botmux 3.4.1 → 3.4.2

package/dist/utils/ready-gate.js

@@ -1,6 +1,6 @@
 /**
  * Ready-gate state machine — holds the FIRST prompt for Claude-family CLIs until
- * a SessionStart hook fires a "真就绪" (true-ready) signal.
+ * a SessionStart hook proves the outer startup selector has been passed.
  *
  * Why this exists: a custom launcher (e.g. `cjadk claude`) shows an interactive
  * model/session selector at startup whose cursor is `❯` (U+276F). That glyph
@@ -10,11 +10,11 @@
  * trailing Enter mis-selects a menu item). The selector clears before Claude's
  * real input box renders, so the message is silently lost.
  *
- * Claude Code's `SessionStart` hook fires within ~3ms of the real input box
- * rendering, and crucially does NOT fire while the launcher is still on its
- * selector — so it's an unambiguous "the CLI is genuinely ready" signal. This
- * gate suspends the first flush until that signal (or a fallback timeout) so the
- * selector can never eat the first message.
+ * Claude Code's `SessionStart` hook crucially does NOT fire while the launcher
+ * is still on its selector. Claude can run multiple matching hooks in parallel,
+ * though, and renders the real prompt only after all finish. This gate therefore
+ * establishes the anti-selector boundary; the worker separately waits for fresh
+ * post-signal prompt evidence before it flushes Claude input.
  *
  * Lifecycle (recreated per CLI spawn in the worker):
  *   - `arm()`        — call at spawn when the adapter injects the SessionStart

package/dist/worker.js

@@ -24,7 +24,7 @@ import { readProcessStartIdentity } from './core/session-marker.js';
 import { drainTranscript, joinAssistantText, trailingAssistantText, findJsonlContainingFingerprint, findJsonlsContainingExactContent, findLatestJsonl, extractLastAssistantTurn, extractTurnStartText, splitTranscriptEventsByCutoff } from './services/claude-transcript.js';
 import { BridgeTurnQueue, makeFingerprint, normaliseForFingerprint } from './services/bridge-turn-queue.js';
 import { shouldSuppressBridgeEmit } from './services/bridge-fallback-gate.js';
-import { decideHardTimeoutAction, decideSettleMarkReady, shouldReleaseFirstPromptTimeout, shouldWriteNow } from './utils/input-gate.js';
+import { decideHardTimeoutAction, decideSettleMarkReady, shouldReleaseFirstPromptTimeout, shouldWaitForPostSessionStartPromptEvidence, shouldWriteNow, } from './utils/input-gate.js';
 import { canStartInjectionFlush, shouldDeferUserFlush, shouldFlushInjectionsFirst } from './core/inject-queue-policy.js';
 import { stripAnsiForLog, tailChars } from './utils/crash-log.js';
 import { CodexUpdateDialogGuard } from './utils/codex-update-dialog.js';
@@ -794,17 +794,16 @@ let bareShellLaunchBlocked = false;
  *  shell. Reset per spawn in spawnCli. */
 let bareShellChecked = false;
 /** Ready-gate (Claude-family): holds the first prompt until the SessionStart
- *  hook fires a true-ready signal, so a cjadk-style startup selector's ❯ (which
- *  falsely matches readyPattern) can't eat the first message. Recreated + armed
- *  per spawn in spawnCli; disarmed on signal or fallback timeout. */
+ *  hook proves a cjadk-style startup selector is behind us. Claude then needs
+ *  fresh post-hook prompt evidence because sibling hooks may still be running.
+ *  Recreated + armed per spawn; disarmed on signal or fallback timeout. */
 let readyGate = new ReadyGate();
 /** Fallback timer: if the SessionStart signal never arrives (hook injection
  *  failed / old CLI / launcher didn't pass --settings / adopt) release the gate
  *  and fall back to readyPattern + quiescence. */
 let readySignalTimer = null;
 /** How long the ready-gate waits for the SessionStart signal before falling
- *  back. The real signal lands within ~ms of the input box rendering, so this is
- *  pure insurance against a missing/failed hook — generous but bounded. */
+ *  back. This is insurance against a missing/failed hook — generous but bounded. */
 const READY_SIGNAL_TIMEOUT_MS = 45_000;
 /** Soft fallback for CLIs that never emit an idle/ready signal during startup.
  *  Legacy adapters release queued first input here. Adapters that opt into
@@ -817,13 +816,13 @@ const FIRST_PROMPT_HARD_TIMEOUT_MS = 90_000;
 /** Epoch ms of the most recent PTY output — used to settle for quiescence
  *  before the first flush (see settleThenFlush). */
 let lastPtyOutputAtMs = 0;
-/** After the SessionStart signal fires, the input box has appeared but Ink's
- *  startup render isn't fully drained yet — typing immediately trips Claude's
+/** After the SessionStart signal fires, Ink's startup rendering or sibling
+ *  hooks may still be active — typing immediately can trip Claude's
  *  paste-burst heuristic and the `\` soft-newline markers (claude-code
  *  writeInput) get kept literally. This is pronounced under wrapperCli launchers
  *  (e.g. `aiden x claude`) whose Claude renders more at startup. So we wait for
- *  the PTY to fall quiet for SETTLE_MS before the first flush — the signal still
- *  gates readiness (anti-selector), the settle just lets the render drain. */
+ *  PTY quiescence, while Claude additionally requires fresh prompt evidence
+ *  after the SessionStart boundary. */
 const READY_FLUSH_SETTLE_MS = 1_000;
 /** Upper bound on the settle so a chatty startup (spinners, periodic redraw)
  *  can't stall the first prompt indefinitely. */
@@ -846,11 +845,18 @@ let promptReadyDetectedDuringSettle = false;
  *  spawn that renders ❯ but never fires BOTMUX_READY_COMMAND waits the full
  *  hard timeout (and previously never delivered at all). */
 let readyPatternSeenDuringHold = false;
+/** Claude's SessionStart hooks run in parallel. Its botmux hook proves the
+ * startup selector is behind us, but sibling project hooks may still be
+ * running. Hold type-ahead until a fresh PTY prompt is observed after the
+ * SessionStart signal. */
+let awaitingPostSessionStartPromptEvidence = false;
+/** Scoped marker set only by IdleDetector's screen-driven callback. */
+let postSessionStartPromptEvidenceInFlight = false;
 /** Wait until the PTY has been quiet for READY_FLUSH_SETTLE_MS (Ink render
  *  drained), capped at READY_FLUSH_SETTLE_CAP_MS, then flush the held prompt.
- *  A real SessionStart/BOTMUX_READY_COMMAND signal is itself authoritative
- *  prompt readiness; the timeout fallback only opens the gate and lets the
- *  regular readyPattern/idle path prove readiness later. */
+ *  An authoritative direct ready command (Hermes) can mark prompt readiness;
+ *  Claude's SessionStart only opens the anti-selector boundary and its regular
+ *  readyPattern/idle path must prove readiness afterward. */
 function settleThenFlush(startedAtMs, promptReadyAfterSettle) {
     readyFlushSettleTimer = null;
     const now = Date.now();
@@ -4527,6 +4533,15 @@ function releaseRawInputRestartGate() {
     rawInputRestartGate = false;
     log('Replacement CLI prompt ready — releasing deferred passthrough commands');
 }
+function markPromptReadyFromPty() {
+    postSessionStartPromptEvidenceInFlight = true;
+    try {
+        markPromptReady();
+    }
+    finally {
+        postSessionStartPromptEvidenceInFlight = false;
+    }
+}
 function markPromptReady() {
     if (isPromptReady)
         return; // guard against duplicate calls
@@ -4546,6 +4561,14 @@ function markPromptReady() {
         log('Idle detected but holding for SessionStart ready signal (startup selector guard)');
         return;
     }
+    if (awaitingPostSessionStartPromptEvidence) {
+        if (!postSessionStartPromptEvidenceInFlight) {
+            log('Ignoring non-PTY ready source while waiting for post-SessionStart prompt evidence');
+            return;
+        }
+        awaitingPostSessionStartPromptEvidence = false;
+        log('Fresh prompt evidence observed after SessionStart hooks');
+    }
     if (isSettlingFirstFlush) {
         promptReadyDetectedDuringSettle = true;
         log('Idle detected during ready-gate settle; deferring prompt-ready until settle completes');
@@ -4577,6 +4600,7 @@ function markPromptReady() {
     maybeEmitWorkflowTranscriptOutput();
     if (awaitingFirstPrompt) {
         awaitingFirstPrompt = false;
+        awaitingPostSessionStartPromptEvidence = false;
         renderer?.markNewTurn(); // exclude history replay from streaming card
     }
     send({ type: 'prompt_ready' });
@@ -4916,6 +4940,10 @@ async function flushPending() {
         log(`Holding ${pendingMessages.length} pending message(s) until ready-gate settle completes`);
         return;
     }
+    if (awaitingPostSessionStartPromptEvidence) {
+        log(`Holding ${pendingMessages.length} pending message(s) until post-SessionStart prompt evidence`);
+        return;
+    }
     // Type-ahead adapters flush even while the CLI is busy; others wait for
     // idle. Claude bridge fallback used to also disable type-ahead because
     // BridgeTurnQueue.ingest didn't recognise the `attachment(queued_command)`
@@ -7369,6 +7397,7 @@ async function spawnCli(cfg, opts = {}) {
     isSettlingFirstFlush = false;
     promptReadyDetectedDuringSettle = false;
     readyPatternSeenDuringHold = false;
+    awaitingPostSessionStartPromptEvidence = false;
     // Reset quiescence baseline so the settle measures silence from THIS spawn.
     lastPtyOutputAtMs = Date.now();
     const readyHookAvailable = effectiveReadyHookInstall
@@ -7411,7 +7440,7 @@ async function spawnCli(cfg, opts = {}) {
     // quiescence, repeatedly triggering markPromptReady() and duplicate cards.
     if (effectiveBackendType !== 'riff') {
         idleDetector = new IdleDetector(cliAdapter);
-        idleDetector.onIdle(async () => {
+        idleDetector.onIdle(async (evidenceSource) => {
             log('Prompt detected (idle)');
             // Bridge drain MUST run before markPromptReady() — the latter calls
             // flushPending() which can immediately fire the next queued message
@@ -7433,7 +7462,12 @@ async function spawnCli(cfg, opts = {}) {
                     log(`Codex bridge emit error: ${err.message}`);
                 }
             }
-            markPromptReady();
+            if (evidenceSource === 'screen') {
+                markPromptReadyFromPty();
+            }
+            else {
+                markPromptReady();
+            }
         });
     }
     backend.onData(onPtyData);
@@ -7582,6 +7616,7 @@ async function spawnCli(cfg, opts = {}) {
             return;
         }
         awaitingFirstPrompt = false;
+        awaitingPostSessionStartPromptEvidence = false;
         renderer?.markNewTurn();
         log(forced
             ? `WARN First prompt hard timeout — ${cliName()} readyPattern did not arrive; forcing queued message flush`
@@ -7643,6 +7678,7 @@ function killCli(opts = {}) {
     isSettlingFirstFlush = false;
     promptReadyDetectedDuringSettle = false;
     readyPatternSeenDuringHold = false;
+    awaitingPostSessionStartPromptEvidence = false;
     stopScreenAnalyzer();
     stopScreenUpdates();
     backend?.kill();
@@ -9454,24 +9490,43 @@ process.on('message', async (raw) => {
             break;
         }
         case 'session_ready': {
-            // Claude-family SessionStart hook fired (via `botmux session-ready` →
-            // daemon). The CLI's input box is genuinely rendered — release the
-            // ready-gate and deliver any held first prompt. Idempotent: a later
-            // duplicate (clear/compact source) is a no-op.
+            // Claude-family SessionStart hooks run in parallel. This signal proves
+            // the startup selector is behind us, but a slower project hook can still
+            // be running and Claude does not render its real prompt until ALL hooks
+            // finish. Clear selector-era evidence and require a fresh PTY prompt after
+            // the signal. Hermes keeps its authoritative ready-command behavior.
             log(`SessionStart ready signal received (source=${msg.source ?? '?'})`);
+            const waitForPostHookPrompt = shouldWaitForPostSessionStartPromptEvidence({
+                isClaudeFamily: !!cliAdapter?.claudeDataDir,
+                hasReadyPattern: !!cliAdapter?.readyPattern,
+                awaitingFirstPrompt,
+                isPromptReady,
+                alreadyWaiting: awaitingPostSessionStartPromptEvidence,
+            });
+            if (waitForPostHookPrompt) {
+                awaitingPostSessionStartPromptEvidence = true;
+                promptReadyDetectedDuringSettle = false;
+                readyPatternSeenDuringHold = false;
+                idleDetector?.resetReadyEvidence();
+                lastPtyOutputAtMs = Date.now();
+                log('SessionStart boundary recorded — waiting for fresh post-hook prompt evidence');
+            }
             // 先记下 gate 是否已被 45s fallback 释放：ReadyGate.receive() 是一次性
             // 语义，fallback 抢先后 releaseReadyGate 会整块跳过迟到的真信号。
             const lateAfterFallback = readyGate.isArmed && readyGate.isReceived;
-            releaseReadyGate('SessionStart hook', { promptReadyAfterSettle: true });
+            releaseReadyGate('SessionStart hook', { promptReadyAfterSettle: !waitForPostHookPrompt });
             // 冷启动超过 READY_SIGNAL_TIMEOUT_MS 的 CLI（Hermes 常态是 2-3 分钟）恰好
             // 总落在 fallback 之后：fallback 只开闸不投递（非 type-ahead 的
             // flushPending 是 no-op），真信号依然是权威就绪，这里直接兑现。仅限首轮
             // （awaitingFirstPrompt）——首条 prompt 交付后 clear/compact 来源的
             // SessionStart 保持原有 no-op 语义，绝不在会话中途误标就绪。
-            if (lateAfterFallback && awaitingFirstPrompt && !isPromptReady) {
+            if (lateAfterFallback && awaitingFirstPrompt && !isPromptReady && !waitForPostHookPrompt) {
                 log('Late ready signal after timeout fallback — marking prompt ready now');
                 markPromptReady();
             }
+            if (msg.requestId) {
+                send({ type: 'session_ready_ack', requestId: msg.requestId });
+            }
             break;
         }
         case 'set_display_mode': {