commandmate 0.49.3 → 0.50.0

package/dist/server/src/lib/session/send-attempt-state.js

@@ -72,6 +72,7 @@ const crypto_1 = require("crypto");
 const global_state_1 = require("../../lib/global-state");
 const logger_1 = require("../../lib/logger");
 const session_start_error_1 = require("../../lib/session/session-start-error");
+const launch_errors_1 = require("../../lib/agent-roles/launch-errors");
 const send_attempt_types_1 = require("./send-attempt-types");
 const logger = (0, logger_1.createLogger)('session/send-attempt-state');
 /** How many instances are tracked at once; the least recently sent to is forgotten first. */
@@ -261,6 +262,12 @@ function classifySendFailure(error) {
         /an earlier server dispatch may have delivered the message \(Issue #4040\)/.test(error.message)) {
         return { state: 'indeterminate', reason: 'send-error' };
     }
+    // #4115: refused before any key, whichever layer wrapped the message on the way out.
+    if ((0, launch_errors_1.isRoleConditionUnmet)(error))
+        return { state: 'not-sent', reason: 'role-condition-failed' };
+    if ((0, launch_errors_1.readRoleLaunchRefusal)(error) !== null || carriesCode(error, launch_errors_1.SESSION_LAUNCH_ROLE_MISMATCH_CODE)) {
+        return { state: 'not-sent', reason: 'role-launch-refused' };
+    }
     if (typeof error === 'object' &&
         error !== null &&
         error.code === session_start_error_1.SESSION_STARTING_CODE) {

package/dist/server/src/lib/session/send-user-message.js

@@ -63,6 +63,7 @@ const session_start_error_1 = require("../../lib/session/session-start-error");
 const cli_session_1 = require("../../lib/session/cli-session");
 const send_attempt_state_1 = require("../../lib/session/send-attempt-state");
 const send_attempt_types_1 = require("../../lib/session/send-attempt-types");
+const launch_errors_1 = require("../../lib/agent-roles/launch-errors");
 const composer_text_1 = require("../../lib/detection/composer-text");
 const status_capture_config_1 = require("../../config/status-capture-config");
 const instance_input_lock_1 = require("../../lib/session/instance-input-lock");
@@ -420,6 +421,11 @@ async function sendUserMessage(db, params) {
         }
         catch (error) {
             logger.error('failed-to-send-message-to:', { error: getErrorMessage(error) });
+            // Issue #4115: the role this send was conditional on, or the role a driver's
+            // relaunch resolved, refused it before the first key.
+            if ((0, launch_errors_1.isRoleConditionUnmet)(error) || (0, launch_errors_1.readRoleLaunchRefusal)(error) !== null) {
+                return { error, failure: (0, send_attempt_state_1.classifySendFailure)(error) };
+            }
             // Issue #3957: the relay's boundary hook refused before the first key —
             // nothing was typed because the reservation the body was going in under
             // was gone. Issue #3992: its own reason, not `input-lock-lost`.

package/dist/server/src/lib/session/session-generation-archive.js

@@ -88,6 +88,7 @@ const db_instance_1 = require("../../lib/db/db-instance");
 const chat_db_1 = require("../../lib/db/chat-db");
 const types_1 = require("../../lib/realtime/types");
 const logger_1 = require("../../lib/logger");
+const test_run_detection_1 = require("../../lib/test-run-detection");
 const logger = (0, logger_1.createLogger)('lib/session/session-generation-archive');
 /**
  * The database this module archives through, or `null` when there is none to
@@ -102,16 +103,14 @@ const logger = (0, logger_1.createLogger)('lib/session/session-generation-archiv
  * fabricate `<cwd>/data/cm.db` or — when the suite runs in a checkout that has
  * one — hand those fixtures the developer's real chat history to write into.
  *
- * So under Vitest the answer is "no database" unless a test hands one in
- * explicitly (see {@link archiveSupersededSessionMessages}'s `db` parameter) or
- * mocks `@/lib/db/db-instance` **and** clears `VITEST`, which is how the
- * integration test drives the production branch. Only `VITEST` is consulted,
- * never `NODE_ENV`: `vitest.config.ts` `define`s `process.env.NODE_ENV` to the
- * literal `'test'` at transform time, so a `NODE_ENV` check here would fold to
- * a constant and no test could ever reach the other branch.
+ * So in a test run ({@link isUnderTest}) the answer is "no database" unless a
+ * test hands one in explicitly (see {@link archiveSupersededSessionMessages}'s
+ * `db` parameter) or mocks both `@/lib/db/db-instance` and `isUnderTest`, which
+ * is how the integration test drives the production branch. `VITEST` is not
+ * consulted: a production server can inherit it (Issue #4097).
  */
 function resolveSessionArchiveDatabase() {
-    if (process.env.VITEST)
+    if ((0, test_run_detection_1.isUnderTest)())
         return null;
     return (0, db_instance_1.getDbInstance)();
 }

package/dist/server/src/lib/session/session-launch-flight.js

@@ -38,6 +38,8 @@
  *   a model the launch in progress is not starting with gets {@link
  *   SessionLaunchModelMismatchError}, as a `--model` to a running session
  *   gets a 400 (#989 / #2771), instead of joining and running on another model.
+ * - **Nor is a role** (Issue #4115): {@link SessionLaunchRoleMismatchError}, on
+ *   the injection fingerprint.
  *
  * In memory and on `globalThis` for the reason the lock is: the routes that
  * start sessions are separate bundles under `next dev`.
@@ -45,8 +47,9 @@
  * @module lib/session/session-launch-flight
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SessionLaunchModelMismatchError = exports.SESSION_LAUNCH_MODEL_MISMATCH_CODE = exports.SessionLaunchWaitTimeoutError = exports.SessionLaunchInFlightError = void 0;
+exports.SessionLaunchRoleMismatchError = exports.SessionLaunchModelMismatchError = exports.SESSION_LAUNCH_MODEL_MISMATCH_CODE = exports.SessionLaunchWaitTimeoutError = exports.SessionLaunchInFlightError = void 0;
 exports.isSessionLaunchModelMismatchError = isSessionLaunchModelMismatchError;
+exports.isSessionLaunchRoleMismatchError = isSessionLaunchRoleMismatchError;
 exports.isSessionLaunchInFlight = isSessionLaunchInFlight;
 exports.runSessionLaunch = runSessionLaunch;
 exports.forgetSessionLaunch = forgetSessionLaunch;
@@ -57,6 +60,7 @@ const logger_1 = require("../../lib/logger");
 const session_starting_config_1 = require("../../config/session-starting-config");
 const instance_input_lock_1 = require("../../lib/session/instance-input-lock");
 const session_start_error_1 = require("../../lib/session/session-start-error");
+const launch_errors_1 = require("../../lib/agent-roles/launch-errors");
 const logger = (0, logger_1.createLogger)('session/session-launch-flight');
 const flights = (0, global_state_1.getOrInitGlobal)('__sessionLaunchFlights', () => new Map());
 /**
@@ -118,6 +122,26 @@ exports.SessionLaunchModelMismatchError = SessionLaunchModelMismatchError;
 function isSessionLaunchModelMismatchError(error) {
     return (error instanceof Error && error.code === exports.SESSION_LAUNCH_MODEL_MISMATCH_CODE);
 }
+/**
+ * A start resolved a different role from the launch of the session already in
+ * progress (Issue #4115). A role is fixed when the process starts, so joining
+ * would silently run the request under the other one. Nothing was typed. Compared
+ * by the injection fingerprint: another name for the same text is the same role.
+ */
+class SessionLaunchRoleMismatchError extends Error {
+    code = launch_errors_1.SESSION_LAUNCH_ROLE_MISMATCH_CODE;
+    constructor(toolName, sessionName) {
+        super(`${toolName} is being started by another request (tmux session '${sessionName}') with a different role. ` +
+            'A role is fixed when the process starts — the message was not delivered and nothing was typed. ' +
+            'Retry once that start has finished; the session will show which role it has.');
+        this.name = 'SessionLaunchRoleMismatchError';
+    }
+}
+exports.SessionLaunchRoleMismatchError = SessionLaunchRoleMismatchError;
+/** Duck-typed on `code`, like the session-start errors (bundles do not share classes). */
+function isSessionLaunchRoleMismatchError(error) {
+    return error instanceof Error && error.code === launch_errors_1.SESSION_LAUNCH_ROLE_MISMATCH_CODE;
+}
 /** How long a caller may wait for `flight`, counted from when it began. */
 function launchWaitLimitMs(flight) {
     return flight.cliToolId === undefined
@@ -160,6 +184,7 @@ function isSessionLaunchInFlight(sessionName) {
  * synchronous step as the check, before `launch` reads anything (R4).
  *
  * @throws SessionLaunchModelMismatchError when another launch is in progress with another model
+ * @throws SessionLaunchRoleMismatchError when another launch is in progress with another role
  * @throws SessionLaunchInFlightError when another launch is in progress and the caller holds the input lock
  * @throws SessionLaunchWaitTimeoutError when the joined launch outlives its start budget
  */
@@ -170,6 +195,12 @@ function runSessionLaunch(sessionName, toolName, launch, options = {}) {
             logger.info('session-launch-model-mismatch-refused', { sessionName });
             return Promise.reject(new SessionLaunchModelMismatchError(toolName, sessionName, options.model, inFlight.model));
         }
+        if (options.injectionFingerprint !== undefined &&
+            inFlight.injectionFingerprint !== undefined &&
+            options.injectionFingerprint !== inFlight.injectionFingerprint) {
+            logger.info('session-launch-role-mismatch-refused', { sessionName });
+            return Promise.reject(new SessionLaunchRoleMismatchError(toolName, sessionName));
+        }
         if ((0, instance_input_lock_1.currentInstanceInputTicket)(sessionName) !== null) {
             logger.info('session-launch-in-flight-refused', { sessionName });
             return Promise.reject(new SessionLaunchInFlightError(toolName, sessionName));
@@ -187,6 +218,7 @@ function runSessionLaunch(sessionName, toolName, launch, options = {}) {
         startedAt: Date.now(),
         cliToolId: options.cliToolId,
         model: options.model,
+        injectionFingerprint: options.injectionFingerprint,
     };
     flights.set(sessionName, flight);
     const clear = () => {

package/dist/server/src/lib/session/worktree-session-reconcile.js

@@ -72,6 +72,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.__internal = void 0;
 exports.reconcileWorktreeSessions = reconcileWorktreeSessions;
 exports.reconcileWorktreeSessionsFromAliases = reconcileWorktreeSessionsFromAliases;
+const role_launch_1 = require("../../lib/session/role-launch");
 const manager_1 = require("../../lib/cli-tools/manager");
 const types_1 = require("../../lib/cli-tools/types");
 const agent_instances_db_1 = require("../../lib/db/agent-instances-db");
@@ -515,6 +516,10 @@ function moveAutoYesPartialAnswers(completed, sourceEpochs) {
  * and leaving either behind is exactly the silent breakage this guards against.
  */
 function migrateRuntimeState(db, renames, result) {
+    // --- Roles ----------------------------------------------------------------
+    // Issue #4115: the sessions were renamed and the processes are the same, so what
+    // this server knows about them follows. The records moved with the worktree row.
+    (0, role_launch_1.moveLaunchRoleEvidence)(renames);
     // --- Auto-Yes -------------------------------------------------------------
     // Snapshot which pollers are running BEFORE the state moves: startAutoYesPolling
     // refuses to start when the state at its key is not enabled, so the state has

package/dist/server/src/lib/test-run-detection.js

@@ -0,0 +1,53 @@
+"use strict";
+/**
+ * Is this process a test run? The one rule, for everything that must behave
+ * differently under test (Issue #4097; the rule itself is from #4086).
+ *
+ * It lives apart from the database on purpose: `db-instance` imports
+ * `agent-session-cost-sampler`, and `session-generation-archive` is reached by
+ * suites that mock `db-instance` down to a single export. This module imports
+ * nothing, so all three can read it without changing either graph.
+ *
+ * A test that needs a production branch mocks {@link isUnderTest}. Clearing
+ * `VITEST` does nothing here, and there is no flag that switches the guards off
+ * in production.
+ *
+ * @module lib/test-run-detection
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isInsideVitestWorker = isInsideVitestWorker;
+exports.isUnderTest = isUnderTest;
+/**
+ * Is this code running inside a Vitest worker?
+ *
+ * Read off the worker state Vitest itself installs on `globalThis` (its
+ * `getWorkerState()` reads the same `__vitest_worker__` global, in the forks
+ * and threads pools alike), not off environment variables: the environment is
+ * both inherited and editable. A test may swap `NODE_ENV` to `production`
+ * mid-run (tests/unit/pwa/ServiceWorkerRegistrar.test.tsx does) and must stay
+ * guarded, while a child process started outside Vitest inherits `VITEST` and
+ * must not be taken for a test run.
+ */
+function isInsideVitestWorker() {
+    const state = globalThis.__vitest_worker__;
+    return typeof state === 'object' && state !== null;
+}
+/**
+ * Is this a test run?
+ *
+ * Inside a Vitest worker: always, whatever `NODE_ENV` says right now.
+ * Outside one: only with `NODE_ENV=test` (a test's own child process, which
+ * also inherits the per-process CM_DB_PATH). `VITEST` alone never counts —
+ * the daemon spreads `process.env` into the server it starts
+ * (src/cli/utils/daemon.ts buildChildEnv), so a `NODE_ENV=production` server
+ * started from a shell where `VITEST` was left behind is a real server.
+ *
+ * @param env - defaults to `process.env`
+ * @param inVitestWorker - defaults to {@link isInsideVitestWorker}; a test
+ *   passes `false` to ask how a process outside Vitest would be judged
+ */
+function isUnderTest(env = process.env, inVitestWorker = isInsideVitestWorker()) {
+    if (inVitestWorker)
+        return true;
+    return (env.NODE_ENV ?? '').trim() === 'test';
+}

package/dist/server/src/lib/tmux/read-mode.js

@@ -117,6 +117,10 @@ const POPUP_HEIGHT = '85%';
  * Always under `~/.commandmate/`, never the install directory and never the cwd:
  * `bind-key` is server-global and long-lived, so the path it names has to outlive
  * a `npx` cache eviction or a `cd`.
+ *
+ * Not moved by `CM_TMUX_SCRIPT_DIR`. `session-hook-scripts.ts` `AUTO_POPUP_SCRIPT`
+ * spells the same location for `sh` as `$HOME/.commandmate/bin/…` (Issue #4191);
+ * change both together.
  */
 function getPagerScriptPath() {
     return (0, path_1.join)((0, os_1.homedir)(), '.commandmate', 'bin', read_mode_pager_1.PAGER_SCRIPT_FILENAME);

package/dist/server/src/lib/tmux/session-hook-scripts.js

@@ -31,7 +31,7 @@
  * also runnable by hand and because a session can be renamed.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AUTO_POPUP_SCRIPT = exports.LIVE_DELEGATE_SCRIPT = exports.LIVE_RESTORE_SCRIPT = exports.AUTO_POPUP_SCRIPT_FILENAME = exports.LIVE_DELEGATE_SCRIPT_FILENAME = exports.LIVE_RESTORE_SCRIPT_FILENAME = void 0;
+exports.AUTO_POPUP_SCRIPT = exports.LIVE_DELEGATE_SCRIPT = exports.LIVE_RESTORE_SCRIPT = exports.AUTO_POPUP_SCRIPT_FILENAME = exports.LIVE_DELEGATE_SCRIPT_FILENAME = exports.LIVE_RESTORE_SCRIPT_FILENAME = exports.SCRIPT_DIR_ENV = void 0;
 exports.getScriptDir = getScriptDir;
 exports.getScriptPath = getScriptPath;
 exports.materializeScript = materializeScript;
@@ -44,6 +44,27 @@ const path_1 = require("path");
 const tmux_pane_config_1 = require("../../config/tmux-pane-config");
 const tmux_session_surface_1 = require("../session/tmux-session-surface");
 const read_mode_pager_1 = require("./read-mode-pager");
+const safe_directory_1 = require("../../config/safe-directory");
+/**
+ * Moves {@link getScriptDir} off `~/.commandmate/bin` (Issue #4176).
+ *
+ * `ensureSessionHooks` materializes these scripts whenever the live-attach or
+ * auto-popup option is on, and a unit test that turns one on would otherwise
+ * read and rewrite the scripts the running server's tmux hooks execute.
+ * `tests/setup.ts` pins it to a temporary directory. Unset, the directory is the
+ * one it has always been. The auto-popup script still looks for the pager at
+ * `$HOME/.commandmate/bin`, where `read-mode.ts` writes it.
+ *
+ * A relative value is made absolute against this process's working directory
+ * when it is read. The scripts are written there anyway (`fs` resolves a
+ * relative path the same way), and the path recorded in the tmux hook has to
+ * be that same file: tmux runs a hook's command from its own working directory,
+ * not this process's, so a relative path in the hook would name another file or
+ * none. Rejecting the value instead would send the scripts back to
+ * `~/.commandmate/bin`, which is what the variable exists to avoid. The
+ * `/proc` check runs on the absolute form, so `../../proc/x` is refused too.
+ */
+exports.SCRIPT_DIR_ENV = 'CM_TMUX_SCRIPT_DIR';
 /** Basename of the Phase D geometry-restore script. */
 exports.LIVE_RESTORE_SCRIPT_FILENAME = 'cm-live-restore.sh';
 /** Basename of the Phase D geometry-delegation script. */
@@ -174,6 +195,13 @@ tmux set-window-option -t "=$SESSION:" window-size latest 2>/dev/null || true
  * then the control-mode test below keeps it from firing for CommandMate's own
  * transport — a popup opened on a control client would be a popup nobody can
  * see and nobody can close.
+ *
+ * The pager path below is `read-mode.ts` `getPagerScriptPath()` written for `sh`
+ * (Issue #4191): the same `~/.commandmate/bin/<PAGER_SCRIPT_FILENAME>`, from the
+ * hook's `$HOME` rather than `homedir()`. Kept as two spellings on purpose: this
+ * text runs in the tmux server's shell, not here, and the pager is not moved by
+ * {@link SCRIPT_DIR_ENV} (it is `bind-key`'s target too). Change both together;
+ * `tests/unit/lib/tmux/pager-script-location-4191.test.ts` holds them equal.
  */
 exports.AUTO_POPUP_SCRIPT = `#!/bin/sh
 # CommandMate auto read popup (Issue #2317) — generated file, edits are overwritten.
@@ -206,16 +234,20 @@ else
   tmux display-popup -w 90% -h 85% -E "sh \\"$PAGER_SCRIPT\\" --follow \\"$SESSION\\"" 2>/dev/null || true
 fi
 `;
-/** Directory every materialized CommandMate script lives in. */
+/**
+ * Directory every materialized CommandMate script lives in, always absolute:
+ * `~/.commandmate/bin` unless {@link SCRIPT_DIR_ENV} names another.
+ */
 function getScriptDir() {
-    return (0, path_1.join)((0, os_1.homedir)(), '.commandmate', 'bin');
+    const fallback = (0, path_1.join)((0, os_1.homedir)(), '.commandmate', 'bin');
+    return (0, safe_directory_1.resolveSafeAbsoluteDirectory)(process.env[exports.SCRIPT_DIR_ENV]?.trim(), fallback, exports.SCRIPT_DIR_ENV);
 }
 /** Absolute path of a materialized script. */
 function getScriptPath(filename) {
     return (0, path_1.join)(getScriptDir(), filename);
 }
 /**
- * Write a script to `~/.commandmate/bin/<filename>` if its content changed.
+ * Write a script to `<getScriptDir()>/<filename>` if its content changed.
  *
  * Idempotent by content comparison so a restart does not churn the file's mtime,
  * and re-executable after a `chmod` accident because the mode is re-applied —

package/dist/server/src/lib/tui-accumulator.js

@@ -40,21 +40,28 @@ function normalizeOpenCodeLine(line) {
 }
 /**
  * Extract meaningful content lines from raw TUI output.
- * Strips ANSI codes, box-drawing characters, and lines matching OPENCODE_SKIP_PATTERNS.
+ * Strips ANSI codes, box-drawing characters, and lines matching `skipPatterns`.
+ *
+ * Issue #4188: the skip list is the caller's, because the rows arrive here with
+ * no position. The default (`OPENCODE_SKIP_PATTERNS`) drops the rows only the
+ * chrome draws by their words. The poller passes `OPENCODE_TRANSCRIPT_SKIP_PATTERNS`
+ * when the rows it hands over were cut above the located chrome
+ * (`sliceOpenCodeTurnWithSkip`), so a reply quoting those rows keeps them.
  *
  * @param rawOutput - Raw tmux capture-pane output
+ * @param skipPatterns - Rows to drop; defaults to `OPENCODE_SKIP_PATTERNS`
  * @returns Array of cleaned, non-empty content lines
  *
  * @internal Exported for unit testing
  */
-function extractTuiContentLines(rawOutput) {
+function extractTuiContentLines(rawOutput, skipPatterns = cli_patterns_1.OPENCODE_SKIP_PATTERNS) {
     const lines = rawOutput.split('\n');
     const contentLines = [];
     for (const line of lines) {
         const cleaned = normalizeOpenCodeLine(line);
         if (!cleaned)
             continue;
-        const shouldSkip = cli_patterns_1.OPENCODE_SKIP_PATTERNS.some(pattern => pattern.test(cleaned));
+        const shouldSkip = skipPatterns.some(pattern => pattern.test(cleaned));
         if (shouldSkip)
             continue;
         // Also skip the Build summary line (completion indicator)
@@ -224,16 +231,18 @@ function initTuiAccumulator(pollerKey) {
  * @param pollerKey - Poller key ("worktreeId:cliToolId")
  * @param rawOutput - Raw tmux capture-pane output
  * @param cliToolId - CLI tool identifier (default: 'opencode' for backward compatibility)
+ * @param openCodeSkipPatterns - The skip list for an opencode capture (Issue #4188);
+ *   defaults to `OPENCODE_SKIP_PATTERNS`. Ignored for copilot.
  *
  * @internal Exported for unit testing
  */
-function accumulateTuiContent(pollerKey, rawOutput, cliToolId = 'opencode') {
+function accumulateTuiContent(pollerKey, rawOutput, cliToolId = 'opencode', openCodeSkipPatterns = cli_patterns_1.OPENCODE_SKIP_PATTERNS) {
     const state = tuiResponseAccumulator.get(pollerKey);
     if (!state)
         return;
     const contentLines = cliToolId === 'copilot'
         ? extractCopilotContentLines(rawOutput)
-        : extractTuiContentLines(rawOutput);
+        : extractTuiContentLines(rawOutput, openCodeSkipPatterns);
     if (contentLines.length === 0)
         return;
     state.pollCount++;

package/dist/server/src/lib/verification/env-clean-gate.js

@@ -38,6 +38,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ENV_CLEAN_GUIDANCE = exports.MAX_REPORTED_ENV_CHANGES = exports.isLivePid = exports.readLivePidCwd = exports.REQUIRE_ENV_CLEAN_SOURCE_CONTRACT = exports.REQUIRE_ENV_CLEAN_SOURCE_CONFIG = void 0;
 exports.resolveRequireEnvClean = resolveRequireEnvClean;
 exports.attributeSessionName = attributeSessionName;
+exports.readSiblingWorktreeIds = readSiblingWorktreeIds;
+exports.defaultOtherWorktreeProbe = defaultOtherWorktreeProbe;
 exports.attributeAnchor = attributeAnchor;
 exports.isZcompdumpEntry = isZcompdumpEntry;
 exports.demoVitestPid = demoVitestPid;
@@ -62,6 +64,7 @@ const fs_1 = require("fs");
 const path_1 = require("path");
 const db_instance_1 = require("../../lib/db/db-instance");
 const worktree_db_1 = require("../../lib/db/worktree-db");
+const worktree_id_1 = require("../../lib/git/worktree-id");
 const session_name_1 = require("../../lib/cli-tools/session-name");
 const types_1 = require("../../lib/cli-tools/types");
 const env_snapshot_1 = require("./env-snapshot");
@@ -115,20 +118,116 @@ function resolveRequireEnvClean(contract, config) {
  * session to this task, and a session this task's agent started in any
  * server's namespace is still this task's addition.
  *
- * Ambiguity resolves towards `self` on purpose. Worktree ids may contain
- * hyphens, so `mcbd-claude-foo-bar` is genuinely ambiguous between worktree
- * `foo` with suffix `bar` and worktree `foo-bar`; calling it `self` makes an
- * addition a violation, and being wrong in that direction costs a false report
- * rather than a missed leak.
+ * Worktree ids may contain hyphens, so `mcbd-claude-foo-bar` is genuinely
+ * ambiguous by name between worktree `foo` with instance suffix `bar` and
+ * worktree `foo-bar`. The rule (Issue #4192):
+ *
+ *   - tail equal to the task's id — `self`;
+ *   - tail not starting with `<id>-` — `other`;
+ *   - tail `<id>-…` — `other` only when `isOtherWorktree` positively says some
+ *     hyphen-boundary prefix of the tail longer than `<id>` (the whole tail
+ *     included) is another worktree: `commandmate-issue-4175-v2` when that
+ *     worktree exists next to, or is registered beside, `commandmate-issue-4175`.
+ *     Otherwise `self`: `-codex-2`, `-2`, a named instance.
+ *
+ * Without that evidence the ambiguity still resolves towards `self` on purpose:
+ * calling it `self` makes an addition a violation, and being wrong in that
+ * direction costs a false report rather than a missed leak. The evidence wins
+ * over the instance reading because it is a fact about the machine (a real
+ * worktree with exactly that id), where the instance reading is only a shape
+ * every name has. The cost, accepted: an instance of this worktree whose suffix
+ * begins with the rest of a live sibling's id (`foo` instance `v2` beside a
+ * worktree `foo-v2`) is excused as that sibling's.
  */
-function attributeSessionName(name, worktreeId) {
+function attributeSessionName(name, worktreeId, isOtherWorktree) {
     const parsed = (0, session_name_1.parseSessionName)(name);
     if (!parsed)
         return 'unattributed';
     const tail = parsed.rest;
-    if (tail === worktreeId || tail.startsWith(`${worktreeId}-`))
+    if (tail === worktreeId)
         return 'self';
-    return 'other';
+    if (!tail.startsWith(`${worktreeId}-`))
+        return 'other';
+    if (isOtherWorktree && longerWorktreeIds(tail, worktreeId).some((id) => askProbe(isOtherWorktree, id))) {
+        return 'other';
+    }
+    return 'self';
+}
+/** Hyphen-boundary prefixes of `tail` longer than `worktreeId`, the whole tail last. */
+function longerWorktreeIds(tail, worktreeId) {
+    const ids = [];
+    let end = tail.indexOf('-', worktreeId.length + 1);
+    while (end !== -1) {
+        ids.push(tail.slice(0, end));
+        end = tail.indexOf('-', end + 1);
+    }
+    ids.push(tail);
+    return ids;
+}
+function askProbe(probe, id) {
+    try {
+        return probe(id) === true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Ids of the git worktrees next to `worktreePath` (#4192): its sibling
+ * directories that carry a `.git` entry, minted the way `deriveWorktreeId`
+ * mints a first registration (sanitized basename). Never throws.
+ */
+function readSiblingWorktreeIds(worktreePath) {
+    const worktree = (0, path_1.resolve)(worktreePath);
+    const parent = (0, path_1.dirname)(worktree);
+    const own = (0, path_1.basename)(worktree);
+    const ids = new Set();
+    try {
+        for (const entry of (0, fs_1.readdirSync)(parent, { withFileTypes: true })) {
+            if (!entry.isDirectory() || entry.name === own)
+                continue;
+            if (!(0, fs_1.existsSync)((0, path_1.join)(parent, entry.name, '.git')))
+                continue;
+            const id = (0, worktree_id_1.sanitizeIdSegment)(entry.name);
+            if (id)
+                ids.add(id);
+        }
+    }
+    catch {
+        // An unreadable parent is no evidence of anything.
+    }
+    return ids;
+}
+/**
+ * The evidence {@link evaluateEnvClean} judges `<id>-…` session names by
+ * (#4192), read at verification — the sibling worktree is usually created
+ * after the baseline, so the baseline cannot know it:
+ *
+ *   - a sibling directory of the task's worktree that is a git worktree with
+ *     exactly that id (no database needed; a worktree not yet synced counts);
+ *   - otherwise a row of this server's worktree table with that id and a path
+ *     other than the task's (covers the collision-suffixed ids a basename
+ *     cannot reproduce).
+ *
+ * The session is `self` again only when both are gone — the sibling directory
+ * and its row in this server's worktree table (removing the directory without
+ * a sync leaves the row, which still counts as evidence) — the strict direction.
+ */
+function defaultOtherWorktreeProbe(worktreePath, lookupRegisteredPath = (worktreeId) => (0, worktree_db_1.getWorktreeById)((0, db_instance_1.getDbInstance)(), worktreeId)?.path ?? null) {
+    let siblings = null;
+    const own = (0, path_1.resolve)(worktreePath);
+    return (candidateId) => {
+        siblings ??= readSiblingWorktreeIds(worktreePath);
+        if (siblings.has(candidateId))
+            return true;
+        try {
+            const path = lookupRegisteredPath(candidateId);
+            return path !== null && path !== '' && (0, path_1.resolve)(path) !== own;
+        }
+        catch {
+            return false;
+        }
+    };
 }
 /**
  * Attribute a listening process by the directory it runs in.
@@ -252,7 +351,7 @@ function attributeHomeEntry(name, worktreePath, resolvePidCwd = exports.readLive
 function attributeEntry(probeId, entry, context, resolvePidCwd) {
     switch (probeId) {
         case 'tmux-sessions':
-            return attributeSessionName(entry.key, context.worktreeId);
+            return attributeSessionName(entry.key, context.worktreeId, context.isOtherWorktree);
         case 'listeners':
             return attributeAnchor(entry.anchor, context.worktreePath);
         case 'home-entries':
@@ -489,7 +588,8 @@ function recordOtherRepositorySessions(snapshot, taskWorktreeId, server) {
     return sessions.entries
         .map((entry) => entry.key)
         .filter((name) => {
-        if (attributeSessionName(name, taskWorktreeId) !== 'other')
+        const isOtherWorktree = (id) => server.repositoryOf?.(id) != null;
+        if (attributeSessionName(name, taskWorktreeId, isOtherWorktree) !== 'other')
             return false;
         if (isOtherServerSession(name, server))
             return false;
@@ -567,7 +667,7 @@ function isKillByAnotherWorker(record, context, taskSession) {
         ? 'unattributed'
         : taskSession && record.callerSession === taskSession
             ? 'self'
-            : attributeSessionName(record.callerSession, context.worktreeId);
+            : attributeSessionName(record.callerSession, context.worktreeId, context.isOtherWorktree);
     const cwdOwner = attributeAnchor(record.callerCwd, context.worktreePath);
     if (sessionOwner === 'self' || cwdOwner === 'self')
         return false;
@@ -990,7 +1090,12 @@ async function evaluateEnvClean(input) {
         // An unreadable ledger excuses nothing; it is not a reason to withhold a verdict.
         sessionKills = [];
     }
-    const diff = diffEnvSnapshots(input.baseline, final, input, {
+    const context = {
+        worktreeId: input.worktreeId,
+        worktreePath: input.worktreePath,
+        isOtherWorktree: input.isOtherWorktree ?? defaultOtherWorktreeProbe(input.worktreePath),
+    };
+    const diff = diffEnvSnapshots(input.baseline, final, context, {
         ignoreHomeEntries: input.ignoreHomeEntries,
         resolvePidCwd: input.resolvePidCwd,
         sessionKills,

package/dist/server/src/lib/verification/gate-runner.js

@@ -288,7 +288,7 @@ function releaseSlot() {
  *
  * The slot bounds what *executes*, not what waits. A run used to take its slot
  * up front and keep it while a gate queued for its `mutex` (`cpu.heavy`, up to
- * the gate's whole `timeoutSec`), so one run holding the lock and one waiting
+ * the gate's whole wait budget, `mutexWaitSec` or else `timeoutSec`), so one run holding the lock and one waiting
  * for it filled both slots, and a third run could not start even its 5-second
  * `lint`. {@link runGateAttempt} now hands the slot back while it waits for the
  * lock and takes it again — ahead of the runs still waiting to start — once the
@@ -673,9 +673,9 @@ function mutexWaitTimeoutLog(gate, name, result) {
         `${exports.MUTEX_WAIT_SKIP_REASON} waited=${formatSeconds(result.waitedMs)}`,
         `${exports.MUTEX_LOG_PREFIX} name=${name} lock=${machineLockPathFor(name)}${held}`,
         `Gate '${gate.id}' declares mutex '${name}' and the machine-wide lock stayed held for its ` +
-            `whole ${gate.timeoutSec}s budget, so the command was never started. This is a resource ` +
-            'conflict, not a verdict on the work: re-run once the other run finishes, or raise ' +
-            "the gate's timeoutSec.",
+            `whole ${(0, verify_config_1.mutexWaitBudgetSec)(gate)}s budget, so the command was never started. This is a ` +
+            'resource conflict, not a verdict on the work: re-run once the other run finishes, or ' +
+            `raise the gate's ${gate.mutexWaitSec === undefined ? 'timeoutSec (or declare mutexWaitSec)' : 'mutexWaitSec'}.`,
     ].join('\n');
 }
 /** Resolved separately from the acquisition so the message can name it either way. */
@@ -701,9 +701,10 @@ async function runGateAttempt(gate, worktreePath, maxLogTailBytes, gateEnv, canc
     if (!mutex) {
         return runCommand(gate.command, worktreePath, gate.timeoutSec, maxLogTailBytes, gateEnv, cancellation);
     }
-    // The gate's own timeout is the wait budget: a gate allowed 600s of execution
-    // has already declared how long this run may spend on it, and a second knob
-    // would only let the two disagree.
+    // The wait budget is `mutexWaitSec`, or the gate's own timeout when it declares
+    // none (Issue #4162; docs/orchestrate/exit-codes.md, 3-4 99). The queue length
+    // and the hang limit are separate facts about a gate, but no key still means
+    // the single budget every gate had before.
     //
     // Issue #2063: the wait is abandonable. `build` declares 1800s here, so a run
     // cancelled while queued behind the lock used to stay `running` for up to
@@ -714,7 +715,7 @@ async function runGateAttempt(gate, worktreePath, maxLogTailBytes, gateEnv, canc
     // busy (never when it is free — `onWait` fires only once a claim has failed),
     // and taken back ahead of the runs still waiting to start. See RunSlot.
     const lock = await (0, machine_lock_1.acquireMachineLock)(mutex, {
-        timeoutMs: gate.timeoutSec * 1000,
+        timeoutMs: (0, verify_config_1.mutexWaitBudgetSec)(gate) * 1000,
         shouldAbandon: () => cancellation.cancelled,
         onWait: () => slot.release(),
     });