commandmate 0.33.2 → 0.34.0

package/dist/server/src/lib/hooks/hook-settings-generator.js

@@ -43,7 +43,7 @@
  * @module lib/hooks/hook-settings-generator
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PERMISSION_DENY_RULES = exports.TOOL_USE_MATCHER = exports.NOTIFICATION_MATCHER = exports.AUTH_TOKEN_ENV_VAR = exports.PERMISSION_REQUEST_TIMEOUT_SECONDS = exports.HOOK_TIMEOUT_SECONDS = exports.PERMISSION_REQUEST_PATH = exports.AGENT_EVENT_PATH = void 0;
+exports.PERMISSION_DENY_RULES = exports.TMUX_UNPINNED_DENY_RULES = exports.TOOL_USE_MATCHER = exports.NOTIFICATION_MATCHER = exports.AUTH_TOKEN_ENV_VAR = exports.PERMISSION_REQUEST_TIMEOUT_SECONDS = exports.HOOK_TIMEOUT_SECONDS = exports.PERMISSION_REQUEST_PATH = exports.AGENT_EVENT_PATH = void 0;
 exports.isHookInjectionEnabled = isHookInjectionEnabled;
 exports.isAuthTokenExpected = isAuthTokenExpected;
 exports.getHookSettingsDirectory = getHookSettingsDirectory;
@@ -127,6 +127,62 @@ exports.NOTIFICATION_MATCHER = 'permission_prompt|idle_prompt';
  * receiver takes.
  */
 exports.TOOL_USE_MATCHER = permission_request_payload_1.ASK_USER_QUESTION_TOOL;
+/**
+ * tmux spellings that reach whichever server the ambient environment points at
+ * (Issue #2442).
+ *
+ * On 2026-09-08 22:53 JST all 42 `mcbd-*` sessions on the default tmux server
+ * were destroyed by a socket-less `tmux kill-server` run from an ad-hoc Bash
+ * block — the second such wipe after 2026-08-02 (#1624). The block had set
+ * `TMUX_TMPDIR` first, which reads as isolation and is not: tmux consults it
+ * only while `$TMUX` is unset, and every CommandMate agent runs inside a pane.
+ *
+ * A tmux invocation carries its target as a *global option before the
+ * subcommand* — `-L <name>` (socket name) or `-S <path>` (socket path) — and
+ * both outrank `$TMUX`. So "which server does this hit" is decidable from the
+ * argv shape alone, and that is what these rules read: a command whose first
+ * word is `tmux` and whose second is a destroying or server-global subcommand
+ * names no socket and therefore hits the shared one.
+ *
+ * The pinned spelling of every rule below is deliberately *not* covered, which
+ * is what keeps the isolated-probe recipes in `docs/design/` working. "Not
+ * covered" means "no new deny rule matches it", not "pre-approved": such a
+ * command still goes through the session's normal permission handling.
+ *
+ * Aliases get their own entry because Claude's prefix matching is **token-exact
+ * and adjacency-sensitive**, measured on 2.1.266 in
+ * `docs/design/agent-hooks-permission-deny-verification.md` §6: a rule naming
+ * `tmux list-p` left `tmux list-panes` untouched, and one naming
+ * `tmux show-options -g` left both `tmux show-options -gv …` and
+ * `tmux show-options -t 0 -g` untouched. A single truncated rule covering a
+ * family is therefore not available — it would load without error and match
+ * nothing. `bind` / `unbind` / `set` are tmux's own documented aliases for
+ * `bind-key` / `unbind-key` / `set-option`; `kill-server` and `kill-session`
+ * have none.
+ *
+ * Shapes that escape these rules (absolute path, `bash -c`, another global
+ * option before the subcommand, tmux's unambiguous-prefix abbreviations,
+ * combined global flags) are measured and listed in §6.4 of the same document
+ * rather than guessed at here. This layer narrows the accident, it does not
+ * close the class — `env-clean` (#1740) is the after-the-fact detector.
+ */
+exports.TMUX_UNPINNED_DENY_RULES = [
+    // Destroys every session on the server it reaches. The 2026-08-02 and
+    // 2026-09-08 wipes were both this word.
+    'Bash(tmux kill-server:*)',
+    // `-t` included on purpose: an exact-match `kill-session -t '=name:'` is safe
+    // only about *what* it names, never about *where* — and the static guard's
+    // exemption for that spelling is why agent recipes must pin the socket.
+    'Bash(tmux kill-session:*)',
+    // Server-global mutations outlive the caller and are shared with every session
+    // on that server.
+    'Bash(tmux set-option -g:*)',
+    'Bash(tmux set -g:*)',
+    'Bash(tmux bind-key:*)',
+    'Bash(tmux bind:*)',
+    'Bash(tmux unbind-key:*)',
+    'Bash(tmux unbind:*)',
+];
 /**
  * Bash spellings this server refuses to let an agent run (Issue #1739).
  *
@@ -162,11 +218,15 @@ exports.TOOL_USE_MATCHER = permission_request_payload_1.ASK_USER_QUESTION_TOOL;
  * signals every process the user owns and `kill -9 -<pgid>` a whole group; the
  * default `kill` (SIGTERM) is untouched, so the graceful spelling of the same
  * intent is the one that survives.
+ *
+ * Issue #2442 adds the tmux half of the same story: see
+ * {@link TMUX_UNPINNED_DENY_RULES}.
  */
 exports.PERMISSION_DENY_RULES = [
     'Bash(pkill:*)',
     'Bash(killall:*)',
     'Bash(kill -9:*)',
+    ...exports.TMUX_UNPINNED_DENY_RULES,
 ];
 /** Relay script shipped with the package (`files: ["scripts/hooks/"]`). */
 const RELAY_SCRIPT_RELATIVE_PATH = (0, path_1.join)('scripts', 'hooks', 'cmate-agent-event.sh');

package/dist/server/src/lib/hooks/sources/antigravity/history.js

@@ -47,6 +47,25 @@
  * module reads only the former — see {@link ANTIGRAVITY_CLI_HOME_SEGMENTS} — and
  * the conversation ids are uuids in any case.
  *
+ * ## Saving and finishing are two questions (Issue #2443)
+ *
+ * agy writes no record that closes a turn, so "may this be saved" has to be
+ * answered from the shape of its last words — and an interim report has the
+ * same shape as a conclusion. #2438 made the row that follows repairable. #2443
+ * separates the *second* consequence of the same evidence: whether the body may
+ * be handed onward as the answer. Two states, and the reader reports which one
+ * the newest turn is in:
+ *
+ *  - **provisional** — History holds the turn, the scraper stands down, the row
+ *    keeps being re-read and grown, and `broadcastMessage('message_updated', …)`
+ *    refreshes what a browser is showing. Nothing leaves the server.
+ *  - **settled** — agy's own `Stop` arrived at or after the turn's newest
+ *    record, so the body is the one it finished on. The gate announces the
+ *    completion edge exactly once for that body.
+ *
+ * `docs/design/antigravity-turn-completion-2443.md` is the argument, including
+ * what happens when the evidence never arrives.
+ *
  * ## Nothing here throws
  *
  * Same contract as the other three readers, for the same reason: this runs
@@ -91,8 +110,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ANTIGRAVITY_TURN_RECHECK_LIMIT = exports.ANTIGRAVITY_CLI_HOME_SEGMENTS = exports.ANTIGRAVITY_TRANSCRIPT_TAIL_BYTES = void 0;
+exports.ANTIGRAVITY_TURN_RECHECK_LIMIT = exports.ANTIGRAVITY_UNSETTLED_TURN_LIMIT = exports.ANTIGRAVITY_CLI_HOME_SEGMENTS = exports.ANTIGRAVITY_TRANSCRIPT_TAIL_BYTES = void 0;
 exports.resetAntigravityTranscriptConversations = resetAntigravityTranscriptConversations;
+exports.resetAntigravityUnsettledTurns = resetAntigravityUnsettledTurns;
 exports.resolveAntigravityConversationId = resolveAntigravityConversationId;
 exports.resolveAntigravityHome = resolveAntigravityHome;
 exports.antigravityBrainRoot = antigravityBrainRoot;
@@ -159,12 +179,153 @@ const ANTIGRAVITY_CONVERSATION_ID_PATTERN = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9
  * did not would otherwise blank the pointer mid-session.
  */
 const conversationPointers = (globalThis.__antigravityTranscriptConversations ??= new Map());
+/**
+ * How many written-but-unconfirmed turns one instance may be following (#2443).
+ *
+ * The bound on the answer to "a saved row must be able to catch up with its
+ * conclusion even once three later turns have been written". Sixteen and not
+ * "however many are in the window", because the list is walked on **every**
+ * poll: each entry costs one indexed `findMessageByRequestId` and, only when
+ * that finds a row, one render of a turn that is already parsed. Sixteen turns
+ * is more than a working session accumulates without a single `Stop` arriving,
+ * and it is a fixed ceiling on a per-instance map rather than a function of a
+ * file somebody else appends to.
+ *
+ * Eviction is oldest-first and is a real loss of coverage, which is why it is
+ * logged (`antigravity-transcript-unsettled-evicted`) rather than silent. What
+ * is left is #2438's behaviour for that row: the newest
+ * {@link ANTIGRAVITY_TURN_RECHECK_LIMIT} turns are re-read regardless of this
+ * list, so an evicted entry loses the *extra* reach and not the ordinary one.
+ */
+exports.ANTIGRAVITY_UNSETTLED_TURN_LIMIT = 16;
+/**
+ * Which written turns are still waiting for agy to vouch for them (#2443).
+ *
+ * On `globalThis` for the reason {@link conversationPointers} is: under `next
+ * dev` the poller's bundle and the hook receiver's bundle each get their own
+ * copy of a module-scoped map, and a list only one of the two writers can see is
+ * not a list.
+ *
+ * In memory and not in SQLite, deliberately. The entry describes a turn this
+ * *process* wrote provisionally and has not seen confirmed; a restart loses it,
+ * and what remains is exactly {@link ANTIGRAVITY_TURN_RECHECK_LIMIT} — the same
+ * coverage #2438 shipped. Persisting it would make a row's repair depend on a
+ * table that outlives the transcript window it can only be repaired from.
+ */
+const unsettledTurns = (globalThis.__antigravityUnsettledTurns ??= new Map());
 function keyOf(target) {
     return (0, auto_yes_state_1.buildCompositeKey)(target.worktreeId, target.cliToolId, target.instanceId);
 }
-/** Forget every instance's pointer. Test seam. */
+/**
+ * Forget every instance's pointer and every unconfirmed row it was following.
+ *
+ * Test seam. Both maps, because they are two halves of one per-instance state:
+ * a suite that reset the pointer and kept the follow list would carry one test's
+ * `step_index` values into the next one's conversation.
+ */
 function resetAntigravityTranscriptConversations() {
     conversationPointers.clear();
+    unsettledTurns.clear();
+}
+/** Forget the unconfirmed rows alone. Test seam. */
+function resetAntigravityUnsettledTurns() {
+    unsettledTurns.clear();
+}
+/**
+ * The steps this instance is following in `conversationId`, oldest first.
+ *
+ * A conversation that is not the one the list was built for answers empty and
+ * drops the list: `/clear` mints a new conversation id, and following the old
+ * one's `step_index` values into it would re-check turns that are not the same
+ * turns. This is the leak test #2443 asks for, expressed as the read path
+ * rather than as a promise.
+ */
+function unsettledStepsFor(key, conversationId) {
+    const entry = unsettledTurns.get(key);
+    if (!entry)
+        return [];
+    if (entry.conversationId !== conversationId) {
+        unsettledTurns.delete(key);
+        return [];
+    }
+    return entry.steps;
+}
+/**
+ * Start, or stop, following one written turn (Issue #2443).
+ *
+ * `confirmed` is {@link AntigravityTurnCompletion.confirmed}: a turn agy has
+ * vouched for cannot grow again without a later record, and a later record takes
+ * the confirmation away and re-adds it here on the very next pass. So the list
+ * holds exactly the rows whose body is still provisional.
+ *
+ * @returns The step that was evicted to make room, or null
+ */
+function noteAntigravityTurnCompletion(key, conversationId, stepIndex, confirmed) {
+    const entry = unsettledTurns.get(key);
+    if (entry && entry.conversationId !== conversationId)
+        unsettledTurns.delete(key);
+    if (confirmed) {
+        const current = unsettledTurns.get(key);
+        if (!current)
+            return null;
+        current.steps = current.steps.filter((step) => step !== stepIndex);
+        if (current.steps.length === 0)
+            unsettledTurns.delete(key);
+        return null;
+    }
+    const current = unsettledTurns.get(key) ?? { conversationId, steps: [] };
+    unsettledTurns.set(key, current);
+    if (current.steps.includes(stepIndex))
+        return null;
+    current.steps.push(stepIndex);
+    if (current.steps.length <= exports.ANTIGRAVITY_UNSETTLED_TURN_LIMIT)
+        return null;
+    return current.steps.shift() ?? null;
+}
+/** Stop following steps the current read window no longer contains. */
+function forgetAntigravityTurnsOutsideWindow(key, conversationId, present) {
+    const entry = unsettledTurns.get(key);
+    if (!entry || entry.conversationId !== conversationId)
+        return [];
+    const dropped = entry.steps.filter((step) => !present.has(step));
+    if (dropped.length === 0)
+        return [];
+    entry.steps = entry.steps.filter((step) => present.has(step));
+    if (entry.steps.length === 0)
+        unsettledTurns.delete(key);
+    return dropped;
+}
+/**
+ * When this instance last reported that its loop stopped, or null (#2443).
+ *
+ * The one piece of evidence {@link resolveAntigravityTurnCompletion} is asked to
+ * judge against, read the way {@link resolveAntigravityConversationId} reads its
+ * own: dynamically, so `agent-event-state`'s module graph is not a static
+ * dependency of the poller, and defensively, so a state module that cannot be
+ * reached — or a build in which this reader is newer than its neighbour — is one
+ * that knows of no stop rather than one that throws inside the save path.
+ *
+ * `recordAgentStopEvent` runs **before** the Stop receiver asks for a capture
+ * (`lib/hooks/agent-event-service`), so the value is already there on the read
+ * that stop itself triggers. That ordering is what lets one seam serve both
+ * triggers instead of the receiver having to hand a flag down through the gate.
+ */
+async function resolveAntigravityStopAt(target) {
+    try {
+        const state = await Promise.resolve().then(() => __importStar(require('../../../../lib/session/agent-event-state')));
+        const read = state.getLastStopEventAt;
+        if (typeof read !== 'function')
+            return null;
+        return read(target.worktreeId, target.cliToolId, target.instanceId) ?? null;
+    }
+    catch (error) {
+        logger.debug('antigravity-transcript-stop-lookup-failed', {
+            worktreeId: target.worktreeId,
+            instanceId: target.instanceId ?? target.cliToolId,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return null;
+    }
 }
 /**
  * The conversation id this instance's transcript is under, or null.
@@ -306,6 +467,20 @@ function acceptAntigravityTranscriptPath(agyHome, candidate) {
  * is worth holding rather than saving. Every other false leaves it unset, which
  * the gate reads as `'unavailable'`.
  *
+ * **A saved turn is not a finished turn (Issue #2443).** #2438 made the frozen
+ * row repairable and left the other half of the damage in place: the same
+ * `true` that tells the poller to drop its scrape also told the relay that the
+ * turn was over, so an interim report was **delivered** to whoever had asked
+ * agy a question, and no later `message_updated` could take that back. So the
+ * `true` now carries a second word. `report.completion` is `'settled'` only
+ * when {@link resolveAntigravityTurnCompletion} can show, from agy's own `Stop`
+ * event, that the body in hand is the one it finished on; otherwise it is
+ * `'provisional'` — History still holds the row, the repair still runs on every
+ * later read, and nothing is announced to a relay. Rows written provisionally
+ * are followed by `step_index` (see {@link ANTIGRAVITY_UNSETTLED_TURN_LIMIT}),
+ * so the conclusion is still picked up once the turn has fallen out of
+ * {@link ANTIGRAVITY_TURN_RECHECK_LIMIT}'s window.
+ *
  * @param target - The instance whose turn just ended
  * @param capture - See {@link AntigravityTranscriptCapture}
  * @param report - Optional out-parameter; see `StructuredHistoryCaptureReport`
@@ -366,7 +541,36 @@ async function captureAntigravityTranscriptTurn(target, capture = {}, report) {
                 preludeRecords: built.preludeRecords,
             });
         }
+        // Issue #2443: one read of the evidence, applied to every turn in the
+        // window. `stopAt` is agy's own account of when its loop ended; see
+        // {@link resolveAntigravityTurnCompletion} for why an ordering against the
+        // turn's newest record — rather than a word, a silence or a `status` — is
+        // what the promotion to "final" rests on.
+        const instanceKey = keyOf(target);
+        const stopAt = await resolveAntigravityStopAt(target);
+        const completions = new Map();
+        for (const turn of built.turns) {
+            completions.set(turn.stepIndex, (0, transcript_1.resolveAntigravityTurnCompletion)(turn, stopAt));
+        }
+        const newestTurn = built.turns[built.turns.length - 1];
+        const newestCompletion = completions.get(newestTurn.stepIndex) ??
+            (0, transcript_1.resolveAntigravityTurnCompletion)(newestTurn, stopAt);
+        // A step this read can no longer see is a step no later read can repair:
+        // the 4 MiB tail slid past it, its `USER_INPUT` is outside the window, or
+        // the file was replaced. Logged rather than dropped in silence, because it
+        // is the boundary of what #2443 promises.
+        const forgotten = forgetAntigravityTurnsOutsideWindow(instanceKey, conversationId, new Set(built.turns.map((turn) => turn.stepIndex)));
+        if (forgotten.length > 0) {
+            logger.info('antigravity-transcript-unsettled-out-of-window', {
+                worktreeId: target.worktreeId,
+                instanceId,
+                conversationId,
+                steps: forgotten,
+                turnsInWindow: built.turns.length,
+            });
+        }
         const pending = await selectUnwrittenAntigravityTurns(target, built.turns);
+        const writtenTurns = built.turns.slice(0, built.turns.length - pending.turns.length);
         // Before anything is written: the rows that are already there (#2438). This
         // is deliberately ahead of the early return below, because "the newest turn
         // is already a row" is exactly the state the frozen row the Issue measured
@@ -375,9 +579,7 @@ async function captureAntigravityTranscriptTurn(target, capture = {}, report) {
         // sat in the transcript beside it. Written turns are re-checked whether or
         // not anything is pending, so an old turn can be repaired in the same pass
         // that writes a new one.
-        await refreshAntigravityTurnRows(target, built.turns
-            .slice(0, built.turns.length - pending.turns.length)
-            .slice(-exports.ANTIGRAVITY_TURN_RECHECK_LIMIT), path);
+        await refreshAntigravityTurnRows(target, selectAntigravityRecheckCandidates(writtenTurns, unsettledStepsFor(instanceKey, conversationId)), path, { instanceKey, conversationId, completions });
         if (pending.turns.length === 0) {
             logger.debug('antigravity-transcript-turns-already-saved', {
                 worktreeId: target.worktreeId,
@@ -387,6 +589,7 @@ async function captureAntigravityTranscriptTurn(target, capture = {}, report) {
             // Issue #2437: this turn is already History's Markdown, so the pane rows
             // behind it must stop being "unsaved output" the pre-send flush can pick up.
             await (0, assistant_response_saver_1.advanceCapturedLineForTranscriptTurn)(target);
+            reportAntigravityCompletion(report, newestTurn, newestCompletion);
             return true;
         }
         if (pending.turns.length > 1) {
@@ -413,7 +616,14 @@ async function captureAntigravityTranscriptTurn(target, capture = {}, report) {
         let captured = false;
         for (let index = 0; index < pending.turns.length; index += 1) {
             const turn = pending.turns[index];
-            captured = await writeAntigravityTurn(target, turn, (0, transcript_1.renderAntigravityTurn)(turn), resolveAssistantTimestampMs(turn, userRows[index], lastAntigravityRecordAt(turn), nextTurnOpensAt(pending.turns, userRows, index)), path, report);
+            captured = await writeAntigravityTurn(target, turn, (0, transcript_1.renderAntigravityTurn)(turn), resolveAssistantTimestampMs(turn, userRows[index], (0, transcript_1.antigravityTurnLastRecordAt)(turn), nextTurnOpensAt(pending.turns, userRows, index)), path, report);
+            // Issue #2443: a row now exists for this turn, and whether it is the body
+            // agy finished on is a separate question from whether it could be saved.
+            // An unconfirmed one joins the follow list so that its conclusion is still
+            // picked up once three later turns have pushed it out of #2438's window.
+            if (captured) {
+                noteUnsettledAntigravityTurn(target, instanceKey, turn, completions.get(turn.stepIndex) ?? (0, transcript_1.resolveAntigravityTurnCompletion)(turn, stopAt));
+            }
         }
         if (captured) {
             // Issue #2437: History now holds this turn as the agent's own Markdown.
@@ -421,6 +631,7 @@ async function captureAntigravityTranscriptTurn(target, capture = {}, report) {
             // `/send` arriving before the next poll tick saves the whole finished turn
             // a second time.
             await (0, assistant_response_saver_1.advanceCapturedLineForTranscriptTurn)(target);
+            reportAntigravityCompletion(report, newestTurn, newestCompletion);
         }
         return captured;
     }
@@ -585,23 +796,6 @@ function resolveAssistantTimestampMs(turn, userRow, lastRecordAt = 0, nextTurnOp
     const latest = nextTurnOpensAt === null ? Number.POSITIVE_INFINITY : nextTurnOpensAt - 1;
     return Math.max(earliest, Math.min(lastRecordAt, latest));
 }
-/**
- * When the last record agy wrote for this turn was made (Issue #2273).
- *
- * The maximum rather than `records.at(-1)`: `created_at` is agy's own field and
- * a record that carries none reads as null, so the last record in file order is
- * not always the last one with a clock on it.
- *
- * @returns Epoch ms, or 0 when the turn has no timestamped record
- */
-function lastAntigravityRecordAt(turn) {
-    let at = 0;
-    for (const record of turn.records) {
-        if (record.timestampMs !== null && record.timestampMs > at)
-            at = record.timestampMs;
-    }
-    return at;
-}
 /**
  * The instant the next pending turn's prompt row carries, or null (Issue #2273).
  *
@@ -727,7 +921,7 @@ async function growAntigravityTurnRow(target, existing, rendered, path) {
  *   {@link ANTIGRAVITY_TURN_RECHECK_LIMIT}
  * @returns How many rows were replaced
  */
-async function refreshAntigravityTurnRows(target, candidates, path) {
+async function refreshAntigravityTurnRows(target, candidates, path, follow) {
     if (candidates.length === 0)
         return 0;
     const [{ getDbInstance }, { findMessageByRequestId }] = await Promise.all([
@@ -737,10 +931,18 @@ async function refreshAntigravityTurnRows(target, candidates, path) {
     const db = getDbInstance();
     let updated = 0;
     for (const turn of candidates) {
-        if (!(0, transcript_1.isAntigravityTurnWritable)(turn))
-            continue;
+        // Issue #2443: the row lookup moved ahead of the writable check, because
+        // the follow list is a statement about ROWS. A turn that is open again has a
+        // row whose body is provisional by definition and must stay followed, and a
+        // candidate whose row has gone — History cleared, the key rewritten — is one
+        // nothing can repair and is dropped here rather than re-queried forever.
         const existing = findMessageByRequestId(db, target.worktreeId, (0, agent_transcript_1.antigravityTurnRequestId)(turn.conversationId, turn.stepIndex));
-        if (!existing)
+        if (!existing) {
+            noteAntigravityTurnCompletion(follow.instanceKey, follow.conversationId, turn.stepIndex, true);
+            continue;
+        }
+        noteUnsettledAntigravityTurn(target, follow.instanceKey, turn, follow.completions.get(turn.stepIndex) ?? (0, transcript_1.resolveAntigravityTurnCompletion)(turn, null));
+        if (!(0, transcript_1.isAntigravityTurnWritable)(turn))
             continue;
         if (await growAntigravityTurnRow(target, existing, (0, transcript_1.renderAntigravityTurn)(turn), path)) {
             updated += 1;
@@ -748,6 +950,79 @@ async function refreshAntigravityTurnRows(target, candidates, path) {
     }
     return updated;
 }
+/**
+ * The written turns to re-read on this pass (Issue #2443).
+ *
+ * Two sources, concatenated oldest-first and de-duplicated:
+ *
+ *  - **the newest {@link ANTIGRAVITY_TURN_RECHECK_LIMIT}**, which is #2438's
+ *    window exactly and is what covers the ordinary case — a row saved at an
+ *    interim report and concluded seconds later, while the session has not moved
+ *    on. It is kept as a floor rather than replaced, so a cold process (one that
+ *    restarted, or one whose follow list was evicted) still has #2438's reach.
+ *  - **the followed steps**, which are the rows this process wrote from a body
+ *    agy had not vouched for. They are the ones the limit above loses: four
+ *    prompts queued back to back push the first turn out of the window in
+ *    seconds, and nothing else in the system ever revisits it.
+ *
+ * The result is bounded by `ANTIGRAVITY_TURN_RECHECK_LIMIT +
+ * {@link ANTIGRAVITY_UNSETTLED_TURN_LIMIT}` — a fixed 19 — whatever the window
+ * holds, so a long transcript cannot make a poll's cost grow with it.
+ *
+ * @param writtenTurns - Turns in the window that already have rows, oldest first
+ * @param followed - `step_index` values from the follow list
+ */
+function selectAntigravityRecheckCandidates(writtenTurns, followed) {
+    const recent = writtenTurns.slice(-exports.ANTIGRAVITY_TURN_RECHECK_LIMIT);
+    if (followed.length === 0)
+        return recent;
+    const inRecent = new Set(recent.map((turn) => turn.stepIndex));
+    const followedSteps = new Set(followed);
+    const older = writtenTurns.filter((turn) => followedSteps.has(turn.stepIndex) && !inRecent.has(turn.stepIndex));
+    return older.length === 0 ? recent : [...older, ...recent];
+}
+/**
+ * Follow this row, or stop following it, and say so once (Issue #2443).
+ *
+ * The log line is the only place an operator can see why a repair did or did not
+ * keep happening, so it carries the reason word rather than the boolean:
+ * `no-stop-event` and `stop-before-last-record` are very different sessions.
+ */
+function noteUnsettledAntigravityTurn(target, instanceKey, turn, completion) {
+    const evicted = noteAntigravityTurnCompletion(instanceKey, turn.conversationId, turn.stepIndex, completion.confirmed);
+    if (evicted === null)
+        return;
+    logger.info('antigravity-transcript-unsettled-evicted', {
+        worktreeId: target.worktreeId,
+        instanceId: target.instanceId ?? target.cliToolId,
+        conversationId: turn.conversationId,
+        step: evicted,
+        limit: exports.ANTIGRAVITY_UNSETTLED_TURN_LIMIT,
+    });
+}
+/**
+ * Tell the caller whether the turn it was handed is final (Issue #2443).
+ *
+ * `completion` is what the gate reads to decide whether a relay may be told the
+ * turn ended; `completionKey` is what stops it being told twice about one body.
+ * The key names the turn **and** the instant of its newest record, so a turn
+ * that grows after being confirmed is a new state and is announced again once
+ * the new state is itself confirmed — which is exactly the `Stop`-then-`continue`
+ * case `./source` warns about, handled without a second rule.
+ *
+ * Left entirely alone when the body is not confirmed, apart from the word
+ * `provisional`: the gate defaults an absent `completion` to `settled`, so this
+ * is the one place antigravity opts out of the pre-#2443 announcement.
+ */
+function reportAntigravityCompletion(report, turn, completion) {
+    if (!report)
+        return;
+    report.completion = completion.confirmed ? 'settled' : 'provisional';
+    report.completionKey = completion.confirmed
+        ? `${(0, agent_transcript_1.antigravityTurnRequestId)(turn.conversationId, turn.stepIndex)}@${completion.lastRecordAt}`
+        : undefined;
+    report.completionReason = completion.reason;
+}
 /**
  * Write one rendered turn, unless it is already there.
  *

package/dist/server/src/lib/hooks/sources/antigravity/transcript.js

@@ -76,6 +76,8 @@ exports.isAntigravityTurnClosingRecord = isAntigravityTurnClosingRecord;
 exports.isAntigravityTurnWritable = isAntigravityTurnWritable;
 exports.isAntigravityPromptRecord = isAntigravityPromptRecord;
 exports.renderAntigravityTurn = renderAntigravityTurn;
+exports.antigravityTurnLastRecordAt = antigravityTurnLastRecordAt;
+exports.resolveAntigravityTurnCompletion = resolveAntigravityTurnCompletion;
 const event_mapper_1 = require("../event-mapper");
 const turn_body_1 = require("../turn-body");
 /**
@@ -444,3 +446,104 @@ function renderAntigravityTurn(turn) {
         unknownRecordTypes: [...unknown],
     };
 }
+/**
+ * Epoch ms of the newest record agy wrote inside this turn, or 0 (Issue #2443).
+ *
+ * The maximum rather than `records.at(-1)`: `created_at` is agy's own field and
+ * a record that carries none reads as null, so the last record in file order is
+ * not always the last one with a clock on it. The prompt record is deliberately
+ * outside the walk — `records` holds everything *after* the `USER_INPUT` — which
+ * is why {@link resolveAntigravityTurnCompletion} floors the comparison at
+ * {@link AntigravityTurnAccumulator.startedAt} as well.
+ *
+ * @returns Epoch ms, or 0 when the turn has no timestamped record
+ */
+function antigravityTurnLastRecordAt(turn) {
+    let at = 0;
+    for (const record of turn.records) {
+        if (record.timestampMs !== null && record.timestampMs > at)
+            at = record.timestampMs;
+    }
+    return at;
+}
+/**
+ * Whether agy has vouched for this turn's body (Issue #2443).
+ *
+ * ## What this is separate from, and why the separation is the Issue
+ *
+ * {@link isAntigravityTurnWritable} answers "may a row be written from this
+ * turn". It has to be generous — agy writes **no record that closes a turn**, so
+ * the shape of the last thing it wrote is all there is, and an interim report
+ * ("waiting for the worker") is prose with no `tool_calls` exactly like a
+ * conclusion is. #2438 made the row that follows from that repairable. What it
+ * could not make repairable is everything a save *triggers*: a relay delivering
+ * the interim body to the session that asked for the answer cannot be taken
+ * back, and `broadcastMessage('message_updated', …)` does not rewind it.
+ *
+ * So this is the second question — "is this body final" — and it is answered
+ * from a different kind of evidence, deliberately:
+ *
+ *  - **not the wording.** "waiting", "Waiting for" and their translations are a
+ *    model's prose, and a rule keyed on them is wrong the first time the model
+ *    is asked to answer in another language or writes a conclusion that mentions
+ *    waiting.
+ *  - **not a fixed quiet period.** The gaps measured on the reporting machine
+ *    were 3 / 58 / 156 s from an interim candidate to the next record and 9 /
+ *    113 / 118 s from the final one, which overlap: no constant separates them.
+ *  - **not `status: DONE`** (all 15 measured candidates carry it, early and
+ *    final alike) **and not `truncated_fields`**, which is agy saying it
+ *    shortened a field.
+ *
+ * ## The evidence that is used
+ *
+ * agy's own `Stop` hook, correlated by instant. `Stop` is agy reporting that its
+ * loop ended, and CommandMate already records when one arrived
+ * (`session/agent-event-state`'s `getLastStopEventAt`). What makes it usable
+ * despite `source.ts`'s warning that a `Stop` can be answered with
+ * `{"decision":"continue"}` is that the correlation is an ordering rather than a
+ * flag: a stop is evidence about the file **as it was when the stop arrived**.
+ *
+ *  - A resumed loop appends records *after* the stop, which pushes
+ *    `lastRecordAt` past `stopAt` and takes the confirmation away again. The
+ *    evidence therefore withdraws itself in exactly the case the warning is
+ *    about, with no `continue`-detection of its own.
+ *  - A stop belonging to the *previous* turn is older than this turn's records
+ *    and confirms nothing.
+ *  - No stop at all — hooks not wired up, agy killed, CommandMate restarted
+ *    since — is `no-stop-event`, and the caller keeps the body provisional
+ *    rather than promoting it.
+ *
+ * The residual is agy's clock resolution: `created_at` is written to the second,
+ * so a record appended in the same second as the stop compares equal to it.
+ * That is a sub-second window, it is bounded by one `created_at` tick, and the
+ * direction of the error is a body confirmed one record early rather than a turn
+ * confirmed that never ended.
+ *
+ * Pure: the stop instant is a parameter, so this file keeps its no-filesystem,
+ * no-database, no-`globalThis` contract and the rule is a property a test states
+ * against values rather than against a running server.
+ *
+ * @param turn - The turn to judge
+ * @param stopAt - Epoch ms of this instance's last `Stop`, or null when none has
+ *   been received
+ */
+function resolveAntigravityTurnCompletion(turn, stopAt) {
+    const lastRecordAt = antigravityTurnLastRecordAt(turn);
+    const base = { confirmed: false, lastRecordAt, stopAt };
+    // A turn agy is still working through has no final body to vouch for. Asked
+    // before the clock questions so that "it is still running" never reads as
+    // "its records are unstamped".
+    if (!isAntigravityTurnWritable(turn))
+        return { ...base, reason: 'turn-open' };
+    if (lastRecordAt <= 0)
+        return { ...base, reason: 'no-timestamped-record' };
+    if (stopAt === null)
+        return { ...base, reason: 'no-stop-event' };
+    // `startedAt` as well as the newest record: a turn whose records all predate
+    // its own prompt is a shape this reader has not seen, and taking the later of
+    // the two cannot make the test easier to pass.
+    if (stopAt < Math.max(lastRecordAt, turn.startedAt)) {
+        return { ...base, reason: 'stop-before-last-record' };
+    }
+    return { confirmed: true, reason: 'stop-after-last-record', lastRecordAt, stopAt };
+}