@songsid/agend 2.1.4-beta.6 → 2.1.4-beta.60

package/dist/daemon.d.ts

@@ -6,11 +6,18 @@ import type { CliBackend, InstanceState, InstanceStateSnapshot } from "./backend
 import { HangDetector } from "./hang-detector.js";
 import type { TmuxControlClient } from "./tmux-control.js";
 import type { FleetInstructionsParams } from "./instructions.js";
+import type { SpawnGate } from "./spawn-gate.js";
+import type { StormWindow } from "./storm-window.js";
+import type { BackendOutageView } from "./backend-outage.js";
 /** Point a resumed CLI at its one backend-native instruction source. */
 export declare function buildInstructionReloadNotice(binaryName: string, instanceName: string, instanceDir: string): string;
 export declare const DEFAULT_STUCK_TIMEOUT_MS: number;
 export declare const DEFAULT_STATE_IDLE_DEBOUNCE_MS = 2000;
 export declare const DEFAULT_STATE_SAFETY_SWEEP_MS = 60000;
+/** Coalesce one cosmetic-redraw burst before comparing the visible pane. */
+export declare const PERIODIC_REDRAW_PROBE_MS = 25;
+/** A foreground server/port-forward should hand control back or be acknowledged. */
+export declare const DEFAULT_BLOCKING_PROCESS_GRACE_MS: number;
 /**
  * Whether two working directories belong to the same project, so a fleet-scoped
  * decision recorded in one reaches the other. Covers the worktree/checkout
@@ -62,11 +69,13 @@ export declare function writeLastInboundAt(instanceDir: string, timestamp: numbe
 export declare function renderHandoffMetadata(meta: Record<string, string>): string;
 /** Headless inactivity timer used by the daemon and unit tests. */
 export declare class AutoPauseController {
-    private readonly thresholdMs;
+    private thresholdMs;
     private lastActivityAt;
     private pausedAt;
     constructor(thresholdMs: number, lastActivityAt?: number);
     recordActivity(now?: number): void;
+    /** Apply a new idle threshold and start a fresh countdown from this update. */
+    reconfigure(thresholdMs: number, now?: number): void;
     observe(state: InstanceState, now?: number): boolean;
     markPaused(now?: number): void;
     markAwake(now?: number): void;
@@ -142,10 +151,13 @@ export declare class PaneStateMachine {
      *   working" and a finished turn would not be seen as idle until the next 60s
      *   safety sweep. Output timestamps are the honest liveness signal here, and
      *   the caller has them.
+     * @param opts.forceBusy the backend has positively identified a still-running
+     *   foreground tool even though its TUI keeps an old ready footer visible.
      */
     observe(pane: string, now?: number, opts?: {
         settled?: boolean;
         changeAt?: number;
+        forceBusy?: boolean;
     }): InstanceStateSnapshot;
     /** Record pane motion from tmux control mode without capturing pane content. */
     recordOutput(now?: number): InstanceStateSnapshot;
@@ -163,6 +175,14 @@ export declare class PendingWorkTracker {
     recordIdle(now?: number): void;
     hasPendingWork(): boolean;
 }
+/**
+ * Startup failed because the CLI's backend is unreachable (see backend-outage.ts).
+ * The session-id is deliberately KEPT; the fleet schedules a delayed retry.
+ */
+export declare class BackendUnreachableStartupError extends Error {
+    readonly backend: string;
+    constructor(backend: string);
+}
 /**
  * One-shot timing gate for the first paste after a CLI reaches its ready
  * prompt. A TUI that is still completing its first redraw can swallow Enter.
@@ -237,6 +257,26 @@ export declare function extractProxyReplyText(pane: string, opts?: {
     maxLines?: number;
     maxChars?: number;
 }): string | null;
+export interface MalformedClaudeToolCallDetection {
+    /** Stable, non-secret fingerprint used to suppress a stale pane fragment. */
+    signature: string;
+    /** Sanitized reply argument, or null when only a dangling closing tag survived. */
+    text: string | null;
+}
+/**
+ * Find the narrow Claude XML failure signature reported in #648.
+ *
+ * This intentionally runs only at the daemon's busy→idle edge (the caller
+ * enforces that) and only scans output after the current inbound marker. A
+ * partial tool call while Claude is still streaming is therefore never acted
+ * on. The extracted argument goes through the same credential redaction as the
+ * dead-MCP pane proxy before it can leave the host.
+ */
+export declare function detectMalformedClaudeToolCall(pane: string, opts?: {
+    inboundMarker?: string;
+    maxLines?: number;
+    maxChars?: number;
+}): MalformedClaudeToolCallDetection | null;
 export type InteractivePromptKind = "sudo_password" | "password" | "confirmation" | "press_enter";
 export interface InteractivePromptDetection {
     kind: InteractivePromptKind;
@@ -258,6 +298,30 @@ export declare class InteractivePromptDetector {
     observe(pane: string, now?: number, outputAt?: number): InteractivePromptDetection | null;
     reset(): void;
 }
+export interface BlockingProcessDetection {
+    activity: string;
+    evidence: string;
+    blockedForMs: number;
+}
+/**
+ * Detect a foreground shell tool which has become a long-lived server.
+ *
+ * Unlike the generic pane-stuck clock, this clock deliberately survives new
+ * output: access logs and `Handling connection` lines are exactly why a
+ * foreground server can remain blocked forever without ever looking silent.
+ * Once a server marker is seen, the still-running tool identity is the stable
+ * signal; the marker may scroll out of the 32-row pane.
+ */
+export declare class BlockingProcessDetector {
+    private readonly graceMs;
+    private activity;
+    private evidence;
+    private detectedAt;
+    private notified;
+    constructor(graceMs?: number);
+    observe(pane: string, activity: string | null, now?: number): BlockingProcessDetection | null;
+    reset(): void;
+}
 export declare class Daemon extends EventEmitter {
     private name;
     private config;
@@ -266,6 +330,10 @@ export declare class Daemon extends EventEmitter {
     private backend?;
     private controlClient?;
     private runtimeIdentity?;
+    private spawnGate?;
+    private stormWindow?;
+    /** Fleet-level "is this CLI's backend down?" memory — see backend-outage.ts. */
+    private backendOutage?;
     private logger;
     private tmuxSessionName;
     private tmux;
@@ -275,6 +343,13 @@ export declare class Daemon extends EventEmitter {
     private guardian;
     private adapter;
     private pendingIpcRequests;
+    /**
+     * Daemon-global request sequence. MCP request ids are only process-local:
+     * Claude can have more than one MCP child connected to the same daemon and
+     * each starts at 1, so using requestId alone lets one caller steal another's
+     * response.
+     */
+    private fleetRequestSeq;
     private lastChatId;
     private lastThreadId;
     private lastAdapterId;
@@ -282,9 +357,6 @@ export declare class Daemon extends EventEmitter {
     /** Last activity published to the fleet manager; null when nothing is running. */
     private currentActivity;
     private socketSessionNames;
-    private static tmuxServerCrashTimestamps;
-    private static tmuxServerPaused;
-    private static tmuxServerRecoveryTimer;
     private healthCheckTimer;
     private crashCount;
     private lastCrashAt;
@@ -305,6 +377,12 @@ export declare class Daemon extends EventEmitter {
     private resolveSpawnSettled;
     private spawnDepth;
     private skipResume;
+    private startupAborted;
+    /** First time the current on-screen blocking dialog was seen (0 = none); drives the parked report. */
+    private dialogParkedSince;
+    /** Identity of that dialog: its pattern, not its description (two tables may describe one screen differently). */
+    private dialogParkedKey;
+    private dialogParkedReported;
     private backgroundSessionRecoveryAttempted;
     /** Whether the last spawn started a fresh session (not resumed). */
     isNewSession: boolean;
@@ -317,6 +395,7 @@ export declare class Daemon extends EventEmitter {
     /** Fallback safety sweep used only when no shared tmux control client exists. */
     private instanceStateMonitorTimer;
     private instanceStateIdleTimer;
+    private instanceStateOutputProbeTimer;
     private instanceStateStuckTimer;
     private instanceStateOutputListener;
     private instanceStateOutputEventName;
@@ -331,8 +410,12 @@ export declare class Daemon extends EventEmitter {
     private statePollInFlight;
     private turnHadInbound;
     private turnOutboundDelivered;
+    /** Successful `reply` specifically; cross-instance tools do not satisfy #648. */
+    private turnReplyDelivered;
     private turnCorrelationId;
     private turnInboundMarker;
+    /** Prevent a visible stale XML fragment from being recovered on later turns. */
+    private lastMalformedToolCallSignature;
     private proxyReplySeq;
     private autoPauseController;
     private pauseRequested;
@@ -343,6 +426,35 @@ export declare class Daemon extends EventEmitter {
      * would silently no-op exactly when we most need to stop feeding the CLI.
      */
     private pausePending;
+    /**
+     * An auth failure was detected and nothing has resolved it yet.
+     *
+     * Separate from `pausePending` because it must outlive it: the deferred pause
+     * clears `pausePending` as soon as it fires, but if that pause is refused the
+     * instance is still auth-broken and must not resume raising alarms.
+     */
+    private authFailureUnresolved;
+    /** One login-screen auth report per spawn — the screen persists across polls. */
+    private loginScreenReported;
+    /** A fatal startup screen (see StartupDialog.fatal) was already reported this run. */
+    private fatalStartupReported;
+    /**
+     * The CLI is parked on a fatal startup screen and every pane write must be
+     * refused. This is deliberately separate from the pause that the reported
+     * pty_error triggers: the pause is applied by an async handler, and a queued
+     * delivery would race it into the modal (where paste+Enter can confirm
+     * "Exit and fix manually"). Set synchronously at dialog-match time; cleared
+     * when a startup scan reaches a real ready prompt, or on wake().
+     */
+    private fatalStartupBlocked;
+    /** model_error seen mid-turn: notify only if it survives to the idle screen. */
+    private pendingModelErrorKey;
+    /**
+     * Let the next pause() proceed from a stuck pane. Set only for the auth-deferred
+     * pause — see the pausePending consumption site for why waiting for idle there
+     * is waiting forever.
+     */
+    private pauseAllowStuck;
     private pauseWakeState;
     private pauseWakeTransition;
     private modelOverride;
@@ -354,6 +466,12 @@ export declare class Daemon extends EventEmitter {
      *  and ⏳/👀/✅ reactions live here). It does NOT cover the other writers that
      *  reach the pane — {@link paneWriteLock} does. */
     private pasteLock;
+    /**
+     * Fleet cancellation epoch. Queue entries retain the epoch they arrived with;
+     * advancing it invalidates only work received before the cancel, never a new
+     * user message which arrives immediately afterwards.
+     */
+    private deliveryEpoch;
     /** Mutual exclusion for *every* write into the pane, whichever subsystem it
      *  comes from. See PaneWriteLock for why interleaving is destructive. */
     private readonly paneWriteLock;
@@ -363,8 +481,20 @@ export declare class Daemon extends EventEmitter {
     private lastBuiltInstructions;
     private pasteQueueDepth;
     private firstDeliveryDelay;
+    /** Orders /steer pastes against each other. Deliberately NOT pasteLock:
+     *  a steer must not queue behind the normal deliveries it exists to
+     *  overtake. Pane-level exclusion still comes from paneWriteLock inside
+     *  deliverMessage, so a steer and a normal delivery can never interleave
+     *  their PTY writes — the steer just doesn't wait for idle. */
+    private steerLock;
+    /** Tool lines shown in the channel processing bubble for the current turn. */
+    private readonly turnProgress;
+    private lastProgressBroadcast;
+    private progressBroadcastTimer;
+    private lastProgressBroadcastAt;
     private errorMonitorTimer;
     private readonly interactivePromptDetector;
+    private readonly blockingProcessDetector;
     /** Same 5-min gate the error monitor uses, so a dead MCP server alerts once. */
     private static readonly MCP_DEATH_COOLDOWN_MS;
     private lastMcpDeathNotifiedAt;
@@ -376,6 +506,16 @@ export declare class Daemon extends EventEmitter {
      * past this point interrupting the turn costs less than staying mute.
      */
     private static readonly MCP_RESTART_MAX_WAIT_MS;
+    /**
+     * How long the revival restart waits, at the point of firing, for a
+     * CLI-respawned MCP server to announce itself.
+     *
+     * Codex <0.146 tears down and recreates ALL MCP connections on an auth/config
+     * change — healthy ones included — so the daemon sees the old pid die while
+     * the CLI is fine and a replacement is seconds away. Module load measured
+     * ~0.36s, so 2s is roughly 5x headroom without making a genuine loss wait.
+     */
+    private static readonly MCP_REPLACEMENT_GRACE_MS;
     /**
      * Sticky "restart to revive the MCP server as soon as the pane idles" — same
      * shape as pausePending, because the death is usually detected mid-turn when
@@ -384,6 +524,25 @@ export declare class Daemon extends EventEmitter {
      */
     private mcpRestartPending;
     private mcpRestartStaleTimer;
+    /** In-flight replacement grace; also the guard against three triggers stacking. */
+    private mcpRestartGraceTimer;
+    /**
+     * Which trigger the in-flight grace will commit under.
+     *
+     * The single-timer guard would otherwise SWALLOW a stale_timeout that lands
+     * during an idle-gated grace — and because the stale timer is one-shot and
+     * already cleared itself, the 30-minute backstop would be gone for good on an
+     * instance that never idles, which is the exact case it exists for.
+     */
+    private mcpRestartGraceTrigger;
+    /**
+     * A dead-MCP sighting held back once, pending a possible replacement.
+     *
+     * Deliberately NOT the same field as `mcpDeathNotifiedForPid`: deferring must
+     * not consume the once-per-pid budget, or a suspicion that turns out to be a
+     * real loss could never be reported at all.
+     */
+    private mcpDeathDeferredForPid;
     /** Prevent in-flight monitor callbacks from re-arming after a pause. */
     private runtimeMonitorsFrozen;
     private errorWaitingForRecovery;
@@ -410,7 +569,9 @@ export declare class Daemon extends EventEmitter {
     private lastDetectedErrorType;
     private static errorPatternKey;
     private clearErrorRecoveryGate;
-    constructor(name: string, config: InstanceConfig, instanceDir: string, topicMode?: boolean, backend?: CliBackend | undefined, controlClient?: TmuxControlClient | undefined, rootLogger?: Logger, runtimeIdentity?: FleetInstructionsParams["runtimeIdentity"]);
+    constructor(name: string, config: InstanceConfig, instanceDir: string, topicMode?: boolean, backend?: CliBackend | undefined, controlClient?: TmuxControlClient | undefined, rootLogger?: Logger, runtimeIdentity?: FleetInstructionsParams["runtimeIdentity"], spawnGate?: SpawnGate | undefined, stormWindow?: StormWindow | undefined, 
+    /** Fleet-level "is this CLI's backend down?" memory — see backend-outage.ts. */
+    backendOutage?: BackendOutageView | undefined);
     start(): Promise<void>;
     /**
      * Detect a CRASHED MCP server and report it once.
@@ -426,7 +587,22 @@ export declare class Daemon extends EventEmitter {
      * process would have no client reading it. Only the CLI can restore its own
      * tools — hence notify, and let the operator decide about restarting.
      */
+    /**
+       * An MCP server has connected and announced itself.
+       *
+       * Beyond the existing session bookkeeping this is the earliest evidence that
+       * tools are back — roughly 30s ahead of the next health tick, which is
+       * exactly the window #663's false restarts fired in.
+       */
+    private handleMcpReady;
     private checkMcpServerAlive;
+    /**
+     * Whether a dead MCP pid on this backend is more likely a CLI-driven
+     * replacement than a real loss. Codex only, and deliberately narrow: it is
+     * the backend whose released fix (0.146) confirms it tore down healthy MCP
+     * connections alongside the one it meant to restart.
+     */
+    private suspectsTransientMcpReplacement;
     /**
      * Arm an automatic instance restart to revive a dead MCP server. Fires on the
      * next busy→idle edge — or immediately when the pane is already idle, which is
@@ -435,7 +611,36 @@ export declare class Daemon extends EventEmitter {
      * force-restarted: see that constant for why staying mute costs more.
      */
     private armMcpRestartWhenIdle;
+    /**
+     * Single chokepoint for all three revival triggers (already_idle, idle_edge,
+     * stale_timeout) — and therefore the one place worth re-checking reality.
+     *
+     * The pending flag is armed by a health tick that saw the OLD pid die, and
+     * was previously fired without ever looking again. When a CLI legitimately
+     * respawns its own MCP child, the replacement is already serving by the time
+     * the turn ends — but the idle edge fires inside the ~30s before the next
+     * health tick can stand the request down, restarting a healthy instance. One
+     * external user was restarted 18 times in two days this way (#663).
+     *
+     * Re-reading here is safe for every backend: worst case it clears a pending
+     * restart that should not have existed.
+     */
     private fireMcpRestartRequest;
+    /**
+     * A recovery is already reshaping the CLI: crash-loop handling
+     * (healthCheckPaused), a respawn in flight (spawning), or a pause
+     * (isPaused / frozen monitors). Each ends in a fresh CLI — and with it a
+     * fresh MCP server — or in supervision ending, where a restart on top would
+     * fight the recovery. Either way the revival restart is moot.
+     */
+    private mcpRestartCancelledByRecovery;
+    /**
+     * Emit a dead-MCP report that was held back as a suspected replacement, once
+     * it is clear no replacement is coming. Consumes the once-per-pid budget
+     * here — deferring was to avoid spending it on a false alarm, not to drop
+     * the incident.
+     */
+    private reportDeferredMcpDeath;
     private clearMcpRestartRequest;
     private startHealthCheck;
     /**
@@ -469,6 +674,8 @@ export declare class Daemon extends EventEmitter {
     private startErrorMonitor;
     /** Evaluate one pane snapshot. Kept synchronous so state-machine edges are unit-testable. */
     private evaluateErrorPatterns;
+    /** Arm the recovery gates and emit one detected error pattern. */
+    private emitErrorPattern;
     /**
      * Notification text for a detected pattern. `formatMessage` patterns build it
      * from the match so the user gets the specifics (e.g. which period and what
@@ -490,12 +697,37 @@ export declare class Daemon extends EventEmitter {
      * that message, which is what the user asked for anyway.
      */
     sendEscape(): Promise<void>;
+    /**
+     * Drop every not-yet-started pane delivery which predates a user cancel.
+     * Promise chains cannot be removed, so entries become generation-checked
+     * no-ops. An entry already past its check is allowed to finish its current PTY
+     * transaction; the interrupt key still cancels the CLI generation.
+     */
+    clearPendingDeliveries(fleetEpoch?: number): void;
+    private captureDeliveryEpoch;
+    private isDeliveryEpochCurrent;
+    private queueRawPaste;
+    /**
+     * Confirm a backend's terminal-level /clear prompt after the channel-level
+     * admin confirmation has already succeeded. Poll instead of pasting `/clear\ny`
+     * as one buffer: Kiro versions that clear immediately interpret that queued
+     * `y` as a brand-new user message.
+     */
+    private confirmBackendClearDialog;
     /** Send the backend-specific graceful quit command/key sequence. */
     private sendQuitSequence;
     stop(): Promise<void>;
     getHangDetector(): HangDetector | null;
     getInstanceState(): InstanceState | "paused";
     getInstanceStateSnapshot(): InstanceStateSnapshot;
+    /**
+     * Answer a FleetManager state query. Most callers only need the cached state,
+     * but lifecycle decisions such as post-reply Cancel retirement need an
+     * authoritative pane observation: after startup the last transition can stay
+     * "working" even though the CLI has since settled without emitting another
+     * control-mode output record.
+     */
+    private respondToInstanceStateQuery;
     /** Gracefully stop the CLI while keeping its remain-on-exit tmux window. */
     /**
      * Mark the instance to pause as soon as its pane is idle. Used for auth
@@ -522,9 +754,21 @@ export declare class Daemon extends EventEmitter {
      * here (edge-triggered, then reset) is what makes it at most once per turn.
      */
     private maybeProxyReplyOnTurnEnd;
+    private isClaudeCodeBackend;
     /** Relay the pane's final text to the channel, marked as a daemon proxy reply. */
     private sendProxyReply;
+    /** Send a narrowly extracted #648 reply; operator notification is a separate event. */
+    private sendRecoveredMalformedReply;
+    /** Context-bound reply path shared by dead-MCP and malformed-call recovery. */
+    private deliverDaemonReply;
     private clearInstanceStateIdleTimer;
+    private clearInstanceStateOutputProbeTimer;
+    /**
+     * Periodic status-line hooks can generate `%output` without changing a single
+     * visible cell. Probe the pane once per burst: a changed capture is real work;
+     * an identical ready capture remains idle and emits no state edge.
+     */
+    private scheduleInstanceStateOutputProbe;
     private clearInstanceStateStuckTimer;
     private scheduleInstanceStateStuckDeadline;
     private scheduleInstanceStateIdleCapture;
@@ -543,14 +787,48 @@ export declare class Daemon extends EventEmitter {
      * Tell the fleet manager what this instance is doing right now, for the live
      * progress line on the cancel button.
      *
-     * Purely cosmetic — nothing decides anything from it, so it is fine that only
-     * backends with a transcript feed report at all (claude-code today). For the
-     * rest the progress line keeps showing just elapsed time.
+     * Primarily cosmetic. The foreground-process detector also uses a current
+     * shell activity as one of several positive signals, but never makes a state
+     * decision from an arbitrary activity label alone.
      *
      * Repeats are dropped: the ticker only edits the channel message when the text
      * changes, and a stream of identical broadcasts would defeat that.
      */
     private publishActivity;
+    /** Effective tool_progress level, hardened against junk config values.
+     *  Off unless explicitly enabled: an update must never make bubbles start
+     *  listing tool activity the operator did not ask to broadcast. */
+    private toolProgressLevel;
+    /**
+     * Apply a tool-progress setting without restarting the CLI session.
+     *
+     * Drop the current accumulator at the boundary: verbose entries may contain
+     * command previews which must not survive a downgrade to standard/off, and a
+     * newly enabled level should start with a clean, internally consistent list.
+     */
+    updateToolProgress(level: InstanceConfig["tool_progress"]): void;
+    /** Snapshot the configuration actually owned by this live daemon. */
+    getConfigSnapshot(): InstanceConfig;
+    /**
+     * Apply the whitelisted hot configuration carried by FleetManager IPC.
+     * null removes an optional value; invalid/unlisted fields are ignored rather
+     * than allowing another client on the per-instance socket to mutate cold
+     * process/session settings.
+     */
+    applyConfigUpdate(value: unknown): void;
+    /**
+     * Accumulate one semantic progress line for the channel bubble and schedule
+     * a coalesced broadcast. Separate from publishActivity on purpose: that one
+     * is the single-line statusline detail (terse, operator-facing), this is the
+     * multi-line channel list (semantic, argument-free at `standard`) — see
+     * tool-progress.ts for why the two labellers must not merge.
+     */
+    private recordToolProgress;
+    /** Coalesce progress broadcasts: at most one per 3s, trailing edge kept. */
+    private scheduleProgressBroadcast;
+    private broadcastToolProgress;
+    /** New turn (or turn over): drop the list and tell the fleet to clear it. */
+    private resetToolProgress;
     /**
      * Options for every system-initiated paste (startup notice, session snapshot,
      * runtime-dialog keys).
@@ -562,12 +840,46 @@ export declare class Daemon extends EventEmitter {
      */
     private systemPasteOptions;
     private summarizeTool;
+    /**
+     * The one place an inbound message grows its metadata wrapper ([user:]/
+     * [from:] prefix, pending reactions, handoff metadata, reply instructions).
+     * Both the normal queued path (pushChannelMessage) and /steer go through
+     * here — a steered message must read EXACTLY like a queued one to the
+     * agent, or the two drift apart in what the agent is told about replying.
+     */
+    private formatInboundMessage;
+    /** Tell the fleet when an already-accepted cross-instance pane write failed. */
+    private reportCrossInstanceDeliveryFailure;
+    /**
+     * /steer: interject into the CURRENT turn instead of queueing for idle.
+     *
+     * Differences from pushChannelMessage, and nothing else:
+     *  - serialized on steerLock, not pasteLock — it may overtake current work,
+     *    but never an ordinary delivery already queued ahead of it
+     *  - deliverMessage runs with { steer: true }, which takes the busy branch
+     *    that pastes immediately (the codex native-queue transaction) instead of
+     *    waiting for idle. Verification and silent-loss fallback are the ones
+     *    that path already has: pane-capture visibility check, then one
+     *    idle-gated redelivery — so on a TUI that swallows busy input the steer
+     *    degrades to "next message after this turn", never silently vanishes.
+     *
+     * The steered text goes through formatInboundMessage so the agent sees a
+     * normal inbound message, with a steering notice prepended for context.
+     */
+    steerMessage(content: string, meta: Record<string, string>, deliveryEpoch?: number): void;
+    /**
+     * /btw: submit a separately-labelled side question immediately while asking
+     * the agent not to change the active task. Claude's native `/btw` opens a
+     * branchAndResume panel whose answer never reaches the channel or transcript,
+     * so channel delivery intentionally uses a normal wrapped inbound instead.
+     */
+    btwMessage(content: string, meta: Record<string, string>, deliveryEpoch?: number): void;
     /**
      * Push an inbound channel message to a specific MCP session.
      * If targetSession is provided, only send to the matching socket.
      * Otherwise send to the instance's own session (this.name).
      */
-    pushChannelMessage(content: string, meta: Record<string, string>, _targetSession?: string): void;
+    pushChannelMessage(content: string, meta: Record<string, string>, _targetSession?: string, deliveryEpoch?: number): void;
     /**
      * Deliver a single message and drive its status reactions:
      *   ⏳ message_queued    — CLI busy; queued locally or by the backend
@@ -585,6 +897,121 @@ export declare class Daemon extends EventEmitter {
      * serial in both cases so separate PTY writes can never overlap.
      */
     private deliverMessage;
+    /**
+     * The runtime dialogs that hold delivery while on screen (`blocksDelivery`
+     * or `holdOnly`). One canonical list and order, shared by the delivery gate
+     * and the runtime scanner, so both observers agree on which dialog they see.
+     * Startup-only patterns are deliberately excluded: several of them are loose
+     * on purpose ("I trust", "Yes, continue") and would match ordinary prose.
+     */
+    private deliveryBlockingDialogs;
+    private static dialogKey;
+    /** A dialog counts only when it is the CURRENT interactive region, if the backend can tell; else by pattern. */
+    private static dialogMatches;
+    /**
+     * Tri-state liveness. tmux's own isWindowAlive folds every query failure
+     * into `false`, so a transient tmux hiccup would read as "the CLI died" —
+     * and callers that clear the session on death must not act on that.
+     * getPaneStatus returns null on a failed/ambiguous query and a definite
+     * `{alive:false}` for a dead pane; only the latter is evidence.
+     */
+    private paneLiveness;
+    /**
+     * Capture the pane and classify it. "unknown" (capture failed) is a distinct
+     * outcome on purpose: the resume dialog is silent, so silence cannot vouch
+     * for the pane, and treating an unreadable pane as clear is exactly the
+     * fail-open that answers a dialog with its default. Callers retry unknown
+     * within a bound and then fail loudly.
+     */
+    private probeBlockingDialog;
+    /**
+     * Remember how long a blocking dialog has been on screen. Once it has
+     * outlived DIALOG_PARKED_NOTIFY_MS — the auto-dismiss did not take, or the
+     * dialog is a hold-only variant — report it ONCE so a human answers it.
+     * Never presses a key: the whole point is that we do not know which option
+     * is safe. Identity is the pattern, so the delivery gate and the runtime
+     * scanner (same canonical list) never reset each other's clock.
+     */
+    private trackDialogParked;
+    /**
+     * Bottom-anchored readiness for TUIs that drop Enter while busy (see
+     * CliBackend.dropsEnterWhileBusy). Output silence is necessary but not
+     * sufficient for them: Kiro paints nothing for the whole duration of a shell
+     * or MCP tool call (and for each 10s backend retry), yet an Enter arriving
+     * then is discarded. Reproduced deterministically: `sleep 9` tool, paste at
+     * t+6s → text stranded in the prompt row, next message submitted both.
+     * Other backends keep the silence-based gate byte-for-byte.
+     */
+    private isPaneReadyForDelivery;
+    /**
+     * Why a pane is not deliverable matters. "busy" may be handed to a native
+     * input queue or steered (after its own dialog probe); "dialog" and "unknown"
+     * must never be — a paste + Enter into a dialog answers it with its default,
+     * and an unreadable pane proves nothing. The silence gate comes first and
+     * costs no capture, so a CLI that is simply working never pays for the probe.
+     */
+    private paneReadinessForDelivery;
+    /**
+     * Like waitForPaneIdleForDelivery, plus the bottom-anchored prompt check for
+     * Enter-dropping TUIs. Polls at a coarse cadence (each poll is a capture-pane)
+     * only after the pane is already quiet, so the common fast-idle delivery still
+     * costs a single capture.
+     */
+    private waitForPaneReadyForDelivery;
+    /**
+     * F3: if an AgEnD message is sitting unsubmitted in the input row (a previous
+     * delivery's Enter was dropped), submit it with one bare Enter under the pane
+     * lock. Only acts on a positive signature — the `[user:`/`[from:` marker every
+     * pasted message carries — never on Kiro's own placeholder hints.
+     *
+     * Outcomes: "idle" = positively verified nothing stranded (the caller may
+     * paste); "submitted" = an Enter went out for the stranded text; "busy" = the
+     * pane is not at its prompt or could not be read (the caller must wait for
+     * the prompt and run this check AGAIN before pasting — never assume someone
+     * else submitted it); "failed" = the Enter could not be sent (the delivery
+     * must fail rather than paste on top of the stranded text).
+     */
+    private submitStrandedInputIfAny;
+    /**
+     * "stranded": an AgEnD message sits in the input row; "clear": the prompt is
+     * at the bottom with no stranded text; "busy": generating, or the prompt is
+     * not at the bottom (incl. a blank frame); "unknown": the pane could not be
+     * read. Only "clear" is positive evidence.
+     */
+    private strandedInputState;
+    /**
+     * F2: for Enter-dropping TUIs, "some output after Enter" proves nothing — the
+     * turn that made the pane look idle keeps producing output. Confirm the
+     * SUBMISSION instead: the pasted text is gone from the input row ("absent"),
+     * or the TUI's own busy marker is up. "unknown" = the pane could not be read;
+     * it never counts as confirmed.
+     */
+    private pasteResidue;
+    /**
+     * Submission = the legacy idle→busy output signal AND the pasted text has
+     * verifiably left the input row. The first alone is what produced false ✅s:
+     * the turn that made the pane look idle keeps emitting output after our
+     * (dropped) Enter — and an unreadable pane is not a verified absence either.
+     */
+    private confirmSubmittedAfterEnter;
+    /**
+     * While the CLI is parked on a fatal startup screen (see fatalStartupBlocked),
+     * no pane write may happen: paste+Enter into the corrupt-config modal would
+     * confirm "Exit and fix manually" and exit the CLI. The message is failed (❌)
+     * rather than held — the accompanying config_error notification tells the user
+     * what to fix, and holding would only build a queue that floods the pane the
+     * moment the flag clears.
+     */
+    private refuseFatalStartupDelivery;
+    /**
+     * A raw `%output` silence check is authoritative for ordinary TUIs. It is not
+     * for a backend such as agy whose status-line hook periodically redraws an
+     * identical screen. In that case trust an idle pane-state snapshot only when
+     * it was captured after both the latest output and the latest control-client
+     * observation reset.
+     */
+    private isPaneIdleForDelivery;
+    private waitForPaneIdleForDelivery;
     /**
      * The write half of a delivery: paste → Enter → confirm, with retries.
      *
@@ -661,6 +1088,49 @@ export declare class Daemon extends EventEmitter {
     private waitForSpawnToSettle;
     /** Spawn a CLI window. Returns true if --resume was used successfully. */
     private spawnClaudeWindow;
+    /**
+     * Startup budget for this launch: the backend's override (resume-aware), never
+     * below a user-configured startup_timeout_ms; undefined = trySpawn's default.
+     */
+    private startupBudgetFor;
+    /** Effective wake budget = max(caller timeout, backend resume override, configured startup_timeout_ms). */
+    wakeBudgetMs(timeoutMs: number): number;
+    /** The fleet-level backend key this instance runs on (matches the lifecycle's backendOf). */
+    private backendKey;
+    /**
+     * After a failed launch, read the pane for the backend's fleet-wide outage
+     * text (e.g. kiro's `dispatch failure (timeout) … kiro.dev`) and record it.
+     * The lifecycle only learns about outages from RUNNING instances; during a
+     * post-update herd nothing is running yet, so the startup path must report
+     * what it sees or the first instance in would clear its session for nothing.
+     */
+    private noteStartupPaneForBackendOutage;
+    /**
+     * Fail the startup WITHOUT touching the session while the backend is known to
+     * be down. The failed window is torn down first: the alternative — a live but
+     * never-ready CLI left behind while the daemon reports `crashed` — would keep
+     * the health monitor from ever seeing a dead pane and retrying.
+     */
+    private failStartupIfBackendUnreachable;
+    /**
+     * Crash-respawn ran into the backend outage: the ordinary path would leave
+     * `crashed` + a paused monitor + nothing scheduled (and count it as a crash).
+     * Hand the instance to the fleet instead — the lifecycle stops this daemon
+     * and the fleet's delayed startup retry re-creates it later with the session
+     * intact. Returns true when someone took the hand-off.
+     */
+    private handOffBackendUnreachableRespawn;
+    /**
+     * Dispose a Daemon whose start() rejected. The lifecycle registers a daemon
+     * only after start() resolves, so nothing else owns this object — and by the
+     * time the spawn fails it has already bound its IPC server (channel.sock),
+     * written daemon.pid and possibly created a window. Left alone, each failed
+     * start leaks one live-but-unreachable server handle (the next start unlinks
+     * the socket path and binds a new one), multiplied by the automatic startup
+     * retries. Idempotent, and fast: no graceful CLI quit, the CLI never reached
+     * its prompt.
+     */
+    abortStartup(): Promise<void>;
     /** Kill the entire process tree of the current tmux pane (CLI + MCP server). */
     private killProcessTree;
     /**
@@ -670,9 +1140,34 @@ export declare class Daemon extends EventEmitter {
      * Returns true if CLI is ready, false if it failed or got stuck.
      */
     private trySpawn;
+    private trySpawnInsideGate;
+    /**
+     * The last leg of a spawn: confirm the pane is not positively dead, then run
+     * the dialog scan. The old pre-check used tmux's isWindowAlive(), which folds
+     * every query failure into `false` — so one transient tmux error right here
+     * read as "the CLI died", the caller abandoned --resume and cleared the
+     * session, before the tri-state scanner ever got a look. Only a POSITIVE
+     * dead pane fails; an unknown liveness is the scanner's problem (bounded,
+     * session-preserving).
+     */
+    private finishStartupScan;
     /**
-     * Repeatedly check pane content, dismiss any confirmation dialogs,
-     * and return true once CLI reaches a ready prompt.
+     * Poll the pane within a wall-clock budget, dismiss the confirmation dialogs
+     * the backend knows, and return true once the CLI shows a ready prompt with
+     * no dialog on screen for two consecutive polls.
+     *
+     * Polls are spaced by `pollMs` and every key sequence / render wait counts
+     * against the budget: Claude paints its session-resume prompt only after
+     * loading the session, i.e. AFTER the first quiet moment, and three
+     * back-to-back captures used to miss it — the scan then "assumed ok", the
+     * `❯` inside the dialog satisfied the ready pattern, and the instance sat on
+     * the dialog with deliveries free to press Enter into it.
+     *
+     * Only hard evidence returns false: a dead window or "command not found".
+     * A transient capture failure is logged and retried; exhausting the budget is
+     * logged at WARN and returns true — false makes the caller abandon --resume
+     * and clear the session, which is the loss this code exists to prevent. The
+     * delivery gate keeps refusing pastes while a blocking dialog is visible.
      */
     private dismissDialogsUntilReady;
     /**