@songsid/agend 2.1.4-beta.34 → 2.1.4-beta.36

package/dist/daemon.d.ts

@@ -246,6 +246,26 @@ export declare function extractProxyReplyText(pane: string, opts?: {
     maxLines?: number;
     maxChars?: number;
 }): string | null;
+export interface MalformedClaudeToolCallDetection {
+    /** Stable, non-secret fingerprint used to suppress a stale pane fragment. */
+    signature: string;
+    /** Sanitized reply argument, or null when only a dangling closing tag survived. */
+    text: string | null;
+}
+/**
+ * Find the narrow Claude XML failure signature reported in #648.
+ *
+ * This intentionally runs only at the daemon's busy→idle edge (the caller
+ * enforces that) and only scans output after the current inbound marker. A
+ * partial tool call while Claude is still streaming is therefore never acted
+ * on. The extracted argument goes through the same credential redaction as the
+ * dead-MCP pane proxy before it can leave the host.
+ */
+export declare function detectMalformedClaudeToolCall(pane: string, opts?: {
+    inboundMarker?: string;
+    maxLines?: number;
+    maxChars?: number;
+}): MalformedClaudeToolCallDetection | null;
 export type InteractivePromptKind = "sudo_password" | "password" | "confirmation" | "press_enter";
 export interface InteractivePromptDetection {
     kind: InteractivePromptKind;
@@ -372,8 +392,12 @@ export declare class Daemon extends EventEmitter {
     private statePollInFlight;
     private turnHadInbound;
     private turnOutboundDelivered;
+    /** Successful `reply` specifically; cross-instance tools do not satisfy #648. */
+    private turnReplyDelivered;
     private turnCorrelationId;
     private turnInboundMarker;
+    /** Prevent a visible stale XML fragment from being recovered on later turns. */
+    private lastMalformedToolCallSignature;
     private proxyReplySeq;
     private autoPauseController;
     private pauseRequested;
@@ -394,6 +418,17 @@ export declare class Daemon extends EventEmitter {
     private authFailureUnresolved;
     /** One login-screen auth report per spawn — the screen persists across polls. */
     private loginScreenReported;
+    /** A fatal startup screen (see StartupDialog.fatal) was already reported this run. */
+    private fatalStartupReported;
+    /**
+     * The CLI is parked on a fatal startup screen and every pane write must be
+     * refused. This is deliberately separate from the pause that the reported
+     * pty_error triggers: the pause is applied by an async handler, and a queued
+     * delivery would race it into the modal (where paste+Enter can confirm
+     * "Exit and fix manually"). Set synchronously at dialog-match time; cleared
+     * when a startup scan reaches a real ready prompt, or on wake().
+     */
+    private fatalStartupBlocked;
     /** model_error seen mid-turn: notify only if it survives to the idle screen. */
     private pendingModelErrorKey;
     /**
@@ -626,8 +661,13 @@ export declare class Daemon extends EventEmitter {
      * here (edge-triggered, then reset) is what makes it at most once per turn.
      */
     private maybeProxyReplyOnTurnEnd;
+    private isClaudeCodeBackend;
     /** Relay the pane's final text to the channel, marked as a daemon proxy reply. */
     private sendProxyReply;
+    /** Send a narrowly extracted #648 reply; operator notification is a separate event. */
+    private sendRecoveredMalformedReply;
+    /** Context-bound reply path shared by dead-MCP and malformed-call recovery. */
+    private deliverDaemonReply;
     private clearInstanceStateIdleTimer;
     private clearInstanceStateOutputProbeTimer;
     /**
@@ -761,6 +801,15 @@ export declare class Daemon extends EventEmitter {
      * serial in both cases so separate PTY writes can never overlap.
      */
     private deliverMessage;
+    /**
+     * While the CLI is parked on a fatal startup screen (see fatalStartupBlocked),
+     * no pane write may happen: paste+Enter into the corrupt-config modal would
+     * confirm "Exit and fix manually" and exit the CLI. The message is failed (❌)
+     * rather than held — the accompanying config_error notification tells the user
+     * what to fix, and holding would only build a queue that floods the pane the
+     * moment the flag clears.
+     */
+    private refuseFatalStartupDelivery;
     /**
      * A raw `%output` silence check is authoritative for ordinary TUIs. It is not
      * for a backend such as agy whose status-line hook periodically redraws an

package/dist/daemon.js

@@ -546,6 +546,66 @@ export function extractProxyReplyText(pane, opts = {}) {
     // The end of the turn is the answer — when over budget, keep the tail.
     return text.length > maxChars ? text.slice(text.length - maxChars) : text;
 }
+/**
+ * Find the narrow Claude XML failure signature reported in #648.
+ *
+ * This intentionally runs only at the daemon's busy→idle edge (the caller
+ * enforces that) and only scans output after the current inbound marker. A
+ * partial tool call while Claude is still streaming is therefore never acted
+ * on. The extracted argument goes through the same credential redaction as the
+ * dead-MCP pane proxy before it can leave the host.
+ */
+export function detectMalformedClaudeToolCall(pane, opts = {}) {
+    let clean = pane
+        .replace(/\x1B(?:[@-Z\\-_]|\[[0-?]*[ -/]*[@-~])/g, "")
+        .replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, "");
+    const marker = opts.inboundMarker?.trim();
+    if (marker) {
+        const markerAt = clean.lastIndexOf(marker);
+        if (markerAt >= 0)
+            clean = clean.slice(markerAt + marker.length);
+    }
+    const lines = clean.split(/\r?\n/).slice(-(opts.maxLines ?? 120));
+    const tail = lines.join("\n");
+    const closingTags = [...tail.matchAll(/<\/(?:parameter|invoke|function_calls)>/gi)];
+    if (closingTags.length === 0)
+        return null;
+    const parameterOpen = /<parameter\b[^>]*\bname\s*=\s*["']text["'][^>]*>/gi;
+    const parameterOpens = [...tail.matchAll(parameterOpen)];
+    const open = parameterOpens.at(-1);
+    if (!open || open.index === undefined) {
+        // Base stale suppression on the XML artifact itself, not unrelated pane
+        // redraws appended after it. The occurrence counts still distinguish a
+        // genuinely new identical malformed call while both remain visible.
+        const signature = createHash("sha256")
+            .update(`0:${closingTags.length}:${closingTags.map(tag => tag[0].toLowerCase()).join(":")}`)
+            .digest("hex");
+        return { signature, text: null };
+    }
+    const contentAt = open.index + open[0].length;
+    const closeAt = tail.slice(contentAt).search(/<\/parameter>/i);
+    if (closeAt < 0) {
+        const signature = createHash("sha256")
+            .update(`${parameterOpens.length}:${closingTags.length}:${open[0]}`)
+            .digest("hex");
+        return { signature, text: null };
+    }
+    const fragment = tail.slice(contentAt, contentAt + closeAt);
+    // Fingerprint only the malformed XML artifact; never put its contents in logs.
+    const signature = createHash("sha256")
+        .update(`${parameterOpens.length}:${closingTags.length}:${open[0]}${fragment}</parameter>`)
+        .digest("hex");
+    let text = sanitizePaneTail(fragment, opts.maxLines ?? 120)
+        .join("\n")
+        .replace(/\n{3,}/g, "\n\n")
+        .trim();
+    if (text.replace(/[^\p{L}\p{N}]/gu, "").length < 2)
+        return { signature, text: null };
+    const maxChars = opts.maxChars ?? 12_000;
+    if (text.length > maxChars)
+        text = text.slice(0, maxChars);
+    return { signature, text };
+}
 const INTERACTIVE_PROMPT_PATTERNS = [
     { kind: "sudo_password", pattern: /^\s*\[sudo\]\s+password\s+for\s+[^:\n]+:\s*$/im },
     // macOS sudo and several package installers use this exact no-echo prompt.
@@ -761,8 +821,12 @@ export class Daemon extends EventEmitter {
     // between, the agent's answer exists only on screen — the daemon relays it.
     turnHadInbound = false;
     turnOutboundDelivered = false;
+    /** Successful `reply` specifically; cross-instance tools do not satisfy #648. */
+    turnReplyDelivered = false;
     turnCorrelationId;
     turnInboundMarker;
+    /** Prevent a visible stale XML fragment from being recovered on later turns. */
+    lastMalformedToolCallSignature;
     proxyReplySeq = 0;
     autoPauseController;
     pauseRequested = false;
@@ -783,6 +847,17 @@ export class Daemon extends EventEmitter {
     authFailureUnresolved = false;
     /** One login-screen auth report per spawn — the screen persists across polls. */
     loginScreenReported = false;
+    /** A fatal startup screen (see StartupDialog.fatal) was already reported this run. */
+    fatalStartupReported = false;
+    /**
+     * The CLI is parked on a fatal startup screen and every pane write must be
+     * refused. This is deliberately separate from the pause that the reported
+     * pty_error triggers: the pause is applied by an async handler, and a queued
+     * delivery would race it into the modal (where paste+Enter can confirm
+     * "Exit and fix manually"). Set synchronously at dialog-match time; cleared
+     * when a startup scan reaches a real ready prompt, or on wake().
+     */
+    fatalStartupBlocked = false;
     /** model_error seen mid-turn: notify only if it survives to the idle screen. */
     pendingModelErrorKey = null;
     /**
@@ -2273,6 +2348,8 @@ export class Daemon extends EventEmitter {
         this.pausePending = false;
         this.authFailureUnresolved = false;
         this.loginScreenReported = false;
+        this.fatalStartupReported = false;
+        this.fatalStartupBlocked = false;
         if (this.pauseWakeState === "active")
             return;
         if (this.pauseWakeState === "pausing")
@@ -2405,6 +2482,7 @@ export class Daemon extends EventEmitter {
             return;
         this.turnHadInbound = true;
         this.turnOutboundDelivered = false;
+        this.turnReplyDelivered = false;
         this.turnCorrelationId = meta.correlation_id || undefined;
         // The last non-empty line of what we pasted: everything on screen after it
         // is the agent's own output.
@@ -2420,13 +2498,38 @@ export class Daemon extends EventEmitter {
     maybeProxyReplyOnTurnEnd(pane) {
         const hadInbound = this.turnHadInbound;
         const delivered = this.turnOutboundDelivered;
+        const replyDelivered = this.turnReplyDelivered;
         const correlationId = this.turnCorrelationId;
         const inboundMarker = this.turnInboundMarker;
         this.turnHadInbound = false;
         this.turnOutboundDelivered = false;
+        this.turnReplyDelivered = false;
         this.turnCorrelationId = undefined;
         this.turnInboundMarker = undefined;
-        if (!hadInbound || delivered || this.isPaused)
+        if (!hadInbound || this.isPaused)
+            return;
+        // Claude sometimes prints a broken XML tool call as plain text and returns
+        // idle without ever invoking `reply`. This is independent of MCP liveness:
+        // the model malformed the call before the server could receive it.
+        if (!replyDelivered && this.isClaudeCodeBackend() && pane) {
+            const malformed = detectMalformedClaudeToolCall(pane, { inboundMarker });
+            if (malformed) {
+                const stale = malformed.signature === this.lastMalformedToolCallSignature;
+                this.lastMalformedToolCallSignature = malformed.signature;
+                if (!stale) {
+                    const recovered = malformed.text != null;
+                    this.logger.warn({ correlationId, recovered }, recovered
+                        ? "Malformed Claude tool call detected — attempting to recover reply text"
+                        : "Malformed Claude tool call detected — reply text could not be extracted");
+                    this.emit("malformed_tool_call", { name: this.name, correlationId, recovered });
+                    if (malformed.text)
+                        this.sendRecoveredMalformedReply(malformed.text, correlationId);
+                }
+                // Never let the broader dead-MCP fallback relay the XML/chrome too.
+                return;
+            }
+        }
+        if (delivered)
             return;
         // Opt-in: raw pane text can carry secrets past the regex redaction.
         if (this.config.mcp_proxy_reply !== true)
@@ -2436,6 +2539,11 @@ export class Daemon extends EventEmitter {
             return;
         void this.sendProxyReply(pane, inboundMarker, correlationId);
     }
+    isClaudeCodeBackend() {
+        return this.runtimeIdentity?.backend === "claude-code"
+            || this.config.backend === "claude-code"
+            || this.backend?.binaryName === "claude";
+    }
     /** Relay the pane's final text to the channel, marked as a daemon proxy reply. */
     async sendProxyReply(pane, inboundMarker, correlationId) {
         try {
@@ -2453,50 +2561,68 @@ export class Daemon extends EventEmitter {
             let body = `⚠️ [MCP unavailable — proxy reply]\n\n${text}`;
             if (correlationId)
                 body += `\n\n(correlation_id: ${correlationId})`;
-            const args = { text: body };
-            // Same context-bound routing as the reply tool in handleToolCall.
-            if (this.lastChatId) {
-                args.chat_id = this.lastChatId;
-                if (this.lastThreadId)
-                    args.thread_id = this.lastThreadId;
-            }
             this.logger.warn({ correlationId }, "MCP server dead and the turn sent no reply — relaying the pane text as a proxy reply");
             this.emit("mcp_proxy_reply", { name: this.name, correlationId });
-            const adapters = this.messageBus.getAllAdapters();
-            if (adapters.length > 0) {
-                routeToolCall(adapters[0], "reply", args, this.lastThreadId, (_result, error) => {
-                    if (error)
-                        this.logger.error({ error }, "Dead-MCP proxy reply failed");
-                });
-                return;
-            }
-            if (!this.ipcServer)
-                return;
-            const fleetReqId = `proxyreply_${++this.proxyReplySeq}`;
-            this.ipcServer.broadcast({
-                type: "fleet_outbound",
-                tool: "reply",
-                args,
-                fleetRequestId: fleetReqId,
-                adapterId: this.lastAdapterId,
-            });
-            const timeout = setTimeout(() => {
-                this.pendingIpcRequests.delete(fleetReqId);
-                this.logger.error("Dead-MCP proxy reply timed out waiting for the fleet manager");
-            }, daemonBudgetMs("reply"));
-            timeout.unref?.();
-            this.pendingIpcRequests.set(fleetReqId, (respMsg) => {
-                clearTimeout(timeout);
-                if (respMsg.error)
-                    this.logger.error({ error: respMsg.error }, "Dead-MCP proxy reply failed");
-                else
-                    this.logger.info("Dead-MCP proxy reply delivered");
-            });
+            this.deliverDaemonReply(body, "proxyreply", "Dead-MCP proxy reply");
         }
         catch (err) {
             this.logger.error({ err: err.message }, "Dead-MCP proxy reply attempt failed");
         }
     }
+    /** Send a narrowly extracted #648 reply; operator notification is a separate event. */
+    sendRecoveredMalformedReply(text, correlationId) {
+        try {
+            this.deliverDaemonReply(text, "malformedreply", "Malformed tool-call recovery");
+        }
+        catch (err) {
+            this.logger.error({ err: err.message, correlationId }, "Malformed tool-call recovery attempt failed");
+        }
+    }
+    /** Context-bound reply path shared by dead-MCP and malformed-call recovery. */
+    deliverDaemonReply(body, requestPrefix, logLabel) {
+        const args = { text: body };
+        if (this.lastChatId) {
+            args.chat_id = this.lastChatId;
+            if (this.lastThreadId)
+                args.thread_id = this.lastThreadId;
+        }
+        const adapters = this.messageBus.getAllAdapters();
+        if (adapters.length > 0) {
+            routeToolCall(adapters[0], "reply", args, this.lastThreadId, (_result, error) => {
+                if (error)
+                    this.logger.error({ error }, `${logLabel} failed`);
+                else
+                    this.logger.info(`${logLabel} delivered`);
+            });
+            return;
+        }
+        if (!this.ipcServer) {
+            this.logger.error(`${logLabel} failed — no adapter or fleet IPC route`);
+            return;
+        }
+        const fleetReqId = `${requestPrefix}_${++this.proxyReplySeq}`;
+        const timeout = setTimeout(() => {
+            this.pendingIpcRequests.delete(fleetReqId);
+            this.logger.error(`${logLabel} timed out waiting for the fleet manager`);
+        }, daemonBudgetMs("reply"));
+        timeout.unref?.();
+        // Register before broadcast: an in-process/fast adapter can answer in the
+        // same tick, and a waiter installed afterwards would miss that response.
+        this.pendingIpcRequests.set(fleetReqId, (respMsg) => {
+            clearTimeout(timeout);
+            if (respMsg.error)
+                this.logger.error({ error: respMsg.error }, `${logLabel} failed`);
+            else
+                this.logger.info(`${logLabel} delivered`);
+        });
+        this.ipcServer.broadcast({
+            type: "fleet_outbound",
+            tool: "reply",
+            args,
+            fleetRequestId: fleetReqId,
+            adapterId: this.lastAdapterId,
+        });
+    }
     clearInstanceStateIdleTimer() {
         if (this.instanceStateIdleTimer)
             clearTimeout(this.instanceStateIdleTimer);
@@ -3219,6 +3345,8 @@ export class Daemon extends EventEmitter {
         await this.waitForSpawnToSettle();
         if (cancelled())
             return false;
+        if (this.refuseFatalStartupDelivery(status))
+            return false;
         let windowId = this.getWindowId();
         const supportsQueuedInput = this.backend?.supportsQueuedInput?.() === true;
         let handingOffToNativeQueue = false;
@@ -3260,9 +3388,29 @@ export class Daemon extends EventEmitter {
         return this.paneWriteLock.run(async () => {
             if (cancelled())
                 return false;
+            // Re-checked here because the flag can be set during the waits above
+            // (a spawn's dialog scan runs concurrently with a queued delivery).
+            if (this.refuseFatalStartupDelivery(status))
+                return false;
             return this.writeMessageToPane(formatted, windowId, handingOffToNativeQueue, status);
         });
     }
+    /**
+     * While the CLI is parked on a fatal startup screen (see fatalStartupBlocked),
+     * no pane write may happen: paste+Enter into the corrupt-config modal would
+     * confirm "Exit and fix manually" and exit the CLI. The message is failed (❌)
+     * rather than held — the accompanying config_error notification tells the user
+     * what to fix, and holding would only build a queue that floods the pane the
+     * moment the flag clears.
+     */
+    refuseFatalStartupDelivery(status) {
+        if (!this.fatalStartupBlocked)
+            return false;
+        this.logger.error("Delivery refused — CLI is parked on a fatal startup screen");
+        if (status)
+            this.emit("message_failed", status); // ❌
+        return true;
+    }
     /**
      * A raw `%output` silence check is authoritative for ordinary TUIs. It is not
      * for a backend such as agy whose status-line hook periodically redraws an
@@ -3614,6 +3762,8 @@ export class Daemon extends EventEmitter {
             // for this turn: the agent proved it can still speak for itself.
             if (!error && result != null && TURN_REPLY_TOOLS.has(tool)) {
                 this.turnOutboundDelivered = true;
+                if (tool === "reply")
+                    this.turnReplyDelivered = true;
             }
             const sent = this.ipcServer?.send(socket, { requestId, result, error }) ?? false;
             if (!sent) {
@@ -4243,7 +4393,10 @@ export class Daemon extends EventEmitter {
         if (!await this.tmux.isWindowAlive())
             return false;
         const ready = await this.dismissDialogsUntilReady(3);
-        if (ready)
+        // A fatal startup screen returns true (the spawn is over — respawning
+        // would only re-show the same screen) but is NOT ready-for-delivery:
+        // fatalStartupBlocked gates every pane write in deliverMessage.
+        if (ready && !this.fatalStartupBlocked)
             this.firstDeliveryDelay.recordReady();
         return ready;
     }
@@ -4266,6 +4419,26 @@ export class Daemon extends EventEmitter {
                 let matched = false;
                 for (const dialog of startupDialogs) {
                     if (dialog.pattern.test(pane)) {
+                        // A fatal startup screen cannot be dismissed by keypresses (e.g. a
+                        // corrupt claude.json modal offering only "exit" / "reset config").
+                        // It must be caught HERE and not fall through to the ready check:
+                        // the modal contains the `❯` selector the ready pattern matches, so
+                        // it would otherwise pass as ready and queued messages would be
+                        // typed into the modal. Report the error (pause stops delivery) and
+                        // stop the retry loop — like the sign-in screen case below, only a
+                        // human fixing the config ends this state.
+                        if (dialog.fatal) {
+                            // Block deliveries BEFORE the emit: the pty_error pause handler
+                            // is async, and a queued message would otherwise win the race
+                            // and be pasted into the modal.
+                            this.fatalStartupBlocked = true;
+                            if (!this.fatalStartupReported) {
+                                this.fatalStartupReported = true;
+                                this.logger.warn({ description: dialog.description }, "Fatal startup screen detected — reporting instead of dismissing");
+                                this.emit("pty_error", { name: this.name, ...dialog.fatal });
+                            }
+                            return true;
+                        }
                         this.logger.debug(`Dismissing startup dialog: ${dialog.description}`);
                         // Restart is exactly when inbound messages pile up, and nothing gates
                         // delivery on `spawning`. Take the pane lock for the key sequence so a
@@ -4298,8 +4471,13 @@ export class Daemon extends EventEmitter {
                 if (matched)
                     continue;
                 // CLI is ready (pattern defined by each backend)
-                if (this.backend.getReadyPattern().test(pane))
+                if (this.backend.getReadyPattern().test(pane)) {
+                    // A real ready prompt (with no fatal dialog on screen — those are
+                    // matched above, before this check) means the fatal screen is gone,
+                    // e.g. the user fixed the config and the instance respawned.
+                    this.fatalStartupBlocked = false;
                     return true;
+                }
                 // A CLI parked at its own sign-in screen is an AUTH incident: no dialog
                 // key can dismiss it and no ready pattern will ever appear. Report it as
                 // an auth error (the lifecycle double-checks with the token-free probe)