commandmate 0.46.1 → 0.47.2

package/dist/server/src/lib/cli-tools/launch-dialog.js

@@ -0,0 +1,203 @@
+"use strict";
+/**
+ * Startup confirmations a launch answers by itself (Issue #3776).
+ *
+ * gemini and agy each ask a folder-trust question before their prompt comes
+ * up, and their launch used to answer it with a blind Enter as soon as the
+ * question's wording was anywhere on the screen. An Enter confirms whichever
+ * row the cursor is on, so a cursor on `Don't trust` / `No, exit` wrote that
+ * answer for good (gemini's `trustedFolders.json`), and a question whose
+ * wording had changed (gemini v0.62.0) was never answered at all, silently.
+ *
+ * Each confirmation is declared once here — its question, the row that is safe
+ * to confirm, how its cursor row looks and the key that confirms it — and
+ * {@link decideLaunchDialog} reads one screen against that declaration: press,
+ * leave it (the cursor is somewhere else), or "this looks like the dialog but
+ * does not read as it" (the wording or the drawing changed). Pure: the caller
+ * sends the key and writes the log.
+ *
+ * A screen counts as the dialog only when the question is followed, a few rows
+ * down, by a block of the declared option rows (review of #3776): a reply that
+ * quotes the question, a diff of this file, or another tool's permission
+ * screen under a quoted question is not the dialog.
+ *
+ * Must not import `../tmux/tmux`: the Auto-Yes poller's suppression step reads
+ * {@link isLaunchDialogOpen} / {@link decideLaunchDialog} to leave these
+ * screens to the launch.
+ *
+ * @module lib/cli-tools/launch-dialog
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ANTIGRAVITY_TRUST_LAUNCH_DIALOG = exports.GEMINI_TRUST_LAUNCH_DIALOG = void 0;
+exports.decideLaunchDialog = decideLaunchDialog;
+exports.isLaunchDialogOpen = isLaunchDialogOpen;
+exports.isLaunchDialogDrawn = isLaunchDialogDrawn;
+exports.launchDialogWarning = launchDialogWarning;
+const cli_patterns_1 = require("../detection/cli-patterns");
+const patterns_1 = require("../detection/tools/antigravity/patterns");
+/** Longest cursor label a decision carries (it goes into logs). */
+const MAX_CURSOR_LABEL_LENGTH = 80;
+/**
+ * gemini's folder-trust question (measured on v0.62.0, 2026-10-17, private
+ * HOME, empty folder; `tests/fixtures/gemini-live-3776/`):
+ *
+ *   │ Do you trust the files in this folder?
+ *   │ ● 1. Trust folder (<folder>)       <- cursor here by default
+ *   │   2. Trust parent folder (<parent>)
+ *   │   3. Don't trust
+ *
+ * Earlier builds asked `Do you trust this folder?` over the same three rows.
+ * Only `1. Trust folder` is safe: `2.` trusts every sibling of the worktree.
+ * One Enter on it makes gemini restart itself ("Gemini CLI is restarting to
+ * apply the trust changes...") and, on a HOME that never signed in, draw the
+ * authentication picker — whose default an extra Enter would confirm.
+ */
+exports.GEMINI_TRUST_LAUNCH_DIALOG = {
+    id: 'gemini-folder-trust',
+    question: /Do you trust (?:the files in )?this folder\?/,
+    signature: /\bTrust folder\b|\bDon't trust\b/,
+    cursorRow: /^[\s│]*●\s*(\S.*?)[\s│]*$/,
+    optionRow: /^[\s│]*(?:\S\s+)?\d\.\s+(?:Trust folder|Trust parent folder|Don't trust)\b/,
+    minOptionRows: 2,
+    optionsWithin: 8,
+    dismissedRow: /restarting to apply the trust changes/,
+    safeRow: /^1\.\s+Trust folder\b/,
+    key: 'Enter',
+    // The dialog is 11 rows from its question to its lower border; the rest is
+    // room for a notice or footer drawn under it.
+    liveRows: 30,
+    declaredIn: 'src/lib/cli-tools/launch-dialog.ts (GEMINI_TRUST_LAUNCH_DIALOG)',
+};
+/**
+ * agy's folder-trust question (Issue #988;
+ * `tests/fixtures/antigravity-live-2364/trust-dialog.txt`):
+ *
+ *   Do you trust the contents of this project?
+ *   > Yes, I trust this folder   <- cursor here by default
+ *     No, exit
+ *   ↑/↓ Navigate · enter Confirm
+ */
+exports.ANTIGRAVITY_TRUST_LAUNCH_DIALOG = {
+    id: 'antigravity-folder-trust',
+    question: patterns_1.ANTIGRAVITY_TRUST_DIALOG_PATTERN,
+    signature: /\bYes, I trust this folder\b/,
+    optionRow: /^\s*(?:\S\s+)?(?:Yes, I trust this folder|No, exit)\s*$/,
+    minOptionRows: 2,
+    optionsWithin: 4,
+    cursorRow: /^\s*>\s+(\S.*?)\s*$/,
+    safeRow: /^Yes, I trust this folder$/,
+    key: 'Enter',
+    liveRows: 12,
+    declaredIn: 'src/lib/cli-tools/launch-dialog.ts (ANTIGRAVITY_TRUST_LAUNCH_DIALOG)',
+};
+/** The last `count` non-blank rows of a screen, ANSI stripped and right-trimmed. */
+function liveRowsOf(screen, count) {
+    const rows = (0, cli_patterns_1.stripAnsi)(screen)
+        .split('\n')
+        .map((row) => row.trimEnd())
+        .filter((row) => row.trim() !== '');
+    return rows.slice(-count);
+}
+/** The rows below the last dismissal row (all of them when there is none). */
+function rowsAfterDismissal(spec, rows) {
+    if (!spec.dismissedRow)
+        return rows;
+    for (let i = rows.length - 1; i >= 0; i--) {
+        if (spec.dismissedRow.test(rows[i]))
+            return rows.slice(i + 1);
+    }
+    return rows;
+}
+/** The option rows of the dialog asked at `questionAt`, or null if it has none. */
+function optionBlockAfter(spec, rows, questionAt) {
+    const last = Math.min(rows.length - 1, questionAt + spec.optionsWithin);
+    for (let start = questionAt + 1; start <= last; start++) {
+        if (!spec.optionRow.test(rows[start]))
+            continue;
+        const block = [];
+        for (let i = start; i < rows.length && spec.optionRow.test(rows[i]); i++)
+            block.push(rows[i]);
+        return block.length >= spec.minOptionRows ? block : null;
+    }
+    return null;
+}
+/** The option rows under the last live question that has them, or null. */
+function findDialog(spec, rows) {
+    for (let i = rows.length - 1; i >= 0; i--) {
+        if (!spec.question.test(rows[i]))
+            continue;
+        const block = optionBlockAfter(spec, rows, i);
+        if (block)
+            return block;
+    }
+    return null;
+}
+/**
+ * Read one screen against a launch dialog's declaration (Issue #3776).
+ *
+ * The question must be among the last {@link LaunchDialogSpec.liveRows}
+ * non-blank rows, below any dismissal row, with its option block under it; the
+ * key is pressed only when exactly one option row carries the cursor and its
+ * label is the safe one.
+ *
+ * @param spec - The confirmation being looked for
+ * @param screen - One capture of the pane (ANSI allowed)
+ */
+function decideLaunchDialog(spec, screen) {
+    const rows = rowsAfterDismissal(spec, liveRowsOf(screen, spec.liveRows));
+    const options = findDialog(spec, rows);
+    if (!options) {
+        return rows.some((row) => spec.signature.test(row))
+            ? { action: 'unrecognized', reason: 'question-not-found' }
+            : { action: 'absent' };
+    }
+    const cursorLabels = [];
+    for (const row of options) {
+        const match = spec.cursorRow.exec(row);
+        if (match)
+            cursorLabels.push(match[1]);
+    }
+    if (cursorLabels.length === 0)
+        return { action: 'unrecognized', reason: 'cursor-not-found' };
+    if (cursorLabels.length > 1)
+        return { action: 'unrecognized', reason: 'multiple-cursors' };
+    const label = cursorLabels[0];
+    return spec.safeRow.test(label)
+        ? { action: 'press', key: spec.key }
+        : { action: 'hold', reason: 'cursor-off-safe-row', cursorLabel: label.slice(0, MAX_CURSOR_LABEL_LENGTH) };
+}
+/**
+ * Whether the dialog — its question over its option block, not dismissed — is
+ * live on the screen, wherever its cursor is (Issue #3776).
+ */
+function isLaunchDialogOpen(spec, screen) {
+    return findDialog(spec, rowsAfterDismissal(spec, liveRowsOf(screen, spec.liveRows))) !== null;
+}
+/**
+ * Whether the dialog is drawn in the live rows, dismissed or not: a dialog
+ * gemini answered stays on the screen, cursor and all, above its restart line
+ * while the restart runs.
+ */
+function isLaunchDialogDrawn(spec, screen) {
+    return findDialog(spec, liveRowsOf(screen, spec.liveRows)) !== null;
+}
+/**
+ * The warn a launch writes when it leaves the dialog alone, or null when the
+ * decision sends or there is nothing to say. Never carries the screen.
+ */
+function launchDialogWarning(spec, decision) {
+    if (decision.action === 'absent' || decision.action === 'press')
+        return null;
+    if (decision.action === 'hold') {
+        return { event: 'launch-dialog-held', fields: { dialog: spec.id, ...decision } };
+    }
+    return {
+        event: 'launch-dialog-unrecognized',
+        fields: {
+            dialog: spec.id,
+            ...decision,
+            // Fail-closed by design; this warn is written once, so say what to look at.
+            hint: `the dialog's wording or cursor drawing may have changed; compare the screen with ${spec.declaredIn}`,
+        },
+    };
+}

package/dist/server/src/lib/cli-tools/launch-window.js

@@ -0,0 +1,96 @@
+"use strict";
+/**
+ * Whether a launch is still answering its own startup confirmation
+ * (review of Issue #3776).
+ *
+ * gemini's launch confirms its folder-trust dialog itself, once, inside its
+ * ~30 s readiness wait (`GeminiTool.waitForReady`); while that wait runs the
+ * Auto-Yes poller must leave the dialog to it, or the two answer it twice. A
+ * dialog still on the screen after the wait — the Enter did not land, or
+ * gemini drew the dialog late (an auto-update, a slow start) — has nobody else
+ * to answer it, so the poller may again, when the cursor is on the safe row.
+ *
+ * The window closing is not the end of the launch's answer (Issue #3790): an
+ * answered dialog stays drawn, cursor on the safe row, until the agent redraws
+ * (gemini's restart line takes about 2 s), and a window that closed in between —
+ * the wait ran out on its last attempts — would hand it to the poller as an
+ * unanswered one. So the launch also records the key it pressed
+ * ({@link recordLaunchDialogPress}), and the poller leaves the dialog alone for
+ * {@link LAUNCH_DIALOG_PRESS_SETTLE_MS} after it, window or not. Past that, a
+ * dialog still on screen is one the key did not reach, and the poller may answer
+ * it as before.
+ *
+ * Copilot's folder-trust dialog has the same window since Issue #3790: its launch
+ * confirms with a `1` and the poller answered `1` + Enter beside it (measured on
+ * 1.0.91: the second `1` + Enter is submitted as a user message).
+ *
+ * Counted, as agy's window is (`antigravity-startup-trust`, Issue #3770): a
+ * relaunch racing another must not have the earlier one's end close the later
+ * one's window. Keyed by tmux session name; reached through `globalThis`
+ * because the launch and the poller may be bundled separately under
+ * `next dev` (Issue #1736).
+ *
+ * @module lib/cli-tools/launch-window
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LAUNCH_DIALOG_PRESS_SETTLE_MS = void 0;
+exports.beginLaunchWindow = beginLaunchWindow;
+exports.endLaunchWindow = endLaunchWindow;
+exports.isLaunchWindowOpen = isLaunchWindowOpen;
+exports.recordLaunchDialogPress = recordLaunchDialogPress;
+exports.isLaunchDialogPressSettling = isLaunchDialogPressSettling;
+exports.clearLaunchWindows = clearLaunchWindows;
+const global_state_1 = require("../global-state");
+/**
+ * How long after the launch pressed its key the dialog stays the launch's
+ * (Issue #3790). Measured on gemini 0.64.0: the restart line is drawn within
+ * 100 ms of the key and the dialog is gone within about 2 s; a dialog still
+ * drawn 30 s later is one the key did not reach.
+ */
+exports.LAUNCH_DIALOG_PRESS_SETTLE_MS = 30_000;
+/** sessionName -> how many launch windows are open. */
+const openLaunchWindows = (0, global_state_1.getOrInitGlobal)('__launchWindows', () => new Map());
+/** sessionName -> when the launch last pressed the key of its startup confirmation. */
+const launchDialogPresses = (0, global_state_1.getOrInitGlobal)('__launchDialogPresses', () => new Map());
+/**
+ * The launch window opened: the launch answers its startup confirmation in it.
+ * A key an earlier launch of the session pressed is forgotten: the dialog this
+ * launch draws is a new one.
+ */
+function beginLaunchWindow(sessionName) {
+    openLaunchWindows.set(sessionName, (openLaunchWindows.get(sessionName) ?? 0) + 1);
+    launchDialogPresses.delete(sessionName);
+}
+/** The launch window closed, however it ended. */
+function endLaunchWindow(sessionName) {
+    const open = openLaunchWindows.get(sessionName) ?? 0;
+    if (open <= 1)
+        openLaunchWindows.delete(sessionName);
+    else
+        openLaunchWindows.set(sessionName, open - 1);
+}
+/**
+ * @returns True while a launch window is open. A session this process never
+ *   launched (a server restart, another launcher) has none open.
+ */
+function isLaunchWindowOpen(sessionName) {
+    return openLaunchWindows.has(sessionName);
+}
+/** The launch pressed the key that confirms its startup confirmation (Issue #3790). */
+function recordLaunchDialogPress(sessionName, at = Date.now()) {
+    launchDialogPresses.set(sessionName, at);
+}
+/**
+ * @returns True within {@link LAUNCH_DIALOG_PRESS_SETTLE_MS} of the launch's
+ *   key (Issue #3790): the dialog on screen may be the one it answered, not yet
+ *   redrawn, whether or not the window is still open.
+ */
+function isLaunchDialogPressSettling(sessionName, now = Date.now()) {
+    const at = launchDialogPresses.get(sessionName);
+    return at !== undefined && now - at < exports.LAUNCH_DIALOG_PRESS_SETTLE_MS;
+}
+/** Close every window and forget every press. Test seam. */
+function clearLaunchWindows() {
+    openLaunchWindows.clear();
+    launchDialogPresses.clear();
+}

package/dist/server/src/lib/detection/prompt-detect-multiple-choice.js

@@ -707,6 +707,11 @@ function extractInstructionText(lines, questionEndIndex, effectiveEnd) {
  *
  * Horizontal rules count too: Codex draws one between turns.
  *
+ * [Issue #3817] Not inside the panel's own frame: the command a panel shows can
+ * carry the same glyphs (a here-document's `> quoted` rows), drawn deeper than
+ * the panel's header, question and option rows. See
+ * {@link findApprovalContextStart}.
+ *
  * Anchored at the start of the trimmed line — ReDoS safe (no repetition).
  */
 const TURN_BOUNDARY_PATTERN = /^[⏺⎿●○•✔✓✖✗✘›»❯└├>]/;
@@ -721,7 +726,32 @@ const TURN_BOUNDARY_PATTERN = /^[⏺⎿●○•✔✓✖✗✘›»❯└├>]/
  * command + description + blank.
  */
 exports.APPROVAL_TARGET_MAX_LOOKBACK = 12;
-/** True when this line belongs to a previous turn rather than the prompt panel. */
+/**
+ * A previous tool call's result row (Issue #3817): claude's `⎿`, codex's `└` /
+ * `├` output continuation. Never the user's echo or a quote (`>`).
+ */
+const RESULT_MARKER_PATTERN = /^[⎿└├]/;
+/** Width of a row's leading whitespace. */
+function indentOf(line) {
+    return line.length - line.trimStart().length;
+}
+/**
+ * The column the dialog's own frame is drawn at (Issue #3817): the least
+ * indented non-blank row from the question down to `panelEnd`. Those rows are
+ * the question, the option block and the footer — claude puts them at column 1
+ * and the command at column 3, codex its `› 1.` cursor at column 0.
+ */
+function panelFrameIndent(lines, questionLineIndex, panelEnd) {
+    let indent = Infinity;
+    for (let i = questionLineIndex; i < Math.min(panelEnd, lines.length); i++) {
+        const line = lines[i];
+        if (line === undefined || line.trim() === '')
+            continue;
+        indent = Math.min(indent, indentOf(line));
+    }
+    return indent === Infinity ? 0 : indent;
+}
+/** True when this line carries a transcript marker or is a rule. */
 function isTurnBoundaryLine(rawLine) {
     if (rawLine === undefined)
         return false;
@@ -738,21 +768,73 @@ function isTurnBoundaryLine(rawLine) {
  * Everything above the returned index is a previous turn and must never reach a
  * deny pattern — that poisoning is Issue #1699.
  *
+ * [Issue #3817] A marker row indented deeper than the dialog's frame
+ * ({@link panelFrameIndent}) is the body of the command the panel asks about
+ * when a frame row sits above it — the `> quoted` rows of a here-document
+ * under a claude panel's ` Bash command` header. Cutting there took the command
+ * rows above it out of the deny surface. The previous turn's markers are drawn
+ * at or left of the frame (`⏺`, the user's `> msg` / `❯ msg` echo, a rule), or
+ * deeper with no frame row above them (claude's `  ⎿` result right under its
+ * `⏺`), and both still end the scan.
+ *
+ * A frame row cannot be told from a body row drawn at the frame's column (a
+ * shell here-document's `EOF`), so a frame row is taken as an older panel's
+ * header only in one shape: a tool-use block — a marker row at the frame's
+ * column, then that row, then deeper rows that are all result markers
+ * ({@link RESULT_MARKER_PATTERN}). Anything else between two frame rows is read
+ * as body: when the screen cannot tell, the deny surface is taken wide.
+ *
  * Shared by both detector paths: multiple_choice passes its `questionEndIndex`,
  * yes_no the line its pattern matched on.
  *
  * @param lines - Full frame, already ANSI/box stripped
  * @param questionLineIndex - Line the prompt's own question sits on
+ * @param panelEnd - Exclusive end of the dialog's own rows (Issue #3817); their
+ *   least indented row is the frame. Defaults to the question row alone.
  * @returns Index of the first line of the current prompt's own block
  */
-function findApprovalContextStart(lines, questionLineIndex) {
+function findApprovalContextStart(lines, questionLineIndex, panelEnd = questionLineIndex + 1) {
     const floor = Math.max(0, questionLineIndex - exports.APPROVAL_TARGET_MAX_LOOKBACK);
+    const frameIndent = panelFrameIndent(lines, questionLineIndex, panelEnd);
+    // The lowest deeper marker row with no frame row found above it yet.
+    let unenclosed = -1;
+    // The deeper rows since the last frame row: are they all result markers?
+    let segmentRows = 0;
+    let segmentAllResults = true;
     for (let i = questionLineIndex - 1; i >= floor; i--) {
-        if (isTurnBoundaryLine(lines[i])) {
-            return i + 1;
+        const line = lines[i];
+        if (line === undefined || line.trim() === '')
+            continue;
+        const atFrame = indentOf(line) <= frameIndent;
+        const marker = isTurnBoundaryLine(line);
+        if (marker && atFrame)
+            return (unenclosed >= 0 ? unenclosed : i) + 1;
+        if (!atFrame) {
+            if (marker && unenclosed < 0)
+                unenclosed = i;
+            segmentRows++;
+            segmentAllResults &&= RESULT_MARKER_PATTERN.test(line.trim());
+            continue;
+        }
+        // A frame row: an older tool-use block's header only in that one shape.
+        if (unenclosed >= 0 && segmentRows > 0 && segmentAllResults && isMarkerRowAtFrameAbove(lines, i, floor, frameIndent)) {
+            return unenclosed + 1;
         }
+        unenclosed = -1;
+        segmentRows = 0;
+        segmentAllResults = true;
     }
-    return floor;
+    return unenclosed >= 0 ? unenclosed + 1 : floor;
+}
+/** True when the nearest non-blank row above `row` is a marker row at the frame's column. */
+function isMarkerRowAtFrameAbove(lines, row, floor, frameIndent) {
+    for (let i = row - 1; i >= floor; i--) {
+        const line = lines[i];
+        if (line === undefined || line.trim() === '')
+            continue;
+        return indentOf(line) <= frameIndent && isTurnBoundaryLine(line);
+    }
+    return false;
 }
 /**
  * Join a slice of the frame into an approval-target string.
@@ -800,7 +882,7 @@ function extractApprovalTarget(lines, questionEndIndex, effectiveEnd, floor = 0)
     if (questionEndIndex < 0) {
         return undefined;
     }
-    return joinApprovalTarget(lines, Math.max(floor, findApprovalContextStart(lines, questionEndIndex)), effectiveEnd);
+    return joinApprovalTarget(lines, Math.max(floor, findApprovalContextStart(lines, questionEndIndex, effectiveEnd)), effectiveEnd);
 }
 /**
  * Build the final PromptDetectionResult for a multiple choice prompt.

package/dist/server/src/lib/detection/prompt-detector.js

@@ -70,7 +70,7 @@ function locateMatchLines(tailText, tailStart, match) {
  */
 function yesNoApprovalTarget(lines, tailText, tailStart, match) {
     const { startLine, endLine } = locateMatchLines(tailText, tailStart, match);
-    return (0, prompt_detect_multiple_choice_1.joinApprovalTarget)(lines, (0, prompt_detect_multiple_choice_1.findApprovalContextStart)(lines, startLine), endLine + 1);
+    return (0, prompt_detect_multiple_choice_1.joinApprovalTarget)(lines, (0, prompt_detect_multiple_choice_1.findApprovalContextStart)(lines, startLine, endLine + 1), endLine + 1);
 }
 /**
  * Creates a yes/no prompt detection result.

package/dist/server/src/lib/detection/selection-shape.js

@@ -64,15 +64,17 @@
  * written once.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.readCommandCodeReviewPage = exports.isCommandCodePlanApproveChoice = exports.hasDismissablePanelFooter = exports.hasCommandCodeSelectionListFooterAtBottom = exports.hasCommandCodePlanReviewFooterAtBottom = exports.hasCommandCodeDismissablePanelFooterAtBottom = exports.DISMISSABLE_PANEL_FOOTER_PATTERN = exports.COMMAND_CODE_SELECTION_LIST_FOOTER = exports.COMMAND_CODE_PLAN_APPROVE_CHOICE_ROW = exports.COMMAND_CODE_PLAN_APPROVE_CHOICE_FOOTER = exports.SET_AS_DEFAULT_FOOTER_PATTERN = exports.SESSION_SCOPE_FOOTER_PATTERN = exports.MAX_OPTION_NUMBER = exports.SELECTION_SHAPE_TAIL_LINE_COUNT = exports.COMMAND_CODE_PLAN_REVIEW_FOOTER = void 0;
+exports.TRUST_CONFIRMATION_TAIL_LINE_COUNT = exports.readCommandCodeReviewPage = exports.isCommandCodePlanApproveChoice = exports.hasDismissablePanelFooter = exports.hasCommandCodeSelectionListFooterAtBottom = exports.hasCommandCodePlanReviewFooterAtBottom = exports.hasCommandCodeDismissablePanelFooterAtBottom = exports.DISMISSABLE_PANEL_FOOTER_PATTERN = exports.COMMAND_CODE_SELECTION_LIST_FOOTER = exports.COMMAND_CODE_PLAN_APPROVE_CHOICE_ROW = exports.COMMAND_CODE_PLAN_APPROVE_CHOICE_FOOTER = exports.SET_AS_DEFAULT_FOOTER_PATTERN = exports.SESSION_SCOPE_FOOTER_PATTERN = exports.MAX_OPTION_NUMBER = exports.SELECTION_SHAPE_TAIL_LINE_COUNT = exports.COMMAND_CODE_PLAN_REVIEW_FOOTER = void 0;
 exports.readCommandCodeQuestionRegion = readCommandCodeQuestionRegion;
 exports.hasCommandCodeQuestionChrome = hasCommandCodeQuestionChrome;
 exports.extractCommandCodeSelectionListFrame = extractCommandCodeSelectionListFrame;
 exports.readSelectionListShape = readSelectionListShape;
 exports.shouldOfferOptionNumbers = shouldOfferOptionNumbers;
+exports.isTrustConfirmationFrame = isTrustConfirmationFrame;
 const ansi_1 = require("./ansi");
 const selection_shape_patterns_1 = require("./selection-shape-patterns");
 Object.defineProperty(exports, "COMMAND_CODE_PLAN_REVIEW_FOOTER", { enumerable: true, get: function () { return selection_shape_patterns_1.COMMAND_CODE_PLAN_REVIEW_FOOTER; } });
+const patterns_1 = require("./tools/antigravity/patterns");
 /**
  * How many rows up from the last content row the shape is read.
  *
@@ -611,3 +613,35 @@ function shouldOfferOptionNumbers(shape) {
         !shape.hasFilterInput &&
         !shape.offersPlanApprove);
 }
+/**
+ * How many content rows from the bottom {@link isTrustConfirmationFrame} hands
+ * the detector's predicate: the detector's own `STATUS_CHECK_LINE_COUNT`
+ * (`tools/frame.ts`, the `lastLines` window), restated because that module
+ * pulls `cli-patterns` and its logger into the browser bundle. Pinned equal by
+ * `tests/unit/lib/detection/trust-confirmation-frame-3758.test.ts`.
+ */
+exports.TRUST_CONFIRMATION_TAIL_LINE_COUNT = 15;
+/**
+ * Is this selection list a folder-trust confirmation (Issue #3758)?
+ *
+ * agy's `Do you trust the contents of this project?` screen is unnumbered, so it
+ * is published as an `antigravity_selection_list` (`isSelectionListActive`) and
+ * never as a prompt — no prompt panel, no sheet — and Auto-Yes does not answer
+ * it (#3757). The surfaces drew the bare arrow pad and the generic "a selection
+ * list is open" sentence, which did not say the agent is stopped until somebody
+ * answers on the terminal. This tells them which screen it is, so they can say
+ * so.
+ *
+ * The test is the detector's own (`isAntigravityTrustScreen`) over the same
+ * window of rows, not a copy of it. Callers ask only while the server says a
+ * selection list is up; this does not decide THAT.
+ *
+ * @param frame - the raw pane (`PaneTerminalState.output` / the poll's `fullOutput`)
+ * @param cliToolId - the tool the pane belongs to; only agy draws this screen
+ */
+function isTrustConfirmationFrame(frame, cliToolId) {
+    if (!frame || cliToolId !== 'antigravity')
+        return false;
+    const lines = tailLines(frame);
+    return (0, patterns_1.isAntigravityTrustScreen)(lines.slice(-exports.TRUST_CONFIRMATION_TAIL_LINE_COUNT).join('\n'));
+}

package/dist/server/src/lib/detection/tools/antigravity/detect.js

@@ -35,6 +35,24 @@ exports.VERIFIED_AGAINST = verified_against_1.ANTIGRAVITY_VERIFIED_AGAINST;
  * card) on screen, and what makes `wait` stop with exit 10 instead of hanging.
  */
 const SELECTION_LIST_VERDICT = (0, verdicts_1.positiveVerdict)('waiting', status_reason_1.STATUS_REASON.ANTIGRAVITY_SELECTION_LIST);
+/**
+ * agy generating: the braille spinner or the `Generating...` word — the parts of
+ * `ANTIGRAVITY_THINKING_PATTERN` a permission dialog does not draw (its
+ * `esc to cancel` row it does).
+ */
+const ANTIGRAVITY_GENERATING_PATTERN = /[\u2800-\u28FF]|Generating/;
+/**
+ * An agy numbered screen no reader vouches for (Issue #2364, #3808): published
+ * as unclassified — the hatch opens and `wait` stops — never as a picker (the
+ * arrow pad would Enter the highlighted row) and never as "generating".
+ */
+const UNKNOWN_FRAME_VERDICT = {
+    status: 'running',
+    confidence: 'low',
+    reason: status_reason_1.STATUS_REASON.UNKNOWN_FRAME,
+    hasActivePrompt: false,
+    evidence: 'none',
+};
 /**
  * How close to the bottom of the content the survey row must be to count as
  * open: itself, a blank row and the `? for shortcuts` status row.
@@ -121,8 +139,20 @@ exports.antigravityStatusDetector = (0, run_detection_1.createToolStatusDetector
         // Issue #2845: only while the screen is the live one. The words alone are
         // not enough — a reply that quotes the `↑/↓ Navigate` footer leaves them in
         // the last rows of a pane whose composer is drawn below them.
-        if (!cli_patterns_1.ANTIGRAVITY_SELECTION_LIST_PATTERN.test(frame.lastLines))
-            return null;
+        if (!cli_patterns_1.ANTIGRAVITY_SELECTION_LIST_PATTERN.test(frame.lastLines)) {
+            // Issue #3808: numbered options with no `↑/↓ Navigate` footer on screen
+            // (cut at `↑/↓ Nav`, or below the pane) are not handed to the generic
+            // parser's `prompt_detected` either — the same frames the Auto-Yes
+            // poller and `/prompt-response` decline. `/feedback` keeps its reading.
+            //
+            // Not ahead of generation: a spinner or `Generating…` in the last rows
+            // leaves the frame to the thinking check (a sent message numbered
+            // `1. / 2.` echoes above the spinner). The bare `esc to cancel` row does
+            // not count — agy draws it under its permission dialogs too.
+            if (ANTIGRAVITY_GENERATING_PATTERN.test(frame.thinkingLines))
+                return null;
+            return (0, dialog_1.isAntigravityUnvouchedNumberedScreen)((0, cli_patterns_1.stripBoxDrawing)(frame.clean)) ? UNKNOWN_FRAME_VERDICT : null;
+        }
         if (!isAntigravitySelectionScreenOpen(frame.lastLines))
             return null;
         // Issue #2270 / #2364: except when the frame is a NUMBERED dialog.
@@ -155,6 +185,11 @@ exports.antigravityStatusDetector = (0, run_detection_1.createToolStatusDetector
         // which reads the same helper over the same spelling) carry one question,
         // one option list and one `instructionText` for one screen.
         //
+        // Issue #3808: the reader also declines a numbered screen whose footer is
+        // not a permission dialog's (`… · tab Amend`) — agy 1.4's login-method
+        // screen, a footer a narrow pane cut — so those land on the unclassified
+        // verdict below: a human answers them, Auto-Yes never does.
+        //
         // #995's own case is untouched: the Switch Model picker carries no numbered
         // rows, so it still resolves below and still keeps NavigationButtons.
         const text = (0, cli_patterns_1.stripBoxDrawing)(frame.clean);
@@ -163,13 +198,7 @@ exports.antigravityStatusDetector = (0, run_detection_1.createToolStatusDetector
             if (promptDetection !== null) {
                 return (0, verdicts_1.activePromptVerdict)(status_reason_1.STATUS_REASON.PROMPT_DETECTED, promptDetection);
             }
-            return {
-                status: 'running',
-                confidence: 'low',
-                reason: status_reason_1.STATUS_REASON.UNKNOWN_FRAME,
-                hasActivePrompt: false,
-                evidence: 'none',
-            };
+            return UNKNOWN_FRAME_VERDICT;
         }
         return SELECTION_LIST_VERDICT;
     },