commandmate 0.46.1 → 0.47.0

package/dist/server/src/lib/push/waiting-push-notifier.js

@@ -103,6 +103,12 @@ exports.CLASSIFICATION_GRACE_MS = 8_000;
 const pending = (0, global_state_1.getOrInitGlobal)('__waitingPushPending', () => new Map());
 /** Composite key -> the timer holding that wait's first notification (#2156). */
 const graceTimers = (0, global_state_1.getOrInitGlobal)('__waitingPushGraceTimers', () => new Map());
+/**
+ * Composite key -> the timer that asks the gate again when its
+ * `auto-yes-answering` hold ends (Issue #3757). Apart from {@link graceTimers}:
+ * that one is the classification hold of #2156, this one the Auto-Yes hold.
+ */
+const answerGraceTimers = (0, global_state_1.getOrInitGlobal)('__waitingPushAnswerGraceTimers', () => new Map());
 /**
  * The worktree's display name, for the notification title.
  *
@@ -160,10 +166,15 @@ function isUnnamedWait(kind) {
 /** Drop the hold on this wait without sending anything. */
 function cancelGrace(key) {
     const timer = graceTimers.get(key);
-    if (timer === undefined)
-        return;
-    clearTimeout(timer);
-    graceTimers.delete(key);
+    if (timer !== undefined) {
+        clearTimeout(timer);
+        graceTimers.delete(key);
+    }
+    const answerTimer = answerGraceTimers.get(key);
+    if (answerTimer !== undefined) {
+        clearTimeout(answerTimer);
+        answerGraceTimers.delete(key);
+    }
 }
 /**
  * The Auto-Yes gate, then the fan-out.
@@ -172,17 +183,70 @@ function cancelGrace(key) {
  * moment it decides to send, so a notification dropped after the fan-out began
  * would still consume the episode's one slot — see `prompt-push-gate`.
  */
-function gateAndSend(wait, now) {
-    if ((0, prompt_push_gate_1.isPromptPushSuppressed)({
+function gateAndSend(wait, now, recheck = false) {
+    const decision = (0, prompt_push_gate_1.decideAndLogPromptPush)({
         worktreeId: wait.worktreeId,
         cliToolId: wait.cliToolId,
         instanceId: wait.instanceId,
         waitingSince: wait.since,
-    })) {
+        now,
+    }, { recheck });
+    if (decision.suppress) {
+        // Issue #3757: "Auto-Yes is answering" is a hold, not a verdict. Ask again
+        // when it ends; a wait Auto-Yes did answer is gone from the episode store
+        // by then and nothing is sent.
+        if (decision.reason === 'auto-yes-answering')
+            holdForAutoYesAnswer(wait, now);
         return;
     }
     void sendWaitingPush(wait, false, now);
 }
+/**
+ * Re-ask the gate for this wait when its `auto-yes-answering` hold ends
+ * (Issue #3757). The edge fires once, so without this a wait Auto-Yes never
+ * answered — a screen the poller cannot read and records nothing about — stayed
+ * silent until the escalation reminder, ten minutes later.
+ */
+function holdForAutoYesAnswer(wait, now) {
+    const key = (0, auto_yes_state_1.buildCompositeKey)(wait.worktreeId, wait.cliToolId, wait.instanceId);
+    const existing = answerGraceTimers.get(key);
+    if (existing !== undefined)
+        clearTimeout(existing);
+    // From the gate's own origin, not `since` (Issue #3757 review), and past the
+    // poller's session-wait tick (Issue #3791). Capped at the grace, so a clock
+    // that went backwards cannot arm an overflowing timer, and a longer hold is
+    // asked about again every grace: a poller stopped meanwhile ends it then
+    // rather than at a tick that will not come.
+    const holdEndsAt = (0, prompt_push_gate_1.autoYesHoldEndsAt)({ worktreeId: wait.worktreeId, cliToolId: wait.cliToolId, instanceId: wait.instanceId, waitingSince: wait.since }, now);
+    const delay = Math.min(prompt_push_gate_1.AUTO_YES_ANSWER_GRACE_MS, Math.max(0, holdEndsAt - now));
+    const timer = setTimeout(() => {
+        answerGraceTimers.delete(key);
+        releaseAutoYesHold(key, wait.since);
+    }, delay);
+    // Never hold the process open for it, as with the other timers here.
+    timer.unref?.();
+    answerGraceTimers.set(key, timer);
+}
+/**
+ * The Auto-Yes hold ended: notify unless the wait is over or is another one
+ * (Issue #3757). Read from the episode store, as {@link releaseHeldWait} does.
+ */
+function releaseAutoYesHold(key, since) {
+    const held = pending.get(key);
+    if (held === undefined || held.since !== since)
+        return;
+    const episode = (0, waiting_episode_state_1.getWaitingEpisode)(held.worktreeId, held.cliToolId, held.instanceId);
+    if (episode === null || episode.since !== held.since) {
+        pending.delete(key);
+        // Issue #3776: this episode's hold only — the next one may hold already.
+        (0, prompt_push_gate_1.forgetAutoYesHold)(key, held.since);
+        stopEscalationTimerIfIdle();
+        return;
+    }
+    const settled = { ...held, kind: episode.kind };
+    pending.set(key, settled);
+    gateAndSend(settled, Date.now(), true);
+}
 /**
  * The grace elapsed: send the held wait with whatever it is called *now*
  * (Issue #2156).
@@ -380,6 +444,9 @@ function stopWaitingPushNotifier() {
     for (const timer of graceTimers.values())
         clearTimeout(timer);
     graceTimers.clear();
+    for (const timer of answerGraceTimers.values())
+        clearTimeout(timer);
+    answerGraceTimers.clear();
     pending.clear();
     stopEscalationTimerIfIdle();
 }

package/dist/server/src/lib/relay/relay-delivery-claims.js

@@ -0,0 +1,46 @@
+"use strict";
+/**
+ * Relays whose payload is being typed into the requester's composer right now
+ * (Issue #3732).
+ *
+ * A claim is taken by `relay-delivery` immediately before `sendUserMessage`, in
+ * the same synchronous stretch that re-read the row and found it still open, and
+ * released once the attempt is over (delivered, held or failed). While it is
+ * held, `withdrawRelay` answers `delivering` instead of cancelling: a cancel
+ * that reported success would be a lie once the send is already under way, and
+ * the send cannot be taken back.
+ *
+ * A module of its own, rather than an export of `relay-delivery`, so that
+ * `relay-service` (and the cancel route behind it) can consult it without
+ * importing the send path.
+ *
+ * On `globalThis` for the reason the in-flight set is (#1736): the poller's and
+ * the API's bundles must see the same set under `next dev`. Being in memory is
+ * enough — a claim only lives for the duration of one send in this process, so
+ * there is nothing to migrate and nothing to recover after a restart.
+ *
+ * @module lib/relay/relay-delivery-claims
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.claimRelayDelivery = claimRelayDelivery;
+exports.releaseRelayDelivery = releaseRelayDelivery;
+exports.isRelayDeliveryClaimed = isRelayDeliveryClaimed;
+exports.resetRelayDeliveryClaims = resetRelayDeliveryClaims;
+const global_state_1 = require("../global-state");
+const claims = (0, global_state_1.getOrInitGlobal)('__relayDeliveryClaims', () => new Set());
+/** Mark a relay as being delivered. */
+function claimRelayDelivery(relayId) {
+    claims.add(relayId);
+}
+/** The attempt is over, whatever its outcome. */
+function releaseRelayDelivery(relayId) {
+    claims.delete(relayId);
+}
+/** Whether a send for this relay is under way right now. */
+function isRelayDeliveryClaimed(relayId) {
+    return claims.has(relayId);
+}
+/** Forget every claim. Test seam. */
+function resetRelayDeliveryClaims() {
+    claims.clear();
+}

package/dist/server/src/lib/relay/relay-delivery.js

@@ -57,6 +57,8 @@ const relay_policy_1 = require("../../lib/relay/relay-policy");
 const relay_readiness_1 = require("../../lib/relay/relay-readiness");
 const relay_session_ref_1 = require("../../lib/relay/relay-session-ref");
 const relay_system_line_1 = require("../../lib/relay/relay-system-line");
+const relay_delivery_claims_1 = require("../../lib/relay/relay-delivery-claims");
+const types_1 = require("../../lib/relay/types");
 const logger_1 = require("../../lib/logger");
 const global_state_1 = require("../global-state");
 const logger = (0, logger_1.createLogger)('relay-delivery');
@@ -158,6 +160,7 @@ const inFlight = (0, global_state_1.getOrInitGlobal)('__relayDeliveryInFlight',
 /** Forget every in-flight delivery. Test seam. */
 function resetRelayDeliveryState() {
     inFlight.clear();
+    (0, relay_delivery_claims_1.resetRelayDeliveryClaims)();
     globalThis.__relayPumpRunning = false;
 }
 function senderLabel(db, relay) {
@@ -431,6 +434,13 @@ function notifyRelayPromptWaiting(worker) {
 function sweepExpiredRelays(db, now = Date.now()) {
     let expired = 0;
     for (const relay of (0, relay_db_1.listExpiredOpenRelays)(db, now)) {
+        // A send already under way for this relay cannot be taken back (#3732).
+        // Expiring it now would leave A with both the reply and the expiry notice,
+        // and the delivery's own cleanup would then wipe that notice. The next
+        // sweep finds it closed (delivered) or, if the send was refused, still
+        // open and expires it then.
+        if ((0, relay_delivery_claims_1.isRelayDeliveryClaimed)(relay.id))
+            continue;
         try {
             const locale = (0, model_change_push_notifier_1.resolveReadersLocale)(db);
             // A payload that never went out is superseded by the expiry notice: A
@@ -465,47 +475,83 @@ function sweepExpiredRelays(db, now = Date.now()) {
  * repeat delivery is prevented by the in-flight set within a process and by
  * `markRelayDelivered`'s guarded update across one, which is the idempotency the
  * Issue asks for by name.
+ *
+ * `kind` and `body` are what the pump's listing saw, and that listing is stale
+ * by the time the readiness check returns (#3732): an earlier relay's send, or
+ * this one's own capture, may have let a cancel or an expiry sweep run. So the
+ * row is read again AFTER the last await before the send, and the send goes
+ * ahead only when it still carries the same payload — and, for anything but an
+ * expiry notice, is still open. The claim is taken in that same synchronous
+ * stretch, so no cancel can slip in between the check and the send; from then
+ * on `withdrawRelay` answers `delivering`.
  */
 async function deliverOne(db, relayId, kind, body) {
-    const relay = (0, relay_db_1.getRelayById)(db, relayId);
-    if (!relay)
+    const listed = (0, relay_db_1.getRelayById)(db, relayId);
+    if (!listed)
         return 'skipped';
-    const requester = (0, relay_session_ref_1.resolveRelaySession)(db, relay.from);
-    const hold = await (0, relay_readiness_1.findRelayHoldReason)(requester.worktreeId, requester.cliToolId, requester.instanceId, db);
+    const listedRequester = (0, relay_session_ref_1.resolveRelaySession)(db, listed.from);
+    const hold = await (0, relay_readiness_1.findRelayHoldReason)(listedRequester.worktreeId, listedRequester.cliToolId, listedRequester.instanceId, db);
     if (hold) {
         logger.debug('relay-delivery-held', { relayId, kind, reason: hold });
         return 'held';
     }
-    const result = await (0, send_user_message_1.sendUserMessage)(db, {
-        worktreeId: requester.worktreeId,
-        content: body,
-        cliToolId: requester.cliToolId,
-        instanceId: requester.instanceId,
-        messageType: 'relay',
-        // The pointer back at the ledger. Also `session_relays.sent_request_id` for
-        // a reply, which carries a UNIQUE index — so a second delivery of the same
-        // relay cannot be recorded even if one were somehow attempted.
-        requestId: kind === 'reply' ? (0, chat_db_1.relayRequestId)(relay.id) : undefined,
-    });
-    if (!result.ok) {
-        logger.info('relay-delivery-refused', { relayId, kind, stage: result.stage });
-        return result.stage === 'prompt_waiting' ? 'held' : 'failed';
+    // Synchronous from here to the send: re-read, then claim.
+    const current = findCurrentPayload(db, relayId);
+    if (!current || current.kind !== kind || current.body !== body) {
+        logger.info('relay-delivery-superseded', { relayId, kind });
+        return 'skipped';
+    }
+    // An expiry notice is delivered from a CLOSED relay by design; everything
+    // else is only owed while the relay is open.
+    if (kind !== 'expired' && !(0, types_1.isOpenRelayState)(current.relay.state)) {
+        logger.info('relay-delivery-closed', { relayId, kind, state: current.relay.state });
+        return 'skipped';
     }
-    const now = Date.now();
-    if (kind === 'reply') {
-        if (!(0, relay_db_1.markRelayDelivered)(db, relay.id, (0, chat_db_1.relayRequestId)(relay.id), now)) {
-            // Somebody closed it underneath us. The message is already in A's
-            // composer, which is the outcome that mattered.
-            logger.info('relay-already-closed-on-deliver', { relayId });
+    const relay = current.relay;
+    const requester = (0, relay_session_ref_1.resolveRelaySession)(db, relay.from);
+    (0, relay_delivery_claims_1.claimRelayDelivery)(relayId);
+    try {
+        const result = await (0, send_user_message_1.sendUserMessage)(db, {
+            worktreeId: requester.worktreeId,
+            content: body,
+            cliToolId: requester.cliToolId,
+            instanceId: requester.instanceId,
+            messageType: 'relay',
+            // The pointer back at the ledger. Also `session_relays.sent_request_id` for
+            // a reply, which carries a UNIQUE index — so a second delivery of the same
+            // relay cannot be recorded even if one were somehow attempted.
+            requestId: kind === 'reply' ? (0, chat_db_1.relayRequestId)(relay.id) : undefined,
+        });
+        if (!result.ok) {
+            logger.info('relay-delivery-refused', { relayId, kind, stage: result.stage });
+            return result.stage === 'prompt_waiting' ? 'held' : 'failed';
+        }
+        const now = Date.now();
+        if (kind === 'reply') {
+            if (!(0, relay_db_1.markRelayDelivered)(db, relay.id, (0, chat_db_1.relayRequestId)(relay.id), now)) {
+                // Somebody closed it underneath us. The message is already in A's
+                // composer, which is the outcome that mattered.
+                logger.info('relay-already-closed-on-deliver', { relayId });
+            }
+            (0, relay_system_line_1.writeRelaySystemLine)(db, relay.id, 'replied', requester, (0, relay_session_ref_1.resolveRelaySession)(db, relay.to), now);
         }
-        (0, relay_system_line_1.writeRelaySystemLine)(db, relay.id, 'replied', requester, (0, relay_session_ref_1.resolveRelaySession)(db, relay.to), now);
+        else if (kind === 'prompt') {
+            (0, relay_system_line_1.writeRelaySystemLine)(db, relay.id, 'waiting', requester, (0, relay_session_ref_1.resolveRelaySession)(db, relay.to), now);
+        }
+        (0, relay_db_1.clearRelayPending)(db, relay.id, now);
+        logger.info('relay-delivered', { relayId, kind, to: `${requester.worktreeId}/${requester.instanceId}` });
+        return 'delivered';
     }
-    else if (kind === 'prompt') {
-        (0, relay_system_line_1.writeRelaySystemLine)(db, relay.id, 'waiting', requester, (0, relay_session_ref_1.resolveRelaySession)(db, relay.to), now);
+    finally {
+        // Delivered: a reply is closed now and a prompt notice leaves the relay
+        // open on purpose, so either way a later cancel must be judged by the row.
+        // Held or failed: nothing reached A, so the relay can be withdrawn again.
+        (0, relay_delivery_claims_1.releaseRelayDelivery)(relayId);
     }
-    (0, relay_db_1.clearRelayPending)(db, relay.id, now);
-    logger.info('relay-delivered', { relayId, kind, to: `${requester.worktreeId}/${requester.instanceId}` });
-    return 'delivered';
+}
+/** The payload this relay carries right now, read straight from the ledger. */
+function findCurrentPayload(db, relayId) {
+    return (0, relay_db_1.listRelaysWithPendingPayload)(db).find((item) => item.relay.id === relayId) ?? null;
 }
 /**
  * Deliver every stashed payload that can be delivered now.

package/dist/server/src/lib/schedule-manager.js

@@ -209,6 +209,8 @@ function getManagerState() {
         initialized: false,
         isSyncing: false,
         cmateFileCache: new Map(),
+        generation: 0,
+        worktreeStopCounts: new Map(),
     }));
 }
 // =============================================================================
@@ -251,6 +253,10 @@ async function syncSchedules() {
         return;
     manager.isSyncing = true;
     try {
+        // Issue #3735: remember what had been stopped when this pass began, so that
+        // a stop landing during the readCmateFile() await is noticed afterwards.
+        const startGeneration = manager.generation ?? 0;
+        const startStopCounts = new Map(manager.worktreeStopCounts);
         const worktrees = (0, cron_parser_1.getAllWorktrees)();
         // Track which scheduleIds are still valid
         const activeScheduleIds = new Set();
@@ -300,7 +306,26 @@ async function syncSchedules() {
                     continue;
                 const entries = (0, cmate_parser_1.parseSchedulesSection)(scheduleRows);
                 // Issue #409: Batch upsert all entries for this worktree
+                // (Issue #3735: deliberately not gated — a row for a stopped worktree is
+                // fixed by the FK CASCADE or the next sync's disableStaleSchedules())
                 const scheduleIds = (0, cron_parser_1.batchUpsertSchedules)(worktree.id, entries);
+                // Issue #3735: no await below, so this synchronous check covers every
+                // cron created, replaced or recovered for this worktree.
+                if ((manager.generation ?? 0) !== startGeneration) {
+                    // stopAllSchedules() ran. Abandon the pass entirely: the stale-removal
+                    // step below would otherwise judge schedules of a restarted manager
+                    // against this pass's partial activeScheduleIds.
+                    manager.cmateFileCache.delete(worktree.path);
+                    logger.info('sync:aborted-by-stop-all', { worktreeId: worktree.id });
+                    return;
+                }
+                if ((manager.worktreeStopCounts?.get(worktree.id) ?? 0) !== (startStopCounts.get(worktree.id) ?? 0)) {
+                    // The mtime cache was set before the await; drop it so a worktree
+                    // that still exists is picked up by the next pass.
+                    manager.cmateFileCache.delete(worktree.path);
+                    logger.info('sync:skipped-stopped-worktree', { worktreeId: worktree.id });
+                    continue;
+                }
                 for (let i = 0; i < entries.length; i++) {
                     const entry = entries[i];
                     const scheduleId = scheduleIds[i];
@@ -472,6 +497,7 @@ function stopAllSchedules() {
         }
     }
     manager.schedules.clear();
+    manager.generation = (manager.generation ?? 0) + 1;
     // DR1-008: Clear mtime cache to prevent stale values from causing
     // incorrect skip decisions on next initScheduleManager() call
     manager.cmateFileCache.clear();
@@ -504,6 +530,8 @@ function stopAllSchedules() {
  */
 function stopScheduleForWorktree(worktreeId) {
     const manager = getManagerState();
+    const stopCounts = (manager.worktreeStopCounts ??= new Map());
+    stopCounts.set(worktreeId, (stopCounts.get(worktreeId) ?? 0) + 1);
     // Stop and remove cron jobs for the target worktree
     for (const [scheduleId, state] of manager.schedules) {
         if (state.worktreeId === worktreeId) {

package/dist/server/src/lib/session/cli-session.js

@@ -16,6 +16,8 @@ exports.isSessionRunning = isSessionRunning;
 exports.getSessionPresence = getSessionPresence;
 exports.captureSessionOutput = captureSessionOutput;
 exports.captureSessionOutputFresh = captureSessionOutputFresh;
+exports.sendSessionAnswerKey = sendSessionAnswerKey;
+exports.readSessionPaneCommand = readSessionPaneCommand;
 exports.getSessionName = getSessionName;
 exports.publishSessionSurface = publishSessionSurface;
 exports.forgetSessionSurface = forgetSessionSurface;
@@ -115,7 +117,8 @@ async function captureSessionOutput(worktreeId, cliToolId, lines = 1000, instanc
  * Capture CLI session output bypassing cache (fresh capture).
  *
  * Issue #405: Used by prompt-response endpoint to ensure fresh output
- * for prompt re-verification. Writes back to cache on success.
+ * for prompt re-verification. Writes back to cache on success, unless the
+ * session was invalidated while the capture was in flight (Issue #3734).
  *
  * @param worktreeId - Worktree ID
  * @param cliToolId - CLI tool ID
@@ -127,11 +130,16 @@ async function captureSessionOutputFresh(worktreeId, cliToolId, lines = 5000, in
     log.debug('captureSessionOutputFresh:start', { requestedLines: lines });
     const { cliTool, sessionName } = resolveSessionContext(worktreeId, cliToolId, instanceId);
     const transport = getDefaultTransport();
+    // Issue #3734: snapshot the generation before the capture starts
+    const generation = (0, tmux_capture_cache_1.getCaptureGeneration)(sessionName);
     try {
         const output = await transport.captureSnapshot(sessionName, { startLine: -lines });
-        // Write back to cache if non-empty [SEC4-007]
+        // Write back to cache if non-empty [SEC4-007]. Skip it when the session was
+        // invalidated while waiting: the output may predate a send (Issue #3734).
         if (output.length > 0) {
-            (0, tmux_capture_cache_1.setCachedCapture)(sessionName, output, lines);
+            if ((0, tmux_capture_cache_1.isCaptureGenerationCurrent)(sessionName, generation)) {
+                (0, tmux_capture_cache_1.setCachedCapture)(sessionName, output, lines);
+            }
         }
         else {
             (0, tmux_capture_cache_1.invalidateCache)(sessionName);
@@ -146,6 +154,33 @@ async function captureSessionOutputFresh(worktreeId, cliToolId, lines = 5000, in
         throw new Error(`Failed to capture ${cliTool.name} output: ${errorMessage}`);
     }
 }
+/**
+ * Send ONE answer key to a session and drop its cached capture, so the next
+ * read is of the pane after the key (Issue #3756). One key per call: the
+ * strict `respond` reads the screen again between two keys.
+ */
+async function sendSessionAnswerKey(worktreeId, cliToolId, key, instanceId) {
+    if (key !== 'Up' && key !== 'Down' && key !== 'Enter') {
+        throw new Error(`Unsupported answer key: ${String(key)}`);
+    }
+    const { sessionName } = resolveSessionContext(worktreeId, cliToolId, instanceId);
+    try {
+        await (0, tmux_1.sendSpecialKeys)(sessionName, [key]);
+    }
+    finally {
+        (0, tmux_capture_cache_1.invalidateCache)(sessionName);
+    }
+}
+/**
+ * The foreground command of a session's pane (`#{pane_current_command}`), or
+ * null when tmux cannot say (Issue #3788). The strict `respond` reads it after
+ * its Enter: agy exits on the trust screen's `No, exit` and leaves the shell in
+ * a pane that is still up, which only this tells apart from an unread screen.
+ */
+async function readSessionPaneCommand(worktreeId, cliToolId, instanceId) {
+    const { sessionName } = resolveSessionContext(worktreeId, cliToolId, instanceId);
+    return (0, tmux_1.getPaneCurrentCommand)(sessionName);
+}
 /**
  * Get session name for a CLI tool and worktree
  *

package/dist/server/src/lib/session/send-attempt-state.js

@@ -0,0 +1,155 @@
+"use strict";
+/**
+ * The last send attempt per instance (Issue #3759).
+ *
+ * When the first message of a session did not arrive (#3746:
+ * `Antigravity prompt not ready`), nothing said whether it was still to be
+ * sent, already on the pane, or somewhere in between. This module keeps, per
+ * (worktree, tool, instance), how the last {@link sendUserMessage} attempt
+ * ended — `not-sent` / `sent` / `indeterminate` (`./send-attempt-types`) — and
+ * `prompt --json` publishes it as `lastSend`.
+ *
+ * The record carries a digest of the message, never the message: it says which
+ * message the state is about without keeping what was written.
+ *
+ * Nothing here resends. The sender (a person, or the supervising agent) decides,
+ * and an `indeterminate` message is not to be resent before looking at the pane.
+ *
+ * In memory on `globalThis` (the send route and the observing route are bundled
+ * apart under `next dev`), bounded; a restart forgets every record, which
+ * publishes as "no record", never as a state.
+ *
+ * Recording must never change a send's outcome: {@link recordSendAttempt}
+ * swallows its own failures.
+ *
+ * @module lib/session/send-attempt-state
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sendMessageDigest = sendMessageDigest;
+exports.recordSendAttempt = recordSendAttempt;
+exports.getLastSendAttempt = getLastSendAttempt;
+exports.clearSendAttempts = clearSendAttempts;
+exports.classifySendFailure = classifySendFailure;
+exports.composerHoldsMessage = composerHoldsMessage;
+exports.describeSendAttemptState = describeSendAttemptState;
+const crypto_1 = require("crypto");
+const global_state_1 = require("../../lib/global-state");
+const logger_1 = require("../../lib/logger");
+const session_start_error_1 = require("../../lib/session/session-start-error");
+const send_attempt_types_1 = require("./send-attempt-types");
+const logger = (0, logger_1.createLogger)('session/send-attempt-state');
+/** How many instances are tracked at once; the least recently sent to is forgotten first. */
+const MAX_TRACKED_INSTANCES = 1024;
+const records = (0, global_state_1.getOrInitGlobal)('__sendAttemptRecords', () => new Map());
+function keyOf(instance) {
+    return JSON.stringify([instance.worktreeId, instance.cliToolId, instance.instanceId]);
+}
+/** The digest a record carries for `content`. */
+function sendMessageDigest(content) {
+    return (0, crypto_1.createHash)('sha256').update(content, 'utf8').digest('hex').slice(0, 16);
+}
+/**
+ * Record how a send attempt ended. Never throws: a record that cannot be made
+ * leaves the send exactly as it was.
+ */
+function recordSendAttempt(instance, attempt, now = Date.now()) {
+    try {
+        const key = keyOf(instance);
+        // Re-inserted, so the map's order is least recently sent to first.
+        records.delete(key);
+        records.set(key, {
+            at: Math.floor(now),
+            state: attempt.state,
+            reason: attempt.reason,
+            messageDigest: sendMessageDigest(attempt.content),
+        });
+        while (records.size > MAX_TRACKED_INSTANCES) {
+            const oldest = records.keys().next().value;
+            if (oldest === undefined)
+                break;
+            records.delete(oldest);
+        }
+    }
+    catch (error) {
+        logger.warn('send-attempt-record-failed', { error: error instanceof Error ? error.message : String(error) });
+    }
+}
+/** The instance's last recorded attempt, or null when none is held. */
+function getLastSendAttempt(instance) {
+    return records.get(keyOf(instance)) ?? null;
+}
+/** Forget every record (tests). */
+function clearSendAttempts() {
+    records.clear();
+}
+/**
+ * Where a failed `ICLITool.sendMessage` stopped, read from its error.
+ *
+ * Only failures whose wording says the body was never typed are `not-sent`;
+ * every other failure is `indeterminate`, because "we do not know" must never
+ * read as "safe to resend". The tools wrap these messages
+ * (`Failed to send message to <tool>: …`), so they are matched anywhere in it.
+ */
+function classifySendFailure(error) {
+    if (typeof error === 'object' &&
+        error !== null &&
+        error.code === session_start_error_1.SESSION_STARTING_CODE) {
+        return { state: 'not-sent', reason: 'session-starting' };
+    }
+    // #3772: the plan review overlay refused the send before the body was typed.
+    if (typeof error === 'object' &&
+        error !== null &&
+        error.code === send_attempt_types_1.PLAN_REVIEW_SEND_REFUSED_CODE) {
+        return { state: 'not-sent', reason: 'plan-review' };
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    // The readiness waits of every tool throw before typing anything.
+    if (/prompt not ready/i.test(message))
+        return { state: 'not-sent', reason: 'prompt-not-ready' };
+    // #1880: refused before the body, after only the clear keys (C-e / C-u).
+    if (/still holds unsent text after \d+ clear passes/.test(message)) {
+        return { state: 'not-sent', reason: 'composer-not-empty' };
+    }
+    // #2464 / #3366: typed, never submitted, taken back out best-effort.
+    if (/Enter was not pressed, so nothing was submitted/.test(message)) {
+        return { state: 'indeterminate', reason: 'body-not-landed' };
+    }
+    // #1501: the input line was cleared best-effort.
+    if (/replaced by a TUI autocompletion/.test(message)) {
+        return { state: 'indeterminate', reason: 'replaced-by-completion' };
+    }
+    // #1471: typed, Enter sent (more than once), never confirmed.
+    if (/submit could not be confirmed/i.test(message)) {
+        return { state: 'indeterminate', reason: 'submit-unconfirmed' };
+    }
+    return { state: 'indeterminate', reason: 'send-error' };
+}
+/** The whitespace-free form two renderings of one text share. */
+function compact(text) {
+    return text.replace(/\s+/g, '');
+}
+/**
+ * Whether a composer read (`extractComposerText(...).text`) still holds the
+ * message: its compacted text contains the compacted start of the message's
+ * first non-blank line. Only the start, because a long body is cut by the
+ * reader and wrapped by the TUI.
+ */
+function composerHoldsMessage(composerText, content) {
+    const firstLine = content.split('\n').find((line) => line.trim() !== '') ?? '';
+    const needle = compact(firstLine).slice(0, 32);
+    return needle !== '' && compact(composerText).includes(needle);
+}
+/** One line for a failed send's error: what state the message is in, and who resends it. */
+function describeSendAttemptState(attempt) {
+    if (attempt.state === 'not-sent') {
+        return (`[send state: not-sent (${attempt.reason}): the message was not typed. ` +
+            'CommandMate does not resend it; send it again once the input prompt is back ' +
+            '(`commandmate prompt <worktree-id> --json` shows the screen and lastSend).]');
+    }
+    if (attempt.state === 'indeterminate') {
+        return (`[send state: indeterminate (${attempt.reason}): part of the message may have been typed or submitted. ` +
+            'CommandMate does not resend it; do not resend before checking the pane ' +
+            '(`commandmate capture <worktree-id> --pane`), or it may arrive twice.]');
+    }
+    return `[send state: sent (${attempt.reason})]`;
+}

package/dist/server/src/lib/session/send-attempt-types.js

@@ -0,0 +1,17 @@
+"use strict";
+/**
+ * What the last send to an instance did to its pane (Issue #3759): types only.
+ *
+ * Kept free of imports so the CLI can read the payload's shape through
+ * `lib/prompt-observation/types` without pulling the server graph in (the same
+ * rule `polling/auto-yes-suppression-reason` follows).
+ *
+ * @module lib/session/send-attempt-types
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PLAN_REVIEW_SEND_REFUSED_CODE = void 0;
+/**
+ * `code` on the error a tool throws when a plan review overlay refuses the
+ * send before any body is typed (Issue #3772). Matched by code, never by wording.
+ */
+exports.PLAN_REVIEW_SEND_REFUSED_CODE = 'PLAN_REVIEW_SEND_REFUSED';