commandmate 0.47.0 → 0.47.2

package/dist/server/src/lib/polling/auto-yes-ledger-records.js

@@ -0,0 +1,143 @@
+"use strict";
+/**
+ * The Auto-Yes confirmation ledger's records (Issue #3848, split out of
+ * `auto-yes-confirmation-ledger.ts`): its constants, the shapes of its state,
+ * the writing of one line, and the small helpers over the state. The state
+ * itself — `ledgerState()`, the clock, the test seams — stays owned by
+ * `auto-yes-confirmation-ledger.ts`, which re-exports the public names here.
+ *
+ * Server only (logger). Must not import `auto-yes-confirmation-ledger.ts`.
+ *
+ * @module lib/polling/auto-yes-ledger-records
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SESSION_ENDING_STOP_REASONS = exports.ABANDONING_STOP_REASONS = exports.CLI_MODE_WORD = exports.MAX_REMEMBERED_CALLS = exports.MAX_REMEMBERED_INSTANCES = exports.MAX_OPEN_HOOK_REQUESTS = exports.MAX_PENDING_ATTEMPTS = exports.AUTO_YES_LEDGER_MAX_OPEN_TOTAL = exports.AUTO_YES_LEDGER_MAX_OPEN_PER_INSTANCE = exports.AUTO_YES_LEDGER_UNOBSERVABLE_TIMEOUT_MS = exports.AUTO_YES_LEDGER_CLOCK_MS = exports.AUTO_YES_LEDGER_HOOK_LINK_WINDOW_MS = exports.AUTO_YES_LEDGER_RECORDED_PATHS = void 0;
+exports.ledgerLogger = ledgerLogger;
+exports.currentLogLevel = currentLogLevel;
+exports.emit = emit;
+exports.callsOf = callsOf;
+exports.endedCallsOf = endedCallsOf;
+exports.callKey = callKey;
+exports.keyOf = keyOf;
+exports.currentEntry = currentEntry;
+exports.rememberBounded = rememberBounded;
+const logger_1 = require("../../lib/logger");
+const env_1 = require("../../lib/env");
+const auto_yes_state_1 = require("../auto-yes-state");
+const auto_yes_confirmation_ledger_types_1 = require("./auto-yes-confirmation-ledger-types");
+/**
+ * The paths this version records (design §6.4): PR 1 the poller's screen path,
+ * PR 2 the hook route, the API adjudication and `/prompt-response`, PR 3 the
+ * link of agy's request to its dialog (`agy-link`). With all five the daily
+ * count is no longer partial for want of a path.
+ */
+exports.AUTO_YES_LEDGER_RECORDED_PATHS = [
+    'screen',
+    'hook',
+    'api',
+    'prompt-response',
+    'agy-link',
+];
+/**
+ * A screen confirmation opened this soon after a hook request closed on the
+ * same instance carries `afterHookAllow` / `afterHookAbstain` (design §2.3).
+ * agy's receipt window is the same length.
+ */
+exports.AUTO_YES_LEDGER_HOOK_LINK_WINDOW_MS = 8_000;
+/** The grid of the `alive` and `checkpoint` lines: every UTC hour boundary. */
+exports.AUTO_YES_LEDGER_CLOCK_MS = 60 * 60 * 1000;
+/** An `unobservable` confirmation is let go after this long (design §4.2). */
+exports.AUTO_YES_LEDGER_UNOBSERVABLE_TIMEOUT_MS = 24 * 60 * 60 * 1000;
+/** Open confirmations one instance may hold; the oldest goes past it (design §8.2). */
+exports.AUTO_YES_LEDGER_MAX_OPEN_PER_INSTANCE = 16;
+/** Open confirmations the process may hold; the oldest goes past it (design §8.2). */
+exports.AUTO_YES_LEDGER_MAX_OPEN_TOTAL = 1024;
+/** Sends whose result has not come back that are remembered; the oldest is dropped past it. */
+exports.MAX_PENDING_ATTEMPTS = 1024;
+/** Hook requests whose reply has not been written that are remembered; the oldest is dropped past it. */
+exports.MAX_OPEN_HOOK_REQUESTS = 1024;
+/** Instances whose last hook request or CLI mode is remembered; the oldest is dropped past it. */
+exports.MAX_REMEMBERED_INSTANCES = 1024;
+/** agy calls whose `PostToolUse` has not come that are remembered; the oldest is dropped past it. */
+exports.MAX_REMEMBERED_CALLS = 1024;
+/** A CLI mode is a word of the CLI's own vocabulary; anything else is logged as `(other)`. */
+exports.CLI_MODE_WORD = /^[A-Za-z][A-Za-z-]{0,31}$/;
+/**
+ * Poller stop reasons that end the session the confirmation was on, or hand
+ * the key to something else (design §4.2). Every other reason — off, expired,
+ * the stop pattern, errors, a shutdown — only stops looking.
+ */
+exports.ABANDONING_STOP_REASONS = new Set([
+    'invalid-key',
+    'session-killed',
+    'instance-removed',
+    'worktree-deleted',
+    'orphan-swept',
+    'worktree-id-migrated',
+    'replaced',
+    'reset',
+]);
+/**
+ * The stop reasons among {@link ABANDONING_STOP_REASONS} that end the agent's
+ * session itself: the memory of a call its `PostToolUse` closed (PR 3) goes
+ * with them. Any other reason — Auto-Yes turned off by hand, expired, the stop
+ * pattern, a key handed over, one this list does not know — keeps it, so a
+ * stale frame of that call is not counted again when Auto-Yes comes back on;
+ * the session epoch still tells a relaunched session apart.
+ */
+exports.SESSION_ENDING_STOP_REASONS = new Set([
+    'session-killed',
+    'instance-removed',
+    'worktree-deleted',
+    'orphan-swept',
+]);
+let cachedLogger = null;
+function ledgerLogger() {
+    cachedLogger ??= (0, logger_1.createLogger)(auto_yes_confirmation_ledger_types_1.AUTO_YES_LEDGER_LOG_MODULE);
+    return cachedLogger;
+}
+function currentLogLevel() {
+    try {
+        return (0, env_1.getLogConfig)().level;
+    }
+    catch {
+        return 'unknown';
+    }
+}
+/** Write one line. A logger that throws is counted, never passed on. */
+function emit(state, event, fields) {
+    try {
+        ledgerLogger().info(event, { ledgerVersion: auto_yes_confirmation_ledger_types_1.AUTO_YES_LEDGER_VERSION, bootId: state.bootId, ...fields });
+    }
+    catch {
+        state.errors += 1;
+    }
+}
+function callsOf(state) {
+    state.calls ??= new Map();
+    return state.calls;
+}
+function endedCallsOf(state) {
+    state.endedCalls ??= new Map();
+    return state.endedCalls;
+}
+function callKey(compositeKey, callId) {
+    return `${compositeKey}\u0000${callId}`;
+}
+function keyOf(scope) {
+    return scope.compositeKey ?? (0, auto_yes_state_1.buildCompositeKey)(scope.worktreeId, scope.cliToolId, scope.instanceId);
+}
+function currentEntry(state, compositeKey) {
+    const id = state.current.get(compositeKey);
+    return id === undefined ? undefined : state.entries.get(id);
+}
+/** Set `key` in a map kept to `max` entries, dropping the oldest. */
+function rememberBounded(map, key, value, max) {
+    map.delete(key);
+    if (map.size >= max) {
+        const oldest = map.keys().next().value;
+        if (oldest !== undefined)
+            map.delete(oldest);
+    }
+    map.set(key, value);
+}

package/dist/server/src/lib/polling/auto-yes-policy.js

@@ -14,12 +14,17 @@
  * indefinitely. The TTL is what bounds staleness — a task that starts or ends is
  * picked up within it, without this module having to observe task transitions.
  *
+ * Issue #3822: a failed lookup is not cached. It is "contract unknown", which
+ * the answering paths read as withholding, and holding it for the TTL would
+ * keep withholding after the database recovered; the next poll reads again.
+ *
  * @module lib/polling/auto-yes-policy
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AUTO_YES_POLICY_CACHE_TTL_MS = void 0;
 exports.getSessionAutoYesPolicy = getSessionAutoYesPolicy;
 exports.getSessionAutoYesPolicyEntry = getSessionAutoYesPolicyEntry;
+exports.getSessionAutoYesPolicyLookupEntry = getSessionAutoYesPolicyLookupEntry;
 exports.isAutoYesBlockedByPolicy = isAutoYesBlockedByPolicy;
 exports.isSessionAutoYesBlockedByContract = isSessionAutoYesBlockedByContract;
 exports.getSessionContractPolicySummary = getSessionContractPolicySummary;
@@ -29,6 +34,7 @@ const db_1 = require("../../lib/db");
 const db_instance_1 = require("../../lib/db/db-instance");
 const auto_yes_state_1 = require("../../lib/auto-yes-state");
 const logger_1 = require("../../lib/logger");
+const auto_yes_resolver_1 = require("./auto-yes-resolver");
 const logger = (0, logger_1.createLogger)('auto-yes-policy');
 /** How long a resolved policy is reused before the task is looked up again. */
 exports.AUTO_YES_POLICY_CACHE_TTL_MS = 5000;
@@ -54,11 +60,11 @@ function purgeExpired(now) {
  * Read the policy from the active task, or null when no contract governs this
  * instance.
  *
- * A database failure yields null — the unconstrained behaviour. Failing closed
- * here would suppress auto-yes for every user who has no contract at all, which
- * is the population this feature must not touch; the suppressing decisions
- * (`off`, deny patterns) are made inside the resolver only once a contract has
- * actually been read.
+ * Issue #3822: a database failure yields {@link AUTO_YES_POLICY_UNKNOWN}, not
+ * null. It used to yield null — the unconstrained behaviour — so a contract
+ * stating `off` or a deny pattern was answered past whenever one read failed.
+ * Users without a contract are still untouched: a lookup that succeeds and
+ * finds no task is null, as before, and only a lookup that fails withholds.
  */
 function readPolicy(worktreeId, cliToolId, instanceId) {
     try {
@@ -76,7 +82,7 @@ function readPolicy(worktreeId, cliToolId, instanceId) {
             instanceId,
             error: error instanceof Error ? error.message : String(error),
         });
-        return { policy: null, taskId: null };
+        return { policy: auto_yes_resolver_1.AUTO_YES_POLICY_UNKNOWN, taskId: null };
     }
 }
 /**
@@ -85,8 +91,12 @@ function readPolicy(worktreeId, cliToolId, instanceId) {
  *
  * @param worktreeId - Worktree identifier
  * @param cliToolId - CLI tool being polled
+ * For the paths that answer (the poller and the `PermissionRequest` hook):
+ * the resolver reads {@link AUTO_YES_POLICY_UNKNOWN} as withholding (Issue #3822).
+ *
  * @param instanceId - Agent instance id (defaults to the primary, i.e. cliToolId)
- * @returns The contract's autoYes block, or null when no contract governs this instance
+ * @returns The contract's autoYes block, null when no contract governs this
+ *   instance, or {@link AUTO_YES_POLICY_UNKNOWN} when the lookup failed
  */
 function getSessionAutoYesPolicy(worktreeId, cliToolId, instanceId) {
     return lookupEntry(worktreeId, cliToolId, instanceId).policy;
@@ -96,8 +106,23 @@ function getSessionAutoYesPolicy(worktreeId, cliToolId, instanceId) {
  * #3724), so a log line naming both cannot pair one task's verdict with another
  * task's id when the cache expires between two reads. `taskId` is null when no
  * contract governs the instance.
+ *
+ * For display only (Issue #3822): a failed lookup reads as no contract here
+ * (`policy` and `taskId` null), never as a contract this lookup did not see.
  */
 function getSessionAutoYesPolicyEntry(worktreeId, cliToolId, instanceId) {
+    const { policy, taskId } = lookupEntry(worktreeId, cliToolId, instanceId);
+    if ((0, auto_yes_resolver_1.isAutoYesPolicyUnknown)(policy))
+        return { policy: null, taskId: null };
+    return { policy, taskId };
+}
+/**
+ * {@link getSessionAutoYesPolicyEntry} for a path that judges the prompt again
+ * (Issue #3822): a failed lookup stays {@link AUTO_YES_POLICY_UNKNOWN} instead of
+ * reading as no contract, so the resolver withholds on it as the tick did.
+ * `taskId` is null when no contract governs the instance or the lookup failed.
+ */
+function getSessionAutoYesPolicyLookupEntry(worktreeId, cliToolId, instanceId) {
     const { policy, taskId } = lookupEntry(worktreeId, cliToolId, instanceId);
     return { policy, taskId };
 }
@@ -146,6 +171,10 @@ function lookupEntry(worktreeId, cliToolId, instanceId) {
         return cached;
     }
     const { policy, taskId } = readPolicy(worktreeId, cliToolId, resolvedInstanceId);
+    if ((0, auto_yes_resolver_1.isAutoYesPolicyUnknown)(policy)) {
+        // Issue #3822: not cached, so the next lookup reads again.
+        return { policy, taskId, expiresAt: now };
+    }
     if (policyCache.size >= MAX_CACHE_ENTRIES) {
         purgeExpired(now);
     }

package/dist/server/src/lib/polling/auto-yes-poller-capture.js

@@ -0,0 +1,50 @@
+"use strict";
+/**
+ * Auto-Yes poller: one tick's capture (Issue #2522) (Issue #3783: split out of
+ * `auto-yes-poller.ts`, which re-exports the public names).
+ *
+ * Does not statically import `auto-yes-poller.ts` (no cycle outside the
+ * baseline in `import-cycles-baseline-3482`). Via `cli-session`, opencode's
+ * history feed reaches it back through a dynamic `import()`; that path predates
+ * the split (the poller imported `cli-session` itself) and is no static cycle.
+ *
+ * @module lib/polling/auto-yes-poller-capture
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.capturePollerFrame = capturePollerFrame;
+exports.captureAndCleanOutput = captureAndCleanOutput;
+const cli_session_1 = require("../session/cli-session");
+const cli_patterns_1 = require("../detection/cli-patterns");
+const auto_yes_config_1 = require("../../config/auto-yes-config");
+/**
+ * Capture tmux session output once, keeping both spellings (Issue #2522).
+ *
+ * @internal Exported for testing purposes only.
+ * @param worktreeId - Worktree identifier
+ * @param cliToolId - CLI tool type being polled
+ * @param captureLines - Optional number of lines to capture
+ * @param instanceId - Optional agent instance ID (Issue #896; defaults to primary session)
+ * @returns The tick's raw capture and its cleaned form
+ */
+async function capturePollerFrame(worktreeId, cliToolId, captureLines, instanceId) {
+    const lines = captureLines ?? auto_yes_config_1.FULL_CAPTURE_LINES;
+    const output = await (0, cli_session_1.captureSessionOutput)(worktreeId, cliToolId, lines, instanceId);
+    return { raw: output, clean: (0, cli_patterns_1.stripBoxDrawing)((0, cli_patterns_1.stripAnsi)(output)) };
+}
+/**
+ * Capture tmux session output and strip ANSI escape codes.
+ *
+ * Kept as the cleaned half of {@link capturePollerFrame} so the many callers and
+ * tests that only ever wanted that string are untouched; `pollAutoYes` takes the
+ * pair. `stripBoxDrawing` still runs exactly once per capture either way.
+ *
+ * @internal Exported for testing purposes only.
+ * @param worktreeId - Worktree identifier
+ * @param cliToolId - CLI tool type being polled
+ * @param captureLines - Optional number of lines to capture
+ * @param instanceId - Optional agent instance ID (Issue #896; defaults to primary session)
+ * @returns Cleaned output string (ANSI stripped)
+ */
+async function captureAndCleanOutput(worktreeId, cliToolId, captureLines, instanceId) {
+    return (await capturePollerFrame(worktreeId, cliToolId, captureLines, instanceId)).clean;
+}

package/dist/server/src/lib/polling/auto-yes-poller-enter-fallback.js

@@ -0,0 +1,37 @@
+"use strict";
+/**
+ * Auto-Yes poller: the Enter fallback's audit answer and per-session epoch
+ * (Issue #3397) (Issue #3783: split out of `auto-yes-poller.ts`, which
+ * re-exports the public names; the Enter itself — `tryEnterFallback` — and its
+ * fresh-frame check stay there).
+ *
+ * Does not statically import `auto-yes-poller.ts` (no cycle outside the
+ * baseline in `import-cycles-baseline-3482`, which does not count dynamic
+ * `import()`).
+ *
+ * @module lib/polling/auto-yes-poller-enter-fallback
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTO_YES_ENTER_FALLBACK_ANSWER = void 0;
+exports.syncEnterFallbackEpoch = syncEnterFallbackEpoch;
+const auto_yes_enter_fallback_1 = require("./auto-yes-enter-fallback");
+/**
+ * The audit row's `answer` for the Enter (Issue #3397): not a digit, so the
+ * History reads as "Auto-Yes pressed Enter" rather than as a chosen option.
+ */
+exports.AUTO_YES_ENTER_FALLBACK_ANSWER = '[Enter]';
+/**
+ * Issue #3397: a session begun since the last tick (a relaunch the poller
+ * outlived) starts with no screen that had its Enter.
+ *
+ * @returns The session epoch the tick reads under
+ */
+function syncEnterFallbackEpoch(compositeKey, pollerState) {
+    const epoch = (0, auto_yes_enter_fallback_1.getEnterFallbackSessionEpoch)(compositeKey);
+    if ((pollerState.enterFallbackEpoch ?? 0) !== epoch) {
+        pollerState.enterFallbackSentKey = null;
+        pollerState.enterFallbackCandidateKey = null;
+        pollerState.enterFallbackEpoch = epoch;
+    }
+    return epoch;
+}

package/dist/server/src/lib/polling/auto-yes-poller-generation.js

@@ -0,0 +1,151 @@
+"use strict";
+/**
+ * Auto-Yes poller state store and tick generation (Issue #3783: split out of
+ * `auto-yes-poller.ts`, which re-exports the public names).
+ *
+ * Does not statically import `auto-yes-poller.ts` (no cycle outside the
+ * baseline in `import-cycles-baseline-3482`, which does not count dynamic
+ * `import()`).
+ *
+ * @module lib/polling/auto-yes-poller-generation
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.autoYesPollerStates = void 0;
+exports.getPollerState = getPollerState;
+exports.getActivePollerCount = getActivePollerCount;
+exports.getLastServerResponseTimestamp = getLastServerResponseTimestamp;
+exports.isPollerActive = isPollerActive;
+exports.updateLastServerResponseTimestamp = updateLastServerResponseTimestamp;
+exports.resetErrorCount = resetErrorCount;
+exports.ownedPollerState = ownedPollerState;
+exports.isPollerCurrent = isPollerCurrent;
+exports.isTickCurrent = isTickCurrent;
+exports.isSameSession = isSameSession;
+exports.isDuplicatePrompt = isDuplicatePrompt;
+const auto_yes_enter_fallback_1 = require("./auto-yes-enter-fallback");
+const auto_yes_state_1 = require("../auto-yes-state");
+const global_state_1 = require("../global-state");
+/** In-memory storage for poller states (globalThis for hot reload persistence) */
+exports.autoYesPollerStates = (0, global_state_1.getOrInitGlobal)('__autoYesPollerStates', () => new Map());
+// =============================================================================
+// Poller State Accessors (compositeKey-based)
+// =============================================================================
+/**
+ * Get poller state by composite key.
+ *
+ * @param compositeKey - Composite key (worktreeId:cliToolId)
+ * @returns Poller state or undefined
+ */
+function getPollerState(compositeKey) {
+    return exports.autoYesPollerStates.get(compositeKey);
+}
+/**
+ * Get the number of active pollers.
+ */
+function getActivePollerCount() {
+    return exports.autoYesPollerStates.size;
+}
+/**
+ * Get the last server response timestamp for a composite key.
+ *
+ * Issue #525: Changed from (worktreeId) to (compositeKey).
+ *
+ * @param compositeKey - Composite key (worktreeId:cliToolId)
+ * @returns Timestamp (Date.now()) of the last server response, or null if none
+ */
+function getLastServerResponseTimestamp(compositeKey) {
+    const pollerState = getPollerState(compositeKey);
+    return pollerState?.lastServerResponseTimestamp ?? null;
+}
+/**
+ * Check if a server-side auto-yes poller is active for a composite key.
+ *
+ * Issue #525: Changed from (worktreeId) to (compositeKey).
+ *
+ * @param compositeKey - Composite key (worktreeId:cliToolId)
+ * @returns true if a poller is actively running
+ */
+function isPollerActive(compositeKey) {
+    return exports.autoYesPollerStates.has(compositeKey);
+}
+/**
+ * Update the last server response timestamp.
+ *
+ * @param compositeKey - Composite key
+ * @param timestamp - Timestamp value (Date.now())
+ */
+function updateLastServerResponseTimestamp(compositeKey, timestamp, owner) {
+    const pollerState = ownedPollerState(compositeKey, owner);
+    if (pollerState) {
+        pollerState.lastServerResponseTimestamp = timestamp;
+    }
+}
+/**
+ * Reset error count for a poller and restore the default polling interval.
+ * Called after every poll that ran to the end without an error (Issue #3329)
+ * and after an answer is sent.
+ *
+ * @param compositeKey - Composite key
+ * @param owner - The tick's own poller state (Issue #3706); see {@link ownedPollerState}
+ */
+function resetErrorCount(compositeKey, owner) {
+    const pollerState = ownedPollerState(compositeKey, owner);
+    if (pollerState) {
+        pollerState.consecutiveErrors = 0;
+        pollerState.currentInterval = auto_yes_state_1.POLLING_INTERVAL_MS;
+    }
+}
+/**
+ * The poller state under `compositeKey`, but only when it is `owner` — the
+ * tick's own (Issue #3706). Without `owner` (callers outside a tick, and tests
+ * driving `detectAndRespondToPrompt` with a hand-built state) it is the plain
+ * by-key read this always was.
+ */
+function ownedPollerState(compositeKey, owner) {
+    const pollerState = getPollerState(compositeKey);
+    if (owner !== undefined && pollerState !== owner)
+        return undefined;
+    return pollerState;
+}
+/** Is the tick's poller still the one under its key (not stopped, not replaced)? */
+function isPollerCurrent(generation) {
+    return getPollerState(generation.compositeKey) === generation.pollerState;
+}
+/**
+ * May the tick still act: its poller, its grant (the same enable, not expired)
+ * and its session (no relaunch since) are all still the ones it started under.
+ * Checked after capture, after each wait before a key, and inside the send.
+ */
+function isTickCurrent(generation) {
+    if (!isPollerCurrent(generation))
+        return false;
+    // `getAutoYesState` returns the stored object until it expires, when it
+    // stores (and returns) a disabled one — so an expiry fails identity too.
+    const grant = (0, auto_yes_state_1.getAutoYesState)(generation.worktreeId, generation.cliToolId, generation.instanceId);
+    if (grant !== generation.grant || !grant.enabled)
+        return false;
+    return isSameSession(generation);
+}
+/**
+ * Is the session the tick answered still the one it started on (Issue #3706)?
+ * What the follow-ups of an answer already sent — the response poller restart,
+ * the terminal push — are judged by: a disable after the keys landed does not
+ * un-send them, a relaunch does make them about another process.
+ */
+function isSameSession(generation) {
+    return (0, auto_yes_enter_fallback_1.getEnterFallbackSessionEpoch)(generation.compositeKey) === generation.sessionEpoch;
+}
+/**
+ * Check if the given prompt has already been answered recently.
+ *
+ * @param pollerState - Current poller state
+ * @param promptKey - Composite key of the current prompt
+ * @returns true if the prompt key matches and is within the retry expiry window
+ */
+function isDuplicatePrompt(pollerState, promptKey) {
+    if (pollerState.lastAnsweredPromptKey !== promptKey)
+        return false;
+    if (pollerState.lastAnsweredAt === null)
+        return false;
+    return (Date.now() - pollerState.lastAnsweredAt) < auto_yes_state_1.DUPLICATE_RETRY_EXPIRY_MS;
+}