commandmate 0.47.0 → 0.48.0

package/dist/server/src/lib/push/prompt-push-gate.js

@@ -47,6 +47,12 @@
  * `at` lines up with the current wait. Here that is `at >= waitingSince` — the
  * suppression was recorded at or after this episode opened. A record from an
  * earlier episode is older than `since` and is ignored.
+ * Issue #3798: a record that names its episode (`episodeId`) is matched to a
+ * wait that names one by that id instead, since two episodes can share a
+ * `since`; either side without an id falls back to the time comparison. A
+ * record of the episode the poller then answered (`lastAnswer`), written
+ * before that answer, is not the wait's reason any more: the success path of
+ * a send does not clear the record, and the answer is the newer fact.
  *
  * The poller re-evaluates a suppressed prompt on every poll (the duplicate
  * guard only remembers *answered* prompts), so `at` stays current for as long
@@ -75,6 +81,20 @@
  * second prompt right after an answer gets a full hold of its own. Both
  * producers ask through {@link decideAndLogPromptPush} and share that origin.
  *
+ * ## Which hold belongs to which wait (Issue #3798)
+ *
+ * A wait is named by its episode id when the caller has one
+ * (`waitingEpisodeId`), and by `waitingSince` when it does not. The two are
+ * matched by the rule {@link isSameWait} states, the same rule the episode
+ * dedup in `notification-dedup` uses: both ids present and equal, or one of
+ * them absent and the `since`s equal. So an id-less producer (opencode's
+ * question push, or the response poller when its commit changed nothing —
+ * otherwise it names the episode it committed) and the id-bearing notifier asking about
+ * one wait share one hold, and the session wait's tick (#3796) is read once,
+ * when that hold begins. A rebind keeps the id, so it keeps the hold and its
+ * end; a replacement brings a new id, so it begins a new hold that reads the
+ * tick at its own start — even when the new wait reuses the old `since`.
+ *
  * ## The hold reaches the session wait's tick (Issue #3791)
  *
  * The 9 s assume the poller's next tick is at most a cooldown away. Its ticks
@@ -93,6 +113,38 @@
  * that tick forward to a poll interval, and the hold follows it — the tick is
  * only ever read earlier than it was when the hold began.
  *
+ * The other tick past the 9 s is the duplicate guard's (#306). A prompt with
+ * the type and question of the one the poller just answered — Claude's
+ * consecutive Bash approvals all ask `Do you want to proceed?` — is not
+ * answered for `DUPLICATE_RETRY_EXPIRY_MS` (10 s) after that answer, and is
+ * answered on the first tick after. While the poller reports that the guard
+ * actually held back the prompt of this wait (`duplicateRetryReservation`,
+ * review N1: its tick matched the guard's key, since this wait opened, and no
+ * tick since read another screen, no prompt, no session or failed; the tick
+ * sending the retry keeps it until that send is settled, review N3) the hold
+ * also lasts until that retry plus two ticks: {@link duplicateRetryHoldEndsAt}.
+ * An answer alone does not: a different screen the poller will not answer, or
+ * an error backoff, after an answer still notifies at the usual 9 s. Read on
+ * every decision, not once: the reservation appears on the poller's next tick,
+ * after the wait may already be held, and the notifier asks again when the 9 s
+ * end.
+ *
+ * ## A wait the poller answered is not "not answered" (Issue #3798)
+ *
+ * The poller records which episode its answer went to (`lastAnswer`, read off
+ * its state on `globalThis` like the answer's time), and closes that episode
+ * when the confirmation is gone. Until a frame says so — the agent works on
+ * over frames no rule reads — the episode stays open, and its hold can run
+ * out. That end is not "Auto-Yes did not answer": when the wait asked about
+ * names its id and it is the answered episode, still open and not a screen
+ * only a person drives, the gate says `auto-yes-answered` and stays quiet.
+ * Another confirmation in the same turn is another episode (R1-7), and a
+ * survey or a picker after the answer turns the episode into a `screen`: both
+ * notify as before. Without an id on either side nothing is matched, and the
+ * hold's end notifies as before. The hold itself is unchanged — its start, its
+ * end, the session wait's tick (#3796) and the duplicate guard's retry (#3791)
+ * are counted as above.
+ *
  * ## The reminder is never muted
  *
  * `runEscalationTick` has already established that the wait is still open — it
@@ -109,17 +161,20 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AUTO_YES_HOLD_MAX_AGE_MS = exports.AUTO_YES_ANSWER_AFTER_TICK_MS = exports.AUTO_YES_ANSWER_GRACE_MS = void 0;
+exports.isSameWait = isSameWait;
 exports.autoYesHoldStartedAt = autoYesHoldStartedAt;
 exports.autoYesHoldEndsAt = autoYesHoldEndsAt;
 exports.forgetAutoYesHold = forgetAutoYesHold;
 exports.clearAutoYesHolds = clearAutoYesHolds;
 exports.decidePromptPush = decidePromptPush;
+exports.autoYesAnsweredWait = autoYesAnsweredWait;
 exports.isPromptPushSuppressed = isPromptPushSuppressed;
 exports.decideAndLogPromptPush = decideAndLogPromptPush;
 const auto_yes_state_1 = require("../../lib/auto-yes-state");
 const logger_1 = require("../../lib/logger");
 const auto_yes_suppression_state_1 = require("../../lib/polling/auto-yes-suppression-state");
 const global_state_1 = require("../../lib/global-state");
+const waiting_episode_state_1 = require("../../lib/session/waiting-episode-state");
 const logger = (0, logger_1.createLogger)('push/prompt-gate');
 /**
  * How long a wait with nothing recorded about it is held as "Auto-Yes is
@@ -132,6 +187,20 @@ const logger = (0, logger_1.createLogger)('push/prompt-gate');
 exports.AUTO_YES_ANSWER_GRACE_MS = Math.max(3 * auto_yes_state_1.POLLING_INTERVAL_MS, auto_yes_state_1.COOLDOWN_INTERVAL_MS + 2 * auto_yes_state_1.POLLING_INTERVAL_MS);
 /** compositeKey -> the hold of that session's current episode. globalThis per #1736. */
 const autoYesHolds = (0, global_state_1.getOrInitGlobal)('__promptPushAutoYesHolds', () => new Map());
+/**
+ * Whether two names are the same wait (Issue #3798): both ids present and
+ * equal, or one of them absent and the `since`s equal. The id decides whenever
+ * both sides have one — two waits can share a `since` (the same millisecond, a
+ * structured `at` reused by the next prompt), and one wait keeps its id across
+ * a rebind.
+ */
+function isSameWait(a, b) {
+    const aId = a.episodeId ?? null;
+    const bId = b.episodeId ?? null;
+    if (aId !== null && bId !== null)
+        return aId === bId;
+    return a.since === b.since;
+}
 /**
  * Where this wait's `auto-yes-answering` hold is counted from (Issue #3757):
  * the later of the moment the gate first held this episode (recorded here on
@@ -146,11 +215,21 @@ const autoYesHolds = (0, global_state_1.getOrInitGlobal)('__promptPushAutoYesHol
 function autoYesHoldStartedAt(input, now) {
     const key = (0, auto_yes_state_1.buildCompositeKey)(input.worktreeId, input.cliToolId, input.instanceId);
     sweepStaleAutoYesHolds(now);
+    const episodeId = input.waitingEpisodeId ?? undefined;
     let hold = autoYesHolds.get(key);
-    if (hold === undefined || hold.since !== input.waitingSince) {
-        hold = { since: input.waitingSince, firstHeldAt: now, sessionWaitTick: pendingSessionWaitTick(key, now) };
+    if (hold === undefined || !isSameWait(hold, { since: input.waitingSince, episodeId })) {
+        hold = {
+            since: input.waitingSince,
+            ...(episodeId !== undefined ? { episodeId } : {}),
+            firstHeldAt: now,
+            sessionWaitTick: pendingSessionWaitTick(key, now),
+        };
         autoYesHolds.set(key, hold);
     }
+    else if (hold.episodeId === undefined && episodeId !== undefined) {
+        // Issue #3798: an id-less caller began this hold; the wait is now named.
+        hold.episodeId = episodeId;
+    }
     // Issue #3770: Auto-Yes switched off and on again inside one episode starts a
     // fresh hold; the old origin would read the poller's silence while it was off
     // as "did not answer".
@@ -199,7 +278,8 @@ function effectiveSessionWaitTickAt(tick) {
  * When this wait's `auto-yes-answering` hold ends (Issue #3791): a full
  * {@link AUTO_YES_ANSWER_GRACE_MS} after {@link autoYesHoldStartedAt}, and not
  * before {@link AUTO_YES_ANSWER_AFTER_TICK_MS} past the session wait's tick
- * pending when the hold began — while the poller that scheduled it still runs.
+ * pending when the hold began — while the poller that scheduled it still runs —
+ * nor past the duplicate guard's retry the poller reserved for this wait.
  *
  * @param now - Epoch ms of the decision; recorded as the start of a new hold
  */
@@ -208,14 +288,35 @@ function autoYesHoldEndsAt(input, now) {
     const key = (0, auto_yes_state_1.buildCompositeKey)(input.worktreeId, input.cliToolId, input.instanceId);
     const tick = autoYesHolds.get(key)?.sessionWaitTick;
     const graceEndsAt = startedAt + exports.AUTO_YES_ANSWER_GRACE_MS;
+    const holdEndsAt = Math.max(graceEndsAt, duplicateRetryHoldEndsAt(key, input.waitingSince));
     // A poller stopped or replaced since (disable, off → on) will not tick.
     if (tick === undefined || globalThis.__autoYesPollerStates?.get(key) !== tick.poller)
-        return graceEndsAt;
+        return holdEndsAt;
     // Kept on the hold: an earlier tick once adopted is not lost when the poller
     // later reschedules (an ordinary tick after a failed capture, a new session
     // wait) — the hold never moves back out.
     tick.at = effectiveSessionWaitTickAt(tick);
-    return Math.max(graceEndsAt, tick.at + exports.AUTO_YES_ANSWER_AFTER_TICK_MS);
+    return Math.max(holdEndsAt, tick.at + exports.AUTO_YES_ANSWER_AFTER_TICK_MS);
+}
+/**
+ * Issue #3791: when the duplicate guard (#306) lets the running poller answer
+ * again, plus {@link AUTO_YES_ANSWER_AFTER_TICK_MS} — or -Infinity unless the
+ * poller reserved that retry for this wait (review N1): a reservation on the
+ * live poller (`__autoYesPollerStates`, so a stopped or replaced one has none),
+ * made by a tick since the wait opened, for the answer the guard still counts
+ * from. Read off `globalThis` for the reason {@link autoYesHoldStartedAt} gives.
+ */
+function duplicateRetryHoldEndsAt(key, waitingSince) {
+    const poller = globalThis.__autoYesPollerStates?.get(key);
+    const reservation = poller?.duplicateRetryReservation;
+    if (poller === undefined || reservation === undefined || reservation === null)
+        return -Infinity;
+    if (reservation.observedAt < waitingSince)
+        return -Infinity;
+    if (reservation.answeredAt !== poller.lastAnsweredAt || reservation.promptKey !== poller.lastAnsweredPromptKey) {
+        return -Infinity;
+    }
+    return reservation.answeredAt + auto_yes_state_1.DUPLICATE_RETRY_EXPIRY_MS + exports.AUTO_YES_ANSWER_AFTER_TICK_MS;
 }
 /** A hold older than this is dropped (Issue #3770): its episode is long over. */
 exports.AUTO_YES_HOLD_MAX_AGE_MS = 60 * 60 * 1000;
@@ -229,14 +330,21 @@ function sweepStaleAutoYesHolds(now) {
  * Drop the hold of one session (Issue #3770): Auto-Yes went off, or the
  * episode closed.
  *
- * @param since - Issue #3776: drop it only when it is this episode's hold. A
+ * @param wait - Issue #3776: drop it only when it is this episode's hold. A
  *   caller retiring one episode must not take the next episode's origin with it
  *   (that hold would start over, and its notification come up to a hold late).
- *   Omitted, the session's hold goes whatever its episode.
+ *   A number is the episode's `since`; Issue #3798 adds the episode's id, matched
+ *   by {@link isSameWait}. Omitted, the session's hold goes whatever its episode.
  */
-function forgetAutoYesHold(key, since) {
-    if (since !== undefined && autoYesHolds.get(key)?.since !== since)
-        return;
+function forgetAutoYesHold(key, wait) {
+    if (wait !== undefined) {
+        const hold = autoYesHolds.get(key);
+        if (hold === undefined)
+            return;
+        const identity = typeof wait === 'number' ? { since: wait } : wait;
+        if (!isSameWait(hold, identity))
+            return;
+    }
     autoYesHolds.delete(key);
 }
 /** Forget every hold. Test seam. */
@@ -251,13 +359,16 @@ function clearAutoYesHolds() {
  * rather than only the outcome.
  */
 function decidePromptPush(input) {
-    const { worktreeId, cliToolId, instanceId, waitingSince } = input;
+    const { worktreeId, cliToolId, instanceId } = input;
     const state = (0, auto_yes_state_1.getAutoYesState)(worktreeId, cliToolId, instanceId);
     if (state === null || !state.enabled) {
         return { suppress: false, reason: 'auto-yes-inactive', stopReason: state?.stopReason };
     }
     const suppression = (0, auto_yes_suppression_state_1.getLastPolicySuppression)(worktreeId, cliToolId, instanceId);
-    if (suppression !== null && suppression.at >= waitingSince) {
+    if (suppression !== null &&
+        suppressionBelongsToWait(suppression, input) &&
+        // The answer that came after the record is the newer fact (Issue #3798).
+        !(0, auto_yes_suppression_state_1.suppressionPredatesAnswer)(suppression, input.waitingEpisodeId, answerTo(input))) {
         return { suppress: false, reason: 'policy-withheld', suppressedBy: suppression.reason };
     }
     if (input.escalated === true) {
@@ -265,10 +376,44 @@ function decidePromptPush(input) {
     }
     const holdEndsAt = input.holdEndsAt ?? (input.holdStartedAt !== undefined ? input.holdStartedAt + exports.AUTO_YES_ANSWER_GRACE_MS : undefined);
     if (holdEndsAt !== undefined && (input.now ?? Date.now()) >= holdEndsAt) {
+        if (autoYesAnsweredWait(input))
+            return { suppress: true, reason: 'auto-yes-answered' };
         return { suppress: false, reason: 'auto-yes-not-answered' };
     }
     return { suppress: true, reason: 'auto-yes-answering' };
 }
+/**
+ * Whether the Auto-Yes poller answered this wait (Issue #3798): the caller
+ * names the episode, the poller's `lastAnswer` names the same one, and that
+ * episode is still the one open and not a screen only a person drives (a
+ * survey or a picker after the answer is rebound to `screen` under the same
+ * id, and a person has to act on it). Read off the poller state on
+ * `globalThis`, as {@link autoYesHoldStartedAt} reads the answer's time.
+ */
+function autoYesAnsweredWait(input) {
+    const waitId = input.waitingEpisodeId ?? null;
+    if (waitId === null || answerTo(input)?.episodeId !== waitId)
+        return false;
+    const episode = (0, waiting_episode_state_1.getWaitingEpisodeRecord)(input.worktreeId, input.cliToolId, input.instanceId);
+    return episode !== null && episode.episodeId === waitId && episode.binding.kind !== 'screen';
+}
+/** The poller's `lastAnswer` for this instance, read off `globalThis` (Issue #3798). */
+function answerTo(input) {
+    const key = (0, auto_yes_state_1.buildCompositeKey)(input.worktreeId, input.cliToolId, input.instanceId);
+    return globalThis.__autoYesPollerStates?.get(key)?.lastAnswer ?? null;
+}
+/**
+ * Whether a policy-suppression record is about this wait (Issue #3798). By the
+ * episode id when both the record and the caller carry one — a record written
+ * for an earlier episode is not this wait's reason however recent its `at` —
+ * and by #1684's `at >= waitingSince` otherwise.
+ */
+function suppressionBelongsToWait(suppression, input) {
+    const waitId = input.waitingEpisodeId ?? null;
+    if (suppression.episodeId !== undefined && waitId !== null)
+        return suppression.episodeId === waitId;
+    return suppression.at >= input.waitingSince;
+}
 /**
  * {@link decidePromptPush}, logged.
  *
@@ -303,6 +448,7 @@ function decideAndLogPromptPush(input, options = {}) {
         cliToolId: input.cliToolId,
         instanceId: input.instanceId ?? input.cliToolId,
         waitingSince: input.waitingSince,
+        ...(input.waitingEpisodeId ? { waitingEpisodeId: input.waitingEpisodeId } : {}),
         escalated: input.escalated === true,
         reason: decision.reason,
         ...(decision.stopReason !== undefined ? { stopReason: decision.stopReason } : {}),

package/dist/server/src/lib/push/push-sender.js

@@ -160,7 +160,9 @@ function buildFailureBody(event, messages, excerpt, locale) {
         : messages[keys.plain];
 }
 /** Build the minimal notification payload for an event, in the reader's language. */
-function buildPushPayload(event, locale = i18n_config_1.DEFAULT_LOCALE, now = Date.now()) {
+function buildPushPayload(event, locale = i18n_config_1.DEFAULT_LOCALE, now = Date.now(), 
+/** Issue #3798: the prompt push order taken for this fan-out, if any. */
+order = null) {
     const excerpt = buildExcerpt(event.excerpt);
     const agentSuffix = event.agentName ? ` (${event.agentName})` : '';
     const title = `${event.worktreeName}${agentSuffix}`;
@@ -208,6 +210,12 @@ function buildPushPayload(event, locale = i18n_config_1.DEFAULT_LOCALE, now = Da
         timestamp: now,
         ...(event.waitingKind ? { waitingKind: event.waitingKind } : {}),
         ...(event.resolved === true ? { resolved: true } : {}),
+        ...(event.kind === 'prompt' && event.resolved !== true && event.waitingEpisodeId
+            ? { episodeId: event.waitingEpisodeId, ...(typeof order === 'number' ? { order } : {}) }
+            : {}),
+        ...(event.resolved === true && event.resolvedEpisodeId
+            ? { resolvedEpisodeId: event.resolvedEpisodeId, ...(typeof order === 'number' ? { order } : {}) }
+            : {}),
     };
 }
 /**
@@ -296,6 +304,7 @@ function passesDedup(event) {
             worktreeId: event.worktreeId,
             instanceId: event.instanceId ?? event.agentName ?? '',
             since: event.waitingSince,
+            episodeId: event.waitingEpisodeId,
             escalated: event.escalated,
         });
     }
@@ -334,8 +343,19 @@ async function notifyPushSubscribers(event, now = Date.now()) {
         // itself does not mark; it clears, and it does so in its own module so each
         // direction has one writer.
         if (event.kind === 'prompt' && event.resolved !== true) {
-            (0, prompt_card_state_1.markPromptCardShown)(event.worktreeId, now);
+            // Issue #3798: with the episode's id, so the resolution can tell its own
+            // card from a newer one (`resolvedEpisodeId`).
+            (0, prompt_card_state_1.markPromptCardShown)(event.worktreeId, now, event.waitingEpisodeId ?? null);
         }
+        // Issue #3798: the order is taken here, synchronously with the decision to
+        // send — for a resolution, in the same tick `notifyPromptResolved` found
+        // nothing waiting — so a card taken after it compares greater on every
+        // device, whichever arrives first. Only pushes the Service Worker compares
+        // take one: an episode-named card, and a resolution naming its episode.
+        const order = event.kind === 'prompt' &&
+            (event.resolved === true ? Boolean(event.resolvedEpisodeId) : Boolean(event.waitingEpisodeId))
+            ? (0, prompt_card_state_1.nextPromptOrder)(event.worktreeId, now)
+            : null;
         web_push_1.default.setVapidDetails(config.subject, config.publicKey, config.privateKey);
         // Devices can be registered in different languages, so the body is built per
         // distinct locale rather than once for the whole fan-out.
@@ -349,7 +369,7 @@ async function notifyPushSubscribers(event, now = Date.now()) {
                 byLocale.set(locale, [sub]);
         }
         const outcomes = (await Promise.all(Array.from(byLocale, ([locale, subs]) => {
-            const payload = JSON.stringify(buildPushPayload(event, locale, now));
+            const payload = JSON.stringify(buildPushPayload(event, locale, now, order));
             return Promise.all(subs.map((sub) => sendToOne(sub, payload, now)));
         }))).flat();
         // Issue #2124: a fan-out that reached nobody used to be indistinguishable

package/dist/server/src/lib/push/resolution-push-notifier.js

@@ -56,6 +56,16 @@
  *    exist, so a single-device install sends exactly as many pushes as it did
  *    before this module was written — zero extra.
  *
+ * ## Which card it clears (Issue #3798)
+ *
+ * The resolution names the episode the card mark was last sent for
+ * (`resolvedEpisodeId`). A resolution can reach a device after the card of a
+ * newer wait in the same worktree — the next prompt's push overtook it — and
+ * without the name the Service Worker would close that newer, still-true card.
+ * With it, the worker closes only this episode's cards (and cards that name no
+ * episode) and re-shows the newer one silently. A mark without an id sends a
+ * resolution without one, which the worker handles exactly as before.
+ *
  * `completion` and `failure` cards are deliberately left alone; the reasoning
  * for each is in the design note under "which kinds are cleared".
  *
@@ -170,6 +180,9 @@ async function notifyPromptResolved(input) {
         reason: decision.reason,
         ...(decision.deviceCount !== undefined ? { deviceCount: decision.deviceCount } : {}),
     };
+    // Issue #3798: read before the mark is cleared below; `decidePromptResolution`
+    // has just adopted it into memory, so this is not a second query.
+    const resolvedEpisodeId = decision.send ? (0, prompt_card_state_1.getPromptCardEpisodeId)(worktreeId) : null;
     if (decision.reason !== 'still-waiting') {
         (0, prompt_card_state_1.clearPromptCard)(worktreeId);
     }
@@ -193,6 +206,7 @@ async function notifyPromptResolved(input) {
             kind: 'prompt',
             agentName,
             resolved: true,
+            ...(resolvedEpisodeId !== null ? { resolvedEpisodeId } : {}),
         }, at);
         logger.info('resolution-push-sent', context);
     }