commandmate 0.29.1 → 0.30.0

package/dist/server/src/lib/git/worktrees.js

@@ -16,6 +16,8 @@ exports.scanMultipleRepositories = scanMultipleRepositories;
 exports.deriveIdIgnoringOwnHistory = deriveIdIgnoringOwnHistory;
 exports.syncWorktreesToDB = syncWorktreesToDB;
 exports.repositoryExistsOnDisk = repositoryExistsOnDisk;
+exports.directoryIsConfirmedAbsent = directoryIsConfirmedAbsent;
+exports.reclaimGhostRepositories = reclaimGhostRepositories;
 exports.pruneStaleRepositoryWorktrees = pruneStaleRepositoryWorktrees;
 const child_process_1 = require("child_process");
 const util_1 = require("util");
@@ -24,6 +26,7 @@ const path_1 = __importDefault(require("path"));
 const worktree_id_1 = require("./worktree-id");
 const db_1 = require("../../lib/db");
 const logger_1 = require("../../lib/logger");
+const agents_config_1 = require("../../lib/repo-config/agents-config");
 const logger = (0, logger_1.createLogger)('worktrees');
 /**
  * ID minting lives in `worktree-id.ts` — a module that imports nothing but
@@ -178,6 +181,27 @@ function getRepositoryPaths() {
  */
 async function scanWorktrees(rootDir) {
     const execAsync = (0, util_1.promisify)(child_process_1.exec);
+    // Issue #2165: a repository whose directory has been removed used to reach
+    // `execAsync` with a `cwd` that no longer exists, and Node reports that as
+    // `spawn /bin/sh ENOENT` — an error about the *shell*, not about the missing
+    // directory. It is neither `not a git repository` nor exit 128, so the catch
+    // below re-threw it and `scanMultipleRepositories` logged it at ERROR. Two
+    // costs: a wasted child process per repository per scan, and a permanent
+    // ERROR line whose text sends the reader after `/bin/sh` and `PATH` (that
+    // misdiagnosis actually happened — see the Issue).
+    //
+    // Deliberately {@link directoryIsConfirmedAbsent} rather than
+    // `fs.existsSync`: only a positively-confirmed absence is allowed to skip the
+    // scan. An unreadable or unreachable path (EACCES, EIO, a hung network mount)
+    // still goes to git, still fails, and is still reported at ERROR — that IS a
+    // real failure and must not be silently downgraded to "the directory is gone".
+    //
+    // A directory that exists but is no longer a git repository is untouched by
+    // this guard: it keeps taking the git exit-128 path below and returns [].
+    if (directoryIsConfirmedAbsent(rootDir)) {
+        logger.warn('repository:scan-skipped-missing-dir', { repoPath: rootDir });
+        return [];
+    }
     try {
         const { stdout } = await execAsync('git worktree list', {
             cwd: rootDir,
@@ -186,6 +210,15 @@ async function scanWorktrees(rootDir) {
         // Get repository name from path
         const repositoryPath = path_1.default.resolve(rootDir);
         const repositoryName = path_1.default.basename(repositoryPath);
+        // Issue #2066: this is the "read it at sync" the repository-level agent
+        // declaration is specified against. Doing it here rather than lazily in
+        // `getWorktrees()` is what keeps the file off the sidebar's polled path
+        // (#1913's no-filesystem-probe-on-a-hot-path rule), and it is also what
+        // makes a broken `.commandmate/agents.yaml` warn once per sync instead of
+        // once per poll — the refusal is cached alongside an accepted value.
+        // Deliberately after the `git worktree list` above succeeded: a directory
+        // that is not a repository has no declaration worth reading.
+        (0, agents_config_1.refreshRepoAgentsConfig)(repositoryPath);
         // Filter and validate worktree paths
         return parsed
             .map((wt) => {
@@ -469,6 +502,137 @@ function repositoryExistsOnDisk(repoPath) {
         return true;
     }
 }
+/**
+ * Whether a path is **positively confirmed** not to exist.
+ *
+ * Issue #2165. `fs.existsSync()` cannot answer this: it collapses "the entry is
+ * not there" and "I could not find out" into the same `false`. It is
+ * `accessSync(F_OK)` underneath, so an unreadable parent directory (EACCES), a
+ * hung or disconnected network mount (EIO / ETIMEDOUT / ESTALE / EHOSTDOWN) and
+ * a genuinely deleted directory are indistinguishable through it. That
+ * distinction is the whole safety question for {@link reclaimGhostRepositories}:
+ * a repository on an unreachable volume must never be treated as gone.
+ *
+ * `lstatSync` keeps the errno, so the answer can be narrowed to the two codes
+ * that mean the kernel walked the path successfully and the entry was not
+ * there:
+ *
+ * - `ENOENT` — a component of the path does not exist;
+ * - `ENOTDIR` — a component that must be a directory is a file, so no such
+ *   entry can exist under it either.
+ *
+ * Every other outcome — the path resolved, or the lookup failed for any other
+ * reason — answers `false`, i.e. "not confirmed absent, leave it alone".
+ * `lstat` rather than `stat` so a dangling symlink is reported as present: the
+ * link is a real entry that the user still has to remove.
+ *
+ * @param repoPath - Absolute path to test
+ * @returns `true` only when the path is confirmed to be absent
+ */
+function directoryIsConfirmedAbsent(repoPath) {
+    if (!repoPath)
+        return false;
+    try {
+        fs_1.default.lstatSync(repoPath);
+        return false;
+    }
+    catch (error) {
+        const code = error.code;
+        return code === 'ENOENT' || code === 'ENOTDIR';
+    }
+}
+/**
+ * Take ghost `repositories` rows out of the scan set (Issue #2165).
+ *
+ * A row whose directory has been deleted stays `enabled = 1` forever: nothing
+ * removes it, so every server start and every sync re-derives the scan set from
+ * it, spawns a shell into a `cwd` that does not exist and logs an ERROR. Rows
+ * registered under `/tmp` were still doing this seven months after the
+ * directory they name was collected by the OS.
+ *
+ * {@link pruneStaleRepositoryWorktrees} cannot reach them. It deletes *worktree*
+ * rows, and it iterates {@link getRepositories}, which is a `GROUP BY` over the
+ * `worktrees` table — a repository with no worktree rows is not in its result
+ * at all, and its `ids.length === 0` early-continue would skip it even if it
+ * were. This function is the missing half: it works the `repositories` table.
+ *
+ * ## What it does — demote, not delete
+ *
+ * The row is set to `enabled = 0`, exactly as the Repositories screen's Scan
+ * toggle does (#1658). It is NOT deleted. `enabled` is the flag that decides
+ * what gets scanned, so demotion is sufficient — the row leaves `allPaths` at
+ * the next startup and sync, and the ERROR stops for good. Choosing it over
+ * `deleteRepository()` buys three things:
+ *
+ * 1. **Reversibility.** No filesystem test can prove a directory is gone
+ *    *forever* — an unmounted volume looks exactly like a deleted one from
+ *    userspace. A demoted row keeps its id, display name, `visible` flag and
+ *    clone URL, is listed on the Repositories screen with a Disabled badge, and
+ *    is one click from coming back. A wrong delete is unrecoverable.
+ * 2. **Agreement with #1666.** That Issue settled that exclusion is where the
+ *    app *stops*, not where it deletes; startup used to purge excluded
+ *    repositories and that was the bug. Reclaiming by deletion would re-open
+ *    the same argument from the other end.
+ * 3. **No dangling references.** `clone_jobs.repository_id` points at this row.
+ *
+ * ## The line — what is NOT reclaimed
+ *
+ * Every guard fails toward keeping the row enabled:
+ *
+ * - **Already disabled** — nothing to fix; it is out of the scan set already,
+ *   and touching it would rewrite state the user owns.
+ * - **Still listed in `WORKTREE_REPOS`** — the environment is a live
+ *   declaration that the operator wants this path scanned. Same reasoning as
+ *   migration v43's guard 2 (#1339): never overrule a path the env still asks
+ *   for. Such a path is re-registered on every boot anyway.
+ * - **Not confirmed absent** — see {@link directoryIsConfirmedAbsent}. This is
+ *   the "temporarily invisible" line: a repository under an unreachable network
+ *   mount answers EIO / ETIMEDOUT / ESTALE / EACCES, not ENOENT, and is kept.
+ * - **Owns worktree rows** — the condition the Issue names, and the one that
+ *   makes this provably lossless. Chat history, memos, todos, timers,
+ *   schedules, tasks and verification runs all hang off `worktrees`, so a
+ *   repository with zero worktree rows has no history to lose by definition.
+ *   It is also good evidence that the directory was never successfully scanned:
+ *   a scan of a present repository always yields at least its main worktree.
+ *
+ * @param db - Database instance
+ * @param envRepositoryPaths - Paths the environment still declares
+ *   (`getRepositoryPaths()`); rows at these paths are never demoted
+ * @returns The rows that were demoted, in `getAllRepositories` order
+ */
+function reclaimGhostRepositories(db, envRepositoryPaths = []) {
+    const envPaths = new Set(envRepositoryPaths.filter(p => !!p).map(p => path_1.default.resolve(p)));
+    const reclaimed = [];
+    for (const repo of (0, db_1.getAllRepositories)(db)) {
+        if (!repo.path)
+            continue;
+        if (!repo.enabled)
+            continue;
+        if (envPaths.has(repo.path))
+            continue;
+        if (!directoryIsConfirmedAbsent(repo.path))
+            continue;
+        if ((0, db_1.countWorktreesByRepositoryPath)(db, repo.path) > 0)
+            continue;
+        try {
+            (0, db_1.setRepositoryEnabled)(db, repo.id, false);
+        }
+        catch (error) {
+            // SEC-SF-004's disabled-row ceiling is the only expected failure. It
+            // guards against unbounded *growth* of the table, which this pass cannot
+            // cause — it creates no rows — so a refusal here just means one ghost
+            // keeps logging. Report it and move on rather than aborting startup.
+            logger.warn('repository:ghost-row-reclaim-failed', {
+                repoPath: repo.path,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            continue;
+        }
+        reclaimed.push({ id: repo.id, path: repo.path });
+        logger.info('repository:ghost-row-reclaimed', { repoPath: repo.path });
+    }
+    return reclaimed;
+}
 /**
  * Prune DB worktree rows for repositories that have vanished from disk.
  *

package/dist/server/src/lib/history/transcript-tail.js

@@ -0,0 +1,80 @@
+"use strict";
+/**
+ * Reading the end of an agent's own transcript file (Issue #2197).
+ *
+ * The second half of the pull-mode reader that is the same whatever the agent
+ * is, alongside `./user-turn-recorder`: every one of them keeps a file that
+ * grows for the life of a session, and every one of them only ever needs its
+ * newest turn.
+ *
+ * The shape is `lib/hooks/sources/claude/history`'s, which #2121 wrote inline
+ * because it was the only reader. It is here rather than there because #2197
+ * added the second and #2198 adds the third, and three private copies of "read
+ * the last 4 MiB and drop the partial first line" is how the bound and the
+ * partial-line rule quietly stop agreeing with each other.
+ *
+ * @module lib/history/transcript-tail
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TRANSCRIPT_TAIL_BYTES = void 0;
+exports.readTranscriptTail = readTranscriptTail;
+const promises_1 = require("fs/promises");
+const logger_1 = require("../../lib/logger");
+const logger = (0, logger_1.createLogger)('lib/history/transcript-tail');
+/**
+ * How much of a transcript's tail is read.
+ *
+ * These files grow for the life of a session and a long one is tens of
+ * megabytes — the largest claude transcript on this machine was 23 MB on
+ * 2026-08-31, and the largest codex rollout was **273 MB** on 2026-09-01 — so
+ * reading one whole on every finished turn would be the most expensive thing the
+ * poller does. Only the newest turn is ever written, so only the newest turn has
+ * to be in the window.
+ *
+ * 4 MiB is roughly two orders of magnitude above the measured size of a single
+ * turn and still small enough to read and parse in one tick. A turn that
+ * genuinely does not fit produces a turn with no prompt in it, which each reader
+ * detects and reports rather than writing as a headless reply.
+ */
+exports.TRANSCRIPT_TAIL_BYTES = 4 * 1024 * 1024;
+/**
+ * The last {@link TRANSCRIPT_TAIL_BYTES} of a file, as UTF-8.
+ *
+ * Read at an offset rather than whole, and the first line of a windowed read is
+ * dropped: starting mid-line would hand the caller's parser a fragment that it
+ * would count as malformed anyway, and dropping it deliberately keeps that
+ * counter meaning "the writer was mid-append", which is the thing worth seeing.
+ *
+ * Never throws.
+ *
+ * @param path - An absolute path the caller has already validated
+ * @returns The text, or null when the file could not be read
+ */
+async function readTranscriptTail(path) {
+    let handle;
+    try {
+        handle = await (0, promises_1.open)(path, 'r');
+        const { size } = await handle.stat();
+        const offset = Math.max(0, size - exports.TRANSCRIPT_TAIL_BYTES);
+        const length = size - offset;
+        if (length <= 0)
+            return '';
+        const buffer = Buffer.alloc(length);
+        const { bytesRead } = await handle.read(buffer, 0, length, offset);
+        const text = buffer.subarray(0, bytesRead).toString('utf8');
+        if (offset === 0)
+            return text;
+        const firstBreak = text.indexOf('\n');
+        return firstBreak === -1 ? '' : text.slice(firstBreak + 1);
+    }
+    catch (error) {
+        logger.warn('transcript-tail-read-failed', {
+            path,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return null;
+    }
+    finally {
+        await handle?.close().catch(() => { });
+    }
+}

package/dist/server/src/lib/history/user-turn-recorder.js

@@ -0,0 +1,247 @@
+"use strict";
+/**
+ * Putting the operator's own input into conversation history (Issue #2196).
+ *
+ * ## The gap this closes
+ *
+ * `chat_messages` has had exactly one producer of `role: 'user'` rows —
+ * `sendUserMessage`, which `/send` and the Timer go through. Everything else the
+ * operator can type reaches the agent without passing that function: `tmux
+ * attach` and a keyboard, `UnsentComposerBar`'s Run (which sends Enter through
+ * `/special-keys` and nothing else), a script calling `tmux send-keys`. The
+ * agent answers all of them, the poller saves the answer, and
+ * `groupMessagesIntoPairs` has a reply with no prompt in front of it — the
+ * `orphan` pair. That is not a rendering problem: History genuinely does not
+ * know what was asked.
+ *
+ * The agents do know, because each of them keeps its own record of the
+ * conversation. This module is the half of the fix that is the same whatever
+ * that record looks like: given "instance X was prompted with this text at this
+ * moment, and here is a stable name for that prompt", make History hold exactly
+ * one user row for it. `lib/hooks/sources/claude/history` supplies those four
+ * things from Claude's transcript JSONL; #2197 and #2198 will supply them from
+ * codex's and antigravity's own records. Nothing below mentions a tool.
+ *
+ * ## Three outcomes, and why the middle one exists
+ *
+ * 1. **The key is already on a row** — nothing happens. The callers are pollers,
+ *    so being asked to record the same prompt again is the normal case rather
+ *    than an error.
+ * 2. **An unkeyed row already holds this text** — that row is *claimed*, not
+ *    duplicated. This is the `/send` case, and it is the whole reason the
+ *    recorder is not simply an insert: `sendUserMessage` wrote the operator's
+ *    message the instant it was sent, and the agent then recorded the same text
+ *    in its own log a moment later. Two records of one keystroke. Inserting
+ *    would show the operator their own message twice, which is a worse defect
+ *    than the orphan pair this Issue set out to remove — so the pre-existing row
+ *    wins and merely gains the key, and every later call recognises it through
+ *    outcome 1.
+ * 3. **Neither** — insert, and broadcast so an open History pane sees it without
+ *    a reload.
+ *
+ * ## Nothing here throws
+ *
+ * The same contract as the transcript readers that call it, for a sharper
+ * reason: this runs inside the poller's save path, immediately before the
+ * *assistant* row is written. An exception escaping would cost the reply as
+ * well as the prompt, so a failure to record the prompt is reported in the
+ * return value and in the log, and the caller carries on.
+ *
+ * The database imports are dynamic, so that `better-sqlite3` does not enter the
+ * module graph of everything that imports `@/lib/hooks/sources`.
+ *
+ * @module lib/history/user-turn-recorder
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.USER_TURN_ADOPTION_WINDOW_MS = void 0;
+exports.normalizeUserTurnContent = normalizeUserTurnContent;
+exports.recordUserTurn = recordUserTurn;
+const logger_1 = require("../../lib/logger");
+const logger = (0, logger_1.createLogger)('lib/history/user-turn-recorder');
+/**
+ * How far from the agent's own clock a `/send` row may sit and still be the
+ * same keystroke.
+ *
+ * Two minutes, and it is a tolerance rather than a guess at a latency. The two
+ * timestamps being compared are written by different clocks for different
+ * events: `sendUserMessage` stamps the row when CommandMate hands the text to
+ * the pane, and the agent stamps its own record when it accepts the prompt.
+ * Between them sit the composer, a `waitForPrompt`, a folder-trust dialog, a
+ * queued prompt waiting for the previous turn to finish, and — for a prompt
+ * typed while the agent was busy — however long that turn took to end.
+ *
+ * Erring wide is the cheap direction. Too wide costs a mis-adoption only if the
+ * *same instance* was sent the *byte-identical* text twice inside four minutes,
+ * in which case the two rows are interchangeable anyway. Too narrow costs a
+ * duplicate row on every `/send` the agent was slow to accept, which is visible
+ * to the operator on every single turn.
+ */
+exports.USER_TURN_ADOPTION_WINDOW_MS = 120_000;
+/**
+ * The form two pieces of text are compared in.
+ *
+ * Trailing whitespace per line, `\r\n`, and blank lines at either end are the
+ * three differences that a round trip through a TUI composer actually
+ * introduces, so they are the three this ignores. Nothing else is touched — in
+ * particular interior blank lines are significant, because a prompt whose
+ * paragraph breaks were collapsed is not the same prompt.
+ */
+function normalizeUserTurnContent(content) {
+    return content
+        .replace(/\r\n?/g, '\n')
+        .split('\n')
+        .map((line) => line.replace(/[ \t　]+$/u, ''))
+        .join('\n')
+        .trim();
+}
+/** How far the recorder's log calls identify the instance. */
+function describe(target) {
+    return {
+        worktreeId: target.worktreeId,
+        cliToolId: target.cliToolId,
+        instanceId: target.instanceId ?? target.cliToolId,
+    };
+}
+/**
+ * Make History hold exactly one `user` row for one prompt.
+ *
+ * Never throws.
+ *
+ * @param target - The instance that was prompted
+ * @param key - A stable name for this prompt, unique per (worktree, prompt).
+ *   Written to `chat_messages.request_id`, which is what makes a second call
+ *   with the same key a no-op. Callers derive it from the agent's own id for the
+ *   prompt — see `claudePromptRequestId` — so that it survives a restart, a
+ *   re-read of the log and a `/clear`.
+ * @param content - The prompt, as the agent recorded it
+ * @param timestampMs - When the agent says it was prompted, epoch ms
+ */
+async function recordUserTurn(target, key, content, timestampMs) {
+    const instanceId = target.instanceId ?? target.cliToolId;
+    const normalized = normalizeUserTurnContent(content);
+    if (key.length === 0 || normalized.length === 0) {
+        return { outcome: 'skipped', messageId: null, timestampMs: null };
+    }
+    try {
+        const [{ getDbInstance }, chatDb, { broadcastMessage }] = await Promise.all([
+            Promise.resolve().then(() => __importStar(require('../../lib/db/db-instance'))),
+            Promise.resolve().then(() => __importStar(require('../../lib/db/chat-db'))),
+            Promise.resolve().then(() => __importStar(require('../../lib/ws-server'))),
+        ]);
+        const db = getDbInstance();
+        const existing = chatDb.findMessageByRequestId(db, target.worktreeId, key);
+        if (existing) {
+            return {
+                outcome: 'already-recorded',
+                messageId: existing.id,
+                timestampMs: existing.timestamp.getTime(),
+            };
+        }
+        const at = timestampMs > 0 ? timestampMs : Date.now();
+        const adopted = adoptExistingRow(chatDb, db, target, instanceId, key, normalized, at);
+        if (adopted)
+            return adopted;
+        const message = chatDb.createMessage(db, {
+            worktreeId: target.worktreeId,
+            role: 'user',
+            content,
+            messageType: 'normal',
+            timestamp: new Date(at),
+            cliToolId: target.cliToolId,
+            instanceId,
+            requestId: key,
+        });
+        broadcastMessage('message', { worktreeId: target.worktreeId, message });
+        logger.info('user-turn-recorded', {
+            ...describe(target),
+            requestId: key,
+            contentLength: content.length,
+        });
+        return { outcome: 'inserted', messageId: message.id, timestampMs: at };
+    }
+    catch (error) {
+        logger.error('user-turn-record-failed', {
+            ...describe(target),
+            requestId: key,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return { outcome: 'failed', messageId: null, timestampMs: null };
+    }
+}
+/**
+ * Claim the `/send` row for this prompt, if there is one.
+ *
+ * The candidates come back newest first and are compared on normalised content;
+ * the one nearest the agent's clock wins, which only matters when the operator
+ * sent the same text twice inside the window and is the right tie-break then
+ * too.
+ *
+ * The claim itself can lose — `setMessageRequestId` refuses a row that acquired
+ * a key between the read and the write. Losing means some other producer got
+ * there first, so the next candidate is tried and, if none is left, the caller
+ * falls through to the insert. It cannot loop: each attempt either claims a row
+ * or removes it from contention.
+ *
+ * @returns The claimed row, or null when nothing here belongs to this prompt
+ */
+function adoptExistingRow(chatDb, db, target, instanceId, key, normalized, at) {
+    const candidates = chatDb
+        .findUnkeyedUserMessages(db, {
+        worktreeId: target.worktreeId,
+        cliToolId: target.cliToolId,
+        instanceId,
+        fromMs: at - exports.USER_TURN_ADOPTION_WINDOW_MS,
+        toMs: at + exports.USER_TURN_ADOPTION_WINDOW_MS,
+    })
+        .filter((row) => normalizeUserTurnContent(row.content) === normalized)
+        .sort((a, b) => Math.abs(a.timestamp.getTime() - at) - Math.abs(b.timestamp.getTime() - at));
+    for (const candidate of candidates) {
+        if (!chatDb.setMessageRequestId(db, candidate.id, key))
+            continue;
+        logger.info('user-turn-adopted', {
+            ...describe(target),
+            requestId: key,
+            messageId: candidate.id,
+            driftMs: candidate.timestamp.getTime() - at,
+        });
+        return {
+            outcome: 'adopted',
+            messageId: candidate.id,
+            timestampMs: candidate.timestamp.getTime(),
+        };
+    }
+    return null;
+}

package/dist/server/src/lib/hooks/permission-decision-service.js

@@ -35,6 +35,39 @@
  *
  * @module lib/hooks/permission-decision-service
  */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PERMISSION_DECISION_SLOW_MS = exports.PERMISSION_REQUEST_PROMPT_TYPE = void 0;
 exports.decidePermissionRequest = decidePermissionRequest;
@@ -145,8 +178,9 @@ function recordAllowedPermission(session, payload) {
     const texts = (0, permission_request_payload_1.collectToolInputMatchTexts)(payload.toolName, payload.toolInput, payload.toolInputNormalization);
     const target = texts.join('\n').slice(0, auto_yes_resolver_1.MAX_DENY_MATCH_TEXT_LENGTH);
     const now = new Date();
+    let recorded = null;
     try {
-        (0, chat_db_1.createMessage)((0, db_instance_1.getDbInstance)(), {
+        recorded = (0, chat_db_1.createMessage)((0, db_instance_1.getDbInstance)(), {
             worktreeId: session.worktreeId,
             role: 'assistant',
             content: `${payload.toolName}: ${target}`.slice(0, auto_yes_resolver_1.MAX_DENY_MATCH_TEXT_LENGTH),
@@ -181,6 +215,56 @@ function recordAllowedPermission(session, payload) {
             error: error instanceof Error ? error.message : String(error),
         });
     }
+    if (!recorded)
+        return;
+    broadcastAuditRow(session, recorded);
+}
+/**
+ * Push the audit row this module just wrote to every pane watching the worktree
+ * (Issue #2214).
+ *
+ * `'message'`, never `'message_updated'`: `recordAllowedPermission` always
+ * INSERTs (see its own comment on why it does not reuse `recordAnsweredPrompt`),
+ * so the row has never been delivered before and a client has to append it.
+ *
+ * Separated from the write above rather than folded into its `try`, because the
+ * two failures are not the same failure: the row is committed by the time this
+ * runs, and a socket that cannot take it must cost this push and nothing else.
+ * That separation is also why the delivery is a detached promise — the caller is
+ * a hook handler with an agent blocked on its verdict, and neither a cold
+ * `ws-server` load nor a socket write belongs on that path. This mirrors how
+ * `auto-yes-poller` publishes the answered-prompt row it writes on the same
+ * Auto-Yes path.
+ *
+ * `instanceId` is carried through unchanged: `createMessage` returns the
+ * caller's own object rather than re-reading the row, and every field this
+ * module passes it — `cliToolId` and `instanceId` included — is an explicit
+ * value taken from the resolved session, so what is published matches the row
+ * that was written.
+ *
+ * #2214 recorded a limitation here — that a route bundle holds its own empty
+ * copy of `ws-server`'s `rooms` under `next dev`, while "production runs one
+ * custom-server bundle and is unaffected". **The second half was wrong, and the
+ * hook route this function serves was one of the paths it was wrong about.** A
+ * production build has two graphs: `dist/server/server.js` requires
+ * `./src/lib/ws-server` and calls `setupWebSocket`, while every
+ * `.next/server/app/api/**\/route.js` reaches a second copy in
+ * `.next/server/chunks/`, where `setupWebSocket` is exported and never called.
+ * This push therefore reached nobody in production either. #2220 fixed it with
+ * the publisher registry in `lib/realtime/publisher-registry`; `broadcastMessage`
+ * now routes to whichever instance owns the sockets, and no call site changed.
+ */
+function broadcastAuditRow(session, message) {
+    void Promise.resolve().then(() => __importStar(require('../../lib/ws-server'))).then(({ broadcastMessage }) => {
+        broadcastMessage('message', { worktreeId: session.worktreeId, message });
+    })
+        .catch((error) => {
+        logger.warn('permission-request:audit-broadcast-failed', {
+            worktreeId: session.worktreeId,
+            instanceId: session.instanceId,
+            error: error instanceof Error ? error.message : String(error),
+        });
+    });
 }
 /**
  * Permission modes in which declining to decide does NOT produce a dialog.