commandmate 0.44.1 → 0.44.3

package/dist/server/src/lib/session/structured-status-merge.js

@@ -0,0 +1,335 @@
+"use strict";
+/**
+ * The two-layer status merge: the screen scrape set against the agent's own
+ * account of its turn (Issue #3215).
+ *
+ * Moved verbatim out of `current-output-builder`, which re-exports
+ * `mergeStructuredStatus`, `ScraperVerdict` and `MergedStatusVerdict` under the
+ * same names, so an import from either module reads the same declaration. The
+ * comments came along unedited: where one says "this module", it was written
+ * about `current-output-builder`.
+ *
+ * `summarizeAskUserQuestion`, `staleReadyCandidate` and `readNewestPromptAt`
+ * are exported for `buildPayload` and for nothing else; they are not part of
+ * what `current-output-builder` re-exports.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.summarizeAskUserQuestion = summarizeAskUserQuestion;
+exports.mergeStructuredStatus = mergeStructuredStatus;
+exports.staleReadyCandidate = staleReadyCandidate;
+exports.readNewestPromptAt = readNewestPromptAt;
+// Issue #2429: the send ledger, read directly from `chat-db` rather than from
+// the `@/lib/db` barrel because that barrel does not re-export it. It is the
+// SAME row `commandmate wait` asks for over
+// `GET /api/worktrees/:id/messages?limit=1&unit=pairs` (see `readNewestPromptAt`
+// in `cli/commands/wait.ts`), so the server and the CLI cannot disagree about
+// when this instance was last handed a prompt.
+const chat_db_1 = require("../../lib/db/chat-db");
+const logger_1 = require("../../lib/logger");
+const prompt_waiting_composition_1 = require("../../lib/session/prompt-waiting-composition");
+// Issue #3215: the name is the one this line has always been logged under. It
+// is what an operator greps for, so it did not move with the code.
+const logger = (0, logger_1.createLogger)('current-output-builder');
+/**
+ * The `AskUserQuestion` call as the degraded prompt can describe it
+ * (Issue #1726).
+ *
+ * Only the first question, and no option numbers — see
+ * {@link StructuredAskUserQuestionSummary} for why a layer that cannot see the
+ * screen must not publish numbers for it.
+ */
+function summarizeAskUserQuestion(episode) {
+    const first = episode?.spec.questions[0];
+    if (!first)
+        return null;
+    return {
+        question: first.question,
+        labels: first.choices.map((choice) => choice.label),
+        questionCount: episode.spec.questions.length,
+        // Issue #2951: a question that takes a typed answer, so the panel and the
+        // phone sheet can offer an input for it.
+        ...(first.custom ? { custom: true } : {}),
+    };
+}
+/**
+ * Prefer the agent's own account of what it is doing over the screen scrape
+ * (Issue #1723).
+ *
+ * Pure, and exported so the whole precedence table can be tested without a tmux
+ * session behind it.
+ *
+ * ## Why the scraper still wins in two cases
+ *
+ * **`waiting` on the scraper's side always wins.** A frame the detector reads
+ * as a prompt, a selection list or a pager is a frame a human has to act on,
+ * and this Issue deliberately does not touch `isPromptWaiting` / `promptData` /
+ * `isSelectionListActive` (they are #1725's). Letting a structured `running`
+ * overwrite `sessionStatus` while those three still said "answer me" would
+ * publish a self-contradicting payload. It is also the empirically necessary
+ * rule: the live capture found that Claude emits **no event at all** while an
+ * `AskUserQuestion` selection or "Ready to submit your answers?" screen is up
+ * (`agent-hooks-live-verification.md` §5.6), so the newest structured fact
+ * there is the `user_prompt_submit` that opened the turn — `running` — while
+ * the truth on screen is "waiting for a human". That is precisely the #1708
+ * stall, and the scraper is the only layer that can see it.
+ *
+ * **A structured `waiting` is applied only through the prompt-waiting state**
+ * (Issue #1725). #1723 recorded `Notification(permission_prompt)` and stopped
+ * there, for a reason that had to be answered before it could be promoted:
+ * nothing marks a permission prompt as *answered*, so a verdict read off the
+ * last event alone would stick until the next `Stop` and describe a session
+ * that went back to work minutes ago. `getStructuredPromptWaiting` is that
+ * answer — it is released by `Stop` / `user_prompt_submit` / a generation
+ * change, by the scraper reporting the frame it corroborated has cleared, and
+ * by expiry. So the `waiting` promoted here is the one that survives all of
+ * those, passed in explicitly; the raw `structured.status === 'waiting'` still
+ * decides nothing on its own.
+ *
+ * ## `isUnclassifiedActive` is not this function's to move (Issue #2011)
+ *
+ * The flag is carried through from the scraper on every path. It answers "could
+ * the detection layer read this frame?", and no amount of knowledge about the
+ * TURN changes the answer for the FRAME:
+ *
+ *  - a static overlay left on screen after a turn (`/help`, #1497) reads as
+ *    `running`/`no_recent_output` while the structured layer says `ready` — the
+ *    structured layer adds nothing about the screen, and clearing the flag would
+ *    take away the navigation hatch the user needs to escape;
+ *  - a frame nobody can classify while the structured layer says `running` is
+ *    still a frame nobody can classify. `wait`'s unclassified dwell (exit 10)
+ *    is the last hatch for a screen that produces no events at all, and #1708
+ *    exists because it was missing. A structured `running` does not prove a
+ *    human is not needed — see the AskUserQuestion case above.
+ *
+ * `#1723`'s reported case — `Stop` arrives while the spinner is still painted —
+ * needs no help from here: that frame reads `running`/`thinking_indicator`, which
+ * is classified, so the flag was already down and `wait` completes on the
+ * structured `ready` alone.
+ *
+ * What this function DOES move is `evidence`, and only upwards: see
+ * {@link hookClosedTurn}.
+ *
+ * @param turn - The published turn record for this instance, or null. Read only
+ *   for {@link hookClosedTurn}; `structured` remains the status authority.
+ */
+function mergeStructuredStatus(scraper, structured, promptWaiting = null, turn = null, lastPromptAt = null) {
+    if (scraper.status === 'waiting') {
+        return { ...scraper, structuredApplied: false };
+    }
+    // Issue #1725, the OR rule at the status level: the scraper reads this frame
+    // as running or ready, and the agent has told us a dialog is in front of it.
+    // Publishing `running` next to `isPromptWaiting: true` would be a payload
+    // that contradicts itself, and every consumer of `sessionStatus` — the
+    // sidebar dot, `deriveSessionStatus`, the worktrees API — would show a worker
+    // that needs a human as one that is busy.
+    if (promptWaiting !== null) {
+        return {
+            status: 'waiting',
+            reason: (0, prompt_waiting_composition_1.structuredWaitingReason)(promptWaiting),
+            thinking: false,
+            // Untouched: what the scraper could read about this frame does not change
+            // because the agent told us a dialog is open (Issue #1924).
+            evidence: scraper.evidence,
+            isUnclassifiedActive: scraper.isUnclassifiedActive,
+            structuredApplied: true,
+        };
+    }
+    if (structured === null || structured.status === 'waiting') {
+        return { ...scraper, structuredApplied: false };
+    }
+    // Issue #2429: the structured `ready` is about a turn older than the prompt
+    // this instance is currently answering, and the screen says so. See
+    // {@link structuredReadyPredatesPrompt} for why that combination is the only
+    // one in which the scraper wins a `running`.
+    if (structuredReadyPredatesPrompt(scraper, structured, turn, lastPromptAt)) {
+        return { ...scraper, structuredApplied: false };
+    }
+    const thinking = structured.status === 'running';
+    // Issue #2011 (対応 2): the agent's own turn close IS positive evidence.
+    //
+    // #1927 (DR2-003) guarded this override with `scraper.evidence === 'positive'`
+    // to stop a structured `ready` clearing `isUnclassifiedActive` on a frame
+    // nobody could read. It over-corrected twice over. First, the conjunct made
+    // the whole expression a no-op: `evidence = cond ? 'positive' : scraper.evidence`
+    // where `cond` requires `scraper.evidence === 'positive'` returns
+    // `scraper.evidence` on both arms, so the branch could not change a value in
+    // any direction. Second, the fix it was reaching for belonged one field over —
+    // the hatch is held open by {@link ScraperVerdict.isUnclassifiedActive}, which
+    // is carried through below rather than re-derived, so the evidence no longer
+    // has to be understated to protect it.
+    //
+    // What that leaves is a payload that stopped contradicting itself. A pane
+    // whose `reason` reads `hook_stop` while `statusEvidence` reads `'none'` is
+    // denying, in one field, the strongest positive signal this server can get: a
+    // `Stop` from the agent, for a turn this server watched open. `closedAt >
+    // openedAt` is what narrows it to that case — a `Stop` that arrived with no
+    // turn open publishes `openedAt: null` (see `recordAgentEvent`), and a close
+    // the SCREEN inferred carries one of the other {@link TurnCloseReason} values.
+    // Freshness needs no bound of its own: `getStructuredSessionState` answered
+    // null above once the display event passed STRUCTURED_STATE_MAX_AGE_MS.
+    //
+    // `scraper.status === 'running'` is deliberately NOT required. The session this
+    // Issue was reported from sat at `ready`/`input_prompt` with `closedBy: 'stop'`
+    // — the agent had said it was done and the frame agreed — and the old conjunct
+    // is what kept publishing `'none'` for it.
+    const evidence = structured.status === 'ready' && hookClosedTurn(turn) ? 'positive' : scraper.evidence;
+    return {
+        status: structured.status,
+        reason: structured.reason,
+        thinking,
+        evidence,
+        // Issue #2011: what the structured layer knows about the TURN says nothing
+        // about whether this FRAME could be read. #1708's dwell and the nav hatch
+        // are the last way out of a pane nothing can drive, and a `Stop` does not
+        // make an unreadable pane readable — see the `/help` overlay fixture in
+        // `tests/unit/lib/detection/fixtures/claude-live-2011/`.
+        isUnclassifiedActive: scraper.isUnclassifiedActive,
+        structuredApplied: true,
+    };
+}
+/**
+ * Whether the agent's own `Stop` closed a turn this server watched open
+ * (Issue #2011, 対応 2).
+ *
+ * Both halves are required. `closedBy: 'stop'` rules out the five close reasons
+ * that are the server's inference rather than the agent's word (`stale`,
+ * `generation`, `session_end`, `scraper_evidence`, `resync_idle`), and
+ * `closedAt > openedAt` rules out a `Stop` whose turn was never observed
+ * opening — `recordAgentEvent` publishes `openedAt: null` for that, and a close
+ * with nothing behind it is not a completion anybody watched.
+ */
+function hookClosedTurn(turn) {
+    if (turn === null)
+        return false;
+    const { closedBy, closedAt, openedAt } = turn;
+    return closedBy === 'stop' && closedAt !== null && openedAt !== null && closedAt > openedAt;
+}
+/**
+ * Whether a structured `ready` could be about a turn that ended before the
+ * prompt now on screen (Issue #2429).
+ *
+ * The cheap half of {@link structuredReadyPredatesPrompt}, split out because
+ * `buildPayload` asks it FIRST: it is the gate on the one database read this
+ * rule needs, and a session that is not in this state must not pay for the send
+ * ledger on every poll. One expression, two callers — the alternative is the
+ * "two expressions for one fact" the merge's own docblock says is how this
+ * layer drifts.
+ *
+ * Three conjuncts, and all three are about the same instant:
+ *
+ *  - **the screen is positively generating.** `ScraperVerdict.thinking` is
+ *    `isGeneratingStatus`, i.e. `running` with `thinking_indicator` /
+ *    `opencode_processing_indicator` behind it — a spinner, `✻ Thinking…` or
+ *    `esc to interrupt` that a tool's own pattern matched. It is deliberately
+ *    NOT `scraper.status === 'running'`: the `no_recent_output` and
+ *    `unknown_frame` floors are also `running`, and neither is evidence of
+ *    anything. A frame that merely stopped changing must never retire a `Stop`
+ *    the agent actually sent.
+ *  - **the structured layer says `ready`.** `running` and `waiting` already win
+ *    on their own paths and are not in question here.
+ *  - **that `ready` came from the agent's own `Stop`.**
+ *    `getStructuredSessionState` publishes `ready / hook_stop` exactly when the
+ *    turn record carries `closedBy: 'stop'` with a `closedAt`, so the record is
+ *    read rather than the folded reason.
+ *
+ * `openedAt` is deliberately not required, which is what separates this from
+ * {@link hookClosedTurn}. A `Stop` that arrived with no turn open publishes
+ * `openedAt: null`, and for the tool this Issue was reported from that is the
+ * ORDINARY shape: Command Code cannot emit `UserPromptSubmit` (its loader
+ * validates the event name against a closed list) and emits no
+ * `PreToolUse` / `PostToolUse` on a turn that calls no tool, so nothing ever
+ * opens the turn. Requiring an `openedAt` here would exclude precisely the case
+ * this rule exists for.
+ */
+function staleReadyCandidate(scraper, structured, turn) {
+    if (!scraper.thinking)
+        return false;
+    if (structured === null || structured.status !== 'ready')
+        return false;
+    if (turn === null)
+        return false;
+    return turn.closedBy === 'stop' && turn.closedAt !== null;
+}
+/**
+ * Whether the structured layer's `ready` has been outlived by the newest prompt
+ * this instance was handed (Issue #2429).
+ *
+ * ## The defect this closes
+ *
+ * The merge above prefers the agent's own account to the screen, and until this
+ * Issue the only exception was a scraper `waiting` (#1708). That is correct for
+ * every tool that can say when a turn BEGINS — claude, codex, copilot, gemini
+ * and antigravity all post a turn-opening event, so a live turn replaces the
+ * previous turn's `stop` before the first generating frame is ever read.
+ *
+ * Command Code can post neither: no `UserPromptSubmit`, and no `PreToolUse` /
+ * `PostToolUse` on a turn that calls no tool. The previous turn's `ready /
+ * hook_stop` therefore stays the newest structured fact for the whole of the
+ * next turn, and the merge published it over a pane that was visibly generating.
+ * Measured 2026-09-08 on a 19 s turn: `sessionStatus` read `ready / hook_stop`
+ * from 4 s to 18 s while the status row said `esc to interrupt`. `commandmate
+ * wait` reads that field — not the frame — for "is at its composer", so #1975's
+ * 60 s unanswered-prompt hold was the only thing standing between a long turn
+ * and a `basis=scraper_ready` completion reported before the reply existed.
+ *
+ * ## Why a comparison rather than a timer
+ *
+ * The same comparison `wait` already makes (`outstandingPrompt`), against the
+ * same two server-stamped facts: the turn's `closedAt`, and the timestamp of
+ * the newest user row in the chat ledger. A `Stop` that POSTDATES the newest
+ * prompt is this turn's own — the agent finished, the spinner on the frame is a
+ * repaint that has not settled, and the structured `ready` keeps winning. A
+ * `Stop` that predates it has reported neither the start nor the end of the
+ * work now on screen, and about that work it says nothing at all.
+ *
+ * Shortening #1975's hold would have been the other repair, and the Issue rules
+ * it out for a reason worth restating here: the hold is what stops a false
+ * completion during a turn nobody has reported yet, so a shorter one moves the
+ * false completion earlier rather than removing it.
+ *
+ * @param lastPromptAt - Epoch ms of the newest prompt handed to this instance,
+ *   or null when the ledger was not read or holds none. Null decides nothing:
+ *   an unreadable ledger is not evidence that nothing was sent, so the
+ *   structured verdict stands exactly as it did before this Issue.
+ */
+function structuredReadyPredatesPrompt(scraper, structured, turn, lastPromptAt) {
+    if (lastPromptAt === null)
+        return false;
+    if (!staleReadyCandidate(scraper, structured, turn))
+        return false;
+    const closedAt = turn?.closedAt ?? null;
+    return closedAt !== null && closedAt < lastPromptAt;
+}
+/**
+ * When this instance was last handed a prompt, or null (Issue #2429).
+ *
+ * The server's half of the comparison `commandmate wait` makes over HTTP. Both
+ * sides read the same row — the newest `role: 'user'` message scoped to this
+ * (worktree, tool, instance) — so the field this function feeds and the notice
+ * `wait` prints cannot describe different sends.
+ *
+ * Best effort, like {@link recordUnclassifiedFrame} and
+ * {@link recordStructuredPrompt}: the caller is building a payload, and a
+ * ledger that cannot be read must cost this one comparison and nothing else.
+ * Null is reported rather than a guess, and null leaves the pre-#2429
+ * precedence in place — an unreadable ledger is not evidence that nothing was
+ * sent, which is the position `wait` takes on the same read.
+ */
+function readNewestPromptAt(db, worktreeId, cliToolId, instanceId) {
+    try {
+        const row = (0, chat_db_1.getLastUserMessageForInstance)(db, worktreeId, cliToolId, instanceId);
+        if (!row)
+            return null;
+        const at = row.timestamp instanceof Date ? row.timestamp.getTime() : NaN;
+        return Number.isFinite(at) ? at : null;
+    }
+    catch (error) {
+        logger.debug('newest-prompt-read-failed', {
+            worktreeId,
+            cliToolId,
+            instanceId,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return null;
+    }
+}

package/dist/server/src/lib/session/waiting-episode-state.js

@@ -47,13 +47,12 @@ exports.clearWaitingEpisodes = clearWaitingEpisodes;
 exports.clearWaitingTransitionListeners = clearWaitingTransitionListeners;
 const auto_yes_state_1 = require("../../lib/auto-yes-state");
 const logger_1 = require("../../lib/logger");
+const global_state_1 = require("../global-state");
 const logger = (0, logger_1.createLogger)('waiting-episode-state');
 /** compositeKey -> the wait currently in progress for that instance. */
-const episodes = globalThis.__sessionWaitingEpisodes ??
-    (globalThis.__sessionWaitingEpisodes = new Map());
+const episodes = (0, global_state_1.getOrInitGlobal)('__sessionWaitingEpisodes', () => new Map());
 /** Subscribers to the edge. See the module docblock. */
-const listeners = globalThis.__sessionWaitingTransitionListeners ??
-    (globalThis.__sessionWaitingTransitionListeners = new Set());
+const listeners = (0, global_state_1.getOrInitGlobal)('__sessionWaitingTransitionListeners', () => new Set());
 /**
  * Subscribe to waiting edges.
  *

package/dist/server/src/lib/session/waiting-kind.js

@@ -33,6 +33,7 @@ const status_detector_1 = require("../../lib/detection/status-detector");
  * |--------------------------------------------------|------------------|
  * | not waiting                                       | `null`           |
  * | `hasActivePrompt`                                 | `'prompt'`       |
+ * | `apiAnswerable` (#3184: answered over the agent's API) | `'prompt'`   |
  * | scraper `waiting` + a {@link SELECTION_LIST_REASONS} reason | `'menu'` |
  * | anything else that is still waiting                | `'unclassified'` |
  *
@@ -52,6 +53,8 @@ function deriveWaitingKind(input) {
         return null;
     if (input.hasActivePrompt)
         return 'prompt';
+    if (input.apiAnswerable === true)
+        return 'prompt';
     if (input.scraperStatus === 'waiting' && status_detector_1.SELECTION_LIST_REASONS.has(input.scraperReason)) {
         return 'menu';
     }

package/dist/server/src/lib/session-cleanup.js

@@ -16,10 +16,9 @@ exports.createOwnedSessionKiller = createOwnedSessionKiller;
 exports.cleanupGlobalSessions = cleanupGlobalSessions;
 exports.syncWorktreesAndCleanup = syncWorktreesAndCleanup;
 const response_poller_1 = require("./polling/response-poller");
-const auto_yes_manager_1 = require("./polling/auto-yes-manager");
+const auto_yes_lifecycle_1 = require("./auto-yes-lifecycle");
 const schedule_manager_1 = require("./schedule-manager");
 const timer_manager_1 = require("./timer-manager");
-const global_session_poller_1 = require("./polling/global-session-poller");
 const tmux_capture_cache_1 = require("./tmux/tmux-capture-cache");
 const types_1 = require("./cli-tools/types");
 const global_session_constants_1 = require("./session/global-session-constants");
@@ -87,7 +86,9 @@ async function cleanupWorktreeSessions(worktreeId, killSessionFn) {
     // 2. Stop auto-yes-poller for all agents (Issue #138, #525: byWorktree helper)
     // Order: stopAutoYesPollingByWorktree -> deleteAutoYesStateByWorktree -> stopScheduleForWorktree (Issue #404)
     try {
-        (0, auto_yes_manager_1.stopAutoYesPollingByWorktree)(worktreeId);
+        // Issue #3184: the `worktree-deleted` row of the Auto-Yes lifecycle table,
+        // in its two halves so the two failures stay reported apart.
+        (0, auto_yes_lifecycle_1.stopAutoYesPollersFor)('worktree-deleted', { scope: 'worktree', worktreeId });
         result.pollersStopped.push('auto-yes-poller');
     }
     catch (error) {
@@ -97,7 +98,7 @@ async function cleanupWorktreeSessions(worktreeId, killSessionFn) {
     }
     // 3. Delete auto-yes state for all agents (Issue #404, #525: byWorktree helper)
     try {
-        (0, auto_yes_manager_1.deleteAutoYesStateByWorktree)(worktreeId);
+        (0, auto_yes_lifecycle_1.applyAutoYesStateRule)('worktree-deleted', { scope: 'worktree', worktreeId });
         result.pollersStopped.push('auto-yes-state');
     }
     catch (error) {
@@ -213,8 +214,7 @@ function createOwnedSessionKiller(pathById) {
 }
 /**
  * Clean up all global assistant sessions.
- * Issue #649: Kill any orphaned mcbd-{cli_tool_id}-__global__ tmux sessions
- * and stop all global session pollers.
+ * Issue #649: Kill any orphaned mcbd-{cli_tool_id}-__global__ tmux sessions.
  *
  * Called during server shutdown and syncWorktreesAndCleanup.
  * Errors are logged but do not propagate (cleanup is best-effort).
@@ -222,8 +222,6 @@ function createOwnedSessionKiller(pathById) {
  * @returns Number of sessions killed
  */
 async function cleanupGlobalSessions() {
-    // Stop all global pollers first
-    (0, global_session_poller_1.stopAllGlobalSessionPolling)();
     let sessionsKilled = 0;
     const manager = manager_1.CLIToolManager.getInstance();
     for (const cliToolId of types_1.CLI_TOOL_IDS) {

package/dist/server/src/lib/skills/install-plan.js

@@ -41,6 +41,7 @@ const schema_1 = require("../../lib/skills/schema");
 const constants_1 = require("../../lib/skills/constants");
 const snapshot_store_1 = require("../../lib/skills/snapshot-store");
 const preview_diff_1 = require("../../lib/skills/preview-diff");
+const global_state_1 = require("../global-state");
 // =============================================================================
 // Layout and limits
 // =============================================================================
@@ -206,7 +207,7 @@ function parseInstalledReceipt(bytes) {
         return null;
     }
 }
-const cache = globalThis.__skillInstallPlans ?? (globalThis.__skillInstallPlans = { records: new Map() });
+const cache = (0, global_state_1.getOrInitGlobal)('__skillInstallPlans', () => ({ records: new Map() }));
 function dropRecord(record) {
     cache.records.delete(record.token);
     // The snapshot reference was taken for this plan; an unconsumed plan must not

package/dist/server/src/lib/skills/snapshot-store.js

@@ -38,8 +38,8 @@ const skill_security_config_1 = require("../../config/skill-security-config");
 const system_directories_1 = require("../../config/system-directories");
 const skills_1 = require("../../lib/skills");
 const integrity_1 = require("../../lib/skills/integrity");
-const state = globalThis.__skillSnapshotStore ??
-    (globalThis.__skillSnapshotStore = { rootDir: null, records: new Map(), totalBytes: 0 });
+const global_state_1 = require("../global-state");
+const state = (0, global_state_1.getOrInitGlobal)('__skillSnapshotStore', () => ({ rootDir: null, records: new Map(), totalBytes: 0 }));
 const SNAPSHOT_FILE_SUFFIX = '.artifact';
 // =============================================================================
 // Initialization

package/dist/server/src/lib/skills/uninstall-plan.js

@@ -42,6 +42,7 @@ const integrity_1 = require("../../lib/skills/integrity");
 const install_plan_1 = require("../../lib/skills/install-plan");
 const constants_2 = require("../../lib/skills/constants");
 const preview_diff_1 = require("../../lib/skills/preview-diff");
+const global_state_1 = require("../global-state");
 /** Stable machine reasons, one per disposition plus the plan-level failures. */
 exports.SkillUninstallReason = {
     /** Recorded, unchanged, and therefore deletable. */
@@ -256,8 +257,7 @@ function canonicalJson(value) {
 function computeSkillUninstallBindingHash(binding) {
     return (0, crypto_1.createHash)('sha256').update(canonicalJson(binding)).digest('hex');
 }
-const cache = globalThis.__skillUninstallPlans ??
-    (globalThis.__skillUninstallPlans = { records: new Map() });
+const cache = (0, global_state_1.getOrInitGlobal)('__skillUninstallPlans', () => ({ records: new Map() }));
 /** Token grammar. Anything else is rejected before the store is consulted. */
 exports.SKILL_UNINSTALL_PLAN_TOKEN_PATTERN = /^[0-9a-f]{48}$/;
 const SKILL_UNINSTALL_PLAN_TOKEN_BYTES = 24;

package/dist/server/src/lib/timer-manager.js

@@ -21,16 +21,14 @@ const db_instance_1 = require("../lib/db/db-instance");
 const logger_1 = require("../lib/logger");
 const timer_constants_1 = require("../config/timer-constants");
 const send_user_message_1 = require("../lib/session/send-user-message");
+const global_state_1 = require("./global-state");
 const logger = (0, logger_1.createLogger)('timer-manager');
 function getState() {
-    if (!globalThis.__timerManagerState) {
-        globalThis.__timerManagerState = {
-            timers: new Map(),
-            timerWorktrees: new Map(),
-            initialized: false,
-        };
-    }
-    return globalThis.__timerManagerState;
+    return (0, global_state_1.getOrInitGlobal)('__timerManagerState', () => ({
+        timers: new Map(),
+        timerWorktrees: new Map(),
+        initialized: false,
+    }));
 }
 // =============================================================================
 // Timer Execution [DP-004/CON-MF-001]

package/dist/server/src/lib/tmux/geometry-delegation.js

@@ -45,6 +45,7 @@ exports.resetGeometryDelegationState = resetGeometryDelegationState;
 const child_process_1 = require("child_process");
 const util_1 = require("util");
 const tmux_session_surface_1 = require("../session/tmux-session-surface");
+const global_state_1 = require("../global-state");
 const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
 /** tmux calls here are interactive-latency, not long-running. */
 const TMUX_TIMEOUT = 5000;
@@ -56,10 +57,8 @@ const TMUX_TIMEOUT = 5000;
  * (the status helper, the response checker) share a single tmux round-trip.
  */
 exports.DELEGATION_TTL_MS = 1000;
-const cache = globalThis.__cmGeometryDelegationCache ??
-    (globalThis.__cmGeometryDelegationCache = new Map());
-const lastObserved = globalThis.__cmGeometryDelegationEdge ??
-    (globalThis.__cmGeometryDelegationEdge = new Map());
+const cache = (0, global_state_1.getOrInitGlobal)('__cmGeometryDelegationCache', () => new Map());
+const lastObserved = (0, global_state_1.getOrInitGlobal)('__cmGeometryDelegationEdge', () => new Map());
 /**
  * Whether `@cm_delegated` is set to `1` on a session.
  *

package/dist/server/src/lib/tmux/legacy-session-alias.js

@@ -27,8 +27,9 @@ exports.registerLegacyAlias = registerLegacyAlias;
 exports.lookupLegacyAlias = lookupLegacyAlias;
 exports.dropLegacyAliasByLegacyName = dropLegacyAliasByLegacyName;
 exports.clearLegacyAliasesForTests = clearLegacyAliasesForTests;
+const global_state_1 = require("../global-state");
 function aliases() {
-    return (globalThis.__cmLegacySessionAliases ??= new Map());
+    return (0, global_state_1.getOrInitGlobal)('__cmLegacySessionAliases', () => new Map());
 }
 /**
  * Serve the new-format session name `newName` with the existing legacy session

package/dist/server/src/lib/tmux/session-hooks.js

@@ -28,11 +28,12 @@ const tmux_session_surface_1 = require("../session/tmux-session-surface");
 const session_hook_scripts_1 = require("./session-hook-scripts");
 const geometry_delegation_1 = require("./geometry-delegation");
 const logger_1 = require("../logger");
+const global_state_1 = require("../global-state");
 const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
 const logger = (0, logger_1.createLogger)('tmux-session-hooks');
 /** tmux calls here are interactive-latency, not long-running. */
 const TMUX_TIMEOUT = 5000;
-const ensured = globalThis.__cmEnsuredSessionHooks ?? (globalThis.__cmEnsuredSessionHooks = new Set());
+const ensured = (0, global_state_1.getOrInitGlobal)('__cmEnsuredSessionHooks', () => new Set());
 /**
  * Reconcile a session's opt-in `client-attached` hooks with the environment.
  *

package/dist/server/src/lib/tmux/session-status-options.js

@@ -58,14 +58,14 @@ const child_process_1 = require("child_process");
 const util_1 = require("util");
 const tmux_session_surface_1 = require("../session/tmux-session-surface");
 const logger_1 = require("../logger");
+const global_state_1 = require("../global-state");
 const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
 const logger = (0, logger_1.createLogger)('tmux-session-status');
 /** tmux calls here are interactive-latency, not long-running. */
 const TMUX_TIMEOUT = 5000;
-const published = globalThis.__cmPublishedTmuxStatus ??
-    (globalThis.__cmPublishedTmuxStatus = new Map());
+const published = (0, global_state_1.getOrInitGlobal)('__cmPublishedTmuxStatus', () => new Map());
 /** Sessions this process has already uninstalled the surface from. */
-const cleared = globalThis.__cmClearedTmuxStatus ?? (globalThis.__cmClearedTmuxStatus = new Set());
+const cleared = (0, global_state_1.getOrInitGlobal)('__cmClearedTmuxStatus', () => new Set());
 /**
  * Write one session's state onto its tmux session, if it changed.
  *

package/dist/server/src/lib/tmux/tmux-capture-cache.js

@@ -30,6 +30,7 @@ exports.resetCacheForTesting = resetCacheForTesting;
 exports.getOrFetchCapture = getOrFetchCapture;
 /** Cache entry structure */
 const logger_1 = require("../../lib/logger");
+const global_state_1 = require("../global-state");
 const logger = (0, logger_1.createLogger)('tmux-capture-cache');
 // =========================================================================
 // Constants
@@ -79,10 +80,10 @@ function isCaptureWindowSaturated(capturedLineCount, windowLines = exports.CACHE
     return windowLines > 0 && capturedLineCount >= windowLines;
 }
 function getCache() {
-    return (globalThis.__tmuxCaptureCache ??= new Map());
+    return (0, global_state_1.getOrInitGlobal)('__tmuxCaptureCache', () => new Map());
 }
 function getInflight() {
-    return (globalThis.__tmuxCaptureCacheInflight ??= new Map());
+    return (0, global_state_1.getOrInitGlobal)('__tmuxCaptureCacheInflight', () => new Map());
 }
 // =========================================================================
 // sliceOutput()