commandmate 0.49.1 → 0.49.3

package/dist/server/src/lib/session/send-attempt-state.js

@@ -22,12 +22,48 @@
  * Recording must never change a send's outcome: {@link recordSendAttempt}
  * swallows its own failures.
  *
+ * Issue #4065: which attempt is "the last" is decided by the input lock's
+ * grant order, not by which attempt finished last. Three kinds of record:
+ *
+ * - **granted** — the attempt held the body's input lock (`inputGeneration`,
+ *   the ticket's generation g). Includes one refused after the grant before
+ *   any key (g does not mean "typed"). Kept when g ≥ the instance's highest
+ *   granted generation so far (maxG), dropped when g < maxG: a send granted
+ *   later has already said how it went.
+ * - **refused** — `not-sent` before any lock was granted to it
+ *   (`observedGeneration`, the generation counter o read once at the request's
+ *   outermost entry). Kept when maxG ≤ o, dropped when maxG > o: a send granted
+ *   after this request began has already said how it went. o is only ever
+ *   compared with maxG — never with another o, nor with another instance's
+ *   grants; o = 0 is a value like any other.
+ * - **excluded / unknown** — neither (copilot's selection-list commands and
+ *   `/model`, opencode's HTTP delivery including its keyboard fallback after an
+ *   `unknown` dispatch, a tool path that reports nothing). Kept in the order
+ *   they finish, as before #4065, and they never move maxG.
+ *
+ * maxG is held beside the published record and only ever grows: a refused or
+ * excluded record, or a demotion ({@link markLastSendDiscarded}), never lowers
+ * it, so an older grant's late outcome cannot come back after them. Within one
+ * process the generation never goes back (a recreated session keeps counting);
+ * a restart forgets the records and maxG together. A worktree ID migration
+ * does not move them (the old ID's records are dropped). When more than
+ * {@link MAX_TRACKED_INSTANCES} instances are tracked the least recently sent
+ * to loses its record and its maxG together — a late outcome for it is then
+ * recorded as if it were the first.
+ *
+ * The published `lastSend` is still the three fields `at` / `state` /
+ * `reason`; neither g nor o is published, and `at` is not an order. It is the
+ * instance's last attempt by the rules above — not necessarily the reading
+ * request's own (that is `onAttempt` / `sendOutcome`).
+ *
  * @module lib/session/send-attempt-state
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.sendMessageDigest = sendMessageDigest;
 exports.recordSendAttempt = recordSendAttempt;
+exports.forgetSendAttemptsForWorktree = forgetSendAttemptsForWorktree;
 exports.getLastSendAttempt = getLastSendAttempt;
+exports.markLastSendDiscarded = markLastSendDiscarded;
 exports.clearSendAttempts = clearSendAttempts;
 exports.classifySendFailure = classifySendFailure;
 exports.composerHoldsMessage = composerHoldsMessage;
@@ -41,6 +77,13 @@ const logger = (0, logger_1.createLogger)('session/send-attempt-state');
 /** How many instances are tracked at once; the least recently sent to is forgotten first. */
 const MAX_TRACKED_INSTANCES = 1024;
 const records = (0, global_state_1.getOrInitGlobal)('__sendAttemptRecords', () => new Map());
+/**
+ * Issue #4065: per instance, the highest input generation a granted record
+ * carried (maxG). Kept apart from the published record so that a refused or
+ * excluded record — or a demotion — that replaces it does not forget it.
+ * Evicted with the instance's record.
+ */
+const maxGenerations = (0, global_state_1.getOrInitGlobal)('__sendAttemptMaxGeneration', () => new Map());
 function keyOf(instance) {
     return JSON.stringify([instance.worktreeId, instance.cliToolId, instance.instanceId]);
 }
@@ -51,36 +94,129 @@ function sendMessageDigest(content) {
 /**
  * Record how a send attempt ended. Never throws: a record that cannot be made
  * leaves the send exactly as it was.
+ *
+ * Issue #4048: `typedContent` is the body the sender actually typed when it
+ * differs from `content`; `inputGeneration` is the input lock generation the
+ * attempt ran under.
+ *
+ * Issue #4065: `observedGeneration` is the generation counter the request read
+ * at its outermost entry (`instanceInputGenerationMark` in `instance-input-lock`), given for a
+ * `not-sent` refusal made before any lock was granted to it. Which record is
+ * kept is decided against the instance's maxG (see the module comment):
+ * granted g ≥ maxG is kept (and raises maxG), g < maxG dropped; a refusal is
+ * kept when maxG ≤ o; a record with neither is kept, in the order recorded.
+ * `inputGeneration` wins when both are given.
+ *
+ * @returns Whether the attempt became the instance's record. The request's own
+ *   outcome is the caller's to report whatever this says (`onAttempt`).
  */
 function recordSendAttempt(instance, attempt, now = Date.now()) {
     try {
         const key = keyOf(instance);
+        const maxGeneration = maxGenerations.get(key);
+        if (attempt.inputGeneration !== undefined) {
+            if (maxGeneration !== undefined && maxGeneration > attempt.inputGeneration) {
+                logger.info('send-attempt-record-skipped-stale-generation', {
+                    generation: attempt.inputGeneration,
+                    heldGeneration: maxGeneration,
+                });
+                return false;
+            }
+        }
+        else if (attempt.observedGeneration !== undefined) {
+            if (maxGeneration !== undefined && maxGeneration > attempt.observedGeneration) {
+                logger.info('send-attempt-record-skipped-refusal-before-newer-grant', {
+                    observedGeneration: attempt.observedGeneration,
+                    heldGeneration: maxGeneration,
+                });
+                return false;
+            }
+        }
+        const messageDigest = sendMessageDigest(attempt.content);
+        const typedDigest = attempt.typedContent === undefined ? undefined : sendMessageDigest(attempt.typedContent);
         // Re-inserted, so the map's order is least recently sent to first.
         records.delete(key);
         records.set(key, {
             at: Math.floor(now),
             state: attempt.state,
             reason: attempt.reason,
-            messageDigest: sendMessageDigest(attempt.content),
+            messageDigest,
+            ...(typedDigest !== undefined && typedDigest !== messageDigest ? { typedDigest } : {}),
+            ...(attempt.inputGeneration !== undefined ? { inputGeneration: attempt.inputGeneration } : {}),
         });
+        if (attempt.inputGeneration !== undefined) {
+            maxGenerations.set(key, Math.max(maxGeneration ?? attempt.inputGeneration, attempt.inputGeneration));
+        }
         while (records.size > MAX_TRACKED_INSTANCES) {
             const oldest = records.keys().next().value;
             if (oldest === undefined)
                 break;
             records.delete(oldest);
+            maxGenerations.delete(oldest);
         }
+        return true;
     }
     catch (error) {
         logger.warn('send-attempt-record-failed', { error: error instanceof Error ? error.message : String(error) });
+        return false;
+    }
+}
+/**
+ * Forget the records — and their maxG — of every instance of `worktreeId`
+ * (Issue #4065): a worktree ID migration drops them rather than moving them,
+ * so the new ID starts with no record. Never throws.
+ */
+function forgetSendAttemptsForWorktree(worktreeId) {
+    try {
+        for (const key of [...records.keys(), ...maxGenerations.keys()]) {
+            const parsed = JSON.parse(key);
+            if (Array.isArray(parsed) && parsed[0] === worktreeId) {
+                records.delete(key);
+                maxGenerations.delete(key);
+            }
+        }
+    }
+    catch (error) {
+        logger.warn('send-attempt-forget-failed', { error: error instanceof Error ? error.message : String(error) });
     }
 }
 /** The instance's last recorded attempt, or null when none is held. */
 function getLastSendAttempt(instance) {
     return records.get(keyOf(instance)) ?? null;
 }
-/** Forget every record (tests). */
+/**
+ * Turn the instance's last `sent` record `indeterminate` (Issue #4035): the
+ * next send found that body still in the composer, so it never reached the
+ * agent. Any other record is left as it is. Never throws.
+ *
+ * `messageDigest` (Issue #4048) is the digest of the body that was found (the
+ * body typed, so it is matched against the record's `typedDigest` too): a
+ * record of another attempt — a later send, or one whose body differs — is
+ * left as it is. Omitted, the last `sent` record is demoted as before.
+ */
+function markLastSendDiscarded(instance, now = Date.now(), messageDigest) {
+    try {
+        const key = keyOf(instance);
+        const record = records.get(key);
+        if (record === undefined || record.state !== 'sent')
+            return;
+        if (messageDigest !== undefined &&
+            record.messageDigest !== messageDigest &&
+            record.typedDigest !== messageDigest) {
+            return;
+        }
+        // Issue #4065: the spread keeps the record's generation, and maxG is not
+        // touched — a demotion is not a newer attempt.
+        records.set(key, { ...record, at: Math.floor(now), state: 'indeterminate', reason: 'found-in-composer' });
+    }
+    catch (error) {
+        logger.warn('send-attempt-record-failed', { error: error instanceof Error ? error.message : String(error) });
+    }
+}
+/** Forget every record and every maxG (tests). */
 function clearSendAttempts() {
     records.clear();
+    maxGenerations.clear();
 }
 /**
  * The wordings of a failed tmux call that can carry the message body: `tmux.ts`
@@ -88,6 +224,25 @@ function clearSendAttempts() {
  * `Failed to send keys to tmux session: …` and the like (Issue #3880).
  */
 const TMUX_TRANSPORT_FAILURE = /Command failed: tmux |Failed to send (?:special )?keys? to tmux session|Failed to send special key:|Failed to paste message into tmux session/;
+/** How many `cause` links {@link carriesCode} follows: a tool's wrap is one. */
+const MAX_CAUSE_DEPTH = 4;
+/**
+ * Whether `error`, or an error it wraps (`cause`), carries `code`
+ * (Issue #4031). The tools wrap the sender's error as
+ * `Failed to send message to <tool>: …` with it as `cause`, so a code set
+ * before the wrap is read here, not lost.
+ */
+function carriesCode(error, code) {
+    let current = error;
+    for (let depth = 0; depth <= MAX_CAUSE_DEPTH; depth++) {
+        if (typeof current !== 'object' || current === null)
+            return false;
+        if (current.code === code)
+            return true;
+        current = current.cause;
+    }
+    return false;
+}
 /**
  * Where a failed `ICLITool.sendMessage` stopped, read from its error.
  *
@@ -97,6 +252,15 @@ const TMUX_TRANSPORT_FAILURE = /Command failed: tmux |Failed to send (?:special
  * (`Failed to send message to <tool>: …`), so they are matched anywhere in it.
  */
 function classifySendFailure(error) {
+    // #4040: opencode's keyboard fallback refused before any key (its cause says
+    // why — a code like `paste-not-started` included), but the server dispatch
+    // before it ended `unknown`: the message may already be there, so the attempt
+    // as a whole stays unknown, never "safe to resend". Read FIRST, before any
+    // code the cause carries.
+    if (error instanceof Error &&
+        /an earlier server dispatch may have delivered the message \(Issue #4040\)/.test(error.message)) {
+        return { state: 'indeterminate', reason: 'send-error' };
+    }
     if (typeof error === 'object' &&
         error !== null &&
         error.code === session_start_error_1.SESSION_STARTING_CODE) {
@@ -108,6 +272,12 @@ function classifySendFailure(error) {
         error.code === send_attempt_types_1.PLAN_REVIEW_SEND_REFUSED_CODE) {
         return { state: 'not-sent', reason: 'plan-review' };
     }
+    // Issue #4031: `load-buffer` failed, so `paste-buffer` never ran — read by
+    // code through the tool's wrap, never by wording (a `paste-buffer` failure,
+    // whose body may be on the pane, shares the transport wording below).
+    if (carriesCode(error, send_attempt_types_1.PASTE_NOT_STARTED_CODE)) {
+        return { state: 'not-sent', reason: 'paste-not-started' };
+    }
     const message = error instanceof Error ? error.message : String(error);
     // Issue #3880: the "after the body was typed" wordings are matched FIRST. A
     // body-not-landed error quotes what the composer shows — the user's own text —
@@ -121,6 +291,11 @@ function classifySendFailure(error) {
     if (/replaced by a TUI autocompletion/.test(message)) {
         return { state: 'indeterminate', reason: 'replaced-by-completion' };
     }
+    // #4035: Enter sent, the composer did not show the body, and the agent did
+    // not report the session's first prompt.
+    if (/did not report the prompt within \d+ms \(Issue #4035\)/.test(message)) {
+        return { state: 'indeterminate', reason: 'prompt-unreported' };
+    }
     // #1471: typed, Enter sent (more than once), never confirmed.
     if (/submit could not be confirmed/i.test(message)) {
         return { state: 'indeterminate', reason: 'submit-unconfirmed' };

package/dist/server/src/lib/session/send-attempt-types.js

@@ -9,12 +9,21 @@
  * @module lib/session/send-attempt-types
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.INPUT_RECHECK_FAILED_CODE = exports.INPUT_RECHECK_PROMPT_WAITING_CODE = exports.PLAN_REVIEW_SEND_REFUSED_CODE = void 0;
+exports.INPUT_RECHECK_FAILED_CODE = exports.INPUT_RECHECK_PROMPT_WAITING_CODE = exports.PASTE_NOT_STARTED_CODE = exports.PLAN_REVIEW_SEND_REFUSED_CODE = void 0;
 /**
  * `code` on the error a tool throws when a plan review overlay refuses the
  * send before any body is typed (Issue #3772). Matched by code, never by wording.
  */
 exports.PLAN_REVIEW_SEND_REFUSED_CODE = 'PLAN_REVIEW_SEND_REFUSED';
+/**
+ * `code` on the error a long body's paste throws when `load-buffer` failed
+ * (Issue #4031): `paste-buffer` never ran, so none of the body reached the
+ * pane. The tools wrap the error (`Failed to send message to <tool>: …`) with
+ * it as `cause`, and the send's outcome is read off that chain by code — the
+ * wording is shared with nothing, but a `paste-buffer` failure's is
+ * (`Failed to paste message into tmux session`) and that one is not known safe.
+ */
+exports.PASTE_NOT_STARTED_CODE = 'PASTE_NOT_STARTED';
 /**
  * `code` on the errors the input re-check throws before any key
  * (`recheckComposerBeforeInput`, Issue #3952): a dialog was open, or the pane

package/dist/server/src/lib/session/send-user-message.js

@@ -132,6 +132,18 @@ async function composerStillHolds(worktreeId, cliToolId, instanceId, content) {
         return false;
     }
 }
+/**
+ * The body the tool will actually type for `content` (Issue #4048): with an
+ * image, the image-capable tool's own body (`imageMessageBody`) or the path
+ * fallback; otherwise `content` itself. Must match what `sendToTool` sends.
+ */
+function typedBodyFor(cliTool, content, absoluteImagePath) {
+    if (!absoluteImagePath)
+        return content;
+    if ((0, types_1.isImageCapableCLITool)(cliTool))
+        return cliTool.imageMessageBody?.(content, absoluteImagePath) ?? content;
+    return (0, opencode_1.formatImagePathFallbackMessage)(content, absoluteImagePath);
+}
 /**
  * Send a validated user message to the CLI tool and record it in history.
  *
@@ -140,7 +152,11 @@ async function composerStillHolds(worktreeId, cliToolId, instanceId, content) {
  * DB record failures throw (same as before the extraction).
  */
 async function sendUserMessage(db, params) {
-    const { worktreeId, content, cliToolId, instanceId, absoluteImagePath, copilotModel } = params;
+    const { worktreeId, content, cliToolId, instanceId, absoluteImagePath, copilotModel, respondAgent } = params;
+    // Issue #4065: read once, before the first await — a send granted while this
+    // request waits (ownership, the prompt guard, `/model`, the lock) is newer
+    // than this request's refusal.
+    const observedGeneration = params.observedInputGeneration ?? (0, instance_input_lock_1.instanceInputGenerationMark)();
     const messageType = params.messageType ?? 'normal';
     /**
      * The instance this send belongs to, resolved the way `createMessage` and
@@ -154,8 +170,47 @@ async function sendUserMessage(db, params) {
     // Issue #3759: how this attempt left the message, kept for `lastSend` (and
     // read back by the send route for its error). The result's shape is
     // unchanged; recording never throws.
+    //
+    // Issue #4048: the record also carries the body actually typed (an image
+    // reference appended), which is what the composer and the first-prompt
+    // receipt know the attempt by, and the input lock generation the delivery
+    // ran under, so the late outcome of a send whose session was replaced does
+    // not overwrite the newer generation's record.
+    //
+    // Issue #4065: which record is the instance's last is decided by the lock's
+    // grant order (`send-attempt-state`). This send's record is one of:
+    // - granted: the body's lock was granted to it (`inputGeneration`) — the
+    //   outer lock below for claude / codex, the shared sender's own lock for the
+    //   others, told through `observeInputStart` as it is granted, so a send that
+    //   throws after it keeps it. Refused after the grant, before any key, too.
+    // - refused: `not-sent` with no lock granted (ownership, the prompt guard,
+    //   `/model`, the lock not admitted, a readiness wait before the sender's
+    //   lock) — carries `observedGeneration`.
+    // - excluded: typed or dispatched outside the shared sender's lock —
+    //   copilot's selection-list keys (input noted, no ticket), opencode's HTTP
+    //   delivery and its keyboard fallback (a dispatch noted) — or anything else
+    //   that reports neither; kept in the order attempts finish.
+    const typedContent = typedBodyFor(cliTool, content, absoluteImagePath);
+    let inputGeneration;
+    let inputNotedWithoutTicket = false;
+    let dispatched = false;
     const settle = (state, reason) => {
-        (0, send_attempt_state_1.recordSendAttempt)({ worktreeId, cliToolId, instanceId: resolvedInstanceId }, { state, reason, content });
+        const excluded = dispatched || (inputGeneration === undefined && inputNotedWithoutTicket);
+        const order = excluded
+            ? {}
+            : inputGeneration !== undefined
+                ? { inputGeneration }
+                : state === 'not-sent'
+                    ? { observedGeneration }
+                    : {};
+        (0, send_attempt_state_1.recordSendAttempt)({ worktreeId, cliToolId, instanceId: resolvedInstanceId }, {
+            state,
+            reason,
+            content,
+            ...(typedContent !== content ? { typedContent } : {}),
+            ...order,
+        });
+        // Told whether or not the shared record took it: this is the request's own.
         params.onAttempt?.({ state, reason });
     };
     // Issue #2865: the send route checks ownership itself, but the timer manager
@@ -215,7 +270,7 @@ async function sendUserMessage(db, params) {
         return {
             ok: false,
             stage: 'prompt_waiting',
-            error: (0, prompt_waiting_guard_1.promptWaitingMessage)(worktreeId, promptGuard.blockedBy),
+            error: (0, prompt_waiting_guard_1.promptWaitingMessage)(worktreeId, promptGuard.blockedBy, instanceId, respondAgent),
         };
     }
     // 1. Issue #576: Send /model command before message if model is specified (copilot only).
@@ -248,7 +303,7 @@ async function sendUserMessage(db, params) {
             const code = error?.code;
             if (code === send_attempt_types_1.INPUT_RECHECK_PROMPT_WAITING_CODE) {
                 settle('not-sent', 'prompt-waiting');
-                return { ok: false, stage: 'prompt_waiting', error: (0, prompt_waiting_guard_1.promptWaitingMessage)(worktreeId) };
+                return { ok: false, stage: 'prompt_waiting', error: (0, prompt_waiting_guard_1.promptWaitingMessage)(worktreeId, undefined, instanceId, respondAgent) };
             }
             settle('not-sent', code === send_attempt_types_1.INPUT_RECHECK_FAILED_CODE ? 'recheck-failed' : 'model-switch-failed');
             return { ok: false, stage: 'model', error: getErrorMessage(error) };
@@ -347,7 +402,20 @@ async function sendUserMessage(db, params) {
     // path that does not report it).
     async function deliver() {
         try {
-            const { inputStartedAt } = await (0, instance_input_lock_1.observeInputStart)(sendToTool, params.onInputStart, params.inputBoundary);
+            const { inputStartedAt } = await (0, instance_input_lock_1.observeInputStart)(sendToTool, (at) => {
+                // Issue #4065: input noted before any body lock was told — copilot's
+                // selection-list keys, under its own lock.
+                if (inputGeneration === undefined)
+                    inputNotedWithoutTicket = true;
+                params.onInputStart?.(at);
+            }, params.inputBoundary, {
+                onTicket: (generation) => {
+                    inputGeneration = inputGeneration === undefined ? generation : Math.max(inputGeneration, generation);
+                },
+                onDispatch: () => {
+                    dispatched = true;
+                },
+            });
             return { sent: true, inputStartedAt };
         }
         catch (error) {
@@ -360,7 +428,8 @@ async function sendUserMessage(db, params) {
             }
             // Issue #3759: not-sent only when the error says the body was never typed.
             let failure = (0, send_attempt_state_1.classifySendFailure)(error);
-            if (failure.reason === 'submit-unconfirmed' && (await composerStillHolds(worktreeId, cliToolId, instanceId, content))) {
+            if ((failure.reason === 'submit-unconfirmed' || failure.reason === 'prompt-unreported') &&
+                (await composerStillHolds(worktreeId, cliToolId, instanceId, content))) {
                 failure = { state: 'indeterminate', reason: 'composer-residue' };
             }
             return { error, failure };
@@ -404,7 +473,10 @@ async function sendUserMessage(db, params) {
     // the lock across it would stall a concurrent tmux send for nothing; their
     // tmux path takes the lock inside the shared sender.
     const delivery = composer_text_1.SUPPORTED_COMPOSER_TOOLS.has(cliToolId)
-        ? await (0, instance_input_lock_1.withInstanceInputLock)(sessionName, () => deliver()).catch((error) => ({
+        ? await (0, instance_input_lock_1.withInstanceInputLock)(sessionName, (ticket) => {
+            inputGeneration = ticket.generation;
+            return deliver();
+        }).catch((error) => ({
             error,
             failure: (0, send_attempt_state_1.classifySendFailure)(error),
         }))
@@ -415,7 +487,7 @@ async function sendUserMessage(db, params) {
         // Issue #3945: a dialog found by the re-check under the lock is the prompt
         // guard's refusal, found late — answered as that refusal (relay holds it).
         if (failure.reason === 'prompt-waiting') {
-            return { ok: false, stage: 'prompt_waiting', error: (0, prompt_waiting_guard_1.promptWaitingMessage)(worktreeId) };
+            return { ok: false, stage: 'prompt_waiting', error: (0, prompt_waiting_guard_1.promptWaitingMessage)(worktreeId, undefined, instanceId, respondAgent) };
         }
         if ((0, session_start_error_1.isSessionStartTimeoutError)(error)) {
             return { ok: false, stage: 'send', error: error.message, code: session_start_error_1.SESSION_STARTING_CODE };