commandmate 0.17.0 → 0.19.0

package/dist/lib/tmux/transcript-squeeze.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transcript-squeeze.d.ts","sourceRoot":"","sources":["../../../src/lib/tmux/transcript-squeeze.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErD;AAED,6CAA6C;AAC7C,MAAM,WAAW,cAAc;IAC7B;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,aAAa,CAwC1F"}

package/dist/lib/tmux/transcript-squeeze.js

@@ -0,0 +1,96 @@
+"use strict";
+/**
+ * Whitespace squeeze for the on-demand reading mode (Issue #1623).
+ *
+ * TUI sessions are pinned to a 200x1000 canvas (`src/config/tmux-pane-config.ts`)
+ * and the agent draws its transcript near the top and its composer at the very
+ * bottom, so a raw `capture-pane` is mostly layout-only blank rows. Measured on a
+ * live `mcbd-claude-*` session: 1000 rows, 480 truly empty, 7 more that LOOK empty
+ * but carry an SGR sequence (`ESC[49m`) and therefore survive a naive
+ * `grep -v '^$'` or `less -s`. Squeezing those runs is what makes `less +G` land
+ * on the composer instead of hundreds of rows below the last readable line.
+ *
+ * ## Relationship to the Web UI normalizer
+ *
+ * `src/lib/terminal/terminal-display-normalizer.ts` (Issue #1172) solves the same
+ * problem for the browser terminal and its rules are the ones reproduced here.
+ * This module exists as a separate entry point rather than importing that one
+ * because the CLI is compiled by `tsconfig.cli.json`, which sets `"paths": {}` —
+ * the normalizer's `@/lib/detection/ansi` import fails there with TS2307 (verified
+ * by adding the import and running `tsc --project tsconfig.cli.json`), while the
+ * relative import below resolves under every build. The two are held byte-identical
+ * by a conformance test over real captures
+ * (`tests/unit/lib/tmux/transcript-squeeze.test.ts`), so neither can drift.
+ *
+ * The transform is DISPLAY-ONLY. Nothing here touches the raw output that status
+ * detection, Auto-Yes, the response saver or the DB record consume — those keep
+ * full fidelity and full line counts.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isVisuallyBlank = isVisuallyBlank;
+exports.squeezeTranscript = squeezeTranscript;
+const ansi_1 = require("../detection/ansi");
+/**
+ * A line is visually blank when nothing printable remains after ANSI removal.
+ *
+ * `.trim()` is deliberate: ECMAScript's WhiteSpace includes U+00A0, which the
+ * Claude composer emits (`ESC[38;5;246m❯ ESC[39m`). That line still holds
+ * `❯`, so it is content either way, but a row of pure NBSP correctly reads blank.
+ */
+function isVisuallyBlank(line) {
+    return (0, ansi_1.stripAnsi)(line).trim() === '';
+}
+/**
+ * Collapse layout-only blank rows in a `capture-pane` frame.
+ *
+ * Rules (identical to `normalizeTerminalOutputForDisplay`, Issue #1172):
+ * 1. Blankness is judged on `stripAnsi(line).trim()`.
+ * 2. Leading and trailing blank runs are removed entirely.
+ * 3. An internal blank run of 1-2 rows is kept verbatim (real paragraph spacing).
+ * 4. An internal blank run of 3+ rows collapses to ONE row carrying that run's
+ *    ANSI sequences in order, so a color/reset that spans the gap still applies
+ *    to the rows below it.
+ * 5. Non-blank lines are never altered — content, order and duplicates survive.
+ *
+ * @param raw - Raw `capture-pane -pe` output
+ * @param options - Tail limit
+ * @returns The squeezed text plus before/after line counts
+ */
+function squeezeTranscript(raw, options = {}) {
+    const lines = raw === '' ? [] : raw.split('\n');
+    const result = [];
+    let seenContent = false;
+    let i = 0;
+    while (i < lines.length) {
+        if (!isVisuallyBlank(lines[i])) {
+            result.push(lines[i]);
+            seenContent = true;
+            i++;
+            continue;
+        }
+        let j = i;
+        while (j < lines.length && isVisuallyBlank(lines[j]))
+            j++;
+        const isLeading = !seenContent;
+        const isTrailing = j >= lines.length;
+        if (!isLeading && !isTrailing) {
+            if (j - i <= 2) {
+                for (let k = i; k < j; k++)
+                    result.push(lines[k]);
+            }
+            else {
+                result.push((0, ansi_1.extractAnsiSequences)(lines.slice(i, j).join('')));
+            }
+        }
+        i = j;
+    }
+    const tail = options.tail;
+    const tailed = tail !== undefined && tail > 0 && result.length > tail;
+    const kept = tailed ? result.slice(result.length - tail) : result;
+    return {
+        text: kept.join('\n'),
+        rawLines: lines.length,
+        lines: kept.length,
+        tailed,
+    };
+}

package/dist/server/server.js

@@ -319,6 +319,24 @@ app.prepare().then(() => {
         console.log(`> WebSocket server ready`);
         // Initialize worktrees after server starts
         await initializeWorktrees();
+        // Issue #1623: reconcile the `prefix+g` reading-mode binding on the user's
+        // tmux server. Fail-open in its own try/catch — a convenience key must never
+        // be able to stop the server from serving.
+        //
+        // Dynamic import, NOT a top-level static import, for the same reason as the
+        // reconcilers above: adding a module graph to server.ts's eval-time graph
+        // perturbs Next's AsyncLocalStorage bootstrap under `tsx server.ts`, and the
+        // first request that compiles middleware then dies. Do not hoist this.
+        try {
+            const { initReadMode } = await Promise.resolve().then(() => __importStar(require('./src/lib/tmux/read-mode')));
+            const readMode = await initReadMode();
+            if (readMode.installed) {
+                console.log(`Reading mode ready: press prefix+${readMode.key} in an attached CommandMate session`);
+            }
+        }
+        catch (error) {
+            console.error('Error initializing tmux reading mode:', error);
+        }
         // [S3-010] Initialize schedule manager AFTER worktrees are ready
         (0, schedule_manager_1.initScheduleManager)();
         // Issue #534: Initialize timer manager AFTER schedule manager

package/dist/server/src/config/tmux-pane-config.js

@@ -17,8 +17,40 @@
  * so `capture-pane` cost / render load stays reasonable.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TUI_PANE_WIDTH = exports.TUI_PANE_HEIGHT = void 0;
+exports.TMUX_HISTORY_LIMIT = exports.TUI_PANE_WIDTH = exports.TUI_PANE_HEIGHT = void 0;
 /** Fixed pane height (rows) for TUI sessions. Large enough to retain useful history. */
 exports.TUI_PANE_HEIGHT = 1000;
 /** Fixed pane width (columns) for TUI sessions. Matches the historical default. */
 exports.TUI_PANE_WIDTH = 200;
+/**
+ * Scrollback lines retained per pane (`history-limit`), Issue #1624.
+ *
+ * Only NON-alternate-screen tools (codex / gemini / vibe-local / antigravity)
+ * consume this: the alternate-screen tools in `ALTERNATE_SCREEN_CLI_TOOLS`
+ * (claude / opencode / copilot) keep `history_size` at 0, so scrollback depth is
+ * irrelevant to them. See `usesAlternateScreen` in lib/cli-tools/types.ts.
+ *
+ * WHY 20000 and not the 50000 this used to request — measured on tmux 3.5a with
+ * a 200-column pane full of realistic, heavily-SGR-coloured agent output
+ * (274 bytes/line as re-emitted by `capture-pane -e`):
+ *
+ * 1. `capturePane` runs tmux under `execFile` with `maxBuffer: 10 MB`. A full
+ *    50000-line capture extrapolates to ~13 MB of escape-laden text, which
+ *    OVERFLOWS that buffer and makes `capturePane` THROW rather than return a
+ *    truncated string — i.e. the deepest part of a 50000-line buffer was never
+ *    readable by this app in the first place. 20000 lines is ~5.2 MB, leaving
+ *    roughly 2x headroom.
+ * 2. Nothing in the app reads deeper than 10000 lines by default (`capturePane`'s
+ *    options-path default is `-S -10000`; every other call site asks for 1000 or
+ *    fewer). 20000 keeps a 2x margin over the deepest default read.
+ * 3. Memory is charged per line ACTUALLY emitted, not preallocated from the
+ *    limit: a fresh session cost ~0.3 MB of tmux-server RSS, growing to ~34 MB
+ *    only after 45000 lines had scrolled (~0.68 KB/line). At 20000 a saturated
+ *    pane costs ~14 MB, so 20 concurrent sessions cap out near 270 MB instead of
+ *    the ~680 MB implied by 50000.
+ *
+ * This is still a 10x increase over tmux's built-in 2000, which is what sessions
+ * were actually getting before #1624 (a `mcbd-codex-*` session was observed at
+ * 1977/2000 lines used, i.e. actively losing transcript).
+ */
+exports.TMUX_HISTORY_LIMIT = 20000;

package/dist/server/src/lib/cli-tools/antigravity.js

@@ -119,10 +119,11 @@ class AntigravityTool extends base_1.BaseCLITool {
         try {
             // Create tmux session with large history buffer for agy output
             // (agy is inline-rendered and retains scrollback, like Codex)
+            // Scrollback depth comes from the shared TMUX_HISTORY_LIMIT default
+            // (Issue #1624) — do not re-hardcode it here.
             await (0, tmux_1.createSession)({
                 sessionName,
                 workingDirectory: worktreePath,
-                historyLimit: 50000,
             });
             // Wait a moment for the session to be created
             await new Promise((resolve) => setTimeout(resolve, cli_tool_timing_config_1.TUI_SESSION_CREATE_WAIT_MS));

package/dist/server/src/lib/cli-tools/codex.js

@@ -67,11 +67,12 @@ class CodexTool extends base_1.BaseCLITool {
             return;
         }
         try {
-            // Create tmux session with large history buffer for Codex output
+            // Create tmux session. Codex is inline-rendered, so its transcript lives in
+            // the pane scrollback — depth comes from the shared TMUX_HISTORY_LIMIT
+            // default (Issue #1624), do not re-hardcode it here.
             await (0, tmux_1.createSession)({
                 sessionName,
                 workingDirectory: worktreePath,
-                historyLimit: 50000,
             });
             // Wait a moment for the session to be created
             await new Promise((resolve) => setTimeout(resolve, cli_tool_timing_config_1.TUI_SESSION_CREATE_WAIT_MS));

package/dist/server/src/lib/cli-tools/copilot.js

@@ -113,11 +113,11 @@ class CopilotTool extends base_1.BaseCLITool {
             return;
         }
         try {
-            // Create tmux session with large history buffer
+            // Create tmux session. Scrollback depth comes from the shared
+            // TMUX_HISTORY_LIMIT default (Issue #1624) — do not re-hardcode it here.
             await (0, tmux_1.createSession)({
                 sessionName,
                 workingDirectory: worktreePath,
-                historyLimit: 50000,
             });
             // Wait a moment for the session to be created
             await new Promise((resolve) => setTimeout(resolve, cli_tool_timing_config_1.TUI_SESSION_CREATE_WAIT_MS));

package/dist/server/src/lib/cli-tools/gemini.js

@@ -74,11 +74,11 @@ class GeminiTool extends base_1.BaseCLITool {
             return;
         }
         try {
-            // Create tmux session with large history buffer
+            // Create tmux session. Scrollback depth comes from the shared
+            // TMUX_HISTORY_LIMIT default (Issue #1624) — do not re-hardcode it here.
             await (0, tmux_1.createSession)({
                 sessionName,
                 workingDirectory: worktreePath,
-                historyLimit: 50000,
             });
             // Wait a moment for the session to be created
             await new Promise((resolve) => setTimeout(resolve, cli_tool_timing_config_1.TUI_SESSION_CREATE_WAIT_MS));

package/dist/server/src/lib/cli-tools/opencode.js

@@ -89,11 +89,11 @@ class OpenCodeTool extends base_1.BaseCLITool {
         try {
             // Generate opencode.json if not present (non-fatal on failure)
             await (0, opencode_config_1.ensureOpencodeConfig)(worktreePath);
-            // Create tmux session with large history buffer
+            // Create tmux session. Scrollback depth comes from the shared
+            // TMUX_HISTORY_LIMIT default (Issue #1624) — do not re-hardcode it here.
             await (0, tmux_1.createSession)({
                 sessionName,
                 workingDirectory: worktreePath,
-                historyLimit: 50000,
             });
             // Wait a moment for the session to be created
             await new Promise((resolve) => setTimeout(resolve, cli_tool_timing_config_1.TUI_SESSION_CREATE_WAIT_MS));

package/dist/server/src/lib/cli-tools/vibe-local.js

@@ -66,11 +66,11 @@ class VibeLocalTool extends base_1.BaseCLITool {
             return;
         }
         try {
-            // Create tmux session with large history buffer
+            // Create tmux session. Scrollback depth comes from the shared
+            // TMUX_HISTORY_LIMIT default (Issue #1624) — do not re-hardcode it here.
             await (0, tmux_1.createSession)({
                 sessionName,
                 workingDirectory: worktreePath,
-                historyLimit: 50000,
             });
             // Wait a moment for the session to be created
             await new Promise((resolve) => setTimeout(resolve, cli_tool_timing_config_1.TUI_SESSION_CREATE_WAIT_MS));

package/dist/server/src/lib/db/agent-instances-db.js

@@ -15,6 +15,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.InvalidAgentInstanceError = exports.AgentInstanceLimitError = void 0;
 exports.getAgentInstances = getAgentInstances;
 exports.getAgentInstance = getAgentInstance;
+exports.resolveInstanceCliTool = resolveInstanceCliTool;
 exports.countAgentInstances = countAgentInstances;
 exports.setAgentInstances = setAgentInstances;
 exports.addAgentInstance = addAgentInstance;
@@ -103,6 +104,58 @@ function getAgentInstance(db, worktreeId, instanceId) {
   `).get(worktreeId, instanceId);
     return row ? mapAgentInstance(row) : null;
 }
+/**
+ * Resolve which CLI tool backs a targeted agent instance (Issue #1629).
+ *
+ * The CLI tool id is part of the tmux session name, so getting it wrong starts
+ * (or looks for) the wrong agent under a session name that claims otherwise:
+ * `--instance codex` used to start Claude in `mcbd-claude-<wt>-codex`.
+ *
+ * Resolution order:
+ *   1. the roster entry for `instanceId` — the roster is what declares that
+ *      `codex` is a codex instance, so it wins over the worktree default
+ *   2. `requestedCliTool`, for an instance the roster does not know about
+ *      (the ad-hoc `send --instance <new-id>` / `--register` flow)
+ *   3. `instanceId` when it is itself a CLI tool id — that is how the primary
+ *      instance is anchored (Issue #868), and holds without a roster row
+ *   4. no signal (`cliToolId: null`) — the caller falls back to its default
+ *
+ * An explicit `requestedCliTool` that contradicts the roster is reported as a
+ * conflict rather than silently overriding it: the roster is user-maintained
+ * and a mismatch means one of the two is wrong. Callers surface it as an error.
+ *
+ * @param db - Database instance
+ * @param worktreeId - Worktree ID
+ * @param instanceId - Targeted agent instance ID (omitted for the primary instance)
+ * @param requestedCliTool - CLI tool explicitly named by the caller, if any
+ */
+function resolveInstanceCliTool(db, worktreeId, instanceId, requestedCliTool) {
+    if (!instanceId) {
+        return { ok: true, cliToolId: requestedCliTool ?? null };
+    }
+    const registered = getAgentInstance(db, worktreeId, instanceId);
+    if (registered && (0, types_1.isCliToolType)(registered.cliTool)) {
+        if (requestedCliTool && requestedCliTool !== registered.cliTool) {
+            return {
+                ok: false,
+                instanceId,
+                rosterCliTool: registered.cliTool,
+                requestedCliTool,
+            };
+        }
+        return { ok: true, cliToolId: registered.cliTool };
+    }
+    // Not registered: an instance id that names a CLI tool is that tool's primary
+    // instance by definition, which outranks the worktree default but not an
+    // explicit request.
+    if (requestedCliTool) {
+        return { ok: true, cliToolId: requestedCliTool };
+    }
+    if ((0, types_1.isCliToolType)(instanceId)) {
+        return { ok: true, cliToolId: instanceId };
+    }
+    return { ok: true, cliToolId: null };
+}
 /**
  * Count agent instances for a worktree.
  */

package/dist/server/src/lib/db/migrations/index.js

@@ -35,6 +35,7 @@ const v48_skill_operations_audit_index_1 = require("./v48-skill-operations-audit
 const v49_verification_runs_1 = require("./v49-verification-runs");
 const v50_tasks_1 = require("./v50-tasks");
 const v51_task_events_1 = require("./v51-task-events");
+const v52_orphaned_worktree_children_1 = require("./v52-orphaned-worktree-children");
 /**
  * Complete ordered list of all migrations.
  * Used internally by the barrel file (db-migrations.ts); NOT exported from the barrel (DR2-004).
@@ -73,4 +74,5 @@ exports.migrations = [
     ...v49_verification_runs_1.v49_migrations,
     ...v50_tasks_1.v50_migrations,
     ...v51_task_events_1.v51_migrations,
+    ...v52_orphaned_worktree_children_1.v52_migrations,
 ];

package/dist/server/src/lib/db/migrations/runner.js

@@ -17,7 +17,7 @@ const path_1 = __importDefault(require("path"));
  * Current schema version
  * Increment this when adding new migrations
  */
-exports.CURRENT_SCHEMA_VERSION = 51;
+exports.CURRENT_SCHEMA_VERSION = 52;
 /**
  * Get current schema version from database
  */

package/dist/server/src/lib/db/migrations/v52-orphaned-worktree-children.js

@@ -0,0 +1,76 @@
+"use strict";
+/**
+ * Migration v52: delete child rows pointing at a worktree that no longer exists
+ * (Issue #1621, Phase 0).
+ *
+ * `getWorktreeChildTables` used to enumerate child tables from foreign-key
+ * metadata alone, so `tasks` (#1548), `verification_runs` (#1544) and
+ * `skill_operations` (#1428) — each holding a `worktree_id` with no constraint
+ * declared — were invisible to both the rename path and the delete path. No
+ * CASCADE fires without a foreign key, so every worktree deleted since those
+ * tables landed left their rows behind, and every worktree ID rename left them
+ * addressing an ID nothing resolves. The code fix stops new orphans; this
+ * migration removes the ones already written.
+ *
+ * The sweep reuses the shared enumeration rather than naming tables, so the
+ * FK-less tables above and the FK-declared ones are treated identically — an
+ * orphan in a CASCADE table is equally unreachable, it just needed a
+ * `foreign_keys = OFF` window to be created.
+ *
+ * Three deliberate narrowings:
+ *
+ * - Append-only ledgers are excluded (`getDeletableWorktreeChildTables`).
+ *   `skill_operations` holds a `worktree_id` and does have rows referencing
+ *   worktrees that are gone, but it declares `BEFORE DELETE ... RAISE(ABORT)`
+ *   (#1234) and is read across every worktree by the audit feed. Deleting from
+ *   it aborts the statement, which here would roll back the migration and take
+ *   startup with it (measured). Its rows are history, not orphans.
+ * - `worktree_id IS NULL` rows are left alone. Every current child table
+ *   declares the column NOT NULL, so this cannot fire today; if a future table
+ *   makes it nullable, a NULL means "not attached", not "attached to something
+ *   gone", and deleting it would be data loss rather than cleanup.
+ * - `verification_gate_results` has no `worktree_id` and is not swept directly.
+ *   It reaches its worktree through `verification_runs(id) ON DELETE CASCADE`,
+ *   so deleting the orphaned runs takes its rows with them (better-sqlite3
+ *   enables `foreign_keys` by default, and db-instance.ts sets it explicitly).
+ *   `task_events` is *not* in the same position: v51 declares no foreign key to
+ *   `tasks` on purpose, because history that vanishes with its subject cannot
+ *   be audited afterwards. That is a design choice, not an orphan, so it stays.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.v52_migrations = void 0;
+const worktree_child_tables_1 = require("./worktree-child-tables");
+exports.v52_migrations = [
+    {
+        version: 52,
+        name: 'delete-orphaned-worktree-children',
+        up: (db) => {
+            let deleted = 0;
+            for (const { table, column } of (0, worktree_child_tables_1.getDeletableWorktreeChildTables)(db)) {
+                // Identifiers come from sqlite_master / PRAGMA, never from user input.
+                // The alias is `cm_parent` rather than something short like `w` so it
+                // cannot collide with a child table that happens to be named the same.
+                const result = db
+                    .prepare(`DELETE FROM "${table}"
+              WHERE "${column}" IS NOT NULL
+                AND NOT EXISTS (
+                  SELECT 1 FROM worktrees AS cm_parent
+                  WHERE cm_parent.id = "${table}"."${column}"
+                )`)
+                    .run();
+                if (result.changes > 0) {
+                    console.log(`Deleted ${result.changes} orphaned row(s) from ${table}.${column}`);
+                    deleted += result.changes;
+                }
+            }
+            if (deleted === 0) {
+                console.log('No orphaned worktree child rows found');
+            }
+        },
+        down: () => {
+            // Deleted rows cannot be resurrected. Defined anyway so rollback tooling
+            // (and the tests that rebuild a v51 database) keep working.
+            console.log('No rollback for orphaned child row cleanup (rows are gone)');
+        },
+    },
+];

package/dist/server/src/lib/db/migrations/worktree-child-tables.js

@@ -0,0 +1,119 @@
+"use strict";
+/**
+ * Live-schema introspection for "which tables reference a worktree".
+ *
+ * Lives under `migrations/` rather than next to `worktree-db.ts` because the
+ * dependency has to point this way: migration v52 sweeps orphans with the same
+ * enumeration the runtime uses, and a migration that imports `worktree-db.ts`
+ * inherits every mock of it — `vi.mock('@/lib/db/worktree-db')` in an unrelated
+ * suite made `runMigrations` throw `No "getDeletableWorktreeChildTables" export
+ * is defined` (measured across 5 tests). Schema introspection is the more
+ * foundational of the two, so it is what the other side imports.
+ *
+ * Issue #1621.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getWorktreeChildTables = getWorktreeChildTables;
+exports.getWriteGuardedTables = getWriteGuardedTables;
+exports.getDeletableWorktreeChildTables = getDeletableWorktreeChildTables;
+/** Conventional name of the column holding a worktree reference. */
+const WORKTREE_REFERENCE_COLUMN = 'worktree_id';
+/**
+ * Discover every table that references a worktree, along with the referencing
+ * column. Derived dynamically from the live schema so it never drifts out of
+ * sync with future migrations that add child tables.
+ *
+ * Two sources are unioned:
+ *
+ * 1. a `worktree_id` column, **whether or not** the table declares a foreign key
+ * 2. a declared foreign key to `worktrees(id)`, whatever the column is named
+ *
+ * Source 1 is what Issue #1621 adds. FK metadata alone (all this did before)
+ * silently skipped `tasks` (#1548), `verification_runs` (#1544) and
+ * `skill_operations` (#1428): all three carry a `worktree_id` but declare no
+ * constraint, so a rename left them pointing at an ID that no longer exists and
+ * a delete left them behind as orphans — no CASCADE fires without a FK.
+ *
+ * Source 2 is kept so a future table whose FK column is *not* named
+ * `worktree_id` keeps being followed; dropping it would be a regression for
+ * every table #1151 already handled.
+ *
+ * Issue #1151, #1621.
+ */
+function getWorktreeChildTables(db) {
+    const tables = db
+        .prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%'")
+        .all();
+    const children = [];
+    const seen = new Set();
+    const add = (table, column) => {
+        // JSON encoding keeps the pair unambiguous whatever the identifiers contain.
+        const key = JSON.stringify([table, column]);
+        if (seen.has(key))
+            return;
+        seen.add(key);
+        children.push({ table, column });
+    };
+    for (const { name: tableName } of tables) {
+        if (tableName === 'worktrees')
+            continue;
+        // PRAGMA identifiers cannot be bound; `tableName` comes from sqlite_master,
+        // not user input, so string interpolation here is safe.
+        const columns = db.prepare(`PRAGMA table_info("${tableName}")`).all();
+        if (columns.some((column) => column.name === WORKTREE_REFERENCE_COLUMN)) {
+            add(tableName, WORKTREE_REFERENCE_COLUMN);
+        }
+        const fks = db.prepare(`PRAGMA foreign_key_list("${tableName}")`).all();
+        for (const fk of fks) {
+            if (fk.table === 'worktrees' && (fk.to === 'id' || fk.to === null)) {
+                add(tableName, fk.from);
+            }
+        }
+    }
+    return children;
+}
+/**
+ * Tables the schema itself refuses to let us rewrite, per statement kind.
+ *
+ * An append-only ledger enforces itself with a `BEFORE UPDATE` / `BEFORE DELETE`
+ * trigger that calls `RAISE(ABORT, ...)`; `skill_operations` declares both
+ * (#1234, migrations v44/v48). Such a table carries a `worktree_id` yet is
+ * deliberately *not* owned by its worktree's lifetime: `querySkillOperationAudit`
+ * reads it across every worktree for the dashboard feed, exactly like v51 keeps
+ * `task_events` alive after its task is gone. Sweeping it is not cleanup, it is
+ * destroying audit history — and it does not even fail safely: the trigger
+ * aborts the statement, which rolls back the whole enclosing transaction, so a
+ * blind sweep breaks worktree deletion outright (measured: `deleteWorktreesByIds`
+ * threw `skill_operations is append-only` and the worktree row survived; the
+ * same sweep inside migration v52 fails startup).
+ *
+ * Detected from trigger SQL rather than by table name so a future ledger is
+ * protected the moment it declares its guard (Issue #1621).
+ */
+function getWriteGuardedTables(db) {
+    const triggers = db
+        .prepare("SELECT tbl_name, sql FROM sqlite_master WHERE type = 'trigger'")
+        .all();
+    const noUpdate = new Set();
+    const noDelete = new Set();
+    for (const trigger of triggers) {
+        if (!trigger.sql)
+            continue;
+        if (!/\bRAISE\s*\(\s*ABORT/i.test(trigger.sql))
+            continue;
+        if (/\bBEFORE\s+UPDATE\b/i.test(trigger.sql))
+            noUpdate.add(trigger.tbl_name);
+        if (/\bBEFORE\s+DELETE\b/i.test(trigger.sql))
+            noDelete.add(trigger.tbl_name);
+    }
+    return { noUpdate, noDelete };
+}
+/**
+ * Child tables whose rows a worktree actually owns — everything
+ * getWorktreeChildTables reports, minus the append-only ledgers that outlive it.
+ * This is the set a delete or an orphan sweep may touch (Issue #1621).
+ */
+function getDeletableWorktreeChildTables(db) {
+    const { noDelete } = getWriteGuardedTables(db);
+    return getWorktreeChildTables(db).filter(({ table }) => !noDelete.has(table));
+}

package/dist/server/src/lib/db/tasks-db.js

@@ -13,13 +13,14 @@
  * failure `verification-db.ts` guards against.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ACTIVE_TASK_STATUSES = exports.TERMINAL_TASK_STATUSES = exports.TASK_STATUSES = void 0;
+exports.VERIFIABLE_TASK_STATUSES = exports.ACTIVE_TASK_STATUSES = exports.TERMINAL_TASK_STATUSES = exports.TASK_STATUSES = void 0;
 exports.isTerminalTaskStatus = isTerminalTaskStatus;
 exports.createTask = createTask;
 exports.getTask = getTask;
 exports.listTasks = listTasks;
 exports.updateTaskStatus = updateTaskStatus;
 exports.getActiveTask = getActiveTask;
+exports.getVerifiableTask = getVerifiableTask;
 exports.getActiveTaskForInstance = getActiveTaskForInstance;
 const crypto_1 = require("crypto");
 /**
@@ -61,6 +62,27 @@ exports.ACTIVE_TASK_STATUSES = [
     'waiting_input',
     'verifying',
 ];
+/**
+ * Statuses a verification run that has to *discover* its task may attach to.
+ *
+ * The active three plus the two the state machine explicitly reopens:
+ * `transitionTask` accepts `verify_started` from `failed` and `not_started`
+ * because a task can fail on one run and pass on the retry. Resolving only the
+ * active three meant that reopening was reachable only by a caller that already
+ * knew the task id — so the retry every agent performs after a red gate found
+ * no contract, and with it no scope to judge (#1620).
+ *
+ * `succeeded` and `cancelled` stay out: those are closed for good, and a run
+ * that silently adopted one would be judging work against a verdict already
+ * given. {@link ACTIVE_TASK_STATUSES} keeps its narrower meaning for the
+ * callers that ask "what is this agent working on right now" (Auto-Yes, prompt
+ * events), where a finished task must not answer.
+ */
+exports.VERIFIABLE_TASK_STATUSES = [
+    ...exports.ACTIVE_TASK_STATUSES,
+    'failed',
+    'not_started',
+];
 function isTerminalTaskStatus(status) {
     return exports.TERMINAL_TASK_STATUSES.includes(status);
 }
@@ -185,6 +207,29 @@ function getActiveTask(db, worktreeId, cliToolId, instanceId) {
         .get(...params, ...exports.ACTIVE_TASK_STATUSES);
     return row ? mapTaskRow(row) : null;
 }
+/**
+ * The task a verification run should attach to when the caller cannot name one.
+ *
+ * Worktree-scoped for the same reason {@link getActiveTask} is: the gates run
+ * over the whole working tree, so there is nothing finer to narrow by. Ordered
+ * like {@link getActiveTask} — most recently updated first, insertion order
+ * breaking a same-millisecond tie — so the answer is the last task to have
+ * moved, not whichever row SQLite happened to reach first.
+ *
+ * @see VERIFIABLE_TASK_STATUSES for why this is wider than "active"
+ */
+function getVerifiableTask(db, worktreeId) {
+    const placeholders = exports.VERIFIABLE_TASK_STATUSES.map(() => '?').join(', ');
+    const row = db
+        .prepare(`
+      SELECT ${TASK_COLUMNS} FROM tasks
+      WHERE worktree_id = ? AND status IN (${placeholders})
+      ORDER BY updated_at DESC, created_at DESC, rowid DESC
+      LIMIT 1
+    `)
+        .get(worktreeId, ...exports.VERIFIABLE_TASK_STATUSES);
+    return row ? mapTaskRow(row) : null;
+}
 /**
  * The active task governing one agent instance, or null.
  *