claude-code-kanban 5.2.0 → 5.4.0

package/server.js

@@ -9,7 +9,7 @@ const _readline = require('node:readline');
 const chokidar = require('chokidar');
 const os = require('node:os');
 const crypto = require('node:crypto');
-const { spawnSync, spawn } = require('node:child_process');
+const { spawn } = require('node:child_process');
 const { assertOpenTarget, openInEditor, whichSync, exeBehindShim } = require('./lib/open-editor');
 const { createNetGuard } = require('./lib/net-guard');
 const { isContained } = require('./lib/contain');
@@ -35,26 +35,30 @@ const {
   readToolResultImage,
   readCachedImage,
   updateLoopInfo,
-  buildLoopInfoFromState
+  buildLoopInfoFromState,
+  readLines
 } = require('./lib/parsers');
 const { inlineHtmlAssets, MIME_BY_EXT } = require('./lib/inline-assets');
 const { buildDecision, decisionFileName, isDecisionFile, approvalsFrom, boardRefusal } = require('./lib/approvals');
-const { getClaudeDir, getArgValue, storageNamespace, isDefaultClaudeDir } = require('./lib/claude-dir');
+const { getClaudeDir, getArgValue, storageNamespace, isDefaultClaudeDir, encodeProjectDirName } = require('./lib/claude-dir');
 const { createTerminalService, readTerminalConfig } = require('./lib/terminal');
+const { createProcStats } = require('./lib/proc-stats');
 const { createDispatchRegistry, formatPreamble, formatDispatchLine, isPeerName, DISPATCH_OUTCOME } = require('./lib/dispatch');
 const { createGroupStore, isGroupName, suggestGroupName } = require('./lib/dispatch-groups');
-const { createDispatchedStore, listTranscriptIds, pruneSessionDirs, retentionMs } = require('./lib/retention');
+const { createDispatchedStore, scanTranscripts, pruneSessionDirs, retentionMs } = require('./lib/retention');
+const { createWorktreeStore } = require('./lib/worktrees');
+const { readGitBranch } = require('./lib/git-branch');
 const { createLinkedDocStore, linkUrl } = require('./lib/linked-docs');
 const { pickFolder } = require('./lib/folder-dialog');
 const { loadSessionCache, saveSessionCache } = require('./lib/session-cache');
 const { countTaskDir } = require('./lib/task-counts');
-const { projectMatcher } = require('./public/project-match');
+const { projectMatcher, normalizeProjectPath } = require('./public/project-match');
 const { getParentVerdict, setParentVerdict } = require('./lib/parent-cache');
 
 if (process.argv.includes("--install") || process.argv.includes("--uninstall")) {
   const { runInstall, runUninstall } = require("./install");
-  const pluginOnly = process.argv.includes("--plugin-only");
-  (process.argv.includes("--install") ? runInstall({ pluginOnly }) : runUninstall())
+  const yes = process.argv.includes("--yes");
+  (process.argv.includes("--install") ? runInstall({ yes }) : runUninstall())
     .then(() => process.exit(0))
     .catch(e => { console.error(e.message); process.exit(1); });
 } else if (!require("./cli").runCli(process.argv)) {
@@ -69,7 +73,8 @@ const PORT = parseInt(getArgValue('port') || process.env.PORT || '3541', 10);
 
 // Mounted before express.json() so a rejected request never buffers a body, and
 // before the /api catch-all so no route escapes the check.
-const net = createNetGuard({ appName: 'Claude Task Kanban' });
+// The board frames the terminal from its other loopback name, so Chrome runs it in its own process.
+const net = createNetGuard({ appName: 'Claude Task Kanban', selfFramedPaths: ['/terminal.html'] });
 app.use(net.hostGuard);
 app.use(net.frameGuard);
 app.use(net.originGuard);
@@ -93,6 +98,7 @@ const CONTEXT_STATUS_DIR = path.join(CCK_DIR, 'context-status');
 const PINS_FILE = path.join(CCK_DIR, 'pins.json');
 const DISPATCH_GROUPS_FILE = path.join(CCK_DIR, 'dispatch-groups.json');
 const DISPATCHED_FILE = path.join(CCK_DIR, 'dispatched.json');
+const WORKTREES_FILE = path.join(CCK_DIR, 'worktrees.json');
 const LINKED_DOCS_FILE = path.join(CCK_DIR, 'linked-docs.json');
 const SERVER_INFO_FILE = path.join(CCK_DIR, 'server.json');
 const TERMINAL_TOKENS_DIR = path.join(CCK_DIR, 'terminal-tokens');
@@ -132,7 +138,7 @@ function writePins(pins) {
   writeJsonAtomic(PINS_FILE, pins);
 }
 
-// Port discovery for out-of-process helpers (the postman monitor, approval-gate.sh).
+// Port discovery for out-of-process helpers (the postman monitor, the CLI).
 // The pid rides along so a reader can tell a live server from a file left behind by
 // a crashed one.
 function writeServerInfo(port) {
@@ -161,8 +167,8 @@ function ownerPid(file) {
   try { return JSON.parse(readFileSync(file, 'utf8')).pid ?? null; } catch (_) { return null; }
 }
 
-// A beacon that outlives its server disarms UI approvals silently: approval-gate.sh
-// probes the port, finds it closed and never waits. The hub spawns every sub-app on
+// A beacon that outlives its server sends the postman monitor and the CLI to a closed
+// port. The hub spawns every sub-app on
 // an ephemeral port, so a stale beacon never comes back on its own — drop ours on
 // the way out. Only when the file is still ours: a newer server on the same config
 // dir has already claimed it. The terminal token file goes the same way.
@@ -267,7 +273,10 @@ function checkWaitingForUser(agentDir, logMtime) {
       const age = Date.now() - waitTime;
       if (age >= PERMISSION_TTL_MS) return null;
       // After grace period, check if session resumed activity (user already responded)
-      if (logMtime && age >= WAITING_RESOLVE_GRACE_MS && logMtime > waitTime + WAITING_RESOLVE_GRACE_MS) return null;
+      if (movedOnSince(waitTime, logMtime)) return null;
+      // The mod sees the ask before auto mode's classifier decides it, and no dialog may follow.
+      // An ask from a settings rule always opens the dialog.
+      if (data.kind === 'permission' && !data.rule && loadSessionMetadata()[path.basename(agentDir)]?.permissionMode === 'auto') return null;
       // Opted out reads the same as lapsed to the board: the ask is only
       // answerable in the terminal, so no buttons.
       if (boardRefusal(data, approvalsConfig())) return { ...data, lapsed: true };
@@ -309,7 +318,7 @@ function isAgentLive(agent) {
 // Claude Code records gitBranch from the launch-time repo and never updates it
 // when cwd shifts (Bash `cd`, submodule, sibling repo). Resolve on-demand from
 // the live cwd instead. Cached per-cwd with a short TTL so a list refresh
-// across N sessions sharing one cwd spawns git at most once per TTL window.
+// across N sessions sharing one cwd reads HEAD at most once per TTL window.
 const gitBranchCache = new Map();
 const GIT_BRANCH_TTL_MS = 30000;
 const GIT_BRANCH_CACHE_MAX = 500;
@@ -318,18 +327,7 @@ function getGitBranch(cwd) {
   const now = Date.now();
   const cached = gitBranchCache.get(cwd);
   if (cached && now - cached.ts < GIT_BRANCH_TTL_MS) return cached.branch;
-  let branch = null;
-  try {
-    // cwd rather than `-C <cwd>`: a path beginning with a dash would otherwise be
-    // read by git as an option.
-    const r = spawnSync('git', ['rev-parse', '--abbrev-ref', 'HEAD'], {
-      cwd, encoding: 'utf8', timeout: 500, windowsHide: true
-    });
-    if (r.status === 0) {
-      const out = (r.stdout || '').trim();
-      if (out && out !== 'HEAD') branch = out;
-    }
-  } catch (_) {}
+  const branch = readGitBranch(cwd);
   gitBranchCache.set(cwd, { branch, ts: now });
   if (gitBranchCache.size > GIT_BRANCH_CACHE_MAX) {
     const firstKey = gitBranchCache.keys().next().value;
@@ -338,36 +336,15 @@ function getGitBranch(cwd) {
   return branch;
 }
 
-// A linked worktree's `.git` is a file holding `gitdir: <main>/.git/worktrees/<name>`, so the
-// main checkout is readable without spawning git. Path shape alone would not do: only some
-// worktrees live under `<repo>/.claude/worktrees/`, the rest sit beside the repo.
-// Cached without a TTL, misses included: a directory cannot turn from an ordinary checkout into
-// a linked worktree without being recreated, and a recreated path is a new cache key.
-const worktreeCache = new Map();
-const WORKTREE_CACHE_MAX = 500;
-const GITDIR_WORKTREE_RE = /^gitdir:\s*(.*)[/\\]\.git[/\\]worktrees[/\\]([^/\\]+)[/\\]?$/;
-
-function resolveWorktree(dir) {
-  if (!dir) return null;
-  if (worktreeCache.has(dir)) return worktreeCache.get(dir);
-
-  let worktree = null;
-  try {
-    // An ordinary checkout's `.git` is a directory, so the read throws EISDIR — that is the
-    // answer, and it costs one syscall instead of a stat followed by a read.
-    const m = GITDIR_WORKTREE_RE.exec(readFileSync(path.join(dir, '.git'), 'utf8').trim());
-    if (m) worktree = { repo: m[1], name: m[2] };
-  } catch (_) {}
-
-  worktreeCache.set(dir, worktree);
-  if (worktreeCache.size > WORKTREE_CACHE_MAX) {
-    worktreeCache.delete(worktreeCache.keys().next().value);
-  }
-  return worktree;
-}
+const worktrees = createWorktreeStore({
+  load: () => {
+    try { return JSON.parse(readFileSync(WORKTREES_FILE, 'utf8')); } catch { return null; }
+  },
+  save: (data) => writeJsonAtomic(WORKTREES_FILE, data),
+});
 
-// Only spawn git when cwd has diverged from the launch project — that's the
-// only case the JSONL value is wrong. Saves N spawns on a typical list build.
+// Only look up the branch when cwd has diverged from the launch project — that's
+// the only case the JSONL value is wrong.
 function resolveSessionGitBranch(meta) {
   if (meta.cwd && meta.project && meta.cwd !== meta.project) {
     return getGitBranch(meta.cwd) || meta.gitBranch || null;
@@ -383,13 +360,25 @@ function getSessionLogStat(meta) {
   } catch { return { mtime: null, hasMessages: false }; }
 }
 
+// A transcript write past the grace window after a marker means the session went on.
+function movedOnSince(markerMs, logMtime) {
+  return !!logMtime && logMtime > markerMs + WAITING_RESOLVE_GRACE_MS;
+}
+
+// The mod cannot delete _stop.json when the session works again.
+function resumedSince(markerPath, logMtime) {
+  if (!logMtime) return false;
+  try { return movedOnSince(statSync(markerPath).mtimeMs, logMtime); }
+  catch { return true; }
+}
+
 function checkAgentStatus(agentDir, stale, logMtime, isTeam) {
   const result = { hasActive: false, hasRunning: false, waitingForUser: null, unread: false };
   let names;
   try { names = readdirSync(agentDir); } catch { return result; }
   if (names.includes('_waiting.json')) result.waitingForUser = checkWaitingForUser(agentDir, logMtime);
   if (result.waitingForUser) result.hasActive = true;
-  const stopped = names.includes('_stop.json');
+  const stopped = names.includes('_stop.json') && !resumedSince(path.join(agentDir, '_stop.json'), logMtime);
   if (stale && !isTeam) {
     result.unread = stopped;
     return result;
@@ -791,33 +780,46 @@ function taskDirBeats(candMtime, candCount, curMtime, curCount) {
   return candMtime > curMtime || (candMtime === curMtime && candCount > curCount);
 }
 
+// A promise from loadFn is cached as is, so concurrent callers share one read, and a newer
+// mtime starts no second read while it is pending: full-transcript scans stream for seconds.
 function cachedByMtime(cache, cacheKey, filePath, loadFn, fallback) {
   try {
     const cached = cache.get(cacheKey);
-    if (cached && Date.now() - cached.ts < MESSAGE_CACHE_TTL) return cached.data;
+    if (cached && (cached.pending || Date.now() - cached.ts < MESSAGE_CACHE_TTL)) return cached.data;
     const st = statSync(filePath);
     if (cached && cached.mtime === st.mtimeMs) {
       cached.ts = Date.now();
       return cached.data;
     }
-    const data = loadFn();
-    cache.set(cacheKey, { data, mtime: st.mtimeMs, ts: Date.now() });
+    const entry = { data: loadFn(), mtime: st.mtimeMs, ts: Date.now() };
+    if (typeof entry.data?.then === 'function') {
+      entry.pending = true;
+      entry.data = entry.data.catch(() => {
+        if (cache.get(cacheKey) === entry) cache.delete(cacheKey);
+        return fallback;
+      }).finally(() => {
+        entry.pending = false;
+        entry.ts = Date.now();
+      });
+    }
+    cache.set(cacheKey, entry);
     evictStaleCache(cache);
-    return data;
+    return entry.data;
   } catch (_) { return fallback; }
 }
 
+// Express 4 does not pass a rejected handler promise to next(), and Node 24 exits on it.
+function asyncRoute(fn) {
+  return (req, res, next) => fn(req, res, next).catch(next);
+}
+
 const sessionDigestCache = new Map();
 function getSessionDigest(jsonlPath) {
   return cachedByMtime(sessionDigestCache, jsonlPath, jsonlPath, () => buildSessionDigest(jsonlPath), { progressMap: {}, terminated: new Map() });
 }
 
-function getProgressMap(jsonlPath) {
-  return getSessionDigest(jsonlPath).progressMap;
-}
-
-function getTerminatedTeammates(jsonlPath) {
-  return getSessionDigest(jsonlPath).terminated;
+async function getProgressMap(jsonlPath) {
+  return (await getSessionDigest(jsonlPath)).progressMap;
 }
 
 function readRecentMessages(jsonlPath, limit = 10) {
@@ -853,6 +855,7 @@ function refreshSessionMetadataPath(jsonlPath) {
   if (info.customTitle) existing.customTitle = info.customTitle;
   if (info.logicalParentUuid) existing.logicalParentUuid = info.logicalParentUuid;
   if (info.compactBoundaryUuid) existing.compactBoundaryUuid = info.compactBoundaryUuid;
+  existing.permissionMode = info.permissionMode;
   return true;
 }
 
@@ -939,7 +942,8 @@ function loadSessionMetadata() {
           customTitle: sessionInfo.customTitle || null,
           jsonlPath: jsonlPath,
           logicalParentUuid: sessionInfo.logicalParentUuid || null,
-          compactBoundaryUuid: sessionInfo.compactBoundaryUuid || null
+          compactBoundaryUuid: sessionInfo.compactBoundaryUuid || null,
+          permissionMode: sessionInfo.permissionMode
         };
         sessionIds.push(sessionId);
       }
@@ -1140,12 +1144,6 @@ function getSessionDisplayName(_sessionId, meta) {
   return null;
 }
 
-// The harness spells a project path into a temp/log dir name by replacing every
-// non-alphanumeric character with a dash, drive colon and separators included.
-function encodeProjectDirName(p) {
-  return p.replace(/[^a-zA-Z0-9]/g, '-');
-}
-
 // Derived by convention, not looked up: the harness creates the dir lazily, so a
 // stat here would report "missing" for every session that has not written a temp
 // file yet — and it would put IO on the session-list hot path. Pure string join.
@@ -1160,7 +1158,7 @@ function getScratchpadDir(id, meta) {
   // harness actually created. Probed only for worktree sessions, and only until one
   // of them exists — before that there is nothing to disambiguate and `byProject`,
   // right for a session started inside the worktree, stands.
-  const wt = resolveWorktree(meta.project);
+  const wt = worktrees.resolve(meta.project);
   if (!wt || existsSync(byProject)) return byProject;
   const byRepo = path.join(SCRATCHPAD_ROOT, encodeProjectDirName(wt.repo), id, 'scratchpad');
   return existsSync(byRepo) ? byRepo : byProject;
@@ -1179,7 +1177,7 @@ function buildSessionObject(id, meta, overrides = {}) {
     cwd: meta.cwd || null,
     description: meta.description || null,
     gitBranch: resolveSessionGitBranch(meta),
-    worktree: resolveWorktree(meta.project),
+    worktree: worktrees.resolve(meta.project),
     customTitle: meta.customTitle || null,
     taskCount: 0,
     completed: 0,
@@ -1578,7 +1576,7 @@ app.get('/api/sessions', async (req, res) => {
     // if the row is missing — that one is not a preference.
     if (projectFilter) {
       const matches = projectMatcher(String(projectFilter));
-      sessions = sessions.filter(s => matches(s.project) || includeIds.has(s.id));
+      sessions = sessions.filter(s => matches(s.project, s.worktree?.repo) || includeIds.has(s.id));
     }
     // The sidebar's 24h filter: projects with any transcript written in the window, so an older
     // session of such a project stays in.
@@ -1650,14 +1648,30 @@ function projectActivity() {
   return activity;
 }
 
-// API: Get distinct project paths with last-modified timestamps
+// API: Get distinct project paths with last-modified timestamps. A linked worktree is folded
+// into its repo, which lists it under `worktrees`; the repo row exists even when only its
+// worktrees have transcripts.
 app.get('/api/projects', (_req, res) => {
   res.setHeader('Cache-Control', 'no-store');
-  const projects = [...projectActivity()]
-    .map(([path, mtime]) => ({
-      path,
-      modifiedAt: mtime ? new Date(mtime).toISOString() : null,
-      ...(isTempPath(path) && { temp: true }),
+  const byRepo = new Map();
+  for (const [project, mtime] of projectActivity()) {
+    const repo = worktrees.resolve(project)?.repo || project;
+    const key = normalizeProjectPath(repo);
+    let row = byRepo.get(key);
+    if (!row) {
+      row = { path: repo, mtime: 0, worktrees: [] };
+      byRepo.set(key, row);
+    }
+    if (repo === project) row.path = project;
+    else row.worktrees.push(project);
+    row.mtime = Math.max(row.mtime, mtime || 0);
+  }
+  const projects = [...byRepo.values()]
+    .map((r) => ({
+      path: r.path,
+      modifiedAt: r.mtime ? new Date(r.mtime).toISOString() : null,
+      ...(isTempPath(r.path) && { temp: true }),
+      ...(r.worktrees.length && { worktrees: r.worktrees.sort() }),
     }))
     .sort((a, b) => a.path.localeCompare(b.path));
   res.json(projects);
@@ -1782,15 +1796,20 @@ app.get('/api/sessions/:sessionId/loop', (req, res) => {
 
 // Memo for a cold read keyed on the file's identity, so a repeat ask costs the one stat
 // it already pays to notice the file grew. `load` may return a promise: the promise is
-// what gets cached, so concurrent callers share a single read. Null when the file is gone.
+// what gets cached, so concurrent callers share a single read, and a file that grows while
+// it is pending starts no second one. Null when the file is gone.
 function cachedByFileStat(cache, filePath, load) {
   let stat;
   try { stat = statSync(filePath); } catch (_) { return null; }
   const hit = cache.get(filePath);
-  if (hit && hit.mtimeMs === stat.mtimeMs && hit.size === stat.size) return hit.value;
-  const value = load();
-  cache.set(filePath, { mtimeMs: stat.mtimeMs, size: stat.size, value });
-  return value;
+  if (hit && (hit.pending || (hit.mtimeMs === stat.mtimeMs && hit.size === stat.size))) return hit.value;
+  const entry = { mtimeMs: stat.mtimeMs, size: stat.size, value: load() };
+  if (typeof entry.value?.then === 'function') {
+    entry.pending = true;
+    entry.value.finally(() => { entry.pending = false; }).catch(() => {});
+  }
+  cache.set(filePath, entry);
+  return entry.value;
 }
 
 // Cold path — a full transcript scan, so the result is held until the file grows.
@@ -1801,12 +1820,12 @@ function getArtifactLinks(jsonlPath) {
   return cachedByFileStat(artifactsByPath, jsonlPath, () => readArtifactLinks(jsonlPath)) || [];
 }
 
-app.get('/api/sessions/:sessionId/artifacts', (req, res) => {
+app.get('/api/sessions/:sessionId/artifacts', async (req, res) => {
   try {
     const metadata = loadSessionMetadata();
     const meta = metadata[req.params.sessionId] || metadata[resolveSessionId(req.params.sessionId)];
     if (!meta?.jsonlPath) return res.json({ artifacts: [] });
-    res.json({ artifacts: getArtifactLinks(meta.jsonlPath) });
+    res.json({ artifacts: await getArtifactLinks(meta.jsonlPath) });
   } catch (error) {
     console.error('Error reading artifacts:', error);
     res.status(500).json({ error: 'Failed to read artifacts' });
@@ -1851,7 +1870,7 @@ async function findPads(root, depth = 0) {
 // stored, so re-reading a transcript cannot drift; the client links each pad once
 // and records that it did, which is what stops a re-read undoing an unlink.
 async function readCreatedPads(meta) {
-  const creations = readScratchpadCreations(meta.jsonlPath);
+  const creations = await readScratchpadCreations(meta.jsonlPath);
   // No `scratch new` in the transcript means no disk work at all, so sessions that
   // never touch the CLI pay a substring pass over the transcript and nothing more.
   if (!creations.length) return [];
@@ -2129,7 +2148,7 @@ app.get('/api/sessions/:sessionId/workflows/:wfId/run', async (req, res) => {
       try { files = readdirSync(runDir).filter((f) => /^agent-.+\.jsonl$/.test(f)); } catch (_) {}
       for (const f of files) {
         const agentId = f.slice('agent-'.length, -'.jsonl'.length);
-        const stats = extractTranscriptStats(path.join(runDir, f)) || {};
+        const stats = (await extractTranscriptStats(path.join(runDir, f))) || {};
         let type = null;
         try {
           type = JSON.parse(readFileSync(path.join(runDir, `agent-${agentId}.meta.json`), 'utf8')).agentType || null;
@@ -2364,9 +2383,9 @@ app.get('/api/teams/:name', (req, res) => {
 // API: Get agents for a session
 // The resultUnavailable latch is persisted on the agent record. Bump this when
 // extractAgentResultFromTranscript finds more, so agents latched earlier rescan once.
-const RESULT_SCAN = 2;
+const RESULT_SCAN = 3;
 
-app.get('/api/sessions/:sessionId/agents', (req, res) => {
+app.get('/api/sessions/:sessionId/agents', async (req, res) => {
   const sessionId = resolveSessionId(req.params.sessionId);
   const agentDir = path.join(AGENT_ACTIVITY_DIR, sessionId);
   if (!existsSync(agentDir)) return res.json({ agents: [], waitingForUser: null });
@@ -2410,10 +2429,11 @@ app.get('/api/sessions/:sessionId/agents', (req, res) => {
         agents.push(agent);
       } catch { /* skip invalid */ }
     }
+    const digest = meta.jsonlPath ? await getSessionDigest(meta.jsonlPath) : null;
     const liveAgents = agents.filter(isAgentLive);
     if (liveAgents.length && meta.jsonlPath) {
       try {
-        const terminated = getTerminatedTeammates(meta.jsonlPath);
+        const { terminated } = digest;
         if (terminated.size) {
           for (const agent of liveAgents) {
             const agentName = agentDisplayName(agent);
@@ -2430,10 +2450,9 @@ app.get('/api/sessions/:sessionId/agents', (req, res) => {
       // Mark agents whose spawning Agent tool_use was rejected by the user as stopped:
       // the parent will never read their output, so they're orphans. Match by agentId
       // when the digest already correlated tool_use→agent, else fall back to prompt text
-      // (the agent-spy hook doesn't record the spawning tool_use_id).
+      // (the plugin's mod doesn't record the spawning tool_use_id).
       try {
-        const { rejectedAgentIds = new Set(), rejectedPrompts = new Set(), killedAgentIds = new Set() } =
-          getSessionDigest(meta.jsonlPath);
+        const { rejectedAgentIds = new Set(), rejectedPrompts = new Set(), killedAgentIds = new Set() } = digest;
         if (rejectedAgentIds.size || rejectedPrompts.size || killedAgentIds.size) {
           for (const agent of liveAgents) {
             if (!isAgentLive(agent)) continue;
@@ -2464,8 +2483,7 @@ app.get('/api/sessions/:sessionId/agents', (req, res) => {
     const byAgentId = {};
     if (meta.jsonlPath) {
       try {
-        const progressMap = getProgressMap(meta.jsonlPath);
-        for (const entry of Object.values(progressMap)) {
+        for (const entry of Object.values(digest.progressMap)) {
           byAgentId[entry.agentId] ||= {};
           const e = byAgentId[entry.agentId];
           for (const f of ['prompt', 'name', 'description', 'usage']) {
@@ -2622,10 +2640,10 @@ app.post('/api/sessions/:sessionId/read', (req, res) => {
   }
 });
 
-// UI-driven approvals: answers the ask approval-gate.sh is blocking on by
-// writing _decision-<id>.json next to the marker. The hook consumes and deletes
-// both files; a write for a hook that already gave up is accepted anyway (D13)
-// and left for cleanupAgentActivity's sweep.
+// UI-driven approvals: answers the ask the plugin's mod is polling for by writing
+// _decision-<id>.json next to the marker. The mod cannot delete files, so it clears
+// the marker and leaves the decision, and a write for an ask that is already over
+// is accepted anyway (D13); cleanupAgentActivity's sweep removes both kinds.
 app.post('/api/sessions/:sessionId/waiting/respond', (req, res) => {
   const sessionId = resolveSessionId(req.params.sessionId);
   const dir = path.join(AGENT_ACTIVITY_DIR, sessionId);
@@ -2942,7 +2960,7 @@ app.get('/api/sessions/:sessionId/agents/:agentId/messages/stream', (req, res) =
   res.on('error', cleanup);
 });
 
-app.get('/api/sessions/:sessionId/messages', (req, res) => {
+async function sendSessionMessages(req, res) {
   const limit = Math.min(parseInt(req.query.limit, 10) || 10, 50);
   const before = req.query.before || null;
   const metadata = loadSessionMetadata();
@@ -2959,9 +2977,10 @@ app.get('/api/sessions/:sessionId/messages', (req, res) => {
     hasMore = messages.length > limit;
     if (hasMore) messages = messages.slice(-limit);
   }
+  const compactPromise = cachedByMtime(compactSummaryCache, jsonlPath, jsonlPath, () => readCompactSummaries(jsonlPath), []);
   const agentMessages = messages.filter(m => m.tool === 'Agent' && m.toolUseId);
   if (agentMessages.length) {
-    const progressMap = getProgressMap(jsonlPath);
+    const progressMap = await getProgressMap(jsonlPath);
     const resolvedSid = resolveSessionId(req.params.sessionId);
     const agentDir = path.join(AGENT_ACTIVITY_DIR, resolvedSid);
     for (const msg of agentMessages) {
@@ -3012,15 +3031,7 @@ app.get('/api/sessions/:sessionId/messages', (req, res) => {
       }
     }
   }
-  const cachedCompact = compactSummaryCache.get(jsonlPath);
-  let compactSummaries;
-  if (cachedCompact && Date.now() - cachedCompact.ts < MESSAGE_CACHE_TTL) {
-    compactSummaries = cachedCompact.data;
-  } else {
-    compactSummaries = readCompactSummaries(jsonlPath);
-    compactSummaryCache.set(jsonlPath, { data: compactSummaries, ts: Date.now() });
-    evictStaleCache(compactSummaryCache);
-  }
+  const compactSummaries = await compactPromise;
   // Match compaction messages to summaries by chronological order
   const compactedMsgs = messages
     .filter(m => m.systemLabel === 'Compacted')
@@ -3038,29 +3049,30 @@ app.get('/api/sessions/:sessionId/messages', (req, res) => {
     delete msg.promptId;
   }
   res.json({ messages, hasMore, sessionId: req.params.sessionId });
-});
+}
 
-app.get('/api/sessions/:sessionId/tool-result/:toolUseId', (req, res) => {
+app.get('/api/sessions/:sessionId/messages', asyncRoute(sendSessionMessages));
+
+app.get('/api/sessions/:sessionId/tool-result/:toolUseId', asyncRoute(async (req, res) => {
   const metadata = loadSessionMetadata();
   const meta = metadata[req.params.sessionId] || metadata[resolveSessionId(req.params.sessionId)];
   const jsonlPath = meta?.jsonlPath;
   if (!jsonlPath) return res.status(404).json({ error: 'session not found' });
-  const content = readFullToolResult(jsonlPath, req.params.toolUseId);
+  const content = await readFullToolResult(jsonlPath, req.params.toolUseId);
   if (content == null) return res.status(404).json({ error: 'tool result not found' });
   res.json({ toolUseId: req.params.toolUseId, content });
-});
+}));
 
 const toolStatsCache = new Map();
 
-function buildToolStats(jsonlPath) {
+async function buildToolStats(jsonlPath) {
   const toolUseById = {};     // tool_use_id -> { displayName, isSkill }
   const seenResults = new Set();
   const toolMap = {};         // displayName -> { count, success, failed, outputBytes }
   const skillPromptIds = {};  // promptId -> [skillDisplayName, ...]
   const promptOutputBytes = {}; // promptId -> total outputBytes in that turn
 
-  const content = readFileSync(jsonlPath, 'utf8');
-  for (const line of content.split('\n')) {
+  for await (const line of readLines(jsonlPath)) {
     if (!line) continue;
     let obj;
     try { obj = JSON.parse(line); } catch (_) { continue; }
@@ -3147,13 +3159,13 @@ function buildToolStats(jsonlPath) {
   return { totalCalls, uniqueTools, totalFailed, totalRejected, tools };
 }
 
-app.get('/api/sessions/:sessionId/tool-stats', (req, res) => {
+app.get('/api/sessions/:sessionId/tool-stats', async (req, res) => {
   const metadata = loadSessionMetadata();
   const meta = metadata[req.params.sessionId] || metadata[resolveSessionId(req.params.sessionId)];
   const jsonlPath = meta?.jsonlPath;
   if (!jsonlPath) return res.status(404).json({ error: 'session not found' });
   try {
-    const data = cachedByMtime(toolStatsCache, jsonlPath, jsonlPath, () => buildToolStats(jsonlPath), null);
+    const data = await cachedByMtime(toolStatsCache, jsonlPath, jsonlPath, () => buildToolStats(jsonlPath), null);
     if (!data) return res.status(404).json({ error: 'could not parse session' });
     res.json({ sessionId: req.params.sessionId, ...data });
   } catch (e) {
@@ -3161,31 +3173,24 @@ app.get('/api/sessions/:sessionId/tool-stats', (req, res) => {
   }
 });
 
-app.get('/api/sessions/:sessionId/user-image/:msgUuid/:blockIndex', (req, res) => {
+async function sendTranscriptImage(req, res, read) {
   const metadata = loadSessionMetadata();
   const meta = metadata[req.params.sessionId] || metadata[resolveSessionId(req.params.sessionId)];
   const jsonlPath = meta?.jsonlPath;
   if (!jsonlPath) return res.status(404).end();
-  const img = readUserImage(jsonlPath, req.params.msgUuid, req.params.blockIndex);
+  const img = await read(jsonlPath);
   if (!img) return res.status(404).end();
   const buf = Buffer.from(img.data, 'base64');
   res.setHeader('Content-Type', img.mediaType);
   res.setHeader('Cache-Control', 'no-store');
   res.end(buf);
-});
+}
 
-app.get('/api/sessions/:sessionId/tool-result-image/:toolUseId/:n', (req, res) => {
-  const metadata = loadSessionMetadata();
-  const meta = metadata[req.params.sessionId] || metadata[resolveSessionId(req.params.sessionId)];
-  const jsonlPath = meta?.jsonlPath;
-  if (!jsonlPath) return res.status(404).end();
-  const img = readToolResultImage(jsonlPath, req.params.toolUseId, req.params.n);
-  if (!img) return res.status(404).end();
-  const buf = Buffer.from(img.data, 'base64');
-  res.setHeader('Content-Type', img.mediaType);
-  res.setHeader('Cache-Control', 'no-store');
-  res.end(buf);
-});
+app.get('/api/sessions/:sessionId/user-image/:msgUuid/:blockIndex', asyncRoute((req, res) =>
+  sendTranscriptImage(req, res, (p) => readUserImage(p, req.params.msgUuid, req.params.blockIndex))));
+
+app.get('/api/sessions/:sessionId/tool-result-image/:toolUseId/:n', asyncRoute((req, res) =>
+  sendTranscriptImage(req, res, (p) => readToolResultImage(p, req.params.toolUseId, req.params.n))));
 
 app.get('/api/sessions/:sessionId/cached-image/:n', (req, res) => {
   const img = readCachedImage(req.params.sessionId, req.params.n, CLAUDE_DIR);
@@ -3298,6 +3303,16 @@ app.get('/api/terminals', (_req, res) => {
   res.json({ sessions: terminal.list() });
 });
 
+const terminalProcStats = createProcStats();
+app.get('/api/terminals/stats', async (_req, res) => {
+  res.setHeader('Cache-Control', 'no-store');
+  const pids = terminal.claudePids();
+  const byPid = await terminalProcStats([process.pid, ...Object.values(pids)]);
+  const terminals = {};
+  for (const [id, pid] of Object.entries(pids)) if (byPid[pid]) terminals[id] = byPid[pid];
+  res.json({ cck: byPid[process.pid] || null, terminals });
+});
+
 app.delete('/api/terminals/:id', (req, res) => {
   const err = terminal.end(req.params.id, req.get('x-terminal-token'));
   if (err === 'auth') return res.status(401).json({ error: 'invalid terminal token' });
@@ -3978,7 +3993,7 @@ function formatReviewMarkdown(src, items) {
   const parts = [
     `# Review of ${src.path || src.label}`,
     '',
-    "Each comment is the user's instruction about the quoted text. A quote missing from the source means the source changed after the review: say so.",
+    `Each comment is the user's instruction about the quoted text.${src.path ? ' A quote missing from the source means the source changed after the review: say so.' : ''}`,
   ];
   items.forEach((c, i) => {
     const where = [c.line && `line ${c.line}`, c.heading && `under "${c.heading}"`].filter(Boolean).join(', ');
@@ -4245,7 +4260,7 @@ agentActivityWatcher.on('all', (event, filePath) => {
   }
 });
 
-// Watch context-status directory for statusline updates
+// Watch context-status directory for the plugin's context and cost updates
 const contextStatusWatcher = chokidar.watch(CONTEXT_STATUS_DIR, {
   persistent: true,
   ignoreInitial: false,
@@ -4305,9 +4320,8 @@ async function cleanupAgentActivity() {
           await fs.rm(dirPath, { recursive: true, force: true });
           continue;
         }
-        // Orphaned decision files: a terminal deny fires no hook event (D13), so a
-        // board answer for an already-gone gate is never consumed. The gate waits at
-        // most PERMISSION_TTL_MS, so anything older is unclaimable.
+        // Mods cannot delete files, so every decision file is swept here. The mod
+        // waits at most PERMISSION_TTL_MS, so anything older is unclaimable.
         for (const f of contents) {
           if (!isDecisionFile(f)) continue;
           const fp = path.join(dirPath, f);
@@ -4321,13 +4335,17 @@ async function cleanupAgentActivity() {
   } catch { /* agent-activity dir may not exist */ }
 }
 
-// Dispatch markers and reviews: see docs/retention.md.
+// Dispatch markers, reviews and worktrees: see docs/retention.md.
 async function runRetention() {
   try {
-    const opts = { known: await listTranscriptIds(PROJECTS_DIR), maxAgeMs: retentionMs(CLAUDE_DIR) };
+    const scan = await scanTranscripts(PROJECTS_DIR);
+    const opts = { known: scan?.ids, maxAgeMs: retentionMs(CLAUDE_DIR) };
     const markers = dispatched.prune(opts);
     const reviews = await pruneSessionDirs(REVIEW_DIR, opts);
-    if (markers || reviews) console.log(`[retention] removed ${markers} dispatch markers, ${reviews} reviews`);
+    const wts = worktrees.prune(scan?.dirs);
+    if (markers || reviews || wts) {
+      console.log(`[retention] removed ${markers} dispatch markers, ${reviews} reviews, ${wts} worktrees`);
+    }
   } catch (e) {
     console.warn('[retention] failed:', e.message);
   }