fix: prevent session restart loops from process lifecycle races (#379)

Four fixes for race conditions that could cause sessions to repeatedly
exit with SIGTERM (code 143) and burn through auto-restart attempts:

- Broaden pkill orphan cleanup to match both --resume and --session-id
  flags, and replace unreliable \b with POSIX-safe (\s|$)
- Switch setProvider to stopClaudeAndWait instead of fire-and-forget
  stopClaude with a 500ms delay
- Clear pending _restartTimer in setModel/setProvider/setPermissionMode
  to prevent stale crash timers from spawning duplicate processes
- Wrap _isStarting flag in try/finally in sendInput to prevent permanent
  session lockout if startClaude throws

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: alari76

server/claude-process.ts

@@ -213,11 +213,16 @@ export class ClaudeProcess extends EventEmitter<ClaudeProcessEvents> implements
     ]
     // Kill any orphaned Claude process still holding this session ID's lock.
     // This can happen when the server restarts and old children survive (SIGKILL'd
-    // or reparented to init). Without this, --resume fails with "already in use".
-    // Uses the full binary path + exact session UUID to avoid matching unrelated processes.
+    // or reparented to init), or when startClaude() replaces a running process
+    // without waiting for the old one to exit.  Without this, --resume fails
+    // with "already in use".
+    // Match both --resume and --session-id because the orphan may have been
+    // started with either flag depending on whether it was a first start or
+    // a resume.  Uses the full binary path + exact session UUID to avoid
+    // matching unrelated processes.
     if (this.resume) {
       try {
-        const pattern = `${CLAUDE_BINARY} .*--resume ${this.sessionId}\\b`
+        const pattern = `${CLAUDE_BINARY} .*(--resume|--session-id) ${this.sessionId}(\\s|$)`
         execFileSync('pkill', ['-f', pattern], { timeout: 2000, stdio: 'ignore' })
       } catch {
         // pkill exits 1 when no matching process is found — that's the happy path

server/session-manager.ts

@@ -1112,8 +1112,11 @@ export class SessionManager {
       // Claude not running (e.g. after server restart or idle reap) — auto-start first.
       // Claude CLI in -p mode waits for first input before emitting init,
       // so we write directly to the stdin pipe buffer (no waiting for init).
-      this.startClaude(sessionId)
-      session._isStarting = false
+      try {
+        this.startClaude(sessionId)
+      } finally {
+        session._isStarting = false
+      }
 
       // If we have a saved claudeSessionId, Claude CLI resumes with full
       // conversation history from its own session storage — no need for our
@@ -1203,15 +1206,19 @@ export class SessionManager {
     if (session.provider === provider) return true
     session.provider = provider
     session.claudeSessionId = null
+    // Clear any pending restart timer from a prior crash to prevent a stale
+    // timer from spawning a second process after we restart below.
+    if (session._restartTimer) { clearTimeout(session._restartTimer); session._restartTimer = undefined }
     this.persistToDiskDebounced()
     if (session.claudeProcess?.isAlive()) {
-      this.stopClaude(sessionId)
-      session._stoppedByUser = false
-      setTimeout(() => {
-        if (this.sessions.has(sessionId) && !session._stoppedByUser) {
+      // Use stopClaudeAndWait to ensure the old process fully exits before
+      // spawning a new one — avoids concurrent processes in the same worktree.
+      void this.stopClaudeAndWait(sessionId).then(() => {
+        if (this.sessions.has(sessionId)) {
+          session._stoppedByUser = false
           this.startClaude(sessionId)
         }
-      }, 500)
+      })
     }
     return true
   }
@@ -1221,6 +1228,9 @@ export class SessionManager {
     const session = this.sessions.get(sessionId)
     if (!session) return false
     session.model = model || undefined
+    // Clear any pending restart timer from a prior crash to prevent a stale
+    // timer from spawning a second process after we restart below.
+    if (session._restartTimer) { clearTimeout(session._restartTimer); session._restartTimer = undefined }
     this.persistToDiskDebounced()
     // Restart Claude with the new model if it's running.
     // Use stopClaudeAndWait to ensure the old process fully exits before
@@ -1242,6 +1252,9 @@ export class SessionManager {
     if (!session) return false
     const previousMode = session.permissionMode
     session.permissionMode = permissionMode
+    // Clear any pending restart timer from a prior crash to prevent a stale
+    // timer from spawning a second process after we restart below.
+    if (session._restartTimer) { clearTimeout(session._restartTimer); session._restartTimer = undefined }
     this.persistToDiskDebounced()
 
     // Audit log for dangerous mode changes