commandmate 0.26.1 → 0.27.0

package/dist/server/src/lib/hooks/sources/define-source.js

@@ -86,6 +86,13 @@ function definePushHookSource(spec) {
                 extractModel: spec.extractModel,
             });
         },
+        eventIdentityOf(payload) {
+            // Issue #1899. Absent by default, because a push tool whose capability
+            // says `eventIdentity: null` has nothing to read — and answering null is
+            // what puts it on the time window `isDuplicateAgentEvent` has always
+            // applied to it.
+            return spec.extractEventIdentity?.(payload) ?? null;
+        },
         parsePermissionRequest: spec.parsePermissionRequest,
         parseQuestion: spec.parseQuestion,
         encodeVerdict(verdict) {
@@ -100,7 +107,15 @@ function definePushHookSource(spec) {
         async decide(target, decision, verdict) {
             // C2: the verdict leaves through the body of the request the agent is
             // blocked on, which the receiver is holding open in a slot.
-            (0, pending_decisions_1.fillDecisionSlot)(target, decision.id, spec.encodeVerdict(verdict));
+            const filled = (0, pending_decisions_1.fillDecisionSlot)(target, decision.id, spec.encodeVerdict(verdict));
+            // Issue #1898: for a push source "delivered" and "the slot was still
+            // open" are the same fact — the body has nowhere else to go. Reported so
+            // callers of `answerPendingDecisionWithReceipt` get the same shape of
+            // answer from both transports.
+            (0, pending_decisions_1.recordDecisionDelivery)(target, decision.id, {
+                delivered: filled,
+                reason: filled ? 'response-body' : 'slot-closed',
+            });
         },
         async listPending(target) {
             return (0, pending_decisions_1.listOpenDecisions)(target);
@@ -157,6 +172,13 @@ function definePullEventSource(spec) {
                 extractModel: spec.extractModel,
             });
         },
+        eventIdentityOf(payload) {
+            // Issue #1899. See the push factory's copy — the difference is that a
+            // pull source is the one that actually declares an `eventIdentity`, so
+            // omitting the extractor here would leave the capability announcing an id
+            // nothing can read.
+            return spec.extractEventIdentity?.(payload) ?? null;
+        },
         parsePermissionRequest: spec.parsePermissionRequest,
         parseQuestion: spec.parseQuestion,
         encodeVerdict() {

package/dist/server/src/lib/hooks/sources/event-mapper.js

@@ -23,7 +23,7 @@
  * @module lib/hooks/sources/event-mapper
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MAX_UNKNOWN_EVENT_NAMES = void 0;
+exports.MAX_EVENT_IDENTITY_LENGTH = exports.MAX_UNKNOWN_EVENT_NAMES = void 0;
 exports.whenNamed = whenNamed;
 exports.fromNameTable = fromNameTable;
 exports.runEventMappers = runEventMappers;
@@ -34,6 +34,7 @@ exports.readStringField = readStringField;
 exports.readFirstStringField = readFirstStringField;
 exports.boundDetail = boundDetail;
 exports.boundModel = boundModel;
+exports.readEventIdentity = readEventIdentity;
 exports.isPlainObject = isPlainObject;
 exports.readNestedString = readNestedString;
 exports.buildNormalizedEvent = buildNormalizedEvent;
@@ -133,6 +134,33 @@ function boundModel(value) {
         return null;
     return value.slice(0, agent_event_types_1.MAX_EVENT_DETAIL_LENGTH);
 }
+/** Longest frame id accepted as a de-duplication key (Issue #1899). */
+exports.MAX_EVENT_IDENTITY_LENGTH = 128;
+/**
+ * Characters a frame id may contain.
+ *
+ * Every id the six sources publish is an opaque token in this alphabet —
+ * opencode's `per_…` / `que_…` / `msg_…` / `toolu_…`, Claude's `toolu_…`. The
+ * allowlist is not about display (nothing renders these); it is about what
+ * becomes a key in a long-lived server-side map.
+ */
+const EVENT_IDENTITY_PATTERN = /^[A-Za-z0-9._:-]+$/;
+/**
+ * A frame id fit to be a de-duplication key, or null (Issue #1899, §10 DR4-001).
+ *
+ * **Discarded, never truncated**, and that is the whole difference from
+ * {@link boundDetail}. A detail is prose that is shown to a human, so cutting
+ * it long is better than losing it. An identity is compared for equality: a
+ * truncated id would collide with every other id sharing its prefix, which
+ * turns an over-long value into a way of making unrelated frames look like
+ * repeats of each other. Answering null instead puts the frame back on the
+ * time window, which is where it was before this Issue.
+ */
+function readEventIdentity(value) {
+    if (value === null || value.length > exports.MAX_EVENT_IDENTITY_LENGTH)
+        return null;
+    return EVENT_IDENTITY_PATTERN.test(value) ? value : null;
+}
 /** Type guard for a JSON object (not an array, not null). */
 function isPlainObject(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);

package/dist/server/src/lib/hooks/sources/gemini/source.js

@@ -122,6 +122,16 @@ exports.geminiAgentEventSource = (0, define_source_1.definePushHookSource)({
         configScope: 'per-worktree',
         // No gemini event waits on a verdict from CommandMate. See the module comment.
         decisionTimeoutSeconds: 0,
+        // Issue #1924, §4 D3. The one source that registers no permission hook at
+        // all: `../gemini/settings-generator` never writes one, so `PreToolUse` is
+        // mapped and never registered and `reportPendingDialog` is unreachable for
+        // this tool. There is no non-allow answer to read a forecast out of.
+        permissionHookPredictsDialog: false,
+        // Not audited. Default = Claude's current behaviour.
+        sessionStartMayArriveLate: false,
+        permissionReplyReleasesPrompt: false,
+        eventIdentity: null,
+        resync: 'none',
     },
     // gemini's own table, kept in gemini's own module: four of the seven are
     // spelled differently, and merging them into the shared CamelCase table would

package/dist/server/src/lib/hooks/sources/index.js

@@ -12,7 +12,7 @@
  * @module lib/hooks/sources
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OPENCODE_CLI_TOOL_ID = exports.CODEX_CLI_TOOL_ID = exports.ANTIGRAVITY_CLI_TOOL_ID = exports.GEMINI_CLI_TOOL_ID = exports.COPILOT_CLI_TOOL_ID = exports.CLAUDE_CLI_TOOL_ID = exports.isAbstainSafe = exports.describeNoDecision = exports.describeAbstain = exports.resetPendingDecisions = exports.openDecisionSlot = exports.listOpenDecisions = exports.closeDecisionSlot = exports.answerPendingDecision = exports.TOOL_CALL_ID_FIELDS = exports.SESSION_ID_FIELDS = exports.extractSnakeCaseEventDetail = exports.CAMEL_CASE_HOOK_EVENT_NAMES = exports.whenNamed = exports.runEventMappers = exports.resetUnknownEventTallies = exports.readStringField = exports.readNestedString = exports.readFirstStringField = exports.isPlainObject = exports.getUnknownEventTally = exports.fromNameTable = exports.boundDetail = exports.renderAgentLaunchCommand = exports.AGENT_EVENT_URL_ENV_VAR = exports.definePushHookSource = exports.definePullEventSource = exports.unregisterAgentEventSource = exports.registerAgentEventSource = exports.listAgentEventSources = exports.hasAgentEventSource = exports.getAgentEventSource = void 0;
+exports.OPENCODE_CLI_TOOL_ID = exports.CODEX_CLI_TOOL_ID = exports.ANTIGRAVITY_CLI_TOOL_ID = exports.GEMINI_CLI_TOOL_ID = exports.COPILOT_CLI_TOOL_ID = exports.CLAUDE_CLI_TOOL_ID = exports.isAbstainSafe = exports.describeNoDecision = exports.describeAbstain = exports.resetPendingDecisions = exports.openDecisionSlot = exports.listOpenDecisions = exports.closeDecisionSlot = exports.answerPendingDecision = exports.TOOL_CALL_ID_FIELDS = exports.SESSION_ID_FIELDS = exports.extractSnakeCaseEventDetail = exports.CAMEL_CASE_HOOK_EVENT_NAMES = exports.whenNamed = exports.runEventMappers = exports.resetUnknownEventTallies = exports.readStringField = exports.readNestedString = exports.readFirstStringField = exports.isPlainObject = exports.getUnknownEventTally = exports.fromNameTable = exports.boundDetail = exports.renderAgentLaunchCommand = exports.HOOK_PORT_ENV_VAR = exports.COMMANDMATE_HOOK_ENV_VARS = exports.AGENT_EVENT_URL_ENV_VAR = exports.definePushHookSource = exports.definePullEventSource = exports.unregisterAgentEventSource = exports.registerAgentEventSource = exports.listAgentEventSources = exports.hasAgentEventSource = exports.getAgentEventSource = void 0;
 var registry_1 = require("./registry");
 Object.defineProperty(exports, "getAgentEventSource", { enumerable: true, get: function () { return registry_1.getAgentEventSource; } });
 Object.defineProperty(exports, "hasAgentEventSource", { enumerable: true, get: function () { return registry_1.hasAgentEventSource; } });
@@ -24,6 +24,8 @@ Object.defineProperty(exports, "definePullEventSource", { enumerable: true, get:
 Object.defineProperty(exports, "definePushHookSource", { enumerable: true, get: function () { return define_source_1.definePushHookSource; } });
 var launch_command_1 = require("./launch-command");
 Object.defineProperty(exports, "AGENT_EVENT_URL_ENV_VAR", { enumerable: true, get: function () { return launch_command_1.AGENT_EVENT_URL_ENV_VAR; } });
+Object.defineProperty(exports, "COMMANDMATE_HOOK_ENV_VARS", { enumerable: true, get: function () { return launch_command_1.COMMANDMATE_HOOK_ENV_VARS; } });
+Object.defineProperty(exports, "HOOK_PORT_ENV_VAR", { enumerable: true, get: function () { return launch_command_1.HOOK_PORT_ENV_VAR; } });
 Object.defineProperty(exports, "renderAgentLaunchCommand", { enumerable: true, get: function () { return launch_command_1.renderAgentLaunchCommand; } });
 var event_mapper_1 = require("./event-mapper");
 Object.defineProperty(exports, "boundDetail", { enumerable: true, get: function () { return event_mapper_1.boundDetail; } });

package/dist/server/src/lib/hooks/sources/launch-command.js

@@ -28,7 +28,7 @@
  * @module lib/hooks/sources/launch-command
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AGENT_EVENT_URL_ENV_VAR = void 0;
+exports.AGENT_LAUNCH_CONFIG_ENV_VARS = exports.AGENT_CORRELATION_ENV_VARS = exports.COMMANDMATE_HOOK_ENV_VARS = exports.HOOK_PORT_ENV_VAR = exports.AGENT_EVENT_URL_ENV_VAR = void 0;
 exports.renderAgentLaunchCommand = renderAgentLaunchCommand;
 const hook_settings_generator_1 = require("../../../lib/hooks/hook-settings-generator");
 /**
@@ -41,6 +41,101 @@ const hook_settings_generator_1 = require("../../../lib/hooks/hook-settings-gene
  * primary instance.
  */
 exports.AGENT_EVENT_URL_ENV_VAR = 'CM_HOOK_URL';
+/**
+ * The port CommandMate's own server is listening on, read by a hook when it
+ * fires rather than baked into the file it was configured from (Issue #1904,
+ * 設計方針書 §10.8).
+ *
+ * Only copilot needs it today, and only because its configuration is one file
+ * for the whole machine: a port fixed at write time makes every copilot session
+ * on the machine post to whichever server started last. It is deliberately
+ * *just the port*. Scheme, host and the relay script's path stay literals in
+ * the generated command, because those are what decide **where** a hook's
+ * bearer token goes and **which program runs**; moving them into the
+ * environment would delegate both to whoever can set a variable.
+ *
+ * Consumers must reject a value that is not a run of digits and not fire at
+ * all — never fall back to a default port. See §10.8 決定 1 and 3.
+ */
+exports.HOOK_PORT_ENV_VAR = 'CM_HOOK_PORT';
+/**
+ * The `CM_HOOK_*` variables CommandMate sets on a launch line.
+ *
+ * Enumerated so the launch-line pin (受入条件 S8) has one list to check rather
+ * than a grep. A name that is here and not on the launch line is a hook reading
+ * a value CommandMate never wrote.
+ *
+ * **This is a subset, not the launch line.** Issue #1942 read this list as
+ * "the correlation variables", which it is not and has never been: the
+ * measurement in `tests/unit/lib/agent-launch-plan-secrets-1933.test.ts` finds
+ * six identity variables across the seven sources and only these two are in
+ * CommandMate's `CM_HOOK_` namespace. The whole set is
+ * {@link AGENT_CORRELATION_ENV_VARS}, and that is the list a caller asking
+ * "what identifies this agent?" wants.
+ *
+ * What this list is still for is the namespace invariant: **every entry must
+ * start with `CM_HOOK_`** (Issue #1942), because that prefix is what
+ * `lib/security/env-sanitizer` strips without needing to know the name. A
+ * `CM_HOOK_*` variable invented next year is covered by the prefix alone; one
+ * invented outside it has to be added to {@link AGENT_CORRELATION_ENV_VARS} and
+ * to the sanitizer's own copy, and the drift guard named below is what says so.
+ */
+exports.COMMANDMATE_HOOK_ENV_VARS = [
+    exports.AGENT_EVENT_URL_ENV_VAR,
+    exports.HOOK_PORT_ENV_VAR,
+];
+/**
+ * Every variable an `AgentLaunchPlan.env` uses to say **which server this agent
+ * reports to and as which instance** (Issue #1996).
+ *
+ * The four beyond {@link COMMANDMATE_HOOK_ENV_VARS} are spelled as literals here
+ * rather than imported from the sources that write them (`codex/hooks-config`,
+ * `copilot/hook-settings`, `antigravity/hooks-config`) because a plan is data,
+ * not a schema: this module renders `plan.env`, it does not know how any source
+ * built it. Importing three source modules to collect four strings would give
+ * `launch-command` a dependency on every tool it renders for, which is the
+ * coupling `AgentLaunchPlan` exists to avoid.
+ *
+ * What binds the literals to reality is a measurement, not the type system.
+ * `tests/unit/lib/agent-launch-plan-secrets-1933.test.ts` builds all seven
+ * plans and asserts their env keys are exactly this list plus
+ * {@link AGENT_LAUNCH_CONFIG_ENV_VARS}. A source that adds a variable, drops
+ * one, or renames one turns that test red and names it.
+ *
+ * `lib/security/env-sanitizer` keeps its own copy as
+ * `AGENT_CORRELATION_ENV_KEYS` and strips all of them. The two are joined by a
+ * test rather than an import, for the reason that file's module comment gives.
+ * Sorted, so a set diff reads cleanly.
+ */
+exports.AGENT_CORRELATION_ENV_VARS = [
+    'CM_AGENT_INSTANCE_ID',
+    'CM_AGENT_TOOL',
+    'CM_AGENT_WORKTREE_ID',
+    exports.HOOK_PORT_ENV_VAR,
+    exports.AGENT_EVENT_URL_ENV_VAR,
+    'CM_PERMISSION_HOOK_URL',
+];
+/**
+ * The other thing a launch line carries: where a tool reads its own settings.
+ *
+ * A per-tool HOME/config redirect, set by a source so the agent resolves the
+ * same settings file CommandMate just wrote — codex's `CODEX_HOME` is the whole
+ * of it today. Deliberately **not** stripped from CommandMate's child
+ * processes: a redirect is neither a credential nor an identity, and a child
+ * that inherits one is unaffected.
+ *
+ * **One name, measured, not three.** #1933's test carried a local allowlist of
+ * `CODEX_HOME` / `COPILOT_HOME` / `XDG_CONFIG_HOME`; building the seven plans
+ * shows only the first is ever written. `COPILOT_HOME` and `XDG_CONFIG_HOME` are
+ * *read* from the ambient environment by `copilot/hook-settings` and the
+ * antigravity config writer to decide where a file goes — they never reach
+ * `plan.env`. An allowlist wide enough to admit them would wave through a source
+ * that started setting one, which is the opposite of what this list is for.
+ *
+ * Enumerated for the same reason as the list above: so the drift guard can
+ * subtract it and hold the remainder to an exact set.
+ */
+exports.AGENT_LAUNCH_CONFIG_ENV_VARS = ['CODEX_HOME'];
 /**
  * Turn a plan into the line a shell can run.
  *

package/dist/server/src/lib/hooks/sources/legacy-relay.js

@@ -55,6 +55,18 @@ function createLegacyRelaySource(cliToolId) {
             supportedEvents: [],
             configScope: 'none',
             decisionTimeoutSeconds: null,
+            // Issue #1924. Same reasoning as `supportedEvents` above: nothing has been
+            // measured for this tool through this path, so every capability answers
+            // the value that makes the state machine do what it does today for a tool
+            // it knows nothing about. `permissionHookPredictsDialog: false` in
+            // particular is deliberately NOT Claude's `true` — forecasting a dialog
+            // for a tool whose permission hook nobody has seen would publish
+            // `waiting` for a prompt that may not exist.
+            permissionHookPredictsDialog: false,
+            sessionStartMayArriveLate: false,
+            permissionReplyReleasesPrompt: false,
+            eventIdentity: null,
+            resync: 'none',
         },
         mappers: (0, event_mapper_1.fromNameTable)(hook_event_vocabulary_1.CAMEL_CASE_HOOK_EVENT_NAMES),
         nativeEventNameFields: ['hook_event_name'],