commandmate 0.46.1 → 0.47.2

package/dist/server/src/lib/detection/tools/antigravity/dialog.js

@@ -65,10 +65,12 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.readAntigravityNumberedDialog = readAntigravityNumberedDialog;
 exports.detectAntigravityNumberedDialogPrompt = detectAntigravityNumberedDialogPrompt;
+exports.isAntigravityUnvouchedNumberedScreen = isAntigravityUnvouchedNumberedScreen;
 const cli_patterns_1 = require("../../cli-patterns");
 const prompt_detect_multiple_choice_1 = require("../../prompt-detect-multiple-choice");
 const tui_detection_frame_1 = require("../../tui-detection-frame");
 const dialog_block_1 = require("../dialog-block");
+const patterns_1 = require("./patterns");
 const truncate_raw_content_1 = require("../../truncate-raw-content");
 /**
  * How many non-blank rows above option 1 may be searched for the question.
@@ -104,7 +106,9 @@ const QUESTION_ROW_PATTERN = /[?？]\s*$/;
 /**
  * Read agy's numbered dialog off ANSI-stripped rows.
  *
- * Null when the frame has no `↑/↓ Navigate` footer, when the rows above it do
+ * Null when the frame has no `↑/↓ Navigate` footer, when that footer is not a
+ * permission dialog's `… · tab Amend` one (the login-method screen, a footer a
+ * narrow pane cut — Issue #3808), when the rows above it do
  * not form a numbered run reaching `1.` (the Switch Model picker, the trust
  * screen, the slash popup), or when the block sits under a `Switch Model`
  * header. A caller that has already passed `isAntigravityNumberedDialog` and
@@ -115,6 +119,10 @@ function readAntigravityNumberedDialog(lines) {
     const region = (0, cli_patterns_1.locateAntigravityDialogRegion)(lines);
     if (region === null)
         return null;
+    // Issue #3808: only a permission dialog's footer vouches for the block —
+    // see ANTIGRAVITY_PERMISSION_FOOTER_PATTERN.
+    if (!patterns_1.ANTIGRAVITY_PERMISSION_FOOTER_PATTERN.test(lines[region.footer]))
+        return null;
     const regionRows = lines.slice(region.start, region.footer);
     if (regionRows.some(row => cli_patterns_1.ANTIGRAVITY_SWITCH_MODEL_HEADER_PATTERN.test(row)))
         return null;
@@ -221,6 +229,85 @@ function detectAntigravityNumberedDialogPrompt(text) {
         // turn's boundary and below at the footer, so the command in the
         // `Requesting permission for:` block and in the labels is judged and
         // nothing from an earlier, already-answered approval is.
-        approvalTarget: (0, prompt_detect_multiple_choice_1.joinApprovalTarget)(lines, (0, prompt_detect_multiple_choice_1.findApprovalContextStart)(lines, dialog.questionRow), dialog.footerRow),
+        approvalTarget: (0, prompt_detect_multiple_choice_1.joinApprovalTarget)(lines, (0, prompt_detect_multiple_choice_1.findApprovalContextStart)(lines, dialog.questionRow, dialog.footerRow), dialog.footerRow),
     }, normalized, truncate_raw_content_1.truncateRawContent);
 }
+/**
+ * agy's `/feedback` category menu footer (`esc Cancel · 1-6 Select & Continue ·
+ * enter Continue`, `antigravity-live-2364/dialog-feedback-category.txt`): the
+ * one numbered agy screen the generic parser is left to read (#2364).
+ */
+/** A numbered option row (`> 1. Yes`, `  2. No`): the `>` cursor, then the number. */
+const OPTION_ROW_PATTERN = /^\s*(>)?\s*(\d+)\.\s+\S/;
+/**
+ * agy's `/feedback` category menu footer (`esc Cancel · 1-6 Select & Continue ·
+ * enter Continue`, `antigravity-live-2364/dialog-feedback-category.txt`): the
+ * one numbered agy screen the generic parser is left to read (#2364). Anchored
+ * at the row start and matched only on the first row under the last option,
+ * so the same words inside an option label or a quoted command never match.
+ */
+const FEEDBACK_MENU_FOOTER_PATTERN = /^\s*esc Cancel\s*·\s*\d+-\d+\s+Select\b/;
+/** How far above the bottom option row the run down from `1.` may reach. */
+const OPTION_RUN_MAX_ROWS = 40;
+/**
+ * Is this an agy screen with numbered options that the permission reader does
+ * NOT vouch for? (Issue #3808)
+ *
+ * True when the frame ends on a run of options numbered `1.` … `N.` (N ≥ 2,
+ * consecutive, wrapped label rows allowed between them, no boundary row
+ * inside) with one row wearing agy's `>` cursor, no `>` composer drawn under
+ * the run — agy paints none while a screen replaces it, so the options are the
+ * live screen's, not a reply's (a reply's list wears no cursor either) — and
+ * {@link readAntigravityNumberedDialog} does not read the frame (no complete
+ * `↑/↓ Navigate · tab Amend` footer: the login-method screen, a footer a narrow
+ * pane cut at `↑/↓ Nav`, or one below the pane altogether). Deliberately
+ * independent of the footer, so a footer that is not on screen cannot hand the
+ * frame back to the generic parser. A single `> 1. …` row — a sent message
+ * echoed above the spinner — is not a run.
+ *
+ * False for the `/feedback` menu (its `esc Cancel · 1-6 Select` footer directly
+ * under the last option), which keeps the generic reading #2364 left it.
+ *
+ * Callers treat true as "no prompt to answer": a human drives the screen.
+ *
+ * @param text - ANSI-stripped capture, box drawing optional
+ */
+function isAntigravityUnvouchedNumberedScreen(text) {
+    const lines = (0, tui_detection_frame_1.normalizeTuiFrameForDetection)(text).split('\n');
+    let last = -1;
+    for (let i = lines.length - 1; i >= 0; i--) {
+        if (patterns_1.ANTIGRAVITY_PROMPT_PATTERN.test(lines[i]))
+            return false;
+        if (OPTION_ROW_PATTERN.test(lines[i])) {
+            last = i;
+            break;
+        }
+    }
+    if (last < 0)
+        return false;
+    // The run, read upward from the bottom option: N., N-1., … 1.
+    let expected = Number(OPTION_ROW_PATTERN.exec(lines[last])[2]);
+    if (expected < 2)
+        return false;
+    let highlighted = OPTION_ROW_PATTERN.exec(lines[last])[1] !== undefined;
+    const floor = Math.max(0, last - OPTION_RUN_MAX_ROWS);
+    for (let i = last - 1; i >= floor && expected > 1; i--) {
+        const match = OPTION_ROW_PATTERN.exec(lines[i]);
+        if (match === null) {
+            if (cli_patterns_1.ANTIGRAVITY_DIALOG_BOUNDARY_PATTERN.test(lines[i]))
+                return false;
+            continue;
+        }
+        if (Number(match[2]) !== expected - 1)
+            return false;
+        expected--;
+        if (match[1] !== undefined)
+            highlighted = true;
+    }
+    if (expected !== 1 || !highlighted)
+        return false;
+    const footer = lines.slice(last + 1).find(row => row.trim() !== '');
+    if (footer !== undefined && FEEDBACK_MENU_FOOTER_PATTERN.test(footer))
+        return false;
+    return readAntigravityNumberedDialog(lines) === null;
+}

package/dist/server/src/lib/detection/tools/antigravity/patterns.js

@@ -4,7 +4,8 @@
  * (Issue #3217). `cli-patterns.ts` re-exports every public name.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ANTIGRAVITY_SKIP_PATTERNS = exports.ANTIGRAVITY_SURVEY_PATTERN = exports.ANTIGRAVITY_DIALOG_MAX_ROWS = exports.ANTIGRAVITY_DIALOG_BOUNDARY_PATTERN = exports.ANTIGRAVITY_SWITCH_MODEL_HEADER_PATTERN = exports.ANTIGRAVITY_NUMBERED_OPTION_PATTERN = exports.ANTIGRAVITY_NAVIGATE_FOOTER_PATTERN = exports.ANTIGRAVITY_SELECTION_LIST_PATTERN = exports.ANTIGRAVITY_SEPARATOR_PATTERN = exports.ANTIGRAVITY_THINKING_PATTERN = exports.ANTIGRAVITY_PROMPT_PATTERN = exports.ANTIGRAVITY_COMPOSER_MODE_BANNER_PATTERN = exports.ANTIGRAVITY_COMPOSER_MODE_BANNER_SOURCE = void 0;
+exports.ANTIGRAVITY_SKIP_PATTERNS = exports.ANTIGRAVITY_TRUST_DIALOG_PATTERN = exports.ANTIGRAVITY_SURVEY_PATTERN = exports.ANTIGRAVITY_DIALOG_MAX_ROWS = exports.ANTIGRAVITY_DIALOG_BOUNDARY_PATTERN = exports.ANTIGRAVITY_SWITCH_MODEL_HEADER_PATTERN = exports.ANTIGRAVITY_NUMBERED_OPTION_PATTERN = exports.ANTIGRAVITY_PERMISSION_FOOTER_PATTERN = exports.ANTIGRAVITY_NAVIGATE_FOOTER_PATTERN = exports.ANTIGRAVITY_SELECTION_LIST_PATTERN = exports.ANTIGRAVITY_SEPARATOR_PATTERN = exports.ANTIGRAVITY_THINKING_PATTERN = exports.ANTIGRAVITY_PROMPT_PATTERN = exports.ANTIGRAVITY_COMPOSER_MODE_BANNER_PATTERN = exports.ANTIGRAVITY_COMPOSER_MODE_BANNER_SOURCE = void 0;
+exports.isAntigravityTrustScreen = isAntigravityTrustScreen;
 exports.locateAntigravityDialogRegion = locateAntigravityDialogRegion;
 exports.isAntigravityNumberedDialog = isAntigravityNumberedDialog;
 const pasted_text_1 = require("../../shared/pasted-text");
@@ -104,6 +105,20 @@ exports.ANTIGRAVITY_SELECTION_LIST_PATTERN = /Switch Model|↑\/↓\s*Navigate/m
  * edit/expand command`, `enter Confirm`, `←/→ Effort  enter Select`).
  */
 exports.ANTIGRAVITY_NAVIGATE_FOOTER_PATTERN = /↑\/↓\s*Navigate/;
+/**
+ * The footer every measured agy PERMISSION dialog ends on: `↑/↓ Navigate · tab
+ * Amend · f full diff` (file creation), `… · tab Amend · ctrl+g edit/expand
+ * command[ · ctrl+r Review]` (command execution)
+ * (`tests/fixtures/antigravity-live-2364/dialog-*.txt`).
+ *
+ * The numbered-dialog reader requires it on the footer row (Issue #3797 for the
+ * prompt observation, #3808 for every producer): agy 1.4's login-method screen
+ * (`↑/↓ Navigate · enter Select`) draws numbered rows too and is not a
+ * permission request. A footer cut short by a narrow pane, wrapped onto the
+ * next row, or spelled differently by another version fails it on purpose —
+ * the frame is then not answered.
+ */
+exports.ANTIGRAVITY_PERMISSION_FOOTER_PATTERN = /↑\/↓\s*Navigate\s*·\s*tab Amend\b/;
 /**
  * One numbered option row of agy's dialogs: `> 1. Yes`, `  4. No`,
  * `  2. No, deny creation`.
@@ -176,6 +191,31 @@ exports.ANTIGRAVITY_DIALOG_MAX_ROWS = 60;
  * that was waiting for a keypress. Anchored to the whole row.
  */
 exports.ANTIGRAVITY_SURVEY_PATTERN = /^\s*\[1\]\s*Good\s+\[2\]\s*Fine\s+\[3\]\s*Bad\s+\[0\]\s*Skip\s*$/m;
+/**
+ * The question of agy's startup folder-trust screen (Issue #988):
+ *
+ *   Do you trust the contents of this project?
+ *   > Yes, I trust this folder   <- default-selected option
+ *     No, exit
+ *   ↑/↓ Navigate · enter Confirm
+ *
+ * Unnumbered, so {@link isAntigravityNumberedDialog} is false on it and neither
+ * the agy dialog reader nor the generic numbered parser reads it as a prompt
+ * (Issue #3757).
+ */
+exports.ANTIGRAVITY_TRUST_DIALOG_PATTERN = /Do you trust the contents of this project\?/;
+/**
+ * Is agy's folder-trust screen live at the bottom of the frame (Issue #3757)?
+ *
+ * The question AND the `↑/↓ Navigate` footer, both in the status tail: the
+ * question alone also matches the dismissed screen left in the scrollback, or a
+ * reply quoting it, and neither of those is waiting for an answer.
+ *
+ * @param lastLines - The status detector's tail (`normalizeFrame(…).lastLines`)
+ */
+function isAntigravityTrustScreen(lastLines) {
+    return exports.ANTIGRAVITY_TRUST_DIALOG_PATTERN.test(lastLines) && exports.ANTIGRAVITY_NAVIGATE_FOOTER_PATTERN.test(lastLines);
+}
 /**
  * Find the rows between the last boundary and the last `↑/↓ Navigate` footer
  * (Issue #2364).

package/dist/server/src/lib/detection/tools/claude/detect.js

@@ -10,6 +10,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.claudeStatusDetector = void 0;
 exports.findClaudeTranscriptTail = findClaudeTranscriptTail;
+exports.isClaudeAskUserQuestionConfirmPage = isClaudeAskUserQuestionConfirmPage;
 exports.readIdleEvidence = readIdleEvidence;
 const cli_patterns_1 = require("../../cli-patterns");
 const composer_text_1 = require("../../composer-text");
@@ -17,6 +18,7 @@ const prompt_detect_multiple_choice_1 = require("../../prompt-detect-multiple-ch
 const verdicts_1 = require("../verdicts");
 const status_reason_1 = require("../../status-reason");
 const prompt_1 = require("./prompt");
+const picker_chrome_1 = require("./picker-chrome");
 const frame_1 = require("../frame");
 const live_region_1 = require("./live-region");
 const run_detection_1 = require("../run-detection");
@@ -59,6 +61,64 @@ function findClaudeTranscriptTail(contentLines) {
     }
     return index;
 }
+/** The confirmation page's question, as the whole row (Issue #3748). */
+const CLAUDE_SUBMIT_CONFIRM_QUESTION_ROW = /^\s*Ready to submit your answers\?\s*$/;
+/** Its option 1, as the whole row, cursor or not. */
+const CLAUDE_SUBMIT_ANSWERS_OPTION_ROW = /^\s*(?:❯\s*)?1\.\s+Submit answers\s*$/;
+/** Its option 2, as the whole row, cursor or not. */
+const CLAUDE_SUBMIT_CANCEL_OPTION_ROW = /^\s*(?:❯\s*)?2\.\s+Cancel\s*$/;
+/** The multi-question tab bar's `✔ Submit` tab — only that bar leads to this page. */
+const CLAUDE_SUBMIT_TAB_PATTERN = /✔\s*Submit/;
+/**
+ * How far above the question the tab bar may sit: the page lists every
+ * question and answer (`● …` / `→ …`) between them, wrapped at the pane width.
+ */
+const CLAUDE_SUBMIT_CONFIRM_TAB_LOOKBACK = 200;
+/** The nearest non-blank row above `row`, or -1. */
+function previousNonBlankRow(lines, row) {
+    for (let i = row - 1; i >= 0; i--) {
+        if (lines[i].trim() !== '')
+            return i;
+    }
+    return -1;
+}
+/**
+ * Is this frame Claude's `AskUserQuestion` confirmation page? (Issue #3748)
+ *
+ * Read strictly, row by row, from the end of the transcript up — all of:
+ *
+ *  1. the transcript's last row ({@link findClaudeTranscriptTail}, which steps
+ *     over Claude's chrome) is `2. Cancel`, the row above it `1. Submit
+ *     answers`, and the cursor `❯` is on one of the two;
+ *  2. the nearest non-blank row above the options IS `Ready to submit your
+ *     answers?` — the whole row, not a row that contains it;
+ *  3. the multi-question tab bar (`←  ☒ …  ✔ Submit  →`) sits above that.
+ *
+ * Deliberately NOT `detectClaudeDialog`'s `ask_user` kind: that classifies by a
+ * substring of the four rows above the options, so a Bash approval whose command
+ * is `grep -rn "review your answers" src`, an Edit approval whose diff holds
+ * the phrase, or a question that asks it read as this page — and Auto-Yes then
+ * left an ordinary `1. Yes` to a human. The dialog gate's reading is unchanged.
+ *
+ * `Submit answers` picks nothing — it commits whatever stands as the answers —
+ * so Auto-Yes leaves this page to a human, as it does Command Code's (#3497).
+ */
+function isClaudeAskUserQuestionConfirmPage(frame) {
+    const lines = frame.contentLines;
+    const cancelRow = findClaudeTranscriptTail(lines);
+    if (cancelRow < 0 || !CLAUDE_SUBMIT_CANCEL_OPTION_ROW.test(lines[cancelRow]))
+        return false;
+    const submitRow = cancelRow - 1;
+    if (submitRow < 0 || !CLAUDE_SUBMIT_ANSWERS_OPTION_ROW.test(lines[submitRow]))
+        return false;
+    if (!lines[submitRow].includes('❯') && !lines[cancelRow].includes('❯'))
+        return false;
+    const questionRow = previousNonBlankRow(lines, submitRow);
+    if (questionRow < 0 || !CLAUDE_SUBMIT_CONFIRM_QUESTION_ROW.test(lines[questionRow]))
+        return false;
+    const tabRow = (0, picker_chrome_1.findAskUserQuestionTabRow)(lines, questionRow, CLAUDE_SUBMIT_CONFIRM_TAB_LOOKBACK);
+    return tabRow >= 0 && CLAUDE_SUBMIT_TAB_PATTERN.test(lines[tabRow]);
+}
 /**
  * §4 D1 決定 1: does this frame positively show that Claude's turn is over?
  *

package/dist/server/src/lib/detection/tools/command-code/selection-shape.js

@@ -17,6 +17,7 @@ exports.hasCommandCodePlanReviewFooterAtBottom = hasCommandCodePlanReviewFooterA
 exports.hasDismissablePanelFooter = hasDismissablePanelFooter;
 exports.isCommandCodeQuestionTabRow = isCommandCodeQuestionTabRow;
 exports.readCommandCodeReviewPage = readCommandCodeReviewPage;
+exports.isCommandCodeQuestionConfirmPage = isCommandCodeQuestionConfirmPage;
 const ansi_1 = require("../../ansi");
 const selection_shape_patterns_1 = require("../../selection-shape-patterns");
 /**
@@ -404,22 +405,13 @@ const COMMAND_CODE_REVIEW_BACK_HINT_PATTERN = /^[^\S\n]*\u2190[^\S\n]+to[^\S\n]+
  */
 const COMMAND_CODE_REVIEW_UNANSWERED_PATTERN = /have\s+not\s+answered\s+all\s+questions/i;
 /**
- * Read Command Code's `AskUserQuestion` Review page, if this frame is one
- * (Issue #2755 §7).
- *
- * The same region {@link readCommandCodeQuestionRegion} works on — last rule
- * row, tab strip as the first row under it — plus the three rows above. The
- * question-shaped conditions are deliberately NOT applied: this page has no
- * question body of its own on the `Submit`/`Cancel` spelling (the answers sit
- * where the question would), and it draws `1.` twice, so the strict reading
- * declines it for a numbering reason that says nothing about what it is.
- *
- * `null` for everything else, so no existing verdict moves except the two
- * captures this is about.
+ * The rows under the frame's LAST rule row, when the first of them that carries
+ * content is a question-screen tab strip (Issue #2755 §7, split out by Issue
+ * #3497 so the Review page reading and the confirm-page guard share one anchor).
  *
  * @param frame - a raw `capture-pane -p -e` frame, ANSI intact (CRLF tolerated)
  */
-function readCommandCodeReviewPage(frame) {
+function readQuestionTabRegion(frame) {
     if (!frame)
         return null;
     const lines = frame.replace(/\r\n/g, '\n').split('\n').map(ansi_1.stripAnsi);
@@ -446,6 +438,28 @@ function readCommandCodeReviewPage(frame) {
         return null;
     if (!isCommandCodeQuestionTabRow(region[tabOffset]))
         return null;
+    return region;
+}
+/**
+ * Read Command Code's `AskUserQuestion` Review page, if this frame is one
+ * (Issue #2755 §7).
+ *
+ * The same region {@link readCommandCodeQuestionRegion} works on — last rule
+ * row, tab strip as the first row under it — plus the three rows above. The
+ * question-shaped conditions are deliberately NOT applied: this page has no
+ * question body of its own on the `Submit`/`Cancel` spelling (the answers sit
+ * where the question would), and it draws `1.` twice, so the strict reading
+ * declines it for a numbering reason that says nothing about what it is.
+ *
+ * `null` for everything else, so no existing verdict moves except the two
+ * captures this is about.
+ *
+ * @param frame - a raw `capture-pane -p -e` frame, ANSI intact (CRLF tolerated)
+ */
+function readCommandCodeReviewPage(frame) {
+    const region = readQuestionTabRegion(frame);
+    if (region === null)
+        return null;
     const body = region.join('\n');
     if (!COMMAND_CODE_REVIEW_SUBMIT_ROW_PATTERN.test(body))
         return null;
@@ -459,3 +473,39 @@ function readCommandCodeReviewPage(frame) {
         cursorOnSubmit: submitRow !== undefined && submitRow.includes(exports.COMMAND_CODE_CURSOR_GLYPH),
     };
 }
+/**
+ * Is this frame an `AskUserQuestion` CONFIRM page — `❯ 1. Submit` / `2. Cancel`
+ * under the question screen's tab strip — whatever else it draws? (Issue #3497)
+ *
+ * {@link readCommandCodeReviewPage} needs all three of its rows, the back hint
+ * included, and on a frame without `← to go back and edit` it answers `null`.
+ * The question region declines that page too (it draws `1.` twice), so the
+ * GENERIC parser reads it; and a free-text question drawn with the pair as its
+ * only options is read by the question reader itself. Either way the payload is
+ * a two-option `multiple_choice` whose default is `Submit`, which Auto-Yes
+ * answered `1` — committing the worker's own proposal as the human's answer
+ * (Kewton/Musunest#283).
+ *
+ * This is the wider reading Auto-Yes declines on, and deliberately NOT a change
+ * to the Review page reading: the status path and the answer panels keep what
+ * they publish for these frames, so a human is still shown the question. True
+ * when the tab strip sits directly under the last rule row and the region
+ * carries the confirm pair — `1. Submit` and `2. Cancel`, the `❯` on either —
+ * with or without the back hint, and whichever tab is current (the incident's
+ * page was a free-text question drawn with the same pair).
+ *
+ * The question screens themselves (#2521 / #2522 / #2753 / #2754) never carry
+ * the pair: their `Submit` / `Next` confirm row has no number, and the Review
+ * TAB showing a diff (`◯ Dispatch | ● Review` over `1 +` gutter rows) has no
+ * `Submit` row at all.
+ *
+ * @param frame - a raw capture with its box drawing intact (ANSI optional)
+ */
+function isCommandCodeQuestionConfirmPage(frame) {
+    const region = readQuestionTabRegion(frame);
+    if (region === null)
+        return false;
+    const body = region.join('\n');
+    return (COMMAND_CODE_REVIEW_SUBMIT_ROW_PATTERN.test(body) &&
+        COMMAND_CODE_REVIEW_CANCEL_ROW_PATTERN.test(body));
+}

package/dist/server/src/lib/detection/tools/copilot/patterns.js

@@ -4,7 +4,7 @@
  * (Issue #3217). `cli-patterns.ts` re-exports every public name.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.COPILOT_SKIP_PATTERNS = exports.COPILOT_FOLDER_TRUST_ANSWER_KEY = exports.COPILOT_FOLDER_TRUST_SESSION_OPTION_PATTERN = exports.COPILOT_FOLDER_TRUST_ANCHORS = exports.COPILOT_SELECTION_FOOTER_PATTERN = exports.COPILOT_BOOT_BANNER_ANCHORS = exports.COPILOT_TRANSCRIPT_CONTINUATION_PATTERN = exports.COPILOT_TOOL_ROW_PATTERN = exports.COPILOT_TOOL_VERBS = exports.COPILOT_TRANSCRIPT_DIVIDER_PATTERN = exports.COPILOT_USER_ECHO_PATTERN = exports.COPILOT_REASONING_HEADER_PATTERN = exports.COPILOT_BOX_ROW_PATTERN = exports.COPILOT_SEPARATOR_PATTERN = exports.COPILOT_IDLE_STATUS_PATTERN = exports.COPILOT_WORKING_STATUS_PATTERN = exports.COPILOT_THINKING_PATTERN = exports.COPILOT_PROMPT_PATTERN = void 0;
+exports.COPILOT_SKIP_PATTERNS = exports.COPILOT_FOLDER_TRUST_ANSWER_KEY = exports.COPILOT_FOLDER_TRUST_OPTION_LABEL_PATTERN = exports.COPILOT_FOLDER_TRUST_SESSION_OPTION_PATTERN = exports.COPILOT_FOLDER_TRUST_ANCHORS = exports.COPILOT_SELECTION_FOOTER_PATTERN = exports.COPILOT_BOOT_BANNER_ANCHORS = exports.COPILOT_TRANSCRIPT_CONTINUATION_PATTERN = exports.COPILOT_TOOL_ROW_PATTERN = exports.COPILOT_TOOL_VERBS = exports.COPILOT_TRANSCRIPT_DIVIDER_PATTERN = exports.COPILOT_USER_ECHO_PATTERN = exports.COPILOT_REASONING_HEADER_PATTERN = exports.COPILOT_BOX_ROW_PATTERN = exports.COPILOT_SEPARATOR_PATTERN = exports.COPILOT_IDLE_STATUS_PATTERN = exports.COPILOT_WORKING_STATUS_PATTERN = exports.COPILOT_THINKING_PATTERN = exports.COPILOT_PROMPT_PATTERN = void 0;
 exports.readCopilotStatusBar = readCopilotStatusBar;
 exports.findCopilotChromeStart = findCopilotChromeStart;
 exports.isCopilotSelectionFrame = isCopilotSelectionFrame;
@@ -559,6 +559,12 @@ exports.COPILOT_FOLDER_TRUST_ANCHORS = [
  * line and accept `1. Yes, and remember ...`.
  */
 exports.COPILOT_FOLDER_TRUST_SESSION_OPTION_PATTERN = /^[ \t]*(?:[>❯][ \t]*)?1\.[ \t]+Yes[ \t]*$/m;
+/**
+ * The folder-trust dialog's option labels as the prompt parser reads them
+ * (`1. Yes` -> `Yes`), for the Auto-Yes poller to tell the dialog itself from
+ * another prompt under a reply that quotes its question (Issue #3790).
+ */
+exports.COPILOT_FOLDER_TRUST_OPTION_LABEL_PATTERN = /^(?:Yes|Yes, and remember this folder for future sessions|No \(Esc\))$/;
 /**
  * Key that selects {@link COPILOT_FOLDER_TRUST_SESSION_OPTION_PATTERN}.
  * Measured on 1.0.80: the digit confirms on its own — sending a trailing Enter

package/dist/server/src/lib/hooks/permission-adjudication.js

@@ -29,6 +29,17 @@
  * capability block is the whole vocabulary (`docs/design/
  * multi-agent-state-architecture.md` §4 D3).
  *
+ * ## The ledger (Issue #3820)
+ *
+ * Each adjudication is written to the Auto-Yes confirmation ledger as the
+ * approval's confirmation, keyed by the decision id (design
+ * `docs/design/auto-yes-measurement-3820.md` §2.4): an `allow` is a send whose
+ * result is `delivered`, `settled` closes it, a policy's abstention withholds
+ * it. **No hook request is made here** — that id is the hook route's alone
+ * (§2.3, N2), so `resolvePermissionRequest` is called without one. The send is
+ * taken before the delivery is awaited and its result returned to it after
+ * (§2.5). The ledger never throws, and nothing here reads it back.
+ *
  * ## Why `permission-decision-service` is imported dynamically
  *
  * The same reason `sources/opencode/ingest` does it: that module reaches the
@@ -72,6 +83,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.adjudicatePendingPermission = adjudicatePendingPermission;
 const logger_1 = require("../../lib/logger");
+const auto_yes_confirmation_ledger_1 = require("../../lib/polling/auto-yes-confirmation-ledger");
 const abstain_1 = require("./sources/abstain");
 const pending_decisions_1 = require("./sources/pending-decisions");
 const permission_decision_state_1 = require("./permission-decision-state");
@@ -121,6 +133,19 @@ async function adjudicatePendingPermission(source, target, decision, payload, tr
             });
         }
     }
+    // Issue #3820: the ledger's send is taken before the delivery's await, as the
+    // screen path takes its handle, so a result that comes back after the
+    // confirmation closed (a kill meanwhile) is that confirmation's late result
+    // rather than the answer of one opened again by the decision id.
+    const ledgerAttempt = (0, auto_yes_confirmation_ledger_1.beginLedgerApiAdjudication)(session, decision.id, {
+        outcome: verdictSource.behavior === 'allow' ? 'allow' : 'abstained',
+        ...(verdictSource.reason === 'policy-suppressed' && verdictSource.suppressedBy
+            ? { withholdReason: verdictSource.suppressedBy }
+            : {}),
+        // `PERMISSION_REQUEST_PROMPT_TYPE`, spelled out: the service is imported
+        // dynamically (above) and its suites mock it down to one export.
+        promptType: 'multiple_choice',
+    });
     // C2: the caller does not know whether this writes a response body or opens a
     // second connection, and must not. What it does now get back is whether the
     // verdict landed (#1898).
@@ -137,6 +162,7 @@ async function adjudicatePendingPermission(source, target, decision, payload, tr
         trigger,
         at: decision.askedAt,
     });
+    (0, auto_yes_confirmation_ledger_1.settleLedgerApiAdjudication)(ledgerAttempt, { delivered, settled });
     logger.info('permission-decision-adjudicated', {
         worktreeId: target.worktreeId,
         cliToolId: target.cliToolId,

package/dist/server/src/lib/hooks/permission-decision-service.js

@@ -78,6 +78,7 @@ const chat_db_1 = require("../../lib/db/chat-db");
 const auto_yes_policy_1 = require("../../lib/polling/auto-yes-policy");
 const auto_yes_resolver_1 = require("../../lib/polling/auto-yes-resolver");
 const auto_yes_suppression_state_1 = require("../../lib/polling/auto-yes-suppression-state");
+const auto_yes_confirmation_ledger_1 = require("../../lib/polling/auto-yes-confirmation-ledger");
 const agent_event_state_1 = require("../../lib/session/agent-event-state");
 const logger_1 = require("../../lib/logger");
 const ask_user_question_payload_1 = require("./ask-user-question-payload");
@@ -114,6 +115,7 @@ function readContractPolicy(session) {
  * | payload unreadable | no-decision |
  * | `AskUserQuestion` | no-decision |
  * | Auto-Yes off / expired | no-decision |
+ * | contract lookup failed (Issue #3822) | no-decision + suppression |
  * | policy suppresses (mode off, deny pattern, type) | no-decision + suppression |
  * | otherwise | allow |
  *
@@ -144,21 +146,28 @@ function decidePermissionRequest(session, payload, deps = {}) {
     // Issue #1902: the third argument is what stops a normalised payload from
     // being judged on its whole body. See `collectToolInputMatchTexts`.
     (0, permission_request_payload_1.collectToolInputMatchTexts)(payload.toolName, payload.toolInput, payload.toolInputNormalization), policy);
+    // Issue #3822: an unknown policy (the lookup failed) is a denial here, so the
+    // hook abstains — the dialog is drawn — rather than allowing unattended.
     if (denial) {
         return {
             behavior: null,
             reason: 'policy-suppressed',
             suppressedBy: denial.reason,
             pattern: denial.pattern,
-            mode: policy?.mode ?? null,
+            mode: (0, auto_yes_resolver_1.policyLookupMode)(policy),
         };
     }
-    return { behavior: 'allow', reason: 'auto-yes', mode: policy?.mode ?? null };
+    return { behavior: 'allow', reason: 'auto-yes', mode: (0, auto_yes_resolver_1.policyLookupMode)(policy) };
 }
 /**
  * Persist an `allow` to the prompt history `capture --prompts` reads
  * (Issue #1685's layer).
  *
+ * Issue #3820: only on a source that declares
+ * {@link AgentSourceCapabilities.permissionAllowSuppressesDialog} — see
+ * {@link resolvePermissionRequest}. On agy the premise below does not hold
+ * (its dialog is drawn after an allow, and the screen's answer is the record).
+ *
  * Only `allow` is written here, and that asymmetry is deliberate. An allowed
  * request never draws a dialog, so this row is the *only* record that anything
  * happened — without it, Auto-Yes v2 approves commands invisibly. Every other
@@ -365,8 +374,9 @@ function reportPendingDialog(session, payload) {
  *   {@link PermissionDecisionDeps}. Omit in the server.
  * @returns The verdict the route serialises
  */
-function resolvePermissionRequest(session, payload, deps = {}) {
+function resolvePermissionRequest(session, payload, deps = {}, options = {}) {
     const decision = decidePermissionRequest(session, payload, deps);
+    const { capabilities } = (0, registry_1.getAgentEventSource)(session.cliToolId);
     // Issue #1902: before anything else, and regardless of the verdict. The
     // adjudicated `tool_input` is not the one copilot sent, and the design
     // policy's discoverability rule (§7) says a rewrite nobody can observe is a
@@ -421,8 +431,36 @@ function resolvePermissionRequest(session, payload, deps = {}) {
             pattern: decision.pattern,
         });
     }
-    if (decision.behavior === 'allow' && payload) {
+    // Issue #3820 (design §5.1): an allow is an answer only where it draws no
+    // dialog. On agy the dialog is drawn anyway and the poller's answer writes
+    // the row, so a row here was the same approval twice — and, when agy ran the
+    // call by its own allow-list, an approval CommandMate never gave.
+    if (decision.behavior === 'allow' && payload && capabilities.permissionAllowSuppressesDialog) {
         (deps.recordAllow ?? recordAllowedPermission)(session, payload);
     }
+    recordHookRequestInLedger(session, payload, decision, capabilities.permissionAllowSuppressesDialog, options);
     return decision;
 }
+/**
+ * The ledger's half of a hook request (Issue #3820, design §2.3, §3.4): what was
+ * decided — an allow that draws no dialog is the confirmation, anything else
+ * leaves the waiting to the screen's confirmation — and the CLI's own mode when
+ * the payload states it. Nothing without a `hookRequestId`, which only the hook
+ * route issues. The ledger never throws, and nothing here decides anything.
+ */
+function recordHookRequestInLedger(session, payload, decision, allowSuppressesDialog, options) {
+    if (!options.hookRequestId)
+        return;
+    (0, auto_yes_confirmation_ledger_1.decideLedgerHookRequest)(options.hookRequestId, {
+        outcome: decision.behavior === 'allow' ? 'allow' : 'abstained',
+        ...(decision.behavior === 'allow' ? {} : { abstainReason: decision.reason }),
+        allowSuppressesDialog,
+        promptType: exports.PERMISSION_REQUEST_PROMPT_TYPE,
+        // PR 3 (design §2.4): agy's call, tying the request to the screen's
+        // confirmation and to the call's `PostToolUse`.
+        ...(payload?.callId ? { callId: payload.callId } : {}),
+    });
+    if (payload?.permissionMode) {
+        (0, auto_yes_confirmation_ledger_1.observeLedgerCliMode)(session, payload.permissionMode);
+    }
+}

package/dist/server/src/lib/hooks/permission-request-payload.js

@@ -23,6 +23,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MAX_TOOL_NAME_LENGTH = exports.ASK_USER_QUESTION_TOOL = exports.PERMISSION_REQUEST_EVENT_NAME = void 0;
+exports.buildHookCallId = buildHookCallId;
 exports.parsePermissionRequestPayload = parsePermissionRequestPayload;
 exports.collectToolInputMatchTexts = collectToolInputMatchTexts;
 const tool_input_normalization_1 = require("./tool-input-normalization");
@@ -39,6 +40,25 @@ exports.PERMISSION_REQUEST_EVENT_NAME = 'PermissionRequest';
 exports.ASK_USER_QUESTION_TOOL = 'AskUserQuestion';
 /** Bound on `tool_name`; it is a Claude-side identifier, logged and stored. */
 exports.MAX_TOOL_NAME_LENGTH = 128;
+/** A conversation id a call id may carry: an opaque id, no path or prose. */
+const CALL_ID_CONVERSATION = /^[A-Za-z0-9._-]{1,128}$/;
+/**
+ * `<conversationId>:<stepIdx>` (Issue #3820, design §2.1): `stepIdx` is unique
+ * within a conversation and starts again when agy is relaunched, so it is
+ * paired with the conversation. Null unless `stepIdx` is a non-negative safe
+ * integer and the conversation id an opaque id — a body without them is read
+ * as before, with no call id.
+ *
+ * @param conversationId - agy's `conversationId` (the relay's `sessionId`)
+ * @param stepIdx - The body's `stepIdx`, whatever it was
+ */
+function buildHookCallId(conversationId, stepIdx) {
+    if (typeof conversationId !== 'string' || !CALL_ID_CONVERSATION.test(conversationId))
+        return null;
+    if (typeof stepIdx !== 'number' || !Number.isSafeInteger(stepIdx) || stepIdx < 0)
+        return null;
+    return `${conversationId}:${stepIdx}`;
+}
 function readString(source, key) {
     const value = source[key];
     return typeof value === 'string' && value !== '' ? value : null;

package/dist/server/src/lib/hooks/sources/antigravity/source.js

@@ -64,6 +64,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.antigravityAgentEventSource = void 0;
 exports.parseAntigravityPermissionRequest = parseAntigravityPermissionRequest;
+exports.readAntigravityPermissionCallId = readAntigravityPermissionCallId;
 exports.encodeAntigravityVerdict = encodeAntigravityVerdict;
 exports.extractAntigravityEventDetail = extractAntigravityEventDetail;
 const uat_isolation_1 = require("../../../../config/uat-isolation");
@@ -125,6 +126,23 @@ function parseAntigravityPermissionRequest(body) {
         permissionSuggestions: null,
     };
 }
+/**
+ * The call agy's `PreToolUse` asks about, `<conversationId>:<stepIdx>`
+ * (Issue #3820, design `docs/design/auto-yes-measurement-3820.md` §2.4), or
+ * null when the body has no numeric `stepIdx` or no conversation id.
+ *
+ * Read beside {@link parseAntigravityPermissionRequest}, not inside it: the
+ * route puts it on the payload (`callId`) for the Auto-Yes ledger only. The
+ * parsed payload is what the adjudication judges, and it stays exactly what it
+ * was — `stepIdx` is still not a prompt id.
+ *
+ * @param body - Whatever was posted to `/api/hooks/permission-request`
+ */
+function readAntigravityPermissionCallId(body) {
+    if (!(0, event_mapper_1.isPlainObject)(body))
+        return null;
+    return (0, permission_request_payload_1.buildHookCallId)((0, event_mapper_1.readStringField)(body, 'conversationId'), body.stepIdx);
+}
 /**
  * Encode a verdict in agy's wire form (S6, #1757 R15).
  *
@@ -217,6 +235,9 @@ exports.antigravityAgentEventSource = (0, define_source_1.definePushHookSource)(
         // Not audited. Default = Claude's current behaviour.
         sessionStartMayArriveLate: false,
         permissionReplyReleasesPrompt: false,
+        // Issue #3820, measured (1.1.12 / 1.1.27 / 1.4.2): agy draws its dialog even
+        // after an `allow`, and the screen's answer is the record — no audit row.
+        permissionAllowSuppressesDialog: false,
         eventIdentity: null,
         resync: 'none',
         // Issue #2198. agy keeps a plain-JSONL transcript per conversation at

package/dist/server/src/lib/hooks/sources/claude/source.js

@@ -133,6 +133,9 @@ exports.claudeAgentEventSource = (0, define_source_1.definePushHookSource)({
         // A hook response body releases nothing observable. The dialog is released
         // by the screen, by `Stop`, or by expiry.
         permissionReplyReleasesPrompt: false,
+        // Issue #3820: an allowed `PermissionRequest` draws no dialog — the reply is
+        // the only record, so the audit row is written (#1724).
+        permissionAllowSuppressesDialog: true,
         // `tool_use_id` is present on tool events but absent on `PermissionRequest`
         // (D2), so there is no id that covers the frames dedup has to cover. The
         // time window stays.

package/dist/server/src/lib/hooks/sources/codex/source.js

@@ -108,6 +108,8 @@ exports.codexAgentEventSource = (0, define_source_1.definePushHookSource)({
         // current behaviour, which is what the state machine does today.
         sessionStartMayArriveLate: false,
         permissionReplyReleasesPrompt: false,
+        // Issue #3820: an allowed `PermissionRequest` draws no dialog.
+        permissionAllowSuppressesDialog: true,
         eventIdentity: null,
         resync: 'none',
         // Issue #2197. codex appends every record of a session to

package/dist/server/src/lib/hooks/sources/command-code/source.js

@@ -230,6 +230,8 @@ exports.commandCodeAgentEventSource = (0, define_source_1.definePushHookSource)(
         sessionStartMayArriveLate: false,
         // A hook response body releases nothing observable, as on every push source.
         permissionReplyReleasesPrompt: false,
+        // Issue #3820: the hook arrives after the dialog was answered (see above).
+        permissionAllowSuppressesDialog: false,
         // `tool_use_id` is present on both tool events (`call_00_…`) and absent from
         // `SessionStart` and `Stop`, so there is no id covering the frames dedup has
         // to cover. The time window stays. Extraction is declared below regardless,