agent-relay-orchestrator 0.119.3 → 0.119.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-relay-orchestrator",
-  "version": "0.119.3",
+  "version": "0.119.7",
   "description": "Agent Relay orchestrator — manages agent lifecycle across hosts",
   "type": "module",
   "bin": {
@@ -16,8 +16,8 @@
     "test": "bun test"
   },
   "dependencies": {
-    "agent-relay-providers": "0.104.2",
-    "agent-relay-sdk": "0.2.104",
+    "agent-relay-providers": "0.104.3",
+    "agent-relay-sdk": "0.2.105",
     "callmux": "0.23.0"
   },
   "devDependencies": {

package/src/control.ts

@@ -32,6 +32,7 @@ interface ControlHandler {
 }
 
 const DEFAULT_MAX_CONCURRENT_SPAWNS = 2;
+const TERMINAL_COMMAND_STATUSES = new Set(["succeeded", "failed", "timed_out", "rejected", "canceled"]);
 
 // #930/#880 — per-host spawn concurrency cap. Bursts of spawns racing worktree
 // materialization + port churn during the registration window are what surface
@@ -95,6 +96,8 @@ interface ControlHandlerDeps {
   waitForRegistration?: WaitForRegistration;
   // Override the fail-safe registration timeout, bypassing the env parse (tests).
   registrationTimeoutMs?: number;
+  // Injectable stop dispatch — production uses tmux/system process teardown.
+  stopSession?: typeof stopSession;
 }
 
 export function createControlHandler(
@@ -104,6 +107,7 @@ export function createControlHandler(
 ): ControlHandler {
   let managedAgents: ManagedAgentReport[] = [];
   const dispatchSpawn = deps.spawnAgent ?? spawnAgent;
+  const dispatchStop = deps.stopSession ?? stopSession;
   // In-memory counter is correct here: a slot only needs to live within this
   // orchestrator process, and a crash resets in-flight spawns anyway (#881 Q1).
   const spawnSlots = new Semaphore(deps.maxConcurrentSpawns ?? resolveMaxConcurrentSpawns());
@@ -114,14 +118,38 @@ export function createControlHandler(
   // registration window. Tracked so tests/shutdown can observe and settle them.
   const backgroundSpawns = new Set<Promise<void>>();
 
-  async function handleSpawn(ctrl: Record<string, any>): Promise<ManagedAgentReport> {
-    const opts = spawnOptionsFromControl(ctrl, config);
+  async function spawnManagedAgent(opts: SpawnOptions, action = "Spawned"): Promise<ManagedAgentReport> {
     const agent = await dispatchSpawn(opts, config);
     managedAgents.push(agent);
-    console.error(`[orchestrator] Spawned ${opts.provider} agent: ${agent.tmuxSession}`);
+    console.error(`[orchestrator] ${action} ${opts.provider} agent: ${agent.tmuxSession}`);
     return agent;
   }
 
+  async function spawnAndWaitForRegistration(opts: SpawnOptions, action = "Spawned"): Promise<ManagedAgentReport> {
+    const agent = await spawnManagedAgent(opts, action);
+    const registered = await waitForRegistration(agent, registrationTimeoutMs);
+    if (!registered) {
+      // Not a spawn failure — the process launched; it just didn't register in
+      // time. Release the slot (fail-safe) so a slow/never-registering child
+      // can't wedge capacity, but still treat the launch as successful.
+      console.error(`[orchestrator] spawn ${agent.tmuxSession} did not register within ${registrationTimeoutMs}ms; releasing slot (fail-safe)`);
+    }
+    return agent;
+  }
+
+  async function markSpawnCommandFailed(command: RelayCommand, error: unknown): Promise<void> {
+    console.error(`[orchestrator] spawn dispatch failed: ${errMessage(error)}`);
+    // #930 — the `failed` status write can itself reject during a relay blip. Wrap it so
+    // a failed status write can't re-throw out of the backgrounded task (belt-and-suspenders
+    // with the `.catch` in dispatchSpawnCommand). The command may strand non-terminal until
+    // the TTL sweep / watchdog reconciles it, but the task settles cleanly regardless.
+    try {
+      await relay.updateCommand(command.id, "failed", undefined, errMessage(error));
+    } catch (statusError) {
+      console.error(`[orchestrator] failed to mark spawn command failed: ${errMessage(statusError)}`);
+    }
+  }
+
   // #930/#880 — dispatch a spawn command concurrently, up to the per-host cap.
   //
   // The command is CLAIMED (status → accepted) synchronously here, BEFORE we
@@ -151,28 +179,31 @@ export function createControlHandler(
   async function runSpawnToRegistration(command: RelayCommand): Promise<void> {
     // Blocks FIFO until a slot frees — this is what bounds concurrent spawns to N.
     await spawnSlots.acquire();
+    let launched = false;
     try {
+      const current = await relay.getCommand(command.id);
+      if (!current || TERMINAL_COMMAND_STATUSES.has(current.status)) {
+        console.error(`[orchestrator] skipping spawn command ${command.id}: ${current ? `status is ${current.status}` : "command not found"}`);
+        return;
+      }
       await relay.updateCommand(command.id, "running");
-      const agent = await handleSpawn(command.params);
-      const registered = await waitForRegistration(agent, registrationTimeoutMs);
-      if (!registered) {
-        // Not a spawn failure — the process launched; it just didn't register in
-        // time. Release the slot (fail-safe) so a slow/never-registering child
-        // can't wedge capacity, but still settle the command as succeeded.
-        console.error(`[orchestrator] spawn ${agent.tmuxSession} did not register within ${registrationTimeoutMs}ms; releasing slot (fail-safe)`);
+      try {
+        await spawnAndWaitForRegistration(spawnOptionsFromControl(command.params, config));
+        launched = true;
+      } catch (error) {
+        await markSpawnCommandFailed(command, error);
+        return;
       }
+      // #956 — from this point the child process launched. A relay blip while
+      // recording success is a settle failure, not a spawn failure; do not flip
+      // the command to failed and notify the parent while the child may register.
       await relay.updateCommand(command.id, "succeeded", { managedAgents });
       await relay.updateManagedAgents(managedAgents);
     } catch (error) {
-      console.error(`[orchestrator] spawn dispatch failed: ${errMessage(error)}`);
-      // #930 — the `failed` status write can itself reject during a relay blip. Wrap it so
-      // a failed status write can't re-throw out of the backgrounded task (belt-and-suspenders
-      // with the `.catch` in dispatchSpawnCommand). The command may strand non-terminal until
-      // the TTL sweep / watchdog reconciles it, but the task settles cleanly regardless.
-      try {
-        await relay.updateCommand(command.id, "failed", undefined, errMessage(error));
-      } catch (statusError) {
-        console.error(`[orchestrator] failed to mark spawn command failed: ${errMessage(statusError)}`);
+      if (launched) {
+        console.error(`[orchestrator] spawn command settle failed after launch: ${errMessage(error)}`);
+      } else {
+        await markSpawnCommandFailed(command, error);
       }
     } finally {
       spawnSlots.release();
@@ -192,9 +223,12 @@ export function createControlHandler(
     if (!session) {
       let restarted: ManagedAgentReport | undefined;
       if (restart && restartSpawn) {
-        restarted = await spawnAgent(spawnOptionsFromRestartSource(restartSpawn, config), config);
-        managedAgents.push(restarted);
-        console.error(`[orchestrator] Restarted ${restarted.provider} agent without prior live session: ${restarted.tmuxSession}`);
+        await spawnSlots.acquire();
+        try {
+          restarted = await spawnAndWaitForRegistration(spawnOptionsFromRestartSource(restartSpawn, config), "Restarted");
+        } finally {
+          spawnSlots.release();
+        }
       }
       return {
         stopped: false,
@@ -206,7 +240,7 @@ export function createControlHandler(
         spawnRequestId: ctrl.spawnRequestId,
       };
     }
-    const result = await stopSession(session, config, typeof ctrl.reason === "string" ? ctrl.reason : restart ? "restart" : "shutdown", ctrl.graceful !== false, shutdownTimeoutMs(ctrl));
+    const result = await dispatchStop(session, config, typeof ctrl.reason === "string" ? ctrl.reason : restart ? "restart" : "shutdown", ctrl.graceful !== false, shutdownTimeoutMs(ctrl));
     managedAgents = managedAgents.filter((agent) => (agent.sessionName ?? agent.tmuxSession) !== session);
     // A managed restart carries a fresh spawnRequestId in restartSpawn — keep it.
     // Falling back to the live agent's params would reuse the stale id and break
@@ -214,9 +248,12 @@ export function createControlHandler(
     const restartSource = (restartSpawn ?? (current ? { ...current, spawnRequestId: undefined } : undefined)) as Record<string, any> | undefined;
     let restarted: ManagedAgentReport | undefined;
     if (restart && restartSource) {
-      restarted = await spawnAgent(spawnOptionsFromRestartSource(restartSource, config), config);
-      managedAgents.push(restarted);
-      console.error(`[orchestrator] Restarted ${restarted.provider} agent: ${restarted.tmuxSession}`);
+      await spawnSlots.acquire();
+      try {
+        restarted = await spawnAndWaitForRegistration(spawnOptionsFromRestartSource(restartSource, config), "Restarted");
+      } finally {
+        spawnSlots.release();
+      }
     }
     return {
       ...result,
@@ -270,7 +307,7 @@ export function createControlHandler(
       } else if (command.type === "workspace.merge") {
         let result: WorkspaceMergeResult;
         try {
-          result = await withMergePhaseTimeout("total", () => mergeWorkspace({
+          result = await withMergePhaseTimeout("total", (signal) => mergeWorkspace({
             id: typeof command.params.workspaceId === "string" ? command.params.workspaceId : undefined,
             repoRoot: typeof command.params.repoRoot === "string" ? command.params.repoRoot : undefined,
             worktreePath: typeof command.params.worktreePath === "string" ? command.params.worktreePath : undefined,
@@ -289,6 +326,7 @@ export function createControlHandler(
                   subject: typeof command.params.prLanded.subject === "string" ? command.params.prLanded.subject : undefined,
                 }
               : undefined,
+            signal,
           }));
         } catch (err) {
           const branch = typeof command.params.branch === "string" ? command.params.branch : undefined;

package/src/git.ts

@@ -10,6 +10,7 @@ type GitResult = Pick<ExecResult, "ok" | "stdout" | "stderr" | "exitCode" | "tim
 interface GitOptions {
   timeoutMs?: number;
   timeoutLabel?: string;
+  signal?: AbortSignal;
 }
 
 /** Run `git -C cwd <args>` and capture trimmed stdout/stderr; never throws. */

package/src/process.ts

@@ -16,6 +16,7 @@ interface ExecOptions {
   timeoutMs?: number;
   timeoutLabel?: string;
   streamDrainGraceMs?: number;
+  signal?: AbortSignal;
 }
 
 const DEFAULT_STREAM_DRAIN_GRACE_MS = 1_000;
@@ -65,7 +66,18 @@ function timeoutMessage(cmd: string[], options: ExecOptions): string {
   return `${label} timed out after ${options.timeoutMs}ms`;
 }
 
+function abortMessage(cmd: string[], options: ExecOptions): string {
+  const reason = options.signal?.reason;
+  if (reason instanceof Error && reason.message) return reason.message;
+  if (typeof reason === "string" && reason) return reason;
+  const label = options.timeoutLabel ?? cmd.join(" ");
+  return `${label} aborted`;
+}
+
 export async function execProcess(cmd: string[], options: ExecOptions = {}): Promise<ExecResult> {
+  if (options.signal?.aborted) {
+    return { ok: false, exitCode: null, stdout: "", stderr: abortMessage(cmd, options) };
+  }
   const proc = Bun.spawn(cmd, {
     cwd: options.cwd,
     env: options.env,
@@ -76,27 +88,34 @@ export async function execProcess(cmd: string[], options: ExecOptions = {}): Pro
   const stdoutCapture = options.stdout === "ignore" ? captureStream(undefined) : captureStream(proc.stdout);
   const stderrCapture = options.stderr === "ignore" ? captureStream(undefined) : captureStream(proc.stderr);
   let timedOut = false;
+  let aborted = false;
   let timeout: ReturnType<typeof setTimeout> | undefined;
   let killTimeout: ReturnType<typeof setTimeout> | undefined;
   let timeoutResolve: ((value: null) => void) | undefined;
   const timeoutPromise = new Promise<null>((resolve) => { timeoutResolve = resolve; });
+  const abortProcess = () => {
+    aborted = true;
+    try { proc.kill("SIGTERM"); } catch {}
+    killTimeout = setTimeout(() => {
+      try { proc.kill("SIGKILL"); } catch {}
+    }, 1_000);
+    killTimeout.unref?.();
+    timeoutResolve?.(null);
+  };
+  options.signal?.addEventListener("abort", abortProcess, { once: true });
   if (options.timeoutMs && options.timeoutMs > 0) {
     timeout = setTimeout(() => {
       timedOut = true;
-      try { proc.kill("SIGTERM"); } catch {}
-      killTimeout = setTimeout(() => {
-        try { proc.kill("SIGKILL"); } catch {}
-      }, 1_000);
-      killTimeout.unref?.();
-      timeoutResolve?.(null);
+      abortProcess();
     }, options.timeoutMs);
     timeout.unref?.();
   }
 
-  const exitCode = await (timeout ? Promise.race([proc.exited, timeoutPromise]) : proc.exited);
+  const exitCode = await (timeout || options.signal ? Promise.race([proc.exited, timeoutPromise]) : proc.exited);
+  options.signal?.removeEventListener("abort", abortProcess);
   if (timeout) clearTimeout(timeout);
-  if (!timedOut && killTimeout) clearTimeout(killTimeout);
-  if (timedOut) {
+  if (!timedOut && !aborted && killTimeout) clearTimeout(killTimeout);
+  if (timedOut || aborted) {
     stdoutCapture.cancel();
     stderrCapture.cancel();
   }
@@ -111,9 +130,12 @@ export async function execProcess(cmd: string[], options: ExecOptions = {}): Pro
   if (timedOut) {
     const msg = timeoutMessage(cmd, options);
     stderr = stderr ? `${stderr}\n${msg}` : msg;
+  } else if (aborted) {
+    const msg = abortMessage(cmd, options);
+    stderr = stderr ? `${stderr}\n${msg}` : msg;
   }
   return {
-    ok: !timedOut && exitCode === 0,
+    ok: !timedOut && !aborted && exitCode === 0,
     exitCode,
     stdout: options.trimStdout === false ? stdout : stdout.trim(),
     stderr: options.trimStderr === false ? stderr : stderr.trim(),

package/src/relay.ts

@@ -10,6 +10,7 @@ export interface RelayClient {
   heartbeat(): Promise<void>;
   updateManagedAgents(agents: ManagedAgentReport[], exitedAgents?: ManagedSessionExitDiagnostics[]): Promise<void>;
   pollCommands(): Promise<RelayCommand[]>;
+  getCommand(commandId: string): Promise<RelayCommand | null>;
   updateCommand(commandId: string, status: string, result?: Record<string, unknown>, error?: string): Promise<boolean>;
   acquireProviderQuotaLease(orchestratorId: string, input: ProviderQuotaLeaseAcquireInput): Promise<ProviderQuotaLeaseAcquireResult>;
   releaseProviderQuotaLease(orchestratorId: string, input: ProviderQuotaLeaseAcquireInput & { leaseToken: string }): Promise<{ released: boolean }>;
@@ -219,6 +220,12 @@ export function createRelayClient(config: OrchestratorConfig, probeCache: Provid
     return await res.json() as RelayCommand[];
   }
 
+  async function getCommand(commandId: string): Promise<RelayCommand | null> {
+    const res = await apiCall("GET", `/commands/${encodeURIComponent(commandId)}`);
+    if (!res.ok) return null;
+    return await res.json() as RelayCommand;
+  }
+
   async function updateCommand(commandId: string, status: string, result?: Record<string, unknown>, error?: string): Promise<boolean> {
     const res = await apiCall("PATCH", `/commands/${encodeURIComponent(commandId)}`, {
       status,
@@ -245,6 +252,7 @@ export function createRelayClient(config: OrchestratorConfig, probeCache: Provid
     heartbeat,
     updateManagedAgents,
     pollCommands,
+    getCommand,
     updateCommand,
     setApiUrl(url: string) { apiUrl = url; },
     startHeartbeatLoop,

package/src/spawn/command.ts

@@ -66,7 +66,7 @@ export function buildEnv(opts: SpawnOptions & { label: string; agentId: string }
     .filter((v, i, a) => a.indexOf(v) === i)
     .join(":");
 
-  return {
+  return sanitizeWorkspaceEnv({
     ...process.env as Record<string, string>,
     ...(config.token ? { AGENT_RELAY_TOKEN: config.token } : {}),
     ...config.env,
@@ -101,7 +101,7 @@ export function buildEnv(opts: SpawnOptions & { label: string; agentId: string }
     ...(opts.workspace ? { AGENT_RELAY_WORKSPACE_JSON: JSON.stringify(opts.workspace) } : {}),
     ...(opts.automationId ? { AGENT_RELAY_AUTOMATION_ID: opts.automationId } : {}),
     ...(opts.automationRunId ? { AGENT_RELAY_AUTOMATION_RUN_ID: opts.automationRunId } : {}),
-  };
+  }, opts.workspaceMode);
 }
 
 function agentProfileEnv(profile: Record<string, unknown> | undefined): Record<string, string> {
@@ -109,3 +109,10 @@ function agentProfileEnv(profile: Record<string, unknown> | undefined): Record<s
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) return {};
   return Object.fromEntries(Object.entries(raw).filter((entry): entry is [string, string] => typeof entry[1] === "string"));
 }
+
+function sanitizeWorkspaceEnv(env: Record<string, string>, workspaceMode: string | undefined): Record<string, string> {
+  if (workspaceMode !== "isolated") return env;
+  const isolatedEnv = { ...env };
+  delete isolatedEnv.PUBLIC_DIR;
+  return isolatedEnv;
+}

package/src/workspace-probe/cleanup.ts

@@ -13,7 +13,7 @@ export async function pruneWorktrees(input: { repoRoot?: string }): Promise<{ re
 // repoRoot points at the PARENT worktree (maybe deleted), not the real checkout (#278/#307);
 // every linked worktree shares the main `.git` (--git-common-dir), so derive the owner from
 // the worktree itself, falling back to `fallback` only when it can't be interrogated.
-async function owningRepoRoot(worktreePath: string, fallback: string): Promise<string> {
+export async function owningRepoRoot(worktreePath: string, fallback: string): Promise<string> {
   const res = await git(["rev-parse", "--git-common-dir"], worktreePath);
   if (!res.ok || !res.stdout) return fallback;
   let commonDir = res.stdout;
@@ -56,7 +56,7 @@ export async function cleanupWorkspace(workspace: { repoRoot?: string; worktreeP
   return { workspaceId: workspace.id, removed: true, worktreePath: path, branchDeleted, ...(branchPreservedReason ? { branchPreservedReason } : {}), containerRemoved };
 }
 
-async function branchSafeToDelete(repo: string, branch: string, baseRef?: string, baseSha?: string): Promise<{ safe: boolean; reason?: string }> {
+export async function branchSafeToDelete(repo: string, branch: string, baseRef?: string, baseSha?: string): Promise<{ safe: boolean; reason?: string }> {
   const branchRef = await resolveCommit(repo, branch) ? branch : await resolveCommit(repo, `refs/heads/${branch}`) ? `refs/heads/${branch}` : undefined;
   if (!branchRef) return { safe: true };
 
@@ -79,6 +79,15 @@ async function branchSafeToDelete(repo: string, branch: string, baseRef?: string
     : { safe: false, reason: `${unmergedAhead} unlanded commit(s)` };
 }
 
+export async function deleteBranchIfSafe(repo: string, branch: string, baseRef?: string, baseSha?: string, signal?: AbortSignal): Promise<{ branchDeleted: boolean; branchPreservedReason?: string }> {
+  if (signal?.aborted) throw signal.reason instanceof Error ? signal.reason : new Error("workspace merge aborted");
+  const safety = await branchSafeToDelete(repo, branch, baseRef, baseSha);
+  if (signal?.aborted) throw signal.reason instanceof Error ? signal.reason : new Error("workspace merge aborted");
+  if (!safety.safe) return { branchDeleted: false, ...(safety.reason ? { branchPreservedReason: safety.reason } : {}) };
+  const branchDeleted = (await git(["branch", "-D", branch], repo, { signal })).ok;
+  return branchDeleted ? { branchDeleted } : { branchDeleted, branchPreservedReason: "branch delete failed" };
+}
+
 async function resolveCleanupBase(repo: string, baseRef?: string, baseSha?: string): Promise<string | undefined> {
   for (const candidate of [baseRef, baseSha, "main", "master"]) {
     if (candidate && await resolveCommit(repo, candidate)) return candidate;

package/src/workspace-probe/git-state.ts

@@ -75,8 +75,8 @@ export async function populateMergeState(cwd: string, targetRef: string, state:
 /** Remote-tracking branch a local base tracks (e.g. `main` -> `origin/main`),
  * or undefined when base has no upstream or is a bare sha. Squash PRs land on
  * the remote, so the upstream is the truthful "has this merged?" reference. */
-export async function upstreamRef(worktreePath: string, base: string): Promise<string | undefined> {
-  const res = await git(["rev-parse", "--abbrev-ref", `${base}@{upstream}`], worktreePath);
+export async function upstreamRef(worktreePath: string, base: string, signal?: AbortSignal): Promise<string | undefined> {
+  const res = await git(["rev-parse", "--abbrev-ref", `${base}@{upstream}`], worktreePath, { signal });
   return res.ok && res.stdout ? res.stdout : undefined;
 }
 
@@ -88,15 +88,15 @@ export async function upstreamRef(worktreePath: string, base: string): Promise<s
  * base. Falls back to the local base ref when there is no upstream (no remote) or the
  * upstream ref can't be resolved — the caller still verifies it contains the merge SHA.
  */
-export async function syncBaseFromOrigin(worktreePath: string, base: string | undefined): Promise<string | undefined> {
+export async function syncBaseFromOrigin(worktreePath: string, base: string | undefined, signal?: AbortSignal): Promise<string | undefined> {
   if (!base) return undefined;
-  const upstream = await upstreamRef(worktreePath, base);
+  const upstream = await upstreamRef(worktreePath, base, signal);
   if (!upstream) return base;
   const slash = upstream.indexOf("/");
   const remote = slash > 0 ? upstream.slice(0, slash) : undefined;
   const remoteBranch = slash > 0 ? upstream.slice(slash + 1) : base;
-  if (remote) await git(["fetch", remote, remoteBranch], worktreePath); // best-effort freshness
-  return (await git(["rev-parse", "--verify", "--quiet", upstream], worktreePath)).ok ? upstream : base;
+  if (remote) await git(["fetch", remote, remoteBranch], worktreePath, { signal }); // best-effort freshness
+  return (await git(["rev-parse", "--verify", "--quiet", upstream], worktreePath, { signal })).ok ? upstream : base;
 }
 
 async function resolveBaseRef(worktreePath: string, baseRef?: string, baseSha?: string): Promise<string | undefined> {

package/src/workspace-probe/merge-timeouts.ts

@@ -26,20 +26,44 @@ export function mergePhaseTimeoutMs(phase: MergePhase): number {
     ?? MERGE_PHASE_TIMEOUTS_MS[phase];
 }
 
-export async function withMergePhaseTimeout<T>(phase: MergePhase, run: () => Promise<T>): Promise<T> {
+function abortError(signal: AbortSignal): Error {
+  const reason = signal.reason;
+  if (reason instanceof Error) return reason;
+  if (typeof reason === "string" && reason) return new Error(reason);
+  return new Error("workspace merge aborted");
+}
+
+export function throwIfMergeAborted(signal?: AbortSignal): void {
+  if (signal?.aborted) throw abortError(signal);
+}
+
+export async function withMergePhaseTimeout<T>(
+  phase: MergePhase,
+  run: (signal: AbortSignal) => Promise<T>,
+  options: { signal?: AbortSignal } = {},
+): Promise<T> {
   const timeoutMs = mergePhaseTimeoutMs(phase);
+  const controller = new AbortController();
   let timeout: ReturnType<typeof setTimeout> | undefined;
-  const work = run();
+  const abortFromParent = () => controller.abort(abortError(options.signal!));
+  if (options.signal?.aborted) controller.abort(abortError(options.signal));
+  else options.signal?.addEventListener("abort", abortFromParent, { once: true });
+  const work = run(controller.signal);
   work.catch(() => {});
   try {
     return await Promise.race([
       work,
       new Promise<T>((_, reject) => {
-        timeout = setTimeout(() => reject(new Error(`workspace merge phase "${phase}" timed out after ${timeoutMs}ms`)), timeoutMs);
+        timeout = setTimeout(() => {
+          const error = new Error(`workspace merge phase "${phase}" timed out after ${timeoutMs}ms`);
+          controller.abort(error);
+          reject(error);
+        }, timeoutMs);
         timeout.unref?.();
       }),
     ]);
   } finally {
     if (timeout) clearTimeout(timeout);
+    options.signal?.removeEventListener("abort", abortFromParent);
   }
 }

package/src/workspace-probe/merge.ts

@@ -4,27 +4,32 @@ import { errMessage, type BaseWorktreeSyncResult, type WorkspaceMergePreview, ty
 import { git, gitRaw } from "../git";
 import { execProcess } from "../process";
 import { prMergedState } from "../workspace-pr";
+import { deleteBranchIfSafe, owningRepoRoot } from "./cleanup";
 import { refreshWorkspaceDeps } from "./deps";
 import { type LandGatesResult } from "./land-gates-runner";
 import { populateMergeState, resolveBranchRef, syncBaseFromOrigin, workspaceGitState } from "./git-state";
-import { type MergePhase, mergePhaseTimeoutMs, withMergePhaseTimeout } from "./merge-timeouts";
+import { type MergePhase, mergePhaseTimeoutMs, throwIfMergeAborted, withMergePhaseTimeout } from "./merge-timeouts";
 import { nextBranchName } from "./names";
 import { parseWorktrees, shortBranch } from "./parse";
 import { json, resolveRequestedPath } from "./request";
 import type { WorkspaceMergeInput } from "./types";
 import { workspacePushEnabled } from "../config";
 
-async function mergeGit(args: string[], cwd: string, phase: MergePhase, timeoutLabel?: string): ReturnType<typeof git> {
+async function mergeGit(args: string[], cwd: string, phase: MergePhase, timeoutLabel?: string, signal?: AbortSignal): ReturnType<typeof git> {
+  throwIfMergeAborted(signal);
   return git(args, cwd, {
     timeoutMs: mergePhaseTimeoutMs(phase),
     timeoutLabel: timeoutLabel ?? `workspace merge ${phase} git ${args.join(" ")}`,
+    signal,
   });
 }
 
-async function mergeGitRaw(args: string[], cwd: string, phase: MergePhase, timeoutLabel?: string): ReturnType<typeof gitRaw> {
+async function mergeGitRaw(args: string[], cwd: string, phase: MergePhase, timeoutLabel?: string, signal?: AbortSignal): ReturnType<typeof gitRaw> {
+  throwIfMergeAborted(signal);
   return gitRaw(args, cwd, {
     timeoutMs: mergePhaseTimeoutMs(phase),
     timeoutLabel: timeoutLabel ?? `workspace merge ${phase} git ${args.join(" ")}`,
+    signal,
   });
 }
 
@@ -33,8 +38,8 @@ function gitError(result: Awaited<ReturnType<typeof git>>, fallback: string): st
 }
 
 /** Behind-count of HEAD relative to `base`, from inside `worktreePath`. */
-async function countBehind(worktreePath: string, base: string): Promise<{ behind: number } | { error: string }> {
-  const counts = await mergeGit(["rev-list", "--left-right", "--count", `${base}...HEAD`], worktreePath, "rebase", "workspace merge count behind integration base");
+async function countBehind(worktreePath: string, base: string, signal?: AbortSignal): Promise<{ behind: number } | { error: string }> {
+  const counts = await mergeGit(["rev-list", "--left-right", "--count", `${base}...HEAD`], worktreePath, "rebase", "workspace merge count behind integration base", signal);
   if (!counts.ok || !counts.stdout) return { error: gitError(counts, "failed to count branch behind integration base") };
   const behind = Number(counts.stdout.split(/\s+/)[0]);
   return Number.isFinite(behind) ? { behind } : { error: "git rev-list produced an invalid behind count" };
@@ -75,12 +80,12 @@ async function baseBranchName(worktreePath: string, baseRef?: string): Promise<s
 }
 
 /** Locate the worktree (if any) that currently has `branch` checked out. */
-async function worktreeForBranch(repoRoot: string, branch: string): Promise<{ path: string; dirty: boolean } | undefined> {
-  const list = await mergeGit(["worktree", "list", "--porcelain"], repoRoot, "rebase", "workspace merge list worktrees");
+async function worktreeForBranch(repoRoot: string, branch: string, signal?: AbortSignal): Promise<{ path: string; dirty: boolean } | undefined> {
+  const list = await mergeGit(["worktree", "list", "--porcelain"], repoRoot, "rebase", "workspace merge list worktrees", signal);
   if (!list.ok) return undefined;
   const match = parseWorktrees(list.stdout).find((worktree) => worktree.branch === branch);
   if (!match) return undefined;
-  const status = await mergeGit(["status", "--porcelain"], match.path, "rebase", `workspace merge status ${branch} worktree`);
+  const status = await mergeGit(["status", "--porcelain"], match.path, "rebase", `workspace merge status ${branch} worktree`, signal);
   return { path: match.path, dirty: status.ok ? status.stdout.length > 0 : true };
 }
 
@@ -88,8 +93,8 @@ function splitNul(stdout: string): string[] {
   return stdout.split("\0").filter(Boolean);
 }
 
-async function dirtyPathSet(worktreePath: string): Promise<Set<string>> {
-  const status = await mergeGitRaw(["status", "--porcelain=v1", "-z", "--untracked-files=all"], worktreePath, "rebase", "workspace merge dirty path scan");
+async function dirtyPathSet(worktreePath: string, signal?: AbortSignal): Promise<Set<string>> {
+  const status = await mergeGitRaw(["status", "--porcelain=v1", "-z", "--untracked-files=all"], worktreePath, "rebase", "workspace merge dirty path scan", signal);
   if (!status.ok) return new Set<string>();
   const paths = new Set<string>();
   const entries = splitNul(status.stdout);
@@ -104,26 +109,26 @@ async function dirtyPathSet(worktreePath: string): Promise<Set<string>> {
   return paths;
 }
 
-async function changedPathList(worktreePath: string, oldBaseTip: string, newBaseTip: string): Promise<string[]> {
-  const diff = await mergeGitRaw(["diff", "--name-only", "-z", oldBaseTip, newBaseTip], worktreePath, "rebase", "workspace merge changed path scan");
+async function changedPathList(worktreePath: string, oldBaseTip: string, newBaseTip: string, signal?: AbortSignal): Promise<string[]> {
+  const diff = await mergeGitRaw(["diff", "--name-only", "-z", oldBaseTip, newBaseTip], worktreePath, "rebase", "workspace merge changed path scan", signal);
   return diff.ok ? splitNul(diff.stdout) : [];
 }
 
-async function restorePathsFromHead(worktreePath: string, paths: string[]): Promise<boolean> {
+async function restorePathsFromHead(worktreePath: string, paths: string[], signal?: AbortSignal): Promise<boolean> {
   if (paths.length === 0) return true;
-  return (await mergeGit(["restore", "--staged", "--worktree", "--", ...paths], worktreePath, "rebase", "workspace merge restore clean landed paths")).ok;
+  return (await mergeGit(["restore", "--staged", "--worktree", "--", ...paths], worktreePath, "rebase", "workspace merge restore clean landed paths", signal)).ok;
 }
 
-async function resetIndexPathsToHead(worktreePath: string, paths: string[]): Promise<boolean> {
+async function resetIndexPathsToHead(worktreePath: string, paths: string[], signal?: AbortSignal): Promise<boolean> {
   if (paths.length === 0) return true;
-  return (await mergeGit(["reset", "-q", "HEAD", "--", ...paths], worktreePath, "rebase", "workspace merge reset preserved paths")).ok;
+  return (await mergeGit(["reset", "-q", "HEAD", "--", ...paths], worktreePath, "rebase", "workspace merge reset preserved paths", signal)).ok;
 }
 
 /** Landed paths whose working copy still differs from the advanced HEAD (ground truth, not
  *  exit codes): the checkout is mixed for these — reads/builds/publishes see STALE files. */
-async function pathsDifferingFromHead(worktreePath: string, paths: string[]): Promise<string[]> {
+async function pathsDifferingFromHead(worktreePath: string, paths: string[], signal?: AbortSignal): Promise<string[]> {
   if (paths.length === 0) return [];
-  const diff = await mergeGitRaw(["diff", "--name-only", "-z", "HEAD", "--", ...paths], worktreePath, "rebase", "workspace merge verify base worktree sync");
+  const diff = await mergeGitRaw(["diff", "--name-only", "-z", "HEAD", "--", ...paths], worktreePath, "rebase", "workspace merge verify base worktree sync", signal);
   // A failed diff can't prove the checkout is clean — treat every landed path as suspect.
   return diff.ok ? splitNul(diff.stdout) : [...paths];
 }
@@ -165,24 +170,25 @@ async function syncDirtyBaseWorktreeAfterRefAdvance(
   oldBaseTip: string,
   newBaseTip: string,
   dirtyBefore: Set<string> | undefined,
+  signal?: AbortSignal,
 ): Promise<BaseWorktreeSyncResult> {
   if (!baseWorktree?.dirty || !dirtyBefore) return RECONCILED;
-  const readTree = await mergeGit(["read-tree", "-m", "-u", oldBaseTip, newBaseTip], baseWorktree.path, "rebase", "workspace merge sync dirty base worktree");
+  const readTree = await mergeGit(["read-tree", "-m", "-u", oldBaseTip, newBaseTip], baseWorktree.path, "rebase", "workspace merge sync dirty base worktree", signal);
   if (readTree.ok) return RECONCILED;
 
-  const changedPaths = await changedPathList(baseWorktree.path, oldBaseTip, newBaseTip);
+  const changedPaths = await changedPathList(baseWorktree.path, oldBaseTip, newBaseTip, signal);
   const cleanChangedPaths = changedPaths.filter((path) => !dirtyBefore.has(path));
   const dirtyChangedPaths = changedPaths.filter((path) => dirtyBefore.has(path));
   // Clean landed paths carry no human WIP — force them to HEAD (restores content AND mode).
-  await restorePathsFromHead(baseWorktree.path, cleanChangedPaths);
+  await restorePathsFromHead(baseWorktree.path, cleanChangedPaths, signal);
   // Landed paths the human also edited — preserve the WIP, normalize the index to HEAD so the
   // difference surfaces as an unstaged modification (not a staged reverse diff). #681.
-  await resetIndexPathsToHead(baseWorktree.path, dirtyChangedPaths);
+  await resetIndexPathsToHead(baseWorktree.path, dirtyChangedPaths, signal);
 
   // Ground-truth check (#824): re-derive which landed paths are STILL out of sync with the
   // advanced HEAD rather than trusting the restore/reset exit codes. A clean landed path left
   // stale here is the silent strand that shipped a stale file into the #823 bootstrap publish.
-  const unsyncedPaths = await pathsDifferingFromHead(baseWorktree.path, changedPaths);
+  const unsyncedPaths = await pathsDifferingFromHead(baseWorktree.path, changedPaths, signal);
   if (unsyncedPaths.length === 0) return RECONCILED;
   const preservedWipPaths = unsyncedPaths.filter((path) => dirtyBefore.has(path));
   return {
@@ -365,6 +371,8 @@ function validPreviewStrategy(strategy: string | null): "pr" | "rebase-ff" | "au
  */
 export async function mergeWorkspace(input: WorkspaceMergeInput): Promise<WorkspaceMergeResult> {
   if (!input.worktreePath) return { strategy: "rebase-ff", merged: false, status: "review_requested", error: "worktreePath required", workspaceId: input.id };
+  const signal = input.signal;
+  throwIfMergeAborted(signal);
   const worktreePath = resolve(input.worktreePath);
   const repoRoot = input.repoRoot ? resolve(input.repoRoot) : worktreePath;
   console.error(`[orchestrator] workspace.merge prep-start workspace=${input.id ?? "(unknown)"} worktree=${worktreePath} repo=${repoRoot}`);
@@ -372,14 +380,15 @@ export async function mergeWorkspace(input: WorkspaceMergeInput): Promise<Worksp
   // DB-recorded branch only when the live probe fails (detached HEAD, missing worktree, etc.).
   // This fixes #232: a stale DB branch value (non-null mismatch) would pass through the
   // `input.branch ?? ...` guard unchanged and cause git to attempt merging a non-existent ref.
-  const liveBranch = shortBranch((await mergeGit(["symbolic-ref", "--quiet", "--short", "HEAD"], worktreePath, "prep", "workspace merge resolve live branch")).stdout || undefined);
+  const liveBranch = shortBranch((await mergeGit(["symbolic-ref", "--quiet", "--short", "HEAD"], worktreePath, "prep", "workspace merge resolve live branch", signal)).stdout || undefined);
   const branch = liveBranch ?? input.branch;
   let preview: WorkspaceMergePreview;
   try {
-    preview = await withMergePhaseTimeout("preview", () => previewWorkspaceMerge({ worktreePath, baseRef: input.baseRef, baseSha: input.baseSha, strategy: input.strategy }));
+    preview = await withMergePhaseTimeout("preview", () => previewWorkspaceMerge({ worktreePath, baseRef: input.baseRef, baseSha: input.baseSha, strategy: input.strategy }), { signal });
   } catch (err) {
     return { workspaceId: input.id, strategy: "rebase-ff", merged: false, status: "review_requested", branch, error: errMessage(err) };
   }
+  throwIfMergeAborted(signal);
   const strategy = preview.strategy;
   const head = (field: Partial<WorkspaceMergeResult>): WorkspaceMergeResult => ({ workspaceId: input.id, strategy, merged: false, status: "review_requested", branch, baseRef: preview.baseRef, ...field });
 
@@ -400,22 +409,23 @@ export async function mergeWorkspace(input: WorkspaceMergeInput): Promise<Worksp
   //      hasn't propagated the PR merge yet, fall through rather than reset onto a base
   //      missing the landed work — never reset on an unverified ground-truth/refs mismatch.
   if (input.prLanded?.sha && (preview.dirtyCount ?? 0) === 0) {
-    const startRef = await syncBaseFromOrigin(worktreePath, preview.baseRef);
-    if (startRef && (await git(["merge-base", "--is-ancestor", input.prLanded.sha, startRef], worktreePath)).ok) {
+    const startRef = await syncBaseFromOrigin(worktreePath, preview.baseRef, signal);
+    throwIfMergeAborted(signal);
+    if (startRef && (await mergeGit(["merge-base", "--is-ancestor", input.prLanded.sha, startRef], worktreePath, "rebase", "workspace merge verify PR landed sha on base", signal)).ok) {
       const landedPreview: WorkspaceMergePreview = { ...preview, noop: true, prMerged: true, prMergeSha: input.prLanded.sha, reason: "PR merged on remote" };
-      return await resolveNoopMerge(input, worktreePath, repoRoot, branch, landedPreview, head, startRef);
+      return await resolveNoopMerge(input, worktreePath, repoRoot, branch, landedPreview, head, startRef, signal);
     }
   }
   // Nothing to land (ahead=0, clean): the branch tree is already in base. Resolve it
   // to a terminal state so it leaves the steward queue instead of looping forever in
   // review_requested (#230). Reclaim the spent worktree/branch when the owner is gone.
-  if (preview.noop) return await resolveNoopMerge(input, worktreePath, repoRoot, branch, preview, head);
+  if (preview.noop) return await resolveNoopMerge(input, worktreePath, repoRoot, branch, preview, head, undefined, signal);
   if (preview.reason) return head({ status: "review_requested", error: preview.reason });
   if (preview.conflict) return head({ conflict: true, status: "conflict", error: "merge would conflict with base" });
 
-  if (strategy === "pr") return await mergePr(input, worktreePath, branch, preview, head);
+  if (strategy === "pr") return await mergePr(input, worktreePath, branch, preview, head, signal);
   console.error(`[orchestrator] workspace.merge rebase-start workspace=${input.id ?? "(unknown)"} branch=${branch ?? "(unknown)"} base=${preview.baseRef ?? "(unknown)"}`);
-  return await mergeRebaseFf(input, worktreePath, repoRoot, branch, preview, head);
+  return await mergeRebaseFf(input, worktreePath, repoRoot, branch, preview, head, signal);
 }
 
 /**
@@ -440,27 +450,31 @@ async function resolveNoopMerge(
   // the upstream tip (e.g. origin/main) so the live owner continues off UPDATED base rather
   // than the worktree's stale local base.
   startRef?: string,
+  signal?: AbortSignal,
 ): Promise<WorkspaceMergeResult> {
+  throwIfMergeAborted(signal);
+  const ownerRepo = branch ? await owningRepoRoot(worktreePath, repoRoot) : repoRoot;
   // Live owner (#327): recycle-to-continue instead of bricking the session.
   if (input.deleteBranch === false) {
     const base = preview.baseRef;
     if (base && branch) {
-      const fresh = await nextBranchName(repoRoot, branch);
+      const fresh = await nextBranchName(ownerRepo, branch);
       // #478 — cut from the FETCHED upstream tip so even a plain noop recycle (no
       // startRef) advances to origin/main, not the stale local base. The PR-land
       // recycle (#423) already passes startRef (the verified upstream sha); this
       // makes the rebase-ff noop path equally multi-host-correct.
-      const start = startRef ?? await syncBaseFromOrigin(worktreePath, base) ?? base;
-      if ((await git(["checkout", "-B", fresh, start], worktreePath)).ok) {
-        // Old branch's tree is already in base (that's what noop means) — safe to drop.
-        const oldDeleted = (await git(["branch", "-D", branch], repoRoot)).ok;
-        const baseSha = (await git(["rev-parse", start], worktreePath)).stdout || undefined;
+      const start = startRef ?? await syncBaseFromOrigin(worktreePath, base, signal) ?? base;
+      throwIfMergeAborted(signal);
+      if ((await mergeGit(["checkout", "-B", fresh, start], worktreePath, "rebase", `workspace merge noop recycle worktree to ${fresh}`, signal)).ok) {
+        const baseSha = (await mergeGit(["rev-parse", start], worktreePath, "rebase", `workspace merge resolve noop recycle start ${start}`, signal)).stdout || undefined;
+        const deleteResult = await deleteBranchIfSafe(ownerRepo, branch, undefined, baseSha ?? start, signal);
         // Recycled onto base, which may declare deps the symlinked node_modules lacks (#51).
-        const depsRefresh = await refreshWorkspaceDeps(repoRoot, worktreePath);
+        const depsRefresh = await refreshWorkspaceDeps(ownerRepo, worktreePath);
+        throwIfMergeAborted(signal);
         const reportDeps = depsRefresh.refreshed || depsRefresh.stale || depsRefresh.error;
         // merged:false → no `branch.landed` notice (nothing landed); newBranch makes the
         // relay repoint the row and return it to `active` rather than terminal `merged`.
-        return head({ merged: false, noop: true, status: "active", baseSha, worktreeRemoved: false, branch: fresh, newBranch: fresh, branchDeleted: oldDeleted, ...(reportDeps ? { depsRefresh } : {}), error: undefined });
+        return head({ merged: false, noop: true, status: "active", baseSha, worktreeRemoved: false, branch: fresh, newBranch: fresh, ...deleteResult, ...(reportDeps ? { depsRefresh } : {}), error: undefined });
       }
     }
     // No base or checkout failed — stay live on the current branch, don't strand at `merged`.
@@ -468,10 +482,11 @@ async function resolveNoopMerge(
   }
   // Owner is gone — reclaim the spent worktree/branch and go terminal.
   if (branch) {
-    const removed = await git(["worktree", "remove", "--force", worktreePath], repoRoot);
+    throwIfMergeAborted(signal);
+    const removed = await mergeGit(["worktree", "remove", "--force", worktreePath], ownerRepo, "cleanup", "workspace merge remove noop worktree", signal);
     const worktreeRemoved = removed.ok;
-    const branchDeleted = worktreeRemoved ? (await git(["branch", "-D", branch], repoRoot)).ok : false;
-    return head({ status: "merged", noop: true, worktreeRemoved, branchDeleted, error: undefined });
+    const deleteResult = worktreeRemoved ? await deleteBranchIfSafe(ownerRepo, branch, preview.baseRef, undefined, signal) : { branchDeleted: false };
+    return head({ status: "merged", noop: true, worktreeRemoved, ...deleteResult, error: undefined });
   }
   return head({ status: "merged", noop: true, error: undefined });
 }
@@ -482,19 +497,22 @@ async function mergePr(
   branch: string | undefined,
   preview: WorkspaceMergePreview,
   head: (field: Partial<WorkspaceMergeResult>) => WorkspaceMergeResult,
+  signal?: AbortSignal,
 ): Promise<WorkspaceMergeResult> {
   if (!branch) return head({ status: "review_requested", error: "cannot determine branch to push" });
   const base = preview.baseRef;
-  const push = await git(["push", "-u", "origin", branch], worktreePath);
+  throwIfMergeAborted(signal);
+  const push = await mergeGit(["push", "-u", "origin", branch], worktreePath, "rebase", `workspace merge push ${branch} to origin`, signal);
   if (!push.ok) return head({ status: "review_requested", error: push.stderr || "git push failed" });
 
-  const title = input.prTitle || (await git(["log", "-1", "--format=%s"], worktreePath)).stdout || `Merge ${branch}`;
+  const title = input.prTitle || (await mergeGit(["log", "-1", "--format=%s"], worktreePath, "rebase", "workspace merge read PR title", signal)).stdout || `Merge ${branch}`;
   const body = input.prBody || `Automated PR for agent workspace branch \`${branch}\`.`;
   const args = ["pr", "create", "--head", branch, "--title", title, "--body", body];
   if (base) args.push("--base", base);
   // Pass process.env explicitly so runtime env mutations (e.g. test PATH injection)
   // are visible to the child process.  Bun's default is the startup-time env snapshot.
-  const proc = await execProcess(["gh", ...args], { cwd: worktreePath, env: process.env });
+  throwIfMergeAborted(signal);
+  const proc = await execProcess(["gh", ...args], { cwd: worktreePath, env: process.env, signal });
   const stdout = proc.stdout;
   if (!proc.ok) {
     return head({ status: "review_requested", error: proc.stderr || "gh pr create failed" });
@@ -518,7 +536,8 @@ async function mergePr(
   // Never throw — if arming fails (repo has auto-merge disabled) we still return
   // merge_planned so the relay reconcile scan can finalize when the PR merges.
   const mergeTarget = prUrl ?? branch!;
-  const armProc = await execProcess(["gh", "pr", "merge", mergeTarget, "--auto", "--merge"], { cwd: worktreePath, env: process.env });
+  throwIfMergeAborted(signal);
+  const armProc = await execProcess(["gh", "pr", "merge", mergeTarget, "--auto", "--merge"], { cwd: worktreePath, env: process.env, signal });
   if (!armProc.ok) {
     // Arm failed (e.g. repo has auto-merge disabled) — return merge_planned so the
     // reconcile scan still finalizes when the PR is merged by a human.
@@ -550,35 +569,28 @@ function landMergeMessage(branch: string | undefined, subject: string | undefine
 // moves (#902/#903) and, via {@link recordNoFfMerge}, to advance base when no working tree is
 // available. Pure object creation: no ref is touched, so a caller can throw it away freely.
 async function synthesizeNoFfMerge(
-  repoRoot: string,
-  baseSha: string,
-  branchSha: string,
-  message: string,
-  timeoutMs?: number,
+  repoRoot: string, baseSha: string, branchSha: string, message: string,
+  timeoutMs?: number, signal?: AbortSignal,
 ): Promise<{ ok: true; mergeSha: string } | { ok: false; conflict?: boolean; error: string }> {
-  const tree = await git(["merge-tree", "--write-tree", baseSha, branchSha], repoRoot, { timeoutMs, timeoutLabel: "workspace merge synthesize merge-tree" });
+  const tree = await git(["merge-tree", "--write-tree", baseSha, branchSha], repoRoot, { timeoutMs, timeoutLabel: "workspace merge synthesize merge-tree", signal });
   if (!tree.ok) return { ok: false, conflict: true, error: tree.stdout || tree.stderr || "merge conflict computing tree" };
   const treeOid = tree.stdout.split("\n")[0]?.trim();
   if (!treeOid) return { ok: false, error: "merge-tree produced no tree oid" };
   const commit = await git(
     ["-c", `user.name=${LAND_COMMITTER.name}`, "-c", `user.email=${LAND_COMMITTER.email}`, "commit-tree", treeOid, "-p", baseSha, "-p", branchSha, "-m", message],
     repoRoot,
-    { timeoutMs, timeoutLabel: "workspace merge synthesize commit-tree" },
+    { timeoutMs, timeoutLabel: "workspace merge synthesize commit-tree", signal },
   );
   if (!commit.ok || !commit.stdout) return { ok: false, error: commit.stderr || "commit-tree failed" };
   return { ok: true, mergeSha: commit.stdout };
 }
 
 async function recordNoFfMerge(
-  repoRoot: string,
-  base: string,
-  baseSha: string,
-  branchSha: string,
-  message: string,
+  repoRoot: string, base: string, baseSha: string, branchSha: string, message: string, signal?: AbortSignal,
 ): Promise<{ ok: true; mergeSha: string } | { ok: false; conflict?: boolean; error: string }> {
-  const synth = await synthesizeNoFfMerge(repoRoot, baseSha, branchSha, message, mergePhaseTimeoutMs("synthesize"));
+  const synth = await synthesizeNoFfMerge(repoRoot, baseSha, branchSha, message, mergePhaseTimeoutMs("synthesize"), signal);
   if (!synth.ok) return synth;
-  const update = await mergeGit(["update-ref", `refs/heads/${base}`, synth.mergeSha, baseSha], repoRoot, "rebase", `workspace merge advance ${base} to synthesized merge`);
+  const update = await mergeGit(["update-ref", `refs/heads/${base}`, synth.mergeSha, baseSha], repoRoot, "rebase", `workspace merge advance ${base} to synthesized merge`, signal);
   if (!update.ok) return { ok: false, error: update.stderr || "failed to advance base ref" };
   return { ok: true, mergeSha: synth.mergeSha };
 }
@@ -623,26 +635,28 @@ async function syncLocalBaseToUpstream(
   worktreePath: string,
   base: string,
   upstream: string,
+  signal?: AbortSignal,
 ): Promise<{ ok: true; baseSync?: BaseWorktreeSyncResult } | { ok: false; error: string }> {
-  const upstreamSha = (await mergeGit(["rev-parse", "--verify", upstream], worktreePath, "rebase", `workspace merge resolve ${upstream}`)).stdout;
+  const upstreamSha = (await mergeGit(["rev-parse", "--verify", upstream], worktreePath, "rebase", `workspace merge resolve ${upstream}`, signal)).stdout;
   if (!upstreamSha) return { ok: false, error: `cannot resolve ${upstream} to sync ${base}` };
-  const baseWorktree = await worktreeForBranch(repoRoot, base);
+  const baseWorktree = await worktreeForBranch(repoRoot, base, signal);
   // Sync IN the base worktree only when it's clean — that keeps its working tree consistent
   // with the advanced ref (the pristine home-repo checkout). When the base worktree is dirty
   // (#644: a human's WIP in the shared checkout) we must NOT refuse and stall the whole repo's
   // lands: advance the ref directly with update-ref, then best-effort sync the checked-out
   // index/worktree forward for paths that are not human-modified (#681).
   if (baseWorktree && !baseWorktree.dirty) {
-    const ff = await mergeGit(["merge", "--ff-only", upstream], baseWorktree.path, "rebase", `workspace merge fast-forward ${base} to ${upstream}`);
+    const ff = await mergeGit(["merge", "--ff-only", upstream], baseWorktree.path, "rebase", `workspace merge fast-forward ${base} to ${upstream}`, signal);
     if (!ff.ok) return { ok: false, error: ff.stderr || `failed to fast-forward ${base} to ${upstream}` };
     return { ok: true };
   }
-  const oldBaseTip = (await mergeGit(["rev-parse", base], repoRoot, "rebase", `workspace merge resolve ${base} before upstream sync`)).stdout;
-  const dirtyBefore = baseWorktree?.dirty ? await dirtyPathSet(baseWorktree.path) : undefined;
+  const oldBaseTip = (await mergeGit(["rev-parse", base], repoRoot, "rebase", `workspace merge resolve ${base} before upstream sync`, signal)).stdout;
+  const dirtyBefore = baseWorktree?.dirty ? await dirtyPathSet(baseWorktree.path, signal) : undefined;
   const updateArgs = oldBaseTip ? ["update-ref", `refs/heads/${base}`, upstreamSha, oldBaseTip] : ["update-ref", `refs/heads/${base}`, upstreamSha];
-  const update = await mergeGit(updateArgs, repoRoot, "rebase", `workspace merge update ${base} to ${upstream}`);
+  throwIfMergeAborted(signal);
+  const update = await mergeGit(updateArgs, repoRoot, "rebase", `workspace merge update ${base} to ${upstream}`, signal);
   if (!update.ok) return { ok: false, error: update.stderr || `failed to advance ${base} to ${upstream}` };
-  const baseSync = oldBaseTip ? await syncDirtyBaseWorktreeAfterRefAdvance(base, baseWorktree, oldBaseTip, upstreamSha, dirtyBefore) : undefined;
+  const baseSync = oldBaseTip ? await syncDirtyBaseWorktreeAfterRefAdvance(base, baseWorktree, oldBaseTip, upstreamSha, dirtyBefore, signal) : undefined;
   return { ok: true, baseSync };
 }
 
@@ -653,7 +667,9 @@ async function mergeRebaseFf(
   branch: string | undefined,
   preview: WorkspaceMergePreview,
   head: (field: Partial<WorkspaceMergeResult>) => WorkspaceMergeResult,
+  signal?: AbortSignal,
 ): Promise<WorkspaceMergeResult> {
+  throwIfMergeAborted(signal);
   const base = preview.baseRef;
   if (!base) return head({ status: "review_requested", error: "no base branch to merge into" });
   if (!branch) return head({ status: "review_requested", error: "cannot determine agent branch" });
@@ -676,7 +692,7 @@ async function mergeRebaseFf(
   // points (the upstream sync below and the final land). A mixed state from either is surfaced
   // loudly rather than swallowed as a log warning (#824).
   let baseSync: BaseWorktreeSyncResult | undefined;
-  const upstreamResult = await mergeGit(["rev-parse", "--abbrev-ref", `${base}@{upstream}`], worktreePath, "rebase", `workspace merge resolve upstream for ${base}`);
+  const upstreamResult = await mergeGit(["rev-parse", "--abbrev-ref", `${base}@{upstream}`], worktreePath, "rebase", `workspace merge resolve upstream for ${base}`, signal);
   const upstream = upstreamResult.ok && upstreamResult.stdout ? upstreamResult.stdout : undefined;
   const slash = upstream ? upstream.indexOf("/") : -1;
   const remote = slash > 0 ? upstream!.slice(0, slash) : undefined; // remote of a `remote/branch` upstream
@@ -686,38 +702,38 @@ async function mergeRebaseFf(
   // gives them new SHAs and breaks traceability (the branch.landed SHA must exist on
   // base verbatim). headSha is the preserved landed commit; when base has advanced we
   // tie the branch in with a no-ff merge so the agent's commits keep their identity.
-  const headResult = await mergeGit(["rev-parse", "HEAD"], worktreePath, "rebase", "workspace merge resolve workspace HEAD before gates");
+  const headResult = await mergeGit(["rev-parse", "HEAD"], worktreePath, "rebase", "workspace merge resolve workspace HEAD before gates", signal);
   const headSha = headResult.stdout;
   if (!headResult.ok || !headSha) return head({ status: "review_requested", error: gitError(headResult, "failed to resolve workspace HEAD before gates") });
   // Subject of the landed commit for the relay's branch.landed notice (#239). Best-effort:
   // an empty/failed read just omits it from the message body.
-  const landedSubject = (await mergeGit(["log", "-1", "--format=%s", headSha], worktreePath, "rebase", "workspace merge read landed commit subject")).stdout || undefined;
+  const landedSubject = (await mergeGit(["log", "-1", "--format=%s", headSha], worktreePath, "rebase", "workspace merge read landed commit subject", signal)).stdout || undefined;
 
   // Resolve the SHA the work will integrate onto WITHOUT moving the ref. Origin-ahead is
   // the common concurrent case (#638): we still fetch fresh origin to compute the real merge,
   // but defer the local-base sync until the final base-ref mutation block below.
-  const integrationBaseResult = await mergeGit(["rev-parse", base], repoRoot, "rebase", `workspace merge resolve integration base ${base}`);
+  const integrationBaseResult = await mergeGit(["rev-parse", base], repoRoot, "rebase", `workspace merge resolve integration base ${base}`, signal);
   let integrationBaseSha = integrationBaseResult.stdout;
   if (!integrationBaseResult.ok || !integrationBaseSha) return head({ status: "review_requested", error: gitError(integrationBaseResult, `failed to resolve integration base ${base}`) });
   let needSync = false;
   if (upstream && remote && pushEnabled) {
     try {
-      const fetch = await withMergePhaseTimeout("fetch", () => git(
+      const fetch = await withMergePhaseTimeout("fetch", (fetchSignal) => git(
         ["fetch", remote, base],
         worktreePath,
-        { timeoutMs: mergePhaseTimeoutMs("fetch"), timeoutLabel: `workspace merge fetch ${remote}/${base}` },
-      ));
+        { timeoutMs: mergePhaseTimeoutMs("fetch"), timeoutLabel: `workspace merge fetch ${remote}/${base}`, signal: fetchSignal },
+      ), { signal });
       if (!fetch.ok && fetch.timedOut) return head({ status: "review_requested", error: fetch.stderr || `fetch ${remote}/${base} timed out` });
     } catch (err) {
       return head({ status: "review_requested", error: errMessage(err) });
     }
-    if (!(await mergeGit(["merge-base", "--is-ancestor", upstream, base], worktreePath, "rebase", `workspace merge compare ${upstream} to ${base}`)).ok) {
+    if (!(await mergeGit(["merge-base", "--is-ancestor", upstream, base], worktreePath, "rebase", `workspace merge compare ${upstream} to ${base}`, signal)).ok) {
       // Origin moved ahead. Sync-then-land iff local base is cleanly behind (ancestor
       // of upstream); otherwise it's genuine divergence — refuse without mutating.
-      if (!(await mergeGit(["merge-base", "--is-ancestor", base, upstream], worktreePath, "rebase", `workspace merge compare ${base} to ${upstream}`)).ok) {
+      if (!(await mergeGit(["merge-base", "--is-ancestor", base, upstream], worktreePath, "rebase", `workspace merge compare ${base} to ${upstream}`, signal)).ok) {
         return head({ status: "review_requested", error: `local ${base} has diverged from ${upstream} (commits not on origin); sync before landing` });
       }
-      const upstreamSha = (await mergeGit(["rev-parse", "--verify", upstream], worktreePath, "rebase", `workspace merge resolve ${upstream} for integration`)).stdout;
+      const upstreamSha = (await mergeGit(["rev-parse", "--verify", upstream], worktreePath, "rebase", `workspace merge resolve ${upstream} for integration`, signal)).stdout;
       if (!upstreamSha) return head({ status: "review_requested", error: `cannot resolve ${upstream} to sync ${base}` });
       // Integrate onto fresh origin (the tree that will land), but DON'T advance local base yet.
       integrationBaseSha = upstreamSha;
@@ -726,7 +742,7 @@ async function mergeRebaseFf(
   }
 
   // Behind relative to the TRUE integration base (origin-ahead ⟹ behind>0 ⟹ a real no-ff merge).
-  const behindResult = await countBehind(worktreePath, integrationBaseSha);
+  const behindResult = await countBehind(worktreePath, integrationBaseSha, signal);
   if ("error" in behindResult) return head({ status: "review_requested", error: behindResult.error });
   const behind = behindResult.behind;
 
@@ -735,6 +751,7 @@ async function mergeRebaseFf(
   // before base-ref mutation so the rest of the historical land ordering stays intact, but no
   // gate subprocess or detached gate worktree can be launched at land time.
   const gateRun = await runLandGatesOnIntegratedTree(repoRoot, worktreePath, behind, integrationBaseSha, headSha, landMergeMessage(branch, landedSubject));
+  throwIfMergeAborted(signal);
   if ("abort" in gateRun) {
     return gateRun.abort.conflict
       ? head({ conflict: true, status: "conflict", error: gateRun.abort.error })
@@ -750,7 +767,9 @@ async function mergeRebaseFf(
   // upstream first (#638); this preserves the pre-existing land ordering while gate execution
   // remains permanently disabled.
   if (needSync) {
-    const synced = await syncLocalBaseToUpstream(repoRoot, worktreePath, base, upstream!);
+    throwIfMergeAborted(signal);
+    const synced = await syncLocalBaseToUpstream(repoRoot, worktreePath, base, upstream!, signal);
+    throwIfMergeAborted(signal);
     if (!synced.ok) return head({ status: "review_requested", error: synced.error });
     baseSync = mergeBaseSyncResults(baseSync, synced.baseSync);
   }
@@ -763,11 +782,12 @@ async function mergeRebaseFf(
   // land: fall through to ref-plumbing (update-ref / synthesized no-ff merge) below, then
   // best-effort sync clean landed paths in the dirty checkout while preserving WIP (#681).
   let baseTip = headSha;
-  const baseWorktree = await worktreeForBranch(repoRoot, base);
-  const dirtyBasePathsBefore = baseWorktree?.dirty ? await dirtyPathSet(baseWorktree.path) : undefined;
+  throwIfMergeAborted(signal);
+  const baseWorktree = await worktreeForBranch(repoRoot, base, signal);
+  const dirtyBasePathsBefore = baseWorktree?.dirty ? await dirtyPathSet(baseWorktree.path, signal) : undefined;
   if (baseWorktree && !baseWorktree.dirty) {
     if (behind === 0) {
-      const ff = await mergeGit(["merge", "--ff-only", branch], baseWorktree.path, "rebase", `workspace merge fast-forward ${base} to ${branch}`);
+      const ff = await mergeGit(["merge", "--ff-only", branch], baseWorktree.path, "rebase", `workspace merge fast-forward ${base} to ${branch}`, signal);
       if (!ff.ok) return head({ status: "review_requested", error: ff.stderr || "fast-forward into base failed" });
     } else {
       const merge = await mergeGit(
@@ -775,28 +795,31 @@ async function mergeRebaseFf(
         baseWorktree.path,
         "rebase",
         `workspace merge no-ff ${branch} into ${base}`,
+        signal,
       );
       if (!merge.ok) {
-        await mergeGit(["merge", "--abort"], baseWorktree.path, "rebase", `workspace merge abort failed no-ff ${branch}`);
+        await mergeGit(["merge", "--abort"], baseWorktree.path, "rebase", `workspace merge abort failed no-ff ${branch}`, signal);
         return head({ conflict: true, status: "conflict", error: merge.stderr || "merge into base failed" });
       }
-      baseTip = (await mergeGit(["rev-parse", "HEAD"], baseWorktree.path, "rebase", `workspace merge resolve ${base} after no-ff`)).stdout;
+      baseTip = (await mergeGit(["rev-parse", "HEAD"], baseWorktree.path, "rebase", `workspace merge resolve ${base} after no-ff`, signal)).stdout;
     }
   } else if (behind === 0) {
-    const oldBaseTip = (await mergeGit(["rev-parse", base], repoRoot, "rebase", `workspace merge resolve ${base} before fast-forward ref update`)).stdout;
+    const oldBaseTip = (await mergeGit(["rev-parse", base], repoRoot, "rebase", `workspace merge resolve ${base} before fast-forward ref update`, signal)).stdout;
+    throwIfMergeAborted(signal);
     const update = oldBaseTip
-      ? await mergeGit(["update-ref", `refs/heads/${base}`, headSha, oldBaseTip], repoRoot, "rebase", `workspace merge update ${base} fast-forward`)
-      : await mergeGit(["update-ref", `refs/heads/${base}`, headSha], repoRoot, "rebase", `workspace merge create/update ${base} fast-forward`);
+      ? await mergeGit(["update-ref", `refs/heads/${base}`, headSha, oldBaseTip], repoRoot, "rebase", `workspace merge update ${base} fast-forward`, signal)
+      : await mergeGit(["update-ref", `refs/heads/${base}`, headSha], repoRoot, "rebase", `workspace merge create/update ${base} fast-forward`, signal);
     if (!update.ok) return head({ status: "review_requested", error: update.stderr || "failed to advance base ref" });
-    if (oldBaseTip) baseSync = mergeBaseSyncResults(baseSync, await syncDirtyBaseWorktreeAfterRefAdvance(base, baseWorktree, oldBaseTip, headSha, dirtyBasePathsBefore));
+    if (oldBaseTip) baseSync = mergeBaseSyncResults(baseSync, await syncDirtyBaseWorktreeAfterRefAdvance(base, baseWorktree, oldBaseTip, headSha, dirtyBasePathsBefore, signal));
   } else {
-    const baseShaResult = await mergeGit(["rev-parse", base], repoRoot, "rebase", `workspace merge resolve ${base} before no-ff ref update`);
+    const baseShaResult = await mergeGit(["rev-parse", base], repoRoot, "rebase", `workspace merge resolve ${base} before no-ff ref update`, signal);
     const baseSha = baseShaResult.stdout;
     if (!baseShaResult.ok || !baseSha) return head({ status: "review_requested", error: gitError(baseShaResult, `failed to resolve ${base} before no-ff ref update`) });
-    const merged = await recordNoFfMerge(repoRoot, base, baseSha, headSha, landMergeMessage(branch, landedSubject));
+    throwIfMergeAborted(signal);
+    const merged = await recordNoFfMerge(repoRoot, base, baseSha, headSha, landMergeMessage(branch, landedSubject), signal);
     if (!merged.ok) return head(merged.conflict ? { conflict: true, status: "conflict", error: merged.error } : { status: "review_requested", error: merged.error });
     baseTip = merged.mergeSha;
-    baseSync = mergeBaseSyncResults(baseSync, await syncDirtyBaseWorktreeAfterRefAdvance(base, baseWorktree, baseSha, baseTip, dirtyBasePathsBefore));
+    baseSync = mergeBaseSyncResults(baseSync, await syncDirtyBaseWorktreeAfterRefAdvance(base, baseWorktree, baseSha, baseTip, dirtyBasePathsBefore, signal));
   }
 
   // #824 — a dirty base checkout left out of sync with the advanced HEAD is a MIXED state:
@@ -812,7 +835,8 @@ async function mergeRebaseFf(
   // means origin raced us — surface it instead of claiming an unpublished land.
   let pushed = false;
   if (upstream && remote && pushEnabled) {
-    const push = await mergeGit(["push", remote, `${base}:${base}`], worktreePath, "rebase", `workspace merge push ${base} to ${remote}`);
+    throwIfMergeAborted(signal);
+    const push = await mergeGit(["push", remote, `${base}:${base}`], worktreePath, "rebase", `workspace merge push ${base} to ${remote}`, signal);
     if (!push.ok) return head({ status: "review_requested", mergedSha: headSha, error: push.stderr || `git push to ${remote}/${base} failed` });
     pushed = true;
   }
@@ -824,25 +848,27 @@ async function mergeRebaseFf(
   // state in the same CWD; status returns to `active`. An absent owner gets the
   // worktree reclaimed.
   const deleteBranch = input.deleteBranch !== false;
+  const ownerRepo = await owningRepoRoot(worktreePath, repoRoot);
   if (!deleteBranch) {
-    const fresh = await nextBranchName(repoRoot, branch);
-    const switched = await mergeGit(["checkout", "-B", fresh, base], worktreePath, "rebase", `workspace merge recycle worktree to ${fresh}`);
+    const fresh = await nextBranchName(ownerRepo, branch);
+    throwIfMergeAborted(signal);
+    const switched = await mergeGit(["checkout", "-B", fresh, base], worktreePath, "rebase", `workspace merge recycle worktree to ${fresh}`, signal);
     if (switched.ok) {
-      // The old branch is now fully contained in base (fast-forwarded, or merged in
-      // as the no-ff merge's second parent) — drop the litter.
-      const oldDeleted = (await mergeGit(["branch", "-D", branch], repoRoot, "cleanup", `workspace merge delete landed branch ${branch}`)).ok;
+      const deleteResult = await deleteBranchIfSafe(ownerRepo, branch, undefined, baseTip, signal);
       // The worktree just moved onto the advanced base, which may declare deps the
       // shared (symlinked) node_modules lacks. Re-provision so the recycled session
       // continues from a buildable state (issue #51). No-op when nothing is stale.
-      const depsRefresh = await refreshWorkspaceDeps(repoRoot, worktreePath);
+      const depsRefresh = await refreshWorkspaceDeps(ownerRepo, worktreePath);
+      throwIfMergeAborted(signal);
       const reportDeps = depsRefresh.refreshed || depsRefresh.stale || depsRefresh.error;
-      return head({ merged: true, status: "active", mergedSha: headSha, baseSha: baseTip, subject: landedSubject, worktreeRemoved: false, branch: fresh, newBranch: fresh, branchDeleted: oldDeleted, pushed, ...(reportDeps ? { depsRefresh } : {}), ...baseWorktreeSyncField, ...gateWarningsField, error: undefined });
+      return head({ merged: true, status: "active", mergedSha: headSha, baseSha: baseTip, subject: landedSubject, worktreeRemoved: false, branch: fresh, newBranch: fresh, ...deleteResult, pushed, ...(reportDeps ? { depsRefresh } : {}), ...baseWorktreeSyncField, ...gateWarningsField, error: undefined });
     }
     // Recycle failed — keep the existing branch. Still landed, still active.
     return head({ merged: true, status: "active", mergedSha: headSha, baseSha: baseTip, subject: landedSubject, worktreeRemoved: false, branchDeleted: false, pushed, ...baseWorktreeSyncField, ...gateWarningsField, error: undefined });
   }
-  const removed = await mergeGit(["worktree", "remove", "--force", worktreePath], repoRoot, "cleanup", "workspace merge remove landed worktree");
+  throwIfMergeAborted(signal);
+  const removed = await mergeGit(["worktree", "remove", "--force", worktreePath], ownerRepo, "cleanup", "workspace merge remove landed worktree", signal);
   const worktreeRemoved = removed.ok;
-  const branchDeleted = worktreeRemoved ? (await mergeGit(["branch", "-D", branch], repoRoot, "cleanup", `workspace merge delete landed branch ${branch}`)).ok : false;
-  return head({ merged: true, status: "merged", mergedSha: headSha, baseSha: baseTip, subject: landedSubject, worktreeRemoved, branchDeleted, pushed, ...baseWorktreeSyncField, ...gateWarningsField, error: undefined });
+  const deleteResult = worktreeRemoved ? await deleteBranchIfSafe(ownerRepo, branch, undefined, baseTip, signal) : { branchDeleted: false };
+  return head({ merged: true, status: "merged", mergedSha: headSha, baseSha: baseTip, subject: landedSubject, worktreeRemoved, ...deleteResult, pushed, ...baseWorktreeSyncField, ...gateWarningsField, error: undefined });
 }

package/src/workspace-probe/types.ts

@@ -65,4 +65,5 @@ export interface WorkspaceMergeInput {
    * otherwise loop via review_requested. prMerged is monotonic and was read from THIS host's
    * own `checkPr` scan, so trusting it is safe; we still refuse on a dirty tree. */
   prLanded?: { sha?: string; subject?: string };
+  signal?: AbortSignal;
 }