@saadnvd1/agent-os 0.3.662 → 0.3.671

package/lib/session-artifacts/collect.ts

@@ -14,6 +14,7 @@ import { git } from "../git-exec";
 import { PLAN_FILE } from "../models/plan-step";
 import { listArtifacts } from "../artifacts/store";
 import { allowedRoots, within } from "./access";
+import { SCREENSHOT_DIR } from "../tasks/ui-brief";
 import {
   fromItems,
   fromPr,
@@ -293,6 +294,20 @@ export async function collectArtifacts(
 
 export const cachedCount = () => cache.size;
 
+// What the UI brief has a terminal session save, whether or not a chat tool
+// call named it: the PR names these files and the worktree is about to go.
+export function screenshotsIn(worktree: string): string[] {
+  const dir = path.join(worktree, SCREENSHOT_DIR);
+  try {
+    return fs
+      .readdirSync(dir)
+      .filter((f) => /\.(png|jpe?g|webp)$/i.test(f))
+      .map((f) => path.join(dir, f));
+  } catch {
+    return [];
+  }
+}
+
 /**
  * Before a session's worktree is removed: copy what it made there that git
  * doesn't hold. Never throws, and never holds up the removal for long.
@@ -309,7 +324,9 @@ export async function keepSessionFiles(sessionId: string): Promise<void> {
     const files = entries
       .map((e) => e.read)
       .filter((f): f is string => !!f && !!relInside(worktree, f));
-    await keepFiles(sessionId, worktree, files);
+    await keepFiles(sessionId, worktree, [
+      ...new Set([...files, ...screenshotsIn(worktree)]),
+    ]);
   } catch (error) {
     console.error(`[session-artifacts] keeping ${sessionId}:`, error);
   } finally {

package/lib/session-artifacts/keep.ts

@@ -5,8 +5,8 @@
  * copy; the manifest records them so the view can say "in the PR".
  */
 
+import { agentosHome } from "../agentos-home";
 import fs from "fs";
-import os from "os";
 import path from "path";
 import { git } from "../git-exec";
 import { isSecretPath } from "../secret-paths";
@@ -23,9 +23,7 @@ export interface Manifest {
 }
 
 export function keptDir(): string {
-  return (
-    process.env.AGENTOS_KEPT_DIR || path.join(os.homedir(), ".agent-os", "kept")
-  );
+  return process.env.AGENTOS_KEPT_DIR || agentosHome("kept");
 }
 
 const safeId = (sessionId: string) => sessionId.replace(/[^\w-]/g, "_");

package/lib/session-audit/store.ts

@@ -8,8 +8,8 @@
  * one before.
  */
 
+import { agentosHome } from "../agentos-home";
 import fs from "fs";
-import os from "os";
 import path from "path";
 import type { Summary } from "./aggregate";
 
@@ -19,10 +19,7 @@ export const AUDIT_NAME = /^[a-z0-9][a-z0-9-]{0,80}$/;
 export const SESSIONS_KIND = "sessions";
 
 export function auditsRoot(): string {
-  return (
-    process.env.AGENTOS_AUDITS_DIR ||
-    path.join(os.homedir(), ".agent-os", "audits")
-  );
+  return process.env.AGENTOS_AUDITS_DIR || agentosHome("audits");
 }
 
 export function auditsDir(): string {

package/lib/session-logs/folder.ts

@@ -6,8 +6,8 @@
  * can be public, and a log holds briefs and reviews.
  */
 
+import { agentosHome } from "../agentos-home";
 import fs from "fs";
-import os from "os";
 import path from "path";
 import { db } from "../db";
 import { slugify } from "../git";
@@ -17,8 +17,7 @@ import { expand, repoPaths, resolved, within } from "./paths";
 
 // AGENTOS_SESSION_LOGS_DIR moves the default (tests keep it off the real one).
 export const DEFAULT_ROOT = () =>
-  process.env.AGENTOS_SESSION_LOGS_DIR ||
-  path.join(os.homedir(), ".agent-os", "session-logs");
+  process.env.AGENTOS_SESSION_LOGS_DIR || agentosHome("session-logs");
 
 const key = (projectId: string) => `session-logs.folder.${projectId}`;
 

package/lib/sessions/launch.ts

@@ -3,10 +3,10 @@
  * then (for a worktree) the setup in the background, then the first message.
  */
 
+import { agentosHome } from "../agentos-home";
 import type { StartVia } from "../tasks/starter";
 import fs from "fs";
 import os from "os";
-import path from "path";
 import { randomUUID } from "crypto";
 import { db, queries, type Session } from "../db";
 import type { AgentType } from "../providers";
@@ -45,7 +45,7 @@ export const DEFAULT_START_VIEW: StartView = "chat";
 export const startView = (v: unknown): StartView | undefined =>
   v === "chat" || v === "terminal" ? v : undefined;
 
-export const SCRATCH_DIR = path.join(os.homedir(), ".agent-os", "scratch");
+export const SCRATCH_DIR = agentosHome("scratch");
 
 export interface LaunchInput {
   // The client's key for this start (a draft's id): it becomes the

package/lib/sessions/leftovers.ts

@@ -0,0 +1,61 @@
+/**
+ * What a task leaves outside its checkout, released when it ends (merge,
+ * drop, done, move, delete): its dev server, its private database and what
+ * the project derived from it, and its temp folder. The worktree itself is
+ * removed by the caller, which knows whether anything in it would be lost.
+ */
+
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { stopDevServer } from "../dev-instance/stopDevServer";
+import { dropSessionDatabase } from "../project-config/database";
+
+export const SESSION_TMP_PREFIX = "agentos-s-";
+
+// The whole id: a shortened one could name two sessions' folders alike.
+export const tmpName = (sessionId: string) => sessionId.replace(/[^\w-]/g, "");
+
+export const sessionTmpDir = (sessionId: string) =>
+  path.join(os.tmpdir(), `${SESSION_TMP_PREFIX}${tmpName(sessionId)}`);
+
+export interface LeftoverDeps {
+  stopDev: (worktree: string) => Promise<unknown>;
+  dropDatabase: (sessionId: string) => Promise<void>;
+  removeDir: (dir: string) => Promise<void>;
+}
+
+const realDeps: LeftoverDeps = {
+  stopDev: (worktree) => stopDevServer(worktree),
+  dropDatabase: dropSessionDatabase,
+  removeDir: (dir) => fs.promises.rm(dir, { recursive: true, force: true }),
+};
+
+/**
+ * Never throws and never waits on a step that can't be reached: each is
+ * tried on its own. Callers read the session row first and don't await this.
+ */
+export async function releaseSessionLeftovers(
+  session: { id: string; worktree_path?: string | null },
+  deps: Partial<LeftoverDeps> = {}
+): Promise<void> {
+  const d = { ...realDeps, ...deps };
+  const steps: Array<[string, () => Promise<unknown>]> = [
+    // First: its row is read before the caller deletes it.
+    ["database", () => d.dropDatabase(session.id)],
+    [
+      "dev server",
+      async () => {
+        if (session.worktree_path) await d.stopDev(session.worktree_path);
+      },
+    ],
+    ["temp folder", () => d.removeDir(sessionTmpDir(session.id))],
+  ];
+  for (const [what, step] of steps) {
+    try {
+      await step();
+    } catch (error) {
+      console.error(`[leftovers] ${what} for ${session.id}:`, error);
+    }
+  }
+}

package/lib/simulator/agent-device.ts

@@ -5,9 +5,9 @@
  * here, so it can only drive its own simulator.
  */
 
+import { agentosHome } from "../agentos-home";
 import { execFile } from "child_process";
 import fs from "fs";
-import os from "os";
 import path from "path";
 import { promisify } from "util";
 
@@ -15,7 +15,7 @@ const execFileAsync = promisify(execFile);
 
 export const AGENT_DEVICE_VERSION = "0.21.27";
 
-const root = () => path.join(os.homedir(), ".agent-os");
+const root = () => agentosHome();
 export const toolDir = () =>
   path.join(root(), "tools", `agent-device-${AGENT_DEVICE_VERSION}`);
 export const toolBin = () =>

package/lib/tasks/finish.ts

@@ -34,7 +34,7 @@ import {
   prFor,
   projectPathFor,
 } from "./session";
-import { dropSessionDatabase } from "../project-config/database";
+import { releaseSessionLeftovers } from "../sessions/leftovers";
 import { captureMergedTask } from "../session-logs";
 import { sessionEnded } from "../experiments/hooks";
 import { snapshotWorktree } from "../resurrect/snapshot";
@@ -62,7 +62,7 @@ async function cleanup(
   const keepRemoteBranch = opts.keepRemoteBranch ?? false;
   await endSessionAgent(session);
   // Never waited on: the row is read now, and Postgres can't hold this up.
-  void dropSessionDatabase(session.id);
+  void releaseSessionLeftovers(session);
   if (session.worktree_path && opts.merged) {
     const fate = await settleWorktree(session, opts.merged).catch(() => null);
     if (fate?.action === "kept")

package/lib/tasks/import.ts

@@ -5,6 +5,7 @@
  * again returns the task it made the first time.
  */
 
+import { releaseSessionLeftovers } from "../sessions/leftovers";
 import fs from "fs";
 import os from "os";
 import path from "path";
@@ -13,10 +14,7 @@ import { db, queries, type Session } from "../db";
 import { setupWorktree } from "../env-setup";
 import { allocatePorts } from "../ports";
 import { loadProjectConfig, portBases } from "../project-config";
-import {
-  dropSessionDatabase,
-  ensureSessionDatabase,
-} from "../project-config/database";
+import { ensureSessionDatabase } from "../project-config/database";
 import { runInBackground } from "../async-operations";
 import { launchClaude } from "../agents/launch";
 import { resolveModelForAgent } from "../model-catalog";
@@ -238,7 +236,7 @@ async function arrive(
   } catch (err) {
     // Nothing runs here, so the source may resume it: leave no row behind,
     // and no database (the drop reads the row before it goes).
-    void dropSessionDatabase(id);
+    void releaseSessionLeftovers({ id });
     if (bundle.chat) {
       stopChat(id);
       dropChat(id);

package/lib/tasks/move-testing.ts

@@ -3,13 +3,13 @@
 // Tests mock ../worktrees (WORKTREES_DIR), ../env-setup and ../agents/launch.
 
 import fs from "fs";
-import os from "os";
 import path from "path";
 import { randomUUID } from "crypto";
 import { db, insertSessionRow, type Session } from "../db";
 import { createProject } from "../projects";
 import { writeTranscript } from "./transcript";
 import { gitSync } from "../git-exec";
+import { tempDir } from "@/lib/test-temp";
 
 export const CLAUDE_ID = "11111111-2222-3333-4444-555555555555";
 
@@ -30,7 +30,7 @@ export interface MoveFixture {
 /** HOME, Claude's folder and git identity all point into a temp dir. */
 export function setupMoveRepo(): MoveFixture {
   const saved = { HOME: process.env.HOME };
-  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "aos-move-"));
+  const tmp = tempDir("aos-move-");
   process.env.HOME = tmp;
   process.env.CLAUDE_CONFIG_DIR = path.join(tmp, ".claude");
   for (const who of ["AUTHOR", "COMMITTER"]) {

package/lib/tasks/move.ts

@@ -26,7 +26,7 @@ import {
 } from "./move-bundle";
 import { stepProgress } from "./move-progress";
 import { PLAN_FILE } from "../models/plan-step";
-import { dropSessionDatabase } from "../project-config/database";
+import { releaseSessionLeftovers } from "../sessions/leftovers";
 import { releaseChat } from "../chat/runner";
 import { collectWhileMoving } from "../chat/hold";
 import { packChat, stopChatForMove } from "./move-chat";
@@ -258,7 +258,7 @@ export function markMoved(id: string, to: string): void {
     { task_status: ["running", "moving"] }
   );
   // It goes on there with a copy of its own.
-  if (moved) void dropSessionDatabase(id);
+  if (moved) void releaseSessionLeftovers({ id });
 }
 
 /**

package/lib/tasks/moved-away.ts

@@ -5,6 +5,7 @@
  * no commit a remote lacks). The row stays, archived, as history.
  */
 
+import { releaseSessionLeftovers } from "../sessions/leftovers";
 import { db, type Session } from "../db";
 import { endSessionAgent } from "../sessions/end";
 import { releasePorts } from "../ports";
@@ -28,6 +29,7 @@ export async function cleanUpMovedAway(id: string): Promise<WorktreeFate> {
       path: s.worktree_path ?? "",
     })
   );
+  void releaseSessionLeftovers(s);
   archiveSession(id);
   if (fate.action === "kept")
     console.warn(

package/lib/tasks/state.ts

@@ -137,6 +137,10 @@ const UNFINISHED = [
 const outcome = (c: RollupEntry) =>
   (c.conclusion || c.state || c.status || "").toUpperCase();
 
+// A skipped or neutral run is settled and says nothing about a rerun, so it
+// never makes a check look unsettled.
+const counts = (c: RollupEntry) => !["SKIPPED", "NEUTRAL"].includes(outcome(c));
+
 // Job names repeat across workflows, and a status context can share a check
 // run's name, so a check is its kind, workflow and name together.
 const checkKey = (c: RollupEntry) => {
@@ -198,7 +202,7 @@ const groupByCheck = <T extends RollupEntry>(rollup: T[]) => {
 // rollup can't tell one attempt from the next.
 function shownAttempts(rollup: RollupEntry[]): Map<string, number | null> {
   const shown = new Map<string, number | null>();
-  for (const c of rollup) {
+  for (const c of rollup.filter(counts)) {
     const run = actionsRunOf(c);
     if (!run) continue;
     const key = `${run.repo}#${run.id}`;
@@ -226,7 +230,7 @@ export function rerunsToLookUp(
     string,
     { repo: string; id: string; attempt: string | null }
   >();
-  for (const group of groupByCheck(rollup).values()) {
+  for (const group of groupByCheck(rollup.filter(counts)).values()) {
     if (group.length < 2) continue;
     for (const c of group) {
       const run = actionsRunOf(c);
@@ -259,7 +263,7 @@ export function settleReruns<T extends RollupEntry>(
   const shown = shownAttempts(rollup);
   const drop = new Set<RollupEntry>();
   const unsettled: RollupEntry[] = [];
-  for (const group of groupByCheck(rollup).values()) {
+  for (const group of groupByCheck(rollup.filter(counts)).values()) {
     if (group.length < 2) continue;
     const located = group.map((c) => ({ c, run: actionsRunOf(c) }));
     // Not all GitHub Actions: nothing says which run is stale, so all count.

package/lib/tasks/ui-brief.ts

@@ -80,6 +80,6 @@ If your diff changes what a user sees, run the app and look at every changed scr
 - Log in and go to pages by URL, from the login, pages and map under "Running this project" when they are there. Exploring the UI to find a page is the most expensive thing a session does.
 - One snapshot to find a uid, then act. Verify with a screenshot of the one element or a small \`evaluate_script\` returning the one value you need, not another full snapshot.
 - Verify the thing that would be wrong, not the thing that is easy to see: a page that rendered proves it rendered. Fix anything visibly off (gaps, clipping, overlap, horizontal scroll, stray bands, misalignment; measure rects with \`evaluate_script\` and report numbers) and read the console for errors.
-- Save screenshots of the final changed screens with \`filePath\` under \`${SCREENSHOT_DIR}/\`, after \`mkdir -p ${SCREENSHOT_DIR} && printf '*\\n' > .agentos/.gitignore\`. That folder is inside the browser's allowed root and git ignores it; a path in /tmp is refused.
-- Add a **Browser check** section to the PR body: the pages and widths you checked, what you fixed, and the screenshot file names. If you didn't check (no visible change, or no browser), say why in one line.`;
+- Save screenshots of the final changed screens with \`filePath\` under \`${SCREENSHOT_DIR}/\`, after \`mkdir -p ${SCREENSHOT_DIR} && printf '*\\n' > .agentos/.gitignore\`. That folder is inside the browser's allowed root and git ignores it; a path in /tmp is refused. AgentOS keeps these files after the worktree is removed.
+- Add a **Browser check** section to the PR body: the pages and widths you checked, what you fixed, and the screenshot file names (names only, never a worktree path: the worktree is removed when the task ends). If you didn't check (no visible change, or no browser), say why in one line.`;
 }

package/lib/test-temp.ts

@@ -0,0 +1,30 @@
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+// Folders made by tempDir, removed when the test file ends (vitest.setup.ts
+// calls removeTempDirs). Kept on globalThis: vi.resetModules() would
+// otherwise lose the list.
+const KEY = Symbol.for("agentos.testTempDirs");
+const made = (): Set<string> => {
+  const g = globalThis as unknown as Record<symbol, Set<string> | undefined>;
+  return (g[KEY] ??= new Set<string>());
+};
+
+/** A fresh temp folder that is removed when the test file ends. */
+export function tempDir(prefix: string): string {
+  const dir = mkdtempSync(join(tmpdir(), prefix));
+  made().add(dir);
+  return dir;
+}
+
+export function removeTempDirs(): void {
+  for (const dir of made()) {
+    try {
+      rmSync(dir, { recursive: true, force: true, maxRetries: 5 });
+    } catch {
+      // the run root's removal is the backstop
+    }
+  }
+  made().clear();
+}

package/lib/workspaces.ts

@@ -8,10 +8,11 @@ import { db, type Workspace } from "./db";
 
 type WorkspaceRow = Omit<
   Workspace,
-  "collapsed" | "wake_tasks_on_pr" | "orch_mcp_servers"
+  "collapsed" | "wake_tasks_on_pr" | "orch_mcp_servers" | "orch_full_access"
 > & {
   collapsed: number;
   wake_tasks_on_pr: number;
+  orch_full_access: number;
   orch_mcp_servers: string;
 };
 
@@ -38,6 +39,7 @@ const toWorkspace = (row: WorkspaceRow): Workspace => ({
   ...row,
   collapsed: !!row.collapsed,
   wake_tasks_on_pr: !!row.wake_tasks_on_pr,
+  orch_full_access: !!row.orch_full_access,
   orch_mcp_servers: parseServers(row.orch_mcp_servers),
 });
 
@@ -86,6 +88,7 @@ export function updateWorkspace(
     sortOrder?: number;
     maxRunningTasks?: number | null;
     wakeTasksOnPR?: boolean;
+    orchFullAccess?: boolean;
     mcpServers?: string[];
   }
 ): Workspace | null {
@@ -93,13 +96,14 @@ export function updateWorkspace(
   if (!existing) return null;
   const name = updates.name?.trim() || existing.name;
   db.prepare(
-    `UPDATE workspaces SET name = ?, collapsed = ?, sort_order = ?, max_running_tasks = ?, wake_tasks_on_pr = ?, orch_mcp_servers = ? WHERE id = ?`
+    `UPDATE workspaces SET name = ?, collapsed = ?, sort_order = ?, max_running_tasks = ?, wake_tasks_on_pr = ?, orch_full_access = ?, orch_mcp_servers = ? WHERE id = ?`
   ).run(
     name,
     (updates.collapsed ?? existing.collapsed) ? 1 : 0,
     updates.sortOrder ?? existing.sort_order,
     taskLimit(updates.maxRunningTasks, existing.max_running_tasks),
     (updates.wakeTasksOnPR ?? existing.wake_tasks_on_pr) ? 1 : 0,
+    (updates.orchFullAccess ?? existing.orch_full_access) ? 1 : 0,
     JSON.stringify(serverNames(updates.mcpServers, existing.orch_mcp_servers)),
     id
   );

package/lib/worktree-deps/fastcopy.ts

@@ -5,9 +5,9 @@
  * none works, and the caller installs or copies plainly instead.
  */
 
+import { agentosHome } from "../agentos-home";
 import { execFile } from "child_process";
 import * as fs from "fs";
-import * as os from "os";
 import * as path from "path";
 import { promisify } from "util";
 import type { CopyMode } from "./spare";
@@ -18,7 +18,7 @@ export type FastMode = Exclude<CopyMode, "copy">;
 
 // Where hardlinked dependencies are kept: one real copy per lockfile, so a
 // write through a link can only ever reach this, never the main checkout.
-export const STORE_ROOT = path.join(os.homedir(), ".agent-os", "deps-store");
+export const STORE_ROOT = agentosHome("deps-store");
 
 // Files tools rewrite in place. A hardlink would carry the write back into
 // the store, so these are real copies in every worktree.

package/lib/worktree-deps/spare.ts

@@ -8,13 +8,13 @@
  * one made before the dependencies changed is never taken, and is pruned.
  */
 
+import { agentosHome } from "../agentos-home";
 import { createHash } from "crypto";
 import { spawn } from "child_process";
 import * as fs from "fs";
-import * as os from "os";
 import * as path from "path";
 
-export const SPARE_ROOT = path.join(os.homedir(), ".agent-os", "spare");
+export const SPARE_ROOT = agentosHome("spare");
 
 // A half-built spare left by a restart is removed after this long.
 const BUILDING_TTL_MS = 30 * 60 * 1000;

package/lib/worktree-sweep/caches.ts

@@ -0,0 +1,129 @@
+/**
+ * What a task leaves outside its checkout and the database: dependency
+ * spares nobody took, its temp folder, a crashed preview browser's profile,
+ * and Xcode's build folder for a worktree that no longer exists. Each is
+ * rebuilt or recreated on demand, so the only rule is "old enough, and not
+ * in use".
+ */
+
+import fs from "fs";
+import path from "path";
+import { execFile } from "child_process";
+import { SESSION_TMP_PREFIX, tmpName } from "../sessions/leftovers";
+import { isTestTempName } from "./testTemp";
+import type { Candidate, SweepSkipped } from "./types";
+
+const DAY_MS = 24 * 3600_000;
+const SPARE_MIN_AGE_MS = 7 * DAY_MS;
+const BUILDING_MIN_AGE_MS = 3600_000;
+
+export interface CacheDeps {
+  now: number;
+  spareRoot: string;
+  tmpRoot: string;
+  derivedRoot: string;
+  worktreesRoot: string;
+  // Ids of the sessions still running on this machine.
+  liveIds: Set<string>;
+  workspaceOf: (derivedDir: string) => Promise<string | null>;
+  size: (dir: string) => Promise<number>;
+}
+
+export const workspaceFromPlist = (dir: string): Promise<string | null> =>
+  new Promise((resolve) =>
+    execFile(
+      "plutil",
+      [
+        "-extract",
+        "WorkspacePath",
+        "raw",
+        "-o",
+        "-",
+        path.join(dir, "info.plist"),
+      ],
+      { timeout: 10_000 },
+      (error, stdout) => resolve(error ? null : String(stdout).trim() || null)
+    )
+  );
+
+const subdirs = (root: string): string[] => {
+  try {
+    return fs
+      .readdirSync(root, { withFileTypes: true })
+      .filter((e) => e.isDirectory())
+      .map((e) => path.join(root, e.name));
+  } catch {
+    return [];
+  }
+};
+
+const mtime = (p: string) => {
+  try {
+    return fs.statSync(p).mtimeMs;
+  } catch {
+    return 0;
+  }
+};
+
+const inside = (root: string, p: string) => {
+  const rel = path.relative(path.resolve(root), path.resolve(p));
+  return !!rel && !rel.startsWith("..") && !path.isAbsolute(rel);
+};
+
+export async function findCacheLeftovers(deps: CacheDeps): Promise<{
+  candidates: Candidate[];
+  skipped: SweepSkipped[];
+}> {
+  const candidates: Candidate[] = [];
+  const skipped: SweepSkipped[] = [];
+  const add = async (dir: string, kind: Candidate["kind"], why: string) =>
+    candidates.push({ path: dir, kind, why, bytes: await deps.size(dir) });
+
+  for (const dir of subdirs(deps.spareRoot)) {
+    const building = path.basename(dir).includes(".");
+    const min = building ? BUILDING_MIN_AGE_MS : SPARE_MIN_AGE_MS;
+    if (deps.now - mtime(dir) >= min)
+      await add(
+        dir,
+        "spare",
+        building ? "an abandoned build" : "unused for a week"
+      );
+  }
+
+  const livePrefixes = [...deps.liveIds].map(tmpName);
+  for (const dir of subdirs(deps.tmpRoot)) {
+    const name = path.basename(dir);
+    if (isTestTempName(name)) {
+      if (deps.now - mtime(dir) >= DAY_MS)
+        await add(dir, "test-temp", "left behind by a test run");
+      continue;
+    }
+    const isSession = name.startsWith(SESSION_TMP_PREFIX);
+    if (!isSession && !name.startsWith("agentos-preview-")) continue;
+    if (deps.now - mtime(dir) < DAY_MS) continue;
+    if (
+      isSession &&
+      livePrefixes.includes(name.slice(SESSION_TMP_PREFIX.length))
+    ) {
+      skipped.push({
+        path: dir,
+        kind: "temp",
+        reason: "its session is running",
+      });
+      continue;
+    }
+    await add(
+      dir,
+      "temp",
+      isSession ? "its task is over" : "a preview browser's profile"
+    );
+  }
+
+  for (const dir of subdirs(deps.derivedRoot)) {
+    const workspace = await deps.workspaceOf(dir);
+    if (!workspace || !inside(deps.worktreesRoot, workspace)) continue;
+    if (fs.existsSync(workspace)) continue;
+    await add(dir, "derived-data", "its worktree is gone");
+  }
+  return { candidates, skipped };
+}