commandmate 0.24.0 → 0.26.0

package/dist/server/src/lib/cli-tools/copilot.js

@@ -149,7 +149,11 @@ class CopilotTool extends base_1.BaseCLITool {
             // Fails open in every branch: with `CM_AGENT_HOOKS_INJECT=0`, or with a
             // settings file that cannot be read or written, this is byte-for-byte the
             // `gh copilot` this line has always sent.
-            const launchCommand = (0, agent_session_lifecycle_1.prepareAgentLaunch)({ worktreeId, cliToolId: tool_id_1.COPILOT_CLI_TOOL_ID, instanceId }, hook_settings_1.COPILOT_LAUNCH_COMMAND).command;
+            const launchCommand = (0, agent_session_lifecycle_1.buildAgentLaunchCommandLine)({
+                target: { worktreeId, cliToolId: tool_id_1.COPILOT_CLI_TOOL_ID, instanceId },
+                executablePath: hook_settings_1.COPILOT_LAUNCH_COMMAND,
+                worktreePath,
+            });
             // Start Copilot CLI in interactive mode
             await (0, tmux_1.sendKeys)(sessionName, launchCommand, true);
             // Wait for Copilot to initialize

package/dist/server/src/lib/cli-tools/gemini.js

@@ -16,7 +16,6 @@ const submit_verified_sender_1 = require("./submit-verified-sender");
 const tmux_capture_cache_1 = require("../tmux/tmux-capture-cache");
 const cli_patterns_1 = require("../detection/cli-patterns");
 const sources_1 = require("../../lib/hooks/sources");
-const source_1 = require("../../lib/hooks/sources/gemini/source");
 const agent_session_lifecycle_1 = require("../../lib/session/agent-session-lifecycle");
 const logger_1 = require("../../lib/logger");
 const cli_tool_timing_config_1 = require("../../config/cli-tool-timing-config");
@@ -92,23 +91,24 @@ class GeminiTool extends base_1.BaseCLITool {
             });
             // Wait a moment for the session to be created
             await new Promise((resolve) => setTimeout(resolve, cli_tool_timing_config_1.TUI_SESSION_CREATE_WAIT_MS));
-            // Issue #1762: hand this worktree its own hooks config, merged into any
-            // `.gemini/settings.json` that is already there. Written from here rather
-            // than from the source's `prepareLaunch` because the worktree path is the
-            // one input `AgentInstanceRef` does not carry, and gemini is the only tool
-            // whose config is scoped to a worktree. Fail-open: a config that cannot be
-            // written costs the events and nothing else.
-            (0, source_1.injectGeminiHookSettings)(worktreePath, {
-                worktreeId,
-                cliToolId: sources_1.GEMINI_CLI_TOOL_ID,
-                instanceId,
-            });
             // Start Gemini CLI in interactive mode (no flags = interactive REPL).
-            // `prepareAgentLaunch` prefixes `CM_HOOK_URL`, which is what tells the
+            //
+            // Issue #1762 hands this worktree its own hooks config, merged into any
+            // `.gemini/settings.json` that is already there; Issue #1846 moved that
+            // write inside `prepareLaunch`, where it belongs — the worktree path is
+            // now part of the launch context, so the second entry point this file
+            // used to call (`injectGeminiHookSettings`) is gone.
+            //
+            // The rendered line prefixes `CM_HOOK_URL`, which is what tells the
             // receiver which instance an event came from — `.gemini/settings.json` is
             // per worktree and cannot. `CM_AGENT_HOOKS_INJECT=0` returns the bare
-            // command, unchanged from before this Issue.
-            const launchCommand = (0, agent_session_lifecycle_1.prepareAgentLaunch)({ worktreeId, cliToolId: sources_1.GEMINI_CLI_TOOL_ID, instanceId }, this.command).command;
+            // command, unchanged from before these Issues. Fail-open throughout: a
+            // config that cannot be written costs the events and nothing else.
+            const launchCommand = (0, agent_session_lifecycle_1.buildAgentLaunchCommandLine)({
+                target: { worktreeId, cliToolId: sources_1.GEMINI_CLI_TOOL_ID, instanceId },
+                executablePath: this.command,
+                worktreePath,
+            });
             await (0, tmux_1.sendKeys)(sessionName, launchCommand, true);
             // Wait for Gemini to initialize (minimum wait for banner/auth)
             await new Promise((resolve) => setTimeout(resolve, GEMINI_INIT_WAIT_MS));

package/dist/server/src/lib/cli-tools/opencode.js

@@ -148,9 +148,15 @@ class OpenCodeTool extends base_1.BaseCLITool {
             // that nothing can read back (§5.9). Null means "no structured events",
             // and the launch below is then the pre-#1763 bare command.
             await (0, runtime_1.reserveOpencodeServerPort)(target, worktreePath);
-            // Start OpenCode TUI. `prepareAgentLaunch` asks the tool's own
-            // `AgentEventSource` for the command line (S3/S4/S5) and never throws.
-            const launchCommand = (0, agent_session_lifecycle_1.prepareAgentLaunch)(target, this.command).command;
+            // Start OpenCode TUI. `buildAgentLaunchCommandLine` asks the tool's own
+            // `AgentEventSource` for the plan (S3/S4/S5) and never throws. opencode's
+            // environment is empty — it is the one source with no correlation
+            // variable, because CommandMate holds the connection (#1846).
+            const launchCommand = (0, agent_session_lifecycle_1.buildAgentLaunchCommandLine)({
+                target,
+                executablePath: this.command,
+                worktreePath,
+            });
             await (0, tmux_1.sendKeys)(sessionName, launchCommand, true);
             // Wait for OpenCode to initialize (GPU model loading via Ollama)
             await new Promise((resolve) => setTimeout(resolve, exports.OPENCODE_INIT_WAIT_MS));

package/dist/server/src/lib/detection/cli-patterns.js

@@ -4,11 +4,12 @@
  * Shared between response-poller.ts and API routes
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CLAUDE_SESSION_ERROR_REGEX_PATTERNS = exports.CLAUDE_SESSION_ERROR_PATTERNS = exports.extractAnsiSequences = exports.stripAnsi = exports.ANTIGRAVITY_SKIP_PATTERNS = exports.ANTIGRAVITY_SELECTION_LIST_PATTERN = exports.ANTIGRAVITY_SEPARATOR_PATTERN = exports.ANTIGRAVITY_THINKING_PATTERN = exports.ANTIGRAVITY_PROMPT_PATTERN = exports.VIBE_LOCAL_THINKING_PATTERN = exports.VIBE_LOCAL_PROMPT_PATTERN = exports.COPILOT_SKIP_PATTERNS = exports.COPILOT_SELECTION_LIST_PATTERN = exports.COPILOT_SEPARATOR_PATTERN = exports.COPILOT_THINKING_PATTERN = exports.COPILOT_PROMPT_PATTERN = exports.OPENCODE_SKIP_PATTERNS = exports.OPENCODE_SEPARATOR_PATTERN = exports.CLAUDE_SELECTION_LIST_FOOTER = exports.CLAUDE_MODEL_OVERLAY_FOOTER_PATTERN = exports.OPENCODE_SELECTION_LIST_PATTERN = exports.OPENCODE_PROCESSING_INDICATOR = exports.OPENCODE_RESPONSE_COMPLETE = exports.OPENCODE_LOADING_PATTERN = exports.OPENCODE_THINKING_PATTERN = exports.OPENCODE_PROMPT_AFTER_RESPONSE = exports.OPENCODE_PROMPT_PATTERN = exports.GEMINI_THINKING_PATTERN = exports.GEMINI_PROMPT_PATTERN = exports.MAX_PASTED_TEXT_RETRIES = exports.PASTED_TEXT_DETECT_DELAY = exports.PASTED_TEXT_PATTERN = exports.CODEX_STATUS_BAR_PATTERN = exports.CODEX_PAGER_FOOTER_PATTERN = exports.CODEX_APPROVAL_FOOTER_PATTERN = exports.CODEX_SELECTION_LIST_PATTERN = exports.CODEX_SEPARATOR_PATTERN = exports.CODEX_DIALOG_PATTERN = exports.CODEX_PROMPT_PATTERN = exports.CLAUDE_TRUST_DIALOG_PATTERN = exports.CLAUDE_SEPARATOR_PATTERN = exports.CLAUDE_PROMPT_PATTERN = exports.CODEX_INTERRUPT_HINT_PATTERN = exports.CODEX_THINKING_PATTERN = exports.CLAUDE_INTERRUPT_HINT_PATTERN = exports.CLAUDE_THINKING_PATTERN = exports.CLAUDE_SPINNER_CHARS = void 0;
+exports.CLAUDE_SESSION_ERROR_REGEX_PATTERNS = exports.CLAUDE_SESSION_ERROR_PATTERNS = exports.extractAnsiSequences = exports.stripAnsi = exports.ANTIGRAVITY_SKIP_PATTERNS = exports.ANTIGRAVITY_SELECTION_LIST_PATTERN = exports.ANTIGRAVITY_SEPARATOR_PATTERN = exports.ANTIGRAVITY_THINKING_PATTERN = exports.ANTIGRAVITY_PROMPT_PATTERN = exports.VIBE_LOCAL_THINKING_PATTERN = exports.VIBE_LOCAL_PROMPT_PATTERN = exports.COPILOT_SKIP_PATTERNS = exports.COPILOT_SELECTION_LIST_PATTERN = exports.COPILOT_SEPARATOR_PATTERN = exports.COPILOT_THINKING_PATTERN = exports.COPILOT_PROMPT_PATTERN = exports.OPENCODE_SKIP_PATTERNS = exports.OPENCODE_SEPARATOR_PATTERN = exports.CLAUDE_SELECTION_LIST_FOOTER = exports.CLAUDE_MODEL_OVERLAY_FOOTER_PATTERN = exports.OPENCODE_SELECTION_LIST_PATTERN = exports.OPENCODE_PROCESSING_INDICATOR = exports.OPENCODE_RESPONSE_COMPLETE = exports.OPENCODE_LOADING_PATTERN = exports.OPENCODE_THINKING_PATTERN = exports.OPENCODE_PROMPT_AFTER_RESPONSE = exports.OPENCODE_PROMPT_PATTERN = exports.GEMINI_THINKING_PATTERN = exports.GEMINI_PROMPT_PATTERN = exports.MAX_PASTED_TEXT_RETRIES = exports.PASTED_TEXT_DETECT_DELAY = exports.PASTED_TEXT_PATTERN = exports.CODEX_STATUS_BAR_PATTERN = exports.CODEX_PAGER_FOOTER_PATTERN = exports.CODEX_APPROVAL_FOOTER_PATTERN = exports.CODEX_SELECTION_LIST_PATTERN = exports.CODEX_SEPARATOR_PATTERN = exports.CODEX_HOOKS_REVIEW_ANCHORS = exports.CODEX_DIALOG_PATTERN = exports.CODEX_PROMPT_PATTERN = exports.CLAUDE_TRUST_DIALOG_PATTERN = exports.CLAUDE_SEPARATOR_PATTERN = exports.CLAUDE_PROMPT_PATTERN = exports.CODEX_INTERRUPT_HINT_PATTERN = exports.CODEX_THINKING_PATTERN = exports.CLAUDE_INTERRUPT_HINT_PATTERN = exports.CLAUDE_THINKING_PATTERN = exports.CLAUDE_SPINNER_CHARS = void 0;
 exports.isCodexTurnActive = isCodexTurnActive;
 exports.findClaudeChromeStart = findClaudeChromeStart;
 exports.isCodexPromptReady = isCodexPromptReady;
 exports.getCodexActiveDialog = getCodexActiveDialog;
+exports.getCodexLifecycleDialog = getCodexLifecycleDialog;
 exports.detectThinking = detectThinking;
 exports.getCliToolPatterns = getCliToolPatterns;
 exports.stripBoxDrawing = stripBoxDrawing;
@@ -330,7 +331,18 @@ function isCodexPromptReady(output) {
  * update dialog wins over its own "Press enter to continue" footer, because Enter
  * on the update dialog could confirm the default "1. Update now" (npm install).
  */
-function getCodexActiveDialog(output) {
+/**
+ * The lines of Codex's ACTIVE region: everything strictly below the bottom-most
+ * genuine input-prompt line, or the whole frame when there is no prompt line
+ * (Issue #892).
+ *
+ * This is the one rule that keeps every Codex dialog classifier honest.
+ * capturePane returns scrollback, so a dialog that was answered minutes ago is
+ * still in the frame; only what sits BELOW the live prompt is still awaiting a
+ * key. Shared by getCodexActiveDialog and getCodexLifecycleDialog so the two
+ * cannot drift into disagreeing about what "active" means.
+ */
+function codexActiveRegionLines(output) {
     const lines = output.split('\n');
     // Index of the bottom-most genuine input-prompt line (-1 if none).
     let promptIdx = -1;
@@ -340,10 +352,12 @@ function getCodexActiveDialog(output) {
             break;
         }
     }
-    // Active region = lines strictly below the genuine prompt (the whole frame when
-    // there is no genuine prompt). Residual dialog text above a live prompt is
-    // excluded, so a dialog lingering in scrollback is never treated as active.
-    const active = lines.slice(promptIdx + 1).join('\n');
+    return lines.slice(promptIdx + 1);
+}
+function getCodexActiveDialog(output) {
+    // Residual dialog text above a live prompt is excluded, so a dialog lingering
+    // in scrollback is never treated as active.
+    const active = codexActiveRegionLines(output).join('\n');
     if (active === '') {
         return null;
     }
@@ -359,6 +373,134 @@ function getCodexActiveDialog(output) {
     }
     return null;
 }
+/**
+ * Anchors of codex's "Hooks need review" launch dialog — screen 1 of the three
+ * it can put in front of a session (Issue #1760, re-measured on codex-cli
+ * 0.148.0 for Issue #1829):
+ *
+ * ```
+ *  Hooks need review
+ *  4 hooks are new or changed.
+ *  Hooks can run outside the sandbox after you trust them.
+ *
+ * > 1. Review hooks
+ *   2. Trust all and continue
+ *   3. Continue without trusting (hooks won't run)
+ *   Press enter to confirm or esc to go back
+ * ```
+ *
+ * The hook COUNT is data — 0.147.0 said 5, 0.148.0 said 4 — so neither anchor
+ * reads it. Both strings are required so a "hooks" mention elsewhere cannot
+ * select an option on a live prompt.
+ */
+exports.CODEX_HOOKS_REVIEW_ANCHORS = ['Hooks need review', 'Continue without trusting'];
+/**
+ * Footer of screen 2, the hooks LIST, new in codex-cli 0.148.0 (Issue #1829):
+ * `Press t to trust all; enter to review hooks; esc to close`.
+ *
+ * The semicolon is what separates it from screen 3's footer — "trust all;" and
+ * "trust;" are disjoint — and matching the footer rather than the table above it
+ * keeps the two screens distinguishable by a single line each.
+ */
+const CODEX_HOOKS_LIST_FOOTER_PATTERN = /press\s+t\s+to\s+trust\s+all\s*;/i;
+/**
+ * Footer of screen 3, the per-hook review DETAIL (Issue #1829):
+ * `Press t to trust; esc to go back`. Where both live sessions in the Issue were
+ * found parked.
+ */
+const CODEX_HOOKS_DETAIL_FOOTER_PATTERN = /press\s+t\s+to\s+trust\s*;/i;
+/**
+ * How much of the active region {@link getCodexLifecycleDialog} judges, in
+ * non-blank lines counted from the bottom (Issue #1829).
+ *
+ * `getCodexActiveDialog` searches the whole active region, which is right for
+ * its caller: `waitForReady` only ever runs during `startSession`, when nothing
+ * else can be on screen. This classifier runs on every Auto-Yes poll for the
+ * life of the session, where "active region" alone is not enough — a codex
+ * approval request renders no `› ` composer line, so an approval that comes up
+ * while a dismissed hooks screen is still inside the capture window would have
+ * the whole frame as its active region and would be mistaken for the dialog.
+ * Requiring the dialog to be in the TAIL is what separates the screen the user
+ * is looking at from the one they have already left.
+ *
+ * 12 lines fits the tallest screen this has to recognise (the review dialog's
+ * two anchors sit 6 lines apart) and none of the shorter frames below it.
+ */
+const CODEX_LIFECYCLE_TAIL_LINES = 12;
+/**
+ * The interactive update dialog, by its option-3 label or its option-1 line.
+ *
+ * Deliberately stricter than `getCodexActiveDialog`'s `Update` AND `Skip`
+ * fallback: that pair can occur in ordinary agent output, and here a false
+ * positive silently stops Auto-Yes answering a real prompt. Both anchors below
+ * are dialog chrome that agent output does not produce.
+ */
+const CODEX_UPDATE_DIALOG_ANCHORS = [
+    /skip until next version/i,
+    /^\s*[›❯]?\s*\d+\.\s*Update now/im,
+];
+/** The directory-trust dialog's question line. */
+const CODEX_TRUST_DIALOG_ANCHOR = /Do you trust/;
+/**
+ * Classify the bottom-most ACTIVE codex lifecycle screen (Issue #1829).
+ *
+ * Position-based, via {@link codexActiveRegionLines}: a dialog left in
+ * scrollback above a live prompt is not active and returns `null`. That is not
+ * a detail — the auto-answer guard in the Auto-Yes poller is built on this
+ * function, and a whole-frame version of it would switch Auto-Yes off for the
+ * rest of a codex session the moment any launch dialog scrolled past.
+ *
+ * The two hooks screens are matched FIRST and bottom-up, because a stuck pane
+ * holds screen 2 above screen 3 and the way out of each differs. The remaining
+ * three are region-level substring tests, which is all their anchors allow:
+ * the review dialog's are on two different lines.
+ *
+ * Deliberately NOT used to decide whether a prompt exists. `detectPrompt` still
+ * reports these screens, so a human still sees them; what this function gates is
+ * only whether a machine may answer on their behalf.
+ *
+ * @param output - ANSI-stripped pane capture
+ * @returns The active lifecycle screen, or null when none is
+ */
+function getCodexLifecycleDialog(output) {
+    const activeLines = codexActiveRegionLines(output);
+    const window = [];
+    for (let i = activeLines.length - 1; i >= 0 && window.length < CODEX_LIFECYCLE_TAIL_LINES; i--) {
+        if (activeLines[i].trim() === '')
+            continue;
+        window.unshift(activeLines[i]);
+    }
+    if (window.length === 0)
+        return null;
+    const text = window.join('\n');
+    // One bottom-up pass, returning on the first line that decides the question --
+    // including the lines that decide it NEGATIVELY. A stuck pane holds screen 2
+    // above screen 3, and an approval request can come up with a hooks screen
+    // still inside the capture window; in both cases the screen the user is
+    // looking at is the lower one.
+    for (let i = window.length - 1; i >= 0; i--) {
+        const line = window[i];
+        if (CODEX_HOOKS_LIST_FOOTER_PATTERN.test(line))
+            return 'hooks-list';
+        if (CODEX_HOOKS_DETAIL_FOOTER_PATTERN.test(line))
+            return 'hooks-detail';
+        // The agent asking the human for permission mid-turn (Issue #1628's
+        // "esc to cancel" footer, which no lifecycle screen wears). This is exactly
+        // the prompt Auto-Yes exists to answer, so whatever lifecycle text is still
+        // above it has been left behind and must not withhold the answer.
+        if (exports.CODEX_APPROVAL_FOOTER_PATTERN.test(line))
+            return null;
+        if (CODEX_UPDATE_DIALOG_ANCHORS.some((pattern) => pattern.test(line)))
+            return 'update';
+        if (CODEX_TRUST_DIALOG_ANCHOR.test(line))
+            return 'trust';
+        // Both anchors required, so a stray "hooks" mention cannot claim the screen.
+        if (line.includes(exports.CODEX_HOOKS_REVIEW_ANCHORS[1]) && text.includes(exports.CODEX_HOOKS_REVIEW_ANCHORS[0])) {
+            return 'hooks-review';
+        }
+    }
+    return null;
+}
 /**
  * Codex separator pattern
  */

package/dist/server/src/lib/detection/status-detector.js

@@ -53,6 +53,8 @@ exports.STATUS_REASON = {
     CODEX_SELECTION_LIST: 'codex_selection_list',
     /** Issue #1017: Codex pager / edit-previous (transcript) mode. */
     CODEX_PAGER: 'codex_pager',
+    /** Issue #1829: Codex's hooks review screens, which only `t`/`esc` leave. */
+    CODEX_HOOKS_REVIEW: 'codex_hooks_review',
     ANTIGRAVITY_SELECTION_LIST: 'antigravity_selection_list',
     OPENCODE_RESPONSE_COMPLETE: 'opencode_response_complete',
     INPUT_PROMPT: 'input_prompt',
@@ -73,6 +75,9 @@ exports.SELECTION_LIST_REASONS = new Set([
     exports.STATUS_REASON.CODEX_SELECTION_LIST,
     // Issue #1017: Codex pager/edit-previous mode also drives NavigationButtons.
     exports.STATUS_REASON.CODEX_PAGER,
+    // Issue #1829: the hooks review screens have no numbered options — `t` and
+    // `esc` are the only ways out, and NavigationButtons is how a human sends them.
+    exports.STATUS_REASON.CODEX_HOOKS_REVIEW,
     exports.STATUS_REASON.ANTIGRAVITY_SELECTION_LIST,
 ]);
 /**
@@ -288,6 +293,29 @@ function detectSessionStatus(output, cliToolId, lastOutputTimestamp) {
             promptDetection: codexPagerPromptDetection,
         };
     }
+    // 0.75. Codex: the hooks review screens (Issue #1829)
+    // codex-cli 0.148.0 answers "1. Review hooks" with a two-screen review UI:
+    //   screen 2 "Press t to trust all; enter to review hooks; esc to close"
+    //   screen 3 "Press t to trust; esc to go back"
+    // Neither carries a numbered option, a "press enter to confirm" footer, or any
+    // thinking indicator, so every branch below falls through to the `running`
+    // default -- which is how two live sessions sat parked on screen 3 while the UI
+    // and `cmate wait` both reported them as busy. They are the bottom-most
+    // interactive element and nothing but a keypress moves them: that is `waiting`.
+    // Checked ahead of prompt detection because the transcript rows on screen 2 are
+    // ordinary text that must not be read as options.
+    if (cliToolId === 'codex') {
+        const codexLifecycleDialog = (0, cli_patterns_1.getCodexLifecycleDialog)(cleanOutput);
+        if (codexLifecycleDialog === 'hooks-list' || codexLifecycleDialog === 'hooks-detail') {
+            return {
+                status: 'waiting',
+                confidence: 'high',
+                reason: exports.STATUS_REASON.CODEX_HOOKS_REVIEW,
+                hasActivePrompt: false,
+                promptDetection: (0, prompt_detector_1.detectPrompt)((0, cli_patterns_1.stripBoxDrawing)(cleanOutput), (0, cli_patterns_1.buildDetectPromptOptions)(cliToolId)),
+            };
+        }
+    }
     // 0.8. Codex: selection list detection BEFORE prompt detection (Issue #622)
     // CODEX_SELECTION_LIST_PATTERN matches "press enter to confirm/select" footer.
     // Without this early check, detectPrompt() at priority 1 would detect the numbered

package/dist/server/src/lib/detection/upstream-faults.js

@@ -0,0 +1,120 @@
+"use strict";
+/**
+ * Signatures of an upstream (model API) fault, as they appear on an agent's
+ * terminal frame (Issue #1839).
+ *
+ * Moved here from `scripts/canary/expectations.ts`, where Issue #1727 first
+ * wrote them, because the canary is no longer the only reader: `capture --json`
+ * publishes the match as `upstreamFault` and `wait --fail-on-upstream-fault`
+ * branches on it. Two copies of a pattern list whose whole job is *not* to be
+ * over-eager would drift, and the drift would be silent on both sides.
+ *
+ * A leaf module by design — it imports nothing but {@link stripAnsi}, so the
+ * canary (which runs outside Next) and the server payload builder can share it
+ * without either pulling in the other's dependencies.
+ *
+ * ## What a match means, and what it does not
+ *
+ * A match means the signature was on the frame. A **non**-match means nothing at
+ * all about upstream health: the pane may have scrolled, the agent may render a
+ * failure with wording nobody has seen yet, and Issue #1834 measured a case
+ * where the pane went blank instead of carrying a banner. Nothing in this
+ * module — and nothing reading it — may report "no fault" as "upstream is
+ * healthy".
+ *
+ * @module lib/detection/upstream-faults
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UPSTREAM_FAULT_TRUNCATION_MARKER = exports.UPSTREAM_FAULT_EXCERPT_MAX_BYTES = exports.UPSTREAM_FAULTS = void 0;
+exports.matchUpstreamFault = matchUpstreamFault;
+exports.findUpstreamFault = findUpstreamFault;
+const ansi_1 = require("./ansi");
+/**
+ * Patterns are anchored on ERROR wording, not on the words "usage limit".
+ * Claude's own banner advertises "up to 50% of your weekly usage limit on
+ * Fable 5" on a perfectly healthy frame — a looser pattern marked every
+ * scenario of a run as `blocked` (measured 2026-08-06), which would have hidden
+ * real regressions behind a fake infrastructure excuse.
+ *
+ * Order is precedence: the first match wins, so the specific overload wording
+ * is listed ahead of the generic `API Error` catch-all. The line Claude 2.1.236
+ * prints on a 529 storm contains both (`API Error: Repeated 529 Overloaded
+ * errors …`, measured for Issue #1839), and `overloaded` is the more useful of
+ * the two answers because it carries `selfRetrying: true`.
+ */
+exports.UPSTREAM_FAULTS = [
+    { id: 'overloaded', pattern: /\b5\d{2}\s+Overloaded\b/i, selfRetrying: true },
+    { id: 'retrying', pattern: /Retrying in \d+s\s*[·•]\s*attempt \d+\/\d+/i, selfRetrying: true },
+    { id: 'limit-reached', pattern: /\blimit reached\b/i, selfRetrying: false },
+    { id: 'api-error', pattern: /\bAPI Error(?::|\s+\d{3})/i, selfRetrying: false },
+];
+/**
+ * Bound on {@link UpstreamFaultMatch.matchedText}, in UTF-8 **bytes**.
+ *
+ * Bytes rather than characters for the reason Issue #1694 gives for its own
+ * excerpt: a Japanese frame runs three bytes to the character, so a
+ * character-counted bound publishes three times the payload it promises. The
+ * excerpt rides every `current-output` response of a faulted session, and those
+ * responses are polled every few seconds.
+ */
+exports.UPSTREAM_FAULT_EXCERPT_MAX_BYTES = 200;
+/** Appended when {@link UPSTREAM_FAULT_EXCERPT_MAX_BYTES} cut the excerpt. */
+exports.UPSTREAM_FAULT_TRUNCATION_MARKER = '…[truncated]';
+/**
+ * Truncate to a UTF-8 byte budget on a code-point boundary.
+ *
+ * A local copy rather than `truncateToUtf8Bytes` from `lib/auto-yes-state`: that
+ * module reaches the database and the Auto-Yes state machine, and this one is a
+ * leaf the canary imports from outside Next. Accumulating code points (never
+ * UTF-16 units) is what keeps a surrogate pair whole.
+ */
+function truncateExcerpt(text) {
+    const encoder = new TextEncoder();
+    if (encoder.encode(text).length <= exports.UPSTREAM_FAULT_EXCERPT_MAX_BYTES)
+        return text;
+    // The marker is inside the budget, not on top of it: the bound is a promise
+    // about the published field, and a caller sizing a log line by it must not be
+    // handed twelve more characters than it asked for.
+    const budget = exports.UPSTREAM_FAULT_EXCERPT_MAX_BYTES - encoder.encode(exports.UPSTREAM_FAULT_TRUNCATION_MARKER).length;
+    let bytes = 0;
+    let out = '';
+    for (const char of text) {
+        const size = encoder.encode(char).length;
+        if (bytes + size > budget)
+            break;
+        bytes += size;
+        out += char;
+    }
+    return `${out}${exports.UPSTREAM_FAULT_TRUNCATION_MARKER}`;
+}
+/**
+ * The first upstream fault visible in the frame, with its line.
+ *
+ * ANSI is stripped first: the signature words are routinely split by colour
+ * sequences on a live pane.
+ */
+function matchUpstreamFault(frame) {
+    const clean = (0, ansi_1.stripAnsi)(frame);
+    for (const fault of exports.UPSTREAM_FAULTS) {
+        const match = fault.pattern.exec(clean);
+        // The patterns are unanchored and stateless (no /g), so `exec` cannot carry
+        // a lastIndex between calls — but reading `index` requires exec regardless.
+        if (!match)
+            continue;
+        const lineStart = clean.lastIndexOf('\n', match.index) + 1;
+        const lineEnd = clean.indexOf('\n', match.index);
+        const line = clean.slice(lineStart, lineEnd === -1 ? undefined : lineEnd).trim();
+        return { fault, matchedText: truncateExcerpt(line || match[0]) };
+    }
+    return null;
+}
+/**
+ * First upstream fault visible in the frame, if any.
+ *
+ * Kept alongside {@link matchUpstreamFault} because the canary only ever wanted
+ * the classification (`id` / `selfRetrying`), and a caller that does not need
+ * the excerpt should not have to reach through a wrapper for it.
+ */
+function findUpstreamFault(frame) {
+    return matchUpstreamFault(frame)?.fault ?? null;
+}

package/dist/server/src/lib/hooks/permission-decision-service.js

@@ -63,6 +63,10 @@ const NO_DECISION = (reason) => ({
     behavior: null,
     reason,
 });
+/** Production policy source: the active task's contract, TTL-cached. */
+function readContractPolicy(session) {
+    return (0, auto_yes_policy_1.getSessionAutoYesPolicy)(session.worktreeId, session.cliToolId, session.instanceId);
+}
 /**
  * The verdict for one permission request. Pure apart from reading Auto-Yes
  * state and the (TTL-cached) contract policy; the recording side effects live
@@ -80,8 +84,10 @@ const NO_DECISION = (reason) => ({
  *
  * @param session - Worktree / tool / instance the request came from
  * @param payload - Parsed payload, or null when it could not be parsed
+ * @param deps - Substitutions for the database-backed lookups; see
+ *   {@link PermissionDecisionDeps}. Omit in the server.
  */
-function decidePermissionRequest(session, payload) {
+function decidePermissionRequest(session, payload, deps = {}) {
     if (!payload) {
         return NO_DECISION('unknown-payload');
     }
@@ -98,7 +104,7 @@ function decidePermissionRequest(session, payload) {
     if (!state?.enabled) {
         return NO_DECISION('auto-yes-disabled');
     }
-    const policy = (0, auto_yes_policy_1.getSessionAutoYesPolicy)(worktreeId, cliToolId, instanceId);
+    const policy = (deps.readPolicy ?? readContractPolicy)({ worktreeId, cliToolId, instanceId });
     const denial = (0, auto_yes_resolver_1.evaluatePolicyAgainstTexts)(exports.PERMISSION_REQUEST_PROMPT_TYPE, (0, permission_request_payload_1.collectToolInputMatchTexts)(payload.toolName, payload.toolInput), policy);
     if (denial) {
         return {
@@ -214,10 +220,12 @@ function reportPendingDialog(session, payload) {
  *
  * @param session - Worktree / tool / instance the request came from
  * @param payload - Parsed payload, or null when it could not be parsed
+ * @param deps - Substitutions for the database-backed lookups; see
+ *   {@link PermissionDecisionDeps}. Omit in the server.
  * @returns The verdict the route serialises
  */
-function resolvePermissionRequest(session, payload) {
-    const decision = decidePermissionRequest(session, payload);
+function resolvePermissionRequest(session, payload, deps = {}) {
+    const decision = decidePermissionRequest(session, payload, deps);
     // Issue #1726: `AskUserQuestion` raises a `PermissionRequest` carrying the
     // same `tool_input` its `PreToolUse` does (§5.6), so the questions are
     // recorded from here too. Redundant on a session this server started — both
@@ -263,7 +271,7 @@ function resolvePermissionRequest(session, payload) {
         });
     }
     if (decision.behavior === 'allow' && payload) {
-        recordAllowedPermission(session, payload);
+        (deps.recordAllow ?? recordAllowedPermission)(session, payload);
     }
     return decision;
 }

package/dist/server/src/lib/hooks/sources/antigravity/hooks-config.js

@@ -87,6 +87,7 @@ const logger_1 = require("../../../../lib/logger");
 // The `~/.gemini` tree belongs to gemini; agy lives inside it. The merge that
 // keeps the two from erasing each other is written once, there.
 const shared_config_tree_1 = require("../gemini/shared-config-tree");
+const launch_command_1 = require("../launch-command");
 const tool_id_1 = require("./tool-id");
 const logger = (0, logger_1.createLogger)('lib/hooks/sources/antigravity/hooks-config');
 /**
@@ -347,26 +348,32 @@ function writeAntigravityHooksConfig(options = {}) {
  * terminal, so the variable is set here and nowhere else.
  *
  * The executable is quoted but not otherwise touched, so a caller may append its
- * own flags — `AntigravityTool.startSession` adds `--model` — after the value
- * this returns.
+ * own flags — `AntigravityTool.startSession` adds `--model` — after the rendered
+ * line. Since Issue #1846 the two variables come back as `env` rather than as a
+ * prefix on the command, which is also what keeps `--model` appendable: the
+ * caller appends to the *rendered* line and the assignments stay in front of it
+ * by construction rather than by the caller remembering to.
  *
- * Never throws, and returns the executable unchanged when injection is off.
+ * Never throws, and returns the executable with an empty environment when
+ * injection is off.
  *
  * @param executablePath - `agy`, or a resolved path to it
  * @param target - The instance being started
- * @returns The command line to type into the pane
+ * @returns The command to type into the pane and the environment it needs
  */
 function buildAntigravityLaunchCommand(executablePath, target, options = {}) {
     if (!(0, hook_settings_generator_1.isHookInjectionEnabled)())
-        return executablePath;
+        return { command: executablePath, env: {} };
     if (!(0, types_1.isValidInstanceId)((0, hook_settings_generator_1.resolveTargetInstanceId)(target))) {
         logger.warn('antigravity-hook-invalid-instance-id', { worktreeId: target.worktreeId });
-        return executablePath;
+        return { command: executablePath, env: {} };
     }
     const scoped = { ...target, cliToolId: tool_id_1.ANTIGRAVITY_CLI_TOOL_ID };
-    const url = (0, hook_settings_generator_1.buildAgentEventUrl)(scoped, options);
-    const permissionUrl = (0, hook_settings_generator_1.buildPermissionRequestUrl)(scoped, options);
-    return (`CM_HOOK_URL=${(0, hook_settings_generator_1.shellQuote)(url)} ` +
-        `${exports.ANTIGRAVITY_PERMISSION_URL_ENV_VAR}=${(0, hook_settings_generator_1.shellQuote)(permissionUrl)} ` +
-        `${(0, hook_settings_generator_1.shellQuote)(executablePath)}`);
+    return {
+        command: (0, hook_settings_generator_1.shellQuote)(executablePath),
+        env: {
+            [launch_command_1.AGENT_EVENT_URL_ENV_VAR]: (0, hook_settings_generator_1.buildAgentEventUrl)(scoped, options),
+            [exports.ANTIGRAVITY_PERMISSION_URL_ENV_VAR]: (0, hook_settings_generator_1.buildPermissionRequestUrl)(scoped, options),
+        },
+    };
 }

package/dist/server/src/lib/hooks/sources/antigravity/source.js

@@ -215,15 +215,16 @@ exports.antigravityAgentEventSource = (0, define_source_1.definePushHookSource)(
     encodeVerdict: encodeAntigravityVerdict,
     // Unlike gemini, the whole config is reachable from here: the file is global,
     // so no worktree path is needed and `prepareLaunch` really does write it.
-    prepareLaunch: (target, executablePath) => {
+    prepareLaunch: ({ target, executablePath }) => {
         const settingsPath = (0, hooks_config_1.writeAntigravityHooksConfig)();
-        return {
-            command: (0, hooks_config_1.buildAntigravityLaunchCommand)(executablePath, {
-                worktreeId: target.worktreeId,
-                instanceId: target.instanceId,
-                cliToolId: tool_id_1.ANTIGRAVITY_CLI_TOOL_ID,
-            }),
-            settingsPath,
-        };
+        // #1846: the two correlation URLs are the plan's `env`. `worktreePath` is
+        // in the context now and deliberately unused here — agy's config is one
+        // file for the machine, so there is nothing per-worktree to write.
+        const { command, env } = (0, hooks_config_1.buildAntigravityLaunchCommand)(executablePath, {
+            worktreeId: target.worktreeId,
+            instanceId: target.instanceId,
+            cliToolId: tool_id_1.ANTIGRAVITY_CLI_TOOL_ID,
+        });
+        return { command, settingsPath, env };
     },
 });

package/dist/server/src/lib/hooks/sources/claude/source.js

@@ -128,7 +128,7 @@ exports.claudeAgentEventSource = (0, define_source_1.definePushHookSource)({
     // S3 / S4 / S5. Delegated rather than reimplemented: `buildClaudeLaunchCommand`
     // writes the settings file, falls back to the bare path on any failure, and is
     // covered byte-for-byte by `tests/unit/hooks/hook-settings-generator.test.ts`.
-    prepareLaunch: (target, executablePath) => {
+    prepareLaunch: ({ target, executablePath }) => {
         const command = (0, hook_settings_generator_1.buildClaudeLaunchCommand)(executablePath, {
             worktreeId: target.worktreeId,
             instanceId: target.instanceId,
@@ -145,6 +145,9 @@ exports.claudeAgentEventSource = (0, define_source_1.definePushHookSource)({
                 cliToolId: target.cliToolId,
             })
             : null;
-        return { command, settingsPath };
+        // Empty, and the only source for which that is uninteresting: `--settings`
+        // carries the correlation keys inside the file, so Claude never needed the
+        // environment prefix the other four sources reached for (#1846).
+        return { command, settingsPath, env: {} };
     },
 });