claude-code-session-manager 0.104.1 → 0.105.0

package/src/main/historyAggregator.cjs

@@ -92,7 +92,12 @@ async function mapWithConcurrency(items, limit, fn) {
 
 // ── date helpers ──────────────────────────────────────────────────────────────
 
-function decodeCwd(encoded) {
+function decodeCwd(encoded, platform = process.platform) {
+  // encodeCwd turns `C:\\Users\\Me` into `C--Users-Me`: drive letter, then `--`.
+  if (platform === 'win32') {
+    const m = /^([A-Za-z])--(.*)$/.exec(encoded);
+    if (m) return m[1] + ':\\' + m[2].replace(/-+/g, '\\');
+  }
   return '/' + encoded.replace(/-+/g, '/');
 }
 
@@ -944,6 +949,7 @@ module.exports = {
   remote,
   MODEL_PRICING,
   finalizeClosedDays,
+  decodeCwd,
   refreshIntradayToday,
   computeIntradayBuckets,
   // exported for tests

package/src/main/index.cjs

@@ -11,6 +11,7 @@ const fsp = require('node:fs/promises');
 const os = require('node:os');
 const { schemas, validated } = require('./ipcSchemas.cjs');
 const { cleanChildEnv } = require('./lib/cleanEnv.cjs');
+const { applyLoginShellPath } = require('./lib/loginShellPath.cjs');
 const { terminateLosingInstance } = require('./lib/singleInstanceGuard.cjs');
 const { acquireSchedulerOwnership, releaseSchedulerOwnership } = require('./lib/instanceLock.cjs');
 const { manager: ptyManager, registerPtyHandlers } = require('./pty.cjs');
@@ -101,7 +102,8 @@ const { registerDocEditHandlers, attachWindow: attachDocEditWindow } = require('
 const { listExchanges } = require('./exchanges.cjs');
 const { resolveClaudeBin } = require('./lib/claudeBin.cjs');
 const { checkInsideHome, assertInsideHome } = require('./lib/insideHome.cjs');
-const { openInEditor, openFileInEditor, openInFinder, openInTerminal } = require('./lib/openExternalApp.cjs');
+const { openInEditor, openFileInEditor, openInFinder, openInTerminal, runInTerminal } = require('./lib/openExternalApp.cjs');
+const { checkPrereqs } = require('./lib/prereqs.cjs');
 const { rebuildActiveIndex } = require('./lib/activeIndexRebuild.cjs');
 const { activeIndexPath: promptSessionsActiveIndexPath } = require('./lib/epicMint.cjs');
 const { allProjectCwds } = require('./lib/activeSessions.cjs');
@@ -266,6 +268,8 @@ function writeFirstPaintFailureLog() {
   }
 }
 
+const { isPackagedApp } = require('./lib/appRuntime.cjs');
+
 function resolveNpx() {
   const isWin = process.platform === 'win32';
   try {
@@ -373,6 +377,14 @@ async function performReboot() {
   // Bounded-lifetime marker: the watchdog must not relaunch a second instance
   // during this deliberate exit window (single-instance-lock race).
   upgradeDrain.markRestarting();
+  if (isPackagedApp()) {
+    // Installer build: no npx — restart the app binary in place.
+    logReboot('packaged build: app.relaunch()');
+    app.relaunch();
+    runShutdownCleanup();   // app.exit bypasses will-quit
+    app.exit(0);
+    return;
+  }
   let childOk = false;
   try {
     const child = relaunchViaNpx();
@@ -715,6 +727,15 @@ ipcMain.handle('app:engage-rules-path', () => process.env.SESSION_MANAGER_ENGAGE
 // on disk or the home self-check failed (e.g. macOS /Users symlink mismatch).
 ipcMain.handle('app:claude-bin-status', () => bootClaudeBin);
 ipcMain.handle('app:home-self-check', () => bootHomeSelfCheck);
+ipcMain.handle('app:prereqs', async () => await checkPrereqs());
+// Renderer sends only an id; the command always comes from a fresh main-side probe.
+ipcMain.handle('app:prereqs-run-fix', async (_e, id) => {
+  const items = await checkPrereqs();
+  const item = typeof id === 'string' ? items.find((i) => i.id === id) : undefined;
+  if (!item) throw new Error(`unknown prereq id: ${String(id)}`);
+  if (!item.fix || !item.fix.command) throw new Error(`prereq ${id} has no fix command`);
+  return runInTerminal({ command: item.fix.command, shell: item.fix.shell });
+});
 // First-boot seeder outcomes ('done' | 'pending' | 'exhausted' per seeder),
 // read live from each seeder's own marker file — see seedStatus.cjs.
 ipcMain.handle('app:seed-status', () => getSeedStatus());
@@ -1190,6 +1211,18 @@ app.whenReady().then(async () => {
     onSuspendWhileAlive: () => { stopSystemdInhibit(); startSystemdInhibit(); },
   });
 
+  // A Finder/Dock-launched packaged app inherits a minimal PATH; adopt the
+  // login shell's so node/git/claude resolve like in the user's terminal.
+  // Must run before resolveClaudeBin() and before any pty/scheduler/MCP spawn.
+  if (process.platform !== 'win32' && process.env.SM_SKIP_LOGIN_SHELL_PATH !== '1') {
+    try {
+      const loginPath = await applyLoginShellPath();
+      logs.writeLine({ scope: 'main', level: 'info', message: 'login-shell PATH', meta: loginPath });
+    } catch (err) {
+      logs.writeLine({ scope: 'main', level: 'warn', message: 'login-shell PATH failed', meta: { error: String(err && err.message || err) } });
+    }
+  }
+
   // Boot-time detection 1: surface `claude` binary resolution so a missing
   // install becomes visible to the renderer instead of failing silently on
   // first spawn attempt.

package/src/main/lib/activeSessions.cjs

@@ -9,6 +9,7 @@
 // which PRD 356-retire purges along with its capture hook.
 
 const fs = require('node:fs');
+const fsp = require('node:fs/promises');
 const os = require('node:os');
 const path = require('node:path');
 const { KIND_CONFIG: WORKTREE_KIND_CONFIG } = require('./gitWorktree.cjs');
@@ -43,13 +44,14 @@ const TAIL_BYTES = 64 * 1024;
 // Safety cap on distinct cwds to bound result set size. O(1) extra space.
 const MAX_CWDS = 50;
 
-// activeProjectCwds' scan is a readdirSync of every dir under ~/.claude
-// /projects (2209 dirs / 8.8 GB observed) plus a statSync per transcript —
-// ~270 ms warm. reconcile() calls into it (directly or via allProjectCwds)
-// several times per pass, so cache the resolved cwd list keyed on the
-// resolved argument TUPLE (projectsDir, maxAgeMin, maxCwds) — never on
-// `!opts`, since allProjectCwds always constructs an options object and that
-// guard would cache nothing on the hottest path.
+// The disk scan (readdirSync of every dir under ~/.claude/projects — 2209
+// dirs / 8.8 GB observed — plus a statSync per transcript, ~270 ms warm) is
+// the expensive part. allProjectCwds() and activeProjectCwds() used to each
+// pay their own full scan under separate (projectsDir, maxAgeMin, maxCwds)
+// cache keys even though they read the same on-disk facts. Now the scan runs
+// ONCE per projectsDir and is cached as a flat per-project record
+// {rawCwd, newestMtimeMs}; every view (any maxAgeMin/maxCwds combination)
+// filters/sorts that one record in memory instead of touching disk again.
 //
 // Invalidation: projectsDir's own mtime (bumps when a project DIRECTORY is
 // added/removed — NOT when an existing transcript gains a line, which is
@@ -58,13 +60,20 @@ const MAX_CWDS = 50;
 // scheduler/prdParser.cjs's dirCache and queueHistory.cjs's historyCacheKey.
 // TTL sits above the 60 s dispatch-loop interval (scheduler POLL_INTERVAL_MS) so
 // one pass never re-scans cold. Cached arrays are frozen — shared, never mutated.
+// Stale-while-revalidate: once a projectsDir has been scanned at least once,
+// an expired cache entry is served to the (synchronous) caller as-is, and at
+// most one background fs.promises rescan is kicked off to refresh it. Only
+// the very first scan of a given projectsDir pays the synchronous cost —
+// every expiry after that is a cache read plus a fire-and-forget refresh.
 const CACHE_TTL_MS = 120_000;
+// Bounds how many project dirs the async rescan reads concurrently.
+const RESCAN_CONCURRENCY = 32;
 const EMPTY_CWDS = Object.freeze([]);
-const cwdScanCache = new Map(); // key -> { dirMtimeMs, cachedAt, result }
+const rawScanCache = new Map(); // projectsDir -> { dirMtimeMs, cachedAt, records, refreshPromise }
 
 /** Forces the next activeProjectCwds/allProjectCwds call to rescan. */
 function bustProjectCwdCache() {
-  cwdScanCache.clear();
+  rawScanCache.clear();
 }
 
 // The ops-root folder name. A transcript's `cwd` can point INSIDE it whenever
@@ -120,42 +129,231 @@ function readTailLines(filePath, maxBytes) {
 }
 
 /**
- * activeProjectCwds(maxAgeMin = 90, opts?) → string[]
- *
- * Returns distinct, on-disk project cwds that have an open/active session
- * within the last maxAgeMin minutes.
- *
- * Sole detection path: scan ~/.claude/projects/*​/  for transcript *.jsonl
- *   files modified within maxAgeMin, read `cwd` from the last parseable line
- *   of the newest transcript per project dir.
- *   Complexity: O(P × L) over P project dirs, each bounded-tail read (64 KB).
+ * scanOneProjectDirSync(projDir) → {rawCwd, newestMtimeMs} | null
+ * Newest *.jsonl's mtime plus its last parseable `cwd`, for one project dir.
+ */
+function scanOneProjectDirSync(projDir) {
+  let entries;
+  try {
+    entries = fs.readdirSync(projDir).filter((f) => f.endsWith('.jsonl'));
+  } catch { return null; }
+
+  let newestPath = null;
+  let newestMtimeMs = 0;
+  for (const tf of entries) {
+    const fp = path.join(projDir, tf);
+    try {
+      const st = fs.statSync(fp);
+      if (st.mtimeMs > newestMtimeMs) {
+        newestMtimeMs = st.mtimeMs;
+        newestPath = fp;
+      }
+    } catch { continue; }
+  }
+  if (!newestPath) return null;
+
+  const tlines = readTailLines(newestPath, TAIL_BYTES);
+  let rawCwd = null;
+  for (let i = tlines.length - 1; i >= 0; i--) {
+    let row;
+    try { row = JSON.parse(tlines[i]); } catch { continue; }
+    if (row.cwd) { rawCwd = row.cwd; break; }
+  }
+  return rawCwd ? { rawCwd, newestMtimeMs } : null;
+}
+
+/**
+ * scanProjectsDir(projectsDir) → {rawCwd, newestMtimeMs}[] | null
  *
- * opts (for testing):
- *   projectsDir   — override the default ~/.claude/projects path
- *   tmpDropRoots  — override the tmp guard's drop roots (default TMP_DROP_ROOTS)
+ * The first scan of a given projectsDir is synchronous (readdirSync of
+ * projectsDir, then per project dir as above) and its result is cached.
+ * A fresh cache entry (same dirMtimeMs, within TTL) is returned as-is.
+ * Once the dir's own mtime changes (a project dir was added/removed), the
+ * next call rescans synchronously and returns the new result — a stale
+ * record would otherwise hide a just-registered project from this caller.
+ * Only when dirMtimeMs is unchanged and the TTL has expired is the stale
+ * record returned as-is, with startAsyncRefresh kicking off at most one
+ * background fs.promises rescan to refresh it for the next caller. Returns
+ * null when projectsDir is missing/unreadable and no record has ever been
+ * cached for it.
  */
-function activeProjectCwds(maxAgeMin = 90, {
-  projectsDir = path.join(HOME, '.claude', 'projects'),
-  maxCwds = MAX_CWDS,
-  tmpDropRoots = TMP_DROP_ROOTS,
-} = {}) {
-  const cacheKey = [projectsDir, maxAgeMin, maxCwds].join('|');
+function scanProjectsDir(projectsDir) {
   let dirMtimeMs;
   try {
     dirMtimeMs = fs.statSync(projectsDir).mtimeMs;
   } catch {
-    // Missing/unreadable dir: nothing to scan, and any prior cache entry for
-    // this key must not survive to be handed back once the dir later
-    // appears — drop it rather than caching this empty result.
-    cwdScanCache.delete(cacheKey);
-    return EMPTY_CWDS;
+    // Missing/unreadable dir: any prior cache entry must not survive to be
+    // handed back once the dir later appears — drop it rather than caching
+    // this empty result.
+    rawScanCache.delete(projectsDir);
+    return null;
   }
-  const cached = cwdScanCache.get(cacheKey);
+  const cached = rawScanCache.get(projectsDir);
   const now0 = Date.now();
   if (cached && cached.dirMtimeMs === dirMtimeMs && now0 - cached.cachedAt < CACHE_TTL_MS) {
-    return cached.result;
+    return cached.records;
+  }
+
+  // Same mtime, TTL expired: a prior successful scan exists and the dir
+  // itself hasn't changed, so serve it stale and refresh in the background
+  // rather than blocking this synchronous caller.
+  if (cached && cached.dirMtimeMs === dirMtimeMs) {
+    startAsyncRefresh(projectsDir);
+    return cached.records;
+  }
+
+  // Either the first-ever scan of this projectsDir, or the dir's mtime
+  // changed (a project was added/removed) — must be synchronous, since a
+  // stale record would hide the change from this caller.
+  let slugs;
+  try { slugs = fs.readdirSync(projectsDir); } catch { rawScanCache.delete(projectsDir); return null; }
+
+  const records = [];
+  for (const slug of slugs) {
+    const rec = scanOneProjectDirSync(path.join(projectsDir, slug));
+    if (rec) records.push(rec);
+  }
+
+  Object.freeze(records);
+  rawScanCache.set(projectsDir, { dirMtimeMs, cachedAt: now0, records, refreshPromise: null });
+  return records;
+}
+
+/**
+ * readTailLinesAsync(filePath, maxBytes) → Promise<string[]>
+ * fs.promises counterpart of readTailLines, used only by the async rescan.
+ */
+async function readTailLinesAsync(filePath, maxBytes) {
+  let buf;
+  let fh;
+  try {
+    const stat = await fsp.stat(filePath);
+    if (stat.size === 0) return [];
+    const readSize = Math.min(maxBytes, stat.size);
+    fh = await fsp.open(filePath, 'r');
+    buf = Buffer.alloc(readSize);
+    await fh.read(buf, 0, readSize, stat.size - readSize);
+  } catch {
+    return [];
+  } finally {
+    if (fh) await fh.close().catch(() => {});
+  }
+  return buf.toString('utf8').split('\n').filter((l) => l.trim());
+}
+
+/**
+ * scanOneProjectDirAsync(projDir) → Promise<{rawCwd, newestMtimeMs} | null>
+ * fs.promises counterpart of scanOneProjectDirSync, used only by the async rescan.
+ */
+async function scanOneProjectDirAsync(projDir) {
+  let entries;
+  try {
+    entries = (await fsp.readdir(projDir)).filter((f) => f.endsWith('.jsonl'));
+  } catch { return null; }
+
+  let newestPath = null;
+  let newestMtimeMs = 0;
+  for (const tf of entries) {
+    const fp = path.join(projDir, tf);
+    try {
+      const st = await fsp.stat(fp);
+      if (st.mtimeMs > newestMtimeMs) {
+        newestMtimeMs = st.mtimeMs;
+        newestPath = fp;
+      }
+    } catch { continue; }
   }
+  if (!newestPath) return null;
 
+  const tlines = await readTailLinesAsync(newestPath, TAIL_BYTES);
+  let rawCwd = null;
+  for (let i = tlines.length - 1; i >= 0; i--) {
+    let row;
+    try { row = JSON.parse(tlines[i]); } catch { continue; }
+    if (row.cwd) { rawCwd = row.cwd; break; }
+  }
+  return rawCwd ? { rawCwd, newestMtimeMs } : null;
+}
+
+/**
+ * rescanProjectsDirAsync(projectsDir) → Promise<{dirMtimeMs, records}>
+ * The background counterpart of the first-scan branch in scanProjectsDir:
+ * same semantics, entirely fs.promises, with the per-project-dir reads
+ * bounded to RESCAN_CONCURRENCY in flight at once. A top-level failure
+ * (missing dir, unreadable) is left to throw/reject — startAsyncRefresh's
+ * caller catches it, logs once, and keeps the old cached record.
+ */
+async function rescanProjectsDirAsync(projectsDir) {
+  const dirMtimeMs = (await fsp.stat(projectsDir)).mtimeMs;
+  const slugs = await fsp.readdir(projectsDir);
+
+  const records = [];
+  let nextIdx = 0;
+  async function worker() {
+    for (;;) {
+      const i = nextIdx++;
+      if (i >= slugs.length) return;
+      const rec = await scanOneProjectDirAsync(path.join(projectsDir, slugs[i]));
+      if (rec) records.push(rec);
+    }
+  }
+  const workerCount = Math.min(RESCAN_CONCURRENCY, slugs.length);
+  await Promise.all(Array.from({ length: workerCount }, worker));
+
+  Object.freeze(records);
+  return { dirMtimeMs, records };
+}
+
+/**
+ * startAsyncRefresh(projectsDir) → Promise<void>
+ * Kicks off at most one in-flight background rescan per projectsDir — later
+ * calls while one is in flight get back the same promise instead of starting
+ * another. On success the cache entry is swapped atomically; on failure the
+ * old record is kept and the error is logged once. Never throws/rejects
+ * into a synchronous caller — scanProjectsDir never awaits this.
+ */
+function startAsyncRefresh(projectsDir) {
+  const entry = rawScanCache.get(projectsDir);
+  if (!entry) return Promise.resolve();
+  if (entry.refreshPromise) return entry.refreshPromise;
+
+  const promise = rescanProjectsDirAsync(projectsDir)
+    .then((result) => {
+      const current = rawScanCache.get(projectsDir);
+      if (!current) return; // busted mid-flight; nothing to swap into
+      rawScanCache.set(projectsDir, {
+        dirMtimeMs: result.dirMtimeMs, cachedAt: Date.now(), records: result.records, refreshPromise: null,
+      });
+    })
+    .catch((err) => {
+      console.error(`[activeSessions] async rescan of ${projectsDir} failed, keeping stale record: ${err.message}`);
+      const current = rawScanCache.get(projectsDir);
+      if (current) current.refreshPromise = null;
+    });
+
+  entry.refreshPromise = promise;
+  return promise;
+}
+
+/**
+ * __waitForPendingRefresh(projectsDir) → Promise<void>
+ * Test-only hook: awaits the in-flight async rescan for projectsDir, if any.
+ * Resolves immediately when no refresh is in flight.
+ */
+function __waitForPendingRefresh(projectsDir) {
+  const entry = rawScanCache.get(projectsDir);
+  return entry && entry.refreshPromise ? entry.refreshPromise : Promise.resolve();
+}
+
+/**
+ * deriveCwds(records, maxAgeMin, maxCwds, tmpDropRoots) → string[]
+ *
+ * Filters/sorts a scanProjectsDir() record into the view activeProjectCwds/
+ * allProjectCwds promise: age cutoff, ops-root/worktree normalization,
+ * dedup, existence check, and the maxCwds cap — identical semantics to the
+ * old per-call scan, now performed in memory against the shared record.
+ */
+function deriveCwds(records, maxAgeMin, maxCwds, tmpDropRoots) {
   // maxAgeMin === Infinity means "every project ever seen, no recency filter"
   // (allProjectCwds below). Date.now() - Infinity is -Infinity, which every
   // mtime clears — spelled out here because it reads like an accident.
@@ -199,46 +397,39 @@ function activeProjectCwds(maxAgeMin = 90, {
     result.push(cwd);
   }
 
-  // Scan ~/.claude/projects/*/  transcript *.jsonl files.
-  let slugs;
-  try { slugs = fs.readdirSync(projectsDir); } catch { cwdScanCache.delete(cacheKey); return Object.freeze(result); }
-
-  for (const slug of slugs) {
+  for (const { rawCwd, newestMtimeMs } of records) {
     if (result.length >= maxCwds) break;
-    const projDir = path.join(projectsDir, slug);
-    let entries;
-    try {
-      entries = fs.readdirSync(projDir).filter((f) => f.endsWith('.jsonl'));
-    } catch { continue; }
-
-    // Find the most recently modified transcript in this project dir.
-    let newestPath = null;
-    let newestMtimeMs = 0;
-    for (const tf of entries) {
-      const fp = path.join(projDir, tf);
-      try {
-        const st = fs.statSync(fp);
-        if (st.mtimeMs > newestMtimeMs) {
-          newestMtimeMs = st.mtimeMs;
-          newestPath = fp;
-        }
-      } catch { continue; }
-    }
-
-    if (!newestPath || newestMtimeMs < cutoffMs) continue;
-
-    // Read `cwd` from the last parseable line of the transcript.
-    const tlines = readTailLines(newestPath, TAIL_BYTES);
-    for (let i = tlines.length - 1; i >= 0; i--) {
-      let row;
-      try { row = JSON.parse(tlines[i]); } catch { continue; }
-      if (row.cwd) { addCwd(row.cwd); break; }
-    }
+    if (newestMtimeMs < cutoffMs) continue;
+    addCwd(rawCwd);
   }
 
-  Object.freeze(result);
-  cwdScanCache.set(cacheKey, { dirMtimeMs, cachedAt: now0, result });
-  return result;
+  return Object.freeze(result);
+}
+
+/**
+ * activeProjectCwds(maxAgeMin = 90, opts?) → string[]
+ *
+ * Returns distinct, on-disk project cwds that have an open/active session
+ * within the last maxAgeMin minutes.
+ *
+ * Sole detection path: scan ~/.claude/projects/*​/  for transcript *.jsonl
+ *   files modified within maxAgeMin, read `cwd` from the last parseable line
+ *   of the newest transcript per project dir.
+ *   Complexity: O(P × L) over P project dirs, each bounded-tail read (64 KB) —
+ *   paid once per TTL window (see scanProjectsDir), shared across views.
+ *
+ * opts (for testing):
+ *   projectsDir   — override the default ~/.claude/projects path
+ *   tmpDropRoots  — override the tmp guard's drop roots (default TMP_DROP_ROOTS)
+ */
+function activeProjectCwds(maxAgeMin = 90, {
+  projectsDir = path.join(HOME, '.claude', 'projects'),
+  maxCwds = MAX_CWDS,
+  tmpDropRoots = TMP_DROP_ROOTS,
+} = {}) {
+  const records = scanProjectsDir(projectsDir);
+  if (!records) return EMPTY_CWDS;
+  return deriveCwds(records, maxAgeMin, maxCwds, tmpDropRoots);
 }
 
 /**
@@ -266,4 +457,5 @@ module.exports = {
   projectRootOf,
   worktreeMainRootOf,
   bustProjectCwdCache,
+  __waitForPendingRefresh,
 };

package/src/main/lib/agentPersonaSchema.cjs

@@ -22,6 +22,7 @@
  */
 'use strict';
 
+const path = require('node:path');
 const { z } = require('zod');
 const { WorkTypeSchema, LEGACY_WORK_TYPES } = require('./workTypeLibrary.cjs');
 const { PERSONA_NAME_RE, ALL_PROJECTS } = require('../agentLibrary.cjs');
@@ -35,8 +36,13 @@ const BoundedString = z.string().max(2000);
 // `projects` entries are either the `'*'` sentinel (every project) or an
 // absolute path — agentLibrary.cjs's openProjects always deals in absolute
 // cwds, and a relative entry could never match one.
+/** @param {string} v @param {NodeJS.Platform} [platform] */
+function isAbsoluteForPlatform(v, platform = process.platform) {
+  return (platform === 'win32' ? path.win32 : path.posix).isAbsolute(v);
+}
+
 const ProjectEntrySchema = z.string().refine(
-  (v) => v === ALL_PROJECTS || v.startsWith('/'),
+  (/** @type {string} */ v) => v === ALL_PROJECTS || isAbsoluteForPlatform(v),
   `must be "${ALL_PROJECTS}" or an absolute path`,
 );
 
@@ -95,4 +101,5 @@ function assertValidAgentPersonaSave(persona) {
 module.exports = {
   AgentPersonaSaveSchema,
   assertValidAgentPersonaSave,
+  isAbsoluteForPlatform,
 };

package/src/main/lib/appRuntime.cjs

@@ -0,0 +1,57 @@
+/**
+ * appRuntime.cjs — how to run a Node script from an EXTERNAL process.
+ *
+ * Packaged installer builds may have no system `node`, so scripts handed to
+ * Claude Code hooks / MCP registrations run through the app's own binary with
+ * ELECTRON_RUN_AS_NODE=1. npx/dev builds keep using `node`.
+ */
+
+'use strict';
+
+/**
+ * @param {{ packaged?: boolean }} [opts]
+ * @returns {boolean}
+ */
+function isPackagedApp(opts) {
+  if (opts && typeof opts.packaged === 'boolean') return opts.packaged;
+  if (process.env.SM_FORCE_PACKAGED === '1') return true;
+  try {
+    return require('electron').app?.isPackaged === true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * @param {string} scriptPath
+ * @param {{ packaged?: boolean, execPath?: string }} [opts]
+ * @returns {{ command: string, args: string[], env: Record<string, string> }}
+ */
+function nodeSpawnSpec(scriptPath, opts) {
+  if (!isPackagedApp(opts)) return { command: 'node', args: [scriptPath], env: {} };
+  return {
+    command: (opts && opts.execPath) || process.execPath,
+    args: [scriptPath],
+    env: { ELECTRON_RUN_AS_NODE: '1' },
+  };
+}
+
+/** @param {string} p */
+function quote(p) {
+  if (p.includes('"')) throw new Error(`appRuntime: path contains a double quote: ${p}`);
+  return `"${p}"`;
+}
+
+/**
+ * Shell command string (hook `command` fields). Paths are double-quoted.
+ * @param {string} scriptPath
+ * @param {{ packaged?: boolean, execPath?: string }} [opts]
+ * @returns {string}
+ */
+function nodeShellCommand(scriptPath, opts) {
+  if (!isPackagedApp(opts)) return `node ${quote(scriptPath)}`;
+  const execPath = (opts && opts.execPath) || process.execPath;
+  return `ELECTRON_RUN_AS_NODE=1 ${quote(execPath)} ${quote(scriptPath)}`;
+}
+
+module.exports = { isPackagedApp, nodeSpawnSpec, nodeShellCommand };

package/src/main/lib/childWithLog.cjs

@@ -52,6 +52,7 @@
 
 const fs = require('node:fs');
 const { spawn, execFile } = require('node:child_process');
+const { killTree } = require('./killTree.cjs');
 
 // Injectable for tests (enumeration-failure coverage).
 const deps = { execFile };
@@ -150,6 +151,7 @@ function openLog(logPath) {
 // Async: resolves to the survivors list, rejects on ps failure/timeout. O(P) in
 // the process table, off the main event loop.
 function enumerateProcessGroupSurvivors(pgid) {
+  // ps -eo is Linux-only; on win32 (and macOS) report the empty/unknown result without spawning ps.
   if (process.platform !== 'linux') return Promise.resolve([]);
   if (!pgid || pgid <= 1) return Promise.resolve([]);
   return new Promise((resolve, reject) => {
@@ -182,12 +184,14 @@ function sweepChildProcessGroup(child, detached, safeLog) {
   if (!child || !child.pid || child.pid <= 1) return null;
   // Defensive: never target the Session Manager process's own group.
   if (child.pid === process.pid) return null;
+  // win32 has no process groups; taskkill on an already-exited pid risks hitting a reused pid.
+  if (process.platform === 'win32') return null;
 
   const pid = child.pid;
   const kill = () => {
-    try { process.kill(-pid, 'SIGTERM'); } catch { /* ESRCH: empty group, the normal case */ }
+    killTree(pid, 'SIGTERM'); // ESRCH on an empty group is the normal case
     const t = setTimeout(() => {
-      try { process.kill(-pid, 'SIGKILL'); } catch { /* ESRCH: empty group, the normal case */ }
+      killTree(pid, 'SIGKILL');
     }, POST_EXIT_GROUP_SWEEP_GRACE_MS);
     if (t.unref) t.unref();
   };
@@ -219,13 +223,9 @@ function withChildAndLog({ fd, logPath, safeLog, closeFd, spawn: spawnSpec, watc
     killTree(signal) {
       const c = ctx.child;
       if (!c) return false;
-      // Negative pid targets the whole process group (requires detached: true at spawn).
-      // Falls back to direct kill if the process is not a group leader.
-      try { process.kill(-c.pid, signal); return true; }
-      catch {
-        try { process.kill(c.pid, signal); return true; }
-        catch { return false; /* already dead */ }
-      }
+      // Whole process group on POSIX / taskkill /T on win32 (requires detachedSpawnOpts at spawn);
+      // killTree falls back to the bare pid if the process is not a group leader.
+      return killTree(c.pid, signal, { log: safeLog });
     },
     addTimer(t) { extraTimers.push(t); },
   };
@@ -315,7 +315,7 @@ function withChildAndLog({ fd, logPath, safeLog, closeFd, spawn: spawnSpec, watc
   const cancel = () => {
     clearAllTimers();
     // Best-effort kill; ignore errors (process may already be gone).
-    try { process.kill(-child.pid, 'SIGKILL'); } catch {
+    if (!killTree(child.pid, 'SIGKILL', { log: safeLog })) {
       try { child.kill('SIGKILL'); } catch { /* */ }
     }
   };