commandmate 0.31.2 → 0.32.0

package/dist/server/src/lib/db/relay-db.js

@@ -0,0 +1,343 @@
+"use strict";
+/**
+ * The relay ledger's CRUD (Issue #2377, table from migration v60).
+ *
+ * Every state change a relay can undergo is a statement in this file, and each
+ * one that must happen at most once is written as a GUARDED update that reports
+ * whether it won. That is not a style choice: the turn's end is judged by two
+ * independent producers (the Stop hook and the poller) and the delivery pump can
+ * be re-entered by a timer while a first pass is still awaiting a send, so
+ * "read, decide, write" would deliver some replies twice. `better-sqlite3` is
+ * synchronous, so a single `UPDATE … WHERE <precondition>` plus `changes === 1`
+ * is a compare-and-set with no window in it.
+ *
+ * Shapes come from `@/lib/relay/types`, which knows nothing about SQL — the
+ * browser hook reads the same interfaces.
+ *
+ * @module lib/db/relay-db
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRelay = createRelay;
+exports.getRelayById = getRelayById;
+exports.listOpenRelaysTo = listOpenRelaysTo;
+exports.listOpenRelaysFrom = listOpenRelaysFrom;
+exports.getSessionRelaySummary = getSessionRelaySummary;
+exports.listOpenRelaysForWorktree = listOpenRelaysForWorktree;
+exports.countOpenRelaysBetween = countOpenRelaysBetween;
+exports.stashRelayPayload = stashRelayPayload;
+exports.listRelaysWithPendingPayload = listRelaysWithPendingPayload;
+exports.clearRelayPending = clearRelayPending;
+exports.markRelayDelivered = markRelayDelivered;
+exports.markRelayPromptNotified = markRelayPromptNotified;
+exports.getRelayPromptSignature = getRelayPromptSignature;
+exports.markRelayExpired = markRelayExpired;
+exports.listExpiredOpenRelays = listExpiredOpenRelays;
+exports.cancelRelay = cancelRelay;
+exports.countRelays = countRelays;
+const crypto_1 = require("crypto");
+const types_1 = require("../../lib/relay/types");
+const logger_1 = require("../../lib/logger");
+const logger = (0, logger_1.createLogger)('relay-db');
+/** Every column, in one place, so the readers cannot drift from each other. */
+const RELAY_COLUMNS = `
+  id, from_worktree_id, from_instance_id, to_worktree_id, to_instance_id,
+  state, hops, sent_request_id, pending_kind, pending_body, prompt_signature,
+  created_at, updated_at, expires_at, delivered_at
+`;
+function mapRelay(row) {
+    return {
+        id: row.id,
+        from: { worktreeId: row.from_worktree_id, instanceId: row.from_instance_id },
+        to: { worktreeId: row.to_worktree_id, instanceId: row.to_instance_id },
+        state: row.state,
+        hops: row.hops,
+        sentRequestId: row.sent_request_id,
+        pendingKind: row.pending_kind ?? null,
+        createdAt: row.created_at,
+        updatedAt: row.updated_at,
+        expiresAt: row.expires_at,
+        deliveredAt: row.delivered_at,
+    };
+}
+/** Insert a new `pending` relay and hand it back. */
+function createRelay(db, input) {
+    const id = (0, crypto_1.randomUUID)();
+    const now = input.now ?? Date.now();
+    db.prepare(`
+    INSERT INTO session_relays
+      (id, from_worktree_id, from_instance_id, to_worktree_id, to_instance_id,
+       state, hops, sent_request_id, pending_kind, pending_body, prompt_signature,
+       created_at, updated_at, expires_at, delivered_at)
+    VALUES (?, ?, ?, ?, ?, 'pending', ?, NULL, NULL, NULL, NULL, ?, ?, ?, NULL)
+  `).run(id, input.from.worktreeId, input.from.instanceId, input.to.worktreeId, input.to.instanceId, input.hops, now, now, input.expiresAt);
+    return {
+        id,
+        from: { ...input.from },
+        to: { ...input.to },
+        state: 'pending',
+        hops: input.hops,
+        sentRequestId: null,
+        pendingKind: null,
+        createdAt: now,
+        updatedAt: now,
+        expiresAt: input.expiresAt,
+        deliveredAt: null,
+    };
+}
+/** One relay by id, or null. */
+function getRelayById(db, id) {
+    const row = db
+        .prepare(`SELECT ${RELAY_COLUMNS} FROM session_relays WHERE id = ?`)
+        .get(id);
+    return row ? mapRelay(row) : null;
+}
+/** Placeholders for an `IN (…)` over the open states. */
+const OPEN_STATE_PLACEHOLDERS = types_1.OPEN_RELAY_STATES.map(() => '?').join(', ');
+/** Every still-open relay this session must answer (it is the `to` end). */
+function listOpenRelaysTo(db, endpoint) {
+    const rows = db
+        .prepare(`
+      SELECT ${RELAY_COLUMNS} FROM session_relays
+      WHERE to_worktree_id = ? AND to_instance_id = ?
+        AND state IN (${OPEN_STATE_PLACEHOLDERS})
+      ORDER BY created_at ASC
+    `)
+        .all(endpoint.worktreeId, endpoint.instanceId, ...types_1.OPEN_RELAY_STATES);
+    return rows.map(mapRelay);
+}
+/** Every still-open relay this session is waiting on (it is the `from` end). */
+function listOpenRelaysFrom(db, endpoint) {
+    const rows = db
+        .prepare(`
+      SELECT ${RELAY_COLUMNS} FROM session_relays
+      WHERE from_worktree_id = ? AND from_instance_id = ?
+        AND state IN (${OPEN_STATE_PLACEHOLDERS})
+      ORDER BY created_at ASC
+    `)
+        .all(endpoint.worktreeId, endpoint.instanceId, ...types_1.OPEN_RELAY_STATES);
+    return rows.map(mapRelay);
+}
+/** Both halves of {@link SessionRelaySummary} in one call. */
+function getSessionRelaySummary(db, endpoint) {
+    return {
+        owed: listOpenRelaysTo(db, endpoint),
+        awaiting: listOpenRelaysFrom(db, endpoint),
+    };
+}
+/** Every open relay in a worktree, whichever end it belongs to. */
+function listOpenRelaysForWorktree(db, worktreeId) {
+    const rows = db
+        .prepare(`
+      SELECT ${RELAY_COLUMNS} FROM session_relays
+      WHERE (from_worktree_id = ? OR to_worktree_id = ?)
+        AND state IN (${OPEN_STATE_PLACEHOLDERS})
+      ORDER BY created_at ASC
+    `)
+        .all(worktreeId, worktreeId, ...types_1.OPEN_RELAY_STATES);
+    return rows.map(mapRelay);
+}
+/**
+ * How many open relays already run from `from` to `to`.
+ *
+ * The Issue's "a from→to pair must not sit at two pending relays at once": a
+ * second standing instruction to the same session says nothing the first one
+ * does not, and both would fire on the same finished turn.
+ */
+function countOpenRelaysBetween(db, from, to) {
+    const row = db
+        .prepare(`
+      SELECT COUNT(*) AS n FROM session_relays
+      WHERE from_worktree_id = ? AND from_instance_id = ?
+        AND to_worktree_id = ? AND to_instance_id = ?
+        AND state IN (${OPEN_STATE_PLACEHOLDERS})
+    `)
+        .get(from.worktreeId, from.instanceId, to.worktreeId, to.instanceId, ...types_1.OPEN_RELAY_STATES);
+    return row.n;
+}
+/**
+ * Record a payload that has been decided and not yet delivered.
+ *
+ * Guarded on `pending_kind IS NULL`, which is what makes two producers finding
+ * the same finished turn cost ONE delivery: the second one loses the race and
+ * returns false rather than queueing a duplicate. The guard is released by
+ * {@link clearRelayPending} once the payload has actually gone out, so the same
+ * relay can carry a prompt notice now and a reply later.
+ *
+ * @returns Whether this call is the one that stashed it
+ */
+function stashRelayPayload(db, id, kind, body, now = Date.now()) {
+    const result = db
+        .prepare(`
+      UPDATE session_relays
+      SET pending_kind = ?, pending_body = ?, updated_at = ?
+      WHERE id = ? AND pending_kind IS NULL
+        AND state IN (${OPEN_STATE_PLACEHOLDERS})
+    `)
+        .run(kind, body, now, id, ...types_1.OPEN_RELAY_STATES);
+    return result.changes === 1;
+}
+/** Every relay carrying an undelivered payload, oldest first. */
+function listRelaysWithPendingPayload(db) {
+    const rows = db
+        .prepare(`
+      SELECT ${RELAY_COLUMNS} FROM session_relays
+      WHERE pending_kind IS NOT NULL
+      ORDER BY updated_at ASC
+    `)
+        .all();
+    return rows
+        .filter((row) => row.pending_body !== null && row.pending_kind !== null)
+        .map((row) => ({
+        relay: mapRelay(row),
+        kind: row.pending_kind,
+        body: row.pending_body,
+    }));
+}
+/** Drop an undelivered payload (it went out, or it was superseded). */
+function clearRelayPending(db, id, now = Date.now()) {
+    db.prepare(`
+    UPDATE session_relays
+    SET pending_kind = NULL, pending_body = NULL, updated_at = ?
+    WHERE id = ?
+  `).run(now, id);
+}
+/**
+ * Close the relay as delivered, exactly once.
+ *
+ * Two clauses, and they guard different things — worth separating, because a
+ * later reader who notices that the second is redundant *for one relay id* will
+ * otherwise delete the one that is not.
+ *
+ *  - `state IN (open)` is what makes a SECOND call for the same relay answer
+ *    false: the first call left it `delivered`, which is not an open state.
+ *  - `sent_request_id IS NULL`, together with the column's UNIQUE index, is what
+ *    makes the delivery id itself unrepeatable ACROSS relays and across
+ *    processes. It is the idempotency key the Issue names, and it is why this
+ *    function catches: the index refusing a write is the answer "somebody else
+ *    got there first", and that answer must not arrive as an exception inside a
+ *    delivery path.
+ *
+ * @returns Whether this call is the one that closed it
+ */
+function markRelayDelivered(db, id, sentRequestId, now = Date.now()) {
+    try {
+        const result = db
+            .prepare(`
+        UPDATE session_relays
+        SET state = 'delivered', sent_request_id = ?, delivered_at = ?,
+            pending_kind = NULL, pending_body = NULL, updated_at = ?
+        WHERE id = ? AND sent_request_id IS NULL
+          AND state IN (${OPEN_STATE_PLACEHOLDERS})
+      `)
+            .run(sentRequestId, now, now, id, ...types_1.OPEN_RELAY_STATES);
+        return result.changes === 1;
+    }
+    catch (error) {
+        // The UNIQUE index refusing the write IS the answer "somebody else got
+        // there first", and it must not become an exception in a delivery path.
+        logger.warn('relay-deliver-conflict', {
+            relayId: id,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return false;
+    }
+}
+/**
+ * Note that A is being told B is waiting on a confirmation.
+ *
+ * Leaves the relay OPEN — `prompt` is an open state, so answering the dialog
+ * lets B finish and the reply is stashed and delivered from here — and leaves
+ * any stashed payload alone: this records the DECISION to notify, while
+ * `clearRelayPending` records that the notice went out. `prompt_signature` is
+ * what stops a twenty-minute wait from producing a notice on every poll.
+ */
+function markRelayPromptNotified(db, id, signature, now = Date.now()) {
+    db.prepare(`
+    UPDATE session_relays
+    SET state = 'prompt', prompt_signature = ?, updated_at = ?
+    WHERE id = ?
+  `).run(signature, now, id);
+}
+/** The confirmation notice already sent for this relay, or null. */
+function getRelayPromptSignature(db, id) {
+    const row = db
+        .prepare('SELECT prompt_signature FROM session_relays WHERE id = ?')
+        .get(id);
+    return row?.prompt_signature ?? null;
+}
+/**
+ * Close the relay as expired, exactly once.
+ *
+ * The once-ness is the point: the Issue asks for ONE line of notice, and the
+ * state transition is what the notice is written from.
+ *
+ * @returns Whether this call is the one that expired it
+ */
+function markRelayExpired(db, id, now = Date.now()) {
+    const result = db
+        .prepare(`
+      UPDATE session_relays
+      SET state = 'expired', updated_at = ?
+      WHERE id = ? AND state IN (${OPEN_STATE_PLACEHOLDERS})
+    `)
+        .run(now, id, ...types_1.OPEN_RELAY_STATES);
+    return result.changes === 1;
+}
+/** Every open relay whose deadline has passed. */
+function listExpiredOpenRelays(db, now = Date.now()) {
+    const rows = db
+        .prepare(`
+      SELECT ${RELAY_COLUMNS} FROM session_relays
+      WHERE state IN (${OPEN_STATE_PLACEHOLDERS}) AND expires_at <= ?
+      ORDER BY expires_at ASC
+    `)
+        .all(...types_1.OPEN_RELAY_STATES, now);
+    return rows.map(mapRelay);
+}
+/** Withdraw a relay. Returns false when it was already closed or absent. */
+function cancelRelay(db, id, now = Date.now()) {
+    const result = db
+        .prepare(`
+      UPDATE session_relays
+      SET state = 'cancelled', pending_kind = NULL, pending_body = NULL, updated_at = ?
+      WHERE id = ? AND state IN (${OPEN_STATE_PLACEHOLDERS})
+    `)
+        .run(now, id, ...types_1.OPEN_RELAY_STATES);
+    return result.changes === 1;
+}
+/**
+ * Count relays per state.
+ *
+ * The shape `commandmate task show` and `report metrics` print. Counting in SQL
+ * rather than reading rows because a long-lived server accumulates thousands
+ * and both callers want five integers.
+ */
+function countRelays(db, filter = {}) {
+    const clauses = [];
+    const params = [];
+    if (filter.worktreeId) {
+        if (filter.instanceId) {
+            clauses.push('((from_worktree_id = ? AND from_instance_id = ?) OR (to_worktree_id = ? AND to_instance_id = ?))');
+            params.push(filter.worktreeId, filter.instanceId, filter.worktreeId, filter.instanceId);
+        }
+        else {
+            clauses.push('(from_worktree_id = ? OR to_worktree_id = ?)');
+            params.push(filter.worktreeId, filter.worktreeId);
+        }
+    }
+    if (filter.since !== undefined) {
+        clauses.push('created_at >= ?');
+        params.push(filter.since);
+    }
+    const where = clauses.length > 0 ? `WHERE ${clauses.join(' AND ')}` : '';
+    const rows = db
+        .prepare(`SELECT state, COUNT(*) AS n FROM session_relays ${where} GROUP BY state`)
+        .all(...params);
+    const counts = (0, types_1.emptyRelayCounts)();
+    for (const row of rows) {
+        if (row.state in counts) {
+            counts[row.state] = row.n;
+        }
+    }
+    return counts;
+}

package/dist/server/src/lib/detection/ansi.js

@@ -11,7 +11,9 @@
  * Covers:
  * - SGR sequences: ESC[Nm (colors, bold, underline, etc.)
  * - OSC sequences: ESC]...BEL and ESC]...ST (ESC \\) - window title, and the
- *   OSC 8 hyperlinks that claude/codex/copilot emit (Issue #1912)
+ *   OSC 8 hyperlinks that claude/codex/copilot emit (Issue #1912). Also
+ *   available on its own as {@link stripOsc} (Issue #2369), for a consumer that
+ *   renders SGR and must not render OSC.
  * - CSI sequences: ESC[...letter (cursor movement, erase, etc.)
  *
  * Known limitations (SEC-002): 8-bit CSI (0x9B), DEC private modes (ESC[?25h),
@@ -19,14 +21,49 @@
  * practice tmux capture-pane output rarely contains these.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ANSI_PATTERN = void 0;
+exports.ANSI_PATTERN = exports.OSC_PATTERN = void 0;
 exports.stripAnsi = stripAnsi;
+exports.stripOsc = stripOsc;
 exports.extractAnsiSequences = extractAnsiSequences;
-exports.ANSI_PATTERN = /\x1b\[[0-9;]*[a-zA-Z]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)|\[[0-9;]*m/g;
+/**
+ * One OSC sequence: `ESC ]`, a payload, and either terminator (BEL or ST).
+ *
+ * Split out of {@link ANSI_PATTERN} by Issue #2369 so a second consumer can
+ * strip OSC **without** stripping SGR. `sanitizeTerminalOutput`
+ * (`lib/security/sanitize.ts`) is that consumer: it hands the frame to
+ * `ansi-to-html`, which turns SGR into colour and does not know OSC at all — so
+ * before this split, Command Code's `/usage` panel rendered its breakdown link
+ * as the literal text `]8;;https://commandcode.ai/…\` beside the label. Calling
+ * `stripAnsi` there would have thrown the colour away with it.
+ *
+ * The payload class excludes ESC as well as BEL (Issue #1912) so a sequence
+ * ended by ST cannot run on to a BEL later in the buffer and swallow the visible
+ * link text between them. An OSC with no terminator at all matches nothing and
+ * is left in place, which is the safe answer: eating the rest of the frame is
+ * worse than showing one stray escape.
+ *
+ * The source is shared with {@link ANSI_PATTERN} rather than restated, so the
+ * two cannot drift about which terminators exist.
+ */
+const OSC_SOURCE = '\\x1b\\][^\\x07\\x1b]*(?:\\x07|\\x1b\\\\)';
+/** {@link OSC_SOURCE} as a reusable global pattern. */
+exports.OSC_PATTERN = new RegExp(OSC_SOURCE, 'g');
+exports.ANSI_PATTERN = new RegExp(`\\x1b\\[[0-9;]*[a-zA-Z]|${OSC_SOURCE}|\\[[0-9;]*m`, 'g');
 /** Remove all ANSI escape sequences from a string. */
 function stripAnsi(str) {
     return str.replace(exports.ANSI_PATTERN, '');
 }
+/**
+ * Remove OSC sequences only, leaving SGR (colour) and CSI untouched.
+ *
+ * For OSC 8 hyperlinks — `ESC ] 8 ; ; <url> ST <label> ESC ] 8 ; ; ST` — this
+ * drops both halves of the pair and keeps `<label>`, which is the text the
+ * terminal itself shows. See {@link OSC_PATTERN} for who needs this and why
+ * `stripAnsi` is not the answer for them.
+ */
+function stripOsc(str) {
+    return str.replace(exports.OSC_PATTERN, '');
+}
 /**
  * Extract the ANSI escape sequences from a string, in order, discarding all
  * other characters. Reuses the same tested pattern as {@link stripAnsi} so the

package/dist/server/src/lib/detection/cli-patterns.js

@@ -5,7 +5,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.COPILOT_TOOL_ROW_PATTERN = exports.COPILOT_TOOL_VERBS = exports.COPILOT_TRANSCRIPT_DIVIDER_PATTERN = exports.COPILOT_USER_ECHO_PATTERN = exports.COPILOT_REASONING_HEADER_PATTERN = exports.COPILOT_BOX_ROW_PATTERN = exports.COPILOT_SEPARATOR_PATTERN = exports.COPILOT_IDLE_STATUS_PATTERN = exports.COPILOT_WORKING_STATUS_PATTERN = exports.COPILOT_THINKING_PATTERN = exports.COPILOT_PROMPT_PATTERN = exports.OPENCODE_SKIP_PATTERNS = exports.OPENCODE_SEPARATOR_PATTERN = exports.CLAUDE_SELECTION_LIST_FOOTER = exports.CLAUDE_MODEL_OVERLAY_FOOTER_PATTERN = exports.OPENCODE_SELECTION_LIST_PATTERN = exports.OPENCODE_FOOTER_STATUS_PATTERN = exports.OPENCODE_USER_ECHO_PATTERN = exports.OPENCODE_GUTTER_ROW_PATTERN = exports.OPENCODE_COMPOSER_BOTTOM_BORDER = exports.OPENCODE_PROCESSING_INDICATOR = exports.OPENCODE_PERMISSION_PATTERN = exports.OPENCODE_TURN_COMPLETE_PATTERN = exports.OPENCODE_RESPONSE_COMPLETE = exports.OPENCODE_LOADING_PATTERN = exports.OPENCODE_THINKING_PATTERN = exports.OPENCODE_PROMPT_AFTER_RESPONSE = exports.OPENCODE_IDLE_COMPOSER_PATTERN = exports.OPENCODE_PROMPT_PATTERN = exports.GEMINI_THINKING_PATTERN = exports.GEMINI_PROMPT_PATTERN = exports.MAX_PASTED_TEXT_RETRIES = exports.PASTED_TEXT_DETECT_DELAY = exports.PASTED_TEXT_PATTERN = exports.CODEX_STATUS_BAR_PATTERN = exports.CODEX_PAGER_FOOTER_PATTERN = exports.CODEX_APPROVAL_FOOTER_PATTERN = exports.CODEX_SELECTION_LIST_PATTERN = exports.CODEX_SEPARATOR_PATTERN = exports.CODEX_HOOKS_REVIEW_ANCHORS = exports.CODEX_DIALOG_PATTERN = exports.CODEX_PROMPT_PATTERN = exports.CLAUDE_TRUST_DIALOG_PATTERN = exports.CLAUDE_SEPARATOR_PATTERN = exports.CLAUDE_PROMPT_PATTERN = exports.CODEX_INTERRUPT_HINT_PATTERN = exports.CODEX_THINKING_PATTERN = exports.CLAUDE_INTERRUPT_HINT_PATTERN = exports.CLAUDE_THINKING_PATTERN = exports.CLAUDE_SPINNER_CHARS = void 0;
-exports.CLAUDE_SESSION_ERROR_REGEX_PATTERNS = exports.CLAUDE_SESSION_ERROR_PATTERNS = exports.extractAnsiSequences = exports.stripAnsi = exports.COMMAND_CODE_SKIP_PATTERNS = exports.COMMAND_CODE_HOOK_NOTICE_PATTERN = exports.COMMAND_CODE_BANNER_PATTERNS = exports.COMMAND_CODE_MODE_INDICATOR_PATTERN = exports.COMMAND_CODE_COMPLETION_PATTERN = exports.COMMAND_CODE_RESPONSE_MARKER_PATTERN = exports.COMMAND_CODE_THINKING_PATTERN = exports.COMMAND_CODE_INTERRUPT_HINT_PATTERN = exports.COMMAND_CODE_SEPARATOR_PATTERN = exports.COMMAND_CODE_PROMPT_PATTERN = exports.COMMAND_CODE_SPINNER_CHARS = exports.ANTIGRAVITY_SKIP_PATTERNS = exports.ANTIGRAVITY_NUMBERED_OPTION_PATTERN = exports.ANTIGRAVITY_NUMBERED_DIALOG_QUESTION_PATTERN = exports.ANTIGRAVITY_SELECTION_LIST_PATTERN = exports.ANTIGRAVITY_SEPARATOR_PATTERN = exports.ANTIGRAVITY_THINKING_PATTERN = exports.ANTIGRAVITY_PROMPT_PATTERN = exports.VIBE_LOCAL_THINKING_PATTERN = exports.VIBE_LOCAL_PROMPT_PATTERN = exports.COPILOT_SKIP_PATTERNS = exports.COPILOT_FOLDER_TRUST_ANSWER_KEY = exports.COPILOT_FOLDER_TRUST_SESSION_OPTION_PATTERN = exports.COPILOT_FOLDER_TRUST_ANCHORS = exports.COPILOT_SELECTION_FOOTER_PATTERN = exports.COPILOT_BOOT_BANNER_ANCHORS = exports.COPILOT_TRANSCRIPT_CONTINUATION_PATTERN = void 0;
+exports.CLAUDE_SESSION_ERROR_REGEX_PATTERNS = exports.CLAUDE_SESSION_ERROR_PATTERNS = exports.extractAnsiSequences = exports.stripAnsi = exports.COMMAND_CODE_SKIP_PATTERNS = exports.COMMAND_CODE_HOOK_NOTICE_PATTERN = exports.COMMAND_CODE_BANNER_PATTERNS = exports.COMMAND_CODE_MODE_INDICATOR_PATTERN = exports.COMMAND_CODE_COMPLETION_PATTERN = exports.COMMAND_CODE_RESPONSE_MARKER_PATTERN = exports.COMMAND_CODE_THINKING_PATTERN = exports.COMMAND_CODE_INTERRUPT_HINT_PATTERN = exports.COMMAND_CODE_SEPARATOR_PATTERN = exports.COMMAND_CODE_PROMPT_PATTERN = exports.COMMAND_CODE_SPINNER_CHARS = exports.ANTIGRAVITY_SKIP_PATTERNS = exports.ANTIGRAVITY_SURVEY_PATTERN = exports.ANTIGRAVITY_DIALOG_MAX_ROWS = exports.ANTIGRAVITY_DIALOG_BOUNDARY_PATTERN = exports.ANTIGRAVITY_SWITCH_MODEL_HEADER_PATTERN = exports.ANTIGRAVITY_NUMBERED_OPTION_PATTERN = exports.ANTIGRAVITY_NAVIGATE_FOOTER_PATTERN = exports.ANTIGRAVITY_SELECTION_LIST_PATTERN = exports.ANTIGRAVITY_SEPARATOR_PATTERN = exports.ANTIGRAVITY_THINKING_PATTERN = exports.ANTIGRAVITY_PROMPT_PATTERN = exports.VIBE_LOCAL_THINKING_PATTERN = exports.VIBE_LOCAL_PROMPT_PATTERN = exports.COPILOT_SKIP_PATTERNS = exports.COPILOT_FOLDER_TRUST_ANSWER_KEY = exports.COPILOT_FOLDER_TRUST_SESSION_OPTION_PATTERN = exports.COPILOT_FOLDER_TRUST_ANCHORS = exports.COPILOT_SELECTION_FOOTER_PATTERN = exports.COPILOT_BOOT_BANNER_ANCHORS = exports.COPILOT_TRANSCRIPT_CONTINUATION_PATTERN = void 0;
 exports.isCodexTurnActive = isCodexTurnActive;
 exports.findClaudeChromeStart = findClaudeChromeStart;
 exports.isCodexPromptReady = isCodexPromptReady;
@@ -19,6 +19,7 @@ exports.readCopilotStatusBar = readCopilotStatusBar;
 exports.findCopilotChromeStart = findCopilotChromeStart;
 exports.isCopilotSelectionFrame = isCopilotSelectionFrame;
 exports.isCopilotFolderTrustDialog = isCopilotFolderTrustDialog;
+exports.locateAntigravityDialogRegion = locateAntigravityDialogRegion;
 exports.isAntigravityNumberedDialog = isAntigravityNumberedDialog;
 exports.findCommandCodeChromeStart = findCommandCodeChromeStart;
 exports.detectThinking = detectThinking;
@@ -1861,25 +1862,125 @@ exports.ANTIGRAVITY_SEPARATOR_PATTERN = /^─{3,}$/m;
  */
 exports.ANTIGRAVITY_SELECTION_LIST_PATTERN = /Switch Model|↑\/↓\s*Navigate/m;
 /**
- * The question line agy draws above its numbered permission dialog
- * (Issue #2270; measured on agy 1.1.25, pane 200x1000, 2026-09-04).
+ * The `↑/↓ Navigate` hint agy draws under every arrow-key screen it owns
+ * (Issue #2364; measured on agy 1.1.27, pane 200x1000, 2026-09-06).
  *
- * Anchored to the whole line so a model's prose that merely quotes the phrase
- * inside a sentence cannot match it.
+ * The same token {@link ANTIGRAVITY_SELECTION_LIST_PATTERN} matches, split out
+ * because the numbered-dialog reader anchors on THIS row and reads upward from
+ * it. It is the one thing all four measured agy dialogs share — the `Do you want
+ * to proceed?` command menu, the `Allow creation of this file?` file menu, the
+ * folder-trust screen and the `/model` picker all end on it — while the words
+ * after it differ on every one (`tab Amend · f full diff`, `tab Amend · ctrl+g
+ * edit/expand command`, `enter Confirm`, `←/→ Effort  enter Select`).
  */
-exports.ANTIGRAVITY_NUMBERED_DIALOG_QUESTION_PATTERN = /^\s*Do you want to proceed\?\s*$/m;
+exports.ANTIGRAVITY_NAVIGATE_FOOTER_PATTERN = /↑\/↓\s*Navigate/;
 /**
- * One numbered option row of that dialog: `> 1. Yes`, `  4. No`.
+ * One numbered option row of agy's dialogs: `> 1. Yes`, `  4. No`,
+ * `  2. No, deny creation`.
  *
- * The `>` gutter marks the highlighted row and is optional, because only one of
- * the four rows carries it.
+ * The `>` gutter marks the highlighted row and is optional, because only one
+ * of the rows carries it.
  */
 exports.ANTIGRAVITY_NUMBERED_OPTION_PATTERN = /^\s*>?\s*\d+\.\s+\S/m;
 /**
- * Is this frame agy's NUMBERED permission dialog rather than one of its
- * arrow-key-only pickers? (Issue #2270)
+ * The header of agy's `/model` picker (Issue #995).
  *
- * Both agy screens share the `↑/↓ Navigate` footer that
+ * Kept as its own exclusion even though the picker's rows already fail the
+ * numbered-row test: the Issue #2364 rule is written as "footer + numbered rows
+ * + NOT the Switch Model picker", and the picker is the one agy screen whose
+ * misreading has a measured cost (#995: NavigationButtons vanished).
+ */
+exports.ANTIGRAVITY_SWITCH_MODEL_HEADER_PATTERN = /^\s*Switch Model\s*$/;
+/**
+ * A row that ends the dialog block when reading UPWARD from the footer
+ * (Issue #2364).
+ *
+ * Everything agy draws above its own dialog panel carries one of these:
+ *
+ *  - a horizontal rule (the turn separator, the input-box border, or the rule
+ *    under the `Command` / `Create file` panel header);
+ *  - a `>`-prefixed row that is not a numbered option — the echoed user prompt,
+ *    the bare composer, the highlighted row of an UNNUMBERED picker (`> Gemini
+ *    3.8 Flash`, `> Yes, I trust this folder`) or of the slash-command popup
+ *    (`> /add-dir  Add a directory …`);
+ *  - a `●` tool-call row, a `⎿` tool-result row or a `▸ Thought for …` row.
+ *
+ * Bounding the block at the nearest one is what keeps a numbered list in the
+ * MODEL'S PROSE, sitting in the transcript above an open picker or popup, from
+ * being adopted as that screen's options. Wrapped option labels never start
+ * with any of these on the measured frames: agy prints the command text inside
+ * the quotes of `… commands that start with '<cmd>'`, indented under the row
+ * that opened it.
+ *
+ * `stripBoxDrawing` blanks the rule rows before the response poller's copy of
+ * the frame reaches this rule; the `●` / `>` rows survive it, so the block is
+ * bounded the same way on both paths.
+ */
+exports.ANTIGRAVITY_DIALOG_BOUNDARY_PATTERN = /^\s*(?:─{3,}\s*$|[●⎿▸]|>(?!\s*\d+\.\s+\S))/;
+/**
+ * How many rows above the `↑/↓ Navigate` footer the dialog block may reach.
+ *
+ * The tallest measured frame (`dialog-bash-wrapped.txt`: header, rule,
+ * `Requesting permission for:`, a four-row command, the question and four
+ * options of which two wrap onto three rows each) spans 18 rows; the cap leaves
+ * room for a longer command without letting a boundary-free frame drag the
+ * whole transcript into the block.
+ */
+exports.ANTIGRAVITY_DIALOG_MAX_ROWS = 60;
+/**
+ * agy's post-answer survey row (Issue #2364).
+ *
+ * Drawn once, in place of the composer, after some tool decisions:
+ *
+ * ```
+ *  How's the CLI experience so far? Help us improve:
+ *  [1] Good  [2] Fine  [3] Bad  [0] Skip
+ *
+ * ? for shortcuts …
+ * ```
+ *
+ * Every option sits on ONE row in `[N] label` form and the screen takes a
+ * typed digit, not the arrow keys; there is no `↑/↓ Navigate` footer and no bare
+ * `>` composer, so before this pattern existed the frame reached the `default`
+ * floor — `running`, with the chat surface showing "generating" over a screen
+ * that was waiting for a keypress. Anchored to the whole row.
+ */
+exports.ANTIGRAVITY_SURVEY_PATTERN = /^\s*\[1\]\s*Good\s+\[2\]\s*Fine\s+\[3\]\s*Bad\s+\[0\]\s*Skip\s*$/m;
+/**
+ * Find the rows between the last boundary and the last `↑/↓ Navigate` footer
+ * (Issue #2364).
+ *
+ * The footer is searched from the bottom, so an older dialog still in the
+ * scrollback above a newer one is never the one read. Returns null when the
+ * frame has no footer at all.
+ *
+ * @param lines - ANSI-stripped rows, box drawing optional
+ */
+function locateAntigravityDialogRegion(lines) {
+    let footer = -1;
+    for (let i = lines.length - 1; i >= 0; i--) {
+        if (exports.ANTIGRAVITY_NAVIGATE_FOOTER_PATTERN.test(lines[i])) {
+            footer = i;
+            break;
+        }
+    }
+    if (footer < 0)
+        return null;
+    const floor = Math.max(0, footer - exports.ANTIGRAVITY_DIALOG_MAX_ROWS);
+    let start = floor;
+    for (let i = footer - 1; i >= floor; i--) {
+        if (exports.ANTIGRAVITY_DIALOG_BOUNDARY_PATTERN.test(lines[i])) {
+            start = i + 1;
+            break;
+        }
+    }
+    return { start, footer };
+}
+/**
+ * Is this frame one of agy's NUMBERED dialogs rather than one of its
+ * arrow-key-only pickers? (Issue #2270, re-measured by Issue #2364)
+ *
+ * Both kinds of screen share the `↑/↓ Navigate` footer that
  * {@link ANTIGRAVITY_SELECTION_LIST_PATTERN} matches, which is why #997 could
  * widen that pattern to cover the permission menu — and why the menu then
  * resolved as `antigravity_selection_list`, `hasActivePrompt: false`. On the
@@ -1888,21 +1989,45 @@ exports.ANTIGRAVITY_NUMBERED_OPTION_PATTERN = /^\s*>?\s*\d+\.\s+\S/m;
  * options 2-4 became unreachable, while the poller and the push notification
  * described the very same frame as a `multiple_choice` prompt.
  *
- * The discriminator is the pair below, not the footer:
- *
- *  - `Do you want to proceed?` on its own line, and
- *  - at least one `N. label` row.
- *
- * The Switch Model picker has neither (its rows are unnumbered model names and
- * its header is `Switch Model`), so it keeps the #995 reading. Every other agy
- * arrow-key TUI keeps it too — this is deliberately a rule about the ONE dialog
- * whose frames were measured, not a general "numbers mean prompt" inference.
+ * #2270 told the two apart by the question line, `Do you want to proceed?`,
+ * because that was the one dialog it had measured. #2364 measured a second one
+ * — agy 1.1.27's file-creation menu asks `Allow creation of this file?` above
+ * `1. Yes, allow creation` / `2. No, deny creation` — and it fell straight back
+ * into the selection-list reading. So the rule is now about the STRUCTURE the
+ * dialogs share and the pickers lack:
+ *
+ *  - the `↑/↓ Navigate` footer,
+ *  - at least two `N. label` rows between the nearest boundary row and that
+ *    footer ({@link ANTIGRAVITY_DIALOG_BOUNDARY_PATTERN}), and
+ *  - no `Switch Model` header in that region.
+ *
+ * The Switch Model picker, the folder-trust screen and the slash-command popup
+ * all draw unnumbered rows (`> Gemini 3.8 Flash`, `> Yes, I trust this folder`,
+ * `> /add-dir …`), so they keep the #995 reading — and because a `>` row that
+ * is not numbered is itself a boundary, a numbered list in the transcript above
+ * one of them cannot be counted.
+ *
+ * True here means "hand the frame to the agy dialog reader"
+ * (`tools/antigravity/dialog.ts`), never "this is a prompt": a frame that
+ * passes this test and still fails to read is published as an unclassified
+ * frame, not as a selection list and never as "generating".
  *
  * Callers pass the same text they hand {@link ANTIGRAVITY_SELECTION_LIST_PATTERN}.
  */
 function isAntigravityNumberedDialog(text) {
-    return (exports.ANTIGRAVITY_NUMBERED_DIALOG_QUESTION_PATTERN.test(text) &&
-        exports.ANTIGRAVITY_NUMBERED_OPTION_PATTERN.test(text));
+    const lines = text.split('\n');
+    const region = locateAntigravityDialogRegion(lines);
+    if (region === null)
+        return false;
+    let numberedRows = 0;
+    for (let i = region.start; i < region.footer; i++) {
+        const line = lines[i];
+        if (exports.ANTIGRAVITY_SWITCH_MODEL_HEADER_PATTERN.test(line))
+            return false;
+        if (exports.ANTIGRAVITY_NUMBERED_OPTION_PATTERN.test(line))
+            numberedRows++;
+    }
+    return numberedRows >= 2;
 }
 /**
  * Antigravity (agy) skip patterns for response cleaning (Issue #988)
@@ -2421,6 +2546,15 @@ function buildDetectPromptOptions(cliToolId) {
     // the Pass 1 gate rejects these menus, so Auto-Yes never responds. Treat agy
     // like claude/opencode/copilot so Pass 2 collects its "1. Yes / … / N. No"
     // options and reports isPrompt=true.
+    //
+    // [Issue #2364] The `↑/↓ Navigate` dialogs themselves no longer reach
+    // `detectPrompt` on either production path: `tools/antigravity/detect.ts`
+    // (status) and `detectPromptWithOptions` (response poller) both read them
+    // with `detectAntigravityNumberedDialogPrompt` first, because the generic
+    // multiple-choice pass reads one row per option and agy wraps a long command
+    // across several rows of one label. What this setting still serves is every
+    // OTHER numbered agy screen — `/feedback`'s `1-6 Select & Continue` menu is
+    // the measured one — which the generic pass reads as before.
     if (cliToolId === 'antigravity') {
         return { requireDefaultIndicator: false };
     }