termdock 1.4.313 → 1.4.314

package/dist/server/agent/collaborationTmuxDelivery.js

@@ -36,12 +36,16 @@ function paneInputKey(pane) {
     return `${pane.serverPid}:${pane.sessionId}:${pane.paneId}:${pane.panePid}`;
 }
 /** Serialize TD paste/submit pairs for this exact runtime pane. */
-export function writeCollaborationTmuxPane(run, pane, prompt, stdin, assertCurrent) {
-    return serializeTerminalInput(paneInputKey(pane), () => writeTmuxPrompt(run, pane, prompt, stdin, assertCurrent));
+export function writeCollaborationTmuxPane(run, pane, prompt, stdin, assertCurrent, progress) {
+    progress?.('queue_wait');
+    return serializeTerminalInput(paneInputKey(pane), () => {
+        progress?.('queue_acquired');
+        return writeTmuxPrompt(run, pane, prompt, stdin, assertCurrent, progress);
+    });
 }
 async function writeTmuxPrompt(run, pane, prompt, 
 /** Body travels on stdin so tmux cannot parse its semicolons/backslashes. */
-stdin, assertCurrent) {
+stdin, assertCurrent, progress) {
     await assertSamePane(run, pane);
     assertCurrent?.();
     // A fixed pane target is independent of the current window, keyboard focus
@@ -64,6 +68,7 @@ stdin, assertCurrent) {
     try {
         // Paste once, then send one unbracketed CR after 50ms. No screen parsing,
         // Agent-specific recovery, consumption confirmation or additional Enter.
+        progress?.('paste_attempted');
         await stdin([
             // The body arrives on stdin, not argv: it is user content, and in a
             // `\;` chain argv is a language where `;` and `\` mean something.
@@ -73,9 +78,11 @@ stdin, assertCurrent) {
             // for it to rewrite — the flag is insurance, not the mechanism.
             'paste-buffer', '-p', '-r', '-d', '-b', buffer, '-t', pane.paneId,
         ], normalizePromptForPaste(prompt));
+        progress?.('paste_written');
         await waitForPromptSubmit();
         await assertSamePane(run, pane);
         assertCurrent?.();
+        progress?.('submit_attempted');
         await run([
             // The submit key rides outside the paste block: inside it, an editor
             // inserts a pasted CR as text instead of acting on it. Pasting the bare
@@ -83,6 +90,7 @@ stdin, assertCurrent) {
             'set-buffer', '-b', buffer, '--', '\r', ';',
             'paste-buffer', '-d', '-b', buffer, '-t', pane.paneId,
         ]);
+        progress?.('submit_written');
     }
     finally {
         // -d consumed the buffer on the happy path; this sweeps up after a failed

package/dist/server/agent/integrationCli.js

@@ -28,7 +28,10 @@ export const INTEGRATION_HELP = `td integration — local scoped integration adm
     Minimum CLI/running service 1.4.309; capabilities.session_resume_configuration=true.
     Errors: RESUME_CONFIGURATION_CHANGED, EXACT_RESUME_UNSUPPORTED,
     SESSION_GENERATION_MISMATCH, SESSION_OPERATION_IN_PROGRESS, LAUNCHER_UNAVAILABLE.
-  diagnostics <TD-session-id> (read the last restore check; administrator only)
+  diagnostics <TD-session-id> (read stored launch/restore diagnostics; administrator only)
+    1.4.314 adds phase/timestamps, paste/submit write facts and target-change
+    evidence; no argv/environment/credentials or application readiness claim.
+    Prior versions cannot reconstruct missing launch evidence retroactively.
   create --file <policy.json> --credential-file <private-output.json>
   update --file <policy.json> (same identity/group; preserves the credential)
   revoke <principal-id>
@@ -217,11 +220,13 @@ export async function runIntegrationCollab(command, port, io) {
             return subscribe(socketPath, `/events?${params}`, credential, command.options.timeout ? duration(String(command.options.timeout)) : undefined, io.write);
         }
         if (command.action === 'session') {
+            if (command.operation === 'retry-cold' && capability.session_cold_retry !== true)
+                throw new CollaborationError('SESSION_COLD_RETRY_UNSUPPORTED', 'CLI and running service must support explicit cold retry (minimum 1.4.314)', 409);
             if (command.operation === 'release' && (capability.session_runtime_release !== true || capability.session_lifecycle_generation !== true || capability.stable_session_identity !== true))
                 throw new CollaborationError('SESSION_RELEASE_UNSUPPORTED', 'CLI and running service must support the lifecycle contract (minimum 1.4.309)', 409);
-            const route = command.operation === 'create' ? '/sessions' : `/sessions/${encodeURIComponent(command.target)}${['restore', 'release'].includes(command.operation) ? `/${command.operation}` : ''}`;
+            const route = command.operation === 'create' ? '/sessions' : `/sessions/${encodeURIComponent(command.target)}${['restore', 'release', 'retry-cold'].includes(command.operation) ? `/${command.operation}` : ''}`;
             const body = command.operation === 'create' ? { group_id: command.options.group, launch_profile: command.options['launch-profile'], cwd: command.options.cwd, idempotency_key: command.options['idempotency-key'] }
-                : ['restore', 'release'].includes(command.operation) ? { ...(command.operation === 'release' ? { generation: Number(command.options.generation) } : {}), idempotency_key: command.options['idempotency-key'] } : undefined;
+                : ['restore', 'release', 'retry-cold'].includes(command.operation) ? { ...(['release', 'retry-cold'].includes(command.operation) ? { generation: Number(command.options.generation) } : {}), idempotency_key: command.options['idempotency-key'] } : undefined;
             io.write(JSON.stringify(parsed(await request(socketPath, command.operation === 'get' ? 'GET' : 'POST', route, body, headers(credential)))));
             return 0;
         }

package/dist/server/agent/integrationServer.js

@@ -70,7 +70,7 @@ export class IntegrationRuntime {
         };
         app.get('/admin/groups', run(req => { admin(req); return { groups: options.messages.list().filter(g => !g.federated).map(g => ({ id: g.id, name: g.name })) }; }));
         app.get('/admin/capabilities', run(req => { admin(req); return this.capabilities(); }));
-        app.get('/admin/sessions/:id/restore-diagnostics', run(req => { admin(req); return this.sessions.restoreDiagnostics(req.params.id); }));
+        app.get('/admin/sessions/:id/restore-diagnostics', run(req => { admin(req); return { ...this.sessions.restoreDiagnostics(req.params.id), ...this.sessions.launchDiagnostics(req.params.id) }; }));
         app.get('/admin/sessions/:id/resume-configuration', run(async (req) => { admin(req); return this.sessions.resumeConfiguration(req.params.id); }));
         app.post('/admin/sessions/:id/resume-configuration', run(async (req) => { admin(req); return { session: publicIntegrationSession(await this.sessions.confirmResumeConfiguration(req.params.id, req.body?.generation, req.body?.fingerprint)) }; }));
         app.post('/admin/sessions/:id/startup-input/clear', run(async (req) => {
@@ -197,6 +197,7 @@ export class IntegrationRuntime {
         }));
         app.get('/sessions/:id', run(async (req) => { const p = principal(req); this.authorize(p, 'session.read'); return { session: publicIntegrationSession(await this.sessions.get(p, req.params.id)) }; }));
         app.post('/sessions/:id/restore', run(async (req) => { const p = principal(req); this.authorize(p, 'session.restore'); const session = await this.sessions.restore(p, req.params.id, req.body?.idempotency_key); this.sync(); return { session: publicIntegrationSession(session) }; }));
+        app.post('/sessions/:id/retry-cold', run(async (req) => { const p = principal(req); this.authorize(p, 'session.create'); const session = await this.sessions.retryCold(p, req.params.id, req.body?.generation, req.body?.idempotency_key); this.sync(); return { session: publicIntegrationSession(session) }; }));
         app.post('/sessions/:id/release', run(async (req) => { const p = principal(req); this.authorize(p, 'session.release'); const session = await this.sessions.release(p, req.params.id, req.body?.generation, req.body?.idempotency_key); this.sync(); return { session: publicIntegrationSession(session) }; }));
         app.get('/events', run((req, res) => {
             const p = principal(req);
@@ -226,6 +227,8 @@ export class IntegrationRuntime {
             session_startup_input_clear: true, session_startup_input_clear_min_version: '1.4.310',
             agent_launch_process_check: true, agent_launch_process_check_min_version: '1.4.312',
             terminal_input_runtime_fence: true, terminal_input_runtime_fence_min_version: '1.4.313',
+            session_launch_diagnostics: true, session_launch_diagnostics_min_version: '1.4.314',
+            session_cold_retry: true, session_cold_retry_min_version: '1.4.314',
             integration_policy_update: true,
             session_restore_diagnostics: true,
             native_identity_linux_flock_owner: process.platform === 'linux',

package/dist/server/agent/integrationSessions.js

@@ -5,6 +5,8 @@ import { atomicJson, integrationError } from './integrationStore.js';
 import { SessionLifecycleCoordinator, assertMessageRuntime, assertReleaseFacts, assertReleaseGeneration } from './sessionLifecycle.js';
 import { resumeConfigurationFingerprint } from './sessionResumeConfiguration.js';
 import { NativeResumeOwnerError } from './nativeResumeOwner.js';
+import { CollaborationError } from './collaborationProtocol.js';
+import { beginLaunchDiagnostics, launchFailure, launchProgress } from './sessionLaunchDiagnostics.js';
 /** Quote each configured argument as literal shell data, including paths. */
 export function integrationLaunchCommand(record, restore) {
     const launchArgs = record.profile.argv.map(arg => arg === '{cwd}' ? record.cwd : arg);
@@ -20,8 +22,9 @@ function startupInput(record, now) {
     return condition ? { state: 'pending', deadline: now + (condition.timeoutMs ?? 120000), matched_since: null, observed_at: null } : undefined;
 }
 export function publicIntegrationSession(record) {
-    const { profile: _, deadline: _deadline, launch_submitted: _submitted, startup_condition: _condition, restore_diagnostics: diagnostics, ...publicRecord } = record;
-    return { ...publicRecord, ...(diagnostics ? { restore_diagnostics_available: true } : {}) };
+    const { profile: _, deadline: _deadline, launch_submitted: _submitted, startup_condition: _condition, restore_diagnostics: diagnostics, launch_diagnostics: launchDiagnostics, launch_diagnostics_history: _history, message_history_seen: _messages, ...publicRecord } = record;
+    return { ...publicRecord, ...(diagnostics ? { restore_diagnostics_available: true } : {}),
+        ...(launchDiagnostics ? { launch_diagnostics_available: true } : {}) };
 }
 export function permittedCwd(profile, cwd) {
     if (typeof cwd !== 'string' || !path.isAbsolute(cwd) || /[\x00-\x1f\x7f]/.test(cwd))
@@ -56,6 +59,7 @@ export class IntegrationSessions {
     listeners = new Set();
     lifecycle = new SessionLifecycleCoordinator();
     mutations = new Map();
+    coldRetries = new Set();
     timers = new Set();
     stopObservation;
     stopDeliveryGuard;
@@ -111,7 +115,9 @@ export class IntegrationSessions {
     }
     saveRecord(record) {
         const before = this.doc.sessions;
-        this.doc.sessions = [...before.filter(s => s.session_id !== record.session_id), structuredClone(record)];
+        const seen = before.find(s => s.session_id === record.session_id)?.message_history_seen;
+        this.doc.sessions = [...before.filter(s => s.session_id !== record.session_id), structuredClone({ ...record,
+                ...(seen ? { message_history_seen: true } : {}) })];
         try {
             this.save();
         }
@@ -154,7 +160,8 @@ export class IntegrationSessions {
         const now = Date.now(), record = { operation_id: randomUUID(), session_id: randomBytes(6).toString('hex'),
             group_id: principal.groupId, principal_id: principal.id, agent_slug: profile.agentSlug, agent_native_session_id: null,
             state: 'starting', generation: 1, runtime_present: null, error_code: null, cwd, launch_profile: profile.id, profile: structuredClone(profile),
-            created_at: now, updated_at: now, deadline: now + this.bindingTimeout, launch_submitted: false };
+            created_at: now, updated_at: now, deadline: now + this.bindingTimeout, launch_submitted: false, message_history_seen: false };
+        record.launch_diagnostics = beginLaunchDiagnostics(record.operation_id, 1, 'cold_start');
         record.startup_input = startupInput(record, now);
         this.doc.requests[request.scoped] = { hash: request.hash, sessionId: record.session_id };
         try {
@@ -166,7 +173,7 @@ export class IntegrationSessions {
         }
         return this.launch(record, false);
     }
-    launch(record, restoring) {
+    launch(record, restoring, retryCold = false) {
         const promise = (async () => {
             try {
                 // Store intent before launching. A failed persistence cannot execute.
@@ -181,17 +188,29 @@ export class IntegrationSessions {
                     catch (error) {
                         // Existing creation supports plugins without an exact resume path.
                         // They remain launchable, but cannot gain a releasable descriptor.
-                        if (restoring || error.code !== 'EXACT_RESUME_UNSUPPORTED')
+                        if (restoring || retryCold || error.code !== 'EXACT_RESUME_UNSUPPORTED')
                             throw error;
                     }
                 }
                 record.launch_submitted = true;
                 this.saveRecord(record);
+                const progress = (phase) => {
+                    const latest = this.doc.sessions.find(s => s.session_id === record.session_id);
+                    if (latest.operation_id !== record.operation_id || latest.generation !== record.generation)
+                        integrationError('SESSION_GENERATION_MISMATCH', 'Launch operation changed during progress recording', 409);
+                    if (latest.launch_diagnostics) {
+                        record.launch_diagnostics = launchProgress(latest.launch_diagnostics, phase);
+                        this.saveRecord({ ...latest, launch_diagnostics: record.launch_diagnostics });
+                    }
+                };
                 const prepared = (binding) => { record.terminal_binding = binding; this.saveRecord(record); };
-                if (restoring)
-                    await this.adapter.restore(record, prepared);
+                if (retryCold)
+                    await this.adapter.retryCold(record, prepared, progress);
+                else if (restoring)
+                    await this.adapter.restore(record, prepared, progress);
                 else
-                    await this.adapter.create(record, prepared);
+                    await this.adapter.create(record, prepared, progress);
+                progress('binding_observe');
                 await this.refresh(record.session_id);
                 this.scheduleRefresh(record);
             }
@@ -199,6 +218,7 @@ export class IntegrationSessions {
                 const current = this.doc.sessions.find(s => s.session_id === record.session_id);
                 const code = error.code;
                 this.saveRecord({ ...current, state: 'failed', error_code: typeof code === 'string' ? code : 'SESSION_LAUNCH_FAILED',
+                    launch_diagnostics: current.launch_diagnostics ? launchFailure(current.launch_diagnostics, error, typeof code === 'string' ? code : 'SESSION_LAUNCH_FAILED') : undefined,
                     restore_diagnostics: error instanceof NativeResumeOwnerError ? { ...structuredClone(error.diagnostics), operation_id: current.operation_id } : undefined,
                     updated_at: Date.now() });
             }
@@ -216,10 +236,27 @@ export class IntegrationSessions {
         return structuredClone({ session_id: record.session_id, operation_id: record.operation_id,
             state: record.state, error_code: record.error_code, diagnostics: record.restore_diagnostics ?? null });
     }
-    assertRuntimeMessage(id) { assertMessageRuntime(this.doc.sessions.find(s => s.session_id === id)); }
+    launchDiagnostics(id) {
+        const record = this.doc.sessions.find(s => s.session_id === id);
+        if (!record)
+            return integrationError('INTEGRATION_SESSION_NOT_FOUND', 'Integration session does not exist', 404);
+        return structuredClone({ launch_diagnostics: record.launch_diagnostics ?? null,
+            launch_diagnostics_history: record.launch_diagnostics_history ?? [] });
+    }
+    assertRuntimeMessage(id) {
+        const record = this.doc.sessions.find(s => s.session_id === id);
+        if (this.coldRetries.has(id) || record?.cold_retry_pending)
+            integrationError('SESSION_OPERATION_IN_PROGRESS', 'Cold retry must finish or be reconciled before sending', 409);
+        assertMessageRuntime(record);
+        // Durable, conservative latch before admission; even a later enqueue
+        // failure cannot make a previously attempted business request disappear.
+        if (record && !record.message_history_seen)
+            this.saveRecord({ ...record, message_history_seen: true });
+    }
     assertMessageTarget(principal, id) {
         const record = this.doc.sessions.find(s => s.session_id === id && s.group_id === principal.groupId);
-        assertMessageRuntime(record);
+        if (record)
+            this.assertRuntimeMessage(id);
     }
     async mutate(principal, key, input, action) {
         const request = this.request(principal, key, input);
@@ -259,6 +296,74 @@ export class IntegrationSessions {
     async restore(principal, id, key) {
         return this.mutate(principal, key, ['restore', id], () => this.lifecycle.run(id, () => this.restoreOnce(principal, id, key)));
     }
+    async retryCold(principal, id, generation, key) {
+        return this.mutate(principal, key, ['retry-cold', id, generation], () => this.lifecycle.run(id, async () => {
+            const request = this.request(principal, key, ['retry-cold', id, generation]);
+            if (request.previous)
+                return this.replayRequest(principal, id, request.previous);
+            if (!this.adapter.retryCold || !this.adapter.messageHistory)
+                integrationError('SESSION_COLD_RETRY_UNSUPPORTED', 'Runtime adapter does not support verified cold retry', 409);
+            if (this.pending.has(id))
+                integrationError('SESSION_OPERATION_IN_PROGRESS', 'Launch is in progress', 409);
+            this.coldRetries.add(id);
+            try {
+                const record = await this.get(principal, id);
+                assertReleaseGeneration(record, generation);
+                if (record.cold_retry_pending || record.operation_uncertain)
+                    integrationError('OPERATION_OUTCOME_UNCONFIRMED', 'Reconcile prior lifecycle outcome before cold retry', 409);
+                if (record.agent_native_session_id)
+                    integrationError('SESSION_COLD_RETRY_NATIVE_BOUND', 'Use exact native restore for a bound session', 409);
+                if (record.state !== 'failed')
+                    integrationError('SESSION_COLD_RETRY_NOT_FAILED', 'Only failed unbound cold starts can be retried', 409);
+                const history = this.adapter.messageHistory(id);
+                if (history === null)
+                    integrationError('SESSION_MESSAGE_HISTORY_UNCONFIRMED', 'Message history cannot be verified', 409);
+                if (record.message_history_seen || history || this.adapter.pendingMessages?.(id))
+                    integrationError('SESSION_MESSAGE_HISTORY_PRESENT', 'Cold retry refuses any TD business message history or attempted admission', 409);
+                const authorized = principal.launchProfiles.find(p => p.id === record.launch_profile);
+                if (!authorized)
+                    integrationError('LAUNCH_PROFILE_DENIED', 'Original launch profile is no longer authorized', 403);
+                permittedCwd(authorized, record.cwd);
+                permittedCwd(record.profile, record.cwd);
+                if (!record.resume_configuration_fingerprint)
+                    integrationError('RESUME_CONFIGURATION_UNCONFIRMED', 'Administrator must confirm the launcher/plugin fingerprint', 409);
+                if (record.resume_configuration_fingerprint !== await resumeConfigurationFingerprint(record, this.adapter))
+                    integrationError('RESUME_CONFIGURATION_CHANGED', 'Launcher/plugin configuration changed', 409);
+                const observed = await this.adapter.inspect(record);
+                if (!record.terminal_binding || !observed.exists || observed.running || !observed.shell || observed.nativeId)
+                    integrationError('SESSION_COLD_RETRY_RUNTIME_UNCONFIRMED', 'Retry requires the exact original, exited foreground shell', 409);
+                record.launch_diagnostics_history = [...(record.launch_diagnostics_history ?? []), ...(record.launch_diagnostics ? [record.launch_diagnostics] : [])].slice(-16);
+                record.generation = generation + 1;
+                record.operation_id = randomUUID();
+                record.state = 'starting';
+                record.error_code = null;
+                record.cold_retry_pending = true;
+                record.cold_retry_count = (record.cold_retry_count ?? 0) + 1;
+                record.runtime_present = true;
+                record.launch_submitted = false;
+                record.updated_at = Date.now();
+                record.deadline = Date.now() + this.bindingTimeout;
+                record.restore_diagnostics = undefined;
+                record.startup_input = startupInput(record, Date.now());
+                record.launch_diagnostics = beginLaunchDiagnostics(record.operation_id, record.generation, 'cold_retry');
+                this.doc.requests[request.scoped] = { hash: request.hash, sessionId: id, operationId: record.operation_id, generation: record.generation };
+                try {
+                    this.saveRecord(record);
+                }
+                catch (error) {
+                    delete this.doc.requests[request.scoped];
+                    throw error;
+                }
+                const result = await this.launch(record, false, true);
+                result.cold_retry_pending = false;
+                this.saveRecord(result);
+                return result;
+            }
+            finally {
+                this.coldRetries.delete(id);
+            }
+        }));
+    }
     async restoreOnce(principal, id, idempotencyKey) {
         const request = this.request(principal, idempotencyKey, ['restore', id]);
         if (request.previous)
@@ -268,6 +373,8 @@ export class IntegrationSessions {
         let releaseNative;
         try {
             const record = await this.get(principal, id);
+            if (record.cold_retry_pending)
+                integrationError('OPERATION_OUTCOME_UNCONFIRMED', 'Reconcile the cold retry before native restore', 409);
             if (!record.agent_native_session_id)
                 integrationError('NATIVE_SESSION_ID_MISSING', 'An exact native session binding is required', 409);
             // Recheck the current grant and actual directories; restore uses the
@@ -310,6 +417,8 @@ export class IntegrationSessions {
             record.deadline = Date.now() + this.bindingTimeout;
             record.updated_at = Date.now();
             record.restore_diagnostics = undefined;
+            record.launch_diagnostics_history = [...(record.launch_diagnostics_history ?? []), ...(record.launch_diagnostics ? [record.launch_diagnostics] : [])].slice(-16);
+            record.launch_diagnostics = beginLaunchDiagnostics(record.operation_id, record.generation, 'native_restore');
             if (!record.startup_input_disabled && !record.profile.startupInput && !record.startup_condition)
                 record.startup_condition = structuredClone(principal.launchProfiles.find(profile => profile.id === record.launch_profile)?.startupInput);
             record.startup_input = startupInput(record, Date.now());
@@ -443,6 +552,8 @@ export class IntegrationSessions {
         const record = structuredClone(this.doc.sessions.find(s => s.session_id === id));
         if (!record)
             return;
+        if (record.cold_retry_pending && (this.lifecycle.active(id) || this.pending.has(id)))
+            return;
         if (record.state === 'released' || record.state === 'releasing' || record.operation_uncertain) {
             if (this.lifecycle.active(id))
                 return;
@@ -483,8 +594,10 @@ export class IntegrationSessions {
             if (JSON.stringify(current) !== JSON.stringify(record))
                 return;
             const code = error.code;
-            if (record.state !== 'failed' || record.error_code !== code)
-                this.saveRecord({ ...record, state: 'failed', error_code: typeof code === 'string' ? code : 'SESSION_OBSERVATION_FAILED', updated_at: Date.now() });
+            const errorCode = typeof code === 'string' ? code : 'SESSION_OBSERVATION_FAILED';
+            if (record.state !== 'failed' || record.error_code !== errorCode)
+                this.saveRecord({ ...record, state: 'failed', error_code: errorCode,
+                    launch_diagnostics: record.launch_diagnostics ? launchFailure(record.launch_diagnostics, error, errorCode) : undefined, updated_at: Date.now() });
             return;
         }
         const next = { ...record, runtime_present: this.adapter.runtimePresent ? await this.adapter.runtimePresent(record) : observed.exists };
@@ -521,6 +634,27 @@ export class IntegrationSessions {
             next.state = 'failed';
             next.error_code = 'SESSION_BINDING_TIMEOUT';
         }
+        if (record.cold_retry_pending) {
+            if (next.state === 'ready')
+                next.cold_retry_pending = false;
+            else if (record.terminal_binding && observed.exists && !observed.running && observed.shell && !observed.nativeId) {
+                next.state = 'failed';
+                next.error_code = 'SESSION_COLD_RETRY_INTERRUPTED';
+                next.cold_retry_pending = false;
+                if (next.launch_diagnostics)
+                    next.launch_diagnostics = launchProgress(next.launch_diagnostics, 'reconciled_shell');
+            }
+            else if (!observed.exists) {
+                next.state = 'failed';
+                next.error_code = 'SESSION_COLD_RETRY_RUNTIME_UNCONFIRMED';
+            }
+        }
+        if (next.launch_diagnostics) {
+            next.launch_diagnostics = { ...next.launch_diagnostics, runtime_exists: observed.exists };
+            if (next.state === 'failed' && next.error_code && (record.state !== 'failed' || record.error_code !== next.error_code)) {
+                next.launch_diagnostics = launchFailure(next.launch_diagnostics, new CollaborationError(next.error_code, '', 409), next.error_code);
+            }
+        }
         if (next.startup_input && next.startup_input.state !== 'observed') {
             const condition = next.startup_condition ?? next.profile.startupInput;
             let matched = false;

package/dist/server/agent/promptDelivery.js

@@ -18,13 +18,19 @@ export function buildBracketedPasteBytes(prompt) {
     return `\x1b[200~${normalizePromptForPaste(prompt)}\x1b[201~`;
 }
 /** Serialize TD prompt pairs per PTY. Success only records terminal writes. */
-export function writeBracketedPrompt(target, prompt, assertCurrent) {
+export function writeBracketedPrompt(target, prompt, assertCurrent, progress) {
+    progress?.('queue_wait');
     return serializeTerminalInput(target, async () => {
+        progress?.('queue_acquired');
         assertCurrent?.();
+        progress?.('paste_attempted');
         target.write(buildBracketedPasteBytes(prompt));
+        progress?.('paste_written');
         await waitForPromptSubmit();
         assertCurrent?.();
+        progress?.('submit_attempted');
         target.write('\r');
+        progress?.('submit_written');
     });
 }
 /**

package/dist/server/agent/sessionLaunchDiagnostics.js

@@ -0,0 +1,26 @@
+import { CollaborationError } from './collaborationProtocol.js';
+import { TerminalInputTargetChangedError } from './terminalInput.js';
+export function beginLaunchDiagnostics(operation_id, generation, kind) {
+    const now = Date.now();
+    return { operation_id, generation, kind, phase: 'configuration', updated_at: now,
+        error_code: null, reason_code: null, paste: 'not_attempted', submit: 'not_attempted',
+        runtime_exists: null, steps: [{ phase: 'configuration', at: now }] };
+}
+export function launchProgress(current, phase) {
+    const now = Date.now();
+    return { ...current, phase, updated_at: now, steps: [...current.steps, { phase, at: now }].slice(-24),
+        paste: phase === 'paste_attempted' ? 'attempted' : phase === 'paste_written' ? 'write_returned' : current.paste,
+        submit: phase === 'submit_attempted' ? 'attempted' : phase === 'submit_written' ? 'write_returned' : current.submit };
+}
+/** Error text/stdout/argv are never copied into durable diagnostics. */
+export function launchFailure(current, error, error_code) {
+    const value = error;
+    const standard = new Set(['ENOENT', 'EACCES', 'EPERM', 'EIO', 'ETIMEDOUT', 'EPIPE', 'ECONNRESET',
+        'TMUX_PANE_CHANGED', 'TMUX_PANE_IN_MODE', 'SESSION_REMOVED', 'SHELL_BACKEND_CHANGED']);
+    const reason_code = error instanceof TerminalInputTargetChangedError ? error.code
+        : error instanceof CollaborationError && /^[A-Z][A-Z0-9_]{0,79}$/.test(error.code) ? error.code
+            : typeof value?.code === 'string' && standard.has(value.code) ? value.code
+                : typeof value?.message === 'string' && standard.has(value.message) ? value.message : 'UNCLASSIFIED_LAUNCH_ERROR';
+    return { ...current, updated_at: Date.now(), error_code, reason_code,
+        ...(error instanceof TerminalInputTargetChangedError ? { target_change: error.evidence } : {}) };
+}

package/dist/server/agent/terminalInput.js

@@ -14,11 +14,19 @@ function serializeInQueue(store, target, action) {
     store.set(target, operation);
     return operation;
 }
+export class TerminalInputTargetChangedError extends Error {
+    evidence;
+    code = 'TERMINAL_INPUT_TARGET_CHANGED';
+    constructor(evidence) {
+        super('TERMINAL_INPUT_TARGET_CHANGED');
+        this.evidence = evidence;
+    }
+}
 /** Clearing a one-time launch check does not change the runtime generation. */
 export function captureTerminalInputGuard(current, expected = current()) {
     return () => {
         if (current() !== expected)
-            throw new Error('TERMINAL_INPUT_TARGET_CHANGED');
+            throw new TerminalInputTargetChangedError();
     };
 }
 /** Await the actual write instead of leaving detached timers after reporting success. */

package/dist/server/routes/terminal.js

@@ -50,7 +50,7 @@ import { archiveTaskWorkspace, restoreTaskWorkspace, snapshotTaskWorkspace } fro
 import { isTmuxRecoveryCandidate } from '../utils/tmuxRecoveryCandidate.js';
 import { AutomationStore, normalizeAutomationSchedule } from '../agent/automationStore.js';
 import { writeBracketedPrompt, canDeliverPromptToAgent } from '../agent/promptDelivery.js';
-import { captureTerminalInputGuard, waitAndWriteTerminalInput } from '../agent/terminalInput.js';
+import { captureTerminalInputGuard, waitAndWriteTerminalInput, TerminalInputTargetChangedError } from '../agent/terminalInput.js';
 import { agentLaunchBlockReason, normalizeAgentLaunchCheck } from '../agent/agentLaunchCheck.js';
 import { prepareSupervisionEnable } from '../utils/enableSupervision.js';
 import { buildServerHealthState, dismissServerHealth } from '../utils/serverHealth.js';
@@ -1479,21 +1479,21 @@ async function observeAgentLaunchCheck(record, observed) {
 function terminalInputGuard(record) {
     const frontendSessionId = record.sessionId;
     const backendSessionId = record.backendSessionId;
-    const generation = captureTerminalInputGuard(() => globalSessionState.sessions
-        .find(candidate => candidate.sessionId === frontendSessionId)?.agentLaunchGeneration ?? null, record.agentLaunchGeneration ?? null);
+    const launchId = record.agentLaunchGeneration ?? null;
     const backend = backendSessionId ? terminalSessions.get(backendSessionId) : undefined;
     return () => {
         const latest = globalSessionState.sessions.find(candidate => candidate.sessionId === frontendSessionId);
         if (!latest)
             throw new Error('SESSION_REMOVED');
-        generation();
-        if (latest.backendSessionId !== backendSessionId
-            || backendSessionId && terminalSessions.get(backendSessionId) !== backend)
-            throw new Error('TERMINAL_INPUT_TARGET_CHANGED');
+        const instanceMatches = !backendSessionId || terminalSessions.get(backendSessionId) === backend;
+        if ((latest.agentLaunchGeneration ?? null) !== launchId || latest.backendSessionId !== backendSessionId || !instanceMatches) {
+            throw new TerminalInputTargetChangedError({ expected_backend_session_id: backendSessionId, current_backend_session_id: latest.backendSessionId,
+                expected_launch_id: launchId, current_launch_id: latest.agentLaunchGeneration ?? null, backend_instance_matches: instanceMatches });
+        }
     };
 }
 /** tmux input always uses the pane queue, including automation and launch commands. */
-async function automaticTerminalInput(record, assertCurrent = terminalInputGuard(record)) {
+async function automaticTerminalInput(record, assertCurrent = terminalInputGuard(record), progress) {
     assertCurrent();
     if (record.mode === 'tmux') {
         const binding = collaborationRouting.get(record.sessionId) ?? {
@@ -1505,18 +1505,18 @@ async function automaticTerminalInput(record, assertCurrent = terminalInputGuard
         if (inspected.state !== 'ready' || !inspected.pane)
             throw new Error(inspected.reason ?? 'TMUX_PANE_UNAVAILABLE');
         const pane = inspected.pane;
-        return (prompt) => writeCollaborationTmuxPane(runTmux, pane, prompt, runTmuxStdin, assertCurrent);
+        return (prompt) => writeCollaborationTmuxPane(runTmux, pane, prompt, runTmuxStdin, assertCurrent, progress);
     }
     const backend = record.backendSessionId ? terminalSessions.get(record.backendSessionId) : null;
     if (!backend)
         throw new Error('SHELL_BACKEND_NOT_RUNNING');
-    return (prompt) => writeBracketedPrompt(backend.ptyProcess, prompt, assertCurrent);
+    return (prompt) => writeBracketedPrompt(backend.ptyProcess, prompt, assertCurrent, progress);
 }
-async function writeAutomaticTerminalPrompt(frontendSessionId, prompt) {
+async function writeAutomaticTerminalPrompt(frontendSessionId, prompt, progress) {
     const record = globalSessionState.sessions.find(candidate => candidate.sessionId === frontendSessionId);
     if (!record)
         throw new Error('SESSION_REMOVED');
-    const write = await automaticTerminalInput(record);
+    const write = await automaticTerminalInput(record, terminalInputGuard(record), progress);
     await write(prompt);
 }
 async function deliverAutomationPromptWhenReady(backendSessionId, prompt) {
@@ -1985,6 +1985,7 @@ export const integrationSessionAdapter = {
     registerDeliveryGuard(guard) { integrationDeliveryGuard = guard; return () => { if (integrationDeliveryGuard === guard)
         integrationDeliveryGuard = undefined; }; },
     pendingMessages(id) { return collaborationStore.pendingCount(id); },
+    messageHistory(id) { return collaborationStore.hasTerminalMessageHistory(id); },
     async prepareRelease(record) {
         if (collaborationStore.groupsForSession(record.session_id).some(group => group.id !== record.group_id))
             integrationError('SESSION_SCOPE_CONFLICT', 'Runtime belongs to another collaboration group; administrator must resolve its membership first', 409);
@@ -2076,21 +2077,28 @@ export const integrationSessionAdapter = {
             collaborationRouting.bind({ ...route, nativeSessionId: nativeId, pane: { ...route.pane, nativeSessionId: nativeId } });
         return { exists: true, running: Boolean(pane.agentSlug), shell: await integrationPaneIsIdleShell(pane), agentSlug: pane.agentSlug || null, nativeId };
     },
-    async create(record, prepared) {
+    async create(record, prepared, progress) {
         await listDetectedAgentLaunchers();
         if (!agentBySlug(record.agent_slug))
             integrationError('COLLAB_AGENT_UNAVAILABLE', 'Configured agent plugin is not installed');
         if (integrationTerminalRecord(record))
             integrationError('SESSION_CREATE_OUTCOME_UNKNOWN', 'Creation intent already has a terminal; inspect it instead of relaunching', 409);
-        await launchIntegrationTerminal(record, false, prepared);
+        await launchIntegrationTerminal(record, false, prepared, progress);
     },
-    async restore(record, prepared) {
+    async restore(record, prepared, progress) {
         await listDetectedAgentLaunchers();
         const agent = agentBySlug(record.agent_slug);
         if (!record.agent_native_session_id || !agent || !buildResumeCommand(agent, record.agent_native_session_id, null))
             integrationError('EXACT_RESUME_UNSUPPORTED', 'Agent plugin must support exact native resume');
+        progress?.('native_owner_check');
         await assertIntegrationNativeResumeAvailable(record);
-        await launchIntegrationTerminal(record, true, prepared);
+        await launchIntegrationTerminal(record, true, prepared, progress);
+    },
+    async retryCold(record, prepared, progress) {
+        await listDetectedAgentLaunchers();
+        if (!agentBySlug(record.agent_slug))
+            integrationError('COLLAB_AGENT_UNAVAILABLE', 'Configured agent plugin is not installed');
+        await launchIntegrationTerminal(record, false, prepared, progress, true);
     },
 };
 async function assertIntegrationNativeResumeAvailable(record) {
@@ -2141,12 +2149,28 @@ async function assertIntegrationNativeResumeAvailable(record) {
                 program: program?.command ?? null, processSource: program?.source, argumentsObserved: !!program?.rawArgs }];
     });
 }
-async function launchIntegrationTerminal(record, restoring, prepared) {
+async function launchIntegrationTerminal(record, restoring, prepared, progress, retryCold = false) {
     await collaborationDeliveryWorker.reconfigure(record.session_id, async () => {
+        progress?.('runtime_prepare');
         const group = collaborationStore.getGroup(record.group_id);
         if (!group || group.deleted)
             integrationError('TASK_GROUP_NOT_FOUND', 'Integration group no longer exists', 404);
         const original = await integrationSessionAdapter.inspect(record);
+        if (retryCold) {
+            await integrationSessionAdapter.prepareRelease(record);
+            const owned = integrationTerminalRecord(record);
+            if (!owned || globalSessionState.sessions.some(other => other.sessionId !== record.session_id
+                && (other.tmuxSessionName === owned.tmuxSessionName || owned.backendSessionId && other.backendSessionId === owned.backendSessionId))) {
+                integrationError('SESSION_IDENTITY_MISMATCH', 'Cold retry runtime lacks unique logical ownership', 409);
+            }
+            const history = collaborationStore.hasTerminalMessageHistory(record.session_id);
+            if (history === null)
+                integrationError('SESSION_MESSAGE_HISTORY_UNCONFIRMED', 'Message history cannot be verified', 409);
+            if (history || collaborationStore.pendingCount(record.session_id))
+                integrationError('SESSION_MESSAGE_HISTORY_PRESENT', 'TD message history appeared before retry', 409);
+            if (!record.terminal_binding || !original.exists || original.running || !original.shell || original.nativeId)
+                integrationError('SESSION_COLD_RETRY_RUNTIME_UNCONFIRMED', 'Original shell could not be confirmed before retry', 409);
+        }
         if (!original.exists) {
             let tmuxExists = false;
             try {
@@ -2178,6 +2202,7 @@ async function launchIntegrationTerminal(record, restoring, prepared) {
         const pane = inspected.pane;
         const pinned = { serverPid: pane.serverPid, sessionId: pane.sessionId,
             paneId: pane.paneId, panePid: pane.panePid, agentSlug: record.agent_slug, nativeSessionId: record.agent_native_session_id };
+        progress?.('binding_persist');
         prepared(pinned); // Must persist before the command enters the terminal.
         collaborationRouting.bind({ sessionId: record.session_id, backendSessionId: opened.terminalSession.sessionId,
             mode: 'tmux', tmuxSessionName: terminal.tmuxSessionName, agentSlug: record.agent_slug, nativeSessionId: record.agent_native_session_id, pane: pinned });
@@ -2195,8 +2220,11 @@ async function launchIntegrationTerminal(record, restoring, prepared) {
         // use an active-pane target which might have changed during preparation.
         if (record.resume_configuration_fingerprint && record.resume_configuration_fingerprint !== await resumeConfigurationFingerprint(record, integrationSessionAdapter))
             integrationError('RESUME_CONFIGURATION_CHANGED', 'Recovery configuration changed before terminal input', 409);
-        if (restoring)
+        if (restoring) {
+            progress?.('native_owner_check');
             await assertIntegrationNativeResumeAvailable(record);
+        }
+        progress?.('runtime_verify');
         const shell = await inspectCollaborationTmux({ sessionId: record.session_id, backendSessionId: opened.terminalSession.sessionId,
             mode: 'tmux', tmuxSessionName: terminal.tmuxSessionName, agentSlug: null, nativeSessionId: null, pane: pinned });
         if (shell.state !== 'ready' || !shell.pane || !await integrationPaneIsIdleShell(shell.pane))
@@ -2206,8 +2234,9 @@ async function launchIntegrationTerminal(record, restoring, prepared) {
         backend.agentSession = null;
         backend.agent = null;
         backend.agentResumeRecovered = false;
+        progress?.('launch_intent');
         await beginAgentLaunchCheck(record.session_id, record.agent_slug, restoring ? record.agent_native_session_id : null);
-        await writeAutomaticTerminalPrompt(record.session_id, integrationLaunchCommand(record, restoring));
+        await writeAutomaticTerminalPrompt(record.session_id, integrationLaunchCommand(record, restoring), progress);
         broadcastClientState();
     });
 }