commandmate 0.47.0 → 0.48.0

package/dist/server/src/lib/prompt-observation/appearance.js

@@ -0,0 +1,165 @@
+"use strict";
+/**
+ * Which appearance of a screen an observation saw (Issue #3755).
+ *
+ * The same trust screen can open, be answered, and open again with every word
+ * the same — and a token issued on the first one must not answer the second.
+ * The server keeps, per instance, the fingerprint of the decision screen it
+ * last observed (kind, question, options, approval target, pane, generation)
+ * and when that fingerprint was first observed. Observing anything else — a
+ * different screen, `composer`, `none`, `unknown`, no session — forgets it, so
+ * the next observation of the same words is a new appearance with a new
+ * `firstSeenAt`, which the token binds (`./token`).
+ *
+ * What this cannot see: the screen going away and coming back between two
+ * observations, with nothing observed in between (observations are opt-in, not
+ * a poll). The two are one appearance here.
+ *
+ * In memory on `globalThis` (the route that issues and the route that verifies
+ * are bundled apart under `next dev`), bounded; forgetting an instance only
+ * makes its next observation a new appearance, which fails closed.
+ *
+ * @module lib/prompt-observation/appearance
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.approvalTargetWithOptionRowsAligned = approvalTargetWithOptionRowsAligned;
+exports.approvalTargetWithoutHighlight = approvalTargetWithoutHighlight;
+exports.screenFingerprint = screenFingerprint;
+exports.noteScreenAppearance = noteScreenAppearance;
+exports.forgetScreenAppearance = forgetScreenAppearance;
+const global_state_1 = require("../../lib/global-state");
+const dialog_block_1 = require("../../lib/detection/tools/dialog-block");
+/** How many instances are tracked at once; the least recently observed is forgotten first. */
+const MAX_TRACKED_INSTANCES = 1024;
+const appearances = (0, global_state_1.getOrInitGlobal)('__promptObservationScreenAppearances', () => new Map());
+/** Whitespace folded, so a re-render that only reflows a row is the same screen. */
+function normalize(text) {
+    return text === null ? null : text.replace(/\s+/g, ' ').trim();
+}
+/**
+ * How many rows under agy's bottom option row may be its wrapped tail: the
+ * allowance `detection/tools/antigravity/dialog.ts` gives the same block
+ * (`LAST_OPTION_TAIL_ROWS`, not exported). A tail longer than this reads as no
+ * block here, which leaves the target as it is (fail closed).
+ */
+const PERMISSION_OPTION_TAIL_ROWS = 12;
+/**
+ * The gutter of an option row: the highlight's glyph or the blank of the others.
+ * The glyphs are the block reader's (`dialog-block.ts`): agy's `>`, and claude's
+ * `❯`, codex's `›` and `●` for the readers that share the poller (#3817).
+ */
+const OPTION_ROW_GUTTER_PATTERN = /^[ \t]*[>\u276F\u203A\u25CF]?[ \t]*/u;
+/**
+ * The rows the shared block reader adopted as option rows, option 1 first, or
+ * null when they cannot be told.
+ *
+ * Taken from the reader itself, never re-judged here: `findNumberedOptionBlock`
+ * names the rows of option 1 (`firstRow`) and of the bottom option (`lastRow`)
+ * only, so option k's row is the `lastRow` of the block the reader finds above
+ * option k+1's row. Between two adopted rows there is no row the reader could
+ * parse as an option (it would have adopted it, or stopped there), so that
+ * block is the same run cut one option shorter. A row the reader folds into a
+ * label — `0. item`, `00. item` — is never in the list.
+ */
+function adoptedOptionRows(rows, block) {
+    const adopted = [block.lastRow];
+    for (let below = block.lastRow; adopted.length < block.options.length - 1;) {
+        const above = (0, dialog_block_1.findNumberedOptionBlock)(rows, below, rows.length);
+        if (above === null || above.firstRow !== block.firstRow || above.lastRow >= below)
+            return null;
+        adopted.unshift(above.lastRow);
+        below = above.lastRow;
+    }
+    adopted.unshift(block.firstRow);
+    return adopted.length === block.options.length ? adopted : null;
+}
+/**
+ * An approval target with the gutters of its option rows made the same, or null
+ * when its option rows cannot be told (Issue #3812, shared since #3817).
+ *
+ * The option block is found the way the readers find it
+ * (`findNumberedOptionBlock`, bottom up to `1.`), and taken only when each label
+ * the block reader read is `sameLabel` to the one the screen names. Only the
+ * gutter of the rows the reader adopted as options ({@link adoptedOptionRows})
+ * is made the same; every row above option 1 (the command, a here-document's
+ * `1. item`, its `>` and its indent) and every row folded into a label
+ * (`0. item` included) stays byte for byte.
+ *
+ * @param sameLabel - Whether the label the block reader read (rows under the
+ *   bottom option folded in) is the one the screen names
+ */
+function approvalTargetWithOptionRowsAligned(approvalTarget, options, sameLabel) {
+    const rows = approvalTarget.split('\n');
+    const block = (0, dialog_block_1.findNumberedOptionBlock)(rows, rows.length, PERMISSION_OPTION_TAIL_ROWS);
+    if (block === null)
+        return null;
+    // The reader folds the rows under the bottom option into its label.
+    const labels = [...block.options];
+    const last = labels.length - 1;
+    if (block.footer !== '')
+        labels[last] = [labels[last], ...block.footer.split('\n')].join(' ').trim();
+    if (labels.length !== options.length || labels.some((label, i) => !sameLabel(label, options[i])))
+        return null;
+    const adopted = adoptedOptionRows(rows, block);
+    if (adopted === null)
+        return null;
+    const optionRows = new Set(adopted);
+    return rows.map((row, i) => (optionRows.has(i) ? row.replace(OPTION_ROW_GUTTER_PATTERN, '  ') : row)).join('\n');
+}
+/**
+ * An approval target with the highlight's mark taken out (Issue #3812).
+ *
+ * agy's permission dialog reads its approval target down to the footer
+ * (`detection/tools/antigravity/dialog.ts`), so its option rows are the tail
+ * of the target and the `>` moves with every ↑/↓. Its option rows are aligned
+ * by {@link approvalTargetWithOptionRowsAligned} when the block's labels are
+ * exactly the screen's `options` — what the reader named.
+ *
+ * Any other kind, a target with no such block, or a block whose labels are not
+ * the screen's, is returned as is: a moved highlight then reads as another
+ * screen, which stops the strict respond rather than letting it through.
+ */
+function approvalTargetWithoutHighlight(kind, approvalTarget, options) {
+    if (approvalTarget === null || kind !== 'antigravity-permission')
+        return approvalTarget;
+    return approvalTargetWithOptionRowsAligned(approvalTarget, options, (read, named) => read === named) ?? approvalTarget;
+}
+/** One fixed form of what a screen asks. The highlight is not in it: moving the cursor is the same appearance. */
+function screenFingerprint(parts) {
+    return JSON.stringify([
+        parts.sessionName,
+        parts.sessionGeneration,
+        parts.kind,
+        normalize(parts.question),
+        parts.options.map(normalize),
+        normalize(approvalTargetWithoutHighlight(parts.kind, parts.approvalTarget, parts.options)),
+    ]);
+}
+function keyOf(instance) {
+    return JSON.stringify([instance.worktreeId, instance.cliToolId, instance.instanceId]);
+}
+/**
+ * Record an observation of a decision screen and return when this appearance
+ * of it was first observed.
+ *
+ * @param fingerprint - {@link screenFingerprint} of the screen
+ */
+function noteScreenAppearance(instance, fingerprint, now) {
+    const key = keyOf(instance);
+    const previous = appearances.get(key);
+    // Re-inserted, so the map's order is least recently observed first.
+    appearances.delete(key);
+    const firstSeenAt = previous?.fingerprint === fingerprint ? previous.firstSeenAt : Math.floor(now);
+    appearances.set(key, { fingerprint, firstSeenAt });
+    while (appearances.size > MAX_TRACKED_INSTANCES) {
+        const oldest = appearances.keys().next().value;
+        if (oldest === undefined)
+            break;
+        appearances.delete(oldest);
+    }
+    return firstSeenAt;
+}
+/** Record an observation of anything else: the instance's last screen has gone. */
+function forgetScreenAppearance(instance) {
+    appearances.delete(keyOf(instance));
+}

package/dist/server/src/lib/push/notification-dedup.js

@@ -60,15 +60,28 @@ const waitingSent = (0, global_state_1.getOrInitGlobal)('__waitingPushDedup', ()
  *  - the escalation → allowed exactly once per episode;
  *  - a new episode (the wait ended and another began) → sent again, even if the
  *    prompt text and the elapsed time are identical.
+ *
+ * Issue #3798: "the same episode" is the mixed rule `prompt-push-gate` holds
+ * its hold by — both ids present and equal, or one absent and the `since`s
+ * equal. Kept inline rather than imported: this module stays a leaf.
  */
 function shouldSendWaitingPush(event) {
     const key = `${event.worktreeId}::${event.instanceId}`;
     const escalated = event.escalated === true;
+    const episodeId = event.episodeId ?? undefined;
     const prev = waitingSent.get(key);
-    if (prev && prev.since === event.since && (prev.escalated || !escalated)) {
+    const sameEpisode = prev !== undefined &&
+        (prev.episodeId !== undefined && episodeId !== undefined
+            ? prev.episodeId === episodeId
+            : prev.since === event.since);
+    if (prev && sameEpisode && (prev.escalated || !escalated)) {
+        // An id-less producer recorded this wait first; it is named now.
+        if (prev.episodeId === undefined && episodeId !== undefined)
+            prev.episodeId = episodeId;
         return false;
     }
-    waitingSent.set(key, { since: event.since, escalated });
+    const recordedId = episodeId ?? (sameEpisode ? prev?.episodeId : undefined);
+    waitingSent.set(key, { since: event.since, ...(recordedId !== undefined ? { episodeId: recordedId } : {}), escalated });
     return true;
 }
 /** Clear the episode-scoped state (for tests). */

package/dist/server/src/lib/push/prompt-card-state.js

@@ -88,12 +88,27 @@
  * this module's; it is written up as a remaining limitation in §6.2 of the
  * design note and pinned by `tests/unit/push/restart-card-state-2057.test.ts`.
  *
+ * ## Which episode the card is about (Issue #3798)
+ *
+ * The mark also keeps the id of the waiting episode the card was last sent
+ * for, so the resolution can name it (`resolvedEpisodeId`) and the Service
+ * Worker can leave a newer episode's card alone. The id lives in a second row,
+ * {@link PROMPT_CARD_EPISODE_KEY_PREFIX}`<worktreeId>`, written in the same
+ * statement as the time row — one write, so a reader never sees a new time
+ * with an old id — and its value repeats the time (`<at>:<episodeId>`): an id
+ * whose time is not the time row's is not this card's and reads as none. The
+ * time row's value stays the bare timestamp it was before #3798, so a mark
+ * written by an older server (time row only) reads as a card with no id, and
+ * an older server reading a newer mark sees exactly what it wrote.
+ *
  * @module lib/push/prompt-card-state
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PROMPT_CARD_MAX_AGE_MS = exports.PROMPT_CARD_KEY_PREFIX = void 0;
+exports.PROMPT_CARD_MAX_AGE_MS = exports.PROMPT_ORDER_KEY_PREFIX = exports.PROMPT_CARD_EPISODE_KEY_PREFIX = exports.PROMPT_CARD_KEY_PREFIX = void 0;
 exports.markPromptCardShown = markPromptCardShown;
+exports.nextPromptOrder = nextPromptOrder;
 exports.hasPromptCard = hasPromptCard;
+exports.getPromptCardEpisodeId = getPromptCardEpisodeId;
 exports.clearPromptCard = clearPromptCard;
 exports.clearAllPromptCards = clearAllPromptCards;
 exports.forgetPromptCardMemory = forgetPromptCardMemory;
@@ -111,6 +126,20 @@ const logger = (0, logger_1.createLogger)('push/prompt-card-state');
  * spell another id's key.
  */
 exports.PROMPT_CARD_KEY_PREFIX = 'push_prompt_card:';
+/**
+ * `app_settings.key` prefix for the episode id beside one worktree's card mark
+ * (Issue #3798). Not matched by `${PROMPT_CARD_KEY_PREFIX}*`: the character
+ * after `push_prompt_card` is `_` here and `:` there.
+ */
+exports.PROMPT_CARD_EPISODE_KEY_PREFIX = 'push_prompt_card_episode:';
+/**
+ * `app_settings.key` prefix for one worktree's prompt push order (Issue #3798):
+ * a counter that moves once per episode-named waiting card and once per
+ * resolution that names its episode, so the Service Worker can tell a card
+ * sent after a resolution was decided from one sent before it. Not a card row:
+ * no card GLOB matches it and nothing clears it, so the order never goes back.
+ */
+exports.PROMPT_ORDER_KEY_PREFIX = 'push_prompt_order:';
 /**
  * How long a persisted mark is believed.
  *
@@ -144,25 +173,51 @@ exports.PROMPT_CARD_KEY_PREFIX = 'push_prompt_card:';
 exports.PROMPT_CARD_MAX_AGE_MS = 24 * 60 * 60 * 1000;
 /** worktreeId -> epoch ms the most recent prompt card was fanned out. */
 const cards = (0, global_state_1.getOrInitGlobal)('__promptPushCards', () => new Map());
+/**
+ * worktreeId -> the episode id that card was sent for, or null (Issue #3798).
+ * Set and dropped together with {@link cards}; a worktree in `cards` with no
+ * entry here reads as id-less.
+ */
+const cardEpisodes = (0, global_state_1.getOrInitGlobal)('__promptPushCardEpisodes', () => new Map());
 function keyFor(worktreeId) {
     return `${exports.PROMPT_CARD_KEY_PREFIX}${worktreeId}`;
 }
+function episodeKeyFor(worktreeId) {
+    return `${exports.PROMPT_CARD_EPISODE_KEY_PREFIX}${worktreeId}`;
+}
+/**
+ * The episode id from its row, if that row belongs to the mark written at `at`.
+ * `<at>:<id>`; an empty id, a different time or a malformed value is no id.
+ */
+function parseEpisodeValue(value, at) {
+    if (value === undefined)
+        return null;
+    const sep = value.indexOf(':');
+    if (sep < 0 || value.slice(0, sep) !== String(at))
+        return null;
+    const id = value.slice(sep + 1);
+    return id === '' ? null : id;
+}
 function isExpired(at, now) {
     return now - at >= exports.PROMPT_CARD_MAX_AGE_MS;
 }
 /** The persisted mark for one worktree, or null. Never throws. */
 function readRow(worktreeId) {
     try {
-        const row = (0, db_instance_1.getDbInstance)()
-            .prepare('SELECT value FROM app_settings WHERE key = ?')
-            .get(keyFor(worktreeId));
+        const rows = (0, db_instance_1.getDbInstance)()
+            .prepare('SELECT key, value FROM app_settings WHERE key IN (?, ?)')
+            .all(keyFor(worktreeId), episodeKeyFor(worktreeId));
+        const row = rows.find((r) => r.key === keyFor(worktreeId));
         if (!row)
             return null;
         const at = Number.parseInt(row.value, 10);
         // A value nobody can read is treated as no card: it fails towards *not*
         // spending a push, the same direction `decidePromptResolution` chose for a
         // database that cannot answer.
-        return Number.isFinite(at) ? at : null;
+        if (!Number.isFinite(at))
+            return null;
+        const episodeRow = rows.find((r) => r.key === episodeKeyFor(worktreeId));
+        return { at, episodeId: parseEpisodeValue(episodeRow?.value, at) };
     }
     catch (error) {
         logger.debug('prompt-card-read-failed', {
@@ -195,18 +250,24 @@ function readAllRows() {
         return [];
     }
 }
-/** Write one worktree's mark through to storage. Never throws. */
-function writeRow(worktreeId, at) {
+/**
+ * Write one worktree's mark through to storage. Never throws.
+ *
+ * Issue #3798: the time row and the episode row in one statement — an id-less
+ * mark writes an empty id, so a newer id-less card never leaves an older
+ * card's id behind.
+ */
+function writeRow(worktreeId, at, episodeId) {
     try {
         (0, db_instance_1.getDbInstance)()
             .prepare(`
         INSERT INTO app_settings (key, value, created_at, updated_at)
-        VALUES (?, ?, ?, ?)
+        VALUES (?, ?, ?, ?), (?, ?, ?, ?)
         ON CONFLICT(key) DO UPDATE SET
           value = excluded.value,
           updated_at = excluded.updated_at
       `)
-            .run(keyFor(worktreeId), String(at), at, at);
+            .run(keyFor(worktreeId), String(at), at, at, episodeKeyFor(worktreeId), `${at}:${episodeId ?? ''}`, at, at);
     }
     catch (error) {
         logger.debug('prompt-card-write-failed', {
@@ -218,8 +279,9 @@ function writeRow(worktreeId, at) {
 /** @returns True when a row was actually removed. Never throws. */
 function deleteRow(worktreeId) {
     try {
-        return ((0, db_instance_1.getDbInstance)().prepare('DELETE FROM app_settings WHERE key = ?').run(keyFor(worktreeId))
-            .changes > 0);
+        return ((0, db_instance_1.getDbInstance)()
+            .prepare('DELETE FROM app_settings WHERE key IN (?, ?)')
+            .run(keyFor(worktreeId), episodeKeyFor(worktreeId)).changes > 0);
     }
     catch (error) {
         logger.debug('prompt-card-delete-failed', {
@@ -235,10 +297,49 @@ function deleteRow(worktreeId) {
  * Idempotent by overwrite: a second prompt in the same worktree (another
  * instance, or the #1790 reminder) replaces the same card on the device, so it
  * refreshes the timestamp rather than adding an entry.
+ *
+ * @param episodeId Issue #3798: the waiting episode this card is about, or
+ *   null when the producer did not name one. The last card's id replaces the
+ *   previous one — the device shows one card per worktree.
  */
-function markPromptCardShown(worktreeId, at = Date.now()) {
+function markPromptCardShown(worktreeId, at = Date.now(), episodeId = null) {
     cards.set(worktreeId, at);
-    writeRow(worktreeId, at);
+    cardEpisodes.set(worktreeId, episodeId);
+    writeRow(worktreeId, at, episodeId);
+}
+/**
+ * Take this worktree's next prompt push order (Issue #3798). Never throws.
+ *
+ * One statement reads and advances the counter, so two decisions never share a
+ * value — not even within the same millisecond — and it survives a restart
+ * with the database. The episode's `since` cannot do this job: a structured
+ * since is reused by the next episode and can be older than the observation.
+ *
+ * @returns The new value, or null when storage cannot answer; the push then
+ *   carries no order and the Service Worker treats it as it did before #3798.
+ */
+function nextPromptOrder(worktreeId, at = Date.now()) {
+    try {
+        const row = (0, db_instance_1.getDbInstance)()
+            .prepare(`
+        INSERT INTO app_settings (key, value, created_at, updated_at)
+        VALUES (?, '1', ?, ?)
+        ON CONFLICT(key) DO UPDATE SET
+          value = CAST(app_settings.value AS INTEGER) + 1,
+          updated_at = excluded.updated_at
+        RETURNING value
+      `)
+            .get(`${exports.PROMPT_ORDER_KEY_PREFIX}${worktreeId}`, at, at);
+        const order = Number(row?.value);
+        return Number.isSafeInteger(order) && order > 0 ? order : null;
+    }
+    catch (error) {
+        logger.debug('prompt-order-advance-failed', {
+            worktreeId,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return null;
+    }
 }
 /**
  * Whether a prompt card for this worktree was fanned out and not yet cleared.
@@ -253,21 +354,38 @@ function markPromptCardShown(worktreeId, at = Date.now()) {
  *   {@link PROMPT_CARD_MAX_AGE_MS} without a fake clock.
  */
 function hasPromptCard(worktreeId, now = Date.now()) {
-    const at = cards.get(worktreeId) ?? readRow(worktreeId);
-    if (at === null || at === undefined)
+    const remembered = cards.get(worktreeId);
+    const mark = remembered !== undefined
+        ? { at: remembered, episodeId: cardEpisodes.get(worktreeId) ?? null }
+        : readRow(worktreeId);
+    if (mark === null)
         return false;
-    if (isExpired(at, now)) {
+    if (isExpired(mark.at, now)) {
         // Dropped as it is read rather than by a sweep: this is the only question
         // asked about a given worktree's card, so the read is the moment the
         // expiry becomes observable, and there is nothing a background pass would
         // catch earlier.
         cards.delete(worktreeId);
+        cardEpisodes.delete(worktreeId);
         deleteRow(worktreeId);
         return false;
     }
-    cards.set(worktreeId, at);
+    cards.set(worktreeId, mark.at);
+    cardEpisodes.set(worktreeId, mark.episodeId);
     return true;
 }
+/**
+ * The episode id the worktree's outstanding card was sent for (Issue #3798),
+ * or null — no card, or a card marked without an id (including every mark an
+ * older server wrote). Read the same way {@link hasPromptCard} reads the mark:
+ * memory first, storage after a restart. Does not expire anything; ask
+ * {@link hasPromptCard} first.
+ */
+function getPromptCardEpisodeId(worktreeId) {
+    if (cards.has(worktreeId))
+        return cardEpisodes.get(worktreeId) ?? null;
+    return readRow(worktreeId)?.episodeId ?? null;
+}
 /**
  * Forget this worktree's card, in memory and in storage.
  *
@@ -277,6 +395,7 @@ function hasPromptCard(worktreeId, now = Date.now()) {
  *   from `app_settings` still reports as cleared.
  */
 function clearPromptCard(worktreeId) {
+    cardEpisodes.delete(worktreeId);
     const wasInMemory = cards.delete(worktreeId);
     const wasPersisted = deleteRow(worktreeId);
     return wasInMemory || wasPersisted;
@@ -290,10 +409,11 @@ function clearPromptCard(worktreeId) {
  */
 function clearAllPromptCards() {
     cards.clear();
+    cardEpisodes.clear();
     try {
         (0, db_instance_1.getDbInstance)()
-            .prepare('DELETE FROM app_settings WHERE key GLOB ?')
-            .run(`${exports.PROMPT_CARD_KEY_PREFIX}*`);
+            .prepare('DELETE FROM app_settings WHERE key GLOB ? OR key GLOB ?')
+            .run(`${exports.PROMPT_CARD_KEY_PREFIX}*`, `${exports.PROMPT_CARD_EPISODE_KEY_PREFIX}*`);
     }
     catch (error) {
         logger.debug('prompt-card-clear-all-failed', {
@@ -312,6 +432,7 @@ function clearAllPromptCards() {
  */
 function forgetPromptCardMemory() {
     cards.clear();
+    cardEpisodes.clear();
 }
 /**
  * How many worktrees have an outstanding, unexpired card. Test seam.