@zswarm/core 0.2.2 → 0.2.4

package/dist/host/services.js

@@ -11,6 +11,14 @@ export const defaultRunner = (cmd, args) => {
     const res = spawnSync(cmd, args, { encoding: "utf8" });
     return { status: res.status ?? 1, stdout: res.stdout ?? "", stderr: res.stderr ?? (res.error?.message ?? "") };
 };
+/** A synchronous sleep for install paths (Node allows Atomics.wait on its main thread). */
+function defaultSleep(ms) {
+    if (ms > 0)
+        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function hostSleep(host, ms) {
+    (host.sleep ?? defaultSleep)(ms);
+}
 /** The account services are installed for: the current user, or `runAs` when root. */
 export function serviceAccount(runAs, run = defaultRunner) {
     const platform = process.platform;
@@ -181,11 +189,30 @@ function launchdPlistPath(account, label) {
 function xml(text) {
     return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-export function launchdPlist(account, spec) {
+/**
+ * The account's per-user temp dir. launchd gives daemons no TMPDIR, so Zellij
+ * would fall back to it anyway; naming it explicitly lets every caller (an SSH
+ * shell, a script that sets TMPDIR) agree on one Zellij socket dir. Resolved as
+ * the account so root writing a foreign LaunchDaemon gets that account's dir.
+ */
+function darwinUserTempDir(account, run) {
+    const argv = [...(account.foreign ? accountArgv(account) : []), "getconf", "DARWIN_USER_TEMP_DIR"];
+    const [cmd, ...args] = argv;
+    if (!cmd)
+        return undefined;
+    const res = run(cmd, args);
+    const dir = res.status === 0 ? res.stdout.trim() : "";
+    return dir || undefined;
+}
+export function launchdPlist(account, spec, run = defaultRunner) {
     checkName(spec.name);
     const label = launchdLabel(account, spec.name);
     const log = join(account.home, "Library", "Logs", "zswarm", `${spec.name}.log`);
-    const env = { HOME: account.home, USER: account.user, ...(spec.env ?? {}) };
+    const env = { HOME: account.home, USER: account.user };
+    const tmpdir = darwinUserTempDir(account, run);
+    if (tmpdir)
+        env.TMPDIR = tmpdir;
+    Object.assign(env, spec.env ?? {});
     const lines = [
         '<?xml version="1.0" encoding="UTF-8"?>',
         '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
@@ -217,6 +244,36 @@ function launchdDomain(host) {
     const gui = `gui/${a.uid}`;
     return host.run("launchctl", ["print", gui]).status === 0 ? gui : `user/${a.uid}`;
 }
+/** launchd removes a booted-out job asynchronously; wait until print stops seeing it. */
+const BOOTOUT_WAIT_MS = 10_000;
+const BOOTOUT_POLL_MS = 250;
+/** bootstrap racing that teardown fails with EIO (5) or 37; retry a couple of times. */
+const BOOTSTRAP_RETRIES = 2;
+const BOOTSTRAP_RETRY_MS = 1_000;
+function waitForBootout(host, domain, label) {
+    const deadline = Date.now() + BOOTOUT_WAIT_MS;
+    for (;;) {
+        if (host.run("launchctl", ["print", `${domain}/${label}`]).status !== 0)
+            return;
+        const left = deadline - Date.now();
+        if (left <= 0)
+            return;
+        hostSleep(host, Math.min(BOOTOUT_POLL_MS, left));
+    }
+}
+function bootstrapLaunchd(host, domain, path, label) {
+    let last;
+    for (let attempt = 0; attempt <= BOOTSTRAP_RETRIES; attempt++) {
+        const res = host.run("launchctl", ["bootstrap", domain, path]);
+        if (res.status === 0)
+            return;
+        last = res;
+        if (!/Bootstrap failed: (5|37):/.test(res.stderr || res.stdout) || attempt === BOOTSTRAP_RETRIES)
+            break;
+        hostSleep(host, BOOTSTRAP_RETRY_MS);
+    }
+    must(last, `launchctl bootstrap ${domain} ${label}`);
+}
 // ------------------------------------------------------------------ common
 /** Write, (re)load and start the services. Returns what it did, one line per unit. */
 export function installServices(host, specs) {
@@ -257,9 +314,10 @@ export function installServices(host, specs) {
     for (const spec of specs) {
         const label = launchdLabel(a, spec.name);
         const path = launchdPlistPath(a, label);
-        fs.write(path, launchdPlist(a, spec), 0o644);
+        fs.write(path, launchdPlist(a, spec, host.run), 0o644);
         host.run("launchctl", ["bootout", `${domain}/${label}`]);
-        must(host.run("launchctl", ["bootstrap", domain, path]), `launchctl bootstrap ${domain} ${label}`);
+        waitForBootout(host, domain, label);
+        bootstrapLaunchd(host, domain, path, label);
         lines.push(`${label} loaded in ${domain}`);
     }
     return { lines, notes };
@@ -298,7 +356,16 @@ export function serviceStates(host, specs) {
         return specs.map((spec) => {
             const unit = systemdUnitName(spec.name, spec.kind);
             const state = systemctl(host, ["is-active", unit]).stdout.trim() || "unknown";
-            return { name: spec.name, unit, state, active: state === "active" };
+            const props = systemctl(host, ["show", unit, "-p", "MainPID", "-p", "ExecMainStatus"]).stdout;
+            const pid = Number(/^MainPID=(\d+)$/m.exec(props)?.[1] ?? NaN);
+            const exit = /^ExecMainStatus=(-?\d+)$/m.exec(props)?.[1];
+            const lastExit = exit === undefined ? undefined : Number(exit);
+            return {
+                name: spec.name,
+                unit,
+                active: state === "active",
+                ...describeJob(spec, state, Number.isFinite(pid) && pid > 0 ? pid : undefined, lastExit),
+            };
         });
     }
     const domain = launchdDomain(host);
@@ -307,12 +374,41 @@ export function serviceStates(host, specs) {
         const res = host.run("launchctl", ["print", `${domain}/${label}`]);
         if (res.status !== 0)
             return { name: spec.name, unit: label, state: "not loaded", active: false };
-        const state = /^\s*state = (.+)$/m.exec(res.stdout)?.[1]?.trim() ?? "loaded";
-        // Oneshot and interval jobs sit "not running" between runs; loaded is up for them.
-        const active = spec.kind === "daemon" ? state === "running" : true;
-        return { name: spec.name, unit: label, state, active };
+        const raw = /^\s*state = (.+)$/m.exec(res.stdout)?.[1]?.trim() ?? "loaded";
+        const pid = Number(/^\s*pid = (\d+)$/m.exec(res.stdout)?.[1] ?? NaN);
+        const exit = /last exit code = (-?\d+)/.exec(res.stdout)?.[1];
+        const lastExit = exit === undefined ? undefined : Number(exit);
+        const pidOrUndef = Number.isFinite(pid) && pid > 0 ? pid : undefined;
+        // Oneshot and interval jobs sit "not running" between runs; being loaded is up for them.
+        const active = spec.kind === "daemon" ? raw === "running" : true;
+        return {
+            name: spec.name,
+            unit: label,
+            active,
+            ...describeJob(spec, spec.kind === "daemon" ? raw : "loaded", pidOrUndef, lastExit),
+        };
     });
 }
+/**
+ * Word a service by what it is: a daemon is running with a pid, an interval
+ * job is a timer and a oneshot has run; the raw platform state reads like a
+ * failure between timer runs.
+ */
+function describeJob(spec, healthy, pid, lastExit) {
+    const parts = [];
+    if (spec.kind === "daemon") {
+        parts.push(pid === undefined ? healthy : `running (pid ${pid})`);
+    }
+    else if (spec.kind === "interval") {
+        parts.push(`timer every ${Math.max(30, Math.floor(spec.intervalSec ?? 120))} s`, healthy);
+    }
+    else {
+        parts.push("oneshot", healthy);
+    }
+    if (lastExit !== undefined)
+        parts.push(`last exit ${lastExit}`);
+    return { state: parts.join(", "), pid, lastExit };
+}
 function must(res, what) {
     if (res.status !== 0) {
         throw new ZellijError("failed", `${what} failed: ${(res.stderr || res.stdout).trim().slice(0, 300)}`);

package/dist/index.d.ts

@@ -4,12 +4,13 @@ export { createExec, NOT_FOUND_EXIT, type ExecFn, type ExecOptions, type ExecRes
 export { createGitClient, defaultWorktreeRoot, normalizeRepoPath, parseWorktreeList, worktreeDirName, type GitClient, type GitClientOptions, type Worktree, } from "./git.js";
 export { expandHomePath, looksLikeZswarmBinary, isZellijVersionOutput, resolveZellijBinary, resetZellijIdentityCache, sanitizeZellijEnv, validateSshDestination, validateSshMode, type ZellijExecFn, type ZellijExecResult, } from "./zellij/binary.js";
 export { normalizePaneId, parsePaneList, resolvePane, type ZellijPane, } from "./zellij/panes.js";
-export { liveSessionNames, parseSessionList, resolveSelfPaneId, type ZellijSession, type ZellijSessionResolve, } from "./zellij/session.js";
+export { liveSessionNames, parseCreatedAge, parseSessionList, resolveSelfPaneId, type ZellijSession, type ZellijSessionResolve, } from "./zellij/session.js";
 export { buildClosePaneArgs, buildDumpArgs, buildLaunchPluginArgs, buildListPanesArgs, buildNewPaneArgs, buildNewTabArgs, buildPasteArgs, buildPipeArgs, buildSendEnterArgs, buildSendKeysArgs, buildWriteCharsArgs, scrollbackPayload, waitPayload, type LaunchPluginInput, type NewPaneInput, type NewTabInput, type PaneDirection, type PipeInput, type ScrollbackRequest, type WaitRequest, } from "./zellij/args.js";
 export { busPluginUrl, busToPanes, isBusPluginPane, nextConfigKey, parseBusReply, parseScrollbackReply, resolveBusPlugin, scrollbackToScreen, BUS_PIPE_NAME, DEFAULT_BUS_KEY, DEFAULT_BUS_TIMEOUT_MS, type BusMarker, type BusPane, type BusScrollback, type BusScrollbackPane, type BusSnapshot, } from "./zellij/bus.js";
 export { busSnapshot, closeBusPluginPanes, planBus, resetBusCache, type BusPlan, } from "./ops/bus.js";
 export { createZellijClient, type ZellijClient, type ZellijClientOptions, type ZellijTransport, } from "./zellij/client.js";
-export { createStateStore, defaultStateDir, type LogEntry, type SignalChannel, type StateStore, type StateStoreOptions, } from "./state.js";
+export { createStateStore, defaultStateDir, type LeaseRecord, type LogEntry, type SignalChannel, type StateStore, type StateStoreOptions, } from "./state.js";
+export { findLease, leaseKey, leaseStale, listLeases, releaseLease, releaseLeaseKey, takeLease, type LeaseTakeInput, type LeaseTakeResult, type LeaseTarget, } from "./host/lease.js";
 export { dispatchZswarm, resolveInvocationEnv } from "./ops/dispatch.js";
 export { assertOpAllowed, assertPaneAllowed, isWriteOp, loadPolicy, type Policy, } from "./policy.js";
 export { buildSshRemoteCommand, createSshExec, quoteRemoteArg, shellQuote, type IpcDiscoveryState, type SshExecFn, type SshTarget, } from "./exec.js";
@@ -23,7 +24,7 @@ export { parseTabList, resolveTab, type ZellijTab } from "./zellij/tabs.js";
 export { selectTargets } from "./ops/broadcast.js";
 export { diffScreens, cursorKey } from "./ops/tail.js";
 export { classify, lastLine, mapPool, peerStatus, DEFAULT_STATUS_TIMEOUT_MS, STATUS_DUMP_CONCURRENCY, type PeerState, } from "./ops/status.js";
-export { normalizeScreen, truncateDumpText, DEFAULT_DUMP_MAX_CHARS, DEFAULT_WAIT_MAX_CHARS, } from "./ops/util.js";
+export { normalizeScreen, unfoldScreen, truncateDumpText, DEFAULT_DUMP_MAX_CHARS, DEFAULT_WAIT_MAX_CHARS, } from "./ops/util.js";
 export type { RoutingContext } from "./ops/routing.js";
 export type { DispatchDeps, OpsResult, ServeInstallDeps } from "./ops/types.js";
 export { DEFAULT_DOCTOR_TIMEOUT_MS, DOCTOR_FAILED_CODE, DOCTOR_SCOPE_FIELD, DOCTOR_SCOPE_HOST, DOCTOR_TAILSCALE_MAX_MS, HOST_REPORT_INCOMPLETE_CODE, HOST_REPORT_INVALID_CODE, doctorOp, inspectDoctorHost, coverHostReport, hostDoctorRequest, isRequiredFailure, mergeHostReply, type DoctorCheck, type DoctorCheckScope, type DoctorCheckState, type DoctorReport, type DoctorRoute, type HostInspectInput, } from "./ops/doctor.js";
@@ -34,5 +35,5 @@ export { findPython, runSlot, slotScriptPath } from "./host/slot.js";
 export { installServeService, serveServiceName, serveServiceSpec, serveTokenFromEnv, serveTokenPath, uninstallServeService, SERVE_AWAIT_SESSION_ENV, SERVE_TOKEN_FILE_ENV, type ServeServiceInput, } from "./host/serve-service.js";
 export { accountArgv, installServices, launchdLabel, launchdPlist, removeServices, serviceAccount, serviceStates, systemdUnitName, systemdUnits, writeAccountFile, type Runner, type ServiceAccount, type ServiceHost, type ServiceKind, type ServiceSpec, type ServiceState, } from "./host/services.js";
 export { crewCheck, crewDir, crewDown, crewServiceSpecs, crewStart, crewStatus, crewUp, firstLayoutPane, parseEnvFile, CREW_UNIT_ENV, CREW_WATCH_SEC, type CrewDeps, type CrewUpInput, } from "./host/crew.js";
-export { deliverMessage, doneLines, fillMessage, freshDoneLine, launchRelay, prepareRelay, pruneRelays, relayLoop, relaysDir, runRelayDir, scrubRelayToken, startRelay, waitForRelay, type RelayConfig, type RelayDeps, type RelayStartInput, type RelayStatus, } from "./host/relay.js";
+export { cancelAllTo, cancelRelay, deliverMessage, doneLines, fillMessage, freshDoneLine, launchRelay, listRelays, prepareRelay, pruneRelays, relayLoop, relaysDir, runRelayDir, scrubRelayToken, startRelay, waitForRelay, type RelayAdminDeps, type RelayCancelResult, type RelayConfig, type RelayDeps, type RelayJob, type RelayJobRunner, type RelayRow, type RelayStartInput, type RelayStatus, } from "./host/relay.js";
 export { hostChecks, hostDoctor, hostInstall, hostInstallArgs, hostScriptPath, parseHostReport, type HostCheck, type HostDoctorInput, type HostInstallInput, type SshRunner, } from "./host/host.js";

package/dist/index.js

@@ -4,12 +4,13 @@ export { createExec, NOT_FOUND_EXIT, } from "./exec.js";
 export { createGitClient, defaultWorktreeRoot, normalizeRepoPath, parseWorktreeList, worktreeDirName, } from "./git.js";
 export { expandHomePath, looksLikeZswarmBinary, isZellijVersionOutput, resolveZellijBinary, resetZellijIdentityCache, sanitizeZellijEnv, validateSshDestination, validateSshMode, } from "./zellij/binary.js";
 export { normalizePaneId, parsePaneList, resolvePane, } from "./zellij/panes.js";
-export { liveSessionNames, parseSessionList, resolveSelfPaneId, } from "./zellij/session.js";
+export { liveSessionNames, parseCreatedAge, parseSessionList, resolveSelfPaneId, } from "./zellij/session.js";
 export { buildClosePaneArgs, buildDumpArgs, buildLaunchPluginArgs, buildListPanesArgs, buildNewPaneArgs, buildNewTabArgs, buildPasteArgs, buildPipeArgs, buildSendEnterArgs, buildSendKeysArgs, buildWriteCharsArgs, scrollbackPayload, waitPayload, } from "./zellij/args.js";
 export { busPluginUrl, busToPanes, isBusPluginPane, nextConfigKey, parseBusReply, parseScrollbackReply, resolveBusPlugin, scrollbackToScreen, BUS_PIPE_NAME, DEFAULT_BUS_KEY, DEFAULT_BUS_TIMEOUT_MS, } from "./zellij/bus.js";
 export { busSnapshot, closeBusPluginPanes, planBus, resetBusCache, } from "./ops/bus.js";
 export { createZellijClient, } from "./zellij/client.js";
 export { createStateStore, defaultStateDir, } from "./state.js";
+export { findLease, leaseKey, leaseStale, listLeases, releaseLease, releaseLeaseKey, takeLease, } from "./host/lease.js";
 export { dispatchZswarm, resolveInvocationEnv } from "./ops/dispatch.js";
 export { assertOpAllowed, assertPaneAllowed, isWriteOp, loadPolicy, } from "./policy.js";
 export { buildSshRemoteCommand, createSshExec, quoteRemoteArg, shellQuote, } from "./exec.js";
@@ -23,7 +24,7 @@ export { parseTabList, resolveTab } from "./zellij/tabs.js";
 export { selectTargets } from "./ops/broadcast.js";
 export { diffScreens, cursorKey } from "./ops/tail.js";
 export { classify, lastLine, mapPool, peerStatus, DEFAULT_STATUS_TIMEOUT_MS, STATUS_DUMP_CONCURRENCY, } from "./ops/status.js";
-export { normalizeScreen, truncateDumpText, DEFAULT_DUMP_MAX_CHARS, DEFAULT_WAIT_MAX_CHARS, } from "./ops/util.js";
+export { normalizeScreen, unfoldScreen, truncateDumpText, DEFAULT_DUMP_MAX_CHARS, DEFAULT_WAIT_MAX_CHARS, } from "./ops/util.js";
 export { DEFAULT_DOCTOR_TIMEOUT_MS, DOCTOR_FAILED_CODE, DOCTOR_SCOPE_FIELD, DOCTOR_SCOPE_HOST, DOCTOR_TAILSCALE_MAX_MS, HOST_REPORT_INCOMPLETE_CODE, HOST_REPORT_INVALID_CODE, doctorOp, inspectDoctorHost, coverHostReport, hostDoctorRequest, isRequiredFailure, mergeHostReply, } from "./ops/doctor.js";
 export { normalizeKey, normalizeKeys, tokenizeCommand } from "./keys.js";
 export { cliUsage, mcpInputSchema, parseCliArgv, MCP_TOOL_DESCRIPTION, OP_NAMES, PARAMS, TARGET_OPS, } from "./schema.js";
@@ -32,5 +33,5 @@ export { findPython, runSlot, slotScriptPath } from "./host/slot.js";
 export { installServeService, serveServiceName, serveServiceSpec, serveTokenFromEnv, serveTokenPath, uninstallServeService, SERVE_AWAIT_SESSION_ENV, SERVE_TOKEN_FILE_ENV, } from "./host/serve-service.js";
 export { accountArgv, installServices, launchdLabel, launchdPlist, removeServices, serviceAccount, serviceStates, systemdUnitName, systemdUnits, writeAccountFile, } from "./host/services.js";
 export { crewCheck, crewDir, crewDown, crewServiceSpecs, crewStart, crewStatus, crewUp, firstLayoutPane, parseEnvFile, CREW_UNIT_ENV, CREW_WATCH_SEC, } from "./host/crew.js";
-export { deliverMessage, doneLines, fillMessage, freshDoneLine, launchRelay, prepareRelay, pruneRelays, relayLoop, relaysDir, runRelayDir, scrubRelayToken, startRelay, waitForRelay, } from "./host/relay.js";
+export { cancelAllTo, cancelRelay, deliverMessage, doneLines, fillMessage, freshDoneLine, launchRelay, listRelays, prepareRelay, pruneRelays, relayLoop, relaysDir, runRelayDir, scrubRelayToken, startRelay, waitForRelay, } from "./host/relay.js";
 export { hostChecks, hostDoctor, hostInstall, hostInstallArgs, hostScriptPath, parseHostReport, } from "./host/host.js";

package/dist/ops/delivery.d.ts

@@ -2,7 +2,7 @@ import type { StateStore } from "../state.js";
 import type { ZellijClient } from "../zellij/client.js";
 import type { ZellijPane } from "../zellij/panes.js";
 import type { Clock } from "./types.js";
-export type Submitted = boolean | "unverified";
+export type Submitted = boolean | "queued" | "unverified" | "not-delivered";
 export type DeliveryResult = {
     to: string;
     ok: boolean;
@@ -14,6 +14,36 @@ export type DeliveryResult = {
     };
 };
 export type SubmitMode = "auto" | "double-enter" | "none";
+/** Fixed send windows before adaptive scaling; explicit flags always win. */
+export declare const SEND_BUDGETS: {
+    /** Pause before checking the paste landed. */
+    readonly settleMs: 300;
+    /** Pane-lookup retry window for an absent pane. */
+    readonly observeMs: 1000;
+    /** The scaled window never exceeds this multiple of the default. */
+    readonly maxScale: 5;
+    /** A first Zellij call at or under this many ms is not "slow". */
+    readonly slowMs: 1000;
+    readonly settleMaxMs: 5000;
+    readonly observeMaxMs: 30000;
+};
+/**
+ * Scale the fixed settle/observe windows by how slow the send's first Zellij
+ * call was. A call under `slowMs` keeps the defaults; five seconds or more pins
+ * the 5x cap. Explicit `--settle-ms` / `--observe-ms` are returned as given,
+ * and a scaled value is capped by the call's own timeout so it cannot outlast
+ * the observation budget.
+ */
+export declare function scaleBudgets(input: {
+    firstCallMs: number;
+    timeoutMs: number;
+    settleMs?: number;
+    observeMs?: number;
+}): {
+    settleMs: number;
+    observeMs: number;
+    scale: number;
+};
 export type SenderSource = "arg" | "env" | "title" | "default";
 export type SenderLabel = {
     label: string;
@@ -54,14 +84,29 @@ export declare function resolveSubmitMode(args: Record<string, unknown>, pane: {
     command?: string | null;
     title?: string | null;
 }): SubmitMode;
+/**
+ * The body text to look for on screen: its first non-empty line, trimmed to 40
+ * chars. A prefix of the whole body (`body.slice(0, 40)`) can span a newline and
+ * then never matches any single screen line. A leading `[zswarm from=…]` header
+ * is skipped so we look for the caller's own first line.
+ */
+export declare function bodyNeedle(body: string): string;
 /** True when the paste still sits in the composer (bottom of the screen). */
 export declare function composerHolds(screen: string, body: string): boolean;
 /**
  * Compare the pane before vs after the paste.
  * Composer clearing (pasted text left the bottom input region) is submission.
  * `[Pasted text` in scrollback is not evidence.
+ *
+ * `not-delivered` is deliberately conservative: only when the screen is
+ * unchanged once the paste/composer itself is discounted and nothing is queued.
+ * A screen that changed while the body is gone is `unverified` — the pane may
+ * have taken the message and scrolled it away, and a false `not-delivered`
+ * makes the caller resend the whole message.
  */
-export declare function classifySubmit(before: string, after: string, body: string): Submitted;
+export declare function classifySubmit(before: string, after: string, body: string, opts?: {
+    queued?: (screen: string) => boolean;
+}): Submitted;
 /** Paste a body into one pane and record the attempt. */
 export declare function deliverTo(client: ZellijClient, state: StateStore, args: Record<string, unknown>, input: {
     session: string;
@@ -70,4 +115,8 @@ export declare function deliverTo(client: ZellijClient, state: StateStore, args:
     op: string;
     at: number;
     clock: Clock;
+    /** How long the send's first Zellij call took, for adaptive budgets. */
+    firstCallMs?: number;
+    /** The observation timeout the scaled windows are capped by. */
+    timeoutMs?: number;
 }): Promise<DeliveryResult>;

package/dist/ops/delivery.js

@@ -1,5 +1,35 @@
-import { resolveHarness } from "../harness.js";
+import { queuedPrompt, resolveHarness } from "../harness.js";
 import { isTrue, numberArg } from "./util.js";
+/** Fixed send windows before adaptive scaling; explicit flags always win. */
+export const SEND_BUDGETS = {
+    /** Pause before checking the paste landed. */
+    settleMs: 300,
+    /** Pane-lookup retry window for an absent pane. */
+    observeMs: 1_000,
+    /** The scaled window never exceeds this multiple of the default. */
+    maxScale: 5,
+    /** A first Zellij call at or under this many ms is not "slow". */
+    slowMs: 1_000,
+    settleMaxMs: 5_000,
+    observeMaxMs: 30_000,
+};
+/**
+ * Scale the fixed settle/observe windows by how slow the send's first Zellij
+ * call was. A call under `slowMs` keeps the defaults; five seconds or more pins
+ * the 5x cap. Explicit `--settle-ms` / `--observe-ms` are returned as given,
+ * and a scaled value is capped by the call's own timeout so it cannot outlast
+ * the observation budget.
+ */
+export function scaleBudgets(input) {
+    const raw = input.firstCallMs > SEND_BUDGETS.slowMs ? input.firstCallMs / SEND_BUDGETS.slowMs : 1;
+    const scale = Math.min(SEND_BUDGETS.maxScale, Math.max(1, raw));
+    const scaled = (base, hardMax) => Math.max(1, Math.floor(Math.min(base * scale, hardMax, input.timeoutMs)));
+    return {
+        settleMs: input.settleMs !== undefined ? Math.min(input.settleMs, SEND_BUDGETS.settleMaxMs) : scaled(SEND_BUDGETS.settleMs, SEND_BUDGETS.settleMaxMs),
+        observeMs: input.observeMs !== undefined ? Math.min(input.observeMs, SEND_BUDGETS.observeMaxMs) : scaled(SEND_BUDGETS.observeMs, SEND_BUDGETS.observeMaxMs),
+        scale,
+    };
+}
 /** Cursor / Claude leave this in scrollback after a successful submit. */
 const PASTE_MARKER = "[Pasted text";
 const SENDER_LABEL_MAX = 48;
@@ -78,44 +108,71 @@ function nonEmptyLines(screen) {
         .map((line) => line.replace(/\s+$/, ""))
         .filter((line) => line.length > 0);
 }
+/** All whitespace removed, so a body match survives a pane's line wrapping. */
+function withoutSpaces(text) {
+    return text.replace(/\s+/g, "");
+}
+/** True when `needle` appears in `text`, ignoring whitespace (wrapped panes). */
+function containsNeedle(text, needle) {
+    const wanted = withoutSpaces(needle);
+    return wanted.length > 0 && withoutSpaces(text).includes(wanted);
+}
+const ZSWARM_HEADER = /^\[zswarm from=/i;
+/**
+ * The body text to look for on screen: its first non-empty line, trimmed to 40
+ * chars. A prefix of the whole body (`body.slice(0, 40)`) can span a newline and
+ * then never matches any single screen line. A leading `[zswarm from=…]` header
+ * is skipped so we look for the caller's own first line.
+ */
+export function bodyNeedle(body) {
+    const lines = body
+        .replace(/\r/g, "")
+        .split("\n")
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0);
+    const first = lines.length > 0 && ZSWARM_HEADER.test(lines[0]) ? lines[1] : lines[0];
+    return (first ?? "").slice(0, 40);
+}
 function isPasteLine(line, needle) {
     if (line.includes(PASTE_MARKER))
         return true;
-    return needle.length > 0 && line.includes(needle);
+    return containsNeedle(line, needle);
 }
 /** True when the paste still sits in the composer (bottom of the screen). */
 export function composerHolds(screen, body) {
-    const needle = body.slice(0, 40);
+    const needle = bodyNeedle(body);
     const lines = nonEmptyLines(screen);
     const last3 = lines.slice(-3);
     const last = lines[lines.length - 1] ?? "";
     if (last.includes(PASTE_MARKER))
         return true;
-    return needle.length > 0 && last3.some((line) => line.includes(needle));
+    return containsNeedle(last3.join("\n"), needle);
 }
 /**
  * Compare the pane before vs after the paste.
  * Composer clearing (pasted text left the bottom input region) is submission.
  * `[Pasted text` in scrollback is not evidence.
+ *
+ * `not-delivered` is deliberately conservative: only when the screen is
+ * unchanged once the paste/composer itself is discounted and nothing is queued.
+ * A screen that changed while the body is gone is `unverified` — the pane may
+ * have taken the message and scrolled it away, and a false `not-delivered`
+ * makes the caller resend the whole message.
  */
-export function classifySubmit(before, after, body) {
-    const needle = body.slice(0, 40);
+export function classifySubmit(before, after, body, opts = {}) {
+    const needle = bodyNeedle(body);
     const beforeLines = nonEmptyLines(before);
     const afterLines = nonEmptyLines(after);
     const beforeNorm = beforeLines.join("\n");
-    const afterNorm = afterLines.join("\n");
     const last3 = afterLines.slice(-3);
     const last = afterLines[afterLines.length - 1] ?? "";
     const markerInLastLine = last.includes(PASTE_MARKER);
-    const bodyInLastRegion = needle.length > 0 && last3.some((line) => line.includes(needle));
+    const bodyInLastRegion = containsNeedle(last3.join("\n"), needle);
     const holds = bodyInLastRegion || markerInLastLine;
-    if (afterNorm === beforeNorm) {
-        // Marker may only count when it sits in the last-line region *and*
-        // nothing else moved — leftover scrollback must not flip the answer.
-        if (markerInLastLine)
-            return false;
-        return "unverified";
-    }
+    // The harness says it accepted the paste but queued it behind a running turn.
+    if (opts.queued?.(after))
+        return "queued";
+    // The paste is still in the composer: not submitted (Enter may rescue it).
     if (holds) {
         const withoutPaste = afterLines.filter((line) => !isPasteLine(line, needle));
         if (withoutPaste.join("\n") === beforeNorm)
@@ -128,9 +185,15 @@ export function classifySubmit(before, after, body) {
         return belowNovel.length > 0 ? true : false;
     }
     // Paste left the input region: still on screen, just not at the bottom.
-    if (needle.length > 0 && afterLines.some((line) => line.includes(needle))) {
+    if (containsNeedle(after, needle))
         return true;
-    }
+    // Nothing moved apart from the paste/composer itself and nothing is queued:
+    // positive evidence the paste never reached the pane, so a resend is safe.
+    const beforeApart = beforeLines.filter((line) => !isPasteLine(line, needle));
+    const afterApart = afterLines.filter((line) => !isPasteLine(line, needle));
+    if (afterApart.join("\n") === beforeApart.join("\n"))
+        return "not-delivered";
+    // The screen changed while the body is not visible: inconclusive, never a resend.
     return "unverified";
 }
 async function dumpOrNull(client, session, paneId) {
@@ -142,7 +205,8 @@ async function dumpOrNull(client, session, paneId) {
     }
 }
 async function verifySubmit(client, input) {
-    const { session, paneId, body, mode, settleMs, clock, before } = input;
+    const { session, paneId, body, mode, settleMs, clock, before, queued } = input;
+    const classify = (base, screen) => classifySubmit(base, screen, body, { queued });
     if (mode === "none")
         return "unverified";
     if (mode === "double-enter") {
@@ -156,47 +220,57 @@ async function verifySubmit(client, input) {
     const after = await dumpOrNull(client, session, paneId);
     if (after === null)
         return "unverified";
-    let verdict = classifySubmit(before, after, body);
-    if (verdict === true)
-        return true;
+    let verdict = classify(before, after);
+    if (verdict === true || verdict === "queued")
+        return verdict;
     if (verdict === false) {
         await client.sendKeys({ session, paneId, keys: ["Enter"] });
         await clock.sleep(settleMs);
         const rescued = await dumpOrNull(client, session, paneId);
         if (rescued === null)
             return "unverified";
-        verdict = classifySubmit(before, rescued, body);
-        if (verdict === true)
-            return true;
+        verdict = classify(before, rescued);
+        if (verdict === true || verdict === "queued")
+            return verdict;
         if (verdict === false)
             return false;
     }
-    // First look was inconclusive; TUIs often redraw after the first settle.
+    // Inconclusive or not (yet) on screen; TUIs often redraw after the first settle.
     await clock.sleep(Math.min(Math.max(settleMs * 2, 800), 5000));
     const later = await dumpOrNull(client, session, paneId);
     if (later === null)
-        return "unverified";
+        return verdict;
     if (composerHolds(after, body) && !composerHolds(later, body))
         return true;
-    return classifySubmit(before, later, body);
+    return classify(before, later);
 }
 /** Paste a body into one pane and record the attempt. */
 export async function deliverTo(client, state, args, input) {
-    const { session, pane, body, op, at, clock } = input;
+    const { session, pane, body, op, at, clock, firstCallMs = 0, timeoutMs = 30_000 } = input;
     const from = senderLabel(args);
     const mode = resolveSubmitMode(args, pane);
-    const settleMs = numberArg(args, "settleMs", 300, { min: 50, max: 5000 });
+    const profile = resolveHarness(pane);
+    const queued = (screen) => queuedPrompt(screen, profile);
+    const explicitSettle = args.settleMs !== undefined && args.settleMs !== null && args.settleMs !== "";
+    const budgets = scaleBudgets({
+        firstCallMs,
+        timeoutMs,
+        settleMs: explicitSettle ? numberArg(args, "settleMs", SEND_BUDGETS.settleMs, { min: 50, max: SEND_BUDGETS.settleMaxMs }) : undefined,
+    });
+    const settleMs = budgets.settleMs;
+    const confirmOnce = isTrue(args.confirm);
     try {
         let before = null;
         if (mode === "auto") {
             before = await dumpOrNull(client, session, pane.id);
         }
-        const delivered = await client.injectPane({
+        const paste = () => client.injectPane({
             session,
             paneId: pane.id,
             text: bodyText(client, args, body),
         });
-        const submitted = await verifySubmit(client, {
+        let delivered = await paste();
+        let submitted = await verifySubmit(client, {
             session,
             paneId: delivered.paneId,
             body,
@@ -204,7 +278,64 @@ export async function deliverTo(client, state, args, input) {
             settleMs,
             clock,
             before,
+            queued,
         });
+        // Opt-in confirm. A second paste is only safe on positive evidence the
+        // first never landed; a still-held composer gets Enter, and unverified just
+        // looks again. Never paste the body twice.
+        if (confirmOnce && mode === "auto" && submitted !== true && submitted !== "queued") {
+            if (submitted === "not-delivered") {
+                const retryBefore = await dumpOrNull(client, session, delivered.paneId);
+                delivered = await paste();
+                submitted = await verifySubmit(client, {
+                    session,
+                    paneId: delivered.paneId,
+                    body,
+                    mode,
+                    settleMs,
+                    clock,
+                    before: retryBefore,
+                    queued,
+                });
+            }
+            else if (submitted === false) {
+                // The paste is still in the composer: press Enter, never paste again.
+                await client.sendKeys({ session, paneId: delivered.paneId, keys: ["Enter"] });
+                const seen = await dumpOrNull(client, session, delivered.paneId);
+                if (seen !== null && before !== null) {
+                    submitted = classifySubmit(before, seen, body, { queued });
+                }
+            }
+            else {
+                // unverified: one more dump to report what is actually on screen.
+                const seen = await dumpOrNull(client, session, delivered.paneId);
+                if (seen !== null && before !== null) {
+                    submitted = classifySubmit(before, seen, body, { queued });
+                }
+            }
+        }
+        if (submitted === "not-delivered") {
+            state.appendLog({
+                at,
+                op,
+                session,
+                to: delivered.paneId,
+                from,
+                bytes: body.length,
+                ok: false,
+                detail: "submitted=not-delivered",
+            });
+            return {
+                to: delivered.paneId,
+                ok: false,
+                delivery: "zellij_paste",
+                submitted,
+                error: {
+                    code: "not_delivered",
+                    message: "the pane was unchanged apart from the composer after the send; the body never landed, so a resend is safe",
+                },
+            };
+        }
         state.appendLog({
             at,
             op,