@zswarm/core 0.2.7 → 0.2.8

package/dist/harness.d.ts

@@ -37,15 +37,23 @@ export type HarnessProfile = {
     /** Trailing lines showing the harness finished starting and is ready for input. */
     ready: readonly RegExp[];
 };
+type HarnessName = Exclude<HarnessProfile["name"], "unknown">;
 /**
- * Identify the harness from a pane's command and title, case-insensitively.
- * The command is the executable that spawned the pane, so it wins; the title
- * is the fallback for panes launched from a generic shell. Never throws.
+ * The stable, ordered list of known harness names. `--harness` validates
+ * against this and the schema help names it, so both stay in step with PROFILES.
+ */
+export declare const HARNESS_NAMES: readonly HarnessName[];
+/**
+ * Identify the harness, case-insensitively. An explicit `name` is the override
+ * for wrapper-launched panes whose command/title hides the real harness: a
+ * non-empty name must be one of `HARNESS_NAMES` (else `bad_arg`). Without an
+ * override the pane's command wins (the executable that spawned it), then the
+ * title for panes launched from a generic shell, then `unknown`.
  */
 export declare function resolveHarness(pane: {
     command?: string | null;
     title?: string | null;
-}): HarnessProfile;
+}, name?: string | null): HarnessProfile;
 /**
  * Does this screen's trailing lines show the harness's queued-message hint?
  * Only the last few lines count: a quoted marker in scrollback is not a queue.
@@ -64,3 +72,4 @@ export declare function busyPrompt(screen: string, profile: HarnessProfile): boo
  * must not make the restart op wait forever.
  */
 export declare function readyPrompt(screen: string, profile: HarnessProfile): boolean;
+export {};

package/dist/harness.js

@@ -1,3 +1,4 @@
+import { ZellijError } from "./errors.js";
 /** Command and title needles observed on real panes in one live session. */
 const PROFILES = [
     { name: "codex", command: ["codex"], title: ["agent-codex"] },
@@ -7,6 +8,11 @@ const PROFILES = [
     { name: "pi", command: ["pi"], title: ["agent-pi"] },
     { name: "claude", command: ["claude"], title: ["agent-claude"] },
 ];
+/**
+ * The stable, ordered list of known harness names. `--harness` validates
+ * against this and the schema help names it, so both stay in step with PROFILES.
+ */
+export const HARNESS_NAMES = PROFILES.map((p) => p.name);
 /**
  * Only codex needs a second Enter to submit: its composer keeps the pasted
  * message (`› [zswarm from=...]`) until an extra Enter lands — verified live
@@ -170,15 +176,8 @@ function matchTitle(title) {
     }
     return null;
 }
-/**
- * Identify the harness from a pane's command and title, case-insensitively.
- * The command is the executable that spawned the pane, so it wins; the title
- * is the fallback for panes launched from a generic shell. Never throws.
- */
-export function resolveHarness(pane) {
-    const name = matchCommand(pane.command) ?? matchTitle(pane.title) ?? "unknown";
-    if (name === "unknown")
-        return UNKNOWN;
+/** Assemble one known profile from the per-name tables, the one assembly path. */
+function profileFor(name) {
     return {
         name,
         submit: SUBMIT[name],
@@ -190,6 +189,27 @@ export function resolveHarness(pane) {
         ready: READY[name],
     };
 }
+/**
+ * Identify the harness, case-insensitively. An explicit `name` is the override
+ * for wrapper-launched panes whose command/title hides the real harness: a
+ * non-empty name must be one of `HARNESS_NAMES` (else `bad_arg`). Without an
+ * override the pane's command wins (the executable that spawned it), then the
+ * title for panes launched from a generic shell, then `unknown`.
+ */
+export function resolveHarness(pane, name) {
+    const override = name?.trim().toLowerCase();
+    if (override) {
+        const known = HARNESS_NAMES.find((candidate) => candidate === override);
+        if (!known) {
+            throw new ZellijError("bad_arg", `unknown harness "${name.trim()}"; known harnesses: ${HARNESS_NAMES.join(", ")}`);
+        }
+        return profileFor(known);
+    }
+    const inferred = matchCommand(pane.command) ?? matchTitle(pane.title) ?? "unknown";
+    if (inferred === "unknown")
+        return UNKNOWN;
+    return profileFor(inferred);
+}
 /**
  * Does this screen's trailing lines show the harness's queued-message hint?
  * Only the last few lines count: a quoted marker in scrollback is not a queue.

package/dist/host/cli.js

@@ -84,12 +84,23 @@ async function crew(argv) {
             return 2;
     }
 }
+/** The DELIVERY cell: the recorded verdict, a reply failure, or `-`. */
+function deliveryLabel(delivery) {
+    if (!delivery)
+        return "-";
+    if (delivery.submitted)
+        return delivery.submitted;
+    if (delivery.note)
+        return `failed:${delivery.note}`;
+    return "-";
+}
 /** A plain-text table for `relay --list`, one row per relay. */
 function relayTable(rows) {
-    const header = ["ID", "STATE", "TO", "SESSION", "AGE", "LAST CHECK", "JOB", "LEASE"];
+    const header = ["ID", "STATE", "DELIVERY", "TO", "SESSION", "AGE", "LAST CHECK", "JOB", "LEASE"];
     const body = rows.map((r) => [
         r.id,
         r.state,
+        deliveryLabel(r.delivery),
         r.to,
         r.session ?? "-",
         `${r.age}s`,
@@ -172,6 +183,7 @@ async function relay(argv) {
         to: str(flags["--to"]) ?? "",
         bodyFile: str(flags["--body-file"]),
         from: str(flags["--from"]),
+        harness: str(flags["--harness"]),
         done: str(flags["--done"]) ?? "",
         replyTo: str(flags["--reply-to"]) ?? "",
         replySession: str(flags["--reply-session"]),
@@ -245,16 +257,17 @@ const COMMANDS = {
     relay: {
         usage: [
             "zswarm relay --to PANE --done REGEX --reply-to PANE [--serve TARGET] [--session S] [--body-file F]",
-            "             [--reply-session S] [--from NAME] [--check SCRIPT] [--message TEMPLATE] [--id ID]",
+            "             [--reply-session S] [--from NAME] [--harness NAME] [--check SCRIPT] [--message TEMPLATE] [--id ID]",
             "             [--timeout-min 240] [--max-age MIN] [--queue] [--force] [--foreground] [--if-idle]",
             "      send the body to PANE over serve (ZSWARM_SERVE / ZSWARM_SERVE_TOKEN), then a detached relay",
             "      waits for REGEX (and SCRIPT exit 0) and pastes a message into the local --reply-to pane;",
+            "      --harness names the target harness and is passed on every send so delivery matches it;",
             "      --max-age (default --timeout-min + 60) is a hard end that always yields a final status",
             "      it leases its target pane until it ends; a second relay to a leased pane fails pane_leased",
             "      unless --queue waits for the lease to free or --force shares it",
             "      --if-idle applies send's busy check before the lease: a harness that shows it is working fails pane_busy",
             "      without sending; --queue then waits for the pane to go idle as well as for the lease, and --force skips the check",
-            "zswarm relay --list [--json]   id, state, target, session, age, last check, job and lease per relay dir",
+            "zswarm relay --list [--json]   id, state, delivery, target, session, age, last check, job and lease per relay dir",
             "zswarm relay --leases [--json]   live pane leases and the relay that holds each",
             "zswarm relay --cancel ID | --cancel-all --to PANE   stop the job, mark it CANCELLED, paste nothing",
             "zswarm relay --wait ID [--timeout-min 240]   block until relay ID has its message, print it (pull path)",

package/dist/host/relay.d.ts

@@ -25,6 +25,19 @@ export type RelayJob = {
     unit?: string;
     pid?: number;
 };
+/**
+ * The last delivery verdict, persisted so `relay --list` can show whether the
+ * body (and later the reply) actually landed. A verdict is not a failure: the
+ * relay keeps waiting for the done line after recording one.
+ */
+export type RelayDelivery = {
+    /** The op's `submitted` value: "true", "false", "unverified", "queued", "not-delivered". */
+    submitted?: string;
+    /** Epoch milliseconds the verdict was recorded. */
+    at?: number;
+    /** A reply's hard failure code, or a short note about a soft-but-not-ok send. */
+    note?: string;
+};
 export type RelayConfig = {
     id: string;
     serve: string;
@@ -35,6 +48,8 @@ export type RelayConfig = {
     replyTo: string;
     replySession?: string;
     from: string;
+    /** The target harness (`--harness`); sent with the body and the reply. */
+    harness?: string;
     timeoutMin: number;
     /** Hard cap on the relay's age; defaults to `timeoutMin` plus 60 minutes. */
     maxAgeMin?: number;
@@ -49,6 +64,8 @@ export type RelayConfig = {
     job?: RelayJob;
     /** Final status once the loop ends; absent while the relay runs. */
     status?: RelayStatus;
+    /** The last delivery verdict (the initial send, then the reply). */
+    delivery?: RelayDelivery;
     /** Set by `--cancel`; a late loop must not overwrite it. */
     cancelled?: boolean;
     cancelledAt?: number;
@@ -81,6 +98,20 @@ export declare function doneLines(screen: string, done: string): string[];
 export declare function freshDoneLine(screen: string, done: string, seen?: readonly string[]): string | null;
 /** Fill {id} {status} {note} {match} {output} {pane} in a message template. */
 export declare function fillMessage(template: string, fields: Record<string, string>): string;
+/**
+ * True when a send result is only a delivery *verdict*, not a hard failure.
+ *
+ * The op layer reports `ok:false, error.code="not_delivered"` when the pane was
+ * unchanged apart from the composer. That is the op saying "I could not
+ * confirm", not "the send failed": a slow-redrawing pane can still have taken
+ * the body, and a false not-delivered must never kill the relay. `submitted`
+ * values other than `true` (false / "unverified" / "queued") are the same kind
+ * of verdict. Only a hard error is worth aborting on: the pane is gone
+ * (peer_not_found / pane_exited / not_found) or serve/the tunnel is down
+ * (serve_* / connection failures), or the call itself threw. The relay records
+ * the verdict and keeps waiting — the done line is the real proof of delivery.
+ */
+export declare function softSendVerdict(res: OpsResult): boolean;
 /** Paste `body` into the reply pane, retrying with backoff; false leaves it in undelivered/. */
 export declare function deliverMessage(cfg: RelayConfig, body: string, dir: string, deps?: RelayDeps): Promise<boolean>;
 /** The waiting loop; returns the final status and the message it delivered or left behind. */
@@ -95,6 +126,8 @@ export type RelayStartInput = {
     to: string;
     bodyFile?: string;
     from?: string;
+    /** Target harness name; sent with the body and the reply (omitted when absent). */
+    harness?: string;
     done: string;
     replyTo: string;
     replySession?: string;
@@ -171,6 +204,8 @@ export type RelayRow = {
     age: number;
     state: string;
     lastCheck?: number;
+    /** The last delivery verdict recorded in config.json, for the DELIVERY column. */
+    delivery?: RelayDelivery;
     /** The launchd label / systemd unit / pid, when the job is still loaded. */
     job?: string;
     /** The live pane lease held for this relay's target, if any. */

package/dist/host/relay.js

@@ -92,14 +92,35 @@ const NOTES = {
     SERVE_DOWN: "serve was unreachable for three checks in a row; run zswarm doctor against it.",
     UNCONFIRMED: "the pane printed the done line but the check never passed; dump the pane once for the error.",
 };
+/**
+ * True when a send result is only a delivery *verdict*, not a hard failure.
+ *
+ * The op layer reports `ok:false, error.code="not_delivered"` when the pane was
+ * unchanged apart from the composer. That is the op saying "I could not
+ * confirm", not "the send failed": a slow-redrawing pane can still have taken
+ * the body, and a false not-delivered must never kill the relay. `submitted`
+ * values other than `true` (false / "unverified" / "queued") are the same kind
+ * of verdict. Only a hard error is worth aborting on: the pane is gone
+ * (peer_not_found / pane_exited / not_found) or serve/the tunnel is down
+ * (serve_* / connection failures), or the call itself threw. The relay records
+ * the verdict and keeps waiting — the done line is the real proof of delivery.
+ */
+export function softSendVerdict(res) {
+    if (!res.ok)
+        return res.error.code === "not_delivered";
+    const submitted = res.data?.submitted;
+    return submitted !== true;
+}
 /** Paste `body` into the reply pane, retrying with backoff; false leaves it in undelivered/. */
 export async function deliverMessage(cfg, body, dir, deps = {}) {
     const env = deps.env ?? process.env;
     const call = deps.call ?? ((args, e) => dispatchZswarm(args, undefined, { env: e }));
     const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const now = deps.now ?? Date.now;
     const log = deps.log ?? (() => { });
     writeFileSync(join(dir, "message.txt"), body);
     const delays = delaysFrom(env, deps.delays);
+    let failureCode = "failed";
     for (const [i, delay] of delays.entries()) {
         await sleep(delay * 1000);
         // Generous Zellij budgets: this runs exactly when the machine is busiest.
@@ -108,16 +129,23 @@ export async function deliverMessage(cfg, body, dir, deps = {}) {
         };
         if (cfg.replySession)
             args.session = cfg.replySession;
+        if (cfg.harness)
+            args.harness = cfg.harness;
         const res = await call(args, localEnv(env)).catch((err) => ({ ok: false, error: { code: "failed", message: String(err) } }));
         if (res.ok) {
-            log(`message attempt ${i + 1}: delivered, submitted=${String(res.data?.submitted)}`);
+            const submitted = String(res.data?.submitted ?? "unknown");
+            recordDelivery(dir, submitted, now());
+            log(`message attempt ${i + 1}: delivered, submitted=${submitted}`);
             return true;
         }
+        failureCode = res.error.code;
         log(`message attempt ${i + 1} failed: ${res.error.code}: ${res.error.message.slice(0, 200)}`);
     }
     const fallback = join(relaysDir(env), "undelivered");
     mkdirSync(fallback, { recursive: true, mode: 0o700 });
     writeFileSync(join(fallback, `${cfg.id}.txt`), body);
+    // The reply never landed: record the last failure code so --list shows failed:<code>.
+    recordDelivery(dir, undefined, now(), failureCode);
     log(`message not delivered after ${delays.length} attempts; left in ${join(fallback, `${cfg.id}.txt`)}`);
     return false;
 }
@@ -304,6 +332,11 @@ function updateConfig(dir, patch) {
     const cfg = { ...JSON.parse(readFileSync(path, "utf8")), ...patch };
     writePrivate(path, `${JSON.stringify(cfg, null, 1)}\n`);
 }
+/** Record the last delivery verdict in config.json; `note` carries a hard failure code. */
+function recordDelivery(dir, submitted, at, note) {
+    const delivery = { ...(submitted ? { submitted } : {}), at, ...(note ? { note } : {}) };
+    updateConfig(dir, { delivery });
+}
 /** Persist the final status unless `--cancel` already marked the relay. */
 function writeFinalStatus(dir, status) {
     try {
@@ -391,6 +424,7 @@ export async function startRelay(input) {
         // The detached job gets a minimal env, so pin the caller's session now.
         replySession: input.replySession?.trim() || env.ZSWARM_SESSION?.trim() || env.ZELLIJ_SESSION_NAME?.trim() || undefined,
         from: input.from?.trim() || "zswarm-relay",
+        harness: input.harness?.trim() || undefined,
         timeoutMin: input.timeoutMin ?? 240,
         maxAgeMin: input.maxAgeMin ?? (input.timeoutMin ?? 240) + DEFAULT_MAX_AGE_EXTRA_MIN,
     };
@@ -405,6 +439,7 @@ export async function startRelay(input) {
     const leaseNow = input.deps?.now ?? Date.now;
     const leaseSleep = input.deps?.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
     const call = input.deps?.call ?? ((args, e) => dispatchZswarm(args, undefined, { env: e }));
+    const log = input.deps?.log ?? ((line) => appendFileSync(join(dir, "relay.log"), `${new Date().toISOString()} ${line}\n`));
     const remote = serveEnv(cfg, env);
     const target = (args) => cfg.session ? { ...args, session: cfg.session } : args;
     const take = () => takeLease(store, { relayId: id, from: cfg.from, at: leaseNow(), dir, target: leaseTarget, force: input.force });
@@ -430,7 +465,7 @@ export async function startRelay(input) {
         const res = await call(target({ op: "dump", to: cfg.to, max: 400 }), remote).catch((err) => ({ ok: false, error: { code: "failed", message: String(err) } }));
         if (!res.ok)
             return null; // cannot see the screen: the lease is the only guard
-        return paneBusyMarker(String(res.data?.text ?? ""), idlePane ?? { title: cfg.to });
+        return paneBusyMarker(String(res.data?.text ?? ""), idlePane ?? { title: cfg.to }, cfg.harness);
     };
     const deadline = leaseNow() + cfg.timeoutMin * 60_000;
     let busy = null;
@@ -479,11 +514,21 @@ export async function startRelay(input) {
     }
     try {
         if (body !== undefined) {
-            const res = await call(target({ op: "send", to: cfg.to, body, from: cfg.from, settleMs: 800 }), remote);
-            if (!res.ok)
+            const sendArgs = { op: "send", to: cfg.to, body, from: cfg.from, settleMs: 800 };
+            if (cfg.harness)
+                sendArgs.harness = cfg.harness;
+            const res = await call(target(sendArgs), remote);
+            // A non-ok send is only fatal when it is a hard error. `not_delivered` is a
+            // verdict ("could not confirm"), so the relay records it and keeps waiting.
+            if (!res.ok && !softSendVerdict(res)) {
                 throw new ZellijError(res.error.code, `send failed: ${res.error.message}`, res.error.details);
-            sent = res.data?.submitted === true ? "submitted" : "unverified";
+            }
+            const rawSubmitted = res.ok ? res.data?.submitted : undefined;
+            sent = rawSubmitted === true ? "submitted" : "unverified";
+            const submittedText = rawSubmitted === undefined ? (res.ok ? "unverified" : "not-delivered") : String(rawSubmitted);
+            recordDelivery(dir, submittedText, leaseNow(), res.ok ? undefined : res.error.code);
             if (sent !== "submitted") {
+                log(`send verdict submitted=${submittedText}; waiting for the done line`);
                 // One dump; one Enter if the body still sits in the composer.
                 const dump = await call(target({ op: "dump", to: cfg.to, max: 2000 }), remote);
                 const screen = dump.ok ? String(dump.data.text ?? "") : "";
@@ -720,6 +765,7 @@ export function listRelays(deps = {}) {
             age: Math.max(0, Math.floor((now() - run.started) / 1000)),
             state: relayState(run.dir, cfg),
             lastCheck: lastCheckResult(run.dir),
+            ...(cfg.delivery ? { delivery: cfg.delivery } : {}),
             ...(loaded && cfg.job ? { job: jobLabelText(cfg.job) } : {}),
             ...(held ? { lease: { relayId: held.relayId, from: held.from, at: held.at } } : {}),
         });

package/dist/ops/delivery.d.ts

@@ -1,3 +1,4 @@
+import type { HarnessProfile } from "../harness.js";
 import type { StateStore } from "../state.js";
 import type { ZellijClient } from "../zellij/client.js";
 import type { ZellijPane } from "../zellij/panes.js";
@@ -20,19 +21,26 @@ export declare const SEND_BUDGETS: {
     readonly settleMs: 300;
     /** Pane-lookup retry window for an absent pane. */
     readonly observeMs: 1000;
+    /**
+     * Base window that polls the pane for positive evidence before any negative
+     * verdict; scaled up for slow panes and capped by `confirmMaxMs`.
+     */
+    readonly confirmMs: 1000;
     /** The scaled window never exceeds this multiple of the default. */
     readonly maxScale: 5;
     /** A first Zellij call at or under this many ms is not "slow". */
     readonly slowMs: 1000;
     readonly settleMaxMs: 5000;
     readonly observeMaxMs: 30000;
+    readonly confirmMaxMs: 15000;
 };
 /**
- * Scale the fixed settle/observe windows by how slow the send's first Zellij
- * call was. A call under `slowMs` keeps the defaults; five seconds or more pins
- * the 5x cap. Explicit `--settle-ms` / `--observe-ms` are returned as given,
- * and a scaled value is capped by the call's own timeout so it cannot outlast
- * the observation budget.
+ * Scale the fixed settle/observe/confirm windows by how slow the send's first
+ * Zellij call was. A call under `slowMs` keeps the defaults; five seconds or
+ * more pins the 5x cap. Explicit `--settle-ms` / `--observe-ms` are returned as
+ * given, and a scaled value is capped by the call's own timeout so it cannot
+ * outlast the observation budget. `confirmMs` is always scaled (no explicit
+ * flag) and capped by both `confirmMaxMs` and the call timeout.
  */
 export declare function scaleBudgets(input: {
     firstCallMs: number;
@@ -42,6 +50,7 @@ export declare function scaleBudgets(input: {
 }): {
     settleMs: number;
     observeMs: number;
+    confirmMs: number;
     scale: number;
 };
 export type SenderSource = "arg" | "env" | "title" | "default";
@@ -78,7 +87,8 @@ export declare function attachKnownSender(args: Record<string, unknown>, env: No
 export declare function bodyText(client: ZellijClient, args: Record<string, unknown>, body: string): string;
 /**
  * Caller `submit=` always wins. With none given, the pane's harness picks
- * auto vs double-enter (codex needs two Enters; the rest submit on one).
+ * auto vs double-enter (codex needs two Enters; the rest submit on one). An
+ * explicit `--harness` overrides the pane-inferred profile.
  */
 export declare function resolveSubmitMode(args: Record<string, unknown>, pane: {
     command?: string | null;
@@ -107,6 +117,20 @@ export declare function composerHolds(screen: string, body: string): boolean;
 export declare function classifySubmit(before: string, after: string, body: string, opts?: {
     queued?: (screen: string) => boolean;
 }): Submitted;
+/**
+ * Press Enter once and report whether the body submitted, without pasting.
+ * The restart op uses this to re-ask a still-held composer; a failed dump is
+ * unverified, never a negative verdict.
+ */
+export declare function submitAfterEnter(client: ZellijClient, input: {
+    session: string;
+    paneId: string;
+    body: string;
+    before: string;
+    clock: Clock;
+    settleMs: number;
+    profile: HarnessProfile;
+}): Promise<Submitted>;
 /** Paste a body into one pane and record the attempt. */
 export declare function deliverTo(client: ZellijClient, state: StateStore, args: Record<string, unknown>, input: {
     session: string;

package/dist/ops/delivery.js

@@ -1,24 +1,33 @@
-import { queuedPrompt, resolveHarness } from "../harness.js";
-import { isTrue, numberArg } from "./util.js";
+import { busyMarker, queuedPrompt, resolveHarness } from "../harness.js";
+import { isTrue, numberArg, optionalString } from "./util.js";
 /** Fixed send windows before adaptive scaling; explicit flags always win. */
 export const SEND_BUDGETS = {
     /** Pause before checking the paste landed. */
     settleMs: 300,
     /** Pane-lookup retry window for an absent pane. */
     observeMs: 1_000,
+    /**
+     * Base window that polls the pane for positive evidence before any negative
+     * verdict; scaled up for slow panes and capped by `confirmMaxMs`.
+     */
+    confirmMs: 1_000,
     /** The scaled window never exceeds this multiple of the default. */
     maxScale: 5,
     /** A first Zellij call at or under this many ms is not "slow". */
     slowMs: 1_000,
     settleMaxMs: 5_000,
     observeMaxMs: 30_000,
+    confirmMaxMs: 15_000,
 };
+/** Upper bound on confirm polls, so a pinned deadline cannot spin forever. */
+const MAX_CONFIRM_POLLS = 40;
 /**
- * Scale the fixed settle/observe windows by how slow the send's first Zellij
- * call was. A call under `slowMs` keeps the defaults; five seconds or more pins
- * the 5x cap. Explicit `--settle-ms` / `--observe-ms` are returned as given,
- * and a scaled value is capped by the call's own timeout so it cannot outlast
- * the observation budget.
+ * Scale the fixed settle/observe/confirm windows by how slow the send's first
+ * Zellij call was. A call under `slowMs` keeps the defaults; five seconds or
+ * more pins the 5x cap. Explicit `--settle-ms` / `--observe-ms` are returned as
+ * given, and a scaled value is capped by the call's own timeout so it cannot
+ * outlast the observation budget. `confirmMs` is always scaled (no explicit
+ * flag) and capped by both `confirmMaxMs` and the call timeout.
  */
 export function scaleBudgets(input) {
     const raw = input.firstCallMs > SEND_BUDGETS.slowMs ? input.firstCallMs / SEND_BUDGETS.slowMs : 1;
@@ -27,6 +36,7 @@ export function scaleBudgets(input) {
     return {
         settleMs: input.settleMs !== undefined ? Math.min(input.settleMs, SEND_BUDGETS.settleMaxMs) : scaled(SEND_BUDGETS.settleMs, SEND_BUDGETS.settleMaxMs),
         observeMs: input.observeMs !== undefined ? Math.min(input.observeMs, SEND_BUDGETS.observeMaxMs) : scaled(SEND_BUDGETS.observeMs, SEND_BUDGETS.observeMaxMs),
+        confirmMs: scaled(SEND_BUDGETS.confirmMs, SEND_BUDGETS.confirmMaxMs),
         scale,
     };
 }
@@ -91,7 +101,8 @@ export function bodyText(client, args, body) {
 }
 /**
  * Caller `submit=` always wins. With none given, the pane's harness picks
- * auto vs double-enter (codex needs two Enters; the rest submit on one).
+ * auto vs double-enter (codex needs two Enters; the rest submit on one). An
+ * explicit `--harness` overrides the pane-inferred profile.
  */
 export function resolveSubmitMode(args, pane) {
     const raw = args.submit;
@@ -99,7 +110,7 @@ export function resolveSubmitMode(args, pane) {
         return raw;
     if (raw !== undefined && raw !== null && raw !== "")
         return "auto";
-    return resolveHarness(pane).submit;
+    return resolveHarness(pane, optionalString(args.harness)).submit;
 }
 function nonEmptyLines(screen) {
     return screen
@@ -205,7 +216,7 @@ async function dumpOrNull(client, session, paneId) {
     }
 }
 async function verifySubmit(client, input) {
-    const { session, paneId, body, mode, settleMs, clock, before, queued } = input;
+    const { session, paneId, body, mode, settleMs, confirmMs, clock, before, profile, queued } = input;
     const classify = (base, screen) => classifySubmit(base, screen, body, { queued });
     if (mode === "none")
         return "unverified";
@@ -232,24 +243,58 @@ async function verifySubmit(client, input) {
         verdict = classify(before, rescued);
         if (verdict === true || verdict === "queued")
             return verdict;
-        if (verdict === false)
-            return false;
     }
-    // Inconclusive or not (yet) on screen; TUIs often redraw after the first settle.
-    await clock.sleep(Math.min(Math.max(settleMs * 2, 800), 5000));
-    const later = await dumpOrNull(client, session, paneId);
-    if (later === null)
-        return verdict;
-    if (composerHolds(after, body) && !composerHolds(later, body))
-        return true;
-    return classify(before, later);
+    // Nothing conclusive yet: a freshly restarted agent can redraw slowly, so poll
+    // for the whole scaled confirm window before any negative verdict. Positive
+    // evidence is new output, a queue hint, the harness's busy marker, or the body
+    // leaving a composer it was sitting in.
+    const pollMs = Math.min(Math.max(settleMs * 2, 500), 1_000);
+    const deadline = clock.now() + confirmMs;
+    for (let polls = 0; polls < MAX_CONFIRM_POLLS && clock.now() < deadline; polls++) {
+        await clock.sleep(Math.min(pollMs, Math.max(0, deadline - clock.now())));
+        const later = await dumpOrNull(client, session, paneId);
+        if (later === null)
+            continue; // unreadable pane: keep polling
+        const seen = classify(before, later);
+        if (seen === true || seen === "queued")
+            return seen;
+        if (busyMarker(later, profile))
+            return true;
+        if (composerHolds(after, body) && !composerHolds(later, body))
+            return true;
+        verdict = seen;
+    }
+    // An unknown harness has no reliable busy marker, so an unchanged screen is
+    // not proof the body never arrived; a false not-delivered would make the
+    // caller resend the whole message. A known harness's not-delivered is now
+    // backed by the whole window.
+    if (verdict === "not-delivered" && profile.name === "unknown")
+        return "unverified";
+    return verdict;
+}
+/**
+ * Press Enter once and report whether the body submitted, without pasting.
+ * The restart op uses this to re-ask a still-held composer; a failed dump is
+ * unverified, never a negative verdict.
+ */
+export async function submitAfterEnter(client, input) {
+    const { session, paneId, body, before, clock, settleMs, profile } = input;
+    await client.sendKeys({ session, paneId, keys: ["Enter"] });
+    await clock.sleep(settleMs);
+    const screen = await dumpOrNull(client, session, paneId);
+    if (screen === null)
+        return "unverified";
+    return classifySubmit(before, screen, body, {
+        queued: (s) => queuedPrompt(s, profile),
+    });
 }
 /** Paste a body into one pane and record the attempt. */
 export async function deliverTo(client, state, args, input) {
     const { session, pane, body, op, at, clock, firstCallMs = 0, timeoutMs = 30_000 } = input;
     const from = senderLabel(args);
+    const override = optionalString(args.harness);
     const mode = resolveSubmitMode(args, pane);
-    const profile = resolveHarness(pane);
+    const profile = resolveHarness(pane, override);
     const queued = (screen) => queuedPrompt(screen, profile);
     const explicitSettle = args.settleMs !== undefined && args.settleMs !== null && args.settleMs !== "";
     const budgets = scaleBudgets({
@@ -258,6 +303,7 @@ export async function deliverTo(client, state, args, input) {
         settleMs: explicitSettle ? numberArg(args, "settleMs", SEND_BUDGETS.settleMs, { min: 50, max: SEND_BUDGETS.settleMaxMs }) : undefined,
     });
     const settleMs = budgets.settleMs;
+    const confirmMs = budgets.confirmMs;
     const confirmOnce = isTrue(args.confirm);
     try {
         let before = null;
@@ -276,8 +322,10 @@ export async function deliverTo(client, state, args, input) {
             body,
             mode,
             settleMs,
+            confirmMs,
             clock,
             before,
+            profile,
             queued,
         });
         // Opt-in confirm. A second paste is only safe on positive evidence the
@@ -293,8 +341,10 @@ export async function deliverTo(client, state, args, input) {
                     body,
                     mode,
                     settleMs,
+                    confirmMs,
                     clock,
                     before: retryBefore,
+                    profile,
                     queued,
                 });
             }

package/dist/ops/dispatch.d.ts

@@ -8,7 +8,7 @@ import type { DispatchDeps, OpsResult } from "./types.js";
 export declare function paneBusyMarker(screen: string, pane: {
     command?: string | null;
     title?: string | null;
-}): string | null;
+}, harness?: string | null): string | null;
 /**
  * Per-invocation routing from `--local` / `--ssh`. `--local` clears both SSH
  * and serve (and remote IPC). `--ssh` sets the destination for this call and

package/dist/ops/dispatch.js

@@ -36,8 +36,8 @@ import { installServeService, uninstallServeService } from "../host/serve-servic
  * busy check behind `send --if-idle` and `relay --if-idle`; the marker names
  * itself (its regex source) in the `pane_busy` error.
  */
-export function paneBusyMarker(screen, pane) {
-    return busyMarker(screen, resolveHarness(pane))?.source ?? null;
+export function paneBusyMarker(screen, pane, harness) {
+    return busyMarker(screen, resolveHarness(pane, harness))?.source ?? null;
 }
 /**
  * Per-invocation routing from `--local` / `--ssh`. `--local` clears both SSH
@@ -412,7 +412,7 @@ async function dispatchOperation(args, injected, deps, context, env) {
                     }
                     const screen = await client.dumpPane({ session, paneId: pane.id }).then((res) => res.text, () => null);
                     if (screen !== null) {
-                        const marker = paneBusyMarker(screen, pane);
+                        const marker = paneBusyMarker(screen, pane, optionalString(args.harness));
                         if (marker) {
                             throw new ZellijError("pane_busy", `pane ${to} is busy with a task (marker: ${marker}); retry when it is idle`);
                         }

package/dist/ops/restart.d.ts

@@ -27,6 +27,8 @@ export declare const READY_SETTLE_MS = 500;
 export declare const READY_STABLE_GAP_MS = 1000;
 /** Screen poll interval while a step waits. */
 export declare const RESTART_POLL_MS = 250;
+/** Settle after the rescue Enter before re-reading the composer, matching the relay. */
+export declare const SUBMIT_ENTER_SETTLE_MS = 800;
 export type RestartPaneKind = "command" | "shell";
 export type RestartStep = {
     step: string;

package/dist/ops/restart.js

@@ -5,7 +5,7 @@ import { ZellijError } from "../errors.js";
 import { readyPrompt, resolveHarness } from "../harness.js";
 import { findLease } from "../host/lease.js";
 import { tokenizeCommand } from "../keys.js";
-import { deliverTo } from "./delivery.js";
+import { deliverTo, submitAfterEnter } from "./delivery.js";
 import { assertNotPlugin, assertNotSelf } from "./guards.js";
 import { isTrue, numberArg, optionalString, throwIfAborted } from "./util.js";
 /**
@@ -32,6 +32,8 @@ export const READY_SETTLE_MS = 500;
 export const READY_STABLE_GAP_MS = 1_000;
 /** Screen poll interval while a step waits. */
 export const RESTART_POLL_MS = 250;
+/** Settle after the rescue Enter before re-reading the composer, matching the relay. */
+export const SUBMIT_ENTER_SETTLE_MS = 800;
 /**
  * Zellij keeps an exited command pane on screen with a re-run prompt. The exact
  * wording has changed between releases, so match the stable phrases.
@@ -394,8 +396,39 @@ export async function restartPane(client, state, args, target, clock, opts = {})
             failStep("deliver", `handoff not delivered (${delivered.error?.message ?? "unknown"})`, steps);
         }
         const source = handoff.pointer ? `pointer to ${handoffPath}` : `${handoff.body.length} chars`;
-        const submitted = delivered.submitted === undefined ? "unknown" : String(delivered.submitted);
-        record("deliver", true, `${source} ${resent ? "resent" : "sent"}; submitted=${submitted}`);
+        let submitted = delivered.submitted;
+        // `false` means the paste is still sitting in the harness's composer: the
+        // body was never sent. Reporting that as success loses the handoff when the
+        // pane is restarted again, so press Enter once and re-verify before trusting
+        // it. A screen read that fails here only turns the verdict into `unverified`,
+        // which still fails the step below rather than claiming success.
+        if (submitted === false) {
+            let before = "";
+            try {
+                before = (await client.dumpPane({ session, paneId: pane.id })).text;
+            }
+            catch {
+                // Unreadable pane: submitAfterEnter reports unverified, never a pass.
+            }
+            submitted = await submitAfterEnter(client, {
+                session,
+                paneId: pane.id,
+                body: handoff.body,
+                before,
+                clock,
+                settleMs: Math.min(SUBMIT_ENTER_SETTLE_MS, Math.max(1, remaining())),
+                profile,
+            });
+            if (submitted !== true && submitted !== "queued") {
+                record("deliver", false, `composer still holds the handoff; submitted=${submitted} after one Enter`);
+                failStep("deliver", `handoff not submitted (composer still holds it; submitted=${submitted} after one Enter)`, steps);
+            }
+            record("deliver", true, `${source} ${resent ? "resent" : "sent"}; submitted=${submitted} after one Enter`);
+        }
+        else {
+            const verdict = submitted === undefined ? "unknown" : String(submitted);
+            record("deliver", true, `${source} ${resent ? "resent" : "sent"}; submitted=${verdict}`);
+        }
     }
     return {
         ok: true,

package/dist/schema.js

@@ -1,4 +1,5 @@
 import { ZellijError } from "./errors.js";
+import { HARNESS_NAMES } from "./harness.js";
 /**
  * One description of the zswarm surface. The MCP tool schema, the CLI flags,
  * and the CLI help text are all generated from it, so they cannot drift apart.
@@ -474,6 +475,13 @@ export const PARAMS = [
         ops: ["send", "broadcast"],
         description: 'send/broadcast: after the send, dump once more and report what it sees; paste again only on "not-delivered" (positive evidence nothing landed), press Enter when the body is still in the composer, and never paste the body twice',
     },
+    {
+        name: "harness",
+        type: "string",
+        flags: ["--harness"],
+        ops: ["send", "restart"],
+        description: `send/restart: override the harness inferred from the pane's command/title for wrapper-launched panes (known: ${HARNESS_NAMES.join(", ")})`,
+    },
     {
         name: "ifIdle",
         type: "boolean",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zswarm/core",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "type": "module",
   "description": "zSwarm Zellij client and shared ops dispatch",
   "exports": {