commandmate 0.49.0 → 0.49.2

package/dist/server/src/lib/session/prompt-submit-receipt.js

@@ -0,0 +1,155 @@
+"use strict";
+/**
+ * Whether the agent itself reported a sent prompt (Issue #4035).
+ *
+ * The submit-verified sender decides "the message left the composer" from the
+ * screen. Two of its rules say only that the body is NOT in the composer — B
+ * (no composer, or an empty one) and F (other text, such as claude's dim
+ * `Try "…"` placeholder) — and right after a claude session starts that is not
+ * the same thing: measured on Claude Code 2.1.314 (`tests/fixtures/claude-first-send-4035/`),
+ * keys typed in the first second after the prompt appeared were drawn into the
+ * composer ~1.7 s later, the Enter typed after them was lost, and the frame
+ * read after the Enter still showed the idle placeholder, so F answered
+ * `submitted` for a body that sat unsent until the next send threw it away.
+ *
+ * Claude reports every submitted prompt with its `UserPromptSubmit` hook. This
+ * module keeps, per tmux session this server started, when that hook last
+ * arrived, so the sender can ask for it before trusting B or F on the
+ * session's first prompt ({@link readPromptSubmitReceipt}). It also keeps a
+ * fingerprint (digests, never the text) of the last body the sender reported
+ * submitted, so a later send that has to clear that very body out of the
+ * composer can say so ({@link matchesSubmittedBody}).
+ *
+ * In memory on `globalThis`, like the other per-session state; a session this
+ * server did not start (one adopted after a restart) has no entry, and every
+ * question about it is answered "not required", i.e. exactly as before.
+ *
+ * @module lib/session/prompt-submit-receipt
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.notePromptSubmitSession = notePromptSubmitSession;
+exports.notePromptSubmitHook = notePromptSubmitHook;
+exports.getPromptSubmitTarget = getPromptSubmitTarget;
+exports.readPromptSubmitReceipt = readPromptSubmitReceipt;
+exports.noteSubmittedBody = noteSubmittedBody;
+exports.matchesSubmittedBody = matchesSubmittedBody;
+exports.clearPromptSubmitReceipts = clearPromptSubmitReceipts;
+const crypto_1 = require("crypto");
+const auto_yes_state_1 = require("../../lib/auto-yes-state");
+const global_state_1 = require("../../lib/global-state");
+/** How many sessions are tracked at once; the least recently started is forgotten first. */
+const MAX_TRACKED_SESSIONS = 1024;
+/**
+ * Compacted characters a body's prefix fingerprint covers. A composer read is
+ * cut by the reader, so a long body is recognised by its beginning.
+ */
+const BODY_PREFIX_CHARS = 64;
+const sessions = (0, global_state_1.getOrInitGlobal)('__promptSubmitSessions', () => new Map());
+const sessionByInstance = (0, global_state_1.getOrInitGlobal)('__promptSubmitSessionByInstance', () => new Map());
+function instanceKey(target) {
+    return (0, auto_yes_state_1.buildCompositeKey)(target.worktreeId, target.cliToolId, target.instanceId);
+}
+/** The tools whose prompt hook is trusted as proof of a submit. */
+function reportsPrompts(cliToolId) {
+    // Claude only. codex's hooks run in a machine-wide daemon that can file a
+    // turn under the wrong instance (#2874), and copilot's arrive out of order
+    // (#1903); neither is evidence about one pane's composer.
+    return cliToolId === 'claude';
+}
+/**
+ * A session's generation began here (`beginAgentSession`). Forgets what was
+ * known about the previous process in the same pane name.
+ */
+function notePromptSubmitSession(sessionName, target, at = Date.now()) {
+    sessions.delete(sessionName);
+    sessions.set(sessionName, { target, startedAt: at, lastEventAt: null, lastPromptAt: null, submittedBody: null });
+    sessionByInstance.set(instanceKey(target), sessionName);
+    while (sessions.size > MAX_TRACKED_SESSIONS) {
+        const oldest = sessions.keys().next().value;
+        if (oldest === undefined)
+            break;
+        const entry = sessions.get(oldest);
+        sessions.delete(oldest);
+        if (entry !== undefined && sessionByInstance.get(instanceKey(entry.target)) === oldest) {
+            sessionByInstance.delete(instanceKey(entry.target));
+        }
+    }
+}
+/** A hook was applied for this instance (`recordAgentEvent`). */
+function notePromptSubmitHook(target, event, at) {
+    let sessionName;
+    try {
+        sessionName = sessionByInstance.get(instanceKey(target));
+    }
+    catch {
+        return;
+    }
+    const entry = sessionName === undefined ? undefined : sessions.get(sessionName);
+    if (entry === undefined)
+        return;
+    entry.lastEventAt = at;
+    if (event === 'user_prompt_submit')
+        entry.lastPromptAt = at;
+}
+/** The instance a session this server started runs, or null. */
+function getPromptSubmitTarget(sessionName) {
+    return sessions.get(sessionName)?.target ?? null;
+}
+/**
+ * Whether the screen's B/F verdict for a send whose first Enter went in at
+ * `enteredAt` needs the agent's own report (Issue #4035).
+ */
+function readPromptSubmitReceipt(sessionName, cliToolId, enteredAt) {
+    if (!reportsPrompts(cliToolId))
+        return 'not-required';
+    const entry = sessions.get(sessionName);
+    if (entry === undefined || entry.target.cliToolId !== cliToolId)
+        return 'not-required';
+    if (entry.lastPromptAt !== null && entry.lastPromptAt >= enteredAt)
+        return 'received';
+    if (entry.lastEventAt === null || entry.lastEventAt < entry.startedAt)
+        return 'not-required';
+    if (entry.lastPromptAt !== null && entry.lastPromptAt >= entry.startedAt)
+        return 'not-required';
+    return 'awaited';
+}
+function compact(text) {
+    return text.replace(/\s+/g, '');
+}
+function digest(text) {
+    return (0, crypto_1.createHash)('sha256').update(text, 'utf8').digest('hex').slice(0, 16);
+}
+/**
+ * The sender reported this body submitted on this session from the screen
+ * alone — not for one the agent's hook reported, which did leave.
+ */
+function noteSubmittedBody(sessionName, message) {
+    const entry = sessions.get(sessionName);
+    if (entry === undefined)
+        return;
+    const body = compact(message);
+    entry.submittedBody = {
+        full: digest(body),
+        prefix: body.length >= BODY_PREFIX_CHARS ? digest(body.slice(0, BODY_PREFIX_CHARS)) : null,
+    };
+}
+/**
+ * Whether a composer read is the body last reported submitted on this session:
+ * the whole of it, or — for a read long enough — its beginning.
+ */
+function matchesSubmittedBody(sessionName, composerText) {
+    const body = sessions.get(sessionName)?.submittedBody;
+    if (body === null || body === undefined)
+        return false;
+    const read = compact(composerText);
+    if (read === '')
+        return false;
+    if (digest(read) === body.full)
+        return true;
+    return body.prefix !== null && read.length >= BODY_PREFIX_CHARS && digest(read.slice(0, BODY_PREFIX_CHARS)) === body.prefix;
+}
+/** Forget every session (tests). */
+function clearPromptSubmitReceipts() {
+    sessions.clear();
+    sessionByInstance.clear();
+}

package/dist/server/src/lib/session/prompt-waiting-guard.js

@@ -128,13 +128,20 @@ async function isPromptWaiting(worktreeId, cliToolId, instanceId, options) {
  * That is precisely the state where a guard turns into an outage, so the message
  * has to name the way past it and how long it lasts if they do nothing.
  *
+ * Issue #4031: the commands it names carry ` --instance <id>` when the refused
+ * request named an instance, so the answer goes to the instance that is
+ * waiting. A request for the primary instance (no `instanceId`) gets the
+ * sentence as before.
+ *
  * @param blockedBy - Which layer refused; omitted callers get the plain message
+ * @param instanceId - The instance the refused request named, if any
  */
-function promptWaitingMessage(worktreeId, blockedBy) {
+function promptWaitingMessage(worktreeId, blockedBy, instanceId) {
+    const target = instanceId ? ` --instance ${instanceId}` : '';
     const base = `${worktreeId} is waiting on a prompt. Sending now would type into the ` +
         `prompt's input line instead of reaching the agent, and would leave that ` +
         `text in place for the next answer. Answer the prompt first: ` +
-        `\`commandmate respond ${worktreeId} <answer>\`.`;
+        `\`commandmate respond ${worktreeId} <answer>${target}\`.`;
     if (blockedBy !== 'structured')
         return base;
     const ttlMinutes = Math.round(prompt_waiting_composition_1.STRUCTURED_SEND_BLOCK_MAX_AGE_MS / 60_000);
@@ -142,6 +149,6 @@ function promptWaitingMessage(worktreeId, blockedBy) {
         `visible to the terminal scraper, so if the pane looks idle the record has ` +
         `outlived its dialog: it stops blocking sends ${ttlMinutes} minutes after ` +
         `it was reported, or immediately with ` +
-        `\`commandmate send ${worktreeId} <message> --ignore-structured-prompt\` ` +
+        `\`commandmate send ${worktreeId} <message>${target} --ignore-structured-prompt\` ` +
         `(server-wide: ${prompt_waiting_composition_1.STRUCTURED_SEND_GUARD_ENV}=off).`);
 }

package/dist/server/src/lib/session/send-attempt-state.js

@@ -28,6 +28,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.sendMessageDigest = sendMessageDigest;
 exports.recordSendAttempt = recordSendAttempt;
 exports.getLastSendAttempt = getLastSendAttempt;
+exports.markLastSendDiscarded = markLastSendDiscarded;
 exports.clearSendAttempts = clearSendAttempts;
 exports.classifySendFailure = classifySendFailure;
 exports.composerHoldsMessage = composerHoldsMessage;
@@ -78,6 +79,23 @@ function recordSendAttempt(instance, attempt, now = Date.now()) {
 function getLastSendAttempt(instance) {
     return records.get(keyOf(instance)) ?? null;
 }
+/**
+ * Turn the instance's last `sent` record `indeterminate` (Issue #4035): the
+ * next send found that body still in the composer, so it never reached the
+ * agent. Any other record is left as it is. Never throws.
+ */
+function markLastSendDiscarded(instance, now = Date.now()) {
+    try {
+        const key = keyOf(instance);
+        const record = records.get(key);
+        if (record === undefined || record.state !== 'sent')
+            return;
+        records.set(key, { ...record, at: Math.floor(now), state: 'indeterminate', reason: 'found-in-composer' });
+    }
+    catch (error) {
+        logger.warn('send-attempt-record-failed', { error: error instanceof Error ? error.message : String(error) });
+    }
+}
 /** Forget every record (tests). */
 function clearSendAttempts() {
     records.clear();
@@ -88,6 +106,25 @@ function clearSendAttempts() {
  * `Failed to send keys to tmux session: …` and the like (Issue #3880).
  */
 const TMUX_TRANSPORT_FAILURE = /Command failed: tmux |Failed to send (?:special )?keys? to tmux session|Failed to send special key:|Failed to paste message into tmux session/;
+/** How many `cause` links {@link carriesCode} follows: a tool's wrap is one. */
+const MAX_CAUSE_DEPTH = 4;
+/**
+ * Whether `error`, or an error it wraps (`cause`), carries `code`
+ * (Issue #4031). The tools wrap the sender's error as
+ * `Failed to send message to <tool>: …` with it as `cause`, so a code set
+ * before the wrap is read here, not lost.
+ */
+function carriesCode(error, code) {
+    let current = error;
+    for (let depth = 0; depth <= MAX_CAUSE_DEPTH; depth++) {
+        if (typeof current !== 'object' || current === null)
+            return false;
+        if (current.code === code)
+            return true;
+        current = current.cause;
+    }
+    return false;
+}
 /**
  * Where a failed `ICLITool.sendMessage` stopped, read from its error.
  *
@@ -108,6 +145,12 @@ function classifySendFailure(error) {
         error.code === send_attempt_types_1.PLAN_REVIEW_SEND_REFUSED_CODE) {
         return { state: 'not-sent', reason: 'plan-review' };
     }
+    // Issue #4031: `load-buffer` failed, so `paste-buffer` never ran — read by
+    // code through the tool's wrap, never by wording (a `paste-buffer` failure,
+    // whose body may be on the pane, shares the transport wording below).
+    if (carriesCode(error, send_attempt_types_1.PASTE_NOT_STARTED_CODE)) {
+        return { state: 'not-sent', reason: 'paste-not-started' };
+    }
     const message = error instanceof Error ? error.message : String(error);
     // Issue #3880: the "after the body was typed" wordings are matched FIRST. A
     // body-not-landed error quotes what the composer shows — the user's own text —
@@ -121,6 +164,11 @@ function classifySendFailure(error) {
     if (/replaced by a TUI autocompletion/.test(message)) {
         return { state: 'indeterminate', reason: 'replaced-by-completion' };
     }
+    // #4035: Enter sent, the composer did not show the body, and the agent did
+    // not report the session's first prompt.
+    if (/did not report the prompt within \d+ms \(Issue #4035\)/.test(message)) {
+        return { state: 'indeterminate', reason: 'prompt-unreported' };
+    }
     // #1471: typed, Enter sent (more than once), never confirmed.
     if (/submit could not be confirmed/i.test(message)) {
         return { state: 'indeterminate', reason: 'submit-unconfirmed' };
@@ -129,11 +177,28 @@ function classifySendFailure(error) {
     // literal send IS the body (`Command failed: tmux send-keys -t =s: -l -- <body>`).
     // Whether any of the body reached the pane is unknown, and the body's own words
     // (`Explain prompt not ready.`) must not be read as a readiness refusal below.
+    // #3945: the re-read under the input lock failed before any key; it quotes the
+    // capture's own error (`Command failed: tmux capture-pane …`, no body), so it
+    // is matched before the transport wordings below.
+    if (/Could not re-read session \S+ before typing \(.*\); nothing was typed \(Issue #3945\)/s.test(message)) {
+        return { state: 'not-sent', reason: 'recheck-failed' };
+    }
     if (TMUX_TRANSPORT_FAILURE.test(message))
         return { state: 'indeterminate', reason: 'send-error' };
     // The readiness waits of every tool throw before typing anything.
     if (/prompt not ready/i.test(message))
         return { state: 'not-sent', reason: 'prompt-not-ready' };
+    // #3945: refused under (or before getting) the instance input lock, before any key.
+    if (/input lock not acquired, nothing was typed/.test(message)) {
+        return /was replaced while this send waited/.test(message)
+            ? { state: 'not-sent', reason: 'session-replaced' }
+            : { state: 'not-sent', reason: 'input-lock-timeout' };
+    }
+    if (/\(re-checked under the input lock\); nothing was typed/.test(message)) {
+        return { state: 'not-sent', reason: 'prompt-waiting' };
+    }
+    if (/input lock lost, nothing was typed/.test(message))
+        return { state: 'not-sent', reason: 'input-lock-lost' };
     // #1880: refused before the body, after only the clear keys (C-e / C-u, or C-e / BSpace
     // for a codex composer holding only a paste placeholder, #3937).
     if (/still holds unsent text after \d+ clear passes/.test(message)) {

package/dist/server/src/lib/session/send-attempt-types.js

@@ -9,9 +9,26 @@
  * @module lib/session/send-attempt-types
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PLAN_REVIEW_SEND_REFUSED_CODE = void 0;
+exports.INPUT_RECHECK_FAILED_CODE = exports.INPUT_RECHECK_PROMPT_WAITING_CODE = exports.PASTE_NOT_STARTED_CODE = exports.PLAN_REVIEW_SEND_REFUSED_CODE = void 0;
 /**
  * `code` on the error a tool throws when a plan review overlay refuses the
  * send before any body is typed (Issue #3772). Matched by code, never by wording.
  */
 exports.PLAN_REVIEW_SEND_REFUSED_CODE = 'PLAN_REVIEW_SEND_REFUSED';
+/**
+ * `code` on the error a long body's paste throws when `load-buffer` failed
+ * (Issue #4031): `paste-buffer` never ran, so none of the body reached the
+ * pane. The tools wrap the error (`Failed to send message to <tool>: …`) with
+ * it as `cause`, and the send's outcome is read off that chain by code — the
+ * wording is shared with nothing, but a `paste-buffer` failure's is
+ * (`Failed to paste message into tmux session`) and that one is not known safe.
+ */
+exports.PASTE_NOT_STARTED_CODE = 'PASTE_NOT_STARTED';
+/**
+ * `code` on the errors the input re-check throws before any key
+ * (`recheckComposerBeforeInput`, Issue #3952): a dialog was open, or the pane
+ * could not be read. Carried by copilot's `/model` switch, whose caller records
+ * the reason by code rather than by the wording around it.
+ */
+exports.INPUT_RECHECK_PROMPT_WAITING_CODE = 'INPUT_RECHECK_PROMPT_WAITING';
+exports.INPUT_RECHECK_FAILED_CODE = 'INPUT_RECHECK_FAILED';

package/dist/server/src/lib/session/send-user-message.js

@@ -31,7 +31,15 @@
  *
  * Every attempt that reaches the ownership check also records how it ended —
  * not-sent / sent / indeterminate — for `prompt --json`'s `lastSend` (Issue
- * #3759, `./send-attempt-state`). Nothing is resent on any outcome.
+ * #3759, `./send-attempt-state`). Nothing is resent on any outcome. The
+ * caller can also be handed its own attempt (`onAttempt`, Issue #3945), so it
+ * describes this send rather than whichever send to the instance recorded last.
+ *
+ * Issue #3945: for the tools whose composer is read after a failure (claude,
+ * codex), step 4 runs under the instance's input lock, the failure read
+ * included — a read made after the lock was released could be reading the next
+ * send's body. The tool's own sender joins that lock rather than queueing
+ * behind it (`instance-input-lock`).
  *
  * Out of scope (kept in the HTTP layer / caller): request/body validation,
  * content trimming/size limits, imagePath validation, CLI-tool availability
@@ -54,8 +62,10 @@ const prompt_waiting_guard_1 = require("../../lib/session/prompt-waiting-guard")
 const session_start_error_1 = require("../../lib/session/session-start-error");
 const cli_session_1 = require("../../lib/session/cli-session");
 const send_attempt_state_1 = require("../../lib/session/send-attempt-state");
+const send_attempt_types_1 = require("../../lib/session/send-attempt-types");
 const composer_text_1 = require("../../lib/detection/composer-text");
 const status_capture_config_1 = require("../../config/status-capture-config");
+const instance_input_lock_1 = require("../../lib/session/instance-input-lock");
 const opencode_1 = require("../../lib/cli-tools/opencode");
 const logger = (0, logger_1.createLogger)('session/send-user-message');
 function getErrorMessage(error) {
@@ -146,6 +156,7 @@ async function sendUserMessage(db, params) {
     // unchanged; recording never throws.
     const settle = (state, reason) => {
         (0, send_attempt_state_1.recordSendAttempt)({ worktreeId, cliToolId, instanceId: resolvedInstanceId }, { state, reason, content });
+        params.onAttempt?.({ state, reason });
     };
     // Issue #2865: the send route checks ownership itself, but the timer manager
     // and relay delivery reach tmux only through here. A session under this
@@ -204,7 +215,7 @@ async function sendUserMessage(db, params) {
         return {
             ok: false,
             stage: 'prompt_waiting',
-            error: (0, prompt_waiting_guard_1.promptWaitingMessage)(worktreeId, promptGuard.blockedBy),
+            error: (0, prompt_waiting_guard_1.promptWaitingMessage)(worktreeId, promptGuard.blockedBy, instanceId),
         };
     }
     // 1. Issue #576: Send /model command before message if model is specified (copilot only).
@@ -232,7 +243,14 @@ async function sendUserMessage(db, params) {
         }
         catch (error) {
             logger.error('failed-to-send-model-command:', { error: getErrorMessage(error) });
-            settle('not-sent', 'model-switch-failed');
+            // Issue #3952: the re-check right before `/model` refused it. Read by
+            // code, not wording: the switch's other errors quote the pane's bottom row.
+            const code = error?.code;
+            if (code === send_attempt_types_1.INPUT_RECHECK_PROMPT_WAITING_CODE) {
+                settle('not-sent', 'prompt-waiting');
+                return { ok: false, stage: 'prompt_waiting', error: (0, prompt_waiting_guard_1.promptWaitingMessage)(worktreeId, undefined, instanceId) };
+            }
+            settle('not-sent', code === send_attempt_types_1.INPUT_RECHECK_FAILED_CODE ? 'recheck-failed' : 'model-switch-failed');
             return { ok: false, stage: 'model', error: getErrorMessage(error) };
         }
         // Issue #2630: copilot is idle now, and if the previous turn ended during the
@@ -269,10 +287,16 @@ async function sendUserMessage(db, params) {
     // behind a dialog (refused by the prompt guard above), and returns at once
     // while a turn is running. A send without `--model` skips step 1, so its stamp
     // is read at the same point as before.
-    const userMessageTimestamp = new Date();
+    //
+    // Issue #3953: this is now the pending row's stamp, and the user row's only
+    // when the sender did not report when input started (see step 4). The waits
+    // between here and the first key — the input lock, a carried paste mark, the
+    // re-read and the clear — can last a minute, and a previous turn that ended
+    // inside them is not this send's.
+    const pendingResponseTimestamp = new Date();
     // 2. Save any pending assistant response before sending the new user message.
     try {
-        await (0, assistant_response_saver_1.savePendingAssistantResponse)(db, worktreeId, cliToolId, userMessageTimestamp, instanceId);
+        await (0, assistant_response_saver_1.savePendingAssistantResponse)(db, worktreeId, cliToolId, pendingResponseTimestamp, instanceId);
     }
     catch (error) {
         // Log but don't fail - user message should still be saved
@@ -318,8 +342,32 @@ async function sendUserMessage(db, params) {
         // Log but don't fail - cleanup candidate discovery is best-effort
         logger.error('failed-to-detect-orphaned-messages:', { error: getErrorMessage(error) });
     }
-    // 4. Send message to CLI tool.
-    try {
+    // 4. Send message to CLI tool (run below). Returns the failure, or when sent
+    // the moment the sender started typing the body (Issue #3953; null for a
+    // path that does not report it).
+    async function deliver() {
+        try {
+            const { inputStartedAt } = await (0, instance_input_lock_1.observeInputStart)(sendToTool, params.onInputStart, params.inputBoundary);
+            return { sent: true, inputStartedAt };
+        }
+        catch (error) {
+            logger.error('failed-to-send-message-to:', { error: getErrorMessage(error) });
+            // Issue #3957: the relay's boundary hook refused before the first key —
+            // nothing was typed because the reservation the body was going in under
+            // was gone. Issue #3992: its own reason, not `input-lock-lost`.
+            if ((0, instance_input_lock_1.isInputBoundaryRefusal)(error)) {
+                return { error, failure: { state: 'not-sent', reason: 'relay-reservation-lost' } };
+            }
+            // Issue #3759: not-sent only when the error says the body was never typed.
+            let failure = (0, send_attempt_state_1.classifySendFailure)(error);
+            if ((failure.reason === 'submit-unconfirmed' || failure.reason === 'prompt-unreported') &&
+                (await composerStillHolds(worktreeId, cliToolId, instanceId, content))) {
+                failure = { state: 'indeterminate', reason: 'composer-residue' };
+            }
+            return { error, failure };
+        }
+    }
+    async function sendToTool() {
         // Issue #474: Image-aware sending
         if (absoluteImagePath) {
             if ((0, types_1.isImageCapableCLITool)(cliTool)) {
@@ -351,20 +399,42 @@ async function sendUserMessage(db, params) {
             await cliTool.sendMessage(worktreeId, content, instanceId);
         }
     }
-    catch (error) {
-        logger.error('failed-to-send-message-to:', { error: getErrorMessage(error) });
-        // Issue #3759: not-sent only when the error says the body was never typed.
-        let failure = (0, send_attempt_state_1.classifySendFailure)(error);
-        if (failure.reason === 'submit-unconfirmed' && (await composerStillHolds(worktreeId, cliToolId, instanceId, content))) {
-            failure = { state: 'indeterminate', reason: 'composer-residue' };
-        }
+    // Issue #3945: under the input lock for the tools whose composer is read
+    // after a failure, so that read is of this send's composer. Not for the
+    // others — opencode's HTTP delivery never touches the composer, and holding
+    // the lock across it would stall a concurrent tmux send for nothing; their
+    // tmux path takes the lock inside the shared sender.
+    const delivery = composer_text_1.SUPPORTED_COMPOSER_TOOLS.has(cliToolId)
+        ? await (0, instance_input_lock_1.withInstanceInputLock)(sessionName, () => deliver()).catch((error) => ({
+            error,
+            failure: (0, send_attempt_state_1.classifySendFailure)(error),
+        }))
+        : await deliver();
+    if (!('sent' in delivery)) {
+        const { error, failure } = delivery;
         settle(failure.state, failure.reason);
+        // Issue #3945: a dialog found by the re-check under the lock is the prompt
+        // guard's refusal, found late — answered as that refusal (relay holds it).
+        if (failure.reason === 'prompt-waiting') {
+            return { ok: false, stage: 'prompt_waiting', error: (0, prompt_waiting_guard_1.promptWaitingMessage)(worktreeId, undefined, instanceId) };
+        }
         if ((0, session_start_error_1.isSessionStartTimeoutError)(error)) {
             return { ok: false, stage: 'send', error: error.message, code: session_start_error_1.SESSION_STARTING_CODE };
         }
         return { ok: false, stage: 'send', error: getErrorMessage(error) };
     }
     settle('sent', 'submitted');
+    // Issue #3953: the user row, `updateLastUserMessage` and so `wait`'s #1975
+    // gate take the moment the body started going in — later than any turn that
+    // ended before it, earlier than the `stop` of the turn it starts (a stamp
+    // taken after the send could be later than a turn that ends at once). Never
+    // earlier than the pending row's stamp, which stays before it by
+    // ASSISTANT_TIMESTAMP_OFFSET_MS. A path that does not report input (opencode's
+    // HTTP delivery) keeps the stamp read before step 2, as before.
+    const inputStartedAt = delivery.inputStartedAt;
+    const userMessageTimestamp = inputStartedAt !== null && inputStartedAt.getTime() > pendingResponseTimestamp.getTime()
+        ? inputStartedAt
+        : pendingResponseTimestamp;
     // 5. Create user message in database (History source: chat_messages).
     const message = (0, db_1.createMessage)(db, {
         worktreeId,