@ferris1225/pi-subagents 4.1.16 → 4.1.18

package/src/session-fork.ts

@@ -3,7 +3,6 @@
 import { SessionManager } from "@earendil-works/pi-coding-agent";
 import { existsSync } from "node:fs";
 import { mkdir, mkdtemp, rm } from "node:fs/promises";
-import { tmpdir } from "node:os";
 import { join } from "node:path";
 
 export interface ForkedSession {
@@ -43,15 +42,15 @@ export async function forkRetainedSession(options: {
 	targetCwd?: string;
 	sessionDir: string;
 	sessionId: string;
-	/** Parent directory for the cloned branch. Defaults to the OS temp dir;
-	 * dispatch passes the durable state root. */
-	targetRoot?: string;
+	/** Parent directory for the cloned branch: the project-scoped durable
+	 * sessions root, so forks never land in the OS temp directory. */
+	targetRoot: string;
 }): Promise<ForkedSession> {
 	const sourceSessionFile = await findRetainedSessionFile(
 		options.sessionDir,
 		options.sessionId,
 	);
-	const root = options.targetRoot ?? tmpdir();
+	const root = options.targetRoot;
 	await mkdir(root, { recursive: true });
 	const sessionDir = await mkdtemp(join(root, "pi-subagent-session-fork-"));
 	try {

package/src/spawn.ts

@@ -367,6 +367,9 @@ export interface RunSingleOptions {
 	/** Parent directory for a fresh session directory: the project-scoped
 	 * sessions root, so retained sessions survive reloads and restarts. */
 	sessionRoot: string;
+	/** Parent directory for per-attempt transient files (child prompt, retry
+	 * policy): the project-scoped tmp root, so nothing lands in the OS temp. */
+	scratchRoot: string;
 	/** Initial RPC prompt. Kept under the old name to limit caller churn. */
 	stdinText?: string;
 	/** Refresh parent-derived tools immediately before every startup retry and
@@ -440,6 +443,7 @@ export async function runSingleAgent(options: RunSingleOptions): Promise<SingleR
 		idleTimeoutMs,
 		sessionDir: options.sessionDir,
 		sessionId: options.sessionId,
+		scratchRoot: options.scratchRoot,
 		prompt,
 		signal: options.signal,
 		onLive: options.onLive,

package/src/temp-hygiene.ts

@@ -1,12 +1,12 @@
 /**
- * Temp hygiene: ownership markers and startup sweeps for the directories this
- * extension creates.
+ * Temp hygiene: ownership markers and startup sweeps for the transient
+ * directories this extension creates.
  *
- * Every short-lived temp directory (child prompt/policy files) gets an owner
- * marker with the creating pid. At extension load, directories whose owner is
- * dead are removed; unmarked legacy leaks fall back to an age cap. The same
- * load pass sweeps the durable state root for directories no manifest record
- * references anymore (crashes between creation and the first record write).
+ * Transient per-run files (child prompt copies, the no-retry policy extension)
+ * live under the project's durable tmp directory, never the OS temp dir. Each
+ * mkdtemp directory gets an owner marker with the creating pid. At extension
+ * load, directories whose owner is dead are removed; unmarked leftovers fall
+ * back to an age cap.
  *
  * A live sibling pi instance never loses its directories: `kill(pid, 0)` only
  * reports "no such process" when the pid genuinely does not exist, so a live
@@ -16,30 +16,19 @@
 
 import { spawn } from "node:child_process";
 import { type Dirent, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
 import { join } from "node:path";
 
 export const TEMP_OWNER_FILE_NAME = "owner.json";
 
-/** Directories this extension creates in the OS temp dir. Session and
- * worktree prefixes cover legacy leaks from versions that used tmpdir for
- * retained state; policy/prompt prefixes cover per-run transient files. */
-const TEMP_DIR_PREFIXES = [
-	"pi-subagent-session-",
-	"pi-subagent-session-fork-",
-	"pi-subagent-worktree-",
-	"pi-subagents-policy-",
-	"pi-subagents-",
-] as const;
+/** Transient directories created under `<project>/tmp`: the child prompt
+ * copies (`pi-subagents-*`) and the no-retry policy extension
+ * (`pi-subagents-policy-*`). Durable sessions and worktrees use the singular
+ * `pi-subagent-` prefixes and live in their own roots, never swept here. */
+const TEMP_DIR_PREFIXES = ["pi-subagents-"] as const;
 
-/** Owned by pruneResultArtifacts; never swept here. */
-const TEMP_DIR_EXCLUDED_NAMES = new Set(["pi-subagents-results"]);
-
-/** Unmarked directories (legacy leaks) must outlive this age before removal. */
+/** Unmarked directories (crash before the marker write) must outlive this age
+ * before removal. */
 export const UNMARKED_TEMP_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1_000;
-/** State-root directories missing from every manifest record (crash between
- * directory creation and the first record persist) after this age. */
-export const UNREFERENCED_STATE_MAX_AGE_MS = 24 * 60 * 60 * 1_000;
 
 interface TempOwner {
 	pid: number;
@@ -128,10 +117,10 @@ function directoryAgeMs(entry: Dirent, dir: string, now: number): number | undef
 	}
 }
 
-/** Remove OS-temp directories owned by dead processes plus old unmarked
- * legacy leaks. Returns how many directories were removed. */
+/** Remove dead-owner and old-unmarked transient directories under `rootDir`.
+ * Returns how many directories were removed. */
 export function sweepOrphanTempDirs(
-	rootDir: string = tmpdir(),
+	rootDir: string,
 	options: SweepOptions = {},
 ): number {
 	const now = options.now ?? Date.now();
@@ -146,7 +135,6 @@ export function sweepOrphanTempDirs(
 	let removed = 0;
 	for (const entry of entries) {
 		if (!entry.isDirectory() || entry.isSymbolicLink()) continue;
-		if (TEMP_DIR_EXCLUDED_NAMES.has(entry.name)) continue;
 		if (!TEMP_DIR_PREFIXES.some((prefix) => entry.name.startsWith(prefix))) continue;
 		const path = join(rootDir, entry.name);
 		const owner = readTempOwnerMarker(path);
@@ -164,3 +152,23 @@ export function sweepOrphanTempDirs(
 	return removed;
 }
 
+/** Sweep every project's transient tmp directory under the durable extension
+ * root, so crash leftovers from any checkout die on the next load. */
+export function sweepProjectTempDirs(
+	durableRoot: string,
+	options: SweepOptions = {},
+): number {
+	let projects: Dirent[];
+	try {
+		projects = readdirSync(durableRoot, { withFileTypes: true });
+	} catch {
+		return 0;
+	}
+	let removed = 0;
+	for (const project of projects) {
+		if (!project.isDirectory() || project.isSymbolicLink()) continue;
+		removed += sweepOrphanTempDirs(join(durableRoot, project.name, "tmp"), options);
+	}
+	return removed;
+}
+

package/src/thread-lifecycle.ts

@@ -12,7 +12,7 @@ import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { existsSync } from "node:fs";
 import { rm } from "node:fs/promises";
 import { realpath } from "node:fs/promises";
-import { join, resolve } from "node:path";
+import { join, resolve, dirname } from "node:path";
 import {
 	discoverAgents,
 	isWriteCapableAgent,
@@ -68,6 +68,7 @@ import {
 	buildResumePrompt,
 	getProjectRoot,
 	getResultOutput,
+	PROJECT_ROOTS_DIR_NAME,
 	RpcRunControl,
 	isFailedResult,
 	isModelLevelFailure,
@@ -81,7 +82,7 @@ import {
 import {
 	isProcessAlive,
 	killProcessTree,
-	sweepOrphanTempDirs,
+	sweepProjectTempDirs,
 } from "./temp-hygiene.ts";
 import {
 	createWorktreeIsolation,
@@ -418,6 +419,7 @@ export function createBackgroundDispatcher(options: BackgroundDispatcherOptions)
 		const projectRoot = getProjectRoot(runtime.configPath, originalCwd);
 		const sessionsRoot = join(projectRoot, "sessions");
 		const worktreesRoot = join(projectRoot, "worktrees");
+		const scratchRoot = join(projectRoot, "tmp");
 		const previousWorktree = existingThread?.worktree;
 		let worktree = seed?.worktree ?? previousWorktree;
 		if (isolation === "worktree") {
@@ -586,6 +588,7 @@ export function createBackgroundDispatcher(options: BackgroundDispatcherOptions)
 							makeDetails: makeDetails("single", true),
 							idleTimeoutMs: activeIdleTimeoutMs,
 							sessionRoot: sessionsRoot,
+							scratchRoot,
 							...(priorSessionId && priorSessionDir
 								? {
 									sessionId: priorSessionId,
@@ -1384,7 +1387,7 @@ export async function bootstrapDurableState(runtime: SubagentRuntime): Promise<v
 		/* retention is best-effort */
 	}
 	try {
-		sweepOrphanTempDirs();
+		sweepProjectTempDirs(join(dirname(runtime.configPath), PROJECT_ROOTS_DIR_NAME));
 	} catch {
 		/* temp hygiene is best-effort */
 	}

package/src/worktree.ts

@@ -11,7 +11,6 @@
 import { spawn, type ChildProcess } from "node:child_process";
 import { existsSync } from "node:fs";
 import { copyFile, mkdir, mkdtemp, realpath, rm, stat, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
 import { isAbsolute, join, relative, resolve } from "node:path";
 
 export type IsolationMode = "shared" | "worktree";
@@ -216,8 +215,9 @@ export interface WorktreeSnapshot {
 
 export interface WorktreeCreateOptions {
 	runner?: CommandRunner;
-	/** Test hook; production uses the OS temp directory. */
-	tempBaseDir?: string;
+	/** Parent directory for the worktree group: the project-scoped durable
+	 * worktrees root, so isolation never lands in the OS temp directory. */
+	tempBaseDir: string;
 	/** Complete source generation checkpoint merged onto the current HEAD. */
 	seedCheckpoint?: WorktreeCheckpoint;
 	/** The seed is already present in the parent checkout, so only later edits
@@ -672,11 +672,11 @@ class GitWorktreeIsolation implements WorktreeIsolation {
  */
 export async function createWorktreeIsolation(
 	cwd: string,
-	options: WorktreeCreateOptions = {},
+	options: WorktreeCreateOptions,
 ): Promise<WorktreeIsolation> {
 	const runner = options.runner ?? runCommand;
 	const target = await resolveWorktreeTarget(cwd, runner);
-	const tempBase = options.tempBaseDir ? resolve(options.tempBaseDir) : tmpdir();
+	const tempBase = resolve(options.tempBaseDir);
 	await mkdir(tempBase, { recursive: true });
 	const tempDir = await mkdtemp(join(tempBase, "pi-subagent-worktree-"));
 	const worktreePath = join(tempDir, "worktree");