commandmate 0.47.0 → 0.48.0

package/dist/server/src/lib/polling/auto-yes-question-choice.js

@@ -0,0 +1,57 @@
+"use strict";
+/**
+ * Which option Auto-Yes answers a question with under the `recommended`
+ * answer mode (Issue #3863).
+ *
+ * Only the choice among a question's options. Whether the screen is a
+ * question at all (`classifyAutoYesQuestion`), whether the mode lets Auto-Yes
+ * answer it, and what the contract allows are decided elsewhere; a permission
+ * dialog keeps #3822's rule (the one "allow this call once" row) and never
+ * reaches this.
+ *
+ * The rule (the user's decision of 2026-10-24):
+ *
+ * - exactly one option's title ends in a recommendation marker → that option,
+ *   wherever it is in the list and wherever the cursor is;
+ * - no option is recommended (every reading `false`) → the default: the
+ *   cursor's option, else option 1;
+ * - otherwise nothing is chosen: an option whose title could not be told from
+ *   its description (`'unknown'`, or no reading at all), two or more
+ *   recommended options, a chosen option that takes typed text, or a
+ *   multi-select question.
+ *
+ * Client-safe: no server-only imports (the resolver that calls it is walked by
+ * the client-import guard).
+ *
+ * @module lib/polling/auto-yes-question-choice
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.chooseRecommendedOption = chooseRecommendedOption;
+/**
+ * Choose a question's answer under the `recommended` mode.
+ *
+ * @param options - The question's options, as the reader read them
+ * @param recommendations - Per option, what its title says (`PromptDetectionResult.optionRecommendations`);
+ *   absent or of another length reads as `'unknown'` for every option
+ * @param multiSelect - Whether the question takes several answers
+ */
+function chooseRecommendedOption(options, recommendations, multiSelect) {
+    if (multiSelect)
+        return { kind: 'unidentified', cause: 'multi-select' };
+    if (options.length === 0)
+        return { kind: 'unidentified', cause: 'no-options' };
+    if (recommendations === undefined || recommendations.length !== options.length) {
+        return { kind: 'unidentified', cause: 'unknown-title' };
+    }
+    if (recommendations.some((value) => value === 'unknown'))
+        return { kind: 'unidentified', cause: 'unknown-title' };
+    const recommended = options.filter((_, index) => recommendations[index] === true);
+    if (recommended.length > 1)
+        return { kind: 'unidentified', cause: 'several-recommended' };
+    const [option, basis] = recommended.length === 1
+        ? [recommended[0], 'recommended']
+        : [options.find((candidate) => candidate.isDefault) ?? options[0], 'default'];
+    if (option.requiresTextInput)
+        return { kind: 'unidentified', cause: 'typed-text' };
+    return { kind: 'chosen', option, basis };
+}

package/dist/server/src/lib/polling/auto-yes-resolver.js

@@ -9,6 +9,15 @@
  *   confirm is a separate row, so a default is half an answer)
  * - multiple_choice with default option -> default option number
  * - multiple_choice without default -> first option number
+ * - Issue #3822: a permission dialog (a row reads as one of the effects in
+ *   `auto-yes-option-effect`) -> the number of its one "allow this call once"
+ *   row, wherever the default is; withheld as `allow-once-unidentified` when
+ *   there is no such row or more than one
+ * - Issue #3863: a question under the `recommended` answer mode (the caller
+ *   passes `question`) -> its recommended option, else its default; withheld
+ *   as `recommended-option-unidentified` when that cannot be told
+ *   (`auto-yes-question-choice`). A question that reads as a permission
+ *   dialog keeps the allow-once rule above.
  * - option requiring text input -> null (skip)
  * - unknown type -> null (skip)
  *
@@ -18,16 +27,32 @@
  * omitting it (or passing one that states nothing) reproduces the pre-#1547
  * behaviour exactly, which is what keeps contract-less operation untouched.
  *
- * Client-safe: no server-only imports, because a 'use client' hook
- * (`hooks/useAutoYes.ts`) imports this module.
+ * Client-safe: no server-only imports. A 'use client' hook
+ * (`hooks/useAutoYes.ts`) imported this module until Issue #3821 retired the
+ * browser's answers; the guard `use-auto-yes-client-imports-3748` still walks it.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MAX_DENY_MATCH_TEXT_LENGTH = exports.MAX_DENY_PATTERN_LENGTH = void 0;
+exports.MAX_DENY_MATCH_TEXT_LENGTH = exports.MAX_DENY_PATTERN_LENGTH = exports.AUTO_YES_POLICY_UNKNOWN = void 0;
+exports.isAutoYesPolicyUnknown = isAutoYesPolicyUnknown;
+exports.policyLookupMode = policyLookupMode;
 exports.evaluatePolicyAgainstTexts = evaluatePolicyAgainstTexts;
 exports.resolveAutoAnswerWithPolicy = resolveAutoAnswerWithPolicy;
 exports.resolveAutoAnswer = resolveAutoAnswer;
 const auto_yes_config_1 = require("../../config/auto-yes-config");
+const auto_yes_suppression_reason_1 = require("./auto-yes-suppression-reason");
 const prompt_answer_semantic_1 = require("../../lib/prompt-answer-semantic");
+const auto_yes_option_effect_1 = require("./auto-yes-option-effect");
+const auto_yes_question_choice_1 = require("./auto-yes-question-choice");
+/** The one {@link AutoYesPolicyUnknown} value. */
+exports.AUTO_YES_POLICY_UNKNOWN = Object.freeze({ lookupFailed: true });
+/** Whether the lookup failed, i.e. the contract is not known (Issue #3822). */
+function isAutoYesPolicyUnknown(policy) {
+    return policy !== null && policy !== undefined && 'lookupFailed' in policy && policy.lookupFailed === true;
+}
+/** The mode a lookup states, for records and log lines; null for no contract or unknown. */
+function policyLookupMode(policy) {
+    return policy && !isAutoYesPolicyUnknown(policy) ? policy.mode : null;
+}
 /**
  * Upper bound on a deny pattern, mirroring MAX_PATTERN_LENGTH in
  * lib/tasks/contract-parser (asserted equal by the unit tests). Contracts are
@@ -41,14 +66,31 @@ exports.MAX_DENY_PATTERN_LENGTH = 200;
  * A prompt question or option label is a few hundred characters; the bound only
  * exists so a pathological pane cannot make every poll scan megabytes with 32
  * patterns. Matching is over the head of the field, deterministically.
+ *
+ * Issue #3881: a field cut here was not shown to the patterns whole, exactly
+ * like an approval target cut at its 12-row cap, so a miss over its head is
+ * not a pass: it withholds as `deny-pattern-unusable` (no pattern named). A
+ * match inside the head is still `deny-pattern`.
  */
 exports.MAX_DENY_MATCH_TEXT_LENGTH = 20_000;
-/** The pre-policy resolution: the rules as they were before Issue #1547. */
-function resolveBaseAnswer(promptData) {
+/**
+ * The pre-policy resolution: the rules as they were before Issue #1547, with
+ * the permission rows read by effect (Issue #3822).
+ */
+function resolveBaseAnswer(promptData, cliToolId, question) {
     if (promptData.type === 'yes_no') {
-        return 'y';
+        return { answer: 'y' };
     }
     if (promptData.type === 'multiple_choice') {
+        // Issue #3863: a question answered with its recommended option. Not for a
+        // question whose rows read as a permission dialog — a recommendation never
+        // picks which permission to grant (#3822's rule below decides that).
+        if (question !== undefined && (0, auto_yes_option_effect_1.selectAllowOnceOption)(promptData.options, cliToolId).kind === 'not-a-permission-dialog') {
+            const choice = (0, auto_yes_question_choice_1.chooseRecommendedOption)(promptData.options, question.optionRecommendations, (0, prompt_answer_semantic_1.isMultiSelectPrompt)(promptData));
+            return choice.kind === 'chosen'
+                ? { answer: choice.option.number.toString() }
+                : { answer: null, withheldBy: auto_yes_suppression_reason_1.RECOMMENDED_OPTION_UNIDENTIFIED_SUPPRESSION_REASON };
+        }
         // Issue #2755: a checkbox question. A number ticks a box and the confirm is
         // a separate row, so "the default option" is not an answer — it is half of
         // one. Auto-Yes refuses the prompt instead of ticking something and stopping.
@@ -57,19 +99,28 @@ function resolveBaseAnswer(promptData) {
         // / `[X]` / `[✔]`) is refused too — the sender answers such a list with
         // Space→Next→Enter, which would tick the default and submit the list.
         if ((0, prompt_answer_semantic_1.isMultiSelectPrompt)(promptData)) {
-            return null;
+            return { answer: null };
         }
-        const defaultOpt = promptData.options.find(o => o.isDefault);
-        const target = defaultOpt ?? promptData.options[0];
+        // Issue #3822: on a permission dialog the default row may save a rule,
+        // change the mode or deny (agy keeps the cursor where it was left), so the
+        // answer is the one row that allows this call once, by its number — never
+        // whatever the cursor or row 1 happens to be.
+        const selection = (0, auto_yes_option_effect_1.selectAllowOnceOption)(promptData.options, cliToolId);
+        if (selection.kind === 'unidentified') {
+            return { answer: null, withheldBy: auto_yes_suppression_reason_1.ALLOW_ONCE_UNIDENTIFIED_SUPPRESSION_REASON };
+        }
+        const target = selection.kind === 'allow-once'
+            ? selection.option
+            : promptData.options.find(o => o.isDefault) ?? promptData.options[0];
         if (!target) {
-            return null;
+            return { answer: null };
         }
         if (target.requiresTextInput) {
-            return null;
+            return { answer: null };
         }
-        return target.number.toString();
+        return { answer: target.number.toString() };
     }
-    return null;
+    return { answer: null };
 }
 /**
  * Every piece of prompt text a deny pattern is matched against.
@@ -108,12 +159,14 @@ function collectDenyMatchTexts(promptData) {
  * Patterns are screened by {@link validateStopPattern} (length, safe-regex2
  * catastrophic-backtracking detection, syntax) before execution, which is the
  * same ReDoS defence the stop-pattern path uses. A pattern that fails screening
- * — or whose execution throws — is reported as `unusable`, not skipped.
+ * — or whose execution throws — is reported as `unusable`, not skipped. So is
+ * a miss when a text was cut at {@link MAX_DENY_MATCH_TEXT_LENGTH} (Issue #3881).
  */
 function evaluateDenyPatterns(rawTexts, patterns) {
     if (patterns.length === 0) {
         return { outcome: 'no-match' };
     }
+    const headCut = rawTexts.some(text => text.length > exports.MAX_DENY_MATCH_TEXT_LENGTH);
     const texts = rawTexts.map(text => text.length > exports.MAX_DENY_MATCH_TEXT_LENGTH ? text.slice(0, exports.MAX_DENY_MATCH_TEXT_LENGTH) : text);
     for (const pattern of patterns) {
         if (pattern.length > exports.MAX_DENY_PATTERN_LENGTH || !(0, auto_yes_config_1.validateStopPattern)(pattern).valid) {
@@ -130,7 +183,9 @@ function evaluateDenyPatterns(rawTexts, patterns) {
             }
         }
     }
-    return { outcome: 'no-match' };
+    // Issue #3881: no pattern matched the heads, but a field's tail was never
+    // shown to them — evaluated over part of the request, which is no pass.
+    return headCut ? { outcome: 'unusable' } : { outcome: 'no-match' };
 }
 /**
  * Decide whether the policy forbids answering, given the prompt type and the
@@ -151,11 +206,22 @@ function evaluateDenyPatterns(rawTexts, patterns) {
  *
  * @param promptType - How the prompt would be classified on screen
  * @param denyMatchTexts - The only strings deny patterns are matched against
+ * Issue #3822: an unknown policy (the lookup failed) denies before anything
+ * else — it is not "no contract", and answering would ignore an `off` or a deny
+ * pattern the contract may state.
+ *
  * @param policy - Contract policy; null/undefined permits everything
+ * @param denySurfaceIncomplete - Issue #3881: the texts are known to be only
+ *   part of what the prompt asks about (`approvalTargetCompleteness`), so a
+ *   deny miss withholds as `deny-pattern-unusable`. The hook's structured call
+ *   is whole and leaves it false.
  */
-function evaluatePolicyAgainstTexts(promptType, denyMatchTexts, policy) {
+function evaluatePolicyAgainstTexts(promptType, denyMatchTexts, policy, denySurfaceIncomplete = false) {
     if (!policy)
         return null;
+    if (isAutoYesPolicyUnknown(policy)) {
+        return { reason: auto_yes_suppression_reason_1.POLICY_LOOKUP_FAILED_SUPPRESSION_REASON };
+    }
     if (policy.mode === 'off') {
         return { reason: 'mode-off' };
     }
@@ -166,6 +232,18 @@ function evaluatePolicyAgainstTexts(promptType, denyMatchTexts, policy) {
     if (deny.outcome === 'unusable') {
         return { reason: 'deny-pattern-unusable', pattern: deny.pattern };
     }
+    // Issue #3881 (H-3): no pattern matched, but the texts are not the whole
+    // request — the approval target's upward scan stopped at its line cap with
+    // rows above it, or (review P2-1) at the top of a capture that filled its
+    // window, and the command may start there. A miss on part of the
+    // request is not a pass: the patterns could not be evaluated against what
+    // the prompt asks, which is `deny-pattern-unusable`'s fail-closed case.
+    // Only when the contract lists patterns; with none there is nothing to miss.
+    // (A field cut at MAX_DENY_MATCH_TEXT_LENGTH is the same case, reported by
+    // evaluateDenyPatterns as `unusable` above.)
+    if (denySurfaceIncomplete && policy.denyPatterns.length > 0) {
+        return { reason: 'deny-pattern-unusable' };
+    }
     if (policy.mode === 'safe') {
         return promptType === 'yes_no' ? null : { reason: 'type-not-allowed' };
     }
@@ -176,7 +254,9 @@ function evaluatePolicyAgainstTexts(promptType, denyMatchTexts, policy) {
 }
 /** {@link evaluatePolicyAgainstTexts} over a detected on-screen prompt. */
 function evaluatePolicy(promptData, policy) {
-    return evaluatePolicyAgainstTexts(promptData.type, collectDenyMatchTexts(promptData), policy);
+    return evaluatePolicyAgainstTexts(promptData.type, collectDenyMatchTexts(promptData), policy, 
+    // Issue #3881: cut at the line cap, or at the top of a clipped capture.
+    promptData.approvalTargetCompleteness !== undefined);
 }
 /**
  * Resolve the automatic answer, reporting whether a policy withheld it.
@@ -184,13 +264,27 @@ function evaluatePolicy(promptData, policy) {
  * `suppressedBy` is set only when an answer was actually withheld, so the
  * escalation log records real suppressions and not prompts the base rules were
  * never going to answer anyway (an empty option list, an option that needs
- * typing). Those still resolve to null, with `suppressedBy` null.
+ * typing). Those still resolve to null, with `suppressedBy` null. Issue #3822:
+ * a permission dialog with no single "allow this call once" row is a
+ * withholding (`allow-once-unidentified`) — it is a dialog Auto-Yes would have
+ * answered before, and the operator must be told why it stopped.
  *
  * @param promptData - Detected prompt
  * @param policy - Contract auto-answer policy; omit for the unconstrained behaviour
+ * @param cliToolId - The tool that drew the prompt, whose permission rows are
+ *   read (Issue #3822). Omitted, every measured tool's wording is read
+ *   (`auto-yes-option-effect`), so a caller that does not know the tool still
+ *   never picks a row that saves a rule or changes the mode.
+ * @param question - Issue #3863: given when the prompt is a question the
+ *   `recommended` answer mode answers; the answer is then its recommended
+ *   option (else its default). The contract is evaluated afterwards exactly
+ *   as for any answer — on the prompt as read, whichever option was chosen.
  */
-function resolveAutoAnswerWithPolicy(promptData, policy) {
-    const answer = resolveBaseAnswer(promptData);
+function resolveAutoAnswerWithPolicy(promptData, policy, cliToolId, question) {
+    const { answer, withheldBy } = resolveBaseAnswer(promptData, cliToolId, question);
+    if (withheldBy) {
+        return { answer: null, suppressedBy: withheldBy };
+    }
     if (answer === null) {
         return { answer: null, suppressedBy: null };
     }
@@ -205,8 +299,9 @@ function resolveAutoAnswerWithPolicy(promptData, policy) {
  *
  * @param promptData - Detected prompt
  * @param policy - Contract auto-answer policy; omit for the unconstrained behaviour
+ * @param cliToolId - The tool that drew the prompt; see {@link resolveAutoAnswerWithPolicy}
  * @returns The answer string to send, or null if auto-answer is not possible
  */
-function resolveAutoAnswer(promptData, policy) {
-    return resolveAutoAnswerWithPolicy(promptData, policy).answer;
+function resolveAutoAnswer(promptData, policy, cliToolId) {
+    return resolveAutoAnswerWithPolicy(promptData, policy, cliToolId).answer;
 }

package/dist/server/src/lib/polling/auto-yes-suppression-reason.js

@@ -1,22 +1,56 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.NO_HOOK_RECEIPT_SUPPRESSION_REASON = exports.QUESTION_CONFIRM_PAGE_SUPPRESSION_REASON = exports.STARTUP_TRUST_UNHANDLED_SUPPRESSION_REASON = exports.PARTIAL_ANSWER_SUPPRESSION_REASON = exports.CONTRACT_SUPPRESSION_REASONS = void 0;
+exports.NO_HOOK_RECEIPT_SUPPRESSION_REASON = exports.RECOMMENDED_OPTION_UNIDENTIFIED_SUPPRESSION_REASON = exports.ALLOW_ONCE_UNIDENTIFIED_SUPPRESSION_REASON = exports.BASE_RULE_SUPPRESSION_REASONS = exports.QUESTION_LEFT_TO_HUMAN_SUPPRESSION_REASON = exports.QUESTION_CONFIRM_PAGE_SUPPRESSION_REASON = exports.STARTUP_TRUST_UNHANDLED_SUPPRESSION_REASON = exports.PARTIAL_ANSWER_SUPPRESSION_REASON = exports.POLICY_LOOKUP_FAILED_SUPPRESSION_REASON = exports.CONTRACT_SUPPRESSION_REASONS = void 0;
+exports.isBaseRuleSuppressionReason = isBaseRuleSuppressionReason;
 /**
  * Issue #3796: the reasons `resolveAutoAnswerWithPolicy` returns — the contract's
  * verdict on the prompt as it is NOW, which a later tick re-evaluates, as
- * opposed to a reason that remembers an event (`partial-answer`).
+ * opposed to a reason that remembers an event (`partial-answer`). Issue #3822
+ * adds the base rules' one withholding, `allow-once-unidentified`, for the same
+ * reason.
  */
 exports.CONTRACT_SUPPRESSION_REASONS = new Set([
     'mode-off',
     'deny-pattern',
     'deny-pattern-unusable',
     'type-not-allowed',
+    'policy-lookup-failed',
+    // Issue #3822: not the contract's, but the same kind of verdict — on the
+    // prompt as it is now, from `resolveAutoAnswerWithPolicy`, re-evaluated later.
+    'allow-once-unidentified',
+    // Issue #3863: likewise, over a question under the `recommended` answer mode.
+    'recommended-option-unidentified',
 ]);
+/** Issue #3822: the reason recorded when the contract lookup failed. */
+exports.POLICY_LOOKUP_FAILED_SUPPRESSION_REASON = 'policy-lookup-failed';
 /** Issue #3706: the reason the poller records for an answer stopped part-way. */
 exports.PARTIAL_ANSWER_SUPPRESSION_REASON = 'partial-answer';
 /** Issue #3757: the reason the poller records over agy's unanswered trust screen. */
 exports.STARTUP_TRUST_UNHANDLED_SUPPRESSION_REASON = 'startup-trust-unhandled';
 /** Issue #3748: the reason the poller records over an `AskUserQuestion` confirm page. */
 exports.QUESTION_CONFIRM_PAGE_SUPPRESSION_REASON = 'question-confirm-page';
+/** Issue #3822: the reason the poller records over a question the tool asks the operator. */
+exports.QUESTION_LEFT_TO_HUMAN_SUPPRESSION_REASON = 'question-left-to-human';
+/**
+ * Issue #3822: the reasons `resolveAutoAnswerWithPolicy` returns from its base
+ * rules, before the contract is read. Every other reason it returns is the
+ * contract's verdict ({@link CONTRACT_SUPPRESSION_REASONS} holds both kinds:
+ * both are verdicts on the prompt as it is now). A reader that tells the
+ * operator what stopped the answer — the prompt observation, agy's withheld
+ * log line — must not send them to the contract for one of these.
+ */
+exports.BASE_RULE_SUPPRESSION_REASONS = new Set([
+    'allow-once-unidentified',
+    // Issue #3863: a question whose recommended option could not be told.
+    'recommended-option-unidentified',
+]);
+/** Whether `reason` is the base rules' withholding rather than the contract's (Issue #3822). */
+function isBaseRuleSuppressionReason(reason) {
+    return exports.BASE_RULE_SUPPRESSION_REASONS.has(reason);
+}
+/** Issue #3822: the reason the resolver returns over a permission dialog with no single allow-once row. */
+exports.ALLOW_ONCE_UNIDENTIFIED_SUPPRESSION_REASON = 'allow-once-unidentified';
+/** Issue #3863: the reason the resolver returns over a question whose recommended option could not be told. */
+exports.RECOMMENDED_OPTION_UNIDENTIFIED_SUPPRESSION_REASON = 'recommended-option-unidentified';
 /** Issue #3767: the reason the poller records over an agy dialog with no matching hook receipt. */
 exports.NO_HOOK_RECEIPT_SUPPRESSION_REASON = 'no-hook-receipt';

package/dist/server/src/lib/polling/auto-yes-suppression-state.js

@@ -25,21 +25,30 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.recordPolicySuppression = recordPolicySuppression;
 exports.getLastPolicySuppression = getLastPolicySuppression;
+exports.suppressionPredatesAnswer = suppressionPredatesAnswer;
 exports.forgetPolicySuppression = forgetPolicySuppression;
 exports.clearPolicySuppressions = clearPolicySuppressions;
 const auto_yes_state_1 = require("../../lib/auto-yes-state");
 const global_state_1 = require("../global-state");
+const waiting_episode_state_1 = require("../session/waiting-episode-state");
 /** compositeKey -> the most recent policy suppression for that session. */
 const lastPolicySuppressions = (0, global_state_1.getOrInitGlobal)('__autoYesPolicySuppressions', () => new Map());
 /**
  * Record that the policy withheld an answer for `instanceId`'s current prompt.
  *
+ * Issue #3798: the record names the waiting episode open for the instance at
+ * this moment — unless the caller names one (a record carried over for the
+ * same dialog) — so it is never taken for the reason of a later wait.
+ *
  * @param at - Epoch ms; defaults to now. Overridable so tests are deterministic.
  */
 function recordPolicySuppression(worktreeId, cliToolId, instanceId, suppression, at = Date.now()) {
+    const { episodeId: carried, ...rest } = suppression;
+    const episodeId = carried ?? (0, waiting_episode_state_1.getWaitingEpisodeRecord)(worktreeId, cliToolId, instanceId)?.episodeId;
     lastPolicySuppressions.set((0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId), {
-        ...suppression,
+        ...rest,
         at,
+        ...(episodeId !== undefined ? { episodeId } : {}),
     });
 }
 /**
@@ -50,6 +59,21 @@ function recordPolicySuppression(worktreeId, cliToolId, instanceId, suppression,
 function getLastPolicySuppression(worktreeId, cliToolId, instanceId) {
     return lastPolicySuppressions.get((0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId)) ?? null;
 }
+/**
+ * Whether the record is older than the Auto-Yes answer to the wait it would
+ * explain (Issue #3798): the poller's last answer (`lastAnswer`) went to
+ * `waitingEpisodeId`, the wait open now, after the record was written. The
+ * success path of a send does not clear the record — it stays as history —
+ * but the answer is the newer fact, so the record is not that wait's reason
+ * any more. The push gate and `current-output` (`lastSuppressionAnswered`,
+ * which `cmate wait` reads) both decide it here. A record written at or after
+ * the answer, an answer to another episode, no answer and no wait id are not.
+ */
+function suppressionPredatesAnswer(suppression, waitingEpisodeId, answer) {
+    if (waitingEpisodeId === null || waitingEpisodeId === undefined || answer === null)
+        return false;
+    return answer.episodeId === waitingEpisodeId && suppression.at < answer.at;
+}
 /**
  * Drop the record of one session (Issue #3796): the reason it gives no longer
  * holds for the prompt still on screen (the contract that withheld it changed),

package/dist/server/src/lib/polling/prompt-screen-reading.js

@@ -0,0 +1,232 @@
+"use strict";
+/**
+ * The one place a prompt's screen is read as a kind of dialog for storage
+ * (Issue #3881).
+ *
+ * The response poller saves a `prompt` row from a frame it has in hand; every
+ * later reader — the chat transcript above all — has only the row's cut-down
+ * `question` and `options`. Deciding "question, permission or confirmation
+ * page?" from those again is what drew Claude's 16-column confirm page as a
+ * tool approval: its option 1 wraps (`Submit` / `answers`), so the stored
+ * option is `Submit`, and the review list is above the five rows the stored
+ * question keeps. So the kind is read here, from the frame, with the same
+ * predicates the Auto-Yes poller acts on, and stored as `promptData.reading`.
+ *
+ * What is evidence, in order:
+ *
+ *  1. the tool's confirm-page reader (`isAutoYesDeclinedConfirmFrame`, the
+ *     predicate behind the poller's `question-confirm-page`) — `confirmation`;
+ *  2. a question reader's picker chrome (`isAskUserQuestion`) — `question`;
+ *  3. rows that read as a permission dialog's effects
+ *     (`selectAllowOnceOption`, the resolver's own reading) — `permission`;
+ *  4. a yes/no confirmation pattern — `permission`;
+ *  5. nothing — `unknown`, which is not "not a question".
+ *
+ * Server-only: the confirm-page reader reaches `logger` → `env` → `fs`. The
+ * client reads what this wrote through `lib/detection/prompt-reading`.
+ *
+ * The second half of #3881 added no evidence here, on purpose: agy's
+ * receipt-backed reply list and copilot's / codex's questions have none on
+ * their screens, and they read `unknown` here as they did. What changed is
+ * what the answering paths do with that absence — agy's reply list is not
+ * answered on a receipt alone (`response-checker-dialog-gate`'s
+ * `isAntigravityGenericReadingOnScreen`), and the `careful` answer mode
+ * leaves copilot's / codex's unidentified lists to a human
+ * (`classifyAutoYesQuestion`'s `unidentified`). New evidence, when a reader
+ * learns some, goes in here; `tests/unit/guards/prompt-reading-sites-3881.test.ts`
+ * keeps this the only place.
+ *
+ * @module lib/polling/prompt-screen-reading
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.captureTopOf = captureTopOf;
+exports.withCaptureTopCompleteness = withCaptureTopCompleteness;
+exports.readPromptScreen = readPromptScreen;
+exports.promptDataForStorage = promptDataForStorage;
+const types_1 = require("../../lib/cli-tools/types");
+const tmux_pane_config_1 = require("../../config/tmux-pane-config");
+const cli_patterns_1 = require("../../lib/detection/cli-patterns");
+const prompt_reading_1 = require("../../types/prompt-reading");
+const auto_yes_confirm_page_1 = require("./auto-yes-confirm-page");
+const auto_yes_option_effect_1 = require("./auto-yes-option-effect");
+/**
+ * Where the first row of a capture sits in the pane (Issue #3881 review P2-1).
+ *
+ * Every capture is the last `windowLines` rows of the pane
+ * (`captureSessionOutput` → `sliceOutput`), so one that came back with fewer
+ * rows than its window holds the pane's whole history and its first row is
+ * the history's first; one that filled the window may have been cut there.
+ * The same test as `isCaptureWindowSaturated` (#1670) on the row count —
+ * restated, not imported: this module may not reach `tmux-capture-cache`
+ * (Issue #1922's import rule), and the equivalence is pinned by
+ * `tests/unit/lib/polling/prompt-reading-capture-top-3881.test.ts`.
+ *
+ * That holds for a scrollback pane only (the second review's N1). A tool in
+ * the alternate screen ({@link usesAlternateScreen}: claude, copilot,
+ * opencode) keeps no history, so its capture is the visible screen whatever
+ * the window, and "fewer rows than the window" says nothing about what the
+ * tool scrolled off. Its capture is read off the screen instead
+ * ({@link screenTopOf}), once the window is known not to have cut it.
+ *
+ * Whether it did (the third review's N4): the capture layer says so when the
+ * caller asks (`headCut`, the Auto-Yes poller's `capturePollerFrame`). The row
+ * count alone cannot tell at a window of exactly {@link TUI_PANE_HEIGHT} rows
+ * (the tallest alternate-screen pane, and the poller's REDUCED window): a
+ * whole 1000-row screen and a longer pane cut to its last 1000 rows come back
+ * the same size. Above that height it can: a cut capture has as many rows as
+ * its window, more than any alternate screen holds, and a capture that tall
+ * is a pane with history (the tool is not in the alternate screen), read as
+ * a scrollback pane. At or below it, a capture that filled its window is
+ * `clipped` unless the capture layer said otherwise (`headCut === false`):
+ * #3881's second half (review (5b)) took away the 1000-row exception, where
+ * an unreported cut on a window of exactly {@link TUI_PANE_HEIGHT} rows was
+ * read off the screen — blank first and last rows are what a longer pane cut
+ * to its last 1000 rows can show too, so they cannot stand in for the capture
+ * layer's word. `undefined` (not reported) and `false` (reported whole) are
+ * two answers, not one.
+ *
+ * And the capture layer's word decides on a scrollback pane too (the fourth
+ * review's N5). `headCut === false` is a known whole history, not an unknown
+ * top: tmux returned `min(history, N)` history rows plus the visible pane for
+ * a `-S -N`, so a capture it cut has more rows than any window it serves and
+ * the slice cuts it too — a capture the slice did not cut is everything from
+ * the history's first row. Only without that word is a capture that filled
+ * its window `clipped`; "filled" is counted in rows ({@link screenRowsOf}),
+ * so a trailing newline does not turn a 999-row capture into a full
+ * 1000-row window.
+ *
+ * @param capture - The capture as returned (or its cleaned spelling: same rows)
+ * @param windowLines - The window it was captured with
+ * @param cliToolId - The tool whose pane it is; omitted, the pane is read as a
+ *   scrollback pane (the reading before N1)
+ * @param headCut - Whether the window dropped rows from the top of what tmux
+ *   returned, when the capture layer said; omitted, judged from the row count
+ */
+function captureTopOf(capture, windowLines, cliToolId, headCut) {
+    if (headCut === true)
+        return 'clipped';
+    const rows = screenRowsOf(capture).length;
+    const filled = windowLines > 0 && rows >= windowLines;
+    // A known whole history (`headCut === false`) wins over a full window.
+    const historyTop = filled && headCut === undefined ? 'clipped' : 'history-start';
+    if (cliToolId === undefined || !(0, types_1.usesAlternateScreen)(cliToolId))
+        return historyTop;
+    if (rows > tmux_pane_config_1.TUI_PANE_HEIGHT)
+        return historyTop;
+    // Not reported, and the window was filled: nothing says the top was not cut.
+    if (headCut === undefined && filled)
+        return 'clipped';
+    return screenTopOf(capture);
+}
+/** A capture's rows: tmux ends every row with a newline, and the last one is not a row of its own. */
+function screenRowsOf(capture) {
+    return (capture.endsWith('\n') ? capture.slice(0, -1) : capture).split('\n');
+}
+/**
+ * An alternate-screen capture taken whole: does its content begin at the top
+ * of what the tool drew? These tools lay their content out from the screen's
+ * top down (a fresh 1000-row claude pane is a blank margin row, the banner,
+ * the turn, and blank rows to the bottom — `tests/fixtures/
+ * claude-confirm-live-3791/`), and one whose content outgrew the screen
+ * scrolls it: then the content reaches the bottom row
+ * (`head-cut-200x12.txt`), and the rows that left the top are gone. So the
+ * first row is the content's own only when the screen shows both its top
+ * margin (a blank first row) and room below (a blank last row); anything else
+ * — a content row at either edge — is `screen-full`, which is the side that
+ * withholds an answer rather than gives one.
+ */
+function screenTopOf(capture) {
+    const rows = screenRowsOf(capture);
+    const blank = (row) => row === undefined || (0, cli_patterns_1.stripAnsi)(row).trim() === '';
+    return rows.length > 1 && blank(rows[0]) && blank(rows[rows.length - 1]) ? 'screen-start' : 'screen-full';
+}
+/**
+ * The detection with `approvalTargetCompleteness: 'top-unknown'` on its prompt
+ * when the target's upward scan reached the frame's first row without a
+ * boundary and that row is not known to be the top of the pane's history
+ * (Issue #3881 review P2-1). Before this, `top-unknown` stayed on the
+ * detection only and the resolver read such a target as complete: a confirm
+ * whose command began above the capture, and whose rest fell within 12 rows,
+ * was answered under a contract that denies the command.
+ *
+ * A capture whose first row is where the pane's content begins
+ * (`history-start`, or `screen-start` on the alternate screen) leaves the
+ * detection as it is.
+ * Blank-row compaction during detection removes no non-blank row, so it does
+ * not change which of the two a frame is.
+ *
+ * @param detection - The tick's detection of the capture
+ * @param captureTop - Where the capture's first row sits ({@link CaptureTop}),
+ *   judged by the caller that knows its window ({@link captureTopOf})
+ */
+function withCaptureTopCompleteness(detection, captureTop) {
+    const promptData = detection.promptData;
+    if (!promptData ||
+        promptData.approvalTarget === undefined ||
+        promptData.approvalTargetCompleteness !== undefined ||
+        detection.approvalContext?.completeness !== 'top-unknown' ||
+        !captureTopMayBeCut(captureTop)) {
+        return detection;
+    }
+    return { ...detection, promptData: { ...promptData, approvalTargetCompleteness: 'top-unknown' } };
+}
+/** Whether rows may be missing above a capture's first row ({@link CaptureTop}). */
+function captureTopMayBeCut(captureTop) {
+    return captureTop === 'clipped' || captureTop === 'screen-full';
+}
+/**
+ * Read the prompt's screen as a kind of dialog.
+ *
+ * @param cliToolId - The tool that drew the frame
+ * @param frame - The capture the prompt was detected on (ANSI and box drawing
+ *   as captured), or the tick's own `normalizeFrame` of it — the Auto-Yes
+ *   poller passes that, so a tick still normalises its capture once (#3183) —
+ *   or null when the caller has none: then no confirm page can be read off it
+ * @param detection - The detection of that frame
+ * @param captureTop - Where `frame`'s first row sits in the pane, when the
+ *   caller knows its capture window (Issue #3881 review P2-1)
+ * @returns The reading, or null when the detection carries no prompt
+ */
+function readPromptScreen(cliToolId, frame, detection, captureTop) {
+    const promptData = detection.promptData;
+    if (!promptData)
+        return null;
+    const context = detection.approvalContext;
+    const base = {
+        version: prompt_reading_1.PROMPT_READING_VERSION,
+        ...(context ? { liveRange: { startRow: context.startRow, endRow: context.endRow } } : {}),
+        approvalTarget: context?.completeness ?? 'not-measured',
+        ...(captureTop !== undefined ? { captureTop } : {}),
+    };
+    const confirmPage = typeof frame === 'object' && frame !== null
+        ? (0, auto_yes_confirm_page_1.isAutoYesDeclinedConfirmPage)(cliToolId, frame)
+        : (0, auto_yes_confirm_page_1.isAutoYesDeclinedConfirmFrame)(cliToolId, frame);
+    if (confirmPage) {
+        return { ...base, kind: 'confirmation', phase: 'confirmation', evidence: ['confirm-page-reader'] };
+    }
+    if (promptData.type === 'multiple_choice' && promptData.isAskUserQuestion === true) {
+        const evidence = ['question-picker-chrome'];
+        if (promptData.askUserQuestion !== undefined)
+            evidence.push('ask-user-question-payload');
+        return { ...base, kind: 'question', phase: 'question', evidence };
+    }
+    if (promptData.type === 'multiple_choice') {
+        return (0, auto_yes_option_effect_1.selectAllowOnceOption)(promptData.options, cliToolId).kind === 'not-a-permission-dialog'
+            ? { ...base, kind: 'unknown', evidence: [] }
+            : { ...base, kind: 'permission', evidence: ['permission-option-effect'] };
+    }
+    return { ...base, kind: 'permission', evidence: ['yes-no-pattern'] };
+}
+/**
+ * The `promptData` a `prompt` row is saved with: the detection's, with what
+ * {@link readPromptScreen} read stored beside it. Undefined when the detection
+ * carries none, exactly as before. Both writers of a new `prompt` row from a
+ * frame use it: the response poller's save, and (review P2-2) the Auto-Yes
+ * poller's audit row when it answers before any row was saved.
+ */
+function promptDataForStorage(cliToolId, frame, detection, captureTop) {
+    const reading = readPromptScreen(cliToolId, frame, detection, captureTop);
+    if (!detection.promptData || reading === null)
+        return detection.promptData;
+    return { ...detection.promptData, reading };
+}