commandmate 0.29.2 → 0.30.1

package/dist/server/src/lib/history/user-turn-recorder.js

@@ -0,0 +1,252 @@
+"use strict";
+/**
+ * Putting the operator's own input into conversation history (Issue #2196).
+ *
+ * ## The gap this closes
+ *
+ * `chat_messages` has had exactly one producer of `role: 'user'` rows —
+ * `sendUserMessage`, which `/send` and the Timer go through. Everything else the
+ * operator can type reaches the agent without passing that function: `tmux
+ * attach` and a keyboard, `UnsentComposerBar`'s Run (which sends Enter through
+ * `/special-keys` and nothing else), a script calling `tmux send-keys`. The
+ * agent answers all of them, the poller saves the answer, and
+ * `groupMessagesIntoPairs` has a reply with no prompt in front of it — the
+ * `orphan` pair. That is not a rendering problem: History genuinely does not
+ * know what was asked.
+ *
+ * The agents do know, because each of them keeps its own record of the
+ * conversation. This module is the half of the fix that is the same whatever
+ * that record looks like: given "instance X was prompted with this text at this
+ * moment, and here is a stable name for that prompt", make History hold exactly
+ * one user row for it. `lib/hooks/sources/claude/history` supplies those four
+ * things from Claude's transcript JSONL; #2197 and #2198 will supply them from
+ * codex's and antigravity's own records. Nothing below mentions a tool.
+ *
+ * ## Three outcomes, and why the middle one exists
+ *
+ * 1. **The key is already on a row** — nothing happens. The callers are pollers,
+ *    so being asked to record the same prompt again is the normal case rather
+ *    than an error.
+ * 2. **An unkeyed row already holds this text** — that row is *claimed*, not
+ *    duplicated. This is the `/send` case, and it is the whole reason the
+ *    recorder is not simply an insert: `sendUserMessage` wrote the operator's
+ *    message the instant it was sent, and the agent then recorded the same text
+ *    in its own log a moment later. Two records of one keystroke. Inserting
+ *    would show the operator their own message twice, which is a worse defect
+ *    than the orphan pair this Issue set out to remove — so the pre-existing row
+ *    wins and merely gains the key, and every later call recognises it through
+ *    outcome 1.
+ * 3. **Neither** — insert, and broadcast so an open History pane sees it without
+ *    a reload.
+ *
+ * ## Nothing here throws
+ *
+ * The same contract as the transcript readers that call it, for a sharper
+ * reason: this runs inside the poller's save path, immediately before the
+ * *assistant* row is written. An exception escaping would cost the reply as
+ * well as the prompt, so a failure to record the prompt is reported in the
+ * return value and in the log, and the caller carries on.
+ *
+ * The database imports are dynamic, so that `better-sqlite3` does not enter the
+ * module graph of everything that imports `@/lib/hooks/sources`.
+ *
+ * @module lib/history/user-turn-recorder
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.USER_TURN_ADOPTION_WINDOW_MS = void 0;
+exports.normalizeUserTurnContent = normalizeUserTurnContent;
+exports.recordUserTurn = recordUserTurn;
+const logger_1 = require("../../lib/logger");
+const logger = (0, logger_1.createLogger)('lib/history/user-turn-recorder');
+/**
+ * How far from the agent's own clock a `/send` row may sit and still be the
+ * same keystroke.
+ *
+ * Two minutes, and it is a tolerance rather than a guess at a latency. The two
+ * timestamps being compared are written by different clocks for different
+ * events: `sendUserMessage` stamps the row when CommandMate hands the text to
+ * the pane, and the agent stamps its own record when it accepts the prompt.
+ * Between them sit the composer, a `waitForPrompt`, a folder-trust dialog, a
+ * queued prompt waiting for the previous turn to finish, and — for a prompt
+ * typed while the agent was busy — however long that turn took to end.
+ *
+ * Erring wide is the cheap direction. Too wide costs a mis-adoption only if the
+ * *same instance* was sent the *byte-identical* text twice inside four minutes,
+ * in which case the two rows are interchangeable anyway. Too narrow costs a
+ * duplicate row on every `/send` the agent was slow to accept, which is visible
+ * to the operator on every single turn.
+ */
+exports.USER_TURN_ADOPTION_WINDOW_MS = 120_000;
+/**
+ * The form two pieces of text are compared in.
+ *
+ * Trailing whitespace per line, `\r\n`, and blank lines at either end are the
+ * three differences that a round trip through a TUI composer actually
+ * introduces, so they are the three this ignores. Nothing else is touched — in
+ * particular interior blank lines are significant, because a prompt whose
+ * paragraph breaks were collapsed is not the same prompt.
+ */
+function normalizeUserTurnContent(content) {
+    return content
+        .replace(/\r\n?/g, '\n')
+        .split('\n')
+        .map((line) => line.replace(/[ \t　]+$/u, ''))
+        .join('\n')
+        .trim();
+}
+/** How far the recorder's log calls identify the instance. */
+function describe(target) {
+    return {
+        worktreeId: target.worktreeId,
+        cliToolId: target.cliToolId,
+        instanceId: target.instanceId ?? target.cliToolId,
+    };
+}
+/**
+ * Make History hold exactly one `user` row for one prompt.
+ *
+ * Never throws.
+ *
+ * @param target - The instance that was prompted
+ * @param key - A stable name for this prompt, unique per (worktree, prompt).
+ *   Written to `chat_messages.request_id`, which is what makes a second call
+ *   with the same key a no-op. Callers derive it from the agent's own id for the
+ *   prompt — see `claudePromptRequestId` — so that it survives a restart, a
+ *   re-read of the log and a `/clear`.
+ * @param content - The prompt, as the agent recorded it
+ * @param timestampMs - When the agent says it was prompted, epoch ms
+ * @param options - See {@link RecordUserTurnOptions}; the defaults are #2196's
+ */
+async function recordUserTurn(target, key, content, timestampMs, options = {}) {
+    const instanceId = target.instanceId ?? target.cliToolId;
+    const normalized = normalizeUserTurnContent(content);
+    if (key.length === 0 || normalized.length === 0) {
+        return { outcome: 'skipped', messageId: null, timestampMs: null };
+    }
+    try {
+        const [{ getDbInstance }, chatDb, { broadcastMessage }] = await Promise.all([
+            Promise.resolve().then(() => __importStar(require('../../lib/db/db-instance'))),
+            Promise.resolve().then(() => __importStar(require('../../lib/db/chat-db'))),
+            Promise.resolve().then(() => __importStar(require('../../lib/ws-server'))),
+        ]);
+        const db = getDbInstance();
+        const existing = chatDb.findMessageByRequestId(db, target.worktreeId, key);
+        if (existing) {
+            return {
+                outcome: 'already-recorded',
+                messageId: existing.id,
+                timestampMs: existing.timestamp.getTime(),
+            };
+        }
+        const at = timestampMs > 0 ? timestampMs : Date.now();
+        const adopted = adoptExistingRow(chatDb, db, target, instanceId, key, normalized, at, options);
+        if (adopted)
+            return adopted;
+        const message = chatDb.createMessage(db, {
+            worktreeId: target.worktreeId,
+            role: 'user',
+            content,
+            messageType: 'normal',
+            timestamp: new Date(at),
+            cliToolId: target.cliToolId,
+            instanceId,
+            requestId: key,
+        });
+        broadcastMessage('message', { worktreeId: target.worktreeId, message });
+        logger.info('user-turn-recorded', {
+            ...describe(target),
+            requestId: key,
+            contentLength: content.length,
+        });
+        return { outcome: 'inserted', messageId: message.id, timestampMs: at };
+    }
+    catch (error) {
+        logger.error('user-turn-record-failed', {
+            ...describe(target),
+            requestId: key,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return { outcome: 'failed', messageId: null, timestampMs: null };
+    }
+}
+/**
+ * Claim the `/send` row for this prompt, if there is one.
+ *
+ * The candidates come back newest first and are compared on normalised content;
+ * the one nearest the agent's clock wins, which only matters when the operator
+ * sent the same text twice inside the window and is the right tie-break then
+ * too.
+ *
+ * The claim itself can lose — `setMessageRequestId` refuses a row that acquired
+ * a key between the read and the write. Losing means some other producer got
+ * there first, so the next candidate is tried and, if none is left, the caller
+ * falls through to the insert. It cannot loop: each attempt either claims a row
+ * or removes it from contention.
+ *
+ * @returns The claimed row, or null when nothing here belongs to this prompt
+ */
+function adoptExistingRow(chatDb, db, target, instanceId, key, normalized, at, options) {
+    // `Math.min` and not a replacement: {@link RecordUserTurnOptions} may widen
+    // the search backwards and may never narrow it, so a caller that supplies a
+    // bound *inside* the standard window changes nothing.
+    const fromMs = Math.min(at - exports.USER_TURN_ADOPTION_WINDOW_MS, options.adoptionFromMs ?? Number.POSITIVE_INFINITY);
+    const candidates = chatDb
+        .findUnkeyedUserMessages(db, {
+        worktreeId: target.worktreeId,
+        cliToolId: target.cliToolId,
+        instanceId,
+        fromMs,
+        toMs: at + exports.USER_TURN_ADOPTION_WINDOW_MS,
+    })
+        .filter((row) => normalizeUserTurnContent(row.content) === normalized)
+        .sort((a, b) => Math.abs(a.timestamp.getTime() - at) - Math.abs(b.timestamp.getTime() - at));
+    for (const candidate of candidates) {
+        if (!chatDb.setMessageRequestId(db, candidate.id, key))
+            continue;
+        logger.info('user-turn-adopted', {
+            ...describe(target),
+            requestId: key,
+            messageId: candidate.id,
+            driftMs: candidate.timestamp.getTime() - at,
+        });
+        return {
+            outcome: 'adopted',
+            messageId: candidate.id,
+            timestampMs: candidate.timestamp.getTime(),
+        };
+    }
+    return null;
+}

package/dist/server/src/lib/hooks/agent-event-service.js

@@ -30,6 +30,7 @@ const path_validator_1 = require("../../lib/security/path-validator");
 const task_transition_service_1 = require("../../lib/tasks/task-transition-service");
 const gate_runner_1 = require("../../lib/verification/gate-runner");
 const agent_event_state_1 = require("../../lib/session/agent-event-state");
+const stop_history_capture_1 = require("../../lib/hooks/stop-history-capture");
 const logger_1 = require("../../lib/logger");
 const logger = (0, logger_1.createLogger)('lib/hooks/agent-event-service');
 /**
@@ -144,14 +145,32 @@ function safeRealpath(target) {
  * Apply a `stop` event to whatever the worktree is currently doing.
  *
  * The no-op is the load-bearing case. Sessions with no contract, and therefore
- * no task, are the overwhelming majority; for them this records the timestamp
- * and returns. Nothing about the existing completion path changes.
+ * no task, are the overwhelming majority; for them this records the timestamp,
+ * asks the transcript reader for the turn, and returns.
+ *
+ * ## Why the history read is here (Issue #2246)
+ *
+ * Because it must happen for *every* stop event and not only for the ones that
+ * govern a task — the majority case above is exactly the session whose replies
+ * this is trying not to lose — and because both callers of this function are
+ * stop receivers (`/api/hooks/agent-event` and the compatibility
+ * `/api/hooks/claude-done`). Putting it in one of the routes would have left the
+ * other one on the old behaviour.
+ *
+ * It runs **before** the task lookup so that the two early returns below cannot
+ * skip it, and after `recordAgentStopEvent` because the reader resolves its
+ * transcript through the session pointer that call refreshes.
+ *
+ * It is awaited rather than detached. The turn has already ended, so the cost is
+ * paid by nobody who is waiting for an answer, and a detached promise here would
+ * be one whose failures nothing observes.
  *
  * Never throws. A hook is fire-and-forget from a CLI's stop handler, and a
  * failure here must not become the agent's problem.
  */
 async function applyAgentStopEvent(db, worktree, cliToolId, instanceId) {
     (0, agent_event_state_1.recordAgentStopEvent)(worktree.id, cliToolId, instanceId);
+    const structuredHistoryCaptured = await (0, stop_history_capture_1.captureTranscriptTurnOnStop)(worktree, cliToolId, instanceId);
     let task;
     try {
         task = (0, tasks_db_1.getActiveTaskForInstance)(db, worktree.id, cliToolId, instanceId);
@@ -161,10 +180,20 @@ async function applyAgentStopEvent(db, worktree, cliToolId, instanceId) {
             worktreeId: worktree.id,
             error: error instanceof Error ? error.message : String(error),
         });
-        return { taskId: null, taskEventApplied: false, verificationRunId: null };
+        return {
+            taskId: null,
+            taskEventApplied: false,
+            verificationRunId: null,
+            structuredHistoryCaptured,
+        };
     }
     if (!task) {
-        return { taskId: null, taskEventApplied: false, verificationRunId: null };
+        return {
+            taskId: null,
+            taskEventApplied: false,
+            verificationRunId: null,
+            structuredHistoryCaptured,
+        };
     }
     let taskEventApplied = false;
     try {
@@ -178,7 +207,12 @@ async function applyAgentStopEvent(db, worktree, cliToolId, instanceId) {
         });
     }
     if (!task.contract.success.autoVerifyOnStop) {
-        return { taskId: task.id, taskEventApplied, verificationRunId: null };
+        return {
+            taskId: task.id,
+            taskEventApplied,
+            verificationRunId: null,
+            structuredHistoryCaptured,
+        };
     }
     let verificationRunId = null;
     try {
@@ -201,5 +235,5 @@ async function applyAgentStopEvent(db, worktree, cliToolId, instanceId) {
             });
         }
     }
-    return { taskId: task.id, taskEventApplied, verificationRunId };
+    return { taskId: task.id, taskEventApplied, verificationRunId, structuredHistoryCaptured };
 }

package/dist/server/src/lib/hooks/permission-decision-service.js

@@ -35,6 +35,39 @@
  *
  * @module lib/hooks/permission-decision-service
  */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PERMISSION_DECISION_SLOW_MS = exports.PERMISSION_REQUEST_PROMPT_TYPE = void 0;
 exports.decidePermissionRequest = decidePermissionRequest;
@@ -145,8 +178,9 @@ function recordAllowedPermission(session, payload) {
     const texts = (0, permission_request_payload_1.collectToolInputMatchTexts)(payload.toolName, payload.toolInput, payload.toolInputNormalization);
     const target = texts.join('\n').slice(0, auto_yes_resolver_1.MAX_DENY_MATCH_TEXT_LENGTH);
     const now = new Date();
+    let recorded = null;
     try {
-        (0, chat_db_1.createMessage)((0, db_instance_1.getDbInstance)(), {
+        recorded = (0, chat_db_1.createMessage)((0, db_instance_1.getDbInstance)(), {
             worktreeId: session.worktreeId,
             role: 'assistant',
             content: `${payload.toolName}: ${target}`.slice(0, auto_yes_resolver_1.MAX_DENY_MATCH_TEXT_LENGTH),
@@ -181,6 +215,56 @@ function recordAllowedPermission(session, payload) {
             error: error instanceof Error ? error.message : String(error),
         });
     }
+    if (!recorded)
+        return;
+    broadcastAuditRow(session, recorded);
+}
+/**
+ * Push the audit row this module just wrote to every pane watching the worktree
+ * (Issue #2214).
+ *
+ * `'message'`, never `'message_updated'`: `recordAllowedPermission` always
+ * INSERTs (see its own comment on why it does not reuse `recordAnsweredPrompt`),
+ * so the row has never been delivered before and a client has to append it.
+ *
+ * Separated from the write above rather than folded into its `try`, because the
+ * two failures are not the same failure: the row is committed by the time this
+ * runs, and a socket that cannot take it must cost this push and nothing else.
+ * That separation is also why the delivery is a detached promise — the caller is
+ * a hook handler with an agent blocked on its verdict, and neither a cold
+ * `ws-server` load nor a socket write belongs on that path. This mirrors how
+ * `auto-yes-poller` publishes the answered-prompt row it writes on the same
+ * Auto-Yes path.
+ *
+ * `instanceId` is carried through unchanged: `createMessage` returns the
+ * caller's own object rather than re-reading the row, and every field this
+ * module passes it — `cliToolId` and `instanceId` included — is an explicit
+ * value taken from the resolved session, so what is published matches the row
+ * that was written.
+ *
+ * #2214 recorded a limitation here — that a route bundle holds its own empty
+ * copy of `ws-server`'s `rooms` under `next dev`, while "production runs one
+ * custom-server bundle and is unaffected". **The second half was wrong, and the
+ * hook route this function serves was one of the paths it was wrong about.** A
+ * production build has two graphs: `dist/server/server.js` requires
+ * `./src/lib/ws-server` and calls `setupWebSocket`, while every
+ * `.next/server/app/api/**\/route.js` reaches a second copy in
+ * `.next/server/chunks/`, where `setupWebSocket` is exported and never called.
+ * This push therefore reached nobody in production either. #2220 fixed it with
+ * the publisher registry in `lib/realtime/publisher-registry`; `broadcastMessage`
+ * now routes to whichever instance owns the sockets, and no call site changed.
+ */
+function broadcastAuditRow(session, message) {
+    void Promise.resolve().then(() => __importStar(require('../../lib/ws-server'))).then(({ broadcastMessage }) => {
+        broadcastMessage('message', { worktreeId: session.worktreeId, message });
+    })
+        .catch((error) => {
+        logger.warn('permission-request:audit-broadcast-failed', {
+            worktreeId: session.worktreeId,
+            instanceId: session.instanceId,
+            error: error instanceof Error ? error.message : String(error),
+        });
+    });
 }
 /**
  * Permission modes in which declining to decide does NOT produce a dialog.