commandmate 0.43.0 → 0.44.0

package/dist/server/src/lib/hooks/sources/claude/transcript.js

@@ -59,6 +59,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CLAUDE_END_TURN_STOP_REASON = exports.CLAUDE_HUMAN_PROMPT_SOURCES = exports.CLAUDE_HUMAN_ORIGIN_KIND = exports.CLAUDE_SLASH_COMMAND_PREFIX = exports.CLAUDE_THINKING_LABEL = exports.MAX_CLAUDE_TOOL_DETAIL_LENGTH = exports.MAX_CLAUDE_TURN_BLOCKS = exports.CLAUDE_TURN_TRUNCATION_MARKER = exports.MAX_CLAUDE_TURN_BODY_LENGTH = exports.CLAUDE_PROJECTS_DIR_SEGMENTS = void 0;
 exports.claudeProjectSlug = claudeProjectSlug;
 exports.claudeSlashCommandPrompt = claudeSlashCommandPrompt;
+exports.claudePastedContentPrompt = claudePastedContentPrompt;
 exports.readClaudeContentBlock = readClaudeContentBlock;
 exports.readClaudeTranscriptRecord = readClaudeTranscriptRecord;
 exports.parseClaudeTranscript = parseClaudeTranscript;
@@ -210,6 +211,37 @@ function claudeSlashCommandPrompt(text) {
     const args = CLAUDE_COMMAND_ARGS_PATTERN.exec(trimmed)?.[1].trim() ?? '';
     return args.length === 0 ? name : `${name} ${args}`;
 }
+/**
+ * A paste's wrapper: `<pasted_content id="X">` … `</pasted_content id="X">`.
+ *
+ * The closing tag repeats the opening tag's id (`\1`), so a pair whose ids
+ * differ — or a tag only mentioned in prose — is not a wrapper and is left alone.
+ * One newline just inside each tag is the wrapper's own framing, not the body's.
+ */
+const CLAUDE_PASTED_CONTENT_PATTERN = /<pasted_content id="([^"<>\s]+)">\n?([\s\S]*?)\n?<\/pasted_content id="\1">/g;
+/**
+ * The text a person sent, with Claude Code's paste wrapper taken off (Issue #3102).
+ *
+ * Claude Code records a multi-line message that arrived as a paste — which is
+ * what CommandMate's tmux send looks like to it — with the body wrapped in
+ * `<pasted_content id="X">…</pasted_content id="X">`. `recordUserTurn` compares
+ * the transcript's text with the `/send` row (and a relay row) byte for byte, so
+ * the wrapper made every such prompt look like a different message and a second
+ * `user` row was written. Unwrapping here lets the existing adoption rules match.
+ *
+ * Every wrapper in the text is replaced by its body, including one inside a
+ * sentence the person typed around a paste. When the result is empty the original
+ * is returned, so this never turns a record into a blank prompt.
+ *
+ * @param text - The record's text, as {@link ClaudeTranscriptRecord.text} holds it
+ * @returns The text without wrappers, or `text` itself when there is none to remove
+ */
+function claudePastedContentPrompt(text) {
+    if (!text.includes('<pasted_content id='))
+        return text;
+    const unwrapped = text.replace(CLAUDE_PASTED_CONTENT_PATTERN, (_match, _id, body) => body);
+    return unwrapped.trim().length === 0 ? text : unwrapped;
+}
 /**
  * Read one `message.content` element.
  *
@@ -517,7 +549,7 @@ function createClaudeTurn(record, sessionId) {
         // A slash command's record is XML and the operator typed a line; #2265 puts
         // the line on the turn so that the `user` row reads `/release v0.30.1` and
         // the `/send` row holding those same bytes is adopted rather than doubled.
-        promptText: claudeSlashCommandPrompt(record.text) ?? record.text,
+        promptText: claudeSlashCommandPrompt(record.text) ?? claudePastedContentPrompt(record.text),
         promptIsOperatorInput: isClaudeOperatorPromptRecord(record),
         blocks: [],
         assistantRecords: 0,

package/dist/server/src/lib/session/claude-executor.js

@@ -50,8 +50,8 @@ const opencode_executable_1 = require("../../lib/cli-tools/opencode-executable")
 exports.MAX_OUTPUT_SIZE = 10 * 1024 * 1024;
 /** Maximum output size stored in DB (100KB) */
 exports.MAX_STORED_OUTPUT_SIZE = 100 * 1024;
-/** Execution timeout in milliseconds (15 minutes) */
-exports.EXECUTION_TIMEOUT_MS = 15 * 60 * 1000;
+/** Execution timeout in milliseconds (30 minutes, Issue #3107; was 15) */
+exports.EXECUTION_TIMEOUT_MS = 30 * 60 * 1000;
 /** Maximum message length sent to claude -p */
 exports.MAX_MESSAGE_LENGTH = 10000;
 /** Allowed CLI tool identifiers for scheduled execution [DR2-002] derived from CLI_TOOL_IDS */

package/dist/server/src/lib/session/claude-session.js

@@ -4,7 +4,7 @@
  * Manages Claude CLI sessions within tmux for each worktree
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CLAUDE_PROMPT_POLL_INTERVAL = exports.CLAUDE_SEND_PROMPT_WAIT_TIMEOUT = exports.CLAUDE_PROMPT_WAIT_TIMEOUT = exports.CLAUDE_POST_PROMPT_DELAY = exports.CLAUDE_INIT_POLL_INTERVAL = exports.CLAUDE_INIT_TIMEOUT = void 0;
+exports.CLAUDE_PROMPT_POLL_INTERVAL = exports.CLAUDE_SEND_PROMPT_WAIT_TIMEOUT = exports.CLAUDE_PROMPT_WAIT_TIMEOUT = exports.CLAUDE_TRUST_DIALOG_EXITED = exports.CLAUDE_TRUST_DIALOG_CURSOR_STUCK = exports.CLAUDE_POST_PROMPT_DELAY = exports.CLAUDE_INIT_POLL_INTERVAL = exports.CLAUDE_INIT_TIMEOUT = void 0;
 exports.clearCachedClaudePath = clearCachedClaudePath;
 exports.isSessionHealthy = isSessionHealthy;
 exports.getSessionName = getSessionName;
@@ -130,6 +130,122 @@ exports.CLAUDE_INIT_POLL_INTERVAL = 300;
  * @see Issue #152 - First message not being sent after session start
  */
 exports.CLAUDE_POST_PROMPT_DELAY = 500;
+/**
+ * Polls (of CLAUDE_INIT_POLL_INTERVAL) a still-open trust dialog is given to
+ * close after being answered before it is answered again (Issue #3078). The
+ * measured close is ~950 ms (Issue #1637), so 10 polls = 3 s is not a race.
+ */
+const TRUST_DIALOG_REANSWER_POLLS = 10;
+/** Upper bound on trust dialog answers per session start (Issue #3078). */
+const TRUST_DIALOG_MAX_ANSWERS = 3;
+/**
+ * Polls a cursor move is given to show up on screen before the next one is
+ * sent (Issue #3089). 3 polls = ~900 ms: a TUI that is not taking keys yet
+ * swallows the move, and the next one goes in once the screen still shows the
+ * cursor off `Yes`.
+ */
+const TRUST_DIALOG_MOVE_SETTLE_POLLS = 3;
+/**
+ * Upper bound on single cursor moves per session start (Issue #3089). 20 moves
+ * at TRUST_DIALOG_MOVE_SETTLE_POLLS apart is ~18 s of a TUI that will not move its
+ * cursor; past that the start fails without ever pressing Enter.
+ */
+const TRUST_DIALOG_MAX_MOVES = 20;
+/** Reported when the cursor never reached `Yes` (Issue #3089). A fixed string, never captured output. */
+exports.CLAUDE_TRUST_DIALOG_CURSOR_STUCK = 'trust dialog: cursor did not reach "Yes, I trust this folder"';
+/** Reported when Claude Code quit from the trust dialog (Issue #3089). A fixed string, never captured output. */
+exports.CLAUDE_TRUST_DIALOG_EXITED = 'trust dialog: Claude Code exited to the shell';
+/**
+ * One poll's answer to the folder-trust dialog (Issue #201 / #3078 / #3089).
+ *
+ * Enter confirms whichever option the cursor is on, and since 2.1.259 that is
+ * `No, exit` by default (which quits Claude Code). So Enter is sent only when
+ * THIS screen shows the cursor on `Yes, I trust this folder`. Otherwise one
+ * move key goes in, and the screen is read again on a later poll: sending
+ * `Down Enter` together lost the `Down` to a TUI that was not taking keys yet
+ * and confirmed `No, exit` (Issue #3089). Both are bounded: Enter is repeated
+ * TRUST_DIALOG_REANSWER_POLLS apart up to TRUST_DIALOG_MAX_ANSWERS times for a
+ * dialog that outlives it, and a cursor that has not reached Yes after
+ * TRUST_DIALOG_MAX_MOVES moves fails the start without Enter.
+ *
+ * @param sessionName - tmux session name
+ * @param dialogScreen - ANSI-stripped pane output when the dialog is open, else null
+ * @param state - Mutated in place
+ * @throws {SessionStartFailedError} When the move budget is spent
+ */
+async function answerTrustDialog(sessionName, dialogScreen, state) {
+    if (state.pollsSinceAnswer !== null)
+        state.pollsSinceAnswer++;
+    if (state.pollsSinceMove !== null)
+        state.pollsSinceMove++;
+    if (dialogScreen === null)
+        return;
+    if (!state.seen) {
+        state.seen = true;
+        state.shellTellsExit = await paneCommandIsAgent(sessionName);
+    }
+    const keys = (0, cli_patterns_1.resolveClaudeTrustDialogKeys)(dialogScreen);
+    if (keys === null)
+        return;
+    if (keys.length === 1) {
+        // Cursor on Yes, on this very screen: the Issue #201 Enter.
+        const due = state.pollsSinceAnswer === null ||
+            (state.pollsSinceAnswer >= TRUST_DIALOG_REANSWER_POLLS && state.answers < TRUST_DIALOG_MAX_ANSWERS);
+        if (!due)
+            return;
+        try {
+            await (0, tmux_1.sendKeys)(sessionName, '', true);
+            state.pollsSinceAnswer = 0;
+            state.answers++;
+            logger.info('trust-dialog-detected', { keys: 'Enter', attempt: state.answers });
+        }
+        catch {
+            // Left unhandled so a later poll answers the dialog again
+        }
+        return;
+    }
+    // Cursor off Yes: one move, then look again before anything else.
+    if (state.pollsSinceMove !== null && state.pollsSinceMove < TRUST_DIALOG_MOVE_SETTLE_POLLS)
+        return;
+    if (state.moves >= TRUST_DIALOG_MAX_MOVES) {
+        throw new session_start_error_1.SessionStartFailedError('Claude Code', sessionName, exports.CLAUDE_TRUST_DIALOG_CURSOR_STUCK);
+    }
+    try {
+        await (0, tmux_1.sendSpecialKeys)(sessionName, [keys[0]]);
+        state.pollsSinceMove = 0;
+        state.moves++;
+        logger.info('trust-dialog-cursor-move', { key: keys[0], attempt: state.moves });
+    }
+    catch {
+        // Left unhandled so a later poll moves the cursor again
+    }
+}
+/**
+ * Whether the pane's foreground process is a shell again (Issue #3089). A
+ * pane tmux cannot describe is not called exited; the start budget still
+ * bounds that case. Only asked when {@link TrustDialogState.shellTellsExit}.
+ *
+ * @param sessionName - tmux session name
+ */
+async function hasReturnedToShell(sessionName) {
+    const command = await readPaneCommand(sessionName);
+    return command !== null && (0, cli_patterns_1.isShellPaneCommand)(command);
+}
+/** Whether the pane's foreground command is known and is not a shell (Issue #3089). */
+async function paneCommandIsAgent(sessionName) {
+    const command = await readPaneCommand(sessionName);
+    return command !== null && !(0, cli_patterns_1.isShellPaneCommand)(command);
+}
+/** `#{pane_current_command}`, or null when it cannot be read. */
+async function readPaneCommand(sessionName) {
+    try {
+        const command = await (0, tmux_1.getPaneCurrentCommand)(sessionName);
+        return typeof command === 'string' ? command : null;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Prompt wait timeout before message send (milliseconds)
  *
@@ -565,7 +681,8 @@ async function startClaudeSession(options) {
         const pollInterval = exports.CLAUDE_INIT_POLL_INTERVAL;
         const startTime = Date.now();
         let initialized = false;
-        let trustDialogHandled = false;
+        // Issue #3078 / #3089: the trust dialog's progress this start.
+        const trust = { pollsSinceAnswer: null, pollsSinceMove: null, answers: 0, moves: 0, seen: false, shellTellsExit: false };
         while (Date.now() - startTime < maxWaitTime) {
             await new Promise((resolve) => setTimeout(resolve, pollInterval));
             // SF-001: Use getCleanPaneOutput helper (DRY)
@@ -579,28 +696,27 @@ async function startClaudeSession(options) {
             if (cleanOutput === null) {
                 continue;
             }
+            // Issue #201 / #3078 / #3089: answer the folder-trust dialog. Checked
+            // BEFORE the prompt: the dialog's cursor row (`❯ No, exit`) wears the
+            // prompt glyph, so an open dialog is never read as a ready prompt.
+            const trustDialogOpen = (0, cli_patterns_1.isClaudeTrustDialogOpen)(cleanOutput);
+            await answerTrustDialog(sessionName, trustDialogOpen ? cleanOutput : null, trust);
             // Claude is ready when we see the prompt (DRY-001)
             // Use CLAUDE_PROMPT_PATTERN from cli-patterns.ts for consistency
             // Note: CLAUDE_SEPARATOR_PATTERN was removed from initialization check (Issue #187, P1-1)
-            if (cli_patterns_1.CLAUDE_PROMPT_PATTERN.test(cleanOutput)) {
+            if (!trustDialogOpen && cli_patterns_1.CLAUDE_PROMPT_PATTERN.test(cleanOutput)) {
                 // Wait for stability after prompt detection (CONS-007, DOC-001)
                 await new Promise((resolve) => setTimeout(resolve, exports.CLAUDE_POST_PROMPT_DELAY));
                 logger.info('claude-initialized-in');
                 initialized = true;
                 break;
             }
-            // Issue #201: Detect trust dialog and auto-respond with Enter
-            // Condition order: CLAUDE_PROMPT_PATTERN (above) is checked first for shortest path
-            if (!trustDialogHandled && cli_patterns_1.CLAUDE_TRUST_DIALOG_PATTERN.test(cleanOutput)) {
-                try {
-                    await (0, tmux_1.sendKeys)(sessionName, '', true);
-                    trustDialogHandled = true;
-                    logger.info('trust-dialog-detected');
-                }
-                catch {
-                    // Left unhandled so the next poll answers the dialog again
-                }
-                // Continue polling to wait for prompt detection
+            // Issue #3089: the dialog is gone and no prompt came up. If the pane is
+            // back at its shell, Claude Code quit (an Enter that landed on
+            // `No, exit`); nothing will ever draw a prompt, so fail now instead of
+            // spending the rest of the budget (and answering the shell).
+            if (!trustDialogOpen && trust.shellTellsExit && (await hasReturnedToShell(sessionName))) {
+                throw new session_start_error_1.SessionStartFailedError('Claude Code', sessionName, exports.CLAUDE_TRUST_DIALOG_EXITED);
             }
             // Issue #1637: fail fast on a start that cannot succeed. The budget is
             // 60s of patience for a *slow* start; a session already showing a

package/dist/server/src/lib/session/session-start-error.js

@@ -30,6 +30,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SessionStartUnavailableError = exports.SessionStartFailedError = exports.SessionStartTimeoutError = exports.SESSION_START_UNAVAILABLE_CODE = exports.SESSION_START_FAILED_CODE = exports.SESSION_STARTING_CODE = void 0;
+exports.buildSessionExitedToShellMessage = buildSessionExitedToShellMessage;
 exports.isSessionStartTimeoutError = isSessionStartTimeoutError;
 exports.isSafeSessionStartError = isSafeSessionStartError;
 exports.isSessionStartUnavailableError = isSessionStartUnavailableError;
@@ -81,6 +82,25 @@ class SessionStartTimeoutError extends Error {
     }
 }
 exports.SessionStartTimeoutError = SessionStartTimeoutError;
+/**
+ * The message for a start timeout whose pane is back at a shell (Issue #3093).
+ *
+ * {@link SessionStartTimeoutError} says "the process is still running, so this
+ * is a slow start … nothing needs repairing" — true for a slow cold start, and
+ * exactly wrong when the agent quit during startup (e.g. a trust dialog that
+ * was answered with "No, exit"): the reader was told to wait for a process that
+ * no longer exists. Built from the tool's display name and the session name
+ * only, for the same SEC-SF-002 reason as the classes in this module.
+ *
+ * @param toolName - Display name of the CLI tool (e.g. `Claude Code`)
+ * @param sessionName - tmux session whose pane is back at a shell
+ */
+function buildSessionExitedToShellMessage(toolName, sessionName) {
+    return (`${toolName} exited before reaching its input prompt: the tmux session '${sessionName}' ` +
+        'is back at a shell, so this is not a slow start and waiting will not help. The message ' +
+        'was not delivered. Run `commandmate capture <worktree-id>` to see why it exited (for ' +
+        'example a startup dialog answered with exit, or a missing login), fix that, then send again.');
+}
 /**
  * The CLI tool printed an error that startup cannot recover from.
  *

package/dist/server/src/lib/skills/agent-state-paths.js

@@ -0,0 +1,39 @@
+"use strict";
+/**
+ * State files an agent CLI writes into the worktree on its own (Issue #3126)
+ *
+ * Command Code leaves `.commandcode/settings.local.json` and
+ * `.commandcode/taste/**` behind in any folder it runs in. Counted as change,
+ * they made a contract's `requireScopeClean` fail on a worktree whose worker
+ * stayed inside `allow`, and made `work-evidence` pass on one nobody worked in.
+ *
+ * Unlike receipt-owned paths (#3092) there is no receipt to vouch for them, so
+ * the declaration below is the whole rule, and it names files, never a whole
+ * directory: `.commandcode/` also holds things a task may legitimately change,
+ * and allowing it wholesale would wave those through. Callers apply this to
+ * **untracked** entries only, as for #3092: a committed or tracked-and-modified
+ * file is history the branch carries.
+ *
+ * Only paths whose existence is confirmed are declared. Other agents (claude,
+ * codex, ...) are deliberately absent until someone has seen them write one.
+ *
+ * @module lib/skills/agent-state-paths
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AGENT_STATE_DIR_PREFIXES = exports.AGENT_STATE_FILES = void 0;
+exports.isAgentStatePath = isAgentStatePath;
+exports.isAgentStateUntrackedEntry = isAgentStateUntrackedEntry;
+/** Exact repository-relative files an agent CLI manages itself. */
+exports.AGENT_STATE_FILES = ['.commandcode/settings.local.json'];
+/** Directory prefixes (with trailing slash) an agent CLI manages itself. */
+exports.AGENT_STATE_DIR_PREFIXES = ['.commandcode/taste/'];
+/** Whether `path` is a declared agent-managed state path. */
+function isAgentStatePath(path) {
+    if (exports.AGENT_STATE_FILES.includes(path))
+        return true;
+    return exports.AGENT_STATE_DIR_PREFIXES.some((prefix) => path.startsWith(prefix) && !path.slice(prefix.length).split('/').includes('..'));
+}
+/** Whether a porcelain record is an untracked file made only of such paths. */
+function isAgentStateUntrackedEntry(entry) {
+    return entry.status === '??' && entry.paths.every(isAgentStatePath);
+}

package/dist/server/src/lib/skills/receipt-owned-paths.js

@@ -0,0 +1,118 @@
+"use strict";
+/**
+ * Files CommandMate itself placed into a worktree by installing a Skill (Issue #3092)
+ *
+ * `skill install` leaves `.agents/skills/<id>/…` and `.claude/skills/<id>/…`
+ * untracked. Counted as change, those files made `work-evidence` pass on a
+ * worktree nobody had worked in (`uncommitted=74`), and made a contract's
+ * `requireScopeClean` fail on a worktree whose agent stayed inside `allow`.
+ *
+ * The answer is the receipt, and only the receipt. A path is reported as
+ * CommandMate-owned when **all** of the following hold, so that nothing the
+ * user or the agent wrote can be laundered through it into a false "no work":
+ *
+ *  - a receipt parses at `.agents/skills/<id>/.commandmate-receipt.json`, and
+ *    its `skill_id` is that directory's name;
+ *  - the root it names is `<known install prefix>/<skill_id>` — a receipt
+ *    claiming `src` or `.commandcode` as a root claims nothing;
+ *  - the file is listed in the receipt's `files`, is a regular file, and its
+ *    bytes still hash to the recorded `sha256`. A Skill file the agent edited
+ *    is the agent's change and stays counted;
+ *  - for the receipt itself in a secondary root: byte-identical to the
+ *    primary's.
+ *
+ * Callers apply the result to **untracked** entries only. A committed or
+ * tracked-and-modified Skill file is history the branch carries, and judging
+ * it is unchanged by this module.
+ *
+ * @module lib/skills/receipt-owned-paths
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.collectSkillReceiptOwnedPaths = collectSkillReceiptOwnedPaths;
+const crypto_1 = require("crypto");
+const fs_1 = require("fs");
+const path_1 = __importDefault(require("path"));
+const constants_1 = require("../../lib/skills/constants");
+const install_plan_1 = require("../../lib/skills/install-plan");
+function sha256Hex(bytes) {
+    return (0, crypto_1.createHash)('sha256').update(bytes).digest('hex');
+}
+/** Read a regular file (never through a link), or null. */
+function readRegularFile(absolute) {
+    try {
+        if (!(0, fs_1.lstatSync)(absolute).isFile())
+            return null;
+        return (0, fs_1.readFileSync)(absolute);
+    }
+    catch {
+        return null;
+    }
+}
+/** A receipt-relative payload path that cannot leave its root. */
+function isSafeRelativePath(relative) {
+    if (relative === '' || relative.startsWith('/') || relative.includes('\\'))
+        return false;
+    return relative.split('/').every((segment) => segment !== '' && segment !== '.' && segment !== '..');
+}
+function isValidSkillId(skillId) {
+    return constants_1.SKILL_ID_PATTERN.test(skillId) && skillId.length <= constants_1.SKILL_ID_MAX_LENGTH;
+}
+/**
+ * Repository-relative POSIX paths of every untouched file a recorded Skill
+ * install placed in this worktree, receipts included.
+ *
+ * Never throws: an unreadable directory or receipt contributes nothing, which
+ * leaves those files counted exactly as before #3092.
+ */
+function collectSkillReceiptOwnedPaths(worktreePath) {
+    const owned = new Set();
+    const primaryAbs = path_1.default.join(worktreePath, constants_1.SKILL_PRIMARY_INSTALL_ROOT_PREFIX);
+    let skillDirs;
+    try {
+        skillDirs = (0, fs_1.readdirSync)(primaryAbs);
+    }
+    catch {
+        return owned;
+    }
+    for (const skillId of skillDirs) {
+        if (!isValidSkillId(skillId))
+            continue;
+        const primaryRoot = `${constants_1.SKILL_PRIMARY_INSTALL_ROOT_PREFIX}/${skillId}`;
+        const receiptBytes = readRegularFile(path_1.default.join(worktreePath, primaryRoot, install_plan_1.SKILL_RECEIPT_FILENAME));
+        if (receiptBytes === null)
+            continue;
+        const receipt = (0, install_plan_1.parseInstalledReceipt)(receiptBytes);
+        if (receipt === null || receipt.skill_id !== skillId)
+            continue;
+        const allowedRoots = new Set(constants_1.SKILL_INSTALL_ROOT_PREFIXES.map((prefix) => `${prefix}/${skillId}`));
+        const roots = (0, install_plan_1.receiptInstallRoots)(receipt);
+        // The receipt that names the roots must live in the primary one.
+        if (roots[0] !== primaryRoot)
+            continue;
+        for (const root of roots) {
+            if (typeof root !== 'string' || !allowedRoots.has(root))
+                continue;
+            const rootReceipt = readRegularFile(path_1.default.join(worktreePath, root, install_plan_1.SKILL_RECEIPT_FILENAME));
+            if (rootReceipt !== null && rootReceipt.equals(receiptBytes)) {
+                owned.add(`${root}/${install_plan_1.SKILL_RECEIPT_FILENAME}`);
+            }
+            for (const file of receipt.files) {
+                if (!file ||
+                    typeof file.path !== 'string' ||
+                    typeof file.sha256 !== 'string' ||
+                    !isSafeRelativePath(file.path) ||
+                    file.path === install_plan_1.SKILL_RECEIPT_FILENAME) {
+                    continue;
+                }
+                const bytes = readRegularFile(path_1.default.join(worktreePath, root, file.path));
+                if (bytes !== null && sha256Hex(bytes) === file.sha256.toLowerCase()) {
+                    owned.add(`${root}/${file.path}`);
+                }
+            }
+        }
+    }
+    return owned;
+}

package/dist/server/src/lib/tmux/tmux.js

@@ -10,6 +10,7 @@ exports.reconcileSessionGeometry = reconcileSessionGeometry;
 exports.isTmuxAvailable = isTmuxAvailable;
 exports.hasSession = hasSession;
 exports.getSessionWorkingDirectory = getSessionWorkingDirectory;
+exports.getPaneCurrentCommand = getPaneCurrentCommand;
 exports.listSessions = listSessions;
 exports.createSession = createSession;
 exports.sendKeys = sendKeys;
@@ -216,6 +217,27 @@ async function getSessionWorkingDirectory(sessionName) {
         return null;
     }
 }
+/**
+ * The foreground command of a session's pane (`#{pane_current_command}`), or
+ * null when tmux cannot say (Issue #3089).
+ *
+ * Read by Claude's start wait to tell "the agent quit back to the shell" from
+ * "the agent is still drawing": once the agent has exited, the pane's
+ * foreground process is the login shell again (`bash`, `zsh`, `-zsh`, ...).
+ *
+ * @param sessionName - Target session name
+ * @returns The command name, or null when the session or tmux is unavailable
+ */
+async function getPaneCurrentCommand(sessionName) {
+    try {
+        const { stdout } = await execFileAsync('tmux', ['display-message', '-p', '-t', exactTarget(sessionName), '#{pane_current_command}'], { timeout: DEFAULT_TIMEOUT });
+        const command = stdout.trim();
+        return command === '' ? null : command;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * List all tmux sessions
  *
@@ -561,6 +583,9 @@ const ALLOWED_SPECIAL_KEYS = new Set([
     // (`COMMAND_CODE_NAVIGATION_KEY_VALUES`), so the route answers 400 for every
     // other tool — the same arrangement as `s` above.
     'C-a',
+    // Issue #3138: Command Code's plan review is submitted with ctrl+r; sent via
+    // sendSpecialKeys() like the other keys instead of a one-off sendKeys() call.
+    'C-r',
 ]);
 /**
  * Type guard for "sendSpecialKeys() will actually deliver this key" (Issue #2032).