commandmate 0.33.3 → 0.34.0

package/dist/cli/utils/session-target.d.ts

@@ -15,7 +15,10 @@
  * compatibility path for a daemon older than the endpoint, reported as
  * `resolvedBy: 'client-fallback'` with a warning on stderr. It is deliberately
  * NOT kept in step with the server — adding the primary-anchor stage to it would
- * be growing the second authority back (DR2-008).
+ * be growing the second authority back (DR2-008). The one exception is a
+ * refusal, not a choice: an `--agent` that contradicts an unregistered
+ * tool-named instance is reported exactly as the server reports it (Issue
+ * #2487), because a copy that obeys it sends where the server would refuse to.
  */
 import type { ApiClient } from './api-client';
 /**
@@ -24,11 +27,22 @@ import type { ApiClient } from './api-client';
  * CLI keeps its own copy of API shapes (see api-responses.ts).
  */
 export type SessionTargetResolvedBy = 'explicit' | 'roster' | 'primary' | 'worktree-default' | 'fallback' | 'client-fallback';
-/** An explicit `--agent` that the roster contradicts. */
+/**
+ * An explicit `--agent` that the instance's declaration contradicts: its roster
+ * row, or — with no row — its own id when that id is a CLI tool id (the
+ * primary-instance anchor, #868; Issue #2487).
+ */
 export interface SessionTargetConflict {
     instanceId: string;
+    /** The tool the instance is declared as; for a primary-anchor conflict, the id itself. */
     rosterCliTool: string;
     requestedCliTool: string;
+    /**
+     * Set when the declaration is the primary-instance anchor rather than a
+     * roster row. Mirrors the server's field of the same name, which
+     * `resolve-target` sends; absent for a roster contradiction.
+     */
+    primaryAnchor?: true;
 }
 export interface CliSessionTarget {
     /**
@@ -56,15 +70,18 @@ export interface ResolveSessionTargetOptions {
  * @param client - API client aimed at the server
  * @param worktreeId - Worktree ID
  * @param options - `--instance` and `--agent` as the user gave them
- * @returns The resolved target, with `conflict` set when `--agent` contradicts the roster
+ * @returns The resolved target, with `conflict` set when `--agent` contradicts
+ *   the roster or the primary-instance anchor
  * @throws ApiError when the server's capabilities cannot be determined (auth
  *   failure, redirect, non-JSON body) — those are never treated as "old server"
  */
 export declare function resolveSessionTarget(client: ApiClient, worktreeId: string, options?: ResolveSessionTargetOptions): Promise<CliSessionTarget>;
 /**
- * The sentence shown when the roster and `--agent` disagree. Names both
- * declarations and the three ways out, because only the operator knows which of
- * the two is wrong.
+ * The sentence shown when the instance's declaration and `--agent` disagree.
+ * Names both declarations and the three ways out, because only the operator
+ * knows which of the two is wrong. A primary-anchor conflict has no roster row
+ * to re-register — `instances add --id <tool>` answers "already exists" — so its
+ * third way out is another instance.
  */
 export declare function describeSessionTargetConflict(conflict: SessionTargetConflict): string;
 //# sourceMappingURL=session-target.d.ts.map

package/dist/cli/utils/session-target.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-target.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/session-target.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAK9C;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAC/B,UAAU,GACV,QAAQ,GACR,SAAS,GACT,kBAAkB,GAClB,UAAU,GACV,iBAAiB,CAAC;AAEtB,yDAAyD;AACzD,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,0EAA0E;IAC1E,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,UAAU,EAAE,uBAAuB,CAAC;IACpC,gFAAgF;IAChF,QAAQ,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACxC;AAED,MAAM,WAAW,2BAA2B;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAuBD;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,gBAAgB,CAAC,CAM3B;AA6ED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,qBAAqB,GAAG,MAAM,CAMrF"}
+{"version":3,"file":"session-target.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/session-target.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAK9C;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAC/B,UAAU,GACV,QAAQ,GACR,SAAS,GACT,kBAAkB,GAClB,UAAU,GACV,iBAAiB,CAAC;AAEtB;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,0FAA0F;IAC1F,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,aAAa,CAAC,EAAE,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,0EAA0E;IAC1E,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,UAAU,EAAE,uBAAuB,CAAC;IACpC,gFAAgF;IAChF,QAAQ,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACxC;AAED,MAAM,WAAW,2BAA2B;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAuBD;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,gBAAgB,CAAC,CAM3B;AA4FD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,qBAAqB,GAAG,MAAM,CAcrF"}

package/dist/cli/utils/session-target.js

@@ -16,12 +16,16 @@
  * compatibility path for a daemon older than the endpoint, reported as
  * `resolvedBy: 'client-fallback'` with a warning on stderr. It is deliberately
  * NOT kept in step with the server — adding the primary-anchor stage to it would
- * be growing the second authority back (DR2-008).
+ * be growing the second authority back (DR2-008). The one exception is a
+ * refusal, not a choice: an `--agent` that contradicts an unregistered
+ * tool-named instance is reported exactly as the server reports it (Issue
+ * #2487), because a copy that obeys it sends where the server would refuse to.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveSessionTarget = resolveSessionTarget;
 exports.describeSessionTargetConflict = describeSessionTargetConflict;
 const types_1 = require("../types");
+const cli_tool_ids_1 = require("../config/cli-tool-ids");
 const agent_instances_1 = require("./agent-instances");
 const server_capabilities_1 = require("./server-capabilities");
 /**
@@ -40,7 +44,8 @@ function warnClientFallback() {
  * @param client - API client aimed at the server
  * @param worktreeId - Worktree ID
  * @param options - `--instance` and `--agent` as the user gave them
- * @returns The resolved target, with `conflict` set when `--agent` contradicts the roster
+ * @returns The resolved target, with `conflict` set when `--agent` contradicts
+ *   the roster or the primary-instance anchor
  * @throws ApiError when the server's capabilities cannot be determined (auth
  *   failure, redirect, non-JSON body) — those are never treated as "old server"
  */
@@ -73,6 +78,13 @@ async function resolveViaServer(client, worktreeId, options) {
  * primary-anchor stage and no worktree-default read — an old server applies
  * those itself when the CLI sends no `cliToolId`, and reimplementing them here
  * is how the second authority grew in the first place (DR2-008).
+ *
+ * The one thing borrowed from the server's chain is its refusal (Issue #2487):
+ * with no roster row, an `--agent` that differs from a tool-named instance id
+ * is the contradiction the server reports, and it is reported here with the
+ * same `conflict`. It resolves nothing — without `--agent` that id still
+ * resolves to nothing here — but taking the `--agent` would start an ad-hoc
+ * session under another tool's primary id, which the server now refuses.
  */
 async function resolveLocally(client, worktreeId, options) {
     const { instanceId, requestedCliTool } = options;
@@ -95,6 +107,14 @@ async function resolveLocally(client, worktreeId, options) {
         return degraded(requestedCliTool);
     }
     if (!registered) {
+        if (requestedCliTool && (0, cli_tool_ids_1.isCliToolId)(instanceId) && requestedCliTool !== instanceId) {
+            return degraded(instanceId, {
+                instanceId,
+                rosterCliTool: instanceId,
+                requestedCliTool,
+                primaryAnchor: true,
+            });
+        }
         return degraded(requestedCliTool);
     }
     if (requestedCliTool && requestedCliTool !== registered.cliTool) {
@@ -107,11 +127,19 @@ async function resolveLocally(client, worktreeId, options) {
     return degraded(registered.cliTool);
 }
 /**
- * The sentence shown when the roster and `--agent` disagree. Names both
- * declarations and the three ways out, because only the operator knows which of
- * the two is wrong.
+ * The sentence shown when the instance's declaration and `--agent` disagree.
+ * Names both declarations and the three ways out, because only the operator
+ * knows which of the two is wrong. A primary-anchor conflict has no roster row
+ * to re-register — `instances add --id <tool>` answers "already exists" — so its
+ * third way out is another instance.
  */
 function describeSessionTargetConflict(conflict) {
+    if (conflict.primaryAnchor) {
+        return (`instance '${conflict.instanceId}' is the primary instance of ${conflict.rosterCliTool}, `
+            + `but --agent ${conflict.requestedCliTool} was given. `
+            + `Drop --agent, pass --agent ${conflict.rosterCliTool}, or target a ${conflict.requestedCliTool} instance instead `
+            + `(e.g. --instance ${conflict.requestedCliTool}).`);
+    }
     return (`instance '${conflict.instanceId}' is registered as ${conflict.rosterCliTool}, `
         + `but --agent ${conflict.requestedCliTool} was given. `
         + `Drop --agent, pass --agent ${conflict.rosterCliTool}, or re-register the instance.`);

package/dist/server/locales/en/worktree.json

@@ -334,7 +334,10 @@
             "trace": "Copy the current trace id for support debugging",
             "tree": "Browse the session tree and jump to any point in it",
             "unshare": "Stop sharing the conversation",
-            "worktree": "Create, list, or switch git worktrees",
+            "worktree": {
+                "codex": "Start or continue a conversation in a new worktree",
+                "command-code": "Create, list, or switch git worktrees"
+            },
             "skill-doctor": "Show what each of your skills costs in context and how often it gets used, so you can find skills to turn off"
         }
     },
@@ -479,6 +482,7 @@
         "empty": "No messages yet",
         "emptyHint": "Sending a message starts the session",
         "openSearch": "Search this conversation",
+        "turnBoundary": "Next turn",
         "thinking": {
             "summary": "Thinking · {count}",
             "expand": "Show the reasoning",
@@ -504,7 +508,19 @@
             "awaitingAnswer": "Awaiting an answer",
             "unclassified": "Dialog not recognized",
             "resolved": "Resolved",
-            "unlabeled": "Approval dialog"
+            "unlabeled": "Approval dialog",
+            "unlabeledQuestion": "Question",
+            "autoAnswered": "Auto-answered",
+            "submitConfirmation": "Answer submission",
+            "confirmation": "Submission: {outcome}",
+            "summaryQuestions": "Questions · {count}",
+            "summaryConfirmations": "Submissions · {count}",
+            "summaryConfirmationsOnly": "Answer submissions · {count}",
+            "summarySeparator": " / ",
+            "expandQuestions": "Show the questions",
+            "collapseQuestions": "Hide the questions",
+            "expandMixed": "Show the questions and approvals",
+            "collapseMixed": "Hide the questions and approvals"
         },
         "previousSession": {
             "summary": "Previous session ({count})",
@@ -927,6 +943,9 @@
         "toolbarLabel": "Dialog answer keys",
         "caption": "Answer"
     },
+    "promptResponse": {
+        "refused": "Your answer was not sent because the dialog has changed. Please check the screen."
+    },
     "dismissPanelKeys": {
         "toolbarLabel": "Close this screen",
         "close": "Close (Esc)",

package/dist/server/locales/ja/worktree.json

@@ -334,7 +334,10 @@
             "trace": "サポート調査用に現在のトレース ID をコピー",
             "tree": "セッションツリーを辿って任意の地点へジャンプ",
             "unshare": "会話の共有を停止",
-            "worktree": "git worktree の作成・一覧・切り替え",
+            "worktree": {
+                "codex": "新しい worktree で会話を開始・再開する",
+                "command-code": "git worktree の作成・一覧・切り替え"
+            },
             "skill-doctor": "各スキルのコンテキスト消費量と使用頻度を表示し、オフにするスキルを特定"
         }
     },
@@ -479,6 +482,7 @@
         "empty": "まだメッセージはありません",
         "emptyHint": "送信するとセッションが起動します",
         "openSearch": "この会話を検索",
+        "turnBoundary": "ここから次のターン",
         "thinking": {
             "summary": "思考 {count} 件",
             "expand": "思考を開く",
@@ -504,7 +508,19 @@
             "awaitingAnswer": "応答待ち",
             "unclassified": "判別できないダイアログ",
             "resolved": "応答済み",
-            "unlabeled": "承認ダイアログ"
+            "unlabeled": "承認ダイアログ",
+            "unlabeledQuestion": "質問",
+            "autoAnswered": "自動回答",
+            "submitConfirmation": "質問の送信確認",
+            "confirmation": "送信確認: {outcome}",
+            "summaryQuestions": "質問 {count} 件",
+            "summaryConfirmations": "送信確認 {count} 件",
+            "summaryConfirmationsOnly": "質問の送信確認 {count} 件",
+            "summarySeparator": "・",
+            "expandQuestions": "質問を開く",
+            "collapseQuestions": "質問を閉じる",
+            "expandMixed": "質問と承認を開く",
+            "collapseMixed": "質問と承認を閉じる"
         },
         "previousSession": {
             "summary": "前回のセッション（{count} 件）",
@@ -927,6 +943,9 @@
         "toolbarLabel": "ダイアログへの回答キー",
         "caption": "回答"
     },
+    "promptResponse": {
+        "refused": "ダイアログの状態が変わったため送信できませんでした。画面を確認してください。"
+    },
     "dismissPanelKeys": {
         "toolbarLabel": "この画面を閉じる",
         "close": "閉じる (Esc)",

package/dist/server/src/config/schedule-config.js

@@ -10,7 +10,7 @@
  * [S4-014] UUID v4 format validation
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.UUID_V4_PATTERN = exports.DEFAULT_PERMISSIONS = exports.NO_PERMISSION_FLAGS = exports.OPENCODE_PERMISSIONS = exports.VIBE_LOCAL_PERMISSIONS = exports.GEMINI_PERMISSIONS = exports.COMMAND_CODE_PERMISSIONS = exports.ANTIGRAVITY_PERMISSIONS = exports.COPILOT_PERMISSIONS = exports.CODEX_SANDBOXES = exports.CLAUDE_PERMISSIONS = exports.MAX_SCHEDULE_CRON_LENGTH = exports.MAX_SCHEDULE_MESSAGE_LENGTH = exports.MAX_SCHEDULE_NAME_LENGTH = void 0;
+exports.UUID_V4_PATTERN = exports.DEFAULT_PERMISSIONS = exports.NO_PERMISSION_FLAGS = exports.OPENCODE_PERMISSIONS = exports.VIBE_LOCAL_PERMISSIONS = exports.GEMINI_PERMISSIONS = exports.COMMAND_CODE_SCHEDULE_PERMISSIONS = exports.COMMAND_CODE_YOLO_PERMISSION = exports.COMMAND_CODE_PERMISSIONS = exports.ANTIGRAVITY_PERMISSIONS = exports.COPILOT_PERMISSIONS = exports.CODEX_SANDBOXES = exports.CLAUDE_PERMISSIONS = exports.MAX_SCHEDULE_CRON_LENGTH = exports.MAX_SCHEDULE_MESSAGE_LENGTH = exports.MAX_SCHEDULE_NAME_LENGTH = void 0;
 exports.getPermissionOptionsForTool = getPermissionOptionsForTool;
 exports.isValidUuidV4 = isValidUuidV4;
 // =============================================================================
@@ -62,6 +62,41 @@ exports.COMMAND_CODE_PERMISSIONS = [
     'auto-accept',
     'dont-ask',
 ];
+/**
+ * The value that means `--yolo` in the Permission column (Issue #2454).
+ *
+ * Not a `--permission-mode` value — it is the flag name, the same trick
+ * {@link COPILOT_PERMISSIONS} plays with `allow-all-tools` / `yolo`. Named so
+ * the branch in `buildCliArgs` reads as a comparison against a vocabulary
+ * entry rather than against a bare string.
+ */
+exports.COMMAND_CODE_YOLO_PERMISSION = 'yolo';
+/**
+ * What the CMATE.md Permission column accepts for command-code (Issue #2454).
+ *
+ * {@link COMMAND_CODE_PERMISSIONS} is what `--permission-mode` accepts; this is
+ * what a *schedule* may say, and the two are different sets because `--yolo`
+ * lives on its own axis. The column is modelled on copilot's, where the cell
+ * holds a flag name (`allow-all-tools` / `yolo`) rather than a mode.
+ *
+ * ## Why `yolo` is first and is the default
+ *
+ * Measured on the 1.53.0 bundle: `commandcode -p …` injects a
+ * `print-permission-gate` mod unless `--yolo` was passed, and that mod answers
+ * `edit_file` / `write_file` / `shell_command` / `monitor_command` /
+ * `kill_shell` with `block: true`. `--permission-mode` does not reach the gate
+ * at all — every one of the five values leaves print mode read-only. The block
+ * does not fail the run: it ends exit 0 with `subtype: "success"`, so the
+ * execution log says the schedule succeeded and nothing was written.
+ *
+ * Before this Issue the column had no spelling for `--yolo`, so the parser
+ * filled an empty cell with `'default'` and `buildCliArgs`'s `--yolo` branch
+ * was unreachable from a schedule (#2454).
+ */
+exports.COMMAND_CODE_SCHEDULE_PERMISSIONS = [
+    exports.COMMAND_CODE_YOLO_PERMISSION,
+    ...exports.COMMAND_CODE_PERMISSIONS,
+];
 /** Allowed permission values for gemini CLI (no permission flags) */
 exports.GEMINI_PERMISSIONS = [];
 /** Allowed permission values for vibe-local CLI (no permission flags) */
@@ -108,7 +143,11 @@ exports.DEFAULT_PERMISSIONS = {
     opencode: '',
     copilot: 'allow-all-tools',
     antigravity: '--dangerously-skip-permissions',
-    'command-code': 'default',
+    // Issue #2454: `yolo`, not `default` -- see COMMAND_CODE_SCHEDULE_PERMISSIONS.
+    // Every `--permission-mode` value leaves `commandcode -p` read-only, and the
+    // run still reports success, so an unattended schedule that omits the column
+    // would look like it worked and change nothing.
+    'command-code': exports.COMMAND_CODE_YOLO_PERMISSION,
 };
 /**
  * Resolve the allowed Permission dropdown options for a CLI tool (Issue #824).
@@ -144,7 +183,10 @@ function getPermissionOptionsForTool(cliToolId) {
         case 'antigravity':
             return exports.ANTIGRAVITY_PERMISSIONS;
         case 'command-code':
-            return exports.COMMAND_CODE_PERMISSIONS;
+            // Issue #2454: the six-value column vocabulary, not the five
+            // `--permission-mode` choices -- the dropdown has to be able to offer
+            // `yolo`, which is the only value that lets print mode write.
+            return exports.COMMAND_CODE_SCHEDULE_PERMISSIONS;
         case 'gemini':
             return exports.GEMINI_PERMISSIONS;
         case 'vibe-local':

package/dist/server/src/lib/cli-tools/antigravity.js

@@ -8,14 +8,19 @@
  *   conversation area (grows downward) | bare "> " input box | status bar
  * The status bar reads "? for shortcuts ... <model>" when idle and
  * "esc to cancel ..." while generating. Patterns confirmed on a real machine.
+ * agy 1.2.1 leaves the idle half of that bar blank after a turn that used a
+ * tool (Issue #2478), so readiness is read off the input box — see
+ * {@link isAntigravityReady}.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AntigravityTool = void 0;
+exports.isAntigravityReady = isAntigravityReady;
 const base_1 = require("./base");
 const tmux_1 = require("../tmux/tmux");
 const submit_verified_sender_1 = require("./submit-verified-sender");
 const tmux_capture_cache_1 = require("../tmux/tmux-capture-cache");
 const cli_patterns_1 = require("../detection/cli-patterns");
+const frame_1 = require("../detection/tools/frame");
 const sources_1 = require("../../lib/hooks/sources");
 const agent_session_lifecycle_1 = require("../../lib/session/agent-session-lifecycle");
 const logger_1 = require("../../lib/logger");
@@ -51,10 +56,14 @@ const ANTIGRAVITY_INIT_MAX_ATTEMPTS = 30;
 /** Timeout for waiting for the prompt before sending a message. */
 const ANTIGRAVITY_PROMPT_WAIT_TIMEOUT_MS = 15000;
 /**
- * Idle REPL footer marker. agy shows "? for shortcuts" in the status bar ONLY
- * when the input prompt is live and ready — not during the startup trust dialog
- * (which shows "↑/↓ Navigate · enter Confirm") nor while generating (which shows
- * "esc to cancel"). So this is a reliable "ready" signal. (Confirmed on machine.)
+ * agy's own word for "idle", drawn on the status row under the input box
+ * ("? for shortcuts … <model>"). While generating the same row reads "esc to
+ * cancel"; the trust screen and the dialogs draw their own footers instead.
+ *
+ * Issue #2478: sufficient, no longer required. agy 1.2.1 does not redraw it
+ * after a turn that used a tool — the row keeps only the right-aligned model
+ * label (`tests/fixtures/antigravity-live-2478/after-tool-turn.txt`) — and a
+ * send that waited for it timed out on every later turn of that session.
  */
 const ANTIGRAVITY_READY_FOOTER_PATTERN = /\?\s+for\s+shortcuts/;
 /**
@@ -69,12 +78,88 @@ const ANTIGRAVITY_READY_FOOTER_PATTERN = /\?\s+for\s+shortcuts/;
  */
 const ANTIGRAVITY_TRUST_DIALOG_PATTERN = /Do you trust the contents of this project\?/;
 /**
- * Decide whether agy is at a genuine, ready input prompt.
- * The idle footer is present AND no trust dialog is awaiting confirmation.
+ * Read agy's input box off the bottom of a frame (Issue #2478).
+ *
+ * agy draws the box — a bare `>` between two rules, its status row under the
+ * lower one — as the last thing on the screen, and everything else it can show
+ * either replaces the box (the permission dialogs, the trust screen, the
+ * post-answer survey) or is drawn below it (the `/model` picker, the slash
+ * command popup, `/feedback`'s category menu). So a frame that ENDS in the box
+ * is one whose input box is live, and a `>` row with more than the status row
+ * under it is not a box anyone can type into.
+ *
+ * This is stricter than the status detector's `promptPattern.test(lastLines)`
+ * (`detection/tools/antigravity/detect.ts`), which accepts the `>` anywhere in
+ * the 15-row tail: the detector tells `/feedback`'s menu apart only in the
+ * shared generic prompt step that runs before it, and this check does not run
+ * that step. The rows between the `>` and the lower rule may be blank — agy
+ * 1.2.1 leaves the box three rows tall after a tool turn.
+ *
+ * @param contentLines - ANSI-stripped rows, trailing blank rows dropped
+ * @returns The status row under the box ('' when agy drew none), or null when
+ *   the frame does not end in the box
+ */
+function readInputBoxStatusRow(contentLines) {
+    const rows = contentLines.map((row) => row.trim());
+    const isRule = (i) => i >= 0 && cli_patterns_1.ANTIGRAVITY_SEPARATOR_PATTERN.test(rows[i]);
+    const skipBlank = (from) => {
+        let i = from;
+        while (i >= 0 && rows[i] === '')
+            i--;
+        return i;
+    };
+    let i = rows.length - 1;
+    let statusRow = '';
+    if (i >= 0 && !isRule(i)) {
+        statusRow = rows[i];
+        i = skipBlank(i - 1);
+    }
+    if (!isRule(i))
+        return null;
+    i = skipBlank(i - 1);
+    if (i < 0 || !cli_patterns_1.ANTIGRAVITY_PROMPT_PATTERN.test(rows[i]))
+        return null;
+    return isRule(skipBlank(i - 1)) ? statusRow : null;
+}
+/**
+ * Decide whether a typed message would land in agy's input box (Issue #2478).
+ *
+ * Read on the status detector's evidence (`detection/tools/antigravity/detect.ts`)
+ * over the status detector's frame (`normalizeFrame`: ANSI stripped, padding
+ * dropped, the same 15-row tail):
+ *
+ *  1. No agy screen is up: the `Switch Model` / `↑/↓ Navigate` test its
+ *     `beforePrompt` makes (every branch after that test answers `waiting` or
+ *     `running`, so it covers the numbered dialogs too), and the trust
+ *     question. Both over the tail — with the pane 1000 rows tall the whole
+ *     transcript is in the capture, and a quoted question anywhere in it used
+ *     to block every send.
+ *  2. The frame ends in the input box ({@link readInputBoxStatusRow}).
+ *  3. agy is not generating. `? for shortcuts` on the status row settles it —
+ *     kept as a sufficient signal so a thought summary such as "Generating the
+ *     specified file" left in the tail cannot block a send the pre-#2478 rule
+ *     allowed. Without it, `afterThinking`'s reading: no spinner, `Generating`
+ *     or `esc to cancel` in the tail. The box stays on screen while agy
+ *     generates, so 2 alone would not do.
+ *
+ * Before #2478 the footer was required and the detector never read it, so the
+ * two disagreed on every frame agy 1.2.1 draws after a tool turn.
+ *
+ * @param output - A captured pane, raw or ANSI-stripped
+ * @returns True when the input box is live and agy is idle
  */
 function isAntigravityReady(output) {
-    return (ANTIGRAVITY_READY_FOOTER_PATTERN.test(output) &&
-        !ANTIGRAVITY_TRUST_DIALOG_PATTERN.test(output));
+    const frame = (0, frame_1.normalizeFrame)(output);
+    if (cli_patterns_1.ANTIGRAVITY_SELECTION_LIST_PATTERN.test(frame.lastLines))
+        return false;
+    if (ANTIGRAVITY_TRUST_DIALOG_PATTERN.test(frame.lastLines))
+        return false;
+    const statusRow = readInputBoxStatusRow(frame.contentLines);
+    if (statusRow === null)
+        return false;
+    if (ANTIGRAVITY_READY_FOOTER_PATTERN.test(statusRow))
+        return true;
+    return !(0, cli_patterns_1.detectThinking)('antigravity', frame.lastLines);
 }
 /**
  * Antigravity CLI tool implementation.
@@ -185,7 +270,7 @@ class AntigravityTool extends base_1.BaseCLITool {
      * Wait for agy to become ready (input prompt live).
      * Handles the first-run trust dialog ("Do you trust the contents of this
      * project?") by sending Enter to confirm the default "Yes, I trust this folder"
-     * selection. Polls until the idle footer is detected or max attempts reached.
+     * selection. Polls until {@link isAntigravityReady} or max attempts reached.
      */
     async waitForReady(sessionName) {
         // One-shot guard: capturePane keeps the dismissed dialog in scrollback, so
@@ -195,7 +280,7 @@ class AntigravityTool extends base_1.BaseCLITool {
             try {
                 const rawOutput = await (0, tmux_1.capturePane)(sessionName, 50);
                 const output = (0, cli_patterns_1.stripAnsi)(rawOutput);
-                // Ready: idle footer present and no trust dialog pending.
+                // Ready: the input box is live and no agy screen covers it.
                 if (isAntigravityReady(output)) {
                     logger.info('antigravity-prompt-detected');
                     return;