commandmate 0.41.1 → 0.42.1

package/dist/server/src/lib/session/worktree-session-reconcile.js

@@ -74,11 +74,15 @@ exports.reconcileWorktreeSessions = reconcileWorktreeSessions;
 exports.reconcileWorktreeSessionsFromAliases = reconcileWorktreeSessionsFromAliases;
 const manager_1 = require("../../lib/cli-tools/manager");
 const types_1 = require("../../lib/cli-tools/types");
-const validation_1 = require("../../lib/cli-tools/validation");
 const agent_instances_db_1 = require("../../lib/db/agent-instances-db");
+const validation_1 = require("../../lib/cli-tools/validation");
+const session_name_1 = require("../../lib/cli-tools/session-name");
+const session_namespace_1 = require("../../lib/cli-tools/session-namespace");
+const session_instance_targets_1 = require("./session-instance-targets");
 const worktree_alias_db_1 = require("../../lib/db/worktree-alias-db");
 const path_validator_1 = require("../../lib/security/path-validator");
 const tmux_1 = require("../../lib/tmux/tmux");
+const session_ownership_1 = require("../../lib/tmux/session-ownership");
 const control_mode_tmux_transport_1 = require("../../lib/tmux/control-mode-tmux-transport");
 const auto_yes_manager_1 = require("../../lib/polling/auto-yes-manager");
 const response_poller_1 = require("../../lib/polling/response-poller");
@@ -131,44 +135,16 @@ function normalizeRenames(renames) {
  * The roster is read for BOTH IDs because the caller may reconcile either side
  * of the DB move: after `migrateWorktreeIdPreservingChildren` the rows sit under
  * `newId`, but a caller reconciling ahead of the move still finds them under
- * `oldId`. The primary instance of every CLI tool is always included — a
- * worktree that predates the roster (#1000) has no `agent_instances` rows at all
- * yet can absolutely have a running `mcbd-claude-<id>` session.
+ * `oldId`.
  */
-function collectInstanceTargets(db, rename) {
-    const seen = new Set();
-    const targets = [];
-    const add = (cliToolId, instanceId) => {
-        const key = `${cliToolId}|${instanceId}`;
-        if (seen.has(key))
-            return;
-        seen.add(key);
-        targets.push({ cliToolId, instanceId });
-    };
-    for (const cliToolId of types_1.CLI_TOOL_IDS)
-        add(cliToolId, cliToolId);
-    for (const worktreeId of [rename.newId, rename.oldId]) {
-        let instances;
-        try {
-            instances = (0, agent_instances_db_1.getAgentInstances)(db, worktreeId);
-        }
-        catch {
-            // No agent_instances table (older database) — the primary instances above
-            // already cover the pre-roster shape.
-            continue;
-        }
-        for (const instance of instances) {
-            if ((0, types_1.isCliToolType)(instance.cliTool))
-                add(instance.cliTool, instance.id);
-        }
-    }
-    return targets;
+function collectRenameInstanceTargets(db, rename) {
+    return (0, session_instance_targets_1.collectInstanceTargets)(db, [rename.newId, rename.oldId]);
 }
 /** Build the (old session name → new session name) plan for one ID move. */
 function planSessionRenames(db, rename, errors) {
     const manager = manager_1.CLIToolManager.getInstance();
     const plans = [];
-    for (const { cliToolId, instanceId } of collectInstanceTargets(db, rename)) {
+    for (const { cliToolId, instanceId } of collectRenameInstanceTargets(db, rename)) {
         try {
             const tool = manager.getTool(cliToolId);
             const oldName = tool.getSessionName(rename.oldId, instanceId);
@@ -243,27 +219,33 @@ function collectKnownWorktreeIds(db, renames) {
  * @param knownIds - Every worktree ID the database can vouch for
  * @returns The attribution, or `null` when nothing in `knownIds` explains the name
  */
-function attributeSessionName(name, knownIds) {
-    for (const cliToolId of types_1.CLI_TOOL_IDS) {
-        const prefix = `mcbd-${cliToolId}-`;
-        if (!name.startsWith(prefix))
-            continue;
-        // No CLI tool id is a prefix of another, so at most one branch is entered
-        // and the remainder is unambiguously `<id>[-<suffix>]`.
-        const rest = name.slice(prefix.length);
-        let candidate = rest;
-        for (;;) {
-            if (knownIds.has(candidate)) {
-                const suffix = candidate.length === rest.length ? undefined : rest.slice(candidate.length + 1);
-                return { cliToolId, worktreeId: candidate, suffix: suffix || undefined };
-            }
-            const cut = candidate.lastIndexOf('-');
-            if (cut <= 0)
-                return null;
-            candidate = candidate.slice(0, cut);
+function attributeSessionName(name, knownIds, namespace = (0, session_namespace_1.getSessionNamespace)()) {
+    // Issue #2866: legacy names and names in this server's namespace only. A name
+    // in another namespace is another server's session, whatever ID it carries.
+    const parsed = (0, session_name_1.parseSessionName)(name);
+    if (!parsed)
+        return null;
+    if (parsed.namespace !== null && parsed.namespace !== namespace)
+        return null;
+    // No CLI tool id is a prefix of another, so the remainder is unambiguously
+    // `<id>[-<suffix>]`.
+    const { cliToolId, rest } = parsed;
+    let candidate = rest;
+    for (;;) {
+        if (knownIds.has(candidate)) {
+            const suffix = candidate.length === rest.length ? undefined : rest.slice(candidate.length + 1);
+            return { cliToolId, worktreeId: candidate, suffix: suffix || undefined };
         }
+        const cut = candidate.lastIndexOf('-');
+        if (cut <= 0)
+            return null;
+        candidate = candidate.slice(0, cut);
     }
-    return null;
+}
+/** Whether a live name is another server's namespaced session (Issue #2866). */
+function isOtherNamespaceSession(name, namespace) {
+    const parsed = (0, session_name_1.parseSessionName)(name);
+    return parsed !== null && parsed.namespace !== null && parsed.namespace !== namespace;
 }
 /**
  * Read the live session list the other way round: attribute each name to a
@@ -277,10 +259,14 @@ function attributeSessionName(name, knownIds) {
 function discoverSessionRenames(renames, liveNames, knownIds, result) {
     const byOldId = new Map(renames.map((rename) => [rename.oldId, rename]));
     const plans = [];
+    const namespace = (0, session_namespace_1.getSessionNamespace)();
     for (const name of liveNames) {
         if (!name.startsWith('mcbd-'))
             continue;
-        const attributed = attributeSessionName(name, knownIds);
+        // Issue #2866: another server's namespace — neither attributed nor reported.
+        if (isOtherNamespaceSession(name, namespace))
+            continue;
+        const attributed = attributeSessionName(name, knownIds, namespace);
         if (!attributed) {
             result.unaccountedSessions.push(name);
             continue;
@@ -291,7 +277,8 @@ function discoverSessionRenames(renames, liveNames, knownIds, result) {
         try {
             const tool = manager_1.CLIToolManager.getInstance().getTool(attributed.cliToolId);
             // Rebuilt through getSessionName rather than by string surgery so the
-            // suffix convention stays owned by one place (`cli-tools/base.ts`).
+            // suffix convention stays owned by one place (`cli-tools/session-name.ts`).
+            // A legacy-form source lands on the current form (Issue #2866).
             const instanceId = attributed.suffix
                 ? (0, types_1.buildInstanceId)(attributed.cliToolId, attributed.suffix)
                 : attributed.cliToolId;
@@ -322,6 +309,58 @@ function mergeSessionPlans(predicted, discovered) {
     }
     return Array.from(byOldName.values());
 }
+/**
+ * The path of a worktree row, or null. Queried directly for the same reason
+ * {@link collectKnownWorktreeIds} is (suites mock `worktree-db`).
+ */
+function readWorktreePath(db, worktreeId) {
+    try {
+        const row = db.prepare('SELECT path FROM worktrees WHERE id = ?').get(worktreeId);
+        return row?.path ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Drop the plans whose live source session another CommandMate server created
+ * (Issue #2865).
+ *
+ * Session names carry no server identity, so a live `mcbd-claude-<old>` may be
+ * a different server's session that merely shares the worktree ID. Only a
+ * session whose `#{session_path}` is the worktree's own directory is renamed;
+ * the rest are reported in `skippedSessions`. The directory comes from the
+ * rename target's row, falling back to the source's row when the pass runs
+ * ahead of the DB move. A plan whose worktree has no row at all cannot be
+ * vouched for and is skipped too (fail safe).
+ */
+function excludeForeignSessionPlans(db, plans, live, livePaths, deps, result) {
+    const owned = [];
+    for (const plan of plans) {
+        // Not live: renameSessionsTwoStage drops it without counting it.
+        if (!live.has(plan.oldName)) {
+            owned.push(plan);
+            continue;
+        }
+        const worktreePath = readWorktreePath(db, plan.rename.newId) ?? readWorktreePath(db, plan.rename.oldId);
+        const sessionPath = livePaths.get(plan.oldName) ?? null;
+        if (worktreePath !== null && deps.isSessionOwnedBy(sessionPath, worktreePath)) {
+            owned.push(plan);
+            continue;
+        }
+        result.skippedSessions.push({
+            oldName: plan.oldName,
+            newName: plan.newName,
+            reason: 'session owned by another server',
+        });
+        logger.warn('reconcile:foreign-session-skipped', {
+            sessionName: plan.oldName,
+            sessionPath,
+            worktreePath,
+        });
+    }
+    return owned;
+}
 /** Mint a session name that is free both on the server and within this pass. */
 function allocateTempName(taken, ordinal) {
     let candidate = `${TEMP_SESSION_PREFIX}${ordinal}`;
@@ -501,13 +540,18 @@ async function reconcileWorktreeSessions(db, renamesOrOldId, newIdOrOptions, may
     const deps = {
         listSessions: options?.tmux?.listSessions ?? tmux_1.listSessions,
         renameSession: options?.tmux?.renameSession ?? tmux_1.renameSession,
+        isSessionOwnedBy: options?.tmux?.isSessionOwnedBy ?? (0, session_ownership_1.createCachedOwnershipMatcher)(),
     };
     // Listed once, up front: both the prediction pass and the attribution pass
     // need it, and it is what makes a startup with nothing stale cost exactly one
     // `tmux list-sessions`.
     let live = null;
+    const livePaths = new Map();
     try {
-        live = new Set((await deps.listSessions()).map((session) => session.name));
+        const sessions = await deps.listSessions();
+        live = new Set(sessions.map((session) => session.name));
+        for (const session of sessions)
+            livePaths.set(session.name, session.path);
     }
     catch (error) {
         result.errors.push(`list tmux sessions: ${error instanceof Error ? error.message : String(error)}`);
@@ -527,7 +571,8 @@ async function reconcileWorktreeSessions(db, renamesOrOldId, newIdOrOptions, may
             else
                 result.planSources.discovered++;
         }
-        await renameSessionsTwoStage(plans, live, deps, result);
+        const ownedPlans = excludeForeignSessionPlans(db, plans, live, livePaths, deps, result);
+        await renameSessionsTwoStage(ownedPlans, live, deps, result);
     }
     // Runtime state moves after the sessions: a poller that ticks in between
     // fails one capture against a name that is briefly gone, which is a logged

package/dist/server/src/lib/session-cleanup.js

@@ -12,6 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.cleanupWorktreeSessions = cleanupWorktreeSessions;
 exports.cleanupMultipleWorktrees = cleanupMultipleWorktrees;
 exports.killWorktreeSession = killWorktreeSession;
+exports.createOwnedSessionKiller = createOwnedSessionKiller;
 exports.cleanupGlobalSessions = cleanupGlobalSessions;
 exports.syncWorktreesAndCleanup = syncWorktreesAndCleanup;
 const response_poller_1 = require("./polling/response-poller");
@@ -27,6 +28,8 @@ const logger_1 = require("../lib/logger");
 const manager_1 = require("./cli-tools/manager");
 const tmux_1 = require("./tmux/tmux");
 const worktrees_1 = require("./git/worktrees");
+const worktree_db_1 = require("./db/worktree-db");
+const session_ownership_1 = require("./cli-tools/session-ownership");
 const logger = (0, logger_1.createLogger)('session-cleanup');
 /**
  * Clean up all CLI tool sessions and pollers for a single worktree
@@ -164,26 +167,50 @@ async function cleanupMultipleWorktrees(worktreeIds, killSessionFn) {
  * MF-C01: getTool() throws Error if tool not found, wrapped in try-catch
  * SF-004: isRunning() correctly awaited
  *
+ * Issue #2865: only a session created in `worktreePath` is killed. A
+ * same-named session another CommandMate server created (the worktree ID is
+ * derived from the directory name, so two servers can share it) is left alone
+ * and `false` is returned.
+ *
  * @param worktreeId - Worktree ID
  * @param cliToolId - CLI tool type
+ * @param worktreePath - The worktree's directory, read from its row BEFORE the row is deleted
  * @returns true if session was killed, false otherwise
  */
-async function killWorktreeSession(worktreeId, cliToolId) {
+async function killWorktreeSession(worktreeId, cliToolId, worktreePath) {
     try {
         const manager = manager_1.CLIToolManager.getInstance();
         const tool = manager.getTool(cliToolId); // throws Error if not found
         if (!await tool.isRunning(worktreeId))
             return false; // SF-004: await
+        const sessionName = tool.getSessionName(worktreeId);
+        const ownership = await (0, session_ownership_1.checkSessionOwnership)(sessionName, worktreePath);
+        if (ownership.verdict !== 'owned')
+            return false;
         // Issue #565: Clear prompt dedup cache on session kill
         const pollerKey = `${worktreeId}:${cliToolId}`;
         (0, response_poller_1.clearPromptHashCache)(pollerKey);
-        const sessionName = tool.getSessionName(worktreeId);
         return (0, tmux_1.killSession)(sessionName);
     }
     catch {
         return false;
     }
 }
+/**
+ * A {@link KillSessionFn} that kills through {@link killWorktreeSession} with
+ * each worktree's pre-deletion path (Issue #2865). A worktree with no known
+ * path cannot be vouched for, so nothing is killed for it.
+ *
+ * @param pathById - worktree ID -> path, captured before the rows are deleted
+ */
+function createOwnedSessionKiller(pathById) {
+    return async (worktreeId, cliToolId) => {
+        const worktreePath = pathById.get(worktreeId);
+        if (worktreePath === undefined)
+            return false;
+        return killWorktreeSession(worktreeId, cliToolId, worktreePath);
+    };
+}
 /**
  * Clean up all global assistant sessions.
  * Issue #649: Kill any orphaned mcbd-{cli_tool_id}-__global__ tmux sessions
@@ -233,6 +260,9 @@ async function cleanupGlobalSessions() {
  * @returns SyncResult and sanitized cleanupWarnings
  */
 async function syncWorktreesAndCleanup(db, worktrees) {
+    // Issue #2865: the rows sync deletes are gone afterwards, and their paths are
+    // what decides which sessions are this server's to kill.
+    const pathById = new Map((0, worktree_db_1.getAllWorktreePathIds)(db).map((row) => [row.id, row.path]));
     const syncResult = (0, worktrees_1.syncWorktreesToDB)(db, worktrees);
     // Issue #649: Clean up orphaned global assistant sessions
     try {
@@ -244,7 +274,7 @@ async function syncWorktreesAndCleanup(db, worktrees) {
     let cleanupWarnings = [];
     if (syncResult.deletedIds.length > 0) {
         try {
-            const cleanupResult = await cleanupMultipleWorktrees(syncResult.deletedIds, killWorktreeSession);
+            const cleanupResult = await cleanupMultipleWorktrees(syncResult.deletedIds, createOwnedSessionKiller(pathById));
             if (cleanupResult.warnings.length > 0) {
                 // SEC-MF-001: Log detailed warnings server-side only
                 logger.warn('sync:cleanup-warnings', { warnings: cleanupResult.warnings });

package/dist/server/src/lib/tmux/legacy-session-alias.js

@@ -0,0 +1,64 @@
+"use strict";
+/**
+ * Legacy tmux session adoption table (Issue #2866).
+ *
+ * Once the server has a session-name namespace, a session is named
+ * `mcbd-{ns}-{cli}-{worktreeId}[-{suffix}]`. Sessions the same server started
+ * before that (`mcbd-{cli}-{worktreeId}[-{suffix}]`) are NOT renamed — a rename
+ * would lose them for an older CommandMate running beside this one, or after a
+ * downgrade. Instead `adoptLegacySessions` records "the new-format name X is
+ * served by the legacy session Y", and `resolveSessionName` returns Y for X
+ * while the entry lives.
+ *
+ * An entry is dropped when its legacy session is killed or found gone
+ * (`tmux.ts` `killSession` / `hasSession`), so the next start uses the
+ * new-format name.
+ *
+ * Pure (no `@/` alias, no child_process): `cli-tools/session-name.ts` reads it,
+ * and that module is part of the CLI bundle (`tsconfig.cli.json` has no paths).
+ *
+ * Kept on `globalThis` rather than in module scope: under `next start` this
+ * module is evaluated once in the custom server's graph and again in each Next
+ * route bundle (see `tui-accumulator.ts`, Issue #2223), and the table is filled
+ * by the server at startup but read by the routes.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerLegacyAlias = registerLegacyAlias;
+exports.lookupLegacyAlias = lookupLegacyAlias;
+exports.dropLegacyAliasByLegacyName = dropLegacyAliasByLegacyName;
+exports.clearLegacyAliasesForTests = clearLegacyAliasesForTests;
+function aliases() {
+    return (globalThis.__cmLegacySessionAliases ??= new Map());
+}
+/**
+ * Serve the new-format session name `newName` with the existing legacy session
+ * `legacyName`.
+ */
+function registerLegacyAlias(newName, legacyName) {
+    aliases().set(newName, legacyName);
+}
+/** The legacy session name adopted for `newName`, if any. */
+function lookupLegacyAlias(newName) {
+    return aliases().get(newName);
+}
+/**
+ * Forget every adoption served by the legacy session `legacyName`. A no-op for
+ * a name that is not an adopted legacy session.
+ *
+ * @returns true when an entry was removed
+ */
+function dropLegacyAliasByLegacyName(legacyName) {
+    const table = aliases();
+    let dropped = false;
+    for (const [newName, legacy] of table) {
+        if (legacy === legacyName) {
+            table.delete(newName);
+            dropped = true;
+        }
+    }
+    return dropped;
+}
+/** Test-only: forget every adoption. */
+function clearLegacyAliasesForTests() {
+    aliases().clear();
+}

package/dist/server/src/lib/tmux/session-hook-scripts.js

@@ -114,12 +114,20 @@ tmux set-option -u -t "=$SESSION:" @cm_delegated 2>/dev/null || true
  * `CM_LIVE_ATTACH_HOOK=on`.
  *
  * claude-only by session-name prefix, and that is not a shortcut. The session
- * name is `mcbd-<tool>-<worktree>`, no other CLI tool id begins with `claude`,
- * and the script has nothing but the name to go on — a hook fires with tmux
- * formats, not with CommandMate's roster. Widening it means widening
+ * name is `mcbd-<ns>-<tool>-<worktree>` or the legacy `mcbd-<tool>-<worktree>`
+ * (Issue #2866), no other CLI tool id begins with `claude`, and the script has
+ * nothing but the name to go on — a hook fires with tmux formats, not with
+ * CommandMate's roster. The namespace is matched as exactly eight hex digits
+ * (Issue #2867), not `*`: `mcbd-*-claude-*` would also match a legacy codex
+ * session of a worktree whose id starts with `claude-`. Widening it means widening
  * `LIVE_ATTACH_TOOLS` too, and that needs the per-tool re-measurement
  * Issue #2317 puts out of scope.
  */
+/**
+ * A session-name namespace as a shell `case` glob: eight hex digits, the shape
+ * `SESSION_NAMESPACE_PATTERN` accepts (Issue #2866 / #2867).
+ */
+const NAMESPACE_GLOB = '[0-9a-f]'.repeat(8);
 exports.LIVE_DELEGATE_SCRIPT = `#!/bin/sh
 # CommandMate live-attach delegate (Issue #2317) — generated file, edits are overwritten.
 #
@@ -141,7 +149,7 @@ SESSION="\${1:-}"
 CONTROL_MODE="\${2:-0}"
 
 case "$SESSION" in
-  ${tmux_session_surface_1.MCBD_SESSION_PREFIX}claude-*) ;;
+  ${tmux_session_surface_1.MCBD_SESSION_PREFIX}claude-*|${tmux_session_surface_1.MCBD_SESSION_PREFIX}${NAMESPACE_GLOB}-claude-*) ;;
   *) exit 0 ;;
 esac
 

package/dist/server/src/lib/tmux/session-ownership.js

@@ -0,0 +1,174 @@
+"use strict";
+/**
+ * tmux session ownership (Issue #2865)
+ *
+ * Session names (`mcbd-{cli}-{worktreeId}`) carry nothing that identifies the
+ * CommandMate server that created them, and worktree IDs are derived from the
+ * directory name — so two servers with different DBs and different worktree
+ * paths can resolve the SAME session name on the shared default tmux socket.
+ * Deciding "is it running?" by name alone then shows, types into, kills and
+ * adopts the OTHER server's session.
+ *
+ * CommandMate always creates sessions with `tmux new-session -c <worktree.path>`,
+ * so `#{session_path}` records which worktree a session belongs to. A session is
+ * "owned" only when the realpath of its `#{session_path}` equals the realpath of
+ * the worktree's path; anything else under the same name is "foreign" and is
+ * excluded from display, input, stop and reuse.
+ *
+ * A worktree whose directory has since moved therefore sees its old session as
+ * foreign. That is intentional (fail safe).
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ForeignSessionError = exports.FOREIGN_SESSION_ERROR_CODE = void 0;
+exports.normalizeOwnershipPath = normalizeOwnershipPath;
+exports.isSessionPathOwnedBy = isSessionPathOwnedBy;
+exports.createCachedOwnershipMatcher = createCachedOwnershipMatcher;
+exports.reportForeignSession = reportForeignSession;
+exports.resetForeignSessionWarningsForTesting = resetForeignSessionWarningsForTesting;
+exports.checkSessionOwnership = checkSessionOwnership;
+exports.assertSessionNotForeign = assertSessionNotForeign;
+exports.foreignSessionErrorBody = foreignSessionErrorBody;
+exports.ownedSessionNameSet = ownedSessionNameSet;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const logger_1 = require("../../lib/logger");
+const tmux_1 = require("./tmux");
+const logger = (0, logger_1.createLogger)('session-ownership');
+exports.FOREIGN_SESSION_ERROR_CODE = 'session_owned_by_other_server';
+/**
+ * Thrown when a code path would adopt / drive a session another server owns.
+ */
+class ForeignSessionError extends Error {
+    sessionName;
+    sessionPath;
+    worktreePath;
+    code = exports.FOREIGN_SESSION_ERROR_CODE;
+    constructor(sessionName, sessionPath, worktreePath) {
+        super(`tmux session "${sessionName}" belongs to another server ` +
+            `(session_path=${sessionPath ?? 'unknown'}, worktree=${worktreePath})`);
+        this.sessionName = sessionName;
+        this.sessionPath = sessionPath;
+        this.worktreePath = worktreePath;
+        this.name = 'ForeignSessionError';
+    }
+}
+exports.ForeignSessionError = ForeignSessionError;
+/**
+ * Normalize a path for ownership comparison: realpath when it resolves,
+ * otherwise `path.resolve()`; trailing `/` removed; case preserved.
+ */
+function normalizeOwnershipPath(p) {
+    let resolved;
+    try {
+        resolved = fs_1.default.realpathSync.native(p);
+    }
+    catch {
+        resolved = path_1.default.resolve(p);
+    }
+    if (resolved.length > 1) {
+        resolved = resolved.replace(/\/+$/, '');
+    }
+    return resolved === '' ? '/' : resolved;
+}
+/**
+ * Pure comparison: is a session created in `sessionPath` owned by the worktree
+ * at `worktreePath`? `null` (tmux could not say) is never owned.
+ *
+ * @param normalize - Path normalizer; {@link createCachedOwnershipMatcher}
+ *   passes a memoized one. Defaults to {@link normalizeOwnershipPath}.
+ */
+function isSessionPathOwnedBy(sessionPath, worktreePath, normalize = normalizeOwnershipPath) {
+    if (sessionPath === null || sessionPath === '')
+        return false;
+    return normalize(sessionPath) === normalize(worktreePath);
+}
+/**
+ * Build an `isSessionPathOwnedBy` that memoizes realpath per input path. Meant
+ * to live for one request (e.g. the batch status listing), so a moved/created
+ * directory is picked up on the next request.
+ */
+function createCachedOwnershipMatcher() {
+    const cache = new Map();
+    const norm = (p) => {
+        let v = cache.get(p);
+        if (v === undefined) {
+            v = normalizeOwnershipPath(p);
+            cache.set(p, v);
+        }
+        return v;
+    };
+    return (sessionPath, worktreePath) => isSessionPathOwnedBy(sessionPath, worktreePath, norm);
+}
+const warnedForeignSessions = new Set();
+/**
+ * Log `session:foreign-detected` once per session name for the process lifetime.
+ */
+function reportForeignSession(sessionName, sessionPath, worktreePath) {
+    if (warnedForeignSessions.has(sessionName))
+        return;
+    warnedForeignSessions.add(sessionName);
+    logger.warn('session:foreign-detected', { sessionName, sessionPath, worktreePath });
+}
+/** Test-only: forget which foreign sessions were already reported. */
+function resetForeignSessionWarningsForTesting() {
+    warnedForeignSessions.clear();
+}
+/**
+ * Decide whether `sessionName` is absent, owned by the worktree at
+ * `worktreePath`, or foreign. A session that exists but whose
+ * `#{session_path}` cannot be read is treated as foreign (fail safe).
+ */
+async function checkSessionOwnership(sessionName, worktreePath) {
+    if (!(await (0, tmux_1.hasSession)(sessionName))) {
+        return { verdict: 'absent', sessionPath: null };
+    }
+    const sessionPath = await (0, tmux_1.getSessionWorkingDirectory)(sessionName);
+    if (sessionPath !== null && isSessionPathOwnedBy(sessionPath, worktreePath)) {
+        return { verdict: 'owned', sessionPath };
+    }
+    reportForeignSession(sessionName, sessionPath, worktreePath);
+    return { verdict: 'foreign', sessionPath };
+}
+/**
+ * Throw `ForeignSessionError` when `sessionName` is foreign; otherwise return
+ * the ownership verdict (`owned` or `absent`).
+ */
+async function assertSessionNotForeign(sessionName, worktreePath) {
+    const ownership = await checkSessionOwnership(sessionName, worktreePath);
+    if (ownership.verdict === 'foreign') {
+        throw new ForeignSessionError(sessionName, ownership.sessionPath, worktreePath);
+    }
+    return ownership;
+}
+/**
+ * JSON body for the HTTP 409 an API route returns for a foreign session.
+ */
+function foreignSessionErrorBody(sessionName, sessionPath) {
+    return {
+        error: `tmux session "${sessionName}" belongs to another CommandMate server`,
+        code: exports.FOREIGN_SESSION_ERROR_CODE,
+        sessionName,
+        sessionPath,
+    };
+}
+/**
+ * From one batch `listSessions()` result, the names of the sessions the worktree
+ * at `worktreePath` owns. Feed this — not the raw name set — to status detection
+ * so a same-named foreign session never reads as "running". Other worktrees'
+ * sessions drop out too, which is harmless: status detection only looks up the
+ * worktree's own session names.
+ *
+ * @param matcher - Pass one `createCachedOwnershipMatcher()` across all worktrees
+ *   of a request so each realpath is resolved once.
+ */
+function ownedSessionNameSet(tmuxSessions, worktreePath, matcher = createCachedOwnershipMatcher()) {
+    const owned = new Set();
+    for (const session of tmuxSessions) {
+        if (matcher(session.path ?? null, worktreePath))
+            owned.add(session.name);
+    }
+    return owned;
+}

package/dist/server/src/lib/tmux/tmux.js

@@ -30,6 +30,7 @@ const child_process_1 = require("child_process");
 const util_1 = require("util");
 const tmux_capture_cache_1 = require("./tmux-capture-cache");
 const geometry_delegation_1 = require("./geometry-delegation");
+const legacy_session_alias_1 = require("./legacy-session-alias");
 const validation_1 = require("../../lib/cli-tools/validation");
 const tmux_pane_config_1 = require("../../config/tmux-pane-config");
 const logger_1 = require("../../lib/logger");
@@ -181,6 +182,9 @@ async function hasSession(sessionName) {
     }
     catch {
         // tmux has-session returns non-zero exit code if session doesn't exist
+        // Issue #2866: an adopted legacy session that is gone no longer serves its
+        // new-format name, so the next start uses the new-format name.
+        (0, legacy_session_alias_1.dropLegacyAliasByLegacyName)(sessionName);
         return false;
     }
 }
@@ -225,19 +229,23 @@ async function getSessionWorkingDirectory(sessionName) {
  */
 async function listSessions() {
     try {
-        const { stdout } = await execFileAsync('tmux', ['list-sessions', '-F', '#{session_name}|#{session_windows}|#{session_attached}'], { timeout: DEFAULT_TIMEOUT });
+        // Issue #2865: `#{session_path}` is the LAST column and tab-separated, so a
+        // path containing `|` or spaces survives intact (everything after the third
+        // tab is the path).
+        const { stdout } = await execFileAsync('tmux', ['list-sessions', '-F', '#{session_name}\t#{session_windows}\t#{session_attached}\t#{session_path}'], { timeout: DEFAULT_TIMEOUT });
         if (!stdout || stdout.trim() === '') {
             return [];
         }
         return stdout
-            .trim()
             .split('\n')
+            .filter(line => line.trim() !== '')
             .map(line => {
-            const [name, windows, attached] = line.split('|');
+            const [name, windows, attached, ...rest] = line.split('\t');
             return {
                 name,
                 windows: parseInt(windows, 10) || 0,
                 attached: attached === '1',
+                path: rest.join('\t'),
             };
         });
     }
@@ -628,6 +636,8 @@ async function killSession(sessionName) {
         await execFileAsync('tmux', ['kill-session', '-t', exactTarget(sessionName)], {
             timeout: DEFAULT_TIMEOUT,
         });
+        // Issue #2866: see hasSession.
+        (0, legacy_session_alias_1.dropLegacyAliasByLegacyName)(sessionName);
         return true;
     }
     catch (error) {