commandmate 0.30.2 → 0.31.1

package/dist/lib/cli-tools/types.js

@@ -24,7 +24,7 @@ exports.isImageCapableCLITool = isImageCapableCLITool;
  * T2.1: Single source of truth for CLI tool IDs
  * CLIToolType is derived from this constant (DRY principle)
  */
-exports.CLI_TOOL_IDS = ['claude', 'codex', 'gemini', 'vibe-local', 'opencode', 'copilot', 'antigravity'];
+exports.CLI_TOOL_IDS = ['claude', 'codex', 'gemini', 'vibe-local', 'opencode', 'copilot', 'antigravity', 'command-code'];
 /**
  * CLI tools that render inside the terminal's alternate screen (Issue #1268).
  *
@@ -44,6 +44,10 @@ const ALTERNATE_SCREEN_CLI_TOOLS = new Set([
     'claude',
     'opencode',
     'copilot',
+    // Issue #2250: `command-code` is deliberately absent. Command Code renders
+    // INLINE -- measured on 1.40.1, `#{alternate_on}` is 0 and the pane keeps its
+    // scrollback -- so its captured line count really is a monotonic cursor, the
+    // way codex's and agy's are.
 ]);
 /**
  * Whether a CLI tool renders in the terminal's alternate screen, making the
@@ -190,6 +194,7 @@ exports.CLI_TOOL_DISPLAY_NAMES = {
     opencode: 'OpenCode',
     copilot: 'Copilot',
     antigravity: 'Antigravity',
+    'command-code': 'Command Code',
 };
 /**
  * Check if a string is a valid CLIToolType

package/dist/lib/cli-tools/validation.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Session name validation module
+ * Issue #4: T2.2 - Security validation for session names (MF4-001)
+ *
+ * This module provides validation functions to prevent command injection
+ * attacks through session names used in tmux commands.
+ */
+/**
+ * Session name pattern
+ * Only allows alphanumeric characters, underscores, and hyphens
+ * This prevents command injection through shell special characters
+ *
+ * Pattern breakdown:
+ * - ^ : Start of string
+ * - [a-zA-Z0-9_-] : Allowed characters (alphanumeric, underscore, hyphen)
+ * - + : One or more characters (empty strings not allowed)
+ * - $ : End of string
+ */
+export declare const SESSION_NAME_PATTERN: RegExp;
+/**
+ * Validate session name format
+ * Throws an error if the session name contains invalid characters
+ *
+ * @param sessionName - Session name to validate
+ * @throws Error if session name is invalid
+ *
+ * @example
+ * ```typescript
+ * validateSessionName('mcbd-claude-test'); // OK
+ * validateSessionName('test;rm -rf'); // Throws Error
+ * ```
+ */
+export declare function validateSessionName(sessionName: string): void;
+//# sourceMappingURL=validation.d.ts.map

package/dist/lib/cli-tools/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../src/lib/cli-tools/validation.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,QAAqB,CAAC;AAEvD;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAI7D"}

package/dist/lib/cli-tools/validation.js

@@ -0,0 +1,41 @@
+"use strict";
+/**
+ * Session name validation module
+ * Issue #4: T2.2 - Security validation for session names (MF4-001)
+ *
+ * This module provides validation functions to prevent command injection
+ * attacks through session names used in tmux commands.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SESSION_NAME_PATTERN = void 0;
+exports.validateSessionName = validateSessionName;
+/**
+ * Session name pattern
+ * Only allows alphanumeric characters, underscores, and hyphens
+ * This prevents command injection through shell special characters
+ *
+ * Pattern breakdown:
+ * - ^ : Start of string
+ * - [a-zA-Z0-9_-] : Allowed characters (alphanumeric, underscore, hyphen)
+ * - + : One or more characters (empty strings not allowed)
+ * - $ : End of string
+ */
+exports.SESSION_NAME_PATTERN = /^[a-zA-Z0-9_-]+$/;
+/**
+ * Validate session name format
+ * Throws an error if the session name contains invalid characters
+ *
+ * @param sessionName - Session name to validate
+ * @throws Error if session name is invalid
+ *
+ * @example
+ * ```typescript
+ * validateSessionName('mcbd-claude-test'); // OK
+ * validateSessionName('test;rm -rf'); // Throws Error
+ * ```
+ */
+function validateSessionName(sessionName) {
+    if (!exports.SESSION_NAME_PATTERN.test(sessionName)) {
+        throw new Error(`Invalid session name format: ${sessionName}`);
+    }
+}

package/dist/lib/detection/status-reason.d.ts

@@ -43,6 +43,24 @@ export declare const STATUS_REASON: {
     /** Issue #1893: opencode's permission dialog — an arrow-key button strip. */
     readonly OPENCODE_PERMISSION_PROMPT: "opencode_permission_prompt";
     readonly CLAUDE_SELECTION_LIST: "claude_selection_list";
+    /**
+     * Issue #2297: Command Code's own picker (`/model`, and every overlay that
+     * shares its footer).
+     *
+     * Distinct from {@link STATUS_REASON.CLAUDE_SELECTION_LIST} even though
+     * Command Code renders claude's inline TUI, because the two footers are not
+     * the same sentence and neither pattern matches the other's screen: claude
+     * prints `Enter to set as default` / `Enter to confirm · Esc`, Command Code
+     * prints a lower-case `enter to select · esc to cancel` hint bar. Reporting
+     * the claude token for a Command Code frame would tell an operator reading
+     * `capture --json` that a rule they can go and read had fired, when it had not.
+     *
+     * Before this reason existed the picker reached the `default` floor, which is
+     * `isUnclassifiedActive` — and the chat surface answers THAT with the `1`-`9`
+     * / `y` / `n` answer keys, every one of which types into the picker's
+     * `Type to search models...` box.
+     */
+    readonly COMMAND_CODE_SELECTION_LIST: "command_code_selection_list";
     readonly COPILOT_SELECTION_LIST: "copilot_selection_list";
     readonly CODEX_SELECTION_LIST: "codex_selection_list";
     /** Issue #1017: Codex pager / edit-previous (transcript) mode. */

package/dist/lib/detection/status-reason.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status-reason.d.ts","sourceRoot":"","sources":["../../../src/lib/detection/status-reason.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;GAGG;AACH,eAAO,MAAM,aAAa;;;;;IAKxB;;;;;;;;;;;;;;;;;;OAkBG;;IAEH,6EAA6E;;;;;IAK7E,kEAAkE;;IAElE,6EAA6E;;;;;;IAM7E;;;;;;;;;;;;;;;OAeG;;IAEH;;;;;;;;;;;;;;;OAeG;;;CAGK,CAAC"}
+{"version":3,"file":"status-reason.d.ts","sourceRoot":"","sources":["../../../src/lib/detection/status-reason.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;GAGG;AACH,eAAO,MAAM,aAAa;;;;;IAKxB;;;;;;;;;;;;;;;;;;OAkBG;;IAEH,6EAA6E;;;IAG7E;;;;;;;;;;;;;;;;OAgBG;;;;IAIH,kEAAkE;;IAElE,6EAA6E;;;;;;IAM7E;;;;;;;;;;;;;;;OAeG;;IAEH;;;;;;;;;;;;;;;OAeG;;;CAGK,CAAC"}

package/dist/lib/detection/status-reason.js

@@ -46,6 +46,24 @@ exports.STATUS_REASON = {
     /** Issue #1893: opencode's permission dialog — an arrow-key button strip. */
     OPENCODE_PERMISSION_PROMPT: 'opencode_permission_prompt',
     CLAUDE_SELECTION_LIST: 'claude_selection_list',
+    /**
+     * Issue #2297: Command Code's own picker (`/model`, and every overlay that
+     * shares its footer).
+     *
+     * Distinct from {@link STATUS_REASON.CLAUDE_SELECTION_LIST} even though
+     * Command Code renders claude's inline TUI, because the two footers are not
+     * the same sentence and neither pattern matches the other's screen: claude
+     * prints `Enter to set as default` / `Enter to confirm · Esc`, Command Code
+     * prints a lower-case `enter to select · esc to cancel` hint bar. Reporting
+     * the claude token for a Command Code frame would tell an operator reading
+     * `capture --json` that a rule they can go and read had fired, when it had not.
+     *
+     * Before this reason existed the picker reached the `default` floor, which is
+     * `isUnclassifiedActive` — and the chat surface answers THAT with the `1`-`9`
+     * / `y` / `n` answer keys, every one of which types into the picker's
+     * `Type to search models...` box.
+     */
+    COMMAND_CODE_SELECTION_LIST: 'command_code_selection_list',
     COPILOT_SELECTION_LIST: 'copilot_selection_list',
     CODEX_SELECTION_LIST: 'codex_selection_list',
     /** Issue #1017: Codex pager / edit-previous (transcript) mode. */

package/dist/lib/detection/tools/verified-against.d.ts

@@ -36,10 +36,21 @@ export declare const CODEX_VERIFIED_AGAINST: {
     readonly capturedAt: "2026-08-15";
     readonly paneGeometry: "200x1000";
 };
-/** copilot-cli these rules were read off (#1885 / #1895 fixtures). */
+/**
+ * copilot-cli these rules were read off (#1885 / #1895 / #2269 fixtures).
+ *
+ * Bumped from 1.0.80 because the frames were RE-CAPTURED and the rules CHANGED:
+ * 1.0.82 redrew the composer's fence (`─` rules became a `╻▄` / `╹▀` half-block
+ * frame), dropped the `❯` from the composer in favour of the frame's own `┃`
+ * edge, boxed the transcript's echoed prompt between two more half-block
+ * dividers, and put a file-type badge in front of most tool rows' verbs. The
+ * frames are `tests/unit/lib/detection/fixtures/copilot-live-2269/`, captured on
+ * a private tmux socket at the production geometry; the 1.0.80 frames stay where
+ * they are and the rules still answer for both builds.
+ */
 export declare const COPILOT_VERIFIED_AGAINST: {
-    readonly version: "1.0.80";
-    readonly capturedAt: "2026-08-21";
+    readonly version: "1.0.82";
+    readonly capturedAt: "2026-09-04";
     readonly paneGeometry: "200x1000";
 };
 /**
@@ -59,11 +70,50 @@ export declare const OPENCODE_VERIFIED_AGAINST: {
     readonly capturedAt: "2026-08-26";
     readonly paneGeometry: "80x200";
 };
-/** agy these rules were read off (#988 / #995). */
+/**
+ * agy these rules were read off (#988 / #995 footer + selection rules, re-read
+ * against the #2270 live panes).
+ *
+ * Bumped from `0.4.x` / `2026-07-30` / `inline` because the frames were
+ * RE-CAPTURED, not because the binary moved: #2270 drove agy 1.1.25 on a private
+ * tmux socket at the production geometry and kept both panes inline in
+ * `tests/unit/status-detector-selection.test.ts`
+ * (`AGY_1125_PERMISSION_PANE`, `AGY_1125_SWITCH_MODEL_PANE`) under the banner
+ * `Antigravity CLI 1.1.25`, trailing pane padding included. The
+ * `Do you want to proceed?` + `N. label` rules were measured off those frames,
+ * and `ANTIGRAVITY_SELECTION_LIST_PATTERN` (#995 / #997) was re-checked against
+ * them and left unchanged.
+ *
+ * `paneGeometry` leaves `inline` because the 1.1.25 permission dialog draws no
+ * composer row at all — it reproduces only at the 200x1000 pane the server
+ * captures, and a fixture without the ~970 blank padding rows exercises a
+ * different `lastLines` slice than production does. That is a statement about
+ * the capture condition, not about agy: the scrollback-retained rendering the
+ * `afterThinking` footer rules rest on (#988) is unchanged, and the 1.1.25
+ * dialog still ends on `esc to cancel`.
+ *
+ * What this stamp does NOT claim: #2270 captured `waiting` frames only, so the
+ * idle (`? for shortcuts`) and generating (spinner) branches are carried over
+ * from the 0.4 captures rather than re-measured. A live IDLE 1.1.25 frame is
+ * still uncaptured — see the `readIdleEvidence` note in `antigravity/detect.ts`.
+ */
 export declare const ANTIGRAVITY_VERIFIED_AGAINST: {
-    readonly version: "0.4.x";
-    readonly capturedAt: "2026-07-30";
-    readonly paneGeometry: "inline";
+    readonly version: "1.1.25";
+    readonly capturedAt: "2026-09-04";
+    readonly paneGeometry: "200x1000";
+};
+/**
+ * Command Code these rules were read off (#2250 fixtures).
+ *
+ * The frames are `tests/fixtures/command-code-live-2250/`, captured on a private
+ * tmux socket at the production geometry — the default pane size does not
+ * reproduce the 200-column rules that fence the composer, and the status row
+ * drops its `esc to interrupt` tail below 72 columns.
+ */
+export declare const COMMAND_CODE_VERIFIED_AGAINST: {
+    readonly version: "1.40.1";
+    readonly capturedAt: "2026-09-03";
+    readonly paneGeometry: "200x1000";
 };
 /**
  * The stamp for a tool whose frames nobody has captured yet.

package/dist/lib/detection/tools/verified-against.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verified-against.d.ts","sourceRoot":"","sources":["../../../../src/lib/detection/tools/verified-against.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,iEAAiE;AACjE,eAAO,MAAM,uBAAuB;;;;CAI1B,CAAC;AAEX,4EAA4E;AAC5E,eAAO,MAAM,sBAAsB;;;;CAIzB,CAAC;AAEX,sEAAsE;AACtE,eAAO,MAAM,wBAAwB;;;;CAI3B,CAAC;AAEX;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yBAAyB;;;;CAI5B,CAAC;AAEX,mDAAmD;AACnD,eAAO,MAAM,4BAA4B;;;;CAI/B,CAAC;AAEX;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B;;;;CAI9B,CAAC;AAEX,iFAAiF;AACjF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAQpF,CAAC"}
+{"version":3,"file":"verified-against.d.ts","sourceRoot":"","sources":["../../../../src/lib/detection/tools/verified-against.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,iEAAiE;AACjE,eAAO,MAAM,uBAAuB;;;;CAI1B,CAAC;AAEX,4EAA4E;AAC5E,eAAO,MAAM,sBAAsB;;;;CAIzB,CAAC;AAEX;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB;;;;CAI3B,CAAC;AAEX;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yBAAyB;;;;CAI5B,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,4BAA4B;;;;CAI/B,CAAC;AAEX;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B;;;;CAIhC,CAAC;AAEX;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B;;;;CAI9B,CAAC;AAEX,iFAAiF;AACjF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CASpF,CAAC"}

package/dist/lib/detection/tools/verified-against.js

@@ -26,7 +26,7 @@
  * instead of importing it.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DETECTOR_VERIFIED_AGAINST = exports.UNMEASURED_VERIFIED_AGAINST = exports.ANTIGRAVITY_VERIFIED_AGAINST = exports.OPENCODE_VERIFIED_AGAINST = exports.COPILOT_VERIFIED_AGAINST = exports.CODEX_VERIFIED_AGAINST = exports.CLAUDE_VERIFIED_AGAINST = void 0;
+exports.DETECTOR_VERIFIED_AGAINST = exports.UNMEASURED_VERIFIED_AGAINST = exports.COMMAND_CODE_VERIFIED_AGAINST = exports.ANTIGRAVITY_VERIFIED_AGAINST = exports.OPENCODE_VERIFIED_AGAINST = exports.COPILOT_VERIFIED_AGAINST = exports.CODEX_VERIFIED_AGAINST = exports.CLAUDE_VERIFIED_AGAINST = void 0;
 /** claude these rules were read off (#1708 / #1927 fixtures). */
 exports.CLAUDE_VERIFIED_AGAINST = {
     version: '2.1.240',
@@ -39,10 +39,21 @@ exports.CODEX_VERIFIED_AGAINST = {
     capturedAt: '2026-08-15',
     paneGeometry: '200x1000',
 };
-/** copilot-cli these rules were read off (#1885 / #1895 fixtures). */
+/**
+ * copilot-cli these rules were read off (#1885 / #1895 / #2269 fixtures).
+ *
+ * Bumped from 1.0.80 because the frames were RE-CAPTURED and the rules CHANGED:
+ * 1.0.82 redrew the composer's fence (`─` rules became a `╻▄` / `╹▀` half-block
+ * frame), dropped the `❯` from the composer in favour of the frame's own `┃`
+ * edge, boxed the transcript's echoed prompt between two more half-block
+ * dividers, and put a file-type badge in front of most tool rows' verbs. The
+ * frames are `tests/unit/lib/detection/fixtures/copilot-live-2269/`, captured on
+ * a private tmux socket at the production geometry; the 1.0.80 frames stay where
+ * they are and the rules still answer for both builds.
+ */
 exports.COPILOT_VERIFIED_AGAINST = {
-    version: '1.0.80',
-    capturedAt: '2026-08-21',
+    version: '1.0.82',
+    capturedAt: '2026-09-04',
     paneGeometry: '200x1000',
 };
 /**
@@ -62,11 +73,50 @@ exports.OPENCODE_VERIFIED_AGAINST = {
     capturedAt: '2026-08-26',
     paneGeometry: '80x200',
 };
-/** agy these rules were read off (#988 / #995). */
+/**
+ * agy these rules were read off (#988 / #995 footer + selection rules, re-read
+ * against the #2270 live panes).
+ *
+ * Bumped from `0.4.x` / `2026-07-30` / `inline` because the frames were
+ * RE-CAPTURED, not because the binary moved: #2270 drove agy 1.1.25 on a private
+ * tmux socket at the production geometry and kept both panes inline in
+ * `tests/unit/status-detector-selection.test.ts`
+ * (`AGY_1125_PERMISSION_PANE`, `AGY_1125_SWITCH_MODEL_PANE`) under the banner
+ * `Antigravity CLI 1.1.25`, trailing pane padding included. The
+ * `Do you want to proceed?` + `N. label` rules were measured off those frames,
+ * and `ANTIGRAVITY_SELECTION_LIST_PATTERN` (#995 / #997) was re-checked against
+ * them and left unchanged.
+ *
+ * `paneGeometry` leaves `inline` because the 1.1.25 permission dialog draws no
+ * composer row at all — it reproduces only at the 200x1000 pane the server
+ * captures, and a fixture without the ~970 blank padding rows exercises a
+ * different `lastLines` slice than production does. That is a statement about
+ * the capture condition, not about agy: the scrollback-retained rendering the
+ * `afterThinking` footer rules rest on (#988) is unchanged, and the 1.1.25
+ * dialog still ends on `esc to cancel`.
+ *
+ * What this stamp does NOT claim: #2270 captured `waiting` frames only, so the
+ * idle (`? for shortcuts`) and generating (spinner) branches are carried over
+ * from the 0.4 captures rather than re-measured. A live IDLE 1.1.25 frame is
+ * still uncaptured — see the `readIdleEvidence` note in `antigravity/detect.ts`.
+ */
 exports.ANTIGRAVITY_VERIFIED_AGAINST = {
-    version: '0.4.x',
-    capturedAt: '2026-07-30',
-    paneGeometry: 'inline',
+    version: '1.1.25',
+    capturedAt: '2026-09-04',
+    paneGeometry: '200x1000',
+};
+/**
+ * Command Code these rules were read off (#2250 fixtures).
+ *
+ * The frames are `tests/fixtures/command-code-live-2250/`, captured on a private
+ * tmux socket at the production geometry — the default pane size does not
+ * reproduce the 200-column rules that fence the composer, and the status row
+ * drops its `esc to interrupt` tail below 72 columns.
+ */
+exports.COMMAND_CODE_VERIFIED_AGAINST = {
+    version: '1.40.1',
+    capturedAt: '2026-09-03',
+    paneGeometry: '200x1000',
 };
 /**
  * The stamp for a tool whose frames nobody has captured yet.
@@ -94,6 +144,7 @@ exports.DETECTOR_VERIFIED_AGAINST = {
     copilot: exports.COPILOT_VERIFIED_AGAINST,
     opencode: exports.OPENCODE_VERIFIED_AGAINST,
     antigravity: exports.ANTIGRAVITY_VERIFIED_AGAINST,
+    'command-code': exports.COMMAND_CODE_VERIFIED_AGAINST,
     gemini: exports.UNMEASURED_VERIFIED_AGAINST,
     'vibe-local': exports.UNMEASURED_VERIFIED_AGAINST,
 };

package/dist/lib/detection/version-probes.d.ts

@@ -99,11 +99,32 @@ export declare function parseCliVersion(output: string): string | null;
  * The comparable form of a `verifiedAgainst` stamp, or null when there is none.
  *
  * `'unmeasured'` is null — a tool nobody has captured frames for cannot be
- * fresh or stale. `'0.4.x'` becomes `0.4.0`: antigravity's stamp is a minor
- * series rather than a build (Issue #995 measured a range), and reading it as
- * "no version" would silently exempt the one tool whose rules are furthest
- * behind. Widening to `.0` is the safe direction — it can only ever call a
- * newer install stale, never call a stale one current.
+ * fresh or stale. A minor-series stamp such as `'2.0.x'` becomes `2.0.0`;
+ * widening to `.0` is the safe direction, because it can only ever call a newer
+ * install stale, never call a stale one current.
+ *
+ * ## The wildcard branch has no caller in the table today, and stays anyway
+ *
+ * antigravity's `0.4.x` (Issue #995 measured a range rather than a build) was
+ * the only wildcard stamp ever written, and Issue #2292 replaced it with the
+ * build #2270 actually read the rules off (`1.1.25`). Re-run the grep that
+ * settled it and the branch has zero users:
+ *
+ * ```
+ * $ grep -rnE "version: '[0-9]+\.[0-9]+\.(x|\*)'" src/
+ * (no matches)
+ * ```
+ *
+ * It is kept, because deleting it would not delete the FORMAT.
+ * `verifiedAgainst` is a hand-written string, and the next person who measures a
+ * series rather than a build can still type `2.0.x`. With this branch that
+ * stamp compares. Without it {@link parseCliVersion} reads it as null and the
+ * tool is filed alongside `'unmeasured'` — never stale, no warning, nothing an
+ * operator can act on — which is the same failure #2292 was raised to fix, one
+ * level further down. A parser for an input the table still permits is not dead
+ * code; the unit exercises it on the format directly rather than through
+ * whichever stamp the table happens to hold, so it does not go vacuous now that
+ * no tool uses it.
  */
 export declare function parseVerifiedAgainstVersion(stamp: string): string | null;
 /**

package/dist/lib/detection/version-probes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"version-probes.d.ts","sourceRoot":"","sources":["../../../src/lib/detection/version-probes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4FG;AAOH,0FAA0F;AAC1F,eAAO,MAAM,iCAAiC,OAAO,CAAC;AActD,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG7D;AAWD;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIxE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAQ/D;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACzF;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;CAAE,CAAC;AAEjF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAUlF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,kCAAkC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,2EAA2E;IAC3E,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED,4EAA4E;AAC5E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAKjF;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4B3F;AAoBD;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC,CAWrF;AAED,2DAA2D;AAC3D,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,SAAS,oBAAoB,EAAE,GAAG,iBAAiB,CAO5F;AAED;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,IAAI,iBAAiB,GAAG,SAAS,CAS5E;AAED,wFAAwF;AACxF,wBAAgB,8BAA8B,IAAI,IAAI,CAGrD"}
+{"version":3,"file":"version-probes.d.ts","sourceRoot":"","sources":["../../../src/lib/detection/version-probes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4FG;AAOH,0FAA0F;AAC1F,eAAO,MAAM,iCAAiC,OAAO,CAAC;AActD,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG7D;AAWD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIxE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAQ/D;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACzF;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;CAAE,CAAC;AAEjF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAWlF,CAAC;AAEF,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACnC,kCAAkC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,2EAA2E;IAC3E,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAED,4EAA4E;AAC5E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAKjF;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4B3F;AAoBD;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC,CAWrF;AAED,2DAA2D;AAC3D,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,SAAS,oBAAoB,EAAE,GAAG,iBAAiB,CAO5F;AAED;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,IAAI,iBAAiB,GAAG,SAAS,CAS5E;AAED,wFAAwF;AACxF,wBAAgB,8BAA8B,IAAI,IAAI,CAGrD"}

package/dist/lib/detection/version-probes.js

@@ -124,7 +124,7 @@ function parseCliVersion(output) {
     return match ? `${match[1]}.${match[2]}.${match[3]}` : null;
 }
 /**
- * A `verifiedAgainst` stamp written as a minor-series wildcard: `0.4.x`.
+ * A `verifiedAgainst` stamp written as a minor-series wildcard: `2.0.x`.
  *
  * Only ever applied to the stamp, never to a probe's own output — one side of
  * this comparison is a string a human typed into a tool module, the other is
@@ -135,11 +135,32 @@ const VERIFIED_AGAINST_WILDCARD_REGEX = /^(\d+)\.(\d+)\.(?:x|\*)$/i;
  * The comparable form of a `verifiedAgainst` stamp, or null when there is none.
  *
  * `'unmeasured'` is null — a tool nobody has captured frames for cannot be
- * fresh or stale. `'0.4.x'` becomes `0.4.0`: antigravity's stamp is a minor
- * series rather than a build (Issue #995 measured a range), and reading it as
- * "no version" would silently exempt the one tool whose rules are furthest
- * behind. Widening to `.0` is the safe direction — it can only ever call a
- * newer install stale, never call a stale one current.
+ * fresh or stale. A minor-series stamp such as `'2.0.x'` becomes `2.0.0`;
+ * widening to `.0` is the safe direction, because it can only ever call a newer
+ * install stale, never call a stale one current.
+ *
+ * ## The wildcard branch has no caller in the table today, and stays anyway
+ *
+ * antigravity's `0.4.x` (Issue #995 measured a range rather than a build) was
+ * the only wildcard stamp ever written, and Issue #2292 replaced it with the
+ * build #2270 actually read the rules off (`1.1.25`). Re-run the grep that
+ * settled it and the branch has zero users:
+ *
+ * ```
+ * $ grep -rnE "version: '[0-9]+\.[0-9]+\.(x|\*)'" src/
+ * (no matches)
+ * ```
+ *
+ * It is kept, because deleting it would not delete the FORMAT.
+ * `verifiedAgainst` is a hand-written string, and the next person who measures a
+ * series rather than a build can still type `2.0.x`. With this branch that
+ * stamp compares. Without it {@link parseCliVersion} reads it as null and the
+ * tool is filed alongside `'unmeasured'` — never stale, no warning, nothing an
+ * operator can act on — which is the same failure #2292 was raised to fix, one
+ * level further down. A parser for an input the table still permits is not dead
+ * code; the unit exercises it on the format directly rather than through
+ * whichever stamp the table happens to hold, so it does not go vacuous now that
+ * no tool uses it.
  */
 function parseVerifiedAgainstVersion(stamp) {
     const wildcard = VERIFIED_AGAINST_WILDCARD_REGEX.exec(stamp);
@@ -180,6 +201,7 @@ exports.DETECTOR_VERSION_PROBES = {
     claude: { kind: 'execFile', command: 'claude', args: ['--version'] },
     codex: { kind: 'execFile', command: 'codex', args: ['--version'] },
     antigravity: { kind: 'execFile', command: 'agy', args: ['--version'] },
+    'command-code': { kind: 'execFile', command: 'commandcode', args: ['--version'] },
     opencode: { kind: 'execFile', command: 'opencode', args: ['--version'] },
     gemini: { kind: 'execFile', command: 'gemini', args: ['--version'] },
     copilot: {