooks.json');
+}
+/**
+ * The relay invocation for one event.
+ *
+ * No `--worktree-id`, no `--instance-id` and no `--url`: this file is shared by
+ * every worktree on the machine, so a correlation key written into it would be
+ * wrong for every session but one. `--event` is mandatory rather than optional —
+ * agy's payloads carry no event-name field at all (#1757 R2), so this argument
+ * is the only thing that says which event arrived.
+ *
+ * @param relayPath - Absolute path to the relay script
+ * @param event - The word to report
+ */
+function buildAntigravityHookCommand(relayPath, event) {
+    return [
+        (0, hook_settings_generator_1.shellQuote)(relayPath),
+        '--tool',
+        tool_id_1.ANTIGRAVITY_CLI_TOOL_ID,
+        '--event',
+        event,
+        '--stdin-json',
+    ].join(' ');
+}
+/**
+ * The `PreToolUse` command, whose stdout **is** the verdict (Issue #1779).
+ *
+ * Never the relay: that script writes its response body to `/dev/null`, and the
+ * body is the entire point here. The same reasoning — and very nearly the same
+ * one-liner — as `codex/hooks-config`'s `buildCodexPermissionHookCommand` and
+ * `copilot/hook-settings`'s `buildCopilotPermissionCommand`, with one
+ * difference that inverts all of it:
+ *
+ * **Those two may print nothing when things go wrong. This one may not.**
+ * codex and copilot read silence as "no opinion" and fall through to their own
+ * approval flow, so `… || true` with no output is their fail-safe. agy reads an
+ * *empty object* as a denial, and a hook that is killed mid-`curl` produces
+ * whatever partial bytes it had written. So every path through this command
+ * ends in a `printf` of either the server's verdict or
+ * {@link ANTIGRAVITY_ABSTAIN_BODY}, and `curl` is bounded well inside the
+ * handler's own timeout so that being killed is not one of the paths.
+ *
+ * Reading it in order:
+ *
+ *  1. **The guard.** `~/.gemini/config/hooks.json` is one file for the whole
+ *     machine, so this command also runs in agy sessions CommandMate did not
+ *     start. Those have no `CM_PERMISSION_HOOK_URL`, and the correct thing for
+ *     them is to behave as though no hook existed — `cat >/dev/null` first, so
+ *     the agent's write to the hook's stdin does not become an EPIPE, then the
+ *     abstain body. This is also the whole of failure path 5.
+ *  2. **The bearer header**, assembled with `set --` rather than `${VAR:+-H …}`
+ *     because that expansion word-splits and sends `Authorization:` alone. The
+ *     relay script and copilot's command solve it the same way.
+ *  3. **`curl -f`**, so a 4xx or 5xx prints nothing and lands on the fallback:
+ *     failure path 3. `2>/dev/null` keeps a connection error off the agent's
+ *     stderr (path 1), and `-m` bounds the wait (path 2).
+ *  4. **The shape check.** A reply is passed through only when it looks like a
+ *     JSON object carrying a `decision`. Anything else — an empty string from
+ *     paths 1-3, an HTML error page from a proxy, a JSON object from some other
+ *     service, a truncated body — is failure path 4 and becomes the abstain
+ *     body. Deliberately a `case` glob rather than a parser: there is no `jq` to
+ *     depend on here, and the failure mode of guessing wrong is bounded by the
+ *     fact that the *only* alternative to passing the body through is abstaining.
+ */
+function buildAntigravityPermissionHookCommand() {
+    const url = `"$${exports.ANTIGRAVITY_PERMISSION_URL_ENV_VAR}"`;
+    const abstain = `printf '%s' ${(0, hook_settings_generator_1.shellQuote)(exports.ANTIGRAVITY_ABSTAIN_BODY)}`;
+    return (`if [ -z "\${${exports.ANTIGRAVITY_PERMISSION_URL_ENV_VAR}:-}" ]; then ` +
+        `cat >/dev/null; ${abstain}; exit 0; fi; ` +
+        `set -- -sS -f -m ${exports.ANTIGRAVITY_PERMISSION_CURL_TIMEOUT_SECONDS} -X POST ` +
+        `-H 'Content-Type: application/json'; ` +
+        `if [ -n "\${${hook_settings_generator_1.AUTH_TOKEN_ENV_VAR}:-}" ]; then ` +
+        `set -- "$@" -H "Authorization: Bearer $${hook_settings_generator_1.AUTH_TOKEN_ENV_VAR}"; fi; ` +
+        `out=$(curl "$@" --data-binary @- ${url} 2>/dev/null); ` +
+        `case "$out" in '{'*'"decision"'*) printf '%s' "$out" ;; *) ${abstain} ;; esac`);
+}
+/**
+ * CommandMate's named hook, ready to be merged into agy's config.
+ *
+ * @param relayPath - Absolute path to the relay script
+ */
+function buildAntigravityHookConfig(relayPath) {
+    const config = {};
+    for (const [nativeName, event] of exports.ANTIGRAVITY_REGISTERED_HOOKS) {
+        const handler = {
+            type: 'command',
+            command: buildAntigravityHookCommand(relayPath, event),
+            timeout: hook_settings_generator_1.HOOK_TIMEOUT_SECONDS,
+        };
+        config[nativeName] = ANTIGRAVITY_GROUPED_EVENTS.has(nativeName)
+            ? [{ matcher: exports.ANTIGRAVITY_TOOL_MATCHER, hooks: [handler] }]
+            : [handler];
+    }
+    // Issue #1779. Its own handler, its own receiver and its own timeout: this is
+    // the only entry in the file whose stdout agy obeys.
+    config[exports.ANTIGRAVITY_PERMISSION_HOOK_EVENT] = [
+        {
+            matcher: exports.ANTIGRAVITY_TOOL_MATCHER,
+            hooks: [
+                {
+                    type: 'command',
+                    command: buildAntigravityPermissionHookCommand(),
+                    timeout: hook_settings_generator_1.PERMISSION_REQUEST_TIMEOUT_SECONDS,
+                },
+            ],
+        },
+    ];
+    return config;
+}
+/**
+ * Put CommandMate's named hook into an existing config without disturbing the
+ * rest of it.
+ *
+ * Pure. One key is replaced; every other named hook is passed through by
+ * identity, in its original position — including a previous `commandmate` key,
+ * which is replaced rather than appended to, so relaunching does not accumulate
+ * handlers.
+ *
+ * @param existing - The parsed `hooks.json`, or null when there is none
+ * @param config - What {@link buildAntigravityHookConfig} produced
+ */
+function mergeAntigravityHooksConfig(existing, config) {
+    return { ...existing, [exports.ANTIGRAVITY_HOOK_NAME]: config };
+}
+/**
+ * Write `~/.gemini/config/hooks.json`.
+ *
+ * @returns The path written, or null when injection is off or not possible
+ */
+function writeAntigravityHooksConfig(options = {}) {
+    if (!(0, hook_settings_generator_1.isHookInjectionEnabled)())
+        return null;
+    const relayPath = (0, hook_settings_generator_1.resolveRelayScriptPath)();
+    if (!relayPath) {
+        logger.warn('antigravity-hook-relay-missing');
+        return null;
+    }
+    const configPath = getAntigravityHooksConfigPath(options);
+    try {
+        const existing = (0, shared_config_tree_1.readJsonObjectFile)(configPath);
+        (0, shared_config_tree_1.writeJsonObjectFile)(configPath, mergeAntigravityHooksConfig(existing, buildAntigravityHookConfig(relayPath)));
+        return configPath;
+    }
+    catch (error) {
+        // Fail-open. A session that starts without hooks is the pre-#1762 status
+        // quo; a session that fails to start because a config file could not be
+        // written is not.
+        logger.warn('antigravity-hooks-config-write-failed', {
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return null;
+    }
+}
+/**
+ * The command that launches `agy` for one instance.
+ *
+ * `CM_HOOK_URL` is not a convenience here the way it is for gemini — it is the
+ * *only* correlation channel agy has. Its payloads carry no `cwd` and an empty
+ * `workspacePaths` (#1757 R6), its hooks run with a working directory of
+ * `~/.gemini/config`, and its config file is one per machine. The environment of
+ * the process CommandMate started is the one thing that differs between two
+ * concurrent agy sessions, so that is where the worktree and instance go. The
+ * relay reads `CM_HOOK_URL` itself, so no shell expansion inside the hook
+ * command is relied on.
+ *
+ * Two variables, not one, since Issue #1779: the observation events and the
+ * adjudication go to different receivers with opposite contracts, and the
+ * adjudication hook treats an absent
+ * {@link ANTIGRAVITY_PERMISSION_URL_ENV_VAR} as "this session is not
+ * CommandMate's, abstain". That guard is the only thing standing between the
+ * machine-global config file and an agy the operator started in their own
+ * terminal, so the variable is set here and nowhere else.
+ *
+ * The executable is quoted but not otherwise touched, so a caller may append its
+ * own flags — `AntigravityTool.startSession` adds `--model` — after the value
+ * this returns.
+ *
+ * Never throws, and returns the executable unchanged when injection is off.
+ *
+ * @param executablePath - `agy`, or a resolved path to it
+ * @param target - The instance being started
+ * @returns The command line to type into the pane
+ */
+function buildAntigravityLaunchCommand(executablePath, target, options = {}) {
+    if (!(0, hook_settings_generator_1.isHookInjectionEnabled)())
+        return executablePath;
+    if (!(0, types_1.isValidInstanceId)((0, hook_settings_generator_1.resolveTargetInstanceId)(target))) {
+        logger.warn('antigravity-hook-invalid-instance-id', { worktreeId: target.worktreeId });
+        return executablePath;
+    }
+    const scoped = { ...target, cliToolId: tool_id_1.ANTIGRAVITY_CLI_TOOL_ID };
+    const url = (0, hook_settings_generator_1.buildAgentEventUrl)(scoped, options);
+    const permissionUrl = (0, hook_settings_generator_1.buildPermissionRequestUrl)(scoped, options);
+    return (`CM_HOOK_URL=${(0, hook_settings_generator_1.shellQuote)(url)} ` +
+        `${exports.ANTIGRAVITY_PERMISSION_URL_ENV_VAR}=${(0, hook_settings_generator_1.shellQuote)(permissionUrl)} ` +
+        `${(0, hook_settings_generator_1.shellQuote)(executablePath)}`);
+}

package/dist/server/src/lib/hooks/sources/antigravity/source.js

@@ -0,0 +1,229 @@
+"use strict";
+/**
+ * Antigravity's {@link AgentEventSource} (Issue #1762, Phase 4-4 of Epic #1720;
+ * adjudication added by Issue #1779).
+ *
+ * The tool that does not fit. Four things about agy are different in kind from
+ * the other push sources rather than different in spelling, and every one of
+ * them is a thing that fails without an error message:
+ *
+ *  1. **An empty object is a denial.** Everywhere else `{}` means "CommandMate
+ *     has no opinion". On agy's `PreToolUse` it means *deny*, and the agent
+ *     loses every tool it has (#1757 P10; re-measured on 1.1.12 for #1779, where
+ *     it prints `⚠ Tool call denied by pre-tool hook:`). A *timeout* is
+ *     fail-open, and so — #1779's correction to #1762 — is a hook that exits 0
+ *     having **printed nothing at all**: measured on 1.1.12, that is
+ *     indistinguishable from having no hook. "No reply" and "an empty reply" are
+ *     opposites here, which is not true of any other tool.
+ *  2. **The payload cannot say what it is.** No event-name field, no `cwd`, and
+ *     `workspacePaths` is `[]` in CLI mode (#1757 R2/R6). The event word arrives
+ *     as a relay argument and the correlation keys as an environment variable;
+ *     see `./hooks-config`.
+ *  3. **One config file for the machine.** `~/.gemini/config/hooks.json`, and
+ *     the documented workspace-local file is never read.
+ *  4. **`Stop` is not an observation.** Answering `{"decision":"continue"}`
+ *     restarts the agent's loop, so the event CommandMate uses for "the turn is
+ *     over" is one whose reply can prevent the turn from being over.
+ *
+ * ## How abstention is spelled, and why `noDecision` says `proceeds` (#1779)
+ *
+ * #1762 shipped this source with `noDecision: { kind: 'blocks' }` and no
+ * `PreToolUse` hook, on the reasoning that abstaining *would* stop the agent if
+ * a hook existed, and that `blocks` was the closest member of
+ * {@link NoDecisionBehavior} to "it refuses". Both halves of that are now
+ * obsolete, because #1779 registered the hook and measured the missing case.
+ *
+ * agy's own `decision` vocabulary has four words — `allow`, `deny`, `ask`,
+ * `force_ask` — and `ask` means *"prompt the user for permission (respects the
+ * Always Allow cache)"*, i.e. precisely what abstaining means. Measured live for
+ * #1779 against agy 1.1.12 in an isolated `HOME`: a `PreToolUse` hook answering
+ * `{"decision":"ask"}` draws agy's ordinary `Do you want to proceed? / 1. Yes …`
+ * dialog, the same dialog a hooks-free control run drew.
+ *
+ * So abstaining on agy costs a dialog and nothing else — `proceeds`, the same
+ * value Claude, codex and copilot carry — **provided abstention is spelled
+ * `{"decision":"ask"}` and never `{}`.** The declaration and
+ * {@link AgentEventSource.encodeVerdict} have to be read together: this field is
+ * true *because* of how the verdict below is encoded, and flipping the encoding
+ * back to `{}` would make it a lie without changing a character of it.
+ *
+ * ## What `allow` does and does not buy on this tool
+ *
+ * Measured for #1779 on agy 1.1.12, interactively: a `PreToolUse` hook
+ * answering `{"decision":"allow"}` **does not suppress the approval dialog** —
+ * neither on its own nor with `permissionOverrides: ["command(*)"]`. The
+ * verdict is encoded honestly all the same, because it is agy's documented
+ * spelling of the thing CommandMate means and because `--print` (headless) does
+ * honour it (#1757 §5.4.4). Auto-Yes over an interactive agy therefore still
+ * lands on the TUI responder, which has answered that dialog since #988. What
+ * this source adds is that abstaining is finally *safe*, and that a verdict can
+ * be expressed at all.
+ *
+ * @module lib/hooks/sources/antigravity/source
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.antigravityAgentEventSource = void 0;
+exports.parseAntigravityPermissionRequest = parseAntigravityPermissionRequest;
+exports.encodeAntigravityVerdict = encodeAntigravityVerdict;
+const permission_request_payload_1 = require("../../../../lib/hooks/permission-request-payload");
+const define_source_1 = require("../define-source");
+const event_mapper_1 = require("../event-mapper");
+const hooks_config_1 = require("./hooks-config");
+const tool_id_1 = require("./tool-id");
+/**
+ * agy's spelling of "no opinion" (Issue #1779).
+ *
+ * `ask` is documented as *"Prompt the user for permission (respects the Always
+ * Allow cache)"*, and measured on 1.1.12 to draw exactly the dialog a hooks-free
+ * run draws. **Never `{}`** — see {@link ANTIGRAVITY_ABSTAIN_BODY} in
+ * `./hooks-config`, whose string form is this object and must stay in step with
+ * it; `encodesTheSameAbstention` in the tests pins the two together.
+ */
+const ABSTAIN_BODY = { decision: 'ask' };
+/**
+ * Read agy's `PreToolUse` payload as a permission request (S7).
+ *
+ * Was `() => null` until #1779, which was correct while no `PreToolUse` hook
+ * existed and is a silent Auto-Yes-is-off switch now that one does: a null
+ * payload makes `decidePermissionRequest` answer `unknown-payload`, which is
+ * indistinguishable from a working feature with nothing to approve.
+ *
+ * Nothing here is Claude-shaped. agy's payload is protojson camelCase with the
+ * call nested under `toolCall`, has no `hook_event_name` to key off (#1757 R2)
+ * and no `prompt_id` of any spelling (R5) — `stepIdx` identifies a step within a
+ * conversation and is deliberately not passed off as a prompt id, since the
+ * route uses that field to correlate and mints its own when it is absent.
+ *
+ * Strict for the same reason Claude's and copilot's parsers are: anything
+ * unvouchable becomes null, null becomes no-decision, and no-decision on this
+ * tool is now a dialog rather than a denial.
+ *
+ * @param body - Whatever was posted to `/api/hooks/permission-request`
+ */
+function parseAntigravityPermissionRequest(body) {
+    if (!(0, event_mapper_1.isPlainObject)(body))
+        return null;
+    const toolCall = body.toolCall;
+    if (!(0, event_mapper_1.isPlainObject)(toolCall))
+        return null;
+    const toolName = (0, event_mapper_1.readStringField)(toolCall, 'name');
+    if (!toolName || toolName.length > permission_request_payload_1.MAX_TOOL_NAME_LENGTH)
+        return null;
+    // No arguments means nothing for the deny patterns to be judged against,
+    // which makes the request unadjudicatable rather than harmless.
+    if (!(0, event_mapper_1.isPlainObject)(toolCall.args))
+        return null;
+    return {
+        toolName,
+        toolInput: toolCall.args,
+        promptId: null,
+        sessionId: (0, event_mapper_1.readStringField)(body, 'conversationId'),
+        permissionMode: null,
+        permissionSuggestions: null,
+    };
+}
+/**
+ * Encode a verdict in agy's wire form (S6, #1757 R15).
+ *
+ * A top-level `decision`, not Claude's `hookSpecificOutput.decision.behavior`
+ * and not copilot's `hookSpecificOutput.permissionDecision`. The three
+ * measurements this rests on, all taken against 1.1.12 in an isolated `HOME`:
+ *
+ *  - `{}` → `⚠ Tool call denied by pre-tool hook:`, the tool does not run.
+ *    **This is why abstention may never be the empty object.**
+ *  - `{"decision":"ask"}` → the ordinary `Do you want to proceed?` dialog.
+ *  - `{"decision":"allow"}` → *also* the ordinary dialog, interactively. agy
+ *    honours it in `--print` (#1757 §5.4.4) and treats it as "the hook does not
+ *    object" in the TUI, where the user is still asked. It is encoded anyway:
+ *    it is agy's documented word for what CommandMate means, and a source that
+ *    lied about its intent to match one version's behaviour would be wrong the
+ *    moment that behaviour changed.
+ *
+ * `allowAlways` and `answer` collapse to abstention, as they do on copilot:
+ * agy's `permissionOverrides` is the only standing-grant form it has, and
+ * approving one call is not the same promise as writing a standing rule.
+ */
+function encodeAntigravityVerdict(verdict) {
+    if (verdict.kind === 'allowOnce')
+        return { decision: 'allow' };
+    // `reason` is shown to the agent, which is how a refusal becomes something an
+    // operator can act on rather than a mystery.
+    if (verdict.kind === 'deny')
+        return { decision: 'deny', reason: verdict.message ?? '' };
+    return { ...ABSTAIN_BODY };
+}
+/**
+ * Antigravity as an event source.
+ *
+ * Registered in `../registry`. Nothing outside this directory imports it by
+ * name; callers ask the registry for the tool they are holding.
+ */
+exports.antigravityAgentEventSource = (0, define_source_1.definePushHookSource)({
+    cliToolId: tool_id_1.ANTIGRAVITY_CLI_TOOL_ID,
+    // #1779, measured. Read this together with `encodeVerdict`: abstaining is
+    // safe here *because* it is spelled `{"decision":"ask"}`, and would stop every
+    // tool call on the machine if it were spelled `{}` (#1757 P10). See the module
+    // comment for the measurement that replaced #1762's `{ kind: 'blocks' }`.
+    noDecision: { kind: 'proceeds' },
+    capabilities: {
+        // agy has no `SessionEnd`, no `Notification` and no `UserPromptSubmit` — not
+        // "undocumented", *absent*: configuring all three produced zero events
+        // across the whole spike.
+        //
+        // `pre_tool_use` is missing for a different reason again, and it is the same
+        // reason copilot omits it (`copilot/source.ts`): the event fires and is
+        // registered, but it is pointed at `/api/hooks/permission-request`, which
+        // adjudicates and does not record. Nothing ever files a `pre_tool_use`
+        // NormalizedAgentEvent for agy, and this list is a promise about what does —
+        // a caller waiting for a word it names waits for good.
+        supportedEvents: ['session_start', 'post_tool_use', 'stop'],
+        configScope: 'global-singleton',
+        // What the adjudication hook actually gets: agy's own default is 30s, the
+        // handler is written with a 5s `timeout`, and the `curl` inside it gives up
+        // at 4s so that CommandMate rather than agy decides what a slow server
+        // means. The number a caller budgeting a verdict needs is the outer one.
+        decisionTimeoutSeconds: hooks_config_1.ANTIGRAVITY_PERMISSION_TIMEOUT_SECONDS,
+    },
+    // Empty on purpose, and the only empty mapper list in the codebase. There is
+    // nothing in an agy payload to map *from*: no `hook_event_name`, no `type`,
+    // no discriminator that is not a guess. `PreToolUse` and `PostToolUse` differ
+    // only by a `error` key that is an empty string on success, so inferring the
+    // event from field presence would file one as the other and do it silently.
+    // The word comes from the relay's `--event`, which reaches `normalizeEvent`
+    // as `RawAgentEvent.event` and bypasses this list entirely.
+    mappers: [],
+    // Nothing to read. An empty list is what makes `definePushHookSource` skip the
+    // payload lookup rather than search for a field that is never there.
+    nativeEventNameFields: [],
+    // protojson camelCase, one tool out of six. `session_id` does not exist here.
+    conversationIdFields: ['conversationId'],
+    toolCallIdFields: [],
+    // Issue #1783. protojson camelCase again: `modelName`, not `model`. Present on
+    // all six captured fixtures, so agy is the one tool whose model survives every
+    // kind of event — including the ones that carry no session id at all.
+    modelFields: ['modelName'],
+    // The tool name is nested under `toolCall`, and it is present on both
+    // `PreToolUse` and `PostToolUse` payloads (checked against both fixtures).
+    extractDetail: (event, payload) => event === 'pre_tool_use' || event === 'post_tool_use'
+        ? (0, event_mapper_1.boundDetail)((0, event_mapper_1.readNestedString)(payload, ['toolCall', 'name']))
+        : null,
+    // agy has no `PermissionRequest` event; its approvals ride on `PreToolUse`,
+    // which #1779 registers against its own receiver.
+    parsePermissionRequest: parseAntigravityPermissionRequest,
+    // No `AskUserQuestion` tool and nothing shaped like one.
+    parseQuestion: () => null,
+    encodeVerdict: encodeAntigravityVerdict,
+    // Unlike gemini, the whole config is reachable from here: the file is global,
+    // so no worktree path is needed and `prepareLaunch` really does write it.
+    prepareLaunch: (target, executablePath) => {
+        const settingsPath = (0, hooks_config_1.writeAntigravityHooksConfig)();
+        return {
+            command: (0, hooks_config_1.buildAntigravityLaunchCommand)(executablePath, {
+                worktreeId: target.worktreeId,
+                instanceId: target.instanceId,
+                cliToolId: tool_id_1.ANTIGRAVITY_CLI_TOOL_ID,
+            }),
+            settingsPath,
+        };
+    },
+});

package/dist/server/src/lib/hooks/sources/antigravity/tool-id.js

@@ -0,0 +1,16 @@
+"use strict";
+/**
+ * Antigravity's {@link CLIToolType} id, as a constant.
+ *
+ * The id is `antigravity`; **the binary is `agy`**. There is no executable
+ * called `antigravity` on any machine (#1757 §1), so the two names are not
+ * interchangeable and the split is deliberate: this constant is CommandMate's
+ * tool id — the thing that keys the registry, the receiver's `tool` field and
+ * the instance triple — while `src/lib/cli-tools/antigravity.ts` owns the
+ * command that actually runs.
+ *
+ * @module lib/hooks/sources/antigravity/tool-id
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ANTIGRAVITY_CLI_TOOL_ID = void 0;
+exports.ANTIGRAVITY_CLI_TOOL_ID = 'antigravity';