const handleImproveSubmit = React.useCallback(
     async (userPrompt: string) => {
+      if (isLaunchingImproveSession) {
+        return;
+      }
       if (localHasUnsavedChanges) {
         showError(
           'Save or discard local edits first',
           'The agent can only improve the saved DAG definition that exists on disk.'
         );
         return;
       }

       setIsLaunchingImproveSession(true);
       clearAgentSession();
       setPendingUserMessage(userPrompt);

-      const { data: sessionData, error } = await client.POST('/agent/sessions', {
-        params: {
-          query: { remoteNode },
-        },
-        body: {
-          message: buildImproveDAGDefinitionPrompt({
-            dagFile: fileName,
-            dagName: data?.dag?.name || fileName,
-            latestDAGRun,
-            userPrompt,
-          }),
-          dagContexts: [
-            {
-              dagFile: fileName,
-              dagRunId: latestDAGRun?.dagRunId,
-            },
-          ],
-          safeMode: preferences.safeMode,
-        },
-      });
-
-      if (error || !sessionData) {
-        setPendingUserMessage(null);
-        setIsLaunchingImproveSession(false);
-        showError(
-          error?.message || 'Failed to start improvement session',
-          'Please try again after the agent service is available.'
-        );
-        return;
-      }
-
-      setSessionId(sessionData.sessionId);
-      setSessionState({
-        session_id: sessionData.sessionId,
-        working: true,
-      });
-      setIsImproveModalOpen(false);
-      setIsLaunchingImproveSession(false);
-      openChat();
+      try {
+        const { data: sessionData, error } = await client.POST('/agent/sessions', {
+          params: {
+            query: { remoteNode },
+          },
+          body: {
+            message: buildImproveDAGDefinitionPrompt({
+              dagFile: fileName,
+              dagName: data?.dag?.name || fileName,
+              latestDAGRun,
+              userPrompt,
+            }),
+            dagContexts: [
+              {
+                dagFile: fileName,
+                dagRunId: latestDAGRun?.dagRunId,
+              },
+            ],
+            safeMode: preferences.safeMode,
+          },
+        });
+
+        if (error || !sessionData) {
+          setPendingUserMessage(null);
+          showError(
+            error?.message || 'Failed to start improvement session',
+            'Please try again after the agent service is available.'
+          );
+          return;
+        }
+
+        setSessionId(sessionData.sessionId);
+        setSessionState({
+          session_id: sessionData.sessionId,
+          working: true,
+        });
+        setIsImproveModalOpen(false);
+        openChat();
+      } catch {
+        setPendingUserMessage(null);
+        showError(
+          'Failed to start improvement session',
+          'Please try again after the agent service is available.'
+        );
+      } finally {
+        setIsLaunchingImproveSession(false);
+      }
     },
     [
+      isLaunchingImproveSession,
       localHasUnsavedChanges,
       clearAgentSession,
       setPendingUserMessage,
       client,

 const MAX_PROBLEM_STEPS = 5;
 const MAX_VALUE_LENGTH = 240;
+const SENSITIVE_KEY_PATTERN =
+  /(pass(word)?|secret|token|api[-_]?key|authorization|credential|private[-_]?key)/i;

@@
 function formatParams(params: string): string {
   try {
-    return truncate(JSON.stringify(JSON.parse(params)));
+    return truncate(JSON.stringify(redactSensitive(JSON.parse(params))));
   } catch {
-    return truncate(cleanInline(params));
+    return truncate(maskInlineSecrets(cleanInline(params)));
   }
 }
+
+function redactSensitive(value: unknown): unknown {
+  if (Array.isArray(value)) {
+    return value.map(redactSensitive);
+  }
+  if (value && typeof value === 'object') {
+    return Object.fromEntries(
+      Object.entries(value as Record<string, unknown>).map(([key, val]) => [
+        key,
+        SENSITIVE_KEY_PATTERN.test(key) ? '[REDACTED]' : redactSensitive(val),
+      ])
+    );
+  }
+  return value;
+}
+
+function maskInlineSecrets(value: string): string {
+  return value.replace(
+    /\b(password|pass|secret|token|api[_-]?key|authorization|credential)\s*[:=]\s*([^\s,;]+)/gi,
+    '$1=[REDACTED]'
+  );
+}