commandmate 0.30.2 → 0.31.0

package/dist/server/src/lib/realtime/types.js

@@ -20,17 +20,27 @@ exports.parseRealtimeEvent = parseRealtimeEvent;
  */
 exports.CLIENT_VERSION_MESSAGE_TYPE = 'client_version';
 /**
- * Server → client notice that the running server version differs from this
- * tab's bundle version (#1338/#1356). Drives the reload banner.
+ * Server → client notice that the bundle the server now serves was built from a
+ * different version than this tab's bundle (#1338/#1356/#2271). Drives the
+ * reload banner.
  */
 exports.VERSION_MISMATCH_EVENT_TYPE = 'version_mismatch';
 /**
- * Whether the running server version and this tab's bundle version have drifted
- * apart and the user should be nudged to reload (#1338/#1356).
+ * Whether two **build identities** have drifted apart and the user should be
+ * nudged to reload (#1338/#1356).
+ *
+ * Both arguments are the version a bundle was *built from*, never the version
+ * installed on disk. Issue #2271: feeding this the runtime `package.json`
+ * version on the server side made it fire permanently for everyone, because the
+ * release procedure bumps that file and deliberately does not rebuild the
+ * running server's `.next` — so "installed > served" is the steady state after
+ * every release rather than evidence of anything. `resolveBundleDrift()` in
+ * `@/lib/version-checker` is the one caller that resolves the server side, and
+ * it resolves it from the build manifest.
  *
  * Conservative on purpose (受入条件: 版が一致している間は誤検知しない): an empty or
  * `'0.0.0'` fallback on either side means "version unknown" and is never treated
- * as a mismatch, so a server that cannot resolve its own version stays silent.
+ * as a mismatch, so a server that cannot resolve its own build stays silent.
  */
 function isVersionMismatch(serverVersion, clientVersion) {
     if (!serverVersion || !clientVersion)

package/dist/server/src/lib/response-cleaner.js

@@ -160,8 +160,15 @@ function cleanGeminiResponse(response) {
  * their own by {@link COPILOT_FOLD_MARKER_PATTERN} and
  * {@link COPILOT_COMMAND_OUTPUT_PATTERN}, so nothing needs a block that can run
  * away over a whole message.
+ *
+ * Issue #2269: the verb list moved to {@link COPILOT_TOOL_VERBS}, which
+ * `COPILOT_TOOL_ROW_PATTERN` reads as well. 1.0.82 marks most tool rows with a
+ * file-type badge rather than `●` and that pattern owns those; `●` is still the
+ * marker for a tool row whose file type has no badge (`● Read d.txt 1 line
+ * read`, measured) and for the ask-user row (`● Asked user …`), so both markers
+ * have to answer to one vocabulary.
  */
-const COPILOT_TOOL_ACTION_PATTERN = /^●\s+(?:Get |Read |Run |Search |Write |Edit |Delete |List |Create |Fetch |Explore |Execute |Install |Model changed to:)/;
+const COPILOT_TOOL_ACTION_PATTERN = new RegExp(`^●\\s+(?:${cli_patterns_1.COPILOT_TOOL_VERBS})[\\s:]`);
 /**
  * copilot 1.0.80's tool invocation row (Issue #1897).
  *
@@ -263,6 +270,22 @@ function cleanCopilotResponse(response) {
     let inThinkingBlock = false;
     let inToolOutputBlock = false;
     for (const line of responseLines) {
+        // Issue #2269: tested BEFORE normalisation, for the reason #1897 records at
+        // COPILOT_BOX_ROW_PATTERN and then only acted on in the accumulator:
+        // `normalizeCopilotLine` deletes every U+2500..U+257F glyph, so by the time
+        // COPILOT_SKIP_PATTERNS runs below, every glyph-anchored rule in it is dead
+        // in THIS function. That is what let two rows of copilot's launch screen
+        // through -- `  ╰─╯╰─╯  Copilot v1.0.82 uses AI.` cleans to a bare version
+        // string (1.0.82 split the one-line disclaimer the exact-match rule was
+        // written for), and `   └ Enable all permissions …` cleans to prose -- on
+        // every call that receives a raw frame rather than accumulated content.
+        //
+        // Deliberately not resetting the block flags: the reasoning block's own rows
+        // are `│ <chain of thought>`, so a box row is the middle of a block far more
+        // often than the end of one. That is the behaviour the dead `/^[│└]/` rule
+        // below was written with, and this is the live version of it.
+        if (cli_patterns_1.COPILOT_BOX_ROW_PATTERN.test(line))
+            continue;
         // Normalize using the same function as TUI accumulator (DRY)
         const normalized = (0, tui_accumulator_1.normalizeCopilotLine)(line);
         if (!normalized) {

package/dist/server/src/lib/response-extractor.js

@@ -203,6 +203,17 @@ function resolveExtractionStartIndex(lastCapturedLine, totalLines, bufferReset,
         const foundUserPrompt = findRecentUserPromptIndex(totalLines);
         return foundUserPrompt >= 0 ? foundUserPrompt + 1 : Math.max(0, lastCapturedLine);
     }
+    // Branch 2a''' (Command Code, Issue #2250): same reasoning as agy's above.
+    // Command Code is inline-rendered (`#{alternate_on}` = 0, scrollback kept), so
+    // `lastCapturedLine` is a real cursor and stays the fallback; but the echo
+    // `❯ <message>` is present in every captured turn and is the cleaner boundary,
+    // and the caller has already excluded the composer from the search window by
+    // trimming the chrome, so the echo this finds is a transcript row rather than
+    // the placeholder in the input box.
+    if (cliToolId === 'command-code') {
+        const foundUserPrompt = findRecentUserPromptIndex(totalLines);
+        return foundUserPrompt >= 0 ? foundUserPrompt + 1 : Math.max(0, lastCapturedLine);
+    }
     // Compute bufferWasReset internally (MF-001: responsibility boundary)
     const bufferWasReset = lastCapturedLine >= totalLines || bufferReset;
     // Branch 1: Buffer was reset - find the most recent user prompt as anchor

package/dist/server/src/lib/session/claude-executor.js

@@ -4,7 +4,7 @@
  * Issue #294: Executes CLI tool commands for scheduled executions
  * Issue #379: Added OpenCode support (opencode run)
  *
- * Supported tools: claude, codex, gemini, vibe-local, opencode, copilot, antigravity
+ * Supported tools: claude, codex, gemini, vibe-local, opencode, copilot, antigravity, command-code
  *
  * Security:
  * - Uses execFile (not exec) to prevent shell injection
@@ -14,11 +14,13 @@
  * - Validates cliToolId against ALLOWED_CLI_TOOLS whitelist [SEC-001]
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ALLOWED_CLI_TOOLS = exports.MAX_MESSAGE_LENGTH = exports.EXECUTION_TIMEOUT_MS = exports.MAX_STORED_OUTPUT_SIZE = exports.MAX_OUTPUT_SIZE = void 0;
+exports.COMMAND_CODE_EXIT_REASONS = exports.ALLOWED_CLI_TOOLS = exports.MAX_MESSAGE_LENGTH = exports.EXECUTION_TIMEOUT_MS = exports.MAX_STORED_OUTPUT_SIZE = exports.MAX_OUTPUT_SIZE = void 0;
 exports.getCommandForTool = getCommandForTool;
 exports.truncateOutput = truncateOutput;
 exports.buildCliArgs = buildCliArgs;
 exports.extractOpencodeFinalText = extractOpencodeFinalText;
+exports.extractCommandCodeResult = extractCommandCodeResult;
+exports.describeCommandCodeFailure = describeCommandCodeFailure;
 exports.executeClaudeCommand = executeClaudeCommand;
 exports.getActiveProcesses = getActiveProcesses;
 const child_process_1 = require("child_process");
@@ -62,6 +64,16 @@ function getCommandForTool(cliToolId) {
         // Issue #990 (Phase C): Antigravity's executable is `agy`, not the tool id.
         case 'antigravity':
             return 'agy';
+        // Issue #2253: Command Code ships four bins (`cmd` / `cmdc` / `command-code`
+        // / `commandcode`) and Epic #2249 決定 1 picked the unambiguous spelling, so
+        // the tool id is not the executable here either. Written as a literal to
+        // match the two cases above rather than importing
+        // `COMMAND_CODE_COMMAND` from `@/lib/cli-tools/command-code`, which would
+        // pull the tmux transport into the scheduler's dependency graph; the unit
+        // test imports both and asserts they are the same string, so the copy
+        // cannot drift.
+        case 'command-code':
+            return 'commandcode';
         default:
             return cliToolId;
     }
@@ -94,6 +106,7 @@ function truncateOutput(output) {
  * - vibe-local: [-p <message> -y] or [--model <model> -p <message> -y]
  * - opencode: run --format json [-m <model>] [--agent <a>] [--variant <v>] [-c] [--title <t>] <message>
  * - antigravity: -p <message> --dangerously-skip-permissions
+ * - command-code: -p <message> --output-format json [--yolo | --permission-mode <permission>]
  * - others: -p <message> (fallback)
  *
  * @param message - Prompt message
@@ -159,6 +172,44 @@ function buildCliArgs(message, cliToolId, permission, options) {
             args.push(message);
             return args;
         }
+        case 'command-code': {
+            // Issue #2253 (Epic #2249 Phase D): `commandcode -p <message>` runs one
+            // prompt non-interactively. `--output-format json` is unconditional for
+            // the same reason opencode's `--format json` is: the text format writes a
+            // rendered answer with no frame around it, while the json format ends in a
+            // single `{"type":"result",…}` line carrying `finalText` and `subtype`,
+            // which is what {@link extractCommandCodeResult} reads.
+            //
+            // ## `--yolo` and `--permission-mode` are different axes, and exclusive here
+            //
+            // `commandcode --help` lists them separately, and the shipped option
+            // declaration in `command-code@1.40.1/dist/cli.mjs` is
+            // `.addOption(new Be('--permission-mode <mode>', …).choices(['default',
+            // 'standard','plan','auto-accept','dont-ask']))` with `--yolo` as a plain
+            // boolean alias of `--dangerously-skip-permissions`. So `--yolo` is not a
+            // *value* of the mode flag, and sending both would ask the CLI to run
+            // under a mode and to bypass modes at once. A scheduled run has nobody to
+            // answer a permission dialog, so the default is `--yolo` and an explicit
+            // permission replaces it rather than joining it.
+            //
+            // The whitelist check follows copilot's shape (SEC4-001) rather than
+            // codex's `??`: a permission the dropdown could not have produced falls
+            // back to the unattended default instead of reaching the CLI, where an
+            // unknown `--permission-mode` value is a `.choices()` rejection and the
+            // run would fail before the prompt was ever sent.
+            //
+            // `--yolo` does not override `.commandcode/settings.json`
+            // `permissions.deny`; a denied tool call still ends the run with exit 4,
+            // which {@link describeCommandCodeExit} names in the failure reason.
+            const args = ['-p', message, '--output-format', 'json'];
+            if (schedule_config_1.COMMAND_CODE_PERMISSIONS.includes(permission)) {
+                args.push('--permission-mode', permission);
+            }
+            else {
+                args.push('--yolo');
+            }
+            return args;
+        }
         case 'antigravity':
             // Issue #990 (Phase C): `agy -p <message>` runs a single prompt non-interactively.
             // --dangerously-skip-permissions auto-approves tool use so the process does not
@@ -292,6 +343,134 @@ function renderOpencodeErrorFrame(record) {
     const message = typeof data.message === 'string' ? data.message : '';
     return message ? `opencode error: ${name}: ${message}` : `opencode error: ${name}`;
 }
+// =============================================================================
+// command-code `--output-format json` extraction (Issue #2253)
+// =============================================================================
+/**
+ * `PRINT_EXIT_CODE`, read off `command-code@1.40.1/dist/cli.mjs`.
+ *
+ * The bundle declares it as one object —
+ * `{SUCCESS:0, ERROR:1, AUTH_ERROR:3, PERMISSION_DENIED:4, RATE_LIMITED:5,
+ * CONNECTION_ERROR:6, SERVER_ERROR:7, MAX_TURNS_REACHED:8, NO_RESPONSE:9,
+ * INSUFFICIENT_CREDITS:10, INTERRUPTED:130}` — and `classifyPrintModeError`
+ * next to it is what picks between them. Issue #2253 lists six of the eleven;
+ * all eleven are recorded here because the point of the map is to turn a bare
+ * number in an execution log into a sentence, and a code that falls through
+ * produces exactly the log line the map exists to replace.
+ *
+ * 0 is deliberately absent: success is not a failure reason, and a lookup that
+ * answers for it would let a caller render "Reason: success" on a run that
+ * worked.
+ */
+exports.COMMAND_CODE_EXIT_REASONS = {
+    1: 'error',
+    3: 'authentication failed',
+    4: 'permission denied',
+    5: 'rate limited',
+    6: 'connection error',
+    7: 'server error',
+    8: 'max turns reached',
+    9: 'no response',
+    10: 'insufficient credits',
+    130: 'interrupted',
+};
+/**
+ * The result line of `commandcode -p … --output-format json`, or null.
+ *
+ * ## The measured stream
+ *
+ * One JSON object per line. Every line but the last is `{"type":"event",…}`;
+ * the last is the result. Measured on command-code 1.40.1 (fixtures under
+ * `tests/fixtures/command-code/headless/`):
+ *
+ * ```text
+ * {"type":"event","event":{"type":"run_start","sessionId":"…"}}
+ * {"type":"event","event":{"type":"text_delta","delta":"OK"}}
+ * {"type":"event","event":{"type":"run_end","result":{"finalText":"OK",…}}}
+ * {"type":"result","subtype":"success","sessionId":"…","stopReason":"end_turn",
+ *  "usage":{…},"durationMs":1957,"finalText":"OK"}
+ * ```
+ *
+ * ## Why the last result line rather than `run_end`
+ *
+ * `run_end` carries a `result.finalText` too, and on a successful run they
+ * agree. But `buildPrintResultLine` in the bundle emits the result line on the
+ * failure path as well, where no `run_end` was ever produced: an empty query
+ * answers with exactly one line,
+ * `{"type":"result","subtype":"error",…,"finalText":"","error":"Error: No query
+ * provided. …"}`, and nothing else. Reading `run_end` would see nothing there.
+ *
+ * ## Why it never throws and never invents a result
+ *
+ * Null means "this stdout carried no result line", which the caller renders as
+ * raw output rather than as an empty answer — the state a run that dies before
+ * `runPrintMode` is actually in (`--model <unknown>` exits 1 with **empty
+ * stdout** and the message only on stderr). Unparseable lines are skipped for
+ * the reason the opencode reader skips them: a stray `console.log` from a mod
+ * lands on the same stdout as the stream.
+ *
+ * @param stdout - Raw stdout from `commandcode -p … --output-format json`
+ * @returns The decoded result line, or null when stdout carried none
+ */
+function extractCommandCodeResult(stdout) {
+    let found = null;
+    for (const line of stdout.split('\n')) {
+        const trimmed = line.trim();
+        if (!trimmed.startsWith('{'))
+            continue;
+        let frame;
+        try {
+            frame = JSON.parse(trimmed);
+        }
+        catch {
+            continue;
+        }
+        if (typeof frame !== 'object' || frame === null)
+            continue;
+        const record = frame;
+        if (record.type !== 'result')
+            continue;
+        if (typeof record.subtype !== 'string')
+            continue;
+        found = {
+            subtype: record.subtype,
+            finalText: typeof record.finalText === 'string' ? record.finalText : '',
+            ...(typeof record.error === 'string' ? { error: record.error } : {}),
+        };
+    }
+    return found;
+}
+/**
+ * One line naming why a Command Code run failed, or null when it did not.
+ *
+ * Both halves are load-bearing, because the CLI can disagree with itself. A run
+ * whose answer is blank exits `NO_RESPONSE` (9) while `buildPrintResultLine`
+ * still stamps `subtype: "success"` — the subtype is derived from `stopReason`
+ * and the exit code from `classifyPrintOutcome`, and only the pair says what
+ * happened. So a non-zero exit is a failure whatever the subtype says, and a
+ * subtype other than `success` is a failure whatever the exit code says.
+ *
+ * @param exitCode - Process exit code (null when killed by a signal)
+ * @param result - Decoded result line, when stdout carried one
+ * @returns A `Reason: …` sentence, or null when the run succeeded
+ */
+function describeCommandCodeFailure(exitCode, result) {
+    const failedByCode = exitCode !== null && exitCode !== 0;
+    const failedBySubtype = result !== null && result.subtype !== 'success';
+    if (!failedByCode && !failedBySubtype)
+        return null;
+    const parts = [];
+    if (exitCode !== null && exitCode !== 0) {
+        const reason = exports.COMMAND_CODE_EXIT_REASONS[exitCode];
+        parts.push(reason ? `exit ${exitCode} (${reason})` : `exit ${exitCode}`);
+    }
+    if (result) {
+        parts.push(`subtype=${result.subtype}`);
+        if (result.error)
+            parts.push(result.error);
+    }
+    return `Reason: command-code ${parts.join(' / ')}`;
+}
 /**
  * Execute a CLI command in a worktree directory.
  *
@@ -332,23 +511,43 @@ async function executeClaudeCommand(message, cwd, cliToolId = 'claude', permissi
                 const isMaxBuffer = errCode === 'ERR_CHILD_PROCESS_STDIO_MAXBUFFER';
                 // maxBuffer 超過は時間切れではなく「出力過多」なので timeout 扱いにしない。
                 const isTimeout = error.killed || errCode === 'ETIMEDOUT';
+                // Issue #2253: command-code writes its whole NDJSON stream *and* a
+                // final result line before exiting non-zero — a max-turns run ends at
+                // exit 8 with a complete `{"type":"result","subtype":"max_turns",…}`
+                // line — so the answer and the CLI's own reason are on stdout even
+                // here. Decoding them turns a log that said "Error: Command failed"
+                // over a 4KB event dump into the reason plus the text.
+                const commandCodeResult = cliToolId === 'command-code'
+                    ? extractCommandCodeResult(stdout || '')
+                    : null;
+                const exitCodeNumber = typeof errCode === 'number' ? errCode : null;
                 const errorSummary = [
                     `Error: ${error.message}`,
                     `Code: ${errCode ?? 'unknown'}`,
                     `Signal: ${error.signal ?? 'none'}`,
                     isMaxBuffer ? 'Reason: stdout exceeded execFile maxBuffer (output_limit)' : null,
+                    cliToolId === 'command-code'
+                        ? describeCommandCodeFailure(exitCodeNumber, commandCodeResult)
+                        : null,
                 ]
                     .filter((line) => line !== null)
                     .join('\n');
+                // `?? stdout` on purpose, matching the success path: a run that died
+                // before it could write a result line (an unknown `--model` exits 1
+                // with empty stdout and the message on stderr) reports what it did
+                // write rather than an empty body.
+                const decodedStdout = commandCodeResult
+                    ? commandCodeResult.finalText
+                    : (stdout || '');
                 const rawOutput = (0, cli_patterns_1.stripAnsi)([
                     errorSummary,
-                    stdout ? `\n--- stdout ---\n${stdout}` : '',
+                    decodedStdout ? `\n--- stdout ---\n${decodedStdout}` : '',
                     stderr ? `\n--- stderr ---\n${stderr}` : '',
                 ].join('\n'));
                 const output = truncateOutput(rawOutput);
                 resolve({
                     output,
-                    exitCode: typeof errCode === 'number' ? errCode : null,
+                    exitCode: exitCodeNumber,
                     status: isTimeout ? 'timeout' : 'failed',
                     error: error.message,
                 });
@@ -358,6 +557,26 @@ async function executeClaudeCommand(message, cwd, cliToolId = 'claude', permissi
             // stored output is the assistant's answer rather than the event log.
             // `?? stdout` on purpose: an unrecognised stream is reported verbatim,
             // never swallowed.
+            //
+            // Issue #2253: command-code is the same deal one flag over
+            // (`--output-format json`), except that its stream also carries the
+            // CLI's own verdict. `classifyPrintOutcome` in the bundle can exit 0
+            // only on `subtype: "success"`, so this branch is the success case in
+            // practice — but the subtype is read rather than assumed, because
+            // "the process exited 0" and "the agent answered" are two facts and
+            // this layer is the only one that can still see the second.
+            if (cliToolId === 'command-code') {
+                const result = extractCommandCodeResult(stdout || '');
+                const failure = describeCommandCodeFailure(0, result);
+                const body = result ? result.finalText : (stdout || '');
+                resolve({
+                    output: truncateOutput((0, cli_patterns_1.stripAnsi)(failure ? `${failure}\n${body}` : body)),
+                    exitCode: 0,
+                    status: failure ? 'failed' : 'completed',
+                    ...(failure ? { error: failure } : {}),
+                });
+                return;
+            }
             const decoded = cliToolId === 'opencode'
                 ? extractOpencodeFinalText(stdout || '') ?? stdout ?? ''
                 : stdout || '';

package/dist/server/src/lib/session/cli-session.js

@@ -16,10 +16,20 @@ exports.isSessionRunning = isSessionRunning;
 exports.captureSessionOutput = captureSessionOutput;
 exports.captureSessionOutputFresh = captureSessionOutputFresh;
 exports.getSessionName = getSessionName;
+exports.publishSessionSurface = publishSessionSurface;
+exports.forgetSessionSurface = forgetSessionSurface;
 const manager_1 = require("../../lib/cli-tools/manager");
 const logger_1 = require("../../lib/logger");
 const polling_tmux_transport_1 = require("../../lib/tmux/polling-tmux-transport");
 const tmux_capture_cache_1 = require("../../lib/tmux/tmux-capture-cache");
+// Issue #2317: this module is one of the two gateways Issue #1922's import guard
+// names, which is why the tmux SURFACE is reached from here and not from
+// `worktree-status-helper.ts`. Static, not `await import()`: the guard's
+// `no-restricted-syntax` rule blocks the dynamic form outright ("keep it at
+// zero"), and this module already imports from `lib/tmux/**` above.
+const session_hooks_1 = require("../../lib/tmux/session-hooks");
+const session_status_options_1 = require("../../lib/tmux/session-status-options");
+const tmux_session_surface_1 = require("./tmux-session-surface");
 const logger = (0, logger_1.createLogger)('cli-session');
 function getDefaultTransport() {
     return (0, polling_tmux_transport_1.getPollingTmuxTransport)();
@@ -130,3 +140,45 @@ async function captureSessionOutputFresh(worktreeId, cliToolId, lines = 5000, in
 function getSessionName(worktreeId, cliToolId, instanceId) {
     return resolveSessionContext(worktreeId, cliToolId, instanceId).sessionName;
 }
+/**
+ * Publish one session's state onto its tmux session, and take back a geometry
+ * no human is using (Issue #2317, Phases B and D).
+ *
+ * ## Why this is here rather than called directly
+ *
+ * `worktree-status-helper.ts` is the caller, and Issue #1922's import guard
+ * (§4 D4) forbids it from reaching `lib/tmux/**` — this module is one of the two
+ * sanctioned gateways the guard's own message names, and the guard's allowlist
+ * "may only shrink". So the status poll asks this module, and this module owns
+ * the three tmux-side calls.
+ *
+ * Everything below is no-throw by construction (each callee swallows its own
+ * errors), and the whole thing is a convenience surface: a tmux hiccup must not
+ * be able to fail the poll that the sidebar, the header chip and
+ * `commandmate ls` all read.
+ *
+ * Costs nothing in the steady state: the status write is skipped unless the
+ * status CHANGED, the hook reconcile runs once per session per process, and the
+ * geometry probe is asked only for the tools `attach --live` accepts.
+ *
+ * @param publication - Session identity plus the status word to publish
+ */
+async function publishSessionSurface(publication) {
+    await (0, session_hooks_1.ensureSessionHooks)(publication.sessionName);
+    if ((0, tmux_session_surface_1.isLiveAttachEligibleSession)(publication.sessionName)) {
+        await (0, session_hooks_1.reconcileDelegatedGeometry)(publication.sessionName);
+    }
+    await (0, session_status_options_1.publishSessionStatus)(publication);
+}
+/**
+ * Drop every memo held for a session that is known to be gone (Issue #2317).
+ *
+ * Without it, a session created later under the same name would be deduped
+ * against the dead one's last published status and never write its own.
+ *
+ * @param sessionName - tmux session name that no longer exists
+ */
+function forgetSessionSurface(sessionName) {
+    (0, session_status_options_1.forgetSessionStatus)(sessionName);
+    (0, session_hooks_1.forgetSessionHooks)(sessionName);
+}