baxian 1.2.8 → 1.2.10

package/dist/agent/manager.js

@@ -6,7 +6,7 @@ import { BRANCH_PREFIX, isValidBranchName, PHASE_EXPECTED_STATUS, PHASE_REQUIRES
 import { AGENT_STORE_NOOP } from '../state/agent-store.js';
 import { PostApproveStore } from '../state/post-approve-store.js';
 import { SkillRegistry } from '../skill/registry.js';
-import { createRunner, LocalRunner, shellQuote, resolveAgentHost } from './runner.js';
+import { createRunner, LocalRunner, shellQuote, resolveAgentHost, hostGroupKey } from './runner.js';
 import { imageFilename, agentHostPath, writeImageToHost } from './image-input.js';
 import { TmuxManager, ReplNotReadyError, detectStartupDialog, detectRuntimeMenu, runtimeBusyCheck, hasRuntimeReadyView, hasReplProcTitle, } from './tmux.js';
 import { WorktreeManager } from './worktree.js';
@@ -87,8 +87,24 @@ export function canDispatchWithBinding(binding) {
 // recover 路径）都可能让第二个 prompt 派进同 pane 与旧 turn 混在一起。outcome handler 通过显式
 // allowAwaitingHuman:true release，gate 单点放行。
 const TURN_COMPLETED_AWAITING_PHASES = new Set();
+// Pane is stopped (interrupt landed) but its session was not cleared: cancel is mid /clear
+// (`cancel-clearing`) or /clear was unconfirmed (`cancel-clear-failed`). Resume can't fix it (it doesn't
+// /clear), so these are DELETE-only: shouldReleaseHeldBinding returns false → recover()/escape/Resume all
+// refuse. Persisted, so the protection survives a restart mid-cleanup.
+const UNCLEARED_PANE_PHASES = new Set(['cancel-clearing', 'cancel-clear-failed']);
+// All cancel-cleanup holds (the un-cleared ones plus `cancel-interrupt-failed`, where the interrupt failed
+// so the pane may still be running the cancelled task). None may be AUTO-released — not by recover(), not by
+// a terminal-task escape, not even by an allowAwaitingHuman caller — because that would reuse the cancelled
+// session. Only cancel's own confirmed-/clear release (fromCancelCleanup) frees one automatically; the
+// operator recovers via Resume (cancel-interrupt-failed only, after verifying) or DELETE (any).
+const CANCEL_CLEANUP_HOLD_PHASES = new Set([...UNCLEARED_PANE_PHASES, 'cancel-interrupt-failed']);
+// A prompt line still holding the typed `/clear` (e.g. `❯ /clear`, `› /clear`) = the Enter was swallowed,
+// so /clear was never submitted. After a real submission /clear wipes the screen and the composer is empty.
+const CLEAR_PENDING_IN_COMPOSER_RE = /(?:^|\n)[ \t]*[❯>›→][ \t]*\/clear\b/;
 // Resume / recover 共用：决定 Held agent 的 binding 是否随状态恢复一起清掉。
 export function shouldReleaseHeldBinding(state, boundTask) {
+    if (state.awaitingPhase != null && UNCLEARED_PANE_PHASES.has(state.awaitingPhase))
+        return false;
     const taskIsTerminal = !!boundTask && TERMINAL_STATUSES.includes(boundTask.status);
     const turnCompleted = state.awaitingPhase != null && TURN_COMPLETED_AWAITING_PHASES.has(state.awaitingPhase);
     return !boundTask || taskIsTerminal || turnCompleted;
@@ -134,6 +150,7 @@ export class AgentManager {
     compactIdleWaitMs = 5 * 60_000;
     compactIdlePollMs = 2_000;
     manualCompactWaitMs = 5_000;
+    clearContextWaitMs = 30_000;
     postMergeFetchTimeoutMs = 60_000;
     postMergeBranchTimeoutMs = 10_000;
     // taskIds with in-flight manual review — second concurrent POST gets 409.
@@ -311,6 +328,16 @@ export class AgentManager {
         catch (err) {
             throw new EnsureSessionError({ createdSession: false, agentId }, `ensureWorkdir failed: ${err instanceof Error ? err.message : String(err)}`);
         }
+        // Skills must be on disk at the repo root before the REPL launches OR is reused,
+        // so native discovery sees them and the dispatch's /skill / $skill resolves. Runs
+        // on every path — fresh launch, adopt of a live runtime, and shell/REPL restart —
+        // not just buildFreshSession; the version marker keeps the steady state a single cat.
+        try {
+            await this.provisionRepoSkills(runner, agent, workdir);
+        }
+        catch (err) {
+            throw new EnsureSessionError({ createdSession: false, agentId }, `skill provisioning failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
         let alive;
         try {
             alive = await tmux.hasSession(agentId);
@@ -327,6 +354,130 @@ export class AgentManager {
         }
         return this.buildFreshSession(tmux, agent, agentId, workdir);
     }
+    // Materialize baxian skills into the repo root the REPL launches in (cwd at
+    // launch), so the agent's `claude`/`codex` discovers them as native skills and
+    // the dispatch can force-load one with `/skill` / `$skill`. Each file is written
+    // atomically (stage + rename) and a current skill's dir is never removed, so a
+    // concurrent agent's lazy SKILL.md read never observes an absent/partial file.
+    async provisionRepoSkills(runner, agent, workdir) {
+        if (this.skillRegistry.names().length === 0)
+            return;
+        const subdir = agent.runtime === 'codex' ? '.agents/skills' : '.claude/skills';
+        const destRoot = `${workdir}/${subdir}`;
+        // Re-run on EVERY dispatch — do NOT cache the result. Config hot-reload
+        // (replaceConfig, no restart) can repoint this agent's workdir/runtime to another
+        // repo / skills dir, and repo code or a prior agent turn can tamper the on-disk
+        // skill tree between dispatches; a skip cache (in-memory or on-disk) would then
+        // serve a missing or repo-controlled tree. The files are tiny, so materialize
+        // unconditionally. The cleanup + git-exclude are idempotent + best-effort.
+        await this.excludeInjectedSkills(runner, workdir, subdir);
+        // Serialize the cleanup+materialize per target skills dir (shared with the launch-time
+        // scan in buildFreshSession): two same-runtime agents on one repo would otherwise let
+        // one's `rm` blank the tree while the other materializes or its REPL scans for skills.
+        await this.runUnderSkillDirLock(this.skillDirLockKey(agent, workdir), async () => {
+            await this.ensureSkillDirSafe(runner, workdir, subdir);
+            await this.skillRegistry.materialize((path, content) => this.atomicWriteFile(runner, path, content), destRoot);
+        });
+    }
+    // Per (host, workdir, runtime-subdir) in-process lock. Both the cleanup+materialize
+    // and the fresh REPL launch (which scans the skills dir at startup) run under it, so a
+    // concurrent same-dir agent never observes a transiently-empty skills tree.
+    skillDirChain = new Map();
+    skillDirLockKey(agent, workdir) {
+        // Canonicalize the host (a registry id and an equivalent inline host, or a blank vs default
+        // port, must collapse to one key) and the workdir (a trailing slash must not fork the lock),
+        // so two agents truly pointing at the same physical dir serialize instead of racing.
+        const host = hostGroupKey(agent.mode, resolveAgentHost(this.config.host, agent.host));
+        const subdir = agent.runtime === 'codex' ? '.agents/skills' : '.claude/skills';
+        const dir = workdir.replace(/\/+$/, '');
+        return `${host}:${dir}:${subdir}`;
+    }
+    runUnderSkillDirLock(key, fn) {
+        const prev = this.skillDirChain.get(key) ?? Promise.resolve();
+        const run = prev.then(fn, fn);
+        this.skillDirChain.set(key, run.then(() => undefined, () => undefined));
+        return run;
+    }
+    // Atomic per-file replace. materialize() hands us each skill file's FINAL path; we stage it as a
+    // sibling `.baxian-tmp` and `mv -f` it into place. POSIX rename is atomic, so a claude/codex lazy
+    // SKILL.md body read — which happens at `/baxian-*` / `$baxian-*` INVOKE time, after this dir's
+    // provisioning lock has already been released — sees either the complete old file or the complete
+    // new one, never the truncate-in-place window of a bare writeFile or the blank window of a
+    // delete-then-rewrite. The tmp lives inside the `baxian-*` leaf, so the git-exclude rule covers it.
+    async atomicWriteFile(runner, finalPath, content) {
+        const tmp = `${finalPath}.baxian-tmp`;
+        await runner.writeFile(tmp, content);
+        const mv = `mv -f ${shellQuote(tmp)} ${shellQuote(finalPath)}`;
+        const res = await runner.exec(`sh -c ${shellQuote(mv)}`);
+        if (res.exitCode !== 0) {
+            throw new Error(`atomic skill write failed (${finalPath}): ${res.stderr || 'unknown error'}`);
+        }
+    }
+    // Make the skills subtree symlink-safe before writing into it, WITHOUT blanking a live skill. A
+    // current skill's dir is left in place (its files are swapped atomically by atomicWriteFile); we
+    // prune `baxian-*` dirs no longer in the registry, strip EVERY symlink anywhere under a `baxian-*`
+    // tree (leaf OR a nested component like `baxian-pr-review/agents`) so the atomic write can't be
+    // redirected out of the workdir, and drop stale helper files left by a past skill version (a
+    // removed/renamed file) — SKILL.md is kept so a concurrent lazy read is never blanked, and
+    // materialize re-writes every current file atomically. The PARENT components (`.claude`/`.agents`
+    // + their `skills` subdir) fail fast when they are symlinks: following one could write OUTSIDE the
+    // workdir, and silently rm-ing it would destroy a user's legitimate symlinked skills dir (codex
+    // documents symlinked skill folders as supported). `find -name`/`-path` (not a bare glob) avoids
+    // zsh NOMATCH; the whole thing runs under POSIX `sh -c` since wrapRemoteCommand otherwise uses the
+    // login shell (maybe fish). `top`/`subdir` are fixed constants; names are baxian-owned slugs.
+    async ensureSkillDirSafe(runner, workdir, subdir) {
+        const top = subdir.split('/')[0];
+        const keep = this.skillRegistry.names().map((n) => `! -name ${shellQuote(n)}`).join(' ');
+        const inner = `cd ${shellQuote(workdir)} && ` +
+            `for d in ${top} ${subdir}; do if [ -L "$d" ]; then ` +
+            `printf 'baxian: %s is a symlink -> %s; replace it with a real directory\\n' "$d" "$(readlink "$d")" >&2; ` +
+            `exit 3; fi; done && ` +
+            `mkdir -p ${subdir} && ` +
+            `find ${subdir} -maxdepth 1 -name 'baxian-*' ${keep} -exec rm -rf {} + && ` +
+            `find ${subdir} -path '${subdir}/baxian-*' -type l -exec rm -f {} + && ` +
+            `find ${subdir} -path '${subdir}/baxian-*/*' -type f ! -name 'SKILL.md' -exec rm -f {} +`;
+        const res = await runner.exec(`sh -c ${shellQuote(inner)}`);
+        if (res.exitCode !== 0) {
+            throw new Error(`failed to prepare a symlink-safe ${subdir} in ${workdir}: ${res.stderr || 'unknown error'}`);
+        }
+    }
+    // Tag a freshly-launched session with the skills version it discovered at launch, so
+    // adoptOrRestartSession can tell when a live REPL predates the current skills.
+    async tagSessionSkillsVersion(tmux, agentId) {
+        if (this.skillRegistry.names().length === 0)
+            return;
+        await tmux.setOption(agentId, '@baxian-skills-version', this.skillRegistry.contentHash());
+    }
+    // True when a live REPL's launch-time skills version differs from the current one
+    // (or is absent — a pre-skills session): it cannot resolve a dispatched /baxian-*.
+    async replSkillsStale(tmux, agentId) {
+        if (this.skillRegistry.names().length === 0)
+            return false;
+        // getOption already maps a MISSING tag to null (→ stale). Do NOT swallow other
+        // errors: a thrown tmux probe failure must propagate so the caller surfaces it as an
+        // EnsureSessionError, instead of being read as stale and needlessly killing the REPL.
+        const tagged = await tmux.getOption(agentId, '@baxian-skills-version');
+        return tagged !== this.skillRegistry.contentHash();
+    }
+    // Hide ONLY what baxian writes — the `baxian-*` skill dirs — from the agent's
+    // `git status` / PRs. Excluding the whole skills dir would also hide a user repo's own
+    // untracked native skills there, defeating the `baxian-` prefix's coexistence intent.
+    // The `if git rev-parse` guard skips a non-git workdir, and failure only warns: skills
+    // are already on disk, so a git hiccup must not block the session.
+    async excludeInjectedSkills(runner, workdir, subdir) {
+        // info/exclude patterns anchor at the REPO ROOT, but the skills dir lives at the
+        // workdir; when workdir is a SUBDIR of the repo, prefix the rule with the workdir's
+        // path relative to the repo root (git rev-parse --show-prefix) so the pattern matches.
+        const inner = `cd ${shellQuote(workdir)} && if p="$(git rev-parse --git-path info/exclude 2>/dev/null)"; then ` +
+            `pre="$(git rev-parse --show-prefix 2>/dev/null)"; rule="\${pre}${subdir}/baxian-*"; ` +
+            `mkdir -p "$(dirname "$p")" && { grep -qxF "$rule" "$p" 2>/dev/null || printf '%s\\n' "$rule" >> "$p"; }; fi`;
+        // Run under POSIX sh (if/then/fi + $() are not fish syntax; wrapRemoteCommand uses $SHELL).
+        const res = await runner.exec(`sh -c ${shellQuote(inner)}`);
+        if (res.exitCode !== 0) {
+            console.warn(`[AgentManager] skill info/exclude best-effort failed in ${workdir} ` +
+                `(skills still materialized): ${res.stderr || 'unknown error'}`);
+        }
+    }
     async pinRuntimeSessionOptions(tmux, agentId) {
         await tmux.setOption(agentId, 'prefix', 'C-b');
         await tmux.setOption(agentId, 'prefix2', 'None');
@@ -338,6 +489,11 @@ export class AgentManager {
         await this.pinRuntimeSessionOptions(tmux, agentId);
     }
     async buildFreshSession(tmux, agent, agentId, workdir) {
+        // Hold the per-skills-dir lock across the launch so the REPL's startup skill scan
+        // can't overlap a concurrent same-dir agent's provisioning rm (see provisionRepoSkills).
+        return this.runUnderSkillDirLock(this.skillDirLockKey(agent, workdir), () => this.buildFreshSessionLocked(tmux, agent, agentId, workdir));
+    }
+    async buildFreshSessionLocked(tmux, agent, agentId, workdir) {
         let createdSession = false;
         const runtime = agentRuntimeKindFor(agent);
         try {
@@ -361,6 +517,7 @@ export class AgentManager {
                 timeoutMs: this.bootstrapTimeoutsMs.waitReplReady,
                 scrollback: 0,
             });
+            await this.tagSessionSkillsVersion(tmux, agentId);
             return { ok: true, createdSession: true, freshRuntime: true, paneId, workdir };
         }
         catch (err) {
@@ -923,9 +1080,25 @@ export class AgentManager {
             throw new EnsureSessionError({ createdSession: false, agentId }, `classifyPaneForAdopt failed: ${err instanceof Error ? err.message : String(err)}`);
         }
         switch (state.kind) {
-            case 'live-runtime':
+            case 'live-runtime': {
+                let stale;
+                try {
+                    stale = await this.replSkillsStale(tmux, agentId);
+                }
+                catch (err) {
+                    // A tmux probe failure here is transient — surface it, do NOT kill the REPL.
+                    throw new EnsureSessionError({ createdSession: false, agentId }, `skills-version probe failed: ${err instanceof Error ? err.message : String(err)}`);
+                }
+                if (stale) {
+                    // This REPL launched before the current skills were on disk; claude/codex only
+                    // discover a freshly-created top-level skills dir at launch, so a dispatched
+                    // /baxian-* / $baxian-* would not resolve. Rebuild so the command works.
+                    await tmux.killSession(agentId).catch(() => { });
+                    return this.buildFreshSession(tmux, agent, agentId, workdir);
+                }
                 // 复用既有 REPL，上下文未中断——dedup 仍可沿用。
                 return { ok: true, createdSession: false, freshRuntime: false, paneId, workdir };
+            }
             case 'startup-dialog':
                 throw new EnsureSessionError({
                     createdSession: false,
@@ -949,6 +1122,7 @@ export class AgentManager {
                         scrollback: 0,
                     });
                     // 信任弹窗刚被答完，REPL 从启动态进入可用——上下文是新的。
+                    await this.tagSessionSkillsVersion(tmux, agentId);
                     return { ok: true, createdSession: false, freshRuntime: true, paneId, workdir };
                 }
                 catch (trustErr) {
@@ -976,6 +1150,7 @@ export class AgentManager {
                 scrollback: 0,
             });
             // shell 路径：在原 pane 里重新启动了 REPL，新进程没有旧 prompt 上下文。
+            await this.tagSessionSkillsVersion(tmux, agentId);
             return { ok: true, createdSession: false, freshRuntime: true, paneId, workdir };
         }
         catch (relErr) {
@@ -1038,6 +1213,17 @@ export class AgentManager {
                     `(expected ${expectedTaskId}, got ${state.taskId}); skipping`);
                 return false;
             }
+            // Cancel-cleanup hold: only cancel's own release may free it. Checked BEFORE the allowAwaitingHuman
+            // gate below, because that gate skips shouldReleaseHeldBinding entirely — so without this an
+            // allowAwaitingHuman caller (startup false-start, review/max-rounds handlers, a terminal-task escape)
+            // could reassign the un-cleared/maybe-running pane before cancel confirms /clear. (Operator recovery
+            // via resumeAgent / DELETE doesn't go through this path.)
+            if (state.awaitingPhase != null
+                && CANCEL_CLEANUP_HOLD_PHASES.has(state.awaitingPhase)
+                && !opts.fromCancelCleanup) {
+                console.warn(`[AgentManager] releaseAgentForTask: agent ${agentId} ${state.awaitingPhase} (cancel-cleanup hold); refusing auto-release`);
+                return false;
+            }
             const boundTask = await this.taskStore.get(expectedTaskId);
             if (state.status === 'awaiting_human' && !opts.allowAwaitingHuman) {
                 // gate 例外：bound task 已 terminal / turn-completed phase 都属于正常 cleanup 路径，
@@ -1268,6 +1454,13 @@ export class AgentManager {
                 console.warn(`[AgentManager] resumeAgent: agent ${agentId} ${state.awaitingPhase} with active task ${state.taskId} — the dispatched prompt's pane signal has no consumer and Resume cannot rebuild the watcher; refusing Resume. Operator should cancel the task or DELETE the agent.`);
                 return { resumed: false, releasedBinding: false };
             }
+            // Un-cleared pane (cancel mid-clear or /clear unconfirmed): Resume would free + reuse it (terminal
+            // task → shouldReleaseHeldBinding) and leak the cancelled task's context. Refuse; only DELETE (which
+            // destroys the pane) is a safe recovery.
+            if (state.awaitingPhase != null && UNCLEARED_PANE_PHASES.has(state.awaitingPhase)) {
+                console.warn(`[AgentManager] resumeAgent: agent ${agentId} ${state.awaitingPhase} — pane holds un-cleared context; refusing Resume. DELETE the agent to discard it.`);
+                return { resumed: false, releasedBinding: false };
+            }
             const now = new Date().toISOString();
             const shouldReleaseBinding = shouldReleaseHeldBinding(state, boundTask);
             const cfg = this.getAgentConfig(agentId);
@@ -1339,25 +1532,29 @@ export class AgentManager {
         }
         return { resumed: result.resumed, releasedBinding: result.releasedBinding };
     }
-    async interruptPaneAndWaitReady(state, cfg) {
-        const runner = this.createRunnerFor(cfg);
-        const tmux = new TmuxManager(runner);
-        let paneId = state.paneId;
-        if (!paneId) {
-            try {
-                paneId = await tmux.getSinglePaneId(cfg.id);
-            }
-            catch (err) {
-                console.warn(`[AgentManager] interruptPaneAndWaitReady: getSinglePaneId failed for ${cfg.id}:`, err);
-                return false;
-            }
+    async resolvePaneId(state, cfg) {
+        if (state.paneId)
+            return state.paneId;
+        try {
+            return await new TmuxManager(this.createRunnerFor(cfg)).getSinglePaneId(cfg.id);
+        }
+        catch (err) {
+            console.warn(`[AgentManager] resolvePaneId: getSinglePaneId failed for ${cfg.id}:`, err);
+            return null;
         }
+    }
+    // ESC (not Ctrl-C) is the interrupt key both runtimes advertise; returns whether the pane reached idle.
+    async interruptPaneAndWaitReady(state, cfg) {
+        const paneId = await this.resolvePaneId(state, cfg);
+        if (!paneId)
+            return false;
+        const tmux = new TmuxManager(this.createRunnerFor(cfg));
         try {
-            await tmux.sendKeysToPane(paneId, 'C-c');
+            await tmux.sendKeysToPane(paneId, 'Escape');
             await new Promise(r => setTimeout(r, 200));
         }
         catch (err) {
-            console.warn(`[AgentManager] interruptPaneAndWaitReady: send C-c failed for pane ${paneId}:`, err);
+            console.warn(`[AgentManager] interruptPaneAndWaitReady: send Escape failed for pane ${paneId}:`, err);
             return false;
         }
         try {
@@ -1372,6 +1569,72 @@ export class AgentManager {
             return false;
         }
     }
+    // Persist a "cancel is interrupting + /clearing this pane" hold BEFORE the ESC→/clear window so the
+    // protection survives a restart (recover() holds UNCLEARED_PANE_PHASES) and the escape can't reassign the
+    // un-cleared pane. Direct update (no intervention event): a normal cancel clears it on release; only a
+    // crash/failure leaves it. Conditional on the binding so a stale cancel can't mark an agent rebound away.
+    async markPaneCancelClearing(agentId, taskId) {
+        const now = new Date().toISOString();
+        await this.agentStore.update(agentId, (latest) => {
+            if (!latest || latest.taskId !== taskId)
+                return AGENT_STORE_NOOP;
+            return {
+                ...latest,
+                status: 'awaiting_human',
+                awaitingPhase: 'cancel-clearing',
+                awaitingReason: 'Cancelling: interrupting and clearing the runtime session; not reusable until /clear is confirmed or the agent is deleted.',
+                awaitingSince: now,
+                updatedAt: now,
+            };
+        });
+    }
+    // Returns whether /clear was confirmed (a real busy→idle, not the stale pre-/clear idle frame); the
+    // caller must hold the agent, not release it, on false or the un-cleared context leaks to the next dispatch.
+    async clearPaneContext(state, cfg) {
+        const paneId = await this.resolvePaneId(state, cfg);
+        if (!paneId)
+            return false;
+        if (!this.tryAcquireCompactGuard(cfg.id)) {
+            console.warn(`[AgentManager] clearPaneContext: ${cfg.id} compact/upload in progress; cannot /clear`);
+            return false;
+        }
+        try {
+            const tmux = new TmuxManager(this.createRunnerFor(cfg));
+            const runtime = agentRuntimeKindFor(cfg);
+            // C-c clears any prompt an ack-timeout left in the composer, so /clear isn't appended to it and submitted.
+            await tmux.sendKeysToPane(paneId, 'C-c');
+            await this.waitForReplPromptReady(tmux, paneId, runtime, this.clearContextWaitMs);
+            await tmux.sendKeysLiteral(paneId, '/clear');
+            // Snapshot the composer holding the typed /clear; require submission proof so a swallowed Enter
+            // (which would leave /clear idle in the composer and let waitForReplPromptReady pass on the stale
+            // frame) is resent rather than treated as cleared.
+            const beforeSubmit = await tmux.capturePaneSnapshot(paneId);
+            await tmux.sendEnter(paneId);
+            await tmux.waitSubmitAck(paneId, beforeSubmit, runtime, {
+                timeoutMs: this.clearContextWaitMs,
+                acceptComposerChange: true,
+                resend: () => tmux.sendEnter(paneId),
+                resendIntervalMs: this.compactIdlePollMs,
+            });
+            await this.waitForReplPromptReady(tmux, paneId, runtime, this.clearContextWaitMs);
+            // Positively confirm the composer is empty: a ready anchor alone can sit above a composer that still
+            // holds the typed /clear (e.g. acceptComposerChange returned on an unrelated redraw). If /clear is
+            // still parked there, it was never submitted — treat as unconfirmed so the caller holds the pane.
+            const afterClear = await tmux.capturePaneById(paneId, { ansi: false, scrollback: 0 });
+            if (CLEAR_PENDING_IN_COMPOSER_RE.test(afterClear)) {
+                console.warn(`[AgentManager] clearPaneContext: /clear still in composer for ${cfg.id}; unconfirmed`);
+                return false;
+            }
+            return true;
+        }
+        catch (err) {
+            console.warn(`[AgentManager] clearPaneContext: /clear failed for ${cfg.id}:`, err);
+            return false;
+        }
+        finally {
+            this.compactInFlight.delete(cfg.id);
+        }
+    }
     async failTaskForDispatchError(taskId, phase, agentId, err) {
         const expected = PHASE_EXPECTED_STATUS[phase] ?? [];
         const transitioned = await this.transitionTaskStatus(taskId, 'failed', { fromStatus: expected.length > 0 ? expected : ['in_progress', 'review', 'fixing', 'approved', 'merge-ready'] });
@@ -1747,7 +2010,7 @@ export class AgentManager {
             return cleared;
         });
     }
-    // manual-merge skips snapshot — a stale scrollback signal would re-fire every restart.
+    // Recovery snapshot replay is safe because the completion token is cleared after merge-ready.
     async setupRecoveredPostApproveSignals() {
         if (!this.phaseSignalWatcher)
             return;
@@ -1756,8 +2019,6 @@ export class AgentManager {
             const completion = await this.postApproveStore.get(task.id);
             if (!completion)
                 continue;
-            const project = this.getProjectConfig(task.projectId);
-            const skipSnapshot = project?.merge !== 'auto';
             try {
                 await this.phaseSignalWatcher.start({
                     taskId: task.id,
@@ -1765,7 +2026,7 @@ export class AgentManager {
                     agentId: task.agentId,
                     expectedKinds: 'pr-merge-ready',
                     token: completion.token,
-                    skipSnapshot,
+                    skipSnapshot: false,
                     recovered: true,
                 });
             }
@@ -2316,11 +2577,26 @@ export class AgentManager {
             if (!fresh || TERMINAL_STATUSES.includes(fresh.status)) {
                 const cfg = this.getAgentConfig(agentId);
                 const state = await this.agentStore.get(agentId);
-                if (cfg && state && state.taskId === taskId && !(await this.interruptPaneAndWaitReady(state, cfg))) {
-                    await this.markAwaitingHuman(agentId, 'cancel-interrupt-failed', 'Task was cancelled during startup but C-c / REPL ready check failed; the agent may still be ' +
-                        'running the cancelled prompt. Attach via web terminal to verify, then Resume or Delete.', { expectedTaskId: taskId });
+                if (cfg && state && state.taskId === taskId) {
+                    // Persist the un-cleared hold before the ESC→/clear window so a restart mid-cleanup recovers it
+                    // held instead of releasing the still-dirty pane (mirrors cancelTask).
+                    await this.markPaneCancelClearing(agentId, taskId);
+                    if (!(await this.interruptPaneAndWaitReady(state, cfg))) {
+                        await this.markAwaitingHuman(agentId, 'cancel-interrupt-failed', 'Task was cancelled during startup but ESC / REPL ready check failed; the agent may still be ' +
+                            'running the cancelled prompt. Attach via web terminal to verify, then Resume or Delete.', { expectedTaskId: taskId });
+                        return null;
+                    }
+                    if (!(await this.clearPaneContext(state, cfg))) {
+                        await this.markAwaitingHuman(agentId, 'cancel-clear-failed', 'Task was cancelled during startup and the session interrupted, but /clear was not confirmed; ' +
+                            'the pane holds un-cleared context. DELETE the agent to discard it (Resume will not reuse an un-cleared pane).', { expectedTaskId: taskId });
+                        return null;
+                    }
+                    // /clear confirmed → cancel cleanup is done; free the cancel-clearing hold (only path allowed to).
+                    await this.releaseAgentForTask(agentId, taskId, 'idle', { allowAwaitingHuman: true, fromCancelCleanup: true });
                     return null;
                 }
+                // No live pane to clean (agent gone / rebound): release without the cancel-cleanup bypass — if it
+                // somehow holds an un-cleared phase, refusing here keeps the dirty pane for the owning cancel.
                 await this.releaseAgentForTask(agentId, taskId, 'idle', { allowAwaitingHuman: true });
                 return null;
             }
@@ -3320,7 +3596,11 @@ export class AgentManager {
                         console.warn(`[recover] dispatchPostMergeCleanup(${state.id}, ${boundTask.id}) failed:`, cleanupErr);
                     }
                 }
-                const shouldReleaseBinding = shouldReleaseHeldBinding(state, boundTask);
+                // A cancel-cleanup hold must NOT be auto-released on restart (it would reuse the cancelled,
+                // un-cleared/maybe-running pane). cancel-interrupt-failed has shouldReleaseHeldBinding=true (it's
+                // operator-Resume recoverable), so exclude the whole cancel-cleanup set here explicitly.
+                const cancelHold = state.awaitingPhase != null && CANCEL_CLEANUP_HOLD_PHASES.has(state.awaitingPhase);
+                const shouldReleaseBinding = shouldReleaseHeldBinding(state, boundTask) && !cancelHold;
                 // 释放 binding 时同步清 worktree（与 resumeAgent 一致）——否则跨重启恢复后
                 // worktreePath 在下面 update 中被丢弃，磁盘上的 worktree 永远无人回收。
                 if (shouldReleaseBinding && state.worktreePath) {
@@ -3378,7 +3658,9 @@ export class AgentManager {
                 if (shouldReleaseBinding) {
                     await this.lockManager.release(state.id);
                 }
-                if (state.taskId && !shouldReleaseBinding) {
+                // Skip the menu-watch for cancel-cleanup holds: they await operator Resume/DELETE, and their taskId
+                // won't clear on its own, so the watcher would poll forever.
+                if (state.taskId && !shouldReleaseBinding && !cancelHold) {
                     this.startRuntimeMenuWatch(state.id);
                 }
             }
@@ -3573,6 +3855,13 @@ export class AgentManager {
                     mayBeInFlight: false,
                 };
             }
+            // Mark the panes cancel-clearing BEFORE flipping the task terminal (still under the lock), so any
+            // window — a concurrent escape, or a restart — sees a persisted hold instead of a plain binding to a
+            // terminal task that recover()/the escape would release with the session still un-cleared.
+            for (const id of [devToRelease, qaToRelease]) {
+                if (id)
+                    await this.markPaneCancelClearing(id, taskId);
+            }
             const now = new Date().toISOString();
             task.status = 'cancelled';
             task.updatedAt = now;
@@ -3594,31 +3883,46 @@ export class AgentManager {
         // (config hot-removed: the pane outlives the config; state gone; rebound)
         // leave an in-flight publish possible.
         let devStopConfirmed = false;
+        // Phase 1 — interrupt every still-bound pane first, so a slow /clear on one agent can't keep another
+        // running the cancelled task. The persisted cancel-clearing hold (set under the lock) blocks any
+        // concurrent escape from releasing these panes until they are /cleared.
+        const stopped = [];
         for (const id of [devToRelease, qaToRelease]) {
             if (!id)
                 continue;
             const cfg = this.getAgentConfig(id);
             const state = await this.agentStore.get(id);
-            if (!cfg || !state)
-                continue;
-            // 重校验绑定：lock 释放后另一路 release+acquire 可能已把 agent 绑给新任务，
-            // 此时不能 C-c 打到新会话上、也不能继续 idle release。
-            if (state.taskId !== taskId) {
-                console.warn(`[AgentManager] cancelTask: ${id} no longer bound to ${taskId} (got ${state.taskId}); skipping`);
+            if (!cfg || !state || state.taskId !== taskId) {
+                console.warn(`[AgentManager] cancelTask: ${id} no longer bound to ${taskId} (got ${state?.taskId}); skipping`);
                 continue;
             }
-            const ok = await this.interruptPaneAndWaitReady(state, cfg);
-            if (!ok) {
-                await this.markAwaitingHuman(id, 'cancel-interrupt-failed', 'Task marked cancelled but C-c / REPL ready check failed; agent may still be running. Attach via web terminal to verify, then Resume or Delete.');
+            if (!(await this.interruptPaneAndWaitReady(state, cfg))) {
+                await this.markAwaitingHuman(id, 'cancel-interrupt-failed', 'Task marked cancelled but ESC / REPL ready check failed; agent may still be running the cancelled prompt. Attach via web terminal to verify, then Resume or Delete.', { expectedTaskId: taskId });
                 continue;
             }
+            // devStopConfirmed reflects only "the pane stopped" — set before /clear so published-artifact
+            // retirement still proceeds even when /clear can't be confirmed.
             if (id === publishedCleanup?.devAgentId)
                 devStopConfirmed = true;
+            stopped.push(id);
+        }
+        // Phase 2 — every pane is stopped; /clear + release each.
+        for (const id of stopped) {
+            const cfg = this.getAgentConfig(id);
+            const state = await this.agentStore.get(id);
+            if (!cfg || !state || state.taskId !== taskId) {
+                console.warn(`[AgentManager] cancelTask: ${id} rebound before /clear (got ${state?.taskId}); skipping`);
+                continue;
+            }
+            if (!(await this.clearPaneContext(state, cfg))) {
+                // /clear unconfirmed → hold; the un-cleared pane stays bound (UNCLEARED_PANE_PHASES) until DELETE.
+                await this.markAwaitingHuman(id, 'cancel-clear-failed', 'Task marked cancelled and the session interrupted, but /clear was not confirmed; the pane holds un-cleared context. DELETE the agent to discard it (Resume will not reuse an un-cleared pane).', { expectedTaskId: taskId });
+                continue;
+            }
             try {
-                // allowAwaitingHuman: cancelTask 是显式回收入口，agent 之前可能因 ack_unknown 等被标 Held，
-                // 用户主动 Cancel 应允许跨过 awaiting_human gate 清理 binding；release 默认 gate 是为了
-                // 拦住非显式路径（如 generic catch）的意外清理，cancelTask 不属于那类。
-                await this.releaseAgentForTask(id, taskId, 'idle', { allowAwaitingHuman: true });
+                // fromCancelCleanup: this IS the owning cancel, having confirmed /clear — the only release allowed
+                // to free the cancel-clearing hold. allowAwaitingHuman: cross the awaiting_human gate too.
+                await this.releaseAgentForTask(id, taskId, 'idle', { allowAwaitingHuman: true, fromCancelCleanup: true });
             }
             catch (err) {
                 console.error(`[AgentManager] cancelTask releaseAgentForTask(${id}) failed:`, err);
@@ -4623,10 +4927,10 @@ export class AgentManager {
                 await this.waitForReplPromptReady(tmux, paneId, runtime, this.compactIdleWaitMs);
                 if (!await bindingStillOurs())
                     return;
-                await tmux.sendKeysLiteral(paneId, cleanSlate ? '/clear' : '/compact');
-                await tmux.sendEnter(paneId);
-                await new Promise(r => setTimeout(r, this.compactIdlePollMs));
-                await this.waitForReplPromptReady(tmux, paneId, runtime, this.compactIdleWaitMs);
+                const command = cleanSlate ? '/clear' : '/compact';
+                if (!await this.sendPostMergeSlashCommand(tmux, paneId, agentId, runtime, command, bindingStillOurs)) {
+                    return;
+                }
                 break;
             }
             catch (err) {
@@ -4636,6 +4940,34 @@ export class AgentManager {
         }
         await this.releasePostMergeAgent(agentId, originalTaskId);
     }
+    async sendPostMergeSlashCommand(tmux, paneId, agentId, runtime, command, bindingStillOurs) {
+        let rejection;
+        for (let attempt = 1; attempt <= 2; attempt++) {
+            await tmux.sendKeysLiteral(paneId, command);
+            await tmux.sendEnter(paneId);
+            await new Promise(r => setTimeout(r, this.compactIdlePollMs));
+            await this.waitForReplPromptReady(tmux, paneId, runtime, this.compactIdleWaitMs);
+            if (!await bindingStillOurs())
+                return false;
+            if (!await this.hasRuntimeSlashCommandRejection(tmux, paneId, command))
+                return true;
+            rejection = new Error(`runtime rejected ${command} because a task is still in progress`);
+            if (attempt < 2) {
+                console.warn(`[AgentManager] runPostMergeCompaction(${agentId}) ${command} rejected; retrying`);
+                await new Promise(r => setTimeout(r, this.compactIdlePollMs));
+                if (!await bindingStillOurs())
+                    return false;
+            }
+        }
+        throw rejection ?? new Error(`runtime rejected ${command}`);
+    }
+    async hasRuntimeSlashCommandRejection(tmux, paneId, command) {
+        const cap = await tmux.capturePaneById(paneId, { ansi: false, scrollback: 0 });
+        return this.runtimeSlashCommandRejectedPattern(command).test(cap);
+    }
+    runtimeSlashCommandRejectedPattern(command) {
+        return new RegExp(`["'“”‘’]?${command}["'“”‘’]?\\s+is disabled while a task is in progress\\.`, 'gi');
+    }
     // pane_current_command 是 runtime 是否仍活的权威信号（不被 viewport stale frame 骗）。
     // anchor 在 codex busy 屏（`Working on it…\n  esc to interrupt`）不存在，所以 busy 状态只看
     // procTitle；只有准备返回 idle 时才用 anchor 作双重证据，挡 stale-frame + shell 误报。