commandmate 0.18.0 → 0.20.0

package/dist/lib/tmux/transcript-squeeze.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Whitespace squeeze for the on-demand reading mode (Issue #1623).
+ *
+ * TUI sessions are pinned to a 200x1000 canvas (`src/config/tmux-pane-config.ts`)
+ * and the agent draws its transcript near the top and its composer at the very
+ * bottom, so a raw `capture-pane` is mostly layout-only blank rows. Measured on a
+ * live `mcbd-claude-*` session: 1000 rows, 480 truly empty, 7 more that LOOK empty
+ * but carry an SGR sequence (`ESC[49m`) and therefore survive a naive
+ * `grep -v '^$'` or `less -s`. Squeezing those runs is what makes `less +G` land
+ * on the composer instead of hundreds of rows below the last readable line.
+ *
+ * ## Relationship to the Web UI normalizer
+ *
+ * `src/lib/terminal/terminal-display-normalizer.ts` (Issue #1172) solves the same
+ * problem for the browser terminal and its rules are the ones reproduced here.
+ * This module exists as a separate entry point rather than importing that one
+ * because the CLI is compiled by `tsconfig.cli.json`, which sets `"paths": {}` —
+ * the normalizer's `@/lib/detection/ansi` import fails there with TS2307 (verified
+ * by adding the import and running `tsc --project tsconfig.cli.json`), while the
+ * relative import below resolves under every build. The two are held byte-identical
+ * by a conformance test over real captures
+ * (`tests/unit/lib/tmux/transcript-squeeze.test.ts`), so neither can drift.
+ *
+ * The transform is DISPLAY-ONLY. Nothing here touches the raw output that status
+ * detection, Auto-Yes, the response saver or the DB record consume — those keep
+ * full fidelity and full line counts.
+ */
+/**
+ * A line is visually blank when nothing printable remains after ANSI removal.
+ *
+ * `.trim()` is deliberate: ECMAScript's WhiteSpace includes U+00A0, which the
+ * Claude composer emits (`ESC[38;5;246m❯ ESC[39m`). That line still holds
+ * `❯`, so it is content either way, but a row of pure NBSP correctly reads blank.
+ */
+export declare function isVisuallyBlank(line: string): boolean;
+/** Options for {@link squeezeTranscript}. */
+export interface SqueezeOptions {
+    /**
+     * Keep only the last N lines OF THE SQUEEZED RESULT (Issue #1623 decision D5).
+     *
+     * Tailing after the squeeze rather than before it is what makes the number
+     * meaningful: `--tail 40` on a 1000-row canvas whose transcript ends at row 254
+     * would otherwise return 40 rows of blank padding. Undefined or <= 0 keeps
+     * everything.
+     */
+    tail?: number;
+}
+/** Outcome of a squeeze, including the counts callers report in `--json`. */
+export interface SqueezeResult {
+    /** Squeezed transcript, no trailing newline. */
+    text: string;
+    /** Line count of the input, before squeezing. */
+    rawLines: number;
+    /** Line count of {@link text}. */
+    lines: number;
+    /** True when {@link SqueezeOptions.tail} actually dropped leading lines. */
+    tailed: boolean;
+}
+/**
+ * Collapse layout-only blank rows in a `capture-pane` frame.
+ *
+ * Rules (identical to `normalizeTerminalOutputForDisplay`, Issue #1172):
+ * 1. Blankness is judged on `stripAnsi(line).trim()`.
+ * 2. Leading and trailing blank runs are removed entirely.
+ * 3. An internal blank run of 1-2 rows is kept verbatim (real paragraph spacing).
+ * 4. An internal blank run of 3+ rows collapses to ONE row carrying that run's
+ *    ANSI sequences in order, so a color/reset that spans the gap still applies
+ *    to the rows below it.
+ * 5. Non-blank lines are never altered — content, order and duplicates survive.
+ *
+ * @param raw - Raw `capture-pane -pe` output
+ * @param options - Tail limit
+ * @returns The squeezed text plus before/after line counts
+ */
+export declare function squeezeTranscript(raw: string, options?: SqueezeOptions): SqueezeResult;
+//# sourceMappingURL=transcript-squeeze.d.ts.map

package/dist/lib/tmux/transcript-squeeze.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transcript-squeeze.d.ts","sourceRoot":"","sources":["../../../src/lib/tmux/transcript-squeeze.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErD;AAED,6CAA6C;AAC7C,MAAM,WAAW,cAAc;IAC7B;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,aAAa,CAwC1F"}

package/dist/lib/tmux/transcript-squeeze.js

@@ -0,0 +1,96 @@
+"use strict";
+/**
+ * Whitespace squeeze for the on-demand reading mode (Issue #1623).
+ *
+ * TUI sessions are pinned to a 200x1000 canvas (`src/config/tmux-pane-config.ts`)
+ * and the agent draws its transcript near the top and its composer at the very
+ * bottom, so a raw `capture-pane` is mostly layout-only blank rows. Measured on a
+ * live `mcbd-claude-*` session: 1000 rows, 480 truly empty, 7 more that LOOK empty
+ * but carry an SGR sequence (`ESC[49m`) and therefore survive a naive
+ * `grep -v '^$'` or `less -s`. Squeezing those runs is what makes `less +G` land
+ * on the composer instead of hundreds of rows below the last readable line.
+ *
+ * ## Relationship to the Web UI normalizer
+ *
+ * `src/lib/terminal/terminal-display-normalizer.ts` (Issue #1172) solves the same
+ * problem for the browser terminal and its rules are the ones reproduced here.
+ * This module exists as a separate entry point rather than importing that one
+ * because the CLI is compiled by `tsconfig.cli.json`, which sets `"paths": {}` —
+ * the normalizer's `@/lib/detection/ansi` import fails there with TS2307 (verified
+ * by adding the import and running `tsc --project tsconfig.cli.json`), while the
+ * relative import below resolves under every build. The two are held byte-identical
+ * by a conformance test over real captures
+ * (`tests/unit/lib/tmux/transcript-squeeze.test.ts`), so neither can drift.
+ *
+ * The transform is DISPLAY-ONLY. Nothing here touches the raw output that status
+ * detection, Auto-Yes, the response saver or the DB record consume — those keep
+ * full fidelity and full line counts.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isVisuallyBlank = isVisuallyBlank;
+exports.squeezeTranscript = squeezeTranscript;
+const ansi_1 = require("../detection/ansi");
+/**
+ * A line is visually blank when nothing printable remains after ANSI removal.
+ *
+ * `.trim()` is deliberate: ECMAScript's WhiteSpace includes U+00A0, which the
+ * Claude composer emits (`ESC[38;5;246m❯ ESC[39m`). That line still holds
+ * `❯`, so it is content either way, but a row of pure NBSP correctly reads blank.
+ */
+function isVisuallyBlank(line) {
+    return (0, ansi_1.stripAnsi)(line).trim() === '';
+}
+/**
+ * Collapse layout-only blank rows in a `capture-pane` frame.
+ *
+ * Rules (identical to `normalizeTerminalOutputForDisplay`, Issue #1172):
+ * 1. Blankness is judged on `stripAnsi(line).trim()`.
+ * 2. Leading and trailing blank runs are removed entirely.
+ * 3. An internal blank run of 1-2 rows is kept verbatim (real paragraph spacing).
+ * 4. An internal blank run of 3+ rows collapses to ONE row carrying that run's
+ *    ANSI sequences in order, so a color/reset that spans the gap still applies
+ *    to the rows below it.
+ * 5. Non-blank lines are never altered — content, order and duplicates survive.
+ *
+ * @param raw - Raw `capture-pane -pe` output
+ * @param options - Tail limit
+ * @returns The squeezed text plus before/after line counts
+ */
+function squeezeTranscript(raw, options = {}) {
+    const lines = raw === '' ? [] : raw.split('\n');
+    const result = [];
+    let seenContent = false;
+    let i = 0;
+    while (i < lines.length) {
+        if (!isVisuallyBlank(lines[i])) {
+            result.push(lines[i]);
+            seenContent = true;
+            i++;
+            continue;
+        }
+        let j = i;
+        while (j < lines.length && isVisuallyBlank(lines[j]))
+            j++;
+        const isLeading = !seenContent;
+        const isTrailing = j >= lines.length;
+        if (!isLeading && !isTrailing) {
+            if (j - i <= 2) {
+                for (let k = i; k < j; k++)
+                    result.push(lines[k]);
+            }
+            else {
+                result.push((0, ansi_1.extractAnsiSequences)(lines.slice(i, j).join('')));
+            }
+        }
+        i = j;
+    }
+    const tail = options.tail;
+    const tailed = tail !== undefined && tail > 0 && result.length > tail;
+    const kept = tailed ? result.slice(result.length - tail) : result;
+    return {
+        text: kept.join('\n'),
+        rawLines: lines.length,
+        lines: kept.length,
+        tailed,
+    };
+}

package/dist/server/server.js

@@ -78,7 +78,11 @@ const resource_cleanup_1 = require("./src/lib/resource-cleanup");
 const db_migrations_1 = require("./src/lib/db/db-migrations");
 const env_1 = require("./src/lib/env");
 const db_repository_1 = require("./src/lib/db/db-repository");
-const db_1 = require("./src/lib/db");
+// Issue #1666: `resolveRepositoryPath`, `getWorktreeIdsByRepository`,
+// `deleteWorktreesByIds`, `cleanupMultipleWorktrees` and `killWorktreeSession`
+// went with the startup purge — they had no other caller here. `npm run lint`
+// only covers `src/`, and tsconfig sets no `noUnusedLocals`, so nothing in the
+// gates would have flagged them: they were removed by inspection, not by a tool.
 const session_cleanup_1 = require("./src/lib/session-cleanup");
 const dev = process.env.NODE_ENV !== 'production';
 const hostname = (0, env_1.getEnvByKey)('CM_BIND') || '127.0.0.1';
@@ -116,6 +120,32 @@ function validateCertPath(filePath, label) {
 // Create Next.js app
 const app = (0, next_1.default)({ dev, hostname, port });
 const handle = app.getRequestHandler();
+let worktreeRedirectModule = null;
+let worktreeRedirectLoad = null;
+async function resolveWorktreeAliasRedirect(url) {
+    if (!worktreeRedirectModule) {
+        if (!worktreeRedirectLoad) {
+            worktreeRedirectLoad = Promise.resolve().then(() => __importStar(require('./src/lib/git/worktree-redirect'))).then((mod) => {
+                worktreeRedirectModule = mod;
+            })
+                .catch((error) => {
+                // Fail open: without the resolver the layout's meta refresh still
+                // lands the user on the right worktree.
+                console.error('Failed to load worktree redirect resolver:', error);
+            });
+        }
+        await worktreeRedirectLoad;
+    }
+    if (!worktreeRedirectModule)
+        return null;
+    try {
+        return worktreeRedirectModule.resolveWorktreeRedirect(url);
+    }
+    catch (error) {
+        console.error('Worktree redirect resolution failed:', error);
+        return null;
+    }
+}
 // Issue #331: Prevent Next.js (NextCustomServer) from registering its own upgrade
 // event listener on the HTTP server.
 //
@@ -160,6 +190,21 @@ app.prepare().then(() => {
         }
         const method = req.method ?? 'UNKNOWN';
         const url = req.url ?? '/';
+        // Issue #1621/#1645: a URL naming a worktree by a retired ID gets a real
+        // 308 here, before Next renders anything. The cheap prefix test keeps every
+        // other route free of the dynamic import and the alias lookup.
+        if (url.startsWith('/worktrees/')) {
+            const redirect = await resolveWorktreeAliasRedirect(url);
+            if (redirect && !res.headersSent) {
+                res.statusCode = redirect.statusCode;
+                res.setHeader('Location', redirect.location);
+                // See WORKTREE_REDIRECT_CACHE_CONTROL: alias -> live is durable, not
+                // eternal, and a cached permanent redirect could never be corrected.
+                res.setHeader('Cache-Control', 'no-store');
+                res.end();
+                return;
+            }
+        }
         try {
             const parsedUrl = (0, url_1.parse)(url, true);
             await handle(req, res, parsedUrl);
@@ -226,6 +271,42 @@ app.prepare().then(() => {
             catch (error) {
                 console.error('Error reconciling Skill operations:', error);
             }
+            // Issue #1621 Phase 3/4: make live tmux sessions follow the worktree IDs
+            // that migration v54 has just renumbered. Session names are DERIVED from
+            // the ID (`mcbd-{cli}-{worktreeId}`), so a running agent would otherwise
+            // keep its process while disappearing from the UI — and the app would
+            // happily start a second agent in the same directory. `worktree_aliases`
+            // is the durable record of every ID that has moved, which makes this pass
+            // idempotent: when nothing is stale it costs one `tmux list-sessions`.
+            //
+            // Fail-open in its own try/catch — reconciling sessions must never be
+            // able to stop the server from serving. Dynamic import for the same
+            // reason as the reconcilers around it: a static import here perturbs
+            // Next's AsyncLocalStorage bootstrap under `tsx server.ts` and the first
+            // request that compiles middleware dies. Do not hoist this.
+            try {
+                const { reconcileWorktreeSessionsFromAliases } = await Promise.resolve().then(() => __importStar(require('./src/lib/session/worktree-session-reconcile')));
+                const sessionReport = await reconcileWorktreeSessionsFromAliases(db);
+                if (sessionReport.renamedSessions.length > 0) {
+                    console.log(`Reconciled ${sessionReport.renamedSessions.length} tmux session(s) to renamed worktree IDs ` +
+                        `(predicted=${sessionReport.planSources.predicted} ` +
+                        `discovered=${sessionReport.planSources.discovered})`);
+                }
+                // Issue #1661: a live `mcbd-*` session that no known worktree ID
+                // explains is exactly what the previous report could not express — the
+                // pass ran clean while two agents sat stranded under stale names. Say
+                // it out loud, with the names, so it is actionable from the log alone.
+                if (sessionReport.unaccountedSessions.length > 0) {
+                    console.warn(`${sessionReport.unaccountedSessions.length} tmux session(s) match no known worktree ID ` +
+                        `and were left untouched: ${sessionReport.unaccountedSessions.join(', ')}`);
+                }
+                if (sessionReport.errors.length > 0) {
+                    console.warn(`Session reconcile warnings: ${sessionReport.errors.join(', ')}`);
+                }
+            }
+            catch (error) {
+                console.error('Error reconciling worktree sessions:', error);
+            }
             // Issue #1543: close verification runs that a crash left in `running`.
             // Gate execution lives in process memory, so none of them survived the
             // restart; leaving the rows open would keep their worktrees permanently
@@ -269,19 +350,31 @@ app.prepare().then(() => {
                 excludedPaths.forEach(p => {
                     console.log(`  [excluded] ${p}`);
                 });
-                // Issue #202/#526: Remove worktrees of excluded repositories from DB
-                // SF-002: cleanup -> delete order for excluded repositories
-                // Sessions must be stopped before DB records are removed
-                for (const excludedPath of excludedPaths) {
-                    const resolvedPath = (0, db_repository_1.resolveRepositoryPath)(excludedPath);
-                    const worktreeIds = (0, db_1.getWorktreeIdsByRepository)(db, resolvedPath);
-                    if (worktreeIds.length > 0) {
-                        // Issue #526: Clean up tmux sessions before deleting from DB
-                        await (0, session_cleanup_1.cleanupMultipleWorktrees)(worktreeIds, session_cleanup_1.killWorktreeSession);
-                        const result = (0, db_1.deleteWorktreesByIds)(db, worktreeIds);
-                        console.log(`  Removed ${result.deletedCount} worktree(s) from excluded repository: ${resolvedPath}`);
-                    }
-                }
+                // Issue #1666: exclusion is where startup STOPS, not where it deletes.
+                //
+                // This branch used to purge every excluded repository — kill its tmux
+                // sessions, then `deleteWorktreesByIds`, taking chat history, memos,
+                // todos, timers, schedules, execution logs, tasks and verification runs
+                // with it by cascade. That was #202's "deleted repositories must not
+                // reappear after a restart", and it was harmless for exactly as long as
+                // `DELETE /api/repositories` was the only route to `enabled = 0`: that
+                // route already purged, so the loop re-deleted nothing.
+                //
+                // #1658 added a non-destructive disable (a single
+                // `UPDATE repositories SET enabled = 0`), which made this loop the
+                // thing that undid it — and only for `WORKTREE_REPOS` repositories,
+                // because a DB-only one leaves `allPaths` when disabled and never
+                // reaches `excludedPaths` at all. So the same toggle was destructive or
+                // not depending on where the repository had been configured, and the
+                // damage landed a restart later, far from the click that caused it.
+                //
+                // #202 survives without the deletion: an excluded repository is not
+                // scanned, so nothing re-creates its rows, and keeping rows is not the
+                // same as showing them. Hiding a repository's worktrees from the
+                // sidebar is `visible`'s job (#690) — a separate, reversible flag that
+                // the user sets deliberately — whereas `enabled` only decides what gets
+                // scanned. Deleting rows to achieve "not shown" destroys history to
+                // implement a view filter, and cannot be undone by re-enabling.
             }
             // Scan filtered repositories (excluded repos are skipped)
             const worktrees = await (0, worktrees_1.scanMultipleRepositories)(filteredPaths);
@@ -319,6 +412,24 @@ app.prepare().then(() => {
         console.log(`> WebSocket server ready`);
         // Initialize worktrees after server starts
         await initializeWorktrees();
+        // Issue #1623: reconcile the `prefix+g` reading-mode binding on the user's
+        // tmux server. Fail-open in its own try/catch — a convenience key must never
+        // be able to stop the server from serving.
+        //
+        // Dynamic import, NOT a top-level static import, for the same reason as the
+        // reconcilers above: adding a module graph to server.ts's eval-time graph
+        // perturbs Next's AsyncLocalStorage bootstrap under `tsx server.ts`, and the
+        // first request that compiles middleware then dies. Do not hoist this.
+        try {
+            const { initReadMode } = await Promise.resolve().then(() => __importStar(require('./src/lib/tmux/read-mode')));
+            const readMode = await initReadMode();
+            if (readMode.installed) {
+                console.log(`Reading mode ready: press prefix+${readMode.key} in an attached CommandMate session`);
+            }
+        }
+        catch (error) {
+            console.error('Error initializing tmux reading mode:', error);
+        }
         // [S3-010] Initialize schedule manager AFTER worktrees are ready
         (0, schedule_manager_1.initScheduleManager)();
         // Issue #534: Initialize timer manager AFTER schedule manager

package/dist/server/src/config/tmux-pane-config.js

@@ -17,8 +17,40 @@
  * so `capture-pane` cost / render load stays reasonable.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TUI_PANE_WIDTH = exports.TUI_PANE_HEIGHT = void 0;
+exports.TMUX_HISTORY_LIMIT = exports.TUI_PANE_WIDTH = exports.TUI_PANE_HEIGHT = void 0;
 /** Fixed pane height (rows) for TUI sessions. Large enough to retain useful history. */
 exports.TUI_PANE_HEIGHT = 1000;
 /** Fixed pane width (columns) for TUI sessions. Matches the historical default. */
 exports.TUI_PANE_WIDTH = 200;
+/**
+ * Scrollback lines retained per pane (`history-limit`), Issue #1624.
+ *
+ * Only NON-alternate-screen tools (codex / gemini / vibe-local / antigravity)
+ * consume this: the alternate-screen tools in `ALTERNATE_SCREEN_CLI_TOOLS`
+ * (claude / opencode / copilot) keep `history_size` at 0, so scrollback depth is
+ * irrelevant to them. See `usesAlternateScreen` in lib/cli-tools/types.ts.
+ *
+ * WHY 20000 and not the 50000 this used to request — measured on tmux 3.5a with
+ * a 200-column pane full of realistic, heavily-SGR-coloured agent output
+ * (274 bytes/line as re-emitted by `capture-pane -e`):
+ *
+ * 1. `capturePane` runs tmux under `execFile` with `maxBuffer: 10 MB`. A full
+ *    50000-line capture extrapolates to ~13 MB of escape-laden text, which
+ *    OVERFLOWS that buffer and makes `capturePane` THROW rather than return a
+ *    truncated string — i.e. the deepest part of a 50000-line buffer was never
+ *    readable by this app in the first place. 20000 lines is ~5.2 MB, leaving
+ *    roughly 2x headroom.
+ * 2. Nothing in the app reads deeper than 10000 lines by default (`capturePane`'s
+ *    options-path default is `-S -10000`; every other call site asks for 1000 or
+ *    fewer). 20000 keeps a 2x margin over the deepest default read.
+ * 3. Memory is charged per line ACTUALLY emitted, not preallocated from the
+ *    limit: a fresh session cost ~0.3 MB of tmux-server RSS, growing to ~34 MB
+ *    only after 45000 lines had scrolled (~0.68 KB/line). At 20000 a saturated
+ *    pane costs ~14 MB, so 20 concurrent sessions cap out near 270 MB instead of
+ *    the ~680 MB implied by 50000.
+ *
+ * This is still a 10x increase over tmux's built-in 2000, which is what sessions
+ * were actually getting before #1624 (a `mcbd-codex-*` session was observed at
+ * 1977/2000 lines used, i.e. actively losing transcript).
+ */
+exports.TMUX_HISTORY_LIMIT = 20000;

package/dist/server/src/lib/auto-yes-state.js

@@ -27,6 +27,7 @@ exports.getAutoYesStateCompositeKeys = getAutoYesStateCompositeKeys;
 exports.filterCompositeKeysByWorktree = filterCompositeKeysByWorktree;
 exports.getCompositeKeysByWorktree = getCompositeKeysByWorktree;
 exports.deleteAutoYesStateByWorktree = deleteAutoYesStateByWorktree;
+exports.migrateAutoYesStateWorktreeIds = migrateAutoYesStateWorktreeIds;
 exports.calculateBackoffInterval = calculateBackoffInterval;
 const auto_yes_config_1 = require("../config/auto-yes-config");
 const path_validator_1 = require("./security/path-validator");
@@ -358,6 +359,69 @@ function deleteAutoYesStateByWorktree(worktreeId) {
     keys.forEach(key => autoYesStates.delete(key));
     return keys.length;
 }
+/**
+ * Re-key every auto-yes state whose worktree ID is being renamed
+ * (Issue #1621 Phase 3).
+ *
+ * **Transfer, never invalidate.** Auto-Yes is what keeps an unattended worker
+ * answering prompts; dropping the state at rename time would leave the agent
+ * alive and silently stuck at the next confirmation, hours later, with nothing
+ * in the UI to explain it. The state object itself (enabledAt / expiresAt /
+ * stopPattern) is moved verbatim, so the countdown a user started keeps running
+ * against its original deadline.
+ *
+ * Takes the whole batch rather than one pair because IDs can **swap**: with
+ * A→B and B→A applied one at a time, the first move overwrites the destination's
+ * state before the destination has been read. Every source key is therefore read
+ * and removed first, and only then are the new keys written.
+ *
+ * The poller that consumes these states is a separate map with its own timers,
+ * and its timer callbacks capture the worktree ID — see
+ * `reconcileWorktreeSessions`, which restarts them. Moving the state without
+ * restarting the poller would stop Auto-Yes just as surely as deleting it.
+ *
+ * @param renames - Worktree ID pairs being applied
+ * @returns One entry per state that moved
+ */
+function migrateAutoYesStateWorktreeIds(renames) {
+    const targets = new Map();
+    for (const { oldId, newId } of renames) {
+        if (!oldId || !newId || oldId === newId)
+            continue;
+        targets.set(oldId, newId);
+    }
+    if (targets.size === 0)
+        return [];
+    const moves = [];
+    for (const [key, state] of autoYesStates) {
+        const oldWorktreeId = extractWorktreeId(key);
+        const newWorktreeId = targets.get(oldWorktreeId);
+        if (!newWorktreeId)
+            continue;
+        const cliToolId = extractCliToolId(key);
+        // A key whose second segment is not a known CLI tool cannot be rebuilt
+        // safely; leave it where it is rather than guess (it is unreachable through
+        // buildCompositeKey, so this only fires on hand-written state).
+        if (!cliToolId)
+            continue;
+        const instanceId = extractInstanceId(key) ?? cliToolId;
+        moves.push({
+            oldKey: key,
+            newKey: buildCompositeKey(newWorktreeId, cliToolId, instanceId),
+            oldWorktreeId,
+            newWorktreeId,
+            cliToolId,
+            instanceId,
+            state,
+        });
+    }
+    // Two passes so a swap (A→B, B→A) cannot have one half clobber the other.
+    for (const move of moves)
+        autoYesStates.delete(move.oldKey);
+    for (const move of moves)
+        autoYesStates.set(move.newKey, move.state);
+    return moves.map(({ state: _state, ...rest }) => rest);
+}
 /**
  * Calculate backoff interval based on consecutive errors.
  * Returns the normal polling interval when errors are below the threshold,

package/dist/server/src/lib/cli-tools/antigravity.js

@@ -119,10 +119,11 @@ class AntigravityTool extends base_1.BaseCLITool {
         try {
             // Create tmux session with large history buffer for agy output
             // (agy is inline-rendered and retains scrollback, like Codex)
+            // Scrollback depth comes from the shared TMUX_HISTORY_LIMIT default
+            // (Issue #1624) — do not re-hardcode it here.
             await (0, tmux_1.createSession)({
                 sessionName,
                 workingDirectory: worktreePath,
-                historyLimit: 50000,
             });
             // Wait a moment for the session to be created
             await new Promise((resolve) => setTimeout(resolve, cli_tool_timing_config_1.TUI_SESSION_CREATE_WAIT_MS));

package/dist/server/src/lib/cli-tools/codex.js

@@ -67,11 +67,12 @@ class CodexTool extends base_1.BaseCLITool {
             return;
         }
         try {
-            // Create tmux session with large history buffer for Codex output
+            // Create tmux session. Codex is inline-rendered, so its transcript lives in
+            // the pane scrollback — depth comes from the shared TMUX_HISTORY_LIMIT
+            // default (Issue #1624), do not re-hardcode it here.
             await (0, tmux_1.createSession)({
                 sessionName,
                 workingDirectory: worktreePath,
-                historyLimit: 50000,
             });
             // Wait a moment for the session to be created
             await new Promise((resolve) => setTimeout(resolve, cli_tool_timing_config_1.TUI_SESSION_CREATE_WAIT_MS));

package/dist/server/src/lib/cli-tools/copilot.js

@@ -113,11 +113,11 @@ class CopilotTool extends base_1.BaseCLITool {
             return;
         }
         try {
-            // Create tmux session with large history buffer
+            // Create tmux session. Scrollback depth comes from the shared
+            // TMUX_HISTORY_LIMIT default (Issue #1624) — do not re-hardcode it here.
             await (0, tmux_1.createSession)({
                 sessionName,
                 workingDirectory: worktreePath,
-                historyLimit: 50000,
             });
             // Wait a moment for the session to be created
             await new Promise((resolve) => setTimeout(resolve, cli_tool_timing_config_1.TUI_SESSION_CREATE_WAIT_MS));

package/dist/server/src/lib/cli-tools/gemini.js

@@ -74,11 +74,11 @@ class GeminiTool extends base_1.BaseCLITool {
             return;
         }
         try {
-            // Create tmux session with large history buffer
+            // Create tmux session. Scrollback depth comes from the shared
+            // TMUX_HISTORY_LIMIT default (Issue #1624) — do not re-hardcode it here.
             await (0, tmux_1.createSession)({
                 sessionName,
                 workingDirectory: worktreePath,
-                historyLimit: 50000,
             });
             // Wait a moment for the session to be created
             await new Promise((resolve) => setTimeout(resolve, cli_tool_timing_config_1.TUI_SESSION_CREATE_WAIT_MS));

package/dist/server/src/lib/cli-tools/opencode.js

@@ -89,11 +89,11 @@ class OpenCodeTool extends base_1.BaseCLITool {
         try {
             // Generate opencode.json if not present (non-fatal on failure)
             await (0, opencode_config_1.ensureOpencodeConfig)(worktreePath);
-            // Create tmux session with large history buffer
+            // Create tmux session. Scrollback depth comes from the shared
+            // TMUX_HISTORY_LIMIT default (Issue #1624) — do not re-hardcode it here.
             await (0, tmux_1.createSession)({
                 sessionName,
                 workingDirectory: worktreePath,
-                historyLimit: 50000,
             });
             // Wait a moment for the session to be created
             await new Promise((resolve) => setTimeout(resolve, cli_tool_timing_config_1.TUI_SESSION_CREATE_WAIT_MS));

package/dist/server/src/lib/cli-tools/vibe-local.js

@@ -66,11 +66,11 @@ class VibeLocalTool extends base_1.BaseCLITool {
             return;
         }
         try {
-            // Create tmux session with large history buffer
+            // Create tmux session. Scrollback depth comes from the shared
+            // TMUX_HISTORY_LIMIT default (Issue #1624) — do not re-hardcode it here.
             await (0, tmux_1.createSession)({
                 sessionName,
                 workingDirectory: worktreePath,
-                historyLimit: 50000,
             });
             // Wait a moment for the session to be created
             await new Promise((resolve) => setTimeout(resolve, cli_tool_timing_config_1.TUI_SESSION_CREATE_WAIT_MS));

package/dist/server/src/lib/db/agent-instances-db.js

@@ -15,6 +15,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.InvalidAgentInstanceError = exports.AgentInstanceLimitError = void 0;
 exports.getAgentInstances = getAgentInstances;
 exports.getAgentInstance = getAgentInstance;
+exports.resolveInstanceCliTool = resolveInstanceCliTool;
 exports.countAgentInstances = countAgentInstances;
 exports.setAgentInstances = setAgentInstances;
 exports.addAgentInstance = addAgentInstance;
@@ -103,6 +104,58 @@ function getAgentInstance(db, worktreeId, instanceId) {
   `).get(worktreeId, instanceId);
     return row ? mapAgentInstance(row) : null;
 }
+/**
+ * Resolve which CLI tool backs a targeted agent instance (Issue #1629).
+ *
+ * The CLI tool id is part of the tmux session name, so getting it wrong starts
+ * (or looks for) the wrong agent under a session name that claims otherwise:
+ * `--instance codex` used to start Claude in `mcbd-claude-<wt>-codex`.
+ *
+ * Resolution order:
+ *   1. the roster entry for `instanceId` — the roster is what declares that
+ *      `codex` is a codex instance, so it wins over the worktree default
+ *   2. `requestedCliTool`, for an instance the roster does not know about
+ *      (the ad-hoc `send --instance <new-id>` / `--register` flow)
+ *   3. `instanceId` when it is itself a CLI tool id — that is how the primary
+ *      instance is anchored (Issue #868), and holds without a roster row
+ *   4. no signal (`cliToolId: null`) — the caller falls back to its default
+ *
+ * An explicit `requestedCliTool` that contradicts the roster is reported as a
+ * conflict rather than silently overriding it: the roster is user-maintained
+ * and a mismatch means one of the two is wrong. Callers surface it as an error.
+ *
+ * @param db - Database instance
+ * @param worktreeId - Worktree ID
+ * @param instanceId - Targeted agent instance ID (omitted for the primary instance)
+ * @param requestedCliTool - CLI tool explicitly named by the caller, if any
+ */
+function resolveInstanceCliTool(db, worktreeId, instanceId, requestedCliTool) {
+    if (!instanceId) {
+        return { ok: true, cliToolId: requestedCliTool ?? null };
+    }
+    const registered = getAgentInstance(db, worktreeId, instanceId);
+    if (registered && (0, types_1.isCliToolType)(registered.cliTool)) {
+        if (requestedCliTool && requestedCliTool !== registered.cliTool) {
+            return {
+                ok: false,
+                instanceId,
+                rosterCliTool: registered.cliTool,
+                requestedCliTool,
+            };
+        }
+        return { ok: true, cliToolId: registered.cliTool };
+    }
+    // Not registered: an instance id that names a CLI tool is that tool's primary
+    // instance by definition, which outranks the worktree default but not an
+    // explicit request.
+    if (requestedCliTool) {
+        return { ok: true, cliToolId: requestedCliTool };
+    }
+    if ((0, types_1.isCliToolType)(instanceId)) {
+        return { ok: true, cliToolId: instanceId };
+    }
+    return { ok: true, cliToolId: null };
+}
 /**
  * Count agent instances for a worktree.
  */