commandmate 0.26.0 → 0.27.0

package/dist/server/src/lib/hooks/sources/copilot/hook-settings.js

@@ -68,17 +68,51 @@
  * left alone entirely and the session starts without hooks — losing events is
  * recoverable, overwriting a user's settings is not.
  *
+ * Since Issue #1904 the write is a temp file plus `rename` under a lock file in
+ * the same directory, because `commandmate start --issue N --auto-port` makes
+ * several servers writing this one file a supported workflow and
+ * `writeFileSync` truncates before it writes. A lock this process cannot take
+ * means starting without hooks, same as every other failure here.
+ *
+ * ## What one machine-global file is *not* allowed to fix (Issue #1904)
+ *
+ * Measurement 5 solves correlation. Issue #1904 found the same argument applies
+ * to two more values that were being fixed at write time, and one that was not
+ * a value at all:
+ *
+ *  - **The port.** A development server on 3011 rewrote the file and every
+ *    copilot session on the machine — including the one on 3000 — started
+ *    posting to 3011. It now travels in {@link COPILOT_HOOK_PORT_ENV}, behind a
+ *    numeric guard, with no default to fall back to.
+ *  - **The relay script's path** stays an absolute literal, because it names
+ *    the program the hook executes and that is not a decision to delegate to
+ *    the environment (設計方針書 §10.8 決定 2). What changed is *when* it is
+ *    checked: `[ -x … ]` at fire time, falling back to the inline `curl` that
+ *    was already written for a package layout without the script. A removed
+ *    checkout no longer takes every session's events with it.
+ *  - **`config.json`.** Copilot 1.0.80 migrates a `hooks` key out of it and
+ *    **over** `settings.json` at startup, so an operator following
+ *    `copilot help config` silently loses everything written here.
+ *    {@link inspectCopilotConfigHooks} finds that key first and the launch goes
+ *    ahead without hooks rather than writing a file that is about to be erased.
+ *
+ * Scheme and host stay module constants. {@link curlArgumentPreamble} attaches
+ * the bearer header without looking at where it is going, so a constant
+ * destination is what keeps the token on loopback (設計方針書 §10.7).
+ *
  * @module lib/hooks/sources/copilot/hook-settings
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.COPILOT_EVENT_HOOKS = exports.COPILOT_PERMISSION_HOOK_EVENT = exports.COPILOT_AUTH_TOKEN_ENV = exports.COPILOT_INSTANCE_ID_ENV = exports.COPILOT_WORKTREE_ID_ENV = exports.COPILOT_HOOK_CURL_TIMEOUT_SECONDS = exports.COPILOT_HOOK_TIMEOUT_SECONDS = exports.COPILOT_HOOK_MARKER = exports.COPILOT_LAUNCH_COMMAND = void 0;
+exports.COPILOT_SETTINGS_BACKUP_SUFFIX = exports.COPILOT_SETTINGS_LOCK_STALE_MS = exports.COPILOT_SETTINGS_LOCK_BASENAME = exports.CopilotConfigHooksShadowError = exports.COPILOT_EVENT_HOOKS = exports.COPILOT_PERMISSION_HOOK_EVENT = exports.COPILOT_HOOK_PORT_ENV = exports.COPILOT_AUTH_TOKEN_ENV = exports.COPILOT_INSTANCE_ID_ENV = exports.COPILOT_WORKTREE_ID_ENV = exports.COPILOT_HOOK_CURL_TIMEOUT_SECONDS = exports.COPILOT_HOOK_TIMEOUT_SECONDS = exports.COPILOT_HOOK_MARKER = exports.COPILOT_LAUNCH_COMMAND = void 0;
 exports.getCopilotHomeDirectory = getCopilotHomeDirectory;
 exports.getCopilotSettingsPath = getCopilotSettingsPath;
+exports.getCopilotConfigPath = getCopilotConfigPath;
 exports.buildCopilotEventCommand = buildCopilotEventCommand;
 exports.buildCopilotPermissionCommand = buildCopilotPermissionCommand;
 exports.buildCopilotHookSettings = buildCopilotHookSettings;
 exports.mergeCopilotHookSettings = mergeCopilotHookSettings;
 exports.readCopilotSettings = readCopilotSettings;
+exports.inspectCopilotConfigHooks = inspectCopilotConfigHooks;
 exports.writeCopilotHookSettings = writeCopilotHookSettings;
 exports.buildCopilotHookEnvironment = buildCopilotHookEnvironment;
 exports.isCopilotHookInjectionEnabled = isCopilotHookInjectionEnabled;
@@ -92,6 +126,7 @@ const env_1 = require("../../../../lib/env");
 const hook_settings_generator_1 = require("../../../../lib/hooks/hook-settings-generator");
 const path_validator_1 = require("../../../../lib/security/path-validator");
 const logger_1 = require("../../../../lib/logger");
+const launch_command_1 = require("../launch-command");
 const tool_id_1 = require("./tool-id");
 const logger = (0, logger_1.createLogger)('lib/hooks/sources/copilot/hook-settings');
 /** Loopback: the agent runs on the machine the server runs on. */
@@ -143,6 +178,21 @@ exports.COPILOT_WORKTREE_ID_ENV = 'CM_AGENT_WORKTREE_ID';
 exports.COPILOT_INSTANCE_ID_ENV = 'CM_AGENT_INSTANCE_ID';
 /** Bearer token variable, read at fire time exactly as the relay script reads it. */
 exports.COPILOT_AUTH_TOKEN_ENV = 'CM_AUTH_TOKEN';
+/**
+ * Carries the receiving server's port, the same way (Issue #1904).
+ *
+ * `~/.copilot/settings.json` is one file for the whole machine, so a port fixed
+ * at write time is the port of whichever server wrote last. CommandMate
+ * supports several servers at once — `commandmate start --issue N --auto-port`
+ * is a documented workflow — and the measured consequence was every copilot
+ * session on the machine posting to a development server on port 3011.
+ *
+ * Only the port moves. `HOOK_HOST`, the scheme and the receiver paths stay
+ * literals in the generated command: they are what decides where the bearer
+ * header goes, and {@link curlArgumentPreamble} attaches that header without
+ * looking at the destination. See 設計方針書 §10.8 決定 1.
+ */
+exports.COPILOT_HOOK_PORT_ENV = launch_command_1.HOOK_PORT_ENV_VAR;
 /**
  * Copilot's name for the event that gates a tool call (#1757 §5.2.4).
  *
@@ -190,13 +240,30 @@ function getCopilotHomeDirectory() {
 function getCopilotSettingsPath() {
     return (0, path_1.join)(getCopilotHomeDirectory(), 'settings.json');
 }
-function receiverUrl(path, options) {
-    return `http://${HOOK_HOST}:${options.port ?? (0, env_1.getServerPort)()}${path}`;
+/**
+ * The file copilot manages for itself, and the reason {@link writeCopilotHookSettings}
+ * sometimes declines to write anything (Issue #1904).
+ *
+ * Never written here. It is read for one key — see
+ * {@link inspectCopilotConfigHooks}.
+ */
+function getCopilotConfigPath() {
+    return (0, path_1.join)(getCopilotHomeDirectory(), 'config.json');
 }
 /**
  * The guard every generated command opens with.
  *
- * Consumes stdin before exiting rather than exiting straight away: copilot
+ * Two conditions, in this order:
+ *
+ *  1. **No worktree id — not a session CommandMate started.** Exit quietly.
+ *  2. **No usable port.** `CM_HOOK_PORT` is what the command builds its URL
+ *     from since Issue #1904, and a value that is not a run of digits is a URL
+ *     this hook must not assemble. Spelled without a `${…:-…}` default on
+ *     purpose: a default would send the payload — and the bearer header — to
+ *     some other port in silence whenever CommandMate forgot to set the
+ *     variable. Not firing is the safe answer (設計方針書 §10.8 決定 3).
+ *
+ * Both consume stdin before exiting rather than exiting straight away: copilot
  * writes the payload to the hook's stdin, and a hook that exits first turns
  * that write into an EPIPE on the agent's side.
  *
@@ -204,7 +271,8 @@ function receiverUrl(path, options) {
  */
 function guardPrelude(onSkip = '') {
     return (`: ${exports.COPILOT_HOOK_MARKER}; ` +
-        `if [ -z "\${${exports.COPILOT_WORKTREE_ID_ENV}:-}" ]; then cat >/dev/null; ${onSkip}exit 0; fi; `);
+        `if [ -z "\${${exports.COPILOT_WORKTREE_ID_ENV}:-}" ]; then cat >/dev/null; ${onSkip}exit 0; fi; ` +
+        `case "$${exports.COPILOT_HOOK_PORT_ENV}" in ''|*[!0-9]*) cat >/dev/null; ${onSkip}exit 0;; esac; `);
 }
 /** `"$CM_AGENT_INSTANCE_ID"`, defaulting to the primary instance. */
 const INSTANCE_EXPANSION = `"\${${exports.COPILOT_INSTANCE_ID_ENV}:-${tool_id_1.COPILOT_CLI_TOOL_ID}}"`;
@@ -217,25 +285,58 @@ const WORKTREE_EXPANSION = `"$${exports.COPILOT_WORKTREE_ID_ENV}"`;
  * Written this way rather than as `${TOKEN:+-H "…"}` because that expansion
  * word-splits into four arguments and sends a header of `Authorization:`
  * alone. The relay script solves it identically.
+ *
+ * `-f` since Issue #1904, and it is not cosmetic on the `PreToolUse` path:
+ * without it a 400 body such as `{"error":"cwd rejected: …"}` is printed to
+ * stdout and copilot reads **the receiver's error message as its verdict**.
+ * With `-f` curl prints nothing and exits 22, which the callers turn into an
+ * explicit no-opinion `{}` plus one line on stderr. The relay script has always
+ * used `-fsS` for the same reason.
  */
 function curlArgumentPreamble() {
-    return (`set -- -sS -m ${exports.COPILOT_HOOK_CURL_TIMEOUT_SECONDS} -X POST ` +
+    return (`set -- -fsS -m ${exports.COPILOT_HOOK_CURL_TIMEOUT_SECONDS} -X POST ` +
         `-H 'Content-Type: application/json'; ` +
         `if [ -n "\${${exports.COPILOT_AUTH_TOKEN_ENV}:-}" ]; then ` +
         `set -- "$@" -H "Authorization: Bearer $${exports.COPILOT_AUTH_TOKEN_ENV}"; fi; `);
 }
+/**
+ * `http://127.0.0.1:` + `"$CM_HOOK_PORT"` + the rest, as one shell word.
+ *
+ * Everything except the port is a single-quoted literal, so the only thing the
+ * environment can move is the port number the {@link guardPrelude} has already
+ * proved to be digits. Host and scheme staying constant is what keeps the
+ * bearer header pointed at loopback (設計方針書 §10.7 / §10.8).
+ */
+function runtimeUrl(tail) {
+    return (`${(0, hook_settings_generator_1.shellQuote)(`http://${HOOK_HOST}:`)}"$${exports.COPILOT_HOOK_PORT_ENV}"${(0, hook_settings_generator_1.shellQuote)(tail)}`);
+}
 /**
  * A receiver URL with the correlation keys appended at fire time.
  *
- * The static half is single-quoted and the variables are double-quoted next to
- * it, so the shell concatenates them into one word without re-splitting. Both
- * ids are validated before injection ({@link buildCopilotLaunchCommand}) and
- * draw from `[A-Za-z0-9_-]`, so no percent-encoding is required.
+ * The static halves are single-quoted and the variables are double-quoted next
+ * to them, so the shell concatenates the lot into one word without
+ * re-splitting. Both ids are validated before injection
+ * ({@link buildCopilotLaunchCommand}) and draw from `[A-Za-z0-9_-]`, so no
+ * percent-encoding is required.
  */
 function runtimeCorrelatedUrl(base) {
-    return (`${(0, hook_settings_generator_1.shellQuote)(`${base}?tool=${tool_id_1.COPILOT_CLI_TOOL_ID}&worktreeId=`)}${WORKTREE_EXPANSION}` +
+    return (`${runtimeUrl(`${base}?tool=${tool_id_1.COPILOT_CLI_TOOL_ID}&worktreeId=`)}${WORKTREE_EXPANSION}` +
         `'&instanceId='${INSTANCE_EXPANSION}`);
 }
+/**
+ * One line on stderr naming why a POST produced nothing, and curl's exit code.
+ *
+ * A hook whose delivery fails in complete silence is a `commandmate wait` that
+ * never returns and an operator with nothing to read. The relay script prints
+ * its own equivalent line; these are the inline paths, which used to end in
+ * `|| true` and `2>/dev/null`.
+ *
+ * The marker leads so `grep` finds CommandMate's lines in a transcript the same
+ * way it finds CommandMate's entries in the settings file.
+ */
+function reportFailure(reasonCode) {
+    return (`rc=$?; printf '%s\\n' "${exports.COPILOT_HOOK_MARKER}: ${reasonCode} rc=$rc" >&2`);
+}
 /**
  * The command for one observation event.
  *
@@ -246,28 +347,39 @@ function runtimeCorrelatedUrl(base) {
  * `normalizeEvent` is what turns `hook_event_name` into a word (S1/S2).
  */
 function buildCopilotEventCommand(event, options = {}) {
-    const url = receiverUrl(hook_settings_generator_1.AGENT_EVENT_PATH, options);
     const relay = options.relayScriptPath === undefined ? (0, hook_settings_generator_1.resolveRelayScriptPath)() : options.relayScriptPath;
-    if (relay) {
-        return (guardPrelude() +
-            [
-                (0, hook_settings_generator_1.shellQuote)(relay),
-                '--tool',
-                (0, hook_settings_generator_1.shellQuote)(tool_id_1.COPILOT_CLI_TOOL_ID),
-                '--event',
-                (0, hook_settings_generator_1.shellQuote)(event),
-                '--worktree-id',
-                WORKTREE_EXPANSION,
-                '--instance-id',
-                INSTANCE_EXPANSION,
-                '--url',
-                (0, hook_settings_generator_1.shellQuote)(url),
-                '--stdin-json',
-            ].join(' '));
-    }
+    const inline = curlArgumentPreamble() +
+        `curl "$@" --data-binary @- ${runtimeCorrelatedUrl(hook_settings_generator_1.AGENT_EVENT_PATH)} >/dev/null 2>&1 || ` +
+        `{ ${reportFailure('agent_event_post_failed')}; }`;
+    if (!relay)
+        return guardPrelude() + inline;
+    // The `[ -x … ]` is Issue #1904. `~/.copilot/settings.json` is one file for
+    // the whole machine, so the absolute path in it is whichever checkout's
+    // server wrote last — and when that checkout is a worktree that has since
+    // been removed, every copilot session on the machine loses every event with
+    // nothing to read. Deciding at fire time costs one `test` and falls back to
+    // the branch that was already written for a package layout with no relay.
+    // The path stays a literal rather than moving into the environment: it names
+    // the program the hook executes, and that is not a decision to hand to
+    // whoever can set a variable (設計方針書 §10.8 決定 2).
     return (guardPrelude() +
-        curlArgumentPreamble() +
-        `curl "$@" --data-binary @- ${runtimeCorrelatedUrl(url)} >/dev/null 2>&1 || true`);
+        `if [ -x ${(0, hook_settings_generator_1.shellQuote)(relay)} ]; then ` +
+        [
+            (0, hook_settings_generator_1.shellQuote)(relay),
+            '--tool',
+            (0, hook_settings_generator_1.shellQuote)(tool_id_1.COPILOT_CLI_TOOL_ID),
+            '--event',
+            (0, hook_settings_generator_1.shellQuote)(event),
+            '--worktree-id',
+            WORKTREE_EXPANSION,
+            '--instance-id',
+            INSTANCE_EXPANSION,
+            '--url',
+            runtimeUrl(hook_settings_generator_1.AGENT_EVENT_PATH),
+            '--stdin-json',
+        ].join(' ') +
+        `; exit 0; fi; ` +
+        inline);
 }
 /**
  * The command for `PreToolUse`, whose stdout copilot obeys.
@@ -284,11 +396,15 @@ function buildCopilotEventCommand(event, options = {}) {
  * session CommandMate did not start all have to look like "no opinion", which
  * is the measured fail-safe.
  */
-function buildCopilotPermissionCommand(options = {}) {
-    const url = receiverUrl(hook_settings_generator_1.PERMISSION_REQUEST_PATH, options);
+function buildCopilotPermissionCommand(
+// Unused since Issue #1904 moved the port into the environment: nothing this
+// command says depends on the writing server any more. Kept so the two
+// builders stay callable the same way from {@link buildCopilotHookSettings}.
+_options = {}) {
     return (guardPrelude(`printf '{}'; `) +
         curlArgumentPreamble() +
-        `out=$(curl "$@" --data-binary @- ${runtimeCorrelatedUrl(url)} 2>/dev/null); ` +
+        `out=$(curl "$@" --data-binary @- ${runtimeCorrelatedUrl(hook_settings_generator_1.PERMISSION_REQUEST_PATH)} ` +
+        `2>/dev/null) || { ${reportFailure('permission_request_failed')}; out=''; }; ` +
         `[ -n "$out" ] || out='{}'; printf '%s' "$out"`);
 }
 /**
@@ -372,6 +488,17 @@ function mergeCopilotHookSettings(existing, generated) {
     }
     return { ...existing, hooks: merged };
 }
+/** `''` when the file is not there; anything else throws. */
+function readFileOrEmpty(path) {
+    try {
+        return (0, fs_1.readFileSync)(path, 'utf8');
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return '';
+        throw error;
+    }
+}
 /**
  * Read the user's `settings.json`.
  *
@@ -380,15 +507,9 @@ function mergeCopilotHookSettings(existing, generated) {
  *   the caller turns that into "start without hooks", never into a rewrite
  */
 function readCopilotSettings(settingsPath) {
-    let raw;
-    try {
-        raw = (0, fs_1.readFileSync)(settingsPath, 'utf8');
-    }
-    catch (error) {
-        if (error.code === 'ENOENT')
-            return {};
-        throw error;
-    }
+    return parseCopilotSettings(readFileOrEmpty(settingsPath));
+}
+function parseCopilotSettings(raw) {
     if (raw.trim() === '')
         return {};
     const parsed = JSON.parse(raw);
@@ -397,18 +518,235 @@ function readCopilotSettings(settingsPath) {
     }
     return parsed;
 }
+/**
+ * Strip `//` and block comments from JSONC, leaving string literals alone.
+ *
+ * `~/.copilot/config.json` is not JSON. Copilot writes two comment lines at the
+ * top of the file it manages — measured verbatim on 1.0.80:
+ *
+ * ```text
+ * // User settings belong in settings.json.
+ * // This file is managed automatically.
+ * ```
+ *
+ * so `JSON.parse` on the real file throws at character 0. A detector that
+ * treated that as "unreadable" would never see the `hooks` key it exists to
+ * find, which is the whole of {@link inspectCopilotConfigHooks}.
+ */
+function stripJsonComments(raw) {
+    let out = '';
+    let inString = false;
+    let escaped = false;
+    for (let i = 0; i < raw.length; i += 1) {
+        const char = raw[i];
+        if (inString) {
+            out += char;
+            if (escaped)
+                escaped = false;
+            else if (char === '\\')
+                escaped = true;
+            else if (char === '"')
+                inString = false;
+            continue;
+        }
+        if (char === '"') {
+            inString = true;
+            out += char;
+            continue;
+        }
+        if (char === '/' && raw[i + 1] === '/') {
+            while (i < raw.length && raw[i] !== '\n')
+                i += 1;
+            out += '\n';
+            continue;
+        }
+        if (char === '/' && raw[i + 1] === '*') {
+            i += 2;
+            while (i < raw.length && !(raw[i] === '*' && raw[i + 1] === '/'))
+                i += 1;
+            i += 1;
+            continue;
+        }
+        out += char;
+    }
+    return out;
+}
+/**
+ * Look for the key that silently erases everything this module writes
+ * (Issue #1904).
+ *
+ * Measured on copilot 1.0.80: with a marker hook in **both** files, only the
+ * `config.json` one fired, and the `settings.json` read back immediately
+ * afterwards held six `config.json` entries and none of the settings ones.
+ * `copilot help config` still documents `hooks` as a `config.json` key, so an
+ * operator who follows the published documentation loses CommandMate's hooks —
+ * events and Auto-Yes both — with no error anywhere.
+ */
+function inspectCopilotConfigHooks(configPath) {
+    const raw = readFileOrEmpty(configPath);
+    if (raw.trim() === '')
+        return 'absent';
+    let parsed;
+    try {
+        parsed = JSON.parse(stripJsonComments(raw));
+    }
+    catch {
+        return 'unreadable';
+    }
+    if (!isPlainObject(parsed))
+        return 'unreadable';
+    const hooks = parsed.hooks;
+    if (hooks === undefined || hooks === null)
+        return 'absent';
+    if (isPlainObject(hooks) && Object.keys(hooks).length === 0)
+        return 'absent';
+    if (Array.isArray(hooks) && hooks.length === 0)
+        return 'absent';
+    return 'present';
+}
+/**
+ * Thrown instead of writing a settings file copilot is about to overwrite.
+ *
+ * A distinct type so {@link buildCopilotLaunchCommand} can log this as its own
+ * reason code: "your config.json shadows the file we write" is a thing an
+ * operator can act on, and `copilot-hook-settings-write-failed` is not.
+ */
+class CopilotConfigHooksShadowError extends Error {
+    configPath;
+    constructor(configPath) {
+        super(`copilot config.json still has a "hooks" key (${configPath}); ` +
+            'copilot migrates it over settings.json at startup, so CommandMate is not writing hooks this launch');
+        this.configPath = configPath;
+        this.name = 'CopilotConfigHooksShadowError';
+    }
+}
+exports.CopilotConfigHooksShadowError = CopilotConfigHooksShadowError;
+/** Where the cross-process lock lives, next to the file it guards. */
+exports.COPILOT_SETTINGS_LOCK_BASENAME = '.cmate.lock';
+/**
+ * How old a lock has to be before it is treated as a crashed process's leftover.
+ *
+ * The critical section is a read, a merge and a rename of a file measured in
+ * kilobytes, so a lock that has been held for this long is not a slow write; it
+ * is a server that died between `openSync` and `unlinkSync`. Without a ceiling
+ * that leftover would disable copilot hooks on the machine until somebody
+ * deleted the file by hand.
+ */
+exports.COPILOT_SETTINGS_LOCK_STALE_MS = 10_000;
+/** Suffix of the one generation of the user's file kept before a rewrite. */
+exports.COPILOT_SETTINGS_BACKUP_SUFFIX = '.cmate-backup';
+/**
+ * Run `write` with `~/.copilot` held against other CommandMate servers.
+ *
+ * `commandmate start --issue N --auto-port` makes several servers on one
+ * machine a supported workflow, and every one of them writes this same file.
+ * Within a process the writes are already serialised — everything here is
+ * synchronous — so the lock exists for the cross-process case (設計方針書
+ * §10.9 決定 2).
+ *
+ * @throws When the lock is held and fresh. The caller turns that into "start
+ *   without hooks", which is the same fail-open every other failure here takes.
+ */
+function withCopilotSettingsLock(directory, write) {
+    const lockPath = (0, path_1.join)(directory, exports.COPILOT_SETTINGS_LOCK_BASENAME);
+    let fd;
+    try {
+        fd = (0, fs_1.openSync)(lockPath, 'wx', 0o600);
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+        const heldForMs = Date.now() - (0, fs_1.statSync)(lockPath).mtimeMs;
+        if (heldForMs < exports.COPILOT_SETTINGS_LOCK_STALE_MS) {
+            throw new Error(`copilot settings.json is locked by another CommandMate server (${lockPath})`);
+        }
+        logger.warn('copilot-hook-settings-lock-stale', { lockPath, heldForMs });
+        (0, fs_1.unlinkSync)(lockPath);
+        fd = (0, fs_1.openSync)(lockPath, 'wx', 0o600);
+    }
+    try {
+        (0, fs_1.writeSync)(fd, `${process.pid}\n`);
+    }
+    finally {
+        (0, fs_1.closeSync)(fd);
+    }
+    try {
+        return write();
+    }
+    finally {
+        try {
+            (0, fs_1.unlinkSync)(lockPath);
+        }
+        catch {
+            // Already gone: another server judged this lock stale. Nothing to undo.
+        }
+    }
+}
+/**
+ * Replace a file's contents without ever leaving it half-written.
+ *
+ * `writeFileSync` truncates first, so a process that dies mid-write leaves the
+ * operator with a truncated `settings.json` — and this module's own docstring
+ * says overwriting a user's settings is the unrecoverable failure. A temp file
+ * in the same directory plus `rename` is atomic on every filesystem CommandMate
+ * runs on (設計方針書 §10.9 決定 1).
+ */
+function writeFileAtomic(path, contents) {
+    const temp = `${path}.${process.pid}.tmp`;
+    try {
+        (0, fs_1.writeFileSync)(temp, contents, { mode: 0o600 });
+        (0, fs_1.renameSync)(temp, path);
+    }
+    catch (error) {
+        try {
+            (0, fs_1.unlinkSync)(temp);
+        }
+        catch {
+            // The temp file never got created, or is already gone.
+        }
+        throw error;
+    }
+}
 /**
  * Merge the generated hooks into copilot's settings file and return its path.
  *
- * @throws Anything the read, the merge or the write throws. Callers must treat
- *   a throw as "launch without hooks" (fail-open).
+ * @throws {CopilotConfigHooksShadowError} When copilot's `config.json` still
+ *   has a `hooks` key, which it migrates over this file at startup
+ * @throws Anything the read, the merge or the write throws, plus a lock the
+ *   file's other writers are holding. Callers must treat a throw as "launch
+ *   without hooks" (fail-open).
  */
 function writeCopilotHookSettings(options = {}) {
     const settingsPath = options.settingsPath ?? getCopilotSettingsPath();
-    const merged = mergeCopilotHookSettings(readCopilotSettings(settingsPath), buildCopilotHookSettings(options));
+    // Next to the settings file rather than via `getCopilotConfigPath()`: the
+    // config.json that can erase a settings.json is the one copilot reads from
+    // the same directory, and an overridden `settingsPath` must not be checked
+    // against a different home's config.
+    const configPath = options.configPath ?? (0, path_1.join)((0, path_1.dirname)(settingsPath), 'config.json');
+    const configHooks = inspectCopilotConfigHooks(configPath);
+    if (configHooks === 'present')
+        throw new CopilotConfigHooksShadowError(configPath);
+    if (configHooks === 'unreadable') {
+        // Not fatal: proceeding is what this module did before #1904, and a shape
+        // nobody has measured is not evidence that a migration is coming.
+        logger.warn('copilot-config-json-unreadable', { configPath });
+    }
     (0, fs_1.mkdirSync)((0, path_1.dirname)(settingsPath), { recursive: true, mode: 0o700 });
-    (0, fs_1.writeFileSync)(settingsPath, `${JSON.stringify(merged, null, 2)}\n`, { mode: 0o600 });
-    return settingsPath;
+    return withCopilotSettingsLock((0, path_1.dirname)(settingsPath), () => {
+        const raw = readFileOrEmpty(settingsPath);
+        const merged = mergeCopilotHookSettings(parseCopilotSettings(raw), buildCopilotHookSettings(options));
+        const next = `${JSON.stringify(merged, null, 2)}\n`;
+        // Since #1904 the generated commands carry no port and no per-launch value,
+        // so the common re-launch produces the bytes already on disk. Returning
+        // early keeps the user's file — and its mtime — untouched, and skips the
+        // backup that would otherwise be rewritten on every session start.
+        if (raw === next)
+            return settingsPath;
+        if (raw !== '')
+            (0, fs_1.copyFileSync)(settingsPath, `${settingsPath}${exports.COPILOT_SETTINGS_BACKUP_SUFFIX}`);
+        writeFileAtomic(settingsPath, next);
+        return settingsPath;
+    });
 }
 /**
  * The environment that tells a hook which instance fired it.
@@ -425,10 +763,15 @@ function writeCopilotHookSettings(options = {}) {
  * separately, all four assuming a shell nobody had declared. The rendering now
  * happens once, in `../launch-command`, and the bytes are identical.
  */
-function buildCopilotHookEnvironment(worktreeId, instanceId) {
+function buildCopilotHookEnvironment(worktreeId, instanceId, options = {}) {
     return {
         [exports.COPILOT_WORKTREE_ID_ENV]: worktreeId,
         [exports.COPILOT_INSTANCE_ID_ENV]: instanceId,
+        // Issue #1904. Not a secret — the launch line is typed into the pane and
+        // shows up in `capture --json` (設計方針書 §10.7 / 受入条件 S18) — and the
+        // one value that has to be *this* server's rather than the last one to
+        // write the machine-global settings file.
+        [exports.COPILOT_HOOK_PORT_ENV]: String(options.port ?? (0, env_1.getServerPort)()),
     };
 }
 /**
@@ -470,10 +813,20 @@ function buildCopilotLaunchCommand(executablePath, target, options = {}) {
         return {
             command: executablePath,
             settingsPath,
-            env: buildCopilotHookEnvironment(target.worktreeId, instanceId),
+            env: buildCopilotHookEnvironment(target.worktreeId, instanceId, options),
         };
     }
     catch (error) {
+        if (error instanceof CopilotConfigHooksShadowError) {
+            // Its own reason code because it is the one failure here an operator can
+            // fix: move `hooks` out of config.json and into settings.json, or let
+            // copilot's own migration do it, and the next launch injects normally.
+            logger.warn('copilot-hook-config-json-shadows-settings', {
+                worktreeId: target.worktreeId,
+                configPath: error.configPath,
+            });
+            return bare;
+        }
         logger.warn('copilot-hook-settings-write-failed', {
             worktreeId: target.worktreeId,
             error: error instanceof Error ? error.message : String(error),

package/dist/server/src/lib/hooks/sources/copilot/source.js

@@ -58,6 +58,14 @@
  * wrong for this tool specifically, which is why the fence in
  * `beginAgentSession` is a timestamp rather than a state machine.
  *
+ * On a first turn the gap is not milliseconds but 12-15 s (#1903, measured
+ * twice), which is long enough for the structured layer to publish a verdict
+ * and then take it away again. That is what `sessionStartMayArriveLate` below
+ * declares, and `agent-event-state.recordAgentEvent` is what reads it: a
+ * `SessionStart` arriving inside a turn this instance has already opened does
+ * not replace the event the verdict is read from. Nothing there compares
+ * against `copilot`.
+ *
  * @module lib/hooks/sources/copilot/source
  */
 Object.defineProperty(exports, "__esModule", { value: true });
@@ -65,6 +73,7 @@ exports.copilotAgentEventSource = void 0;
 exports.parseCopilotPermissionRequest = parseCopilotPermissionRequest;
 exports.encodeCopilotVerdict = encodeCopilotVerdict;
 const permission_request_payload_1 = require("../../../../lib/hooks/permission-request-payload");
+const tool_input_normalization_1 = require("../../../../lib/hooks/tool-input-normalization");
 const define_source_1 = require("../define-source");
 const event_mapper_1 = require("../event-mapper");
 const hook_event_vocabulary_1 = require("../hook-event-vocabulary");
@@ -106,13 +115,24 @@ function parseCopilotPermissionRequest(body) {
     const toolName = (0, event_mapper_1.readStringField)(body, 'tool_name');
     if (!toolName || toolName.length > permission_request_payload_1.MAX_TOOL_NAME_LENGTH)
         return null;
-    // No `tool_input` means nothing for the deny patterns to be judged against,
-    // which makes the request unadjudicatable rather than harmless.
-    if (!(0, event_mapper_1.isPlainObject)(body.tool_input))
+    // No usable `tool_input` means nothing for the deny patterns to be judged
+    // against, which makes the request unadjudicatable rather than harmless.
+    //
+    // Issue #1902: this used to be `isPlainObject(body.tool_input)`, and that was
+    // the bug. Copilot 1.0.80's `Edit` sends the apply-patch envelope as a bare
+    // *string*, so the object check answered null for every file edit copilot
+    // ever made — null became `unknown-payload`, `unknown-payload` is a
+    // no-decision, and Auto-Yes v2 abstained on the whole edit family while
+    // working perfectly on `Read` and `Bash`, whose inputs are objects. The
+    // string is now read as a patch and the rewrite is reported rather than done
+    // in silence; see `lib/hooks/tool-input-normalization`.
+    const input = (0, tool_input_normalization_1.readPermissionToolInput)(body.tool_input);
+    if (!input)
         return null;
     return {
         toolName,
-        toolInput: body.tool_input,
+        toolInput: input.toolInput,
+        toolInputNormalization: input.normalization,
         promptId: null,
         sessionId: (0, event_mapper_1.readStringField)(body, 'session_id'),
         permissionMode: null,
@@ -184,6 +204,22 @@ exports.copilotAgentEventSource = (0, define_source_1.definePushHookSource)({
         // One file for the whole machine. See `./hook-settings`.
         configScope: 'global-singleton',
         decisionTimeoutSeconds: hook_settings_1.COPILOT_HOOK_TIMEOUT_SECONDS,
+        // Issue #1924, §4 D3. copilot DOES register a permission hook — this is the
+        // row where registration and prediction come apart. It fires on every tool
+        // call and copilot executes most of them straight away (#1901), so reading a
+        // non-allow as "a dialog is coming" files a prompt that never appears and
+        // leaves the pane `waiting` until the provisional record expires.
+        permissionHookPredictsDialog: false,
+        // The one `true` in this column, and a stopwatch rather than an inference:
+        // `UserPromptSubmit` at 20.813Z, `SessionStart` at 20.915Z (#1903). See the
+        // module comment above.
+        sessionStartMayArriveLate: true,
+        permissionReplyReleasesPrompt: false,
+        // Not audited. No captured copilot payload carries a `tool_use_id`, so
+        // `'tool-call-id'` would be a guess; whether one exists is still to be
+        // measured. Default = Claude's fallback, the time window.
+        eventIdentity: null,
+        resync: 'none',
     },
     // The same CamelCase dialect as Claude and codex — measured against six
     // captured payloads (#1757 §8.1), not assumed from the resemblance. Shared