commandmate 0.26.0 → 0.27.0

package/dist/server/src/lib/response-cleaner.js

@@ -141,14 +141,45 @@ function cleanGeminiResponse(response) {
     return cleanedLines.join('\n').trim();
 }
 /**
- * Copilot tool-action pattern: ● followed by English tool/action keywords.
- * These lines represent Copilot's internal tool calls (shell, file reads, etc.)
- * and should be filtered from saved responses.
- * Does NOT match ● followed by non-action text (e.g., Japanese response content).
+ * Copilot tool-action pattern: ● followed by one of copilot's TOOL NAMES.
  *
  * Issue #571: Distinguish tool actions from actual response content starting with ●
+ *
+ * Issue #1897: the list used to hold ~110 ordinary English verbs (Check, Add,
+ * Update, Show, Find, Set, Test, Save, Watch, Verify, Build, Start, …). On
+ * copilot 1.0.80 `●` is the marker for the AGENT'S MESSAGE -- tool calls are
+ * drawn as `$ <Tool> …` (see {@link COPILOT_TOOL_INVOCATION_PATTERN}) -- so every
+ * one of those verbs matched prose and nothing else. `● Check the config file`
+ * was deleted as a tool call, and because the match also opened a
+ * skip-until-next-marker block it took the rest of the reply with it.
+ *
+ * What remains is the set of names copilot actually labels tool rows with, which
+ * is why the ≤1.0.79 rows this was written for (`● Read package.json`,
+ * `● Get current directory structure (shell)`) are still filtered. A match is now
+ * a SINGLE-LINE skip: the follow-on command and output rows are recognised on
+ * their own by {@link COPILOT_FOLD_MARKER_PATTERN} and
+ * {@link COPILOT_COMMAND_OUTPUT_PATTERN}, so nothing needs a block that can run
+ * away over a whole message.
+ */
+const COPILOT_TOOL_ACTION_PATTERN = /^●\s+(?:Get |Read |Run |Search |Write |Edit |Delete |List |Create |Fetch |Explore |Execute |Install |Model changed to:)/;
+/**
+ * copilot 1.0.80's tool invocation row (Issue #1897).
+ *
+ * Measured on the live frames in
+ * `tests/unit/lib/detection/fixtures/copilot-live-1885/`: a tool call is a `$`
+ * marker row naming the tool, with the fold marker and the elapsed time
+ * right-aligned onto the same row, and the command it ran on the indented rows
+ * below:
+ *
+ *     $ Shell Wait 25 seconds then print status 2 lines…            1m 27s
+ *       sleep 25; echo finished
+ *
+ * The capitalised tool name is required so a `$ npm install` line inside a reply's
+ * code block is not read as copilot's own chrome. This is the one construct that
+ * still opens a skip block, and that block now ends at the next marker row or the
+ * next blank row rather than running to the end of the message.
  */
-const COPILOT_TOOL_ACTION_PATTERN = /^●\s+(?:Get |Read |Run |Search |Write |Delete |Edit |List |Create |Check |Fetch |Map |Explore |Execute |Find |Install |Update |Open |Close |Copy |Move |Rename |Set |Test |Build |Deploy |Start |Stop |Restart |Kill |Call |Send |Upload |Download |Compile |Analyze |Scan |Apply |Revert |Reset |Push |Pull |Clone |Merge |Commit |Checkout |Branch |Tag |Diff |Log |Show |Status |Init |Config |Add |Remove |Index |Query |Connect |Disconnect |Ping |Trace |Debug |Validate |Verify |Inspect |Monitor |Watch |Clean |Purge |Flush |Load |Save |Export |Import |Format |Lint |Parse |Generate |Transform |Convert |Migrate |Upgrade |Patch |Enable |Disable |Grant |Revoke |Approve |Deny |Lock |Unlock |Mount |Unmount |Attach |Detach |Register |Unregister |Subscribe |Unsubscribe |Publish |Unpublish |Encrypt |Decrypt |Sign |Hash |Encode |Decode |Compress |Decompress |Archive |Extract |Backup |Restore |Dump |Model changed to:)/;
+const COPILOT_TOOL_INVOCATION_PATTERN = /^\$\s+[A-Z][A-Za-z]*(?:\s|$)/;
 /**
  * Pattern for "N lines..." fold markers in Copilot TUI output.
  * These indicate collapsed command output.
@@ -161,8 +192,17 @@ const COPILOT_THINKING_INDICATOR_PATTERN = /^[◐◑◒◓]/;
 /**
  * Pattern for shell command output lines in Copilot TUI.
  * Matches common command prefixes that appear in tool call output.
+ *
+ * Issue #1897: the heads that are also ordinary English words at the start of a
+ * sentence were removed -- `find`, `go`, `make`, `cat`, `ls`, `cd`, `echo`,
+ * `node`, `python`, `ruby`. "find the file in src/", "go to the settings page",
+ * "make sure you run npm test" and "cat the file to check" were all being deleted
+ * from saved replies as if they were shell transcript. The heads that remain are
+ * tool names no English sentence opens with, so the rule keeps its purpose (the
+ * `git --no-pager …` and `npm run …` rows copilot echoes under a tool call) at no
+ * cost to prose.
  */
-const COPILOT_COMMAND_OUTPUT_PATTERN = /^(?:git\s+--no-pager|git\s+(?:log|diff|show|status|branch|remote|fetch|pull|push|merge|rebase|checkout|reset|stash|tag|config|clone|init|add|commit|rm|mv|bisect|grep|ls-files|rev-parse|describe|shortlog|blame|reflog|cherry-pick|revert|submodule|worktree)\b|npm\s+|npx\s+|node\s+|yarn\s+|pnpm\s+|cargo\s+|pip\s+|python\s+|ruby\s+|go\s+|rustc\s+|make\s+|cmake\s+|docker\s+|kubectl\s+|aws\s+|gcloud\s+|az\s+|terraform\s+|ansible\s+|curl\s+|wget\s+|ssh\s+|scp\s+|rsync\s+|find\s+|grep\s+|sed\s+|awk\s+|cat\s+|ls\s+|cd\s+|mkdir\s+|rm\s+|cp\s+|mv\s+|chmod\s+|chown\s+|echo\s+)/;
+const COPILOT_COMMAND_OUTPUT_PATTERN = /^(?:git\s+--no-pager|git\s+(?:log|diff|show|status|branch|remote|fetch|pull|push|merge|rebase|checkout|reset|stash|tag|config|clone|init|add|commit|rm|mv|bisect|grep|ls-files|rev-parse|describe|shortlog|blame|reflog|cherry-pick|revert|submodule|worktree)\b|npm\s+|npx\s+|yarn\s+|pnpm\s+|cargo\s+|pip\s+|rustc\s+|cmake\s+|docker\s+|kubectl\s+|aws\s+|gcloud\s+|az\s+|terraform\s+|ansible\s+|curl\s+|wget\s+|ssh\s+|scp\s+|rsync\s+|grep\s+|sed\s+|awk\s+|mkdir\s+|rm\s+|cp\s+|mv\s+|chmod\s+|chown\s+)/;
 /**
  * Clean Copilot response by removing TUI artifacts, extracting only the latest
  * response, and normalizing content.
@@ -182,7 +222,15 @@ const COPILOT_COMMAND_OUTPUT_PATTERN = /^(?:git\s+--no-pager|git\s+(?:log|diff|s
  */
 function cleanCopilotResponse(response) {
     const strippedResponse = (0, cli_patterns_1.stripAnsi)(response);
-    const lines = strippedResponse.split('\n');
+    const allLines = strippedResponse.split('\n');
+    // Issue #1897: cut copilot's bottom-pinned chrome (cwd row, rules, composer,
+    // status bar) before anything else, positionally — the status bar's wording is
+    // something copilot will happily print as body text, so only its position tells
+    // the two apart. Returns -1, and so changes nothing, for input that is not a
+    // whole captured frame: the accumulated content this normally receives, and the
+    // synthetic strings the unit tests pass.
+    const chromeStart = (0, cli_patterns_1.findCopilotChromeStart)(allLines);
+    const lines = chromeStart >= 0 ? allLines.slice(0, chromeStart) : allLines;
     // Step 1: Find the last ❯ prompt line with user input (not empty prompt)
     // This marks the boundary — everything after is the latest response
     let lastUserPromptIndex = -1;
@@ -196,32 +244,54 @@ function cleanCopilotResponse(response) {
             break;
         }
     }
-    // Extract lines after the last user prompt
-    const startIndex = lastUserPromptIndex >= 0 ? lastUserPromptIndex + 1 : 0;
+    // Extract lines after the last user prompt.
+    //
+    // Issue #1897: a prompt too long for one row wraps onto indented continuation
+    // rows, and starting at `+ 1` opened the saved reply with the tail of the
+    // operator's own question. Walk past them. (Indentation only survives on a raw
+    // frame; the accumulator has its own copy of this rule for the normalised path.)
+    let startIndex = lastUserPromptIndex >= 0 ? lastUserPromptIndex + 1 : 0;
+    if (lastUserPromptIndex >= 0) {
+        while (startIndex < lines.length &&
+            cli_patterns_1.COPILOT_TRANSCRIPT_CONTINUATION_PATTERN.test(lines[startIndex])) {
+            startIndex++;
+        }
+    }
     const responseLines = lines.slice(startIndex);
     const cleanedLines = [];
     // Track block-level skip state for multi-line constructs
     let inThinkingBlock = false;
-    let inCommandOutputBlock = false;
+    let inToolOutputBlock = false;
     for (const line of responseLines) {
         // Normalize using the same function as TUI accumulator (DRY)
         const normalized = (0, tui_accumulator_1.normalizeCopilotLine)(line);
-        if (!normalized)
+        if (!normalized) {
+            // Issue #1897: a blank row closes whatever block is open. copilot separates
+            // every transcript block with one, and skipping this reset is what allowed a
+            // single misclassified marker row to swallow the entire rest of the reply.
+            inThinkingBlock = false;
+            inToolOutputBlock = false;
             continue;
+        }
         // Skip lines matching any Copilot skip pattern (existing patterns)
         const shouldSkip = cli_patterns_1.COPILOT_SKIP_PATTERNS.some(pattern => pattern.test(normalized));
         if (shouldSkip)
             continue;
-        // Issue #571: Skip ● tool-action lines (but preserve ● response content)
-        if (COPILOT_TOOL_ACTION_PATTERN.test(normalized)) {
-            inCommandOutputBlock = true;
+        // Issue #1897: copilot 1.0.80's tool call. Its command / output rows follow
+        // until the next marker row or blank row.
+        if (COPILOT_TOOL_INVOCATION_PATTERN.test(normalized)) {
+            inToolOutputBlock = true;
             inThinkingBlock = false;
             continue;
         }
+        // Issue #571: Skip ● tool-action lines (but preserve ● response content).
+        // Issue #1897: a single-line skip — see COPILOT_TOOL_ACTION_PATTERN.
+        if (COPILOT_TOOL_ACTION_PATTERN.test(normalized))
+            continue;
         // Issue #571: Skip ◐◑◒◓ thinking indicator lines and their continuation lines
         if (COPILOT_THINKING_INDICATOR_PATTERN.test(normalized)) {
             inThinkingBlock = true;
-            inCommandOutputBlock = false;
+            inToolOutputBlock = false;
             continue;
         }
         // Issue #571: Skip "N lines..." fold markers
@@ -231,8 +301,11 @@ function cleanCopilotResponse(response) {
         if (COPILOT_COMMAND_OUTPUT_PATTERN.test(normalized))
             continue;
         // Skip empty ❯ prompt lines and ❯ with content (previous prompts that leaked through)
-        if (/^❯\s*/.test(normalized))
+        if (/^❯\s*/.test(normalized)) {
+            inThinkingBlock = false;
+            inToolOutputBlock = false;
             continue;
+        }
         // Issue #571: Skip │ and └ prefixed lines (command output block content)
         if (/^[│└]/.test(normalized)) {
             continue;
@@ -240,16 +313,16 @@ function cleanCopilotResponse(response) {
         // Detect new content block: ● starts a new response block, reset skip states
         if (/^●/.test(normalized)) {
             inThinkingBlock = false;
-            inCommandOutputBlock = false;
+            inToolOutputBlock = false;
             // This is a ● line that didn't match COPILOT_TOOL_ACTION_PATTERN,
             // so it's actual response content — keep it, but remove the ● prefix
             cleanedLines.push(normalized.replace(/^●\s*/, ''));
             continue;
         }
-        // If we're in a thinking or command output block, skip continuation lines
-        // until a new block marker (● or ❯) is found.
+        // If we're in a thinking or tool output block, skip continuation lines until a
+        // new block marker (●, ❯, $) or a blank row is found.
         // Note: TUI accumulator normalizes lines (trim), so indentation is lost.
-        if (inThinkingBlock || inCommandOutputBlock) {
+        if (inThinkingBlock || inToolOutputBlock) {
             continue;
         }
         cleanedLines.push(normalized);

package/dist/server/src/lib/response-extractor.js

@@ -7,28 +7,121 @@
  * Issue #479: Extracted from response-poller.ts for single-responsibility separation
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveOpenCodeTurnRegion = resolveOpenCodeTurnRegion;
+exports.sliceOpenCodeTurn = sliceOpenCodeTurn;
 exports.isOpenCodeComplete = isOpenCodeComplete;
 exports.resolveExtractionStartIndex = resolveExtractionStartIndex;
 const cli_patterns_1 = require("./detection/cli-patterns");
+/**
+ * The slice of an opencode pane that belongs to the turn currently on screen
+ * (Issue #1911).
+ *
+ * opencode renders in the alternate screen, so one capture holds the tail of the
+ * whole conversation plus the bottom-anchored chrome. Three of #1911's defects
+ * are the same missing boundary seen from different sides, so all three read the
+ * region from here:
+ *
+ *  - the echoed user prompt was saved as part of the assistant's reply, because
+ *    extraction anchored on the PREVIOUS turn's `▣ Build` row (and on the first
+ *    turn of a session, where there is no previous row, on line 0);
+ *  - the composer's model row and the footer's wrapped cwd were saved with it,
+ *    because nothing bounded the extraction from below;
+ *  - the previous turn's finished-turn marker satisfied `isOpenCodeComplete` on
+ *    the first poll of a new turn, so the previous answer was re-saved as the
+ *    new one and polling stopped before the real reply arrived.
+ *
+ * @param lines - Captured pane lines, ANSI-stripped, box drawing intact.
+ * @returns The turn's `[start, end)` bounds plus the two anchors they came from.
+ *
+ * @internal Exported for unit testing
+ */
+function resolveOpenCodeTurnRegion(lines) {
+    const chromeStart = (0, cli_patterns_1.findOpenCodeChromeStart)(lines);
+    const echoEnd = (0, cli_patterns_1.findOpenCodeUserEchoEnd)(lines, chromeStart);
+    return {
+        chromeStart,
+        echoEnd,
+        start: echoEnd + 1,
+        end: chromeStart >= 0 ? chromeStart : lines.length,
+        headTruncated: echoEnd < 0,
+    };
+}
+/**
+ * The current turn's rows of an opencode capture, ANSI intact (Issue #1911).
+ *
+ * Thin wrapper over {@link resolveOpenCodeTurnRegion} for callers that hold a
+ * raw capture rather than a line array — today the Layer-2 accumulator, which is
+ * fed this instead of the whole pane so it never records the previous turn, the
+ * echoed prompt, or the bottom chrome.
+ *
+ * @param output - Raw `capture-pane` output.
+ * @returns The region's rows joined by newlines; `''` when the turn has no rows
+ *   on screen yet.
+ */
+function sliceOpenCodeTurn(output) {
+    const rawLines = output.split('\n');
+    const region = resolveOpenCodeTurnRegion(rawLines.map(cli_patterns_1.stripAnsi));
+    if (region.start >= region.end)
+        return '';
+    return rawLines.slice(region.start, region.end).join('\n');
+}
 /**
  * Check if OpenCode has completed its response.
- * Detects the Build summary line pattern (e.g., "square Build . model . 2.5s").
+ * Detects the finished-turn marker (e.g., "square Build . model . 2.5s").
  * [D2-002] Independent completion detection for OpenCode.
  *
  * Unlike Claude (prompt + separator) or Codex/Gemini (prompt + not thinking),
  * OpenCode signals completion via the Build summary line, which includes
  * the model name and generation timing.
  *
- * @param output - Cleaned tmux output to check (ANSI-stripped)
+ * Issue #1893 tightened both halves of this, because a `true` here is what
+ * makes `response-checker` persist the frame as the agent's answer and stop
+ * polling — the failure mode is a permission dialog saved as if it were a
+ * reply, with the turn it belongs to still unanswered:
+ *
+ *  1. the marker must carry its DURATION ({@link OPENCODE_TURN_COMPLETE_PATTERN}).
+ *     The duration-less `▣ Build · <model>` row opencode draws for a step that
+ *     is still open used to satisfy the old, looser pattern.
+ *  2. a permission dialog on screen is never a completion, whatever marker sits
+ *     above it. `opencode-live-1893/permission-after-complete.txt` is a live
+ *     frame with the box open and a genuine `· 2.3s` marker from the PREVIOUS
+ *     turn still in the transcript, so (1) alone does not cover it.
+ *
+ * Issue #1911 adds the third half that (1) and (2) between them still left open:
+ * the marker must belong to the CURRENT turn, i.e. sit below the newest echoed
+ * user prompt ({@link resolveOpenCodeTurnRegion}). Without that, the very first
+ * poll after a send — before opencode has repainted `esc interrupt`, with the
+ * previous turn's duration-carrying marker still on screen — reported the turn
+ * as finished, so the previous answer was saved as the new one and polling
+ * stopped before the real reply existed.
+ *
+ * @param output - Cleaned tmux output to check (ANSI-stripped). Box drawing must
+ *   still be present: `OPENCODE_PERMISSION_PATTERN` anchors on the dialog box's
+ *   own gutter. `response-checker` passes `stripAnsi(lines.join('\n'))`, which
+ *   is exactly that.
  * @returns True if OpenCode response is complete
  *
  * @internal Exported for unit testing (response-poller-opencode.test.ts)
  */
 function isOpenCodeComplete(output) {
-    // Must have a Build completion marker AND must NOT be actively processing.
+    const lines = output.split('\n');
+    const region = resolveOpenCodeTurnRegion(lines);
+    // Issue #1911: the marker has to belong to THIS turn. Restricting the search
+    // to the region below the newest echoed prompt is what stops the previous
+    // turn's `▣ … · 2.3s` — still on screen, and still carrying its duration, so
+    // #1893's tightening does not touch it — from completing a turn that has not
+    // been answered yet. The upper bound matters too: the composer's own
+    // `┃  Build · GPT-5.6 Luna GitHub Copilot` row sits in the chrome.
+    const turnRegion = region.start >= region.end
+        ? ''
+        : lines.slice(region.start, region.end).join('\n');
+    // Must have a finished-turn marker in this turn, must NOT be actively
+    // processing, and must NOT be blocked on a permission dialog. The last two are
+    // read from the WHOLE frame: both live in the chrome the region excludes.
     // The "esc interrupt" indicator appears in the TUI footer during model processing.
-    // Without this check, old Build markers from previous Q&As cause false completions.
-    return cli_patterns_1.OPENCODE_RESPONSE_COMPLETE.test(output) && !cli_patterns_1.OPENCODE_PROCESSING_INDICATOR.test(output);
+    return (cli_patterns_1.OPENCODE_TURN_COMPLETE_PATTERN.test(turnRegion) &&
+        !cli_patterns_1.OPENCODE_PROCESSING_INDICATOR.test(output) &&
+        !cli_patterns_1.OPENCODE_PERMISSION_PATTERN.test(output));
 }
 /**
  * Determine the start index for response extraction based on buffer state.

package/dist/server/src/lib/security/env-sanitizer.js

@@ -7,9 +7,116 @@
  * before spawning child processes like `claude -p`.
  *
  * [S1-001/S4-001] Centralized sensitive key management
+ *
+ * ## What this file defends — the one sentence (Issue #1996)
+ *
+ * **A CommandMate process must hand its children neither a credential nor the
+ * identity of the agent that started it.**
+ *
+ * Two halves, and they fail differently:
+ *
+ *  - **Credentials** — {@link SENSITIVE_ENV_KEYS}. A child that can read them
+ *    can act as this server, or read its database.
+ *  - **The launching agent's identity** — {@link AGENT_CORRELATION_ENV_KEYS}:
+ *    every variable `AgentLaunchPlan.env` writes onto an agent's launch line
+ *    that says *which server to report to* and *as which instance*. A child
+ *    that inherits them reports somebody else's work as that instance's.
+ *
+ * A per-tool config redirect (`CODEX_HOME`) is on the launch line too and is
+ * deliberately **not** stripped: it says where a tool reads its own settings,
+ * which is neither a credential nor an identity, and a child that inherits one
+ * is unaffected.
+ *
+ * ## Issue #1942 — why a *prefix* joined the list
+ *
+ * 設計方針書 §13.2 S8 asks for two halves. #1904 landed the first: the values a
+ * hook needs are handed to the agent on its launch line (`CM_HOOK_PORT=3011
+ * copilot`) instead of being baked into a machine-global settings file. This is
+ * the second: those variables must not travel any further than the agent.
+ *
+ * The leak this closes is not the agent's own children — CommandMate does not
+ * own that environment — it is **CommandMate's**. A server started from inside
+ * a pane CommandMate itself launched inherits that pane's launch line, and
+ * every child *this* process then spawns (`claude -p` for Assistant Chat, the
+ * slash-command probes, `copilot --version`) inherits it in turn. The values
+ * are a correlation key and a port: a relay firing from one of those children
+ * posts its events to another server, attributed to an instance that is not the
+ * one running. Nothing errors; the events simply land on the wrong session.
+ *
+ * ## Issue #1996 — why the prefix could not be the whole rule
+ *
+ * #1942 chose `CM_HOOK_*` because a namespace is stronger than a list: the next
+ * variable in it is stripped whether or not its author reads this file. That
+ * reasoning is still right, and the prefix stays. What was wrong was the
+ * premise that the namespace *covers the launch line*. Building all seven
+ * sources' `prepareLaunch` and reading `env` back — the measurement is pinned in
+ * `tests/unit/lib/agent-launch-plan-secrets-1933.test.ts` — finds six identity
+ * variables, and two of them start with `CM_HOOK_`.
+ *
+ * The other four produce the same failure #1942 named, by two measured routes:
+ *
+ *  - `scripts/hooks/cmate-agent-event.sh` reads `CM_AGENT_TOOL` from the
+ *    environment (`TOOL="${CM_AGENT_TOOL:-claude}"`) and, with no `CM_HOOK_URL`,
+ *    falls back to `http://127.0.0.1:${CM_PORT:-3000}/api/hooks/agent-event`.
+ *    Stripping only the `CM_HOOK_` half therefore makes the destination *valid
+ *    again* — usually the live server — while the attribution stays wrong. The
+ *    event lands, on the wrong tool.
+ *  - The generated antigravity `PreToolUse` command gates on
+ *    `[ -z "${CM_PERMISSION_HOOK_URL:-}" ]`, which is its whole test for "am I a
+ *    CommandMate-launched session". `~/.gemini/config/hooks.json` is a
+ *    machine-global singleton, so an inherited `CM_PERMISSION_HOOK_URL` makes
+ *    any agy started under one of CommandMate's children ask *another
+ *    instance's* server for permission, and obey the answer.
+ *
+ * ### Why the prefix was not simply widened to `CM_AGENT_`
+ *
+ * Because `CM_AGENT_` is not CommandMate's own namespace, and the sentence that
+ * justifies the `CM_HOOK_` prefix — "there is no operator value here to
+ * preserve" — is false for it. `CM_AGENT_HOOKS_INJECT` and `CM_AGENT_HOOKS_DIR`
+ * are **operator switches read from the ambient environment**
+ * (`hooks/sources/copilot/hook-settings.ts`, `hooks/hook-settings-generator.ts`);
+ * stripping them would silently change a child's configuration. #1942's own test
+ * already pinned that shape. And `CM_PERMISSION_HOOK_URL` shares no prefix with
+ * anything, so no namespace rule could have covered the set in any case.
+ *
+ * Renaming the four into `CM_HOOK_*` so the prefix *would* suffice was
+ * considered and rejected: `CM_AGENT_TOOL` is documented in the shipped relay's
+ * own `--help` and depended on by the hand-configured hooks of #1549, and
+ * `~/.copilot/settings.json` / `~/.gemini/config/hooks.json` are machine-global
+ * files already on disk carrying the old names — every already-configured
+ * session would stop correlating until rewritten.
+ *
+ * So the rule is a **union**: the credential list, the enumerated identity set,
+ * and the `CM_HOOK_` prefix that still covers whatever is invented inside it.
+ *
+ * ## The join with `lib/hooks`, and what replaces the prefix as a drift guard
+ *
+ * `lib/security` does not import `lib/hooks` — the dependency already runs the
+ * other way (`hooks/agent-event-service`, `hooks/sources/copilot/hook-settings`
+ * and `hooks/sources/codex/hooks-config` all import
+ * `lib/security/path-validator`), and inverting it would put a package cycle
+ * underneath four child-process spawners. `tests/unit/guards/security-no-hooks-import.test.ts`
+ * holds that.
+ *
+ * The enumeration below is therefore a second copy of a list `lib/hooks` also
+ * declares, and two tests are the join:
+ *
+ *  1. `tests/unit/lib/agent-launch-plan-secrets-1933.test.ts` builds all seven
+ *     `prepareLaunch` plans and asserts their env keys are **exactly**
+ *     `AGENT_CORRELATION_ENV_VARS` plus `AGENT_LAUNCH_CONFIG_ENV_VARS`. A source
+ *     that starts writing a new variable — in any namespace — goes red there, by
+ *     name.
+ *  2. `tests/unit/security/child-process-agent-env-1996.test.ts` takes that
+ *     declared list and proves, with a real child process, that none of it is
+ *     readable. Deleting a name from {@link AGENT_CORRELATION_ENV_KEYS} does not
+ *     shrink what that test iterates, so the deletion is what goes red.
+ *
+ * Together those two are stronger than the prefix was, because the prefix never
+ * covered a name outside its own namespace at all.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SENSITIVE_ENV_KEYS = void 0;
+exports.AGENT_CORRELATION_ENV_KEYS = exports.COMMANDMATE_HOOK_ENV_PREFIX = exports.SENSITIVE_ENV_KEYS = void 0;
+exports.isStrippedChildProcessEnvKey = isStrippedChildProcessEnvKey;
 exports.sanitizeEnvForChildProcess = sanitizeEnvForChildProcess;
 /**
  * List of environment variable keys that must be removed before
@@ -18,9 +125,24 @@ exports.sanitizeEnvForChildProcess = sanitizeEnvForChildProcess;
  * These include authentication tokens, TLS certificates, IP restriction
  * settings, and database paths that should not be inherited by spawned
  * CLI tool processes.
+ *
+ * `CM_AUTH_TOKEN` — the **plaintext** bearer token — joined in Issue #1996. Only
+ * the `_HASH` form was listed, and the plaintext one is what a request is
+ * actually authenticated with: measured with a real child, `claude -p` and the
+ * version probes could read it back. It is expected in a server's environment
+ * (the CLI's own `--token` warning tells operators to prefer the variable, and
+ * §10.7 of the 設計方針書 has the agent's hooks read it "from process
+ * inheritance"), and `lib/slash-command-catalog`'s docblock already claimed a
+ * probe "never hands CommandMate's auth token … to a third-party CLI".
+ *
+ * Nothing that spawns with {@link sanitizeEnvForChildProcess} needs it: none of
+ * the five call sites configures hooks for its child. The **agent's** pane is
+ * unaffected — tmux inherits the server's environment directly and never goes
+ * through this function — so `$CM_AUTH_TOKEN` still expands in a hook.
  */
 exports.SENSITIVE_ENV_KEYS = [
     'CLAUDECODE',
+    'CM_AUTH_TOKEN', // Issue #1996: plaintext bearer token, not just its hash
     'CM_AUTH_TOKEN_HASH',
     'CM_AUTH_EXPIRE',
     'CM_HTTPS_KEY',
@@ -30,11 +152,61 @@ exports.SENSITIVE_ENV_KEYS = [
     'CM_DB_PATH',
     'GH_DEBUG', // Issue #545: Prevent gh debug output in child processes [SEC4-003]
 ];
+/**
+ * The namespace CommandMate writes onto an agent's launch line (Issue #1942).
+ *
+ * Kept alongside {@link AGENT_CORRELATION_ENV_KEYS} rather than replaced by it.
+ * Inside this namespace the prefix is still the stronger rule — a `CM_HOOK_*`
+ * variable invented next year is stripped whether or not anyone remembers this
+ * file exists, and `CM_HOOK_` is CommandMate's own namespace, so there is no
+ * operator value here to preserve. What #1996 measured is that the namespace is
+ * two of the launch line's six identity variables, not all of them; see the
+ * module comment.
+ */
+exports.COMMANDMATE_HOOK_ENV_PREFIX = 'CM_HOOK_';
+/**
+ * Every variable an agent's launch line uses to say **which server to report to
+ * and as which instance** (Issue #1996).
+ *
+ * The measured contents of `AgentLaunchPlan.env` across all seven sources, minus
+ * the per-tool config redirects. `lib/hooks/sources/launch-command` declares the
+ * same set as `AGENT_CORRELATION_ENV_VARS`; this is the second copy, and the two
+ * tests named in the module comment are the join. Sorted, so a diff against the
+ * measured set reads cleanly.
+ *
+ * Two of them are inside {@link COMMANDMATE_HOOK_ENV_PREFIX} and would be
+ * stripped anyway. They are listed regardless: this array is the statement of
+ * *what the rule is about*, and a reader who has to subtract a prefix to see the
+ * set is a reader who will get it wrong again.
+ */
+exports.AGENT_CORRELATION_ENV_KEYS = [
+    'CM_AGENT_INSTANCE_ID',
+    'CM_AGENT_TOOL',
+    'CM_AGENT_WORKTREE_ID',
+    'CM_HOOK_PORT',
+    'CM_HOOK_URL',
+    'CM_PERMISSION_HOOK_URL',
+];
+/**
+ * Whether `key` is removed from a child process's environment.
+ *
+ * @param key - An environment variable name
+ * @returns `true` for a listed secret, a launch-line identity variable, or
+ *   anything in CommandMate's hook namespace
+ */
+function isStrippedChildProcessEnvKey(key) {
+    return (exports.SENSITIVE_ENV_KEYS.includes(key) ||
+        exports.AGENT_CORRELATION_ENV_KEYS.includes(key) ||
+        key.startsWith(exports.COMMANDMATE_HOOK_ENV_PREFIX));
+}
 /**
  * Create a sanitized copy of process.env suitable for child processes.
  *
- * Removes all keys listed in SENSITIVE_ENV_KEYS from the environment.
- * Non-sensitive variables (PATH, HOME, NODE_ENV, etc.) are preserved.
+ * Removes every key {@link isStrippedChildProcessEnvKey} claims: the listed
+ * secrets (Issue #294/#545/#1996), the launch-line identity of the agent this
+ * process was started under (Issue #1996), and CommandMate's own `CM_HOOK_*`
+ * namespace (Issue #1942). Non-sensitive variables (PATH, HOME, NODE_ENV, etc.)
+ * are preserved, including the operator's own `CM_AGENT_HOOKS_*` switches.
  *
  * @returns A shallow copy of process.env with sensitive keys removed
  *
@@ -51,8 +223,10 @@ exports.SENSITIVE_ENV_KEYS = [
  */
 function sanitizeEnvForChildProcess() {
     const env = { ...process.env };
-    for (const key of exports.SENSITIVE_ENV_KEYS) {
-        delete env[key];
+    for (const key of Object.keys(env)) {
+        if (isStrippedChildProcessEnvKey(key)) {
+            delete env[key];
+        }
     }
     return env;
 }