@saadnvd1/agent-os 0.3.851 → 0.3.859

package/lib/db/migrations/20261102T1944_leads.ts

@@ -0,0 +1,142 @@
+import type { Migration } from "../migration-types";
+import { createSessionRowsView } from "../session-parts/view";
+
+const columnsOf = (db: Parameters<Migration["up"]>[0], table: string) =>
+  (db.prepare(`PRAGMA table_info(${table})`).all() as { name: string }[]).map(
+    (c) => c.name
+  );
+
+export default {
+  key: "20261102T1944_leads",
+  up: (db) => {
+    // Leads (lib/leads): a lead is a standing chat like the orchestrator,
+    // with role 'lead' and a lead_kind; the orchestrator is the 'tech' lead
+    // once its workspace adds leads, and a workspace has one 'chief'.
+    // lead_since is when it became one, so its usage counts from then.
+    // Additive: a workspace without leads has none of these rows.
+    const sessions = columnsOf(db, "sessions");
+    if (!sessions.includes("lead_kind"))
+      db.exec(`ALTER TABLE sessions ADD COLUMN lead_kind TEXT`);
+    if (!sessions.includes("lead_since"))
+      db.exec(`ALTER TABLE sessions ADD COLUMN lead_since TEXT`);
+    createSessionRowsView(db);
+    db.exec(
+      `CREATE UNIQUE INDEX IF NOT EXISTS idx_sessions_lead
+         ON sessions(workspace_id, lead_kind) WHERE role = 'lead'`
+    );
+    db.exec(
+      `CREATE UNIQUE INDEX IF NOT EXISTS idx_sessions_chief
+         ON sessions(workspace_id) WHERE role = 'chief'`
+    );
+
+    // A row means the workspace added leads. The chief's autonomy starts at
+    // acting only when asked; a later setting lifts it without code.
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS workspace_leads (
+        workspace_id TEXT PRIMARY KEY,
+        enabled_at TEXT NOT NULL DEFAULT (datetime('now')),
+        chief_autonomy TEXT NOT NULL DEFAULT 'on_request'
+          CHECK (chief_autonomy IN ('on_request', 'acts'))
+      )
+    `);
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS lead_charters (
+        workspace_id TEXT NOT NULL,
+        lead_kind TEXT NOT NULL,
+        title TEXT NOT NULL,
+        area_text TEXT NOT NULL DEFAULT '',
+        charter_md TEXT NOT NULL DEFAULT '',
+        goal TEXT NOT NULL DEFAULT '',
+        updated_at TEXT NOT NULL DEFAULT (datetime('now')),
+        PRIMARY KEY (workspace_id, lead_kind)
+      )
+    `);
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS lead_areas (
+        workspace_id TEXT NOT NULL,
+        lead_kind TEXT NOT NULL,
+        kind TEXT NOT NULL CHECK (kind IN ('project', 'path', 'board')),
+        value TEXT NOT NULL,
+        PRIMARY KEY (workspace_id, lead_kind, kind, value)
+      )
+    `);
+    // Pinned direction quotes a chat item the person wrote; a newer pin
+    // supersedes an older one and nothing is deleted.
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS lead_direction (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        workspace_id TEXT NOT NULL,
+        lead_kind TEXT NOT NULL,
+        session_id TEXT NOT NULL,
+        chat_item_id TEXT NOT NULL,
+        quote TEXT NOT NULL,
+        set_at TEXT NOT NULL DEFAULT (datetime('now')),
+        superseded_by INTEGER
+      )
+    `);
+    db.exec(
+      `CREATE INDEX IF NOT EXISTS idx_lead_direction
+         ON lead_direction(workspace_id, lead_kind, id)`
+    );
+    // Proposed pins (an adopted lead's, or a lead's suggestion) wait here
+    // until the person confirms or drops them.
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS lead_pin_proposals (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        workspace_id TEXT NOT NULL,
+        lead_kind TEXT NOT NULL,
+        session_id TEXT NOT NULL,
+        chat_item_id TEXT NOT NULL,
+        quote TEXT NOT NULL,
+        status TEXT NOT NULL DEFAULT 'open'
+          CHECK (status IN ('open', 'pinned', 'dropped')),
+        created_at TEXT NOT NULL DEFAULT (datetime('now')),
+        resolved_at TEXT
+      )
+    `);
+    db.exec(
+      `CREATE UNIQUE INDEX IF NOT EXISTS idx_lead_pin_proposals_open
+         ON lead_pin_proposals(session_id, chat_item_id) WHERE status = 'open'`
+    );
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS lead_memos (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        workspace_id TEXT NOT NULL,
+        lead_kind TEXT NOT NULL,
+        text TEXT NOT NULL,
+        created_at TEXT NOT NULL DEFAULT (datetime('now'))
+      )
+    `);
+    db.exec(
+      `CREATE INDEX IF NOT EXISTS idx_lead_memos
+         ON lead_memos(workspace_id, lead_kind, id)`
+    );
+    db.exec(`
+      CREATE TABLE IF NOT EXISTS lead_messages (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        workspace_id TEXT NOT NULL,
+        from_kind TEXT NOT NULL,
+        to_kind TEXT NOT NULL,
+        thread TEXT NOT NULL,
+        text TEXT NOT NULL,
+        created_at TEXT NOT NULL DEFAULT (datetime('now')),
+        read_at TEXT
+      )
+    `);
+    db.exec(
+      `CREATE INDEX IF NOT EXISTS idx_lead_messages_to
+         ON lead_messages(workspace_id, to_kind, id)`
+    );
+    db.exec(
+      `CREATE INDEX IF NOT EXISTS idx_lead_messages_thread
+         ON lead_messages(workspace_id, thread, id)`
+    );
+
+    // The decision log and asks per lead; every existing row is Tech's.
+    for (const table of ["orchestrator_notes", "orchestrator_asks"])
+      if (!columnsOf(db, table).includes("lead_kind"))
+        db.exec(
+          `ALTER TABLE ${table} ADD COLUMN lead_kind TEXT NOT NULL DEFAULT 'tech'`
+        );
+  },
+} satisfies Migration;

package/lib/db/migrations/20261102T2300_needs_you_chat_per_session.ts

@@ -0,0 +1,24 @@
+import type { Migration } from "../migration-types";
+
+export default {
+  key: "20261102T2300_needs_you_chat_per_session",
+  up: (db) => {
+    // The Needs-you "waiting in chat" item was keyed per workspace
+    // (approval:<workspace id>), so one lead's waiting chat would hide
+    // another's. It is keyed per session now; a hidden one stays hidden on
+    // the workspace's orchestrator, the only chat that showed it. Safe to
+    // repeat: a renamed key no longer matches.
+    db.exec(`
+      UPDATE OR IGNORE needs_you_dismissed
+         SET key = 'approval:' || (
+           SELECT s.id FROM sessions s
+            WHERE s.role = 'orchestrator'
+              AND s.workspace_id = needs_you_dismissed.workspace_id)
+       WHERE key = 'approval:' || workspace_id
+         AND EXISTS (
+           SELECT 1 FROM sessions s
+            WHERE s.role = 'orchestrator'
+              AND s.workspace_id = needs_you_dismissed.workspace_id)
+    `);
+  },
+} satisfies Migration;

package/lib/db/session-parts/columns.ts

@@ -186,4 +186,6 @@ export const SESSION_ROW_COLUMNS: readonly string[] = [
   "session_group_id",
   "agent_role",
   "crew_id",
+  "lead_kind",
+  "lead_since",
 ];

package/lib/db/types.ts

@@ -1,6 +1,9 @@
 import type { AgentType } from "../providers";
 import type { ChatAccess } from "../chat/events";
 
+// The standing chats a workspace can have (lib/leads/roles.ts).
+export type SessionRole = "orchestrator" | "lead" | "chief";
+
 export interface Session {
   id: string;
   name: string;
@@ -118,8 +121,13 @@ export interface Session {
   // The agent role it was started in (lib/models/agent-roles) and its crew.
   agent_role?: string | null;
   crew_id?: string | null;
-  // A workspace's standing orchestrator chat (and that workspace), or null.
-  role: "orchestrator" | null;
+  // A workspace's standing chat (and that workspace), or null: its
+  // orchestrator, and with Leads its other leads and chief (lib/leads).
+  role: SessionRole | null;
+  // A lead's department ('tech' for the orchestrator once leads are added)
+  // and when it became one.
+  lead_kind?: string | null;
+  lead_since?: string | null;
   // An orchestrator's tool-call secret.
   orch_token?: string | null;
   workspace_id: string | null;

package/lib/done/archive.ts

@@ -1,6 +1,7 @@
 // Archived sessions: out of the sidebar, the needs-you count and the
 // orchestrator's view, but kept with their history and chat items.
 
+import { isStandingRole, roleNoun } from "../leads/roles";
 import fs from "fs";
 import { db, queries, type Session } from "../db";
 import { statusOf } from "../orchestrator/facts";
@@ -102,9 +103,9 @@ export async function archiveChecked(
   const s = queries.getSession(db).get(id) as Session | undefined;
   if (!s) throw new Error("Session not found");
   if (s.archived_at) throw new Error(`${s.name} is already archived`);
-  if (s.role === "orchestrator")
+  if (isStandingRole(s.role))
     throw new Error(
-      `${s.name} is a workspace's orchestrator; it can't be archived`
+      `${s.name} is a workspace's ${roleNoun(s.role)}; it can't be archived`
     );
   if (peerSessionLink(s))
     throw new Error(`${s.name} runs on another machine: archive it there`);

package/lib/done/auto-archive.ts

@@ -3,6 +3,7 @@
 // session, an orchestrator, one that needs input or is working, or one with
 // an open PR. Mirrors the sidebar's Done placement (lib/sidebar/shelves).
 
+import { sqlNoRole } from "../leads/roles";
 import { db, type Session } from "../db";
 import { fromSqliteTime } from "../session-meta";
 import { statusOf } from "../orchestrator/facts";
@@ -34,7 +35,7 @@ export async function archiveStaleDone(now = Date.now()): Promise<string[]> {
   const rows = db
     .prepare(
       `SELECT * FROM session_rows
-       WHERE archived_at IS NULL AND pinned = 0 AND role IS NULL
+       WHERE archived_at IS NULL AND pinned = 0 AND ${sqlNoRole()}
          AND peer_mirror = 0 AND quick_of IS NULL
          AND (pr_status IS NULL OR pr_status != 'open')`
     )

package/lib/done/bulk.ts

@@ -5,6 +5,7 @@
  * The preview says what will happen to each before anything does.
  */
 
+import { sqlNoRole, isStandingRole, roleLabel } from "../leads/roles";
 import { db, type Session } from "../db";
 import { getProject } from "../projects";
 import { workspaceProjects } from "../orchestrator/brief";
@@ -52,7 +53,7 @@ function scopeSessions(scope: DoneScope): Session[] {
     .prepare(
       `SELECT * FROM session_rows
        WHERE project_id IN (${projectIds.map(() => "?").join(", ")})
-         AND role IS NULL AND archived_at IS NULL
+         AND ${sqlNoRole()} AND archived_at IS NULL
          -- A linked machine's own sessions are cleaned up there.
          AND peer_mirror = 0
          -- A task another machine's orchestrator moved here is its to finish.
@@ -80,9 +81,9 @@ export async function idleSessions(
 export function scopeOf(session: Session): DoneScope {
   // An orchestrator acts through its tools, which Pause holds and which are
   // logged; aos would reach the same sessions past both.
-  if (session.role === "orchestrator")
+  if (isStandingRole(session.role))
     throw new Error(
-      `${session.name} is an orchestrator: it moves, finishes and stops sessions with its move, done and stop tools, not aos`
+      `${session.name} is ${roleLabel(session.role)}: it moves, finishes and stops sessions with its move, done and stop tools, not aos`
     );
   const project = session.project_id ? getProject(session.project_id) : null;
   if (!project || project.is_uncategorized)

package/lib/done/index.ts

@@ -8,6 +8,7 @@
  * its own action, archive.ts). What it will do is decided first (plan.ts).
  */
 
+import { isStandingRole, RoleLabel } from "../leads/roles";
 import { endPauseOnFinish } from "../tasks/pause-hold";
 import { db, queries, type Session } from "../db";
 import { endSessionAgent } from "../sessions/end";
@@ -132,8 +133,8 @@ export async function doneSession(
   // A demo archives and nothing more: no merge, no agent to stop, no
   // worktree to touch.
   if (demoMode()) {
-    if (s.role === "orchestrator")
-      throw new Error("An orchestrator isn't marked done.");
+    if (isStandingRole(s.role))
+      throw new Error(`${RoleLabel(s.role)} isn't marked done.`);
     if (s.archived_at) throw new Error(`${s.name} is already archived.`);
     if (s.task_prompt) setTask(db, s.id, { task_status: "done" });
     archiveSession(s.id);

package/lib/done/plan.ts

@@ -4,6 +4,7 @@
  * single done acts on it; the bulk preview shows it.
  */
 
+import { isStandingRole, roleNoun } from "../leads/roles";
 import { db, stackQueries as sq, type Session } from "../db";
 import type { TaskPR } from "../tasks";
 import { prFor } from "../tasks/session";
@@ -90,8 +91,10 @@ export async function planDone(
   s: Session,
   callerId?: string | null
 ): Promise<DonePlan> {
-  if (s.role === "orchestrator")
-    return refuse(`${s.name} is a workspace's orchestrator; it can't be done`);
+  if (isStandingRole(s.role))
+    return refuse(
+      `${s.name} is a workspace's ${roleNoun(s.role)}; it can't be done`
+    );
   if (s.archived_at) return refuse(`${s.name} is already archived`);
   if (callerId && callerId === s.id)
     return refuse("A session can't mark itself done");

package/lib/experiments/registry.ts

@@ -14,6 +14,8 @@ export interface Experiment {
   status: ExperimentStatus;
   // It shows suggestions, so an accept rate means something for it.
   suggests?: boolean;
+  // Built but not offered in Settings yet: it can be set, nothing lists it.
+  unlisted?: boolean;
 }
 
 export const EXPERIMENTS = [
@@ -34,6 +36,15 @@ export const EXPERIMENTS = [
     area: "sessions",
     status: "experimental",
   },
+  {
+    id: "leads",
+    name: "Leads",
+    description:
+      "Department heads and a chief of staff, per workspace. Off, nothing changes. On, you choose which workspaces get leads; each gets its own chief.",
+    area: "orchestrator",
+    status: "experimental",
+    unlisted: true,
+  },
 ] as const satisfies readonly Experiment[];
 
 export type ExperimentId = (typeof EXPERIMENTS)[number]["id"];

package/lib/experiments/view.ts

@@ -15,5 +15,7 @@ export const experimentView = (id: ExperimentId): ExperimentView => ({
 
 export const experimentsView = () => ({
   locked: experimentsLocked(),
-  experiments: EXPERIMENTS.map((e) => experimentView(e.id)),
+  experiments: EXPERIMENTS.filter((e: Experiment) => !e.unlisted).map((e) =>
+    experimentView(e.id)
+  ),
 });

package/lib/fork/brief.ts

@@ -3,7 +3,7 @@
 import { FORK_LIMITS } from "./options";
 import type { ChildRow } from "./types";
 
-export const PARENT_BRIEF = `Forks: when the user asks you to fork, or to do things in parallel in background copies, run \`aos fork "<instruction>" ...\` (one instruction per fork), keep working, and results arrive as a message. Also when you have independent side work, \`aos fork "<instruction>" ["<instruction>" …]\` starts that many background copies of you (up to ${FORK_LIMITS.maxPerFork}) that know what you know. It returns at once; you keep working. Their results arrive as a message when they finish, or after \`aos wait children --all|--any [--timeout 30m]\` (end your turn; you're woken with them). \`aos children\` lists them, \`aos children <n>\` shows a full result, \`aos cancel <n>|--all\` stops them. Children have your abilities and work in your checkout: tell one that has to edit code to \`--worktree\` (its own throwaway checkout). Fork only work that doesn't depend on your next step.`;
+export const PARENT_BRIEF = `Forks: when the user asks you to fork, or to do things in parallel in background copies, run \`aos fork "<instruction>" ...\` (one instruction per fork), keep working, and results arrive as a message. Also when you have independent side work, \`aos fork "<instruction>" ["<instruction>" …]\` starts that many background copies of you (up to ${FORK_LIMITS.maxPerFork}) that know what you know. It returns at once; you keep working. Their results arrive as a message when they finish, or after \`aos wait children --all|--any [--timeout 30m]\` (end your turn; you're woken with them). \`aos children\` lists them, \`aos children <n>\` shows a full result, \`aos cancel <n>|--all\` stops them. Children have your abilities and work in your checkout: tell one that has to edit code to \`--worktree\` (its own checkout). Fork only work that doesn't depend on your next step.`;
 
 export const CHILD_BRIEF = `You are a fork child: a background copy of another session, started to do one piece of work and report back. You have its abilities, not its checkout: don't change the parent's files, push, open a PR or fork. Put temp work (scripts, repros, notes) in $AOS_SCRATCH. Run builds and tests only through \`aos heavy -- <command>\`, which queues you with the other forks. To ask the parent something, \`aos send <parent> "<question>"\`; that doesn't finish you. When done, \`aos return "<result>"\` (first line: the answer in a sentence; then the detail; \`--failed\` if you couldn't do it). Your reply when you end your turn without it is used as the result, after a short wait.`;
 
@@ -22,7 +22,7 @@ export function childFirstMessage(opts: {
     opts.instruction.trim(),
     "",
     opts.worktree && opts.checkout
-      ? `You work in your own checkout (${opts.checkout}), a copy of the parent's changes as they were when you started. Scratch folder: ${opts.scratch}.`
+      ? `You work in your own checkout (${opts.checkout}), a copy of the parent's changes as they were when you started. Scratch folder: ${opts.scratch}. Both are kept after you return.`
       : `You work in the parent's checkout: read freely, but don't change it. Scratch folder: ${opts.scratch} ($AOS_SCRATCH).`,
     "Finish with `aos return`.",
   ];

package/lib/fork/extras.ts

@@ -1,5 +1,6 @@
 /** What a chat worker adds for fork parents and children. */
 
+import { isStandingRole } from "../leads/roles";
 import os from "os";
 import type { Session } from "../db";
 import type { ToolGuard } from "../chat/driver";
@@ -7,7 +8,7 @@ import { CHILD_BRIEF, PARENT_BRIEF } from "./brief";
 import { forkToolGuard } from "./guard";
 import { getChild } from "./ledger";
 import { forksOn } from "./options";
-import { scratchOf, worktreeOf } from "./scratch";
+import { forksRoot, scratchOf, worktreeOf } from "./scratch";
 import { db } from "../db";
 
 const expand = (p: string) => p.replace(/^~(?=$|\/)/, os.homedir());
@@ -16,7 +17,7 @@ const expand = (p: string) => p.replace(/^~(?=$|\/)/, os.homedir());
 // parent, so their prompts match as far as they can).
 export function forkBrief(session: Session): string | null {
   if (getChild(session.id)) return CHILD_BRIEF;
-  if (!forksOn() || session.role === "orchestrator" || session.view !== "chat")
+  if (!forksOn() || isStandingRole(session.role) || session.view !== "chat")
     return null;
   return PARENT_BRIEF;
 }
@@ -46,6 +47,7 @@ export function childExtras(
         parent?.working_directory ?? session.working_directory
       ),
       scratch,
+      forksRoot: forksRoot(),
       ownCheckout: child.worktree ? worktreeOf(session.id) : null,
       cwd: expand(session.working_directory),
     }),

package/lib/fork/guard.ts

@@ -27,6 +27,8 @@ export interface ForkGuardContext {
   parentCheckout: string;
   // The child's scratch folder: free to write.
   scratch: string;
+  // Where every fork's folders live; the others' are never written.
+  forksRoot: string;
   // Its own throwaway checkout, when it has one: free to write.
   ownCheckout: string | null;
   // Where the child runs; relative paths start here.
@@ -39,7 +41,7 @@ const WHERE = (c: ForkGuardContext) =>
     : `put temp work in ${c.scratch} (AOS_SCRATCH), or ask for \`aos fork --worktree\` to edit code`;
 
 const noWrite = (c: ForkGuardContext, what: string) =>
-  `Refused: ${what} would change the parent's checkout, which it is working in. ${WHERE(c)}.`;
+  `Refused: ${what} would change the parent's checkout or another fork's folder, which they are working in. ${WHERE(c)}.`;
 
 // Commands whose every path argument is something they change.
 const MUTATORS = new Set([
@@ -134,7 +136,7 @@ async function protectedPath(
     c.ownCheckout ? physicalPath(c.ownCheckout) : Promise.resolve(null),
   ]);
   if (within(r, scratch) || (own && within(r, own))) return false;
-  return within(r, parent);
+  return within(r, parent) || within(r, await physicalPath(c.forksRoot));
 }
 
 // A file tool's refusal, or null.

package/lib/fork/scratch.ts

@@ -1,14 +1,17 @@
 /**
  * A fork child's own folders under the data root: a scratch folder for temp
- * work (scripts, repros, notes), and, when it was asked for, a throwaway
- * checkout. Both are removed when the child settles or is dropped, and a
- * sweep removes what a crash left.
+ * work (scripts, repros, notes), and, when it was asked for, its own
+ * checkout. Settling a child removes nothing: they are kept while its
+ * session is open, and tidied up after it closes only when nothing in them
+ * would be lost. Deleting the child's session is the one thing that removes
+ * them whatever they hold.
  */
 
 import fs from "fs";
 import path from "path";
 import { agentosHome } from "../agentos-home";
 import { git } from "../git-exec";
+import { describeChanges } from "../worktree-placed";
 
 export const forksRoot = () => agentosHome("forks");
 export const forkHome = (childId: string) => agentosHome("forks", childId);
@@ -17,6 +20,89 @@ export const scratchOf = (childId: string) =>
 export const worktreeOf = (childId: string) =>
   path.join(forkHome(childId), "wt");
 
+// The tree the checkout started from (the parent's changes and what setup
+// placed included), so what the child changed can be told from it.
+export const baseOf = (childId: string) => path.join(forkHome(childId), "base");
+
+const MAX_LISTED = 50;
+
+// A tree of the checkout as it is now, taken through a temporary index so
+// the child's own index is left alone. Ignored files aren't in it.
+export async function snapshotTree(
+  wt: string,
+  childId: string
+): Promise<string> {
+  const index = path.join(forkHome(childId), "index.tmp");
+  const env = { GIT_INDEX_FILE: index };
+  try {
+    await git(wt, ["read-tree", "HEAD"], { env });
+    await git(wt, ["add", "-A", "--", ".", ":(exclude)node_modules"], { env });
+    return (await git(wt, ["write-tree"], { env })).trim();
+  } finally {
+    await fs.promises.rm(index, { force: true });
+  }
+}
+
+async function filesUnder(dir: string, rel = ""): Promise<string[]> {
+  const out: string[] = [];
+  const entries = await fs.promises
+    .readdir(path.join(dir, rel), { withFileTypes: true })
+    .catch(() => []);
+  for (const e of entries) {
+    if (out.length >= MAX_LISTED) break;
+    const r = path.join(rel, e.name);
+    if (e.isDirectory()) out.push(...(await filesUnder(dir, r)));
+    else out.push(r);
+  }
+  return out.slice(0, MAX_LISTED);
+}
+
+// What removing the child's folders would lose: files in its scratch, and
+// changes in its checkout since it started. Null when that can't be told.
+export async function forkLosses(childId: string): Promise<string[] | null> {
+  const lost = (await filesUnder(scratchOf(childId))).map(
+    (f) => `scratch/${f}`
+  );
+  const wt = worktreeOf(childId);
+  if (fs.existsSync(wt)) {
+    try {
+      const base = (
+        await fs.promises.readFile(baseOf(childId), "utf8").catch(() => "")
+      ).trim();
+      if (base) {
+        const now = await snapshotTree(wt, childId);
+        const names = await git(wt, ["diff", "--name-only", base, now]);
+        lost.push(...names.split("\n").filter(Boolean));
+      } else {
+        const st = await git(wt, ["status", "--porcelain"]);
+        lost.push(
+          ...st
+            .split("\n")
+            .filter(Boolean)
+            .map((l) => l.slice(3))
+        );
+      }
+    } catch {
+      return null;
+    }
+  }
+  return lost;
+}
+
+// Removes the child's folders only when nothing in them would be lost.
+export async function tidyFork(childId: string): Promise<boolean> {
+  if (!fs.existsSync(forkHome(childId))) return true;
+  const lost = await forkLosses(childId);
+  if (lost?.length === 0) {
+    await removeFork(childId);
+    return true;
+  }
+  console.log(
+    `[forks] kept ${childId}: ${lost ? describeChanges(lost) : "it couldn't be checked"}`
+  );
+  return false;
+}
+
 // Made on demand, so a settled child that is talked to again has one.
 export async function ensureScratch(childId: string): Promise<string> {
   const dir = scratchOf(childId);
@@ -50,18 +136,22 @@ export async function removeFork(childId: string): Promise<void> {
   await fs.promises.rm(home, { recursive: true, force: true, maxRetries: 3 });
 }
 
-// Folders of children that are settled or gone: what a crash between a
-// settle and its cleanup left. `keep` says whose folders are still in use.
+// Folders of children whose session is closed or gone, tidied the same safe
+// way: what a crash left, and children closed after they settled. `keep`
+// says whose folders are still in use. Patches beside the folders stay.
 export async function sweepForks(
   keep: (childId: string) => boolean
-): Promise<number> {
+): Promise<{ removed: number; kept: number }> {
   const root = forksRoot();
-  const names = await fs.promises.readdir(root).catch(() => [] as string[]);
+  const entries = await fs.promises
+    .readdir(root, { withFileTypes: true })
+    .catch(() => []);
   let removed = 0;
-  for (const name of names) {
-    if (keep(name)) continue;
-    await removeFork(name);
-    removed++;
+  let kept = 0;
+  for (const e of entries) {
+    if (!e.isDirectory() || keep(e.name)) continue;
+    if (await tidyFork(e.name)) removed++;
+    else kept++;
   }
-  return removed;
+  return { removed, kept };
 }

package/lib/fork/settle.ts

@@ -26,7 +26,15 @@ import {
   markDeliveredIds,
 } from "./ledger";
 import { FORK_LIMITS } from "./options";
-import { forksRoot, removeFork, worktreeOf } from "./scratch";
+import {
+  baseOf,
+  forkLosses,
+  forksRoot,
+  scratchOf,
+  snapshotTree,
+  tidyFork,
+  worktreeOf,
+} from "./scratch";
 import type { ChildOutcome, ChildRow, ResultKind } from "./types";
 
 const sessionOf = (id: string) =>
@@ -53,14 +61,17 @@ function tokensOf(childId: string) {
 export const patchPath = (childId: string) =>
   path.join(forksRoot(), `${childId}.patch`);
 
-// What a child changed in its own checkout, kept as a patch the parent can
-// apply: its checkout goes with it.
+// What a child changed in its own checkout (not what the parent had when it
+// started), kept as a patch the parent can apply.
 async function keepPatch(childId: string): Promise<string | null> {
   const wt = worktreeOf(childId);
   if (!fs.existsSync(wt)) return null;
   try {
-    await git(wt, ["add", "-A"]);
-    const diff = await git(wt, ["diff", "--cached", "HEAD", "--binary"], {
+    const base = (
+      await fs.promises.readFile(baseOf(childId), "utf8").catch(() => "")
+    ).trim();
+    const now = await snapshotTree(wt, childId);
+    const diff = await git(wt, ["diff", base || "HEAD", now, "--binary"], {
       maxBuffer: 64 * 1024 * 1024,
     });
     if (!diff.trim()) return null;
@@ -89,12 +100,19 @@ export async function settleAndDeliver(
   const row = getChild(childId);
   if (!row || row.state === "settled") return false;
   let result = s.result ?? null;
-  if (row.worktree && s.outcome !== "cancelled") {
+  if (row.worktree) {
     const patch = await keepPatch(childId);
     if (patch)
       result =
         `${result ?? ""}\n\nIts changes are in ${patch} (apply with \`git apply ${patch}\`).`.trim();
   }
+  if (
+    (await forkLosses(childId).catch(() => null))?.some((f) =>
+      f.startsWith("scratch/")
+    )
+  )
+    result =
+      `${result ?? ""}\n\nIts scratch files are in ${scratchOf(childId)}.`.trim();
   const changed = settleChild(childId, {
     ...s,
     result,
@@ -103,7 +121,11 @@ export async function settleAndDeliver(
   if (!changed) return false;
   // Cancelled by its parent or the user: they know, so nothing is sent.
   if (s.outcome === "cancelled") markDeliveredIds([childId]);
-  await removeFork(childId).catch(() => undefined);
+  // Its folders stay while its session is open; a closed one's go only
+  // when nothing in them would be lost.
+  const session = sessionOf(childId);
+  if (!session || session.archived_at)
+    await tidyFork(childId).catch(() => undefined);
   const { admitQueued } = await import("./start");
   await admitQueued(row.parent_session_id).catch(() => undefined);
   const { kickForks } = await import("./tick");
@@ -175,6 +197,8 @@ const lastReply = (childId: string): string => {
 export async function lookAtChild(row: ChildRow, now: number): Promise<void> {
   if (row.state === "queued" || row.state === "settled") return;
   const session = sessionOf(row.child_session_id);
+  // Its checkout is still being made: no session row yet.
+  if (!session && row.state === "starting") return;
   if (!session || session.archived_at) {
     await settleAndDeliver(row.child_session_id, {
       outcome: "failed",