commandmate 0.29.1 → 0.29.2

package/dist/config/system-directories.js

@@ -0,0 +1,211 @@
+"use strict";
+/**
+ * System Directories Configuration
+ * Issue #135: DB path resolution logic fix
+ * Issue #1285: Path boundary matching and symlink resolution
+ *
+ * Centralized list of system directories that are not allowed for DB storage.
+ * This supports security measures SEC-001, SEC-002, SEC-005.
+ *
+ * @module system-directories
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VIRTUAL_FILESYSTEM_ROOTS = exports.SYSTEM_DIRECTORIES = void 0;
+exports.isPathWithin = isPathWithin;
+exports.isSystemDirectory = isSystemDirectory;
+exports.isVirtualFilesystemPath = isVirtualFilesystemPath;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+/**
+ * System directories that are not allowed for DB storage
+ *
+ * SEC-001: System directory protection
+ * These directories are protected to prevent writing database files
+ * to critical system paths which could cause security issues.
+ */
+exports.SYSTEM_DIRECTORIES = [
+    '/etc',
+    '/usr',
+    '/bin',
+    '/sbin',
+    '/var',
+    '/tmp',
+    '/dev',
+    '/sys',
+    '/proc',
+];
+/**
+ * The subset of {@link SYSTEM_DIRECTORIES} that is not a filesystem at all.
+ *
+ * Issue #1774: these three are kernel-backed namespaces, and their `mkdir`
+ * error codes are not the ones `fs` callers assume. procfs answers a `mkdir`
+ * for a child that cannot exist with **ENOENT rather than EPERM**, and Node's
+ * recursive mkdir reads ENOENT as "the parent is missing", so it creates the
+ * parent and retries — forever. Measured in a container: `mkdirSync('/proc/x/y',
+ * {recursive:true})` had not returned after 25s at 100.4% CPU; the promise from
+ * `fs.promises.mkdir` never settled and held a libuv threadpool thread (4 by
+ * default) for the life of the process. Neither logs anything, and the
+ * synchronous form stops the event loop, so a surrounding `try/catch` is never
+ * reached. On macOS the paths do not exist and the call throws at once, which
+ * is why this is invisible outside Linux and containers.
+ *
+ * Kept as a named subset rather than reusing the whole list because the two
+ * lists answer different questions. {@link isSystemDirectory} answers "may a
+ * database live here", and rejects `/tmp` and `/var` for that; but `/tmp` and
+ * `/var/log` are ordinary writable directories that a log or hook directory may
+ * legitimately be pointed at — `os.tmpdir()` is *inside* one on both platforms
+ * (`/tmp` on Linux, `/var/folders/…` on macOS), which is where every isolated
+ * test directory in this repository lives. Rejecting those would not prevent a
+ * hang; it would redirect isolated test runs and container deployments back
+ * onto the real `~/.codex` and `~/.commandmate`.
+ *
+ * `SYSTEM_DIRECTORIES` remains the superset — `tests/unit/config/system-directories.test.ts`
+ * pins that, so the two cannot drift apart.
+ */
+exports.VIRTUAL_FILESYSTEM_ROOTS = ['/proc', '/sys', '/dev'];
+/**
+ * POSIX separator. SYSTEM_DIRECTORIES are POSIX absolute paths and this guard
+ * protects POSIX platforms, so the boundary is always '/' rather than path.sep.
+ */
+const POSIX_SEP = '/';
+/**
+ * Check whether `target` is `dir` itself or lives underneath it.
+ *
+ * Issue #1285: A bare startsWith() has no path boundary, so '/tmp' matched
+ * '/tmpfoo' and '/var' matched '/variance'. Requiring an exact match or a
+ * separator after the prefix keeps unrelated siblings out of the match.
+ *
+ * @param target - Absolute path to test
+ * @param dir - Absolute directory path to test against
+ * @returns true if target is dir or is contained in dir
+ */
+function isPathWithin(target, dir) {
+    const normalizedDir = dir.endsWith(POSIX_SEP) ? dir.slice(0, -1) : dir;
+    return target === normalizedDir || target.startsWith(normalizedDir + POSIX_SEP);
+}
+/**
+ * SYSTEM_DIRECTORIES plus their physical locations.
+ *
+ * Issue #1285: On macOS '/tmp', '/var' and '/etc' are symlinks into '/private'.
+ * A resolved path such as '/private/tmp/x.db' therefore never matches the
+ * literal '/tmp' entry. Both sides of the comparison must be resolved, so the
+ * literal and physical forms are both kept as match candidates.
+ *
+ * Mount layout does not change while the process runs, so this is computed once.
+ */
+const resolvedDirectoryCandidatesCache = new Map();
+function getDirectoryCandidates(directories) {
+    const cached = resolvedDirectoryCandidatesCache.get(directories);
+    if (cached !== undefined) {
+        return cached;
+    }
+    const candidates = new Set();
+    for (const dir of directories) {
+        // Always keep the literal form: it must stay enforced even when the
+        // directory does not exist on this platform (e.g. /proc and /sys on macOS).
+        candidates.add(dir);
+        try {
+            candidates.add(fs_1.default.realpathSync(dir));
+        }
+        catch {
+            // Not present on this platform; the literal form still applies.
+        }
+    }
+    const resolved = Array.from(candidates);
+    resolvedDirectoryCandidatesCache.set(directories, resolved);
+    return resolved;
+}
+/**
+ * Resolve symlinks in an absolute path, tolerating components that do not exist.
+ *
+ * Issue #1285: fs.realpathSync() throws on a missing path, but a DB file is
+ * validated *before* it is created, so "does not exist" is the normal case.
+ * The nearest existing ancestor is resolved and the remaining (not yet created)
+ * components are re-appended, which yields the physical location the path would
+ * occupy. Because the input is already lexically resolved it contains no '..',
+ * so the re-appended tail cannot escape the resolved ancestor.
+ *
+ * @param absolutePath - A lexically resolved absolute path
+ * @returns The physical path, or the input unchanged if nothing could be resolved
+ */
+function resolvePhysicalPath(absolutePath) {
+    const pendingComponents = [];
+    let current = absolutePath;
+    for (;;) {
+        try {
+            const real = fs_1.default.realpathSync(current);
+            return pendingComponents.length > 0
+                ? path_1.default.join(real, ...pendingComponents)
+                : real;
+        }
+        catch {
+            const parent = path_1.default.dirname(current);
+            if (parent === current) {
+                // Reached the root without resolving anything.
+                return absolutePath;
+            }
+            pendingComponents.unshift(path_1.default.basename(current));
+            current = parent;
+        }
+    }
+}
+/**
+ * Check if a path is within a system directory
+ *
+ * Issue #1285: Resolution happens here rather than at each call site. The check
+ * is only correct when the candidate path *and* the system directory list are
+ * resolved consistently; resolving at a call site and comparing against the
+ * unresolved literals silently defeats the guard (that is what made the SEC-002
+ * call site in db-migration-path.ts miss '/tmp'). Centralizing keeps every
+ * caller correct by construction.
+ *
+ * The literal and physical forms are both matched, so a path is rejected if
+ * either form lands in a system directory. This fails closed: a symlink placed
+ * inside a system directory that points elsewhere is still rejected.
+ *
+ * This performs filesystem I/O and is therefore not a pure function.
+ *
+ * @param inputPath - The absolute path to check (relative paths are resolved against cwd)
+ * @returns true if the path is within a system directory
+ */
+function isSystemDirectory(inputPath) {
+    return matchesAnyDirectory(inputPath, exports.SYSTEM_DIRECTORIES);
+}
+/**
+ * Check if a path is inside a virtual filesystem ({@link VIRTUAL_FILESYSTEM_ROOTS}).
+ *
+ * Issue #1774: the question `isSystemDirectory` cannot answer for a directory
+ * that is about to be created. A recursive `mkdir` under one of these roots does
+ * not fail — it hangs the process, unrecoverably and without a log line — so
+ * every path that reaches a `mkdir(…, {recursive:true})` has to be filtered
+ * through this first. See {@link VIRTUAL_FILESYSTEM_ROOTS} for the measurements
+ * and for why this is a subset of `SYSTEM_DIRECTORIES` rather than all of it.
+ *
+ * Matching is the same as `isSystemDirectory`: lexical *and* physical form, so a
+ * symlink that points into `/proc` is rejected along with a literal `/proc/…`.
+ * That is the direction that matters — a missed one hangs the server.
+ *
+ * Reads the filesystem (symlink resolution); it never creates anything, and
+ * `realpath` on a procfs path returns ENOENT immediately rather than spinning.
+ *
+ * @param inputPath - The path to check (relative paths are resolved against cwd)
+ * @returns true if a recursive mkdir for this path could spin
+ */
+function isVirtualFilesystemPath(inputPath) {
+    return matchesAnyDirectory(inputPath, exports.VIRTUAL_FILESYSTEM_ROOTS);
+}
+/**
+ * Shared matcher for {@link isSystemDirectory} and {@link isVirtualFilesystemPath}.
+ *
+ * @param inputPath - The path to check
+ * @param directories - Absolute directory prefixes to test against
+ * @returns true if either the lexical or the physical form lands in one of them
+ */
+function matchesAnyDirectory(inputPath, directories) {
+    const lexicalPath = path_1.default.resolve(inputPath);
+    const physicalPath = resolvePhysicalPath(lexicalPath);
+    return getDirectoryCandidates(directories).some((dir) => isPathWithin(lexicalPath, dir) || isPathWithin(physicalPath, dir));
+}

package/dist/lib/cli-tools/types.d.ts

@@ -1,7 +1,7 @@
 /**
  * Type definitions and interfaces for CLI tools
  */
-import type { CaptureSpec, ComposerSpec, GracefulExitSpec, NavigationKeySpec } from '../../types/cli-tool-contracts';
+import type { CaptureSpec, ComposerSpec, GracefulExitSpec, NavigationKeySpec, ToolLivenessSpec } from '../../types/cli-tool-contracts';
 /**
  * CLI Tool IDs constant array
  * T2.1: Single source of truth for CLI tool IDs
@@ -220,6 +220,20 @@ export interface ICLITool {
      * (Issue #1933, §10.12).
      */
     captureSpec(): CaptureSpec;
+    /**
+     * Describe how this tool's pane is read for "did the TOOL exit?"
+     * (Issue #2070).
+     *
+     * A tmux session outlives the process it was created for whenever the agent
+     * quits, updates itself or crashes, and `has-session` cannot tell the
+     * difference. Until this Issue only claude could — through one
+     * `cliToolId === 'claude'` branch in `worktree-status-helper` — so a codex
+     * session that had fallen back to the shell kept a green dot and failed every
+     * subsequent `send` in `waitForPrompt`.
+     *
+     * See {@link ToolLivenessSpec} for the rule the declaration fills in.
+     */
+    livenessSpec(): ToolLivenessSpec;
     /**
      * Declare the keys this tool's terminal UI may send (Issue #2046).
      *

package/dist/lib/cli-tools/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/lib/cli-tools/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,gCAAgC,CAAC;AAExC;;;;GAIG;AACH,eAAO,MAAM,YAAY,4FAA6F,CAAC;AAEvH;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;AAuBtD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,WAAW,GAAG,OAAO,CAEnE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,WAAW,EACtB,sBAAsB,EAAE,OAAO,GAC9B,OAAO,CAET;AAMD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;GAEG;AACH,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,QAAqB,CAAC;AAEtD,yCAAyC;AACzC,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC;;;;;;;;;;GAUG;AACH,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,EAAE,EAAE,MAAM,CAAC;IACX,sCAAsC;IACtC,OAAO,EAAE,WAAW,CAAC;IACrB,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,EAAE,IAAI,MAAM,CAK1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAEjE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAE/F;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,MAAM,CAGpF;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC;IAEzB,iBAAiB;IACjB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,mBAAmB;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB;;;OAGG;IACH,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAEhC;;;;;OAKG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAErE;;;;;OAKG;IACH,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3F;;;;;OAKG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErF;;;;OAIG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpE;;;;;OAKG;IACH,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAEhE;;;;OAIG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElE;;;;;;;;OAQG;IACH,gBAAgB,IAAI,YAAY,CAAC;IAEjC;;;;;OAKG;IACH,oBAAoB,IAAI,gBAAgB,CAAC;IAEzC;;;OAGG;IACH,WAAW,IAAI,WAAW,CAAC;IAE3B;;;;;;;;OAQG;IACH,cAAc,IAAI,iBAAiB,CAAC;CACrC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAQ9D,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,WAAW,CAEjE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,WAAW,GAAG,MAAM,CAE7D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,SAAc,GAAG,MAAM,CAI5F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE;IAAE,OAAO,EAAE,WAAW,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAM3F;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,aAAa,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,WAAW,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,EAC9E,gBAAgB,EAAE,MAAM,EACxB,eAAe,EAAE,WAAW,GAC3B,MAAM,CAGR;AAED;;;;;;;;;GASG;AACH,wBAAgB,gCAAgC,CAAC,cAAc,EAAE,WAAW,EAAE,GAAG,aAAa,EAAE,CAO/F;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,MAAM,CAAC;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,UAAU,CAAC;AAErD;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAO7E;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,QAAmC,CAAC;AAErE;;;;GAIG;AACH,MAAM,WAAW,oBAAqB,SAAQ,QAAQ;IACpD,6CAA6C;IAC7C,aAAa,IAAI,IAAI,CAAC;IACtB;;;;;;OAMG;IACH,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClH;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,IAAI,oBAAoB,CAIlF;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,eAAe;IACf,EAAE,EAAE,WAAW,CAAC;IAChB,UAAU;IACV,IAAI,EAAE,MAAM,CAAC;IACb,YAAY;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB;IAChB,SAAS,EAAE,OAAO,CAAC;CACpB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/lib/cli-tools/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,gCAAgC,CAAC;AAExC;;;;GAIG;AACH,eAAO,MAAM,YAAY,4FAA6F,CAAC;AAEvH;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;AAuBtD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,WAAW,GAAG,OAAO,CAEnE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,yBAAyB,CACvC,SAAS,EAAE,WAAW,EACtB,sBAAsB,EAAE,OAAO,GAC9B,OAAO,CAET;AAMD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;GAEG;AACH,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,QAAqB,CAAC;AAEtD,yCAAyC;AACzC,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC;;;;;;;;;;GAUG;AACH,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,EAAE,EAAE,MAAM,CAAC;IACX,sCAAsC;IACtC,OAAO,EAAE,WAAW,CAAC;IACrB,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,EAAE,IAAI,MAAM,CAK1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAEjE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAE/F;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,MAAM,CAGpF;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC;IAEzB,iBAAiB;IACjB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,mBAAmB;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB;;;OAGG;IACH,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAEhC;;;;;OAKG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAErE;;;;;OAKG;IACH,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3F;;;;;OAKG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErF;;;;OAIG;IACH,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpE;;;;;OAKG;IACH,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAEhE;;;;OAIG;IACH,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElE;;;;;;;;OAQG;IACH,gBAAgB,IAAI,YAAY,CAAC;IAEjC;;;;;OAKG;IACH,oBAAoB,IAAI,gBAAgB,CAAC;IAEzC;;;OAGG;IACH,WAAW,IAAI,WAAW,CAAC;IAE3B;;;;;;;;;;;;OAYG;IACH,YAAY,IAAI,gBAAgB,CAAC;IAEjC;;;;;;;;OAQG;IACH,cAAc,IAAI,iBAAiB,CAAC;CACrC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAQ9D,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,WAAW,CAEjE;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,WAAW,GAAG,MAAM,CAE7D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,SAAc,GAAG,MAAM,CAI5F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE;IAAE,OAAO,EAAE,WAAW,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAM3F;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,aAAa,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,WAAW,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,EAC9E,gBAAgB,EAAE,MAAM,EACxB,eAAe,EAAE,WAAW,GAC3B,MAAM,CAGR;AAED;;;;;;;;;GASG;AACH,wBAAgB,gCAAgC,CAAC,cAAc,EAAE,WAAW,EAAE,GAAG,aAAa,EAAE,CAO/F;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,MAAM,CAAC;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,UAAU,CAAC;AAErD;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAO7E;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,QAAmC,CAAC;AAErE;;;;GAIG;AACH,MAAM,WAAW,oBAAqB,SAAQ,QAAQ;IACpD,6CAA6C;IAC7C,aAAa,IAAI,IAAI,CAAC;IACtB;;;;;;OAMG;IACH,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClH;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,IAAI,oBAAoB,CAIlF;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,eAAe;IACf,EAAE,EAAE,WAAW,CAAC;IAChB,UAAU;IACV,IAAI,EAAE,MAAM,CAAC;IACb,YAAY;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB;IAChB,SAAS,EAAE,OAAO,CAAC;CACpB"}

package/dist/lib/detection/status-reason.d.ts

@@ -0,0 +1,92 @@
+/**
+ * The reason vocabulary a status verdict can carry.
+ *
+ * Split out of `status-detector.ts` by Issue #1927 for a mechanical reason: the
+ * facade now imports the per-tool detectors, and every tool module needs these
+ * constants, so leaving them in the facade made the graph
+ * `status-detector -> tools/* -> status-detector` — a cycle that resolves to
+ * `undefined` at module-evaluation time rather than to a value. A leaf module
+ * with no imports of its own cannot participate in one.
+ *
+ * Re-exported from `status-detector.ts`, which is where every existing importer
+ * reads it from.
+ */
+/**
+ * Reason string constants for StatusDetectionResult.reason.
+ * Shared between status-detector.ts and current-output/route.ts to prevent typos (DR2-003).
+ */
+export declare const STATUS_REASON: {
+    readonly PROMPT_DETECTED: "prompt_detected";
+    readonly THINKING_INDICATOR: "thinking_indicator";
+    readonly OPENCODE_PROCESSING_INDICATOR: "opencode_processing_indicator";
+    readonly OPENCODE_SELECTION_LIST: "opencode_selection_list";
+    /**
+     * Issue #2112: a background-painted rectangle with an `esc` hatch was drawn
+     * over the transcript — opencode's session list, agent list, timeline,
+     * command palette or picker.
+     *
+     * Distinct from {@link STATUS_REASON.OPENCODE_SELECTION_LIST} because the two
+     * are different READINGS of the same screen: that one is the allowlisted
+     * heading (`Select model` / `Select provider` / `Connect a provider`, #1896)
+     * found as text and survives ANSI stripping; this one is the layout and needs
+     * the SGR the capture was taken with. An operator reading `capture --json`
+     * can tell which one answered, which is the difference between "the heading is
+     * one we know" and "something modal is on the pane".
+     *
+     * The literal is restated from `OPENCODE_MODAL_OVERLAY_ID`
+     * (`lib/detection/opencode-modal-overlay.ts`) rather than imported, so this
+     * module keeps the no-imports property its docblock above depends on;
+     * `tests/unit/detection-opencode-modal-overlay-2112.test.ts` pins the two
+     * equal so the restatement cannot drift.
+     */
+    readonly OPENCODE_MODAL_OVERLAY: "opencode_modal_overlay";
+    /** Issue #1893: opencode's permission dialog — an arrow-key button strip. */
+    readonly OPENCODE_PERMISSION_PROMPT: "opencode_permission_prompt";
+    readonly CLAUDE_SELECTION_LIST: "claude_selection_list";
+    readonly COPILOT_SELECTION_LIST: "copilot_selection_list";
+    readonly CODEX_SELECTION_LIST: "codex_selection_list";
+    /** Issue #1017: Codex pager / edit-previous (transcript) mode. */
+    readonly CODEX_PAGER: "codex_pager";
+    /** Issue #1829: Codex's hooks review screens, which only `t`/`esc` leave. */
+    readonly CODEX_HOOKS_REVIEW: "codex_hooks_review";
+    readonly ANTIGRAVITY_SELECTION_LIST: "antigravity_selection_list";
+    readonly OPENCODE_RESPONSE_COMPLETE: "opencode_response_complete";
+    readonly INPUT_PROMPT: "input_prompt";
+    readonly NO_RECENT_OUTPUT: "no_recent_output";
+    /**
+     * Issue #2070: the tmux session is there, and the TOOL is not.
+     *
+     * Published by `worktree-status-helper` when the liveness probe reads a bare
+     * shell prompt at the bottom of a pane whose agent quit, updated itself or
+     * crashed (`judgeToolLiveness`). It is the ONE reason on this list that
+     * accompanies `isRunning: false` — every other one describes a frame a live
+     * agent drew — which is exactly why it is worth a token of its own: without
+     * it the sidebar and `commandmate ls` render such a session as plain `idle`,
+     * indistinguishable from one that was never started, and the operator has no
+     * way to tell "start it" from "it died under you".
+     *
+     * ADDITIVE, in the strict sense: no existing reason's value or meaning
+     * changes, and no surface that does not know the token behaves differently —
+     * a reader that does not recognise it sees the same `idle` it saw before.
+     */
+    readonly EXITED: "exited";
+    /**
+     * A tool's own detector looked at this frame and recognised nothing
+     * (Issue #1927, §6.1).
+     *
+     * Distinct from {@link STATUS_REASON.DEFAULT} on purpose, and the distinction
+     * is operational rather than cosmetic. `default` is the generic floor: no
+     * pattern matched anywhere, including the shared composer check, so nothing
+     * in particular is missing. `unknown_frame` is what a tool that OPTS OUT of
+     * the shared composer check reports — copilot and opencode, whose own rules
+     * are the only rules that run for them. Seeing it means "this tool's measured
+     * rules could not read this frame", which names an action: capture the frame
+     * and add it to that tool's fixtures.
+     *
+     * Both are `running` on the wire with `evidence: 'none'`, so a consumer that
+     * does not care about the difference sees no change.
+     */
+    readonly UNKNOWN_FRAME: "unknown_frame";
+    readonly DEFAULT: "default";
+};
+//# sourceMappingURL=status-reason.d.ts.map

package/dist/lib/detection/status-reason.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status-reason.d.ts","sourceRoot":"","sources":["../../../src/lib/detection/status-reason.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;GAGG;AACH,eAAO,MAAM,aAAa;;;;;IAKxB;;;;;;;;;;;;;;;;;;OAkBG;;IAEH,6EAA6E;;;;;IAK7E,kEAAkE;;IAElE,6EAA6E;;;;;;IAM7E;;;;;;;;;;;;;;;OAeG;;IAEH;;;;;;;;;;;;;;;OAeG;;;CAGK,CAAC"}

package/dist/lib/detection/status-reason.js

@@ -0,0 +1,94 @@
+"use strict";
+/**
+ * The reason vocabulary a status verdict can carry.
+ *
+ * Split out of `status-detector.ts` by Issue #1927 for a mechanical reason: the
+ * facade now imports the per-tool detectors, and every tool module needs these
+ * constants, so leaving them in the facade made the graph
+ * `status-detector -> tools/* -> status-detector` — a cycle that resolves to
+ * `undefined` at module-evaluation time rather than to a value. A leaf module
+ * with no imports of its own cannot participate in one.
+ *
+ * Re-exported from `status-detector.ts`, which is where every existing importer
+ * reads it from.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STATUS_REASON = void 0;
+/**
+ * Reason string constants for StatusDetectionResult.reason.
+ * Shared between status-detector.ts and current-output/route.ts to prevent typos (DR2-003).
+ */
+exports.STATUS_REASON = {
+    PROMPT_DETECTED: 'prompt_detected',
+    THINKING_INDICATOR: 'thinking_indicator',
+    OPENCODE_PROCESSING_INDICATOR: 'opencode_processing_indicator',
+    OPENCODE_SELECTION_LIST: 'opencode_selection_list',
+    /**
+     * Issue #2112: a background-painted rectangle with an `esc` hatch was drawn
+     * over the transcript — opencode's session list, agent list, timeline,
+     * command palette or picker.
+     *
+     * Distinct from {@link STATUS_REASON.OPENCODE_SELECTION_LIST} because the two
+     * are different READINGS of the same screen: that one is the allowlisted
+     * heading (`Select model` / `Select provider` / `Connect a provider`, #1896)
+     * found as text and survives ANSI stripping; this one is the layout and needs
+     * the SGR the capture was taken with. An operator reading `capture --json`
+     * can tell which one answered, which is the difference between "the heading is
+     * one we know" and "something modal is on the pane".
+     *
+     * The literal is restated from `OPENCODE_MODAL_OVERLAY_ID`
+     * (`lib/detection/opencode-modal-overlay.ts`) rather than imported, so this
+     * module keeps the no-imports property its docblock above depends on;
+     * `tests/unit/detection-opencode-modal-overlay-2112.test.ts` pins the two
+     * equal so the restatement cannot drift.
+     */
+    OPENCODE_MODAL_OVERLAY: 'opencode_modal_overlay',
+    /** Issue #1893: opencode's permission dialog — an arrow-key button strip. */
+    OPENCODE_PERMISSION_PROMPT: 'opencode_permission_prompt',
+    CLAUDE_SELECTION_LIST: 'claude_selection_list',
+    COPILOT_SELECTION_LIST: 'copilot_selection_list',
+    CODEX_SELECTION_LIST: 'codex_selection_list',
+    /** Issue #1017: Codex pager / edit-previous (transcript) mode. */
+    CODEX_PAGER: 'codex_pager',
+    /** Issue #1829: Codex's hooks review screens, which only `t`/`esc` leave. */
+    CODEX_HOOKS_REVIEW: 'codex_hooks_review',
+    ANTIGRAVITY_SELECTION_LIST: 'antigravity_selection_list',
+    OPENCODE_RESPONSE_COMPLETE: 'opencode_response_complete',
+    INPUT_PROMPT: 'input_prompt',
+    NO_RECENT_OUTPUT: 'no_recent_output',
+    /**
+     * Issue #2070: the tmux session is there, and the TOOL is not.
+     *
+     * Published by `worktree-status-helper` when the liveness probe reads a bare
+     * shell prompt at the bottom of a pane whose agent quit, updated itself or
+     * crashed (`judgeToolLiveness`). It is the ONE reason on this list that
+     * accompanies `isRunning: false` — every other one describes a frame a live
+     * agent drew — which is exactly why it is worth a token of its own: without
+     * it the sidebar and `commandmate ls` render such a session as plain `idle`,
+     * indistinguishable from one that was never started, and the operator has no
+     * way to tell "start it" from "it died under you".
+     *
+     * ADDITIVE, in the strict sense: no existing reason's value or meaning
+     * changes, and no surface that does not know the token behaves differently —
+     * a reader that does not recognise it sees the same `idle` it saw before.
+     */
+    EXITED: 'exited',
+    /**
+     * A tool's own detector looked at this frame and recognised nothing
+     * (Issue #1927, §6.1).
+     *
+     * Distinct from {@link STATUS_REASON.DEFAULT} on purpose, and the distinction
+     * is operational rather than cosmetic. `default` is the generic floor: no
+     * pattern matched anywhere, including the shared composer check, so nothing
+     * in particular is missing. `unknown_frame` is what a tool that OPTS OUT of
+     * the shared composer check reports — copilot and opencode, whose own rules
+     * are the only rules that run for them. Seeing it means "this tool's measured
+     * rules could not read this frame", which names an action: capture the frame
+     * and add it to that tool's fixtures.
+     *
+     * Both are `running` on the wire with `evidence: 'none'`, so a consumer that
+     * does not care about the difference sees no change.
+     */
+    UNKNOWN_FRAME: 'unknown_frame',
+    DEFAULT: 'default',
+};