Consolidate on state.GlobalSession to eliminate redundant interface,
extract clearStaleReviews for clarity, and fix withGlobalLock to
explicitly throw when the lock cannot be acquired instead of
silently proceeding.
Simplify stale-lock recovery to just retry the loop instead of
nesting a second mkdir, and surface lock failures in actionRemove
rather than letting them propagate as unhandled exceptions.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace deprecated fs.exists with stat, wrap git calls in try/catch
to gracefully degrade to "idle" for inaccessible worktrees, and load
all projects concurrently in loadAll. Also fix stale-lock retry in
withGlobalLock to re-attempt mkdir immediately after cleanup.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Re-load state before clearing stale reviews to narrow the race window
with concurrent writers. Also fix missing await on withGlobalLock,
remove redundant mkdir and normalizePath calls, and reuse the existing
load() helper instead of duplicating file-reading logic in loadAll().
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The registry lock could spin silently forever on contention, worktrees
could vanish between runs, and loadAll swallowed errors from projects
whose state files were removed. Also skip symlinks during scan to avoid
cycles.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The separate actionAll function duplicated most of the listing logic.
Merging it simplifies status resolution by removing the key/repoRoot
indirection, fixes stale-review detection inline, and batches
scanAndRegister writes into a single lock acquisition. Also bumps the
stale lock timeout to 5 minutes and fixes normalizePath matching bare ~.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Move stale review flag outside the vm-running block so sessions
marked in_review are caught even when the VM is stopped. Extract
shared status-resolution logic into resolveAllStatuses to deduplicate
the list and list-all commands. Add stale lock detection to prevent
deadlocks from crashed processes, and include status in JSON output
for list-all.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Deduplicate status resolution, stale-review cleanup, and prompt
backfill between single-repo and all-repo list paths. Protect
the global registry file with a mkdir-based lock to prevent
concurrent read-modify-write races, and add a max-depth guard
to scanAndRegister.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Keying statuses by branch alone caused collisions when multiple repos
shared branch names. Key by repo/branch instead and auto-clear
in_review when Claude is no longer active. Also extract shared
rendering helpers, batch scanAndRegister writes, normalize paths
in the global registry, and move registerProject to setSession.
The old loadAll() walked ~/.sandlot/ and reverse-engineered repo roots
from .git worktree pointers, which was fragile and slow. A simple
registry (~/.sandlot/state.json) tracks known projects explicitly,
with commands to add, remove, and list across all of them.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The idle state is now determined by the absence of activity
heartbeats rather than an explicit hook signal, which is more
reliable when the process exits unexpectedly.
REBASE_HEAD can linger after an interrupted rebase, causing false positives.
Checking rebase-merge/ and rebase-apply/ directories matches how git itself
determines rebase state. Also surface rebase failures in the CLI spinner
instead of letting them propagate as unhandled exceptions.
The config command already parsed the key but ignored it when calling
set() and printing the result. Also clarify sync vs async convention
in CLAUDE.md and log invalid memory config instead of silently falling
back.
The config command previously maintained a separate key list and used a
switch statement that would need updating for each new key. Deriving
VALID_KEYS from config.DEFAULTS keeps them in sync automatically.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The validator is now reusable by both the CLI config command and
the VM startup path, which falls back to the default if the stored
value is invalid. Also lowers the default memory limit to 16G and
makes config.load() resilient to malformed JSON.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Eliminates duplicated default values and simplifies the config
command by replacing the generic key metadata registry with
direct validation functions.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Move defaults and normalization into KEYS metadata, validate config
file shape on load, and lower default container memory from 32G to 16G.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Allow users to configure container memory limit (default 32G) via
`sandlot config memory <value>` instead of hardcoding it.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Speeds up repeated cargo builds across sessions by caching
compilation artifacts on the persistent mount.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Collapse redundant empty-session branch so --json falls through to the
normal serialization path instead of printing "[]" separately. Replace
per-branch load/save loop with a single state cycle to avoid racing
concurrent writes.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Batch-clearing stale flags in list and blindly writing back the session
in review could clobbер concurrent changes. Use per-session get/set
instead of whole-state load/save, and re-read before clearing in_review.
The fire-and-forget patchSession calls in list could race with each
other, each reading stale state before writing. Collecting stale
branches and doing a single load-modify-save eliminates the race.
Also emits valid JSON (`[]`) when listing with --json and no sessions.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The mkdir-based lock was unreliable (stale lock recovery was racy) and
added latency. The atomic rename in save() already prevents corruption,
and concurrent writes to different keys are rare enough to not warrant
the complexity. Also inlines stale review self-healing into the map
callback and collapses the review try/catch/finally into just finally.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Parallel operations (e.g. stale review cleanup in `list`) could
clobber each other via read-modify-write on the shared state file.
Also fix spinner lifecycle in `review` and simplify empty-list output.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The load-modify-save pattern could overwrite concurrent state changes.
patchSession does an atomic read-patch-write, and the list command now
re-checks activity before clearing stale flags to avoid racing with a
review that just started.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Reload fresh state before saving to avoid overwriting concurrent changes
from other processes between the initial load and the heal write.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Use already-loaded state in list command instead of re-reading. In review
command, patch in_review on fresh state to avoid clobbering concurrent
changes, and skip worktree save in print mode. Remove unused white import
and unnecessary nullish coalescing fallback.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Move in_review flag set before try block so it is always visible,
and consolidate per-session state writes into a single batch to
avoid repeated disk I/O during list. Also guard against missing
status entries with fallback defaults.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Move in_review flag set inside try block so finally always clears it,
and actively clear stale flags in list when Claude is no longer active.
Previously a crash between setting the flag and entering try would
leave the session stuck in review state.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Review status now requires Claude to be active, preventing stale flags
from showing after a crash. Consolidates icon/color maps into a single
styles record and defers setting in_review until the container is up.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The list command needs to show when a session is under active
review so users don't interrupt it. Wrapping the review body in
try/finally ensures the flag is always cleared on exit.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
PostToolUseFailure incorrectly marked the session idle on transient tool
errors. PreToolUse keeps the active signal fresh throughout tool execution,
while Stop alone handles the transition to idle.
