@loicngr/kobo 1.11.26 → 1.11.28

package/dist/server/services/agent/engines/claude-code/engine.js

@@ -17,7 +17,7 @@ import { buildStopHookOutput } from './stop-hook.js';
  * post-result drain watchdog force-emits `session:ended` so the orchestrator
  * and auto-loop are not frozen forever.
  */
-const RESULT_DRAIN_TIMEOUT_MS = 15_000;
+export const RESULT_DRAIN_TIMEOUT_MS = 15_000;
 /**
  * Deadline for a stream that stops reporting ANY activity. The former
  * text-only guard was re-armed solely on a message with text and no tool call
@@ -26,12 +26,23 @@ const RESULT_DRAIN_TIMEOUT_MS = 15_000;
  * forever with zero trace. Exported so tests never hard-code the value.
  */
 export const CLAUDE_STREAM_IDLE_TIMEOUT_MS = 120_000;
+/**
+ * Idle ceiling while a FOREGROUND tool call is in flight (tool:call seen, no
+ * tool:result yet). A long Bash run — a test suite, a CI-poll sleep — emits no
+ * SDK message until its tool_result, so the short deadline would kill a
+ * healthy session mid-tool (the "random session stops" bug). A genuinely dead
+ * stream is still reaped once this longer ceiling elapses.
+ */
+export const CLAUDE_TOOL_IDLE_TIMEOUT_MS = 30 * 60_000;
+/** Ceiling on a context compaction: past this, assume it wedged and let the
+ *  liveness deadline take over instead of pausing forever. */
+export const COMPACTION_STALL_TIMEOUT_MS = 10 * 60_000;
 // Safety net for a subagent whose terminal `task_notification` carries a
 // status outside the mapper's known-terminal set (SDK schema drift) — it
 // never clears `activeSubagentToolCallIds`, which otherwise blocks
 // `inputStream.close()`/the result-drain watchdog forever. Generous window:
 // legitimate subagents can run for several minutes.
-const SUBAGENT_STALL_TIMEOUT_MS = 10 * 60_000;
+export const SUBAGENT_STALL_TIMEOUT_MS = 10 * 60_000;
 const MAX_PENDING_USER_MESSAGES = 20;
 function toMcpServersMap(specs) {
     if (!specs || specs.length === 0)
@@ -106,6 +117,9 @@ export function createClaudeCodeEngine() {
             // UI/tool ids can differ from the SDK task id. Key by the stable UI id
             // so a terminal notification that omits task_id still clears the task.
             const activeSubagentTaskIds = new Map();
+            // Foreground tool calls currently awaiting their tool_result. Cleared on
+            // every `result` message: a turn cannot end with a tool still in flight.
+            const pendingToolCallIds = new Set();
             // Pending canUseTool callbacks, keyed by SDK ctx.toolUseID.
             const pendingResolvers = new Map();
             const isInteractive = options.agentPermissionMode === 'interactive';
@@ -141,6 +155,7 @@ export function createClaudeCodeEngine() {
                         return;
                     }
                     ctx.signal.addEventListener('abort', onAbort, { once: true });
+                    resolver.cleanup = () => ctx.signal.removeEventListener('abort', onAbort);
                     onEvent({
                         kind: 'session:user-input-requested',
                         requestKind,
@@ -283,16 +298,74 @@ export function createClaudeCodeEngine() {
             const turnLiveness = createTurnLiveness({
                 timeoutMs: CLAUDE_STREAM_IDLE_TIMEOUT_MS,
                 onTimeout() {
-                    console.warn(`[claude-engine] SDK stream reported no activity for ${CLAUDE_STREAM_IDLE_TIMEOUT_MS}ms — forcing session:ended`);
+                    // The armed deadline tracks whether a foreground tool call is in
+                    // flight (see `turnLiveness.setTimeoutMs` below) — log the duration
+                    // that actually elapsed, not always the shorter baseline, so the
+                    // watchdog's own diagnostic message stays trustworthy.
+                    const timeoutMs = pendingToolCallIds.size > 0 ? CLAUDE_TOOL_IDLE_TIMEOUT_MS : CLAUDE_STREAM_IDLE_TIMEOUT_MS;
+                    console.warn(`[claude-engine] SDK stream reported no activity for ${timeoutMs}ms — forcing session:ended`);
                     if (userInterrupted)
                         emitSessionEnded('killed', null);
                     else if (mapperState.sawErrorResult)
                         emitSessionEnded('error', null);
-                    else
+                    else {
+                        safeEmit({
+                            kind: 'error',
+                            category: 'other',
+                            message: 'Session force-ended by the liveness watchdog: no SDK activity within the deadline. If the agent was legitimately busy, this is a bug worth reporting.',
+                        });
                         emitSessionEnded('watchdog', null);
+                    }
                     abortController.abort();
                 },
             });
+            // The single source of truth for "should the idle deadline be paused
+            // right now" — a background subagent, a pending permission/question
+            // card, or an in-progress compaction can each legitimately keep the
+            // stream quiet for minutes; their own dedicated watchdogs own those
+            // windows. Every call site that changes one of these three conditions
+            // must re-evaluate through this helper, not duplicate the check.
+            const reevaluateLivenessPause = () => {
+                if (activeSubagentTaskIds.size > 0 || pendingResolvers.size > 0 || isCompacting)
+                    turnLiveness.pause();
+                else
+                    turnLiveness.resume();
+            };
+            // Backstop for a compaction that never reports completion (stuck
+            // `session:compacting` with `active: true` forever): `isCompacting`
+            // pauses `turnLiveness` indefinitely, and a wedged-but-alive generator
+            // never trips `isAlive()`'s own sweep either. Past this ceiling, assume
+            // it wedged and resume the liveness deadline so the existing tool-aware
+            // / short deadline can reap it, mirroring `armSubagentStallWatchdog`.
+            let compactionStallTimer;
+            const clearCompactionStallTimer = () => {
+                if (!compactionStallTimer)
+                    return;
+                clearTimeout(compactionStallTimer);
+                compactionStallTimer = undefined;
+            };
+            const armCompactionStallTimer = () => {
+                clearCompactionStallTimer();
+                compactionStallTimer = setTimeout(() => {
+                    compactionStallTimer = undefined;
+                    if (!isCompacting)
+                        return;
+                    console.warn(`[claude-engine] Compaction still reported active ${COMPACTION_STALL_TIMEOUT_MS}ms after it started — resuming the liveness deadline.`);
+                    isCompacting = false;
+                    reevaluateLivenessPause();
+                    if (activeSubagentTaskIds.size > 0 && !subagentStallTimer) {
+                        // Resume declined because a subagent is still tracked — but the
+                        // subagent stall net is only armed from the `result` branch, which
+                        // a fully wedged generator may never reach. Arm it here as a
+                        // second stage so this combination can't hang forever. The
+                        // `!subagentStallTimer` guard matters: arming re-sets the
+                        // deadline, and a net already armed by a prior `result` must not
+                        // be extended by this backstop (it is not new activity).
+                        armSubagentStallWatchdog();
+                    }
+                }, COMPACTION_STALL_TIMEOUT_MS);
+                compactionStallTimer.unref?.();
+            };
             const armResultDrainWatchdog = () => {
                 if (resultDrainTimer)
                     return;
@@ -302,8 +375,14 @@ export function createClaudeCodeEngine() {
                         emitSessionEnded('killed', null);
                     else if (mapperState.sawErrorResult)
                         emitSessionEnded('error', null);
-                    else
+                    else {
+                        safeEmit({
+                            kind: 'error',
+                            category: 'other',
+                            message: 'Session force-ended: the SDK generator stayed open after its final result (drain watchdog).',
+                        });
                         emitSessionEnded('watchdog', null);
+                    }
                     abortController.abort();
                 }, RESULT_DRAIN_TIMEOUT_MS);
                 resultDrainTimer.unref?.();
@@ -369,12 +448,25 @@ export function createClaudeCodeEngine() {
                                 activeSubagentTaskIds.delete(ev.toolCallId);
                         }
                         for (const ev of events) {
-                            if (ev.kind === 'session:compacting')
+                            if (ev.kind === 'session:compacting') {
                                 isCompacting = ev.active;
+                                if (ev.active)
+                                    armCompactionStallTimer();
+                                else
+                                    clearCompactionStallTimer();
+                            }
                             // Older SDKs can emit only compact_boundary, without a trailing
                             // status update. This boundary marks compaction as complete.
-                            else if (ev.kind === 'session:compacted')
+                            else if (ev.kind === 'session:compacted') {
                                 isCompacting = false;
+                                clearCompactionStallTimer();
+                            }
+                        }
+                        for (const ev of events) {
+                            if (ev.kind === 'tool:call')
+                                pendingToolCallIds.add(ev.toolCallId);
+                            else if (ev.kind === 'tool:result')
+                                pendingToolCallIds.delete(ev.toolCallId);
                         }
                         // The stall watchdog is only armed while we're waiting purely on
                         // background subagents (no further SDK turn expected unless one
@@ -398,11 +490,12 @@ export function createClaudeCodeEngine() {
                         // A background subagent or a pending permission card can stay
                         // legitimately quiet for minutes; their own dedicated watchdogs
                         // own those windows, so suspend the turn deadline meanwhile.
-                        if (activeSubagentTaskIds.size > 0 || pendingResolvers.size > 0 || isCompacting)
-                            turnLiveness.pause();
-                        else
-                            turnLiveness.resume();
+                        // A FOREGROUND tool call in flight keeps the deadline armed but
+                        // stretched to the tool-aware ceiling.
+                        turnLiveness.setTimeoutMs(pendingToolCallIds.size > 0 ? CLAUDE_TOOL_IDLE_TIMEOUT_MS : CLAUDE_STREAM_IDLE_TIMEOUT_MS);
+                        reevaluateLivenessPause();
                         if (msg.type === 'result') {
+                            pendingToolCallIds.clear();
                             completedResponses++;
                             emitTurnCompletedIfSettled();
                             // A queued forced message starts the next response on this same SDK stream.
@@ -457,11 +550,13 @@ export function createClaudeCodeEngine() {
                     clearResultDrainWatchdog();
                     turnLiveness.stop();
                     clearSubagentStallWatchdog();
+                    clearCompactionStallTimer();
                     // Drain any callback still pending (SDK terminated while awaiting an
                     // answer). canUseTool's abort path covers signalled stops; this
                     // covers natural iterator completion.
                     for (const resolver of pendingResolvers.values()) {
                         try {
+                            resolver.cleanup?.();
                             resolver.resolve({ behavior: 'deny', message: 'session ended', interrupt: false });
                         }
                         catch {
@@ -541,10 +636,12 @@ export function createClaudeCodeEngine() {
                     if (!resolver)
                         return false;
                     pendingResolvers.delete(toolCallId);
-                    // Only resume the deadline once every outstanding card is answered —
-                    // a sibling request may still be waiting on a human.
-                    if (pendingResolvers.size === 0)
-                        turnLiveness.resume();
+                    resolver.cleanup?.();
+                    // Re-evaluate rather than unconditionally resuming: a sibling
+                    // request, a still-active subagent, or an in-progress compaction
+                    // may each still have their own legitimate reason to keep the
+                    // deadline paused.
+                    reevaluateLivenessPause();
                     if (response.kind === 'question') {
                         // Echo the original questions array + answers so the SDK
                         // reconstructs the AskUserQuestion tool input.

package/dist/server/services/agent/engines/codex/engine.js

@@ -12,6 +12,8 @@ import { spawnAppServer } from './spawn.js';
 /** Long enough for normal tool work, short enough to recover a lost turn event. */
 export const CODEX_TURN_IDLE_TIMEOUT_MS = 120_000;
 export const CODEX_GRACEFUL_INTERRUPT_TIMEOUT_MS = 3_000;
+/** Grace given to a SIGTERM before the child is killed outright. */
+const CODEX_FORCE_KILL_TIMEOUT_MS = 3_000;
 // Safety net while `turnLiveness` is paused for background subagents: that
 // pause is deliberately unbounded (a legitimate subagent can run long), but
 // if a thread never reports a terminal status (dropped notification, or the
@@ -508,6 +510,22 @@ export function createCodexEngine() {
                     catch {
                         // swallow
                     }
+                    // Escalate. The SIGTERM in the `finally` below is a request, not a
+                    // guarantee: a wedged `codex app-server` that ignores it outlives the
+                    // stop, the archive, the delete and Kōbō's own shutdown, holding the
+                    // worktree and its share of the model quota, with nothing left in
+                    // this process tracking it.
+                    if (child.exitCode === null && child.signalCode === null) {
+                        child.kill('SIGTERM');
+                        const exited = await Promise.race([
+                            new Promise((resolve) => child.once('exit', () => resolve(true))),
+                            wait(CODEX_FORCE_KILL_TIMEOUT_MS).then(() => false),
+                        ]);
+                        if (!exited) {
+                            console.warn('[codex] app-server ignored SIGTERM — sending SIGKILL');
+                            child.kill('SIGKILL');
+                        }
+                    }
                 },
                 resolvePendingUserInput(callId, response) {
                     const pending = pendingByCallId.get(callId);

package/dist/server/services/agent/engines/codex/server-requests.js

@@ -67,14 +67,11 @@ export function handleServerRequest(args) {
         return true;
     }
     if (method === 'item/permissions/requestApproval') {
-        register(callId, { requestId, kind: 'permissions', payload: p });
-        emit({
-            kind: 'session:user-input-requested',
-            requestKind: 'permission',
-            toolCallId: callId,
-            toolName: 'Permissions',
-            payload: p,
-        });
+        // Kōbō doesn't model granular permission grants: the only answer we can
+        // send is the empty grant (Codex then falls back to the turn policy), so
+        // an Allow/Deny card would be a lie — "Allow" and "Deny" produced the
+        // same decline. Answer immediately and keep the session moving.
+        respond?.(requestId, { permissions: {}, scope: 'turn' });
         return true;
     }
     return false; // unknown method
@@ -87,12 +84,6 @@ export function handleServerRequest(args) {
  * (and the matching `FileChangeApprovalDecision`): `'accept' | 'acceptForSession' | 'decline' | 'cancel'`.
  * NOT `'approve' / 'reject'` — those would be silently rejected as unknown
  * variants, which breaks the strict and interactive permission modes.
- *
- * `PermissionsRequestApprovalResponse` has a completely different shape:
- * `{ permissions, scope, strictAutoReview? }` — no `decision` field. Since
- * Kōbō doesn't yet model permission grants, we deny the request by sending
- * an empty permissions response. A future iteration could add a UI for
- * granular permission grants.
  */
 export function buildResponseForResolve(pending, response) {
     if (pending.kind === 'command' || pending.kind === 'file_change') {
@@ -100,12 +91,6 @@ export function buildResponseForResolve(pending, response) {
             return { decision: 'accept' };
         return { decision: 'decline' };
     }
-    if (pending.kind === 'permissions') {
-        // Codex's PermissionsRequestApprovalResponse shape — not { decision }.
-        // We don't yet model granular permission grants, so deny by returning an
-        // empty permissions object; Codex falls back to the existing turn policy.
-        return { permissions: {}, scope: 'turn' };
-    }
     if (pending.kind === 'user_input') {
         if (response.kind === 'question') {
             const answers = {};

package/dist/server/services/agent/orchestrator.js

@@ -6,6 +6,7 @@ import * as autoLoopService from '../auto-loop-service.js';
 import * as cleanupScriptService from '../cleanup-script-service.js';
 import * as cronService from '../cron-service.js';
 import { resolveForge } from '../forge/resolve.js';
+import * as lifecycleHookService from '../lifecycle-hook-service.js';
 import * as quotaBackoffService from '../quota-backoff-service.js';
 import { getEffectiveSettings, getGlobalSettings } from '../settings-service.js';
 import { refreshNow } from '../usage/poller.js';
@@ -268,6 +269,9 @@ function runWatchdog() {
         if (controllers.get(workspaceId) === ctrl)
             controllers.delete(workspaceId);
         retryCounts.delete(workspaceId);
+        // This end never goes through handleEvent → onSessionEnded, so the user's
+        // hook would otherwise miss precisely the case it is most useful for.
+        fireSessionEndedHook(workspaceId, ctrl.agentSessionId, 'killed', null, ctrl);
         try {
             const db = getDb();
             db.prepare('UPDATE agent_sessions SET status = ?, ended_at = ? WHERE id = ?').run('error', new Date().toISOString(), ctrl.agentSessionId);
@@ -413,6 +417,9 @@ function readEffectiveSettingsSafe(projectPath) {
             cleanupScriptOnlyOnChanges: false,
             archiveScript: '',
             changeSourceBranchScript: '',
+            sessionEndedScript: '',
+            prMergedScript: '',
+            autoLoopDisabledScript: '',
             notionStatusProperty: '',
             notionInProgressStatus: '',
         };
@@ -856,6 +863,9 @@ function handleEvent(workspaceId, agentSessionId, sourceController, ev) {
         // a mid-loop session (never cleans) or a standalone one.
         const wasAutoLoop = autoLoopService.getStatus(workspaceId).auto_loop;
         autoLoopService.onSessionEnded(workspaceId, effectiveReason, progressDelta);
+        // A slot just freed. Any auto-loop workspace parked on the concurrency
+        // limit has no session of its own to bring it back; this one does it.
+        autoLoopService.resumeWaitingWorkspaces();
         cleanupScriptService.onSessionEnded(workspaceId, effectiveReason, { wasAutoLoop });
     }
     if (ev.kind === 'session:user-input-requested' && !sourceControllerIsStopping) {
@@ -913,11 +923,43 @@ function handleEvent(workspaceId, agentSessionId, sourceController, ev) {
         }
     }
 }
+/**
+ * Sessions whose session-ended hook already ran. Two paths can report the
+ * same end — the watchdog's dead-engine sweep, then the engine's own late
+ * `session:ended` — and the user's script must run once per session, not
+ * once per report. Bounded: cleared past a size no single process reaches.
+ */
+const sessionEndedHookFired = new Set();
+function fireSessionEndedHook(workspaceId, agentSessionId, reason, exitCode, controller) {
+    if (sessionEndedHookFired.has(agentSessionId))
+        return;
+    if (sessionEndedHookFired.size > 10_000)
+        sessionEndedHookFired.clear();
+    sessionEndedHookFired.add(agentSessionId);
+    // The worktree is about to be removed by the very operation that stopped
+    // this session; a script spawned in it would lose its cwd mid-run.
+    const cause = controller?.stopCause;
+    if (cause === 'delete' || cause === 'purge')
+        return;
+    void lifecycleHookService.onSessionEnded(workspaceId, {
+        sessionId: agentSessionId,
+        reason,
+        exitCode,
+        stopCause: controller?.status === 'stopping' ? (cause ?? 'user') : '',
+        // Read BEFORE auto-loop reacts to this end (which may disable it): the
+        // hook wants to know whether the next iteration is about to start.
+        autoLoopActive: getWs(workspaceId)?.autoLoop === true,
+    });
+}
 function onSessionEnded(workspaceId, agentSessionId, sourceController, exitCode, reason, resumeFailed = false) {
     // Update the agent_sessions row
     try {
         const db = getDb();
-        db.prepare('UPDATE agent_sessions SET status = ?, ended_at = ? WHERE id = ?').run(exitCode === 0 ? 'completed' : 'error', new Date().toISOString(), agentSessionId);
+        // `status` only distinguishes completed from error, by exit code. Keep the
+        // reason too: "the watchdog force-ended it", "the user stopped it" and "it
+        // finished on its own" all landed on the same two values, so after the fact
+        // nothing could say why a session stopped.
+        db.prepare('UPDATE agent_sessions SET status = ?, ended_at = ?, end_reason = ? WHERE id = ?').run(exitCode === 0 ? 'completed' : 'error', new Date().toISOString(), reason, agentSessionId);
     }
     catch (err) {
         console.error('[orchestrator] Failed to update agent_sessions on exit:', err);
@@ -926,6 +968,10 @@ function onSessionEnded(workspaceId, agentSessionId, sourceController, exitCode,
     const isSuperseded = sourceController !== undefined && registeredController !== undefined && registeredController !== sourceController;
     if (isSuperseded)
         return false;
+    // A superseded end (above) is a session that was replaced, not one that
+    // ended; everything past this point is a real end the user may want to act
+    // on, whatever the reason — the script reads KOBO_SESSION_END_REASON.
+    fireSessionEndedHook(workspaceId, agentSessionId, reason, exitCode, sourceController);
     const currentWorkspace = getWs(workspaceId);
     const preserveQuotaBackoff = currentWorkspace?.status === 'quota';
     const wasStopping = sourceController?.status === 'stopping';
@@ -957,7 +1003,16 @@ function onSessionEnded(workspaceId, agentSessionId, sourceController, exitCode,
     // `reason` is authoritative (with the SDK engine `exitCode` is often null,
     // so reason='error'+exitCode=null would otherwise map wrongly to 'completed').
     // `resumeFailed` is benign: stale id cleared, next iteration starts fresh.
-    const isErrorOutcome = !resumeFailed && (reason === 'error' || (exitCode !== null && exitCode !== 0));
+    // 'watchdog' is a forced kill, never a success. For an auto-loop workspace,
+    // handleTransientAutoLoopFailure (called above, before onSessionEnded) runs
+    // synchronously up to its first await and writes status 'quota' as its very
+    // first statement — that write lands before `currentWorkspace` is read above
+    // (line ~1144), so `preserveQuotaBackoff` is already true and this function
+    // returns early at the `if (preserveQuotaBackoff) return true` branch above.
+    // This computation is therefore never reached at all for that path, not
+    // merely short-circuited afterwards — it only runs on session ends that
+    // don't go through the auto-loop transient-failure path.
+    const isErrorOutcome = !resumeFailed && (reason === 'error' || reason === 'watchdog' || (exitCode !== null && exitCode !== 0));
     const targetStatus = isErrorOutcome ? 'error' : 'completed';
     // Skip the transition when the workspace is already in a terminal state.
     // This happens when stopAgent (or an equivalent caller) synchronously
@@ -1161,7 +1216,8 @@ export function interruptAgent(workspaceId, options = {}) {
  * is untracked by anyone in this process; only the OS or the user can end it.
  */
 export const STOP_AGENT_TIMEOUT_MS = 15_000;
-async function stopController(workspaceId, ctrl) {
+async function stopController(workspaceId, ctrl, cause = 'user') {
+    ctrl.stopCause = cause;
     wakeupService.cancel(workspaceId, 'stopped');
     // Normalize the state synchronously so callers (archive, delete, manual
     // stop) see a clean workspace immediately — without waiting for the async
@@ -1247,11 +1303,13 @@ async function stopWithTimeout(ctrl, timeoutMs) {
  * switch — MUST use this: the fire-and-forget `stopAgent` returns while the
  * engine may still be writing files.
  */
-export async function stopAgentAndWait(workspaceId, timeoutMs = STOP_AGENT_TIMEOUT_MS) {
+export async function stopAgentAndWait(workspaceId, timeoutMs = STOP_AGENT_TIMEOUT_MS, 
+/** Why. `delete` and `purge` tell the session-ended hook to stand down. */
+cause = 'user') {
     const ctrl = controllers.get(workspaceId);
     if (!ctrl)
         return 'not-running';
-    const finished = await raceWithTimeout(stopController(workspaceId, ctrl).then(() => true, (err) => {
+    const finished = await raceWithTimeout(stopController(workspaceId, ctrl, cause).then(() => true, (err) => {
         console.error(`[orchestrator] controller.stop failed for '${workspaceId}':`, err);
         return true;
     }), timeoutMs, () => false);
@@ -1638,6 +1696,10 @@ export function getAgentStatus(workspaceId) {
 export function hasController(workspaceId) {
     return controllers.has(workspaceId);
 }
+/** How many agent sessions are live right now, across every workspace. */
+export function runningAgentCount() {
+    return controllers.size;
+}
 /** The agent_session_id of the active controller for the workspace, if any. */
 export function getActiveSessionId(workspaceId) {
     return controllers.get(workspaceId)?.agentSessionId;
@@ -1782,25 +1844,63 @@ async function handleQuota(workspaceId, _agentSessionId) {
         // Never silent: a refused transition here loses the backoff two lines down.
         console.warn(`[orchestrator] Could not transition workspace '${workspaceId}' to quota:`, err);
     }
-    const retryCount = retryCounts.get(workspaceId) ?? 0;
-    const autoLoopEnabled = getWs(workspaceId)?.autoLoop === true;
-    const maxRetries = autoLoopEnabled ? (getGlobalSettings().autoLoopMaxRetries ?? 5) : 5;
-    if (autoLoopEnabled && retryCount >= maxRetries) {
-        autoLoopService.disable(workspaceId, 'error');
-        try {
-            updateWorkspaceStatus(workspaceId, 'error');
-        }
-        catch {
-            // The loop is disabled even if an already-terminal status rejects this transition.
+    // Everything below reads the settings file, the workspace row and the
+    // backoff table. Both call sites are fire-and-forget (`void handleQuota(…)`)
+    // and the process treats an unhandled rejection as fatal, so a transient
+    // failure here must not escape: hitting a quota while the database is busy
+    // would otherwise kill Kōbō and every agent running under it.
+    try {
+        const retryCount = retryCounts.get(workspaceId) ?? 0;
+        const autoLoopEnabled = getWs(workspaceId)?.autoLoop === true;
+        const maxRetries = autoLoopEnabled ? (getGlobalSettings().autoLoopMaxRetries ?? 5) : 5;
+        if (autoLoopEnabled && retryCount >= maxRetries) {
+            autoLoopService.disable(workspaceId, 'error');
+            try {
+                updateWorkspaceStatus(workspaceId, 'error');
+            }
+            catch {
+                // The loop is disabled even if an already-terminal status rejects this transition.
+            }
+            return;
         }
-        return;
+        const { delayMs, resetsAt, source } = await computeQuotaBackoffMs(workspaceId, retryCount);
+        retryCounts.set(workspaceId, retryCount + 1);
+        // The quotaBackoffService owns the timer + the persistent row + the
+        // 'agent:quota-backoff' WS emit. Hand off everything to it.
+        quotaBackoffService.arm(workspaceId, delayMs, { resetsAt: resetsAt ?? null, source, reason: 'quota' });
+    }
+    catch (err) {
+        console.error(`[orchestrator] Could not arm the quota backoff for workspace '${workspaceId}':`, err);
+        // The status was already moved to 'quota' above, and the banner offering
+        // "resume now" only renders once a backoff row exists. Leaving it there
+        // would strand the workspace waiting on a timer nobody armed, with the
+        // console line as its only trace. 'error' has a banner of its own.
+        failVisibly(workspaceId);
     }
-    const { delayMs, resetsAt, source } = await computeQuotaBackoffMs(workspaceId, retryCount);
-    retryCounts.set(workspaceId, retryCount + 1);
-    // The quotaBackoffService owns the timer + the persistent row + the
-    // 'agent:quota-backoff' WS emit. Hand off everything to it.
-    quotaBackoffService.arm(workspaceId, delayMs, { resetsAt: resetsAt ?? null, source, reason: 'quota' });
 }
+/**
+ * Last resort when the retry machinery itself fails: stop the loop and move the
+ * workspace to a status the UI actually surfaces, so the user sees something to
+ * act on instead of a workspace that has quietly stopped moving.
+ */
+function failVisibly(workspaceId) {
+    try {
+        autoLoopService.disable(workspaceId, 'error');
+    }
+    catch (err) {
+        console.error(`[orchestrator] Could not disable the auto-loop for workspace '${workspaceId}':`, err);
+    }
+    try {
+        updateWorkspaceStatus(workspaceId, 'error');
+    }
+    catch {
+        // An already-terminal status refusing this transition is fine.
+    }
+}
+/** First retry after a transient failure (watchdog recovery, HTTP 500). The
+ *  quota ladder's 15-minute floor is tuned for real quota windows — a forced
+ *  kill or a server blip deserves a much faster first attempt. */
+const TRANSIENT_FIRST_RETRY_MS = 2 * 60_000;
 /**
  * Use the same persisted retry path for temporary upstream failures (HTTP 500
  * and overloads) while deliberately ignoring quota-reset data: a server error
@@ -1813,21 +1913,30 @@ async function handleTransientAutoLoopFailure(workspaceId) {
     catch (err) {
         console.warn(`[orchestrator] Could not transition workspace '${workspaceId}' to quota for a transient failure:`, err);
     }
-    const retryCount = retryCounts.get(workspaceId) ?? 0;
-    const maxRetries = getGlobalSettings().autoLoopMaxRetries ?? 5;
-    if (retryCount >= maxRetries) {
-        autoLoopService.disable(workspaceId, 'error');
-        try {
-            updateWorkspaceStatus(workspaceId, 'error');
-        }
-        catch {
-            // The loop is disabled even if an already-terminal status rejects this transition.
+    // Same reasoning as handleQuota: fire-and-forget call sites plus a fatal
+    // unhandled-rejection policy mean a failure here must stay contained.
+    try {
+        const retryCount = retryCounts.get(workspaceId) ?? 0;
+        const maxRetries = getGlobalSettings().autoLoopMaxRetries ?? 5;
+        if (retryCount >= maxRetries) {
+            autoLoopService.disable(workspaceId, 'error');
+            try {
+                updateWorkspaceStatus(workspaceId, 'error');
+            }
+            catch {
+                // The loop is disabled even if an already-terminal status rejects this transition.
+            }
+            return;
         }
-        return;
+        const { delayMs, resetsAt, source } = await computeQuotaBackoffMs(workspaceId, retryCount, false);
+        const effectiveDelayMs = retryCount === 0 ? Math.min(delayMs, TRANSIENT_FIRST_RETRY_MS) : delayMs;
+        retryCounts.set(workspaceId, retryCount + 1);
+        quotaBackoffService.arm(workspaceId, effectiveDelayMs, { resetsAt: resetsAt ?? null, source, reason: 'transient' });
+    }
+    catch (err) {
+        console.error(`[orchestrator] Could not arm the transient retry for workspace '${workspaceId}':`, err);
+        failVisibly(workspaceId);
     }
-    const { delayMs, resetsAt, source } = await computeQuotaBackoffMs(workspaceId, retryCount, false);
-    retryCounts.set(workspaceId, retryCount + 1);
-    quotaBackoffService.arm(workspaceId, delayMs, { resetsAt: resetsAt ?? null, source, reason: 'transient' });
 }
 /** @internal test-only — re-export of `handleQuota` for direct testing. */
 export const _handleQuota = handleQuota;

package/dist/server/services/agent/session-controller.js

@@ -3,9 +3,21 @@ export class SessionController {
     agentSessionId;
     engine;
     onEvent;
+    /**
+     * Set by the orchestrator when it stops this controller on purpose. A
+     * delete or purge is about to remove the worktree, and a hook spawned in it
+     * would run in a directory being deleted — the hook path checks this.
+     */
+    stopCause;
     _engineProcess;
     _startPromise;
     _status = 'running';
+    /**
+     * Set by `stop()`. Distinct from `_status` so the check in `startEngine` is
+     * not narrowed away by the compiler: `stop()` can flip it while that method
+     * is awaiting the engine.
+     */
+    _stopRequested = false;
     /**
      * Wall-clock creation time. The watchdog needs it: `engineProcess` stays
      * undefined until `engine.start` resolves, and without a grace window any
@@ -38,6 +50,21 @@ export class SessionController {
         await this._startPromise;
     }
     async startEngine(options) {
+        // Already stopped before we got here. The orchestrator chains `start`
+        // behind a zombie eviction that can take up to STOP_AGENT_TIMEOUT_MS, and a
+        // stop landing in that window resolves immediately and reports "stopped" —
+        // so the caller (delete, purge-worktree) is already removing the worktree.
+        // Spawning into it and stopping afterwards, as the check below does, is too
+        // late; the process must never exist.
+        //
+        // Still report an end: the orchestrator already created the session row,
+        // and only session:ended closes it. Without this the row stayed `running`
+        // until the next boot — blocking deleteSession and tagging the next
+        // messages onto a ghost session.
+        if (this._stopRequested) {
+            this.handle({ kind: 'session:ended', reason: 'killed', exitCode: null });
+            return;
+        }
         const process = await this.engine.start(options, (ev) => this.handle(ev));
         this._engineProcess = process;
         if (this._status === 'stopping') {
@@ -63,6 +90,7 @@ export class SessionController {
         this._engineProcess.interrupt();
     }
     async stop() {
+        this._stopRequested = true;
         this._status = 'stopping';
         // `startEngine` may still be in flight: `_engineProcess` stays undefined
         // until `engine.start` resolves, so without this wait `stop()` would

package/dist/server/services/agent/streaming-batcher.js

@@ -19,6 +19,7 @@ export function createStreamingBatcher(emit, options = {}) {
                     return;
                 }
                 const timer = setTimeout(() => flush(event.messageId), windowMs);
+                timer.unref?.();
                 pending.set(event.messageId, { text: event.text, timer });
                 return;
             }