@songsid/agend 2.1.4-beta.3 → 2.1.4-beta.30

package/dist/daemon.js

@@ -8,6 +8,9 @@ import { mcpServerState } from "./mcp-liveness.js";
 import { clearPausedMarker, writePausedMarker } from "./pause-marker.js";
 import { TmuxManager, resolveTmuxLogicalSize } from "./tmux-manager.js";
 import { TranscriptMonitor } from "./transcript-monitor.js";
+import { createTranscriptSource } from "./transcript-sources.js";
+import { LOGIN_FLOWS } from "./login-flows.js";
+import { ProgressAccumulator, summarizeProgress } from "./tool-progress.js";
 import { ContextGuardian } from "./context-guardian.js";
 import { IpcServer } from "./channel/ipc-bridge.js";
 import { daemonBudgetMs } from "./channel/ipc-timeouts.js";
@@ -45,6 +48,10 @@ export function buildInstructionReloadNotice(binaryName, instanceName, instanceD
 export const DEFAULT_STUCK_TIMEOUT_MS = 10 * 60_000;
 export const DEFAULT_STATE_IDLE_DEBOUNCE_MS = 2_000;
 export const DEFAULT_STATE_SAFETY_SWEEP_MS = 60_000;
+/** Coalesce one cosmetic-redraw burst before comparing the visible pane. */
+export const PERIODIC_REDRAW_PROBE_MS = 25;
+/** A foreground server/port-forward should hand control back or be acknowledged. */
+export const DEFAULT_BLOCKING_PROCESS_GRACE_MS = 2 * 60_000;
 const LAST_INBOUND_FILE = "last-inbound-at";
 /** Minimum gap between "health check is failing" notifications for one instance. */
 const HEALTH_ERROR_NOTIFY_INTERVAL_MS = 10 * 60_000;
@@ -157,6 +164,11 @@ export class AutoPauseController {
     recordActivity(now = Date.now()) {
         this.lastActivityAt = now;
     }
+    /** Apply a new idle threshold and start a fresh countdown from this update. */
+    reconfigure(thresholdMs, now = Date.now()) {
+        this.thresholdMs = Math.max(0, thresholdMs);
+        this.lastActivityAt = now;
+    }
     observe(state, now = Date.now()) {
         if (this.pausedAt !== null || this.thresholdMs <= 0)
             return false;
@@ -279,9 +291,11 @@ export class PaneStateMachine {
      *   working" and a finished turn would not be seen as idle until the next 60s
      *   safety sweep. Output timestamps are the honest liveness signal here, and
      *   the caller has them.
+     * @param opts.forceBusy the backend has positively identified a still-running
+     *   foreground tool even though its TUI keeps an old ready footer visible.
      */
     observe(pane, now = Date.now(), opts = {}) {
-        const { settled = false, changeAt = now } = opts;
+        const { settled = false, changeAt = now, forceBusy = false } = opts;
         const paneHash = createHash("sha256").update(pane).digest("hex");
         const firstObservation = this.lastPaneHash === null;
         const paneChanged = this.lastPaneHash !== paneHash;
@@ -290,7 +304,10 @@ export class PaneStateMachine {
             this.lastPaneChangeAt = changeAt;
         }
         this.lastObservedAt = now;
-        const ready = this.isReady(pane);
+        // Some TUIs keep their ready footer visible while a foreground tool owns
+        // stdin. Backends can positively identify that tool from the pane; in that
+        // case the old prompt must not clear pending work or retire Cancel.
+        const ready = !forceBusy && this.isReady(pane);
         const nextState = firstObservation
             ? ready ? "idle" : "working"
             : paneChanged && !settled
@@ -591,6 +608,69 @@ export class InteractivePromptDetector {
         this.notifiedSignature = null;
     }
 }
+const BLOCKING_PROCESS_PATTERNS = [
+    // kubectl port-forward (including a backgrounded child whose inherited
+    // stdout keeps the parent shell tool open).
+    /^\s*(?:Forwarding from\s+(?:127\.0\.0\.1|localhost|\[::1\]):\d+\s+->\s+\d+|Handling connection for\s+\d+)\s*$/im,
+    // Common development servers. Keep these line-shaped and require an address
+    // or port so prose such as "the server is running" does not arm the detector.
+    /^\s*(?:(?:INFO:\s*)?Uvicorn running on|Serving HTTP on|Listening on|Server (?:is )?(?:listening|running) (?:at|on)|Application startup complete[^\n]*(?:port|https?:\/\/))[^\n]*(?:https?:\/\/|\b(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[::\]|port)\b)[^\n]*$/im,
+];
+/**
+ * Detect a foreground shell tool which has become a long-lived server.
+ *
+ * Unlike the generic pane-stuck clock, this clock deliberately survives new
+ * output: access logs and `Handling connection` lines are exactly why a
+ * foreground server can remain blocked forever without ever looking silent.
+ * Once a server marker is seen, the still-running tool identity is the stable
+ * signal; the marker may scroll out of the 32-row pane.
+ */
+export class BlockingProcessDetector {
+    graceMs;
+    activity = null;
+    evidence = null;
+    detectedAt = 0;
+    notified = false;
+    constructor(graceMs = DEFAULT_BLOCKING_PROCESS_GRACE_MS) {
+        this.graceMs = graceMs;
+    }
+    observe(pane, activity, now = Date.now()) {
+        const shellActivity = activity && /^(?:shell|bash|exec_command|terminal|command)(?::|$)/i.test(activity);
+        if (!shellActivity) {
+            this.reset();
+            return null;
+        }
+        if (activity !== this.activity) {
+            this.reset();
+            this.activity = activity;
+        }
+        if (!this.evidence) {
+            const tail = sanitizePaneTail(pane, 40).join("\n");
+            for (const pattern of BLOCKING_PROCESS_PATTERNS) {
+                const match = tail.match(pattern);
+                if (!match)
+                    continue;
+                this.evidence = match[0].trim().slice(0, 200);
+                this.detectedAt = now;
+                break;
+            }
+        }
+        if (!this.evidence || this.notified || now - this.detectedAt < this.graceMs)
+            return null;
+        this.notified = true;
+        return {
+            activity,
+            evidence: this.evidence,
+            blockedForMs: now - this.detectedAt,
+        };
+    }
+    reset() {
+        this.activity = null;
+        this.evidence = null;
+        this.detectedAt = 0;
+        this.notified = false;
+    }
+}
 export class Daemon extends EventEmitter {
     name;
     config;
@@ -655,6 +735,7 @@ export class Daemon extends EventEmitter {
     /** Fallback safety sweep used only when no shared tmux control client exists. */
     instanceStateMonitorTimer = null;
     instanceStateIdleTimer = null;
+    instanceStateOutputProbeTimer = null;
     instanceStateStuckTimer = null;
     instanceStateOutputListener = null;
     instanceStateOutputEventName = null;
@@ -665,6 +746,7 @@ export class Daemon extends EventEmitter {
     instanceStateReadyPattern = null;
     instanceStateBusyPattern = null;
     instanceStateMonitorActive = false;
+    sessionCheckpointWarningEmitted = false;
     statePollInFlight = false;
     // ── Dead-MCP proxy reply: per-turn evidence ─────────────────────────────
     // Set when an inbound message lands in the CLI; cleared on the idle edge that
@@ -684,6 +766,22 @@ export class Daemon extends EventEmitter {
      * would silently no-op exactly when we most need to stop feeding the CLI.
      */
     pausePending = false;
+    /**
+     * An auth failure was detected and nothing has resolved it yet.
+     *
+     * Separate from `pausePending` because it must outlive it: the deferred pause
+     * clears `pausePending` as soon as it fires, but if that pause is refused the
+     * instance is still auth-broken and must not resume raising alarms.
+     */
+    authFailureUnresolved = false;
+    /** One login-screen auth report per spawn — the screen persists across polls. */
+    loginScreenReported = false;
+    /**
+     * Let the next pause() proceed from a stuck pane. Set only for the auth-deferred
+     * pause — see the pausePending consumption site for why waiting for idle there
+     * is waiting forever.
+     */
+    pauseAllowStuck = false;
     pauseWakeState = "active";
     pauseWakeTransition = null;
     // Model failover: override model on next spawn when rate-limited
@@ -697,6 +795,12 @@ export class Daemon extends EventEmitter {
      *  and ⏳/👀/✅ reactions live here). It does NOT cover the other writers that
      *  reach the pane — {@link paneWriteLock} does. */
     pasteLock = Promise.resolve();
+    /**
+     * Fleet cancellation epoch. Queue entries retain the epoch they arrived with;
+     * advancing it invalidates only work received before the cancel, never a new
+     * user message which arrives immediately afterwards.
+     */
+    deliveryEpoch = 0;
     /** Mutual exclusion for *every* write into the pane, whichever subsystem it
      *  comes from. See PaneWriteLock for why interleaving is destructive. */
     paneWriteLock = new PaneWriteLock();
@@ -710,9 +814,21 @@ export class Daemon extends EventEmitter {
     lastBuiltInstructions = "";
     pasteQueueDepth = 0;
     firstDeliveryDelay = new FirstDeliveryDelay();
+    /** Orders /steer pastes against each other. Deliberately NOT pasteLock:
+     *  a steer must not queue behind the normal deliveries it exists to
+     *  overtake. Pane-level exclusion still comes from paneWriteLock inside
+     *  deliverMessage, so a steer and a normal delivery can never interleave
+     *  their PTY writes — the steer just doesn't wait for idle. */
+    steerLock = Promise.resolve();
+    /** Tool lines shown in the channel processing bubble for the current turn. */
+    turnProgress = new ProgressAccumulator();
+    lastProgressBroadcast = "";
+    progressBroadcastTimer = null;
+    lastProgressBroadcastAt = 0;
     // PTY error pattern monitoring
     errorMonitorTimer = null;
     interactivePromptDetector = new InteractivePromptDetector();
+    blockingProcessDetector = new BlockingProcessDetector();
     /** Same 5-min gate the error monitor uses, so a dead MCP server alerts once. */
     static MCP_DEATH_COOLDOWN_MS = 5 * 60_000;
     lastMcpDeathNotifiedAt = 0;
@@ -910,43 +1026,38 @@ export class Daemon extends EventEmitter {
                 // Fleet manager routed a message to us (topic mode)
                 const meta = msg.meta;
                 const targetSession = msg.targetSession;
+                const deliveryEpoch = this.captureDeliveryEpoch(msg.delivery_epoch);
                 void this.wake().then(() => {
-                    this.pushChannelMessage(msg.content, meta, targetSession);
+                    this.pushChannelMessage(msg.content, meta, targetSession, deliveryEpoch);
                 }).catch(err => {
                     this.logger.error({ err: err.message }, "Wake failed for inbound delivery");
                 });
             }
             else if (msg.type === "raw_paste") {
                 // Paste raw text directly to CLI without [user:] wrapping.
-                if (this.tmux) {
-                    const rawText = msg.content;
-                    this.pasteLock = this.pasteLock.then(async () => {
-                        await this.wake();
-                        await this.deliverMessage(rawText);
-                        this.logger.debug({ text: rawText.slice(0, 100) }, "Raw paste delivered");
-                    }).catch(err => {
-                        this.logger.warn({ err: err.message }, "raw_paste delivery error");
-                    });
-                }
+                this.queueRawPaste(msg.content, this.captureDeliveryEpoch(msg.delivery_epoch));
+            }
+            else if (msg.type === "config_update") {
+                this.applyConfigUpdate(msg.config);
+            }
+            else if (msg.type === "steer") {
+                const meta = (msg.meta ?? {});
+                this.steerMessage(msg.content, meta, this.captureDeliveryEpoch(msg.delivery_epoch));
+            }
+            else if (msg.type === "btw") {
+                const meta = (msg.meta ?? {});
+                this.btwMessage(msg.content, meta, this.captureDeliveryEpoch(msg.delivery_epoch));
             }
             else if (msg.type === "fleet_schedule_trigger") {
                 const payload = msg.payload;
                 const meta = msg.meta;
-                void this.wake().then(() => this.pushChannelMessage(payload.message, meta)).catch(err => {
+                const deliveryEpoch = this.captureDeliveryEpoch(msg.delivery_epoch);
+                void this.wake().then(() => this.pushChannelMessage(payload.message, meta, undefined, deliveryEpoch)).catch(err => {
                     this.logger.error({ err: err.message }, "Wake failed for scheduled delivery");
                 });
             }
             else if (msg.type === "query_instance_state") {
-                const snapshot = this.getInstanceStateSnapshot();
-                this.ipcServer?.send(socket, {
-                    type: "instance_state_response",
-                    requestId: msg.requestId,
-                    instanceName: this.name,
-                    ...snapshot,
-                    state: this.isPaused ? "paused" : snapshot.state,
-                    processStatus: this.processStatus,
-                    pausedAt: this.lastPausedAt,
-                });
+                void this.respondToInstanceStateQuery(msg, socket);
             }
         });
         // 2. Tmux — ensure session, create window if not alive
@@ -1032,8 +1143,11 @@ export class Daemon extends EventEmitter {
             const outputLog = join(this.instanceDir, "output.log");
             rotateLogIfNeeded(outputLog);
             await this.tmux.pipeOutput(outputLog).catch(() => { });
-            // 4. Transcript monitor
-            this.transcriptMonitor = new TranscriptMonitor(this.instanceDir, this.logger);
+            // 4. Transcript monitor. claude-code is handled inside the monitor
+            // (statusline transcript); codex/kiro/opencode read their CLI's own
+            // conversation store via a pluggable source. Backends with no known
+            // source stay inert exactly as before.
+            this.transcriptMonitor = new TranscriptMonitor(this.instanceDir, this.logger, createTranscriptSource(this.config.backend ?? "claude-code", this.config.working_directory));
             // 5. Wire transcript events
             const ackIfPending = () => {
                 if (!this.pendingAckMessage || !this.adapter)
@@ -1049,6 +1163,7 @@ export class Daemon extends EventEmitter {
                 this.recordRecentEvent({ type: "tool_use", name, preview: this.summarizeTool(name, input) });
                 this.recordRecentToolActivity(this.summarizeTool(name, input));
                 this.publishActivity(this.summarizeTool(name, input));
+                this.recordToolProgress(name, input);
             });
             this.transcriptMonitor.on("tool_result", (name, _output) => {
                 this.recordRecentEvent({ type: "tool_result", name });
@@ -1129,9 +1244,13 @@ export class Daemon extends EventEmitter {
             return;
         this.mcpDeathNotifiedForPid = status.pid;
         this.lastMcpDeathNotifiedAt = Date.now();
-        const autoRestart = this.config.mcp_auto_restart !== false;
-        this.logger.error({ pid: status.pid, autoRestart }, "MCP server process is gone — instance has no agend tools");
-        this.emit("mcp_died", { name: this.name, pid: status.pid, autoRestart });
+        // An auth-broken CLI cannot keep an MCP server alive, and restarting it
+        // only loops back to the sign-in screen — hold the auto-restart until a
+        // re-login (which restarts the instance and replaces this daemon anyway).
+        const authSuspected = this.authFailureUnresolved;
+        const autoRestart = this.config.mcp_auto_restart !== false && !authSuspected;
+        this.logger.error({ pid: status.pid, autoRestart, authSuspected }, "MCP server process is gone — instance has no agend tools");
+        this.emit("mcp_died", { name: this.name, pid: status.pid, autoRestart, authSuspected });
         if (autoRestart)
             this.armMcpRestartWhenIdle();
     }
@@ -1357,6 +1476,17 @@ export class Daemon extends EventEmitter {
                             catch (err) {
                                 this.logger.error({ err: err.message }, "Recovery from background session conflict failed");
                             }
+                            // Keep the loop alive: every health-check exit must either
+                            // scheduleNext() or deliberately set healthCheckPaused. This one
+                            // did neither, so a recovered instance ran UNMONITORED (while
+                            // isHealthCheckEffectivelyPaused still said monitoring was on)
+                            // until the next pause→wake cycle or fleet restart. The next tick
+                            // does the right thing in both outcomes: a healthy new window
+                            // passes the alive check, and a failed recovery hits the dead
+                            // window again with backgroundSessionRecoveryAttempted set — so
+                            // it falls through to the normal crash handling (crash counting,
+                            // backoff, supervision_ended when retries are exhausted).
+                            scheduleNext();
                             return; // Don't count as crash
                         }
                         // Already attempted recovery — fall through to normal crash handling
@@ -1573,6 +1703,25 @@ export class Daemon extends EventEmitter {
                     // A prompt is not an error and must not enter the PTY recovery gate.
                     // Continue scanning real errors in this same snapshot.
                 }
+                // If a backend can derive activity from this exact pane, trust its
+                // explicit null (tool completed) instead of falling back to a possibly
+                // stale transcript activity from the previous scan.
+                const paneActivity = this.backend?.getPaneActivity
+                    ? this.backend.getPaneActivity(pane)
+                    : this.currentActivity;
+                const hasPendingWork = this.pendingWork.hasPendingWork();
+                if (!hasPendingWork)
+                    this.blockingProcessDetector.reset();
+                const blockingProcess = hasPendingWork
+                    ? this.blockingProcessDetector.observe(pane, paneActivity, Date.now())
+                    : null;
+                if (blockingProcess) {
+                    // Reuse the hang-notification bridge: it offers explicit Restart/Wait
+                    // choices and, unlike pty_error, does not retire a still-useful Cancel
+                    // button merely because a foreground process owns stdin.
+                    this.logger.warn(blockingProcess, "Foreground process is blocking the agent input loop");
+                    this.hangDetector?.emit("hang", { unchangedForMs: blockingProcess.blockedForMs });
+                }
                 // Auto-dismiss runtime dialogs (e.g. Codex rate limit model switch)
                 for (const dialog of dialogs) {
                     if (!dialog.pattern.test(pane))
@@ -1645,6 +1794,7 @@ export class Daemon extends EventEmitter {
                     if (seen > 0)
                         this.lastErrorCount.set(Daemon.errorPatternKey(ep), seen);
                 }
+                this.authFailureUnresolved = false;
                 this.clearErrorRecoveryGate();
                 this.logger.info({ downtime_s: downtime }, "PTY error recovered — agent is ready again");
                 this.emit("pty_recovered", { name: this.name, downtime_s: downtime });
@@ -1706,6 +1856,11 @@ export class Daemon extends EventEmitter {
             if (ep.action === "failover")
                 this.lastFailoverAt = now;
             const message = this.resolveErrorMessage(pane, ep);
+            // Remember an auth failure for as long as it is unresolved. An auth-broken
+            // CLI cannot finish the turn it is holding, so every other detector in this
+            // scan would otherwise keep reporting the same dead instance forever.
+            if (ep.type === "auth_error")
+                this.authFailureUnresolved = true;
             this.logger.warn({ errorType: ep.type, action: ep.action }, `PTY error detected: ${message}`);
             this.emit("pty_error", { name: this.name, ...ep, message });
             break; // Only handle first unsuppressed new error per scan
@@ -1749,6 +1904,46 @@ export class Daemon extends EventEmitter {
         const cancelKey = this.backend?.getCancelKey() ?? "Escape";
         await this.tmux?.sendSpecialKey(cancelKey);
     }
+    /**
+     * Drop every not-yet-started pane delivery which predates a user cancel.
+     * Promise chains cannot be removed, so entries become generation-checked
+     * no-ops. An entry already past its check is allowed to finish its current PTY
+     * transaction; the interrupt key still cancels the CLI generation.
+     */
+    clearPendingDeliveries(fleetEpoch) {
+        this.deliveryEpoch = fleetEpoch === undefined
+            ? this.deliveryEpoch + 1
+            : Math.max(this.deliveryEpoch, fleetEpoch);
+        this.logger.info({ deliveryEpoch: this.deliveryEpoch }, "Pending delivery queue cleared by user cancel");
+    }
+    captureDeliveryEpoch(value) {
+        const epoch = typeof value === "number" && Number.isSafeInteger(value) && value >= 0
+            ? value
+            : this.deliveryEpoch;
+        if (epoch > this.deliveryEpoch)
+            this.deliveryEpoch = epoch;
+        return epoch;
+    }
+    isDeliveryEpochCurrent(epoch) {
+        return epoch === this.deliveryEpoch;
+    }
+    queueRawPaste(rawText, deliveryEpoch = this.deliveryEpoch) {
+        if (!this.tmux || !this.isDeliveryEpochCurrent(deliveryEpoch))
+            return;
+        this.pasteLock = this.pasteLock.then(async () => {
+            if (!this.isDeliveryEpochCurrent(deliveryEpoch)) {
+                this.logger.info("Pending raw delivery dropped by user cancel");
+                return;
+            }
+            await this.wake();
+            if (!this.isDeliveryEpochCurrent(deliveryEpoch))
+                return;
+            await this.deliverMessage(rawText, undefined, { deliveryEpoch });
+            this.logger.debug({ text: rawText.slice(0, 100) }, "Raw paste delivered");
+        }).catch(err => {
+            this.logger.warn({ err: err.message }, "raw_paste delivery error");
+        });
+    }
     /** Send the backend-specific graceful quit command/key sequence. */
     async sendQuitSequence() {
         if (!this.tmux || !this.backend)
@@ -1850,6 +2045,33 @@ export class Daemon extends EventEmitter {
             stateChangedAt: Date.now(),
         };
     }
+    /**
+     * Answer a FleetManager state query. Most callers only need the cached state,
+     * but lifecycle decisions such as post-reply Cancel retirement need an
+     * authoritative pane observation: after startup the last transition can stay
+     * "working" even though the CLI has since settled without emitting another
+     * control-mode output record.
+     */
+    async respondToInstanceStateQuery(msg, socket) {
+        try {
+            if (msg.refresh === true) {
+                await this.captureAndEvaluateInstanceState("state_query");
+            }
+            const snapshot = this.getInstanceStateSnapshot();
+            this.ipcServer?.send(socket, {
+                type: "instance_state_response",
+                requestId: msg.requestId,
+                instanceName: this.name,
+                ...snapshot,
+                state: this.isPaused ? "paused" : snapshot.state,
+                processStatus: this.processStatus,
+                pausedAt: this.lastPausedAt,
+            });
+        }
+        catch (err) {
+            this.logger.debug({ err: err.message }, "Instance state query failed");
+        }
+    }
     /** Gracefully stop the CLI while keeping its remain-on-exit tmux window. */
     /**
      * Mark the instance to pause as soon as its pane is idle. Used for auth
@@ -1869,7 +2091,14 @@ export class Daemon extends EventEmitter {
             if (this.getPauseWakeState() !== "active")
                 return;
         }
-        if (this.instanceState !== "idle" || this.pasteQueueDepth > 0) {
+        // `pauseAllowStuck` is consumed here, not merely read: it authorises exactly
+        // one pause from a stuck pane (the auth-deferred one) and must never leak
+        // into an ordinary idle-timeout pause of a busy instance.
+        const allowStuck = this.pauseAllowStuck;
+        this.pauseAllowStuck = false;
+        const pausableState = this.instanceState === "idle"
+            || (allowStuck && this.instanceState === "stuck");
+        if (!pausableState || this.pasteQueueDepth > 0) {
             this.pauseRequested = false;
             return;
         }
@@ -1933,6 +2162,8 @@ export class Daemon extends EventEmitter {
         // An explicit wake (e.g. after the user re-logs in) cancels a deferred
         // auth pause — otherwise the instance would pause again the moment it idles.
         this.pausePending = false;
+        this.authFailureUnresolved = false;
+        this.loginScreenReported = false;
         if (this.pauseWakeState === "active")
             return;
         if (this.pauseWakeState === "pausing")
@@ -1993,6 +2224,14 @@ export class Daemon extends EventEmitter {
     applyInstanceStateSnapshot(snapshot, pane) {
         const previous = this.instanceState;
         this.instanceState = snapshot.state;
+        // OpenCode creates its session lazily on the first submitted message.
+        // Waiting until stop/pause to persist that id loses resume state when the
+        // fleet is SIGKILLed or the host reboots.
+        // Idle observations are safe checkpoints; the 60s safety sweep also gives
+        // us a bounded retry if session creation produced no visible state edge.
+        if (snapshot.state === "idle" && this.backend?.binaryName === "opencode") {
+            this.saveSessionId();
+        }
         // Only a transition back to idle completes pending work. Repeated idle
         // observations between enqueue and paste must not clear a newer inbound.
         if (snapshot.state === "idle" && previous !== "idle") {
@@ -2001,6 +2240,7 @@ export class Daemon extends EventEmitter {
             // tool_result (interrupted, crashed, cancelled), which would otherwise leave
             // the last tool pinned to the progress line for the rest of the session.
             this.publishActivity(null);
+            this.resetToolProgress();
             // Must run before the mcpRestartPending branch below: the pane text is the
             // only copy of the answer, and the revival restart is about to clear it.
             this.maybeProxyReplyOnTurnEnd(pane);
@@ -2020,8 +2260,13 @@ export class Daemon extends EventEmitter {
         if (snapshot.state !== "idle")
             this.pauseRequested = false;
         // A pause deferred by an auth failure: retry the moment the pane settles.
-        if (this.pausePending && snapshot.state === "idle" && this.pasteQueueDepth === 0) {
+        // "stuck" counts as settled here, and that is the whole point — an expired
+        // session cannot complete the turn it is holding, so the pane never returns
+        // to idle and waiting for idle meant waiting forever. The instance stayed
+        // live, kept its warm slot, and re-raised a hang alert on every scan.
+        if (this.pausePending && (snapshot.state === "idle" || snapshot.state === "stuck") && this.pasteQueueDepth === 0) {
             this.pausePending = false;
+            this.pauseAllowStuck = snapshot.state === "stuck";
             this.emit("auto_pause_requested", { name: this.name, idleSince: snapshot.stateChangedAt });
             return;
         }
@@ -2148,6 +2393,25 @@ export class Daemon extends EventEmitter {
             clearTimeout(this.instanceStateIdleTimer);
         this.instanceStateIdleTimer = null;
     }
+    clearInstanceStateOutputProbeTimer() {
+        if (this.instanceStateOutputProbeTimer)
+            clearTimeout(this.instanceStateOutputProbeTimer);
+        this.instanceStateOutputProbeTimer = null;
+    }
+    /**
+     * Periodic status-line hooks can generate `%output` without changing a single
+     * visible cell. Probe the pane once per burst: a changed capture is real work;
+     * an identical ready capture remains idle and emits no state edge.
+     */
+    scheduleInstanceStateOutputProbe() {
+        if (this.instanceStateOutputProbeTimer)
+            return;
+        this.instanceStateOutputProbeTimer = setTimeout(() => {
+            this.instanceStateOutputProbeTimer = null;
+            void this.captureAndEvaluateInstanceState("output_probe", this.instanceStateLastOutputAt);
+        }, PERIODIC_REDRAW_PROBE_MS);
+        this.instanceStateOutputProbeTimer.unref?.();
+    }
     clearInstanceStateStuckTimer() {
         if (this.instanceStateStuckTimer)
             clearTimeout(this.instanceStateStuckTimer);
@@ -2192,6 +2456,8 @@ export class Daemon extends EventEmitter {
         if (this.statePollInFlight) {
             if (reason === "idle_debounce")
                 this.scheduleInstanceStateIdleCapture();
+            if (reason === "output_probe")
+                this.scheduleInstanceStateOutputProbe();
             return;
         }
         this.statePollInFlight = true;
@@ -2200,9 +2466,19 @@ export class Daemon extends EventEmitter {
             const pane = await this.tmux.capturePane();
             // Output received while capture-pane was in flight makes this snapshot
             // stale. Its output handler has already armed a new debounce.
-            if ((expectedOutputAt > 0 && this.instanceStateLastOutputAt > expectedOutputAt)
-                || (this.instanceStateLastOutputAt > 0 && this.instanceStateLastOutputAt >= captureStartedAt))
+            const outputMovedDuringCapture = (expectedOutputAt > 0 && this.instanceStateLastOutputAt > expectedOutputAt)
+                || (this.instanceStateLastOutputAt > 0 && this.instanceStateLastOutputAt >= captureStartedAt);
+            if (outputMovedDuringCapture) {
+                if (reason === "output_probe") {
+                    // A second burst overtook the probe. Do not bless its stale capture as
+                    // idle: continuous output is the safer working signal, while the next
+                    // quiet probe/debounce can still prove that it was only repainting.
+                    this.applyInstanceStateSnapshot(this.instanceStateMachine.recordOutput(this.instanceStateLastOutputAt));
+                    this.scheduleInstanceStateIdleCapture();
+                    this.scheduleInstanceStateStuckDeadline(this.instanceStateLastOutputAt);
+                }
                 return;
+            }
             const observedChangeAt = expectedOutputAt || captureStartedAt;
             // One observation per capture. This used to call observe() twice with the
             // same pane: the second call always saw an unchanged pane, so the
@@ -2211,6 +2487,7 @@ export class Daemon extends EventEmitter {
             // mismatched spinner frame was enough to report idle mid-turn.
             const settled = this.instanceStateLastOutputAt === 0
                 || captureStartedAt - this.instanceStateLastOutputAt >= this.instanceStateIdleDebounceMs;
+            const paneActivity = this.backend?.getPaneActivity?.(pane) ?? null;
             // The two times are genuinely different and both matter: the content
             // changed when tmux reported output (observedChangeAt), but idle/stuck are
             // decisions about *now*. The old double-observe expressed that by calling
@@ -2218,6 +2495,7 @@ export class Daemon extends EventEmitter {
             const snapshot = this.instanceStateMachine.observe(pane, Date.now(), {
                 settled,
                 changeAt: observedChangeAt,
+                forceBusy: paneActivity !== null,
             });
             this.applyInstanceStateSnapshot(snapshot, pane);
             // Backends without a transcript feed can still say what they are doing, if
@@ -2225,7 +2503,7 @@ export class Daemon extends EventEmitter {
             // extra tmux call. Cadence is the capture cadence (idle debounce + the 60s
             // safety sweep), which matches the progress ticker's own 60s interval.
             if (this.backend?.getPaneActivity) {
-                this.publishActivity(snapshot.state === "idle" ? null : this.backend.getPaneActivity(pane));
+                this.publishActivity(snapshot.state === "idle" ? null : paneActivity);
             }
             if (snapshot.state === "idle") {
                 this.clearInstanceStateStuckTimer();
@@ -2252,6 +2530,14 @@ export class Daemon extends EventEmitter {
         if (!windowId || event.windowId !== windowId || !this.instanceStateMachine)
             return;
         this.instanceStateLastOutputAt = event.at;
+        if (this.backend?.hasPeriodicPaneRedraw?.() === true && this.instanceState === "idle") {
+            // Do not emit idle→working solely because agy repainted an identical
+            // footer. The short capture probe below still observes genuine pane
+            // changes promptly and moves the state to working.
+            this.scheduleInstanceStateOutputProbe();
+            this.scheduleInstanceStateIdleCapture();
+            return;
+        }
         const snapshot = this.instanceStateMachine.recordOutput(event.at);
         this.applyInstanceStateSnapshot(snapshot);
         this.scheduleInstanceStateIdleCapture();
@@ -2302,6 +2588,7 @@ export class Daemon extends EventEmitter {
     stopInstanceStateMonitor() {
         this.instanceStateMonitorActive = false;
         this.clearInstanceStateIdleTimer();
+        this.clearInstanceStateOutputProbeTimer();
         this.clearInstanceStateStuckTimer();
         if (this.instanceStateMonitorTimer)
             clearInterval(this.instanceStateMonitorTimer);
@@ -2336,6 +2623,15 @@ export class Daemon extends EventEmitter {
             this.logger.debug(diagnostic, "Suppressing stuck notification without pending work");
             return;
         }
+        // An auth-broken instance IS stuck, and stays stuck: it cannot finish the
+        // turn it is holding, so pendingWork never clears and this fired on every
+        // scan forever. The notification is also useless — it offers Restart/Wait
+        // and asks General for help, but only the user re-logging in fixes this, and
+        // they have already been told exactly that by the auth alert.
+        if (this.authFailureUnresolved) {
+            this.logger.debug(diagnostic, "Suppressing stuck notification — unresolved auth failure (re-login required)");
+            return;
+        }
         this.logger.warn(diagnostic, "Instance pane stuck with pending work");
         this.hangDetector?.emit("hang", { unchangedForMs: snapshot.unchangedForMs });
     }
@@ -2355,6 +2651,7 @@ export class Daemon extends EventEmitter {
         // fire into a stopped daemon).
         this.clearMcpRestartRequest();
         this.interactivePromptDetector.reset();
+        this.blockingProcessDetector.reset();
         this.stopInstanceStateMonitor();
         this.transcriptMonitor?.stop();
         this.guardian?.stop();
@@ -2380,9 +2677,9 @@ export class Daemon extends EventEmitter {
      * Tell the fleet manager what this instance is doing right now, for the live
      * progress line on the cancel button.
      *
-     * Purely cosmetic — nothing decides anything from it, so it is fine that only
-     * backends with a transcript feed report at all (claude-code today). For the
-     * rest the progress line keeps showing just elapsed time.
+     * Primarily cosmetic. The foreground-process detector also uses a current
+     * shell activity as one of several positive signals, but never makes a state
+     * decision from an arbitrary activity label alone.
      *
      * Repeats are dropped: the ticker only edits the channel message when the text
      * changes, and a stream of identical broadcasts would defeat that.
@@ -2398,6 +2695,141 @@ export class Daemon extends EventEmitter {
             activity: next,
         });
     }
+    /** Effective tool_progress level, hardened against junk config values.
+     *  Off unless explicitly enabled: an update must never make bubbles start
+     *  listing tool activity the operator did not ask to broadcast. */
+    toolProgressLevel() {
+        const raw = this.config.tool_progress;
+        return raw === "standard" || raw === "verbose" ? raw : "off";
+    }
+    /**
+     * Apply a tool-progress setting without restarting the CLI session.
+     *
+     * Drop the current accumulator at the boundary: verbose entries may contain
+     * command previews which must not survive a downgrade to standard/off, and a
+     * newly enabled level should start with a clean, internally consistent list.
+     */
+    updateToolProgress(level) {
+        const previous = this.toolProgressLevel();
+        this.config.tool_progress = level;
+        if (this.toolProgressLevel() !== previous)
+            this.resetToolProgress();
+    }
+    /** Snapshot the configuration actually owned by this live daemon. */
+    getConfigSnapshot() {
+        return structuredClone(this.config);
+    }
+    /**
+     * Apply the whitelisted hot configuration carried by FleetManager IPC.
+     * null removes an optional value; invalid/unlisted fields are ignored rather
+     * than allowing another client on the per-instance socket to mutate cold
+     * process/session settings.
+     */
+    applyConfigUpdate(value) {
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            return;
+        const update = value;
+        if (update.tool_progress === null || ["off", "standard", "verbose"].includes(String(update.tool_progress))) {
+            this.updateToolProgress(update.tool_progress === null ? undefined : update.tool_progress);
+        }
+        if (typeof update.mcp_proxy_reply === "boolean")
+            this.config.mcp_proxy_reply = update.mcp_proxy_reply;
+        else if (update.mcp_proxy_reply === null)
+            delete this.config.mcp_proxy_reply;
+        if (typeof update.warm_cap === "number" && Number.isInteger(update.warm_cap) && update.warm_cap >= 0)
+            this.config.warm_cap = update.warm_cap;
+        else if (update.warm_cap === null)
+            delete this.config.warm_cap;
+        const nextAutoPause = typeof update.auto_pause_after === "number"
+            && Number.isFinite(update.auto_pause_after)
+            && update.auto_pause_after >= 0
+            ? update.auto_pause_after
+            : update.auto_pause_after === null ? 0 : undefined;
+        if (nextAutoPause !== undefined) {
+            const previousAutoPause = typeof this.config.auto_pause_after === "number" ? this.config.auto_pause_after : 0;
+            if (update.auto_pause_after === null)
+                delete this.config.auto_pause_after;
+            else
+                this.config.auto_pause_after = nextAutoPause;
+            if (nextAutoPause !== previousAutoPause) {
+                const isGeneral = this.config.general_topic === true || this.name === "general";
+                this.autoPauseController.reconfigure((isGeneral ? 0 : nextAutoPause) * 60_000);
+            }
+        }
+        for (const key of ["display_name", "description"]) {
+            if (typeof update[key] === "string")
+                this.config[key] = update[key];
+            else if (update[key] === null)
+                delete this.config[key];
+        }
+        if (Array.isArray(update.tags) && update.tags.every(tag => typeof tag === "string"))
+            this.config.tags = [...update.tags];
+        else if (update.tags === null)
+            delete this.config.tags;
+        if (["trace", "debug", "info", "warn", "error"].includes(String(update.log_level))) {
+            const level = update.log_level;
+            if (this.config.log_level !== level) {
+                this.config.log_level = level;
+                this.logger.level = level;
+            }
+        }
+    }
+    /**
+     * Accumulate one semantic progress line for the channel bubble and schedule
+     * a coalesced broadcast. Separate from publishActivity on purpose: that one
+     * is the single-line statusline detail (terse, operator-facing), this is the
+     * multi-line channel list (semantic, argument-free at `standard`) — see
+     * tool-progress.ts for why the two labellers must not merge.
+     */
+    recordToolProgress(name, input) {
+        const level = this.toolProgressLevel();
+        if (level === "off")
+            return;
+        if (this.turnProgress.add(summarizeProgress(name, input, level))) {
+            this.scheduleProgressBroadcast();
+        }
+    }
+    /** Coalesce progress broadcasts: at most one per 3s, trailing edge kept. */
+    scheduleProgressBroadcast() {
+        const MIN_INTERVAL_MS = 3_000;
+        const since = Date.now() - this.lastProgressBroadcastAt;
+        if (since >= MIN_INTERVAL_MS) {
+            this.broadcastToolProgress();
+            return;
+        }
+        if (this.progressBroadcastTimer)
+            return;
+        this.progressBroadcastTimer = setTimeout(() => {
+            this.progressBroadcastTimer = null;
+            this.broadcastToolProgress();
+        }, MIN_INTERVAL_MS - since);
+        this.progressBroadcastTimer.unref?.();
+    }
+    broadcastToolProgress() {
+        const rendered = this.turnProgress.render();
+        if (rendered === this.lastProgressBroadcast)
+            return;
+        this.lastProgressBroadcast = rendered;
+        this.lastProgressBroadcastAt = Date.now();
+        this.ipcServer?.broadcast({
+            type: "instance_progress",
+            instanceName: this.name,
+            progress: rendered,
+        });
+    }
+    /** New turn (or turn over): drop the list and tell the fleet to clear it. */
+    resetToolProgress() {
+        if (this.progressBroadcastTimer) {
+            clearTimeout(this.progressBroadcastTimer);
+            this.progressBroadcastTimer = null;
+        }
+        this.turnProgress.reset();
+        if (this.lastProgressBroadcast !== "") {
+            this.lastProgressBroadcast = "";
+            this.lastProgressBroadcastAt = Date.now();
+            this.ipcServer?.broadcast({ type: "instance_progress", instanceName: this.name, progress: "" });
+        }
+    }
     /**
      * Options for every system-initiated paste (startup notice, session snapshot,
      * runtime-dialog keys).
@@ -2433,12 +2865,130 @@ export class Daemon extends EventEmitter {
             return ""; // skip channel tools
         return name;
     }
+    /**
+     * The one place an inbound message grows its metadata wrapper ([user:]/
+     * [from:] prefix, pending reactions, handoff metadata, reply instructions).
+     * Both the normal queued path (pushChannelMessage) and /steer go through
+     * here — a steered message must read EXACTLY like a queued one to the
+     * agent, or the two drift apart in what the agent is told about replying.
+     */
+    formatInboundMessage(content, meta) {
+        const user = meta.user || "unknown";
+        const fromInstance = meta.from_instance;
+        let formatted;
+        if (fromInstance) {
+            // #77: show the sender's display name for readability, keeping the machine
+            // instance name in parens so the recipient's send_to_instance target is valid.
+            const fromLabel = meta.from_display ? `${meta.from_display} (${fromInstance})` : fromInstance;
+            formatted = `[from:${fromLabel}] ${content}`;
+            formatted += renderHandoffMetadata(meta);
+            // A delegated task that requires a reply must not read like a chatty FYI —
+            // the "you may stay silent" line is for the latter only.
+            formatted += meta.requires_reply === "true"
+                ? "\n(A reply IS required: use report_result with the correlation_id above — or send_to_instance. Not direct text.)"
+                : "\n(If you need to reply, use send_to_instance tool, NOT direct text. If there is nothing to add, you may stay silent.)";
+        }
+        else {
+            const via = meta.source ? ` via ${meta.source}` : "";
+            const idTag = meta.user_id ? `, id:${meta.user_id}` : "";
+            formatted = `[user:${user}${via}${idTag}] ${content}`;
+            // Reactions queued since the last real message (#432). One leading line of
+            // context, present only when something is pending — a reaction no longer
+            // costs a turn of its own.
+            if (meta.pending_reactions) {
+                formatted = `[Recent reactions: ${meta.pending_reactions}]\n${formatted}`;
+            }
+            formatted += renderHandoffMetadata(meta);
+            formatted += "\n(Reply using the reply tool — do NOT respond with direct text)";
+        }
+        if (meta.reply_to_text) {
+            formatted += `\n(reply_to: "${meta.reply_to_text}")`;
+        }
+        return formatted;
+    }
+    /**
+     * /steer: interject into the CURRENT turn instead of queueing for idle.
+     *
+     * Differences from pushChannelMessage, and nothing else:
+     *  - serialized on steerLock, not pasteLock — it must overtake, not queue
+     *  - deliverMessage runs with { steer: true }, which takes the busy branch
+     *    that pastes immediately (the codex native-queue transaction) instead of
+     *    waiting for idle. Verification and silent-loss fallback are the ones
+     *    that path already has: pane-capture visibility check, then one
+     *    idle-gated redelivery — so on a TUI that swallows busy input the steer
+     *    degrades to "next message after this turn", never silently vanishes.
+     *
+     * The steered text goes through formatInboundMessage so the agent sees a
+     * normal inbound message, with a steering notice prepended for context.
+     */
+    steerMessage(content, meta, deliveryEpoch = this.deliveryEpoch) {
+        if (!this.isDeliveryEpochCurrent(deliveryEpoch))
+            return;
+        this.updateLastChat(meta.chat_id, meta.thread_id, meta.adapter_id);
+        this.pendingWork.recordInbound();
+        this.recordRecentUserMessage(content, meta);
+        const formatted = "[STEERING — mid-task course correction from the user. Fold this into the CURRENT work.]\n"
+            + this.formatInboundMessage(content, meta);
+        const chatId = meta.chat_id;
+        const messageId = meta.message_id;
+        const status = (chatId && messageId)
+            ? { chatId: meta.thread_id || chatId, messageId }
+            : undefined;
+        this.steerLock = this.steerLock.then(async () => {
+            if (!this.isDeliveryEpochCurrent(deliveryEpoch))
+                return;
+            await this.wake();
+            if (!this.isDeliveryEpochCurrent(deliveryEpoch))
+                return;
+            if (await this.deliverMessage(formatted, status, { steer: true, deliveryEpoch })) {
+                this.markTurnStarted(meta, formatted);
+            }
+        }).catch(err => {
+            this.logger.warn({ err: err.message }, "steer delivery error");
+        });
+    }
+    /**
+     * /btw: submit a separately-labelled side question immediately while asking
+     * the agent not to change the active task. Claude's native `/btw` opens a
+     * branchAndResume panel whose answer never reaches the channel or transcript,
+     * so channel delivery intentionally uses a normal wrapped inbound instead.
+     */
+    btwMessage(content, meta, deliveryEpoch = this.deliveryEpoch) {
+        if (!this.isDeliveryEpochCurrent(deliveryEpoch))
+            return;
+        this.updateLastChat(meta.chat_id, meta.thread_id, meta.adapter_id);
+        this.pendingWork.recordInbound();
+        this.recordRecentUserMessage(content, meta);
+        const formatted = "[BTW — side question from the user. Answer it separately without changing or interrupting the CURRENT work.]\n"
+            + this.formatInboundMessage(content, meta);
+        const chatId = meta.chat_id;
+        const messageId = meta.message_id;
+        const status = (chatId && messageId)
+            ? { chatId: meta.thread_id || chatId, messageId }
+            : undefined;
+        this.steerLock = this.steerLock.then(async () => {
+            if (!this.isDeliveryEpochCurrent(deliveryEpoch))
+                return;
+            await this.wake();
+            if (!this.isDeliveryEpochCurrent(deliveryEpoch))
+                return;
+            if (await this.deliverMessage(formatted, status, { steer: true, deliveryEpoch })) {
+                this.markTurnStarted(meta, formatted);
+            }
+        }).catch(err => {
+            this.logger.warn({ err: err.message }, "btw delivery error");
+        });
+    }
     /**
      * Push an inbound channel message to a specific MCP session.
      * If targetSession is provided, only send to the matching socket.
      * Otherwise send to the instance's own session (this.name).
      */
-    pushChannelMessage(content, meta, _targetSession) {
+    pushChannelMessage(content, meta, _targetSession, deliveryEpoch = this.deliveryEpoch) {
+        if (!this.isDeliveryEpochCurrent(deliveryEpoch)) {
+            this.logger.info("Pending channel delivery dropped by user cancel");
+            return;
+        }
         if (!this.tmux) {
             this.logger.warn("Cannot push channel message: tmux not running");
             return;
@@ -2472,46 +3022,19 @@ export class Daemon extends EventEmitter {
             const rawText = content.slice(5);
             this.logger.info({ user }, "Raw paste from topic mode user");
             this.pasteLock = this.pasteLock.then(async () => {
-                if (await this.deliverMessage(rawText))
+                if (!this.isDeliveryEpochCurrent(deliveryEpoch))
+                    return;
+                if (await this.deliverMessage(rawText, undefined, { deliveryEpoch }))
                     this.markTurnStarted(meta, rawText);
             }).catch(err => {
                 this.logger.warn({ err: err.message }, "pasteLock raw delivery error");
             });
             return;
         }
-        let formatted;
-        if (fromInstance) {
-            // #77: show the sender's display name for readability, keeping the machine
-            // instance name in parens so the recipient's send_to_instance target is valid.
-            const fromLabel = meta.from_display ? `${meta.from_display} (${fromInstance})` : fromInstance;
-            formatted = `[from:${fromLabel}] ${content}`;
-            formatted += renderHandoffMetadata(meta);
-            // A delegated task that requires a reply must not read like a chatty FYI —
-            // the "you may stay silent" line is for the latter only.
-            formatted += meta.requires_reply === "true"
-                ? "\n(A reply IS required: use report_result with the correlation_id above — or send_to_instance. Not direct text.)"
-                : "\n(If you need to reply, use send_to_instance tool, NOT direct text. If there is nothing to add, you may stay silent.)";
-        }
-        else {
-            const via = meta.source ? ` via ${meta.source}` : "";
-            const idTag = meta.user_id ? `, id:${meta.user_id}` : "";
-            formatted = `[user:${user}${via}${idTag}] ${content}`;
-            // Reactions queued since the last real message (#432). One leading line of
-            // context, present only when something is pending — a reaction no longer
-            // costs a turn of its own.
-            if (meta.pending_reactions) {
-                formatted = `[Recent reactions: ${meta.pending_reactions}]\n${formatted}`;
-            }
-            formatted += renderHandoffMetadata(meta);
-            formatted += "\n(Reply using the reply tool — do NOT respond with direct text)";
-        }
-        if (meta.reply_to_text) {
-            formatted += `\n(reply_to: "${meta.reply_to_text}")`;
-        }
+        const formatted = this.formatInboundMessage(content, meta);
         // Serialize deliveries: each message waits for the previous to complete,
         // and each waits for the CLI to be idle before pasting. Messages are never
-        // dropped for age — a long-busy CLI just queues them until it frees up
-        // (the user can press Cancel to interrupt and let the queue drain sooner).
+        // dropped for age — only an explicit user Cancel invalidates queued work.
         const chatId = meta.chat_id;
         const messageId = meta.message_id;
         const wasQueued = this.pasteQueueDepth > 0;
@@ -2524,17 +3047,28 @@ export class Daemon extends EventEmitter {
         }
         this.pasteLock = this.pasteLock.then(async () => {
             try {
+                if (!this.isDeliveryEpochCurrent(deliveryEpoch)) {
+                    this.logger.info("Pending channel delivery dropped by user cancel");
+                    return;
+                }
                 if (this.config.pre_task_command) {
-                    await this.deliverMessage(this.config.pre_task_command);
+                    await this.deliverMessage(this.config.pre_task_command, undefined, { deliveryEpoch });
+                    if (!this.isDeliveryEpochCurrent(deliveryEpoch))
+                        return;
                 }
                 if (this.pendingInstructionsNotice) {
                     this.pendingInstructionsNotice = false;
-                    await this.deliverMessage(buildInstructionReloadNotice(this.backend?.binaryName ?? "unknown", this.name, this.instanceDir));
+                    await this.deliverMessage(buildInstructionReloadNotice(this.backend?.binaryName ?? "unknown", this.name, this.instanceDir), undefined, { deliveryEpoch });
+                    if (!this.isDeliveryEpochCurrent(deliveryEpoch))
+                        return;
                 }
                 const status = (chatId && messageId)
                     ? { chatId: meta.thread_id || chatId, messageId }
                     : undefined;
-                if (await this.deliverMessage(formatted, status))
+                // A fresh delivery begins a fresh turn — its bubble must not inherit
+                // the previous turn's tool list.
+                this.resetToolProgress();
+                if (await this.deliverMessage(formatted, status, { deliveryEpoch }))
                     this.markTurnStarted(meta, formatted);
             }
             finally {
@@ -2561,7 +3095,11 @@ export class Daemon extends EventEmitter {
      * immediately and own the application-level queue themselves. The pasteLock remains
      * serial in both cases so separate PTY writes can never overlap.
      */
-    async deliverMessage(formatted, status) {
+    async deliverMessage(formatted, status, opts) {
+        const cancelled = () => opts?.deliveryEpoch !== undefined
+            && !this.isDeliveryEpochCurrent(opts.deliveryEpoch);
+        if (cancelled())
+            return false;
         // Sanitize unclosed code fences — they cause CLI to wait for closure on Enter
         const fenceCount = (formatted.match(/```/g) || []).length;
         if (fenceCount % 2 !== 0) {
@@ -2570,22 +3108,31 @@ export class Daemon extends EventEmitter {
         }
         // Before anything reads the window id: a spawn in progress is about to change it.
         await this.waitForSpawnToSettle();
+        if (cancelled())
+            return false;
         let windowId = this.getWindowId();
         const supportsQueuedInput = this.backend?.supportsQueuedInput?.() === true;
         let handingOffToNativeQueue = false;
         // If the CLI is busy, either hand the complete submission to its native input
         // queue or wait for idle. Native queue support is an explicit backend capability:
         // normal Enter input has steering/interrupt semantics in several other CLIs.
-        if (windowId && this.controlClient && !this.controlClient.isIdle(windowId)) {
+        if (windowId && this.controlClient && !this.isPaneIdleForDelivery(windowId)) {
             if (status)
                 this.emit("message_queued", status);
-            if (supportsQueuedInput) {
+            if (supportsQueuedInput || opts?.steer) {
+                // Native queue (codex), or an explicit /steer: hand the complete
+                // paste+Enter transaction to the busy CLI now. For steer this is the
+                // point — the user asked to interject, and the transaction's
+                // visibility check + idle-gated fallback catch TUIs that swallow
+                // busy input (see steerMessage).
                 handingOffToNativeQueue = true;
-                this.logger.debug("CLI busy — handing message to backend-native input queue");
+                this.logger.debug(opts?.steer ? "CLI busy — steering into the running turn" : "CLI busy — handing message to backend-native input queue");
             }
             else {
                 this.logger.debug("CLI busy — queuing message until idle");
-                const becameIdle = await this.controlClient.waitUntilIdle(windowId);
+                const becameIdle = await this.waitForPaneIdleForDelivery(windowId);
+                if (cancelled())
+                    return false;
                 if (!becameIdle) {
                     // The pane never freed up. Report the failure instead of pasting into a
                     // wedged CLI (where the text would sit unsubmitted and the next message
@@ -2601,7 +3148,54 @@ export class Daemon extends EventEmitter {
         // held under the pane lock — holding it across the idle wait (up to 30 min)
         // would starve the runtime-dialog dismisser, which is often the very thing
         // that would let the pane go idle again.
-        return this.paneWriteLock.run(() => this.writeMessageToPane(formatted, windowId, handingOffToNativeQueue, status));
+        return this.paneWriteLock.run(async () => {
+            if (cancelled())
+                return false;
+            return this.writeMessageToPane(formatted, windowId, handingOffToNativeQueue, status);
+        });
+    }
+    /**
+     * A raw `%output` silence check is authoritative for ordinary TUIs. It is not
+     * for a backend such as agy whose status-line hook periodically redraws an
+     * identical screen. In that case trust an idle pane-state snapshot only when
+     * it was captured after both the latest output and the latest control-client
+     * observation reset.
+     */
+    isPaneIdleForDelivery(windowId) {
+        if (!this.controlClient)
+            return true;
+        if (this.controlClient.isIdle(windowId))
+            return true;
+        if (this.backend?.hasPeriodicPaneRedraw?.() !== true || this.instanceState !== "idle")
+            return false;
+        const lastOutputAt = this.controlClient.getLastOutputAt(windowId);
+        if (lastOutputAt === undefined || !this.instanceStateMachine)
+            return false;
+        const observedAt = this.instanceStateMachine.snapshot().observedAt;
+        return observedAt >= lastOutputAt
+            && observedAt >= this.controlClient.getObservationResetAt();
+    }
+    waitForPaneIdleForDelivery(windowId, timeoutMs = 30 * 60_000) {
+        if (!this.controlClient)
+            return Promise.resolve(true);
+        if (this.backend?.hasPeriodicPaneRedraw?.() !== true) {
+            return this.controlClient.waitUntilIdle(windowId, timeoutMs);
+        }
+        if (this.isPaneIdleForDelivery(windowId))
+            return Promise.resolve(true);
+        return new Promise(resolve => {
+            const check = setInterval(() => {
+                if (!this.isPaneIdleForDelivery(windowId))
+                    return;
+                clearInterval(check);
+                clearTimeout(timer);
+                resolve(true);
+            }, 50);
+            const timer = setTimeout(() => {
+                clearInterval(check);
+                resolve(false);
+            }, timeoutMs);
+        });
     }
     /**
      * The write half of a delivery: paste → Enter → confirm, with retries.
@@ -3097,7 +3691,10 @@ export class Daemon extends EventEmitter {
     }
     /** Build config object for the CLI backend */
     buildBackendConfig() {
-        const isCliMode = this.config.agent_mode === "cli" || (this.config.agent_mode == null && this.config.backend === "antigravity");
+        // Antigravity 1.1.17 has no per-workspace MCP config, but its global MCP
+        // children inherit the CLI process environment. The backend installs one
+        // environment-selecting launcher, so MCP is now the safe default here too.
+        const isCliMode = this.config.agent_mode === "cli";
         const sockPath = join(this.instanceDir, "channel.sock");
         let serverJs = join(__dirname, "channel", "mcp-server.js");
         if (!existsSync(serverJs)) {
@@ -3234,6 +3831,8 @@ export class Daemon extends EventEmitter {
             });
         }
         const agentPort = parseInt(process.env.AGEND_PORT ?? "19280", 10);
+        const backendName = this.config.backend ?? "claude-code";
+        const backendOptions = this.config.backend_options?.[backendName];
         return {
             workingDirectory: this.config.working_directory,
             instanceDir: this.instanceDir,
@@ -3253,6 +3852,7 @@ export class Daemon extends EventEmitter {
             instructions,
             agentMode: isCliMode ? "cli" : "mcp",
             agentPort: isCliMode ? agentPort : undefined,
+            backendOptions,
         };
     }
     /**
@@ -3580,6 +4180,24 @@ export class Daemon extends EventEmitter {
                 // CLI is ready (pattern defined by each backend)
                 if (this.backend.getReadyPattern().test(pane))
                     return true;
+                // A CLI parked at its own sign-in screen is an AUTH incident: no dialog
+                // key can dismiss it and no ready pattern will ever appear. Report it as
+                // an auth error (the lifecycle double-checks with the token-free probe)
+                // instead of letting it decay into crash/hang/MCP-died noise, and stop
+                // the retry loop — only re-login (see /login) ends this state.
+                const loginScreen = LOGIN_FLOWS[this.config.backend ?? "claude-code"]?.loginScreenPattern;
+                if (loginScreen?.test(pane) && !this.loginScreenReported) {
+                    this.loginScreenReported = true;
+                    this.authFailureUnresolved = true;
+                    this.logger.warn({ backend: this.config.backend }, "CLI is waiting at its sign-in screen — reporting auth error");
+                    this.emit("pty_error", {
+                        name: this.name,
+                        type: "auth_error",
+                        action: "pause",
+                        message: "CLI is waiting at its sign-in screen — credentials are missing or expired",
+                    });
+                    return true;
+                }
                 // Fatal: command not found (must match full phrase to avoid false positives
                 // like Kiro's "agent X not found, using default")
                 if (/command not found|: not found$/m.test(pane))
@@ -3616,9 +4234,29 @@ export class Daemon extends EventEmitter {
         // back from statusline.json — that would re-arm --continue and re-loop.
         if (this.skipResume)
             return;
-        const sid = this.backend?.getSessionId();
-        if (sid) {
-            writeFileSync(join(this.instanceDir, "session-id"), sid);
+        try {
+            const sid = this.backend?.getSessionId();
+            if (!sid)
+                return;
+            const path = join(this.instanceDir, "session-id");
+            // Idle observations happen after turns. Avoid needless writes (and mtime
+            // churn) while still updating the marker when /new changes the session.
+            try {
+                if (readFileSync(path, "utf-8").trim() === sid)
+                    return;
+            }
+            catch { /* first checkpoint */ }
+            writeFileSync(path, sid);
+            this.sessionCheckpointWarningEmitted = false;
+            this.logger.debug("Session id checkpointed");
+        }
+        catch (err) {
+            // Session discovery is best-effort and must never break the pane state
+            // monitor. Existing stop/pause checkpoints get another chance later.
+            if (!this.sessionCheckpointWarningEmitted) {
+                this.sessionCheckpointWarningEmitted = true;
+                this.logger.warn({ err: err.message }, "Session id checkpoint failed");
+            }
         }
     }
     readContextPercentage() {