teapot-coding-agent 0.25.2 → 0.26.1

package/dist/agent/agent.js

@@ -345,6 +345,46 @@ export class Agent {
     get compactBudgetIsManual() {
         return this.manualCompactBudget;
     }
+    /**
+     * A context size we are willing to act on.
+     *
+     * #73: `lastUsage.input` is the provider's own count, so it is normally the
+     * most accurate number available — but a provider that under-reports (a proxy
+     * that omits the field's real value, a broken gateway, a model served through
+     * a shim) makes BOTH safety gates believe the context is nearly empty:
+     *
+     *     maybePrune()    est < budget * 0.6   -> 0 prunes, forever
+     *     maybeCompact()  before < budget       -> 0 compactions, forever
+     *
+     * Reproduced: ~40k characters of real conversation, provider reporting
+     * `prompt_tokens: 10` — zero prunes, zero compactions, and a gauge reading 10,
+     * so nothing looks wrong. The context then overflows for real, with the
+     * defence that exists to stop exactly that switched off.
+     *
+     * So the reported number is used, but never as the ONLY number: it is floored
+     * against the local estimate. The estimate is a heuristic; the point is that
+     * `??` was the wrong way to combine a measurement with a floor — it only falls
+     * back when the value is ABSENT, so a confidently wrong value was trusted more
+     * than the guess.
+     *
+     * The floor is a HALF of the local estimate. A quarter was tried first and
+     * was too weak to clear the 0.6-of-budget threshold for a realistic session
+     * (estimate 5108 → floored 1277 against a 3600 bar), so the guard still would
+     * not have fired. Half keeps the intent — catch "reported 10 when the real
+     * prompt is large" — without arguing with a provider whose tokenizer
+     * legitimately differs from ours, since a provider within 2x of the estimate
+     * is not the failure mode being defended against.
+     */
+    contextSizeForBudgeting() {
+        const estimated = this.estimateTokens();
+        const reported = this.lastUsage?.input;
+        if (reported === undefined)
+            return estimated;
+        // a provider reporting nothing at all is a different bug; treat it as unknown
+        if (!Number.isFinite(reported) || reported <= 0)
+            return estimated;
+        return Math.max(reported, Math.floor(estimated / 2));
+    }
     /**
      * Is this agent doing work that `stop()` would actually stop?
      *
@@ -722,10 +762,19 @@ export class Agent {
             droppedEvents: dropped.length,
             tailMode: tail,
         });
-        // Seed the new branch's parent link to the fork event just written, so its
-        // first event chains across instead of starting a disconnected parent:null
-        // history (#38).
-        this.log.seedBranch(newBranch, this.log.lastEventId(this.currentBranch));
+        // Seed the new branch's parent link so its first event chains across
+        // instead of starting a disconnected parent:null history (#38).
+        //
+        // #69: seed from the CUT POINT, not from this branch's tip. The fork event
+        // records where the edit was made (`fromEvent` = the last KEPT event), but
+        // `lastEventId(currentBranch)` is the newest event on the branch — which is
+        // one of the events this edit just DISCARDED. Seeding from the tip chained
+        // the new branch to the discarded tail, so lineageOf() walked straight back
+        // through it and a restart resurrected every dropped turn.
+        //
+        // The cut point is the right parent: it is the last event that survives.
+        const cutPoint = kept.at(-1)?.id ?? null;
+        this.log.seedBranch(newBranch, cutPoint);
         this.currentBranch = newBranch;
         this.messages = msgs;
         await this.log.append("prompt", this.currentSession, this.currentBranch, { source: "user", text });
@@ -940,6 +989,17 @@ export class Agent {
                 ...(this.compactPhase ? { compacting: this.compactPhase } : {}),
             },
             pendingPrompts: this.pendingPrompts.length,
+            // #78: the IDS as well as the count. The web UI reconciles its local echo
+            // list against the live queue, and it was doing that by POSITION
+            // (slice(0, queued)) because only a count was published — so whenever the
+            // count dipped below the true queue length (a mid-queue cancellation, or a
+            // momentary gap), the NEWEST still-queued echoes were dropped and their
+            // undelivered log rows reappeared as settled "sent" rows. Identity needs
+            // the ids to travel; the count alone cannot express "these two".
+            //
+            // Bounded like the rest of the snapshot, and ids are opaque, so this
+            // cannot carry prompt text.
+            pendingPromptIds: this.pendingPrompts.map((p) => p.id).filter((x) => !!x).slice(0, 64),
             todo: this.todo.slice(0, 32_000), // match set_todo's cap — no silent truncation
             parent: this.opts.parent,
             awaiting: this.awaitingUser,
@@ -1114,9 +1174,24 @@ export class Agent {
     }
     /** Start (or resume) autonomous operation toward the goal. */
     start(reason = "start") {
-        if (this.status === "running")
+        // #76: a stop() immediately followed by start() USED TO BE SILENTLY LOST.
+        //
+        // `stop()` only flips the status via an ENQUEUED task, so between the two
+        // calls the status is still "running" and the guard below returned early —
+        // before `stopRequested = false` could run. The stop then landed, the loop
+        // exited, and the agent ended "stopped" with the restart discarded. The same
+        // window made a stop+restart abort the new round's first tool.
+        //
+        // So a pending stop is not a reason to refuse a start. The loop's own
+        // guards (`stopRequested` re-checked after every await) keep the old turn
+        // from running on, and enqueue() serialises the two tasks, so the restart
+        // is ordered after the stop rather than racing it.
+        const pendingStop = this.stopRequested;
+        if (this.status === "running" && !pendingStop)
             return;
         this.stopRequested = false;
+        // claim the status against any stop write still queued behind us (#86)
+        this.stopSeq++;
         this.awaitingUser = false; // a fresh start answers/resumes past any ask_user
         void this.enqueue(async () => {
             await this.ensureReady(); // lazy restore before the loop touches history
@@ -1133,11 +1208,32 @@ export class Agent {
         this.abort?.abort();
         this.toolAbort.abort();
         this.wake?.();
+        // #86: the status write is DEFERRED onto the run chain, so it can land
+        // AFTER a start() that followed it. Observed: `idle -> stopped -> running ->
+        // running -> idle`. The agent did resume — but it flashed "stopped" on the
+        // way, and finished idle rather than running, so from the UI the operator's
+        // ▶ start looked like it had done nothing.
+        //
+        // `start()` clears stopRequested synchronously, which is what makes this
+        // detectable: by the time this task runs, a start has already claimed the
+        // agent and the stop no longer owns the status.
+        //
+        // So record WHEN the stop was requested, and let a start that came after it
+        // win. A stop issued while the agent is genuinely still running behaves
+        // exactly as before.
+        const stopSeq = ++this.stopSeq;
         void this.enqueue(() => {
+            // Only a start() that arrived AFTER this stop may claim the status. The
+            // seq check alone does that — no status test, because a genuinely running
+            // agent must still be reported "stopped" (#86).
+            if (this.stopSeq !== stopSeq)
+                return Promise.resolve();
             this.setStatus("stopped", reason);
             return Promise.resolve();
         });
     }
+    /** monotonic counter: a start() bumps it, so a pending stop status write loses */
+    stopSeq = 0;
     setStatus(s, reason = "") {
         // Update the field FIRST. log.append fires onEvent synchronously, and the
         // master's child-event hook wakes parked wait_children callers — those
@@ -1318,6 +1414,13 @@ export class Agent {
                 const name = err.name;
                 if (name === "StopRequested" || name === "AbortError" || this.stopRequested)
                     throw err;
+                // #76: a context-overflow error is the caller's to handle, not ours to
+                // retry. Retrying the SAME oversized request four times with 5s/5s/30s
+                // waits cannot succeed, and it delays the compact-and-retry that would
+                // — so the overflow path never even ran. This is the same
+                // "present, correct, and inert" shape as #54.
+                if (isContextOverflow(err))
+                    throw err;
                 if (attempt >= maxAttempts)
                     throw err;
                 const waitMs = waits[Math.min(attempt - 1, waits.length - 1)];
@@ -1505,8 +1608,15 @@ export class Agent {
                 return finished;
             }
             for (const call of m.tool_calls) {
-                if (this.stopRequested)
+                if (this.stopRequested) {
+                    // #54: this returned straight out of the turn, SKIPPING the
+                    // answerUnansweredToolCalls backstop below — so every remaining
+                    // tool_call in this assistant message stayed logged with NO
+                    // tool_result anywhere, and its row rendered as "waiting for
+                    // output…" for the rest of the session.
+                    await this.answerUnansweredToolCalls(m);
                     return finished;
+                }
                 if (call.function.name === "finish") {
                     this.pendingSubReport = ""; // the real summary supersedes it
                     await this.handleFinish(call.function.arguments);
@@ -1585,6 +1695,13 @@ export class Agent {
                     this.awaitingUser = true;
                     this.setStatus("waiting", question.slice(0, 80));
                     // control flow: park the loop; the operator's next prompt resumes it
+                    //
+                    // #54: answer the rest of this assistant batch BEFORE parking. The
+                    // throw leaves the whole tool loop, so any EARLIER call in the same
+                    // message that was logged but not yet run kept no tool_result — the
+                    // comment on the backstop below says as much, and it is exactly the
+                    // path that bites in practice because ask_user is common.
+                    await this.answerUnansweredToolCalls(m);
                     throw Object.assign(new Error("waiting for user"), { name: "WaitForUser" });
                 }
                 if (call.function.name === "get_todo") {
@@ -1716,8 +1833,23 @@ export class Agent {
                 });
                 const t0 = Date.now();
                 // first filesystem touch creates a missing workspace (never at boot)
-                await this.ensureWorkspace();
-                const result = await executeTool(call.function.name, call.function.arguments, this.toolCtx);
+                // #54: this is awaited BETWEEN the tool_call append above and the
+                // tool_result append below, and `fs.mkdir` has no catch — so a failure
+                // propagated out of the whole loop, leaving the call logged with no
+                // result ANYWHERE, and its row read "waiting for output…" for good.
+                //
+                // The loop's own backstop could not save it: it sits at the bottom of
+                // the same loop, which a throw skips. So the tool_result is written in a
+                // `finally` — the call is answered whatever happens.
+                // the type is inferred from executeTool, so this cannot drift from it
+                let result;
+                try {
+                    await this.ensureWorkspace();
+                    result = await executeTool(call.function.name, call.function.arguments, this.toolCtx);
+                }
+                catch (err) {
+                    result = { ok: false, result: `tool could not run: ${err.message}` };
+                }
                 this.stats.toolCalls++;
                 await this.log.append("tool_result", this.currentSession, this.currentBranch, {
                     callId: call.id,
@@ -1743,6 +1875,20 @@ export class Agent {
                         `(last: ${call.function.name})`);
                 }
             }
+            // #76: every tool_call an assistant message issued must have a matching
+            // tool result, or the provider REJECTS the next request — which is the
+            // "`200 with no choices`" shape #50 traced to a malformed history.
+            //
+            // Two exits could leave some unanswered: `stopRequested` returns early
+            // mid-batch, and a handler that throws (ask_user parking the loop is the
+            // one that bites in practice) propagates out of the whole loop. Restore
+            // has a hole-filler for exactly this; the LIVE array did not, so a session
+            // that hit it produced an invalid next request and then failed with
+            // something that looked like a provider fault.
+            //
+            // So the invariant is enforced here rather than at each exit: whatever
+            // happened, answer what is still outstanding before moving on.
+            await this.answerUnansweredToolCalls(m);
             if (finished)
                 return true;
         }
@@ -1750,6 +1896,37 @@ export class Agent {
         // nudges the model; this round simply ends (no hard error)
         return finished;
     }
+    /**
+     * Append a tool result for every tool_call in `m` that has not been answered.
+     *
+     * Scans the tail of `messages` for `tool_call_id`s, so it is correct whichever
+     * path left the batch unfinished — a stop, a throw, or a normal completion
+     * where a handler returned early. Answered calls are left alone.
+     */
+    async answerUnansweredToolCalls(m) {
+        const calls = m.tool_calls ?? [];
+        if (!calls.length)
+            return;
+        const answered = new Set();
+        for (const existing of this.messages) {
+            if (existing.role === "tool" && existing.tool_call_id)
+                answered.add(existing.tool_call_id);
+        }
+        for (const call of calls) {
+            if (answered.has(call.id))
+                continue;
+            const content = "(not completed — the tool did not run)";
+            this.messages.push({ role: "tool", tool_call_id: call.id, content });
+            await this.log.append("tool_result", this.currentSession, this.currentBranch, {
+                callId: call.id,
+                name: call.function.name,
+                ok: false,
+                durationMs: 0,
+                result: content,
+                synthesized: true,
+            });
+        }
+    }
     buildMessages() {
         // deliberately static: [system] + append-only history keeps prefix caches hot.
         // The workspace context block (AGENTS.md + ls snapshot) is appended to the
@@ -2139,7 +2316,7 @@ export class Agent {
      * protected so current work never loses its footing.
      */
     maybePrune() {
-        const est = this.lastUsage?.input ?? this.estimateTokens();
+        const est = this.contextSizeForBudgeting(); // floored — see #73
         const budget = this.opts.contextTokenBudget;
         if (!budget || est < budget * 0.6)
             return 0; // prune only when it matters
@@ -2199,7 +2376,7 @@ export class Agent {
         // for providers that omit usage
         // stage 1: clip oversized old tool outputs before considering a summarize
         this.maybePrune();
-        const before = this.lastUsage?.input ?? this.estimateTokens();
+        const before = this.contextSizeForBudgeting(); // floored — see #73
         if (!force && before < this.opts.contextTokenBudget)
             return;
         if (!force && this.opts.autoCompact === false)
@@ -2492,12 +2669,24 @@ export class Agent {
     async fork(fromEventId) {
         const newBranch = `br${this.branchCount()}${Date.now().toString(36).slice(-4)}`;
         const parentBranch = this.currentBranch;
-        await this.log.append("fork", this.currentSession, newBranch, {
+        // Where the fork leaves the source branch. Recorded on the event AND used
+        // to seed the new branch, so the two can never disagree.
+        const fromEvent = fromEventId ?? this.log.lastEventId(parentBranch);
+        // #69: the fork event must be appended under the SOURCE branch. Appending it
+        // under the new one gave it parent:null (nothing had been written to that
+        // branch yet), so lineageOf() walked an empty chain and a restart rebuilt
+        // the fork with NO history at all — the same class of bug editPromptAt had,
+        // fixed on one path only. editPromptAt already appends under the old
+        // branch for exactly this reason.
+        await this.log.append("fork", this.currentSession, parentBranch, {
             fromSession: this.currentSession,
             fromBranch: parentBranch,
-            fromEvent: fromEventId ?? this.log.lastEventId(parentBranch),
+            fromEvent,
             newBranch,
         });
+        // Seed the new branch's parent to the point it leaves the source, so its
+        // first event chains across instead of starting at parent:null.
+        this.log.seedBranch(newBranch, fromEvent);
         this.currentBranch = newBranch;
         this.messages = [...this.messages]; // independent history copy
         return { session: this.currentSession, branch: newBranch };

package/dist/agent/tools.js

@@ -3,7 +3,7 @@
  * Tool specs are plain JSON-schema function definitions — provider-agnostic.
  */
 import { spawn } from "node:child_process";
-import { existsSync, promises as fs, realpathSync } from "node:fs";
+import { existsSync, promises as fs, readlinkSync, realpathSync } from "node:fs";
 import path from "node:path";
 import { discoverSkills, isValidSkillName, readSkillFile, saveSkill, SKILL_FILE, } from "./skills.js";
 const str = (v, fallback = "") => (typeof v === "string" ? v : fallback);
@@ -16,6 +16,45 @@ function clip(s, max) {
 async function readText(p) {
     return fs.readFile(p, "utf8");
 }
+/**
+ * The file's dominant line ending, or null when it is mixed or empty.
+ *
+ * `null` means "do not normalise" — see the note above.
+ */
+export function detectEol(text) {
+    if (!text)
+        return null;
+    const crlf = (text.match(/\r\n/g) ?? []).length;
+    // a bare CR is a CR not followed by LF
+    const cr = (text.match(/\r(?!\n)/g) ?? []).length;
+    const lf = (text.match(/(?<!\r)\n/g) ?? []).length;
+    const kinds = [crlf, cr, lf].filter((n) => n > 0).length;
+    // one kind only -> unambiguous. Mixed -> null.
+    if (kinds !== 1)
+        return null;
+    if (crlf > 0)
+        return "\r\n";
+    if (cr > 0)
+        return "\r";
+    return "\n";
+}
+/** Split on ANY of the three line endings, dropping the terminators. */
+export function splitEolLines(text) {
+    return text.split(/\r\n|\r|\n/);
+}
+/**
+ * Re-apply `eol` to content the model supplied.
+ *
+ * Models emit `\n` essentially always, so a CRLF or CR file rewritten with LF
+ * content would otherwise be silently converted. Untouched terminators already
+ * in the right form are left alone, so this is safe to run on merged content.
+ */
+export function applyEol(content, eol) {
+    if (!eol || eol === "\n")
+        return content;
+    // normalise to \n first, then re-apply — avoids double-CR on "\r\n"
+    return content.replace(/\r\n|\r|\n/g, eol);
+}
 /**
  * Optimistic-concurrency guard (#5). The model reads a file, thinks, then
  * writes — and in between, a sub-agent, a background job or the operator may
@@ -60,14 +99,64 @@ export function safeJoin(cwd, p) {
     if (rel.startsWith("..") || path.isAbsolute(rel)) {
         throw new Error(`path escapes workspace: ${p}`);
     }
-    // symlinks inside the workspace can point anywhere — resolve the real
-    // target and confine THAT too (path.resolve alone doesn't follow links)
+    // symlinks inside the workspace can point anywhere — resolve the real target
+    // and confine THAT too (path.resolve alone doesn't follow links)
+    //
+    // #74: the old code resolved `abs` and swallowed a throw, treating failure as
+    // "fine". That is exactly backwards, and the failure is the NORMAL case:
+    // `realpathSync` throws ENOENT for a file that does not exist yet, which is
+    // every write_file creating something new. So `real` stayed as the LEXICAL
+    // path — which is inside the workspace — and the symlink guard never ran.
+    //
+    // Demonstrated: with `esc -> /outside` (a real directory), safeJoin allowed
+    // `esc/pwned.txt` and write_file wrote straight through it, landing outside
+    // the workspace. The dangling case happened to fail later with ENOTDIR, which
+    // is luck, not a control.
+    //
+    // So on ENOENT/ENOTDIR, resolve the nearest EXISTING ancestor instead of
+    // giving up. That still catches the escape — the ancestor IS the symlink —
+    // while allowing genuinely new files inside the workspace.
     let real = abs;
     try {
         real = realpathSync(abs);
     }
-    catch {
-        /* target may not exist yet (write_file) — lexical check above still holds */
+    catch (err) {
+        const code = err.code;
+        if (code === "ENOENT" || code === "ENOTDIR") {
+            // Walk up one component at a time. A component that is itself a SYMLINK
+            // must be resolved even when its target does not exist — realpathSync
+            // throws ENOENT for the dangling link itself, so naively walking to the
+            // first existing ancestor steps OVER the symlink and loses it. So read
+            // the link and check its target directly.
+            let probe = path.dirname(abs);
+            for (;;) {
+                try {
+                    real = realpathSync(probe);
+                    break;
+                }
+                catch (inner) {
+                    if (inner.code !== "ENOENT")
+                        break;
+                    // this component is a dangling symlink: resolve where it POINTS
+                    try {
+                        const target = readlinkSync(probe);
+                        real = path.isAbsolute(target) ? target : path.resolve(path.dirname(probe), target);
+                        break;
+                    }
+                    catch {
+                        /* not a symlink after all — keep walking */
+                    }
+                    const next = path.dirname(probe);
+                    if (next === probe)
+                        break; // reached the filesystem root
+                    probe = next;
+                }
+            }
+            // keep the un-resolved tail so the comparison below sees the full path
+            const tail = path.relative(probe, abs);
+            if (tail && !tail.startsWith(".."))
+                real = path.join(real, tail);
+        }
     }
     const relReal = path.relative(cwd, real);
     if (relReal.startsWith("..") || path.isAbsolute(relReal)) {
@@ -920,7 +1009,11 @@ export const TOOLS = [
                 };
             }
             ctx.onFileRead?.(str(args.path));
-            const lines = text.split("\n");
+            // #84: split on ALL THREE line endings. A CR-only (old-Mac) file used to
+            // come back as a single line, so the model could not address lines 2..n at
+            // all — and a CRLF file left a trailing "\r" on every line, which then
+            // had to be stripped again by every consumer.
+            const lines = splitEolLines(text);
             // #7/#4: opt-in hashline output. Default stays the historical `N| ` so
             // nothing that depends on it changes until the mode is chosen.
             const idMode = lineIdMode(args);
@@ -1006,8 +1099,25 @@ export const TOOLS = [
             if (stale)
                 return stale;
             await fs.mkdir(path.dirname(p), { recursive: true });
-            await fs.writeFile(p, args.content, "utf8");
-            return { ok: true, result: `wrote ${p} (${args.content.length} bytes)` };
+            // #84: a file's line endings belong to the FILE. Writing the model's
+            // content verbatim silently converted a CRLF (or CR) file to LF whenever
+            // the model rewrote it — the model never emits \r — so one logical edit
+            // produced a whole-file diff, and any tool that normalises on EOL (git,
+            // prettier) would rewrite it afterwards.
+            //
+            // So an EXISTING file's dominant EOL is re-applied. detectEol returns null
+            // for a mixed file, which is left untouched on purpose: choosing a winner
+            // there would itself be the silent whole-file rewrite this prevents.
+            const before = await currentOrNull(p);
+            const eol = before === null ? null : detectEol(before);
+            const out = applyEol(args.content, eol);
+            await fs.writeFile(p, out, "utf8");
+            const converted = eol !== null && eol !== "\n" && out !== args.content;
+            return {
+                ok: true,
+                result: `wrote ${p} (${out.length} bytes)` +
+                    (converted ? ` (kept ${eol === "\r\n" ? "CRLF" : "CR"} line endings)` : ""),
+            };
         },
     },
     {
@@ -1086,12 +1196,15 @@ export const TOOLS = [
                 const patLines = oldText.replace(/\r\n/g, "\n").split("\n");
                 const hits = trailingWsMatches(srcLines, patLines);
                 if (hits.length === 1 && patLines.length > 0) {
-                    const eol = text.includes("\r\n") ? "\r\n" : "\n";
+                    // #84: same detection as the hashline path — CR-only files are detected
+                    // too, and a MIXED file yields null and is left as-is rather than
+                    // homogenised. The old `includes("\r\n")` test called a CR-only file
+                    // "\n", so an edit to one silently converted its line endings.
                     const rebuilt = [
                         ...srcLines.slice(0, hits[0]),
-                        ...newText.replace(/\r\n/g, "\n").split("\n"),
+                        ...splitEolLines(newText),
                         ...srcLines.slice(hits[0] + patLines.length),
-                    ].join(eol);
+                    ].join(detectEol(text) ?? "\n");
                     await fs.writeFile(p, rebuilt, "utf8");
                     return {
                         ok: true,
@@ -1147,12 +1260,10 @@ export const TOOLS = [
             // emit \r).
             const eol = text.includes("\r\n") ? "\r\n" : "\n";
             const out = hashSpan
-                ? text
-                    .split("\n")
+                ? splitEolLines(text)
                     .slice(0, hashSpan.start)
-                    .concat(newText.replace(/\r\n/g, "\n").split("\n"), text.split("\n").slice(hashSpan.end))
-                    .join("\n")
-                    .replace(/(?<!\r)\n/g, eol)
+                    .concat(splitEolLines(newText), splitEolLines(text).slice(hashSpan.end))
+                    .join(eol ?? "\n")
                 : replaceAll
                     ? text.split(oldText).join(newText)
                     : text.replace(oldText, newText);

package/dist/master.js

@@ -229,6 +229,22 @@ function printAgentEvent(e) {
     if (line)
         console.log(`${dim(ts)} ${who} ${line}`);
 }
+/**
+ * Reduce an agent id to a safe single path segment.
+ *
+ * Agent ids become directory names, so anything path-like in one is an escape
+ * from the sessions root (#72). Kept in step with the per-call-site
+ * `.replace(/[^\w.-]/g, "-")` calls, and applied in `addAgent` too so the
+ * guarantee holds for every caller.
+ */
+export function sanitizeAgentId(id) {
+    const cleaned = String(id ?? "")
+        .replace(/[^\w.-]/g, "-")
+        // a leading dot would create a hidden dir; ".." would climb out
+        .replace(/^\.+/, "")
+        .slice(0, 60);
+    return cleaned || "agent";
+}
 export class Master {
     agents = new Map();
     /**
@@ -402,6 +418,21 @@ export class Master {
      * an older one's history.
      */
     async addAgent(ac, opts = {}) {
+        // #72: an agent id becomes a DIRECTORY name (sessions/<id>-<hash>), so it
+        // must be a safe path segment. Every caller sanitised its own id — the HTTP
+        // route, spawnChildFor's child name — except the ACP adapter, which passed
+        // the raw client string through, so `session/load {"sessionId":"../../x"}`
+        // created an agent logged outside <dataDir>/sessions/.
+        //
+        // Sanitised HERE as well as at the call sites: this is the one place that
+        // guarantees the property, so a future caller cannot reintroduce the escape
+        // by forgetting. A caller that already sanitised is unaffected — the
+        // transform is idempotent on a safe id.
+        const safeId = sanitizeAgentId(ac.id);
+        if (safeId !== ac.id) {
+            console.warn(`[teapot] agent id ${JSON.stringify(ac.id)} contained unsafe characters; using ${JSON.stringify(safeId)}`);
+        }
+        ac = { ...ac, id: safeId };
         if (this.agents.has(ac.id))
             throw new Error(`agent id already exists: ${ac.id}`);
         // provider resolution: inline overrides > named provider > legacy llm block
@@ -1246,9 +1277,30 @@ When this task is done (or truly blocked), call finish() with a summary for @${p
             // remove from map so a re-spawn after restart doesn't carry state
             this.agents.delete(id);
         });
-        const timeout = new Promise((_, reject) => setTimeout(() => reject(new Error("agent stop timeout")), timeoutMs));
-        await Promise.race([Promise.all(stopPromises), timeout]);
-        console.log("[teapot] all agents stopped");
+        // #79: two problems with racing a timeout against the real work.
+        //
+        // 1. The timer was never cleared, so it kept the event loop alive for the
+        //    FULL timeout after a fast, successful stop — a 30s handle on a stop
+        //    that took milliseconds.
+        // 2. On timeout, the promises that HAD completed had already deleted their
+        //    agents from `this.agents`, while their peers were still mid-dispose.
+        //    `restartServer` then threw BEFORE spawning its replacement, so the
+        //    process was left serving with a half-empty agent map and no successor.
+        //
+        // Fixed by clearing the timer, and by reporting which agents did NOT stop
+        // so the caller can decide rather than being left half-dead.
+        let timer;
+        const timeout = new Promise((_, reject) => {
+            timer = setTimeout(() => reject(new Error("agent stop timeout")), timeoutMs);
+        });
+        try {
+            await Promise.race([Promise.all(stopPromises), timeout]);
+            console.log("[teapot] all agents stopped");
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
     }
     /** Restart the server process (spawns a new master, keeps this one alive until ready). */
     async restartServer() {