commandmate 0.33.3 → 0.34.1

package/dist/cli/utils/remote-state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-state.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/remote-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEvE,oFAAoF;AACpF,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD,qEAAqE;AACrE,eAAO,MAAM,sBAAsB,MAAQ,CAAC;AAE5C;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAE7C,4EAA4E;AAC5E,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,+CAA+C;IAC/C,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,4EAA4E;IAC5E,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,OAAO,EAAE;QACP,sEAAsE;QACtE,QAAQ,EAAE,MAAM,CAAC;QACjB,8EAA8E;QAC9E,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,gFAAgF;IAChF,MAAM,EAAE,YAAY,CAAC;IACrB,4DAA4D;IAC5D,MAAM,EAAE;QACN,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;CACH;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAa5E;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAkBrE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAMzD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAqBlE"}
+{"version":3,"file":"remote-state.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/remote-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEvE,oFAAoF;AACpF,eAAO,MAAM,sBAAsB,gBAAgB,CAAC;AAEpD,qEAAqE;AACrE,eAAO,MAAM,sBAAsB,MAAQ,CAAC;AAE5C;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAE7C;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,aAAa,CAAC;AAEpD,4EAA4E;AAC5E,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,+CAA+C;IAC/C,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,4EAA4E;IAC5E,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,OAAO,EAAE;QACP,sEAAsE;QACtE,QAAQ,EAAE,MAAM,CAAC;QACjB,8EAA8E;QAC9E,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,gFAAgF;IAChF,MAAM,EAAE,YAAY,CAAC;IACrB,4DAA4D;IAC5D,MAAM,EAAE;QACN,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,EAAE,MAAM,CAAC;QACb;;;;;;;;;;;;WAYG;QACH,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACnC,CAAC;IACF;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,eAAe,CAAC;CAC7B;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAa5E;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAkBrE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAMzD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAqClE"}

package/dist/cli/utils/remote-state.js

@@ -164,6 +164,18 @@ function isRemoteState(value) {
         return false;
     if (typeof server.port !== 'number')
         return false;
+    // Issue #2489: present-and-wrong is rejected; absent is accepted and reads as
+    // "this session predates --auth", which is the compatibility this field needs.
+    if (server.remoteIngressPort !== undefined &&
+        server.remoteIngressPort !== null &&
+        typeof server.remoteIngressPort !== 'number') {
+        return false;
+    }
+    if (record.authScope !== undefined &&
+        record.authScope !== 'all' &&
+        record.authScope !== 'remote-only') {
+        return false;
+    }
     return isRemoteHandle(record.handle);
 }
 /**

package/dist/cli/utils/session-target.d.ts

@@ -15,7 +15,10 @@
  * compatibility path for a daemon older than the endpoint, reported as
  * `resolvedBy: 'client-fallback'` with a warning on stderr. It is deliberately
  * NOT kept in step with the server — adding the primary-anchor stage to it would
- * be growing the second authority back (DR2-008).
+ * be growing the second authority back (DR2-008). The one exception is a
+ * refusal, not a choice: an `--agent` that contradicts an unregistered
+ * tool-named instance is reported exactly as the server reports it (Issue
+ * #2487), because a copy that obeys it sends where the server would refuse to.
  */
 import type { ApiClient } from './api-client';
 /**
@@ -24,11 +27,22 @@ import type { ApiClient } from './api-client';
  * CLI keeps its own copy of API shapes (see api-responses.ts).
  */
 export type SessionTargetResolvedBy = 'explicit' | 'roster' | 'primary' | 'worktree-default' | 'fallback' | 'client-fallback';
-/** An explicit `--agent` that the roster contradicts. */
+/**
+ * An explicit `--agent` that the instance's declaration contradicts: its roster
+ * row, or — with no row — its own id when that id is a CLI tool id (the
+ * primary-instance anchor, #868; Issue #2487).
+ */
 export interface SessionTargetConflict {
     instanceId: string;
+    /** The tool the instance is declared as; for a primary-anchor conflict, the id itself. */
     rosterCliTool: string;
     requestedCliTool: string;
+    /**
+     * Set when the declaration is the primary-instance anchor rather than a
+     * roster row. Mirrors the server's field of the same name, which
+     * `resolve-target` sends; absent for a roster contradiction.
+     */
+    primaryAnchor?: true;
 }
 export interface CliSessionTarget {
     /**
@@ -56,15 +70,18 @@ export interface ResolveSessionTargetOptions {
  * @param client - API client aimed at the server
  * @param worktreeId - Worktree ID
  * @param options - `--instance` and `--agent` as the user gave them
- * @returns The resolved target, with `conflict` set when `--agent` contradicts the roster
+ * @returns The resolved target, with `conflict` set when `--agent` contradicts
+ *   the roster or the primary-instance anchor
  * @throws ApiError when the server's capabilities cannot be determined (auth
  *   failure, redirect, non-JSON body) — those are never treated as "old server"
  */
 export declare function resolveSessionTarget(client: ApiClient, worktreeId: string, options?: ResolveSessionTargetOptions): Promise<CliSessionTarget>;
 /**
- * The sentence shown when the roster and `--agent` disagree. Names both
- * declarations and the three ways out, because only the operator knows which of
- * the two is wrong.
+ * The sentence shown when the instance's declaration and `--agent` disagree.
+ * Names both declarations and the three ways out, because only the operator
+ * knows which of the two is wrong. A primary-anchor conflict has no roster row
+ * to re-register — `instances add --id <tool>` answers "already exists" — so its
+ * third way out is another instance.
  */
 export declare function describeSessionTargetConflict(conflict: SessionTargetConflict): string;
 //# sourceMappingURL=session-target.d.ts.map

package/dist/cli/utils/session-target.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-target.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/session-target.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAK9C;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAC/B,UAAU,GACV,QAAQ,GACR,SAAS,GACT,kBAAkB,GAClB,UAAU,GACV,iBAAiB,CAAC;AAEtB,yDAAyD;AACzD,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,0EAA0E;IAC1E,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,UAAU,EAAE,uBAAuB,CAAC;IACpC,gFAAgF;IAChF,QAAQ,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACxC;AAED,MAAM,WAAW,2BAA2B;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAuBD;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,gBAAgB,CAAC,CAM3B;AA6ED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,qBAAqB,GAAG,MAAM,CAMrF"}
+{"version":3,"file":"session-target.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/session-target.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAK9C;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAC/B,UAAU,GACV,QAAQ,GACR,SAAS,GACT,kBAAkB,GAClB,UAAU,GACV,iBAAiB,CAAC;AAEtB;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,0FAA0F;IAC1F,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,aAAa,CAAC,EAAE,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;;;;OAMG;IACH,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,0EAA0E;IAC1E,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,UAAU,EAAE,uBAAuB,CAAC;IACpC,gFAAgF;IAChF,QAAQ,EAAE,qBAAqB,GAAG,IAAI,CAAC;CACxC;AAED,MAAM,WAAW,2BAA2B;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAuBD;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,gBAAgB,CAAC,CAM3B;AA4FD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,qBAAqB,GAAG,MAAM,CAcrF"}

package/dist/cli/utils/session-target.js

@@ -16,12 +16,16 @@
  * compatibility path for a daemon older than the endpoint, reported as
  * `resolvedBy: 'client-fallback'` with a warning on stderr. It is deliberately
  * NOT kept in step with the server — adding the primary-anchor stage to it would
- * be growing the second authority back (DR2-008).
+ * be growing the second authority back (DR2-008). The one exception is a
+ * refusal, not a choice: an `--agent` that contradicts an unregistered
+ * tool-named instance is reported exactly as the server reports it (Issue
+ * #2487), because a copy that obeys it sends where the server would refuse to.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveSessionTarget = resolveSessionTarget;
 exports.describeSessionTargetConflict = describeSessionTargetConflict;
 const types_1 = require("../types");
+const cli_tool_ids_1 = require("../config/cli-tool-ids");
 const agent_instances_1 = require("./agent-instances");
 const server_capabilities_1 = require("./server-capabilities");
 /**
@@ -40,7 +44,8 @@ function warnClientFallback() {
  * @param client - API client aimed at the server
  * @param worktreeId - Worktree ID
  * @param options - `--instance` and `--agent` as the user gave them
- * @returns The resolved target, with `conflict` set when `--agent` contradicts the roster
+ * @returns The resolved target, with `conflict` set when `--agent` contradicts
+ *   the roster or the primary-instance anchor
  * @throws ApiError when the server's capabilities cannot be determined (auth
  *   failure, redirect, non-JSON body) — those are never treated as "old server"
  */
@@ -73,6 +78,13 @@ async function resolveViaServer(client, worktreeId, options) {
  * primary-anchor stage and no worktree-default read — an old server applies
  * those itself when the CLI sends no `cliToolId`, and reimplementing them here
  * is how the second authority grew in the first place (DR2-008).
+ *
+ * The one thing borrowed from the server's chain is its refusal (Issue #2487):
+ * with no roster row, an `--agent` that differs from a tool-named instance id
+ * is the contradiction the server reports, and it is reported here with the
+ * same `conflict`. It resolves nothing — without `--agent` that id still
+ * resolves to nothing here — but taking the `--agent` would start an ad-hoc
+ * session under another tool's primary id, which the server now refuses.
  */
 async function resolveLocally(client, worktreeId, options) {
     const { instanceId, requestedCliTool } = options;
@@ -95,6 +107,14 @@ async function resolveLocally(client, worktreeId, options) {
         return degraded(requestedCliTool);
     }
     if (!registered) {
+        if (requestedCliTool && (0, cli_tool_ids_1.isCliToolId)(instanceId) && requestedCliTool !== instanceId) {
+            return degraded(instanceId, {
+                instanceId,
+                rosterCliTool: instanceId,
+                requestedCliTool,
+                primaryAnchor: true,
+            });
+        }
         return degraded(requestedCliTool);
     }
     if (requestedCliTool && requestedCliTool !== registered.cliTool) {
@@ -107,11 +127,19 @@ async function resolveLocally(client, worktreeId, options) {
     return degraded(registered.cliTool);
 }
 /**
- * The sentence shown when the roster and `--agent` disagree. Names both
- * declarations and the three ways out, because only the operator knows which of
- * the two is wrong.
+ * The sentence shown when the instance's declaration and `--agent` disagree.
+ * Names both declarations and the three ways out, because only the operator
+ * knows which of the two is wrong. A primary-anchor conflict has no roster row
+ * to re-register — `instances add --id <tool>` answers "already exists" — so its
+ * third way out is another instance.
  */
 function describeSessionTargetConflict(conflict) {
+    if (conflict.primaryAnchor) {
+        return (`instance '${conflict.instanceId}' is the primary instance of ${conflict.rosterCliTool}, `
+            + `but --agent ${conflict.requestedCliTool} was given. `
+            + `Drop --agent, pass --agent ${conflict.rosterCliTool}, or target a ${conflict.requestedCliTool} instance instead `
+            + `(e.g. --instance ${conflict.requestedCliTool}).`);
+    }
     return (`instance '${conflict.instanceId}' is registered as ${conflict.rosterCliTool}, `
         + `but --agent ${conflict.requestedCliTool} was given. `
         + `Drop --agent, pass --agent ${conflict.rosterCliTool}, or re-register the instance.`);

package/dist/server/locales/en/worktree.json

@@ -334,7 +334,10 @@
             "trace": "Copy the current trace id for support debugging",
             "tree": "Browse the session tree and jump to any point in it",
             "unshare": "Stop sharing the conversation",
-            "worktree": "Create, list, or switch git worktrees",
+            "worktree": {
+                "codex": "Start or continue a conversation in a new worktree",
+                "command-code": "Create, list, or switch git worktrees"
+            },
             "skill-doctor": "Show what each of your skills costs in context and how often it gets used, so you can find skills to turn off"
         }
     },
@@ -479,6 +482,7 @@
         "empty": "No messages yet",
         "emptyHint": "Sending a message starts the session",
         "openSearch": "Search this conversation",
+        "turnBoundary": "Next turn",
         "thinking": {
             "summary": "Thinking · {count}",
             "expand": "Show the reasoning",
@@ -504,7 +508,19 @@
             "awaitingAnswer": "Awaiting an answer",
             "unclassified": "Dialog not recognized",
             "resolved": "Resolved",
-            "unlabeled": "Approval dialog"
+            "unlabeled": "Approval dialog",
+            "unlabeledQuestion": "Question",
+            "autoAnswered": "Auto-answered",
+            "submitConfirmation": "Answer submission",
+            "confirmation": "Submission: {outcome}",
+            "summaryQuestions": "Questions · {count}",
+            "summaryConfirmations": "Submissions · {count}",
+            "summaryConfirmationsOnly": "Answer submissions · {count}",
+            "summarySeparator": " / ",
+            "expandQuestions": "Show the questions",
+            "collapseQuestions": "Hide the questions",
+            "expandMixed": "Show the questions and approvals",
+            "collapseMixed": "Hide the questions and approvals"
         },
         "previousSession": {
             "summary": "Previous session ({count})",
@@ -927,6 +943,9 @@
         "toolbarLabel": "Dialog answer keys",
         "caption": "Answer"
     },
+    "promptResponse": {
+        "refused": "Your answer was not sent because the dialog has changed. Please check the screen."
+    },
     "dismissPanelKeys": {
         "toolbarLabel": "Close this screen",
         "close": "Close (Esc)",

package/dist/server/locales/ja/worktree.json

@@ -334,7 +334,10 @@
             "trace": "サポート調査用に現在のトレース ID をコピー",
             "tree": "セッションツリーを辿って任意の地点へジャンプ",
             "unshare": "会話の共有を停止",
-            "worktree": "git worktree の作成・一覧・切り替え",
+            "worktree": {
+                "codex": "新しい worktree で会話を開始・再開する",
+                "command-code": "git worktree の作成・一覧・切り替え"
+            },
             "skill-doctor": "各スキルのコンテキスト消費量と使用頻度を表示し、オフにするスキルを特定"
         }
     },
@@ -479,6 +482,7 @@
         "empty": "まだメッセージはありません",
         "emptyHint": "送信するとセッションが起動します",
         "openSearch": "この会話を検索",
+        "turnBoundary": "ここから次のターン",
         "thinking": {
             "summary": "思考 {count} 件",
             "expand": "思考を開く",
@@ -504,7 +508,19 @@
             "awaitingAnswer": "応答待ち",
             "unclassified": "判別できないダイアログ",
             "resolved": "応答済み",
-            "unlabeled": "承認ダイアログ"
+            "unlabeled": "承認ダイアログ",
+            "unlabeledQuestion": "質問",
+            "autoAnswered": "自動回答",
+            "submitConfirmation": "質問の送信確認",
+            "confirmation": "送信確認: {outcome}",
+            "summaryQuestions": "質問 {count} 件",
+            "summaryConfirmations": "送信確認 {count} 件",
+            "summaryConfirmationsOnly": "質問の送信確認 {count} 件",
+            "summarySeparator": "・",
+            "expandQuestions": "質問を開く",
+            "collapseQuestions": "質問を閉じる",
+            "expandMixed": "質問と承認を開く",
+            "collapseMixed": "質問と承認を閉じる"
         },
         "previousSession": {
             "summary": "前回のセッション（{count} 件）",
@@ -927,6 +943,9 @@
         "toolbarLabel": "ダイアログへの回答キー",
         "caption": "回答"
     },
+    "promptResponse": {
+        "refused": "ダイアログの状態が変わったため送信できませんでした。画面を確認してください。"
+    },
     "dismissPanelKeys": {
         "toolbarLabel": "この画面を閉じる",
         "close": "閉じる (Esc)",

package/dist/server/server.js

@@ -87,6 +87,83 @@ const session_cleanup_1 = require("./src/lib/session-cleanup");
 const dev = process.env.NODE_ENV !== 'production';
 const hostname = (0, env_1.getEnvByKey)('CM_BIND') || '127.0.0.1';
 const port = parseInt((0, env_1.getEnvByKey)('CM_PORT') || '3000', 10);
+/**
+ * Issue #2489: the `CM_AUTH_SCOPE` value that exempts the local listener.
+ *
+ * Written out here rather than imported from `src/lib/ws-server.ts`, which
+ * exports the same constant for the Node-runtime side, for the same reason the
+ * `x-cm-raw-url` header name below is written out: this is read at MODULE SCOPE,
+ * before `app.prepare()`, and everything server.ts evaluates that early has to
+ * stand on its own. `tests/integration/remote-ingress-auth-2489.test.ts` holds
+ * the two spellings equal, so a rename cannot leave one of them behind.
+ */
+const REMOTE_ONLY_AUTH_SCOPE = 'remote-only';
+/**
+ * Issue #2489: the loopback address the Provider's upstream is pointed at.
+ *
+ * `commandmate remote --auth remote-only` asks for "the phone authenticates,
+ * the PC in front of the machine does not". The listener a request landed on is
+ * the only unforgeable way to tell those apart (see the header of
+ * `src/lib/ws-server.ts`'s ingress section), so this bind is deliberately the
+ * literal loopback address rather than `hostname`: the second listener must
+ * never be reachable from the LAN, whatever `CM_BIND` says.
+ */
+const REMOTE_INGRESS_BIND = '127.0.0.1';
+/**
+ * Issue #2489: whether `CM_BIND` keeps the local listener off the network.
+ *
+ * `remote-only` makes the local listener unauthenticated, so a non-loopback
+ * bind would extend "local means trusted" to every host on the LAN. The CLI
+ * refuses that combination up front (exit 2); this is the second, independent
+ * check, because `CM_BIND` can also be set in `.env` or exported after the fact.
+ */
+function isLoopbackBind(bind) {
+    return bind === '127.0.0.1' || bind === 'localhost' || bind === '::1' || bind === '[::1]';
+}
+/**
+ * Fall back to authenticating every listener, and say why.
+ *
+ * Writes the decision back into `process.env` rather than only returning it:
+ * `middleware.ts` and `ws-server.ts` read `CM_AUTH_SCOPE` per request, so a
+ * degradation that lived in a local variable would leave the local listener
+ * exempt while this process believed it had closed the door.
+ */
+function refuseRemoteOnly(reason) {
+    console.error(`[Security] CM_AUTH_SCOPE=${REMOTE_ONLY_AUTH_SCOPE} refused: ${reason}. ` +
+        'Every listener will require authentication.');
+    process.env.CM_AUTH_SCOPE = 'all';
+    return null;
+}
+/**
+ * Resolve the port of the remote-only ingress listener, or null for one listener.
+ *
+ * Fail-closed at every branch: anything this cannot verify turns into
+ * {@link refuseRemoteOnly}, which is the pre-#2489 behaviour (auth everywhere).
+ *
+ * @returns The loopback port to open for the Provider, or null
+ */
+function resolveRemoteIngressPort() {
+    if (process.env.CM_AUTH_SCOPE !== REMOTE_ONLY_AUTH_SCOPE)
+        return null;
+    if (!isLoopbackBind(hostname)) {
+        return refuseRemoteOnly(`CM_BIND is ${hostname}, which is not loopback`);
+    }
+    const raw = process.env.CM_REMOTE_INGRESS_PORT;
+    if (!raw) {
+        return refuseRemoteOnly('CM_REMOTE_INGRESS_PORT is not set');
+    }
+    const parsed = Number.parseInt(raw, 10);
+    if (!Number.isInteger(parsed) || parsed < 1 || parsed > 65535) {
+        return refuseRemoteOnly(`CM_REMOTE_INGRESS_PORT is not a valid port: ${raw}`);
+    }
+    if (parsed === port) {
+        // One socket cannot be two ingresses, and "the Provider dials the port the
+        // user dials" is exactly the confusion this whole mechanism exists to avoid.
+        return refuseRemoteOnly('CM_REMOTE_INGRESS_PORT is the same port the server serves on');
+    }
+    return parsed;
+}
+const remoteIngressPort = resolveRemoteIngressPort();
 // Issue #331: HTTPS configuration
 const certPath = process.env.CM_HTTPS_CERT;
 const keyPath = process.env.CM_HTTPS_KEY;
@@ -162,14 +239,27 @@ async function resolveWorktreeAliasRedirect(url) {
 // All WebSocket upgrades are handled by ws-server.ts (our own upgrade listener).
 app.setupWebSocketHandler = () => { };
 app.prepare().then(() => {
-    // Request handler for both HTTP and HTTPS
-    const requestHandler = async (req, res) => {
+    // Request handler for both HTTP and HTTPS.
+    //
+    // Issue #2489: a factory rather than a single handler, because the ONE thing a
+    // request cannot lie about is the listener it arrived on, and that fact is
+    // only known here — at the point the listener is constructed. Every listener
+    // is built through this function, so every request is stamped; a listener
+    // wired up any other way would leave the caller's own `x-cm-ingress` in place,
+    // which is the single way this scheme can fail open.
+    const requestHandlerFor = (ingress) => async (req, res) => {
         // Guard: res must be a proper HTTP ServerResponse (not a raw net.Socket).
         // Defense-in-depth: normally not needed after the setupWebSocketHandler fix above,
         // but kept for safety in case any other path passes a non-ServerResponse object.
         if (typeof res?.setHeader !== 'function') {
             return;
         }
+        // Issue #2489: overwrite, unconditionally and before anything reads it.
+        // `middleware.ts` and `ws-server.ts` decide whether to demand a token from
+        // this value alone — deliberately NOT from `X-Real-IP` / `X-Forwarded-For` /
+        // `Host`, all of which a tunnelled request carries identically to a local
+        // one (a Provider's upstream IS 127.0.0.1).
+        (0, ws_server_1.stampIngress)(req.headers, ingress);
         // Issue #332: Inject X-Real-IP header for IP restriction
         // [S3-005] This applies to HTTP requests only. WebSocket upgrade requests
         // are skipped below and handled by ws-server.ts (which uses socket.remoteAddress directly).
@@ -241,15 +331,16 @@ app.prepare().then(() => {
         }
     };
     // Issue #331: Create HTTP or HTTPS server
-    let server;
+    let tlsOptions = null;
     let protocol = 'http';
     if (certPath && keyPath) {
         const validatedCertPath = validateCertPath(certPath, 'Certificate');
         const validatedKeyPath = validateCertPath(keyPath, 'Key');
         try {
-            const cert = (0, fs_1.readFileSync)(validatedCertPath);
-            const key = (0, fs_1.readFileSync)(validatedKeyPath);
-            server = (0, https_1.createServer)({ cert, key }, requestHandler);
+            tlsOptions = {
+                cert: (0, fs_1.readFileSync)(validatedCertPath),
+                key: (0, fs_1.readFileSync)(validatedKeyPath),
+            };
             protocol = 'https';
             console.log('HTTPS server created with TLS certificates');
         }
@@ -258,11 +349,35 @@ app.prepare().then(() => {
             process.exit(2);
         }
     }
-    else {
-        server = (0, http_1.createServer)(requestHandler);
-    }
+    /**
+     * Issue #2489: build one listener, stamped with its own ingress.
+     *
+     * The TLS material is read once above and shared, so the remote listener is
+     * the same server in every respect except which socket it answers on — which
+     * is the only difference that is allowed to matter.
+     */
+    const createListener = (ingress) => tlsOptions === null
+        ? (0, http_1.createServer)(requestHandlerFor(ingress))
+        : (0, https_1.createServer)(tlsOptions, requestHandlerFor(ingress));
+    const server = createListener('local');
+    /**
+     * Issue #2489: the listener `commandmate remote --auth remote-only` points the
+     * Provider at. Null in every other configuration, which is what keeps
+     * `--auth all` (and a plain `commandmate start`) on exactly one socket.
+     */
+    const remoteServer = remoteIngressPort === null ? null : createListener('remote');
+    // Issue #2489: stamp WebSocket upgrades too, and BEFORE `setupWebSocket`
+    // registers its own 'upgrade' listener — Node fires listeners in registration
+    // order, so this is what guarantees the auth check downstream reads a value
+    // this process wrote. HTTP and WS must agree: a phone drives the terminal over
+    // this socket, so a WS path that exempted more than the HTTP path would hand
+    // the tunnel a live shell while the screen behind it still asked for a token.
+    server.on('upgrade', (request) => (0, ws_server_1.stampIngress)(request.headers, 'local'));
+    remoteServer?.on('upgrade', (request) => (0, ws_server_1.stampIngress)(request.headers, 'remote'));
     // Setup WebSocket server
-    (0, ws_server_1.setupWebSocket)(server);
+    (0, ws_server_1.setupWebSocket)(server, {
+        additionalServers: remoteServer === null ? [] : [remoteServer],
+    });
     // Scan and sync worktrees on startup
     async function initializeWorktrees() {
         try {
@@ -466,9 +581,35 @@ app.prepare().then(() => {
         }
         process.exit(1);
     });
+    // Issue #2489: open the Provider's door on its own loopback socket.
+    //
+    // Started before the main `listen` so the CLI's readiness probe on this port
+    // cannot outrun it. An error here is NOT fatal to the process — killing the
+    // server would take the user's local session down with the remote one, which
+    // is the same reason `--expires` closes only the Provider (§5.3) — but it IS
+    // fail-closed: without this socket there is no "remote" ingress, so the local
+    // exemption is withdrawn and every listener goes back to demanding a token.
+    // `commandmate remote` then fails its readiness probe on this port and rolls
+    // the whole session back, which is where the user sees the error.
+    if (remoteServer !== null && remoteIngressPort !== null) {
+        remoteServer.on('error', (err) => {
+            console.error(`[Security] Remote ingress listener on ${REMOTE_INGRESS_BIND}:${remoteIngressPort} failed ` +
+                `(${err.code ?? err.message}). Every listener will require authentication.`);
+            process.env.CM_AUTH_SCOPE = 'all';
+        });
+        remoteServer.listen(remoteIngressPort, REMOTE_INGRESS_BIND, () => {
+            console.log(`> Remote ingress ready on ${protocol}://${REMOTE_INGRESS_BIND}:${remoteIngressPort} (authentication required)`);
+        });
+    }
     server.listen(port, hostname, async () => {
         console.log(`> Ready on ${protocol}://${hostname}:${port}`);
         console.log(`> WebSocket server ready`);
+        if (remoteIngressPort !== null) {
+            // Say it on the main "Ready" line too: "the PC does not need to log in" is
+            // a security-relevant departure from the default, and a server log that
+            // only mentions it in a line above is a log nobody reads.
+            console.log(`> Auth scope: ${REMOTE_ONLY_AUTH_SCOPE} — ${protocol}://${hostname}:${port} does not require a token`);
+        }
         // Issue #2113: verify that the URL the documentation advertises
         // (`http://localhost:<port>`) actually reaches THIS process. It does not when
         // another process holds `::1:<port>`: `localhost` resolves ::1 before 127.0.0.1
@@ -647,12 +788,59 @@ app.prepare().then(() => {
             console.log('Graceful shutdown timeout, forcing exit...');
             process.exit(1);
         }, 3000);
-        // Try graceful HTTP server close
-        server.close(() => {
-            clearTimeout(forceExitTimeout);
-            console.log('Server closed gracefully');
-            process.exit(0);
-        });
+        // Try graceful HTTP server close.
+        //
+        // Issue #2489: EVERY listener this process opened, not just the main one.
+        // `remoteServer` was absent from this function entirely, and the cost was
+        // asymmetry on the door the user cannot see: `server.close()`'s callback
+        // fires once the LOCAL connections have drained, and the `process.exit(0)`
+        // inside it then cut off any request still in flight through the provider.
+        // The local listener had three seconds of grace and the remote one had
+        // none. (The accept window between the teardown above and this point is the
+        // same for both listeners, and effectively zero — everything between the
+        // signal and here is synchronous, so the event loop never turns to accept a
+        // connection. The in-flight requests are the real loss.)
+        //
+        // The invariant, rather than the fix: whatever shutdown does to one
+        // listener it does to all of them. Anything added here belongs INSIDE this
+        // loop rather than on `server` alone — applying it to `server` only would
+        // put the asymmetry straight back on the listener nobody is looking at.
+        const listeners = remoteServer === null ? [server] : [server, remoteServer];
+        // `close()` stops each accept loop immediately and calls back once that
+        // listener's own connections have ended, so both doors shut now and the
+        // exit waits for the last one to drain. A listener that never reached
+        // `listen()` (EADDRINUSE on the remote port) calls its callback with an
+        // Error instead of throwing, which counts as drained here — which is what
+        // we want: a door that never opened cannot be holding anything.
+        let draining = listeners.length;
+        for (const listener of listeners) {
+            listener.close(() => {
+                draining -= 1;
+                if (draining > 0)
+                    return;
+                clearTimeout(forceExitTimeout);
+                console.log('Server closed gracefully');
+                process.exit(0);
+            });
+            // Issue #2488: close() stops accepting immediately, but its callback only
+            // fires once every ESTABLISHED connection on that listener is gone. A
+            // browser tab left on the dashboard holds keep-alive sockets with no
+            // request in flight, and nothing ever closes them, so the callback never
+            // ran and the process lived the full 3 seconds to the force-exit — with
+            // its listening socket already closed. That window is what the stop
+            // scripts used to mistake for "stopped" (they looked for a listener,
+            // found none, and returned while this process was still alive and still
+            // named by logs/server.pid).
+            //
+            // closeIdleConnections() ends exactly those sockets. A connection with a
+            // request in flight is NOT idle and is left alone: it still gets the 3
+            // seconds above, so an in-flight response is no more truncated than
+            // before. The stop scripts no longer depend on this being fast — they
+            // wait for the PID — but the common case now exits in milliseconds
+            // instead of 3 seconds. Per #2489's invariant this runs on EVERY
+            // listener, so the remote door drains on the same terms as the local one.
+            listener.closeIdleConnections();
+        }
     }
     process.on('SIGTERM', () => gracefulShutdown('SIGTERM'));
     process.on('SIGINT', () => gracefulShutdown('SIGINT'));

package/dist/server/src/config/schedule-config.js

@@ -10,7 +10,7 @@
  * [S4-014] UUID v4 format validation
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.UUID_V4_PATTERN = exports.DEFAULT_PERMISSIONS = exports.NO_PERMISSION_FLAGS = exports.OPENCODE_PERMISSIONS = exports.VIBE_LOCAL_PERMISSIONS = exports.GEMINI_PERMISSIONS = exports.COMMAND_CODE_PERMISSIONS = exports.ANTIGRAVITY_PERMISSIONS = exports.COPILOT_PERMISSIONS = exports.CODEX_SANDBOXES = exports.CLAUDE_PERMISSIONS = exports.MAX_SCHEDULE_CRON_LENGTH = exports.MAX_SCHEDULE_MESSAGE_LENGTH = exports.MAX_SCHEDULE_NAME_LENGTH = void 0;
+exports.UUID_V4_PATTERN = exports.DEFAULT_PERMISSIONS = exports.NO_PERMISSION_FLAGS = exports.OPENCODE_PERMISSIONS = exports.VIBE_LOCAL_PERMISSIONS = exports.GEMINI_PERMISSIONS = exports.COMMAND_CODE_SCHEDULE_PERMISSIONS = exports.COMMAND_CODE_YOLO_PERMISSION = exports.COMMAND_CODE_PERMISSIONS = exports.ANTIGRAVITY_PERMISSIONS = exports.COPILOT_PERMISSIONS = exports.CODEX_SANDBOXES = exports.CLAUDE_PERMISSIONS = exports.MAX_SCHEDULE_CRON_LENGTH = exports.MAX_SCHEDULE_MESSAGE_LENGTH = exports.MAX_SCHEDULE_NAME_LENGTH = void 0;
 exports.getPermissionOptionsForTool = getPermissionOptionsForTool;
 exports.isValidUuidV4 = isValidUuidV4;
 // =============================================================================
@@ -62,6 +62,41 @@ exports.COMMAND_CODE_PERMISSIONS = [
     'auto-accept',
     'dont-ask',
 ];
+/**
+ * The value that means `--yolo` in the Permission column (Issue #2454).
+ *
+ * Not a `--permission-mode` value — it is the flag name, the same trick
+ * {@link COPILOT_PERMISSIONS} plays with `allow-all-tools` / `yolo`. Named so
+ * the branch in `buildCliArgs` reads as a comparison against a vocabulary
+ * entry rather than against a bare string.
+ */
+exports.COMMAND_CODE_YOLO_PERMISSION = 'yolo';
+/**
+ * What the CMATE.md Permission column accepts for command-code (Issue #2454).
+ *
+ * {@link COMMAND_CODE_PERMISSIONS} is what `--permission-mode` accepts; this is
+ * what a *schedule* may say, and the two are different sets because `--yolo`
+ * lives on its own axis. The column is modelled on copilot's, where the cell
+ * holds a flag name (`allow-all-tools` / `yolo`) rather than a mode.
+ *
+ * ## Why `yolo` is first and is the default
+ *
+ * Measured on the 1.53.0 bundle: `commandcode -p …` injects a
+ * `print-permission-gate` mod unless `--yolo` was passed, and that mod answers
+ * `edit_file` / `write_file` / `shell_command` / `monitor_command` /
+ * `kill_shell` with `block: true`. `--permission-mode` does not reach the gate
+ * at all — every one of the five values leaves print mode read-only. The block
+ * does not fail the run: it ends exit 0 with `subtype: "success"`, so the
+ * execution log says the schedule succeeded and nothing was written.
+ *
+ * Before this Issue the column had no spelling for `--yolo`, so the parser
+ * filled an empty cell with `'default'` and `buildCliArgs`'s `--yolo` branch
+ * was unreachable from a schedule (#2454).
+ */
+exports.COMMAND_CODE_SCHEDULE_PERMISSIONS = [
+    exports.COMMAND_CODE_YOLO_PERMISSION,
+    ...exports.COMMAND_CODE_PERMISSIONS,
+];
 /** Allowed permission values for gemini CLI (no permission flags) */
 exports.GEMINI_PERMISSIONS = [];
 /** Allowed permission values for vibe-local CLI (no permission flags) */
@@ -108,7 +143,11 @@ exports.DEFAULT_PERMISSIONS = {
     opencode: '',
     copilot: 'allow-all-tools',
     antigravity: '--dangerously-skip-permissions',
-    'command-code': 'default',
+    // Issue #2454: `yolo`, not `default` -- see COMMAND_CODE_SCHEDULE_PERMISSIONS.
+    // Every `--permission-mode` value leaves `commandcode -p` read-only, and the
+    // run still reports success, so an unattended schedule that omits the column
+    // would look like it worked and change nothing.
+    'command-code': exports.COMMAND_CODE_YOLO_PERMISSION,
 };
 /**
  * Resolve the allowed Permission dropdown options for a CLI tool (Issue #824).
@@ -144,7 +183,10 @@ function getPermissionOptionsForTool(cliToolId) {
         case 'antigravity':
             return exports.ANTIGRAVITY_PERMISSIONS;
         case 'command-code':
-            return exports.COMMAND_CODE_PERMISSIONS;
+            // Issue #2454: the six-value column vocabulary, not the five
+            // `--permission-mode` choices -- the dropdown has to be able to offer
+            // `yolo`, which is the only value that lets print mode write.
+            return exports.COMMAND_CODE_SCHEDULE_PERMISSIONS;
         case 'gemini':
             return exports.GEMINI_PERMISSIONS;
         case 'vibe-local':