- Shipped
- September 5, 2026 at 1:22 AM UTC
- Author
- Kamo
- Commit
- efee857
mid-work today, and would have taken every other member's terminals with it. systemd's default is KillMode=control-group: on stop or restart it SIGKILLs every process in the unit's cgroup. The tmux SERVER is forked by the first `tmux new-session` the agent execs, so it lives in that cgroup — and restarting the agent therefore killed the server and every shell inside it. That is the exact opposite of why tmux is in this design. The whole argument for it, written in this file's own comments, is that the shell outlives the socket: "without tmux a refresh, a closed laptop or a wifi blip kills a running build". An agent deploy was a bigger blip than any of them, and nothing said so — the sessions were simply gone, and a browser reconnecting found an empty machine. It hid because the only two ways to notice are to restart the agent while somebody is working, or to read the unit and know what the default is. Shipping the agent is rare, and the machine is usually idle when it happens: the previous install today ran against a machine with no tmux server at all, so it looked clean. KillMode=process stops the main process and leaves its descendants. Nothing leaks: a per-connection PTY pump is a thread inside the main process and dies with it, and the tmux CLIENT it forked gets EOF on its master and exits by itself. Only the tmux server survives, which is the point. Verified on the machine rather than reasoned about: a session running `sleep` was created, the agent was restarted exactly as a deploy does, and afterwards the session was still listed, the process still running, and its @kamo_coder option intact. Before the fix the same restart left "no server running".