commandmate 0.49.1 → 0.49.3

package/dist/server/src/lib/session/agent-event-state.js

@@ -69,6 +69,7 @@ const agent_event_structured_state_1 = require("../../lib/session/agent-event-st
 const agent_event_awaiting_instruction_1 = require("../../lib/session/agent-event-awaiting-instruction");
 const agent_event_ask_user_question_1 = require("../../lib/session/agent-event-ask-user-question");
 const global_state_1 = require("../global-state");
+const prompt_submit_receipt_1 = require("../../lib/session/prompt-submit-receipt");
 var agent_event_dedup_2 = require("../../lib/session/agent-event-dedup");
 Object.defineProperty(exports, "AGENT_EVENT_DEDUP_WINDOW_MS", { enumerable: true, get: function () { return agent_event_dedup_2.AGENT_EVENT_DEDUP_WINDOW_MS; } });
 Object.defineProperty(exports, "agentEventKeyClaimedAt", { enumerable: true, get: function () { return agent_event_dedup_2.agentEventKeyClaimedAt; } });
@@ -224,6 +225,9 @@ function recordAgentEvent(worktreeId, cliToolId, instanceId, record, options = {
         return { recorded: false, skipped: 'late-session-start' };
     }
     lastAgentEvent.set(key, record);
+    // Issue #4035: what the sender asks before trusting an empty-looking composer
+    // on a session's first prompt.
+    (0, prompt_submit_receipt_1.notePromptSubmitHook)({ worktreeId, cliToolId, instanceId }, record.event, record.at);
     const outcomes = [];
     if (record.event === 'session_start') {
         // Issue #2357: a new agent process, whatever model it names first is its

package/dist/server/src/lib/session/agent-session-lifecycle.js

@@ -46,6 +46,7 @@ const session_generation_archive_1 = require("../../lib/session/session-generati
 const session_starting_state_1 = require("../../lib/session/session-starting-state");
 const auto_yes_enter_fallback_state_1 = require("../../lib/polling/auto-yes-enter-fallback-state");
 const instance_input_lock_1 = require("../../lib/session/instance-input-lock");
+const prompt_submit_receipt_1 = require("../../lib/session/prompt-submit-receipt");
 const session_name_1 = require("../../lib/cli-tools/session-name");
 const logger_1 = require("../../lib/logger");
 const logger = (0, logger_1.createLogger)('lib/session/agent-session-lifecycle');
@@ -93,7 +94,11 @@ function beginAgentSession(target, at = Date.now()) {
     // `invalidateInstanceInput`). In memory only; a name that does not resolve
     // has no lock to expire.
     try {
-        (0, instance_input_lock_1.invalidateInstanceInput)((0, session_name_1.resolveSessionName)(target.cliToolId, target.worktreeId, target.instanceId));
+        const sessionName = (0, session_name_1.resolveSessionName)(target.cliToolId, target.worktreeId, target.instanceId);
+        (0, instance_input_lock_1.invalidateInstanceInput)(sessionName);
+        // Issue #4035: the new process's first prompt is confirmed by its own
+        // `UserPromptSubmit`, which is looked up by this session name.
+        (0, prompt_submit_receipt_1.notePromptSubmitSession)(sessionName, target, at);
     }
     catch (error) {
         logger.warn('instance-input-invalidate-failed', {

package/dist/server/src/lib/session/claude-session.js

@@ -35,6 +35,8 @@ const agent_event_state_1 = require("../../lib/session/agent-event-state");
 const session_start_error_1 = require("../../lib/session/session-start-error");
 const launch_screen_1 = require("../../lib/session/launch-screen");
 const instance_input_lock_1 = require("../../lib/session/instance-input-lock");
+const session_launch_flight_1 = require("../../lib/session/session-launch-flight");
+const launch_keys_1 = require("../../lib/cli-tools/launch-keys");
 const logger = (0, logger_1.createLogger)('claude-session');
 const execAsync = (0, util_1.promisify)(child_process_1.exec);
 // ----- Helper Functions -----
@@ -686,12 +688,22 @@ async function startClaudeSession(options) {
             sessionName,
             workingDirectory: worktreePath,
         });
-        // SF-S2-003: Sanitize environment after createSession, before launching Claude CLI
-        await (0, session_key_sender_1.sanitizeSessionEnvironment)(sessionName);
-        // Start Claude CLI in interactive mode using dynamically resolved path.
-        // Issue #3975: one writer's turn, as gemini's launch line; the init polls
-        // below stay outside the lock.
-        await (0, instance_input_lock_1.withInstanceInputLock)(sessionName, () => (0, tmux_1.sendKeys)(sessionName, (0, launch_screen_1.withLaunchScreenCleared)(launchCommand), true));
+        // SF-S2-003: Sanitize environment after createSession, before launching
+        // Claude CLI (what session-key-sender's `sanitizeSessionEnvironment` did
+        // until #4032 removed it): drop CLAUDECODE from
+        // tmux's global environment (MF-S3-002), then `unset` it in the pane's
+        // shell, then start Claude in interactive mode using the dynamically
+        // resolved path.
+        //
+        // Issue #3981: the two lines are typed in ONE writer's turn of the input
+        // lock (#3975 locked only the launch line; the `unset` went out before it
+        // with no lock), so neither lands inside a send's body. The sanitize's
+        // 100 ms pause between them is gone: both lines queue in the same shell's
+        // input in order, so the `unset` runs first without it, and a pause inside
+        // the turn would only hold sends off longer. The init polls below stay
+        // outside the lock.
+        await execAsync('tmux set-environment -g -u CLAUDECODE 2>/dev/null || true');
+        await (0, launch_keys_1.typeLaunchLines)(sessionName, ['unset CLAUDECODE', (0, launch_screen_1.withLaunchScreenCleared)(launchCommand)]);
         // Wait for Claude to initialize with dynamic detection (OCP-001)
         // Use constants instead of hardcoded values
         const maxWaitTime = exports.CLAUDE_INIT_TIMEOUT;
@@ -799,7 +811,14 @@ async function startClaudeSession(options) {
  */
 async function sendMessageToClaude(worktreeId, message, instanceId) {
     const sessionName = getSessionName(worktreeId, instanceId);
-    await (0, session_key_sender_1.sendMessageToSession)(sessionName, message, exports.CLAUDE_POST_PROMPT_DELAY, exports.CLAUDE_SEND_PROMPT_WAIT_TIMEOUT);
+    // Issue #3981: a session another request is still launching shows a shell
+    // (`❯ ` can pass for Claude's prompt) — wait for that launch, or, holding the
+    // input lock as the send service does, refuse with nothing typed (R1).
+    await (0, session_launch_flight_1.settleSessionLaunch)(sessionName, 'Claude Code');
+    await (0, session_key_sender_1.sendMessageToSession)(sessionName, message, exports.CLAUDE_POST_PROMPT_DELAY, exports.CLAUDE_SEND_PROMPT_WAIT_TIMEOUT, 
+    // Issue #4048: the instance this send is for, so the first prompt's hook
+    // check reads that instance's entry — the same one the name resolves to.
+    { worktreeId, instanceId });
 }
 /**
  * Capture Claude session output

package/dist/server/src/lib/session/current-output-builder.js

@@ -237,7 +237,7 @@ function readAgentEvents(worktreeId, cliToolId, instanceId, resolvedInstanceId)
  * every value below is derived from the arguments, and nothing is assigned
  * outside this function.
  */
-function composePromptData({ worktreeId, cliToolId, output, captureWindowLines, statusResult, startingSince, promptWaiting, askUserQuestion, eventSource, }) {
+function composePromptData({ worktreeId, cliToolId, respondInstanceId, output, captureWindowLines, statusResult, startingSince, promptWaiting, askUserQuestion, eventSource, }) {
     const scraperPromptWaiting = statusResult.hasActivePrompt;
     // Issue #1726: the agent's own account of what it asked. It contributes only
     // where some other layer has already established that a dialog is on screen —
@@ -338,9 +338,9 @@ function composePromptData({ worktreeId, cliToolId, output, captureWindowLines,
         : scraperPromptWaiting
             ? correctedPromptData ??
                 scraperPromptData ??
-                (structuredFacts ? (0, structured_prompt_1.buildStructuredPromptData)(worktreeId, structuredFacts) : null)
+                (structuredFacts ? (0, structured_prompt_1.buildStructuredPromptData)(worktreeId, structuredFacts, respondInstanceId) : null)
             : structuredFacts
-                ? (0, structured_prompt_1.buildStructuredPromptData)(worktreeId, structuredFacts)
+                ? (0, structured_prompt_1.buildStructuredPromptData)(worktreeId, structuredFacts, respondInstanceId)
                 : null;
     // Issue #2870: whether `/prompt-response` would answer the prompt published
     // above, read by the SAME function it re-verifies with. In #2868 `promptData`
@@ -813,6 +813,7 @@ async function buildPayload(db, worktreeId, cliToolId, instanceId) {
     const { structuredFacts, promptData, promptAnswerable } = composePromptData({
         worktreeId,
         cliToolId,
+        respondInstanceId: resolvedInstanceId,
         output,
         captureWindowLines,
         statusResult,
@@ -920,6 +921,9 @@ async function buildPayload(db, worktreeId, cliToolId, instanceId) {
             worktreeId,
             cliToolId,
             instanceId: resolvedInstanceId,
+            // Issue #4063: the instance the live payload's question names, so the
+            // row says the same `respond` whichever caller wrote it.
+            respondInstanceId: resolvedInstanceId,
             state: promptWaiting,
             facts: structuredFacts,
         });

package/dist/server/src/lib/session/current-output-history-writers.js

@@ -221,7 +221,7 @@ function recordUnclassifiedFrame(db, params) {
  * nothing else.
  */
 function recordStructuredPrompt(db, params) {
-    const record = (0, structured_prompt_1.buildStructuredPromptHistoryRecord)(params.worktreeId, params.facts);
+    const record = (0, structured_prompt_1.buildStructuredPromptHistoryRecord)(params.worktreeId, params.facts, params.respondInstanceId);
     try {
         const message = (0, db_1.createMessage)(db, {
             worktreeId: params.worktreeId,

package/dist/server/src/lib/session/instance-input-lock.js

@@ -61,6 +61,7 @@ exports.currentInstanceInputTicket = currentInstanceInputTicket;
 exports.withInstanceInputLock = withInstanceInputLock;
 exports.instanceInputReadMark = instanceInputReadMark;
 exports.instanceInputLaunchReadMark = instanceInputLaunchReadMark;
+exports.instanceInputGenerationMark = instanceInputGenerationMark;
 exports.answerUnderInstanceInputLock = answerUnderInstanceInputLock;
 exports.leaveCarriedPasteMark = leaveCarriedPasteMark;
 exports.getCarriedPasteMark = getCarriedPasteMark;
@@ -70,6 +71,7 @@ exports.invalidateInstanceInput = invalidateInstanceInput;
 exports.isInputBoundaryRefusal = isInputBoundaryRefusal;
 exports.observeInputStart = observeInputStart;
 exports.noteInputStart = noteInputStart;
+exports.noteInputTicket = noteInputTicket;
 exports.noteDispatchStart = noteDispatchStart;
 exports.noteDispatchFailed = noteDispatchFailed;
 exports.resetInstanceInputLocks = resetInstanceInputLocks;
@@ -364,6 +366,18 @@ function instanceInputReadMark() {
 function instanceInputLaunchReadMark() {
     return (generationSeq.exclusiveEvents ?? 0) + (generationSeq.sharedReleases ?? 0);
 }
+/**
+ * The generation counter as it stands now (Issue #4065): every ticket granted
+ * from here on carries a larger generation. A send request reads it once, at
+ * its outermost entry (the send route before it reads the body; the send
+ * service for the timer and relay), and a refusal it records before any lock
+ * was granted to it carries the value — so it is not taken over the record of
+ * a send granted after the request began. Process-wide, like the generations
+ * themselves; 0 before any grant.
+ */
+function instanceInputGenerationMark() {
+    return generationSeq.last;
+}
 function skipOfLockError(error) {
     const code = typeof error === 'object' && error !== null ? error.code : undefined;
     if (code === exports.INSTANCE_INPUT_LOCK_TIMEOUT_CODE)
@@ -584,12 +598,16 @@ const inputStartScope = (0, global_state_1.getOrInitGlobal)('__instanceInputStar
  *   {@link noteInputStart}, so a caller can read state as of the moment the
  *   body started going in (Issue #3957: the send route's open-turn reading). A
  *   throw is logged and does not fail the send.
+ * @param request - Issue #4065: told, synchronously and as it happens, the
+ *   generation of the body's input lock ({@link noteInputTicket}) and a
+ *   dispatch ({@link noteDispatchStart}) — so a send that throws afterwards
+ *   still leaves them with the caller.
  * @returns `fn`'s value, and the moment input started — null when nothing in
  *   `fn` noted one (a path that never types a body: opencode's HTTP delivery,
  *   or a send refused before its first key). Never set when `fn` throws.
  */
-async function observeInputStart(fn, onStart, boundary) {
-    const observer = { at: null, onStart, boundary, dispatchOpen: false };
+async function observeInputStart(fn, onStart, boundary, request) {
+    const observer = { at: null, onStart, boundary, dispatchOpen: false, request };
     const value = await inputStartScope.run(observer, fn);
     return { value, inputStartedAt: observer.at };
 }
@@ -623,6 +641,25 @@ function runBoundaryHook(observer, at, kind) {
         throw error instanceof InputBoundaryRefusedError ? error : new InputBoundaryRefusedError(error);
     }
 }
+/**
+ * Tell the request observing this context the generation its body's input
+ * lock was granted under (Issue #4065). Called by the shared sender right
+ * after its lock is granted or joined — never for a launch key, an answer, a
+ * trust dialog or copilot's `/model` and selection-list keys, whose tickets
+ * are not the body's. Synchronous, never throws; outside an
+ * {@link observeInputStart} context it does nothing.
+ */
+function noteInputTicket(ticket) {
+    const observer = inputStartScope.getStore();
+    if (observer?.request?.onTicket === undefined)
+        return;
+    try {
+        observer.request.onTicket(ticket.generation);
+    }
+    catch (error) {
+        logger.warn('input-ticket-observer-failed', { error: error instanceof Error ? error.message : String(error) });
+    }
+}
 /**
  * Note that a body is about to be DISPATCHED without being typed (Issue #3957):
  * opencode's HTTP send, which reports no input start. Runs the required
@@ -636,6 +673,14 @@ function noteDispatchStart(now = new Date()) {
         return;
     runBoundaryHook(observer, now, 'dispatch');
     observer.dispatchOpen = true;
+    // Issue #4065: after the required hook, so a refused dispatch — nothing went
+    // out — is not reported as one.
+    try {
+        observer.request?.onDispatch?.();
+    }
+    catch (error) {
+        logger.warn('dispatch-start-observer-failed', { error: error instanceof Error ? error.message : String(error) });
+    }
 }
 /**
  * Say how a dispatch noted by {@link noteDispatchStart} ended when it did not

package/dist/server/src/lib/session/prompt-submit-receipt.js

@@ -0,0 +1,224 @@
+"use strict";
+/**
+ * Whether the agent itself reported a sent prompt (Issue #4035).
+ *
+ * The submit-verified sender decides "the message left the composer" from the
+ * screen. Two of its rules say only that the body is NOT in the composer — B
+ * (no composer, or an empty one) and F (other text, such as claude's dim
+ * `Try "…"` placeholder) — and right after a claude session starts that is not
+ * the same thing: measured on Claude Code 2.1.314 (`tests/fixtures/claude-first-send-4035/`),
+ * keys typed in the first second after the prompt appeared were drawn into the
+ * composer ~1.7 s later, the Enter typed after them was lost, and the frame
+ * read after the Enter still showed the idle placeholder, so F answered
+ * `submitted` for a body that sat unsent until the next send threw it away.
+ *
+ * Claude reports every submitted prompt with its `UserPromptSubmit` hook. This
+ * module keeps, per tmux session this server started, when that hook last
+ * arrived, so the sender can ask for it before trusting B or F on the
+ * session's first prompt ({@link readPromptSubmitReceipt}). It also keeps a
+ * fingerprint (digests, never the text) of the last body the sender reported
+ * submitted, so a later send that has to clear that very body out of the
+ * composer can say so ({@link matchesSubmittedBody}).
+ *
+ * In memory on `globalThis`, like the other per-session state; a session this
+ * server did not start (one adopted after a restart) has no entry, and every
+ * question about it is answered "not required", i.e. exactly as before.
+ *
+ * @module lib/session/prompt-submit-receipt
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.reportsPrompts = reportsPrompts;
+exports.notePromptSubmitSession = notePromptSubmitSession;
+exports.notePromptSubmitHook = notePromptSubmitHook;
+exports.getPromptSubmitTarget = getPromptSubmitTarget;
+exports.readPromptSubmitReceipt = readPromptSubmitReceipt;
+exports.noteSubmittedBody = noteSubmittedBody;
+exports.findSubmittedBody = findSubmittedBody;
+exports.matchesSubmittedBody = matchesSubmittedBody;
+exports.clearPromptSubmitReceipts = clearPromptSubmitReceipts;
+const crypto_1 = require("crypto");
+const auto_yes_state_1 = require("../../lib/auto-yes-state");
+const global_state_1 = require("../../lib/global-state");
+const send_attempt_state_1 = require("../../lib/session/send-attempt-state");
+/** How many sessions are tracked at once; the least recently started is forgotten first. */
+const MAX_TRACKED_SESSIONS = 1024;
+/**
+ * Compacted characters a body's prefix fingerprint covers. A composer read is
+ * cut by the reader, so a long body is recognised by its beginning.
+ */
+const BODY_PREFIX_CHARS = 64;
+const sessions = (0, global_state_1.getOrInitGlobal)('__promptSubmitSessions', () => new Map());
+const sessionByInstance = (0, global_state_1.getOrInitGlobal)('__promptSubmitSessionByInstance', () => new Map());
+function instanceKey(target) {
+    return (0, auto_yes_state_1.buildCompositeKey)(target.worktreeId, target.cliToolId, target.instanceId);
+}
+/**
+ * The tools whose prompt hook is trusted as proof of a submit — and, since
+ * Issue #4048, the only ones whose `lastSend` a found body may demote.
+ */
+function reportsPrompts(cliToolId) {
+    // Claude only. codex's hooks run in a machine-wide daemon that can file a
+    // turn under the wrong instance (#2874), and copilot's arrive out of order
+    // (#1903); neither is evidence about one pane's composer.
+    return cliToolId === 'claude';
+}
+/**
+ * The entry a send looks at (Issue #4048). By name alone, the name's entry. With
+ * an explicit target, the same entry only when the target's instance currently
+ * maps to this very name and the entry is that instance's — a target and a name
+ * that disagree are no entry at all, so nothing about another instance (or a
+ * generation the instance no longer runs under this name) is taken as proof.
+ * Looking never registers or resets anything.
+ */
+function entryFor(sessionName, cliToolId, expected) {
+    const entry = sessions.get(sessionName);
+    if (entry === undefined || expected === undefined)
+        return entry;
+    let key;
+    try {
+        key = instanceKey({ worktreeId: expected.worktreeId, cliToolId, instanceId: expected.instanceId });
+    }
+    catch {
+        return undefined;
+    }
+    if (sessionByInstance.get(key) !== sessionName)
+        return undefined;
+    if (instanceKey(entry.target) !== key)
+        return undefined;
+    return entry;
+}
+/**
+ * A session's generation began here (`beginAgentSession`). Forgets what was
+ * known about the previous process in the same pane name.
+ */
+function notePromptSubmitSession(sessionName, target, at = Date.now()) {
+    sessions.delete(sessionName);
+    sessions.set(sessionName, { target, startedAt: at, lastEventAt: null, lastPromptAt: null, submittedBody: null });
+    sessionByInstance.set(instanceKey(target), sessionName);
+    while (sessions.size > MAX_TRACKED_SESSIONS) {
+        const oldest = sessions.keys().next().value;
+        if (oldest === undefined)
+            break;
+        const entry = sessions.get(oldest);
+        sessions.delete(oldest);
+        if (entry !== undefined && sessionByInstance.get(instanceKey(entry.target)) === oldest) {
+            sessionByInstance.delete(instanceKey(entry.target));
+        }
+    }
+}
+/** A hook was applied for this instance (`recordAgentEvent`). */
+function notePromptSubmitHook(target, event, at) {
+    let sessionName;
+    try {
+        sessionName = sessionByInstance.get(instanceKey(target));
+    }
+    catch {
+        return;
+    }
+    const entry = sessionName === undefined ? undefined : sessions.get(sessionName);
+    if (entry === undefined)
+        return;
+    entry.lastEventAt = at;
+    if (event === 'user_prompt_submit') {
+        entry.lastPromptAt = at;
+        // Issue #4048: the agent took a prompt, so a body the screen alone called
+        // submitted is no longer one to look for — the late report was that body's,
+        // or a later send went through after it. Either way no later send may find
+        // it and demote a record (review: X restored after Y's success).
+        entry.submittedBody = null;
+    }
+}
+/**
+ * The instance a session this server started runs, or null. With `expected`
+ * (Issue #4048), null unless the explicit target names the same entry.
+ */
+function getPromptSubmitTarget(sessionName, expected) {
+    if (expected === undefined)
+        return sessions.get(sessionName)?.target ?? null;
+    return entryFor(sessionName, expected.cliToolId, expected)?.target ?? null;
+}
+/**
+ * Whether the screen's B/F verdict for a send whose first Enter went in at
+ * `enteredAt` needs the agent's own report (Issue #4035).
+ *
+ * `expected` (Issue #4048) is the instance the send was made for; a name that
+ * does not resolve to that instance's entry answers `not-required` (never
+ * `received`), exactly as a session this server did not start.
+ *
+ * Known limit, kept as it is (Issue #4048 item 3): the question is asked on
+ * every read, and a session whose first hook (`SessionStart`) has not arrived
+ * by the read-back is answered `not-required` — the screen's B/F verdict then
+ * stands and the send returns at once, before a hook that is only late could
+ * turn it into `awaited`. Pinned by `prompt-submit-receipt-4048.test.ts`.
+ */
+function readPromptSubmitReceipt(sessionName, cliToolId, enteredAt, expected) {
+    if (!reportsPrompts(cliToolId))
+        return 'not-required';
+    const entry = entryFor(sessionName, cliToolId, expected);
+    if (entry === undefined || entry.target.cliToolId !== cliToolId)
+        return 'not-required';
+    if (entry.lastPromptAt !== null && entry.lastPromptAt >= enteredAt)
+        return 'received';
+    // Issue #4048 item 3 (known limit): no hook yet from this process — the
+    // screen decides, and a `SessionStart` that arrives after this read is not
+    // waited for.
+    if (entry.lastEventAt === null || entry.lastEventAt < entry.startedAt)
+        return 'not-required';
+    if (entry.lastPromptAt !== null && entry.lastPromptAt >= entry.startedAt)
+        return 'not-required';
+    return 'awaited';
+}
+function compact(text) {
+    return text.replace(/\s+/g, '');
+}
+function digest(text) {
+    return (0, crypto_1.createHash)('sha256').update(text, 'utf8').digest('hex').slice(0, 16);
+}
+/**
+ * The sender reported this body submitted on this session from the screen
+ * alone — not for one the agent's hook reported, which did leave.
+ *
+ * `expected` (Issue #4048): with an explicit target, nothing is noted unless it
+ * names the same entry as the session name.
+ */
+function noteSubmittedBody(sessionName, message, expected) {
+    const entry = expected === undefined ? sessions.get(sessionName) : entryFor(sessionName, expected.cliToolId, expected);
+    if (entry === undefined)
+        return;
+    const body = compact(message);
+    entry.submittedBody = {
+        full: digest(body),
+        prefix: body.length >= BODY_PREFIX_CHARS ? digest(body.slice(0, BODY_PREFIX_CHARS)) : null,
+        messageDigest: (0, send_attempt_state_1.sendMessageDigest)(message),
+    };
+}
+/**
+ * The body last reported submitted on this session, when a composer read is it
+ * — the whole of it, or (for a read long enough) its beginning — or null.
+ * `messageDigest` is the attempt's digest, for demoting only that attempt's
+ * record (Issue #4048).
+ */
+function findSubmittedBody(sessionName, composerText, expected) {
+    const entry = expected === undefined ? sessions.get(sessionName) : entryFor(sessionName, expected.cliToolId, expected);
+    const body = entry?.submittedBody;
+    if (body === null || body === undefined)
+        return null;
+    const read = compact(composerText);
+    if (read === '')
+        return null;
+    const matched = digest(read) === body.full ||
+        (body.prefix !== null && read.length >= BODY_PREFIX_CHARS && digest(read.slice(0, BODY_PREFIX_CHARS)) === body.prefix);
+    return matched ? { messageDigest: body.messageDigest } : null;
+}
+/**
+ * Whether a composer read is the body last reported submitted on this session:
+ * the whole of it, or — for a read long enough — its beginning.
+ */
+function matchesSubmittedBody(sessionName, composerText) {
+    return findSubmittedBody(sessionName, composerText) !== null;
+}
+/** Forget every session (tests). */
+function clearPromptSubmitReceipts() {
+    sessions.clear();
+    sessionByInstance.clear();
+}

package/dist/server/src/lib/session/prompt-waiting-guard.js

@@ -24,6 +24,7 @@ exports.PROMPT_WAITING_CODE = void 0;
 exports.isPromptWaiting = isPromptWaiting;
 exports.promptWaitingMessage = promptWaitingMessage;
 const manager_1 = require("../../lib/cli-tools/manager");
+const respond_target_1 = require("../../lib/session/respond-target");
 const cli_session_1 = require("../../lib/session/cli-session");
 const status_detector_1 = require("../../lib/detection/status-detector");
 const status_capture_config_1 = require("../../config/status-capture-config");
@@ -128,13 +129,25 @@ async function isPromptWaiting(worktreeId, cliToolId, instanceId, options) {
  * That is precisely the state where a guard turns into an outage, so the message
  * has to name the way past it and how long it lasts if they do nothing.
  *
+ * Issue #4031: the commands it names carry ` --instance <id>` when the refused
+ * request named an instance, so the answer goes to the instance that is
+ * waiting. A request for the primary instance (no `instanceId`) gets the
+ * sentence as before.
+ *
+ * Issue #4049: a request that named only a tool other than the worktree
+ * default gets ` --agent <tool>` instead (the caller decides, through
+ * `respondAgentFor`), since a bare `respond` goes to the default tool.
+ *
  * @param blockedBy - Which layer refused; omitted callers get the plain message
+ * @param instanceId - The instance the refused request named, if any
+ * @param agent - The tool to name when no instance was named (`respondAgentFor`)
  */
-function promptWaitingMessage(worktreeId, blockedBy) {
+function promptWaitingMessage(worktreeId, blockedBy, instanceId, agent) {
+    const target = (0, respond_target_1.respondTargetFlags)(instanceId, agent);
     const base = `${worktreeId} is waiting on a prompt. Sending now would type into the ` +
         `prompt's input line instead of reaching the agent, and would leave that ` +
         `text in place for the next answer. Answer the prompt first: ` +
-        `\`commandmate respond ${worktreeId} <answer>\`.`;
+        `\`commandmate respond ${worktreeId} <answer>${target}\`.`;
     if (blockedBy !== 'structured')
         return base;
     const ttlMinutes = Math.round(prompt_waiting_composition_1.STRUCTURED_SEND_BLOCK_MAX_AGE_MS / 60_000);
@@ -142,6 +155,6 @@ function promptWaitingMessage(worktreeId, blockedBy) {
         `visible to the terminal scraper, so if the pane looks idle the record has ` +
         `outlived its dialog: it stops blocking sends ${ttlMinutes} minutes after ` +
         `it was reported, or immediately with ` +
-        `\`commandmate send ${worktreeId} <message> --ignore-structured-prompt\` ` +
+        `\`commandmate send ${worktreeId} <message>${target} --ignore-structured-prompt\` ` +
         `(server-wide: ${prompt_waiting_composition_1.STRUCTURED_SEND_GUARD_ENV}=off).`);
 }

package/dist/server/src/lib/session/respond-target.js

@@ -0,0 +1,82 @@
+"use strict";
+/**
+ * Where the `respond` a server-side guidance sentence names has to go
+ * (Issue #4049).
+ *
+ * #4031 gave the PROMPT_WAITING refusal and the structured-dialog question a
+ * ` --instance <id>` when the request named an instance. A request that named
+ * only a tool (`send … --agent codex`) still got a bare `commandmate respond
+ * <id> <answer>`, and the CLI resolves a bare `respond` to the worktree's
+ * default tool — so the answer could reach a different agent than the one that
+ * is waiting.
+ *
+ * Type-only imports and string building, like `structured-prompt`, so the
+ * client bundle that reads that module can read this one too.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.respondTargetFlags = respondTargetFlags;
+exports.respondAgentFor = respondAgentFor;
+exports.commandCodePlanReviewSendMessage = commandCodePlanReviewSendMessage;
+/**
+ * The flags that aim a `respond` (or `send`) at the waiting session, by the
+ * CLI's own order (`targetFlags` in `src/cli/utils/follow-up-command.ts`): an
+ * instance first, else a tool, else nothing — the sentence as it was before.
+ *
+ * @param instanceId - The instance the request named, if any
+ * @param agent - The tool to name when no instance was named (see {@link respondAgentFor})
+ */
+function respondTargetFlags(instanceId, agent) {
+    if (instanceId)
+        return ` --instance ${instanceId}`;
+    if (agent)
+        return ` --agent ${agent}`;
+    return '';
+}
+/**
+ * The tool a guidance `respond` must name, or undefined when a bare one already
+ * reaches the waiting session.
+ *
+ * Only a request that named a tool explicitly and no instance gets one, and
+ * only when that tool is not what an unqualified request resolves to (the
+ * worktree default): `--agent claude` on a claude worktree, and a request that
+ * named nothing, keep the sentence they had (#4031's "primary and default are
+ * unchanged").
+ *
+ * @param requestedCliTool - The tool the request named explicitly, if any
+ * @param instanceId - The instance the request named, if any
+ * @param unqualifiedCliTool - The tool a request naming nothing resolves to
+ */
+function respondAgentFor(requestedCliTool, instanceId, unqualifiedCliTool) {
+    if (instanceId || !requestedCliTool)
+        return undefined;
+    return requestedCliTool === unqualifiedCliTool ? undefined : requestedCliTool;
+}
+/**
+ * Why `send` stops at the plan review overlay (Issue #3125).
+ *
+ * The overlay replaces the composer until a human decides, so waiting for the
+ * composer only ran out the clock (`prompt not ready` after the full timeout).
+ * Its comments, Submit review, approval and cancel go through `respond`.
+ *
+ * Issue #4049: a function, not a constant. The constant named a
+ * `<worktree-id>` placeholder and no instance, so on `command-code-2` the
+ * `respond` it showed went to the primary instance. The primary instance
+ * (no id, or the tool's own id — #868) gets no `--instance`.
+ *
+ * Issue #4063: and the tool, by {@link respondTargetFlags}' rule, when the
+ * request named Command Code on a worktree whose default is another tool
+ * ({@link respondAgentFor}). `CommandCodeTool.sendMessage` does not know the
+ * request, so the routes (send, terminal) rebuild the sentence with the `agent`
+ * they resolved; the tool's own throw leaves it out. Kept here, with no import
+ * beyond types, so those routes do not load the tool module.
+ *
+ * @param worktreeId - The worktree whose session is showing the review
+ * @param instanceId - The instance the send was for, if any
+ * @param agent - The tool the `respond` must name when no instance is (see `respondAgentFor`)
+ */
+function commandCodePlanReviewSendMessage(worktreeId, instanceId, agent) {
+    const target = respondTargetFlags(instanceId && instanceId !== 'command-code' ? instanceId : undefined, agent);
+    return ('Command Code is showing a plan review (REVIEW), which takes review comments, not messages. ' +
+        `Comment with \`commandmate respond ${worktreeId} "<text>"${target}\`, then \`--plan-review submit\` (ctrl+r), ` +
+        '`--plan-review approve` (ctrl+a) or `--plan-review cancel` (esc).');
+}