commandmate 0.29.2 → 0.30.0

package/dist/server/src/lib/realtime/types.js

@@ -9,8 +9,9 @@
  * the canonical {@link RealtimeEvent}.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.VERSION_MISMATCH_EVENT_TYPE = exports.CLIENT_VERSION_MESSAGE_TYPE = void 0;
+exports.MESSAGES_INVALIDATED_EVENT_TYPE = exports.MAX_CHAT_TURN_PROGRESS_BODY_LENGTH = exports.CHAT_TURN_PROGRESS_MIN_INTERVAL_MS = exports.CHAT_TURN_PROGRESS_EVENT_TYPE = exports.VERSION_MISMATCH_EVENT_TYPE = exports.CLIENT_VERSION_MESSAGE_TYPE = void 0;
 exports.isVersionMismatch = isVersionMismatch;
+exports.truncateChatTurnProgressBody = truncateChatTurnProgressBody;
 exports.parseRealtimeEvent = parseRealtimeEvent;
 /**
  * Client → server hello carrying the client bundle version, sent on every
@@ -38,6 +39,100 @@ function isVersionMismatch(serverVersion, clientVersion) {
         return false;
     return serverVersion !== clientVersion;
 }
+/**
+ * The body of the turn that is being generated **right now** (Issue #2199).
+ *
+ * The chat surface has no partial assistant text of its own: a reply reaches
+ * `chat_messages` only once the turn is over, so a long turn leaves the surface
+ * saying "Responding…" for minutes while the terminal surface next to it is
+ * filling up. This frame is that missing text, and everything about its shape
+ * follows from one decision — **it is never persisted**.
+ *
+ * Not persisted means the row this becomes is written by somebody else: the
+ * existing `message` broadcast, from `sources/<tool>/history`, whose `requestId`
+ * is exactly {@link ChatTurnProgressEvent.turnKey}. So a client replaces the
+ * progress body with the confirmed row by matching that one string, and a
+ * missed frame costs a moment of staleness rather than a lost reply. It is also
+ * why there is no replay on reconnect and no `done: true` member: the settled
+ * state of a turn is a `chat_messages` row, and this event has nothing to say
+ * about it.
+ *
+ * `version` is monotonic per (worktreeId, cliToolId, instanceId) — the same
+ * discipline {@link TerminalSnapshotEvent} carries, and for a sharper reason
+ * here: opencode's SSE re-sends its boundary frames, so a client that trusted
+ * arrival order would redraw an older body over a newer one.
+ */
+exports.CHAT_TURN_PROGRESS_EVENT_TYPE = 'chat_turn_progress';
+/**
+ * Smallest gap between two progress frames for one instance.
+ *
+ * The producers are a 2 s poller tick (claude) and an SSE part stream that
+ * measured 88 delta frames for a single 967-character paragraph (opencode), so
+ * the second one needs a brake and the first one does not. One brake for both,
+ * because the expensive half of the claude path — a 4 MiB tail read and a parse
+ * — happens *behind* this gate too, and a surface polled over HTTP at ~1 s
+ * would otherwise pay for it on every request.
+ */
+exports.CHAT_TURN_PROGRESS_MIN_INTERVAL_MS = 1000;
+/**
+ * Longest body one progress frame carries, in UTF-16 code units.
+ *
+ * Two orders of magnitude below `MAX_CLAUDE_TURN_BODY_LENGTH` /
+ * `MAX_OPENCODE_TURN_BODY_LENGTH`, which bound the body that gets *saved*. This
+ * one is re-sent every second while a turn runs, so its cost is per frame
+ * rather than per turn.
+ */
+exports.MAX_CHAT_TURN_PROGRESS_BODY_LENGTH = 64 * 1024;
+/**
+ * Cut an over-long progress body, **keeping the tail**.
+ *
+ * The head is what goes, and that is the opposite of what the two turn writers
+ * do. They are recording a reply and the reply reads from the top; this is
+ * showing a reply being written, and the interesting end is the one the model
+ * is still adding to. A reader who needs the head has the terminal surface and,
+ * a moment later, the settled row.
+ *
+ * The cut is reported rather than hidden — see `partial` on
+ * {@link ChatTurnProgressEvent}. Silently showing the middle of a reply as if it
+ * were the whole of one is the failure this signature exists to prevent.
+ */
+function truncateChatTurnProgressBody(body, maxLength = exports.MAX_CHAT_TURN_PROGRESS_BODY_LENGTH) {
+    if (maxLength <= 0)
+        return { body: '', truncated: body.length > 0 };
+    if (body.length <= maxLength)
+        return { body, truncated: false };
+    return { body: body.slice(body.length - maxLength), truncated: true };
+}
+/**
+ * "This instance's history changed in a way no row-level frame can express —
+ * re-read it" (Issue #2219).
+ *
+ * The one mutation that has no row to publish is a **delete**:
+ * `sendUserMessage` removes the previous, identical user row after the retry is
+ * persisted (#379's duplicate guard), and `message` / `message_updated` can only
+ * ever say "this row now looks like this". A second device therefore kept the
+ * deleted row until its own poll came round — 15s while a socket is up, since
+ * #2195 demoted that poll to a fallback — showing the same sentence twice.
+ *
+ * It carries a **scope, not a payload**, and that is the whole design:
+ *
+ *  - the receiver re-fetches, so it lands on the DB's settled state rather than
+ *    on a diff it has to merge — a `message` frame that was dropped on the way
+ *    is repaired by the same round trip;
+ *  - the re-fetch bumps `useSplitMessages`' request id, which retires any fetch
+ *    that started *before* the delete and would otherwise resolve with the row
+ *    still in it;
+ *  - no tombstone has to be kept anywhere, and `archived` — which means "a
+ *    previous session's history" — keeps meaning only that.
+ *
+ * The cost is one extra GET per orphan cleanup, on an event that fires only when
+ * someone re-sends the exact text of their last unanswered message.
+ *
+ * {@link instanceId} is always resolved (`instanceId ?? cliToolId`), like
+ * {@link TerminalSnapshotEvent}'s: a client matches it against its own pane and
+ * an omitted field would simply never match.
+ */
+exports.MESSAGES_INVALIDATED_EVENT_TYPE = 'messages_invalidated';
 /**
  * Parse a raw WebSocket frame into the inner realtime event.
  *

package/dist/server/src/lib/session/current-output-builder.js

@@ -7,18 +7,55 @@
  * over WebSocket (terminal streaming), keeping the pull (HTTP) and push (WS)
  * paths byte-for-byte consistent (DRY).
  */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.mergeStructuredStatus = mergeStructuredStatus;
 exports.buildCurrentOutput = buildCurrentOutput;
+exports.resetChatTurnProgressState = resetChatTurnProgressState;
+exports.buildChatTurnProgress = buildChatTurnProgress;
+exports.emitChatTurnProgress = emitChatTurnProgress;
 const db_1 = require("../../lib/db");
 const unclassified_frame_tracker_1 = require("../../lib/detection/unclassified-frame-tracker");
 const composer_text_1 = require("../../lib/detection/composer-text");
 const upstream_faults_1 = require("../../lib/detection/upstream-faults");
 const opencode_pane_obstruction_1 = require("../../lib/detection/opencode-pane-obstruction");
+const types_1 = require("../../lib/realtime/types");
 const models_1 = require("../../types/models");
 const logger_1 = require("../../lib/logger");
 const manager_1 = require("../../lib/cli-tools/manager");
-const types_1 = require("../../lib/cli-tools/types");
+const types_2 = require("../../lib/cli-tools/types");
 const registry_1 = require("../../lib/hooks/sources/registry");
 const define_source_1 = require("../../lib/hooks/sources/define-source");
 const subscription_1 = require("../../lib/hooks/sources/opencode/subscription");
@@ -93,6 +130,44 @@ function describePaneObstruction(obstruction) {
         `${JSON.stringify(obstruction.matchedText)}), which covers the marker that ends a ` +
         `turn. Press \`${opencode_pane_obstruction_1.OPENCODE_SIDEBAR_RECOVERY_CHORD}\` in the pane to close it.`);
 }
+/**
+ * Push a history row this module just wrote to the worktree room (Issue #2214).
+ *
+ * Always `'message'`: both callers INSERT a brand-new row, so nothing has been
+ * delivered for it before and the client appends rather than replaces.
+ *
+ * Detached on purpose, and for two reasons that both matter here:
+ *
+ *  - the `ws-server` import stays dynamic, which is the same bargain
+ *    {@link emitChatTurnProgress} strikes — this module's *other* callers (the
+ *    `/current-output` route and the terminal push) must not pull the WebSocket
+ *    server into their graph just by building a payload;
+ *  - the row is already committed when this runs, so a socket write can never
+ *    turn a written row into a failed one. The two record functions below are
+ *    best-effort by contract and their callers are waiting on a payload.
+ *
+ * #2214 recorded a limitation here — a route bundle holding its own empty copy
+ * of `ws-server`'s `rooms` under `next dev` — and added that "production runs
+ * one custom-server bundle and is unaffected". **That last clause was wrong.**
+ * `npm run dev` and `npm start` run the *same* custom server (`tsx server.ts`
+ * vs `node dist/server/server.js`); what differs is only whether Next evaluates
+ * a route handler from a dev compilation or from `.next/server`. Either way the
+ * route handler's copy of this module and of `ws-server` is not the custom
+ * server's, so this push was silent in production too. #2220 bridged it: the
+ * `broadcastMessage` below now reaches the socket owner through
+ * `lib/realtime/publisher-registry` regardless of which graph called it.
+ */
+function broadcastRecordedRow(worktreeId, message) {
+    void Promise.resolve().then(() => __importStar(require('../../lib/ws-server'))).then(({ broadcastMessage }) => {
+        broadcastMessage('message', { worktreeId, message });
+    })
+        .catch((error) => {
+        logger.warn('history-row-broadcast-failed', {
+            worktreeId,
+            error: error instanceof Error ? error.message : String(error),
+        });
+    });
+}
 function recordUnclassifiedFrame(db, params) {
     const dwellSeconds = Math.round(params.dwellMs / 1000);
     const statusReason = `${params.sessionStatus}/${params.sessionStatusReason}`;
@@ -114,7 +189,7 @@ function recordUnclassifiedFrame(db, params) {
         sessionStatusReason: statusReason,
     };
     try {
-        (0, db_1.createMessage)(db, {
+        const message = (0, db_1.createMessage)(db, {
             worktreeId: params.worktreeId,
             role: 'assistant',
             content: question,
@@ -133,6 +208,10 @@ function recordUnclassifiedFrame(db, params) {
             dwellSeconds,
             statusReason,
         });
+        // `cliToolId` / `instanceId` are already the explicit values passed above —
+        // `createMessage` hands back the caller's own object — so the published row
+        // addresses the same instance the column does.
+        broadcastRecordedRow(params.worktreeId, message);
     }
     catch (error) {
         logger.warn('unclassified-frame-record-failed', {
@@ -166,7 +245,7 @@ function recordUnclassifiedFrame(db, params) {
 function recordStructuredPrompt(db, params) {
     const record = (0, structured_prompt_1.buildStructuredPromptHistoryRecord)(params.worktreeId, params.facts);
     try {
-        (0, db_1.createMessage)(db, {
+        const message = (0, db_1.createMessage)(db, {
             worktreeId: params.worktreeId,
             role: 'assistant',
             content: record.question,
@@ -187,6 +266,7 @@ function recordStructuredPrompt(db, params) {
             source: params.state.source,
             toolName: params.state.toolName,
         });
+        broadcastRecordedRow(params.worktreeId, message);
     }
     catch (error) {
         logger.warn('structured-prompt-record-failed', {
@@ -371,6 +451,17 @@ function hookClosedTurn(turn) {
  */
 async function buildCurrentOutput(db, worktreeId, cliToolId, instanceId, resolution) {
     const payload = await buildPayload(db, worktreeId, cliToolId, instanceId);
+    // Issue #2199. Fire-and-forget, and placed HERE rather than in the poller for
+    // one reason: this is the function both live paths run through. The WebSocket
+    // push calls it from `broadcastTerminalSnapshot` on every generating poller
+    // tick, and the HTTP `/current-output` poll calls it at the same cadence when
+    // the push is down — so the progress frames appear at whatever rate the
+    // surface is actually being watched at, which is exactly the property the
+    // terminal snapshot already has. Gated on the merged verdict (`'running'`, not
+    // the tmux-session-exists `isRunning`) so an idle pane reads no transcript.
+    if (payload.isRunning && payload.sessionStatus === 'running') {
+        void publishChatTurnProgress(db, worktreeId, cliToolId, instanceId);
+    }
     if (!resolution)
         return payload;
     return {
@@ -573,7 +664,7 @@ async function buildPayload(db, worktreeId, cliToolId, instanceId) {
     // value is the pane height, `slice()` starts past the last row, and `content`
     // — the field `commandmate capture <id>` prints — was an empty string.
     // `capturedLineCountIsCursor` states both conditions in one place.
-    const lineCountIsCursor = (0, types_1.capturedLineCountIsCursor)(cliToolId, captureWindowSaturated);
+    const lineCountIsCursor = (0, types_2.capturedLineCountIsCursor)(cliToolId, captureWindowSaturated);
     const newLines = lineCountIsCursor ? lines.slice(Math.max(0, lastCapturedLine)) : lines;
     const newContent = newLines.join('\n');
     const compositeKey = (0, auto_yes_manager_1.buildCompositeKey)(worktreeId, cliToolId, instanceId);
@@ -946,3 +1037,171 @@ async function buildPayload(db, worktreeId, cliToolId, instanceId) {
         composerState: composer.state,
     };
 }
+/**
+ * On `globalThis` for the reason every shared map in this subsystem is (#1736):
+ * under `next dev` the poller's bundle and the opencode subscription's bundle
+ * would each get a private copy, and two producers throttling against two
+ * different maps is no throttle at all.
+ */
+const chatTurnProgressState = (globalThis.__chatTurnProgressState ??= new Map());
+function chatTurnProgressKey(target) {
+    return `${target.worktreeId}:${target.cliToolId}:${target.instanceId ?? target.cliToolId}`;
+}
+/** Forget every instance's progress bookkeeping. Test seam. */
+function resetChatTurnProgressState() {
+    chatTurnProgressState.clear();
+}
+/**
+ * Decide whether this instance has a new progress frame, and build it.
+ *
+ * The single generator both tools go through, on the same argument
+ * {@link buildCurrentOutput} makes for the terminal payload: two producers of one
+ * wire shape drift, and the drift is invisible because each of them is
+ * individually correct. Three rules, in this order, and each of them is a way
+ * this feature goes wrong if it is missing:
+ *
+ *  1. **Throttle.** At most one *ask* per {@link CHAT_TURN_PROGRESS_MIN_INTERVAL_MS}
+ *     per instance. It gates the ask rather than the send because the source is
+ *     the expensive half (see {@link ChatTurnProgressSource}); a gate on the send
+ *     alone would re-read a 4 MiB transcript to discover it had not changed.
+ *  2. **No-change suppression.** Same turn, same body → no frame. A reply that
+ *     has stopped growing must not keep waking every subscribed browser.
+ *  3. **Monotonic version**, per instance and NOT per turn. A client drops
+ *     anything at or below what it has already rendered, and restarting the
+ *     counter on a new turn would make the first frame of turn N+1 look stale
+ *     against the last frame of turn N.
+ *
+ * The body is bounded by {@link truncateChatTurnProgressBody}, whose cut is
+ * folded into `partial` together with the reader's own — see
+ * {@link ChatTurnProgressEvent.partial} for why one flag answers both.
+ *
+ * Never throws: a source that throws is a turn with nothing to show, not a
+ * broken poll tick.
+ *
+ * @param target - The instance
+ * @param source - Asked only when the throttle allows it
+ * @param now - Epoch ms; injected by the tests
+ * @returns The frame to broadcast, or null when there is nothing new to say
+ */
+async function buildChatTurnProgress(target, source, now = Date.now()) {
+    const key = chatTurnProgressKey(target);
+    const state = chatTurnProgressState.get(key) ?? {
+        version: 0,
+        askedAt: Number.NEGATIVE_INFINITY,
+        turnKey: null,
+        body: null,
+    };
+    if (now - state.askedAt < types_1.CHAT_TURN_PROGRESS_MIN_INTERVAL_MS)
+        return null;
+    state.askedAt = now;
+    chatTurnProgressState.set(key, state);
+    let draft;
+    try {
+        draft = await source();
+    }
+    catch {
+        // The readers already promise never to throw; this is the belt for the
+        // dynamic import that reaches them.
+        return null;
+    }
+    if (!draft || draft.body.length === 0)
+        return null;
+    const bounded = (0, types_1.truncateChatTurnProgressBody)(draft.body);
+    if (draft.turnKey === state.turnKey && bounded.body === state.body)
+        return null;
+    state.turnKey = draft.turnKey;
+    state.body = bounded.body;
+    state.version += 1;
+    return {
+        type: types_1.CHAT_TURN_PROGRESS_EVENT_TYPE,
+        worktreeId: target.worktreeId,
+        cliToolId: target.cliToolId,
+        instanceId: target.instanceId ?? target.cliToolId,
+        turnKey: draft.turnKey,
+        body: bounded.body,
+        partial: bounded.truncated || draft.partial === true,
+        version: state.version,
+        done: false,
+    };
+}
+/**
+ * Build a progress frame and push it to the worktree room.
+ *
+ * Subscribers are checked FIRST, before the throttle state is touched and long
+ * before the source is asked, so a session nobody is watching costs one map
+ * lookup per tick — the same bargain `broadcastTerminalSnapshot` strikes, and
+ * the reason a 4 MiB transcript read does not happen for every claude session on
+ * the machine.
+ *
+ * The `ws-server` import is dynamic so this module's *other* callers — the
+ * `/current-output` route and `commandmate capture` — do not pull the WebSocket
+ * server into their graph just by building a payload.
+ *
+ * Never throws; a failed push is a moment of staleness on a surface that has the
+ * settled row coming anyway.
+ *
+ * @returns Whether a frame was broadcast
+ */
+async function emitChatTurnProgress(target, source, now = Date.now()) {
+    try {
+        const { broadcast, hasRoomSubscribers } = await Promise.resolve().then(() => __importStar(require('../../lib/ws-server')));
+        if (!hasRoomSubscribers(target.worktreeId))
+            return false;
+        const event = await buildChatTurnProgress(target, source, now);
+        if (!event)
+            return false;
+        broadcast(target.worktreeId, event);
+        return true;
+    }
+    catch (error) {
+        logger.debug('chat-turn-progress-failed', {
+            worktreeId: target.worktreeId,
+            cliToolId: target.cliToolId,
+            instanceId: target.instanceId ?? target.cliToolId,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return false;
+    }
+}
+/**
+ * Ask the tool that has a transcript for the body of its open turn (Issue #2199).
+ *
+ * claude only, and that is a statement about which tools have a *pull* reader
+ * rather than a list to extend by hand. opencode's body arrives on its own SSE
+ * stream and is published from `sources/opencode/history` at the moment a part
+ * lands — polling for it here would be a second producer of the same frames.
+ * codex and antigravity have neither, and stay on the indicator (#2197 / #2198).
+ *
+ * The reader is imported dynamically so `sources/claude/history` — and through
+ * it `fs/promises`, the session-pointer latch and `user-turn-recorder` — stays
+ * out of the module graph of the `/current-output` route and of `commandmate
+ * capture`, both of which reach this file for a payload and nothing else.
+ *
+ * Never throws: `emitChatTurnProgress` swallows, and so does this.
+ */
+async function publishChatTurnProgress(db, worktreeId, cliToolId, instanceId) {
+    if (cliToolId !== 'claude')
+        return;
+    try {
+        // The slug the transcript directory is named after is a function of the
+        // worktree's path, so the row is what makes the file findable at all. Read
+        // before the throttle only because it is a single indexed lookup against a
+        // connection this function was handed; everything expensive is behind the
+        // gate.
+        const { getWorktreeById } = await Promise.resolve().then(() => __importStar(require('../../lib/db/worktree-db')));
+        const worktreePath = getWorktreeById(db, worktreeId)?.path;
+        if (!worktreePath)
+            return;
+        await emitChatTurnProgress({ worktreeId, cliToolId, instanceId }, async () => {
+            const { readClaudeTurnProgress } = await Promise.resolve().then(() => __importStar(require('../../lib/hooks/sources/claude/history')));
+            return readClaudeTurnProgress({ worktreeId, cliToolId, instanceId: instanceId ?? cliToolId }, { worktreePath });
+        });
+    }
+    catch (error) {
+        logger.debug('chat-turn-progress-claude-failed', {
+            worktreeId,
+            instanceId: instanceId ?? cliToolId,
+            error: error instanceof Error ? error.message : String(error),
+        });
+    }
+}

package/dist/server/src/lib/session/send-user-message.js

@@ -14,7 +14,13 @@
  *   3. copilot /model command        — Issue #576 (copilot only)
  *   4. send to CLI tool              — image branch / ICLITool.sendMessage
  *   5. createMessage (role: 'user')  — INSERT INTO chat_messages (History source)
+ *   5b. broadcastMessage('message')  — Issue #2195, push the user row to every
+ *                                      open pane (the send that produced it is
+ *                                      not necessarily on this device)
  *   6. orphan deletion               — remove prior duplicate after persist
+ *   6b. broadcastMessage(              — Issue #2219, tell every open pane for
+ *         'messages_invalidated')        this instance to re-read its history:
+ *                                        a delete has no row to publish
  *   7. updateLastUserMessage
  *   8. clearInProgressMessageId
  *   9. startPolling                  — record the assistant response afterwards
@@ -30,6 +36,8 @@ const manager_1 = require("../../lib/cli-tools/manager");
 const types_1 = require("../../lib/cli-tools/types");
 const response_poller_1 = require("../../lib/polling/response-poller");
 const assistant_response_saver_1 = require("../../lib/assistant-response-saver");
+const ws_server_1 = require("../../lib/ws-server");
+const types_2 = require("../../lib/realtime/types");
 const logger_1 = require("../../lib/logger");
 const prompt_waiting_guard_1 = require("../../lib/session/prompt-waiting-guard");
 const opencode_1 = require("../../lib/cli-tools/opencode");
@@ -47,6 +55,14 @@ function getErrorMessage(error) {
 async function sendUserMessage(db, params) {
     const { worktreeId, content, cliToolId, instanceId, absoluteImagePath, copilotModel } = params;
     const messageType = params.messageType ?? 'normal';
+    /**
+     * The instance this send belongs to, resolved the way `createMessage` and
+     * `mapChatMessage` resolve it (Issue #868: the primary instance's id *is* the
+     * tool's id). Callers omit `instanceId` for the primary instance — the UI and
+     * the send API both do — so every scope decision below has to resolve it
+     * first or it is not scoped at all.
+     */
+    const resolvedInstanceId = instanceId ?? cliToolId;
     const cliTool = manager_1.CLIToolManager.getInstance().getTool(cliToolId);
     // Issue #1708: refuse before the first side effect. A prompt dialog does not
     // forward keystrokes to the agent — they accumulate in its own input line — so
@@ -94,12 +110,31 @@ async function sendUserMessage(db, params) {
         logger.error('failed-to-save-pending-assistant-response:', { error: getErrorMessage(error) });
     }
     // 2. Clean up orphaned user messages (Issue #379: duplicate message prevention).
-    // If the most recent message for this cliToolId is a user message with the same
+    // If the most recent message for THIS INSTANCE is a user message with the same
     // content, the assistant never responded and the user is retrying. Remove it
     // (only after the retry message is persisted) to prevent duplicates.
+    //
+    // Issue #2219: the scope is `resolvedInstanceId`, not the caller's raw
+    // `instanceId`. `getMessages` filters on the instance *or* the tool, never
+    // both, so passing an omitted `instanceId` through fell back to the tool
+    // filter and made this search read the newest row of **every instance of that
+    // tool**. A primary-instance re-send whose text matched `claude-2`'s last user
+    // row therefore deleted a row belonging to another session — data loss, not a
+    // display delay, and invisible because the delete is best-effort and silent.
+    //
+    // `matchResolvedInstance` is what makes the fix safe rather than merely
+    // narrow: a bare `instance_id = ?` would hide every pre-#868 row (they carry
+    // NULL and read back as the primary instance), so the orphan they are would
+    // survive as a visible duplicate. Same expression as #2196's
+    // `findUnkeyedUserMessages`.
     let orphanedMessageIdToDelete = null;
     try {
-        const recentMessages = (0, db_1.getMessages)(db, worktreeId, { limit: 1, cliToolId, instanceId });
+        const recentMessages = (0, db_1.getMessages)(db, worktreeId, {
+            limit: 1,
+            cliToolId,
+            instanceId: resolvedInstanceId,
+            matchResolvedInstance: true,
+        });
         if (recentMessages.length > 0 &&
             recentMessages[0].role === 'user' &&
             recentMessages[0].content === content) {
@@ -169,6 +204,31 @@ async function sendUserMessage(db, params) {
         cliToolId,
         instanceId,
     });
+    // 5b. Broadcast the user row (Issue #2195).
+    //
+    // Every other history writer already does this; this one did not, so a second
+    // device (or a second pane on the same device) saw a message it did not send
+    // only on its next poll — and #2195 stretches that poll to 15s while a socket
+    // is up, which would have made the omission three times as visible.
+    //
+    // `createMessage` hands back the caller's own object rather than re-reading
+    // the row, so `instanceId` here would be `undefined` whenever the caller
+    // omitted it. It is resolved to the primary instance (=== cliToolId) exactly
+    // as `createMessage` resolves it for the column, so the client's
+    // (worktreeId, cliToolId, instanceId) match cannot miss.
+    //
+    // Wrapped because the message is already sent and already persisted by this
+    // point: a socket write that throws must not turn a successful send into a
+    // failure the caller reports to the user.
+    try {
+        (0, ws_server_1.broadcastMessage)('message', {
+            worktreeId,
+            message: { ...message, cliToolId, instanceId: resolvedInstanceId },
+        });
+    }
+    catch (error) {
+        logger.warn('user-message-broadcast-failed', { error: getErrorMessage(error) });
+    }
     // 6. Remove the prior orphan only after the retry message is persisted.
     // This avoids data loss if send/create fails partway through.
     if (orphanedMessageIdToDelete) {
@@ -176,6 +236,34 @@ async function sendUserMessage(db, params) {
             const deleted = (0, db_1.deleteMessageById)(db, orphanedMessageIdToDelete);
             if (deleted) {
                 logger.info('cleaned-up-orphaned-user');
+                // 6b. Issue #2219: publish the delete.
+                //
+                // The `message` frame above told every pane about the row that was
+                // added; nothing told them about the row that went away, because the
+                // event contract has no shape for a deletion — `message_updated` can
+                // only say what a row now looks like. A second device therefore kept
+                // showing the old copy next to the new one until its own poll, which
+                // #2195 demoted to a 15s fallback while a socket is up.
+                //
+                // A scope rather than an id: the receiver re-reads its history, so it
+                // lands on the settled DB state and a `message` frame that was dropped
+                // on the way is repaired by the same round trip. See
+                // MESSAGES_INVALIDATED_EVENT_TYPE.
+                //
+                // Wrapped separately from the delete: the row is already gone by now,
+                // and #379's cleanup has always been best-effort — a socket write that
+                // throws must not turn a completed send into a reported failure.
+                try {
+                    (0, ws_server_1.broadcastMessage)(types_2.MESSAGES_INVALIDATED_EVENT_TYPE, {
+                        worktreeId,
+                        cliToolId,
+                        instanceId: resolvedInstanceId,
+                        reason: 'orphan_cleanup',
+                    });
+                }
+                catch (error) {
+                    logger.warn('orphan-cleanup-broadcast-failed', { error: getErrorMessage(error) });
+                }
             }
         }
         catch (error) {

package/dist/server/src/lib/tui-accumulator.js

@@ -26,14 +26,8 @@ const cli_patterns_1 = require("./detection/cli-patterns");
  * fingerprint for overlap detection with the next capture.
  */
 const OVERLAP_FINGERPRINT_SIZE = 10;
-/**
- * Per-session TUI response accumulator storage.
- * Key: pollerKey ("worktreeId:cliToolId")
- *
- * Module-scope variable (not globalThis). Node.js module cache ensures
- * singleton behavior. See D3-004 in design policy for details.
- */
-const tuiResponseAccumulator = new Map();
+const tuiResponseAccumulator = globalThis.__tuiResponseAccumulator ??
+    (globalThis.__tuiResponseAccumulator = new Map());
 /**
  * Normalize a single OpenCode TUI line by removing ANSI codes and border glyphs.
  * Returns an empty string when the line has no meaningful content after cleanup.