commandmate 0.47.0 → 0.48.0

package/dist/server/src/lib/detection/tools/command-code/dialog.js

@@ -78,6 +78,7 @@ const ansi_1 = require("../../ansi");
 const prompt_detect_multiple_choice_1 = require("../../prompt-detect-multiple-choice");
 const selection_shape_1 = require("../../selection-shape");
 const dialog_block_1 = require("../dialog-block");
+const option_recommendation_1 = require("../../option-recommendation");
 const truncate_raw_content_1 = require("../../truncate-raw-content");
 /**
  * How many rows of dialog this reader will parse.
@@ -354,6 +355,8 @@ function readCommandCodeQuestionDialog(frame) {
         region,
         prompt: {
             ...built,
+            // Issue #3863: beside the payload, never in it — see `PromptDetectionResult`.
+            optionRecommendations: readCommandCodeOptionRecommendations(lines, regionRows.slice(block.firstRow), labels.length),
             promptData: {
                 ...promptData,
                 // Only ever added, never set to `false`: see the `checked` note above.
@@ -373,6 +376,70 @@ function readCommandCodeQuestionDialog(frame) {
         },
     };
 }
+/** The option row's own prefix — indent, gutter, cursor and number — up to where its label starts. */
+const OPTION_ROW_PREFIX_PATTERN = /^[^\S\n]*[│┃]?[^\S\n]*[❯›●>]?[^\S\n]*\d{1,2}[.)][^\S\n]+/;
+/**
+ * What each option's title says about being recommended (Issue #3863,
+ * `option-recommendation`), read off the option rows again — the block reader
+ * joins everything under an option into its label, and this screen says
+ * which rows are the title.
+ *
+ * Measured on the reported capture (#2521, 1.53.0): an option's description
+ * starts on its own row at the option's LABEL column (`❯ 1. ` → five spaces),
+ * and only what the pane wraps lands further left (column 0 or 1). So under an
+ * option row:
+ *
+ * - a row at or right of the label column starts the description, and
+ *   everything after it is description;
+ * - a row left of it, before any description, is the title wrapping — unless
+ *   the row above could not have wrapped into it (its first word would have
+ *   fit there, `cannotBeWrapOf`), in which case it is a description drawn
+ *   further left (the synthetic indent 0 / 1 / 2 shapes #2522 reads), and the
+ *   rest is description too;
+ * - `Submit` / `Next` and the hint bar under the last option are nobody's.
+ *
+ * Every option `'unknown'` when the walk does not find the same options the
+ * reading did.
+ *
+ * @param frameRows - Every row of the capture, for the pane's width
+ * @param optionRows - The region's rows from option 1's row on
+ * @param optionCount - How many options the reading found
+ */
+function readCommandCodeOptionRecommendations(frameRows, optionRows, optionCount) {
+    const paneColumns = (0, option_recommendation_1.lowerBoundPaneColumns)(frameRows);
+    const titles = [];
+    let labelColumn = 0;
+    let lastTitleRow = '';
+    let inDescription = false;
+    for (const row of optionRows) {
+        if (row.trim() === '')
+            continue;
+        const parsed = (0, dialog_block_1.parseNumberedOptionRow)(row);
+        if (parsed !== null && parsed.number === titles.length + 1) {
+            titles.push([parsed.label]);
+            labelColumn = OPTION_ROW_PREFIX_PATTERN.exec(row)?.[0].length ?? 0;
+            lastTitleRow = row;
+            inDescription = false;
+            continue;
+        }
+        if (titles.length === 0)
+            break;
+        if (COMMAND_CODE_CONFIRM_ROW_PATTERN.test(row) || COMMAND_CODE_QUESTION_HINT_BAR_PATTERN.test(row))
+            continue;
+        if (inDescription)
+            continue;
+        const indent = row.length - row.trimStart().length;
+        if (indent >= labelColumn || (0, option_recommendation_1.cannotBeWrapOf)(lastTitleRow, row, paneColumns)) {
+            inDescription = true;
+            continue;
+        }
+        titles[titles.length - 1].push(row.trim());
+        lastTitleRow = row;
+    }
+    if (titles.length !== optionCount)
+        return Array.from({ length: optionCount }, () => 'unknown');
+    return titles.map((rows) => (0, option_recommendation_1.isRecommendedTitle)(rows.join(' ')));
+}
 /**
  * The same reading as a `PromptDetectionResult | null`, for the call sites whose
  * only question is "is there an answerable prompt here?".

package/dist/server/src/lib/detection/tools/dialog-block.js

@@ -30,7 +30,9 @@
  * glyph or an SGR attribute, so both spellings parse to the same block.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseNumberedOptionRow = parseNumberedOptionRow;
 exports.findNumberedOptionBlock = findNumberedOptionBlock;
+const option_recommendation_1 = require("../option-recommendation");
 /**
  * One numbered option row.
  *
@@ -58,6 +60,16 @@ const OPTION_ROW_PATTERN = /^[^\S\n]*[│┃]?[^\S\n]*([❯›●>])?[^\S\n]*(\d
 const DEFAULT_FOOTER_SCAN_ROWS = 8;
 /** How many rows one option block may span, wrapped continuations included. */
 const MAX_BLOCK_ROWS = 60;
+/**
+ * Read one row as a numbered option row (`❯ 1. label`), or null.
+ *
+ * Exported for a tool module that walks the block's rows again to tell an
+ * option's title from its description (Issue #3863), so it reads an option
+ * row exactly as this reader does.
+ */
+function parseNumberedOptionRow(row) {
+    return parseOptionRow(row);
+}
 function parseOptionRow(row) {
     const match = OPTION_ROW_PATTERN.exec(row);
     if (!match)
@@ -117,6 +129,8 @@ function findNumberedOptionBlock(lines, endExclusive, footerScanRows = DEFAULT_F
     const lastRow = cursor;
     // 2. Walk up the run, collecting each option and any wrapped rows above it.
     const collected = [bottom];
+    // Issue #3863: whether rows were folded into each collected option's label.
+    const folded = [false];
     let expected = bottom.number - 1;
     let row = cursor - 1;
     let spanned = 1;
@@ -135,6 +149,7 @@ function findNumberedOptionBlock(lines, endExclusive, footerScanRows = DEFAULT_F
         const parsed = parseOptionRow(text);
         if (parsed && parsed.number === expected) {
             collected.unshift({ ...parsed, label: [parsed.label, ...pending].join(' ').trim() });
+            folded.unshift(pending.length > 0);
             pending = [];
             expected--;
             row--;
@@ -155,5 +170,6 @@ function findNumberedOptionBlock(lines, endExclusive, footerScanRows = DEFAULT_F
         firstRow: row + 1,
         lastRow,
         footer: footerRows.join('\n'),
+        optionRecommendations: collected.map((option, index) => folded[index] ? 'unknown' : (0, option_recommendation_1.isRecommendedTitle)(option.label)),
     };
 }

package/dist/server/src/lib/detection/waiting-screen-reading.js

@@ -0,0 +1,98 @@
+"use strict";
+/**
+ * One reading of a frame for the waiting episodes (Issue #3798, design §2.2 /
+ * 規則 1 / I9).
+ *
+ * Three observers read a frame and tell the episode store about it: the status
+ * probe (`worktree-status-helper`), the response poller and the Auto-Yes poller.
+ * They used to read it three ways — the Auto-Yes poller through the agy receipt
+ * window, which turns a real confirmation outside the window into "no prompt" —
+ * and a wait one of them saw as a person's screen another saw as nothing. Here
+ * is the one reading they share: whether the frame waits, what kind of wait it
+ * is, and whether only a person can end it (`humanHeld`), from the detector's
+ * verdict WITHOUT the receipt scope.
+ *
+ * `humanHeld` (規則 1) is all of: the detector says `waiting`, the same
+ * verdict's prompt reading says there is no prompt, and the agent reported no
+ * structured wait. So a copilot `ask_user` with four or more options (a prompt
+ * the detector reads, `isPrompt: true`) and an opencode permission strip the
+ * agent reported a decision for (a structured wait) are not a person's screen;
+ * a survey, a picker or a trust screen is.
+ *
+ * Detection layer: reads the detector and the waiting taxonomy, and nothing in
+ * `polling/` or the session stores.
+ *
+ * @module lib/detection/waiting-screen-reading
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.waitingReadingFromVerdict = waitingReadingFromVerdict;
+exports.promptWaitingReading = promptWaitingReading;
+exports.readWaitingScreen = readWaitingScreen;
+const status_detector_1 = require("./status-detector");
+const status_reason_1 = require("./status-reason");
+const waiting_kind_1 = require("../../lib/session/waiting-kind");
+/**
+ * The reasons that mean "no rule could read this frame" — the set
+ * `session/status-evidence`'s `isUnclassifiedFrame` names. Restated rather than
+ * imported because that module sits above this layer (it reads the agent's
+ * event store).
+ */
+const UNCLASSIFIED_REASONS = new Set([
+    status_reason_1.STATUS_REASON.NO_RECENT_OUTPUT,
+    status_reason_1.STATUS_REASON.UNKNOWN_FRAME,
+    status_reason_1.STATUS_REASON.DEFAULT,
+]);
+/**
+ * A reading from a verdict the caller has already made, with the caller's own
+ * composed answer to "is it waiting" (the status probe folds the structured
+ * layer and a launch in progress into it). `humanHeld` is decided here and
+ * nowhere else.
+ */
+function waitingReadingFromVerdict(input) {
+    if (!input.waiting)
+        return { kind: 'not-waiting' };
+    const { verdict } = input;
+    return {
+        kind: 'waiting',
+        waitingKind: input.waitingKind,
+        humanHeld: verdict.status === 'waiting' && verdict.promptDetection.isPrompt === false && !input.structuredWaiting,
+        promptData: verdict.promptDetection.promptData ?? null,
+        structuredSince: input.structuredSince,
+    };
+}
+/**
+ * The reading of a prompt an observer has already read off the frame (the
+ * response poller's saved prompt). A prompt is never a person's screen.
+ */
+function promptWaitingReading(promptData) {
+    return { kind: 'waiting', waitingKind: 'prompt', humanHeld: false, promptData, structuredSince: null };
+}
+/**
+ * Read one captured frame (design §2.2). The detector is asked without the
+ * receipt scope (I9); the structured wait, and whether the app answers it over
+ * the agent's API, are the caller's to look up — the status probe's reading of
+ * the same frame gives the same kind only when both are passed.
+ *
+ * `verdict` is the detector's answer on this same frame when the caller has
+ * already asked for it (to look the structured wait up with), so the frame is
+ * not judged twice.
+ */
+function readWaitingScreen(input) {
+    const verdict = input.verdict ?? (0, status_detector_1.detectSessionStatus)(input.output, input.cliToolId, input.lastOutputTimestamp);
+    if (verdict.status === 'running' && UNCLASSIFIED_REASONS.has(verdict.reason))
+        return { kind: 'unknown' };
+    const waiting = verdict.status === 'waiting' || verdict.hasActivePrompt || input.structuredWaiting;
+    return waitingReadingFromVerdict({
+        verdict,
+        waiting,
+        waitingKind: (0, waiting_kind_1.deriveWaitingKind)({
+            waiting,
+            hasActivePrompt: verdict.hasActivePrompt,
+            scraperStatus: verdict.status,
+            scraperReason: verdict.reason,
+            apiAnswerable: input.apiAnswerable === true,
+        }),
+        structuredWaiting: input.structuredWaiting,
+        structuredSince: input.structuredSince,
+    });
+}

package/dist/server/src/lib/hooks/permission-adjudication.js

@@ -29,6 +29,17 @@
  * capability block is the whole vocabulary (`docs/design/
  * multi-agent-state-architecture.md` §4 D3).
  *
+ * ## The ledger (Issue #3820)
+ *
+ * Each adjudication is written to the Auto-Yes confirmation ledger as the
+ * approval's confirmation, keyed by the decision id (design
+ * `docs/design/auto-yes-measurement-3820.md` §2.4): an `allow` is a send whose
+ * result is `delivered`, `settled` closes it, a policy's abstention withholds
+ * it. **No hook request is made here** — that id is the hook route's alone
+ * (§2.3, N2), so `resolvePermissionRequest` is called without one. The send is
+ * taken before the delivery is awaited and its result returned to it after
+ * (§2.5). The ledger never throws, and nothing here reads it back.
+ *
  * ## Why `permission-decision-service` is imported dynamically
  *
  * The same reason `sources/opencode/ingest` does it: that module reaches the
@@ -72,6 +83,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.adjudicatePendingPermission = adjudicatePendingPermission;
 const logger_1 = require("../../lib/logger");
+const auto_yes_confirmation_ledger_1 = require("../../lib/polling/auto-yes-confirmation-ledger");
 const abstain_1 = require("./sources/abstain");
 const pending_decisions_1 = require("./sources/pending-decisions");
 const permission_decision_state_1 = require("./permission-decision-state");
@@ -121,6 +133,19 @@ async function adjudicatePendingPermission(source, target, decision, payload, tr
             });
         }
     }
+    // Issue #3820: the ledger's send is taken before the delivery's await, as the
+    // screen path takes its handle, so a result that comes back after the
+    // confirmation closed (a kill meanwhile) is that confirmation's late result
+    // rather than the answer of one opened again by the decision id.
+    const ledgerAttempt = (0, auto_yes_confirmation_ledger_1.beginLedgerApiAdjudication)(session, decision.id, {
+        outcome: verdictSource.behavior === 'allow' ? 'allow' : 'abstained',
+        ...(verdictSource.reason === 'policy-suppressed' && verdictSource.suppressedBy
+            ? { withholdReason: verdictSource.suppressedBy }
+            : {}),
+        // `PERMISSION_REQUEST_PROMPT_TYPE`, spelled out: the service is imported
+        // dynamically (above) and its suites mock it down to one export.
+        promptType: 'multiple_choice',
+    });
     // C2: the caller does not know whether this writes a response body or opens a
     // second connection, and must not. What it does now get back is whether the
     // verdict landed (#1898).
@@ -137,6 +162,7 @@ async function adjudicatePendingPermission(source, target, decision, payload, tr
         trigger,
         at: decision.askedAt,
     });
+    (0, auto_yes_confirmation_ledger_1.settleLedgerApiAdjudication)(ledgerAttempt, { delivered, settled });
     logger.info('permission-decision-adjudicated', {
         worktreeId: target.worktreeId,
         cliToolId: target.cliToolId,

package/dist/server/src/lib/hooks/permission-decision-service.js

@@ -78,6 +78,7 @@ const chat_db_1 = require("../../lib/db/chat-db");
 const auto_yes_policy_1 = require("../../lib/polling/auto-yes-policy");
 const auto_yes_resolver_1 = require("../../lib/polling/auto-yes-resolver");
 const auto_yes_suppression_state_1 = require("../../lib/polling/auto-yes-suppression-state");
+const auto_yes_confirmation_ledger_1 = require("../../lib/polling/auto-yes-confirmation-ledger");
 const agent_event_state_1 = require("../../lib/session/agent-event-state");
 const logger_1 = require("../../lib/logger");
 const ask_user_question_payload_1 = require("./ask-user-question-payload");
@@ -114,9 +115,17 @@ function readContractPolicy(session) {
  * | payload unreadable | no-decision |
  * | `AskUserQuestion` | no-decision |
  * | Auto-Yes off / expired | no-decision |
+ * | contract lookup failed (Issue #3822) | no-decision + suppression |
  * | policy suppresses (mode off, deny pattern, type) | no-decision + suppression |
  * | otherwise | allow |
  *
+ * Issue #3822: the screen path reads the grant and the contract once more right
+ * before its first key (`withheldAtSend`). This path has no such moment: the
+ * `allow` returned here IS the answer — Claude runs the call without drawing a
+ * dialog and nothing is typed afterwards — so the grant and the contract it is
+ * judged against are read now, when the hook is answered, and the contract
+ * through the same cache-backed lookup (a failed read withholds, #3830).
+ *
  * @param session - Worktree / tool / instance the request came from
  * @param payload - Parsed payload, or null when it could not be parsed
  * @param deps - Substitutions for the database-backed lookups; see
@@ -144,21 +153,28 @@ function decidePermissionRequest(session, payload, deps = {}) {
     // Issue #1902: the third argument is what stops a normalised payload from
     // being judged on its whole body. See `collectToolInputMatchTexts`.
     (0, permission_request_payload_1.collectToolInputMatchTexts)(payload.toolName, payload.toolInput, payload.toolInputNormalization), policy);
+    // Issue #3822: an unknown policy (the lookup failed) is a denial here, so the
+    // hook abstains — the dialog is drawn — rather than allowing unattended.
     if (denial) {
         return {
             behavior: null,
             reason: 'policy-suppressed',
             suppressedBy: denial.reason,
             pattern: denial.pattern,
-            mode: policy?.mode ?? null,
+            mode: (0, auto_yes_resolver_1.policyLookupMode)(policy),
         };
     }
-    return { behavior: 'allow', reason: 'auto-yes', mode: policy?.mode ?? null };
+    return { behavior: 'allow', reason: 'auto-yes', mode: (0, auto_yes_resolver_1.policyLookupMode)(policy) };
 }
 /**
  * Persist an `allow` to the prompt history `capture --prompts` reads
  * (Issue #1685's layer).
  *
+ * Issue #3820: only on a source that declares
+ * {@link AgentSourceCapabilities.permissionAllowSuppressesDialog} — see
+ * {@link resolvePermissionRequest}. On agy the premise below does not hold
+ * (its dialog is drawn after an allow, and the screen's answer is the record).
+ *
  * Only `allow` is written here, and that asymmetry is deliberate. An allowed
  * request never draws a dialog, so this row is the *only* record that anything
  * happened — without it, Auto-Yes v2 approves commands invisibly. Every other
@@ -365,8 +381,9 @@ function reportPendingDialog(session, payload) {
  *   {@link PermissionDecisionDeps}. Omit in the server.
  * @returns The verdict the route serialises
  */
-function resolvePermissionRequest(session, payload, deps = {}) {
+function resolvePermissionRequest(session, payload, deps = {}, options = {}) {
     const decision = decidePermissionRequest(session, payload, deps);
+    const { capabilities } = (0, registry_1.getAgentEventSource)(session.cliToolId);
     // Issue #1902: before anything else, and regardless of the verdict. The
     // adjudicated `tool_input` is not the one copilot sent, and the design
     // policy's discoverability rule (§7) says a rewrite nobody can observe is a
@@ -421,8 +438,36 @@ function resolvePermissionRequest(session, payload, deps = {}) {
             pattern: decision.pattern,
         });
     }
-    if (decision.behavior === 'allow' && payload) {
+    // Issue #3820 (design §5.1): an allow is an answer only where it draws no
+    // dialog. On agy the dialog is drawn anyway and the poller's answer writes
+    // the row, so a row here was the same approval twice — and, when agy ran the
+    // call by its own allow-list, an approval CommandMate never gave.
+    if (decision.behavior === 'allow' && payload && capabilities.permissionAllowSuppressesDialog) {
         (deps.recordAllow ?? recordAllowedPermission)(session, payload);
     }
+    recordHookRequestInLedger(session, payload, decision, capabilities.permissionAllowSuppressesDialog, options);
     return decision;
 }
+/**
+ * The ledger's half of a hook request (Issue #3820, design §2.3, §3.4): what was
+ * decided — an allow that draws no dialog is the confirmation, anything else
+ * leaves the waiting to the screen's confirmation — and the CLI's own mode when
+ * the payload states it. Nothing without a `hookRequestId`, which only the hook
+ * route issues. The ledger never throws, and nothing here decides anything.
+ */
+function recordHookRequestInLedger(session, payload, decision, allowSuppressesDialog, options) {
+    if (!options.hookRequestId)
+        return;
+    (0, auto_yes_confirmation_ledger_1.decideLedgerHookRequest)(options.hookRequestId, {
+        outcome: decision.behavior === 'allow' ? 'allow' : 'abstained',
+        ...(decision.behavior === 'allow' ? {} : { abstainReason: decision.reason }),
+        allowSuppressesDialog,
+        promptType: exports.PERMISSION_REQUEST_PROMPT_TYPE,
+        // PR 3 (design §2.4): agy's call, tying the request to the screen's
+        // confirmation and to the call's `PostToolUse`.
+        ...(payload?.callId ? { callId: payload.callId } : {}),
+    });
+    if (payload?.permissionMode) {
+        (0, auto_yes_confirmation_ledger_1.observeLedgerCliMode)(session, payload.permissionMode);
+    }
+}

package/dist/server/src/lib/hooks/permission-request-payload.js

@@ -23,6 +23,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MAX_TOOL_NAME_LENGTH = exports.ASK_USER_QUESTION_TOOL = exports.PERMISSION_REQUEST_EVENT_NAME = void 0;
+exports.buildHookCallId = buildHookCallId;
 exports.parsePermissionRequestPayload = parsePermissionRequestPayload;
 exports.collectToolInputMatchTexts = collectToolInputMatchTexts;
 const tool_input_normalization_1 = require("./tool-input-normalization");
@@ -39,6 +40,25 @@ exports.PERMISSION_REQUEST_EVENT_NAME = 'PermissionRequest';
 exports.ASK_USER_QUESTION_TOOL = 'AskUserQuestion';
 /** Bound on `tool_name`; it is a Claude-side identifier, logged and stored. */
 exports.MAX_TOOL_NAME_LENGTH = 128;
+/** A conversation id a call id may carry: an opaque id, no path or prose. */
+const CALL_ID_CONVERSATION = /^[A-Za-z0-9._-]{1,128}$/;
+/**
+ * `<conversationId>:<stepIdx>` (Issue #3820, design §2.1): `stepIdx` is unique
+ * within a conversation and starts again when agy is relaunched, so it is
+ * paired with the conversation. Null unless `stepIdx` is a non-negative safe
+ * integer and the conversation id an opaque id — a body without them is read
+ * as before, with no call id.
+ *
+ * @param conversationId - agy's `conversationId` (the relay's `sessionId`)
+ * @param stepIdx - The body's `stepIdx`, whatever it was
+ */
+function buildHookCallId(conversationId, stepIdx) {
+    if (typeof conversationId !== 'string' || !CALL_ID_CONVERSATION.test(conversationId))
+        return null;
+    if (typeof stepIdx !== 'number' || !Number.isSafeInteger(stepIdx) || stepIdx < 0)
+        return null;
+    return `${conversationId}:${stepIdx}`;
+}
 function readString(source, key) {
     const value = source[key];
     return typeof value === 'string' && value !== '' ? value : null;

package/dist/server/src/lib/hooks/sources/antigravity/source.js

@@ -64,6 +64,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.antigravityAgentEventSource = void 0;
 exports.parseAntigravityPermissionRequest = parseAntigravityPermissionRequest;
+exports.readAntigravityPermissionCallId = readAntigravityPermissionCallId;
 exports.encodeAntigravityVerdict = encodeAntigravityVerdict;
 exports.extractAntigravityEventDetail = extractAntigravityEventDetail;
 const uat_isolation_1 = require("../../../../config/uat-isolation");
@@ -125,6 +126,23 @@ function parseAntigravityPermissionRequest(body) {
         permissionSuggestions: null,
     };
 }
+/**
+ * The call agy's `PreToolUse` asks about, `<conversationId>:<stepIdx>`
+ * (Issue #3820, design `docs/design/auto-yes-measurement-3820.md` §2.4), or
+ * null when the body has no numeric `stepIdx` or no conversation id.
+ *
+ * Read beside {@link parseAntigravityPermissionRequest}, not inside it: the
+ * route puts it on the payload (`callId`) for the Auto-Yes ledger only. The
+ * parsed payload is what the adjudication judges, and it stays exactly what it
+ * was — `stepIdx` is still not a prompt id.
+ *
+ * @param body - Whatever was posted to `/api/hooks/permission-request`
+ */
+function readAntigravityPermissionCallId(body) {
+    if (!(0, event_mapper_1.isPlainObject)(body))
+        return null;
+    return (0, permission_request_payload_1.buildHookCallId)((0, event_mapper_1.readStringField)(body, 'conversationId'), body.stepIdx);
+}
 /**
  * Encode a verdict in agy's wire form (S6, #1757 R15).
  *
@@ -217,6 +235,9 @@ exports.antigravityAgentEventSource = (0, define_source_1.definePushHookSource)(
         // Not audited. Default = Claude's current behaviour.
         sessionStartMayArriveLate: false,
         permissionReplyReleasesPrompt: false,
+        // Issue #3820, measured (1.1.12 / 1.1.27 / 1.4.2): agy draws its dialog even
+        // after an `allow`, and the screen's answer is the record — no audit row.
+        permissionAllowSuppressesDialog: false,
         eventIdentity: null,
         resync: 'none',
         // Issue #2198. agy keeps a plain-JSONL transcript per conversation at

package/dist/server/src/lib/hooks/sources/claude/source.js

@@ -133,6 +133,9 @@ exports.claudeAgentEventSource = (0, define_source_1.definePushHookSource)({
         // A hook response body releases nothing observable. The dialog is released
         // by the screen, by `Stop`, or by expiry.
         permissionReplyReleasesPrompt: false,
+        // Issue #3820: an allowed `PermissionRequest` draws no dialog — the reply is
+        // the only record, so the audit row is written (#1724).
+        permissionAllowSuppressesDialog: true,
         // `tool_use_id` is present on tool events but absent on `PermissionRequest`
         // (D2), so there is no id that covers the frames dedup has to cover. The
         // time window stays.

package/dist/server/src/lib/hooks/sources/codex/source.js

@@ -108,6 +108,8 @@ exports.codexAgentEventSource = (0, define_source_1.definePushHookSource)({
         // current behaviour, which is what the state machine does today.
         sessionStartMayArriveLate: false,
         permissionReplyReleasesPrompt: false,
+        // Issue #3820: an allowed `PermissionRequest` draws no dialog.
+        permissionAllowSuppressesDialog: true,
         eventIdentity: null,
         resync: 'none',
         // Issue #2197. codex appends every record of a session to

package/dist/server/src/lib/hooks/sources/command-code/source.js

@@ -230,6 +230,8 @@ exports.commandCodeAgentEventSource = (0, define_source_1.definePushHookSource)(
         sessionStartMayArriveLate: false,
         // A hook response body releases nothing observable, as on every push source.
         permissionReplyReleasesPrompt: false,
+        // Issue #3820: the hook arrives after the dialog was answered (see above).
+        permissionAllowSuppressesDialog: false,
         // `tool_use_id` is present on both tool events (`call_00_…`) and absent from
         // `SessionStart` and `Stop`, so there is no id covering the frames dedup has
         // to cover. The time window stays. Extraction is declared below regardless,

package/dist/server/src/lib/hooks/sources/copilot/source.js

@@ -215,6 +215,8 @@ exports.copilotAgentEventSource = (0, define_source_1.definePushHookSource)({
         // module comment above.
         sessionStartMayArriveLate: true,
         permissionReplyReleasesPrompt: false,
+        // Issue #3820: an allowed `PreToolUse` runs the call without a dialog.
+        permissionAllowSuppressesDialog: true,
         // Not audited. No captured copilot payload carries a `tool_use_id`, so
         // `'tool-call-id'` would be a guess; whether one exists is still to be
         // measured. Default = Claude's fallback, the time window.

package/dist/server/src/lib/hooks/sources/gemini/source.js

@@ -130,6 +130,8 @@ exports.geminiAgentEventSource = (0, define_source_1.definePushHookSource)({
         // Not audited. Default = Claude's current behaviour.
         sessionStartMayArriveLate: false,
         permissionReplyReleasesPrompt: false,
+        // Issue #3820: not measured, and no permission hook is registered.
+        permissionAllowSuppressesDialog: false,
         eventIdentity: null,
         resync: 'none',
         // Issue #2197. Nobody but the screen scraper records gemini replies.

package/dist/server/src/lib/hooks/sources/legacy-relay.js

@@ -65,6 +65,8 @@ function createLegacyRelaySource(cliToolId) {
             permissionHookPredictsDialog: false,
             sessionStartMayArriveLate: false,
             permissionReplyReleasesPrompt: false,
+            // Issue #3820: an unmeasured tool's allow is not assumed to answer a dialog.
+            permissionAllowSuppressesDialog: false,
             eventIdentity: null,
             resync: 'none',
             // Issue #2197. A tool on the compatibility relay has no reader, which

package/dist/server/src/lib/hooks/sources/opencode/ingest.js

@@ -81,6 +81,7 @@ const logger_1 = require("../../../../lib/logger");
 const agent_event_types_1 = require("../../../../lib/hooks/agent-event-types");
 const permission_adjudication_1 = require("../../../../lib/hooks/permission-adjudication");
 const pending_decision_kind_1 = require("../../../../lib/hooks/pending-decision-kind");
+const auto_yes_confirmation_ledger_1 = require("../../../../lib/polling/auto-yes-confirmation-ledger");
 const agent_event_state_1 = require("../../../../lib/session/agent-event-state");
 const structured_prompt_1 = require("../../../../lib/session/structured-prompt");
 const event_mapper_1 = require("../event-mapper");
@@ -362,6 +363,11 @@ async function ingestOpencodeEvent(target, event) {
             record.decisionId = (0, mappers_1.repliedPermissionId)(event.raw);
             record.promptSettled = replyReleasesPrompt(target, instanceId);
             (0, agent_event_state_1.recordAgentEvent)(target.worktreeId, tool_id_1.OPENCODE_CLI_TOOL_ID, instanceId, record, options);
+            // Issue #3820: the approval's confirmation in the Auto-Yes ledger ends
+            // here when Auto-Yes did not settle it — who answered is not known.
+            if (record.decisionId) {
+                (0, auto_yes_confirmation_ledger_1.noteLedgerApiDecisionReplied)({ worktreeId: target.worktreeId, cliToolId: tool_id_1.OPENCODE_CLI_TOOL_ID, instanceId }, record.decisionId);
+            }
             logger.info('opencode-permission-reply-observed', {
                 worktreeId: target.worktreeId,
                 instanceId,

package/dist/server/src/lib/hooks/sources/opencode/source.js

@@ -316,6 +316,8 @@ exports.opencodeAgentEventSource = (0, define_source_1.definePullEventSource)({
         // `permission.replied` arrives on the same stream and is a positive
         // statement that the dialog is gone (#1898). The only source that can say so.
         permissionReplyReleasesPrompt: true,
+        // Issue #3820: an allow is the approval itself, over the agent's API.
+        permissionAllowSuppressesDialog: true,
         // `per_...` — the id in the reply URL, which is the same id the frame
         // carries (#1899). Real identity, so this source does not need the time
         // window that loses the `stop` of a short turn.

package/dist/server/src/lib/hooks/sources/opencode-v2/ingest.js

@@ -64,6 +64,7 @@ const logger_1 = require("../../../../lib/logger");
 const agent_event_types_1 = require("../../../../lib/hooks/agent-event-types");
 const permission_adjudication_1 = require("../../../../lib/hooks/permission-adjudication");
 const pending_decision_kind_1 = require("../../../../lib/hooks/pending-decision-kind");
+const auto_yes_confirmation_ledger_1 = require("../../../../lib/polling/auto-yes-confirmation-ledger");
 const agent_event_state_1 = require("../../../../lib/session/agent-event-state");
 const structured_prompt_1 = require("../../../../lib/session/structured-prompt");
 const event_mapper_1 = require("../event-mapper");
@@ -207,6 +208,11 @@ async function ingestOpencodeV2Event(target, event, stopEffect = applyStop, load
             record.decisionId = (0, mappers_1.frameDecisionId)(event.raw);
             record.promptSettled = true;
             (0, agent_event_state_1.recordAgentEvent)(target.worktreeId, tool_id_1.OPENCODE_V2_CLI_TOOL_ID, instanceId, record, options);
+            // Issue #3820: as v1's `permission.replied` — the ledger's confirmation
+            // of this approval ends, by whoever answered it.
+            if (record.decisionId) {
+                (0, auto_yes_confirmation_ledger_1.noteLedgerApiDecisionReplied)({ worktreeId: target.worktreeId, cliToolId: tool_id_1.OPENCODE_V2_CLI_TOOL_ID, instanceId }, record.decisionId);
+            }
         }
         else if (event.event === 'notification' && event.detail === mappers_1.OPENCODE_V2_QUESTION_DETAIL) {
             const spec = await readQuestion(target, event, loadForm);

package/dist/server/src/lib/hooks/sources/opencode-v2/source.js

@@ -254,6 +254,8 @@ exports.opencodeV2AgentEventSource = (0, define_source_1.definePullEventSource)(
         permissionHookPredictsDialog: false,
         sessionStartMayArriveLate: false,
         permissionReplyReleasesPrompt: true,
+        // Issue #3820: an allow is the approval itself, over the agent's API.
+        permissionAllowSuppressesDialog: true,
         // Issue #2945: `per_…` / `frm_…`, the id the reply URL takes and the one
         // `permission.replied` / `form.replied` settle. Moves together with
         // `extractEventIdentity` below.

package/dist/server/src/lib/hooks/sources/pending-decisions.js

@@ -124,12 +124,24 @@ function resetPendingDecisions() {
  * function exists, cannot find out without going out of its way — whether the
  * verdict left through the response body or through a second HTTP call.
  *
+ * @param options.onReceipt - Issue #3820: handed the receipt — what
+ *   {@link answerPendingDecisionWithReceipt} returns beside the body — before
+ *   the body is returned. For a caller that records the delivery (the hook
+ *   route's ledger) and writes the body whatever it says; the body is the same
+ *   with or without it.
  * @returns The body to write. `{}` means "nothing to say here", which for a
  *   hook is the measured no-decision reply and for a pull source is simply the
  *   ack of a request whose answer went elsewhere.
  */
-async function answerPendingDecision(source, ref, decision, verdict) {
-    return (await answerPendingDecisionWithReceipt(source, ref, decision, verdict)).body;
+async function answerPendingDecision(source, ref, decision, verdict, options = {}) {
+    const { body, delivery } = await answerPendingDecisionWithReceipt(source, ref, decision, verdict);
+    try {
+        options.onReceipt?.(delivery);
+    }
+    catch {
+        // The receipt is the caller's record, never a reason to lose the body.
+    }
+    return body;
 }
 /**
  * Answer one decision and keep the receipt (Issue #1898).