commandmate 0.44.2 → 0.45.0

package/dist/server/src/lib/hooks/sources/codex/hooks-config.js

@@ -63,7 +63,9 @@
  * start. Those post too, with the environment variables unset; the relay omits
  * the correlation keys it does not have and the receiver falls back to
  * resolving the worktree from `cwd`, which is exactly the hand-configured
- * behaviour of Issue #1549. `CM_AGENT_HOOKS_INJECT=0` turns the whole thing off.
+ * behaviour of Issue #1549. `CM_AGENT_HOOKS_INJECT=0` turns the whole thing off;
+ * `CM_UAT_ISOLATION=1` keeps it on without writing any shared file (Issue #3360,
+ * {@link reuseCodexHookSettingsReadOnly}).
  *
  * ## The shared app-server daemon (Issue #2874)
  *
@@ -96,12 +98,15 @@ exports.buildCodexPermissionHookCommand = buildCodexPermissionHookCommand;
 exports.buildCodexHookSettings = buildCodexHookSettings;
 exports.mergeCodexHookSettings = mergeCodexHookSettings;
 exports.writeCodexHookSettings = writeCodexHookSettings;
+exports.inspectCodexSharedHooksReadOnly = inspectCodexSharedHooksReadOnly;
+exports.reuseCodexHookSettingsReadOnly = reuseCodexHookSettingsReadOnly;
 exports.buildCodexLaunchPlan = buildCodexLaunchPlan;
 const child_process_1 = require("child_process");
 const fs_1 = require("fs");
 const os_1 = require("os");
 const path_1 = require("path");
 const safe_directory_1 = require("../../../../config/safe-directory");
+const uat_isolation_1 = require("../../../../config/uat-isolation");
 const types_1 = require("../../../../lib/cli-tools/types");
 const env_1 = require("../../../../lib/env");
 const hook_settings_generator_1 = require("../../../../lib/hooks/hook-settings-generator");
@@ -313,6 +318,13 @@ function isCodexHookTrustBypassEnabled() {
 function shouldTrustCodexHooks(worktreePath) {
     if (resolveCodexHookTrustPolicy() === 'never')
         return false;
+    // Issue #3360: a grant is codex writing the user's own `config.toml`, which a
+    // UAT / daily-check server must not cause. Declined, the hooks stay inert for
+    // that session — the "no hooks" case the UAT already has to tolerate.
+    // Issue #3312: under `own-home` the `config.toml` is the dedicated user's and
+    // was checked with the rest of `$CODEX_HOME` before the launch, so it may.
+    if ((0, uat_isolation_1.getUatIsolationMode)() === 'shared-read-only')
+        return false;
     try {
         // codex reads `<cwd>/.codex/hooks.json` as well as the home one, and a
         // review that includes a hook from the repository is a review this server
@@ -531,6 +543,10 @@ function mergeCodexHookSettings(existing, generated) {
     base.hooks = merged;
     return base;
 }
+/** The bytes `hooks.json` should hold, given what it holds now. */
+function renderCodexHookSettings(existing, options) {
+    return `${JSON.stringify(mergeCodexHookSettings(existing, buildCodexHookSettings(options)), null, 2)}\n`;
+}
 /**
  * Write the hooks file, and answer where it is.
  *
@@ -543,6 +559,21 @@ function mergeCodexHookSettings(existing, generated) {
  */
 function writeCodexHookSettings(options = {}) {
     const settingsPath = getCodexHooksPath(options);
+    // Issue #3360: UAT isolation never writes the shared files. See
+    // {@link reuseCodexHookSettingsReadOnly}. Issue #3312: `own-home` writes
+    // them, after checking every path below is inside the dedicated user's HOME
+    // (and refuses the launch when one is not).
+    const codexHome = getCodexHome(options);
+    const relayPath = (0, relay_install_1.getCodexRelayInstallPath)(codexHome);
+    const policy = (0, uat_isolation_1.sharedHookWritePolicy)('codex', [
+        codexHome,
+        settingsPath,
+        relayPath,
+        (0, relay_install_1.getCodexRelayStagingPath)(relayPath),
+        (0, path_1.join)(codexHome, 'config.toml'),
+    ]);
+    if (policy === 'read-only')
+        return reuseCodexHookSettingsReadOnly(options);
     // Issue #2315: put the relay where the generated file can name it without
     // naming a checkout, BEFORE the content is built — `buildCodexHookSettings`
     // only reads what is installed, so an install that had not happened yet would
@@ -550,7 +581,15 @@ function writeCodexHookSettings(options = {}) {
     // between. Best-effort by construction: the installer never throws, and a
     // machine where it cannot write simply keeps whatever copy is already there.
     if (options.relayScriptPath === undefined) {
-        (0, relay_install_1.installCodexRelayScript)(getCodexHome(options), (0, hook_settings_generator_1.resolveRelayScriptPath)());
+        if ((0, uat_isolation_1.getUatIsolationMode)() === 'own-home') {
+            // Issue #3312: a relay that could not be updated is a failed
+            // preparation here (the caller refuses the launch), not an older relay
+            // the check would quietly run against.
+            (0, relay_install_1.installCodexRelayScriptOrThrow)(codexHome, (0, hook_settings_generator_1.resolveRelayScriptPath)());
+        }
+        else {
+            (0, relay_install_1.installCodexRelayScript)(codexHome, (0, hook_settings_generator_1.resolveRelayScriptPath)());
+        }
     }
     let existing = null;
     let previous = null;
@@ -569,19 +608,100 @@ function writeCodexHookSettings(options = {}) {
             return null;
         }
     }
-    const content = `${JSON.stringify(mergeCodexHookSettings(existing, buildCodexHookSettings(options)), null, 2)}\n`;
+    const content = renderCodexHookSettings(existing, options);
     if (previous === content)
         return settingsPath;
     (0, fs_1.mkdirSync)((0, path_1.dirname)(settingsPath), { recursive: true, mode: 0o700 });
     (0, fs_1.writeFileSync)(settingsPath, content, { mode: 0o600 });
     return settingsPath;
 }
+/**
+ * Whether the shared `$CODEX_HOME/hooks.json` may be used, unwritten, by a
+ * server in UAT isolation mode (`CM_UAT_ISOLATION=1`, Issue #3360).
+ *
+ * `$CODEX_HOME/hooks.json`, the installed relay and the hook trust in
+ * `config.toml` are shared with the user's production server and live beside
+ * codex's login, so they cannot be moved for a UAT either. They do not need to
+ * be written to work for one: the file holds no port, worktree or instance —
+ * {@link buildCodexLaunchPlan} hands those to the session in its environment —
+ * so a file production has already written delivers this session's events to
+ * THIS server.
+ *
+ * Usable means exactly one thing: the file is byte-identical to what this build
+ * writes into an EMPTY file. Comparing against the merge with what is there
+ * ({@link mergeCodexHookSettings}) would not do — the merge keeps the user's own
+ * handlers, so a file holding a hand-written hook that posts straight to
+ * production would compare equal and run in the UAT session. So these are all
+ * unusable, each with its reason: no file, an unreadable one, hooks or keys
+ * CommandMate did not write, a file this build would change (a newer or older
+ * CommandMate), or an installed relay whose bytes differ from the one this build
+ * ships (the command string would match while running another script).
+ */
+function inspectCodexSharedHooksReadOnly(options = {}) {
+    const settingsPath = getCodexHooksPath(options);
+    if (options.relayScriptPath === undefined) {
+        const shipped = (0, hook_settings_generator_1.resolveRelayScriptPath)();
+        const installed = (0, relay_install_1.getCodexRelayInstallPath)(getCodexHome(options));
+        try {
+            if (shipped &&
+                (0, fs_1.existsSync)(installed) &&
+                (0, fs_1.readFileSync)(shipped, 'utf8') !== (0, fs_1.readFileSync)(installed, 'utf8')) {
+                logger.info('codex-hooks-shared-relay-differs-readonly', { installed });
+                return { usable: false, reason: `the installed relay ${installed} differs from the one this build ships`, fix: uat_isolation_1.UAT_SAME_BUILD_FIX };
+            }
+        }
+        catch {
+            return { usable: false, reason: `the installed relay ${installed} could not be read`, fix: uat_isolation_1.UAT_SAME_BUILD_FIX };
+        }
+    }
+    try {
+        if (!(0, fs_1.existsSync)(settingsPath)) {
+            logger.info('codex-hooks-shared-absent-readonly', { settingsPath });
+            return { usable: false, reason: `${settingsPath} does not exist`, fix: uat_isolation_1.UAT_SAME_BUILD_FIX };
+        }
+        const previous = (0, fs_1.readFileSync)(settingsPath, 'utf8');
+        if (previous === renderCodexHookSettings(null, options)) {
+            return { usable: true, settingsPath };
+        }
+        if (previous === renderCodexHookSettings(JSON.parse(previous), options)) {
+            logger.info('codex-hooks-shared-foreign-readonly', { settingsPath });
+            return {
+                usable: false,
+                reason: `${settingsPath} also holds hooks (or keys) CommandMate did not write, which would run in the UAT session`,
+                fix: 'Skip codex scenarios in this UAT, or run it where the shared hooks file holds only the hooks CommandMate writes.',
+            };
+        }
+        logger.info('codex-hooks-shared-differs-readonly', { settingsPath });
+        return { usable: false, reason: `${settingsPath} differs from what this build writes`, fix: uat_isolation_1.UAT_SAME_BUILD_FIX };
+    }
+    catch (error) {
+        logger.warn('codex-hooks-config-unreadable', {
+            settingsPath,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return { usable: false, reason: `${settingsPath} could not be read`, fix: uat_isolation_1.UAT_SAME_BUILD_FIX };
+    }
+}
+/**
+ * {@link writeCodexHookSettings} for a server in UAT isolation mode: the path
+ * when {@link inspectCodexSharedHooksReadOnly} finds the shared file usable,
+ * else null — which the launch plan turns into a refused launch
+ * ({@link UatIsolationLaunchRefusedError}), not "codex without hooks", because
+ * a bare codex reads the shared file anyway.
+ */
+function reuseCodexHookSettingsReadOnly(options = {}) {
+    const inspection = inspectCodexSharedHooksReadOnly(options);
+    return inspection.usable ? inspection.settingsPath : null;
+}
 /**
  * The plan that starts codex for one instance.
  *
- * Never throws: hooks are an enhancement to a session that has to start anyway,
- * so anything that goes wrong here returns the bare executable — which is
- * byte-for-byte the pre-#1760 launch.
+ * Never throws outside UAT isolation: hooks are an enhancement to a session
+ * that has to start anyway, so anything that goes wrong here returns the bare
+ * executable — which is byte-for-byte the pre-#1760 launch. Under
+ * `CM_UAT_ISOLATION=1` (Issue #3360) each of those roads throws
+ * {@link UatIsolationLaunchRefusedError} instead: a bare codex still reads the
+ * shared, trusted `hooks.json`.
  *
  * The environment assignments are the per-session half of the design. The
  * hooks file cannot hold them (there is one file for the machine), the payload
@@ -604,19 +724,33 @@ function writeCodexHookSettings(options = {}) {
  */
 function buildCodexLaunchPlan(executablePath, target, options = {}) {
     const bare = { command: executablePath, settingsPath: null, env: {} };
-    if (!(0, hook_settings_generator_1.isHookInjectionEnabled)())
+    // Issue #3360: under UAT isolation every road to `bare` is refused instead.
+    // A bare codex still reads `$CODEX_HOME/hooks.json` — production's trusted
+    // hooks, with no correlation keys and no `--no-daemon` — so "without hooks"
+    // would really be "with production's hooks, posting to production".
+    const fallback = (reason, fix) => {
+        if ((0, uat_isolation_1.isUatIsolationEnabled)())
+            throw new uat_isolation_1.UatIsolationLaunchRefusedError('codex', reason, fix);
         return bare;
+    };
+    if (!(0, hook_settings_generator_1.isHookInjectionEnabled)()) {
+        return fallback('CM_AGENT_HOOKS_INJECT=0', 'Do not combine CM_AGENT_HOOKS_INJECT=0 with UAT isolation.');
+    }
     const instanceId = target.instanceId ?? tool_id_1.CODEX_CLI_TOOL_ID;
     if (!(0, path_validator_1.isValidWorktreeId)(target.worktreeId) || !(0, types_1.isValidInstanceId)(instanceId)) {
         // Both become URL parameters the receiver re-validates; a value that would
         // be rejected there is not worth injecting.
         logger.warn('codex-hooks-invalid-correlation-key', { worktreeId: target.worktreeId });
-        return bare;
+        return fallback('the worktree or instance id is not a valid correlation key', 'Use a valid worktree and instance id.');
     }
     try {
         const settingsPath = writeCodexHookSettings(options);
-        if (!settingsPath)
-            return bare;
+        if (!settingsPath) {
+            const inspection = (0, uat_isolation_1.getUatIsolationMode)() === 'shared-read-only' ? inspectCodexSharedHooksReadOnly(options) : null;
+            if (inspection && !inspection.usable)
+                return fallback(inspection.reason, inspection.fix);
+            return fallback(`${getCodexHooksPath(options)} or its relay is missing or differs from what this build writes`, uat_isolation_1.UAT_SAME_BUILD_FIX);
+        }
         const port = options.port ?? (0, env_1.getServerPort)();
         const query = new URLSearchParams({
             tool: tool_id_1.CODEX_CLI_TOOL_ID,
@@ -652,10 +786,12 @@ function buildCodexLaunchPlan(executablePath, target, options = {}) {
         };
     }
     catch (error) {
+        if (error instanceof uat_isolation_1.UatIsolationLaunchRefusedError)
+            throw error;
         logger.warn('codex-hooks-config-write-failed', {
             worktreeId: target.worktreeId,
             error: error instanceof Error ? error.message : String(error),
         });
-        return bare;
+        return fallback(`the hook config could not be prepared (${error instanceof Error ? error.message : String(error)})`, uat_isolation_1.UAT_SAME_BUILD_FIX);
     }
 }

package/dist/server/src/lib/hooks/sources/codex/relay-install.js

@@ -57,6 +57,8 @@ exports.CODEX_RELAY_INSTALL_BASENAME = exports.CODEX_RELAY_INSTALL_DIRNAME = voi
 exports.getCodexRelayInstallPath = getCodexRelayInstallPath;
 exports.getInstalledCodexRelayPath = getInstalledCodexRelayPath;
 exports.installCodexRelayScript = installCodexRelayScript;
+exports.installCodexRelayScriptOrThrow = installCodexRelayScriptOrThrow;
+exports.getCodexRelayStagingPath = getCodexRelayStagingPath;
 const fs_1 = require("fs");
 const path_1 = require("path");
 const logger_1 = require("../../../../lib/logger");
@@ -109,27 +111,7 @@ function installCodexRelayScript(codexHome, sourcePath) {
     const target = getCodexRelayInstallPath(codexHome);
     if (sourcePath && sourcePath !== target) {
         try {
-            const desired = (0, fs_1.readFileSync)(sourcePath, 'utf8');
-            const current = (0, fs_1.existsSync)(target) ? (0, fs_1.readFileSync)(target, 'utf8') : null;
-            if (current !== desired) {
-                (0, fs_1.mkdirSync)((0, path_1.dirname)(target), { recursive: true, mode: 0o700 });
-                // `.tmp` beside the target so the rename cannot cross a filesystem.
-                const staging = `${target}.tmp`;
-                try {
-                    (0, fs_1.writeFileSync)(staging, desired, { mode: 0o700 });
-                    (0, fs_1.renameSync)(staging, target);
-                }
-                catch (error) {
-                    try {
-                        (0, fs_1.unlinkSync)(staging);
-                    }
-                    catch {
-                        // Nothing to clean up, or nothing that can be.
-                    }
-                    throw error;
-                }
-                logger.info('codex-relay-installed', { target });
-            }
+            copyRelayIfChanged(sourcePath, target);
         }
         catch (error) {
             // An install that failed is not a launch that failed. If a previous
@@ -143,3 +125,64 @@ function installCodexRelayScript(codexHome, sourcePath) {
     }
     return (0, fs_1.existsSync)(target) ? target : null;
 }
+/**
+ * {@link installCodexRelayScript} for `CM_UAT_ISOLATION=own-home` (Issue #3312):
+ * every failure throws instead of being absorbed — no shipped relay, a copy
+ * that could not be written, an installed copy whose bytes still differ from
+ * the shipped one — so the launch plan refuses the launch rather than running
+ * the check against an older relay.
+ *
+ * @returns The installed path, byte-identical to `sourcePath`
+ * @throws When the relay is missing or could not be made identical
+ */
+function installCodexRelayScriptOrThrow(codexHome, sourcePath) {
+    if (!sourcePath)
+        throw new Error('this build ships no relay script');
+    const target = getCodexRelayInstallPath(codexHome);
+    if (sourcePath !== target)
+        copyRelayIfChanged(sourcePath, target);
+    if (!(0, fs_1.existsSync)(target) || (0, fs_1.readFileSync)(target, 'utf8') !== (0, fs_1.readFileSync)(sourcePath, 'utf8')) {
+        throw new Error(`the installed relay ${target} differs from the one this build ships`);
+    }
+    return target;
+}
+/**
+ * Copy `sourcePath` to `target` when the bytes differ. Throws on any failure.
+ *
+ * The write goes through `<target>.tmp` and a rename, because the file being
+ * replaced is one a *running* codex session may be executing at that moment —
+ * truncating it in place would hand that session half a script. The temp file
+ * is removed first and then created exclusively (`wx`), so a symlink planted
+ * at that name is removed, never written through (Issue #3312).
+ */
+function copyRelayIfChanged(sourcePath, target) {
+    const desired = (0, fs_1.readFileSync)(sourcePath, 'utf8');
+    const current = (0, fs_1.existsSync)(target) ? (0, fs_1.readFileSync)(target, 'utf8') : null;
+    if (current === desired)
+        return;
+    (0, fs_1.mkdirSync)((0, path_1.dirname)(target), { recursive: true, mode: 0o700 });
+    // `.tmp` beside the target so the rename cannot cross a filesystem.
+    const staging = getCodexRelayStagingPath(target);
+    try {
+        unlinkIfPresent(staging);
+        (0, fs_1.writeFileSync)(staging, desired, { mode: 0o700, flag: 'wx' });
+        (0, fs_1.renameSync)(staging, target);
+    }
+    catch (error) {
+        unlinkIfPresent(staging);
+        throw error;
+    }
+    logger.info('codex-relay-installed', { target });
+}
+/** The temp file the relay is written to before it is renamed over `target`. */
+function getCodexRelayStagingPath(target) {
+    return `${target}.tmp`;
+}
+function unlinkIfPresent(file) {
+    try {
+        (0, fs_1.unlinkSync)(file);
+    }
+    catch {
+        // Nothing to clean up, or nothing that can be.
+    }
+}

package/dist/server/src/lib/hooks/sources/codex/transcript.js

@@ -224,9 +224,9 @@ function readItemDetail(type, item) {
         // for a call codex could not parse.
         const parsed = readParsedCommand(item.parsed_cmd);
         if (parsed)
-            return boundDetailText(collapseToLine(parsed));
+            return boundDetailText((0, turn_body_1.collapseToLine)(parsed));
         const argv = readArgv(item.command);
-        return argv ? boundDetailText(collapseToLine(argv)) : null;
+        return argv ? boundDetailText((0, turn_body_1.collapseToLine)(argv)) : null;
     }
     if (type === 'FileChange') {
         const changes = item.changes;
@@ -248,7 +248,7 @@ function readItemDetail(type, item) {
     }
     if (type === 'Extension') {
         const query = (0, event_mapper_1.readStringField)(item, 'query') ?? (0, event_mapper_1.readStringField)(item, 'action');
-        return query ? boundDetailText(collapseToLine(query)) : null;
+        return query ? boundDetailText((0, turn_body_1.collapseToLine)(query)) : null;
     }
     return null;
 }
@@ -273,14 +273,8 @@ function readArgv(value) {
     const parts = value.filter((entry) => typeof entry === 'string');
     return parts.length > 0 ? parts.join(' ') : null;
 }
-/** A tool detail on one line. A heredoc puts newlines in a shell command. */
-function collapseToLine(value) {
-    return value.replace(/\s+/g, ' ').trim();
-}
 function boundDetailText(value) {
-    return value.length <= exports.MAX_CODEX_TOOL_DETAIL_LENGTH
-        ? value
-        : `${value.slice(0, exports.MAX_CODEX_TOOL_DETAIL_LENGTH - 1)}…`;
+    return (0, turn_body_1.boundDetail)(value, exports.MAX_CODEX_TOOL_DETAIL_LENGTH);
 }
 /**
  * Read one parsed rollout line.
@@ -565,11 +559,7 @@ function renderCodexTurn(turn) {
     // enough to be truncated at both ends still says so at both ends.
     if (!turn.started && body.length > 0)
         body = exports.CODEX_TURN_HEAD_TRUNCATION_MARKER + body;
-    if (body.length > exports.MAX_CODEX_TURN_BODY_LENGTH) {
-        body =
-            body.slice(0, exports.MAX_CODEX_TURN_BODY_LENGTH - exports.CODEX_TURN_TRUNCATION_MARKER.length) +
-                exports.CODEX_TURN_TRUNCATION_MARKER;
-    }
+    body = (0, turn_body_1.truncateTurnBody)(body, exports.MAX_CODEX_TURN_BODY_LENGTH, exports.CODEX_TURN_TRUNCATION_MARKER);
     return {
         sessionId: turn.sessionId,
         turnId: turn.turnId,

package/dist/server/src/lib/hooks/sources/command-code/history.js

@@ -129,6 +129,7 @@ exports.acceptCommandCodeTranscriptHint = acceptCommandCodeTranscriptHint;
 exports.findCommandCodeTranscriptPath = findCommandCodeTranscriptPath;
 exports.captureCommandCodeTranscriptTurn = captureCommandCodeTranscriptTurn;
 exports.resolveCommandCodeTranscriptPath = resolveCommandCodeTranscriptPath;
+const global_state_1 = require("../../../../lib/global-state");
 const promises_1 = require("fs/promises");
 const os_1 = require("os");
 const path_1 = require("path");
@@ -138,6 +139,7 @@ const user_turn_recorder_1 = require("../../../../lib/history/user-turn-recorder
 const assistant_response_saver_1 = require("../../../../lib/assistant-response-saver");
 const logger_1 = require("../../../../lib/logger");
 const agent_transcript_1 = require("../../../../types/agent-transcript");
+const transcript_history_1 = require("../transcript-history");
 const transcript_1 = require("./transcript");
 const logger = (0, logger_1.createLogger)('lib/hooks/sources/command-code/history');
 /**
@@ -172,7 +174,7 @@ const COMMAND_CODE_SESSION_ID_PATTERN = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA
  * Command Code sends `session_id` on all four of its events — but an event that
  * did not would otherwise blank the pointer mid-session.
  */
-const sessionPointers = (globalThis.__commandCodeTranscriptSessions ??= new Map());
+const sessionPointers = (0, global_state_1.getOrInitGlobal)('__commandCodeTranscriptSessions', () => new Map());
 /**
  * Where each session id's transcript was found.
  *
@@ -181,7 +183,7 @@ const sessionPointers = (globalThis.__commandCodeTranscriptSessions ??= new Map(
  * directory scan — the project directory name is `slugify(cwd)` and not
  * derivable — and a scan on every finished turn is not something to do twice.
  */
-const transcriptPaths = (globalThis.__commandCodeTranscriptPaths ??= new Map());
+const transcriptPaths = (0, global_state_1.getOrInitGlobal)('__commandCodeTranscriptPaths', () => new Map());
 function keyOf(target) {
     return (0, auto_yes_state_1.buildCompositeKey)(target.worktreeId, target.cliToolId, target.instanceId);
 }
@@ -206,24 +208,7 @@ function resetCommandCodeTranscriptSessions() {
  * is merely the status quo.
  */
 async function resolveCommandCodeSessionId(target) {
-    const key = keyOf(target);
-    try {
-        const { getLastAgentEvent } = await Promise.resolve().then(() => __importStar(require('../../../../lib/session/agent-event-state')));
-        const sessionId = getLastAgentEvent(target.worktreeId, target.cliToolId, target.instanceId)?.sessionId;
-        if (typeof sessionId === 'string' && sessionId.length > 0) {
-            sessionPointers.set(key, sessionId);
-            return sessionId;
-        }
-    }
-    catch (error) {
-        // A state module that cannot be reached is one that knows no session id.
-        logger.debug('command-code-transcript-session-lookup-failed', {
-            worktreeId: target.worktreeId,
-            instanceId: target.instanceId ?? target.cliToolId,
-            error: error instanceof Error ? error.message : String(error),
-        });
-    }
-    return sessionPointers.get(key) ?? null;
+    return (0, transcript_history_1.resolveSessionIdFromEvents)(target, sessionPointers, keyOf(target), logger, 'command-code-transcript-session-lookup-failed');
 }
 /** `<home>/.commandcode/projects`. */
 function commandCodeProjectsRoot(homeDir) {
@@ -247,15 +232,7 @@ function commandCodeProjectsRoot(homeDir) {
  * @returns The resolved path, or null when it is not acceptable
  */
 function acceptCommandCodeTranscriptHint(homeDir, hint) {
-    if (!hint.endsWith(transcript_1.COMMAND_CODE_TRANSCRIPT_EXTENSION))
-        return null;
-    if (hint.includes('\0'))
-        return null;
-    const root = (0, path_1.resolve)(commandCodeProjectsRoot(homeDir));
-    const resolved = (0, path_1.resolve)(hint);
-    if (resolved !== root && !resolved.startsWith(root + path_1.sep))
-        return null;
-    return resolved;
+    return (0, transcript_history_1.acceptPathUnderRoot)(commandCodeProjectsRoot(homeDir), transcript_1.COMMAND_CODE_TRANSCRIPT_EXTENSION, hint);
 }
 /**
  * Find this session's transcript under `~/.commandcode/projects`.
@@ -301,7 +278,7 @@ async function findCommandCodeTranscriptPath(homeDir, sessionId) {
     const fileName = `${sessionId}${transcript_1.COMMAND_CODE_TRANSCRIPT_EXTENSION}`;
     for (const directory of directories) {
         const candidate = (0, path_1.join)(root, directory.name, fileName);
-        if (await isReadableFile(candidate))
+        if (await (0, transcript_history_1.isReadableFile)(candidate))
             return candidate;
     }
     return null;
@@ -438,7 +415,7 @@ async function captureCommandCodeTranscriptTurn(target, capture, report) {
         let captured = false;
         for (let index = 0; index < pending.turns.length; index += 1) {
             const turn = pending.turns[index];
-            captured = await writeCommandCodeTurn(target, turn, (0, transcript_1.renderCommandCodeTurn)(turn), resolveAssistantTimestampMs(turn, userRows[index], lastRecordAt.get(turn.promptId) ?? 0, nextTurnOpensAt(pending.turns, userRows, index)), path, report);
+            captured = await writeCommandCodeTurn(target, turn, (0, transcript_1.renderCommandCodeTurn)(turn), (0, transcript_history_1.resolveAssistantTimestampMs)(turn, userRows[index], lastRecordAt.get(turn.promptId) ?? 0, (0, transcript_history_1.nextTurnOpensAt)(pending.turns, userRows, index)), path, report);
         }
         if (captured) {
             // Issue #2437: History now holds this turn as the agent's own Markdown.
@@ -473,26 +450,7 @@ async function captureCommandCodeTranscriptTurn(target, capture, report) {
  * there is no evidence in the window that says otherwise.
  */
 async function selectUnwrittenCommandCodeTurns(target, turns) {
-    const [{ getDbInstance }, { findMessageByRequestId }] = await Promise.all([
-        Promise.resolve().then(() => __importStar(require('../../../../lib/db/db-instance'))),
-        Promise.resolve().then(() => __importStar(require('../../../../lib/db'))),
-    ]);
-    const db = getDbInstance();
-    for (let index = turns.length - 1; index >= 0; index -= 1) {
-        const requestId = (0, agent_transcript_1.commandCodeTurnRequestId)(turns[index].promptId);
-        if (!findMessageByRequestId(db, target.worktreeId, requestId))
-            continue;
-        return {
-            turns: turns.slice(index + 1),
-            previousStartedAt: turns[index].startedAt,
-            anchored: true,
-        };
-    }
-    return {
-        turns: turns.slice(-1),
-        previousStartedAt: turns.length > 1 ? turns[turns.length - 2].startedAt : 0,
-        anchored: false,
-    };
+    return (0, transcript_history_1.selectUnwrittenTurns)(target, turns, (turn) => (0, agent_transcript_1.commandCodeTurnRequestId)(turn.promptId));
 }
 /**
  * The transcript file this instance would be read from, or null (Issue #2246).
@@ -526,14 +484,14 @@ async function locateCommandCodeTranscript(homeDir, capture, sessionId) {
     const hint = capture.transcriptPathHint;
     if (typeof hint === 'string' && hint.length > 0) {
         const accepted = acceptCommandCodeTranscriptHint(homeDir, hint);
-        if (accepted && (await isReadableFile(accepted)))
+        if (accepted && (await (0, transcript_history_1.isReadableFile)(accepted)))
             return accepted;
     }
     if (!sessionId)
         return null;
     const memoKey = `${homeDir}\0${sessionId}`;
     const memoised = transcriptPaths.get(memoKey);
-    if (memoised && (await isReadableFile(memoised)))
+    if (memoised && (await (0, transcript_history_1.isReadableFile)(memoised)))
         return memoised;
     const found = await findCommandCodeTranscriptPath(homeDir, sessionId);
     if (found)
@@ -542,14 +500,6 @@ async function locateCommandCodeTranscript(homeDir, capture, sessionId) {
         transcriptPaths.delete(memoKey);
     return found;
 }
-async function isReadableFile(path) {
-    try {
-        return (await (0, promises_1.stat)(path)).isFile();
-    }
-    catch {
-        return false;
-    }
-}
 /**
  * Record the prompt this turn answers, before the reply is written (#2196).
  *
@@ -592,7 +542,7 @@ async function recordCommandCodeUserTurn(target, turn, previousStartedAt = 0) {
     }
     return recorded;
 }
-/**
+/*
  * When the assistant row for this turn is dated.
  *
  * **The turn's LAST assistant record, not its prompt (Issue #2273).** #2252
@@ -618,13 +568,6 @@ async function recordCommandCodeUserTurn(target, turn, previousStartedAt = 0) {
  * @param nextTurnOpensAt - Epoch ms of the next turn's user row, or null when
  *   this is the newest turn in the window
  */
-function resolveAssistantTimestampMs(turn, userRow, lastRecordAt = 0, nextTurnOpensAt = null) {
-    const earliest = userRow.timestampMs === null
-        ? turn.startedAt
-        : Math.max(turn.startedAt, userRow.timestampMs + 1);
-    const latest = nextTurnOpensAt === null ? Number.POSITIVE_INFINITY : nextTurnOpensAt - 1;
-    return Math.max(earliest, Math.min(lastRecordAt, latest));
-}
 /**
  * When each turn's last assistant record was written (Issue #2273).
  *
@@ -661,7 +604,7 @@ function lastCommandCodeAssistantRecordAt(records) {
     }
     return at;
 }
-/**
+/*
  * The instant the next pending turn's prompt row carries, or null (Issue #2273).
  *
  * The user row's own timestamp when there is one, because that is what History
@@ -670,12 +613,6 @@ function lastCommandCodeAssistantRecordAt(records) {
  * prompt is while the previous turn was still running. The turn's start is the
  * fallback for a turn that produced no row at all.
  */
-function nextTurnOpensAt(turns, userRows, index) {
-    const next = turns[index + 1];
-    if (!next)
-        return null;
-    return userRows[index + 1]?.timestampMs ?? next.startedAt;
-}
 /**
  * How many already-written turns are re-rendered and compared (Issue #2264).
  *
@@ -710,32 +647,7 @@ exports.COMMAND_CODE_TURN_RECHECK_LIMIT = 3;
  * @returns Whether the row was replaced
  */
 async function growCommandCodeTurnRow(target, existing, rendered, path) {
-    const instanceId = target.instanceId ?? target.cliToolId;
-    const previousLength = existing.content.length;
-    if (rendered.body.length <= previousLength)
-        return false;
-    const [{ getDbInstance }, { updateMessageContent }, { broadcastMessage }] = await Promise.all([
-        Promise.resolve().then(() => __importStar(require('../../../../lib/db/db-instance'))),
-        Promise.resolve().then(() => __importStar(require('../../../../lib/db'))),
-        Promise.resolve().then(() => __importStar(require('../../../../lib/ws-server'))),
-    ]);
-    updateMessageContent(getDbInstance(), existing.id, rendered.body);
-    broadcastMessage('message_updated', {
-        worktreeId: target.worktreeId,
-        message: { ...existing, content: rendered.body },
-    });
-    logger.info('command-code-transcript-turn-updated', {
-        worktreeId: target.worktreeId,
-        instanceId,
-        sessionId: rendered.sessionId,
-        requestId: existing.requestId,
-        path,
-        previousLength,
-        bodyLength: rendered.body.length,
-        textBlocks: rendered.textBlocks,
-        toolBlocks: rendered.toolBlocks,
-    });
-    return true;
+    return (0, transcript_history_1.growTurnRowTo)(target, existing, rendered, path, logger, 'command-code-transcript-turn-updated');
 }
 /**
  * Re-read the newest already-written turns and grow the short ones (#2264).
@@ -758,25 +670,12 @@ async function growCommandCodeTurnRow(target, existing, rendered, path) {
  * @returns How many rows were replaced
  */
 async function refreshCommandCodeTurnRows(target, candidates, path) {
-    if (candidates.length === 0)
-        return 0;
-    const [{ getDbInstance }, { findMessageByRequestId }] = await Promise.all([
-        Promise.resolve().then(() => __importStar(require('../../../../lib/db/db-instance'))),
-        Promise.resolve().then(() => __importStar(require('../../../../lib/db'))),
-    ]);
-    const db = getDbInstance();
-    let updated = 0;
-    for (const turn of candidates) {
-        if (!(0, transcript_1.isCommandCodeTurnWritable)(turn))
-            continue;
-        const existing = findMessageByRequestId(db, target.worktreeId, (0, agent_transcript_1.commandCodeTurnRequestId)(turn.promptId));
-        if (!existing)
-            continue;
-        if (await growCommandCodeTurnRow(target, existing, (0, transcript_1.renderCommandCodeTurn)(turn), path)) {
-            updated += 1;
-        }
-    }
-    return updated;
+    return (0, transcript_history_1.refreshTurnRowsTo)(target, candidates, path, {
+        isWritable: transcript_1.isCommandCodeTurnWritable,
+        requestIdOf: (turn) => (0, agent_transcript_1.commandCodeTurnRequestId)(turn.promptId),
+        render: transcript_1.renderCommandCodeTurn,
+        grow: growCommandCodeTurnRow,
+    });
 }
 /**
  * Write one rendered turn, unless it is already there.