fix(send): submit multiline prompts + never nudge a session paused on a permission dialog

[axisrow]

Fixes #2342.

Problem

ao send returns HTTP 200 the moment tmux send-keys exits 0, but for a large multiline prompt claude-code's TUI can absorb the trailing Enter and leave the text as an unsubmitted draft (#2342). UserPromptSubmit never fires, so the orchestrator can't tell the worker started and polls endlessly.

Fixing that surfaced a second, sharper problem: a session paused on a permission dialog looked identical to a session waiting at an idle prompt, so an automated re-send (or any reaction nudge) could paste Enter into the dialog and answer a decision on the user's behalf — an unrecoverable action.

What this does

Three commits, each a self-contained layer:

1. feat(activity): reintroduce blocked state — splits the overloaded waiting_input into waiting_input (idle at the prompt, safe to message) and blocked (paused on a permission/approval decision, must not be auto-messaged). Zero DB migrations — the sessions CHECK constraint already permits blocked (it was removed as dead code without rebuilding the table). Adds a NeedsInput() predicate; both states map to the existing needs_input status, so the UI and telemetry are unchanged.

2. fix(send): confirm prompt submission via a guarded pane-write primitive — after Send, a bounded confirm loop (3×2s) re-sends Enter until the session reports active, so a big multiline paste actually submits. All pane-writing paths (session_manager.Send/confirmActive, lifecycle.sendOnce) funnel through a new internal/sessionguard primitive that re-reads session state immediately before writing and refuses when the session is blocked/terminated (fail-closed). ao send into a blocked session now returns 409 SESSION_AWAITING_DECISION instead of pasting into the dialog. tmux gains a 300ms paste→Enter settle (matching conpty), on a detached context so a cancel mid-pause can't strand a half-submitted draft.

3. feat(activity): clear stale blocked via the approved tool's own post — answering a permission dialog fires no hook, so the sticky blocked would otherwise persist until turn-end. claude-code installs PreToolUse/PostToolUse/PostToolUseFailure/PermissionRequest hooks; lifecycle keeps per-session tool-flight state and clears blocked only when the uniquely-identified approved tool's post arrives (or a turn boundary), correlating by the single in-flight tool of the blocking name — ambiguous same-name batches fail closed. Subagent/sibling tool traffic can never clear a live dialog. The activity signal gains optional {event, toolName, toolUseId} fields (additive; old daemons ignore them).

Compatibility

No DB migrations, no changes to ports.AgentMessenger, lifecycle.New/session_manager.Deps signatures, or the hooks wire protocol beyond three additive optional fields. Every adapter that doesn't tag its signals keeps last-writer-wins behavior. openapi.yaml/schema.ts regenerated.

Testing

• go build ./... && go vet ./... && go test -race ./... — all packages green; new sessionguard and tool-flight suites pin the guard and precedence invariants.
• Live-verified on both claude-code and codex workers: a 27-line multiline message submits fully (agent reads and replies, no draft left in the composer); a permission dialog drives the session to blocked, ao send returns 409, and approving in the terminal clears it to active before turn end via the approved tool's post.

This work went through three rounds of adversarial review (Claude + Codex) on my fork; the same-name-sibling clear, an ambiguity-reset leak, and a reaper flight-state leak were each caught and fixed there.

🤖 Generated with Claude Code

[axisrow]

Force-pushed: rebased onto current `main` and squashed the three original commits (#2 blocked state, #5 guarded send-confirmation, #7 correlated clearing) plus the later Guard decorator refactor into one commit.

One behavior change worth flagging for review: `permission-request` now maps to `blocked` only for claude-code (and its hook-delegators grok/continue/devin). Those are the only harnesses that install the pre/post-tool-use trio, so they are the only ones where lifecycle can correlate the approved tool's post with the dialog and clear `blocked` mid-turn. Every other harness that mapped `permission-request`/`notification` to `blocked` could enter the state but never clear it before the turn boundary, so `ao send` returned 409 for the rest of the turn and automated nudges were suppressed — copilot/cline/kiro/cursor on every tool call (their pre-tool hook maps to permission-request), codex/qwen/autohand after a real dialog, droid on a 60s-idle notification. Those now map to `waiting_input` (still suppresses automated nudges via NeedsInput, still deliverable by user sends), and they opt out of the Enter nudge via `EmitsBlockedActivity()`.

[axisrow]

Rebased onto current main (8 upstream commits) and accepted upstream PR #2541 — idle_prompt now maps to idle (a finished turn at the prompt is Idle, not Input Needed), while permission_prompt stays blocked for the sessionguard 409.

Scope narrowed to claude-code only — it is the one harness with the pre/post-tool-use trio that lets lifecycle correlate the approved tool's post and clear blocked before the turn ends. codex keeps its submit signal but opts out of blocked (no tool trio). Every other harness maps its permission signal to waiting_input via the shared deriver and does not implement ActivitySignaler, so it gets the paste-settle delay but no confirm loop. The 13-harness mapping set removed from this branch is preserved on fork/archive/blocked-mappings for restoration when a harness is adopted.

[axisrow]

Rebased onto the latest main (662405cd) — it had advanced past the old base, so the PR was showing an inflated diff and mergeable: false. Now mergeable: true, 2 commits, scoped to the send fix.

Conflict with the token-based design-system migration (#2535): my blocked activity-pill in ShellTopbar.tsx / SessionInspector.tsx collided with the new CSS tokens. Resolved by adopting the new tokens (var(--color-working) / var(--color-text-muted) / var(--color-warning)) and keeping the blocked → "Awaiting Decision" row, using the same warning tone as waiting_input.

The earlier CI failures (build-test gofmt, lint golangci-lint) are fixed in the second commit (import ordering, a nilerr in Send, revive doc comments, two staticcheck QF1008). Verified locally: gofmt clean, golangci-lint v2 0 issues, all 534 frontend tests + the Go suite pass. CI here is waiting on "Approve and run workflows" for the new push from a fork.

[illegalcall]

Reviewed the latest push. The after-start prompt suppression issue is addressed by using Deliver directly, and the conflict with the frontend design tokens is resolved. Backend test suite passes locally.