commandmate 0.42.1 → 0.43.0

package/dist/server/src/lib/session/structured-prompt.js

@@ -35,12 +35,15 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MAX_STRUCTURED_PROMPT_MESSAGE_LENGTH = exports.STRUCTURED_DECISION_OPTIONS = void 0;
+exports.structuredDecisionOptionsFor = structuredDecisionOptionsFor;
 exports.isAddressableDecision = isAddressableDecision;
+exports.hasApiAnswerableDecision = hasApiAnswerableDecision;
 exports.buildStructuredPromptQuestion = buildStructuredPromptQuestion;
 exports.buildStructuredPromptData = buildStructuredPromptData;
 exports.buildStructuredPromptHistoryRecord = buildStructuredPromptHistoryRecord;
 exports.isStructuredPromptWaitingData = isStructuredPromptWaitingData;
 const models_1 = require("../../types/models");
+const decision_labels_1 = require("../../lib/hooks/sources/opencode-v2/decision-labels");
 /**
  * The three verdicts an approval dialog accepts, in the order `respond` numbers
  * them (Issue #1898).
@@ -67,6 +70,32 @@ exports.STRUCTURED_DECISION_OPTIONS = [
     // eslint-disable-next-line no-restricted-syntax -- CLI answer vocabulary, not display text
     { number: 3, label: 'Reject', reply: 'reject' },
 ];
+/**
+ * A tool's own words for the approval verdicts, keyed by wire reply
+ * (Issue #2951). Only tools whose dialog words differ from
+ * {@link STRUCTURED_DECISION_OPTIONS} are here: OpenCode V2 draws `Always allow`
+ * where v1 draws `Allow always`.
+ */
+const DECISION_LABELS_BY_TOOL = {
+    'opencode-v2': decision_labels_1.OPENCODE_V2_DECISION_LABELS,
+};
+/**
+ * The approval verdicts in the words of the tool that asked (Issue #2951).
+ *
+ * What `capture --json` publishes as `decisionOptions` and what `respond`
+ * matches a label against, so both say what the tool's own dialog says. Only
+ * the LABEL differs per tool: the number and the wire reply are the shared
+ * list's, so `2` still means `always` everywhere. Every tool without its own
+ * words gets {@link STRUCTURED_DECISION_OPTIONS} itself (the same object).
+ *
+ * @param cliToolId - The tool the approval belongs to
+ */
+function structuredDecisionOptionsFor(cliToolId) {
+    const labels = DECISION_LABELS_BY_TOOL[cliToolId];
+    if (!labels)
+        return exports.STRUCTURED_DECISION_OPTIONS;
+    return exports.STRUCTURED_DECISION_OPTIONS.map((option) => labels[option.reply] ? { ...option, label: labels[option.reply] } : option);
+}
 /** Bound on the agent's `message`, which is prose and only ever displayed. */
 exports.MAX_STRUCTURED_PROMPT_MESSAGE_LENGTH = 500;
 /**
@@ -89,6 +118,31 @@ exports.MAX_STRUCTURED_PROMPT_MESSAGE_LENGTH = 500;
 function isAddressableDecision(value) {
     return typeof value === 'string' && value !== '';
 }
+/**
+ * Whether the agent is holding a decision this server can answer over the
+ * agent's own API right now (Issue #2965).
+ *
+ * The gate on the two "the detection layer could not read this" rows — the
+ * unclassified-frame row and the structured-prompt row
+ * ({@link buildStructuredPromptQuestion}). Both exist to record a dialog nobody
+ * could answer; while this is true somebody can, by id, and the row is a
+ * meaningless line in the chat (OpenCode V2 approvals and questions, #2945;
+ * v1 opencode's approvals, which carry the same `permission-id`). All three
+ * conjuncts are required, and each failing one puts the row back — the safe
+ * side:
+ *
+ *  - the source publishes per-decision ids (`eventIdentity: 'permission-id'`);
+ *  - a pending decision carries one ({@link isAddressableDecision});
+ *  - its delivery window has not expired (a verdict can still reach the agent).
+ *
+ * @param eventIdentity - `capabilities.eventIdentity` of the tool's event source
+ * @param pendingDecisions - the decisions the turn is holding, as published
+ */
+function hasApiAnswerableDecision(eventIdentity, pendingDecisions) {
+    if (eventIdentity !== 'permission-id')
+        return false;
+    return pendingDecisions.some((decision) => isAddressableDecision(decision.id) && !decision.deliveryExpired);
+}
 /** How each source reads in the one-line question. */
 const SOURCE_LABEL = {
     notification: 'Notification(permission_prompt)',

package/dist/server/src/lib/session/tmux-session-surface.js

@@ -343,7 +343,7 @@ function isLiveAttachEligibleSession(sessionName) {
  * `tests/unit/tmux/session-surface-2317.test.ts`, so a tool moving in or out of
  * the alternate screen breaks a test rather than silently dropping the hint.
  */
-exports.ALT_SCREEN_TOOLS = ['claude', 'opencode', 'copilot'];
+exports.ALT_SCREEN_TOOLS = ['claude', 'opencode', 'copilot', 'opencode-v2'];
 /** Whether `attach` should warn that a bare attach shows no transcript. */
 function usesAltScreen(cliToolId) {
     return exports.ALT_SCREEN_TOOLS.includes(cliToolId);

package/dist/server/src/lib/skills/compatibility-matrix.js

@@ -81,6 +81,7 @@ const NOT_MEASURED_SKIP_REASON_KEY = 'skills.compatibility.skipReason.notMeasure
 exports.AGENT_RELOAD_MESSAGE_KEYS = {
     SESSION_RESTART: 'skills.compatibility.reload.sessionRestart',
     SESSION_RESTART_NO_SLASH: 'skills.compatibility.reload.sessionRestartNoSlash',
+    PICKED_UP_LIVE: 'skills.compatibility.reload.pickedUpLive',
     UNKNOWN: 'skills.compatibility.reload.unknown',
 };
 /** Known limitation keys attached to an axis outcome. */
@@ -113,6 +114,15 @@ const MEASURED_DATE_2026_09_05 = '2026-09-05';
  * deliberately *not* recorded as a row — see the `gemini` entry below.
  */
 const OTHER_AGENTS_EVIDENCE_SOURCE = 'https://github.com/Kewton/CommandMate/blob/main/docs/reference/skill-agent-compatibility.md#9-gemini--copilot-probe-log-issue-2302';
+/**
+ * Evidence reference for the OpenCode V2 (opencode2) 2.0.18 measurement
+ * (Issue #2975).
+ *
+ * The reference doc carries the harness, the controls and the raw
+ * `GET /api/skill` / message output.
+ */
+const OPENCODE_V2_EVIDENCE_SOURCE = 'https://github.com/Kewton/CommandMate/blob/main/docs/reference/skill-agent-compatibility.md#10-opencode-v2-probe-log-issue-2975';
+const MEASURED_DATE_2026_09_29 = '2026-09-29';
 function unmeasuredEntry(agent) {
     return {
         agent,
@@ -345,6 +355,61 @@ const AGENT_DISCOVERY_MATRIX = [
         reloadKey: exports.AGENT_RELOAD_MESSAGE_KEYS.SESSION_RESTART,
         skipReasonKey: null,
     },
+    {
+        agent: 'opencode-v2',
+        // Issue #2975, opencode2 2.0.18. Measured on its own rather than copied off
+        // the v1 row: the values happen to match v1's, but the release, the day and
+        // the route that makes invocation work are different.
+        //
+        // Ten probe Skills were planted, one per candidate root, each told to
+        // answer a unique token. `GET /api/skill` returned eight of them with their
+        // absolute SKILL.md paths — project `.opencode/skills`, `.opencode/skill`,
+        // `.claude/skills`, `.agents/skills`; home `.claude/skills`,
+        // `.agents/skills`, `.config/opencode/skills`, `.config/opencode/skill` —
+        // and not the two negative controls (`.github/skills`,
+        // `$HOME/.opencode/skills`). Both CommandMate install roots are among the
+        // eight, and the byte-identical dual-root install is listed once.
+        discoveryRoots: [constants_1.SKILL_INSTALL_ROOT_PREFIX, constants_1.SKILL_CLAUDE_INSTALL_ROOT_PREFIX],
+        discovery: {
+            outcome: 'verified',
+            evidenceKind: 'mechanical',
+            labelKey: exports.AGENT_AXIS_OUTCOME_LABEL_KEYS.verified,
+            evidenceKindKey: exports.AGENT_EVIDENCE_KIND_LABEL_KEYS.mechanical,
+            limitationKey: null,
+        },
+        invocation: {
+            // Submitting `/probe-agents-root ` produced a `skill` tool part with
+            // `input.id: "probe-agents-root"` and the Skill's absolute directory in
+            // its metadata, and the agent answered `PROBE_OK_probe-agents-root`;
+            // `.claude/skills` did the same with its own token. Unlike v1 the TUI
+            // does not expand the Skill — the user message is the literal
+            // `/probe-agents-root ` (a markdown command, by contrast, is replaced by
+            // its template) — so it is the model calling the `skill` tool. The tool
+            // part is the discriminator, not the token: `/probe-home-dotopencode-root`
+            // (never discovered) came back with a *different* Skill's token.
+            //
+            // The limitation is the same as v1's: typing the name after `/` shows
+            // "No matching commands" (positive control `/rev` → `/review`, negative
+            // control `/zzzznotacommand` → nothing), and the `ctrl+p` palette has no
+            // row for it either. What v2 adds is an `@` completion — `@probe` lists
+            // every discovered Skill tagged `skill`, and the `/skills` picker inserts
+            // `@name` — so v2 does have its own way in, just not a slash command.
+            outcome: 'verified',
+            evidenceKind: 'mechanical',
+            labelKey: exports.AGENT_AXIS_OUTCOME_LABEL_KEYS.verified,
+            evidenceKindKey: exports.AGENT_EVIDENCE_KIND_LABEL_KEYS.mechanical,
+            limitationKey: exports.AGENT_LIMITATION_MESSAGE_KEYS.NO_SLASH_COMMAND,
+        },
+        testedVersion: '2.0.18',
+        testedDate: MEASURED_DATE_2026_09_29,
+        evidenceSource: OPENCODE_V2_EVIDENCE_SOURCE,
+        // Also measured, and the opposite of v1: the server does NOT need a
+        // restart. A Skill planted while it ran appeared in `GET /api/skill` within
+        // seconds, and one planted into `$HOME/.agents/skills` mid-session was run
+        // in that same session — so the guidance is "no new session needed".
+        reloadKey: exports.AGENT_RELOAD_MESSAGE_KEYS.PICKED_UP_LIVE,
+        skipReasonKey: null,
+    },
 ];
 /** The measured matrix, in CLI-tool declaration order. */
 function getSkillAgentMatrix() {

package/dist/server/src/lib/tmux/tmux.js

@@ -254,6 +254,33 @@ async function listSessions() {
         return [];
     }
 }
+/**
+ * Issue #2958: what window 0 of a new session runs until `createSession`
+ * replaces it with the login shell. Two words so tmux execs it directly (a
+ * single word would be run through `default-shell -c`); it never exits on its
+ * own and dies with the SIGHUP the replacement sends.
+ */
+const PLACEHOLDER_PANE_COMMAND = ['sleep', '2147483647'];
+/**
+ * Fallback for a failed window rebuild: swap the placeholder in window 0 for
+ * the login shell tmux would have started (`default-shell`, as a login shell).
+ *
+ * A bare `respawn-pane` would re-run the pane's creation command — the
+ * placeholder — so the shell is named explicitly.
+ */
+async function respawnLoginShell(sessionName, workingDirectory) {
+    let shell = '';
+    try {
+        const { stdout } = await execFileAsync('tmux', ['show-options', '-gv', 'default-shell'], { timeout: DEFAULT_TIMEOUT });
+        shell = stdout.trim();
+    }
+    catch {
+        // Fall through to the environment's shell.
+    }
+    if (!shell)
+        shell = process.env.SHELL || '/bin/sh';
+    await execFileAsync('tmux', ['respawn-pane', '-k', '-t', `${exactTarget(sessionName)}0`, '-c', workingDirectory, shell, '-l'], { timeout: DEFAULT_TIMEOUT });
+}
 /**
  * Create a new tmux session
  *
@@ -300,7 +327,23 @@ async function createSession(sessionNameOrOptions, cwd) {
     try {
         // Create session with explicit window size to avoid 80x24 default
         // This is critical for TUI tools (Copilot, OpenCode) that use alternate screen
-        await execFileAsync('tmux', ['new-session', '-d', '-s', sessionName, '-c', workingDirectory, '-x', String(windowWidth), '-y', String(windowHeight)], { timeout: DEFAULT_TIMEOUT });
+        //
+        // Issue #2958: window 0 runs a PLACEHOLDER, not the login shell, because it
+        // is thrown away by the `new-window -k` below a few milliseconds later. A
+        // shell killed that early is still inside its rc files, and pyenv's
+        // `pyenv init -` (`command pyenv rehash`) can die holding its lock file
+        // (`$PYENV_ROOT/shims/.pyenv-shim`). The NEXT shell then spins in
+        // `pyenv rehash` for its 60s lock timeout before running the launch command,
+        // so the agent missed the 60s initialization wait (exit 99). Measured on tmux
+        // 3.5a / pyenv 2.6.0: 7 of 40 shell-first creations left the lock behind and
+        // the replacement pane ran its first command after 61s; 0 of 40 with the
+        // placeholder. Two argv words make tmux exec it directly, so no shell (and
+        // no rc file) is started for window 0 at all.
+        await execFileAsync('tmux', [
+            'new-session', '-d', '-s', sessionName, '-c', workingDirectory,
+            '-x', String(windowWidth), '-y', String(windowHeight),
+            ...PLACEHOLDER_PANE_COMMAND,
+        ], { timeout: DEFAULT_TIMEOUT });
         // Issue #1624: `history-limit` must be set BEFORE the pane that uses it exists.
         //
         // It is a session option, but a pane sizes its scrollback buffer ONCE, from
@@ -324,7 +367,9 @@ async function createSession(sessionNameOrOptions, cwd) {
         // cwd instead). Omitting it silently launches every agent in the wrong repo.
         //
         // Best-effort, matching the geometry step below: if this fails the session is
-        // still usable, just with tmux's default 2000-line scrollback.
+        // still usable, just with tmux's default 2000-line scrollback. Window 0 is
+        // only a placeholder (Issue #2958), so the fallback must still put the login
+        // shell into it — see respawnLoginShell().
         try {
             await execFileAsync('tmux', ['new-window', '-k', '-t', `${exactTarget(sessionName)}0`, '-c', workingDirectory], { timeout: DEFAULT_TIMEOUT });
         }
@@ -334,6 +379,7 @@ async function createSession(sessionNameOrOptions, cwd) {
                 historyLimit,
                 error: error instanceof Error ? error.message : String(error),
             });
+            await respawnLoginShell(sessionName, workingDirectory);
         }
         // Issue #1163: Pin the pane to a fixed height so alternate-screen TUIs
         // (Claude/Codex/etc.) keep enough visible rows for capture-pane.

package/dist/server/src/lib/verification/env-clean-gate.js

@@ -17,7 +17,9 @@
  *      counted, and it is the single failure this gate must not reproduce.
  *   2. **Additions and removals are judged asymmetrically.** Everything that
  *      existed at task start must still exist, whoever it belonged to — that is
- *      the pkill (#1739) and `kill-server` (#1624) case. New things are a
+ *      the pkill (#1739) and `kill-server` (#1624) case — with one exception: a
+ *      tmux session the baseline recorded as *another CommandMate server's*
+ *      (#2627), which that server may close whenever it likes. New things are a
  *      violation *unless they are attributable to another worker*, because
  *      parallel delegations legitimately start their own sessions and servers
  *      inside each other's measurement windows — or unless they are the one
@@ -29,17 +31,25 @@
  * @module lib/verification/env-clean-gate
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ENV_CLEAN_GUIDANCE = exports.MAX_REPORTED_ENV_CHANGES = exports.REQUIRE_ENV_CLEAN_SOURCE_CONTRACT = exports.REQUIRE_ENV_CLEAN_SOURCE_CONFIG = void 0;
+exports.ENV_CLEAN_GUIDANCE = exports.MAX_REPORTED_ENV_CHANGES = exports.readLivePidCwd = exports.REQUIRE_ENV_CLEAN_SOURCE_CONTRACT = exports.REQUIRE_ENV_CLEAN_SOURCE_CONFIG = void 0;
 exports.resolveRequireEnvClean = resolveRequireEnvClean;
 exports.attributeSessionName = attributeSessionName;
 exports.attributeAnchor = attributeAnchor;
+exports.demoVitestPid = demoVitestPid;
+exports.attributeHomeEntry = attributeHomeEntry;
 exports.resolveTaskSessionName = resolveTaskSessionName;
 exports.recordTaskSession = recordTaskSession;
 exports.readTaskSession = readTaskSession;
+exports.currentSessionServer = currentSessionServer;
+exports.isOtherServerSession = isOtherServerSession;
+exports.recordOtherServerSessions = recordOtherServerSessions;
+exports.readOtherServerSessions = readOtherServerSessions;
 exports.diffEnvSnapshots = diffEnvSnapshots;
 exports.formatEnvCleanReport = formatEnvCleanReport;
 exports.envCleanNoBaseline = envCleanNoBaseline;
 exports.evaluateEnvClean = evaluateEnvClean;
+const child_process_1 = require("child_process");
+const fs_1 = require("fs");
 const path_1 = require("path");
 const session_name_1 = require("../../lib/cli-tools/session-name");
 const types_1 = require("../../lib/cli-tools/types");
@@ -132,16 +142,92 @@ function attributeAnchor(anchor, worktreePath) {
         return 'other';
     return 'unattributed';
 }
-function attributeEntry(probeId, entry, context) {
+/** Bounded like the snapshot probes: a hung `lsof` must not hold a run open. */
+const PID_CWD_TIMEOUT_MS = 5_000;
+/**
+ * Read a process's cwd from the machine: `/proc/<pid>/cwd` on Linux, `lsof` on
+ * macOS (which has no procfs). A dead pid, a process owned by someone this user
+ * cannot inspect, or a missing `lsof` all answer null — which leaves the entry
+ * unattributed, the strict verdict.
+ */
+const readLivePidCwd = (pid) => {
+    try {
+        process.kill(pid, 0);
+    }
+    catch (error) {
+        // EPERM means the process exists but belongs to another user.
+        if (error.code !== 'EPERM')
+            return null;
+    }
+    if (process.platform === 'linux') {
+        try {
+            return (0, fs_1.readlinkSync)(`/proc/${pid}/cwd`);
+        }
+        catch {
+            return null;
+        }
+    }
+    try {
+        const out = (0, child_process_1.execFileSync)('lsof', ['-a', '-d', 'cwd', '-p', String(pid), '-F', 'n'], {
+            encoding: 'utf8',
+            timeout: PID_CWD_TIMEOUT_MS,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        const line = out.split('\n').find((field) => field.startsWith('n'));
+        return line ? line.slice(1) : null;
+    }
+    catch {
+        return null;
+    }
+};
+exports.readLivePidCwd = readLivePidCwd;
+/**
+ * `tests/unit/skills/demo-video/env-scripts.test.ts` creates
+ * `~/.commandmate-demo-vitest-<pid>` for the length of its run — in the real
+ * `$HOME`, because `env-up.sh` refuses `/tmp` and `/var` (#2954). The name
+ * carries the pid of the test process that made it, which is the one `$HOME`
+ * entry whose owner can be established.
+ */
+const DEMO_VITEST_HOME_ENTRY = /^\.commandmate-demo-vitest-([1-9]\d*)$/;
+/** The pid a `.commandmate-demo-vitest-<pid>` name carries; null for any other name. */
+function demoVitestPid(name) {
+    const match = DEMO_VITEST_HOME_ENTRY.exec(name);
+    if (!match)
+        return null;
+    const pid = Number(match[1]);
+    return Number.isSafeInteger(pid) ? pid : null;
+}
+/**
+ * Attribute a `$HOME` entry (#2954).
+ *
+ * Only `.commandmate-demo-vitest-<pid>` can be attributed, and only while its
+ * pid is alive: the test process's cwd is then judged exactly as a listener's
+ * is ({@link attributeAnchor}), so a parallel worktree's test run is `other`.
+ * A dead pid, an unreadable cwd, or a cwd inside this worktree leave it
+ * unattributed — a directory this worker's own tests failed to remove is still
+ * caught.
+ */
+function attributeHomeEntry(name, worktreePath, resolvePidCwd = exports.readLivePidCwd) {
+    const pid = demoVitestPid(name);
+    if (pid === null)
+        return 'unattributed';
+    const owner = attributeAnchor(resolvePidCwd(pid), worktreePath);
+    // `self` is not an excuse for an addition, and a file has no self to report.
+    return owner === 'other' ? 'other' : 'unattributed';
+}
+function attributeEntry(probeId, entry, context, resolvePidCwd) {
     switch (probeId) {
         case 'tmux-sessions':
             return attributeSessionName(entry.key, context.worktreeId);
         case 'listeners':
             return attributeAnchor(entry.anchor, context.worktreePath);
+        case 'home-entries':
+            return attributeHomeEntry(entry.key, context.worktreePath, resolvePidCwd);
         default:
             // A file has no owner. `$HOME` and `~/.commandmate` are shared, so an
             // entry appearing there is a violation for whoever is being judged — the
-            // rule the Issue's incident list is made of.
+            // rule the Issue's incident list is made of. The one `$HOME` exception is
+            // above (#2954).
             return 'unattributed';
     }
 }
@@ -166,8 +252,12 @@ function resolveTaskSessionName(task) {
     }
 }
 /** A freshly captured baseline, stamped with its task's own agent session. */
-function recordTaskSession(snapshot, task) {
-    return { ...snapshot, taskSession: resolveTaskSessionName(task) };
+function recordTaskSession(snapshot, task, server = currentSessionServer()) {
+    return {
+        ...snapshot,
+        taskSession: resolveTaskSessionName(task),
+        otherServerSessions: recordOtherServerSessions(snapshot, server),
+    };
 }
 /**
  * The session a baseline excuses: its name, `null` when it was recorded as
@@ -180,6 +270,106 @@ function readTaskSession(baseline) {
     const recorded = baseline.taskSession;
     return typeof recorded === 'string' && recorded !== '' ? recorded : null;
 }
+/**
+ * The identity of the server process this module runs in.
+ *
+ * The adoption table is read through `resolveSessionName`, which returns the
+ * adopted legacy name in place of the new-format one — this module may not
+ * reach into `lib/tmux` (#1922).
+ */
+function currentSessionServer() {
+    return {
+        namespace: (0, session_name_1.getActiveSessionNamespace)(),
+        legacyAliasOf: (newName) => {
+            const parsed = (0, session_name_1.parseSessionName)(newName);
+            if (!parsed)
+                return undefined;
+            try {
+                const resolved = (0, session_name_1.resolveSessionName)(parsed.cliToolId, parsed.rest);
+                return resolved !== newName ? resolved : undefined;
+            }
+            catch {
+                return undefined;
+            }
+        },
+    };
+}
+/**
+ * Whether a session name positively belongs to a CommandMate server other than
+ * `server`.
+ *
+ * False whenever that cannot be shown: this server has no namespace (then every
+ * name could be its own), or the name is not a CommandMate session name at all.
+ */
+function isOtherServerSession(name, server) {
+    if (server.namespace === null)
+        return false;
+    const parsed = (0, session_name_1.parseSessionName)(name);
+    if (!parsed)
+        return false;
+    if (parsed.namespace !== null)
+        return parsed.namespace !== server.namespace;
+    let ownName;
+    try {
+        ownName = (0, session_name_1.resolveNamespacedSessionName)(server.namespace, parsed.cliToolId, parsed.rest);
+    }
+    catch {
+        // A name this server could never have built is not one of its adoptions.
+        return true;
+    }
+    return server.legacyAliasOf(ownName) !== name;
+}
+/**
+ * The baseline's `mcbd-*` sessions that belonged to another CommandMate server
+ * at task creation.
+ *
+ * Recorded then, because only then is it knowable: this server's legacy
+ * adoptions are dropped when their session goes away, so by verification time
+ * a vanished adopted session would look like a stranger's.
+ *
+ * Why this is the line removals are excused on — the design note for #2627:
+ *
+ *   - A removal is a violation because a worker may have killed someone else's
+ *     session (#1624) or server (#1739). A session *of this server* — the
+ *     sibling worktree in #1624, whose name carries this server's namespace —
+ *     stays guarded exactly as before.
+ *   - A session of *another server* is closed by that server's own lifecycle:
+ *     the incident of 2026-09-17 was a global-install server's orchestrate
+ *     finishing issue-107 and moving on to issue-108, with no kill of any kind
+ *     in the three workers' transcripts. This task has no way to tell that
+ *     from a worker's kill, and that server — not this gate — owns the fact.
+ *   - The namespace is the designed marker of "which server" (#2866); nothing
+ *     else here needs this server's database or a guess at the other
+ *     repository's paths.
+ *
+ * Rejected: counting (`one other session gone is fine`) — that is the #1624
+ * shape, a sibling session disappearing while this worktree's stays; ignoring
+ * every `other` removal — that drops #1624 outright; the database's worktree
+ * table — the other server has a different database and the same worktree ids
+ * can exist in both, which is why #2866 exists; timing — the two snapshots do
+ * not say *when* inside the window something went away; the worker's command
+ * log — not recorded in a form the gate reads, and a kill run through a script
+ * would not name the session anyway.
+ *
+ * @returns the names, or null when `server` has no namespace to judge by
+ */
+function recordOtherServerSessions(snapshot, server) {
+    if (server.namespace === null)
+        return null;
+    const sessions = snapshot.probes['tmux-sessions'];
+    if (!sessions || sessions.status !== 'ok')
+        return [];
+    return sessions.entries
+        .map((entry) => entry.key)
+        .filter((name) => isOtherServerSession(name, server));
+}
+/** The recorded other-server sessions of a baseline; empty when none was recorded. */
+function readOtherServerSessions(baseline) {
+    const recorded = baseline.otherServerSessions;
+    if (!Array.isArray(recorded))
+        return new Set();
+    return new Set(recorded.filter((name) => typeof name === 'string'));
+}
 function toChange(entry, owner) {
     return { key: entry.key, detail: entry.detail, owner };
 }
@@ -193,7 +383,9 @@ function toChange(entry, owner) {
  */
 function diffEnvSnapshots(baseline, final, context, options = {}) {
     const taskSession = readTaskSession(baseline);
+    const otherServerSessions = readOtherServerSessions(baseline);
     const ignoredHomeEntries = new Set(options.ignoreHomeEntries ?? []);
+    const resolvePidCwd = options.resolvePidCwd ?? exports.readLivePidCwd;
     const probes = env_snapshot_1.ENV_PROBE_IDS.map((probeId) => {
         const before = baseline.probes[probeId];
         const after = final.probes[probeId];
@@ -206,6 +398,7 @@ function diffEnvSnapshots(baseline, final, context, options = {}) {
                 ignoredAdded: [],
                 taskSessionAdded: [],
                 removed: [],
+                removedByOtherServer: [],
                 ignoredByConfig: [],
             };
         }
@@ -218,6 +411,7 @@ function diffEnvSnapshots(baseline, final, context, options = {}) {
                 ignoredAdded: [],
                 taskSessionAdded: [],
                 removed: [],
+                removedByOtherServer: [],
                 ignoredByConfig: [],
             };
         }
@@ -233,7 +427,7 @@ function diffEnvSnapshots(baseline, final, context, options = {}) {
         for (const entry of after.entries) {
             if (beforeKeys.has(entry.key))
                 continue;
-            const owner = attributeEntry(probeId, entry, context);
+            const owner = attributeEntry(probeId, entry, context, resolvePidCwd);
             if (isIgnoredByConfig(entry)) {
                 ignoredByConfig.push(toChange(entry, owner));
                 continue;
@@ -246,12 +440,29 @@ function diffEnvSnapshots(baseline, final, context, options = {}) {
             }
             (owner === 'other' ? ignoredAdded : added).push(toChange(entry, owner));
         }
+        // An excuse for another server's session presumes the tmux server lived
+        // through the task. When nothing from the baseline survived and the task's
+        // own session is gone too, the likeliest story is `kill-server` (#1624), and
+        // every removal is counted.
+        const tmuxServerSurvived = probeId === 'tmux-sessions' &&
+            after.entries.some((entry) => beforeKeys.has(entry.key) || (taskSession !== null && entry.key === taskSession));
         const removed = [];
+        const removedByOtherServer = [];
         for (const entry of before.entries) {
             if (afterKeys.has(entry.key))
                 continue;
-            const change = toChange(entry, attributeEntry(probeId, entry, context));
-            (isIgnoredByConfig(entry) ? ignoredByConfig : removed).push(change);
+            const change = toChange(entry, attributeEntry(probeId, entry, context, resolvePidCwd));
+            if (isIgnoredByConfig(entry)) {
+                ignoredByConfig.push(change);
+            }
+            else if (tmuxServerSurvived &&
+                change.owner !== 'self' &&
+                otherServerSessions.has(entry.key)) {
+                removedByOtherServer.push(change);
+            }
+            else {
+                removed.push(change);
+            }
         }
         return {
             probeId,
@@ -261,6 +472,7 @@ function diffEnvSnapshots(baseline, final, context, options = {}) {
             ignoredAdded,
             taskSessionAdded,
             removed,
+            removedByOtherServer,
             ignoredByConfig,
         };
     });
@@ -318,6 +530,10 @@ function formatTaskSessionChanges(changes) {
  * session is: a verdict that silently discounted an entry would read exactly
  * like one that never saw it.
  */
+/** Removals excused as another CommandMate server's sessions (#2627), one line each. */
+function formatRemovedByOtherServer(changes) {
+    return changes.map((change) => `    · - ${change.key} (ignored: another CommandMate server's session, recorded at task start)`);
+}
 function formatIgnoredByConfig(changes) {
     if (changes.length === 0)
         return [];
@@ -350,6 +566,7 @@ function formatEnvCleanReport(diff) {
                 : '';
             lines.push(`  ${probe.probeId} clean (${label})${excused}`);
             lines.push(...formatTaskSessionChanges(probe.taskSessionAdded));
+            lines.push(...formatRemovedByOtherServer(probe.removedByOtherServer));
             lines.push(...formatIgnoredByConfig(probe.ignoredByConfig));
             continue;
         }
@@ -357,6 +574,7 @@ function formatEnvCleanReport(diff) {
         lines.push(...formatChanges('+', probe.added));
         lines.push(...formatChanges('-', probe.removed));
         lines.push(...formatTaskSessionChanges(probe.taskSessionAdded));
+        lines.push(...formatRemovedByOtherServer(probe.removedByOtherServer));
         lines.push(...formatIgnoredByConfig(probe.ignoredByConfig));
         for (const excused of probe.ignoredAdded) {
             lines.push(`    · ${excused.key} (ignored: belongs to another worktree)`);
@@ -415,6 +633,7 @@ async function evaluateEnvClean(input) {
     }
     const diff = diffEnvSnapshots(input.baseline, final, input, {
         ignoreHomeEntries: input.ignoreHomeEntries,
+        resolvePidCwd: input.resolvePidCwd,
     });
     const header = `${verify_config_1.ENV_CLEAN_GATE_ID}: baseline=${new Date(input.baseline.capturedAt).toISOString()} ` +
         `status=${diff.status} task-session=${describeTaskSession(diff.taskSession)}`;