claude-code-session-manager 0.123.1 → 0.124.1

package/src/main/lib/scheduler/reaperHelpers.cjs

@@ -12,72 +12,78 @@ const path = require('node:path');
 const { readTail } = require('../util/fileTail.cjs');
 const { detectRateLimitInLog } = require('../claude/rateLimitDetect.cjs');
 const { pidAlive } = require('../process/pidAlive.cjs');
+const { smArgv0 } = require('../process/procName.cjs');
 
 /**
- * Return true if pid is alive AND its cmdline looks like a claude process.
+ * isClaudeArgv(argv) — strict claude-executor identity. Pure.
  *
- * Guards against PID recycling: on Linux we read /proc/<pid>/cmdline and
- * require /\bclaude\b/ in the command. On macOS (no /proc) we can't read
- * cmdline, so we conservatively return true — never false-reap a live PID
- * just because we can't verify its identity.
- *
- * Existence check now delegates to the shared pidAlive() (pidAlive.cjs) so
- * EPERM (pid exists, owned by another user) counts as alive here too — the
- * previous bare `process.kill(pid, 0)` + catch-all-false treated EPERM the
- * same as ESRCH (no such process), silently false-reaping a live-but-
- * unsignalable pid.
+ * Judges argv[0] (and argv[1] only for a node/bun-launched CLI) — never a
+ * substring of the whole command line. 2026-10-25: a stray
+ * `tail -F /tmp/claude-1000/.../x.log` matched /\bclaude\b/ and was adopted as
+ * the executor of two pidless rows for up to 25 hours.
+ */
+function isClaudeArgv(argv) {
+  if (!Array.isArray(argv) || argv.length === 0 || typeof argv[0] !== 'string') return false;
+  const base = path.basename(argv[0]);
+  if (base === 'claude' || base.startsWith('sm-claude-')) return true;
+  if (base === 'node' || base === 'bun') {
+    const a1 = typeof argv[1] === 'string' ? argv[1] : '';
+    // A shebang-script claude launched through an sm-claude-* alias shows the
+    // alias path as argv[1] (the kernel rewrites script argv), so accept it too.
+    return /\/claude(\.js|\.mjs|\.cjs)?$/.test(a1) || a1.includes('/@anthropic-ai/claude-code/')
+      || path.basename(a1).startsWith('sm-claude-');
+  }
+  return false;
+}
+
+/** Read /proc/<pid>/cmdline as an argv array; null when unreadable. */
+function readArgv(pid) {
+  try {
+    const parts = fs.readFileSync(`/proc/${pid}/cmdline`, 'utf8').split('\0');
+    if (parts.length && parts[parts.length - 1] === '') parts.pop();
+    return parts;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Return true if pid is alive AND its argv looks like a claude process
+ * (isClaudeArgv). Guards against PID recycling. Where /proc/<pid>/cmdline
+ * cannot be read (macOS, permission denied) or on win32, conservatively
+ * returns true — never false-reap a live PID we cannot identify.
  *
- * Conservative by design: a false negative (live process treated as dead) is
- * far worse than a late reap.
+ * Existence check delegates to the shared pidAlive() so EPERM counts as alive.
  */
 function claudePidAlive(pid, { platform = process.platform } = {}) {
   if (!pid || typeof pid !== 'number' || pid <= 1) return false;
   if (!pidAlive(pid)) return false;
-  // Windows has no /proc — cannot verify identity, so never call it dead.
   if (platform === 'win32') return true;
-  try {
-    const cmd = fs.readFileSync(`/proc/${pid}/cmdline`, 'utf8').replace(/\0/g, ' ');
-    return /\bclaude\b/.test(cmd);
-  } catch {
-    // Can't read cmdline (macOS, permission denied) → assume alive.
-    return true;
-  }
+  const argv = readArgv(pid);
+  if (argv === null) return true;
+  return isClaudeArgv(argv);
 }
 
 /**
- * findLiveProcessForJob(job, { worktreeDir, runCwd }) → pid | null
+ * findLiveProcessForJob(job, { worktreeDir }) → pid | null
  *
- * Positive liveness scan for a 'running' row whose `runtime.pid` is missing —
- * the case a missing pid must NOT be read as "the process is gone" (2026-09-06
- * incident: 234-uranus-eight-tails-ox marked failed/never_ran while PID
- * 2174739 was a live `claude -p` still writing to that job's own worktree).
+ * Positive liveness scan for a 'running' row whose `runtime.pid` is missing
+ * (2026-09-06: a pidless row was reaped while its claude was still alive).
  *
- * Linux-`/proc` only. Scans every numeric `/proc/<pid>` entry and matches any
- * of, in order:
- *  - `/proc/<pid>/cwd` resolves to `worktreeDir` (or a path nested under it)
- *    — sufficient alone, no cmdline check needed.
- *  - `/proc/<pid>/cmdline` contains both `claude` and the job's slug —
- *    fallback for a worktree-disabled/in-place run with no dedicated
- *    worktreeDir to match against.
- *  - `/proc/<pid>/cwd` resolves to `runCwd` (or nested under it) AND
- *    `/proc/<pid>/cmdline` contains `claude` (2026-09-13 incident:
- *    runId 2026-09-13T16-15-56-818Z ran in-place in the shared tree — no
- *    worktree, and dispatch never puts the slug into argv — so neither of
- *    the above could ever match a live pid 3138458). `runCwd` is deliberately
- *    NEVER matched alone: several concurrent jobs commonly share one tree's
- *    cwd, so a bare cwd match without the process-identity check would
- *    cross-match the wrong job's process.
+ * Linux-`/proc` only. A candidate must pass isClaudeArgv AND either:
+ *  - `/proc/<pid>/cwd` is `worktreeDir` or nested under it, or
+ *  - argv[0] === smArgv0('job', job.slug) (every scheduler job spawn carries
+ *    the slug in argv[0]).
+ * There is deliberately no runCwd-nested match: it adopted a stray `tail -F`
+ * on 2026-10-25 and is redundant now that argv[0] carries the slug.
  *
- * Returns the first matching pid, or null if none is found.
- *
- * Safe fallback by construction: on any platform without `/proc` (macOS,
- * Windows) `fs.readdirSync('/proc')` throws and this returns null immediately
- * — i.e. exactly today's behaviour (fail toward terminalizing), never a hang
- * or a thrown error propagating to the caller.
+ * Returns the first matching pid, or null. On platforms without `/proc` it
+ * returns null immediately.
  */
-function findLiveProcessForJob(job, { worktreeDir, runCwd, platform = process.platform } = {}) {
+function findLiveProcessForJob(job, { worktreeDir, platform = process.platform } = {}) {
   if (platform === 'win32') return null; // no /proc — skip every read
   const slug = job?.slug;
+  const want = slug ? smArgv0('job', slug) : null;
   let entries;
   try {
     entries = fs.readdirSync('/proc');
@@ -89,34 +95,15 @@ function findLiveProcessForJob(job, { worktreeDir, runCwd, platform = process.pl
     const pid = Number(name);
     if (!pid || pid <= 1) continue;
 
-    let cwdLink = null;
-    if (worktreeDir || runCwd) {
-      try {
-        cwdLink = fs.readlinkSync(`/proc/${pid}/cwd`);
-      } catch {
-        // Process exited mid-scan, or permission denied — try the argv
-        // fallback below before giving up on this pid.
-      }
-    }
-
-    if (worktreeDir && cwdLink && (cwdLink === worktreeDir || cwdLink.startsWith(worktreeDir + path.sep))) {
-      return pid;
-    }
-
-    let cmd = null;
-    if (slug || (runCwd && cwdLink)) {
-      try {
-        cmd = fs.readFileSync(`/proc/${pid}/cmdline`, 'utf8').replace(/\0/g, ' ');
-      } catch {
-        // Same as above — process gone or unreadable, keep scanning.
-      }
-    }
+    const argv = readArgv(pid);
+    if (!argv || !isClaudeArgv(argv)) continue;
 
-    if (slug && cmd && /\bclaude\b/.test(cmd) && cmd.includes(slug)) return pid;
+    if (want && argv[0] === want) return pid;
 
-    if (runCwd && cwdLink && cmd && /\bclaude\b/.test(cmd) &&
-        (cwdLink === runCwd || cwdLink.startsWith(runCwd + path.sep))) {
-      return pid;
+    if (worktreeDir) {
+      let cwdLink = null;
+      try { cwdLink = fs.readlinkSync(`/proc/${pid}/cwd`); } catch { /* exited / denied */ }
+      if (cwdLink && (cwdLink === worktreeDir || cwdLink.startsWith(worktreeDir + path.sep))) return pid;
     }
   }
   return null;
@@ -413,6 +400,11 @@ function selectReapableJobs(jobs, now, {
   const reapable = [];
   const warnings = [];
   const recovered = [];
+  /** pid -> slug that records/was recovered with it */
+  const claimedPids = new Map();
+  for (const r of jobs ?? []) {
+    if (r.status === 'running' && r.runtime?.pid) claimedPids.set(r.runtime.pid, r.slug);
+  }
   for (const j of jobs ?? []) {
     if (j.status !== 'running') continue;
     const pid = j.runtime?.pid;
@@ -448,10 +440,22 @@ function selectReapableJobs(jobs, now, {
       continue;
     }
 
-    const livePid = typeof findLiveProcess === 'function' ? findLiveProcess(j) : null;
+    // A row with no run log never reached the spawn — a /proc scan can only
+    // misattribute a stray process to it.
+    const livePid = (typeof findLiveProcess === 'function' && Number.isFinite(logMtimeMs))
+      ? findLiveProcess(j) : null;
     if (livePid) {
-      recovered.push({ slug: j.slug, pid: livePid });
-      continue;
+      const holder = claimedPids.get(livePid);
+      if (holder && holder !== j.slug) {
+        warnings.push({
+          slug: j.slug,
+          reason: `pid ${livePid} not recovered for ${j.slug} — already claimed by ${holder}`,
+        });
+      } else {
+        claimedPids.set(livePid, j.slug);
+        recovered.push({ slug: j.slug, pid: livePid });
+        continue;
+      }
     }
     reapable.push({
       slug: j.slug,
@@ -520,6 +524,7 @@ function resolveCommitGuardOutcome(guardVerdict, satisfyingCommits) {
 
 module.exports = {
   claudePidAlive,
+  isClaudeArgv,
   classifyRunOutcome,
   mapOutcomeToGateOutcome,
   ORPHAN_REQUEUE_CAP,

package/src/main/lib/scheduler/reviewNotice.cjs

@@ -153,8 +153,6 @@ function selectDueReviewNotices(jobs = [], { now = Date.now(), holdMs = DEFAULT_
   const isDue = (j) => {
     if (j.status === 'skipped' && j.needsReviewAutoResolvedSkip) return true;
     if (j.status !== 'needs_review') return false;
-    // A question for the human has nothing for the ladder to heal — no hold.
-    if (j.verifierVerdict === 'needs_human') return true;
     const firstParkedAt = j.reviewNotice.firstParkedAt;
     if (!firstParkedAt) return false;
     const parkedMs = Date.parse(firstParkedAt);

package/src/main/lib/scheduler/scheduleJobTransitions.cjs

@@ -116,7 +116,7 @@ const LEGAL_TRANSITIONS = {
   pending: ['running', 'completed', 'failed', 'skipped'],
   running: ['completed', 'failed', 'needs_review', 'skipped', 'pending'],
   investigating: ['failed', 'needs_review', 'completed', 'pending', 'skipped'],
-  failed: ['investigating', 'pending', 'completed', 'needs_review'],
+  failed: ['investigating', 'pending', 'completed', 'needs_review', 'skipped'],
   needs_review: ['investigating', 'pending', 'completed', 'skipped', 'running'],
   completed: ['pending'],
   skipped: ['pending'],

package/src/main/lib/scheduler/schedulerBatch.cjs

@@ -360,7 +360,7 @@ function pickForProject(projectJobs, runningSlugsInProject, slots, heldSlugs = n
     for (const [rootSlug, { rootStatus, slugs }] of heldByRoot) {
       const names = [...slugs].sort().join(', ');
       if (rootStatus === 'needs_review') {
-        reasons.push(`holding ${slugs.size} job(s) transitively behind root blocker ${rootSlug} (needs_review) [${names}]. ${rootSlug} is a QUESTION awaiting a human — the chain resumes once it is retired or reset; it will not clear on its own.`);
+        reasons.push(`holding ${slugs.size} job(s) transitively behind root blocker ${rootSlug} (needs_review) [${names}]. the chain resumes when the recovery ladder resolves ${rootSlug} (or it is retired or reset).`);
       } else if (rootStatus === 'failed') {
         reasons.push(`holding ${slugs.size} job(s) transitively behind root blocker ${rootSlug} (failed) [${names}]. Reset or archive ${rootSlug} to unblock the chain.`);
       } else if (rootStatus === 'skipped') {

package/src/main/lib/sendToRenderer.cjs

@@ -20,9 +20,21 @@
  * webContents state and wrap the send in try/catch.
  */
 function sendIfAlive(window, channel, payload) {
+  sendToWindow(window, channel, payload);
+  // Remote fanout runs even when the window is gone (web clients outlive it) and never throws.
+  if (_remoteFanout) {
+    try {
+      _remoteFanout(channel, payload);
+    } catch {
+      // A broken remote subscriber must never break the Electron send path.
+    }
+  }
+}
+
+function sendToWindow(window, channel, payload) {
   if (!window || window.isDestroyed()) return;
   const wc = window.webContents;
-  if (!wc || wc.isDestroyed() || wc.isCrashed()) return;
+  if (!wc || wc.isDestroyed() || wc.isCrashed?.()) return;
   try {
     wc.send(channel, payload);
   } catch {
@@ -31,4 +43,12 @@ function sendIfAlive(window, channel, payload) {
   }
 }
 
-module.exports = { sendIfAlive };
+/** @type {((channel: string, payload: unknown) => void) | null} */
+let _remoteFanout = null;
+
+/** Register (or clear with null) the fanout that mirrors every push to E2E web clients. */
+function setRemoteFanout(fn) {
+  _remoteFanout = typeof fn === 'function' ? fn : null;
+}
+
+module.exports = { sendIfAlive, setRemoteFanout };

package/src/main/lib/smfileHeaders.cjs

@@ -63,4 +63,20 @@ function shouldBlockFrameNavigation({ isMainFrame, currentUrl, targetUrl }) {
   return true;
 }
 
-module.exports = { DEMO_VIDEO_CSP_HEADER, smfileResponseHeaders, shouldBlockFrameNavigation };
+/**
+ * Convert an smfile:// URL pathname (still percent-encoded) into a filesystem
+ * path. On win32 the pathname is `/C:/Users/...`; the leading '/' before the
+ * drive letter is stripped and the result is path.win32-normalized. Posix input
+ * is only decoded.
+ * @param {string} pathname
+ * @param {string} [platform]
+ * @returns {string}
+ */
+function smfileUrlToPath(pathname, platform = process.platform) {
+  const decoded = decodeURIComponent(pathname);
+  if (platform !== 'win32') return decoded;
+  const stripped = /^[\\/][A-Za-z]:/.test(decoded) ? decoded.slice(1) : decoded;
+  return require('node:path').win32.normalize(stripped);
+}
+
+module.exports = { DEMO_VIDEO_CSP_HEADER, smfileResponseHeaders, shouldBlockFrameNavigation, smfileUrlToPath };

package/src/main/pluginInstall.cjs

@@ -7,7 +7,7 @@
  *
  * Channels:
  *   ipcMain.handle('plugins:install', { slug }) -> { ok, exitCode }
- *   webContents.send('plugins:install-progress', { slug, line })
+ *   sendIfAlive('plugins:install-progress', { slug, line })
  *
  * Safety:
  *   - slug must match /^[a-z0-9\-/]+$/ (lowercase, hyphen, slash for owner/name).

package/src/main/promptSessionEvents.cjs

@@ -1,4 +1,5 @@
 'use strict';
+const { sendIfAlive } = require('./lib/sendToRenderer.cjs');
 
 /**
  * Main-process counterpart to promptSessions.ts's event chain, used ONLY by
@@ -30,11 +31,7 @@ let mainWindow = null;
 function attachWindow(win) { mainWindow = win; }
 
 function broadcast(channel, payload) {
-  try {
-    if (mainWindow && !mainWindow.isDestroyed() && mainWindow.webContents && !mainWindow.webContents.isDestroyed()) {
-      mainWindow.webContents.send(channel, payload);
-    }
-  } catch { /* render frame may be gone */ }
+  sendIfAlive(mainWindow, channel, payload);
 }
 
 let seq = 0;

package/src/main/pty.cjs

@@ -16,10 +16,10 @@ const { ipcMain } = require('electron');
 const path = require('node:path');
 const os = require('node:os');
 const fs = require('node:fs');
-const { addAllowedRoot } = require('./config.cjs');
+const { addAllowedRoot, getAllowedRoots } = require('./config.cjs');
 const { aliasedShellBin } = require('./lib/process/smProcNames.cjs');
 const { cleanChildEnv, pathWithUserBins } = require('./lib/process/cleanEnv.cjs');
-const { checkInsideHome } = require('./lib/insideHome.cjs');
+const { checkInsideHomeOrRoots } = require('./lib/insideHome.cjs');
 const { defaultShell } = require('./lib/process/defaultShell.cjs');
 const { sendIfAlive } = require('./lib/sendToRenderer.cjs');
 const opsErrorLog = require('./lib/telemetry/opsErrorLog.cjs');
@@ -151,9 +151,10 @@ class PtyManager {
       return { pid: null, cwd, reattached: false, error: 'node-pty unavailable' };
     }
 
-    // Validate that cwd is inside homedir before widening the allowed-root set.
+    // Validate that cwd is inside homedir or an already-registered project root
+    // (never a renderer-supplied one) before widening the allowed-root set.
     if (cwd) {
-      const r = checkInsideHome(cwd);
+      const r = checkInsideHomeOrRoots(cwd, getAllowedRoots());
       if (!r.ok) throw new Error(`pty ${r.error}`);
       addAllowedRoot(r.realPath);
     }

package/src/main/runVerify.cjs

@@ -269,21 +269,22 @@ function checkDeps(queueEntry, allJobs) {
 // ─── sentinel scanner ─────────────────────────────────────────────────────────
 
 /**
- * Scan for a `SCHEDULER_VERDICT: PASS|FAIL|BLOCKED_BY_FOREIGN_WIP|NEEDS_HUMAN` sentinel
+ * Scan for a `SCHEDULER_VERDICT: PASS|FAIL|BLOCKED_BY_FOREIGN_WIP` sentinel (a legacy NEEDS_HUMAN line is classed as FAIL)
  * line in the run output.
  *
  * Checks `resultEvent.resultText` first (the agent's final message), then the
  * last tool_result content. Anchored to line-start so prose mentioning the
  * string in mid-sentence does not match.
  *
- * Returns 'pass', 'fail', 'blocked_by_foreign_wip', 'needs_human', or null.
+ * Returns 'pass', 'fail', 'blocked_by_foreign_wip', or null.
  */
 function scanSentinel(resultEvent, events) {
   const RE = /^SCHEDULER_VERDICT:\s*(PASS|FAIL|BLOCKED_BY_FOREIGN_WIP|NEEDS_HUMAN)\b/m;
+  const norm = (v) => { const l = v.toLowerCase(); return l === 'needs_human' ? 'fail' : l; };
 
   if (resultEvent) {
     const m = resultEvent.resultText.match(RE);
-    if (m) return m[1].toLowerCase();
+    if (m) return norm(m[1]);
   }
 
   let lastToolResult = null;
@@ -292,7 +293,7 @@ function scanSentinel(resultEvent, events) {
   }
   if (lastToolResult && lastToolResult.content) {
     const m = lastToolResult.content.match(RE);
-    if (m) return m[1].toLowerCase();
+    if (m) return norm(m[1]);
   }
 
   return null;
@@ -327,29 +328,7 @@ function scanHaltLine(text) {
  * as scanSentinel). Trimmed, capped at 300 chars; '' when absent.
  */
 function scanSentinelReason(resultEvent, events) {
-  const RE = /^SCHEDULER_VERDICT:\s*FAIL\b[ \t]*([^\n]*)/m;
-  const clip = (m) => m[1].trim().slice(0, 300);
-  if (resultEvent && resultEvent.resultText) {
-    const m = resultEvent.resultText.match(RE);
-    if (m) return clip(m);
-  }
-  let lastToolResult = null;
-  for (const ev of events) {
-    if (ev.kind === 'tool_result') lastToolResult = ev;
-  }
-  if (lastToolResult && lastToolResult.content) {
-    const m = lastToolResult.content.match(RE);
-    if (m) return clip(m);
-  }
-  return '';
-}
-
-/**
- * One-line question after `SCHEDULER_VERDICT: NEEDS_HUMAN` (same two-source
- * scan order as scanSentinel). Trimmed, capped at 300 chars; '' when absent.
- */
-function scanHumanQuestion(resultEvent, events) {
-  const RE = /^SCHEDULER_VERDICT:\s*NEEDS_HUMAN\b[ \t]*([^\n]*)/m;
+  const RE = /^SCHEDULER_VERDICT:\s*(?:FAIL|NEEDS_HUMAN)\b[ \t]*([^\n]*)/m;
   const clip = (m) => m[1].trim().slice(0, 300);
   if (resultEvent && resultEvent.resultText) {
     const m = resultEvent.resultText.match(RE);
@@ -816,19 +795,6 @@ async function verifyRun({
       );
     }
 
-    // The executor needs a decision/action only the human can take. Parks as
-    // needs_review with the question; every automatic retry rung skips it.
-    if (sentinel === 'needs_human') {
-      const humanQuestion = scanHumanQuestion(resultEvent, events);
-      const kept = [...annotations, ...issues.map((i) => ({ verdict: i.verdict, reason: i.reason }))];
-      return conclude(
-        'needs_human',
-        'executor reported SCHEDULER_VERDICT: NEEDS_HUMAN' + (humanQuestion ? ': ' + humanQuestion : ''),
-        'needs_review',
-        { sentinel, humanQuestion, ...(kept.length ? { annotations: kept } : {}) },
-      );
-    }
-
     const sentinelFields = sentinel ? { sentinel } : {};
     const extras = (annotations.length || sentinel)
       ? { ...(annotations.length ? { annotations } : {}), ...sentinelFields }
@@ -1050,7 +1016,6 @@ module.exports = {
   scanSentinel,
   scanHaltLine,
   scanSentinelReason,
-  scanHumanQuestion,
   scanForeignWipPathsClaim,
   isMergeMainSlug,
   extractMergeMainPrNumber,

package/src/main/scheduler/budget.cjs

@@ -225,12 +225,12 @@ function classifyBudgetKill(res, landedCommitEvidence) {
 /**
  * isJobBudgetExempt(job) → boolean
  *
- * Pure. `quietMachine: true` PRDs (their whole point is running alone,
- * un-contended, for a timing-sensitive measurement) and any PRD with an
- * explicit `budgetExempt: true` opt-out have no wall-clock kill ceiling.
+ * Pure. Only an explicit `budgetExempt: true` opt-out has no wall-clock kill
+ * ceiling. `quietMachine` jobs are NOT exempt: they hold an exclusive
+ * machine-wide lease, so they must always be killed by the normal budget.
  */
 function isJobBudgetExempt(job) {
-  return job?.quietMachine === true || job?.budgetExempt === true;
+  return job?.budgetExempt === true;
 }
 
 /** Pure predicate the budget watchdog's shouldFire calls — single source of

package/src/main/scheduler/prdParser.cjs

@@ -137,9 +137,8 @@ async function parsePrdRaw(filePath) {
     quietMachine: fm.quietMachine === 'true',
     // Explicit opt-out of the wall-clock budget kill (scheduler.cjs's budget
     // watchdog) — only a literal `true` opts out, matching quietMachine's
-    // parse semantics above. quietMachine jobs are exempt regardless of this
-    // field; this is for a job that isn't quiet-machine-eligible but still
-    // needs no wall-clock kill ceiling.
+    // parse semantics above. quietMachine jobs are NOT exempt; this is the
+    // only way to get no wall-clock kill ceiling.
     budgetExempt: fm.budgetExempt === 'true',
     body: body.trim(),
   };

package/src/main/scheduler/reviewLadder.cjs

@@ -34,7 +34,6 @@ const { DEFAULT_PROJECT_CWD } = require('../lib/scheduler/schedulerBatch.cjs');
  * Kill-switch: SM_RESUME_RECOVERY_DISABLE=1 restores today's behaviour
  * exactly (always returns null), mirroring SM_RCA_DISABLE/SM_DOD_DISABLE.
  */
-/** A row parked on a question only the human can answer — no automatic rung may touch it. */
 // PRD refire-cap: a row parked by the post-run re-fire cap stays parked for the
 // Epic's grouped notice. Every automated rung (reset, re-verify, auto-fix,
 // auto-skip) consults this ONE predicate.
@@ -42,14 +41,10 @@ function isRefireCapped(job) {
   return !!job && job.verifierVerdict === 'refire_capped';
 }
 
-function isNeedsHuman(job) {
-  return !!job && job.verifierVerdict === 'needs_human';
-}
 
 function selectResumeRecoveryTarget(job) {
   if (process.env.SM_RESUME_RECOVERY_DISABLE === '1') return null;
   if (!job || job.status !== 'needs_review') return null;
-  if (isNeedsHuman(job)) return null;
   if (job.verifierVerdict !== 'uncommitted_changes') return null;
   if (typeof job.sessionId !== 'string' || job.sessionId.length === 0) return null;
   if (job.resumeRecoveryAttempted === true) return null;
@@ -113,7 +108,6 @@ function isMechanicalRecoveryFutile(job, currentHeadSha) {
 function selectMechanicalRecoveryTarget(job, currentHeadSha = null) {
   if (process.env.SM_MECHANICAL_RECOVERY_DISABLE === '1') return null;
   if (!job || job.status !== 'needs_review') return null;
-  if (isNeedsHuman(job)) return null;
   if (!MECHANICALLY_RESOLVABLE_VERDICTS.has(job.verifierVerdict)) return null;
   if (job.mechanicalRecoveryAttempted === true) return null;
   if (isMechanicalRecoveryFutile(job, currentHeadSha)) return null;
@@ -827,7 +821,6 @@ function selectExhaustedNeedsReviewTargets(jobs, now, thresholdMs) {
   for (const j of jobs ?? []) {
     if (isCancelledJob(j)) continue;
     if (j.status !== 'needs_review') continue;
-    if (isNeedsHuman(j)) continue;
     if (!isEligibleForNeedsReviewAutoResolve(j, jobs)) continue;
     if ((j.exhaustedResolveAttempts ?? 0) > NEEDS_REVIEW_RESOLVE_CAP) continue;
     const history = j.statusHistory || [];
@@ -872,7 +865,6 @@ function selectAutoFixTargets(jobs, { fixSlugExists, resolveJobRunId = resolveRu
     if (isCancelledJob(job)) return false;
     if (isRefireCapped(job)) return false;
     if (job.status !== 'needs_review') return false;
-    if (isNeedsHuman(job)) return false;
     // A job parked here because it was blocked by a sibling's foreign WIP
     // three times in a row (never its own regression) has nothing for a
     // fix-plan investigation to diagnose — there is no code defect to
@@ -1013,7 +1005,6 @@ function selectGateShadowTarget(jobs, headByCwd, { authorityDisabled = false, ba
 }
 
 module.exports = {
-  isNeedsHuman,
   isRefireCapped,
   isCancelledJob,
   selectResumeRecoveryTarget,