Mcp(fix[pane]): Stop reporting tmux failures as success

Two defects on the same seam: an operation failed and the server told
the agent something that was not true.

`send_keys` dropped any payload starting with `-` and returned
`Keys sent to pane %N`. tmux read the payload as flags and rejected the
command; `Pane.send_keys` builds the argv with no `--` separator and
discards tmux's result, and the wrapper returned a hardcoded success
string. Reachable with ordinary input — `--help` typed into a REPL, a
negative number, a pasted diff line. The argv now ends flag parsing
with `--` and a failed send raises with tmux's own stderr. All three
call sites built argv separately and shared none of it; they now share
one builder, which also fixes the timed batch path (it surfaced the
error but still failed to deliver).

`wait_for_text` crashed with `ValueError: invalid literal for int() with
base 10: ''` when its pane died mid-wait. tmux expands every field of a
vanished pane to the empty string and three `int()` calls on the poll
path took it raw — the same degrade-don't-fail rule the comment three
lines above already states for `alternate_on`.

Fixing only the `int()` calls would have swapped the crash for a wrong
answer: `pane_dead` is itself blanked, so it reads back as `"0"` and
cannot report the death. A killed pane would then have failed the pid
comparison and been reported as *respawned*. A live pane always has a
`pane_pid`, so an empty one is the reliable gone signal, and the wait
now ends with `pane %N died`.

`_read_history_limit` had the same defect one call over — its guard
covered an empty list but not an empty string.

There were no tests for `_parse_pane_state` at all, which is why both
defects survived. The three history tests that asserted on
`Pane.send_keys` calls now observe the argv boundary, which is where
every path already goes.

Author: tony

CHANGES

@@ -8,6 +8,39 @@ _Notes on upcoming releases will be added here_
 
 ### What's new
 
+#### A pane that dies mid-wait reports the death, not a parse crash
+
+Killing a pane while `wait_for_text` was waiting on it surfaced
+`Unexpected error: ValueError: invalid literal for int() with base 10:
+''`. tmux expands every field of a vanished pane to the empty string,
+and three `int()` calls on the poll path took it raw.
+
+Fixing only the `int()` calls would have replaced the crash with a wrong
+answer: `pane_dead` is one of the blanked fields, so it reads back as
+`"0"` and cannot report the death itself. A killed pane would then have
+failed the pid comparison instead and been reported as *respawned*. A
+live pane always has a `pane_pid`, so an empty one is the reliable
+signal that the pane is gone, and the wait now ends with `pane %N died;
+cursor/baseline anchor is no longer valid`.
+
+`_read_history_limit` had the same defect one call over — its guard
+covered an empty list but not an empty string — and now shares the
+helper.
+
+#### `send_keys` no longer drops text that starts with `-`
+
+`send_keys(keys="-X cancel", literal=True)` returned `Keys sent to pane
+%N` and sent nothing. tmux parsed the payload as flags and rejected the
+command; the wrapper discarded tmux's result and returned a hardcoded
+success string. Reachable with ordinary input — `--help` or `-v` typed
+into a REPL, a negative number, a pasted diff line.
+
+The `send-keys` argv now ends flag parsing with `--`, and a failed send
+raises with tmux's own stderr instead of reporting success. This covers
+`send_keys` and both `send_keys_batch` paths, which each built the argv
+separately; the timed batch path surfaced the error but still failed to
+deliver.
+
 #### A gated tool now says which tier it needs
 
 Calling a tool above the server's `LIBTMUX_SAFETY` tier reported

src/libtmux_mcp/tools/pane_tools/io.py

@@ -50,6 +50,89 @@ def _remaining_timeout(deadline: float, timeout: float) -> float:
     return remaining
 
 
+#: Bound on a single untimed ``send-keys``. libtmux runs tmux through
+#: ``Popen.communicate()`` with no timeout, so an unresponsive server
+#: would wedge the tool call. Mirrors ``wait.py``'s per-call ceiling.
+_SEND_KEYS_TIMEOUT_SECONDS = 5.0
+
+
+def _send_keys_argvs(
+    pane: Pane,
+    keys: str,
+    *,
+    enter: bool,
+    literal: bool,
+    suppress_history: bool,
+) -> list[list[str]]:
+    """Build the ``tmux send-keys`` argv(s) for one send.
+
+    ``--`` terminates flag parsing. Without it tmux reads a payload
+    beginning with ``-`` as flags and rejects the command, so `--help`,
+    a negative number, or a pasted diff line never reaches the pane.
+    ``Pane.send_keys`` omits it and discards tmux's result, which is why
+    that failure arrived as a success.
+
+    Enter is a separate call without ``-l`` so it stays a key name
+    rather than the literal text ``Enter``.
+    """
+    pane_id = pane.pane_id
+    if pane_id is None:
+        msg = "resolved pane has no pane_id"
+        raise ExpectedToolError(msg)
+
+    tmux_args = ["send-keys", "-t", pane_id]
+    if literal:
+        tmux_args.append("-l")
+    tmux_args.extend(("--", (" " if suppress_history else "") + keys))
+
+    argvs = [_tmux_argv(pane.server, *tmux_args)]
+    if enter:
+        argvs.append(_tmux_argv(pane.server, "send-keys", "-t", pane_id, "Enter"))
+    return argvs
+
+
+def _raise_send_keys_error(exc: subprocess.CalledProcessError) -> t.NoReturn:
+    """Re-raise a failed ``send-keys`` carrying tmux's own stderr."""
+    stderr = exc.stderr.decode(errors="replace").strip() if exc.stderr else ""
+    msg = f"send-keys failed: {stderr or exc}"
+    raise ExpectedToolError(msg) from exc
+
+
+def _run_send_keys_argv(argv: list[str]) -> None:
+    """Run one ``tmux send-keys`` argv under the untimed ceiling."""
+    try:
+        subprocess.run(
+            argv,
+            check=True,
+            capture_output=True,
+            timeout=_SEND_KEYS_TIMEOUT_SECONDS,
+        )
+    except subprocess.TimeoutExpired as e:
+        msg = f"send-keys timed out after {_SEND_KEYS_TIMEOUT_SECONDS}s"
+        raise ExpectedToolError(msg) from e
+    except subprocess.CalledProcessError as e:
+        _raise_send_keys_error(e)
+
+
+def _run_send_keys(
+    pane: Pane,
+    keys: str,
+    *,
+    enter: bool,
+    literal: bool,
+    suppress_history: bool,
+) -> None:
+    """Send keys to *pane*, raising if tmux rejected them."""
+    for argv in _send_keys_argvs(
+        pane,
+        keys,
+        enter=enter,
+        literal=literal,
+        suppress_history=suppress_history,
+    ):
+        _run_send_keys_argv(argv)
+
+
 def _run_timed_send_keys_argv(
     argv: list[str],
     *,
@@ -67,9 +150,7 @@ def _run_timed_send_keys_argv(
     except subprocess.TimeoutExpired as e:
         raise ExpectedToolError(_batch_timeout_error(timeout)) from e
     except subprocess.CalledProcessError as e:
-        stderr = e.stderr.decode(errors="replace").strip() if e.stderr else ""
-        msg = f"send-keys failed: {stderr or e}"
-        raise ExpectedToolError(msg) from e
+        _raise_send_keys_error(e)
 
 
 def _run_timed_send_keys(
@@ -80,21 +161,13 @@ def _run_timed_send_keys(
     timeout: float,
 ) -> None:
     """Run ``tmux send-keys`` for one operation within the batch deadline."""
-    pane_id = pane.pane_id
-    if pane_id is None:
-        msg = "resolved pane has no pane_id"
-        raise ExpectedToolError(msg)
-
-    tmux_args = ["send-keys", "-t", pane_id]
-    if operation.literal:
-        tmux_args.append("-l")
-    tmux_args.append((" " if operation.suppress_history else "") + operation.keys)
-
-    send_argvs = [_tmux_argv(pane.server, *tmux_args)]
-    if operation.enter:
-        send_argvs.append(_tmux_argv(pane.server, "send-keys", "-t", pane_id, "Enter"))
-
-    for argv in send_argvs:
+    for argv in _send_keys_argvs(
+        pane,
+        operation.keys,
+        enter=operation.enter,
+        literal=operation.literal,
+        suppress_history=operation.suppress_history,
+    ):
         _run_timed_send_keys_argv(argv, deadline=deadline, timeout=timeout)
 
 
@@ -161,11 +234,12 @@ def send_keys(
         session_id=session_id,
         window_id=window_id,
     )
-    pane.send_keys(
+    _run_send_keys(
+        pane,
         keys,
         enter=enter,
-        suppress_history=suppress_history,
         literal=literal,
+        suppress_history=suppress_history,
     )
     return f"Keys sent to pane {pane.pane_id}"
 
@@ -266,11 +340,12 @@ def send_keys_batch(
                     break
                 continue
             if deadline is None:
-                pane.send_keys(
+                _run_send_keys(
+                    pane,
                     operation.keys,
                     enter=operation.enter,
-                    suppress_history=operation.suppress_history,
                     literal=operation.literal,
+                    suppress_history=operation.suppress_history,
                 )
             else:
                 assert timeout is not None

src/libtmux_mcp/tools/pane_tools/state.py

@@ -62,6 +62,19 @@ class _PaneState(t.NamedTuple):
 HISTORY_LIMIT_FORMAT = "#{history_limit}"
 
 
+def _int_or_zero(value: str) -> int:
+    """Parse a tmux numeric format field, treating a missing value as 0.
+
+    A dead pane makes ``display-message`` expand every field to the
+    empty string, so a bare ``int()`` raised
+    ``ValueError: invalid literal for int() with base 10: ''`` from the
+    hot poll path -- a wait whose pane died reported a raw parse crash
+    rather than ``pane_dead``. Same degrade-don't-fail rule the
+    ``alternate_on`` comment below states.
+    """
+    return int(value) if value else 0
+
+
 def _parse_pane_state(raw: str) -> _PaneState:
     """Parse one :data:`PANE_STATE_FORMAT` line into a :class:`_PaneState`."""
     # ``maxsplit`` is one below the field count so a pane_pid or a
@@ -73,12 +86,17 @@ def _parse_pane_state(raw: str) -> _PaneState:
     parts = raw.split("|", 5)
     hs, cy, sy, pid, dead = parts[:5]
     alternate = parts[5] if len(parts) > 5 else "0"
+    # A pane that no longer exists expands EVERY field to empty --
+    # ``pane_dead`` included, so it reads as "0" and cannot report the
+    # death itself. A live pane always has a pid, so an empty one is
+    # the reliable gone signal; without it the pid mismatch below
+    # reports a killed pane as "respawned".
     return _PaneState(
-        history_size=int(hs),
-        cursor_y=int(cy),
-        pane_height=int(sy),
+        history_size=_int_or_zero(hs),
+        cursor_y=_int_or_zero(cy),
+        pane_height=_int_or_zero(sy),
         pane_pid=pid,
-        pane_dead=dead == "1",
+        pane_dead=dead == "1" or not pid,
         alternate_on=alternate == "1",
     )
 
@@ -130,4 +148,4 @@ def _read_history_limit(pane: Pane) -> int:
     """
     stdout = pane.display_message(HISTORY_LIMIT_FORMAT, get_text=True)
     raw = stdout[0] if stdout else "0"
-    return int(raw)
+    return _int_or_zero(raw)

tests/test_history.py

@@ -666,14 +666,12 @@ def test_global_history_default_leaves_raw_send_keys_bytes_and_boundaries(
 ) -> None:
     """Control/TUI input stays exact; explicit suppression adds one space.
 
-    A fake pane delegates to libtmux's real ``send_keys`` at the pre-PTY
-    command boundary, where an inherited prefix or merged Enter is observable.
+    Subprocess interception at the pre-PTY argv boundary, where an
+    inherited prefix or a merged Enter would be observable.
     """
-    from libtmux import Pane
-
     from libtmux_mcp.tools.pane_tools import io
 
-    calls: list[tuple[str, tuple[str, ...]]] = []
+    calls: list[list[str]] = []
 
     class FakeServer:
         tmux_bin = "tmux"
@@ -684,18 +682,14 @@ class FakePane:
         pane_id = "%1"
         server = FakeServer()
 
-        def cmd(self, *args: str) -> None:
-            calls.append(("cmd", args))
-
-        def enter(self) -> None:
-            calls.append(("enter", ()))
-
-        def send_keys(self, keys: str, **kwargs: t.Any) -> None:
-            Pane.send_keys(t.cast("Pane", self), keys, **kwargs)
+    def _run(argv: list[str], **kwargs: t.Any) -> subprocess.CompletedProcess[str]:
+        calls.append(argv)
+        return subprocess.CompletedProcess(argv, 0)
 
     pane = FakePane()
     monkeypatch.setattr(io, "_get_server", lambda **kwargs: FakeServer())
     monkeypatch.setattr(io, "_resolve_pane", lambda *args, **kwargs: pane)
+    monkeypatch.setattr("libtmux_mcp.tools.pane_tools.io.subprocess.run", _run)
 
     async def _exercise() -> None:
         async with Client(_history_server("1")) as client:
@@ -721,12 +715,12 @@ async def _exercise() -> None:
     asyncio.run(_exercise())
 
     assert calls == [
-        ("cmd", ("send-keys", "C-c")),
-        ("cmd", ("send-keys", "-l", "partial-TUI")),
-        ("cmd", ("send-keys", "/needle")),
-        ("enter", ()),
-        ("cmd", ("send-keys", "-l", " explicit-secret")),
-        ("enter", ()),
+        ["tmux", "send-keys", "-t", "%1", "--", "C-c"],
+        ["tmux", "send-keys", "-t", "%1", "-l", "--", "partial-TUI"],
+        ["tmux", "send-keys", "-t", "%1", "--", "/needle"],
+        ["tmux", "send-keys", "-t", "%1", "Enter"],
+        ["tmux", "send-keys", "-t", "%1", "-l", "--", " explicit-secret"],
+        ["tmux", "send-keys", "-t", "%1", "Enter"],
     ]
 
 
@@ -735,14 +729,12 @@ def test_global_history_default_leaves_untimed_batch_operations_explicit_only(
 ) -> None:
     """Untimed batches preserve raw defaults, literal mode, and Enter.
 
-    A fake pane exercises libtmux's real ``send_keys`` at the pre-PTY command
-    boundary so exact literal bytes and the separate Enter call remain visible.
+    Subprocess interception at the pre-PTY argv boundary keeps the exact
+    literal bytes and the separate Enter call visible.
     """
-    from libtmux import Pane
-
     from libtmux_mcp.tools.pane_tools import io
 
-    calls: list[tuple[str, tuple[str, ...]]] = []
+    calls: list[list[str]] = []
 
     class FakeServer:
         tmux_bin = "tmux"
@@ -753,18 +745,14 @@ class FakePane:
         pane_id = "%1"
         server = FakeServer()
 
-        def cmd(self, *args: str) -> None:
-            calls.append(("cmd", args))
-
-        def enter(self) -> None:
-            calls.append(("enter", ()))
-
-        def send_keys(self, keys: str, **kwargs: t.Any) -> None:
-            Pane.send_keys(t.cast("Pane", self), keys, **kwargs)
+    def _run(argv: list[str], **kwargs: t.Any) -> subprocess.CompletedProcess[str]:
+        calls.append(argv)
+        return subprocess.CompletedProcess(argv, 0)
 
     pane = FakePane()
     monkeypatch.setattr(io, "_get_server", lambda **kwargs: FakeServer())
     monkeypatch.setattr(io, "_resolve_pane", lambda *args, **kwargs: pane)
+    monkeypatch.setattr("libtmux_mcp.tools.pane_tools.io.subprocess.run", _run)
 
     async def _exercise() -> None:
         async with Client(_history_server("1")) as client:
@@ -793,11 +781,11 @@ async def _exercise() -> None:
     asyncio.run(_exercise())
 
     assert calls == [
-        ("cmd", ("send-keys", "C-c")),
-        ("cmd", ("send-keys", "-l", "TUI_BATCH_DEFAULT")),
-        ("enter", ()),
-        ("cmd", ("send-keys", "-l", " batch-secret")),
-        ("enter", ()),
+        ["tmux", "send-keys", "-t", "%1", "--", "C-c"],
+        ["tmux", "send-keys", "-t", "%1", "-l", "--", "TUI_BATCH_DEFAULT"],
+        ["tmux", "send-keys", "-t", "%1", "Enter"],
+        ["tmux", "send-keys", "-t", "%1", "-l", "--", " batch-secret"],
+        ["tmux", "send-keys", "-t", "%1", "Enter"],
     ]
 
 
@@ -806,8 +794,8 @@ def test_global_history_default_leaves_timed_batch_operations_explicit_only(
 ) -> None:
     """Timed batches preserve raw bytes and send Enter separately.
 
-    Timed batches bypass ``Pane.send_keys``, so subprocess interception at the
-    pre-PTY argv boundary is required to expose prefixes and Enter coalescing.
+    Subprocess interception at the pre-PTY argv boundary exposes prefixes
+    and Enter coalescing.
     """
     from libtmux_mcp.tools.pane_tools import io
 
@@ -859,10 +847,10 @@ async def _exercise() -> None:
     asyncio.run(_exercise())
 
     assert calls == [
-        ["tmux", "send-keys", "-t", "%1", "C-c"],
-        ["tmux", "send-keys", "-t", "%1", "-l", "TUI_BATCH_DEFAULT"],
+        ["tmux", "send-keys", "-t", "%1", "--", "C-c"],
+        ["tmux", "send-keys", "-t", "%1", "-l", "--", "TUI_BATCH_DEFAULT"],
         ["tmux", "send-keys", "-t", "%1", "Enter"],
-        ["tmux", "send-keys", "-t", "%1", "-l", " batch-secret"],
+        ["tmux", "send-keys", "-t", "%1", "-l", "--", " batch-secret"],
         ["tmux", "send-keys", "-t", "%1", "Enter"],
     ]