claude-code-session-manager 0.104.2 → 0.105.0

package/src/main/lib/watchdogHelpers.cjs

@@ -9,6 +9,7 @@ const schedulerPaths = require('./schedulerPaths.cjs');
 const { isRestartingMarkerActive } = require('./upgradeDrain.cjs');
 const { pidAlive: pidAliveCore } = require('./pidAlive.cjs');
 const atomicFs = require('./atomicFs.cjs');
+const { isPackagedApp } = require('./appRuntime.cjs');
 
 
 
@@ -230,14 +231,32 @@ function logRelaunchLine(logPath, message) {
  * (short-lived) process doesn't block on the launched app and the app
  * survives the watchdog exiting.
  */
-function defaultSpawnRelaunch({ logPath = schedulerPaths.watchdogRelaunchLogPath() } = {}) {
-  const { spawn } = require('node:child_process');
+/**
+ * relaunchSpec(opts?) — what the watchdog spawns to bring the app back.
+ * Packaged installer builds have no npx: relaunch the app binary itself.
+ * @param {{ packaged?: boolean, execPath?: string }} [opts]
+ * @returns {{ command: string, args: string[], packaged: boolean }}
+ */
+function relaunchSpec(opts) {
+  if (isPackagedApp(opts)) {
+    return { command: (opts && opts.execPath) || process.execPath, args: [], packaged: true };
+  }
+  return { command: 'npx', args: ['claude-code-session-manager@latest'], packaged: false };
+}
+
+function defaultSpawnRelaunch({ logPath = schedulerPaths.watchdogRelaunchLogPath(), packaged, execPath, spawnFn } = {}) {
+  const spawn = spawnFn || require('node:child_process').spawn;
+  const spec = relaunchSpec({ packaged, execPath });
   fs.mkdirSync(path.dirname(logPath), { recursive: true });
   const fd = fs.openSync(logPath, 'a');
   try {
-    const child = spawn('npx', ['claude-code-session-manager@latest'], {
+    const env = { ...process.env };
+    // The watchdog may itself run as node via the app binary; the relaunched app must not.
+    if (spec.packaged) delete env.ELECTRON_RUN_AS_NODE;
+    const child = spawn(spec.command, spec.args, {
       detached: true,
       stdio: ['ignore', fd, fd],
+      env,
     });
     child.on('error', (e) => {
       logRelaunchLine(logPath, `spawn error: ${e?.message}`);
@@ -460,6 +479,7 @@ module.exports = {
   readRelaunchState,
   writeRelaunchState,
   defaultSpawnRelaunch,
+  relaunchSpec,
   maybeRelaunchApp,
   DEFAULT_MAX_AGE_MS,
   DEFAULT_DISPATCH_DEAD_MS,

package/src/main/lib/winSpawn.cjs

@@ -0,0 +1,67 @@
+/**
+ * winSpawn.cjs — make spawn() work for Windows .cmd/.bat shims (npx, npm) without
+ * shell:true. Node refuses to spawn those directly (EINVAL), so they are wrapped in
+ * an explicit `cmd.exe /d /s /c "<line>"` argv with every cmd metacharacter escaped.
+ * Non-win32 input passes through untouched.
+ */
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const DEFAULT_PATHEXT = '.COM;.EXE;.BAT;.CMD';
+const META = /([()\][%!^"`<>&|;, *?])/g;
+
+function envGet(env, name) {
+  if (env[name] !== undefined) return env[name];
+  const key = Object.keys(env).find((k) => k.toLowerCase() === name.toLowerCase());
+  return key ? env[key] : undefined;
+}
+
+function findOnPath(command, env, exists) {
+  const w = path.win32;
+  const exts = (envGet(env, 'PATHEXT') || DEFAULT_PATHEXT)
+    .split(';').filter(Boolean).map((e) => e.toLowerCase());
+  const hasDir = /[\\/]/.test(command);
+  const dirs = hasDir ? [''] : (envGet(env, 'PATH') || '').split(';').filter(Boolean);
+  const hasExt = exts.includes(w.extname(command).toLowerCase());
+  for (const dir of dirs) {
+    const base = dir ? w.join(dir, command) : command;
+    const candidates = hasExt ? [base] : [];
+    for (const e of exts) candidates.push(base + e);
+    // PATHEXT order is by extension; keep the casing the filesystem probe accepts.
+    for (const cand of candidates) {
+      if (exists(cand)) return cand;
+      const upper = cand.slice(0, cand.length - w.extname(cand).length) + w.extname(cand).toUpperCase();
+      if (upper !== cand && exists(upper)) return upper;
+    }
+  }
+  return null;
+}
+
+// Quote for CreateProcess argv parsing, then ^-escape every cmd metacharacter.
+function quoteArg(arg) {
+  let s = String(arg);
+  s = s.replace(/(\\*)"/g, '$1$1\\"').replace(/(\\*)$/, '$1$1');
+  s = `"${s}"`;
+  return s.replace(META, '^$1');
+}
+
+function resolveSpawn(command, args = [], { platform = process.platform, env = process.env, exists = fs.existsSync } = {}) {
+  if (platform !== 'win32') return { command, args };
+  const resolved = findOnPath(command, env, exists);
+  if (!resolved) return { command, args };
+  const ext = path.win32.extname(resolved).toLowerCase();
+  if (ext === '.cmd' || ext === '.bat') {
+    const line = [resolved, ...args].map(quoteArg).join(' ');
+    return {
+      command: envGet(env, 'ComSpec') || 'cmd.exe',
+      args: ['/d', '/s', '/c', `"${line}"`],
+      windowsVerbatimArguments: true,
+    };
+  }
+  return { command: resolved, args };
+}
+
+module.exports = { resolveSpawn };

package/src/main/otel.cjs

@@ -8,58 +8,36 @@
  * plan text, and agent prompts are excluded unless `includeContent` is on
  * (matches upstream OTEL_LOG_USER_PROMPTS opt-in).
  *
- * The OTEL SDK is required lazily — if any of the @opentelemetry/* packages
- * fail to load, the module is left in an inert state and `recordTranscriptEvent`
- * becomes a no-op. The app must keep working without telemetry.
- *
- * Threading: the BatchSpanProcessor batches/sends spans on its own timer; we
- * never block the transcript flush.
+ * Spans are POSTed as OTLP/HTTP JSON by lib/otlpTraceExporter.cjs (zero
+ * dependencies). recordSpan() only queues; the exporter batches/sends on its
+ * own unref()'d timer, so we never block the transcript flush. The app must
+ * keep working without telemetry: a failed export is surfaced, never thrown.
  */
 
 const otelSettings = require('./otelSettings.cjs');
+const { createOtlpTraceExporter } = require('./lib/otlpTraceExporter.cjs');
 
-let provider = null;
-let tracer = null;
+let exporter = null;
 let enabled = false;
 let includeContent = false;
 let lastError = null;
 let initialized = false;
 
 /**
- * Lazy-require all @opentelemetry/* packages. Returns null if any are missing.
- * We catch the per-require so a partial install doesn't half-init.
- */
-function loadDeps() {
-  try {
-    const api = require('@opentelemetry/api');
-    const { NodeTracerProvider } = require('@opentelemetry/sdk-trace-node');
-    const { BatchSpanProcessor } = require('@opentelemetry/sdk-trace-base');
-    const { OTLPTraceExporter } = require('@opentelemetry/exporter-trace-otlp-http');
-    const { resourceFromAttributes } = require('@opentelemetry/resources');
-    const { ATTR_SERVICE_NAME } = require('@opentelemetry/semantic-conventions');
-    return { api, NodeTracerProvider, BatchSpanProcessor, OTLPTraceExporter, resourceFromAttributes, ATTR_SERVICE_NAME };
-  } catch (err) {
-    return { error: err };
-  }
-}
-
-/**
- * Tear down any existing provider. Best-effort — flushes pending spans on a
+ * Tear down any existing exporter. Best-effort — flushes pending spans on a
  * 2s ceiling so a wedged exporter doesn't block app shutdown / config reload.
  */
 async function shutdown() {
-  if (!provider) {
+  if (!exporter) {
     enabled = false;
-    tracer = null;
     return;
   }
-  const p = provider;
-  provider = null;
-  tracer = null;
+  const e = exporter;
+  exporter = null;
   enabled = false;
   try {
     await Promise.race([
-      p.shutdown(),
+      e.shutdown(),
       new Promise((resolve) => setTimeout(resolve, 2000)),
     ]);
   } catch (err) {
@@ -68,7 +46,7 @@ async function shutdown() {
 }
 
 /**
- * Configure the tracer provider. Tears down any prior provider first so a
+ * Configure the exporter. Tears down any prior exporter first so a
  * settings change reliably re-points at the new endpoint.
  *
  * Returns { ok, error?: string } — the renderer surfaces `error` in the UI.
@@ -77,31 +55,13 @@ async function init({ endpoint, headers, serviceName, includeContent: ic } = {})
   await shutdown();
   initialized = true;
 
-  const deps = loadDeps();
-  if (deps.error) {
-    lastError = `OTEL packages unavailable: ${deps.error.message}`;
-    return { ok: false, error: lastError };
-  }
-
-  const { NodeTracerProvider, BatchSpanProcessor, OTLPTraceExporter, resourceFromAttributes, ATTR_SERVICE_NAME } = deps;
-
   try {
-    const exporter = new OTLPTraceExporter({
+    exporter = createOtlpTraceExporter({
       url: String(endpoint || 'http://localhost:4318/v1/traces'),
       headers: typeof headers === 'object' && headers ? headers : {},
+      serviceName: String(serviceName || 'session-manager'),
+      scopeName: 'session-manager-transcripts',
     });
-    const tp = new NodeTracerProvider({
-      resource: resourceFromAttributes({
-        [ATTR_SERVICE_NAME]: String(serviceName || 'session-manager'),
-      }),
-      spanProcessors: [new BatchSpanProcessor(exporter)],
-    });
-    // Note: we deliberately do NOT call tp.register() — that installs a global
-    // tracer provider, which would intercept any other OTEL user in the
-    // process. We only want to emit our own spans, so we use the provider
-    // directly via getTracer().
-    provider = tp;
-    tracer = tp.getTracer('session-manager-transcripts');
     includeContent = !!ic;
     enabled = true;
     lastError = null;
@@ -205,11 +165,11 @@ function pruneAttrs(obj) {
 
 /**
  * Emit a 0-duration span for one classified transcript event.
- * Synchronous + non-blocking: the BatchSpanProcessor handles network I/O
+ * Synchronous + non-blocking: the exporter handles network I/O
  * on its own schedule.
  */
 function recordTranscriptEvent({ tabId, tabCwd, kind, data, ts }) {
-  if (!enabled || !tracer) return;
+  if (!enabled || !exporter) return;
   try {
     const startTime = typeof ts === 'number' ? ts : Date.now();
     const attrs = pruneAttrs({
@@ -218,11 +178,7 @@ function recordTranscriptEvent({ tabId, tabCwd, kind, data, ts }) {
       kind,
       ...attrsFor(kind, data),
     });
-    const span = tracer.startSpan(`transcript.${kind}`, {
-      startTime,
-      attributes: attrs,
-    });
-    span.end(startTime);
+    exporter.recordSpan({ name: `transcript.${kind}`, timeMs: startTime, attributes: attrs });
   } catch (err) {
     // A failure here must never break transcript ingestion. Log once-ish.
     if (!recordTranscriptEvent._warned) {

package/src/main/pty.cjs

@@ -20,6 +20,7 @@ const { addAllowedRoot } = require('./config.cjs');
 const { aliasedShellBin } = require('./lib/smProcNames.cjs');
 const { cleanChildEnv, pathWithUserBins } = require('./lib/cleanEnv.cjs');
 const { checkInsideHome } = require('./lib/insideHome.cjs');
+const { defaultShell } = require('./lib/defaultShell.cjs');
 const { sendIfAlive } = require('./lib/sendToRenderer.cjs');
 const opsErrorLog = require('./lib/opsErrorLog.cjs');
 const { planEpicSpawn } = require('./lib/epicSpawnPlan.cjs');
@@ -51,20 +52,39 @@ const PTY_FLUSH_MAX_BYTES = 64 * 1024;
  */
 function nativeModuleHelp(reason) {
   const mac = process.platform === 'darwin';
-  const lines = [
+  const head = [
     '',
     `\x1b[1;33m[session-manager] Terminal could not start.\x1b[0m`,
     `\x1b[33m${reason}\x1b[0m`,
     '',
-    `This is almost always the node-pty native module not matching this`,
-    `Electron build. Rebuild it once:`,
+  ];
+  if (process.platform === 'win32') {
+    return (
+      [
+        ...head,
+        `This is almost always a damaged install (the node-pty native module`,
+        `is missing or does not match this build). Reinstall session-manager:`,
+        '',
+        `  - Installed app: run the latest installer again.`,
+        `  - npm package:   \x1b[36mnpm install -g claude-code-session-manager@latest\x1b[0m`,
+        '',
+        `Then quit and reopen session-manager.`,
+        '',
+      ].join('\r\n') + '\r\n'
+    );
+  }
+  const lines = [
+    ...head,
+    `node-pty ships prebuilt binaries for macOS, Linux and Windows on x64 and`,
+    `arm64. This machine is \x1b[36m${process.platform}-${process.arch}\x1b[0m. If the module failed to load, the`,
+    `install is probably damaged. Reinstall session-manager:`,
+    '',
+    `  \x1b[36mnpm i -g claude-code-session-manager@latest\x1b[0m`,
+    `  (or re-run the npx command)`,
     '',
-    `  \x1b[36mcd ${PKG_DIR}\x1b[0m`,
-    `  \x1b[36mnpx electron-rebuild -f -w node-pty\x1b[0m`,
+    `On any other platform node-pty compiles from source and needs build tools:`,
+    mac ? `  macOS: \x1b[36mxcode-select --install\x1b[0m` : `  Linux: build-essential + python3`,
     '',
-    mac ? `macOS: if the rebuild fails, install the compiler first:` : '',
-    mac ? `  \x1b[36mxcode-select --install\x1b[0m` : '',
-    mac ? '' : '',
     `Then quit and reopen session-manager.`,
     '',
   ].filter((l) => l !== '');
@@ -210,8 +230,8 @@ class PtyManager {
       SM_PROJECT_ROOT: cwd,
     });
 
-    const shell = process.env.SHELL || '/bin/bash';
-    console.log('[pty] spawning shell', shell);
+    const shell = defaultShell({ platform: process.platform, env: process.env, exists: fs.existsSync });
+    console.log('[pty] spawning shell', shell.file);
     // Tab ID = claudeSessionId (see CLAUDE.md), and Chat/Terminal are two views over ONE session,
     // so this asks the same decision function chatRunner.cjs does (epicSpawnPlan.cjs). `cwd`
     // itself is NEVER repointed; only this actual PTY spawn option is (epicSpawnCwd.cjs's
@@ -255,7 +275,8 @@ class PtyManager {
       // job's descendants; no shell in a job's process tree is ever spawned
       // through here, so that detection is unaffected. Non-bash/zsh shells and
       // any alias failure fall back to the real path.
-      proc = pty.spawn(aliasedShellBin(shell), ['-il'], {
+      const shellFile = process.platform === 'win32' ? shell.file : aliasedShellBin(shell.file);
+      proc = pty.spawn(shellFile, shell.args, {
         name: 'xterm-256color',
         cols,
         rows,

package/src/main/runVerify.cjs

@@ -168,13 +168,14 @@ function parseLog(logPath) {
   try {
     text = fs.readFileSync(logPath, 'utf8');
   } catch (e) {
-    return { events: [], resultEvent: null, error: e.message };
+    return { events: [], resultEvent: null, error: e.message, transcriptCommitShas: [] };
   }
 
   const events = [];
   let resultEvent = null;
   let seq = 0;
   let transcriptCommitLanded = false;
+  const transcriptCommitShaSet = new Set();
 
   for (const line of text.split('\n')) {
     const trimmed = line.trim();
@@ -194,6 +195,8 @@ function parseLog(logPath) {
     }
     if (obj.tool_use_result?.gitOperation?.commit?.kind === 'committed') {
       transcriptCommitLanded = true;
+      const sha = obj.tool_use_result.gitOperation.commit.sha;
+      if (typeof sha === 'string' && sha) transcriptCommitShaSet.add(sha);
     }
 
     // Final result event.
@@ -245,7 +248,7 @@ function parseLog(logPath) {
     }
   }
 
-  return { events, resultEvent, error: null, transcriptCommitLanded };
+  return { events, resultEvent, error: null, transcriptCommitLanded, transcriptCommitShas: [...transcriptCommitShaSet] };
 }
 
 // Stable, narrow substrings of the harness's auto-background tool_result text
@@ -549,6 +552,28 @@ function scanSentinel(resultEvent, events) {
   return null;
 }
 
+/**
+ * One-line reason after `SCHEDULER_VERDICT: FAIL` (same two-source scan order
+ * as scanSentinel). Trimmed, capped at 300 chars; '' when absent.
+ */
+function scanSentinelReason(resultEvent, events) {
+  const RE = /^SCHEDULER_VERDICT:\s*FAIL\b[ \t]*([^\n]*)/m;
+  const clip = (m) => m[1].trim().slice(0, 300);
+  if (resultEvent && resultEvent.resultText) {
+    const m = resultEvent.resultText.match(RE);
+    if (m) return clip(m);
+  }
+  let lastToolResult = null;
+  for (const ev of events) {
+    if (ev.kind === 'tool_result') lastToolResult = ev;
+  }
+  if (lastToolResult && lastToolResult.content) {
+    const m = lastToolResult.content.match(RE);
+    if (m) return clip(m);
+  }
+  return '';
+}
+
 /**
  * Scan for a `FOREIGN_WIP_PATHS: <comma-separated paths>` evidence line —
  * the mandatory companion to a `SCHEDULER_VERDICT: BLOCKED_BY_FOREIGN_WIP`
@@ -1079,6 +1104,20 @@ async function verifyRun({
     // Scan for the SCHEDULER_VERDICT sentinel emitted by the finish protocol.
     const sentinel = scanSentinel(resultEvent, events);
 
+    // An explicit executor FAIL is always blocking — outranks every other
+    // verdict and every override below (early return). Transcript issues are
+    // kept as annotations so nothing is lost.
+    if (sentinel === 'fail') {
+      const failReason = scanSentinelReason(resultEvent, events);
+      const kept = [...annotations, ...issues.map((i) => ({ verdict: i.verdict, reason: i.reason }))];
+      return conclude(
+        'sentinel_fail',
+        'executor reported SCHEDULER_VERDICT: FAIL' + (failReason ? ': ' + failReason : ''),
+        'needs_review',
+        { sentinel, ...(kept.length ? { annotations: kept } : {}) },
+      );
+    }
+
     // Ground truth outranks heuristics: an exit-0 run that landed a commit
     // ATTRIBUTABLE TO THIS RUN (spawnJob's own guardHeadBefore/headAtExit
     // delta, or the repo-wide committedDuringRun window scan) and never
@@ -1377,6 +1416,7 @@ module.exports = {
   checkDeps,
   parseLog,
   scanSentinel,
+  scanSentinelReason,
   scanForeignWipPathsClaim,
   isMergeMainSlug,
   extractMergeMainPrNumber,

package/src/main/scheduler.cjs

@@ -82,6 +82,7 @@ const { isResetFresh, bindingWindow, degradedBudget } = require('./lib/usageCirc
 const { computeQueueHealth } = require('./lib/queueHealth.cjs');
 const { createLoadGate, topCpuConsumers } = require('./lib/loadGate.cjs');
 const { openLog, withChildAndLog } = require('./lib/childWithLog.cjs');
+const { killTree, detachedSpawnOpts } = require('./lib/killTree.cjs');
 const { sendIfAlive } = require('./lib/sendToRenderer.cjs');
 const { createBroadcastCoalescer } = require('./lib/broadcastCoalescer.cjs');
 const prdParser = require('./scheduler/prdParser.cjs');
@@ -846,6 +847,51 @@ async function computeCommittedDuringRun(cwd, headBefore, headAfter, startedAt,
   return module.exports.committedInWindow(cwd, startedAt, untilIso);
 }
 
+/**
+ * Which commit does this run get credit for? A worktree-isolated run shares the
+ * main checkout with concurrent jobs, so a HEAD move there may be someone else's
+ * integration — credit comes only from this run's own integration result. An
+ * in-place run keeps the HEAD-delta / time-window behaviour.
+ */
+function resolveRunCommitAttribution({
+  ranInWorktree, integratedSha, headBefore, headAtExit, committedInWindow,
+  rangeCommits, transcriptCommitShas, siblingOverlap,
+}) {
+  if (ranInWorktree) {
+    const landedCommit = integratedSha || null;
+    return { landedCommit, committedDuringRun: Boolean(landedCommit) };
+  }
+  const shas = Array.isArray(transcriptCommitShas) ? transcriptCommitShas.filter(Boolean) : [];
+  if (shas.length === 0 && !siblingOverlap) {
+    const headMoved = Boolean(headBefore && headAtExit && headBefore !== headAtExit);
+    return {
+      landedCommit: headMoved ? headAtExit : null,
+      committedDuringRun: headMoved || Boolean(committedInWindow),
+    };
+  }
+  // Shared tree with possible siblings (or transcript evidence): credit only a
+  // commit in the range that this run's own transcript reported.
+  const own = (Array.isArray(rangeCommits) ? rangeCommits : [])
+    .find((c) => shas.some((sha) => c.startsWith(sha)));
+  const landedCommit = own || null;
+  return { landedCommit, committedDuringRun: Boolean(landedCommit) };
+}
+
+/** Full shas in `before..after` (newest first); [] on any error. Never throws. */
+function gitRangeCommits(cwd, before, after) {
+  return new Promise((resolve) => {
+    if (!cwd || !before || !after || before === after) { resolve([]); return; }
+    execFile(
+      'git', ['-C', cwd, 'rev-list', `${before}..${after}`],
+      { timeout: 10_000, windowsHide: true },
+      (err, out) => {
+        if (err) { resolve([]); return; }
+        resolve(String(out || '').split('\n').map((l) => l.trim()).filter(Boolean));
+      },
+    );
+  });
+}
+
 /**
  * Read-only check: is a job's `sm-job/<slug>` worktree branch already fully
  * integrated into `cwd`'s current HEAD — i.e. every commit on the branch is
@@ -2769,6 +2815,8 @@ function killOrphanClaudePid(pid, recordedIdentity = null) {
     && isDifferentProcess(recordedIdentity, procIdentityOf(pid))) {
     return 'mismatch';
   }
+  // win32 has no /proc or `ps`: the identity heuristic can't run, so never reap.
+  if (process.platform === 'win32') return 'unknown';
   let cmdline = '';
   try {
     cmdline = fs.readFileSync(`/proc/${pid}/cmdline`, 'utf8').replace(/\0/g, ' ');
@@ -2779,12 +2827,10 @@ function killOrphanClaudePid(pid, recordedIdentity = null) {
     } catch { return 'unknown'; }
   }
   if (!/\bclaude\b/.test(cmdline)) return 'mismatch';
-  try { process.kill(-pid, 'SIGTERM'); }
-  catch { try { process.kill(pid, 'SIGTERM'); } catch { /* race: died between checks */ } }
+  killTree(pid, 'SIGTERM');
   setTimeout(() => {
     try { process.kill(pid, 0); } catch { return; /* already gone */ }
-    try { process.kill(-pid, 'SIGKILL'); }
-    catch { try { process.kill(pid, 'SIGKILL'); } catch { /* race */ } }
+    killTree(pid, 'SIGKILL');
   }, 5000).unref?.();
   return 'killed';
 }
@@ -6302,10 +6348,10 @@ async function executeJob(job, runDir, defaultCwd, onPid, execCwd, resumeTarget
           ...(jobSpawn.argv0 ? { argv0: jobSpawn.argv0 } : {}),
           // detached:true puts the child in its own process group so we can kill
           // the entire descendant tree (including any stray background bashes the
-          // agent spawned) with `process.kill(-pid)`. Without this, child.kill()
+          // agent spawned) with killTree(pid). Without this, child.kill()
           // only kills the immediate `claude` process, leaving orphaned subprocs
           // that keep the parent alive (the 2026-05-10 cellar-publish hang).
-          detached: true,
+          ...detachedSpawnOpts(),
         },
       },
       watchdogs: [resultTailWatchdog, deadmanWatchdog, idleTailWatchdog, budgetWatchdog],
@@ -7249,6 +7295,7 @@ async function finalizeJobWorktree({ job, runDir, worktree, guardCwd, carriedPat
   let worktreeIntegrationDetail = null;
   let mergeAutoResolved = null;
   let mergeAutoResolvedPaths = null;
+  let integratedSha = null;
   try {
     worktreeLeftoverDirty = (await uncommitted(worktree.dir)) || [];
     // Salvage the worktree's full diff (tracked + untracked) to the run
@@ -7273,6 +7320,7 @@ async function finalizeJobWorktree({ job, runDir, worktree, guardCwd, carriedPat
       worktreeIntegrationDetail = integration;
       console.error(`[scheduler] ${job.slug}: worktree branch integration FAILED (${integration.reason}) — branch ${worktree.branch} preserved in ${guardCwd} for manual recovery`);
     } else if (integration.integrated) {
+      integratedSha = integration.sha || null;
       console.log(`[scheduler] ${job.slug}: worktree branch ${worktree.branch} integrated into ${guardCwd}${integration.mergeCommit ? ' (merge commit)' : ' (fast-forward)'}`);
       if (integration.autoResolved) {
         mergeAutoResolved = integration.autoResolved;
@@ -7294,7 +7342,7 @@ async function finalizeJobWorktree({ job, runDir, worktree, guardCwd, carriedPat
       await jw.cleanupJobWorktree({ cwd: guardCwd, dir: worktree.dir, branch: worktree.branch, keepBranch: true });
     } catch { /* already reported above */ }
   }
-  return { worktreeLeftoverDirty, salvagePatch, worktreeIntegrationFailure, worktreeIntegrationDetail, mergeAutoResolved, mergeAutoResolvedPaths };
+  return { worktreeLeftoverDirty, salvagePatch, worktreeIntegrationFailure, worktreeIntegrationDetail, mergeAutoResolved, mergeAutoResolvedPaths, integratedSha };
 }
 
 /**
@@ -7686,6 +7734,7 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null, sib
     // self-healed rather than silently looking like an ordinary merge.
     let mergeAutoResolved = null;
     let mergeAutoResolvedPaths = null;
+    let integratedSha = null;
     // A job's uncommitted-work patch, whichever isolation mode produced it —
     // set by EITHER branch below, never both (worktree.ok picks exactly one
     // shape for the whole run). Named generically (not "worktree...") because
@@ -7721,7 +7770,7 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null, sib
       }, reviewInRun);
     } finally {
       if (worktree.ok) {
-        ({ worktreeLeftoverDirty, salvagePatch, worktreeIntegrationFailure, worktreeIntegrationDetail, mergeAutoResolved, mergeAutoResolvedPaths } =
+        ({ worktreeLeftoverDirty, salvagePatch, worktreeIntegrationFailure, worktreeIntegrationDetail, mergeAutoResolved, mergeAutoResolvedPaths, integratedSha } =
           await finalizeJobWorktree({ job, runDir, worktree, guardCwd, carriedPaths }));
       } else {
         // In-place run (non-git cwd, cap reached, env-disabled, or a carry-over
@@ -7873,15 +7922,50 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null, sib
       // Used by the sentinel override: SCHEDULER_VERDICT: PASS + a landed
       // commit together override incidental transcript noise verdicts.
       const headAtExit = await gitHead(guardCwd);
-      const committedDuringRun = await computeCommittedDuringRun(
-        guardCwd,
-        guardHeadBefore,
+      // Worktree runs: attribution comes only from this run's own integration
+      // (a concurrent job's commit moving shared HEAD must not count).
+      const committedInWindow = worktree.ok
+        ? false
+        : await computeCommittedDuringRun(
+          guardCwd,
+          guardHeadBefore,
+          headAtExit,
+          job.startedAt,
+          new Date().toISOString(),
+        );
+      let rangeCommits = [];
+      let transcriptCommitShas = [];
+      let siblingOverlap = false;
+      if (!worktree.ok) {
+        rangeCommits = await gitRangeCommits(guardCwd, guardHeadBefore, headAtExit);
+        transcriptCommitShas = parseLog(path.join(runDir, `${job.slug}.log`)).transcriptCommitShas || [];
+        const overlapState = await readQueue().catch(() => ({ jobs: [] }));
+        const myStart = Date.parse(job.startedAt) || 0;
+        const myEnd = Date.now();
+        siblingOverlap = (overlapState.jobs || []).some((j) => {
+          if (j.slug === job.slug || (j.cwd || defaultCwd) !== guardCwd) return false;
+          if (j.status === 'running') return true;
+          const jStart = Date.parse(j.startedAt);
+          const jEnd = Date.parse(j.finishedAt);
+          if (!Number.isFinite(jStart) && !Number.isFinite(jEnd)) return false;
+          const s0 = Number.isFinite(jStart) ? jStart : jEnd;
+          const e0 = Number.isFinite(jEnd) ? jEnd : jStart;
+          return s0 <= myEnd && e0 >= myStart;
+        });
+      }
+      const attribution = resolveRunCommitAttribution({
+        ranInWorktree: Boolean(worktree.ok),
+        integratedSha,
+        headBefore: guardHeadBefore,
         headAtExit,
-        job.startedAt,
-        new Date().toISOString(),
-      );
-      if (guardHeadBefore && headAtExit && headAtExit !== guardHeadBefore) {
-        jobLandedCommitThisRun = headAtExit;
+        committedInWindow,
+        rangeCommits,
+        transcriptCommitShas,
+        siblingOverlap,
+      });
+      const committedDuringRun = attribution.committedDuringRun;
+      if (attribution.landedCommit) {
+        jobLandedCommitThisRun = attribution.landedCommit;
       }
 
       const prdPath = (await resolveVerifyPrdPath(job)) ?? archivedPrdPathForJob(job);
@@ -7955,7 +8039,9 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null, sib
           (j) => j.slug !== job.slug && j.status === 'running' && (j.cwd || defaultCwd) === guardCwd,
         );
         const guardHeadAfter = await gitHead(guardCwd);
-        const jobSelfCommitted = guardHeadBefore && guardHeadAfter && guardHeadAfter !== guardHeadBefore;
+        const jobSelfCommitted = worktree.ok
+          ? Boolean(jobLandedCommitThisRun)
+          : guardHeadBefore && guardHeadAfter && guardHeadAfter !== guardHeadBefore;
         const guardVerdict = commitGuardVerdict({
           newlyDirty,
           siblingRunning,
@@ -9703,9 +9789,7 @@ function bootRowPid(j, logPathOf) {
 }
 
 function signalAdoptedGroup(pgid, signal, pid) {
-  try { process.kill(-pgid, signal); } catch {
-    try { process.kill(pid, signal); } catch { /* already dead */ }
-  }
+  if (!killTree(pgid, signal)) killTree(pid, signal);
 }
 
 async function superviseAdoptedRunsPass(jobs) {
@@ -13595,6 +13679,7 @@ function registerAdminRoutes(adminHttp, remoteObj = remote) {
 module.exports = {
   reportSchedulerError,
   finalizeJobWorktree,
+  resolveRunCommitAttribution,
   worktreeIntegrationVerdict,
   guardedTick,
   rescheduleIntervalTick,