commandmate 0.47.2 → 0.48.0

package/dist/server/src/lib/polling/auto-yes-poller-receipt-log.js

@@ -22,6 +22,8 @@ const auto_yes_resolver_1 = require("./auto-yes-resolver");
 const auto_yes_policy_1 = require("./auto-yes-policy");
 const logger_1 = require("../../lib/logger");
 const global_state_1 = require("../global-state");
+const prompt_screen_key_1 = require("../detection/prompt-screen-key");
+const auto_yes_poller_state_1 = require("./auto-yes-poller-state");
 const auto_yes_suppression_reason_1 = require("./auto-yes-suppression-reason");
 const auto_yes_suppression_state_1 = require("./auto-yes-suppression-state");
 const logger = (0, logger_1.createLogger)('auto-yes-poller');
@@ -70,12 +72,20 @@ const WITHHELD_NO_RECEIPT_LOG_INTERVAL_MS = 60_000;
  * ungated reading this function already took, and the reason it recorded.
  *
  * @param compositeKey - The instance's key, for the once-a-minute limit
+ * Issue #3880: a person's send that may have left keys on the pane holds the
+ * dialog (`partial-answer`), but no tick inside the window published it — the
+ * manual hold kept them off it — so there is no record to re-stamp. Given that
+ * hold's screen, a dialog still up at it is withheld as `partial-answer` here,
+ * before the contract and the receipt (as on the tick, step 2.5).
+ *
  * @param readWithoutGate - The same frame read without `receiptScope`
+ * @param personHoldScreenKey - The screen of a person's hold the tick had
+ *   (`PartialAutoYesAnswer.byPerson`), else null
  * @returns The prompt the ungated reading saw, with the reason this call
  *   recorded or kept for it (null when none: a dialog the gate accepted and is
  *   waiting to be answered); null when no dialog was read past the gate
  */
-function logIfWithheldForWantOfReceipt(worktreeId, instanceId, compositeKey, readWithoutGate) {
+function logIfWithheldForWantOfReceipt(worktreeId, instanceId, compositeKey, readWithoutGate, personHoldScreenKey = null) {
     // Issue #3767: the gate's own verdict for this tick's candidate. Null means it
     // never saw one (no dialog), `ok` that it let the frame through.
     let verdict = (0, antigravity_receipt_episodes_1.getAntigravityReceiptVerdict)(worktreeId, instanceId);
@@ -91,6 +101,14 @@ function logIfWithheldForWantOfReceipt(worktreeId, instanceId, compositeKey, rea
     verdict ??= (0, antigravity_receipt_episodes_1.judgeAntigravityPermissionReceipt)(worktreeId, instanceId, now);
     if (verdict.ok)
         return null;
+    if (personHoldScreenKey !== null && (0, auto_yes_poller_state_1.partialAnswerCovers)(personHoldScreenKey, (0, prompt_screen_key_1.promptScreenKey)(promptData))) {
+        (0, auto_yes_suppression_state_1.recordPolicySuppression)(worktreeId, 'antigravity', instanceId, {
+            reason: auto_yes_suppression_reason_1.PARTIAL_ANSWER_SUPPRESSION_REASON,
+            mode: null,
+            promptType: promptData.type,
+        });
+        return { promptData, reason: auto_yes_suppression_reason_1.PARTIAL_ANSWER_SUPPRESSION_REASON, keptPersonHold: true };
+    }
     // Issue #3724: a contract that withholds the answer makes the server reply
     // `ask`, so the dialog stays up past the receipt window. The cause is then the
     // contract, not a hooks.json that points elsewhere. Judged exactly as the tick
@@ -102,7 +120,7 @@ function logIfWithheldForWantOfReceipt(worktreeId, instanceId, compositeKey, rea
     // dropping the `policy-lookup-failed` record the tick made.
     const { policy, taskId } = (0, auto_yes_policy_1.getSessionAutoYesPolicyLookupEntry)(worktreeId, 'antigravity', instanceId);
     const mode = (0, auto_yes_resolver_1.policyLookupMode)(policy);
-    const resolution = (0, auto_yes_resolver_1.resolveAutoAnswerWithPolicy)(ungated.promptData, policy);
+    const resolution = (0, auto_yes_resolver_1.resolveAutoAnswerWithPolicy)(ungated.promptData, policy, 'antigravity');
     // Issue #3767: `answered` is the dialog the gate already let through on this
     // receipt, still up past the window. Unless the contract withheld it, that is
     // not a missing receipt: neither recorded nor logged, nor counted for the limit.
@@ -149,9 +167,7 @@ function logIfWithheldForWantOfReceipt(worktreeId, instanceId, compositeKey, rea
             reason: resolution.suppressedBy,
             mode,
             taskId,
-            hint: resolution.suppressedBy === auto_yes_suppression_reason_1.POLICY_LOOKUP_FAILED_SUPPRESSION_REASON
-                ? '契約の照会に失敗したので答えていない。サーバーログの policy-lookup-failed を確認'
-                : '契約の autoYes が答えを止めている。契約の autoYes を確認',
+            hint: withheldHint(resolution.suppressedBy),
         });
         return seen(contractReason ?? null);
     }
@@ -172,6 +188,24 @@ function logIfWithheldForWantOfReceipt(worktreeId, instanceId, compositeKey, rea
     });
     return seen(auto_yes_suppression_reason_1.NO_HOOK_RECEIPT_SUPPRESSION_REASON);
 }
+/**
+ * The hint of `antigravity-autoyes-withheld-by-policy` for `reason`. Issue
+ * #3822: the base rules' withholding (`allow-once-unidentified`) is not the
+ * contract's, so the line does not send the operator to the contract for it.
+ */
+function withheldHint(reason) {
+    if (reason === auto_yes_suppression_reason_1.POLICY_LOOKUP_FAILED_SUPPRESSION_REASON) {
+        return '契約の照会に失敗したので答えていない。サーバーログの policy-lookup-failed を確認';
+    }
+    // Issue #3863: the other base-rule withholding, over a question's recommended option.
+    if (reason === auto_yes_suppression_reason_1.RECOMMENDED_OPTION_UNIDENTIFIED_SUPPRESSION_REASON) {
+        return '質問の推奨の選択肢を 1 つに特定できないので答えていない（基本の判定。契約の判定ではない）。画面で答える';
+    }
+    if ((0, auto_yes_suppression_reason_1.isBaseRuleSuppressionReason)(reason)) {
+        return '今回だけ許可の選択肢を 1 つに特定できないので答えていない（基本の判定。契約の判定ではない）。画面で答える';
+    }
+    return '契約の autoYes が答えを止めている。契約の autoYes を確認';
+}
 /**
  * Whether a withheld line for `compositeKey` is due at `now` under the
  * once-a-minute limit; when it is, entries past the interval are pruned and
@@ -218,6 +252,9 @@ function refreshEpisodeSuppression(worktreeId, instanceId, verdict, resolution)
         // up (same episode, accepted on the same receipt). Not `getPartialAnswer`:
         // the tick forgets it as soon as the gated reading stops seeing the prompt,
         // which past the window is every tick.
+        // Issue #3798: re-stamped under the waiting episode it was recorded for
+        // (`episodeId` is carried over), not whichever is open now — the keys went
+        // to that wait's dialog.
         const { at: _recordedAt, ...suppression } = own;
         (0, auto_yes_suppression_state_1.recordPolicySuppression)(worktreeId, 'antigravity', instanceId, suppression);
         return true;

package/dist/server/src/lib/polling/auto-yes-poller-state.js

@@ -6,15 +6,24 @@
  * `AutoYesPollerState`. Must not import auto-yes-poller.ts (cycle).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.partialAnswerScreenKey = exports.UNIDENTIFIED_SCREEN_KEY = void 0;
+exports.getAutoYesLastAnswer = getAutoYesLastAnswer;
 exports.promptFrameKey = promptFrameKey;
 exports.warnOncePerFrame = warnOncePerFrame;
-exports.partialAnswerScreenKey = partialAnswerScreenKey;
+exports.partialAnswerCovers = partialAnswerCovers;
 exports.ledgerScreenKey = ledgerScreenKey;
+exports.approvalTargetWithoutCursor = approvalTargetWithoutCursor;
 exports.getPartialAnswer = getPartialAnswer;
 exports.forgetPartialAnswer = forgetPartialAnswer;
+exports.personSendsInFlight = personSendsInFlight;
 exports.forgetPartialAnswersByWorktree = forgetPartialAnswersByWorktree;
+exports.releasePartialAnswerToHuman = releasePartialAnswerToHuman;
+exports.identifyPartialAnswerScreen = identifyPartialAnswerScreen;
+exports.keepPartialAnswerByPerson = keepPartialAnswerByPerson;
+exports.nextSendOrder = nextSendOrder;
 exports.clearPartialAnswers = clearPartialAnswers;
 exports.beginSendAttempt = beginSendAttempt;
+exports.beginManualSendAttempt = beginManualSendAttempt;
 exports.settleSendAttempt = settleSendAttempt;
 exports.hasMovedSendInFlight = hasMovedSendInFlight;
 exports.movePartialAnswers = movePartialAnswers;
@@ -24,7 +33,17 @@ const auto_yes_state_1 = require("../auto-yes-state");
 const global_state_1 = require("../global-state");
 const auto_yes_enter_fallback_state_1 = require("./auto-yes-enter-fallback-state");
 const appearance_1 = require("../prompt-observation/appearance");
+const prompt_screen_key_1 = require("../detection/prompt-screen-key");
 const logger = (0, logger_1.createLogger)('auto-yes-poller');
+/**
+ * The Auto-Yes poller's last answer for one instance (Issue #3798), for the
+ * other observers of the same waiting episode (the response poller). Read off
+ * `globalThis` (`__autoYesPollerStates`) as the push gate reads the poller's
+ * answer time, so a reader need not import the poller.
+ */
+function getAutoYesLastAnswer(compositeKey) {
+    return globalThis.__autoYesPollerStates?.get(compositeKey)?.lastAnswer ?? null;
+}
 /**
  * Issue #2995: what makes two ticks "the same prompt" for `warnOncePerFrame`.
  *
@@ -65,41 +84,21 @@ function warnOncePerFrame(pollerState, frameKey, event, fields) {
     logger.warn(event, fields);
 }
 /**
- * Which prompt a stopped answer is about (Issue #3706): the type, the question,
- * the option labels and `approvalTarget` — what {@link promptFrameKey} tells
- * apart — but NOT where the cursor is. The keys that were sent may have moved
- * the cursor themselves (a `Down` whose Enter was withheld), and that must not
- * make the same list read as a new one; a different list or a different command
- * under the same question is a new prompt and is answered.
- */
-function partialAnswerScreenKey(promptData) {
-    const options = promptData.type === 'multiple_choice'
-        ? promptData.options.map((o) => `${o.number}.${o.label}`).join('\n')
-        : promptData.options.join('\n');
-    return [(0, prompt_key_1.generatePromptKey)(promptData), options, withoutCursorMarks(promptData)].join('\u0000');
-}
-/**
- * `approvalTarget` with the cursor taken out: the generic parser copies the
- * option panel into it, `❯` row included, so a moved cursor would otherwise
- * read as another prompt.
- *
- * [Issue #3817] Only the rows the block reader adopted as the options are
- * aligned (`approvalTargetWithOptionRowsAligned`, the reading #3812 gives the
- * strict respond), so two commands whose bodies differ by an indent or a `>`
- * are two screens. A label the block reader read may run longer than the
- * prompt's — it folds wrapped rows and the footer in — so it only has to start
- * with it. A yes/no prompt has no cursor and is read as it is. A list whose
- * rows cannot be told that way keeps the old reading below: two bodies then
- * read as one screen, which holds the prompt for a human rather than typing
- * the answer twice.
+ * The screen key of a person's send made with no prompt read off the screen
+ * (Issue #3880: the capture before it failed). A hold at it covers whatever
+ * confirmation the next tick reads, and takes that confirmation's key there
+ * ({@link identifyPartialAnswerScreen}); from then on it is released like any
+ * other — the screen changing, the session relaunched, a person's answer going
+ * through — and before then by a frame with no prompt on it.
  */
-function withoutCursorMarks(promptData) {
-    const target = promptData.approvalTarget ?? '';
-    if (promptData.type !== 'multiple_choice')
-        return target;
-    const aligned = (0, appearance_1.approvalTargetWithOptionRowsAligned)(target, promptData.options.map((o) => o.label), (read, named) => read.startsWith(named));
-    return aligned ?? withoutLeadingMarks(target);
+exports.UNIDENTIFIED_SCREEN_KEY = '\u0000unidentified-screen';
+/** Whether a hold (or a send) at `heldScreenKey` covers the confirmation at `screenKey`. */
+function partialAnswerCovers(heldScreenKey, screenKey) {
+    return heldScreenKey === screenKey || heldScreenKey === exports.UNIDENTIFIED_SCREEN_KEY;
 }
+/** Issue #3798: moved to `detection/prompt-screen-key`, where the waiting episodes read it too. */
+var prompt_screen_key_2 = require("../detection/prompt-screen-key");
+Object.defineProperty(exports, "partialAnswerScreenKey", { enumerable: true, get: function () { return prompt_screen_key_2.promptScreenKey; } });
 /**
  * Which confirmation the ledger counts a prompt as (Issue #3820): the
  * {@link partialAnswerScreenKey} reading where the option rows can be told,
@@ -115,14 +114,32 @@ function withoutCursorMarks(promptData) {
  */
 function ledgerScreenKey(promptData) {
     if (promptData.type !== 'multiple_choice')
-        return partialAnswerScreenKey(promptData);
+        return (0, prompt_screen_key_1.promptScreenKey)(promptData);
     const target = promptData.approvalTarget ?? '';
     const aligned = (0, appearance_1.approvalTargetWithOptionRowsAligned)(target, promptData.options.map((o) => o.label), (read, named) => read.startsWith(named));
     if (aligned !== null)
-        return partialAnswerScreenKey(promptData);
+        return (0, prompt_screen_key_1.promptScreenKey)(promptData);
     const options = promptData.options.map((o) => `${o.number}.${o.label}`).join('\n');
     return [(0, prompt_key_1.generatePromptKey)(promptData), options, withOptionRowGuttersAligned(target, promptData.options)].join('\u0000');
 }
+/**
+ * `approvalTarget` with only the cursor taken out of its option rows, or null
+ * when the prompt has none (Issue #3821, the identity of the confirmation an
+ * Auto-Yes decision is about). The reading {@link ledgerScreenKey} keeps: the
+ * rows the block reader adopted as the options are aligned
+ * (`approvalTargetWithOptionRowsAligned`), else only the rows that ARE the
+ * prompt's options lose their gutter; the body — its indent, a `>`, a blank
+ * row — stays byte for byte, so two commands that differ there are two
+ * confirmations (#3817), and a moved cursor is the same one.
+ */
+function approvalTargetWithoutCursor(promptData) {
+    const target = promptData.approvalTarget;
+    if (typeof target !== 'string')
+        return null;
+    if (promptData.type !== 'multiple_choice')
+        return target;
+    return ((0, appearance_1.approvalTargetWithOptionRowsAligned)(target, promptData.options.map((o) => o.label), (read, named) => read.startsWith(named)) ?? withOptionRowGuttersAligned(target, promptData.options));
+}
 /** A row's leading cursor marks and indentation. */
 const LEADING_MARKS_PATTERN = /^[\s\u276F\u203A>\u25B6\u25BA\u25CF\u25CB\u25C9\u2192]+/u;
 /** A row's option number and the text after its separator (`1.`, `1)` or `1`, then spaces). */
@@ -145,13 +162,6 @@ function withOptionRowGuttersAligned(text, options) {
     })
         .join('\n');
 }
-/** Every row's leading marks and indentation taken out (the reading before #3817). */
-function withoutLeadingMarks(text) {
-    return text
-        .split('\n')
-        .map((line) => line.replace(/^[\s\u276F\u203A>\u25B6\u25BA\u25CF\u25CB\u25C9\u2192]+/u, ''))
-        .join('\n');
-}
 /** compositeKey -> the answer stopped part-way. globalThis for hot reload (#153). */
 const partialAnswers = (0, global_state_1.getOrInitGlobal)('__autoYesPartialAnswers', () => new Map());
 /**
@@ -168,6 +178,7 @@ function getPartialAnswer(compositeKey, epoch) {
     }
     return partial;
 }
+const NO_ATTEMPTS = new Set();
 /**
  * Forget it: the prompt left the screen, another prompt came up, or the session ended.
  *
@@ -179,6 +190,8 @@ function getPartialAnswer(compositeKey, epoch) {
  * and records as before. Expiring is the mark: it drops the attempt from the
  * registry, so no per-key "forgotten up to seq" state has to outlive it.
  *
+ * @param spare - Issue #3880: sends that are not expired (a person's, at agy's
+ *   dialog the ungated reading still shows)
  * @param screenKey - Given when the memory is dropped because ANOTHER prompt is
  *   on screen (re-instruction 3): only the sends at the forgotten memory's
  *   screen are expired. A send at the screen now shown (Y, carried here by a
@@ -186,16 +199,27 @@ function getPartialAnswer(compositeKey, epoch) {
  *   stop is still remembered when it comes back. Omitted (the prompt left the
  *   screen), every send under the key is expired.
  */
-function forgetPartialAnswer(compositeKey, screenKey) {
+function forgetPartialAnswer(compositeKey, screenKey, spare = NO_ATTEMPTS) {
     partialAnswers.delete(compositeKey);
     for (const attempt of [...sendAttempts]) {
         if (attempt.recordKey !== compositeKey)
             continue;
         if (screenKey !== undefined && attempt.screenKey !== screenKey)
             continue;
+        if (spare.has(attempt))
+            continue;
         expireSendAttempt(attempt);
     }
 }
+/**
+ * A person's sends still in flight under this key, to this session epoch
+ * (Issue #3880): agy's gated reading seeing no prompt does not say the screen
+ * they type at is gone, so the tick checks the ungated reading before it
+ * expires them ({@link forgetPartialAnswer}'s `spare`).
+ */
+function personSendsInFlight(compositeKey, epoch) {
+    return [...sendAttempts].filter((attempt) => attempt.byPerson === true && attempt.recordKey === compositeKey && attempt.recordEpoch === epoch);
+}
 /**
  * {@link forgetPartialAnswer} for every instance of a worktree, and the sends
  * still in flight there are expired (Issue #3713): a slow tick that comes back
@@ -213,6 +237,53 @@ function forgetPartialAnswersByWorktree(worktreeId) {
             expireSendAttempt(attempt);
     }
 }
+/**
+ * A person's answer went through, or was refused before any key (Issue #3880):
+ * the answer Auto-Yes held at that confirmation is theirs now, so the hold is
+ * dropped — only one recorded before the person's answer began (`before`, its
+ * {@link nextSendOrder}). A hold recorded since, by a send begun after theirs
+ * (another person's from another screen, a tick's), is about what that send
+ * did and stays. Only the record: a send still in flight records what it did
+ * when it comes back. Not called when a person's own send may have left keys
+ * on the pane, nor at the START of their answer.
+ */
+function releasePartialAnswerToHuman(compositeKey, before) {
+    const recorded = partialAnswers.get(compositeKey);
+    if (recorded !== undefined && recorded.seq < before)
+        partialAnswers.delete(compositeKey);
+}
+/**
+ * The hold's screen, now that a tick read the confirmation on screen (Issue
+ * #3880): a hold at {@link UNIDENTIFIED_SCREEN_KEY} takes `screenKey`.
+ */
+function identifyPartialAnswerScreen(compositeKey, screenKey) {
+    const recorded = partialAnswers.get(compositeKey);
+    if (recorded?.screenKey === exports.UNIDENTIFIED_SCREEN_KEY)
+        partialAnswers.set(compositeKey, { ...recorded, screenKey });
+}
+/**
+ * Put back a person's hold the tick dropped because its gated reading saw no
+ * prompt, while agy's dialog it is about is still up past the receipt window
+ * (Issue #3880). Only into the same session, and over nothing newer.
+ */
+function keepPartialAnswerByPerson(compositeKey, partial, screenKey) {
+    if ((0, auto_yes_enter_fallback_state_1.getEnterFallbackSessionEpoch)(compositeKey) !== partial.epoch)
+        return;
+    const recorded = partialAnswers.get(compositeKey);
+    if (recorded !== undefined && recorded.seq > partial.seq)
+        return;
+    partialAnswers.set(compositeKey, { ...partial, screenKey });
+}
+/**
+ * A place in the order sends are registered in (Issue #3880): a person's
+ * answer takes one as it begins, so the hold it releases when it ends is only
+ * one recorded by a send registered before it began. What its own send
+ * records is ordered by that send's registration instead
+ * ({@link beginManualSendAttempt}).
+ */
+function nextSendOrder() {
+    return ++sendAttemptSeq.last;
+}
 /** Forget every one, and expire every send in flight: server shutdown, and a test seam. */
 function clearPartialAnswers() {
     partialAnswers.clear();
@@ -240,12 +311,38 @@ function beginSendAttempt(compositeKey, screenKey, epoch, ledger = null) {
     sendAttempts.add(attempt);
     return attempt;
 }
+/**
+ * Register a person's send about to start (Issue #3880): the screen it types
+ * at and the session epoch it goes to, fixed now, and its place among the
+ * sends taken now too, as Auto-Yes's own is — not when the answer began: an
+ * answer that waited before its first key (the re-verification of the screen)
+ * may send after one begun later, and then its keys are the newer ones.
+ * Settled with {@link settleSendAttempt} like Auto-Yes's own, so it records a
+ * hold only for the session the keys went to, never over a hold of a send
+ * registered after it, and not at all once the screen it typed at was seen gone.
+ */
+function beginManualSendAttempt(compositeKey, screenKey) {
+    const attempt = {
+        seq: ++sendAttemptSeq.last,
+        screenKey,
+        recordKey: compositeKey,
+        recordEpoch: (0, auto_yes_enter_fallback_state_1.getEnterFallbackSessionEpoch)(compositeKey),
+        moved: false,
+        state: 'pending',
+        byPerson: true,
+        ledger: null,
+    };
+    sendAttempts.add(attempt);
+    return attempt;
+}
 /**
  * The send came back. `keysSent` — it was stopped with keys already on the
- * pane — records the partial answer under the attempt's key as it is now, when
- * that key's session is still the one the keys went to; otherwise (sent in
- * full, stopped before any key, or failed) only the attempt itself is removed.
- * A second call, or a call on an expired attempt, does nothing.
+ * pane, or (Issue #3880) a tmux call of it ended without an exit status and
+ * its keys may be there — records the partial answer under the attempt's key
+ * as it is now, when that key's session is still the one the keys went to;
+ * otherwise (sent in full, stopped before any key, or failed with nothing
+ * sent) only the attempt itself is removed. A second call, or a call on an
+ * expired attempt, does nothing.
  */
 function settleSendAttempt(attempt, keysSent, at = Date.now()) {
     if (attempt.state !== 'pending')
@@ -267,6 +364,7 @@ function settleSendAttempt(attempt, keysSent, at = Date.now()) {
         epoch: attempt.recordEpoch,
         at,
         seq: attempt.seq,
+        ...(attempt.byPerson ? { byPerson: true } : {}),
     });
 }
 function expireSendAttempt(attempt) {
@@ -286,7 +384,7 @@ function hasMovedSendInFlight(compositeKey, epoch, screenKey) {
         if (attempt.moved &&
             attempt.recordKey === compositeKey &&
             attempt.recordEpoch === epoch &&
-            attempt.screenKey === screenKey) {
+            partialAnswerCovers(attempt.screenKey, screenKey)) {
             return true;
         }
     }

package/dist/server/src/lib/polling/auto-yes-poller-steps.js

@@ -12,11 +12,18 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.withheldForEarlierSend = withheldForEarlierSend;
+exports.answerModeOfTick = answerModeOfTick;
+exports.questionAnsweringOf = questionAnsweringOf;
+exports.withheldAsQuestion = withheldAsQuestion;
+exports.withheldAtSend = withheldAtSend;
 exports.resolveAnswerUnderPolicy = resolveAnswerUnderPolicy;
 exports.skippedForUnownedSession = skippedForUnownedSession;
 const auto_yes_resolver_1 = require("./auto-yes-resolver");
 const auto_yes_policy_1 = require("./auto-yes-policy");
 const auto_yes_suppression_reason_1 = require("./auto-yes-suppression-reason");
+const auto_yes_state_1 = require("../auto-yes-state");
+const auto_yes_dialog_gate_1 = require("./auto-yes-dialog-gate");
+const auto_yes_answer_mode_1 = require("../../types/auto-yes-answer-mode");
 const auto_yes_poller_state_1 = require("./auto-yes-poller-state");
 const auto_yes_prompt_suppression_1 = require("./auto-yes-prompt-suppression");
 const auto_yes_confirmation_ledger_1 = require("./auto-yes-confirmation-ledger");
@@ -30,7 +37,10 @@ function withheldForEarlierSend(judged, screenKey, epoch) {
     const { worktreeId, cliToolId, instanceId, compositeKey, pollerState, promptData, frameKey } = judged;
     const partial = (0, auto_yes_poller_state_1.getPartialAnswer)(compositeKey, epoch);
     if (partial !== null) {
-        if (partial.screenKey === screenKey) {
+        if ((0, auto_yes_poller_state_1.partialAnswerCovers)(partial.screenKey, screenKey)) {
+            // Issue #3880: a person's send made with no prompt read (the capture
+            // failed) holds the first confirmation read after it, as that one.
+            (0, auto_yes_poller_state_1.identifyPartialAnswerScreen)(compositeKey, screenKey);
             (0, auto_yes_prompt_suppression_1.suppressAndWarnOnce)(judged, {
                 reason: auto_yes_suppression_reason_1.PARTIAL_ANSWER_SUPPRESSION_REASON,
                 mode: null,
@@ -54,6 +64,165 @@ function withheldForEarlierSend(judged, screenKey, epoch) {
     }
     return false;
 }
+/**
+ * The answer mode a tick acts under (Issue #3863): the grant the tick read
+ * (its generation's, #3706), or — for a direct caller with no generation —
+ * the instance's grant as it stands, if it is on. Neither: the default,
+ * `recommended`. A grant that cannot be read is `careful`, the mode that
+ * answers less.
+ */
+function answerModeOfTick(worktreeId, cliToolId, instanceId, grant) {
+    if (grant !== undefined)
+        return (0, auto_yes_state_1.autoYesAnswerModeOf)(grant);
+    try {
+        const state = (0, auto_yes_state_1.getAutoYesState)(worktreeId, cliToolId, instanceId);
+        return state?.enabled ? (0, auto_yes_state_1.autoYesAnswerModeOf)(state) : auto_yes_answer_mode_1.DEFAULT_AUTO_YES_ANSWER_MODE;
+    }
+    catch {
+        return 'careful';
+    }
+}
+/**
+ * Issue #3863: what the resolver needs to answer the prompt as a question
+ * under `answerMode`, or undefined when it is not answered as one — not a
+ * question reader's picker, or the mode is `careful` (which never answers it).
+ */
+function questionAnsweringOf(judged, answerMode) {
+    // Issue #3881 (review N3): the shared table, which the observation reads too.
+    const kind = (0, auto_yes_dialog_gate_1.classifyAutoYesQuestion)(judged.promptData, judged.dialogGate, judged.cliToolId);
+    if ((0, auto_yes_dialog_gate_1.autoYesQuestionTreatment)(kind, answerMode) !== 'recommended-choice')
+        return undefined;
+    return { optionRecommendations: judged.optionRecommendations };
+}
+/**
+ * Step 3.7 of `detectAndRespondToPrompt` (Issue #3822): a question to the
+ * operator is left to the human when Auto-Yes's answer mode says so.
+ *
+ * Issue #3863: which questions, by {@link classifyAutoYesQuestion}:
+ *
+ * - a question reader's picker (Claude's AskUserQuestion, Command Code's
+ *   question screen) — left to a human under the `careful` answer mode; under
+ *   `recommended` it goes on to step 4, which answers it with its recommended
+ *   option (`auto-yes-question-choice`). Judged without the dialog gate, so a
+ *   `legacy` tool and the `CM_AUTOYES_DIALOG_GATE` kill switch change nothing
+ *   here;
+ * - OpenCode V2's question form — left to a human under either mode;
+ * - Issue #3881: a copilot / codex numbered list nothing marks as a question
+ *   or as a permission (`'unidentified'`) — left to a human under `careful`;
+ *   under `recommended` it goes on to step 4 and is answered as before.
+ *
+ * Not a contract verdict, so `allowPromptTypes` cannot bring it back: an
+ * `allow-listed` contract naming `multiple_choice` delegates permission
+ * dialogs, not the operator's questions.
+ *
+ * Recorded as `question-left-to-human` — a question in general, not the
+ * `Submit` / `Cancel` confirm page that follows one (`question-confirm-page`,
+ * #3748, recorded at step 3.3 before this step is reached).
+ *
+ * @returns true when the prompt is withheld (the caller returns `no_answer`)
+ */
+function withheldAsQuestion(judged) {
+    const { promptData, dialogGate, cliToolId } = judged;
+    const kind = (0, auto_yes_dialog_gate_1.classifyAutoYesQuestion)(promptData, dialogGate, cliToolId);
+    if (kind === null)
+        return false;
+    const answerMode = judged.answerMode ?? auto_yes_answer_mode_1.DEFAULT_AUTO_YES_ANSWER_MODE;
+    if ((0, auto_yes_dialog_gate_1.autoYesQuestionTreatment)(kind, answerMode) !== 'left-to-human')
+        return false;
+    withholdQuestion(judged, answerMode, false, kind);
+    return true;
+}
+/** Record a question left to a human (`question-left-to-human`), warning once per frame. */
+function withholdQuestion(judged, answerMode, atSend, kind) {
+    const { promptData, frameKey, dialogGate } = judged;
+    (0, auto_yes_prompt_suppression_1.suppressAndWarnOnce)(judged, { reason: auto_yes_suppression_reason_1.QUESTION_LEFT_TO_HUMAN_SUPPRESSION_REASON, mode: null, promptType: promptData.type }, `${frameKey}\u0000question`, 'poller:auto-yes-skipped-question', {
+        reason: auto_yes_suppression_reason_1.QUESTION_LEFT_TO_HUMAN_SUPPRESSION_REASON,
+        promptType: promptData.type,
+        dialogKind: dialogGate?.dialog?.kind ?? null,
+        // Issue #3881: `unidentified` — not known to be a question, nor not one.
+        questionKind: kind,
+        question: (0, auto_yes_prompt_suppression_1.truncateForLog)(promptData.question),
+        answerMode,
+        ...(atSend ? { atSend: true } : {}),
+    });
+}
+/**
+ * The last look before a key (Issue #3822): is the answer still Auto-Yes's to
+ * send? Asked after the last wait before the send (the ownership check), so
+ * nothing it reads can change before the first key goes out.
+ *
+ * - With a `generation` (a poller tick), Auto-Yes must still be on and inside
+ *   its window. `getAutoYesState` disables an expired grant on read, the
+ *   boundary the hook and the next tick see. Without one (direct callers,
+ *   tests) the grant is not checked, as the tick checks nothing then (#3706).
+ * - The contract is read again past the policy cache, so a switched contract,
+ *   an `off`, or a deny pattern added since the tick's lookup withholds the
+ *   key. A read that fails is "contract unknown" (`policy-lookup-failed`), as
+ *   in step 4, and so is a grant that cannot be read.
+ * - Issue #3863: the answer mode is read off that grant again. A question the
+ *   `careful` mode leaves to a human gets no key, whatever the tick began
+ *   under; the question's answer is resolved again under the mode as it is.
+ *   (A mode change replaces the grant, so a tick that began under the old one
+ *   has usually stopped at its last generation check already.)
+ *
+ * The `PermissionRequest` hook is not asked this: its `allow` IS the answer,
+ * decided against the grant and the contract when the hook is answered, and
+ * nothing is typed afterwards for a later look to stop.
+ *
+ * @param checkGrant - Whether the grant is checked (a tick with a generation)
+ * @returns true when the key is withheld (the caller returns `no_answer`)
+ */
+function withheldAtSend(judged, checkGrant) {
+    const { worktreeId, cliToolId, instanceId, pollerState, promptData, frameKey } = judged;
+    let answerMode = judged.answerMode ?? auto_yes_answer_mode_1.DEFAULT_AUTO_YES_ANSWER_MODE;
+    if (checkGrant) {
+        let grant;
+        try {
+            grant = (0, auto_yes_state_1.getAutoYesState)(worktreeId, cliToolId, instanceId);
+        }
+        catch {
+            return withholdAsUnknown(judged);
+        }
+        if (!grant?.enabled) {
+            // Auto-Yes is off: nothing is recorded as withheld (the poller stops on
+            // its next tick and the state says why), only that the key was not sent.
+            (0, auto_yes_poller_state_1.warnOncePerFrame)(pollerState, `${frameKey}\u0000at-send-disabled`, 'poller:auto-yes-withheld-at-send', {
+                worktreeId,
+                cliToolId,
+                instanceId,
+                reason: grant?.stopReason === 'expired' ? 'expired' : 'auto-yes-disabled',
+                promptType: promptData.type,
+            });
+            return true;
+        }
+        answerMode = (0, auto_yes_state_1.autoYesAnswerModeOf)(grant);
+        const questionKind = (0, auto_yes_dialog_gate_1.classifyAutoYesQuestion)(promptData, judged.dialogGate, cliToolId);
+        if (answerMode === 'careful' && questionKind !== null
+            && (0, auto_yes_dialog_gate_1.autoYesQuestionTreatment)(questionKind, answerMode) === 'left-to-human') {
+            withholdQuestion(judged, answerMode, true, questionKind);
+            return true;
+        }
+    }
+    const policy = (0, auto_yes_policy_1.getSessionAutoYesPolicy)(worktreeId, cliToolId, instanceId, { fresh: true });
+    const resolution = (0, auto_yes_resolver_1.resolveAutoAnswerWithPolicy)(promptData, policy, cliToolId, questionAnsweringOf(judged, answerMode));
+    if (resolution.suppressedBy) {
+        const mode = (0, auto_yes_resolver_1.policyLookupMode)(policy);
+        (0, auto_yes_prompt_suppression_1.suppressAndWarnOnce)(judged, { reason: resolution.suppressedBy, mode, promptType: promptData.type, pattern: resolution.pattern }, `${frameKey}\u0000${resolution.suppressedBy}\u0000${mode ?? ''}\u0000${resolution.pattern ?? ''}`, 'poller:auto-yes-suppressed-by-policy', {
+            reason: resolution.suppressedBy,
+            mode,
+            pattern: resolution.pattern,
+            promptType: promptData.type,
+            atSend: true,
+        });
+        return true;
+    }
+    return false;
+}
+function withholdAsUnknown(judged) {
+    const { promptData, frameKey } = judged;
+    (0, auto_yes_prompt_suppression_1.suppressAndWarnOnce)(judged, { reason: auto_yes_suppression_reason_1.POLICY_LOOKUP_FAILED_SUPPRESSION_REASON, mode: null, promptType: promptData.type }, `${frameKey}\u0000${auto_yes_suppression_reason_1.POLICY_LOOKUP_FAILED_SUPPRESSION_REASON}\u0000at-send`, 'poller:auto-yes-suppressed-by-policy', { reason: auto_yes_suppression_reason_1.POLICY_LOOKUP_FAILED_SUPPRESSION_REASON, mode: null, promptType: promptData.type, atSend: true });
+    return true;
+}
 /**
  * Step 4 of `detectAndRespondToPrompt`: the auto answer under the execution
  * contract's policy, recording the suppression when the policy withholds it.
@@ -64,7 +233,8 @@ function resolveAnswerUnderPolicy(judged) {
     const { worktreeId, cliToolId, instanceId, promptData, frameKey } = judged;
     // Issue #3822: a failed lookup reaches the resolver as unknown and withholds.
     const policy = (0, auto_yes_policy_1.getSessionAutoYesPolicy)(worktreeId, cliToolId, instanceId);
-    const resolution = (0, auto_yes_resolver_1.resolveAutoAnswerWithPolicy)(promptData, policy);
+    // Issue #3863: a question the `recommended` mode answers takes its recommended option.
+    const resolution = (0, auto_yes_resolver_1.resolveAutoAnswerWithPolicy)(promptData, policy, cliToolId, questionAnsweringOf(judged, judged.answerMode ?? auto_yes_answer_mode_1.DEFAULT_AUTO_YES_ANSWER_MODE));
     if (resolution.suppressedBy) {
         const mode = (0, auto_yes_resolver_1.policyLookupMode)(policy);
         // Issue #1684: the log line alone leaves a CLI-driven pipeline blind to

package/dist/server/src/lib/polling/auto-yes-prompt-suppression.js

@@ -247,8 +247,8 @@ function suppressIfNotOursToAnswer(prompt, frame) {
     //
     // Issue #3748: Claude's confirmation page (`Ready to submit your answers?` /
     // `❯ 1. Submit answers` / `2. Cancel`) is the same page and is declined the
-    // same way. Judged by `isAutoYesDeclinedConfirmPage`, which the browser's
-    // fallback (`useAutoYes`) asks too, and recorded with a reason of its own,
+    // same way. Judged by `isAutoYesDeclinedConfirmPage` (the browser's fallback,
+    // `useAutoYes`, read the same page by its options until #3821 retired it), and recorded with a reason of its own,
     // `question-confirm-page`, which `cmate wait` names as such (it reused
     // `unclassified-frame`, whose wording says no detector recognised the frame).
     if ((0, auto_yes_confirm_page_1.isAutoYesDeclinedConfirmPage)(cliToolId, frame)) {