commandmate 0.47.0 → 0.48.0

package/dist/server/src/lib/polling/auto-yes-poller-state.js

@@ -6,14 +6,24 @@
  * `AutoYesPollerState`. Must not import auto-yes-poller.ts (cycle).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.partialAnswerScreenKey = exports.UNIDENTIFIED_SCREEN_KEY = void 0;
+exports.getAutoYesLastAnswer = getAutoYesLastAnswer;
 exports.promptFrameKey = promptFrameKey;
 exports.warnOncePerFrame = warnOncePerFrame;
-exports.partialAnswerScreenKey = partialAnswerScreenKey;
+exports.partialAnswerCovers = partialAnswerCovers;
+exports.ledgerScreenKey = ledgerScreenKey;
+exports.approvalTargetWithoutCursor = approvalTargetWithoutCursor;
 exports.getPartialAnswer = getPartialAnswer;
 exports.forgetPartialAnswer = forgetPartialAnswer;
+exports.personSendsInFlight = personSendsInFlight;
 exports.forgetPartialAnswersByWorktree = forgetPartialAnswersByWorktree;
+exports.releasePartialAnswerToHuman = releasePartialAnswerToHuman;
+exports.identifyPartialAnswerScreen = identifyPartialAnswerScreen;
+exports.keepPartialAnswerByPerson = keepPartialAnswerByPerson;
+exports.nextSendOrder = nextSendOrder;
 exports.clearPartialAnswers = clearPartialAnswers;
 exports.beginSendAttempt = beginSendAttempt;
+exports.beginManualSendAttempt = beginManualSendAttempt;
 exports.settleSendAttempt = settleSendAttempt;
 exports.hasMovedSendInFlight = hasMovedSendInFlight;
 exports.movePartialAnswers = movePartialAnswers;
@@ -22,7 +32,18 @@ const logger_1 = require("../../lib/logger");
 const auto_yes_state_1 = require("../auto-yes-state");
 const global_state_1 = require("../global-state");
 const auto_yes_enter_fallback_state_1 = require("./auto-yes-enter-fallback-state");
+const appearance_1 = require("../prompt-observation/appearance");
+const prompt_screen_key_1 = require("../detection/prompt-screen-key");
 const logger = (0, logger_1.createLogger)('auto-yes-poller');
+/**
+ * The Auto-Yes poller's last answer for one instance (Issue #3798), for the
+ * other observers of the same waiting episode (the response poller). Read off
+ * `globalThis` (`__autoYesPollerStates`) as the push gate reads the poller's
+ * answer time, so a reader need not import the poller.
+ */
+function getAutoYesLastAnswer(compositeKey) {
+    return globalThis.__autoYesPollerStates?.get(compositeKey)?.lastAnswer ?? null;
+}
 /**
  * Issue #2995: what makes two ticks "the same prompt" for `warnOncePerFrame`.
  *
@@ -63,29 +84,82 @@ function warnOncePerFrame(pollerState, frameKey, event, fields) {
     logger.warn(event, fields);
 }
 /**
- * Which prompt a stopped answer is about (Issue #3706): the type, the question,
- * the option labels and `approvalTarget` — what {@link promptFrameKey} tells
- * apart — but NOT where the cursor is. The keys that were sent may have moved
- * the cursor themselves (a `Down` whose Enter was withheld), and that must not
- * make the same list read as a new one; a different list or a different command
- * under the same question is a new prompt and is answered.
+ * The screen key of a person's send made with no prompt read off the screen
+ * (Issue #3880: the capture before it failed). A hold at it covers whatever
+ * confirmation the next tick reads, and takes that confirmation's key there
+ * ({@link identifyPartialAnswerScreen}); from then on it is released like any
+ * other — the screen changing, the session relaunched, a person's answer going
+ * through — and before then by a frame with no prompt on it.
  */
-function partialAnswerScreenKey(promptData) {
-    const options = promptData.type === 'multiple_choice'
-        ? promptData.options.map((o) => `${o.number}.${o.label}`).join('\n')
-        : promptData.options.join('\n');
-    return [(0, prompt_key_1.generatePromptKey)(promptData), options, withoutCursorMarks(promptData.approvalTarget ?? '')].join('\u0000');
+exports.UNIDENTIFIED_SCREEN_KEY = '\u0000unidentified-screen';
+/** Whether a hold (or a send) at `heldScreenKey` covers the confirmation at `screenKey`. */
+function partialAnswerCovers(heldScreenKey, screenKey) {
+    return heldScreenKey === screenKey || heldScreenKey === exports.UNIDENTIFIED_SCREEN_KEY;
 }
+/** Issue #3798: moved to `detection/prompt-screen-key`, where the waiting episodes read it too. */
+var prompt_screen_key_2 = require("../detection/prompt-screen-key");
+Object.defineProperty(exports, "partialAnswerScreenKey", { enumerable: true, get: function () { return prompt_screen_key_2.promptScreenKey; } });
 /**
- * `approvalTarget` with the cursor taken out: the generic parser copies the
- * option panel into it, `❯` row included, so a moved cursor would otherwise
- * read as another prompt. Leading indentation goes too — the cursor row is the
- * one indented differently.
+ * Which confirmation the ledger counts a prompt as (Issue #3820): the
+ * {@link partialAnswerScreenKey} reading where the option rows can be told,
+ * and otherwise one that still keeps the body. That key's fallback takes the
+ * marks and indent off every row — for a partial answer, two bodies reading as
+ * one screen holds the prompt for a human, the safe side — but for counting it
+ * makes two confirmations whose commands differ by a `>` or an indent one.
+ * Here only the rows that ARE the options the reader read — the row's number
+ * and label match one of `promptData.options` — lose their gutter (where the
+ * cursor sits); every other row, a numbered line of the body included, stays
+ * byte for byte. The match takes the separator as the readers do: `1.`, `1)`
+ * or a bare `1` followed by any run of spaces (`❯ 1  Yes`).
  */
-function withoutCursorMarks(text) {
+function ledgerScreenKey(promptData) {
+    if (promptData.type !== 'multiple_choice')
+        return (0, prompt_screen_key_1.promptScreenKey)(promptData);
+    const target = promptData.approvalTarget ?? '';
+    const aligned = (0, appearance_1.approvalTargetWithOptionRowsAligned)(target, promptData.options.map((o) => o.label), (read, named) => read.startsWith(named));
+    if (aligned !== null)
+        return (0, prompt_screen_key_1.promptScreenKey)(promptData);
+    const options = promptData.options.map((o) => `${o.number}.${o.label}`).join('\n');
+    return [(0, prompt_key_1.generatePromptKey)(promptData), options, withOptionRowGuttersAligned(target, promptData.options)].join('\u0000');
+}
+/**
+ * `approvalTarget` with only the cursor taken out of its option rows, or null
+ * when the prompt has none (Issue #3821, the identity of the confirmation an
+ * Auto-Yes decision is about). The reading {@link ledgerScreenKey} keeps: the
+ * rows the block reader adopted as the options are aligned
+ * (`approvalTargetWithOptionRowsAligned`), else only the rows that ARE the
+ * prompt's options lose their gutter; the body — its indent, a `>`, a blank
+ * row — stays byte for byte, so two commands that differ there are two
+ * confirmations (#3817), and a moved cursor is the same one.
+ */
+function approvalTargetWithoutCursor(promptData) {
+    const target = promptData.approvalTarget;
+    if (typeof target !== 'string')
+        return null;
+    if (promptData.type !== 'multiple_choice')
+        return target;
+    return ((0, appearance_1.approvalTargetWithOptionRowsAligned)(target, promptData.options.map((o) => o.label), (read, named) => read.startsWith(named)) ?? withOptionRowGuttersAligned(target, promptData.options));
+}
+/** A row's leading cursor marks and indentation. */
+const LEADING_MARKS_PATTERN = /^[\s\u276F\u203A>\u25B6\u25BA\u25CF\u25CB\u25C9\u2192]+/u;
+/** A row's option number and the text after its separator (`1.`, `1)` or `1`, then spaces). */
+const OPTION_ROW_PATTERN = /^(\d+)(?:[.)]\s*|\s+)(.*)$/u;
+const collapseSpaces = (text) => text.replace(/\s+/gu, ' ').trim();
+/** Rows that match one of `options` lose their leading marks and indent; the rest stay. */
+function withOptionRowGuttersAligned(text, options) {
     return text
         .split('\n')
-        .map((line) => line.replace(/^[\s\u276F\u203A>\u25B6\u25BA\u25CF\u25CB\u25C9\u2192]+/u, ''))
+        .map((line) => {
+        const row = OPTION_ROW_PATTERN.exec(line.replace(LEADING_MARKS_PATTERN, ''));
+        if (row === null)
+            return line;
+        const rest = collapseSpaces(row[2]);
+        const isOption = options.some((option) => {
+            const label = collapseSpaces(option.label);
+            return option.number === Number(row[1]) && label !== '' && rest.startsWith(label);
+        });
+        return isOption ? line.replace(LEADING_MARKS_PATTERN, '') : line;
+    })
         .join('\n');
 }
 /** compositeKey -> the answer stopped part-way. globalThis for hot reload (#153). */
@@ -104,6 +178,7 @@ function getPartialAnswer(compositeKey, epoch) {
     }
     return partial;
 }
+const NO_ATTEMPTS = new Set();
 /**
  * Forget it: the prompt left the screen, another prompt came up, or the session ended.
  *
@@ -115,6 +190,8 @@ function getPartialAnswer(compositeKey, epoch) {
  * and records as before. Expiring is the mark: it drops the attempt from the
  * registry, so no per-key "forgotten up to seq" state has to outlive it.
  *
+ * @param spare - Issue #3880: sends that are not expired (a person's, at agy's
+ *   dialog the ungated reading still shows)
  * @param screenKey - Given when the memory is dropped because ANOTHER prompt is
  *   on screen (re-instruction 3): only the sends at the forgotten memory's
  *   screen are expired. A send at the screen now shown (Y, carried here by a
@@ -122,16 +199,27 @@ function getPartialAnswer(compositeKey, epoch) {
  *   stop is still remembered when it comes back. Omitted (the prompt left the
  *   screen), every send under the key is expired.
  */
-function forgetPartialAnswer(compositeKey, screenKey) {
+function forgetPartialAnswer(compositeKey, screenKey, spare = NO_ATTEMPTS) {
     partialAnswers.delete(compositeKey);
     for (const attempt of [...sendAttempts]) {
         if (attempt.recordKey !== compositeKey)
             continue;
         if (screenKey !== undefined && attempt.screenKey !== screenKey)
             continue;
+        if (spare.has(attempt))
+            continue;
         expireSendAttempt(attempt);
     }
 }
+/**
+ * A person's sends still in flight under this key, to this session epoch
+ * (Issue #3880): agy's gated reading seeing no prompt does not say the screen
+ * they type at is gone, so the tick checks the ungated reading before it
+ * expires them ({@link forgetPartialAnswer}'s `spare`).
+ */
+function personSendsInFlight(compositeKey, epoch) {
+    return [...sendAttempts].filter((attempt) => attempt.byPerson === true && attempt.recordKey === compositeKey && attempt.recordEpoch === epoch);
+}
 /**
  * {@link forgetPartialAnswer} for every instance of a worktree, and the sends
  * still in flight there are expired (Issue #3713): a slow tick that comes back
@@ -149,6 +237,53 @@ function forgetPartialAnswersByWorktree(worktreeId) {
             expireSendAttempt(attempt);
     }
 }
+/**
+ * A person's answer went through, or was refused before any key (Issue #3880):
+ * the answer Auto-Yes held at that confirmation is theirs now, so the hold is
+ * dropped — only one recorded before the person's answer began (`before`, its
+ * {@link nextSendOrder}). A hold recorded since, by a send begun after theirs
+ * (another person's from another screen, a tick's), is about what that send
+ * did and stays. Only the record: a send still in flight records what it did
+ * when it comes back. Not called when a person's own send may have left keys
+ * on the pane, nor at the START of their answer.
+ */
+function releasePartialAnswerToHuman(compositeKey, before) {
+    const recorded = partialAnswers.get(compositeKey);
+    if (recorded !== undefined && recorded.seq < before)
+        partialAnswers.delete(compositeKey);
+}
+/**
+ * The hold's screen, now that a tick read the confirmation on screen (Issue
+ * #3880): a hold at {@link UNIDENTIFIED_SCREEN_KEY} takes `screenKey`.
+ */
+function identifyPartialAnswerScreen(compositeKey, screenKey) {
+    const recorded = partialAnswers.get(compositeKey);
+    if (recorded?.screenKey === exports.UNIDENTIFIED_SCREEN_KEY)
+        partialAnswers.set(compositeKey, { ...recorded, screenKey });
+}
+/**
+ * Put back a person's hold the tick dropped because its gated reading saw no
+ * prompt, while agy's dialog it is about is still up past the receipt window
+ * (Issue #3880). Only into the same session, and over nothing newer.
+ */
+function keepPartialAnswerByPerson(compositeKey, partial, screenKey) {
+    if ((0, auto_yes_enter_fallback_state_1.getEnterFallbackSessionEpoch)(compositeKey) !== partial.epoch)
+        return;
+    const recorded = partialAnswers.get(compositeKey);
+    if (recorded !== undefined && recorded.seq > partial.seq)
+        return;
+    partialAnswers.set(compositeKey, { ...partial, screenKey });
+}
+/**
+ * A place in the order sends are registered in (Issue #3880): a person's
+ * answer takes one as it begins, so the hold it releases when it ends is only
+ * one recorded by a send registered before it began. What its own send
+ * records is ordered by that send's registration instead
+ * ({@link beginManualSendAttempt}).
+ */
+function nextSendOrder() {
+    return ++sendAttemptSeq.last;
+}
 /** Forget every one, and expire every send in flight: server shutdown, and a test seam. */
 function clearPartialAnswers() {
     partialAnswers.clear();
@@ -158,8 +293,12 @@ function clearPartialAnswers() {
 /** The sends in flight. globalThis for hot reload (#153), like the Map above. */
 const sendAttempts = (0, global_state_1.getOrInitGlobal)('__autoYesSendAttempts', () => new Set());
 const sendAttemptSeq = (0, global_state_1.getOrInitGlobal)('__autoYesSendAttemptSeq', () => ({ last: 0 }));
-/** Register a send about to start (the poller, before `sendPromptAnswer`). */
-function beginSendAttempt(compositeKey, screenKey, epoch) {
+/**
+ * Register a send about to start (the poller, before `sendPromptAnswer`).
+ *
+ * @param ledger - Issue #3820: the ledger's handle for this send, if any
+ */
+function beginSendAttempt(compositeKey, screenKey, epoch, ledger = null) {
     const attempt = {
         seq: ++sendAttemptSeq.last,
         screenKey,
@@ -167,16 +306,43 @@ function beginSendAttempt(compositeKey, screenKey, epoch) {
         recordEpoch: epoch,
         moved: false,
         state: 'pending',
+        ledger,
+    };
+    sendAttempts.add(attempt);
+    return attempt;
+}
+/**
+ * Register a person's send about to start (Issue #3880): the screen it types
+ * at and the session epoch it goes to, fixed now, and its place among the
+ * sends taken now too, as Auto-Yes's own is — not when the answer began: an
+ * answer that waited before its first key (the re-verification of the screen)
+ * may send after one begun later, and then its keys are the newer ones.
+ * Settled with {@link settleSendAttempt} like Auto-Yes's own, so it records a
+ * hold only for the session the keys went to, never over a hold of a send
+ * registered after it, and not at all once the screen it typed at was seen gone.
+ */
+function beginManualSendAttempt(compositeKey, screenKey) {
+    const attempt = {
+        seq: ++sendAttemptSeq.last,
+        screenKey,
+        recordKey: compositeKey,
+        recordEpoch: (0, auto_yes_enter_fallback_state_1.getEnterFallbackSessionEpoch)(compositeKey),
+        moved: false,
+        state: 'pending',
+        byPerson: true,
+        ledger: null,
     };
     sendAttempts.add(attempt);
     return attempt;
 }
 /**
  * The send came back. `keysSent` — it was stopped with keys already on the
- * pane — records the partial answer under the attempt's key as it is now, when
- * that key's session is still the one the keys went to; otherwise (sent in
- * full, stopped before any key, or failed) only the attempt itself is removed.
- * A second call, or a call on an expired attempt, does nothing.
+ * pane, or (Issue #3880) a tmux call of it ended without an exit status and
+ * its keys may be there — records the partial answer under the attempt's key
+ * as it is now, when that key's session is still the one the keys went to;
+ * otherwise (sent in full, stopped before any key, or failed with nothing
+ * sent) only the attempt itself is removed. A second call, or a call on an
+ * expired attempt, does nothing.
  */
 function settleSendAttempt(attempt, keysSent, at = Date.now()) {
     if (attempt.state !== 'pending')
@@ -198,6 +364,7 @@ function settleSendAttempt(attempt, keysSent, at = Date.now()) {
         epoch: attempt.recordEpoch,
         at,
         seq: attempt.seq,
+        ...(attempt.byPerson ? { byPerson: true } : {}),
     });
 }
 function expireSendAttempt(attempt) {
@@ -217,7 +384,7 @@ function hasMovedSendInFlight(compositeKey, epoch, screenKey) {
         if (attempt.moved &&
             attempt.recordKey === compositeKey &&
             attempt.recordEpoch === epoch &&
-            attempt.screenKey === screenKey) {
+            partialAnswerCovers(attempt.screenKey, screenKey)) {
             return true;
         }
     }

package/dist/server/src/lib/polling/auto-yes-poller-steps.js

@@ -0,0 +1,279 @@
+"use strict";
+/**
+ * Auto-Yes poller: synchronous steps of `detectAndRespondToPrompt` that decide
+ * whether a read prompt is left alone (Issue #3781) (Issue #3783: split out of
+ * `auto-yes-poller.ts`).
+ *
+ * Does not statically import `auto-yes-poller.ts` (no cycle outside the
+ * baseline in `import-cycles-baseline-3482`, which does not count dynamic
+ * `import()`).
+ *
+ * @module lib/polling/auto-yes-poller-steps
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withheldForEarlierSend = withheldForEarlierSend;
+exports.answerModeOfTick = answerModeOfTick;
+exports.questionAnsweringOf = questionAnsweringOf;
+exports.withheldAsQuestion = withheldAsQuestion;
+exports.withheldAtSend = withheldAtSend;
+exports.resolveAnswerUnderPolicy = resolveAnswerUnderPolicy;
+exports.skippedForUnownedSession = skippedForUnownedSession;
+const auto_yes_resolver_1 = require("./auto-yes-resolver");
+const auto_yes_policy_1 = require("./auto-yes-policy");
+const auto_yes_suppression_reason_1 = require("./auto-yes-suppression-reason");
+const auto_yes_state_1 = require("../auto-yes-state");
+const auto_yes_dialog_gate_1 = require("./auto-yes-dialog-gate");
+const auto_yes_answer_mode_1 = require("../../types/auto-yes-answer-mode");
+const auto_yes_poller_state_1 = require("./auto-yes-poller-state");
+const auto_yes_prompt_suppression_1 = require("./auto-yes-prompt-suppression");
+const auto_yes_confirmation_ledger_1 = require("./auto-yes-confirmation-ledger");
+/**
+ * Step 2.5 of `detectAndRespondToPrompt`: whether an earlier send to this
+ * screen keeps the prompt from being answered now.
+ *
+ * @returns true when the prompt is withheld (the caller returns `no_answer`)
+ */
+function withheldForEarlierSend(judged, screenKey, epoch) {
+    const { worktreeId, cliToolId, instanceId, compositeKey, pollerState, promptData, frameKey } = judged;
+    const partial = (0, auto_yes_poller_state_1.getPartialAnswer)(compositeKey, epoch);
+    if (partial !== null) {
+        if ((0, auto_yes_poller_state_1.partialAnswerCovers)(partial.screenKey, screenKey)) {
+            // Issue #3880: a person's send made with no prompt read (the capture
+            // failed) holds the first confirmation read after it, as that one.
+            (0, auto_yes_poller_state_1.identifyPartialAnswerScreen)(compositeKey, screenKey);
+            (0, auto_yes_prompt_suppression_1.suppressAndWarnOnce)(judged, {
+                reason: auto_yes_suppression_reason_1.PARTIAL_ANSWER_SUPPRESSION_REASON,
+                mode: null,
+                promptType: promptData.type,
+            }, `${frameKey}\u0000partial-answer`, 'poller:auto-yes-skipped-partial-answer', { promptType: promptData.type, stoppedAt: partial.at });
+            return true;
+        }
+        // Another prompt is on screen: only the sends at the forgotten one's
+        // screen go with it (#3713) — one in flight at this screen keeps its hold.
+        (0, auto_yes_poller_state_1.forgetPartialAnswer)(compositeKey, partial.screenKey);
+    }
+    // Issue #3713: a worktree ID move carried an answer still being sent to
+    // this session's key. Its keys may already be on the pane, and how its send
+    // ends is not known yet — so this screen gets no keys until it comes back
+    // (recorded as a partial answer above, or gone).
+    if ((0, auto_yes_poller_state_1.hasMovedSendInFlight)(compositeKey, epoch, screenKey)) {
+        // Issue #3820: a stop the policy record never carries — the ledger's own reason.
+        (0, auto_yes_confirmation_ledger_1.withholdLedgerConfirmation)(judged, 'moved-send-in-flight');
+        (0, auto_yes_poller_state_1.warnOncePerFrame)(pollerState, `${frameKey}\u0000moved-send-in-flight`, 'poller:auto-yes-skipped-moved-send-in-flight', { worktreeId, cliToolId, instanceId, promptType: promptData.type });
+        return true;
+    }
+    return false;
+}
+/**
+ * The answer mode a tick acts under (Issue #3863): the grant the tick read
+ * (its generation's, #3706), or — for a direct caller with no generation —
+ * the instance's grant as it stands, if it is on. Neither: the default,
+ * `recommended`. A grant that cannot be read is `careful`, the mode that
+ * answers less.
+ */
+function answerModeOfTick(worktreeId, cliToolId, instanceId, grant) {
+    if (grant !== undefined)
+        return (0, auto_yes_state_1.autoYesAnswerModeOf)(grant);
+    try {
+        const state = (0, auto_yes_state_1.getAutoYesState)(worktreeId, cliToolId, instanceId);
+        return state?.enabled ? (0, auto_yes_state_1.autoYesAnswerModeOf)(state) : auto_yes_answer_mode_1.DEFAULT_AUTO_YES_ANSWER_MODE;
+    }
+    catch {
+        return 'careful';
+    }
+}
+/**
+ * Issue #3863: what the resolver needs to answer the prompt as a question
+ * under `answerMode`, or undefined when it is not answered as one — not a
+ * question reader's picker, or the mode is `careful` (which never answers it).
+ */
+function questionAnsweringOf(judged, answerMode) {
+    // Issue #3881 (review N3): the shared table, which the observation reads too.
+    const kind = (0, auto_yes_dialog_gate_1.classifyAutoYesQuestion)(judged.promptData, judged.dialogGate, judged.cliToolId);
+    if ((0, auto_yes_dialog_gate_1.autoYesQuestionTreatment)(kind, answerMode) !== 'recommended-choice')
+        return undefined;
+    return { optionRecommendations: judged.optionRecommendations };
+}
+/**
+ * Step 3.7 of `detectAndRespondToPrompt` (Issue #3822): a question to the
+ * operator is left to the human when Auto-Yes's answer mode says so.
+ *
+ * Issue #3863: which questions, by {@link classifyAutoYesQuestion}:
+ *
+ * - a question reader's picker (Claude's AskUserQuestion, Command Code's
+ *   question screen) — left to a human under the `careful` answer mode; under
+ *   `recommended` it goes on to step 4, which answers it with its recommended
+ *   option (`auto-yes-question-choice`). Judged without the dialog gate, so a
+ *   `legacy` tool and the `CM_AUTOYES_DIALOG_GATE` kill switch change nothing
+ *   here;
+ * - OpenCode V2's question form — left to a human under either mode;
+ * - Issue #3881: a copilot / codex numbered list nothing marks as a question
+ *   or as a permission (`'unidentified'`) — left to a human under `careful`;
+ *   under `recommended` it goes on to step 4 and is answered as before.
+ *
+ * Not a contract verdict, so `allowPromptTypes` cannot bring it back: an
+ * `allow-listed` contract naming `multiple_choice` delegates permission
+ * dialogs, not the operator's questions.
+ *
+ * Recorded as `question-left-to-human` — a question in general, not the
+ * `Submit` / `Cancel` confirm page that follows one (`question-confirm-page`,
+ * #3748, recorded at step 3.3 before this step is reached).
+ *
+ * @returns true when the prompt is withheld (the caller returns `no_answer`)
+ */
+function withheldAsQuestion(judged) {
+    const { promptData, dialogGate, cliToolId } = judged;
+    const kind = (0, auto_yes_dialog_gate_1.classifyAutoYesQuestion)(promptData, dialogGate, cliToolId);
+    if (kind === null)
+        return false;
+    const answerMode = judged.answerMode ?? auto_yes_answer_mode_1.DEFAULT_AUTO_YES_ANSWER_MODE;
+    if ((0, auto_yes_dialog_gate_1.autoYesQuestionTreatment)(kind, answerMode) !== 'left-to-human')
+        return false;
+    withholdQuestion(judged, answerMode, false, kind);
+    return true;
+}
+/** Record a question left to a human (`question-left-to-human`), warning once per frame. */
+function withholdQuestion(judged, answerMode, atSend, kind) {
+    const { promptData, frameKey, dialogGate } = judged;
+    (0, auto_yes_prompt_suppression_1.suppressAndWarnOnce)(judged, { reason: auto_yes_suppression_reason_1.QUESTION_LEFT_TO_HUMAN_SUPPRESSION_REASON, mode: null, promptType: promptData.type }, `${frameKey}\u0000question`, 'poller:auto-yes-skipped-question', {
+        reason: auto_yes_suppression_reason_1.QUESTION_LEFT_TO_HUMAN_SUPPRESSION_REASON,
+        promptType: promptData.type,
+        dialogKind: dialogGate?.dialog?.kind ?? null,
+        // Issue #3881: `unidentified` — not known to be a question, nor not one.
+        questionKind: kind,
+        question: (0, auto_yes_prompt_suppression_1.truncateForLog)(promptData.question),
+        answerMode,
+        ...(atSend ? { atSend: true } : {}),
+    });
+}
+/**
+ * The last look before a key (Issue #3822): is the answer still Auto-Yes's to
+ * send? Asked after the last wait before the send (the ownership check), so
+ * nothing it reads can change before the first key goes out.
+ *
+ * - With a `generation` (a poller tick), Auto-Yes must still be on and inside
+ *   its window. `getAutoYesState` disables an expired grant on read, the
+ *   boundary the hook and the next tick see. Without one (direct callers,
+ *   tests) the grant is not checked, as the tick checks nothing then (#3706).
+ * - The contract is read again past the policy cache, so a switched contract,
+ *   an `off`, or a deny pattern added since the tick's lookup withholds the
+ *   key. A read that fails is "contract unknown" (`policy-lookup-failed`), as
+ *   in step 4, and so is a grant that cannot be read.
+ * - Issue #3863: the answer mode is read off that grant again. A question the
+ *   `careful` mode leaves to a human gets no key, whatever the tick began
+ *   under; the question's answer is resolved again under the mode as it is.
+ *   (A mode change replaces the grant, so a tick that began under the old one
+ *   has usually stopped at its last generation check already.)
+ *
+ * The `PermissionRequest` hook is not asked this: its `allow` IS the answer,
+ * decided against the grant and the contract when the hook is answered, and
+ * nothing is typed afterwards for a later look to stop.
+ *
+ * @param checkGrant - Whether the grant is checked (a tick with a generation)
+ * @returns true when the key is withheld (the caller returns `no_answer`)
+ */
+function withheldAtSend(judged, checkGrant) {
+    const { worktreeId, cliToolId, instanceId, pollerState, promptData, frameKey } = judged;
+    let answerMode = judged.answerMode ?? auto_yes_answer_mode_1.DEFAULT_AUTO_YES_ANSWER_MODE;
+    if (checkGrant) {
+        let grant;
+        try {
+            grant = (0, auto_yes_state_1.getAutoYesState)(worktreeId, cliToolId, instanceId);
+        }
+        catch {
+            return withholdAsUnknown(judged);
+        }
+        if (!grant?.enabled) {
+            // Auto-Yes is off: nothing is recorded as withheld (the poller stops on
+            // its next tick and the state says why), only that the key was not sent.
+            (0, auto_yes_poller_state_1.warnOncePerFrame)(pollerState, `${frameKey}\u0000at-send-disabled`, 'poller:auto-yes-withheld-at-send', {
+                worktreeId,
+                cliToolId,
+                instanceId,
+                reason: grant?.stopReason === 'expired' ? 'expired' : 'auto-yes-disabled',
+                promptType: promptData.type,
+            });
+            return true;
+        }
+        answerMode = (0, auto_yes_state_1.autoYesAnswerModeOf)(grant);
+        const questionKind = (0, auto_yes_dialog_gate_1.classifyAutoYesQuestion)(promptData, judged.dialogGate, cliToolId);
+        if (answerMode === 'careful' && questionKind !== null
+            && (0, auto_yes_dialog_gate_1.autoYesQuestionTreatment)(questionKind, answerMode) === 'left-to-human') {
+            withholdQuestion(judged, answerMode, true, questionKind);
+            return true;
+        }
+    }
+    const policy = (0, auto_yes_policy_1.getSessionAutoYesPolicy)(worktreeId, cliToolId, instanceId, { fresh: true });
+    const resolution = (0, auto_yes_resolver_1.resolveAutoAnswerWithPolicy)(promptData, policy, cliToolId, questionAnsweringOf(judged, answerMode));
+    if (resolution.suppressedBy) {
+        const mode = (0, auto_yes_resolver_1.policyLookupMode)(policy);
+        (0, auto_yes_prompt_suppression_1.suppressAndWarnOnce)(judged, { reason: resolution.suppressedBy, mode, promptType: promptData.type, pattern: resolution.pattern }, `${frameKey}\u0000${resolution.suppressedBy}\u0000${mode ?? ''}\u0000${resolution.pattern ?? ''}`, 'poller:auto-yes-suppressed-by-policy', {
+            reason: resolution.suppressedBy,
+            mode,
+            pattern: resolution.pattern,
+            promptType: promptData.type,
+            atSend: true,
+        });
+        return true;
+    }
+    return false;
+}
+function withholdAsUnknown(judged) {
+    const { promptData, frameKey } = judged;
+    (0, auto_yes_prompt_suppression_1.suppressAndWarnOnce)(judged, { reason: auto_yes_suppression_reason_1.POLICY_LOOKUP_FAILED_SUPPRESSION_REASON, mode: null, promptType: promptData.type }, `${frameKey}\u0000${auto_yes_suppression_reason_1.POLICY_LOOKUP_FAILED_SUPPRESSION_REASON}\u0000at-send`, 'poller:auto-yes-suppressed-by-policy', { reason: auto_yes_suppression_reason_1.POLICY_LOOKUP_FAILED_SUPPRESSION_REASON, mode: null, promptType: promptData.type, atSend: true });
+    return true;
+}
+/**
+ * Step 4 of `detectAndRespondToPrompt`: the auto answer under the execution
+ * contract's policy, recording the suppression when the policy withholds it.
+ *
+ * @returns The answer to send, or null when there is none
+ */
+function resolveAnswerUnderPolicy(judged) {
+    const { worktreeId, cliToolId, instanceId, promptData, frameKey } = judged;
+    // Issue #3822: a failed lookup reaches the resolver as unknown and withholds.
+    const policy = (0, auto_yes_policy_1.getSessionAutoYesPolicy)(worktreeId, cliToolId, instanceId);
+    // Issue #3863: a question the `recommended` mode answers takes its recommended option.
+    const resolution = (0, auto_yes_resolver_1.resolveAutoAnswerWithPolicy)(promptData, policy, cliToolId, questionAnsweringOf(judged, judged.answerMode ?? auto_yes_answer_mode_1.DEFAULT_AUTO_YES_ANSWER_MODE));
+    if (resolution.suppressedBy) {
+        const mode = (0, auto_yes_resolver_1.policyLookupMode)(policy);
+        // Issue #1684: the log line alone leaves a CLI-driven pipeline blind to
+        // why its worker stalled. Record the suppression so buildCurrentOutput
+        // can publish it (`autoYes.lastSuppression` in capture --json).
+        (0, auto_yes_prompt_suppression_1.suppressAndWarnOnce)(judged, {
+            reason: resolution.suppressedBy,
+            mode,
+            promptType: promptData.type,
+            pattern: resolution.pattern,
+        }, `${frameKey}\u0000${resolution.suppressedBy}\u0000${mode ?? ''}\u0000${resolution.pattern ?? ''}`, 'poller:auto-yes-suppressed-by-policy', {
+            reason: resolution.suppressedBy,
+            mode,
+            pattern: resolution.pattern,
+            promptType: promptData.type,
+        });
+    }
+    return resolution.answer;
+}
+/**
+ * Issue #2865: whether the session is not this server's to type into (another
+ * server created it, or the worktree is gone), warning once per frame.
+ *
+ * @returns true when the caller returns `no_answer`
+ */
+function skippedForUnownedSession(judged, sessionName, ownership) {
+    const { worktreeId, cliToolId, instanceId, pollerState, frameKey } = judged;
+    if (ownership === null || ownership.verdict === 'foreign') {
+        // Issue #3820: as above, the ledger's own reason.
+        (0, auto_yes_confirmation_ledger_1.withholdLedgerConfirmation)(judged, 'foreign-session');
+        (0, auto_yes_poller_state_1.warnOncePerFrame)(pollerState, `${frameKey}\u0000${sessionName}\u0000${ownership ? 'foreign' : 'worktree_not_found'}`, 'poller:auto-yes-skipped-foreign-session', {
+            worktreeId,
+            cliToolId,
+            instanceId,
+            sessionName,
+            sessionPath: ownership?.sessionPath ?? null,
+            reason: ownership ? 'foreign' : 'worktree_not_found',
+        });
+        return true;
+    }
+    return false;
+}

package/dist/server/src/lib/polling/auto-yes-prompt-suppression.js

@@ -24,6 +24,7 @@ const auto_yes_confirm_page_1 = require("./auto-yes-confirm-page");
 const auto_yes_suppression_state_1 = require("./auto-yes-suppression-state");
 const auto_yes_dialog_gate_1 = require("./auto-yes-dialog-gate");
 const auto_yes_poller_state_1 = require("./auto-yes-poller-state");
+const auto_yes_confirmation_ledger_1 = require("./auto-yes-confirmation-ledger");
 /**
  * Issue #3214: the form the four suppression exits of `detectAndRespondToPrompt`
  * share. Records why Auto-Yes left the prompt alone (`recordPolicySuppression`,
@@ -38,6 +39,8 @@ const auto_yes_poller_state_1 = require("./auto-yes-poller-state");
 function suppressAndWarnOnce(prompt, suppression, warnFrameKey, event, detail) {
     const { worktreeId, cliToolId, instanceId } = prompt;
     (0, auto_yes_suppression_state_1.recordPolicySuppression)(worktreeId, cliToolId, instanceId, suppression);
+    // Issue #3820: the same stop, as an interval of the confirmation on screen.
+    (0, auto_yes_confirmation_ledger_1.withholdLedgerConfirmation)(prompt, suppression.reason);
     (0, auto_yes_poller_state_1.warnOncePerFrame)(prompt.pollerState, warnFrameKey, event, {
         worktreeId,
         cliToolId,
@@ -244,8 +247,8 @@ function suppressIfNotOursToAnswer(prompt, frame) {
     //
     // Issue #3748: Claude's confirmation page (`Ready to submit your answers?` /
     // `❯ 1. Submit answers` / `2. Cancel`) is the same page and is declined the
-    // same way. Judged by `isAutoYesDeclinedConfirmPage`, which the browser's
-    // fallback (`useAutoYes`) asks too, and recorded with a reason of its own,
+    // same way. Judged by `isAutoYesDeclinedConfirmPage` (the browser's fallback,
+    // `useAutoYes`, read the same page by its options until #3821 retired it), and recorded with a reason of its own,
     // `question-confirm-page`, which `cmate wait` names as such (it reused
     // `unclassified-frame`, whose wording says no detector recognised the frame).
     if ((0, auto_yes_confirm_page_1.isAutoYesDeclinedConfirmPage)(cliToolId, frame)) {
@@ -280,6 +283,7 @@ function suppressIfNotOursToAnswer(prompt, frame) {
     if (!dialogGate.allowed) {
         return { kind: 'dialog-gate-refused', dialogGate };
     }
+    prompt.dialogGate = dialogGate;
     return { kind: 'ours' };
 }
 /**
@@ -296,6 +300,8 @@ function suppressUnclassifiedFrame(prompt, dialogGate) {
         gateMode: dialogGate.mode,
     });
 }
+/** Issue #3820: the ledger's screen key for agy's startup trust screen (not a `partialAnswerScreenKey`). */
+const ANTIGRAVITY_TRUST_SCREEN_LEDGER_KEY = 'antigravity-startup-trust';
 /**
  * Issue #3757: agy's startup folder-trust screen, which the tick read as no
  * prompt at all — it is unnumbered, so neither agy's dialog reader nor the
@@ -330,6 +336,11 @@ function suppressAntigravityTrustScreen(worktreeId, instanceId, pollerState, fra
         mode: null,
         promptType: 'multiple_choice',
     });
+    // Issue #3820: unnumbered, so no prompt data and no screen key of its own —
+    // the screen is one confirmation for as long as it stays up.
+    const ledgerScope = { worktreeId, cliToolId: 'antigravity', instanceId };
+    (0, auto_yes_confirmation_ledger_1.observeLedgerScreen)(ledgerScope, ANTIGRAVITY_TRUST_SCREEN_LEDGER_KEY, 'multiple_choice');
+    (0, auto_yes_confirmation_ledger_1.withholdLedgerConfirmation)(ledgerScope, auto_yes_suppression_reason_1.STARTUP_TRUST_UNHANDLED_SUPPRESSION_REASON);
     (0, auto_yes_poller_state_1.warnOncePerFrame)(pollerState, 'antigravity-startup-trust', 'poller:auto-yes-skipped-startup-trust', {
         worktreeId,
         cliToolId: 'antigravity',