@rynx-ai/runtime 0.1.9 → 0.1.10-beta.3

package/dist/claude/native-hook-main.js

@@ -2,6 +2,7 @@
 /** Standalone Claude hook adapter. Observer hooks append framing events; blocking
  * interaction hooks rendezvous with the runner through the session bridge. */
 import { createHash, randomUUID } from "node:crypto";
+import { realpathSync } from "node:fs";
 import { claimInteractionResult, recordInteractionAck, recordHookEvent, recordInteractionRequest, removeClaimedInteractionResult, removeInteractionLease, touchInteractionLease, } from "./native-bridge.js";
 import { boundInteractionRequest, redactInteractionResolution, } from "../interactions.js";
 function argValue(argv, flag) {
@@ -87,11 +88,48 @@ function questionRequest(id, toolInput) {
     };
 }
 function permissionSuggestions(payload) {
-    return Array.isArray(payload.permission_suggestions)
+    const suggestions = Array.isArray(payload.permission_suggestions)
         ? payload.permission_suggestions
             .map(asRecord)
             .filter((suggestion) => Boolean(suggestion))
         : [];
+    const seenFilesystemTargets = new Set();
+    return suggestions.filter((suggestion) => {
+        const key = filesystemPermissionSuggestionKey(suggestion);
+        if (!key)
+            return true;
+        if (seenFilesystemTargets.has(key))
+            return false;
+        seenFilesystemTargets.add(key);
+        return true;
+    });
+}
+function filesystemPermissionSuggestionKey(suggestion) {
+    const rules = Array.isArray(suggestion.rules)
+        ? suggestion.rules.map(asRecord).filter((rule) => Boolean(rule))
+        : [];
+    if (rules.length !== 1)
+        return undefined;
+    const toolName = asString(rules[0]?.toolName);
+    if (toolName !== "Read" && toolName !== "Write" && toolName !== "Edit")
+        return undefined;
+    const ruleContent = asString(rules[0]?.ruleContent);
+    if (!ruleContent?.endsWith("/**"))
+        return undefined;
+    try {
+        const target = realpathSync(ruleContent.slice(0, -3));
+        return JSON.stringify([
+            asString(suggestion.type),
+            asString(suggestion.behavior),
+            asString(suggestion.destination),
+            asString(suggestion.mode),
+            toolName,
+            target,
+        ]);
+    }
+    catch {
+        return undefined;
+    }
 }
 function permissionSuggestionLabel(suggestion, index, total) {
     const rules = Array.isArray(suggestion.rules)
@@ -134,11 +172,10 @@ function permissionSuggestionLabel(suggestion, index, total) {
 function permissionSuggestionActionId(index) {
     return `allow_suggestion_${index}`;
 }
-function permissionRequest(id, payload, toolInput) {
+function permissionRequest(id, payload, toolInput, suggestions) {
     const toolName = asString(payload.tool_name) ?? "tool";
     const command = asString(toolInput.command) ?? asString(toolInput.file_path);
     const cwd = asString(payload.cwd);
-    const suggestions = permissionSuggestions(payload);
     return {
         interactionId: id,
         kind: "permission",
@@ -178,7 +215,7 @@ async function waitForResult(bridgeDir, id) {
 function answerText(value) {
     return Array.isArray(value) ? value.join(", ") : value ?? "";
 }
-function nativeVerdict(hookKind, payload, result) {
+function nativeVerdict(hookKind, payload, result, suggestions) {
     const toolInput = asRecord(payload.tool_input) ?? {};
     const toolName = asString(payload.tool_name) ?? "tool";
     if (result.status === "cancelled") {
@@ -224,7 +261,6 @@ function nativeVerdict(hookKind, payload, result) {
                 },
             };
     }
-    const suggestions = permissionSuggestions(payload);
     const suggestionMatch = /^allow_suggestion_(\d+)$/.exec(resolution.actionId);
     const suggestionIndex = suggestionMatch ? Number(suggestionMatch[1]) : -1;
     const selectedSuggestion = Number.isSafeInteger(suggestionIndex)
@@ -274,16 +310,17 @@ async function main() {
     }
     const id = interactionId(payload);
     const toolInput = asRecord(payload.tool_input) ?? {};
+    const suggestions = permissionSuggestions(payload);
     const request = asString(payload.tool_name) === "AskUserQuestion"
         ? questionRequest(id, toolInput)
-        : permissionRequest(id, payload, toolInput);
+        : permissionRequest(id, payload, toolInput, suggestions);
     try {
         const bounded = boundInteractionRequest(request);
         if (!bounded.ok) {
             await writeStdout(nativeVerdict(hookKind, payload, {
                 status: "cancelled",
                 reason: bounded.reason,
-            }));
+            }, suggestions));
             return;
         }
         touchInteractionLease(bridgeDir, id);
@@ -295,7 +332,7 @@ async function main() {
                 request: bounded.request,
             });
             const result = await waitForResult(bridgeDir, id);
-            const verdict = nativeVerdict(hookKind, payload, result);
+            const verdict = nativeVerdict(hookKind, payload, result, suggestions);
             // Claiming the response is the interaction commit point: it records what
             // the user answered, while the later tool/Turn events record whether Claude
             // could act on it. ACK before stdout is required because Claude may reap a

package/dist/claude/native-integration.d.ts

@@ -96,6 +96,17 @@ export declare class ClaudeLiveSession {
     private stopPendingAt;
     /** Open tool-call ids (start seen, end not yet) — suppresses the idle backstop. */
     private readonly openToolIds;
+    /** Transcript-backed acknowledgements for web→TUI input. A direct idle
+     * submit is recorded as `promptSource:"typed"`; a submit while Claude is busy
+     * is recorded immediately as `queue-operation:enqueue` and only later
+     * promoted to `promptSource:"queued"`. The promotion is intentionally not a
+     * second acknowledgement. */
+    private submissionSequence;
+    private readonly submissionObservations;
+    /** Enqueued type-ahead inputs awaiting their eventual role:user promotion.
+     * Claude has used both `promptSource:"queued"` and `"sdk"` for that later
+     * record, so content correlation is the stable discriminator. */
+    private readonly pendingQueuedSubmissions;
     /** Blocking native questions/permissions. Their hook subprocess is still
      *  executing, so the Turn remains running and cannot be idle-closed. */
     private readonly pendingInteractions;
@@ -120,11 +131,16 @@ export declare class ClaudeLiveSession {
      *  a turn's usage on close. undefined until the statusLine hook first fires. */
     private latestStatus?;
     private deltasOffset;
-    /** MessageDisplay message ids in first-seen order, FIFO-mapped onto the
+    /** Finalized MessageDisplay ids in completion order, FIFO-mapped onto the
      *  transcript's assistant-text records so a streamed message and its final
      *  item share an itemId (message_id is absent from the transcript). */
     private readonly messageIdQueue;
-    private readonly seenMessageIds;
+    private readonly finalizedMessageIds;
+    /** Transcript messages that arrived before their MessageDisplay stream. A
+     *  matching late final consumes both sides so its id cannot shift the FIFO
+     *  used by the next assistant message. */
+    private readonly unmatchedTranscriptMessages;
+    private readonly streamedMessageText;
     constructor(opts: ClaudeLiveSessionOptions);
     /**
      * Restore the durable forwarder cursor for `transcriptPath` (reference implementation's
@@ -139,6 +155,17 @@ export declare class ClaudeLiveSession {
     private persistForwardState;
     /** True once SessionStart bound the transcript (or a resume path was given). */
     isReady(): boolean;
+    /** Drain records that predate a new injection, then return a monotonic
+     * checkpoint. This prevents a lagging, older identical prompt from
+     * acknowledging the new submit. */
+    beginSubmissionObservation(): number;
+    /** Whether Claude durably accepted `text` after `checkpoint`. Polling the
+     * transcript here makes submit confirmation independent of the background
+     * forwarder interval and covers both idle and type-ahead submissions. */
+    hasObservedSubmissionAfter(checkpoint: number, text: string): boolean;
+    private rememberSubmission;
+    private rememberQueuedSubmission;
+    private consumeQueuedPromotion;
     start(): void;
     stop(): void;
     /** Phase two of runner shutdown. The caller must stop the Claude terminal
@@ -213,6 +240,7 @@ export declare class ClaudeLiveSession {
      *  events. Guarded on an open turn — deltas belong to the turn the user record
      *  opened; the offset advances only once processed. */
     private pollDeltas;
+    private finalizeMessageDisplay;
     /** Refresh the latest statusLine context/cost snapshot (a last-writer-wins file
      *  the statusLine hook overwrites on every TUI render). */
     private pollStatus;
@@ -222,7 +250,8 @@ export declare class ClaudeLiveSession {
     private statusUsage;
     /** Remap an assistant-text `message_completed` onto the FIFO-matched
      *  MessageDisplay message_id, so its streamed deltas and this final item share
-     *  an itemId. No queued delta (MessageDisplay didn't fire) → keep the transcript id. */
+     *  an itemId. No queued delta yet → keep the transcript id and remember its
+     *  text so a late MessageDisplay final can be reconciled backward. */
     private remapMessageItem;
     private trackTool;
     private ensureTurn;
@@ -245,6 +274,7 @@ export declare class ClaudeLiveSession {
     isTurnOpen(): boolean;
     private closeTurn;
     private closeTurnError;
+    private resetMessageCorrelation;
     private maybeIdleClose;
 }
 /** The tmux-pane operations claude-native injection needs (a subset of
@@ -261,10 +291,14 @@ export interface TerminalInjector {
 export interface InjectViaTerminalOptions {
     promptGlyph?: string;
     promptTimeoutMs?: number;
-    pasteCommitMs?: number;
     settleMs?: number;
-    submitVerifyMs?: number;
-    submitRetryMs?: number;
+    /** Transcript-backed proof that Claude accepted this exact input. When
+     * absent, injection keeps the legacy one-Enter best-effort contract. */
+    submissionObserved?: () => boolean;
+    /** Per-attempt wait for a transcript acknowledgement. */
+    submitConfirmMs?: number;
+    /** Total Enter attempts when transcript confirmation is available. */
+    maxSubmitAttempts?: number;
     pollMs?: number;
     now?: () => number;
     sleep?: (ms: number) => Promise<void>;
@@ -274,13 +308,13 @@ export interface InjectViaTerminalOptions {
 }
 /**
  * Deliver `text` into a claude TUI pane, the reference implementation recipe:
- *   ready-gate (poll for `❯`) → clear leftover → bracketed paste (+ trailing
- *   newline) → wait for the draft to land → settle → submit Enter → verify the
- *   draft left the box (re-send Enter while it hasn't).
+ *   ready-gate (poll for `❯`) → clear leftover → bracketed paste the draft
+ *   → settle → submit Enter → confirm from Claude's transcript.
  *
  * THROWS if the prompt never appears within the ready-gate window (reference implementation
  * `_wait_for_claude_prompt_ready` RAISE) — a not-ready pane is a hard error the
- * caller reports, NOT a signal to fall through to a second output path. Returns
- * `true` once the message is submitted (best-effort even if submit-verify times out).
+ * caller reports, NOT a signal to fall through to a second output path. With a
+ * transcript observer, Enter is retried only when Claude has durably recorded
+ * neither a direct user prompt nor a type-ahead enqueue.
  */
 export declare function injectViaTerminal(injector: TerminalInjector, text: string, opts?: InjectViaTerminalOptions): Promise<boolean>;

package/dist/claude/native-integration.js

@@ -22,6 +22,8 @@ import { parseTerminalCommand, parseTranscriptRecord, readSubagentEvents, subage
 import { jsonlCursorFingerprint, interactionLeaseUpdatedAt, readClaimedInteractionResult, readClaudeStatus, readForwardState, readInteractionAcksFrom, readHookEventsFrom, readInteractionRequestsFrom, readJsonlFrom, readMessageDeltasFrom, resetForwardState, removeClaimedInteractionResult, removeInteractionLease, removeInteractionResult, scrubClaudeInteractionArtifacts, writeInteractionResult, writeForwardState, } from "./native-bridge.js";
 import { boundInteractionRequest, redactInteractionResolution, validateInteractionResolution, } from "../interactions.js";
 const MAX_SETTLED_INTERACTIONS = 512;
+const MAX_MESSAGE_CORRELATION_BACKLOG = 64;
+const MAX_SUBMISSION_OBSERVATIONS = 64;
 const INTERACTION_ACK_TIMEOUT_MS = 5_000;
 const INTERACTION_LEASE_TIMEOUT_MS = 30_000;
 function processIsAlive(pid) {
@@ -45,6 +47,27 @@ function userStringContent(rec) {
         return undefined; // tool_result records are arrays
     return content.trim() || undefined;
 }
+function submissionText(value) {
+    if (typeof value !== "string")
+        return undefined;
+    return value.trim() || undefined;
+}
+const COMMAND_NAME_RE = /<command-name>([\s\S]*?)<\/command-name>/;
+const COMMAND_ARGS_RE = /<command-args>([\s\S]*?)<\/command-args>/;
+/** Claude persists slash commands as XML bookkeeping rather than as the text
+ * typed into the TUI. Keep the raw record (for literal XML prompts) and add the
+ * reconstructed command as a submission-confirmation alias. */
+function submissionCandidates(content) {
+    const candidates = [content];
+    const name = COMMAND_NAME_RE.exec(content)?.[1]?.trim();
+    if (!name)
+        return candidates;
+    const args = COMMAND_ARGS_RE.exec(content)?.[1]?.trim();
+    const command = args ? `${name} ${args}` : name;
+    if (!candidates.includes(command))
+        candidates.push(command);
+    return candidates;
+}
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -145,6 +168,17 @@ export class ClaudeLiveSession {
     stopPendingAt = null;
     /** Open tool-call ids (start seen, end not yet) — suppresses the idle backstop. */
     openToolIds = new Set();
+    /** Transcript-backed acknowledgements for web→TUI input. A direct idle
+     * submit is recorded as `promptSource:"typed"`; a submit while Claude is busy
+     * is recorded immediately as `queue-operation:enqueue` and only later
+     * promoted to `promptSource:"queued"`. The promotion is intentionally not a
+     * second acknowledgement. */
+    submissionSequence = 0;
+    submissionObservations = [];
+    /** Enqueued type-ahead inputs awaiting their eventual role:user promotion.
+     * Claude has used both `promptSource:"queued"` and `"sdk"` for that later
+     * record, so content correlation is the stable discriminator. */
+    pendingQueuedSubmissions = [];
     /** Blocking native questions/permissions. Their hook subprocess is still
      *  executing, so the Turn remains running and cannot be idle-closed. */
     pendingInteractions = new Map();
@@ -169,11 +203,16 @@ export class ClaudeLiveSession {
      *  a turn's usage on close. undefined until the statusLine hook first fires. */
     latestStatus;
     deltasOffset = 0;
-    /** MessageDisplay message ids in first-seen order, FIFO-mapped onto the
+    /** Finalized MessageDisplay ids in completion order, FIFO-mapped onto the
      *  transcript's assistant-text records so a streamed message and its final
      *  item share an itemId (message_id is absent from the transcript). */
     messageIdQueue = [];
-    seenMessageIds = new Set();
+    finalizedMessageIds = new Set();
+    /** Transcript messages that arrived before their MessageDisplay stream. A
+     *  matching late final consumes both sides so its id cannot shift the FIFO
+     *  used by the next assistant message. */
+    unmatchedTranscriptMessages = [];
+    streamedMessageText = new Map();
     constructor(opts) {
         this.bridgeDir = opts.bridgeDir;
         this.sink = opts.sink;
@@ -231,6 +270,48 @@ export class ClaudeLiveSession {
     isReady() {
         return this.transcriptPath !== undefined;
     }
+    /** Drain records that predate a new injection, then return a monotonic
+     * checkpoint. This prevents a lagging, older identical prompt from
+     * acknowledging the new submit. */
+    beginSubmissionObservation() {
+        this.pollTranscript();
+        return this.submissionSequence;
+    }
+    /** Whether Claude durably accepted `text` after `checkpoint`. Polling the
+     * transcript here makes submit confirmation independent of the background
+     * forwarder interval and covers both idle and type-ahead submissions. */
+    hasObservedSubmissionAfter(checkpoint, text) {
+        this.pollTranscript();
+        const expected = submissionText(text);
+        return expected !== undefined && this.submissionObservations.some((observation) => observation.sequence > checkpoint && observation.text === expected);
+    }
+    rememberSubmission(value) {
+        const text = submissionText(value);
+        if (!text)
+            return;
+        this.submissionSequence += 1;
+        this.submissionObservations.push({ sequence: this.submissionSequence, text });
+        if (this.submissionObservations.length > MAX_SUBMISSION_OBSERVATIONS) {
+            this.submissionObservations.shift();
+        }
+    }
+    rememberQueuedSubmission(value) {
+        const text = submissionText(value);
+        if (!text)
+            return;
+        this.rememberSubmission(text);
+        this.pendingQueuedSubmissions.push(text);
+        if (this.pendingQueuedSubmissions.length > MAX_SUBMISSION_OBSERVATIONS) {
+            this.pendingQueuedSubmissions.shift();
+        }
+    }
+    consumeQueuedPromotion(text) {
+        const index = this.pendingQueuedSubmissions.indexOf(text);
+        if (index < 0)
+            return false;
+        this.pendingQueuedSubmissions.splice(index, 1);
+        return true;
+    }
     start() {
         if (this.started)
             return;
@@ -266,12 +347,13 @@ export class ClaudeLiveSession {
     /** One poll cycle (hooks → transcript → idle backstop). Exposed for tests to
      *  drive deterministically; the async {@link loop} just calls it on an interval. */
     tick() {
-        // Order matters: pollDeltas PUSHes a message_id onto the FIFO queue before
-        // pollTranscript SHIFTs it for the final item — else a same-tick delta+record
-        // (claude flushing a short message as one chunk) would miss the correlation.
+        // Read the transcript first so a user record opens its Turn before any
+        // same-tick MessageDisplay chunks are handled. The correlation layer
+        // supports either completion order; this also lets pollDeltas safely drain
+        // late chunks while no Turn is open instead of leaking them into the next.
         this.pollHooks();
-        this.pollDeltas();
         this.pollTranscript();
+        this.pollDeltas();
         this.pollInteractions();
         this.drainInteractionCommits();
         this.pollAbandonedInteractions();
@@ -369,6 +451,11 @@ export class ClaudeLiveSession {
             }
             return;
         }
+        // Drain the old transcript before a SessionStart switches paths so a slash
+        // command recorded immediately before /clear or /fork can still
+        // acknowledge the web submission.
+        if (ev.transcriptPath !== this.transcriptPath)
+            this.pollTranscript();
         // Same session id (a plain re-announce) → nothing to do.
         if (!ev.sessionId || ev.sessionId === this.currentClaudeSessionId)
             return;
@@ -396,8 +483,8 @@ export class ClaudeLiveSession {
         this.transcriptOffset = atEof ? fileSize(newPath) : 0;
         this.seenSubagents.clear();
         this.todos.clear();
-        this.seenMessageIds.clear();
-        this.messageIdQueue.length = 0;
+        this.pendingQueuedSubmissions.length = 0;
+        this.resetMessageCorrelation();
         this.latestStatus = undefined;
         // Fresh transcript → drop the old cursor + seen ids (a new session has fresh
         // record uuids, so no collision); the next poll seeds a new forwarder state.
@@ -689,6 +776,25 @@ export class ClaudeLiveSession {
     handleRecord(rec) {
         if (rec.isSidechain === true)
             return; // sub-agent turns (Phase 9 forwards them)
+        if (rec.isMeta === true)
+            return; // Claude-generated UI metadata, not a human message
+        // Type-ahead is acknowledged at enqueue time. Its later
+        // `promptSource:"queued"` user record must not count again: another
+        // identical web message may already be awaiting its own acknowledgement.
+        if (rec.type === "queue-operation") {
+            if (rec.operation === "enqueue")
+                this.rememberQueuedSubmission(rec.content);
+            // `dequeue` has no content and is followed by the promoted user record,
+            // so it must retain the correlation. `remove(content)` is cancellation:
+            // remove exactly one matching pending entry so a later identical prompt
+            // cannot be mistaken for that cancelled promotion.
+            else if (rec.operation === "remove") {
+                const removed = submissionText(rec.content);
+                if (removed)
+                    this.consumeQueuedPromotion(removed);
+            }
+            return;
+        }
         // Secondary dedup: skip a record whose source id was already forwarded (a
         // re-read after a fingerprint reset). rynx emits a record's items atomically,
         // so the record uuid is the source key (vs reference implementation's per-block key for its
@@ -701,6 +807,19 @@ export class ClaudeLiveSession {
         }
         const content = userStringContent(rec);
         if (content !== undefined) {
+            const candidates = submissionCandidates(content);
+            const queuedPromotion = rec.promptSource !== "typed" &&
+                candidates.some((candidate) => this.consumeQueuedPromotion(candidate));
+            // Submission acknowledgement is independent of UI classification. A
+            // legitimate web prompt can begin with "<" (for example HTML) even
+            // though the mirror below treats provider-generated XML markers as
+            // bookkeeping. Exact content + checkpoint matching keeps this safe.
+            if (!queuedPromotion &&
+                rec.promptSource !== "queued" &&
+                rec.promptSource !== "sdk") {
+                for (const candidate of candidates)
+                    this.rememberSubmission(candidate);
+            }
             // A local `!` command records its input+output as `<bash-*>` markers — mirror
             // it as a self-contained terminal_command turn (before the prompt check, as
             // it too is `<`-prefixed).
@@ -801,24 +920,43 @@ export class ClaudeLiveSession {
      *  events. Guarded on an open turn — deltas belong to the turn the user record
      *  opened; the offset advances only once processed. */
     pollDeltas() {
-        if (!this.turnOpen)
-            return;
         const { deltas, nextOffset } = readMessageDeltasFrom(this.bridgeDir, this.deltasOffset);
         this.deltasOffset = nextOffset;
+        // MessageDisplay has no Turn id. Chunks observed while idle belong to the
+        // Turn that just closed and must never be replayed into a later Turn.
+        if (!this.turnOpen)
+            return;
         for (const d of deltas) {
-            if (!this.seenMessageIds.has(d.messageId)) {
-                this.seenMessageIds.add(d.messageId);
-                this.messageIdQueue.push(d.messageId);
-            }
+            this.streamedMessageText.set(d.messageId, (this.streamedMessageText.get(d.messageId) ?? "") + d.delta);
             this.sink.onEvent({
                 type: "token",
                 text: d.delta,
-                metadata: { itemId: d.messageId, dedupeAgainstCompleted: true },
+                metadata: {
+                    itemId: d.messageId,
+                    dedupeAgainstCompleted: true,
+                    final: d.final,
+                },
             });
+            if (d.final && !this.finalizedMessageIds.has(d.messageId)) {
+                this.finalizedMessageIds.add(d.messageId);
+                this.finalizeMessageDisplay(d.messageId);
+            }
         }
         if (deltas.length)
             this.lastActivityAt = this.now();
     }
+    finalizeMessageDisplay(messageId) {
+        const text = this.streamedMessageText.get(messageId);
+        this.streamedMessageText.delete(messageId);
+        if (text === undefined)
+            return;
+        const transcriptIndex = this.unmatchedTranscriptMessages.indexOf(text);
+        if (transcriptIndex >= 0) {
+            this.unmatchedTranscriptMessages.splice(transcriptIndex, 1);
+            return;
+        }
+        this.messageIdQueue.push(messageId);
+    }
     /** Refresh the latest statusLine context/cost snapshot (a last-writer-wins file
      *  the statusLine hook overwrites on every TUI render). */
     pollStatus() {
@@ -854,12 +992,19 @@ export class ClaudeLiveSession {
     }
     /** Remap an assistant-text `message_completed` onto the FIFO-matched
      *  MessageDisplay message_id, so its streamed deltas and this final item share
-     *  an itemId. No queued delta (MessageDisplay didn't fire) → keep the transcript id. */
+     *  an itemId. No queued delta yet → keep the transcript id and remember its
+     *  text so a late MessageDisplay final can be reconciled backward. */
     remapMessageItem(event) {
         if (event.type !== "message_completed")
             return event;
         const messageId = this.messageIdQueue.shift();
-        return messageId ? { ...event, itemId: messageId } : event;
+        if (messageId)
+            return { ...event, itemId: messageId };
+        this.unmatchedTranscriptMessages.push(event.text);
+        if (this.unmatchedTranscriptMessages.length > MAX_MESSAGE_CORRELATION_BACKLOG) {
+            this.unmatchedTranscriptMessages.shift();
+        }
+        return event;
     }
     trackTool(event) {
         if (event.type !== "tool")
@@ -929,6 +1074,7 @@ export class ClaudeLiveSession {
         this.openToolIds.clear();
         this.stopSignalPending = false;
         this.stopPendingAt = null;
+        this.resetMessageCorrelation();
         this.sink.onTurnEnd(this.statusUsage());
     }
     closeTurnError(error) {
@@ -942,8 +1088,15 @@ export class ClaudeLiveSession {
         this.openToolIds.clear();
         this.stopSignalPending = false;
         this.stopPendingAt = null;
+        this.resetMessageCorrelation();
         this.sink.onTurnError(error);
     }
+    resetMessageCorrelation() {
+        this.finalizedMessageIds.clear();
+        this.messageIdQueue.length = 0;
+        this.unmatchedTranscriptMessages.length = 0;
+        this.streamedMessageText.clear();
+    }
     maybeIdleClose() {
         if (!this.turnOpen ||
             this.openToolIds.size > 0 ||
@@ -964,20 +1117,15 @@ export class ClaudeLiveSession {
 }
 /** Claude Code renders this glyph once the input box is mounted (ready-gate). */
 const CLAUDE_PROMPT_GLYPH = "❯";
-const DRAFT_NEEDLE_MAX = 24;
-function submitNeedle(text) {
-    return (text.split("\n")[0] ?? "").slice(0, DRAFT_NEEDLE_MAX);
-}
-/** Whether the pasted draft is visibly sitting in the input box (the last line
- *  carrying the prompt glyph). Mirrors reference implementation's `_draft_in_input_box`. */
-function draftInBox(pane, glyph, needle) {
-    const glyphLines = pane.split("\n").filter((l) => l.includes(glyph));
-    if (glyphLines.length === 0)
-        return false;
-    const tail = glyphLines[glyphLines.length - 1].split(glyph).pop() ?? "";
-    if (tail.includes("[Pasted text"))
-        return true; // claude's large-paste placeholder
-    return needle.length > 0 && tail.includes(needle);
+const CLAUDE_PROMPT_SCAN_TAIL_LINES = 5;
+/** The live composer sits at the bottom of the pane. Restricting readiness to
+ * its trailing non-empty lines prevents an old prompt glyph in scrollback from
+ * accepting input while Claude is still booting or showing another screen. */
+function claudePromptRendered(pane, glyph) {
+    const nonEmpty = pane.split(/\r?\n/).filter((line) => line.trim());
+    return nonEmpty
+        .slice(-CLAUDE_PROMPT_SCAN_TAIL_LINES)
+        .some((line) => line.includes(glyph));
 }
 async function pollUntil(pred, timeoutMs, pollMs, now, sleep, signal) {
     const deadline = now() + timeoutMs;
@@ -992,14 +1140,14 @@ async function pollUntil(pred, timeoutMs, pollMs, now, sleep, signal) {
 }
 /**
  * Deliver `text` into a claude TUI pane, the reference implementation recipe:
- *   ready-gate (poll for `❯`) → clear leftover → bracketed paste (+ trailing
- *   newline) → wait for the draft to land → settle → submit Enter → verify the
- *   draft left the box (re-send Enter while it hasn't).
+ *   ready-gate (poll for `❯`) → clear leftover → bracketed paste the draft
+ *   → settle → submit Enter → confirm from Claude's transcript.
  *
  * THROWS if the prompt never appears within the ready-gate window (reference implementation
  * `_wait_for_claude_prompt_ready` RAISE) — a not-ready pane is a hard error the
- * caller reports, NOT a signal to fall through to a second output path. Returns
- * `true` once the message is submitted (best-effort even if submit-verify times out).
+ * caller reports, NOT a signal to fall through to a second output path. With a
+ * transcript observer, Enter is retried only when Claude has durably recorded
+ * neither a direct user prompt nor a type-ahead enqueue.
  */
 export async function injectViaTerminal(injector, text, opts = {}) {
     const glyph = opts.promptGlyph ?? CLAUDE_PROMPT_GLYPH;
@@ -1018,39 +1166,43 @@ export async function injectViaTerminal(injector, text, opts = {}) {
     };
     // 1. Ready-gate. No prompt within the window → THROW (reference implementation RAISE): a
     //    not-ready pane is a hard error, never a fall-through-to-run signal.
-    const ready = await pollUntil(() => injector.capturePane().includes(glyph), opts.promptTimeoutMs ?? 20_000, pollMs, now, sleep, signal);
+    const ready = await pollUntil(() => claudePromptRendered(injector.capturePane(), glyph), opts.promptTimeoutMs ?? 20_000, pollMs, now, sleep, signal);
     if (cancelled())
         return false;
     if (!ready) {
         const tail = injector.capturePane().split("\n").slice(-5).join("\n");
         throw new Error(`claude prompt not ready (no "${glyph}" within timeout)\npane tail:\n${tail}`);
     }
-    // 2. Clear leftover, then bracketed-paste the draft (+\n absorbs a trailing "\").
+    // 2. Clear leftover, then bracketed-paste the draft. A final "\" is Claude's
+    // documented soft-newline escape: a bare submit Enter would consume it and
+    // mutate/strand the message. Only that edge gets one sentinel newline inside
+    // the bracketed paste; normal messages must not gain an empty input row.
     injector.clearInputLine();
-    injector.paste(`${text}\n`);
-    // 3. Wait for the draft to visibly land, then a short settle.
-    const needle = submitNeedle(text);
-    const draftSeen = await pollUntil(() => draftInBox(injector.capturePane(), glyph, needle), opts.pasteCommitMs ?? 5_000, pollMs, now, sleep, signal);
-    await sleep(opts.settleMs ?? 100);
+    injector.paste(text.endsWith("\\") ? `${text}\n` : text);
+    // 3. `paste-buffer` returns after tmux wrote the bracketed-paste frame. Give
+    // Claude a short, fixed settle window before the separate submit key; screen
+    // text is not used as an acknowledgement because submitted prompts remain in
+    // scrollback and are indistinguishable from an editable draft.
+    await sleep(opts.settleMs ?? 500);
     if (cancelled())
         return false; // Stop pressed mid-paste → don't submit
-    // 4. Submit.
-    injector.sendEnter();
-    if (!draftSeen)
-        return true; // draft never identifiable → submit blind (reference implementation)
-    // 5. Verify the submit took; re-send Enter while the draft is still boxed.
-    const deadline = now() + (opts.submitVerifyMs ?? 10_000);
-    let lastEnter = now();
-    while (now() < deadline) {
-        if (cancelled())
-            return false; // Stop pressed → stop re-submitting, clear the box
-        await sleep(pollMs);
-        if (!draftInBox(injector.capturePane(), glyph, needle))
+    // 4. Submit. Without a transcript observer this remains a one-Enter
+    // best-effort operation. With one, a bounded retry handles an Enter swallowed
+    // by the TUI without ever consulting stale pane text. A direct prompt or
+    // queue enqueue ends the loop immediately.
+    const observed = opts.submissionObserved;
+    const attempts = observed
+        ? Math.max(1, Math.floor(opts.maxSubmitAttempts ?? 2))
+        : 1;
+    for (let attempt = 0; attempt < attempts; attempt += 1) {
+        injector.sendEnter();
+        if (!observed)
+            return true;
+        if (await pollUntil(observed, opts.submitConfirmMs ?? 2_000, pollMs, now, sleep, signal)) {
             return true;
-        if (now() - lastEnter >= (opts.submitRetryMs ?? 1_000)) {
-            injector.sendEnter();
-            lastEnter = now();
         }
+        if (cancelled())
+            return false;
     }
-    return true;
+    return false;
 }