commandmate 0.47.0 → 0.48.0

package/dist/server/src/lib/polling/auto-yes-decision-state.js

@@ -0,0 +1,195 @@
+"use strict";
+/**
+ * Auto-Yes's decision about the confirmation on screen (Issue #3821).
+ *
+ * Written by the poller's tick (`detectAndRespondToPrompt`), which is where the
+ * decision is actually made, and read by `buildCurrentOutput`, which publishes
+ * it as `autoYesDecision` next to the prompt. The answer surfaces show their
+ * panel under Auto-Yes for every decision but `answering`.
+ *
+ * ## What a record is tied to
+ *
+ * A record is published only while everything it was made under still holds:
+ *
+ * - the GRANT — the same `AutoYesState` object (`getAutoYesState` stores a new
+ *   one on every enable and on expiry, as the tick's own generation check
+ *   reads it, #3706), so turning Auto-Yes off and on again or letting it expire
+ *   drops the old decision even with the same screen up;
+ * - the SESSION epoch (`getEnterFallbackSessionEpoch`): a relaunch drops it;
+ * - the CONFIRMATION ({@link matchesConfirmation}): the question and the
+ *   options ({@link enterFallbackScreenKey}), AND what is being approved — the
+ *   whole `approvalTarget` as read, with only the cursor on its option rows
+ *   taken out ({@link approvalTargetRows}, the body's indent, `>` and blank
+ *   rows kept, as #3817 reads it) — AND, for agy, the hook call the receipt
+ *   was accepted for. Two approvals that differ only in their target (agy's
+ *   file creation names the file only there, two commands that differ by an
+ *   indent) are two confirmations. Two readings of one screen that differ in
+ *   how many rows they kept (one cut from the top) are not matched either:
+ *   the rows a cut leaves need not name what is approved (a diff row, not the
+ *   file), and the hook call known now may be an earlier one's (review 3), so
+ *   they read `none` — the panel opens, nothing is sent. The published
+ *   `confirmation` ({@link autoYesConfirmationKey}) is this same identity: a
+ *   record matches exactly when the keys are equal;
+ * - a TICK not long ago ({@link AUTO_YES_DECISION_STALE_MS}): a live poller
+ *   re-decides every tick, so a record nobody refreshed says nothing now.
+ *
+ * Anything else — no record, another confirmation, an old grant — is `none`,
+ * never `answering`. A human's answer through `/prompt-response` drops the
+ * record (`./auto-yes-manual-answer`).
+ *
+ * Two confirmations identical in every part above, in a row, with no frame
+ * without a prompt between them, read as one here: nothing on the screen tells
+ * them apart. The tick re-decides on its next pass either way.
+ *
+ * Not the confirmation ledger (#3820): the ledger measures, never decides, and
+ * a failure in it changes nothing. This record is what the tick decided.
+ *
+ * In-memory and on `globalThis` for the reason `auto-yes-suppression-state`
+ * gives: the poller writes it and the `current-output` route reads it, and
+ * under `next dev` the two are bundled apart.
+ *
+ * @module lib/polling/auto-yes-decision-state
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTO_YES_DECISION_STALE_MS = void 0;
+exports.approvalTargetRows = approvalTargetRows;
+exports.autoYesConfirmationKey = autoYesConfirmationKey;
+exports.matchesConfirmation = matchesConfirmation;
+exports.recordAutoYesDecision = recordAutoYesDecision;
+exports.reaffirmAutoYesAnswering = reaffirmAutoYesAnswering;
+exports.getAutoYesDecisionRecord = getAutoYesDecisionRecord;
+exports.forgetAutoYesDecision = forgetAutoYesDecision;
+exports.forgetAutoYesDecisionsByWorktree = forgetAutoYesDecisionsByWorktree;
+exports.clearAutoYesDecisions = clearAutoYesDecisions;
+exports.publishAutoYesDecision = publishAutoYesDecision;
+const auto_yes_state_1 = require("../../lib/auto-yes-state");
+const auto_yes_decision_1 = require("../../types/auto-yes-decision");
+const global_state_1 = require("../global-state");
+const auto_yes_enter_fallback_state_1 = require("./auto-yes-enter-fallback-state");
+const auto_yes_poller_state_1 = require("./auto-yes-poller-state");
+const crypto_1 = require("crypto");
+/**
+ * How long a record stays current without a tick refreshing it. The poller
+ * ticks every couple of seconds and refreshes the record on each tick that
+ * sees the screen; one past this is from a poller that is not ticking.
+ */
+exports.AUTO_YES_DECISION_STALE_MS = 30_000;
+const decisions = (0, global_state_1.getOrInitGlobal)('__autoYesDecisions', () => new Map());
+/**
+ * The rows of `approvalTarget` with only the cursor taken out of its option
+ * rows (`approvalTargetWithoutCursor`), or null when the prompt has none. The
+ * body stays as read: an indent, a `>` or a blank row is part of what is
+ * approved (#3817).
+ */
+function approvalTargetRows(promptData) {
+    const target = (0, auto_yes_poller_state_1.approvalTargetWithoutCursor)(promptData);
+    return target === null ? null : target.split('\n');
+}
+/**
+ * Which confirmation a reading is of: question and options
+ * ({@link enterFallbackScreenKey}), the approval target row for row
+ * ({@link approvalTargetRows}) and the agy call, hashed. The one identity both
+ * the record ({@link matchesConfirmation}) and the wire (`confirmation`, read
+ * by `laterAutoYesDecision`) use: same key, same confirmation; another key,
+ * another confirmation — or the same one read with other rows, which is not
+ * claimed to be the same.
+ */
+function autoYesConfirmationKey(identity) {
+    return (0, crypto_1.createHash)('sha256')
+        .update(JSON.stringify([
+        (0, auto_yes_enter_fallback_state_1.enterFallbackScreenKey)(identity.promptData),
+        approvalTargetRows(identity.promptData),
+        identity.callId ?? null,
+    ]))
+        .digest('hex')
+        .slice(0, 32);
+}
+/** Is `record` about the confirmation `identity` describes? The same {@link autoYesConfirmationKey}. */
+function matchesConfirmation(record, identity) {
+    return record.confirmation === autoYesConfirmationKey(identity);
+}
+/** Record what the tick decided for the prompt on screen. */
+function recordAutoYesDecision(compositeKey, decision, at = Date.now()) {
+    decisions.set(compositeKey, {
+        state: decision.state,
+        reason: decision.state === 'withheld' ? decision.reason : null,
+        confirmation: autoYesConfirmationKey(decision),
+        grant: decision.grant,
+        epoch: decision.epoch,
+        at,
+    });
+}
+/**
+ * Issue #3821 (review 2): the duplicate guard (#306) says "answered less than
+ * `DUPLICATE_RETRY_EXPIRY_MS` ago", comparing only the type and the question.
+ * That is not evidence the confirmation on screen is the one answered, so the
+ * `answering` record is only kept — its time moved on — when it is the one
+ * this tick's send made: about this very confirmation, under the same grant
+ * and session. Otherwise the record is dropped (`none`).
+ *
+ * @returns Whether `answering` still stands
+ */
+function reaffirmAutoYesAnswering(compositeKey, tick, at = Date.now()) {
+    const record = decisions.get(compositeKey);
+    if (record === undefined ||
+        record.state !== 'answering' ||
+        record.grant !== tick.grant ||
+        record.epoch !== tick.epoch ||
+        !matchesConfirmation(record, tick)) {
+        decisions.delete(compositeKey);
+        return false;
+    }
+    decisions.set(compositeKey, { ...record, at });
+    return true;
+}
+/** The record as kept, or null. Test seam and diagnostics. */
+function getAutoYesDecisionRecord(compositeKey) {
+    return decisions.get(compositeKey) ?? null;
+}
+/** Drop one instance's record: no prompt on screen, a human answered, the poller stopped. */
+function forgetAutoYesDecision(compositeKey) {
+    decisions.delete(compositeKey);
+}
+/** {@link forgetAutoYesDecision} for every instance of a worktree. */
+function forgetAutoYesDecisionsByWorktree(worktreeId) {
+    for (const key of (0, auto_yes_state_1.filterCompositeKeysByWorktree)([...decisions.keys()], worktreeId)) {
+        decisions.delete(key);
+    }
+}
+/** Drop every record: server shutdown, and a test seam. */
+function clearAutoYesDecisions() {
+    decisions.clear();
+}
+/**
+ * The decision published for the payload's prompt.
+ *
+ * - no screen prompt, or Auto-Yes off: `none`;
+ * - Auto-Yes on with no poller for the instance: `withheld`
+ *   (`server-poller-inactive`) — nothing answers the screen, whatever an
+ *   earlier record said;
+ * - a record made under this grant and session, about this confirmation
+ *   ({@link matchesConfirmation}), refreshed recently: that record;
+ * - otherwise `none`.
+ *
+ * Each names the payload's prompt in `confirmation` ({@link autoYesConfirmationKey}; null with no prompt).
+ */
+function publishAutoYesDecision(input) {
+    const now = input.now ?? Date.now();
+    const { compositeKey, grant, promptData } = input;
+    const confirmation = promptData == null ? null : autoYesConfirmationKey({ promptData, callId: input.callId });
+    const none = { state: 'none', reason: null, observedAt: now, confirmation };
+    if (promptData == null || !grant?.enabled)
+        return none;
+    if (!input.pollerActive) {
+        return { state: 'withheld', reason: auto_yes_decision_1.SERVER_POLLER_INACTIVE_DECISION_REASON, observedAt: now, confirmation };
+    }
+    const record = decisions.get(compositeKey);
+    if (record === undefined ||
+        record.grant !== grant ||
+        record.epoch !== (0, auto_yes_enter_fallback_state_1.getEnterFallbackSessionEpoch)(compositeKey) ||
+        record.confirmation !== confirmation ||
+        now - record.at > exports.AUTO_YES_DECISION_STALE_MS) {
+        return none;
+    }
+    return { state: record.state, reason: record.reason, observedAt: now, confirmation };
+}

package/dist/server/src/lib/polling/auto-yes-dialog-gate.js

@@ -37,12 +37,17 @@
  *
  * A `yes_no` prompt is a different inference — `detectPrompt` requires an
  * explicit `(y/n)`-shaped token in the text rather than deriving it from layout
- * — and NO tool in the registry has a measured yes/no dialog rule to gate it
- * against. Gating an inference for which no positive rule exists is the failure
- * mode the rollout guidance is written to prevent: every such prompt would
- * become a suppression, and the operator would see a worker that had silently
- * gone quiet. When a tool's yes/no dialog is measured and fixtured, widen this
- * the same way a tool is added to the table.
+ * — and NO tool in the registry has a measured yes/no dialog rule. Until Issue
+ * #3822 that was the reason to leave it ungated. It is now the reason to refuse
+ * it on an `enforce` tool, in {@link evaluateAutoYesDialogGate} only: none of
+ * those tools draws a `(y/n)` dialog, so a `(y/n)` on their pane is text — a
+ * reply quoting one, a shell command's prompt — and typing `y` at it answers
+ * nothing the tool asked (the user's decision of 2026-10-20: a generic yes/no
+ * without the tool's own evidence is left to a human). The tool can still vouch
+ * for the frame through `detectDialog`, exactly as for a numbered list. The
+ * `legacy` tools are unchanged (#3823), and so is
+ * {@link evaluateDialogPresence}: a `(y/n)` row a human may answer still
+ * belongs in History.
  *
  * ## What "allowed" does NOT mean
  *
@@ -54,9 +59,12 @@
  * @module lib/polling/auto-yes-dialog-gate
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.COMMAND_CODE_UNSUPPORTED_QUESTION_MESSAGE = exports.UNSUPPORTED_DIALOG_LAYOUT_REASON = exports.PROMPT_NO_LONGER_ACTIVE_REASON = exports.AUTO_YES_DIALOG_GATE_ENV_VAR = exports.AUTO_YES_DIALOG_GATE_DEFAULT_MODE = exports.AUTO_YES_DIALOG_GATE_MODES = void 0;
+exports.COMMAND_CODE_UNSUPPORTED_QUESTION_MESSAGE = exports.UNSUPPORTED_DIALOG_LAYOUT_REASON = exports.PROMPT_NO_LONGER_ACTIVE_REASON = exports.QUESTION_EVIDENCE_UNREAD_TOOLS = exports.AUTO_YES_QUESTION_DIALOG_KINDS = exports.AUTO_YES_DIALOG_GATE_ENV_VAR = exports.AUTO_YES_DIALOG_GATE_DEFAULT_MODE = exports.AUTO_YES_DIALOG_GATE_MODES = void 0;
 exports.resolveAutoYesDialogGateMode = resolveAutoYesDialogGateMode;
 exports.evaluateAutoYesDialogGate = evaluateAutoYesDialogGate;
+exports.classifyAutoYesQuestion = classifyAutoYesQuestion;
+exports.autoYesQuestionTreatment = autoYesQuestionTreatment;
+exports.isAutoYesQuestionPrompt = isAutoYesQuestionPrompt;
 exports.evaluateDialogPresence = evaluateDialogPresence;
 exports.judgePromptResponse = judgePromptResponse;
 exports.assessPromptAnswerability = assessPromptAnswerability;
@@ -67,6 +75,7 @@ const prompt_detector_1 = require("../../lib/detection/prompt-detector");
 const cli_patterns_1 = require("../../lib/detection/cli-patterns");
 const dialog_1 = require("../../lib/detection/tools/antigravity/dialog");
 const dialog_2 = require("../../lib/detection/tools/command-code/dialog");
+const auto_yes_option_effect_1 = require("./auto-yes-option-effect");
 /** Every accepted value of {@link AutoYesDialogGateMode}, for parsing and tests. */
 exports.AUTO_YES_DIALOG_GATE_MODES = ['enforce', 'legacy'];
 /**
@@ -193,7 +202,10 @@ function resolveAutoYesDialogGateMode(tool, env = process.env) {
     }
     return specific ?? wildcard ?? exports.AUTO_YES_DIALOG_GATE_DEFAULT_MODE[tool] ?? 'legacy';
 }
-/** The only prompt family this gate judges. See the module docstring. */
+/**
+ * The only prompt family the presence gate judges. Auto-Yes's gate also judges
+ * `yes_no` (Issue #3822); see the module docstring.
+ */
 const GATED_PROMPT_TYPE = 'multiple_choice';
 /**
  * May Auto-Yes answer the prompt the generic inference found on this frame?
@@ -216,7 +228,10 @@ function evaluateAutoYesDialogGate(cliToolId, promptType, cleanOutput, env = pro
     // `judgeDialogPresence` holds that rule; Issue #2457 split it out so the
     // history-save and `/prompt-response` paths judge a frame the same way this
     // one does instead of re-deriving the rollout table.
-    const presence = judgeDialogPresence(cliToolId, promptType, cleanOutput, resolveAutoYesDialogGateMode(cliToolId, env));
+    const mode = resolveAutoYesDialogGateMode(cliToolId, env);
+    const presence = promptType === 'yes_no'
+        ? judgeYesNoPresence(cliToolId, cleanOutput, mode)
+        : judgeDialogPresence(cliToolId, promptType, cleanOutput, mode);
     return {
         // `keys` is a dialog and still not answerable: opencode's button strip takes
         // ←/→ + Enter, so the digit is swallowed and the Enter confirms whatever is
@@ -245,6 +260,119 @@ function judgeDialogPresence(cliToolId, promptType, frame, mode) {
     const dialog = detector.detectDialog(typeof frame === 'string' ? (0, frame_1.normalizeFrame)(frame, cliToolId) : frame);
     return { present: dialog !== null, dialog, mode, gated: true };
 }
+/**
+ * Issue #3822: the Auto-Yes gate's reading of a `yes_no` candidate. Judged on
+ * the same terms as a numbered one — the rollout table and the `hasDialogRules`
+ * cross-check — so a `legacy` tool, or one with no rules, stays ungated. An
+ * `enforce` tool answers only where its own `detectDialog` vouched for the
+ * frame; none of their rules reads a `(y/n)` row, so in practice it is refused.
+ */
+function judgeYesNoPresence(cliToolId, frame, mode) {
+    const detector = (0, registry_1.getToolStatusDetector)(cliToolId);
+    if (!detector.hasDialogRules || mode === 'legacy') {
+        return { present: true, dialog: null, mode, gated: false };
+    }
+    const dialog = detector.detectDialog(typeof frame === 'string' ? (0, frame_1.normalizeFrame)(frame, cliToolId) : frame);
+    return { present: dialog !== null, dialog, mode, gated: true };
+}
+/**
+ * The dialog kinds that are a question to the operator, not a permission
+ * (Issue #3822): OpenCode V2's question form, read off its own key hints.
+ *
+ * Not Claude's `ask_user`: Claude classifies by the context rows above the
+ * options, which on a permission dialog are the command being approved — a
+ * `grep "Ready to submit your answers?"` approval reads `ask_user` (#3748's
+ * controls), and it is a permission.
+ */
+exports.AUTO_YES_QUESTION_DIALOG_KINDS = new Set(['question']);
+/**
+ * What kind of question to the operator a prompt is, if it is one (Issue
+ * #3863):
+ *
+ * - `'question-form'` — a question form the tool's own dialog rules read
+ *   ({@link AUTO_YES_QUESTION_DIALOG_KINDS}: OpenCode V2's). Left to a human
+ *   under every answer mode, as before; only on a gated frame, where those
+ *   rules ran;
+ * - `'picker'` — a picker a question reader read: Claude's AskUserQuestion
+ *   (the parser's own footer, `Enter to select · … navigate`) or Command
+ *   Code's question screen (its reader). Both set `isAskUserQuestion`, off the
+ *   picker's chrome rather than its text. Answered under the `recommended`
+ *   answer mode, left to a human under `careful`;
+ * - null — not a question (a permission, a yes/no, a list).
+ *
+ * The picker is judged WITHOUT the dialog gate (#3863): the gate's mode
+ * (`enforce` / `legacy`, and the `CM_AUTOYES_DIALOG_GATE` kill switch) says
+ * whether a frame's numbered list may be answered at all, not whether it is a
+ * question, so `legacy` does not turn a question into something Auto-Yes
+ * answers under `careful`. Claude's dialog kind `ask_user` is not evidence:
+ * Claude classifies by the context rows above the options, which on a
+ * permission dialog are the command being approved (#3748).
+ *
+ * - `'unidentified'` (Issue #3881, the second half: finding 3) — given the
+ *   tool, a numbered list on copilot or codex
+ *   ({@link QUESTION_EVIDENCE_UNREAD_TOOLS}) that is neither of the above and
+ *   whose rows do not read as a permission dialog
+ *   (`auto-yes-option-effect`, the wording measured on their live captures).
+ *   Copilot's question (`ask_user`) and codex's `request_user_input` draw the
+ *   same picker as their menus: copilot calls anything without `do you want
+ *   to` a `picker`, codex anything with a `?` above it a `permission`, and
+ *   neither sets `isAskUserQuestion`. So such a list is not known to be a
+ *   question, nor known not to be one. Left to a human under `careful`;
+ *   under `recommended` it is answered exactly as before (not as a question).
+ *
+ * @param promptData - The prompt the tick read
+ * @param gate - {@link evaluateAutoYesDialogGate}'s verdict for the same frame, if it ran
+ * @param cliToolId - The tool that drew it; omitted, no list is `'unidentified'`
+ *   (the reading before #3881's second half)
+ */
+function classifyAutoYesQuestion(promptData, gate, cliToolId) {
+    if (gate?.gated === true && gate.dialog !== null && exports.AUTO_YES_QUESTION_DIALOG_KINDS.has(gate.dialog.kind)) {
+        return 'question-form';
+    }
+    if (promptData.type !== 'multiple_choice')
+        return null;
+    if (promptData.isAskUserQuestion === true)
+        return 'picker';
+    if (cliToolId !== undefined && exports.QUESTION_EVIDENCE_UNREAD_TOOLS.has(cliToolId)
+        && (0, auto_yes_option_effect_1.selectAllowOnceOption)(promptData.options, cliToolId).kind === 'not-a-permission-dialog') {
+        return 'unidentified';
+    }
+    return null;
+}
+/** See {@link AutoYesQuestionTreatment}. */
+function autoYesQuestionTreatment(kind, answerMode) {
+    if (kind === null)
+        return 'base-rules';
+    if (kind === 'question-form')
+        return 'left-to-human';
+    if (answerMode === 'careful')
+        return 'left-to-human';
+    return kind === 'picker' ? 'recommended-choice' : 'base-rules';
+}
+/**
+ * The tools whose question screens nothing on the screen tells from their
+ * other pickers (Issue #3881, finding 3): copilot's `ask_user`, codex's
+ * `request_user_input`. Neither module reads a question's chrome; their dialog
+ * kinds are guesses from the words above the options
+ * (`tools/copilot/prompt.ts`, `tools/codex/prompt.ts`).
+ */
+exports.QUESTION_EVIDENCE_UNREAD_TOOLS = new Set(['copilot', 'codex']);
+/**
+ * Is the prompt a question to the operator rather than a permission, on a
+ * GATED frame? (Issue #3822.)
+ *
+ * The reading #3822 first shipped: a question only where the tool's own rules
+ * ran. Since Issue #3863 the poller reads {@link classifyAutoYesQuestion},
+ * which judges the picker without the gate (so the kill switch and the
+ * `legacy` tools do not change how a question is treated); this stays the
+ * gated half of that reading.
+ *
+ * @param promptData - The prompt the tick read
+ * @param gate - {@link evaluateAutoYesDialogGate}'s verdict for the same frame
+ */
+function isAutoYesQuestionPrompt(promptData, gate) {
+    return gate.gated && classifyAutoYesQuestion(promptData, gate) !== null;
+}
 /**
  * Does this frame POSITIVELY carry a dialog for the numbered-list candidate the
  * generic parser found on it? (Issue #2457)
@@ -395,8 +523,9 @@ function assessPromptAnswerability(cliToolId, frame) {
     // Issue #3808: a numbered agy screen agy's reader declines (the login-method
     // screen, a permission dialog whose `tab Amend` footer is cut or off the
     // pane) is no prompt — not the generic parser's reading of its `1. / 2.` rows.
+    // #3818: by default, so a run with a number missing is declined too.
     const declinedAgyScreen = cliToolId === 'antigravity' && toolDialog === null
-        && (0, dialog_1.isAntigravityUnvouchedNumberedScreen)(cleanOutput);
+        && (0, dialog_1.isAntigravityUnansweredNumberedScreen)(cleanOutput);
     const isCommandCodeQuestion = commandCodeQuestion.kind === 'prompt';
     const candidate = (commandCodeQuestion.kind === 'prompt' ? commandCodeQuestion.prompt : null)
         ?? toolDialog

package/dist/server/src/lib/polling/auto-yes-enter-fallback.js

@@ -2,6 +2,20 @@
 /**
  * Auto-Yes's Enter on a choice screen CommandMate cannot read (Issue #3397).
  *
+ * ## Retired (Issue #3821)
+ *
+ * Nothing sends this Enter any more. The poller leaves every frame the dialog
+ * gate refuses to a human (`unclassified-frame`), whatever
+ * {@link judgeEnterFallback} would say and whatever
+ * {@link AUTO_YES_ENTER_FALLBACK_ENV_VAR} is set to: a bare Enter confirms
+ * whatever happens to be selected, and on a screen nothing here can read,
+ * nothing here can say what that is. {@link judgeEnterFallback} stays as a
+ * reading of the frame only; no sending path calls it. The session epoch the
+ * record was keyed on (`./auto-yes-enter-fallback-state`) is still what every
+ * send's generation check and the partial-answer record belong to.
+ *
+ * What follows is how the Enter was decided while it existed.
+ *
  * ## The screen
  *
  * `assessPromptAnswerability` refuses some frames that are plainly a choice

package/dist/server/src/lib/polling/auto-yes-ledger-records.js

@@ -0,0 +1,143 @@
+"use strict";
+/**
+ * The Auto-Yes confirmation ledger's records (Issue #3848, split out of
+ * `auto-yes-confirmation-ledger.ts`): its constants, the shapes of its state,
+ * the writing of one line, and the small helpers over the state. The state
+ * itself — `ledgerState()`, the clock, the test seams — stays owned by
+ * `auto-yes-confirmation-ledger.ts`, which re-exports the public names here.
+ *
+ * Server only (logger). Must not import `auto-yes-confirmation-ledger.ts`.
+ *
+ * @module lib/polling/auto-yes-ledger-records
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SESSION_ENDING_STOP_REASONS = exports.ABANDONING_STOP_REASONS = exports.CLI_MODE_WORD = exports.MAX_REMEMBERED_CALLS = exports.MAX_REMEMBERED_INSTANCES = exports.MAX_OPEN_HOOK_REQUESTS = exports.MAX_PENDING_ATTEMPTS = exports.AUTO_YES_LEDGER_MAX_OPEN_TOTAL = exports.AUTO_YES_LEDGER_MAX_OPEN_PER_INSTANCE = exports.AUTO_YES_LEDGER_UNOBSERVABLE_TIMEOUT_MS = exports.AUTO_YES_LEDGER_CLOCK_MS = exports.AUTO_YES_LEDGER_HOOK_LINK_WINDOW_MS = exports.AUTO_YES_LEDGER_RECORDED_PATHS = void 0;
+exports.ledgerLogger = ledgerLogger;
+exports.currentLogLevel = currentLogLevel;
+exports.emit = emit;
+exports.callsOf = callsOf;
+exports.endedCallsOf = endedCallsOf;
+exports.callKey = callKey;
+exports.keyOf = keyOf;
+exports.currentEntry = currentEntry;
+exports.rememberBounded = rememberBounded;
+const logger_1 = require("../../lib/logger");
+const env_1 = require("../../lib/env");
+const auto_yes_state_1 = require("../auto-yes-state");
+const auto_yes_confirmation_ledger_types_1 = require("./auto-yes-confirmation-ledger-types");
+/**
+ * The paths this version records (design §6.4): PR 1 the poller's screen path,
+ * PR 2 the hook route, the API adjudication and `/prompt-response`, PR 3 the
+ * link of agy's request to its dialog (`agy-link`). With all five the daily
+ * count is no longer partial for want of a path.
+ */
+exports.AUTO_YES_LEDGER_RECORDED_PATHS = [
+    'screen',
+    'hook',
+    'api',
+    'prompt-response',
+    'agy-link',
+];
+/**
+ * A screen confirmation opened this soon after a hook request closed on the
+ * same instance carries `afterHookAllow` / `afterHookAbstain` (design §2.3).
+ * agy's receipt window is the same length.
+ */
+exports.AUTO_YES_LEDGER_HOOK_LINK_WINDOW_MS = 8_000;
+/** The grid of the `alive` and `checkpoint` lines: every UTC hour boundary. */
+exports.AUTO_YES_LEDGER_CLOCK_MS = 60 * 60 * 1000;
+/** An `unobservable` confirmation is let go after this long (design §4.2). */
+exports.AUTO_YES_LEDGER_UNOBSERVABLE_TIMEOUT_MS = 24 * 60 * 60 * 1000;
+/** Open confirmations one instance may hold; the oldest goes past it (design §8.2). */
+exports.AUTO_YES_LEDGER_MAX_OPEN_PER_INSTANCE = 16;
+/** Open confirmations the process may hold; the oldest goes past it (design §8.2). */
+exports.AUTO_YES_LEDGER_MAX_OPEN_TOTAL = 1024;
+/** Sends whose result has not come back that are remembered; the oldest is dropped past it. */
+exports.MAX_PENDING_ATTEMPTS = 1024;
+/** Hook requests whose reply has not been written that are remembered; the oldest is dropped past it. */
+exports.MAX_OPEN_HOOK_REQUESTS = 1024;
+/** Instances whose last hook request or CLI mode is remembered; the oldest is dropped past it. */
+exports.MAX_REMEMBERED_INSTANCES = 1024;
+/** agy calls whose `PostToolUse` has not come that are remembered; the oldest is dropped past it. */
+exports.MAX_REMEMBERED_CALLS = 1024;
+/** A CLI mode is a word of the CLI's own vocabulary; anything else is logged as `(other)`. */
+exports.CLI_MODE_WORD = /^[A-Za-z][A-Za-z-]{0,31}$/;
+/**
+ * Poller stop reasons that end the session the confirmation was on, or hand
+ * the key to something else (design §4.2). Every other reason — off, expired,
+ * the stop pattern, errors, a shutdown — only stops looking.
+ */
+exports.ABANDONING_STOP_REASONS = new Set([
+    'invalid-key',
+    'session-killed',
+    'instance-removed',
+    'worktree-deleted',
+    'orphan-swept',
+    'worktree-id-migrated',
+    'replaced',
+    'reset',
+]);
+/**
+ * The stop reasons among {@link ABANDONING_STOP_REASONS} that end the agent's
+ * session itself: the memory of a call its `PostToolUse` closed (PR 3) goes
+ * with them. Any other reason — Auto-Yes turned off by hand, expired, the stop
+ * pattern, a key handed over, one this list does not know — keeps it, so a
+ * stale frame of that call is not counted again when Auto-Yes comes back on;
+ * the session epoch still tells a relaunched session apart.
+ */
+exports.SESSION_ENDING_STOP_REASONS = new Set([
+    'session-killed',
+    'instance-removed',
+    'worktree-deleted',
+    'orphan-swept',
+]);
+let cachedLogger = null;
+function ledgerLogger() {
+    cachedLogger ??= (0, logger_1.createLogger)(auto_yes_confirmation_ledger_types_1.AUTO_YES_LEDGER_LOG_MODULE);
+    return cachedLogger;
+}
+function currentLogLevel() {
+    try {
+        return (0, env_1.getLogConfig)().level;
+    }
+    catch {
+        return 'unknown';
+    }
+}
+/** Write one line. A logger that throws is counted, never passed on. */
+function emit(state, event, fields) {
+    try {
+        ledgerLogger().info(event, { ledgerVersion: auto_yes_confirmation_ledger_types_1.AUTO_YES_LEDGER_VERSION, bootId: state.bootId, ...fields });
+    }
+    catch {
+        state.errors += 1;
+    }
+}
+function callsOf(state) {
+    state.calls ??= new Map();
+    return state.calls;
+}
+function endedCallsOf(state) {
+    state.endedCalls ??= new Map();
+    return state.endedCalls;
+}
+function callKey(compositeKey, callId) {
+    return `${compositeKey}\u0000${callId}`;
+}
+function keyOf(scope) {
+    return scope.compositeKey ?? (0, auto_yes_state_1.buildCompositeKey)(scope.worktreeId, scope.cliToolId, scope.instanceId);
+}
+function currentEntry(state, compositeKey) {
+    const id = state.current.get(compositeKey);
+    return id === undefined ? undefined : state.entries.get(id);
+}
+/** Set `key` in a map kept to `max` entries, dropping the oldest. */
+function rememberBounded(map, key, value, max) {
+    map.delete(key);
+    if (map.size >= max) {
+        const oldest = map.keys().next().value;
+        if (oldest !== undefined)
+            map.delete(oldest);
+    }
+    map.set(key, value);
+}