commandmate 0.43.0 → 0.44.1

package/dist/server/src/lib/session/session-starting-state.js

@@ -0,0 +1,236 @@
+"use strict";
+/**
+ * Which agent sessions are still starting (Issue #3179).
+ *
+ * `isRunning` is tmux's `has-session`, and every tool's `launchSession` creates
+ * the tmux session BEFORE it types the launch command — so from that moment the
+ * screen saw a "running" session whose pane held nothing but a shell prompt and
+ * the launch line. That frame matches no tool's rule, falls to the detector's
+ * floor (`running` / `default`) and raised `isUnclassifiedActive`, which drew the
+ * Navigate pad; the trust dialog the launch answers by itself was drawn as a
+ * selection list or a prompt; and the composer's stop button lit up red.
+ *
+ * This module is the missing fact: "a launch of this (worktree, tool, instance)
+ * is in progress, and began at T". It is written by `beginAgentSession` (every
+ * tool's creation path goes through it) and cleared by `BaseCLITool.startSession`
+ * in a `finally`, success and failure alike — which also covers the
+ * `relaunchIfToolExited` path, because that reuses `startSession`.
+ *
+ * ## Whose record it is (Issue #3195)
+ *
+ * The key is (worktree, tool, instance), and a key outlives a launch: kill a
+ * launch mid-way and start the instance again, and the killed `startSession`
+ * is still in its readiness wait (agy: up to 30 s) while the new one writes
+ * the same key. When the old one finished, its `finally` deleted the new
+ * launch's record and the new "starting" display ended early.
+ *
+ * So every launch carries a token. `startSession` issues one
+ * ({@link issueSessionStartingToken}) and runs `launchSession` inside
+ * {@link runWithSessionStartingToken}; `markSessionStarting`, reached from
+ * `beginAgentSession` anywhere below that call, picks it up from the
+ * `AsyncLocalStorage`, and the `finally` clears with it — a record written
+ * under another token is left alone. A second mark under the same token (codex's
+ * `relaunchIntoSamePane`) rewrites the same launch's record, so the `finally`
+ * still clears it. A mark never replaces a record of a LATER launch (tokens
+ * only grow), so a killed launch that re-marks on its way out cannot take the
+ * key back from its successor. `clearSessionStarting` without a token — the
+ * kill-session route — drops the record whoever wrote it.
+ *
+ * ## The escape hatches
+ *
+ * A starting display that never ends would hide a stuck launch, which is worse
+ * than the defect it fixes. So the record stops answering when:
+ *
+ *  - the launch returned or threw (`clearSessionStarting`);
+ *  - it is older than the tool's readiness wait plus a grace period
+ *    (`getSessionStartingMaxMs`) — several tools only log when that wait runs
+ *    out and carry on, so time is the only signal there is;
+ *  - a dialog has stayed on screen for longer than the launch takes to answer
+ *    the ones it knows about (`SESSION_STARTING_PROMPT_GRACE_MS`) — a login or
+ *    an unknown dialog, which a human has to see. Once released this way the
+ *    record stays released for the rest of the launch, so the display does not
+ *    flicker back when the dialog is answered.
+ *
+ * A server restart drops the map, and the screen shows the raw pane — harmless.
+ *
+ * In memory and on `globalThis` for the reason every shared map in this
+ * subsystem is (#1736): the writer (`POST /send`) and the readers
+ * (`/current-output`, the WebSocket streamer, `GET /api/worktrees`) are
+ * different route bundles under `next dev`.
+ *
+ * @module lib/session/session-starting-state
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.issueSessionStartingToken = issueSessionStartingToken;
+exports.runWithSessionStartingToken = runWithSessionStartingToken;
+exports.markSessionStarting = markSessionStarting;
+exports.clearSessionStarting = clearSessionStarting;
+exports.getSessionStartingSince = getSessionStartingSince;
+exports.observeSessionStartingFrame = observeSessionStartingFrame;
+exports.startingStatusResult = startingStatusResult;
+exports.resetSessionStartingState = resetSessionStartingState;
+const node_async_hooks_1 = require("node:async_hooks");
+const auto_yes_state_1 = require("../../lib/auto-yes-state");
+const status_reason_1 = require("../../lib/detection/status-reason");
+const session_starting_config_1 = require("../../config/session-starting-config");
+const records = globalThis.__sessionStartingRecords ??
+    (globalThis.__sessionStartingRecords = new Map());
+/** On `globalThis` like the map, so tokens keep growing across route bundles. */
+const tokenSeq = globalThis.__sessionStartingTokenSeq ??
+    (globalThis.__sessionStartingTokenSeq = { last: 0 });
+const tokenScope = globalThis.__sessionStartingTokenScope ??
+    (globalThis.__sessionStartingTokenScope = new node_async_hooks_1.AsyncLocalStorage());
+/**
+ * A token for a launch about to begin (Issue #3195). Strictly greater than
+ * every token issued before it.
+ */
+function issueSessionStartingToken() {
+    tokenSeq.last += 1;
+    return tokenSeq.last;
+}
+/**
+ * Run a launch under its token, so a `markSessionStarting` anywhere below it
+ * records the launch as this token's (Issue #3195).
+ *
+ * @param token - From {@link issueSessionStartingToken}
+ * @param fn - The launch
+ */
+function runWithSessionStartingToken(token, fn) {
+    return tokenScope.run(token, fn);
+}
+/**
+ * Record that a launch of this instance began.
+ *
+ * Under the launch's token: the one {@link runWithSessionStartingToken} is
+ * running, or a fresh one outside any. A record of a later launch is kept —
+ * this call is then a launch that was already superseded (Issue #3195).
+ *
+ * @param worktreeId - Worktree ID
+ * @param cliToolId - Tool being launched
+ * @param instanceId - Instance (defaults to the primary)
+ * @param at - Epoch ms; defaults to now
+ * @returns The token the record was written under, or null when it was not written
+ */
+function markSessionStarting(worktreeId, cliToolId, instanceId, at = Date.now()) {
+    const token = tokenScope.getStore() ?? issueSessionStartingToken();
+    const key = (0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId);
+    const existing = records.get(key);
+    if (existing !== undefined && existing.token > token)
+        return null;
+    records.set(key, {
+        cliToolId,
+        token,
+        since: at,
+        promptSeenAt: null,
+        released: false,
+    });
+    return token;
+}
+/**
+ * Forget the launch of this instance. Idempotent, and never throws: it runs in
+ * `startSession`'s `finally`, where an exception would replace the launch's own
+ * error — an id `buildCompositeKey` refuses could never have been recorded.
+ *
+ * With a token, only that launch's record is dropped — a launch that was
+ * killed and replaced must not end its successor's display (Issue #3195).
+ * Without one (kill-session), the record is dropped whoever wrote it.
+ *
+ * @param worktreeId - Worktree ID
+ * @param cliToolId - Tool that was launched
+ * @param instanceId - Instance (defaults to the primary)
+ * @param token - The launch's token; omit to drop any launch's record
+ */
+function clearSessionStarting(worktreeId, cliToolId, instanceId, token) {
+    try {
+        const key = (0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId);
+        if (token !== undefined && records.get(key)?.token !== token)
+            return;
+        records.delete(key);
+    }
+    catch {
+        // Nothing was recorded under an id that does not compose into a key.
+    }
+}
+/** The record's start time while it still answers, else null (dropping an expired one). */
+function activeSince(key, record, now) {
+    if (record === undefined || record.released)
+        return null;
+    if (now - record.since > (0, session_starting_config_1.getSessionStartingMaxMs)(record.cliToolId)) {
+        records.delete(key);
+        return null;
+    }
+    return record.since;
+}
+/**
+ * When this instance's launch began, or null when it is not starting (no
+ * launch, already finished, past its time bound, or released by a dialog).
+ *
+ * Read-only apart from dropping an expired record.
+ *
+ * @param worktreeId - Worktree ID
+ * @param cliToolId - Tool
+ * @param instanceId - Instance (defaults to the primary)
+ * @param now - Epoch ms; defaults to now
+ */
+function getSessionStartingSince(worktreeId, cliToolId, instanceId, now = Date.now()) {
+    const key = (0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId);
+    return activeSince(key, records.get(key), now);
+}
+/**
+ * {@link getSessionStartingSince}, fed what the current frame shows.
+ *
+ * A dialog on screen (a prompt, a selection list, any `waiting` verdict) starts
+ * a dwell; one that outlives {@link SESSION_STARTING_PROMPT_GRACE_MS} is a
+ * dialog the launch is not going to answer, and the record is released so the
+ * screen shows it. A frame with no dialog resets the dwell.
+ *
+ * @param worktreeId - Worktree ID
+ * @param cliToolId - Tool
+ * @param instanceId - Instance (defaults to the primary)
+ * @param dialogVisible - Whether the frame shows a dialog
+ * @param now - Epoch ms; defaults to now
+ * @returns The launch's start time while it is still shown as starting, else null
+ */
+function observeSessionStartingFrame(worktreeId, cliToolId, instanceId, dialogVisible, now = Date.now()) {
+    const key = (0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId);
+    const record = records.get(key);
+    const since = activeSince(key, record, now);
+    if (since === null || record === undefined)
+        return null;
+    if (!dialogVisible) {
+        record.promptSeenAt = null;
+        return since;
+    }
+    record.promptSeenAt ??= now;
+    if (now - record.promptSeenAt >= session_starting_config_1.SESSION_STARTING_PROMPT_GRACE_MS) {
+        record.released = true;
+        return null;
+    }
+    return since;
+}
+/**
+ * The verdict published for a frame under a launch in progress (Issue #3179).
+ *
+ * `running` with the `starting` reason: the session exists and is busy, and no
+ * dialog, selection list or unclassified overlay is on it for anybody to drive.
+ * `positive` because the launch record is an observation this server made, not
+ * a pattern that failed to match. The raw verdict is not consulted beyond its
+ * `confidence`; reading anything else off it is what this replaces.
+ *
+ * @param raw - What the detector said about the frame
+ * @returns The neutral verdict for the same frame
+ */
+function startingStatusResult(raw) {
+    return {
+        ...raw,
+        status: 'running',
+        reason: status_reason_1.STATUS_REASON.STARTING,
+        hasActivePrompt: false,
+        promptDetection: { ...raw.promptDetection, isPrompt: false, promptData: undefined },
+        evidence: 'positive',
+    };
+}
+/** Drop every record. For tests. */
+function resetSessionStartingState() {
+    records.clear();
+}

package/dist/server/src/lib/skills/agent-state-paths.js

@@ -0,0 +1,39 @@
+"use strict";
+/**
+ * State files an agent CLI writes into the worktree on its own (Issue #3126)
+ *
+ * Command Code leaves `.commandcode/settings.local.json` and
+ * `.commandcode/taste/**` behind in any folder it runs in. Counted as change,
+ * they made a contract's `requireScopeClean` fail on a worktree whose worker
+ * stayed inside `allow`, and made `work-evidence` pass on one nobody worked in.
+ *
+ * Unlike receipt-owned paths (#3092) there is no receipt to vouch for them, so
+ * the declaration below is the whole rule, and it names files, never a whole
+ * directory: `.commandcode/` also holds things a task may legitimately change,
+ * and allowing it wholesale would wave those through. Callers apply this to
+ * **untracked** entries only, as for #3092: a committed or tracked-and-modified
+ * file is history the branch carries.
+ *
+ * Only paths whose existence is confirmed are declared. Other agents (claude,
+ * codex, ...) are deliberately absent until someone has seen them write one.
+ *
+ * @module lib/skills/agent-state-paths
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AGENT_STATE_DIR_PREFIXES = exports.AGENT_STATE_FILES = void 0;
+exports.isAgentStatePath = isAgentStatePath;
+exports.isAgentStateUntrackedEntry = isAgentStateUntrackedEntry;
+/** Exact repository-relative files an agent CLI manages itself. */
+exports.AGENT_STATE_FILES = ['.commandcode/settings.local.json'];
+/** Directory prefixes (with trailing slash) an agent CLI manages itself. */
+exports.AGENT_STATE_DIR_PREFIXES = ['.commandcode/taste/'];
+/** Whether `path` is a declared agent-managed state path. */
+function isAgentStatePath(path) {
+    if (exports.AGENT_STATE_FILES.includes(path))
+        return true;
+    return exports.AGENT_STATE_DIR_PREFIXES.some((prefix) => path.startsWith(prefix) && !path.slice(prefix.length).split('/').includes('..'));
+}
+/** Whether a porcelain record is an untracked file made only of such paths. */
+function isAgentStateUntrackedEntry(entry) {
+    return entry.status === '??' && entry.paths.every(isAgentStatePath);
+}

package/dist/server/src/lib/skills/receipt-owned-paths.js

@@ -0,0 +1,118 @@
+"use strict";
+/**
+ * Files CommandMate itself placed into a worktree by installing a Skill (Issue #3092)
+ *
+ * `skill install` leaves `.agents/skills/<id>/…` and `.claude/skills/<id>/…`
+ * untracked. Counted as change, those files made `work-evidence` pass on a
+ * worktree nobody had worked in (`uncommitted=74`), and made a contract's
+ * `requireScopeClean` fail on a worktree whose agent stayed inside `allow`.
+ *
+ * The answer is the receipt, and only the receipt. A path is reported as
+ * CommandMate-owned when **all** of the following hold, so that nothing the
+ * user or the agent wrote can be laundered through it into a false "no work":
+ *
+ *  - a receipt parses at `.agents/skills/<id>/.commandmate-receipt.json`, and
+ *    its `skill_id` is that directory's name;
+ *  - the root it names is `<known install prefix>/<skill_id>` — a receipt
+ *    claiming `src` or `.commandcode` as a root claims nothing;
+ *  - the file is listed in the receipt's `files`, is a regular file, and its
+ *    bytes still hash to the recorded `sha256`. A Skill file the agent edited
+ *    is the agent's change and stays counted;
+ *  - for the receipt itself in a secondary root: byte-identical to the
+ *    primary's.
+ *
+ * Callers apply the result to **untracked** entries only. A committed or
+ * tracked-and-modified Skill file is history the branch carries, and judging
+ * it is unchanged by this module.
+ *
+ * @module lib/skills/receipt-owned-paths
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.collectSkillReceiptOwnedPaths = collectSkillReceiptOwnedPaths;
+const crypto_1 = require("crypto");
+const fs_1 = require("fs");
+const path_1 = __importDefault(require("path"));
+const constants_1 = require("../../lib/skills/constants");
+const install_plan_1 = require("../../lib/skills/install-plan");
+function sha256Hex(bytes) {
+    return (0, crypto_1.createHash)('sha256').update(bytes).digest('hex');
+}
+/** Read a regular file (never through a link), or null. */
+function readRegularFile(absolute) {
+    try {
+        if (!(0, fs_1.lstatSync)(absolute).isFile())
+            return null;
+        return (0, fs_1.readFileSync)(absolute);
+    }
+    catch {
+        return null;
+    }
+}
+/** A receipt-relative payload path that cannot leave its root. */
+function isSafeRelativePath(relative) {
+    if (relative === '' || relative.startsWith('/') || relative.includes('\\'))
+        return false;
+    return relative.split('/').every((segment) => segment !== '' && segment !== '.' && segment !== '..');
+}
+function isValidSkillId(skillId) {
+    return constants_1.SKILL_ID_PATTERN.test(skillId) && skillId.length <= constants_1.SKILL_ID_MAX_LENGTH;
+}
+/**
+ * Repository-relative POSIX paths of every untouched file a recorded Skill
+ * install placed in this worktree, receipts included.
+ *
+ * Never throws: an unreadable directory or receipt contributes nothing, which
+ * leaves those files counted exactly as before #3092.
+ */
+function collectSkillReceiptOwnedPaths(worktreePath) {
+    const owned = new Set();
+    const primaryAbs = path_1.default.join(worktreePath, constants_1.SKILL_PRIMARY_INSTALL_ROOT_PREFIX);
+    let skillDirs;
+    try {
+        skillDirs = (0, fs_1.readdirSync)(primaryAbs);
+    }
+    catch {
+        return owned;
+    }
+    for (const skillId of skillDirs) {
+        if (!isValidSkillId(skillId))
+            continue;
+        const primaryRoot = `${constants_1.SKILL_PRIMARY_INSTALL_ROOT_PREFIX}/${skillId}`;
+        const receiptBytes = readRegularFile(path_1.default.join(worktreePath, primaryRoot, install_plan_1.SKILL_RECEIPT_FILENAME));
+        if (receiptBytes === null)
+            continue;
+        const receipt = (0, install_plan_1.parseInstalledReceipt)(receiptBytes);
+        if (receipt === null || receipt.skill_id !== skillId)
+            continue;
+        const allowedRoots = new Set(constants_1.SKILL_INSTALL_ROOT_PREFIXES.map((prefix) => `${prefix}/${skillId}`));
+        const roots = (0, install_plan_1.receiptInstallRoots)(receipt);
+        // The receipt that names the roots must live in the primary one.
+        if (roots[0] !== primaryRoot)
+            continue;
+        for (const root of roots) {
+            if (typeof root !== 'string' || !allowedRoots.has(root))
+                continue;
+            const rootReceipt = readRegularFile(path_1.default.join(worktreePath, root, install_plan_1.SKILL_RECEIPT_FILENAME));
+            if (rootReceipt !== null && rootReceipt.equals(receiptBytes)) {
+                owned.add(`${root}/${install_plan_1.SKILL_RECEIPT_FILENAME}`);
+            }
+            for (const file of receipt.files) {
+                if (!file ||
+                    typeof file.path !== 'string' ||
+                    typeof file.sha256 !== 'string' ||
+                    !isSafeRelativePath(file.path) ||
+                    file.path === install_plan_1.SKILL_RECEIPT_FILENAME) {
+                    continue;
+                }
+                const bytes = readRegularFile(path_1.default.join(worktreePath, root, file.path));
+                if (bytes !== null && sha256Hex(bytes) === file.sha256.toLowerCase()) {
+                    owned.add(`${root}/${file.path}`);
+                }
+            }
+        }
+    }
+    return owned;
+}

package/dist/server/src/lib/tmux/tmux.js

@@ -10,6 +10,7 @@ exports.reconcileSessionGeometry = reconcileSessionGeometry;
 exports.isTmuxAvailable = isTmuxAvailable;
 exports.hasSession = hasSession;
 exports.getSessionWorkingDirectory = getSessionWorkingDirectory;
+exports.getPaneCurrentCommand = getPaneCurrentCommand;
 exports.listSessions = listSessions;
 exports.createSession = createSession;
 exports.sendKeys = sendKeys;
@@ -216,6 +217,27 @@ async function getSessionWorkingDirectory(sessionName) {
         return null;
     }
 }
+/**
+ * The foreground command of a session's pane (`#{pane_current_command}`), or
+ * null when tmux cannot say (Issue #3089).
+ *
+ * Read by Claude's start wait to tell "the agent quit back to the shell" from
+ * "the agent is still drawing": once the agent has exited, the pane's
+ * foreground process is the login shell again (`bash`, `zsh`, `-zsh`, ...).
+ *
+ * @param sessionName - Target session name
+ * @returns The command name, or null when the session or tmux is unavailable
+ */
+async function getPaneCurrentCommand(sessionName) {
+    try {
+        const { stdout } = await execFileAsync('tmux', ['display-message', '-p', '-t', exactTarget(sessionName), '#{pane_current_command}'], { timeout: DEFAULT_TIMEOUT });
+        const command = stdout.trim();
+        return command === '' ? null : command;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * List all tmux sessions
  *
@@ -561,6 +583,9 @@ const ALLOWED_SPECIAL_KEYS = new Set([
     // (`COMMAND_CODE_NAVIGATION_KEY_VALUES`), so the route answers 400 for every
     // other tool — the same arrangement as `s` above.
     'C-a',
+    // Issue #3138: Command Code's plan review is submitted with ctrl+r; sent via
+    // sendSpecialKeys() like the other keys instead of a one-off sendKeys() call.
+    'C-r',
 ]);
 /**
  * Type guard for "sendSpecialKeys() will actually deliver this key" (Issue #2032).