commandmate 0.49.1 → 0.49.3

package/dist/lib/verification/session-kill-ledger.js

@@ -0,0 +1,174 @@
+"use strict";
+/**
+ * Record of `mcbd-*` sessions stopped through CommandMate's kill (Issue #3993).
+ *
+ * The `env-clean` gate counts every vanished session of a sibling worktree as a
+ * violation, because a worker killing its neighbour is the #1624 failure. The
+ * orchestrator stops sibling sessions too — `commandmate instances <wt> kill`
+ * when it cleans a worktree up (worktree-cleanup Phase 3), the UI's kill
+ * button, the server's cleanup after sync or a repository removal — and the two
+ * snapshots cannot tell that apart from a worker's kill: on 2026-10-29 four
+ * verification runs of #3957 failed on `- mcbd-…-<another worktree> [other]`
+ * for a cleanup nobody in the worker's transcript had run.
+ *
+ * This ledger is the missing fact: one line per kill, naming the API, the
+ * tmux sessions it actually stopped, the worktree it was for and who asked
+ * (the caller's working directory and tmux session). The gate excuses as little
+ * as it can prove is not the worker's (`env-clean-gate.ts`, `findExternalKill`):
+ * a vanished sibling session is `external` only when a line inside the task's
+ * window names that exact session, was written by the CLI, and its caller is
+ * known to be someone else — a cwd in a sibling directory of the task's
+ * worktree (the primary checkout, another worktree) or a tmux session of
+ * another worktree. Everything else stays a violation, exactly as before:
+ * a worker's own kill, a caller that is nowhere in particular (`/tmp`, `$HOME`),
+ * the route's and the server's lines (a worker can reach the UI and trigger
+ * sync too), and any kill that bypassed CommandMate (`tmux kill-session`), which
+ * records nothing. Those lines are still shown next to the violation.
+ *
+ * Written by the CLI (with its caller), by the kill-session route and by
+ * `session-cleanup.ts`. A CLI kill is therefore recorded twice — the CLI's line
+ * and the route's `http` line — which changes no verdict: only the CLI's line
+ * can excuse anything.
+ *
+ * Machine-wide, like the gate mutex (`machine-lock.ts`): the CLI and the server
+ * write it and the server's gate reads it, so the path is derived from `$HOME` alone —
+ * `~/.commandmate/session-kills/<UTC date>.jsonl` — with an override for tests.
+ * The `commandmate-entries` probe ignores the directory, like `locks`.
+ *
+ * Node built-ins only: the CLI imports this module.
+ *
+ * @module lib/verification/session-kill-ledger
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SESSION_KILL_LEDGER_RETENTION_MS = exports.SESSION_KILL_LEDGER_VERSION = exports.SESSION_KILL_LEDGER_ROOT_ENV = exports.SESSION_KILL_LEDGER_DIR_NAME = void 0;
+exports.defaultSessionKillLedgerRoot = defaultSessionKillLedgerRoot;
+exports.resolveSessionKillLedgerRoot = resolveSessionKillLedgerRoot;
+exports.appendSessionKillRecord = appendSessionKillRecord;
+exports.isSessionKillRecord = isSessionKillRecord;
+exports.readSessionKillRecords = readSessionKillRecords;
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path_1 = require("path");
+/** Directory under `~/.commandmate`; exported for the `commandmate-entries` probe. */
+exports.SESSION_KILL_LEDGER_DIR_NAME = 'session-kills';
+/** Overrides the ledger directory (tests, isolated environments). */
+exports.SESSION_KILL_LEDGER_ROOT_ENV = 'CM_SESSION_KILL_LEDGER_ROOT';
+/** Bumped only when a line stops being readable by this module. */
+exports.SESSION_KILL_LEDGER_VERSION = 1;
+/** Day files older than this are removed when a new line is written (same as env snapshots). */
+exports.SESSION_KILL_LEDGER_RETENTION_MS = 30 * 24 * 60 * 60 * 1000;
+const DAY_MS = 24 * 60 * 60 * 1000;
+const DAY_FILE_PATTERN = /^(\d{4}-\d{2}-\d{2})\.jsonl$/;
+const SESSION_KILL_APIS = ['kill-session', 'session-cleanup'];
+const SESSION_KILL_ORIGINS = ['cli', 'browser', 'http', 'server'];
+function defaultSessionKillLedgerRoot() {
+    return (0, path_1.join)((0, os_1.homedir)(), '.commandmate', exports.SESSION_KILL_LEDGER_DIR_NAME);
+}
+function resolveSessionKillLedgerRoot(env = process.env) {
+    const override = env[exports.SESSION_KILL_LEDGER_ROOT_ENV];
+    return override && override.trim() !== '' ? override : defaultSessionKillLedgerRoot();
+}
+function dayOf(epochMs) {
+    return new Date(epochMs).toISOString().slice(0, 10);
+}
+function pruneOldDays(root, now) {
+    const oldest = dayOf(now - exports.SESSION_KILL_LEDGER_RETENTION_MS);
+    let names;
+    try {
+        names = (0, fs_1.readdirSync)(root);
+    }
+    catch {
+        return;
+    }
+    for (const name of names) {
+        const day = DAY_FILE_PATTERN.exec(name)?.[1];
+        if (day === undefined || day >= oldest)
+            continue;
+        try {
+            (0, fs_1.rmSync)((0, path_1.join)(root, name), { force: true });
+        }
+        catch {
+            // A day file that cannot be removed is disk use, not a reason to fail a kill.
+        }
+    }
+}
+/**
+ * Append one kill. Never throws: the kill already happened, and failing the
+ * command over its bookkeeping would only hide that.
+ *
+ * @returns true when the line was written
+ */
+function appendSessionKillRecord(record, root = resolveSessionKillLedgerRoot()) {
+    try {
+        (0, fs_1.mkdirSync)(root, { recursive: true, mode: 0o700 });
+        // One short line per append; O_APPEND keeps concurrent writers' lines whole.
+        (0, fs_1.appendFileSync)((0, path_1.join)(root, `${dayOf(record.at)}.jsonl`), `${JSON.stringify(record)}\n`, {
+            encoding: 'utf8',
+            mode: 0o600,
+        });
+        pruneOldDays(root, record.at);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function isNullableString(value) {
+    return value === null || typeof value === 'string';
+}
+/** Whether a parsed line is a record this module can use; anything else is skipped. */
+function isSessionKillRecord(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const record = value;
+    return (record.version === exports.SESSION_KILL_LEDGER_VERSION &&
+        typeof record.at === 'number' &&
+        typeof record.api === 'string' &&
+        SESSION_KILL_APIS.includes(record.api) &&
+        typeof record.origin === 'string' &&
+        SESSION_KILL_ORIGINS.includes(record.origin) &&
+        typeof record.worktreeId === 'string' &&
+        record.worktreeId !== '' &&
+        isNullableString(record.instanceId) &&
+        Array.isArray(record.sessionNames) &&
+        record.sessionNames.every((name) => typeof name === 'string') &&
+        isNullableString(record.callerCwd) &&
+        isNullableString(record.callerSession));
+}
+/**
+ * The kills recorded in `[since, until]` (epoch ms, inclusive).
+ *
+ * A missing directory, an unreadable day file and a malformed line all read as
+ * "no record", which only ever excuses less.
+ */
+function readSessionKillRecords(since, until, root = resolveSessionKillLedgerRoot()) {
+    if (!(since <= until))
+        return [];
+    // Nothing older than the retention survives, so a stale baseline costs no extra reads.
+    since = Math.max(since, until - exports.SESSION_KILL_LEDGER_RETENTION_MS - DAY_MS);
+    const records = [];
+    for (let day = Date.parse(`${dayOf(since)}T00:00:00.000Z`); day <= until; day += DAY_MS) {
+        let text;
+        try {
+            text = (0, fs_1.readFileSync)((0, path_1.join)(root, `${dayOf(day)}.jsonl`), 'utf8');
+        }
+        catch {
+            continue;
+        }
+        for (const line of text.split('\n')) {
+            if (line.trim() === '')
+                continue;
+            let parsed;
+            try {
+                parsed = JSON.parse(line);
+            }
+            catch {
+                continue;
+            }
+            if (isSessionKillRecord(parsed) && parsed.at >= since && parsed.at <= until) {
+                records.push(parsed);
+            }
+        }
+    }
+    return records;
+}

package/dist/server/locales/en/worktree.json

@@ -1138,6 +1138,7 @@
     "promptResponse": {
         "refused": "Your answer was not sent because the dialog has changed. Please check the screen.",
         "failed": "Could not send the answer. Please try again.",
+        "partial": "The answer stopped part-way: some of its keys may have reached the agent. Check the screen before answering again.",
         "stuckHint": "If sending does not work, operate the terminal in direct input mode.",
         "stuckHintLink": "Switch to direct input",
         "unanswerable": "CommandMate cannot operate this screen. Use direct input mode instead.",
@@ -1169,6 +1170,7 @@
             "nothingToSubmit": "There is no comment to submit. Add a comment first.",
             "invalidRequest": "That action does not fit this screen. Nothing was sent.",
             "notActive": "Nothing was sent: no plan review is on screen.",
+            "inputLost": "Stopped part-way: some keys may have reached the agent. Check the screen before trying again.",
             "generic": "Could not send."
         },
         "composerNotice": "The plan is waiting for your review — approve, cancel or comment.",
@@ -1284,6 +1286,13 @@
         "stripAwaitingMany": "Waiting for {count} delegated replies.",
         "stripPrompt": "{alias} is waiting for a confirmation.",
         "stripOwed": "Owed to {alias}: this session's reply is delivered when the turn ends.",
+        "badgeHeld": "Delivery from {alias} unconfirmed",
+        "badgeHeldMany": "Unconfirmed deliveries ({count})",
+        "heldTitle": "Whether a relay delivery to this session (a reply, a confirmation notice or an expiry notice) arrived is not known. It is not resent automatically. Check this pane, then settle it with commandmate relays resolve.",
+        "stripHeld": "Delivery from {alias} unconfirmed: check this pane, then settle it with relays resolve.",
+        "stripHeldMany": "{count} unconfirmed deliveries: check this pane, then settle them with relays resolve.",
+        "unplacedHeldHeading": "Unconfirmed deliveries to sessions not in the roster",
+        "unplacedHeldLine": "{requester} ← {alias} (relay {relayId})",
         "historyBadge": "relay",
         "historyBadgeTitle": "Delivered by another agent session (Issue #2377 relay).",
         "historyCount": "{count} relayed message(s) in view"

package/dist/server/locales/ja/worktree.json

@@ -1138,6 +1138,7 @@
     "promptResponse": {
         "refused": "ダイアログの状態が変わったため送信できませんでした。画面を確認してください。",
         "failed": "送信に失敗しました。もう一度お試しください。",
+        "partial": "回答の途中で止まりました。一部のキーが届いた可能性があります。画面を確認してから答え直してください。",
         "stuckHint": "送信がうまくいかない場合は、直接入力モードで操作してください。",
         "stuckHintLink": "直接入力に切り替える",
         "unanswerable": "この画面は CommandMate から操作できません。直接入力モードで操作してください。",
@@ -1169,6 +1170,7 @@
             "nothingToSubmit": "送るコメントがありません。先にコメントを追加してください。",
             "invalidRequest": "この画面では送れない操作です。何も送っていません。",
             "notActive": "計画のレビュー画面が表示されていないため、何も送っていません。",
+            "inputLost": "途中で止まりました。一部のキーが届いた可能性があります。画面を確認してから操作し直してください。",
             "generic": "送信できませんでした。"
         },
         "composerNotice": "計画の確認待ちです。承認・取り消し・コメントを選んでください",
@@ -1284,6 +1286,13 @@
         "stripAwaitingMany": "返信待ち {count} 件",
         "stripPrompt": "{alias} が確認待ち",
         "stripOwed": "{alias} へ返信予定: ターン完了時に届きます",
+        "badgeHeld": "{alias} からの配送が未確認",
+        "badgeHeldMany": "配送未確認 {count} 件",
+        "heldTitle": "このセッションへの relay の配送（返信・確認待ちの通知・期限切れの通知）が届いたか分かりません。自動では再送しません。この画面を確かめてから commandmate relays resolve で片付けてください。",
+        "stripHeld": "{alias} からの配送が未確認: 画面を確かめて relays resolve で片付けてください",
+        "stripHeldMany": "配送未確認 {count} 件: 画面を確かめて relays resolve で片付けてください",
+        "unplacedHeldHeading": "名簿に無いセッションへの配送未確認",
+        "unplacedHeldLine": "{requester} ← {alias}（relay {relayId}）",
         "historyBadge": "relay",
         "historyBadgeTitle": "別のエージェントセッションから届いたメッセージです（Issue #2377 relay）。",
         "historyCount": "表示範囲に relay メッセージが {count} 件"

package/dist/server/src/config/cli-tool-timing-config.js

@@ -20,7 +20,7 @@
  * All values are preserved from the original literals (no behavior change).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LIVENESS_CONFIRM_DELAY_MS = exports.CLAUDE_ENV_SANITIZE_WAIT_MS = exports.OPENCODE_V2_COMPOSER_WAIT_MS = exports.OPENCODE_V2_EXIT_WAIT_MS = exports.COMMAND_CODE_INIT_WAIT_MS = exports.VIBE_LOCAL_DOUBLE_ENTER_WAIT_MS = exports.COPILOT_EXIT_WAIT_MS = exports.OPENCODE_INTERRUPT_SECOND_ESCAPE_DELAY_MS = exports.OPENCODE_EXIT_WAIT_MS = exports.CODEX_DIALOG_SETTLE_MS = exports.TUI_EXIT_WAIT_MS = exports.TUI_INTERRUPT_SETTLE_MS = exports.TUI_MESSAGE_PROCESSED_WAIT_MS = exports.TUI_TEXT_INPUT_WAIT_MS = exports.TUI_SESSION_CREATE_WAIT_MS = void 0;
+exports.LIVENESS_CONFIRM_DELAY_MS = exports.OPENCODE_V2_COMPOSER_WAIT_MS = exports.OPENCODE_V2_EXIT_WAIT_MS = exports.COMMAND_CODE_INIT_WAIT_MS = exports.VIBE_LOCAL_DOUBLE_ENTER_WAIT_MS = exports.COPILOT_EXIT_WAIT_MS = exports.OPENCODE_INTERRUPT_SECOND_ESCAPE_DELAY_MS = exports.OPENCODE_EXIT_WAIT_MS = exports.CODEX_DIALOG_SETTLE_MS = exports.TUI_EXIT_WAIT_MS = exports.TUI_INTERRUPT_SETTLE_MS = exports.TUI_MESSAGE_PROCESSED_WAIT_MS = exports.TUI_TEXT_INPUT_WAIT_MS = exports.TUI_SESSION_CREATE_WAIT_MS = void 0;
 /**
  * Wait (ms) after `createSession()` before sending the first keys, giving tmux
  * time to spin up the session.
@@ -156,12 +156,6 @@ exports.OPENCODE_V2_EXIT_WAIT_MS = 3000;
  * Site: opencode-v2 sendMessage().
  */
 exports.OPENCODE_V2_COMPOSER_WAIT_MS = 15000;
-/**
- * Wait (ms) for the `unset CLAUDECODE` command to reach the shell while
- * sanitizing the session environment (empirically determined).
- * Site: session-key-sender sanitizeSessionEnvironment().
- */
-exports.CLAUDE_ENV_SANITIZE_WAIT_MS = 100;
 /**
  * Wait (ms) between the two liveness readings that must agree before a reuse
  * path re-sends a launch command (Issue #2070).

package/dist/server/src/lib/auto-yes-poller.js

@@ -10,7 +10,11 @@
  * Dependencies: auto-yes-state.ts (composite keys / state), polling/* (prompt
  * detection, resolver, policy, dialog gate, session epoch, poller state,
  * decision record), cli-tools/*, session/cli-session.ts, tmux/*, detection/*,
- * db/*, tasks/*.
+ * db/*, tasks/*. Split out of this file (Issue #3893): auto-yes-poller-tick.ts
+ * (tick reading / no-prompt bookkeeping / decision recorder),
+ * auto-yes-poller-answer-target.ts (answer target), auto-yes-poller-session-presence.ts
+ * (whether a failed capture's session is gone) and auto-yes-poller-keys.ts
+ * (which composite keys have a poller entry).
  *
  * Issue #3821: this poller (with the hook / API adjudication) is what answers
  * automatically. The browser no longer answers, and the Enter sent to a choice

package/dist/server/src/lib/cli-tools/antigravity.js

@@ -267,7 +267,9 @@ class AntigravityTool extends base_1.BaseCLITool {
             // screen is this window's to confirm; the poller records nothing for it.
             (0, antigravity_startup_trust_1.beginStartupWindow)(sessionName);
             try {
-                await (0, tmux_1.sendKeys)(sessionName, (0, launch_screen_1.withLaunchScreenCleared)(launchCommand), true);
+                // Issue #3981: in one writer's turn of the input lock; the waits below
+                // stay outside it.
+                await this.typeLaunchLines(sessionName, [(0, launch_screen_1.withLaunchScreenCleared)(launchCommand)]);
                 // Wait for agy to initialize
                 await new Promise((resolve) => setTimeout(resolve, ANTIGRAVITY_INIT_WAIT_MS));
                 // Poll until the interactive prompt is ready (handles the trust dialog)
@@ -494,7 +496,8 @@ class AntigravityTool extends base_1.BaseCLITool {
         }
         catch (error) {
             const errorMessage = (0, errors_1.getErrorMessage)(error);
-            throw new Error(`Failed to send message to Antigravity: ${errorMessage}`);
+            // Issue #4031: the cause keeps a failed `load-buffer`'s code (`classifySendFailure`).
+            throw new Error(`Failed to send message to Antigravity: ${errorMessage}`, { cause: error });
         }
     }
     /**

package/dist/server/src/lib/cli-tools/base.js

@@ -31,6 +31,8 @@ const terminal_keys_1 = require("../../types/terminal-keys");
 const cli_tool_timing_config_1 = require("../../config/cli-tool-timing-config");
 const tmux_pane_config_1 = require("../../config/tmux-pane-config");
 const session_starting_state_1 = require("../session/session-starting-state");
+const session_launch_flight_1 = require("../session/session-launch-flight");
+const launch_keys_1 = require("./launch-keys");
 const execAsync = (0, util_1.promisify)(child_process_1.exec);
 const logger = (0, logger_1.createLogger)('cli-tools/base');
 /**
@@ -221,6 +223,27 @@ class BaseCLITool {
      * @throws Whatever {@link launchSession} threw — unchanged, after reporting
      */
     async startSession(worktreeId, worktreePath, instanceId, model) {
+        // Issue #3981: one launch per session (`session-launch-flight`). A second
+        // request joins the launch in progress instead of starting its own — whose
+        // reuse branch would kill the first one's half-launched pane — and a caller
+        // that holds the input lock is refused rather than made to wait (R1). A
+        // name that does not validate is left to `launchSession` to refuse, and
+        // reported as before. A start that asks for a model the launch in
+        // progress is not starting with is refused instead of joining it (#2771).
+        let sessionName = null;
+        try {
+            sessionName = this.getSessionName(worktreeId, instanceId);
+        }
+        catch {
+            // fall through: launchSession throws on it, inside the reporting below
+        }
+        const launch = () => this.startSessionOnce(worktreeId, worktreePath, instanceId, model);
+        if (sessionName === null)
+            return launch();
+        return (0, session_launch_flight_1.runSessionLaunch)(sessionName, this.name, launch, { cliToolId: this.id, model });
+    }
+    /** {@link startSession}'s body: one launch, its failure reported once. */
+    async startSessionOnce(worktreeId, worktreePath, instanceId, model) {
         // Issue #3195: this launch's "starting" record is written under this token
         // (see `session-starting-state`), so the `finally` below clears this
         // launch's record and never a later launch's of the same instance.
@@ -615,6 +638,11 @@ class BaseCLITool {
      */
     async requireSession(label, worktreeId, instanceId, options) {
         const sessionName = this.getSessionName(worktreeId, instanceId);
+        // Issue #3981: a pane another request is still launching reads as
+        // "exists, tool not live" and would be relaunched or typed into. Wait for
+        // that launch first — or, holding the input lock (claude and codex send
+        // under it), refuse with nothing typed (R1).
+        await (0, session_launch_flight_1.settleSessionLaunch)(sessionName, this.name);
         const exists = await (0, tmux_1.hasSession)(sessionName);
         if (!exists) {
             throw new Error(`${label} session ${sessionName} does not exist. Start the session first.`);
@@ -683,6 +711,17 @@ class BaseCLITool {
         }
         return { sessionName, exists, live: false };
     }
+    /**
+     * Type a launch's keys — its launch line, and anything that has to go in
+     * before it — in one `exclusive` turn of the instance input lock (Issue
+     * #3981, `./launch-keys`). The waits after the keys stay outside the lock.
+     *
+     * @param sessionName - tmux session name
+     * @param steps - Lines typed with Enter, or steps that type their own keys
+     */
+    async typeLaunchLines(sessionName, steps) {
+        await (0, launch_keys_1.typeLaunchLines)(sessionName, steps);
+    }
     /**
      * Create the tmux session a launch types into, then wait
      * {@link TUI_SESSION_CREATE_WAIT_MS} for it. Creation path only: on the #2070

package/dist/server/src/lib/cli-tools/claude.js

@@ -97,9 +97,15 @@ class ClaudeTool extends base_1.BaseCLITool {
      * @param instanceId - Optional agent instance ID (defaults to primary)
      */
     async sendMessageWithImage(worktreeId, message, imagePath, instanceId) {
+        await this.sendMessage(worktreeId, this.imageMessageBody(message, imagePath), instanceId);
+    }
+    /**
+     * The body {@link sendMessageWithImage} types: the message with the image's
+     * markdown reference appended (Issue #4048: the send's record digests it).
+     */
+    imageMessageBody(message, imagePath) {
         const imageMarkdown = `\n![](${imagePath})`;
-        const fullMessage = message ? `${message}${imageMarkdown}` : imageMarkdown;
-        await this.sendMessage(worktreeId, fullMessage, instanceId);
+        return message ? `${message}${imageMarkdown}` : imageMarkdown;
     }
     /**
      * Kill Claude session

package/dist/server/src/lib/cli-tools/codex.js

@@ -244,11 +244,13 @@ class CodexTool extends base_1.BaseCLITool {
             // as the new one's.
             const relaunchIntoSamePane = async () => {
                 (0, agent_session_lifecycle_1.beginAgentSession)({ worktreeId, cliToolId: sources_1.CODEX_CLI_TOOL_ID, instanceId });
-                await (0, tmux_1.sendKeys)(sessionName, (0, launch_screen_1.withLaunchScreenCleared)(launchCommand), true);
+                // Issue #3981: one writer's turn, as the first launch line below.
+                await this.typeLaunchLines(sessionName, [(0, launch_screen_1.withLaunchScreenCleared)(launchCommand)]);
                 await new Promise((resolve) => setTimeout(resolve, CODEX_INIT_WAIT_MS));
             };
-            // Start Codex CLI in interactive mode
-            await (0, tmux_1.sendKeys)(sessionName, (0, launch_screen_1.withLaunchScreenCleared)(launchCommand), true);
+            // Start Codex CLI in interactive mode. Issue #3981: in one writer's turn
+            // of the input lock (joined when this launch runs inside a send's).
+            await this.typeLaunchLines(sessionName, [(0, launch_screen_1.withLaunchScreenCleared)(launchCommand)]);
             // Wait for Codex to initialize
             await new Promise((resolve) => setTimeout(resolve, CODEX_INIT_WAIT_MS));
             // Poll until Codex interactive prompt is ready
@@ -771,7 +773,8 @@ class CodexTool extends base_1.BaseCLITool {
         }
         catch (error) {
             const errorMessage = (0, errors_1.getErrorMessage)(error);
-            throw new Error(`Failed to send message to Codex: ${errorMessage}`);
+            // Issue #4031: the cause keeps a failed `load-buffer`'s code (`classifySendFailure`).
+            throw new Error(`Failed to send message to Codex: ${errorMessage}`, { cause: error });
         }
     }
     /**

package/dist/server/src/lib/cli-tools/command-code.js

@@ -36,7 +36,7 @@
  * only the correlation.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CommandCodeTool = exports.COMMAND_CODE_PLAN_REVIEW_SEND_MESSAGE = exports.COMMAND_CODE_STARTING_WINDOW_MS = exports.COMMAND_CODE_EXIT_COMMAND = exports.COMMAND_CODE_LAUNCH_FLAGS = exports.COMMAND_CODE_COMMAND = void 0;
+exports.CommandCodeTool = exports.commandCodePlanReviewSendMessage = exports.COMMAND_CODE_STARTING_WINDOW_MS = exports.COMMAND_CODE_EXIT_COMMAND = exports.COMMAND_CODE_LAUNCH_FLAGS = exports.COMMAND_CODE_COMMAND = void 0;
 exports.buildCommandCodeLaunchCommand = buildCommandCodeLaunchCommand;
 exports.isCommandCodeReady = isCommandCodeReady;
 const base_1 = require("./base");
@@ -48,6 +48,8 @@ const cli_patterns_1 = require("../detection/cli-patterns");
 const errors_1 = require("../../lib/errors");
 const logger_1 = require("../../lib/logger");
 const send_attempt_types_1 = require("../../lib/session/send-attempt-types");
+const respond_target_1 = require("../../lib/session/respond-target");
+Object.defineProperty(exports, "commandCodePlanReviewSendMessage", { enumerable: true, get: function () { return respond_target_1.commandCodePlanReviewSendMessage; } });
 const tool_id_1 = require("../../lib/hooks/sources/command-code/tool-id");
 const agent_session_lifecycle_1 = require("../../lib/session/agent-session-lifecycle");
 const cli_tool_timing_config_1 = require("../../config/cli-tool-timing-config");
@@ -146,16 +148,6 @@ function isCommandCodeReady(rawOutput) {
         return false;
     return !cli_patterns_1.COMMAND_CODE_THINKING_PATTERN.test((0, cli_patterns_1.stripAnsi)(rawOutput));
 }
-/**
- * Why `send` stops at the plan review overlay (Issue #3125).
- *
- * The overlay replaces the composer until a human decides, so waiting for the
- * composer only ran out the clock (`prompt not ready` after the full timeout).
- * Its comments, Submit review, approval and cancel go through `respond`.
- */
-exports.COMMAND_CODE_PLAN_REVIEW_SEND_MESSAGE = 'Command Code is showing a plan review (REVIEW), which takes review comments, not messages. ' +
-    'Comment with `commandmate respond <worktree-id> "<text>"`, then `--plan-review submit` (ctrl+r), ' +
-    '`--plan-review approve` (ctrl+a) or `--plan-review cancel` (esc).';
 /**
  * Command Code CLI tool implementation.
  * Manages `commandcode` sessions using tmux.
@@ -238,11 +230,14 @@ class CommandCodeTool extends base_1.BaseCLITool {
                 // shared TMUX_HISTORY_LIMIT default (Issue #1624).
                 await this.createLaunchPane(sessionName, worktreePath);
             }
-            await (0, tmux_1.sendKeys)(sessionName, (0, launch_screen_1.withLaunchScreenCleared)(buildCommandCodeLaunchCommand({
+            // Issue #3981: in one writer's turn of the input lock; the readiness
+            // wait below stays outside it.
+            const launchCommand = buildCommandCodeLaunchCommand({
                 target: { worktreeId, cliToolId: tool_id_1.COMMAND_CODE_CLI_TOOL_ID, instanceId },
                 executablePath: this.command,
                 worktreePath,
-            })), true);
+            });
+            await this.typeLaunchLines(sessionName, [(0, launch_screen_1.withLaunchScreenCleared)(launchCommand)]);
             await new Promise((resolve) => setTimeout(resolve, cli_tool_timing_config_1.COMMAND_CODE_INIT_WAIT_MS));
             await this.waitForReady(sessionName);
             logger.info('started-command-code-session');
@@ -292,11 +287,11 @@ class CommandCodeTool extends base_1.BaseCLITool {
      *
      * @throws SessionStartTimeoutError when a just-launched session's composer
      *   has still not appeared
-     * @throws Error ({@link COMMAND_CODE_PLAN_REVIEW_SEND_MESSAGE}) at once when
+     * @throws Error ({@link commandCodePlanReviewSendMessage}) at once when
      *   the plan review overlay is on screen (Issue #3125)
      * @throws Error when the composer is not detected within the timeout
      */
-    async waitForPrompt(sessionName) {
+    async waitForPrompt(sessionName, worktreeId, instanceId) {
         const startTime = Date.now();
         const pollInterval = 500;
         let planReviewPolls = 0;
@@ -320,7 +315,7 @@ class CommandCodeTool extends base_1.BaseCLITool {
             planReviewPolls = planReviewUp ? planReviewPolls + 1 : 0;
             if (planReviewPolls >= 2) {
                 logger.info('command-code-plan-review-blocks-send', { sessionName });
-                throw Object.assign(new Error(exports.COMMAND_CODE_PLAN_REVIEW_SEND_MESSAGE), {
+                throw Object.assign(new Error((0, respond_target_1.commandCodePlanReviewSendMessage)(worktreeId, instanceId)), {
                     code: send_attempt_types_1.PLAN_REVIEW_SEND_REFUSED_CODE,
                 });
             }
@@ -352,7 +347,7 @@ class CommandCodeTool extends base_1.BaseCLITool {
         // pane when the tool is gone; costs one `capture-pane` when it is not.
         await this.requireSession('Command Code', worktreeId, instanceId, { relaunch: true });
         try {
-            await this.waitForPrompt(sessionName);
+            await this.waitForPrompt(sessionName, worktreeId, instanceId);
             // Issue #1471: body/Enter separation + read-back submit verification.
             await (0, submit_verified_sender_1.sendMessageWithSubmitVerification)({
                 sessionName,
@@ -368,7 +363,8 @@ class CommandCodeTool extends base_1.BaseCLITool {
             // Issue #3006: passed through unwrapped so its `code` reaches the route.
             if ((0, session_start_error_1.isSessionStartTimeoutError)(error))
                 throw error;
-            const wrapped = new Error(`Failed to send message to Command Code: ${(0, errors_1.getErrorMessage)(error)}`);
+            // Issue #4031: the cause keeps a failed `load-buffer`'s code (`classifySendFailure`).
+            const wrapped = new Error(`Failed to send message to Command Code: ${(0, errors_1.getErrorMessage)(error)}`, { cause: error });
             // Issue #3772: the plan review refusal comes before the body; keep its code.
             if (error?.code === send_attempt_types_1.PLAN_REVIEW_SEND_REFUSED_CODE) {
                 throw Object.assign(wrapped, { code: send_attempt_types_1.PLAN_REVIEW_SEND_REFUSED_CODE });