commandmate 0.46.0 → 0.47.0

package/dist/server/src/lib/prompt-observation/kinds.js

@@ -0,0 +1,123 @@
+"use strict";
+/**
+ * The screen kinds a prompt observation publishes (Issue #3755, #3746 A-3).
+ *
+ * ## Why a vocabulary of its own
+ *
+ * `promptData.type` (`yes_no` / `multiple_choice` / `unclassified`) says how a
+ * parsed prompt is answered, and agy's status detector
+ * (`detection/tools/antigravity/detect.ts`) publishes the folder-trust screen,
+ * the `/model` picker and the slash popup under ONE reason
+ * (`antigravity_selection_list`). Neither can say "this is the trust screen and
+ * not the picker", which is exactly what a caller about to answer one of them
+ * has to be sure of (#3746 P4-1). So the values a caller may branch on — and
+ * that the strict `respond` (#3756) may make a send condition — live here, and
+ * are never mixed into `promptData.type` or read back from the detector's
+ * reason.
+ *
+ * A kind is added only for a screen whose reading is pinned to a measured
+ * frame. Everything else that waits on a human is `unknown`: an unmeasured
+ * screen must not borrow a measured screen's name.
+ *
+ * ## No imports, on purpose
+ *
+ * The CLI (`tsconfig.cli.json`) compiles with `"paths": {}` and reaches a
+ * module under `src/lib` only by a relative path whose graph uses no `@/`
+ * alias (the arrangement `lib/session/prompt-view` documents). `prompt` and
+ * `wait` import these values from here rather than restating them.
+ *
+ * @module lib/prompt-observation/kinds
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EXITING_STRICT_ANSWERS = exports.UNNUMBERED_STRICT_RESPOND_KINDS = exports.STRICT_RESPOND_KINDS = exports.NO_PROMPT_OBSERVATION_KINDS = exports.PROMPT_OBSERVATION_KINDS = exports.PROMPT_OBSERVATION_SCHEMA_VERSION = void 0;
+exports.isPromptObservationKind = isPromptObservationKind;
+exports.isDecisionKind = isDecisionKind;
+exports.isStrictRespondKind = isStrictRespondKind;
+exports.isExitingStrictAnswer = isExitingStrictAnswer;
+/** `schemaVersion` of the observation payload. Bumped when a field changes meaning. */
+exports.PROMPT_OBSERVATION_SCHEMA_VERSION = 1;
+/**
+ * Every kind an observation can publish.
+ *
+ * - `antigravity-trust` — agy's first-run folder trust screen (`Do you trust
+ *   the contents of this project?` over `> Yes, I trust this folder` /
+ *   `No, exit`). Unnumbered; Enter confirms the highlighted row.
+ * - `antigravity-model-picker` — agy's `/model` picker (`Switch Model`): the
+ *   1.1.27 layout (`antigravity-live-2364/picker-switch-model.txt`) and the
+ *   1.4 one with a search box (`prompt-observation-3797/`, Issue #3797).
+ * - `antigravity-permission` — agy's numbered permission dialog (command
+ *   execution, file creation; `tests/fixtures/antigravity-live-2364/dialog-*`),
+ *   ending on its `tab Amend` footer. agy's numbered login-method screen is
+ *   not one (`unknown`).
+ * - `antigravity-slash-menu` — agy's slash-command popup.
+ * - `composer` — no confirmation: the agent sits at its input box.
+ * - `none` — no confirmation, and not at the input box either (working).
+ * - `unknown` — something waits on a human and no measured reading names it.
+ */
+exports.PROMPT_OBSERVATION_KINDS = [
+    'antigravity-trust',
+    'antigravity-model-picker',
+    'antigravity-permission',
+    'antigravity-slash-menu',
+    'composer',
+    'none',
+    'unknown',
+];
+/** The two kinds that mean "nothing on screen is asking for a decision". */
+exports.NO_PROMPT_OBSERVATION_KINDS = ['composer', 'none'];
+/** Whether `value` is one of {@link PROMPT_OBSERVATION_KINDS}. */
+function isPromptObservationKind(value) {
+    return typeof value === 'string' && exports.PROMPT_OBSERVATION_KINDS.includes(value);
+}
+/** Whether `kind` is a screen that asks for a decision (neither `composer` nor `none`). */
+function isDecisionKind(kind) {
+    return !exports.NO_PROMPT_OBSERVATION_KINDS.includes(kind);
+}
+/**
+ * The kinds the strict `respond` (Issue #3756) answers. Every other kind is
+ * refused before a key: the `/model` picker's effort slider is not read, the
+ * slash popup is a menu of the composer, and `unknown` is never answered.
+ */
+exports.STRICT_RESPOND_KINDS = ['antigravity-trust', 'antigravity-permission'];
+/** Whether `kind` is one of {@link STRICT_RESPOND_KINDS}. */
+function isStrictRespondKind(kind) {
+    return typeof kind === 'string' && exports.STRICT_RESPOND_KINDS.includes(kind);
+}
+/**
+ * Strict kinds whose rows carry no number: answered only by a label, which is
+ * sent as ↑/↓ and Enter. An option number or `--default` is refused there.
+ */
+exports.UNNUMBERED_STRICT_RESPOND_KINDS = ['antigravity-trust'];
+/**
+ * Per strict kind, the answer whose consequence is the agent exiting (Issue
+ * #3788): its 1-based position, valid only on a screen that shows exactly
+ * `optionCount` options AND whose row at that position reads `label`. agy's
+ * trust screen offers `Yes, I trust this folder` then `No, exit` (measured:
+ * `tests/fixtures/prompt-observation-3755/antigravity-trust.txt`,
+ * `antigravity-live-2364/trust-dialog.txt`), and agy exits on the second.
+ *
+ * The three conditions only narrow: a screen drawn in another order, with
+ * another number of rows, or with another wording has no exiting answer, and
+ * its outcome stays `indeterminate` (exit 41).
+ *
+ * Only after such an answer may a shell back in front of the pane be read as
+ * the session having ended: after any other answer it is the agent falling
+ * over (a crash, a failed start), which the answer did not ask for. A kind
+ * absent here has no exiting answer.
+ */
+exports.EXITING_STRICT_ANSWERS = {
+    // eslint-disable-next-line no-restricted-syntax -- agy's drawn option row, matched against the screen, not display text
+    'antigravity-trust': { position: 2, optionCount: 2, label: 'No, exit' },
+};
+/**
+ * Whether answering option `position` (1-based) of a `kind` screen showing
+ * `options` (labels in draw order) exits the agent: the declared position, the
+ * declared number of options, and the declared label at that position (runs of
+ * spaces folded, ends trimmed; case kept).
+ */
+function isExitingStrictAnswer(kind, position, options) {
+    const exiting = exports.EXITING_STRICT_ANSWERS[kind];
+    if (exiting === undefined || exiting.position !== position || exiting.optionCount !== options.length)
+        return false;
+    return options[position - 1].replace(/\s+/g, ' ').trim() === exiting.label;
+}

package/dist/server/src/lib/prompt-observation/types.js

@@ -0,0 +1,14 @@
+"use strict";
+/**
+ * The payload of one prompt observation (Issue #3755): what
+ * `GET /api/worktrees/:id/current-output?observe=1` adds as `promptObservation`,
+ * what `commandmate prompt --json` prints, and what `commandmate wait` adds to
+ * its exit-10 payload as `observation`.
+ *
+ * Types only, and importable from the CLI for the reason `./kinds` gives: the
+ * two imports outside this directory (`polling/auto-yes-suppression-reason`,
+ * `session/send-attempt-types`) have no imports of their own.
+ *
+ * @module lib/prompt-observation/types
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/server/src/lib/push/prompt-push-gate.js

@@ -56,6 +56,43 @@
  * it resolves in seconds, and the reminder below is what catches it when it
  * does not.
  *
+ * ## "About to answer" has a deadline (Issue #3757)
+ *
+ * Nothing recorded is not proof that Auto-Yes is answering. A screen the poller
+ * cannot read at all (agy's folder-trust screen was the measured case: the
+ * poller read no prompt, so it recorded nothing) looked exactly like the
+ * common case above, and the wait was held silent until the ten-minute
+ * reminder. So the hold lasts {@link AUTO_YES_ANSWER_GRACE_MS} — time for the
+ * poller to answer or to record why it did not — and a wait still open after
+ * that notifies as `auto-yes-not-answered`. `waiting-push-notifier` asks again
+ * when the hold ends.
+ *
+ * The hold is NOT counted from `waitingSince`. That is the wait's identity,
+ * not when anyone saw it: it can be a hook's timestamp older than the probe
+ * that opened the edge, and it stays frozen across several prompts of one
+ * episode. It is counted from {@link autoYesHoldStartedAt}: the later of the
+ * moment the gate first held this episode and the poller's last answer, so a
+ * second prompt right after an answer gets a full hold of its own. Both
+ * producers ask through {@link decideAndLogPromptPush} and share that origin.
+ *
+ * ## The hold reaches the session wait's tick (Issue #3791)
+ *
+ * The 9 s assume the poller's next tick is at most a cooldown away. Its ticks
+ * are a poll interval, a cooldown or the thinking interval (5 s) apart — inside
+ * the 9 s — with two exceptions. An error backoff (up to `MAX_BACKOFF_MS`) is
+ * not waited for: a poller failing in a row is the least likely to answer, and
+ * a broken Auto-Yes is when a human most needs the notification. The session
+ * wait is: a capture that found no session puts the next tick `MAX_BACKOFF_MS`
+ * away, and a session started meanwhile (`send --auto-yes` enables Auto-Yes
+ * before the session exists) gets its first prompt answered on that tick. So
+ * when the hold begins while that tick is pending, it lasts until the tick plus
+ * two ticks (answer, or the Enter fallback's second look):
+ * {@link autoYesHoldEndsAt}. The tick is read once, and only counts while the
+ * poller that scheduled it is still the one running — a poller stopped or
+ * replaced meanwhile will not tick. Issue #3796: the session's creation brings
+ * that tick forward to a poll interval, and the hold follows it — the tick is
+ * only ever read earlier than it was when the hold began.
+ *
  * ## The reminder is never muted
  *
  * `runEscalationTick` has already established that the wait is still open — it
@@ -71,12 +108,141 @@
  * @module lib/push/prompt-push-gate
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTO_YES_HOLD_MAX_AGE_MS = exports.AUTO_YES_ANSWER_AFTER_TICK_MS = exports.AUTO_YES_ANSWER_GRACE_MS = void 0;
+exports.autoYesHoldStartedAt = autoYesHoldStartedAt;
+exports.autoYesHoldEndsAt = autoYesHoldEndsAt;
+exports.forgetAutoYesHold = forgetAutoYesHold;
+exports.clearAutoYesHolds = clearAutoYesHolds;
 exports.decidePromptPush = decidePromptPush;
 exports.isPromptPushSuppressed = isPromptPushSuppressed;
+exports.decideAndLogPromptPush = decideAndLogPromptPush;
 const auto_yes_state_1 = require("../../lib/auto-yes-state");
 const logger_1 = require("../../lib/logger");
 const auto_yes_suppression_state_1 = require("../../lib/polling/auto-yes-suppression-state");
+const global_state_1 = require("../../lib/global-state");
 const logger = (0, logger_1.createLogger)('push/prompt-gate');
+/**
+ * How long a wait with nothing recorded about it is held as "Auto-Yes is
+ * answering" (Issue #3757), from {@link autoYesHoldStartedAt}. The poller
+ * answers a prompt it can read on the tick that sees it and records a reason
+ * on the same tick when it will not, but that tick can be a cooldown away
+ * (`COOLDOWN_INTERVAL_MS` after an answer, as long while thinking), and the
+ * Enter fallback needs one more tick: a cooldown plus two ticks, 9 s.
+ */
+exports.AUTO_YES_ANSWER_GRACE_MS = Math.max(3 * auto_yes_state_1.POLLING_INTERVAL_MS, auto_yes_state_1.COOLDOWN_INTERVAL_MS + 2 * auto_yes_state_1.POLLING_INTERVAL_MS);
+/** compositeKey -> the hold of that session's current episode. globalThis per #1736. */
+const autoYesHolds = (0, global_state_1.getOrInitGlobal)('__promptPushAutoYesHolds', () => new Map());
+/**
+ * Where this wait's `auto-yes-answering` hold is counted from (Issue #3757):
+ * the later of the moment the gate first held this episode (recorded here on
+ * the first call) and the Auto-Yes poller's last answer to this session.
+ *
+ * The poller's answer is read off its state on `globalThis`
+ * (`__autoYesPollerStates`, `lastServerResponseTimestamp`) rather than through
+ * `auto-yes-poller`, which imports `response-checker`, which imports this gate.
+ *
+ * @param now - Epoch ms of the decision; recorded as the start of a new hold
+ */
+function autoYesHoldStartedAt(input, now) {
+    const key = (0, auto_yes_state_1.buildCompositeKey)(input.worktreeId, input.cliToolId, input.instanceId);
+    sweepStaleAutoYesHolds(now);
+    let hold = autoYesHolds.get(key);
+    if (hold === undefined || hold.since !== input.waitingSince) {
+        hold = { since: input.waitingSince, firstHeldAt: now, sessionWaitTick: pendingSessionWaitTick(key, now) };
+        autoYesHolds.set(key, hold);
+    }
+    // Issue #3770: Auto-Yes switched off and on again inside one episode starts a
+    // fresh hold; the old origin would read the poller's silence while it was off
+    // as "did not answer".
+    const enabledAt = (0, auto_yes_state_1.getAutoYesState)(input.worktreeId, input.cliToolId, input.instanceId)?.enabledAt;
+    if (enabledAt !== undefined && enabledAt > hold.firstHeldAt && enabledAt <= now)
+        hold.firstHeldAt = enabledAt;
+    const lastAnswer = globalThis.__autoYesPollerStates?.get(key)?.lastServerResponseTimestamp ?? null;
+    return lastAnswer !== null ? Math.max(hold.firstHeldAt, lastAnswer) : hold.firstHeldAt;
+}
+/**
+ * How long after the poller's tick the hold still lasts (Issue #3791): that
+ * tick answers, or records why not, and the Enter fallback answers on the tick
+ * after it — the "two ticks" of {@link AUTO_YES_ANSWER_GRACE_MS}.
+ */
+exports.AUTO_YES_ANSWER_AFTER_TICK_MS = 2 * auto_yes_state_1.POLLING_INTERVAL_MS;
+/**
+ * The Auto-Yes poller's pending session-wait tick (Issue #3791), read off its
+ * state on `globalThis` for the same reason as `lastServerResponseTimestamp`.
+ * Only a tick due after `now`, and no further than the session wait puts it.
+ */
+function pendingSessionWaitTick(key, now) {
+    const poller = globalThis.__autoYesPollerStates?.get(key);
+    const at = poller?.sessionWaitTickAt;
+    if (poller === undefined || at === undefined || at <= now)
+        return undefined;
+    return { at: Math.min(at, now + auto_yes_state_1.MAX_BACKOFF_MS), poller, heldAt: now };
+}
+/**
+ * Issue #3796: when the session wait's tick the hold counts on actually comes.
+ * The tick read when the hold began, brought forward when the poller ticked
+ * early — its session was created, and it rescheduled the tick a poll interval
+ * away (`sessionWaitTickAt`), or already ran it (`sessionWaitTickRanAt`,
+ * `sessionAppearedAt`) — only times since the hold began count. Only
+ * ever earlier: a session wait scheduled after the hold began does not extend
+ * it (#3791).
+ */
+function effectiveSessionWaitTickAt(tick) {
+    let at = tick.at;
+    for (const t of [tick.poller.sessionWaitTickAt, tick.poller.sessionWaitTickRanAt, tick.poller.sessionAppearedAt]) {
+        if (t !== undefined && t >= tick.heldAt && t < at)
+            at = t;
+    }
+    return at;
+}
+/**
+ * When this wait's `auto-yes-answering` hold ends (Issue #3791): a full
+ * {@link AUTO_YES_ANSWER_GRACE_MS} after {@link autoYesHoldStartedAt}, and not
+ * before {@link AUTO_YES_ANSWER_AFTER_TICK_MS} past the session wait's tick
+ * pending when the hold began — while the poller that scheduled it still runs.
+ *
+ * @param now - Epoch ms of the decision; recorded as the start of a new hold
+ */
+function autoYesHoldEndsAt(input, now) {
+    const startedAt = autoYesHoldStartedAt(input, now);
+    const key = (0, auto_yes_state_1.buildCompositeKey)(input.worktreeId, input.cliToolId, input.instanceId);
+    const tick = autoYesHolds.get(key)?.sessionWaitTick;
+    const graceEndsAt = startedAt + exports.AUTO_YES_ANSWER_GRACE_MS;
+    // A poller stopped or replaced since (disable, off → on) will not tick.
+    if (tick === undefined || globalThis.__autoYesPollerStates?.get(key) !== tick.poller)
+        return graceEndsAt;
+    // Kept on the hold: an earlier tick once adopted is not lost when the poller
+    // later reschedules (an ordinary tick after a failed capture, a new session
+    // wait) — the hold never moves back out.
+    tick.at = effectiveSessionWaitTickAt(tick);
+    return Math.max(graceEndsAt, tick.at + exports.AUTO_YES_ANSWER_AFTER_TICK_MS);
+}
+/** A hold older than this is dropped (Issue #3770): its episode is long over. */
+exports.AUTO_YES_HOLD_MAX_AGE_MS = 60 * 60 * 1000;
+function sweepStaleAutoYesHolds(now) {
+    for (const [key, hold] of autoYesHolds) {
+        if (now - hold.firstHeldAt >= exports.AUTO_YES_HOLD_MAX_AGE_MS)
+            autoYesHolds.delete(key);
+    }
+}
+/**
+ * Drop the hold of one session (Issue #3770): Auto-Yes went off, or the
+ * episode closed.
+ *
+ * @param since - Issue #3776: drop it only when it is this episode's hold. A
+ *   caller retiring one episode must not take the next episode's origin with it
+ *   (that hold would start over, and its notification come up to a hold late).
+ *   Omitted, the session's hold goes whatever its episode.
+ */
+function forgetAutoYesHold(key, since) {
+    if (since !== undefined && autoYesHolds.get(key)?.since !== since)
+        return;
+    autoYesHolds.delete(key);
+}
+/** Forget every hold. Test seam. */
+function clearAutoYesHolds() {
+    autoYesHolds.clear();
+}
 /**
  * Decide whether this prompt notification is worth a human's attention.
  *
@@ -97,6 +263,10 @@ function decidePromptPush(input) {
     if (input.escalated === true) {
         return { suppress: false, reason: 'escalation-reminder' };
     }
+    const holdEndsAt = input.holdEndsAt ?? (input.holdStartedAt !== undefined ? input.holdStartedAt + exports.AUTO_YES_ANSWER_GRACE_MS : undefined);
+    if (holdEndsAt !== undefined && (input.now ?? Date.now()) >= holdEndsAt) {
+        return { suppress: false, reason: 'auto-yes-not-answered' };
+    }
     return { suppress: true, reason: 'auto-yes-answering' };
 }
 /**
@@ -111,7 +281,23 @@ function decidePromptPush(input) {
  * so the line is only there for the "why did this one ring?" question.
  */
 function isPromptPushSuppressed(input) {
-    const decision = decidePromptPush(input);
+    return decideAndLogPromptPush(input).suppress;
+}
+/**
+ * {@link isPromptPushSuppressed}, with the whole decision handed back — for the
+ * caller that has to ask again when an `auto-yes-answering` hold ends
+ * (`waiting-push-notifier`, Issue #3757).
+ */
+function decideAndLogPromptPush(input, options = {}) {
+    let decision = decidePromptPush(input);
+    if (decision.reason === 'auto-yes-inactive') {
+        forgetAutoYesHold((0, auto_yes_state_1.buildCompositeKey)(input.worktreeId, input.cliToolId, input.instanceId));
+    }
+    // Issue #3757: only a wait that reached the hold gets an origin recorded.
+    if (decision.reason === 'auto-yes-answering' && input.holdStartedAt === undefined && input.holdEndsAt === undefined) {
+        const now = input.now ?? Date.now();
+        decision = decidePromptPush({ ...input, now, holdEndsAt: autoYesHoldEndsAt(input, now) });
+    }
     const context = {
         worktreeId: input.worktreeId,
         cliToolId: input.cliToolId,
@@ -122,9 +308,15 @@ function isPromptPushSuppressed(input) {
         ...(decision.stopReason !== undefined ? { stopReason: decision.stopReason } : {}),
         ...(decision.suppressedBy !== undefined ? { suppressedBy: decision.suppressedBy } : {}),
     };
-    if (decision.suppress)
+    // A re-ask at the end of a hold (Issue #3757) that holds again was already
+    // logged when the hold began.
+    if (decision.suppress && options.recheck === true)
+        logger.debug('prompt-push-suppressed', context);
+    else if (decision.suppress)
         logger.info('prompt-push-suppressed', context);
+    else if (decision.reason === 'auto-yes-not-answered')
+        logger.info('prompt-push-allowed', context);
     else
         logger.debug('prompt-push-allowed', context);
-    return decision.suppress;
+    return decision;
 }

package/dist/server/src/lib/push/waiting-push-notifier.js

@@ -103,6 +103,12 @@ exports.CLASSIFICATION_GRACE_MS = 8_000;
 const pending = (0, global_state_1.getOrInitGlobal)('__waitingPushPending', () => new Map());
 /** Composite key -> the timer holding that wait's first notification (#2156). */
 const graceTimers = (0, global_state_1.getOrInitGlobal)('__waitingPushGraceTimers', () => new Map());
+/**
+ * Composite key -> the timer that asks the gate again when its
+ * `auto-yes-answering` hold ends (Issue #3757). Apart from {@link graceTimers}:
+ * that one is the classification hold of #2156, this one the Auto-Yes hold.
+ */
+const answerGraceTimers = (0, global_state_1.getOrInitGlobal)('__waitingPushAnswerGraceTimers', () => new Map());
 /**
  * The worktree's display name, for the notification title.
  *
@@ -160,10 +166,15 @@ function isUnnamedWait(kind) {
 /** Drop the hold on this wait without sending anything. */
 function cancelGrace(key) {
     const timer = graceTimers.get(key);
-    if (timer === undefined)
-        return;
-    clearTimeout(timer);
-    graceTimers.delete(key);
+    if (timer !== undefined) {
+        clearTimeout(timer);
+        graceTimers.delete(key);
+    }
+    const answerTimer = answerGraceTimers.get(key);
+    if (answerTimer !== undefined) {
+        clearTimeout(answerTimer);
+        answerGraceTimers.delete(key);
+    }
 }
 /**
  * The Auto-Yes gate, then the fan-out.
@@ -172,17 +183,70 @@ function cancelGrace(key) {
  * moment it decides to send, so a notification dropped after the fan-out began
  * would still consume the episode's one slot — see `prompt-push-gate`.
  */
-function gateAndSend(wait, now) {
-    if ((0, prompt_push_gate_1.isPromptPushSuppressed)({
+function gateAndSend(wait, now, recheck = false) {
+    const decision = (0, prompt_push_gate_1.decideAndLogPromptPush)({
         worktreeId: wait.worktreeId,
         cliToolId: wait.cliToolId,
         instanceId: wait.instanceId,
         waitingSince: wait.since,
-    })) {
+        now,
+    }, { recheck });
+    if (decision.suppress) {
+        // Issue #3757: "Auto-Yes is answering" is a hold, not a verdict. Ask again
+        // when it ends; a wait Auto-Yes did answer is gone from the episode store
+        // by then and nothing is sent.
+        if (decision.reason === 'auto-yes-answering')
+            holdForAutoYesAnswer(wait, now);
         return;
     }
     void sendWaitingPush(wait, false, now);
 }
+/**
+ * Re-ask the gate for this wait when its `auto-yes-answering` hold ends
+ * (Issue #3757). The edge fires once, so without this a wait Auto-Yes never
+ * answered — a screen the poller cannot read and records nothing about — stayed
+ * silent until the escalation reminder, ten minutes later.
+ */
+function holdForAutoYesAnswer(wait, now) {
+    const key = (0, auto_yes_state_1.buildCompositeKey)(wait.worktreeId, wait.cliToolId, wait.instanceId);
+    const existing = answerGraceTimers.get(key);
+    if (existing !== undefined)
+        clearTimeout(existing);
+    // From the gate's own origin, not `since` (Issue #3757 review), and past the
+    // poller's session-wait tick (Issue #3791). Capped at the grace, so a clock
+    // that went backwards cannot arm an overflowing timer, and a longer hold is
+    // asked about again every grace: a poller stopped meanwhile ends it then
+    // rather than at a tick that will not come.
+    const holdEndsAt = (0, prompt_push_gate_1.autoYesHoldEndsAt)({ worktreeId: wait.worktreeId, cliToolId: wait.cliToolId, instanceId: wait.instanceId, waitingSince: wait.since }, now);
+    const delay = Math.min(prompt_push_gate_1.AUTO_YES_ANSWER_GRACE_MS, Math.max(0, holdEndsAt - now));
+    const timer = setTimeout(() => {
+        answerGraceTimers.delete(key);
+        releaseAutoYesHold(key, wait.since);
+    }, delay);
+    // Never hold the process open for it, as with the other timers here.
+    timer.unref?.();
+    answerGraceTimers.set(key, timer);
+}
+/**
+ * The Auto-Yes hold ended: notify unless the wait is over or is another one
+ * (Issue #3757). Read from the episode store, as {@link releaseHeldWait} does.
+ */
+function releaseAutoYesHold(key, since) {
+    const held = pending.get(key);
+    if (held === undefined || held.since !== since)
+        return;
+    const episode = (0, waiting_episode_state_1.getWaitingEpisode)(held.worktreeId, held.cliToolId, held.instanceId);
+    if (episode === null || episode.since !== held.since) {
+        pending.delete(key);
+        // Issue #3776: this episode's hold only — the next one may hold already.
+        (0, prompt_push_gate_1.forgetAutoYesHold)(key, held.since);
+        stopEscalationTimerIfIdle();
+        return;
+    }
+    const settled = { ...held, kind: episode.kind };
+    pending.set(key, settled);
+    gateAndSend(settled, Date.now(), true);
+}
 /**
  * The grace elapsed: send the held wait with whatever it is called *now*
  * (Issue #2156).
@@ -380,6 +444,9 @@ function stopWaitingPushNotifier() {
     for (const timer of graceTimers.values())
         clearTimeout(timer);
     graceTimers.clear();
+    for (const timer of answerGraceTimers.values())
+        clearTimeout(timer);
+    answerGraceTimers.clear();
     pending.clear();
     stopEscalationTimerIfIdle();
 }

package/dist/server/src/lib/realtime/terminal-broadcast.js

@@ -24,6 +24,7 @@ const manager_1 = require("../../lib/cli-tools/manager");
 const tmux_capture_cache_1 = require("../../lib/tmux/tmux-capture-cache");
 const global_state_1 = require("../global-state");
 const terminal_session_ownership_1 = require("./terminal-session-ownership");
+const poller_owner_1 = require("../../lib/polling/poller-owner");
 const logger = (0, logger_1.createLogger)('terminal-broadcast');
 const versionCounters = (0, global_state_1.getOrInitGlobal)('__terminalSnapshotVersions', () => new Map());
 exports.INTERACTION_SNAPSHOT_RETRY_DELAYS_MS = [100, 250, 500, 750];
@@ -43,11 +44,24 @@ async function broadcastTerminalSnapshot(worktreeId, cliToolId, instanceId) {
     try {
         if (!(await isPushableSession(worktreeId, cliToolId, instanceId)))
             return;
+        // Issue #3705: the response poller starts this snapshot inside its tick's
+        // owner (`snapshotOwnerStorage`) and the question is asked again after each
+        // `await`: a successor that took the key meanwhile is not overwritten by
+        // the turn that ended, and its `version` is not spent on it. Outside a
+        // poller tick, always yes.
+        if (!(0, poller_owner_1.maySnapshotPublish)())
+            throw new poller_owner_1.RetiredSnapshotError();
         const db = (0, db_instance_1.getDbInstance)();
         const payload = await (0, current_output_builder_1.buildCurrentOutput)(db, worktreeId, cliToolId, instanceId);
+        if (!(0, poller_owner_1.maySnapshotPublish)())
+            throw new poller_owner_1.RetiredSnapshotError();
         emitTerminalSnapshot(worktreeId, cliToolId, payload, instanceId);
     }
     catch (error) {
+        if (error instanceof poller_owner_1.RetiredSnapshotError) {
+            logger.info('terminal-snapshot:retired', { worktreeId, cliToolId, instanceId });
+            return;
+        }
         logger.error('terminal-snapshot:failed', {
             worktreeId,
             error: error instanceof Error ? error.message : String(error),

package/dist/server/src/lib/relay/relay-delivery-claims.js

@@ -0,0 +1,46 @@
+"use strict";
+/**
+ * Relays whose payload is being typed into the requester's composer right now
+ * (Issue #3732).
+ *
+ * A claim is taken by `relay-delivery` immediately before `sendUserMessage`, in
+ * the same synchronous stretch that re-read the row and found it still open, and
+ * released once the attempt is over (delivered, held or failed). While it is
+ * held, `withdrawRelay` answers `delivering` instead of cancelling: a cancel
+ * that reported success would be a lie once the send is already under way, and
+ * the send cannot be taken back.
+ *
+ * A module of its own, rather than an export of `relay-delivery`, so that
+ * `relay-service` (and the cancel route behind it) can consult it without
+ * importing the send path.
+ *
+ * On `globalThis` for the reason the in-flight set is (#1736): the poller's and
+ * the API's bundles must see the same set under `next dev`. Being in memory is
+ * enough — a claim only lives for the duration of one send in this process, so
+ * there is nothing to migrate and nothing to recover after a restart.
+ *
+ * @module lib/relay/relay-delivery-claims
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.claimRelayDelivery = claimRelayDelivery;
+exports.releaseRelayDelivery = releaseRelayDelivery;
+exports.isRelayDeliveryClaimed = isRelayDeliveryClaimed;
+exports.resetRelayDeliveryClaims = resetRelayDeliveryClaims;
+const global_state_1 = require("../global-state");
+const claims = (0, global_state_1.getOrInitGlobal)('__relayDeliveryClaims', () => new Set());
+/** Mark a relay as being delivered. */
+function claimRelayDelivery(relayId) {
+    claims.add(relayId);
+}
+/** The attempt is over, whatever its outcome. */
+function releaseRelayDelivery(relayId) {
+    claims.delete(relayId);
+}
+/** Whether a send for this relay is under way right now. */
+function isRelayDeliveryClaimed(relayId) {
+    return claims.has(relayId);
+}
+/** Forget every claim. Test seam. */
+function resetRelayDeliveryClaims() {
+    claims.clear();
+}