feat(composer): lock the composer and show the prompt as Sending in the feed - #1183

Problem

Pressing Enter left the prompt in an editable composer until the provider accepted it. For Claude, acceptance is the JSONL acknowledgement, which can take seconds, and Claude painted no user row until the transcript caught up. The submit looked ignored, and the editable draft invited a second Enter or edits to a prompt already on its way.

Behavior

• Enter locks the composer. While promptDelivery.kind === 'sending' the composer shows empty and is read-only. The key handler ignores every key, including /, Tab, arrows, Enter, Escape and Ctrl+C. Paste, type-to-focus and paste-to-focus are off.
• The prompt moves into the feed. It shows at once as a user row at 50% opacity with a Sending… caption.
• "Sent" = provider accepted it: Claude's JSONL acknowledgement, OpenCode/Grok/Pi's handoff, Codex's completed PTY writes.
• All providers. Echo providers dim their existing optimistic row, which is now keyed by submission id. Claude gets a pending-only row that is added at Enter and removed when the send settles, so it can never double-render against Claude's committed row or queue-operation strip.
• Queued behind a running turn: the composer unlocks on the queue acceptance. For Claude, the pending row goes and Claude's queue strip shows the prompt.
• Failure: the pending row goes and the lock lifts, so the stored draft (text and images) is visible again. The existing uncertain banner still blocks a plain resend.

Design notes

• The draft stays in the store for the whole send; only the view hides it. Autosave persists only draftInput, and a session replacement transfers only current draft fields. On acceptance, draftAfterAcceptance strips the sent prompt and keeps text that dictation, templates or reply-to-selection added at either end. submitCurrentDraft also refuses while sending, because the per-mount in-flight ref does not survive a remount.
• Order barrier in main. session:deliver-prompt calls flushJsonl(sessionId) before replying. Otherwise Claude's acceptance reply overtakes the coalesced JSONL batch (microtask vs setImmediate), and the pending row is removed before the committed row exists.
• Pending state is presentation, not ledger state. Feed gets pendingEntryUuid and dims the matching entry item. Ledger rows, ordering and ownership are untouched, so the D11 identity cache holds.
• Claude's row does not reuse addOptimisticCodexUserEntry. That action's mid-turn branch writes queuedMessages, which for Claude belongs to the queue-operation reducer.
• Ownership fixes:
  • Repeated prompts: a committed twin must be no older than the submit (2 s clock tolerance). Before, a second continue was owned by the first one and vanished at once.
  • Pasted prompts: a committed user row's key is the inner text of Claude's <pasted_content> envelope, using the same strict unwrap main uses for acceptance.
• One shared prefix. The optimistic uuid prefix lives in session-runtime/optimisticPrompt.ts, and every copied literal is gone.

Review (one round: Claude + Codex reviewers)

Tests

• useComposerKeybinds.pendingPrompt.renderer.test.tsx. Real workspace controller, real submit hook and real ledger → Feed, with delivery held open. It covers:
  • Claude pending row and lock, with the draft kept in the store.
  • A writer adding text during the send.
  • Failure: text and images become visible again.
  • Queue acceptance.
  • Every key locked, with an unlocked control.
  • OpenCode: the optimistic row is dimmed while sending and undimmed after.
• ownership.optimisticTwin.test.ts:
  • An older twin does not own a new submit, and the submit's own twin does.
  • Tolerance edges and missing timestamps.
  • A pasted prompt, using the recorded fixture. Confirmed it fails without the unwrap.
• promptDeliveryDraft.test.ts: acceptance stripping.
• streamingSubmissionIdentity: now pins distinct uuids for same-millisecond submits. It used to pin the collision.
• npx tsc -b is clean.
• Full npm test on Node 24 (before the review fixes): 6479 passed. The 4 failures were 5 s timeouts in untouched files (lazy-prose, settings hydration ×2, ProviderEnablementRow) and fail locally on main too. Affected areas were re-run after the fixes.

Known limitations

• Grok keeps the old repeated-prompt behavior because its rows carry no timestamps.
• The Sending WorkIndicator chip still shows beside the row caption. It is driven by stream phase and carries the elapsed clock.
• An image-only Claude submit has no text row. The lock and the WorkIndicator still show that it's sending.
• Manual app QA has not been done.

Fixes #1181

🤖 Generated with Claude Code