commandmate 0.41.1 → 0.42.1

package/dist/server/src/lib/hooks/sources/codex/hooks-config.js

@@ -65,10 +65,26 @@
  * resolving the worktree from `cwd`, which is exactly the hand-configured
  * behaviour of Issue #1549. `CM_AGENT_HOOKS_INJECT=0` turns the whole thing off.
  *
+ * ## The shared app-server daemon (Issue #2874)
+ *
+ * From codex **0.157** the TUI attaches by default (`features.daemon_auto_start`)
+ * to one machine-wide `codex app-server --managed-daemon`, and hooks run inside
+ * *that* process, so they see the daemon's environment — the first instance that
+ * started it — not the launching session's. Every later instance was reported as
+ * that first one.
+ *
+ * `-c features.daemon_auto_start=false` ({@link CODEX_EMBEDDED_MODE_ARGS}) only stops
+ * codex *starting* a daemon; one already running is still attached to (Issue #2891 —
+ * #2874 was observed with none up). `--no-daemon` ({@link CODEX_NO_DAEMON_FLAG}) stays
+ * off it even then, when {@link codexSupportsNoDaemon}; both are kept.
+ * Measured 2026-09-27 on codex-cli 0.157.1.
+ *
  * @module lib/hooks/sources/codex/hooks-config
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CODEX_HOOK_TRUST_POLICY_DEFAULT = exports.CODEX_SUPPORTED_EVENTS = exports.CODEX_PERMISSION_REQUEST_EVENT = exports.CODEX_REGISTERED_EVENTS = exports.CODEX_SESSION_END_TIMEOUT_SECONDS = exports.CODEX_HOOK_TRUST_BYPASS_FLAG = exports.CODEX_HOOK_TRUST_ENV_VAR = exports.CODEX_PERMISSION_URL_ENV_VAR = exports.CODEX_EVENT_URL_ENV_VAR = exports.CODEX_INSTANCE_ID_ENV_VAR = exports.CODEX_WORKTREE_ID_ENV_VAR = exports.CODEX_TOOL_ENV_VAR = exports.CODEX_HOME_ENV_VAR = exports.CODEX_HOOK_MARKER = void 0;
+exports.CODEX_HOOK_TRUST_POLICY_DEFAULT = exports.CODEX_SUPPORTED_EVENTS = exports.CODEX_PERMISSION_REQUEST_EVENT = exports.CODEX_REGISTERED_EVENTS = exports.CODEX_SESSION_END_TIMEOUT_SECONDS = exports.CODEX_NO_DAEMON_FLAG = exports.CODEX_EMBEDDED_MODE_ARGS = exports.CODEX_HOOK_TRUST_BYPASS_FLAG = exports.CODEX_HOOK_TRUST_ENV_VAR = exports.CODEX_PERMISSION_URL_ENV_VAR = exports.CODEX_EVENT_URL_ENV_VAR = exports.CODEX_INSTANCE_ID_ENV_VAR = exports.CODEX_WORKTREE_ID_ENV_VAR = exports.CODEX_TOOL_ENV_VAR = exports.CODEX_HOME_ENV_VAR = exports.CODEX_HOOK_MARKER = void 0;
+exports.codexSupportsNoDaemon = codexSupportsNoDaemon;
+exports.resetCodexNoDaemonSupportCacheForTests = resetCodexNoDaemonSupportCacheForTests;
 exports.resolveCodexHookTrustPolicy = resolveCodexHookTrustPolicy;
 exports.isCodexHookTrustBypassEnabled = isCodexHookTrustBypassEnabled;
 exports.shouldTrustCodexHooks = shouldTrustCodexHooks;
@@ -81,6 +97,7 @@ exports.buildCodexHookSettings = buildCodexHookSettings;
 exports.mergeCodexHookSettings = mergeCodexHookSettings;
 exports.writeCodexHookSettings = writeCodexHookSettings;
 exports.buildCodexLaunchPlan = buildCodexLaunchPlan;
+const child_process_1 = require("child_process");
 const fs_1 = require("fs");
 const os_1 = require("os");
 const path_1 = require("path");
@@ -89,6 +106,7 @@ const types_1 = require("../../../../lib/cli-tools/types");
 const env_1 = require("../../../../lib/env");
 const hook_settings_generator_1 = require("../../../../lib/hooks/hook-settings-generator");
 const logger_1 = require("../../../../lib/logger");
+const env_sanitizer_1 = require("../../../../lib/security/env-sanitizer");
 const path_validator_1 = require("../../../../lib/security/path-validator");
 const event_mapper_1 = require("../event-mapper");
 const relay_install_1 = require("./relay-install");
@@ -134,6 +152,56 @@ exports.CODEX_PERMISSION_URL_ENV_VAR = 'CM_PERMISSION_HOOK_URL';
 exports.CODEX_HOOK_TRUST_ENV_VAR = 'CM_CODEX_HOOK_TRUST';
 /** codex's own flag for running unreviewed hooks, for one invocation. */
 exports.CODEX_HOOK_TRUST_BYPASS_FLAG = '--dangerously-bypass-hook-trust';
+/** codex 0.157+: keep the TUI off the shared app-server daemon so hooks run with this session's env. */
+exports.CODEX_EMBEDDED_MODE_ARGS = '-c features.daemon_auto_start=false';
+/** codex 0.157+: stay off the shared app-server daemon even when one is already running. */
+exports.CODEX_NO_DAEMON_FLAG = '--no-daemon';
+/** How long `codex --help` may take before {@link codexSupportsNoDaemon} gives up. */
+const CODEX_HELP_PROBE_TIMEOUT_MS = 5000;
+/** `--no-daemon` as a whole option name, not the prefix of a longer one. */
+const CODEX_NO_DAEMON_HELP_PATTERN = new RegExp(`${exports.CODEX_NO_DAEMON_FLAG}(?![\\w-])`);
+const noDaemonSupportCache = new Map();
+/**
+ * Whether `executablePath --help` lists `--no-daemon`. Cached per executable path for the
+ * life of the process. Any failure (spawn error, non-zero exit, timeout) → false.
+ *
+ * Decided from the help text, not from a version number: a version that was
+ * read wrongly, or a build that backported or dropped the option, still gets
+ * the answer the binary itself gives. The failure direction is the safe one — an
+ * unrecognised option would stop codex starting at all, whereas a missing flag
+ * only leaves the #2874 behaviour in place. Failures are cached too, so a codex
+ * that hangs on `--help` costs one timeout, not one per launch.
+ *
+ * Synchronous because `prepareLaunch` is. The child gets the sanitised
+ * environment: `executablePath` may be a bare name resolved off the server's
+ * `PATH`, and a `--help` probe has no use for CommandMate's credentials.
+ */
+function codexSupportsNoDaemon(executablePath) {
+    const cached = noDaemonSupportCache.get(executablePath);
+    if (cached !== undefined)
+        return cached;
+    let supported = false;
+    try {
+        const result = (0, child_process_1.spawnSync)(executablePath, ['--help'], {
+            encoding: 'utf8',
+            timeout: CODEX_HELP_PROBE_TIMEOUT_MS,
+            env: (0, env_sanitizer_1.sanitizeEnvForChildProcess)(),
+        });
+        supported =
+            !result.error &&
+                result.status === 0 &&
+                CODEX_NO_DAEMON_HELP_PATTERN.test(String(result.stdout ?? ''));
+    }
+    catch {
+        supported = false;
+    }
+    noDaemonSupportCache.set(executablePath, supported);
+    return supported;
+}
+/** Forget what {@link codexSupportsNoDaemon} has learned. Tests only. */
+function resetCodexNoDaemonSupportCacheForTests() {
+    noDaemonSupportCache.clear();
+}
 /**
  * `SessionEnd`'s budget, in seconds.
  *
@@ -573,8 +641,15 @@ function buildCodexLaunchPlan(executablePath, target, options = {}) {
             [exports.CODEX_EVENT_URL_ENV_VAR]: `http://${CODEX_HOOK_HOST}:${port}${hook_settings_generator_1.AGENT_EVENT_PATH}`,
             [exports.CODEX_PERMISSION_URL_ENV_VAR]: `http://${CODEX_HOOK_HOST}:${port}${hook_settings_generator_1.PERMISSION_REQUEST_PATH}?${query.toString()}`,
         };
+        const noDaemon = (options.supportsNoDaemon ?? codexSupportsNoDaemon(executablePath))
+            ? ` ${exports.CODEX_NO_DAEMON_FLAG}`
+            : '';
         const trust = isCodexHookTrustBypassEnabled() ? ` ${exports.CODEX_HOOK_TRUST_BYPASS_FLAG}` : '';
-        return { command: `${(0, hook_settings_generator_1.shellQuote)(executablePath)}${trust}`, settingsPath, env };
+        return {
+            command: `${(0, hook_settings_generator_1.shellQuote)(executablePath)} ${exports.CODEX_EMBEDDED_MODE_ARGS}${noDaemon}${trust}`,
+            settingsPath,
+            env,
+        };
     }
     catch (error) {
         logger.warn('codex-hooks-config-write-failed', {

package/dist/server/src/lib/polling/auto-yes-dialog-gate.js

@@ -54,13 +54,18 @@
  * @module lib/polling/auto-yes-dialog-gate
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.UNSUPPORTED_DIALOG_LAYOUT_REASON = exports.PROMPT_NO_LONGER_ACTIVE_REASON = exports.AUTO_YES_DIALOG_GATE_ENV_VAR = exports.AUTO_YES_DIALOG_GATE_DEFAULT_MODE = exports.AUTO_YES_DIALOG_GATE_MODES = void 0;
+exports.COMMAND_CODE_UNSUPPORTED_QUESTION_MESSAGE = exports.UNSUPPORTED_DIALOG_LAYOUT_REASON = exports.PROMPT_NO_LONGER_ACTIVE_REASON = exports.AUTO_YES_DIALOG_GATE_ENV_VAR = exports.AUTO_YES_DIALOG_GATE_DEFAULT_MODE = exports.AUTO_YES_DIALOG_GATE_MODES = void 0;
 exports.resolveAutoYesDialogGateMode = resolveAutoYesDialogGateMode;
 exports.evaluateAutoYesDialogGate = evaluateAutoYesDialogGate;
 exports.evaluateDialogPresence = evaluateDialogPresence;
 exports.judgePromptResponse = judgePromptResponse;
+exports.assessPromptAnswerability = assessPromptAnswerability;
 const frame_1 = require("../../lib/detection/tools/frame");
 const registry_1 = require("../../lib/detection/tools/registry");
+const prompt_detector_1 = require("../../lib/detection/prompt-detector");
+const cli_patterns_1 = require("../../lib/detection/cli-patterns");
+const dialog_1 = require("../../lib/detection/tools/antigravity/dialog");
+const dialog_2 = require("../../lib/detection/tools/command-code/dialog");
 /** Every accepted value of {@link AutoYesDialogGateMode}, for parsing and tests. */
 exports.AUTO_YES_DIALOG_GATE_MODES = ['enforce', 'legacy'];
 /**
@@ -309,3 +314,74 @@ function judgePromptResponse(promptCheck, presence) {
     }
     return { reason: exports.PROMPT_NO_LONGER_ACTIVE_REASON };
 }
+/**
+ * The refusal text for a Command Code question screen that is plainly up and
+ * could not be read (Issue #2522 確定仕様 B).
+ *
+ * Shares {@link UNSUPPORTED_DIALOG_LAYOUT_REASON} with Issue #2486's refusal —
+ * the reason code is what `respond --json` and the CLI branch on, and both cases
+ * are the same thing: a picker is on screen whose layout no rule could verify.
+ * The SENTENCE is its own because the next step differs in one respect worth
+ * saying out loud: this screen's LIST is what could not be read, so retrying
+ * once the pane has repainted is genuinely worth a try before walking over to it.
+ *
+ * Fixed text that never quotes the answer or the frame (SEC-003), so it is safe
+ * to return to a client verbatim.
+ */
+exports.COMMAND_CODE_UNSUPPORTED_QUESTION_MESSAGE = 'A Command Code question is on screen, but its option list could not be read, so no key was ' +
+    'sent. Answer it in the terminal, or retry once the screen has settled.';
+/**
+ * May this frame be answered from CommandMate? (Issue #2870)
+ *
+ * The ONE reading both `/prompt-response` (before it sends a key) and the status
+ * API (`promptAnswerable`, before the UI offers Send) use, so the two can no
+ * longer disagree: in #2868 the status API published a prompt off the generic
+ * parser alone while `/prompt-response` refused it, and Send did nothing.
+ *
+ * The order is the route's (#161, #2364, #2457, #2486, #2522): the tool's own
+ * reader (agy's `↑/↓ Navigate` dialog, Command Code's question) → the generic
+ * parser → {@link evaluateDialogPresence} → {@link judgePromptResponse}.
+ *
+ * @param cliToolId - CLI tool the frame came from
+ * @param frame - The capture itself (ANSI and box drawing intact). It is cleaned
+ *   here for the parsers; Command Code's reader and the presence gate read it as
+ *   captured (see {@link evaluateDialogPresence}).
+ */
+function assessPromptAnswerability(cliToolId, frame) {
+    const cleanOutput = (0, cli_patterns_1.stripBoxDrawing)((0, cli_patterns_1.stripAnsi)(frame));
+    const toolDialog = cliToolId === 'antigravity'
+        ? (0, dialog_1.detectAntigravityNumberedDialogPrompt)(cleanOutput)
+        : null;
+    const commandCodeQuestion = cliToolId === 'command-code'
+        ? (0, dialog_2.readCommandCodeQuestionDialog)(frame)
+        : { kind: 'none' };
+    // Plainly up and unreadable: refuse before the generic parser, whose partial
+    // list is exactly what must not reach a keystroke.
+    if (commandCodeQuestion.kind === 'unsupported') {
+        return {
+            promptCheck: { isPrompt: false, cleanContent: cleanOutput },
+            isCommandCodeQuestion: false,
+            refusal: {
+                reason: exports.UNSUPPORTED_DIALOG_LAYOUT_REASON,
+                message: exports.COMMAND_CODE_UNSUPPORTED_QUESTION_MESSAGE,
+            },
+            presence: {
+                present: false,
+                dialog: null,
+                mode: exports.AUTO_YES_DIALOG_GATE_DEFAULT_MODE[cliToolId] ?? 'legacy',
+                gated: false,
+            },
+        };
+    }
+    const isCommandCodeQuestion = commandCodeQuestion.kind === 'prompt';
+    const promptCheck = (commandCodeQuestion.kind === 'prompt' ? commandCodeQuestion.prompt : null)
+        ?? toolDialog
+        ?? (0, prompt_detector_1.detectPrompt)(cleanOutput, (0, cli_patterns_1.buildDetectPromptOptions)(cliToolId));
+    const presence = evaluateDialogPresence(cliToolId, promptCheck.promptData?.type, frame);
+    return {
+        promptCheck,
+        isCommandCodeQuestion,
+        refusal: judgePromptResponse(promptCheck, presence),
+        presence,
+    };
+}

package/dist/server/src/lib/realtime/terminal-broadcast.js

@@ -63,6 +63,11 @@ function snapshotFingerprint(payload) {
         payload.sessionStatus,
         payload.thinking ?? false,
         payload.isPromptWaiting ?? false,
+        // Issue #2887: so a redraw whose only change is this verdict (a dialog's
+        // answerability flipping between `#2870`'s judgement calls) still reaches
+        // the push, the same reason `sessionStatus` and the two dismiss-panel
+        // fields above are here.
+        payload.promptAnswerable ?? null,
         payload.isSelectionListActive ?? false,
         payload.isPagerActive ?? false,
         // Issue #2369: in the fingerprint for the same reason `sessionStatus` is —
@@ -96,6 +101,12 @@ function emitTerminalSnapshot(worktreeId, cliToolId, payload, instanceId) {
         thinking: payload.thinking ?? false,
         isPromptWaiting: payload.isPromptWaiting ?? false,
         promptData: payload.promptData ?? null,
+        // Issue #2887: straight through, unlike its neighbours above — not
+        // `?? false`. `buildCurrentOutput` publishes this only when it judged the
+        // prompt (#2870), and `undefined` here means "no verdict", which
+        // `JSON.stringify` (in `broadcast`) already drops from the wire on its own.
+        // Defaulting it would turn "not judged" into a judgement.
+        promptAnswerable: payload.promptAnswerable,
         isSelectionListActive: payload.isSelectionListActive ?? false,
         isPagerActive: payload.isPagerActive ?? false,
         isDismissablePanelActive: payload.isDismissablePanelActive ?? false,

package/dist/server/src/lib/session/adopt-legacy-sessions.js

@@ -0,0 +1,89 @@
+"use strict";
+/**
+ * Keep using this server's pre-namespace tmux sessions (Issue #2866).
+ *
+ * Once a namespace is set, `resolveSessionName` names a session
+ * `mcbd-{ns}-{cli}-{worktreeId}[-{suffix}]`. A session the same server started
+ * before that is still running under `mcbd-{cli}-{worktreeId}[-{suffix}]`, and
+ * would vanish from the UI while its agent keeps running. It is NOT renamed —
+ * an older CommandMate running beside this one, or this one after a downgrade,
+ * must still find it — but adopted: the new-format name is aliased to the
+ * legacy one (`legacy-session-alias.ts`), and the alias is dropped once the
+ * legacy session is killed or found gone.
+ *
+ * Only a session whose `#{session_path}` is the worktree's own directory is
+ * adopted (Issue #2865): the same legacy name may be another server's session.
+ *
+ * Runs once at startup, after `initSessionNamespace` and the worktree-ID
+ * session reconcile.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.adoptLegacySessions = adoptLegacySessions;
+const session_name_1 = require("../../lib/cli-tools/session-name");
+const session_namespace_1 = require("../../lib/cli-tools/session-namespace");
+const session_ownership_1 = require("../../lib/cli-tools/session-ownership");
+const legacy_session_adoption_1 = require("../../lib/cli-tools/legacy-session-adoption");
+const logger_1 = require("../../lib/logger");
+const session_instance_targets_1 = require("./session-instance-targets");
+const logger = (0, logger_1.createLogger)('adopt-legacy-sessions');
+/**
+ * Every worktree row. Queried directly rather than through `worktree-db`, for
+ * the same reason `worktree-session-reconcile.ts` does: suites mock that module.
+ */
+function readWorktrees(db) {
+    return db.prepare('SELECT id, path FROM worktrees').all();
+}
+/**
+ * Alias each worktree instance's new-format session name to its live legacy
+ * session, when the legacy session is this worktree's own and no new-format
+ * session exists yet.
+ *
+ * Never throws — a startup pass must not be able to stop the server.
+ *
+ * @param db - Database instance (worktrees and the agent roster)
+ */
+async function adoptLegacySessions(db, options) {
+    const result = { adopted: [], errors: [] };
+    const namespace = options?.namespace !== undefined ? options.namespace : (0, session_namespace_1.getSessionNamespace)();
+    // No namespace: the current name IS the legacy name, nothing to adopt.
+    if (namespace === null)
+        return result;
+    const list = options?.tmux?.listSessions ?? legacy_session_adoption_1.listSessions;
+    const isOwnedBy = options?.tmux?.isSessionOwnedBy ?? session_ownership_1.isSessionPathOwnedBy;
+    let livePaths;
+    let worktrees;
+    try {
+        const sessions = await list();
+        livePaths = new Map(sessions.map((session) => [session.name, session.path]));
+        worktrees = livePaths.size === 0 ? [] : readWorktrees(db);
+    }
+    catch (error) {
+        result.errors.push(error instanceof Error ? error.message : String(error));
+        logger.warn('adopt-legacy:failed', { error: result.errors[0] });
+        return result;
+    }
+    for (const worktree of worktrees) {
+        for (const { cliToolId, instanceId } of (0, session_instance_targets_1.collectInstanceTargets)(db, [worktree.id])) {
+            try {
+                const legacyName = (0, session_name_1.resolveLegacySessionName)(cliToolId, worktree.id, instanceId);
+                if (!livePaths.has(legacyName))
+                    continue;
+                const newName = (0, session_name_1.resolveNamespacedSessionName)(namespace, cliToolId, worktree.id, instanceId);
+                if (livePaths.has(newName))
+                    continue;
+                if (!isOwnedBy(livePaths.get(legacyName) ?? null, worktree.path))
+                    continue;
+                (0, legacy_session_adoption_1.registerLegacyAlias)(newName, legacyName);
+                result.adopted.push({ worktreeId: worktree.id, newName, legacyName });
+            }
+            catch (error) {
+                result.errors.push(`${worktree.id}/${instanceId}: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+    }
+    logger.info('adopt-legacy:complete', {
+        adopted: result.adopted.length,
+        errors: result.errors.length,
+    });
+    return result;
+}

package/dist/server/src/lib/session/claude-session.js

@@ -27,8 +27,9 @@ const child_process_1 = require("child_process");
 const util_1 = require("util");
 const promises_1 = require("fs/promises");
 const logger_1 = require("../../lib/logger");
+const session_ownership_1 = require("../../lib/cli-tools/session-ownership");
 const cli_tool_timing_config_1 = require("../../config/cli-tool-timing-config");
-const types_1 = require("../../lib/cli-tools/types");
+const session_name_1 = require("../../lib/cli-tools/session-name");
 const sources_1 = require("../../lib/hooks/sources");
 const hook_settings_generator_1 = require("../../lib/hooks/hook-settings-generator");
 const cmate_cli_tool_parser_1 = require("../../lib/cmate-cli-tool-parser");
@@ -340,9 +341,9 @@ async function ensureHealthySession(sessionName) {
  * Get tmux session name for a worktree
  *
  * Issue #868: Supports additional agent instances. The primary instance
- * (instanceId omitted or equal to 'claude') keeps the original
- * `mcbd-claude-{worktreeId}` name for backward compatibility. Additional
- * instances append a suffix derived from the instance ID.
+ * (instanceId omitted or equal to 'claude') carries no suffix; additional
+ * instances append a suffix derived from the instance ID. Issue #2866: the
+ * rule is `resolveSessionName`'s (server namespace included).
  *
  * @param worktreeId - Worktree ID
  * @param instanceId - Optional agent instance ID (defaults to primary)
@@ -355,12 +356,11 @@ async function ensureHealthySession(sessionName) {
  * ```
  */
 function getSessionName(worktreeId, instanceId) {
-    const base = `mcbd-claude-${worktreeId}`;
-    if (!instanceId || instanceId === 'claude') {
-        return base;
-    }
-    const suffix = (0, types_1.deriveSessionSuffix)(instanceId, 'claude');
-    return suffix ? `${base}-${suffix}` : base;
+    // Issue #2866: delegated so the server namespace and adopted legacy sessions
+    // apply to Claude exactly as to every other tool. A local copy of the rule
+    // would start, send to and stop `mcbd-claude-*` while capture and the UI
+    // address `mcbd-{ns}-claude-*`.
+    return (0, session_name_1.resolveSessionName)('claude', worktreeId, instanceId);
 }
 /**
  * Check if Claude is installed and available
@@ -486,6 +486,9 @@ async function startClaudeSession(options) {
     // Check if session already exists
     const exists = await (0, tmux_1.hasSession)(sessionName);
     if (exists) {
+        // Issue #2865: a same-named session another CommandMate server created is
+        // refused before the health check can kill or reuse it.
+        await (0, session_ownership_1.assertSessionNotForeign)(sessionName, worktreePath);
         // SF-S2-004: Health check on existing session
         const healthy = await ensureHealthySession(sessionName);
         if (healthy) {

package/dist/server/src/lib/session/current-output-builder.js

@@ -85,6 +85,7 @@ const prompt_waiting_composition_1 = require("../../lib/session/prompt-waiting-c
 const provisional_turn_1 = require("../../lib/session/provisional-turn");
 const status_evidence_1 = require("../../lib/session/status-evidence");
 const ask_user_question_prompt_1 = require("../../lib/session/ask-user-question-prompt");
+const auto_yes_dialog_gate_1 = require("../../lib/polling/auto-yes-dialog-gate");
 const layer_disagreement_1 = require("../../lib/session/layer-disagreement");
 const structured_prompt_1 = require("../../lib/session/structured-prompt");
 const logger = (0, logger_1.createLogger)('current-output-builder');
@@ -632,6 +633,9 @@ async function buildPayload(db, worktreeId, cliToolId, instanceId) {
     const resolvedInstanceId = instanceId ?? cliToolId;
     const manager = manager_1.CLIToolManager.getInstance();
     const cliTool = manager.getTool(cliToolId);
+    // Issue #2886: read once, independent of `isRunning`, so both return paths
+    // below publish the same value the pane is (or would be) reached at.
+    const sessionName = cliTool.getSessionName(worktreeId, instanceId);
     const stopEventAt = (0, agent_event_state_1.getLastStopEventAt)(worktreeId, cliToolId, instanceId);
     const lastEvent = (0, agent_event_state_1.getLastAgentEvent)(worktreeId, cliToolId, instanceId);
     // Issue #1924: the registry answers for every tool — a real implementation
@@ -743,6 +747,7 @@ async function buildPayload(db, worktreeId, cliToolId, instanceId) {
         (0, status_evidence_1.forgetLastKnownStatus)((0, auto_yes_manager_1.buildCompositeKey)(worktreeId, cliToolId, instanceId));
         return {
             isRunning: false,
+            sessionName,
             content: '',
             lineCount: 0,
             cliToolId,
@@ -1029,6 +1034,17 @@ async function buildPayload(db, worktreeId, cliToolId, instanceId) {
         : structuredFacts
             ? (0, structured_prompt_1.buildStructuredPromptData)(worktreeId, structuredFacts)
             : null;
+    // Issue #2870: whether `/prompt-response` would answer the prompt published
+    // above, read by the SAME function it re-verifies with. In #2868 `promptData`
+    // came off the generic parser alone, the route refused it, and the UI's Send
+    // did nothing. Only for a parser-read prompt: the structured form (hook
+    // `decisionId`, degraded) is answered by id or not by number at all, so the
+    // key is left out there, as it is when no prompt is up. `isPromptWaiting` /
+    // `promptData` / `sessionStatus` are untouched — `wait`'s exit 10, Auto-Yes
+    // and push notifications keep reading exactly what they read before.
+    const promptAnswerable = scraperPromptWaiting && (correctedPromptData ?? scraperPromptData)
+        ? (0, auto_yes_dialog_gate_1.assessPromptAnswerability)(cliToolId, output).refusal === null
+        : undefined;
     // Issue #1723 §3: the field data this Epic is being built on. Every line is
     // one poll where the screen and the agent disagreed about what the agent was
     // doing, which is the only way to answer "how wrong was the scraper?" with a
@@ -1165,6 +1181,7 @@ async function buildPayload(db, worktreeId, cliToolId, instanceId) {
     const lastKnown = (0, status_evidence_1.getLastKnownStatus)(compositeKey);
     return {
         isRunning: true,
+        sessionName,
         cliToolId,
         sessionStatus: merged.status,
         sessionStatusReason: merged.reason,
@@ -1181,6 +1198,7 @@ async function buildPayload(db, worktreeId, cliToolId, instanceId) {
         thinkingMessage: merged.thinking ? `${(0, types_2.getCliToolDisplayName)(cliToolId)} is thinking...` : null,
         isPromptWaiting,
         promptData,
+        ...(promptAnswerable !== undefined ? { promptAnswerable } : {}),
         autoYes: {
             enabled: autoYesState?.enabled ?? false,
             expiresAt: autoYesState?.enabled ? autoYesState.expiresAt : null,

package/dist/server/src/lib/session/send-user-message.js

@@ -44,6 +44,8 @@ const assistant_response_saver_1 = require("../../lib/assistant-response-saver")
 const ws_server_1 = require("../../lib/ws-server");
 const types_2 = require("../../lib/realtime/types");
 const logger_1 = require("../../lib/logger");
+const worktree_session_ownership_1 = require("../../lib/cli-tools/worktree-session-ownership");
+const session_name_1 = require("../../lib/cli-tools/session-name");
 const prompt_waiting_guard_1 = require("../../lib/session/prompt-waiting-guard");
 const opencode_1 = require("../../lib/cli-tools/opencode");
 const logger = (0, logger_1.createLogger)('session/send-user-message');
@@ -108,6 +110,30 @@ async function sendUserMessage(db, params) {
      */
     const resolvedInstanceId = instanceId ?? cliToolId;
     const cliTool = manager_1.CLIToolManager.getInstance().getTool(cliToolId);
+    // Issue #2865: the send route checks ownership itself, but the timer manager
+    // and relay delivery reach tmux only through here. A session under this
+    // worktree's name that was created in another directory belongs to another
+    // CommandMate server; nothing is typed into it and no poller watches it.
+    // Checked before the prompt guard, which would otherwise read that pane.
+    const sessionName = (0, session_name_1.resolveSessionName)(cliToolId, worktreeId, instanceId);
+    const ownership = await (0, worktree_session_ownership_1.checkWorktreeSessionOwnership)(worktreeId, sessionName, db);
+    if (ownership === null || ownership.verdict === 'foreign') {
+        logger.warn('send-refused-foreign-session', {
+            worktreeId,
+            cliToolId,
+            instanceId: resolvedInstanceId,
+            sessionName,
+            sessionPath: ownership?.sessionPath ?? null,
+            reason: ownership ? 'foreign' : 'worktree_not_found',
+        });
+        return {
+            ok: false,
+            stage: 'foreign_session',
+            error: ownership
+                ? `tmux session "${sessionName}" belongs to another CommandMate server`
+                : `Worktree '${worktreeId}' not found; cannot confirm tmux session "${sessionName}" is this server's`,
+        };
+    }
     // Issue #1708: refuse before the first side effect. A prompt dialog does not
     // forward keystrokes to the agent — they accumulate in its own input line — so
     // the message is lost AND the next `respond` has to answer a prompt whose

package/dist/server/src/lib/session/session-instance-targets.js

@@ -0,0 +1,53 @@
+"use strict";
+/**
+ * Every (CLI tool, instance) pair whose tmux session could belong to a worktree
+ * (Issue #1621, extracted for #2866).
+ *
+ * Shared by the startup passes that predict session names from the database —
+ * `worktree-session-reconcile.ts` (ID moves) and `adopt-legacy-sessions.ts`
+ * (legacy-name adoption) — so both enumerate the same set.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.collectInstanceTargets = collectInstanceTargets;
+const types_1 = require("../../lib/cli-tools/types");
+const agent_instances_db_1 = require("../../lib/db/agent-instances-db");
+/**
+ * The primary instance of every CLI tool, plus every roster row under any of
+ * `worktreeIds`.
+ *
+ * The primary instance of every CLI tool is always included — a worktree that
+ * predates the roster (#1000) has no `agent_instances` rows at all yet can
+ * absolutely have a running `mcbd-claude-<id>` session.
+ *
+ * @param db - Database instance (read for the agent roster)
+ * @param worktreeIds - The worktree IDs whose roster rows to include
+ */
+function collectInstanceTargets(db, worktreeIds) {
+    const seen = new Set();
+    const targets = [];
+    const add = (cliToolId, instanceId) => {
+        const key = `${cliToolId}|${instanceId}`;
+        if (seen.has(key))
+            return;
+        seen.add(key);
+        targets.push({ cliToolId, instanceId });
+    };
+    for (const cliToolId of types_1.CLI_TOOL_IDS)
+        add(cliToolId, cliToolId);
+    for (const worktreeId of worktreeIds) {
+        let instances;
+        try {
+            instances = (0, agent_instances_db_1.getAgentInstances)(db, worktreeId);
+        }
+        catch {
+            // No agent_instances table (older database) — the primary instances above
+            // already cover the pre-roster shape.
+            continue;
+        }
+        for (const instance of instances) {
+            if ((0, types_1.isCliToolType)(instance.cliTool))
+                add(instance.cliTool, instance.id);
+        }
+    }
+    return targets;
+}

package/dist/server/src/lib/session/tmux-session-surface.js

@@ -3,9 +3,9 @@
  * The tmux "surface" CommandMate publishes on its own sessions (Issue #2317).
  *
  * Everything here is a pure argument builder or a pure predicate — no
- * `child_process`, no `@/` path alias, and one constants import. Three
- * constraints put it here rather than under `lib/tmux/`, and all three are
- * load-bearing:
+ * `child_process`, no `@/` path alias, one constants import and the pure
+ * session-name parser. Three constraints put it here rather than under
+ * `lib/tmux/`, and all three are load-bearing:
  *
  * 1. **`tsconfig.cli.json` sets `"paths": {}`.** The CLI bundle resolves nothing
  *    through `@/…`, so a module the `attach` command needs may only reach the
@@ -67,6 +67,10 @@ exports.buildRemoveAutoPopupHookArgs = buildRemoveAutoPopupHookArgs;
 exports.buildDelegateGeometryCommands = buildDelegateGeometryCommands;
 exports.buildRestoreGeometryCommands = buildRestoreGeometryCommands;
 const tmux_pane_config_1 = require("../../config/tmux-pane-config");
+// Relative on purpose (constraint 1 above). `session-name.ts` is already part of
+// the CLI bundle (`commands/attach.ts` imports it) and reaches nothing through
+// `@/…`, so it costs the bundle nothing new (Issue #2866).
+const session_name_1 = require("../cli-tools/session-name");
 /**
  * Session-name prefix every CommandMate tmux session carries.
  *
@@ -308,8 +312,9 @@ function isLiveAttachSupported(cliToolId) {
 /**
  * Whether a tmux session's NAME says it runs a tool `--live` supports.
  *
- * The session name is `mcbd-<tool>-<worktree>` and no supported tool id is a
- * prefix of another, so this is exact rather than a guess. It exists because
+ * The session name is `mcbd-[<ns>-]<tool>-<worktree>` and `parseSessionName`
+ * reads the tool out of either form (Issue #2866), so this is exact rather
+ * than a guess. It exists because
  * the two callers that need the answer — the attach hook script's installer and
  * the response poller — hold a session name and nothing else: a hook fires with
  * tmux formats, and the poller must not pay a tmux round-trip to ask about a
@@ -320,7 +325,8 @@ function isLiveAttachSupported(cliToolId) {
 function isLiveAttachEligibleSession(sessionName) {
     if (!isCommandMateSession(sessionName))
         return false;
-    return exports.LIVE_ATTACH_TOOLS.some((tool) => sessionName.startsWith(`${exports.MCBD_SESSION_PREFIX}${tool}-`));
+    const cliToolId = (0, session_name_1.parseSessionName)(sessionName)?.cliToolId;
+    return cliToolId !== undefined && exports.LIVE_ATTACH_TOOLS.includes(cliToolId);
 }
 /**
  * CLI tools that paint their transcript in the terminal's alternate screen.
@@ -331,8 +337,9 @@ function isLiveAttachEligibleSession(sessionName) {
  * else. `attach` prints its hint for exactly these.
  *
  * Deliberately a local list rather than an import of `usesAlternateScreen()`:
- * this module must stay free of `lib/cli-tools`, whose graph the CLI bundle
- * cannot afford (see the module docblock). The two are pinned to each other by
+ * this module must stay free of `lib/cli-tools` beyond the pure
+ * `session-name.ts`, whose tool graph the CLI bundle cannot afford (see the
+ * module docblock). The two are pinned to each other by
  * `tests/unit/tmux/session-surface-2317.test.ts`, so a tool moving in or out of
  * the alternate screen breaks a test rather than silently dropping the hint.
  */