pi-claude-supervisor 0.2.2 → 0.4.0

package/src/index.ts

@@ -1,14 +1,18 @@
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { randomUUID } from "node:crypto";
 import { homedir } from "node:os";
-import { dirname, isAbsolute, join, relative, sep } from "node:path";
+import { join } from "node:path";
 import { realpath } from "node:fs/promises";
 import { EventLog } from "./events.ts";
+import { redactSensitive } from "./redaction.ts";
 import { ProcessWorkerAdapter } from "./worker/process-adapter.ts";
+import { TmuxWorkerAdapter, attachCommand } from "./worker/tmux-adapter.ts";
 import { Supervisor } from "./supervisor.ts";
 import { evaluateCommand } from "./policy.ts";
 import { HumanWebhookNotifier } from "./notifications.ts";
 import { loadSupervisorEnvironment } from "./config.ts";
 import { DecisionSessionStore, type DecisionSessionRecord } from "./decision-session-store.ts";
+import { CwdLeaseStore, type CwdLeaseHandle, pathsOverlap, workerIdentity } from "./cwd-lease.ts";
 
 /**
  * Pi Claude Supervisor.
@@ -20,20 +24,38 @@ import { DecisionSessionStore, type DecisionSessionRecord } from "./decision-ses
 export default function piClaudeSupervisor(pi: ExtensionAPI): void {
   loadSupervisorEnvironment();
   const automation = process.env.PI_CLAUDE_SUPERVISOR_MODE === "auto" || process.env.PI_CLAUDE_SUPERVISOR_AUTOMATION === "1";
-  const adapter = new ProcessWorkerAdapter({
-    // Automatic decisions require Claude's structured event stream. The pipe
-    // transport remains available for manual/compatibility sessions.
-    mode: automation || process.env.PI_CLAUDE_SUPERVISOR_TRANSPORT === "jsonl" ? "claude-jsonl" : "process-pipe",
-  });
+  const stateDir = process.env.PI_CLAUDE_SUPERVISOR_STATE_DIR ?? join(homedir(), ".pi", "agent", "claude-supervisor");
+  const configuredTransport = process.env.PI_CLAUDE_SUPERVISOR_TRANSPORT;
+  const transport = configuredTransport ?? (automation ? "jsonl" : "process-pipe");
+  const cgroupMode = process.env.PI_CLAUDE_SUPERVISOR_CGROUP_MODE ?? "auto";
+  if (!(["process-pipe", "jsonl", "tmux"] as string[]).includes(transport)) {
+    throw new Error(`Unsupported PI_CLAUDE_SUPERVISOR_TRANSPORT: ${transport}; expected process-pipe, jsonl, or tmux`);
+  }
+  if (!["off", "auto", "required"].includes(cgroupMode)) {
+    throw new Error(`Unsupported PI_CLAUDE_SUPERVISOR_CGROUP_MODE: ${cgroupMode}; expected off, auto, or required`);
+  }
+  if (transport === "tmux" && cgroupMode === "required") {
+    throw new Error("PI_CLAUDE_SUPERVISOR_CGROUP_MODE=required is unsupported with tmux; use process-pipe/jsonl or set cgroup mode to auto/off");
+  }
+  const adapter = transport === "tmux"
+    ? new TmuxWorkerAdapter({ stateDir })
+    : new ProcessWorkerAdapter({
+      // Automatic decisions require Claude's structured event stream. The pipe
+      // transport remains available for manual/compatibility sessions.
+      mode: automation || transport === "jsonl" ? "claude-jsonl" : "process-pipe",
+      cgroupMode: cgroupMode as "off" | "auto" | "required",
+    });
   const humanWebhook = new HumanWebhookNotifier({
     url: process.env.PI_CLAUDE_SUPERVISOR_HUMAN_WEBHOOK_URL,
     format: process.env.PI_CLAUDE_SUPERVISOR_HUMAN_WEBHOOK_FORMAT === "wecom" ? "wecom" : "generic",
     secret: process.env.PI_CLAUDE_SUPERVISOR_HUMAN_WEBHOOK_SECRET,
   });
-  const stateDir = process.env.PI_CLAUDE_SUPERVISOR_STATE_DIR ?? join(homedir(), ".pi", "agent", "claude-supervisor");
   const events = new EventLog(join(stateDir, "events.jsonl"));
   const decisionStore = new DecisionSessionStore(join(stateDir, "decision-sessions"));
+  const cwdLeaseStore = new CwdLeaseStore(process.env.PI_CLAUDE_SUPERVISOR_CWD_LEASE_DIR ?? join(homedir(), ".pi", "agent", "claude-supervisor", "cwd-leases"));
   const sessions = new Map<string, Supervisor>();
+  const cwdLeases = new Map<string, CwdLeaseHandle>();
+  const cleanupRequiredTasks = new Set<string>();
   const reservedCwds = new Map<string, string>();
   const pendingCwds = new Set<string>();
   const pendingStarts = new Set<Promise<void>>();
@@ -43,26 +65,58 @@ export default function piClaudeSupervisor(pi: ExtensionAPI): void {
   let shutdownPromise: Promise<void> | undefined;
 
   const notify = (ctx: ExtensionContext, message: string, type: "info" | "warning" = "info") => {
-    if (ctx.hasUI) ctx.ui.notify(message, type);
+    if (ctx.hasUI) ctx.ui.notify(redactText(message), type);
   };
   const activeSessions = () => [...sessions.entries()].filter(([, session]) =>
     ["starting", "running", "waiting", "paused"].includes(session.state));
+  const releaseLease = async (taskId: string): Promise<boolean> => {
+    const lease = cwdLeases.get(taskId);
+    if (!lease) return false;
+    try {
+      await lease.release();
+      cwdLeases.delete(taskId);
+      return true;
+    } catch (error) {
+      console.error(`pi-claude-supervisor cwd lease release failed: ${redactText(error instanceof Error ? error.message : String(error))}`);
+      return false;
+    }
+  };
   const releaseSettledReservations = async (): Promise<void> => {
     for (const [taskId, session] of sessions) {
       if (!["completed", "stopped", "failed"].includes(session.state)) continue;
       if (!session.handle) {
-        reservedCwds.delete(taskId);
+        if (await releaseLease(taskId)) {
+          reservedCwds.delete(taskId);
+          cleanupRequiredTasks.delete(taskId);
+        }
         continue;
       }
       try {
         const status = await adapter.getStatus(session.handle);
-        if (!status.running && status.processGroupCleaned === true && !status.cleanupError) reservedCwds.delete(taskId);
+        if (!status.running && status.processGroupCleaned === true && !status.cleanupError && (!status.cgroupError || status.cgroupRequired === false)) {
+          if (await releaseLease(taskId)) {
+            reservedCwds.delete(taskId);
+            cleanupRequiredTasks.delete(taskId);
+          }
+        }
       } catch {
         // Keep the reservation when cleanup status cannot be confirmed.
       }
     }
   };
-  const stopSession = async (session: Supervisor, reason: string): Promise<void> => {
+  const stopSession = async (session: Supervisor, reason: string, releasePersistent = false): Promise<void> => {
+    const handle = session.handle;
+    const persistent = adapter.capabilities().persistentSession && Boolean(handle);
+    const taskId = session.task?.taskId;
+    const adoptedPersistent = persistent && handle?.ownership === "adopted";
+    const healthyPersistent = persistent && !["failed", "completed", "stopped"].includes(session.state);
+    const cleanupRequired = taskId ? cleanupRequiredTasks.has(taskId) : false;
+    const markCleanupRequired = () => { if (taskId) cleanupRequiredTasks.add(taskId); };
+    if (adoptedPersistent || (releasePersistent && healthyPersistent && !cleanupRequired)) {
+      await session.release(reason);
+      return;
+    }
+    if (!handle && ["failed", "completed", "stopped"].includes(session.state)) return;
     let lifecycleError: unknown;
     try {
       await session.stop(reason);
@@ -70,9 +124,11 @@ export default function piClaudeSupervisor(pi: ExtensionAPI): void {
       lifecycleError = error;
     }
 
-    const handle = session.handle;
     if (!handle) {
-      if (lifecycleError) throw lifecycleError;
+      if (lifecycleError) {
+        markCleanupRequired();
+        throw lifecycleError;
+      }
       return;
     }
 
@@ -81,8 +137,12 @@ export default function piClaudeSupervisor(pi: ExtensionAPI): void {
     while (Date.now() <= deadline) {
       try {
         const status = await adapter.getStatus(handle);
-        if (!status.running && status.processGroupCleaned === true) {
-          if (lifecycleError) throw lifecycleError;
+        if (!status.running && status.processGroupCleaned === true && !status.cleanupError && (!status.cgroupError || status.cgroupRequired === false)) {
+          if (lifecycleError) {
+            markCleanupRequired();
+            throw lifecycleError;
+          }
+          if (taskId) cleanupRequiredTasks.delete(taskId);
           return;
         }
       } catch (error) {
@@ -96,6 +156,7 @@ export default function piClaudeSupervisor(pi: ExtensionAPI): void {
       await delay(25);
     }
 
+    markCleanupRequired();
     if (lifecycleError) throw lifecycleError;
     throw cleanupError instanceof Error
       ? cleanupError
@@ -109,9 +170,11 @@ export default function piClaudeSupervisor(pi: ExtensionAPI): void {
         const tokens = args.trim() ? args.trim().split(/\s+/u) : [];
         const [operation = "status", ...rest] = tokens;
         let message = "";
-        if (operation === "start") {
+        if (operation === "start" || operation === "adopt-tmux") {
+          const tmuxSession = operation === "adopt-tmux" ? rest.shift() : undefined;
           const task = rest.join(" ").trim();
-          if (!task) throw new Error("Usage: /supervise start <task>");
+          if (!task) throw new Error(operation === "adopt-tmux" ? "Usage: /supervise adopt-tmux <tmux-session> <task>" : "Usage: /supervise start <task>");
+          if (operation === "adopt-tmux" && adapter.capabilities().transport !== "tmux") throw new Error("/supervise adopt-tmux requires PI_CLAUDE_SUPERVISOR_TRANSPORT=tmux");
           const [command, ...workerArgs] = parseCommand(process.env.PI_CLAUDE_SUPERVISOR_WORKER ?? "claude");
           if (!command) throw new Error("PI_CLAUDE_SUPERVISOR_WORKER must contain an executable");
           const policy = evaluateCommand(command, workerArgs);
@@ -134,32 +197,54 @@ export default function piClaudeSupervisor(pi: ExtensionAPI): void {
           if (reservedPaths.some((reserved) => pathsOverlap(reserved, cwdKey))) {
             throw new Error("An active, starting, or unreaped worker uses an overlapping cwd; use a separate worktree for concurrent sessions");
           }
+          const taskId = randomUUID();
+          const lease = await cwdLeaseStore.acquire(cwdKey, taskId, adapter.capabilities().transport, tmuxSession
+            ? { handoff: { sessionName: tmuxSession, tmuxSocket: process.env.PI_CLAUDE_SUPERVISOR_TMUX_SOCKET } }
+            : {});
+          cwdLeases.set(taskId, lease);
+          if (shuttingDown) {
+            await releaseLease(taskId);
+            throw new Error("Pi session is shutting down");
+          }
           pendingCwds.add(cwdKey);
           const session = new Supervisor(adapter, events, {
             onHumanRequired: async (notice) => {
-              if (ctx.hasUI) ctx.ui.notify(`Claude Worker needs human intervention: ${notice.reason}`, "warning");
+              if (ctx.hasUI) notify(ctx, `Claude Worker needs human intervention: ${notice.reason}`, "warning");
               if (humanWebhook.enabled) {
                 try {
                   await humanWebhook.notify(notice);
                 } catch (error) {
-                  console.error(`pi-claude-supervisor human webhook failed: ${error instanceof Error ? error.message : String(error)}`);
+                  console.error(`pi-claude-supervisor human webhook failed: ${redactText(error instanceof Error ? error.message : String(error))}`);
                 }
               } else {
-                console.error(`pi-claude-supervisor human intervention required: ${notice.reason}`);
+                console.error(`pi-claude-supervisor human intervention required: ${redactText(notice.reason)}`);
               }
             },
           });
           pendingStartSessions.add(session);
+          let startupCleanupCompleted = false;
           const startOperation = (async () => {
             try {
               const handle = await session.start({
+                taskId,
                 task,
-                cwd: ctx.cwd,
+                cwd: cwdKey,
                 command,
                 args: workerArgs,
                 env: selectedWorkerEnvironment(),
                 approval,
                 automation,
+                tmuxSession,
+                tmuxSocket: process.env.PI_CLAUDE_SUPERVISOR_TMUX_SOCKET,
+                tmuxExpectedIdentity: tmuxSession && lease.record.worker ? {
+                  pid: lease.record.worker.pid,
+                  startTime: lease.record.worker.startTime,
+                  tmuxTarget: lease.record.worker.tmuxTarget,
+                  tmuxPaneId: lease.record.worker.tmuxPaneId,
+                  paneStartTime: lease.record.worker.paneStartTime,
+                  paneCommand: lease.record.worker.paneCommand,
+                } : undefined,
+                sendInitialInput: !tmuxSession,
                 decisionSessionDir: decisionStore.directory,
                 onDecisionSessionReady: (info) => decisionStore.save({
                   taskId: info.taskId,
@@ -179,36 +264,70 @@ export default function piClaudeSupervisor(pi: ExtensionAPI): void {
                 onDecisionSessionProgress: (info) => decisionStore.update(info.taskId, { turn: info.turn }),
                 onDecisionSessionClosed: (taskId) => decisionStore.close(taskId),
               });
-              const taskId = session.task?.taskId;
-              if (!taskId) throw new Error("worker started without a task id");
+              const startedTaskId = session.task?.taskId;
+              if (!startedTaskId) throw new Error("worker started without a task id");
+              try {
+                await lease.updateWorker({
+                  transport: adapter.capabilities().transport,
+                  ...(await workerIdentity(handle)),
+                  sessionName: handle.sessionName,
+                  tmuxSocket: handle.tmuxSocket,
+                  ownership: handle.ownership,
+                });
+              } catch (error) {
+                const registrationError = error instanceof Error ? error : new Error(String(error));
+                if (handle.ownership !== "adopted") {
+                  try {
+                    await stopSession(session, "cwd lease metadata registration failed");
+                    startupCleanupCompleted = await releaseLease(taskId);
+                  } catch (cleanupError) {
+                    const message = cleanupError instanceof Error ? cleanupError.message : String(cleanupError);
+                    registrationError.message = `${registrationError.message}; worker cleanup failed: ${message}`;
+                    Object.defineProperty(registrationError, "workerCleanupRequired", { value: true, enumerable: false });
+                  }
+                }
+                throw registrationError;
+              }
               // Register immediately after spawn so shutdown can retry cleanup if
               // the first stop attempt fails.
-              sessions.set(taskId, session);
-              reservedCwds.set(taskId, cwdKey);
-              activeTaskId = taskId;
+              sessions.set(startedTaskId, session);
+              reservedCwds.set(startedTaskId, cwdKey);
+              activeTaskId = startedTaskId;
               if (shuttingDown) {
                 try {
-                  await stopSession(session, "Pi session shutdown during worker start");
-                  sessions.delete(taskId);
-                  reservedCwds.delete(taskId);
+                  await stopSession(session, "Pi session shutdown during worker start", true);
+                  sessions.delete(startedTaskId);
+                  reservedCwds.delete(startedTaskId);
                 } finally {
                   if (session.state !== "stopped") {
                     // Keep the session registered for the shutdown retry below.
-                    sessions.set(taskId, session);
-                    reservedCwds.set(taskId, cwdKey);
+                    sessions.set(startedTaskId, session);
+                    reservedCwds.set(startedTaskId, cwdKey);
                   }
                 }
                 throw new Error("Pi session shut down during worker start");
               }
-              message = `Worker started: task=${taskId} worker=${handle.id} (pid ${handle.pid ?? "unknown"}); transport=${adapter.capabilities().transport}`;
+              const attach = handle.sessionName ? ` attach=${attachCommand(handle)}` : "";
+              message = `${tmuxSession ? "Tmux worker adopted" : "Worker started"}: task=${startedTaskId} worker=${handle.id} (pid ${handle.pid ?? "unknown"}); transport=${adapter.capabilities().transport}${attach}`;
             } catch (error) {
               // Register failed starts before the promise settles, so shutdown
               // cannot snapshot sessions before a returned handle is retained.
               const failedTaskId = session.task?.taskId;
-              if (failedTaskId && session.handle) {
+              const cleanupRequired = requiresWorkerCleanup(error);
+              if (cleanupRequired && failedTaskId) cleanupRequiredTasks.add(failedTaskId);
+              const retainHandle = !startupCleanupCompleted && failedTaskId && session.handle
+                && (cleanupRequired || session.handle.ownership === "adopted");
+              if (retainHandle) {
                 sessions.set(failedTaskId, session);
                 reservedCwds.set(failedTaskId, cwdKey);
                 activeTaskId = failedTaskId;
+              } else if (!cleanupRequired && !startupCleanupCompleted) {
+                const released = await releaseLease(taskId);
+                if (!released && failedTaskId) {
+                  sessions.set(failedTaskId, session);
+                  reservedCwds.set(failedTaskId, cwdKey);
+                  activeTaskId = failedTaskId;
+                }
               }
               throw error;
             }
@@ -220,10 +339,21 @@ export default function piClaudeSupervisor(pi: ExtensionAPI): void {
             // Preserve a failed startup in the registry when the adapter
             // returned a handle but lifecycle/event setup failed.
             const failedTaskId = session.task?.taskId;
-            if (failedTaskId && session.handle) {
+            const cleanupRequired = requiresWorkerCleanup(error);
+            if (cleanupRequired && failedTaskId) cleanupRequiredTasks.add(failedTaskId);
+            const retainHandle = !startupCleanupCompleted && failedTaskId && session.handle
+              && (cleanupRequired || session.handle.ownership === "adopted");
+            if (retainHandle) {
               sessions.set(failedTaskId, session);
               reservedCwds.set(failedTaskId, cwdKey);
               activeTaskId = failedTaskId;
+            } else if (!cleanupRequired && !startupCleanupCompleted) {
+              const released = await releaseLease(taskId);
+              if (!released && failedTaskId) {
+                sessions.set(failedTaskId, session);
+                reservedCwds.set(failedTaskId, cwdKey);
+                activeTaskId = failedTaskId;
+              }
             }
             throw error;
           } finally {
@@ -260,19 +390,26 @@ export default function piClaudeSupervisor(pi: ExtensionAPI): void {
             if (!approved) throw new Error("Worker command not approved");
             approval = { actor: "human", reason: policy.reason };
           }
+          const lease = await cwdLeaseStore.acquire(cwdKey, record.taskId, adapter.capabilities().transport);
+          cwdLeases.set(record.taskId, lease);
+          if (shuttingDown) {
+            await releaseLease(record.taskId);
+            throw new Error("Pi session is shutting down");
+          }
           pendingCwds.add(cwdKey);
           const session = new Supervisor(adapter, events, {
             onHumanRequired: async (notice) => {
-              if (ctx.hasUI) ctx.ui.notify(`Claude Worker needs human intervention: ${notice.reason}`, "warning");
+              if (ctx.hasUI) notify(ctx, `Claude Worker needs human intervention: ${notice.reason}`, "warning");
               if (humanWebhook.enabled) {
                 try { await humanWebhook.notify(notice); }
-                catch (error) { console.error(`pi-claude-supervisor human webhook failed: ${error instanceof Error ? error.message : String(error)}`); }
+                catch (error) { console.error(`pi-claude-supervisor human webhook failed: ${redactText(error instanceof Error ? error.message : String(error))}`); }
               } else {
-                console.error(`pi-claude-supervisor human intervention required: ${notice.reason}`);
+                console.error(`pi-claude-supervisor human intervention required: ${redactText(notice.reason)}`);
               }
             },
           });
           pendingStartSessions.add(session);
+          let recoveryCleanupCompleted = false;
           const recoveryOperation = (async () => {
             try {
               const handle = await session.start({
@@ -282,7 +419,8 @@ export default function piClaudeSupervisor(pi: ExtensionAPI): void {
                 // must explicitly send the next instruction.
                 task: record.task,
                 initialInput: "",
-                cwd: record.cwd,
+                sendInitialInput: false,
+                cwd: cwdKey,
                 command: record.command,
                 args: record.args,
                 env: selectedWorkerEnvironment(),
@@ -313,20 +451,51 @@ export default function piClaudeSupervisor(pi: ExtensionAPI): void {
                 onDecisionSessionProgress: (info) => decisionStore.update(info.taskId, { turn: info.turn }),
                 onDecisionSessionClosed: (closedTaskId) => decisionStore.close(closedTaskId),
               });
+              try {
+                await lease.updateWorker({
+                  transport: adapter.capabilities().transport,
+                  ...(await workerIdentity(handle)),
+                  sessionName: handle.sessionName,
+                  tmuxSocket: handle.tmuxSocket,
+                  ownership: handle.ownership,
+                });
+              } catch (error) {
+                const registrationError = error instanceof Error ? error : new Error(String(error));
+                try {
+                  await stopSession(session, "cwd lease metadata registration failed");
+                  recoveryCleanupCompleted = await releaseLease(record.taskId);
+                } catch (cleanupError) {
+                  const message = cleanupError instanceof Error ? cleanupError.message : String(cleanupError);
+                  registrationError.message = `${registrationError.message}; worker cleanup failed: ${message}`;
+                  Object.defineProperty(registrationError, "workerCleanupRequired", { value: true, enumerable: false });
+                }
+                throw registrationError;
+              }
               sessions.set(record.taskId, session);
               reservedCwds.set(record.taskId, cwdKey);
               activeTaskId = record.taskId;
               await session.takeover();
               if (shuttingDown) {
-                await stopSession(session, "Pi session shutdown during recovery");
+                await stopSession(session, "Pi session shutdown during recovery", true);
                 throw new Error("Pi session shut down during recovery");
               }
               message = `Worker recovered idle: task=${record.taskId} worker=${handle.id}; original task was not replayed; send an explicit continuation, then use resume-auto`;
             } catch (error) {
-              if (session.handle) {
+              const cleanupRequired = requiresWorkerCleanup(error);
+              if (cleanupRequired) cleanupRequiredTasks.add(record.taskId);
+              const retainHandle = !recoveryCleanupCompleted && session.handle
+                && (cleanupRequired || session.handle.ownership === "adopted");
+              if (retainHandle) {
                 sessions.set(record.taskId, session);
                 reservedCwds.set(record.taskId, cwdKey);
                 activeTaskId = record.taskId;
+              } else if (!cleanupRequired && !recoveryCleanupCompleted) {
+                const released = await releaseLease(record.taskId);
+                if (!released) {
+                  sessions.set(record.taskId, session);
+                  reservedCwds.set(record.taskId, cwdKey);
+                  activeTaskId = record.taskId;
+                }
               }
               throw error;
             }
@@ -372,9 +541,12 @@ export default function piClaudeSupervisor(pi: ExtensionAPI): void {
           } else if (operation === "resume") {
             await session.resume(); message = `Worker resumed: ${sessionId}.`;
           } else if (operation === "stop") {
-            await session.stop(remaining.join(" ") || "human requested stop"); message = `Worker stopped: ${sessionId}.`;
+            await stopSession(session, remaining.join(" ") || "human requested stop");
+            await releaseSettledReservations();
+            message = `Worker stopped: ${sessionId}.`;
           } else if (operation === "verify") {
             const result = await session.verify();
+            await releaseSettledReservations();
             message = `${result.ok ? "Verification passed" : "Verification failed"}: ${result.command}\n${result.output}`.trim();
           } else if (operation === "approve") {
             const behavior = remaining[0];
@@ -386,7 +558,7 @@ export default function piClaudeSupervisor(pi: ExtensionAPI): void {
           } else if (operation === "resume-auto") {
             await session.resumeAutomation(); message = `Automatic decisions resumed: ${sessionId}.`;
           } else {
-            throw new Error("Usage: /supervise start|recover|sessions|status|poll [all|taskId]|send [taskId]|pause [taskId]|resume [taskId]|stop [taskId]|verify [taskId]|approve [taskId] <allow|deny>|takeover [taskId]|resume-auto [taskId]|capabilities");
+            throw new Error("Usage: /supervise start|adopt-tmux|recover|sessions|status|poll [all|taskId]|send [taskId]|pause [taskId]|resume [taskId]|stop [taskId]|verify [taskId]|approve [taskId] <allow|deny>|takeover [taskId]|resume-auto [taskId]|capabilities");
           }
         }
         notify(ctx, message);
@@ -401,15 +573,26 @@ export default function piClaudeSupervisor(pi: ExtensionAPI): void {
     shuttingDown = true;
     shutdownPromise = (async () => {
       const pending = [...pendingStarts];
+      let startupFailures: PromiseRejectedResult[] = [];
       await Promise.race([Promise.allSettled(pending), delay(5_000)]);
       if (pendingStarts.size > 0) {
-        await Promise.allSettled([...pendingStartSessions].map((session) => session.abortStart("Pi session shutdown during startup")));
-        await Promise.race([Promise.allSettled([...pendingStarts]), delay(5_000)]);
+        const abortResults = await Promise.allSettled([...pendingStartSessions].map((session) => session.abortStart("Pi session shutdown during startup")));
+        startupFailures = abortResults.filter((result): result is PromiseRejectedResult => result.status === "rejected");
+        // Do not snapshot sessions or release leases until every startup has
+        // settled. Otherwise a provider that resolves after a fixed timeout
+        // could register a live handle after shutdown cleanup had completed.
+        // Adapters expose bounded cancellation; an uncooperative provider must
+        // keep shutdown fail-closed rather than allowing a late worker escape.
+        while (pendingStarts.size > 0) {
+          const results = await Promise.allSettled([...pendingStarts]);
+          startupFailures.push(...results.filter((result): result is PromiseRejectedResult => result.status === "rejected"));
+        }
       }
-      const results = await Promise.allSettled([...sessions.values()].map((session) => stopSession(session, "Pi session shutdown")));
-      const failures = results.filter((result): result is PromiseRejectedResult => result.status === "rejected");
+      const results = await Promise.allSettled([...sessions.values()].map((session) => stopSession(session, "Pi session shutdown", true)));
+      await releaseSettledReservations();
+      const failures = [...startupFailures, ...results.filter((result): result is PromiseRejectedResult => result.status === "rejected")];
       if (failures.length > 0) {
-        for (const failure of failures) console.error(`pi-claude-supervisor shutdown cleanup failed: ${failure.reason instanceof Error ? failure.reason.message : String(failure.reason)}`);
+        for (const failure of failures) console.error(`pi-claude-supervisor shutdown cleanup failed: ${redactText(failure.reason instanceof Error ? failure.reason.message : String(failure.reason))}`);
         if (exitCode === undefined) process.exitCode = 1;
       }
       if (exitCode !== undefined) process.exitCode = exitCode;
@@ -449,13 +632,8 @@ async function canonicalCwd(cwd: string): Promise<string> {
   return realpath(cwd);
 }
 
-function pathsOverlap(first: string, second: string): boolean {
-  return isWithin(first, second) || isWithin(second, first);
-}
-
-function isWithin(parent: string, child: string): boolean {
-  const childRelative = relative(parent, child);
-  return childRelative === "" || (childRelative !== ".." && !childRelative.startsWith(`..${sep}`) && !isAbsolute(childRelative));
+function requiresWorkerCleanup(error: unknown): boolean {
+  return Boolean(error && typeof error === "object" && (error as { workerCleanupRequired?: unknown }).workerCleanupRequired === true);
 }
 
 function formatSessions(sessions: Map<string, Supervisor>, recoverable: DecisionSessionRecord[] = []): string {
@@ -493,8 +671,5 @@ function delay(ms: number): Promise<void> {
 }
 
 function redactText(value: string): string {
-  return value
-    .replace(/\b(sk-ant-[A-Za-z0-9_-]+)\b/gu, "[REDACTED]")
-    .replace(/\b(Bearer\s+)[^\s]+/giu, "$1[REDACTED]")
-    .replace(/(--?(?:token|api[-_]?key|secret|password|authorization)(?:=|\s+))[^\s]+/giu, "$1[REDACTED]");
+  return String(redactSensitive(value));
 }

package/src/notifications.ts

@@ -1,5 +1,6 @@
 import { createHmac, randomUUID } from "node:crypto";
 import type { HumanInterventionNotice } from "./supervisor.ts";
+import { redactSensitive } from "./redaction.ts";
 
 export interface HumanWebhookOptions {
   url?: string;
@@ -46,38 +47,36 @@ function toGeneric(notice: HumanInterventionNotice): Record<string, unknown> {
     eventId: randomUUID(),
     event: "human_intervention_required",
     occurredAt: new Date().toISOString(),
-    task: { id: notice.taskId, goal: notice.task, cwd: notice.cwd },
-    worker: { id: notice.workerId },
-    reason: notice.reason,
-    question: notice.question,
-    permission: notice.permission ? { ...notice.permission, input: sanitize(notice.permission.input) } : undefined,
+    task: { id: sanitize(notice.taskId), goal: sanitize(notice.task), cwd: sanitize(notice.cwd) },
+    worker: { id: sanitize(notice.workerId) },
+    reason: sanitize(notice.reason),
+    question: sanitize(notice.question),
+    permission: notice.permission ? sanitize(notice.permission) : undefined,
     actions: ["approve_or_deny_permission", "send_instruction", "stop_worker", "takeover"],
     note: "This is an outbound notification. Use the Pi session or a separately authenticated callback service to approve actions.",
   };
 }
 
 function toWeCom(notice: HumanInterventionNotice): Record<string, unknown> {
-  const permission = notice.permission ? `\n工具: ${notice.permission.toolName}\n请求 ID: ${notice.permission.requestId}` : "";
-  const question = notice.question ? `\n问题: ${notice.question}` : "";
+  const permission = notice.permission ? `\n工具: ${safeText(notice.permission.toolName)}\n请求 ID: ${safeText(notice.permission.requestId)}` : "";
+  const question = notice.question ? `\n问题: ${safeText(notice.question)}` : "";
   return {
     msgtype: "markdown",
     markdown: {
-      content: `### Claude Supervisor 需要人工介入\n> 任务: ${escapeMarkdown(notice.task)}\n> Task ID: ${notice.taskId}\n> 原因: ${escapeMarkdown(notice.reason)}${escapeMarkdown(question)}${escapeMarkdown(permission)}\n\n请在 Pi 中执行对应的 approve/deny、send、stop 或 takeover 操作。`,
+      content: `### Claude Supervisor 需要人工介入\n> 任务: ${safeText(notice.task)}\n> Task ID: ${safeText(notice.taskId)}\n> 原因: ${safeText(notice.reason)}${escapeMarkdown(question)}${escapeMarkdown(permission)}\n\n请在 Pi 中执行对应的 approve/deny、send、stop 或 takeover 操作。`,
     },
   };
 }
 
 function sanitize(value: unknown, key?: string): unknown {
-  if (key && /(password|secret|token|api[-_]?key|authorization|credential)/iu.test(key)) return "[REDACTED]";
-  if (typeof value === "string") {
-    return value
-      .replace(/\\b(sk-ant-[A-Za-z0-9_-]+)\\b/gu, "[REDACTED]")
-      .replace(/\\b(Bearer\\s+)[^\\s]+/giu, "$1[REDACTED]")
-      .slice(0, 4_000);
-  }
+  if (typeof value === "string") return String(redactSensitive(value, key)).slice(0, 4_000);
   if (Array.isArray(value)) return value.slice(0, 50).map((item) => sanitize(item, key));
   if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).slice(0, 50).map(([childKey, childValue]) => [childKey, sanitize(childValue, childKey)]));
-  return value;
+  return redactSensitive(value, key);
+}
+
+function safeText(value: unknown): string {
+  return String(sanitize(value));
 }
 
 function escapeMarkdown(value: string): string {

package/src/redaction.ts

@@ -0,0 +1,20 @@
+const sensitiveKeyPattern = /(password|secret|token|api[-_]?key|authorization|credential)/iu;
+
+/** Recursively redact credential-shaped values before persistence or model prompts. */
+export function redactSensitive(value: unknown, key?: string): unknown {
+  if (key && sensitiveKeyPattern.test(key)) return "[REDACTED]";
+  if (typeof value === "string") {
+    return value
+      .replace(/\b(sk-ant-[A-Za-z0-9_-]+)\b/gu, "[REDACTED]")
+      .replace(/\b(?:gh[pousr]_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]{20,}|xox[baprs]-[A-Za-z0-9-]{20,}|npm_[A-Za-z0-9]{20,})\b/gu, "[REDACTED]")
+      .replace(/\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/gu, "[REDACTED]")
+      .replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[REDACTED]")
+      .replace(/\b(Bearer\s+)[^\s]+/giu, "$1[REDACTED]")
+      .replace(/\b((?:AWS_ACCESS_KEY_ID|AWS_SECRET_ACCESS_KEY|AWS_SESSION_TOKEN|[A-Z][A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD)))=([^\s]+)/gu, "$1=[REDACTED]")
+      .replace(/\b((?:authorization|x-api-key|api-key)\s*:\s*)[^\s]+/giu, "$1[REDACTED]")
+      .replace(/(--?(?:token|api[-_]?key|secret|password|authorization)(?:=|\s+))[^\s]+/giu, "$1[REDACTED]");
+  }
+  if (Array.isArray(value)) return value.map((item) => redactSensitive(item, key));
+  if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([childKey, childValue]) => [childKey, redactSensitive(childValue, childKey)]));
+  return value;
+}