agent-yes 1.169.0 → 1.170.1

package/ts/serve.ts

@@ -12,6 +12,7 @@ import {
   extractBadges,
   extractNeedsInput,
   extractTaskCounts,
+  isUserTyping,
   listRecords,
   readNotes,
   readPtysize,
@@ -21,14 +22,18 @@ import {
   writeToIpc,
   type CommonOpts,
 } from "./subcommands.ts";
+import { TYPING_BADGE } from "./badges.ts";
 import { updateGlobalPidStatus } from "./globalPidIndex.ts";
 import { spawnRejectionReason } from "./spawnGate.ts";
+import { findSpawnHiddenLauncher } from "./rustBinary.ts";
 import { pgidForWrapper } from "./reaper.ts";
 import { SUPPORTED_CLIS } from "./SUPPORTED_CLIS.ts";
 import { getInstalledPackage } from "./versionChecker.ts";
 import {
+  getProvisionHook,
   getProvisionRoot,
   getSpawnHook,
+  hasProvisionHook,
   hasSpawnHook,
   isProvisionAllowed,
   resolveSpawnCwd,
@@ -234,6 +239,83 @@ function freshAgentEnv(): Record<string, string> {
   return env;
 }
 
+// Best-effort owner/repo from a worktree's github origin remote — used to build
+// the KOHO_* env a provision hook branches on (which account to select for this
+// repo). Mirrors codehost's forkWorktree parse; null when there's no github
+// origin (the hook still runs, just without KOHO_OWNER/REPO).
+function originOwnerRepo(cwd: string): { owner: string; repo: string } | null {
+  try {
+    const r = Bun.spawnSync(["git", "-C", cwd, "remote", "get-url", "origin"]);
+    if (r.exitCode !== 0) return null;
+    const url = new TextDecoder().decode(r.stdout).trim();
+    const m = url.match(/github\.com[:/]([^/]+)\/(.+?)(?:\.git)?\/?$/i);
+    return m && m[1] && m[2] ? { owner: m[1], repo: m[2] } : null;
+  } catch {
+    return null;
+  }
+}
+
+type ProvisionHookResult =
+  | { ran: false }
+  | { ran: true; ok: boolean; code: number | null; detail: string };
+
+// Run the "koho-style" provision hook (a host-local trusted shell hook) BEFORE a
+// fork/from git op. Its purpose is to prepare the host for provisioning — most
+// usefully to select the right git identity (e.g. `gh auth switch --user <who>`,
+// keyed on the KOHO_* env we export) before the clone/worktree/setup runs. When
+// configured it is ALSO the provisioning gate: its exit code decides admission
+// (0 = allow, non-zero = deny), overriding the static provisionAllowlist.
+// Returns { ran:false } when no hook is set, so the caller falls back to the
+// allowlist. Unlike the spawn hook there is no `exec "$@"`: this hook runs to
+// completion and hands control back — it prepares state, it is not the agent.
+async function runProvisionHook(
+  cwd: string,
+  koho: Record<string, string>,
+): Promise<ProvisionHookResult> {
+  const hook = getProvisionHook();
+  if (!hook) return { ran: false };
+  const shell =
+    process.env.AGENT_YES_PROVISION_SHELL?.trim() ||
+    process.env.AGENT_YES_SPAWN_SHELL?.trim() ||
+    "/bin/sh";
+  const outPath = path.join(
+    agentYesHome(),
+    `provision-hook-${process.pid}-${performance.now().toString(36).replace(".", "")}.log`,
+  );
+  const timeoutMs = Number(process.env.AGENT_YES_PROVISION_HOOK_TIMEOUT_MS) || 60_000;
+  let code: number | null = null;
+  try {
+    // Recovered login-shell env (freshAgentEnv), NOT the daemon's raw env: the
+    // oxmgr/launchd daemon runs with a minimal PATH (/usr/bin:/bin:…) that lacks
+    // Homebrew/bun/etc., so `gh`/`git` would be "command not found" and `set -e`
+    // would deny EVERY provision. freshAgentEnv re-derives the user's real PATH
+    // (as a fresh terminal would) while preserving HOME — so the hook finds `gh`
+    // and its credential store. `set -e` so any failing step denies the provision.
+    const child = Bun.spawn([shell, "-c", `set -e\n${hook}`], {
+      cwd,
+      env: { ...freshAgentEnv(), ...koho },
+      stdin: "ignore",
+      stdout: Bun.file(outPath),
+      stderr: Bun.file(outPath),
+    });
+    code = await Promise.race([
+      child.exited,
+      new Promise<number>((r) => setTimeout(() => r(124), timeoutMs)),
+    ]);
+    if (code === 124) child.kill();
+  } catch (e) {
+    return { ran: true, ok: false, code: null, detail: (e as Error).message };
+  }
+  let detail = "";
+  try {
+    detail = (await Bun.file(outPath).text()).slice(0, 4096).trimEnd();
+  } catch {
+    /* no output captured */
+  }
+  await unlink(outPath).catch(() => {});
+  return { ran: true, ok: code === 0, code, detail };
+}
+
 // ---------------------------------------------------------------------------
 // ay serve install / uninstall / logs  (oxmgr daemon management)
 // ---------------------------------------------------------------------------
@@ -513,6 +595,17 @@ async function cmdServeDaemon(sub: string, args: string[]): Promise<number> {
     // args after `--`. Both auto-restart on crash by default (pm2) / via the
     // explicit flag (oxmgr).
     const serveArgv = ayServeArgv(effArgs);
+    // On Windows, interpose the window-less launcher so the manager (pm2/oxmgr)
+    // doesn't flash a console window on each (re)start. `ay-spawn-hidden` is a
+    // GUI-subsystem shim that starts the real `ay serve …` with CREATE_NO_WINDOW
+    // and mirrors its lifetime/exit-code, so the manager still tracks it exactly.
+    // Resolves to undefined off Windows or when the launcher isn't installed
+    // (older builds / a release predating it) → fall back to the raw command.
+    const spawnHidden = findSpawnHiddenLauncher();
+    // The command the manager launches: unchanged normally, or the launcher
+    // followed by the real argv when interposing. Split into program + args for
+    // pm2 (which takes `<program> … -- <args>`); oxmgr takes the joined string.
+    const managedArgv = spawnHidden ? [spawnHidden, ...serveArgv] : serveArgv;
     // WebRTC daemons get an oxmgr health watchdog: the native WebRTC stack can
     // freeze the JS event loop (host answers nobody, no in-process timer can
     // recover it), so an EXTERNAL probe of the serve heartbeat is the only thing
@@ -536,7 +629,7 @@ async function cmdServeDaemon(sub: string, args: string[]): Promise<number> {
         ? [
             mgr.bin,
             "start",
-            serveArgv.join(" "),
+            managedArgv.join(" "),
             "--name",
             DAEMON_NAME,
             "--restart",
@@ -552,7 +645,7 @@ async function cmdServeDaemon(sub: string, args: string[]): Promise<number> {
         : [
             mgr.bin,
             "start",
-            serveArgv[0]!,
+            managedArgv[0]!,
             "--name",
             DAEMON_NAME,
             "--interpreter",
@@ -565,7 +658,7 @@ async function cmdServeDaemon(sub: string, args: string[]): Promise<number> {
             "--exp-backoff-restart-delay",
             "200",
             "--",
-            ...serveArgv.slice(1),
+            ...managedArgv.slice(1),
           ];
     const proc = Bun.spawn(startArgv, { stdio: ["ignore", "inherit", "inherit"] });
     const code = await proc.exited;
@@ -1153,8 +1246,18 @@ export async function cmdServe(rest: string[]): Promise<number> {
     // dot and the CLI agree.
     const question =
       status !== "exited" && !r.unresponsive ? await logNeedsInput(r.log_file, r.cli) : null;
+    // Last-active time: the log file's mtime, i.e. when the agent last wrote
+    // output (stdout). The console's left panel shows the age off this instead
+    // of started_at, so a long-lived-but-quiet agent reads as stale, not "new".
+    // Falls back to started_at when there's no log yet (freshly spawned).
+    const lastActiveAt = r.log_file
+      ? await stat(r.log_file)
+          .then((s) => s.mtimeMs)
+          .catch(() => r.started_at)
+      : r.started_at;
     return {
       ...r,
+      last_active_at: lastActiveAt,
       // Precedence: exited stays exited; the Rust supervisor's unresponsive flag is
       // an authoritative wedge signal (`stuck`); then a blocked menu (`needs_input`);
       // else the base live status — so the console's dot matches `ay ls`. (A dead
@@ -1170,8 +1273,15 @@ export async function cmdServe(rest: string[]): Promise<number> {
       // badge). Skipped for exited agents — their screen is no longer live.
       tasks: status === "exited" ? null : await logTasks(r.log_file),
       // Status flags matched against the rendered screen (see badges.ts) — e.g.
-      // an active /goal loop. [] when none matched or for exited agents.
-      badges: status === "exited" ? [] : await logBadges(r.log_file),
+      // an active /goal loop. [] when none matched or for exited agents. The
+      // time-derived "typing" chip (user typing at the terminal) is appended
+      // from the stdin-activity marker, not the screen — same chip `ay ls` shows.
+      badges:
+        status === "exited"
+          ? []
+          : await logBadges(r.log_file).then(async (b) =>
+              (await isUserTyping(r.pid)) ? [...b, TYPING_BADGE.id] : b,
+            ),
     };
   };
 
@@ -1339,7 +1449,10 @@ export async function cmdServe(rest: string[]): Promise<number> {
     // share token are not necessarily host admins. Setting it stays host-local
     // (edit ~/.agent-yes/config.json) — there is no PUT.
     if (req.method === "GET" && p === "/api/spawn-config") {
-      return Response.json({ hasSpawnHook: hasSpawnHook() });
+      return Response.json({
+        hasSpawnHook: hasSpawnHook(),
+        hasProvisionHook: hasProvisionHook(),
+      });
     }
 
     // GET /api/notes
@@ -1620,7 +1733,18 @@ export async function cmdServe(rest: string[]): Promise<number> {
         const record = await resolveOne(keyword, defaultOpts({ all: true }));
         const args = ["restart", String(record.pid)];
         if (body.fresh) args.push("--fresh");
-        const child = Bun.spawn(["agent-yes", ...args], {
+        // Resolve `ay` to an absolute command — same as the /api/spawn path below.
+        // The detached daemon (oxmgr/launchd/pm2) usually has a PATH WITHOUT
+        // ~/.bun/bin and ~/.cargo/bin, so a bare "agent-yes"/"ay" fails with
+        // "Executable not found in $PATH" — the exact error the console surfaced on
+        // restart. Prefer PATH; fall back to re-running THIS process's own ay entry
+        // (process.argv[1]) — always present, since the daemon is itself an `ay serve`.
+        const ayBin = Bun.which("ay") ?? process.argv[1];
+        const ayCmd =
+          process.platform === "win32" && ayBin.toLowerCase().endsWith(".exe")
+            ? [ayBin]
+            : [process.execPath, ayBin];
+        const child = Bun.spawn([...ayCmd, ...args], {
           cwd: record.cwd,
           detached: true,
           stdio: ["ignore", "ignore", "ignore"],
@@ -1782,6 +1906,25 @@ export async function cmdServe(rest: string[]): Promise<number> {
             { status: 501 },
           );
         }
+        // koho-style provision gate — runs BEFORE the worktree + setup-repo.sh so
+        // it can select the git identity for this fork; its exit code overrides
+        // the allowlist. When no hook is configured, falls through to the allowlist
+        // check after the fork resolves owner/repo.
+        const forkOrigin = originOwnerRepo(fork.fromCwd);
+        const forkHook = await runProvisionHook(fork.fromCwd, {
+          KOHO_ACTION: "fork",
+          KOHO_FROM_CWD: fork.fromCwd,
+          KOHO_BRANCH: fork.branch,
+          KOHO_OWNER: forkOrigin?.owner ?? "",
+          KOHO_REPO: forkOrigin?.repo ?? "",
+          KOHO_WS_ROOT: getProvisionRoot() ?? "",
+        });
+        if (forkHook.ran && !forkHook.ok)
+          return new Response(
+            `provision hook denied this fork (exit ${forkHook.code})` +
+              (forkHook.detail ? `:\n${forkHook.detail}` : ""),
+            { status: 403 },
+          );
         let result: {
           ok: boolean;
           folder: string;
@@ -1800,11 +1943,14 @@ export async function cmdServe(rest: string[]): Promise<number> {
           return new Response(`fork failed: ${(e as Error).message}`, { status: 502 });
         }
         if (!result?.ok) return new Response(result?.error ?? "fork failed", { status: 502 });
-        // Same allowlist gate as `from` — the fork runs setup-repo.sh (code exec).
-        if (result.spec && !isProvisionAllowed(result.spec.owner, result.spec.repo))
+        // Allowlist gate — only when a provision hook did NOT already gate this
+        // (a configured hook overrides the allowlist). The fork runs setup-repo.sh
+        // (code exec), the same risk surface as `from`.
+        if (!forkHook.ran && result.spec && !isProvisionAllowed(result.spec.owner, result.spec.repo))
           return new Response(
             `forking '${result.spec.owner}/${result.spec.repo}' is not allowed — add the owner ` +
-              `to provisionAllowlist in ~/.agent-yes/config.json (or "*" to allow all)`,
+              `to provisionAllowlist in ~/.agent-yes/config.json (or "*" to allow all), ` +
+              `or set a provisionHook to gate it yourself`,
             { status: 403 },
           );
         cwd = result.folder;
@@ -1840,14 +1986,34 @@ export async function cmdServe(rest: string[]): Promise<number> {
         }
         if (!spec) return new Response(`unrecognized spawn source: ${from}`, { status: 400 });
         // Provisioning clones the repo and runs its setup script (dependency
-        // installs + package lifecycle hooks = code execution on the host), so
-        // gate it behind an owner/repo allowlist — empty allowlist = deny all.
-        if (!isProvisionAllowed(spec.owner, spec.repo))
+        // installs + package lifecycle hooks = code execution on the host), so it
+        // is gated. A koho-style provision hook, when configured, runs first (to
+        // select the git identity for the clone) and its exit code IS the gate,
+        // overriding the allowlist; otherwise the owner/repo allowlist gates it
+        // (empty allowlist = deny all).
+        const fromHook = await runProvisionHook(getProvisionRoot() ?? homedir(), {
+          KOHO_ACTION: "from",
+          KOHO_SOURCE: from,
+          KOHO_OWNER: spec.owner,
+          KOHO_REPO: spec.repo,
+          KOHO_BRANCH: spec.branch,
+          KOHO_WS_ROOT: getProvisionRoot() ?? "",
+        });
+        if (fromHook.ran) {
+          if (!fromHook.ok)
+            return new Response(
+              `provision hook denied '${spec.owner}/${spec.repo}' (exit ${fromHook.code})` +
+                (fromHook.detail ? `:\n${fromHook.detail}` : ""),
+              { status: 403 },
+            );
+        } else if (!isProvisionAllowed(spec.owner, spec.repo)) {
           return new Response(
             `provisioning '${spec.owner}/${spec.repo}' is not allowed — add the owner to ` +
-              `provisionAllowlist in ~/.agent-yes/config.json (or "*" to allow all)`,
+              `provisionAllowlist in ~/.agent-yes/config.json (or "*" to allow all), ` +
+              `or set a provisionHook to gate it yourself`,
             { status: 403 },
           );
+        }
         let result: { ok: boolean; folder: string; action: string; error?: string };
         try {
           const wsRoot = getProvisionRoot();

package/ts/subcommands.spec.ts

@@ -1,5 +1,6 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { mkdir, mkdtemp, rm, utimes, writeFile } from "fs/promises";
+import { appendFileSync } from "fs";
 import { tmpdir } from "os";
 import path from "path";
 
@@ -986,6 +987,346 @@ describe("subcommands.isSlashCommand", () => {
   });
 });
 
+describe("subcommands.waitForLogQuiet", () => {
+  it("resolves once writes to the file stop for quietMs, with the final size", async () => {
+    const dir = await mkdtemp(path.join(tmpdir(), "ay-quiet-"));
+    try {
+      const log = path.join(dir, "a.log");
+      await writeFile(log, "hello");
+      const { waitForLogQuiet } = await loadModule();
+      const size = await waitForLogQuiet(log, 50, 500);
+      expect(size).toBe(5);
+    } finally {
+      await rm(dir, { recursive: true, force: true }).catch(() => null);
+    }
+  });
+
+  it("returns the last observed size when maxWaitMs elapses without ever going quiet", async () => {
+    const dir = await mkdtemp(path.join(tmpdir(), "ay-quiet-"));
+    try {
+      const log = path.join(dir, "a.log");
+      await writeFile(log, "x");
+      const timer = setInterval(() => {
+        appendFileSync(log, "x");
+      }, 20);
+      try {
+        const { waitForLogQuiet } = await loadModule();
+        const start = Date.now();
+        const size = await waitForLogQuiet(log, 50, 200);
+        expect(Date.now() - start).toBeGreaterThanOrEqual(190); // hit the cap, not the quiet window
+        expect(size).toBeGreaterThan(0);
+      } finally {
+        clearInterval(timer);
+      }
+    } finally {
+      await rm(dir, { recursive: true, force: true }).catch(() => null);
+    }
+  });
+
+  it("returns null when the file can't be stat'd", async () => {
+    const { waitForLogQuiet } = await loadModule();
+    expect(await waitForLogQuiet("/no/such/file/here", 50, 200)).toBeNull();
+  });
+});
+
+describe("subcommands.submitAndConfirm (ay send swallowed-Enter fix)", () => {
+  const itUnix = process.platform === "linux" || process.platform === "darwin";
+  // claude's shipped `working` busy marker — matches cliDefaults()["claude"].working.
+  const BUSY = "⏺ Cogitating…\r\nesc to interrupt · ← for agents\r\n";
+  const IDLE = "❯ some leftover unsent text\r\n"; // no busy marker, never changes
+
+  const rec = (over: any) => ({
+    pid: process.pid,
+    cli: "claude",
+    prompt: null,
+    cwd: "/tmp",
+    log_file: null,
+    fifo_file: null,
+    status: "active",
+    exit_code: null,
+    exit_reason: null,
+    started_at: 0,
+    ...over,
+  });
+
+  async function withFifo(fn: (fifo: string) => Promise<void>) {
+    const { spawnSync } = await import("child_process");
+    const dir = await mkdtemp(path.join(tmpdir(), "ay-confirm-"));
+    const fifo = path.join(dir, "test.fifo");
+    try {
+      const r = spawnSync("mkfifo", [fifo]);
+      if (r.status !== 0) return; // mkfifo unavailable — skip
+      const fs = await import("fs");
+      const rdwrFd = fs.openSync(fifo, fs.constants.O_RDWR); // keeps writes from blocking
+      try {
+        await fn(fifo);
+      } finally {
+        fs.closeSync(rdwrFd);
+      }
+    } finally {
+      await rm(dir, { recursive: true, force: true }).catch(() => null);
+    }
+  }
+
+  it.skipIf(!itUnix)(
+    "confirms on the first attempt when the busy marker newly appears after sending",
+    async () => {
+      const dir = await mkdtemp(path.join(tmpdir(), "ay-confirm-log-"));
+      try {
+        const log = path.join(dir, "a.log");
+        await writeFile(log, "❯ \r\n"); // idle — no busy marker yet
+        const { submitAndConfirm } = await loadModule();
+        await withFifo(async (fifo) => {
+          // The Enter kicks off work: the busy marker appears shortly after,
+          // well within the confirm window — a genuine idle→busy transition.
+          setTimeout(() => appendFileSync(log, BUSY), 100);
+          const { confirmed, screen } = await submitAndConfirm(rec({ log_file: log }), fifo, "\r");
+          expect(confirmed).toBe(true);
+          expect(screen.join("\n")).toContain("esc to interrupt");
+        });
+      } finally {
+        await rm(dir, { recursive: true, force: true }).catch(() => null);
+      }
+    },
+  );
+
+  it.skipIf(!itUnix)(
+    "does NOT confirm from a busy marker that was already on screen before sending (false-positive guard)",
+    async () => {
+      // A screen already showing "esc to interrupt" (busy from whatever the agent
+      // was already doing) proves nothing about whether THIS Enter landed — e.g.
+      // it could be sitting queued, unsubmitted, behind an unrelated in-flight
+      // turn. Static and unchanging (no growth either), so this must NOT confirm.
+      const dir = await mkdtemp(path.join(tmpdir(), "ay-confirm-log-"));
+      try {
+        const log = path.join(dir, "a.log");
+        await writeFile(log, BUSY);
+        const { submitAndConfirm } = await loadModule();
+        await withFifo(async (fifo) => {
+          const { confirmed } = await submitAndConfirm(rec({ log_file: log }), fifo, "\r");
+          expect(confirmed).toBe(false);
+        });
+      } finally {
+        await rm(dir, { recursive: true, force: true }).catch(() => null);
+      }
+    },
+    10_000,
+  );
+
+  it.skipIf(!itUnix)("confirms via log growth even without a recognized busy marker", async () => {
+    const dir = await mkdtemp(path.join(tmpdir(), "ay-confirm-log-"));
+    try {
+      const log = path.join(dir, "a.log");
+      await writeFile(log, "❯ \r\n");
+      const { submitAndConfirm } = await loadModule();
+      await withFifo(async (fifo) => {
+        // Simulate the CLI starting to respond shortly after Enter lands — well
+        // within the first attempt's confirm window.
+        setTimeout(() => appendFileSync(log, "some real response text appears here\r\n"), 100);
+        const { confirmed } = await submitAndConfirm(rec({ log_file: log }), fifo, "\r");
+        expect(confirmed).toBe(true);
+      });
+    } finally {
+      await rm(dir, { recursive: true, force: true }).catch(() => null);
+    }
+  });
+
+  it.skipIf(!itUnix)(
+    "gives up after exhausting retries when the Enter is swallowed (screen never changes)",
+    async () => {
+      const dir = await mkdtemp(path.join(tmpdir(), "ay-confirm-log-"));
+      try {
+        const log = path.join(dir, "a.log");
+        await writeFile(log, IDLE); // never touched again — nothing to confirm
+        const { submitAndConfirm } = await loadModule();
+        await withFifo(async (fifo) => {
+          const { confirmed, screen } = await submitAndConfirm(rec({ log_file: log }), fifo, "\r");
+          expect(confirmed).toBe(false);
+          expect(screen.join("\n")).toContain("leftover unsent text");
+        });
+      } finally {
+        await rm(dir, { recursive: true, force: true }).catch(() => null);
+      }
+    },
+    10_000,
+  );
+});
+
+describe("subcommands.cmdSend end-to-end submit-confirm wiring", () => {
+  const itUnix = process.platform === "linux" || process.platform === "darwin";
+  const BUSY = "⏺ Cogitating…\r\nesc to interrupt · ← for agents\r\n";
+
+  // A background drain so cmdSend's writes to the FIFO never block, mirroring
+  // the "delivers a message to a real FIFO" setup above.
+  async function withDrainedFifo(fn: (fifo: string) => Promise<void>) {
+    const { spawnSync } = await import("child_process");
+    const dir = await mkdtemp(path.join(tmpdir(), "ay-send-e2e-"));
+    const fifo = path.join(dir, "test.fifo");
+    try {
+      if (spawnSync("mkfifo", [fifo]).status !== 0) return; // mkfifo unavailable — skip
+      const fs = await import("fs");
+      // O_NONBLOCK is REQUIRED here: without it, readSync on an empty FIFO BLOCKS
+      // the whole event loop. An O_RDWR fd keeps a writer open, so the read waits
+      // for bytes that only arrive once fn() calls writeToIpc — but fn() can't make
+      // progress while the loop is blocked in readSync → deadlock. That froze the
+      // vitest worker so hard its 30s testTimeout couldn't even fire, wedging the CI
+      // job for the full 6h cap. The catch below expects EAGAIN, which only happens
+      // with O_NONBLOCK. The sibling drain in "writeToIpc reliable delivery" already
+      // opens O_NONBLOCK for exactly this reason.
+      const rdwrFd = fs.openSync(fifo, fs.constants.O_RDWR | fs.constants.O_NONBLOCK);
+      const drain = setInterval(() => {
+        try {
+          fs.readSync(rdwrFd, Buffer.alloc(4096), 0, 4096, null);
+        } catch {
+          /* EAGAIN or similar — nothing pending, ignore */
+        }
+      }, 20);
+      // Belt-and-suspenders: never let the drain timer alone keep the worker alive.
+      // If a future test's fn() hangs past testTimeout, the finally below won't run
+      // (the awaited fn stays pending), but an unref'd timer can't wedge process exit.
+      drain.unref();
+      try {
+        await fn(fifo);
+      } finally {
+        clearInterval(drain);
+        fs.closeSync(rdwrFd);
+      }
+    } finally {
+      await rm(dir, { recursive: true, force: true }).catch(() => null);
+    }
+  }
+
+  async function send(fifo: string, log: string, body: string, extraArgs: string[] = []) {
+    const { runSubcommand } = await loadModule();
+    const { appendGlobalPid } = await import("./globalPidIndex.ts");
+    await appendGlobalPid({
+      pid: process.pid,
+      cli: "claude",
+      prompt: null,
+      cwd: process.cwd(),
+      log_file: log,
+      fifo_file: fifo,
+      status: "active",
+      exit_code: null,
+      exit_reason: null,
+      started_at: Date.now(),
+    });
+    const stdout: string[] = [];
+    const orig = process.stdout.write.bind(process.stdout);
+    (process.stdout as any).write = (s: any) => {
+      stdout.push(String(s));
+      return true;
+    };
+    const savedAyPid = process.env.AGENT_YES_PID;
+    delete process.env.AGENT_YES_PID; // isolate from the send-safety guard, as above
+    try {
+      const code = await runSubcommand([
+        "bun",
+        "cli.js",
+        "send",
+        String(process.pid),
+        body,
+        "--force",
+        ...extraArgs,
+      ]);
+      return { code, stdout: stdout.join("") };
+    } finally {
+      process.stdout.write = orig;
+      if (savedAyPid !== undefined) process.env.AGENT_YES_PID = savedAyPid;
+    }
+  }
+
+  it.skipIf(!itUnix)(
+    "exits 0 and reports 'sent' when a working marker appears after the Enter (genuine confirm)",
+    async () => {
+      const dir = await mkdtemp(path.join(tmpdir(), "ay-send-e2e-log-"));
+      // A STATIC pre-existing busy marker cannot confirm — that's the #157
+      // wasAlreadyWorking guard (see the "already on screen before sending" test).
+      // Confirmation needs a real idle→working transition (or >=8 bytes of growth)
+      // AFTER the submit. Model that: the log is idle until we send, then a steady
+      // trickle of the working marker lands within submitAndConfirm's window, so it
+      // confirms deterministically without fragile single-shot timing.
+      const log = path.join(dir, "a.log");
+      await writeFile(log, "❯ \r\n"); // idle until the submitted Enter lands
+      let working = false;
+      const respond = setInterval(() => {
+        if (working) appendFileSync(log, BUSY);
+      }, 40);
+      respond.unref();
+      try {
+        await withDrainedFifo(async (fifo) => {
+          working = true; // the submitted Enter kicks the agent into working
+          const { code, stdout } = await send(fifo, log, "hello");
+          expect(code).toBe(0);
+          expect(stdout).toMatch(/^sent to pid/);
+          expect(stdout).not.toMatch(/NOT confirmed/);
+        });
+      } finally {
+        clearInterval(respond);
+        await rm(dir, { recursive: true, force: true }).catch(() => null);
+      }
+    },
+  );
+
+  it.skipIf(!itUnix)(
+    "exits non-zero and reports the leftover screen when submission can't be confirmed",
+    async () => {
+      const dir = await mkdtemp(path.join(tmpdir(), "ay-send-e2e-log-"));
+      try {
+        const log = path.join(dir, "a.log");
+        await writeFile(log, "❯ \r\n"); // stays this way — nothing ever confirms
+        await withDrainedFifo(async (fifo) => {
+          const { code, stdout } = await send(fifo, log, "hello");
+          expect(code).toBe(1);
+          expect(stdout).toMatch(/NOT confirmed/);
+        });
+      } finally {
+        await rm(dir, { recursive: true, force: true }).catch(() => null);
+      }
+    },
+    10_000,
+  );
+
+  it.skipIf(!itUnix)(
+    "applies submit-confirm for --code=cr too, not just the default --code=enter",
+    async () => {
+      // canConfirm gates on the resolved trailing byte, not the code NAME, so
+      // every alias that resolves to Enter must go through the same confirm
+      // path — regression test for that alias-vs-byte gap.
+      const dir = await mkdtemp(path.join(tmpdir(), "ay-send-e2e-log-"));
+      try {
+        const log = path.join(dir, "a.log");
+        await writeFile(log, "❯ \r\n"); // never confirms — nothing ever changes
+        await withDrainedFifo(async (fifo) => {
+          const { code, stdout } = await send(fifo, log, "hello", ["--code=cr"]);
+          expect(code).toBe(1);
+          expect(stdout).toMatch(/NOT confirmed/);
+        });
+      } finally {
+        await rm(dir, { recursive: true, force: true }).catch(() => null);
+      }
+    },
+    10_000,
+  );
+
+  it.skipIf(!itUnix)("--no-wait skips confirmation entirely and always exits 0", async () => {
+    const dir = await mkdtemp(path.join(tmpdir(), "ay-send-e2e-log-"));
+    try {
+      const log = path.join(dir, "a.log");
+      await writeFile(log, "❯ \r\n"); // would fail to confirm if checked — but we opt out
+      await withDrainedFifo(async (fifo) => {
+        const start = Date.now();
+        const { code, stdout } = await send(fifo, log, "hello", ["--no-wait"]);
+        expect(code).toBe(0);
+        expect(stdout).not.toMatch(/NOT confirmed/);
+        expect(Date.now() - start).toBeLessThan(1000); // fast — no settle/confirm polling
+      });
+    } finally {
+      await rm(dir, { recursive: true, force: true }).catch(() => null);
+    }
+  });
+});
+
 describe("subcommands.writeToIpc reliable delivery", () => {
   const itUnix = process.platform === "linux" || process.platform === "darwin";