commandmate 0.25.0 → 0.26.0

package/dist/server/src/lib/auto-yes-state.js

@@ -11,7 +11,7 @@
  * auto-yes-poller.ts -> auto-yes-state.ts -> path-validator.ts
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.THINKING_CHECK_LINE_COUNT = exports.MAX_CONCURRENT_POLLERS = exports.MAX_CONSECUTIVE_ERRORS = exports.MAX_BACKOFF_MS = exports.DUPLICATE_RETRY_EXPIRY_MS = exports.COOLDOWN_INTERVAL_MS = exports.POLLING_INTERVAL_MS = exports.executeRegexWithTimeout = exports.COMPOSITE_KEY_SEPARATOR = void 0;
+exports.THINKING_CHECK_LINE_COUNT = exports.MAX_CONCURRENT_POLLERS = exports.MAX_CONSECUTIVE_ERRORS = exports.MAX_BACKOFF_MS = exports.DUPLICATE_RETRY_EXPIRY_MS = exports.COOLDOWN_INTERVAL_MS = exports.POLLING_INTERVAL_MS = exports.STOP_MATCH_EXCERPT_CONTEXT_LINES = exports.STOP_MATCH_EXCERPT_TRUNCATION_MARKER = exports.STOP_MATCH_EXCERPT_MAX_BYTES = exports.executeRegexWithTimeout = exports.COMPOSITE_KEY_SEPARATOR = void 0;
 exports.buildCompositeKey = buildCompositeKey;
 exports.extractWorktreeId = extractWorktreeId;
 exports.extractCliToolId = extractCliToolId;
@@ -21,6 +21,7 @@ exports.getAutoYesState = getAutoYesState;
 exports.setAutoYesEnabled = setAutoYesEnabled;
 exports.disableAutoYes = disableAutoYes;
 exports.clearAllAutoYesStates = clearAllAutoYesStates;
+exports.truncateToUtf8Bytes = truncateToUtf8Bytes;
 exports.checkStopCondition = checkStopCondition;
 exports.deleteAutoYesState = deleteAutoYesState;
 exports.getAutoYesStateCompositeKeys = getAutoYesStateCompositeKeys;
@@ -204,9 +205,12 @@ function setAutoYesEnabled(worktreeId, cliToolId, enabled, duration, stopPattern
  * @param cliToolId - CLI tool type (default: 'claude')
  * @param reason - Optional reason for disabling ('expired' | 'stop_pattern_matched')
  * @param instanceId - Optional instance identifier (Issue #896; defaults to primary)
+ * @param stopMatchedText - Optional excerpt of what the stop pattern matched
+ *   (Issue #1694). Deliberately *not* carried over from the existing state: it
+ *   belongs to `reason`, so a disable for any other reason stores none.
  * @returns Updated auto-yes state
  */
-function disableAutoYes(worktreeId, cliToolId = 'claude', reason, instanceId) {
+function disableAutoYes(worktreeId, cliToolId = 'claude', reason, instanceId, stopMatchedText) {
     const key = buildCompositeKey(worktreeId, cliToolId, instanceId);
     const existing = autoYesStates.get(key);
     const state = {
@@ -215,6 +219,7 @@ function disableAutoYes(worktreeId, cliToolId = 'claude', reason, instanceId) {
         expiresAt: existing?.expiresAt ?? 0,
         stopPattern: existing?.stopPattern,
         stopReason: reason,
+        stopMatchedText,
     };
     autoYesStates.set(key, state);
     return state;
@@ -235,6 +240,103 @@ function clearAllAutoYesStates() {
  */
 var auto_yes_config_2 = require("../config/auto-yes-config");
 Object.defineProperty(exports, "executeRegexWithTimeout", { enumerable: true, get: function () { return auto_yes_config_2.executeRegexWithTimeout; } });
+/**
+ * Maximum size of the stop-pattern excerpt, in UTF-8 bytes, marker included
+ * (Issue #1694).
+ *
+ * The excerpt answers one question — "is this a real stop or did a build log
+ * happen to contain the pattern?" (#1678 A-5) — and a couple of lines answer
+ * it. The cap is a hard bound rather than a hint because `cleanOutput` is a
+ * whole terminal frame and a greedy pattern can match all of it, and because
+ * the value rides in every `capture --json` poll for the rest of the session.
+ */
+exports.STOP_MATCH_EXCERPT_MAX_BYTES = 400;
+/**
+ * Appended when the excerpt was cut to fit {@link STOP_MATCH_EXCERPT_MAX_BYTES}.
+ *
+ * Cutting silently would make a fragment read as the whole match, which is the
+ * wrong conclusion in exactly the triage this field exists for.
+ */
+exports.STOP_MATCH_EXCERPT_TRUNCATION_MARKER = '…[truncated]';
+/** Lines of context kept on either side of the match (Issue #1694). */
+exports.STOP_MATCH_EXCERPT_CONTEXT_LINES = 1;
+/** Shared encoder for byte-length math (UTF-8 by spec). */
+const utf8Encoder = new TextEncoder();
+/** UTF-8 byte length of a string. */
+function utf8ByteLength(text) {
+    return utf8Encoder.encode(text).length;
+}
+/**
+ * Cut `text` down to `maxBytes` UTF-8 bytes, marker included, never splitting a
+ * character (Issue #1694).
+ *
+ * The budget is measured in bytes rather than characters because the excerpt is
+ * copied verbatim into a JSON payload, and a Japanese terminal frame costs 3
+ * bytes per character — a character cap would let one frame publish three times
+ * the intended payload.
+ *
+ * @internal Exported for testing purposes only.
+ * @param text - Text to bound
+ * @param maxBytes - Byte ceiling for the returned string (marker included)
+ * @returns `text` unchanged when it already fits, otherwise a prefix of it with
+ *   {@link STOP_MATCH_EXCERPT_TRUNCATION_MARKER} appended
+ */
+function truncateToUtf8Bytes(text, maxBytes = exports.STOP_MATCH_EXCERPT_MAX_BYTES) {
+    if (utf8ByteLength(text) <= maxBytes)
+        return text;
+    const budget = maxBytes - utf8ByteLength(exports.STOP_MATCH_EXCERPT_TRUNCATION_MARKER);
+    if (budget <= 0)
+        return exports.STOP_MATCH_EXCERPT_TRUNCATION_MARKER;
+    let used = 0;
+    let kept = '';
+    // for..of iterates code points, so a surrogate pair is never halved.
+    for (const char of text) {
+        const size = utf8ByteLength(char);
+        if (used + size > budget)
+            break;
+        kept += char;
+        used += size;
+    }
+    return kept + exports.STOP_MATCH_EXCERPT_TRUNCATION_MARKER;
+}
+/**
+ * Build the excerpt shown for a stop-pattern hit (Issue #1694).
+ *
+ * Whole lines, not the raw match: a pattern like `error` matched against a
+ * terminal frame yields the six characters `error`, which tells the operator
+ * nothing about whether it came from the agent asking a question or from a
+ * dependency's build log scrolling past. The surrounding line is the smallest
+ * unit that carries that.
+ *
+ * @param regex - The already-constructed stop pattern (no `g` flag, so `exec`
+ *   is position-independent and does not disturb the caller's `test`)
+ * @param output - ANSI-stripped terminal output the pattern matched
+ * @returns Bounded excerpt, or null when the match cannot be located
+ */
+function buildStopMatchExcerpt(regex, output) {
+    let match;
+    try {
+        match = regex.exec(output);
+    }
+    catch {
+        return null;
+    }
+    if (!match)
+        return null;
+    const matchStart = match.index;
+    const matchEnd = matchStart + match[0].length;
+    const lines = output.split('\n');
+    const firstLine = output.slice(0, matchStart).split('\n').length - 1;
+    const lastLine = output.slice(0, matchEnd).split('\n').length - 1;
+    const from = Math.max(0, firstLine - exports.STOP_MATCH_EXCERPT_CONTEXT_LINES);
+    const to = Math.min(lines.length - 1, lastLine + exports.STOP_MATCH_EXCERPT_CONTEXT_LINES);
+    const raw = lines.slice(from, to + 1).join('\n');
+    // Terminal frames are padded with blank lines and trailing spaces; those are
+    // pure noise here and eat the byte budget. A whitespace-only match keeps its
+    // raw form rather than becoming an empty, unexplained field.
+    const trimmed = raw.trim();
+    return truncateToUtf8Bytes(trimmed.length > 0 ? trimmed : raw);
+}
 /**
  * Check if the terminal output matches the stop condition pattern.
  * If matched, disables auto-yes for the worktree/agent.
@@ -275,7 +377,10 @@ function checkStopCondition(compositeKey, cleanOutput, onStopMatched) {
             return false;
         }
         if (matched) {
-            disableAutoYes(worktreeId, cliToolId, 'stop_pattern_matched', instanceId);
+            // Issue #1694: what matched, not just that something did. Built here
+            // because this is the only frame that still holds the output.
+            const stopMatchedText = buildStopMatchExcerpt(regex, cleanOutput) ?? undefined;
+            disableAutoYes(worktreeId, cliToolId, 'stop_pattern_matched', instanceId, stopMatchedText);
             if (onStopMatched) {
                 onStopMatched(compositeKey);
             }

package/dist/server/src/lib/cli-tools/antigravity.js

@@ -136,15 +136,19 @@ class AntigravityTool extends base_1.BaseCLITool {
             await new Promise((resolve) => setTimeout(resolve, cli_tool_timing_config_1.TUI_SESSION_CREATE_WAIT_MS));
             // Start agy in interactive mode, optionally pinned to a model.
             //
-            // Issue #1762: `prepareAgentLaunch` merges CommandMate's named hook into
+            // Issue #1762: the launch merges CommandMate's named hook into
             // `~/.gemini/config/hooks.json` — agy's single global config, shared with
             // gemini's tree and with whatever the user has in it — and prefixes
             // `CM_HOOK_URL`. That variable is the *only* correlation channel agy has:
             // its payloads carry no `cwd`, its hooks run in `~/.gemini/config`, and
             // one file serves every worktree on the machine. `--model` is appended
-            // after, so the env prefix stays in front of the command.
-            // `CM_AGENT_HOOKS_INJECT=0` returns bare `agy`, unchanged from before.
-            const base = (0, agent_session_lifecycle_1.prepareAgentLaunch)({ worktreeId, cliToolId: sources_1.ANTIGRAVITY_CLI_TOOL_ID, instanceId }, this.command).command;
+            // after the rendered line, so the env assignments stay in front of the
+            // command. `CM_AGENT_HOOKS_INJECT=0` returns bare `agy`, unchanged.
+            const base = (0, agent_session_lifecycle_1.buildAgentLaunchCommandLine)({
+                target: { worktreeId, cliToolId: sources_1.ANTIGRAVITY_CLI_TOOL_ID, instanceId },
+                executablePath: this.command,
+                worktreePath,
+            });
             const launchCommand = model ? `${base} --model ${shellSingleQuote(model)}` : base;
             await (0, tmux_1.sendKeys)(sessionName, launchCommand, true);
             // Wait for agy to initialize

package/dist/server/src/lib/cli-tools/codex.js

@@ -166,7 +166,11 @@ class CodexTool extends base_1.BaseCLITool {
             // Falls back to the bare command on any failure and when
             // `CM_AGENT_HOOKS_INJECT=0`; a session that starts without hooks is the
             // pre-#1760 status quo, and a session that fails to start is not.
-            const launchCommand = (0, agent_session_lifecycle_1.prepareAgentLaunch)({ worktreeId, cliToolId: sources_1.CODEX_CLI_TOOL_ID, instanceId }, this.command).command;
+            const launchCommand = (0, agent_session_lifecycle_1.buildAgentLaunchCommandLine)({
+                target: { worktreeId, cliToolId: sources_1.CODEX_CLI_TOOL_ID, instanceId },
+                executablePath: this.command,
+                worktreePath,
+            });
             // Start Codex CLI in interactive mode
             await (0, tmux_1.sendKeys)(sessionName, launchCommand, true);
             // Wait for Codex to initialize

package/dist/server/src/lib/cli-tools/copilot.js

@@ -149,7 +149,11 @@ class CopilotTool extends base_1.BaseCLITool {
             // Fails open in every branch: with `CM_AGENT_HOOKS_INJECT=0`, or with a
             // settings file that cannot be read or written, this is byte-for-byte the
             // `gh copilot` this line has always sent.
-            const launchCommand = (0, agent_session_lifecycle_1.prepareAgentLaunch)({ worktreeId, cliToolId: tool_id_1.COPILOT_CLI_TOOL_ID, instanceId }, hook_settings_1.COPILOT_LAUNCH_COMMAND).command;
+            const launchCommand = (0, agent_session_lifecycle_1.buildAgentLaunchCommandLine)({
+                target: { worktreeId, cliToolId: tool_id_1.COPILOT_CLI_TOOL_ID, instanceId },
+                executablePath: hook_settings_1.COPILOT_LAUNCH_COMMAND,
+                worktreePath,
+            });
             // Start Copilot CLI in interactive mode
             await (0, tmux_1.sendKeys)(sessionName, launchCommand, true);
             // Wait for Copilot to initialize

package/dist/server/src/lib/cli-tools/gemini.js

@@ -16,7 +16,6 @@ const submit_verified_sender_1 = require("./submit-verified-sender");
 const tmux_capture_cache_1 = require("../tmux/tmux-capture-cache");
 const cli_patterns_1 = require("../detection/cli-patterns");
 const sources_1 = require("../../lib/hooks/sources");
-const source_1 = require("../../lib/hooks/sources/gemini/source");
 const agent_session_lifecycle_1 = require("../../lib/session/agent-session-lifecycle");
 const logger_1 = require("../../lib/logger");
 const cli_tool_timing_config_1 = require("../../config/cli-tool-timing-config");
@@ -92,23 +91,24 @@ class GeminiTool extends base_1.BaseCLITool {
             });
             // Wait a moment for the session to be created
             await new Promise((resolve) => setTimeout(resolve, cli_tool_timing_config_1.TUI_SESSION_CREATE_WAIT_MS));
-            // Issue #1762: hand this worktree its own hooks config, merged into any
-            // `.gemini/settings.json` that is already there. Written from here rather
-            // than from the source's `prepareLaunch` because the worktree path is the
-            // one input `AgentInstanceRef` does not carry, and gemini is the only tool
-            // whose config is scoped to a worktree. Fail-open: a config that cannot be
-            // written costs the events and nothing else.
-            (0, source_1.injectGeminiHookSettings)(worktreePath, {
-                worktreeId,
-                cliToolId: sources_1.GEMINI_CLI_TOOL_ID,
-                instanceId,
-            });
             // Start Gemini CLI in interactive mode (no flags = interactive REPL).
-            // `prepareAgentLaunch` prefixes `CM_HOOK_URL`, which is what tells the
+            //
+            // Issue #1762 hands this worktree its own hooks config, merged into any
+            // `.gemini/settings.json` that is already there; Issue #1846 moved that
+            // write inside `prepareLaunch`, where it belongs — the worktree path is
+            // now part of the launch context, so the second entry point this file
+            // used to call (`injectGeminiHookSettings`) is gone.
+            //
+            // The rendered line prefixes `CM_HOOK_URL`, which is what tells the
             // receiver which instance an event came from — `.gemini/settings.json` is
             // per worktree and cannot. `CM_AGENT_HOOKS_INJECT=0` returns the bare
-            // command, unchanged from before this Issue.
-            const launchCommand = (0, agent_session_lifecycle_1.prepareAgentLaunch)({ worktreeId, cliToolId: sources_1.GEMINI_CLI_TOOL_ID, instanceId }, this.command).command;
+            // command, unchanged from before these Issues. Fail-open throughout: a
+            // config that cannot be written costs the events and nothing else.
+            const launchCommand = (0, agent_session_lifecycle_1.buildAgentLaunchCommandLine)({
+                target: { worktreeId, cliToolId: sources_1.GEMINI_CLI_TOOL_ID, instanceId },
+                executablePath: this.command,
+                worktreePath,
+            });
             await (0, tmux_1.sendKeys)(sessionName, launchCommand, true);
             // Wait for Gemini to initialize (minimum wait for banner/auth)
             await new Promise((resolve) => setTimeout(resolve, GEMINI_INIT_WAIT_MS));

package/dist/server/src/lib/cli-tools/opencode.js

@@ -148,9 +148,15 @@ class OpenCodeTool extends base_1.BaseCLITool {
             // that nothing can read back (§5.9). Null means "no structured events",
             // and the launch below is then the pre-#1763 bare command.
             await (0, runtime_1.reserveOpencodeServerPort)(target, worktreePath);
-            // Start OpenCode TUI. `prepareAgentLaunch` asks the tool's own
-            // `AgentEventSource` for the command line (S3/S4/S5) and never throws.
-            const launchCommand = (0, agent_session_lifecycle_1.prepareAgentLaunch)(target, this.command).command;
+            // Start OpenCode TUI. `buildAgentLaunchCommandLine` asks the tool's own
+            // `AgentEventSource` for the plan (S3/S4/S5) and never throws. opencode's
+            // environment is empty — it is the one source with no correlation
+            // variable, because CommandMate holds the connection (#1846).
+            const launchCommand = (0, agent_session_lifecycle_1.buildAgentLaunchCommandLine)({
+                target,
+                executablePath: this.command,
+                worktreePath,
+            });
             await (0, tmux_1.sendKeys)(sessionName, launchCommand, true);
             // Wait for OpenCode to initialize (GPU model loading via Ollama)
             await new Promise((resolve) => setTimeout(resolve, exports.OPENCODE_INIT_WAIT_MS));

package/dist/server/src/lib/detection/upstream-faults.js

@@ -0,0 +1,120 @@
+"use strict";
+/**
+ * Signatures of an upstream (model API) fault, as they appear on an agent's
+ * terminal frame (Issue #1839).
+ *
+ * Moved here from `scripts/canary/expectations.ts`, where Issue #1727 first
+ * wrote them, because the canary is no longer the only reader: `capture --json`
+ * publishes the match as `upstreamFault` and `wait --fail-on-upstream-fault`
+ * branches on it. Two copies of a pattern list whose whole job is *not* to be
+ * over-eager would drift, and the drift would be silent on both sides.
+ *
+ * A leaf module by design — it imports nothing but {@link stripAnsi}, so the
+ * canary (which runs outside Next) and the server payload builder can share it
+ * without either pulling in the other's dependencies.
+ *
+ * ## What a match means, and what it does not
+ *
+ * A match means the signature was on the frame. A **non**-match means nothing at
+ * all about upstream health: the pane may have scrolled, the agent may render a
+ * failure with wording nobody has seen yet, and Issue #1834 measured a case
+ * where the pane went blank instead of carrying a banner. Nothing in this
+ * module — and nothing reading it — may report "no fault" as "upstream is
+ * healthy".
+ *
+ * @module lib/detection/upstream-faults
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UPSTREAM_FAULT_TRUNCATION_MARKER = exports.UPSTREAM_FAULT_EXCERPT_MAX_BYTES = exports.UPSTREAM_FAULTS = void 0;
+exports.matchUpstreamFault = matchUpstreamFault;
+exports.findUpstreamFault = findUpstreamFault;
+const ansi_1 = require("./ansi");
+/**
+ * Patterns are anchored on ERROR wording, not on the words "usage limit".
+ * Claude's own banner advertises "up to 50% of your weekly usage limit on
+ * Fable 5" on a perfectly healthy frame — a looser pattern marked every
+ * scenario of a run as `blocked` (measured 2026-08-06), which would have hidden
+ * real regressions behind a fake infrastructure excuse.
+ *
+ * Order is precedence: the first match wins, so the specific overload wording
+ * is listed ahead of the generic `API Error` catch-all. The line Claude 2.1.236
+ * prints on a 529 storm contains both (`API Error: Repeated 529 Overloaded
+ * errors …`, measured for Issue #1839), and `overloaded` is the more useful of
+ * the two answers because it carries `selfRetrying: true`.
+ */
+exports.UPSTREAM_FAULTS = [
+    { id: 'overloaded', pattern: /\b5\d{2}\s+Overloaded\b/i, selfRetrying: true },
+    { id: 'retrying', pattern: /Retrying in \d+s\s*[·•]\s*attempt \d+\/\d+/i, selfRetrying: true },
+    { id: 'limit-reached', pattern: /\blimit reached\b/i, selfRetrying: false },
+    { id: 'api-error', pattern: /\bAPI Error(?::|\s+\d{3})/i, selfRetrying: false },
+];
+/**
+ * Bound on {@link UpstreamFaultMatch.matchedText}, in UTF-8 **bytes**.
+ *
+ * Bytes rather than characters for the reason Issue #1694 gives for its own
+ * excerpt: a Japanese frame runs three bytes to the character, so a
+ * character-counted bound publishes three times the payload it promises. The
+ * excerpt rides every `current-output` response of a faulted session, and those
+ * responses are polled every few seconds.
+ */
+exports.UPSTREAM_FAULT_EXCERPT_MAX_BYTES = 200;
+/** Appended when {@link UPSTREAM_FAULT_EXCERPT_MAX_BYTES} cut the excerpt. */
+exports.UPSTREAM_FAULT_TRUNCATION_MARKER = '…[truncated]';
+/**
+ * Truncate to a UTF-8 byte budget on a code-point boundary.
+ *
+ * A local copy rather than `truncateToUtf8Bytes` from `lib/auto-yes-state`: that
+ * module reaches the database and the Auto-Yes state machine, and this one is a
+ * leaf the canary imports from outside Next. Accumulating code points (never
+ * UTF-16 units) is what keeps a surrogate pair whole.
+ */
+function truncateExcerpt(text) {
+    const encoder = new TextEncoder();
+    if (encoder.encode(text).length <= exports.UPSTREAM_FAULT_EXCERPT_MAX_BYTES)
+        return text;
+    // The marker is inside the budget, not on top of it: the bound is a promise
+    // about the published field, and a caller sizing a log line by it must not be
+    // handed twelve more characters than it asked for.
+    const budget = exports.UPSTREAM_FAULT_EXCERPT_MAX_BYTES - encoder.encode(exports.UPSTREAM_FAULT_TRUNCATION_MARKER).length;
+    let bytes = 0;
+    let out = '';
+    for (const char of text) {
+        const size = encoder.encode(char).length;
+        if (bytes + size > budget)
+            break;
+        bytes += size;
+        out += char;
+    }
+    return `${out}${exports.UPSTREAM_FAULT_TRUNCATION_MARKER}`;
+}
+/**
+ * The first upstream fault visible in the frame, with its line.
+ *
+ * ANSI is stripped first: the signature words are routinely split by colour
+ * sequences on a live pane.
+ */
+function matchUpstreamFault(frame) {
+    const clean = (0, ansi_1.stripAnsi)(frame);
+    for (const fault of exports.UPSTREAM_FAULTS) {
+        const match = fault.pattern.exec(clean);
+        // The patterns are unanchored and stateless (no /g), so `exec` cannot carry
+        // a lastIndex between calls — but reading `index` requires exec regardless.
+        if (!match)
+            continue;
+        const lineStart = clean.lastIndexOf('\n', match.index) + 1;
+        const lineEnd = clean.indexOf('\n', match.index);
+        const line = clean.slice(lineStart, lineEnd === -1 ? undefined : lineEnd).trim();
+        return { fault, matchedText: truncateExcerpt(line || match[0]) };
+    }
+    return null;
+}
+/**
+ * First upstream fault visible in the frame, if any.
+ *
+ * Kept alongside {@link matchUpstreamFault} because the canary only ever wanted
+ * the classification (`id` / `selfRetrying`), and a caller that does not need
+ * the excerpt should not have to reach through a wrapper for it.
+ */
+function findUpstreamFault(frame) {
+    return matchUpstreamFault(frame)?.fault ?? null;
+}

package/dist/server/src/lib/hooks/permission-decision-service.js

@@ -63,6 +63,10 @@ const NO_DECISION = (reason) => ({
     behavior: null,
     reason,
 });
+/** Production policy source: the active task's contract, TTL-cached. */
+function readContractPolicy(session) {
+    return (0, auto_yes_policy_1.getSessionAutoYesPolicy)(session.worktreeId, session.cliToolId, session.instanceId);
+}
 /**
  * The verdict for one permission request. Pure apart from reading Auto-Yes
  * state and the (TTL-cached) contract policy; the recording side effects live
@@ -80,8 +84,10 @@ const NO_DECISION = (reason) => ({
  *
  * @param session - Worktree / tool / instance the request came from
  * @param payload - Parsed payload, or null when it could not be parsed
+ * @param deps - Substitutions for the database-backed lookups; see
+ *   {@link PermissionDecisionDeps}. Omit in the server.
  */
-function decidePermissionRequest(session, payload) {
+function decidePermissionRequest(session, payload, deps = {}) {
     if (!payload) {
         return NO_DECISION('unknown-payload');
     }
@@ -98,7 +104,7 @@ function decidePermissionRequest(session, payload) {
     if (!state?.enabled) {
         return NO_DECISION('auto-yes-disabled');
     }
-    const policy = (0, auto_yes_policy_1.getSessionAutoYesPolicy)(worktreeId, cliToolId, instanceId);
+    const policy = (deps.readPolicy ?? readContractPolicy)({ worktreeId, cliToolId, instanceId });
     const denial = (0, auto_yes_resolver_1.evaluatePolicyAgainstTexts)(exports.PERMISSION_REQUEST_PROMPT_TYPE, (0, permission_request_payload_1.collectToolInputMatchTexts)(payload.toolName, payload.toolInput), policy);
     if (denial) {
         return {
@@ -214,10 +220,12 @@ function reportPendingDialog(session, payload) {
  *
  * @param session - Worktree / tool / instance the request came from
  * @param payload - Parsed payload, or null when it could not be parsed
+ * @param deps - Substitutions for the database-backed lookups; see
+ *   {@link PermissionDecisionDeps}. Omit in the server.
  * @returns The verdict the route serialises
  */
-function resolvePermissionRequest(session, payload) {
-    const decision = decidePermissionRequest(session, payload);
+function resolvePermissionRequest(session, payload, deps = {}) {
+    const decision = decidePermissionRequest(session, payload, deps);
     // Issue #1726: `AskUserQuestion` raises a `PermissionRequest` carrying the
     // same `tool_input` its `PreToolUse` does (§5.6), so the questions are
     // recorded from here too. Redundant on a session this server started — both
@@ -263,7 +271,7 @@ function resolvePermissionRequest(session, payload) {
         });
     }
     if (decision.behavior === 'allow' && payload) {
-        recordAllowedPermission(session, payload);
+        (deps.recordAllow ?? recordAllowedPermission)(session, payload);
     }
     return decision;
 }

package/dist/server/src/lib/hooks/sources/antigravity/hooks-config.js

@@ -87,6 +87,7 @@ const logger_1 = require("../../../../lib/logger");
 // The `~/.gemini` tree belongs to gemini; agy lives inside it. The merge that
 // keeps the two from erasing each other is written once, there.
 const shared_config_tree_1 = require("../gemini/shared-config-tree");
+const launch_command_1 = require("../launch-command");
 const tool_id_1 = require("./tool-id");
 const logger = (0, logger_1.createLogger)('lib/hooks/sources/antigravity/hooks-config');
 /**
@@ -347,26 +348,32 @@ function writeAntigravityHooksConfig(options = {}) {
  * terminal, so the variable is set here and nowhere else.
  *
  * The executable is quoted but not otherwise touched, so a caller may append its
- * own flags — `AntigravityTool.startSession` adds `--model` — after the value
- * this returns.
+ * own flags — `AntigravityTool.startSession` adds `--model` — after the rendered
+ * line. Since Issue #1846 the two variables come back as `env` rather than as a
+ * prefix on the command, which is also what keeps `--model` appendable: the
+ * caller appends to the *rendered* line and the assignments stay in front of it
+ * by construction rather than by the caller remembering to.
  *
- * Never throws, and returns the executable unchanged when injection is off.
+ * Never throws, and returns the executable with an empty environment when
+ * injection is off.
  *
  * @param executablePath - `agy`, or a resolved path to it
  * @param target - The instance being started
- * @returns The command line to type into the pane
+ * @returns The command to type into the pane and the environment it needs
  */
 function buildAntigravityLaunchCommand(executablePath, target, options = {}) {
     if (!(0, hook_settings_generator_1.isHookInjectionEnabled)())
-        return executablePath;
+        return { command: executablePath, env: {} };
     if (!(0, types_1.isValidInstanceId)((0, hook_settings_generator_1.resolveTargetInstanceId)(target))) {
         logger.warn('antigravity-hook-invalid-instance-id', { worktreeId: target.worktreeId });
-        return executablePath;
+        return { command: executablePath, env: {} };
     }
     const scoped = { ...target, cliToolId: tool_id_1.ANTIGRAVITY_CLI_TOOL_ID };
-    const url = (0, hook_settings_generator_1.buildAgentEventUrl)(scoped, options);
-    const permissionUrl = (0, hook_settings_generator_1.buildPermissionRequestUrl)(scoped, options);
-    return (`CM_HOOK_URL=${(0, hook_settings_generator_1.shellQuote)(url)} ` +
-        `${exports.ANTIGRAVITY_PERMISSION_URL_ENV_VAR}=${(0, hook_settings_generator_1.shellQuote)(permissionUrl)} ` +
-        `${(0, hook_settings_generator_1.shellQuote)(executablePath)}`);
+    return {
+        command: (0, hook_settings_generator_1.shellQuote)(executablePath),
+        env: {
+            [launch_command_1.AGENT_EVENT_URL_ENV_VAR]: (0, hook_settings_generator_1.buildAgentEventUrl)(scoped, options),
+            [exports.ANTIGRAVITY_PERMISSION_URL_ENV_VAR]: (0, hook_settings_generator_1.buildPermissionRequestUrl)(scoped, options),
+        },
+    };
 }

package/dist/server/src/lib/hooks/sources/antigravity/source.js

@@ -215,15 +215,16 @@ exports.antigravityAgentEventSource = (0, define_source_1.definePushHookSource)(
     encodeVerdict: encodeAntigravityVerdict,
     // Unlike gemini, the whole config is reachable from here: the file is global,
     // so no worktree path is needed and `prepareLaunch` really does write it.
-    prepareLaunch: (target, executablePath) => {
+    prepareLaunch: ({ target, executablePath }) => {
         const settingsPath = (0, hooks_config_1.writeAntigravityHooksConfig)();
-        return {
-            command: (0, hooks_config_1.buildAntigravityLaunchCommand)(executablePath, {
-                worktreeId: target.worktreeId,
-                instanceId: target.instanceId,
-                cliToolId: tool_id_1.ANTIGRAVITY_CLI_TOOL_ID,
-            }),
-            settingsPath,
-        };
+        // #1846: the two correlation URLs are the plan's `env`. `worktreePath` is
+        // in the context now and deliberately unused here — agy's config is one
+        // file for the machine, so there is nothing per-worktree to write.
+        const { command, env } = (0, hooks_config_1.buildAntigravityLaunchCommand)(executablePath, {
+            worktreeId: target.worktreeId,
+            instanceId: target.instanceId,
+            cliToolId: tool_id_1.ANTIGRAVITY_CLI_TOOL_ID,
+        });
+        return { command, settingsPath, env };
     },
 });

package/dist/server/src/lib/hooks/sources/claude/source.js

@@ -128,7 +128,7 @@ exports.claudeAgentEventSource = (0, define_source_1.definePushHookSource)({
     // S3 / S4 / S5. Delegated rather than reimplemented: `buildClaudeLaunchCommand`
     // writes the settings file, falls back to the bare path on any failure, and is
     // covered byte-for-byte by `tests/unit/hooks/hook-settings-generator.test.ts`.
-    prepareLaunch: (target, executablePath) => {
+    prepareLaunch: ({ target, executablePath }) => {
         const command = (0, hook_settings_generator_1.buildClaudeLaunchCommand)(executablePath, {
             worktreeId: target.worktreeId,
             instanceId: target.instanceId,
@@ -145,6 +145,9 @@ exports.claudeAgentEventSource = (0, define_source_1.definePushHookSource)({
                 cliToolId: target.cliToolId,
             })
             : null;
-        return { command, settingsPath };
+        // Empty, and the only source for which that is uninteresting: `--settings`
+        // carries the correlation keys inside the file, so Claude never needed the
+        // environment prefix the other four sources reached for (#1846).
+        return { command, settingsPath, env: {} };
     },
 });