commandmate 0.42.2 → 0.44.0

package/dist/server/src/lib/tmux/tmux.js

@@ -10,6 +10,7 @@ exports.reconcileSessionGeometry = reconcileSessionGeometry;
 exports.isTmuxAvailable = isTmuxAvailable;
 exports.hasSession = hasSession;
 exports.getSessionWorkingDirectory = getSessionWorkingDirectory;
+exports.getPaneCurrentCommand = getPaneCurrentCommand;
 exports.listSessions = listSessions;
 exports.createSession = createSession;
 exports.sendKeys = sendKeys;
@@ -216,6 +217,27 @@ async function getSessionWorkingDirectory(sessionName) {
         return null;
     }
 }
+/**
+ * The foreground command of a session's pane (`#{pane_current_command}`), or
+ * null when tmux cannot say (Issue #3089).
+ *
+ * Read by Claude's start wait to tell "the agent quit back to the shell" from
+ * "the agent is still drawing": once the agent has exited, the pane's
+ * foreground process is the login shell again (`bash`, `zsh`, `-zsh`, ...).
+ *
+ * @param sessionName - Target session name
+ * @returns The command name, or null when the session or tmux is unavailable
+ */
+async function getPaneCurrentCommand(sessionName) {
+    try {
+        const { stdout } = await execFileAsync('tmux', ['display-message', '-p', '-t', exactTarget(sessionName), '#{pane_current_command}'], { timeout: DEFAULT_TIMEOUT });
+        const command = stdout.trim();
+        return command === '' ? null : command;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * List all tmux sessions
  *
@@ -254,6 +276,33 @@ async function listSessions() {
         return [];
     }
 }
+/**
+ * Issue #2958: what window 0 of a new session runs until `createSession`
+ * replaces it with the login shell. Two words so tmux execs it directly (a
+ * single word would be run through `default-shell -c`); it never exits on its
+ * own and dies with the SIGHUP the replacement sends.
+ */
+const PLACEHOLDER_PANE_COMMAND = ['sleep', '2147483647'];
+/**
+ * Fallback for a failed window rebuild: swap the placeholder in window 0 for
+ * the login shell tmux would have started (`default-shell`, as a login shell).
+ *
+ * A bare `respawn-pane` would re-run the pane's creation command — the
+ * placeholder — so the shell is named explicitly.
+ */
+async function respawnLoginShell(sessionName, workingDirectory) {
+    let shell = '';
+    try {
+        const { stdout } = await execFileAsync('tmux', ['show-options', '-gv', 'default-shell'], { timeout: DEFAULT_TIMEOUT });
+        shell = stdout.trim();
+    }
+    catch {
+        // Fall through to the environment's shell.
+    }
+    if (!shell)
+        shell = process.env.SHELL || '/bin/sh';
+    await execFileAsync('tmux', ['respawn-pane', '-k', '-t', `${exactTarget(sessionName)}0`, '-c', workingDirectory, shell, '-l'], { timeout: DEFAULT_TIMEOUT });
+}
 /**
  * Create a new tmux session
  *
@@ -300,7 +349,23 @@ async function createSession(sessionNameOrOptions, cwd) {
     try {
         // Create session with explicit window size to avoid 80x24 default
         // This is critical for TUI tools (Copilot, OpenCode) that use alternate screen
-        await execFileAsync('tmux', ['new-session', '-d', '-s', sessionName, '-c', workingDirectory, '-x', String(windowWidth), '-y', String(windowHeight)], { timeout: DEFAULT_TIMEOUT });
+        //
+        // Issue #2958: window 0 runs a PLACEHOLDER, not the login shell, because it
+        // is thrown away by the `new-window -k` below a few milliseconds later. A
+        // shell killed that early is still inside its rc files, and pyenv's
+        // `pyenv init -` (`command pyenv rehash`) can die holding its lock file
+        // (`$PYENV_ROOT/shims/.pyenv-shim`). The NEXT shell then spins in
+        // `pyenv rehash` for its 60s lock timeout before running the launch command,
+        // so the agent missed the 60s initialization wait (exit 99). Measured on tmux
+        // 3.5a / pyenv 2.6.0: 7 of 40 shell-first creations left the lock behind and
+        // the replacement pane ran its first command after 61s; 0 of 40 with the
+        // placeholder. Two argv words make tmux exec it directly, so no shell (and
+        // no rc file) is started for window 0 at all.
+        await execFileAsync('tmux', [
+            'new-session', '-d', '-s', sessionName, '-c', workingDirectory,
+            '-x', String(windowWidth), '-y', String(windowHeight),
+            ...PLACEHOLDER_PANE_COMMAND,
+        ], { timeout: DEFAULT_TIMEOUT });
         // Issue #1624: `history-limit` must be set BEFORE the pane that uses it exists.
         //
         // It is a session option, but a pane sizes its scrollback buffer ONCE, from
@@ -324,7 +389,9 @@ async function createSession(sessionNameOrOptions, cwd) {
         // cwd instead). Omitting it silently launches every agent in the wrong repo.
         //
         // Best-effort, matching the geometry step below: if this fails the session is
-        // still usable, just with tmux's default 2000-line scrollback.
+        // still usable, just with tmux's default 2000-line scrollback. Window 0 is
+        // only a placeholder (Issue #2958), so the fallback must still put the login
+        // shell into it — see respawnLoginShell().
         try {
             await execFileAsync('tmux', ['new-window', '-k', '-t', `${exactTarget(sessionName)}0`, '-c', workingDirectory], { timeout: DEFAULT_TIMEOUT });
         }
@@ -334,6 +401,7 @@ async function createSession(sessionNameOrOptions, cwd) {
                 historyLimit,
                 error: error instanceof Error ? error.message : String(error),
             });
+            await respawnLoginShell(sessionName, workingDirectory);
         }
         // Issue #1163: Pin the pane to a fixed height so alternate-screen TUIs
         // (Claude/Codex/etc.) keep enough visible rows for capture-pane.
@@ -515,6 +583,9 @@ const ALLOWED_SPECIAL_KEYS = new Set([
     // (`COMMAND_CODE_NAVIGATION_KEY_VALUES`), so the route answers 400 for every
     // other tool — the same arrangement as `s` above.
     'C-a',
+    // Issue #3138: Command Code's plan review is submitted with ctrl+r; sent via
+    // sendSpecialKeys() like the other keys instead of a one-off sendKeys() call.
+    'C-r',
 ]);
 /**
  * Type guard for "sendSpecialKeys() will actually deliver this key" (Issue #2032).

package/dist/server/src/lib/verification/env-clean-gate.js

@@ -17,9 +17,13 @@
  *      counted, and it is the single failure this gate must not reproduce.
  *   2. **Additions and removals are judged asymmetrically.** Everything that
  *      existed at task start must still exist, whoever it belonged to — that is
- *      the pkill (#1739) and `kill-server` (#1624) case — with one exception: a
- *      tmux session the baseline recorded as *another CommandMate server's*
- *      (#2627), which that server may close whenever it likes. New things are a
+ *      the pkill (#1739) and `kill-server` (#1624) case — with three exceptions,
+ *      each recorded in the baseline rather than guessed at verification: a
+ *      tmux session of *another CommandMate server* (#2627) or of *this* server's
+ *      worktree in *another repository* (#3043), which their owners close
+ *      whenever they like, and a `.commandmate-demo-vitest-<pid>` directory
+ *      whose pid was already dead (#3043), which the demo-video tests clean up
+ *      by design. New things are a
  *      violation *unless they are attributable to another worker*, because
  *      parallel delegations legitimately start their own sessions and servers
  *      inside each other's measurement windows — or unless they are the one
@@ -31,10 +35,12 @@
  * @module lib/verification/env-clean-gate
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ENV_CLEAN_GUIDANCE = exports.MAX_REPORTED_ENV_CHANGES = exports.REQUIRE_ENV_CLEAN_SOURCE_CONTRACT = exports.REQUIRE_ENV_CLEAN_SOURCE_CONFIG = void 0;
+exports.ENV_CLEAN_GUIDANCE = exports.MAX_REPORTED_ENV_CHANGES = exports.isLivePid = exports.readLivePidCwd = exports.REQUIRE_ENV_CLEAN_SOURCE_CONTRACT = exports.REQUIRE_ENV_CLEAN_SOURCE_CONFIG = void 0;
 exports.resolveRequireEnvClean = resolveRequireEnvClean;
 exports.attributeSessionName = attributeSessionName;
 exports.attributeAnchor = attributeAnchor;
+exports.demoVitestPid = demoVitestPid;
+exports.attributeHomeEntry = attributeHomeEntry;
 exports.resolveTaskSessionName = resolveTaskSessionName;
 exports.recordTaskSession = recordTaskSession;
 exports.readTaskSession = readTaskSession;
@@ -42,11 +48,19 @@ exports.currentSessionServer = currentSessionServer;
 exports.isOtherServerSession = isOtherServerSession;
 exports.recordOtherServerSessions = recordOtherServerSessions;
 exports.readOtherServerSessions = readOtherServerSessions;
+exports.recordOtherRepositorySessions = recordOtherRepositorySessions;
+exports.readOtherRepositorySessions = readOtherRepositorySessions;
+exports.recordDeadDemoVitestEntries = recordDeadDemoVitestEntries;
+exports.readDeadDemoVitestEntries = readDeadDemoVitestEntries;
 exports.diffEnvSnapshots = diffEnvSnapshots;
 exports.formatEnvCleanReport = formatEnvCleanReport;
 exports.envCleanNoBaseline = envCleanNoBaseline;
 exports.evaluateEnvClean = evaluateEnvClean;
+const child_process_1 = require("child_process");
+const fs_1 = require("fs");
 const path_1 = require("path");
+const db_instance_1 = require("../../lib/db/db-instance");
+const worktree_db_1 = require("../../lib/db/worktree-db");
 const session_name_1 = require("../../lib/cli-tools/session-name");
 const types_1 = require("../../lib/cli-tools/types");
 const env_snapshot_1 = require("./env-snapshot");
@@ -138,16 +152,102 @@ function attributeAnchor(anchor, worktreePath) {
         return 'other';
     return 'unattributed';
 }
-function attributeEntry(probeId, entry, context) {
+/** Bounded like the snapshot probes: a hung `lsof` must not hold a run open. */
+const PID_CWD_TIMEOUT_MS = 5_000;
+/**
+ * Read a process's cwd from the machine: `/proc/<pid>/cwd` on Linux, `lsof` on
+ * macOS (which has no procfs). A dead pid, a process owned by someone this user
+ * cannot inspect, or a missing `lsof` all answer null — which leaves the entry
+ * unattributed, the strict verdict.
+ */
+const readLivePidCwd = (pid) => {
+    try {
+        process.kill(pid, 0);
+    }
+    catch (error) {
+        // EPERM means the process exists but belongs to another user.
+        if (error.code !== 'EPERM')
+            return null;
+    }
+    if (process.platform === 'linux') {
+        try {
+            return (0, fs_1.readlinkSync)(`/proc/${pid}/cwd`);
+        }
+        catch {
+            return null;
+        }
+    }
+    try {
+        const out = (0, child_process_1.execFileSync)('lsof', ['-a', '-d', 'cwd', '-p', String(pid), '-F', 'n'], {
+            encoding: 'utf8',
+            timeout: PID_CWD_TIMEOUT_MS,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        const line = out.split('\n').find((field) => field.startsWith('n'));
+        return line ? line.slice(1) : null;
+    }
+    catch {
+        return null;
+    }
+};
+exports.readLivePidCwd = readLivePidCwd;
+/**
+ * `tests/unit/skills/demo-video/env-scripts.test.ts` creates
+ * `~/.commandmate-demo-vitest-<pid>` for the length of its run — in the real
+ * `$HOME`, because `env-up.sh` refuses `/tmp` and `/var` (#2954). The name
+ * carries the pid of the test process that made it, which is the one `$HOME`
+ * entry whose owner can be established.
+ */
+const DEMO_VITEST_HOME_ENTRY = /^\.commandmate-demo-vitest-([1-9]\d*)$/;
+const isLivePid = (pid) => {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === 'EPERM';
+    }
+};
+exports.isLivePid = isLivePid;
+/** The pid a `.commandmate-demo-vitest-<pid>` name carries; null for any other name. */
+function demoVitestPid(name) {
+    const match = DEMO_VITEST_HOME_ENTRY.exec(name);
+    if (!match)
+        return null;
+    const pid = Number(match[1]);
+    return Number.isSafeInteger(pid) ? pid : null;
+}
+/**
+ * Attribute a `$HOME` entry (#2954).
+ *
+ * Only `.commandmate-demo-vitest-<pid>` can be attributed, and only while its
+ * pid is alive: the test process's cwd is then judged exactly as a listener's
+ * is ({@link attributeAnchor}), so a parallel worktree's test run is `other`.
+ * A dead pid, an unreadable cwd, or a cwd inside this worktree leave it
+ * unattributed — a directory this worker's own tests failed to remove is still
+ * caught.
+ */
+function attributeHomeEntry(name, worktreePath, resolvePidCwd = exports.readLivePidCwd) {
+    const pid = demoVitestPid(name);
+    if (pid === null)
+        return 'unattributed';
+    const owner = attributeAnchor(resolvePidCwd(pid), worktreePath);
+    // `self` is not an excuse for an addition, and a file has no self to report.
+    return owner === 'other' ? 'other' : 'unattributed';
+}
+function attributeEntry(probeId, entry, context, resolvePidCwd) {
     switch (probeId) {
         case 'tmux-sessions':
             return attributeSessionName(entry.key, context.worktreeId);
         case 'listeners':
             return attributeAnchor(entry.anchor, context.worktreePath);
+        case 'home-entries':
+            return attributeHomeEntry(entry.key, context.worktreePath, resolvePidCwd);
         default:
             // A file has no owner. `$HOME` and `~/.commandmate` are shared, so an
             // entry appearing there is a violation for whoever is being judged — the
-            // rule the Issue's incident list is made of.
+            // rule the Issue's incident list is made of. The one `$HOME` exception is
+            // above (#2954).
             return 'unattributed';
     }
 }
@@ -172,11 +272,13 @@ function resolveTaskSessionName(task) {
     }
 }
 /** A freshly captured baseline, stamped with its task's own agent session. */
-function recordTaskSession(snapshot, task, server = currentSessionServer()) {
+function recordTaskSession(snapshot, task, server = currentSessionServer(), isPidAlive = exports.isLivePid) {
     return {
         ...snapshot,
         taskSession: resolveTaskSessionName(task),
         otherServerSessions: recordOtherServerSessions(snapshot, server),
+        otherRepositorySessions: recordOtherRepositorySessions(snapshot, task.worktreeId, server),
+        deadDemoVitestEntries: recordDeadDemoVitestEntries(snapshot, isPidAlive),
     };
 }
 /**
@@ -212,6 +314,14 @@ function currentSessionServer() {
                 return undefined;
             }
         },
+        repositoryOf: (worktreeId) => {
+            try {
+                return (0, worktree_db_1.getWorktreeById)((0, db_instance_1.getDbInstance)(), worktreeId)?.repositoryPath || null;
+            }
+            catch {
+                return null;
+            }
+        },
     };
 }
 /**
@@ -290,6 +400,131 @@ function readOtherServerSessions(baseline) {
         return new Set();
     return new Set(recorded.filter((name) => typeof name === 'string'));
 }
+// =============================================================================
+// This server's sessions of another repository (Issue #3043)
+// =============================================================================
+/**
+ * The repository a session of this server belongs to, or null when that
+ * cannot be pinned to exactly one.
+ *
+ * The worktree id and the instance suffix are not separable by name alone
+ * (`parseSessionName`), so every hyphen-boundary prefix of the tail is looked
+ * up; a prefix that is not a registered worktree answers null and is skipped.
+ * More than one repository among the answers is ambiguous and answers null —
+ * the strict direction, because null excuses nothing.
+ */
+function sessionRepository(tail, server) {
+    const repositoryOf = server.repositoryOf;
+    if (!repositoryOf)
+        return null;
+    const repositories = new Set();
+    let end = tail.indexOf('-');
+    for (;;) {
+        const candidate = end === -1 ? tail : tail.slice(0, end);
+        const repository = repositoryOf(candidate);
+        if (repository)
+            repositories.add(repository);
+        if (end === -1)
+            break;
+        end = tail.indexOf('-', end + 1);
+    }
+    return repositories.size === 1 ? [...repositories][0] : null;
+}
+/**
+ * The baseline's `mcbd-*` sessions of *this* server whose worktree belongs to a
+ * repository other than the task's, at task creation.
+ *
+ * Why this is the second line removals are excused on — the design note for
+ * #3043, which extends the one for #2627 rather than contradicting it:
+ *
+ *   - #1624, the case the removal rule exists for, was a worker killing a
+ *     *sibling worktree of the same repository*. Those sessions stay guarded
+ *     exactly as before: a same-repository removal is never excused, however
+ *     plainly `other` its name is.
+ *   - A worktree of another repository is driven by another orchestrate on the
+ *     same server, which closes its workers' sessions when they finish (the
+ *     2026-09-29 and 2026-09-30 runs, `commandagent-issue-546/554` against
+ *     `commandmate-issue-3023`). A delegation has no business in another
+ *     repository, and the one it is judged for cannot tell that close from a
+ *     kill any better than it could for another server's.
+ *   - It uses the database the #2627 note rejected, but not for what that note
+ *     rejected it for: there the other server's worktrees lived in a different
+ *     database under colliding ids. Here the session carries *this* server's
+ *     namespace, so *this* server's worktree table is the authority on it.
+ *   - Recorded at task creation, like {@link recordOtherServerSessions}: the
+ *     other orchestrate may remove its worktree — and with it the row — before
+ *     this task is verified, and an unknown worktree excuses nothing.
+ *
+ * Still rejected: excusing every `other` removal (drops #1624), counting,
+ * timing and the worker's command log, for the reasons in the #2627 note; and
+ * a "needs review" verdict of its own, because the orchestrator's review of the
+ * same-repository case is exactly the one #1624 needs a hard failure for.
+ *
+ * @returns the names, or null when `server` has no namespace or cannot place
+ *          the task's own worktree
+ */
+function recordOtherRepositorySessions(snapshot, taskWorktreeId, server) {
+    if (server.namespace === null || !server.repositoryOf)
+        return null;
+    const ownRepository = server.repositoryOf(taskWorktreeId);
+    if (!ownRepository)
+        return null;
+    const sessions = snapshot.probes['tmux-sessions'];
+    if (!sessions || sessions.status !== 'ok')
+        return [];
+    return sessions.entries
+        .map((entry) => entry.key)
+        .filter((name) => {
+        if (attributeSessionName(name, taskWorktreeId) !== 'other')
+            return false;
+        if (isOtherServerSession(name, server))
+            return false;
+        const parsed = (0, session_name_1.parseSessionName)(name);
+        if (!parsed)
+            return false;
+        const repository = sessionRepository(parsed.rest, server);
+        return repository !== null && repository !== ownRepository;
+    });
+}
+/** The recorded other-repository sessions of a baseline; empty when none was recorded. */
+function readOtherRepositorySessions(baseline) {
+    const recorded = baseline.otherRepositorySessions;
+    if (!Array.isArray(recorded))
+        return new Set();
+    return new Set(recorded.filter((name) => typeof name === 'string'));
+}
+// =============================================================================
+// Stale demo-vitest directories (Issue #3043)
+// =============================================================================
+/**
+ * The baseline's `.commandmate-demo-vitest-<pid>` entries whose pid was already
+ * dead at task creation.
+ *
+ * Recorded then, because only then is it knowable: a removed directory's pid is
+ * always dead by verification, so the gate could not otherwise tell a leftover
+ * swept up by `env-scripts.test.ts` (#3025, run by any parallel worktree's unit
+ * gate) from a directory a live test run was still using. The latter — a pid
+ * alive at task start — stays a violation: a worker may have deleted a parallel
+ * test's working directory.
+ */
+function recordDeadDemoVitestEntries(snapshot, isPidAlive = exports.isLivePid) {
+    const home = snapshot.probes['home-entries'];
+    if (!home || home.status !== 'ok')
+        return [];
+    return home.entries
+        .map((entry) => entry.key)
+        .filter((name) => {
+        const pid = demoVitestPid(name);
+        return pid !== null && !isPidAlive(pid);
+    });
+}
+/** The recorded dead-pid demo-vitest entries of a baseline; empty when none was recorded. */
+function readDeadDemoVitestEntries(baseline) {
+    const recorded = baseline.deadDemoVitestEntries;
+    if (!Array.isArray(recorded))
+        return new Set();
+    return new Set(recorded.filter((name) => typeof name === 'string' && demoVitestPid(name) !== null));
+}
 function toChange(entry, owner) {
     return { key: entry.key, detail: entry.detail, owner };
 }
@@ -304,7 +539,10 @@ function toChange(entry, owner) {
 function diffEnvSnapshots(baseline, final, context, options = {}) {
     const taskSession = readTaskSession(baseline);
     const otherServerSessions = readOtherServerSessions(baseline);
+    const otherRepositorySessions = readOtherRepositorySessions(baseline);
+    const deadDemoVitestEntries = readDeadDemoVitestEntries(baseline);
     const ignoredHomeEntries = new Set(options.ignoreHomeEntries ?? []);
+    const resolvePidCwd = options.resolvePidCwd ?? exports.readLivePidCwd;
     const probes = env_snapshot_1.ENV_PROBE_IDS.map((probeId) => {
         const before = baseline.probes[probeId];
         const after = final.probes[probeId];
@@ -318,6 +556,8 @@ function diffEnvSnapshots(baseline, final, context, options = {}) {
                 taskSessionAdded: [],
                 removed: [],
                 removedByOtherServer: [],
+                removedByOtherRepository: [],
+                removedStaleDemoVitest: [],
                 ignoredByConfig: [],
             };
         }
@@ -331,6 +571,8 @@ function diffEnvSnapshots(baseline, final, context, options = {}) {
                 taskSessionAdded: [],
                 removed: [],
                 removedByOtherServer: [],
+                removedByOtherRepository: [],
+                removedStaleDemoVitest: [],
                 ignoredByConfig: [],
             };
         }
@@ -346,7 +588,7 @@ function diffEnvSnapshots(baseline, final, context, options = {}) {
         for (const entry of after.entries) {
             if (beforeKeys.has(entry.key))
                 continue;
-            const owner = attributeEntry(probeId, entry, context);
+            const owner = attributeEntry(probeId, entry, context, resolvePidCwd);
             if (isIgnoredByConfig(entry)) {
                 ignoredByConfig.push(toChange(entry, owner));
                 continue;
@@ -367,10 +609,12 @@ function diffEnvSnapshots(baseline, final, context, options = {}) {
             after.entries.some((entry) => beforeKeys.has(entry.key) || (taskSession !== null && entry.key === taskSession));
         const removed = [];
         const removedByOtherServer = [];
+        const removedByOtherRepository = [];
+        const removedStaleDemoVitest = [];
         for (const entry of before.entries) {
             if (afterKeys.has(entry.key))
                 continue;
-            const change = toChange(entry, attributeEntry(probeId, entry, context));
+            const change = toChange(entry, attributeEntry(probeId, entry, context, resolvePidCwd));
             if (isIgnoredByConfig(entry)) {
                 ignoredByConfig.push(change);
             }
@@ -379,6 +623,14 @@ function diffEnvSnapshots(baseline, final, context, options = {}) {
                 otherServerSessions.has(entry.key)) {
                 removedByOtherServer.push(change);
             }
+            else if (tmuxServerSurvived &&
+                change.owner === 'other' &&
+                otherRepositorySessions.has(entry.key)) {
+                removedByOtherRepository.push(change);
+            }
+            else if (probeId === 'home-entries' && deadDemoVitestEntries.has(entry.key)) {
+                removedStaleDemoVitest.push(change);
+            }
             else {
                 removed.push(change);
             }
@@ -392,6 +644,8 @@ function diffEnvSnapshots(baseline, final, context, options = {}) {
             taskSessionAdded,
             removed,
             removedByOtherServer,
+            removedByOtherRepository,
+            removedStaleDemoVitest,
             ignoredByConfig,
         };
     });
@@ -453,6 +707,14 @@ function formatTaskSessionChanges(changes) {
 function formatRemovedByOtherServer(changes) {
     return changes.map((change) => `    · - ${change.key} (ignored: another CommandMate server's session, recorded at task start)`);
 }
+/** Removals excused as this server's sessions of another repository (#3043), one line each. */
+function formatRemovedByOtherRepository(changes) {
+    return changes.map((change) => `    · - ${change.key} (ignored: a worktree of another repository on this server, recorded at task start)`);
+}
+/** Removals excused as leftover demo-vitest directories (#3043), one line each. */
+function formatRemovedStaleDemoVitest(changes) {
+    return changes.map((change) => `    · - ${change.key} (ignored: its pid was already dead at task start — a leftover swept by the demo-video tests)`);
+}
 function formatIgnoredByConfig(changes) {
     if (changes.length === 0)
         return [];
@@ -486,6 +748,8 @@ function formatEnvCleanReport(diff) {
             lines.push(`  ${probe.probeId} clean (${label})${excused}`);
             lines.push(...formatTaskSessionChanges(probe.taskSessionAdded));
             lines.push(...formatRemovedByOtherServer(probe.removedByOtherServer));
+            lines.push(...formatRemovedByOtherRepository(probe.removedByOtherRepository));
+            lines.push(...formatRemovedStaleDemoVitest(probe.removedStaleDemoVitest));
             lines.push(...formatIgnoredByConfig(probe.ignoredByConfig));
             continue;
         }
@@ -494,6 +758,8 @@ function formatEnvCleanReport(diff) {
         lines.push(...formatChanges('-', probe.removed));
         lines.push(...formatTaskSessionChanges(probe.taskSessionAdded));
         lines.push(...formatRemovedByOtherServer(probe.removedByOtherServer));
+        lines.push(...formatRemovedByOtherRepository(probe.removedByOtherRepository));
+        lines.push(...formatRemovedStaleDemoVitest(probe.removedStaleDemoVitest));
         lines.push(...formatIgnoredByConfig(probe.ignoredByConfig));
         for (const excused of probe.ignoredAdded) {
             lines.push(`    · ${excused.key} (ignored: belongs to another worktree)`);
@@ -518,7 +784,11 @@ function envCleanNoBaseline(taskId, sources) {
     return (`${verify_config_1.ENV_CLEAN_GATE_ID}: UNKNOWN — no baseline snapshot exists for ${who}, so nothing can be ` +
         'compared. This is NOT "the environment is unchanged": no measurement was taken. ' +
         'A baseline is recorded when the task is created (`send --contract`) and only while the ' +
-        `gate is switched on (currently: ${how}). Switch it on, then re-send the task.`);
+        `gate is switched on (currently: ${how}). Switch it on, then re-send the task.` +
+        (taskId
+            ? ''
+            : ' To re-verify this worktree\'s contract task (this run is not attached to a task), run ' +
+                '`commandmate verify <worktree> --task <id>`.'));
 }
 /**
  * Judge the machine against the task's baseline.
@@ -552,6 +822,7 @@ async function evaluateEnvClean(input) {
     }
     const diff = diffEnvSnapshots(input.baseline, final, input, {
         ignoreHomeEntries: input.ignoreHomeEntries,
+        resolvePidCwd: input.resolvePidCwd,
     });
     const header = `${verify_config_1.ENV_CLEAN_GATE_ID}: baseline=${new Date(input.baseline.capturedAt).toISOString()} ` +
         `status=${diff.status} task-session=${describeTaskSession(diff.taskSession)}`;

package/dist/server/src/lib/verification/gate-runner.js

@@ -50,6 +50,8 @@ const worktree_index_1 = require("./worktree-index");
 // exit-code table the pane prints, so the producer and the reader are one string.
 const run_verdict_vocabulary_1 = require("./run-verdict-vocabulary");
 const scope_gate_1 = require("./scope-gate");
+const receipt_owned_paths_1 = require("../../lib/skills/receipt-owned-paths");
+const agent_state_paths_1 = require("../../lib/skills/agent-state-paths");
 const verify_config_1 = require("./verify-config");
 Object.defineProperty(exports, "ENV_CLEAN_GATE_ID", { enumerable: true, get: function () { return verify_config_1.ENV_CLEAN_GATE_ID; } });
 Object.defineProperty(exports, "SCOPE_GATE_ID", { enumerable: true, get: function () { return verify_config_1.SCOPE_GATE_ID; } });
@@ -816,10 +818,35 @@ async function evaluateWorkEvidence(worktreePath, baseRef, requireCommit, agentE
     if (porcelain.code !== 0) {
         return done('error', "work-evidence: 'git status --porcelain' failed.", null);
     }
-    const uncommittedCount = (0, scope_gate_1.parsePorcelainEntries)(porcelain.stdout).filter((paths) => paths.some((path) => !(0, scope_gate_1.isContractPath)(path))).length;
+    // Untracked files a recorded Skill install placed, untouched since, are
+    // CommandMate's and not the agent's (#3092): installing a Skill alone must
+    // still read as `not_started`. Anything the receipt does not vouch for —
+    // including a Skill file whose bytes changed — is counted as before.
+    const skillOwned = (0, receipt_owned_paths_1.collectSkillReceiptOwnedPaths)(worktreePath);
+    let skillInstalledCount = 0;
+    const agentStateExcluded = new Set();
+    const uncommittedCount = (0, scope_gate_1.parsePorcelainStatusEntries)(porcelain.stdout).filter((entry) => {
+        if (!entry.paths.some((path) => !(0, scope_gate_1.isContractPath)(path)))
+            return false;
+        if ((0, scope_gate_1.isSkillInstalledUntrackedEntry)(entry, skillOwned)) {
+            skillInstalledCount += 1;
+            return false;
+        }
+        if ((0, agent_state_paths_1.isAgentStateUntrackedEntry)(entry)) {
+            entry.paths.forEach((path) => agentStateExcluded.add(path));
+            return false;
+        }
+        return true;
+    }).length;
     const summary = `work-evidence: baseRef=${baseRef} commits=${commitCount} uncommitted=${uncommittedCount}` +
         (requireCommit.required ? ' requireCommit=true' : '') +
-        ' (contract files excluded)';
+        ' (contract files excluded)' +
+        (skillInstalledCount > 0
+            ? ` (${skillInstalledCount} CommandMate-installed Skill file(s) excluded)`
+            : '') +
+        (agentStateExcluded.size > 0
+            ? ` (agent-managed state file(s) excluded: ${[...agentStateExcluded].sort().join(', ')})`
+            : '');
     if (!Number.isFinite(commitCount) || (commitCount === 0 && uncommittedCount === 0)) {
         // Issue #2043, and the ONLY place this gate's verdict differs from what it
         // was: git found nothing, so ask the agent. `null` — every tool but