@yemi33/minions 0.1.2383 → 0.1.2385

package/engine/agent-worker-pool.js

@@ -30,14 +30,15 @@
  *
  * Assignment strategy (acquireWorker), per the P-7a1c2e4f spike's findings:
  *
- *   1. A FREE worker whose mcpServersHash already matches the request wins
+ *   1. A FREE worker whose MCP config, process environment, and process cwd
+ *      match the request wins
  *      first — reused via a fresh `session/new` (worker.newSession), no
  *      respawn, no wasted initialize handshake.
  *   2. Otherwise any OTHER free worker is evicted (closed) and a replacement
  *      is spawned fresh with the requested mcpServers/cwd — MCP servers are
  *      resolved at `copilot --acp` process boot (via $COPILOT_HOME), so a
- *      changed local/stdio server set requires a full respawn, not just a
- *      new session (spike (c)).
+ *      changed local/stdio server set or process cwd requires a full respawn,
+ *      not just a new session (spike (c)).
  *   3. Otherwise, if the pool has room (fewer than `poolSize` workers
  *      allocated across free+busy+in-flight-spawn), spawn a brand new
  *      worker.
@@ -59,7 +60,9 @@
  * No new npm deps — Node built-ins only.
  */
 
+const path = require('path');
 const transport = require('./acp-transport');
+const { buildWorkerArgs } = require('./runtimes');
 const { Worker, hashMcpServers, hashProcessContext } = transport;
 
 // Test seam — mirrors engine/cc-worker-pool.js's `_internals` pattern, but is
@@ -68,6 +71,11 @@ const { Worker, hashMcpServers, hashProcessContext } = transport;
 const _internals = {
   spawnAcp: transport.spawnAcp,
   killImmediate: transport.killImmediate,
+  killRoot: transport.killRoot,
+  async getProcessStartedAt(pid) {
+    const processes = await require('./shared').listAllProcessesAsync();
+    return Number(processes.find((entry) => entry.pid === pid)?.startedAt) || 0;
+  },
   now() { return Date.now(); },
 };
 
@@ -82,8 +90,10 @@ let _poolSize = DEFAULT_POOL_SIZE;
 
 function setPoolSize(n) {
   const parsed = Number(n);
-  if (!Number.isFinite(parsed) || parsed <= 0) return _poolSize;
-  _poolSize = Math.floor(parsed);
+  const nextSize = Math.floor(parsed);
+  if (!Number.isFinite(parsed) || nextSize <= 0) return _poolSize;
+  _poolSize = nextSize;
+  _trimFreeWorkers();
   _pump();
   return _poolSize;
 }
@@ -108,17 +118,57 @@ const _free = [];              // Worker[] — idle, unleased
 const _busy = new Map();       // dispatchId → Worker — currently leased
 const _queue = [];             // pending acquire requests, FIFO
 const _leaseContexts = new Map(); // dispatchId → mutable session-only context
+const _acquiring = new Map();  // dispatchId → queued/reserved/setup request
+const _starting = new Set();   // Worker instances still in ACP handshake
 // Slots reserved for a worker that's mid-reuse/respawn/fresh-spawn — pulled
 // out of `_free` (or not yet spawned) but not yet placed in `_busy`. Counted
 // toward `_poolSize` so a burst of concurrent acquireWorker calls can't
 // overshoot the configured pool size while spawns are still in flight.
 let _reserved = 0;
 let _draining = false;
+let _enabled = true;
 
 function _occupied() {
   return _free.length + _busy.size + _reserved;
 }
 
+function _pathKey(value) {
+  const resolved = path.resolve(value || process.cwd());
+  return process.platform === 'win32' ? resolved.toLowerCase() : resolved;
+}
+
+function _closeWorker(worker) {
+  try {
+    if (worker.processStartedAt > 0) worker.close();
+    else worker.abandon();
+  } catch { /* already torn down */ }
+}
+
+function _trimFreeWorkers() {
+  while (_free.length > 0 && _occupied() > _poolSize) {
+    _closeWorker(_free.pop());
+  }
+}
+
+function _settleRequest(req, method, value) {
+  if (req.settled) return false;
+  req.settled = true;
+  try { req[method](value); } catch { /* already settled */ }
+  return true;
+}
+
+function _releaseReservation(req) {
+  if (!req.reserved) return;
+  req.reserved = false;
+  _reserved = Math.max(0, _reserved - 1);
+}
+
+function _acquisitionUnavailableError(req) {
+  if (req?.cancelled) return new Error('agent-worker-pool: acquisition cancelled');
+  if (_draining) return new Error('agent-worker-pool: draining');
+  return new Error('agent-worker-pool: disabled');
+}
+
 // ── Queue pump ──────────────────────────────────────────────────────────
 //
 // Fully synchronous per pass: each iteration either satisfies the head of
@@ -130,18 +180,48 @@ function _occupied() {
 // no-op re-pump; failure frees the reservation and DOES let another queued
 // request through).
 function _pump() {
+  if (_draining || !_enabled) return;
   while (_queue.length > 0) {
     const req = _queue[0];
 
-    const matchIdx = _free.findIndex((w) =>
+    const compatible = (w) => (
       w.runtime === req.runtime
       && w.mcpServersHash === req.mcpServersHash
       && w.processContextHash === req.processContextHash
+      && w.processCwdKey === req.processCwdKey
     );
+    if (req.resumeSessionId) {
+      const busyOwnsSession = [..._busy.values()].some((worker) =>
+        worker.runtime === req.runtime && worker.sessionId === req.resumeSessionId);
+      const acquiringOwnsSession = [..._acquiring.values()].some((other) =>
+        other !== req
+        && other.reserved
+        && other.runtime === req.runtime
+        && (other.resumeSessionId === req.resumeSessionId || other.worker?.sessionId === req.resumeSessionId));
+      if (busyOwnsSession || acquiringOwnsSession) break;
+
+      const sessionOwnerIdx = _free.findIndex((worker) =>
+        worker.runtime === req.runtime && worker.sessionId === req.resumeSessionId);
+      if (sessionOwnerIdx >= 0) {
+        _queue.shift();
+        const sessionOwner = _free.splice(sessionOwnerIdx, 1)[0];
+        _reserved++;
+        req.reserved = true;
+        if (compatible(sessionOwner) && _pathKey(sessionOwner.cwd) === _pathKey(req.cwd)) {
+          _reuseWorker(sessionOwner, req);
+        } else {
+          _respawnWorker(sessionOwner, req);
+        }
+        continue;
+      }
+    }
+
+    const matchIdx = _free.findIndex(compatible);
     if (matchIdx >= 0) {
       _queue.shift();
       const worker = _free.splice(matchIdx, 1)[0];
       _reserved++;
+      req.reserved = true;
       _reuseWorker(worker, req);
       continue;
     }
@@ -150,6 +230,7 @@ function _pump() {
       _queue.shift();
       const stale = _free.shift();
       _reserved++;
+      req.reserved = true;
       _respawnWorker(stale, req);
       continue;
     }
@@ -157,6 +238,7 @@ function _pump() {
     if (_occupied() < _poolSize) {
       _queue.shift();
       _reserved++;
+      req.reserved = true;
       _spawnFreshWorker(req);
       continue;
     }
@@ -168,40 +250,55 @@ function _pump() {
 }
 
 async function _reuseWorker(worker, req) {
+  req.worker = worker;
   try {
-    await worker.newSession({ mcpServers: req.mcpServers, model: req.model, effort: req.effort, cwd: req.cwd });
+    if (req.resumeSessionId) {
+      await worker.loadSession(req.resumeSessionId, {
+        mcpServers: req.mcpServers,
+        model: req.model,
+        effort: req.effort,
+        cwd: req.cwd,
+      });
+    } else {
+      await worker.newSession({
+        mcpServers: req.mcpServers,
+        model: req.model,
+        effort: req.effort,
+        cwd: req.cwd,
+      });
+    }
     _trace(`dispatch=${req.dispatchId} reuse: worker=${worker.id} sessionId=${worker.sessionId}`);
-    _reserved--;
-    if (_draining) {
-      try { worker.close(); } catch { /* already torn down */ }
-      req.reject(new Error('agent-worker-pool: draining'));
+    _releaseReservation(req);
+    if (req.cancelled || _draining || !_enabled) {
+      _closeWorker(worker);
+      _settleRequest(req, 'reject', _acquisitionUnavailableError(req));
       return;
     }
-    req.resolve(worker);
+    _settleRequest(req, 'resolve', worker);
   } catch (err) {
-    _reserved--;
+    _releaseReservation(req);
     // The worker died mid-newSession (or the daemon rejected the call) —
     // it's already unusable; don't return it to `_free`.
-    try { worker.close(); } catch { /* already torn down */ }
-    req.reject(err);
+    _closeWorker(worker);
+    _settleRequest(req, 'reject', err);
     _pump();
   }
 }
 
 async function _respawnWorker(stale, req) {
-  try { stale.close(); } catch { /* already torn down */ }
+  _closeWorker(stale);
   try {
     const worker = await _bootWorker(req);
-    _reserved--;
-    if (_draining) {
-      try { worker.close(); } catch { /* already torn down */ }
-      req.reject(new Error('agent-worker-pool: draining'));
+    _releaseReservation(req);
+    if (req.cancelled || _draining || !_enabled) {
+      _closeWorker(worker);
+      _settleRequest(req, 'reject', _acquisitionUnavailableError(req));
       return;
     }
-    req.resolve(worker);
+    _settleRequest(req, 'resolve', worker);
   } catch (err) {
-    _reserved--;
-    req.reject(err);
+    _releaseReservation(req);
+    _settleRequest(req, 'reject', err);
     _pump();
   }
 }
@@ -209,16 +306,16 @@ async function _respawnWorker(stale, req) {
 async function _spawnFreshWorker(req) {
   try {
     const worker = await _bootWorker(req);
-    _reserved--;
-    if (_draining) {
-      try { worker.close(); } catch { /* already torn down */ }
-      req.reject(new Error('agent-worker-pool: draining'));
+    _releaseReservation(req);
+    if (req.cancelled || _draining || !_enabled) {
+      _closeWorker(worker);
+      _settleRequest(req, 'reject', _acquisitionUnavailableError(req));
       return;
     }
-    req.resolve(worker);
+    _settleRequest(req, 'resolve', worker);
   } catch (err) {
-    _reserved--;
-    req.reject(err);
+    _releaseReservation(req);
+    _settleRequest(req, 'reject', err);
     _pump();
   }
 }
@@ -231,6 +328,9 @@ async function _spawnFreshWorker(req) {
 // whichever pool collection it's currently sitting in, then re-pumps so a
 // queued request can spawn its replacement.
 async function _bootWorker(req) {
+  if (req.cancelled || _draining || !_enabled) {
+    throw _acquisitionUnavailableError(req);
+  }
   const worker = new Worker({
     runtime: req.runtime,
     id: `agent-pool-${_nextWorkerId++}`,
@@ -240,19 +340,33 @@ async function _bootWorker(req) {
     mcpServersHash: req.mcpServersHash,
     processEnv: req.processEnv,
     processContextHash: req.processContextHash,
+    workerOptions: req.workerOptions,
+    resumeSessionId: req.resumeSessionId,
     cwd: req.cwd,
+    processCwd: req.processCwd,
     internals: _internals,
     trace: _trace,
   });
+  worker.processCwdKey = req.processCwdKey;
+  req.worker = worker;
+  _starting.add(worker);
   const initPromise = worker._spawnAndInit();
+  const identityPromise = worker.proc?.pid
+    ? _internals.getProcessStartedAt(worker.proc.pid)
+    : Promise.resolve(0);
   worker.initPromise = initPromise;
   try {
-    await initPromise;
+    const [, processStartedAt] = await Promise.all([initPromise, identityPromise]);
+    if (worker.killed || processStartedAt <= 0) {
+      throw new Error('agent-worker-pool: worker process identity unavailable after startup');
+    }
+    worker.processStartedAt = processStartedAt;
   } catch (err) {
-    try { worker.close(); } catch { /* already torn down */ }
+    _closeWorker(worker);
     throw err;
   } finally {
     worker.initPromise = null;
+    _starting.delete(worker);
   }
   if (worker.proc) {
     worker.proc.once('exit', () => _onWorkerExit(worker));
@@ -315,11 +429,13 @@ function _clearLeaseContext(dispatchId) {
 }
 
 async function acquireWorker({
-  runtime, dispatchId, cwd, model, effort, mcpServers, hermeticDirs, processEnv, sessionContext,
+  runtime, dispatchId, cwd, processCwd, model, effort, mcpServers, hermeticDirs,
+  processEnv, workerOptions, sessionId, sessionContext,
 } = {}) {
   if (!dispatchId) throw new Error('agent-worker-pool.acquireWorker: dispatchId is required');
   if (_draining) throw new Error('agent-worker-pool: draining');
-  if (_busy.has(dispatchId) || _leaseContexts.has(dispatchId)) {
+  if (!_enabled) throw new Error('agent-worker-pool: disabled');
+  if (_busy.has(dispatchId) || _leaseContexts.has(dispatchId) || _acquiring.has(dispatchId)) {
     throw new Error(
       `agent-worker-pool.acquireWorker: dispatchId ${dispatchId} already has an active worker ` +
       '(1 worker : 1 active dispatch invariant — call release() before acquiring again)'
@@ -331,16 +447,39 @@ async function acquireWorker({
   const workerProcessEnv = processEnv && typeof processEnv === 'object'
     ? Object.freeze({ ...processEnv })
     : undefined;
-  const processContextHash = hashProcessContext(workerProcessEnv);
+  const frozenWorkerOptions = Object.freeze(
+    workerOptions && typeof workerOptions === 'object' ? { ...workerOptions } : {}
+  );
+  const normalizedSessionCwd = path.resolve(cwd || process.cwd());
+  const normalizedProcessCwd = path.resolve(processCwd || cwd || process.cwd());
+  const processCwdKey = _pathKey(normalizedProcessCwd);
+  const workerArgs = buildWorkerArgs(runtimeAdapter, {
+    ...frozenWorkerOptions,
+    cwd: normalizedProcessCwd,
+    env: workerProcessEnv,
+  });
+  const processContextHash = hashProcessContext(workerProcessEnv, {
+    runtime: runtimeAdapter.name,
+    workerArgs,
+    processCwd: processCwdKey,
+  });
   const leaseContext = sessionContext && typeof sessionContext === 'object'
     ? { ...sessionContext }
     : {};
   const req = {
     runtime: runtimeAdapter,
-    dispatchId, cwd, model, effort, mcpServers, mcpServersHash,
-    processEnv: workerProcessEnv, processContextHash,
+    dispatchId, cwd: normalizedSessionCwd, processCwd: normalizedProcessCwd,
+    model, effort, mcpServers, mcpServersHash,
+    processEnv: workerProcessEnv, processContextHash, processCwdKey,
+    workerOptions: frozenWorkerOptions,
+    resumeSessionId: sessionId || null,
+    cancelled: false,
+    settled: false,
+    reserved: false,
+    worker: null,
   };
   _leaseContexts.set(dispatchId, leaseContext);
+  _acquiring.set(dispatchId, req);
 
   let worker;
   try {
@@ -352,18 +491,23 @@ async function acquireWorker({
     });
 
     if (_draining) throw new Error('agent-worker-pool: draining');
+    if (req.cancelled || !_enabled) throw new Error('agent-worker-pool: acquisition cancelled');
     _busy.set(dispatchId, worker);
     await _applyHermeticDirs(worker, hermeticDirs);
     if (worker.killed) throw new Error('agent-worker-pool: worker died during acquisition');
-    if (_draining) throw new Error('agent-worker-pool: draining');
+    if (req.cancelled || _draining || !_enabled) {
+      throw _acquisitionUnavailableError(req);
+    }
   } catch (err) {
     if (_busy.get(dispatchId) === worker) _busy.delete(dispatchId);
     _clearLeaseContext(dispatchId);
     if (worker) {
-      try { worker.close(); } catch { /* already torn down */ }
+      _closeWorker(worker);
       _pump();
     }
     throw err;
+  } finally {
+    _acquiring.delete(dispatchId);
   }
 
   return {
@@ -376,6 +520,7 @@ async function acquireWorker({
     // snapshots of the underlying worker's current values (a getter, not a
     // captured copy), since sessionId can rotate under a reused worker.
     get pid() { return (worker.proc && worker.proc.pid) || null; },
+    get processStartedAt() { return worker.processStartedAt || 0; },
     get sessionId() { return worker.sessionId || null; },
     get currentModel() { return worker.currentModel || null; },
     stream: async (promptText, opts = {}) => {
@@ -393,9 +538,26 @@ async function acquireWorker({
       return worker.cancel();
     },
     release: () => release(dispatchId),
+    discard: () => discard(dispatchId),
+    abandon: () => abandon(dispatchId),
+    preserveDescendants: (pids) => worker.preserveDescendants(pids),
   };
 }
 
+function cancelAcquire(dispatchId) {
+  const req = _acquiring.get(dispatchId);
+  if (!req) return false;
+  req.cancelled = true;
+  const queueIdx = _queue.indexOf(req);
+  if (queueIdx >= 0) _queue.splice(queueIdx, 1);
+  if (_busy.get(dispatchId) === req.worker) _busy.delete(dispatchId);
+  _clearLeaseContext(dispatchId);
+  if (req.worker) _closeWorker(req.worker);
+  _settleRequest(req, 'reject', new Error('agent-worker-pool: acquisition cancelled'));
+  _pump();
+  return true;
+}
+
 // Return a leased worker to the free set — unless it died during the lease
 // (WORKER_DIED), in which case it's simply dropped (already evicted from
 // `_busy` by `_onWorkerExit` if the crash happened before release(), or
@@ -412,9 +574,18 @@ function release(dispatchId) {
     _pump();
     return true;
   }
-  if (_draining) {
-    try { worker.close(); } catch { /* already torn down */ }
-    _trace(`dispatch=${dispatchId} release: draining, worker=${worker.id} closed`);
+
+  if (worker.inflight) {
+    _closeWorker(worker);
+    _trace(`dispatch=${dispatchId} release: worker=${worker.id} still had an inflight turn and was evicted`);
+    _pump();
+    return true;
+  }
+
+  if (_draining || !_enabled || _occupied() >= _poolSize) {
+    _closeWorker(worker);
+    _trace(`dispatch=${dispatchId} release: worker=${worker.id} closed instead of exceeding pool capacity`);
+    _pump();
     return true;
   }
   _free.push(worker);
@@ -423,14 +594,55 @@ function release(dispatchId) {
   return true;
 }
 
+function discard(dispatchId) {
+  const worker = _busy.get(dispatchId);
+  _clearLeaseContext(dispatchId);
+  if (!worker) return false;
+  _busy.delete(dispatchId);
+  _closeWorker(worker);
+  _trace(`dispatch=${dispatchId} discard: worker=${worker.id} evicted`);
+  _pump();
+  return true;
+}
+
+function abandon(dispatchId) {
+  const worker = _busy.get(dispatchId);
+  _clearLeaseContext(dispatchId);
+  if (!worker) return false;
+  _busy.delete(dispatchId);
+  try { worker.abandon(); } catch { /* pipe already closed */ }
+  _trace(`dispatch=${dispatchId} abandon: worker=${worker.id} evicted without signaling an unverified PID`);
+  _pump();
+  return true;
+}
+
+function setEnabled(enabled) {
+  const next = enabled === true;
+  if (_enabled === next) return _enabled;
+  if (next && _draining) return false;
+  _enabled = next;
+  if (!_enabled) {
+    for (const dispatchId of [..._acquiring.keys()]) cancelAcquire(dispatchId);
+    for (const worker of _free.splice(0)) _closeWorker(worker);
+  } else {
+    _pump();
+  }
+  return _enabled;
+}
+
+function isEnabled() {
+  return _enabled;
+}
+
 function beginDrain() {
   if (_draining) return;
   _draining = true;
   for (const req of _queue.splice(0)) {
-    try { req.reject(new Error('agent-worker-pool: draining')); } catch { /* already settled */ }
+    _clearLeaseContext(req.dispatchId);
+    _settleRequest(req, 'reject', new Error('agent-worker-pool: draining'));
   }
   for (const worker of _free.splice(0)) {
-    try { worker.close(); } catch { /* already torn down */ }
+    _closeWorker(worker);
   }
 }
 
@@ -448,26 +660,29 @@ function getActiveLeaseIds() {
 
 function shutdown() {
   _draining = true;
-  for (const req of _queue.splice(0)) {
-    _clearLeaseContext(req.dispatchId);
-    try { req.reject(new Error('agent-worker-pool: shutdown')); } catch { /* swallow */ }
-  }
+  _enabled = false;
+  for (const dispatchId of [..._acquiring.keys()]) cancelAcquire(dispatchId);
   for (const worker of _free.splice(0)) {
-    try { worker.close(); } catch { /* swallow */ }
+    _closeWorker(worker);
   }
   for (const [, worker] of _busy) {
-    try { worker.close(); } catch { /* swallow */ }
+    _closeWorker(worker);
   }
+  for (const worker of _starting) _closeWorker(worker);
   _busy.clear();
   for (const dispatchId of [..._leaseContexts.keys()]) _clearLeaseContext(dispatchId);
-  _reserved = 0;
 }
 
 module.exports = {
   acquireWorker,
+  cancelAcquire,
   release,
+  discard,
+  abandon,
   setPoolSize,
   getPoolSize,
+  setEnabled,
+  isEnabled,
   beginDrain,
   isDraining,
   isDrained,
@@ -480,4 +695,6 @@ module.exports = {
   _busy,
   _queue,
   _leaseContexts,
+  _acquiring,
+  _starting,
 };

package/engine/cc-worker-pool.js

@@ -79,6 +79,7 @@ const {
 const _internals = {
   spawnAcp: transport.spawnAcp,
   killImmediate: transport.killImmediate,
+  killRoot: transport.killRoot,
   now() { return Date.now(); },
 };
 
@@ -207,7 +208,13 @@ async function getSession({ runtime, tabId, model, effort, mcpServers, systemPro
       // and create a fresh one. Saves the ~2.1 s initialize handshake.
       // Pass model/effort so the NEW session picks up any override the
       // caller has rotated in (Bug B / issue #2479).
-      await worker.newSession({ mcpServers, systemPromptHash, model, effort });
+      try {
+        await worker.newSession({ mcpServers, systemPromptHash, model, effort });
+      } catch (err) {
+        if (_tabs.get(tabId) === worker) _tabs.delete(tabId);
+        try { worker.close(); } catch { /* already torn down */ }
+        throw err;
+      }
       worker.lastUsedAt = _internals.now();
       lifecycle = 'new-session';
     } else {

package/engine/cleanup.js

@@ -808,16 +808,20 @@ async function runCleanup(config, verbose = false) {
       // normalized cwd values from managed-process state and protect any
       // worktree dir that contains one. Cwd is optional per the schema, so
       // entries without cwd contribute nothing.
-      const _managedSpawnCwds = [];
+      const _anchoredProcessCwds = [];
       try {
         const _ms = require('./managed-spawn');
         for (const rec of _ms.listManagedSpecs()) {
           if (rec && typeof rec.cwd === 'string' && rec.cwd.length > 0) {
-            try { _managedSpawnCwds.push(path.resolve(rec.cwd)); }
+            try { _anchoredProcessCwds.push(shared.realPathForComparison(rec.cwd)); }
             catch (_e) { /* malformed cwd — skip */ }
           }
         }
       } catch (e) { log('warn', `managed-spawn cwd anchor lookup failed: ${e.message}`); }
+      try {
+        const _kp = require('./keep-process-sweep');
+        _anchoredProcessCwds.push(..._kp.getActiveKeepProcessCwds());
+      } catch (e) { log('warn', `keep-processes cwd anchor lookup failed: ${e.message}`); }
 
       // Probe `git branch --show-current` for every worktree in chunks of 5.
       // Sequential probing was the dominant cost in the cleanup phase
@@ -886,20 +890,20 @@ async function runCleanup(config, verbose = false) {
           if (verbose) console.log(`  Skipping worktree ${dir}: pool-borrowed by active dispatch`);
         }
 
-        // W-mpbinmrh001907e9 — managed-spawn cwd anchor protection.
-        // Worktrees backing live managed-spawn cwds must outlive the
-        // originating dispatch; the engine-owned services run inside them.
+        // Long-running process cwd anchor protection.
+        // Worktrees backing live managed_spawn or keep_processes cwds must outlive the
+        // originating dispatch.
         // Overrides merged-branch and age sweeps because the cwd record is
         // the authoritative signal that something live still uses the dir.
-        if (_managedSpawnCwds.length > 0) {
-          const _wtPathNorm = path.resolve(wtPath);
-          const _wtPathPrefix = _wtPathNorm + path.sep;
-          for (const cwd of _managedSpawnCwds) {
-            if (cwd === _wtPathNorm || cwd.startsWith(_wtPathPrefix)) {
+        if (_anchoredProcessCwds.length > 0) {
+          for (const cwd of _anchoredProcessCwds) {
+            let anchored = false;
+            try { anchored = shared.isPathInsideOrEqual(cwd, wtPath); } catch {}
+            if (anchored) {
               isProtected = true;
               if (shouldClean) {
                 shouldClean = false;
-                if (verbose) console.log(`  Skipping worktree ${dir}: managed-spawn cwd anchor`);
+                if (verbose) console.log(`  Skipping worktree ${dir}: long-running process cwd anchor`);
               }
               break;
             }