commandmate 0.47.2 → 0.49.0

package/dist/server/src/lib/polling/auto-yes-dialog-gate.js

@@ -37,12 +37,17 @@
  *
  * A `yes_no` prompt is a different inference — `detectPrompt` requires an
  * explicit `(y/n)`-shaped token in the text rather than deriving it from layout
- * — and NO tool in the registry has a measured yes/no dialog rule to gate it
- * against. Gating an inference for which no positive rule exists is the failure
- * mode the rollout guidance is written to prevent: every such prompt would
- * become a suppression, and the operator would see a worker that had silently
- * gone quiet. When a tool's yes/no dialog is measured and fixtured, widen this
- * the same way a tool is added to the table.
+ * — and NO tool in the registry has a measured yes/no dialog rule. Until Issue
+ * #3822 that was the reason to leave it ungated. It is now the reason to refuse
+ * it on an `enforce` tool, in {@link evaluateAutoYesDialogGate} only: none of
+ * those tools draws a `(y/n)` dialog, so a `(y/n)` on their pane is text — a
+ * reply quoting one, a shell command's prompt — and typing `y` at it answers
+ * nothing the tool asked (the user's decision of 2026-10-20: a generic yes/no
+ * without the tool's own evidence is left to a human). The tool can still vouch
+ * for the frame through `detectDialog`, exactly as for a numbered list. The
+ * `legacy` tools are unchanged (#3823), and so is
+ * {@link evaluateDialogPresence}: a `(y/n)` row a human may answer still
+ * belongs in History.
  *
  * ## What "allowed" does NOT mean
  *
@@ -54,9 +59,12 @@
  * @module lib/polling/auto-yes-dialog-gate
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.COMMAND_CODE_UNSUPPORTED_QUESTION_MESSAGE = exports.UNSUPPORTED_DIALOG_LAYOUT_REASON = exports.PROMPT_NO_LONGER_ACTIVE_REASON = exports.AUTO_YES_DIALOG_GATE_ENV_VAR = exports.AUTO_YES_DIALOG_GATE_DEFAULT_MODE = exports.AUTO_YES_DIALOG_GATE_MODES = void 0;
+exports.COMMAND_CODE_UNSUPPORTED_QUESTION_MESSAGE = exports.UNSUPPORTED_DIALOG_LAYOUT_REASON = exports.PROMPT_NO_LONGER_ACTIVE_REASON = exports.QUESTION_EVIDENCE_UNREAD_TOOLS = exports.AUTO_YES_QUESTION_DIALOG_KINDS = exports.AUTO_YES_DIALOG_GATE_ENV_VAR = exports.AUTO_YES_DIALOG_GATE_DEFAULT_MODE = exports.AUTO_YES_DIALOG_GATE_MODES = void 0;
 exports.resolveAutoYesDialogGateMode = resolveAutoYesDialogGateMode;
 exports.evaluateAutoYesDialogGate = evaluateAutoYesDialogGate;
+exports.classifyAutoYesQuestion = classifyAutoYesQuestion;
+exports.autoYesQuestionTreatment = autoYesQuestionTreatment;
+exports.isAutoYesQuestionPrompt = isAutoYesQuestionPrompt;
 exports.evaluateDialogPresence = evaluateDialogPresence;
 exports.judgePromptResponse = judgePromptResponse;
 exports.assessPromptAnswerability = assessPromptAnswerability;
@@ -67,6 +75,7 @@ const prompt_detector_1 = require("../../lib/detection/prompt-detector");
 const cli_patterns_1 = require("../../lib/detection/cli-patterns");
 const dialog_1 = require("../../lib/detection/tools/antigravity/dialog");
 const dialog_2 = require("../../lib/detection/tools/command-code/dialog");
+const auto_yes_option_effect_1 = require("./auto-yes-option-effect");
 /** Every accepted value of {@link AutoYesDialogGateMode}, for parsing and tests. */
 exports.AUTO_YES_DIALOG_GATE_MODES = ['enforce', 'legacy'];
 /**
@@ -193,7 +202,10 @@ function resolveAutoYesDialogGateMode(tool, env = process.env) {
     }
     return specific ?? wildcard ?? exports.AUTO_YES_DIALOG_GATE_DEFAULT_MODE[tool] ?? 'legacy';
 }
-/** The only prompt family this gate judges. See the module docstring. */
+/**
+ * The only prompt family the presence gate judges. Auto-Yes's gate also judges
+ * `yes_no` (Issue #3822); see the module docstring.
+ */
 const GATED_PROMPT_TYPE = 'multiple_choice';
 /**
  * May Auto-Yes answer the prompt the generic inference found on this frame?
@@ -216,7 +228,10 @@ function evaluateAutoYesDialogGate(cliToolId, promptType, cleanOutput, env = pro
     // `judgeDialogPresence` holds that rule; Issue #2457 split it out so the
     // history-save and `/prompt-response` paths judge a frame the same way this
     // one does instead of re-deriving the rollout table.
-    const presence = judgeDialogPresence(cliToolId, promptType, cleanOutput, resolveAutoYesDialogGateMode(cliToolId, env));
+    const mode = resolveAutoYesDialogGateMode(cliToolId, env);
+    const presence = promptType === 'yes_no'
+        ? judgeYesNoPresence(cliToolId, cleanOutput, mode)
+        : judgeDialogPresence(cliToolId, promptType, cleanOutput, mode);
     return {
         // `keys` is a dialog and still not answerable: opencode's button strip takes
         // ←/→ + Enter, so the digit is swallowed and the Enter confirms whatever is
@@ -245,6 +260,119 @@ function judgeDialogPresence(cliToolId, promptType, frame, mode) {
     const dialog = detector.detectDialog(typeof frame === 'string' ? (0, frame_1.normalizeFrame)(frame, cliToolId) : frame);
     return { present: dialog !== null, dialog, mode, gated: true };
 }
+/**
+ * Issue #3822: the Auto-Yes gate's reading of a `yes_no` candidate. Judged on
+ * the same terms as a numbered one — the rollout table and the `hasDialogRules`
+ * cross-check — so a `legacy` tool, or one with no rules, stays ungated. An
+ * `enforce` tool answers only where its own `detectDialog` vouched for the
+ * frame; none of their rules reads a `(y/n)` row, so in practice it is refused.
+ */
+function judgeYesNoPresence(cliToolId, frame, mode) {
+    const detector = (0, registry_1.getToolStatusDetector)(cliToolId);
+    if (!detector.hasDialogRules || mode === 'legacy') {
+        return { present: true, dialog: null, mode, gated: false };
+    }
+    const dialog = detector.detectDialog(typeof frame === 'string' ? (0, frame_1.normalizeFrame)(frame, cliToolId) : frame);
+    return { present: dialog !== null, dialog, mode, gated: true };
+}
+/**
+ * The dialog kinds that are a question to the operator, not a permission
+ * (Issue #3822): OpenCode V2's question form, read off its own key hints.
+ *
+ * Not Claude's `ask_user`: Claude classifies by the context rows above the
+ * options, which on a permission dialog are the command being approved — a
+ * `grep "Ready to submit your answers?"` approval reads `ask_user` (#3748's
+ * controls), and it is a permission.
+ */
+exports.AUTO_YES_QUESTION_DIALOG_KINDS = new Set(['question']);
+/**
+ * What kind of question to the operator a prompt is, if it is one (Issue
+ * #3863):
+ *
+ * - `'question-form'` — a question form the tool's own dialog rules read
+ *   ({@link AUTO_YES_QUESTION_DIALOG_KINDS}: OpenCode V2's). Left to a human
+ *   under every answer mode, as before; only on a gated frame, where those
+ *   rules ran;
+ * - `'picker'` — a picker a question reader read: Claude's AskUserQuestion
+ *   (the parser's own footer, `Enter to select · … navigate`) or Command
+ *   Code's question screen (its reader). Both set `isAskUserQuestion`, off the
+ *   picker's chrome rather than its text. Answered under the `recommended`
+ *   answer mode, left to a human under `careful`;
+ * - null — not a question (a permission, a yes/no, a list).
+ *
+ * The picker is judged WITHOUT the dialog gate (#3863): the gate's mode
+ * (`enforce` / `legacy`, and the `CM_AUTOYES_DIALOG_GATE` kill switch) says
+ * whether a frame's numbered list may be answered at all, not whether it is a
+ * question, so `legacy` does not turn a question into something Auto-Yes
+ * answers under `careful`. Claude's dialog kind `ask_user` is not evidence:
+ * Claude classifies by the context rows above the options, which on a
+ * permission dialog are the command being approved (#3748).
+ *
+ * - `'unidentified'` (Issue #3881, the second half: finding 3) — given the
+ *   tool, a numbered list on copilot or codex
+ *   ({@link QUESTION_EVIDENCE_UNREAD_TOOLS}) that is neither of the above and
+ *   whose rows do not read as a permission dialog
+ *   (`auto-yes-option-effect`, the wording measured on their live captures).
+ *   Copilot's question (`ask_user`) and codex's `request_user_input` draw the
+ *   same picker as their menus: copilot calls anything without `do you want
+ *   to` a `picker`, codex anything with a `?` above it a `permission`, and
+ *   neither sets `isAskUserQuestion`. So such a list is not known to be a
+ *   question, nor known not to be one. Left to a human under `careful`;
+ *   under `recommended` it is answered exactly as before (not as a question).
+ *
+ * @param promptData - The prompt the tick read
+ * @param gate - {@link evaluateAutoYesDialogGate}'s verdict for the same frame, if it ran
+ * @param cliToolId - The tool that drew it; omitted, no list is `'unidentified'`
+ *   (the reading before #3881's second half)
+ */
+function classifyAutoYesQuestion(promptData, gate, cliToolId) {
+    if (gate?.gated === true && gate.dialog !== null && exports.AUTO_YES_QUESTION_DIALOG_KINDS.has(gate.dialog.kind)) {
+        return 'question-form';
+    }
+    if (promptData.type !== 'multiple_choice')
+        return null;
+    if (promptData.isAskUserQuestion === true)
+        return 'picker';
+    if (cliToolId !== undefined && exports.QUESTION_EVIDENCE_UNREAD_TOOLS.has(cliToolId)
+        && (0, auto_yes_option_effect_1.selectAllowOnceOption)(promptData.options, cliToolId).kind === 'not-a-permission-dialog') {
+        return 'unidentified';
+    }
+    return null;
+}
+/** See {@link AutoYesQuestionTreatment}. */
+function autoYesQuestionTreatment(kind, answerMode) {
+    if (kind === null)
+        return 'base-rules';
+    if (kind === 'question-form')
+        return 'left-to-human';
+    if (answerMode === 'careful')
+        return 'left-to-human';
+    return kind === 'picker' ? 'recommended-choice' : 'base-rules';
+}
+/**
+ * The tools whose question screens nothing on the screen tells from their
+ * other pickers (Issue #3881, finding 3): copilot's `ask_user`, codex's
+ * `request_user_input`. Neither module reads a question's chrome; their dialog
+ * kinds are guesses from the words above the options
+ * (`tools/copilot/prompt.ts`, `tools/codex/prompt.ts`).
+ */
+exports.QUESTION_EVIDENCE_UNREAD_TOOLS = new Set(['copilot', 'codex']);
+/**
+ * Is the prompt a question to the operator rather than a permission, on a
+ * GATED frame? (Issue #3822.)
+ *
+ * The reading #3822 first shipped: a question only where the tool's own rules
+ * ran. Since Issue #3863 the poller reads {@link classifyAutoYesQuestion},
+ * which judges the picker without the gate (so the kill switch and the
+ * `legacy` tools do not change how a question is treated); this stays the
+ * gated half of that reading.
+ *
+ * @param promptData - The prompt the tick read
+ * @param gate - {@link evaluateAutoYesDialogGate}'s verdict for the same frame
+ */
+function isAutoYesQuestionPrompt(promptData, gate) {
+    return gate.gated && classifyAutoYesQuestion(promptData, gate) !== null;
+}
 /**
  * Does this frame POSITIVELY carry a dialog for the numbered-list candidate the
  * generic parser found on it? (Issue #2457)
@@ -395,8 +523,9 @@ function assessPromptAnswerability(cliToolId, frame) {
     // Issue #3808: a numbered agy screen agy's reader declines (the login-method
     // screen, a permission dialog whose `tab Amend` footer is cut or off the
     // pane) is no prompt — not the generic parser's reading of its `1. / 2.` rows.
+    // #3818: by default, so a run with a number missing is declined too.
     const declinedAgyScreen = cliToolId === 'antigravity' && toolDialog === null
-        && (0, dialog_1.isAntigravityUnvouchedNumberedScreen)(cleanOutput);
+        && (0, dialog_1.isAntigravityUnansweredNumberedScreen)(cleanOutput);
     const isCommandCodeQuestion = commandCodeQuestion.kind === 'prompt';
     const candidate = (commandCodeQuestion.kind === 'prompt' ? commandCodeQuestion.prompt : null)
         ?? toolDialog

package/dist/server/src/lib/polling/auto-yes-enter-fallback.js

@@ -2,6 +2,20 @@
 /**
  * Auto-Yes's Enter on a choice screen CommandMate cannot read (Issue #3397).
  *
+ * ## Retired (Issue #3821)
+ *
+ * Nothing sends this Enter any more. The poller leaves every frame the dialog
+ * gate refuses to a human (`unclassified-frame`), whatever
+ * {@link judgeEnterFallback} would say and whatever
+ * {@link AUTO_YES_ENTER_FALLBACK_ENV_VAR} is set to: a bare Enter confirms
+ * whatever happens to be selected, and on a screen nothing here can read,
+ * nothing here can say what that is. {@link judgeEnterFallback} stays as a
+ * reading of the frame only; no sending path calls it. The session epoch the
+ * record was keyed on (`./auto-yes-enter-fallback-state`) is still what every
+ * send's generation check and the partial-answer record belong to.
+ *
+ * What follows is how the Enter was decided while it existed.
+ *
  * ## The screen
  *
  * `assessPromptAnswerability` refuses some frames that are plainly a choice

package/dist/server/src/lib/polling/auto-yes-manual-answer.js

@@ -0,0 +1,124 @@
+"use strict";
+/**
+ * A person's answer through `/prompt-response`, as Auto-Yes's poller sees it
+ * (Issue #3821, review 2).
+ *
+ * Dropping the published decision is not enough to keep the poller's keys off
+ * a confirmation a person is answering: a tick already past its checks — the
+ * ownership check, a wait inside the send — acts for its generation (#3706),
+ * which a manual answer did not touch. So the start of a manual answer
+ *
+ *  - moves the instance's manual-answer sequence on; a tick whose generation
+ *    was taken under an earlier one is no longer current (`isTickCurrent`) and
+ *    sends no further key;
+ *  - holds the instance for {@link MANUAL_ANSWER_HOLD_MS}: a tick that reads a
+ *    confirmation meanwhile leaves it to the person (`answered-by-human`)
+ *    instead of answering what they may be answering right now;
+ *  - drops the published decision.
+ *
+ * How the answer ENDED decides what happens to an answer the poller holds at
+ * that confirmation (Issue #3880, {@link settleManualAnswer}).
+ *
+ * Auto-Yes itself stays on: past the hold the poller answers again.
+ *
+ * In-memory and on `globalThis` (the route and the poller are bundled apart
+ * under `next dev`).
+ *
+ * @module lib/polling/auto-yes-manual-answer
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ANSWERED_BY_HUMAN_DECISION_REASON = exports.MANUAL_ANSWER_HOLD_MS = void 0;
+exports.noteManualAnswerStarted = noteManualAnswerStarted;
+exports.noteManualSendStarting = noteManualSendStarting;
+exports.settleManualAnswer = settleManualAnswer;
+exports.abandonManualSend = abandonManualSend;
+exports.getManualAnswerSeq = getManualAnswerSeq;
+exports.isManualAnswerHolding = isManualAnswerHolding;
+exports.clearManualAnswers = clearManualAnswers;
+const auto_yes_state_1 = require("../../lib/auto-yes-state");
+const global_state_1 = require("../global-state");
+const auto_yes_decision_state_1 = require("./auto-yes-decision-state");
+const auto_yes_poller_state_1 = require("./auto-yes-poller-state");
+/** How long a manual answer keeps the poller off the instance's confirmations. */
+exports.MANUAL_ANSWER_HOLD_MS = auto_yes_state_1.DUPLICATE_RETRY_EXPIRY_MS;
+/** The decision reason a tick withholds under while the hold lasts. */
+exports.ANSWERED_BY_HUMAN_DECISION_REASON = 'answered-by-human';
+const marks = (0, global_state_1.getOrInitGlobal)('__autoYesManualAnswers', () => new Map());
+/** A person began answering on this instance (called before the first key or API call). */
+function noteManualAnswerStarted(compositeKey, at = Date.now()) {
+    marks.set(compositeKey, { seq: (marks.get(compositeKey)?.seq ?? 0) + 1, at });
+    (0, auto_yes_decision_state_1.forgetAutoYesDecision)(compositeKey);
+    return { compositeKey, order: (0, auto_yes_poller_state_1.nextSendOrder)(), attempt: null };
+}
+/**
+ * The person's keys are about to go out (Issue #3880), at the confirmation
+ * `promptData` is — or, when no prompt could be read off the screen (the
+ * capture before the send failed), at an unidentified one. Registered as a
+ * send in flight, so a screen seen gone, a relaunch, or a worktree going away
+ * before it ends keeps its end from recording a hold.
+ */
+function noteManualSendStarting(ticket, promptData) {
+    if (ticket.attempt !== null)
+        return;
+    const screenKey = promptData ? (0, auto_yes_poller_state_1.partialAnswerScreenKey)(promptData) : auto_yes_poller_state_1.UNIDENTIFIED_SCREEN_KEY;
+    ticket.attempt = (0, auto_yes_poller_state_1.beginManualSendAttempt)(ticket.compositeKey, screenKey);
+}
+/**
+ * A person's answer ended (Issue #3880). Starting one does not touch what
+ * Auto-Yes holds — the start only stops the tick under way and holds the
+ * poller off for {@link MANUAL_ANSWER_HOLD_MS} — so a manual send that fails
+ * cannot leave the confirmation free for Auto-Yes to type at again once that
+ * hold passes. Everything is matched to THIS answer (`ticket`), not to the
+ * instance's key alone:
+ *
+ * - `answered` / `not-sent`: the hold recorded before this answer began is
+ *   released (the person answered, or saw the screen and nothing of theirs is
+ *   on it). One recorded since — by another person's send that may be on the
+ *   pane, or a tick's — stays.
+ * - `may-be-on-pane`: the send records a hold at its screen (unidentified
+ *   when none was read), as Auto-Yes's own does: only for the session epoch it
+ *   went to, never over a hold of a send registered after it, and not at all when
+ *   the screen it typed at was seen gone since. And every tick under way stops
+ *   (the manual-answer sequence moves on): one that read no hold before its
+ *   last wait does not type over this one.
+ *
+ * An end nobody reports (a send that threw saying nothing of its keys, a
+ * verdict the agent's API gave no receipt for — both only abandoned; a
+ * structured verdict `/prompt-response` refused) leaves the hold as it was. A verdict delivered over the
+ * agent's API reports its receipt like a send (Issue #3925).
+ */
+function settleManualAnswer(ticket, outcome, at = Date.now()) {
+    const { compositeKey, attempt } = ticket;
+    if (outcome !== 'may-be-on-pane') {
+        if (attempt !== null)
+            (0, auto_yes_poller_state_1.settleSendAttempt)(attempt, false, at);
+        (0, auto_yes_poller_state_1.releasePartialAnswerToHuman)(compositeKey, ticket.order);
+        return;
+    }
+    if (attempt !== null)
+        (0, auto_yes_poller_state_1.settleSendAttempt)(attempt, true, at);
+    const mark = marks.get(compositeKey);
+    if (mark !== undefined)
+        marks.set(compositeKey, { ...mark, seq: mark.seq + 1 });
+}
+/**
+ * A person's send ended in a way that says nothing of its keys (Issue #3880):
+ * it is no longer in flight, and the hold is left as it was.
+ */
+function abandonManualSend(ticket) {
+    if (ticket.attempt !== null)
+        (0, auto_yes_poller_state_1.settleSendAttempt)(ticket.attempt, false);
+}
+/** The instance's manual-answer sequence (0 until a person answers there). */
+function getManualAnswerSeq(compositeKey) {
+    return marks.get(compositeKey)?.seq ?? 0;
+}
+/** Whether a manual answer began on this instance less than {@link MANUAL_ANSWER_HOLD_MS} ago. */
+function isManualAnswerHolding(compositeKey, now = Date.now()) {
+    const mark = marks.get(compositeKey);
+    return mark !== undefined && now - mark.at < exports.MANUAL_ANSWER_HOLD_MS;
+}
+/** Drop every mark: a test seam. The sequences only ever move forward otherwise. */
+function clearManualAnswers() {
+    marks.clear();
+}

package/dist/server/src/lib/polling/auto-yes-option-effect.js

@@ -0,0 +1,157 @@
+"use strict";
+/**
+ * Auto-Yes option effects - what picking one row of a permission dialog does
+ * (Issue #3822).
+ *
+ * Until #3822 the resolver picked the default row, or row 1, of any numbered
+ * dialog. On every tool measured here the rows of a permission dialog do not
+ * mean the same thing: one allows this call only, the others save a rule
+ * (`don't ask again`, `always allow`, `Persist to settings.json`), switch the
+ * permission mode for the session (`allow all edits`, `Full Access`), or deny.
+ * Where the cursor rests is the tool's choice, not a promise that the row is
+ * the narrow one — agy keeps the `>` where the operator left it — so Auto-Yes
+ * answers only the row that reads as "allow this call once", by its number,
+ * and nothing when no single row reads that way.
+ *
+ * ## Where the wording comes from
+ *
+ * Every rule below is a row read off a live capture in the repository, named
+ * next to it. Nothing is inferred from another tool's wording. A tool without
+ * a table (gemini, vibe-local, opencode, opencode-v2) keeps the pre-#3822
+ * reading: opencode's and OpenCode V2's permission strips are unnumbered and
+ * never reach the resolver as a prompt (they are answered through the hook,
+ * whose `allow` is `allowOnce`), and gemini / vibe-local have no captured
+ * permission dialog to read.
+ *
+ * ## When a dialog counts as a permission dialog
+ *
+ * When at least one of its rows reads as an allow — this call once, a saved
+ * rule, or a mode change. A `No` row alone does not make one: a launch dialog
+ * (`Yes, continue` / `No, quit`, `Yes, I trust this folder` / `No, exit`) is
+ * judged where it always was (the launch-dialog branch, the contract's deny
+ * patterns). A numbered list none of whose rows the tool's table recognises (a
+ * question's options, a dialog whose wording was never captured) keeps the
+ * pre-#3822 default-row reading — this module only narrows what a recognised
+ * permission dialog may be answered with, it does not decide which screens are
+ * dialogs.
+ *
+ * Client-safe: no server-only imports (the resolver is bundled into
+ * `hooks/useAutoYes.ts`).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OPTION_EFFECT_TOOLS = void 0;
+exports.readOptionEffect = readOptionEffect;
+exports.selectAllowOnceOption = selectAllowOnceOption;
+/** `don't` with a straight or a typographic apostrophe. */
+const DONT = "don['’]t";
+/** `No`, alone or followed by its explanation (`No, cancel`, `No, and tell … differently`). */
+const DENY_NO = ['deny', /^No(?:,|$)/];
+/**
+ * Each tool's rows, first match wins. A rule is anchored at the start of the
+ * label and reads only the words that say what the row does, so the command or
+ * path a row quotes after them does not matter.
+ */
+const OPTION_EFFECT_RULES = {
+    // tests/fixtures/canary/permission-dialog.raw.txt, permission-hook-no-decision.raw.txt,
+    // tests/unit/lib/detection/fixtures/claude-live-1708/bash-approval-taskpanel.txt,
+    // tests/fixtures/tui-frame-footer-2776/claude-2.1.278-bash-approval-task-panel.txt
+    claude: [
+        ['allow-once', /^Yes$/],
+        ['allow-persistent', /^Yes, and always allow\b/],
+        ['mode-change', /^Yes, allow all edits\b/],
+        ['mode-change', /^Yes, and switch to\b/],
+        DENY_NO,
+    ],
+    // tests/unit/lib/detection/fixtures/codex-live-1628/approval-{run-command,apply-patch}.txt,
+    // tests/fixtures/codex-dialogs-0157/approval.txt, codex-hooks-review-0148.ts,
+    // tests/fixtures/codex-browser-use-2609/approval-form-browser-use.txt (`Allow` /
+    // `Always allow` / `Cancel`, each followed by its description), and
+    // tests/fixtures/codex-live-2310/dialog-permissions-picker.txt (the approval modes)
+    codex: [
+        ['allow-once', /^Yes$/],
+        ['allow-once', /^Yes, proceed\b/],
+        ['allow-once', /^Allow(?:\s{2,}|$)/],
+        ['allow-persistent', new RegExp(`^Yes, and ${DONT} ask again\\b`)],
+        ['allow-persistent', /^Always allow\b/],
+        ['mode-change', /^Ask for approval\b/],
+        ['mode-change', /^Approve for me\b/],
+        ['mode-change', /^Full Access\b/],
+        ['deny', /^Cancel\b/],
+        DENY_NO,
+    ],
+    // tests/fixtures/antigravity-live-2364/dialog-bash-*.txt, dialog-create-file.txt,
+    // tests/fixtures/strict-respond-3812/permission-run-command.txt. `always allow in
+    // this conversation` is as much a saved rule as `(Persist to settings.json)`:
+    // neither is this call only.
+    antigravity: [
+        ['allow-once', /^Yes$/],
+        ['allow-once', /^Yes, run command$/],
+        ['allow-once', /^Yes, allow creation$/],
+        ['allow-persistent', /^Yes, and always allow\b/],
+        DENY_NO,
+    ],
+    // tests/fixtures/command-code-live-2250/dialog-shell-command.txt, dialog-create-file.txt,
+    // dialog-kill-task-1490.txt, tests/fixtures/command-code-plan-review-2763/after-approve.txt
+    'command-code': [
+        ['allow-once', /^Yes$/],
+        ['allow-persistent', new RegExp(`^Yes, ${DONT} ask again\\b`)],
+        ['mode-change', /^Yes, allow all edits\b/],
+        DENY_NO,
+    ],
+    // tests/unit/lib/detection/fixtures/copilot-live-1885/permission-dialog.txt and
+    // copilot-picker-1895/picker-permissions.txt (`Manual ✓` / `Allow all`, the modes)
+    copilot: [
+        ['allow-once', /^Yes$/],
+        ['allow-persistent', new RegExp(`^Yes, and ${DONT} ask again\\b`)],
+        ['mode-change', /^Manual\b/],
+        ['mode-change', /^Allow all\b/],
+        DENY_NO,
+    ],
+};
+/** Every table, for a caller that does not say which tool drew the dialog. */
+const ANY_TOOL_RULES = Object.values(OPTION_EFFECT_RULES).flat();
+/** The tools whose permission rows are read (the others keep the pre-#3822 reading). */
+exports.OPTION_EFFECT_TOOLS = Object.keys(OPTION_EFFECT_RULES);
+function rulesFor(cliToolId) {
+    if (cliToolId === undefined)
+        return ANY_TOOL_RULES;
+    return OPTION_EFFECT_RULES[cliToolId] ?? null;
+}
+function readWith(rules, label) {
+    const text = label.trim();
+    for (const [effect, pattern] of rules) {
+        if (pattern.test(text))
+            return effect;
+    }
+    return 'unknown';
+}
+/**
+ * What choosing the row labelled `label` does on `cliToolId`'s dialog.
+ *
+ * @param cliToolId - The tool that drew the dialog. Omitted, every tool's
+ *   table is read (the first rule that matches decides); a tool with no table
+ *   reads every row as `unknown`.
+ */
+function readOptionEffect(label, cliToolId) {
+    const rules = rulesFor(cliToolId);
+    return rules === null ? 'unknown' : readWith(rules, label);
+}
+/**
+ * Pick the one "allow this call once" row of a permission dialog.
+ *
+ * @param options - The dialog's rows, as parsed
+ * @param cliToolId - The tool that drew it; see {@link readOptionEffect}
+ */
+function selectAllowOnceOption(options, cliToolId) {
+    const rules = rulesFor(cliToolId);
+    if (rules === null)
+        return { kind: 'not-a-permission-dialog' };
+    const effects = options.map((option) => readWith(rules, option.label));
+    if (!effects.some((effect) => effect === 'allow-once' || effect === 'allow-persistent' || effect === 'mode-change')) {
+        return { kind: 'not-a-permission-dialog' };
+    }
+    const once = options.filter((_option, index) => effects[index] === 'allow-once');
+    if (once.length === 1)
+        return { kind: 'allow-once', option: once[0] };
+    return { kind: 'unidentified', allowOnceCount: once.length };
+}

package/dist/server/src/lib/polling/auto-yes-policy.js

@@ -95,11 +95,14 @@ function readPolicy(worktreeId, cliToolId, instanceId) {
  * the resolver reads {@link AUTO_YES_POLICY_UNKNOWN} as withholding (Issue #3822).
  *
  * @param instanceId - Agent instance id (defaults to the primary, i.e. cliToolId)
+ * @param options - `fresh: true` reads the task past the cache (and refreshes
+ *   it): the poller's last look before a key (Issue #3822), where a contract
+ *   switched or a deny pattern added within the TTL must already count
  * @returns The contract's autoYes block, null when no contract governs this
  *   instance, or {@link AUTO_YES_POLICY_UNKNOWN} when the lookup failed
  */
-function getSessionAutoYesPolicy(worktreeId, cliToolId, instanceId) {
-    return lookupEntry(worktreeId, cliToolId, instanceId).policy;
+function getSessionAutoYesPolicy(worktreeId, cliToolId, instanceId, options) {
+    return lookupEntry(worktreeId, cliToolId, instanceId, options?.fresh === true).policy;
 }
 /**
  * The policy and the id of the task it came from, read in ONE lookup (Issue
@@ -162,17 +165,20 @@ function getSessionContractPolicySummary(worktreeId, cliToolId, instanceId) {
         denyPatternCount: policy.denyPatterns.length,
     };
 }
-function lookupEntry(worktreeId, cliToolId, instanceId) {
+function lookupEntry(worktreeId, cliToolId, instanceId, fresh = false) {
     const resolvedInstanceId = instanceId ?? cliToolId;
     const key = (0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, resolvedInstanceId);
     const now = Date.now();
     const cached = policyCache.get(key);
-    if (cached && cached.expiresAt > now) {
+    if (!fresh && cached && cached.expiresAt > now) {
         return cached;
     }
     const { policy, taskId } = readPolicy(worktreeId, cliToolId, resolvedInstanceId);
     if ((0, auto_yes_resolver_1.isAutoYesPolicyUnknown)(policy)) {
-        // Issue #3822: not cached, so the next lookup reads again.
+        // Issue #3822: not cached, so the next lookup reads again. A fresh read
+        // that failed also drops what was cached: it is no longer known to hold.
+        if (fresh)
+            policyCache.delete(key);
         return { policy, taskId, expiresAt: now };
     }
     if (policyCache.size >= MAX_CACHE_ENTRIES) {

package/dist/server/src/lib/polling/auto-yes-poller-capture.js

@@ -13,9 +13,15 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.capturePollerFrame = capturePollerFrame;
 exports.captureAndCleanOutput = captureAndCleanOutput;
+const async_hooks_1 = require("async_hooks");
 const cli_session_1 = require("../session/cli-session");
+const global_state_1 = require("../global-state");
 const cli_patterns_1 = require("../detection/cli-patterns");
 const auto_yes_config_1 = require("../../config/auto-yes-config");
+/** Where `cli-session` reports whether the capture it runs inside cut the pane's top (Issue #3881 N4). */
+function headCutSink() {
+    return (0, global_state_1.getOrInitGlobal)('__captureHeadCutSink', () => new async_hooks_1.AsyncLocalStorage());
+}
 /**
  * Capture tmux session output once, keeping both spellings (Issue #2522).
  *
@@ -28,8 +34,15 @@ const auto_yes_config_1 = require("../../config/auto-yes-config");
  */
 async function capturePollerFrame(worktreeId, cliToolId, captureLines, instanceId) {
     const lines = captureLines ?? auto_yes_config_1.FULL_CAPTURE_LINES;
-    const output = await (0, cli_session_1.captureSessionOutput)(worktreeId, cliToolId, lines, instanceId);
-    return { raw: output, clean: (0, cli_patterns_1.stripBoxDrawing)((0, cli_patterns_1.stripAnsi)(output)) };
+    const reported = {};
+    const output = await headCutSink().run((headCut) => {
+        reported.headCut = headCut;
+    }, () => (0, cli_session_1.captureSessionOutput)(worktreeId, cliToolId, lines, instanceId));
+    return {
+        raw: output,
+        clean: (0, cli_patterns_1.stripBoxDrawing)((0, cli_patterns_1.stripAnsi)(output)),
+        ...(reported.headCut !== undefined ? { headCut: reported.headCut } : {}),
+    };
 }
 /**
  * Capture tmux session output and strip ANSI escape codes.

package/dist/server/src/lib/polling/auto-yes-poller-generation.js

@@ -22,9 +22,13 @@ exports.isPollerCurrent = isPollerCurrent;
 exports.isTickCurrent = isTickCurrent;
 exports.isSameSession = isSameSession;
 exports.isDuplicatePrompt = isDuplicatePrompt;
+exports.reserveDuplicateRetry = reserveDuplicateRetry;
+exports.isDuplicateRetryOf = isDuplicateRetryOf;
+exports.releaseDuplicateRetry = releaseDuplicateRetry;
 const auto_yes_enter_fallback_1 = require("./auto-yes-enter-fallback");
 const auto_yes_state_1 = require("../auto-yes-state");
 const global_state_1 = require("../global-state");
+const auto_yes_manual_answer_1 = require("./auto-yes-manual-answer");
 /** In-memory storage for poller states (globalThis for hot reload persistence) */
 exports.autoYesPollerStates = (0, global_state_1.getOrInitGlobal)('__autoYesPollerStates', () => new Map());
 // =============================================================================
@@ -113,7 +117,8 @@ function isPollerCurrent(generation) {
 }
 /**
  * May the tick still act: its poller, its grant (the same enable, not expired)
- * and its session (no relaunch since) are all still the ones it started under.
+ * and its session (no relaunch since) are all still the ones it started under,
+ * and no person has begun answering on the instance since (Issue #3821).
  * Checked after capture, after each wait before a key, and inside the send.
  */
 function isTickCurrent(generation) {
@@ -124,6 +129,10 @@ function isTickCurrent(generation) {
     const grant = (0, auto_yes_state_1.getAutoYesState)(generation.worktreeId, generation.cliToolId, generation.instanceId);
     if (grant !== generation.grant || !grant.enabled)
         return false;
+    // Issue #3821: a person began answering on this instance since the tick started
+    // (Issue #3880: or a person's send ended with keys maybe on the pane, holding it).
+    if ((generation.manualAnswerSeq ?? 0) !== (0, auto_yes_manual_answer_1.getManualAnswerSeq)(generation.compositeKey))
+        return false;
     return isSameSession(generation);
 }
 /**
@@ -149,3 +158,35 @@ function isDuplicatePrompt(pollerState, promptKey) {
         return false;
     return (Date.now() - pollerState.lastAnsweredAt) < auto_yes_state_1.DUPLICATE_RETRY_EXPIRY_MS;
 }
+/**
+ * Issue #3791 (review N1): publish that the duplicate guard held back the
+ * prompt on screen on this tick ({@link isDuplicatePrompt} was true), for the
+ * push gate to hold the wait until the guard's retry. Only the guard's own
+ * verdict sets it: an answer alone (`lastAnsweredAt`) says nothing about the
+ * screen now up — another prompt, or a failed tick, is not held by the guard.
+ */
+function reserveDuplicateRetry(pollerState, promptKey, now) {
+    if (pollerState.lastAnsweredAt === null)
+        return;
+    pollerState.duplicateRetryReservation = { promptKey, answeredAt: pollerState.lastAnsweredAt, observedAt: now };
+}
+/**
+ * Issue #3791 (review N3): is `promptKey` the prompt the guard reserved, its
+ * guard since expired — the tick about to send the retry the reservation
+ * waited for? Its reservation is then kept until that send is settled.
+ */
+function isDuplicateRetryOf(pollerState, promptKey) {
+    const reservation = pollerState.duplicateRetryReservation;
+    return (reservation !== undefined &&
+        reservation !== null &&
+        reservation.promptKey === promptKey &&
+        reservation.answeredAt === pollerState.lastAnsweredAt);
+}
+/**
+ * Issue #3791 (review N1): the tick did not hold the prompt back with the
+ * guard — another screen, no prompt, a failed tick, no session — so the wait
+ * is no longer the guard's retry to wait for.
+ */
+function releaseDuplicateRetry(pollerState) {
+    pollerState.duplicateRetryReservation = null;
+}