commandmate 0.26.1 → 0.27.0

package/dist/server/src/lib/hooks/permission-decision-service.js

@@ -49,6 +49,8 @@ const agent_event_state_1 = require("../../lib/session/agent-event-state");
 const logger_1 = require("../../lib/logger");
 const ask_user_question_payload_1 = require("./ask-user-question-payload");
 const permission_request_payload_1 = require("./permission-request-payload");
+const registry_1 = require("./sources/registry");
+const tool_input_normalization_state_1 = require("./tool-input-normalization-state");
 const logger = (0, logger_1.createLogger)('lib/hooks/permission-decision-service');
 /**
  * How the pre-empted dialog would have been classified on screen.
@@ -105,7 +107,10 @@ function decidePermissionRequest(session, payload, deps = {}) {
         return NO_DECISION('auto-yes-disabled');
     }
     const policy = (deps.readPolicy ?? readContractPolicy)({ worktreeId, cliToolId, instanceId });
-    const denial = (0, auto_yes_resolver_1.evaluatePolicyAgainstTexts)(exports.PERMISSION_REQUEST_PROMPT_TYPE, (0, permission_request_payload_1.collectToolInputMatchTexts)(payload.toolName, payload.toolInput), policy);
+    const denial = (0, auto_yes_resolver_1.evaluatePolicyAgainstTexts)(exports.PERMISSION_REQUEST_PROMPT_TYPE, 
+    // Issue #1902: the third argument is what stops a normalised payload from
+    // being judged on its whole body. See `collectToolInputMatchTexts`.
+    (0, permission_request_payload_1.collectToolInputMatchTexts)(payload.toolName, payload.toolInput, payload.toolInputNormalization), policy);
     if (denial) {
         return {
             behavior: null,
@@ -137,7 +142,7 @@ function decidePermissionRequest(session, payload, deps = {}) {
  * Never throws — the verdict has already been decided and the agent is waiting.
  */
 function recordAllowedPermission(session, payload) {
-    const texts = (0, permission_request_payload_1.collectToolInputMatchTexts)(payload.toolName, payload.toolInput);
+    const texts = (0, permission_request_payload_1.collectToolInputMatchTexts)(payload.toolName, payload.toolInput, payload.toolInputNormalization);
     const target = texts.join('\n').slice(0, auto_yes_resolver_1.MAX_DENY_MATCH_TEXT_LENGTH);
     const now = new Date();
     try {
@@ -189,30 +194,82 @@ function recordAllowedPermission(session, payload) {
  */
 const NON_BLOCKING_PERMISSION_MODES = new Set(['bypassPermissions']);
 /**
- * Tell the detection layer that a dialog is about to be drawn (Issue #1725).
+ * Tell the detection layer that a dialog is about to be drawn (Issue #1725),
+ * but only on a source where that is true (Issue #1901).
  *
- * A no-decision means precisely this: D5 measured `{}` landing back in the
- * ordinary TUI approval flow, i.e. the dialog appears. That is ~6 seconds
- * before `Notification(permission_prompt)` announces the same dialog (§5.5), so
- * it is the earliest moment anything in this system can know a human is needed.
+ * On Claude a no-decision means precisely this: D5 measured `{}` landing back
+ * in the ordinary TUI approval flow, i.e. the dialog appears. That is ~6
+ * seconds before `Notification(permission_prompt)` announces the same dialog
+ * (§5.5), so it is the earliest moment anything in this system can know a human
+ * is needed.
  *
  * It is a prediction rather than an observation, and it is recorded as one:
  * `agent-event-state` expires a `permission-request` record that nothing
  * corroborates within 20 s. See STRUCTURED_PROMPT_PROVISIONAL_MAX_AGE_MS for
  * why the asymmetry with the notification source is deliberate.
  *
- * `AskUserQuestion` is included even though this Issue does not claim to detect
- * its screens: it also raises a `PermissionRequest`, and allowing it does not
- * dismiss the picker (§5.6), so a no-decision there is followed by a screen a
- * human must act on just the same. What is NOT claimed is that the state
- * survives — nothing about that screen produces events, so unless the scraper
- * corroborates it the record expires, which is the honest outcome for a screen
- * this layer cannot see. That screen belongs to #1708 / #1726.
+ * ## Why the source is asked first (Issue #1901)
+ *
+ * "Non-allow means a dialog is coming" is *Claude's* semantics, and #1725
+ * applied it to every tool that reached this module. copilot fires its
+ * `PreToolUse` on **every** tool call and executes most of them straight away
+ * — measured: `Read` followed by `PostToolUse` 0–1 s later, no dialog — so a
+ * forecast was filed for every `Read` / `Grep` / `Bash` of a build. Each one
+ * published `waiting / hook_permission_request` for up to
+ * STRUCTURED_PROMPT_PROVISIONAL_MAX_AGE_MS, which made `wait --on-prompt agent`
+ * exit 10 on a session nobody was blocking, refused `send` with
+ * `blockedBy: 'structured'`, and flashed a WS / push notification per tool call.
+ * antigravity is wired the same way.
+ *
+ * So the forecast is now conditioned on the source's declared
+ * {@link AgentSourceCapabilities.permissionHookPredictsDialog} (#1924, §4 D3
+ * decision 1; §6.2 names this function). Not a tool-id branch and not
+ * `supportedEvents`: the capability block is the whole vocabulary, exactly as
+ * `permission-adjudication` reads `permissionReplyReleasesPrompt` (#1898) and
+ * `sources/opencode/ingest` reads it for `permission.replied`.
+ *
+ * **What is given up, and why it is affordable.** On a source that declares
+ * `false`, whether a dialog is on the pane goes back to being the scraper's
+ * question alone. That premise was re-checked against the detection #1885 /
+ * #1886 landed rather than assumed: copilot draws an approval as a box over the
+ * bottom of the pane, which takes the status bar and the composer away, so
+ * `detectSessionStatus` answers `waiting` / `prompt_detected` /
+ * `hasActivePrompt: true` on the live frame
+ * (`tests/unit/lib/detection/fixtures/copilot-live-1885/permission-dialog.txt`).
+ * The cost is latency, not blindness: the scraper reads through a 5 s capture
+ * cache, so a real copilot dialog is reported up to a poll later than the
+ * forecast would have reported it. opencode gives up nothing at all — its
+ * approvals arrive as `notification(permission_prompt)` frames, which are
+ * observations and open the record through `recordAgentEvent` regardless.
+ *
+ * `AskUserQuestion` is included on a forecasting source even though this Issue
+ * does not claim to detect its screens: it also raises a `PermissionRequest`,
+ * and allowing it does not dismiss the picker (§5.6), so a no-decision there is
+ * followed by a screen a human must act on just the same. What is NOT claimed
+ * is that the state survives — nothing about that screen produces events, so
+ * unless the scraper corroborates it the record expires, which is the honest
+ * outcome for a screen this layer cannot see. That screen belongs to
+ * #1708 / #1726.
  */
 function reportPendingDialog(session, payload) {
     if (payload?.permissionMode && NON_BLOCKING_PERMISSION_MODES.has(payload.permissionMode)) {
         return;
     }
+    // The declared value, read through the registry rather than compared against
+    // a tool id. An unregistered tool answers from `sources/legacy-relay`, which
+    // declares `false` on purpose (#1924): forecasting a dialog for a permission
+    // hook nobody has measured would publish `waiting` for a prompt that may not
+    // exist.
+    if (!(0, registry_1.getAgentEventSource)(session.cliToolId).capabilities.permissionHookPredictsDialog) {
+        logger.debug('permission-request:dialog-forecast-skipped', {
+            worktreeId: session.worktreeId,
+            cliToolId: session.cliToolId,
+            instanceId: session.instanceId,
+            toolName: payload?.toolName ?? null,
+            reason: 'capability-permissionHookPredictsDialog-false',
+        });
+        return;
+    }
     (0, agent_event_state_1.reportPermissionRequestPending)(session.worktreeId, session.cliToolId, session.instanceId, payload?.toolName ?? null);
 }
 /**
@@ -226,6 +283,16 @@ function reportPendingDialog(session, payload) {
  */
 function resolvePermissionRequest(session, payload, deps = {}) {
     const decision = decidePermissionRequest(session, payload, deps);
+    // Issue #1902: before anything else, and regardless of the verdict. The
+    // adjudicated `tool_input` is not the one copilot sent, and the design
+    // policy's discoverability rule (§7) says a rewrite nobody can observe is a
+    // rewrite that should not happen. Recording it only on the allow path would
+    // hide it on exactly the path an operator investigates — a suppressed edit
+    // whose deny pattern was matched against the patch's action headers rather
+    // than its body.
+    if (payload?.toolInputNormalization) {
+        (0, tool_input_normalization_state_1.recordToolInputNormalization)(session.worktreeId, session.cliToolId, session.instanceId, payload.toolInputNormalization, payload.toolName);
+    }
     // Issue #1726: `AskUserQuestion` raises a `PermissionRequest` carrying the
     // same `tool_input` its `PreToolUse` does (§5.6), so the questions are
     // recorded from here too. Redundant on a session this server started — both

package/dist/server/src/lib/hooks/permission-decision-state.js

@@ -0,0 +1,62 @@
+"use strict";
+/**
+ * In-memory record of the last permission this server adjudicated *on the
+ * agent's behalf* (Issue #1898).
+ *
+ * Every hook tool is adjudicated inside the request it is blocked on, so the
+ * agent learns the verdict by getting an answer. opencode is adjudicated over a
+ * connection nobody is holding: CommandMate reads `permission.asked` off the
+ * SSE stream, decides, and POSTs the reply back. That is an automatic action
+ * taken while no human was looking, and the design policy's discoverability
+ * rule (§7 of `docs/design/multi-agent-state-architecture.md`) is that such an
+ * action which exists only in the server log does not exist — an operator has
+ * to be able to read *"Auto-Yes answered `once` and the dialog is gone"* out of
+ * the CLI.
+ *
+ * So the outcome is kept here per session and published by `buildCurrentOutput`
+ * as `structuredEvents.permissionDecision`, which is what `capture --json`
+ * prints verbatim and what `wait` polls.
+ *
+ * Exposure only, exactly like `./tool-input-normalization-state` (#1902):
+ * nothing reads this back to decide anything. Whether a dialog is open is
+ * `getStructuredPromptWaiting`'s answer, and it is reached through the event
+ * record rather than through this map.
+ *
+ * The `globalThis` indirection is load-bearing for the same reason it is
+ * everywhere else in this subsystem (#1736): the writer is the opencode ingest
+ * (or `/api/worktrees/:id/auto-yes`) and the reader is
+ * `/api/worktrees/:id/current-output`, which `next dev` bundles separately and
+ * would otherwise give a private copy of this map each.
+ *
+ * @module lib/hooks/permission-decision-state
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.recordPermissionDecision = recordPermissionDecision;
+exports.getLastPermissionDecision = getLastPermissionDecision;
+exports.clearPermissionDecisions = clearPermissionDecisions;
+const auto_yes_state_1 = require("../../lib/auto-yes-state");
+/** compositeKey -> the most recent adjudication for that session. */
+const lastDecisions = globalThis.__permissionDecisions ??
+    (globalThis.__permissionDecisions = new Map());
+/**
+ * Record how one approval was adjudicated.
+ *
+ * Recorded for every verdict, not only for allows — the operator's question is
+ * "why is this worker sitting on a dialog", and suppressing the record on the
+ * abstain path would remove the answer exactly when it is asked.
+ */
+function recordPermissionDecision(worktreeId, cliToolId, instanceId, record) {
+    lastDecisions.set((0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId), record);
+}
+/**
+ * @returns The last adjudication for this session, or null — the ordinary case
+ *   for every tool CommandMate does not adjudicate for, and for an opencode
+ *   session that has not asked for anything yet.
+ */
+function getLastPermissionDecision(worktreeId, cliToolId, instanceId) {
+    return lastDecisions.get((0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId)) ?? null;
+}
+/** Drop every recorded adjudication. Test seam. */
+function clearPermissionDecisions() {
+    lastDecisions.clear();
+}

package/dist/server/src/lib/hooks/permission-request-payload.js

@@ -25,6 +25,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.MAX_TOOL_NAME_LENGTH = exports.ASK_USER_QUESTION_TOOL = exports.PERMISSION_REQUEST_EVENT_NAME = void 0;
 exports.parsePermissionRequestPayload = parsePermissionRequestPayload;
 exports.collectToolInputMatchTexts = collectToolInputMatchTexts;
+const tool_input_normalization_1 = require("./tool-input-normalization");
 /** `hook_event_name` this receiver accepts. Anything else is not ours to judge. */
 exports.PERMISSION_REQUEST_EVENT_NAME = 'PermissionRequest';
 /**
@@ -122,9 +123,25 @@ const PRIMARY_TOOL_INPUT_KEYS = {
  *
  * @param toolName - `tool_name` from the payload
  * @param toolInput - `tool_input` from the payload
+ * @param normalization - Set when `toolInput` was rewritten from something that
+ *   was not an object (Issue #1902); null or omitted for a payload the agent
+ *   sent as an object, which is every tool but copilot's `Edit`
  * @returns Texts to match, never empty for a non-empty input
  */
-function collectToolInputMatchTexts(toolName, toolInput) {
+function collectToolInputMatchTexts(toolName, toolInput, normalization) {
+    if (normalization) {
+        const raw = toolInput[normalization.key];
+        if (typeof raw === 'string' && raw !== '') {
+            // The tool-name table cannot help here: the agent sent no named
+            // arguments at all, so the surface comes from the string itself.
+            return normalization.reason === 'string-tool-input-as-patch'
+                ? (0, tool_input_normalization_1.collectPatchMatchTexts)(raw)
+                : [raw];
+        }
+        // The record and the input disagree — something rewrote one without the
+        // other. Fall through to the whole-input fallback rather than trusting
+        // either: over-matching costs a dialog, under-matching costs the protection.
+    }
     const keys = PRIMARY_TOOL_INPUT_KEYS[toolName];
     if (keys) {
         const texts = keys

package/dist/server/src/lib/hooks/sources/antigravity/source.js

@@ -183,6 +183,16 @@ exports.antigravityAgentEventSource = (0, define_source_1.definePushHookSource)(
         // at 4s so that CommandMate rather than agy decides what a slow server
         // means. The number a caller budgeting a verdict needs is the outer one.
         decisionTimeoutSeconds: hooks_config_1.ANTIGRAVITY_PERMISSION_TIMEOUT_SECONDS,
+        // Issue #1924, §4 D3. agy registers a permission hook, but CommandMate is
+        // the adjudicator on it rather than a forecaster: the reply IS the decision
+        // (see the module comment on encodeVerdict), so a non-allow answer is not a
+        // prediction that agy will now ask a human.
+        permissionHookPredictsDialog: false,
+        // Not audited. Default = Claude's current behaviour.
+        sessionStartMayArriveLate: false,
+        permissionReplyReleasesPrompt: false,
+        eventIdentity: null,
+        resync: 'none',
     },
     // Empty on purpose, and the only empty mapper list in the codebase. There is
     // nothing in an agy payload to map *from*: no `hook_event_name`, no `type`,

package/dist/server/src/lib/hooks/sources/claude/source.js

@@ -100,6 +100,26 @@ exports.claudeAgentEventSource = (0, define_source_1.definePushHookSource)({
         supportedEvents: agent_event_types_1.AGENT_EVENT_TYPES,
         configScope: 'per-instance',
         decisionTimeoutSeconds: hook_settings_generator_1.PERMISSION_REQUEST_TIMEOUT_SECONDS,
+        // Issue #1924, the 6x5 table of §4 D3. Claude is the reference row: every
+        // "not audited" cell on another source is set to whatever Claude declares
+        // here, so that a source nobody has measured behaves the way the state
+        // machine already behaves today.
+        //
+        // `PermissionRequest` is registered and a non-allow answer on it really is
+        // the forecast that a dialog is coming — that is the behaviour #1725 built
+        // the provisional dialog record on.
+        permissionHookPredictsDialog: true,
+        // `SessionStart` leads the turn here; copilot is the tool where it does not.
+        sessionStartMayArriveLate: false,
+        // A hook response body releases nothing observable. The dialog is released
+        // by the screen, by `Stop`, or by expiry.
+        permissionReplyReleasesPrompt: false,
+        // `tool_use_id` is present on tool events but absent on `PermissionRequest`
+        // (D2), so there is no id that covers the frames dedup has to cover. The
+        // time window stays.
+        eventIdentity: null,
+        // push. There is no connection to lose and nothing to re-read.
+        resync: 'none',
     },
     // S1. A plain name table is enough *for this tool* — one native name, one
     // word, no predicates — so it is expressed as rules built from the table

package/dist/server/src/lib/hooks/sources/codex/source.js

@@ -100,6 +100,16 @@ exports.codexAgentEventSource = (0, define_source_1.definePushHookSource)({
         // is 600 s; the receiver decides from in-memory state, so the budget it
         // needs is small and the failure it bounds is a wedged server.
         decisionTimeoutSeconds: 5,
+        // Issue #1924, §4 D3. codex registers the same `PermissionRequest` handler
+        // Claude does and its payload is Claude-shaped field for field, so the
+        // forecast reading carries over with it.
+        permissionHookPredictsDialog: true,
+        // Not audited (#1891 measured opencode and copilot). Default = Claude's
+        // current behaviour, which is what the state machine does today.
+        sessionStartMayArriveLate: false,
+        permissionReplyReleasesPrompt: false,
+        eventIdentity: null,
+        resync: 'none',
     },
     // Same CamelCase dialect as Claude and copilot (#1757 §8.1). The table is
     // shared, the choice to use it is this source's.