Close TOCTOU window in withGlobalLock by retrying mkdir immediately
after removing a stale lock. Fix off-by-one in scanAndRegister where
maxDepth was exceeded by one level. Export normalizePath to eliminate
duplicate logic in list.ts, use a Set for faster dedup in scan, and
simplify the styles map to a plain object literal.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace the repoRoot/branch composite-key workaround with a Map keyed
directly by session objects. Also tighten the global lock to properly
throw on acquisition failure and fix prompt truncation at narrow widths.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Remove generic helper that obscured a three-line call site, flatten
try/catch nesting in backfillPrompts, and push results directly in
loadAll instead of collecting intermediate objects. Also export
normalizePath for use in actionRemove and drop redundant `acquired`
flag from the lock loop.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Consolidate on state.GlobalSession to eliminate redundant interface,
extract clearStaleReviews for clarity, and fix withGlobalLock to
explicitly throw when the lock cannot be acquired instead of
silently proceeding.
Simplify stale-lock recovery to just retry the loop instead of
nesting a second mkdir, and surface lock failures in actionRemove
rather than letting them propagate as unhandled exceptions.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace deprecated fs.exists with stat, wrap git calls in try/catch
to gracefully degrade to "idle" for inaccessible worktrees, and load
all projects concurrently in loadAll. Also fix stale-lock retry in
withGlobalLock to re-attempt mkdir immediately after cleanup.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Re-load state before clearing stale reviews to narrow the race window
with concurrent writers. Also fix missing await on withGlobalLock,
remove redundant mkdir and normalizePath calls, and reuse the existing
load() helper instead of duplicating file-reading logic in loadAll().
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The registry lock could spin silently forever on contention, worktrees
could vanish between runs, and loadAll swallowed errors from projects
whose state files were removed. Also skip symlinks during scan to avoid
cycles.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The separate actionAll function duplicated most of the listing logic.
Merging it simplifies status resolution by removing the key/repoRoot
indirection, fixes stale-review detection inline, and batches
scanAndRegister writes into a single lock acquisition. Also bumps the
stale lock timeout to 5 minutes and fixes normalizePath matching bare ~.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Move stale review flag outside the vm-running block so sessions
marked in_review are caught even when the VM is stopped. Extract
shared status-resolution logic into resolveAllStatuses to deduplicate
the list and list-all commands. Add stale lock detection to prevent
deadlocks from crashed processes, and include status in JSON output
for list-all.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Deduplicate status resolution, stale-review cleanup, and prompt
backfill between single-repo and all-repo list paths. Protect
the global registry file with a mkdir-based lock to prevent
concurrent read-modify-write races, and add a max-depth guard
to scanAndRegister.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Keying statuses by branch alone caused collisions when multiple repos
shared branch names. Key by repo/branch instead and auto-clear
in_review when Claude is no longer active. Also extract shared
rendering helpers, batch scanAndRegister writes, normalize paths
in the global registry, and move registerProject to setSession.
The old loadAll() walked ~/.sandlot/ and reverse-engineered repo roots
from .git worktree pointers, which was fragile and slow. A simple
registry (~/.sandlot/state.json) tracks known projects explicitly,
with commands to add, remove, and list across all of them.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The fire-and-forget patchSession calls in list could race with each
other, each reading stale state before writing. Collecting stale
branches and doing a single load-modify-save eliminates the race.
Also emits valid JSON (`[]`) when listing with --json and no sessions.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The mkdir-based lock was unreliable (stale lock recovery was racy) and
added latency. The atomic rename in save() already prevents corruption,
and concurrent writes to different keys are rare enough to not warrant
the complexity. Also inlines stale review self-healing into the map
callback and collapses the review try/catch/finally into just finally.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Parallel operations (e.g. stale review cleanup in `list`) could
clobber each other via read-modify-write on the shared state file.
Also fix spinner lifecycle in `review` and simplify empty-list output.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The load-modify-save pattern could overwrite concurrent state changes.
patchSession does an atomic read-patch-write, and the list command now
re-checks activity before clearing stale flags to avoid racing with a
review that just started.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The list command needs to show when a session is under active
review so users don't interrupt it. Wrapping the review body in
try/finally ensures the flag is always cleared on exit.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Implements all 7 commands: new, save, push, list, open, stop, rm.
Uses Commander for CLI parsing, Anthropic SDK for AI commit messages
and merge conflict resolution, and Apple container for VMs.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
