pi-claude-supervisor 0.7.2 → 0.7.3

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 All notable changes to this project will be documented here.
 
+## [0.7.3](https://github.com/btnalit/pi-claude-supervisor/compare/v0.7.2...v0.7.3) (2026-09-17)
+
+
+### Bug Fixes
+
+* **policy:** a name bound to literal text is not an unseen argument ([b93bbf6](https://github.com/btnalit/pi-claude-supervisor/commit/b93bbf6ae019fb7137588f113c0e1113ee942be7))
+* **policy:** a tilde expands only at the start of a word ([9671b23](https://github.com/btnalit/pi-claude-supervisor/commit/9671b23cd6f112f28decc2e906c029c11f5f7d1c))
+* **tmux:** a subagent hand-back is Claude's own prompt, not a human's ([90d40ba](https://github.com/btnalit/pi-claude-supervisor/commit/90d40baf357c5390f1699502235459e2d4230d55))
+* **tmux:** remove a dead Worker's tmux socket and sweep leftovers at load ([db83d40](https://github.com/btnalit/pi-claude-supervisor/commit/db83d4016dc210739d386d038df220cd7c1c4479))
+
 ## [0.7.2](https://github.com/btnalit/pi-claude-supervisor/compare/v0.7.1...v0.7.2) (2026-09-17)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-claude-supervisor",
-  "version": "0.7.2",
+  "version": "0.7.3",
   "description": "A policy-gated Pi supervisor for observing and verifying Claude Code workers.",
   "license": "MIT",
   "publishConfig": {

package/src/index.ts

@@ -8,7 +8,7 @@ import { EventLog } from "./events.ts";
 import { redactSensitive } from "./redaction.ts";
 import { ProcessWorkerAdapter } from "./worker/process-adapter.ts";
 import { automaticWorkerEnvironment } from "./worker/environment.ts";
-import { TmuxWorkerAdapter, attachCommand } from "./worker/tmux-adapter.ts";
+import { TmuxWorkerAdapter, attachCommand, sweepDeadTmuxSockets } from "./worker/tmux-adapter.ts";
 import { Supervisor, type DecisionSessionClosedInfo, type HumanInterventionNotice, type SupervisorProgress, type SupervisorTokenUsage } from "./supervisor.ts";
 import { evaluateCommand } from "./policy.ts";
 import { HumanWebhookNotifier } from "./notifications.ts";
@@ -128,6 +128,9 @@ export default function piClaudeSupervisor(pi: ExtensionAPI): void {
   // with /supervise uninstall-hooks; the relay is a ~1 ms no-op when no
   // Supervisor is listening, so leaving it installed costs nothing.
   let hookInstallNotice: string | undefined;
+  // A Worker killed with its cgroup leaves its tmux socket behind; sweep the
+  // ones no server answers on so the temp directory does not fill with them.
+  if (transport === "tmux") sweepDeadTmuxSockets();
   if (hookServer) {
     hookServerReady = (async () => {
       await writeRelayScript(relayPath);

package/src/policy.ts

@@ -333,7 +333,8 @@ function evaluateCommandInternal(command: string, depth: number): PolicyResult {
 }
 
 function evaluateTokens(rawTokens: readonly ShellToken[], depth: number): PolicyResult {
-  const { tokens, embedded } = resolveDataTokens(rawTokens);
+  const { tokens: dataResolved, embedded } = resolveDataTokens(rawTokens);
+  const tokens = resolveLiteralBindings(dataResolved);
   if (depth < 4) {
     for (const body of embedded) {
       const nestedResult = evaluateCommandInternal(body, depth + 1);
@@ -363,6 +364,61 @@ function evaluateTokens(rawTokens: readonly ShellToken[], depth: number): Policy
   return { decision: "allow", reason: "command is allowed for unattended local development" };
 }
 
+/**
+ * `NAME=literal` and `for NAME in literal…` bind a name to text the policy can
+ * see, so a later `$NAME` is not an unseen argument: `for c in 5dae138 feff500;
+ * do git show $c; done` and `S=/tmp/x && cat > $S/log` are literal commands.
+ * Every bound value is substituted (a loop over `status push` yields
+ * `git status push …`, which the boundary checks still catch), and a name
+ * rebound to dynamic text is forgotten again.
+ */
+function resolveLiteralBindings(tokens: readonly ShellToken[]): ShellToken[] {
+  const bindings = new Map<string, string>();
+  const resolved: ShellToken[] = [];
+  const substitute = (token: ShellToken): ShellToken => {
+    if (token.operator || token.data || !token.dynamic || bindings.size === 0) return token;
+    const value = token.value.replace(/\$\{?([A-Za-z_][A-Za-z0-9_]*)\}?/gu, (match, name: string) => bindings.get(name) ?? match);
+    if (value === token.value) return token;
+    const dynamic = /[$`*?[\]{}~]/u.test(value) && !/^[[\]{}]+$/u.test(value);
+    return { ...token, value, dynamic };
+  };
+  let commandPosition = true;
+  for (let index = 0; index < tokens.length; index += 1) {
+    const token = substitute(tokens[index]!);
+    resolved.push(token);
+    if (token.operator) { commandPosition = SEGMENT_SPLIT_OPERATORS.has(token.value); continue; }
+    const word = token.value;
+    if (commandPosition) {
+      const assignment = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/su.exec(word);
+      if (assignment) {
+        if (token.dynamic) bindings.delete(assignment[1]!);
+        else bindings.set(assignment[1]!, assignment[2]!);
+        continue;
+      }
+      if (word.toLowerCase() === "for") {
+        const name = tokens[index + 1]?.value;
+        const inWord = tokens[index + 2]?.value.toLowerCase();
+        if (name && /^[A-Za-z_][A-Za-z0-9_]*$/u.test(name) && inWord === "in") {
+          const values: string[] = [];
+          let cursor = index + 3;
+          let literal = true;
+          for (; cursor < tokens.length; cursor += 1) {
+            const item = tokens[cursor]!;
+            if (item.operator || item.value.toLowerCase() === "do") break;
+            const substituted = substitute(item);
+            if (substituted.dynamic || substituted.data) literal = false;
+            values.push(substituted.value);
+          }
+          if (literal && values.length > 0) bindings.set(name, values.join(" "));
+          else bindings.delete(name);
+        }
+      }
+      if (!COMMAND_POSITION_KEYWORDS.has(word.toLowerCase())) commandPosition = false;
+    }
+  }
+  return resolved;
+}
+
 /**
  * A quoted heredoc body means whatever its consumer makes of it. Fed to a shell
  * (`bash <<'EOF'`, `cat <<'EOF' | sh`, `eval "$(cat <<'EOF' …)"`) it is a
@@ -534,7 +590,10 @@ function lexShell(input: string): { tokens: ShellToken[]; error?: string } {
     // Brace, tilde and pathname expansion can change command names, targets or
     // Git refs after this lexical pass. Treat all unquoted expansion markers as
     // dynamic rather than attempting to model Bash's expansion order.
-    if ("*?[]{}~".includes(character)) { dynamic = true; value += character; started = true; continue; }
+    // A tilde expands only at the start of a word (or of an assignment value);
+    // `HEAD~1` and `a~b` are literal text.
+    if (character === "~") { if (value === "" || /[=:]$/u.test(value)) dynamic = true; value += character; started = true; continue; }
+    if ("*?[]{}".includes(character)) { dynamic = true; value += character; started = true; continue; }
     if (";&|<>".includes(character)) {
       if (character === "<" && next === "<") {
         const third = input[index + 2];

package/src/worker/tmux-adapter.ts

@@ -1,6 +1,6 @@
 import { createHash, randomUUID } from "node:crypto";
-import { spawn } from "node:child_process";
-import { constants as fsConstants } from "node:fs";
+import { spawn, spawnSync } from "node:child_process";
+import { constants as fsConstants, lstatSync, readdirSync, unlinkSync } from "node:fs";
 import { access, chmod, lstat, mkdir, open, readdir, readFile, realpath, rm, rmdir, stat, truncate, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { delimiter, dirname, isAbsolute, join } from "node:path";
@@ -798,6 +798,7 @@ export class TmuxWorkerAdapter implements WorkerAdapter {
       if (record.owned) {
         await this.#stopGuardian(record).catch((error) => { record.cleanupError ??= asError(error); });
         await this.#run(record, ["kill-server"], undefined, undefined, true).catch(() => {});
+        removeDeadTmuxSocket(record.handle.tmuxSocket);
       } else await this.#detachPipe(record);
     }
     const deadline = Date.now() + 25_000;
@@ -1670,6 +1671,7 @@ export class TmuxWorkerAdapter implements WorkerAdapter {
       if (isMissingSession(error)) record.serverKilled = true;
       else record.cleanupError = asError(error);
     }
+    if (record.serverKilled) removeDeadTmuxSocket(record.handle.tmuxSocket);
     if (!record.serverKilled) await this.#ensurePaneGone(record);
     if (record.cgroupPath) {
       try {
@@ -2281,9 +2283,49 @@ function normalizeForMatch(value: string): string {
   return value.trim().replace(/\s+/gu, " ");
 }
 
-/** True for a prompt Claude Code injected itself (`<task-notification>`, `<system-reminder>`), which a human never typed. */
+/**
+ * A tmux server removes its socket when it exits normally, but not when it is
+ * killed with its cgroup; a dead `pi-cs-*.sock` is unlinked once no server
+ * answers on it. `sweepDeadTmuxSockets` does the same for every socket the
+ * adapter's naming scheme left behind in the temp directory.
+ */
+function removeDeadTmuxSocket(socketPath: string | undefined): void {
+  if (!socketPath || !/[\\/]pi-cs-[0-9a-f-]+\.sock$/u.test(socketPath)) return;
+  try {
+    const probe = spawnSync("tmux", ["-S", socketPath, "list-sessions"], { stdio: "ignore", timeout: 2_000 });
+    // A server that answers, or a socket something else holds open (the probe
+    // timed out), is left alone.
+    if (probe.status === 0 || probe.signal) return;
+    unlinkSync(socketPath);
+  } catch { /* already gone, or not ours to remove */ }
+}
+
+export function sweepDeadTmuxSockets(directory = tmpdir()): number {
+  let removed = 0;
+  let names: string[];
+  try { names = readdirSync(directory); } catch { return 0; }
+  for (const name of names) {
+    if (!/^pi-cs-[0-9a-f-]+\.sock$/u.test(name)) continue;
+    const socketPath = join(directory, name);
+    try {
+      if (!lstatSync(socketPath).isSocket()) continue;
+      const probe = spawnSync("tmux", ["-S", socketPath, "list-sessions"], { stdio: "ignore", timeout: 2_000 });
+      if (probe.status === 0 || probe.signal) continue;
+      unlinkSync(socketPath);
+      removed += 1;
+    } catch { /* skip */ }
+  }
+  return removed;
+}
+
+/**
+ * True for a prompt Claude Code injected itself, which a human never typed:
+ * `<task-notification>`, `<system-reminder>`, `<agent-message …>` and the
+ * other hyphenated runtime wrappers it frames delivered content with. A
+ * person's own message does not begin with such a tag.
+ */
 function isClaudeRuntimePrompt(prompt: string): boolean {
-  return /^\s*<(?:task-notification|system-reminder)\b/u.test(prompt);
+  return /^\s*<[a-z]+(?:-[a-z]+)+(?:\s|>)/u.test(prompt);
 }
 
 /**
@@ -2407,7 +2449,10 @@ function isPaneIdentityError(error: unknown): boolean {
 }
 
 function isMissingSession(error: unknown): boolean {
-  return error instanceof Error && /(can't find session|no server running|session not found|failed to connect)/iu.test(error.message);
+  // tmux leaves its socket behind on exit ("no server running") unless it was
+  // unlinked, in which case it reports "error connecting … (No such file or
+  // directory)"; both mean the same thing here.
+  return error instanceof Error && /(can't find session|no server running|session not found|failed to connect|error connecting to [^\n]*No such file or directory)/iu.test(error.message);
 }
 
 function isMissingFile(error: unknown): boolean {