@yemi33/minions 0.1.2382 → 0.1.2384

package/engine/spawn-agent.js

@@ -32,12 +32,18 @@
  */
 
 const fs = require('fs');
-const os = require('os');
 const path = require('path');
 const { runFile, cleanChildEnv, killGracefully, killImmediate, killByPidsImmediate, listProcessDescendants, ts, readFileNoFollow } = require('./shared');
-const { resolveRuntime } = require('./runtimes');
+const {
+  resolveRuntime,
+  RUNTIME_OPTIONS_FLAG,
+  RUNTIME_IMAGES_FILE_OPTION,
+  decodeRuntimeOptions,
+  prepareWorkspace: prepareRuntimeWorkspace,
+} = require('./runtimes');
 const { acquireAdoTokenSync, isLikelyAdoToken } = require('./ado-token');
 const keepProcessSweep = require('./keep-process-sweep');
+const MAX_RUNTIME_IMAGES_FILE_BYTES = 32 * 1024 * 1024;
 
 // ─── Pure helpers (exported for tests) ──────────────────────────────────────
 
@@ -76,17 +82,7 @@ function parseSpawnArgs(argv) {
       case '--disable-builtin-mcps':       opts.disableBuiltinMcps = true; break;
       case '--no-custom-instructions':     opts.suppressAgentsMd = true; break;
       case '--enable-reasoning-summaries': opts.reasoningSummaries = true; break;
-      case '--project-harness-dir': {
-        const v = peek();
-        if (typeof v === 'string' && v) projectHarnessDirs.push(v);
-        break;
-      }
-      // P-49e1c8b7 — hermetic harness opt-out. When set, computeAddDirs in
-      // main() returns [minionsDir] only (user-scope asset dirs from
-      // runtime.getUserAssetDirs AND any forwarded --project-harness-dir
-      // entries are dropped). Engine.js gates this flag via
-      // shared.resolveAgentHermeticHarness(agent, engine).
-      case '--hermetic-harness':           hermetic = true; break;
+      case RUNTIME_OPTIONS_FLAG:           Object.assign(opts, decodeRuntimeOptions(peek())); break;
       // LEGACY: dropped — the runtime adapter emits its own permission flag.
       // Pre-P-2a6d9c4f engine.js still passes `--permission-mode bypassPermissions`;
       // letting it through would duplicate the permission flag for Claude.
@@ -168,6 +164,41 @@ function injectAdoTokenEnvForRepoHost(env, opts) {
   return injectAdoTokenEnv(env, opts);
 }
 
+function hydrateRuntimeOptionFiles(opts, {
+  promptFile,
+  readFile = readFileNoFollow,
+  lstatSync = fs.lstatSync,
+  unlinkSync = fs.unlinkSync,
+} = {}) {
+  const imagesFile = opts?.[RUNTIME_IMAGES_FILE_OPTION];
+  if (!imagesFile) return opts;
+  if (typeof imagesFile !== 'string' || !promptFile) {
+    throw new Error('Invalid runtime images sidecar path');
+  }
+  const resolvedFile = path.resolve(imagesFile);
+  const optionsDir = path.resolve(path.dirname(promptFile));
+  if (path.dirname(resolvedFile) !== optionsDir) {
+    throw new Error('Runtime images sidecar must be beside the prompt file');
+  }
+  const stat = lstatSync(resolvedFile);
+  if (!stat.isFile() || stat.isSymbolicLink() || stat.size > MAX_RUNTIME_IMAGES_FILE_BYTES) {
+    throw new Error('Invalid runtime images sidecar file');
+  }
+  let images;
+  try {
+    images = JSON.parse(readFile(resolvedFile, 'utf8'));
+  } catch (err) {
+    throw new Error(`Invalid runtime images sidecar payload: ${err.message}`);
+  }
+  if (!Array.isArray(images)) {
+    throw new Error('Invalid runtime images sidecar payload: expected an array');
+  }
+  opts.images = images;
+  delete opts[RUNTIME_IMAGES_FILE_OPTION];
+  try { unlinkSync(resolvedFile); } catch {}
+  return opts;
+}
+
 function formatProcessExitSentinel(exitCode, signal) {
   return `\n[process-exit] code=${exitCode}${signal ? ` signal=${signal}` : ''}\n`;
 }
@@ -307,105 +338,16 @@ function createParentPipeForwarder(stream, outputPath, prefix = '') {
 }
 
 /**
- * P-7d31a06b — Pre-approve a worktree's `.mcp.json` servers in `~/.claude.json`
- * so Claude Code's first invocation in a fresh worktree cwd doesn't show the
- * project-scoped "trust this MCP server?" prompt (which `--dangerously-skip-permissions`
- * silently suppresses → the agent runs without the workspace MCPs).
- *
- * Writes to `projects[worktreePath].enabledMcpjsonServers` (the field Claude
- * Code actually reads — confirmed against the live `~/.claude.json` schema:
- * `enabledMcpjsonServers` / `disabledMcpjsonServers` are siblings of
- * `mcpServers`, indexed by absolute project path). Notes on the PRD wording
- * "mcpServers.approved": that's the intent label; `enabledMcpjsonServers` is
- * the on-disk reality.
- *
- * Pure-ish: all I/O (fs reads, mutator) is injected for tests. Best-effort —
- * callers MUST swallow errors and never block dispatch on this.
- *
- * Returns `{ wrote: boolean, reason: string, servers: string[] }`:
- *   - reason ∈ { 'ok', 'flag-off', 'not-claude', 'no-worktree',
- *                'no-workspace-mcp', 'invalid-workspace-mcp', 'no-servers' }
- *   - servers: keys discovered in the workspace `.mcp.json` (regardless of write)
- *
- * Args:
- *   runtimeName             — `runtime.name` from `resolveRuntime(...)`. Helper no-ops if !== 'claude'.
- *   worktreePath            — absolute path to the agent's cwd (the worktree). Used as both the file location
- *                             (`<worktreePath>/.mcp.json`) and the `projects[...]` key in `~/.claude.json`.
- *   homeDir                 — `os.homedir()`. Injected for test isolation; helper does NOT call os.homedir directly.
- *   engineConfig            — config.engine object; reads `claudePreApproveWorkspaceMcps` (default true via ENGINE_DEFAULTS).
- *   mutateJsonFileLocked    — injected file-locked mutator (engine/shared.js#mutateJsonFileLocked).
- *   existsSync, readFileSync — injectable fs primitives (default to node:fs).
+ * Backward-compatible wrapper for the old helper name. Runtime-owned workspace
+ * preparation now lives behind the adapter contract; the spawn wrapper does
+ * not know which harness needs which config file mutation.
  */
-function preApproveWorkspaceMcps({
-  runtimeName,
-  worktreePath,
-  homeDir,
-  engineConfig,
-  mutateJsonFileLocked,
-  existsSync = fs.existsSync,
-  readFileSync = fs.readFileSync,
-} = {}) {
-  if (engineConfig && engineConfig.claudePreApproveWorkspaceMcps === false) {
-    return { wrote: false, reason: 'flag-off', servers: [] };
-  }
-  if (runtimeName !== 'claude') {
-    return { wrote: false, reason: 'not-claude', servers: [] };
-  }
-  if (!worktreePath || typeof worktreePath !== 'string') {
-    return { wrote: false, reason: 'no-worktree', servers: [] };
+function preApproveWorkspaceMcps({ runtimeName, ...context } = {}) {
+  const result = prepareRuntimeWorkspace(resolveRuntime(runtimeName), context);
+  if (result?.reason === 'unsupported-runtime') {
+    return { ...result, reason: 'not-claude' };
   }
-  const workspaceMcpPath = path.join(worktreePath, '.mcp.json');
-  if (!existsSync(workspaceMcpPath)) {
-    return { wrote: false, reason: 'no-workspace-mcp', servers: [] };
-  }
-  let workspaceMcp;
-  try {
-    workspaceMcp = JSON.parse(readFileSync(workspaceMcpPath, 'utf8'));
-  } catch {
-    return { wrote: false, reason: 'invalid-workspace-mcp', servers: [] };
-  }
-  const serversObj = workspaceMcp && typeof workspaceMcp === 'object' ? workspaceMcp.mcpServers : null;
-  const servers = serversObj && typeof serversObj === 'object' && !Array.isArray(serversObj)
-    ? Object.keys(serversObj).filter((k) => typeof k === 'string' && k.length > 0)
-    : [];
-  if (servers.length === 0) {
-    return { wrote: false, reason: 'no-servers', servers: [] };
-  }
-  if (!homeDir || typeof mutateJsonFileLocked !== 'function') {
-    return { wrote: false, reason: 'no-home-or-mutator', servers };
-  }
-  const claudeJsonPath = path.join(homeDir, '.claude.json');
-  let didWrite = false;
-  mutateJsonFileLocked(claudeJsonPath, (data) => {
-    const root = data && typeof data === 'object' ? data : {};
-    if (!root.projects || typeof root.projects !== 'object') root.projects = {};
-    const projectKey = worktreePath;
-    const proj = root.projects[projectKey] && typeof root.projects[projectKey] === 'object'
-      ? root.projects[projectKey]
-      : {};
-    // enabledMcpjsonServers is Claude's actual on-disk approval field
-    const enabled = Array.isArray(proj.enabledMcpjsonServers) ? proj.enabledMcpjsonServers.slice() : [];
-    const disabled = Array.isArray(proj.disabledMcpjsonServers) ? proj.disabledMcpjsonServers.slice() : [];
-    const enabledSet = new Set(enabled.filter((s) => typeof s === 'string'));
-    let mutated = false;
-    for (const name of servers) {
-      if (!enabledSet.has(name)) {
-        enabledSet.add(name);
-        mutated = true;
-      }
-    }
-    // If a server was previously explicitly disabled, lift the disabled mark when we
-    // re-approve it — otherwise Claude treats the disabled entry as authoritative.
-    const nextDisabled = disabled.filter((s) => typeof s === 'string' && !servers.includes(s));
-    if (nextDisabled.length !== disabled.length) mutated = true;
-    if (!mutated) return data;
-    proj.enabledMcpjsonServers = [...enabledSet];
-    proj.disabledMcpjsonServers = nextDisabled;
-    root.projects[projectKey] = proj;
-    didWrite = true;
-    return root;
-  }, { defaultValue: {}, skipWriteIfUnchanged: true });
-  return { wrote: didWrite, reason: 'ok', servers };
+  return result;
 }
 
 // ─── Main script execution ──────────────────────────────────────────────────
@@ -421,7 +363,13 @@ function _installHint(name, runtime) {
 }
 
 function main() {
-  const parsed = parseSpawnArgs(process.argv);
+  let parsed;
+  try {
+    parsed = parseSpawnArgs(process.argv);
+  } catch (err) {
+    console.error(`FATAL: ${err.message}`);
+    process.exit(78);
+  }
   if (!parsed) {
     console.error('Usage: node spawn-agent.js <prompt-file> <sysprompt-file> [--runtime <name>] [args...]');
     process.exit(1);
@@ -445,12 +393,18 @@ function main() {
   // (Windows non-junction reads don't follow symlinks the same way POSIX does).
   const promptText = readFileNoFollow(promptFile, 'utf8');
   const sysPromptText = readFileNoFollow(sysPromptFile, 'utf8');
+  try {
+    hydrateRuntimeOptionFiles(opts, { promptFile });
+  } catch (err) {
+    console.error(`FATAL: ${err.message}`);
+    process.exit(78);
+  }
 
   // Sys prompt tmp file — only when (a) NOT resuming and (b) the adapter
   // accepts a system prompt as a separate file. For runtimes that bake the
   // system prompt into the user prompt (e.g. Copilot), sysPromptText is
   // already merged inside `runtime.buildPrompt(prompt, sys)`.
-  const isResume = opts.sessionId != null;
+  const isResume = typeof opts.sessionId === 'string' && opts.sessionId.trim() !== '';
   const sysTmpPath = sysPromptFile + '.tmp';
   const wantsSystemPromptFile = typeof runtime.usesSystemPromptFile === 'function'
     ? runtime.usesSystemPromptFile({ isResume, opts })
@@ -672,9 +626,12 @@ function main() {
             // meta.keep_processes_skip_workdir_check is true) bypasses the
             // requireGitWorkdir check so legitimate non-git keep_processes
             // use cases (e.g., a daemon under /tmp) still anchor.
-            const reapOpts = process.env.MINIONS_KEEP_PROCESSES_SKIP_WORKDIR_CHECK === '1'
-              ? { requireGitWorkdir: false }
-              : {};
+            const reapOpts = {
+              requireGitWorkdir: process.env.MINIONS_KEEP_PROCESSES_SKIP_WORKDIR_CHECK !== '1',
+            };
+            if (process.env.MINIONS_KEEP_PROCESSES_ALLOWED_CWD_ROOT) {
+              reapOpts.allowedCwdRoot = process.env.MINIONS_KEEP_PROCESSES_ALLOWED_CWD_ROOT;
+            }
             const plan = keepProcessSweep.computeReapPlan(toKillPids, agentId, reapOpts);
             toKillPids = plan.toKill;
             kept = plan.kept;
@@ -714,6 +671,18 @@ function main() {
   });
 }
 
-module.exports = { parseSpawnArgs, buildSpawnInvocation, normalizeRuntimeExit, shouldInjectAdoTokenEnv, injectAdoTokenEnv, injectAdoTokenEnvForRepoHost, writeProcessExitSentinel, preApproveWorkspaceMcps, createParentPipeForwarder, assertStaleHeadOk };
+module.exports = {
+  parseSpawnArgs,
+  buildSpawnInvocation,
+  normalizeRuntimeExit,
+  shouldInjectAdoTokenEnv,
+  injectAdoTokenEnv,
+  injectAdoTokenEnvForRepoHost,
+  writeProcessExitSentinel,
+  preApproveWorkspaceMcps,
+  createParentPipeForwarder,
+  assertStaleHeadOk,
+  hydrateRuntimeOptionFiles, // exported for testing
+};
 
 if (require.main === module) main();

package/engine/spawn-phase-watchdog.js

@@ -36,6 +36,7 @@ const fs = require('fs');
 const path = require('path');
 const shared = require('./shared');
 const queries = require('./queries');
+const { resolveRuntime, isSpawnStartupEvent } = require('./runtimes');
 const { ENGINE_DEFAULTS, FAILURE_CLASS } = shared;
 const AGENTS_DIR = queries.AGENTS_DIR;
 const log = (level, msg) => shared.log ? shared.log(level, msg) : console.log(`[${level}] ${msg}`);
@@ -43,24 +44,6 @@ const log = (level, msg) => shared.log ? shared.log(level, msg) : console.log(`[
 // Lazy require to break circular dep with dispatch.js (which lazy-requires engine.js).
 function dispatch() { return require('./dispatch'); }
 
-// ── Per-runtime startup-only event filters ──────────────────────────────────
-//
-// Anything NOT in these sets is treated as "real task activity" and the
-// watchdog stands down. These match the runtimes/*.js KNOWN_EVENT_TYPES
-// startup section — keep in sync.
-
-const COPILOT_STARTUP_TYPES = new Set([
-  'session.mcp_server_status_changed',
-  'session.mcp_servers_loaded',
-  'session.skills_loaded',
-  'session.tools_updated',
-  'session.info',
-]);
-
-// Claude stream-json prints {"type":"system","subtype":"init|hook_started|hook_response"}
-// during startup before any assistant/user/tool_use/result events fire.
-const CLAUDE_STARTUP_SUBTYPES = new Set(['init', 'hook_started', 'hook_response']);
-
 // Header line that engine.js writes at spawn: "[<iso>] pid: <n>"
 const HEADER_LINE_RE = /^\[[^\]]+\]\s+(?:pid:|spawn-failed)/;
 
@@ -79,6 +62,12 @@ const HEADER_LINE_RE = /^\[[^\]]+\]\s+(?:pid:|spawn-failed)/;
  */
 function hasRealTaskActivity(tailText, runtimeName) {
   if (!tailText) return false;
+  let runtime;
+  try {
+    runtime = resolveRuntime(runtimeName);
+  } catch {
+    return true;
+  }
   const lines = String(tailText).split(/\r?\n/);
   for (const rawLine of lines) {
     const line = rawLine.trim();
@@ -100,23 +89,7 @@ function hasRealTaskActivity(tailText, runtimeName) {
       // Object with no `type` — unusual; treat as activity to stay safe.
       return true;
     }
-    if (runtimeName === 'copilot') {
-      if (COPILOT_STARTUP_TYPES.has(type)) continue;
-      // Anything else from Copilot is real (assistant.*, tool.*, result,
-      // session.task_complete, user.message, function).
-      return true;
-    }
-    if (runtimeName === 'claude' || !runtimeName) {
-      // Claude stream-json: only {type:'system', subtype:'init|hook_*'} is startup.
-      if (type === 'system') {
-        const sub = typeof evt.subtype === 'string' ? evt.subtype : '';
-        if (CLAUDE_STARTUP_SUBTYPES.has(sub)) continue;
-        // Other `system` subtypes (e.g. errors, banners) — treat as activity.
-        return true;
-      }
-      return true;
-    }
-    // Unknown runtime — be conservative.
+    if (isSpawnStartupEvent(runtime, evt)) continue;
     return true;
   }
   return false;
@@ -266,6 +239,4 @@ function _defaultTailReader(filePath) {
 module.exports = {
   checkSpawnPhaseStalls,
   hasRealTaskActivity, // exported for testing
-  COPILOT_STARTUP_TYPES, // exported for testing
-  CLAUDE_STARTUP_SUBTYPES, // exported for testing
 };

package/engine/timeout.js

@@ -25,14 +25,16 @@ let _engine = null;
 function engine() { if (!_engine) _engine = require('../engine'); return _engine; }
 const _pendingBranchPreservations = new Set();
 
-function resolveDispatchBranchPath(item) {
+function resolveDispatchBranchPath(item, config) {
   if (item?.worktreePath) return item.worktreePath;
-  if (item?.originalRef && item.meta?.project?.localPath) return item.meta.project.localPath;
+  if (shared.isLiveCheckoutDispatchRecord(item, config) && item.meta?.project?.localPath) {
+    return item.meta.project.localPath;
+  }
   return null;
 }
 
 function preserveDispatchBranch(item, config) {
-  const branchPath = resolveDispatchBranchPath(item);
+  const branchPath = resolveDispatchBranchPath(item, config);
   if (!branchPath || !item.meta?.branch) {
     return Promise.resolve({ pushed: false, reason: 'invalid-worktree' });
   }
@@ -55,17 +57,18 @@ async function _finalizeDeadDispatch(item, reason, failureClass, config, deps =
     require('./live-checkout').maybeRestoreLiveCheckoutFromRecord;
   const complete = deps.complete || dispatch().completeDispatch;
 
-  if (resolveDispatchBranchPath(item) && item.meta?.branch) {
+  if (resolveDispatchBranchPath(item, config) && item.meta?.branch) {
     try {
       await preserveBranch(item, config);
     } catch (err) {
       log('warn', `Orphan branch preservation failed for ${item.id}: ${err.message}`);
     }
   }
-  if (item.originalRef && item.meta?.branch && item.meta?.project?.localPath) {
+  if (shared.isLiveCheckoutDispatchRecord(item, config)) {
     try {
       await restoreLiveCheckout({
         item,
+        config,
         isTerminalFailure: true,
         resultLabel: 'orphaned',
         log: (lvl, msg) => log(lvl, msg),
@@ -719,7 +722,7 @@ function checkTimeouts(config) {
   const legacyAnnotationClears = new Set();
 
   function completeFromOutput(item, liveLogPath, processExitCode, detectedLogText, hasProcess, preservationDone = false, expectedProcInfo = activeProcesses.get(item.id)) {
-    if (!preservationDone && resolveDispatchBranchPath(item) && item.meta?.branch) {
+    if (!preservationDone && resolveDispatchBranchPath(item, config) && item.meta?.branch) {
       if (_pendingBranchPreservations.has(item.id)) return;
       _pendingBranchPreservations.add(item.id);
       preserveDispatchBranch(item, config)
@@ -776,12 +779,13 @@ function checkTimeouts(config) {
     // for a live-mode dispatch that finished AFTER an engine restart. This path
     // (output-detected completion of a re-attached process) has no in-memory
     // onAgentClose closure, so without this the tree is stranded on the agent
-    // branch. originalRef's presence is the live-mode signal; the helper no-ops
-    // for non-live records. Fire-and-forget + best-effort.
-    if (item.originalRef && item.meta?.branch && item.meta?.project?.localPath) {
+    // branch. Explicit dispatch provenance plus current config are the live-mode
+    // signal; worktree-mode records fail closed.
+    if (shared.isLiveCheckoutDispatchRecord(item, config)) {
       try {
         require('./live-checkout').maybeRestoreLiveCheckoutFromRecord({
           item,
+          config,
           isTerminalFailure: _completedAsError,
           resultLabel: _completedAsError ? 'error' : 'success',
           log: (lvl, msg) => log(lvl, msg),
@@ -1033,7 +1037,7 @@ function checkTimeouts(config) {
     // #853 — stale orphans have no process close event, so preserve their
     // clean committed branch explicitly before completeDispatch makes the
     // worktree eligible for teardown/quarantine.
-    if (resolveDispatchBranchPath(item) && item.meta?.branch) {
+    if (resolveDispatchBranchPath(item, config) && item.meta?.branch) {
       if (_pendingBranchPreservations.has(item.id)) continue;
       _pendingBranchPreservations.add(item.id);
       _finalizeDeadDispatch(item, reason, failureClass, config, { complete: completeDispatch })

package/engine/worktree-gc.js

@@ -41,6 +41,32 @@ function _managedSpawn() {
 
 const _noopLog = () => {};
 
+function _collectAnchoredCwds(listManagedSpecs, listKeepProcessCwds) {
+  const out = [];
+  try {
+    for (const rec of (listManagedSpecs() || [])) {
+      if (!rec || typeof rec.cwd !== 'string' || !rec.cwd) continue;
+      try { out.push(shared.realPathForComparison(rec.cwd)); } catch {}
+    }
+  } catch {}
+  try {
+    for (const cwd of (listKeepProcessCwds() || [])) {
+      if (typeof cwd !== 'string' || !cwd) continue;
+      try { out.push(shared.realPathForComparison(cwd)); } catch {}
+    }
+  } catch {}
+  return out;
+}
+
+function _isWorktreeCwdAnchored(worktreePath, anchoredCwds) {
+  for (const cwd of anchoredCwds) {
+    try {
+      if (shared.isPathInsideOrEqual(cwd, worktreePath)) return true;
+    } catch {}
+  }
+  return false;
+}
+
 // ── Stuck-dir escalation (Layer 4 of W-mq5o6bvy000x7191) ─────────────────────
 // In-memory ring of paths that have failed removal N consecutive times. After
 // escalation we (a) write a dedup'd inbox note, (b) suppress repeat per-tick
@@ -608,13 +634,11 @@ function shouldGcDispatchWorktree(opts) {
       ? listManagedSpecs
       : _managedSpawn().listManagedSpecs;
     const specs = fn() || [];
-    const wtAbs = path.resolve(worktreePath);
-    const wtPrefix = wtAbs + path.sep;
     for (const rec of specs) {
       if (!rec || typeof rec.cwd !== 'string' || rec.cwd.length === 0) continue;
-      let cwdAbs;
-      try { cwdAbs = path.resolve(rec.cwd); } catch { continue; }
-      if (cwdAbs === wtAbs || cwdAbs.startsWith(wtPrefix)) {
+      let anchored = false;
+      try { anchored = shared.isPathInsideOrEqual(rec.cwd, worktreePath); } catch {}
+      if (anchored) {
         return { gc: false, reason: 'managed-spawn-anchored' };
       }
     }
@@ -744,6 +768,12 @@ function pruneOrphanWorktrees(opts) {
       try { return _managedSpawn().listManagedSpecs(); }
       catch (_e) { return []; }
     });
+  const _listKeepProcessCwds = typeof opts.listKeepProcessCwds === 'function'
+    ? opts.listKeepProcessCwds
+    : (() => {
+      try { return _keepProcessSweep().getActiveKeepProcessCwds(); }
+      catch (_e) { return []; }
+    });
 
   // Pool-known paths (idle + borrowed + any stale entry still on disk). The
   // worktree-pool's own pruneStale() runs FIRST in cli boot so this snapshot
@@ -768,7 +798,11 @@ function pruneOrphanWorktrees(opts) {
   // review — Issue 2)
   const globalLiveDirNames = new Set();
   for (const d of [...(dispatchSnap.active || []), ...(dispatchSnap.pending || [])]) {
-    if (!d || !d.id || !d.meta || !d.meta.branch) continue;
+    if (!d || !d.id) continue;
+    if (d.worktreePath) {
+      try { globalLiveDirNames.add(path.basename(path.resolve(d.worktreePath))); } catch {}
+    }
+    if (!d.meta || !d.meta.branch) continue;
     const dispatchProject = typeof d.meta.project === 'string'
       ? d.meta.project
       : (d.meta.project?.name || 'default');
@@ -781,17 +815,7 @@ function pruneOrphanWorktrees(opts) {
     } catch (_e) { /* defensive */ }
   }
 
-  // Resolved managed-spawn cwds (per-cwd → resolved abs path). Used to
-  // reject GC of any dir that contains (or equals) a live service's cwd.
-  // (PR #2627 review — Issue 1)
-  const managedSpawnCwds = [];
-  try {
-    for (const rec of (_listManagedSpecs() || [])) {
-      if (!rec || typeof rec.cwd !== 'string' || rec.cwd.length === 0) continue;
-      try { managedSpawnCwds.push(path.resolve(rec.cwd)); }
-      catch (_e) { /* malformed cwd — skip */ }
-    }
-  } catch (_e) { /* optional */ }
+  const anchoredCwds = _collectAnchoredCwds(_listManagedSpecs, _listKeepProcessCwds);
 
   const result = { scanned: 0, kept: 0, evicted: 0, failed: 0, perProject: {} };
 
@@ -836,18 +860,10 @@ function pruneOrphanWorktrees(opts) {
         projStats.kept++; result.kept++;
         continue;
       }
-      // 3. managed_spawn cwd anchor protection.
-      if (managedSpawnCwds.length > 0) {
-        const wtPathNorm = path.resolve(wtPath);
-        const wtPrefix = wtPathNorm + path.sep;
-        let anchored = false;
-        for (const cwd of managedSpawnCwds) {
-          if (cwd === wtPathNorm || cwd.startsWith(wtPrefix)) { anchored = true; break; }
-        }
-        if (anchored) {
-          projStats.kept++; result.kept++;
-          continue;
-        }
+      // 3. managed_spawn / keep_processes cwd anchor protection.
+      if (_isWorktreeCwdAnchored(wtPath, anchoredCwds)) {
+        projStats.kept++; result.kept++;
+        continue;
       }
 
       // P-c7e2b405 — route the slow-retry gate, ownership-marker gate (now
@@ -938,6 +954,12 @@ function pruneOrphanWorktreesFromGitRegistry(opts) {
       try { return _managedSpawn().listManagedSpecs(); }
       catch (_e) { return []; }
     });
+  const _listKeepProcessCwds = typeof opts.listKeepProcessCwds === 'function'
+    ? opts.listKeepProcessCwds
+    : (() => {
+      try { return _keepProcessSweep().getActiveKeepProcessCwds(); }
+      catch (_e) { return []; }
+    });
   const _execSilent = typeof opts.execSilent === 'function'
     ? opts.execSilent
     : shared.execSilent;
@@ -986,15 +1008,7 @@ function pruneOrphanWorktreesFromGitRegistry(opts) {
     for (const p of opts.extraPoolPaths) poolPaths.add(worktreePool._normalizePath(p));
   }
 
-  // managed_spawn cwds.
-  const managedSpawnCwds = [];
-  try {
-    for (const rec of (_listManagedSpecs() || [])) {
-      if (!rec || typeof rec.cwd !== 'string' || rec.cwd.length === 0) continue;
-      try { managedSpawnCwds.push(path.resolve(rec.cwd)); }
-      catch (_e) { /* malformed cwd — skip */ }
-    }
-  } catch (_e) { /* optional */ }
+  const anchoredCwds = _collectAnchoredCwds(_listManagedSpecs, _listKeepProcessCwds);
 
   const result = { scanned: 0, kept: 0, evicted: 0, failed: 0, prunedRegistry: 0, perProject: {} };
   const _seenAbs = new Set(); // dedup across projects sharing a parent
@@ -1058,14 +1072,9 @@ function pruneOrphanWorktreesFromGitRegistry(opts) {
       if (poolPaths.has(normPath)) {
         projStats.kept++; result.kept++; continue;
       }
-      // managed_spawn anchor protection
-      if (managedSpawnCwds.length > 0) {
-        const wtPrefix = wtAbs + path.sep;
-        let anchored = false;
-        for (const cwd of managedSpawnCwds) {
-          if (cwd === wtAbs || cwd.startsWith(wtPrefix)) { anchored = true; break; }
-        }
-        if (anchored) { projStats.kept++; result.kept++; continue; }
+      // managed_spawn / keep_processes cwd anchor protection.
+      if (_isWorktreeCwdAnchored(wtAbs, anchoredCwds)) {
+        projStats.kept++; result.kept++; continue;
       }
 
       // P-c7e2b405 — ownership-marker gate, slow-retry gate, remove, escalate,