@loicngr/kobo 1.11.12 → 1.11.14

package/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to Kōbō are documented here. The format is based on
 [Keep a Changelog](https://keepachangelog.com/). Each release is an `## <version>`
 section — the in-app "What's new" dialog reads this file.
 
+## 1.11.14
+
+- ⬆️ develop - refactor(deps): Bump SDKs + refactor shutdown + hardening sécurité
+
+## 1.11.13
+
+- fix(engines): unstick agent sessions that never emit session:ended
+
 ## 1.11.12
 
 - ✨ develop - feat(engines): Garder les sessions ouvertes pour les subagents en arrière-plan

package/dist/mcp-server/kobo-tasks-handlers.js

@@ -4,6 +4,7 @@ import { nanoid } from 'nanoid';
 import * as cronService from '../server/services/cron-service.js';
 import * as settingsService from '../server/services/settings-service.js';
 import { slugifyProjectName } from '../server/utils/project-slug.js';
+import { resolveExistingPathInside } from '../server/utils/safe-path.js';
 import { resolveWorkspaceWorktreePath } from '../server/utils/worktree-paths.js';
 /** Allowed task status values. */
 export const VALID_TASK_STATUSES = ['pending', 'in_progress', 'done'];
@@ -296,6 +297,7 @@ export function getTicketSourcesHandler(worktreePath) {
 export const DOCUMENT_DIRS = ['docs/plans', 'docs/superpowers', '.ai/thoughts'];
 /** Depth cap to keep recursion bounded even on pathological symlink loops. */
 const DOC_MAX_DEPTH = 8;
+const DOC_MAX_FILE_BYTES = 1024 * 1024;
 function walkMarkdownFiles(rootAbs, rootRel, out, depth = 0) {
     if (depth > DOC_MAX_DEPTH)
         return;
@@ -313,11 +315,13 @@ function walkMarkdownFiles(rootAbs, rootRel, out, depth = 0) {
         const relEntry = `${rootRel}/${entry}`;
         let stat;
         try {
-            stat = fs.statSync(absEntry);
+            stat = fs.lstatSync(absEntry);
         }
         catch {
             continue;
         }
+        if (stat.isSymbolicLink())
+            continue;
         if (stat.isDirectory()) {
             walkMarkdownFiles(absEntry, relEntry, out, depth + 1);
         }
@@ -336,7 +340,14 @@ export function listDocumentsHandler(worktreePath) {
         const absDir = path.join(worktreePath, dir);
         if (!fs.existsSync(absDir))
             continue;
-        walkMarkdownFiles(absDir, dir, documents);
+        try {
+            if (fs.lstatSync(absDir).isSymbolicLink())
+                continue;
+            walkMarkdownFiles(resolveExistingPathInside(worktreePath, absDir), dir, documents);
+        }
+        catch {
+            // A document directory outside the worktree is never eligible.
+        }
     }
     documents.sort((a, b) => new Date(b.modifiedAt).getTime() - new Date(a.modifiedAt).getTime());
     return documents;
@@ -361,7 +372,19 @@ export function readDocumentHandler(worktreePath, relPath) {
     if (!fs.existsSync(abs)) {
         throw new Error(`Document not found: ${normalized}`);
     }
-    return { path: normalized, content: fs.readFileSync(abs, 'utf-8') };
+    const lstat = fs.lstatSync(abs);
+    if (lstat.isSymbolicLink()) {
+        // Resolve for a consistent error if the link escapes; internal links are
+        // rejected too so list/read share the same no-symlink contract.
+        resolveExistingPathInside(worktreePath, abs);
+        throw new Error('Symbolic links are not allowed in documents');
+    }
+    const safeAbs = resolveExistingPathInside(worktreePath, abs);
+    const stat = fs.statSync(safeAbs);
+    if (stat.size > DOC_MAX_FILE_BYTES) {
+        throw new Error(`Document too large (max ${DOC_MAX_FILE_BYTES / 1024 / 1024} MB)`);
+    }
+    return { path: normalized, content: fs.readFileSync(safeAbs, 'utf-8') };
 }
 /**
  * Append a thought / decision / note to

package/dist/server/index.js

@@ -25,12 +25,12 @@ import templatesRouter from './routes/templates.js';
 import usageRoutes from './routes/usage.js';
 import voiceRouter from './routes/voice.js';
 import workspacesRouter from './routes/workspaces.js';
-import { getAvailableSkills, reconcileOrphanSessions, restoreRetryCountsFromDb, sendMessage, setBackendPort, startAgent, startWatchdog, stopAgent, stopWatchdog, } from './services/agent/orchestrator.js';
+import { getAvailableSkills, reconcileOrphanSessions, restoreRetryCountsFromDb, sendMessage, setBackendPort, startAgent, startWatchdog, stopAgent, stopAllAgents, stopWatchdog, } from './services/agent/orchestrator.js';
 import * as autoLoopService from './services/auto-loop-service.js';
 import { runContentMigrationIfNeeded } from './services/content-migration-service.js';
 import * as cronService from './services/cron-service.js';
 import { createDailyDbBackupIfNeeded, createPreMigrationBackup } from './services/db-backup-service.js';
-import { startDevServer, stopDevServer } from './services/dev-server-service.js';
+import { startDevServer, stopAllDevServers, stopDevServer } from './services/dev-server-service.js';
 import { authorizeWsUpgrade, generateToken, getLanUrls, resolveBindHost, resolveNetworkAccessEnvOverrides, } from './services/network-access-service.js';
 import { startPrWatcher, stopPrWatcher } from './services/pr-watcher-service.js';
 import * as quotaBackoffService from './services/quota-backoff-service.js';
@@ -42,7 +42,6 @@ import * as wakeupService from './services/wakeup-service.js';
 import { emit, emitEphemeral, handleConnection, setMessageHandler } from './services/websocket-service.js';
 import { getActiveSession, getWorkspace, updateWorkspaceStatus } from './services/workspace-service.js';
 import { getClientSpaPath, getDbPath, getKoboHome, getPackageVersion } from './utils/paths.js';
-import { initProcessCleanup, killAll as killAllTrackedProcesses } from './utils/process-tracker.js';
 console.log(`[kobo] Kōbō home: ${getKoboHome()}`);
 // Initialize DB + run migrations
 const db = getDb();
@@ -72,7 +71,6 @@ void createDailyDbBackupIfNeeded(db, getDbPath()).then((r) => {
     }
 });
 // Initialize process cleanup, agent watchdog, PR watcher, and wakeup rehydration
-initProcessCleanup();
 reconcileOrphanSessions();
 startWatchdog();
 wakeupService.rehydrate();
@@ -490,10 +488,10 @@ async function gracefulShutdown(signal) {
     catch {
         // Best-effort
     }
-    // Kill all tracked child processes (agents, dev servers)
+    // Stop managed agents and both direct/Docker dev servers before closing DB.
     try {
-        killAllTrackedProcesses();
-        console.log('[kobo] Tracked processes killed');
+        await Promise.all([stopAllAgents(), stopAllDevServers()]);
+        console.log('[kobo] Agents and dev servers stopped');
     }
     catch {
         // Best-effort

package/dist/server/routes/export.js

@@ -5,7 +5,8 @@ import * as workspaceService from '../services/workspace-service.js';
 const app = new Hono();
 /** Quote a CSV cell when it contains a delimiter, quote, or newline (RFC 4180). */
 function csvCell(value) {
-    return /[",\r\n]/.test(value) ? `"${value.replace(/"/g, '""')}"` : value;
+    const safeValue = /^[\s]*[=+\-@]/.test(value) ? `'${value}` : value;
+    return /[",\r\n]/.test(safeValue) ? `"${safeValue.replace(/"/g, '""')}"` : safeValue;
 }
 function csvRow(values) {
     return values.map(csvCell).join(',');

package/dist/server/routes/workspaces.js

@@ -42,6 +42,7 @@ import * as worktreeService from '../services/worktree-service.js';
 import { resolveUniqueBranchAndPath } from '../utils/branch-resolver.js';
 import * as gitOps from '../utils/git-ops.js';
 import { slugifyProjectName } from '../utils/project-slug.js';
+import * as safePath from '../utils/safe-path.js';
 import { resolveSiblingWorkspaceWorktreePath } from '../utils/worktree-paths.js';
 /** Hono sub-router for workspace CRUD, tasks, agent lifecycle, git operations, and PR creation. */
 const app = new Hono();
@@ -2692,6 +2693,13 @@ app.get('/:id/diff-file', (c) => {
             return c.json({ error: `Workspace '${id}' not found` }, 404);
         }
         const worktreePath = workspace.worktreePath;
+        try {
+            safePath.assertPathInside(worktreePath, filePath);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return c.json({ error: message }, 400);
+        }
         if (c.req.query('mode') === 'commits') {
             const from = c.req.query('from');
             const to = c.req.query('to');
@@ -2750,6 +2758,13 @@ app.post('/:id/rollback-file', async (c) => {
         if (!filePath) {
             return c.json({ error: 'Missing or invalid `path` field' }, 400);
         }
+        try {
+            safePath.assertPathInside(workspace.worktreePath, filePath);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return c.json({ error: message }, 400);
+        }
         let target;
         try {
             target = gitOps.rollbackFile(workspace.worktreePath, workspace.workingBranch, filePath);

package/dist/server/services/agent/engines/claude-code/engine.js

@@ -20,6 +20,12 @@ const RESULT_DRAIN_TIMEOUT_MS = 15_000;
 // without producing a result message. Keep a separate, conservative guard for
 // that shape; active tool/message traffic always cancels and re-arms it.
 const TEXT_IDLE_TIMEOUT_MS = 120_000;
+// Safety net for a subagent whose terminal `task_notification` carries a
+// status outside the mapper's known-terminal set (SDK schema drift) — it
+// never clears `activeSubagentToolCallIds`, which otherwise blocks
+// `inputStream.close()`/the result-drain watchdog forever. Generous window:
+// legitimate subagents can run for several minutes.
+const SUBAGENT_STALL_TIMEOUT_MS = 10 * 60_000;
 const MAX_PENDING_USER_MESSAGES = 20;
 function toMcpServersMap(specs) {
     if (!specs || specs.length === 0)
@@ -91,7 +97,9 @@ export function createClaudeCodeEngine() {
         async start(options, onEvent) {
             const abortController = new AbortController();
             const mapperState = createMapperState();
-            const activeSubagentToolCallIds = new Set();
+            // UI/tool ids can differ from the SDK task id. Key by the stable UI id
+            // so a terminal notification that omits task_id still clears the task.
+            const activeSubagentTaskIds = new Map();
             // Pending canUseTool callbacks, keyed by SDK ctx.toolUseID.
             const pendingResolvers = new Map();
             const isInteractive = options.agentPermissionMode === 'interactive';
@@ -278,6 +286,41 @@ export function createClaudeCodeEngine() {
                 }, RESULT_DRAIN_TIMEOUT_MS);
                 resultDrainTimer.unref?.();
             };
+            // Safety net for the "waiting on a background subagent" branch below:
+            // if `activeSubagentToolCallIds` never empties (a missed/unrecognised
+            // terminal notification), the workspace would otherwise stay `executing`
+            // forever. Force the drain through once this fires.
+            let subagentStallTimer;
+            const clearSubagentStallWatchdog = () => {
+                if (!subagentStallTimer)
+                    return;
+                clearTimeout(subagentStallTimer);
+                subagentStallTimer = undefined;
+            };
+            // Re-armed (not merely armed-once) on every qualifying `result` so the
+            // deadline tracks the last observed activity, matching the warning
+            // message below — a long chain of legitimate subagent-backed turns
+            // must not be cut off just because 10 minutes have passed in total.
+            const armSubagentStallWatchdog = () => {
+                clearSubagentStallWatchdog();
+                subagentStallTimer = setTimeout(() => {
+                    subagentStallTimer = undefined;
+                    // A message queued between arming and firing means a new turn is
+                    // about to start on this same stream — don't discard the subagent
+                    // tracking or force-close under it; the next 'result' re-evaluates.
+                    if (inputStream.hasUnansweredInput(completedResponses))
+                        return;
+                    console.warn(`[claude-engine] Subagent(s) still tracked active ${SUBAGENT_STALL_TIMEOUT_MS}ms after the last turn ended — forcing session drain.`);
+                    activeSubagentTaskIds.clear();
+                    // This is a forced, unclean termination (the subagent may still be
+                    // alive server-side) — never report it as a normal completion, so
+                    // auto-loop doesn't treat an orphaned run as forward progress.
+                    mapperState.sawErrorResult = true;
+                    inputStream.close();
+                    armResultDrainWatchdog();
+                }, SUBAGENT_STALL_TIMEOUT_MS);
+                subagentStallTimer.unref?.();
+            };
             const iteratorPromise = (async () => {
                 iteratorRunning = true;
                 try {
@@ -287,9 +330,20 @@ export function createClaudeCodeEngine() {
                             if (ev.kind !== 'subagent:progress')
                                 continue;
                             if (ev.status === 'running')
-                                activeSubagentToolCallIds.add(ev.toolCallId);
+                                activeSubagentTaskIds.set(ev.toolCallId, ev.taskId ?? ev.toolCallId);
                             else
-                                activeSubagentToolCallIds.delete(ev.toolCallId);
+                                activeSubagentTaskIds.delete(ev.toolCallId);
+                        }
+                        // The stall watchdog is only armed while we're waiting purely on
+                        // background subagents (no further SDK turn expected unless one
+                        // reports done). React the moment the last one clears instead of
+                        // waiting for a 'result' message that may never come.
+                        if (subagentStallTimer &&
+                            activeSubagentTaskIds.size === 0 &&
+                            !inputStream.hasUnansweredInput(completedResponses)) {
+                            clearSubagentStallWatchdog();
+                            inputStream.close();
+                            armResultDrainWatchdog();
                         }
                         for (const ev of events) {
                             if (ev.kind === 'session:started')
@@ -307,9 +361,15 @@ export function createClaudeCodeEngine() {
                             clearTextIdleWatchdog();
                             completedResponses++;
                             // A queued forced message starts the next response on this same SDK stream.
-                            if (!inputStream.hasUnansweredInput(completedResponses) && activeSubagentToolCallIds.size === 0) {
-                                inputStream.close();
-                                armResultDrainWatchdog();
+                            if (!inputStream.hasUnansweredInput(completedResponses)) {
+                                if (activeSubagentTaskIds.size === 0) {
+                                    clearSubagentStallWatchdog();
+                                    inputStream.close();
+                                    armResultDrainWatchdog();
+                                }
+                                else {
+                                    armSubagentStallWatchdog();
+                                }
                             }
                         }
                     }
@@ -354,6 +414,7 @@ export function createClaudeCodeEngine() {
                         resultDrainTimer = undefined;
                     }
                     clearTextIdleWatchdog();
+                    clearSubagentStallWatchdog();
                     // Drain any callback still pending (SDK terminated while awaiting an
                     // answer). canUseTool's abort path covers signalled stops; this
                     // covers natural iterator completion.
@@ -391,6 +452,20 @@ export function createClaudeCodeEngine() {
                     // subtype `error_during_execution` through the normal iterator —
                     // the mapper needs this flag to treat it as a clean stop.
                     mapperState.userInterrupted = true;
+                    // The soft interrupt below only ends the foreground turn — a
+                    // background subagent task keeps running unless told to stop via
+                    // its own API, which would otherwise leave the Stop button
+                    // appearing to do nothing for up to SUBAGENT_STALL_TIMEOUT_MS.
+                    for (const taskId of activeSubagentTaskIds.values()) {
+                        try {
+                            void q.stopTask(taskId).catch(() => {
+                                /* best-effort */
+                            });
+                        }
+                        catch {
+                            /* best-effort */
+                        }
+                    }
                     const qq = q;
                     if (typeof qq.interrupt === 'function') {
                         try {

package/dist/server/services/agent/engines/claude-code/event-mapper.js

@@ -192,16 +192,20 @@ export function mapSdkMessage(msg, state) {
             return events;
         }
         if (subtype === 'task_started' || subtype === 'task_progress' || subtype === 'task_notification') {
-            const toolCallId = typeof parsed.tool_use_id === 'string' ? parsed.tool_use_id : undefined;
+            const taskId = typeof parsed.task_id === 'string' ? parsed.task_id : undefined;
+            const toolCallId = typeof parsed.tool_use_id === 'string' ? parsed.tool_use_id : taskId;
             if (toolCallId) {
                 const usage = parsed.usage;
-                const taskStatus = typeof parsed.status === 'string' ? parsed.status : undefined;
-                const isDone = subtype === 'task_notification' &&
-                    taskStatus !== undefined &&
-                    ['completed', 'stopped', 'failed', 'cancelled'].includes(taskStatus);
+                // Unlike task_started/task_progress (in-flight signals), task_notification
+                // is only ever emitted once a task settles — its `status` value is a
+                // reason, not a liveness signal. Treat every task_notification as
+                // terminal instead of matching against a status whitelist, so an SDK
+                // status value added later doesn't leave the subagent stuck 'running'.
+                const isDone = subtype === 'task_notification';
                 events.push({
                     kind: 'subagent:progress',
                     toolCallId,
+                    ...(taskId ? { taskId } : {}),
                     status: isDone ? 'done' : 'running',
                     description: typeof parsed.description === 'string' ? parsed.description : undefined,
                     taskType: typeof parsed.task_type === 'string' ? parsed.task_type : undefined,

package/dist/server/services/agent/engines/codex/engine.js

@@ -11,6 +11,13 @@ import { createTurnLiveness } from './turn-liveness.js';
 /** Long enough for normal tool work, short enough to recover a lost turn event. */
 export const CODEX_TURN_IDLE_TIMEOUT_MS = 120_000;
 export const CODEX_GRACEFUL_INTERRUPT_TIMEOUT_MS = 3_000;
+// Safety net while `turnLiveness` is paused for background subagents: that
+// pause is deliberately unbounded (a legitimate subagent can run long), but
+// if a thread never reports a terminal status (dropped notification, or the
+// sub-thread's own process hanging), nothing else would ever resume it or
+// resolve `turnDonePromise` — the session would hang forever. Generous
+// window, refreshed on every observed subagent-thread status change.
+export const CODEX_SUBAGENT_STALL_TIMEOUT_MS = 10 * 60_000;
 function wait(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -108,6 +115,30 @@ export function createCodexEngine() {
                 resolveTurnDone = resolve;
                 rejectTurnDone = reject;
             });
+            let subagentStallTimer;
+            const clearSubagentStallWatchdog = () => {
+                if (!subagentStallTimer)
+                    return;
+                clearTimeout(subagentStallTimer);
+                subagentStallTimer = undefined;
+            };
+            // Re-armed on every observed subagent-thread status change so the
+            // deadline tracks the last activity, not the start of the wait.
+            const armSubagentStallWatchdog = () => {
+                clearSubagentStallWatchdog();
+                subagentStallTimer = setTimeout(() => {
+                    subagentStallTimer = undefined;
+                    console.warn(`[codex-engine] Background subagent thread(s) still tracked active ${CODEX_SUBAGENT_STALL_TIMEOUT_MS}ms after the turn completed — forcing session drain.`);
+                    activeSubagentThreads.clear();
+                    // Forced, unclean termination (a thread may still be alive
+                    // server-side) — never report it as a normal completion, so
+                    // auto-loop doesn't treat an orphaned run as forward progress.
+                    mapperState.sawErrorResult = true;
+                    if (waitingForBackgroundSubagents)
+                        resolveTurnDone();
+                }, CODEX_SUBAGENT_STALL_TIMEOUT_MS);
+                subagentStallTimer.unref?.();
+            };
             const finishBackgroundSubagent = (threadId, alreadyEmittedToolCallId) => {
                 const tracked = activeSubagentThreads.get(threadId);
                 if (!tracked)
@@ -122,8 +153,15 @@ export function createCodexEngine() {
                         taskType: tracked.taskType,
                     });
                 }
-                if (waitingForBackgroundSubagents && activeSubagentThreads.size === 0)
-                    resolveTurnDone();
+                if (waitingForBackgroundSubagents) {
+                    if (activeSubagentThreads.size === 0) {
+                        clearSubagentStallWatchdog();
+                        resolveTurnDone();
+                    }
+                    else {
+                        armSubagentStallWatchdog();
+                    }
+                }
             };
             const turnLiveness = createTurnLiveness({
                 timeoutMs: CODEX_TURN_IDLE_TIMEOUT_MS,
@@ -227,6 +265,7 @@ export function createCodexEngine() {
                             if (n.turn?.status === 'completed' && activeSubagentThreads.size > 0) {
                                 waitingForBackgroundSubagents = true;
                                 turnLiveness.pause();
+                                armSubagentStallWatchdog();
                             }
                             else {
                                 resolveTurnDone();
@@ -364,8 +403,21 @@ export function createCodexEngine() {
                 }
                 finally {
                     turnLiveness.stop();
+                    clearSubagentStallWatchdog();
                     streamingBatcher.close();
                     iteratorRunning = false;
+                    // Drain any outstanding approval/elicitation request (SDK terminated
+                    // while awaiting a human decision) — without a response, Codex's own
+                    // process would otherwise wait forever for a reply that never comes.
+                    for (const pending of pendingByCallId.values()) {
+                        try {
+                            client.peer.respondError(pending.requestId, -32000, 'session ended');
+                        }
+                        catch {
+                            // best-effort
+                        }
+                    }
+                    pendingByCallId.clear();
                     client.close();
                     try {
                         child.kill('SIGTERM');

package/dist/server/services/agent/orchestrator.js

@@ -987,12 +987,7 @@ export function interruptAgent(workspaceId, options = {}) {
         autoLoopService.disable(workspaceId, 'user-action');
     }
 }
-/** Gracefully stop an agent (the engine handles SIGTERM + SIGKILL). */
-export function stopAgent(workspaceId) {
-    const ctrl = controllers.get(workspaceId);
-    if (!ctrl) {
-        throw new Error(`No agent running for workspace '${workspaceId}'`);
-    }
+async function stopController(workspaceId, ctrl) {
     wakeupService.cancel(workspaceId, 'stopped');
     // If the session was waiting on a question/permission, normalize the state
     // synchronously so callers (archive, delete, manual stop) see a clean
@@ -1020,11 +1015,42 @@ export function stopAgent(workspaceId) {
     controllers.delete(workspaceId);
     // Manual stop should also drop any pending quota auto-resume.
     quotaBackoffService.cancel(workspaceId, 'user');
-    // Fire-and-forget: controller.stop is async but we don't block callers.
-    void ctrl.stop().catch((err) => {
+    await ctrl.stop();
+}
+/** Gracefully stop an agent (the engine handles SIGTERM + SIGKILL). */
+export function stopAgent(workspaceId) {
+    const ctrl = controllers.get(workspaceId);
+    if (!ctrl) {
+        throw new Error(`No agent running for workspace '${workspaceId}'`);
+    }
+    // Fire-and-forget: callers such as archive/delete must remain synchronous.
+    void stopController(workspaceId, ctrl).catch((err) => {
         console.error('[orchestrator] controller.stop failed:', err);
     });
 }
+/** Stop every live engine before process shutdown, with a bounded wait per engine. */
+export async function stopAllAgents(timeoutMs = 3_000) {
+    const stops = [...controllers.entries()].map(async ([workspaceId, ctrl]) => {
+        let timeout;
+        try {
+            await Promise.race([
+                stopController(workspaceId, ctrl),
+                new Promise((resolve) => {
+                    timeout = setTimeout(resolve, timeoutMs);
+                    timeout.unref?.();
+                }),
+            ]);
+        }
+        catch (err) {
+            console.error(`[orchestrator] Failed to stop '${workspaceId}' during shutdown:`, err);
+        }
+        finally {
+            if (timeout)
+                clearTimeout(timeout);
+        }
+    });
+    await Promise.all(stops);
+}
 /** Write a user message to the running agent. */
 export async function sendMessage(workspaceId, content, expectedSessionId) {
     const ctrl = controllers.get(workspaceId);

package/dist/server/services/cron-service.js

@@ -170,7 +170,6 @@ function fireOrSkip(id) {
         }
         let status = 'skipped-active';
         if (!orchestrator.hasController(row.workspace_id)) {
-            status = 'fired';
             try {
                 const globalSettings = settingsService.getGlobalSettings();
                 const projectSettings = settingsService.getProjectSettings(wsRow.project_path);
@@ -186,9 +185,11 @@ function fireOrSkip(id) {
                 // every fire" (clean context, no conversation continuity).
                 const resumeMode = row.agent_session_id !== null;
                 orchestrator.startAgent(row.workspace_id, worktreePath, row.prompt, wsRow.model, resumeMode, agentPermissionMode, row.agent_session_id ?? undefined, wsRow.reasoning_effort);
+                status = 'fired';
             }
             catch (err) {
                 console.error(`[cron-service] startAgent at fire time failed for cron '${id}':`, err);
+                status = 'start-failed';
             }
         }
         const now = new Date();

package/dist/server/services/dev-server-service.js

@@ -3,7 +3,7 @@ import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import path from 'node:path';
 import { getProjectSettings } from './settings-service.js';
 import { emitEphemeral } from './websocket-service.js';
-import { getWorkspace, updateDevServerStatus } from './workspace-service.js';
+import { getWorkspace, listWorkspaces, updateDevServerStatus } from './workspace-service.js';
 // ── Helpers ───────────────────────────────────────────────────────────────────
 /** Build a clean env for child processes, stripping Kobo-specific variables. */
 function cleanEnv() {
@@ -312,6 +312,18 @@ export async function stopDevServer(workspaceId) {
     emitEphemeral(workspaceId, 'devserver:status', status);
     return status;
 }
+/** Stop direct and Docker dev servers for every persisted workspace. */
+export async function stopAllDevServers() {
+    const workspaceIds = new Set([...listWorkspaces(true).map((workspace) => workspace.id), ...trackedProcesses.keys()]);
+    await Promise.all([...workspaceIds].map(async (workspaceId) => {
+        try {
+            await stopDevServer(workspaceId);
+        }
+        catch (err) {
+            console.error(`[dev-server] Failed to stop '${workspaceId}' during shutdown:`, err);
+        }
+    }));
+}
 // ── Logs ───────────────────────────────────────────────────────────────────────
 /**
  * Get logs from running dev-server containers for a workspace.

package/dist/server/services/wakeup-service.js

@@ -6,6 +6,7 @@ import * as settingsService from './settings-service.js';
 import { emitEphemeral } from './websocket-service.js';
 const MIN_DELAY_SECONDS = 60;
 const MAX_DELAY_SECONDS = 21600;
+const ACTIVE_SESSION_RETRY_MS = 15_000;
 const STALE_WAKEUP_GRACE_MS = 5 * 60 * 1000;
 const AUTONOMOUS_LOOP_SENTINEL = '<<autonomous-loop-dynamic>>';
 const AUTONOMOUS_LOOP_FALLBACK_PROMPT = 'Continue where you left off.';
@@ -19,6 +20,15 @@ function rowToPending(row) {
         return null;
     return { targetAt: row.target_at, reason: row.reason ?? undefined };
 }
+/** Keep a claimed wakeup durable while the session is still unavailable. */
+function defer(workspaceId, row) {
+    const targetAt = new Date(Date.now() + ACTIVE_SESSION_RETRY_MS).toISOString();
+    getDb().prepare('UPDATE pending_wakeups SET target_at = ? WHERE workspace_id = ?').run(targetAt, workspaceId);
+    const timeout = setTimeout(() => fire(workspaceId), ACTIVE_SESSION_RETRY_MS);
+    timeout.unref?.();
+    timers.set(workspaceId, timeout);
+    emitEphemeral(workspaceId, 'wakeup:scheduled', { targetAt, reason: row.reason ?? undefined });
+}
 /** Schedule a wakeup for the given workspace. Replaces any existing pending wakeup. */
 export function schedule(workspaceId, delaySeconds, prompt, reason, agentSessionId) {
     try {
@@ -118,21 +128,12 @@ export function rehydrate() {
 function fire(workspaceId) {
     try {
         const db = getDb();
-        // Atomic claim: SELECT + DELETE in a single transaction so a concurrent
-        // cancel() can't race us between the read and the act. If we come out
-        // with a row, it's ours exclusively; no other caller will ever see it.
-        const row = db.transaction(() => {
-            const r = db.prepare('SELECT * FROM pending_wakeups WHERE workspace_id = ?').get(workspaceId);
-            if (r) {
-                db.prepare('DELETE FROM pending_wakeups WHERE workspace_id = ?').run(workspaceId);
-            }
-            return r;
-        })();
+        const row = db.prepare('SELECT * FROM pending_wakeups WHERE workspace_id = ?').get(workspaceId);
         timers.delete(workspaceId);
         if (!row)
             return;
         if (orchestrator.hasController(workspaceId)) {
-            emitEphemeral(workspaceId, 'wakeup:skipped', { reason: 'session-active' });
+            defer(workspaceId, row);
             return;
         }
         const wsRow = db
@@ -155,12 +156,13 @@ function fire(workspaceId) {
         const agentPermissionMode = stored === 'plan' || stored === 'strict' || stored === 'interactive' ? stored : 'bypass';
         try {
             orchestrator.startAgent(workspaceId, worktreePath, row.prompt, wsRow.model, true, agentPermissionMode, row.agent_session_id ?? undefined, wsRow.reasoning_effort);
+            db.prepare('DELETE FROM pending_wakeups WHERE workspace_id = ?').run(workspaceId);
             emitEphemeral(workspaceId, 'wakeup:fired', {});
         }
         catch (err) {
             const message = err instanceof Error ? err.message : String(err);
             console.error(`[wakeup-service] startAgent at fire time failed for '${workspaceId}':`, message);
-            emitEphemeral(workspaceId, 'wakeup:skipped', { reason: 'fire-failed' });
+            defer(workspaceId, row);
         }
     }
     catch (err) {

package/dist/server/utils/git-ops.js

@@ -2,6 +2,7 @@ import { execFile as execFileCb, execFileSync } from 'node:child_process';
 import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { promisify } from 'node:util';
+import { resolvePathInside } from './safe-path.js';
 const execFileAsync = promisify(execFileCb);
 const READ_ONLY_GIT_TIMEOUT_MS = 15_000;
 function git(repoPath, args) {
@@ -854,6 +855,7 @@ export function getChangedFilesBetween(repoPath, fromRef, toRef) {
  * feedback in the UI.
  */
 export function rollbackFile(repoPath, branchName, filePath, remote = 'origin') {
+    const absPath = resolvePathInside(repoPath, filePath);
     const remoteRef = `${remote}/${branchName}`;
     let remoteRefExists = false;
     try {
@@ -884,7 +886,6 @@ export function rollbackFile(repoPath, branchName, filePath, remote = 'origin')
         // with a previous rollback, stale UI list, manual rm), we still return
         // 'deleted' since the end state matches the user's intent. `rmSync`
         // over `git clean -f` keeps the action narrow to one file.
-        const absPath = join(repoPath, filePath);
         if (existsSync(absPath)) {
             rmSync(absPath, { force: true });
         }
@@ -896,7 +897,7 @@ export const rollbackFileToRemote = rollbackFile;
 /** Get the current content of a file in the worktree. Returns null if the file doesn't exist. */
 export function getFileContent(repoPath, filePath) {
     try {
-        return readFileSync(join(repoPath, filePath), 'utf-8');
+        return readFileSync(resolvePathInside(repoPath, filePath), 'utf-8');
     }
     catch {
         return null;