@kendoo.agentdesk/agentdesk 0.28.3 → 0.28.4

package/cli/engine/outcome.mjs

@@ -0,0 +1,115 @@
+import { execFileSync } from "node:child_process";
+import { normalizeOutcome } from "../../shared/outcomes.mjs";
+
+export function githubRepository(cwd) {
+  try {
+    const remote = execFileSync("git", ["config", "--get", "remote.origin.url"], { cwd, encoding: "utf8", timeout: 3000, stdio: ["ignore", "pipe", "ignore"] }).trim();
+    return remote.match(/^(?:https:\/\/github\.com\/|git@github\.com:)([\w.-]+\/[\w.-]+?)(?:\.git)?$/)?.[1] || null;
+  } catch { return null; }
+}
+
+export const replyMarker = sessionId => `[AgentDesk reply:${sessionId}]`;
+
+export function currentBranch(cwd) {
+  try { return execFileSync("git", ["symbolic-ref", "--short", "HEAD"], { cwd, encoding: "utf8", timeout: 3000, stdio: ["ignore", "pipe", "ignore"] }).trim(); }
+  catch { return null; }
+}
+
+// Recognize single, literal commands only. Never execute/expand shell text.
+// Pipelines, substitutions, redirects, command chains and file payloads are
+// intentionally unsupported rather than guessed at.
+export function commandWords(command) {
+  if (typeof command !== "string") return null;
+  const words = []; let word = "", quote = null, started = false;
+  for (let i = 0; i < String(command).length; i++) {
+    const ch = command[i];
+    if (quote === "'") { if (ch === "'") quote = null; else word += ch; started = true; continue; }
+    if (ch === "`" || (ch === "$" && command[i + 1] === "(")) return null;
+    if (ch === "\\") { if (i + 1 >= command.length) return null; word += command[++i]; started = true; continue; }
+    if (quote === '"') { if (ch === '"') quote = null; else word += ch; started = true; continue; }
+    if (ch === "'" || ch === '"') { quote = ch; started = true; continue; }
+    if (/[;&|<>\n\r()]/.test(ch)) return null;
+    if (/\s/.test(ch)) { if (started) words.push(word); word = ""; started = false; }
+    else { word += ch; started = true; }
+  }
+  if (quote) return null;
+  if (started) words.push(word);
+  return words;
+}
+
+function flags(words, valued, switches = []) {
+  const values = {};
+  for (let i = 0; i < words.length; i++) {
+    const flag = words[i];
+    if (switches.includes(flag)) continue;
+    const key = valued[flag];
+    if (!key || i + 1 >= words.length || (values[key] !== undefined && key !== "header")) return null;
+    values[key] = words[++i];
+  }
+  return values;
+}
+
+export function captureOutcome({ tool, input, response, actionId, phase, sessionId, taskId, repo, branch, tracker, config = {}, observedAt = Date.now() }) {
+  try {
+    return captureReceipt({ tool, input, response, actionId, phase, sessionId, taskId, repo, branch, tracker, config, observedAt });
+  } catch {
+    // Optional reporting must never turn a tool result into a hook failure.
+    return null;
+  }
+}
+
+function captureReceipt({ tool, input, response, actionId, phase, sessionId, taskId, repo, branch, tracker, config, observedAt }) {
+  if (tool !== "Bash" || !actionId || !sessionId || !response || response.interrupted || response.is_error ||
+      (response.exitCode != null && response.exitCode !== 0)) return null;
+  const words = commandWords(input?.command);
+  if (!words) return null;
+  const stdout = typeof response.stdout === "string" ? response.stdout.trim() : "";
+  const common = { actionId, taskId: String(taskId || ""), observedAt, branch };
+  const marker = replyMarker(sessionId);
+  if (words.slice(0, 3).join(" ") === "gh pr create") {
+    const opts = flags(words.slice(3), { "--repo": "repo", "-R": "repo", "--head": "head", "-H": "head", "--base": "base", "-B": "base", "--title": "title", "-t": "title", "--body": "body", "-b": "body", "--body-file": "file", "-F": "file" }, ["--draft", "-d", "--fill", "--fill-first", "--fill-verbose"]);
+    if (!opts || !repo || opts.repo !== repo || !branch || opts.head !== branch) return null;
+    const id = stdout.match(/^https:\/\/github\.com\/[\w.-]+\/[\w.-]+\/pull\/(\d+)$/)?.[1];
+    return normalizeOutcome({ ...common, kind: "pr_created", provider: "github", container: repo, externalId: id, url: stdout });
+  }
+  if (!["SUMMARY", "SOLO"].includes(phase)) return null;
+  if (tracker === "github" && words.slice(0, 3).join(" ") === "gh issue comment" && words[3] === String(taskId)) {
+    const opts = flags(words.slice(4), { "--repo": "repo", "-R": "repo", "--body": "body", "-b": "body" });
+    if (!opts || !repo || opts.repo !== repo || !opts.body?.includes(marker)) return null;
+    const id = stdout.match(/#issuecomment-(\d+)$/)?.[1];
+    return normalizeOutcome({ ...common, kind: "replied", provider: "github", container: repo, externalId: id, url: stdout });
+  }
+  if (words[0] !== "curl") return null;
+  const urls = words.slice(1).filter(word => /^https:\/\//.test(word));
+  if (urls.length !== 1) return null;
+  const opts = flags(words.slice(1).filter(word => word !== urls[0]), {
+    "-X": "method", "--request": "method", "-H": "header", "--header": "header", "-u": "auth", "--user": "auth",
+    "--data-raw": "data", "--data": "data", "-d": "data",
+  }, ["-s", "-S", "-sS", "-fsS", "-f", "--silent", "--show-error", "--fail", "--fail-with-body"]);
+  if (!opts || (opts.method && opts.method !== "POST") || !opts.data || opts.data.startsWith("@")) return null;
+  let payload, result;
+  try { payload = JSON.parse(opts.data); result = JSON.parse(stdout); } catch { return null; }
+  if (!payload || typeof payload !== "object" || Array.isArray(payload) ||
+      !result || typeof result !== "object" || Array.isArray(result)) return null;
+  if (result.errors || result.errorMessages || result.error) return null;
+  if (tracker === "jira") {
+    let origin;
+    try { origin = new URL(config.jira?.baseUrl).origin; } catch { return null; }
+    if (urls[0] !== `${origin}/rest/api/3/issue/${taskId}/comment` || !JSON.stringify(payload.body || {}).includes(marker) ||
+        !JSON.stringify(result.body || {}).includes(marker) || !result.id ||
+        typeof result.self !== "string" || !result.self.startsWith(`${origin}/rest/api/3/issue/`) ||
+        !result.self.endsWith(`/comment/${result.id}`)) return null;
+    return normalizeOutcome({ ...common, kind: "replied", provider: "jira", container: origin, externalId: String(result.id), url: `${origin}/browse/${taskId}?focusedCommentId=${result.id}` });
+  }
+  if (tracker === "linear" && urls[0] === "https://api.linear.app/graphql") {
+    const receipt = result.data?.commentCreate;
+    const comment = receipt?.comment;
+    if (receipt?.success !== true || !comment?.id || comment.issue?.identifier !== taskId ||
+        typeof comment.body !== "string" || !comment.body.includes(marker) || !JSON.stringify(payload).includes(marker) ||
+        typeof payload.query !== "string" || !/^\s*mutation\b/.test(payload.query) || !/\bcommentCreate\s*\(/.test(payload.query)) return null;
+    let url;
+    try { url = new URL(comment.url); } catch { return null; }
+    return normalizeOutcome({ ...common, kind: "replied", provider: "linear", container: url.pathname.split("/")[1], externalId: comment.id, url: comment.url });
+  }
+  return null;
+}

package/cli/engine/query.mjs

@@ -34,6 +34,7 @@ export function maxTurnsFor(phase, config = {}) {
 export function buildQueryOptions({
   phase, cwd, env, model, agents, allowedTools, lead, state, config = {},
   abortController, sandbox, onChild, onIsolation, hookCallbacks = {},
+  extraWritePaths = [],
   claudePath = process.env.AGENTDESK_CLAUDE_PATH,
 }) {
   const options = {
@@ -50,7 +51,7 @@ export function buildQueryOptions({
     forwardSubagentText: true,
     outputFormat: { type: "json_schema", schema: PHASE_OUTPUT_SCHEMAS[phase] },
     hooks: hooksForPhase({ phase, state, ...hookCallbacks }),
-    spawnClaudeCodeProcess: createSandboxedSpawn({ sandbox, onChild, onIsolation }),
+    spawnClaudeCodeProcess: createSandboxedSpawn({ sandbox, onChild, onIsolation, extraWritePaths }),
   };
   if (model) options.model = model;
   if (Number(config.maxBudgetUsd) > 0) options.maxBudgetUsd = Number(config.maxBudgetUsd);

package/cli/engine/session.mjs

@@ -23,12 +23,17 @@ import { buildChildEnv } from "./env.mjs";
 import { loadDotEnv } from "../dotenv.mjs";
 import { checkClaudeAuth } from "./claude-auth.mjs";
 import { createEventMapper, timestamp } from "./events.mjs";
+import { captureOutcome, githubRepository, currentBranch, replyMarker } from "./outcome.mjs";
 import { agentsForPhase, modelForPhase, soloDefinition } from "./agents/index.mjs";
 import { renderPhasePrompt, renderSoloPrompt } from "./prompts.mjs";
 import { renderMemorySection } from "./schemas.mjs";
 import { verdictFromResult } from "./verdict.mjs";
 import { buildQueryOptions, defaultRunQuery } from "./query.mjs";
 import { armPublishGate, onSubagentStopped } from "./hooks.mjs";
+import { prepareWorkspace } from "../worktrees.mjs";
+import { detectProject } from "../detect.mjs";
+import { preparePrivateGit } from "../worktree-git.mjs";
+import { runCancellable } from "./cancellation.mjs";
 
 const here = dirname(fileURLToPath(import.meta.url));
 const CLI_VERSION = JSON.parse(readFileSync(join(here, "../../package.json"), "utf-8")).version;
@@ -46,7 +51,7 @@ async function fetchTrackerCredentials(projectName, apiKey, serverUrl) {
   return {};
 }
 
-function writeResumeFile({ cwd, taskId, sessionUrl, phase, duration, steps }) {
+function writeResumeFile({ cwd, taskId, sessionUrl, phase, duration, steps, workspaceId }) {
   let branch = "", diffStat = "";
   try { branch = execSync("git branch --show-current", { cwd, encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }).trim(); } catch {}
   try { diffStat = execSync("git diff --stat HEAD", { cwd, encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }).trim(); } catch {}
@@ -58,7 +63,7 @@ function writeResumeFile({ cwd, taskId, sessionUrl, phase, duration, steps }) {
       `Duration: ${duration}`, `Steps: ${steps}`,
       ``, `## Branch`, branch || "(none)",
       ``, `## Uncommitted changes`, diffStat || "(none)",
-      ``, `## Notes`, `Session interrupted during ${phase}.`, `Resume with: agentdesk team ${taskId}`,
+      ``, `## Notes`, `Session interrupted during ${phase}.`, `Resume from the original project directory with: agentdesk team ${taskId}${workspaceId ? ` --resume-worktree ${workspaceId}` : " --no-worktree"}`,
       ``,
     ].join("\n"));
   } catch {}
@@ -68,16 +73,77 @@ function seconds(startedAt) {
   return `${((Date.now() - startedAt) / 1000).toFixed(1)}s`;
 }
 
-export async function runSession({
+export async function runSession(options) {
+  const sourceCwd = options.cwd;
+  const workspace = prepareWorkspace({ cwd: sourceCwd, sessionId: options.sessionId,
+    projectId: options.projectId || options.config?.projectKey || options.project?.name, taskId: options.taskId,
+    workspace: options.workspace, root: options.workspaceRoot });
+  let privateGit;
+  let cleanup;
+  let quarantined = false;
+  let result;
+  try {
+    if (workspace.record) privateGit = preparePrivateGit(workspace.record, workspace.stateDir);
+    options.onWorkspace?.(workspace.record);
+    if (workspace.record) console.error(`[agentdesk] worktree: ${workspace.cwd} (${workspace.record.branch})`);
+    result = await runCancellable(onChild => executeSession({ ...options, onChild, registerCleanup: fn => { cleanup = fn; }, cwd: workspace.cwd, sourceCwd,
+      project: workspace.record ? { ...detectProject(workspace.cwd), name: options.project?.name } : options.project,
+      workspaceRecord: workspace.record, workspaceStateDir: workspace.stateDir,
+      workspaceGitEnv: privateGit?.env,
+      resumingWorkspace: !!options.workspace?.resumeId }), {
+      signal: options.abortSignal,
+      timeoutMs: options.cancellationTimeoutMs,
+      onChild: child => { workspace.trackChild(child); options.onChild?.(child); },
+      cleanup: () => cleanup?.(),
+    });
+    return result;
+  } catch (error) {
+    if (error.name !== "AbortError" && error.name !== "CancellationTimeoutError") throw error;
+    if (error.name === "CancellationTimeoutError") {
+      // Do not publish Git state or release the lease while a writer may live.
+      // Persisted child PIDs let startup/periodic recovery clear it safely later.
+      quarantined = true;
+      workspace.quarantine();
+      console.error(`[agentdesk] ${error.message}`);
+    }
+    result = { status: "stopped", aborted: true, ...(quarantined && { quarantined: true }), duration: "0s", steps: 0, inputTokens: 0, outputTokens: 0 };
+    options.onEvent?.({ type: "session:end", ...result });
+    return result;
+  } finally {
+    // A clean SDK return does not prove that its detached process group exited.
+    if (!quarantined && workspace.hasLiveChildren()) {
+      quarantined = true;
+      workspace.quarantine();
+    }
+    if (quarantined) {
+      if (result) result.quarantined = true;
+      options.onEvent?.({ type: "session:workspace", quarantined: true });
+    }
+    if (!quarantined) {
+      try { privateGit?.publish(); }
+      finally { workspace.release(); }
+    }
+  }
+}
+
+async function executeSession({
   taskId, taskLink, description, createTask, tracker, config = {},
   project, team, sessionUrl, cwd,
   onEvent, apiKey, serverUrl, sessionId, onChild, abortSignal,
   soloAgent = null, childStrategy = null,
   runQuery = defaultRunQuery,
   authCheck = checkClaudeAuth,
+  sourceCwd = cwd, workspaceRecord, workspaceStateDir, resumingWorkspace = false,
+  workspaceGitEnv = {},
+  registerCleanup,
 }) {
   const startedAt = Date.now();
-  const emit = event => onEvent?.({ ...event, timestamp: timestamp() });
+  const emit = event => {
+    if (event.type === "session:update" && event.taskId) taskId = event.taskId;
+    onEvent?.({ ...event, timestamp: timestamp() });
+  };
+  const outcomeIds = new Set();
+  const outcomeRepo = githubRepository(sourceCwd || cwd);
 
   // Solo mode: one agent, one phase, full tools, no lead and no review gate.
   const solo = soloAgent ? team.find(a => a.name === soloAgent) : null;
@@ -92,11 +158,14 @@ export async function runSession({
     sessionNumber: 1,
     agents: teamNames,
     cliVersion: CLI_VERSION,
+    branch: workspaceRecord?.branch || null,
+    workspace: workspaceRecord ? { id: workspaceRecord.id, branch: workspaceRecord.branch, baseBranch: workspaceRecord.baseRef.replace(/^refs\/(heads|remotes)\//, "") } : null,
   });
 
   // --- credentials + preflight (before any sandbox or child) ---------------
   const trackerCreds = await fetchTrackerCredentials(project?.name, apiKey, serverUrl);
-  const resolvedToken = resolveGitHubCreds({ cwd, trackerCreds }).GITHUB_TOKEN;
+  abortSignal?.throwIfAborted();
+  const resolvedToken = resolveGitHubCreds({ cwd: sourceCwd, trackerCreds }).GITHUB_TOKEN;
   const creds = { ...trackerCreds, GITHUB_TOKEN: resolvedToken || trackerCreds.GITHUB_TOKEN };
 
   const failStart = (code, message) => {
@@ -115,8 +184,9 @@ export async function runSession({
   // Claude itself must be able to authenticate as a standalone process, with
   // the environment the child will actually get. Checked before the sandbox
   // exists so a missing login is one clear message, not a crashed phase.
-  const dotenv = loadDotEnv(cwd);
+  const dotenv = { ...loadDotEnv(sourceCwd), ...loadDotEnv(cwd) };
   const auth = await authCheck({ env: buildChildEnv({ dotenv }) });
+  abortSignal?.throwIfAborted();
   if (!auth.ok) return failStart("CLAUDE_NOT_LOGGED_IN", `${auth.detail}.\n${auth.hint || ""}`.trim());
 
   const sandbox = createScratchHome({
@@ -128,6 +198,7 @@ export async function runSession({
       email: creds.JIRA_EMAIL || "agentdesk@local",
     },
   });
+  registerCleanup?.(() => sandbox.cleanup());
 
   const abortController = new AbortController();
   const onExternalAbort = () => abortController.abort();
@@ -135,13 +206,17 @@ export async function runSession({
   else abortSignal?.addEventListener("abort", onExternalAbort, { once: true });
 
   // --- session memory (engine-owned) ---------------------------------------
-  const stateDir = join(cwd, ".agentdesk");
+  const stateDir = workspaceStateDir || join(cwd, ".agentdesk");
   const memoryPath = join(stateDir, "session-memory.md");
   const findingsPath = join(stateDir, "review-findings.json");
   try { mkdirSync(stateDir, { recursive: true }); } catch {}
-  if (archiveStaleMemory(memoryPath)) console.error("[agentdesk] archived stale session-memory.md from a previous run");
-  try { if (existsSync(findingsPath)) unlinkSync(findingsPath); } catch {}
-  writeFileSync(memoryPath, `# Session Memory\n\n## Task\n- ID: ${taskId}\n${taskLink ? `- Link: ${taskLink}\n` : ""}\n`);
+  if (!resumingWorkspace || !existsSync(memoryPath)) {
+    if (archiveStaleMemory(memoryPath)) console.error("[agentdesk] archived stale session-memory.md from a previous run");
+    try { if (existsSync(findingsPath)) unlinkSync(findingsPath); } catch {}
+    writeFileSync(memoryPath, `# Session Memory\n\n## Task\n- ID: ${taskId}\n${taskLink ? `- Link: ${taskLink}\n` : ""}\n`);
+  } else {
+    appendFileSync(memoryPath, `\n## Resumed session\n${sessionUrl || sessionId}\n`);
+  }
   const memoryText = () => { try { return readFileSync(memoryPath, "utf-8").trim(); } catch { return ""; } };
   const appendMemory = text => { try { appendFileSync(memoryPath, `\n${text}`); } catch {} };
 
@@ -170,7 +245,7 @@ export async function runSession({
       const { agents, allowedTools, lead } = solo
         ? soloDefinition(solo)
         : agentsForPhase({ phase, team, phaseModels: config.phaseModels });
-      const prompt = solo
+      let prompt = solo
         ? renderSoloPrompt({ agent: solo, taskId, taskLink, description, tracker, config, project, sessionUrl, cwd, childStrategy })
         : renderPhasePrompt({
           phase, taskId, taskLink, description,
@@ -179,15 +254,31 @@ export async function runSession({
           sessionMemory: memoryText(),
           retryVerdict: phase === "EXECUTION" && lastVerdict && lastVerdict.outcome !== "APPROVED" ? lastVerdict : null,
         });
+      if (workspaceRecord) {
+        prompt += `\n\n## SESSION WORKSPACE\nAll file reads, writes, shell commands and Git operations must use ${cwd}.\nThe session branch ${workspaceRecord.branch} is already checked out; use it instead of creating or switching branches. The starting branch is ${workspaceRecord.baseRef}. Keep this branch until the session ends. Runtime session memory lives at ${memoryPath}.\n`;
+      }
+      prompt += `\n\n## Confirmed session outcomes\nWhen creating a PR, use a standalone gh pr create command with explicit --repo ${outcomeRepo || "OWNER/REPO"} and --head ${workspaceRecord?.branch || "BRANCH"}. Do not chain it with other commands; preserve its stdout so the harness can confirm creation. Never create another PR just to record an outcome.\n`;
+      if (["SUMMARY", "SOLO"].includes(phase)) {
+        prompt += `For the final substantive tracker reply only, include the literal marker ${replyMarker(sessionId)} in the posted comment. Never mark startup/progress comments. Keep the successful provider response intact (no jq, redirects or pipelines). For GitHub use standalone gh issue comment ${taskId} --repo ${outcomeRepo || "OWNER/REPO"} --body with a literal body. For Jira use standalone curl with a literal JSON --data-raw payload and the task's comment endpoint. For Linear use standalone curl with a literal JSON --data-raw payload and a commentCreate mutation selecting success and comment { id url body issue { identifier } }. Do not post an extra reply just to record an outcome.\n`;
+      }
 
       // Publishing is gated until Sam has audited in this EXECUTION phase.
       if (phase === "EXECUTION") armPublishGate(state, lastVerdict?.outcome === "APPROVED" ? [] : (lastVerdict?.findings || []));
 
       const mapper = createEventMapper({ leadAgent: lead, onEvent: emit });
       const options = buildQueryOptions({
-        phase, cwd, env: buildChildEnv({ dotenv, sandboxEnv: sandbox.env }), model,
+        phase, cwd, env: buildChildEnv({ dotenv, sandboxEnv: sandbox.env, extra: workspaceGitEnv }), model,
         agents, allowedTools, lead, state, config, abortController, sandbox, onChild,
+        extraWritePaths: workspaceStateDir ? [workspaceStateDir, workspaceRecord.tree || cwd] : [],
         hookCallbacks: {
+          onToolResult: result => {
+            const outcome = captureOutcome({ ...result, phase, sessionId, taskId, repo: outcomeRepo,
+              branch: workspaceRecord?.branch || (result.tool === "Bash" && /^gh\s+pr\s+create\b/.test(result.input?.command || "") ? currentBranch(cwd) : null), tracker, config });
+            if (outcome && !outcomeIds.has(outcome.id)) {
+              outcomeIds.add(outcome.id);
+              emit({ type: "session:outcome", project: project?.name || null, outcome });
+            }
+          },
           onSubagentStop: ({ agentType }) => {
             onSubagentStopped(state, { phase, agentType });
             if (agentType) emit({ type: "agent:message", agent: agentType, tag: "SAY", message: `${agentType} finished and reported back.` });
@@ -221,7 +312,7 @@ export async function runSession({
         const detail = thrown?.message || summary.subtype || "error";
         emit({ type: "session:error", code: "PHASE_FAILED", message: `${phase} failed (${detail}) — session incomplete.` });
         handoff = true;
-        writeResumeFile({ cwd, taskId, sessionUrl, phase, duration: seconds(startedAt), steps: totals.steps });
+        writeResumeFile({ cwd, taskId, sessionUrl, phase, duration: seconds(startedAt), steps: totals.steps, workspaceId: workspaceRecord?.id });
         break;
       }
 

package/cli/engine/spawn.mjs

@@ -16,9 +16,10 @@
 
 import { spawn } from "child_process";
 import { createRequire } from "node:module";
-import { dirname } from "path";
+import { dirname, join } from "path";
 import { wrapIsolatedSpawn } from "../session-isolation.mjs";
 import { killTree, trackChild, installExitGuards } from "../proc.mjs";
+import { workspaceGitPaths } from "../worktrees.mjs";
 
 // Resolve the directory the SDK's bundled Claude binary lives in so the strict
 // sandbox can expose it read-only. The SDK resolves the platform package
@@ -40,18 +41,22 @@ export function bundledClaudeDir() {
 //   onChild      — daemon/team hook so cancel can reach the live process
 //   extraReadPaths — additional read-only paths for the strict sandbox
 //   onIsolation  — called once with the isolation descriptor (for logging)
-export function createSandboxedSpawn({ sandbox, onChild, extraReadPaths = [], onIsolation } = {}) {
+export function createSandboxedSpawn({ sandbox, onChild, extraReadPaths = [], extraWritePaths = [], onIsolation } = {}) {
   installExitGuards();
   let reported = false;
 
   return function spawnClaudeCodeProcess(opts) {
+    const sharedGit = workspaceGitPaths(opts.cwd);
     const wrapped = wrapIsolatedSpawn({
       cmd: opts.command,
       args: opts.args,
       cwd: opts.cwd,
       scratchHome: sandbox.home,
-      extraReadPaths: [bundledClaudeDir(), ...extraReadPaths].filter(Boolean),
+      extraReadPaths: [bundledClaudeDir(), ...sharedGit, ...extraReadPaths].filter(Boolean),
+      extraWritePaths,
+      protectedPaths: sharedGit.length ? [...sharedGit, join(opts.env.GIT_WORK_TREE || opts.cwd, ".git"), ...(opts.env.GIT_DIR ? [join(dirname(opts.env.GIT_DIR), "..", "git-pending")] : [])] : [],
     });
+    if (sharedGit.length && wrapped.isolation.policy !== "strict") throw new Error("Worktree sessions require strict kernel isolation; shared Git metadata cannot be exposed writable.");
 
     if (!reported) {
       reported = true;

package/cli/session-isolation.mjs

@@ -70,7 +70,7 @@ function legacyMode() {
 // policy. The engine passes the Agent SDK's bundled Claude binary here — it
 // lives under an npm prefix (global or the project's node_modules), which the
 // deny-default allowlist does not necessarily cover.
-export function wrapIsolatedSpawn({ cmd, args, cwd, scratchHome, extraReadPaths = [] }) {
+export function wrapIsolatedSpawn({ cmd, args, cwd, scratchHome, extraReadPaths = [], extraWritePaths = [], protectedPaths = [] }) {
   const probe = probeIsolation();
   if (probe.kind === "none") {
     return { cmd, args, isolation: { kind: "none", reason: probe.reason } };
@@ -82,7 +82,7 @@ export function wrapIsolatedSpawn({ cmd, args, cwd, scratchHome, extraReadPaths
     const profilePath = join(scratchHome, "sandbox.sb");
     const profile = policyKind === "legacy"
       ? macosProfileLegacy({ cwd, scratchHome })
-      : macosProfileStrict({ cwd, scratchHome, extraReadPaths });
+      : macosProfileStrict({ cwd, scratchHome, extraReadPaths, extraWritePaths, protectedPaths });
     writeFileSync(profilePath, profile, { mode: 0o600 });
     return {
       cmd: "sandbox-exec",
@@ -94,7 +94,7 @@ export function wrapIsolatedSpawn({ cmd, args, cwd, scratchHome, extraReadPaths
   if (probe.kind === "bwrap") {
     const bwrap = policyKind === "legacy"
       ? bwrapArgsLegacy({ cwd, scratchHome })
-      : bwrapArgsStrict({ cwd, scratchHome, extraReadPaths });
+      : bwrapArgsStrict({ cwd, scratchHome, extraReadPaths, extraWritePaths, protectedPaths });
     return {
       cmd: "bwrap",
       args: [...bwrap, cmd, ...args],
@@ -115,7 +115,7 @@ function sbString(s) {
 // paths and capabilities legitimate tools need. Anything under $HOME that
 // isn't explicitly allowed is unreadable — that includes ~/Documents,
 // browser cookie stores, other projects' .env files, etc.
-function macosProfileStrict({ cwd, scratchHome, extraReadPaths = [] }) {
+function macosProfileStrict({ cwd, scratchHome, extraReadPaths = [], extraWritePaths = [], protectedPaths = [] }) {
   const home = homedir();
 
   // AD-65: Claude walks up from cwd (git root, CLAUDE.md, project lookups) and
@@ -165,6 +165,7 @@ function macosProfileStrict({ cwd, scratchHome, extraReadPaths = [] }) {
     `; Project cwd + scratch HOME — full read/write.`,
     `(allow file-read* file-write* (subpath ${sbString(cwd)}))`,
     `(allow file-read* file-write* (subpath ${sbString(scratchHome)}))`,
+    ...extraWritePaths.map(p => `(allow file-read* file-write* (subpath ${sbString(p)}))`),
     ``,
     `; Root directory + top-level symlinks (/etc → /private/etc, /var, /tmp).`,
     `; dyld stats "/" during process startup on modern macOS; denying it aborts`,
@@ -227,6 +228,7 @@ function macosProfileStrict({ cwd, scratchHome, extraReadPaths = [] }) {
     ``,
     `; Caller-supplied read-only paths (e.g. the Agent SDK's bundled Claude binary).`,
     ...extraReadPaths.filter(Boolean).map(p => `(allow file-read* (subpath ${sbString(p)}))`),
+    ...protectedPaths.map(p => `(deny file-write* (subpath ${sbString(p)}))`),
     ``,
   ].join("\n");
 }
@@ -273,7 +275,7 @@ function macosProfileLegacy() {
 // AD-30 strict allowlist via bwrap. Read-only binds for system paths, --tmpfs
 // over $HOME so nothing on the user's home directory is visible by default,
 // then re-expose specific tool dirs that exist as read-only binds.
-function bwrapArgsStrict({ cwd, scratchHome, extraReadPaths = [] }) {
+function bwrapArgsStrict({ cwd, scratchHome, extraReadPaths = [], extraWritePaths = [], protectedPaths = [] }) {
   const home = homedir();
   const args = [
     "--die-with-parent",
@@ -328,6 +330,9 @@ function bwrapArgsStrict({ cwd, scratchHome, extraReadPaths = [] }) {
   for (const p of extraReadPaths.filter(Boolean)) {
     args.push("--ro-bind-try", p, p);
   }
+  for (const p of extraWritePaths) args.push("--bind", p, p);
+  // Last mount wins, including when the repository lives under writable /tmp.
+  for (const p of protectedPaths) args.push("--ro-bind", p, p);
 
   return args;
 }

package/cli/session-queue.mjs

@@ -0,0 +1,57 @@
+export function sessionLimit(value = process.env.AGENTDESK_MAX_SESSIONS) {
+  if (value === undefined || value === "") return 3;
+  const limit = Number(value);
+  if (!Number.isInteger(limit) || limit < 1 || limit > 32) throw new Error("AGENTDESK_MAX_SESSIONS must be an integer from 1 to 32");
+  return limit;
+}
+
+// Capacity belongs to the daemon, not the network connection or UI status.
+// Hold reservations through confirmation, cancellation and engine teardown.
+export function createSessionQueue({ limit = sessionLimit(), run, onQueued = () => {}, onError = () => {} }) {
+  const active = new Map();
+  const waiting = [];
+  let closed = false;
+  function drain() {
+    if (closed) return;
+    while (active.size < limit) {
+      const index = waiting.findIndex(job => !job.key || ![...active.values()].some(other => other.key === job.key));
+      if (index < 0) break;
+      const job = waiting.splice(index, 1)[0];
+      active.set(job.sessionId, job);
+      Promise.resolve().then(() => run(job)).catch(error => onError(job, error)).finally(() => {
+        active.delete(job.sessionId);
+        drain();
+      });
+    }
+  }
+  return {
+    enqueue(job) {
+      if (closed) throw new Error("Daemon is shutting down");
+      if (active.has(job.sessionId) || waiting.some(other => other.sessionId === job.sessionId)) return;
+      if (waiting.length >= 100) throw new Error("Daemon queue is full (100 waiting sessions)");
+      waiting.push(job);
+      drain();
+      if (!active.has(job.sessionId)) onQueued(job);
+    },
+    cancel(sessionId) {
+      const index = waiting.findIndex(job => job.sessionId === sessionId);
+      if (index < 0) return false;
+      waiting.splice(index, 1);
+      return true;
+    },
+    get activeIds() { return [...active.keys()]; },
+    get queuedIds() { return waiting.map(job => job.sessionId); },
+    close() { closed = true; waiting.length = 0; },
+  };
+}
+
+// Abort settles the confirmation even if the input source never responds.
+export function confirmWithAbort(ask, signal) {
+  if (signal.aborted) return Promise.resolve(false);
+  return new Promise((resolve, reject) => {
+    const abort = () => resolve(false);
+    signal.addEventListener("abort", abort, { once: true });
+    Promise.resolve().then(() => signal.aborted ? false : ask()).then(resolve, reject)
+      .finally(() => signal.removeEventListener("abort", abort));
+  });
+}

package/cli/team.mjs

@@ -203,11 +203,14 @@ export async function runTeam(taskId, opts = {}) {
   process.on("SIGINT", onSigint);
 
   let result;
+  let workspaceId = null;
   try {
     result = await runSession({
       taskId, taskLink, description, createTask, tracker, config,
       project, team, sessionUrl, cwd,
       sessionId,
+      workspace: opts.workspace,
+      onWorkspace: record => { workspaceId = record?.id || null; },
       onEvent: vizSend,
       apiKey,
       serverUrl: agentdeskServer,
@@ -215,11 +218,16 @@ export async function runTeam(taskId, opts = {}) {
       childStrategy: opts.childStrategy || null,
       abortSignal: abort.signal,
     });
+  } catch (error) {
+    console.error(`Session could not start: ${error.message}`);
+    result = { error: error.message, duration: "0s", steps: 0, inputTokens: 0, outputTokens: 0 };
   } finally {
     process.removeListener("SIGINT", onSigint);
     clearInterval(heartbeatInterval);
   }
 
+  const resumeCommand = `agentdesk team ${taskId}${workspaceId ? ` --resume-worktree ${workspaceId}` : " --no-worktree"}`;
+
   if (result.error) {
     const red = "\x1b[31m";
     console.log(`\n━━━ ${red}SESSION COULD NOT START${reset} ━━━`);
@@ -227,8 +235,8 @@ export async function runTeam(taskId, opts = {}) {
   } else if (result.aborted) {
     const yellow = "\x1b[33m";
     console.log(`\n━━━ ${yellow}STOPPED${reset} ━━━`);
-    console.log(`  Cancelled — Claude terminated.`);
-    console.log(`  Resume with: ${cyan}agentdesk team ${taskId}${reset}\n`);
+    console.log(result.quarantined ? "  Cancelled — workspace quarantined until remaining processes exit." : "  Cancelled — Claude terminated.");
+    console.log(`  Resume with: ${cyan}${resumeCommand}${reset}\n`);
   } else if (result.status === "handoff" && result.reviewResolved === false) {
     const yellow = "\x1b[33m";
     console.log(`\n━━━ ${yellow}NEEDS REVIEW${reset} ━━━`);
@@ -239,7 +247,7 @@ export async function runTeam(taskId, opts = {}) {
     console.log(`\n━━━ ${yellow}HANDOFF${reset} ━━━`);
     console.log(`  Session paused — likely hit Claude rate/context limit.`);
     console.log(`  Resume file saved to .agentdesk-resume.md`);
-    console.log(`  Resume with: ${cyan}agentdesk team ${taskId}${reset}\n`);
+    console.log(`  Resume with: ${cyan}${resumeCommand}${reset}\n`);
   } else {
     console.log(`\n━━━ DONE ━━━`);
   }