create-claude-cabinet 0.45.0 → 0.46.0

package/templates/mux/bin/mux

@@ -409,21 +409,40 @@ queue_claude_start() {
   win_idx=$(tmux display-message -t "$target" -p '#{window_index}' 2>/dev/null)
   local stable="${sess}:${win_idx}"
   tmux set-window-option -t "$stable" @mux_claude 1 2>/dev/null || true
-  tmux send-keys -t "$stable" "cd '${win_path}' && claude" Enter
-  # auto_orient=1 (default): inject the canned /orient-quick before the prompt
-  # — the standard "start a session" sequence. auto_orient=0: inject ONLY the
-  # prompt, for callers whose prompt orchestrates its own orient (e.g.
-  # `mux handoff`, whose seed runs /orient then the seeded work thread —
-  # QA drains stay with window 1's standing station, never the seed).
-  (
-    sleep 5
+
+  if [[ -n "$prompt" ]]; then
+    # Prompt-bearing launch: hand the prompt to the CLI as its INITIAL-PROMPT
+    # argument (`claude "<prompt>"` — interactive session, submits on startup).
+    # This auto-submits with zero keystroke timing, and is structurally safe:
+    # if `cd && claude` fails (path gone, claude off PATH, crash on boot) the
+    # prompt is just an unused argument — it is NEVER executed as shell, the
+    # way a paste+Enter into a fallen-back shell prompt would be. The prompt
+    # is staged in a per-window file and read by the PANE's shell via
+    # $(cat …), so multi-line/quote-heavy content never passes through tmux
+    # key parsing. auto_orient=1 prepends the orient instruction INTO the same
+    # first message (one message, model-driven orient); auto_orient=0 trusts
+    # the prompt to orchestrate its own orient (e.g. `mux handoff`, whose seed
+    # runs /orient then the seeded thread — QA drains stay with window 1).
+    local seed_dir="${HOME}/.local/share/mux/seed-prompts"
+    mkdir -p "$seed_dir" 2>/dev/null || true
+    local pf="${seed_dir}/${sess}-${win_idx}.txt"
     if [[ "$auto_orient" == "1" ]]; then
-      tmux send-keys -t "$stable" "/orient-quick" Enter
-      sleep 2
+      printf 'Run /orient-quick first to load state, then:\n\n%s' "$prompt" > "$pf"
+    else
+      printf '%s' "$prompt" > "$pf"
     fi
-    [[ -n "$prompt" ]] && tmux send-keys -t "$stable" -l "$prompt"
-  ) &
-  disown
+    tmux send-keys -t "$stable" "cd '${win_path}' && claude \"\$(cat '${pf}')\"" Enter
+  else
+    # Empty-prompt launch (e.g. QA station relaunch): start plain. On the
+    # auto_orient path inject the canned /orient-quick after startup — a
+    # benign payload (a harmless command-not-found if it ever lands in a
+    # shell), the long-proven behavior, deliberately left unchanged.
+    tmux send-keys -t "$stable" "cd '${win_path}' && claude" Enter
+    if [[ "$auto_orient" == "1" ]]; then
+      ( sleep 5; tmux send-keys -t "$stable" "/orient-quick" Enter ) &
+      disown
+    fi
+  fi
 }
 
 queue_claude_resume() {
@@ -436,12 +455,15 @@ queue_claude_resume() {
   tmux send-keys -t "$stable" "cd '${win_path}' && claude --resume ${session_id}" Enter
 }
 
-# --- QA handoff dispatch (qa-handoff-protocol.md, stage 2) ---
+# --- Desk dispatch: QA handoffs + declared routines (stage 2) ---
 #
-# The push model. /qa-handoff packages a just-merged worktree into an inbox
-# item, then calls `mux qa dispatch <descriptor>`. We route that handoff to
-# the desk's MAIN window (window 1 — the permanent main session that owns
-# post-merge QA / publish / deploy):
+# The push model, and the desk's SINGLE dispatch path. Two producers feed it:
+# /qa-handoff packages a just-merged worktree into an inbox item
+# (qa-handoff-protocol.md), and watchtower's routine engine
+# (watchtower-routines.mjs) fires declared interactive routines — both then
+# call `mux qa dispatch <descriptor>`. We route the prompt to the desk's
+# MAIN window (window 1 — the permanent main session that owns post-merge
+# QA / publish / deploy and the desk's standing routines):
 #
 #   verified-idle Claude  → inject the pickup prompt (send-keys)
 #   bare shell (no Claude) → launch a fresh Claude with the prompt
@@ -454,11 +476,17 @@ queue_claude_resume() {
 # of truth; the ·N badge is a pure projection of it, recomputed at every
 # mutation and on desk open, so a tmux restart can't desync the two.
 
-MUX_QA_DIR="${HOME}/.local/share/mux/qa-handoff"
+MUX_QA_DIR="${MUX_QA_DIR:-${HOME}/.local/share/mux/qa-handoff}"
 
-# A descriptor is the small JSON /qa-handoff writes per merge:
-#   { project, project_path, item_id, merged_commit, what, pickup_prompt }
-# mux only reads project / pickup_prompt / item_id / what / merged_commit.
+# A descriptor is the small JSON a producer writes per dispatch:
+#   { project, project_path, item_id, what, pickup_prompt[, merged_commit] }
+# (merged_commit is qa-handoff-only; routine descriptors omit it.) mux only
+# reads project / pickup_prompt / item_id / what / merged_commit.
+#
+# Layout: <desk>/<item_id>.json is queued (counts toward the ·N badge);
+# <desk>/in-flight/<item_id>.json is drained-awaiting-verdict (badge-dark,
+# visible in `mux qa status`). The gate exit in watchtower-queue.mjs deletes
+# the descriptor from either location when a verdict/dismissal lands.
 
 qa_count() {
   find "${MUX_QA_DIR}/${1}" -maxdepth 1 -name '*.json' 2>/dev/null | wc -l | tr -d ' '
@@ -486,14 +514,37 @@ qa_main_window() {
   return 1
 }
 
+# Positive Claude-liveness verification for a pane whose @mux_claude marker
+# is ABSENT. The marker only exists on windows mux itself launched into
+# (v0.44+), so absence is NOT death evidence — a Claude started by hand, or
+# before the marker scheme, is live but unmarked. Returns 0 only on positive
+# proof: the foreground process looks like Claude's runtime AND the visible
+# pane shows Claude Code's UI footer. Anything ambiguous returns 1 — callers
+# must then refuse to inject, never launch over the pane.
+# Process-name set: claude/node/bun, plus digit-led names — the macOS native
+# installer execs a versioned binary, so a REAL Claude pane reports
+# pane_current_command as the bare version string (e.g. "2.1.169"; live
+# finding, dec-c1dbcd8b QA). The name is only the weak pre-filter; the
+# footer match is the positive verification.
+pane_is_live_claude() {
+  local win="$1" cmd snap
+  cmd=$(tmux display-message -t "=$win" -p '#{pane_current_command}' 2>/dev/null)
+  case "$cmd" in
+    claude*|node*|bun*|[0-9]*) ;;
+    *) return 1 ;;
+  esac
+  snap=$(tmux capture-pane -t "=$win" -p -S -30 2>/dev/null)
+  printf '%s' "$snap" | grep -qiE 'esc to interrupt|· *[0-9]+ tokens|Running…|Compacting|Thinking…|\? for shortcuts|\? for help'
+}
+
 # Classify the main window's pane:
 #   claude-idle | claude-busy | shell | other | no-window
-# Conservative by design: anything ambiguous resolves to claude-busy, so we
-# queue instead of injecting (better dark than wrong — the indicator and the
-# inject path only fire on a positively verified state). The idle/busy
-# markers track Claude Code's footer and may need tuning across CC versions;
-# `mux qa status` surfaces the detected state so any drift is debuggable, not
-# silent.
+# Conservative by design: anything ambiguous resolves to claude-busy or
+# other, so we queue instead of injecting (better dark than wrong — the
+# indicator and the inject path only fire on a positively verified state).
+# The idle/busy markers track Claude Code's footer and may need tuning across
+# CC versions; `mux qa status` surfaces the detected state so any drift is
+# debuggable, not silent.
 qa_pane_state() {
   local project="$1" win cmd is_claude snap
   win=$(qa_main_window "$project") || { echo "no-window"; return; }
@@ -502,10 +553,20 @@ qa_pane_state() {
 
   if [[ "$is_claude" != "1" ]]; then
     case "$cmd" in
-      zsh|bash|sh|fish|login|-zsh|-bash|-sh) echo "shell" ;;
-      *) echo "other" ;;
+      zsh|bash|sh|fish|login|-zsh|-bash|-sh) echo "shell"; return ;;
     esac
-    return
+    # No marker but not a shell either: this may be a live pre-marker Claude
+    # (act:ca5ac156 — keystrokes injected into its input box looked like
+    # "mux new isn't working"). Verify positively and BACKFILL the marker so
+    # every later check sees it; otherwise it's an unknown program — report
+    # "other" and never treat the pane as launchable.
+    if pane_is_live_claude "$win"; then
+      tmux set-window-option -t "=$win" @mux_claude 1 2>/dev/null || true
+      is_claude=1
+    else
+      echo "other"
+      return
+    fi
   fi
 
   snap=$(tmux capture-pane -t "=$win" -p -S -30 2>/dev/null)
@@ -542,11 +603,27 @@ qa_enqueue() {
 }
 
 # Inject into an idle Claude composer. C-u clears any half-typed input first
-# so we never prepend to whatever was sitting in the box.
+# so we never prepend to whatever was sitting in the box. The caller has
+# already positively verified this pane is a live, idle Claude (qa_pane_state)
+# — this helper does not re-gate; it only delivers the keystrokes.
+#
+# Delivery is via a tmux paste buffer with bracketed-paste mode (-p), not
+# `send-keys -l`: a literal send treats embedded newlines in a multi-line
+# pickup prompt as Enter and submits the prompt mid-way. Bracketed paste makes
+# the TUI insert the whole block as one unit; the trailing Enter submits it.
+# -d deletes the buffer after pasting; the per-call buffer name avoids
+# collisions, and any failure path falls back to the literal send.
 qa_inject() {
-  local win="$1" prompt="$2"
+  local win="$1" prompt="$2" buf="mux-inject-$$-$RANDOM"
   tmux send-keys -t "=$win" C-u 2>/dev/null || true
-  tmux send-keys -t "=$win" -l "$prompt"
+  if printf '%s' "$prompt" | tmux load-buffer -b "$buf" - 2>/dev/null; then
+    tmux paste-buffer -p -d -b "$buf" -t "=$win" 2>/dev/null || {
+      tmux delete-buffer -b "$buf" 2>/dev/null || true
+      tmux send-keys -t "=$win" -l "$prompt"
+    }
+  else
+    tmux send-keys -t "=$win" -l "$prompt"
+  fi
   tmux send-keys -t "=$win" Enter
 }
 
@@ -565,20 +642,35 @@ qa_launch_fresh() {
 # checkout that receives post-merge QA handoffs). Idempotent, and the keystone
 # of the standing-station model: because a clean station is guaranteed, every
 # `mux … "prompt"` can safely route its work to a worktree and let the merge
-# hand back to the station. Three cases, in order:
-#   - a live non-worktree Claude already exists → reuse it (no-op)
+# hand back to the station. Four cases, in order:
+#   - the main window holds a live Claude — marked, or unmarked-but-verified
+#     (qa_pane_state backfills the marker) → reuse it (no-op)
 #   - the main window is a bare shell (window 1's Claude died) → relaunch there
+#   - the main window runs some OTHER program → refuse LOUDLY; never type
+#     launch keystrokes into a pane that isn't positively a shell (the
+#     act:ca5ac156 injection bug — a live pre-marker Claude got the launch
+#     sequence typed into its input box)
 #   - no non-worktree window at all (defensive) → create window 1, launch there
 # Never touches worktree windows. Reuses qa_main_window (live-station-preferring
-# resolution) and qa_launch_fresh (the single launch path) — no forked logic.
+# resolution), qa_pane_state (the single pane classifier), and qa_launch_fresh
+# (the single launch path) — no forked logic.
 ensure_main_station() {
-  local project="$1" path="$2" station claude
+  local project="$1" path="$2" station state cmd
   station=$(qa_main_window "$project" 2>/dev/null || true)
   if [[ -n "$station" ]]; then
-    claude=$(tmux show-window-option -t "=$station" -v @mux_claude 2>/dev/null)
-    [[ "$claude" == "1" ]] && return 0
-    qa_launch_fresh "$station" "" "$project"
-    return 0
+    state=$(qa_pane_state "$project")
+    case "$state" in
+      claude-idle|claude-busy)
+        return 0 ;;
+      shell)
+        qa_launch_fresh "$station" "" "$project"
+        return 0 ;;
+      *)
+        cmd=$(tmux display-message -t "=$station" -p '#{pane_current_command}' 2>/dev/null)
+        printf "mux: main window %s is running '%s' — can't verify it's Claude or a shell, so no station was launched there (close that program or start claude yourself)\n" \
+          "$station" "${cmd:-unknown}" >&2
+        return 0 ;;
+    esac
   fi
   tmux new-window -t "=$project" -c "$path" 2>/dev/null || true
   station=$(qa_main_window "$project" 2>/dev/null || true)
@@ -1366,30 +1458,163 @@ qa_cmd_list() {
     python3 -c 'import json,sys
 d=json.load(open(sys.argv[1]))
 what=d.get("what","(no summary)")
-sha=str(d.get("merged_commit","?"))[:8]
+sha=d.get("merged_commit")
 iid=d.get("item_id","?")
-print(f"  - {what}  [merged {sha}]  {iid}")' "$f" 2>/dev/null
+tag=f"  [merged {str(sha)[:8]}]" if sha else ""
+print(f"  - {what}{tag}  {iid}")' "$f" 2>/dev/null
   done < <(ls -1tr "${MUX_QA_DIR}/${project}"/*.json 2>/dev/null)
+  local inflight_n
+  inflight_n=$(find "${MUX_QA_DIR}/${project}/in-flight" -maxdepth 1 -name '*.json' 2>/dev/null | wc -l | tr -d ' ')
+  [[ "$inflight_n" -gt 0 ]] && echo "${inflight_n} in flight (drained, awaiting verdict — restored on next drain if no verdict lands)"
   echo ""
   echo "Drain the oldest into this session: mux qa drain"
 }
 
-# Pop the oldest queued handoff and print its pickup prompt to stdout. The
+# Cross-check a dispatch descriptor's inbox item against the watchtower
+# queue (act:796fe6dc — the dispatch queue and the inbox drift BOTH ways).
+# Echoes: pending | not-pending | missing | unknown | no-watchtower.
+# "unknown" (unparseable item) errs toward offering the handoff — the
+# recipient gate sorts it out; only a positively non-pending item is a ghost.
+qa_item_status() {
+  local item_id="$1"
+  local wt_items="${WATCHTOWER_DIR:-$HOME/.claude-cabinet/watchtower}/queue/items"
+  [[ -d "$wt_items" ]] || { echo "no-watchtower"; return; }
+  local f="${wt_items}/${item_id}.json"
+  [[ -f "$f" ]] || { echo "missing"; return; }
+  local st
+  st=$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1])).get("status",""))' "$f" 2>/dev/null || true)
+  case "$st" in
+    pending) echo "pending" ;;
+    "")      echo "unknown" ;;
+    *)       echo "not-pending" ;;
+  esac
+}
+
+qa_descriptor_item_id() {
+  python3 -c 'import json,sys; print(json.load(open(sys.argv[1])).get("item_id") or "")' "$1" 2>/dev/null || true
+}
+
+# Offer the oldest queued handoff and print its pickup prompt to stdout. The
 # window-1 Claude session runs this (via the Bash tool) and acts on the
-# prompt it gets back — the prompt IS the instruction. Removing the
-# descriptor decrements the badge.
+# prompt it gets back — the prompt IS the instruction.
+#
+# Hardened against two-way dispatch/inbox drift (act:796fe6dc):
+#   - Descriptors whose inbox item is no longer pending are GHOSTS (the
+#     verdict was filed out-of-band) — skipped and removed, never offered.
+#   - The offered descriptor moves to in-flight/ instead of rm -f, so a
+#     session that dies without filing a verdict doesn't eat the handoff:
+#     the next drain restores still-pending in-flight entries to the queue.
+#     The gate exit (resolveItem/dismiss/supersede in watchtower-queue.mjs)
+#     clears the in-flight entry when the verdict lands.
+#   - When the dispatch queue is empty, falls back to walking the inbox for
+#     pending dispatched-category items (qa-handoff, routine), so the pull
+#     path works even when the push path was never used (or its descriptor
+#     was lost).
 qa_cmd_drain() {
   local project="${1:-$(tmux display-message -p '#{session_name}' 2>/dev/null)}"
   [[ -n "$project" ]] || die "mux qa drain: no project (run inside a desk or pass a name)"
+  local qdir="${MUX_QA_DIR}/${project}" inflight="${MUX_QA_DIR}/${project}/in-flight"
+  local f iid st
+
+  # 1. Sweep in-flight: a prior drain parked these. Verdict filed → done,
+  #    drop. Still pending (or un-checkable) → restore to the queue so this
+  #    drain can re-offer it — drained work can't silently vanish.
+  if [[ -d "$inflight" ]]; then
+    for f in "$inflight"/*.json; do
+      [[ -f "$f" ]] || continue
+      iid=$(qa_descriptor_item_id "$f")
+      if [[ -z "$iid" ]]; then mv -f "$f" "${qdir}/"; continue; fi
+      st=$(qa_item_status "$iid")
+      case "$st" in
+        not-pending|missing) rm -f "$f" ;;
+        *) mv -f "$f" "${qdir}/" ;;
+      esac
+    done
+  fi
+
+  # 2. Walk the queue oldest-first, skipping resolved ghosts.
   local oldest
-  oldest=$(ls -1tr "${MUX_QA_DIR}/${project}"/*.json 2>/dev/null | head -1)
-  if [[ -z "$oldest" ]]; then
-    echo "No QA handoffs queued for ${project}."
+  while :; do
+    # `|| true`: under pipefail an empty glob makes ls fail and would
+    # silently kill the whole script mid-drain.
+    oldest=$(ls -1tr "${qdir}"/*.json 2>/dev/null | head -1 || true)
+    [[ -z "$oldest" ]] && break
+    iid=$(qa_descriptor_item_id "$oldest")
+    if [[ -n "$iid" ]]; then
+      st=$(qa_item_status "$iid")
+      case "$st" in
+        not-pending)
+          echo "… skipped ${iid}: already resolved in the inbox (ghost dispatch removed)" >&2
+          rm -f "$oldest"; continue ;;
+        missing)
+          echo "… skipped ${iid}: no matching inbox item (stale dispatch removed)" >&2
+          rm -f "$oldest"; continue ;;
+      esac
+    fi
+    python3 -c 'import json,sys; print(json.load(open(sys.argv[1])).get("pickup_prompt",""))' "$oldest" 2>/dev/null || true
+    mkdir -p "$inflight"
+    mv -f "$oldest" "${inflight}/"
+    qa_refresh_indicator "$project"
     return 0
-  fi
-  python3 -c 'import json,sys; print(json.load(open(sys.argv[1])).get("pickup_prompt",""))' "$oldest" 2>/dev/null
-  rm -f "$oldest"
+  done
   qa_refresh_indicator "$project"
+
+  # 3. Dispatch queue is dry — fall back to the inbox itself: any pending
+  #    dispatched-category item (qa-handoff or routine) for this desk is real
+  #    debt even if no descriptor was ever dispatched (or it was lost). Match
+  #    by desk name, project name, or the desk's MUX_PROJECT_PATH. Oldest
+  #    first; surface only. qa-handoffs before routines: QA debt outranks a
+  #    missed routine.
+  local wt_items="${WATCHTOWER_DIR:-$HOME/.claude-cabinet/watchtower}/queue/items"
+  if [[ -d "$wt_items" ]]; then
+    local ppath
+    ppath=$(tmux show-environment -t "=$project" MUX_PROJECT_PATH 2>/dev/null | sed 's/^MUX_PROJECT_PATH=//' || true)
+    if python3 -c '
+import json, sys, os, glob
+items_dir, desk, ppath = sys.argv[1], sys.argv[2], sys.argv[3]
+cands = []
+for f in glob.glob(os.path.join(items_dir, "*.json")):
+    try:
+        d = json.load(open(f))
+    except Exception:
+        continue
+    if d.get("category") not in ("qa-handoff", "routine") or d.get("status") != "pending":
+        continue
+    if not (d.get("desk") == desk or d.get("project") == desk
+            or (ppath and d.get("project_path") == ppath)):
+        continue
+    cands.append(d)
+if not cands:
+    sys.exit(3)
+cands.sort(key=lambda d: (0 if d.get("category") == "qa-handoff" else 1,
+                          d.get("filed_at", "")))
+d = cands[0]
+iid = str(d.get("id", ""))
+title = str(d.get("title", ""))
+path = os.path.join(items_dir, iid + ".json")
+more = ""
+if len(cands) > 1:
+    more = " (%d more pending in the inbox)" % (len(cands) - 1)
+if d.get("category") == "qa-handoff":
+    print("Pending QA handoff found in the watchtower inbox with no dispatch entry"
+          " (the push path was missed or its descriptor was lost): %s -- %s."
+          " Read the full item at %s and run the /qa-drain recipient-gate pickup on it:"
+          " verify what the worktree could not, then exit through the gate"
+          " (resolveItem with a structured qa_verdict; dismiss/supersede require typed"
+          " reasons). It cannot leave the inbox silently.%s" % (iid, title, path, more))
+else:
+    print("Pending routine found in the watchtower inbox with no dispatch entry"
+          " (the push path was missed or its descriptor was lost): %s -- %s."
+          " Read the full item at %s, then read the routine script it names"
+          " (evidence.script, relative to project_path) and run it as the"
+          " conversation script. When done, resolve the item via watchtower-queue"
+          " resolveItem (resolution_type acted-on).%s" % (iid, title, path, more))
+' "$wt_items" "$project" "$ppath" 2>/dev/null; then
+      return 0
+    fi
+  fi
+
+  echo "No QA handoffs queued for ${project}."
 }
 
 qa_cmd_status() {
@@ -1398,14 +1623,15 @@ qa_cmd_status() {
   printf 'QA handoff — %s\n' "$project"
   printf '  window 1 pane: %s\n' "$(qa_pane_state "$project")"
   printf '  queued:        %s\n' "$(qa_count "$project")"
+  printf '  in-flight:     %s\n' "$(find "${MUX_QA_DIR}/${project}/in-flight" -maxdepth 1 -name '*.json' 2>/dev/null | wc -l | tr -d ' ')"
 }
 
 qa_cmd_clear() {
   local project="${1:-$(tmux display-message -p '#{session_name}' 2>/dev/null)}"
   [[ -n "$project" ]] || die "mux qa clear: no project (run inside a desk or pass a name)"
-  rm -f "${MUX_QA_DIR}/${project}"/*.json 2>/dev/null || true
+  rm -f "${MUX_QA_DIR}/${project}"/*.json "${MUX_QA_DIR}/${project}/in-flight"/*.json 2>/dev/null || true
   qa_refresh_indicator "$project"
-  echo "Cleared queued QA handoffs for ${project}."
+  echo "Cleared queued QA handoffs for ${project} (including in-flight)."
 }
 
 # --- Session handoff (session-handoff skill, phase 2) ---