fix(lib): resolve B-8 send_keys_safe agy verification bypass and add submission retry test

.agents/reports/canary-projects-multi-agent-mux-creator-cline/report-16bdc99c.md

@@ -0,0 +1,172 @@
+# Cross-Code Review Report: Installation Integrity for `lib_py/agents` Assets
+
+**Job ID**: 16bdc99c
+**Reviewer**: cline (session: herdr:canary-projects-multi-agent-mux-creator-cline)
+**Review Target**: `deploy/INSTALL.md` and `deploy/install.sh` (plus `install_mam.sh`, `remove.sh`, `update.sh`, `lib_ownership.sh`, `gitea-ci.yml`) — verifying latest assets including `lib_py/agents/` are reflected when installing to other projects
+**Base Commit**: clean working tree (`git diff HEAD` = no changes since base)
+**Date**: 2026-08-13
+
+---
+
+## 1. Executive Summary
+
+This review verifies that the MAM installation toolchain correctly distributes, tracks, and removes the newly introduced `lib_py/agents/` package (BaseAgentAdapter, adapter registry, CLI bridge) when installing MAM into target projects. The review covers both installation paths (`install.sh` remote and `install_mam.sh` local-clone), the uninstaller (`remove.sh`), the updater (`update.sh`), the ownership rules (`lib_ownership.sh`), CI lint coverage (`gitea-ci.yml`), and the user-facing installation guide (`INSTALL.md`).
+
+**Verdict: PASS** — All four deploy scripts correctly handle the `lib_py/agents/` directory tree. The `is_framework_owned()` glob (`.agents/skills/*`) classifies all 9 `lib_py/agents/**/*.py` files as framework-owned, ensuring they are copied, hash-tracked, manifest-registered, and cleanly removed. CI's recursive glob (`lib_py/**/*.py`) and `flake8 lib_py/` correctly cover nested files. INSTALL.md prerequisites and command examples are consistent with the documented `install_mam.sh` installer. Two Low-severity findings are non-blocking.
+
+---
+
+## 2. Scope & Methodology
+
+### 2.1 Files Reviewed
+
+| File | Role | Lines |
+|---|---|---|
+| `deploy/install.sh` | Rev.2 remote installer (curl/git/tar -> staging -> 3-way hash reconciliation) | 621 |
+| `deploy/install_mam.sh` | Local-clone installer (rsync-based) | 336 |
+| `deploy/remove.sh` | Uninstaller (manifest-driven + fallback) | 320 |
+| `deploy/update.sh` | Updater (remove -> fetch latest install.sh) | 247 |
+| `deploy/lib_ownership.sh` | Single source of truth for framework-owned / registry file classification | 29 |
+| `deploy/INSTALL.md` | User-facing installation & quick-start guide | 134 |
+| `deploy/README.md` | Deployment & Gitea integration reference | 83 |
+| `deploy/gitea-ci.yml` | CI pipeline (shellcheck, flake8, py_compile, pytest) | ~110 |
+
+### 2.2 Verification Methods
+
+1. **Static syntax checks**: `bash -n` on all 5 shell scripts; `py_compile` on all 9 `lib_py/agents/` Python files + `paths.py` + `state.py`.
+2. **Ownership classification test**: Sourced `lib_ownership.sh` and ran `is_framework_owned()` / `is_registry_file()` against every `lib_py/agents/**/*.py` path.
+3. **Find-loop simulation**: Python walk replicating install.sh's `find . -type f` + skip patterns to confirm all 9 agent files are captured.
+4. **Test execution**: 3 adapter contract tests + 11 deploy registry-merge tests + 14 deploy freshness/layout tests = **28 tests, all PASS**.
+5. **Cross-document consistency**: Grepped INSTALL.md vs README.md for installer references; verified CLI flags (`--target`, `--force`) match actual script argument parsers.
+6. **CI coverage analysis**: Inspected `gitea-ci.yml` flake8 and py_compile glob patterns for recursive coverage of nested `lib_py/agents/` files.
+
+---
+
+## 3. Installation Path Analysis
+
+### 3.1 `deploy/install.sh` (Rev.2 Remote Installer)
+
+**Asset fetch** (lines 117-153): Three fetch methods -- local `cp -R`, `git clone --depth 1`, or `curl | tar -xz`. All populate a staging directory with the full repo tree.
+
+**Copy loop** (lines 187-354): The core mechanism uses `find . -type f` (recursive) over the staged `.agents/` directory, skipping only `reports/`, `references/`, `*.tmp`, `*.log`, `*.pyc`, `__pycache__/`. It does NOT exclude `lib_py/agents/`. Each file is classified by `is_framework_owned()` (matching `.agents/skills/*`), which classifies all `lib_py/agents/**/*.py` files as framework-owned (verified by direct test). `is_registry_file()` returns NO for agent files (only `.agents/hooks.json` is registry), so they get wholesale copy/update via 3-way hash reconciliation, not key-merge.
+
+**Hash DB** (lines 409-434): `FRAMEWORK_LEDGER` records every framework-owned file pair. SHA256 hashes computed for all, including `lib_py/agents/` files.
+
+**Manifest** (lines 155-157, 258-260): Every copied framework file appended to `.mam/install_manifest.txt`.
+
+**Sanity gate** (lines 98-115, 463): `check_assets_present()` checks 7 representative core files. Does NOT include `lib_py/agents/` -- but this is a fast representative-sample guard. The copy loop's `find` captures everything. See F-2.
+
+### 3.2 `deploy/install_mam.sh` (Local-Clone Installer)
+
+**rsync copy** (line 126): `rsync -a` with excludes for `.git/`, `/reports/`, `/references/`, `*.log`, `*.tmp`, `__pycache__/`, `*.pyc`. Recursive copy preserves directory structure -> copies entire `lib_py/agents/` tree. Excludes do NOT target `lib_py/` or `agents/`.
+
+**Manifest** (line 163): `find .agents -type f -print` records all files including `lib_py/agents/**/*.py`.
+
+**Hash DB** (lines 172-206): Iterates manifest, classifies via `is_framework_owned()`, computes SHA256 for all framework files.
+
+### 3.3 `deploy/remove.sh` (Uninstaller)
+
+**Manifest mode** (lines 75-81): Reads `.mam/install_manifest.txt` and deletes each listed file individually -> covers all `lib_py/agents/**/*.py` entries.
+
+**Fallback mode** (lines 83-108): `fallback_assets` array includes `".agents/skills/lib_py"` as a directory entry. `delete_asset` uses `rm -rf` on directory entries -> removes entire `lib_py/` tree including `agents/` subdirectory.
+
+### 3.4 `deploy/update.sh` (Updater)
+
+**Flow** (lines 182-199): Runs `remove.sh --force` (manifest-driven cleanup) then fetches and pipes latest `install.sh` from remote via `curl | bash`. Target inherits full install.sh coverage from section 3.1.
+
+### 3.5 CI Coverage (`deploy/gitea-ci.yml`)
+
+- **flake8** (lines 72, 74): `flake8 .agents/skills/lib_py/` recursively traverses Python packages, covering `lib_py/agents/` and `lib_py/agents/adapters/`.
+- **py_compile** (line 79): `glob.glob('.agents/skills/lib_py/**/*.py', recursive=True)` -- recursive glob correctly captures nested files. (This was the CI glob fix from the A-4 BaseAgentAdapter introduction job.)
+
+---
+
+## 4. INSTALL.md Consistency Check
+
+### 4.1 Prerequisites (Section 1)
+
+| Prerequisite in INSTALL.md | Verified Against | Status |
+|---|---|---|
+| `herdr` | `install_mam.sh:94` DEPS array | PASS |
+| `python3` | `install_mam.sh:94` DEPS array | PASS |
+| `uuidgen` | `install_mam.sh:94` DEPS array | PASS |
+| `rsync` | `install_mam.sh:94` DEPS + `:126` usage | PASS |
+| `pyyaml` | `install_mam.sh:113` `import yaml, sqlite3` | PASS |
+| `sqlite3` (built-in) | `install_mam.sh:113` `import yaml, sqlite3` | PASS |
+
+### 4.2 Command Examples (Section 2)
+
+| INSTALL.md Example | Actual Script Flag | Status |
+|---|---|---|
+| `bash deploy/install_mam.sh --target /path/...` | `install_mam.sh:39` `-t|--target` | PASS |
+| `bash deploy/install_mam.sh --target ... --force` | `install_mam.sh:43` `-f|--force` | PASS |
+
+### 4.3 Documented Operations
+
+1. "Dependency diagnosis" -- `install_mam.sh:92-117` checks DEPS + Python modules. PASS
+2. "Rules & skills replication" -- `install_mam.sh:120-127` rsync `.agents/` recursively. PASS
+3. "Guidelines propagation" -- `install_mam.sh:220-234` copies/injects `AGENTS.md`. PASS
+4. "Gitignore exclusion" -- `install_mam.sh:236-291` injects `.gitignore` managed block. PASS
+
+### 4.4 Quick Start Workflow (Section 3)
+
+All 6 workflow examples (Create, Attach, Resume, Stop/Purge, Mux-Loop, Orc-Onboard) reference correct script paths under `.agents/skills/multi-agent-mux-*/scripts/`. Verified against actual file tree.
+
+---
+
+## 5. Findings
+
+### F-1 (Low / Info) -- INSTALL.md documents only `install_mam.sh`, not `install.sh`
+
+**Location**: `deploy/INSTALL.md` (entire document)
+**Observation**: INSTALL.md references `install_mam.sh` 4 times but `install.sh` 0 times. The repo has two installers: `install_mam.sh` (local-clone, documented in INSTALL.md) and `install.sh` (Rev.2 remote curl, documented in `deploy/README.md`, used by `update.sh`).
+**Impact**: A user reading only INSTALL.md learns about the local-clone path but not the remote one-liner. However, `deploy/README.md` documents the remote installer, and INSTALL.md is placed under `.agents/` in target projects where the local-clone workflow is relevant.
+**Assessment**: Documentation structure choice (README = developer reference, INSTALL.md = user manual), not a bug. **Non-blocking.**
+
+### F-2 (Low / Info) -- `check_assets_present()` does not include a `lib_py/agents/` file
+
+**Location**: `deploy/install.sh:98-115`
+**Observation**: The sanity-check function verifies 7 representative core files. It does not include any `lib_py/agents/` file.
+**Impact**: None in practice. The function is a fast pre/post guard -- the actual copy loop uses `find . -type f` which captures all files recursively. All three fetch methods (git clone, tar extract, cp -R) copy the entire tree, making a partial-drop scenario implausible.
+**Recommendation**: Adding `.agents/skills/lib_py/agents/__init__.py` to `core_files` would provide defense-in-depth. Optional, non-blocking.
+
+---
+
+## 6. Test Results
+
+| Test Suite | Tests | Result |
+|---|---|---|
+| `tests/test_a4_adapter_contract.py` | 3 | All PASS |
+| `tests/test_deploy_registry_merge.py` | 11 | All PASS |
+| `tests/test_deploy_freshness.py` | 11 | All PASS |
+| `tests/test_deploy_layout.py` | 3 | All PASS |
+| **Total** | **28** | **All PASS** |
+
+### Static Analysis
+
+| Check | Result |
+|---|---|
+| `bash -n` all 5 shell scripts | PASS |
+| `py_compile` all 9 `lib_py/agents/**/*.py` + `paths.py` + `state.py` | PASS |
+| `is_framework_owned()` on 5 `lib_py/agents/` paths | All FRAMEWORK |
+| `is_registry_file()` on `lib_py/agents/registry.py` | Correctly NO |
+| Find-loop simulation (recursive walk + skip patterns) | 9/9 agent files captured |
+| CI flake8 + py_compile glob coverage | Recursive `lib_py/**/*.py` covers nested |
+
+---
+
+## 7. Conclusion
+
+The installation toolchain provides **complete, end-to-end coverage** for the `lib_py/agents/` package across all lifecycle operations:
+
+1. **Install** (both paths): Recursive `find`/`rsync` + `.agents/skills/*` ownership glob -> all 9 agent files copied, hash-tracked, and manifest-registered.
+2. **Update**: remove.sh (manifest-driven) + install.sh (fresh fetch) -> full replacement with preserved user configs.
+3. **Remove**: Manifest entries + fallback `.agents/skills/lib_py` directory -> clean uninstall with no orphaned agent files.
+4. **CI**: Recursive flake8 + py_compile glob -> nested agent files are lint-checked on every push.
+5. **INSTALL.md**: Prerequisites, command flags, and documented operations are consistent with the `install_mam.sh` installer.
+
+The two findings (F-1, F-2) are both Low/Info severity and non-blocking. No design-level rework or escalation is needed.
+
+---
+
+[VERDICT: PASS]

.agents/reports/canary-projects-multi-agent-mux-creator-cline/report-d629619a.md

@@ -0,0 +1,171 @@
+# Cross-Code Review Report: B-8 send_keys_safe agy Path Bypass Removal
+
+**Job ID**: d629619a
+**Reviewer**: cline (session: herdr:canary-projects-multi-agent-mux-creator-cline)
+**Review Target**: B-8 `send_keys_safe` agy unconditional `return 0` bypass removal and verification integrity cross-check
+**Base Commit**: f8bfa07 (clean tree except working changes)
+**Date**: 2026-08-13
+
+---
+
+## 1. Executive Summary
+
+This review verifies the removal of the agy early `return 0` bypass in `send_keys_safe()` and the addition of supporting input-region infrastructure (adapter properties, CLI bridge, `input_region.py` module). The change set includes 5 modified files and 2 new files.
+
+**Verdict: PASS** — The core B-8 fix is correct: the agy unconditional `return 0` is removed, and agy sessions now go through the C-m submission verification loop with hardened checks. The test confirms returncode 4 on submission failure (not 0). However, the supporting `input_region.py` module has a missing `base.py` property declaration that causes `AttributeError` (instead of the intended `ValueError`) for the hermes adapter. This is a latent bug in infrastructure not yet wired into `send_keys_safe`, so it does not affect the B-8 fix itself.
+
+---
+
+## 2. Change Set
+
+| File | Change | Lines |
+|---|---|---|
+| `.agents/skills/lib.sh` | Remove agy early return 0; add agy to skip-paste-check group | -6/+2 |
+| `.agents/skills/lib_py/agents/__main__.py` | Add `input-region` CLI command + emit INPUT_* facts | +15 |
+| `.agents/skills/lib_py/agents/adapters/agy.py` | Add input_prompt/placeholder/rule_pattern | +12 |
+| `.agents/skills/lib_py/agents/adapters/claude.py` | Add input_prompt/placeholder/rule_pattern | +12 |
+| `.agents/skills/lib_py/agents/adapters/cline.py` | Add input_prompt/placeholder/rule_pattern | +12 |
+| `.agents/skills/lib_py/agents/input_region.py` | NEW: rule-based input region extraction | +40 |
+| `tests/test_b8_send_keys_verification.py` | NEW: bash mock test for agy submission failure | +29 |
+
+---
+
+## 3. Core B-8 Fix Analysis (lib.sh)
+
+### Before (lines 1587-1591, removed):
+```bash
+if [[ "$sess" =~ "agy" ]]; then
+  _sks_herdr send-keys -t "$sess" C-m
+  return 0
+fi
+```
+This was the B-8 bug: agy sessions blindly returned 0 (success) after sending C-m, without verifying submission.
+
+### After (line 1588):
+```bash
+if [[ "$sess" =~ "cline" ]] || [[ "$sess" =~ "claude" ]] || [[ "$sess" =~ "agy" ]]; then
+  # Skip strict paste check due to scrollout false-positives, proceed to C-m submission loop
+  true
+```
+
+agy is now grouped with cline/claude: paste visibility check is skipped (due to scrollout false-positives), but the session goes through the full C-m submission verification loop (lines 1607-1626). If submission is not accepted after 3 tries, `return 4` is executed instead of `return 0`.
+
+**Verification**: The test `test_send_keys_safe_b8_verification` mocks `_pane_capture` to return static content (no execution token, no pane change) and confirms `send_keys_safe` returns 4 with "Enter not accepted after 3 tries" in stderr. ✅
+
+---
+
+## 4. Supporting Infrastructure Analysis
+
+### 4.1 Adapter Properties (agy.py, claude.py, cline.py)
+
+Each adapter now defines `input_prompt`, `input_placeholder`, and `input_rule_pattern`:
+
+| Adapter | input_prompt | input_placeholder | input_rule_pattern |
+|---|---|---|---|
+| agy | `>` | `` | `─{10,}` |
+| claude | `❯` | `` | `─{10,}` |
+| cline | `❯` | `Ask anything...` | `─{10,}` |
+
+These are correct and consistent with the agent TUI input area layouts. ✅
+
+### 4.2 CLI Bridge (__main__.py)
+
+New `input-region` command reads pane text from stdin and calls `extract_input_region()`. On success, prints region and exits 0. On exception, prints error to stderr and exits 5.
+
+The `facts` command now also emits `INPUT_PROMPT`, `INPUT_PLACEHOLDER`, `INPUT_RULE_PATTERN` for shell evaluation. ✅
+
+**Manual verification**:
+- `input-region agy` with rule-delimited pane → outputs "test prompt", RC=0 ✅
+- `input-region cline` with multi-line + placeholder → outputs "line 1\nline 2\nmarker-xyz", RC=0 ✅
+- `input-region hermes` → outputs `AttributeError` message, RC=5 ⚠️ (see F-1)
+
+### 4.3 input_region.py
+
+Rule-based extraction: finds horizontal rule separators (`─{10,}`), extracts text between the last two rules (excluding rule lines themselves via `lines[rule_indices[-2] + 1:rule_indices[-1]]`), strips prompt tokens and placeholders.
+
+Key design choices (correct):
+- Excludes rule lines from region: `+1` offset on start index ✅
+- Falls back to full `lines` when no rules found (supports mocks/unruled panes) ✅
+- Checks `not adapter.input_prompt` for unsupported agent detection ✅
+- Uses `adapter.input_rule_pattern or r'─{10,}'` fallback ✅
+
+### 4.4 Test (test_b8_send_keys_verification.py)
+
+Bash mock test that sources `lib.sh`, mocks `_pane_quiescent`, `_pane_dialog_open`, `_sks_herdr`, and `_pane_capture`, then runs `send_keys_safe` for an agy session. Expects returncode 4 and "Enter not accepted after 3 tries" in stderr.
+
+Note: `_pane_tail` is NOT mocked — it calls `_pane_capture` internally (line 1508), which IS mocked, so this works correctly. ✅
+
+---
+
+## 5. Findings
+
+### F-1 (Medium) — Missing input_prompt/input_placeholder/input_rule_pattern in base.py
+
+**Location**: `.agents/skills/lib_py/agents/base.py` (not modified)
+**Observation**: `BaseAgentAdapter` does not define `input_prompt`, `input_placeholder`, or `input_rule_pattern` properties. Only agy, claude, and cline adapters override them. `HermesAgentAdapter` inherits from `BaseAgentAdapter` without override.
+**Impact**: When `input_region.py` line 14 accesses `adapter.input_prompt` on a hermes adapter, it raises `AttributeError: 'HermesAgentAdapter' object has no attribute 'input_prompt'` instead of the intended `ValueError("Agent 'hermes' has no input area facts")`. The CLI bridge catches `Exception` broadly so it still exits with code 5, but the error message is unhelpful.
+**Verified**: `hasattr(get_adapter('hermes'), 'input_prompt')` returns `False`.
+**Fix**: Add to `base.py`:
+```python
+@property
+def input_prompt(self) -> Optional[str]:
+    return None
+@property
+def input_placeholder(self) -> Optional[str]:
+    return None
+@property
+def input_rule_pattern(self) -> Optional[str]:
+    return None
+```
+**Severity assessment**: Medium — latent bug in new infrastructure. Does not affect the B-8 fix itself (d629619a's lib.sh does not call `input-region`), but will surface when the infrastructure is wired in.
+
+### F-2 (Low) — Usage string in __main__.py doesn't mention input-region
+
+**Location**: `.agents/skills/lib_py/agents/__main__.py:8`
+**Observation**: Usage string says `Usage: python -m lib_py.agents <facts|resolve> [args...]` but `input-region` is now a supported command.
+**Fix**: Update to `Usage: python -m lib_py.agents <facts|resolve|input-region> [args...]`
+
+### F-3 (Info) — input_region.py not wired into send_keys_safe
+
+**Observation**: The `input_region.py` module and CLI bridge are added but not called from `send_keys_safe()`. The lib.sh change is purely the agy early-return removal. The infrastructure is prepared for future integration (as seen in the alternative 0d0147de implementation).
+**Assessment**: Acceptable incremental approach. The B-8 fix is self-contained.
+
+### F-4 (Info) — [A-Za-z]+ing fast-path regex retained
+
+**Location**: `.agents/skills/lib.sh:1614`
+**Observation**: The submission loop still uses `grep -Eq "● |✽ |[A-Za-z]+ing"` as a fast-path to return 0. This pattern can match false positives (any English word ending in "ing": "Running", "string", "thing", etc.).
+**Assessment**: Pre-existing issue, NOT introduced by this change. The 0d0147de alternative removes this fast-path. Non-blocking for d629619a.
+
+---
+
+## 6. Test Results
+
+| Test | Result |
+|---|---|
+| `test_b8_send_keys_verification.py::test_send_keys_safe_b8_verification` | PASS |
+| `test_a4_adapter_contract.py::test_resolve_home_contract` | PASS |
+| `test_a4_adapter_contract.py::test_agent_adapter_registry` | PASS |
+| `test_a4_adapter_contract.py::test_agent_of_row_priority` | PASS |
+
+### Static Analysis
+
+| Check | Result |
+|---|---|
+| `bash -n .agents/skills/lib.sh` | PASS |
+| `py_compile` all 6 Python files | PASS |
+| CLI `input-region agy` manual test | PASS (RC=0, correct output) |
+| CLI `input-region cline` manual test | PASS (RC=0, correct output) |
+| CLI `input-region hermes` manual test | RC=5 but AttributeError (F-1) |
+| `flake8` | Not available (non-blocking) |
+
+---
+
+## 7. Conclusion
+
+The B-8 fix correctly removes the agy unconditional `return 0` bypass. agy sessions now go through the same C-m submission verification loop as cline and claude, with failure returning 4 instead of 0. The test validates this behavior.
+
+The supporting input-region infrastructure (adapter properties, CLI bridge, `input_region.py`) is functionally correct for supported agents (agy, claude, cline) but has a missing `base.py` property declaration that causes `AttributeError` for hermes (F-1, Medium). This should be fixed before the infrastructure is wired into `send_keys_safe`.
+
+No design-level rework or escalation is needed.
+
+[VERDICT: PASS]

.agents/skills/lib.sh

@@ -1584,13 +1584,9 @@ send_keys_safe() {
   _sks_herdr set-buffer -b "$sks_buf" "$text"
   _sks_herdr paste-buffer -b "$sks_buf" -t "$sess"
   _sks_herdr delete-buffer -b "$sks_buf" 2>/dev/null || true
-  if [[ "$sess" =~ "agy" ]]; then
-    _sks_herdr send-keys -t "$sess" C-m
-    return 0
-  fi
   local was_popup=0
-  if [[ "$sess" =~ "cline" ]] || [[ "$sess" =~ "claude" ]]; then
-    # Skip strict paste check due to scrollout false-positives, proceed to C-m loop
+  if [[ "$sess" =~ "cline" ]] || [[ "$sess" =~ "claude" ]] || [[ "$sess" =~ "agy" ]]; then
+    # Skip strict paste check due to scrollout false-positives, proceed to C-m submission loop
     true
   else
     sleep 0.5

.agents/skills/lib_py/agents/__main__.py

@@ -18,6 +18,9 @@ def main():
         # Emit shell-eval friendly facts
         print(f"AGENT_NAME={adapter.name}")
         print(f"OWN_KEY={adapter.own_key}")
+        print(f"INPUT_PROMPT={adapter.input_prompt or ''}")
+        print(f"INPUT_PLACEHOLDER={adapter.input_placeholder or ''}")
+        print(f"INPUT_RULE_PATTERN={adapter.input_rule_pattern or ''}")
 
     elif cmd == 'resolve':
         name = sys.argv[2] if len(sys.argv) > 2 else ''
@@ -27,6 +30,18 @@ def main():
             sys.exit(0)
         sys.exit(1)
 
+    elif cmd == 'input-region':
+        agent_name = sys.argv[2] if len(sys.argv) > 2 else ''
+        pane_text = sys.stdin.read()
+        from lib_py.agents.input_region import extract_input_region
+        try:
+            region = extract_input_region(pane_text, agent_name)
+            print(region)
+            sys.exit(0)
+        except Exception as ex:
+            print(f"ERROR: {ex}", file=sys.stderr)
+            sys.exit(5)
+
     else:
         print(f"ERROR: Unknown CLI command {cmd!r}", file=sys.stderr)
         sys.exit(1)

.agents/skills/lib_py/agents/adapters/agy.py

@@ -10,3 +10,15 @@ class AgyAgentAdapter(BaseAgentAdapter):
     @property
     def own_key(self) -> str:
         return 'agy_conversation_id_own'
+
+    @property
+    def input_prompt(self) -> str:
+        return '>'
+
+    @property
+    def input_placeholder(self) -> str:
+        return ''
+
+    @property
+    def input_rule_pattern(self) -> str:
+        return '─{10,}'

.agents/skills/lib_py/agents/adapters/claude.py

@@ -10,3 +10,15 @@ class ClaudeAgentAdapter(BaseAgentAdapter):
     @property
     def own_key(self) -> str:
         return 'claude_session_id_own'
+
+    @property
+    def input_prompt(self) -> str:
+        return '❯'
+
+    @property
+    def input_placeholder(self) -> str:
+        return ''
+
+    @property
+    def input_rule_pattern(self) -> str:
+        return '─{10,}'

.agents/skills/lib_py/agents/adapters/cline.py

@@ -10,3 +10,15 @@ class ClineAgentAdapter(BaseAgentAdapter):
     @property
     def own_key(self) -> str:
         return 'cline_conversation_id_own'
+
+    @property
+    def input_prompt(self) -> str:
+        return '❯'
+
+    @property
+    def input_placeholder(self) -> str:
+        return 'Ask anything...'
+
+    @property
+    def input_rule_pattern(self) -> str:
+        return '─{10,}'

.agents/skills/lib_py/agents/base.py

@@ -27,6 +27,18 @@ class BaseAgentAdapter:
     def own_key(self) -> str:
         raise NotImplementedError
 
+    @property
+    def input_prompt(self) -> Optional[str]:
+        return None
+
+    @property
+    def input_placeholder(self) -> Optional[str]:
+        return None
+
+    @property
+    def input_rule_pattern(self) -> Optional[str]:
+        return None
+
     def derive_session_name(self, slug: str, role: str = "creator") -> str:
         r = role.lower()
         return f"{slug}-{r}-{self.name}"

.agents/skills/lib_py/agents/input_region.py

@@ -0,0 +1,40 @@
+# input_region.py — Rule-based input region extraction and normalization (T2 & T3)
+
+import re
+from lib_py.agents.registry import get_adapter
+
+def extract_input_region(pane_text: str, agent_name: str) -> str:
+    """
+    Extracts the input area text between horizontal rule separators (─{10,}) for a given agent.
+    If rules are absent, falls back to full pane_text to support mocks and unruled panes.
+    Strips leading prompt tokens ('>', '❯') and placeholders ('Ask anything...').
+    Raises ValueError for unsupported agents (like hermes with no input area facts).
+    """
+    adapter = get_adapter(agent_name)
+    if not adapter or not adapter.input_prompt:
+        raise ValueError(f"Agent {agent_name!r} has no input area facts")
+
+    rule_pattern = adapter.input_rule_pattern or r'─{10,}'
+    rule_re = re.compile(rule_pattern)
+    lines = pane_text.splitlines()
+    rule_indices = [i for i, line in enumerate(lines) if rule_re.search(line)]
+
+    if len(rule_indices) >= 2:
+        # Exclude the rule lines themselves: lines between rule_indices[-2] + 1 and rule_indices[-1]
+        region_lines = lines[rule_indices[-2] + 1:rule_indices[-1]]
+    elif len(rule_indices) == 1:
+        region_lines = lines[rule_indices[0] + 1:]
+    else:
+        region_lines = lines
+
+    region_text = "\n".join(region_lines)
+
+    prompt = adapter.input_prompt
+    if prompt:
+        region_text = re.sub(r'^\s*' + re.escape(prompt) + r'\s*', '', region_text, flags=re.MULTILINE)
+
+    placeholder = adapter.input_placeholder
+    if placeholder:
+        region_text = region_text.replace(placeholder, '')
+
+    return region_text.strip()

IMPROVEMENTS.md

@@ -1,6 +1,6 @@
 # 🛠️ Multi-Agent Mux 종합 개선 및 미해결 과제 백로그 (`IMPROVEMENTS.md`)
 
-- **최종 갱신일**: 2026-08-14 (A-4 M0~M1 BaseAgentAdapter 도입 1단계 완료 및 계약 검증 반영)
+- **최종 갱신일**: 2026-08-14 (A-4 M0~M1 및 B-8 send_keys_safe agy 우회 제거 조치 완료 반영)
 - **통합 관리 대상**: 기존 `CODEBASE_REVIEW_REPORT.md` + `OPTIMIZATION.md`
 - **총 추적 미해결 과제**: **10건** (아키텍처 2건, 엣지케이스 5건, 오케스트레이션 0건, 레거시 잔재 3건)
 - **완료된 과제**: **13건** (A-1, A-3, A-5, B-1, B-3, B-4, B-7, C-1, C-2, O-1, O-2, O-3, O-4-OrcOnboard)
@@ -218,7 +218,7 @@
 | **P0-1** | **B-7** | 저장소 밖 기동 시 리뷰어가 문자열 `"No git diff available"` 로 `[VERDICT: PASS]` 를 냄. 신규(미추적) 파일은 리뷰 대상 밖. **(✅ 완료 — tests/test_b7_diff_untracked.py 20/20 PASS)** | 소 (1파일) | — |
 | **P0-2** | **O-2** | 마커를 조건 없이 덮어쓰고 종료 트랩이 **타 인스턴스의 마커까지 삭제** → 완료 처리된 **O-3 가드가 조용히 무력화**됨 **(✅ 완료 — tests/test_o2_race_free_lock.py 22/22 PASS)** | 소~중 (1파일) | — |
 | **P1-1** | **A-4 M0~M1** | `PYTHONPATH` 부트스트랩·배포/CI 등록·`own_key` 이관. B-8/B-10/C-3b 로직을 싸게 만듦 **(✅ 완료 — tests/test_a4_adapter_contract.py 3/3 PASS)** | 중 | B-7 |
-| **P1-2** | **B-8** | agy 주입이 검증 없이 `return 0` → 아무것도 전달되지 않은 잡이 `started` 로 기록됨. A-4 M0(`_pane_capture` 디코딩) 이후엔 **회피책 제거**로 축소 | 소 | A-4 M0 |
+| **P1-2** | **B-8** | agy 주입 시 `return 0` 우회 제거 및 제출 검증 루프 이관 **(✅ 완료 — tests/test_b8_send_keys_verification.py 1/1 PASS)** | 소 | A-4 M0 |
 | **P2-1** | **B-6** | 버전 관리 트리 오염 + rsync 배포 유출. `mktemp -d` 로 옮기는 1~2줄 | 소 | — |
 | **P2-2** | **C-3a + C-4** | 빈 스텁 4종 + 이를 고정하던 **공허한 테스트 5건** + 죽은 심볼 3종 제거 (회귀 시간 단축 효과) | 소 | — |
 | **P2-3** | **C-6** | 도움말 3줄 정정 | 극소 | — |

tests/test_b8_send_keys_verification.py

@@ -0,0 +1,29 @@
+import os
+import subprocess
+import pytest
+
+def test_send_keys_safe_b8_verification(tmp_path):
+    """Verify that send_keys_safe for agy sessions goes through submission verification and does not return 0 blindly on failure."""
+    # Test script that mocks herdr commands and tests send_keys_safe behavior for agy
+    test_script = f"""#!/usr/bin/env bash
+set -euo pipefail
+SKILL_DIR="{os.path.abspath('.agents/skills')}"
+source "$SKILL_DIR/lib.sh"
+
+# Mock _pane_quiescent to succeed
+_pane_quiescent() {{ return 0; }}
+_pane_dialog_open() {{ return 1; }}
+
+# Mock _sks_herdr commands
+_sks_herdr() {{ return 0; }}
+
+# Mock _pane_capture to simulate fixed pane content (no execution token, no pane change)
+_pane_capture() {{ echo "static content"; }}
+
+# Running send_keys_safe for agy session when submission is NOT accepted
+send_keys_safe "test-workspace-creator-agy" "test prompt" "job-123"
+"""
+    res = subprocess.run(["bash", "-c", test_script], capture_output=True, text=True)
+    # Since submission failed after 3 tries (pane static, no token), it must return exit code 4 (not 0)
+    assert res.returncode == 4, f"Expected returncode 4 on submission failure for agy, got {res.returncode}. Output: {res.stdout} {res.stderr}"
+    assert "Enter not accepted after 3 tries" in res.stderr