commandmate 0.41.0 → 0.42.0

package/dist/lib/verification/verify-config.js

@@ -8,7 +8,7 @@
  * Server-only: reads from disk, so import this from API routes / CLI only.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.VerifyConfigError = exports.MAX_RETRY_ON_FAIL = exports.MAX_GATE_MUTEX_LENGTH = exports.GATE_MUTEX_PATTERN = exports.GATE_ID_PATTERN = exports.DEFAULT_MAX_LOG_TAIL_BYTES = exports.DEFAULT_TIMEOUT_SEC = exports.VERIFY_CONFIG_RELATIVE_PATH = exports.RESERVED_GATE_IDS = exports.ENV_CLEAN_GATE_ID = exports.SCOPE_GATE_ID = exports.WORK_EVIDENCE_GATE_ID = void 0;
+exports.VerifyConfigError = exports.MAX_ENV_CLEAN_IGNORE_HOME_ENTRIES = exports.MAX_RETRY_ON_FAIL = exports.MAX_GATE_MUTEX_LENGTH = exports.GATE_MUTEX_PATTERN = exports.GATE_ID_PATTERN = exports.DEFAULT_MAX_LOG_TAIL_BYTES = exports.DEFAULT_TIMEOUT_SEC = exports.VERIFY_CONFIG_RELATIVE_PATH = exports.RESERVED_GATE_IDS = exports.ENV_CLEAN_GATE_ID = exports.SCOPE_GATE_ID = exports.WORK_EVIDENCE_GATE_ID = void 0;
 exports.defaultPlannedGateIds = defaultPlannedGateIds;
 exports.validateGateEntries = validateGateEntries;
 exports.loadVerifyConfig = loadVerifyConfig;
@@ -110,6 +110,11 @@ exports.MAX_GATE_MUTEX_LENGTH = 64;
  * reports the machine's luck, not the work.
  */
 exports.MAX_RETRY_ON_FAIL = 1;
+/**
+ * Most names `options.envCleanIgnoreHomeEntries` may list (Issue #2890). A list
+ * this long is already a repository papering over a machine it should fix.
+ */
+exports.MAX_ENV_CLEAN_IGNORE_HOME_ENTRIES = 32;
 const TOP_LEVEL_KEYS = ['version', 'gates', 'options'];
 const GATE_KEYS = ['id', 'command', 'timeoutSec', 'mutex', 'retryOnFail', 'flakyIsPass'];
 const OPTION_KEYS = [
@@ -118,6 +123,7 @@ const OPTION_KEYS = [
     'maxLogTailBytes',
     'requireCommit',
     'requireEnvClean',
+    'envCleanIgnoreHomeEntries',
 ];
 class VerifyConfigError extends Error {
     issues;
@@ -316,6 +322,47 @@ function validateGates(value, issues) {
     }
     return validateGateEntries(value, 'gates', issues);
 }
+/**
+ * Validate `options.envCleanIgnoreHomeEntries` (Issue #2890).
+ *
+ * Each item must be usable as one exact `$HOME` directory-entry name: a string,
+ * non-empty, not `.` / `..`, and free of `/` and NUL. Anything with a separator
+ * could never equal a `readdir` result, so accepting it would be a rule that
+ * silently matches nothing.
+ *
+ * @returns the names, or null when the value was invalid (issues were pushed)
+ */
+function validateHomeEntryNames(value, issues) {
+    const label = 'options.envCleanIgnoreHomeEntries';
+    if (!Array.isArray(value)) {
+        issues.push(`${label}: must be a list of $HOME entry names (got ${describe(value)})`);
+        return null;
+    }
+    const before = issues.length;
+    if (value.length > exports.MAX_ENV_CLEAN_IGNORE_HOME_ENTRIES) {
+        issues.push(`${label}: at most ${exports.MAX_ENV_CLEAN_IGNORE_HOME_ENTRIES} entries (got ${value.length})`);
+    }
+    const names = [];
+    value.forEach((item, index) => {
+        const at = `${label}[${index}]`;
+        if (typeof item !== 'string') {
+            issues.push(`${at}: must be a string (got ${describe(item)})`);
+        }
+        else if (item === '') {
+            issues.push(`${at}: must not be empty`);
+        }
+        else if (item === '.' || item === '..') {
+            issues.push(`${at}: must be an entry name, not ${JSON.stringify(item)}`);
+        }
+        else if (item.includes('/') || item.includes('\0')) {
+            issues.push(`${at}: must be a single $HOME entry name without "/" or NUL (got ${describe(item)})`);
+        }
+        else {
+            names.push(item);
+        }
+    });
+    return issues.length === before ? names : null;
+}
 function validateOptions(value, issues) {
     const options = {
         baseRef: null,
@@ -323,6 +370,7 @@ function validateOptions(value, issues) {
         maxLogTailBytes: exports.DEFAULT_MAX_LOG_TAIL_BYTES,
         requireCommit: false,
         requireEnvClean: false,
+        envCleanIgnoreHomeEntries: [],
     };
     // A childless `options:` key parses as null and means "all defaults".
     if (value === undefined || value === null)
@@ -367,6 +415,11 @@ function validateOptions(value, issues) {
             options.requireEnvClean = parsed;
         }
     }
+    if (value.envCleanIgnoreHomeEntries !== undefined) {
+        const names = validateHomeEntryNames(value.envCleanIgnoreHomeEntries, issues);
+        if (names)
+            options.envCleanIgnoreHomeEntries = names;
+    }
     if (value.maxLogTailBytes !== undefined) {
         const parsed = asInteger(value.maxLogTailBytes);
         if (parsed === null) {

package/dist/server/locales/en/worktree.json

@@ -1020,7 +1020,10 @@
         "caption": "Answer"
     },
     "promptResponse": {
-        "refused": "Your answer was not sent because the dialog has changed. Please check the screen."
+        "refused": "Your answer was not sent because the dialog has changed. Please check the screen.",
+        "stuckHint": "If sending does not work, operate the terminal in direct input mode.",
+        "stuckHintLink": "Switch to direct input",
+        "unanswerable": "CommandMate cannot operate this screen. Use direct input mode instead."
     },
     "dismissPanelKeys": {
         "toolbarLabel": "Close this screen",

package/dist/server/locales/ja/worktree.json

@@ -1020,7 +1020,10 @@
         "caption": "回答"
     },
     "promptResponse": {
-        "refused": "ダイアログの状態が変わったため送信できませんでした。画面を確認してください。"
+        "refused": "ダイアログの状態が変わったため送信できませんでした。画面を確認してください。",
+        "stuckHint": "送信がうまくいかない場合は、直接入力モードで操作してください。",
+        "stuckHintLink": "直接入力に切り替える",
+        "unanswerable": "この画面は CommandMate から操作できません。直接入力モードで操作してください。"
     },
     "dismissPanelKeys": {
         "toolbarLabel": "この画面を閉じる",

package/dist/server/server.js

@@ -409,6 +409,19 @@ app.prepare().then(() => {
             catch (error) {
                 console.error('Error reconciling Skill operations:', error);
             }
+            // Issue #2866: this server's tmux session-name namespace. Must precede the
+            // session reconcile below, which renames onto (and attributes against)
+            // names in this namespace. Fail-open in its own try/catch: without a
+            // namespace sessions keep the legacy `mcbd-{cli}-{id}` names. Dynamic
+            // import for the same reason as the reconcilers around it.
+            try {
+                const { initSessionNamespace } = await Promise.resolve().then(() => __importStar(require('./src/lib/cli-tools/session-namespace')));
+                const namespace = initSessionNamespace(db);
+                console.log(`tmux session namespace: ${namespace}`);
+            }
+            catch (error) {
+                console.error('Error initializing tmux session namespace:', error);
+            }
             // Issue #1621 Phase 3/4: make live tmux sessions follow the worktree IDs
             // that migration v54 has just renumbered. Session names are DERIVED from
             // the ID (`mcbd-{cli}-{worktreeId}`), so a running agent would otherwise
@@ -445,6 +458,22 @@ app.prepare().then(() => {
             catch (error) {
                 console.error('Error reconciling worktree sessions:', error);
             }
+            // Issue #2866: keep serving this server's sessions that predate the
+            // namespace under their legacy names (adopted, not renamed). After the
+            // reconcile above, so an ID move has already been applied. Fail-open.
+            try {
+                const { adoptLegacySessions } = await Promise.resolve().then(() => __importStar(require('./src/lib/session/adopt-legacy-sessions')));
+                const adoptReport = await adoptLegacySessions(db);
+                if (adoptReport.adopted.length > 0) {
+                    console.log(`Adopted ${adoptReport.adopted.length} legacy-named tmux session(s)`);
+                }
+                if (adoptReport.errors.length > 0) {
+                    console.warn(`Legacy session adoption warnings: ${adoptReport.errors.join(', ')}`);
+                }
+            }
+            catch (error) {
+                console.error('Error adopting legacy tmux sessions:', error);
+            }
             // Issue #1543: close verification runs that a crash left in `running`.
             // Gate execution lives in process memory, so none of them survived the
             // restart; leaving the rows open would keep their worktrees permanently

package/dist/server/src/lib/auto-yes-poller.js

@@ -69,6 +69,7 @@ const auto_yes_dialog_gate_1 = require("./polling/auto-yes-dialog-gate");
 const task_transition_service_1 = require("./tasks/task-transition-service");
 const db_instance_1 = require("./db/db-instance");
 const chat_db_1 = require("./db/chat-db");
+const worktree_session_ownership_1 = require("./cli-tools/worktree-session-ownership");
 const prompt_answer_sender_1 = require("./prompt-answer-sender");
 const manager_1 = require("./cli-tools/manager");
 const cli_patterns_1 = require("./detection/cli-patterns");
@@ -519,6 +520,20 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
         const manager = manager_1.CLIToolManager.getInstance();
         const cliTool = manager.getTool(cliToolId);
         const sessionName = cliTool.getSessionName(worktreeId, instanceId);
+        // Issue #2865: never auto-answer a same-named session another CommandMate
+        // server created. The poller keeps running; it just does not type.
+        const ownership = await (0, worktree_session_ownership_1.checkWorktreeSessionOwnership)(worktreeId, sessionName);
+        if (ownership === null || ownership.verdict === 'foreign') {
+            logger.warn('poller:auto-yes-skipped-foreign-session', {
+                worktreeId,
+                cliToolId,
+                instanceId,
+                sessionName,
+                sessionPath: ownership?.sessionPath ?? null,
+                reason: ownership ? 'foreign' : 'worktree_not_found',
+            });
+            return 'no_answer';
+        }
         try {
             await (0, prompt_answer_sender_1.sendPromptAnswer)({
                 sessionName,

package/dist/server/src/lib/cli-tools/antigravity.js

@@ -200,7 +200,7 @@ class AntigravityTool extends base_1.BaseCLITool {
         // Check if session already exists
         const exists = await (0, tmux_1.hasSession)(sessionName);
         if (exists) {
-            await this.reconcileExistingSession(sessionName);
+            await this.reconcileExistingSession(sessionName, worktreePath);
             // Issue #2070: this branch used to return unconditionally. A tmux session
             // outlives the agent that was launched into it — a quit, a self-update, a
             // crash — and the launch was then skipped for a pane holding nothing but a

package/dist/server/src/lib/cli-tools/base.js

@@ -13,6 +13,7 @@ const child_process_1 = require("child_process");
 const util_1 = require("util");
 const session_name_1 = require("./session-name");
 const tmux_1 = require("../tmux/tmux");
+const session_ownership_1 = require("../tmux/session-ownership");
 const composer_spec_1 = require("./composer-spec");
 const capture_spec_1 = require("./capture-spec");
 const agent_mode_spec_1 = require("./agent-mode-spec");
@@ -235,8 +236,16 @@ class BaseCLITool {
     /**
      * Repair geometry when reusing a tmux session that predates the current
      * defaults, and record that this launch reused one (Issue #2429).
+     *
+     * Issue #2865: only a session created in `worktreePath` is reused. A
+     * same-named session another CommandMate server created is refused with
+     * {@link ForeignSessionError} before anything touches it, and is never
+     * recorded as adopted.
+     *
+     * @throws {ForeignSessionError} When the session's `#{session_path}` is not `worktreePath`
      */
-    async reconcileExistingSession(sessionName, options) {
+    async reconcileExistingSession(sessionName, worktreePath, options) {
+        await (0, session_ownership_1.assertSessionNotForeign)(sessionName, worktreePath);
         adoptedSessions.add(sessionName);
         await (0, tmux_1.reconcileSessionGeometry)(sessionName, options);
     }

package/dist/server/src/lib/cli-tools/codex.js

@@ -204,7 +204,7 @@ class CodexTool extends base_1.BaseCLITool {
         // Check if session already exists
         const exists = await (0, tmux_1.hasSession)(sessionName);
         if (exists) {
-            await this.reconcileExistingSession(sessionName);
+            await this.reconcileExistingSession(sessionName, worktreePath);
             // Issue #2070: this branch used to return unconditionally, and that is
             // the second half of the reported bug. codex's own "1. Update now"
             // replaces codex with `npm install` and exits; `Ctrl+C` twice quits it; a

package/dist/server/src/lib/cli-tools/command-code.js

@@ -191,7 +191,7 @@ class CommandCodeTool extends base_1.BaseCLITool {
         const sessionName = this.getSessionName(worktreeId, instanceId);
         const exists = await (0, tmux_1.hasSession)(sessionName);
         if (exists) {
-            await this.reconcileExistingSession(sessionName);
+            await this.reconcileExistingSession(sessionName, worktreePath);
             // Issue #2070's shape: a tmux session outlives the agent that was launched
             // into it, and skipping the launch for a pane holding nothing but a shell
             // prompt leaves `kill-session` by hand as the only recovery.

package/dist/server/src/lib/cli-tools/copilot.js

@@ -307,7 +307,7 @@ class CopilotTool extends base_1.BaseCLITool {
         // Check if session already exists
         const exists = await (0, tmux_1.hasSession)(sessionName);
         if (exists) {
-            await this.reconcileExistingSession(sessionName);
+            await this.reconcileExistingSession(sessionName, worktreePath);
             // Issue #2070: this branch used to return unconditionally. A tmux session
             // outlives the agent that was launched into it — a quit, a self-update, a
             // crash — and the launch was then skipped for a pane holding nothing but a

package/dist/server/src/lib/cli-tools/gemini.js

@@ -72,7 +72,7 @@ class GeminiTool extends base_1.BaseCLITool {
         // Check if session already exists
         const exists = await (0, tmux_1.hasSession)(sessionName);
         if (exists) {
-            await this.reconcileExistingSession(sessionName);
+            await this.reconcileExistingSession(sessionName, worktreePath);
             // Issue #2070: this branch used to return unconditionally. A tmux session
             // outlives the agent that was launched into it — a quit, a self-update, a
             // crash — and the launch was then skipped for a pane holding nothing but a

package/dist/server/src/lib/cli-tools/legacy-session-adoption.js

@@ -0,0 +1,19 @@
+"use strict";
+/**
+ * Gateway re-export for legacy session adoption (Issue #2866).
+ *
+ * `adoptLegacySessions` lives in `src/lib/session/`, which may not import
+ * `src/lib/tmux/**` directly (Issue #1922, `.eslintrc.json`
+ * `no-restricted-imports`). The CLITool layer is a sanctioned gateway, so the
+ * one session listing and the adoption table it needs are reached through here
+ * — the same arrangement as `session-ownership.ts` (Issue #2865).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerLegacyAlias = exports.lookupLegacyAlias = exports.dropLegacyAliasByLegacyName = exports.clearLegacyAliasesForTests = exports.listSessions = void 0;
+var tmux_1 = require("../tmux/tmux");
+Object.defineProperty(exports, "listSessions", { enumerable: true, get: function () { return tmux_1.listSessions; } });
+var legacy_session_alias_1 = require("../tmux/legacy-session-alias");
+Object.defineProperty(exports, "clearLegacyAliasesForTests", { enumerable: true, get: function () { return legacy_session_alias_1.clearLegacyAliasesForTests; } });
+Object.defineProperty(exports, "dropLegacyAliasByLegacyName", { enumerable: true, get: function () { return legacy_session_alias_1.dropLegacyAliasByLegacyName; } });
+Object.defineProperty(exports, "lookupLegacyAlias", { enumerable: true, get: function () { return legacy_session_alias_1.lookupLegacyAlias; } });
+Object.defineProperty(exports, "registerLegacyAlias", { enumerable: true, get: function () { return legacy_session_alias_1.registerLegacyAlias; } });

package/dist/server/src/lib/cli-tools/opencode.js

@@ -255,7 +255,7 @@ class OpenCodeTool extends base_1.BaseCLITool {
             // 200 wide, reconnected ones are 80" ships without anyone noticing —
             // a reconnect would silently hand the detectors a geometry the creation
             // path had been moved away from.
-            await this.reconcileExistingSession(sessionName, {
+            await this.reconcileExistingSession(sessionName, worktreePath, {
                 windowWidth: resolveOpencodePaneWidthChecked(),
                 windowHeight: tmux_pane_config_1.OPENCODE_PANE_HEIGHT,
             });

package/dist/server/src/lib/cli-tools/session-name.js

@@ -16,18 +16,87 @@
  * `import('../../lib/ws-server')` の 458ms のうち 234ms を占めていた。
  *
  * 規則そのものは 1 箇所に保つ — `BaseCLITool.getSessionName()` はこの関数へ委譲する。
+ *
+ * ## Issue #2866: 名前空間（ns）
+ *
+ * worktree ID はディレクトリ名から作られるので、DB が別の 2 台のサーバでも
+ * `mcbd-{cli}-{worktreeId}` が重なる。サーバ起動時に `initSessionNamespace()`
+ * （`session-namespace.ts`）が ns（16 進 8 桁）を決めると、以後の名前は
+ * `mcbd-{ns}-{cli}-{worktreeId}[-{suffix}]` になる。ns 未設定（CLI・テスト・
+ * 初期化失敗時）は従来形式のまま。ns はどの CLI ツール ID とも一致しないので、
+ * `mcbd-` の直後の区切りで新旧を見分けられる（{@link parseSessionName}）。
+ *
+ * このモジュールは CLI バンドル（`tsconfig.cli.json` は paths なし）にも入るので、
+ * `@/` を使わず、DB にも触らない。ns の保持だけをここで行い、DB からの読み書きは
+ * `session-namespace.ts` が受け持つ。
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.SESSION_NAMESPACE_PATTERN = void 0;
+exports.getActiveSessionNamespace = getActiveSessionNamespace;
+exports.setActiveSessionNamespace = setActiveSessionNamespace;
+exports.resolveNamespacedSessionName = resolveNamespacedSessionName;
 exports.resolveSessionName = resolveSessionName;
+exports.resolveLegacySessionName = resolveLegacySessionName;
+exports.parseSessionName = parseSessionName;
 const types_1 = require("./types");
 const validation_1 = require("./validation");
+const legacy_session_alias_1 = require("../tmux/legacy-session-alias");
+const SESSION_NAME_PREFIX = 'mcbd-';
+/** Shape of a session-name namespace: 8 lowercase hex digits (Issue #2866). */
+exports.SESSION_NAMESPACE_PATTERN = /^[0-9a-f]{8}$/;
+/** CLI tool ids, longest first, so a longer id is never read as a shorter one. */
+const CLI_TOOL_IDS_LONGEST_FIRST = [...types_1.CLI_TOOL_IDS].sort((a, b) => b.length - a.length);
+/**
+ * The namespace this process names its sessions with, or null (legacy names).
+ *
+ * @internal Read through `getSessionNamespace()` in `session-namespace.ts`.
+ * Kept on `globalThis` because the custom server sets it at startup while the
+ * Next route bundles — a separate module graph (Issue #2223) — read it.
+ */
+function getActiveSessionNamespace() {
+    return globalThis.__cmTmuxSessionNamespace ?? null;
+}
+/**
+ * @internal Set by `initSessionNamespace()` / reset by tests only.
+ */
+function setActiveSessionNamespace(namespace) {
+    if (namespace !== null && !exports.SESSION_NAMESPACE_PATTERN.test(namespace)) {
+        throw new Error(`Invalid session namespace: ${namespace}`);
+    }
+    globalThis.__cmTmuxSessionNamespace = namespace;
+}
+function buildSessionName(head, cliToolId, worktreeId, instanceId) {
+    const base = `${head}${cliToolId}-${worktreeId}`;
+    if (!instanceId || instanceId === cliToolId) {
+        (0, validation_1.validateSessionName)(base);
+        return base;
+    }
+    const suffix = (0, types_1.deriveSessionSuffix)(instanceId, cliToolId);
+    const sessionName = suffix ? `${base}-${suffix}` : base;
+    (0, validation_1.validateSessionName)(sessionName);
+    return sessionName;
+}
+/**
+ * The session name in the given namespace, ignoring legacy adoptions
+ * (Issue #2866). `namespace === null` is the legacy form.
+ *
+ * @throws Error if the resulting session name is invalid
+ */
+function resolveNamespacedSessionName(namespace, cliToolId, worktreeId, instanceId) {
+    const head = namespace === null ? SESSION_NAME_PREFIX : `${SESSION_NAME_PREFIX}${namespace}-`;
+    return buildSessionName(head, cliToolId, worktreeId, instanceId);
+}
 /**
  * Resolve the tmux session name for a (worktree, CLI tool, instance) triple.
  *
- * Format (Issue #868):
- * - Primary instance (`instanceId` omitted or `=== cliToolId`):
- *   `mcbd-{cli_tool_id}-{worktree_id}` — the backward-compatible anchor
- * - Additional instance: `mcbd-{cli_tool_id}-{worktree_id}-{suffix}`
+ * Format (Issue #868, #2866):
+ * - namespace set: `mcbd-{ns}-{cli_tool_id}-{worktree_id}[-{suffix}]` — unless a
+ *   legacy session was adopted for that name (`adoptLegacySessions`), in which
+ *   case the adopted legacy name is returned
+ * - namespace unset: `mcbd-{cli_tool_id}-{worktree_id}[-{suffix}]`
+ *
+ * The primary instance (`instanceId` omitted or `=== cliToolId`) carries no
+ * suffix.
  *
  * T2.3 (MF4-001): the result is validated to keep shell metacharacters out of
  * the tmux command line.
@@ -40,18 +109,52 @@ const validation_1 = require("./validation");
  *
  * @example
  * ```typescript
+ * // namespace unset
  * resolveSessionName('claude', 'wt-1');            // 'mcbd-claude-wt-1'
  * resolveSessionName('claude', 'wt-1', 'claude-2'); // 'mcbd-claude-wt-1-2'
+ * // namespace '0a1b2c3d'
+ * resolveSessionName('claude', 'wt-1');            // 'mcbd-0a1b2c3d-claude-wt-1'
  * ```
  */
 function resolveSessionName(cliToolId, worktreeId, instanceId) {
-    const base = `mcbd-${cliToolId}-${worktreeId}`;
-    if (!instanceId || instanceId === cliToolId) {
-        (0, validation_1.validateSessionName)(base);
-        return base;
+    const namespace = getActiveSessionNamespace();
+    const name = resolveNamespacedSessionName(namespace, cliToolId, worktreeId, instanceId);
+    if (namespace === null)
+        return name;
+    return (0, legacy_session_alias_1.lookupLegacyAlias)(name) ?? name;
+}
+/**
+ * The legacy (pre-#2866) session name, whatever the namespace:
+ * `mcbd-{cli_tool_id}-{worktree_id}[-{suffix}]`.
+ *
+ * @throws Error if the resulting session name is invalid
+ */
+function resolveLegacySessionName(cliToolId, worktreeId, instanceId) {
+    return resolveNamespacedSessionName(null, cliToolId, worktreeId, instanceId);
+}
+/**
+ * Split a session name of either form. The worktree ID and the instance suffix
+ * are NOT separated — worktree IDs may contain `-`, so only the caller (who
+ * knows the set of worktree IDs) can tell them apart.
+ *
+ * @returns null when the name does not start with `mcbd-`, names no known CLI
+ *   tool, or has nothing after the tool
+ */
+function parseSessionName(name) {
+    if (!name.startsWith(SESSION_NAME_PREFIX))
+        return null;
+    let body = name.slice(SESSION_NAME_PREFIX.length);
+    let namespace = null;
+    const dash = body.indexOf('-');
+    if (dash > 0 && exports.SESSION_NAMESPACE_PATTERN.test(body.slice(0, dash))) {
+        namespace = body.slice(0, dash);
+        body = body.slice(dash + 1);
     }
-    const suffix = (0, types_1.deriveSessionSuffix)(instanceId, cliToolId);
-    const sessionName = suffix ? `${base}-${suffix}` : base;
-    (0, validation_1.validateSessionName)(sessionName);
-    return sessionName;
+    const cliToolId = CLI_TOOL_IDS_LONGEST_FIRST.find((id) => body.startsWith(`${id}-`));
+    if (!cliToolId)
+        return null;
+    const rest = body.slice(cliToolId.length + 1);
+    if (rest === '')
+        return null;
+    return { namespace, cliToolId, rest };
 }

package/dist/server/src/lib/cli-tools/session-namespace.js

@@ -0,0 +1,55 @@
+"use strict";
+/**
+ * The tmux session-name namespace of this server (Issue #2866).
+ *
+ * Two CommandMate servers with different databases resolve the same
+ * `mcbd-{cli}-{worktreeId}` whenever their worktree directories share a name,
+ * because worktree IDs are derived from the directory name. Each server
+ * therefore mints a random namespace once, keeps it in `app_settings`
+ * (`tmux_session_namespace`), and puts it into every session name it creates:
+ * `mcbd-{ns}-{cli}-{worktreeId}[-{suffix}]` (`session-name.ts`).
+ *
+ * Initialized once at server startup, before the startup session reconcile.
+ * Until then — and in the CLI, in tests, or when initialization failed — the
+ * namespace is unset and names keep the legacy form.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.initSessionNamespace = initSessionNamespace;
+exports.getSessionNamespace = getSessionNamespace;
+exports.resetSessionNamespaceForTests = resetSessionNamespaceForTests;
+const crypto_1 = require("crypto");
+const app_settings_db_1 = require("../../lib/db/app-settings-db");
+const logger_1 = require("../../lib/logger");
+const session_name_1 = require("./session-name");
+const logger = (0, logger_1.createLogger)('session-namespace');
+/**
+ * Read the namespace from the DB, minting and saving one when it is absent or
+ * ill-formed, and make it the namespace every later session name uses.
+ *
+ * @param db - The server's database
+ * @returns The namespace now in effect
+ * @throws when the DB cannot be written; the namespace then stays unset
+ */
+function initSessionNamespace(db) {
+    const stored = (0, app_settings_db_1.getTmuxSessionNamespace)(db);
+    if (stored !== null && session_name_1.SESSION_NAMESPACE_PATTERN.test(stored)) {
+        (0, session_name_1.setActiveSessionNamespace)(stored);
+        return stored;
+    }
+    const namespace = (0, crypto_1.randomBytes)(4).toString('hex');
+    if (stored !== null) {
+        logger.warn('session-namespace:invalid-stored-value', { stored, replacement: namespace });
+    }
+    (0, app_settings_db_1.setTmuxSessionNamespace)(db, namespace);
+    (0, session_name_1.setActiveSessionNamespace)(namespace);
+    logger.info('session-namespace:initialized', { namespace, minted: true });
+    return namespace;
+}
+/** The namespace in effect, or null when not initialized. */
+function getSessionNamespace() {
+    return (0, session_name_1.getActiveSessionNamespace)();
+}
+/** Test-only: back to "not initialized". */
+function resetSessionNamespaceForTests() {
+    (0, session_name_1.setActiveSessionNamespace)(null);
+}

package/dist/server/src/lib/cli-tools/session-ownership.js

@@ -0,0 +1,21 @@
+"use strict";
+/**
+ * Gateway re-export of the tmux session-ownership check (Issue #2865).
+ *
+ * Routes, pollers and the WebSocket server may not import `src/lib/tmux/**`
+ * directly (Issue #1922, `.eslintrc.json` `no-restricted-imports`); the
+ * CLITool layer is one of the sanctioned gateways, so the ownership check is
+ * reached through here. The implementation lives in
+ * `src/lib/tmux/session-ownership.ts`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ownedSessionNameSet = exports.isSessionPathOwnedBy = exports.foreignSessionErrorBody = exports.createCachedOwnershipMatcher = exports.checkSessionOwnership = exports.assertSessionNotForeign = exports.ForeignSessionError = exports.FOREIGN_SESSION_ERROR_CODE = void 0;
+var session_ownership_1 = require("../tmux/session-ownership");
+Object.defineProperty(exports, "FOREIGN_SESSION_ERROR_CODE", { enumerable: true, get: function () { return session_ownership_1.FOREIGN_SESSION_ERROR_CODE; } });
+Object.defineProperty(exports, "ForeignSessionError", { enumerable: true, get: function () { return session_ownership_1.ForeignSessionError; } });
+Object.defineProperty(exports, "assertSessionNotForeign", { enumerable: true, get: function () { return session_ownership_1.assertSessionNotForeign; } });
+Object.defineProperty(exports, "checkSessionOwnership", { enumerable: true, get: function () { return session_ownership_1.checkSessionOwnership; } });
+Object.defineProperty(exports, "createCachedOwnershipMatcher", { enumerable: true, get: function () { return session_ownership_1.createCachedOwnershipMatcher; } });
+Object.defineProperty(exports, "foreignSessionErrorBody", { enumerable: true, get: function () { return session_ownership_1.foreignSessionErrorBody; } });
+Object.defineProperty(exports, "isSessionPathOwnedBy", { enumerable: true, get: function () { return session_ownership_1.isSessionPathOwnedBy; } });
+Object.defineProperty(exports, "ownedSessionNameSet", { enumerable: true, get: function () { return session_ownership_1.ownedSessionNameSet; } });

package/dist/server/src/lib/cli-tools/vibe-local.js

@@ -63,7 +63,7 @@ class VibeLocalTool extends base_1.BaseCLITool {
         const sessionName = this.getSessionName(worktreeId, instanceId);
         const exists = await (0, tmux_1.hasSession)(sessionName);
         if (exists) {
-            await this.reconcileExistingSession(sessionName);
+            await this.reconcileExistingSession(sessionName, worktreePath);
             // Issue #2070: this branch used to return unconditionally. A tmux session
             // outlives the agent that was launched into it — a quit, a self-update, a
             // crash — and the launch was then skipped for a pane holding nothing but a

package/dist/server/src/lib/cli-tools/worktree-session-ownership.js

@@ -0,0 +1,28 @@
+"use strict";
+/**
+ * Session ownership by worktree id (Issue #2865).
+ *
+ * For callers that hold only a worktree id — the Auto-Yes poller and
+ * `sendUserMessage` (timer / relay sends) — and would
+ * otherwise have to reach into the DB and the tmux gateway separately. Kept out
+ * of `session-ownership.ts` so the plain ownership check does not drag the DB
+ * layer into every module that imports it.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkWorktreeSessionOwnership = checkWorktreeSessionOwnership;
+const db_instance_1 = require("../db/db-instance");
+const worktree_db_1 = require("../db/worktree-db");
+const session_ownership_1 = require("../tmux/session-ownership");
+/**
+ * Ownership of `sessionName` against the worktree row `worktreeId`. `null` when
+ * the row does not exist — the caller cannot vouch for the session and must not
+ * drive it.
+ *
+ * @param db - The handle to read the row from; defaults to the server's
+ */
+async function checkWorktreeSessionOwnership(worktreeId, sessionName, db = (0, db_instance_1.getDbInstance)()) {
+    const worktree = (0, worktree_db_1.getWorktreeById)(db, worktreeId);
+    if (!worktree)
+        return null;
+    return (0, session_ownership_1.checkSessionOwnership)(sessionName, worktree.path);
+}

package/dist/server/src/lib/db/app-settings-db.js

@@ -16,6 +16,8 @@ exports.setDefaultSelectedAgents = setDefaultSelectedAgents;
 exports.clearDefaultSelectedAgents = clearDefaultSelectedAgents;
 exports.getDefaultSurfaceMode = getDefaultSurfaceMode;
 exports.setDefaultSurfaceMode = setDefaultSurfaceMode;
+exports.getTmuxSessionNamespace = getTmuxSessionNamespace;
+exports.setTmuxSessionNamespace = setTmuxSessionNamespace;
 const selected_agents_validator_1 = require("../../lib/selected-agents-validator");
 const ui_state_1 = require("../../types/ui-state");
 // ============================================================================
@@ -45,6 +47,14 @@ const KEY_DEFAULT_SELECTED_AGENTS = 'default_selected_agents';
  * reaches an install that never chose.
  */
 const KEY_DEFAULT_SURFACE_MODE = 'default_surface_mode';
+/**
+ * Storage key for this server's tmux session-name namespace (Issue #2866).
+ *
+ * 8 lowercase hex digits, minted once at first startup. Validated by
+ * `initSessionNamespace()` rather than here: an ill-formed row has to be seen
+ * (and warned about) before it is replaced, not silently read as "unset".
+ */
+const KEY_TMUX_SESSION_NAMESPACE = 'tmux_session_namespace';
 /** How many recently used directories to remember (Issue #1517) */
 exports.RECENT_BROWSE_PATHS_LIMIT = 5;
 // ============================================================================
@@ -200,3 +210,22 @@ function getDefaultSurfaceMode(db) {
 function setDefaultSurfaceMode(db, mode) {
     writeScalar(db, KEY_DEFAULT_SURFACE_MODE, mode);
 }
+// ============================================================================
+// tmux session namespace (Issue #2866)
+// ============================================================================
+/**
+ * Get the stored tmux session-name namespace, unvalidated.
+ *
+ * @returns The raw stored value, or null when unset
+ */
+function getTmuxSessionNamespace(db) {
+    return readScalar(db, KEY_TMUX_SESSION_NAMESPACE);
+}
+/**
+ * Save the tmux session-name namespace.
+ *
+ * @param namespace - Already-validated namespace (`^[0-9a-f]{8}$`)
+ */
+function setTmuxSessionNamespace(db, namespace) {
+    writeScalar(db, KEY_TMUX_SESSION_NAMESPACE, namespace);
+}