@0xmaxma/claude-gateway 2.0.9 → 2.0.11

package/dist/session/process.js

@@ -38,6 +38,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SessionProcess = exports.INTERRUPTED_NO_REPLY_TEXT = exports.MAX_HISTORY_MESSAGES = void 0;
 exports.resolveMaxHistoryMessages = resolveMaxHistoryMessages;
+const child_env_1 = require("../jev/child-env");
 const worker_environment_1 = require("./worker-environment");
 const process_diagnostics_1 = require("./process-diagnostics");
 const managed_connectors_1 = require("./managed-connectors");
@@ -53,10 +54,11 @@ const runtime_profile_1 = require("./runtime-profile");
 const string_decoder_1 = require("string_decoder");
 const process_supervisor_1 = require("../orchestration/process-supervisor");
 const capacity_1 = require("../orchestration/capacity");
+const types_1 = require("../orchestration/types");
 const chokidar_1 = __importDefault(require("chokidar"));
 const knowledge_1 = require("../agent/knowledge");
 const config_1 = require("../agent/dreaming/config");
-const types_1 = require("../history/types");
+const types_2 = require("../history/types");
 const logger_1 = require("../logger");
 const pty_stream_registry_1 = require("../shell/pty-stream-registry");
 const screen_1 = require("../shell/screen");
@@ -252,6 +254,10 @@ class SessionProcess extends events_1.EventEmitter {
     runtimeProfile) {
         super();
         this.runtimeProfile = runtimeProfile;
+        /** Bumped by stop(): a spawnProcess() that awaited across it abandons its spawn. */
+        this.spawnEpoch = 0;
+        // Bumped by every start(): a stop() still awaiting after one ran no longer owns the session's live state.
+        this.starts = 0;
         this.managedGroupStopped = false;
         this.lastActivityAt = Date.now(); // accessible by AgentRunner for eviction sort
         // Wall-clock time of the most recent BACKGROUND_DISPATCH_TOOLS tool_use seen
@@ -369,7 +375,7 @@ class SessionProcess extends events_1.EventEmitter {
         this.sessionId = sessionId;
         this.source = source;
         this.chatId = chatId ?? sessionId;
-        this.sessionChannel = (0, types_1.toChatChannel)(source);
+        this.sessionChannel = (0, types_2.toChatChannel)(source);
         this.agentConfig = agentConfig;
         this.gatewayConfig = gatewayConfig;
         this.sessionStore = sessionStore;
@@ -421,6 +427,7 @@ class SessionProcess extends events_1.EventEmitter {
         return this.agentConfig.claude.model;
     }
     async start() {
+        this.starts++;
         this.stopping = false;
         this.restartCount = 0;
         this.setupRestartWatcher();
@@ -696,6 +703,25 @@ class SessionProcess extends events_1.EventEmitter {
             return false;
         return [...this.spawnedConnectors.keys()].some(id => name.startsWith(`mcp__${id}__`) && name.length > id.length + 7);
     }
+    /** The appended system prompt never travels on the command line: Windows caps a
+     * whole command line at 32767 characters and Linux caps ONE argument at 128 KiB
+     * (MAX_ARG_STRLEN), so a large workspace context or skill catalog would fail
+     * every spawn (#559); argv is also world-readable through /proc/<pid>/cmdline.
+     * The host CLI reads a 0600 file beside the attempt's MCP config (a 0700
+     * directory), named per spawn so stopping one spawn never removes another's.
+     * A container CLI reads one that prepareContainerProfile writes in its attempt
+     * directory, in the same docker exec as the attempt's mcp.json and ticket. */
+    writeSystemPromptFile(args, mcpConfigPath) {
+        if (!this.runtimeProfile)
+            return args;
+        const file = path.join(path.dirname(mcpConfigPath ?? this.runtimeProfile.mcpConfigPath), `system-prompt-${this.sessionId.replace(/[^\w.-]/g, '_')}-${(0, crypto_1.randomUUID)()}.md`);
+        const moved = (0, runtime_profile_1.appendSystemPromptViaFile)(args, file);
+        if (moved.prompt === undefined)
+            return args;
+        fs.writeFileSync(file, moved.prompt, { mode: 0o600, flag: 'wx' });
+        this.systemPromptPath = file;
+        return moved.args;
+    }
     writeMcpConfig() {
         if (this.runtimeProfile) {
             // Orchestrators dispatch execution; only eligible workers receive connectors.
@@ -707,7 +733,11 @@ class SessionProcess extends events_1.EventEmitter {
             const { servers, connectors } = (0, managed_connectors_1.prepareManagedConnectors)(this.agentConfig, this.gatewayConfig, this.runtimeProfile, this.managedConnectorPaths);
             this.spawnedConnectors = new Map(Object.entries(connectors).map(([id, server]) => [id, connectorFingerprint(server)]));
             const configPath = path.join(path.dirname(this.runtimeProfile.mcpConfigPath), 'managed-connectors.json');
-            fs.writeFileSync(configPath, JSON.stringify({ mcpServers: { ...servers, ...ticket.mcpServers } }), { mode: 0o600 });
+            const mcpServers = { ...servers, ...ticket.mcpServers };
+            for (const server of Object.values(mcpServers))
+                if (server?.env)
+                    server.env = (0, child_env_1.sanitizeJevChildEnv)(server.env, this.gatewayConfig.gateway.jev);
+            fs.writeFileSync(configPath, JSON.stringify({ mcpServers }), { mode: 0o600 });
             fs.chmodSync(configPath, 0o600);
             this.managedMcpConfigPath = configPath;
             return configPath;
@@ -724,6 +754,7 @@ class SessionProcess extends events_1.EventEmitter {
             throw new Error('invalid session id');
         }
         fs.mkdirSync(sessionDir, { recursive: true, mode: 0o700 });
+        this.sessionDirPath = sessionDir;
         const mcpServerPath = path.resolve(__dirname, '..', '..', 'mcp', 'server.ts');
         // Merge stdio servers from Claude Code user + project configs (project overrides user).
         // Skip the gateway's own server names from both — gateway always generates its own
@@ -869,6 +900,9 @@ class SessionProcess extends events_1.EventEmitter {
             },
         };
         const configPath = path.join(sessionDir, 'mcp-config.json');
+        for (const server of Object.values(mcpConfig.mcpServers))
+            if (server?.env)
+                server.env = (0, child_env_1.sanitizeJevChildEnv)(server.env, this.gatewayConfig.gateway.jev);
         fs.writeFileSync(configPath, JSON.stringify(mcpConfig, null, 2), { mode: 0o600 });
         const serverNames = Object.keys(mcpConfig.mcpServers);
         this.logger.debug('MCP config written', { sessionId: this.sessionId, servers: serverNames });
@@ -900,7 +934,7 @@ class SessionProcess extends events_1.EventEmitter {
         const shared = (0, knowledge_1.resolveSharedConfig)(this.agentConfig.knowledge?.shared, this.gatewayConfig.gateway.knowledge?.shared).staleness;
         return (personal.enabled && personal.recordRetrievals) || (shared.enabled && shared.recordRetrievals) ? '1' : '';
     }
-    buildArgs(mcpConfigPath, model) {
+    buildArgs(mcpConfigPath, model, containerAttempt = this.containerAttempt) {
         const args = [
             '--model', model,
             '--input-format', 'stream-json',
@@ -926,7 +960,8 @@ class SessionProcess extends events_1.EventEmitter {
                     throw error;
                 }
             }
-            args.push(...(0, runtime_profile_1.runtimeProfileArgs)({ ...this.runtimeProfile, context, checkpointCommand: this.containerAttempt && this.runtimeProfile.checkpointCommand ? `node ${this.containerAttempt.directory}/checkpoint.cjs ${this.containerAttempt.directory}/ticket.json` : this.runtimeProfile.checkpointCommand, containerExecution: this.agentConfig.type === 'app-agent', mcpConfigPath: this.containerAttempt?.config ?? mcpConfigPath ?? this.runtimeProfile.mcpConfigPath, skillPluginDir: this.containerAttempt && this.runtimeProfile.skillPluginDir ? this.containerAttempt.directory + '/skill-plugin' : this.runtimeProfile.skillPluginDir }, this.agentConfig.claude.extraFlags ?? []));
+            const profileArgs = (0, runtime_profile_1.runtimeProfileArgs)({ ...this.runtimeProfile, context, checkpointCommand: containerAttempt && this.runtimeProfile.checkpointCommand ? `node ${containerAttempt.directory}/checkpoint.cjs ${containerAttempt.directory}/ticket.json` : this.runtimeProfile.checkpointCommand, containerExecution: this.agentConfig.type === 'app-agent', mcpConfigPath: containerAttempt?.config ?? mcpConfigPath ?? this.runtimeProfile.mcpConfigPath, skillPluginDir: containerAttempt && this.runtimeProfile.skillPluginDir ? containerAttempt.directory + '/skill-plugin' : this.runtimeProfile.skillPluginDir }, this.agentConfig.claude.extraFlags ?? []);
+            args.push(...profileArgs);
             if (this.runtimeProfile.cliSession) {
                 const session = this.runtimeProfile.cliSession;
                 args.push(session.resume ? '--resume' : '--session-id', session.id);
@@ -963,15 +998,33 @@ class SessionProcess extends events_1.EventEmitter {
             message: { role: 'user', content: [{ type: 'text', text }, ...images] },
         });
     }
+    /** Resolves false when a stop() during its awaits abandoned the spawn: nothing was
+     * started, and a container attempt it prepared is already cleaned up. */
     async spawnProcess() {
+        const epoch = this.spawnEpoch;
         const { historyPrompt, loadedAtSpawn, archivedCount, messageCountAtSpawn } = await this.buildInitialPrompt();
+        if (epoch !== this.spawnEpoch)
+            return false;
         this.spawnContext = { loadedAtSpawn, archivedCount, messageCountAtSpawn };
         // Determine if this is a docker-exec app-agent before computing paths
         (0, container_1.assertContainerBinding)(this.agentConfig, this.runtimeProfile);
         const isAppAgent = this.agentConfig.type === 'app-agent' && !!this.agentConfig.container;
+        const freshModel = this.readFreshModel();
+        let containerArgs;
         if (isAppAgent && this.runtimeProfile) {
-            this.containerAttempt = await (0, container_1.prepareContainerProfile)(this.agentConfig, this.runtimeProfile);
-            this.runtimeProfile.context = await (0, container_1.containerNode)(this.agentConfig.container, "process.stdout.write(require('fs').readFileSync('/workspace/CLAUDE.md','utf8'))");
+            const profile = this.runtimeProfile, container = this.agentConfig.container;
+            const attempt = await (0, container_1.prepareContainerProfile)(this.agentConfig, profile, async (directory) => {
+                profile.context = await (0, container_1.containerNode)(container, "process.stdout.write(require('fs').readFileSync('/workspace/CLAUDE.md','utf8'))");
+                const moved = (0, runtime_profile_1.appendSystemPromptViaFile)(this.buildArgs(null, freshModel, { directory, config: directory + '/mcp.json' }), directory + '/system-prompt.md');
+                containerArgs = moved.args;
+                return moved.prompt;
+            });
+            // stop() could not see this attempt yet; remove its ticket and prompt here.
+            if (epoch !== this.spawnEpoch) {
+                await (0, container_1.stopContainerProfile)(container, attempt.directory);
+                return false;
+            }
+            this.containerAttempt = attempt;
         }
         const mcpConfigPath = this.writeMcpConfig();
         // For app-agents, Claude runs inside the container where /workspace is mounted.
@@ -979,14 +1032,15 @@ class SessionProcess extends events_1.EventEmitter {
         const toContainerPath = (hostPath) => `/workspace/${path.relative(this.agentConfig.workspace, hostPath)}`;
         const effectiveMcpPath = (isAppAgent && mcpConfigPath) ? toContainerPath(mcpConfigPath) : mcpConfigPath;
         const containerRestartPath = isAppAgent ? toContainerPath(this.restartSignalPath) : this.restartSignalPath;
-        const freshModel = this.readFreshModel();
-        const args = this.buildArgs(effectiveMcpPath, freshModel);
+        const args = containerArgs ?? this.writeSystemPromptFile(this.buildArgs(effectiveMcpPath, freshModel), mcpConfigPath);
         // Resolve the claude binary. An explicit CLAUDE_BIN (which may carry args) is
-        // trusted verbatim; otherwise probe PATH and the native-installer / legacy
+        // parsed by parseClaudeBin; otherwise probe PATH and the native-installer / legacy
         // install locations so a gateway launched with a minimal PATH still finds it.
         let claudeBinRaw;
+        let claudeBinParts;
         if (process.env.CLAUDE_BIN) {
             claudeBinRaw = process.env.CLAUDE_BIN;
+            claudeBinParts = (0, claude_bin_1.parseClaudeBin)(claudeBinRaw);
         }
         else if (isAppAgent) {
             // App-agents run claude INSIDE the container; host-side resolution would
@@ -994,10 +1048,13 @@ class SessionProcess extends events_1.EventEmitter {
             // `claude` so the container's own PATH resolves it (agentConfig.claudeBin
             // overrides below when the image installs claude elsewhere).
             claudeBinRaw = 'claude';
+            claudeBinParts = { command: claudeBinRaw, args: [] };
         }
         else {
             const resolution = (0, claude_bin_1.resolveClaudeBin)();
             claudeBinRaw = resolution.bin;
+            // A resolved path is one executable, never split: it may sit under a home with spaces.
+            claudeBinParts = { command: claudeBinRaw, args: [] };
             if (resolution.source === 'fallback') {
                 this.logger.warn('Could not resolve the claude binary — spawning bare "claude" as a last resort', {
                     sessionId: this.sessionId,
@@ -1016,9 +1073,8 @@ class SessionProcess extends events_1.EventEmitter {
                 });
             }
         }
-        const claudeBinParts = claudeBinRaw.split(' ');
-        let claudeBin = claudeBinParts[0];
-        let allArgs = [...claudeBinParts.slice(1), ...args];
+        let claudeBin = claudeBinParts.command;
+        let allArgs = [...claudeBinParts.args, ...args];
         // gateway.headless: false → run the interactive claude TUI under the
         // claude-pty-shell PTY wrapper (same stream-json protocol on stdio).
         // App-agents always stay headless: the wrapper (node-pty) lives on the
@@ -1067,10 +1123,13 @@ class SessionProcess extends events_1.EventEmitter {
             containerUid = os.userInfo().uid;
         }
         catch { /* use 1000 */ }
-        const configuredWorkerEnvironment = this.runtimeProfile?.role === 'worker' ? (0, worker_environment_1.workerEnvironment)(this.agentConfig, this.gatewayConfig) : {};
+        const configuredWorkerEnvironment = (0, child_env_1.sanitizeJevChildEnv)(this.runtimeProfile?.role === 'worker' ? (0, worker_environment_1.workerEnvironment)(this.agentConfig, this.gatewayConfig) : {}, this.gatewayConfig.gateway.jev);
+        const turnEnvironment = this.runtimeProfile?.role === 'agent' && this.runtimeProfile.claudeEffort
+            ? { CLAUDE_CODE_EFFORT_LEVEL: this.runtimeProfile.claudeEffort } : {};
         const containerEnv = {
             HOME: os.homedir(),
             CLAUDE_WORKSPACE: '/workspace',
+            ...turnEnvironment,
             GATEWAY_RESTART_SIGNAL_PATH: containerRestartPath,
         };
         if (!this.runtimeProfile && process.env.GATEWAY_API_URL)
@@ -1089,6 +1148,8 @@ class SessionProcess extends events_1.EventEmitter {
         const dockerEnvFlags = [
             ...Object.entries(containerEnv).flatMap(([k, v]) => ['-e', `${k}=${v}`]),
             ...byNameKeys.flatMap((k) => ['-e', k]),
+            // Also mask values baked into an existing container's own environment.
+            ...(0, child_env_1.jevCredentialEnvNames)(this.gatewayConfig.gateway.jev).flatMap(k => ['-e', `${k}=`]),
         ];
         const spawnArgs = isAppAgent
             ? [
@@ -1126,13 +1187,14 @@ class SessionProcess extends events_1.EventEmitter {
         let proc;
         try {
             proc = (0, child_process_1.spawn)(spawnBin, spawnArgs, {
-                env: {
+                env: (0, child_env_1.sanitizeJevChildEnv)({
                     ...process.env,
                     ...(!isAppAgent && this.runtimeProfile?.checkpointCommand && !this.runtimeProfile.hostExecution ? Object.fromEntries(CONTAINER_CREDENTIAL_KEYS.map(key => [key, undefined])) : {}),
                     ...containerAuthEnv,
                     ...(toolCapture ? { OTEL_LOG_RAW_API_BODIES: 'file:' + toolCapture.directory } : {}),
                     ...(hardenedPath ? { PATH: hardenedPath } : {}),
                     ...configuredWorkerEnvironment,
+                    ...turnEnvironment,
                     GATEWAY_ORIGIN_SESSION_ID: this.runtimeProfile?.originSessionId ?? this.sessionId,
                     GATEWAY_TASK_ID: this.runtimeProfile?.taskId ?? '',
                     GATEWAY_TASK_ATTEMPT_ID: this.runtimeProfile?.attemptId ?? '',
@@ -1142,24 +1204,36 @@ class SessionProcess extends events_1.EventEmitter {
                     ...(ptyRealBin ? { CLAUDE_REAL_BIN: ptyRealBin } : {}),
                     ...(ptyHeartbeatPath ? { PTY_SHELL_HEARTBEAT_PATH: ptyHeartbeatPath } : {}),
                     ...(ptyStreamSocketPath ? { PTY_SHELL_STREAM_SOCKET: ptyStreamSocketPath } : {}),
-                },
+                }, this.gatewayConfig.gateway.jev),
                 cwd: this.agentConfig.workspace,
-                ...(this.runtimeProfile?.role === 'worker' && process.platform === 'linux' ? { detached: true } : {}),
+                ...(this.runtimeProfile?.role === 'worker' && (0, process_supervisor_1.processSupervisorSupported)() && (0, process_supervisor_1.workerSpawnDetached)() ? { detached: true } : {}),
+                windowsHide: true,
                 stdio: ['pipe', 'pipe', 'pipe'],
             });
         }
         catch (error) {
             toolCapture?.close();
             releaseCapacity();
+            // Node throws E2BIG/ENAMETOOLONG (and most other execve failures) from spawn()
+            // itself; they never reach proc.on('error') below, so log them here. Sizes
+            // only: the arguments may carry prompts and settings.
+            const cause = error.code;
+            const bytes = [spawnBin, ...spawnArgs].map(arg => Buffer.byteLength(arg));
+            this.logger.error('session subprocess could not be spawned', { sessionId: this.sessionId, code: cause, argCount: bytes.length, largestArgBytes: Math.max(...bytes), totalArgBytes: bytes.reduce((sum, n) => sum + n, 0) });
+            if (cause === 'E2BIG' || cause === 'ENAMETOOLONG')
+                throw new types_1.OrchestrationError('PROCESS_ARGS_TOO_LARGE', `spawn ${cause}`);
             throw error;
         }
         this.process = proc;
+        const startsAtSpawn = this.starts;
         proc.once('exit', releaseCapacity);
         proc.once('exit', () => { setTimeout(() => toolCapture?.close(), 200).unref(); });
         proc.once('error', () => toolCapture?.close());
         proc.once('error', releaseCapacity);
-        if (this.runtimeProfile?.role === 'worker' && process.platform === 'linux')
+        if (this.runtimeProfile?.role === 'worker' && (0, process_supervisor_1.processSupervisorSupported)()) {
             this.managedProcessGroup = proc.pid;
+            (0, process_supervisor_1.recordProcessRoot)(proc);
+        }
         // Fresh child is alive: clear any exit observed for a prior process (e.g.
         // after an auto-restart), so isRunning()/interrupt() see it as live.
         this._exited = false;
@@ -1540,6 +1614,15 @@ class SessionProcess extends events_1.EventEmitter {
             });
             if (ptyStreamSocketPath)
                 pty_stream_registry_1.ptyStreamRegistry.close(ptyStreamSocketPath);
+            // A start() while an earlier stop() still waited for this exit owns the
+            // session now, whether or not its child is attached yet; this exit is not
+            // that session's death, so no 'exit' listener may see it and nothing restarts.
+            // The stopped turn settles when its stop() resolves.
+            if (this.starts !== startsAtSpawn || (this.process && this.process !== proc)) {
+                if (this.process === proc)
+                    this.process = null;
+                return;
+            }
             this.process = null;
             this._exited = true;
             this.resetBackgroundDispatchState();
@@ -1585,6 +1668,7 @@ class SessionProcess extends events_1.EventEmitter {
                 this.emit('startup-error', Object.assign(new Error(code), { code }));
             }
         });
+        return true;
     }
     scheduleRestart() {
         // Graceful self-restart requested by agent — reset counter so it doesn't
@@ -1624,9 +1708,12 @@ class SessionProcess extends events_1.EventEmitter {
                     // sendMessage() will no longer silently no-op. Emitted on every
                     // successful crash-triggered respawn — cheap, and nothing currently
                     // listens outside that one call site.
-                    .then(() => {
+                    .then(spawned => {
                     this._restartScheduled = false;
-                    this.emit('restarted');
+                    if (spawned)
+                        this.emit('restarted');
+                    else
+                        this.emit('restartFailed', new Error('Session restart abandoned: session stopping'));
                 })
                     .catch(err => {
                     this._restartScheduled = false;
@@ -1987,28 +2074,56 @@ class SessionProcess extends events_1.EventEmitter {
         if (this.diagnostics.outcome === 'pending' && !this.diagnostics.stopReason)
             this.diagnostics.stopReason = 'shutdown';
         this.stopping = true;
-        if (this.containerAttempt && this.agentConfig.container) {
-            this.managedGroupStopped = await (0, container_1.stopContainerProfile)(this.agentConfig.container, this.containerAttempt.directory);
-            this.containerAttempt = undefined;
+        this.spawnEpoch++;
+        // Take over what the spawn being stopped wrote, so a start() while this stop
+        // still waits for the exit records its own files from scratch. Connector and
+        // MCP config files keep fixed names, and such a start() rewrites them in place:
+        // at the exit, removeSessionDir skips every path that newer spawn holds again.
+        const owned = {
+            systemPrompt: this.systemPromptPath,
+            connectors: [...this.managedConnectorPaths],
+            managedMcpConfig: this.managedMcpConfigPath,
+        };
+        this.systemPromptPath = undefined;
+        this.managedConnectorPaths = new Set();
+        this.managedMcpConfigPath = undefined;
+        this.sessionDirPath = undefined;
+        // The same for the spawn's live state: a start() during the awaits below
+        // attaches its own child, group, attempt and watcher, which this stop must
+        // neither signal nor clear. A newer stop() of that spawn handles them.
+        const starts = this.starts;
+        const superseded = () => this.starts !== starts;
+        const proc = this.process;
+        const attempt = this.containerAttempt;
+        const group = this.managedProcessGroup;
+        const watcher = this.restartWatcher;
+        this.restartWatcher = null;
+        let exited = false;
+        const exit = proc ? new Promise(resolve => proc.once('exit', () => { exited = true; resolve(); })) : undefined;
+        this.resetBackgroundDispatchState();
+        if (attempt && this.agentConfig.container) {
+            this.managedGroupStopped = await (0, container_1.stopContainerProfile)(this.agentConfig.container, attempt.directory);
+            if (this.containerAttempt === attempt)
+                this.containerAttempt = undefined;
         }
-        if (this.managedProcessGroup) {
-            const hostStopped = await (0, process_supervisor_1.stopProcessGroup)(this.managedProcessGroup);
+        if (group) {
+            const hostStopped = await (0, process_supervisor_1.stopProcessGroup)(group);
             this.managedGroupStopped = this.agentConfig.type === 'app-agent' ? this.managedGroupStopped && hostStopped : hostStopped;
-            if (this.managedGroupStopped)
+            if (this.managedGroupStopped && this.managedProcessGroup === group)
                 this.managedProcessGroup = undefined;
         }
-        this.resetBackgroundDispatchState();
-        await this.restartWatcher?.close();
-        this.restartWatcher = null;
-        try {
-            fs.rmSync(this.restartSignalPath, { force: true });
-        }
-        catch { }
-        if (this.source === 'telegram' && !this.runtimeProfile) {
+        await watcher?.close();
+        if (!superseded()) {
             try {
-                fs.rmSync(path.join(this.typingDir, `${this.chatId}.processing`), { force: true });
+                fs.rmSync(this.restartSignalPath, { force: true });
             }
             catch { }
+            if (this.source === 'telegram' && !this.runtimeProfile) {
+                try {
+                    fs.rmSync(path.join(this.typingDir, `${this.chatId}.processing`), { force: true });
+                }
+                catch { }
+            }
         }
         // mcp-config.json under here holds fully-substituted secrets (channel bot
         // tokens, GATEWAY_API_KEY, connector OAuth tokens) — it must not outlive
@@ -2018,49 +2133,42 @@ class SessionProcess extends events_1.EventEmitter {
         // subprocess (or, for a container agent, the still-running container that
         // bind-mounts this path) can be alive for up to the 10s graceful-shutdown
         // window immediately after this point, and must not find it gone under it.
+        // A newer spawn that wrote the shared directory owns it now; its stop removes it.
         const removeSessionDir = () => {
-            for (const filename of this.managedConnectorPaths) {
-                try {
-                    fs.rmSync(filename, { force: true });
-                }
-                catch { }
-            }
-            this.managedConnectorPaths.clear();
-            if (this.managedMcpConfigPath) {
-                try {
-                    fs.rmSync(this.managedMcpConfigPath, { force: true });
+            const reclaimed = (file) => this.managedConnectorPaths.has(file) || file === this.managedMcpConfigPath;
+            for (const file of [...owned.connectors, owned.managedMcpConfig, owned.systemPrompt]) {
+                if (file && !reclaimed(file)) {
+                    try {
+                        fs.rmSync(file, { force: true });
+                    }
+                    catch { }
                 }
-                catch { }
-                this.managedMcpConfigPath = undefined;
             }
+            if (this.sessionDirPath)
+                return;
             try {
                 fs.rmSync(path.join(this.agentConfig.workspace, '.sessions', this.sessionId), { recursive: true, force: true });
             }
             catch { }
         };
-        if (!this.process) {
+        // A child that failed to spawn never exits; its 'error' handler already let go of it.
+        if (!proc || exited || (this.process !== proc && !proc.pid)) {
             removeSessionDir();
             return;
         }
-        return new Promise((resolve) => {
-            const proc = this.process;
-            let forceKillTimer = null;
-            proc.once('exit', () => {
-                if (forceKillTimer !== null) {
-                    clearTimeout(forceKillTimer);
-                    forceKillTimer = null;
-                }
-                this.process = null;
-                removeSessionDir();
-                resolve();
-            });
-            proc.kill('SIGTERM');
-            forceKillTimer = setTimeout(() => {
-                forceKillTimer = null;
-                if (this.process)
-                    proc.kill('SIGKILL');
-            }, 10000);
-        });
+        let forceKillTimer = null;
+        proc.kill('SIGTERM');
+        forceKillTimer = setTimeout(() => {
+            forceKillTimer = null;
+            if (!exited)
+                proc.kill('SIGKILL');
+        }, 10000);
+        await exit;
+        if (forceKillTimer !== null)
+            clearTimeout(forceKillTimer);
+        if (this.process === proc)
+            this.process = null;
+        removeSessionDir();
     }
 }
 exports.SessionProcess = SessionProcess;