@songsid/agend 2.1.11-beta.1 → 2.1.11-beta.3

package/dist/command-table.d.ts

@@ -0,0 +1,99 @@
+/**
+ * The command table: for every command AgEnD answers, WHERE it applies and WHO may use it.
+ *
+ * Before this there was no single place to look. A slash command's lock emoji was typed by hand into its
+ * description, its gate lived in whichever of two copied handlers dispatched it, and the same command had a
+ * different gate in a fleet channel, a ClassicBot channel and as typed text. The audit of #1148 found `/compact`
+ * labelled 🔒 and open to everyone, `/stop` open on Discord and admin-only on Telegram, `/save` judged by the wrong
+ * kind of admin — all of them the same mistake: the rule and the label were allowed to disagree.
+ *
+ * This file is pure data plus one pure function, so it can be read, and tested cell by cell, without a client.
+ *
+ * It sits BEHIND the door in src/slash-authz.ts and never in front of it. The door decides whether the caller may
+ * speak here at all (not a DM, an acceptable guild, the access policy of the channel's owner, fail closed). Only
+ * then does this ask whether the command applies in this kind of channel and which kind of admin it needs. It can
+ * therefore only narrow what the door let through; nothing here is a way around it.
+ *
+ * Levels
+ *  - anyone         whoever the door admitted (in a fleet channel: someone the access policy hears; in a ClassicBot
+ *                   channel: everyone, as for typed messages)
+ *  - channel-admin  the admin of the channel's own kind: in a fleet channel an explicit fleet admin, in a ClassicBot
+ *                   channel a fleet admin OR a ClassicBot admin (what `isModelAdmin` always meant)
+ *  - fleet-admin    an explicit entry in the INVOKING adapter's `allowed_users`; an empty list means nobody
+ *  - classic-admin  a ClassicBot admin only (`admin_users`)
+ *  - handler        the door has admitted the caller and the table asks nothing more: the command's own handler
+ *                   decides, because the rule is not one level. Only `/start` is like this — an allowlist that is a
+ *                   different list on each platform (see `start` below). A command with this level is not locked.
+ *
+ * Platforms: the table is read per platform. `scopes` is what the Discord slash dispatcher enforces; `telegram`, where
+ * present, holds the cells where Telegram's own handlers gate differently (they are not table-driven yet, and each
+ * override is pinned against the real handlers by tests/command-gates-by-platform.test.ts). The audit that produced
+ * this table once folded both platforms into one level per command and lost Telegram's side of it; a cell that holds
+ * for Discord is not thereby true for Telegram, and "most restrictive wins" is not a way to merge them.
+ *
+ * Scopes: `fleet` is an instance's own channel, `general` the General dispatcher (also a fleet channel, but some
+ * commands differ there), `classic` a ClassicBot channel, `none` a channel AgEnD has no agent in.
+ */
+export type CommandScope = "fleet" | "general" | "classic" | "none";
+export type CommandLevel = "anyone" | "channel-admin" | "fleet-admin" | "classic-admin" | "handler";
+export type Platform = "discord" | "telegram";
+/** A locale key, optionally with arguments (`cmd.admin_required` wants the command name). */
+export type Reply = readonly [key: string, ...args: string[]];
+/**
+ * One scope on one platform. `passthrough`: there is no handler for this command here — the typed text is not a
+ * command, it goes to the agent like any message (or, in a chat with no agent, is dropped). It is NOT a refusal and
+ * grants nothing; it exists so that "Telegram has no such command" is stated instead of being read off Discord's cell.
+ */
+export type PlatformRule = ScopeRule | {
+    readonly passthrough: true;
+};
+export type ScopeRule = {
+    readonly level: CommandLevel; /** For `handler`: what the handler checks, per platform. */
+    readonly note?: string;
+}
+/** The command does not apply in this kind of channel: say so, with this reply, and do nothing. */
+ | {
+    readonly refuse: Reply;
+};
+export interface CommandSpec {
+    readonly name: string;
+    /** Appears in the Discord slash menu. */
+    readonly slash: boolean;
+    /** What the Discord slash dispatcher enforces. */
+    readonly scopes: Readonly<Record<CommandScope, ScopeRule>>;
+    /** What Telegram's own handlers do, every scope written out (nothing is inherited from `scopes`). */
+    readonly telegram: Readonly<Record<CommandScope, PlatformRule>>;
+    /** Said when the caller is not at the required level. */
+    readonly denied: Reply;
+    /** Said instead of `denied` when a fleet-admin command is off because the adapter lists no admins at all. */
+    readonly disabled?: Reply;
+}
+export declare const COMMANDS: readonly CommandSpec[];
+export declare function commandSpec(name: string): CommandSpec | undefined;
+/** The rule for one scope on one platform: the Discord column for Discord, the Telegram column for Telegram. */
+export declare function ruleFor(spec: CommandSpec, scope: CommandScope, platform: "discord"): ScopeRule;
+export declare function ruleFor(spec: CommandSpec, scope: CommandScope, platform: Platform): PlatformRule;
+/** True when some scope the command applies in asks for more than `anyone` — what the lock emoji says. */
+export declare function isLocked(spec: CommandSpec): boolean;
+/** The prefix for a slash command's menu description: generated, never typed. Unknown names get none. */
+export declare function slashLock(name: string): string;
+export type FleetAdminState = "ok" | "disabled" | "denied";
+/** What the caller knows about the person; each is asked only if the command's level needs it. */
+export interface CommandChecks {
+    fleetAdmin(): FleetAdminState;
+    channelAdmin(): boolean;
+    classicAdmin(): boolean;
+}
+export type CommandDecision = {
+    allow: true;
+} | {
+    allow: false;
+    reply: Reply;
+};
+/** On Telegram a cell can also be "not a command here" (see `PlatformRule`): nothing to authorize, refuse or run. */
+export type PlatformDecision = CommandDecision | {
+    allow: false;
+    passthrough: true;
+};
+export declare function decideCommand(spec: CommandSpec, scope: CommandScope, checks: CommandChecks, platform?: "discord"): CommandDecision;
+export declare function decideCommand(spec: CommandSpec, scope: CommandScope, checks: CommandChecks, platform: Platform): PlatformDecision;

package/dist/command-table.js

@@ -0,0 +1,125 @@
+const SCOPES = ["fleet", "general", "classic", "none"];
+/** The same level everywhere. */
+const everywhere = (level) => ({ fleet: { level }, general: { level }, classic: { level }, none: { level } });
+/** An agent's own channel (fleet, General, ClassicBot): `level` there, `otherwise` anywhere else. */
+const inAgentChannels = (level, otherwise) => ({ fleet: { level }, general: { level }, classic: { level }, none: { refuse: otherwise } });
+/** ClassicBot channels only: `level` there, `otherwise` everywhere else. */
+const classicOnly = (level, otherwise) => ({ fleet: { refuse: otherwise }, general: { refuse: otherwise }, classic: { level }, none: { refuse: otherwise } });
+const NOT_AUTHORIZED = ["not_authorized"];
+const PERMISSION_DENIED = ["permission.denied"];
+const NO_AGENT = ["classic.no_agent"];
+const NO_AGENT_START = ["classic.no_agent_start"];
+/**
+ * The Telegram column, written out for EVERY scope of every command: a Telegram cell is never inherited from Discord,
+ * because most of them differ (a command can have no Telegram handler at all). Scopes are the same four: `general` is
+ * the General topic, `fleet` an instance's own topic, `classic` a registered ClassicBot chat (private, or a group
+ * addressed with `/cmd@bot`), `none` a chat with no agent (an unregistered group or private chat).
+ */
+const PASS = { passthrough: true };
+const ANYONE = { level: "anyone" };
+const FLEET_ADMIN = { level: "fleet-admin" };
+const CLASSIC_ADMIN = { level: "classic-admin" };
+const CHANNEL_ADMIN = { level: "channel-admin" };
+/** A chat with no agent: the command exists on Telegram and checks the caller, then finds nothing to act on — nobody gets it. */
+const NOBODY_NO_AGENT = { refuse: NO_AGENT };
+const NOBODY_NO_AGENT_START = { refuse: NO_AGENT_START };
+const HANDLER = { level: "handler", note: "Telegram private: user allowlist. Telegram group: group allowlist + ClassicBot admin." };
+const tg = (general, fleet, classic, none = PASS) => ({ general, fleet, classic, none });
+/** Only the General topic has a handler: everywhere else the typed text is an ordinary message to the agent. */
+const tgGeneralOnly = (general) => tg(general, PASS, PASS);
+export const COMMANDS = [
+    // ── ClassicBot lifecycle ──
+    {
+        name: "start", slash: true, denied: NOT_AUTHORIZED,
+        // Not one level. Discord: the guild allowlist (`isGuildAllowed`) and nothing else — no admin. Telegram private chat:
+        // `isUserAllowed`. Telegram group: `isGroupAllowed` AND a ClassicBot admin. The handler enforces each (the table
+        // only says where it applies), so the single word "anyone" that stood here was wrong for Telegram groups.
+        scopes: {
+            fleet: { refuse: ["classic.topic_bound"] }, general: { refuse: ["classic.topic_bound"] }, classic: { refuse: ["classic.already_active"] },
+            none: { level: "handler", note: "Discord: guild allowlist. Telegram private: user allowlist. Telegram group: group allowlist + ClassicBot admin." },
+        },
+        telegram: tg(PASS, PASS, HANDLER, HANDLER),
+    },
+    // A ClassicBot admin on both platforms. Telegram always required one; Discord used to require nothing ("the guild
+    // allowlist is the trust boundary"), then briefly a channel admin, which let a fleet admin stop a channel Telegram
+    // would not have let them stop.
+    { name: "stop", slash: true, denied: ["classic.admin_only_stop"], scopes: classicOnly("classic-admin", NO_AGENT), telegram: tg(PASS, PASS, CLASSIC_ADMIN, NOBODY_NO_AGENT) },
+    { name: "chat", slash: true, denied: NOT_AUTHORIZED, scopes: classicOnly("anyone", NO_AGENT_START), telegram: tg(PASS, PASS, ANYONE) },
+    // Discord only: on Telegram `/load` is not a command (the text goes to the agent).
+    { name: "load", slash: true, denied: ["admin.required"], scopes: classicOnly("classic-admin", NO_AGENT_START), telegram: tg(PASS, PASS, PASS) },
+    // ── Per-agent controls ──
+    // Telegram's ClassicBot handler asks `isAdmin` (a ClassicBot admin only; a fleet admin alone is refused), where Discord
+    // asks `isModelAdmin` (a fleet admin or a ClassicBot admin).
+    { name: "pause", slash: true, denied: PERMISSION_DENIED, scopes: inAgentChannels("channel-admin", NO_AGENT), telegram: tg(FLEET_ADMIN, FLEET_ADMIN, CLASSIC_ADMIN, NOBODY_NO_AGENT_START) },
+    { name: "wake", slash: true, denied: PERMISSION_DENIED, scopes: inAgentChannels("channel-admin", NO_AGENT), telegram: tg(FLEET_ADMIN, FLEET_ADMIN, CLASSIC_ADMIN, NOBODY_NO_AGENT_START) },
+    // Discord had no check at all (the 🔒 was only a label). Telegram: a ClassicBot admin in a ClassicBot chat, and NO
+    // check in a fleet topic.
+    { name: "compact", slash: true, denied: ["cmd.admin_required", "/compact"], scopes: inAgentChannels("channel-admin", NO_AGENT), telegram: tg(ANYONE, ANYONE, CLASSIC_ADMIN, NOBODY_NO_AGENT_START) },
+    { name: "clear", slash: true, denied: PERMISSION_DENIED, scopes: inAgentChannels("channel-admin", NO_AGENT), telegram: tg(FLEET_ADMIN, FLEET_ADMIN, CHANNEL_ADMIN, NOBODY_NO_AGENT_START) },
+    { name: "model", slash: true, denied: PERMISSION_DENIED, scopes: inAgentChannels("channel-admin", NO_AGENT), telegram: tg(FLEET_ADMIN, FLEET_ADMIN, CHANNEL_ADMIN, NOBODY_NO_AGENT_START) },
+    // Telegram has no ClassicBot /effort handler (the text goes to the agent).
+    { name: "effort", slash: true, denied: PERMISSION_DENIED, scopes: inAgentChannels("channel-admin", NO_AGENT), telegram: tg(FLEET_ADMIN, FLEET_ADMIN, PASS) },
+    // Telegram's typed /collab has no check in a fleet topic and no handler in a ClassicBot chat (the text goes to the agent).
+    { name: "collab", slash: true, denied: NOT_AUTHORIZED, scopes: inAgentChannels("channel-admin", NO_AGENT_START), telegram: tg(ANYONE, ANYONE, PASS) },
+    // Telegram: a ClassicBot admin in a ClassicBot chat, no check in a fleet topic (same as /compact).
+    { name: "save", slash: true, denied: ["admin.required"], scopes: inAgentChannels("channel-admin", NO_AGENT_START), telegram: tg(ANYONE, ANYONE, CLASSIC_ADMIN, NOBODY_NO_AGENT_START) },
+    // Anyone who can talk to the agent may talk to it mid-turn, ask a side question, interrupt it or read its context.
+    { name: "steer", slash: true, denied: NOT_AUTHORIZED, scopes: inAgentChannels("anyone", NO_AGENT), telegram: tg(ANYONE, ANYONE, ANYONE, NOBODY_NO_AGENT_START) },
+    { name: "btw", slash: true, denied: NOT_AUTHORIZED, scopes: inAgentChannels("anyone", NO_AGENT), telegram: tg(ANYONE, ANYONE, ANYONE, NOBODY_NO_AGENT_START) },
+    { name: "cancel", slash: true, denied: NOT_AUTHORIZED, scopes: inAgentChannels("anyone", NO_AGENT), telegram: tg(ANYONE, ANYONE, ANYONE, NOBODY_NO_AGENT_START) },
+    { name: "ctx", slash: true, denied: NOT_AUTHORIZED, scopes: inAgentChannels("anyone", NO_AGENT), telegram: tg(ANYONE, ANYONE, ANYONE, NOBODY_NO_AGENT_START) },
+    // ── The fleet, from anywhere ── (on Telegram: only the General topic has these handlers)
+    { name: "status", slash: true, denied: ["cmd.admin_required", "/status"], scopes: everywhere("fleet-admin"), telegram: tgGeneralOnly(FLEET_ADMIN) },
+    { name: "restart", slash: true, denied: NOT_AUTHORIZED, scopes: everywhere("fleet-admin"), telegram: tgGeneralOnly(FLEET_ADMIN) },
+    { name: "login", slash: true, denied: PERMISSION_DENIED, scopes: everywhere("fleet-admin"), telegram: tgGeneralOnly(FLEET_ADMIN) },
+    { name: "update", slash: true, denied: NOT_AUTHORIZED, disabled: ["update.disabled"], scopes: everywhere("fleet-admin"), telegram: tgGeneralOnly(FLEET_ADMIN) },
+    { name: "doctor", slash: true, denied: NOT_AUTHORIZED, scopes: everywhere("fleet-admin"), telegram: tgGeneralOnly(FLEET_ADMIN) },
+    { name: "dashboard", slash: true, denied: NOT_AUTHORIZED, disabled: ["dashboard.disabled"], scopes: everywhere("fleet-admin"), telegram: tgGeneralOnly(FLEET_ADMIN) },
+    // Informational. `/tips on|off|advanced on` change settings and are gated by the handler on that argument.
+    { name: "sysinfo", slash: true, denied: NOT_AUTHORIZED, scopes: everywhere("anyone"), telegram: tgGeneralOnly(ANYONE) },
+    { name: "usage", slash: true, denied: NOT_AUTHORIZED, scopes: everywhere("anyone"), telegram: tgGeneralOnly(ANYONE) },
+    // On Telegram it also works in an instance's topic.
+    { name: "tips", slash: true, denied: PERMISSION_DENIED, scopes: everywhere("anyone"), telegram: tg(ANYONE, ANYONE, PASS) },
+];
+const BY_NAME = new Map(COMMANDS.map(spec => [spec.name, spec]));
+export function commandSpec(name) {
+    return BY_NAME.get(name);
+}
+export function ruleFor(spec, scope, platform) {
+    return platform === "telegram" ? spec.telegram[scope] : spec.scopes[scope];
+}
+/** True when some scope the command applies in asks for more than `anyone` — what the lock emoji says. */
+export function isLocked(spec) {
+    return SCOPES.some(scope => {
+        const rule = spec.scopes[scope];
+        return "level" in rule && rule.level !== "anyone" && rule.level !== "handler";
+    });
+}
+/** The prefix for a slash command's menu description: generated, never typed. Unknown names get none. */
+export function slashLock(name) {
+    const spec = BY_NAME.get(name);
+    return spec && isLocked(spec) ? "🔒 " : "";
+}
+export function decideCommand(spec, scope, checks, platform = "discord") {
+    const rule = ruleFor(spec, scope, platform);
+    if ("passthrough" in rule)
+        return { allow: false, passthrough: true };
+    if ("refuse" in rule)
+        return { allow: false, reply: rule.refuse };
+    switch (rule.level) {
+        case "anyone":
+        case "handler":
+            return { allow: true };
+        case "channel-admin":
+            return checks.channelAdmin() ? { allow: true } : { allow: false, reply: spec.denied };
+        case "classic-admin":
+            return checks.classicAdmin() ? { allow: true } : { allow: false, reply: spec.denied };
+        case "fleet-admin": {
+            const state = checks.fleetAdmin();
+            if (state === "ok")
+                return { allow: true };
+            return { allow: false, reply: state === "disabled" && spec.disabled ? spec.disabled : spec.denied };
+        }
+    }
+}
+//# sourceMappingURL=command-table.js.map

package/dist/command-table.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-table.js","sourceRoot":"","sources":["../src/command-table.ts"],"names":[],"mappings":"AAqEA,MAAM,MAAM,GAA4B,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AAEhF,iCAAiC;AACjC,MAAM,UAAU,GAAG,CAAC,KAAmB,EAAyB,EAAE,CAChE,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;AAElF,qGAAqG;AACrG,MAAM,eAAe,GAAG,CAAC,KAAmB,EAAE,SAAgB,EAAyB,EAAE,CACvF,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;AAE9F,4EAA4E;AAC5E,MAAM,WAAW,GAAG,CAAC,KAAmB,EAAE,SAAgB,EAAyB,EAAE,CACnF,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;AAEtH,MAAM,cAAc,GAAU,CAAC,gBAAgB,CAAC,CAAC;AACjD,MAAM,iBAAiB,GAAU,CAAC,mBAAmB,CAAC,CAAC;AACvD,MAAM,QAAQ,GAAU,CAAC,kBAAkB,CAAC,CAAC;AAC7C,MAAM,cAAc,GAAU,CAAC,wBAAwB,CAAC,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,IAAI,GAAiB,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AACjD,MAAM,MAAM,GAAiB,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACjD,MAAM,WAAW,GAAiB,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;AAC3D,MAAM,aAAa,GAAiB,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;AAC/D,MAAM,aAAa,GAAiB,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;AAC/D,iIAAiI;AACjI,MAAM,eAAe,GAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC3D,MAAM,qBAAqB,GAAiB,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;AACvE,MAAM,OAAO,GAAiB,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,uFAAuF,EAAE,CAAC;AAClJ,MAAM,EAAE,GAAG,CAAC,OAAqB,EAAE,KAAmB,EAAE,OAAqB,EAAE,OAAqB,IAAI,EAA2B,EAAE,CACnI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AACtC,gHAAgH;AAChH,MAAM,aAAa,GAAG,CAAC,OAAqB,EAA2B,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAElG,MAAM,CAAC,MAAM,QAAQ,GAA2B;IAC9C,6BAA6B;IAC7B;QACE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc;QAClD,qHAAqH;QACrH,iHAAiH;QACjH,0GAA0G;QAC1G,MAAM,EAAE;YACN,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,qBAAqB,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,qBAAqB,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,wBAAwB,CAAC,EAAE;YACzI,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,iHAAiH,EAAE;SACpJ;QACD,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC;KAC3C;IACD,kHAAkH;IAClH,mHAAmH;IACnH,gCAAgC;IAChC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,yBAAyB,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,eAAe,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,eAAe,CAAC,EAAE;IAC5K,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,WAAW,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE;IACtI,mFAAmF;IACnF,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,eAAe,EAAE,cAAc,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;IAE/I,2BAA2B;IAC3B,wHAAwH;IACxH,6DAA6D;IAC7D,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,eAAe,CAAC,eAAe,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,qBAAqB,CAAC,EAAE;IAC3L,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,eAAe,CAAC,eAAe,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,qBAAqB,CAAC,EAAE;IAC1L,mHAAmH;IACnH,0BAA0B;IAC1B,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,oBAAoB,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,eAAe,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,qBAAqB,CAAC,EAAE;IACpM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,eAAe,CAAC,eAAe,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,qBAAqB,CAAC,EAAE;IAC3L,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,eAAe,CAAC,eAAe,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,qBAAqB,CAAC,EAAE;IAC3L,2EAA2E;IAC3E,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,eAAe,CAAC,eAAe,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE;IAC5J,2HAA2H;IAC3H,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,eAAe,CAAC,eAAe,EAAE,cAAc,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;IACrJ,mGAAmG;IACnG,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,eAAe,EAAE,cAAc,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,qBAAqB,CAAC,EAAE;IACvL,mHAAmH;IACnH,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,CAAC,EAAE;IAChK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,CAAC,EAAE;IAC9J,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,CAAC,EAAE;IACjK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,CAAC,EAAE;IAE9J,0FAA0F;IAC1F,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,oBAAoB,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,aAAa,CAAC,WAAW,CAAC,EAAE;IACnJ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,aAAa,CAAC,WAAW,CAAC,EAAE;IACjI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,UAAU,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,aAAa,CAAC,WAAW,CAAC,EAAE;IAClI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,aAAa,CAAC,WAAW,CAAC,EAAE;IAC/J,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,aAAa,CAAC,WAAW,CAAC,EAAE;IAChI,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,oBAAoB,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,aAAa,CAAC,WAAW,CAAC,EAAE;IACrK,2GAA2G;IAC3G,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE;IACvH,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE;IACrH,oDAAoD;IACpD,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;CAC3H,CAAC;AAEF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAEjE,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAKD,MAAM,UAAU,OAAO,CAAC,IAAiB,EAAE,KAAmB,EAAE,QAAkB;IAChF,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,QAAQ,CAAC,IAAiB;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,OAAO,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC;IAChF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7C,CAAC;AAiBD,MAAM,UAAU,aAAa,CAAC,IAAiB,EAAE,KAAmB,EAAE,MAAqB,EAAE,WAAqB,SAAS;IACzH,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC5C,IAAI,aAAa,IAAI,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACtE,IAAI,QAAQ,IAAI,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IAClE,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS;YACZ,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACzB,KAAK,eAAe;YAClB,OAAO,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QACxF,KAAK,eAAe;YAClB,OAAO,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QACxF,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YAClC,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YAC3C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,KAAK,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACtG,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/daemon.d.ts

@@ -474,6 +474,12 @@ export declare class Daemon extends EventEmitter {
     /** Identity of that dialog: its pattern, not its description (two tables may describe one screen differently). */
     private dialogParkedKey;
     private dialogParkedReported;
+    /**
+     * The runtime dialog the monitor is answering, and how many of its answers in a row did nothing (the dialog was
+     * still on screen right after the keys). Not the on-screen duration: a burst of FRESH prompts, each answered, has a
+     * dialog on screen at every poll and ignores nothing.
+     */
+    private dialogAnswers;
     /** Current stdin-owning runtime dialog, independent from execution state. */
     private inputBlockedDialogKey;
     /** Generation/signature fence for safety dialogs while their screen is still visible. */
@@ -699,6 +705,13 @@ export declare class Daemon extends EventEmitter {
     private mcpDeathDeferredForPid;
     /** Prevent in-flight monitor callbacks from re-arming after a pause. */
     private runtimeMonitorsFrozen;
+    /**
+     * Bumped by every stop / pause / startup abort (they all freeze the monitors). A launch that has to
+     * await something before it touches the pane (a backend's `prepareLaunch`) remembers the value it
+     * started under and gives up if it moved: a stopped instance must not get a window, a config or a
+     * token from a launch that was already in the air. A wake that STARTS after the freeze is unaffected.
+     */
+    private launchFenceEpoch;
     private errorWaitingForRecovery;
     private errorDetectedAt;
     private errorRecoveryDeadlineAt;
@@ -1325,6 +1338,29 @@ export declare class Daemon extends EventEmitter {
      * within a bound and then fail loudly.
      */
     private probeBlockingDialog;
+    /** What identifies the request on screen: the backend's own identity when it has one, else the whole screen verbatim. */
+    private static screenOf;
+    private static answerKey;
+    /**
+     * The episode being counted is over: its count and its report. Its parked clock ends too (`clearParked`) only when the
+     * dialog is gone or a different request is positively identified — not on a difference nobody can explain.
+     */
+    private endDialogEpisode;
+    /**
+     * A poll that did not complete an answer-and-look (lock busy, keys not sent, nothing to press) breaks "in a row" for
+     * this dialog; if the dialog on screen is a DIFFERENT one, the episode being counted belongs to a screen that is gone.
+     */
+    private breakAnswerStreak;
+    /**
+     * One answer of the runtime scanner to a dialog, and whether the SAME dialog (same kind, same content) was still
+     * on screen right after it.
+     * An answer that took ends the episode (what shows next is a new dialog, so the parked clock restarts too);
+     * DIALOG_ANSWER_IGNORED_MAX in a row that did not is reported ONCE per episode, for ANY backend's dialog —
+     * not only the ones that hold deliveries — so a human is told in about a quarter of a minute instead of the
+     * instance sitting there until a hang detector (and only with pending work) notices. The event carries the
+     * dialog's static description and a count, never the pane: a pane can hold anything the agent printed.
+     */
+    private noteDialogAnswer;
     /**
      * Remember how long a blocking dialog has been on screen. Once it has
      * outlived DIALOG_PARKED_NOTIFY_MS — the auto-dismiss did not take, or the

package/dist/daemon.js

@@ -447,6 +447,18 @@ const STARTUP_DIALOG_POLL_MS = 500;
 const STARTUP_DIALOG_BUDGET_MS = 30_000;
 /** A blocking dialog still on screen this long after first being seen is reported for a human. */
 const DIALOG_PARKED_NOTIFY_MS = 60_000;
+/** After a runtime dialog's keys, how long the pane gets to repaint before it is read again to see whether they took. */
+const DIALOG_ANSWER_SETTLE_MS = 300;
+/** Consecutive answers one runtime dialog ignored (still on screen right after the keys) before it is reported for a human. */
+const DIALOG_ANSWER_IGNORED_MAX = 3;
+/**
+ * Once a dialog has been reported as ignoring the answer, how long the scanner waits between answers to the SAME request.
+ * Not a stop: requests that merely look alike (several queued permission requests for one directory) cannot be told
+ * apart from an ignored answer, and each still needs its answer — they get it, slowly — while a dialog that really
+ * ignores the keys is pressed far less. A different request, the dialog going away, or a new spawn restores the
+ * normal pace (and a fresh count).
+ */
+const DIALOG_ANSWER_BACKOFF_MS = 30_000;
 /** How many "dialog painted just before the write → wait → retry" rounds a delivery tolerates. */
 const LATE_DIALOG_WRITE_ROUNDS = 3;
 /** How many times a delivery redoes itself when a spawn starts between its settle wait and its pane write. */
@@ -1024,6 +1036,12 @@ export class Daemon extends EventEmitter {
     /** Identity of that dialog: its pattern, not its description (two tables may describe one screen differently). */
     dialogParkedKey = null;
     dialogParkedReported = false;
+    /**
+     * The runtime dialog the monitor is answering, and how many of its answers in a row did nothing (the dialog was
+     * still on screen right after the keys). Not the on-screen duration: a burst of FRESH prompts, each answered, has a
+     * dialog on screen at every poll and ignores nothing.
+     */
+    dialogAnswers = null;
     /** Current stdin-owning runtime dialog, independent from execution state. */
     inputBlockedDialogKey = null;
     /** Generation/signature fence for safety dialogs while their screen is still visible. */
@@ -1260,6 +1278,13 @@ export class Daemon extends EventEmitter {
     mcpDeathDeferredForPid = null;
     /** Prevent in-flight monitor callbacks from re-arming after a pause. */
     runtimeMonitorsFrozen = false;
+    /**
+     * Bumped by every stop / pause / startup abort (they all freeze the monitors). A launch that has to
+     * await something before it touches the pane (a backend's `prepareLaunch`) remembers the value it
+     * started under and gives up if it moved: a stopped instance must not get a window, a config or a
+     * token from a launch that was already in the air. A wake that STARTS after the freeze is unaffected.
+     */
+    launchFenceEpoch = 0;
     errorWaitingForRecovery = false; // true = error detected, waiting for ready pattern
     errorDetectedAt = 0;
     errorRecoveryDeadlineAt = 0;
@@ -2654,7 +2679,7 @@ export class Daemon extends EventEmitter {
             return false;
         this.healthCheckPaused = true;
         this.logger.error({ reason: err.message }, "Not respawning: the installed CLI cannot run this instance as configured");
-        this.emitSupervisionEnded(err.message, "Install a CLI version that supports this instance's configuration, then start it again.");
+        this.emitSupervisionEnded(err.message, "Install a CLI version that supports this instance's configuration, then start it again.", undefined, "cli_unsupported");
         return true;
     }
     /**
@@ -2670,12 +2695,13 @@ export class Daemon extends EventEmitter {
      * `crash_loop` already had this treatment; this is the same bridge for the other
      * four, carrying a human-readable cause and the operator's next step.
      */
-    emitSupervisionEnded(reason, remedy, exitCode) {
+    emitSupervisionEnded(reason, remedy, exitCode, cause) {
         this.emit("supervision_ended", {
             name: this.name,
             reason,
             remedy,
             ...(exitCode !== undefined ? { exitCode } : {}),
+            ...(cause ? { cause } : {}),
         });
     }
     setProcessStatus(status) {
@@ -2725,11 +2751,18 @@ export class Daemon extends EventEmitter {
         this.errorMonitorTimer = setInterval(async () => {
             if (!this.tmux || this.spawning)
                 return;
+            // This poll belongs to the spawn and the monitors it started under. Every await below can outlive them (a stop,
+            // a pause, a respawn); a stale poll must not touch state a newer one owns, so it checks before committing.
+            const pollSpawn = this.spawnGeneration;
+            const pollFence = this.launchFenceEpoch;
+            const stale = () => pollSpawn !== this.spawnGeneration || pollFence !== this.launchFenceEpoch;
             try {
                 const alive = await this.tmux.isWindowAlive();
                 if (!alive)
                     return;
                 const pane = await this.tmux.capturePane();
+                if (stale())
+                    return;
                 const inputBlockedDialog = this.updateInputBlockedState(pane, dialogs);
                 // A sign-in screen that appears AFTER the startup scan ended (first run:
                 // theme → login can take longer than its budget) is the same auth
@@ -2769,6 +2802,7 @@ export class Daemon extends EventEmitter {
                 // on). Runtime table only: startup patterns are loose on purpose and
                 // must never send keys into an ordinary transcript.
                 let blockingSeen = null;
+                let answersBackedOff = false;
                 for (const dialog of dialogs) {
                     if (!Daemon.dialogMatches(dialog, pane))
                         continue;
@@ -2777,6 +2811,20 @@ export class Daemon extends EventEmitter {
                         blockingSeen = dialog;
                     if (dialog.holdOnly)
                         break; // recognised, deliberately not answered; trackDialogParked reports it
+                    // Reported as ignoring the daemon: the SAME request (the identity the count was made on — verbatim, the
+                    // backend's own when it names one) is answered only once per DIALOG_ANSWER_BACKOFF_MS. Anything else — another
+                    // request, an unexplained difference, the dialog gone — is not held back here; the answer path below ends or
+                    // keeps the episode by its own rules.
+                    const episode = this.dialogAnswers;
+                    // A wall clock that moved BACKWARDS since the last answer (NTP step, VM resume) gives a negative elapsed time:
+                    // the backoff has expired, not "not started" — held to it, the answers would stop until the clock caught up.
+                    const sinceLastAnswer = episode ? Date.now() - episode.lastAnswerAt : 0;
+                    if (episode?.reported && episode.key === Daemon.answerKey(dialog)
+                        && episode.screen === Daemon.screenOf(dialog, pane)
+                        && sinceLastAnswer >= 0 && sinceLastAnswer < DIALOG_ANSWER_BACKOFF_MS) {
+                        answersBackedOff = true;
+                        continue;
+                    }
                     const autoKey = dialog.autoResolutionKey;
                     if (dialog.verifyAfterKeys && autoKey
                         && this.autoResolvedDialogGeneration === this.spawnGeneration
@@ -2796,10 +2844,23 @@ export class Daemon extends EventEmitter {
                         // while a delivery was finishing. A stale danger menu must never
                         // receive a blind key sequence.
                         const currentPane = await this.tmux.capturePane();
+                        // Every await below can outlive the spawn / monitors this poll started under: after each one, before
+                        // any state is touched or any further key is sent, `stale()` (fixed at the poll's start) is asked again.
+                        if (stale())
+                            return;
                         if (!Daemon.dialogMatches(dialog, currentPane)) {
                             this.updateInputBlockedState(currentPane, dialogs);
+                            this.endDialogEpisode(); // somebody (or the CLI) already cleared it: that screen is over
                             return;
                         }
+                        // What is being answered: the request's identity when the backend can name it (verbatim, without whatever
+                        // ticks around it), else the whole screen.
+                        const before = Daemon.screenOf(dialog, currentPane);
+                        // Another request since the last answer: the count and the report belong to that one. Its parked clock goes
+                        // too only when the backend vouches for the identity — an unrecognised difference (a timer, a spinner) is
+                        // not evidence that the old request was answered, and the one-minute fallback must keep running.
+                        if (this.dialogAnswers?.key === Daemon.answerKey(dialog) && this.dialogAnswers.screen !== before)
+                            this.endDialogEpisode(dialog.requestIdentity !== undefined);
                         if (dialog.verifyAfterKeys && autoKey
                             && this.autoResolvedDialogGeneration === this.spawnGeneration
                             && this.autoResolvedDialogKey === autoKey)
@@ -2818,17 +2879,24 @@ export class Daemon extends EventEmitter {
                             else {
                                 sent = await this.tmux.pasteText(key, this.systemPasteOptions());
                             }
+                            if (stale())
+                                return;
                             if (!sent) {
                                 if (dialog.verifyAfterKeys && autoKey) {
                                     this.autoResolvedDialogGeneration = 0;
                                     this.autoResolvedDialogKey = null;
                                 }
+                                this.breakAnswerStreak(dialog);
                                 return;
                             }
                             await new Promise(r => setTimeout(r, 200));
+                            if (stale())
+                                return;
                         }
                         if (dialog.verifyAfterKeys) {
                             const afterKeysPane = await this.tmux.capturePane();
+                            if (stale())
+                                return;
                             const dialogStillActive = dialog.inputBlocked
                                 ? dialogs.some(candidate => candidate.inputBlocked && Daemon.dialogMatches(candidate, afterKeysPane))
                                 : Daemon.dialogMatches(dialog, afterKeysPane);
@@ -2844,8 +2912,27 @@ export class Daemon extends EventEmitter {
                                 resolved = true;
                             }
                         }
+                        else if (dialog.keys.length > 0) {
+                            // Did the keys take? Read the pane again. The same request still there is an answer that did nothing. A request
+                            // the backend names as DIFFERENT (the next queued one), or no dialog at all, means it took. Without a
+                            // backend-named identity any difference on the screen (a ticking timer) proves nothing either way: nothing
+                            // is reported and the parked clock is left alone. Two requests that look exactly alike cannot be told apart.
+                            await new Promise(r => setTimeout(r, DIALOG_ANSWER_SETTLE_MS));
+                            const afterPane = await this.tmux.capturePane();
+                            if (stale())
+                                return; // (nothing was touched since the last check: only a read)
+                            const stillThere = Daemon.dialogMatches(dialog, afterPane);
+                            const same = stillThere && Daemon.screenOf(dialog, afterPane) === before;
+                            this.noteDialogAnswer(dialog, same ? "ignored" : (!stillThere || dialog.requestIdentity) ? "took" : "unproven", before);
+                        }
+                        else {
+                            this.breakAnswerStreak(dialog);
+                        }
                     });
+                    if (stale())
+                        return; // the answer-and-look outlived its spawn / monitors: it commits nothing
                     if (!dismissed) {
+                        this.breakAnswerStreak(dialog);
                         this.logger.info({ dialog: dialog.description }, "Dialog dismissal deferred — pane write in flight");
                     }
                     else if (dialog.verifyAfterKeys && !resolved) {
@@ -2854,6 +2941,11 @@ export class Daemon extends EventEmitter {
                     this.trackDialogParked(blockingSeen);
                     return; // Dialog handled (or deliberately deferred): skip error checks this cycle
                 }
+                // Reached only when no dialog was answered this poll (none on screen, a fenced one, or one waiting out its
+                // backoff): unless it is the one backing off, the screen that was being answered is gone, and the next dialog is
+                // a new one.
+                if (!answersBackedOff)
+                    this.dialogAnswers = null;
                 this.trackDialogParked(blockingSeen);
                 if (blockingSeen)
                     return; // held dialog: skip error checks this cycle
@@ -4649,6 +4741,7 @@ export class Daemon extends EventEmitter {
     /** Stop every runtime poller/watcher while preserving IPC and daemon state. */
     freezeRuntimeMonitors() {
         this.runtimeMonitorsFrozen = true;
+        this.launchFenceEpoch++;
         if (this.healthCheckTimer) {
             clearTimeout(this.healthCheckTimer);
             this.healthCheckTimer = null;
@@ -5716,6 +5809,64 @@ export class Daemon extends EventEmitter {
         this.trackDialogParked(null);
         return { state: "clear" };
     }
+    /** What identifies the request on screen: the backend's own identity when it has one, else the whole screen verbatim. */
+    static screenOf(dialog, pane) {
+        return dialog.requestIdentity?.(pane) ?? pane;
+    }
+    static answerKey(dialog) {
+        return `${Daemon.dialogKey(dialog)}\0${dialog.description}`;
+    }
+    /**
+     * The episode being counted is over: its count and its report. Its parked clock ends too (`clearParked`) only when the
+     * dialog is gone or a different request is positively identified — not on a difference nobody can explain.
+     */
+    endDialogEpisode(clearParked = true) {
+        this.dialogAnswers = null;
+        if (clearParked)
+            this.trackDialogParked(null);
+    }
+    /**
+     * A poll that did not complete an answer-and-look (lock busy, keys not sent, nothing to press) breaks "in a row" for
+     * this dialog; if the dialog on screen is a DIFFERENT one, the episode being counted belongs to a screen that is gone.
+     */
+    breakAnswerStreak(dialog) {
+        if (!this.dialogAnswers)
+            return;
+        if (this.dialogAnswers.key === Daemon.answerKey(dialog))
+            this.dialogAnswers.ignored = 0;
+        else
+            this.endDialogEpisode();
+    }
+    /**
+     * One answer of the runtime scanner to a dialog, and whether the SAME dialog (same kind, same content) was still
+     * on screen right after it.
+     * An answer that took ends the episode (what shows next is a new dialog, so the parked clock restarts too);
+     * DIALOG_ANSWER_IGNORED_MAX in a row that did not is reported ONCE per episode, for ANY backend's dialog —
+     * not only the ones that hold deliveries — so a human is told in about a quarter of a minute instead of the
+     * instance sitting there until a hang detector (and only with pending work) notices. The event carries the
+     * dialog's static description and a count, never the pane: a pane can hold anything the agent printed.
+     */
+    noteDialogAnswer(dialog, outcome, screen) {
+        const key = Daemon.answerKey(dialog);
+        if (!this.dialogAnswers || this.dialogAnswers.key !== key)
+            this.dialogAnswers = { key, ignored: 0, reported: false, screen, lastAnswerAt: 0 }; // the exact screen being counted: every answer in the episode saw this same one
+        const episode = this.dialogAnswers;
+        if (outcome !== "ignored") {
+            this.endDialogEpisode(outcome === "took");
+            return;
+        }
+        episode.ignored++;
+        episode.lastAnswerAt = Date.now();
+        if (episode.ignored < DIALOG_ANSWER_IGNORED_MAX || episode.reported)
+            return;
+        episode.reported = true;
+        // The time-based "parked" report would say the same thing again a minute later.
+        if (this.dialogParkedKey === Daemon.dialogKey(dialog))
+            this.dialogParkedReported = true;
+        const holdsDeliveries = dialog.blocksDelivery === true || dialog.holdOnly === true;
+        this.logger.warn({ dialog: dialog.description, attempts: episode.ignored, holdsDeliveries }, "Runtime dialog is ignoring AgEnD's answer — reporting for a human");
+        this.emit("dialog_answer_ignored", { name: this.name, description: dialog.description, attempts: episode.ignored, holdsDeliveries });
+    }
     /**
      * Remember how long a blocking dialog has been on screen. Once it has
      * outlived DIALOG_PARKED_NOTIFY_MS — the auto-dismiss did not take, or the
@@ -7596,6 +7747,7 @@ export class Daemon extends EventEmitter {
      * into exactly the window this exists to close.
      */
     beginSpawn() {
+        this.dialogAnswers = null;
         // A relaunch settles any outstanding quit watch: the CLI came back.
         this.clearQuitRelaunchWatch();
         // A restarted CLI has no trustworthy turn edge for the process it replaced.
@@ -8171,6 +8323,7 @@ export class Daemon extends EventEmitter {
         catch { /* non-fatal */ }
     }
     async trySpawnInsideGate(reuseWindow = false, startupTimeoutMs) {
+        const launchFence = this.launchFenceEpoch;
         const backendConfig = this.buildBackendConfig();
         // Compare freshly-built instructions against the last value the agent was
         // told about. Computed for ALL backends (not gated by
@@ -8206,6 +8359,16 @@ export class Daemon extends EventEmitter {
                 this.pendingInstructionsUpdate = backendConfig.instructions;
             }
         }
+        // A backend that has to ask its CLI something before the launch command exists (OpenCode: does
+        // this binary take --auto?) does it here, off the event loop, bounded, and never fails the launch.
+        try {
+            await this.backend.prepareLaunch?.();
+        }
+        catch { /* unknown capability → the backend's conservative form */ }
+        // Thrown, not `false`: a false verdict reads as "the CLI failed to start" and sends the startup path
+        // into its resume-retry / set-the-session-aside handling, for an instance somebody just stopped.
+        if (launchFence !== this.launchFenceEpoch)
+            throw new Error("Launch cancelled: the instance was stopped or paused while the launch was being prepared");
         this.backend.writeConfig(backendConfig);
         this.backend.preTrust?.(this.config.working_directory);
         // Resolve working directory (e.g. symlink for hidden paths)