@openrig/cli 0.7.0 → 0.7.1

package/daemon/dist/domain/session-transport.js

@@ -11,7 +11,9 @@ import { DraftAwareDelivery } from "./draft-aware-delivery.js";
 import { claudeResumeRotation } from "./session-registry.js";
 import { latestHookPermissionPending, latestHookWaitsOnPerson } from "./agent-activity-store.js";
 import { DeliveryGuardError } from "./seat-delivery-guard.js";
+import { withUrgentLine } from "./urgent-line.js";
 import { wrapPaneEnvelope, appendDeliveredSegment } from "../lib/pane-envelope.js";
+import { isBoundTerminalSeat } from "./terminal-seat.js";
 import { SeatIdentityStore } from "./seat-identity-store.js";
 import { isShellForeground } from "./shell-classifier.js";
 import { observeClaudeDelivery, verifyCodexPaneProcess } from "./native-process-lineage.js";
@@ -135,6 +137,10 @@ const CLAUDE_STATUS_WARNINGS = [
     /^✘ Auto-update failed: no write permission to npm prefix · Run claude doctor$/,
     /^tmux focus-events off · add 'set -g focus-events on' to ~\/\.tmux\.conf and re…$/,
     /^You've used (?:\d|[1-9]\d)% of your weekly limit · resets \d{1,2}(?::\d{2})?(?:am|pm) \(UTC\)$/,
+    // #1641: Claude 2.1.293's update banner, whatever installer it names.
+    /^Update available! Run: \S.*$/,
+    // The context hint, as Claude prints it; reported as the last line below the mode bar on one seat.
+    /^new task\? \/clear to save \d+(?:\.\d+)?k tokens$/,
 ];
 // Current Claude status rows need not end in "thinking)" or show "esc to interrupt".
 // Completed summaries such as "✻ Crunched for 2s" lack the live ellipsis/timer shape.
@@ -206,7 +212,7 @@ function findClaudeComposer(paneContent, options = {}) {
     }
     return { text: prompt.slice(indent.length), bar: lines[bar].trim(), framed, hasWarnings: bar < lines.length - 1, supportedWarningFooter, modeFooter, headSeen, liveStatus };
 }
-const unknown = () => ({ state: "unknown", rows: [], columns: 0, cursorAtEnd: false, collapsedPaste: null });
+const unknown = (unknownReason, cursor) => ({ state: "unknown", rows: [], columns: 0, cursorAtEnd: false, collapsedPaste: null, unknownReason, ...(cursor ? { cursor } : {}) });
 const rule = (line) => /^[─━═-]{6,}(?: .+ [─━═-]+)?$/.test(line.trim());
 const codexFooter = (line) => isComposerFooter(line)
     || /(?:\b\d+% context left\b|\bContext \[)/.test(line);
@@ -251,17 +257,19 @@ function styledTextLines(screen) {
  */
 export function inspectComposerInput(snapshot, runtime = null, owned) {
     const promptClass = composerPromptClassForRuntime(runtime);
-    if (!snapshot || snapshot.inMode)
-        return unknown();
+    if (!snapshot)
+        return unknown("capture_unavailable");
+    if (snapshot.inMode)
+        return unknown("pane_in_mode", snapshot.cursor);
     const { x, y, width, height } = snapshot.cursor;
     if (![x, y, width, height].every(Number.isInteger) || x < 0 || y < 0 || x >= width || y >= height || width < 3 || height < 1)
-        return unknown();
+        return unknown("invalid_cursor", snapshot.cursor);
     const styled = styledTextLines(snapshot.screen);
     const lines = styled.map(line => line.text);
     if (lines.at(-1) === "")
         lines.pop();
     if (lines.length > height || !lines[y])
-        return unknown();
+        return unknown("incomplete_frame", snapshot.cursor);
     const footerAt = findClaudeFooterIndex(lines);
     const footer = lines[footerAt]?.trim() ?? "";
     let claudeEnd = footerAt - 1;
@@ -313,6 +321,7 @@ export function inspectComposerInput(snapshot, runtime = null, owned) {
         // A literal placeholder or text before a moved cursor remains authored input.
         const cursorRow = y - start;
         let ghost;
+        let suggestionRows = [];
         const currentRow = rows[cursorRow];
         let cursorOffset = x === prefix ? 0 : -1;
         let offset = 0;
@@ -327,6 +336,7 @@ export function inspectComposerInput(snapshot, runtime = null, owned) {
                 faint: styled[y + i].faintCells.slice(prefix + (i === 0 ? cursorOffset : 0), prefix + row.length),
             }));
             if (suffix.some(row => row.text.length > 0) && suffix.every(row => row.faint.every(Boolean))) {
+                suggestionRows = suffix.map(row => row.text);
                 ghost = { line: y, offset: prefix + cursorOffset, continuationRows: rows.length - cursorRow - 1 };
                 rows.splice(cursorRow + 1);
                 rows[cursorRow] = currentRow.slice(0, cursorOffset);
@@ -348,7 +358,7 @@ export function inspectComposerInput(snapshot, runtime = null, owned) {
         const cursorAtEnd = y === start + last && x === prefix + stringWidth(visible[last] ?? "");
         const label = visible.length === 1 && COMPOSER_COLLAPSED_PASTE_PATTERN.test(visible[0]) ? visible[0] : null;
         const frame = JSON.stringify([prompt.glyph, prefix, width, footer]);
-        const input = { state: empty ? "empty" : "text", rows: visible, columns: width - prefix, cursorAtEnd, collapsedPaste: label, frame,
+        const input = { state: empty ? "empty" : "text", cursor: { ...snapshot.cursor }, suggestionRows, rows: visible, columns: width - prefix, cursorAtEnd, collapsedPaste: label, frame,
             ...(ghost ? { ghost } : {}) };
         // A numbered body is allowed only as this operation's exact text in its
         // previously empty composer. A newly observed menu gains no such authority.
@@ -361,7 +371,7 @@ export function inspectComposerInput(snapshot, runtime = null, owned) {
         }
         candidates.push(input);
     }
-    return candidates.length === 1 ? candidates[0] : unknown();
+    return candidates.length === 1 ? candidates[0] : unknown(candidates.length ? "ambiguous_composer" : "unrecognized_composer", snapshot.cursor);
 }
 function findPromptDraftBeforeFooter(paneContent) {
     const rawLines = paneContent.split("\n").map((line) => line.trimEnd());
@@ -503,8 +513,19 @@ export function classifyPaneActivity(paneContent, options = {}) {
         ? promptScanLines.slice(oldQuestionEnd + 1)
         : options.runtime === "codex" && !permissionPromptEvidence
             ? codexCurrentSelectionLines(paneContent) ?? promptScanLines : promptScanLines;
+    const currentComposer = options.currentClaudeDialogueOnly && options.runtime === "claude-code"
+        ? composerRegion(paneContent, "claude-code")
+        : null;
+    const currentComposerText = currentComposer?.body ?? (currentComposer?.markerLine !== null && currentComposer?.markerLine !== undefined
+        && currentComposer.closingRuleLine !== null && currentComposer.closingRuleLine !== undefined
+        ? paneContent.split(/\r?\n/).slice(currentComposer.markerLine - 1, currentComposer.closingRuleLine - 1).join("\n")
+        : null);
+    const currentComposerSelection = currentComposerText
+        ? findPatternEvidence(currentComposerText.split("\n").map(line => line.trimStart()), [COMPOSER_SELECTION_SCAN_PATTERN])
+        : null;
     const selectionPromptEvidence = currentClaudeMcpMenu(paneContent) ?? findCurrentClaudeQuestion(paneContent) ??
-        findPatternEvidence(selectionLines, [COMPOSER_SELECTION_SCAN_PATTERN]);
+        currentComposerSelection ?? (options.currentClaudeDialogueOnly ? null
+        : findPatternEvidence(selectionLines, [COMPOSER_SELECTION_SCAN_PATTERN]));
     if (selectionPromptEvidence) {
         return {
             state: "attention",
@@ -716,7 +737,10 @@ export async function probeSessionActivity(input) {
         const snapshot = input.composerSnapshot ? await input.composerSnapshot().catch(() => null) : null;
         const paneContent = snapshot?.screen ?? await capture();
         const capturedAt = new Date().toISOString();
-        const classifyOptions = { timerlessStatusIsLive: input.timerlessStatusIsLive === true };
+        const classifyOptions = {
+            timerlessStatusIsLive: input.timerlessStatusIsLive === true,
+            currentClaudeDialogueOnly: input.currentClaudeDialogueOnly === true,
+        };
         let classification = communityHarnessPaneActivity(classifyPaneActivity(paneContent ?? "", { ...classifyOptions,
             composerSnapshot: snapshot ?? undefined, runtime }), input.communityHarness);
         // Claude renders its prompt suggestion faint, which the plain capture loses. When a Claude pane reads
@@ -1500,8 +1524,6 @@ function callerCancelled(sessionName) {
     return { ok: false, sessionName, sent: false, inputPhase: "not_reached", reason: CALLER_CANCELLED,
         error: `The request was cancelled before any input started. Nothing was typed into '${sessionName}', and nothing will be.` };
 }
-/** The evidence of a verified send whose path does not read the input box (an audited prompt answer). */
-const INPUT_BOX_UNCHECKED = { seat: "unchecked", before: "unchecked", after: "unchecked", sameProcess: false };
 export class SessionTransport {
     db;
     guardedDelivery;
@@ -1818,11 +1840,14 @@ export class SessionTransport {
     }
     deliveryTarget(sessionName) { return this.tmuxAdapter.deliveryGuard?.maybeTarget(sessionName) ?? null; }
     get deliveryGuard() { return this.tmuxAdapter.deliveryGuard; }
-    retentionTarget(sessionName) {
+    /** With an input, whether the seat's level would hold that input; without one, whether its mode holds everything. */
+    retentionTarget(sessionName, input) {
         const guard = this.tmuxAdapter.deliveryGuard;
         const target = guard?.maybeTarget(sessionName);
         if (!guard || !target)
             return null;
+        if (input)
+            return guard.holdsInput(target.nodeId, input) ? target : null;
         const pref = guard.preference(target.nodeId);
         return pref.desired || pref.effective ? target : null;
     }
@@ -1847,6 +1872,16 @@ export class SessionTransport {
      * send, add a notice saying so. The notice is context beside the send's own result, which it never changes.
      */
     async send(sessionName, text, opts) {
+        // A terminal seat's shell would run the envelope lines as commands. Swap before the guard,
+        // whose outbox body, hash and delivery-ID identity all key on the text actually typed.
+        // Without the envelope there's no Sent: line, so stampISO is dropped too: the delivered-latency
+        // segment must never edit a line of the exact text.
+        if (opts?.exactText !== undefined && !opts.dangerouslyInteract) {
+            const { exactText, ...rest } = opts;
+            if (!isBoundTerminalSeat(this.db, sessionName))
+                return this.send(sessionName, text, rest);
+            return { ...(await this.send(sessionName, exactText, { ...rest, stampISO: undefined, typedExactly: true })), envelopeOmitted: true };
+        }
         const observe = () => { try {
             return this.compactionObserver?.(sessionName) ?? null;
         }
@@ -1863,7 +1898,20 @@ export class SessionTransport {
                 notice: `${sessionName} was ${seen.detail} (${when}, as OpenRig's managed compaction recorded it). This doesn't mean the restore has finished; if this message matters, check the reply and follow up.` } };
     }
     async sendWithoutCompactionNotice(sessionName, text, opts) {
+        if (!opts?.urgent)
+            return this.sendClassified(sessionName, text, opts);
+        // Shown on delivery, and kept with a held message: who marked it urgent.
+        console.info(`[transport] urgent send to ${sessionName}, marked by ${opts.urgent.by}`);
+        // An explicit prompt answer is typed as keys, and a submit-only retry types no text at all: the label's letters would
+        // act as keystrokes (a menu shortcut, say). A terminal seat's exact text would run the label as a command. Their bytes
+        // stay exactly as given; the mark stays in the result and the log.
+        const rawKeys = opts.dangerouslyInteract === true || opts.submitOnly === true || opts.typedExactly === true;
+        const result = await this.sendClassified(sessionName, rawKeys ? text : withUrgentLine(text, opts.urgent.by), opts);
+        return { ...result, urgent: opts.urgent };
+    }
+    async sendClassified(sessionName, text, opts) {
         const guard = this.tmuxAdapter.deliveryGuard;
+        const admission = { source: opts?.openrigNotice ? "openrig" : "agent", urgent: !!opts?.urgent, override: opts?.dangerouslyInteract === true };
         if (!guard) {
             // No guard, so no recorded delivery to read back: a caller already gone ends the send here.
             if (callerSignal(opts)?.aborted)
@@ -1875,7 +1923,9 @@ export class SessionTransport {
             return result;
         }
         const outbox = new OutboxHandler(this.db);
-        const ids = opts?.committedOutboxIds ?? [opts?.deliveryId ?? `guard-send-${randomUUID()}`];
+        let ids = opts?.committedOutboxIds ?? [opts?.deliveryId ?? `guard-send-${randomUUID()}`];
+        // A combined wake's members are re-checked under the lease, against the configuration that decides this send.
+        const recheck = (held) => opts?.recheckMembers?.((input) => guard.holdsInput(guard.target(sessionName).nodeId, input), held) ?? null;
         const retainedResult = (reason = "typing_guard_enabled") => ({ ok: true, sessionName, outcome: "retained", sent: false, verified: false,
             outboxIds: ids, reason, warning: `Retained, not delivered. Inspect with rig seat held-messages ${sessionName}; changing protection does not replay held messages.` });
         try {
@@ -1930,18 +1980,24 @@ export class SessionTransport {
                 }
             }
             const result = await guard.operation(sessionName, async () => {
-                if (this.guardedDelivery && !sendOpts?.submitOnly && guard.needsInputCheck(sessionName)) {
-                    if (callerSignal(sendOpts)?.aborted)
+                const members = recheck(false);
+                const memberText = members?.text ?? text;
+                const memberOpts = members ? { ...sendOpts, committedOutboxIds: members.outboxIds } : sendOpts;
+                if (this.guardedDelivery && !memberOpts?.submitOnly && !memberOpts?.dangerouslyInteract && guard.needsInputCheck(sessionName)) {
+                    if (callerSignal(memberOpts)?.aborted)
                         return callerCancelled(sessionName);
-                    return this.guardedDelivery.send(sessionName, text, sendOpts ?? {}, sendOpts?.committedOutboxIds ?? [`guard-send-${randomUUID()}`]);
+                    return this.guardedDelivery.send(sessionName, memberText, memberOpts ?? {}, memberOpts?.committedOutboxIds ?? [`guard-send-${randomUUID()}`]);
                 }
-                return this.sendUnguarded(sessionName, text, sendOpts);
+                return this.sendUnguarded(sessionName, memberText, memberOpts);
             }, async (target) => {
                 if (opts?.submitOnly)
                     return { ok: false, sessionName, sent: false, reason: "typing_guard_enabled", error: "Typing guard prevents submit-only; no Enter was sent." };
                 // Nothing is retained yet: a caller that went away while this send waited for the lease ends it here.
                 if (callerSignal(opts)?.aborted)
                     return callerCancelled(sessionName);
+                const members = recheck(true);
+                if (members)
+                    ids = members.outboxIds;
                 this.db.transaction(() => {
                     for (const id of ids) {
                         const prior = opts?.committedOutboxIds ? outbox.getById(id) : null;
@@ -1949,7 +2005,7 @@ export class SessionTransport {
                             throw new Error("Committed wake target/ID mismatch");
                         outbox.retain(prior ? { ...prior, outboxId: id, tags: prior.tags ?? undefined, auditPointer: prior.auditPointer ?? undefined } : {
                             outboxId: id, senderSession: opts?.actorSession ?? "unknown", destinationSession: sessionName, body: text, auditPointer: opts?.auditPointer,
-                            identityProvenance: opts?.identityProvenance,
+                            identityProvenance: opts?.identityProvenance, ...(opts?.urgent ? { urgency: "urgent" } : {}),
                         }, target, !!opts?.committedOutboxIds);
                     }
                 })();
@@ -1969,7 +2025,7 @@ export class SessionTransport {
                     });
                 }
                 return retainedResult();
-            });
+            }, admission);
             if (result.ok && result.sent !== false) {
                 await this.reconcileStartupReadiness(sessionName).catch(() => { });
             }
@@ -2104,6 +2160,7 @@ export class SessionTransport {
             attachmentType: meta.attachmentType,
             timeoutMs,
             binding: { sessionName, nodeId: meta.nodeId, occupant: meta.occupant, pane: meta.pane },
+            privateInput: opts.dangerouslyInteract === true,
             readinessFromPaneOnly: opts.readinessFromPaneOnly === true,
             signal: callerSignal(opts), cancelledBy: "caller",
         });
@@ -2173,14 +2230,18 @@ export class SessionTransport {
                 error: `'${sessionName}' is in a tmux mode (such as copy mode) and could not leave it, so Enter would not reach the agent. ${outcome}` };
         };
         // S01/S02 P2 observation context, frozen at attempt entry before any await.
-        const observed = this.captureObserver ? {
+        const observed = this.captureObserver && !opts?.dangerouslyInteract ? {
             attemptId: randomUUID(),
             binding: Object.freeze({ sessionName, nodeId: sessionMeta.nodeId, occupant: sessionMeta.occupant, pane: sessionMeta.pane }),
             pre: (opts?.verify ? { state: "not_reached" } : { state: "not_requested" }),
             post: (opts?.verify ? { state: "not_reached" } : { state: "not_requested" }),
             sentHash: null,
         } : null;
+        let existingInput;
+        let overrideBeforePaste;
         const observe = (result) => {
+            if (existingInput)
+                result = { ...result, existingInput };
             if (result.ok && runtimeAdvisory)
                 result = { ...result, warning: [runtimeAdvisory, result.warning].filter(Boolean).join(" ") };
             if (observed && this.captureObserver) {
@@ -2364,6 +2425,7 @@ export class SessionTransport {
                 attachmentType: sessionMeta.attachmentType,
                 timeoutMs: waitForIdleMs,
                 binding: observed?.binding,
+                privateInput: opts?.dangerouslyInteract === true,
                 readinessFromPaneOnly: opts?.readinessFromPaneOnly === true,
                 signal: callerSignal(opts), cancelledBy: "caller",
             });
@@ -2422,6 +2484,7 @@ export class SessionTransport {
                     // Message-only: the re-wait runs on the leftover budget, but the
                     // timeout names the configured --wait-for-idle value.
                     timeoutLabelMs: waitForIdleMs,
+                    privateInput: opts.dangerouslyInteract === true,
                     binding: observed?.binding,
                     readinessFromPaneOnly: opts.readinessFromPaneOnly === true,
                     signal: callerSignal(opts), cancelledBy: "caller",
@@ -2450,7 +2513,7 @@ export class SessionTransport {
                     attachmentType: sessionMeta.attachmentType,
                     binding: observed?.binding,
                     readinessFromPaneOnly: opts.readinessFromPaneOnly === true,
-                });
+                }, opts.dangerouslyInteract === true);
                 if (recheck.state !== "idle") {
                     const late = recheck.state === "needs_input"
                         ? {
@@ -2497,14 +2560,15 @@ export class SessionTransport {
         // the positive-picker guard (FR-4 — the footgun separation). The advisory is carried on the
         // success result via `warning` so the honest telemetry is surfaced.
         let sendAdvisory;
-        const promptOverride = waitForIdleMs === undefined && Boolean(opts?.dangerouslyInteract);
-        if (waitForIdleMs === undefined) {
+        // Broadcast can carry wait + override: after waiting, it still uses the same deliberate-input boundary.
+        const promptOverride = Boolean(opts?.dangerouslyInteract);
+        if (waitForIdleMs === undefined || promptOverride) {
             const readiness = await this.classifySendReadiness({
                 sessionName,
                 runtime,
                 attachmentType: sessionMeta.attachmentType,
                 binding: observed?.binding,
-            });
+            }, opts?.dangerouslyInteract === true);
             // Explicit interaction selects key input even when readiness cannot recognize the prompt.
             // Only bypassing a positive picker requires a successful audit; other states already sent.
             if (opts?.dangerouslyInteract) {
@@ -2516,12 +2580,34 @@ export class SessionTransport {
                         error: "--dangerously-interact requires --reason explaining why the prompt is being driven. No text was sent.",
                     };
                 }
-                const audit = this.recordPromptOverride({
-                    sessionName,
-                    readiness,
-                    actorSession: opts.actorSession ?? null,
-                    overrideReason: opts.reason ?? null,
-                });
+                const auditInput = { sessionName, readiness, actorSession: opts.actorSession ?? null, overrideReason: opts.reason ?? null };
+                const target = this.tmuxAdapter.deliveryGuard?.maybeTarget(sessionName);
+                // Native menus retain their audited key-driving path. Otherwise inspect under the same lease,
+                // after buffer preparation, immediately before the adapter's final identity check and paste.
+                if (target && readiness.state !== "needs_input") {
+                    overrideBeforePaste = async () => {
+                        const unchecked = opts.typeWithoutChecking === true;
+                        const snapshot = unchecked ? null : await this.readWithinDeadline("session_transport.override_input", () => this.tmuxAdapter.captureComposerSnapshot(target.pane ?? sessionName));
+                        const input = unchecked ? null : inspectComposerInput(snapshot, runtime);
+                        const classification = unchecked ? "not_checked" : input.state === "unknown" ? "unreadable"
+                            : input.state === "text" ? "typed_or_pasted" : input.ghost ? "suggestion_only" : "empty";
+                        existingInput = { target, classification, rows: input?.rows ?? [], suggestionRows: input?.suggestionRows ?? [],
+                            cursor: input?.cursor ?? null, fullContentsVisible: !!input && input.state !== "unknown" && !input.collapsedPaste,
+                            ...(input?.unknownReason ? { reason: input.unknownReason } : {}), cleared: false };
+                        const stopped = classification === "typed_or_pasted" || classification === "unreadable";
+                        const audit = this.recordPromptOverride({ ...auditInput, input: { classification, visibleRows: existingInput.rows.length,
+                                suggestionRows: existingInput.suggestionRows.length, choice: unchecked ? "type_without_checking" : "inspect",
+                                outcome: stopped ? "stopped" : "proceed", clearAttempted: false } });
+                        if (!audit.ok)
+                            sendAdvisory = `prompt-override: audit unavailable (${audit.reason}).`;
+                        if (stopped)
+                            throw new DeliveryGuardError(classification === "unreadable" ? "override_input_unknown" : "override_input_present", classification === "unreadable" ? "Input could not be read. Nothing was typed. Inspect the native terminal, deliberately clear its prompt with native/tmux controls, then retry; or explicitly choose --type-without-checking (does not clear)."
+                                : "Existing typed or pasted input (author unknown). Nothing was typed. Inspect the shown input, deliberately clear the prompt with native/tmux controls, then retry. Manual clearing is outside OpenRig's lease and observation checks and is not recorded.");
+                        if (unchecked)
+                            sendAdvisory = [sendAdvisory, "Input was not checked or cleared; this send may join or submit existing text."].filter(Boolean).join(" ");
+                    };
+                }
+                const audit = overrideBeforePaste ? { ok: true } : this.recordPromptOverride(auditInput);
                 if (!audit.ok && readiness.state === "needs_input") {
                     return {
                         ok: false,
@@ -2623,7 +2709,7 @@ export class SessionTransport {
             opts?.beforeWrite?.();
             writeIssued = true;
             if (promptOverride)
-                return this.tmuxAdapter.sendText(sessionName, text, beforePaste, { bracketed: false });
+                return this.tmuxAdapter.sendText(sessionName, text, beforePaste, { bracketed: false, beforePaste: overrideBeforePaste });
             return beforePaste ? this.tmuxAdapter.sendText(sessionName, text, beforePaste) : this.tmuxAdapter.sendText(sessionName, text);
         }, (result) => result.ok ? "ok" : "failed").catch(tagIssued);
         if (!textResult.ok && textResult.code === CALLER_CANCELLED && cancel?.aborted) {
@@ -2631,13 +2717,15 @@ export class SessionTransport {
         }
         if (!textResult.ok) {
             // A draft refusal is the guard holding the write before any input; it is not an attempted write.
-            const policyRefusal = typeof textResult.code === "string" && (textResult.code.startsWith("draft_") || textResult.code === "managed_compaction_pending");
+            const policyRefusal = typeof textResult.code === "string" && (textResult.code.startsWith("draft_") || textResult.code.startsWith("override_input_") || textResult.code === "managed_compaction_pending");
             return observe({
                 ok: false,
                 sessionName,
                 reason: policyRefusal ? textResult.code : "send_failed",
                 outcome: "failed",
-                ...(policyRefusal ? (textResult.code === "managed_compaction_pending" ? { inputPhase: "not_reached" } : {}) : { inputPhase: "attempted" }),
+                // The adapter's draft checks run before the paste (only file/buffer preparation precedes them), and its
+                // after-paste observation cannot fail the write, so a draft_* receipt proves the target input was never reached.
+                inputPhase: policyRefusal ? "not_reached" : "attempted",
                 error: `Failed to send text to '${sessionName}': ${textResult.message}`,
                 ...(waitMode || policyRefusal ? { sent: false, ...waitEvidence } : {}),
             });
@@ -2673,7 +2761,6 @@ export class SessionTransport {
                     return observe(changedRecipient(true));
                 if (!promptAnswerStaged(pane, text, runtime)) {
                     return observe({ ok: true, sessionName, sent: true, verified: false, outcome: "rendered-unconfirmed", promptInteraction: "unverified",
-                        ...(inputBoxRuntime ? { inputBox: INPUT_BOX_UNCHECKED } : {}),
                         warning: [sendAdvisory, "prompt-override: answer sent as unbracketed input; submission unverified. No trailing Enter: the complete answer is not visibly staged (it may have been consumed, the prompt changed, or observation is unavailable)."].filter(Boolean).join(" ") });
                 }
                 sendAdvisory = [sendAdvisory, "prompt-override: answer sent as unbracketed input; Enter submitted the complete still-staged answer."].filter(Boolean).join(" ");
@@ -2688,7 +2775,9 @@ export class SessionTransport {
                     reason: policyRefusal ? submitResult.code : "submit_failed",
                     outcome: "failed",
                     inputPhase: "written",
-                    error: `Text is in '${sessionName}', but the Enter reported a failure, so the submission outcome is unconfirmed. The agent may need manual attention.${submitResult.code === "managed_compaction_pending" ? ` ${submitResult.message}` : ""}`,
+                    error: policyRefusal
+                        ? `Text was pasted into '${sessionName}', but Enter was not sent: ${submitResult.message} Inspect the current input before submitting it.`
+                        : `Text is in '${sessionName}', but the Enter reported a failure, so the submission outcome is unconfirmed. The agent may need manual attention.`,
                     ...(waitMode || policyRefusal ? { sent: true, ...waitEvidence } : {}),
                 });
             }
@@ -2727,26 +2816,23 @@ export class SessionTransport {
                 const count = envelope ? (pane, expected) => countEnvelopeOccurrences(pane, expected, promptClass) : countOccurrences;
                 const preCount = count(transcript(preVerifyContent), snippet);
                 const postCount = count(transcript(content), snippet);
-                // An audited prompt answer reads no box (no extra read is added for it), so it says so: unchecked, and
-                // unconfirmed; it never falls back to the count below.
+                // An audited prompt answer reads no box (no extra read is added for it), so it reads unconfirmed; it never
+                // falls back to the count below.
                 const inputBox = boxBefore && inputBoxRuntime
                     ? await this.inputBoxEvidence(sessionName, sessionMeta, boxBefore, readInputBox(content, inputBoxRuntime, text, boxBefore.pane))
-                    : inputBoxRuntime && promptOverride ? INPUT_BOX_UNCHECKED : undefined;
+                    : undefined;
                 // With the setting on, only a seat proven idle before the paste and input-box evidence verify: exact before
                 // Enter, empty after, same process. A not-idle or unknown seat always reads unconfirmed.
                 const verified = inputBoxRuntime
                     ? inputBox?.seat === "idle" && inputBox.before === "exact" && inputBox.after === "empty" && inputBox.sameProcess
                     : postCount > preCount;
-                return observe({ ok: true, sessionName, ...interaction, verified, outcome: verified ? "delivered" : "rendered-unconfirmed", ...(inputBox ? { inputBox } : {}), ...(sendAdvisory ? { warning: sendAdvisory } : {}), ...(waitMode ? { sent: true, ...waitEvidence } : {}) });
+                return observe({ ok: true, sessionName, ...interaction, verified, outcome: verified ? "delivered" : "rendered-unconfirmed", ...(sendAdvisory ? { warning: sendAdvisory } : {}), ...(waitMode ? { sent: true, ...waitEvidence } : {}) });
             }
             catch {
                 if (observed && observed.post.state === "not_reached") {
                     observed.post = { state: "unavailable", cause: "capture_error", capturedAt: this.now().toISOString(), captureSeq };
                 }
-                const inputBox = boxBefore
-                    ? { seat: boxBefore.seat, before: boxBefore.reading, after: "unavailable", sameProcess: false }
-                    : inputBoxRuntime && promptOverride ? INPUT_BOX_UNCHECKED : undefined;
-                return observe({ ok: true, sessionName, ...interaction, verified: false, outcome: "rendered-unconfirmed", ...(inputBox ? { inputBox } : {}), ...(sendAdvisory ? { warning: sendAdvisory } : {}), ...(waitMode ? { sent: true, ...waitEvidence } : {}) });
+                return observe({ ok: true, sessionName, ...interaction, verified: false, outcome: "rendered-unconfirmed", ...(sendAdvisory ? { warning: sendAdvisory } : {}), ...(waitMode ? { sent: true, ...waitEvidence } : {}) });
             }
         }
         return observe({ ok: true, sessionName, ...interaction, ...(sendAdvisory ? { warning: sendAdvisory } : {}), ...(waitMode ? { sent: true, ...waitEvidence } : {}) });
@@ -2887,7 +2973,7 @@ export class SessionTransport {
     async observeReadinessWithin(input, remainingMs, cancel) {
         if (cancel?.aborted)
             return null;
-        const observation = this.classifySendReadiness(input);
+        const observation = this.classifySendReadiness(input, input.privateInput);
         observation.catch(() => undefined);
         let timer;
         let onAbort;
@@ -2956,7 +3042,7 @@ export class SessionTransport {
         }
         return paneCommand.replace(/^-/, "");
     }
-    async classifySendReadiness(input) {
+    async classifySendReadiness(input, privateInput = false) {
         const now = this.now();
         const composerSnapshot = this.tmuxAdapter.deliveryGuard?.needsInputCheck(input.sessionName)
             ? () => this.tmuxAdapter.captureComposerSnapshot(input.binding?.pane ?? input.sessionName) : undefined;
@@ -2989,6 +3075,21 @@ export class SessionTransport {
             hookActivity.reason !== "permission_prompt_cleared") {
             // Fresh hook (within the 15s send window): authoritative for any state.
             if (this.hookFreshForSend(hookActivity, now)) {
+                if (hookActivity.state === "running" && input.runtime === "claude-code") {
+                    const paneVeto = await probeSessionActivity({
+                        composerSnapshot,
+                        currentClaudeDialogueOnly: true,
+                        sessionName: input.sessionName,
+                        runtime: input.runtime,
+                        attachmentType: input.attachmentType,
+                        tmuxAdapter: this.tmuxAdapter,
+                        now,
+                        captureObserver: privateInput ? undefined : this.captureObserver,
+                        binding: input.binding,
+                    });
+                    if (paneVeto.state === "needs_input")
+                        return paneVeto;
+                }
                 return hookActivity;
             }
             // OPR.0.4.3.28 Part A — a stale-but-latest `idle` hook (older than the 15s
@@ -3012,7 +3113,7 @@ export class SessionTransport {
                     attachmentType: input.attachmentType,
                     tmuxAdapter: this.tmuxAdapter,
                     now,
-                    captureObserver: this.captureObserver,
+                    captureObserver: privateInput ? undefined : this.captureObserver,
                     binding: input.binding,
                 });
                 if (paneVeto.state === "needs_input") {
@@ -3028,7 +3129,7 @@ export class SessionTransport {
             attachmentType: input.attachmentType,
             tmuxAdapter: this.tmuxAdapter,
             now,
-            captureObserver: this.captureObserver,
+            captureObserver: privateInput ? undefined : this.captureObserver,
             binding: input.binding,
             // Pane-only readiness must not send into a status row whose timer hasn't appeared yet.
             timerlessStatusIsLive: input.readinessFromPaneOnly === true,
@@ -3195,6 +3296,7 @@ export class SessionTransport {
                 detectedReason: input.readiness.reason,
                 evidenceSource: input.readiness.evidenceSource,
                 overrideReason: input.overrideReason,
+                ...(input.input ? { input: input.input } : {}),
             });
             return { ok: true };
         }
@@ -3341,6 +3443,7 @@ export class SessionTransport {
             // (h) thread the resolved stampISO so send()'s delivered-latency calc measures from the SAME
             // compose stamp the envelope carries (opts may not have carried one; the local stampISO is truth).
             const result = await this.send(session.sessionName, perRecipientText, { ...opts, stampISO,
+                exactText: opts?.envelopeSender ? text : undefined,
                 deliveryId: opts?.deliveryId ? `${opts.deliveryId}:${session.sessionName}` : undefined });
             results.push(result);
         }