Confirm a launch from the editor that owns the cursor

Burn-in run 3 failed three times with prompt_not_submitted: the launch text reached the editor every attempt and the following Enter never took effect. Six isolated probes of the same code path, environment and worktree all submitted on the first Enter, so the submit is not deterministic and waiting for it to land is not enough. F17 first. pendingInput scanned every line beginning with the prompt marker, but a queued or already-accepted message renders with the same prefix. Only the editor that owns the pane cursor is unsubmitted input, so inputState asks tmux for the cursor row and reads the editor around it, joining soft-wrapped rows. On that footing ConfirmLaunch becomes an active submit protocol: resend Enter while the live editor still holds exactly what was submitted, at most three times and no closer together than two poll intervals, then observe until the deadline. Queued input confirms rather than fails. The evidence records confirmation kind, submit_attempts and both timestamps, so a harness that needs a second Enter is distinguishable from one that needs none. Verified live against a real Claude Code pane: confirmation=editor_cleared submit_attempts=1, no spurious resend. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-27 12:53:56 +04:00
parent 1888d4280e
commit f54fb0036d
2 changed files with 288 additions and 37 deletions
@@ -140,22 +140,173 @@ func TestLaunchTransportIsHarnessSpecific(t *testing.T) {
 	}
 }

-// The exact F15 signature: the TUI coalesced the launch text into a paste and
-// absorbed the Enter, leaving the instruction in the input editor.
-func TestPendingInputSeesAnUnsubmittedPaste(t *testing.T) {
-	stalled := "  b141e4f6 - none | 0/1.0m ctx\n❯ [Pasted text #1 +66 lines]\n────────────\n"
-	if got := pendingInput(stalled); got != "[Pasted text #1 +66 lines]" {
-		t.Fatalf("pendingInput=%q, want the unsubmitted paste", got)
+// F17, found live during burn-in run 3: a queued or already-accepted prompt
+// renders with the same "❯" prefix as an unsubmitted one, so only cursor
+// ownership can tell them apart.
+func TestInputStateReadsTheEditorOwningTheCursor(t *testing.T) {
+	wrapped := "\u2500\u2500\u2500\u2500\n\u276f @.orchestra/launch.md is your complete Orchestra launch instruction. Read\n  .orchestra/launch.md now and follow it.\n\u2500\u2500\u2500\u2500\n"
+	b := paneTmux(t, wrapped, 2)
+	state, err := b.inputState(context.Background(), Session{PaneID: "s:1.0"})
+	if err != nil {
+		t.Fatal(err)
 	}
-	if got := pendingInput("esc to interrupt\n❯ \n"); got != "" {
-		t.Fatalf("pendingInput=%q, want empty for a cleared editor", got)
+	if !state.Active || !sameInput(state.Text, LaunchReference) {
+		t.Fatalf("state=%+v, want the wrapped launch reference in the active editor", state)
 	}
-	if got := pendingInput("❯ @.orchestra/launch.md is your complete Orchestra launch instruction."); got == "" {
-		t.Fatal("a one-line reference still sitting in the editor must count as pending")
+
+	// The same text, but the cursor sits in the empty editor below it: the
+	// harness took the prompt and queued it.
+	queued := "  \u276f @.orchestra/launch.md is your complete Orchestra launch instruction. Read\n    .orchestra/launch.md now and follow it.\n\u2500\u2500\u2500\u2500\n\u276f Press up to edit queued messages\n"
+	b = paneTmux(t, queued, 3)
+	state, err = b.inputState(context.Background(), Session{PaneID: "s:1.0"})
+	if err != nil {
+		t.Fatal(err)
 	}
-	if got := pendingInput("no editor line here"); got != "" {
-		t.Fatalf("pendingInput=%q, want empty when no editor line is visible", got)
+	if !state.Active || sameInput(state.Text, LaunchReference) {
+		t.Fatalf("state=%+v, want the queued marker rather than the launch text", state)
 	}
+	if !queuedInput(state.Text) {
+		t.Fatalf("state=%+v, want queued input recognized", state)
+	}
+}
+
+// Run 3 proved one Enter is not enough. A launch still owning the cursor must
+// be resubmitted, and the evidence must say how many submits it took.
+func TestConfirmLaunchResubmitsUntilTheEditorClears(t *testing.T) {
+	b, keys := submitTmux(t, 2)
+	evidence, err := b.ConfirmLaunch(context.Background(), Session{PaneID: "s:1.0"}, LaunchReference)
+	if err != nil {
+		t.Fatalf("confirm: %v", err)
+	}
+	if !strings.Contains(evidence, "submit_attempts=2") {
+		t.Fatalf("evidence=%q, want two submits recorded", evidence)
+	}
+	if got := enterCount(t, keys); got != 1 {
+		t.Fatalf("resent Enter %d times, want 1", got)
+	}
+}
+
+// The intervention is bounded independently of the observation deadline: a TUI
+// that already accepted the prompt must not receive a fortieth Enter.
+func TestConfirmLaunchBoundsResubmission(t *testing.T) {
+	b, keys := submitTmux(t, 99)
+	// Generous deadline on purpose: the cap must be what stops the resends.
+	b.LaunchConfirmTimeout = 3 * time.Second
+	if _, err := b.ConfirmLaunch(context.Background(), Session{PaneID: "s:1.0"}, LaunchReference); !errors.Is(err, ErrPromptNotSubmitted) {
+		t.Fatalf("err=%v, want ErrPromptNotSubmitted", err)
+	}
+	if got := enterCount(t, keys); got != launchResubmitLimit {
+		t.Fatalf("resent Enter %d times, want the %d-resubmit cap", got, launchResubmitLimit)
+	}
+}
+
+// Queued is submitted. Treating it as a stalled editor would kill a pane whose
+// harness had already accepted the instruction.
+func TestConfirmLaunchAcceptsQueuedInput(t *testing.T) {
+	pane := "\u2500\u2500\u2500\u2500\n\u276f Press up to edit queued messages\n"
+	b := paneTmux(t, pane, 1)
+	evidence, err := b.ConfirmLaunch(context.Background(), Session{PaneID: "s:1.0"}, LaunchReference)
+	if err != nil {
+		t.Fatalf("confirm: %v", err)
+	}
+	if !strings.Contains(evidence, "confirmation=queued") {
+		t.Fatalf("evidence=%q, want queued input confirmed", evidence)
+	}
+}
+
+// paneTmux serves one fixed pane with the cursor on the given row.
+func paneTmux(t *testing.T, pane string, cursor int) *TmuxBackend {
+	t.Helper()
+	dir := t.TempDir()
+	paneFile := filepath.Join(dir, "pane")
+	if err := os.WriteFile(paneFile, []byte(pane), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	bin := filepath.Join(dir, "tmux")
+	script := `#!/bin/sh
+cmd=""
+for a in "$@"; do
+  case "$a" in
+    capture-pane|has-session|display-message|send-keys) cmd=$a; break;;
+  esac
+done
+case "$cmd" in
+  has-session) exit 0 ;;
+  capture-pane) cat ` + paneFile + ` ; exit 0 ;;
+  display-message)
+    case "$*" in
+      *cursor_y*) printf '` + fmt.Sprint(cursor) + `\n' ;;
+      *) printf '0\tclaude\n' ;;
+    esac
+    exit 0 ;;
+esac
+exit 0
+`
+	if err := os.WriteFile(bin, []byte(script), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	return &TmuxBackend{Binary: bin, LaunchConfirmTimeout: time.Second, LaunchConfirmPoll: 5 * time.Millisecond}
+}
+
+// submitTmux holds the launch reference in the active editor until the given
+// number of submits has been received, then clears it. The first submit is the
+// one Prompt already sent, so submitOn=2 means one resend is required.
+func submitTmux(t *testing.T, submitOn int) (*TmuxBackend, string) {
+	t.Helper()
+	dir := t.TempDir()
+	keys := filepath.Join(dir, "keys")
+	bin := filepath.Join(dir, "tmux")
+	script := `#!/bin/sh
+dir=` + dir + `
+cmd=""
+for a in "$@"; do
+  case "$a" in
+    capture-pane|has-session|display-message|send-keys) cmd=$a; break;;
+  esac
+done
+submits=$(cat $dir/submits 2>/dev/null || echo 1)
+case "$cmd" in
+  has-session) exit 0 ;;
+  send-keys)
+    case "$*" in
+      *Enter*)
+        echo Enter >> ` + keys + `
+        echo $((submits+1)) > $dir/submits ;;
+    esac
+    exit 0 ;;
+  capture-pane)
+    if [ "$submits" -ge "` + fmt.Sprint(submitOn) + `" ]; then
+      printf 'esc to interrupt\n\xe2\x9d\xaf \n'
+    else
+      printf '\xe2\x94\x80\x0a\xe2\x9d\xaf ` + LaunchReference + `\n'
+    fi
+    exit 0 ;;
+  display-message)
+    case "$*" in
+      *cursor_y*)
+        if [ "$submits" -ge "` + fmt.Sprint(submitOn) + `" ]; then printf '1\n'; else printf '1\n'; fi ;;
+      *) printf '0\tclaude\n' ;;
+    esac
+    exit 0 ;;
+esac
+exit 0
+`
+	if err := os.WriteFile(bin, []byte(script), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	return &TmuxBackend{Binary: bin, LaunchConfirmTimeout: time.Second, LaunchConfirmPoll: 5 * time.Millisecond}, keys
+}
+
+func enterCount(t *testing.T, path string) int {
+	t.Helper()
+	b, err := os.ReadFile(path)
+	if os.IsNotExist(err) {
+		return 0
+	}
+	if err != nil {
+		t.Fatal(err)
+	}
+	return len(strings.Fields(string(b)))
 }

 // fakeTmux scripts capture-pane so confirmation can be driven without waiting
@@ -179,7 +330,12 @@ for a in "$@"; do
 done
 case "$cmd" in
  has-session) exit 0 ;;
-  display-message) printf '0\tclaude\n'; exit 0 ;;
+  display-message)
+    case "$*" in
+      *cursor_y*) printf '0\n' ;;
+      *) printf '0\tclaude\n' ;;
+    esac
+    exit 0 ;;
  capture-pane)
    if [ "` + fail + `" = "1" ]; then echo "no server running" >&2; exit 1; fi
    n=$(cat $state 2>/dev/null || echo 0); n=$((n+1)); echo $n > $state