commandmate 0.46.0 → 0.47.0

package/dist/server/src/lib/cli-tools/launch-dialog.js

@@ -0,0 +1,203 @@
+"use strict";
+/**
+ * Startup confirmations a launch answers by itself (Issue #3776).
+ *
+ * gemini and agy each ask a folder-trust question before their prompt comes
+ * up, and their launch used to answer it with a blind Enter as soon as the
+ * question's wording was anywhere on the screen. An Enter confirms whichever
+ * row the cursor is on, so a cursor on `Don't trust` / `No, exit` wrote that
+ * answer for good (gemini's `trustedFolders.json`), and a question whose
+ * wording had changed (gemini v0.62.0) was never answered at all, silently.
+ *
+ * Each confirmation is declared once here — its question, the row that is safe
+ * to confirm, how its cursor row looks and the key that confirms it — and
+ * {@link decideLaunchDialog} reads one screen against that declaration: press,
+ * leave it (the cursor is somewhere else), or "this looks like the dialog but
+ * does not read as it" (the wording or the drawing changed). Pure: the caller
+ * sends the key and writes the log.
+ *
+ * A screen counts as the dialog only when the question is followed, a few rows
+ * down, by a block of the declared option rows (review of #3776): a reply that
+ * quotes the question, a diff of this file, or another tool's permission
+ * screen under a quoted question is not the dialog.
+ *
+ * Must not import `../tmux/tmux`: the Auto-Yes poller's suppression step reads
+ * {@link isLaunchDialogOpen} / {@link decideLaunchDialog} to leave these
+ * screens to the launch.
+ *
+ * @module lib/cli-tools/launch-dialog
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ANTIGRAVITY_TRUST_LAUNCH_DIALOG = exports.GEMINI_TRUST_LAUNCH_DIALOG = void 0;
+exports.decideLaunchDialog = decideLaunchDialog;
+exports.isLaunchDialogOpen = isLaunchDialogOpen;
+exports.isLaunchDialogDrawn = isLaunchDialogDrawn;
+exports.launchDialogWarning = launchDialogWarning;
+const cli_patterns_1 = require("../detection/cli-patterns");
+const patterns_1 = require("../detection/tools/antigravity/patterns");
+/** Longest cursor label a decision carries (it goes into logs). */
+const MAX_CURSOR_LABEL_LENGTH = 80;
+/**
+ * gemini's folder-trust question (measured on v0.62.0, 2026-10-17, private
+ * HOME, empty folder; `tests/fixtures/gemini-live-3776/`):
+ *
+ *   │ Do you trust the files in this folder?
+ *   │ ● 1. Trust folder (<folder>)       <- cursor here by default
+ *   │   2. Trust parent folder (<parent>)
+ *   │   3. Don't trust
+ *
+ * Earlier builds asked `Do you trust this folder?` over the same three rows.
+ * Only `1. Trust folder` is safe: `2.` trusts every sibling of the worktree.
+ * One Enter on it makes gemini restart itself ("Gemini CLI is restarting to
+ * apply the trust changes...") and, on a HOME that never signed in, draw the
+ * authentication picker — whose default an extra Enter would confirm.
+ */
+exports.GEMINI_TRUST_LAUNCH_DIALOG = {
+    id: 'gemini-folder-trust',
+    question: /Do you trust (?:the files in )?this folder\?/,
+    signature: /\bTrust folder\b|\bDon't trust\b/,
+    cursorRow: /^[\s│]*●\s*(\S.*?)[\s│]*$/,
+    optionRow: /^[\s│]*(?:\S\s+)?\d\.\s+(?:Trust folder|Trust parent folder|Don't trust)\b/,
+    minOptionRows: 2,
+    optionsWithin: 8,
+    dismissedRow: /restarting to apply the trust changes/,
+    safeRow: /^1\.\s+Trust folder\b/,
+    key: 'Enter',
+    // The dialog is 11 rows from its question to its lower border; the rest is
+    // room for a notice or footer drawn under it.
+    liveRows: 30,
+    declaredIn: 'src/lib/cli-tools/launch-dialog.ts (GEMINI_TRUST_LAUNCH_DIALOG)',
+};
+/**
+ * agy's folder-trust question (Issue #988;
+ * `tests/fixtures/antigravity-live-2364/trust-dialog.txt`):
+ *
+ *   Do you trust the contents of this project?
+ *   > Yes, I trust this folder   <- cursor here by default
+ *     No, exit
+ *   ↑/↓ Navigate · enter Confirm
+ */
+exports.ANTIGRAVITY_TRUST_LAUNCH_DIALOG = {
+    id: 'antigravity-folder-trust',
+    question: patterns_1.ANTIGRAVITY_TRUST_DIALOG_PATTERN,
+    signature: /\bYes, I trust this folder\b/,
+    optionRow: /^\s*(?:\S\s+)?(?:Yes, I trust this folder|No, exit)\s*$/,
+    minOptionRows: 2,
+    optionsWithin: 4,
+    cursorRow: /^\s*>\s+(\S.*?)\s*$/,
+    safeRow: /^Yes, I trust this folder$/,
+    key: 'Enter',
+    liveRows: 12,
+    declaredIn: 'src/lib/cli-tools/launch-dialog.ts (ANTIGRAVITY_TRUST_LAUNCH_DIALOG)',
+};
+/** The last `count` non-blank rows of a screen, ANSI stripped and right-trimmed. */
+function liveRowsOf(screen, count) {
+    const rows = (0, cli_patterns_1.stripAnsi)(screen)
+        .split('\n')
+        .map((row) => row.trimEnd())
+        .filter((row) => row.trim() !== '');
+    return rows.slice(-count);
+}
+/** The rows below the last dismissal row (all of them when there is none). */
+function rowsAfterDismissal(spec, rows) {
+    if (!spec.dismissedRow)
+        return rows;
+    for (let i = rows.length - 1; i >= 0; i--) {
+        if (spec.dismissedRow.test(rows[i]))
+            return rows.slice(i + 1);
+    }
+    return rows;
+}
+/** The option rows of the dialog asked at `questionAt`, or null if it has none. */
+function optionBlockAfter(spec, rows, questionAt) {
+    const last = Math.min(rows.length - 1, questionAt + spec.optionsWithin);
+    for (let start = questionAt + 1; start <= last; start++) {
+        if (!spec.optionRow.test(rows[start]))
+            continue;
+        const block = [];
+        for (let i = start; i < rows.length && spec.optionRow.test(rows[i]); i++)
+            block.push(rows[i]);
+        return block.length >= spec.minOptionRows ? block : null;
+    }
+    return null;
+}
+/** The option rows under the last live question that has them, or null. */
+function findDialog(spec, rows) {
+    for (let i = rows.length - 1; i >= 0; i--) {
+        if (!spec.question.test(rows[i]))
+            continue;
+        const block = optionBlockAfter(spec, rows, i);
+        if (block)
+            return block;
+    }
+    return null;
+}
+/**
+ * Read one screen against a launch dialog's declaration (Issue #3776).
+ *
+ * The question must be among the last {@link LaunchDialogSpec.liveRows}
+ * non-blank rows, below any dismissal row, with its option block under it; the
+ * key is pressed only when exactly one option row carries the cursor and its
+ * label is the safe one.
+ *
+ * @param spec - The confirmation being looked for
+ * @param screen - One capture of the pane (ANSI allowed)
+ */
+function decideLaunchDialog(spec, screen) {
+    const rows = rowsAfterDismissal(spec, liveRowsOf(screen, spec.liveRows));
+    const options = findDialog(spec, rows);
+    if (!options) {
+        return rows.some((row) => spec.signature.test(row))
+            ? { action: 'unrecognized', reason: 'question-not-found' }
+            : { action: 'absent' };
+    }
+    const cursorLabels = [];
+    for (const row of options) {
+        const match = spec.cursorRow.exec(row);
+        if (match)
+            cursorLabels.push(match[1]);
+    }
+    if (cursorLabels.length === 0)
+        return { action: 'unrecognized', reason: 'cursor-not-found' };
+    if (cursorLabels.length > 1)
+        return { action: 'unrecognized', reason: 'multiple-cursors' };
+    const label = cursorLabels[0];
+    return spec.safeRow.test(label)
+        ? { action: 'press', key: spec.key }
+        : { action: 'hold', reason: 'cursor-off-safe-row', cursorLabel: label.slice(0, MAX_CURSOR_LABEL_LENGTH) };
+}
+/**
+ * Whether the dialog — its question over its option block, not dismissed — is
+ * live on the screen, wherever its cursor is (Issue #3776).
+ */
+function isLaunchDialogOpen(spec, screen) {
+    return findDialog(spec, rowsAfterDismissal(spec, liveRowsOf(screen, spec.liveRows))) !== null;
+}
+/**
+ * Whether the dialog is drawn in the live rows, dismissed or not: a dialog
+ * gemini answered stays on the screen, cursor and all, above its restart line
+ * while the restart runs.
+ */
+function isLaunchDialogDrawn(spec, screen) {
+    return findDialog(spec, liveRowsOf(screen, spec.liveRows)) !== null;
+}
+/**
+ * The warn a launch writes when it leaves the dialog alone, or null when the
+ * decision sends or there is nothing to say. Never carries the screen.
+ */
+function launchDialogWarning(spec, decision) {
+    if (decision.action === 'absent' || decision.action === 'press')
+        return null;
+    if (decision.action === 'hold') {
+        return { event: 'launch-dialog-held', fields: { dialog: spec.id, ...decision } };
+    }
+    return {
+        event: 'launch-dialog-unrecognized',
+        fields: {
+            dialog: spec.id,
+            ...decision,
+            // Fail-closed by design; this warn is written once, so say what to look at.
+            hint: `the dialog's wording or cursor drawing may have changed; compare the screen with ${spec.declaredIn}`,
+        },
+    };
+}

package/dist/server/src/lib/cli-tools/launch-window.js

@@ -0,0 +1,96 @@
+"use strict";
+/**
+ * Whether a launch is still answering its own startup confirmation
+ * (review of Issue #3776).
+ *
+ * gemini's launch confirms its folder-trust dialog itself, once, inside its
+ * ~30 s readiness wait (`GeminiTool.waitForReady`); while that wait runs the
+ * Auto-Yes poller must leave the dialog to it, or the two answer it twice. A
+ * dialog still on the screen after the wait — the Enter did not land, or
+ * gemini drew the dialog late (an auto-update, a slow start) — has nobody else
+ * to answer it, so the poller may again, when the cursor is on the safe row.
+ *
+ * The window closing is not the end of the launch's answer (Issue #3790): an
+ * answered dialog stays drawn, cursor on the safe row, until the agent redraws
+ * (gemini's restart line takes about 2 s), and a window that closed in between —
+ * the wait ran out on its last attempts — would hand it to the poller as an
+ * unanswered one. So the launch also records the key it pressed
+ * ({@link recordLaunchDialogPress}), and the poller leaves the dialog alone for
+ * {@link LAUNCH_DIALOG_PRESS_SETTLE_MS} after it, window or not. Past that, a
+ * dialog still on screen is one the key did not reach, and the poller may answer
+ * it as before.
+ *
+ * Copilot's folder-trust dialog has the same window since Issue #3790: its launch
+ * confirms with a `1` and the poller answered `1` + Enter beside it (measured on
+ * 1.0.91: the second `1` + Enter is submitted as a user message).
+ *
+ * Counted, as agy's window is (`antigravity-startup-trust`, Issue #3770): a
+ * relaunch racing another must not have the earlier one's end close the later
+ * one's window. Keyed by tmux session name; reached through `globalThis`
+ * because the launch and the poller may be bundled separately under
+ * `next dev` (Issue #1736).
+ *
+ * @module lib/cli-tools/launch-window
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LAUNCH_DIALOG_PRESS_SETTLE_MS = void 0;
+exports.beginLaunchWindow = beginLaunchWindow;
+exports.endLaunchWindow = endLaunchWindow;
+exports.isLaunchWindowOpen = isLaunchWindowOpen;
+exports.recordLaunchDialogPress = recordLaunchDialogPress;
+exports.isLaunchDialogPressSettling = isLaunchDialogPressSettling;
+exports.clearLaunchWindows = clearLaunchWindows;
+const global_state_1 = require("../global-state");
+/**
+ * How long after the launch pressed its key the dialog stays the launch's
+ * (Issue #3790). Measured on gemini 0.64.0: the restart line is drawn within
+ * 100 ms of the key and the dialog is gone within about 2 s; a dialog still
+ * drawn 30 s later is one the key did not reach.
+ */
+exports.LAUNCH_DIALOG_PRESS_SETTLE_MS = 30_000;
+/** sessionName -> how many launch windows are open. */
+const openLaunchWindows = (0, global_state_1.getOrInitGlobal)('__launchWindows', () => new Map());
+/** sessionName -> when the launch last pressed the key of its startup confirmation. */
+const launchDialogPresses = (0, global_state_1.getOrInitGlobal)('__launchDialogPresses', () => new Map());
+/**
+ * The launch window opened: the launch answers its startup confirmation in it.
+ * A key an earlier launch of the session pressed is forgotten: the dialog this
+ * launch draws is a new one.
+ */
+function beginLaunchWindow(sessionName) {
+    openLaunchWindows.set(sessionName, (openLaunchWindows.get(sessionName) ?? 0) + 1);
+    launchDialogPresses.delete(sessionName);
+}
+/** The launch window closed, however it ended. */
+function endLaunchWindow(sessionName) {
+    const open = openLaunchWindows.get(sessionName) ?? 0;
+    if (open <= 1)
+        openLaunchWindows.delete(sessionName);
+    else
+        openLaunchWindows.set(sessionName, open - 1);
+}
+/**
+ * @returns True while a launch window is open. A session this process never
+ *   launched (a server restart, another launcher) has none open.
+ */
+function isLaunchWindowOpen(sessionName) {
+    return openLaunchWindows.has(sessionName);
+}
+/** The launch pressed the key that confirms its startup confirmation (Issue #3790). */
+function recordLaunchDialogPress(sessionName, at = Date.now()) {
+    launchDialogPresses.set(sessionName, at);
+}
+/**
+ * @returns True within {@link LAUNCH_DIALOG_PRESS_SETTLE_MS} of the launch's
+ *   key (Issue #3790): the dialog on screen may be the one it answered, not yet
+ *   redrawn, whether or not the window is still open.
+ */
+function isLaunchDialogPressSettling(sessionName, now = Date.now()) {
+    const at = launchDialogPresses.get(sessionName);
+    return at !== undefined && now - at < exports.LAUNCH_DIALOG_PRESS_SETTLE_MS;
+}
+/** Close every window and forget every press. Test seam. */
+function clearLaunchWindows() {
+    openLaunchWindows.clear();
+    launchDialogPresses.clear();
+}

package/dist/server/src/lib/conversation-logger.js

@@ -8,18 +8,30 @@ exports.recordClaudeConversation = recordClaudeConversation;
 const db_1 = require("./db");
 const log_manager_1 = require("./log-manager");
 const logger_1 = require("./logger");
+const poller_owner_1 = require("./polling/poller-owner");
 const logger = (0, logger_1.createLogger)('conversation-logger');
 /**
  * Persist the latest Claude response alongside the most recent user prompt.
  * Errors are swallowed so the calling API route can continue responding.
  */
-async function recordClaudeConversation(db, worktreeId, claudeResponse, cliToolId = 'claude') {
+async function recordClaudeConversation(db, worktreeId, claudeResponse, cliToolId = 'claude', options = {}) {
+    const { pollerKey } = options;
+    const mayWrite = pollerKey === undefined ? undefined : () => (0, poller_owner_1.mayActForPollerKey)(pollerKey);
+    if (mayWrite && !mayWrite()) {
+        logger.info('conversation:log-refused', { worktreeId, cliToolId });
+        return;
+    }
     const lastUserMessage = (0, db_1.getLastUserMessage)(db, worktreeId);
     if (!lastUserMessage) {
         return;
     }
     try {
-        await (0, log_manager_1.createLog)(worktreeId, lastUserMessage.content, claudeResponse, cliToolId);
+        const logPath = await (0, log_manager_1.createLog)(worktreeId, lastUserMessage.content, claudeResponse, cliToolId, {
+            mayWrite,
+        });
+        if (logPath === null) {
+            logger.info('conversation:log-refused', { worktreeId, cliToolId });
+        }
     }
     catch (error) {
         logger.error('conversation:log-failed', { error: error instanceof Error ? error.message : String(error) });

package/dist/server/src/lib/db/chat-db.js

@@ -693,9 +693,10 @@ function recordAnsweredPrompt(db, params) {
       AND message_type = 'prompt'
       AND json_extract(prompt_data, '$.status') = 'pending'
       ${exports.ACTIVE_FILTER}
+      ${params.pendingSavedAtOrBefore !== undefined ? 'AND timestamp <= ?' : ''}
     ORDER BY timestamp DESC
   `)
-        .all(worktreeId, resolvedInstanceId);
+        .all(worktreeId, resolvedInstanceId, ...(params.pendingSavedAtOrBefore !== undefined ? [params.pendingSavedAtOrBefore] : []));
     let target = null;
     for (const row of rows) {
         try {

package/dist/server/src/lib/detection/selection-shape.js

@@ -64,15 +64,17 @@
  * written once.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.readCommandCodeReviewPage = exports.isCommandCodePlanApproveChoice = exports.hasDismissablePanelFooter = exports.hasCommandCodeSelectionListFooterAtBottom = exports.hasCommandCodePlanReviewFooterAtBottom = exports.hasCommandCodeDismissablePanelFooterAtBottom = exports.DISMISSABLE_PANEL_FOOTER_PATTERN = exports.COMMAND_CODE_SELECTION_LIST_FOOTER = exports.COMMAND_CODE_PLAN_APPROVE_CHOICE_ROW = exports.COMMAND_CODE_PLAN_APPROVE_CHOICE_FOOTER = exports.SET_AS_DEFAULT_FOOTER_PATTERN = exports.SESSION_SCOPE_FOOTER_PATTERN = exports.MAX_OPTION_NUMBER = exports.SELECTION_SHAPE_TAIL_LINE_COUNT = exports.COMMAND_CODE_PLAN_REVIEW_FOOTER = void 0;
+exports.TRUST_CONFIRMATION_TAIL_LINE_COUNT = exports.readCommandCodeReviewPage = exports.isCommandCodePlanApproveChoice = exports.hasDismissablePanelFooter = exports.hasCommandCodeSelectionListFooterAtBottom = exports.hasCommandCodePlanReviewFooterAtBottom = exports.hasCommandCodeDismissablePanelFooterAtBottom = exports.DISMISSABLE_PANEL_FOOTER_PATTERN = exports.COMMAND_CODE_SELECTION_LIST_FOOTER = exports.COMMAND_CODE_PLAN_APPROVE_CHOICE_ROW = exports.COMMAND_CODE_PLAN_APPROVE_CHOICE_FOOTER = exports.SET_AS_DEFAULT_FOOTER_PATTERN = exports.SESSION_SCOPE_FOOTER_PATTERN = exports.MAX_OPTION_NUMBER = exports.SELECTION_SHAPE_TAIL_LINE_COUNT = exports.COMMAND_CODE_PLAN_REVIEW_FOOTER = void 0;
 exports.readCommandCodeQuestionRegion = readCommandCodeQuestionRegion;
 exports.hasCommandCodeQuestionChrome = hasCommandCodeQuestionChrome;
 exports.extractCommandCodeSelectionListFrame = extractCommandCodeSelectionListFrame;
 exports.readSelectionListShape = readSelectionListShape;
 exports.shouldOfferOptionNumbers = shouldOfferOptionNumbers;
+exports.isTrustConfirmationFrame = isTrustConfirmationFrame;
 const ansi_1 = require("./ansi");
 const selection_shape_patterns_1 = require("./selection-shape-patterns");
 Object.defineProperty(exports, "COMMAND_CODE_PLAN_REVIEW_FOOTER", { enumerable: true, get: function () { return selection_shape_patterns_1.COMMAND_CODE_PLAN_REVIEW_FOOTER; } });
+const patterns_1 = require("./tools/antigravity/patterns");
 /**
  * How many rows up from the last content row the shape is read.
  *
@@ -611,3 +613,35 @@ function shouldOfferOptionNumbers(shape) {
         !shape.hasFilterInput &&
         !shape.offersPlanApprove);
 }
+/**
+ * How many content rows from the bottom {@link isTrustConfirmationFrame} hands
+ * the detector's predicate: the detector's own `STATUS_CHECK_LINE_COUNT`
+ * (`tools/frame.ts`, the `lastLines` window), restated because that module
+ * pulls `cli-patterns` and its logger into the browser bundle. Pinned equal by
+ * `tests/unit/lib/detection/trust-confirmation-frame-3758.test.ts`.
+ */
+exports.TRUST_CONFIRMATION_TAIL_LINE_COUNT = 15;
+/**
+ * Is this selection list a folder-trust confirmation (Issue #3758)?
+ *
+ * agy's `Do you trust the contents of this project?` screen is unnumbered, so it
+ * is published as an `antigravity_selection_list` (`isSelectionListActive`) and
+ * never as a prompt — no prompt panel, no sheet — and Auto-Yes does not answer
+ * it (#3757). The surfaces drew the bare arrow pad and the generic "a selection
+ * list is open" sentence, which did not say the agent is stopped until somebody
+ * answers on the terminal. This tells them which screen it is, so they can say
+ * so.
+ *
+ * The test is the detector's own (`isAntigravityTrustScreen`) over the same
+ * window of rows, not a copy of it. Callers ask only while the server says a
+ * selection list is up; this does not decide THAT.
+ *
+ * @param frame - the raw pane (`PaneTerminalState.output` / the poll's `fullOutput`)
+ * @param cliToolId - the tool the pane belongs to; only agy draws this screen
+ */
+function isTrustConfirmationFrame(frame, cliToolId) {
+    if (!frame || cliToolId !== 'antigravity')
+        return false;
+    const lines = tailLines(frame);
+    return (0, patterns_1.isAntigravityTrustScreen)(lines.slice(-exports.TRUST_CONFIRMATION_TAIL_LINE_COUNT).join('\n'));
+}

package/dist/server/src/lib/detection/tools/antigravity/detect.js

@@ -35,6 +35,24 @@ exports.VERIFIED_AGAINST = verified_against_1.ANTIGRAVITY_VERIFIED_AGAINST;
  * card) on screen, and what makes `wait` stop with exit 10 instead of hanging.
  */
 const SELECTION_LIST_VERDICT = (0, verdicts_1.positiveVerdict)('waiting', status_reason_1.STATUS_REASON.ANTIGRAVITY_SELECTION_LIST);
+/**
+ * agy generating: the braille spinner or the `Generating...` word — the parts of
+ * `ANTIGRAVITY_THINKING_PATTERN` a permission dialog does not draw (its
+ * `esc to cancel` row it does).
+ */
+const ANTIGRAVITY_GENERATING_PATTERN = /[\u2800-\u28FF]|Generating/;
+/**
+ * An agy numbered screen no reader vouches for (Issue #2364, #3808): published
+ * as unclassified — the hatch opens and `wait` stops — never as a picker (the
+ * arrow pad would Enter the highlighted row) and never as "generating".
+ */
+const UNKNOWN_FRAME_VERDICT = {
+    status: 'running',
+    confidence: 'low',
+    reason: status_reason_1.STATUS_REASON.UNKNOWN_FRAME,
+    hasActivePrompt: false,
+    evidence: 'none',
+};
 /**
  * How close to the bottom of the content the survey row must be to count as
  * open: itself, a blank row and the `? for shortcuts` status row.
@@ -121,8 +139,20 @@ exports.antigravityStatusDetector = (0, run_detection_1.createToolStatusDetector
         // Issue #2845: only while the screen is the live one. The words alone are
         // not enough — a reply that quotes the `↑/↓ Navigate` footer leaves them in
         // the last rows of a pane whose composer is drawn below them.
-        if (!cli_patterns_1.ANTIGRAVITY_SELECTION_LIST_PATTERN.test(frame.lastLines))
-            return null;
+        if (!cli_patterns_1.ANTIGRAVITY_SELECTION_LIST_PATTERN.test(frame.lastLines)) {
+            // Issue #3808: numbered options with no `↑/↓ Navigate` footer on screen
+            // (cut at `↑/↓ Nav`, or below the pane) are not handed to the generic
+            // parser's `prompt_detected` either — the same frames the Auto-Yes
+            // poller and `/prompt-response` decline. `/feedback` keeps its reading.
+            //
+            // Not ahead of generation: a spinner or `Generating…` in the last rows
+            // leaves the frame to the thinking check (a sent message numbered
+            // `1. / 2.` echoes above the spinner). The bare `esc to cancel` row does
+            // not count — agy draws it under its permission dialogs too.
+            if (ANTIGRAVITY_GENERATING_PATTERN.test(frame.thinkingLines))
+                return null;
+            return (0, dialog_1.isAntigravityUnvouchedNumberedScreen)((0, cli_patterns_1.stripBoxDrawing)(frame.clean)) ? UNKNOWN_FRAME_VERDICT : null;
+        }
         if (!isAntigravitySelectionScreenOpen(frame.lastLines))
             return null;
         // Issue #2270 / #2364: except when the frame is a NUMBERED dialog.
@@ -155,6 +185,11 @@ exports.antigravityStatusDetector = (0, run_detection_1.createToolStatusDetector
         // which reads the same helper over the same spelling) carry one question,
         // one option list and one `instructionText` for one screen.
         //
+        // Issue #3808: the reader also declines a numbered screen whose footer is
+        // not a permission dialog's (`… · tab Amend`) — agy 1.4's login-method
+        // screen, a footer a narrow pane cut — so those land on the unclassified
+        // verdict below: a human answers them, Auto-Yes never does.
+        //
         // #995's own case is untouched: the Switch Model picker carries no numbered
         // rows, so it still resolves below and still keeps NavigationButtons.
         const text = (0, cli_patterns_1.stripBoxDrawing)(frame.clean);
@@ -163,13 +198,7 @@ exports.antigravityStatusDetector = (0, run_detection_1.createToolStatusDetector
             if (promptDetection !== null) {
                 return (0, verdicts_1.activePromptVerdict)(status_reason_1.STATUS_REASON.PROMPT_DETECTED, promptDetection);
             }
-            return {
-                status: 'running',
-                confidence: 'low',
-                reason: status_reason_1.STATUS_REASON.UNKNOWN_FRAME,
-                hasActivePrompt: false,
-                evidence: 'none',
-            };
+            return UNKNOWN_FRAME_VERDICT;
         }
         return SELECTION_LIST_VERDICT;
     },

package/dist/server/src/lib/detection/tools/antigravity/dialog.js

@@ -65,10 +65,12 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.readAntigravityNumberedDialog = readAntigravityNumberedDialog;
 exports.detectAntigravityNumberedDialogPrompt = detectAntigravityNumberedDialogPrompt;
+exports.isAntigravityUnvouchedNumberedScreen = isAntigravityUnvouchedNumberedScreen;
 const cli_patterns_1 = require("../../cli-patterns");
 const prompt_detect_multiple_choice_1 = require("../../prompt-detect-multiple-choice");
 const tui_detection_frame_1 = require("../../tui-detection-frame");
 const dialog_block_1 = require("../dialog-block");
+const patterns_1 = require("./patterns");
 const truncate_raw_content_1 = require("../../truncate-raw-content");
 /**
  * How many non-blank rows above option 1 may be searched for the question.
@@ -104,7 +106,9 @@ const QUESTION_ROW_PATTERN = /[?？]\s*$/;
 /**
  * Read agy's numbered dialog off ANSI-stripped rows.
  *
- * Null when the frame has no `↑/↓ Navigate` footer, when the rows above it do
+ * Null when the frame has no `↑/↓ Navigate` footer, when that footer is not a
+ * permission dialog's `… · tab Amend` one (the login-method screen, a footer a
+ * narrow pane cut — Issue #3808), when the rows above it do
  * not form a numbered run reaching `1.` (the Switch Model picker, the trust
  * screen, the slash popup), or when the block sits under a `Switch Model`
  * header. A caller that has already passed `isAntigravityNumberedDialog` and
@@ -115,6 +119,10 @@ function readAntigravityNumberedDialog(lines) {
     const region = (0, cli_patterns_1.locateAntigravityDialogRegion)(lines);
     if (region === null)
         return null;
+    // Issue #3808: only a permission dialog's footer vouches for the block —
+    // see ANTIGRAVITY_PERMISSION_FOOTER_PATTERN.
+    if (!patterns_1.ANTIGRAVITY_PERMISSION_FOOTER_PATTERN.test(lines[region.footer]))
+        return null;
     const regionRows = lines.slice(region.start, region.footer);
     if (regionRows.some(row => cli_patterns_1.ANTIGRAVITY_SWITCH_MODEL_HEADER_PATTERN.test(row)))
         return null;
@@ -224,3 +232,82 @@ function detectAntigravityNumberedDialogPrompt(text) {
         approvalTarget: (0, prompt_detect_multiple_choice_1.joinApprovalTarget)(lines, (0, prompt_detect_multiple_choice_1.findApprovalContextStart)(lines, dialog.questionRow), dialog.footerRow),
     }, normalized, truncate_raw_content_1.truncateRawContent);
 }
+/**
+ * agy's `/feedback` category menu footer (`esc Cancel · 1-6 Select & Continue ·
+ * enter Continue`, `antigravity-live-2364/dialog-feedback-category.txt`): the
+ * one numbered agy screen the generic parser is left to read (#2364).
+ */
+/** A numbered option row (`> 1. Yes`, `  2. No`): the `>` cursor, then the number. */
+const OPTION_ROW_PATTERN = /^\s*(>)?\s*(\d+)\.\s+\S/;
+/**
+ * agy's `/feedback` category menu footer (`esc Cancel · 1-6 Select & Continue ·
+ * enter Continue`, `antigravity-live-2364/dialog-feedback-category.txt`): the
+ * one numbered agy screen the generic parser is left to read (#2364). Anchored
+ * at the row start and matched only on the first row under the last option,
+ * so the same words inside an option label or a quoted command never match.
+ */
+const FEEDBACK_MENU_FOOTER_PATTERN = /^\s*esc Cancel\s*·\s*\d+-\d+\s+Select\b/;
+/** How far above the bottom option row the run down from `1.` may reach. */
+const OPTION_RUN_MAX_ROWS = 40;
+/**
+ * Is this an agy screen with numbered options that the permission reader does
+ * NOT vouch for? (Issue #3808)
+ *
+ * True when the frame ends on a run of options numbered `1.` … `N.` (N ≥ 2,
+ * consecutive, wrapped label rows allowed between them, no boundary row
+ * inside) with one row wearing agy's `>` cursor, no `>` composer drawn under
+ * the run — agy paints none while a screen replaces it, so the options are the
+ * live screen's, not a reply's (a reply's list wears no cursor either) — and
+ * {@link readAntigravityNumberedDialog} does not read the frame (no complete
+ * `↑/↓ Navigate · tab Amend` footer: the login-method screen, a footer a narrow
+ * pane cut at `↑/↓ Nav`, or one below the pane altogether). Deliberately
+ * independent of the footer, so a footer that is not on screen cannot hand the
+ * frame back to the generic parser. A single `> 1. …` row — a sent message
+ * echoed above the spinner — is not a run.
+ *
+ * False for the `/feedback` menu (its `esc Cancel · 1-6 Select` footer directly
+ * under the last option), which keeps the generic reading #2364 left it.
+ *
+ * Callers treat true as "no prompt to answer": a human drives the screen.
+ *
+ * @param text - ANSI-stripped capture, box drawing optional
+ */
+function isAntigravityUnvouchedNumberedScreen(text) {
+    const lines = (0, tui_detection_frame_1.normalizeTuiFrameForDetection)(text).split('\n');
+    let last = -1;
+    for (let i = lines.length - 1; i >= 0; i--) {
+        if (patterns_1.ANTIGRAVITY_PROMPT_PATTERN.test(lines[i]))
+            return false;
+        if (OPTION_ROW_PATTERN.test(lines[i])) {
+            last = i;
+            break;
+        }
+    }
+    if (last < 0)
+        return false;
+    // The run, read upward from the bottom option: N., N-1., … 1.
+    let expected = Number(OPTION_ROW_PATTERN.exec(lines[last])[2]);
+    if (expected < 2)
+        return false;
+    let highlighted = OPTION_ROW_PATTERN.exec(lines[last])[1] !== undefined;
+    const floor = Math.max(0, last - OPTION_RUN_MAX_ROWS);
+    for (let i = last - 1; i >= floor && expected > 1; i--) {
+        const match = OPTION_ROW_PATTERN.exec(lines[i]);
+        if (match === null) {
+            if (cli_patterns_1.ANTIGRAVITY_DIALOG_BOUNDARY_PATTERN.test(lines[i]))
+                return false;
+            continue;
+        }
+        if (Number(match[2]) !== expected - 1)
+            return false;
+        expected--;
+        if (match[1] !== undefined)
+            highlighted = true;
+    }
+    if (expected !== 1 || !highlighted)
+        return false;
+    const footer = lines.slice(last + 1).find(row => row.trim() !== '');
+    if (footer !== undefined && FEEDBACK_MENU_FOOTER_PATTERN.test(footer))
+        return false;
+    return readAntigravityNumberedDialog(lines) === null;
+}

package/dist/server/src/lib/detection/tools/antigravity/patterns.js

@@ -4,7 +4,8 @@
  * (Issue #3217). `cli-patterns.ts` re-exports every public name.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ANTIGRAVITY_SKIP_PATTERNS = exports.ANTIGRAVITY_SURVEY_PATTERN = exports.ANTIGRAVITY_DIALOG_MAX_ROWS = exports.ANTIGRAVITY_DIALOG_BOUNDARY_PATTERN = exports.ANTIGRAVITY_SWITCH_MODEL_HEADER_PATTERN = exports.ANTIGRAVITY_NUMBERED_OPTION_PATTERN = exports.ANTIGRAVITY_NAVIGATE_FOOTER_PATTERN = exports.ANTIGRAVITY_SELECTION_LIST_PATTERN = exports.ANTIGRAVITY_SEPARATOR_PATTERN = exports.ANTIGRAVITY_THINKING_PATTERN = exports.ANTIGRAVITY_PROMPT_PATTERN = exports.ANTIGRAVITY_COMPOSER_MODE_BANNER_PATTERN = exports.ANTIGRAVITY_COMPOSER_MODE_BANNER_SOURCE = void 0;
+exports.ANTIGRAVITY_SKIP_PATTERNS = exports.ANTIGRAVITY_TRUST_DIALOG_PATTERN = exports.ANTIGRAVITY_SURVEY_PATTERN = exports.ANTIGRAVITY_DIALOG_MAX_ROWS = exports.ANTIGRAVITY_DIALOG_BOUNDARY_PATTERN = exports.ANTIGRAVITY_SWITCH_MODEL_HEADER_PATTERN = exports.ANTIGRAVITY_NUMBERED_OPTION_PATTERN = exports.ANTIGRAVITY_PERMISSION_FOOTER_PATTERN = exports.ANTIGRAVITY_NAVIGATE_FOOTER_PATTERN = exports.ANTIGRAVITY_SELECTION_LIST_PATTERN = exports.ANTIGRAVITY_SEPARATOR_PATTERN = exports.ANTIGRAVITY_THINKING_PATTERN = exports.ANTIGRAVITY_PROMPT_PATTERN = exports.ANTIGRAVITY_COMPOSER_MODE_BANNER_PATTERN = exports.ANTIGRAVITY_COMPOSER_MODE_BANNER_SOURCE = void 0;
+exports.isAntigravityTrustScreen = isAntigravityTrustScreen;
 exports.locateAntigravityDialogRegion = locateAntigravityDialogRegion;
 exports.isAntigravityNumberedDialog = isAntigravityNumberedDialog;
 const pasted_text_1 = require("../../shared/pasted-text");
@@ -104,6 +105,20 @@ exports.ANTIGRAVITY_SELECTION_LIST_PATTERN = /Switch Model|↑\/↓\s*Navigate/m
  * edit/expand command`, `enter Confirm`, `←/→ Effort  enter Select`).
  */
 exports.ANTIGRAVITY_NAVIGATE_FOOTER_PATTERN = /↑\/↓\s*Navigate/;
+/**
+ * The footer every measured agy PERMISSION dialog ends on: `↑/↓ Navigate · tab
+ * Amend · f full diff` (file creation), `… · tab Amend · ctrl+g edit/expand
+ * command[ · ctrl+r Review]` (command execution)
+ * (`tests/fixtures/antigravity-live-2364/dialog-*.txt`).
+ *
+ * The numbered-dialog reader requires it on the footer row (Issue #3797 for the
+ * prompt observation, #3808 for every producer): agy 1.4's login-method screen
+ * (`↑/↓ Navigate · enter Select`) draws numbered rows too and is not a
+ * permission request. A footer cut short by a narrow pane, wrapped onto the
+ * next row, or spelled differently by another version fails it on purpose —
+ * the frame is then not answered.
+ */
+exports.ANTIGRAVITY_PERMISSION_FOOTER_PATTERN = /↑\/↓\s*Navigate\s*·\s*tab Amend\b/;
 /**
  * One numbered option row of agy's dialogs: `> 1. Yes`, `  4. No`,
  * `  2. No, deny creation`.
@@ -176,6 +191,31 @@ exports.ANTIGRAVITY_DIALOG_MAX_ROWS = 60;
  * that was waiting for a keypress. Anchored to the whole row.
  */
 exports.ANTIGRAVITY_SURVEY_PATTERN = /^\s*\[1\]\s*Good\s+\[2\]\s*Fine\s+\[3\]\s*Bad\s+\[0\]\s*Skip\s*$/m;
+/**
+ * The question of agy's startup folder-trust screen (Issue #988):
+ *
+ *   Do you trust the contents of this project?
+ *   > Yes, I trust this folder   <- default-selected option
+ *     No, exit
+ *   ↑/↓ Navigate · enter Confirm
+ *
+ * Unnumbered, so {@link isAntigravityNumberedDialog} is false on it and neither
+ * the agy dialog reader nor the generic numbered parser reads it as a prompt
+ * (Issue #3757).
+ */
+exports.ANTIGRAVITY_TRUST_DIALOG_PATTERN = /Do you trust the contents of this project\?/;
+/**
+ * Is agy's folder-trust screen live at the bottom of the frame (Issue #3757)?
+ *
+ * The question AND the `↑/↓ Navigate` footer, both in the status tail: the
+ * question alone also matches the dismissed screen left in the scrollback, or a
+ * reply quoting it, and neither of those is waiting for an answer.
+ *
+ * @param lastLines - The status detector's tail (`normalizeFrame(…).lastLines`)
+ */
+function isAntigravityTrustScreen(lastLines) {
+    return exports.ANTIGRAVITY_TRUST_DIALOG_PATTERN.test(lastLines) && exports.ANTIGRAVITY_NAVIGATE_FOOTER_PATTERN.test(lastLines);
+}
 /**
  * Find the rows between the last boundary and the last `↑/↓ Navigate` footer
  * (Issue #2364).