commandmate 0.42.2 → 0.44.0

package/dist/server/src/lib/session/claude-session.js

@@ -4,7 +4,7 @@
  * Manages Claude CLI sessions within tmux for each worktree
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CLAUDE_PROMPT_POLL_INTERVAL = exports.CLAUDE_SEND_PROMPT_WAIT_TIMEOUT = exports.CLAUDE_PROMPT_WAIT_TIMEOUT = exports.CLAUDE_POST_PROMPT_DELAY = exports.CLAUDE_INIT_POLL_INTERVAL = exports.CLAUDE_INIT_TIMEOUT = void 0;
+exports.CLAUDE_PROMPT_POLL_INTERVAL = exports.CLAUDE_SEND_PROMPT_WAIT_TIMEOUT = exports.CLAUDE_PROMPT_WAIT_TIMEOUT = exports.CLAUDE_TRUST_DIALOG_EXITED = exports.CLAUDE_TRUST_DIALOG_CURSOR_STUCK = exports.CLAUDE_POST_PROMPT_DELAY = exports.CLAUDE_INIT_POLL_INTERVAL = exports.CLAUDE_INIT_TIMEOUT = void 0;
 exports.clearCachedClaudePath = clearCachedClaudePath;
 exports.isSessionHealthy = isSessionHealthy;
 exports.getSessionName = getSessionName;
@@ -130,6 +130,122 @@ exports.CLAUDE_INIT_POLL_INTERVAL = 300;
  * @see Issue #152 - First message not being sent after session start
  */
 exports.CLAUDE_POST_PROMPT_DELAY = 500;
+/**
+ * Polls (of CLAUDE_INIT_POLL_INTERVAL) a still-open trust dialog is given to
+ * close after being answered before it is answered again (Issue #3078). The
+ * measured close is ~950 ms (Issue #1637), so 10 polls = 3 s is not a race.
+ */
+const TRUST_DIALOG_REANSWER_POLLS = 10;
+/** Upper bound on trust dialog answers per session start (Issue #3078). */
+const TRUST_DIALOG_MAX_ANSWERS = 3;
+/**
+ * Polls a cursor move is given to show up on screen before the next one is
+ * sent (Issue #3089). 3 polls = ~900 ms: a TUI that is not taking keys yet
+ * swallows the move, and the next one goes in once the screen still shows the
+ * cursor off `Yes`.
+ */
+const TRUST_DIALOG_MOVE_SETTLE_POLLS = 3;
+/**
+ * Upper bound on single cursor moves per session start (Issue #3089). 20 moves
+ * at TRUST_DIALOG_MOVE_SETTLE_POLLS apart is ~18 s of a TUI that will not move its
+ * cursor; past that the start fails without ever pressing Enter.
+ */
+const TRUST_DIALOG_MAX_MOVES = 20;
+/** Reported when the cursor never reached `Yes` (Issue #3089). A fixed string, never captured output. */
+exports.CLAUDE_TRUST_DIALOG_CURSOR_STUCK = 'trust dialog: cursor did not reach "Yes, I trust this folder"';
+/** Reported when Claude Code quit from the trust dialog (Issue #3089). A fixed string, never captured output. */
+exports.CLAUDE_TRUST_DIALOG_EXITED = 'trust dialog: Claude Code exited to the shell';
+/**
+ * One poll's answer to the folder-trust dialog (Issue #201 / #3078 / #3089).
+ *
+ * Enter confirms whichever option the cursor is on, and since 2.1.259 that is
+ * `No, exit` by default (which quits Claude Code). So Enter is sent only when
+ * THIS screen shows the cursor on `Yes, I trust this folder`. Otherwise one
+ * move key goes in, and the screen is read again on a later poll: sending
+ * `Down Enter` together lost the `Down` to a TUI that was not taking keys yet
+ * and confirmed `No, exit` (Issue #3089). Both are bounded: Enter is repeated
+ * TRUST_DIALOG_REANSWER_POLLS apart up to TRUST_DIALOG_MAX_ANSWERS times for a
+ * dialog that outlives it, and a cursor that has not reached Yes after
+ * TRUST_DIALOG_MAX_MOVES moves fails the start without Enter.
+ *
+ * @param sessionName - tmux session name
+ * @param dialogScreen - ANSI-stripped pane output when the dialog is open, else null
+ * @param state - Mutated in place
+ * @throws {SessionStartFailedError} When the move budget is spent
+ */
+async function answerTrustDialog(sessionName, dialogScreen, state) {
+    if (state.pollsSinceAnswer !== null)
+        state.pollsSinceAnswer++;
+    if (state.pollsSinceMove !== null)
+        state.pollsSinceMove++;
+    if (dialogScreen === null)
+        return;
+    if (!state.seen) {
+        state.seen = true;
+        state.shellTellsExit = await paneCommandIsAgent(sessionName);
+    }
+    const keys = (0, cli_patterns_1.resolveClaudeTrustDialogKeys)(dialogScreen);
+    if (keys === null)
+        return;
+    if (keys.length === 1) {
+        // Cursor on Yes, on this very screen: the Issue #201 Enter.
+        const due = state.pollsSinceAnswer === null ||
+            (state.pollsSinceAnswer >= TRUST_DIALOG_REANSWER_POLLS && state.answers < TRUST_DIALOG_MAX_ANSWERS);
+        if (!due)
+            return;
+        try {
+            await (0, tmux_1.sendKeys)(sessionName, '', true);
+            state.pollsSinceAnswer = 0;
+            state.answers++;
+            logger.info('trust-dialog-detected', { keys: 'Enter', attempt: state.answers });
+        }
+        catch {
+            // Left unhandled so a later poll answers the dialog again
+        }
+        return;
+    }
+    // Cursor off Yes: one move, then look again before anything else.
+    if (state.pollsSinceMove !== null && state.pollsSinceMove < TRUST_DIALOG_MOVE_SETTLE_POLLS)
+        return;
+    if (state.moves >= TRUST_DIALOG_MAX_MOVES) {
+        throw new session_start_error_1.SessionStartFailedError('Claude Code', sessionName, exports.CLAUDE_TRUST_DIALOG_CURSOR_STUCK);
+    }
+    try {
+        await (0, tmux_1.sendSpecialKeys)(sessionName, [keys[0]]);
+        state.pollsSinceMove = 0;
+        state.moves++;
+        logger.info('trust-dialog-cursor-move', { key: keys[0], attempt: state.moves });
+    }
+    catch {
+        // Left unhandled so a later poll moves the cursor again
+    }
+}
+/**
+ * Whether the pane's foreground process is a shell again (Issue #3089). A
+ * pane tmux cannot describe is not called exited; the start budget still
+ * bounds that case. Only asked when {@link TrustDialogState.shellTellsExit}.
+ *
+ * @param sessionName - tmux session name
+ */
+async function hasReturnedToShell(sessionName) {
+    const command = await readPaneCommand(sessionName);
+    return command !== null && (0, cli_patterns_1.isShellPaneCommand)(command);
+}
+/** Whether the pane's foreground command is known and is not a shell (Issue #3089). */
+async function paneCommandIsAgent(sessionName) {
+    const command = await readPaneCommand(sessionName);
+    return command !== null && !(0, cli_patterns_1.isShellPaneCommand)(command);
+}
+/** `#{pane_current_command}`, or null when it cannot be read. */
+async function readPaneCommand(sessionName) {
+    try {
+        const command = await (0, tmux_1.getPaneCurrentCommand)(sessionName);
+        return typeof command === 'string' ? command : null;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Prompt wait timeout before message send (milliseconds)
  *
@@ -565,7 +681,8 @@ async function startClaudeSession(options) {
         const pollInterval = exports.CLAUDE_INIT_POLL_INTERVAL;
         const startTime = Date.now();
         let initialized = false;
-        let trustDialogHandled = false;
+        // Issue #3078 / #3089: the trust dialog's progress this start.
+        const trust = { pollsSinceAnswer: null, pollsSinceMove: null, answers: 0, moves: 0, seen: false, shellTellsExit: false };
         while (Date.now() - startTime < maxWaitTime) {
             await new Promise((resolve) => setTimeout(resolve, pollInterval));
             // SF-001: Use getCleanPaneOutput helper (DRY)
@@ -579,28 +696,27 @@ async function startClaudeSession(options) {
             if (cleanOutput === null) {
                 continue;
             }
+            // Issue #201 / #3078 / #3089: answer the folder-trust dialog. Checked
+            // BEFORE the prompt: the dialog's cursor row (`❯ No, exit`) wears the
+            // prompt glyph, so an open dialog is never read as a ready prompt.
+            const trustDialogOpen = (0, cli_patterns_1.isClaudeTrustDialogOpen)(cleanOutput);
+            await answerTrustDialog(sessionName, trustDialogOpen ? cleanOutput : null, trust);
             // Claude is ready when we see the prompt (DRY-001)
             // Use CLAUDE_PROMPT_PATTERN from cli-patterns.ts for consistency
             // Note: CLAUDE_SEPARATOR_PATTERN was removed from initialization check (Issue #187, P1-1)
-            if (cli_patterns_1.CLAUDE_PROMPT_PATTERN.test(cleanOutput)) {
+            if (!trustDialogOpen && cli_patterns_1.CLAUDE_PROMPT_PATTERN.test(cleanOutput)) {
                 // Wait for stability after prompt detection (CONS-007, DOC-001)
                 await new Promise((resolve) => setTimeout(resolve, exports.CLAUDE_POST_PROMPT_DELAY));
                 logger.info('claude-initialized-in');
                 initialized = true;
                 break;
             }
-            // Issue #201: Detect trust dialog and auto-respond with Enter
-            // Condition order: CLAUDE_PROMPT_PATTERN (above) is checked first for shortest path
-            if (!trustDialogHandled && cli_patterns_1.CLAUDE_TRUST_DIALOG_PATTERN.test(cleanOutput)) {
-                try {
-                    await (0, tmux_1.sendKeys)(sessionName, '', true);
-                    trustDialogHandled = true;
-                    logger.info('trust-dialog-detected');
-                }
-                catch {
-                    // Left unhandled so the next poll answers the dialog again
-                }
-                // Continue polling to wait for prompt detection
+            // Issue #3089: the dialog is gone and no prompt came up. If the pane is
+            // back at its shell, Claude Code quit (an Enter that landed on
+            // `No, exit`); nothing will ever draw a prompt, so fail now instead of
+            // spending the rest of the budget (and answering the shell).
+            if (!trustDialogOpen && trust.shellTellsExit && (await hasReturnedToShell(sessionName))) {
+                throw new session_start_error_1.SessionStartFailedError('Claude Code', sessionName, exports.CLAUDE_TRUST_DIALOG_EXITED);
             }
             // Issue #1637: fail fast on a start that cannot succeed. The budget is
             // 60s of patience for a *slow* start; a session already showing a

package/dist/server/src/lib/session/current-output-builder.js

@@ -301,6 +301,9 @@ function summarizeAskUserQuestion(episode) {
         question: first.question,
         labels: first.choices.map((choice) => choice.label),
         questionCount: episode.spec.questions.length,
+        // Issue #2951: a question that takes a typed answer, so the panel and the
+        // phone sheet can offer an input for it.
+        ...(first.custom ? { custom: true } : {}),
     };
 }
 /**
@@ -999,7 +1002,10 @@ async function buildPayload(db, worktreeId, cliToolId, instanceId) {
     // same way `structuredEvents.pendingDecisions[].kind` is, through the one
     // reader in `pending-decision-kind`.
     const addressesQuestion = promptWaiting !== null && (0, pending_decision_kind_1.pendingDecisionKind)(promptWaiting.toolName) === 'question';
-    const decisionOptions = addressableDecisionId !== null && !addressesQuestion ? structured_prompt_1.STRUCTURED_DECISION_OPTIONS : null;
+    const decisionOptions = addressableDecisionId !== null && !addressesQuestion
+        ? // Issue #2951: in the tool's own words (OpenCode V2: `Always allow`).
+            (0, structured_prompt_1.structuredDecisionOptionsFor)(cliToolId)
+        : null;
     const structuredFacts = promptWaiting === null
         ? null
         : {
@@ -1096,7 +1102,16 @@ async function buildPayload(db, worktreeId, cliToolId, instanceId) {
     // an unclassified frame, and writing a "detection failed" row for a turn the
     // agent itself told us had ended would put a false stall into the audit trail
     // `capture --prompts` prints.
-    const unclassifiedVerdict = (0, unclassified_frame_tracker_1.observeUnclassifiedFrame)(compositeKey, merged.isUnclassifiedActive);
+    //
+    // Issue #2965: not while the agent holds a decision this server can answer by
+    // id (OpenCode V2 / opencode approvals and questions). The frame may still be
+    // one the scraper cannot read, but "nothing could answer it" is false then,
+    // and the row landed in the chat as a meaningless assistant line. Fed to the
+    // tracker as "not unclassified" rather than merely not written, so the run —
+    // and the 60 seconds — start afresh if the frame is still unreadable once the
+    // decision is gone (answered, expired, or the source dropped).
+    const answerableOverAgentApi = (0, structured_prompt_1.hasApiAnswerableDecision)(eventSource.capabilities.eventIdentity, structuredEvents.pendingDecisions ?? []);
+    const unclassifiedVerdict = (0, unclassified_frame_tracker_1.observeUnclassifiedFrame)(compositeKey, merged.isUnclassifiedActive && !answerableOverAgentApi);
     if (unclassifiedVerdict.shouldRecord) {
         recordUnclassifiedFrame(db, {
             worktreeId,
@@ -1136,7 +1151,16 @@ async function buildPayload(db, worktreeId, cliToolId, instanceId) {
     }
     // Issue #1725: the structured layer saw a dialog the scraper did not. That
     // gap is the fact worth keeping — see recordStructuredPrompt.
-    if (promptWaiting !== null && structuredFacts !== null && !scraperPromptWaiting && !promptWaiting.recorded) {
+    //
+    // Issue #2965: except while that dialog can be answered over the agent's API
+    // — the live payload already carries its id and replies, so the row says
+    // nothing true. Not marked recorded either: should the decision expire with
+    // the dialog still open, the row is written then (the safe side).
+    if (promptWaiting !== null &&
+        structuredFacts !== null &&
+        !scraperPromptWaiting &&
+        !promptWaiting.recorded &&
+        !answerableOverAgentApi) {
         (0, agent_event_state_1.markStructuredPromptRecorded)(worktreeId, cliToolId, instanceId);
         recordStructuredPrompt(db, {
             worktreeId,

package/dist/server/src/lib/session/send-user-message.js

@@ -47,6 +47,7 @@ const logger_1 = require("../../lib/logger");
 const worktree_session_ownership_1 = require("../../lib/cli-tools/worktree-session-ownership");
 const session_name_1 = require("../../lib/cli-tools/session-name");
 const prompt_waiting_guard_1 = require("../../lib/session/prompt-waiting-guard");
+const session_start_error_1 = require("../../lib/session/session-start-error");
 const opencode_1 = require("../../lib/cli-tools/opencode");
 const logger = (0, logger_1.createLogger)('session/send-user-message');
 function getErrorMessage(error) {
@@ -313,6 +314,9 @@ async function sendUserMessage(db, params) {
     }
     catch (error) {
         logger.error('failed-to-send-message-to:', { error: getErrorMessage(error) });
+        if ((0, session_start_error_1.isSessionStartTimeoutError)(error)) {
+            return { ok: false, stage: 'send', error: error.message, code: session_start_error_1.SESSION_STARTING_CODE };
+        }
         return { ok: false, stage: 'send', error: getErrorMessage(error) };
     }
     // 5. Create user message in database (History source: chat_messages).

package/dist/server/src/lib/session/session-start-error.js

@@ -30,6 +30,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SessionStartUnavailableError = exports.SessionStartFailedError = exports.SessionStartTimeoutError = exports.SESSION_START_UNAVAILABLE_CODE = exports.SESSION_START_FAILED_CODE = exports.SESSION_STARTING_CODE = void 0;
+exports.buildSessionExitedToShellMessage = buildSessionExitedToShellMessage;
 exports.isSessionStartTimeoutError = isSessionStartTimeoutError;
 exports.isSafeSessionStartError = isSafeSessionStartError;
 exports.isSessionStartUnavailableError = isSessionStartUnavailableError;
@@ -81,6 +82,25 @@ class SessionStartTimeoutError extends Error {
     }
 }
 exports.SessionStartTimeoutError = SessionStartTimeoutError;
+/**
+ * The message for a start timeout whose pane is back at a shell (Issue #3093).
+ *
+ * {@link SessionStartTimeoutError} says "the process is still running, so this
+ * is a slow start … nothing needs repairing" — true for a slow cold start, and
+ * exactly wrong when the agent quit during startup (e.g. a trust dialog that
+ * was answered with "No, exit"): the reader was told to wait for a process that
+ * no longer exists. Built from the tool's display name and the session name
+ * only, for the same SEC-SF-002 reason as the classes in this module.
+ *
+ * @param toolName - Display name of the CLI tool (e.g. `Claude Code`)
+ * @param sessionName - tmux session whose pane is back at a shell
+ */
+function buildSessionExitedToShellMessage(toolName, sessionName) {
+    return (`${toolName} exited before reaching its input prompt: the tmux session '${sessionName}' ` +
+        'is back at a shell, so this is not a slow start and waiting will not help. The message ' +
+        'was not delivered. Run `commandmate capture <worktree-id>` to see why it exited (for ' +
+        'example a startup dialog answered with exit, or a missing login), fix that, then send again.');
+}
 /**
  * The CLI tool printed an error that startup cannot recover from.
  *

package/dist/server/src/lib/session/structured-prompt.js

@@ -35,12 +35,15 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MAX_STRUCTURED_PROMPT_MESSAGE_LENGTH = exports.STRUCTURED_DECISION_OPTIONS = void 0;
+exports.structuredDecisionOptionsFor = structuredDecisionOptionsFor;
 exports.isAddressableDecision = isAddressableDecision;
+exports.hasApiAnswerableDecision = hasApiAnswerableDecision;
 exports.buildStructuredPromptQuestion = buildStructuredPromptQuestion;
 exports.buildStructuredPromptData = buildStructuredPromptData;
 exports.buildStructuredPromptHistoryRecord = buildStructuredPromptHistoryRecord;
 exports.isStructuredPromptWaitingData = isStructuredPromptWaitingData;
 const models_1 = require("../../types/models");
+const decision_labels_1 = require("../../lib/hooks/sources/opencode-v2/decision-labels");
 /**
  * The three verdicts an approval dialog accepts, in the order `respond` numbers
  * them (Issue #1898).
@@ -67,6 +70,32 @@ exports.STRUCTURED_DECISION_OPTIONS = [
     // eslint-disable-next-line no-restricted-syntax -- CLI answer vocabulary, not display text
     { number: 3, label: 'Reject', reply: 'reject' },
 ];
+/**
+ * A tool's own words for the approval verdicts, keyed by wire reply
+ * (Issue #2951). Only tools whose dialog words differ from
+ * {@link STRUCTURED_DECISION_OPTIONS} are here: OpenCode V2 draws `Always allow`
+ * where v1 draws `Allow always`.
+ */
+const DECISION_LABELS_BY_TOOL = {
+    'opencode-v2': decision_labels_1.OPENCODE_V2_DECISION_LABELS,
+};
+/**
+ * The approval verdicts in the words of the tool that asked (Issue #2951).
+ *
+ * What `capture --json` publishes as `decisionOptions` and what `respond`
+ * matches a label against, so both say what the tool's own dialog says. Only
+ * the LABEL differs per tool: the number and the wire reply are the shared
+ * list's, so `2` still means `always` everywhere. Every tool without its own
+ * words gets {@link STRUCTURED_DECISION_OPTIONS} itself (the same object).
+ *
+ * @param cliToolId - The tool the approval belongs to
+ */
+function structuredDecisionOptionsFor(cliToolId) {
+    const labels = DECISION_LABELS_BY_TOOL[cliToolId];
+    if (!labels)
+        return exports.STRUCTURED_DECISION_OPTIONS;
+    return exports.STRUCTURED_DECISION_OPTIONS.map((option) => labels[option.reply] ? { ...option, label: labels[option.reply] } : option);
+}
 /** Bound on the agent's `message`, which is prose and only ever displayed. */
 exports.MAX_STRUCTURED_PROMPT_MESSAGE_LENGTH = 500;
 /**
@@ -89,6 +118,31 @@ exports.MAX_STRUCTURED_PROMPT_MESSAGE_LENGTH = 500;
 function isAddressableDecision(value) {
     return typeof value === 'string' && value !== '';
 }
+/**
+ * Whether the agent is holding a decision this server can answer over the
+ * agent's own API right now (Issue #2965).
+ *
+ * The gate on the two "the detection layer could not read this" rows — the
+ * unclassified-frame row and the structured-prompt row
+ * ({@link buildStructuredPromptQuestion}). Both exist to record a dialog nobody
+ * could answer; while this is true somebody can, by id, and the row is a
+ * meaningless line in the chat (OpenCode V2 approvals and questions, #2945;
+ * v1 opencode's approvals, which carry the same `permission-id`). All three
+ * conjuncts are required, and each failing one puts the row back — the safe
+ * side:
+ *
+ *  - the source publishes per-decision ids (`eventIdentity: 'permission-id'`);
+ *  - a pending decision carries one ({@link isAddressableDecision});
+ *  - its delivery window has not expired (a verdict can still reach the agent).
+ *
+ * @param eventIdentity - `capabilities.eventIdentity` of the tool's event source
+ * @param pendingDecisions - the decisions the turn is holding, as published
+ */
+function hasApiAnswerableDecision(eventIdentity, pendingDecisions) {
+    if (eventIdentity !== 'permission-id')
+        return false;
+    return pendingDecisions.some((decision) => isAddressableDecision(decision.id) && !decision.deliveryExpired);
+}
 /** How each source reads in the one-line question. */
 const SOURCE_LABEL = {
     notification: 'Notification(permission_prompt)',

package/dist/server/src/lib/session/tmux-session-surface.js

@@ -343,7 +343,7 @@ function isLiveAttachEligibleSession(sessionName) {
  * `tests/unit/tmux/session-surface-2317.test.ts`, so a tool moving in or out of
  * the alternate screen breaks a test rather than silently dropping the hint.
  */
-exports.ALT_SCREEN_TOOLS = ['claude', 'opencode', 'copilot'];
+exports.ALT_SCREEN_TOOLS = ['claude', 'opencode', 'copilot', 'opencode-v2'];
 /** Whether `attach` should warn that a bare attach shows no transcript. */
 function usesAltScreen(cliToolId) {
     return exports.ALT_SCREEN_TOOLS.includes(cliToolId);

package/dist/server/src/lib/skills/agent-state-paths.js

@@ -0,0 +1,39 @@
+"use strict";
+/**
+ * State files an agent CLI writes into the worktree on its own (Issue #3126)
+ *
+ * Command Code leaves `.commandcode/settings.local.json` and
+ * `.commandcode/taste/**` behind in any folder it runs in. Counted as change,
+ * they made a contract's `requireScopeClean` fail on a worktree whose worker
+ * stayed inside `allow`, and made `work-evidence` pass on one nobody worked in.
+ *
+ * Unlike receipt-owned paths (#3092) there is no receipt to vouch for them, so
+ * the declaration below is the whole rule, and it names files, never a whole
+ * directory: `.commandcode/` also holds things a task may legitimately change,
+ * and allowing it wholesale would wave those through. Callers apply this to
+ * **untracked** entries only, as for #3092: a committed or tracked-and-modified
+ * file is history the branch carries.
+ *
+ * Only paths whose existence is confirmed are declared. Other agents (claude,
+ * codex, ...) are deliberately absent until someone has seen them write one.
+ *
+ * @module lib/skills/agent-state-paths
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AGENT_STATE_DIR_PREFIXES = exports.AGENT_STATE_FILES = void 0;
+exports.isAgentStatePath = isAgentStatePath;
+exports.isAgentStateUntrackedEntry = isAgentStateUntrackedEntry;
+/** Exact repository-relative files an agent CLI manages itself. */
+exports.AGENT_STATE_FILES = ['.commandcode/settings.local.json'];
+/** Directory prefixes (with trailing slash) an agent CLI manages itself. */
+exports.AGENT_STATE_DIR_PREFIXES = ['.commandcode/taste/'];
+/** Whether `path` is a declared agent-managed state path. */
+function isAgentStatePath(path) {
+    if (exports.AGENT_STATE_FILES.includes(path))
+        return true;
+    return exports.AGENT_STATE_DIR_PREFIXES.some((prefix) => path.startsWith(prefix) && !path.slice(prefix.length).split('/').includes('..'));
+}
+/** Whether a porcelain record is an untracked file made only of such paths. */
+function isAgentStateUntrackedEntry(entry) {
+    return entry.status === '??' && entry.paths.every(isAgentStatePath);
+}

package/dist/server/src/lib/skills/compatibility-matrix.js

@@ -81,6 +81,7 @@ const NOT_MEASURED_SKIP_REASON_KEY = 'skills.compatibility.skipReason.notMeasure
 exports.AGENT_RELOAD_MESSAGE_KEYS = {
     SESSION_RESTART: 'skills.compatibility.reload.sessionRestart',
     SESSION_RESTART_NO_SLASH: 'skills.compatibility.reload.sessionRestartNoSlash',
+    PICKED_UP_LIVE: 'skills.compatibility.reload.pickedUpLive',
     UNKNOWN: 'skills.compatibility.reload.unknown',
 };
 /** Known limitation keys attached to an axis outcome. */
@@ -113,6 +114,15 @@ const MEASURED_DATE_2026_09_05 = '2026-09-05';
  * deliberately *not* recorded as a row — see the `gemini` entry below.
  */
 const OTHER_AGENTS_EVIDENCE_SOURCE = 'https://github.com/Kewton/CommandMate/blob/main/docs/reference/skill-agent-compatibility.md#9-gemini--copilot-probe-log-issue-2302';
+/**
+ * Evidence reference for the OpenCode V2 (opencode2) 2.0.18 measurement
+ * (Issue #2975).
+ *
+ * The reference doc carries the harness, the controls and the raw
+ * `GET /api/skill` / message output.
+ */
+const OPENCODE_V2_EVIDENCE_SOURCE = 'https://github.com/Kewton/CommandMate/blob/main/docs/reference/skill-agent-compatibility.md#10-opencode-v2-probe-log-issue-2975';
+const MEASURED_DATE_2026_09_29 = '2026-09-29';
 function unmeasuredEntry(agent) {
     return {
         agent,
@@ -345,6 +355,61 @@ const AGENT_DISCOVERY_MATRIX = [
         reloadKey: exports.AGENT_RELOAD_MESSAGE_KEYS.SESSION_RESTART,
         skipReasonKey: null,
     },
+    {
+        agent: 'opencode-v2',
+        // Issue #2975, opencode2 2.0.18. Measured on its own rather than copied off
+        // the v1 row: the values happen to match v1's, but the release, the day and
+        // the route that makes invocation work are different.
+        //
+        // Ten probe Skills were planted, one per candidate root, each told to
+        // answer a unique token. `GET /api/skill` returned eight of them with their
+        // absolute SKILL.md paths — project `.opencode/skills`, `.opencode/skill`,
+        // `.claude/skills`, `.agents/skills`; home `.claude/skills`,
+        // `.agents/skills`, `.config/opencode/skills`, `.config/opencode/skill` —
+        // and not the two negative controls (`.github/skills`,
+        // `$HOME/.opencode/skills`). Both CommandMate install roots are among the
+        // eight, and the byte-identical dual-root install is listed once.
+        discoveryRoots: [constants_1.SKILL_INSTALL_ROOT_PREFIX, constants_1.SKILL_CLAUDE_INSTALL_ROOT_PREFIX],
+        discovery: {
+            outcome: 'verified',
+            evidenceKind: 'mechanical',
+            labelKey: exports.AGENT_AXIS_OUTCOME_LABEL_KEYS.verified,
+            evidenceKindKey: exports.AGENT_EVIDENCE_KIND_LABEL_KEYS.mechanical,
+            limitationKey: null,
+        },
+        invocation: {
+            // Submitting `/probe-agents-root ` produced a `skill` tool part with
+            // `input.id: "probe-agents-root"` and the Skill's absolute directory in
+            // its metadata, and the agent answered `PROBE_OK_probe-agents-root`;
+            // `.claude/skills` did the same with its own token. Unlike v1 the TUI
+            // does not expand the Skill — the user message is the literal
+            // `/probe-agents-root ` (a markdown command, by contrast, is replaced by
+            // its template) — so it is the model calling the `skill` tool. The tool
+            // part is the discriminator, not the token: `/probe-home-dotopencode-root`
+            // (never discovered) came back with a *different* Skill's token.
+            //
+            // The limitation is the same as v1's: typing the name after `/` shows
+            // "No matching commands" (positive control `/rev` → `/review`, negative
+            // control `/zzzznotacommand` → nothing), and the `ctrl+p` palette has no
+            // row for it either. What v2 adds is an `@` completion — `@probe` lists
+            // every discovered Skill tagged `skill`, and the `/skills` picker inserts
+            // `@name` — so v2 does have its own way in, just not a slash command.
+            outcome: 'verified',
+            evidenceKind: 'mechanical',
+            labelKey: exports.AGENT_AXIS_OUTCOME_LABEL_KEYS.verified,
+            evidenceKindKey: exports.AGENT_EVIDENCE_KIND_LABEL_KEYS.mechanical,
+            limitationKey: exports.AGENT_LIMITATION_MESSAGE_KEYS.NO_SLASH_COMMAND,
+        },
+        testedVersion: '2.0.18',
+        testedDate: MEASURED_DATE_2026_09_29,
+        evidenceSource: OPENCODE_V2_EVIDENCE_SOURCE,
+        // Also measured, and the opposite of v1: the server does NOT need a
+        // restart. A Skill planted while it ran appeared in `GET /api/skill` within
+        // seconds, and one planted into `$HOME/.agents/skills` mid-session was run
+        // in that same session — so the guidance is "no new session needed".
+        reloadKey: exports.AGENT_RELOAD_MESSAGE_KEYS.PICKED_UP_LIVE,
+        skipReasonKey: null,
+    },
 ];
 /** The measured matrix, in CLI-tool declaration order. */
 function getSkillAgentMatrix() {

package/dist/server/src/lib/skills/receipt-owned-paths.js

@@ -0,0 +1,118 @@
+"use strict";
+/**
+ * Files CommandMate itself placed into a worktree by installing a Skill (Issue #3092)
+ *
+ * `skill install` leaves `.agents/skills/<id>/…` and `.claude/skills/<id>/…`
+ * untracked. Counted as change, those files made `work-evidence` pass on a
+ * worktree nobody had worked in (`uncommitted=74`), and made a contract's
+ * `requireScopeClean` fail on a worktree whose agent stayed inside `allow`.
+ *
+ * The answer is the receipt, and only the receipt. A path is reported as
+ * CommandMate-owned when **all** of the following hold, so that nothing the
+ * user or the agent wrote can be laundered through it into a false "no work":
+ *
+ *  - a receipt parses at `.agents/skills/<id>/.commandmate-receipt.json`, and
+ *    its `skill_id` is that directory's name;
+ *  - the root it names is `<known install prefix>/<skill_id>` — a receipt
+ *    claiming `src` or `.commandcode` as a root claims nothing;
+ *  - the file is listed in the receipt's `files`, is a regular file, and its
+ *    bytes still hash to the recorded `sha256`. A Skill file the agent edited
+ *    is the agent's change and stays counted;
+ *  - for the receipt itself in a secondary root: byte-identical to the
+ *    primary's.
+ *
+ * Callers apply the result to **untracked** entries only. A committed or
+ * tracked-and-modified Skill file is history the branch carries, and judging
+ * it is unchanged by this module.
+ *
+ * @module lib/skills/receipt-owned-paths
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.collectSkillReceiptOwnedPaths = collectSkillReceiptOwnedPaths;
+const crypto_1 = require("crypto");
+const fs_1 = require("fs");
+const path_1 = __importDefault(require("path"));
+const constants_1 = require("../../lib/skills/constants");
+const install_plan_1 = require("../../lib/skills/install-plan");
+function sha256Hex(bytes) {
+    return (0, crypto_1.createHash)('sha256').update(bytes).digest('hex');
+}
+/** Read a regular file (never through a link), or null. */
+function readRegularFile(absolute) {
+    try {
+        if (!(0, fs_1.lstatSync)(absolute).isFile())
+            return null;
+        return (0, fs_1.readFileSync)(absolute);
+    }
+    catch {
+        return null;
+    }
+}
+/** A receipt-relative payload path that cannot leave its root. */
+function isSafeRelativePath(relative) {
+    if (relative === '' || relative.startsWith('/') || relative.includes('\\'))
+        return false;
+    return relative.split('/').every((segment) => segment !== '' && segment !== '.' && segment !== '..');
+}
+function isValidSkillId(skillId) {
+    return constants_1.SKILL_ID_PATTERN.test(skillId) && skillId.length <= constants_1.SKILL_ID_MAX_LENGTH;
+}
+/**
+ * Repository-relative POSIX paths of every untouched file a recorded Skill
+ * install placed in this worktree, receipts included.
+ *
+ * Never throws: an unreadable directory or receipt contributes nothing, which
+ * leaves those files counted exactly as before #3092.
+ */
+function collectSkillReceiptOwnedPaths(worktreePath) {
+    const owned = new Set();
+    const primaryAbs = path_1.default.join(worktreePath, constants_1.SKILL_PRIMARY_INSTALL_ROOT_PREFIX);
+    let skillDirs;
+    try {
+        skillDirs = (0, fs_1.readdirSync)(primaryAbs);
+    }
+    catch {
+        return owned;
+    }
+    for (const skillId of skillDirs) {
+        if (!isValidSkillId(skillId))
+            continue;
+        const primaryRoot = `${constants_1.SKILL_PRIMARY_INSTALL_ROOT_PREFIX}/${skillId}`;
+        const receiptBytes = readRegularFile(path_1.default.join(worktreePath, primaryRoot, install_plan_1.SKILL_RECEIPT_FILENAME));
+        if (receiptBytes === null)
+            continue;
+        const receipt = (0, install_plan_1.parseInstalledReceipt)(receiptBytes);
+        if (receipt === null || receipt.skill_id !== skillId)
+            continue;
+        const allowedRoots = new Set(constants_1.SKILL_INSTALL_ROOT_PREFIXES.map((prefix) => `${prefix}/${skillId}`));
+        const roots = (0, install_plan_1.receiptInstallRoots)(receipt);
+        // The receipt that names the roots must live in the primary one.
+        if (roots[0] !== primaryRoot)
+            continue;
+        for (const root of roots) {
+            if (typeof root !== 'string' || !allowedRoots.has(root))
+                continue;
+            const rootReceipt = readRegularFile(path_1.default.join(worktreePath, root, install_plan_1.SKILL_RECEIPT_FILENAME));
+            if (rootReceipt !== null && rootReceipt.equals(receiptBytes)) {
+                owned.add(`${root}/${install_plan_1.SKILL_RECEIPT_FILENAME}`);
+            }
+            for (const file of receipt.files) {
+                if (!file ||
+                    typeof file.path !== 'string' ||
+                    typeof file.sha256 !== 'string' ||
+                    !isSafeRelativePath(file.path) ||
+                    file.path === install_plan_1.SKILL_RECEIPT_FILENAME) {
+                    continue;
+                }
+                const bytes = readRegularFile(path_1.default.join(worktreePath, root, file.path));
+                if (bytes !== null && sha256Hex(bytes) === file.sha256.toLowerCase()) {
+                    owned.add(`${root}/${file.path}`);
+                }
+            }
+        }
+    }
+    return owned;
+}