aicodeman 1.48.0 → 1.49.0

package/dist/tmux-manager.js

@@ -22,6 +22,7 @@
  */
 import { EventEmitter } from 'node:events';
 import { collectDescendants } from './proc-tree.js';
+import { foreignViewSessionName, buildForeignDockerViewKillCommand, buildForeignAttachCommand, buildForeignDockerAttachCommand, buildForeignRemoteAttachCommand, } from './foreign-tmux.js';
 import { execSync, exec, execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 const execAsync = promisify(exec);
@@ -315,9 +316,10 @@ export function derivePaneCurrentPaths(rows, previous = new Map()) {
  *
  * Mirrors `Session.paneExitApplies`, which is where the rule is enforced. A
  * remote session's local pane holds the ssh client, a docker case's holds a
- * `docker exec` into the container's own tmux, and a record rebuilt from the
- * socket carries no provenance at all, so the session end forces all three to
- * UNKNOWN whatever tmux reports. A tick that sees only those has nothing to
+ * `docker exec` into the container's own tmux, an ADOPTED session's holds a
+ * `tmux attach` to a session a human started rather than the agent itself, and
+ * a record rebuilt from the socket carries no provenance at all, so the session
+ * end forces all four to UNKNOWN whatever tmux reports. A tick that sees only those has nothing to
  * learn, and `refreshPaneExits()` skips its tmux read rather than paying for
  * the answer.
  *
@@ -332,12 +334,27 @@ export function hasObservablePaneSession(sessions) {
             continue;
         if (session.docker)
             continue;
+        if (session.adopt)
+            continue;
         if (session.discovered === true)
             continue;
         return true;
     }
     return false;
 }
+/**
+ * Which adopted wrappers have a dead pane with a tmux client still attached, from rows of
+ * `#{pane_dead} #{session_attached} #{session_name}`. Exported for unit testing.
+ */
+export function endedAdoptedAttaches(rows, adopted) {
+    const ended = [];
+    for (const row of rows.split('\n')) {
+        const [dead, attached, muxName] = row.trim().split(' ');
+        if (dead === '1' && Number(attached) > 0 && adopted.has(muxName))
+            ended.push(muxName);
+    }
+    return ended;
+}
 /**
  * Resolve a target pane id from `tmux list-panes -F '#{pane_id}:#{pane_active}'`.
  * Prefers the active pane and falls back to the first valid pane.
@@ -1026,12 +1043,15 @@ export function remoteTmuxLocation(remote, sessionId) {
  *
  * Emits:
  *   ssh -o BatchMode=yes -t [<COD-107 connection opts>] user@host \
- *     'tmux -L codeman-remote new-session -A -s codeman-ssh-<id> -c <path> "cd <path> && exec <cli>" \
+ *     'tmux -L codeman-remote new-session -A -s codeman-ssh-<id> -c <path> /bin/sh -c <pane-command> \
  *        \; set -t codeman-ssh-<id> status off \; set -t codeman-ssh-<id> mouse off \
  *        \; set -t codeman-ssh-<id> prefix C-q \; set -s escape-time 0 \; \
  *        bind-key -T prefix C-q send-prefix \; unbind-key -a -T prefix \; \
  *        bind-key -T prefix C-q send-prefix \; set -t codeman-ssh-<id> remain-on-exit failed'
  *
+ * `<pane-command>` is `cd <path> && exec <cli>`, quoted as one token. A per-host `commands.*`
+ * override is that one token alone, with no `/bin/sh -c` in front of it.
+ *
  * COD-107 — the connection options (`-p`, `-i`, `-J`, SOCKS `-o ProxyCommand`,
  * arbitrary `-o`) come from the shared `buildSshConnectionArgs(remote)`, so the
  * prereq tmux probe and this launch connect with identical options.
@@ -1045,10 +1065,12 @@ export function remoteTmuxLocation(remote, sessionId) {
  * - The `set` options are scoped per-session (`set -t <name>` / server-level
  *   `set -s`), never `-g`, so they never mutate other sessions' prefix/mouse.
  * - The whole tmux invocation is a SINGLE ssh argument (the remote login shell
- *   runs it), so it is shell-quoted as one unit; the `cd && exec` command is in
- *   turn a single tmux argument (tmux runs it via `/bin/sh -c`), so the path is
- *   shell-quoted inside it too. This keeps escaping correct through every layer
- *   even when the remote path contains spaces.
+ *   runs it), so it is shell-quoted as one unit. The `cd && exec` command is the
+ *   pane command: Codeman's own text goes to `/bin/sh -c` as separate tmux
+ *   arguments, and a per-host `commands.*` override stays one argument, which
+ *   tmux hands to the remote default-shell (see the comment at `paneCommand`).
+ *   Each is shell-quoted, so escaping stays correct through every layer even
+ *   when the remote path contains spaces.
  */
 export function buildRemoteLaunchCommand(options) {
     const { mode, remote, sessionId, claudeMode, allowedTools, ompConfig, resumeSessionId } = options;
@@ -1056,9 +1078,9 @@ export function buildRemoteLaunchCommand(options) {
     // hardcoding --dangerously-skip-permissions, so a non-granted multi-user user's
     // downgraded 'auto' actually reaches the remote agent (the default command otherwise
     // ignored claudeMode). A per-host `commands.claude` override stays authoritative
-    // (admin's explicit choice). Wrapped in `$SHELL -i -l -c` for the same reason as
-    // `defaultRemoteCommandForMode`: `claude` lives under a per-user PATH entry that
-    // only an interactive login shell resolves (see that function's comment).
+    // (admin's explicit choice). Wrapped in the login shell (`remoteLoginShellCommand`) for
+    // the same reason as `defaultRemoteCommandForMode`: `claude` lives under a per-user PATH
+    // entry that only an interactive login shell resolves (see that function's comment).
     const override = remote.commands?.[mode];
     let modeCommand;
     if (override) {
@@ -1123,16 +1145,24 @@ export function buildRemoteLaunchCommand(options) {
         modeCommand = defaultRemoteCommandForMode(mode);
     }
     const remoteName = remoteTmuxSessionName(sessionId);
-    // Innermost: the command tmux runs in the new pane. Run via `/bin/sh -c` by
-    // tmux, so the path needs shell-quoting here. `exec` replaces the shell with
-    // the CLI so the pane PID is the agent itself.
+    // Innermost: the command tmux runs in the new pane. `exec` replaces the shell
+    // with the CLI so the pane PID is the agent itself.
+    //
+    // tmux runs a ONE-argument command through the remote default-shell, which is
+    // the user's login shell, and bypasses it for two or more arguments (both
+    // measured on tmux 3.4). Codeman's own text is POSIX (`"${SHELL:-/bin/sh}"` is
+    // a parse error in fish, status 127, a dead pane on every new session), so it
+    // goes to `/bin/sh -c` as separate arguments and no login shell has to parse it.
+    // An override is the user's own text for THEIR shell: it stays one argument,
+    // because `source` and `[[` work in bash and zsh and die in a dash `/bin/sh`.
     const paneCommand = `cd ${shellescape(remote.remotePath)} && ${modeCommand}`;
+    const paneArgv = `${override ? '' : '/bin/sh -c '}${shellescape(paneCommand)}`;
     // The tmux command line, with `\;` separating commands so the config `set`s
     // apply on the SAME connection (and are idempotent on reattach). Options are
     // scoped per-session (`set -t <name>` / server `set -s`), NEVER `-g`, so a
     // shared remote tmux server's other sessions keep their own prefix/mouse.
     const tmuxInvocation = [
-        `tmux -L ${REMOTE_TMUX_SOCKET} new-session -A -s ${remoteName} -c ${shellescape(remote.remotePath)} ${shellescape(paneCommand)}`,
+        `tmux -L ${REMOTE_TMUX_SOCKET} new-session -A -s ${remoteName} -c ${shellescape(remote.remotePath)} ${paneArgv}`,
         `set -t ${remoteName} status off`,
         `set -t ${remoteName} mouse off`,
         `set -t ${remoteName} prefix ${NESTED_TMUX_PREFIX}`,
@@ -1281,7 +1311,7 @@ function claudeDockerPaneCommand(modeCommand, sessionId, resumeId) {
  * Build the ONE `bash -c` launch string for a docker session: image-check ->
  * ensure (inspect-or-create) -> start -> `exec docker exec -it` into the durable
  * in-container tmux (resume-aware). PURE and unit-testable. The escaping survives
- * four layers: outer `bash -c "…"` (JSON.stringify at respawn-pane) -> the joined
+ * four layers: outer `bash -c '…'` (`bashCArg()` at respawn-pane) -> the joined
  * command -> `docker exec … sh -lc '<tmux>'` -> tmux `'<paneCommand>'`.
  */
 export function buildDockerLaunchCommand(opts) {
@@ -1308,8 +1338,8 @@ export function buildDockerLaunchCommand(opts) {
     else if (resumeSessionId) {
         modeCommand = appendResumeFlag(modeCommand, mode, resumeSessionId);
     }
-    // Run by tmux via /bin/sh -c, so the path is shell-quoted here. `exec` makes the
-    // pane PID the agent itself.
+    // Run by tmux through the container's default-shell, so the path is shell-quoted
+    // here. `exec` makes the pane PID the agent itself.
     const paneCommand = `cd ${workdir} && ${modeCommand}`;
     // `setenv -g` primes the session id so reattaches / newly-created panes inherit
     // it. `new-session -A` = attach-or-create (idempotent + resume-aware). Options
@@ -1363,11 +1393,10 @@ export function buildDockerLaunchCommand(opts) {
     const ensure = adopted
         ? `${base} inspect ${name} >/dev/null 2>&1 || { echo ${notFoundMsg}; exit 1; }`
         : `${base} inspect ${name} >/dev/null 2>&1 || ${createCommand}`;
-    // ⚠️ No double quotes and no `$(…)` in the ADOPTED arms. This whole chain is
-    // embedded in an outer `bash -c "…"`, so an unescaped `"` closes that string early,
-    // the rest is re-tokenized, and tmux fails to exec with a bare `execvp(3) failed`.
-    // A `grep -qx` pipeline reads the same answer using only the single-quoted form
-    // every other line in this builder already uses.
+    // A `grep -qx` pipeline, in the single-quoted form every other line in this builder
+    // uses. This chain reaches `bash -c` verbatim now (`bashCArg()`), but it went through
+    // a double-quoted layer for a long time, where a `"` closed that string early and tmux
+    // failed with a bare `execvp(3) failed`, so keep it free of double quotes and `$(…)`.
     const start = adopted
         ? `${base} inspect -f ${shellescape('{{.State.Running}}')} ${name} 2>/dev/null | grep -qx true || { echo ${notRunningMsg}; exit 1; }`
         : `${base} start ${name} >/dev/null 2>&1 || { echo ${startFailMsg}; exit 1; }`;
@@ -1562,6 +1591,44 @@ function buildRemoteSessionCommand(options) {
     }
     return buildRemoteLaunchCommand(options);
 }
+/**
+ * ADOPTION: the pane command for a wrapper session around a tmux session a
+ * human started. Sibling of `buildRemoteSessionCommand` and
+ * `buildDockerLaunchCommand`, and the same shape of decision: the wrapper is an
+ * ordinary `codeman-<8hex>` session on OUR socket, and only what runs INSIDE its
+ * pane differs per location.
+ *
+ * That indirection is what makes adoption safe by construction rather than by
+ * discipline: `killSession` only ever kills the wrapper on our own socket, so
+ * there is no shape of caller bug that reaches the foreign server with a
+ * `kill-session`. It is the same reasoning that keeps a non-owned REMOTE session
+ * safe (see the detach-not-kill early return in `killSession`).
+ */
+export function buildAdoptSessionCommand(adopt, sessionId) {
+    const target = {
+        socketPath: adopt.socketPath,
+        targetSession: adopt.targetSession,
+        // Derived rather than required: the view name is a function of the Codeman
+        // session id, so a record that predates it (or one whose creator filled it in
+        // after construction) still produces the right name instead of an empty `-s`.
+        viewSession: adopt.viewSession || foreignViewSessionName(sessionId),
+    };
+    if (adopt.location === 'docker' && adopt.docker) {
+        return buildForeignDockerAttachCommand({
+            ...target,
+            dockerBase: buildDockerBaseArgs(adopt.docker).join(' '),
+            containerName: adopt.docker.containerName,
+        });
+    }
+    if (adopt.location === 'remote' && adopt.remote) {
+        return buildForeignRemoteAttachCommand({
+            ...target,
+            sshArgs: buildSshConnectionArgs(adopt.remote),
+            sshTarget: remoteSshTarget(adopt.remote),
+        });
+    }
+    return buildForeignAttachCommand(target);
+}
 /**
  * Push one environment variable into a tmux session with `setenv`.
  *
@@ -2113,7 +2180,7 @@ export class TmuxManager extends EventEmitter {
      * In test mode: creates an in-memory session only (no real tmux session).
      */
     async createSession(options) {
-        const { sessionId, workingDir, mode, name, cliName, niceConfig, model, claudeMode, allowedTools, openCodeConfig, codexConfig, geminiConfig, antigravityConfig, piConfig, grokConfig, copilotConfig, deepSeekConfig, ompConfig, resumeSessionId, envOverrides, effort, advisorModel, keepWarm, spawnedByAgent, historyLimit = DEFAULT_TMUX_HISTORY_LIMIT, remote, docker, owner, } = options;
+        const { sessionId, workingDir, mode, name, cliName, niceConfig, model, claudeMode, allowedTools, openCodeConfig, codexConfig, geminiConfig, antigravityConfig, piConfig, grokConfig, copilotConfig, deepSeekConfig, ompConfig, resumeSessionId, envOverrides, effort, advisorModel, keepWarm, spawnedByAgent, historyLimit = DEFAULT_TMUX_HISTORY_LIMIT, remote, docker, adopt, owner, } = options;
         const muxName = `codeman-${sessionId.slice(0, 8)}`;
         if (!isValidMuxName(muxName)) {
             throw new Error('Invalid session name: contains unsafe characters');
@@ -2131,6 +2198,7 @@ export class TmuxManager extends EventEmitter {
                 workingDir,
                 remote,
                 docker,
+                adopt,
                 owner,
                 mode,
                 attached: false,
@@ -2156,14 +2224,22 @@ export class TmuxManager extends EventEmitter {
         // surfacing as a bare `execvp(3) failed: No such file or directory` with nothing
         // pointing at the real cause. The container's own CLIs are verified by the adoption
         // preflight / image gate before launch instead.
-        const cliRunsInContainer = !!docker;
+        //
+        // ⚠️ Skipped for an ADOPTED session for the mirror-image reason: its CLI was started by
+        // a human in a process we did not spawn, and our pane only runs `tmux attach`. Requiring
+        // the binary here would reject adopting a claude that lives in a container or on an ssh
+        // host, and (worse) reject a LOCAL adoption whenever the agent is outside the server
+        // process's PATH, which is the usual systemd/launchd situation.
+        const cliRunsInContainer = !!docker || !!adopt;
         if (!cliRunsInContainer && !cliDir) {
             const message = missingCliMessage(mode);
             if (message)
                 throw new Error(message);
         }
         const envExportsStr = this.buildEnvExports(sessionId, muxName, mode).join(' && ');
-        const { command: statusLineCommand, state: statusLine } = await this._resolveStatusLine(mode, workingDir, !!(remote || docker));
+        const { command: statusLineCommand, state: statusLine } = await this._resolveStatusLine(mode, workingDir, 
+        // An adopted wrapper launches no agent, so nothing can carry the exporter.
+        !!(remote || docker || adopt));
         const idleCompactionOff = await this._resolveIdleCompactionOptOut(mode, statusLine, keepWarm, spawnedByAgent);
         // The user's own REAL statusLine, if any (walked via Claude Code's own
         // settings precedence) — exported below so the shared exporter script
@@ -2196,11 +2272,21 @@ export class TmuxManager extends EventEmitter {
         try {
             // Build the full command to run inside tmux
             const localFullCmd = `${buildNofileLimitCommand()} && ${pathExport}${envExportsStr} && ${cmd}`;
-            const fullCmd = docker
-                ? buildDockerLaunchCommand(resolveDockerLaunchOptions(mode, docker, sessionId, resumeSessionId))
-                : remote
-                    ? buildRemoteSessionCommand({ mode, remote, sessionId, claudeMode, allowedTools, ompConfig, resumeSessionId })
-                    : localFullCmd;
+            const fullCmd = adopt
+                ? buildAdoptSessionCommand(adopt, sessionId)
+                : docker
+                    ? buildDockerLaunchCommand(resolveDockerLaunchOptions(mode, docker, sessionId, resumeSessionId))
+                    : remote
+                        ? buildRemoteSessionCommand({
+                            mode,
+                            remote,
+                            sessionId,
+                            claudeMode,
+                            allowedTools,
+                            ompConfig,
+                            resumeSessionId,
+                        })
+                        : localFullCmd;
             // Create tmux session in three steps to handle cold-start (no server running)
             // and avoid the race where the command exits before remain-on-exit is set:
             // 2. Set remain-on-exit (server now exists, session won't vanish on exit)
@@ -2250,8 +2336,10 @@ export class TmuxManager extends EventEmitter {
             this.applyEnvOverrides(muxName, envOverrides);
             // Replace the shell with the actual command (no echo in terminal). Keep
             // pane launch in /tmp, then cd inside bash against the current mount table.
-            const launchCmd = remote || docker ? fullCmd : `cd ${JSON.stringify(workingDir)} && ${fullCmd}`;
-            execSync(`${this.tmux()} respawn-pane -k -c ${TMUX_LAUNCH_CWD} -t "${muxName}" bash -c ${JSON.stringify(launchCmd)}`, {
+            // ⚠️ An adopted pane is never `cd`'d: it only attaches, and its `workingDir`
+            // is the neutral wrapper folder, not where the foreign pane is.
+            const launchCmd = remote || docker || adopt ? fullCmd : `cd ${JSON.stringify(workingDir)} && ${fullCmd}`;
+            execSync(`${this.tmux()} respawn-pane -k -c ${TMUX_LAUNCH_CWD} -t "${muxName}" bash -c ${bashCArg(launchCmd, !!(remote || docker || adopt))}`, {
                 timeout: EXEC_TIMEOUT_MS,
                 stdio: 'ignore',
             });
@@ -2305,6 +2393,7 @@ export class TmuxManager extends EventEmitter {
                 workingDir,
                 remote,
                 docker,
+                adopt,
                 owner,
                 mode,
                 attached: false,
@@ -2402,13 +2491,20 @@ export class TmuxManager extends EventEmitter {
         const session = this.sessions.get(sessionId);
         if (!session)
             return null;
+        // Adoption metadata comes from the tracked session, not the caller: a respawn
+        // of an adopted wrapper RE-ATTACHES to the same foreign target. It must never
+        // be able to become "launch a fresh agent here" because a caller forgot to
+        // pass the field through.
+        const adopt = options.adopt ?? session.adopt;
         const muxName = session.muxName;
         if (!isValidMuxName(muxName) || !isValidPath(workingDir))
             return null;
         // Resolve CLI binary directory based on mode
         const { pathExport } = this.buildPathExport(mode);
         const envExportsStr = this.buildEnvExports(sessionId, muxName, mode).join(' && ');
-        const { command: statusLineCommand, state: statusLine } = await this._resolveStatusLine(mode, workingDir, !!(remote || docker));
+        const { command: statusLineCommand, state: statusLine } = await this._resolveStatusLine(mode, workingDir, 
+        // An adopted wrapper launches no agent, so nothing can carry the exporter.
+        !!(remote || docker || adopt));
         const idleCompactionOff = await this._resolveIdleCompactionOptOut(mode, statusLine, keepWarm, spawnedByAgent);
         const userStatusLineCommand = statusLineCommand ? await findEffectiveUserStatusLineCommand(workingDir) : undefined;
         const baseCmd = buildSpawnCommand({
@@ -2436,11 +2532,13 @@ export class TmuxManager extends EventEmitter {
         const config = niceConfig || DEFAULT_NICE_CONFIG;
         const cmd = wrapWithNice(baseCmd, config);
         const localFullCmd = `${buildNofileLimitCommand()} && ${pathExport}${envExportsStr} && ${cmd}`;
-        const fullCmd = docker
-            ? buildDockerLaunchCommand(resolveDockerLaunchOptions(mode, docker, sessionId, resumeSessionId))
-            : remote
-                ? buildRemoteSessionCommand({ mode, remote, sessionId, claudeMode, allowedTools, ompConfig, resumeSessionId })
-                : localFullCmd;
+        const fullCmd = adopt
+            ? buildAdoptSessionCommand(adopt, sessionId)
+            : docker
+                ? buildDockerLaunchCommand(resolveDockerLaunchOptions(mode, docker, sessionId, resumeSessionId))
+                : remote
+                    ? buildRemoteSessionCommand({ mode, remote, sessionId, claudeMode, allowedTools, ompConfig, resumeSessionId })
+                    : localFullCmd;
         try {
             // Same per-CLI env setup as createSession, re-applied so the respawned pane inherits it.
             this._configureCliEnv(muxName, sessionId, mode, legacyConfigForMode(mode, options));
@@ -2449,8 +2547,10 @@ export class TmuxManager extends EventEmitter {
             // dropping the ones the caller retired first (see applyEnvOverrides).
             this.applyEnvOverrides(muxName, envOverrides, unsetEnvKeys);
             // -c /tmp + cd bounce — see createSession() for rationale (stale FUSE state).
-            const launchCmd = remote || docker ? fullCmd : `cd ${JSON.stringify(workingDir)} && ${fullCmd}`;
-            await execAsync(`${this.tmux()} respawn-pane -k -c ${TMUX_LAUNCH_CWD} -t "${muxName}" bash -c ${JSON.stringify(launchCmd)}`, {
+            // ⚠️ An adopted pane is never `cd`'d: it only attaches, and its `workingDir`
+            // is the neutral wrapper folder, not where the foreign pane is.
+            const launchCmd = remote || docker || adopt ? fullCmd : `cd ${JSON.stringify(workingDir)} && ${fullCmd}`;
+            await execAsync(`${this.tmux()} respawn-pane -k -c ${TMUX_LAUNCH_CWD} -t "${muxName}" bash -c ${bashCArg(launchCmd, !!(remote || docker || adopt))}`, {
                 timeout: EXEC_TIMEOUT_MS,
             });
             // Wait for the respawned process to start
@@ -2650,6 +2750,56 @@ export class TmuxManager extends EventEmitter {
         // for a non-owned session. The only `kill-session` we run is on OUR LOCAL
         // socket (`this.tmux()` = `tmux -L codeman` on THIS host), which kills the
         // local pane — it does NOT reach the REMOTE socket.
+        // ADOPTION: DETACH-NOT-KILL, by construction rather than by discipline.
+        //
+        // An adopted session's wrapper is an ordinary session on OUR socket whose
+        // pane runs `tmux attach` (or `docker exec …`/`ssh …` then attach) against a
+        // FOREIGN server. Killing the wrapper kills our attach client, which is a
+        // DETACH on the foreign side; the human's session keeps running, and our
+        // grouped view session self-destroys via `destroy-unattached on`.
+        //
+        // The guard below is a formality more than a fence: `this.tmux()` only ever
+        // addresses our own socket, so no code path here CAN reach the foreign
+        // server. It is written out anyway so the intent survives future edits, the
+        // same way the non-owned-remote early return does.
+        if (session.adopt) {
+            console.log(`[TmuxManager] DETACH (adopted): tearing down wrapper only for ${session.muxName}`);
+            // A `docker exec` survives its client, so the in-container view would stay
+            // attached forever and leak. Best-effort, and it can only reach OUR view.
+            // See buildForeignDockerViewKillCommand for why local/remote need nothing.
+            // Fire and forget like the owned docker branch below: a daemon that stopped
+            // answering must not hold the event loop for the whole timeout.
+            if (session.adopt.location === 'docker' && session.adopt.docker) {
+                try {
+                    exec(buildForeignDockerViewKillCommand({
+                        dockerBase: buildDockerBaseArgs(session.adopt.docker).join(' '),
+                        containerName: session.adopt.docker.containerName,
+                        socketPath: session.adopt.socketPath,
+                        viewSession: session.adopt.viewSession || foreignViewSessionName(sessionId),
+                    }), { timeout: EXEC_TIMEOUT_MS }, () => { });
+                }
+                catch {
+                    // Best-effort: the container may be gone, or the view already collected.
+                }
+            }
+            if (isValidMuxName(session.muxName)) {
+                try {
+                    await execAsync(`${this.tmux()} kill-session -t "${session.muxName}" 2>/dev/null`, {
+                        timeout: EXEC_TIMEOUT_MS,
+                    });
+                }
+                catch {
+                    // Wrapper may already be gone.
+                }
+            }
+            this.lastPaneCount.delete(session.muxName);
+            this.clearPaneExit(session.muxName);
+            this.sessions.delete(sessionId);
+            this.clearRemoteReconnectState(sessionId);
+            this.saveSessions();
+            this.emit('sessionKilled', { sessionId });
+            return true;
+        }
         if (session.remote && session.remote.owned === false) {
             console.log(`[TmuxManager] DETACH (non-owned remote): tearing down local pane only for ${session.muxName}`);
             if (isValidMuxName(session.muxName)) {
@@ -3328,8 +3478,51 @@ export class TmuxManager extends EventEmitter {
             catch (err) {
                 console.error('[TmuxManager] Remote reconnect watcher error:', err);
             }
+            void this.detachEndedAdoptedAttaches().catch((err) => {
+                console.error('[TmuxManager] Adopted attach watcher error:', err);
+            });
         }, intervalMs);
     }
+    /**
+     * Let go of a wrapper whose pane died (#510). That pane holds the attach to someone
+     * else's tmux session, so it dies when that session ends, the transport drops or the
+     * view gets detached, and `paneExit` rightly reports none of them. But `remain-on-exit`
+     * keeps Codeman's own tmux client on the dead pane, so the tab kept its pid and `busy`,
+     * input went nowhere and both attach routes refused it.
+     *
+     * Detaching that client is an ordinary PTY exit with status 0: the pid goes null, the tab
+     * stays open, and selecting it starts the wrapper again, which joins the target if it is
+     * back and otherwise prints that it is gone. Only Codeman's own socket is touched.
+     */
+    async detachEndedAdoptedAttaches() {
+        const adopted = new Set();
+        for (const session of this.sessions.values()) {
+            if (session.adopt)
+                adopted.add(session.muxName);
+        }
+        if (adopted.size === 0)
+            return;
+        for (const muxName of endedAdoptedAttaches(await this.readAttachRows(), adopted)) {
+            await this.detachClients(muxName);
+        }
+    }
+    /** Rows for {@link endedAdoptedAttaches}. Empty when tmux did not answer. */
+    async readAttachRows() {
+        if (IS_TEST_MODE)
+            return '';
+        const format = '#{pane_dead} #{session_attached} #{session_name}';
+        const { stdout } = await execAsync(`${this.tmux()} list-panes -a -F '${format}' 2>/dev/null || true`, {
+            encoding: 'utf-8',
+            timeout: EXEC_TIMEOUT_MS,
+        });
+        return stdout;
+    }
+    /** Detach every tmux client from one of Codeman's own sessions. */
+    async detachClients(muxName) {
+        if (IS_TEST_MODE || !isValidMuxName(muxName))
+            return;
+        await execAsync(`${this.tmux()} detach-client -s "${muxName}"`, { timeout: EXEC_TIMEOUT_MS });
+    }
     stopRemoteReconnectWatcher() {
         if (this.remoteReconnectInterval) {
             clearInterval(this.remoteReconnectInterval);
@@ -4099,6 +4292,28 @@ export class TmuxManager extends EventEmitter {
         }
     }
 }
+/**
+ * The `bash -c` argument of a pane launch (`respawn-pane … bash -c <arg>`, run through the
+ * local sh). A remote, docker or adopted command is already quoted for the shell at the far
+ * end and must reach bash verbatim, so it goes in single quotes. Double quotes
+ * (JSON.stringify) let the local sh expand every `$` first: the PATH bootstrap of
+ * `withRemoteTmuxPath` (`$HOME/.local/bin:…:$PATH`) arrived on the remote host as this
+ * host's home and PATH, so a remote user with another home found no tmux and every new
+ * remote pane exited 127. `${SHELL:-/bin/sh}` in the remote launch was the local shell for
+ * the same reason, and an adopted ssh attach carries the same bootstrap, so a tmux in the
+ * remote `~/.local/bin` was found by discovery and then missed by the attach. Single quotes
+ * also keep a real newline, which JSON escaping left as the two characters `\n`.
+ * An adopted attach goes verbatim at all three locations, the local one included: every
+ * value in it is already quoted by `foreign-tmux.ts`, and nothing in it is for this shell.
+ * An agent launched on this host keeps its double-quoted form.
+ *
+ * ⚠️ So nothing in a verbatim launch is expanded on this host any more, the docker client's
+ * own arguments included: a bare `$VAR` in `extraCreateArgs`/`extraExecArgs` reaches docker
+ * as those literal characters.
+ */
+export function bashCArg(launchCmd, verbatim) {
+    return verbatim ? shellescape(launchCmd) : JSON.stringify(launchCmd);
+}
 /**
  * Shell-escape a string for use as a single argument.
  * Wraps in single quotes, escaping any embedded single quotes.