@songsid/agend 2.2.0-beta.3 → 2.2.0-beta.5

package/dist/daemon.js

@@ -45,7 +45,9 @@ import { measureSyncWork, noteSyncWork } from "./sync-work-attribution.js";
 import { TranscriptDeltaReader } from "./transcript-delta-reader.js";
 import { buildResumeContinuation, clearInFlightTurnMarker, consumeInFlightTurnMarker, decideTurnResume, normalizeResumeBackend, readResumeFingerprint, RESUME_BLOCKING_DELIVERY_STATES, writeInFlightTurnMarker, } from "./turn-resume.js";
 import { codexLiveRowMatches } from "./backend/codex.js";
+import { claudeConfigDirFor, claudeProfileConfigDir, claudeSwitchDialog, claudeSwitchTargetMatches } from "./backend/claude-code.js";
 import { InteractionObservation, INTERACTION_CONFIRM_MS, sameInteractionOwner } from "./interaction-observation.js";
+import { unrecognisedPromptShape } from "./unrecognised-prompt.js";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 // Tool routing sets — module-level to avoid re-creation on every handleToolCall
@@ -522,8 +524,16 @@ const DIALOG_PROBE_UNKNOWN_MAX = 40;
 /** Startup dialog scan: poll cadence and wall-clock budget (keys and waits included). */
 const STARTUP_DIALOG_POLL_MS = 500;
 const STARTUP_DIALOG_BUDGET_MS = 30_000;
+/** #1690: after AgEnD's own `/model`, how long the pane is read for claude's "Switch model?" or its result. */
+export const OWN_SWITCH_WAIT_MS = 6_000;
+/** #1690: after an answer to that dialog, how long it gets to go away. */
+const OWN_SWITCH_SETTLE_MS = 3_000;
 /** A blocking dialog still on screen this long after first being seen is reported for a human. */
 const DIALOG_PARKED_NOTIFY_MS = 60_000;
+/** #1691: a prompt no table knows must sit unchanged this long (monotonic) before it holds deliveries and is reported. */
+export const UNRECOGNISED_PROMPT_STABLE_MS = 60_000;
+/** #1691: the rows under a prompt a backend without a composer reader shows its ready chrome in (status bar, hint). */
+const COMPOSER_TAIL_ROWS = 4;
 /** After a runtime dialog's keys, how long the pane gets to repaint before it is read again to see whether they took. */
 const DIALOG_ANSWER_SETTLE_MS = 300;
 /** Consecutive answers one runtime dialog ignored (still on screen right after the keys) before it is reported for a human. */
@@ -1163,6 +1173,34 @@ export class Daemon extends EventEmitter {
     dialogParkedKey = null;
     dialogParkedInteractionEpisode = null;
     dialogParkedReported = false;
+    /**
+     * #1691: the prompt at the bottom of the pane that no backend table knows — its block, since when (performance.now)
+     * it has been unchanged, and whether that has lasted UNRECOGNISED_PROMPT_STABLE_MS. Updated by the runtime scan.
+     */
+    unrecognisedPrompt = null;
+    /**
+     * #1691: when (performance.now) the newest pane read that decided the evidence above was taken — a scan or a fresh
+     * read, confirming, restarting or ending it. A read taken before it finishes late and says nothing about now: it may
+     * neither clear, restart nor confirm (#1695 r4).
+     */
+    unrecognisedPromptReadAt = -Infinity;
+    /**
+     * #1691: the catch-all for that prompt, as a hold-only runtime dialog — so the delivery hold, awaiting_input, the
+     * Needs-you item and the single parked report are the existing ones. Never answered (hold-only, no keys).
+     */
+    unrecognisedPromptDialog = {
+        pattern: /(?!)unrecognised-prompt-1691/,
+        keys: [],
+        description: "a prompt AgEnD does not recognise",
+        holdOnly: true,
+        isActive: (pane) => this.unrecognisedPromptActive(pane),
+        requestIdentity: () => this.unrecognisedPrompt?.block ?? null,
+    };
+    /**
+     * #1690: AgEnD's own runtime `/model` in flight — from the moment its paste went in until its "Switch model?" dialog
+     * (if any) is answered. Every delivery is held meanwhile: the dialog's default cursor is Yes, a stray Enter confirms it.
+     */
+    ownSwitch = null;
     /**
      * The runtime dialog the monitor is answering, and how many of its answers in a row did nothing (the dialog was
      * still on screen right after the keys). Not the on-screen duration: a burst of FRESH prompts, each answered, has a
@@ -3216,7 +3254,6 @@ export class Daemon extends EventEmitter {
         if (this.runtimeMonitorsFrozen || this.errorMonitorTimer)
             return;
         const patterns = this.backend?.getErrorPatterns?.() ?? [];
-        const dialogs = this.backend?.getRuntimeDialogs?.() ?? [];
         if (!this.tmux)
             return;
         if (!this.backend)
@@ -3252,6 +3289,9 @@ export class Daemon extends EventEmitter {
                 scanStartedAt = performance.now();
                 if (stale())
                     return;
+                this.trackUnrecognisedPrompt(pane, captureMono, this.instanceStateLastOutputAt > 0 && this.instanceStateLastOutputAt >= captureAt);
+                // The backend's dialogs, and #1691's catch-all while an unrecognised prompt is active (decided just above).
+                const dialogs = this.runtimeDialogs();
                 if (this.instanceStateLastOutputAt > 0 && this.instanceStateLastOutputAt >= captureAt) {
                     this.unverifyInteraction(captureMono, captureOrder);
                 }
@@ -3731,14 +3771,21 @@ export class Daemon extends EventEmitter {
     isDeliveryEpochCurrent(epoch) {
         return epoch === this.deliveryEpoch;
     }
-    queueRawPaste(rawText, deliveryEpoch = this.deliveryEpoch, confirmClear = false, durableAttempt) {
+    queueRawPaste(rawText, deliveryEpoch = this.deliveryEpoch, confirmClear = false, durableAttempt, ownSwitch) {
+        const reportSwitch = (result) => {
+            if (!ownSwitch)
+                return;
+            this.ipcServer?.broadcast({ type: "runtime_switch_result", id: ownSwitch.id, ...result });
+        };
         if (!this.tmux || !this.isDeliveryEpochCurrent(deliveryEpoch)) {
             if (durableAttempt)
                 this.retryDurableDeliveryBeforeBegin(durableAttempt, "raw_paste target unavailable before pane queue");
+            reportSwitch({ outcome: "not_sent" });
             return;
         }
         this.pasteLock = this.pasteLock.then(async () => {
             if (!this.isDeliveryEpochCurrent(deliveryEpoch)) {
+                reportSwitch({ outcome: "not_sent" });
                 this.logger.info("Pending raw delivery dropped by user cancel");
                 if (durableAttempt)
                     this.retryDurableDeliveryBeforeBegin(durableAttempt, "raw_paste epoch changed while queued");
@@ -3750,6 +3797,7 @@ export class Daemon extends EventEmitter {
                 if (!this.isDeliveryEpochCurrent(deliveryEpoch)) {
                     if (durableAttempt)
                         this.retryDurableDeliveryBeforeBegin(durableAttempt, "raw_paste epoch changed while waking");
+                    reportSwitch({ outcome: "not_sent" }); // #1690: cancelled before anything was typed — said at once, nothing saved
                     return;
                 }
                 const delivered = await this.deliverMessage(rawText, undefined, {
@@ -3757,6 +3805,9 @@ export class Daemon extends EventEmitter {
                     verdict,
                     durableAttempt,
                     preserveExactBytes: true,
+                    // #1690: our own /model holds every other delivery from its write on — before the lock is released, so a steer
+                    // or /btw waiting on it cannot type into the gap before claude paints "Switch model?" (default cursor: Yes).
+                    ...(ownSwitch ? { onPaneWritten: () => { this.ownSwitch = ownSwitch; } } : {}),
                 });
                 if (delivered)
                     this.finishDurableSubmission(durableAttempt ?? null, verdict);
@@ -3789,10 +3840,31 @@ export class Daemon extends EventEmitter {
                 else if (durableAttempt)
                     this.retryDurableDeliveryBeforeBegin(durableAttempt, err.message);
                 this.logger.warn({ err: err.message }, "raw_paste delivery error");
+                if (ownSwitch) {
+                    if (this.ownSwitch === ownSwitch)
+                        this.ownSwitch = null;
+                    reportSwitch({ outcome: "not_confirmed" });
+                }
                 return;
             }
             if (confirmClear)
                 await this.confirmBackendClearDialog();
+            if (ownSwitch) {
+                if (this.ownSwitch !== ownSwitch)
+                    reportSwitch({ outcome: "not_sent" }); // its write never began
+                else {
+                    try {
+                        reportSwitch(await this.answerOwnSwitchDialog(ownSwitch));
+                    }
+                    catch (err) {
+                        this.logger.warn({ err: err.message }, "Answering our own model switch failed");
+                        reportSwitch({ outcome: "not_confirmed" });
+                    }
+                    finally {
+                        this.ownSwitch = null;
+                    }
+                }
+            }
             this.logger.debug({ text: rawText.slice(0, 100) }, "Raw paste delivered");
         });
         this.pasteLock = this.pasteLock.catch(err => {
@@ -3811,7 +3883,93 @@ export class Daemon extends EventEmitter {
             this.deferDurableDelivery(deliveryMeta, "invalid raw_paste delivery attempt metadata");
             return;
         }
-        this.queueRawPaste(msg.content, this.captureDeliveryEpoch(msg.delivery_epoch), msg.confirm_clear === true, durableAttempt ? { ...durableAttempt, submissionMode: "raw_paste" } : undefined);
+        const sw = msg.runtime_switch;
+        const ownSwitch = sw && typeof sw.id === "string" && sw.kind === "model" && typeof sw.requested === "string"
+            ? { id: sw.id, kind: "model", requested: sw.requested } : undefined;
+        this.queueRawPaste(msg.content, this.captureDeliveryEpoch(msg.delivery_epoch), msg.confirm_clear === true, durableAttempt ? { ...durableAttempt, submissionMode: "raw_paste" } : undefined, ownSwitch);
+    }
+    /**
+     * #1690 (the user's choice A): after AgEnD's own `/model <name>`, claude may ask "Switch model?" (a warm cache for
+     * another model). When the model it names is the one asked for, answer Yes; otherwise No (Escape — `Kept model as …`),
+     * and say so. Every key goes on a freshly read, verified dialog under the pane write lock: the same target, and for
+     * Enter the cursor on "1. Yes"; the cursor is walked there with Up, one verified step at a time, never a blind key.
+     * Without the dialog, claude's own "Set model to …" line after the command is the result.
+     */
+    async answerOwnSwitchDialog(spec) {
+        const tmux = this.tmux;
+        if (!tmux)
+            return { outcome: "not_confirmed" };
+        const read = () => tmux.capturePane().catch(() => "");
+        const sleep = (ms) => new Promise(resolve => setTimeout(resolve, ms));
+        /** One key on a dialog re-read under the lock: still the same target, and (when given) the cursor where expected. */
+        const press = (target, cursor, key) => this.paneWriteLock.run(async () => {
+            if (this.tmux !== tmux)
+                return false;
+            const now = claudeSwitchDialog(await read());
+            if (!now || now.kind !== "model" || now.target !== target || (cursor !== null && now.cursor !== cursor))
+                return false;
+            return tmux.sendSpecialKey(key);
+        });
+        const gone = async () => {
+            const until = performance.now() + OWN_SWITCH_SETTLE_MS;
+            while (performance.now() < until) {
+                if (!claudeSwitchDialog(await read()))
+                    return true;
+                await sleep(150);
+            }
+            return false;
+        };
+        const deadline = performance.now() + OWN_SWITCH_WAIT_MS;
+        while (performance.now() < deadline && this.tmux === tmux) {
+            const pane = await read();
+            const dialog = claudeSwitchDialog(pane);
+            if (dialog && dialog.kind === "model") {
+                const shown = dialog.target;
+                if (!claudeSwitchTargetMatches(spec.requested, shown)) {
+                    const answered = await press(shown, null, "Escape") && await gone();
+                    this.logger.warn({ requested: spec.requested, shown, answered }, "claude would switch to another model than asked — answered No");
+                    return { outcome: "mismatch", shown, answered };
+                }
+                // Walk the cursor to "1. Yes" (it starts there; a human may have moved it): Up from row 2, re-read each time.
+                let current = dialog;
+                for (let step = 0; step < 2 && current.cursor === 2; step++) {
+                    if (!await press(shown, 2, "Up"))
+                        break;
+                    await sleep(120);
+                    const next = claudeSwitchDialog(await read());
+                    if (!next || next.target !== shown)
+                        break;
+                    current = next;
+                }
+                if (current.cursor !== 1 || !await press(shown, 1, "Enter") || !await gone()) {
+                    this.logger.warn({ requested: spec.requested, shown, cursor: current.cursor }, "Our own model switch dialog could not be confirmed on a verified cursor — left for a human");
+                    return { outcome: "not_confirmed", shown };
+                }
+                this.logger.info({ requested: spec.requested, shown }, "Confirmed our own model switch (claude: the next reply re-reads the history)");
+                return { outcome: "switched", confirmed: true, shown };
+            }
+            if (Daemon.switchResultAfterCommand(pane, spec.requested))
+                return { outcome: "switched", confirmed: false };
+            await sleep(200);
+        }
+        return { outcome: "not_confirmed" };
+    }
+    /**
+     * #1690: claude's "Set model to …" line under our `/model <requested>` (no dialog was needed). Only the newest command
+     * on the pane counts: an older identical `/model` with its result further up (switched away and back) must not pass
+     * for this one before it has even painted — that left its dialog unanswered (live, 2.1.296).
+     */
+    static switchResultAfterCommand(pane, requested) {
+        const rows = pane.replace(/\r/g, "").split("\n");
+        let last = -1;
+        for (let i = rows.length - 1; i >= 0; i--)
+            if (/^❯[ \t\u00a0]+\S/.test(rows[i])) {
+                last = i;
+                break;
+            }
+        if (last < 0 || rows[last].replace(/^❯[ \t\u00a0]+/, "").trimEnd() !== `/model ${requested}`)
+            return false;
+        return rows.slice(last + 1).some(row => /^\s*⎿?\s*Set model to /.test(row));
     }
     /**
      * Confirm a backend's terminal-level /clear prompt after the channel-level
@@ -4275,7 +4433,9 @@ export class Daemon extends EventEmitter {
             // Bare backend regexes are not proof of a live modal. The canonical
             // isActive predicate replaces pattern.test(), preserving table order.
             const dialog = dialogs.find(d => d.isActive && (d.inputBlocked || d.blocksDelivery || d.holdOnly)
-                && Daemon.dialogMatches(d, pane));
+                && Daemon.dialogMatches(d, pane)
+                // #1690: AgEnD's own switch dialog, being answered right now, is nobody's to answer.
+                && !(this.ownSwitch && claudeSwitchDialog(pane) !== null));
             if (dialog) {
                 const identity = dialog.requestIdentity?.(pane) ?? pane.replace(/\r/g, "")
                     .split("\n").map(row => row.replace(/^([ \t]*)[❯›]([ \t]+)(?=\d\.|Yes\b|No\b|Resume\b)/, "$1$2").trimEnd())
@@ -4291,7 +4451,7 @@ export class Daemon extends EventEmitter {
         // No captured text leaves this function or the private observer identity.
         return evidence ? { ...evidence, identity: createHash("sha256").update(evidence.identity).digest("hex") } : null;
     }
-    observeInteractionPane(pane, observedAt, monotonicAt, dialogs = this.backend?.getRuntimeDialogs?.() ?? [], order = ++this.interactionCaptureSerial, allowConfirmation = true) {
+    observeInteractionPane(pane, observedAt, monotonicAt, dialogs = this.runtimeDialogs(), order = ++this.interactionCaptureSerial, allowConfirmation = true) {
         const owner = this.interactionOwner();
         const evidence = this.interactionEvidence(pane, dialogs);
         if (!this.interactionObservation.observe(evidence, owner, observedAt, monotonicAt, this.interactionOutputRevision !== this.interactionObservedOutputRevision, order))
@@ -4776,10 +4936,7 @@ export class Daemon extends EventEmitter {
                 backend: resumeBackend ?? "unknown",
                 cwd: resumeCwd,
                 armedAt: Date.now(),
-                before: readResumeFingerprint(normalizeResumeBackend(resumeBackend), {
-                    instanceDir: this.instanceDir,
-                    workingDirectory: resumeCwd,
-                }),
+                before: readResumeFingerprint(normalizeResumeBackend(resumeBackend), this.resumeRoots(resumeCwd)),
             });
         }
     }
@@ -4825,7 +4982,7 @@ export class Daemon extends EventEmitter {
             && this.spawnGeneration === gateSpawn
             && this.launchFenceEpoch === gateFence;
         const backend = this.resolveResumeBackend() ?? normalizeResumeBackend(marker.backend);
-        const roots = { instanceDir: this.instanceDir, workingDirectory: this.config.working_directory ?? "" };
+        const roots = this.resumeRoots(this.config.working_directory ?? "");
         // This boot's CLI spawn is what the daemon itself caused: pre-restart
         // writes (including pre-crash progress) are excluded, and the flush
         // grace holds the decision until post-spawn writes are observable.
@@ -5554,6 +5711,8 @@ export class Daemon extends EventEmitter {
                 return;
             if (!this.observeInteractionPane(pane, captureStartedAt, interactionCaptureAt, undefined, interactionCaptureOrder, reason !== "interaction_confirmation"))
                 return;
+            // #1691: an accepted capture of this launch is a fresh read for the unrecognised-prompt evidence too (#1695 r3).
+            this.noteFreshPaneRead(pane, interactionCaptureAt);
             this.updateInputBlockedState(pane);
             // Advance the shared 10s timer only for a fresh capture of this launch.
             const deliveryFallback = deliveryCandidate === true
@@ -6712,6 +6871,9 @@ export class Daemon extends EventEmitter {
                 if (residue !== "clear")
                     return this.failDelivery(verdict, status, "input-residue", residue);
                 const written = await this.writeMessageToPane(formatted, windowId, handingOffToNativeQueue, status, opts?.submissionId, verdict, opts?.durableAttempt, opts?.steer === true, writeCurrent);
+                // #1690: still under the lock — whatever waits on it next must already see what this write started.
+                if (verdict.paneWriteStarted)
+                    opts?.onPaneWritten?.();
                 // The hand-off's last capture had no box: nothing was begun or written — wait for readiness, then try again.
                 if (written === "handoff-box-unread")
                     return "dialog";
@@ -6759,7 +6921,148 @@ export class Daemon extends EventEmitter {
      * on purpose ("I trust", "Yes, continue") and would match ordinary prose.
      */
     deliveryBlockingDialogs() {
-        return (this.backend?.getRuntimeDialogs?.() ?? []).filter(d => d.blocksDelivery || d.holdOnly);
+        return this.runtimeDialogs().filter(d => d.blocksDelivery || d.holdOnly);
+    }
+    /**
+     * The backend's runtime dialogs, then #1691's catch-all for a prompt none of them knows (last: known ones win). The
+     * catch-all is listed only while such a prompt is active: otherwise it could match nothing, and a backend with no
+     * dialogs keeps its empty list (its delivery path skips the dialog probe, as before).
+     */
+    runtimeDialogs() {
+        const dialogs = this.backend?.getRuntimeDialogs?.() ?? [];
+        return this.unrecognisedPromptCurrent()?.active ? [...dialogs, this.unrecognisedPromptDialog] : dialogs;
+    }
+    /**
+     * #1691: is the pane at the CLI's own idle composer? Then whatever looks like a prompt above it is transcript output
+     * (an agent's numbered list, a quoted "[y/n]"), not a prompt. The backend's own reading, most specific first.
+     */
+    cliComposerShowing(pane, shape) {
+        const backend = this.backend;
+        if (!backend)
+            return false;
+        if (backend.readInputRow)
+            return backend.readInputRow(pane) !== null;
+        // muse: its live input box — null when the bottom of the screen is not its layout (#829), e.g. a selection menu.
+        if (backend.inputDraft)
+            return backend.inputDraft(pane) !== null;
+        if (backend.isDeliveryInputReadyPane)
+            return backend.isDeliveryInputReadyPane(pane);
+        const bottom = backend.getBottomReadyPattern?.();
+        if (bottom) {
+            bottom.lastIndex = 0;
+            return bottom.test(pane);
+        }
+        // No reader of its own (opencode, grok, …): its ready chrome BELOW the prompt rows — a status bar or prompt hint drawn
+        // under its input box (opencode's "ctrl+p commands"), which a prompt shown in place of the input has nothing of. Not
+        // the whole pane (a reply quoting "ctrl+p commands" higher up), and never the prompt's own rows: a ready pattern that
+        // is just a cursor glyph would otherwise read the menu's own "❯ 1." as the CLI's prompt (#1695 r2).
+        const rows = pane.replace(/\r/g, "").split("\n").map(r => r.trimEnd());
+        const lastOwn = (shape.block.split("\n").at(-1) ?? "").trim();
+        let end = -1;
+        for (let i = rows.length - 1; i >= 0; i--)
+            if (rows[i].trim() === lastOwn) {
+                end = i;
+                break;
+            }
+        if (end < 0)
+            return false;
+        const below = rows.slice(end + 1).filter(r => r.trim() !== "").slice(0, COMPOSER_TAIL_ROWS).join("\n");
+        const ready = backend.getReadyPattern();
+        ready.lastIndex = 0;
+        return below !== "" && ready.test(below);
+    }
+    /**
+     * #1691: the prompt shape this pane shows, when nothing else explains it (no known dialog, login, idle composer, and
+     * the CLI is not showing its busy indicator).
+     */
+    unrecognisedPromptCandidate(pane) {
+        const shape = unrecognisedPromptShape(pane);
+        if (!shape)
+            return null;
+        const busy = this.backend?.getBusyPattern?.() ?? null;
+        if (busy) {
+            busy.lastIndex = 0;
+            if (busy.test(pane))
+                return null;
+        }
+        if ((this.backend?.getRuntimeDialogs?.() ?? []).some(dialog => Daemon.dialogMatches(dialog, pane)))
+            return null;
+        if (LOGIN_FLOWS[this.config.backend ?? "claude-code"]?.loginScreenActive?.(pane))
+            return null;
+        if (this.cliComposerShowing(pane, shape))
+            return null;
+        return shape;
+    }
+    /**
+     * #1691, from each runtime scan: the same unexplained prompt block unchanged for UNRECOGNISED_PROMPT_STABLE_MS
+     * becomes active (held, awaiting_input, reported once by trackDialogParked). Any other screen ends it. A turn keeps
+     * changing the pane (spinner, timer, streamed text), so its clock never completes mid-turn.
+     */
+    trackUnrecognisedPrompt(pane, mono, outputMoved) {
+        if (mono < this.unrecognisedPromptReadAt)
+            return;
+        this.unrecognisedPromptReadAt = mono;
+        const shape = this.unrecognisedPromptCandidate(pane);
+        if (!shape) {
+            this.unrecognisedPrompt = null;
+            return;
+        }
+        const screen = Daemon.stableScreen(pane);
+        const owner = this.interactionOwner();
+        const current = this.unrecognisedPromptCurrent();
+        // Restart the minute on any change: another prompt, motion anywhere on the screen, output that arrived while this
+        // capture was taken, or evidence from another launch (#1695 review).
+        if (!current || current.block !== shape.block || current.screen !== screen || outputMoved) {
+            this.unrecognisedPrompt = { block: shape.block, shape, since: mono, active: false, reportedElsewhere: false, screen, owner };
+            return;
+        }
+        if (!current.active && mono - current.since >= UNRECOGNISED_PROMPT_STABLE_MS) {
+            current.active = true;
+            // A [y/n] the interactive-prompt detector knows was already told (interactive_prompt, after 10 s): held and
+            // awaiting input from here on, but not reported a second time.
+            current.reportedElsewhere = shape.kind === "yes-no" && this.interactivePromptDetector.match(pane) !== null;
+            this.logger.warn({ shape: shape.kind, options: shape.options, question: shape.question, unchangedForMs: Math.round(mono - current.since) }, "CLI is waiting on a prompt AgEnD does not recognise — holding deliveries, reporting for a human (capture this pane for the per-version audit, ffb8104e)");
+        }
+    }
+    /** #1691: the tracked evidence, if it still belongs to this launch (else it is dropped). */
+    unrecognisedPromptCurrent() {
+        const current = this.unrecognisedPrompt;
+        if (current && (this.runtimeMonitorsFrozen || !sameInteractionOwner(current.owner, this.interactionOwner()))) {
+            this.unrecognisedPrompt = null;
+            return null;
+        }
+        return current;
+    }
+    /**
+     * #1691: the catch-all's predicate — the tracked prompt is active and this pane still shows exactly it (any reader:
+     * the scan, a probe, an interaction re-capture). Ending the evidence on a read without it is noteFreshPaneRead's.
+     */
+    unrecognisedPromptActive(pane) {
+        const current = this.unrecognisedPromptCurrent();
+        return !!current?.active && this.unrecognisedPromptCandidate(pane)?.block === current.block && Daemon.stableScreen(pane) === current.screen;
+    }
+    /**
+     * #1691: a fresh pane read outside the scan (a delivery probe, an accepted state re-capture), taken at `mono`. When it
+     * no longer shows exactly the tracked prompt, the evidence ends — counting or active, so a return needs a fresh minute
+     * (#1695 r2). When it does, it is the newest confirmation. Either way only a read newer than the newest read that
+     * decided the evidence counts: an older one, finishing late, says nothing about now (#1695 r3, r4).
+     */
+    noteFreshPaneRead(pane, mono) {
+        if (mono < this.unrecognisedPromptReadAt)
+            return;
+        // Advanced even with nothing tracked: a scan whose capture is older must not start evidence this read contradicts
+        // (#1695 r5).
+        this.unrecognisedPromptReadAt = mono;
+        const current = this.unrecognisedPromptCurrent();
+        if (!current)
+            return;
+        if (this.unrecognisedPromptCandidate(pane)?.block === current.block && Daemon.stableScreen(pane) === current.screen)
+            return;
+        this.unrecognisedPrompt = null;
+    }
+    /** #1691: the screen as the stability clock compares it (trailing blanks are not motion). */
+    static stableScreen(pane) {
+        return pane.replace(/\r/g, "").split("\n").map(r => r.trimEnd()).join("\n").trimEnd();
     }
     /** Passive input-unavailable phases relevant to the current spawn only. */
     guardedInputTransients() {
@@ -6927,7 +7230,7 @@ export class Daemon extends EventEmitter {
         return dialog.isActive ? dialog.isActive(pane) : dialog.pattern.test(pane);
     }
     /** Refresh the separate stdin-blocked observation from one pane capture. */
-    updateInputBlockedState(pane, dialogs = this.backend?.getRuntimeDialogs?.() ?? []) {
+    updateInputBlockedState(pane, dialogs = this.runtimeDialogs()) {
         const active = dialogs.find(dialog => dialog.inputBlocked && Daemon.dialogMatches(dialog, pane)) ?? null;
         const nextKey = active ? Daemon.dialogKey(active) : null;
         if (nextKey !== this.inputBlockedDialogKey) {
@@ -7015,9 +7318,15 @@ export class Daemon extends EventEmitter {
     async probeBlockingDialog() {
         if (!this.tmux || !this.backend)
             return { state: "clear" };
+        // #1691: a probe is a fresh read — it may end unrecognised-prompt evidence even when no dialog is listed.
+        const tracking = this.unrecognisedPrompt !== null;
         const dialogs = this.deliveryBlockingDialogs();
-        if (dialogs.length === 0)
+        // #1690: our own switch is being answered — nothing else types into the pane until it has settled.
+        if (this.ownSwitch && dialogs.length > 0)
+            return { state: "dialog", dialog: dialogs[0] };
+        if (dialogs.length === 0 && !tracking)
             return { state: "clear" };
+        const probeMono = performance.now();
         let pane;
         try {
             pane = await this.tmux.capturePane();
@@ -7026,6 +7335,7 @@ export class Daemon extends EventEmitter {
             this.logger.debug({ err }, "capture-pane failed during the dialog probe — pane state unknown");
             return { state: "unknown" };
         }
+        this.noteFreshPaneRead(pane, probeMono);
         for (const dialog of dialogs) {
             if (!Daemon.dialogMatches(dialog, pane))
                 continue;
@@ -7235,11 +7545,16 @@ export class Daemon extends EventEmitter {
             this.dialogParkedReported = false;
             return;
         }
-        if (!this.dialogParkedReported && Date.now() - this.dialogParkedSince >= DIALOG_PARKED_NOTIFY_MS) {
+        // #1691: the catch-all waited its minute before it became active; it is reported on the next scan.
+        const unrecognised = dialog === this.unrecognisedPromptDialog;
+        if (unrecognised && this.unrecognisedPrompt?.reportedElsewhere)
+            this.dialogParkedReported = true;
+        if (!this.dialogParkedReported && Date.now() - this.dialogParkedSince >= (unrecognised ? 0 : DIALOG_PARKED_NOTIFY_MS)) {
             this.dialogParkedReported = true;
             this.logger.warn({ dialog: dialog.description, parkedForMs: Date.now() - this.dialogParkedSince }, "CLI dialog is still on screen — not auto-answering, reporting for a human");
             this.emit("dialog_parked", { name: this.name, description: dialog.description, holdOnly: dialog.holdOnly === true,
-                ...(episode !== null && interaction.kind ? { kind: interaction.kind, episode, backend: this.config.backend ?? "claude-code" } : {}) });
+                ...(episode !== null && interaction.kind ? { kind: interaction.kind, episode, backend: this.config.backend ?? "claude-code" } : {}),
+                ...(unrecognised ? { unrecognised: true, question: this.unrecognisedPrompt?.shape.question ?? null } : {}) });
         }
     }
     /**
@@ -10704,7 +11019,7 @@ export class Daemon extends EventEmitter {
         if (launchFence !== this.launchFenceEpoch)
             throw new Error("Launch cancelled: the instance was stopped or paused while the launch was being prepared");
         this.backend.writeConfig(backendConfig);
-        this.backend.preTrust?.(this.config.working_directory);
+        this.backend.preTrust?.(this.config.working_directory, backendConfig);
         // Resolve working directory (e.g. symlink for hidden paths)
         const resolvedCwd = this.backend.resolveWorkingDirectory?.(this.config.working_directory, this.name) ?? this.config.working_directory;
         // Generate a fresh per-instance agent token each spawn. agent-cli reads
@@ -11344,6 +11659,14 @@ export class Daemon extends EventEmitter {
         }, "Snapshot written");
         return snapshot;
     }
+    /** #1699: the claude config dir this instance's CLI uses — its credential profile's, else exactly as before. */
+    claudeConfigDir() {
+        return claudeConfigDirFor(claudeProfileConfigDir(this.config.backend_options?.["claude-code"]));
+    }
+    /** Where this instance's CLI keeps the conversation a turn resume is judged on (#1699: claude's follows the profile). */
+    resumeRoots(workingDirectory) {
+        return { instanceDir: this.instanceDir, workingDirectory, claudeConfigDir: this.claudeConfigDir() };
+    }
     /**
      * The credential profile's store this instance's CLI writes to, if any.
      *