A dropped devpod tunnel kills the Claude session inside the workspace #672

A Claude session started in a dl workspace runs as a child of devpod's ssh tunnel. On the host that tunnel is one process:

docker exec -i -u root <container> sh -c '/usr/local/bin/devpod' helper ssh-server --stdio

Kill that process and the session inside the container dies with it, mid-turn. Nothing is left to reattach to.

What happened

On 2026-10-02 at 22:25:49 BST, a host command meant to kill one tunnel ran pkill -KILL -f "docker exec -i ". The variable that should have held the container id was empty, so the pattern matched every devpod tunnel on the host. All 9 Claude sessions running in dl workspaces died at once. The containers kept running. The work in their checkouts survived, but every in-flight turn and all session state was lost, and each session had to be restarted and re-briefed.

The command was the bug, and that host now blocks name-pattern kills. But a tunnel can also drop for ordinary reasons: a host-side crash, an OOM kill, a laptop suspend, a devpod restart. Each of those has the same result.

Ask

A dropped tunnel should drop only the connection to the session, not the session.

One way: when dl hands over an interactive shell or starts an agent, run it inside a terminal multiplexer in the container (tmux, or zellij, which the image setup already considered in #391). Attach with new-session -A or the equivalent, so a second dl <ws> re-attaches to the session that is still running instead of starting a new one. dl <ws> -- <cmd> should keep its subprocess contract (exit status, stdin and stdout are the command's), so it probably stays as it is, or gets an opt-in flag.

Questions for the design:

• How does this sit with the herdr work in herdr cannot see an agent inside a dl workspace: the hook arrives, its socket, binary and pane id do not #547 and Measure whether a session manager can already see into a workspace, before anything is built for it #549? If herdr becomes the session manager, does the multiplexer belong to it instead of to dl?
• Should a dead tunnel be detected and reported? Today the only sign is a session that is no longer there.