agent-coord-mcp 0.26.34 → 0.26.39

package/src/transports/herdr.ts

@@ -246,6 +246,20 @@ export class HerdrTransport implements Transport {
   #markerPid: () => HerdrMarkerPid;
   #env: Record<string, string | undefined>;
   #submitMode: SubmitMode;
+  /**
+   * ⛔⛆ PROVENANCE FOR THE ENTER WE PRESS ON A DRAFT WE DID NOT JUST TYPE: target → the exact text this
+   * transport left sitting un-submitted in that pane. A `pending` result means the payload is IN the box
+   * and our enters did not submit it; the recovery is to press Enter again, NEVER to retype.
+   * ⚠ Why the box alone cannot decide this: a pasted payload renders as `[Pasted text #N +M lines]`, and
+   * `isPasteChip` is CONTENT-BLIND (MEASURED 2026-09-27, 4 cases over the 4 draft classes readReadyBox
+   * distinguishes — our verbatim payload, a foreign plain draft, a foreign chip, an empty box: the foreign
+   * chip read as OURS). Our own paste is a chip too, so chip-vs-chip is indistinguishable ON SCREEN and a
+   * content-only rule would refuse the very case this fixes. So ownership is recorded HERE, by the code
+   * that typed it, and the screen read stays exactly as strict as it was.
+   * ⭐ In-memory by design: after a restart we claim nothing and fall through to the refusal, which is the
+   * conservative side and is what today's build already does.
+   */
+  #leftUnsubmitted = new Map<string, string>();
 
   constructor(opts: HerdrTransportOptions = {}) {
     this.#run = opts.run ?? defaultHerdrRunner;
@@ -329,11 +343,61 @@ export class HerdrTransport implements Transport {
     return herdrPaneExists(target, this.#run);
   }
 
+  /**
+   * ⟨q-f995c3c7⟩ next layer — THE CANONICAL ID BEHIND A PANE SPELLING. `null` = could not ask.
+   *
+   * ⛔ WHY THIS EXISTS: one pane has more than one name. This seat's env said `wA5:p1` while its
+   * marker said `wA3:p4`, both resolving to the same pane, and the first-claim guard compared the two
+   * STRINGS with `===`. So a seat restarting into its own pane was refused by its own marker — the
+   * defect ⟨q-f995c3c7⟩ fixed for the ENV-vs-TMUX_PANE case and left standing for spelling-vs-spelling.
+   * Measured 2026-09-26: six seats had to be hand-staged to the env spelling before a restart, and the
+   * fleet-wide standdown manifest now carries an `attachWith` field to work around it.
+   *
+   * ⭐ HERDR IS ALREADY THE RESOLVER — `pane get <spelling>` answers with the canonical `pane_id` for
+   * either name, and `attach()` above has read `paneOf(cur)?.pane_id` since before this row existed.
+   * Nothing new is being invented here; the guard simply stopped short of asking.
+   */
+  resolvePaneId(target: string): string | null {
+    const got = this.#run(["pane", "get", target]);
+    if (!got.ok) return null;
+    return paneOf(got)?.pane_id ?? null;
+  }
+
   /** Nothing to kill: there is no pusher. The tool deletes the marker. */
   async detach(_agentId: string): Promise<void> {
     return;
   }
 
+  /**
+   * Press Enter on a payload ALREADY sitting in the ready box, and verify by reading back. Returns a
+   * result when the outcome is settled, or `null` to fall through to the normal type-then-submit path.
+   *
+   * ⭐ Used only when `boxHoldsPayload` says the draft is OURS. No `send-text` happens here — the text is
+   * already there, and typing it again would join it to itself. This is the recovery for a `pending` left
+   * by an earlier attempt, and it is what turns that state from "a human must nudge it" into "the next
+   * tick submits it".
+   */
+  #pressEnterUntilSubmitted(target: string, text: string, before: ReturnType<typeof readReadyBox>, key: string): HerdrPushResult | null {
+    let enters = 0;
+    for (let attempt = 0; attempt < 2; attempt++) {
+      const pressed = this.#run(["pane", "send-keys", target, key]);
+      if (!pressed.ok) return { delivered: false, verified: false, outcome: "typed-unconfirmed", safeToRetry: false, enters, error: `send-keys enter to ${target} refused while submitting a payload already in the box: ${pressed.error?.message ?? pressed.stderr}` };
+      enters++;
+      this.#sleep(this.#settleMs);
+      const box = readReadyBox(this.#screen(target));
+      if (transcriptGained(before, box, text)) {
+        this.#leftUnsubmitted.delete(target);
+        return { delivered: true, verified: true, outcome: "delivered", safeToRetry: false, enters, busy: box.ready ? box.busy ?? undefined : undefined };
+      }
+      if (boxHoldsPayload(box, text)) continue;
+      // The box no longer holds our text and the transcript did not gain it: something else consumed it.
+      // Not ours to retype — report it rather than guess.
+      this.#leftUnsubmitted.delete(target);
+      return { delivered: false, verified: false, outcome: "unverified", safeToRetry: false, enters, error: `pressed enter on a payload already in ${target}'s box, but the screen after it does not show the message submitted (${box.ready ? (box.draft ? "the box now holds other text" : "the box is empty and the transcript gained no line carrying it") : box.reason})` };
+    }
+    return { delivered: false, verified: true, outcome: "pending", safeToRetry: true, enters, error: `payload was already sitting in ${target}'s input and ${enters} further enters did not submit it — the composer HOLDS this message: a human Enter in ${target} submits it, or clearing that box discards it` };
+  }
+
   /**
    * Type `text` into the pane and press enter; VERIFY by reading the pane back, and if
    * the line is still sitting unsubmitted (the spike's race), press enter once more.
@@ -363,6 +427,22 @@ export class HerdrTransport implements Transport {
     // ⟨q-15d763dc⟩ BEFORE ANY KEY: the screen must be Claude Code's ready, empty input box. The text
     // is held as firmly as the Enter — a digit typed into an open dialog selects an option.
     const before = readReadyBox(this.#screen(target));
+
+    // ⛔⛆ OUR OWN UN-SUBMITTED PAYLOAD IS SUBMITTED, NOT REFUSED AND NOT RETYPED. A previous attempt can
+    // leave this exact text in the composer: `pasteAndSubmit` types it, presses Enter up to twice, and
+    // returns `pending` when the box still holds it. `refusalBeforeKeys` then refuses ANY draft — so the
+    // retry refused on text THIS TRANSPORT typed, every tick, forever, and only a human Enter broke it.
+    // That is David's nudge on fleet HRx, shipped in 0.26.36 ⟨q-1ce5bc97⟩.
+    // ⭐ `boxHoldsPayload` is the discriminator worker-1 identified: OUR payload → press Enter and submit
+    // what is already there; a FOREIGN draft → refuse, which is what that refusal was always for. Typing
+    // again is never right — it would join the text to itself.
+    // ⚠ The refusal is NOT weakened for any other case: an unready screen, a dialog, or someone else's
+    // draft still stops before a single key, because `boxHoldsPayload` returns false for all of them.
+    if (this.#leftUnsubmitted.get(target) === text && boxHoldsPayload(before, text)) {
+      const resubmitted = this.#pressEnterUntilSubmitted(target, text, before, enterKey.key);
+      if (resubmitted) return resubmitted;
+    }
+
     const refusal = refusalBeforeKeys(before);
     if (refusal) return { delivered: false, verified: false, outcome: "held", safeToRetry: true, error: `held, nothing typed into ${target}: ${refusal}` };
 
@@ -381,11 +461,22 @@ export class HerdrTransport implements Transport {
       enters++;
       this.#sleep(this.#settleMs);
       box = readReadyBox(this.#screen(target));
-      if (transcriptGained(before, box, text)) return { delivered: true, verified: true, outcome: "delivered", safeToRetry: false, enters, busy: box.ready ? box.busy ?? undefined : undefined };
+      if (transcriptGained(before, box, text)) {
+        this.#leftUnsubmitted.delete(target);
+        return { delivered: true, verified: true, outcome: "delivered", safeToRetry: false, enters, busy: box.ready ? box.busy ?? undefined : undefined };
+      }
       if (boxHoldsPayload(box, text)) continue;
+      this.#leftUnsubmitted.delete(target);
       return { delivered: false, verified: false, outcome: "unverified", safeToRetry: false, enters, error: `enter sent to ${target}, but the screen after it does not show the message submitted (${box.ready ? (box.draft ? "the box holds other text" : "the box is empty and the transcript gained no line carrying it") : box.reason})` };
     }
-    return { delivered: false, verified: true, outcome: "pending", safeToRetry: true, enters, error: `text still sitting unsubmitted in ${target}'s input after ${enters} enters` };
+    // ⚠ `safeToRetry: true` STAYS, and it is not an oversight — ⟨q-1ce5bc97⟩ step 1 chose it because
+    // pending is the most recoverable non-delivery: the payload is KNOWN to be in the box, so a transient
+    // misread must not become a permanent drop. What was wrong lived in the CONSUMER, which read this flag
+    // as "no key was sent" and retried into the draft this attempt created (the 0.26.36 livelock).
+    // ⭐ The error now says what a sender actually faces, because `verified: true` here means the OUTCOME
+    // is known — we read the screen back and the payload is sitting there — and has never meant delivered.
+    this.#leftUnsubmitted.set(target, text);
+    return { delivered: false, verified: true, outcome: "pending", safeToRetry: true, enters, error: `text still sitting unsubmitted in ${target}'s input after ${enters} enters — the pane's composer HOLDS this message, so a retype would join it rather than send it: a human Enter in ${target} submits it, or clearing that box discards it` };
   }
 
   /**