commandmate 0.49.0 → 0.49.2

package/dist/server/src/lib/cli-tools/antigravity.js

@@ -30,6 +30,7 @@ const logger_1 = require("../../lib/logger");
 const cli_tool_timing_config_1 = require("../../config/cli-tool-timing-config");
 const launch_screen_1 = require("../../lib/session/launch-screen");
 const errors_1 = require("../../lib/errors");
+const instance_input_lock_1 = require("../../lib/session/instance-input-lock");
 const logger = (0, logger_1.createLogger)('cli-tools/antigravity');
 /**
  * Single-quote a value for safe embedding in a shell command typed into a
@@ -266,7 +267,9 @@ class AntigravityTool extends base_1.BaseCLITool {
             // screen is this window's to confirm; the poller records nothing for it.
             (0, antigravity_startup_trust_1.beginStartupWindow)(sessionName);
             try {
-                await (0, tmux_1.sendKeys)(sessionName, (0, launch_screen_1.withLaunchScreenCleared)(launchCommand), true);
+                // Issue #3981: in one writer's turn of the input lock; the waits below
+                // stay outside it.
+                await this.typeLaunchLines(sessionName, [(0, launch_screen_1.withLaunchScreenCleared)(launchCommand)]);
                 // Wait for agy to initialize
                 await new Promise((resolve) => setTimeout(resolve, ANTIGRAVITY_INIT_WAIT_MS));
                 // Poll until the interactive prompt is ready (handles the trust dialog)
@@ -308,6 +311,7 @@ class AntigravityTool extends base_1.BaseCLITool {
         let lastCaptureError;
         for (let i = 0; i < ANTIGRAVITY_INIT_MAX_ATTEMPTS; i++) {
             try {
+                const readMark = (0, instance_input_lock_1.instanceInputReadMark)();
                 const rawOutput = await (0, tmux_1.capturePane)(sessionName, 50);
                 const output = (0, cli_patterns_1.stripAnsi)(rawOutput);
                 lastOutput = rawOutput;
@@ -323,11 +327,17 @@ class AntigravityTool extends base_1.BaseCLITool {
                 if (!trustDialogHandled) {
                     const decision = (0, launch_dialog_1.decideLaunchDialog)(launch_dialog_1.ANTIGRAVITY_TRUST_LAUNCH_DIALOG, output);
                     if (decision.action === 'press' && !(0, antigravity_startup_trust_1.isStartupTrustHeld)(sessionName)) {
-                        await (0, tmux_1.sendSpecialKey)(sessionName, decision.key);
-                        trustDialogHandled = true;
-                        logger.info('auto-trusted-folder-for-antigravity');
-                        await new Promise((resolve) => setTimeout(resolve, ANTIGRAVITY_DIALOG_SETTLE_MS));
-                        continue;
+                        // Issue #3952: typed as the composer's writer, and only while the
+                        // screen still asks for this key once a send holding it is over.
+                        const key = decision.key;
+                        const outcome = await (0, instance_input_lock_1.answerUnderInstanceInputLock)(sessionName, readMark, () => this.isTrustPressStill(sessionName, key), () => (0, tmux_1.sendSpecialKey)(sessionName, key));
+                        if (outcome.answered) {
+                            trustDialogHandled = true;
+                            logger.info('auto-trusted-folder-for-antigravity');
+                            await new Promise((resolve) => setTimeout(resolve, ANTIGRAVITY_DIALOG_SETTLE_MS));
+                            continue;
+                        }
+                        logger.info('antigravity-trust-answer-skipped', { sessionName, reason: outcome.reason });
                     }
                     logTrustDecisionOnce(sessionName, decision, loggedTrustDecisions);
                 }
@@ -354,6 +364,16 @@ class AntigravityTool extends base_1.BaseCLITool {
             ...(lastCaptureError !== undefined ? { lastCaptureError } : {}),
         });
     }
+    /**
+     * Whether a fresh read still shows the trust screen with `key` as its answer
+     * — the re-check an automatic trust answer makes once it owns the composer
+     * after another writer (Issue #3952).
+     */
+    async isTrustPressStill(sessionName, key) {
+        const output = (0, cli_patterns_1.stripAnsi)(await (0, tmux_1.capturePane)(sessionName, 50));
+        const decision = (0, launch_dialog_1.decideLaunchDialog)(launch_dialog_1.ANTIGRAVITY_TRUST_LAUNCH_DIALOG, output);
+        return decision.action === 'press' && decision.key === key;
+    }
     /**
      * Wait for agy's prompt before sending a message.
      * Mirrors CodexTool.waitForPrompt: throws on timeout so a failed readiness
@@ -380,6 +400,7 @@ class AntigravityTool extends base_1.BaseCLITool {
         let lastCaptureError;
         while (Date.now() < deadline) {
             try {
+                const readMark = (0, instance_input_lock_1.instanceInputReadMark)();
                 const rawOutput = await (0, tmux_1.capturePane)(sessionName, 50);
                 const output = (0, cli_patterns_1.stripAnsi)(rawOutput);
                 lastOutput = rawOutput;
@@ -395,8 +416,22 @@ class AntigravityTool extends base_1.BaseCLITool {
                 if (trustDecision !== null && trustDecision.action !== 'press' && (0, antigravity_startup_trust_1.isStartupTrustPending)(sessionName)) {
                     logTrustDecisionOnce(sessionName, trustDecision, loggedTrustDecisions);
                 }
-                if (trustDecision?.action === 'press' && (0, antigravity_startup_trust_1.claimStartupTrust)(sessionName)) {
-                    await (0, tmux_1.sendSpecialKey)(sessionName, trustDecision.key);
+                // Issue #3952: claimed and typed as the composer's writer. The claim is
+                // made only once the screen has been read again after a send holding
+                // the composer, so a screen that moved meanwhile keeps the Enter owed.
+                const pressKey = trustDecision?.action === 'press' ? trustDecision.key : null;
+                const claimed = pressKey !== null && (0, antigravity_startup_trust_1.isStartupTrustPending)(sessionName)
+                    ? await (0, instance_input_lock_1.answerUnderInstanceInputLock)(sessionName, readMark, () => this.isTrustPressStill(sessionName, pressKey), async () => {
+                        if (!(0, antigravity_startup_trust_1.claimStartupTrust)(sessionName))
+                            return false;
+                        await (0, tmux_1.sendSpecialKey)(sessionName, pressKey);
+                        return true;
+                    })
+                    : null;
+                if (claimed !== null && !claimed.answered) {
+                    logger.info('antigravity-trust-answer-skipped', { sessionName, reason: claimed.reason, afterLaunchWindow: true });
+                }
+                if (claimed?.answered === true && claimed.value) {
                     logger.info('auto-trusted-folder-for-antigravity', { sessionName, afterLaunchWindow: true });
                     // A full ordinary window for agy to draw its prompt after the Enter.
                     deadline = Math.max(deadline, Date.now() + ANTIGRAVITY_PROMPT_WAIT_TIMEOUT_MS);
@@ -461,7 +496,8 @@ class AntigravityTool extends base_1.BaseCLITool {
         }
         catch (error) {
             const errorMessage = (0, errors_1.getErrorMessage)(error);
-            throw new Error(`Failed to send message to Antigravity: ${errorMessage}`);
+            // Issue #4031: the cause keeps a failed `load-buffer`'s code (`classifySendFailure`).
+            throw new Error(`Failed to send message to Antigravity: ${errorMessage}`, { cause: error });
         }
     }
     /**

package/dist/server/src/lib/cli-tools/base.js

@@ -31,6 +31,8 @@ const terminal_keys_1 = require("../../types/terminal-keys");
 const cli_tool_timing_config_1 = require("../../config/cli-tool-timing-config");
 const tmux_pane_config_1 = require("../../config/tmux-pane-config");
 const session_starting_state_1 = require("../session/session-starting-state");
+const session_launch_flight_1 = require("../session/session-launch-flight");
+const launch_keys_1 = require("./launch-keys");
 const execAsync = (0, util_1.promisify)(child_process_1.exec);
 const logger = (0, logger_1.createLogger)('cli-tools/base');
 /**
@@ -221,6 +223,27 @@ class BaseCLITool {
      * @throws Whatever {@link launchSession} threw — unchanged, after reporting
      */
     async startSession(worktreeId, worktreePath, instanceId, model) {
+        // Issue #3981: one launch per session (`session-launch-flight`). A second
+        // request joins the launch in progress instead of starting its own — whose
+        // reuse branch would kill the first one's half-launched pane — and a caller
+        // that holds the input lock is refused rather than made to wait (R1). A
+        // name that does not validate is left to `launchSession` to refuse, and
+        // reported as before. A start that asks for a model the launch in
+        // progress is not starting with is refused instead of joining it (#2771).
+        let sessionName = null;
+        try {
+            sessionName = this.getSessionName(worktreeId, instanceId);
+        }
+        catch {
+            // fall through: launchSession throws on it, inside the reporting below
+        }
+        const launch = () => this.startSessionOnce(worktreeId, worktreePath, instanceId, model);
+        if (sessionName === null)
+            return launch();
+        return (0, session_launch_flight_1.runSessionLaunch)(sessionName, this.name, launch, { cliToolId: this.id, model });
+    }
+    /** {@link startSession}'s body: one launch, its failure reported once. */
+    async startSessionOnce(worktreeId, worktreePath, instanceId, model) {
         // Issue #3195: this launch's "starting" record is written under this token
         // (see `session-starting-state`), so the `finally` below clears this
         // launch's record and never a later launch's of the same instance.
@@ -615,6 +638,11 @@ class BaseCLITool {
      */
     async requireSession(label, worktreeId, instanceId, options) {
         const sessionName = this.getSessionName(worktreeId, instanceId);
+        // Issue #3981: a pane another request is still launching reads as
+        // "exists, tool not live" and would be relaunched or typed into. Wait for
+        // that launch first — or, holding the input lock (claude and codex send
+        // under it), refuse with nothing typed (R1).
+        await (0, session_launch_flight_1.settleSessionLaunch)(sessionName, this.name);
         const exists = await (0, tmux_1.hasSession)(sessionName);
         if (!exists) {
             throw new Error(`${label} session ${sessionName} does not exist. Start the session first.`);
@@ -683,6 +711,17 @@ class BaseCLITool {
         }
         return { sessionName, exists, live: false };
     }
+    /**
+     * Type a launch's keys — its launch line, and anything that has to go in
+     * before it — in one `exclusive` turn of the instance input lock (Issue
+     * #3981, `./launch-keys`). The waits after the keys stay outside the lock.
+     *
+     * @param sessionName - tmux session name
+     * @param steps - Lines typed with Enter, or steps that type their own keys
+     */
+    async typeLaunchLines(sessionName, steps) {
+        await (0, launch_keys_1.typeLaunchLines)(sessionName, steps);
+    }
     /**
      * Create the tmux session a launch types into, then wait
      * {@link TUI_SESSION_CREATE_WAIT_MS} for it. Creation path only: on the #2070

package/dist/server/src/lib/cli-tools/codex.js

@@ -21,6 +21,7 @@ const agent_session_lifecycle_1 = require("../../lib/session/agent-session-lifec
 const cli_tool_timing_config_1 = require("../../config/cli-tool-timing-config");
 const launch_screen_1 = require("../../lib/session/launch-screen");
 const errors_1 = require("../../lib/errors");
+const instance_input_lock_1 = require("../../lib/session/instance-input-lock");
 const logger = (0, logger_1.createLogger)('cli-tools/codex');
 /** Wait for Codex CLI to initialize after launch */
 const CODEX_INIT_WAIT_MS = 3000;
@@ -243,11 +244,13 @@ class CodexTool extends base_1.BaseCLITool {
             // as the new one's.
             const relaunchIntoSamePane = async () => {
                 (0, agent_session_lifecycle_1.beginAgentSession)({ worktreeId, cliToolId: sources_1.CODEX_CLI_TOOL_ID, instanceId });
-                await (0, tmux_1.sendKeys)(sessionName, (0, launch_screen_1.withLaunchScreenCleared)(launchCommand), true);
+                // Issue #3981: one writer's turn, as the first launch line below.
+                await this.typeLaunchLines(sessionName, [(0, launch_screen_1.withLaunchScreenCleared)(launchCommand)]);
                 await new Promise((resolve) => setTimeout(resolve, CODEX_INIT_WAIT_MS));
             };
-            // Start Codex CLI in interactive mode
-            await (0, tmux_1.sendKeys)(sessionName, (0, launch_screen_1.withLaunchScreenCleared)(launchCommand), true);
+            // Start Codex CLI in interactive mode. Issue #3981: in one writer's turn
+            // of the input lock (joined when this launch runs inside a send's).
+            await this.typeLaunchLines(sessionName, [(0, launch_screen_1.withLaunchScreenCleared)(launchCommand)]);
             // Wait for Codex to initialize
             await new Promise((resolve) => setTimeout(resolve, CODEX_INIT_WAIT_MS));
             // Poll until Codex interactive prompt is ready
@@ -327,6 +330,7 @@ class CodexTool extends base_1.BaseCLITool {
         try {
             for (let i = 0; i < maxAttempts; i++) {
                 try {
+                    const readMark = (0, instance_input_lock_1.instanceInputReadMark)();
                     const rawOutput = await (0, tmux_1.capturePane)(sessionName, 50);
                     const output = (0, cli_patterns_1.stripAnsi)(rawOutput);
                     // Issue #2315: the hooks screens are judged BEFORE readiness, and the
@@ -343,7 +347,7 @@ class CodexTool extends base_1.BaseCLITool {
                     if (lifecycleScreen === 'hooks-review' ||
                         lifecycleScreen === 'hooks-list' ||
                         lifecycleScreen === 'hooks-detail') {
-                        const sent = await this.answerCodexHooksScreen(sessionName, lifecycleScreen, hooksScreenState, trustHooks);
+                        const sent = await this.answerCodexHooksScreen(sessionName, lifecycleScreen, hooksScreenState, trustHooks, readMark);
                         if (sent) {
                             await new Promise((resolve) => setTimeout(resolve, cli_tool_timing_config_1.CODEX_DIALOG_SETTLE_MS));
                             continue;
@@ -499,7 +503,20 @@ class CodexTool extends base_1.BaseCLITool {
                             // stray keypress -- an empty submit on the main prompt, or worst case the
                             // default "1. Update now" confirm if the key was dropped during a re-render.
                             // Send the digit alone and let the next poll observe the result.
-                            await (0, tmux_1.sendKeys)(sessionName, keyToSend, false);
+                            //
+                            // Issue #3952: as the composer's writer, and only while the update
+                            // dialog is still the active one once a send holding it is over.
+                            const digit = keyToSend;
+                            const updateOutcome = await (0, instance_input_lock_1.answerUnderInstanceInputLock)(sessionName, readMark, () => this.isActiveDialogStill(sessionName, 'update'), () => (0, tmux_1.sendKeys)(sessionName, digit, false));
+                            if (!updateOutcome.answered) {
+                                // Nothing typed: the install this lock covers never started.
+                                if (updateLockHeld) {
+                                    updateLockHeld = false;
+                                    (0, updates_1.releaseAgentUpdateLock)(CODEX_UPDATE_LOCK_TOOL);
+                                }
+                                logger.info('codex-update-dialog-answer-skipped', { sessionName, reason: updateOutcome.reason });
+                                continue;
+                            }
                             updateDialogHandled = true;
                             if (keyToSend === codex_update_dialog_config_1.CODEX_UPDATE_DIALOG_KEYS.update) {
                                 // codex is about to become `npm install`. The prompt this method
@@ -519,7 +536,11 @@ class CodexTool extends base_1.BaseCLITool {
                     // Numbered selection dialogs are dismissed by the number key above, so this
                     // branch is reached only when no number selection is pending.
                     if (activeDialog === 'press-enter') {
-                        await (0, tmux_1.sendSpecialKey)(sessionName, 'Enter');
+                        const enterOutcome = await (0, instance_input_lock_1.answerUnderInstanceInputLock)(sessionName, readMark, () => this.isActiveDialogStill(sessionName, 'press-enter'), () => (0, tmux_1.sendSpecialKey)(sessionName, 'Enter'));
+                        if (!enterOutcome.answered) {
+                            logger.info('codex-notification-answer-skipped', { sessionName, reason: enterOutcome.reason });
+                            continue;
+                        }
                         logger.info('dismissed-codex-notification');
                         await new Promise((resolve) => setTimeout(resolve, cli_tool_timing_config_1.CODEX_DIALOG_SETTLE_MS));
                         continue;
@@ -528,7 +549,11 @@ class CodexTool extends base_1.BaseCLITool {
                     // Options: › 1. Yes, continue / 2. No, quit
                     if (activeDialog === 'trust' && !trustDialogHandled) {
                         // Issue #890: number-key selection confirms instantly; no trailing Enter.
-                        await (0, tmux_1.sendKeys)(sessionName, '1', false);
+                        const trustOutcome = await (0, instance_input_lock_1.answerUnderInstanceInputLock)(sessionName, readMark, () => this.isActiveDialogStill(sessionName, 'trust'), () => (0, tmux_1.sendKeys)(sessionName, '1', false));
+                        if (!trustOutcome.answered) {
+                            logger.info('codex-trust-dialog-answer-skipped', { sessionName, reason: trustOutcome.reason });
+                            continue;
+                        }
                         trustDialogHandled = true;
                         logger.info('auto-trusted-folder-for-codex');
                         await new Promise((resolve) => setTimeout(resolve, cli_tool_timing_config_1.CODEX_DIALOG_SETTLE_MS));
@@ -556,6 +581,14 @@ class CodexTool extends base_1.BaseCLITool {
             }
         }
     }
+    /**
+     * Whether `dialog` is still codex's active dialog on a fresh read — the
+     * re-check an automatic launch answer makes once it owns the composer after
+     * another writer (Issue #3952).
+     */
+    async isActiveDialogStill(sessionName, dialog) {
+        return (0, cli_patterns_1.getCodexActiveDialog)((0, cli_patterns_1.stripAnsi)(await (0, tmux_1.capturePane)(sessionName, 50))) === dialog;
+    }
     /**
      * Send the one key that gets this pane off the hooks screen it is on
      * (Issue #2315).
@@ -590,9 +623,12 @@ class CodexTool extends base_1.BaseCLITool {
      * @param screen - The bottom-most active hooks screen, from `getCodexLifecycleDialog`
      * @param state - Per-screen budget, carried across polls by the caller
      * @param trust - Whether trust may be granted, from {@link shouldTrustCodexHooks}
-     * @returns True when a key was sent, false when this screen's budget is spent
+     * @param readMark - {@link instanceInputReadMark} taken before the frame that showed `screen` was read
+     * @returns True when a key was sent, or none was because the composer's writer
+     *   found the screen gone (Issue #3952) — either way the caller polls again;
+     *   false when this screen's budget is spent
      */
-    async answerCodexHooksScreen(sessionName, screen, state, trust) {
+    async answerCodexHooksScreen(sessionName, screen, state, trust, readMark) {
         if (state.screen !== screen) {
             // Progress. The pane moved, so the previous screen's spent attempts say
             // nothing about this one.
@@ -603,7 +639,22 @@ class CodexTool extends base_1.BaseCLITool {
             logger.warn('codex-hooks-screen-unresponsive', { sessionName, screen, trust });
             return false;
         }
-        const attempt = ++state.attempts;
+        const attempt = state.attempts + 1;
+        // Issue #3952: the key goes to the composer's tmux pane, so it waits for a
+        // send that holds it — and is not typed if the hooks screen it was chosen
+        // for is gone once that send is over. Inside `sendMessage` under
+        // `sendUserMessage`'s lock it joins that lock instead.
+        const outcome = await (0, instance_input_lock_1.answerUnderInstanceInputLock)(sessionName, readMark, async () => (0, cli_patterns_1.getCodexLifecycleDialog)((0, cli_patterns_1.stripAnsi)(await (0, tmux_1.capturePane)(sessionName, 50))) === screen, () => this.sendCodexHooksScreenKey(sessionName, screen, attempt, trust));
+        if (!outcome.answered) {
+            // Nothing was typed, so this screen's budget is not spent; poll again.
+            logger.info('codex-hooks-screen-answer-skipped', { sessionName, screen, reason: outcome.reason });
+            return true;
+        }
+        state.attempts = attempt;
+        return true;
+    }
+    /** The key {@link answerCodexHooksScreen} chose, typed as the composer's writer. */
+    async sendCodexHooksScreenKey(sessionName, screen, attempt, trust) {
         if (screen === 'hooks-review') {
             const key = attempt === 1
                 ? trust
@@ -614,18 +665,17 @@ class CodexTool extends base_1.BaseCLITool {
             // on the screen this key just opened.
             await (0, tmux_1.sendKeys)(sessionName, key, false);
             logger.info('codex-hooks-review-answered', { sessionName, key, attempt, trust });
-            return true;
+            return;
         }
         if (trust) {
             // `t`, the key screens 2 and 3 print in their own footers. Literal, so
             // tmux sends the character rather than resolving it as a key name.
             await (0, tmux_1.sendKeys)(sessionName, CODEX_HOOKS_TRUST_KEY, false, { literal: true });
             logger.info('codex-hooks-screen-trusted', { sessionName, screen, attempt });
-            return true;
+            return;
         }
         await (0, tmux_1.sendSpecialKey)(sessionName, 'Escape');
         logger.info('codex-hooks-screen-escaped', { sessionName, screen, attempt });
-        return true;
     }
     /**
      * Wait for Codex prompt before sending a message.
@@ -653,6 +703,7 @@ class CodexTool extends base_1.BaseCLITool {
         let trustHooks = null;
         while (Date.now() - startTime < CODEX_PROMPT_WAIT_TIMEOUT_MS) {
             try {
+                const readMark = (0, instance_input_lock_1.instanceInputReadMark)();
                 const rawOutput = await (0, tmux_1.capturePane)(sessionName, 50);
                 const output = (0, cli_patterns_1.stripAnsi)(rawOutput);
                 // Before readiness, for the reason `waitForReady` gives: a review screen
@@ -667,7 +718,7 @@ class CodexTool extends base_1.BaseCLITool {
                         const worktreePath = await (0, tmux_1.getSessionWorkingDirectory)(sessionName);
                         trustHooks = worktreePath !== null && (0, hooks_config_1.shouldTrustCodexHooks)(worktreePath);
                     }
-                    await this.answerCodexHooksScreen(sessionName, screen, hooksScreenState, trustHooks);
+                    await this.answerCodexHooksScreen(sessionName, screen, hooksScreenState, trustHooks, readMark);
                 }
                 else if ((0, cli_patterns_1.isCodexPromptReady)(output)) {
                     // Issue #890/#892: position-based guard so a residual update/trust dialog
@@ -722,7 +773,8 @@ class CodexTool extends base_1.BaseCLITool {
         }
         catch (error) {
             const errorMessage = (0, errors_1.getErrorMessage)(error);
-            throw new Error(`Failed to send message to Codex: ${errorMessage}`);
+            // Issue #4031: the cause keeps a failed `load-buffer`'s code (`classifySendFailure`).
+            throw new Error(`Failed to send message to Codex: ${errorMessage}`, { cause: error });
         }
     }
     /**

package/dist/server/src/lib/cli-tools/command-code-plan-review.js

@@ -34,7 +34,7 @@
  * @module lib/cli-tools/command-code-plan-review
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PLAN_REVIEW_STEP_DELAY_MS = exports.PLAN_REVIEW_REFUSAL = exports.PLAN_REVIEW_ACTIONS = void 0;
+exports.PlanReviewInputLostError = exports.PLAN_REVIEW_STEP_DELAY_MS = exports.PLAN_REVIEW_REFUSAL = exports.PLAN_REVIEW_ACTIONS = void 0;
 exports.isPlanReviewAction = isPlanReviewAction;
 exports.planCommandCodePlanReviewKeys = planCommandCodePlanReviewKeys;
 exports.sendCommandCodePlanReviewKeys = sendCommandCodePlanReviewKeys;
@@ -153,15 +153,37 @@ function planCommandCodePlanReviewKeys(state, request) {
 }
 /** Pause between steps, so the TUI handles each one as its own input event. */
 exports.PLAN_REVIEW_STEP_DELAY_MS = 300;
+/**
+ * The plan review's keys stopped part-way (Issue #3952 review P2-3): the
+ * session's input was taken from the answer — the session was replaced — after
+ * `stepsSent` of its steps had gone out. The rest were not sent.
+ */
+class PlanReviewInputLostError extends Error {
+    stepsSent;
+    constructor(sessionName, stepsSent) {
+        super(`Session ${sessionName} was replaced while the plan review answer held its input; ` +
+            `${stepsSent} step(s) had been sent, the rest were not (Issue #3952).`);
+        this.stepsSent = stepsSent;
+        this.name = 'PlanReviewInputLostError';
+    }
+}
+exports.PlanReviewInputLostError = PlanReviewInputLostError;
 /**
  * Send the planned steps, one tmux invocation each.
  *
  * Key steps (including `C-r`) go through `sendSpecialKeys`; the comment text
  * goes through `-l` so it is never resolved as a key name.
+ *
+ * Issue #3952 review P2-3: given `isCurrent` (the input ticket the answer holds),
+ * it is asked before every step — after each wait — and a ticket that is no
+ * longer current stops the steps there ({@link PlanReviewInputLostError}), as
+ * the strict respond's keys stop.
  */
-async function sendCommandCodePlanReviewKeys(sessionName, steps, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))) {
+async function sendCommandCodePlanReviewKeys(sessionName, steps, sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)), isCurrent) {
     for (let i = 0; i < steps.length; i++) {
         const step = steps[i];
+        if (isCurrent !== undefined && !isCurrent())
+            throw new PlanReviewInputLostError(sessionName, i);
         if (step.kind === 'text') {
             await (0, tmux_1.sendKeys)(sessionName, step.text, false, { literal: true });
         }

package/dist/server/src/lib/cli-tools/command-code.js

@@ -238,11 +238,14 @@ class CommandCodeTool extends base_1.BaseCLITool {
                 // shared TMUX_HISTORY_LIMIT default (Issue #1624).
                 await this.createLaunchPane(sessionName, worktreePath);
             }
-            await (0, tmux_1.sendKeys)(sessionName, (0, launch_screen_1.withLaunchScreenCleared)(buildCommandCodeLaunchCommand({
+            // Issue #3981: in one writer's turn of the input lock; the readiness
+            // wait below stays outside it.
+            const launchCommand = buildCommandCodeLaunchCommand({
                 target: { worktreeId, cliToolId: tool_id_1.COMMAND_CODE_CLI_TOOL_ID, instanceId },
                 executablePath: this.command,
                 worktreePath,
-            })), true);
+            });
+            await this.typeLaunchLines(sessionName, [(0, launch_screen_1.withLaunchScreenCleared)(launchCommand)]);
             await new Promise((resolve) => setTimeout(resolve, cli_tool_timing_config_1.COMMAND_CODE_INIT_WAIT_MS));
             await this.waitForReady(sessionName);
             logger.info('started-command-code-session');
@@ -368,7 +371,8 @@ class CommandCodeTool extends base_1.BaseCLITool {
             // Issue #3006: passed through unwrapped so its `code` reaches the route.
             if ((0, session_start_error_1.isSessionStartTimeoutError)(error))
                 throw error;
-            const wrapped = new Error(`Failed to send message to Command Code: ${(0, errors_1.getErrorMessage)(error)}`);
+            // Issue #4031: the cause keeps a failed `load-buffer`'s code (`classifySendFailure`).
+            const wrapped = new Error(`Failed to send message to Command Code: ${(0, errors_1.getErrorMessage)(error)}`, { cause: error });
             // Issue #3772: the plan review refusal comes before the body; keep its code.
             if (error?.code === send_attempt_types_1.PLAN_REVIEW_SEND_REFUSED_CODE) {
                 throw Object.assign(wrapped, { code: send_attempt_types_1.PLAN_REVIEW_SEND_REFUSED_CODE });