commandmate 0.47.0 → 0.47.2

package/dist/server/src/lib/detection/prompt-detect-multiple-choice.js

@@ -707,6 +707,11 @@ function extractInstructionText(lines, questionEndIndex, effectiveEnd) {
  *
  * Horizontal rules count too: Codex draws one between turns.
  *
+ * [Issue #3817] Not inside the panel's own frame: the command a panel shows can
+ * carry the same glyphs (a here-document's `> quoted` rows), drawn deeper than
+ * the panel's header, question and option rows. See
+ * {@link findApprovalContextStart}.
+ *
  * Anchored at the start of the trimmed line — ReDoS safe (no repetition).
  */
 const TURN_BOUNDARY_PATTERN = /^[⏺⎿●○•✔✓✖✗✘›»❯└├>]/;
@@ -721,7 +726,32 @@ const TURN_BOUNDARY_PATTERN = /^[⏺⎿●○•✔✓✖✗✘›»❯└├>]/
  * command + description + blank.
  */
 exports.APPROVAL_TARGET_MAX_LOOKBACK = 12;
-/** True when this line belongs to a previous turn rather than the prompt panel. */
+/**
+ * A previous tool call's result row (Issue #3817): claude's `⎿`, codex's `└` /
+ * `├` output continuation. Never the user's echo or a quote (`>`).
+ */
+const RESULT_MARKER_PATTERN = /^[⎿└├]/;
+/** Width of a row's leading whitespace. */
+function indentOf(line) {
+    return line.length - line.trimStart().length;
+}
+/**
+ * The column the dialog's own frame is drawn at (Issue #3817): the least
+ * indented non-blank row from the question down to `panelEnd`. Those rows are
+ * the question, the option block and the footer — claude puts them at column 1
+ * and the command at column 3, codex its `› 1.` cursor at column 0.
+ */
+function panelFrameIndent(lines, questionLineIndex, panelEnd) {
+    let indent = Infinity;
+    for (let i = questionLineIndex; i < Math.min(panelEnd, lines.length); i++) {
+        const line = lines[i];
+        if (line === undefined || line.trim() === '')
+            continue;
+        indent = Math.min(indent, indentOf(line));
+    }
+    return indent === Infinity ? 0 : indent;
+}
+/** True when this line carries a transcript marker or is a rule. */
 function isTurnBoundaryLine(rawLine) {
     if (rawLine === undefined)
         return false;
@@ -738,21 +768,73 @@ function isTurnBoundaryLine(rawLine) {
  * Everything above the returned index is a previous turn and must never reach a
  * deny pattern — that poisoning is Issue #1699.
  *
+ * [Issue #3817] A marker row indented deeper than the dialog's frame
+ * ({@link panelFrameIndent}) is the body of the command the panel asks about
+ * when a frame row sits above it — the `> quoted` rows of a here-document
+ * under a claude panel's ` Bash command` header. Cutting there took the command
+ * rows above it out of the deny surface. The previous turn's markers are drawn
+ * at or left of the frame (`⏺`, the user's `> msg` / `❯ msg` echo, a rule), or
+ * deeper with no frame row above them (claude's `  ⎿` result right under its
+ * `⏺`), and both still end the scan.
+ *
+ * A frame row cannot be told from a body row drawn at the frame's column (a
+ * shell here-document's `EOF`), so a frame row is taken as an older panel's
+ * header only in one shape: a tool-use block — a marker row at the frame's
+ * column, then that row, then deeper rows that are all result markers
+ * ({@link RESULT_MARKER_PATTERN}). Anything else between two frame rows is read
+ * as body: when the screen cannot tell, the deny surface is taken wide.
+ *
  * Shared by both detector paths: multiple_choice passes its `questionEndIndex`,
  * yes_no the line its pattern matched on.
  *
  * @param lines - Full frame, already ANSI/box stripped
  * @param questionLineIndex - Line the prompt's own question sits on
+ * @param panelEnd - Exclusive end of the dialog's own rows (Issue #3817); their
+ *   least indented row is the frame. Defaults to the question row alone.
  * @returns Index of the first line of the current prompt's own block
  */
-function findApprovalContextStart(lines, questionLineIndex) {
+function findApprovalContextStart(lines, questionLineIndex, panelEnd = questionLineIndex + 1) {
     const floor = Math.max(0, questionLineIndex - exports.APPROVAL_TARGET_MAX_LOOKBACK);
+    const frameIndent = panelFrameIndent(lines, questionLineIndex, panelEnd);
+    // The lowest deeper marker row with no frame row found above it yet.
+    let unenclosed = -1;
+    // The deeper rows since the last frame row: are they all result markers?
+    let segmentRows = 0;
+    let segmentAllResults = true;
     for (let i = questionLineIndex - 1; i >= floor; i--) {
-        if (isTurnBoundaryLine(lines[i])) {
-            return i + 1;
+        const line = lines[i];
+        if (line === undefined || line.trim() === '')
+            continue;
+        const atFrame = indentOf(line) <= frameIndent;
+        const marker = isTurnBoundaryLine(line);
+        if (marker && atFrame)
+            return (unenclosed >= 0 ? unenclosed : i) + 1;
+        if (!atFrame) {
+            if (marker && unenclosed < 0)
+                unenclosed = i;
+            segmentRows++;
+            segmentAllResults &&= RESULT_MARKER_PATTERN.test(line.trim());
+            continue;
+        }
+        // A frame row: an older tool-use block's header only in that one shape.
+        if (unenclosed >= 0 && segmentRows > 0 && segmentAllResults && isMarkerRowAtFrameAbove(lines, i, floor, frameIndent)) {
+            return unenclosed + 1;
         }
+        unenclosed = -1;
+        segmentRows = 0;
+        segmentAllResults = true;
     }
-    return floor;
+    return unenclosed >= 0 ? unenclosed + 1 : floor;
+}
+/** True when the nearest non-blank row above `row` is a marker row at the frame's column. */
+function isMarkerRowAtFrameAbove(lines, row, floor, frameIndent) {
+    for (let i = row - 1; i >= floor; i--) {
+        const line = lines[i];
+        if (line === undefined || line.trim() === '')
+            continue;
+        return indentOf(line) <= frameIndent && isTurnBoundaryLine(line);
+    }
+    return false;
 }
 /**
  * Join a slice of the frame into an approval-target string.
@@ -800,7 +882,7 @@ function extractApprovalTarget(lines, questionEndIndex, effectiveEnd, floor = 0)
     if (questionEndIndex < 0) {
         return undefined;
     }
-    return joinApprovalTarget(lines, Math.max(floor, findApprovalContextStart(lines, questionEndIndex)), effectiveEnd);
+    return joinApprovalTarget(lines, Math.max(floor, findApprovalContextStart(lines, questionEndIndex, effectiveEnd)), effectiveEnd);
 }
 /**
  * Build the final PromptDetectionResult for a multiple choice prompt.

package/dist/server/src/lib/detection/prompt-detector.js

@@ -70,7 +70,7 @@ function locateMatchLines(tailText, tailStart, match) {
  */
 function yesNoApprovalTarget(lines, tailText, tailStart, match) {
     const { startLine, endLine } = locateMatchLines(tailText, tailStart, match);
-    return (0, prompt_detect_multiple_choice_1.joinApprovalTarget)(lines, (0, prompt_detect_multiple_choice_1.findApprovalContextStart)(lines, startLine), endLine + 1);
+    return (0, prompt_detect_multiple_choice_1.joinApprovalTarget)(lines, (0, prompt_detect_multiple_choice_1.findApprovalContextStart)(lines, startLine, endLine + 1), endLine + 1);
 }
 /**
  * Creates a yes/no prompt detection result.

package/dist/server/src/lib/detection/tools/antigravity/dialog.js

@@ -229,7 +229,7 @@ function detectAntigravityNumberedDialogPrompt(text) {
         // turn's boundary and below at the footer, so the command in the
         // `Requesting permission for:` block and in the labels is judged and
         // nothing from an earlier, already-answered approval is.
-        approvalTarget: (0, prompt_detect_multiple_choice_1.joinApprovalTarget)(lines, (0, prompt_detect_multiple_choice_1.findApprovalContextStart)(lines, dialog.questionRow), dialog.footerRow),
+        approvalTarget: (0, prompt_detect_multiple_choice_1.joinApprovalTarget)(lines, (0, prompt_detect_multiple_choice_1.findApprovalContextStart)(lines, dialog.questionRow, dialog.footerRow), dialog.footerRow),
     }, normalized, truncate_raw_content_1.truncateRawContent);
 }
 /**

package/dist/server/src/lib/hooks/permission-adjudication.js

@@ -29,6 +29,17 @@
  * capability block is the whole vocabulary (`docs/design/
  * multi-agent-state-architecture.md` §4 D3).
  *
+ * ## The ledger (Issue #3820)
+ *
+ * Each adjudication is written to the Auto-Yes confirmation ledger as the
+ * approval's confirmation, keyed by the decision id (design
+ * `docs/design/auto-yes-measurement-3820.md` §2.4): an `allow` is a send whose
+ * result is `delivered`, `settled` closes it, a policy's abstention withholds
+ * it. **No hook request is made here** — that id is the hook route's alone
+ * (§2.3, N2), so `resolvePermissionRequest` is called without one. The send is
+ * taken before the delivery is awaited and its result returned to it after
+ * (§2.5). The ledger never throws, and nothing here reads it back.
+ *
  * ## Why `permission-decision-service` is imported dynamically
  *
  * The same reason `sources/opencode/ingest` does it: that module reaches the
@@ -72,6 +83,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.adjudicatePendingPermission = adjudicatePendingPermission;
 const logger_1 = require("../../lib/logger");
+const auto_yes_confirmation_ledger_1 = require("../../lib/polling/auto-yes-confirmation-ledger");
 const abstain_1 = require("./sources/abstain");
 const pending_decisions_1 = require("./sources/pending-decisions");
 const permission_decision_state_1 = require("./permission-decision-state");
@@ -121,6 +133,19 @@ async function adjudicatePendingPermission(source, target, decision, payload, tr
             });
         }
     }
+    // Issue #3820: the ledger's send is taken before the delivery's await, as the
+    // screen path takes its handle, so a result that comes back after the
+    // confirmation closed (a kill meanwhile) is that confirmation's late result
+    // rather than the answer of one opened again by the decision id.
+    const ledgerAttempt = (0, auto_yes_confirmation_ledger_1.beginLedgerApiAdjudication)(session, decision.id, {
+        outcome: verdictSource.behavior === 'allow' ? 'allow' : 'abstained',
+        ...(verdictSource.reason === 'policy-suppressed' && verdictSource.suppressedBy
+            ? { withholdReason: verdictSource.suppressedBy }
+            : {}),
+        // `PERMISSION_REQUEST_PROMPT_TYPE`, spelled out: the service is imported
+        // dynamically (above) and its suites mock it down to one export.
+        promptType: 'multiple_choice',
+    });
     // C2: the caller does not know whether this writes a response body or opens a
     // second connection, and must not. What it does now get back is whether the
     // verdict landed (#1898).
@@ -137,6 +162,7 @@ async function adjudicatePendingPermission(source, target, decision, payload, tr
         trigger,
         at: decision.askedAt,
     });
+    (0, auto_yes_confirmation_ledger_1.settleLedgerApiAdjudication)(ledgerAttempt, { delivered, settled });
     logger.info('permission-decision-adjudicated', {
         worktreeId: target.worktreeId,
         cliToolId: target.cliToolId,

package/dist/server/src/lib/hooks/permission-decision-service.js

@@ -78,6 +78,7 @@ const chat_db_1 = require("../../lib/db/chat-db");
 const auto_yes_policy_1 = require("../../lib/polling/auto-yes-policy");
 const auto_yes_resolver_1 = require("../../lib/polling/auto-yes-resolver");
 const auto_yes_suppression_state_1 = require("../../lib/polling/auto-yes-suppression-state");
+const auto_yes_confirmation_ledger_1 = require("../../lib/polling/auto-yes-confirmation-ledger");
 const agent_event_state_1 = require("../../lib/session/agent-event-state");
 const logger_1 = require("../../lib/logger");
 const ask_user_question_payload_1 = require("./ask-user-question-payload");
@@ -114,6 +115,7 @@ function readContractPolicy(session) {
  * | payload unreadable | no-decision |
  * | `AskUserQuestion` | no-decision |
  * | Auto-Yes off / expired | no-decision |
+ * | contract lookup failed (Issue #3822) | no-decision + suppression |
  * | policy suppresses (mode off, deny pattern, type) | no-decision + suppression |
  * | otherwise | allow |
  *
@@ -144,21 +146,28 @@ function decidePermissionRequest(session, payload, deps = {}) {
     // Issue #1902: the third argument is what stops a normalised payload from
     // being judged on its whole body. See `collectToolInputMatchTexts`.
     (0, permission_request_payload_1.collectToolInputMatchTexts)(payload.toolName, payload.toolInput, payload.toolInputNormalization), policy);
+    // Issue #3822: an unknown policy (the lookup failed) is a denial here, so the
+    // hook abstains — the dialog is drawn — rather than allowing unattended.
     if (denial) {
         return {
             behavior: null,
             reason: 'policy-suppressed',
             suppressedBy: denial.reason,
             pattern: denial.pattern,
-            mode: policy?.mode ?? null,
+            mode: (0, auto_yes_resolver_1.policyLookupMode)(policy),
         };
     }
-    return { behavior: 'allow', reason: 'auto-yes', mode: policy?.mode ?? null };
+    return { behavior: 'allow', reason: 'auto-yes', mode: (0, auto_yes_resolver_1.policyLookupMode)(policy) };
 }
 /**
  * Persist an `allow` to the prompt history `capture --prompts` reads
  * (Issue #1685's layer).
  *
+ * Issue #3820: only on a source that declares
+ * {@link AgentSourceCapabilities.permissionAllowSuppressesDialog} — see
+ * {@link resolvePermissionRequest}. On agy the premise below does not hold
+ * (its dialog is drawn after an allow, and the screen's answer is the record).
+ *
  * Only `allow` is written here, and that asymmetry is deliberate. An allowed
  * request never draws a dialog, so this row is the *only* record that anything
  * happened — without it, Auto-Yes v2 approves commands invisibly. Every other
@@ -365,8 +374,9 @@ function reportPendingDialog(session, payload) {
  *   {@link PermissionDecisionDeps}. Omit in the server.
  * @returns The verdict the route serialises
  */
-function resolvePermissionRequest(session, payload, deps = {}) {
+function resolvePermissionRequest(session, payload, deps = {}, options = {}) {
     const decision = decidePermissionRequest(session, payload, deps);
+    const { capabilities } = (0, registry_1.getAgentEventSource)(session.cliToolId);
     // Issue #1902: before anything else, and regardless of the verdict. The
     // adjudicated `tool_input` is not the one copilot sent, and the design
     // policy's discoverability rule (§7) says a rewrite nobody can observe is a
@@ -421,8 +431,36 @@ function resolvePermissionRequest(session, payload, deps = {}) {
             pattern: decision.pattern,
         });
     }
-    if (decision.behavior === 'allow' && payload) {
+    // Issue #3820 (design §5.1): an allow is an answer only where it draws no
+    // dialog. On agy the dialog is drawn anyway and the poller's answer writes
+    // the row, so a row here was the same approval twice — and, when agy ran the
+    // call by its own allow-list, an approval CommandMate never gave.
+    if (decision.behavior === 'allow' && payload && capabilities.permissionAllowSuppressesDialog) {
         (deps.recordAllow ?? recordAllowedPermission)(session, payload);
     }
+    recordHookRequestInLedger(session, payload, decision, capabilities.permissionAllowSuppressesDialog, options);
     return decision;
 }
+/**
+ * The ledger's half of a hook request (Issue #3820, design §2.3, §3.4): what was
+ * decided — an allow that draws no dialog is the confirmation, anything else
+ * leaves the waiting to the screen's confirmation — and the CLI's own mode when
+ * the payload states it. Nothing without a `hookRequestId`, which only the hook
+ * route issues. The ledger never throws, and nothing here decides anything.
+ */
+function recordHookRequestInLedger(session, payload, decision, allowSuppressesDialog, options) {
+    if (!options.hookRequestId)
+        return;
+    (0, auto_yes_confirmation_ledger_1.decideLedgerHookRequest)(options.hookRequestId, {
+        outcome: decision.behavior === 'allow' ? 'allow' : 'abstained',
+        ...(decision.behavior === 'allow' ? {} : { abstainReason: decision.reason }),
+        allowSuppressesDialog,
+        promptType: exports.PERMISSION_REQUEST_PROMPT_TYPE,
+        // PR 3 (design §2.4): agy's call, tying the request to the screen's
+        // confirmation and to the call's `PostToolUse`.
+        ...(payload?.callId ? { callId: payload.callId } : {}),
+    });
+    if (payload?.permissionMode) {
+        (0, auto_yes_confirmation_ledger_1.observeLedgerCliMode)(session, payload.permissionMode);
+    }
+}

package/dist/server/src/lib/hooks/permission-request-payload.js

@@ -23,6 +23,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MAX_TOOL_NAME_LENGTH = exports.ASK_USER_QUESTION_TOOL = exports.PERMISSION_REQUEST_EVENT_NAME = void 0;
+exports.buildHookCallId = buildHookCallId;
 exports.parsePermissionRequestPayload = parsePermissionRequestPayload;
 exports.collectToolInputMatchTexts = collectToolInputMatchTexts;
 const tool_input_normalization_1 = require("./tool-input-normalization");
@@ -39,6 +40,25 @@ exports.PERMISSION_REQUEST_EVENT_NAME = 'PermissionRequest';
 exports.ASK_USER_QUESTION_TOOL = 'AskUserQuestion';
 /** Bound on `tool_name`; it is a Claude-side identifier, logged and stored. */
 exports.MAX_TOOL_NAME_LENGTH = 128;
+/** A conversation id a call id may carry: an opaque id, no path or prose. */
+const CALL_ID_CONVERSATION = /^[A-Za-z0-9._-]{1,128}$/;
+/**
+ * `<conversationId>:<stepIdx>` (Issue #3820, design §2.1): `stepIdx` is unique
+ * within a conversation and starts again when agy is relaunched, so it is
+ * paired with the conversation. Null unless `stepIdx` is a non-negative safe
+ * integer and the conversation id an opaque id — a body without them is read
+ * as before, with no call id.
+ *
+ * @param conversationId - agy's `conversationId` (the relay's `sessionId`)
+ * @param stepIdx - The body's `stepIdx`, whatever it was
+ */
+function buildHookCallId(conversationId, stepIdx) {
+    if (typeof conversationId !== 'string' || !CALL_ID_CONVERSATION.test(conversationId))
+        return null;
+    if (typeof stepIdx !== 'number' || !Number.isSafeInteger(stepIdx) || stepIdx < 0)
+        return null;
+    return `${conversationId}:${stepIdx}`;
+}
 function readString(source, key) {
     const value = source[key];
     return typeof value === 'string' && value !== '' ? value : null;

package/dist/server/src/lib/hooks/sources/antigravity/source.js

@@ -64,6 +64,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.antigravityAgentEventSource = void 0;
 exports.parseAntigravityPermissionRequest = parseAntigravityPermissionRequest;
+exports.readAntigravityPermissionCallId = readAntigravityPermissionCallId;
 exports.encodeAntigravityVerdict = encodeAntigravityVerdict;
 exports.extractAntigravityEventDetail = extractAntigravityEventDetail;
 const uat_isolation_1 = require("../../../../config/uat-isolation");
@@ -125,6 +126,23 @@ function parseAntigravityPermissionRequest(body) {
         permissionSuggestions: null,
     };
 }
+/**
+ * The call agy's `PreToolUse` asks about, `<conversationId>:<stepIdx>`
+ * (Issue #3820, design `docs/design/auto-yes-measurement-3820.md` §2.4), or
+ * null when the body has no numeric `stepIdx` or no conversation id.
+ *
+ * Read beside {@link parseAntigravityPermissionRequest}, not inside it: the
+ * route puts it on the payload (`callId`) for the Auto-Yes ledger only. The
+ * parsed payload is what the adjudication judges, and it stays exactly what it
+ * was — `stepIdx` is still not a prompt id.
+ *
+ * @param body - Whatever was posted to `/api/hooks/permission-request`
+ */
+function readAntigravityPermissionCallId(body) {
+    if (!(0, event_mapper_1.isPlainObject)(body))
+        return null;
+    return (0, permission_request_payload_1.buildHookCallId)((0, event_mapper_1.readStringField)(body, 'conversationId'), body.stepIdx);
+}
 /**
  * Encode a verdict in agy's wire form (S6, #1757 R15).
  *
@@ -217,6 +235,9 @@ exports.antigravityAgentEventSource = (0, define_source_1.definePushHookSource)(
         // Not audited. Default = Claude's current behaviour.
         sessionStartMayArriveLate: false,
         permissionReplyReleasesPrompt: false,
+        // Issue #3820, measured (1.1.12 / 1.1.27 / 1.4.2): agy draws its dialog even
+        // after an `allow`, and the screen's answer is the record — no audit row.
+        permissionAllowSuppressesDialog: false,
         eventIdentity: null,
         resync: 'none',
         // Issue #2198. agy keeps a plain-JSONL transcript per conversation at

package/dist/server/src/lib/hooks/sources/claude/source.js

@@ -133,6 +133,9 @@ exports.claudeAgentEventSource = (0, define_source_1.definePushHookSource)({
         // A hook response body releases nothing observable. The dialog is released
         // by the screen, by `Stop`, or by expiry.
         permissionReplyReleasesPrompt: false,
+        // Issue #3820: an allowed `PermissionRequest` draws no dialog — the reply is
+        // the only record, so the audit row is written (#1724).
+        permissionAllowSuppressesDialog: true,
         // `tool_use_id` is present on tool events but absent on `PermissionRequest`
         // (D2), so there is no id that covers the frames dedup has to cover. The
         // time window stays.

package/dist/server/src/lib/hooks/sources/codex/source.js

@@ -108,6 +108,8 @@ exports.codexAgentEventSource = (0, define_source_1.definePushHookSource)({
         // current behaviour, which is what the state machine does today.
         sessionStartMayArriveLate: false,
         permissionReplyReleasesPrompt: false,
+        // Issue #3820: an allowed `PermissionRequest` draws no dialog.
+        permissionAllowSuppressesDialog: true,
         eventIdentity: null,
         resync: 'none',
         // Issue #2197. codex appends every record of a session to

package/dist/server/src/lib/hooks/sources/command-code/source.js

@@ -230,6 +230,8 @@ exports.commandCodeAgentEventSource = (0, define_source_1.definePushHookSource)(
         sessionStartMayArriveLate: false,
         // A hook response body releases nothing observable, as on every push source.
         permissionReplyReleasesPrompt: false,
+        // Issue #3820: the hook arrives after the dialog was answered (see above).
+        permissionAllowSuppressesDialog: false,
         // `tool_use_id` is present on both tool events (`call_00_…`) and absent from
         // `SessionStart` and `Stop`, so there is no id covering the frames dedup has
         // to cover. The time window stays. Extraction is declared below regardless,

package/dist/server/src/lib/hooks/sources/copilot/source.js

@@ -215,6 +215,8 @@ exports.copilotAgentEventSource = (0, define_source_1.definePushHookSource)({
         // module comment above.
         sessionStartMayArriveLate: true,
         permissionReplyReleasesPrompt: false,
+        // Issue #3820: an allowed `PreToolUse` runs the call without a dialog.
+        permissionAllowSuppressesDialog: true,
         // Not audited. No captured copilot payload carries a `tool_use_id`, so
         // `'tool-call-id'` would be a guess; whether one exists is still to be
         // measured. Default = Claude's fallback, the time window.

package/dist/server/src/lib/hooks/sources/gemini/source.js

@@ -130,6 +130,8 @@ exports.geminiAgentEventSource = (0, define_source_1.definePushHookSource)({
         // Not audited. Default = Claude's current behaviour.
         sessionStartMayArriveLate: false,
         permissionReplyReleasesPrompt: false,
+        // Issue #3820: not measured, and no permission hook is registered.
+        permissionAllowSuppressesDialog: false,
         eventIdentity: null,
         resync: 'none',
         // Issue #2197. Nobody but the screen scraper records gemini replies.

package/dist/server/src/lib/hooks/sources/legacy-relay.js

@@ -65,6 +65,8 @@ function createLegacyRelaySource(cliToolId) {
             permissionHookPredictsDialog: false,
             sessionStartMayArriveLate: false,
             permissionReplyReleasesPrompt: false,
+            // Issue #3820: an unmeasured tool's allow is not assumed to answer a dialog.
+            permissionAllowSuppressesDialog: false,
             eventIdentity: null,
             resync: 'none',
             // Issue #2197. A tool on the compatibility relay has no reader, which

package/dist/server/src/lib/hooks/sources/opencode/ingest.js

@@ -81,6 +81,7 @@ const logger_1 = require("../../../../lib/logger");
 const agent_event_types_1 = require("../../../../lib/hooks/agent-event-types");
 const permission_adjudication_1 = require("../../../../lib/hooks/permission-adjudication");
 const pending_decision_kind_1 = require("../../../../lib/hooks/pending-decision-kind");
+const auto_yes_confirmation_ledger_1 = require("../../../../lib/polling/auto-yes-confirmation-ledger");
 const agent_event_state_1 = require("../../../../lib/session/agent-event-state");
 const structured_prompt_1 = require("../../../../lib/session/structured-prompt");
 const event_mapper_1 = require("../event-mapper");
@@ -362,6 +363,11 @@ async function ingestOpencodeEvent(target, event) {
             record.decisionId = (0, mappers_1.repliedPermissionId)(event.raw);
             record.promptSettled = replyReleasesPrompt(target, instanceId);
             (0, agent_event_state_1.recordAgentEvent)(target.worktreeId, tool_id_1.OPENCODE_CLI_TOOL_ID, instanceId, record, options);
+            // Issue #3820: the approval's confirmation in the Auto-Yes ledger ends
+            // here when Auto-Yes did not settle it — who answered is not known.
+            if (record.decisionId) {
+                (0, auto_yes_confirmation_ledger_1.noteLedgerApiDecisionReplied)({ worktreeId: target.worktreeId, cliToolId: tool_id_1.OPENCODE_CLI_TOOL_ID, instanceId }, record.decisionId);
+            }
             logger.info('opencode-permission-reply-observed', {
                 worktreeId: target.worktreeId,
                 instanceId,

package/dist/server/src/lib/hooks/sources/opencode/source.js

@@ -316,6 +316,8 @@ exports.opencodeAgentEventSource = (0, define_source_1.definePullEventSource)({
         // `permission.replied` arrives on the same stream and is a positive
         // statement that the dialog is gone (#1898). The only source that can say so.
         permissionReplyReleasesPrompt: true,
+        // Issue #3820: an allow is the approval itself, over the agent's API.
+        permissionAllowSuppressesDialog: true,
         // `per_...` — the id in the reply URL, which is the same id the frame
         // carries (#1899). Real identity, so this source does not need the time
         // window that loses the `stop` of a short turn.

package/dist/server/src/lib/hooks/sources/opencode-v2/ingest.js

@@ -64,6 +64,7 @@ const logger_1 = require("../../../../lib/logger");
 const agent_event_types_1 = require("../../../../lib/hooks/agent-event-types");
 const permission_adjudication_1 = require("../../../../lib/hooks/permission-adjudication");
 const pending_decision_kind_1 = require("../../../../lib/hooks/pending-decision-kind");
+const auto_yes_confirmation_ledger_1 = require("../../../../lib/polling/auto-yes-confirmation-ledger");
 const agent_event_state_1 = require("../../../../lib/session/agent-event-state");
 const structured_prompt_1 = require("../../../../lib/session/structured-prompt");
 const event_mapper_1 = require("../event-mapper");
@@ -207,6 +208,11 @@ async function ingestOpencodeV2Event(target, event, stopEffect = applyStop, load
             record.decisionId = (0, mappers_1.frameDecisionId)(event.raw);
             record.promptSettled = true;
             (0, agent_event_state_1.recordAgentEvent)(target.worktreeId, tool_id_1.OPENCODE_V2_CLI_TOOL_ID, instanceId, record, options);
+            // Issue #3820: as v1's `permission.replied` — the ledger's confirmation
+            // of this approval ends, by whoever answered it.
+            if (record.decisionId) {
+                (0, auto_yes_confirmation_ledger_1.noteLedgerApiDecisionReplied)({ worktreeId: target.worktreeId, cliToolId: tool_id_1.OPENCODE_V2_CLI_TOOL_ID, instanceId }, record.decisionId);
+            }
         }
         else if (event.event === 'notification' && event.detail === mappers_1.OPENCODE_V2_QUESTION_DETAIL) {
             const spec = await readQuestion(target, event, loadForm);

package/dist/server/src/lib/hooks/sources/opencode-v2/source.js

@@ -254,6 +254,8 @@ exports.opencodeV2AgentEventSource = (0, define_source_1.definePullEventSource)(
         permissionHookPredictsDialog: false,
         sessionStartMayArriveLate: false,
         permissionReplyReleasesPrompt: true,
+        // Issue #3820: an allow is the approval itself, over the agent's API.
+        permissionAllowSuppressesDialog: true,
         // Issue #2945: `per_…` / `frm_…`, the id the reply URL takes and the one
         // `permission.replied` / `form.replied` settle. Moves together with
         // `extractEventIdentity` below.

package/dist/server/src/lib/hooks/sources/pending-decisions.js

@@ -124,12 +124,24 @@ function resetPendingDecisions() {
  * function exists, cannot find out without going out of its way — whether the
  * verdict left through the response body or through a second HTTP call.
  *
+ * @param options.onReceipt - Issue #3820: handed the receipt — what
+ *   {@link answerPendingDecisionWithReceipt} returns beside the body — before
+ *   the body is returned. For a caller that records the delivery (the hook
+ *   route's ledger) and writes the body whatever it says; the body is the same
+ *   with or without it.
  * @returns The body to write. `{}` means "nothing to say here", which for a
  *   hook is the measured no-decision reply and for a pull source is simply the
  *   ack of a request whose answer went elsewhere.
  */
-async function answerPendingDecision(source, ref, decision, verdict) {
-    return (await answerPendingDecisionWithReceipt(source, ref, decision, verdict)).body;
+async function answerPendingDecision(source, ref, decision, verdict, options = {}) {
+    const { body, delivery } = await answerPendingDecisionWithReceipt(source, ref, decision, verdict);
+    try {
+        options.onReceipt?.(delivery);
+    }
+    catch {
+        // The receipt is the caller's record, never a reason to lose the body.
+    }
+    return body;
 }
 /**
  * Answer one decision and keep the receipt (Issue #1898).

package/dist/server/src/lib/polling/antigravity-permission-receipts.js

@@ -24,7 +24,8 @@
  * ## What is kept
  *
  * ONE entry per instance: the tool name and the arrival time of the most recent
- * question. A second question replaces the first, because the only thing asked
+ * question, and the call it asked about (`callId`, Issue #3820) when the body
+ * named one. A second question replaces the first, because the only thing asked
  * of this record is "was there one lately".
  *
  * The screen carries no tool name (only the option labels), so the caller that
@@ -42,6 +43,7 @@ exports.ANTIGRAVITY_PERMISSION_RECEIPT_WINDOW_MS = void 0;
 exports.recordAntigravityPermissionReceipt = recordAntigravityPermissionReceipt;
 exports.hasRecentAntigravityPermissionReceipt = hasRecentAntigravityPermissionReceipt;
 exports.getAntigravityPermissionReceiptAt = getAntigravityPermissionReceiptAt;
+exports.getAntigravityPermissionReceiptCallId = getAntigravityPermissionReceiptCallId;
 exports.resetAntigravityPermissionReceiptsForTests = resetAntigravityPermissionReceiptsForTests;
 const auto_yes_state_1 = require("../../lib/auto-yes-state");
 const global_state_1 = require("../global-state");
@@ -87,12 +89,14 @@ const observations = (0, global_state_1.getOrInitGlobal)('__antigravityReceiptOb
  * @param instanceId - Agent instance id (the tool id itself for the primary)
  * @param toolName - Tool the request named, or null when the payload had none
  * @param at - Epoch ms the request arrived
+ * @param callId - Issue #3820: the call the request asked about
+ *   (`PermissionRequestPayload.callId`), null when it named none
  */
-function recordAntigravityPermissionReceipt(worktreeId, cliToolId, instanceId, toolName, at = Date.now()) {
+function recordAntigravityPermissionReceipt(worktreeId, cliToolId, instanceId, toolName, at = Date.now(), callId = null) {
     if (toolName === null)
         return;
     pruneExpiredReceipts(at);
-    receipts.set((0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId), { toolName, at });
+    receipts.set((0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId), { toolName, at, callId });
 }
 /**
  * Did agy ask CommandMate about a tool call, for this instance, within
@@ -121,6 +125,13 @@ function hasRecentAntigravityPermissionReceipt(worktreeId, cliToolId, instanceId
 function getAntigravityPermissionReceiptAt(worktreeId, cliToolId, instanceId) {
     return receipts.get((0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId))?.at ?? null;
 }
+/**
+ * The call the latest question asked about (Issue #3820), or null when it
+ * named none or none was received. For the ledger only.
+ */
+function getAntigravityPermissionReceiptCallId(worktreeId, cliToolId, instanceId) {
+    return receipts.get((0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId))?.callId ?? null;
+}
 /** Empty the record. Tests only: production entries age out on their own. */
 function resetAntigravityPermissionReceiptsForTests() {
     receipts.clear();