commandmate 0.33.3 → 0.34.1

package/dist/cli/commands/remote.js

@@ -7,6 +7,8 @@
  *   commandmate remote status     # Provider / URL / expiry / pairing state
  *   commandmate remote stop       # close the door, keeping the server running
  *
+ *   commandmate remote --auth remote-only   # only the phone's route authenticates
+ *
  * ## What lives here rather than in a Provider (§6.2)
  *
  * Two things, and both for the same reason — they are decisions about an
@@ -21,6 +23,17 @@
  *     Provider would have to re-derive interactive-vs-not per Provider, and its
  *     answer would be invisible to the caller that has to honour `--yes`.
  *
+ * ## How far the token reaches (Issue #2489)
+ *
+ * `--auth all` (the default) authenticates every listener, which is what #1937
+ * shipped. `--auth remote-only` runs a SECOND loopback listener, points the
+ * Provider at that one alone, and exempts the original from authentication — so
+ * the phone still pairs and the PC in front of the machine keeps working. The
+ * exemption is decided by which listener a request arrived on, never by its
+ * source address: a Provider's upstream IS 127.0.0.1, so every IP- and
+ * header-based answer here fails open. See `src/lib/ws-server.ts`'s ingress
+ * section for the full argument.
+ *
  * ## What this command deliberately does not have
  *
  *  - **`--token`.** `remote` is the side that MINTS a token; one supplied from
@@ -34,10 +47,13 @@
  *    local session down along with the remote one (§5.3).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.REMOTE_LAUNCH_ENV_KEYS = exports.PUBLIC_TUNNEL_PROVIDERS = exports.REMOTE_PROVIDER_ALIASES = exports.MAX_PAIRING_TTL_MS = exports.MIN_PAIRING_TTL_MS = exports.DEFAULT_PAIRING_EXPIRES = exports.DEFAULT_REMOTE_EXPIRES = void 0;
+exports.REMOTE_INGRESS_HOST = exports.DEFAULT_REMOTE_AUTH_SCOPE = exports.REMOTE_AUTH_SCOPES = exports.REMOTE_ONLY_LAUNCH_ENV_KEYS = exports.REMOTE_LAUNCH_ENV_KEYS = exports.PUBLIC_TUNNEL_PROVIDERS = exports.REMOTE_PROVIDER_ALIASES = exports.MAX_PAIRING_TTL_MS = exports.MIN_PAIRING_TTL_MS = exports.DEFAULT_PAIRING_EXPIRES = exports.DEFAULT_REMOTE_EXPIRES = void 0;
 exports.buildRemoteLaunchEnv = buildRemoteLaunchEnv;
 exports.applyRemoteLaunchEnv = applyRemoteLaunchEnv;
 exports.parsePairingDuration = parsePairingDuration;
+exports.parseAuthScope = parseAuthScope;
+exports.resolveEffectiveBind = resolveEffectiveBind;
+exports.isLoopbackBind = isLoopbackBind;
 exports.selectProvider = selectProvider;
 exports.runRemoteUp = runRemoteUp;
 exports.buildPairingUrl = buildPairingUrl;
@@ -56,6 +72,7 @@ const logger_1 = require("../utils/logger");
 const prompt_1 = require("../utils/prompt");
 const qr_terminal_1 = require("../utils/qr-terminal");
 const remote_state_1 = require("../utils/remote-state");
+const server_url_1 = require("../utils/server-url");
 const security_logger_1 = require("../utils/security-logger");
 const server_ready_1 = require("../utils/server-ready");
 const remote_1 = require("../../lib/remote");
@@ -106,6 +123,12 @@ exports.PUBLIC_TUNNEL_PROVIDERS = ['cloudflare-quick'];
  *    put here would be readable by the very agents CommandMate is driving
  *    (§7.2).
  *
+ *  - `CM_AUTH_SCOPE` — the `--auth` value (#2489). Not a secret and not a path:
+ *    the string `all` or `remote-only`, which is what `middleware.ts` and
+ *    `ws-server.ts` read to decide whether the local listener may skip the
+ *    token. Always exported, including for `all`, so the server is told what
+ *    was chosen rather than inferring it from a missing variable.
+ *
  * `tests/unit/cli/commands/remote-launch-env-1937.test.ts` holds the measured
  * set to this declaration in BOTH directions, the way
  * `agent-launch-plan-secrets-1933.test.ts` does for `prepareLaunch`. Adding a
@@ -115,6 +138,19 @@ exports.REMOTE_LAUNCH_ENV_KEYS = [
     'CM_AUTH_TOKEN_HASH',
     'CM_AUTH_EXPIRE',
     'CM_REMOTE_PAIRING_FILE',
+    'CM_AUTH_SCOPE',
+];
+/**
+ * The measured set for `--auth remote-only` (Issue #2489).
+ *
+ * One key more than {@link REMOTE_LAUNCH_ENV_KEYS}, and declared separately
+ * rather than as an "optional extra" so the exact-set measurement keeps working
+ * in BOTH directions for BOTH modes. A conditional key checked against a single
+ * list would be a list that describes neither mode.
+ */
+exports.REMOTE_ONLY_LAUNCH_ENV_KEYS = [
+    ...exports.REMOTE_LAUNCH_ENV_KEYS,
+    'CM_REMOTE_INGRESS_PORT',
 ];
 /**
  * Build the exact environment `remote` contributes to the server it starts.
@@ -124,15 +160,20 @@ exports.REMOTE_LAUNCH_ENV_KEYS = [
  * {@link REMOTE_LAUNCH_ENV_KEYS} — "what did remote add" is otherwise only
  * observable by diffing a global.
  *
- * @param input - Hash, expiry and handoff path
- * @returns The three variables, and nothing else
+ * @param input - Hash, expiry, handoff path and auth scope
+ * @returns Those variables, and nothing else
  */
 function buildRemoteLaunchEnv(input) {
-    return {
+    const env = {
         CM_AUTH_TOKEN_HASH: input.authTokenHash,
         CM_AUTH_EXPIRE: input.authExpire,
         CM_REMOTE_PAIRING_FILE: input.pairingFilePath,
+        CM_AUTH_SCOPE: input.authScope,
     };
+    if (input.authScope === 'remote-only' && input.remoteIngressPort !== undefined) {
+        env.CM_REMOTE_INGRESS_PORT = String(input.remoteIngressPort);
+    }
+    return env;
 }
 /**
  * Copy the launch env into `process.env`, where `daemon.ts` reads it.
@@ -187,6 +228,79 @@ function parsePairingDuration(value) {
     }
     return ms;
 }
+/**
+ * What the user may type after `--auth`, and the default when they type nothing.
+ *
+ * Issue #2489. `all` is the default deliberately: `remote-only` leaves every
+ * process on this machine — including the agents CommandMate itself runs in tmux
+ * — able to reach the API without a token, which is the same exposure as a
+ * CommandMate started without `--auth` at all, and weaker than `all`. Opting
+ * into that is the user's call to make, not a default to inherit.
+ */
+exports.REMOTE_AUTH_SCOPES = ['all', 'remote-only'];
+/** Auth scope applied when `--auth` is not given (Issue #2489). */
+exports.DEFAULT_REMOTE_AUTH_SCOPE = 'all';
+/**
+ * Where the `remote-only` ingress listener lives (Issue #2489).
+ *
+ * The literal loopback address, matching `REMOTE_INGRESS_BIND` in `server.ts`:
+ * both Providers dial `http://127.0.0.1:<port>`, and the listener must not be
+ * reachable from anywhere else.
+ */
+exports.REMOTE_INGRESS_HOST = '127.0.0.1';
+/**
+ * Loopback bind addresses that keep the local listener off the network.
+ *
+ * Issue #2489: `remote-only` makes the local listener unauthenticated, so it is
+ * refused when the server would bind anywhere a second machine can reach —
+ * otherwise "local means trusted" quietly becomes "the LAN means trusted".
+ * `server.ts` re-checks this against its own effective `CM_BIND`; this copy is
+ * what turns the mistake into an exit code instead of a degraded server.
+ */
+const LOOPBACK_BINDS = ['127.0.0.1', 'localhost', '::1', '[::1]'];
+/**
+ * Parse an `--auth` value.
+ *
+ * @param value - Raw flag value; undefined means the flag was not given
+ * @returns The scope to use
+ * @throws Error naming the valid values, for CONFIG_ERROR
+ */
+function parseAuthScope(value) {
+    if (value === undefined)
+        return exports.DEFAULT_REMOTE_AUTH_SCOPE;
+    const normalized = value.trim().toLowerCase();
+    const match = exports.REMOTE_AUTH_SCOPES.find((scope) => scope === normalized);
+    if (match === undefined) {
+        throw new Error(`Unknown --auth value: "${value}". Valid values: ${exports.REMOTE_AUTH_SCOPES.join(', ')}.`);
+    }
+    return match;
+}
+/**
+ * The bind address the server this session starts will actually listen on.
+ *
+ * Read through `loadEffectiveEnv()` rather than `process.env` because that is
+ * what `daemon.start()` hands the child: it layers `.env` OVER the exported
+ * environment, so a `CM_BIND=0.0.0.0` written in `~/.commandmate/.env` is
+ * invisible to `process.env` here and decisive for the server. Checking the
+ * wrong one is how this guard would pass while the thing it guards against
+ * happened anyway.
+ *
+ * This is the one place `remote` reads `CM_BIND`, and only in `remote-only`
+ * mode — §9.1's "remote neither reads nor writes CM_BIND" still holds for every
+ * other path, and `remote` never writes it.
+ *
+ * @returns The effective `CM_BIND`, defaulted the way `server.ts` defaults it
+ */
+function resolveEffectiveBind() {
+    return (0, server_url_1.loadEffectiveEnv)().CM_BIND || '127.0.0.1';
+}
+/**
+ * @param bind - An effective `CM_BIND` value
+ * @returns true when nothing outside this machine can reach that address
+ */
+function isLoopbackBind(bind) {
+    return LOOPBACK_BINDS.includes(bind.trim().toLowerCase());
+}
 /**
  * Apply the Provider selection rule (§6.2).
  *
@@ -376,6 +490,33 @@ async function runRemoteUp(options) {
         logger.error(`Invalid --pairing-expires value: ${(0, types_1.getErrorMessage)(error)}`);
         return types_1.ExitCode.CONFIG_ERROR;
     }
+    // Issue #2489. Both checks happen BEFORE any Provider is probed: neither an
+    // unknown `--auth` value nor a LAN-facing bind should cost the user a
+    // `tailscale serve` that then has to be reverted.
+    let authScope;
+    try {
+        authScope = parseAuthScope(options.auth);
+    }
+    catch (error) {
+        logger.error((0, types_1.getErrorMessage)(error));
+        return types_1.ExitCode.CONFIG_ERROR;
+    }
+    if (authScope === 'remote-only') {
+        const bind = resolveEffectiveBind();
+        if (!isLoopbackBind(bind)) {
+            logger.error(`--auth remote-only requires a loopback CM_BIND, but this server would bind to ${bind}.`);
+            logger.info('In this mode the local listener answers without a token, so a non-loopback bind would ' +
+                'extend that to every host that can reach this machine.');
+            logger.info('Set CM_BIND=127.0.0.1, or run "commandmate remote --auth all".');
+            (0, security_logger_1.logSecurityEvent)({
+                timestamp: new Date().toISOString(),
+                command: 'remote',
+                action: 'failure',
+                details: `up: remote-only refused (CM_BIND=${bind})`,
+            });
+            return types_1.ExitCode.CONFIG_ERROR;
+        }
+    }
     // 1. Probe every Provider, then apply the selection rule here (§6.2).
     const candidates = await (0, remote_1.detectRemoteProviders)();
     const selection = selectProvider(candidates, options.provider);
@@ -416,9 +557,31 @@ async function runRemoteUp(options) {
     const sessionToken = (0, auth_1.generateToken)();
     const authTokenHash = (0, auth_1.hashToken)(sessionToken);
     const pairing = (0, pairing_code_1.createPairingHandoff)({ ttlMs: pairingTtlMs, sessionToken });
+    // 4b. Issue #2489: in `remote-only` the Provider gets a socket of its own, so
+    // "which listener did this arrive on" can answer "does this need a token".
+    // Picked here rather than by the server because the Provider is started from
+    // this process and has to be pointed somewhere; the server re-validates the
+    // value and falls back to authenticating everything if it cannot use it.
+    let remoteIngressPort;
+    if (authScope === 'remote-only') {
+        try {
+            remoteIngressPort = await (0, remote_1.findFreeLoopbackPort)();
+        }
+        catch (error) {
+            logger.error(`Could not reserve a loopback port for the remote listener: ${(0, types_1.getErrorMessage)(error)}`);
+            (0, pairing_code_1.consumePairingHandoff)(pairing.filePath);
+            return types_1.ExitCode.START_FAILED;
+        }
+    }
     // 5. Start the server through the existing exit-free core. Not reimplemented:
     // `runStart` already owns .env loading, port allocation and the daemon spawn.
-    const restoreEnv = applyRemoteLaunchEnv(buildRemoteLaunchEnv({ authTokenHash, authExpire: expires, pairingFilePath: pairing.filePath }));
+    const restoreEnv = applyRemoteLaunchEnv(buildRemoteLaunchEnv({
+        authTokenHash,
+        authExpire: expires,
+        pairingFilePath: pairing.filePath,
+        authScope,
+        remoteIngressPort,
+    }));
     logger.info('Starting the CommandMate server...');
     const started = await (0, start_1.runStart)({ daemon: true, port: options.port });
     if (!started.ok) {
@@ -442,11 +605,31 @@ async function runRemoteUp(options) {
         return types_1.ExitCode.START_FAILED;
     }
     logger.success(`Server: ${started.url} (pid ${started.pid})`);
+    // 6b. Issue #2489: the remote listener is fatal in exactly the same way. The
+    // server refuses `remote-only` rather than dying when it cannot open this
+    // socket — it must not take the user's local session down — so its absence
+    // reaches us as a port that never answers, and publishing a URL that fronts
+    // it would hand the user a QR code for nothing. Roll the whole session back.
+    if (remoteIngressPort !== undefined) {
+        if (!(await (0, server_ready_1.waitForServer)(exports.REMOTE_INGRESS_HOST, remoteIngressPort))) {
+            logger.error(`The server did not open its remote listener on ${exports.REMOTE_INGRESS_HOST}:${remoteIngressPort} in time.`);
+            logger.info('Nothing was published. Re-run, or use "commandmate remote --auth all".');
+            await rollback(daemonManager, pairing.filePath, restoreEnv);
+            return types_1.ExitCode.START_FAILED;
+        }
+        logger.success(`Remote listener: ${exports.REMOTE_INGRESS_HOST}:${remoteIngressPort} (authentication required)`);
+    }
     // 7. Open the outside door. The Provider is handed 127.0.0.1 explicitly; it
     // never reads CM_BIND (§9.1).
+    //
+    // Issue #2489: in `remote-only` it is handed the SEPARATE loopback port
+    // instead. That substitution is the whole mechanism — the Provider reaches
+    // only the listener that always authenticates, and the port the user's own
+    // browser and CLI dial is never published.
+    const publishedPort = remoteIngressPort ?? endpoint.port;
     let handle;
     try {
-        handle = await provider.start({ port: endpoint.port, signal: new AbortController().signal });
+        handle = await provider.start({ port: publishedPort, signal: new AbortController().signal });
     }
     catch (error) {
         logger.error(`Provider ${provider.id} failed to start: ${(0, types_1.getErrorMessage)(error)}`);
@@ -472,7 +655,12 @@ async function runRemoteUp(options) {
         expiresAt: now + expiresMs,
         pairing: { filePath: pairing.filePath, expiresAt: pairing.expiresAt },
         handle,
-        server: { pid: started.pid ?? null, port: endpoint.port },
+        server: {
+            pid: started.pid ?? null,
+            port: endpoint.port,
+            remoteIngressPort: remoteIngressPort ?? null,
+        },
+        authScope,
     };
     try {
         (0, remote_state_1.writeRemoteState)(state);
@@ -493,7 +681,7 @@ async function runRemoteUp(options) {
         command: 'remote',
         action: 'success',
         // Neither the pairing code nor the token appears here (§5.2).
-        details: `up: provider=${handle.provider} port=${endpoint.port}`,
+        details: `up: provider=${handle.provider} port=${publishedPort} auth=${authScope}`,
     });
     if (options.json) {
         // NOT a pure-JSON stream, and saying so is better than implying otherwise:
@@ -504,13 +692,19 @@ async function runRemoteUp(options) {
         console.log(JSON.stringify({
             action: 'up',
             provider: state.provider,
+            authScope: state.authScope ?? exports.DEFAULT_REMOTE_AUTH_SCOPE,
             url: state.url,
             // The one-time display, in the form a machine caller can use. `status`
             // never emits this field - the code is shown by `up` or not at all.
             pairingUrl,
             expiresAt: new Date(state.expiresAt).toISOString(),
             pairing: { expiresAt: new Date(state.pairing.expiresAt).toISOString() },
-            server: { pid: state.server.pid, port: state.server.port, url: started.url },
+            server: {
+                pid: state.server.pid,
+                port: state.server.port,
+                url: started.url,
+                remoteIngressPort: state.server.remoteIngressPort ?? null,
+            },
         }, null, 2));
     }
     return types_1.ExitCode.SUCCESS;
@@ -685,6 +879,9 @@ async function runRemoteStatus(options) {
             action: 'status',
             remote: {
                 provider: state.provider,
+                // Issue #2489: what `--auth` this session ran with. A record written
+                // before #2489 has no such field and was, by construction, `all`.
+                authScope: state.authScope ?? exports.DEFAULT_REMOTE_AUTH_SCOPE,
                 // The URL is public information; the pairing code and the token are
                 // not, and neither appears here or anywhere else in `status` (§5.4).
                 url: state.url,
@@ -696,6 +893,10 @@ async function runRemoteStatus(options) {
                     state: pairing,
                     expiresAt: new Date(state.pairing.expiresAt).toISOString(),
                 },
+                server: {
+                    port: state.server.port,
+                    remoteIngressPort: state.server.remoteIngressPort ?? null,
+                },
             },
             server,
         }, null, 2));
@@ -703,6 +904,7 @@ async function runRemoteStatus(options) {
     else {
         logger.info(`Provider:        ${state.provider}`);
         logger.info(`URL:             ${state.url}`);
+        logger.info(`Auth scope:      ${describeAuthScope(state)}`);
         logger.info(`Remote expires:  ${new Date(state.expiresAt).toISOString()} (${formatRemaining(state.expiresAt - now)})`);
         logger.info(`Pairing:         ${pairing}`);
         logger.info(`Server:          ${describeServer(server)}`);
@@ -718,6 +920,26 @@ async function runRemoteStatus(options) {
     }
     return types_1.ExitCode.SUCCESS;
 }
+/**
+ * Render the `Auth scope:` line (Issue #2489).
+ *
+ * `remote-only` says where the exemption applies as well as that it exists: the
+ * difference between the two ports is the entire security boundary, so a line
+ * that named only the mode would leave the reader to guess which socket is
+ * which.
+ *
+ * @param state - The recorded session
+ * @returns The text after `Auth scope:`
+ */
+function describeAuthScope(state) {
+    const scope = state.authScope ?? exports.DEFAULT_REMOTE_AUTH_SCOPE;
+    if (scope !== 'remote-only') {
+        return 'all (every request needs the paired token)';
+    }
+    const ingress = state.server.remoteIngressPort;
+    return (`remote-only (provider port ${ingress ?? 'unknown'} needs the paired token; ` +
+        `http://${exports.REMOTE_INGRESS_HOST}:${state.server.port} on this machine does not)`);
+}
 /**
  * @param server - Daemon status, or null when there is no PID file
  * @returns The `Server:` line
@@ -839,6 +1061,7 @@ function createRemoteCommand() {
         .option('--pairing-expires <duration>', `Pairing code TTL, 1m-24h (default: ${exports.DEFAULT_PAIRING_EXPIRES})`)
         .option('-p, --port <number>', 'Port for the server to expose', parseInt)
         .option('--yes', 'Approve creating a public tunnel without prompting (required when non-interactive)')
+        .option('--auth <scope>', `How far authentication reaches: all or remote-only (default: ${exports.DEFAULT_REMOTE_AUTH_SCOPE})`)
         .option('--json', 'JSON output')
         // Deliberately absent: --token (remote mints its own; see the file header)
         // and every --auto-yes flag (§5.5).

package/dist/cli/commands/respond.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"respond.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/respond.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA2JpC,wBAAgB,oBAAoB,IAAI,OAAO,CAwK9C"}
+{"version":3,"file":"respond.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/respond.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA2JpC,wBAAgB,oBAAoB,IAAI,OAAO,CA4K9C"}

package/dist/cli/commands/respond.js

@@ -207,10 +207,14 @@ function createRespondCommand() {
             if (result && !result.success) {
                 // [DR2-06] Check reason for failure
                 const reason = result.reason || 'unknown';
-                // Issue #1681 / #1726: these two mean the server refused BEFORE
-                // sending, so the terminal is untouched — worth saying plainly,
-                // because the other reasons leave the answer's fate unknown.
-                const refusedBeforeSending = reason === 'unresolvable_answer' || reason === 'answer_out_of_range';
+                // Issue #1681 / #1726: these mean the server refused BEFORE sending,
+                // so the terminal is untouched — worth saying plainly, because the
+                // other reasons leave the answer's fate unknown. Issue #2486 adds
+                // `unsupported_dialog_layout`: a picker IS on screen but its layout
+                // could not be verified, and the server's message says what to do.
+                const refusedBeforeSending = reason === 'unresolvable_answer' ||
+                    reason === 'answer_out_of_range' ||
+                    reason === 'unsupported_dialog_layout';
                 // Issue #1898: the verdict was addressed to the agent's own API and
                 // the POST did not land. Distinct from the two above — the answer was
                 // resolved and an attempt was made — and distinct from a keystroke,

package/dist/cli/commands/send.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"send.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/send.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAoMpC,wBAAgB,iBAAiB,IAAI,OAAO,CAkP3C"}
+{"version":3,"file":"send.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/send.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA+MpC,wBAAgB,iBAAiB,IAAI,OAAO,CA0P3C"}

package/dist/cli/commands/send.js

@@ -18,6 +18,16 @@ const instances_1 = require("./instances");
 const relays_1 = require("./relays");
 /** Auto-yes duration used when --duration is omitted. */
 const DEFAULT_AUTO_YES_DURATION = '1h';
+/**
+ * The message length `send` is verified to deliver whole (Issue #2464): the
+ * largest body sent through the paste path to claude, codex, command-code and
+ * antigravity and found byte-identical in each tool's own transcript
+ * (`docs/design/2464-long-body-repro-matrix.md`). Stated in `--help` so a
+ * caller can choose "put it in a file" instead. A documented guarantee, not an
+ * enforced cap: a longer message takes the same path and the same check.
+ */
+const SEND_VERIFIED_MAX_KIB = 48;
+const SEND_VERIFIED_MAX_LINES = 240;
 /**
  * Code the send API returns when the session is blocked on a prompt (Issue
  * #1708). Mirrors PROMPT_WAITING_CODE in src/lib/session/prompt-waiting-guard.ts;
@@ -172,6 +182,14 @@ no pane to scrape. Watch it with \`commandmate relays\`, withdraw it with
 Exit 2 when the relay is refused: you are answering a relayed message already
 (pass --allow-relay-chain), the chain would exceed 3 hops, or an open relay
 between these two sessions exists. Nothing is sent in that case.
+
+Message length (Issue #2464): up to ${SEND_VERIFIED_MAX_KIB} KiB and ${SEND_VERIFIED_MAX_LINES} lines is verified
+to arrive whole on claude, codex, command-code and antigravity. A message over
+512 bytes is pasted into the agent's composer as one bracketed paste, and Enter
+waits until the composer shows all of it. If it never does, nothing is
+submitted and send exits 99 with "Message body did not arrive intact" -- it
+does not print "Message sent.". For a longer brief, write it to a file in the
+worktree and send a short message that tells the agent to read that file.
 `)
         .action(async (worktreeId, message, options) => {
         try {

package/dist/cli/commands/wait.d.ts

@@ -8,7 +8,9 @@
  *       selection lists — Issue #1628 — and interactive frames the detection
  *       layer could not classify at all — Issue #1708. Both are reported as
  *       exit 10 with a distinguishing `type` rather than a new exit code, so
- *       callers that already branch on 10 keep working.)
+ *       callers that already branch on 10 keep working. Issue #2463: a prompt
+ *       the target's own Auto-Yes is answering is held for --auto-yes-grace
+ *       seconds before it is reported.)
  * - 11: UPSTREAM_FAULT (--fail-on-upstream-fault only, Issue #1839: the agent
  *       came back to its composer with an upstream API failure on the frame)
  * - 124: TIMEOUT (--timeout exceeded)
@@ -48,6 +50,18 @@ import { ApiClient } from '../utils/api-client';
  * `"paths": {}`), so the test is the only thing holding the two together.
  */
 export declare const TURN_OPENING_EVENT_TYPES: ReadonlySet<string>;
+/**
+ * {@link pollWorktree}'s options: {@link WaitOptions} plus the Auto-Yes grace
+ * (Issue #2463).
+ */
+export interface PollWorktreeOptions extends WaitOptions {
+    /**
+     * `--auto-yes-grace`, in seconds; 0 turns the hold off. Absent means
+     * {@link AUTO_YES_GRACE_DEFAULT_SECONDS}, which is what `ask` gets: it calls
+     * {@link pollWorktree} without the flag.
+     */
+    autoYesGrace?: number;
+}
 /**
  * Poll a single worktree until completion, prompt, or timeout.
  *
@@ -56,12 +70,13 @@ export declare const TURN_OPENING_EVENT_TYPES: ReadonlySet<string>;
  * `send` + `wait` + "read the reply", and a private copy of the turn-boundary
  * rules here (#1839's `basis`, #1975's unanswered-prompt hold, #1708's
  * unclassified dwell) is a copy that would drift into reporting a completion
- * this one refuses.
+ * this one refuses. #2463's Auto-Yes hold is shared the same way: `ask` passes
+ * no `autoYesGrace` and holds for the default.
  *
  * `options.instance` must already be a resolved instance ID — see
  * {@link resolveWaitInstance}.
  */
-export declare function pollWorktree(client: ApiClient, worktreeId: string, options: WaitOptions): Promise<{
+export declare function pollWorktree(client: ApiClient, worktreeId: string, options: PollWorktreeOptions): Promise<{
     exitCode: number;
     output?: WaitPromptOutput;
 }>;

package/dist/cli/commands/wait.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wait.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/wait.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EAMV,gBAAgB,EACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,SAAS,EAA+B,MAAM,qBAAqB,CAAC;AAwD7E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,MAAM,CAIvD,CAAC;AA2bH;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;CAAE,CAAC,CA6X1D;AAwKD,wBAAgB,iBAAiB,IAAI,OAAO,CA2J3C"}
+{"version":3,"file":"wait.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/wait.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EAMV,gBAAgB,EACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,SAAS,EAA+B,MAAM,qBAAqB,CAAC;AAwD7E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,MAAM,CAIvD,CAAC;AA2dH;;;GAGG;AACH,MAAM,WAAW,mBAAoB,SAAQ,WAAW;IACtD;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAwCD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,gBAAgB,CAAA;CAAE,CAAC,CAqb1D;AAwKD,wBAAgB,iBAAiB,IAAI,OAAO,CAsL3C"}