claude-code-session-manager 0.108.0 → 0.110.0

package/src/main/lib/updaterSettings.cjs

@@ -0,0 +1,64 @@
+/**
+ * updaterSettings — persists the in-app auto-update toggle.
+ *
+ * Storage: ~/.claude/session-manager/updater.json
+ * Shape: { enabled: boolean (ON by default), schemaVersion: 1 }
+ *
+ * Mirrors telemetrySettings.cjs: atomic write via config.cjs, frozen DEFAULTS,
+ * isValid() rejecting unknown keys. Pure data plumbing — no IPC, no UI.
+ */
+'use strict';
+
+const fsp = require('node:fs/promises');
+const path = require('node:path');
+const os = require('node:os');
+const config = require('../config.cjs');
+
+const SCHEMA_VERSION = 1;
+const DEFAULTS = Object.freeze({ enabled: true, schemaVersion: SCHEMA_VERSION });
+const KNOWN_KEYS = new Set(Object.keys(DEFAULTS));
+
+function storePath() {
+  return path.join(os.homedir(), '.claude', 'session-manager', 'updater.json');
+}
+
+function isValid(cfg) {
+  if (!cfg || typeof cfg !== 'object' || Array.isArray(cfg)) return false;
+  for (const k of Object.keys(cfg)) {
+    if (!KNOWN_KEYS.has(k)) return false;
+  }
+  return typeof cfg.enabled === 'boolean' && cfg.schemaVersion === SCHEMA_VERSION;
+}
+
+/** Never throws: missing, unparseable, or invalid files all yield the defaults. */
+async function load() {
+  try {
+    const data = JSON.parse(await fsp.readFile(storePath(), 'utf8'));
+    const merged = { ...DEFAULTS, ...data };
+    if (isValid(data && typeof data === 'object' && !Array.isArray(data) ? merged : data)) {
+      return { enabled: merged.enabled, schemaVersion: SCHEMA_VERSION };
+    }
+  } catch (e) {
+    if (e.code !== 'ENOENT') console.warn('[updaterSettings] load failed:', e.message);
+  }
+  return { ...DEFAULTS };
+}
+
+let writeQueue = Promise.resolve();
+async function save(patch) {
+  if (!patch || typeof patch !== 'object' || Array.isArray(patch)) throw new Error('Invalid updater config');
+  for (const k of Object.keys(patch)) {
+    if (k !== 'enabled') throw new Error('Invalid updater config');
+  }
+  if (typeof patch.enabled !== 'boolean') throw new Error('Invalid updater config');
+  const next = { enabled: patch.enabled, schemaVersion: SCHEMA_VERSION };
+  const run = async () => {
+    await config.writeJson(storePath(), next, { mode: 0o600 });
+    return next;
+  };
+  const tail = writeQueue.then(run, run);
+  writeQueue = tail.catch(() => {});
+  return tail;
+}
+
+module.exports = { storePath, load, save, isValid, DEFAULTS, SCHEMA_VERSION };

package/src/main/pty.cjs

@@ -111,6 +111,44 @@ class PtyManager {
     this.outBuffers = new Map();
     this.flushTimers = new Map(); // tabId -> Timeout
     this.window = null;
+    this.outputListeners = new Map(); // tabId -> Set<{onData,onExit}>
+  }
+
+  /**
+   * Observe a tab's coalesced output (the same string the renderer gets) and
+   * its exit from the main process. Returns an unsubscribe function.
+   * @param {string} tabId
+   * @param {(tabId: string, chunk: string) => void} onData
+   * @param {(tabId: string, info: {exitCode: number, signal?: number}) => void} [onExit]
+   */
+  addOutputListener(tabId, onData, onExit) {
+    const entry = { onData, onExit };
+    let set = this.outputListeners.get(tabId);
+    if (!set) {
+      set = new Set();
+      this.outputListeners.set(tabId, set);
+    }
+    set.add(entry);
+    return () => {
+      const cur = this.outputListeners.get(tabId);
+      if (!cur) return;
+      cur.delete(entry);
+      if (cur.size === 0) this.outputListeners.delete(tabId);
+    };
+  }
+
+  /** Fire every onExit listener for `tabId` once (errors isolated), then drop them. */
+  #notifyExit(tabId, info) {
+    const set = this.outputListeners.get(tabId);
+    this.outputListeners.delete(tabId);
+    if (!set) return;
+    for (const l of [...set]) {
+      try {
+        l.onExit?.(tabId, info);
+      } catch (err) {
+        console.warn('[pty] output listener onExit threw', err);
+      }
+    }
   }
 
   /** Send any pending buffered output for `tabId` now, and clear its timer. */
@@ -124,6 +162,16 @@ class PtyManager {
     if (pending) {
       this.outBuffers.delete(tabId);
       sendIfAlive(this.window, `pty:data:${tabId}`, pending);
+      const set = this.outputListeners.get(tabId);
+      if (set) {
+        for (const l of [...set]) {
+          try {
+            l.onData?.(tabId, pending);
+          } catch (err) {
+            console.warn('[pty] output listener onData threw', err);
+          }
+        }
+      }
     }
   }
 
@@ -328,6 +376,7 @@ class PtyManager {
         this.sessions.delete(tabId);
         this.buffers.delete(tabId);
         this.#dropOutput(tabId);
+        this.#notifyExit(tabId, { exitCode, signal });
         return;
       }
       // Flush any still-buffered output BEFORE the exit event so the renderer
@@ -349,6 +398,7 @@ class PtyManager {
         });
       }
       sendIfAlive(this.window, `pty:exit:${tabId}`, { exitCode, signal });
+      this.#notifyExit(tabId, { exitCode, signal });
       this.sessions.delete(tabId);
       this.buffers.delete(tabId);
     });
@@ -411,6 +461,9 @@ class PtyManager {
       this.sessions.delete(tabId);
       this.buffers.delete(tabId);
       this.#dropOutput(tabId);
+      // Listeners learn the tab is gone now; the suppressed exit event that
+      // follows finds none left, so each fires exactly once.
+      this.#notifyExit(tabId, { exitCode: 0, signal: undefined });
     }
   }
 

package/src/main/remoteClient.cjs

@@ -0,0 +1,334 @@
+'use strict';
+
+// Desktop-to-desktop remote: the CLIENT role. Drives a paired Session Manager
+// agent (webRemote.cjs) over the relay using the same envelope protocol the
+// phone app speaks (web/remote-app/src/ws.ts). No Electron imports — IPC wiring
+// lives elsewhere.
+
+const crypto = require('node:crypto');
+const path = require('node:path');
+const { claudeHome } = require('./lib/schedulerPaths.cjs');
+const { writeJsonAtomicSync, readJsonOrSync } = require('./lib/atomicFs.cjs');
+const { generateE2EKeyPair, deriveSessionKey, deriveSas, encryptBox, decryptBox } = require('./lib/remoteE2eCrypto.cjs');
+const { ALLOWED_COMMANDS } = require('./ipcSchemas.cjs');
+const { relayClientAuth } = require('./lib/relayClientAuth.cjs');
+
+// Hard-coded wss:// — same relay URL as webRemote.cjs, no plaintext downgrade.
+const RELAY_WSS_URL = 'wss://bilko.run/projects/session-manager/relay';
+const SEND_TIMEOUT_MS = 15_000;
+const WS_OPEN = 1;
+
+// The relay closes a revoked desktop client's socket with this code.
+const CLOSE_TOKEN_REVOKED = 4001;
+// Relay errors that end the handshake with a reason the UI can explain.
+const FATAL_RELAY_ERRORS = new Set(['device_offline', 'not_your_device']);
+
+function defaultWsFactory(url) {
+  const WebSocket = require('ws');
+  return new WebSocket(url, { rejectUnauthorized: true });
+}
+
+function defaultConfigPath() {
+  return path.join(claudeHome(), 'session-manager', 'remote-peers.json');
+}
+
+function createRemoteClient({ relayAuth = relayClientAuth, wsFactory = defaultWsFactory, configPath } = {}) {
+  const file = configPath || defaultConfigPath();
+  /** @type {Map<string, any>} peerId -> runtime state */
+  const runtime = new Map();
+  /** @type {Map<string, Set<Function>>} */
+  const subscribers = new Map();
+
+  function loadPeers() {
+    const data = readJsonOrSync(file, { peers: [] });
+    return Array.isArray(data?.peers) ? data.peers : [];
+  }
+  function savePeers(peers) {
+    writeJsonAtomicSync(file, { peers }, { mode: 0o600 });
+  }
+  function getPeer(peerId) {
+    return loadPeers().find((p) => p.peerId === peerId) || null;
+  }
+  function updatePeer(peerId, patch) {
+    const peers = loadPeers();
+    const i = peers.findIndex((p) => p.peerId === peerId);
+    if (i < 0) return;
+    peers[i] = { ...peers[i], ...patch };
+    savePeers(peers);
+  }
+
+  function rt(peerId) {
+    let s = runtime.get(peerId);
+    if (!s) {
+      s = {
+        status: 'idle', reason: null, sas: null, ws: null, sessionKey: null,
+        devicePubKey: null, pending: new Map(), attempt: 0, osRequested: false,
+      };
+      runtime.set(peerId, s);
+    }
+    return s;
+  }
+
+  function failPending(s, err) {
+    for (const p of s.pending.values()) { clearTimeout(p.timer); p.reject(err); }
+    s.pending.clear();
+  }
+
+  function fail(peerId, reason) {
+    const s = rt(peerId);
+    s.status = 'failed';
+    s.reason = reason;
+    s.sessionKey = null;
+    s.sas = null;
+    failPending(s, new Error(reason));
+    const ws = s.ws;
+    s.ws = null;
+    try { ws?.close(); } catch { /* already closed */ }
+  }
+
+  function addPeer({ peerId, deviceId, machineName }) {
+    if (!peerId || !deviceId) throw new Error('peerId and deviceId required');
+    const peers = loadPeers();
+    const existing = peers.find((p) => p.peerId === peerId);
+    if (existing) return existing;
+    const kp = generateE2EKeyPair();
+    const peer = {
+      peerId,
+      deviceId,
+      machineName: machineName || '',
+      pairedAt: new Date().toISOString(),
+      clientPrivateKey: kp.e2ePrivateKey,
+      clientPublicKey: kp.e2ePublicKey,
+      verifiedDevicePubKey: null,
+      os: null,
+    };
+    peers.push(peer);
+    savePeers(peers);
+    return peer;
+  }
+
+  function listPeers() {
+    // Never expose the private key to callers.
+    return loadPeers().map(({ clientPrivateKey, ...rest }) => rest);
+  }
+
+  function getStatus(peerId) {
+    const s = rt(peerId);
+    return { status: s.status, reason: s.reason, sas: s.sas };
+  }
+
+  // Fire-and-forget, once per connection: remember the remote's platform so the
+  // Remote view can show it offline. Any failure leaves `os` untouched.
+  function learnOs(peerId, s) {
+    if (s.osRequested) return;
+    s.osRequested = true;
+    send(peerId, 'cmd:app:info').then((res) => {
+      if (typeof res?.platform === 'string' && res.platform) updatePeer(peerId, { os: res.platform });
+    }).catch(() => { /* older remote or timeout: never fails the connection */ });
+  }
+
+  function markAuthenticated(peerId, s) {
+    s.status = 'authenticated';
+    learnOs(peerId, s);
+  }
+
+  function rawSend(ws, msg) {
+    ws.send(JSON.stringify(msg));
+  }
+
+  function handleInner(peerId, s, inner) {
+    if (!inner || typeof inner.type !== 'string') return;
+    if (inner.type.startsWith('resp:')) {
+      const p = s.pending.get(inner.id);
+      if (!p) return;
+      s.pending.delete(inner.id);
+      clearTimeout(p.timer);
+      p.resolve(inner.payload);
+      return;
+    }
+    if (inner.type.startsWith('event:')) {
+      for (const cb of subscribers.get(peerId) || []) {
+        try { cb(inner); } catch { /* subscriber errors never break the socket */ }
+      }
+    }
+  }
+
+  function handleMessage(peerId, s, peer, raw) {
+    let msg;
+    try { msg = JSON.parse(raw.toString()); } catch { return; }
+    if (!msg || typeof msg.type !== 'string') return;
+
+    if (msg.type === 'ping') {
+      if (s.ws && s.ws.readyState === WS_OPEN) rawSend(s.ws, { type: 'pong', id: msg.id, ts: Date.now() });
+      return;
+    }
+    if (msg.type === 'error') {
+      const code = msg.code || msg.payload?.code;
+      if (code === 'token_revoked') {
+        try { relayAuth.clearToken?.(); } catch { /* best effort */ }
+        fail(peerId, 'token_revoked');
+      } else if (FATAL_RELAY_ERRORS.has(code)) {
+        fail(peerId, code);
+      }
+      return;
+    }
+    if (msg.type === 'auth:ok') {
+      // Relay accepted the ticket: start the E2E handshake.
+      rawSend(s.ws, {
+        type: 'e2e:hello',
+        id: crypto.randomUUID(),
+        deviceId: peer.deviceId,
+        payload: { pubKey: peer.clientPublicKey },
+        ts: Date.now(),
+      });
+      return;
+    }
+    if (msg.type === 'e2e:ready') {
+      if (s.sessionKey) return;
+      try {
+        s.sessionKey = deriveSessionKey(peer.clientPrivateKey, s.devicePubKey, peer.deviceId);
+        s.sas = deriveSas(peer.clientPrivateKey, s.devicePubKey, peer.deviceId);
+      } catch {
+        fail(peerId, 'e2e_derivation_failed');
+        return;
+      }
+      if (peer.verifiedDevicePubKey && peer.verifiedDevicePubKey === s.devicePubKey) {
+        markAuthenticated(peerId, s);
+      } else {
+        s.status = 'pending_sas';
+      }
+      return;
+    }
+    if (msg.type === 'e2e:box') {
+      if (!s.sessionKey) return;
+      const { nonce, ciphertext } = msg.payload || {};
+      if (!nonce || !ciphertext) return;
+      const plain = decryptBox(nonce, ciphertext, s.sessionKey);
+      if (!plain) return;
+      let inner;
+      try { inner = JSON.parse(plain); } catch { return; }
+      handleInner(peerId, s, inner);
+    }
+  }
+
+  async function connect(peerId) {
+    const peer = getPeer(peerId);
+    if (!peer) throw new Error('unknown_peer');
+    const s = rt(peerId);
+    const attempt = ++s.attempt;
+    try { s.ws?.close(); } catch { /* already closed */ }
+    s.ws = null;
+    s.sessionKey = null;
+    s.sas = null;
+    s.reason = null;
+    s.osRequested = false;
+    s.status = 'connecting';
+
+    let ticket;
+    let devicePubKey;
+    try {
+      ticket = await relayAuth.getBrowserTicket(peer);
+      devicePubKey = await relayAuth.getDevicePubKey(peer.deviceId);
+    } catch (e) {
+      fail(peerId, e?.message || 'relay_auth_failed');
+      return getStatus(peerId);
+    }
+    if (attempt !== s.attempt) return getStatus(peerId); // superseded or removed
+    if (!ticket || !devicePubKey) {
+      fail(peerId, 'relay_auth_failed');
+      return getStatus(peerId);
+    }
+    // TOFU: a changed device key after pinning fails closed, before any socket opens.
+    if (peer.verifiedDevicePubKey && peer.verifiedDevicePubKey !== devicePubKey) {
+      fail(peerId, 'device_key_changed');
+      return getStatus(peerId);
+    }
+    s.devicePubKey = devicePubKey;
+
+    let ws;
+    try {
+      ws = wsFactory(`${RELAY_WSS_URL}?ticket=${encodeURIComponent(ticket)}`);
+    } catch {
+      fail(peerId, 'ws_create_failed');
+      return getStatus(peerId);
+    }
+    s.ws = ws;
+    ws.on('message', (data) => { if (s.ws === ws) handleMessage(peerId, s, peer, data); });
+    ws.on('close', (code) => {
+      if (s.ws !== ws) return;
+      if (code === CLOSE_TOKEN_REVOKED) {
+        try { relayAuth.clearToken?.(); } catch { /* best effort */ }
+        fail(peerId, 'token_revoked');
+        return;
+      }
+      s.ws = null;
+      s.sessionKey = null;
+      failPending(s, new Error('connection_closed'));
+      if (s.status !== 'failed') { s.status = 'idle'; s.sas = null; }
+    });
+    ws.on('error', () => { if (s.ws === ws) fail(peerId, 'ws_error'); });
+    return getStatus(peerId);
+  }
+
+  function confirmSas(peerId) {
+    const s = rt(peerId);
+    if (s.status !== 'pending_sas' || !s.devicePubKey) return { ok: false, reason: 'not_pending_sas' };
+    updatePeer(peerId, { verifiedDevicePubKey: s.devicePubKey });
+    markAuthenticated(peerId, s);
+    return { ok: true };
+  }
+
+  function send(peerId, type, payload) {
+    if (typeof type !== 'string' || !ALLOWED_COMMANDS.has(type)) {
+      return Promise.reject(new Error('command_not_allowed'));
+    }
+    const s = rt(peerId);
+    if (!s.ws || s.ws.readyState !== WS_OPEN || !s.sessionKey) {
+      return Promise.reject(new Error('not_connected'));
+    }
+    const id = crypto.randomUUID();
+    const peer = getPeer(peerId);
+    if (!peer) return Promise.reject(new Error('unknown_peer'));
+    const inner = { type, id, payload: payload ?? {}, ts: Date.now() };
+    const { nonce, ciphertext } = encryptBox(JSON.stringify(inner), s.sessionKey);
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => {
+        s.pending.delete(id);
+        reject(new Error('timeout'));
+      }, SEND_TIMEOUT_MS);
+      s.pending.set(id, { resolve, reject, timer });
+      try {
+        rawSend(s.ws, { type: 'e2e:box', id, deviceId: peer.deviceId, payload: { nonce, ciphertext }, ts: Date.now() });
+      } catch (e) {
+        s.pending.delete(id);
+        clearTimeout(timer);
+        reject(e);
+      }
+    });
+  }
+
+  function onEvent(peerId, cb) {
+    let set = subscribers.get(peerId);
+    if (!set) { set = new Set(); subscribers.set(peerId, set); }
+    set.add(cb);
+    return () => { set.delete(cb); };
+  }
+
+  function removePeer(peerId) {
+    const s = runtime.get(peerId);
+    if (s) {
+      s.attempt++;
+      failPending(s, new Error('peer_removed'));
+      try { s.ws?.close(); } catch { /* already closed */ }
+      runtime.delete(peerId);
+    }
+    subscribers.delete(peerId);
+    savePeers(loadPeers().filter((p) => p.peerId !== peerId));
+  }
+
+  return { addPeer, listPeers, connect, confirmSas, getStatus, send, onEvent, removePeer };
+}
+
+const remoteClient = createRemoteClient();
+
+module.exports = { createRemoteClient, remoteClient, SEND_TIMEOUT_MS };

package/src/main/remoteClientIpc.cjs

@@ -0,0 +1,133 @@
+'use strict';
+
+/**
+ * remoteClientIpc.cjs — IPC surface for the desktop-to-desktop remote client
+ * (remoteClient.cjs). Every payload is Zod-validated here, in main. Status
+ * changes and peer events are pushed to the renderer on `remoteClient:status`
+ * and `remoteClient:event`.
+ */
+
+const os = require('node:os');
+const { ipcMain } = require('electron');
+const { z } = require('zod');
+const { remoteClient } = require('./remoteClient.cjs');
+const { relayClientAuth } = require('./lib/relayClientAuth.cjs');
+const { ALLOWED_COMMANDS } = require('./ipcSchemas.cjs');
+const { sendIfAlive } = require('./lib/sendToRenderer.cjs');
+
+const STATUS_POLL_MS = 1000;
+
+const peerId = z.string().min(1).max(128);
+const pairCode = z.string().trim()
+  .transform((c) => c.replace(/[-\s]/g, '').toUpperCase())
+  .refine((c) => /^[A-Za-z0-9]{8}$/.test(c), { message: 'invalid_code' });
+const schemas = {
+  pair: z.object({ code: pairCode, clientName: z.string().max(64).optional() }),
+  add: z.object({ deviceId: z.string().min(1).max(128), machineName: z.string().min(1).max(64) }),
+  peer: z.object({ peerId }),
+  send: z.object({
+    peerId,
+    type: z.string().min(1).max(128).refine((t) => ALLOWED_COMMANDS.has(t), { message: 'command_not_allowed' }),
+    payload: z.unknown().optional(),
+  }),
+};
+
+function validated(schema, handler) {
+  return (_event, payload) => handler(schema.parse(payload));
+}
+
+function registerRemoteClientHandlers(getWindow, client = remoteClient, auth = relayClientAuth) {
+  const unsubs = new Map(); // peerId -> unsubscribe for event forwarding
+  const lastStatus = new Map(); // peerId -> serialized status
+
+  const toWindow = (channel, payload) => sendIfAlive(getWindow(), channel, payload);
+
+  function publishStatus(id) {
+    const status = client.getStatus(id);
+    const key = JSON.stringify(status);
+    if (lastStatus.get(id) === key) return status;
+    lastStatus.set(id, key);
+    toWindow('remoteClient:status', { peerId: id, ...status });
+    return status;
+  }
+
+  function ensureForwarding(id) {
+    if (unsubs.has(id)) return;
+    unsubs.set(id, client.onEvent(id, (ev) => {
+      toWindow('remoteClient:event', { peerId: id, type: ev.type, payload: ev.payload });
+    }));
+  }
+
+  // remoteClient has no status callback; the socket moves status on its own
+  // (pending_sas, failed, idle), so poll for changes on known peers.
+  const timer = setInterval(() => {
+    for (const p of client.listPeers()) publishStatus(p.peerId);
+  }, STATUS_POLL_MS);
+  if (typeof timer.unref === 'function') timer.unref();
+
+  ipcMain.handle('remoteClient:list', () => client.listPeers().map((p) => {
+    ensureForwarding(p.peerId);
+    return { ...p, ...client.getStatus(p.peerId) };
+  }));
+
+  ipcMain.handle('remoteClient:connect', validated(schemas.peer, async ({ peerId: id }) => {
+    ensureForwarding(id);
+    const connecting = client.connect(id);
+    publishStatus(id);
+    const status = await connecting;
+    publishStatus(id);
+    return status;
+  }));
+
+  ipcMain.handle('remoteClient:confirm-sas', validated(schemas.peer, ({ peerId: id }) => {
+    const res = client.confirmSas(id);
+    publishStatus(id);
+    return res;
+  }));
+
+  ipcMain.handle('remoteClient:remove', validated(schemas.peer, ({ peerId: id }) => {
+    client.removePeer(id);
+    const off = unsubs.get(id);
+    if (off) off();
+    unsubs.delete(id);
+    lastStatus.delete(id);
+    toWindow('remoteClient:status', { peerId: id, status: 'removed', reason: null, sas: null });
+    return { ok: true };
+  }));
+
+  ipcMain.handle('remoteClient:send', validated(schemas.send, ({ peerId: id, type, payload }) =>
+    client.send(id, type, payload)));
+
+  ipcMain.handle('remoteClient:auth-status', () => ({ paired: auth.isPaired(), clientId: auth.getClientId() }));
+
+  ipcMain.handle('remoteClient:pair', validated(schemas.pair, ({ code, clientName }) =>
+    auth.pair(code, clientName ?? os.hostname())));
+
+  ipcMain.handle('remoteClient:unpair', () => {
+    auth.clearToken();
+    return { ok: true };
+  });
+
+  ipcMain.handle('remoteClient:devices', async () => {
+    try {
+      return { ok: true, devices: await auth.listDevices() };
+    } catch (e) {
+      return { ok: false, error: e.message };
+    }
+  });
+
+  ipcMain.handle('remoteClient:add', validated(schemas.add, ({ deviceId, machineName }) => {
+    const { clientPrivateKey: _omit, ...peer } = client.addPeer({ peerId: deviceId, deviceId, machineName });
+    ensureForwarding(deviceId);
+    publishStatus(deviceId);
+    return peer;
+  }));
+
+  return () => {
+    clearInterval(timer);
+    for (const off of unsubs.values()) off();
+    unsubs.clear();
+  };
+}
+
+module.exports = { registerRemoteClientHandlers, schemas };

package/src/main/scheduler.cjs

@@ -9856,6 +9856,18 @@ async function superviseAdoptedRunsPass(jobs) {
   }
 }
 
+// A dead-pid row whose spawnJob() is still in flight (slug in runningSet) is
+// mid-finalize: integrating its sm-job branch, then writing the terminal row.
+// Reaping it races that merge (family-frame 137, 2026-10-10). The bound keeps
+// a wedged spawnJob from shielding its row forever — past it, reap as before.
+const FINALIZE_OWNERSHIP_MAX_MS = 30 * 60_000;
+const finalizeOwnedSince = new Map();
+function spawnJobStillFinalizing(slug, now) {
+  if (!runningSet.has(slug)) return false;
+  if (!finalizeOwnedSince.has(slug)) finalizeOwnedSince.set(slug, now);
+  return now - finalizeOwnedSince.get(slug) < FINALIZE_OWNERSHIP_MAX_MS;
+}
+
 async function reapDeadRunningJobs() {
   try {
     // Do NOT gate on runningSet: spawnJob()'s finally block unconditionally
@@ -9881,7 +9893,11 @@ async function reapDeadRunningJobs() {
       getLogPid: (j) => readSpawnedPidFromLog(logPathForJob(j)),
       getLogMtimeMs: (j) => readLogMtimeMs(logPathForJob(j)),
       logFreshWindowMs: IDLE_OUTPUT_KILL_MS,
+      finalizeOwned: (j) => spawnJobStillFinalizing(j.slug, Date.now()),
     });
+    for (const slug of finalizeOwnedSince.keys()) {
+      if (!runningSet.has(slug)) finalizeOwnedSince.delete(slug);
+    }
     for (const w of warnings) {
       console.warn(`[scheduler] reapDeadRunningJobs: ${w.reason} slug=${w.slug} — leaving row alone`);
     }