@loicngr/kobo 1.11.27 → 1.11.29

package/dist/server/routes/workspaces.js

@@ -14,6 +14,7 @@ import * as autoLoopService from '../services/auto-loop-service.js';
 import { changeSourceBranch } from '../services/change-source-branch-service.js';
 import { listChatHistory, pushChatHistory } from '../services/chat-history-service.js';
 import { renderCiFixTemplate } from '../services/ci-fix-template-service.js';
+import { computeWorkspaceActivityStats } from '../services/comparison-stats-service.js';
 import * as cronService from '../services/cron-service.js';
 import * as devServerService from '../services/dev-server-service.js';
 import { buildEngineHandoff } from '../services/engine-handoff-service.js';
@@ -44,6 +45,7 @@ import * as gitOps from '../utils/git-ops.js';
 import { logError } from '../utils/logger.js';
 import { slugifyProjectName } from '../utils/project-slug.js';
 import * as safePath from '../utils/safe-path.js';
+import { resolveExtractedName } from '../utils/workspace-name.js';
 import { resolveSiblingWorkspaceWorktreePath } from '../utils/worktree-paths.js';
 /** Hono sub-router for workspace CRUD, tasks, agent lifecycle, git operations, and PR creation. */
 const app = new Hono();
@@ -231,26 +233,6 @@ function parsePrNumberFromUrl(prUrl) {
     }
     return number;
 }
-// Mirrors the private `WORKSPACE_NAME_MAX_LENGTH` in workspace-service.ts —
-// duplicated rather than exported to avoid coupling this route to that
-// module's internals (and the many `vi.mock(workspace-service.js, factory)`
-// test files that would otherwise need updating for an export nothing else
-// consumes).
-const WORKSPACE_NAME_MAX_LENGTH = 200;
-/**
- * Cap an auto-derived title (Notion page title, Sentry issue title, PR/MR
- * title) before handing it to `updateWorkspaceName`. That function throws on
- * anything longer — the right behaviour for a name the user typed
- * themselves, but titles pulled from an external source (a long exception
- * message, a verbose PR title) are not user input: truncating them is the
- * sane default, matching the existing `slugifyBranchSegment` precedent for
- * auto-derived branch names.
- */
-function truncateWorkspaceName(name) {
-    if (name.length <= WORKSPACE_NAME_MAX_LENGTH)
-        return name;
-    return `${name.slice(0, WORKSPACE_NAME_MAX_LENGTH - 1)}…`;
-}
 app.get('/', (c) => {
     try {
         const workspaces = workspaceService.listWorkspaces();
@@ -265,7 +247,7 @@ app.get('/', (c) => {
 app.post('/:id/engine-handoff-preview', migrationGuard, async (c) => {
     try {
         const id = c.req.param('id');
-        const body = await c.req.json();
+        const body = await c.req.json().catch(() => ({}));
         const workspace = workspaceService.getWorkspaceWithTasks(id);
         if (!workspace)
             return c.json({ error: `Workspace '${id}' not found` }, 404);
@@ -282,7 +264,9 @@ app.post('/:id/engine-handoff-preview', migrationGuard, async (c) => {
 app.post('/:id/switch-engine', migrationGuard, async (c) => {
     try {
         const id = c.req.param('id');
-        const body = await c.req.json();
+        const body = await c.req
+            .json()
+            .catch(() => ({}));
         const workspace = workspaceService.getWorkspaceWithTasks(id);
         if (!workspace)
             return c.json({ error: `Workspace '${id}' not found` }, 404);
@@ -340,7 +324,9 @@ app.post('/', migrationGuard, async (c) => {
     // can read it to decide whether the setup-script caveat applies.
     let setupScriptConfigured = false;
     try {
-        const body = await c.req.json();
+        const body = await c.req
+            .json()
+            .catch(() => ({}));
         // workingBranch is derived from git when worktreePath is provided, so
         // it's not required in that flow. The other 3 fields stay mandatory.
         if (!body.name || !body.projectPath || !body.sourceBranch) {
@@ -357,6 +343,14 @@ app.post('/', migrationGuard, async (c) => {
         if (body.workingBranch && !gitOps.isValidBranchName(body.workingBranch)) {
             return c.json({ error: `Invalid working branch name: ${body.workingBranch}` }, 400);
         }
+        // Same reasoning for the source branch, which is always caller-supplied and
+        // reaches `git fetch <remote> <sourceBranch>` as a bare argument.
+        if (!gitOps.isValidBranchName(body.sourceBranch)) {
+            return c.json({ error: `Invalid source branch name: ${body.sourceBranch}` }, 400);
+        }
+        if (body.comparisonId !== undefined && typeof body.comparisonId !== 'string') {
+            return c.json({ error: 'comparisonId must be a string' }, 400);
+        }
         creationId = typeof body.creationId === 'string' && body.creationId.length > 0 ? body.creationId : undefined;
         currentStep = 'validate';
         emitCreateProgress(creationId, currentStep);
@@ -397,7 +391,7 @@ app.post('/', migrationGuard, async (c) => {
         let baseRef = `origin/${body.sourceBranch}`;
         let usedLocalFallback = false;
         try {
-            gitOps.fetchSourceBranch(body.projectPath, body.sourceBranch);
+            await gitOps.fetchSourceBranchOrThrowAsync(body.projectPath, body.sourceBranch);
         }
         catch (err) {
             const message = err instanceof Error ? err.message : String(err);
@@ -603,7 +597,13 @@ app.post('/', migrationGuard, async (c) => {
                     .replace(/^-|-$/g, '')
                     .substring(0, 50);
                 const safeSlug = titleSlug || 'task';
-                workingBranch = ticketPrefix ? `${typePrefix}${ticketPrefix}--${safeSlug}` : `${typePrefix}${safeSlug}`;
+                // An engine comparison posts here once per engine with the same
+                // ticket: without the suffix both halves collapse onto one branch and
+                // the second gets a random hash instead of its engine.
+                const engineSuffix = body.comparisonId && body.engine ? `-${body.engine}` : '';
+                workingBranch = ticketPrefix
+                    ? `${typePrefix}${ticketPrefix}--${safeSlug}${engineSuffix}`
+                    : `${typePrefix}${safeSlug}${engineSuffix}`;
             }
         }
         // Compute the project slug once and reuse it for both the prospective
@@ -661,6 +661,9 @@ app.post('/', migrationGuard, async (c) => {
             reasoningEffort: body.reasoningEffort,
             agentPermissionMode: resolveCreateAgentPermissionMode(body.agentPermissionMode, body.projectPath, globalSettings, body.engine ?? 'claude-code'),
             engine: body.engine,
+            // Set by the engine-comparison flow, which posts here once per engine
+            // with the same id so the resulting workspaces can find each other.
+            comparisonId: body.comparisonId,
             ...(useReusedWorktree ? {} : { worktreesPath: globalSettings.worktreesPath }),
         });
         createdWorkspace = workspace;
@@ -706,9 +709,11 @@ app.post('/', migrationGuard, async (c) => {
         // a custom name and Notion hasn't already filled it. Prefix with the Sentry
         // short-id (e.g. "SEKUR-IOS-9 | TypeError: …") so the workspace stays
         // identifiable in the sidebar without opening the panel.
-        if (sentryContent?.title && !notionContent?.title && workspace.name === 'workspace') {
+        if (sentryContent?.title && !notionContent?.title) {
             const prefix = sentryContent.issueId ? `${sentryContent.issueId} | ` : '';
-            workspace = workspaceService.updateWorkspaceName(workspace.id, truncateWorkspaceName(`${prefix}${sentryContent.title}`));
+            const renamed = resolveExtractedName(workspace.name, `${prefix}${sentryContent.title}`);
+            if (renamed)
+                workspace = workspaceService.updateWorkspaceName(workspace.id, renamed);
         }
         currentStep = 'create-tasks';
         emitCreateProgress(creationId, currentStep);
@@ -732,16 +737,20 @@ app.post('/', migrationGuard, async (c) => {
             // Update workspace name with Notion page title only if user didn't
             // provide a custom name. Prefix with the Notion unique-id (e.g.
             // Use the Notion page title when the user left the generic placeholder.
-            if (notionContent.title && workspace.name === 'workspace') {
-                workspace = workspaceService.updateWorkspaceName(workspace.id, truncateWorkspaceName(notionContent.title));
+            if (notionContent.title) {
+                const renamed = resolveExtractedName(workspace.name, notionContent.title);
+                if (renamed)
+                    workspace = workspaceService.updateWorkspaceName(workspace.id, renamed);
             }
         }
         // Update workspace name with the PR/MR title if the user did not provide
         // a custom name and neither Notion nor Sentry already claimed it. This
         // makes the PR a THIRD context source, lowest priority of the three
         // (Notion > Sentry > PR), consistent with the checks above.
-        if (prContent && !notionContent?.title && !sentryContent?.title && workspace.name === 'workspace') {
-            workspace = workspaceService.updateWorkspaceName(workspace.id, truncateWorkspaceName(prContent.title));
+        if (prContent && !notionContent?.title && !sentryContent?.title) {
+            const renamed = resolveExtractedName(workspace.name, prContent.title);
+            if (renamed)
+                workspace = workspaceService.updateWorkspaceName(workspace.id, renamed);
         }
         // Create manual tasks/criteria if no Notion content was extracted
         if (!notionContent && (Array.isArray(body.tasks) || Array.isArray(body.acceptanceCriteria))) {
@@ -814,6 +823,11 @@ app.post('/', migrationGuard, async (c) => {
                 ['.ai/thoughts/', 'thoughts/'],
                 ['.ai/images/', 'images/'],
                 ['.ai/.setup-script.tmp', '.setup-script.tmp'],
+                ['.ai/.cleanup-script.tmp', '.cleanup-script.tmp'],
+                ['.ai/.archive-script.tmp', '.archive-script.tmp'],
+                // A crash mid-hook leaves the temp script behind; the next agent
+                // would otherwise happily commit it.
+                ['.ai/.hook-*.tmp', '.hook-*.tmp'],
                 ['.mcp.json', ''],
             ];
             const toAdd = [];
@@ -1401,6 +1415,40 @@ app.get('/info', (c) => {
         return c.json({ error: message }, 500);
     }
 });
+// GET /api/workspaces/:id/comparison — the workspaces running the same task on
+// another engine, with the diff each one produced. Reads the git-stats cache the
+// pr-watcher already maintains rather than shelling out to git twice per request.
+app.get('/:id/comparison', (c) => {
+    const id = c.req.param('id');
+    try {
+        const workspace = workspaceService.getWorkspace(id);
+        if (!workspace)
+            return c.json({ error: `Workspace '${id}' not found` }, 404);
+        if (!workspace.comparisonId)
+            return c.json({ comparisonId: null, members: [] });
+        const stats = getAllGitStats();
+        const members = workspaceService.listComparisonMembers(workspace.comparisonId).map((member) => {
+            // Same count as the auto-loop badge: every task, acceptance criteria
+            // included. How finely each engine planned the task is visible before
+            // a single line of code is, and it colours every later number.
+            const tasks = workspaceService.listTasks(member.id);
+            return {
+                workspace: member,
+                // Null, not zeros: "not measured yet" and "changed nothing" are
+                // different answers, and only one of them is true here.
+                gitStats: stats[member.id] ?? null,
+                tasks: { done: tasks.filter((t) => t.status === 'done').length, total: tasks.length },
+                // What it took: messages, questions, tools, tokens, over every session.
+                activity: computeWorkspaceActivityStats(getDb(), member.id),
+            };
+        });
+        return c.json({ comparisonId: workspace.comparisonId, members });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return c.json({ error: message }, 500);
+    }
+});
 // POST /api/workspaces/pr-snapshot/refresh/:id — on-demand refresh of a single
 // workspace's PR snapshot, driven by the Git tab refresh button. Static prefix
 // keeps it ahead of `/:id` in the Hono matcher.
@@ -1458,7 +1506,13 @@ app.get('/auto-loop-states', (c) => {
 // GET /api/workspaces/:id/auto-loop — current auto-loop status for one workspace.
 app.get('/:id/auto-loop', (c) => {
     try {
-        return c.json(autoLoopService.getStatus(c.req.param('id')));
+        const id = c.req.param('id');
+        // getStatus returns a default row for an unknown id, so without this the
+        // caller gets a cheerful `auto_loop: false` for a workspace that does not
+        // exist — the neighbouring handlers all 404.
+        if (!workspaceService.getWorkspace(id))
+            return c.json({ error: `Workspace '${id}' not found` }, 404);
+        return c.json(autoLoopService.getStatus(id));
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
@@ -1848,7 +1902,9 @@ app.post('/:id/tasks', async (c) => {
         if (!workspace) {
             return c.json({ error: `Workspace '${id}' not found` }, 404);
         }
-        const body = await c.req.json();
+        const body = await c.req
+            .json()
+            .catch(() => ({}));
         if (!body.title?.trim()) {
             return c.json({ error: 'Title is required' }, 400);
         }
@@ -1879,7 +1935,9 @@ app.patch('/:id/tasks/:taskId', async (c) => {
         if (!task) {
             return c.json({ error: `Task '${taskId}' not found in workspace '${id}'` }, 404);
         }
-        const body = await c.req.json();
+        const body = await c.req
+            .json()
+            .catch(() => ({}));
         if (body.status === undefined && body.title === undefined) {
             return c.json({ error: 'At least one of status or title is required' }, 400);
         }
@@ -2075,6 +2133,59 @@ function readableHistorySearchResult(type, rawPayload, query) {
         snippet: `${start > 0 ? '…' : ''}${text.slice(start, end).replace(/\s+/g, ' ').trim()}${end < text.length ? '…' : ''}`,
     };
 }
+/**
+ * GET /api/workspaces/:id/sessions/:sessionId/summary — why a session ended.
+ *
+ * A session can stop for many reasons (quota, transient failure, drain
+ * watchdog, auto-loop stall, failed resume, manual stop, natural end) and none
+ * of them were legible after the fact: you had to read the event feed to work
+ * out what happened overnight. Everything here is already collected —
+ * `agent_sessions` and `session_event_metrics` — it was just never put in one
+ * place. Note that `end_reason` itself only records four values (completed /
+ * error / killed / watchdog); quota, stall and failed resume are visible
+ * through the workspace status and the auto-loop events, not through it.
+ */
+app.get('/:id/sessions/:sessionId/summary', (c) => {
+    try {
+        const id = c.req.param('id');
+        const sessionId = c.req.param('sessionId');
+        if (!workspaceService.getWorkspace(id))
+            return c.json({ error: `Workspace '${id}' not found` }, 404);
+        const db = getDb();
+        const session = db
+            .prepare(`SELECT id, engine, model, status, end_reason, started_at, ended_at
+           FROM agent_sessions WHERE id = ? AND workspace_id = ?`)
+            .get(sessionId, id);
+        if (!session)
+            return c.json({ error: `Session '${sessionId}' not found` }, 404);
+        const metrics = db
+            .prepare(`SELECT tool_calls, errors, input_tokens, output_tokens
+           FROM session_event_metrics WHERE workspace_id = ? AND session_id = ?`)
+            .get(id, sessionId);
+        const startedAt = Date.parse(session.started_at);
+        const endedAt = session.ended_at ? Date.parse(session.ended_at) : null;
+        return c.json({
+            sessionId: session.id,
+            engine: session.engine,
+            model: session.model,
+            status: session.status,
+            // Null for sessions that ended before this was recorded, and for one
+            // still running. The client says "unknown" rather than inventing a cause.
+            endReason: session.end_reason,
+            startedAt: session.started_at,
+            endedAt: session.ended_at,
+            durationMs: endedAt !== null && !Number.isNaN(startedAt) ? endedAt - startedAt : null,
+            toolCalls: metrics?.tool_calls ?? 0,
+            errors: metrics?.errors ?? 0,
+            inputTokens: metrics?.input_tokens ?? 0,
+            outputTokens: metrics?.output_tokens ?? 0,
+        });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return c.json({ error: message }, 500);
+    }
+});
 // GET /api/workspaces/:id/session-metrics — compact observability data for the timeline.
 app.get('/:id/session-metrics', (c) => {
     try {
@@ -2118,15 +2229,22 @@ app.get('/:id/diagnostic.json', (c) => {
         const sessions = db
             .prepare('SELECT id, engine_session_id, status, started_at, ended_at, model, name FROM agent_sessions WHERE workspace_id = ? ORDER BY started_at ASC')
             .all(id);
+        // Bounded on purpose: better-sqlite3 is synchronous, so an unbounded read
+        // materialises every event the workspace ever produced and blocks the
+        // event loop while `c.json` serialises them. A diagnostic bundle wants a
+        // representative trace, not the entire history.
+        const DIAGNOSTIC_EVENT_LIMIT = 50_000;
         const events = db
-            .prepare('SELECT id, session_id, type, created_at FROM ws_events WHERE workspace_id = ? ORDER BY rowid ASC')
-            .all(id);
+            .prepare('SELECT id, session_id, type, created_at FROM ws_events WHERE workspace_id = ? ORDER BY rowid ASC LIMIT ?')
+            .all(id, DIAGNOSTIC_EVENT_LIMIT);
+        const eventsTruncated = events.length === DIAGNOSTIC_EVENT_LIMIT;
         c.header('Content-Disposition', `attachment; filename="${workspace.name.replace(/[^a-z0-9]+/gi, '-').toLowerCase() || id}-diagnostic.json"`);
         return c.json({
             generatedAt: new Date().toISOString(),
             workspace: { id, name: workspace.name, engine: workspace.engine },
             sessions,
             events,
+            eventsTruncated,
         });
     }
     catch (err) {
@@ -2218,21 +2336,24 @@ app.get('/:id/events', (c) => {
                 if (firstRow) {
                     const older = session
                         ? db
-                            .prepare('SELECT COUNT(*) as c FROM ws_events WHERE workspace_id = ? AND (session_id = ? OR session_id IS NULL) AND rowid < ?')
+                            .prepare('SELECT 1 as c FROM ws_events WHERE workspace_id = ? AND (session_id = ? OR session_id IS NULL) AND rowid < ? LIMIT 1')
                             .get(id, session, firstRow.rowid)
                         : db
-                            .prepare('SELECT COUNT(*) as c FROM ws_events WHERE workspace_id = ? AND rowid < ?')
+                            .prepare('SELECT 1 as c FROM ws_events WHERE workspace_id = ? AND rowid < ? LIMIT 1')
                             .get(id, firstRow.rowid);
-                    hasMore = older.c > 0;
+                    hasMore = older !== undefined;
                 }
             }
             else {
-                const total = session
+                // `LIMIT 1 OFFSET <page size>` answers "is there anything past this
+                // page?" by reading one row, where COUNT(*) walked every event the
+                // workspace ever produced — on each page, synchronously.
+                const beyond = session
                     ? db
-                        .prepare('SELECT COUNT(*) as c FROM ws_events WHERE workspace_id = ? AND (session_id = ? OR session_id IS NULL)')
-                        .get(id, session)
-                    : db.prepare('SELECT COUNT(*) as c FROM ws_events WHERE workspace_id = ?').get(id);
-                hasMore = total.c > rows.length;
+                        .prepare('SELECT 1 as c FROM ws_events WHERE workspace_id = ? AND (session_id = ? OR session_id IS NULL) LIMIT 1 OFFSET ?')
+                        .get(id, session, rows.length)
+                    : db.prepare('SELECT 1 as c FROM ws_events WHERE workspace_id = ? LIMIT 1 OFFSET ?').get(id, rows.length);
+                hasMore = beyond !== undefined;
             }
         }
         return c.json({ events, hasMore });
@@ -2427,7 +2548,7 @@ app.delete('/:id/pr-watch-disabled', async (c) => {
 app.put('/:id/tags', async (c) => {
     const { id } = c.req.param();
     try {
-        const body = await c.req.json();
+        const body = await c.req.json().catch(() => ({}));
         if (!Array.isArray(body.tags)) {
             return c.json({ error: 'tags must be an array of strings' }, 400);
         }
@@ -2664,26 +2785,31 @@ app.post('/:id/run-setup-script', async (c) => {
         if (setupScriptRunning.has(id)) {
             return c.json({ error: 'Setup script is already running for this workspace' }, 409);
         }
-        // Stop the running agent before re-running the setup script — the script
-        // rewrites the worktree the agent may still be writing to.
-        try {
-            if (agentManager.getAgentStatus(id)) {
-                await agentManager.stopAgentAndWait(id);
-            }
-        }
-        catch (err) {
-            console.error(`[workspaces] stopAgentAndWait before setup script failed for '${id}':`, err);
-        }
-        const effectiveSettings = settingsService.getEffectiveSettings(workspace.projectPath);
-        if (!effectiveSettings.setupScript) {
-            return c.json({ error: 'No setup script configured' }, 400);
-        }
-        const worktreePath = workspace.worktreePath;
-        if (!fs.existsSync(worktreePath)) {
-            return c.json({ error: `Worktree path does not exist: ${worktreePath}` }, 400);
-        }
+        // Claim before the first await. Checking here and claiming after the agent
+        // stop below let two concurrent calls both pass the check and then run the
+        // user's script twice, concurrently, in the same worktree.
         setupScriptRunning.add(id);
+        // Everything below releases the claim, including the validation failures:
+        // a workspace left marked as running would refuse every later attempt.
         try {
+            // Stop the running agent before re-running the setup script — the script
+            // rewrites the worktree the agent may still be writing to.
+            try {
+                if (agentManager.getAgentStatus(id)) {
+                    await agentManager.stopAgentAndWait(id);
+                }
+            }
+            catch (err) {
+                console.error(`[workspaces] stopAgentAndWait before setup script failed for '${id}':`, err);
+            }
+            const effectiveSettings = settingsService.getEffectiveSettings(workspace.projectPath);
+            if (!effectiveSettings.setupScript) {
+                return c.json({ error: 'No setup script configured' }, 400);
+            }
+            const worktreePath = workspace.worktreePath;
+            if (!fs.existsSync(worktreePath)) {
+                return c.json({ error: `Worktree path does not exist: ${worktreePath}` }, 400);
+            }
             const result = await runSetupScript(workspace.id, worktreePath, effectiveSettings.setupScript, {
                 workspaceName: workspace.name,
                 branchName: workspace.workingBranch,
@@ -2802,7 +2928,7 @@ async function deleteWorkspaceWithSideEffects(workspace, opts) {
     // a few lines below: firing and forgetting here pulled the directory from
     // under an agent still writing to it, destroying uncommitted work.
     try {
-        await agentManager.stopAgentAndWait(workspace.id);
+        await agentManager.stopAgentAndWait(workspace.id, undefined, 'delete');
     }
     catch (err) {
         console.error(`[workspaces] stopAgentAndWait during delete failed for '${workspace.name}':`, err);
@@ -3185,7 +3311,7 @@ app.post('/:id/rollback-file', async (c) => {
         if (!workspace) {
             return c.json({ error: `Workspace '${id}' not found` }, 404);
         }
-        const body = await c.req.json();
+        const body = await c.req.json().catch(() => ({}));
         const filePath = typeof body?.path === 'string' ? body.path.trim() : '';
         if (!filePath) {
             return c.json({ error: 'Missing or invalid `path` field' }, 400);
@@ -3427,10 +3553,10 @@ app.post('/:id/push', async (c) => {
             // no-options call shape identical to before for callers/tests that
             // assert on argument count.
             if (force) {
-                gitOps.pushBranch(worktreePath, workspace.workingBranch, { force: true });
+                await gitOps.pushBranchAsync(worktreePath, workspace.workingBranch, { force: true });
             }
             else {
-                gitOps.pushBranch(worktreePath, workspace.workingBranch);
+                await gitOps.pushBranchAsync(worktreePath, workspace.workingBranch);
             }
         }
         catch (err) {
@@ -3449,14 +3575,14 @@ app.post('/:id/push', async (c) => {
 });
 // POST /api/workspaces/:id/fetch — git fetch the workspace repo (all branches of origin).
 // Read-only: updates remote-tracking refs, never touches the working tree.
-app.post('/:id/fetch', (c) => {
+app.post('/:id/fetch', async (c) => {
     try {
         const id = c.req.param('id');
         const workspace = workspaceService.getWorkspace(id);
         if (!workspace) {
             return c.json({ error: `Workspace '${id}' not found` }, 404);
         }
-        gitOps.fetchAllBranches(workspace.worktreePath);
+        await gitOps.fetchAllBranchesAsync(workspace.worktreePath);
         return c.json({ ok: true });
     }
     catch (err) {
@@ -3465,7 +3591,7 @@ app.post('/:id/fetch', (c) => {
     }
 });
 // POST /api/workspaces/:id/pull — pull working branch from origin (fast-forward only)
-app.post('/:id/pull', (c) => {
+app.post('/:id/pull', async (c) => {
     try {
         const id = c.req.param('id');
         const workspace = workspaceService.getWorkspace(id);
@@ -3475,7 +3601,7 @@ app.post('/:id/pull', (c) => {
         const worktreePath = workspace.worktreePath;
         const autostash = c.req.query('autostash') === '1';
         try {
-            gitOps.pullBranch(worktreePath, workspace.workingBranch, 'origin', { autostash });
+            await gitOps.pullBranchAsync(worktreePath, workspace.workingBranch, 'origin', { autostash });
         }
         catch (err) {
             if (err instanceof gitOps.DirtyWorktreeError) {
@@ -3495,7 +3621,7 @@ app.post('/:id/pull', (c) => {
     }
 });
 /** Rebase the workspace branch onto its source branch. */
-app.post('/:id/rebase', (c) => {
+app.post('/:id/rebase', async (c) => {
     try {
         const id = c.req.param('id');
         const workspace = workspaceService.getWorkspace(id);
@@ -3503,7 +3629,7 @@ app.post('/:id/rebase', (c) => {
             return c.json({ error: `Workspace '${id}' not found` }, 404);
         const autostash = c.req.query('autostash') === '1';
         const worktreePath = workspace.worktreePath;
-        gitOps.rebaseBranch(worktreePath, workspace.sourceBranch, { autostash });
+        await gitOps.rebaseBranchAsync(worktreePath, workspace.sourceBranch, { autostash });
         return c.json({ success: true });
     }
     catch (err) {
@@ -3518,7 +3644,7 @@ app.post('/:id/rebase', (c) => {
     }
 });
 /** Merge the source branch into the workspace branch (non-fast-forward). */
-app.post('/:id/merge', (c) => {
+app.post('/:id/merge', async (c) => {
     try {
         const id = c.req.param('id');
         const workspace = workspaceService.getWorkspace(id);
@@ -3526,7 +3652,7 @@ app.post('/:id/merge', (c) => {
             return c.json({ error: `Workspace '${id}' not found` }, 404);
         const autostash = c.req.query('autostash') === '1';
         const worktreePath = workspace.worktreePath;
-        gitOps.mergeBranch(worktreePath, workspace.sourceBranch, { autostash });
+        await gitOps.mergeBranchAsync(worktreePath, workspace.sourceBranch, { autostash });
         return c.json({ success: true });
     }
     catch (err) {
@@ -3719,9 +3845,14 @@ Start now.`;
 app.post('/:id/change-pr-base', async (c) => {
     try {
         const id = c.req.param('id');
-        const body = await c.req.json();
+        const body = await c.req.json().catch(() => ({}));
         if (!body.base)
             return c.json({ error: 'Missing base parameter' }, 400);
+        // Forwarded to `gh pr edit --base <base>` / the GitLab equivalent, so a
+        // name starting with `-` would read as a CLI option rather than a branch.
+        if (!gitOps.isValidBranchName(body.base)) {
+            return c.json({ error: `Invalid base branch name: ${body.base}` }, 400);
+        }
         const workspace = workspaceService.getWorkspace(id);
         if (!workspace)
             return c.json({ error: `Workspace '${id}' not found` }, 404);
@@ -3814,9 +3945,14 @@ app.post('/:id/change-source-branch', async (c) => {
     const id = c.req.param('id');
     const workspace = workspaceService.getWorkspace(id);
     try {
-        const body = await c.req.json();
+        const body = await c.req.json().catch(() => ({}));
         if (!body.newBase)
             return c.json({ error: 'Missing newBase parameter' }, 400);
+        // Reaches git (fetch/reset/cherry-pick) and the forge CLI as a bare
+        // argument, and is exported to the custom script as KOBO_NEW_BASE.
+        if (!gitOps.isValidBranchName(body.newBase)) {
+            return c.json({ error: `Invalid source branch name: ${body.newBase}` }, 400);
+        }
         if (!workspace)
             return c.json({ error: `Workspace '${id}' not found` }, 404);
         const result = await changeSourceBranch(id, body.newBase);
@@ -3847,9 +3983,15 @@ app.post('/:id/change-source-branch', async (c) => {
 app.post('/:id/cancel-source-change', async (c) => {
     try {
         const id = c.req.param('id');
-        const body = await c.req.json();
+        const body = await c.req.json().catch(() => ({}));
         if (!body.previousBase)
             return c.json({ error: 'Missing previousBase parameter' }, 400);
+        // Persisted as the workspace source branch, and from there it reaches
+        // `git fetch origin <sourceBranch>` as a bare argument — including from a
+        // plain visit to the Diff tab, with no further user action.
+        if (!gitOps.isValidBranchName(body.previousBase)) {
+            return c.json({ error: `Invalid source branch name: ${body.previousBase}` }, 400);
+        }
         const workspace = workspaceService.getWorkspace(id);
         if (!workspace)
             return c.json({ error: `Workspace '${id}' not found` }, 404);
@@ -3877,13 +4019,13 @@ app.post('/:id/cancel-source-change', async (c) => {
     }
 });
 /** Force-push the working branch with --force-with-lease (after a history rewrite). */
-app.post('/:id/force-push', (c) => {
+app.post('/:id/force-push', async (c) => {
     try {
         const id = c.req.param('id');
         const workspace = workspaceService.getWorkspace(id);
         if (!workspace)
             return c.json({ error: `Workspace '${id}' not found` }, 404);
-        gitOps.pushBranch(workspace.worktreePath, workspace.workingBranch, { force: true });
+        await gitOps.pushBranchAsync(workspace.worktreePath, workspace.workingBranch, { force: true });
         return c.json({ success: true });
     }
     catch (err) {

package/dist/server/services/agent/engines/claude-code/engine.js

@@ -155,6 +155,7 @@ export function createClaudeCodeEngine() {
                         return;
                     }
                     ctx.signal.addEventListener('abort', onAbort, { once: true });
+                    resolver.cleanup = () => ctx.signal.removeEventListener('abort', onAbort);
                     onEvent({
                         kind: 'session:user-input-requested',
                         requestKind,
@@ -555,6 +556,7 @@ export function createClaudeCodeEngine() {
                     // covers natural iterator completion.
                     for (const resolver of pendingResolvers.values()) {
                         try {
+                            resolver.cleanup?.();
                             resolver.resolve({ behavior: 'deny', message: 'session ended', interrupt: false });
                         }
                         catch {
@@ -634,6 +636,7 @@ export function createClaudeCodeEngine() {
                     if (!resolver)
                         return false;
                     pendingResolvers.delete(toolCallId);
+                    resolver.cleanup?.();
                     // Re-evaluate rather than unconditionally resuming: a sibling
                     // request, a still-active subagent, or an in-progress compaction
                     // may each still have their own legitimate reason to keep the

package/dist/server/services/agent/engines/codex/engine.js

@@ -12,6 +12,8 @@ import { spawnAppServer } from './spawn.js';
 /** Long enough for normal tool work, short enough to recover a lost turn event. */
 export const CODEX_TURN_IDLE_TIMEOUT_MS = 120_000;
 export const CODEX_GRACEFUL_INTERRUPT_TIMEOUT_MS = 3_000;
+/** Grace given to a SIGTERM before the child is killed outright. */
+const CODEX_FORCE_KILL_TIMEOUT_MS = 3_000;
 // Safety net while `turnLiveness` is paused for background subagents: that
 // pause is deliberately unbounded (a legitimate subagent can run long), but
 // if a thread never reports a terminal status (dropped notification, or the
@@ -508,6 +510,22 @@ export function createCodexEngine() {
                     catch {
                         // swallow
                     }
+                    // Escalate. The SIGTERM in the `finally` below is a request, not a
+                    // guarantee: a wedged `codex app-server` that ignores it outlives the
+                    // stop, the archive, the delete and Kōbō's own shutdown, holding the
+                    // worktree and its share of the model quota, with nothing left in
+                    // this process tracking it.
+                    if (child.exitCode === null && child.signalCode === null) {
+                        child.kill('SIGTERM');
+                        const exited = await Promise.race([
+                            new Promise((resolve) => child.once('exit', () => resolve(true))),
+                            wait(CODEX_FORCE_KILL_TIMEOUT_MS).then(() => false),
+                        ]);
+                        if (!exited) {
+                            console.warn('[codex] app-server ignored SIGTERM — sending SIGKILL');
+                            child.kill('SIGKILL');
+                        }
+                    }
                 },
                 resolvePendingUserInput(callId, response) {
                     const pending = pendingByCallId.get(callId);