@songsid/agend 2.1.4-beta.35 → 2.1.4-beta.37

package/dist/daemon.js

@@ -847,6 +847,17 @@ export class Daemon extends EventEmitter {
     authFailureUnresolved = false;
     /** One login-screen auth report per spawn — the screen persists across polls. */
     loginScreenReported = false;
+    /** A fatal startup screen (see StartupDialog.fatal) was already reported this run. */
+    fatalStartupReported = false;
+    /**
+     * The CLI is parked on a fatal startup screen and every pane write must be
+     * refused. This is deliberately separate from the pause that the reported
+     * pty_error triggers: the pause is applied by an async handler, and a queued
+     * delivery would race it into the modal (where paste+Enter can confirm
+     * "Exit and fix manually"). Set synchronously at dialog-match time; cleared
+     * when a startup scan reaches a real ready prompt, or on wake().
+     */
+    fatalStartupBlocked = false;
     /** model_error seen mid-turn: notify only if it survives to the idle screen. */
     pendingModelErrorKey = null;
     /**
@@ -2337,6 +2348,8 @@ export class Daemon extends EventEmitter {
         this.pausePending = false;
         this.authFailureUnresolved = false;
         this.loginScreenReported = false;
+        this.fatalStartupReported = false;
+        this.fatalStartupBlocked = false;
         if (this.pauseWakeState === "active")
             return;
         if (this.pauseWakeState === "pausing")
@@ -3332,6 +3345,8 @@ export class Daemon extends EventEmitter {
         await this.waitForSpawnToSettle();
         if (cancelled())
             return false;
+        if (this.refuseFatalStartupDelivery(status))
+            return false;
         let windowId = this.getWindowId();
         const supportsQueuedInput = this.backend?.supportsQueuedInput?.() === true;
         let handingOffToNativeQueue = false;
@@ -3373,9 +3388,29 @@ export class Daemon extends EventEmitter {
         return this.paneWriteLock.run(async () => {
             if (cancelled())
                 return false;
+            // Re-checked here because the flag can be set during the waits above
+            // (a spawn's dialog scan runs concurrently with a queued delivery).
+            if (this.refuseFatalStartupDelivery(status))
+                return false;
             return this.writeMessageToPane(formatted, windowId, handingOffToNativeQueue, status);
         });
     }
+    /**
+     * While the CLI is parked on a fatal startup screen (see fatalStartupBlocked),
+     * no pane write may happen: paste+Enter into the corrupt-config modal would
+     * confirm "Exit and fix manually" and exit the CLI. The message is failed (❌)
+     * rather than held — the accompanying config_error notification tells the user
+     * what to fix, and holding would only build a queue that floods the pane the
+     * moment the flag clears.
+     */
+    refuseFatalStartupDelivery(status) {
+        if (!this.fatalStartupBlocked)
+            return false;
+        this.logger.error("Delivery refused — CLI is parked on a fatal startup screen");
+        if (status)
+            this.emit("message_failed", status); // ❌
+        return true;
+    }
     /**
      * A raw `%output` silence check is authoritative for ordinary TUIs. It is not
      * for a backend such as agy whose status-line hook periodically redraws an
@@ -4358,7 +4393,10 @@ export class Daemon extends EventEmitter {
         if (!await this.tmux.isWindowAlive())
             return false;
         const ready = await this.dismissDialogsUntilReady(3);
-        if (ready)
+        // A fatal startup screen returns true (the spawn is over — respawning
+        // would only re-show the same screen) but is NOT ready-for-delivery:
+        // fatalStartupBlocked gates every pane write in deliverMessage.
+        if (ready && !this.fatalStartupBlocked)
             this.firstDeliveryDelay.recordReady();
         return ready;
     }
@@ -4381,6 +4419,26 @@ export class Daemon extends EventEmitter {
                 let matched = false;
                 for (const dialog of startupDialogs) {
                     if (dialog.pattern.test(pane)) {
+                        // A fatal startup screen cannot be dismissed by keypresses (e.g. a
+                        // corrupt claude.json modal offering only "exit" / "reset config").
+                        // It must be caught HERE and not fall through to the ready check:
+                        // the modal contains the `❯` selector the ready pattern matches, so
+                        // it would otherwise pass as ready and queued messages would be
+                        // typed into the modal. Report the error (pause stops delivery) and
+                        // stop the retry loop — like the sign-in screen case below, only a
+                        // human fixing the config ends this state.
+                        if (dialog.fatal) {
+                            // Block deliveries BEFORE the emit: the pty_error pause handler
+                            // is async, and a queued message would otherwise win the race
+                            // and be pasted into the modal.
+                            this.fatalStartupBlocked = true;
+                            if (!this.fatalStartupReported) {
+                                this.fatalStartupReported = true;
+                                this.logger.warn({ description: dialog.description }, "Fatal startup screen detected — reporting instead of dismissing");
+                                this.emit("pty_error", { name: this.name, ...dialog.fatal });
+                            }
+                            return true;
+                        }
                         this.logger.debug(`Dismissing startup dialog: ${dialog.description}`);
                         // Restart is exactly when inbound messages pile up, and nothing gates
                         // delivery on `spawning`. Take the pane lock for the key sequence so a
@@ -4413,8 +4471,13 @@ export class Daemon extends EventEmitter {
                 if (matched)
                     continue;
                 // CLI is ready (pattern defined by each backend)
-                if (this.backend.getReadyPattern().test(pane))
+                if (this.backend.getReadyPattern().test(pane)) {
+                    // A real ready prompt (with no fatal dialog on screen — those are
+                    // matched above, before this check) means the fatal screen is gone,
+                    // e.g. the user fixed the config and the instance respawned.
+                    this.fatalStartupBlocked = false;
                     return true;
+                }
                 // A CLI parked at its own sign-in screen is an AUTH incident: no dialog
                 // key can dismiss it and no ready pattern will ever appear. Report it as
                 // an auth error (the lifecycle double-checks with the token-free probe)