commandmate 0.46.0 → 0.47.0

package/dist/server/src/lib/polling/response-poller-core.js

@@ -9,13 +9,17 @@ exports.stopPolling = stopPolling;
 exports.stopAllPolling = stopAllPolling;
 exports.getActivePollers = getActivePollers;
 exports.migrateResponsePollerWorktreeIds = migrateResponsePollerWorktreeIds;
-const async_hooks_1 = require("async_hooks");
 const logger_1 = require("../../lib/logger");
 const tui_accumulator_1 = require("../tui-accumulator");
 const prompt_dedup_1 = require("./prompt-dedup");
 const response_dedup_1 = require("./response-dedup");
 const prompt_dedup_state_1 = require("./prompt-dedup-state");
 const response_checker_1 = require("./response-checker");
+// Issue #3663: the migration's own entry points into the held-scrape store,
+// imported from the store itself rather than through `./response-checker`'s
+// re-export (suites that replace the checker by path keep working unchanged).
+const pending_scraped_response_1 = require("./pending-scraped-response");
+const poller_owner_1 = require("./poller-owner");
 const terminal_broadcast_1 = require("../../lib/realtime/terminal-broadcast");
 const terminal_session_ownership_1 = require("../../lib/realtime/terminal-session-ownership");
 const session_name_1 = require("../../lib/cli-tools/session-name");
@@ -58,7 +62,7 @@ const coordinator = (0, global_state_1.getOrInitGlobal)('__responsePollerCoordin
     owners: new Map(),
     running: new Map(),
     pendingRestart: new Map(),
-    ownerStorage: new async_hooks_1.AsyncLocalStorage(),
+    latestOwners: new Map(),
     generationCounter: 0,
     pausedOnPrompt: new Set(),
 }));
@@ -68,6 +72,7 @@ const coordinator = (0, global_state_1.getOrInitGlobal)('__responsePollerCoordin
 // `globalThis` across HMR, and a poller started before the reload would
 // otherwise crash the first tick after it.
 coordinator.pausedOnPrompt ??= new Set();
+coordinator.latestOwners ??= new Map();
 /**
  * Active pollers map: "worktreeId:instanceId" -> NodeJS.Timeout
  *
@@ -101,11 +106,17 @@ exports.pollingStartTimes = coordinator.pollingStartTimes;
  * @param instanceId - Optional agent instance ID (defaults to cliToolId)
  */
 function getPollerKey(worktreeId, cliToolId, instanceId) {
-    return `${worktreeId}:${instanceId ?? cliToolId}`;
+    // Issue #3705: spelled in `./poller-owner`, so the writers that ask whether a
+    // tick may still act for this key name it the same way without importing here.
+    return (0, poller_owner_1.pollerKeyOf)(worktreeId, cliToolId, instanceId);
 }
 /** Hand `pollerKey` to a brand-new chain, retiring whichever chain held it. */
 function takeOwnership(pollerKey) {
-    const previous = coordinator.owners.get(pollerKey);
+    // Issue #3705: the newest chain the key ever had, not only the one holding it
+    // now. A chain that was stopped (a route, a migration that displaced it) has
+    // left `owners`, but a tick of it may still be in flight, and it has a
+    // successor from this moment on.
+    const previous = coordinator.owners.get(pollerKey) ?? coordinator.latestOwners.get(pollerKey);
     if (previous)
         previous.superseded = true;
     const owner = {
@@ -116,6 +127,7 @@ function takeOwnership(pollerKey) {
         selfStopped: false,
     };
     coordinator.owners.set(pollerKey, owner);
+    coordinator.latestOwners.set(pollerKey, owner);
     return owner;
 }
 /**
@@ -171,7 +183,7 @@ function startPolling(worktreeId, cliToolId, instanceId) {
         // previous turn.
         inFlight.owner.superseded = true;
         if (Date.now() - inFlight.since < exports.STALLED_TICK_TIMEOUT) {
-            coordinator.pendingRestart.set(pollerKey, target);
+            coordinator.pendingRestart.set(pollerKey, { target, behind: inFlight.owner });
             return;
         }
         logger.warn('poller:restart-past-stalled-tick', {
@@ -293,7 +305,11 @@ async function runPollTick(target, owner) {
         // Check for response
         let recorded = false;
         try {
-            recorded = await coordinator.ownerStorage.run(owner, () => (0, response_checker_1.checkForResponse)(target.worktreeId, target.cliToolId, target.instanceId));
+            // The token rides through `checkForResponse()` (`./poller-owner`), so a
+            // `stopPolling()` raised inside a superseded tick can be told apart from
+            // one raised by a route, `session-cleanup` or `kill-session` (#2223), and
+            // the held-scrape store can turn away a tick that was retired (#3663).
+            recorded = await poller_owner_1.pollerOwnerStorage.run(owner, () => (0, response_checker_1.checkForResponse)(target.worktreeId, target.cliToolId, target.instanceId));
         }
         catch (error) {
             logger.error('error:', { error: error instanceof Error ? error.message : String(error) });
@@ -310,8 +326,14 @@ async function runPollTick(target, owner) {
         // Issue #2223: skipped once another chain owns the key — a superseded tick
         // would push the previous turn's screen on top of the live one, and its
         // `version` counter would make the client drop the real frame that follows.
+        //
+        // Issue #3705: and the snapshot carries the owner explicitly
+        // (`snapshotOwnerStorage`), because this is only where it starts. Its
+        // capture and the writers inside `buildCurrentOutput` resume after awaits,
+        // and they ask again then (`maySnapshotPublish`): a successor that took the
+        // key in the meantime is not overwritten by the turn that ended.
         if (!owner.superseded) {
-            void (0, terminal_broadcast_1.broadcastTerminalSnapshot)(target.worktreeId, target.cliToolId, target.instanceId);
+            void poller_owner_1.snapshotOwnerStorage.run(owner, () => (0, terminal_broadcast_1.broadcastTerminalSnapshot)(target.worktreeId, target.cliToolId, target.instanceId));
         }
         // Schedule next poll ONLY after current one completes
         // Guard: only if THIS chain is still the poller for the key (Issue #2223)
@@ -326,10 +348,15 @@ async function runPollTick(target, owner) {
         // Apply a restart that arrived while this tick was in flight. Doing it here
         // rather than in startPolling() is what keeps the old and new chains from
         // polling the same pane at the same time.
+        //
+        // Issue #3705: only the restart handed to THIS tick. One queued behind a
+        // later chain's tick belongs to that tick: applied here, by a tick that was
+        // cut loose past STALLED_TICK_TIMEOUT and came back, it would stop the chain
+        // whose tick is still running and start the next one beside it.
         const pending = coordinator.pendingRestart.get(pollerKey);
-        if (pending) {
+        if (pending && pending.behind === owner) {
             coordinator.pendingRestart.delete(pollerKey);
-            restartChain(pollerKey, pending);
+            restartChain(pollerKey, pending.target);
         }
     }
 }
@@ -391,7 +418,7 @@ function stopPollingByKey(pollerKey, options = {}) {
     // (worktree gone, session not running, prompt detected, TUI reply saved).
     // Honouring that verdict would kill the chain that replaced it — the old
     // tick is describing a turn that is already over.
-    const caller = coordinator.ownerStorage.getStore();
+    const caller = poller_owner_1.pollerOwnerStorage.getStore();
     if (caller && caller.pollerKey === pollerKey && (caller.superseded || caller.stopped)) {
         logger.info('poller:stale-stop-ignored', {
             pollerKey,
@@ -506,54 +533,18 @@ function splitPollerKey(pollerKey) {
         instanceId: pollerKey.slice(separatorIndex + 1),
     };
 }
-/**
- * Move every running response poller from a renamed worktree ID to the new one
- * (Issue #1621 Phase 3).
- *
- * Re-keying the maps alone is **not** enough, and this is the subtle part: the
- * `setTimeout` chain in {@link scheduleNextResponsePoll} closes over
- * `worktreeId` and recomputes its key on every tick. A poller left running
- * would go on capturing `mcbd-<cli>-<OLD id>` (a session that no longer exists
- * after the rename), writing its messages against an ID no row carries, and
- * re-registering the old key the moment it fired. So each poller is torn down
- * and restarted under the new ID — ownership token included (Issue #2223), so a
- * tick already inside `checkForResponse()` cannot come back and act on the old
- * ID — with everything that represents *progress* carried across:
- *
- * - `pollingStartTimes`, so MAX_POLLING_DURATION still measures from when the
- *   turn actually began rather than restarting the 30-minute budget;
- * - the prompt and response dedup hashes, so the screen currently on display is
- *   not saved a second time as a new message, together with the prompt-skip
- *   tally that explains those suppressions to `capture --json` (Issue #1695).
- *
- * The TUI accumulator (opencode / copilot only) is re-initialised empty at the
- * new key instead of carried over: `tui-accumulator.ts` exposes no way to write
- * a buffer back, and it is outside this Issue's allowed scope. The cost is that
- * one in-flight TUI response may be truncated at the rename boundary; the next
- * turn accumulates normally.
- *
- * Takes the whole batch because IDs can swap (A→B, B→A) or chain (A→B→C):
- * every source key is removed before any destination key is written. That
- * includes the dedup state (Issue #3553) — of running pollers and paused chains
- * alike — which is lifted off every source key in one pass and only then
- * written, so a pair handled early cannot overwrite a source handled later.
- *
- * @param renames - Worktree ID pairs being applied
- * @param resolveCliToolId - Maps a poller's (worktree, instance) back to its CLI
- *   tool, which the poller key does not encode for alias instances. Callers pass
- *   a roster-backed lookup; returning null skips that poller (it is stopped
- *   rather than left pointing at a dead ID).
- * @returns One entry per poller that was moved
- */
-function migrateResponsePollerWorktreeIds(renames, resolveCliToolId) {
+/** Old worktree ID -> new worktree ID, skipping empty and no-op pairs. */
+function collectRenameTargets(renames) {
     const targets = new Map();
     for (const { oldId, newId } of renames) {
         if (!oldId || !newId || oldId === newId)
             continue;
         targets.set(oldId, newId);
     }
-    if (targets.size === 0)
-        return [];
+    return targets;
+}
+/** Sort every running poller under a renamed ID into a move or an abandoned stop. */
+function planRunningPollerMoves(targets, resolveCliToolId) {
     const moves = [];
     const abandoned = [];
     for (const pollerKey of Array.from(exports.activePollers.keys())) {
@@ -565,7 +556,7 @@ function migrateResponsePollerWorktreeIds(renames, resolveCliToolId) {
             continue;
         const cliToolId = resolveCliToolId(parts.worktreeId, parts.instanceId);
         if (!cliToolId) {
-            abandoned.push(pollerKey);
+            abandoned.push({ pollerKey, newWorktreeId });
             continue;
         }
         moves.push({
@@ -576,9 +567,10 @@ function migrateResponsePollerWorktreeIds(renames, resolveCliToolId) {
             instanceId: parts.instanceId,
         });
     }
-    // Phase 1: stop every affected timer and lift the state off the old keys.
-    // Done for the whole batch before any write so a swap cannot self-collide.
-    const carried = new Map();
+    return { moves, abandoned };
+}
+/** Phase 1 of the migration for the moved pollers (see the caller). */
+function liftMovedPollers(moves, carried) {
     for (const move of moves) {
         const timerId = exports.activePollers.get(move.oldKey);
         if (timerId)
@@ -601,6 +593,145 @@ function migrateResponsePollerWorktreeIds(renames, resolveCliToolId) {
         exports.pollingStartTimes.delete(move.oldKey);
         (0, tui_accumulator_1.clearTuiAccumulator)(move.oldKey);
     }
+}
+/** The paused chains under a renamed ID, keyed old -> new (see the caller). */
+function collectPausedMoves(targets) {
+    const pausedMoves = [];
+    for (const pollerKey of Array.from(coordinator.pausedOnPrompt)) {
+        const parts = splitPollerKey(pollerKey);
+        if (!parts)
+            continue;
+        const newWorktreeId = targets.get(parts.worktreeId);
+        if (!newWorktreeId)
+            continue;
+        pausedMoves.push({ oldKey: pollerKey, newKey: `${newWorktreeId}:${parts.instanceId}` });
+    }
+    return pausedMoves;
+}
+/** The held scrapes under a renamed ID, keyed old -> new (see the caller). */
+function collectPendingMoves(targets, abandonedKeys) {
+    const pendingMoves = [];
+    for (const pollerKey of (0, pending_scraped_response_1.listPendingScrapedResponseKeys)()) {
+        if (abandonedKeys.has(pollerKey))
+            continue;
+        const parts = splitPollerKey(pollerKey);
+        if (!parts)
+            continue;
+        const newWorktreeId = targets.get(parts.worktreeId);
+        if (!newWorktreeId)
+            continue;
+        pendingMoves.push({ oldKey: pollerKey, newKey: `${newWorktreeId}:${parts.instanceId}`, newWorktreeId });
+    }
+    return pendingMoves;
+}
+/** Stop the chains on destinations that no source vacates (see the caller). */
+function stopDisplacedPollers(moves, pausedMoves, pendingMoves, abandonedKeys) {
+    const vacated = new Set([
+        ...moves.map((move) => move.oldKey),
+        ...pausedMoves.map((move) => move.oldKey),
+        ...pendingMoves.map((move) => move.oldKey),
+    ]);
+    // A held scrape moved on its own (no chain, no pause) changes the key's
+    // owner just the same, so its destination is handled alike (#3663 review).
+    const occupied = new Set([
+        ...moves.map((move) => move.newKey),
+        ...pausedMoves.map((move) => move.newKey),
+        ...pendingMoves.map((move) => move.newKey),
+    ]);
+    for (const pollerKey of occupied) {
+        if (vacated.has(pollerKey) || abandonedKeys.has(pollerKey))
+            continue;
+        const held = coordinator.owners.has(pollerKey) ||
+            exports.activePollers.has(pollerKey) ||
+            coordinator.pausedOnPrompt.has(pollerKey) ||
+            (0, pending_scraped_response_1.hasPendingScrapedResponse)(pollerKey);
+        if (!held)
+            continue;
+        stopPollingByKey(pollerKey);
+        logger.warn('poller:migrate-displaced', { pollerKey });
+    }
+}
+/** Phase 2 of the migration: restart each moved poller (see the caller). */
+function restartMovedPollers(moves, carried) {
+    for (const move of moves) {
+        const startedAt = carried.get(move.newKey)?.startedAt;
+        exports.pollingStartTimes.set(move.newKey, startedAt ?? Date.now());
+        if (isFullScreenTui(move.cliToolId)) {
+            (0, tui_accumulator_1.initTuiAccumulator)(move.newKey);
+        }
+        scheduleNextResponsePoll(move.newWorktreeId, move.cliToolId, move.instanceId);
+    }
+}
+/**
+ * Move every running response poller from a renamed worktree ID to the new one
+ * (Issue #1621 Phase 3).
+ *
+ * Re-keying the maps alone is **not** enough, and this is the subtle part: the
+ * `setTimeout` chain in {@link scheduleNextResponsePoll} closes over
+ * `worktreeId` and recomputes its key on every tick. A poller left running
+ * would go on capturing `mcbd-<cli>-<OLD id>` (a session that no longer exists
+ * after the rename), writing its messages against an ID no row carries, and
+ * re-registering the old key the moment it fired. So each poller is torn down
+ * and restarted under the new ID — ownership token included (Issue #2223), so a
+ * tick already inside `checkForResponse()` cannot come back and act on the old
+ * ID — with everything that represents *progress* carried across:
+ *
+ * - `pollingStartTimes`, so MAX_POLLING_DURATION still measures from when the
+ *   turn actually began rather than restarting the 30-minute budget;
+ * - the prompt and response dedup hashes, so the screen currently on display is
+ *   not saved a second time as a new message, together with the prompt-skip
+ *   tally that explains those suppressions to `capture --json` (Issue #1695).
+ *
+ * The TUI accumulator (opencode / copilot only) is re-initialised empty at the
+ * new key instead of carried over: `tui-accumulator.ts` exposes no way to write
+ * a buffer back, and it is outside this Issue's allowed scope. The cost is that
+ * one in-flight TUI response may be truncated at the rename boundary; the next
+ * turn accumulates normally.
+ *
+ * Takes the whole batch because IDs can swap (A→B, B→A) or chain (A→B→C):
+ * every source key is removed before any destination key is written. That
+ * includes the dedup state (Issue #3553) — of running pollers and paused chains
+ * alike — which is lifted off every source key in one pass and only then
+ * written, so a pair handled early cannot overwrite a source handled later.
+ *
+ * Issue #3663: the held scrapes (#2436) move too, by the same lift-then-place
+ * rule, keeping everything but their worktree ID, which becomes the new one.
+ * Every chain whose key changes hands is retired (`stopped`), so a tick still
+ * awaiting the transcript reader cannot come back and hold, drop or write
+ * under it: the moved chains' old owners, and a chain already running on a
+ * destination key that no source vacates — that one is stopped like any
+ * other, which writes its held scrape under the ID it carries before the moved
+ * one arrives. A chain that cannot be resolved has its held scrape written
+ * under the NEW ID: the old one is gone from the table, and a row for it fails
+ * the foreign key and is lost. A chain with a tick running at the moment of
+ * the migration does not hand its response hash on (see the dedup move below).
+ *
+ * @param renames - Worktree ID pairs being applied
+ * @param resolveCliToolId - Maps a poller's (worktree, instance) back to its CLI
+ *   tool, which the poller key does not encode for alias instances. Callers pass
+ *   a roster-backed lookup; returning null skips that poller (it is stopped
+ *   rather than left pointing at a dead ID).
+ * @returns One entry per poller that was moved
+ */
+function migrateResponsePollerWorktreeIds(renames, resolveCliToolId) {
+    const targets = collectRenameTargets(renames);
+    if (targets.size === 0)
+        return [];
+    const { moves, abandoned } = planRunningPollerMoves(targets, resolveCliToolId);
+    // Phase 1: stop every affected timer and lift the state off the old keys.
+    // Done for the whole batch before any write so a swap cannot self-collide.
+    const carried = new Map();
+    // Issue #3663: the moves whose chain has a tick running right now — read
+    // before anything below touches the coordinator. See the response hash below.
+    // The chain that holds the key now, not merely some tick under the key: a
+    // chain retired earlier leaves its `running` entry until its own tick
+    // returns (the epilogue removes it by owner), and the chain that replaced it
+    // may not have started a tick yet.
+    const midTick = moves.filter((move) => {
+        const inFlight = coordinator.running.get(move.oldKey);
+        return inFlight !== undefined && inFlight.owner === coordinator.owners.get(move.oldKey);
+    });
+    liftMovedPollers(moves, carried);
     // Stop the abandoned pollers before any dedup state is written: the stop
     // clears every cache under its key, and that key can be the destination of
     // another move in this batch (A:x paused → B:x while B:x is abandoned).
@@ -608,29 +739,56 @@ function migrateResponsePollerWorktreeIds(renames, resolveCliToolId) {
     // An abandoned key is never a move source, so nothing still to be moved is
     // lost here; and the paused chains are collected after it, as before, so a
     // pause the stop ends is not carried.
-    for (const pollerKey of abandoned) {
+    //
+    // Issue #3663: its held scrape is pointed at the new ID first, so the stop
+    // writes it there — the old ID is no longer in the table.
+    for (const { pollerKey, newWorktreeId } of abandoned) {
+        (0, pending_scraped_response_1.retargetPendingScrapedResponse)(pollerKey, newWorktreeId);
         stopPollingByKey(pollerKey);
         logger.warn('poller:migrate-abandoned', { pollerKey });
     }
+    const abandonedKeys = new Set(abandoned.map(({ pollerKey }) => pollerKey));
     // Issue #2230: a chain paused on a prompt has no timer, so the loops here
     // never see it — but it is holding the response hash for the turn it paused
     // on, and `/respond` will resume it under the NEW ID. Move the hash and the
     // pause mark with it; the chain itself stays paused until that resume.
-    const pausedMoves = [];
-    for (const pollerKey of Array.from(coordinator.pausedOnPrompt)) {
-        const parts = splitPollerKey(pollerKey);
-        if (!parts)
-            continue;
-        const newWorktreeId = targets.get(parts.worktreeId);
-        if (!newWorktreeId)
-            continue;
-        pausedMoves.push({ oldKey: pollerKey, newKey: `${newWorktreeId}:${parts.instanceId}` });
-    }
+    const pausedMoves = collectPausedMoves(targets);
+    // Issue #3663: every held scrape under a renamed worktree ID moves — a
+    // running chain's, a paused chain's, and one whose chain is already gone.
+    // The abandoned ones were written above and are no longer held.
+    const pendingMoves = collectPendingMoves(targets, abandonedKeys);
+    // Issue #3663: a destination a chain (running or paused) moves onto, that no
+    // source of this batch vacates, may already be held by another chain — B:x
+    // running while A:x moves to B:x. That chain loses the key, so it is stopped
+    // here like any other stop: its held scrape is written under the ID it
+    // carries (the current one), its owner is retired so its in-flight tick can
+    // no longer hold or drop anything, and its caches are cleared before the
+    // moved state is written. A destination nothing is on is left alone, and so
+    // is every other instance of the destination worktree.
+    stopDisplacedPollers(moves, pausedMoves, pendingMoves, abandonedKeys);
     // Issue #3553: the dedup state of the whole batch moves in one call per map
     // family, each lifting every source before writing any destination. Re-keyed
     // pair by pair, a swap left A with its own state and B empty.
+    //
+    // Issue #3663: except the response hash of a chain whose tick is running.
+    // That tick may have registered the hash of a reply it has not yet saved or
+    // held — it is awaiting the transcript reader, and the hold it comes back
+    // with is refused (its owner is retired above). Handed on, the hash would
+    // make the successor skip a reply nobody wrote. Dropped, the successor judges
+    // the screen itself and holds or saves it. The price, taken knowingly: a
+    // reply that tick HAD already saved may be saved once more by the successor
+    // — a duplicate row rather than a lost one, the trade #2436 makes. Deciding
+    // here, once, replaces marking the hash and taking it back later, whose
+    // lifetime every later move, resume and restart would have to carry.
+    // The prompt hash and the prompt-skip tally move as before.
+    // Dropped on the source key only, before the batch moves: the destination is
+    // left as the batch leaves it, so what another source of a many-to-one move
+    // brings there (a chain that saved its reply and is waiting) still stands.
+    for (const move of midTick)
+        (0, response_dedup_1.clearResponseHashCache)(move.oldKey);
     (0, prompt_dedup_1.renamePromptHashCacheKeys)(moves);
     (0, response_dedup_1.renameResponseHashCacheKeys)([...moves, ...pausedMoves]);
+    (0, pending_scraped_response_1.movePendingScrapedResponses)(pendingMoves);
     // Issue #1695: the prompt hash moved above, so the guard keeps suppressing
     // the prompt on screen under the new ID. Its tally has to move with it, or
     // `capture --json` reports zero skips for a session that is still skipping.
@@ -647,14 +805,7 @@ function migrateResponsePollerWorktreeIds(renames, resolveCliToolId) {
             : [];
     }));
     // Phase 2: restart each poller under its new identity.
-    for (const move of moves) {
-        const startedAt = carried.get(move.newKey)?.startedAt;
-        exports.pollingStartTimes.set(move.newKey, startedAt ?? Date.now());
-        if (isFullScreenTui(move.cliToolId)) {
-            (0, tui_accumulator_1.initTuiAccumulator)(move.newKey);
-        }
-        scheduleNextResponsePoll(move.newWorktreeId, move.cliToolId, move.instanceId);
-    }
+    restartMovedPollers(moves, carried);
     // Issue #2230: the pause marks of the chains collected above follow their
     // hashes (moved with the batch). All removed before any is added, for the
     // same swap reason.

package/dist/server/src/lib/polling/structured-history-gate.js

@@ -84,6 +84,7 @@ const tool_id_4 = require("../../lib/hooks/sources/command-code/tool-id");
 const registry_1 = require("../../lib/hooks/sources/registry");
 const relay_triggers_1 = require("../../lib/relay/relay-triggers");
 const global_state_1 = require("../global-state");
+const poller_owner_1 = require("./poller-owner");
 const logger = (0, logger_1.createLogger)('lib/polling/structured-history-gate');
 /**
  * One in-flight capture per instance (Issue #2246).
@@ -382,7 +383,25 @@ async function captureStructuredHistoryTurn(worktreeId, cliToolId, instanceId, c
             // back. So a provisional capture announces nothing at all; the relay
             // keeps waiting on the deadline it already has, and the settled capture
             // that follows announces the finished body.
-            if (captured && completion === 'settled') {
+            //
+            // Issue #3701: a poller tick retired while it awaited the reader
+            // announces nothing under the key it lost, and claims nothing, so its
+            // successor still announces this completion. Asked by the poller key
+            // (`getPollerKey`'s `worktreeId:instanceId`), not `captureKey`. The
+            // Stop hook runs outside any tick and is never refused. Issue #3705:
+            // what the reader itself writes during the `await` (rows, user rows,
+            // the cursor, agy's follow list) is asked the same question by the
+            // reader, after its own last `await` (`mayReaderWrite`).
+            const pollerKey = (0, poller_owner_1.pollerKeyOf)(worktreeId, cliToolId, resolvedInstanceId);
+            if (captured && completion === 'settled' && !(0, poller_owner_1.mayActForPollerKey)(pollerKey)) {
+                logger.info('structured-history-completion-refused', {
+                    worktreeId,
+                    cliToolId,
+                    instanceId: resolvedInstanceId,
+                    generation: (0, poller_owner_1.currentPollerOwner)()?.generation,
+                });
+            }
+            else if (captured && completion === 'settled') {
                 if (claimCompletionAnnouncement(captureKey, readerReport.completionKey)) {
                     (0, relay_triggers_1.onRelayTurnCompleted)(worktreeId, cliToolId, resolvedInstanceId, true);
                 }

package/dist/server/src/lib/prompt-answer-sender.js

@@ -7,7 +7,7 @@
  * the promptType/defaultOptionNumber fallback introduced in Bug1).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MultiSelectAnswerRejectedError = exports.MULTI_SELECT_NOT_COMMITTED_REASON = exports.FreeTextAtChoiceOnlyPromptError = exports.FreeTextAnswerRejectedError = exports.FREE_TEXT_AT_MENU_ROW_REASON = exports.PromptAnswerRejectedError = exports.ANSWER_MODE_KEYS_REASON = void 0;
+exports.PromptAnswerAbortedError = exports.MultiSelectAnswerRejectedError = exports.MULTI_SELECT_NOT_COMMITTED_REASON = exports.FreeTextAtChoiceOnlyPromptError = exports.FreeTextAnswerRejectedError = exports.FREE_TEXT_AT_MENU_ROW_REASON = exports.PromptAnswerRejectedError = exports.ANSWER_MODE_KEYS_REASON = void 0;
 exports.sendPromptAnswer = sendPromptAnswer;
 const tmux_1 = require("./tmux/tmux");
 const frame_1 = require("../lib/detection/tools/frame");
@@ -665,7 +665,7 @@ async function recaptureAfterKeys(sessionName) {
  * @throws {MultiSelectAnswerRejectedError} whenever the question was not
  *   committed; `keysSent` says whether the pane was touched.
  */
-async function sendCommandCodeMultiSelectAnswer(sessionName, promptData, wanted) {
+async function sendCommandCodeMultiSelectAnswer(sessionName, promptData, wanted, stillCurrent) {
     const cursor = promptData.options.find((option) => option.isDefault === true);
     if (cursor === undefined) {
         throw new MultiSelectAnswerRejectedError('cursor-unknown', false, wanted);
@@ -679,12 +679,13 @@ async function sendCommandCodeMultiSelectAnswer(sessionName, promptData, wanted)
         ...current.filter((n) => !wanted.includes(n)),
     ].sort((a, b) => a - b);
     if (toggles.length > 0) {
-        await (0, tmux_1.sendSpecialKeys)(sessionName, toggles.map(String));
+        await sendSpecialKeysWhileCurrent(sessionName, toggles.map(String), stillCurrent);
     }
     const keysSent = toggles.length > 0;
     // 2. Read the screen back and refuse unless it is the same question with
     //    exactly the requested boxes ticked.
     const afterToggle = await recaptureAfterKeys(sessionName);
+    assertStillCurrent(stillCurrent, keysSent);
     if (afterToggle === null) {
         throw new MultiSelectAnswerRejectedError('recapture-failed', keysSent, wanted);
     }
@@ -711,14 +712,12 @@ async function sendCommandCodeMultiSelectAnswer(sessionName, promptData, wanted)
     if (cursorNow === undefined) {
         throw new MultiSelectAnswerRejectedError('cursor-unknown', keysSent, wanted);
     }
-    await (0, tmux_1.sendSpecialKeys)(sessionName, [
-        ...downKeys(verified.options.length - cursorNow.number + 1),
-        'Enter',
-    ]);
+    await sendSpecialKeysWhileCurrent(sessionName, [...downKeys(verified.options.length - cursorNow.number + 1), 'Enter'], stillCurrent);
     // 4. The second stage. `Submit` opens the Review page and the answer is sent
     //    from there; `Next` advances to the following question, which IS the
     //    commit for this one (its tab turns `✔`).
     const afterConfirm = await recaptureAfterKeys(sessionName);
+    assertStillCurrent(stillCurrent, true);
     if (afterConfirm === null) {
         throw new MultiSelectAnswerRejectedError('recapture-failed', true, wanted);
     }
@@ -729,7 +728,7 @@ async function sendCommandCodeMultiSelectAnswer(sessionName, promptData, wanted)
         if (review.hasUnansweredWarning) {
             throw new MultiSelectAnswerRejectedError('review-unanswered', true, wanted);
         }
-        await (0, tmux_1.sendSpecialKeys)(sessionName, ['Enter']);
+        await sendSpecialKeysWhileCurrent(sessionName, ['Enter'], stillCurrent);
         return;
     }
     const next = (0, dialog_1.readCommandCodeQuestionDialog)(afterConfirm);
@@ -740,6 +739,50 @@ async function sendCommandCodeMultiSelectAnswer(sessionName, promptData, wanted)
         throw new MultiSelectAnswerRejectedError('not-committed', true, wanted);
     }
 }
+/**
+ * The caller's `stillCurrent` said no after one of the send's waits
+ * (Issue #3706): the keys not yet sent were not sent. Keys already typed cannot
+ * be taken back, so {@link keysSent} says whether the pane was touched; either
+ * way the answer was NOT completed and must not be recorded as one.
+ */
+class PromptAnswerAbortedError extends Error {
+    keysSent;
+    constructor(
+    /** Whether any key reached the pane before the stop. */
+    keysSent) {
+        super(`Prompt answer stopped by its caller (${keysSent ? 'some keys were sent' : 'no key was sent'})`);
+        this.keysSent = keysSent;
+        this.name = 'PromptAnswerAbortedError';
+    }
+}
+exports.PromptAnswerAbortedError = PromptAnswerAbortedError;
+/** Stop here when the caller's `stillCurrent` says no (Issue #3706). */
+function assertStillCurrent(stillCurrent, keysSent) {
+    if (stillCurrent && !stillCurrent())
+        throw new PromptAnswerAbortedError(keysSent);
+}
+/**
+ * `sendSpecialKeys`, asking `stillCurrent` between the keys when the caller
+ * gave one (Issue #3706). Without it the call is exactly the old two-argument
+ * one, so manual answers and every other caller send as before.
+ */
+async function sendSpecialKeysWhileCurrent(sessionName, keys, stillCurrent) {
+    if (!stillCurrent) {
+        await (0, tmux_1.sendSpecialKeys)(sessionName, keys);
+        return;
+    }
+    try {
+        await (0, tmux_1.sendSpecialKeys)(sessionName, keys, { shouldContinue: stillCurrent });
+    }
+    catch (error) {
+        // By name rather than `instanceof`: test doubles of `./tmux/tmux` need not
+        // export the class.
+        if (error instanceof Error && error.name === 'SpecialKeysAbortedError') {
+            throw new PromptAnswerAbortedError(true);
+        }
+        throw error;
+    }
+}
 /**
  * Send an answer to a tmux session, using cursor-key navigation for
  * Claude Code / Antigravity multiple-choice prompts and text input for
@@ -750,7 +793,7 @@ async function sendCommandCodeMultiSelectAnswer(sessionName, promptData, wanted)
  * - src/lib/auto-yes-manager.ts (L340-399)
  */
 async function sendPromptAnswer(params) {
-    const { sessionName, answer, cliToolId, promptData, fallbackPromptType, fallbackDefaultOptionNumber } = params;
+    const { sessionName, answer, cliToolId, promptData, fallbackPromptType, fallbackDefaultOptionNumber, stillCurrent } = params;
     // Issue #2755: Command Code's checkbox question, before every guard below.
     // Its answer is a SET (`"1,3"`), which none of them can read — `/^\d+$/` is
     // how all three ask "is this a number?", so a set would be judged as free
@@ -760,7 +803,7 @@ async function sendPromptAnswer(params) {
     // a two-stage confirm, not a digit and an Enter.
     const multiSelect = readMultiSelectRequest(params);
     if (multiSelect !== null) {
-        await sendCommandCodeMultiSelectAnswer(sessionName, multiSelect.promptData, multiSelect.wanted);
+        await sendCommandCodeMultiSelectAnswer(sessionName, multiSelect.promptData, multiSelect.wanted, stillCurrent);
         (0, tmux_capture_cache_1.invalidateCache)(sessionName);
         return;
     }
@@ -781,6 +824,8 @@ async function sendPromptAnswer(params) {
     // the Enter after them confirms that row — so the cursor has to be checked
     // here too, before the branch.
     assertFreeTextCursorIsOnTheField(params);
+    // Issue #3706: the guard above may have read the pane; nothing is typed yet.
+    assertStillCurrent(stillCurrent, false);
     // Determine if this is an arrow-key-navigated multiple-choice prompt.
     // Claude Code and Antigravity (agy) both render selection menus that only
     // respond to cursor navigation + Enter, not to typed option numbers
@@ -829,7 +874,7 @@ async function sendPromptAnswer(params) {
             keys.push(...buildNavigationKeys(downToNext));
             // 4. Enter to submit
             keys.push('Enter');
-            await (0, tmux_1.sendSpecialKeys)(sessionName, keys);
+            await sendSpecialKeysWhileCurrent(sessionName, keys, stillCurrent);
         }
         else {
             // Single-select: navigate and Enter to select
@@ -847,7 +892,7 @@ async function sendPromptAnswer(params) {
             const keys = (isAskUserQuestionPicker && offset === 0)
                 ? ['Down', 'Up', 'Enter']
                 : [...navigationKeys, 'Enter'];
-            await (0, tmux_1.sendSpecialKeys)(sessionName, keys);
+            await sendSpecialKeysWhileCurrent(sessionName, keys, stillCurrent);
         }
     }
     else {
@@ -858,6 +903,8 @@ async function sendPromptAnswer(params) {
         if (!shouldSuppressEnter(params, resolvedSubmitMode, dialog)) {
             // Wait a moment for the input to be processed
             await new Promise(resolve => setTimeout(resolve, cli_tool_timing_config_1.TUI_TEXT_INPUT_WAIT_MS));
+            // Issue #3706: the text is typed; the Enter that submits it is not.
+            assertStillCurrent(stillCurrent, true);
             // Send Enter
             await (0, tmux_1.sendKeys)(sessionName, '', true);
         }