@hyperdrive.bot/fleet-server 0.3.99

package/dist/server/server/agent/providers/claude/transport/pty-query.js

@@ -0,0 +1,2075 @@
+import { randomUUID } from "node:crypto";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { PtyExitedError } from "./pty.js";
+import { TranscriptSdkReader } from "./transcript-sdk-reader.js";
+/**
+ * PtyQuery — a `Query`-shaped adapter over an interactive `claude` PTY.
+ *
+ * The query pump consumes `for await (message of query)` plus a handful of control
+ * methods. `SdkTransport` gets its `Query` straight from the SDK; the PTY transport has
+ * no SDK, so PtyQuery reconstructs the same `SDKMessage` stream:
+ *   - user turns  → typed into the PTY (write + Enter), gated on claude being ready
+ *   - assistant / tool_result messages → tailed from the session transcript JSONL
+ *   - turn end    → detected from the transcript (an `assistant` with a terminal
+ *                   `stop_reason` after a short idle) → a synthesized `result` message,
+ *                   which is what makes the pump emit `turn_completed`.
+ *
+ * Turn-end is transcript-derived (not hook-derived) on purpose: it removes the
+ * `paseo agent-hook` → socket round-trip from the critical path. A `Stop`-hook fast-path
+ * can be layered on later.
+ *
+ * Control methods: `interrupt()` sends ESC to the TUI; `setModel`/`setPermissionMode`/
+ * thinking are already driven by the `instanceof PtyTransport` branches in agent.ts
+ * (which write to the transport directly), so here they are safe no-ops. The long tail
+ * of `Query` methods (rewindFiles, readFile, …) is unsupported on the PTY path; the
+ * instance is cast `as unknown as Query` at the seam.
+ */
+/**
+ * Readiness is "the terminal stopped talking", not "the terminal said something".
+ *
+ * This used to schedule a settle 1500ms after EVERY chunk, and because settling is
+ * idempotent the first chunk always won: readiness fired 1.5s after the first byte no
+ * matter how much boot output was still streaming. The splash banner is a first byte, so
+ * on a slow start (seven MCP servers to connect) paseo began typing into a terminal that
+ * was not accepting input yet, and the prompt was lost outright. Observed 2026-08-01: a
+ * session whose entire recording was the splash line, then 70s of failed Enters.
+ *
+ * Resetting the timer on each chunk makes it a real debounce, so it settles once output
+ * has actually gone quiet. The ceiling is correspondingly generous, because waiting a few
+ * extra seconds costs nothing next to losing the message.
+ */
+const READY_QUIET_SETTLE_MS = 1500;
+const READY_MAX_WAIT_MS = 60000;
+/**
+ * How long the idle prompt must hold before we believe it. The TUI repaints its footer
+ * mid-turn, so a single frame without the busy marker is a flicker, not idleness.
+ */
+const READY_IDLE_STABLE_MS = 400;
+/**
+ * How long a control slash command (`/model`, `/effort`) waits for the terminal to accept
+ * input before giving up.
+ *
+ * Bounded by the same reasoning as a stall: if the TUI has not shown an input box in that
+ * long, waiting further buys nothing and the caller deserves to hear that the setting did
+ * not apply.
+ */
+const CONTROL_COMMAND_MAX_WAIT_MS = 60000;
+/** Poll interval while waiting for the input box. Cheap: it only reads cached state. */
+const CONTROL_COMMAND_POLL_MS = 100;
+/**
+ * Absolute ceiling on waiting for a busy terminal to go idle. Only reached while the TUI is
+ * actively telling us it is working, so it is a backstop against a wedged agent, not a boot
+ * budget. Matches the turn-stall backstop deliberately: both answer "this terminal claims to
+ * be working but never finished".
+ */
+const READY_BUSY_MAX_WAIT_MS = 10 * 60000;
+/** The TUI prints this in its footer for exactly as long as a turn is running. */
+const BUSY_MARKER = "esc to interrupt";
+/**
+ * Footer fragments that only render when the input box is accepting typing. Matched against
+ * the rolling tail, and only believed when {@link BUSY_MARKER} is absent, because the busy
+ * footer contains some of these too (`… · esc to interrupt · ← for agents`).
+ */
+const IDLE_PROMPT_MARKERS = [
+    "for agents",
+    "for shortcuts",
+    "bypass permissions",
+    "shift+tab to cycle",
+    "for commands",
+];
+const TURN_END_IDLE_MS = 700;
+/**
+ * How long to wait for the TUI to react to a slash command before giving up on it. Short:
+ * a command either renders immediately or was swallowed, and pressing Enter again would
+ * run it twice.
+ */
+const SLASH_COMMAND_ECHO_WAIT_MS = 3000;
+/**
+ * Echo-verified delivery.
+ *
+ * A claude TUI that is still parsing a large resumed transcript PAINTS its idle footer
+ * before its input loop is live, and in that state it DISCARDS keystrokes: typing produces
+ * no echo at all. Observed 2026-08-03 on a 215MB session: attach at 13:03:00, idle footer
+ * by 13:03:04, prompt typed plus five Enters, zero echo in the recording, no user line,
+ * message lost -- while every successful delivery in the same recordings shows the typed
+ * text echoed back. Echo is therefore the one signal that distinguishes "idle" from
+ * "idle-looking but deaf", and its absence also proves the keystrokes were discarded,
+ * which is exactly what makes retyping safe rather than a duplication risk.
+ */
+/**
+ * How much of the typed text must be found in the terminal output for it to count as an
+ * echo. Byte-counting was not enough: a freshly spawned claude under load keeps painting
+ * boot output (splash, MCP connects) after the readiness gate settles, and those bytes
+ * passed the old any-bytes check while the input loop was still dead -- three scheduled
+ * spawns failed that way in five minutes on a loaded box, 2026-08-03. Boot output never
+ * contains the user's message; a real input-box echo always does.
+ */
+/** How much of the message identifies it in a transcript record. */
+const RECEIPT_FINGERPRINT_CHARS = 64;
+/** Below this length a fingerprint must match a record WHOLE, never as a substring. */
+const RECEIPT_EXACT_MATCH_BELOW_CHARS = 12;
+/** How long one delivery attempt waits for its transcript receipt before retrying. */
+const RECEIPT_WINDOW_MS = 4000;
+/** A queued message can only land when the running turn ends, so wait far longer for it. */
+const QUEUED_RECEIPT_WINDOW_MS = 10 * 60000;
+/**
+ * The TUI's own words for "your message is in the queue".
+ *
+ * A message typed while a turn is running is QUEUED by claude, and a queued message
+ * appends NO `user` record until the running turn ends -- so the one delivery oracle
+ * (receiptSince) cannot fire, by construction, for minutes at a time. The old test for
+ * "is a turn running" was `lastTranscriptAt > attemptStartedAt`, i.e. "did the transcript
+ * grow during my 4s window". That is a proxy, and it reads FALSE whenever the running
+ * turn is simply quiet for four seconds (thinking, or one slow tool call). When it reads
+ * false the loop concludes the terminal is deaf and retypes.
+ *
+ * Retyping a QUEUED message is not idempotent: the composer is empty (the text already
+ * left it), so Ctrl+U clears nothing and the retype either stacks a second queued copy or
+ * concatenates onto text the clear failed to kill. Observed live 2026-08-20 on session
+ * 0b1ec622, four retries logged at 18:28:13 / 18:29:59 / 18:30:06 / 18:30:14 / 18:30:27,
+ * producing these transcript records:
+ *
+ *   mint another xpmint another xp
+ *   a new one with another cpf: 76797678153, caixaa new one with another cpf: ...
+ *
+ * The terminal was stating the answer the whole time. Paseo's own turn heartbeat captured
+ * it at 18:30:15: `... Press up to edit queued messages - esc to interrupt`. This reads
+ * that footer instead of inferring it from file growth.
+ */
+const QUEUED_FOOTER_RE = /Press up to edit queued messages/i;
+/** How much of the tail to scan for the footer. It is repainted on every frame. */
+const QUEUED_FOOTER_SCAN_CHARS = 2000;
+/** Backoff between retype attempts against a deaf terminal. */
+const DEAF_RETRY_INITIAL_MS = 2000;
+const DEAF_RETRY_MAX_MS = 60000;
+const TERMINAL_STOP_REASONS = new Set(["end_turn", "stop_sequence", "max_tokens"]);
+/**
+ * Liveness backstop: how long an in-flight turn may append NOTHING to the transcript
+ * before PtyQuery gives up and synthesizes a failed `result`.
+ *
+ * Without this the PTY path has no liveness detection at all, and a claude-side stall is
+ * indistinguishable from a long turn: the agent sits at `status: running` forever with no
+ * output, no error and no timeout. Observed 2026-07-31: an agent accepted a prompt, hit a
+ * provider auth failure, and stayed "running" for 2h33m emitting nothing, because
+ *   - the PTY's own output is unsubscribed once the readiness gate settles, so whatever the
+ *     TUI prints (`API Error 401 · Retrying in 32s`, …) is never seen, and
+ *   - `scheduleTurnEndCheck()` is only ever armed from `onTranscriptMessage()`, so silence
+ *     never arms anything, and `maybeCompleteTurn()` returns early unless it already saw a
+ *     terminal `stop_reason`.
+ * `TURN_END_IDLE_MS` is a 700ms turn-BOUNDARY debounce, not a stall detector.
+ *
+ * Deliberately generous: a legitimate turn can be quiet for a long time (one slow tool call
+ * writes nothing until its `tool_result` lands), and a false positive marks a healthy turn
+ * failed. Ten minutes is far past any normal tool call while still bounded. Tune per-call
+ * with `stallTimeoutMs`; `0` disables the backstop entirely.
+ */
+const TURN_STALL_TIMEOUT_MS = 10 * 60000;
+/**
+ * How much terminal text to keep for diagnosis. The TUI is the only place that says what
+ * claude is actually doing while it is quiet ("Compacting conversation…", a retry notice,
+ * a prompt), and PtyQuery otherwise unsubscribes from it once the readiness gate settles,
+ * so a stall investigation has nothing to read.
+ *
+ * A rolling tail rather than a live log on purpose: the TUI redraws constantly (spinner
+ * frames, cursor moves), so streaming it would flood the daemon log for no benefit. This
+ * keeps only the last few KB and emits it exactly once, when a turn is declared stalled.
+ */
+const TERMINAL_TAIL_MAX_CHARS = 4000;
+/** Chars of the tail to include in the user-facing stall message; the rest goes to the log. */
+const TERMINAL_TAIL_EXCERPT_CHARS = 300;
+/**
+ * Telemetry. The PTY path had none: a session that went quiet left no record of what it had
+ * been doing, and four distinct failure modes (prompt never submitted, stall after a
+ * compaction, never finished booting, genuinely waiting on the model) were indistinguishable
+ * from each other and from a slow turn. Each of the three below exists to separate them.
+ */
+/** Heartbeat cadence while a turn is outstanding. Cheap: one line per turn per interval. */
+const LIVENESS_HEARTBEAT_MS = 30000;
+/**
+ * The claude TUI's post-interrupt modal. A cancelled turn leaves the terminal sitting on
+ * `Interrupted · What should Claude do instead?`, and in that state Enter answers the dialog
+ * instead of submitting a turn, so every subsequent prompt is swallowed whole and the retry
+ * loop in submitTurn cannot win. Observed live 2026-08-01: a turn was cancelled at 16:56:08
+ * and the next message failed all five submit attempts 35s later.
+ *
+ * Matched against the terminal tail rather than guessed at, and acted on only while the
+ * sighting is recent, because sending ESC blindly would interrupt a healthy running turn.
+ */
+const INTERRUPT_PROMPT_MARKER = "what should claude do instead";
+/**
+ * The CLI's large-session resume dialog. Resuming a session past a usage threshold shows
+ *
+ *   This session is Nd old and NNNk tokens. ...We recommend resuming from a summary.
+ *   > 1. Resume from summary (recommended)      <- PRE-SELECTED
+ *     2. Resume full session as-is
+ *     3. Don't ask me again
+ *
+ * "Resume from summary" runs /compact, and confirming it is recorded in the transcript as
+ * a USER-TYPED /compact (entrypoint cli, userType external) -- indistinguishable from real
+ * input. Left unhandled, paseo's flow walks straight into it: the dialog is quiet, so the
+ * readiness gate settles; the user's message is typed into the menu and eaten; and the
+ * submit Enter confirms the pre-selected compaction. Proven by isolated replication
+ * 2026-08-03: two sessions compacted from a single Enter with paseo not involved, a third
+ * resumed intact when option 2 was selected instead.
+ *
+ * The answer is option 2: the user asked to talk to this session, so resume it whole.
+ * Selecting it takes one Down (to move off option 1) and one Enter.
+ */
+const RESUME_DIALOG_MARKER = "resume from summary";
+/** How long a sighting stays actionable; mirrors INTERRUPT_PROMPT_TTL_MS reasoning. */
+const RESUME_DIALOG_TTL_MS = 5 * 60000;
+/** How long a sighting stays actionable. Beyond this, assume the modal is long gone. */
+const INTERRUPT_PROMPT_TTL_MS = 5 * 60000;
+/**
+ * Full-session terminal recording, written next to the daemon log under
+ * `$PASEO_HOME/pty-recordings/<sessionId>.log`.
+ *
+ * The 4KB in-memory tail only survives to the next stall and holds seconds of history once
+ * the spinner is running; a session that failed at boot produced 579 chars total. A file
+ * keeps the whole run, so a failure can be read backwards afterwards instead of inferred.
+ * Capped and truncated rather than rotated: this is diagnostic data, the recent past is what
+ * matters, and an unbounded file on a long-running agent is its own incident.
+ */
+/** Tabs to try before giving up on finding the picker's Submit tab. */
+const DIALOG_SUBMIT_MAX_TABS = 12;
+const RECORDING_MAX_BYTES = 4 * 1024 * 1024;
+/** Keep this much when the cap is hit, so a truncation never leaves an empty file. */
+const RECORDING_KEEP_BYTES = 1024 * 1024;
+/**
+ * Monotonic milliseconds for every liveness comparison here.
+ *
+ * Never Date.now(): a stepping wall clock silently breaks all of them. Measured on this
+ * machine, the clock oscillated +/-48.6s roughly six times a minute, which made the
+ * readiness gate believe its 60s budget had elapsed after ~11s and type the user's prompt
+ * into a terminal that was still working, losing the message. The tell was an overshoot of
+ * 3641ms on a loop that ticks every 500ms: real elapse cannot overshoot by more than one
+ * tick, a clock step can.
+ */
+function monotonicNowMs() {
+    return performance.now();
+}
+export class PtyQuery {
+    constructor(opts) {
+        /** One queued notice per message, not one per retry. Reset by deliverPrompt(). */
+        this.queuedNoticeSent = false;
+        // output queue → async iterator
+        this.outQueue = [];
+        this.outResolvers = [];
+        this.done = false;
+        this.offReadyData = null;
+        /** Unsubscribes the transport exit tap. Teardown MUST call this. */
+        this.offExitTap = null;
+        /** Set once the agent process has exited; the two remaining "still running" claims read it. */
+        this.transportExited = null;
+        /**
+         * Cancels the readiness gate and its timers.
+         *
+         * Teardown MUST call this. A query closed before the gate settles used to leave its
+         * deadline interval running, so a session that attached and detached in the same
+         * millisecond still logged "readiness gate hit its timeout" a full minute later, warning
+         * about a terminal nobody was waiting on and leaking a timer per closed session.
+         */
+        this.cancelReadiness = null;
+        // turn-end tracking
+        this.turnEndTimer = null;
+        this.lastStopReason = null;
+        this.lastUsage = null;
+        this.turnStartedAt = 0;
+        this.numTurns = 0;
+        this.stallTimer = null;
+        this.turnInFlight = false;
+        // terminal tail (see TERMINAL_TAIL_MAX_CHARS)
+        this.terminalTail = "";
+        this.offTerminalTap = null;
+        // telemetry
+        this.startedAt = monotonicNowMs();
+        this.recordingPath = null;
+        this.recordingBytes = 0;
+        this.ptyBytesTotal = 0;
+        this.ptyBytesAtLastBeat = 0;
+        this.lastMeaningfulLine = "";
+        this.lastTranscriptAt = 0;
+        this.heartbeatTimer = null;
+        this.readySettledBy = null;
+        /** Last time the TUI footer said a turn was running. 0 = never seen. */
+        this.lastBusyAt = 0;
+        /**
+         * Serializes everything that TYPES into the terminal.
+         *
+         * Prompt delivery and control slash commands both write to the same single input line, and
+         * before this they ran on independent async paths with nothing ordering them.
+         */
+        this.writeGate = Promise.resolve();
+        /** Last sighting of the large-session resume dialog. 0 = never seen. */
+        this.resumeDialogAt = 0;
+        /** Set when the CLI rejected the just-submitted command; carries the CLI's own reply. */
+        this.rejectedCommandNotice = null;
+        /** Interactive TUI dialog awaiting the user (AskUserQuestion / plan approval), if any. */
+        this.pendingDialog = null;
+        /**
+         * Raw capture window for echo verification. The rolling tail deliberately drops lines
+         * with fewer than three letters as spinner noise, which also swallows the echo of a
+         * short message: "> go" never reaches the tail, so verifying against the tail held a
+         * two-letter message forever. While this is non-null, appendTerminalTail mirrors every
+         * stripped chunk here unfiltered.
+         */
+        this.echoProbe = null;
+        this.interruptPromptAt = 0;
+        this.transport = opts.transport;
+        this.input = opts.input;
+        this.sessionId = opts.sessionId;
+        this.transcriptPath = opts.transcriptPath;
+        this.logger = opts.logger;
+        this.stallTimeoutMs = opts.stallTimeoutMs ?? TURN_STALL_TIMEOUT_MS;
+        this.onDialogChange = opts.onDialogChange ?? null;
+        this.onNotice = opts.onNotice ?? null;
+        this.reader = new TranscriptSdkReader({
+            transcriptPath: opts.transcriptPath,
+            onMessage: (m) => this.onTranscriptMessage(m),
+            ...(opts.onUserPrompt ? { onUserPrompt: opts.onUserPrompt } : {}),
+        });
+        // Keep a rolling tail of terminal output. Registered BEFORE the readiness tap below so
+        // that looksIdle() sees the CURRENT chunk: handlers fire in registration order, and
+        // with the order reversed an idle prompt in the final frame was never noticed, because
+        // readiness inspected a tail that did not yet contain it. This one lives for the whole
+        // session so a stall has something to explain itself with. Chunks arrive already redacted (PtyTransport.onData
+        // runs redactChunk), so nothing further is needed here.
+        this.offTerminalTap = this.transport.onData((chunk) => this.appendTerminalTail(chunk));
+        // Learn about the agent process dying the moment it happens. Without this tap the only
+        // thing that ever noticed was the stall backstop, ten minutes later, and it then told the
+        // user the session was "still running and may recover" - of a process that had already
+        // printed its farewell banner and exited. The stall timer is for a live agent that is
+        // slow; it is the wrong instrument for a dead one.
+        this.offExitTap = this.transport.onExit((code, signal) => this.onTransportExit(code, signal));
+        // The executor stays trivial and settlement lives outside it, so there is exactly one
+        // resolve() call in the file. Timers and handlers below all funnel through settle(),
+        // which is guarded by `settled`; expressing that inside the executor tripped
+        // promise/no-multiple-resolved, and the rule is right that multiple resolve paths in an
+        // executor are hard to audit.
+        let resolveReady = () => { };
+        this.readyPromise = new Promise((resolve) => {
+            resolveReady = resolve;
+        });
+        let settled = false;
+        // Single resolve site. Both the normal outcomes and teardown funnel through here, so
+        // the promise provably resolves once no matter which timer or path gets there first.
+        const settle = (by) => {
+            if (settled)
+                return;
+            settled = true;
+            this.readySettledBy = by === "cancelled" ? null : by;
+            this.offReadyData?.();
+            clearTimeout(quietTimer ?? undefined);
+            clearTimeout(idleTimer ?? undefined);
+            clearInterval(deadlineTimer);
+            // A torn-down query never had a readiness problem, so it reports nothing.
+            if (by !== "cancelled") {
+                // Settling on the timeout means claude never produced output that looked like a
+                // booted TUI, so the prompt about to be typed may go into a terminal that is not
+                // listening yet and be lost outright. Loud on purpose.
+                const level = by === "timeout" ? "warn" : "debug";
+                this.logger[level]({
+                    sessionId: this.sessionId,
+                    settledBy: by,
+                    elapsedMs: monotonicNowMs() - this.startedAt,
+                    ptyBytes: this.ptyBytesTotal,
+                    sawBusyMarker: this.lastBusyAt > 0,
+                    lastLine: this.lastMeaningfulLine.slice(-120),
+                }, by === "timeout"
+                    ? "PtyQuery: readiness gate hit its timeout, claude may not be accepting input yet"
+                    : "PtyQuery: readiness settled on terminal output");
+            }
+            resolveReady();
+        };
+        const finish = settle;
+        this.cancelReadiness = () => settle("cancelled");
+        let quietTimer = null;
+        let idleTimer = null;
+        this.offReadyData = this.transport.onData(() => {
+            // Two independent paths to ready, because a PtyQuery attaches to a LONG-LIVED
+            // terminal, not only to a fresh boot (observed 2026-08-01: nine attach/detach
+            // cycles on one session's PTY).
+            //
+            //  - quiet:       nothing has been painted for a while. Correct for a cold boot.
+            //  - idle-prompt: the footer positively shows an input box and no busy marker.
+            //
+            // Quiet ALONE is wrong on re-attach: if the agent is mid-turn the spinner repaints
+            // at a couple of KB/s forever, so "went quiet" can never fire and the gate used to
+            // fall through to its timeout and type into a working terminal. That was the real
+            // cause of the lost prompts, and it is why absence-of-output cannot be the only
+            // signal here.
+            if (quietTimer)
+                clearTimeout(quietTimer);
+            quietTimer = setTimeout(() => finish("quiet"), READY_QUIET_SETTLE_MS);
+            quietTimer.unref?.();
+            if (this.looksIdle()) {
+                // Hold the idle read briefly: the footer repaints mid-turn and a single frame
+                // without the busy marker is a flicker, not idleness.
+                if (!idleTimer) {
+                    idleTimer = setTimeout(() => {
+                        if (this.looksIdle())
+                            finish("idle-prompt");
+                        idleTimer = null;
+                    }, READY_IDLE_STABLE_MS);
+                    idleTimer.unref?.();
+                }
+            }
+            else if (idleTimer) {
+                clearTimeout(idleTimer);
+                idleTimer = null;
+            }
+        });
+        // The deadline is conditional on evidence, not a flat budget. Only a terminal showing
+        // NO sign of life gets cut off at the short budget.
+        //
+        // Liveness is "has this PTY ever produced output", NOT "did the busy footer repaint
+        // recently". An earlier version keyed on the footer and timed out anyway on a session
+        // that was plainly working (60017ms, 78991 bytes, sawBusyMarker true but outside the
+        // window). Measured across captured sessions, the gap between footer repaints has a
+        // median of 37.7s and a p90 of 483s, so no recency window is defensible.
+        //
+        // Reaching this branch at all already proves the terminal is streaming: the quiet
+        // timer above resolves readiness after 1.5s of silence, so if we are still un-ready
+        // the quiet timer must be getting reset continuously. A genuinely dead terminal never
+        // fires onData, never arms the quiet timer, and never records a byte, which is exactly
+        // the case the short budget exists for.
+        const deadlineTimer = setInterval(() => {
+            const waited = monotonicNowMs() - this.startedAt;
+            if (this.ptyBytesTotal > 0) {
+                if (waited >= READY_BUSY_MAX_WAIT_MS)
+                    finish("timeout");
+                return;
+            }
+            if (waited >= READY_MAX_WAIT_MS)
+                finish("timeout");
+        }, 500);
+        deadlineTimer.unref?.();
+        this.openRecording();
+        if (opts.initMessage)
+            this.emit(opts.initMessage);
+        this.reader.start();
+        void this.runInputLoop();
+    }
+    // ---- output queue / AsyncGenerator ----------------------------------------
+    emit(message) {
+        if (this.done)
+            return;
+        const resolve = this.outResolvers.shift();
+        if (resolve) {
+            resolve({ value: message, done: false });
+            return;
+        }
+        this.outQueue.push(message);
+    }
+    next() {
+        const queued = this.outQueue.shift();
+        if (queued !== undefined)
+            return Promise.resolve({ value: queued, done: false });
+        if (this.done)
+            return Promise.resolve({ value: undefined, done: true });
+        return new Promise((resolve) => this.outResolvers.push(resolve));
+    }
+    return() {
+        this.finish();
+        return Promise.resolve({ value: undefined, done: true });
+    }
+    throw(error) {
+        this.finish();
+        return Promise.reject(error instanceof Error ? error : new Error(String(error)));
+    }
+    [Symbol.asyncIterator]() {
+        return this;
+    }
+    finish() {
+        if (this.done)
+            return;
+        this.done = true;
+        const hadDialog = this.pendingDialog !== null;
+        this.pendingDialog = null;
+        if (hadDialog)
+            this.notifyDialogChange();
+        this.cancelReadiness?.();
+        if (this.turnEndTimer)
+            clearTimeout(this.turnEndTimer);
+        this.turnEndTimer = null;
+        this.turnInFlight = false;
+        this.clearStallTimer();
+        this.offReadyData?.();
+        this.offTerminalTap?.();
+        this.offTerminalTap = null;
+        this.offExitTap?.();
+        this.offExitTap = null;
+        this.stopHeartbeat();
+        this.recordLine("--- PtyQuery detached ---");
+        try {
+            this.reader.stop();
+        }
+        catch {
+            /* ignore */
+        }
+        while (this.outResolvers.length > 0) {
+            this.outResolvers.shift()?.({ value: undefined, done: true });
+        }
+    }
+    // ---- input → PTY ----------------------------------------------------------
+    async runInputLoop() {
+        // Gate the first prompt on claude being ready to accept input (boot + settle),
+        // otherwise early keystrokes are dropped by the TUI (observed in the spike).
+        await this.readyPromise;
+        try {
+            for await (const userMessage of this.input) {
+                if (this.done)
+                    break;
+                // Inline images cannot be typed into a terminal, but the CLI agent can Read a
+                // file: stage each image to disk and reference it by path, the same serialization
+                // job toSdkUserMessage does for the SDK path.
+                const imageRefs = this.stageInlineImages(userMessage)
+                    .map((p) => `[Attached image: ${p}]`)
+                    .join(" ");
+                const text = [extractUserText(userMessage), imageRefs].filter(Boolean).join(" ").trim();
+                if (!text) {
+                    // An empty prompt used to be dropped silently right here, AFTER the manager had
+                    // already flipped the agent to "running": the sender stared at a spinner forever
+                    // (observed live 2026-08-04, an image-only message from a 0.3.10 app whose
+                    // composer also stripped the attachment). Nothing-deliverable is an answerable
+                    // outcome, so answer it.
+                    this.recordLine("--- message had no deliverable content; notifying sender ---");
+                    this.emit(this.buildNothingDeliverableResult());
+                    continue;
+                }
+                if (this.pendingDialog) {
+                    // The TUI is showing a question/plan dialog: typed text would be eaten by it and
+                    // pre-typing ESC would decline it. Either answer it (a reply that names an
+                    // option) or tell the sender what is being asked - never type across it.
+                    await this.answerPendingDialog(text);
+                    continue;
+                }
+                this.turnStartedAt = monotonicNowMs();
+                // Clear modals BEFORE typing, not after: text typed into either dialog is
+                // consumed by it, so recovering at submit time is already too late.
+                await this.answerResumeDialog();
+                await this.clearInterruptPrompt();
+                // Deliberately NOT normalized (e.g. lowercasing an auto-capitalized command
+                // token): paseo must never silently rewrite what the user typed. A wrong command is
+                // handled by relaying the CLI's own rejection -- including its "did you mean"
+                // suggestion -- back to the sender, which corrects every rejection cause honestly
+                // instead of hiding one narrow cause invisibly.
+                // Same gate as sendControlCommand: a control command must never interleave with a
+                // prompt on the shared input line.
+                const delivery = await this.runExclusive(() => this.deliverPrompt(text));
+                if (this.done)
+                    break;
+                if (delivery === "rejected") {
+                    // Not lost, refused: hand the CLI's own answer (which includes its "did you
+                    // mean" suggestion) to the sender instead of a phantom running turn.
+                    const notice = this.rejectedCommandNotice ?? "the command was not recognized.";
+                    this.rejectedCommandNotice = null;
+                    this.emit(this.buildCommandRejectedResult(notice));
+                    continue;
+                }
+                if (delivery === "exited") {
+                    // Dead, not deaf. `continue`, never `break`: the exit tap is what ends this query,
+                    // and breaking here would instead leave the input channel undrained, so a resend
+                    // would sit unread and the sender would watch a spinner - the symptom being fixed.
+                    this.emit(this.buildExitedResult(this.transportExited?.code ?? null, this.transportExited?.signal ?? null));
+                    continue;
+                }
+                if (delivery === "undelivered") {
+                    // No transcript receipt for the whole budget: the message never became a turn,
+                    // nothing was queued, and only the sender can decide what to do next.
+                    this.recordLine("--- no delivery receipt within the budget; message not delivered ---");
+                    this.emit(this.buildSubmitFailedResult());
+                    continue;
+                }
+                // "unconfirmed" is the slash-command case: exactly one Enter was sent and the CLI
+                // reacted, but a slash command may append no user record to confirm against.
+                // Treat it as started and let the stall backstop notice if it never runs -- never
+                // press Enter again, which would run the command twice.
+                // The turn is now claude's to answer; start the liveness clock. submitTurn() has
+                // confirmed claude accepted it (a real user line landed), so from here on silence
+                // means a stall, not a slow start.
+                this.turnInFlight = true;
+                this.armStallTimer();
+                this.startHeartbeat();
+            }
+        }
+        catch (err) {
+            this.logger.warn({ err }, "PtyQuery input loop ended");
+        }
+    }
+    /**
+     * The message the user sees when the terminal would not take their prompt.
+     *
+     * Only reachable while the query is still live (teardown breaks out before this), so it
+     * always describes a message that genuinely did not land and that only the user can
+     * resend. Shaped as a normal result so it renders in the timeline rather than being
+     * buried in the daemon log.
+     */
+    /** The CLI refused the command; relay its own reply so the sender can correct and resend. */
+    buildCommandRejectedResult(notice) {
+        const base = this.buildResult("submit_failed");
+        return {
+            ...base,
+            subtype: "error_during_execution",
+            is_error: true,
+            errors: [`The agent's CLI rejected the command: ${notice} Nothing was run.`],
+        };
+    }
+    /**
+     * Write each inline base64 image block to a temp file so the terminal agent can Read it
+     * by path. A staging failure is logged and skipped rather than thrown: the text part of
+     * the message (if any) must still be delivered.
+     */
+    stageInlineImages(message) {
+        const content = message.message?.content;
+        if (!Array.isArray(content))
+            return [];
+        const staged = [];
+        for (const block of content) {
+            if (!block || typeof block !== "object")
+                continue;
+            const image = block;
+            if (image.type !== "image")
+                continue;
+            const source = image.source;
+            if (!source || source.type !== "base64" || !source.data)
+                continue;
+            try {
+                const dir = path.join(os.tmpdir(), "paseo-pty-images", this.sessionId);
+                fs.mkdirSync(dir, { recursive: true });
+                const ext = IMAGE_MEDIA_TYPE_EXT[source.media_type ?? ""] ?? "png";
+                const file = path.join(dir, `image-${randomUUID().slice(0, 8)}.${ext}`);
+                fs.writeFileSync(file, Buffer.from(source.data, "base64"));
+                staged.push(file);
+            }
+            catch (err) {
+                this.logger.warn({ err }, "PtyQuery: failed to stage an inline image for delivery");
+            }
+        }
+        return staged;
+    }
+    /**
+     * The message had no text and no stageable image, so there is literally nothing to type.
+     * Emitted instead of dropping the message, because the manager has already marked the
+     * agent running by the time the input loop sees it: silence here is a forever-spinner.
+     */
+    buildNothingDeliverableResult() {
+        const base = this.buildResult("submit_failed");
+        return {
+            ...base,
+            subtype: "error_during_execution",
+            is_error: true,
+            errors: [
+                `Your message had nothing the terminal transport could deliver: no text, and no ` +
+                    `image it could stage to disk. Nothing was sent, so please resend it with text.` +
+                    `${this.stillRunningClause()}`,
+            ],
+        };
+    }
+    /**
+     * " The session itself is still running." -- but only when it is.
+     *
+     * The exit tap fixes the in-flight turn and the stall message. These two other results
+     * asserted the same thing unconditionally and are reachable after the process is gone, so
+     * they need the same correction. Wording matches buildExitedResult: no "aborted", and
+     * "status" rather than "code", so isAbortError() cannot swallow it and
+     * buildTurnFailedEvent() cannot scrape a phantom exit code out of it.
+     */
+    stillRunningClause() {
+        if (!this.transportExited)
+            return " The session itself is still running.";
+        return (` The agent process has exited, so the session is NOT running any more and will not ` +
+            `recover on its own; the conversation is still on disk, recover it with ` +
+            `"paseo import ${this.sessionId}".`);
+    }
+    /** Tell the provider the dialog state changed; never let a listener throw into the loop. */
+    notifyDialogChange() {
+        if (!this.onDialogChange)
+            return;
+        try {
+            this.onDialogChange(this.pendingDialog ? { ...this.pendingDialog } : null);
+        }
+        catch (err) {
+            this.logger.warn({ err }, "PtyQuery: dialog listener threw");
+        }
+    }
+    /** The dialog the TUI is waiting on, if any. */
+    interactiveDialog() {
+        return this.pendingDialog ? { ...this.pendingDialog } : null;
+    }
+    /**
+     * Answer the pending dialog by option index (0-based), the way the app's question card
+     * does. Returns false when there is no dialog or the keystrokes never registered.
+     */
+    async answerDialogByIndex(index) {
+        if (!this.pendingDialog || index < 0)
+            return false;
+        return await this.sendDialogAnswer(this.pendingDialog, index);
+    }
+    /**
+     * Answer a multi-question picker, one entry per question in on-screen order; a null
+     * leaves that question unanswered. The app's question card collects an answer for EVERY
+     * question, so collapsing them to a single index would throw away answers the user
+     * actually gave and submit those questions blank.
+     */
+    async answerDialogByIndexes(indexes) {
+        const dialog = this.pendingDialog;
+        if (!dialog)
+            return false;
+        if (indexes.length <= 1) {
+            const only = indexes[0];
+            return typeof only === "number" && only >= 0 ? await this.answerDialogByIndex(only) : false;
+        }
+        this.recordLine(`--- answering ${indexes.length} questions ---`);
+        for (const index of indexes) {
+            if (this.done || !this.pendingDialog)
+                break;
+            if (typeof index === "number" && index >= 0) {
+                for (let i = 0; i < index && !this.done; i++) {
+                    await this.transport.writeRaw?.("\u001b[B");
+                    await delay(DIALOG_KEY_DELAY_MS);
+                }
+                // Enter checks this question and moves focus to the next one.
+                await this.transport.writeRaw?.("\r");
+            }
+            else {
+                // No answer for this one: Tab past it rather than picking whatever is highlighted.
+                await this.transport.writeRaw?.("\t");
+            }
+            await delay(DIALOG_KEY_DELAY_MS);
+        }
+        await this.reachSubmitTabAndConfirm();
+        const deadline = monotonicNowMs() + DIALOG_ANSWER_CONFIRM_MS;
+        while (this.pendingDialog && !this.done && monotonicNowMs() < deadline) {
+            await delay(250);
+        }
+        if (this.pendingDialog) {
+            this.recordLine("--- multi-question answer did not register ---");
+            this.notifyDialogDriveFailed();
+            return false;
+        }
+        this.turnStartedAt = monotonicNowMs();
+        this.turnInFlight = true;
+        this.armStallTimer();
+        this.startHeartbeat();
+        return true;
+    }
+    /**
+     * Try to answer the pending TUI dialog with the user's reply. A reply that names an
+     * option (its 1-based number or its label) becomes Down-arrow presses + Enter, the same
+     * proven mechanism as the resume-dialog answerer. Anything else gets the question echoed
+     * back with the options, and nothing is typed - an unanswerable message must never turn
+     * into a silent decline.
+     */
+    async answerPendingDialog(text) {
+        const dialog = this.pendingDialog;
+        if (!dialog)
+            return;
+        const index = matchDialogOption(text, dialog.options);
+        if (index !== null) {
+            const answered = await this.sendDialogAnswer(dialog, index);
+            if (!answered) {
+                this.emit(this.buildDialogPendingResult(dialog, true));
+            }
+            return;
+        }
+        // The reply names no option. That is NOT a dead end: an AskUserQuestion picker always
+        // renders a free-text entry after the model's options, so free text has a real home
+        // in the dialog. Dropping it here is what made a typed answer look like it vanished.
+        if (dialog.name === "AskUserQuestion" && (await this.sendDialogFreeText(text)))
+            return;
+        this.recordLine(`--- reply does not name a ${dialog.name} option; echoing question ---`);
+        this.notify(`Your message was not delivered: the agent is waiting on a ${dialog.name === "ExitPlanMode" ? "plan-approval" : "question"} dialog and the reply matched no option. Reply with an option number to answer it.`);
+        this.emit(this.buildDialogPendingResult(dialog));
+    }
+    /**
+     * Answer the question with free text by driving the picker's own "Type something" entry.
+     *
+     * The entry number is READ OFF THE SCREEN rather than computed as options.length + 1:
+     * the CLI owns that list and appends more than one trailing entry (a free-text one and a
+     * chat one, verified against claude 2.1.239), so an offset derived from the tool input
+     * would silently drift the day the CLI adds another. Returns false when the entry is not
+     * on screen or the answer never registers, so the caller can still tell the sender.
+     */
+    async sendDialogFreeText(text) {
+        const entry = this.findFreeTextEntryNumber();
+        if (entry === null) {
+            this.recordLine("--- no free-text entry visible in the dialog ---");
+            return false;
+        }
+        this.recordLine(`--- answering with free text via entry ${entry} ---`);
+        for (let i = 1; i < entry && !this.done; i++) {
+            await this.transport.writeRaw?.("\u001b[B");
+            await delay(DIALOG_KEY_DELAY_MS);
+        }
+        await this.transport.writeRaw?.("\r");
+        await delay(DIALOG_KEY_DELAY_MS);
+        await this.transport.write(text);
+        await this.transport.writeRaw?.("\r");
+        // Same reason as sendDialogAnswer: with more than one question the picker advances
+        // rather than finishing, so without this the text lands, the wait below times out, and
+        // the sender is told the message was NOT delivered -- which invites them to send it
+        // twice.
+        await this.finishMultiQuestionDialog();
+        const deadline = monotonicNowMs() + DIALOG_ANSWER_CONFIRM_MS;
+        while (this.pendingDialog && !this.done && monotonicNowMs() < deadline) {
+            await delay(250);
+        }
+        if (this.pendingDialog) {
+            this.recordLine("--- free-text answer did not register ---");
+            return false;
+        }
+        this.turnStartedAt = monotonicNowMs();
+        this.turnInFlight = true;
+        this.armStallTimer();
+        this.startHeartbeat();
+        return true;
+    }
+    /**
+     * 1-based number of the picker's free-text entry, or null when it is not on screen.
+     * Whitespace is squeezed out before matching because a redrawing TUI captured through a
+     * PTY loses spaces inside a line ("4.Typesomething." is a real observed frame).
+     */
+    findFreeTextEntryNumber() {
+        const squished = this.readTerminalTail().toLowerCase().replace(/\s+/g, "");
+        let found = null;
+        for (const match of squished.matchAll(/(\d+)\.typesomething/g)) {
+            const value = Number(match[1]);
+            if (Number.isFinite(value) && value > 0)
+                found = value;
+        }
+        return found;
+    }
+    /**
+     * The dialog was driven and did not settle. Say so.
+     *
+     * This exists because of the failure it was written for: tapping an option on the app's
+     * question card resolved the permission, drove real keystrokes, answered the first
+     * question, and then stalled -- and every caller DISCARDED the false this returns, so the
+     * card vanished, the chip kept spinning, and nothing anywhere told the sender. The typed
+     * path had a result message to fall back on; the card path had nothing at all. A notice
+     * at the point of failure covers both callers instead of one.
+     */
+    notifyDialogDriveFailed() {
+        this.notify("Your answer was sent to the agent's question but the dialog did not close. " +
+            "It is still waiting, so try answering it again.");
+    }
+    /** Sender-facing line; never let a listener throw into the delivery loop. */
+    notify(text) {
+        try {
+            this.onNotice?.(text);
+        }
+        catch (err) {
+            this.logger.warn({ err }, "PtyQuery: notice listener threw");
+        }
+    }
+    /**
+     * Drive the dialog's own keys: Down to the option, Enter to confirm. Confirmation is the
+     * tool_result landing in the transcript (which clears pendingDialog) - an optimistic flag
+     * here would record intent as fact.
+     */
+    async sendDialogAnswer(dialog, index) {
+        this.recordLine(`--- answering ${dialog.name} with option ${index + 1} ---`);
+        for (let i = 0; i < index && !this.done; i++) {
+            await this.transport.writeRaw?.("\u001b[B");
+            await delay(DIALOG_KEY_DELAY_MS);
+        }
+        await this.transport.writeRaw?.("\r");
+        // Enter both answers the focused question AND advances to the next tab. With more
+        // than one question the dialog is therefore still up, and the tool_result cannot land
+        // until the whole set is submitted -- which is why a multi-question call used to time
+        // out here and report "answer did not register" (verified against claude 2.1.239).
+        await this.finishMultiQuestionDialog();
+        const deadline = monotonicNowMs() + DIALOG_ANSWER_CONFIRM_MS;
+        while (this.pendingDialog && !this.done && monotonicNowMs() < deadline) {
+            await delay(250);
+        }
+        if (this.pendingDialog) {
+            this.recordLine(`--- ${dialog.name} answer did not register ---`);
+            this.notifyDialogDriveFailed();
+            return false;
+        }
+        // Answer accepted: the turn is live again, restart the liveness clock.
+        this.turnStartedAt = monotonicNowMs();
+        this.turnInFlight = true;
+        this.armStallTimer();
+        this.startHeartbeat();
+        return true;
+    }
+    /**
+     * Walk a multi-question picker to its Submit tab and confirm.
+     *
+     * Only the first question has an answer here (a reply, or the app card's choice), so the
+     * rest are submitted unanswered on purpose: the CLI supports exactly that and reports it
+     * to the model ("Beta went unanswered"), which is strictly better than the alternative
+     * this replaces, where the dialog stayed up until somebody cancelled it.
+     *
+     * Every step is screen-verified rather than counted, because the number of Tabs between
+     * the focused question and Submit depends on how many questions are left.
+     */
+    async finishMultiQuestionDialog() {
+        const dialog = this.pendingDialog;
+        if (!dialog || dialog.optionsByQuestion.length <= 1)
+            return;
+        const unanswered = dialog.optionsByQuestion.length - 1;
+        this.recordLine(`--- multi-question dialog: submitting with ${unanswered} unanswered ---`);
+        if (await this.reachSubmitTabAndConfirm()) {
+            this.notify(`Submitted your answer to the first question. ${unanswered} other ` +
+                `${unanswered === 1 ? "question" : "questions"} in the same prompt went ` +
+                `unanswered - reply again to answer ${unanswered === 1 ? "it" : "them"}.`);
+        }
+    }
+    /**
+     * Tab until the picker's review tab is on screen, then confirm the pre-selected
+     * "1. Submit answers". Screen-verified rather than counted: how many Tabs away Submit
+     * is depends on how many questions are left. Returns false if it never got there, so
+     * the caller does not claim a submission that did not happen.
+     */
+    async reachSubmitTabAndConfirm() {
+        for (let attempt = 0; attempt < DIALOG_SUBMIT_MAX_TABS && !this.done; attempt++) {
+            await delay(DIALOG_KEY_DELAY_MS);
+            if (!this.pendingDialog)
+                return false;
+            if (this.onSubmitTab()) {
+                await this.transport.writeRaw?.("\r");
+                return true;
+            }
+            await this.transport.writeRaw?.("\t");
+        }
+        this.recordLine("--- never reached the Submit tab ---");
+        return false;
+    }
+    /** True when the picker is showing its review/Submit tab. */
+    onSubmitTab() {
+        const squished = this.readTerminalTail().toLowerCase().replace(/\s+/g, "");
+        return squished.includes("submitanswers") || squished.includes("readytosubmit");
+    }
+    /** The agent is waiting on a dialog; tell the sender what it asks and how to answer. */
+    buildDialogPendingResult(dialog, answerFailed = false) {
+        const base = this.buildResult("submit_failed");
+        const optionLines = dialog.options.length > 0
+            ? ` Options: ${dialog.options.map((o, i) => `${i + 1}) ${o}`).join("  ")}.`
+            : "";
+        const preamble = answerFailed
+            ? `The answer keystrokes did not register in the terminal, so the dialog is still up.`
+            : `Your message was NOT delivered because the agent is showing a ${dialog.name === "ExitPlanMode" ? "plan-approval" : "question"} dialog and is waiting for an answer.`;
+        return {
+            ...base,
+            subtype: "error_during_execution",
+            is_error: true,
+            errors: [
+                `${preamble}${optionLines} Reply with just the option number (or its exact text) ` +
+                    `to answer it.`,
+            ],
+        };
+    }
+    buildSubmitFailedResult() {
+        const base = this.buildResult("submit_failed");
+        const excerpt = this.terminalTail.slice(-TERMINAL_TAIL_EXCERPT_CHARS).trim();
+        const tailLine = excerpt ? ` Last terminal output: ${JSON.stringify(excerpt)}.` : "";
+        return {
+            ...base,
+            subtype: "error_during_execution",
+            is_error: true,
+            errors: [
+                `Your message did not reach the agent: the terminal would not accept it. ` +
+                    `Nothing was sent, so please send it again.${this.stillRunningClause()}${tailLine}`,
+            ],
+        };
+    }
+    /**
+     * Press Enter to submit the composed prompt, and CONFIRM the turn actually started by
+     * watching for the USER LINE claude appends to <sid>.jsonl the instant it accepts a turn.
+     * During boot the TUI intermittently swallows the first Enter (a "what's new" notice /
+     * MCP-auth warning steals focus), so retry until it takes.
+     *
+     * The confirmation used to be `transcriptSize() > before`, which is any growth at all.
+     * That is not specific to the turn starting: claude writes `attachment`, `last-prompt`
+     * and other bookkeeping lines on its own schedule, so a swallowed Enter that happened to
+     * coincide with unrelated writes read as success. Observed in production 2026-08-01: a
+     * session logged 157 consecutive `attachment` lines and NOT ONE `user` line, yet
+     * submitTurn returned on the first attempt. The prompt stayed unsent in the TUI composer,
+     * paseo set turnInFlight and waited on a turn that had never begun, and the agent showed
+     * a spinner until the liveness backstop fired ten minutes later. The retry loop below was
+     * always right; the thing it was checking was not.
+     */
+    /**
+     * Dismiss the post-interrupt modal if the terminal is showing one. ESC is only sent on a
+     * recent sighting: on an idle prompt it is harmless, but on a live turn it would interrupt
+     * real work, so a stale marker must never trigger it.
+     */
+    async clearInterruptPrompt() {
+        if (!this.interruptPromptAt)
+            return;
+        if (this.pendingDialog) {
+            // ESC here would DECLINE the pending question/plan dialog - that is where every
+            // phantom "User declined to answer" came from. The dialog branch of the input loop
+            // owns this state; never clear modals across it.
+            return;
+        }
+        if (monotonicNowMs() - this.interruptPromptAt > INTERRUPT_PROMPT_TTL_MS) {
+            this.interruptPromptAt = 0;
+            return;
+        }
+        this.logger.warn({ sessionId: this.sessionId, lastLine: this.lastMeaningfulLine.slice(-120) }, "PtyQuery: terminal is showing the post-interrupt prompt, dismissing it before submitting");
+        this.recordLine("--- dismissing post-interrupt prompt before submit ---");
+        for (let attempt = 0; attempt < 3 && this.interruptPromptAt && !this.done; attempt++) {
+            const seenAt = this.interruptPromptAt;
+            await this.transport.writeRaw?.("\u001b");
+            await delay(250);
+            // The marker only refreshes while the modal is still drawing; if it stopped, we are out.
+            if (this.interruptPromptAt === seenAt) {
+                this.interruptPromptAt = 0;
+                return;
+            }
+        }
+        this.interruptPromptAt = 0;
+    }
+    /**
+     * Answer the large-session resume dialog with "Resume full session as-is".
+     *
+     * Must run BEFORE anything is typed: text typed while the menu is up is eaten by it, and
+     * an Enter confirms the pre-selected "Resume from summary", compacting the session the
+     * user was trying to talk to. Down moves the selection off option 1; Enter confirms
+     * option 2. Only acts on a recent sighting, because on any other screen a stray
+     * Down+Enter is at best a wasted keystroke and at worst an answer to a different menu.
+     */
+    async answerResumeDialog() {
+        if (!this.resumeDialogAt)
+            return;
+        if (monotonicNowMs() - this.resumeDialogAt > RESUME_DIALOG_TTL_MS) {
+            this.resumeDialogAt = 0;
+            return;
+        }
+        this.logger.warn({ sessionId: this.sessionId, lastLine: this.lastMeaningfulLine.slice(-120) }, "PtyQuery: large-session resume dialog is showing; selecting 'Resume full session as-is'");
+        this.recordLine("--- resume dialog: selecting 'Resume full session as-is' ---");
+        await this.transport.writeRaw?.("\u001b[B"); // Down: off the pre-selected compact option
+        await delay(300);
+        await this.transport.writeRaw?.("\r");
+        await delay(500);
+        this.resumeDialogAt = 0;
+    }
+    /**
+     * Type the prompt and confirm the terminal actually received it, retrying against a
+     * deaf terminal with backoff.
+     *
+     * Returns true once an echo (or a transcript user line) confirms the keystrokes landed;
+     * false only after the terminal stayed deaf for the whole {@link READY_BUSY_MAX_WAIT_MS}
+     * ceiling. Retyping cannot double-deliver: a deaf terminal demonstrably discards input
+     * (zero echo), and every iteration first checks whether a user line landed anyway.
+     */
+    /**
+     * Empty the input box before a retype. Ctrl+U kills the line the TUI is composing; a
+     * pasted chip is dropped the same way. Best-effort: a transport that cannot take raw
+     * keys just leaves the composer as it was.
+     */
+    /**
+     * Is the TUI currently showing its "queued messages" footer?
+     *
+     * This reads a CLI STATUS LINE, not a rendering of our own text. The distinction matters
+     * because this file has (rightly) burned four incidents on trusting renderings as proof
+     * of DELIVERY -- bytes, then echoed text, then a raw probe, then a paste chip. Delivery
+     * is still proved by one thing only, a matching `user` record. The footer answers a
+     * different and much cheaper question: is a turn running right now. The CLI is the
+     * authority on that, and it prints the answer.
+     */
+    queuedFooterVisible() {
+        return QUEUED_FOOTER_RE.test(this.terminalTail.slice(-QUEUED_FOOTER_SCAN_CHARS));
+    }
+    /** Tell the sender their message is in line, once per message. */
+    notifyQueued() {
+        if (this.queuedNoticeSent)
+            return;
+        this.queuedNoticeSent = true;
+        try {
+            this.onNotice?.("Your message was accepted and is queued behind the turn this session is already " +
+                "running. It will start as soon as that turn finishes.");
+        }
+        catch (err) {
+            this.logger.debug({ err }, "PtyQuery: queued notice callback threw");
+        }
+    }
+    async clearComposer() {
+        try {
+            // Ctrl+E (end of line), Ctrl+U (kill to start), Ctrl+K (kill to end).
+            //
+            // Ctrl+U alone was not enough. In a readline-style buffer it kills from the CURSOR
+            // to the start of the line: it empties the composer only when the cursor already
+            // sits at the end, and it never touches what is after the cursor. Live 2026-08-20 a
+            // retype landed ON TOP of text a Ctrl+U was supposed to have killed, which is how
+            // session 0b1ec622 got these into its transcript:
+            //
+            //   mint another xpmint another xp
+            //   a new one with another cpf: 76797678153, caixaa new one with another cpf: ...
+            //
+            // This sequence is cursor-position independent and idempotent: all three keys are
+            // no-ops on an already empty composer, so it cannot damage the common case. Each
+            // gets its own beat, because the TUI only processes keys as fast as its input loop
+            // drains them.
+            //
+            // It makes the clear far more likely to succeed. It does NOT prove the composer is
+            // empty, and this file deliberately has no way to prove that: every signal for it is
+            // a rendering, and renderings are what four earlier incidents taught it not to
+            // trust. The real protection against duplication is not retyping at all once the
+            // text has demonstrably left the composer -- the queued-footer guard in
+            // deliverPrompt(), which removes the case behind every duplicate observed so far.
+            for (const key of ["\u0005", "\u0015", "\u000b"]) {
+                await this.transport.writeRaw?.(key);
+                await delay(60);
+            }
+            await delay(120);
+        }
+        catch (err) {
+            this.logger.debug({ err }, "PtyQuery: could not clear the composer before retyping");
+        }
+    }
+    /**
+     * Deliver a prompt and prove it, or say it failed. See docs/pty-delivery.md.
+     *
+     * One authority: a transcript user record matching the text. Nothing the terminal paints
+     * gates this - echoed characters, paste chips, boot noise and footer hints are renderings,
+     * and renderings changed with every CLI version while this code kept "discovering" new
+     * ones (bytes -> text -> raw probe -> paste chip, four incidents, same defect each time).
+     *
+     * Retries are safe because the composer is cleared first, and a message QUEUED behind a
+     * running turn is never retyped - that is the one way to send it twice.
+     */
+    async deliverPrompt(text) {
+        this.queuedNoticeSent = false;
+        const fingerprint = PtyQuery.fingerprint(text);
+        const watermark = this.transcriptSize();
+        const deadline = monotonicNowMs() + READY_BUSY_MAX_WAIT_MS;
+        let backoff = DEAF_RETRY_INITIAL_MS;
+        let attempt = 0;
+        while (!this.done && monotonicNowMs() < deadline) {
+            // Re-checked every attempt, not once up front: the child can die between attempts and
+            // this loop's budget is ten minutes. Retrying into a corpse is what produced the
+            // "no delivery receipt; retrying" storms that ended at the 20-retry cap.
+            if (this.transportExited)
+                return "exited";
+            attempt += 1;
+            const attemptStartedAt = monotonicNowMs();
+            // Empty the input box first: whatever an earlier attempt may have left there is
+            // undelivered by definition (no receipt), and typing on top of it is how one message
+            // became nine stacked paste blocks in production.
+            if (attempt > 1)
+                await this.clearComposer();
+            try {
+                await this.transport.write(text);
+            }
+            catch (err) {
+                // The transport now refuses a write into a dead pty. Without this catch the rejection
+                // escapes deliverPrompt into the input loop's handler, which only logs "input loop
+                // ended" -- so the sender would watch a spinner and never be told anything.
+                if (err instanceof PtyExitedError)
+                    return "exited";
+                throw err;
+            }
+            const submitted = await this.submitTurn(text, watermark, fingerprint);
+            if (submitted === "rejected")
+                return "rejected";
+            if (submitted === "delivered") {
+                if (attempt > 1) {
+                    this.recordLine(`--- delivered on attempt ${attempt} ---`);
+                }
+                return "delivered";
+            }
+            // No receipt. Is a turn actually RUNNING (so our text is queued behind it), or was
+            // the Enter simply swallowed? Two independent signals, ORed on purpose:
+            //
+            //   - the TUI's own queued footer, which is the CLI stating the fact outright, and
+            //   - real SDK messages arriving during this attempt, the original heuristic.
+            //
+            // File growth alone cannot tell queued from swallowed: claude writes `attachment`
+            // and other bookkeeping records on its own schedule, and treating that as "queued"
+            // would sit here for ten minutes while the prompt was never submitted (the
+            // 2026-08-01 bug, in reverse). But it also misses the common case, a running turn
+            // that is quiet for the four-second receipt window, and the cost of missing it is a
+            // retype that corrupts the queued prompt. The footer settles that case directly.
+            if (this.queuedFooterVisible() || this.lastTranscriptAt > attemptStartedAt) {
+                this.recordLine("--- no receipt yet; queued behind a running turn ---");
+                // Say so where the sender can see it. Once per message, not once per poll.
+                this.notifyQueued();
+                const late = await pollUntil(() => this.receiptSince(watermark, fingerprint), QUEUED_RECEIPT_WINDOW_MS, 500);
+                if (late)
+                    return "delivered";
+                // Queued, and still no receipt after the full window. Do NOT fall through to the
+                // retype: the text is demonstrably out of the composer, so retyping cannot undo
+                // anything and can only stack a duplicate.
+                //
+                // "unconfirmed", never "undelivered". They are not interchangeable here:
+                // `undelivered` makes the caller emit buildSubmitFailedResult(), whose text is
+                // "Nothing was sent, so please send it again" -- a lie about a message sitting in
+                // claude's queue, and an instruction that produces the exact duplicate this branch
+                // exists to prevent. `unconfirmed` means "accepted, start not observed", which is
+                // true, and the stall backstop is already the right net for it.
+                return "unconfirmed";
+            }
+            this.logger.warn({ sessionId: this.sessionId, attempt, nextRetryMs: backoff }, "PtyQuery: no delivery receipt for the prompt; retrying");
+            this.recordLine(`--- no delivery receipt (attempt ${attempt}); retrying in ${Math.round(backoff / 1000)}s ---`);
+            await delay(backoff);
+            backoff = Math.min(backoff * 2, DEAF_RETRY_MAX_MS);
+        }
+        return "undelivered";
+    }
+    /**
+     * Press Enter to submit the composed prompt, and CONFIRM the turn actually started by
+     * watching for the USER LINE claude appends to <sid>.jsonl the instant it accepts a turn.
+     * During boot the TUI intermittently swallows the first Enter (a "what's new" notice /
+     * MCP-auth warning steals focus), so retry until it takes.
+     *
+     * The confirmation used to be `transcriptSize() > before`, which is any growth at all.
+     * That is not specific to the turn starting: claude writes `attachment`, `last-prompt`
+     * and other bookkeeping lines on its own schedule, so a swallowed Enter that happened to
+     * coincide with unrelated writes read as success. Observed in production 2026-08-01: a
+     * session logged 157 consecutive `attachment` lines and NOT ONE `user` line, yet
+     * submitTurn returned on the first attempt. The prompt stayed unsent in the TUI composer,
+     * paseo set turnInFlight and waited on a turn that had never begun, and the agent showed
+     * a spinner until the liveness backstop fired ten minutes later. The retry loop below was
+     * always right; the thing it was checking was not.
+     */
+    /**
+     * Type the prompt and confirm the terminal actually received it, retrying against a
+     * deaf terminal with backoff.
+     *
+     * Returns true once an echo (or a transcript user line) confirms the keystrokes landed;
+     * false only after the terminal stayed deaf for the whole {@link READY_BUSY_MAX_WAIT_MS}
+     * ceiling. Retyping cannot double-deliver: a deaf terminal demonstrably discards input
+     * (zero echo), and every iteration first checks whether a user line landed anyway.
+     */
+    async submitTurn(text, watermark, fingerprint) {
+        const before = watermark;
+        // A slash command gets EXACTLY ONE Enter. Never retry it.
+        //
+        // Typing "/x" opens the TUI's own command menu, and in that state each Enter runs the
+        // highlighted entry. The retry loop below was added to beat a swallowed first Enter on
+        // a booting terminal, and for ordinary prompts it works; for a slash command it
+        // re-executes the command once per attempt. Captured on a recording:
+        //
+        //   /compact                                  <- written once by paseo
+        //   /compact Free up context by summarizing…  <- the TUI's menu opens
+        //   > /compact  > /compact  Not enough messages to compact.
+        //
+        // Two executions from one message. That is why sessions compacted twice, and why a
+        // second /compact could land on an already-compacted session at a few thousand tokens.
+        // Confirmation cannot come from the transcript here either: a slash command does not
+        // append the user line that sawUserLineSince() waits for, so the loop never sees
+        // success and always burns all five attempts.
+        //
+        // Instead, confirm from the terminal: the command was accepted if the TUI produced
+        // output in response. If it produced nothing, report it rather than pressing again --
+        // a lost slash command is recoverable by resending, a duplicated one is not.
+        if (text.trim().startsWith("/")) {
+            const bytesBefore = this.ptyBytesTotal;
+            await this.transport.writeRaw?.("\r");
+            const reacted = await pollUntil(() => this.receiptSince(before, fingerprint) || this.ptyBytesTotal > bytesBefore, SLASH_COMMAND_ECHO_WAIT_MS, 150);
+            // The terminal responding is not the same as the command running. An unknown command
+            // is answered with `Unknown command: /X. Did you mean /y?` and NOTHING starts -- but
+            // that reply previously counted as acceptance, so the app showed a running turn that
+            // did not exist and the sender saw dead silence. Observed live: a phone-keyboard
+            // auto-capitalized "/WhatsApp-read" rejected twice while the UI said "working".
+            // Checked regardless of the byte-poll outcome: the rejection can repaint before the
+            // poll's baseline is captured, in which case `reacted` is false but the refusal is
+            // already sitting in the tail.
+            await delay(400);
+            const m = this.terminalTail.slice(-500).match(/Unknown command:[^\n]{0,160}/i);
+            if (m) {
+                this.rejectedCommandNotice = m[0].trim();
+                this.recordLine(`--- CLI rejected the command: ${this.rejectedCommandNotice} ---`);
+                return "rejected";
+            }
+            if (!reacted) {
+                this.logger.warn({ sessionId: this.sessionId, command: text.trim().split(/\s/, 1)[0] }, "PtyQuery: slash command produced no terminal response; not retrying to avoid double execution");
+            }
+            // A slash command may not append a user record at all (version-dependent), so the
+            // CLI's own reaction stands in for the receipt here. This reads a CLI RESPONSE, not
+            // a rendering, and it is never retried: a lost slash command is recoverable by
+            // resending, a duplicated one is not.
+            return reacted ? "delivered" : "unconfirmed";
+        }
+        await this.transport.writeRaw?.("\r");
+        if (await pollUntil(() => this.receiptSince(before, fingerprint), RECEIPT_WINDOW_MS, 150)) {
+            return "delivered";
+        }
+        // No receipt from this attempt. The delivery loop decides what that means: it can see
+        // whether the transcript is moving (queued behind a running turn) and owns the retry.
+        this.logger.debug({ sessionId: this.sessionId, lastLine: this.lastMeaningfulLine.slice(-120) }, "PtyQuery: no receipt for this submit attempt");
+        return "unconfirmed";
+    }
+    /**
+     * True once a real `user` line has been appended past `offset`. Reads only the bytes
+     * added since then, so it stays cheap on a transcript that can reach tens of MB.
+     * `isMeta` user lines are claude's own bookkeeping and do not mean a turn started.
+     */
+    /**
+     * Fingerprint used to match a transcript record against what we typed. Whitespace is
+     * stripped on both sides because the terminal is free to re-wrap and re-space anything
+     * it renders, while the transcript keeps the text verbatim - so the character sequence
+     * is the part that survives every rendering.
+     */
+    static fingerprint(text) {
+        return text.replace(/\s+/g, "").slice(0, RECEIPT_FINGERPRINT_CHARS);
+    }
+    /**
+     * THE delivery authority: did claude append a user record matching what we sent?
+     *
+     * Content-matched on purpose. The old check accepted ANY user record past the watermark,
+     * which cannot tell "my message became a turn" apart from an unrelated record (a resume
+     * dialog answering itself, a queued earlier message). Matching the text answers the only
+     * question that matters, and answers it identically whether the terminal echoed the
+     * characters, collapsed them into a paste chip, or drew nothing at all.
+     */
+    receiptSince(offset, fingerprint) {
+        for (const record of this.readUserRecordsSince(offset)) {
+            const body = PtyQuery.fingerprint(record);
+            if (!fingerprint)
+                return true;
+            // Short messages must match whole, or a two-letter fingerprint like "ok" would
+            // happily match an unrelated record that merely contains those letters.
+            if (fingerprint.length < RECEIPT_EXACT_MATCH_BELOW_CHARS) {
+                if (body === fingerprint)
+                    return true;
+                continue;
+            }
+            if (body.includes(fingerprint))
+                return true;
+        }
+        return false;
+    }
+    /** Text of every non-meta user record written past `offset`. */
+    readUserRecordsSince(offset) {
+        let fd = null;
+        const out = [];
+        try {
+            const size = this.transcriptSize();
+            if (size <= offset)
+                return out;
+            fd = fs.openSync(this.transcriptPath, "r");
+            const length = size - offset;
+            const buffer = Buffer.alloc(length);
+            fs.readSync(fd, buffer, 0, length, offset);
+            for (const line of buffer.toString("utf8").split("\n")) {
+                if (!line.trim())
+                    continue;
+                try {
+                    // A trailing partial line simply fails to parse; the next poll sees it whole.
+                    const parsed = JSON.parse(line);
+                    if (parsed?.type !== "user" || parsed.isMeta)
+                        continue;
+                    out.push(userRecordText(parsed.message?.content));
+                }
+                catch {
+                    /* partial or non-JSON line */
+                }
+            }
+            return out;
+        }
+        catch {
+            return out;
+        }
+        finally {
+            if (fd !== null) {
+                try {
+                    fs.closeSync(fd);
+                }
+                catch {
+                    /* ignore */
+                }
+            }
+        }
+    }
+    transcriptSize() {
+        try {
+            return fs.statSync(this.transcriptPath).size;
+        }
+        catch {
+            return 0;
+        }
+    }
+    // ---- transcript → SDKMessage stream + turn-end ----------------------------
+    onTranscriptMessage(message) {
+        this.emit(message);
+        this.trackInteractiveDialog(message);
+        if (message.type === "assistant") {
+            const beta = message.message;
+            this.lastStopReason = beta.stop_reason ?? null;
+            if (beta.usage)
+                this.lastUsage = beta.usage;
+        }
+        // Any transcript activity proves the turn is alive; push the stall deadline out.
+        this.lastTranscriptAt = monotonicNowMs();
+        // Real turn activity means the modal is gone, whatever the tail still remembers.
+        this.interruptPromptAt = 0;
+        this.armStallTimer();
+        this.scheduleTurnEndCheck();
+    }
+    /**
+     * Track interactive TUI dialogs (AskUserQuestion / plan-mode approval) from the
+     * transcript. While one is pending the terminal is WAITING, not stalled: the stall
+     * backstop must stand down, no ESC may be sent (it declines the dialog - the source of
+     * every phantom "User declined" this week), and an incoming reply is translated to
+     * dialog keystrokes instead of typed text.
+     */
+    trackInteractiveDialog(message) {
+        const content = message.message?.content;
+        if (!Array.isArray(content))
+            return;
+        for (const block of content) {
+            if (!block || typeof block !== "object")
+                continue;
+            const b = block;
+            if (message.type === "assistant" &&
+                b.type === "tool_use" &&
+                b.id &&
+                (b.name === "AskUserQuestion" || b.name === "ExitPlanMode")) {
+                this.pendingDialog = {
+                    toolUseId: b.id,
+                    name: b.name,
+                    input: isRecord(b.input) ? b.input : {},
+                    options: extractDialogOptions(b.name, b.input),
+                    optionsByQuestion: extractDialogOptionsByQuestion(b.name, b.input),
+                };
+                this.recordLine(`--- interactive dialog pending: ${b.name} ---`);
+                this.notifyDialogChange();
+            }
+            const pending = this.pendingDialog;
+            if (pending && b.type === "tool_result" && b.tool_use_id === pending.toolUseId) {
+                this.recordLine(`--- interactive dialog answered: ${pending.name} ---`);
+                this.pendingDialog = null;
+                this.notifyDialogChange();
+            }
+        }
+    }
+    scheduleTurnEndCheck() {
+        if (this.turnEndTimer)
+            clearTimeout(this.turnEndTimer);
+        this.turnEndTimer = setTimeout(() => this.maybeCompleteTurn(), TURN_END_IDLE_MS);
+    }
+    maybeCompleteTurn() {
+        if (this.done)
+            return;
+        const stop = this.lastStopReason;
+        if (!stop || !TERMINAL_STOP_REASONS.has(stop))
+            return; // e.g. "tool_use" → more coming
+        this.numTurns += 1;
+        // The turn ended on its own; stand the liveness backstop down before emitting.
+        this.turnInFlight = false;
+        this.clearStallTimer();
+        this.stopHeartbeat();
+        this.emit(this.buildResult(stop));
+        // reset so a stale terminal reason can't re-fire before the next assistant turn
+        this.lastStopReason = null;
+    }
+    /**
+     * (Re)arm the liveness backstop. Called when a turn starts and on every transcript
+     * message, so the deadline only expires after an unbroken window of silence.
+     */
+    armStallTimer() {
+        if (this.stallTimeoutMs <= 0 || !this.turnInFlight)
+            return;
+        this.clearStallTimer();
+        this.stallTimer = setTimeout(() => this.onTurnStalled(), this.stallTimeoutMs);
+        // Never hold the event loop open just to wait for a stall.
+        this.stallTimer.unref?.();
+    }
+    clearStallTimer() {
+        if (this.stallTimer)
+            clearTimeout(this.stallTimer);
+        this.stallTimer = null;
+    }
+    /**
+     * No transcript activity for the whole budget while a turn was outstanding. Surface it as
+     * a failed turn instead of leaving the caller on an endless spinner. We do NOT kill the
+     * PTY: claude may still be retrying, and if it recovers its messages keep flowing through
+     * the reader as a fresh turn.
+     */
+    onTurnStalled() {
+        this.stallTimer = null;
+        if (this.done || !this.turnInFlight)
+            return;
+        if (this.pendingDialog) {
+            // Waiting on a human is not a stall. Observed live 2026-08-04: an ExitPlanMode
+            // approval sat pending for 2.5 hours and the backstop declared the turn failed,
+            // which read as a wedge and got a healthy process killed.
+            this.recordLine(`--- stall budget elapsed but ${this.pendingDialog.name} is pending ---`);
+            this.armStallTimer();
+            return;
+        }
+        this.turnInFlight = false;
+        this.stopHeartbeat();
+        const silentForMs = this.stallTimeoutMs;
+        const terminalTail = this.readTerminalTail();
+        this.recordLine(`--- STALLED after ${silentForMs}ms of transcript silence ---`);
+        this.logger.error({
+            sessionId: this.sessionId,
+            transcriptPath: this.transcriptPath,
+            silentForMs,
+            // The whole point of the tap: whatever the TUI was showing while it went quiet.
+            terminalTail,
+        }, "PtyQuery: turn stalled, no transcript activity within the liveness budget");
+        this.numTurns += 1;
+        this.emit(this.buildStalledResult(silentForMs, terminalTail));
+    }
+    /**
+     * Append terminal output to the rolling tail.
+     *
+     * Scrubbed and filtered on the way IN, not on the way out, because the TUI's spinner
+     * redraws at a few hundred bytes/second: a raw buffer holds only a second or two of
+     * history and would evict the one line worth reading. Keeping only lines that carry
+     * letters or digits means a message like "Compacting conversation…" survives minutes of
+     * animation. Verified against a real stall: the raw tail was 163 chars of pure spinner.
+     */
+    /**
+     * True when the rolling tail's last frame looks like an input box waiting for typing.
+     *
+     * Deliberately requires the busy marker to be ABSENT rather than trusting the prompt
+     * markers alone: the working footer renders as `… · esc to interrupt · ← for agents`, so
+     * "for agents" on its own is present in both states and would read a mid-turn terminal
+     * as idle.
+     */
+    /** Runs `fn` after every previously queued terminal write has finished. */
+    runExclusive(fn) {
+        const next = this.writeGate.then(fn, fn);
+        // Keep the chain alive even when a link rejects; each caller still sees its own error.
+        this.writeGate = next.catch(() => undefined);
+        return next;
+    }
+    /**
+     * Type a control slash command (`/model`, `/effort`) into the terminal, but only once the
+     * TUI is actually accepting input, and never while another write is in flight.
+     *
+     * Why this exists instead of `transport.write()` straight from the agent: a control command
+     * written to the transport bypasses the input loop, so it races the prompt being delivered
+     * and the two COLLIDE on the same input line. Captured live 2026-08-29 (session c132c833)
+     * from claude's own transcript:
+     *
+     *     command-args>claude-opus-5[1m]Responda APENAS: R1<
+     *
+     * The model id and the user's prompt, concatenated with no separator. Measured
+     * consequences: the model never changed (the old one kept answering two minutes later),
+     * the user's prompt was swallowed by the slash command, and the agent never returned to
+     * idle. Waiting for the input box also keeps the command out of claude's PERSISTED input
+     * queue, so it cannot be replayed into a future session.
+     *
+     * Returns false when the terminal never became typeable, so the caller can refuse to
+     * record a setting change that did not happen.
+     */
+    async sendControlCommand(command) {
+        return await this.runExclusive(async () => {
+            const deadline = monotonicNowMs() + CONTROL_COMMAND_MAX_WAIT_MS;
+            while (!this.done && monotonicNowMs() < deadline) {
+                if (this.looksIdle()) {
+                    // Text first, Enter SEPARATELY -- never `write(`${command}\r`)` as one chunk.
+                    //
+                    // Typing "/" opens the TUI's own command menu, and a carriage return arriving in the
+                    // same chunk as the text is taken as a newline inside the composer rather than a
+                    // submit. The command then just sits there, and the next thing typed is appended to
+                    // it. Captured live 2026-08-29 14:00:47 on a daemon that already had the write gate:
+                    // paseo wrote a clean `/effort low\r` (provenance `length: 12`) and the CLI still
+                    // received
+                    //
+                    //     command-args>low\nThis is me changing effort to low<
+                    //
+                    // the level and the user's next message as one argument. submitTurn() has always
+                    // sent Enter as its own writeRaw for exactly this reason; this path did not.
+                    const bytesBefore = this.ptyBytesTotal;
+                    await this.transport.write(command);
+                    await this.transport.writeRaw?.("\r");
+                    // Exactly one Enter, never retried: a lost control command is recoverable by
+                    // resending, a duplicated one runs the command twice (see submitTurn).
+                    const reacted = await pollUntil(() => this.ptyBytesTotal > bytesBefore, SLASH_COMMAND_ECHO_WAIT_MS, 150);
+                    if (!reacted) {
+                        this.recordLine(`--- "${command}" produced no terminal response ---`);
+                        this.logger.warn({ sessionId: this.sessionId, command }, "PtyQuery: control command produced no terminal response; not retrying");
+                        return false;
+                    }
+                    return true;
+                }
+                await delay(CONTROL_COMMAND_POLL_MS);
+            }
+            if (this.done)
+                return false;
+            this.recordLine(`--- terminal never accepted input; "${command}" not sent ---`);
+            this.logger.warn({ sessionId: this.sessionId, command, waitedMs: CONTROL_COMMAND_MAX_WAIT_MS }, "PtyQuery: terminal never returned to an input box, refusing to type a control command");
+            return false;
+        });
+    }
+    looksIdle() {
+        const tail = this.terminalTail.slice(-400).toLowerCase();
+        if (!tail)
+            return false;
+        if (tail.includes(BUSY_MARKER))
+            return false;
+        if (this.lastBusyAt > 0 && monotonicNowMs() - this.lastBusyAt < READY_IDLE_STABLE_MS)
+            return false;
+        return IDLE_PROMPT_MARKERS.some((m) => tail.includes(m));
+    }
+    appendTerminalTail(chunk) {
+        if (!chunk)
+            return;
+        this.ptyBytesTotal += chunk.length;
+        const text = stripTerminalControl(chunk);
+        if (!text)
+            return;
+        if (this.echoProbe) {
+            this.echoProbe.buf = (this.echoProbe.buf + text.replace(/\s+/g, "")).slice(-2000);
+        }
+        // Read the busy marker off the raw stripped text, NOT the filtered tail below:
+        // isProgressNoise() drops a line that is only the footer, which is exactly the frame
+        // that proves a turn is running.
+        if (text.toLowerCase().includes(BUSY_MARKER))
+            this.lastBusyAt = monotonicNowMs();
+        for (const rawLine of text.split("\n")) {
+            const line = rawLine.trim();
+            if (!line || !/[a-z0-9]/i.test(line))
+                continue;
+            if (isProgressNoise(line))
+                continue;
+            // de-dupe consecutive identical redraws of the same line
+            if (this.terminalTail.endsWith(line + "\n"))
+                continue;
+            this.terminalTail += line + "\n";
+            this.lastMeaningfulLine = line;
+            if (line.toLowerCase().includes(INTERRUPT_PROMPT_MARKER)) {
+                this.interruptPromptAt = monotonicNowMs();
+            }
+            if (line.toLowerCase().includes(RESUME_DIALOG_MARKER)) {
+                this.resumeDialogAt = monotonicNowMs();
+            }
+            this.recordLine(line);
+        }
+        if (this.terminalTail.length > TERMINAL_TAIL_MAX_CHARS) {
+            this.terminalTail = this.terminalTail.slice(-TERMINAL_TAIL_MAX_CHARS);
+        }
+    }
+    // ---- telemetry ------------------------------------------------------------
+    /** Open `$PASEO_HOME/pty-recordings/<sessionId>.log`. Best-effort: never fail a session. */
+    openRecording() {
+        try {
+            const home = process.env.PASEO_HOME;
+            if (!home)
+                return;
+            const dir = path.join(home, "pty-recordings");
+            fs.mkdirSync(dir, { recursive: true });
+            this.recordingPath = path.join(dir, `${this.sessionId}.log`);
+            this.recordingBytes = this.safeSize(this.recordingPath);
+            this.recordLine(`--- PtyQuery attached, transcript=${this.transcriptPath} ---`);
+            this.logger.debug({ sessionId: this.sessionId, recordingPath: this.recordingPath }, "PtyQuery: recording terminal output");
+        }
+        catch {
+            this.recordingPath = null;
+        }
+    }
+    recordLine(line) {
+        if (!this.recordingPath)
+            return;
+        try {
+            const entry = `${new Date().toISOString()} ${line}\n`;
+            fs.appendFileSync(this.recordingPath, entry);
+            this.recordingBytes += entry.length;
+            if (this.recordingBytes > RECORDING_MAX_BYTES) {
+                // Keep the recent past, drop the rest. Diagnostics, not an audit trail.
+                const kept = fs.readFileSync(this.recordingPath).subarray(-RECORDING_KEEP_BYTES);
+                fs.writeFileSync(this.recordingPath, kept);
+                this.recordingBytes = kept.length;
+            }
+        }
+        catch {
+            this.recordingPath = null;
+        }
+    }
+    safeSize(p) {
+        try {
+            return fs.statSync(p).size;
+        }
+        catch {
+            return 0;
+        }
+    }
+    /**
+     * While a turn is outstanding, emit one line every {@link LIVENESS_HEARTBEAT_MS} with
+     * enough state to tell the failure modes apart without waiting for the stall budget:
+     * terminal bytes since the last beat (0 means the TUI is frozen, not thinking), seconds
+     * since the transcript last grew, and the last meaningful line on screen.
+     */
+    startHeartbeat() {
+        this.stopHeartbeat();
+        this.ptyBytesAtLastBeat = this.ptyBytesTotal;
+        this.heartbeatTimer = setInterval(() => this.beat(), LIVENESS_HEARTBEAT_MS);
+        this.heartbeatTimer.unref?.();
+    }
+    stopHeartbeat() {
+        if (this.heartbeatTimer)
+            clearInterval(this.heartbeatTimer);
+        this.heartbeatTimer = null;
+    }
+    beat() {
+        if (this.done || !this.turnInFlight) {
+            this.stopHeartbeat();
+            return;
+        }
+        const ptyBytesSinceLastBeat = this.ptyBytesTotal - this.ptyBytesAtLastBeat;
+        this.ptyBytesAtLastBeat = this.ptyBytesTotal;
+        this.logger.info({
+            sessionId: this.sessionId,
+            event: "pty.turn.heartbeat",
+            turnAgeMs: this.turnStartedAt ? monotonicNowMs() - this.turnStartedAt : 0,
+            ptyBytesSinceLastBeat,
+            secondsSinceTranscript: this.lastTranscriptAt
+                ? Math.round((monotonicNowMs() - this.lastTranscriptAt) / 1000)
+                : null,
+            readySettledBy: this.readySettledBy,
+            lastLine: this.lastMeaningfulLine.slice(-160),
+        }, "PtyQuery: turn in flight");
+    }
+    /**
+     * The tail as readable text: ANSI/OSC sequences dropped and runs of whitespace collapsed,
+     * because a raw TUI capture is mostly cursor movement and redraw padding.
+     */
+    readTerminalTail() {
+        return this.terminalTail.trim().slice(-TERMINAL_TAIL_MAX_CHARS);
+    }
+    buildResult(stopReason) {
+        const usage = (this.lastUsage ?? {
+            input_tokens: 0,
+            output_tokens: 0,
+            cache_creation_input_tokens: 0,
+            cache_read_input_tokens: 0,
+        });
+        const result = {
+            type: "result",
+            subtype: "success",
+            duration_ms: this.turnStartedAt ? Math.round(monotonicNowMs() - this.turnStartedAt) : 0,
+            duration_api_ms: 0,
+            is_error: false,
+            num_turns: this.numTurns,
+            result: "",
+            stop_reason: stopReason,
+            total_cost_usd: 0,
+            usage,
+            modelUsage: {},
+            permission_denials: [],
+            uuid: randomUUID(),
+            session_id: this.sessionId,
+        };
+        return result;
+    }
+    /**
+     * The agent process exited. Fail any in-flight turn immediately and end the query.
+     *
+     * Unlike a stall there is nothing to wait for: no retry, no recovery, no later transcript
+     * activity. Emitting here rather than letting the stall timer fire turns a ten-minute wait
+     * plus a false "still running" into an immediate, accurate failure, and finishing the query
+     * stops the layer above treating this transport as a live destination for prompts.
+     */
+    onTransportExit(code, signal) {
+        // Recorded before the `done` bail: the wording helpers and the delivery guards must know
+        // the process is gone even when the query had already been torn down.
+        this.transportExited ?? (this.transportExited = { code, signal });
+        if (this.done)
+            return;
+        const wasInFlight = this.turnInFlight;
+        this.turnInFlight = false;
+        this.clearStallTimer();
+        this.logger.error({ sessionId: this.sessionId, exitCode: code, exitSignal: signal, wasInFlight }, "PtyQuery: the agent process exited");
+        this.recordLine(`--- agent process exited (status ${code ?? "none"}, signal ${signal ?? "none"}) ---`);
+        if (wasInFlight) {
+            this.numTurns += 1;
+            this.emit(this.buildExitedResult(code, signal));
+        }
+        this.finish();
+    }
+    /**
+     * A non-success `result` for an agent that exited.
+     *
+     * Wording constraints match {@link buildStalledResult}: `isAbortError()` drops results
+     * matching /\baborted\b/i and `buildTurnFailedEvent()` scrapes /\bcode\s+(\d+)\b/i for an
+     * exit code, so this says "status", never "code", and never says "aborted". It also must
+     * NOT claim the session is still running, which is the exact lie this change deletes.
+     */
+    buildExitedResult(code, signal) {
+        const base = this.buildResult("process_exited");
+        const how = signal ? `on signal ${signal}` : `with status ${code ?? "unknown"}`;
+        const excerpt = this.terminalTail.slice(-TERMINAL_TAIL_EXCERPT_CHARS).trim();
+        const tailLine = excerpt ? ` Last terminal output: ${JSON.stringify(excerpt)}.` : "";
+        return {
+            ...base,
+            subtype: "error_during_execution",
+            is_error: true,
+            errors: [
+                `The agent process exited ${how} before finishing this turn, so the session is NOT ` +
+                    `running any more and will not recover on its own. The conversation is still on ` +
+                    `disk: recover it with "paseo import ${this.sessionId}", then restore the agent's ` +
+                    `model, thinking budget and permission mode, which import does not carry over.` +
+                    tailLine,
+            ],
+        };
+    }
+    buildStalledResult(silentForMs, terminalTail) {
+        // A dead process is not a stall, and must never be described as one that "may recover".
+        if (this.transportExited) {
+            return this.buildExitedResult(this.transportExited.code, this.transportExited.signal);
+        }
+        const minutes = Math.round(silentForMs / 60000);
+        const base = this.buildResult("stall_timeout");
+        // The last thing the terminal showed is usually the whole diagnosis ("Compacting
+        // conversation…", a retry notice), so lead the message with it when we have one.
+        const excerpt = (terminalTail ?? "").slice(-TERMINAL_TAIL_EXCERPT_CHARS).trim();
+        const tailLine = excerpt ? ` Last terminal output: ${JSON.stringify(excerpt)}.` : "";
+        return {
+            ...base,
+            subtype: "error_during_execution",
+            is_error: true,
+            errors: [
+                `No response from the claude PTY session for ${minutes} min. ` +
+                    `The turn was accepted but produced no output, so it was marked failed. ` +
+                    `The underlying session is still running and may recover.${tailLine}`,
+            ],
+        };
+    }
+    // ---- control surface ------------------------------------------------------
+    async interrupt() {
+        // ESC interrupts the active turn in the claude TUI.
+        await this.transport.writeRaw?.("\x1b");
+    }
+    // These are driven by the `instanceof PtyTransport` branches in agent.ts (which write
+    // to the transport directly), so on the query they are inert.
+    async setPermissionMode() { }
+    async setModel() { }
+    async setMaxThinkingTokens() { }
+    async applyFlagSettings() { }
+    async supportedModels() {
+        return [];
+    }
+    async supportedCommands() {
+        return [];
+    }
+    async supportedAgents() {
+        return [];
+    }
+    async mcpServerStatus() {
+        return [];
+    }
+    close() {
+        this.finish();
+        void this.transport.kill().catch(() => { });
+    }
+}
+/** Extract the plain-text prompt from a user SDK message for typing into the PTY. */
+/** Delay between Down-arrow presses when answering a dialog; the TUI animates selection. */
+const DIALOG_KEY_DELAY_MS = 150;
+/** How long to wait for the dialog's tool_result to land after answering keystrokes. */
+const DIALOG_ANSWER_CONFIRM_MS = 8000;
+/**
+ * Options the TUI dialog offers, in on-screen order. AskUserQuestion carries them in its
+ * input; the plan-approval dialog's options are the CLI's own and version-dependent, so
+ * they stay empty and replies are matched by number only.
+ */
+function extractDialogOptionsByQuestion(name, input) {
+    if (name !== "AskUserQuestion")
+        return [];
+    const questions = input?.questions;
+    if (!Array.isArray(questions))
+        return [];
+    return questions.map((question) => {
+        const options = question?.options;
+        if (!Array.isArray(options))
+            return [];
+        const labels = [];
+        for (const option of options) {
+            if (typeof option === "string")
+                labels.push(option);
+            else if (option && typeof option === "object") {
+                const label = option.label;
+                if (typeof label === "string")
+                    labels.push(label);
+            }
+        }
+        return labels;
+    });
+}
+function extractDialogOptions(name, input) {
+    if (name !== "AskUserQuestion")
+        return [];
+    const questions = input?.questions;
+    if (!Array.isArray(questions) || questions.length === 0)
+        return [];
+    const options = questions[0]?.options;
+    if (!Array.isArray(options))
+        return [];
+    const labels = [];
+    for (const option of options) {
+        if (typeof option === "string")
+            labels.push(option);
+        else if (option && typeof option === "object") {
+            const label = option.label;
+            if (typeof label === "string")
+                labels.push(label);
+        }
+    }
+    return labels;
+}
+/**
+ * Resolve the user's reply to a 0-based dialog option index, or null when it names none.
+ * "2" picks the second option; an exact case-insensitive label match works too. Free text
+ * stays null on purpose: guessing would answer a question the user did not answer.
+ */
+function normalizeOptionText(value) {
+    return value
+        .trim()
+        .toLowerCase()
+        .replace(/[\u2018\u2019\u201c\u201d]/g, "'")
+        .replace(/[^a-z0-9]+/g, " ")
+        .trim();
+}
+/** The single index every candidate list agrees on, or null when it is 0 or 2+. */
+function soleIndex(indices) {
+    return indices.length === 1 ? (indices[0] ?? null) : null;
+}
+function matchDialogOption(text, options) {
+    const reply = text.trim();
+    if (/^[1-9]$/.test(reply)) {
+        const index = Number(reply) - 1;
+        if (options.length === 0 || index < options.length)
+            return index;
+        return null;
+    }
+    const lowered = reply.toLowerCase();
+    const byLabel = options.findIndex((o) => o.trim().toLowerCase() === lowered);
+    if (byLabel >= 0)
+        return byLabel;
+    // Exact-label-only matching sounds safe and is not: the app's own suggestion chip sent
+    // "Yes" against an option labelled "Yes, merge to master", scored no match, and the
+    // message was discarded (2026-08-21, question unanswered for 1h38m). Widen to
+    // punctuation-insensitive equality, then to a UNIQUE prefix, then to a UNIQUE substring.
+    // Uniqueness is the whole safety property: anything matching two options stays null,
+    // because guessing answers a question the user did not answer.
+    const normalizedReply = normalizeOptionText(reply);
+    if (normalizedReply.length === 0)
+        return null;
+    const normalized = options.map(normalizeOptionText);
+    const exact = normalized.flatMap((o, i) => (o === normalizedReply ? [i] : []));
+    const byExact = soleIndex(exact);
+    if (byExact !== null)
+        return byExact;
+    const prefix = normalized.flatMap((o, i) => (o.startsWith(normalizedReply) ? [i] : []));
+    const byPrefix = soleIndex(prefix);
+    if (byPrefix !== null)
+        return byPrefix;
+    // Only worth a substring pass when the reply is long enough to be a real quotation of
+    // the label; a two-character reply substring-matching one option is a coincidence.
+    if (normalizedReply.length < 4)
+        return null;
+    const contains = normalized.flatMap((o, i) => (o.includes(normalizedReply) ? [i] : []));
+    return soleIndex(contains);
+}
+/** Flatten a transcript user record's content to plain text for fingerprint matching. */
+function userRecordText(content) {
+    if (typeof content === "string")
+        return content;
+    if (!Array.isArray(content))
+        return "";
+    const parts = [];
+    for (const block of content) {
+        if (typeof block === "string")
+            parts.push(block);
+        else if (isRecord(block) && typeof block.text === "string")
+            parts.push(block.text);
+    }
+    return parts.join(" ");
+}
+function isRecord(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}
+/** Extensions for the media types the app can send; anything unknown stages as .png. */
+const IMAGE_MEDIA_TYPE_EXT = {
+    "image/jpeg": "jpg",
+    "image/png": "png",
+    "image/gif": "gif",
+    "image/webp": "webp",
+};
+function extractUserText(message) {
+    const content = message.message?.content;
+    if (typeof content === "string")
+        return content;
+    if (Array.isArray(content)) {
+        return content
+            .filter((b) => !!b && typeof b === "object" && b.type === "text")
+            .map((b) => b.text)
+            .join("");
+    }
+    return "";
+}
+/**
+ * Drop ANSI/OSC sequences and remaining control chars. Scanned by code point rather than a
+ * regex so the source carries no control characters and avoids no-control-regex (same
+ * approach as sanitizeUploadFilename).
+ */
+function stripTerminalControl(src) {
+    const ESC = 0x1b;
+    const BEL = 0x07;
+    const out = [];
+    for (let i = 0; i < src.length; i++) {
+        const code = src.charCodeAt(i);
+        if (code === ESC) {
+            const next = src[i + 1];
+            if (next === "[") {
+                i += 2;
+                while (i < src.length && !isCsiFinal(src.charCodeAt(i)))
+                    i++;
+            }
+            else if (next === "]") {
+                i += 2;
+                while (i < src.length && src.charCodeAt(i) !== BEL && src.charCodeAt(i) !== ESC)
+                    i++;
+                if (i < src.length && src.charCodeAt(i) === ESC)
+                    i++;
+            }
+            else {
+                i += 1;
+            }
+            continue;
+        }
+        if (code === 0x0a) {
+            out.push("\n");
+            continue;
+        }
+        if (code === 0x09) {
+            out.push(" ");
+            continue;
+        }
+        if (code <= 0x1f || code === 0x7f)
+            continue;
+        out.push(src[i]);
+    }
+    return out.join("").replace(/[ ]{2,}/g, " ");
+}
+/**
+ * True for the TUI's own progress chrome: spinner frames, the elapsed-time counter and
+ * token tickers. These redraw constantly and carry no diagnostic value, and keeping them
+ * would evict the lines that do.
+ */
+function isProgressNoise(line) {
+    if (/^[^a-z]*\d+m?\s*\d*s\)?[^a-z]*$/i.test(line))
+        return true;
+    if (/^\W*(esc to interrupt|ctrl\+[a-z])\W*$/i.test(line))
+        return true;
+    const letters = (line.match(/[a-z]/gi) ?? []).length;
+    return letters < 3;
+}
+function isCsiFinal(code) {
+    return code >= 0x40 && code <= 0x7e;
+}
+const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+async function pollUntil(cond, timeoutMs, intervalMs) {
+    const deadline = monotonicNowMs() + timeoutMs;
+    while (monotonicNowMs() < deadline) {
+        if (cond())
+            return true;
+        await delay(intervalMs);
+    }
+    return cond();
+}
+//# sourceMappingURL=pty-query.js.map