@kendoo.agentdesk/agentdesk 0.28.3 → 0.28.4

package/CHANGELOG.md

@@ -8,14 +8,27 @@ All user-facing changes to AgentDesk. Each entry is tagged:
 
 Internal refactors, infrastructure changes, and architectural notes are not listed here.
 
-## [0.28.3] — 2026-09-19
-
-### Changed
-- `[UI]` The docked team status bar now defaults to a compact one-line strip (avatars + current status) instead of the full grid, with a drag handle (and keyboard resize) to expand it.
-- `[Both]` Session messages are filtered to the session's declared roster, so nested/ad-hoc subagents (e.g. a generic search delegate) no longer show their internal narration in the feed as if they were a team member.
+## [Unreleased]
 
 ### Fixed
-- `[CLI]` Every phase (INTAKE, PLAN, EXECUTION, REVIEW, SUMMARY, SOLO) told the model to answer with the raw handoff JSON as its final chat reply, so the model printed that JSON into the session feed on top of the SDK's separate structured-output channel. Phase prompts no longer ask for that, and a code-side guard strips it if a model still echoes it.
+- `[Both]` Daemon sessions now have a configurable concurrency limit (default 3), with excess requests queued. Cancellation during confirmation stays stopped; workspace quarantine survives cancellation and restart, including when processes outlive a successful session.
+- `[Both]` Worktree Git commands ignore inherited Git config overrides, lock cleanup tolerates concurrent removal, runtime config healing is restored, handoff sessions remain open, and outcome branch validation includes the 300-character boundary.
+- `[Both]` Session restoration checks persisted ownership; outcome capture tolerates diagnostic output and malformed receipts. Live outcomes survive dashboard loading races and appear on the mobile Run screen.
+- `[Both]` Phase handoff JSON is captured automatically instead of repeated in chat; a fallback filter suppresses duplicate structured-output objects in agent messages.
+- `[UI]` Internal helpers outside a session's declared team no longer appear in its roster or contribute SAY/ACT messages to the conversation feed.
+- `[Both]` Cancellation now stops waiting after 30 seconds and quarantines worktrees with surviving processes. Daemon startup and periodic checks recover stale locks without deleting unfinished work.
+- `[Both]` Session agents can no longer modify shared Git refs or hooks. Private Git state is published back only to the session branch, with conflict checks.
+- `[Both]` Cancellation releases the workspace after child processes stop even if the agent connection stalls. Dashboard sessions retain their tracker links.
+- `[CLI]` Conflicting resume and branch options now report an error.
+- `[UI]` Daemon status counts sessions within the current account without scanning other accounts.
+
+### Added
+- `[Both]` Confirmed PR creation and final tracker replies are recorded during the session and shown separately from its status, surviving disconnects and later failures. Background outcome recovery remains deferred.
+- `[UI]` The sidebar shows the 12 most recent past sessions by default, with a More control and automatic reveal of a selected older session.
+- `[UI]` The docked team footer starts as a compact avatar/status row. Drag its handle upward for the full grid, or use arrow keys and Enter to resize it.
+- `[Both]` New sessions use separate Git worktrees by default, so tasks can run concurrently on different branches in the same repository. Choose the starting branch, create or reuse a branch, or opt out to use the existing directory.
+- `[Both]` Archived sessions automatically clean up clean, merged worktrees while retaining branches. Unfinished work stays available to resume, with a review reminder after 14 days and explicit confirmation before discarding files.
+- `[UI]` A Worktrees panel shows session directories, cleanup status, and resume controls.
 
 ## [0.28.2] — 2026-09-18
 

package/README.md

@@ -1,5 +1,43 @@
 # AgentDesk
 
+### Session status and outcomes
+
+Session status remains independent of accomplishments: **Stopped · PR created** still means stopped, not approved or complete. Confirmed PRs and substantive tracker replies appear as separate links in the sidebar and status panel. Outcomes are saved immediately, survive later session updates and server restarts, and are deduplicated on replay. Archived sessions retain them; explicit session deletion removes the associated records.
+
+Capture currently recognizes successful, standalone `gh pr create` commands with an explicit repository and head branch; marked final `gh issue comment` calls; and marked Jira/Linear comment-creation responses from standalone `curl` calls using literal JSON payloads. The engine supplies instructions for a session-specific `[AgentDesk reply:…]` marker in the final task reply, not startup/progress comments. Jira responses must include the created comment's ID/body/self URL; Linear mutations must return `success` and `comment { id url body issue { identifier } }`. Provider receipts must match the session's task/repository. Raw command output and credentials are not stored with outcomes.
+
+Arbitrary shell scripts, pipelines, redirected output, file-based comment payloads, unsupported providers/hosts, and unconfirmed responses remain unknown rather than being guessed from chat or a PR lookup. A crash before the receipt reaches durable storage can still lose an outcome. There is no background recovery or historical backfill in this release.
+
+The sidebar initially shows 12 past sessions across its date groups. **More** reveals older loaded sessions; an explicitly selected older session is revealed automatically. Active sessions are not limited.
+
+### Parallel sessions with Git worktrees
+
+New team and solo sessions create a separate Git worktree and branch by default. Agents, their shell commands, file tools, and Git operations use that session directory. Multiple sessions can work on the same repository concurrently. Existing sessions keep their original directories.
+
+The daemon runs at most **3 sessions concurrently** by default, including sessions awaiting confirmation or completing teardown. Set `AGENTDESK_MAX_SESSIONS=5 agentdesk daemon` to change the limit (1–32). Excess requests wait in a cancellable in-memory daemon queue (up to 100); non-worktree sessions sharing a repository are serialized. The limit applies to daemon-managed sessions, not independently launched `agentdesk team` processes. Queued requests survive a network reconnect but not a daemon process restart.
+
+```sh
+agentdesk team -d "Add search" --base-branch main --branch feature/search
+agentdesk team -d "Fix navigation" --base-branch main
+agentdesk team TASK-123 --existing-branch feature/unfinished --base-branch main
+agentdesk team TASK-123 --no-worktree
+agentdesk team TASK-123 --resume-worktree SESSION-ID
+```
+
+The dashboard's **Run Team** dialog offers the same choices. Git refuses an existing branch that is already checked out elsewhere. A starting branch must exist locally (fetch remote branches first); an unborn or detached HEAD requires selecting a valid starting branch. Opting out uses the current directory and allows one AgentDesk session in that directory at a time.
+
+Worktrees start from committed files. Uncommitted source files, dependencies, and ignored files are not copied or symlinked. Project configuration and environment values are loaded from the registered project, while commands run in the worktree. Install dependencies within each worktree as needed. Worktrees and retained runtime notes live under `~/.agentdesk/workspaces/`; the CLI prints the working directory when a session starts.
+
+Agents use private Git refs, configuration, hooks, and an index, borrowing existing objects read-only. The shared Git database is read-only inside the kernel sandbox. When a session exits, AgentDesk validates new objects and publishes only its branch and index; it refuses to overwrite a branch that moved independently. Private Git state is retained if publication fails and can be resumed when the shared branch has not moved. Worktree sessions require strict kernel isolation (macOS sandbox-exec or Linux bubblewrap); disabling it or selecting the legacy policy will prevent the session from starting. `--resume-worktree` cannot be combined with branch-selection flags.
+
+Cancellation waits at most 30 seconds for process teardown. If processes still remain, the session ends but its worktree is quarantined: no Git publication, resume, or deletion until those processes exit. Other worktrees remain usable. The daemon checks stale locks on startup and every 15 seconds, preserving locks held by surviving agent PIDs or process groups even if the previous daemon crashed. Recovery removes only stale locks, never unfinished files or branches; unpublished private Git state remains available for recovery on resume. Inaccessible or unidentifiable processes require manual review rather than automatic unlocking.
+
+The same live-process check applies after a successful session. Quarantine is recorded separately from the session result and survives server restart; the dashboard reports quarantine at shutdown, while Worktrees shows the current recovery state. Handoff and queued sessions remain open for display and are excluded from bulk inactive-session deletion; only active/stale sessions count as running.
+
+Use **Worktrees** in the dashboard to inspect retained directories, resume work, or remove them. Archiving or deleting a session requests cleanup, including when the daemon is temporarily offline. Automatic removal requires a clean directory (including no untracked or ignored files) and commits reachable from the selected starting branch. Branches are kept. Merge checks use local refs; fetch first if a merge happened remotely. Squash merges do not prove commit ancestry and require manual review.
+
+Unfinished work is retained, with a review reminder after 14 days of session inactivity. Age never triggers deletion. **Discard files** requires typing the branch name and permanently removes uncommitted, untracked, and ignored files; committed branch history remains. Automatic cleanup is retried while the daemon and dashboard are connected. Update both the server and daemon to use this feature.
+
 AI team orchestrator for [Claude Code](https://claude.ai/code). Run collaborative agent sessions from your terminal and watch them live on [agentdesk.live](https://agentdesk.live).
 
 AgentDesk spawns a team of AI agents inside Claude Code that collaborate on your tasks. The default team includes 8 built-in agents, and you can add custom agents to fit your workflow.

package/bin/agentdesk.mjs

@@ -50,6 +50,11 @@ if (!command || command === "help" || command === "--help") {
   Options:
     --description, -d    Task description or requirements
     --cwd                Working directory (defaults to current)
+    --no-worktree        Use the existing directory instead of an isolated worktree
+    --base-branch NAME   Starting branch (defaults to current branch)
+    --branch NAME        Name of the new session branch (default: generated)
+    --existing-branch NAME  Use an existing local branch in a new worktree
+    --resume-worktree ID Resume a retained worktree
     --child-strategy     How to handle child tasks: "inline" (default) or "branch"
 
   Sessions run five phases — INTAKE → PLAN → EXECUTION → REVIEW → SUMMARY — each as
@@ -111,7 +116,8 @@ if (AGENT_NAMES.includes(command?.toLowerCase())) {
   let cwd = process.cwd();
   let taskId = null;
   let childStrategy = null;
-  const remaining = args.slice(1);
+  const { parseWorkspaceArgs } = await import("../cli/worktree-options.mjs");
+  const { remaining, workspace } = parseWorkspaceArgs(args.slice(1));
 
   for (let i = 0; i < remaining.length; i++) {
     if ((remaining[i] === "--description" || remaining[i] === "-d") && remaining[i + 1]) {
@@ -132,7 +138,7 @@ if (AGENT_NAMES.includes(command?.toLowerCase())) {
   }
 
   const { runTeam } = await import("../cli/team.mjs");
-  const code = await runTeam(taskId, { description, cwd, soloAgent: command.charAt(0).toUpperCase() + command.slice(1).toLowerCase(), childStrategy });
+  const code = await runTeam(taskId, { description, cwd, workspace, soloAgent: command.charAt(0).toUpperCase() + command.slice(1).toLowerCase(), childStrategy });
   process.exit(code);
 }
 
@@ -166,7 +172,8 @@ else if (command === "team") {
   let cwd = process.cwd();
   let taskId = null;
   let childStrategy = null;
-  const remaining = args.slice(1);
+  const { parseWorkspaceArgs } = await import("../cli/worktree-options.mjs");
+  const { remaining, workspace } = parseWorkspaceArgs(args.slice(1));
 
   for (let i = 0; i < remaining.length; i++) {
     if ((remaining[i] === "--description" || remaining[i] === "-d") && remaining[i + 1]) {
@@ -189,7 +196,7 @@ else if (command === "team") {
   }
 
   const { runTeam } = await import("../cli/team.mjs");
-  const code = await runTeam(taskId, { description, cwd, childStrategy });
+  const code = await runTeam(taskId, { description, cwd, workspace, childStrategy });
   process.exit(code);
 }
 

package/cli/config.mjs

@@ -9,7 +9,8 @@
 //      on-disk file stays a cached view of the server. Credentials never land
 //      on disk — they stay in the server DB, encrypted.
 
-import { existsSync, readFileSync, writeFileSync } from "fs";
+import { existsSync, readFileSync, writeFileSync, renameSync, unlinkSync } from "fs";
+import { randomUUID } from "node:crypto";
 import { join } from "path";
 
 const DEFAULTS = {
@@ -184,11 +185,15 @@ export async function pushConfig(apiKey, serverUrl, projectName, payload) {
 }
 
 function writeLocalConfig(configPath, config) {
+  const temp = `${configPath}.${randomUUID()}.tmp`;
   try {
     const payload = stripCredentials(config);
-    writeFileSync(configPath, JSON.stringify(payload, null, 2) + "\n", "utf-8");
+    writeFileSync(temp, JSON.stringify(payload, null, 2) + "\n", { encoding: "utf-8", mode: 0o600 });
+    renameSync(temp, configPath);
   } catch (err) {
     console.error(`Warning: Failed to write .agentdesk.json: ${err.message}`);
+  } finally {
+    try { unlinkSync(temp); } catch {}
   }
 }
 

package/cli/daemon.mjs

@@ -15,6 +15,8 @@ import { getRegisteredProjects, registerLocalProject, claimLocalProjects } from
 import { buildTrackerUrl } from "./tracker-url.mjs";
 import { fileURLToPath } from "url";
 import { dirname } from "path";
+import { repositoryInfo, listWorkspaces, inspectWorkspace, cleanupWorkspace, recoverWorkspaceLocks } from "./worktrees.mjs";
+import { createSessionQueue, sessionLimit, confirmWithAbort } from "./session-queue.mjs";
 
 const __dirname_daemon = dirname(fileURLToPath(import.meta.url));
 const DAEMON_VERSION = JSON.parse(readFileSync(join(__dirname_daemon, "../package.json"), "utf-8")).version;
@@ -125,6 +127,16 @@ export async function runDaemon() {
   const cyan = "\x1b[36m";
   const reset = "\x1b[0m";
 
+  // Recover crashes before accepting new work, then reap quarantined leases as
+  // their last process exits. Recovery never deletes a worktree or its branch.
+  const recoverLocks = () => {
+    try { recoverWorkspaceLocks(); }
+    catch (error) { console.error(`[agentdesk] Workspace recovery failed: ${error.message}`); }
+  };
+  recoverLocks();
+  const recoveryTimer = setInterval(recoverLocks, 15000);
+  recoveryTimer.unref();
+
   // 1. Load credentials
   const apiKey = getStoredApiKey();
   if (!apiKey) {
@@ -264,7 +276,22 @@ export async function runDaemon() {
   const buffer = new RingBuffer();
 
   // Active session state
-  let activeSession = null; // { sessionId, projectId, child, startedAt, filePathsTouched }
+  const activeSessions = new Map();
+  let confirmationQueue = Promise.resolve();
+  const maxSessions = sessionLimit();
+  const sessionQueue = createSessionQueue({ limit: maxSessions, run: handleStartSession,
+    onQueued: job => sendBuffered(job.sessionId, { type: "session:update", status: "queued" }),
+    onError: job => send({ type: "daemon:error", sessionId: job.sessionId, error: "Unable to start queued session" }),
+  });
+  function enqueueSession(job) {
+    const project = projects.find(p => p.id === job.projectId);
+    if (!project) { send({ type: "daemon:error", sessionId: job.sessionId, error: "Unknown project" }); return; }
+    try {
+      let key = job.workspace?.resumeId ? `workspace:${job.workspace.resumeId}` : null;
+      if (job.workspace?.enabled === false) key = `repo:${repositoryInfo(project.path).repo}`;
+      sessionQueue.enqueue({ ...job, key });
+    } catch (error) { send({ type: "daemon:error", sessionId: job.sessionId, error: error.message }); }
+  }
 
   function send(data) {
     if (connected && ws?.readyState === WebSocket.OPEN) {
@@ -304,6 +331,8 @@ export async function runDaemon() {
           send({
             type: "daemon:connect",
             version: DAEMON_VERSION,
+            worktrees: true,
+            maxSessions,
             projects: projects.map(p => ({ id: p.id, name: p.name })),
           });
 
@@ -318,7 +347,7 @@ export async function runDaemon() {
 
           // Start heartbeat
           clearInterval(heartbeatTimer);
-          heartbeatTimer = setInterval(() => send({ type: "daemon:heartbeat" }), 30000);
+          heartbeatTimer = setInterval(() => send({ type: "daemon:heartbeat", activeSessionIds: [...activeSessions.keys()], queuedSessionIds: sessionQueue.queuedIds }), 30000);
 
           console.log(`  ${dim}Waiting for sessions...${reset}\n`);
         }
@@ -331,12 +360,13 @@ export async function runDaemon() {
         }
 
         if (msg.type === "daemon:start-session") {
-          handleStartSession(msg);
+          enqueueSession(msg);
         }
 
         if (msg.type === "daemon:cancel-session") {
           handleCancelSession(msg);
         }
+        if (msg.type === "daemon:workspace-request") handleWorkspaceRequest(msg);
       });
 
       ws.on("error", (err) => {
@@ -367,7 +397,7 @@ export async function runDaemon() {
 // terminal. Returns true if the user accepts. If stdin isn't a TTY (running
 // headless / no terminal), refuse — the safer default. Set
 // AGENTDESK_DAEMON_AUTO_ACCEPT=1 to skip this prompt for trusted automation.
-async function confirmIncomingSession({ project, taskId, prompt }) {
+async function confirmIncomingSession({ project, taskId, prompt, signal }) {
   if (!process.stdin.isTTY) {
     console.log("  Refusing server-pushed session: no terminal to confirm at. Set AGENTDESK_DAEMON_AUTO_ACCEPT=1 to allow.");
     return false;
@@ -379,14 +409,42 @@ async function confirmIncomingSession({ project, taskId, prompt }) {
   console.log(`  Prompt: ${promptPreview}${String(prompt || "").length > 240 ? "..." : ""}`);
   console.log("");
   const rl = createInterface({ input: process.stdin, output: process.stdout });
-  const answer = await new Promise(resolve => rl.question("  Approve this session? [y/N] ", resolve));
+  const close = () => rl.close();
+  signal.addEventListener("abort", close, { once: true });
+  const answer = await confirmWithAbort(() => new Promise(resolve => rl.question("  Approve this session? [y/N] ", resolve)), signal);
+  signal.removeEventListener("abort", close);
   rl.close();
   return /^y(es)?$/i.test(String(answer).trim());
 }
 
   // 4. Session handling
 
-  async function handleStartSession({ sessionId, projectId, taskId: remoteTaskId, prompt, screenshots: screenshotsOverride }) {
+  function handleWorkspaceRequest({ requestId, action, projectId, workspaceId, discard, confirmation }) {
+    try {
+      const projectPaths = projects.map(p => p.path);
+      let result;
+      if (action === "branches") {
+        const project = projects.find(p => p.id === projectId);
+        if (!project) throw new Error("Unknown project");
+        const { branches, currentBranch } = repositoryInfo(project.path);
+        result = { branches, currentBranch };
+      } else if (action === "list") {
+        result = listWorkspaces({ projectPaths }).map(record => {
+          if (record.archived && !record.removedAt) {
+            try { return cleanupWorkspace(record.id, { projectPaths }); } catch {}
+          }
+          return inspectWorkspace(record);
+        });
+      } else if (action === "cleanup" || action === "archive") {
+        result = cleanupWorkspace(workspaceId, { projectPaths, discard: discard === true, confirmation, archive: action === "archive" });
+      } else throw new Error("Unknown workspace action");
+      send({ type: "daemon:workspace-response", requestId, result });
+    } catch (error) {
+      send({ type: "daemon:workspace-response", requestId, error: error.message });
+    }
+  }
+
+  async function handleStartSession({ sessionId, projectId, taskId: remoteTaskId, prompt, screenshots: screenshotsOverride, workspace }) {
     // Validate project against local allowlist
     const project = projects.find(p => p.id === projectId);
     if (!project) {
@@ -401,23 +459,8 @@ async function confirmIncomingSession({ project, taskId, prompt }) {
     // command through to the victim machine without someone at the keyboard
     // saying yes. Opt out via AGENTDESK_DAEMON_AUTO_ACCEPT=1 for trusted
     // automation environments.
-    if (process.env.AGENTDESK_DAEMON_AUTO_ACCEPT !== "1") {
-      const accepted = await confirmIncomingSession({ project, taskId: remoteTaskId, prompt });
-      if (!accepted) {
-        console.log(`  ${yellow}Rejected by user:${reset} ${dim}${sessionId}${reset}`);
-        send({ type: "daemon:error", sessionId, error: "Session declined by daemon owner" });
-        return;
-      }
-    }
-
-    // Enforce max 1 concurrent session — set flag BEFORE any async work to prevent race
-    if (activeSession) {
-      console.log(`  ${red}Rejected:${reset} session already running ${dim}(${activeSession.sessionId})${reset}`);
-      send({ type: "daemon:error", sessionId, error: "Max concurrent sessions reached (1). Try again after the current session completes." });
-      return;
-    }
-    // Claim the slot immediately (before any await) to prevent race conditions
-    activeSession = {
+    if (activeSessions.has(sessionId)) return;
+    const activeSession = {
       sessionId, projectId,
       child: null,
       // Cancelling must stop the whole phase pipeline, not just the child that
@@ -427,6 +470,7 @@ async function confirmIncomingSession({ project, taskId, prompt }) {
       startedAt: Date.now(),
       filePathsTouched: new Set(),
     };
+    activeSessions.set(sessionId, activeSession);
 
     console.log(`  ${green}Starting session${reset} ${dim}${sessionId}${reset}`);
     console.log(`  Project: ${project.name} ${dim}(${project.path})${reset}`);
@@ -435,11 +479,20 @@ async function confirmIncomingSession({ project, taskId, prompt }) {
     const filePathsTouched = activeSession.filePathsTouched;
 
     try {
+      if (process.env.AGENTDESK_DAEMON_AUTO_ACCEPT !== "1") {
+        const approval = confirmationQueue.then(() => activeSession.cancelled ? false : confirmIncomingSession({ project, taskId: remoteTaskId, prompt, signal: activeSession.abort.signal }));
+        confirmationQueue = approval.catch(() => false);
+        const accepted = await approval;
+        if (activeSession.cancelled) return;
+        if (!accepted) throw new Error("Session declined by daemon owner");
+      }
+      if (activeSession.cancelled) return;
       // Load project config
       const detected = detectProject(project.path);
       const projectEnv = loadDotEnv(project.path);
       const projectApiKey = projectEnv.AGENTDESK_API_KEY || process.env.AGENTDESK_API_KEY || apiKey;
-      const config = await loadConfig(project.path, { apiKey: projectApiKey, serverUrl: agentdeskServer, projectName: project.name });
+      const config = await loadConfig(project.path, { apiKey: projectApiKey, serverUrl: agentdeskServer, projectName: projectId });
+      if (activeSession.cancelled) return;
       if (screenshotsOverride !== undefined) config.screenshots = screenshotsOverride;
       const tracker = config.tracker || null;
 
@@ -463,10 +516,12 @@ async function confirmIncomingSession({ project, taskId, prompt }) {
         description: prompt || "",
         createTask: !remoteTaskId && !!prompt && !!tracker,
         tracker, config,
-        project: detected, team,
+        project: { ...detected, name: projectId }, team,
+        projectId,
         sessionUrl,
         sessionId,
         cwd: project.path,
+        workspace,
         apiKey,
         serverUrl: agentdeskServer,
         abortSignal: sessionAbort.signal,
@@ -474,7 +529,7 @@ async function confirmIncomingSession({ project, taskId, prompt }) {
         // This was never wired: activeSession.child stayed null forever, so
         // every cancel reported "stopped" while Claude kept writing to the repo.
         onChild: (child) => {
-          if (activeSession?.sessionId === sessionId) activeSession.child = child;
+          activeSession.child = child;
         },
         onEvent: (() => {
           // Stagger agent messages for real-time feel, flush on non-message events
@@ -500,7 +555,10 @@ async function confirmIncomingSession({ project, taskId, prompt }) {
           }
 
           return (event) => {
-            if (!activeSession || activeSession.sessionId !== sessionId) return;
+            // Confirmed accomplishments may arrive during cancellation teardown.
+            // They do not revive the session or emit a second terminal event.
+            if (["session:outcome", "session:workspace"].includes(event.type)) { sendBuffered(sessionId, event); return; }
+            if (activeSessions.get(sessionId) !== activeSession) return;
             // A cancelled session already sent its terminal event; the
             // orchestrator's own unwind must not send a second one.
             if (activeSession.cancelled) return;
@@ -546,13 +604,13 @@ async function confirmIncomingSession({ project, taskId, prompt }) {
         filePathsTouched: [...filePathsTouched],
       });
 
-      activeSession = null;
-
     } catch (err) {
       console.log(`  ${red}Failed to start session:${reset} ${err.message}`);
+      if (activeSession.cancelled) return;
       // Send generic error to server — don't leak internal details (paths, config, etc.)
       send({ type: "daemon:error", sessionId, error: "Failed to start session on daemon" });
-      activeSession = null;
+    } finally {
+      if (activeSessions.get(sessionId) === activeSession) activeSessions.delete(sessionId);
     }
   }
 
@@ -566,46 +624,36 @@ async function confirmIncomingSession({ project, taskId, prompt }) {
   }
 
   function handleCancelSession({ sessionId }) {
-    if (activeSession?.sessionId === sessionId) {
+    if (sessionQueue.cancel(sessionId)) {
+      sendBuffered(sessionId, { type: "session:end", status: "stopped", duration: "0s" });
+      return;
+    }
+    const activeSession = activeSessions.get(sessionId);
+    if (activeSession) {
       console.log(`  ${yellow}Cancelling session${reset} ${dim}${sessionId}${reset}`);
       const duration = `${((Date.now() - activeSession.startedAt) / 1000).toFixed(1)}s`;
 
-      // Mark rather than clear. Nulling activeSession here would free the
-      // concurrency slot immediately — while the child is still inside its
-      // SIGTERM grace period — letting a second session start against the same
-      // working tree. The slot is released where it always was: after the
-      // orchestrator await unwinds, which cancellation now guarantees.
+      // Keep the workspace lease until the engine unwinds, including the
+      // child's SIGTERM grace period. Other worktrees may continue running.
       activeSession.cancelled = true;
       stopSessionWork(activeSession);
 
       // The `cancelled` flag also suppresses the orchestrator's own
       // session:end, so this stays the single terminal event for the session.
       sendBuffered(sessionId, { type: "session:end", duration, steps: 0, inputTokens: 0, outputTokens: 0, status: "stopped" });
-
-      // Safety valve: if the child somehow never dies, don't wedge the daemon
-      // into rejecting every future session.
-      const wedged = activeSession;
-      const timer = setTimeout(() => {
-        if (activeSession === wedged) {
-          console.log(`  ${red}Cancelled session did not exit — releasing slot${reset}`);
-          killTree(wedged.child, { graceMs: 0 });
-          activeSession = null;
-        }
-      }, 30000);
-      timer.unref?.();
     }
   }
 
   // 5. Graceful shutdown
 
   function shutdown() {
+    sessionQueue.close();
     console.log(`\n  ${dim}Shutting down...${reset}`);
     clearInterval(heartbeatTimer);
+    clearInterval(recoveryTimer);
     clearTimeout(reconnectTimer);
 
-    if (activeSession) {
-      stopSessionWork(activeSession);
-    }
+    for (const session of activeSessions.values()) stopSessionWork(session);
 
     send({ type: "daemon:disconnect" });
     try { ws?.close(); } catch {}

package/cli/engine/cancellation.mjs

@@ -0,0 +1,90 @@
+import { killTree } from "../proc.mjs";
+
+// A child can exit without `close` arriving (for example, inherited stdio may
+// remain open). Never depend on that event alone to release a cancelled lease.
+function forceStop(child) {
+  if (!child.pid) return child.exitCode != null || child.signalCode != null;
+  try { process.kill(-child.pid, "SIGKILL"); }
+  catch (error) { if (error.code !== "ESRCH") return false; }
+  // Kill the direct PID too, in case it was not in a detached process group.
+  let exited = child.exitCode != null || child.signalCode != null;
+  try { process.kill(child.pid, "SIGKILL"); }
+  catch (error) { if (error.code === "ESRCH") exited = true; else return false; }
+  // Delivery alone isn't proof of exit. Keep the lease until Node or the OS
+  // confirms teardown; permission errors must never unlock a live workspace.
+  if (!exited) return false;
+  try { process.kill(-child.pid, 0); return false; }
+  catch (error) { return error.code === "ESRCH"; }
+}
+
+// The SDK iterator may never settle after its process exits. Cancellation waits
+// for process teardown, not for that iterator, before releasing the workspace.
+export async function runCancellable(run, { signal, onChild, graceMs = 5000, timeoutMs = 30000, cleanup } = {}) {
+  const children = new Set();
+  let rejectAbort, timer, deadline, cancelled = false, timedOut = false, cleaned = false;
+  const clean = () => { if (!cleaned) { cleaned = true; cleanup?.(); } };
+  const aborted = new Promise((_, reject) => { rejectAbort = reject; });
+  const finishAbort = () => {
+    if (!cancelled || children.size) return;
+    clearTimeout(timer);
+    clearTimeout(deadline);
+    if (timedOut) { clean(); return; }
+    const error = new Error("Session cancelled"); error.name = "AbortError";
+    rejectAbort(error);
+  };
+  const track = child => {
+    children.add(child);
+    child.once("close", () => {
+      // Bash grandchildren may survive their direct parent. They share the
+      // detached process group and must stop before the workspace is reusable.
+      if (child.pid && !forceStop(child)) return;
+      children.delete(child); finishAbort();
+    });
+    onChild?.(child);
+    if (cancelled) killTree(child, { graceMs: 0 });
+  };
+  const abort = () => {
+    if (cancelled) return;
+    cancelled = true;
+    deadline = setTimeout(() => {
+      if (!children.size) return;
+      timedOut = true;
+      const error = new Error("Cancellation timed out; workspace quarantined until its processes exit.");
+      error.name = "CancellationTimeoutError";
+      rejectAbort(error);
+    }, timeoutMs);
+    for (const child of children) killTree(child, { graceMs });
+    const watchdog = () => {
+      for (const child of children) {
+        if (!forceStop(child)) continue;
+        children.delete(child);
+        for (const stream of child.stdio || []) stream?.destroy?.();
+      }
+      finishAbort();
+      if (children.size) {
+        timer = setTimeout(watchdog, timedOut ? 1000 : 50);
+        if (timedOut) timer.unref?.();
+      }
+    };
+    timer = setTimeout(watchdog, graceMs);
+    finishAbort();
+  };
+  signal?.addEventListener("abort", abort, { once: true });
+  try {
+    if (signal?.aborted) { abort(); return await aborted; }
+    const running = Promise.resolve().then(() => {
+      signal?.throwIfAborted();
+      return run(track);
+    }).then(result => cancelled ? aborted : result, error => {
+      if (cancelled) return aborted;
+      throw error;
+    });
+    return await Promise.race([running, aborted]);
+  } finally {
+    if (timedOut) timer?.unref?.();
+    else clearTimeout(timer);
+    clearTimeout(deadline);
+    signal?.removeEventListener("abort", abort);
+    if (!timedOut) clean();
+  }
+}

package/cli/engine/env.mjs

@@ -25,6 +25,9 @@ export const PARENT_SESSION_VARS = Object.freeze([
   "CLAUDE_CODE_SESSION_ID",
   "CLAUDE_PID",
   "CLAUDE_EFFORT",
+  // A session must resolve Git against its own cwd, not an inherited repository/index.
+  "GIT_DIR", "GIT_WORK_TREE", "GIT_COMMON_DIR", "GIT_INDEX_FILE",
+  "GIT_OBJECT_DIRECTORY", "GIT_ALTERNATE_OBJECT_DIRECTORIES",
 ]);
 
 // Hard caps on what a session may spawn. Depth 1: our subagents may not spawn

package/cli/engine/hooks.mjs

@@ -105,7 +105,8 @@ export function hooksForPhase({ phase, state, onToolUse, onToolResult, onSubagen
     }],
     PostToolUse: [{
       hooks: [async (input) => {
-        onToolResult?.({ agentType: input.agent_type || null, tool: input.tool_name, response: input.tool_response });
+        await onToolResult?.({ agentType: input.agent_type || null, tool: input.tool_name,
+          input: input.tool_input, actionId: input.tool_use_id, response: input.tool_response });
         return {};
       }],
     }],