@songsid/agend 2.2.0-alpha.1 → 2.2.0-alpha.3

package/dist/daemon.js

@@ -11,6 +11,7 @@ import { clearPausedMarker, writePausedMarker } from "./pause-marker.js";
 import { TmuxManager, resolveTmuxLogicalSize } from "./tmux-manager.js";
 import { TranscriptMonitor } from "./transcript-monitor.js";
 import { createTranscriptSource } from "./transcript-sources.js";
+import { TranscriptTurnLedger } from "./transcript-turns.js";
 import { credentialProfileStoreHome, resolveCredentialProfile } from "./backend/credential-profile.js";
 import { resolveToolSet } from "./tool-permissions.js";
 import { getAgendHome } from "./paths.js";
@@ -25,6 +26,7 @@ import { MessageBus } from "./channel/message-bus.js";
 import { shellQuote, UnsupportedCliError } from "./backend/types.js";
 import { getTmuxSession } from "./config.js";
 import { routeToolCall } from "./channel/tool-router.js";
+import { parseReplyButtons, replyButtonsFallbackText } from "./reply-buttons.js";
 import { HangDetector } from "./hang-detector.js";
 import { writeSecretFile } from "./secret-file.js";
 import { PaneWriteLock } from "./pane-write-lock.js";
@@ -69,6 +71,12 @@ const REPLY_DROP_WARNING_COOLDOWN_MS = 5 * 60_000;
  * backstop is delayed by at most this window, never disabled.
  */
 const REPLY_GUARD_IDLE_CONFIRM_MS = 60_000;
+/**
+ * #1510: how long an idle pane may be held because the transcript still shows the turn running. A turn whose end is
+ * never written (the CLI killed, the rollout replaced) would otherwise be re-checked for ever; past this it stands
+ * down like a turn the transcript cannot place — never a recovery.
+ */
+const TRANSCRIPT_RUNNING_HOLD_MAX_MS = 30 * 60_000;
 const REPLY_RECOVERY_PROMPT = "[system:reply-required] The previous human-facing turn ended without a successfully delivered reply. Do not redo the work. React with an emoji or use the reply tool exactly once now to send the user a concise conclusion. If no substantive answer is needed, a brief react is sufficient. If you already replied to this message, do nothing. Do not reply to this system instruction except through the react or reply tool.";
 /** Point a resumed CLI at its one backend-native instruction source. */
 /** The outbox evidence for a delivery the CLI's transcript shows taken (#758; #1201 absorbed). */
@@ -644,6 +652,8 @@ const CONFIRM_BUSY_POLL_MS = 200;
  * hold the pane write lock along with it.
  */
 const CONFIRM_BUSY_MAX_WAIT_MS = 10_000;
+/** How much longer a confirmation waits while the control client is blind (a drained read; its limit is 10 s). */
+const CONFIRM_BUSY_BLIND_EXTRA_MS = 12_000;
 /**
  * How long a delivery waits for an in-flight spawn. Comfortably past the default
  * 25s startup timeout plus dialog dismissal; past it we fall back to the old
@@ -1168,6 +1178,8 @@ export class Daemon extends EventEmitter {
     /** Generation/signature fence for safety dialogs while their screen is still visible. */
     autoResolvedDialogKey = null;
     autoResolvedDialogGeneration = 0;
+    /** Per-launch safety phases survive startup handoff, redraws and failed/uncertain key ACKs. */
+    launchDialogClaims = null;
     /**
      * (#1103) Proof that THIS spawn's Codex went onto Luna Reserve: AgEnD saw (and
      * answered) the usage-limit menu that codex shows when it switches itself to
@@ -1223,6 +1235,10 @@ export class Daemon extends EventEmitter {
     // It also supplies the older dead-MCP/malformed-call recovery paths, so those
     // paths cannot disagree about whether the turn already spoke to the channel.
     turnReplyGuard = new TurnReplyGuard();
+    /** #1510: turn boundaries from the CLI's transcript, for a backend whose guard reads its turn end there. */
+    transcriptTurns = new TranscriptTurnLedger();
+    /** #1510: since when (monotonic) this generation has been held as running in the transcript. */
+    transcriptRunningSince = null;
     /** Prevent a visible stale XML fragment from being recovered on later turns. */
     lastMalformedToolCallSignature;
     proxyReplySeq = 0;
@@ -2176,7 +2192,7 @@ export class Daemon extends EventEmitter {
             // (statusline transcript); codex/kiro/opencode read their CLI's own
             // conversation store via a pluggable source. Backends with no known
             // source stay inert exactly as before.
-            this.transcriptMonitor = new TranscriptMonitor(this.instanceDir, this.logger, createTranscriptSource(this.config.backend ?? "claude-code", this.config.working_directory, this.credentialProfileStore()));
+            this.transcriptMonitor = this.buildTranscriptMonitor(createTranscriptSource(this.config.backend ?? "claude-code", this.config.working_directory, this.credentialProfileStore()));
             const transcriptMonitor = this.transcriptMonitor;
             const transcriptFence = this.launchFenceEpoch;
             // Baseline in the isolate before this daemon accepts new work. A
@@ -3166,8 +3182,9 @@ export class Daemon extends EventEmitter {
         const readyPattern = this.backend.getReadyPattern();
         const busyPattern = this.backend.getBusyPattern?.() ?? null;
         this.errorMonitorTimer = setInterval(async () => {
-            if (!this.tmux || this.spawning)
+            if (!this.tmux || this.spawning || this.deliveryWritesStopping)
                 return;
+            const pollTmux = this.tmux;
             // This poll belongs to the spawn and the monitors it started under. Every await below can outlive them (a stop,
             // a pause, a respawn); a stale poll must not touch state a newer one owns, so it checks before committing.
             const pollSpawn = this.spawnGeneration;
@@ -3176,18 +3193,19 @@ export class Daemon extends EventEmitter {
             const captureOrder = ++this.interactionCaptureSerial;
             const captureMono = performance.now();
             const stale = () => pollSpawn !== this.spawnGeneration || pollFence !== this.launchFenceEpoch
-                || !sameInteractionOwner(pollOwner, this.interactionOwner()) || this.runtimeMonitorsFrozen || this.spawning;
+                || !sameInteractionOwner(pollOwner, this.interactionOwner()) || this.runtimeMonitorsFrozen || this.spawning
+                || this.deliveryWritesStopping || this.tmux !== pollTmux;
             let scanStartedAt = null;
             const endScan = () => { if (scanStartedAt !== null)
                 noteSyncWork("daemon.errorMonitorScan", scanStartedAt); scanStartedAt = null; };
             try {
-                const alive = await this.tmux.isWindowAlive();
+                const alive = await pollTmux.isWindowAlive();
                 if (stale())
                     return;
                 if (!alive)
                     return;
                 const captureAt = Date.now();
-                const pane = await this.tmux.capturePane();
+                const pane = await pollTmux.capturePane();
                 // The scan of this pane is synchronous until it answers a dialog (an await) or ends: attributed (#1235).
                 scanStartedAt = performance.now();
                 if (stale())
@@ -3264,9 +3282,7 @@ export class Daemon extends EventEmitter {
                         continue;
                     }
                     const autoKey = dialog.autoResolutionKey;
-                    if (dialog.verifyAfterKeys && autoKey
-                        && this.autoResolvedDialogGeneration === this.spawnGeneration
-                        && this.autoResolvedDialogKey === autoKey) {
+                    if (dialog.verifyAfterKeys && autoKey && this.hasAutoDialogClaim(dialog)) {
                         // A previous poll sent the safety choice but the CLI has not
                         // repainted yet. Never send another Enter into the same screen.
                         continue;
@@ -3285,7 +3301,7 @@ export class Daemon extends EventEmitter {
                         const currentAt = Date.now();
                         const currentMono = performance.now();
                         const currentOrder = ++this.interactionCaptureSerial;
-                        const currentPane = await this.tmux.capturePane();
+                        const currentPane = await pollTmux.capturePane();
                         // Every await below can outlive the spawn / monitors this poll started under: after each one, before
                         // any state is touched or any further key is sent, `stale()` (fixed at the poll's start) is asked again.
                         if (stale())
@@ -3309,28 +3325,26 @@ export class Daemon extends EventEmitter {
                         // not evidence that the old request was answered, and the one-minute fallback must keep running.
                         if (this.dialogAnswers?.key === Daemon.answerKey(dialog) && this.dialogAnswers.screen !== before)
                             this.endDialogEpisode(dialog.requestIdentity !== undefined);
-                        if (dialog.verifyAfterKeys && autoKey
-                            && this.autoResolvedDialogGeneration === this.spawnGeneration
-                            && this.autoResolvedDialogKey === autoKey)
+                        if (dialog.verifyAfterKeys && autoKey && this.hasAutoDialogClaim(dialog))
                             return;
-                        if (dialog.verifyAfterKeys && autoKey) {
-                            this.autoResolvedDialogGeneration = this.spawnGeneration;
-                            this.autoResolvedDialogKey = autoKey;
-                        }
+                        if (dialog.verifyAfterKeys && autoKey)
+                            this.claimAutoDialog(dialog);
                         this.logger.info(`Auto-dismissing runtime dialog: ${dialog.description}`);
                         const SPECIAL_KEYS = new Set(["Up", "Down", "Enter", "Escape", "Right", "Left"]);
                         for (const key of dialog.keys) {
+                            if (stale())
+                                return;
                             let sent = false;
                             if (SPECIAL_KEYS.has(key)) {
-                                sent = await this.tmux.sendSpecialKey(key);
+                                sent = await pollTmux.sendSpecialKey(key);
                             }
                             else {
-                                sent = await this.tmux.pasteText(key, this.systemPasteOptions());
+                                sent = await pollTmux.pasteText(key, this.systemPasteOptions());
                             }
                             if (stale())
                                 return;
                             if (!sent) {
-                                if (dialog.verifyAfterKeys && autoKey) {
+                                if (dialog.verifyAfterKeys && autoKey && !dialog.oncePerLaunch) {
                                     this.autoResolvedDialogGeneration = 0;
                                     this.autoResolvedDialogKey = null;
                                 }
@@ -3345,7 +3359,7 @@ export class Daemon extends EventEmitter {
                             const afterKeysAt = Date.now();
                             const afterKeysMono = performance.now();
                             const afterKeysOrder = ++this.interactionCaptureSerial;
-                            const afterKeysPane = await this.tmux.capturePane();
+                            const afterKeysPane = await pollTmux.capturePane();
                             if (stale())
                                 return;
                             const dialogStillActive = dialog.inputBlocked
@@ -3375,7 +3389,7 @@ export class Daemon extends EventEmitter {
                             // backend-named identity any difference on the screen (a ticking timer) proves nothing either way: nothing
                             // is reported and the parked clock is left alone. Two requests that look exactly alike cannot be told apart.
                             await new Promise(r => setTimeout(r, DIALOG_ANSWER_SETTLE_MS));
-                            const afterPane = await this.tmux.capturePane();
+                            const afterPane = await pollTmux.capturePane();
                             if (stale())
                                 return; // (nothing was touched since the last check: only a read)
                             const stillThere = Daemon.dialogMatches(dialog, afterPane);
@@ -4113,6 +4127,23 @@ export class Daemon extends EventEmitter {
             this.logger.debug({ err: e }, "Failed to remove PID file");
         }
     }
+    /** Context refresh uses the already-bound manager; no name-based child or backend probe. */
+    getPaneContextSource() {
+        const tmux = this.tmux;
+        const control = this.controlClient;
+        if (!tmux || !control || this.deliveryWritesStopping)
+            return null;
+        const owner = this.interactionOwner();
+        const epoch = this.deliveryEpoch;
+        const isCurrent = () => {
+            const now = this.interactionOwner();
+            return !this.deliveryWritesStopping && this.controlClient === control && this.tmux === tmux && this.deliveryEpoch === epoch
+                && now.bootId === owner.bootId && now.spawnGeneration === owner.spawnGeneration
+                && now.launchAttempt === owner.launchAttempt && now.launchFenceEpoch === owner.launchFenceEpoch;
+        };
+        return { owner: tmux, generation: JSON.stringify([owner.bootId, owner.spawnGeneration, owner.launchAttempt, owner.launchFenceEpoch, epoch]),
+            isCurrent, capture: () => isCurrent() ? tmux.capturePaneWithHistory(60, 2_000) : Promise.reject(new Error("Pane context owner retired")) };
+    }
     getHangDetector() {
         return this.hangDetector;
     }
@@ -4651,11 +4682,14 @@ export class Daemon extends EventEmitter {
         // chat_id) does not update lastChatId, so its proxy reply would land in
         // whatever USER topic spoke to this instance last — the wrong audience for
         // a task result, and a stale one (sol's review of #515).
-        if (meta.from_instance || !meta.chat_id)
+        // A web message on a fleet with no chat platform has no chat_id (its reply goes to the web chat through the fleet's
+        // web-only sink), but it is a person waiting for an answer all the same: the guard arms for it (alpha.2).
+        if (meta.from_instance || (!meta.chat_id && meta.source !== "web"))
             return;
         // The last non-empty line of what we pasted: everything on screen after it
         // is the agent's own output.
         const inboundMarker = deliveredText.split(/\r?\n/).map(l => l.trim()).filter(Boolean).pop();
+        const deliveredAt = Date.now();
         // #1241 P2-1: carry pre-arm work evidence over the arm, bounded by this
         // delivery's ingress — output the paste produced before it confirmed.
         this.turnReplyGuard.arm({
@@ -4665,6 +4699,8 @@ export class Daemon extends EventEmitter {
             messageId: meta.message_id || undefined,
             correlationId: meta.correlation_id || undefined,
             inboundMarker,
+            deliveredText,
+            deliveredAt,
         }, this.pendingWork.lastInboundTimestamp());
         // #1209: persist the in-flight turn with a seam checkpoint. A marker
         // that survives a restart is an interrupted turn by construction —
@@ -4953,6 +4989,34 @@ export class Daemon extends EventEmitter {
             this.clearReplyGuardConfirm();
             return;
         }
+        // #1510: a backend whose turn end is read from its own transcript (codex) must show it there too: the turn that
+        // took this delivery ended and nothing started since. Anything less never starts a recovery.
+        if (this.backend?.turnEndFromTranscript === true) {
+            let verdict = this.transcriptTurns.verdict(turn.target.deliveredText, turn.target.deliveredAt ?? 0);
+            if (verdict === "running") {
+                if (this.transcriptRunningSince?.generation !== turn.generation) {
+                    this.transcriptRunningSince = { generation: turn.generation, at: performance.now() };
+                }
+                if (performance.now() - this.transcriptRunningSince.at >= TRANSCRIPT_RUNNING_HOLD_MAX_MS)
+                    verdict = "unknown";
+            }
+            if (verdict !== "running")
+                this.transcriptRunningSince = null;
+            if (verdict === "running") {
+                // Idle on screen, still working in the transcript: look again after another window.
+                this.armReplyGuardConfirm(turn.generation);
+                this.logger.info({ correlationId: turn.target.correlationId, generation: turn.generation, reason: "transcript_turn_running" }, "Reply guard holding — the transcript shows the turn still running");
+                return;
+            }
+            if (verdict !== "ended") {
+                this.clearReplyGuardConfirm();
+                this.turnReplyGuard.complete(turn.generation);
+                this.logger.info({ correlationId: turn.target.correlationId, generation: turn.generation, reason: `transcript_${verdict}` }, verdict === "unknown" ? "Reply guard stood down — this delivery's turn is not in the transcript followed (fail-safe)"
+                    : verdict === "aborted" ? "Reply guard stood down — the turn was interrupted"
+                        : "Reply guard stood down — the turn ended on a provider error (its own notice covers it)");
+                return;
+            }
+        }
         this.clearReplyGuardConfirm();
         if (turn.replyAttempted) {
             // A reply was attempted but its deliver result is unknown (in-flight
@@ -4970,6 +5034,16 @@ export class Daemon extends EventEmitter {
             || this.config.backend === "claude-code"
             || this.backend?.binaryName === "claude";
     }
+    /**
+     * This launch's transcript monitor. #1510: its turn boundaries feed the reply guard's ledger, which starts empty
+     * with it — a new monitor re-baselines at the transcript's end, so nothing the old one read can be attributed.
+     */
+    buildTranscriptMonitor(source) {
+        const monitor = new TranscriptMonitor(this.instanceDir, this.logger, source);
+        this.transcriptTurns.reset();
+        monitor.on("turns", (turns) => this.transcriptTurns.observe(turns));
+        return monitor;
+    }
     replyCompletionGuardEnabled() {
         return this.config.reply_completion_guard !== false
             && this.backend?.replyCompletionGuard === true;
@@ -6727,6 +6801,32 @@ export class Daemon extends EventEmitter {
         }
         return active;
     }
+    hasAutoDialogClaim(dialog) {
+        const key = dialog.autoResolutionKey;
+        if (!key)
+            return false;
+        if (dialog.oncePerLaunch) {
+            const claims = this.launchDialogClaims;
+            return claims !== null && claims.spawn === this.spawnGeneration && claims.attempt === this.launchAttempt
+                && claims.keys.has(key);
+        }
+        return this.autoResolvedDialogGeneration === this.spawnGeneration && this.autoResolvedDialogKey === key;
+    }
+    claimAutoDialog(dialog) {
+        const key = dialog.autoResolutionKey;
+        if (!key)
+            return;
+        if (dialog.oncePerLaunch) {
+            if (!this.launchDialogClaims || this.launchDialogClaims.spawn !== this.spawnGeneration
+                || this.launchDialogClaims.attempt !== this.launchAttempt) {
+                this.launchDialogClaims = { spawn: this.spawnGeneration, attempt: this.launchAttempt, keys: new Set() };
+            }
+            this.launchDialogClaims.keys.add(key);
+            return;
+        }
+        this.autoResolvedDialogGeneration = this.spawnGeneration;
+        this.autoResolvedDialogKey = key;
+    }
     /** Whether a runtime prompt currently owns the pane's stdin. */
     isInputBlocked() {
         return this.inputBlockedDialogKey !== null;
@@ -6788,8 +6888,7 @@ export class Daemon extends EventEmitter {
             // this spawn is not what the screen is waiting on any more — the entry
             // after it (typically a hold) describes it.
             if (dialog.verifyAfterKeys && dialog.autoResolutionKey
-                && this.autoResolvedDialogGeneration === this.spawnGeneration
-                && this.autoResolvedDialogKey === dialog.autoResolutionKey
+                && this.hasAutoDialogClaim(dialog)
                 && dialogs.some(other => other !== dialog && Daemon.dialogMatches(other, pane)))
                 continue;
             this.trackDialogParked(dialog);
@@ -7766,6 +7865,10 @@ export class Daemon extends EventEmitter {
     async sendDeliveryEnter(phase, stillCurrent, durableAttempt) {
         if (!(await this.waitForInputTransientToClear(phase)))
             return false;
+        return this.sendDeliveryEnterAfterAvailability(phase, stillCurrent, durableAttempt);
+    }
+    /** Write half only: callers must finish the availability wait before any final recovery ownership proof. */
+    async sendDeliveryEnterAfterAvailability(phase, stillCurrent, durableAttempt) {
         // A recovery Enter may have waited for a transient while cancel or spawn
         // replaced the delivery. Check at the last point before the tmux write.
         if (this.deliveryWritesStopping || (stillCurrent && !stillCurrent()))
@@ -8246,6 +8349,10 @@ export class Daemon extends EventEmitter {
                 // is disqualifying and no amount of output may override it. Where it
                 // cannot (a backend with no prompt pattern), the output signal remains
                 // exactly as before — this must not regress backends we cannot read.
+                // The attempt's owner (#1514 review): a confirmation fenced because the window was replaced must not be revived
+                // by the late proof below on the replacement's pane.
+                const ownerTmux = this.tmux, ownerGeneration = this.spawnGeneration;
+                const owned = () => this.tmux === ownerTmux && this.spawnGeneration === ownerGeneration;
                 const becameBusy = await this.confirmAfterEnter(windowId, enterAt, signature, pasteBaseline, "idle-to-busy-retry", !rawPaste);
                 if (becameBusy) {
                     if (status)
@@ -8257,15 +8364,29 @@ export class Daemon extends EventEmitter {
                     if (!rawPaste && !steer && !this.canProveSubmission())
                         verdict.proof = "output-edge";
                 }
+                else if (!owned()) {
+                    // The window this delivery was pasted into was replaced while it was being confirmed: whether its CLI took
+                    // the message is unknown, and the new window's pane says nothing about it. Uncertain, never ✅ or ❌.
+                    this.logger.warn({ phase: "post-submit-proof" }, "Window replaced during submission proof — delivery outcome uncertain");
+                    verdict.phase = "post-submit-proof";
+                    verdict.proof = "window-replaced";
+                    return false;
+                }
                 else {
                     const proof = this.structuredInputEvidence()
-                        ? await this.lateCodexSubmissionProof(signature, pasteBaseline)
-                        : await this.confirmSubmitted(signature, pasteBaseline);
-                    if (proof === "submitted") {
+                        ? await this.lateCodexSubmissionProof(signature, pasteBaseline, false, owned)
+                        : await this.confirmSubmitted(signature, pasteBaseline, owned);
+                    if (proof === "submitted" && owned()) {
                         if (status)
                             this.emit("message_confirmed", status);
                         return true;
                     }
+                    if (!owned()) {
+                        this.logger.warn({ phase: "post-submit-proof" }, "Window replaced during submission proof — delivery outcome uncertain");
+                        verdict.phase = "post-submit-proof";
+                        verdict.proof = "window-replaced";
+                        return false;
+                    }
                     if (this.structuredInputEvidence() && proof !== "stranded") {
                         // This is the observed #910 race: the CLI processed the message
                         // although its echo had not appeared within the proof window. A
@@ -8368,16 +8489,25 @@ export class Daemon extends EventEmitter {
      * still confirmed on output alone).
      */
     async confirmAfterEnter(windowId, enterAt, signature, baseline, retryPhase, allowRecoveryEnter = true) {
+        // The window this confirmation is about (#1490). The waits below can span a recoverWindow, which replaces
+        // this.tmux with a new TmuxManager, so its identity (with the spawn generation) is the fence. A recovery Enter or
+        // a proof taken after that would be about another window: the fence goes down to the write
+        // (sendDeliveryEnterAfterAvailability asks it last, right before the key) and into every proof, which asks it
+        // before its capture and again before judging what it read (#1514 review) — so a replacement during a capture
+        // can neither confirm this delivery nor run a proof's side effects.
+        const generation = this.spawnGeneration, tmux = this.tmux;
+        const current = () => this.spawnGeneration === generation && this.tmux === tmux;
+        const proofNow = () => this.confirmSubmitted(signature, baseline, current);
         if (!this.canProveSubmission()) {
-            let busy = await this.confirmBusyAfterEnter(windowId, enterAt);
+            let busy = (await this.confirmBusyAfterEnter(windowId, enterAt)) && current();
             if (!busy) {
-                if (!allowRecoveryEnter)
+                if (!allowRecoveryEnter || !current())
                     return false;
                 this.logger.warn("No idle→busy transition after Enter — re-sending Enter once");
                 const retryAt = Date.now();
-                if (!(await this.sendDeliveryEnter(retryPhase)))
+                if (!(await this.sendDeliveryEnter(retryPhase, current)))
                     return false;
-                busy = await this.confirmBusyAfterEnter(windowId, retryAt);
+                busy = (await this.confirmBusyAfterEnter(windowId, retryAt)) && current();
             }
             return busy;
         }
@@ -8393,7 +8523,9 @@ export class Daemon extends EventEmitter {
             // proves a swallowed Enter only once it outlasts the window; an early one is polled through. Codex keeps its rule.
             const strandMustPersist = !!this.backend?.readInputRow;
             for (;;) {
-                proof = await this.confirmSubmitted(signature, baseline);
+                proof = await proofNow();
+                if (!current())
+                    return false;
                 if (proof === "submitted")
                     return true;
                 if ((proof === "stranded" && !strandMustPersist) || Date.now() >= firstDeadline)
@@ -8402,18 +8534,22 @@ export class Daemon extends EventEmitter {
             }
             if (proof !== "stranded" || !allowRecoveryEnter)
                 return false;
-            if (!(await this.waitForPaneReadyForDelivery(windowId, STRANDED_RETRY_READY_WAIT_MS)))
+            if (!(await this.waitForPaneReadyForDelivery(windowId, STRANDED_RETRY_READY_WAIT_MS)) || !current())
+                return false;
+            proof = await proofNow();
+            if (!current())
                 return false;
-            proof = await this.confirmSubmitted(signature, baseline);
             if (proof === "submitted")
                 return true;
             if (proof !== "stranded")
                 return false;
-            if (!(await this.sendDeliveryEnter(retryPhase)))
+            if (!(await this.sendDeliveryEnter(retryPhase, current)))
                 return false;
             const retryDeadline = Date.now() + POST_ENTER_PROOF_WINDOW_MS;
             for (;;) {
-                proof = await this.confirmSubmitted(signature, baseline);
+                proof = await proofNow();
+                if (!current())
+                    return false;
                 if (proof === "submitted")
                     return true;
                 if (Date.now() >= retryDeadline)
@@ -8421,8 +8557,10 @@ export class Daemon extends EventEmitter {
                 await new Promise(r => setTimeout(r, POST_ENTER_PROOF_POLL_MS));
             }
         }
-        if (await this.confirmSubmitted(signature, baseline) === "submitted")
+        if (await proofNow() === "submitted" && current())
             return true;
+        if (!current())
+            return false;
         // Retry once the prompt is back — an Enter sent into a mid-redraw TUI is
         // how we got here. Then poll briefly rather than judging on one capture:
         // the key takes a moment to be digested, and a single early look would
@@ -8432,25 +8570,32 @@ export class Daemon extends EventEmitter {
         this.logger.warn("Enter did not submit — waiting for the prompt, then re-sending once");
         if (!(await this.waitForPaneReadyForDelivery(windowId, STRANDED_RETRY_READY_WAIT_MS)))
             return false;
-        if (!(await this.sendDeliveryEnter(retryPhase)))
+        if (!(await this.sendDeliveryEnter(retryPhase, current)))
             return false;
         const deadline = Date.now() + POST_ENTER_PROOF_WINDOW_MS;
         for (;;) {
-            if (await this.confirmSubmitted(signature, baseline) === "submitted")
+            const proof = await proofNow();
+            if (!current())
+                return false;
+            if (proof === "submitted")
                 return true;
             if (Date.now() >= deadline)
                 return false;
             await new Promise(r => setTimeout(r, POST_ENTER_PROOF_POLL_MS));
         }
     }
-    async confirmSubmitted(signature, baseline) {
-        if (!this.tmux)
+    async confirmSubmitted(signature, baseline, owned) {
+        // `owned`: the attempt's window fence (#1514 review), asked before the capture and again before judging it —
+        // judging can retire the spawn's input guard, so a capture of a replaced window must not even be judged.
+        if (!this.tmux || (owned && !owned()))
             return "unproven";
         let pane = null;
         try {
             pane = await this.tmux.capturePane();
         }
         catch { /* the transcript may still say */ }
+        if (owned && !owned())
+            return "unproven";
         const onPane = pane === null ? "unproven" : this.judgeSubmission(pane, signature, baseline);
         if (onPane === "submitted")
             return onPane;
@@ -8458,7 +8603,7 @@ export class Daemon extends EventEmitter {
         const found = await this.transcriptLook(signature);
         // One synchronous stretch from here: the fence is asked after the last await, and only then is the hit kept and the
         // spawn's guard retired — a stop or respawn that lands between the look and this line leaves both untouched.
-        if (!found || !t?.current())
+        if (!found || !t?.current() || (owned && !owned()))
             return onPane;
         if (!t.provenBy) {
             t.provenBy = found;
@@ -8547,12 +8692,12 @@ export class Daemon extends EventEmitter {
         //    read as ours, we would press Enter to "recover" it, and the turn IT
         //    starts would confirm a message that never reached the pane.
         //
-        //    For a structural box reader (claude-code), "did not already show it" needs a baseline whose box was READ: an
-        //    unreadable one (a dialog, a redraw the reader refused) says nothing about what the box held, and counting it as
-        //    empty would claim an older message as ours and press Enter on it (#1353 review). The prompt-row backends (codex,
-        //    kiro) keep their existing attribution.
+        //    Structured evidence (Claude's box and Codex's current input/footer pair) requires both snapshots to be READ.
+        //    An unreadable baseline says nothing about what the box held; treating it as empty would claim an older draft
+        //    as ours and press Enter on it (#1353/#1359). Codex's native warning viewer can ignore the paste and first Enter,
+        //    then reveal an older draft when the user dismisses it. Row-only backends retain their existing attribution.
         const attributable = baseline != null
-            && (!this.backend?.readInputRow || (baseline.inputReadable && after.inputReadable));
+            && (!this.structuredInputEvidence() || (baseline.inputReadable && after.inputReadable));
         if (after.strandedInput && (signature.unique || (attributable && baseline.strandedInput === false)))
             return "stranded";
         //    A paste the CLI shows collapsed carries no signature at all. One the box did not hold before we pasted is
@@ -8593,11 +8738,13 @@ export class Daemon extends EventEmitter {
         return "unverifiable";
     }
     /** Only positive echo/queue evidence may turn an ambiguous Codex write into ✅. */
-    async lateCodexSubmissionProof(signature, baseline, waitThroughStranded = false) {
+    async lateCodexSubmissionProof(signature, baseline, waitThroughStranded = false, owned) {
         const deadline = Date.now() + CODEX_LATE_PROOF_MS;
         let proof = "unproven";
         for (;;) {
-            proof = await this.confirmSubmitted(signature, baseline);
+            if (owned && !owned())
+                return "unproven";
+            proof = await this.confirmSubmitted(signature, baseline, owned);
             // Ordinary idle-path proof may return a strand immediately. After a
             // native-queue recovery Enter, though, it can be the previous frame
             // still on screen; only a strand that survives the bounded repaint
@@ -8609,6 +8756,8 @@ export class Daemon extends EventEmitter {
                     // Scrollback can hold the echo the viewport lost — but it is judged exactly like the viewport: a box that
                     // cannot be read, or that still holds our text, is never upgraded by an echo further up.
                     const history = await this.tmux.capturePaneWithHistory(300);
+                    if (owned && !owned())
+                        return "unproven";
                     if (this.judgeSubmission(history, signature, baseline) === "submitted")
                         return this.submittedProof();
                 }
@@ -8802,12 +8951,36 @@ export class Daemon extends EventEmitter {
             return true; // best effort, exactly as before — nothing here is verified
         }
         if (proof !== "submitted") {
-            // A bare Enter is a no-op at an empty prompt, so this is safe even if the
-            // first one did land; when the text is still in the input row it is the
-            // submit it never got. Re-pasting would append the text to itself.
             await new Promise(r => setTimeout(r, NORMAL_ENTER_SETTLE_MS));
-            if (!(await this.sendDeliveryEnter(`${label}-retry`, current)))
+            if (current && !current())
                 return false;
+            const retryPhase = `${label}-retry`;
+            if (this.structuredInputEvidence()) {
+                // Both the retry delay and the Enter availability wait may outlive the
+                // paste. Complete those waits BEFORE the last ownership/positive proof.
+                if (!(await this.waitForInputTransientToClear(retryPhase)))
+                    return false;
+                if (this.deliveryWritesStopping || (current && !current()))
+                    return false;
+                proof = await this.confirmSubmitted(signature, baseline);
+                if (this.deliveryWritesStopping || (current && !current()))
+                    return false;
+                if (proof === "submitted")
+                    return true;
+                if (proof !== "stranded") {
+                    this.logger.warn({ label, proof }, "System paste recovery input could not be attributed");
+                    return false;
+                }
+                // No further availability wait may invalidate this proof. The write
+                // half retains the same stopping/admission fence immediately before IPC.
+                if (!(await this.sendDeliveryEnterAfterAvailability(retryPhase, current)))
+                    return false;
+            }
+            else {
+                // Row-only backends retain their ordinary availability wait and retry.
+                if (!(await this.sendDeliveryEnter(retryPhase, current)))
+                    return false;
+            }
             proof = await this.confirmSubmitted(signature, baseline);
             if (current && !current())
                 return false;
@@ -8871,12 +9044,18 @@ export class Daemon extends EventEmitter {
     async confirmBusyAfterEnter(windowId, since) {
         const client = this.controlClient;
         const hardDeadline = Date.now() + CONFIRM_BUSY_MAX_WAIT_MS;
+        // A drained control read hides notifications (#1517 review): while the client is blind a quiet pane is not
+        // evidence of a swallowed Enter, so blind polls do not count toward "no reaction". Bounded: past the drain limit
+        // the client retires and resets, which restarts this check from when it could see again.
+        const blindDeadline = hardDeadline + CONFIRM_BUSY_BLIND_EXTRA_MS;
         let observedFrom = since;
         let polls = 0;
         while (polls < CONFIRM_BUSY_POLLS) {
             await new Promise(r => setTimeout(r, CONFIRM_BUSY_POLL_MS));
             if (client.hasOutputSince(windowId, observedFrom))
                 return true;
+            if (client.isObservationBlind?.() && Date.now() < blindDeadline)
+                continue;
             const resetAt = client.getObservationResetAt();
             if (resetAt > observedFrom && Date.now() < hardDeadline) {
                 this.logger.debug({ windowId, resetAt }, "Control mode reconnected mid-confirmation — restarting the Enter check from when we could see again");
@@ -9194,7 +9373,20 @@ export class Daemon extends EventEmitter {
             respond(null, "No channel world bound to this chat context — awaiting an inbound message to establish it");
             return;
         }
-        if (!routeToolCall(adapter, tool, args, this.lastThreadId, respond)) {
+        // #1266: without the fleet there is no button store: buttons are checked, then offered as text.
+        let routed = args;
+        if (tool === "reply") {
+            const buttons = parseReplyButtons(args.buttons, args);
+            if (buttons && "error" in buttons) {
+                respond(null, `reply: ${buttons.error}`);
+                return;
+            }
+            if (buttons) {
+                routed = { ...args, text: `${String(args.text)}\n\n${replyButtonsFallbackText(buttons.buttons)}` };
+                delete routed.buttons;
+            }
+        }
+        if (!routeToolCall(adapter, tool, routed, this.lastThreadId, respond)) {
             respond(null, `Unknown tool: ${tool}`);
         }
     }
@@ -9353,7 +9545,8 @@ export class Daemon extends EventEmitter {
             instanceName: this.name,
             mcpServers: isCliMode ? {} : {
                 "agend": {
-                    command: "node",
+                    // The Node this daemon runs on (#1450 C5): the CLIs start the MCP server with it, not a `node` from PATH.
+                    command: process.execPath,
                     args: [serverJs],
                     env: mcpEnv,
                 },
@@ -10290,15 +10483,16 @@ export class Daemon extends EventEmitter {
         // this file from <instanceDir>/agent.token (mode 0o600) and sends its
         // value in the X-Agend-Instance-Token header; the daemon-side /agent
         // endpoint verifies it matches the on-disk value for the claimed
-        // instance. This prevents other local processes (even those holding
-        // the global web token) from impersonating instances.
+        // instance. A global web token cannot substitute for this credential, but
+        // same-uid shell processes can read sibling tokens. Mode 0600 separates
+        // OS users; it does not isolate mutually untrusted agents on this account.
         const agentTokenPath = join(this.instanceDir, "agent.token");
         const agentToken = randomBytes(32).toString("hex");
         const tokenWrite = writeSecretFile(agentTokenPath, agentToken);
         if (!tokenWrite.ok) {
             // Do not fail the spawn over it — an instance that cannot start is worse
             // than one whose token is readable. But say so, loudly: the whole point of
-            // this token is that other local processes cannot use it.
+            // this permission check separates other OS users, not same-uid processes.
             this.logger.error({ path: agentTokenPath, mode: tokenWrite.mode?.toString(8), reason: tokenWrite.reason }, "Agent token file is not owner-only — other local users can impersonate this instance");
         }
         // AGEND_HOME points the child's agent-cli at the same data dir the daemon
@@ -10499,7 +10693,8 @@ export class Daemon extends EventEmitter {
         const ownerTmux = this.tmux;
         const ownerSpawn = this.spawnGeneration;
         const ownerFence = this.launchFenceEpoch;
-        const owned = () => this.tmux === ownerTmux && this.spawnGeneration === ownerSpawn && this.launchFenceEpoch === ownerFence;
+        const owned = () => !this.deliveryWritesStopping && this.tmux === ownerTmux
+            && this.spawnGeneration === ownerSpawn && this.launchFenceEpoch === ownerFence;
         do {
             this.startupAdmission?.();
             attempts++;
@@ -10545,8 +10740,7 @@ export class Daemon extends EventEmitter {
                     if (Daemon.dialogMatches(dialog, pane)) {
                         if (dialog.autoResolutionKey
                             && (attemptedSafetyChoices.has(dialog.autoResolutionKey)
-                                || (this.autoResolvedDialogGeneration === this.spawnGeneration
-                                    && this.autoResolvedDialogKey === dialog.autoResolutionKey)))
+                                || this.hasAutoDialogClaim(dialog)))
                             continue;
                         lastDialog = dialog;
                         this.noteCodexReserveDialog(dialog, pane);
@@ -10610,8 +10804,7 @@ export class Daemon extends EventEmitter {
                             }
                             if (dialog.autoResolutionKey) {
                                 attemptedSafetyChoices.add(dialog.autoResolutionKey);
-                                this.autoResolvedDialogGeneration = ownerSpawn;
-                                this.autoResolvedDialogKey = dialog.autoResolutionKey;
+                                this.claimAutoDialog(dialog);
                             }
                             for (const key of dialog.keys) {
                                 this.startupAdmission?.();