cckeep 0.2.3 → 0.4.0

package/README.ja.md

@@ -59,12 +59,13 @@ asdf reshim nodejs # asdf
 
 ここがこのツールの設計上いちばん難しいところです。タイマーでターミナルに文字を打ち込むツールは、「いま打っても安全か」を確実に判断できない限り、ただ危険なだけになります。以下はすべて実装済みで、[テスト](test/)で守られています。
 
-- **ターンの実行中は打たない。** ペインを2秒あけて2回キャプチャします。実行中はスピナーとトークン数が動くので、2回が同じなら何もしていない証拠です。違っていれば手を出しません
-- **ダイアログには打たない。** 権限プロンプトや選択メニューでは、Enter が「選択」になってしまいます。選択マーカーが画面にあれば、その回はまるごと見送ります
-- **自分で開いたパネルには触らない。** `/remote-control` は QR コード付きのステータスパネルを開きます。cckeep が Enter を押すのは、自分でパネルを開いたときだけです
-- **自分で切った接続は戻さない。** 一度でも接続できていたペインだけを対象にします。意図して切ったものは切れたままです
-- **連打しない。** 同じペインに手を出すのは5分に1回までです
-- **送る直前にもう一度確かめる。** 判断は1回のキャプチャで下しますが、待機したあとにもう一度確認します。その間に復帰していたり、ダイアログが出ていれば何も送りません
+- **入力中の文字の上には打たない。** Enter は入力欄の内容をそのまま送信するので、書きかけの下書きがあるとコマンドがくっついて送信されてしまいます。入力欄に何か入っている場合、そもそも入力欄が見つからない場合は何も送りません。静止判定ではこれを防げません。下書きは動かないからです
+- **ターンの実行中は打たない。** ペインを3回キャプチャします。実行中はスピナーとトークン数が動くので、3回とも同じなら何もしていない証拠です。2回ではなく3回、しかも間隔をあえて半端な値にしているのは、周期が間隔を割り切るアニメーションだと同じ絵が並んで静止に見えてしまうためです
+- **ダイアログには打たない。** 権限プロンプトでは Enter が「選択」になります。選択マーカーは画面のどこにあっても対象にしますが、英語の言い回し(`Do you want …` など)は入力欄の近くにある場合だけ対象にします。Claude Code は通常の返答でも同じ言い回しを使うためです
+- **自分で開いたパネルには触らない。** `/remote-control` は QR コード付きのステータスパネルを開きます。cckeep が Enter を押すのは自分でパネルを開いたときだけで、押す直前にもパネルがまだ開いているかを確認します
+- **話題に出しただけのセッションは対象にしない。** 状態の判定は画面末尾の数行だけから読み、会話本文からは読みません。`/rc active` について話しているセッションが接続中と誤認されることはありません。一度も接続を確認していないペインに手を出すのは、Claude Code 自身が「接続が切れた」と表示した場合だけです
+- **連打しない。同時に2つ動かない。** 同じペインに手を出すのは5分に1回まで。さらにロックを取るので、`cckeep watch` とスケジュール実行が並走しても、2つの処理が混ざって壊れた入力になることはありません
+- **送る直前にもう一度確かめる。** 判断は1回のキャプチャで下しますが、待機後にもう一度確認します。その間に復帰した、ダイアログが出た、何か入力された — いずれでも何も送りません。そしてそれまでの経過はリセットせず保持します
 
 `--dry-run` を付けると、送る内容を表示するだけで実際には何も送りません。
 
@@ -72,7 +73,7 @@ asdf reshim nodejs # asdf
 
 | 画面の状態 | 意味 | cckeep の動作 |
 |---|---|---|
-| `/rc active` | 接続できている | ペインを覚えるだけ |
+| `/rc active`、または切り詰められた `/rc` | 接続できている | ペインを覚えるだけ |
 | `/rc reconnecting` | 31秒の再試行中 | 待つ(たいていはこれで戻る) |
 | `/rc reconnecting` が2分以上 | 固まっている([#34255](https://github.com/anthropics/claude-code/issues/34255)) | パネルを開いて切断し、繋ぎ直す |
 | `Remote Control disconnected` | 諦めた | すぐに繋ぎ直す |
@@ -170,8 +171,9 @@ Ctrl+B の衝突については何もしなくて構いません。Claude Code
 - `missLimit`: 以前は表示があったペインが、何回続けて無表示なら繋ぎ直すか
 - `settle`: 静止判定に使う2回のキャプチャの間隔(ミリ秒)。遅いマシンでは増やしてください
 - `paneCommand`: Claude Code のペインだと判定するフォアグラウンドプロセス名
+- `tmuxSocket`: 既定以外のサーバーで tmux を動かしている場合のソケット名またはパス(`tmux -L name` / `-S path`)。空なら既定サーバー
 
-どの項目にも環境変数版があります。`CCKEEP_INTERVAL`、`CCKEEP_COOLDOWN`、`CCKEEP_STUCK_LIMIT`、`CCKEEP_MISS_LIMIT`、`CCKEEP_SETTLE`、`CCKEEP_PANE_COMMAND` です。`CCKEEP_HOME` を指定すれば、状態・設定・ログの置き場所を `~/.cckeep` 以外に移せます。
+どの項目にも環境変数版があります。`CCKEEP_INTERVAL`、`CCKEEP_COOLDOWN`、`CCKEEP_STUCK_LIMIT`、`CCKEEP_MISS_LIMIT`、`CCKEEP_SETTLE`、`CCKEEP_PANE_COMMAND`、`CCKEEP_TMUX_SOCKET` です。`CCKEEP_HOME` を指定すれば、状態・設定・ログの置き場所を `~/.cckeep` 以外に移せます。
 
 ## 適用範囲
 
@@ -199,6 +201,8 @@ Claude Code はフッターにリモートコントロールの状態を表示
 
 ペインを探すところに一手間あります。Claude Code は自身のプロセスタイトルを書き換えるため、tmux はそのペインのコマンド名を `claude` ではなく `2.1.220` のように報告します。tmux の報告する名前だけで判定すると、実機では1つも見つかりません。そこで cckeep はプロセステーブルも参照し、ペインのプロセス(またはそこから起動されたプロセス)が実際に `claude` であればそのペインを対象とします。
 
+インジケータは右寄せで描画されるため、カスタムステータスラインを使っていたりペインが狭かったりすると、`active` が削られて `/rc` だけになります。cckeep はこれを接続中として扱います。インジケータ自体は接続がある間しか描画されず、接続中と読んでもペインを記録して待つだけなので、안全な側に倒れるからです。
+
 「どこを見るか」も同じくらい重要です。状態の判定に使う文字列は画面末尾の十数行からしか読みません。これらの言葉は普通の会話にも出てくるので、たとえば `/rc active` について話しているだけのセッションが「接続中」に見えてしまうからです。逆にダイアログとステータスパネルの検出は画面全体を対象にしています。こちらは誤検知しても1回見送るだけで済みますが、見落とすと誤ったキー入力に直結します。
 
 判定層(`src/detect.js`)は、画面テキストと直前の状態だけを受け取る純粋関数です。だからこそ、安全ルールをターミナル無しで網羅的にテストできます。静止判定・直前の再確認・キー送信といった I/O は、実行層(`src/run.js`)が担当します。

package/README.md

@@ -61,12 +61,13 @@ One requirement: **Claude Code has to be running inside tmux.** A session starte
 
 This is the whole design problem. A watchdog that types into your terminal on a timer is a liability unless it is certain the moment is safe. Every one of these is enforced, and [tested](test/):
 
-- **Never during a turn.** The pane is captured twice, two seconds apart. A running turn animates a spinner and a token counter, so identical captures mean nothing is happening. Different ones mean hands off.
-- **Never into a dialog.** Permission prompts and pickers turn Enter into a selection. If a selection marker is on screen, the pass is skipped.
-- **Never into the panel you opened.** `/remote-control` opens a status panel with a QR code. cckeep only presses Enter there when it opened the panel itself.
-- **Never a session you turned off.** Only panes seen connected at least once are ever chased. Disable Remote Control deliberately and it stays off.
-- **Never in a tight loop.** One action per pane per 5 minutes.
-- **Re-checked at the last moment.** The decision is made from one capture, then re-verified after the idle wait — if the pane reconnected or opened a dialog in between, nothing is sent.
+- **Never on top of what you typed.** Enter submits whatever is in the composer, so an unsent draft would go out with the command glued onto it. If anything is in the box — or the box cannot be found at all — nothing is sent. The idle check cannot cover this: a draft sitting in the box is perfectly still.
+- **Never during a turn.** The pane is captured three times. A running turn animates a spinner and a token counter, so identical captures mean nothing is happening. Three rather than two, at an interval that is deliberately not round, because any animation whose period divides the interval would otherwise alias into identical frames.
+- **Never into a dialog.** Permission prompts turn Enter into a selection. A selection marker counts anywhere on screen; the plain English phrasings only count near the composer, since Claude Code writes sentences like "Do you want me to run the tests as well?" in ordinary replies.
+- **Never into the panel you opened.** `/remote-control` opens a status panel with a QR code. cckeep only presses Enter there when it opened the panel itself, and only if the panel is still up when it goes to press it.
+- **Never a session that only mentioned it.** The indicators are read from the last few rows, never from the transcript, so a session discussing `/rc active` is not mistaken for a connected one. A pane that has never been seen connected is only ever acted on when Claude Code itself prints that the link died.
+- **Never in a tight loop, and never twice at once.** One action per pane per 5 minutes, and a lock so that `cckeep watch` running alongside the scheduled job cannot interleave two passes into one garbled prompt.
+- **Re-checked at the last moment.** The decision is made from one capture, then re-verified after the wait — reconnected in between, dialog appeared, something typed? Nothing is sent, and the pane keeps the progress it had made rather than starting its wait over.
 
 `--dry-run` prints what it would do and sends nothing.
 
@@ -74,7 +75,7 @@ This is the whole design problem. A watchdog that types into your terminal on a
 
 | State on screen | What it means | What cckeep does |
 |---|---|---|
-| `/rc active` | connected | remembers the pane, nothing else |
+| `/rc active`, or a truncated `/rc` | connected | remembers the pane, nothing else |
 | `/rc reconnecting` | inside the 31-second budget | waits — this usually resolves |
 | `/rc reconnecting`, 2 minutes on | wedged ([#34255](https://github.com/anthropics/claude-code/issues/34255)) | cycles the bridge: opens the panel, disconnects, reconnects |
 | `Remote Control disconnected` | gave up | re-arms immediately |
@@ -174,8 +175,9 @@ Defaults are tuned so you never notice it. Override in `~/.cckeep/config.json`,
 - `missLimit` — checks with no indicator before re-arming a pane that had one
 - `settle` — milliseconds between the two captures of the idle check; raise it on a slow machine
 - `paneCommand` — foreground process name that marks a pane as Claude Code
+- `tmuxSocket` — socket name or path, if your tmux runs on something other than the default server (`tmux -L name` / `-S path`). Empty means the default
 
-Every key has an env twin: `CCKEEP_INTERVAL`, `CCKEEP_COOLDOWN`, `CCKEEP_STUCK_LIMIT`, `CCKEEP_MISS_LIMIT`, `CCKEEP_SETTLE`, `CCKEEP_PANE_COMMAND`. `CCKEEP_HOME` moves state, config and log off `~/.cckeep`.
+Every key has an env twin: `CCKEEP_INTERVAL`, `CCKEEP_COOLDOWN`, `CCKEEP_STUCK_LIMIT`, `CCKEEP_MISS_LIMIT`, `CCKEEP_SETTLE`, `CCKEEP_PANE_COMMAND`, `CCKEEP_TMUX_SOCKET`. `CCKEEP_HOME` moves state, config and log off `~/.cckeep`.
 
 ## Scope
 
@@ -203,6 +205,8 @@ Claude Code paints a Remote Control indicator in its footer: `/rc active` when c
 
 Finding those panes takes one extra step: Claude Code rewrites its own process title, so tmux reports such a pane as `2.1.220` rather than `claude`. Matching the name tmux reports therefore finds nothing on a real machine. cckeep checks the process table as well, and treats a pane as Claude Code's when the pane's process — or anything it spawned — is actually `claude`.
 
+The indicator is right-aligned, so a custom status line or a narrow pane squeezes it down to a bare `/rc` with the word cut off. cckeep treats that as connected: the indicator only renders while a link exists, and reading it as connected merely records the pane and waits.
+
 Where it looks matters as much as what it looks for. The state indicators are read from the last dozen lines only, because the words themselves turn up in ordinary conversation — a session where you happen to discuss `/rc active` would otherwise read as connected. Dialog and status-panel detection deliberately scans the whole pane instead: a false positive there costs one skipped pass, while a miss costs a keystroke in the wrong place.
 
 The decision layer (`src/detect.js`) is a pure function of screen text plus prior state, which is why the safety rules can be tested exhaustively without a terminal. The runner (`src/run.js`) does the I/O: the idle check, the last-moment re-check, and the keystrokes.

package/bin/cckeep.js

@@ -7,7 +7,7 @@ import { logPath, statePath, homeDir } from '../src/state.js';
 import * as tmux from '../src/tmux.js';
 import * as scheduler from '../src/scheduler.js';
 import { pickLang, strings } from '../src/i18n.js';
-import { resolveCommand } from '../src/commands.js';
+import { resolveCommand, isKnownCommand } from '../src/commands.js';
 import { parsePsTable, isTargetPane } from '../src/procs.js';
 
 const HELP = `cckeep — keep Claude Code Remote Control from silently going dead
@@ -41,16 +41,33 @@ into the ones that went dead — never into one that is busy or showing a dialog
 `;
 
 function parseArgs(argv) {
-  const opts = { command: null, dryRun: false, json: false, lang: null, interval: null };
+  const opts = { command: null, dryRun: false, json: false, lang: null, interval: null, error: null };
+  const fail = (msg) => {
+    if (!opts.error) opts.error = msg;
+  };
+  // Unknown flags used to be skipped in silence, so `--dry-runn` performed real
+  // sends into live panes. The one flag that prevents sending must never fail
+  // open on a typo.
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
     if (a === '--dry-run') opts.dryRun = true;
     else if (a === '--json') opts.json = true;
-    else if (a === '--lang') opts.lang = argv[++i];
-    else if (a === '--interval') opts.interval = Number(argv[++i]);
-    else if (a === '-h' || a === '--help') opts.command = 'help';
+    else if (a === '--lang') {
+      const v = argv[++i];
+      if (v === undefined || v.startsWith('-')) fail('--lang needs a value: en or ja');
+      else if (v !== 'en' && v !== 'ja') fail(`--lang must be en or ja, not "${v}"`);
+      else opts.lang = v;
+    } else if (a === '--interval') {
+      const v = argv[++i];
+      const n = Number(v);
+      if (v === undefined || v.startsWith('-')) fail('--interval needs a value in seconds');
+      else if (!Number.isInteger(n) || n < 1) fail(`--interval must be a whole number of seconds, not "${v}"`);
+      else opts.interval = n;
+    } else if (a === '-h' || a === '--help') opts.command = 'help';
     else if (a === '-v' || a === '--version') opts.command = 'version';
-    else if (!a.startsWith('-') && !opts.command) opts.command = a;
+    else if (a.startsWith('-')) fail(`Unknown option: ${a}`);
+    else if (!opts.command) opts.command = a;
+    else fail(`Unexpected argument: ${a}`);
   }
   return opts;
 }
@@ -68,6 +85,7 @@ const REASON_KEY = {
   dialog: 'dialog',
   cooldown: 'cooldown',
   busy: 'busy',
+  'composer-busy': 'composerBusy',
   recovered: 'recovered',
 };
 
@@ -106,6 +124,18 @@ async function main() {
   if (opts.command === 'help') return console.log(HELP);
   if (opts.command === 'version') return console.log(version());
 
+  if (opts.error) {
+    console.error(opts.error);
+    console.error('Run `cckeep --help` for the full list.');
+    process.exit(2);
+  }
+
+  if (opts.command !== null && !isKnownCommand(opts.command)) {
+    console.error(`Unknown command: ${opts.command}\n`);
+    console.log(HELP);
+    process.exit(1);
+  }
+
   let config;
   try {
     config = loadConfig(opts.interval ? { interval: opts.interval } : {});
@@ -114,6 +144,10 @@ async function main() {
     process.exit(1);
   }
 
+  // The socket and binary can only come from the config file, so hand them to
+  // the tmux layer before anything queries it.
+  tmux.configureTmux({ socket: config.tmuxSocket, binary: config.tmuxBinary });
+
   switch (resolveCommand(opts.command)) {
     case 'status': {
       const out = await runPass({ config, dryRun: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cckeep",
-  "version": "0.2.3",
+  "version": "0.4.0",
   "description": "Keeps Claude Code Remote Control from silently going dead. Re-arms the sessions its 31-second retry budget gives up on — local, tmux-native, zero dependencies.",
   "type": "module",
   "bin": {

package/src/config.js

@@ -7,16 +7,25 @@ export const BASE = {
   ...DEFAULTS,
   /** Seconds between passes in watch mode, and what `enable` schedules. */
   interval: 15,
-  /** Milliseconds between the two captures of the idle check. */
-  settle: 2000,
+  /** Milliseconds between idle-check captures. Deliberately not a round
+   * number: a spinner whose period divides the interval would alias to
+   * identical frames and read as idle. */
+  settle: 1700,
   /** Milliseconds between typing the command and pressing Enter. */
   keyDelay: 1000,
   /** Foreground process name that marks a pane as Claude Code. */
   paneCommand: 'claude',
+  /** tmux socket name or path, for anyone not on the default server. */
+  tmuxSocket: '',
+  /** Absolute path to tmux, for installs outside the usual locations. */
+  tmuxBinary: '',
 };
 
 const NUMERIC = new Set(['stuckLimit', 'missLimit', 'cooldown', 'interval', 'settle', 'keyDelay']);
 
+/** launchd and systemd both want whole seconds, and a fraction breaks the plist. */
+const INTEGER = new Set(['interval', 'stuckLimit', 'missLimit']);
+
 const ENV = {
   CCKEEP_INTERVAL: 'interval',
   CCKEEP_COOLDOWN: 'cooldown',
@@ -25,6 +34,8 @@ const ENV = {
   CCKEEP_SETTLE: 'settle',
   CCKEEP_KEY_DELAY: 'keyDelay',
   CCKEEP_PANE_COMMAND: 'paneCommand',
+  CCKEEP_TMUX_SOCKET: 'tmuxSocket',
+  CCKEEP_TMUX: 'tmuxBinary',
 };
 
 export function configPath() {
@@ -51,9 +62,11 @@ export function loadConfig(overrides = {}) {
   }
 
   const merged = { ...BASE, ...fromFile, ...fromEnv, ...overrides };
+  if (Number(merged.interval) < 1) throw new Error('config: interval must be at least 1 second');
   for (const key of NUMERIC) {
     const value = Number(merged[key]);
     if (!Number.isFinite(value) || value < 0) throw new Error(`config: ${key} must be a non-negative number`);
+    if (INTEGER.has(key) && !Number.isInteger(value)) throw new Error(`config: ${key} must be a whole number`);
     merged[key] = value;
   }
   return merged;

package/src/detect.js

@@ -3,19 +3,55 @@
 // so every rule below is directly testable, which matters a lot for a tool whose
 // failure mode is typing into someone's terminal at the wrong moment.
 
-/** Indicators Claude Code paints in the footer for the Remote Control link. */
-const CONNECTED = '/rc active';
-const RETRYING = '/rc reconnecting';
-const FAILED = /Remote Control disconnected|Remote Control failed|\/rc failed/;
+/**
+ * The Remote Control indicator Claude Code right-aligns in its footer.
+ *
+ * It reads `/rc active`, `/rc reconnecting` or `/rc failed` when there is room
+ * — but it is right-aligned on the status line, so a custom statusline or a
+ * narrow pane truncates it to a bare `/rc`. Matching the full phrase therefore
+ * never fires for anyone with a status line of their own, which is common.
+ *
+ * Anchored to the end of the line because the indicator is right-aligned. A
+ * separator and link may follow it (`/rc active · claude.ai/code`), but prose
+ * may not — that is what keeps `/rc` written mid-sentence from matching.
+ */
+const RC_INDICATOR = /(?:^|\s)\/rc(?:\s+(active|reconnecting|failed))?(?:\s*[\u00b7|].*)?\s*$/;
+
+/** Lines a user types into; they may well contain `/rc` themselves. */
+const INPUT_LINE = /^[❯>]/;
+
+/** The notification Claude Code prints when it has given up for good. */
+const FAILED_NOTICE = /Remote Control disconnected|Remote Control failed/;
 
 /** The /remote-control status panel — its first entry is "Disconnect this session". */
 const PANEL = /Disconnect this session|(?:Show|Hide) QR code/;
 
 /**
- * Anything that turns Enter or a slash command into a selection: permission
- * prompts, pickers, confirmations. Typing into one of these picks an option.
+ * Anything that turns Enter into a selection: permission prompts, pickers,
+ * confirmations. Typing into one of these picks an option.
+ *
+ * Split in two on purpose. A selection marker followed by an option is close to
+ * unambiguous, so it counts anywhere on screen. The bare English phrases are
+ * things Claude Code also writes in ordinary replies ("Do you want me to run
+ * the tests as well?"), and such a sentence sitting in the transcript forever
+ * would hold the pane off forever — so those only count near the composer,
+ * where a real dialog renders.
+ */
+const MODAL_MARKER = /(?:^|\s)(?:❯|›|>)\s*(?:\d+\s*[.)]|Yes\b|No\b)/m;
+const MODAL_PROMPT = /Do you want|Would you like|Allow\b[^\n]{0,40}\?|\(y\/n\)|\[y\/N\]/i;
+
+/** How far up from the composer a dialog can plausibly render. */
+const MODAL_LINES = 20;
+
+/**
+ * The composer, and whether anything is typed in it.
+ *
+ * `send-keys` inserts at the cursor and Enter submits whatever is in the box,
+ * so an unsent draft would be submitted with `/remote-control` glued onto it —
+ * a text injection into the conversation *and* a failed reconnect. The idle
+ * check cannot catch this: a draft sitting in the box is perfectly still.
  */
-const MODAL = /(?:❯|›)\s*(?:\d+\.|Yes|No)|Do you want|\(y\/n\)/;
+const COMPOSER = /^(?:│\s*)?(?:❯|>)\s?(.*?)\s*(?:│)?$/;
 
 /**
  * How many lines from the bottom count as "the footer".
@@ -28,6 +64,13 @@ const MODAL = /(?:❯|›)\s*(?:\d+\.|Yes|No)|Do you want|\(y\/n\)/;
  */
 const FOOTER_LINES = 12;
 
+/**
+ * The indicator sits on the status line, one or two rows from the bottom — a
+ * tighter window than the notifications above it, so that `/rc` typed into the
+ * input box cannot be mistaken for it.
+ */
+const INDICATOR_LINES = 4;
+
 export const DEFAULTS = {
   /** Consecutive checks stuck in "reconnecting" before we treat the bridge as wedged. */
   stuckLimit: 8,
@@ -45,22 +88,63 @@ export function emptyState() {
  * Reduce a captured pane to the handful of signals the rules care about.
  * @param {string} screen raw `tmux capture-pane -p` output
  */
+/**
+ * Read the indicator out of the last few lines.
+ *
+ * Returns 'active' | 'reconnecting' | 'failed', or null when no indicator is on
+ * screen. A truncated `/rc` counts as 'active': the indicator only renders while
+ * a link exists, and reading it as connected merely records the pane and waits,
+ * which is the safe direction.
+ */
+/**
+ * 'empty' | 'draft' | 'unknown'. Unknown means we could not find the composer,
+ * which is treated like a draft: if we cannot see the box, we do not type.
+ */
+function readComposer(lines, window = INDICATOR_LINES + 4) {
+  for (const line of lines.slice(Math.max(0, lines.length - window)).reverse()) {
+    const m = line.match(COMPOSER);
+    if (m) return m[1].trim() === '' ? 'empty' : 'draft';
+  }
+  return 'unknown';
+}
+
+function readIndicator(lines, window = INDICATOR_LINES) {
+  for (const line of lines.slice(Math.max(0, lines.length - window))) {
+    if (INPUT_LINE.test(line.trim())) continue;
+    const m = line.match(RC_INDICATOR);
+    if (m) return m[1] ?? 'active';
+  }
+  return null;
+}
+
 export function readScreen(screen, footerLines = FOOTER_LINES) {
-  const lines = String(screen).split('\n');
+  // `capture-pane` returns the whole pane, blank rows included, so a UI that
+  // does not fill the pane leaves the bottom padded with empty lines. Scanning
+  // the last N lines would then scan nothing but padding and see no indicator
+  // at all — a silent failure. Measure the footer from the last row that has
+  // something on it.
+  const all = String(screen).split('\n');
+  let end = all.length;
+  while (end > 0 && all[end - 1].trim() === '') end -= 1;
+  const lines = all.slice(0, end);
+
   const footer = lines.slice(Math.max(0, lines.length - footerLines)).join('\n');
+  const modalWindow = lines.slice(Math.max(0, lines.length - MODAL_LINES)).join('\n');
+  const indicator = readIndicator(lines);
 
   return {
     // Signals that make cckeep act are read from the footer only, so text in
     // the conversation cannot trigger anything.
-    connected: footer.includes(CONNECTED),
-    retrying: footer.includes(RETRYING),
-    failed: FAILED.test(footer),
-
-    // Signals that make cckeep hold off are read from the whole pane. A false
-    // positive here costs a skipped pass; missing one costs a keystroke in the
-    // wrong place.
-    panel: PANEL.test(screen),
-    modal: MODAL.test(screen),
+    connected: indicator === 'active',
+    retrying: indicator === 'reconnecting',
+    failed: indicator === 'failed' || FAILED_NOTICE.test(footer),
+
+    // Signals that make cckeep hold off. A false positive here costs a skipped
+    // pass; missing one costs a keystroke in the wrong place.
+    panel: PANEL.test(footer),
+    modal: MODAL_MARKER.test(lines.join('\n')) || MODAL_PROMPT.test(modalWindow),
+
+    composer: readComposer(lines),
   };
 }
 
@@ -90,7 +174,9 @@ export function decide({ screen, state = emptyState(), now = 0, config = {} }) {
   // panel to read the QR code.
   if (next.panelPending) {
     next.panelPending = false;
-    if (s.panel && !s.modal) {
+    // Same rules as any other keystroke: not into a dialog, and not on top of
+    // something the user has typed.
+    if (s.panel && !s.modal && s.composer === 'empty') {
       next.lastActionAt = 0; // let the next pass re-arm without waiting out the cooldown
       return { action: 'confirm-panel', reason: 'stuck-cycle', state: next };
     }
@@ -105,6 +191,20 @@ export function decide({ screen, state = emptyState(), now = 0, config = {} }) {
     return { action: 'none', reason: 'connected', state: next };
   }
 
+  // Held off before any counter moves. Doing this after the counters were
+  // consumed meant a dialog — or a sentence merely worded like one, or panel
+  // text cckeep itself had left in the scrollback — reset the progress every
+  // pass, so the pane could never mature into a recovery at all.
+  if (s.modal || s.panel) {
+    return { action: 'none', reason: 'dialog', state: next };
+  }
+
+  // Enter submits whatever sits in the composer, so an unsent draft would go
+  // out with the command glued to it.
+  if (s.composer !== 'empty') {
+    return { action: 'none', reason: 'composer-busy', state: next };
+  }
+
   let dead = null;
 
   if (s.retrying) {
@@ -137,10 +237,6 @@ export function decide({ screen, state = emptyState(), now = 0, config = {} }) {
     }
   }
 
-  if (s.modal || s.panel) {
-    return { action: 'none', reason: 'dialog', state: next };
-  }
-
   if (state.lastActionAt && now - state.lastActionAt < cfg.cooldown) {
     return { action: 'none', reason: 'cooldown', state: next };
   }

package/src/i18n.js

@@ -3,7 +3,6 @@ const en = {
   noServer: 'No tmux server is running — nothing to watch.',
   noPanes: 'No tmux pane is running Claude Code.',
   hintOutside: 'Claude Code started outside tmux cannot be reached: there is no way to type into it from another process.',
-  header: 'pane          state          detail',
   connected: 'connected',
   retrying: 'retrying',
   waiting: 'no indicator',
@@ -11,6 +10,7 @@ const en = {
   dialog: 'dialog open',
   cooldown: 'cooling down',
   busy: 'busy',
+  composerBusy: 'something typed in the box',
   recovered: 'recovered',
   rearmed: 're-armed',
   confirmed: 'bridge cycled',
@@ -23,7 +23,7 @@ const en = {
   unsupported: 'Automatic scheduling supports macOS (launchd) and Linux (systemd user timers). Elsewhere, run `cckeep watch` under your own supervisor.',
   ephemeral: (p) => `Refusing to schedule: this copy of cckeep lives in npm's throwaway npx cache\n  ${p}\nA scheduled job pointing there stops working the moment the cache is cleared — silently. Install it properly first:\n\n  npm install -g cckeep && cckeep enable\n`,
   scheduledPath: 'scheduled cmd',
-  scheduledMissing: 'MISSING — run `cckeep install` again',
+  scheduledMissing: 'MISSING — run `cckeep enable` again',
   noLog: 'No log yet.',
   doctorOk: 'ok',
   doctorFail: 'missing',
@@ -34,7 +34,6 @@ const ja = {
   noServer: 'tmux が起動していないので、監視するものがありません。',
   noPanes: 'Claude Code が動いている tmux ペインが見つかりません。',
   hintOutside: 'tmux の外で起動した Claude Code には手が出せません。外のプロセスから入力を送る経路がないためです。',
-  header: 'ペイン        状態           詳細',
   connected: '接続中',
   retrying: '再試行中',
   waiting: '表示なし',
@@ -42,6 +41,7 @@ const ja = {
   dialog: 'ダイアログが開いている',
   cooldown: '待機中(連打防止)',
   busy: '実行中のためスキップ',
+  composerBusy: '入力欄に文字があるため見送り',
   recovered: '自力で復帰',
   rearmed: '繋ぎ直しました',
   confirmed: '接続を張り直しました',

package/src/run.js

@@ -1,10 +1,24 @@
 import { decide, readScreen } from './detect.js';
 import { parsePsTable, isTargetPane } from './procs.js';
 import * as realTmux from './tmux.js';
-import { loadState, saveState, forPane, prune, appendLog } from './state.js';
+import { loadState, saveState, forPane, prune, appendLog, acquireLock, releaseLock } from './state.js';
 
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 
+/**
+ * What to put back when a send is called off at the last moment. The counters
+ * had already matured to reach this point; discarding them would make the pane
+ * start its wait from scratch every time it happened to be busy.
+ */
+function abortedCounters(before) {
+  return {
+    lastActionAt: before.lastActionAt,
+    panelPending: before.panelPending,
+    miss: before.miss,
+    stuck: before.stuck,
+  };
+}
+
 /**
  * Is the pane quiet enough to type into?
  *
@@ -14,10 +28,14 @@ const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
  * status-line wording.
  */
 export async function isIdle(tmux, paneId, settle) {
+  // Three samples, not two: with two, any animation whose period divides the
+  // interval aliases to identical frames and a running turn reads as idle.
   const a = tmux.capture(paneId);
   await sleep(settle);
   const b = tmux.capture(paneId);
-  return a.length > 0 && a === b;
+  if (a.length === 0 || a !== b) return false;
+  await sleep(Math.round(settle / 2));
+  return tmux.capture(paneId) === b;
 }
 
 /**
@@ -32,6 +50,8 @@ export async function runPass({ tmux = realTmux, config, dryRun = false, now = M
   if (!tmux.hasServer()) return { results, acted: 0, error: 'no-server' };
 
   const panes = tmux.listPanes();
+  if (panes === null) return { results, acted: 0, error: 'query-failed' };
+  if (!dryRun && !acquireLock()) return { results, acted: 0, error: 'busy-elsewhere' };
   const procs = parsePsTable(tmux.processTable ? tmux.processTable() : '');
   const state = loadState();
   let acted = 0;
@@ -59,42 +79,47 @@ export async function runPass({ tmux = realTmux, config, dryRun = false, now = M
       continue;
     }
 
-    if (action === 'confirm-panel') {
-      tmux.sendEnter(pane.id);
-      appendLog(`${pane.label}: closing wedged bridge via panel`);
-      acted += 1;
-      results.push(result);
-      continue;
-    }
-
-    // action === 'rearm'. The decision was made from a single capture; make
-    // sure nothing has started running in the meantime before typing.
+    // Both actions type into the pane, so both go through the same checks: the
+    // decision came from one capture, and anything could have happened since.
     if (!(await isIdle(tmux, pane.id, config.settle))) {
       result.action = 'none';
       result.reason = 'busy';
-      state[pane.id] = { ...after, lastActionAt: before.lastActionAt, panelPending: before.panelPending };
+      state[pane.id] = { ...after, ...abortedCounters(before) };
       results.push(result);
       continue;
     }
 
-    // Re-read: the pane may have reconnected or opened a dialog while we waited.
+    // Re-read: the pane may have reconnected, opened a dialog, or had something
+    // typed into it while we waited.
     const recheck = readScreen(tmux.capture(pane.id));
-    if (recheck.connected || recheck.modal || recheck.panel) {
+    const stillSafe =
+      action === 'confirm-panel'
+        ? recheck.panel && !recheck.modal && recheck.composer === 'empty'
+        : !recheck.connected && !recheck.modal && !recheck.panel && recheck.composer === 'empty';
+    if (!stillSafe) {
       result.action = 'none';
-      result.reason = recheck.connected ? 'recovered' : 'dialog';
-      state[pane.id] = { ...after, lastActionAt: before.lastActionAt, panelPending: before.panelPending };
+      result.reason = recheck.connected ? 'recovered' : recheck.composer !== 'empty' ? 'composer-busy' : 'dialog';
+      state[pane.id] = { ...after, ...abortedCounters(before) };
       results.push(result);
       continue;
     }
 
-    tmux.sendText(pane.id, '/remote-control');
-    await sleep(config.keyDelay ?? 1000);
-    tmux.sendEnter(pane.id);
-    appendLog(`${pane.label}: re-arming Remote Control (${reason})`);
+    if (action === 'confirm-panel') {
+      tmux.sendEnter(pane.id);
+      appendLog(`${pane.label}: closing wedged bridge via panel`);
+    } else {
+      tmux.sendText(pane.id, '/remote-control');
+      await sleep(config.keyDelay ?? 1000);
+      tmux.sendEnter(pane.id);
+      appendLog(`${pane.label}: re-arming Remote Control (${reason})`);
+    }
     acted += 1;
     results.push(result);
   }
 
-  if (!dryRun) saveState(prune(state, panes.map((p) => p.id)));
+  if (!dryRun) {
+    saveState(prune(state, panes.map((p) => p.id)));
+    releaseLock();
+  }
   return { results, acted };
 }

package/src/scheduler.js

@@ -2,6 +2,7 @@ import { execFileSync } from 'node:child_process';
 import { mkdirSync, writeFileSync, readFileSync, existsSync, unlinkSync } from 'node:fs';
 import { homedir, platform } from 'node:os';
 import { join } from 'node:path';
+import { logPath } from './state.js';
 import { fileURLToPath } from 'node:url';
 
 export const LABEL = 'io.github.kamihork.cckeep';
@@ -24,6 +25,28 @@ function nodePath() {
   return process.execPath;
 }
 
+/** The plist is XML, so anything interpolated into it has to be escaped. */
+function xml(value) {
+  return String(value)
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;');
+}
+
+/**
+ * Environment the scheduled job needs but would not otherwise inherit. A
+ * scheduled run starts from launchd's or systemd's environment, not the shell
+ * you typed `enable` in, so a socket or tmux path set there is simply gone —
+ * and the job then watches the wrong server, forever, in silence.
+ */
+function inheritedEnv() {
+  const keep = {};
+  for (const key of ['CCKEEP_HOME', 'CCKEEP_TMUX_SOCKET', 'CCKEEP_TMUX']) {
+    if (process.env[key]) keep[key] = process.env[key];
+  }
+  return keep;
+}
+
 export function plistPath() {
   return join(homedir(), 'Library', 'LaunchAgents', `${LABEL}.plist`);
 }
@@ -32,9 +55,17 @@ export function systemdDir() {
   return join(process.env.XDG_CONFIG_HOME || join(homedir(), '.config'), 'systemd', 'user');
 }
 
-export function renderPlist({ interval, node = nodePath(), cli = cliPath(), home }) {
-  const env = home
-    ? `    <key>EnvironmentVariables</key>\n    <dict>\n        <key>CCKEEP_HOME</key>\n        <string>${home}</string>\n    </dict>\n`
+export function renderPlist({ interval, node = nodePath(), cli = cliPath(), env = {}, log }) {
+  const entries = Object.entries(env).filter(([, v]) => v);
+  const envBlock = entries.length
+    ? `    <key>EnvironmentVariables</key>\n    <dict>\n${entries
+        .map(([k, v]) => `        <key>${xml(k)}</key>\n        <string>${xml(v)}</string>`)
+        .join('\n')}\n    </dict>\n`
+    : '';
+  // Without these, everything a scheduled run reports — a bad config, a
+  // missing tmux — goes to /dev/null and the failure is invisible.
+  const logBlock = log
+    ? `    <key>StandardOutPath</key>\n    <string>${xml(log)}</string>\n    <key>StandardErrorPath</key>\n    <string>${xml(log)}</string>\n`
     : '';
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -44,28 +75,35 @@ export function renderPlist({ interval, node = nodePath(), cli = cliPath(), home
     <string>${LABEL}</string>
     <key>ProgramArguments</key>
     <array>
-        <string>${node}</string>
-        <string>${cli}</string>
+        <string>${xml(node)}</string>
+        <string>${xml(cli)}</string>
         <string>once</string>
     </array>
     <key>StartInterval</key>
-    <integer>${interval}</integer>
+    <integer>${Math.max(1, Math.round(interval))}</integer>
     <key>RunAtLoad</key>
     <true/>
     <key>ProcessType</key>
     <string>Background</string>
-${env}</dict>
+${envBlock}${logBlock}</dict>
 </plist>
 `;
 }
 
-export function renderSystemdService({ node = nodePath(), cli = cliPath() }) {
+export function renderSystemdService({ node = nodePath(), cli = cliPath(), env = {} } = {}) {
+  // systemd splits ExecStart on whitespace and reads % as a specifier, so the
+  // paths are quoted and % is escaped.
+  const arg = (v) => `"${String(v).replace(/%/g, '%%').replace(/"/g, '\\"')}"`;
+  const envLines = Object.entries(env)
+    .filter(([, v]) => v)
+    .map(([k, v]) => `Environment=${k}=${String(v).replace(/%/g, '%%')}`)
+    .join('\n');
   return `[Unit]
 Description=cckeep — keep Claude Code Remote Control alive
 
 [Service]
 Type=oneshot
-ExecStart=${node} ${cli} once
+${envLines}${envLines ? '\n' : ''}ExecStart=${arg(node)} ${arg(cli)} once
 `;
 }
 
@@ -100,7 +138,7 @@ export function install({ interval }) {
   if (os === 'darwin') {
     const p = plistPath();
     mkdirSync(join(homedir(), 'Library', 'LaunchAgents'), { recursive: true });
-    writeFileSync(p, renderPlist({ interval, home: process.env.CCKEEP_HOME }));
+    writeFileSync(p, renderPlist({ interval, env: inheritedEnv(), log: logPath() }));
     const uid = process.getuid();
     run('launchctl', ['bootout', `gui/${uid}/${LABEL}`]);
     const ok = run('launchctl', ['bootstrap', `gui/${uid}`, p]);
@@ -109,9 +147,12 @@ export function install({ interval }) {
   if (os === 'linux') {
     const dir = systemdDir();
     mkdirSync(dir, { recursive: true });
-    writeFileSync(join(dir, 'cckeep.service'), renderSystemdService({}));
+    writeFileSync(join(dir, 'cckeep.service'), renderSystemdService({ env: inheritedEnv() }));
     writeFileSync(join(dir, 'cckeep.timer'), renderSystemdTimer({ interval }));
     run('systemctl', ['--user', 'daemon-reload']);
+    // Without lingering the user manager stops at logout and the timer dies
+    // with it — silently, on exactly the remote boxes this matters most on.
+    run('loginctl', ['enable-linger', process.env.USER ?? '']);
     const ok = run('systemctl', ['--user', 'enable', '--now', 'cckeep.timer']);
     return { kind: 'systemd', path: dir, ok };
   }
@@ -158,7 +199,9 @@ export function scheduledCli() {
       const p = plistPath();
       if (!existsSync(p)) return null;
       const xml = readFileSync(p, 'utf8');
-      const args = [...xml.matchAll(/<string>([^<]*)<\/string>/g)].map((m) => m[1]);
+      const args = [...xml.matchAll(/<string>([^<]*)<\/string>/g)].map((m) =>
+        m[1].replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&amp;/g, '&'),
+      );
       return args.find((a) => a.endsWith('cckeep.js')) ?? null;
     }
     if (os === 'linux') {
@@ -166,7 +209,11 @@ export function scheduledCli() {
       if (!existsSync(p)) return null;
       const unit = readFileSync(p, 'utf8');
       const line = unit.match(/^ExecStart=(.*)$/m)?.[1] ?? '';
-      return line.split(/\s+/).find((a) => a.endsWith('cckeep.js')) ?? null;
+      // Paths are quoted, so read the quoted words rather than splitting on
+      // whitespace — a path with a space used to come back mangled.
+      const quoted = [...line.matchAll(/"([^"]*)"/g)].map((m) => m[1].replace(/%%/g, '%'));
+      const words = quoted.length ? quoted : line.split(/\s+/);
+      return words.find((a) => a.endsWith('cckeep.js')) ?? null;
     }
   } catch {}
   return null;

package/src/state.js

@@ -1,4 +1,4 @@
-import { mkdirSync, readFileSync, writeFileSync, existsSync } from 'node:fs';
+import { mkdirSync, readFileSync, writeFileSync, renameSync, rmSync, statSync, existsSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join, dirname } from 'node:path';
 import { emptyState } from './detect.js';
@@ -31,7 +31,41 @@ export function loadState() {
 export function saveState(state) {
   const p = statePath();
   mkdirSync(dirname(p), { recursive: true });
-  writeFileSync(p, JSON.stringify(state, null, 2));
+  // Write then rename, so a concurrent reader never sees a half-written file
+  // and falls back to an empty state — which would lose every `seen` flag.
+  const tmp = `${p}.${process.pid}.tmp`;
+  writeFileSync(tmp, JSON.stringify(state, null, 2));
+  renameSync(tmp, p);
+}
+
+/**
+ * One pass at a time. `cckeep watch` in a terminal alongside the scheduled job
+ * is an easy thing to end up with, and two passes acting on the same pane
+ * interleave into a single garbled prompt — the cooldown cannot help, because
+ * both read the state before either writes it.
+ */
+export function acquireLock(staleAfterMs = 120000) {
+  const p = join(homeDir(), 'cckeep.lock');
+  mkdirSync(dirname(p), { recursive: true });
+  try {
+    writeFileSync(p, String(process.pid), { flag: 'wx' });
+    return true;
+  } catch {
+    try {
+      if (Date.now() - statSync(p).mtimeMs > staleAfterMs) {
+        rmSync(p, { force: true });
+        writeFileSync(p, String(process.pid), { flag: 'wx' });
+        return true;
+      }
+    } catch {}
+    return false;
+  }
+}
+
+export function releaseLock() {
+  try {
+    rmSync(join(homeDir(), 'cckeep.lock'), { force: true });
+  } catch {}
 }
 
 export function forPane(state, paneId) {

package/src/tmux.js

@@ -15,8 +15,37 @@ const CANDIDATES = [
 
 let cached;
 
+/**
+ * tmux runs one server per socket. Anyone using `tmux -L name` or `-S path` has
+ * their panes on a different server, and without this cckeep silently watches
+ * the wrong one — it reports "no panes" while the sessions are right there.
+ * It also makes cckeep testable against a throwaway server instead of the one
+ * holding your real conversations.
+ */
+export function socketArgs(socketOverride) {
+  // `||` rather than `??`: the config default is an empty string, and an empty
+  // string must fall through to the environment instead of shadowing it.
+  const socket = socketOverride || process.env.CCKEEP_TMUX_SOCKET;
+  if (!socket) return [];
+  return socket.includes('/') ? ['-S', socket] : ['-L', socket];
+}
+
+/**
+ * Settings that reach tmux from the config file rather than the environment.
+ * Set once from the CLI after the config is loaded, because every call site
+ * below is deep inside a pass and threading them through would touch every
+ * signature for no gain.
+ */
+let configured = { socket: '', binary: '' };
+
+export function configureTmux({ socket = '', binary = '' } = {}) {
+  configured = { socket, binary };
+  cached = binary && existsSync(binary) ? binary : undefined;
+}
+
 export function tmuxPath() {
   if (cached) return cached;
+  if (configured.binary && existsSync(configured.binary)) return (cached = configured.binary);
   const fromEnv = process.env.CCKEEP_TMUX;
   if (fromEnv && existsSync(fromEnv)) return (cached = fromEnv);
   for (const p of CANDIDATES) if (existsSync(p)) return (cached = p);
@@ -31,7 +60,7 @@ function tmux(args, { allowFail = true } = {}) {
   const bin = tmuxPath();
   if (!bin) return null;
   try {
-    return execFileSync(bin, args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
+    return execFileSync(bin, [...socketArgs(configured.socket), ...args], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
   } catch (err) {
     if (allowFail) return null;
     throw err;
@@ -43,9 +72,17 @@ export function hasServer() {
 }
 
 /** Every pane on the server, with the process currently in the foreground. */
+/**
+ * Every pane on the server, or null if tmux could not be asked.
+ *
+ * The distinction matters: an empty array used to also mean "the query failed",
+ * and the caller pruned its state to match — wiping every pane it had ever seen
+ * connected, which no pane can re-earn while it is disconnected.
+ */
 export function listPanes() {
   const out = tmux(['list-panes', '-a', '-F', '#{pane_id}\t#{pane_current_command}\t#{session_name}\t#{window_index}\t#{pane_index}\t#{pane_pid}']);
-  if (!out) return [];
+  if (out === null) return null;
+  if (!out.trim()) return [];
   return out
     .split('\n')
     .filter(Boolean)