Confirm a launch from the editor that owns the cursor

Burn-in run 3 failed three times with prompt_not_submitted: the launch text reached the editor every attempt and the following Enter never took effect. Six isolated probes of the same code path, environment and worktree all submitted on the first Enter, so the submit is not deterministic and waiting for it to land is not enough. F17 first. pendingInput scanned every line beginning with the prompt marker, but a queued or already-accepted message renders with the same prefix. Only the editor that owns the pane cursor is unsubmitted input, so inputState asks tmux for the cursor row and reads the editor around it, joining soft-wrapped rows. On that footing ConfirmLaunch becomes an active submit protocol: resend Enter while the live editor still holds exactly what was submitted, at most three times and no closer together than two poll intervals, then observe until the deadline. Queued input confirms rather than fails. The evidence records confirmation kind, submit_attempts and both timestamps, so a harness that needs a second Enter is distinguishable from one that needs none. Verified live against a real Claude Code pane: confirmation=editor_cleared submit_attempts=1, no spurious resend. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-27 12:53:56 +04:00
parent 1888d4280e
commit f54fb0036d
2 changed files with 288 additions and 37 deletions
@@ -9,6 +9,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"regexp"
+	"strconv"
 	"strings"
 	"time"
 )
@@ -360,27 +361,87 @@ func (b *TmuxBackend) LaunchTransport(harness string) LaunchTransport {
 	return LaunchInline
 }

-// promptLine matches the harness input editor's own line. Its remainder is
-// what is still sitting unsubmitted, whether that is literal text or the
-// TUI's own "[Pasted text #1 +66 lines]" placeholder.
+// promptLine matches a harness input line. A queued or already-accepted
+// message renders with the same prefix, so a match alone proves nothing about
+// what is still unsubmitted; see inputState.
 var promptLine = regexp.MustCompile(`(?m)^[ \t]*[>❯][ \t]*(.*)$`)

-// pendingInput returns whatever the input editor still holds.
-func pendingInput(pane string) string {
-	m := promptLine.FindAllStringSubmatch(pane, -1)
-	if len(m) == 0 {
-		return ""
-	}
-	return strings.TrimSpace(m[len(m)-1][1])
+// separatorRow matches the rule Claude Code draws above and below its editor.
+var separatorRow = regexp.MustCompile(`^[\s─━┄┅┈┉-]+$`)
+
+// InputState is what the interactive editor holds. Active distinguishes the
+// live editor from queued or already-submitted input: both render with the
+// same "❯" prefix, but only the live editor owns the pane cursor (F17,
+// found live during burn-in run 3).
+type InputState struct {
+	Text   string
+	Active bool
 }

-// ConfirmLaunch waits for observable proof that the harness accepted the
-// prompt. An input editor that still holds the submitted text is definite
-// failure, which is the whole point: TaskLaunchAcknowledged previously meant
-// "Prompt returned nil" and so reported a launch that never happened.
+// sameInput compares editor content to what was submitted. Soft wrapping may
+// break the text at any column and re-indent the continuation, so the
+// comparison ignores whitespace entirely.
+func sameInput(a, b string) bool {
+	strip := func(s string) string { return strings.Join(strings.Fields(s), "") }
+	return strip(a) == strip(b)
+}
+
+// inputState reads the editor that owns the cursor. Scanning every line
+// beginning with "❯" cannot tell an unsubmitted prompt from one the
+// harness already queued, which is why this asks tmux where the cursor is.
+func (b *TmuxBackend) inputState(ctx context.Context, s Session) (InputState, error) {
+	out, err := b.command(ctx, "display-message", "-p", "-t", tmuxTarget(s.PaneID), "#{cursor_y}")
+	if err != nil {
+		return InputState{}, err
+	}
+	row, err := strconv.Atoi(strings.TrimSpace(string(out)))
+	if err != nil {
+		return InputState{}, fmt.Errorf("tmux backend: cursor row %q: %w", strings.TrimSpace(string(out)), err)
+	}
+	// Screen rows, unjoined: -J merges wrapped rows and would invalidate the
+	// cursor row index.
+	raw, err := b.command(ctx, "capture-pane", "-p", "-t", tmuxTarget(s.PaneID))
+	if err != nil {
+		return InputState{}, err
+	}
+	rows := strings.Split(strings.TrimRight(string(raw), "\n"), "\n")
+	if row < 0 || row >= len(rows) {
+		return InputState{}, nil
+	}
+	start := -1
+	for i := row; i >= 0; i-- {
+		if promptLine.MatchString(rows[i]) {
+			start = i
+			break
+		}
+		if separatorRow.MatchString(rows[i]) {
+			break
+		}
+	}
+	if start < 0 {
+		return InputState{}, nil
+	}
+	parts := []string{strings.TrimSpace(promptLine.FindStringSubmatch(rows[start])[1])}
+	for i := start + 1; i <= row; i++ {
+		parts = append(parts, strings.TrimSpace(rows[i]))
+	}
+	return InputState{Text: strings.TrimSpace(strings.Join(parts, " ")), Active: true}, nil
+}
+
+// launchResubmitLimit bounds the intervention independently of the observation
+// deadline. A slow TUI must not receive a fortieth Enter after it accepted the
+// first: three exact-editor resubmits, then observation only.
+const launchResubmitLimit = 3
+
+// ConfirmLaunch drives the submit to a decision instead of assuming one Enter
+// landed. Burn-in run 3 proved the submit is not deterministic: the text
+// reached the editor on all three attempts and the following Enter never took
+// effect. So this resends Enter while the live editor still holds exactly what
+// was submitted, up to launchResubmitLimit times, then observes until the
+// deadline.
 //
-// This is not a timing workaround for the submit itself. The submit is
-// deterministic; this waits for the harness to visibly react to it.
+// The returned evidence records how many submits it took, which is the only
+// way to tell a harness that needs a second Enter from one that needed none.
 func (b *TmuxBackend) ConfirmLaunch(ctx context.Context, s Session, submitted string) (string, error) {
 	timeout, poll := b.LaunchConfirmTimeout, b.LaunchConfirmPoll
 	if timeout <= 0 {
@@ -389,14 +450,42 @@ func (b *TmuxBackend) ConfirmLaunch(ctx context.Context, s Session, submitted st
 	if poll <= 0 {
 		poll = 250 * time.Millisecond
 	}
-	deadline := b.now().Add(timeout)
-	var last string
+	first := b.now()
+	deadline := first.Add(timeout)
+	attempts, resubmits := 1, 0
+	var lastResubmit time.Time
+	evidence := func(kind string) string {
+		return fmt.Sprintf("confirmation=%s submit_attempts=%d first_submit_at=%s confirmed_at=%s",
+			kind, attempts, first.UTC().Format(time.RFC3339Nano), b.now().UTC().Format(time.RFC3339Nano))
+	}
+	var last InputState
 	for {
-		pane, err := b.PaneCapture(ctx, s, "recent")
+		state, err := b.inputState(ctx, s)
 		if err != nil {
 			return "", err
 		}
-		if last = pendingInput(pane); last == "" {
+		last = state
+		switch {
+		case state.Active && sameInput(state.Text, submitted):
+			// Exactly what was submitted still owns the cursor, so the submit
+			// did not take. Resend Enter, spaced so a TUI that accepted the
+			// previous one cannot receive another inside its own redraw.
+			if resubmits < launchResubmitLimit && (lastResubmit.IsZero() || b.now().Sub(lastResubmit) >= 2*poll) {
+				if err := b.SendKeys(ctx, s, []string{"Enter"}); err != nil {
+					return "", err
+				}
+				resubmits++
+				attempts++
+				lastResubmit = b.now()
+			}
+		case state.Active && queuedInput(state.Text):
+			// The harness accepted the instruction and parked it behind the
+			// current turn. Queued is submitted.
+			return evidence("queued"), nil
+		case state.Active && state.Text != "":
+			// Something else is in the editor, a paste placeholder for
+			// instance. Not proof of acceptance, so keep observing.
+		default:
 			status, statusErr := b.AgentStatus(ctx, s)
 			if statusErr != nil {
 				return "", statusErr
@@ -405,18 +494,18 @@ func (b *TmuxBackend) ConfirmLaunch(ctx context.Context, s Session, submitted st
 			case "exited":
 				return "", fmt.Errorf("%w: pane %s exited before the harness reacted", ErrPromptNotSubmitted, s.PaneID)
 			case "busy":
-				return "input editor cleared, agent busy", nil
+				return evidence("busy"), nil
 			case "blocked":
 				// A permission dialog is the harness acting on the
 				// instruction, so submission is proven even though the
 				// session now needs an operator.
-				return "input editor cleared, agent awaiting approval", nil
+				return evidence("blocked"), nil
 			default:
-				return "input editor cleared", nil
+				return evidence("editor_cleared"), nil
 			}
 		}
 		if !b.now().Before(deadline) {
-			return "", fmt.Errorf("%w: pane %s still holds %q after %s", ErrPromptNotSubmitted, s.PaneID, last, timeout)
+			return "", fmt.Errorf("%w: pane %s still holds %q after %s and %d submits", ErrPromptNotSubmitted, s.PaneID, last.Text, timeout, attempts)
 		}
 		select {
 		case <-ctx.Done():
@@ -425,3 +514,9 @@ func (b *TmuxBackend) ConfirmLaunch(ctx context.Context, s Session, submitted st
 		}
 	}
 }
+
+// queuedInput recognizes the editor Claude Code shows once it has taken a
+// prompt and parked it behind the running turn.
+func queuedInput(text string) bool {
+	return strings.Contains(strings.ToLower(text), "queued message")
+}