commandmate 0.48.0 → 0.49.1

package/dist/server/src/lib/cli-tools/antigravity.js

@@ -30,6 +30,7 @@ const logger_1 = require("../../lib/logger");
 const cli_tool_timing_config_1 = require("../../config/cli-tool-timing-config");
 const launch_screen_1 = require("../../lib/session/launch-screen");
 const errors_1 = require("../../lib/errors");
+const instance_input_lock_1 = require("../../lib/session/instance-input-lock");
 const logger = (0, logger_1.createLogger)('cli-tools/antigravity');
 /**
  * Single-quote a value for safe embedding in a shell command typed into a
@@ -308,6 +309,7 @@ class AntigravityTool extends base_1.BaseCLITool {
         let lastCaptureError;
         for (let i = 0; i < ANTIGRAVITY_INIT_MAX_ATTEMPTS; i++) {
             try {
+                const readMark = (0, instance_input_lock_1.instanceInputReadMark)();
                 const rawOutput = await (0, tmux_1.capturePane)(sessionName, 50);
                 const output = (0, cli_patterns_1.stripAnsi)(rawOutput);
                 lastOutput = rawOutput;
@@ -323,11 +325,17 @@ class AntigravityTool extends base_1.BaseCLITool {
                 if (!trustDialogHandled) {
                     const decision = (0, launch_dialog_1.decideLaunchDialog)(launch_dialog_1.ANTIGRAVITY_TRUST_LAUNCH_DIALOG, output);
                     if (decision.action === 'press' && !(0, antigravity_startup_trust_1.isStartupTrustHeld)(sessionName)) {
-                        await (0, tmux_1.sendSpecialKey)(sessionName, decision.key);
-                        trustDialogHandled = true;
-                        logger.info('auto-trusted-folder-for-antigravity');
-                        await new Promise((resolve) => setTimeout(resolve, ANTIGRAVITY_DIALOG_SETTLE_MS));
-                        continue;
+                        // Issue #3952: typed as the composer's writer, and only while the
+                        // screen still asks for this key once a send holding it is over.
+                        const key = decision.key;
+                        const outcome = await (0, instance_input_lock_1.answerUnderInstanceInputLock)(sessionName, readMark, () => this.isTrustPressStill(sessionName, key), () => (0, tmux_1.sendSpecialKey)(sessionName, key));
+                        if (outcome.answered) {
+                            trustDialogHandled = true;
+                            logger.info('auto-trusted-folder-for-antigravity');
+                            await new Promise((resolve) => setTimeout(resolve, ANTIGRAVITY_DIALOG_SETTLE_MS));
+                            continue;
+                        }
+                        logger.info('antigravity-trust-answer-skipped', { sessionName, reason: outcome.reason });
                     }
                     logTrustDecisionOnce(sessionName, decision, loggedTrustDecisions);
                 }
@@ -354,6 +362,16 @@ class AntigravityTool extends base_1.BaseCLITool {
             ...(lastCaptureError !== undefined ? { lastCaptureError } : {}),
         });
     }
+    /**
+     * Whether a fresh read still shows the trust screen with `key` as its answer
+     * — the re-check an automatic trust answer makes once it owns the composer
+     * after another writer (Issue #3952).
+     */
+    async isTrustPressStill(sessionName, key) {
+        const output = (0, cli_patterns_1.stripAnsi)(await (0, tmux_1.capturePane)(sessionName, 50));
+        const decision = (0, launch_dialog_1.decideLaunchDialog)(launch_dialog_1.ANTIGRAVITY_TRUST_LAUNCH_DIALOG, output);
+        return decision.action === 'press' && decision.key === key;
+    }
     /**
      * Wait for agy's prompt before sending a message.
      * Mirrors CodexTool.waitForPrompt: throws on timeout so a failed readiness
@@ -380,6 +398,7 @@ class AntigravityTool extends base_1.BaseCLITool {
         let lastCaptureError;
         while (Date.now() < deadline) {
             try {
+                const readMark = (0, instance_input_lock_1.instanceInputReadMark)();
                 const rawOutput = await (0, tmux_1.capturePane)(sessionName, 50);
                 const output = (0, cli_patterns_1.stripAnsi)(rawOutput);
                 lastOutput = rawOutput;
@@ -395,8 +414,22 @@ class AntigravityTool extends base_1.BaseCLITool {
                 if (trustDecision !== null && trustDecision.action !== 'press' && (0, antigravity_startup_trust_1.isStartupTrustPending)(sessionName)) {
                     logTrustDecisionOnce(sessionName, trustDecision, loggedTrustDecisions);
                 }
-                if (trustDecision?.action === 'press' && (0, antigravity_startup_trust_1.claimStartupTrust)(sessionName)) {
-                    await (0, tmux_1.sendSpecialKey)(sessionName, trustDecision.key);
+                // Issue #3952: claimed and typed as the composer's writer. The claim is
+                // made only once the screen has been read again after a send holding
+                // the composer, so a screen that moved meanwhile keeps the Enter owed.
+                const pressKey = trustDecision?.action === 'press' ? trustDecision.key : null;
+                const claimed = pressKey !== null && (0, antigravity_startup_trust_1.isStartupTrustPending)(sessionName)
+                    ? await (0, instance_input_lock_1.answerUnderInstanceInputLock)(sessionName, readMark, () => this.isTrustPressStill(sessionName, pressKey), async () => {
+                        if (!(0, antigravity_startup_trust_1.claimStartupTrust)(sessionName))
+                            return false;
+                        await (0, tmux_1.sendSpecialKey)(sessionName, pressKey);
+                        return true;
+                    })
+                    : null;
+                if (claimed !== null && !claimed.answered) {
+                    logger.info('antigravity-trust-answer-skipped', { sessionName, reason: claimed.reason, afterLaunchWindow: true });
+                }
+                if (claimed?.answered === true && claimed.value) {
                     logger.info('auto-trusted-folder-for-antigravity', { sessionName, afterLaunchWindow: true });
                     // A full ordinary window for agy to draw its prompt after the Enter.
                     deadline = Math.max(deadline, Date.now() + ANTIGRAVITY_PROMPT_WAIT_TIMEOUT_MS);

package/dist/server/src/lib/cli-tools/codex.js

@@ -21,6 +21,7 @@ const agent_session_lifecycle_1 = require("../../lib/session/agent-session-lifec
 const cli_tool_timing_config_1 = require("../../config/cli-tool-timing-config");
 const launch_screen_1 = require("../../lib/session/launch-screen");
 const errors_1 = require("../../lib/errors");
+const instance_input_lock_1 = require("../../lib/session/instance-input-lock");
 const logger = (0, logger_1.createLogger)('cli-tools/codex');
 /** Wait for Codex CLI to initialize after launch */
 const CODEX_INIT_WAIT_MS = 3000;
@@ -327,6 +328,7 @@ class CodexTool extends base_1.BaseCLITool {
         try {
             for (let i = 0; i < maxAttempts; i++) {
                 try {
+                    const readMark = (0, instance_input_lock_1.instanceInputReadMark)();
                     const rawOutput = await (0, tmux_1.capturePane)(sessionName, 50);
                     const output = (0, cli_patterns_1.stripAnsi)(rawOutput);
                     // Issue #2315: the hooks screens are judged BEFORE readiness, and the
@@ -343,7 +345,7 @@ class CodexTool extends base_1.BaseCLITool {
                     if (lifecycleScreen === 'hooks-review' ||
                         lifecycleScreen === 'hooks-list' ||
                         lifecycleScreen === 'hooks-detail') {
-                        const sent = await this.answerCodexHooksScreen(sessionName, lifecycleScreen, hooksScreenState, trustHooks);
+                        const sent = await this.answerCodexHooksScreen(sessionName, lifecycleScreen, hooksScreenState, trustHooks, readMark);
                         if (sent) {
                             await new Promise((resolve) => setTimeout(resolve, cli_tool_timing_config_1.CODEX_DIALOG_SETTLE_MS));
                             continue;
@@ -499,7 +501,20 @@ class CodexTool extends base_1.BaseCLITool {
                             // stray keypress -- an empty submit on the main prompt, or worst case the
                             // default "1. Update now" confirm if the key was dropped during a re-render.
                             // Send the digit alone and let the next poll observe the result.
-                            await (0, tmux_1.sendKeys)(sessionName, keyToSend, false);
+                            //
+                            // Issue #3952: as the composer's writer, and only while the update
+                            // dialog is still the active one once a send holding it is over.
+                            const digit = keyToSend;
+                            const updateOutcome = await (0, instance_input_lock_1.answerUnderInstanceInputLock)(sessionName, readMark, () => this.isActiveDialogStill(sessionName, 'update'), () => (0, tmux_1.sendKeys)(sessionName, digit, false));
+                            if (!updateOutcome.answered) {
+                                // Nothing typed: the install this lock covers never started.
+                                if (updateLockHeld) {
+                                    updateLockHeld = false;
+                                    (0, updates_1.releaseAgentUpdateLock)(CODEX_UPDATE_LOCK_TOOL);
+                                }
+                                logger.info('codex-update-dialog-answer-skipped', { sessionName, reason: updateOutcome.reason });
+                                continue;
+                            }
                             updateDialogHandled = true;
                             if (keyToSend === codex_update_dialog_config_1.CODEX_UPDATE_DIALOG_KEYS.update) {
                                 // codex is about to become `npm install`. The prompt this method
@@ -519,7 +534,11 @@ class CodexTool extends base_1.BaseCLITool {
                     // Numbered selection dialogs are dismissed by the number key above, so this
                     // branch is reached only when no number selection is pending.
                     if (activeDialog === 'press-enter') {
-                        await (0, tmux_1.sendSpecialKey)(sessionName, 'Enter');
+                        const enterOutcome = await (0, instance_input_lock_1.answerUnderInstanceInputLock)(sessionName, readMark, () => this.isActiveDialogStill(sessionName, 'press-enter'), () => (0, tmux_1.sendSpecialKey)(sessionName, 'Enter'));
+                        if (!enterOutcome.answered) {
+                            logger.info('codex-notification-answer-skipped', { sessionName, reason: enterOutcome.reason });
+                            continue;
+                        }
                         logger.info('dismissed-codex-notification');
                         await new Promise((resolve) => setTimeout(resolve, cli_tool_timing_config_1.CODEX_DIALOG_SETTLE_MS));
                         continue;
@@ -528,7 +547,11 @@ class CodexTool extends base_1.BaseCLITool {
                     // Options: › 1. Yes, continue / 2. No, quit
                     if (activeDialog === 'trust' && !trustDialogHandled) {
                         // Issue #890: number-key selection confirms instantly; no trailing Enter.
-                        await (0, tmux_1.sendKeys)(sessionName, '1', false);
+                        const trustOutcome = await (0, instance_input_lock_1.answerUnderInstanceInputLock)(sessionName, readMark, () => this.isActiveDialogStill(sessionName, 'trust'), () => (0, tmux_1.sendKeys)(sessionName, '1', false));
+                        if (!trustOutcome.answered) {
+                            logger.info('codex-trust-dialog-answer-skipped', { sessionName, reason: trustOutcome.reason });
+                            continue;
+                        }
                         trustDialogHandled = true;
                         logger.info('auto-trusted-folder-for-codex');
                         await new Promise((resolve) => setTimeout(resolve, cli_tool_timing_config_1.CODEX_DIALOG_SETTLE_MS));
@@ -556,6 +579,14 @@ class CodexTool extends base_1.BaseCLITool {
             }
         }
     }
+    /**
+     * Whether `dialog` is still codex's active dialog on a fresh read — the
+     * re-check an automatic launch answer makes once it owns the composer after
+     * another writer (Issue #3952).
+     */
+    async isActiveDialogStill(sessionName, dialog) {
+        return (0, cli_patterns_1.getCodexActiveDialog)((0, cli_patterns_1.stripAnsi)(await (0, tmux_1.capturePane)(sessionName, 50))) === dialog;
+    }
     /**
      * Send the one key that gets this pane off the hooks screen it is on
      * (Issue #2315).
@@ -590,9 +621,12 @@ class CodexTool extends base_1.BaseCLITool {
      * @param screen - The bottom-most active hooks screen, from `getCodexLifecycleDialog`
      * @param state - Per-screen budget, carried across polls by the caller
      * @param trust - Whether trust may be granted, from {@link shouldTrustCodexHooks}
-     * @returns True when a key was sent, false when this screen's budget is spent
+     * @param readMark - {@link instanceInputReadMark} taken before the frame that showed `screen` was read
+     * @returns True when a key was sent, or none was because the composer's writer
+     *   found the screen gone (Issue #3952) — either way the caller polls again;
+     *   false when this screen's budget is spent
      */
-    async answerCodexHooksScreen(sessionName, screen, state, trust) {
+    async answerCodexHooksScreen(sessionName, screen, state, trust, readMark) {
         if (state.screen !== screen) {
             // Progress. The pane moved, so the previous screen's spent attempts say
             // nothing about this one.
@@ -603,7 +637,22 @@ class CodexTool extends base_1.BaseCLITool {
             logger.warn('codex-hooks-screen-unresponsive', { sessionName, screen, trust });
             return false;
         }
-        const attempt = ++state.attempts;
+        const attempt = state.attempts + 1;
+        // Issue #3952: the key goes to the composer's tmux pane, so it waits for a
+        // send that holds it — and is not typed if the hooks screen it was chosen
+        // for is gone once that send is over. Inside `sendMessage` under
+        // `sendUserMessage`'s lock it joins that lock instead.
+        const outcome = await (0, instance_input_lock_1.answerUnderInstanceInputLock)(sessionName, readMark, async () => (0, cli_patterns_1.getCodexLifecycleDialog)((0, cli_patterns_1.stripAnsi)(await (0, tmux_1.capturePane)(sessionName, 50))) === screen, () => this.sendCodexHooksScreenKey(sessionName, screen, attempt, trust));
+        if (!outcome.answered) {
+            // Nothing was typed, so this screen's budget is not spent; poll again.
+            logger.info('codex-hooks-screen-answer-skipped', { sessionName, screen, reason: outcome.reason });
+            return true;
+        }
+        state.attempts = attempt;
+        return true;
+    }
+    /** The key {@link answerCodexHooksScreen} chose, typed as the composer's writer. */
+    async sendCodexHooksScreenKey(sessionName, screen, attempt, trust) {
         if (screen === 'hooks-review') {
             const key = attempt === 1
                 ? trust
@@ -614,18 +663,17 @@ class CodexTool extends base_1.BaseCLITool {
             // on the screen this key just opened.
             await (0, tmux_1.sendKeys)(sessionName, key, false);
             logger.info('codex-hooks-review-answered', { sessionName, key, attempt, trust });
-            return true;
+            return;
         }
         if (trust) {
             // `t`, the key screens 2 and 3 print in their own footers. Literal, so
             // tmux sends the character rather than resolving it as a key name.
             await (0, tmux_1.sendKeys)(sessionName, CODEX_HOOKS_TRUST_KEY, false, { literal: true });
             logger.info('codex-hooks-screen-trusted', { sessionName, screen, attempt });
-            return true;
+            return;
         }
         await (0, tmux_1.sendSpecialKey)(sessionName, 'Escape');
         logger.info('codex-hooks-screen-escaped', { sessionName, screen, attempt });
-        return true;
     }
     /**
      * Wait for Codex prompt before sending a message.
@@ -653,6 +701,7 @@ class CodexTool extends base_1.BaseCLITool {
         let trustHooks = null;
         while (Date.now() - startTime < CODEX_PROMPT_WAIT_TIMEOUT_MS) {
             try {
+                const readMark = (0, instance_input_lock_1.instanceInputReadMark)();
                 const rawOutput = await (0, tmux_1.capturePane)(sessionName, 50);
                 const output = (0, cli_patterns_1.stripAnsi)(rawOutput);
                 // Before readiness, for the reason `waitForReady` gives: a review screen
@@ -667,7 +716,7 @@ class CodexTool extends base_1.BaseCLITool {
                         const worktreePath = await (0, tmux_1.getSessionWorkingDirectory)(sessionName);
                         trustHooks = worktreePath !== null && (0, hooks_config_1.shouldTrustCodexHooks)(worktreePath);
                     }
-                    await this.answerCodexHooksScreen(sessionName, screen, hooksScreenState, trustHooks);
+                    await this.answerCodexHooksScreen(sessionName, screen, hooksScreenState, trustHooks, readMark);
                 }
                 else if ((0, cli_patterns_1.isCodexPromptReady)(output)) {
                     // Issue #890/#892: position-based guard so a residual update/trust dialog

package/dist/server/src/lib/cli-tools/command-code-plan-review.js

@@ -34,7 +34,7 @@
  * @module lib/cli-tools/command-code-plan-review
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PLAN_REVIEW_STEP_DELAY_MS = exports.PLAN_REVIEW_REFUSAL = exports.PLAN_REVIEW_ACTIONS = void 0;
+exports.PlanReviewInputLostError = exports.PLAN_REVIEW_STEP_DELAY_MS = exports.PLAN_REVIEW_REFUSAL = exports.PLAN_REVIEW_ACTIONS = void 0;
 exports.isPlanReviewAction = isPlanReviewAction;
 exports.planCommandCodePlanReviewKeys = planCommandCodePlanReviewKeys;
 exports.sendCommandCodePlanReviewKeys = sendCommandCodePlanReviewKeys;
@@ -153,15 +153,37 @@ function planCommandCodePlanReviewKeys(state, request) {
 }
 /** Pause between steps, so the TUI handles each one as its own input event. */
 exports.PLAN_REVIEW_STEP_DELAY_MS = 300;
+/**
+ * The plan review's keys stopped part-way (Issue #3952 review P2-3): the
+ * session's input was taken from the answer — the session was replaced — after
+ * `stepsSent` of its steps had gone out. The rest were not sent.
+ */
+class PlanReviewInputLostError extends Error {
+    stepsSent;
+    constructor(sessionName, stepsSent) {
+        super(`Session ${sessionName} was replaced while the plan review answer held its input; ` +
+            `${stepsSent} step(s) had been sent, the rest were not (Issue #3952).`);
+        this.stepsSent = stepsSent;
+        this.name = 'PlanReviewInputLostError';
+    }
+}
+exports.PlanReviewInputLostError = PlanReviewInputLostError;
 /**
  * Send the planned steps, one tmux invocation each.
  *
  * Key steps (including `C-r`) go through `sendSpecialKeys`; the comment text
  * goes through `-l` so it is never resolved as a key name.
+ *
+ * Issue #3952 review P2-3: given `isCurrent` (the input ticket the answer holds),
+ * it is asked before every step — after each wait — and a ticket that is no
+ * longer current stops the steps there ({@link PlanReviewInputLostError}), as
+ * the strict respond's keys stop.
  */
-async function sendCommandCodePlanReviewKeys(sessionName, steps, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))) {
+async function sendCommandCodePlanReviewKeys(sessionName, steps, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), isCurrent) {
     for (let i = 0; i < steps.length; i++) {
         const step = steps[i];
+        if (isCurrent !== undefined && !isCurrent())
+            throw new PlanReviewInputLostError(sessionName, i);
         if (step.kind === 'text') {
             await (0, tmux_1.sendKeys)(sessionName, step.text, false, { literal: true });
         }

package/dist/server/src/lib/cli-tools/copilot.js

@@ -24,6 +24,7 @@ exports.judgeCopilotModelSwitch = judgeCopilotModelSwitch;
 const base_1 = require("./base");
 const tmux_1 = require("../tmux/tmux");
 const submit_verified_sender_1 = require("./submit-verified-sender");
+const composer_clear_1 = require("../../lib/session/composer-clear");
 const tmux_capture_cache_1 = require("../tmux/tmux-capture-cache");
 const cli_patterns_1 = require("../detection/cli-patterns");
 const copilot_executable_1 = require("./copilot-executable");
@@ -37,6 +38,7 @@ const logger_1 = require("../../lib/logger");
 const install_hints_1 = require("./install-hints");
 const launch_window_1 = require("./launch-window");
 const launch_screen_1 = require("../../lib/session/launch-screen");
+const instance_input_lock_1 = require("../../lib/session/instance-input-lock");
 const logger = (0, logger_1.createLogger)('cli-tools/copilot');
 /** Interval for polling prompt detection */
 const COPILOT_POLL_INTERVAL_MS = 1000;
@@ -224,6 +226,33 @@ function judgeCopilotModelSwitch(before, output, modelName) {
     return { kind: 'pending' };
 }
 /** The pane's bottom non-blank row, squeezed, for an error message a person reads. */
+/**
+ * Throw unless `ticket` still owns the composer (Issue #3945): right before a
+ * key this module types itself, so a send whose session was replaced while it
+ * waited cannot type into the new one.
+ */
+function assertCopilotInputOwner(ticket, step) {
+    if (ticket.isCurrent())
+        return;
+    throw new Error(`Session ${ticket.sessionName} was handed to another writer before ${step}; input lock lost, nothing was typed (Issue #3945).`);
+}
+/**
+ * Type `text` + Enter as the composer's owner. A failure that may have put part
+ * of it on the pane (anything but a `send-keys` tmux never started,
+ * `TmuxSendError.delivery`) leaves the carried paste mark, as the shared
+ * sender's typed body does (review-2): the next send waits out what may still
+ * be drawn.
+ */
+async function typeLeavingMarkOnFailure(sessionName, text, ticket) {
+    try {
+        await (0, tmux_1.sendKeys)(sessionName, text, true);
+    }
+    catch (error) {
+        if (error?.delivery !== 'not-started')
+            (0, instance_input_lock_1.leaveCarriedPasteMark)(ticket);
+        throw error;
+    }
+}
 function describeBottomRow(output) {
     const lines = (0, cli_patterns_1.stripAnsi)(output).split('\n');
     for (let i = lines.length - 1; i >= 0; i--) {
@@ -397,15 +426,25 @@ class CopilotTool extends base_1.BaseCLITool {
      * `waiting`, and the send guard refuses a `waiting` session for as long as
      * that entry lives.
      *
+     * Issue #3952: the digit is typed as the composer's writer. A send that holds
+     * the composer is waited out, and the dialog is read again after it: when it
+     * is gone nothing is typed and false comes back, so the caller looks again on
+     * its next poll. Inside the selection-list branch's lock it joins that lock.
+     *
      * @param sessionName - tmux session name
      * @param output - ANSI-stripped pane capture
+     * @param readMark - {@link instanceInputReadMark} taken before `output` was read
      * @returns True when the dialog was found and answered
      */
-    async answerFolderTrustDialog(sessionName, output) {
+    async answerFolderTrustDialog(sessionName, output, readMark) {
         if (!(0, cli_patterns_1.isCopilotFolderTrustDialog)(output)) {
             return false;
         }
-        await (0, tmux_1.sendKeys)(sessionName, cli_patterns_1.COPILOT_FOLDER_TRUST_ANSWER_KEY, false);
+        const outcome = await (0, instance_input_lock_1.answerUnderInstanceInputLock)(sessionName, readMark, async () => (0, cli_patterns_1.isCopilotFolderTrustDialog)((0, cli_patterns_1.stripAnsi)(await (0, tmux_1.capturePane)(sessionName, 50))), () => (0, tmux_1.sendKeys)(sessionName, cli_patterns_1.COPILOT_FOLDER_TRUST_ANSWER_KEY, false));
+        if (!outcome.answered) {
+            logger.info('copilot-folder-trust-answer-skipped', { reason: outcome.reason });
+            return false;
+        }
         (0, launch_window_1.recordLaunchDialogPress)(sessionName);
         (0, tmux_capture_cache_1.invalidateCache)(sessionName);
         logger.info('copilot-folder-trust-answered');
@@ -477,6 +516,7 @@ class CopilotTool extends base_1.BaseCLITool {
         let trustDialogHandled = false;
         for (let i = 0; i < COPILOT_INIT_MAX_ATTEMPTS; i++) {
             try {
+                const readMark = (0, instance_input_lock_1.instanceInputReadMark)();
                 const rawOutput = await (0, tmux_1.capturePane)(sessionName, 50);
                 const output = (0, cli_patterns_1.stripAnsi)(rawOutput);
                 // Check if copilot's own composer is on screen
@@ -484,7 +524,7 @@ class CopilotTool extends base_1.BaseCLITool {
                     logger.info('copilot-prompt-detected');
                     return;
                 }
-                if (!trustDialogHandled && (await this.answerFolderTrustDialog(sessionName, output))) {
+                if (!trustDialogHandled && (await this.answerFolderTrustDialog(sessionName, output, readMark))) {
                     trustDialogHandled = true;
                 }
             }
@@ -541,6 +581,7 @@ class CopilotTool extends base_1.BaseCLITool {
         let output = '';
         while (Date.now() - startTime < timeoutMs) {
             try {
+                const readMark = (0, instance_input_lock_1.instanceInputReadMark)();
                 const rawOutput = await (0, tmux_1.capturePane)(sessionName, 50);
                 output = (0, cli_patterns_1.stripAnsi)(rawOutput);
                 if (this.isReadyFor(until, output)) {
@@ -555,7 +596,7 @@ class CopilotTool extends base_1.BaseCLITool {
                 // "Yes, and remember this folder" and writes the operator's
                 // machine-global ~/.copilot/config.json. Answer it here for the same
                 // reason the launch path does, rather than leaving the worse outcome.
-                if (!trustDialogHandled && (await this.answerFolderTrustDialog(sessionName, output))) {
+                if (!trustDialogHandled && (await this.answerFolderTrustDialog(sessionName, output, readMark))) {
                     trustDialogHandled = true;
                 }
             }
@@ -641,19 +682,48 @@ class CopilotTool extends base_1.BaseCLITool {
         // same pane when the tool is gone; costs one `capture-pane` when it is not.
         await this.requireSession('Copilot', worktreeId, instanceId, { relaunch: true });
         try {
-            // Verify Copilot is at prompt state before sending
-            await this.waitForPrompt(sessionName);
             // Check if this is a slash command that triggers a selection list
             const slashCmd = this.extractSlashCommand(message);
             if (slashCmd && SELECTION_LIST_COMMANDS.has(slashCmd)) {
                 // For selection list commands: send text + Enter, then wait for
                 // the selection list to appear. Do NOT send additional input after.
-                await (0, tmux_1.sendKeys)(sessionName, message, true);
-                await this.waitForSelectionList(sessionName);
+                //
+                // Issue #3945: this types into the composer without the shared sender,
+                // so it takes the instance's input lock itself — from the readiness
+                // read (fresh, under the lock) to the picker that answers it — and
+                // waits out a carried paste mark first, as a normal send does.
+                await (0, instance_input_lock_1.withInstanceInputLock)(sessionName, async (ticket) => {
+                    await (0, instance_input_lock_1.waitOutCarriedPasteMark)(ticket);
+                    // review-2: a composer that never came up (a dialog, an unreadable
+                    // pane, a time-out) is not typed into. The shared sender's re-check
+                    // then refuses on the same terms right before the keys: a dialog is
+                    // `prompt-waiting`, a pane that cannot be read `recheck-failed`.
+                    const prompt = await this.waitForPrompt(sessionName);
+                    await (0, composer_clear_1.recheckComposerBeforeInput)(sessionName, 'copilot');
+                    if (!prompt.ready) {
+                        // review-3: neither the request nor the pane goes into the message.
+                        // `classifySendFailure` reads the wording, and its "may have been
+                        // typed" rules come first — a body or a screen saying `submit could
+                        // not be confirmed` would turn this refusal into `indeterminate`.
+                        logger.warn('copilot-selection-list-not-sent:prompt-not-ready', {
+                            command: slashCmd,
+                            bottomRow: describeBottomRow(prompt.output),
+                        });
+                        throw new Error(`copilot prompt not ready within ${COPILOT_PROMPT_WAIT_TIMEOUT_MS}ms, ` +
+                            'so the selection-list command was not sent; nothing was typed');
+                    }
+                    assertCopilotInputOwner(ticket, 'the selection-list command');
+                    // Issue #3953: the send's stamp, as the shared sender takes it.
+                    (0, instance_input_lock_1.noteInputStart)();
+                    await typeLeavingMarkOnFailure(sessionName, message, ticket);
+                    await this.waitForSelectionList(sessionName);
+                });
                 (0, tmux_capture_cache_1.invalidateCache)(sessionName);
                 logger.info('sent-selection-list-command-to-copilot', { command: slashCmd });
                 return;
             }
+            // Verify Copilot is at prompt state before sending
+            await this.waitForPrompt(sessionName);
             // Issue #1471: Body/Enter separation + read-back submit verification via the
             // shared helper (replaces the old type -> C-m -> `\n`-gated paste recovery).
             // Copilot's own text-input / post-Enter delays are preserved. The selection
@@ -731,32 +801,52 @@ class CopilotTool extends base_1.BaseCLITool {
         const sessionName = this.getSessionName(worktreeId, instanceId);
         await this.requireSession('Copilot', worktreeId, instanceId, { relaunch: false });
         try {
-            const idle = await this.waitForPrompt(sessionName, copilot_constants_1.COPILOT_MODEL_SWITCH_TIMEOUT_MS, 'idle');
-            if (!idle.ready) {
-                throw new Error(`copilot did not become idle within ${copilot_constants_1.COPILOT_MODEL_SWITCH_TIMEOUT_MS}ms, so /model was not sent ` +
-                    `(bottom row: ${describeBottomRow(idle.output)})`);
-            }
-            const before = readCopilotModelSwitchOutcomes(idle.output, modelName);
-            // Send /model <modelName> command with Enter. An argument means an
-            // in-place switch, never a picker (Issue #1895).
-            await (0, tmux_1.sendKeys)(sessionName, `/model ${modelName}`, true);
-            const verdict = await this.waitForModelSwitchOutcome(sessionName, modelName, before);
-            (0, tmux_capture_cache_1.invalidateCache)(sessionName);
-            if (verdict.kind === 'rejected') {
-                logger.warn('copilot-model-rejected', { model: modelName, reason: verdict.reason });
-                throw new Error(`copilot refused it: ${verdict.reason}`);
-            }
-            if (verdict.kind === 'pending') {
-                logger.warn('copilot-model-switch-unconfirmed', { model: modelName, bottomRow: verdict.bottomRow });
-                throw new Error(`copilot printed no answer to /model within ${copilot_constants_1.COPILOT_MODEL_SWITCH_TIMEOUT_MS}ms ` +
-                    `(bottom row: ${verdict.bottomRow}); the switch may still take effect, and nothing further was typed`);
-            }
-            logger.info('copilot-model-switched', { model: modelName });
+            // Issue #3945: `/model` is typed into the composer, so it is one writer's
+            // turn like the selection-list branch — from the idle read to the answer.
+            await (0, instance_input_lock_1.withInstanceInputLock)(sessionName, (ticket) => this.switchModelUnderInputLock(sessionName, modelName, ticket));
         }
         catch (error) {
             const errorMessage = (0, errors_1.getErrorMessage)(error);
-            throw new Error(`Failed to switch Copilot model to ${modelName}: ${errorMessage}`);
+            // Issue #3952: the re-check's `code` is kept, so the caller records a
+            // dialog or an unreadable pane as such rather than as a refused model.
+            const code = error?.code;
+            throw Object.assign(new Error(`Failed to switch Copilot model to ${modelName}: ${errorMessage}`), typeof code === 'string' ? { code } : {});
+        }
+    }
+    /** {@link sendModelCommand}'s keys and waits, as the composer's only writer (Issue #3945). */
+    async switchModelUnderInputLock(sessionName, modelName, ticket) {
+        // A previous send's body may still arrive (review-1 #5): `/model` waits it
+        // out like a normal send, and the idle read below is the one after the wait.
+        await (0, instance_input_lock_1.waitOutCarriedPasteMark)(ticket);
+        const idle = await this.waitForPrompt(sessionName, copilot_constants_1.COPILOT_MODEL_SWITCH_TIMEOUT_MS, 'idle');
+        if (!idle.ready) {
+            // The pane's text goes to the log, not the message: the message is read by
+            // `classifySendFailure`, which a screen quoting its keywords would steer (#3954).
+            logger.warn('copilot-model-switch-not-idle', { model: modelName, bottomRow: describeBottomRow(idle.output) });
+            throw new Error(`copilot did not become idle within ${copilot_constants_1.COPILOT_MODEL_SWITCH_TIMEOUT_MS}ms, so /model was not sent`);
+        }
+        const before = readCopilotModelSwitchOutcomes(idle.output, modelName);
+        // Issue #3952: "idle, so no dialog" holds for the frame that was read, not
+        // for the moment the keys go out. The pane is read once more right before
+        // them, as every send is: a dialog is `prompt-waiting`, a pane that cannot
+        // be read `recheck-failed`, and nothing is typed in either case.
+        await (0, composer_clear_1.recheckComposerBeforeInput)(sessionName, 'copilot');
+        // Send /model <modelName> command with Enter. An argument means an
+        // in-place switch, never a picker (Issue #1895).
+        assertCopilotInputOwner(ticket, '/model');
+        await typeLeavingMarkOnFailure(sessionName, `/model ${modelName}`, ticket);
+        const verdict = await this.waitForModelSwitchOutcome(sessionName, modelName, before);
+        (0, tmux_capture_cache_1.invalidateCache)(sessionName);
+        if (verdict.kind === 'rejected') {
+            logger.warn('copilot-model-rejected', { model: modelName, reason: verdict.reason });
+            throw new Error(`copilot refused it: ${verdict.reason}`);
+        }
+        if (verdict.kind === 'pending') {
+            logger.warn('copilot-model-switch-unconfirmed', { model: modelName, bottomRow: verdict.bottomRow });
+            throw new Error(`copilot printed no answer to /model within ${copilot_constants_1.COPILOT_MODEL_SWITCH_TIMEOUT_MS}ms; ` +
+                'the switch may still take effect, and nothing further was typed');
         }
+        logger.info('copilot-model-switched', { model: modelName });
     }
     /**
      * Poll until `/model <modelName>` has answered (Issue #2623).

package/dist/server/src/lib/cli-tools/gemini.js

@@ -25,6 +25,7 @@ const launch_screen_1 = require("../../lib/session/launch-screen");
 const errors_1 = require("../../lib/errors");
 const launch_dialog_1 = require("./launch-dialog");
 const launch_window_1 = require("./launch-window");
+const instance_input_lock_1 = require("../../lib/session/instance-input-lock");
 const logger = (0, logger_1.createLogger)('cli-tools/gemini');
 /** Wait for Gemini CLI to initialize after launch (banner + auth + dialog) */
 const GEMINI_INIT_WAIT_MS = 6000;
@@ -106,7 +107,11 @@ class GeminiTool extends base_1.BaseCLITool {
             // trust dialog is this launch's to answer; the Auto-Yes poller leaves it.
             (0, launch_window_1.beginLaunchWindow)(sessionName);
             try {
-                await (0, tmux_1.sendKeys)(sessionName, (0, launch_screen_1.withLaunchScreenCleared)(launchCommand), true);
+                // Issue #3975: the launch line is one writer's turn, so a send's body
+                // already in the pane is not run as part of it. Only the keys: the
+                // waits below stay outside the lock, where a send waiting for the
+                // prompt cannot be held behind them.
+                await (0, instance_input_lock_1.withInstanceInputLock)(sessionName, () => (0, tmux_1.sendKeys)(sessionName, (0, launch_screen_1.withLaunchScreenCleared)(launchCommand), true));
                 // Wait for Gemini to initialize (minimum wait for banner/auth)
                 await new Promise((resolve) => setTimeout(resolve, GEMINI_INIT_WAIT_MS));
                 // Poll until Gemini interactive prompt is ready
@@ -139,6 +144,8 @@ class GeminiTool extends base_1.BaseCLITool {
         const loggedDecisions = new Set();
         for (let i = 0; i < GEMINI_INIT_MAX_ATTEMPTS; i++) {
             try {
+                // Issue #3975: taken before the read the trust Enter is decided on.
+                const readMark = (0, instance_input_lock_1.instanceInputLaunchReadMark)();
                 const rawOutput = await (0, tmux_1.capturePane)(sessionName, capture_spec_1.GEMINI_PANE_HEIGHT);
                 // Strip ANSI escape codes before pattern matching
                 // (Gemini TUI uses 24-bit color codes that break regex matching)
@@ -152,14 +159,26 @@ class GeminiTool extends base_1.BaseCLITool {
                 if (!trustDialogHandled) {
                     const decision = (0, launch_dialog_1.decideLaunchDialog)(launch_dialog_1.GEMINI_TRUST_LAUNCH_DIALOG, output);
                     if (decision.action === 'press') {
-                        await (0, tmux_1.sendSpecialKey)(sessionName, decision.key);
-                        trustDialogHandled = true;
-                        trustPressedAt = Date.now();
-                        // Issue #3790: the poller leaves the answered dialog alone even if
-                        // the window closes before gemini redraws it.
-                        (0, launch_window_1.recordLaunchDialogPress)(sessionName, trustPressedAt);
-                        logger.info('auto-trusted-folder-for-gemini');
-                        // Continue polling for prompt after trust dialog
+                        // Issue #3975: the Enter as an `exclusive` writer, so it never lands
+                        // inside a send's body, paste or Enter; a send that came between
+                        // the read and the lock makes the dialog be read again first.
+                        const pressed = await (0, instance_input_lock_1.answerUnderInstanceInputLock)(sessionName, readMark, async () => {
+                            const again = (0, launch_dialog_1.decideLaunchDialog)(launch_dialog_1.GEMINI_TRUST_LAUNCH_DIALOG, (0, cli_patterns_1.stripAnsi)(await (0, tmux_1.capturePane)(sessionName, capture_spec_1.GEMINI_PANE_HEIGHT)));
+                            return again.action === 'press' && again.key === decision.key;
+                        }, () => (0, tmux_1.sendSpecialKey)(sessionName, decision.key), { mode: 'exclusive' });
+                        if (pressed.answered) {
+                            trustDialogHandled = true;
+                            trustPressedAt = Date.now();
+                            // Issue #3790: the poller leaves the answered dialog alone even if
+                            // the window closes before gemini redraws it.
+                            (0, launch_window_1.recordLaunchDialogPress)(sessionName, trustPressedAt);
+                            logger.info('auto-trusted-folder-for-gemini');
+                            // Continue polling for prompt after trust dialog
+                        }
+                        else {
+                            // Not answered this poll; the next one reads the screen again.
+                            logger.info('gemini-trust-answer-skipped', { sessionName, reason: pressed.reason });
+                        }
                     }
                     else {
                         const warning = (0, launch_dialog_1.launchDialogWarning)(launch_dialog_1.GEMINI_TRUST_LAUNCH_DIALOG, decision);