tmux-ide 2.6.1 → 2.8.0

package/packages/daemon/src/tui/detect/manifests.ts

@@ -8,14 +8,26 @@
  * stay minimal. Treat every matcher below as a heuristic to tune, not a
  * contract — edit freely as agent UIs change.
  *
- * EVIDENCE PROVENANCE. The `claude` and `codex` manifests are tuned against
- * REAL captured screens (see `manifest-corpus.test.ts` for the sanitized
- * fixtures). Each matcher cites the invariant it was built from ("seen: …").
- * The remaining manifests (`opencode`, `gemini`, `aider`, `copilot`) are
- * best-effort from public docs/common knowledge — every one of their matchers
- * is marked "untuned — needs real captures" and kept HIGH-PRECISION
- * (esc-to-interrupt / spinner / explicit y-n) so they can never false-positive
- * on a plain prompt. Users can override any of these with a JSON file in
+ * EVIDENCE PROVENANCE (per-manifest `confidence`):
+ *   - `tuned` — built from REAL captured screens or the agent's own source
+ *     strings. `claude`, `codex`, and `aider` are tuned: codex from live
+ *     `tmux capture-pane` frames driven through a real turn (idle / working /
+ *     command-approval / trust prompt), aider from the verbatim prompt strings
+ *     in its installed source (`io.py` confirm_ask, `waiting.py` spinner).
+ *     Each matcher cites the invariant it was built from ("seen: …").
+ *   - `conservative` — best-effort from public docs/common knowledge
+ *     (`opencode`, `gemini`, `copilot`, `cursor`, `goose`, `amp`, and the
+ *     M25.4 breadth set: `devin`, `kimi`, `pi`, `grok`, `kiro`, `cline`,
+ *     `droid`, `kilo`). Every matcher is HIGH-PRECISION (esc-to-interrupt /
+ *     spinner / explicit y-n / "Do you want") so it can never false-positive
+ *     on a plain prompt, but it may miss real states until a live capture
+ *     upgrades it. `opencode` was attempted live but its local auth DB errored
+ *     and the TUI rendered blank, so it stays conservative. Several M25.4
+ *     manifests carry source/binary-VERBATIM markers (see each manifest's
+ *     provenance comment) but stay conservative until a live capture confirms
+ *     the surrounding chrome.
+ *
+ * Users can override any of these with a JSON file in
  * `~/.tmux-ide/agent-detection/` (see `manifest-loader.ts`).
  */
 import type { AgentManifest } from "./manifest.ts";
@@ -27,6 +39,7 @@ const BRAILLE_SPINNER = "[⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏]";
 const CLAUDE: AgentManifest = {
   id: "claude",
   commands: ["claude"],
+  confidence: "tuned",
   states: {
     // Approval / confirmation prompts — Claude is waiting on the user.
     // Claude's approval UI is a bordered box asking a "Do you want …?" question
@@ -74,41 +87,57 @@ const CLAUDE: AgentManifest = {
 
 const CODEX: AgentManifest = {
   id: "codex",
-  commands: ["codex"],
+  commands: ["codex", "codex.exe"],
+  confidence: "tuned",
   states: {
+    // TUNED against real captures (codex-cli v0.142.5, driven through a turn).
+    // The command-approval dialog and the directory-trust prompt are the two
+    // "blocked" screens. Codex's approval menu uses a "› 1." numbered arrow —
+    // note the arrow is "›" (U+203A), NOT claude's "❯".
     blocked: {
       any: [
-        // untuned — needs real captures. Codex approval prompts (docs/common
-        // knowledge): a command-approval question before running a shell
-        // command. Kept high-precision so it can't fire on the idle "›" box.
-        { region: "bottom", contains: "Allow command", caseInsensitive: true },
-        { region: "bottom", contains: "Do you want" },
-        { region: "bottom", contains: "approve", caseInsensitive: true },
-        { region: "bottom", contains: "(y/n)", caseInsensitive: true },
+        // seen (command approval): "Would you like to run the following
+        // command?" above a "$ <cmd>" preview and the numbered menu.
+        { region: "bottom", contains: "Would you like to run", caseInsensitive: true },
+        // seen: the highlighted approval option "› 1. Yes, proceed".
+        { region: "bottom", contains: "Yes, proceed" },
+        // seen: "3. No, and tell Codex what to do differently (esc)".
+        { region: "bottom", contains: "No, and tell Codex" },
+        // seen: the confirm footer under the approval menu.
+        { region: "bottom", contains: "Press enter to confirm", caseInsensitive: true },
+        // seen (directory-trust prompt on first launch in an untrusted dir):
+        // "Do you trust the contents of this directory?" + "1. Yes, continue".
+        { region: "bottom", contains: "Do you trust the contents", caseInsensitive: true },
       ],
     },
     working: {
       any: [
-        // untuned for the exact string — Codex shows an elapsed-time working
-        // line with an interrupt hint while a turn runs. "esc to interrupt" is
-        // the shared CLI-TUI invariant; the spinner is the fallback.
+        // seen (verbatim): the working status line is
+        //   "• Working (6s • esc to interrupt)".
+        // Both the "Working (" prefix and the shared "esc to interrupt" hint
+        // are present for the whole turn.
+        { region: "bottom", regex: "Working \\(\\d" },
         { region: "bottom", contains: "esc to interrupt", caseInsensitive: true },
         { region: "bottom", regex: BRAILLE_SPINNER },
         { region: "title", regex: BRAILLE_SPINNER },
       ],
     },
-    // done: omitted. NOTE (seen, NOT used): idle Codex shows a "›" input prompt
-    // and a "gpt-5.5 high · <cwd>            Goal achieved (5m)" status line —
-    // "Goal achieved" is a finished/idle marker, not "working", so it is left
-    // out (a done rule would collapse to idle in the instant classifier anyway).
+    // done: omitted. NOTE (seen, NOT used): a finished turn leaves the agent's
+    // answer above the idle "›" input box (placeholder "Find and fix a bug in
+    // @filename") and a "gpt-5.5 xhigh · <cwd>" status line; older builds also
+    // showed "Goal achieved (5m)". None are working/blocked evidence, so codex
+    // correctly falls through to idle and the classifier infers done.
   },
 };
 
 const OPENCODE: AgentManifest = {
   id: "opencode",
-  commands: ["opencode"],
+  commands: ["opencode", "opencode.exe"],
+  confidence: "conservative",
   states: {
-    // untuned — needs real captures. High-precision only.
+    // conservative — a live capture was attempted (opencode v1.17.10) but its
+    // local auth DB errored ("no such column: name") and the TUI rendered
+    // blank, so these stay best-effort. High-precision only.
     blocked: {
       any: [
         { region: "bottom", contains: "(y/n)", caseInsensitive: true },
@@ -129,8 +158,10 @@ const OPENCODE: AgentManifest = {
 const GEMINI: AgentManifest = {
   id: "gemini",
   commands: ["gemini"],
+  confidence: "conservative",
   states: {
-    // untuned — needs real captures. gemini-cli. High-precision only.
+    // conservative — gemini-cli needs a Google account/API key to reach a
+    // working state, so no live capture was taken. High-precision only.
     blocked: {
       any: [
         { region: "bottom", contains: "(y/n)", caseInsensitive: true },
@@ -153,20 +184,33 @@ const GEMINI: AgentManifest = {
 const AIDER: AgentManifest = {
   id: "aider",
   commands: ["aider"],
+  confidence: "tuned",
   states: {
-    // untuned — needs real captures. aider uses "(Y)es/(N)o" confirmation
-    // prompts, which are its most reliable blocked signal.
+    // TUNED from aider's installed source (v0.86.2). Every confirmation renders
+    // through `io.confirm_ask` (io.py), which appends the literal option string
+    // " (Y)es/(N)o" (plus "/(A)ll/(S)kip all" or "/(D)on't ask again") and a
+    // "[Yes]:"/"[No]:" default — so "(Y)es/(N)o" is aider's exact, universal
+    // blocked marker. The specific questions below are verbatim from
+    // base_coder.py / commands.py.
     blocked: {
       any: [
         { region: "bottom", contains: "(Y)es/(N)o", caseInsensitive: true },
-        { region: "bottom", contains: "? [Yes]", caseInsensitive: true },
         { region: "bottom", contains: "Add file to the chat", caseInsensitive: true },
+        { region: "bottom", contains: "Allow edits to file", caseInsensitive: true },
+        { region: "bottom", contains: "Add command output to the chat", caseInsensitive: true },
+        { region: "bottom", contains: "Run pip install", caseInsensitive: true },
       ],
     },
-    // working: aider streams tokens without a stable status line, so we leave
-    // it to idle-by-default rather than risk a false positive.
+    // TUNED: while a turn runs aider shows a `WaitingSpinner` (waiting.py)
+    // rendered as "[░█   ] Waiting for <model>" — the text is literally
+    // "Waiting for LLM" or "Waiting for " + the model name (base_coder.py:1440).
+    // aider's spinner uses a "░█" scanner, NOT braille, so "Waiting for " is the
+    // real invariant; the braille probe is kept only as a harmless fallback.
     working: {
-      any: [{ region: "bottom", regex: BRAILLE_SPINNER }],
+      any: [
+        { region: "bottom", contains: "Waiting for ", caseInsensitive: false },
+        { region: "bottom", regex: BRAILLE_SPINNER },
+      ],
     },
   },
 };
@@ -174,8 +218,10 @@ const AIDER: AgentManifest = {
 const COPILOT: AgentManifest = {
   id: "copilot",
   commands: ["copilot", "github-copilot", "github-copilot-cli"],
+  confidence: "conservative",
   states: {
-    // untuned — needs real captures. github-copilot-cli. High-precision only.
+    // conservative — github-copilot-cli needs a GitHub account, so no live
+    // capture was taken. High-precision only.
     blocked: {
       any: [
         { region: "bottom", contains: "(y/n)", caseInsensitive: true },
@@ -193,9 +239,314 @@ const COPILOT: AgentManifest = {
   },
 };
 
+const CURSOR: AgentManifest = {
+  id: "cursor",
+  commands: ["cursor-agent", "cursor"],
+  confidence: "conservative",
+  states: {
+    // conservative — cursor-agent (Cursor CLI) was launched live but sits on a
+    // "Press any key to log in…" pre-auth screen without an account, so no
+    // working/blocked turn could be captured. The pre-auth splash ("Cursor
+    // Agent" / "Press any key to log in") is idle chrome and deliberately NOT
+    // matched here. Markers below are high-precision guesses from public
+    // knowledge of its approval/streaming UI. NOTE: cursor-agent runs under
+    // `node`, so it resolves via the process-tree (argv0 basename), not the
+    // pane's `current_command`.
+    blocked: {
+      any: [
+        { region: "bottom", contains: "Do you want", caseInsensitive: false },
+        { region: "bottom", contains: "Run this command", caseInsensitive: true },
+        { region: "bottom", contains: "Apply this edit", caseInsensitive: true },
+        { region: "bottom", contains: "(y/n)", caseInsensitive: true },
+      ],
+    },
+    working: {
+      any: [
+        { region: "bottom", contains: "esc to interrupt", caseInsensitive: true },
+        { region: "bottom", regex: BRAILLE_SPINNER },
+        { region: "title", regex: BRAILLE_SPINNER },
+      ],
+    },
+  },
+};
+
+const GOOSE: AgentManifest = {
+  id: "goose",
+  commands: ["goose"],
+  confidence: "conservative",
+  states: {
+    // conservative — Block's goose CLI needs a configured provider, so no live
+    // capture was taken. High-precision only; markers are best-effort from
+    // public knowledge of its confirmation/streaming UI.
+    blocked: {
+      any: [
+        { region: "bottom", contains: "Do you want", caseInsensitive: false },
+        { region: "bottom", contains: "Allow this tool", caseInsensitive: true },
+        { region: "bottom", contains: "(y/n)", caseInsensitive: true },
+        { region: "bottom", contains: "[y/n]", caseInsensitive: true },
+      ],
+    },
+    working: {
+      any: [
+        { region: "bottom", contains: "esc to interrupt", caseInsensitive: true },
+        { region: "bottom", regex: BRAILLE_SPINNER },
+        { region: "title", regex: BRAILLE_SPINNER },
+      ],
+    },
+  },
+};
+
+const AMP: AgentManifest = {
+  id: "amp",
+  commands: ["amp"],
+  confidence: "conservative",
+  states: {
+    // conservative — Sourcegraph's amp CLI needs an account, so no live capture
+    // was taken. High-precision only; markers are best-effort from public
+    // knowledge of its approval/streaming UI.
+    blocked: {
+      any: [
+        { region: "bottom", contains: "Do you want", caseInsensitive: false },
+        { region: "bottom", contains: "Allow", caseInsensitive: false },
+        { region: "bottom", contains: "(y/n)", caseInsensitive: true },
+      ],
+    },
+    working: {
+      any: [
+        { region: "bottom", contains: "esc to interrupt", caseInsensitive: true },
+        { region: "bottom", regex: BRAILLE_SPINNER },
+        { region: "title", regex: BRAILLE_SPINNER },
+      ],
+    },
+  },
+};
+
+const DEVIN: AgentManifest = {
+  id: "devin",
+  commands: ["devin"],
+  confidence: "conservative",
+  states: {
+    // conservative — Devin CLI (Cognition; closed-source native Rust binary,
+    // needs an account). Blocked markers are VERBATIM from docs.devin.ai
+    // (cli/changelog + essential-commands via llms-full.txt): the plan-mode
+    // approval menu and the always-allow option. Devin has NO verified working
+    // text (its spinner is unlabeled; docs say interrupt is Ctrl+C, not esc),
+    // so working keeps only the shared spinner probe.
+    blocked: {
+      any: [
+        // seen (docs): "Yes, implement plan and accept edits" / "…and bypass
+        // permissions" — the shared prefix covers both.
+        { region: "bottom", contains: "Yes, implement plan and" },
+        { region: "bottom", contains: "No, plan needs changes" },
+        { region: "bottom", contains: "Yes, always allow" },
+      ],
+    },
+    working: {
+      any: [
+        { region: "bottom", regex: BRAILLE_SPINNER },
+        { region: "title", regex: BRAILLE_SPINNER },
+      ],
+    },
+  },
+};
+
+const KIMI: AgentManifest = {
+  id: "kimi",
+  commands: ["kimi"],
+  confidence: "conservative",
+  states: {
+    // conservative — kimi CLI (MoonshotAI/kimi-cli, Python/prompt_toolkit).
+    // Blocked markers are VERBATIM from its source (_approval_panel.py): the
+    // approval panel's "<tool> is requesting approval to …" header and its
+    // option labels. Its working spinner is a text-less moon animation (not
+    // braille), so working may under-detect until tuned — the braille probe is
+    // kept only as the shared fallback. ("Thinking"/"Thought for" deliberately
+    // NOT matched: they persist in the transcript after the turn.)
+    blocked: {
+      any: [
+        { region: "bottom", contains: " is requesting approval to " },
+        { region: "bottom", contains: "Approve for this session" },
+        { region: "bottom", contains: "Reject, tell the model" },
+      ],
+    },
+    working: {
+      any: [
+        { region: "bottom", regex: BRAILLE_SPINNER },
+        { region: "title", regex: BRAILLE_SPINNER },
+      ],
+    },
+  },
+};
+
+const PI: AgentManifest = {
+  id: "pi",
+  commands: ["pi"],
+  confidence: "conservative",
+  states: {
+    // conservative — pi (@mariozechner/pi-coding-agent, node). Working marker
+    // is VERBATIM from its source (interactive-mode.ts): the status line is
+    // `Working... (esc to interrupt)`, with `(esc to cancel)` retry/compacting
+    // variants. Its core has NO distinctive approval wording (generic Yes/No
+    // via extensions), so blocked is deliberately ABSENT — authority
+    // self-reporting or the classifier's fallback carry it.
+    working: {
+      any: [
+        { region: "bottom", contains: "Working... (esc to interrupt)" },
+        { region: "bottom", contains: "(esc to cancel)" },
+        { region: "bottom", regex: BRAILLE_SPINNER },
+        { region: "title", regex: BRAILLE_SPINNER },
+      ],
+    },
+  },
+};
+
+const GROK: AgentManifest = {
+  id: "grok",
+  commands: ["grok"],
+  confidence: "conservative",
+  states: {
+    // conservative — the community grok CLI (@vibe-kit/grok-cli /
+    // superagent-ai/grok-cli, node/OpenTUI). Working markers are VERBATIM from
+    // its source (app.tsx / headless output.ts): the mid-turn placeholder
+    // carries "(esc to interrupt)" and headless prints "⏳ Processing...".
+    // Its ConfirmationDialog wording could not be verified, so blocked keeps
+    // only a high-precision generic. NOTE: xAI's separate official
+    // `grok-build` binary substring-matches this manifest but has no verified
+    // strings — it will simply read idle until evidence exists.
+    blocked: {
+      any: [{ region: "bottom", contains: "(y/n)", caseInsensitive: true }],
+    },
+    working: {
+      any: [
+        { region: "bottom", contains: "esc to interrupt", caseInsensitive: true },
+        { region: "bottom", contains: "⏳ Processing" },
+        { region: "bottom", regex: BRAILLE_SPINNER },
+        { region: "title", regex: BRAILLE_SPINNER },
+      ],
+    },
+  },
+};
+
+const KIRO: AgentManifest = {
+  id: "kiro",
+  commands: ["kiro-cli", "kiro"],
+  confidence: "conservative",
+  states: {
+    // conservative — Kiro CLI (AWS; the rebranded Amazon Q Developer CLI, a
+    // native Rust binary). Markers are VERBATIM from the open-source
+    // predecessor (aws/amazon-q-developer-cli chat-cli/src/cli/chat/mod.rs):
+    // the tool-approval question and the Spinners::Dots "Thinking..." status.
+    // The closed Kiro build may drift — same lineage, pending live capture.
+    // NOTE: the predecessor's 1-char `q` binary is deliberately NOT a command
+    // token (a single letter substring-matches far too much).
+    blocked: {
+      any: [
+        { region: "bottom", contains: "Allow this action?" },
+        { region: "bottom", contains: "to trust (always allow) this tool" },
+      ],
+    },
+    working: {
+      any: [
+        { region: "bottom", contains: "Thinking..." },
+        { region: "bottom", regex: BRAILLE_SPINNER },
+        { region: "title", regex: BRAILLE_SPINNER },
+      ],
+    },
+  },
+};
+
+const CLINE: AgentManifest = {
+  id: "cline",
+  commands: ["cline"],
+  confidence: "conservative",
+  states: {
+    // conservative — cline CLI (cline.bot; CLI 2.0 ships prebuilt platform
+    // binaries, OpenTUI). Markers are VERBATIM from its source: the approval
+    // dialog's "Cline needs permission" title + "Approve tool call?" header
+    // (tui/components/dialogs/tool-approval.tsx) and the streaming
+    // "Thinking... (esc to cancel)" status (chat-message-list.tsx).
+    blocked: {
+      any: [
+        { region: "bottom", contains: "Cline needs permission" },
+        { region: "bottom", contains: "Approve tool call?" },
+        { region: "bottom", contains: "[y] Approve" },
+      ],
+    },
+    working: {
+      any: [
+        { region: "bottom", contains: "esc to cancel", caseInsensitive: true },
+        { region: "bottom", regex: BRAILLE_SPINNER },
+        { region: "title", regex: BRAILLE_SPINNER },
+      ],
+    },
+  },
+};
+
+const DROID: AgentManifest = {
+  id: "droid",
+  commands: ["droid"],
+  confidence: "conservative",
+  states: {
+    // conservative — droid (Factory CLI) was launched live (v0.114.1) but sits
+    // on an auth-gated login menu without a Factory account, so only the login
+    // splash could be captured (it reads IDLE and is deliberately not matched:
+    // "Please login with your Factory account to continue." / "> Login").
+    // Verified live: droid runs as its OWN process (`pane_current_command` =
+    // "droid"), so command matching needs no process-tree help.
+    // Blocked markers are docs-derived (docs.factory.ai auto-run levels,
+    // corroborated third-party walkthrough) — the Spec-mode proceed menu names
+    // its autonomy levels verbatim. Pending live-capture confirmation.
+    blocked: {
+      any: [
+        { region: "bottom", contains: "Proceed, manual approval" },
+        { region: "bottom", contains: "Proceed, allow safe commands" },
+        { region: "bottom", contains: "Proceed, allow all commands" },
+      ],
+    },
+    working: {
+      any: [
+        { region: "bottom", contains: "esc to interrupt", caseInsensitive: true },
+        { region: "bottom", regex: BRAILLE_SPINNER },
+        { region: "title", regex: BRAILLE_SPINNER },
+      ],
+    },
+  },
+};
+
+const KILO: AgentManifest = {
+  id: "kilo",
+  commands: ["kilo", ".kilo", "kilocode"],
+  confidence: "conservative",
+  states: {
+    // conservative, but the blocked markers are VERBATIM from the shipped
+    // @kilocode/cli binary (v7.4.5, strings-extracted — no account to drive a
+    // live capture): the permission dialog renders a "△ Permission required"
+    // header over an "Allow once" / "Allow always" / "Reject" option list.
+    // NOTE: the CLI's npm launcher (`bin/kilo`, node) execs the platform
+    // binary installed as `bin/.kilo`, hence the ".kilo" command token.
+    blocked: {
+      any: [
+        { region: "bottom", contains: "Permission required" },
+        { region: "bottom", contains: "Allow once" },
+        { region: "bottom", contains: "Allow always" },
+      ],
+    },
+    // No working-state string was found in the binary (its status UI renders
+    // from dynamic parts) — only the shared spinner probe, so kilo may read
+    // idle while working until a live capture tunes it.
+    working: {
+      any: [
+        { region: "bottom", regex: BRAILLE_SPINNER },
+        { region: "title", regex: BRAILLE_SPINNER },
+      ],
+    },
+  },
+};
+
 const SHELL: AgentManifest = {
   id: "shell",
   commands: ["bash", "zsh", "sh", "fish", "nu"],
+  confidence: "conservative",
   states: {
     // Catch-all: a raw shell is almost always idle. We only flag an explicit
     // interactive confirmation as blocked; "working" is unreliable to read
@@ -222,5 +573,16 @@ export const BUNDLED_MANIFESTS: AgentManifest[] = [
   GEMINI,
   AIDER,
   COPILOT,
+  CURSOR,
+  GOOSE,
+  AMP,
+  DEVIN,
+  KIMI,
+  PI,
+  GROK,
+  KIRO,
+  CLINE,
+  DROID,
+  KILO,
   SHELL,
 ];

package/packages/daemon/src/tui/detect/process-tree.ts

@@ -53,6 +53,16 @@ export function parsePsOutput(raw: string): ProcEntry[] {
  * depth are guarded.
  */
 export function subtreeCommands(entries: ProcEntry[], rootPid: number, maxDepth = 6): string[] {
+  return subtreeEntries(entries, rootPid, maxDepth).map((entry) => entry.command);
+}
+
+/**
+ * The full {@link ProcEntry} rows of the subtree rooted at `rootPid`, in the
+ * same deepest-first order as {@link subtreeCommands}. Callers that need PIDs
+ * (e.g. the session-id capture probing a pane's agent process by open files)
+ * use this; the command-only view above stays the common path.
+ */
+export function subtreeEntries(entries: ProcEntry[], rootPid: number, maxDepth = 6): ProcEntry[] {
   const childrenByParent = new Map<number, ProcEntry[]>();
   const byPid = new Map<number, ProcEntry>();
   for (const entry of entries) {
@@ -65,7 +75,7 @@ export function subtreeCommands(entries: ProcEntry[], rootPid: number, maxDepth
   const root = byPid.get(rootPid);
   if (!root) return [];
 
-  const commands: string[] = [];
+  const out: ProcEntry[] = [];
   const visited = new Set<number>();
 
   const walk = (pid: number, depth: number): void => {
@@ -76,11 +86,31 @@ export function subtreeCommands(entries: ProcEntry[], rootPid: number, maxDepth
       walk(child.pid, depth + 1);
     }
     const self = byPid.get(pid);
-    if (self) commands.push(self.command);
+    if (self) out.push(self);
   };
 
   walk(rootPid, 0);
-  return commands;
+  return out;
+}
+
+/**
+ * Summarize the executable-ish tokens seen in a pane's process subtree, in the
+ * order the tree-walk visits them (deepest first), de-duplicated. Pure.
+ *
+ * This is a DIAGNOSTIC for `agent explain`: when no manifest resolves, showing
+ * "process-tree saw: node, sleep" tells the user WHY nothing matched and what
+ * to point an `@agent_hint` at. Tokens are the same basenames
+ * `resolveAgentCommand` matches against, so the report reflects reality.
+ */
+export function describeSubtree(entries: ProcEntry[], rootPid: number, limit = 8): string[] {
+  const seen: string[] = [];
+  for (const command of subtreeCommands(entries, rootPid)) {
+    for (const token of commandTokens(command)) {
+      if (!seen.includes(token)) seen.push(token);
+      if (seen.length >= limit) return seen;
+    }
+  }
+  return seen;
 }
 
 /**