commandmate 0.44.1 → 0.44.3

package/dist/server/src/lib/hooks/sources/codex/transcript.js

@@ -224,9 +224,9 @@ function readItemDetail(type, item) {
         // for a call codex could not parse.
         const parsed = readParsedCommand(item.parsed_cmd);
         if (parsed)
-            return boundDetailText(collapseToLine(parsed));
+            return boundDetailText((0, turn_body_1.collapseToLine)(parsed));
         const argv = readArgv(item.command);
-        return argv ? boundDetailText(collapseToLine(argv)) : null;
+        return argv ? boundDetailText((0, turn_body_1.collapseToLine)(argv)) : null;
     }
     if (type === 'FileChange') {
         const changes = item.changes;
@@ -248,7 +248,7 @@ function readItemDetail(type, item) {
     }
     if (type === 'Extension') {
         const query = (0, event_mapper_1.readStringField)(item, 'query') ?? (0, event_mapper_1.readStringField)(item, 'action');
-        return query ? boundDetailText(collapseToLine(query)) : null;
+        return query ? boundDetailText((0, turn_body_1.collapseToLine)(query)) : null;
     }
     return null;
 }
@@ -273,14 +273,8 @@ function readArgv(value) {
     const parts = value.filter((entry) => typeof entry === 'string');
     return parts.length > 0 ? parts.join(' ') : null;
 }
-/** A tool detail on one line. A heredoc puts newlines in a shell command. */
-function collapseToLine(value) {
-    return value.replace(/\s+/g, ' ').trim();
-}
 function boundDetailText(value) {
-    return value.length <= exports.MAX_CODEX_TOOL_DETAIL_LENGTH
-        ? value
-        : `${value.slice(0, exports.MAX_CODEX_TOOL_DETAIL_LENGTH - 1)}…`;
+    return (0, turn_body_1.boundDetail)(value, exports.MAX_CODEX_TOOL_DETAIL_LENGTH);
 }
 /**
  * Read one parsed rollout line.
@@ -565,11 +559,7 @@ function renderCodexTurn(turn) {
     // enough to be truncated at both ends still says so at both ends.
     if (!turn.started && body.length > 0)
         body = exports.CODEX_TURN_HEAD_TRUNCATION_MARKER + body;
-    if (body.length > exports.MAX_CODEX_TURN_BODY_LENGTH) {
-        body =
-            body.slice(0, exports.MAX_CODEX_TURN_BODY_LENGTH - exports.CODEX_TURN_TRUNCATION_MARKER.length) +
-                exports.CODEX_TURN_TRUNCATION_MARKER;
-    }
+    body = (0, turn_body_1.truncateTurnBody)(body, exports.MAX_CODEX_TURN_BODY_LENGTH, exports.CODEX_TURN_TRUNCATION_MARKER);
     return {
         sessionId: turn.sessionId,
         turnId: turn.turnId,

package/dist/server/src/lib/hooks/sources/command-code/history.js

@@ -129,6 +129,7 @@ exports.acceptCommandCodeTranscriptHint = acceptCommandCodeTranscriptHint;
 exports.findCommandCodeTranscriptPath = findCommandCodeTranscriptPath;
 exports.captureCommandCodeTranscriptTurn = captureCommandCodeTranscriptTurn;
 exports.resolveCommandCodeTranscriptPath = resolveCommandCodeTranscriptPath;
+const global_state_1 = require("../../../../lib/global-state");
 const promises_1 = require("fs/promises");
 const os_1 = require("os");
 const path_1 = require("path");
@@ -138,6 +139,7 @@ const user_turn_recorder_1 = require("../../../../lib/history/user-turn-recorder
 const assistant_response_saver_1 = require("../../../../lib/assistant-response-saver");
 const logger_1 = require("../../../../lib/logger");
 const agent_transcript_1 = require("../../../../types/agent-transcript");
+const transcript_history_1 = require("../transcript-history");
 const transcript_1 = require("./transcript");
 const logger = (0, logger_1.createLogger)('lib/hooks/sources/command-code/history');
 /**
@@ -172,7 +174,7 @@ const COMMAND_CODE_SESSION_ID_PATTERN = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA
  * Command Code sends `session_id` on all four of its events — but an event that
  * did not would otherwise blank the pointer mid-session.
  */
-const sessionPointers = (globalThis.__commandCodeTranscriptSessions ??= new Map());
+const sessionPointers = (0, global_state_1.getOrInitGlobal)('__commandCodeTranscriptSessions', () => new Map());
 /**
  * Where each session id's transcript was found.
  *
@@ -181,7 +183,7 @@ const sessionPointers = (globalThis.__commandCodeTranscriptSessions ??= new Map(
  * directory scan — the project directory name is `slugify(cwd)` and not
  * derivable — and a scan on every finished turn is not something to do twice.
  */
-const transcriptPaths = (globalThis.__commandCodeTranscriptPaths ??= new Map());
+const transcriptPaths = (0, global_state_1.getOrInitGlobal)('__commandCodeTranscriptPaths', () => new Map());
 function keyOf(target) {
     return (0, auto_yes_state_1.buildCompositeKey)(target.worktreeId, target.cliToolId, target.instanceId);
 }
@@ -206,24 +208,7 @@ function resetCommandCodeTranscriptSessions() {
  * is merely the status quo.
  */
 async function resolveCommandCodeSessionId(target) {
-    const key = keyOf(target);
-    try {
-        const { getLastAgentEvent } = await Promise.resolve().then(() => __importStar(require('../../../../lib/session/agent-event-state')));
-        const sessionId = getLastAgentEvent(target.worktreeId, target.cliToolId, target.instanceId)?.sessionId;
-        if (typeof sessionId === 'string' && sessionId.length > 0) {
-            sessionPointers.set(key, sessionId);
-            return sessionId;
-        }
-    }
-    catch (error) {
-        // A state module that cannot be reached is one that knows no session id.
-        logger.debug('command-code-transcript-session-lookup-failed', {
-            worktreeId: target.worktreeId,
-            instanceId: target.instanceId ?? target.cliToolId,
-            error: error instanceof Error ? error.message : String(error),
-        });
-    }
-    return sessionPointers.get(key) ?? null;
+    return (0, transcript_history_1.resolveSessionIdFromEvents)(target, sessionPointers, keyOf(target), logger, 'command-code-transcript-session-lookup-failed');
 }
 /** `<home>/.commandcode/projects`. */
 function commandCodeProjectsRoot(homeDir) {
@@ -247,15 +232,7 @@ function commandCodeProjectsRoot(homeDir) {
  * @returns The resolved path, or null when it is not acceptable
  */
 function acceptCommandCodeTranscriptHint(homeDir, hint) {
-    if (!hint.endsWith(transcript_1.COMMAND_CODE_TRANSCRIPT_EXTENSION))
-        return null;
-    if (hint.includes('\0'))
-        return null;
-    const root = (0, path_1.resolve)(commandCodeProjectsRoot(homeDir));
-    const resolved = (0, path_1.resolve)(hint);
-    if (resolved !== root && !resolved.startsWith(root + path_1.sep))
-        return null;
-    return resolved;
+    return (0, transcript_history_1.acceptPathUnderRoot)(commandCodeProjectsRoot(homeDir), transcript_1.COMMAND_CODE_TRANSCRIPT_EXTENSION, hint);
 }
 /**
  * Find this session's transcript under `~/.commandcode/projects`.
@@ -301,7 +278,7 @@ async function findCommandCodeTranscriptPath(homeDir, sessionId) {
     const fileName = `${sessionId}${transcript_1.COMMAND_CODE_TRANSCRIPT_EXTENSION}`;
     for (const directory of directories) {
         const candidate = (0, path_1.join)(root, directory.name, fileName);
-        if (await isReadableFile(candidate))
+        if (await (0, transcript_history_1.isReadableFile)(candidate))
             return candidate;
     }
     return null;
@@ -438,7 +415,7 @@ async function captureCommandCodeTranscriptTurn(target, capture, report) {
         let captured = false;
         for (let index = 0; index < pending.turns.length; index += 1) {
             const turn = pending.turns[index];
-            captured = await writeCommandCodeTurn(target, turn, (0, transcript_1.renderCommandCodeTurn)(turn), resolveAssistantTimestampMs(turn, userRows[index], lastRecordAt.get(turn.promptId) ?? 0, nextTurnOpensAt(pending.turns, userRows, index)), path, report);
+            captured = await writeCommandCodeTurn(target, turn, (0, transcript_1.renderCommandCodeTurn)(turn), (0, transcript_history_1.resolveAssistantTimestampMs)(turn, userRows[index], lastRecordAt.get(turn.promptId) ?? 0, (0, transcript_history_1.nextTurnOpensAt)(pending.turns, userRows, index)), path, report);
         }
         if (captured) {
             // Issue #2437: History now holds this turn as the agent's own Markdown.
@@ -473,26 +450,7 @@ async function captureCommandCodeTranscriptTurn(target, capture, report) {
  * there is no evidence in the window that says otherwise.
  */
 async function selectUnwrittenCommandCodeTurns(target, turns) {
-    const [{ getDbInstance }, { findMessageByRequestId }] = await Promise.all([
-        Promise.resolve().then(() => __importStar(require('../../../../lib/db/db-instance'))),
-        Promise.resolve().then(() => __importStar(require('../../../../lib/db'))),
-    ]);
-    const db = getDbInstance();
-    for (let index = turns.length - 1; index >= 0; index -= 1) {
-        const requestId = (0, agent_transcript_1.commandCodeTurnRequestId)(turns[index].promptId);
-        if (!findMessageByRequestId(db, target.worktreeId, requestId))
-            continue;
-        return {
-            turns: turns.slice(index + 1),
-            previousStartedAt: turns[index].startedAt,
-            anchored: true,
-        };
-    }
-    return {
-        turns: turns.slice(-1),
-        previousStartedAt: turns.length > 1 ? turns[turns.length - 2].startedAt : 0,
-        anchored: false,
-    };
+    return (0, transcript_history_1.selectUnwrittenTurns)(target, turns, (turn) => (0, agent_transcript_1.commandCodeTurnRequestId)(turn.promptId));
 }
 /**
  * The transcript file this instance would be read from, or null (Issue #2246).
@@ -526,14 +484,14 @@ async function locateCommandCodeTranscript(homeDir, capture, sessionId) {
     const hint = capture.transcriptPathHint;
     if (typeof hint === 'string' && hint.length > 0) {
         const accepted = acceptCommandCodeTranscriptHint(homeDir, hint);
-        if (accepted && (await isReadableFile(accepted)))
+        if (accepted && (await (0, transcript_history_1.isReadableFile)(accepted)))
             return accepted;
     }
     if (!sessionId)
         return null;
     const memoKey = `${homeDir}\0${sessionId}`;
     const memoised = transcriptPaths.get(memoKey);
-    if (memoised && (await isReadableFile(memoised)))
+    if (memoised && (await (0, transcript_history_1.isReadableFile)(memoised)))
         return memoised;
     const found = await findCommandCodeTranscriptPath(homeDir, sessionId);
     if (found)
@@ -542,14 +500,6 @@ async function locateCommandCodeTranscript(homeDir, capture, sessionId) {
         transcriptPaths.delete(memoKey);
     return found;
 }
-async function isReadableFile(path) {
-    try {
-        return (await (0, promises_1.stat)(path)).isFile();
-    }
-    catch {
-        return false;
-    }
-}
 /**
  * Record the prompt this turn answers, before the reply is written (#2196).
  *
@@ -592,7 +542,7 @@ async function recordCommandCodeUserTurn(target, turn, previousStartedAt = 0) {
     }
     return recorded;
 }
-/**
+/*
  * When the assistant row for this turn is dated.
  *
  * **The turn's LAST assistant record, not its prompt (Issue #2273).** #2252
@@ -618,13 +568,6 @@ async function recordCommandCodeUserTurn(target, turn, previousStartedAt = 0) {
  * @param nextTurnOpensAt - Epoch ms of the next turn's user row, or null when
  *   this is the newest turn in the window
  */
-function resolveAssistantTimestampMs(turn, userRow, lastRecordAt = 0, nextTurnOpensAt = null) {
-    const earliest = userRow.timestampMs === null
-        ? turn.startedAt
-        : Math.max(turn.startedAt, userRow.timestampMs + 1);
-    const latest = nextTurnOpensAt === null ? Number.POSITIVE_INFINITY : nextTurnOpensAt - 1;
-    return Math.max(earliest, Math.min(lastRecordAt, latest));
-}
 /**
  * When each turn's last assistant record was written (Issue #2273).
  *
@@ -661,7 +604,7 @@ function lastCommandCodeAssistantRecordAt(records) {
     }
     return at;
 }
-/**
+/*
  * The instant the next pending turn's prompt row carries, or null (Issue #2273).
  *
  * The user row's own timestamp when there is one, because that is what History
@@ -670,12 +613,6 @@ function lastCommandCodeAssistantRecordAt(records) {
  * prompt is while the previous turn was still running. The turn's start is the
  * fallback for a turn that produced no row at all.
  */
-function nextTurnOpensAt(turns, userRows, index) {
-    const next = turns[index + 1];
-    if (!next)
-        return null;
-    return userRows[index + 1]?.timestampMs ?? next.startedAt;
-}
 /**
  * How many already-written turns are re-rendered and compared (Issue #2264).
  *
@@ -710,32 +647,7 @@ exports.COMMAND_CODE_TURN_RECHECK_LIMIT = 3;
  * @returns Whether the row was replaced
  */
 async function growCommandCodeTurnRow(target, existing, rendered, path) {
-    const instanceId = target.instanceId ?? target.cliToolId;
-    const previousLength = existing.content.length;
-    if (rendered.body.length <= previousLength)
-        return false;
-    const [{ getDbInstance }, { updateMessageContent }, { broadcastMessage }] = await Promise.all([
-        Promise.resolve().then(() => __importStar(require('../../../../lib/db/db-instance'))),
-        Promise.resolve().then(() => __importStar(require('../../../../lib/db'))),
-        Promise.resolve().then(() => __importStar(require('../../../../lib/ws-server'))),
-    ]);
-    updateMessageContent(getDbInstance(), existing.id, rendered.body);
-    broadcastMessage('message_updated', {
-        worktreeId: target.worktreeId,
-        message: { ...existing, content: rendered.body },
-    });
-    logger.info('command-code-transcript-turn-updated', {
-        worktreeId: target.worktreeId,
-        instanceId,
-        sessionId: rendered.sessionId,
-        requestId: existing.requestId,
-        path,
-        previousLength,
-        bodyLength: rendered.body.length,
-        textBlocks: rendered.textBlocks,
-        toolBlocks: rendered.toolBlocks,
-    });
-    return true;
+    return (0, transcript_history_1.growTurnRowTo)(target, existing, rendered, path, logger, 'command-code-transcript-turn-updated');
 }
 /**
  * Re-read the newest already-written turns and grow the short ones (#2264).
@@ -758,25 +670,12 @@ async function growCommandCodeTurnRow(target, existing, rendered, path) {
  * @returns How many rows were replaced
  */
 async function refreshCommandCodeTurnRows(target, candidates, path) {
-    if (candidates.length === 0)
-        return 0;
-    const [{ getDbInstance }, { findMessageByRequestId }] = await Promise.all([
-        Promise.resolve().then(() => __importStar(require('../../../../lib/db/db-instance'))),
-        Promise.resolve().then(() => __importStar(require('../../../../lib/db'))),
-    ]);
-    const db = getDbInstance();
-    let updated = 0;
-    for (const turn of candidates) {
-        if (!(0, transcript_1.isCommandCodeTurnWritable)(turn))
-            continue;
-        const existing = findMessageByRequestId(db, target.worktreeId, (0, agent_transcript_1.commandCodeTurnRequestId)(turn.promptId));
-        if (!existing)
-            continue;
-        if (await growCommandCodeTurnRow(target, existing, (0, transcript_1.renderCommandCodeTurn)(turn), path)) {
-            updated += 1;
-        }
-    }
-    return updated;
+    return (0, transcript_history_1.refreshTurnRowsTo)(target, candidates, path, {
+        isWritable: transcript_1.isCommandCodeTurnWritable,
+        requestIdOf: (turn) => (0, agent_transcript_1.commandCodeTurnRequestId)(turn.promptId),
+        render: transcript_1.renderCommandCodeTurn,
+        grow: growCommandCodeTurnRow,
+    });
 }
 /**
  * Write one rendered turn, unless it is already there.

package/dist/server/src/lib/hooks/sources/command-code/transcript.js

@@ -202,18 +202,12 @@ function readToolDetail(input) {
     for (const field of COMMAND_CODE_TOOL_DETAIL_FIELDS) {
         const value = (0, event_mapper_1.readStringField)(input, field);
         if (value)
-            return boundToolDetail(collapseToLine(value));
+            return boundToolDetail((0, turn_body_1.collapseToLine)(value));
     }
     return null;
 }
-/** A tool detail on one line. A heredoc `command` puts newlines in it. */
-function collapseToLine(value) {
-    return value.replace(/\s+/g, ' ').trim();
-}
 function boundToolDetail(value) {
-    return value.length <= exports.MAX_COMMAND_CODE_TOOL_DETAIL_LENGTH
-        ? value
-        : `${value.slice(0, exports.MAX_COMMAND_CODE_TOOL_DETAIL_LENGTH - 1)}…`;
+    return (0, turn_body_1.boundDetail)(value, exports.MAX_COMMAND_CODE_TOOL_DETAIL_LENGTH);
 }
 /** `message.meta`, when the entry has one. */
 function readMessageMeta(message) {
@@ -588,11 +582,7 @@ function renderCommandCodeTurn(turn) {
             unknown.add(block.type);
     }
     let body = (0, turn_body_1.separateTurnBody)(rendered).body;
-    if (body.length > exports.MAX_COMMAND_CODE_TURN_BODY_LENGTH) {
-        body =
-            body.slice(0, exports.MAX_COMMAND_CODE_TURN_BODY_LENGTH - exports.COMMAND_CODE_TURN_TRUNCATION_MARKER.length) +
-                exports.COMMAND_CODE_TURN_TRUNCATION_MARKER;
-    }
+    body = (0, turn_body_1.truncateTurnBody)(body, exports.MAX_COMMAND_CODE_TURN_BODY_LENGTH, exports.COMMAND_CODE_TURN_TRUNCATION_MARKER);
     return {
         sessionId: turn.sessionId,
         promptId: turn.promptId,

package/dist/server/src/lib/hooks/sources/copilot/hook-settings.js

@@ -100,6 +100,15 @@
  * the bearer header without looking at where it is going, so a constant
  * destination is what keeps the token on loopback (設計方針書 §10.7).
  *
+ * ## UAT isolation (Issue #3391)
+ *
+ * Under `CM_UAT_ISOLATION=1` (Issue #3360) nothing in `~/.copilot` is written —
+ * not `settings.json`, not its backup, not the lock. The file is the user's,
+ * shared with their production server, and names a relay by this checkout's
+ * path. It is used as it is only when it already holds exactly what this build
+ * writes into an empty file ({@link inspectCopilotHookSettingsReadOnly});
+ * anything else refuses the launch, the way codex and antigravity do.
+ *
  * @module lib/hooks/sources/copilot/hook-settings
  */
 Object.defineProperty(exports, "__esModule", { value: true });
@@ -111,8 +120,9 @@ exports.buildCopilotEventCommand = buildCopilotEventCommand;
 exports.buildCopilotPermissionCommand = buildCopilotPermissionCommand;
 exports.buildCopilotHookSettings = buildCopilotHookSettings;
 exports.mergeCopilotHookSettings = mergeCopilotHookSettings;
-exports.readCopilotSettings = readCopilotSettings;
 exports.inspectCopilotConfigHooks = inspectCopilotConfigHooks;
+exports.getCopilotSettingsTempPath = getCopilotSettingsTempPath;
+exports.inspectCopilotHookSettingsReadOnly = inspectCopilotHookSettingsReadOnly;
 exports.writeCopilotHookSettings = writeCopilotHookSettings;
 exports.buildCopilotHookEnvironment = buildCopilotHookEnvironment;
 exports.isCopilotHookInjectionEnabled = isCopilotHookInjectionEnabled;
@@ -121,6 +131,7 @@ const fs_1 = require("fs");
 const os_1 = require("os");
 const path_1 = require("path");
 const safe_directory_1 = require("../../../../config/safe-directory");
+const uat_isolation_1 = require("../../../../config/uat-isolation");
 const types_1 = require("../../../../lib/cli-tools/types");
 const env_1 = require("../../../../lib/env");
 const hook_settings_generator_1 = require("../../../../lib/hooks/hook-settings-generator");
@@ -488,6 +499,10 @@ function mergeCopilotHookSettings(existing, generated) {
     }
     return { ...existing, hooks: merged };
 }
+/** The bytes `settings.json` should hold, given what it holds now. */
+function renderCopilotHookSettings(existing, options) {
+    return `${JSON.stringify(mergeCopilotHookSettings(existing, buildCopilotHookSettings(options)), null, 2)}\n`;
+}
 /** `''` when the file is not there; anything else throws. */
 function readFileOrEmpty(path) {
     try {
@@ -499,16 +514,6 @@ function readFileOrEmpty(path) {
         throw error;
     }
 }
-/**
- * Read the user's `settings.json`.
- *
- * @returns The parsed object, or `{}` when the file does not exist
- * @throws When the file exists but cannot be read or is not a JSON object —
- *   the caller turns that into "start without hooks", never into a rewrite
- */
-function readCopilotSettings(settingsPath) {
-    return parseCopilotSettings(readFileOrEmpty(settingsPath));
-}
 function parseCopilotSettings(raw) {
     if (raw.trim() === '')
         return {};
@@ -682,6 +687,10 @@ function withCopilotSettingsLock(directory, write) {
         }
     }
 }
+/** The temp file {@link writeFileAtomic} writes before it renames it over `path`. */
+function getCopilotSettingsTempPath(path) {
+    return `${path}.${process.pid}.tmp`;
+}
 /**
  * Replace a file's contents without ever leaving it half-written.
  *
@@ -692,9 +701,17 @@ function withCopilotSettingsLock(directory, write) {
  * runs on (設計方針書 §10.9 決定 1).
  */
 function writeFileAtomic(path, contents) {
-    const temp = `${path}.${process.pid}.tmp`;
+    const temp = getCopilotSettingsTempPath(path);
     try {
-        (0, fs_1.writeFileSync)(temp, contents, { mode: 0o600 });
+        // Issue #3312: removed first and then created exclusively, so a symlink
+        // planted at the temp name is removed, never written through.
+        try {
+            (0, fs_1.unlinkSync)(temp);
+        }
+        catch {
+            // Not there: the usual case.
+        }
+        (0, fs_1.writeFileSync)(temp, contents, { mode: 0o600, flag: 'wx' });
         (0, fs_1.renameSync)(temp, path);
     }
     catch (error) {
@@ -707,22 +724,121 @@ function writeFileAtomic(path, contents) {
         throw error;
     }
 }
+/**
+ * The `config.json` that can erase `settingsPath`.
+ *
+ * Next to the settings file rather than via `getCopilotConfigPath()`: the
+ * config.json that can erase a settings.json is the one copilot reads from the
+ * same directory, and an overridden `settingsPath` must not be checked against
+ * a different home's config.
+ */
+function resolveCopilotConfigPathFor(settingsPath, options) {
+    return options.configPath ?? (0, path_1.join)((0, path_1.dirname)(settingsPath), 'config.json');
+}
+/**
+ * Whether the shared `~/.copilot/settings.json` may be used, unwritten, by a
+ * server in UAT isolation mode (`CM_UAT_ISOLATION=1`, Issue #3391).
+ *
+ * Usable means exactly one thing, as for codex and antigravity: the file is
+ * byte-identical to what this build writes into an EMPTY file. Comparing against
+ * the merge with what is there ({@link mergeCopilotHookSettings}) would not do —
+ * the merge keeps the user's own handlers, so a file holding a hand-written
+ * hook that posts straight to production would compare equal and run in the
+ * UAT session. The file holds no port, worktree or instance (they travel in the
+ * launch environment), so a file production wrote with the same build delivers
+ * this session's events to THIS server.
+ *
+ * A `hooks` key in copilot's `config.json` is refused too: copilot migrates it
+ * over `settings.json` at startup, so those hooks would be the ones that run. An
+ * unreadable `config.json` is refused rather than proceeded past, because here
+ * nothing may run that this server cannot show is its own.
+ */
+function inspectCopilotHookSettingsReadOnly(options = {}) {
+    const settingsPath = options.settingsPath ?? getCopilotSettingsPath();
+    const configPath = resolveCopilotConfigPathFor(settingsPath, options);
+    if (!isCopilotHookInjectionEnabled()) {
+        return {
+            usable: false,
+            reason: 'CM_AGENT_HOOKS_INJECT=0',
+            fix: 'Do not combine CM_AGENT_HOOKS_INJECT=0 with UAT isolation.',
+        };
+    }
+    try {
+        const configHooks = inspectCopilotConfigHooks(configPath);
+        if (configHooks !== 'absent') {
+            logger.info('copilot-hook-config-json-readonly', { configPath, configHooks });
+            return {
+                usable: false,
+                reason: configHooks === 'present'
+                    ? `${configPath} has a "hooks" key, which copilot migrates over settings.json at startup`
+                    : `${configPath} could not be parsed, so it may hold hooks copilot migrates over settings.json`,
+                fix: 'Skip copilot scenarios in this UAT, or run it where copilot\'s config.json holds no hooks.',
+            };
+        }
+        const raw = readFileOrEmpty(settingsPath);
+        if (raw === '') {
+            logger.info('copilot-hook-settings-absent-readonly', { settingsPath });
+            return { usable: false, reason: `${settingsPath} does not exist or is empty`, fix: uat_isolation_1.UAT_SAME_BUILD_FIX };
+        }
+        if (raw === renderCopilotHookSettings({}, options)) {
+            return { usable: true, settingsPath };
+        }
+        if (raw === renderCopilotHookSettings(parseCopilotSettings(raw), options)) {
+            logger.info('copilot-hook-settings-foreign-readonly', { settingsPath });
+            return {
+                usable: false,
+                reason: `${settingsPath} also holds hooks (or keys) CommandMate did not write, which would run in the UAT session`,
+                fix: 'Skip copilot scenarios in this UAT, or run it where the shared settings file holds only the hooks CommandMate writes.',
+            };
+        }
+        logger.info('copilot-hook-settings-differs-readonly', { settingsPath });
+        return { usable: false, reason: `${settingsPath} differs from what this build writes`, fix: uat_isolation_1.UAT_SAME_BUILD_FIX };
+    }
+    catch (error) {
+        logger.warn('copilot-hook-settings-unreadable', {
+            settingsPath,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return { usable: false, reason: `${settingsPath} could not be read`, fix: uat_isolation_1.UAT_SAME_BUILD_FIX };
+    }
+}
 /**
  * Merge the generated hooks into copilot's settings file and return its path.
  *
+ * Under `CM_UAT_ISOLATION=1` (Issue #3391) nothing is written: a file that
+ * already holds exactly this build's hooks is reused, anything else throws
+ * {@link UatIsolationLaunchRefusedError}.
+ *
+ * @throws {UatIsolationLaunchRefusedError} Under UAT isolation, when the shared
+ *   file cannot be used as it is
  * @throws {CopilotConfigHooksShadowError} When copilot's `config.json` still
  *   has a `hooks` key, which it migrates over this file at startup
  * @throws Anything the read, the merge or the write throws, plus a lock the
  *   file's other writers are holding. Callers must treat a throw as "launch
- *   without hooks" (fail-open).
+ *   without hooks" (fail-open), except the UAT isolation refusal.
  */
 function writeCopilotHookSettings(options = {}) {
-    const settingsPath = options.settingsPath ?? getCopilotSettingsPath();
-    // Next to the settings file rather than via `getCopilotConfigPath()`: the
-    // config.json that can erase a settings.json is the one copilot reads from
-    // the same directory, and an overridden `settingsPath` must not be checked
-    // against a different home's config.
-    const configPath = options.configPath ?? (0, path_1.join)((0, path_1.dirname)(settingsPath), 'config.json');
+    // Issue #3312: under `own-home` the file, its backup and its lock directory
+    // are written once they check out inside the dedicated user's HOME.
+    const targetPath = options.settingsPath ?? getCopilotSettingsPath();
+    const policy = (0, uat_isolation_1.sharedHookWritePolicy)(tool_id_1.COPILOT_CLI_TOOL_ID, [
+        (0, path_1.dirname)(targetPath),
+        targetPath,
+        `${targetPath}${exports.COPILOT_SETTINGS_BACKUP_SUFFIX}`,
+        getCopilotSettingsTempPath(targetPath),
+        (0, path_1.join)((0, path_1.dirname)(targetPath), exports.COPILOT_SETTINGS_LOCK_BASENAME),
+    ]);
+    if (policy === 'read-only') {
+        // Issue #3391: the file is the user's, shared with their production server,
+        // and names a relay by this checkout's path. A UAT server writes nothing to
+        // it; see {@link inspectCopilotHookSettingsReadOnly}.
+        const inspection = inspectCopilotHookSettingsReadOnly(options);
+        if (inspection.usable)
+            return inspection.settingsPath;
+        throw new uat_isolation_1.UatIsolationLaunchRefusedError(tool_id_1.COPILOT_CLI_TOOL_ID, inspection.reason, inspection.fix);
+    }
+    const settingsPath = targetPath;
+    const configPath = resolveCopilotConfigPathFor(settingsPath, options);
     const configHooks = inspectCopilotConfigHooks(configPath);
     if (configHooks === 'present')
         throw new CopilotConfigHooksShadowError(configPath);
@@ -734,8 +850,7 @@ function writeCopilotHookSettings(options = {}) {
     (0, fs_1.mkdirSync)((0, path_1.dirname)(settingsPath), { recursive: true, mode: 0o700 });
     return withCopilotSettingsLock((0, path_1.dirname)(settingsPath), () => {
         const raw = readFileOrEmpty(settingsPath);
-        const merged = mergeCopilotHookSettings(parseCopilotSettings(raw), buildCopilotHookSettings(options));
-        const next = `${JSON.stringify(merged, null, 2)}\n`;
+        const next = renderCopilotHookSettings(parseCopilotSettings(raw), options);
         // Since #1904 the generated commands carry no port and no per-launch value,
         // so the common re-launch produces the bytes already on disk. Returning
         // early keeps the user's file — and its mtime — untouched, and skips the
@@ -787,26 +902,37 @@ function isCopilotHookInjectionEnabled() {
 /**
  * The command that launches copilot for one instance (S3 / S4 / S5).
  *
- * Never throws. Injection is an enhancement to a session that has to start
- * anyway, so every failure — the switch is off, an id would not survive the
- * receiver's own validation, the settings file is unreadable or unwritable —
- * returns the bare command and no settings path, which is byte-for-byte what
- * `cli-tools/copilot.ts` sent before this Issue.
+ * Never throws outside UAT isolation. Injection is an enhancement to a session
+ * that has to start anyway, so every failure — the switch is off, an id would
+ * not survive the receiver's own validation, the settings file is unreadable or
+ * unwritable — returns the bare command and no settings path, which is
+ * byte-for-byte what `cli-tools/copilot.ts` sent before this Issue.
+ *
+ * Under `CM_UAT_ISOLATION=1` (Issue #3391) each of those roads throws
+ * {@link UatIsolationLaunchRefusedError} instead, as codex's and antigravity's
+ * do: a bare copilot still reads the shared `~/.copilot/settings.json`, so
+ * "without hooks" would mean "with whatever hooks are in the user's file".
  *
  * @param executablePath - Normally {@link COPILOT_LAUNCH_COMMAND}
  * @param target - The instance being started
  */
 function buildCopilotLaunchCommand(executablePath, target, options = {}) {
     const bare = { command: executablePath, settingsPath: null, env: {} };
-    if (!isCopilotHookInjectionEnabled())
+    const fallback = (reason, fix) => {
+        if ((0, uat_isolation_1.isUatIsolationEnabled)())
+            throw new uat_isolation_1.UatIsolationLaunchRefusedError(tool_id_1.COPILOT_CLI_TOOL_ID, reason, fix);
         return bare;
+    };
+    if (!isCopilotHookInjectionEnabled()) {
+        return fallback('CM_AGENT_HOOKS_INJECT=0', 'Do not combine CM_AGENT_HOOKS_INJECT=0 with UAT isolation.');
+    }
     const instanceId = target.instanceId ?? tool_id_1.COPILOT_CLI_TOOL_ID;
     if (!(0, types_1.isValidInstanceId)(instanceId) || !(0, path_validator_1.isValidWorktreeId)(target.worktreeId)) {
         // Both become URL parameters the receivers re-validate; a value that would
         // be rejected there is not worth injecting, and a rejected event is worse
         // than no event because it is a 400 in the operator's log for every turn.
         logger.warn('copilot-hook-invalid-correlation-key', { worktreeId: target.worktreeId });
-        return bare;
+        return fallback('the worktree or instance id is not a valid correlation key', 'Use a valid worktree and instance id.');
     }
     try {
         const settingsPath = writeCopilotHookSettings(options);
@@ -817,6 +943,8 @@ function buildCopilotLaunchCommand(executablePath, target, options = {}) {
         };
     }
     catch (error) {
+        if (error instanceof uat_isolation_1.UatIsolationLaunchRefusedError)
+            throw error;
         if (error instanceof CopilotConfigHooksShadowError) {
             // Its own reason code because it is the one failure here an operator can
             // fix: move `hooks` out of config.json and into settings.json, or let
@@ -825,12 +953,14 @@ function buildCopilotLaunchCommand(executablePath, target, options = {}) {
                 worktreeId: target.worktreeId,
                 configPath: error.configPath,
             });
-            return bare;
+            // Issue #3312: only `own-home` writes and so can get here isolated; a
+            // bare copilot would run the hooks in config.json, so it is refused.
+            return fallback(`${error.configPath} has a "hooks" key, which copilot migrates over settings.json at startup`, 'Move the hooks out of copilot\'s config.json.');
         }
         logger.warn('copilot-hook-settings-write-failed', {
             worktreeId: target.worktreeId,
             error: error instanceof Error ? error.message : String(error),
         });
-        return bare;
+        return fallback('~/.copilot/settings.json could not be prepared', uat_isolation_1.UAT_SAME_BUILD_FIX);
     }
 }