commandmate 0.44.1 → 0.44.3

package/dist/cli/commands/ask.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ask.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/ask.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA4LpC,wBAAgB,gBAAgB,IAAI,OAAO,CA0O1C"}
+{"version":3,"file":"ask.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/ask.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAiTpC,wBAAgB,gBAAgB,IAAI,OAAO,CAwI1C"}

package/dist/cli/commands/ask.js

@@ -40,17 +40,11 @@ const reply_ledger_1 = require("../utils/reply-ledger");
 const cli_tool_ids_1 = require("../config/cli-tool-ids");
 const agent_target_options_1 = require("../config/agent-target-options");
 const instances_1 = require("./instances");
+const command_target_1 = require("./command-target");
 const wait_1 = require("./wait");
 const capture_1 = require("./capture");
 const relays_1 = require("./relays");
-/**
- * Code the send API returns when the session is blocked on a prompt.
- *
- * Mirrors `PROMPT_WAITING_CODE` in `send.ts`, which mirrors the server's own —
- * the CLI bundle keeps its own copies of API strings rather than importing the
- * server's tmux/detection graph for one of them.
- */
-const PROMPT_WAITING_CODE = 'PROMPT_WAITING';
+const message_dispatch_1 = require("./message-dispatch");
 /** Default `--timeout`, in seconds. Matches the GUI's delegation brief. */
 const DEFAULT_ASK_TIMEOUT_SECONDS = 1800;
 /** Squeezed pane lines kept for the fallback reply. */
@@ -164,6 +158,104 @@ async function readLatestReply(client, worktreeId, instanceId, since, cliToolId)
 async function readPaneTail(client, worktreeId, cliToolId, instanceId) {
     return (0, capture_1.readSqueezedPaneTail)(client, worktreeId, cliToolId, instanceId, PANE_FALLBACK_TAIL);
 }
+/** Argument checks. A mocked `process.exit` returns, so nothing here stops early. */
+function validateAskArgs(worktreeId, message, options) {
+    if (!(0, api_client_1.isValidWorktreeId)(worktreeId)) {
+        console.error('Error: Invalid worktree ID format.');
+        process.exit(types_1.ExitCode.CONFIG_ERROR);
+    }
+    if (message.trim() === '') {
+        console.error('Error: Message cannot be empty.');
+        process.exit(types_1.ExitCode.CONFIG_ERROR);
+    }
+    if (options.agent && !(0, cli_tool_ids_1.isCliToolId)(options.agent)) {
+        console.error(`Error: Invalid agent. Must be one of: ${cli_tool_ids_1.CLI_TOOL_IDS.join(', ')}`);
+        process.exit(types_1.ExitCode.CONFIG_ERROR);
+    }
+    if (options.instance && !(0, instances_1.isInstanceSelector)(options.instance)) {
+        console.error(instances_1.INSTANCE_SELECTOR_ERROR);
+        process.exit(types_1.ExitCode.CONFIG_ERROR);
+    }
+    // `--reply-to` / `--allow-relay-chain` only mean something under
+    // `--async`: without it `ask` returns the reply on stdout, and a second
+    // copy arriving in somebody's composer is a surprise, not a feature.
+    if (!options.async && (options.replyTo || options.allowRelayChain)) {
+        console.error('Error: --reply-to and --allow-relay-chain require --async.');
+        process.exit(types_1.ExitCode.CONFIG_ERROR);
+    }
+}
+/** `--async`: prints the relay id (or its JSON) and exits 0. */
+function printAsyncAck(worktreeId, instanceId, agent, relayId, options) {
+    if (options.json) {
+        console.log(JSON.stringify({
+            worktreeId,
+            instanceId: instanceId ?? null,
+            cliToolId: agent ?? null,
+            relayId,
+            mode: 'async',
+        }, null, 2));
+    }
+    else {
+        console.log(relayId);
+    }
+    console.error('Message sent. The reply will be delivered when the turn ends; '
+        + 'watch it with `commandmate relays`.');
+    process.exit(types_1.ExitCode.SUCCESS);
+}
+/** A non-success wait: prints the payload and exits with wait's code. */
+function reportWaitFailure(result, worktreeId, instanceId, agent, options) {
+    // Same stdout contract as `wait`: the prompt payload, and nothing
+    // else, so a caller can parse it without stripping progress lines.
+    if (result.output) {
+        console.log(JSON.stringify(result.output));
+    }
+    if (result.upstreamFault && options.json) {
+        console.log(JSON.stringify({
+            worktreeId,
+            instanceId: instanceId ?? null,
+            cliToolId: agent ?? null,
+            upstreamFault: result.upstreamFault,
+        }, null, 2));
+    }
+    process.exit(result.exitCode);
+}
+/** Reads the reply from the transcript, falling back to the pane. */
+async function readAskReply(client, worktreeId, instanceId, askedAt, agent) {
+    let source = 'history';
+    let reply = await readLatestReply(client, worktreeId, instanceId, askedAt, agent);
+    if (reply === null && agent) {
+        source = 'pane';
+        const pane = await readPaneTail(client, worktreeId, agent, instanceId);
+        const cleaned = pane === null ? '' : (0, reply_ledger_1.sanitizeReply)(pane);
+        reply = cleaned === '' ? null : cleaned;
+    }
+    if (reply === null) {
+        source = 'none';
+    }
+    return { source, reply };
+}
+/** Prints the reply (or its JSON, or the no-reply warning). */
+function printAskReply(worktreeId, instanceId, agent, source, reply, options) {
+    if (options.json) {
+        console.log(JSON.stringify({
+            worktreeId,
+            instanceId: instanceId ?? null,
+            cliToolId: agent ?? null,
+            source,
+            reply,
+        }, null, 2));
+    }
+    else if (reply === null) {
+        // Not an error exit: the turn DID end, and saying so on stderr keeps
+        // stdout empty rather than filling it with an apology a caller would
+        // paste into a report as the agent's answer.
+        console.error('Warning: the turn completed but no reply could be read '
+            + '(no transcript row and no readable pane).');
+    }
+    else {
+        console.log(reply);
+    }
+}
 function createAskCommand() {
     const cmd = new commander_1.Command('ask');
     cmd
@@ -204,29 +296,7 @@ a decision about that session's guard rails, not part of asking it a question.
 `)
         .action(async (worktreeId, message, options) => {
         try {
-            if (!(0, api_client_1.isValidWorktreeId)(worktreeId)) {
-                console.error('Error: Invalid worktree ID format.');
-                process.exit(types_1.ExitCode.CONFIG_ERROR);
-            }
-            if (message.trim() === '') {
-                console.error('Error: Message cannot be empty.');
-                process.exit(types_1.ExitCode.CONFIG_ERROR);
-            }
-            if (options.agent && !(0, cli_tool_ids_1.isCliToolId)(options.agent)) {
-                console.error(`Error: Invalid agent. Must be one of: ${cli_tool_ids_1.CLI_TOOL_IDS.join(', ')}`);
-                process.exit(types_1.ExitCode.CONFIG_ERROR);
-            }
-            if (options.instance && !(0, instances_1.isInstanceSelector)(options.instance)) {
-                console.error(instances_1.INSTANCE_SELECTOR_ERROR);
-                process.exit(types_1.ExitCode.CONFIG_ERROR);
-            }
-            // `--reply-to` / `--allow-relay-chain` only mean something under
-            // `--async`: without it `ask` returns the reply on stdout, and a second
-            // copy arriving in somebody's composer is a surprise, not a feature.
-            if (!options.async && (options.replyTo || options.allowRelayChain)) {
-                console.error('Error: --reply-to and --allow-relay-chain require --async.');
-                process.exit(types_1.ExitCode.CONFIG_ERROR);
-            }
+            validateAskArgs(worktreeId, message, options);
             const timeout = parseTimeout(options.timeout);
             const client = new api_client_1.ApiClient({ token: options.token });
             // Resolved once, before the send, and reused for the wait and both
@@ -242,11 +312,7 @@ a decision about that session's guard rails, not part of asking it a question.
             // worktree default: exit 21 while the default was not running, and the
             // default's turn instead of <tool>'s while it was.
             const selector = options.instance ?? options.agent;
-            const target = selector
-                ? await (0, instances_1.resolveInstanceTarget)(client, worktreeId, selector, options.agent)
-                : null;
-            const agent = target ? target.cliToolId : options.agent;
-            const instanceId = target?.instanceId;
+            const { agent, instanceId } = await (0, command_target_1.resolveCommandTarget)(client, worktreeId, selector, options.agent);
             // Taken BEFORE the send so a reply written by the previous turn cannot
             // be read as this one's. Milliseconds, compared against the row's own
             // timestamp rather than against a re-derived clock.
@@ -256,11 +322,11 @@ a decision about that session's guard rails, not part of asking it a question.
             // and the ledger row. A refusal exits 2 having sent nothing.
             let relayId;
             if (options.async) {
-                const replyEndpoint = await (0, relays_1.resolveRelayEndpoint)(client, options.replyTo ?? 'self');
-                const workerEndpoint = await (0, relays_1.resolveEndpointForWorktree)(client, worktreeId, options.instance, options.agent);
-                relayId = await (0, relays_1.registerRelay)(client, {
-                    from: replyEndpoint,
-                    to: workerEndpoint,
+                relayId = await (0, message_dispatch_1.registerRelayForMessage)(client, {
+                    worktreeId,
+                    replyTo: options.replyTo ?? 'self',
+                    instance: options.instance,
+                    agent: options.agent,
                     allowRelayChain: options.allowRelayChain,
                 });
             }
@@ -269,44 +335,20 @@ a decision about that session's guard rails, not part of asking it a question.
                 sendBody.cliToolId = agent;
             if (instanceId)
                 sendBody.instanceId = instanceId;
-            try {
-                await client.post(`/api/worktrees/${worktreeId}/send`, sendBody);
-            }
-            catch (error) {
-                // The other session is sitting on a dialog, so the message would have
-                // been typed into the dialog's input line instead of reaching the
-                // agent (Issue #1708). Reported as a config error with the server's
-                // own sentence: the answer is to look at that session, never to
-                // re-send.
-                // A relay whose message never arrived can never be answered.
-                if (relayId)
-                    await (0, relays_1.cancelRelayQuietly)(client, relayId);
-                if (error instanceof api_client_1.ApiError && error.apiCode === PROMPT_WAITING_CODE) {
-                    console.error(`Error: ${error.payload?.error
-                        ?? `${worktreeId} is waiting on a prompt; the message was not sent.`}`);
-                    process.exit(types_1.ExitCode.CONFIG_ERROR);
-                }
-                throw error;
-            }
+            // The other session may be sitting on a dialog (Issue #1708): the
+            // message would be typed into the dialog's input line instead of
+            // reaching the agent. Reported as a config error with the server's
+            // own sentence: the answer is to look at that session, never to
+            // re-send.
+            await (0, message_dispatch_1.postMessage)(client, worktreeId, sendBody, {
+                relayId,
+                promptWaitingFallback: `${worktreeId} is waiting on a prompt; the message was not sent.`,
+            });
             // Issue #2377: the whole point of `--async`. Nothing is waited on, so
             // the caller's own turn ends here and the answer arrives later, in their
             // composer, as a `relay` row.
             if (relayId) {
-                if (options.json) {
-                    console.log(JSON.stringify({
-                        worktreeId,
-                        instanceId: instanceId ?? null,
-                        cliToolId: agent ?? null,
-                        relayId,
-                        mode: 'async',
-                    }, null, 2));
-                }
-                else {
-                    console.log(relayId);
-                }
-                console.error('Message sent. The reply will be delivered when the turn ends; '
-                    + 'watch it with `commandmate relays`.');
-                process.exit(types_1.ExitCode.SUCCESS);
+                printAsyncAck(worktreeId, instanceId, agent, relayId, options);
                 return;
             }
             console.error('Message sent. Waiting for the reply...');
@@ -321,52 +363,11 @@ a decision about that session's guard rails, not part of asking it a question.
                 failOnUpstreamFault: true,
             });
             if (result.exitCode !== types_1.WaitExitCode.SUCCESS) {
-                // Same stdout contract as `wait`: the prompt payload, and nothing
-                // else, so a caller can parse it without stripping progress lines.
-                if (result.output) {
-                    console.log(JSON.stringify(result.output));
-                }
-                if (result.upstreamFault && options.json) {
-                    console.log(JSON.stringify({
-                        worktreeId,
-                        instanceId: instanceId ?? null,
-                        cliToolId: agent ?? null,
-                        upstreamFault: result.upstreamFault,
-                    }, null, 2));
-                }
-                process.exit(result.exitCode);
+                reportWaitFailure(result, worktreeId, instanceId, agent, options);
                 return;
             }
-            let source = 'history';
-            let reply = await readLatestReply(client, worktreeId, instanceId, askedAt, agent);
-            if (reply === null && agent) {
-                source = 'pane';
-                const pane = await readPaneTail(client, worktreeId, agent, instanceId);
-                const cleaned = pane === null ? '' : (0, reply_ledger_1.sanitizeReply)(pane);
-                reply = cleaned === '' ? null : cleaned;
-            }
-            if (reply === null) {
-                source = 'none';
-            }
-            if (options.json) {
-                console.log(JSON.stringify({
-                    worktreeId,
-                    instanceId: instanceId ?? null,
-                    cliToolId: agent ?? null,
-                    source,
-                    reply,
-                }, null, 2));
-            }
-            else if (reply === null) {
-                // Not an error exit: the turn DID end, and saying so on stderr keeps
-                // stdout empty rather than filling it with an apology a caller would
-                // paste into a report as the agent's answer.
-                console.error('Warning: the turn completed but no reply could be read '
-                    + '(no transcript row and no readable pane).');
-            }
-            else {
-                console.log(reply);
-            }
+            const { source, reply } = await readAskReply(client, worktreeId, instanceId, askedAt, agent);
+            printAskReply(worktreeId, instanceId, agent, source, reply, options);
             process.exit(types_1.ExitCode.SUCCESS);
         }
         catch (error) {

package/dist/cli/commands/attach.d.ts

@@ -30,6 +30,100 @@
  * 200x1000, or cannot survive a width change at all.
  */
 import { Command } from 'commander';
+import { ApiClient } from '../utils/api-client';
+import type { ApiErrorPayload } from '../utils/api-client';
+/** The name `attach` will connect to, and whether the server published it. */
+export interface AttachSessionTarget {
+    sessionName: string;
+    /**
+     * True when the name came from the server's roster (Issue #2867); false when
+     * it is the legacy name assembled here because the roster could not supply
+     * one. Only a published name is the one the server's own routes address, so
+     * only a published name can be vouched for by them (Issue #3334).
+     */
+    published: boolean;
+}
+/**
+ * What the server could say about the session `attach` is about to open.
+ *
+ * - `owned`: the server's ownership check passed, for this very name.
+ * - `foreign`: the server answered 409 `session_owned_by_other_server` for
+ *   this very name.
+ * - `unconfirmed`: anything else — the owner is not known. The server answered
+ *   about a DIFFERENT name than the one `attach` connects to (`other-name`), or
+ *   gave no ownership answer at all (`no-answer`: any non-2xx such as the 404
+ *   for a namespaced session that does not exist, a server older than #2865,
+ *   no server).
+ */
+export type AttachOwnership = {
+    verdict: 'owned';
+} | {
+    verdict: 'foreign';
+    payload: ApiErrorPayload;
+} | {
+    verdict: 'unconfirmed';
+    why: 'other-name' | 'no-answer';
+    checkedName: string | null;
+};
+/**
+ * Ask the server whether the session `attach` is about to open is its own
+ * (Issue #3334).
+ *
+ * ## Why ask the server, and why through `capture`
+ *
+ * `has-session` answers by name, and a name is all two servers on one tmux
+ * socket have in common (Issue #2865): a worktree directory called the same on
+ * both resolves to the same `mcbd-…` name. Only the server that holds the
+ * worktree row knows the directory its own session was started in, and every
+ * session route already compares that with tmux's `#{session_path}` and
+ * answers 409 `session_owned_by_other_server` when they differ. `capture` with
+ * `lines: 1` is the cheapest of them, reads nothing it would not show anyway,
+ * and sends tmux no key.
+ *
+ * ## The name has to be the same one
+ *
+ * The route checks the name IT resolves — the namespaced one, or the legacy
+ * one it adopted — which is exactly the name the roster publishes. When the
+ * roster could not be read, `attach` falls back to the legacy name, and a 200
+ * from `capture` is then about a different session: the namespaced name and
+ * the legacy name can both exist, one this server's and one another's. So a
+ * 200 counts as `owned` only for a published name, and a 409 counts as
+ * `foreign` only when the name it reports is the one being opened.
+ *
+ * Every other outcome is `unconfirmed`, including no answer at all. A 404
+ * from `capture` is the common case of that: the roster could not be read, the
+ * name fell back to the legacy form, and the server's namespaced session does
+ * not exist — so the legacy session `has-session` found belongs to nobody this
+ * server can vouch for. Only a confirmed owner gets a writable attach.
+ */
+export declare function checkAttachOwnership(client: ApiClient, worktreeId: string, cliToolId: string, instanceId: string | undefined, target: AttachSessionTarget): Promise<AttachOwnership>;
+/**
+ * What to do with an attach the server did not vouch for (Issue #3334): a
+ * session another server owns (`foreign`), or one whose owner could not be
+ * confirmed because the server checked a different name (`unconfirmed`).
+ *
+ * Attaching is the one path where the operator named the session themselves,
+ * and looking at it can be what they came for — so the attach is not refused,
+ * it is made read-only: tmux then delivers no key but the detach one. The two
+ * forms that cannot be made read-only are refused before tmux is touched:
+ *
+ * - `--live` re-lays the session out (`set-option` / `resize-window`), which
+ *   changes the other server's pane whether or not a key is typed;
+ * - inside tmux, `switch-client` has no read-only form (its `-r` TOGGLES the
+ *   client's mode, so it can just as well turn read-only off), and the manual
+ *   `attach -r` from outside tmux is printed instead.
+ *
+ * @returns the lines for stderr and whether to go on (read-only)
+ */
+export declare function planGuardedAttach(ownership: Extract<AttachOwnership, {
+    verdict: 'foreign' | 'unconfirmed';
+}>, sessionName: string, options: {
+    live?: boolean;
+    insideTmux: boolean;
+}): {
+    proceedReadOnly: boolean;
+    lines: string[];
+};
 /**
  * The lines printed to stderr before the terminal is handed to tmux.
  *

package/dist/cli/commands/attach.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attach.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/attach.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAyFpC;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9C,MAAM,EAAE,CAmCV;AAiDD,wBAAgB,mBAAmB,IAAI,OAAO,CAmE7C"}
+{"version":3,"file":"attach.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/attach.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,OAAO,EACL,SAAS,EAMV,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAsD3D,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,SAAS,EAAE,OAAO,CAAC;CACpB;AAqCD;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GACpB;IAAE,OAAO,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,GAChD;IAAE,OAAO,EAAE,aAAa,CAAC;IAAC,GAAG,EAAE,YAAY,GAAG,WAAW,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAE5F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,eAAe,CAAC,CAqB1B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,OAAO,CAAC,eAAe,EAAE;IAAE,OAAO,EAAE,SAAS,GAAG,aAAa,CAAA;CAAE,CAAC,EAC3E,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,GAC/C;IAAE,eAAe,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CA0C/C;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAC9C,MAAM,EAAE,CAmCV;AAiDD,wBAAgB,mBAAmB,IAAI,OAAO,CAoF7C"}

package/dist/cli/commands/attach.js

@@ -31,6 +31,8 @@
  * 200x1000, or cannot survive a width change at all.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkAttachOwnership = checkAttachOwnership;
+exports.planGuardedAttach = planGuardedAttach;
 exports.buildAttachHints = buildAttachHints;
 exports.createAttachCommand = createAttachCommand;
 const child_process_1 = require("child_process");
@@ -93,13 +95,131 @@ async function resolveAttachSessionName(client, worktreeId, cliToolId, instanceI
         const published = instances.find((inst) => inst.id === targetId)?.sessionName;
         if (published) {
             (0, validation_1.validateSessionName)(published);
-            return published;
+            return { sessionName: published, published: true };
         }
     }
     catch {
         // Fall through to the legacy name.
     }
-    return (0, session_name_1.resolveLegacySessionName)(cliToolId, worktreeId, instanceId);
+    return {
+        sessionName: (0, session_name_1.resolveLegacySessionName)(cliToolId, worktreeId, instanceId),
+        published: false,
+    };
+}
+/**
+ * Ask the server whether the session `attach` is about to open is its own
+ * (Issue #3334).
+ *
+ * ## Why ask the server, and why through `capture`
+ *
+ * `has-session` answers by name, and a name is all two servers on one tmux
+ * socket have in common (Issue #2865): a worktree directory called the same on
+ * both resolves to the same `mcbd-…` name. Only the server that holds the
+ * worktree row knows the directory its own session was started in, and every
+ * session route already compares that with tmux's `#{session_path}` and
+ * answers 409 `session_owned_by_other_server` when they differ. `capture` with
+ * `lines: 1` is the cheapest of them, reads nothing it would not show anyway,
+ * and sends tmux no key.
+ *
+ * ## The name has to be the same one
+ *
+ * The route checks the name IT resolves — the namespaced one, or the legacy
+ * one it adopted — which is exactly the name the roster publishes. When the
+ * roster could not be read, `attach` falls back to the legacy name, and a 200
+ * from `capture` is then about a different session: the namespaced name and
+ * the legacy name can both exist, one this server's and one another's. So a
+ * 200 counts as `owned` only for a published name, and a 409 counts as
+ * `foreign` only when the name it reports is the one being opened.
+ *
+ * Every other outcome is `unconfirmed`, including no answer at all. A 404
+ * from `capture` is the common case of that: the roster could not be read, the
+ * name fell back to the legacy form, and the server's namespaced session does
+ * not exist — so the legacy session `has-session` found belongs to nobody this
+ * server can vouch for. Only a confirmed owner gets a writable attach.
+ */
+async function checkAttachOwnership(client, worktreeId, cliToolId, instanceId, target) {
+    try {
+        await client.post(`/api/worktrees/${worktreeId}/capture`, {
+            cliToolId,
+            lines: 1,
+            ...(instanceId !== undefined && instanceId !== cliToolId ? { instanceId } : {}),
+        });
+        return target.published
+            ? { verdict: 'owned' }
+            : { verdict: 'unconfirmed', why: 'other-name', checkedName: null };
+    }
+    catch (error) {
+        if (error instanceof api_client_1.ApiError && error.statusCode === 409 && error.apiCode === api_client_1.FOREIGN_SESSION_ERROR_CODE) {
+            const payload = error.payload ?? { code: api_client_1.FOREIGN_SESSION_ERROR_CODE };
+            const checkedName = typeof payload.sessionName === 'string' ? payload.sessionName : null;
+            if (checkedName === target.sessionName || (checkedName === null && target.published)) {
+                return { verdict: 'foreign', payload };
+            }
+            return { verdict: 'unconfirmed', why: 'other-name', checkedName };
+        }
+        return { verdict: 'unconfirmed', why: 'no-answer', checkedName: null };
+    }
+}
+/**
+ * What to do with an attach the server did not vouch for (Issue #3334): a
+ * session another server owns (`foreign`), or one whose owner could not be
+ * confirmed because the server checked a different name (`unconfirmed`).
+ *
+ * Attaching is the one path where the operator named the session themselves,
+ * and looking at it can be what they came for — so the attach is not refused,
+ * it is made read-only: tmux then delivers no key but the detach one. The two
+ * forms that cannot be made read-only are refused before tmux is touched:
+ *
+ * - `--live` re-lays the session out (`set-option` / `resize-window`), which
+ *   changes the other server's pane whether or not a key is typed;
+ * - inside tmux, `switch-client` has no read-only form (its `-r` TOGGLES the
+ *   client's mode, so it can just as well turn read-only off), and the manual
+ *   `attach -r` from outside tmux is printed instead.
+ *
+ * @returns the lines for stderr and whether to go on (read-only)
+ */
+function planGuardedAttach(ownership, sessionName, options) {
+    const reason = ownership.verdict === 'foreign'
+        ? (0, api_client_1.foreignSessionMessage)(ownership.payload)
+        : `Could not confirm that tmux session "${sessionName}" is this CommandMate server's: `
+            + (ownership.why === 'no-answer'
+                ? 'the server gave no ownership answer for it (an older server, a session it does not have, or no server).'
+                : ownership.checkedName
+                    ? `the server checked "${ownership.checkedName}", not that name.`
+                    : 'the server did not publish the session name it uses, so its check was about a different name.');
+    if (options.live) {
+        return {
+            proceedReadOnly: false,
+            lines: [`Error: ${reason}`, '--live would re-lay that session out, so it was not attached.'],
+        };
+    }
+    if (options.insideTmux) {
+        return {
+            proceedReadOnly: false,
+            lines: [
+                `Error: ${reason}`,
+                'Inside tmux this client can only switch to it with keys enabled, so it was not switched. '
+                    + 'To look at it read-only, from a terminal outside tmux run:',
+                `  tmux attach -r -t '${(0, tmux_session_surface_1.exactSessionTarget)(sessionName)}'`,
+            ],
+        };
+    }
+    if (ownership.verdict === 'unconfirmed') {
+        return {
+            proceedReadOnly: true,
+            lines: [`Warning: ${reason}`, 'Attaching READ-ONLY, so no key you type reaches it.'],
+        };
+    }
+    const where = typeof ownership.payload.sessionPath === 'string' && ownership.payload.sessionPath !== ''
+        ? ` (it was started in ${ownership.payload.sessionPath})`
+        : '';
+    return {
+        proceedReadOnly: true,
+        lines: [
+            `Warning: tmux session "${sessionName}" belongs to another CommandMate server${where}.`,
+            'Attaching READ-ONLY, so no key you type reaches it. To work in it, use the server that started it.',
+        ],
+    };
 }
 /**
  * The lines printed to stderr before the terminal is handed to tmux.
@@ -194,7 +314,7 @@ function createAttachCommand() {
                 process.exit(types_1.ExitCode.CONFIG_ERROR);
             }
             if (options.agent && !(0, cli_tool_ids_1.isCliToolId)(options.agent)) {
-                console.error('Error: Invalid agent.');
+                console.error(`Error: Invalid agent. Must be one of: ${cli_tool_ids_1.CLI_TOOL_IDS.join(', ')}`);
                 process.exit(types_1.ExitCode.CONFIG_ERROR);
             }
             if (options.instance && !(0, api_client_1.isValidInstanceId)(options.instance)) {
@@ -209,22 +329,40 @@ function createAttachCommand() {
                     + `Attach without it, or read with: commandmate capture ${worktreeId} --pane --follow`);
                 process.exit(types_1.ExitCode.CONFIG_ERROR);
             }
-            const sessionName = await resolveAttachSessionName(client, worktreeId, cliToolId, instanceId);
+            const target = await resolveAttachSessionName(client, worktreeId, cliToolId, instanceId);
+            const { sessionName } = target;
             if (!runTmux(['has-session', '-t', (0, tmux_session_surface_1.exactSessionTarget)(sessionName)])) {
                 console.error(`Error: no tmux session named ${sessionName}.\n`
                     + `  commandmate ls                      which worktrees have a running session\n`
                     + `  commandmate instances ${worktreeId}   which agents this worktree runs`);
                 process.exit(types_1.ExitCode.UNEXPECTED_ERROR);
             }
+            // Issue #3334: the name exists, but it may be another server's session,
+            // and the server's check has to be about this very name.
+            let readOnly = Boolean(options.readOnly);
+            // Only a confirmed owner attaches writable; everything else is read-only
+            // or refused (`planGuardedAttach`).
+            const ownership = await checkAttachOwnership(client, worktreeId, cliToolId, instanceId, target);
+            if (ownership.verdict !== 'owned') {
+                const plan = planGuardedAttach(ownership, sessionName, {
+                    live: options.live,
+                    insideTmux: Boolean(process.env.TMUX),
+                });
+                for (const line of plan.lines)
+                    console.error(line);
+                if (!plan.proceedReadOnly)
+                    process.exit(types_1.ExitCode.UNEXPECTED_ERROR);
+                readOnly = true;
+            }
             for (const line of buildAttachHints(cliToolId, worktreeId, sessionName, {
-                readOnly: options.readOnly,
+                readOnly,
                 live: options.live,
             })) {
                 console.error(line);
             }
             const status = options.live
-                ? attachLive(sessionName, Boolean(options.readOnly))
-                : attachOrSwitch(sessionName, Boolean(options.readOnly));
+                ? attachLive(sessionName, readOnly)
+                : attachOrSwitch(sessionName, readOnly);
             process.exit(status);
         }
         catch (error) {

package/dist/cli/commands/auto-yes.js

@@ -80,7 +80,7 @@ function createAutoYesCommand() {
                 process.exit(types_1.ExitCode.CONFIG_ERROR);
             }
             if (options.agent && !(0, cli_tool_ids_1.isCliToolId)(options.agent)) {
-                console.error('Error: Invalid agent.');
+                console.error(`Error: Invalid agent. Must be one of: ${cli_tool_ids_1.CLI_TOOL_IDS.join(', ')}`);
                 process.exit(types_1.ExitCode.CONFIG_ERROR);
             }
             // Issue #896: Validate instance ID if provided

package/dist/cli/commands/capture.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capture.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/capture.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,OAAO,EAAE,SAAS,EAAqB,MAAM,qBAAqB,CAAC;AAwVnE;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAexB;AA2ED,wBAAgB,oBAAoB,IAAI,OAAO,CAoI9C"}
+{"version":3,"file":"capture.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/capture.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,OAAO,EAAE,SAAS,EAAqB,MAAM,qBAAqB,CAAC;AAuVnE;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAexB;AA2ED,wBAAgB,oBAAoB,IAAI,OAAO,CAiI9C"}