commandmate 0.49.0 → 0.49.1

package/dist/cli/utils/reply-ledger.d.ts

@@ -77,6 +77,85 @@ export declare function replyCandidates(messages: PromptMessageResponse[], since
  * @param turnRowsOnly - Whether an unmarked (scraped) row may stand in
  */
 export declare function pickLatestReply(candidates: ReplyCandidate[], turnRowsOnly: boolean): ReplyCandidate | null;
+/**
+ * Whether another message reached this instance inside `[since, until]`
+ * (Issue #3955).
+ *
+ * codex folds a message typed while a turn is running into that same turn and
+ * answers both with one reply, so an `ask` whose turn also carried somebody
+ * else's message cannot know which of the two the reply answers. The ledger
+ * shows it: `/send` writes a `user` row for every message the instant it is
+ * handed to the pane, so a `user` row in this instance's window whose text is
+ * not this `ask`'s own is a second sender's.
+ *
+ * Text, not id, tells the rows apart: the transcript reader claims the `/send`
+ * row rather than writing a second one (`user-turn-recorder`), so this `ask`'s
+ * own message is one row, or one plus a reader's copy with the same text.
+ *
+ * @param messages - Rows as the messages route serialized them
+ * @param ownContent - The message this `ask` sent
+ * @param since - Epoch ms taken before the send
+ * A row on another instance is not this turn's: `instanceId` keeps a read that
+ * was not scoped to one instance (no `--instance` / `--agent`) from counting a
+ * message somebody sent to a different session. Without it every row counts,
+ * which is right only for a read the server already scoped.
+ *
+ * @param until - Epoch ms at which the turn ended
+ * @param instanceId - The instance this `ask`'s message went to
+ */
+export declare function hasForeignPromptInWindow(messages: PromptMessageResponse[], ownContent: string, since: number, until: number, instanceId?: string): boolean;
+/**
+ * The one instance this `ask`'s own `user` row landed on, or null
+ * (Issue #3955).
+ *
+ * An `ask` with no `--instance` / `--agent` leaves the choice to the server,
+ * and `/send` does not say which it picked to this caller. The ledger does: the
+ * row `/send` wrote carries it. Two rows with this text on different instances
+ * (the same request sent to two sessions at once) say nothing certain, so that
+ * is null too.
+ *
+ * @param messages - Rows as the messages route serialized them
+ * @param ownContent - The message this `ask` sent
+ * Bounded on both sides, like {@link hasForeignPromptInWindow}: the same text
+ * sent to another instance after this turn ended is somebody else's later
+ * request, and must not make this one's instance undecided.
+ *
+ * @param since - Epoch ms taken before the send
+ * @param until - Epoch ms at which the turn ended (`ask` always passes it;
+ *   unbounded when omitted)
+ */
+export declare function ownPromptInstance(messages: PromptMessageResponse[], ownContent: string, since: number, until?: number): string | null;
+/**
+ * User turns read back per page by {@link fetchPromptRowsSince}.
+ *
+ * The route's `unit=pairs` counts user rows, so a turn that wrote many
+ * assistant rows cannot push a user row out of the page the way it can out of
+ * {@link REPLY_LOOKBACK_MESSAGES} rows.
+ */
+export declare const PROMPT_ROWS_PAGE_TURNS = 20;
+/**
+ * Whether a read of {@link REPLY_LOOKBACK_MESSAGES} rows may have cut off rows
+ * stamped at or after `since` (Issue #3955): it came back full and its oldest
+ * row is not older than `since`.
+ */
+export declare function mayHaveDroppedRowsSince(messages: PromptMessageResponse[], since: number): boolean;
+/**
+ * Every `user` row stamped at or after `since`, however many rows came after
+ * it (Issue #3955), or null if the rows cannot be read.
+ *
+ * Pages backwards with the route's existing `unit=pairs` and `before`: a page
+ * holds the newest {@link PROMPT_ROWS_PAGE_TURNS} user rows and every row from
+ * the oldest of them on, so the next page's `before` (that oldest timestamp)
+ * leaves no user row between two pages. Stops at the first page that reaches
+ * back past `since`, or that holds fewer user rows than asked for (nothing
+ * older is left).
+ *
+ * @param client - API client
+ * @param worktreeId - Worktree ID
+ * @param instanceId - Instance to scope to, or undefined for every instance
+ * @param since - Epoch ms taken before the send
+ */
+export declare function fetchPromptRowsSince(client: ApiClient, worktreeId: string, instanceId: string | undefined, since: number): Promise<PromptMessageResponse[] | null>;
 /**
  * The recent chat rows for this instance. Throws what the API client throws.
  *

package/dist/cli/utils/reply-ledger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reply-ledger.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/reply-ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,KAAK,CAAC;AA4B1C;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,EAAE,WAAW,CAAC,MAAM,CAMtD,CAAC;AAcH;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjD;AAaD,iDAAiD;AACjD,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,cAAc,EAAE,OAAO,CAAC;IACxB,kEAAkE;IAClE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,oEAAoE;IACpE,EAAE,EAAE,MAAM,CAAC;CACZ;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,qBAAqB,EAAE,EACjC,KAAK,EAAE,MAAM,GACZ,cAAc,EAAE,CAkBlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,cAAc,EAAE,EAC5B,YAAY,EAAE,OAAO,GACpB,cAAc,GAAG,IAAI,CAMvB;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAUlC;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,OAAO,CAAC,qBAAqB,EAAE,GAAG,IAAI,CAAC,CAMzC"}
+{"version":3,"file":"reply-ledger.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/reply-ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,KAAK,CAAC;AA4B1C;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,EAAE,WAAW,CAAC,MAAM,CAMtD,CAAC;AAcH;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEjD;AAaD,iDAAiD;AACjD,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,cAAc,EAAE,OAAO,CAAC;IACxB,kEAAkE;IAClE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,oEAAoE;IACpE,EAAE,EAAE,MAAM,CAAC;CACZ;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,qBAAqB,EAAE,EACjC,KAAK,EAAE,MAAM,GACZ,cAAc,EAAE,CAkBlB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,cAAc,EAAE,EAC5B,YAAY,EAAE,OAAO,GACpB,cAAc,GAAG,IAAI,CAMvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,qBAAqB,EAAE,EACjC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAST;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,qBAAqB,EAAE,EACjC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,KAAK,GAAE,MAAiC,GACvC,MAAM,GAAG,IAAI,CAWf;AAED;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,qBAAqB,EAAE,EACjC,KAAK,EAAE,MAAM,GACZ,OAAO,CAIT;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,qBAAqB,EAAE,GAAG,IAAI,CAAC,CAsBzC;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAUlC;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,OAAO,CAAC,qBAAqB,EAAE,GAAG,IAAI,CAAC,CAMzC"}

package/dist/cli/utils/reply-ledger.js

@@ -18,10 +18,14 @@
  * and whether an unmarked row may stand in for one — stays with the caller.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TRANSCRIPT_READER_TOOLS = exports.REPLY_LOOKBACK_MESSAGES = void 0;
+exports.PROMPT_ROWS_PAGE_TURNS = exports.TRANSCRIPT_READER_TOOLS = exports.REPLY_LOOKBACK_MESSAGES = void 0;
 exports.sanitizeReply = sanitizeReply;
 exports.replyCandidates = replyCandidates;
 exports.pickLatestReply = pickLatestReply;
+exports.hasForeignPromptInWindow = hasForeignPromptInWindow;
+exports.ownPromptInstance = ownPromptInstance;
+exports.mayHaveDroppedRowsSince = mayHaveDroppedRowsSince;
+exports.fetchPromptRowsSince = fetchPromptRowsSince;
 exports.requestRecentMessages = requestRecentMessages;
 exports.fetchRecentMessages = fetchRecentMessages;
 /**
@@ -154,6 +158,142 @@ function pickLatestReply(candidates, turnRowsOnly) {
         return null;
     return candidates[candidates.length - 1] ?? null;
 }
+/**
+ * Whether another message reached this instance inside `[since, until]`
+ * (Issue #3955).
+ *
+ * codex folds a message typed while a turn is running into that same turn and
+ * answers both with one reply, so an `ask` whose turn also carried somebody
+ * else's message cannot know which of the two the reply answers. The ledger
+ * shows it: `/send` writes a `user` row for every message the instant it is
+ * handed to the pane, so a `user` row in this instance's window whose text is
+ * not this `ask`'s own is a second sender's.
+ *
+ * Text, not id, tells the rows apart: the transcript reader claims the `/send`
+ * row rather than writing a second one (`user-turn-recorder`), so this `ask`'s
+ * own message is one row, or one plus a reader's copy with the same text.
+ *
+ * @param messages - Rows as the messages route serialized them
+ * @param ownContent - The message this `ask` sent
+ * @param since - Epoch ms taken before the send
+ * A row on another instance is not this turn's: `instanceId` keeps a read that
+ * was not scoped to one instance (no `--instance` / `--agent`) from counting a
+ * message somebody sent to a different session. Without it every row counts,
+ * which is right only for a read the server already scoped.
+ *
+ * @param until - Epoch ms at which the turn ended
+ * @param instanceId - The instance this `ask`'s message went to
+ */
+function hasForeignPromptInWindow(messages, ownContent, since, until, instanceId) {
+    const own = ownContent.trim();
+    return messages.some((m) => {
+        if (m.role !== 'user' || typeof m.content !== 'string')
+            return false;
+        if (instanceId !== undefined && m.instanceId !== instanceId)
+            return false;
+        const at = Date.parse(m.timestamp);
+        if (!(at >= since && at <= until))
+            return false;
+        return m.content.trim() !== own;
+    });
+}
+/**
+ * The one instance this `ask`'s own `user` row landed on, or null
+ * (Issue #3955).
+ *
+ * An `ask` with no `--instance` / `--agent` leaves the choice to the server,
+ * and `/send` does not say which it picked to this caller. The ledger does: the
+ * row `/send` wrote carries it. Two rows with this text on different instances
+ * (the same request sent to two sessions at once) say nothing certain, so that
+ * is null too.
+ *
+ * @param messages - Rows as the messages route serialized them
+ * @param ownContent - The message this `ask` sent
+ * Bounded on both sides, like {@link hasForeignPromptInWindow}: the same text
+ * sent to another instance after this turn ended is somebody else's later
+ * request, and must not make this one's instance undecided.
+ *
+ * @param since - Epoch ms taken before the send
+ * @param until - Epoch ms at which the turn ended (`ask` always passes it;
+ *   unbounded when omitted)
+ */
+function ownPromptInstance(messages, ownContent, since, until = Number.POSITIVE_INFINITY) {
+    const own = ownContent.trim();
+    const instances = new Set();
+    for (const m of messages) {
+        if (m.role !== 'user' || typeof m.content !== 'string')
+            continue;
+        const at = Date.parse(m.timestamp);
+        if (!(at >= since && at <= until))
+            continue;
+        if (m.content.trim() !== own)
+            continue;
+        if (typeof m.instanceId === 'string')
+            instances.add(m.instanceId);
+    }
+    return instances.size === 1 ? [...instances][0] : null;
+}
+/**
+ * User turns read back per page by {@link fetchPromptRowsSince}.
+ *
+ * The route's `unit=pairs` counts user rows, so a turn that wrote many
+ * assistant rows cannot push a user row out of the page the way it can out of
+ * {@link REPLY_LOOKBACK_MESSAGES} rows.
+ */
+exports.PROMPT_ROWS_PAGE_TURNS = 20;
+/**
+ * Whether a read of {@link REPLY_LOOKBACK_MESSAGES} rows may have cut off rows
+ * stamped at or after `since` (Issue #3955): it came back full and its oldest
+ * row is not older than `since`.
+ */
+function mayHaveDroppedRowsSince(messages, since) {
+    if (messages.length < exports.REPLY_LOOKBACK_MESSAGES)
+        return false;
+    const oldest = Math.min(...messages.map((m) => Date.parse(m.timestamp)));
+    return !(oldest < since);
+}
+/**
+ * Every `user` row stamped at or after `since`, however many rows came after
+ * it (Issue #3955), or null if the rows cannot be read.
+ *
+ * Pages backwards with the route's existing `unit=pairs` and `before`: a page
+ * holds the newest {@link PROMPT_ROWS_PAGE_TURNS} user rows and every row from
+ * the oldest of them on, so the next page's `before` (that oldest timestamp)
+ * leaves no user row between two pages. Stops at the first page that reaches
+ * back past `since`, or that holds fewer user rows than asked for (nothing
+ * older is left).
+ *
+ * @param client - API client
+ * @param worktreeId - Worktree ID
+ * @param instanceId - Instance to scope to, or undefined for every instance
+ * @param since - Epoch ms taken before the send
+ */
+async function fetchPromptRowsSince(client, worktreeId, instanceId, since) {
+    const found = [];
+    let before = null;
+    try {
+        for (;;) {
+            const query = new URLSearchParams({ limit: String(exports.PROMPT_ROWS_PAGE_TURNS), unit: 'pairs' });
+            if (instanceId)
+                query.set('instance', instanceId);
+            if (before !== null)
+                query.set('before', new Date(before).toISOString());
+            const page = await client.get(`/api/worktrees/${worktreeId}/messages?${query.toString()}`);
+            const users = (Array.isArray(page) ? page : []).filter((m) => m.role === 'user');
+            found.push(...users.filter((m) => Date.parse(m.timestamp) >= since));
+            if (users.length < exports.PROMPT_ROWS_PAGE_TURNS)
+                return found;
+            const oldest = Math.min(...users.map((m) => Date.parse(m.timestamp)));
+            // A page that does not move the cursor back would repeat for ever.
+            if (!(oldest >= since) || (before !== null && !(oldest < before)))
+                return found;
+            before = oldest;
+        }
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * The recent chat rows for this instance. Throws what the API client throws.
  *

package/dist/lib/session/send-attempt-types.d.ts

@@ -30,7 +30,7 @@ export type SendAttemptReason =
  | 'session-starting'
 /** `not-sent`: the session could not be started. */
  | 'session-start-failed'
-/** `not-sent`: a prompt dialog was open (#1708). */
+/** `not-sent`: a prompt dialog was open (#1708), or opened while the send waited for the composer (#3945). */
  | 'prompt-waiting'
 /** `not-sent`: the tmux session belongs to another server (#2865). */
  | 'foreign-session'
@@ -40,6 +40,20 @@ export type SendAttemptReason =
  | 'composer-not-empty'
 /** `not-sent`: a Command Code plan review overlay refused the send before the body (#3125/#3772). */
  | 'plan-review'
+/** `not-sent`: another send held the instance's composer past the input lock's wait (#3945). */
+ | 'input-lock-timeout'
+/** `not-sent`: the session was killed or recreated while the send waited for its composer (#3945). */
+ | 'session-replaced'
+/** `not-sent`: the composer was handed to another writer before the body was typed (#3945). */
+ | 'input-lock-lost'
+/**
+ * `not-sent`: the bound relay the send was going in under was no longer its
+ * own right before the first key (cancelled, expired or taken), so the
+ * input-boundary hook refused it and nothing was typed or dispatched (#3957/#3992).
+ */
+ | 'relay-reservation-lost'
+/** `not-sent`: the pane could not be re-read under the input lock, so nothing was typed (#3945). */
+ | 'recheck-failed'
 /** `indeterminate`: the body was typed, did not land intact, and was taken back out best-effort (#2464/#3366). */
  | 'body-not-landed'
 /** `indeterminate`: an autocompletion replaced the body; the line was cleared best-effort (#1501). */
@@ -63,4 +77,12 @@ export interface LastSendAttempt {
  * send before any body is typed (Issue #3772). Matched by code, never by wording.
  */
 export declare const PLAN_REVIEW_SEND_REFUSED_CODE = "PLAN_REVIEW_SEND_REFUSED";
+/**
+ * `code` on the errors the input re-check throws before any key
+ * (`recheckComposerBeforeInput`, Issue #3952): a dialog was open, or the pane
+ * could not be read. Carried by copilot's `/model` switch, whose caller records
+ * the reason by code rather than by the wording around it.
+ */
+export declare const INPUT_RECHECK_PROMPT_WAITING_CODE = "INPUT_RECHECK_PROMPT_WAITING";
+export declare const INPUT_RECHECK_FAILED_CODE = "INPUT_RECHECK_FAILED";
 //# sourceMappingURL=send-attempt-types.d.ts.map

package/dist/lib/session/send-attempt-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"send-attempt-types.d.ts","sourceRoot":"","sources":["../../../src/lib/session/send-attempt-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,MAAM,GAAG,eAAe,CAAC;AAErE,MAAM,MAAM,iBAAiB;AAC3B,wCAAwC;AACtC,WAAW;AACb,2EAA2E;GACzE,kBAAkB;AACpB,mEAAmE;GACjE,kBAAkB;AACpB,oDAAoD;GAClD,sBAAsB;AACxB,oDAAoD;GAClD,gBAAgB;AAClB,sEAAsE;GACpE,iBAAiB;AACnB,oEAAoE;GAClE,qBAAqB;AACvB,4EAA4E;GAC1E,oBAAoB;AACtB,qGAAqG;GACnG,aAAa;AACf,kHAAkH;GAChH,iBAAiB;AACnB,sGAAsG;GACpG,wBAAwB;AAC1B,sGAAsG;GACpG,oBAAoB;AACtB,sFAAsF;GACpF,kBAAkB;AACpB,yEAAyE;GACvE,YAAY,CAAC;AAEjB,0EAA0E;AAC1E,MAAM,WAAW,eAAe;IAC9B,kCAAkC;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,gBAAgB,CAAC;IACxB,8FAA8F;IAC9F,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAAC;CACpC;AAED;;;GAGG;AACH,eAAO,MAAM,6BAA6B,6BAA6B,CAAC"}
+{"version":3,"file":"send-attempt-types.d.ts","sourceRoot":"","sources":["../../../src/lib/session/send-attempt-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,MAAM,GAAG,eAAe,CAAC;AAErE,MAAM,MAAM,iBAAiB;AAC3B,wCAAwC;AACtC,WAAW;AACb,2EAA2E;GACzE,kBAAkB;AACpB,mEAAmE;GACjE,kBAAkB;AACpB,oDAAoD;GAClD,sBAAsB;AACxB,8GAA8G;GAC5G,gBAAgB;AAClB,sEAAsE;GACpE,iBAAiB;AACnB,oEAAoE;GAClE,qBAAqB;AACvB,4EAA4E;GAC1E,oBAAoB;AACtB,qGAAqG;GACnG,aAAa;AACf,gGAAgG;GAC9F,oBAAoB;AACtB,sGAAsG;GACpG,kBAAkB;AACpB,+FAA+F;GAC7F,iBAAiB;AACnB;;;;GAIG;GACD,wBAAwB;AAC1B,oGAAoG;GAClG,gBAAgB;AAClB,kHAAkH;GAChH,iBAAiB;AACnB,sGAAsG;GACpG,wBAAwB;AAC1B,sGAAsG;GACpG,oBAAoB;AACtB,sFAAsF;GACpF,kBAAkB;AACpB,yEAAyE;GACvE,YAAY,CAAC;AAEjB,0EAA0E;AAC1E,MAAM,WAAW,eAAe;IAC9B,kCAAkC;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,gBAAgB,CAAC;IACxB,8FAA8F;IAC9F,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAAC;CACpC;AAED;;;GAGG;AACH,eAAO,MAAM,6BAA6B,6BAA6B,CAAC;AAExE;;;;;GAKG;AACH,eAAO,MAAM,iCAAiC,iCAAiC,CAAC;AAChF,eAAO,MAAM,yBAAyB,yBAAyB,CAAC"}

package/dist/lib/session/send-attempt-types.js

@@ -9,9 +9,17 @@
  * @module lib/session/send-attempt-types
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PLAN_REVIEW_SEND_REFUSED_CODE = void 0;
+exports.INPUT_RECHECK_FAILED_CODE = exports.INPUT_RECHECK_PROMPT_WAITING_CODE = exports.PLAN_REVIEW_SEND_REFUSED_CODE = void 0;
 /**
  * `code` on the error a tool throws when a plan review overlay refuses the
  * send before any body is typed (Issue #3772). Matched by code, never by wording.
  */
 exports.PLAN_REVIEW_SEND_REFUSED_CODE = 'PLAN_REVIEW_SEND_REFUSED';
+/**
+ * `code` on the errors the input re-check throws before any key
+ * (`recheckComposerBeforeInput`, Issue #3952): a dialog was open, or the pane
+ * could not be read. Carried by copilot's `/model` switch, whose caller records
+ * the reason by code rather than by the wording around it.
+ */
+exports.INPUT_RECHECK_PROMPT_WAITING_CODE = 'INPUT_RECHECK_PROMPT_WAITING';
+exports.INPUT_RECHECK_FAILED_CODE = 'INPUT_RECHECK_FAILED';

package/dist/server/locales/en/worktree.json

@@ -334,7 +334,10 @@
             "remote": "Toggle remote control from GitHub web and mobile",
             "research": "Run a deep research investigation",
             "reset-allowed-tools": "Reset the list of allowed tools",
-            "restart": "Restart the CLI, preserving the current session",
+            "restart": {
+                "copilot": "Restart the CLI, preserving the current session",
+                "claude": "Restart Claude Code and resume this session, which applies an installed update"
+            },
             "rubber-duck": "Get an independent critique of the current work",
             "search": "Search the conversation timeline",
             "session": "View and manage sessions",
@@ -695,7 +698,14 @@
         "regionLabel": "Unsent input",
         "label": "Unsent input:",
         "run": "Run",
-        "clear": "Clear"
+        "clear": "Clear",
+        "clearError": {
+            "dismiss": "Dismiss",
+            "otherServer": "Could not clear: this session is owned by another server.",
+            "busy": "Could not clear: a send is in progress. Wait a moment and try again.",
+            "notCleared": "The text is still in the input box; it could not be cleared.",
+            "failed": "Failed to clear. Please try again."
+        }
     },
     "todo": {
         "addPlaceholder": "Add a todo…",
@@ -1144,8 +1154,11 @@
         "commentPlaceholder": "What should change? (Add comment → Submit review)",
         "comment": "Add comment",
         "submit": "Submit review (Ctrl+R)",
+        "submitCompact": "Submit review",
         "approve": "Approve (Ctrl+A)",
+        "approveCompact": "Approve",
         "cancel": "Cancel (Esc)",
+        "cancelCompact": "Cancel",
         "approveConfirmLabel": "Confirm plan approval",
         "approveConfirmText": "Approving runs the plan. Approve it?",
         "approveConfirmYes": "Approve and run",
@@ -1157,7 +1170,9 @@
             "invalidRequest": "That action does not fit this screen. Nothing was sent.",
             "notActive": "Nothing was sent: no plan review is on screen.",
             "generic": "Could not send."
-        }
+        },
+        "composerNotice": "The plan is waiting for your review — approve, cancel or comment.",
+        "composerGoto": "Go to the controls"
     },
     "selectionKeys": {
         "numbersToolbarLabel": "Option number keys",

package/dist/server/locales/ja/worktree.json

@@ -334,7 +334,10 @@
             "remote": "GitHub の Web・モバイルからのリモート操作を切り替え",
             "research": "ディープリサーチ調査を実行",
             "reset-allowed-tools": "許可済みツールの一覧をリセット",
-            "restart": "現在のセッションを保ったまま CLI を再起動",
+            "restart": {
+                "copilot": "現在のセッションを保ったまま CLI を再起動",
+                "claude": "Claude Code を再起動してこのセッションを再開し、インストール済みの更新を適用"
+            },
             "rubber-duck": "現在の作業への独立した批評を取得",
             "search": "会話タイムラインを検索",
             "session": "セッションを表示・管理",
@@ -695,7 +698,14 @@
         "regionLabel": "未送信の入力",
         "label": "未送信の入力:",
         "run": "実行",
-        "clear": "クリア"
+        "clear": "クリア",
+        "clearError": {
+            "dismiss": "閉じる",
+            "otherServer": "別のサーバーが管理しているセッションのため、クリアできませんでした。",
+            "busy": "送信中のため、クリアできませんでした。少し待ってからもう一度お試しください。",
+            "notCleared": "入力欄に文字が残っています。クリアできませんでした。",
+            "failed": "クリアに失敗しました。もう一度お試しください。"
+        }
     },
     "todo": {
         "addPlaceholder": "ToDoを追加…",
@@ -1144,8 +1154,11 @@
         "commentPlaceholder": "直してほしい点を書く（コメントを追加 → レビューを送信）",
         "comment": "コメントを追加",
         "submit": "レビューを送信 (Ctrl+R)",
+        "submitCompact": "レビューを送信",
         "approve": "承認 (Ctrl+A)",
+        "approveCompact": "承認",
         "cancel": "取り消し (Esc)",
+        "cancelCompact": "取り消し",
         "approveConfirmLabel": "プランの承認の確認",
         "approveConfirmText": "承認するとプランが実行されます。承認しますか？",
         "approveConfirmYes": "承認して実行",
@@ -1157,7 +1170,9 @@
             "invalidRequest": "この画面では送れない操作です。何も送っていません。",
             "notActive": "計画のレビュー画面が表示されていないため、何も送っていません。",
             "generic": "送信できませんでした。"
-        }
+        },
+        "composerNotice": "計画の確認待ちです。承認・取り消し・コメントを選んでください",
+        "composerGoto": "操作へ"
     },
     "selectionKeys": {
         "numbersToolbarLabel": "選択肢の番号キー",

package/dist/server/src/lib/auto-yes-poller.js

@@ -71,6 +71,7 @@ const db_instance_1 = require("./db/db-instance");
 const chat_db_1 = require("./db/chat-db");
 const worktree_session_ownership_1 = require("./cli-tools/worktree-session-ownership");
 const prompt_answer_sender_1 = require("./prompt-answer-sender");
+const instance_input_lock_1 = require("../lib/session/instance-input-lock");
 const session_created_signal_1 = require("./tmux/session-created-signal");
 const manager_1 = require("./cli-tools/manager");
 const cli_patterns_1 = require("./detection/cli-patterns");
@@ -401,6 +402,24 @@ function settleFailedTick(error, tick) {
         logger.info('poller:auto-yes-answer-abandoned', { worktreeId, cliToolId, instanceId, keysSent, delivery });
         return 'no_answer';
     }
+    // Issue #3952: the answer waited for a send holding the session's input and
+    // was then not typed — the prompt moved, or the wait ran out. Nothing is on
+    // the pane and the poller did nothing wrong: the next tick reads the screen
+    // afresh and decides again, without counting an error. By name, as the
+    // transport's errors are read: test doubles of the sender need not export it.
+    if (error instanceof Error && error.name === 'PromptAnswerNotDeliveredError') {
+        if (attempt !== null)
+            (0, auto_yes_poller_state_1.settleSendAttempt)(attempt, false);
+        if (sendInFlight)
+            (0, auto_yes_poller_receipt_log_1.noteAnswerSent)(cliToolId, worktreeId, instanceId, true, receiptEpisode);
+        logger.info('poller:auto-yes-answer-not-delivered', {
+            worktreeId,
+            cliToolId,
+            instanceId,
+            skip: error.skip,
+        });
+        return 'no_answer';
+    }
     // Issue #3839: a failure with keys already on the pane is held the same way —
     // the next tick must not type the answer again over them (step 2.5); the
     // screen leaving or changing forgets it (`forgetPartialAnswer`). Issue #3880:
@@ -445,10 +464,14 @@ function settleFailedTick(error, tick) {
  *   dropped rows from the top of what tmux returned, as the capture layer said
  *   ({@link capturePollerFrame}'s `headCut`). At a window of the pane's height
  *   the row count cannot tell. Omitted, judged from the row count as before.
+ * @param inputReadMark - Issue #3952: `instanceInputReadMark()` taken before the
+ *   tick's capture. Omitted, it is taken when this function is called.
  * @returns 'responded' | 'no_prompt' | 'duplicate' | 'no_answer' | 'error'
  */
-async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, cleanOutput, precomputedLines, instanceId, rawOutput, generation, observation, captureWindowLines, captureHeadCut) {
+async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, cleanOutput, precomputedLines, instanceId, rawOutput, generation, observation, captureWindowLines, captureHeadCut, inputReadMark) {
     const compositeKey = (0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId);
+    // Issue #3952: where the session's input order stood when the frame was read.
+    const readMark = inputReadMark ?? (0, instance_input_lock_1.instanceInputReadMark)();
     const captureExtent = captureWindowLines === undefined ? undefined : { windowLines: captureWindowLines, headCut: captureHeadCut };
     const tickObservation = observation ?? {
         start: (0, waiting_episode_binding_1.startWaitingObservation)(worktreeId, cliToolId, instanceId),
@@ -690,15 +713,28 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
         // Issue #3798: the wait this answer goes to, fixed as the send begins.
         const answerTarget = (0, auto_yes_poller_answer_target_1.fixAnswerTarget)(worktreeId, cliToolId, instanceId);
         sendInFlight = true;
+        const answerParams = {
+            sessionName,
+            answer,
+            cliToolId,
+            promptData: promptDetection.promptData,
+            // Issue #3706: asked after each wait inside the send.
+            ...(generation !== undefined ? { stillCurrent: () => (0, auto_yes_poller_generation_1.isTickCurrent)(generation) } : {}),
+            // Issue #3952: an answer that had to wait for a send is read again.
+            readMark,
+        };
+        // Issue #3952 review P1-2: and step 5.5's last look is taken again after
+        // that wait, right before the first key — the contract or the grant may
+        // have changed while the answer waited for the input. Not enumerable: the
+        // params stay the plain record of what was answered (as the ledger's
+        // fault-injection test compares them across runs); the sender reads it as
+        // the field it is.
+        Object.defineProperty(answerParams, 'stillAllowedAtSend', {
+            value: () => !(0, auto_yes_poller_steps_1.withheldAtSend)(judged, generation !== undefined),
+            enumerable: false,
+        });
         try {
-            await (0, prompt_answer_sender_1.sendPromptAnswer)({
-                sessionName,
-                answer,
-                cliToolId,
-                promptData: promptDetection.promptData,
-                // Issue #3706: asked after each wait inside the send.
-                ...(generation !== undefined ? { stillCurrent: () => (0, auto_yes_poller_generation_1.isTickCurrent)(generation) } : {}),
-            });
+            await (0, prompt_answer_sender_1.sendPromptAnswer)(answerParams);
         }
         finally {
             (0, tmux_capture_cache_1.invalidateCache)(sessionName);
@@ -788,6 +824,9 @@ async function pollAutoYes(worktreeId, cliToolId, instanceId, owner) {
     // Issue #3798: the waiting episode as this tick found it, before its first wait.
     const observationStart = (0, waiting_episode_binding_1.startWaitingObservation)(worktreeId, cliToolId, instanceId);
     try {
+        // Issue #3952: taken before the capture, so a send admitted after it makes
+        // an answer from this frame read the screen again.
+        const inputReadMark = (0, instance_input_lock_1.instanceInputReadMark)();
         // 2. Capture and clean output
         const captureLines = grant.stopPattern
             ? auto_yes_config_1.FULL_CAPTURE_LINES
@@ -819,7 +858,7 @@ async function pollAutoYes(worktreeId, cliToolId, instanceId, owner) {
         const result = await detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, cleanOutput, lines, instanceId, rawOutput, generation, { start: observationStart, frameTime }, 
         // Issue #3881 (review P2-1): the window this capture was taken with,
         // and (third review N4) whether it cut the pane's top.
-        captureLines, headCut);
+        captureLines, headCut, inputReadMark);
         if (!(0, auto_yes_poller_generation_1.isTickCurrent)(generation)) {
             endStaleTick(generation);
             return;

package/dist/server/src/lib/cli-tools/antigravity.js

@@ -30,6 +30,7 @@ const logger_1 = require("../../lib/logger");
 const cli_tool_timing_config_1 = require("../../config/cli-tool-timing-config");
 const launch_screen_1 = require("../../lib/session/launch-screen");
 const errors_1 = require("../../lib/errors");
+const instance_input_lock_1 = require("../../lib/session/instance-input-lock");
 const logger = (0, logger_1.createLogger)('cli-tools/antigravity');
 /**
  * Single-quote a value for safe embedding in a shell command typed into a
@@ -308,6 +309,7 @@ class AntigravityTool extends base_1.BaseCLITool {
         let lastCaptureError;
         for (let i = 0; i < ANTIGRAVITY_INIT_MAX_ATTEMPTS; i++) {
             try {
+                const readMark = (0, instance_input_lock_1.instanceInputReadMark)();
                 const rawOutput = await (0, tmux_1.capturePane)(sessionName, 50);
                 const output = (0, cli_patterns_1.stripAnsi)(rawOutput);
                 lastOutput = rawOutput;
@@ -323,11 +325,17 @@ class AntigravityTool extends base_1.BaseCLITool {
                 if (!trustDialogHandled) {
                     const decision = (0, launch_dialog_1.decideLaunchDialog)(launch_dialog_1.ANTIGRAVITY_TRUST_LAUNCH_DIALOG, output);
                     if (decision.action === 'press' && !(0, antigravity_startup_trust_1.isStartupTrustHeld)(sessionName)) {
-                        await (0, tmux_1.sendSpecialKey)(sessionName, decision.key);
-                        trustDialogHandled = true;
-                        logger.info('auto-trusted-folder-for-antigravity');
-                        await new Promise((resolve) => setTimeout(resolve, ANTIGRAVITY_DIALOG_SETTLE_MS));
-                        continue;
+                        // Issue #3952: typed as the composer's writer, and only while the
+                        // screen still asks for this key once a send holding it is over.
+                        const key = decision.key;
+                        const outcome = await (0, instance_input_lock_1.answerUnderInstanceInputLock)(sessionName, readMark, () => this.isTrustPressStill(sessionName, key), () => (0, tmux_1.sendSpecialKey)(sessionName, key));
+                        if (outcome.answered) {
+                            trustDialogHandled = true;
+                            logger.info('auto-trusted-folder-for-antigravity');
+                            await new Promise((resolve) => setTimeout(resolve, ANTIGRAVITY_DIALOG_SETTLE_MS));
+                            continue;
+                        }
+                        logger.info('antigravity-trust-answer-skipped', { sessionName, reason: outcome.reason });
                     }
                     logTrustDecisionOnce(sessionName, decision, loggedTrustDecisions);
                 }
@@ -354,6 +362,16 @@ class AntigravityTool extends base_1.BaseCLITool {
             ...(lastCaptureError !== undefined ? { lastCaptureError } : {}),
         });
     }
+    /**
+     * Whether a fresh read still shows the trust screen with `key` as its answer
+     * — the re-check an automatic trust answer makes once it owns the composer
+     * after another writer (Issue #3952).
+     */
+    async isTrustPressStill(sessionName, key) {
+        const output = (0, cli_patterns_1.stripAnsi)(await (0, tmux_1.capturePane)(sessionName, 50));
+        const decision = (0, launch_dialog_1.decideLaunchDialog)(launch_dialog_1.ANTIGRAVITY_TRUST_LAUNCH_DIALOG, output);
+        return decision.action === 'press' && decision.key === key;
+    }
     /**
      * Wait for agy's prompt before sending a message.
      * Mirrors CodexTool.waitForPrompt: throws on timeout so a failed readiness
@@ -380,6 +398,7 @@ class AntigravityTool extends base_1.BaseCLITool {
         let lastCaptureError;
         while (Date.now() < deadline) {
             try {
+                const readMark = (0, instance_input_lock_1.instanceInputReadMark)();
                 const rawOutput = await (0, tmux_1.capturePane)(sessionName, 50);
                 const output = (0, cli_patterns_1.stripAnsi)(rawOutput);
                 lastOutput = rawOutput;
@@ -395,8 +414,22 @@ class AntigravityTool extends base_1.BaseCLITool {
                 if (trustDecision !== null && trustDecision.action !== 'press' && (0, antigravity_startup_trust_1.isStartupTrustPending)(sessionName)) {
                     logTrustDecisionOnce(sessionName, trustDecision, loggedTrustDecisions);
                 }
-                if (trustDecision?.action === 'press' && (0, antigravity_startup_trust_1.claimStartupTrust)(sessionName)) {
-                    await (0, tmux_1.sendSpecialKey)(sessionName, trustDecision.key);
+                // Issue #3952: claimed and typed as the composer's writer. The claim is
+                // made only once the screen has been read again after a send holding
+                // the composer, so a screen that moved meanwhile keeps the Enter owed.
+                const pressKey = trustDecision?.action === 'press' ? trustDecision.key : null;
+                const claimed = pressKey !== null && (0, antigravity_startup_trust_1.isStartupTrustPending)(sessionName)
+                    ? await (0, instance_input_lock_1.answerUnderInstanceInputLock)(sessionName, readMark, () => this.isTrustPressStill(sessionName, pressKey), async () => {
+                        if (!(0, antigravity_startup_trust_1.claimStartupTrust)(sessionName))
+                            return false;
+                        await (0, tmux_1.sendSpecialKey)(sessionName, pressKey);
+                        return true;
+                    })
+                    : null;
+                if (claimed !== null && !claimed.answered) {
+                    logger.info('antigravity-trust-answer-skipped', { sessionName, reason: claimed.reason, afterLaunchWindow: true });
+                }
+                if (claimed?.answered === true && claimed.value) {
                     logger.info('auto-trusted-folder-for-antigravity', { sessionName, afterLaunchWindow: true });
                     // A full ordinary window for agy to draw its prompt after the Enter.
                     deadline = Math.max(deadline, Date.now() + ANTIGRAVITY_PROMPT_WAIT_TIMEOUT_MS);