claude-code-session-manager 0.111.0 → 0.113.0

package/src/main/lib/{effectiveModelInfo.cjs → claude/effectiveModelInfo.cjs}

@@ -26,9 +26,9 @@
 const fs = require('node:fs');
 const path = require('node:path');
 const os = require('node:os');
-const { splitFrontmatter } = require('./prdFrontmatter.cjs');
-const { resolveEpicTranscriptPath } = require('./epicTranscriptPath.cjs');
-const schedulerPaths = require('./schedulerPaths.cjs');
+const { splitFrontmatter } = require('../prd/prdFrontmatter.cjs');
+const { resolveEpicTranscriptPath } = require('../epic/epicTranscriptPath.cjs');
+const schedulerPaths = require('../scheduler/schedulerPaths.cjs');
 
 // Deliberately stays a FIXED alias set (reviewed against the catalog-driven raw picker): it answers
 // "alias vs concrete id", not "which options to offer", so live catalog ids must not enter it.
@@ -70,7 +70,7 @@ function isConcreteModelId(modelAlias) {
  */
 function computeEffortEnvReachable(deps) {
   try {
-    const { cleanChildEnv } = deps.cleanEnv || require('./cleanEnv.cjs');
+    const { cleanChildEnv } = deps.cleanEnv || require('../process/cleanEnv.cjs');
     const probe = cleanChildEnv({ CLAUDE_EFFORT: 'high', CLAUDE_CODE_EFFORT_LEVEL: 'high' });
     return Boolean(probe.CLAUDE_EFFORT || probe.CLAUDE_CODE_EFFORT_LEVEL);
   } catch {
@@ -93,7 +93,7 @@ function computeEffortEnvReachable(deps) {
  * for the same dangling reference.
  */
 async function resolvePersonaModelAlias(cwd, agentType, deps) {
-  const getPersonaBody = deps.getPersonaBody || require('../agentLibrary.cjs').getPersonaBody;
+  const getPersonaBody = deps.getPersonaBody || require('../../agentLibrary.cjs').getPersonaBody;
   // The overlay-vs-global provenance question itself ("which of
   // resolvePersonaPaths' two candidates won") is answered by
   // agentModelResolve.cjs's isProjectOverlayPersonaPath, not re-derived here
@@ -125,7 +125,7 @@ async function resolvePersonaModelAlias(cwd, agentType, deps) {
 
 /** Best-effort read of `<cwd>/session-manager-operations/scheduler/state/queue.json`'s hot jobs[]. */
 function readHotJobsForCwd(cwd, deps) {
-  const { projectQueuePath } = deps.queueStore || require('./queueStore.cjs');
+  const { projectQueuePath } = deps.queueStore || require('../scheduler/queueStore.cjs');
   try {
     const data = JSON.parse(fs.readFileSync(projectQueuePath(cwd), 'utf8'));
     return Array.isArray(data.jobs) ? data.jobs : [];
@@ -136,7 +136,7 @@ function readHotJobsForCwd(cwd, deps) {
 
 /** Best-effort read of `<cwd>/session-manager-operations/scheduler/state/history.jsonl`'s archived rows. */
 function readHistoryEntriesForCwd(cwd, deps) {
-  const { projectHistoryPath } = deps.queueStore || require('./queueStore.cjs');
+  const { projectHistoryPath } = deps.queueStore || require('../scheduler/queueStore.cjs');
   let text;
   try {
     text = fs.readFileSync(projectHistoryPath(cwd), 'utf8');
@@ -246,7 +246,7 @@ function findLatestSchedulerModel(cwd, agentType, deps) {
  * O(min(transcriptSize, cap)) per transcript read.
  */
 function findLatestTranscriptModel(cwd, agentType, deps) {
-  const readActiveIndex = deps.readActiveIndex || require('./epicMint.cjs').readActiveIndex;
+  const readActiveIndex = deps.readActiveIndex || require('../epic/epicMint.cjs').readActiveIndex;
   let sessions;
   try {
     ({ sessions } = readActiveIndex(cwd));
@@ -296,7 +296,7 @@ async function resolveEffectiveModelInfo({ cwd, agentType, deps = {} } = {}) {
   if (!cwd || !agentType) return miss;
 
   try {
-    const { projectRootOf } = deps.activeSessions || require('./activeSessions.cjs');
+    const { projectRootOf } = deps.activeSessions || require('../activeSessions.cjs');
     const normalizedCwd = projectRootOf(path.resolve(cwd));
     if (!normalizedCwd) return miss;
 

package/src/main/lib/{modelCatalog.cjs → claude/modelCatalog.cjs}

@@ -29,7 +29,7 @@ const SCAN_OVERLAP_BYTES = 128;
 const MODEL_ID_RE = /claude-(?:opus|sonnet|haiku|fable)-[0-9][0-9-]*/g;
 // A real CLI binary is tens of MB; test stubs and launcher shims are tiny shell scripts.
 const MIN_SCAN_BYTES = 1024 * 1024;
-const SCHEMA_PATH = path.join(__dirname, '..', '..', 'renderer', 'data', 'claude-settings-schema.json');
+const SCHEMA_PATH = path.join(__dirname, '..', '..', '..', 'renderer', 'data', 'claude-settings-schema.json');
 
 const CATALOG_FLOOR = Object.freeze({
   aliases: Object.freeze(['haiku', 'sonnet', 'opus', 'fable']),
@@ -118,7 +118,7 @@ function readAvailableModels(cwd, d, fsImpl) {
   const home = d.homeDir ? d.homeDir() : os.homedir();
   let root = null;
   if (cwd) {
-    try { root = (d.projectRootOf || require('./activeSessions.cjs').projectRootOf)(path.resolve(cwd)); } catch { root = path.resolve(cwd); }
+    try { root = (d.projectRootOf || require('../activeSessions.cjs').projectRootOf)(path.resolve(cwd)); } catch { root = path.resolve(cwd); }
   }
   const files = [path.join(home, '.claude', 'settings.json')];
   if (root) files.push(path.join(root, '.claude', 'settings.json'), path.join(root, '.claude', 'settings.local.json'));
@@ -221,7 +221,7 @@ async function doResolve({ cwd, force, deps }) {
   };
   // Unknown version = unknown cache key: writing it would stamp `claudeVersion: null` over a real entry.
   if (!degraded && cacheFile && claudeVersion) {
-    try { await (d.writeJson || require('../config.cjs').writeJson)(cacheFile, catalog); } catch { /* cache is best-effort */ }
+    try { await (d.writeJson || require('../../config.cjs').writeJson)(cacheFile, catalog); } catch { /* cache is best-effort */ }
   }
   return catalog;
 }

package/src/main/lib/claude/rateLimitDetect.cjs

@@ -0,0 +1,54 @@
+'use strict';
+
+/**
+ * rateLimitDetect.cjs — the single source of truth for "did this claude -p
+ * log tail show a rate-limit death". Shared by spawnJob() (a still-running
+ * process that just exited) and reapDeadRunningJobs()/classifyRunOutcome()
+ * (a process the reaper found already dead) — see PRD 1117. Before this,
+ * only spawnJob checked this; the reaper had no rate-limit branch at all,
+ * so a rate-limited exit that the reaper won the race to finalize got
+ * stamped terminal 'failed' instead of retryable 'pending'. There must
+ * never be a second, independently-drifting regex set at either call site.
+ */
+
+const { readTail } = require('../util/fileTail.cjs');
+
+/** Scan the tail of a job's log for a GENUINE rate-limit rejection. Parses the
+ *  last 16 KB line by line as JSON (non-JSON / partial lines are skipped) and
+ *  returns true only for: (a) a rate_limit_event whose rate_limit_info.status
+ *  is 'rejected'; (b) a result event with api_error_status 429; (c) an
+ *  is_error result event whose `result` text is the CLI's limit message
+ *  ("You've hit your ... limit" / "You've reached your ... limit").
+ *
+ *  Never substring-match the raw text: informational rate_limit_event lines
+ *  (status 'allowed' / 'allowed_warning') carry rateLimitType on every run, so
+ *  the old substring match turned any non-zero exit (e.g. a watchdog SIGTERM,
+ *  exit 143) into a machine-wide rate_limit pause (2026-10-11 incident: 4-day
+ *  pause at 58% weekly). Tool output may also mention 429 or "rate limit". */
+function detectRateLimitInLog(logPath) {
+  try {
+    const text = readTail(logPath, 16384);
+    if (!text) return false;
+    for (const line of text.split('\n')) {
+      const t = line.trim();
+      if (!t || t[0] !== '{') continue;
+      let ev;
+      try { ev = JSON.parse(t); } catch { continue; }
+      if (!ev || typeof ev !== 'object') continue;
+      if (ev.type === 'rate_limit_event') {
+        if (ev.rate_limit_info && ev.rate_limit_info.status === 'rejected') return true;
+      } else if (ev.type === 'result') {
+        if (ev.api_error_status === 429) return true;
+        if (ev.is_error === true && typeof ev.result === 'string'
+          && (/You'?ve hit your .*limit/.test(ev.result) || /You'?ve reached your .* limit/.test(ev.result))) {
+          return true;
+        }
+      }
+    }
+    return false;
+  } catch {
+    return false;
+  }
+}
+
+module.exports = { detectRateLimitInLog };

package/src/main/lib/{rateLimitWindow.cjs → claude/rateLimitWindow.cjs}

@@ -13,7 +13,7 @@
  * unit-testable without scheduler.cjs (mirrors reaperHelpers.cjs's split).
  */
 
-const { readTail } = require('./fileTail.cjs');
+const { readTail } = require('../util/fileTail.cjs');
 
 // Authoritative window block rides on the LAST rate_limit_event in the log
 // (often the one attached to the final result), so mirror classifyRunOutcome's
@@ -21,17 +21,21 @@ const { readTail } = require('./fileTail.cjs');
 const TAIL_BYTES = 64 * 1024;
 
 /**
- * Scans a run log's tail for rate_limit_event entries and returns the
- * UNIX-seconds resetsAt of the window that actually bound (utilization >= 1.0)
- * in the LAST such event. When multiple windows bind in that event, the
- * latest resetsAt wins. Returns null when no rate_limit_event is found, or
- * none of its windows are at/above 1.0 utilization.
+ * Scans a run log's tail for rate_limit_event entries. The REJECTED event is
+ * authoritative (2026-10-11 incident: an allowed-only log with a seven_day
+ * window pause landed on the seven_day reset 4 days out): if any event has
+ * status 'rejected', the LAST one's reset wins — rate_limit_info.resetsAt, else
+ * unifiedWindows[rateLimitType].resetsAt. Otherwise, a last event carrying a
+ * status (allowed / allowed_warning) yields null, even if a window shows
+ * utilization >= 1.0 (overage is not a rejection). Legacy: a last event with
+ * no status falls back to the latest resetsAt among windows at utilization >= 1.0.
  */
 function resolveBindingRateLimitReset(logPath) {
   const text = readTail(logPath, TAIL_BYTES);
   if (!text) return null;
 
-  let lastWindows = null;
+  let lastRejected = null;
+  let lastEvent = null;
   for (const line of text.split('\n')) {
     const trimmed = line.trim();
     if (!trimmed || trimmed[0] !== '{') continue;
@@ -41,12 +45,20 @@ function resolveBindingRateLimitReset(logPath) {
     } catch {
       continue;
     }
-    const windows = event?.rate_limit_info?.unifiedWindows;
-    if (event?.type === 'rate_limit_event' && windows && typeof windows === 'object') {
-      lastWindows = windows;
-    }
+    if (event?.type !== 'rate_limit_event' || !event.rate_limit_info) continue;
+    lastEvent = event.rate_limit_info;
+    if (lastEvent.status === 'rejected') lastRejected = lastEvent;
+  }
+
+  if (lastRejected) {
+    if (typeof lastRejected.resetsAt === 'number') return lastRejected.resetsAt;
+    const typed = lastRejected.unifiedWindows?.[lastRejected.rateLimitType]?.resetsAt;
+    return typeof typed === 'number' ? typed : null;
   }
-  if (!lastWindows) return null;
+  if (!lastEvent || lastEvent.status !== undefined) return null;
+
+  const lastWindows = lastEvent.unifiedWindows;
+  if (!lastWindows || typeof lastWindows !== 'object') return null;
 
   let latestBoundReset = null;
   for (const window of Object.values(lastWindows)) {

package/src/main/lib/{runClaudeP.cjs → claude/runClaudeP.cjs}

@@ -17,7 +17,7 @@
 const { spawn } = require('node:child_process');
 const { resolveClaudeBin, claudeSpawnTarget } = require('./claudeBin.cjs');
 const { headlessPermissionArgs, ensureCliCapsProbed } = require('./claudeCliCaps.cjs');
-const { withProcRole } = require('./cleanEnv.cjs');
+const { withProcRole } = require('../process/cleanEnv.cjs');
 
 const MAX_OUT_BYTES = 8 * 1024 * 1024;
 

package/src/main/lib/credentials.cjs

@@ -5,9 +5,8 @@ const fs = require('node:fs');
 const path = require('node:path');
 const os = require('node:os');
 const { spawn, execFileSync } = require('node:child_process');
-const { cleanChildEnv, pathWithUserBins } = require('./cleanEnv.cjs');
-const atomicFs = require('./atomicFs.cjs');
-const { resolveClaudeBin, claudeSpawnTarget } = require('./claudeBin.cjs');
+const { cleanChildEnv, pathWithUserBins } = require('./process/cleanEnv.cjs');
+const { resolveClaudeBin, claudeSpawnTarget } = require('./claude/claudeBin.cjs');
 
 const CREDS_PATH = path.join(os.homedir(), '.claude', '.credentials.json');
 
@@ -47,22 +46,9 @@ function keychainAccount() {
   return os.userInfo().username;
 }
 
-/** Write the credential JSON back into the Keychain (-U upserts in place). */
-function writeKeychainRaw(value) {
-  execFileSync(
-    'security',
-    ['add-generic-password', '-U', '-s', KEYCHAIN_SERVICE, '-a', keychainAccount(), '-w', value],
-    { timeout: 10_000, stdio: 'ignore' },
-  );
-}
 const REFRESH_LOG_PATH = path.join(os.homedir(), '.claude', 'session-manager', 'credential-refresh.log');
 const REFRESH_LOG_MAX_BYTES = 100 * 1024;
 
-// Standard OAuth 2.0 refresh grant — endpoint discovered from Claude Code CLI behavior.
-// Returns { kind: 'unsupported' } if the endpoint returns 404 or cannot be reached,
-// allowing the caller to fall back gracefully.
-const OAUTH_TOKEN_URL = 'https://claude.ai/api/auth/oauth/token';
-
 /** Parse a raw credential JSON blob (from file or Keychain) into a result. */
 function parseCredsRaw(raw, source) {
   let data;
@@ -125,14 +111,13 @@ function isExpiringSoon(creds, withinMs = 5 * 60_000) {
  * isRefreshFutile(creds) → boolean
  *
  * True when the token is already expired AND there is no refresh token to
- * present. In that state every refresh avenue is a dead end: tryOAuthRefresh
- * short-circuits to 'unsupported' (it needs `creds.refreshToken`), and the
+ * present. In that state the refresh avenue is a dead end: the
  * `claude --version` CLI fallback performs its own silent OAuth refresh from
  * that SAME missing refresh token, so it cannot help either. The only recovery
  * is an out-of-band `claude login` — which refreshIfNeeded picks up on its very
  * next call via the isExpiringSoon early-return, since fresh creds never reach
  * this path. Left ungated, this state made pollLoop spawn a `claude --version`
- * process and write the oauth_refresh_unsupported → cli_fallback_ok →
+ * process and write the cli_fallback_ok →
  * auth_failed_expired triple on EVERY 15 s poll, forever (observed 2026-09-23:
  * expiredAtMs 1775277875159, identical triple every ~15 min across the log).
  */
@@ -153,17 +138,6 @@ function __resetFutileRefreshThrottle() {
   lastFutileRefreshLoggedAt = null;
 }
 
-async function writeCredentials(rawData, freshOauth, source = 'file') {
-  const next = { ...rawData, claudeAiOauth: { ...rawData.claudeAiOauth, ...freshOauth } };
-  if (source === 'keychain') {
-    // macOS: upsert back into the Keychain. Sync + may throw — caller catches
-    // and falls back to the `claude --version` CLI refresh path.
-    writeKeychainRaw(JSON.stringify(next));
-    return;
-  }
-  await atomicFs.writeJsonAtomic(CREDS_PATH, next, { mode: 0o600, newline: false });
-}
-
 function appendRefreshLog(entry) {
   try {
     const line = JSON.stringify({ ...entry, ts: new Date().toISOString() }) + '\n';
@@ -179,36 +153,7 @@ function appendRefreshLog(entry) {
   } catch { /* non-fatal; telemetry must not break the main flow */ }
 }
 
-// Stretch: attempt standard OAuth 2.0 refresh token grant.
-async function tryOAuthRefresh(creds) {
-  if (!creds.refreshToken) return { kind: 'unsupported', message: 'no refresh token in credentials' };
-  try {
-    const r = await fetch(OAUTH_TOKEN_URL, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ grant_type: 'refresh_token', refresh_token: creds.refreshToken }),
-      signal: AbortSignal.timeout(10_000),
-    });
-    if (r.status === 404) return { kind: 'unsupported', message: 'refresh endpoint not found (HTTP 404)' };
-    if (r.status === 401 || r.status === 403) return { kind: 'auth', message: `refresh rejected: HTTP ${r.status}` };
-    if (!r.ok) return { kind: 'transient', message: `HTTP ${r.status}` };
-    const j = await r.json();
-    if (!j.access_token) return { kind: 'auth', message: 'no access_token in refresh response' };
-    return {
-      kind: 'ok',
-      fresh: {
-        accessToken: j.access_token,
-        refreshToken: j.refresh_token ?? creds.refreshToken,
-        expiresAt: j.expires_at ?? (Date.now() + (j.expires_in ?? 3600) * 1000),
-      },
-    };
-  } catch (e) {
-    if (e?.name === 'TimeoutError') return { kind: 'transient', message: 'refresh request timed out' };
-    return { kind: 'unsupported', message: `refresh error: ${e?.message}` };
-  }
-}
-
-// Stretch fallback: spawning `claude --version` triggers silent token refresh in the CLI binary.
+// Sole refresh avenue: spawning `claude --version` triggers silent token refresh in the CLI binary.
 function tryCliFallback() {
   return new Promise((resolve) => {
     let settled = false;
@@ -244,7 +189,7 @@ function tryCliFallback() {
 async function refreshIfNeeded(forceRefresh = false) {
   const cr = await readCredentials();
   if (cr.kind !== 'ok') return cr;
-  const { creds, raw, source } = cr;
+  const { creds } = cr;
 
   if (!forceRefresh && !isExpiringSoon(creds)) {
     return { kind: 'ok', creds };
@@ -253,12 +198,12 @@ async function refreshIfNeeded(forceRefresh = false) {
   const alreadyExpired = isExpired(creds);
 
   // Futile-refresh short-circuit: token already expired AND no refresh token
-  // to present. Every downstream avenue (OAuth grant, `claude --version` CLI
-  // fallback) is a guaranteed dead end from the same missing token, so running
-  // them on every 15 s poll only spawns a doomed child process and re-logs the
+  // to present. The `claude --version` CLI fallback is a guaranteed dead end
+  // from the same missing token, so running it on every 15 s poll only spawns
+  // a doomed child process and re-logs the
   // same triple forever (2026-09-23 storm). Re-read once — cheap, and the ONE
   // real recovery (`claude login`) lands here — then, if still futile, return
-  // the auth verdict WITHOUT the OAuth call or the CLI-fallback spawn, logging
+  // the auth verdict WITHOUT the CLI-fallback spawn, logging
   // at most once per FUTILE_REFRESH_COOLDOWN_MS instead of every poll.
   if (isRefreshFutile(creds)) {
     const recheckCr = await readCredentials();
@@ -279,38 +224,19 @@ async function refreshIfNeeded(forceRefresh = false) {
     };
   }
 
-  // Stretch: try OAuth refresh endpoint first.
-  const oauthResult = await tryOAuthRefresh(creds);
-  appendRefreshLog({ event: `oauth_refresh_${oauthResult.kind}`, message: oauthResult.message ?? null });
-
-  if (oauthResult.kind === 'ok') {
-    try {
-      await writeCredentials(raw, oauthResult.fresh, source);
-      const freshCr = await readCredentials();
-      if (freshCr.kind === 'ok') {
-        appendRefreshLog({ event: 'oauth_refresh_written_ok' });
-        return { kind: 'ok', creds: freshCr.creds };
-      }
-    } catch (e) {
-      appendRefreshLog({ event: 'oauth_refresh_write_failed', error: e?.message });
-    }
-  }
-
-  // Stretch: if OAuth didn't explicitly reject the token, try `claude --version` fallback.
-  if (oauthResult.kind !== 'auth') {
-    const cliResult = await tryCliFallback();
-    appendRefreshLog({ event: cliResult.ok ? 'cli_fallback_ok' : 'cli_fallback_failed', reason: cliResult.reason ?? null });
-    if (cliResult.ok) {
-      const freshCr = await readCredentials();
-      if (freshCr.kind === 'ok' && !isExpired(freshCr.creds)) {
-        return { kind: 'ok', creds: freshCr.creds };
-      }
+  // The CLI owns the real refresh contract: `claude --version` refreshes silently.
+  const cliResult = await tryCliFallback();
+  appendRefreshLog({ event: cliResult.ok ? 'cli_fallback_ok' : 'cli_fallback_failed', reason: cliResult.reason ?? null });
+  if (cliResult.ok) {
+    const freshCr = await readCredentials();
+    if (freshCr.kind === 'ok' && !isExpired(freshCr.creds)) {
+      return { kind: 'ok', creds: freshCr.creds };
     }
   }
 
   if (alreadyExpired) {
     // Re-read from disk in case credentials were externally refreshed (e.g. via
-    // `claude login`) between our initial read and the failed OAuth attempt.
+    // `claude login`) between our initial read and the failed CLI fallback.
     const recheckCr = await readCredentials();
     if (recheckCr.kind === 'ok' && !isExpired(recheckCr.creds)) {
       appendRefreshLog({ event: 'externally_refreshed_ok', recheckExpiresAt: recheckCr.creds.expiresAt ?? null });

package/src/main/lib/cwdClassify.cjs

@@ -41,7 +41,7 @@
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
-const schedulerPaths = require('./schedulerPaths.cjs');
+const schedulerPaths = require('./scheduler/schedulerPaths.cjs');
 
 const OPS_DIRNAME = 'session-manager-operations';
 const WORKTREES_MARKER = `${path.sep}.git${path.sep}worktrees${path.sep}`;

package/src/main/lib/{activeIndexMerge.cjs → epic/activeIndexMerge.cjs}

@@ -35,7 +35,7 @@
 
 const path = require('path');
 const { activeIndexPath, withPathLock } = require('./epicMint.cjs');
-const config = require('../config.cjs');
+const config = require('../../config.cjs');
 const { mirrorEpicStatus } = require('./epicStatusMirror.cjs');
 
 function hasOwn(obj, key) {
@@ -73,7 +73,7 @@ async function mergeActiveIndex(cwd, { sessions: rawMemorySessions = {}, events:
   if (!cwd || typeof cwd !== 'string') throw new Error('mergeActiveIndex: cwd is required');
   // Register this project's cwd as a write-allowed root (config.cjs's
   // validateWrite gate) — mirrors the precedent + comment in
-  // lib/prdCreate.cjs:152-155. A chat-only Epic (headless claude -p, no
+  // lib/prd/prdCreate.cjs:152-155. A chat-only Epic (headless claude -p, no
   // Terminal PTY ever spawned for this cwd) reaches this merge on a cold
   // boot before pty.cjs's addAllowedRoot call has ever run for it — without
   // this, every active-index.json write for such a project fails with
@@ -181,7 +181,7 @@ async function mergeActiveIndex(cwd, { sessions: rawMemorySessions = {}, events:
 
 function registerActiveIndexMergeHandlers() {
   const { ipcMain } = require('electron');
-  const { schemas: s, validated: v } = require('../ipcSchemas.cjs');
+  const { schemas: s, validated: v } = require('../../ipcSchemas.cjs');
   ipcMain.handle(
     'promptSessions:merge-active-index',
     v(s.promptSessionsMergeActiveIndex, ({ cwd, sessions, events, removedIds }) =>

package/src/main/lib/{activeIndexRebuild.cjs → epic/activeIndexRebuild.cjs}

@@ -20,7 +20,7 @@ const path = require('node:path');
 const { activeIndexPath, readActiveIndex, writeActiveIndex, withPathLock } = require('./epicMint.cjs');
 
 function promptSessionsDir(cwd) {
-  const { opsPath } = require('./opsOwnership.cjs');
+  const { opsPath } = require('../opsOwnership.cjs');
   return opsPath(cwd, 'prompt-sessions');
 }
 

package/src/main/lib/{delegationReadiness.cjs → epic/delegationReadiness.cjs}

@@ -20,36 +20,28 @@ const fs = require('node:fs');
 const path = require('node:path');
 const os = require('node:os');
 const { spawn } = require('node:child_process');
-const { writeJson, addAllowedRoot } = require('../config.cjs');
-const { cleanChildEnv, pathWithUserBins } = require('./cleanEnv.cjs');
-const { shimPath: guardShimPath, resolveShimTarget, ensureGuardShimsOrError } = require('./guardShims.cjs');
-const { resolveProjectRoot } = require('./opsOwnership.cjs');
-const { nodeShellCommand } = require('./appRuntime.cjs');
+const { writeJson, addAllowedRoot } = require('../../config.cjs');
+const { cleanChildEnv, pathWithUserBins } = require('../process/cleanEnv.cjs');
+const { shimPath: guardShimPath, resolveShimTarget, ensureGuardShimsOrError } = require('../guardShims.cjs');
+const { resolveProjectRoot } = require('../opsOwnership.cjs');
+const { nodeShellCommand } = require('../appRuntime.cjs');
+const { readJsonOrSync } = require('../util/atomicFs.cjs');
 
 const SCHEDULER_MCP_NAME = 'session-manager-scheduler';
 const DEV_PLUGIN_ENABLED_KEY = 'session-manager-dev@session-manager';
-const SCHEDULER_MCP_SERVER_SCRIPT = path.resolve(__dirname, '..', '..', '..', 'scripts', 'scheduler-mcp-server.cjs');
-const PRD_WRITE_GUARD_SCRIPT = path.resolve(__dirname, '..', '..', '..', 'scripts', 'hooks', 'guard-prd-writes.cjs');
+const SCHEDULER_MCP_SERVER_SCRIPT = path.resolve(__dirname, '..', '..', '..', '..', 'scripts', 'scheduler-mcp-server.cjs');
+const PRD_WRITE_GUARD_SCRIPT = path.resolve(__dirname, '..', '..', '..', '..', 'scripts', 'hooks', 'guard-prd-writes.cjs');
 const PRD_WRITE_GUARD_MATCHER = 'Write|Edit|NotebookEdit';
-const DESTRUCTIVE_GIT_GUARD_SCRIPT = path.resolve(__dirname, '..', '..', '..', 'scripts', 'hooks', 'guard-destructive-git.cjs');
+const DESTRUCTIVE_GIT_GUARD_SCRIPT = path.resolve(__dirname, '..', '..', '..', '..', 'scripts', 'hooks', 'guard-destructive-git.cjs');
 const DESTRUCTIVE_GIT_GUARD_MATCHER = 'Bash';
-const INLINE_IMPLEMENTATION_GUARD_SCRIPT = path.resolve(__dirname, '..', '..', '..', 'scripts', 'hooks', 'guard-inline-implementation.cjs');
+const INLINE_IMPLEMENTATION_GUARD_SCRIPT = path.resolve(__dirname, '..', '..', '..', '..', 'scripts', 'hooks', 'guard-inline-implementation.cjs');
 const INLINE_IMPLEMENTATION_GUARD_MATCHER = 'Write|Edit|NotebookEdit';
-const SELF_SCHEDULE_GUARD_SCRIPT = path.resolve(__dirname, '..', '..', '..', 'scripts', 'hooks', 'guard-self-schedule.cjs');
+const SELF_SCHEDULE_GUARD_SCRIPT = path.resolve(__dirname, '..', '..', '..', '..', 'scripts', 'hooks', 'guard-self-schedule.cjs');
 const SELF_SCHEDULE_GUARD_MATCHER = 'ScheduleWakeup|CronCreate|Task|Agent';
 const LIVE_PROBE_TIMEOUT_MS = 10_000;
 const LIVE_PROBE_TTL_MS = 60_000;
 const REQUIRED_LIVE_TOOLS = ['scheduler_create_prd', 'session_manager_help'];
 
-/** Read + JSON.parse a file, returning `fallback` on any read/parse failure. */
-function readJsonSafe(absPath, fallback) {
-  try {
-    return JSON.parse(fs.readFileSync(absPath, 'utf8'));
-  } catch {
-    return fallback;
-  }
-}
-
 /** Lazy (not a module-load constant) so tests can toggle packaged mode. */
 function schedulerMcpFixCmd() {
   const cmd = nodeShellCommand(SCHEDULER_MCP_SERVER_SCRIPT);
@@ -68,10 +60,10 @@ function schedulerMcpFixCmd() {
  * which is the incident this PRD closes.
  */
 function checkSchedulerMcp({ cwd, homeDir }) {
-  const userConfig = readJsonSafe(path.join(homeDir, '.claude.json'), null);
+  const userConfig = readJsonOrSync(path.join(homeDir, '.claude.json'), null);
   const userEntry = userConfig?.mcpServers?.[SCHEDULER_MCP_NAME];
 
-  const projectConfig = readJsonSafe(path.join(cwd, '.mcp.json'), null);
+  const projectConfig = readJsonOrSync(path.join(cwd, '.mcp.json'), null);
   const projectHas = !!projectConfig?.mcpServers?.[SCHEDULER_MCP_NAME];
 
   if (userEntry) {
@@ -129,10 +121,10 @@ function checkSchedulerMcp({ cwd, homeDir }) {
  * (enableAllProjectMcpServers), not something this probe decides.
  */
 function checkSchedulerMcpProjectDuplicate({ cwd, homeDir }) {
-  const userConfig = readJsonSafe(path.join(homeDir, '.claude.json'), null);
+  const userConfig = readJsonOrSync(path.join(homeDir, '.claude.json'), null);
   const userHas = !!userConfig?.mcpServers?.[SCHEDULER_MCP_NAME];
 
-  const projectConfig = readJsonSafe(path.join(cwd, '.mcp.json'), null);
+  const projectConfig = readJsonOrSync(path.join(cwd, '.mcp.json'), null);
   const projectHas = !!projectConfig?.mcpServers?.[SCHEDULER_MCP_NAME];
 
   const warn = userHas && projectHas;
@@ -289,7 +281,7 @@ async function checkSchedulerMcpLive({ cwd, homeDir, schedulerMcpCheck }) {
   // executed the moment its cwd is merely probed, bypassing that approval
   // entirely. Auto-approving project-scope servers is explicitly out of
   // scope for this probe — see this PRD's "Out of scope".
-  const userConfig = readJsonSafe(path.join(homeDir, '.claude.json'), null);
+  const userConfig = readJsonOrSync(path.join(homeDir, '.claude.json'), null);
   const entry = userConfig?.mcpServers?.[SCHEDULER_MCP_NAME];
 
   if (!entry?.command) {
@@ -312,7 +304,7 @@ async function checkSchedulerMcpLive({ cwd, homeDir, schedulerMcpCheck }) {
 }
 
 function checkDevPlugin({ homeDir }) {
-  const settings = readJsonSafe(path.join(homeDir, '.claude', 'settings.json'), null);
+  const settings = readJsonOrSync(path.join(homeDir, '.claude', 'settings.json'), null);
   const ok = settings?.enabledPlugins?.[DEV_PLUGIN_ENABLED_KEY] === true;
 
   return {
@@ -444,7 +436,7 @@ const GUARD_DEFS = {
  * while reporting green" failure mode, one hop downstream of the hook command.
  */
 function checkGuard(def, { cwd, homeDir = os.homedir() }) {
-  const settings = readJsonSafe(path.join(cwd, '.claude', 'settings.json'), null);
+  const settings = readJsonOrSync(path.join(cwd, '.claude', 'settings.json'), null);
   const preToolUse = Array.isArray(settings?.hooks?.PreToolUse) ? settings.hooks.PreToolUse : [];
 
   let mentioned = false;
@@ -536,7 +528,7 @@ async function installGuard(def, { cwd, homeDir = os.homedir(), skipShimEnsure =
   // documents for PromptSession archive writes. `cwd` here IS a project root.
   addAllowedRoot(cwd);
 
-  const existing = fs.existsSync(settingsPath) ? readJsonSafe(settingsPath, undefined) : {};
+  const existing = fs.existsSync(settingsPath) ? readJsonOrSync(settingsPath, undefined) : {};
   if (existing === undefined) {
     // Unparseable settings — refuse rather than silently discarding whatever
     // the human has in there.
@@ -629,7 +621,7 @@ async function installSelfScheduleGuard({ cwd, homeDir = os.homedir(), skipShimE
 
 /**
  * Runs all eight delegation-readiness checks for `cwd`. Every filesystem read
- * is wrapped (readJsonSafe / try-catch) so a missing or unparseable file
+ * is wrapped (readJsonOrSync / try-catch) so a missing or unparseable file
  * yields ok:false with a detail, never a thrown exception. Async because
  * scheduler-mcp-live genuinely spawns a process and waits on it (bounded by
  * LIVE_PROBE_TIMEOUT_MS, and memoized per registration signature so repeat
@@ -673,7 +665,7 @@ function logAutoInstallEvent({ cwd, guard, action, error }) {
   // A no-op outcome is not an event worth an error-log row (24 rows/3 days of boot noise).
   if (action === 'already-installed') return;
   try {
-    const opsErrorLog = require('./opsErrorLog.cjs');
+    const opsErrorLog = require('../telemetry/opsErrorLog.cjs');
     opsErrorLog.appendError({
       cwd,
       scope: 'delegationReadiness',

package/src/main/lib/{epicContextDigest.cjs → epic/epicContextDigest.cjs}

@@ -13,7 +13,7 @@
  * scheduler.cjs.
  */
 
-const { readTurns } = require('../promptSessionTranscript.cjs');
+const { readTurns } = require('../../promptSessionTranscript.cjs');
 const { readActiveIndex } = require('./epicMint.cjs');
 
 const DEFAULT_MAX_CHARS = 4000;

package/src/main/lib/{epicDelegationStats.cjs → epic/epicDelegationStats.cjs}

@@ -28,7 +28,7 @@ const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
 const { resolveEpicTranscriptPath } = require('./epicTranscriptPath.cjs');
-const { classifyLine } = require('./classifyTranscriptLine.cjs');
+const { classifyLine } = require('../classifyTranscriptLine.cjs');
 
 // Same cap transcripts.cjs's readDelta uses for a single pass — bounds
 // memory/time on a very large transcript instead of reading it whole.
@@ -40,7 +40,7 @@ const APPLICATION_SOURCE_PREFIXES = ['src/', 'scripts/', 'plugins/', 'bin/'];
 function countPrdsQueued(cwd, epicId, deps = {}) {
   const readdirSync = deps.readdirSync || fs.readdirSync;
   try {
-    const { opsPath } = require('./opsOwnership.cjs');
+    const { opsPath } = require('../opsOwnership.cjs');
     const dir = opsPath(cwd, 'scheduler', 'epics', epicId, 'prds');
     return readdirSync(dir).filter((name) => name.endsWith('.md')).length;
   } catch {