commandmate 0.46.0 → 0.47.0

package/dist/server/src/lib/relay/relay-delivery.js

@@ -57,6 +57,8 @@ const relay_policy_1 = require("../../lib/relay/relay-policy");
 const relay_readiness_1 = require("../../lib/relay/relay-readiness");
 const relay_session_ref_1 = require("../../lib/relay/relay-session-ref");
 const relay_system_line_1 = require("../../lib/relay/relay-system-line");
+const relay_delivery_claims_1 = require("../../lib/relay/relay-delivery-claims");
+const types_1 = require("../../lib/relay/types");
 const logger_1 = require("../../lib/logger");
 const global_state_1 = require("../global-state");
 const logger = (0, logger_1.createLogger)('relay-delivery');
@@ -158,6 +160,7 @@ const inFlight = (0, global_state_1.getOrInitGlobal)('__relayDeliveryInFlight',
 /** Forget every in-flight delivery. Test seam. */
 function resetRelayDeliveryState() {
     inFlight.clear();
+    (0, relay_delivery_claims_1.resetRelayDeliveryClaims)();
     globalThis.__relayPumpRunning = false;
 }
 function senderLabel(db, relay) {
@@ -431,6 +434,13 @@ function notifyRelayPromptWaiting(worker) {
 function sweepExpiredRelays(db, now = Date.now()) {
     let expired = 0;
     for (const relay of (0, relay_db_1.listExpiredOpenRelays)(db, now)) {
+        // A send already under way for this relay cannot be taken back (#3732).
+        // Expiring it now would leave A with both the reply and the expiry notice,
+        // and the delivery's own cleanup would then wipe that notice. The next
+        // sweep finds it closed (delivered) or, if the send was refused, still
+        // open and expires it then.
+        if ((0, relay_delivery_claims_1.isRelayDeliveryClaimed)(relay.id))
+            continue;
         try {
             const locale = (0, model_change_push_notifier_1.resolveReadersLocale)(db);
             // A payload that never went out is superseded by the expiry notice: A
@@ -465,47 +475,83 @@ function sweepExpiredRelays(db, now = Date.now()) {
  * repeat delivery is prevented by the in-flight set within a process and by
  * `markRelayDelivered`'s guarded update across one, which is the idempotency the
  * Issue asks for by name.
+ *
+ * `kind` and `body` are what the pump's listing saw, and that listing is stale
+ * by the time the readiness check returns (#3732): an earlier relay's send, or
+ * this one's own capture, may have let a cancel or an expiry sweep run. So the
+ * row is read again AFTER the last await before the send, and the send goes
+ * ahead only when it still carries the same payload — and, for anything but an
+ * expiry notice, is still open. The claim is taken in that same synchronous
+ * stretch, so no cancel can slip in between the check and the send; from then
+ * on `withdrawRelay` answers `delivering`.
  */
 async function deliverOne(db, relayId, kind, body) {
-    const relay = (0, relay_db_1.getRelayById)(db, relayId);
-    if (!relay)
+    const listed = (0, relay_db_1.getRelayById)(db, relayId);
+    if (!listed)
         return 'skipped';
-    const requester = (0, relay_session_ref_1.resolveRelaySession)(db, relay.from);
-    const hold = await (0, relay_readiness_1.findRelayHoldReason)(requester.worktreeId, requester.cliToolId, requester.instanceId, db);
+    const listedRequester = (0, relay_session_ref_1.resolveRelaySession)(db, listed.from);
+    const hold = await (0, relay_readiness_1.findRelayHoldReason)(listedRequester.worktreeId, listedRequester.cliToolId, listedRequester.instanceId, db);
     if (hold) {
         logger.debug('relay-delivery-held', { relayId, kind, reason: hold });
         return 'held';
     }
-    const result = await (0, send_user_message_1.sendUserMessage)(db, {
-        worktreeId: requester.worktreeId,
-        content: body,
-        cliToolId: requester.cliToolId,
-        instanceId: requester.instanceId,
-        messageType: 'relay',
-        // The pointer back at the ledger. Also `session_relays.sent_request_id` for
-        // a reply, which carries a UNIQUE index — so a second delivery of the same
-        // relay cannot be recorded even if one were somehow attempted.
-        requestId: kind === 'reply' ? (0, chat_db_1.relayRequestId)(relay.id) : undefined,
-    });
-    if (!result.ok) {
-        logger.info('relay-delivery-refused', { relayId, kind, stage: result.stage });
-        return result.stage === 'prompt_waiting' ? 'held' : 'failed';
+    // Synchronous from here to the send: re-read, then claim.
+    const current = findCurrentPayload(db, relayId);
+    if (!current || current.kind !== kind || current.body !== body) {
+        logger.info('relay-delivery-superseded', { relayId, kind });
+        return 'skipped';
+    }
+    // An expiry notice is delivered from a CLOSED relay by design; everything
+    // else is only owed while the relay is open.
+    if (kind !== 'expired' && !(0, types_1.isOpenRelayState)(current.relay.state)) {
+        logger.info('relay-delivery-closed', { relayId, kind, state: current.relay.state });
+        return 'skipped';
     }
-    const now = Date.now();
-    if (kind === 'reply') {
-        if (!(0, relay_db_1.markRelayDelivered)(db, relay.id, (0, chat_db_1.relayRequestId)(relay.id), now)) {
-            // Somebody closed it underneath us. The message is already in A's
-            // composer, which is the outcome that mattered.
-            logger.info('relay-already-closed-on-deliver', { relayId });
+    const relay = current.relay;
+    const requester = (0, relay_session_ref_1.resolveRelaySession)(db, relay.from);
+    (0, relay_delivery_claims_1.claimRelayDelivery)(relayId);
+    try {
+        const result = await (0, send_user_message_1.sendUserMessage)(db, {
+            worktreeId: requester.worktreeId,
+            content: body,
+            cliToolId: requester.cliToolId,
+            instanceId: requester.instanceId,
+            messageType: 'relay',
+            // The pointer back at the ledger. Also `session_relays.sent_request_id` for
+            // a reply, which carries a UNIQUE index — so a second delivery of the same
+            // relay cannot be recorded even if one were somehow attempted.
+            requestId: kind === 'reply' ? (0, chat_db_1.relayRequestId)(relay.id) : undefined,
+        });
+        if (!result.ok) {
+            logger.info('relay-delivery-refused', { relayId, kind, stage: result.stage });
+            return result.stage === 'prompt_waiting' ? 'held' : 'failed';
+        }
+        const now = Date.now();
+        if (kind === 'reply') {
+            if (!(0, relay_db_1.markRelayDelivered)(db, relay.id, (0, chat_db_1.relayRequestId)(relay.id), now)) {
+                // Somebody closed it underneath us. The message is already in A's
+                // composer, which is the outcome that mattered.
+                logger.info('relay-already-closed-on-deliver', { relayId });
+            }
+            (0, relay_system_line_1.writeRelaySystemLine)(db, relay.id, 'replied', requester, (0, relay_session_ref_1.resolveRelaySession)(db, relay.to), now);
         }
-        (0, relay_system_line_1.writeRelaySystemLine)(db, relay.id, 'replied', requester, (0, relay_session_ref_1.resolveRelaySession)(db, relay.to), now);
+        else if (kind === 'prompt') {
+            (0, relay_system_line_1.writeRelaySystemLine)(db, relay.id, 'waiting', requester, (0, relay_session_ref_1.resolveRelaySession)(db, relay.to), now);
+        }
+        (0, relay_db_1.clearRelayPending)(db, relay.id, now);
+        logger.info('relay-delivered', { relayId, kind, to: `${requester.worktreeId}/${requester.instanceId}` });
+        return 'delivered';
     }
-    else if (kind === 'prompt') {
-        (0, relay_system_line_1.writeRelaySystemLine)(db, relay.id, 'waiting', requester, (0, relay_session_ref_1.resolveRelaySession)(db, relay.to), now);
+    finally {
+        // Delivered: a reply is closed now and a prompt notice leaves the relay
+        // open on purpose, so either way a later cancel must be judged by the row.
+        // Held or failed: nothing reached A, so the relay can be withdrawn again.
+        (0, relay_delivery_claims_1.releaseRelayDelivery)(relayId);
     }
-    (0, relay_db_1.clearRelayPending)(db, relay.id, now);
-    logger.info('relay-delivered', { relayId, kind, to: `${requester.worktreeId}/${requester.instanceId}` });
-    return 'delivered';
+}
+/** The payload this relay carries right now, read straight from the ledger. */
+function findCurrentPayload(db, relayId) {
+    return (0, relay_db_1.listRelaysWithPendingPayload)(db).find((item) => item.relay.id === relayId) ?? null;
 }
 /**
  * Deliver every stashed payload that can be delivered now.

package/dist/server/src/lib/schedule-manager.js

@@ -209,6 +209,8 @@ function getManagerState() {
         initialized: false,
         isSyncing: false,
         cmateFileCache: new Map(),
+        generation: 0,
+        worktreeStopCounts: new Map(),
     }));
 }
 // =============================================================================
@@ -251,6 +253,10 @@ async function syncSchedules() {
         return;
     manager.isSyncing = true;
     try {
+        // Issue #3735: remember what had been stopped when this pass began, so that
+        // a stop landing during the readCmateFile() await is noticed afterwards.
+        const startGeneration = manager.generation ?? 0;
+        const startStopCounts = new Map(manager.worktreeStopCounts);
         const worktrees = (0, cron_parser_1.getAllWorktrees)();
         // Track which scheduleIds are still valid
         const activeScheduleIds = new Set();
@@ -300,7 +306,26 @@ async function syncSchedules() {
                     continue;
                 const entries = (0, cmate_parser_1.parseSchedulesSection)(scheduleRows);
                 // Issue #409: Batch upsert all entries for this worktree
+                // (Issue #3735: deliberately not gated — a row for a stopped worktree is
+                // fixed by the FK CASCADE or the next sync's disableStaleSchedules())
                 const scheduleIds = (0, cron_parser_1.batchUpsertSchedules)(worktree.id, entries);
+                // Issue #3735: no await below, so this synchronous check covers every
+                // cron created, replaced or recovered for this worktree.
+                if ((manager.generation ?? 0) !== startGeneration) {
+                    // stopAllSchedules() ran. Abandon the pass entirely: the stale-removal
+                    // step below would otherwise judge schedules of a restarted manager
+                    // against this pass's partial activeScheduleIds.
+                    manager.cmateFileCache.delete(worktree.path);
+                    logger.info('sync:aborted-by-stop-all', { worktreeId: worktree.id });
+                    return;
+                }
+                if ((manager.worktreeStopCounts?.get(worktree.id) ?? 0) !== (startStopCounts.get(worktree.id) ?? 0)) {
+                    // The mtime cache was set before the await; drop it so a worktree
+                    // that still exists is picked up by the next pass.
+                    manager.cmateFileCache.delete(worktree.path);
+                    logger.info('sync:skipped-stopped-worktree', { worktreeId: worktree.id });
+                    continue;
+                }
                 for (let i = 0; i < entries.length; i++) {
                     const entry = entries[i];
                     const scheduleId = scheduleIds[i];
@@ -472,6 +497,7 @@ function stopAllSchedules() {
         }
     }
     manager.schedules.clear();
+    manager.generation = (manager.generation ?? 0) + 1;
     // DR1-008: Clear mtime cache to prevent stale values from causing
     // incorrect skip decisions on next initScheduleManager() call
     manager.cmateFileCache.clear();
@@ -504,6 +530,8 @@ function stopAllSchedules() {
  */
 function stopScheduleForWorktree(worktreeId) {
     const manager = getManagerState();
+    const stopCounts = (manager.worktreeStopCounts ??= new Map());
+    stopCounts.set(worktreeId, (stopCounts.get(worktreeId) ?? 0) + 1);
     // Stop and remove cron jobs for the target worktree
     for (const [scheduleId, state] of manager.schedules) {
         if (state.worktreeId === worktreeId) {

package/dist/server/src/lib/session/chat-turn-progress.js

@@ -52,6 +52,7 @@ exports.publishChatTurnProgress = publishChatTurnProgress;
 const types_1 = require("../../lib/realtime/types");
 const logger_1 = require("../../lib/logger");
 const global_state_1 = require("../global-state");
+const poller_owner_1 = require("../../lib/polling/poller-owner");
 // Issue #3215: the name is the one these lines have always been logged under.
 // It is what an operator greps for, so it did not move with the code.
 const logger = (0, logger_1.createLogger)('current-output-builder');
@@ -169,6 +170,19 @@ function logChatTurnProgressOutcome(target, outcome, turnKey, extra = {}) {
  * @returns The frame to broadcast, or null when there is nothing new to say
  */
 async function buildChatTurnProgress(target, source, now = Date.now()) {
+    const prepared = await prepareChatTurnProgress(target, source, now);
+    return prepared === null ? null : commitChatTurnProgress(target, prepared);
+}
+/**
+ * The half of {@link buildChatTurnProgress} that awaits: the throttle, the read
+ * and the bound — and nothing remembered about the body (Issue #3705).
+ *
+ * Split so that {@link emitChatTurnProgress} can remember a body only once it is
+ * actually going out. Remembered at the build and refused at the broadcast (a
+ * poller snapshot superseded in the `await` between the two), the body stood
+ * as "already sent" and suppressed the successor's identical frame.
+ */
+async function prepareChatTurnProgress(target, source, now) {
     const key = chatTurnProgressKey(target);
     const state = chatTurnProgressState.get(key) ?? newChatTurnProgressState();
     if (now - state.askedAt < types_1.CHAT_TURN_PROGRESS_MIN_INTERVAL_MS)
@@ -186,20 +200,43 @@ async function buildChatTurnProgress(target, source, now = Date.now()) {
     }
     if (!draft || draft.body.length === 0)
         return null;
+    // Issue #3705: the frame of a poller snapshot whose tick was superseded while
+    // the transcript was read is not built — and, above all, not remembered: the
+    // turn key and body are what suppress the successor's identical frame.
+    if (!(0, poller_owner_1.maySnapshotPublish)())
+        return null;
     const bounded = (0, types_1.truncateChatTurnProgressBody)(draft.body);
     if (draft.turnKey === state.turnKey && bounded.body === state.body)
         return null;
-    state.turnKey = draft.turnKey;
-    state.body = bounded.body;
+    return {
+        turnKey: draft.turnKey,
+        body: bounded.body,
+        partial: bounded.truncated || draft.partial === true,
+    };
+}
+/**
+ * Remember a prepared frame and give it its version — synchronous, so the
+ * caller can make it the last step before the broadcast (Issue #3705). The
+ * no-change rule is applied again against what is remembered NOW, since another
+ * frame may have gone out while the read was in flight.
+ */
+function commitChatTurnProgress(target, prepared) {
+    const key = chatTurnProgressKey(target);
+    const state = chatTurnProgressState.get(key) ?? newChatTurnProgressState();
+    if (prepared.turnKey === state.turnKey && prepared.body === state.body)
+        return null;
+    state.turnKey = prepared.turnKey;
+    state.body = prepared.body;
     state.version += 1;
+    chatTurnProgressState.set(key, state);
     return {
         type: types_1.CHAT_TURN_PROGRESS_EVENT_TYPE,
         worktreeId: target.worktreeId,
         cliToolId: target.cliToolId,
         instanceId: target.instanceId ?? target.cliToolId,
-        turnKey: draft.turnKey,
-        body: bounded.body,
-        partial: bounded.truncated || draft.partial === true,
+        turnKey: prepared.turnKey,
+        body: prepared.body,
+        partial: prepared.partial,
         version: state.version,
         done: false,
     };
@@ -232,9 +269,18 @@ async function emitChatTurnProgress(target, source, now = Date.now()) {
             logChatTurnProgressOutcome(target, 'no-subscribers', null);
             return false;
         }
-        const event = await buildChatTurnProgress(target, source, now);
+        const prepared = await prepareChatTurnProgress(target, source, now);
         // Not logged: null is the throttle, an unchanged body, or a turn with no
         // text yet — the quiet, correct majority of ticks.
+        if (!prepared)
+            return false;
+        // Issue #3705: asked after the build's `await`, and BEFORE the body is
+        // remembered — a frame refused here leaves nothing behind that would make
+        // the successor's same body look already sent. From here to the broadcast
+        // there is no `await`.
+        if (!(0, poller_owner_1.maySnapshotPublish)())
+            return false;
+        const event = commitChatTurnProgress(target, prepared);
         if (!event)
             return false;
         broadcast(target.worktreeId, event);
@@ -302,6 +348,11 @@ async function publishChatTurnProgress(db, worktreeId, cliToolId, instanceId) {
         // sessions nobody is watching, which is the bargain that was already being
         // struck one frame later.
         const { hasRoomSubscribers } = await Promise.resolve().then(() => __importStar(require('../../lib/ws-server')));
+        // Issue #3705: the progress of a superseded tick's snapshot is not started.
+        // The detached read below keeps the snapshot's owner in its async context
+        // and asks again before it remembers or broadcasts anything.
+        if (!(0, poller_owner_1.maySnapshotPublish)())
+            return;
         if (!hasRoomSubscribers(worktreeId)) {
             logChatTurnProgressOutcome(target, 'no-subscribers', null);
             return;

package/dist/server/src/lib/session/cli-session.js

@@ -16,6 +16,8 @@ exports.isSessionRunning = isSessionRunning;
 exports.getSessionPresence = getSessionPresence;
 exports.captureSessionOutput = captureSessionOutput;
 exports.captureSessionOutputFresh = captureSessionOutputFresh;
+exports.sendSessionAnswerKey = sendSessionAnswerKey;
+exports.readSessionPaneCommand = readSessionPaneCommand;
 exports.getSessionName = getSessionName;
 exports.publishSessionSurface = publishSessionSurface;
 exports.forgetSessionSurface = forgetSessionSurface;
@@ -115,7 +117,8 @@ async function captureSessionOutput(worktreeId, cliToolId, lines = 1000, instanc
  * Capture CLI session output bypassing cache (fresh capture).
  *
  * Issue #405: Used by prompt-response endpoint to ensure fresh output
- * for prompt re-verification. Writes back to cache on success.
+ * for prompt re-verification. Writes back to cache on success, unless the
+ * session was invalidated while the capture was in flight (Issue #3734).
  *
  * @param worktreeId - Worktree ID
  * @param cliToolId - CLI tool ID
@@ -127,11 +130,16 @@ async function captureSessionOutputFresh(worktreeId, cliToolId, lines = 5000, in
     log.debug('captureSessionOutputFresh:start', { requestedLines: lines });
     const { cliTool, sessionName } = resolveSessionContext(worktreeId, cliToolId, instanceId);
     const transport = getDefaultTransport();
+    // Issue #3734: snapshot the generation before the capture starts
+    const generation = (0, tmux_capture_cache_1.getCaptureGeneration)(sessionName);
     try {
         const output = await transport.captureSnapshot(sessionName, { startLine: -lines });
-        // Write back to cache if non-empty [SEC4-007]
+        // Write back to cache if non-empty [SEC4-007]. Skip it when the session was
+        // invalidated while waiting: the output may predate a send (Issue #3734).
         if (output.length > 0) {
-            (0, tmux_capture_cache_1.setCachedCapture)(sessionName, output, lines);
+            if ((0, tmux_capture_cache_1.isCaptureGenerationCurrent)(sessionName, generation)) {
+                (0, tmux_capture_cache_1.setCachedCapture)(sessionName, output, lines);
+            }
         }
         else {
             (0, tmux_capture_cache_1.invalidateCache)(sessionName);
@@ -146,6 +154,33 @@ async function captureSessionOutputFresh(worktreeId, cliToolId, lines = 5000, in
         throw new Error(`Failed to capture ${cliTool.name} output: ${errorMessage}`);
     }
 }
+/**
+ * Send ONE answer key to a session and drop its cached capture, so the next
+ * read is of the pane after the key (Issue #3756). One key per call: the
+ * strict `respond` reads the screen again between two keys.
+ */
+async function sendSessionAnswerKey(worktreeId, cliToolId, key, instanceId) {
+    if (key !== 'Up' && key !== 'Down' && key !== 'Enter') {
+        throw new Error(`Unsupported answer key: ${String(key)}`);
+    }
+    const { sessionName } = resolveSessionContext(worktreeId, cliToolId, instanceId);
+    try {
+        await (0, tmux_1.sendSpecialKeys)(sessionName, [key]);
+    }
+    finally {
+        (0, tmux_capture_cache_1.invalidateCache)(sessionName);
+    }
+}
+/**
+ * The foreground command of a session's pane (`#{pane_current_command}`), or
+ * null when tmux cannot say (Issue #3788). The strict `respond` reads it after
+ * its Enter: agy exits on the trust screen's `No, exit` and leaves the shell in
+ * a pane that is still up, which only this tells apart from an unread screen.
+ */
+async function readSessionPaneCommand(worktreeId, cliToolId, instanceId) {
+    const { sessionName } = resolveSessionContext(worktreeId, cliToolId, instanceId);
+    return (0, tmux_1.getPaneCurrentCommand)(sessionName);
+}
 /**
  * Get session name for a CLI tool and worktree
  *

package/dist/server/src/lib/session/current-output-builder.js

@@ -48,6 +48,7 @@ const auto_yes_dialog_gate_1 = require("../../lib/polling/auto-yes-dialog-gate")
 const layer_disagreement_1 = require("../../lib/session/layer-disagreement");
 const structured_prompt_1 = require("../../lib/session/structured-prompt");
 const chat_turn_progress_1 = require("./chat-turn-progress");
+const poller_owner_1 = require("../../lib/polling/poller-owner");
 const structured_status_merge_1 = require("./structured-status-merge");
 const current_output_history_writers_1 = require("./current-output-history-writers");
 const detection_divergence_1 = require("./detection-divergence");
@@ -74,6 +75,11 @@ const logger = (0, logger_1.createLogger)('current-output-builder');
  */
 async function buildCurrentOutput(db, worktreeId, cliToolId, instanceId, resolution) {
     const payload = await buildPayload(db, worktreeId, cliToolId, instanceId);
+    // Issue #3705: the payload's own writers asked after their awaits (see
+    // `buildPayload`); the progress frame below is one more write, of the turn
+    // the payload describes.
+    if (!(0, poller_owner_1.maySnapshotPublish)())
+        throw new poller_owner_1.RetiredSnapshotError();
     // Issue #2199. Fire-and-forget, and placed HERE rather than in the poller for
     // one reason: this is the function both live paths run through. The WebSocket
     // push calls it from `broadcastTerminalSnapshot` on every generating poller
@@ -565,6 +571,15 @@ async function buildPayload(db, worktreeId, cliToolId, instanceId) {
     const sessionName = cliTool.getSessionName(worktreeId, instanceId);
     const { stopEventAt, eventSource, askUserQuestion, structuredEvents } = readAgentEvents(worktreeId, cliToolId, instanceId, resolvedInstanceId);
     const running = await cliTool.isRunning(worktreeId, instanceId);
+    // Issue #3705: a terminal snapshot the response poller started for a tick
+    // that has since been superseded writes nothing from here on — not the
+    // latch, the starting state, the unclassified-frame row, the structured
+    // prompt row or the status evidence — because they would describe the turn
+    // that ended on top of the successor's. Thrown, not answered, so the payload
+    // type stays what the route reads; `broadcastTerminalSnapshot` catches it.
+    // Never thrown outside a poller snapshot (`maySnapshotPublish`).
+    if (!(0, poller_owner_1.maySnapshotPublish)())
+        throw new poller_owner_1.RetiredSnapshotError();
     if (!running) {
         // Issue #1926: the latch describes a process, and this one is gone. Dropped
         // rather than aged out so the next session on this key starts with no
@@ -632,6 +647,10 @@ async function buildPayload(db, worktreeId, cliToolId, instanceId) {
     const sessionState = (0, db_1.getSessionState)(db, worktreeId, resolvedInstanceId);
     const lastCapturedLine = sessionState?.lastCapturedLine || 0;
     const output = await (0, cli_session_1.captureSessionOutput)(worktreeId, cliToolId, status_capture_config_1.STATUS_CAPTURE_LINES, instanceId);
+    // Issue #3705: the last `await` of the build. Everything below it, through
+    // `observeStatusEvidence`, runs without one.
+    if (!(0, poller_owner_1.maySnapshotPublish)())
+        throw new poller_owner_1.RetiredSnapshotError();
     const lines = output.split('\n');
     const totalLines = lines.length;
     // Issue #1670: `content` is "everything the poller has not saved yet", which

package/dist/server/src/lib/session/send-attempt-state.js

@@ -0,0 +1,155 @@
+"use strict";
+/**
+ * The last send attempt per instance (Issue #3759).
+ *
+ * When the first message of a session did not arrive (#3746:
+ * `Antigravity prompt not ready`), nothing said whether it was still to be
+ * sent, already on the pane, or somewhere in between. This module keeps, per
+ * (worktree, tool, instance), how the last {@link sendUserMessage} attempt
+ * ended — `not-sent` / `sent` / `indeterminate` (`./send-attempt-types`) — and
+ * `prompt --json` publishes it as `lastSend`.
+ *
+ * The record carries a digest of the message, never the message: it says which
+ * message the state is about without keeping what was written.
+ *
+ * Nothing here resends. The sender (a person, or the supervising agent) decides,
+ * and an `indeterminate` message is not to be resent before looking at the pane.
+ *
+ * In memory on `globalThis` (the send route and the observing route are bundled
+ * apart under `next dev`), bounded; a restart forgets every record, which
+ * publishes as "no record", never as a state.
+ *
+ * Recording must never change a send's outcome: {@link recordSendAttempt}
+ * swallows its own failures.
+ *
+ * @module lib/session/send-attempt-state
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sendMessageDigest = sendMessageDigest;
+exports.recordSendAttempt = recordSendAttempt;
+exports.getLastSendAttempt = getLastSendAttempt;
+exports.clearSendAttempts = clearSendAttempts;
+exports.classifySendFailure = classifySendFailure;
+exports.composerHoldsMessage = composerHoldsMessage;
+exports.describeSendAttemptState = describeSendAttemptState;
+const crypto_1 = require("crypto");
+const global_state_1 = require("../../lib/global-state");
+const logger_1 = require("../../lib/logger");
+const session_start_error_1 = require("../../lib/session/session-start-error");
+const send_attempt_types_1 = require("./send-attempt-types");
+const logger = (0, logger_1.createLogger)('session/send-attempt-state');
+/** How many instances are tracked at once; the least recently sent to is forgotten first. */
+const MAX_TRACKED_INSTANCES = 1024;
+const records = (0, global_state_1.getOrInitGlobal)('__sendAttemptRecords', () => new Map());
+function keyOf(instance) {
+    return JSON.stringify([instance.worktreeId, instance.cliToolId, instance.instanceId]);
+}
+/** The digest a record carries for `content`. */
+function sendMessageDigest(content) {
+    return (0, crypto_1.createHash)('sha256').update(content, 'utf8').digest('hex').slice(0, 16);
+}
+/**
+ * Record how a send attempt ended. Never throws: a record that cannot be made
+ * leaves the send exactly as it was.
+ */
+function recordSendAttempt(instance, attempt, now = Date.now()) {
+    try {
+        const key = keyOf(instance);
+        // Re-inserted, so the map's order is least recently sent to first.
+        records.delete(key);
+        records.set(key, {
+            at: Math.floor(now),
+            state: attempt.state,
+            reason: attempt.reason,
+            messageDigest: sendMessageDigest(attempt.content),
+        });
+        while (records.size > MAX_TRACKED_INSTANCES) {
+            const oldest = records.keys().next().value;
+            if (oldest === undefined)
+                break;
+            records.delete(oldest);
+        }
+    }
+    catch (error) {
+        logger.warn('send-attempt-record-failed', { error: error instanceof Error ? error.message : String(error) });
+    }
+}
+/** The instance's last recorded attempt, or null when none is held. */
+function getLastSendAttempt(instance) {
+    return records.get(keyOf(instance)) ?? null;
+}
+/** Forget every record (tests). */
+function clearSendAttempts() {
+    records.clear();
+}
+/**
+ * Where a failed `ICLITool.sendMessage` stopped, read from its error.
+ *
+ * Only failures whose wording says the body was never typed are `not-sent`;
+ * every other failure is `indeterminate`, because "we do not know" must never
+ * read as "safe to resend". The tools wrap these messages
+ * (`Failed to send message to <tool>: …`), so they are matched anywhere in it.
+ */
+function classifySendFailure(error) {
+    if (typeof error === 'object' &&
+        error !== null &&
+        error.code === session_start_error_1.SESSION_STARTING_CODE) {
+        return { state: 'not-sent', reason: 'session-starting' };
+    }
+    // #3772: the plan review overlay refused the send before the body was typed.
+    if (typeof error === 'object' &&
+        error !== null &&
+        error.code === send_attempt_types_1.PLAN_REVIEW_SEND_REFUSED_CODE) {
+        return { state: 'not-sent', reason: 'plan-review' };
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    // The readiness waits of every tool throw before typing anything.
+    if (/prompt not ready/i.test(message))
+        return { state: 'not-sent', reason: 'prompt-not-ready' };
+    // #1880: refused before the body, after only the clear keys (C-e / C-u).
+    if (/still holds unsent text after \d+ clear passes/.test(message)) {
+        return { state: 'not-sent', reason: 'composer-not-empty' };
+    }
+    // #2464 / #3366: typed, never submitted, taken back out best-effort.
+    if (/Enter was not pressed, so nothing was submitted/.test(message)) {
+        return { state: 'indeterminate', reason: 'body-not-landed' };
+    }
+    // #1501: the input line was cleared best-effort.
+    if (/replaced by a TUI autocompletion/.test(message)) {
+        return { state: 'indeterminate', reason: 'replaced-by-completion' };
+    }
+    // #1471: typed, Enter sent (more than once), never confirmed.
+    if (/submit could not be confirmed/i.test(message)) {
+        return { state: 'indeterminate', reason: 'submit-unconfirmed' };
+    }
+    return { state: 'indeterminate', reason: 'send-error' };
+}
+/** The whitespace-free form two renderings of one text share. */
+function compact(text) {
+    return text.replace(/\s+/g, '');
+}
+/**
+ * Whether a composer read (`extractComposerText(...).text`) still holds the
+ * message: its compacted text contains the compacted start of the message's
+ * first non-blank line. Only the start, because a long body is cut by the
+ * reader and wrapped by the TUI.
+ */
+function composerHoldsMessage(composerText, content) {
+    const firstLine = content.split('\n').find((line) => line.trim() !== '') ?? '';
+    const needle = compact(firstLine).slice(0, 32);
+    return needle !== '' && compact(composerText).includes(needle);
+}
+/** One line for a failed send's error: what state the message is in, and who resends it. */
+function describeSendAttemptState(attempt) {
+    if (attempt.state === 'not-sent') {
+        return (`[send state: not-sent (${attempt.reason}): the message was not typed. ` +
+            'CommandMate does not resend it; send it again once the input prompt is back ' +
+            '(`commandmate prompt <worktree-id> --json` shows the screen and lastSend).]');
+    }
+    if (attempt.state === 'indeterminate') {
+        return (`[send state: indeterminate (${attempt.reason}): part of the message may have been typed or submitted. ` +
+            'CommandMate does not resend it; do not resend before checking the pane ' +
+            '(`commandmate capture <worktree-id> --pane`), or it may arrive twice.]');
+    }
+    return `[send state: sent (${attempt.reason})]`;
+}

package/dist/server/src/lib/session/send-attempt-types.js

@@ -0,0 +1,17 @@
+"use strict";
+/**
+ * What the last send to an instance did to its pane (Issue #3759): types only.
+ *
+ * Kept free of imports so the CLI can read the payload's shape through
+ * `lib/prompt-observation/types` without pulling the server graph in (the same
+ * rule `polling/auto-yes-suppression-reason` follows).
+ *
+ * @module lib/session/send-attempt-types
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PLAN_REVIEW_SEND_REFUSED_CODE = void 0;
+/**
+ * `code` on the error a tool throws when a plan review overlay refuses the
+ * send before any body is typed (Issue #3772). Matched by code, never by wording.
+ */
+exports.PLAN_REVIEW_SEND_REFUSED_CODE = 'PLAN_REVIEW_SEND_REFUSED';