@saadnvd1/agent-os 0.3.477 → 0.3.479

package/lib/orchestrator/task-state.ts

@@ -17,6 +17,8 @@ import { untrusted } from "./untrusted";
 export async function waitingState(
   task: Session
 ): Promise<{ blocked: string | null; waitingOn: string | null }> {
+  // A quick change has no agent to block or ask: the orchestrator makes it.
+  if (task.quick_of) return { blocked: null, waitingOn: null };
   // A linked machine's chat lives in that machine's store, not this one's:
   // its own reading of the task is asked for, fresh.
   const link = hostLink(task.host_id);

package/lib/orchestrator/tool-names.ts

@@ -16,6 +16,8 @@ export const TOOL_NAMES = {
   start_task: name("start_task"),
   set_task_model: name("set_task_model"),
   start_session: name("start_session"),
+  quick_change: name("quick_change"),
+  quick_pr: name("quick_pr"),
   stack: name("stack"),
   stack_status: name("stack_status"),
   land: name("land"),
@@ -39,8 +41,11 @@ export const TOOL_NAMES = {
 // braked; the shell keeps only `aos` commands that read, and notify, which
 // reaches only Saad, so `aos send`, `task`, `spawn` and `stack` can't go
 // around them. It writes files, but never in a project repository, a task
-// worktree, AgentOS's own state or a secret file: its worker checks each
-// write first (write-guard.ts).
+// worktree, AgentOS's own state or a secret file, except inside its own
+// quick changes' worktrees (quick.ts), where it may also run git that
+// looks, stages or undoes, never commits with hooks or pushes: its worker
+// checks each write and each shell command first (write-guard.ts,
+// git-guard.ts).
 export const ORCHESTRATOR_PERMISSIONS: {
   permissionMode: PermissionMode;
   allowedTools: string[];
@@ -67,6 +72,8 @@ export const ORCHESTRATOR_PERMISSIONS: {
     "Bash(aos notify:*)",
     "Bash(aos docs:*)",
     "Bash(aos doc:*)",
+    // Only `git -C <its own quick worktree>`, refused anywhere else.
+    "Bash(git:*)",
   ],
   disallowedTools: [],
 };

package/lib/orchestrator/tool-schemas.ts

@@ -135,6 +135,32 @@ export const TOOL_SHAPES = {
       .describe("A short name, 2-6 words (default: one made from the prompt)"),
     view,
   },
+  quick_change: {
+    project,
+    name: z
+      .string()
+      .trim()
+      .min(1)
+      .max(80)
+      .describe("A short name for the change, 2-6 words"),
+  },
+  quick_pr: {
+    change: ref("Your quick change, by name or id"),
+    title: z
+      .string()
+      .trim()
+      .min(1)
+      .max(200)
+      .describe("The PR's title, also its commit message"),
+    body: z
+      .string()
+      .trim()
+      .min(1)
+      .max(20000)
+      .describe(
+        "What changed and why; the review judges the change against it"
+      ),
+  },
   stack: {
     target: ref("Board or project name"),
     plan_only: z.boolean().optional(),

package/lib/orchestrator/tools.ts

@@ -66,6 +66,10 @@ const DESCRIPTIONS: Record<ToolName, string> = {
     'Resume a paused task on another model ("provider/model", or a map of role to one), keeping its conversation and worktree; it\'s told to carry on (or message). Refused mid-turn.',
   start_session:
     "Start an interactive agent session in a project with a prompt. It runs as a chat unless view is terminal (only for a job that needs a TUI). Refused while a brake holds.",
+  quick_change:
+    "Make a small, low-risk edit yourself (a typo, a config value, a one-file fix): cuts a worktree and branch from the project's default branch and returns its path. You may write there (Write, Edit) and run git there as `git -C <path> ...` (status, diff, add, rm, mv, restore, reset, log, show); nowhere else in a project. Anything needing real work, tests or an investigation is a task (start_task).",
+  quick_pr:
+    "Commit everything in a quick change's worktree, push its branch (never the default branch) and open its PR, or push to the PR it already has. The PR goes through the same gates as a task's; with no task agent to run /do-code-review, its code-review gate is the independent review of its exact head, which starts now.",
   stack:
     "Run a LumifyHub board's open cards as stacked tasks (each start braked), or with plan_only just show the plan.",
   stack_status: "One stack's items, PRs and progress.",

package/lib/orchestrator/write-guard.ts

@@ -21,6 +21,8 @@ import { isSecretPath } from "../secret-paths";
 import { WORKTREES_DIR } from "../worktrees";
 import { orchestratorDir } from "./home";
 import { LIMITS_FILE } from "./usage";
+import { GIT_LAYOUT_FILE, readCommand } from "./git-guard";
+import { quickWorktrees } from "./quick-store";
 
 // The tools that write a file, and the argument naming it.
 export const WRITE_TOOLS: Record<string, string> = {
@@ -43,6 +45,9 @@ export interface WriteBounds {
   home: string;
   // Folders whose files run (~/Library, PATH, the usage brake's input...).
   runs: string[];
+  // Its own quick changes' worktrees (quick.ts): the one place in a
+  // project it may write, everything else in `repos` still refused.
+  quick?: string[];
 }
 
 // Wherever they are, files that configure what an agent, git or a
@@ -129,6 +134,7 @@ export async function writeRefusal(
   let ownDir: string[];
   let home: string[];
   let runs: string[];
+  let quick: string[][];
   try {
     // Where it lands as written, and with `..` taken by name first, as a
     // tool that normalises the path before opening it would; and where it
@@ -151,16 +157,27 @@ export async function writeRefusal(
     state = await both(bounds.state);
     ownDir = await both(bounds.ownDir);
     home = await both(bounds.home);
+    quick = await Promise.all((bounds.quick ?? []).map(both));
   } catch (e) {
     return `Couldn't resolve ${filePath}: ${(e as Error).message}.`;
   }
   for (const target of targets) {
-    const repo = repos.find((r) => within(target, r));
+    // Inside one of its quick worktrees, the roots that hold that worktree
+    // (the worktrees folder, a project above it) don't count; any other
+    // root, one nested inside it included, still refuses.
+    const ownQuick = quick.find((q) => q.some((d) => within(target, d)));
+    const holdsQuick = (r: string) =>
+      !!ownQuick && ownQuick.some((d) => within(d, r));
+    const repo = repos.find((r) => within(target, r) && !holdsQuick(r));
     if (repo)
-      return `${filePath} is inside ${repo}, a project repository, task worktree or AgentOS itself. Change code there through a task (start_task), so its PR goes through the merge gates.`;
+      return `${filePath} is inside ${repo}, a project repository, task worktree or AgentOS itself. Change code there through a task (start_task), or for a small edit, in a quick change's worktree (quick_change), so its PR goes through the merge gates.`;
+    if (ownQuick && GIT_LAYOUT_FILE.test(target))
+      return `${filePath} is part of a git repository's layout (HEAD, .git/, .gitattributes); git config can run programs, so orchestrators never write those.`;
     if (AGENTOS_TEMP.test(target))
       return `${filePath} is in a checkout AgentOS is reviewing or rebasing; orchestrators never write there.`;
-    const own = ownDir.some((d) => within(target, d));
+    // Its folder, or a quick worktree (which sits in ~/.agent-os/worktrees):
+    // AgentOS's state and the home's dot-folders hold it, but it's its own.
+    const own = ownDir.some((d) => within(target, d)) || !!ownQuick;
     if (state.some((d) => within(target, d)) && !own)
       return `${filePath} is in AgentOS's own state (${bounds.state}); you may write only in your folder, ${bounds.ownDir}.`;
     if (isSecretPath(target) || isSecretPath(filePath))
@@ -219,6 +236,7 @@ export async function orchestratorWriteBounds(
       ...(process.env.PATH ?? "").split(":").filter((d) => d.startsWith("/")),
     ],
     ownDir: orchestratorDir(session.workspace_id ?? ""),
+    quick: quickWorktrees(session.id),
     state: path.join(os.homedir(), ".agent-os"),
     repos: [...repos, WORKTREES_DIR, process.cwd(), path.dirname(dbPath)],
   };
@@ -287,9 +305,68 @@ export async function orchestratorToolRefusal(
   tool: string,
   input: Record<string, unknown>
 ): Promise<string | null> {
+  if (tool === "Bash") return commandRefusal(session, input.command);
   const arg = WRITE_TOOLS[tool];
   if (!arg) return null;
   const filePath = input[arg];
   if (typeof filePath !== "string") return "No file path to check.";
   return writeRefusal(filePath, await orchestratorWriteBounds(session));
 }
+
+// A shell command: one plain command, and git only in its own quick
+// worktrees (git-guard.ts), the folder it names resolved like a write's.
+async function commandRefusal(
+  session: Session,
+  command: unknown
+): Promise<string | null> {
+  const read = readCommand(command);
+  if (read.refusal !== null || read.dir === null) return read.refusal;
+  const quick = quickWorktrees(session.id);
+  const dir = read.dir;
+  if (!dir.startsWith("/") || !quick.length)
+    return `Refused: git runs only in one of your quick changes' worktrees, named by its full path (${quick.length ? quick.join(", ") : "you have none open; start one with quick_change"}).`;
+  return (await isQuickRoot(dir, quick))
+    ? null
+    : `Refused: ${read.dir} isn't the root of one of your quick changes' worktrees (${quick.join(", ")}). Git runs at the root only, never in a subfolder, a project checkout or another session's worktree.`;
+}
+
+// Whether a folder is inside one of these worktrees by every way the
+// system could read it: as named, with `..` taken by name, and with links
+// followed.
+export async function insideQuick(
+  dir: string,
+  quick: string[]
+): Promise<boolean> {
+  try {
+    const forms = [
+      path.resolve(dir),
+      await physicalPath(dir),
+      await physicalPath(path.resolve(dir)),
+    ];
+    const roots = (
+      await Promise.all(
+        quick.map(async (q) => [path.resolve(q), await physicalPath(q)])
+      )
+    ).flat();
+    return forms.every((f) => roots.some((r) => within(f, r)));
+  } catch {
+    return false;
+  }
+}
+
+// Whether a folder is exactly the root of one of these worktrees (as named,
+// and with links followed), where git finds the real git dir.
+async function isQuickRoot(dir: string, quick: string[]): Promise<boolean> {
+  if (!(await insideQuick(dir, quick))) return false;
+  try {
+    const forms = [path.resolve(dir), await physicalPath(dir)];
+    const roots = (
+      await Promise.all(
+        quick.map(async (q) => [path.resolve(q), await physicalPath(q)])
+      )
+    ).flat();
+    return forms.every((f) => roots.includes(f));
+  } catch {
+    return false;
+  }
+}

package/lib/sessions/end.ts

@@ -0,0 +1,15 @@
+import type { Session } from "../db";
+import { stopChat } from "../chat/runner";
+import { waitForExit } from "../chat/worker/client";
+import { endTmuxSession } from "../tmux/end";
+
+type Agent = Pick<Session, "id" | "host_id" | "tmux_name">;
+
+// A session's agent, ended: its chat worker, and its own tmux session (a
+// chat session can still own one). The one call that delete, done, drop and
+// finish share.
+export async function endSessionAgent(s: Agent): Promise<void> {
+  stopChat(s.id);
+  void waitForExit(s.id).catch(() => {});
+  await endTmuxSession(s.host_id, s.tmux_name);
+}

package/lib/sidebar/shelves.ts

@@ -41,6 +41,10 @@ export interface SidebarRow {
   working: boolean;
   // Orchestration workers, nested under their conductor.
   workers: SidebarRow[];
+  // Its task's state, when it's a task.
+  task?: TaskState;
+  // An orchestrator's quick changes (orchestrator/quick.ts), nested under it.
+  quick?: SidebarRow[];
 }
 
 export interface Shelves {
@@ -113,6 +117,8 @@ function toRow(input: ShelfInput, session: Session): SidebarRow {
     unread: !!status?.unread,
     working: status?.status === "running",
     workers: [],
+    task: input.tasks[session.id],
+    quick: [],
   };
 }
 
@@ -129,6 +135,15 @@ export function buildShelves(input: ShelfInput): Shelves {
 
   const top: SidebarRow[] = [];
   for (const row of rows) {
+    // A quick change always sits under the orchestrator that makes it: it's
+    // that orchestrator's to carry, never one that needs you.
+    const owner = row.session.quick_of
+      ? byId.get(row.session.quick_of)
+      : undefined;
+    if (owner) {
+      (owner.quick ??= []).push(row);
+      continue;
+    }
     const conductor = row.session.conductor_session_id
       ? byId.get(row.session.conductor_session_id)
       : undefined;
@@ -200,8 +215,11 @@ export function sameRow(a: SidebarRow, b: SidebarRow): boolean {
     a.unread === b.unread &&
     a.working === b.working &&
     sameStatus(a.status, b.status) &&
+    a.task === b.task &&
     a.workers.length === b.workers.length &&
-    a.workers.every((w, i) => sameRow(w, b.workers[i]))
+    a.workers.every((w, i) => sameRow(w, b.workers[i])) &&
+    (a.quick?.length ?? 0) === (b.quick?.length ?? 0) &&
+    (a.quick ?? []).every((q, i) => sameRow(q, b.quick![i]))
   );
 }
 

package/lib/tasks/finish.ts

@@ -10,7 +10,7 @@ import { republishAfterMerge } from "../lumifyhub/publish";
 import { restackAfterMerge } from "../stacks/restack";
 import { itemName, liveChildren, signOffRefusal } from "../stacks/guard";
 import { resolveMergedTaskAsks } from "../orchestrator/ask-settle";
-import { stopChat } from "../chat/runner";
+import { endSessionAgent } from "../sessions/end";
 import { run } from "./gh";
 import { gitFetch, gitPush } from "../git-exec";
 import {
@@ -39,13 +39,7 @@ async function cleanup(
   opts: { keepRemoteBranch?: boolean; merged?: MergedAs } = {}
 ): Promise<void> {
   const keepRemoteBranch = opts.keepRemoteBranch ?? false;
-  // A chat task's agent runs in its chat worker, not the task's tmux.
-  if (session.view === "chat") stopChat(session.id);
-  await run(
-    "tmux",
-    ["kill-session", "-t", `=${session.tmux_name}`],
-    repo
-  ).catch(() => {});
+  await endSessionAgent(session);
   // Never waited on: the row is read now, and Postgres can't hold this up.
   void dropSessionDatabase(session.id);
   if (session.worktree_path && opts.merged) {

package/lib/tasks/index.ts

@@ -96,6 +96,8 @@ export interface TaskView {
   // plan step (lib/models).
   model?: string;
   planning?: boolean;
+  // A quick change: the orchestrator session that makes it (no agent).
+  quickOf?: string | null;
 }
 
 export async function createTask(opts: {
@@ -304,22 +306,31 @@ export async function taskView(session: Session): Promise<TaskView> {
   const setup = taskSetupOf(session);
   // A finished task's PR is in the database: only a running one asks gh.
   const chat = session.view === "chat";
+  // A quick change has no agent: the orchestrator is working on it until
+  // its PR is up, and nothing in it can be blocked.
+  const quick = !!session.quick_of;
   const [pr, chatTurn, screen] = await Promise.all([
     live ? prFor(session) : storedPR(session),
-    live && chat
+    live && chat && !quick
       ? chatStateNow(session.id).catch((): ChatTurn => "unknown")
       : Promise.resolve(null),
-    live && !chat
+    live && !chat && !quick
       ? statusDetector.getStatus(session.tmux_name)
       : Promise.resolve(undefined),
   ]);
   const sessionStatus = !live
     ? undefined
-    : chat
-      ? chatStatus(chatTurn)
-      : screen;
+    : quick
+      ? "running"
+      : chat
+        ? chatStatus(chatTurn)
+        : screen;
   const agentGone =
-    !chat && live && sessionStatus !== "dead" && sessionStatus !== undefined
+    !chat &&
+    !quick &&
+    live &&
+    sessionStatus !== "dead" &&
+    sessionStatus !== undefined
       ? await shellOnly(session.tmux_name)
       : false;
   const blocked =
@@ -365,6 +376,7 @@ export async function taskView(session: Session): Promise<TaskView> {
     armed: !!session.merge_armed_at,
     model: sessionModelRef(session),
     planning: session.plan_phase === "planning",
+    quickOf: session.quick_of ?? null,
   };
 }
 

package/lib/tasks/move-guard.ts

@@ -10,6 +10,8 @@ import { db, type Session } from "../db";
 import { escalations } from "../orchestrator/gates";
 
 export function moveRefusal(session: Session): string | null {
+  if (session.quick_of)
+    return "It's a quick change its orchestrator makes on this machine, so it stays here";
   if (escalations(session.id).length)
     return "It's waiting on you (an escalated gate), so it stays here";
   const ask = db

package/lib/tasks/move.ts

@@ -7,10 +7,9 @@
  */
 
 import os from "os";
-import { execFile } from "child_process";
-import { promisify } from "util";
 import { db, type Session } from "../db";
 import { getProject } from "../projects";
+import { endTmuxSession } from "../tmux/end";
 import { launchClaude } from "../agents/launch";
 import { buildTaskBrief } from "./brief";
 import { git as runGit } from "../git-exec";
@@ -31,7 +30,6 @@ import {
 
 export * from "./move-bundle";
 
-const execFileAsync = promisify(execFile);
 const git = (cwd: string, ...args: string[]) =>
   runGit(cwd, args, { timeout: 120000 });
 
@@ -40,9 +38,7 @@ const g = globalThis as unknown as { __agentosExporting?: Set<string> };
 const exporting = (g.__agentosExporting ??= new Set());
 
 async function stopAgent(tmuxName: string): Promise<void> {
-  await execFileAsync("tmux", ["kill-session", "-t", `=${tmuxName}`]).catch(
-    () => undefined
-  );
+  await endTmuxSession(null, tmuxName);
 }
 
 export async function claudeIdFor(session: Session): Promise<string | null> {

package/lib/tasks/queue.ts

@@ -110,7 +110,8 @@ const workspaceOf = (projectId: string) =>
   getProject(projectId)?.workspace_id ?? null;
 
 // Running tasks hold their slot until they finish (merged, dropped, done),
-// PR open or not; a queued task being started counts too. Without a
+// PR open or not; a queued task being started counts too. A quick change
+// runs no agent, so it holds none. Without a
 // workspace, the project is the scope.
 function runningIn(scope: { workspaceId: string | null; projectId: string }) {
   const where = scope.workspaceId
@@ -120,7 +121,7 @@ function runningIn(scope: { workspaceId: string | null; projectId: string }) {
     db
       .prepare(
         `SELECT s.id FROM sessions s JOIN projects p ON p.id = s.project_id
-         WHERE ${where} AND s.archived_at IS NULL
+         WHERE ${where} AND s.archived_at IS NULL AND s.quick_of IS NULL
            AND s.task_status IN (${IN_FLIGHT.map((s) => `'${s}'`).join(", ")})`
       )
       .all({ ws: scope.workspaceId, project: scope.projectId }) as {

package/lib/tasks/start.ts

@@ -8,6 +8,7 @@
 
 import { execFile } from "child_process";
 import { promisify } from "util";
+import { endTmuxSession } from "../tmux/end";
 import { db, type Session } from "../db";
 import { getProject } from "../projects";
 import { setupWorktree } from "../env-setup";
@@ -195,10 +196,7 @@ function earlierSetup(row: SetupColumns): TaskSetup | undefined {
   return undefined;
 }
 
-export const killTmux = (name: string) =>
-  execFileAsync("tmux", ["kill-session", "-t", `=${name}`], {
-    timeout: 5000,
-  }).catch(() => undefined);
+export const killTmux = (name: string) => endTmuxSession(null, name);
 
 const tmuxAlive = (name: string) =>
   execFileAsync("tmux", ["has-session", "-t", `=${name}`], {

package/lib/tmux/end.ts

@@ -0,0 +1,33 @@
+import { hostExec } from "../hosts";
+import { shellQuote } from "../hosts/ssh";
+import { isValidTmuxName } from "../hosts/tmux-name";
+
+// Run by sh on the machine the session lives on. The pane processes and
+// everything under them are read before tmux ends the session (the kill only
+// hangs up the panes' own shells), then asked to stop and, if any is still
+// there a second later, killed. Only pids found under this session's panes
+// are ever signalled.
+export function endTmuxScript(name: string): string {
+  return [
+    `t=${shellQuote(`=${name}`)}`,
+    `roots=$(tmux list-panes -s -t "$t" -F '#{pane_pid}' 2>/dev/null)`,
+    `tree=$(ps -Ao pid=,ppid= | awk -v roots="$roots" 'BEGIN{n=split(roots,r,/[ \\n]+/);for(i=1;i<=n;i++)if(r[i]!="")s[r[i]]=1} {p[$1]=$2;a[NR]=$1} END{do{c=0;for(i=1;i<=NR;i++){k=a[i];if(!(k in s)&&(p[k] in s)){s[k]=1;c=1}}}while(c);for(k in s)print k}')`,
+    `tmux kill-session -t "$t" 2>/dev/null`,
+    `if [ -n "$tree" ]; then`,
+    `  kill -TERM $tree 2>/dev/null`,
+    `  alive=; for p in $tree; do kill -0 "$p" 2>/dev/null && alive="$alive $p"; done`,
+    `  if [ -n "$alive" ]; then sleep 1; kill -KILL $alive 2>/dev/null; fi`,
+    `fi`,
+    `exit 0`,
+  ].join("\n");
+}
+
+// Ends a tmux session and what its panes started, on the machine it runs on.
+// A session that isn't there is nothing to do; this never throws.
+export async function endTmuxSession(
+  hostId: string | null | undefined,
+  name: string | null | undefined
+): Promise<void> {
+  if (!name || !isValidTmuxName(name)) return;
+  await hostExec(hostId, endTmuxScript(name), 15_000).catch(() => {});
+}

package/lib/tmux/orphans.ts

@@ -0,0 +1,146 @@
+import { db } from "../db";
+import { getManagedSessionPattern } from "../providers/registry";
+import { WORKER_TMUX_PREFIX } from "../chat/worker/protocol";
+import { isValidTmuxName } from "../hosts/tmux-name";
+import { endTmuxSession } from "./end";
+import { tmux } from "./exec";
+
+// tmux sessions AgentOS made whose session row is gone: deleted before every
+// end-of-life path ended the agent. Swept once at start. Only sessions that
+// carry AgentOS's own marks are ever touched: its names (<agent>-<uuid>,
+// aos-chat-<uuid>) or the AGENTOS_SESSION_ID it sets on the session at
+// launch. Dispatch's sessions and anyone's own terminals have neither.
+
+const UUID = "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}";
+const WORKER_NAME = new RegExp(`^${WORKER_TMUX_PREFIX}(${UUID})$`, "i");
+const AGENT_NAME = new RegExp(`(${UUID})$`, "i");
+
+export interface TmuxListing {
+  name: string;
+  // AGENTOS_SESSION_ID on the session itself; null when absent or when the
+  // whole tmux server carries one (every session would then).
+  taggedId: string | null;
+}
+
+export interface SessionRow {
+  id: string;
+  tmux_name: string | null;
+  host_id: string | null;
+}
+
+const isLocal = (hostId: string | null) => !hostId || hostId === "local";
+
+// The AgentOS session id a tmux session belongs to, or null if it isn't one
+// of AgentOS's.
+export function agentOsIdOf(
+  l: TmuxListing,
+  managed = getManagedSessionPattern()
+): string | null {
+  const worker = WORKER_NAME.exec(l.name);
+  if (worker) return worker[1].toLowerCase();
+  if (managed.test(l.name)) return AGENT_NAME.exec(l.name)![1].toLowerCase();
+  return l.taggedId && new RegExp(`^${UUID}$`, "i").test(l.taggedId)
+    ? l.taggedId.toLowerCase()
+    : null;
+}
+
+export function findOrphans(
+  listing: TmuxListing[],
+  rows: SessionRow[]
+): { name: string; id: string }[] {
+  const ids = new Set(rows.map((r) => r.id.toLowerCase()));
+  const names = new Set(
+    rows.filter((r) => isLocal(r.host_id)).map((r) => r.tmux_name)
+  );
+  const orphans: { name: string; id: string }[] = [];
+  for (const l of listing) {
+    const id = agentOsIdOf(l);
+    if (id && !ids.has(id) && !names.has(l.name))
+      orphans.push({ name: l.name, id });
+  }
+  return orphans;
+}
+
+async function taggedId(
+  name: string,
+  serverWide: boolean
+): Promise<string | null> {
+  if (serverWide) return null;
+  const out = await tmux(
+    ["show-environment", "-t", `=${name}`, "AGENTOS_SESSION_ID"],
+    5000
+  ).catch(() => "");
+  return /^AGENTOS_SESSION_ID=(.+)$/m.exec(out)?.[1].trim() ?? null;
+}
+
+async function listLocal(createdBefore: number): Promise<TmuxListing[]> {
+  const out = await tmux(
+    ["list-sessions", "-F", "#{session_created} #{session_name}"],
+    5000
+  ).catch(() => "");
+  // Sessions made after the cutoff belong to work this process started: their
+  // rows may not be committed yet, so they are never candidates.
+  const names = out
+    .split("\n")
+    .map((l) => /^(\d+) (.+)$/.exec(l))
+    .filter((m): m is RegExpExecArray => !!m && Number(m[1]) <= createdBefore)
+    .map((m) => m[2])
+    .filter(isValidTmuxName);
+  // A server started from inside an agent's shell has the variable in its
+  // own environment, which every session on it then shows.
+  const global = await tmux(
+    ["show-environment", "-g", "AGENTOS_SESSION_ID"],
+    5000
+  ).catch(() => "");
+  const serverWide = /^AGENTOS_SESSION_ID=/m.test(global);
+  const managed = getManagedSessionPattern();
+  const listing: TmuxListing[] = [];
+  for (const name of names) {
+    const byName = WORKER_NAME.test(name) || managed.test(name);
+    listing.push({
+      name,
+      taggedId: byName ? null : await taggedId(name, serverWide),
+    });
+  }
+  return listing;
+}
+
+const hasRow = (id: string, tmuxName: string) =>
+  !!db
+    .prepare(`SELECT 1 FROM sessions WHERE id = ? OR tmux_name = ?`)
+    .get(id, tmuxName);
+
+export async function sweepOrphanTmux(
+  opts: {
+    dryRun?: boolean;
+    rows?: SessionRow[];
+    // Epoch seconds; only tmux sessions created at or before it are swept.
+    // Defaults to when this process started.
+    createdBefore?: number;
+  } = {}
+): Promise<{ found: string[]; killed: string[] }> {
+  const none = { found: [], killed: [] };
+  const rows =
+    opts.rows ??
+    (db
+      .prepare(`SELECT id, tmux_name, host_id FROM sessions`)
+      .all() as SessionRow[]);
+  // An empty table is a fresh or wrong database, not proof that nothing is
+  // alive: never sweep against it.
+  if (!rows.length) return none;
+  const cutoff =
+    opts.createdBefore ?? Math.floor(Date.now() / 1000 - process.uptime());
+  const orphans = findOrphans(await listLocal(cutoff), rows);
+  const killed: string[] = [];
+  for (const o of orphans) {
+    if (opts.dryRun) continue;
+    // The snapshot is old by now: a row inserted since keeps its session.
+    if (!opts.rows && hasRow(o.id, o.name)) continue;
+    await endTmuxSession(null, o.name);
+    killed.push(o.name);
+    console.log(`[tmux-sweep] ended ${o.name}: session ${o.id} has no row`);
+  }
+  if (killed.length)
+    console.log(`[tmux-sweep] ended ${killed.length} orphaned tmux sessions`);
+  return { found: orphans.map((o) => o.name), killed };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saadnvd1/agent-os",
-  "version": "0.3.477",
+  "version": "0.3.479",
   "description": "Self-hosted web UI for managing Claude Code sessions",
   "bin": {
     "agent-os": "scripts/agent-os"

package/server.ts

@@ -61,6 +61,7 @@ import { installClaudeStatusHooks } from "./lib/program-status/claude-hooks";
 import os from "os";
 import { resumeHeldStarts, resumeTaskStarts } from "./lib/tasks/start";
 import { failInterruptedSetups } from "./lib/sessions/worktree-setup";
+import { sweepOrphanTmux } from "./lib/tmux/orphans";
 import { releaseInterruptedClaims } from "./lib/orchestrator/ask-approvals";
 import { resumeReviews } from "./lib/orchestrator/review";
 import { claimAgentosEnv } from "./lib/agents/self-env";
@@ -357,6 +358,14 @@ app.prepare().then(async () => {
   }
   // New sessions whose worktree setup a restart cut off.
   failInterruptedSetups();
+  // tmux sessions of sessions deleted before agents were ended with them.
+  // Production only: a dev or test instance has its own database but shares
+  // the default tmux server, so it would see the real instance's sessions as
+  // orphans.
+  if (!dev && process.env.AGENTOS_TMUX_SWEEP !== "off")
+    sweepOrphanTmux().catch((error) =>
+      console.error("Sweeping orphaned tmux sessions failed:", error)
+    );
   // Chat turns that kept running through a restart.
   void reattachChats();
   // Reviews this restart cut off run again and deliver their verdicts.