@saadnvd1/agent-os 0.3.466 → 0.3.468

package/README.md

@@ -908,10 +908,13 @@ it may do on its own, and the lines that always come back to you as asks.
   `BLOCKED:` or waiting, the diff stays in scope (no secrets, not only
   lockfiles, nothing outside the repo, within the card) and its stack parent
   has merged, and the PR body's Code review section names that commit. `land` judges each item again at its own head right before
-  merging it. The second failure of a gate or a repo with no CI goes to you
-  as an ask, and the orchestrator stops merging that task. Failures count per
-  task and gate: a review that blocks counts when its verdict arrives, once
-  per commit, whether or not `sign_off` ever reads it.
+  merging it. A gate failing again on a different commit, or a repo with no
+  CI, goes to you as an ask, and the orchestrator stops merging that task.
+  A failure counts once per task, gate and head commit, however many times
+  and from wherever that commit is judged (the armed watcher, CI finishing,
+  `sign_off`, `done`, `land`); a pass in between doesn't reset it. A review
+  that blocks counts when its verdict arrives, whether or not `sign_off`
+  ever reads it.
 - **Arm to merge:** `arm` (or **Arm merge** on a task's row) makes AgentOS
   merge the task's PR itself the moment every `sign_off` gate passes at its
   head, starting the review once CI is green, so nothing polls `sign_off`.

package/components/SessionList/useDoneAction.ts

@@ -27,7 +27,8 @@ export function useDoneAction() {
           id,
           duration: 8000,
           ...(!outcome.merged &&
-            outcome.worktree.action !== "removed" && {
+            outcome.worktree.action !== "removed" &&
+            outcome.worktree.action !== "gone" && {
               action: {
                 label: "Undo",
                 onClick: () => unarchive.mutate(session.id),

package/lib/db/migrations.ts

@@ -1327,6 +1327,37 @@ const migrations: Migration[] = [
       installChangeTriggers(db, TABLES_WATCHED_58);
     },
   },
+  {
+    id: 59,
+    name: "gate_failure_commits",
+    up: (db) => {
+      // Each head a gate failed on, once: a gate's failure counts once per
+      // commit however many times that commit is judged (the armed watcher,
+      // CI finishing, sign_off, done, land), and the second commit it fails
+      // on goes to Saad. The key is what makes it once, across restarts and
+      // concurrent evaluations.
+      db.exec(`
+        CREATE TABLE IF NOT EXISTS orchestrator_gate_failure_commits (
+          session_id TEXT NOT NULL,
+          gate TEXT NOT NULL,
+          sha TEXT NOT NULL,
+          workspace_id TEXT NOT NULL,
+          reason TEXT,
+          created_at TEXT NOT NULL DEFAULT (datetime('now')),
+          PRIMARY KEY (session_id, gate, sha)
+        );
+        INSERT OR IGNORE INTO orchestrator_gate_failure_commits (session_id, gate, sha, workspace_id, reason)
+          SELECT session_id, gate, last_sha, workspace_id, last_reason
+          FROM orchestrator_gate_failures WHERE last_sha IS NOT NULL;
+        CREATE TRIGGER IF NOT EXISTS gate_failures_clear_commits
+          AFTER DELETE ON orchestrator_gate_failures
+        BEGIN
+          DELETE FROM orchestrator_gate_failure_commits
+            WHERE session_id = OLD.session_id AND gate = OLD.gate;
+        END;
+      `);
+    },
+  },
 ];
 
 // `upTo`: stop after this id (tests that start from an older database).

package/lib/done/index.ts

@@ -7,7 +7,6 @@
  * and archives the session. What it will do is decided first (plan.ts).
  */
 
-import fs from "fs";
 import { db, queries, type Session } from "../db";
 import { stopChat } from "../chat/runner";
 import { hostExec } from "../hosts";
@@ -69,6 +68,7 @@ async function stopAgent(s: Session): Promise<void> {
 
 function worktreeLine(f: WorktreeFate): string {
   if (f.action === "removed") return `worktree removed (${f.why})`;
+  if (f.action === "gone") return `worktree ${f.why}`;
   if (f.action === "kept") return `worktree kept at ${f.path}: ${f.why}`;
   return "no worktree";
 }
@@ -141,7 +141,6 @@ export async function doneSession(
       `${s.name} runs on ${peer.hostName}: only you can mark it done, from its row.`
     );
   if (peer) return doneOnPeer(peer, s);
-  const hadWorktree = !!s.worktree_path && fs.existsSync(s.worktree_path);
   // A sign-off just before this (the orchestrator's sign_off, then done)
   // is still cleaning up in the background: read what it leaves.
   await mergeSettled(s.id);
@@ -173,12 +172,6 @@ export async function doneSession(
     await stopAgent(s);
     worktree = await settleWorktree(s, plan.merged);
   }
-  if (
-    hadWorktree &&
-    worktree.action === "none" &&
-    !fs.existsSync(s.worktree_path!)
-  )
-    worktree = { action: "removed", why: "its branch is merged" };
   archiveSession(s.id);
   const head = merged ?? `Done: ${s.name}.`;
   const extra = notes.length ? `, ${notes.join(", ")}` : "";

package/lib/done/plan.ts

@@ -78,6 +78,14 @@ async function taskPlan(s: Session): Promise<DonePlan> {
   return cleanup(s, "done", pr, null);
 }
 
+// A task merged before done looked (a sign-off, an armed merge): its PR's
+// head, so commits that went in with it aren't counted as unsaved once the
+// cleanup has deleted its branch on origin.
+async function mergedAs(s: Session): Promise<MergedAs> {
+  const pr = await prFor(s, true).catch(() => null);
+  return { prHead: pr?.state === "MERGED" ? (pr.head ?? null) : null };
+}
+
 export async function planDone(
   s: Session,
   callerId?: string | null
@@ -90,7 +98,8 @@ export async function planDone(
   if ((await statusOf(s)).status === "running")
     return refuse(`${s.name} is still working: wait for it, or stop it first`);
   if (s.task_status === "running") return taskPlan(s);
-  if (s.task_status === "merged") return cleanup(s, null, null, {});
+  if (s.task_status === "merged")
+    return cleanup(s, null, null, await mergedAs(s));
   return cleanup(s, null, null, null);
 }
 
@@ -105,6 +114,8 @@ export function planLine(p: DonePlan): string {
       ? `remove its worktree (${w.why})`
       : w.action === "kept"
         ? `keep its worktree: ${w.why}`
-        : "no worktree";
+        : w.action === "gone"
+          ? `its worktree is ${w.why}`
+          : "no worktree";
   return `stop it, ${tree}, archive it`;
 }

package/lib/done/worktree.ts

@@ -10,17 +10,15 @@ import { getDefaultBranch } from "../git";
 import { git as runGit } from "../git-exec";
 import { mergePolicy } from "../tasks/merge-policy";
 import { getProject } from "../projects";
-import {
-  deleteWorktree,
-  isAgentOSWorktree,
-  removalRunning,
-  removalSettled,
-} from "../worktrees";
+import { deleteWorktree, isAgentOSWorktree } from "../worktrees";
+import { removalRunning, removalSettled } from "../worktree-removal";
 import { describeChanges, unsavedChanges } from "../worktree-placed";
 
 export type WorktreeFate =
   | { action: "none" }
   | { action: "removed"; why: string }
+  // Removed, or being removed, by something else (a merge's cleanup).
+  | { action: "gone"; why: string }
   | { action: "kept"; why: string; path: string };
 
 const git = (cwd: string, ...args: string[]) =>
@@ -104,30 +102,63 @@ export type FatePreview =
 type Judged = Pick<Session, "worktree_path" | "base_branch"> &
   Partial<Pick<Session, "project_id">>;
 
+// Gone, or still going: removed by whatever else got to it first.
+const gone = (merged: MergedAs | null, still = false) => ({
+  action: "gone" as const,
+  why: `${still ? "still being" : "already"} removed${merged ? " by the merge cleanup" : ""}`,
+});
+
 // Decides without touching anything, after any removal already running
-// (a sign-off's cleanup, just before a done) has finished: a tree read
-// while git deletes it lists every deleted file as a change.
+// (a merge's cleanup, from any process) has finished: a tree read while
+// git deletes it lists every deleted file as a change.
 export async function worktreeFate(
   session: Judged,
-  merged: MergedAs | null
+  merged: MergedAs | null,
+  waitMs = 60_000
 ): Promise<FatePreview> {
   const path = session.worktree_path;
+  if (!path) return { action: "none" };
   for (;;) {
-    if (path) await removalSettled(path);
+    if (!(await removalSettled(path, waitMs))) return gone(merged, true);
+    if (!fs.existsSync(path)) return gone(merged);
     const fate = await judge(session, merged);
-    if (!path || !removalRunning(path)) return fate;
+    // A removal that started while it read: read what it leaves.
+    if (!removalRunning(path) && fs.existsSync(path)) return fate;
   }
 }
 
+// What the branch's commits would lose: why they keep the worktree, or
+// null when every one is merged, pushed or not its own.
+async function commitsKeep(
+  path: string,
+  repo: string,
+  session: Judged,
+  merged: MergedAs | null
+): Promise<string | null> {
+  if (merged) {
+    const stray = await strayCommits(path, merged).catch(() => null);
+    if (stray === null) return "its commits can't be checked";
+    if (stray > 0)
+      return `${stray} commit${stray === 1 ? " is" : "s are"} on it that the merged PR didn't include and no remote has`;
+    return null;
+  }
+  const base = session.base_branch || (await getDefaultBranch(repo));
+  const own = await ownCommits(path, base).catch(() => null);
+  if (own === null) return `its base ${base} can't be found to compare`;
+  if (own > 0)
+    return `its branch has ${own} commit${own === 1 ? "" : "s"} not merged into ${base}`;
+  return null;
+}
+
 // Uncommitted work always keeps it; a merged branch goes only if the merge
 // settings delete worktrees and every commit on it was in the merge or is
-// on a remote; an unmerged one only if it has no commits of its own.
+// on a remote; an unmerged one only if it has no commits of its own. A
+// kept one names every reason, the commits as well as the changes.
 async function judge(
   session: Judged,
   merged: MergedAs | null
 ): Promise<FatePreview> {
-  const path = session.worktree_path;
-  if (!path || !fs.existsSync(path)) return { action: "none" };
+  const path = session.worktree_path!;
   const keep = (why: string) => ({ action: "kept" as const, why, path });
   if (!isAgentOSWorktree(path)) return keep("it isn't an AgentOS worktree");
   if (merged && session.project_id) {
@@ -141,27 +172,18 @@ async function judge(
   // nobody has touched since isn't work; anything else is.
   const unsaved = await unsavedChanges(path).catch(() => null);
   if (!unsaved) return keep("its uncommitted changes can't be checked");
-  if (unsaved.length)
-    return keep(`it has uncommitted changes (${describeChanges(unsaved)})`);
-  if (merged) {
-    const stray = await strayCommits(path, merged).catch(() => null);
-    if (stray === null) return keep("its commits can't be checked");
-    if (stray > 0)
-      return keep(
-        `${stray} commit${stray === 1 ? " is" : "s are"} on it that the merged PR didn't include and no remote has`
-      );
-    return { action: "remove", why: "its branch is merged", repo };
-  }
-  const base = session.base_branch || (await getDefaultBranch(repo));
-  const own = await ownCommits(path, base).catch(() => null);
-  if (own === null) return keep(`its base ${base} can't be found to compare`);
-  if (own > 0)
-    return keep(
-      `its branch has ${own} commit${own === 1 ? "" : "s"} not merged into ${base}`
-    );
+  const why = [
+    unsaved.length
+      ? `it has uncommitted changes (${describeChanges(unsaved)})`
+      : null,
+    await commitsKeep(path, repo, session, merged),
+  ].filter((w) => w !== null);
+  if (why.length) return keep(why.join(", and "));
   return {
     action: "remove",
-    why: "its branch has no commits of its own",
+    why: merged
+      ? "its branch is merged"
+      : "its branch has no commits of its own",
     repo,
   };
 }

package/lib/orchestrator/armed.ts

@@ -229,8 +229,8 @@ async function mergeOne(
   }
   const seen = `${pr.head}:${failures(verdict.text)}`;
   if (task.merge_armed_seen === seen) return;
-  // Counted once, as sign_off would count it: a second failure of a gate
-  // goes to Saad.
+  // Counted as sign_off would count it: once per head (the database keys
+  // it), and a gate failing on a second commit goes to Saad.
   if (!stillArmed(workspaceId, task.id)) return;
   const counted = await deps.judge(workspaceId, task);
   if (counted.ok) return merge(workspaceId, task, counted, deps);

package/lib/orchestrator/brief.ts

@@ -54,7 +54,7 @@ When the base moves and a task's PR conflicts with it, AgentOS rebases it onto t
 
 Tasks are woken by AgentOS itself when a check fails on their PR's head (with the failing step and the log around the error) and when a collaborator reviews or comments on their PR, and you get one "task X woken: ..." line for each. Don't message a task about the same failure or review; act only if it doesn't fix it.
 
-"Not yet" (CI running or settling, no review of this commit yet) is not a failure: wait for the event and try again. A failure counts against the task: a review that blocks counts when its verdict arrives, once per commit, and the second failure of the same gate goes to Saad, with a note in your chat, and from then on only he merges or drops that task. Don't retry it; say so in your chat and move on. ${mergeApprovalsOn() ? APPROVALS_ON : APPROVALS_OFF} \`land\` merges a whole stack only if every open item passes the same gates, and judges each one again at its own head right before merging it.
+"Not yet" (CI running or settling, no review of this commit yet) is not a failure: wait for the event and try again. A failure counts against the task once per commit, whichever path judges that commit and however often (a review that blocks counts when its verdict arrives); the same gate failing again on a different commit goes to Saad, with a note in your chat, and from then on only he merges or drops that task. Don't retry it; say so in your chat and move on. ${mergeApprovalsOn() ? APPROVALS_ON : APPROVALS_OFF} \`land\` merges a whole stack only if every open item passes the same gates, and judges each one again at its own head right before merging it.
 
 ## Brakes
 

package/lib/orchestrator/escalate.ts

@@ -6,7 +6,6 @@ import { AskRefused, raiseAsk, workSubject } from "./asks";
 import {
   failureOf,
   markEscalated,
-  PER_COMMIT_GATES,
   recordFailure,
   type GateOutcome,
 } from "./gates";
@@ -20,7 +19,8 @@ export function escalate(
   url: string,
   sha: string | null = null
 ): string {
-  if (!failureOf(task.id, gate)) recordFailure(workspaceId, task.id, gate, why);
+  if (!failureOf(task.id, gate))
+    recordFailure(workspaceId, task.id, gate, why, sha);
   markEscalated(task.id, gate);
   let created = false;
   try {
@@ -50,8 +50,9 @@ export function escalate(
   return `Escalated to Saad: ${why}. It's on his asks list; his answer reaches you as an event. Don't retry; say so in your chat.`;
 }
 
-// Counts a gate's failure against the task; the second failure of the same
-// gate goes to Saad. A review or scope verdict counts once per commit.
+// Counts a gate's failure on this head against the task; the same gate
+// failing on a second, different head goes to Saad. The same head judged
+// again, from any path, isn't another failure.
 export function countFailure(
   workspaceId: string,
   task: { id: string; name: string },
@@ -59,12 +60,11 @@ export function countFailure(
   url: string,
   sha: string
 ): { line: string; escalated: boolean } {
-  const key = PER_COMMIT_GATES.includes(o.gate) ? sha : null;
-  const n = recordFailure(workspaceId, task.id, o.gate, o.reason ?? "", key);
+  const n = recordFailure(workspaceId, task.id, o.gate, o.reason ?? "", sha);
   const line = `- ${o.gate} failed (${n === 1 ? "first" : "again"}): ${o.reason}`;
   if (n < 2 || failureOf(task.id, o.gate)?.escalated_at)
     return { line, escalated: false };
-  const why = `the ${o.gate} gate failed twice: ${o.reason}`;
+  const why = `the ${o.gate} gate failed on two different commits: ${o.reason}`;
   return {
     line: `${line}\n  ${escalate(workspaceId, task, o.gate, why, url, sha)}`,
     escalated: true,

package/lib/orchestrator/gates.ts

@@ -2,10 +2,12 @@
  * The merge gates, ported from dispatch orchestrate. Each one passes, waits
  * (not ready yet: CI running or settling, no review of this commit yet),
  * fails, or goes straight to Saad (no CI at all). Only a failure counts
- * against the task, and the second failure of the same gate goes to Saad
- * instead of being retried. The count is per task and gate: a review that
- * blocks counts when its verdict arrives, whether or not sign_off ever
- * reads it, and reading the same commit's verdict again isn't another.
+ * against the task, and a gate failing again on a different commit goes to
+ * Saad instead of being retried. A failure counts once per task, gate and
+ * head commit, whichever path judged it (the armed watcher, CI finishing,
+ * sign_off, done, land, a review's verdict arriving): judging the same head
+ * again is never another failure. A pass doesn't reset the count, so a gate
+ * that fails on A, passes on B and fails on C has failed twice.
  */
 
 import { db } from "../db";
@@ -170,12 +172,10 @@ export interface FailureRow {
   last_sha: string | null;
 }
 
-// The gates whose failure is a verdict stored against one commit: the same
-// verdict read again is the same failure.
-export const PER_COMMIT_GATES: readonly string[] = ["review", "scope"];
-
-// Counts one failure; returns the count now. With `sha`, a failure of the
-// commit last counted for this gate isn't counted again.
+// Counts one failure; returns the count now. With `sha`, a failure is
+// counted once per commit: the (task, gate, sha) key in
+// orchestrator_gate_failure_commits decides, so neither a restart nor two
+// evaluations at once count the same head twice.
 export function recordFailure(
   workspaceId: string,
   sessionId: string,
@@ -183,14 +183,34 @@ export function recordFailure(
   reason: string,
   sha: string | null = null
 ): number {
+  return db
+    .transaction(countOnce)
+    .immediate(workspaceId, sessionId, gate, reason, sha);
+}
+
+function countOnce(
+  workspaceId: string,
+  sessionId: string,
+  gate: string,
+  reason: string,
+  sha: string | null
+): number {
+  const fresh =
+    sha === null ||
+    db
+      .prepare(
+        `INSERT OR IGNORE INTO orchestrator_gate_failure_commits (session_id, gate, sha, workspace_id, reason)
+           VALUES (?, ?, ?, ?, ?)`
+      )
+      .run(sessionId, gate, sha, workspaceId, reason).changes > 0;
   db.prepare(
     `INSERT INTO orchestrator_gate_failures (session_id, gate, workspace_id, count, last_reason, last_sha)
-     VALUES (?, ?, ?, 1, ?, ?)
-     ON CONFLICT(session_id, gate) DO UPDATE SET
-       count = count + CASE WHEN excluded.last_sha IS NOT NULL AND last_sha IS excluded.last_sha THEN 0 ELSE 1 END,
-       last_reason = excluded.last_reason,
-       last_sha = excluded.last_sha`
-  ).run(sessionId, gate, workspaceId, reason, sha);
+       VALUES (?, ?, ?, 1, ?, ?)
+       ON CONFLICT(session_id, gate) DO UPDATE SET
+         count = count + ?,
+         last_reason = excluded.last_reason,
+         last_sha = excluded.last_sha`
+  ).run(sessionId, gate, workspaceId, reason, sha, fresh ? 1 : 0);
   return failureOf(sessionId, gate)!.count;
 }
 

package/lib/orchestrator/signoff.ts

@@ -3,7 +3,7 @@
  * commit that was judged. With merge approvals on (merge-approvals.ts),
  * anything touching CI config, build and hook scripts, agent config, deploys
  * or secrets handling goes to Saad whatever the gates say. A repository with
- * no CI and a gate failing twice on a task go to him either way. Once a task
+ * no CI and a gate failing on two different commits go to him either way. Once a task
  * is with Saad the orchestrator doesn't merge it; he signs it off or drops it.
  */
 

package/lib/tasks/finish.ts

@@ -75,8 +75,14 @@ async function cleanup(
 export const signingOff = new Set<string>();
 
 // What happens after a merge: restack anything stacked on it, then remove the
-// session, worktree and branch. Kept per task so Land can wait for it.
-const afterMerge = new Map<string, Promise<void>>();
+// session, worktree and branch. Kept per task so Land and done can wait for
+// it; on globalThis because the watcher's merges run in server.ts and done in
+// a route bundle, which load this module separately.
+const g = globalThis as unknown as {
+  __agentosAfterMerge?: Map<string, Promise<void>>;
+};
+const afterMerge: Map<string, Promise<void>> = (g.__agentosAfterMerge ??=
+  new Map());
 
 async function finishMerge(
   session: Session,

package/lib/worktree-removal.ts

@@ -0,0 +1,115 @@
+/**
+ * Removals of a worktree in progress, visible to every reader. `git
+ * worktree remove` takes seconds on a tree with cloned dependencies, and a
+ * tree read halfway through lists every file it already deleted as an
+ * uncommitted change. The removal that a merge's cleanup starts runs in
+ * server.ts while done runs in a route bundle (each loads its own copy of
+ * a module) or another process, so besides the in-memory record a marker
+ * file beside the worktree says a removal is running.
+ */
+
+import fs from "fs";
+import os from "os";
+import path from "path";
+
+export interface Removal {
+  done: Promise<void>;
+  // The branch the worktree was on, read before anything was removed.
+  branch: Promise<string | null>;
+}
+
+const g = globalThis as unknown as { __agentosRemovals?: Map<string, Removal> };
+export const removals: Map<string, Removal> = (g.__agentosRemovals ??=
+  new Map());
+
+export const removalKey = (p: string) =>
+  path.resolve(p.replace(/^~/, os.homedir()));
+
+// Beside the worktree, not in it: git never lists it and the removal
+// doesn't delete it.
+export const removalMarker = (key: string) =>
+  path.join(path.dirname(key), `.${path.basename(key)}.removing`);
+
+// A marker older than this, or whose process is gone, is from a removal
+// cut short (a restart) and no longer means anything.
+const STALE_MS = 10 * 60_000;
+
+// Returns what it wrote, so only the removal that wrote it clears it.
+export function markRemoving(key: string): string | null {
+  const marker = removalMarker(key);
+  const tmp = `${marker}.${process.pid}`;
+  const body = JSON.stringify({ pid: process.pid, at: Date.now() });
+  try {
+    fs.writeFileSync(tmp, body);
+    fs.renameSync(tmp, marker);
+    return body;
+  } catch {
+    // No marker only means other processes can't see this removal.
+    return null;
+  }
+}
+
+export function unmarkRemoving(key: string, body: string): void {
+  const marker = removalMarker(key);
+  try {
+    if (fs.readFileSync(marker, "utf8") === body) fs.rmSync(marker);
+  } catch {
+    // Already gone.
+  }
+}
+
+const alive = (pid: number) => {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return (e as NodeJS.ErrnoException).code === "EPERM";
+  }
+};
+
+function markerLive(key: string): boolean {
+  let raw: string;
+  try {
+    raw = fs.readFileSync(removalMarker(key), "utf8");
+  } catch {
+    return false;
+  }
+  try {
+    const { pid, at } = JSON.parse(raw) as { pid: number; at: number };
+    return Date.now() - at < STALE_MS && alive(pid);
+  } catch {
+    return false;
+  }
+}
+
+// Whether any code path or process is removing this worktree now.
+export const removalRunning = (worktreePath: string) => {
+  const key = removalKey(worktreePath);
+  return removals.has(key) || markerLive(key);
+};
+
+const sleep = (ms: number) =>
+  new Promise<void>((r) => setTimeout(r, Math.max(0, ms)));
+
+/**
+ * Resolves once no removal of this worktree is running: true, or false
+ * when one still is after `timeoutMs`. `foreignOnly` waits only for one
+ * another process (or a copy of this module) marked.
+ */
+export async function removalSettled(
+  worktreePath: string,
+  timeoutMs = 60_000,
+  { foreignOnly = false } = {}
+): Promise<boolean> {
+  const key = removalKey(worktreePath);
+  const deadline = Date.now() + timeoutMs;
+  for (;;) {
+    const own = foreignOnly ? undefined : removals.get(key);
+    if (!own && !markerLive(key)) return true;
+    const left = deadline - Date.now();
+    if (left <= 0) return false;
+    await (own
+      ? Promise.race([own.done.catch(() => {}), sleep(left)])
+      : sleep(Math.min(250, left)));
+  }
+}

package/lib/worktrees.ts

@@ -14,6 +14,14 @@ import {
 } from "./git";
 import { installWorktreeHooks } from "./worktree-hooks";
 import { gitResult, isGitError, worktreeList } from "./git-exec";
+import {
+  markRemoving,
+  removalKey,
+  removalRunning,
+  removalSettled,
+  removals,
+  unmarkRemoving,
+} from "./worktree-removal";
 
 const git = (cwd: string, args: string[], timeout: number) =>
   gitResult(cwd, args, { timeout });
@@ -252,28 +260,10 @@ async function undoFailedAdd(
     await quiet(["branch", "-D", "--", branch]);
 }
 
-// Removals in progress, by path, with the branch each one's worktree was
-// on. `git worktree remove` takes seconds on a tree with cloned
-// dependencies, and a tree read halfway through looks like every file it
-// already deleted is an uncommitted change.
-const removing = new Map<
-  string,
-  { done: Promise<void>; branch: Promise<string | null> }
->();
-
-const removalKey = (p: string) => path.resolve(resolvePath(p));
-
-// Resolves once no removal of this worktree is running.
-export async function removalSettled(worktreePath: string): Promise<void> {
-  await removing.get(removalKey(worktreePath))?.done.catch(() => {});
-}
-
-export const removalRunning = (worktreePath: string) =>
-  removing.has(removalKey(worktreePath));
-
 /**
  * Delete a worktree and optionally its branch. A second call while one is
- * running joins it, and still deletes the branch when it asks to.
+ * running joins it, and still deletes the branch when it asks to; one
+ * another process is running is waited for first.
  */
 export function deleteWorktree(
   worktreePath: string,
@@ -282,22 +272,35 @@ export function deleteWorktree(
 ): Promise<void> {
   const key = removalKey(worktreePath);
   const repo = resolvePath(projectPath);
-  const running = removing.get(key);
+  const running = removals.get(key);
   if (running)
     return deleteBranch
       ? running.done.then(async () => dropBranch(repo, await running.branch))
       : running.done;
+  // One another process is running goes first, and keeps its own marker.
+  const foreign = removalRunning(key)
+    ? removalSettled(key, undefined, { foreignOnly: true })
+    : null;
   // Read before anything is removed.
-  const branch = git(key, ["rev-parse", "--abbrev-ref", "HEAD"], 5000).then(
-    ({ stdout }) => stdout.trim() || null,
-    () => null
-  );
+  const branch = (async () => {
+    await foreign;
+    return git(key, ["rev-parse", "--abbrev-ref", "HEAD"], 5000).then(
+      ({ stdout }) => stdout.trim() || null,
+      () => null
+    );
+  })();
+  let marker: string | null = null;
   const done = (async () => {
     await branch;
+    // Before anything is removed, so no reader catches it half-deleted.
+    marker = markRemoving(key);
     await removeWorktree(key, repo);
     if (deleteBranch) await dropBranch(repo, await branch);
-  })().finally(() => removing.delete(key));
-  removing.set(key, { done, branch });
+  })().finally(() => {
+    removals.delete(key);
+    if (marker) unmarkRemoving(key, marker);
+  });
+  removals.set(key, { done, branch });
   return done;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saadnvd1/agent-os",
-  "version": "0.3.466",
+  "version": "0.3.468",
   "description": "Self-hosted web UI for managing Claude Code sessions",
   "bin": {
     "agent-os": "scripts/agent-os"