@ours.network/fleet 0.9.2 → 0.9.4

package/README.md

@@ -268,7 +268,12 @@ straight into the console. It is a deterministic program whose lifetime is fused
 the tmux session — it primes the notification cursor *before* the session launches
 (no missed arrivals), cannot be orphaned or left deaf-but-armed, and writes its
 health to `<agentDir>/.monitor-status` (`armed | degraded | failed`), surfaced in
-`ours-fleet status`/`doctor`. The agent's briefing tells it **not** to arm an
+`ours-fleet status`/`doctor`. Injection is held while the pane shows a modal dialog,
+so an injected wake can never answer a trust/permission prompt; if the dialog is
+still up after 2 minutes the monitor gives up on that wake and records
+`degraded: modal wedge …` instead of waiting silently forever (the mail stays
+queued — the agent drains it on the next wake or at SessionStart). The agent's
+briefing tells it **not** to arm an
 in-session Monitor. Set `monitor.enabled: false` to keep the legacy behavior where
 the agent arms its own `ours-mcp watch`. `inject: full` (pushing message bodies
 inline) is on the roadmap and needs two new ours-mcp daemon endpoints; today all

package/dist/monitor.d.ts

@@ -80,9 +80,19 @@ export declare function filterEvents(events: NotifyEvent[], wakeSources: string[
 export declare function formatNotificationLine(events: NotifyEvent[]): string;
 /**
  * Heuristic: does the pane show a modal selection dialog we must not `Enter`
- * into? Markers are the deployed Claude Code trust/permission dialogs — a `❯`
- * pointer beside numbered options, or a "Do you want …" prompt (design §3.2,
- * open question (a): refine empirically). A running turn is NOT modal.
+ * into? Two independent signals, both requiring the *option* shape, not just a
+ * loose numbered line:
+ *
+ *  1. the `❯` pointer sitting on a numbered option — `❯ 1. Use this MCP server`;
+ *  2. a dialog marker ("Do you want …", "Enter to confirm") with ≥2 numbered
+ *     options within `OPTION_WINDOW` lines — this still catches a dialog captured
+ *     mid-redraw, before its pointer row is painted.
+ *
+ * A running turn, a prose list, and a markdown step list are all NOT modal.
+ * Erring modal is the safe direction (a wake is retried; an `Enter` into a live
+ * permission dialog is not undoable), which is why signal 2 is kept — but a bare
+ * marker with no options no longer suffices, because Claude Code closes turns
+ * with exactly that prose ("Do you want me to open the PR?").
  */
 export declare function looksModal(pane: string): boolean;
 /**
@@ -145,7 +155,21 @@ export declare class Monitor {
     private observeTurnOutcome;
     /** Update the consecutive-API-error streak and derive `.monitor-status` from it. */
     private recordTurn;
-    /** Block until the console can accept input; classify offline/stopped/ready. */
+    /**
+     * Reset the composer to empty before typing a wake. Without this, any
+     * unsubmitted text a human left in the input concatenates with the injected
+     * line (`stray[fleet-monitor] …`) or, when it has opened a slash-command menu,
+     * swallows the submit Enter entirely — wedging every subsequent injection until
+     * the composer is cleared by hand. Best-effort: a dead pane just makes the keys
+     * no-ops (delivery is still verified downstream).
+     */
+    private clearComposer;
+    /**
+     * Block until the console can accept input; classify offline/stopped/ready, or
+     * `modal` when the pane still looks modal after `MODAL_GIVE_UP_MS`. The bound is
+     * what keeps a modal from wedging delivery silently: we still never `Enter` into
+     * the dialog, but the give-up is reported instead of retried forever.
+     */
     private awaitInjectable;
     private doFetch;
     private advance;

package/dist/monitor.js

@@ -9,6 +9,20 @@ const BOOT_GRACE_MS = 15_000; // hold injection until the TUI is up
 const POST_VERIFY_MS = 1_000;
 const MAX_ENTER_RETRIES = 2;
 const MODAL_RETRY_MS = 5_000;
+// How long delivery may wait on a modal before giving up. Unbounded waiting made
+// any modal — real or false-positive — wedge wake delivery forever while
+// `.monitor-status` still read `armed`, so the failure was invisible from outside.
+// 2 minutes: long enough that a human answering a real dialog is not punished with
+// a spurious `degraded`, short enough that a wedge shows up in the status while
+// it still matters. Giving up drops nothing — the events stay covered by
+// unread.json / the SessionStart backlog, and the next wake retries.
+const MODAL_GIVE_UP_MS = 120_000;
+const MAX_MODAL_WAITS = Math.floor(MODAL_GIVE_UP_MS / MODAL_RETRY_MS);
+// Keys that reset the composer to empty before we type a wake, so a human's
+// unsubmitted keystrokes can't concatenate with — or wedge (e.g. via an open
+// slash-command menu that captures Enter) — the injected line. C-e moves to end
+// of line, C-u kills to start ⇒ whole single line cleared regardless of cursor.
+const COMPOSER_CLEAR_KEYS = ['C-e', 'C-u'];
 const BACKOFF_STEP_MS = 1_000;
 const BACKOFF_MAX_MS = 5_000;
 const PREFIX = '[fleet-monitor]';
@@ -143,18 +157,57 @@ export function formatNotificationLine(events) {
     ].filter(Boolean).join(', ');
     return `${PREFIX} ${compact} — run get_messages`;
 }
+// ─── Modal-dialog detection (design §3.2, refined empirically) ────────────────
+//
+// `❯` is Claude Code's ordinary composer prompt, so it is on screen in nearly
+// every capture. Testing for it *anywhere* in the pane therefore says nothing;
+// paired with "a numbered line anywhere", it flagged every prose list ("1) foo
+// 2) bar") and every markdown step list as a dialog. What actually distinguishes
+// a select dialog is that its pointer sits ON one of the numbered options.
+//
+// `[^\S\n]` is horizontal whitespace: unlike `\s` it cannot span a line break,
+// so these patterns can't stitch a `❯` in the composer onto a number ten lines up.
+/** `❯ 1. Yes` — the pointer on a numbered option. The shape of every CC dialog. */
+const POINTED_OPTION = /❯[^\S\n]*\d+[.)][^\S\n]+\S/;
+/** A dialog's own chrome. Neither is sufficient alone — see `looksModal`. */
+const DIALOG_MARKERS = [/\bDo you want\b/i, /\bEnter to confirm\b/i];
+/**
+ * A numbered option as a dialog paints it: line start (or a box border), then the
+ * number. Anchored so prose can't match mid-sentence ("…rewrote 3. Then we…").
+ */
+const OPTION_LINE = /^[^\S\n]*(?:[│┃|][^\S\n]*)?(?:❯[^\S\n]*)?\d+[.)][^\S\n]+\S/;
+/** How far from a marker line the options may sit (footers trail them, questions lead). */
+const OPTION_WINDOW = 10;
+/** Options rendered inline on the marker's own line: "…? 1. Yes 2. No". */
+const INLINE_OPTION = /\d+[.)][^\S\n]+\S/g;
 /**
  * Heuristic: does the pane show a modal selection dialog we must not `Enter`
- * into? Markers are the deployed Claude Code trust/permission dialogs — a `❯`
- * pointer beside numbered options, or a "Do you want …" prompt (design §3.2,
- * open question (a): refine empirically). A running turn is NOT modal.
+ * into? Two independent signals, both requiring the *option* shape, not just a
+ * loose numbered line:
+ *
+ *  1. the `❯` pointer sitting on a numbered option — `❯ 1. Use this MCP server`;
+ *  2. a dialog marker ("Do you want …", "Enter to confirm") with ≥2 numbered
+ *     options within `OPTION_WINDOW` lines — this still catches a dialog captured
+ *     mid-redraw, before its pointer row is painted.
+ *
+ * A running turn, a prose list, and a markdown step list are all NOT modal.
+ * Erring modal is the safe direction (a wake is retried; an `Enter` into a live
+ * permission dialog is not undoable), which is why signal 2 is kept — but a bare
+ * marker with no options no longer suffices, because Claude Code closes turns
+ * with exactly that prose ("Do you want me to open the PR?").
  */
 export function looksModal(pane) {
-    if (/Do you want\b/i.test(pane))
+    if (POINTED_OPTION.test(pane))
+        return true;
+    const lines = pane.split('\n');
+    const marker = lines.findIndex(l => DIALOG_MARKERS.some(re => re.test(l)));
+    if (marker < 0)
+        return false;
+    const from = Math.max(0, marker - OPTION_WINDOW);
+    const near = lines.slice(from, marker + OPTION_WINDOW + 1);
+    if (near.filter(l => OPTION_LINE.test(l)).length >= 2)
         return true;
-    const hasPointer = /❯/.test(pane);
-    const hasNumbered = /(^|\n)\s*[❯>]?\s*\d+[.)]\s+\S/.test(pane);
-    return hasPointer && hasNumbered;
+    return (lines[marker].match(INLINE_OPTION) ?? []).length >= 2;
 }
 /**
  * Heuristic: did the turn shown in this pane TERMINATE in an API-level error?
@@ -293,9 +346,13 @@ export class Monitor {
         if (state !== 'ready') {
             if (state === 'offline')
                 this.setStatus('degraded: offline during delivery');
+            else if (state === 'modal')
+                this.setStatus(`degraded: modal wedge — pane held a dialog for ` +
+                    `${MODAL_GIVE_UP_MS / 1000}s, wake not injected`);
             return; // events remain covered by unread.json / SessionStart backlog
         }
         const line = formatNotificationLine(batch);
+        await this.clearComposer(); // start from an empty composer
         await this.deps.tmux.sendText(this.name, line); // send-keys -l + Enter
         let delivered = false;
         // Verify submission for THIS line even if stop() arrives mid-flight: the text
@@ -356,8 +413,26 @@ export class Monitor {
             ? 'degraded: turns failing (api error)'
             : 'armed');
     }
-    /** Block until the console can accept input; classify offline/stopped/ready. */
+    /**
+     * Reset the composer to empty before typing a wake. Without this, any
+     * unsubmitted text a human left in the input concatenates with the injected
+     * line (`stray[fleet-monitor] …`) or, when it has opened a slash-command menu,
+     * swallows the submit Enter entirely — wedging every subsequent injection until
+     * the composer is cleared by hand. Best-effort: a dead pane just makes the keys
+     * no-ops (delivery is still verified downstream).
+     */
+    async clearComposer() {
+        for (const key of COMPOSER_CLEAR_KEYS)
+            await this.deps.tmux.sendKey(this.name, key);
+    }
+    /**
+     * Block until the console can accept input; classify offline/stopped/ready, or
+     * `modal` when the pane still looks modal after `MODAL_GIVE_UP_MS`. The bound is
+     * what keeps a modal from wedging delivery silently: we still never `Enter` into
+     * the dialog, but the give-up is reported instead of retried forever.
+     */
     async awaitInjectable(pid) {
+        let modalWaits = 0;
         for (;;) {
             if (this.stopped)
                 return 'stopped';
@@ -369,11 +444,11 @@ export class Monitor {
                 continue;
             }
             const pane = await safeCapture(this.deps.tmux, this.name);
-            if (looksModal(pane)) {
-                await this.deps.sleep(MODAL_RETRY_MS);
-                continue;
-            }
-            return 'ready';
+            if (!looksModal(pane))
+                return 'ready';
+            if (modalWaits++ >= MAX_MODAL_WAITS)
+                return 'modal';
+            await this.deps.sleep(MODAL_RETRY_MS);
         }
     }
     async doFetch(since, holdMs) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/fleet",
-  "version": "0.9.2",
+  "version": "0.9.4",
   "description": "Harness-agnostic fleet of persistent, identity-bound AI agents. Declarative fleet.yaml, tmux consoles, systemd/launchd supervision, ours.network messaging.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",