feat(environments): add archive undo and continue in new thread by ymichael · Pull Request #1016 · get-bb/bb

ymichael · 2026-08-04T22:34:31Z

Problem

Archiving the last live thread in a managed environment immediately destroyed its worktree. An accidental archive could lose uncommitted work, and a thread whose environment was already destroyed ended at a read-only dead end.

What changed

Lossless archive undo

Managed worktrees remain retiring for managedEnvironmentRetireGraceMs (10 seconds by default) before destruction.
The grace gate is durable across restart because it uses the environment row's lifecycle updatedAt.
Grace applies only while a non-deleted archived thread can still be revived; deleted/tombstoned-only environments clean up immediately.
The archive toast offers Undo for the same window.
Unarchiving a retiring environment emits the existing retire.cancelled transition and preserves the intact worktree, including uncommitted work.

Continue in a new thread after destruction

Destroyed environments remain terminal, and the source thread remains archived and read-only. Its banner offers Continue in new thread after cleanup finishes.

The handoff uses the ordinary new-thread flow:

seeds Continue from @thread:<id> as a rich thread mention;
targets the original host;
for managed worktrees, selects the destroyed environment's surviving branch as the new worktree base;
creates a fresh environment and a new uniquely named branch.

Committed work survives because the old branch remains in the source repository. Uncommitted and untracked work cannot be recovered after destruction.

Recovery fails closed if the original host, project source, or branch is unavailable instead of silently falling back. An explicit project/environment/branch change exits recovery mode. Unmanaged or branchless environments do not show the CTA.

Boundaries

No restore HTTP route, SDK/CLI command, or same-thread environment replacement.
No daemon wire behavior change or protocol-version bump.
No schema or migration change.
destroyed remains a terminal lifecycle state.
The only data-access addition is a targeted query for a revivable archived thread.

Testing

Affected-package typechecks: app, server, CLI, SDK, server contract, daemon contract, host workspace, plugin SDK, templates, and integration tests.
App coverage for handoff seed validation, banner priority/CTA, rich mention seeding, and compose targeting.
Server coverage for grace deferral, cancellation, expiry, restart recovery, and deletion.
Fake-host integration: commit work, archive/destroy the old worktree, create a new thread from the surviving branch, and verify the committed file reappears while the source thread/environment remain archived/destroyed.

Design notes: plans/environment-archive-grace-period-and-handoff.md.

SawyerHood · 2026-08-04T22:37:45Z

🚨 SLOP COP 🚨 · review

I am SlopCop. I am reviewing this pull request under the configured security, quality, performance, and end-to-end rules.

The stack contains PR #1016 only. I found no later pull request and skipped no pull request.

I will run the security, code quality and architecture, and performance reviews in parallel. I will test the complete stack after those reviews.

SawyerHood · 2026-08-04T22:44:44Z

🚨 SLOP COP 🚨 · review

Performance review complete. The database queries use suitable indexes, and the sweep cadence has no regression.

I found one low-impact concern. Undo repeats full thread-list cache invalidation for each archived thread. I will verify this concern during final synthesis.

SawyerHood · 2026-08-04T22:46:03Z

🚨 SLOP COP 🚨 · review

Security review complete. Command construction, indexes, concurrent restore claims, and the daemon protocol update look correct.

The review found two medium and two lower-impact concerns. They cover branch identity, restore validation order, the grace-period clock, and route guard consistency. I will verify each concern during final synthesis.

SawyerHood · 2026-08-04T22:53:58Z

🚨 SLOP COP 🚨 · review

Code quality and architecture review complete. I found no duplicate environment-restore service. The server, app, database, workspace, CLI, and SDK type checks passed.

The review found three medium concerns. They cover the public-thread guard, restore validation order, and Undo failure handling. It also found several low-impact cleanup items.

SawyerHood · 2026-08-04T22:55:24Z

+  if (
+    refreshedEnvironment.status === "retiring" &&
+    refreshedEnvironment.path !== null &&
+    Date.now() - refreshedEnvironment.updatedAt <


🚨 slopcop/review — The grace-period clock can move after retirement.

The environment metadata PATCH route can update a retiring row, and updateEnvironmentMetadataRecord always writes a new updatedAt. Repeated metadata writes can extend this grace check without limit. Store the retirement time separately, or prevent metadata updates from changing the cleanup clock.

SawyerHood · 2026-08-04T22:55:24Z

+        action: {
+          label: "Undo",
+          onClick: () => {
+            void Promise.all(


🚨 slopcop/review — A partial Undo failure leaves restored threads absent from the sidebar.

Promise.all rejects when one unarchive request fails. The .then block then settles no cache entry, even when other requests succeeded. The successful path also repeats broad list invalidation once per thread. Use Promise.allSettled, report failures, settle each detail entry, and invalidate the list keys once.

SawyerHood · 2026-08-04T22:55:24Z

    return context.json({ ok: true });
  });

+  post(routes.restoreEnvironment, async (context) => {


🚨 slopcop/review — This route omits the public-thread boundary check used by sibling actions.

The service checks thread.deletedAt, but it does not reject a thread whose project has entered soft deletion. A restore can therefore create a worktree while the project deletion sweep removes project environments. Call requirePublicThread at this route boundary before the restore service.

SawyerHood · 2026-08-04T22:55:24Z

+  }
+
+  if (thread.archivedAt !== null) {
+    unarchiveThread(deps.db, deps.hub, thread.id);


🚨 slopcop/review — Restore changes archive state before it validates the request.

The later destroying, missing-environment, unmanaged, and non-writable checks can return 409 after this call unarchives the thread. The restore path also does not send the provider unarchive command that the normal unarchive route sends. Validate first, then use one shared unarchive operation on successful restore paths.

SawyerHood · 2026-08-04T22:55:24Z

+    sourcePath: source.path,
+    baseBranch: storedBaseBranchNameToSpec(destroyed.baseBranch),
+    workspaceProvisionType: "managed-worktree",
+    ...(destroyed.branchName ? { branchName: destroyed.branchName } : {}),


🚨 slopcop/review — Restore can select the last polled branch instead of the managed branch.

callEnvironmentWorkspaceStatus writes the current checkout into environment.branchName. If a user checked out main, this restore request selects main. The worktree add can then fail because another worktree owns main, or it can restore the thread onto the shared default branch. Persist the managed branch identity separately and restore from that stable value.

SawyerHood · 2026-08-04T22:55:49Z

🚨 SLOP COP 🚨 · review

End-to-end review complete on the top pull request. I created a managed thread, archived it, and confirmed that Undo revived the retiring worktree.

I then let cleanup destroy the worktree. The browser showed Restore environment, and that action created a new managed worktree. The thread returned to idle without a new agent turn.

SawyerHood

🚨 SLOP COP 🚨 · review

Review complete for stack PR #1016. I posted five inline findings.

Medium: Restore uses a mutable, polled branch value instead of a stable managed branch identity.
Medium: Restore unarchives before validation and does not synchronize provider archive state.
Medium: The restore route omits the shared public-thread guard.
Medium: A partial Undo failure leaves successful unarchives absent from the sidebar.
Low: Environment metadata writes can extend the retirement grace clock.

The architecture scan found no duplicate restore service. The new query uses an existing suitable index. The daemon protocol version increased correctly.

I tested the live product at the pull request head. Archive Undo preserved the worktree during grace. Restore created a new worktree after destruction and returned the thread to idle.

Focused local suites passed 241 tests. Six package type checks passed. All current GitHub checks pass.

I submitted a comment review only. I did not approve or request changes.

ymichael mentioned this pull request Aug 4, 2026

feat(environments): archive grace period + Restore environment #242

Closed

SawyerHood reviewed Aug 4, 2026

View reviewed changes

ymichael force-pushed the bb/restore-environment-archive-grace-period-thr_ufty6npytm branch from 9f70124 to d07b36b Compare August 7, 2026 21:45

ymichael changed the title ~~feat(environments): archive grace period + Restore environment~~ feat(environments): add archive undo and continue in new thread Aug 7, 2026

ymichael added 2 commits August 7, 2026 16:00

feat(environments): add archive undo and continue in new thread

31a62f5

fix(app): stabilize handoff branch selection

ed16cd6

ymichael force-pushed the bb/restore-environment-archive-grace-period-thr_ufty6npytm branch from 685460b to ed16cd6 Compare August 7, 2026 23:01

ymichael added 4 commits August 7, 2026 16:10

fix(app): consolidate archive feedback toast

ff2f45c

fix(app): clarify archived environment banner

22bee37

fix(environments): extend archive grace period

4cafb1d

fix(app): keep archive undo toast brief

97064a2

Navigation Menu

Uh oh!

feat(environments): add archive undo and continue in new thread - #1016

feat(environments): add archive undo and continue in new thread#1016
ymichael wants to merge 6 commits into
mainfrom
bb/restore-environment-archive-grace-period-thr_ufty6npytm

ymichael commented Aug 4, 2026 •

edited

Loading

Uh oh!

SawyerHood commented Aug 4, 2026 •

edited

Loading

Uh oh!

SawyerHood commented Aug 4, 2026

Uh oh!

SawyerHood commented Aug 4, 2026

Uh oh!

SawyerHood commented Aug 4, 2026

Uh oh!

SawyerHood Aug 4, 2026

Uh oh!

SawyerHood Aug 4, 2026

Uh oh!

SawyerHood Aug 4, 2026

Uh oh!

SawyerHood Aug 4, 2026

Uh oh!

SawyerHood Aug 4, 2026

Uh oh!

SawyerHood commented Aug 4, 2026

Uh oh!

SawyerHood left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

ymichael commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

What changed

Lossless archive undo

Continue in a new thread after destruction

Boundaries

Testing

Uh oh!

SawyerHood commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

SawyerHood commented Aug 4, 2026

Uh oh!

SawyerHood commented Aug 4, 2026

Uh oh!

SawyerHood commented Aug 4, 2026

Uh oh!

SawyerHood Aug 4, 2026

Choose a reason for hiding this comment

Uh oh!

SawyerHood Aug 4, 2026

Choose a reason for hiding this comment

Uh oh!

SawyerHood Aug 4, 2026

Choose a reason for hiding this comment

Uh oh!

SawyerHood Aug 4, 2026

Choose a reason for hiding this comment

Uh oh!

SawyerHood Aug 4, 2026

Choose a reason for hiding this comment

Uh oh!

SawyerHood commented Aug 4, 2026

Uh oh!

SawyerHood left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ymichael commented Aug 4, 2026 •

edited

Loading

SawyerHood commented Aug 4, 2026 •

edited

Loading