claude-code-session-manager 0.124.1 → 0.125.0

package/src/main/lib/scheduler/launchFailure.cjs

@@ -57,6 +57,38 @@ const LAUNCH_FAILURE_KINDS = Object.freeze({
   API_ERROR: 'api_error',
 });
 
+/**
+ * Argv-size guard (incident 2026-10-26, social-signals-trader): an oversized
+ * `-p` argument made `spawn` fail with E2BIG (exit -1 in ~86 ms), which
+ * became `impl_failed:exit_-1` and spawned a fix-plan that failed the same
+ * way. Linux caps ONE argv string at MAX_ARG_STRLEN = 131072 bytes, counting
+ * the NUL terminator. The cause is one job's input, not the persona's
+ * environment, so this never arms the per-persona launch breaker.
+ */
+const MAX_ARG_BYTES = 131072;
+
+/** First argv element whose utf8 bytes + NUL exceed `limit`, else null. */
+function findOversizedArg(args, limit = MAX_ARG_BYTES) {
+  if (!Array.isArray(args)) return null;
+  for (let index = 0; index < args.length; index++) {
+    const a = args[index];
+    if (typeof a !== 'string') continue;
+    const bytes = Buffer.byteLength(a, 'utf8') + 1;
+    if (bytes <= limit) continue;
+    let flag = '(positional)';
+    for (let j = index - 1; j >= 0; j--) {
+      if (typeof args[j] === 'string' && args[j].startsWith('--')) { flag = args[j]; break; }
+    }
+    return { index, flag, bytes };
+  }
+  return null;
+}
+
+/** True when a spawn error message is the OS refusing an oversized argv. */
+function isArgvTooLargeSpawnError(message) {
+  return /E2BIG|ENAMETOOLONG/.test(String(message ?? ''));
+}
+
 /** Tail bytes scanned for the `result` event — same budget classifyRunOutcome uses. */
 const RESULT_TAIL_BYTES = 65536;
 
@@ -310,9 +342,10 @@ function evaluateLaunchGate(block, { now, claudeVersion } = {}) {
  * closed set so operators never have to open a transcript to tell a
  * non-start from an implementation failure from a verifier downgrade.
  */
-function deriveTerminalReason({ effectiveStatus, exitCode, verifyResult, sigtermOverride, worktreeIntegrationFailure, budgetKill }) {
+function deriveTerminalReason({ effectiveStatus, exitCode, verifyResult, sigtermOverride, worktreeIntegrationFailure, budgetKill, launchError }) {
   if (worktreeIntegrationFailure) return 'worktree_integration_failed';
   if (effectiveStatus === 'completed') return 'completed';
+  if (launchError === 'argv_too_large') return 'launch_failure:argv_too_large';
   if (budgetKill) return 'budget_exceeded';
   if (sigtermOverride) return 'signal_kill_with_commit';
   if (exitCode === 143 || exitCode === 137) return 'signal_kill';
@@ -338,6 +371,9 @@ function writeOutcomeSidecar(runDir, slug, outcome) {
 }
 
 module.exports = {
+  MAX_ARG_BYTES,
+  findOversizedArg,
+  isArgvTooLargeSpawnError,
   LAUNCH_FAILURE_KINDS,
   LAUNCH_BLOCK_MAX_ATTEMPTS,
   LAUNCH_PROBE_STALE_MS,

package/src/main/scheduler.cjs

@@ -3474,7 +3474,9 @@ const TRANSIENT_RETRY_CAP = 2;
  * transient (PRD 543/545 incident) — same bounded-retry treatment, not a
  * second parallel classifier.
  */
-function classifyFailureOutcome({ exitCode, networkError, durationMs, transientRetries, newlyDirtyCount }) {
+function classifyFailureOutcome({ exitCode, networkError, durationMs, transientRetries, newlyDirtyCount, launchError }) {
+  // The run never started (argv too large): not transient, not investigable.
+  if (launchError) return { action: 'fail-launch', launchError };
   const signalTransient = (exitCode === 143 || exitCode === 137) && durationMs < IDLE_OUTPUT_KILL_MS;
   const networkTransient = networkError === true;
   const transient = signalTransient || networkTransient;
@@ -3677,37 +3679,87 @@ function capDirtyPaths(paths, cap = PRE_RUN_DIRTY_PATHS_CAP) {
 const FOREIGN_WIP_DELIMITER = '--- FOREIGN WORKING-TREE STATE (not your work) ---';
 const FOREIGN_WIP_END_DELIMITER = '--- END FOREIGN WORKING-TREE STATE ---';
 
+const FOREIGN_WIP_SECTION_MAX_BYTES = 16 * 1024;
+const FOREIGN_WIP_SUMMARY_RESERVE_BYTES = 1024;
+const FOREIGN_WIP_OMITTED_SENTENCE = 'The omitted paths are just as foreign: do not stage, commit, revert, or stash them either.';
+
+/**
+ * Pure: bound a foreign-WIP path list by count (PRE_RUN_DIRTY_PATHS_CAP) and
+ * bytes. A trailing capDirtyPaths `+N more` marker is never listed; its N is
+ * added to omittedCount. Omitted real paths are grouped by parent directory.
+ * `fixedBytes` = byte length of the section's fixed sentences/delimiters.
+ */
+function limitForeignWipPaths(paths, fixedBytes = 0) {
+  const all = Array.isArray(paths) ? paths.filter(Boolean) : [];
+  let omittedCount = 0;
+  if (all.length && /^\+\d+ more$/.test(all[all.length - 1])) {
+    omittedCount += Number(all.pop().slice(1).split(' ')[0]);
+  }
+  const budget = FOREIGN_WIP_SECTION_MAX_BYTES - fixedBytes - FOREIGN_WIP_SUMMARY_RESERVE_BYTES;
+  const listed = [];
+  let used = 0;
+  let i = 0;
+  for (; i < all.length && listed.length < PRE_RUN_DIRTY_PATHS_CAP; i++) {
+    const lineBytes = Buffer.byteLength(`  ${all[i]}\n`, 'utf8');
+    if (used + lineBytes > budget) break;
+    used += lineBytes;
+    listed.push(all[i]);
+  }
+  const byDir = new Map();
+  for (; i < all.length; i++) {
+    const slash = all[i].lastIndexOf('/');
+    const dir = slash >= 0 ? all[i].slice(0, slash + 1) : '(repo root)';
+    byDir.set(dir, (byDir.get(dir) || 0) + 1);
+    omittedCount += 1;
+  }
+  const omittedByDir = [...byDir.entries()].sort((x, y) => y[1] - x[1]);
+  return { listed, omittedCount, omittedByDir };
+}
+
+function foreignWipSummaryLine(omittedCount, omittedByDir) {
+  const fmt = (n) => n.toLocaleString('en-US');
+  const clip = (d) => (d.length > 120 ? `${d.slice(0, 117)}...` : d);
+  const top = omittedByDir.slice(0, 5);
+  const parts = top.map(([d, n]) => `${fmt(n)} under ${clip(d)}`);
+  const rest = omittedByDir.slice(5).reduce((sum, [, n]) => sum + n, 0);
+  if (rest > 0) parts.push(`${fmt(rest)} elsewhere`);
+  const tail = parts.length ? `: ${parts.join(', ')}` : '';
+  return `  ... and ${fmt(omittedCount)} more path(s) not listed${tail}`;
+}
+
 /**
  * Pure: build the executor-prompt section warning about pre-existing dirty
  * paths this job does not own — either base WIP carried into an isolated
  * worktree (PRD 1094's carriedPaths, checked first since it's the more
  * specific/authoritative case) or the raw pre-run dirty snapshot of a shared
  * (non-isolated) tree. Returns '' when both lists are empty so a clean spawn
- * produces a byte-identical prompt to before this section existed.
+ * produces a byte-identical prompt to before this section existed. Both
+ * branches are bounded by count and bytes (FOREIGN_WIP_SECTION_MAX_BYTES).
  */
 function buildForeignWipSection({ preRunDirtyPaths, carriedPaths } = {}) {
   const carried = Array.isArray(carriedPaths) ? carriedPaths.filter(Boolean) : [];
-  if (carried.length) {
-    return [
-      FOREIGN_WIP_DELIMITER,
-      'This job is running in an isolated git worktree, but the following paths carry uncommitted base-tree work-in-progress that was carried into this checkout so the tree is self-consistent. The authoritative copy of these files lives in the MAIN tree, not this worktree.',
-      'These files were already modified before this job started. They are NOT this job\'s work:',
-      ...carried.map((p) => `  ${p}`),
-      'Do not stage, commit, revert, or stash these paths. A test failure confined to these paths is not this job\'s regression.',
-      FOREIGN_WIP_END_DELIMITER,
-    ].join('\n');
-  }
   const dirty = Array.isArray(preRunDirtyPaths) ? preRunDirtyPaths.filter(Boolean) : [];
-  if (dirty.length) {
-    return [
-      FOREIGN_WIP_DELIMITER,
-      'This job is running in a SHARED working tree (not isolated in its own worktree). The following paths were already modified when this job started:',
-      ...dirty.map((p) => `  ${p}`),
-      'These files are NOT this job\'s work. Do not stage, commit, revert, or stash them. A test failure confined to these paths is not this job\'s regression.',
-      FOREIGN_WIP_END_DELIMITER,
-    ].join('\n');
-  }
-  return '';
+  if (!carried.length && !dirty.length) return '';
+  const isCarried = carried.length > 0;
+  const head = isCarried
+    ? [
+        FOREIGN_WIP_DELIMITER,
+        'This job is running in an isolated git worktree, but the following paths carry uncommitted base-tree work-in-progress that was carried into this checkout so the tree is self-consistent. The authoritative copy of these files lives in the MAIN tree, not this worktree.',
+        'These files were already modified before this job started. They are NOT this job\'s work:',
+      ]
+    : [
+        FOREIGN_WIP_DELIMITER,
+        'This job is running in a SHARED working tree (not isolated in its own worktree). The following paths were already modified when this job started:',
+      ];
+  const tailLines = isCarried
+    ? ['Do not stage, commit, revert, or stash these paths. A test failure confined to these paths is not this job\'s regression.', FOREIGN_WIP_END_DELIMITER]
+    : ['These files are NOT this job\'s work. Do not stage, commit, revert, or stash them. A test failure confined to these paths is not this job\'s regression.', FOREIGN_WIP_END_DELIMITER];
+  const fixedBytes = Buffer.byteLength([...head, ...tailLines, FOREIGN_WIP_OMITTED_SENTENCE].join('\n'), 'utf8') + 8;
+  const { listed, omittedCount, omittedByDir } = limitForeignWipPaths(isCarried ? carried : dirty, fixedBytes);
+  const omitted = omittedCount > 0
+    ? [foreignWipSummaryLine(omittedCount, omittedByDir), FOREIGN_WIP_OMITTED_SENTENCE]
+    : [];
+  return [...head, ...listed.map((p) => `  ${p}`), ...omitted, ...tailLines].join('\n');
 }
 
 // A job whose validated BLOCKED_BY_FOREIGN_WIP claim keeps recurring against
@@ -4157,11 +4209,15 @@ const HEADLESS_DISALLOWED_TOOLS = Object.freeze([
  * inserted BEFORE that flag, never between `--disallowedTools` and its value.
  * `--disallowedTools` takes a variadic list, so another flag must always
  * follow it to end that list — `--output-format` does, right after. Never
- * put `--disallowedTools` last or right before the prompt.
+ * put `--disallowedTools` last.
+ * The prompt is NOT in argv: callers send it on the child's stdin
+ * (withChildAndLog's `stdinText`). Linux caps a single argv element at 128 KB,
+ * and a large prompt failed with spawn E2BIG before the job started (the
+ * 2026-10-26 incident). `claude -p` with no positional prompt reads stdin.
  */
-function buildClaudeSpawnArgs({ prompt, model, effort, sessionId, resume, systemPrompt, toolScope }) {
+function buildClaudeSpawnArgs({ model, effort, sessionId, resume, systemPrompt, toolScope }) {
   return [
-    '-p', prompt,
+    '-p',
     '--model', model,
     ...effortArgs(effort),
     ...(systemPrompt ? ['--append-system-prompt', systemPrompt] : []),
@@ -4685,7 +4741,6 @@ async function executeJob(job, runDir, defaultCwd, onPid, execCwd, resumeTarget
     // Distinct comm (`sm-claude-job`) + slug-labelled argv0 for System Monitor.
     // Both keep the word `claude`, which the /\bclaude\b/ reaper gates need.
     const jobArgs = buildClaudeSpawnArgs({
-      prompt,
       model: personaResolution.model,
       effort: personaEffort,
       sessionId,
@@ -4695,6 +4750,17 @@ async function executeJob(job, runDir, defaultCwd, onPid, execCwd, resumeTarget
     });
     const jobSpawn = claudeSpawnTarget('job', job.slug, claudeBin, jobArgs);
 
+    // Pre-spawn argv guard: one oversized argument makes spawn throw E2BIG.
+    const oversized = launchFailure.findOversizedArg(jobSpawn.args || jobArgs);
+    if (oversized) {
+      const errMsg = `argv too large: ${oversized.flag} is ${oversized.bytes} bytes, over the ${launchFailure.MAX_ARG_BYTES}-byte per-argument limit; not spawned`;
+      safeLog(`[scheduler] ${errMsg}\n`);
+      closeFd();
+      config.writeJsonSync(metaPath, { slug: job.slug, cwd, sessionId, exitCode: -1, error: errMsg, startedAt, finishedAt: Date.now(), durationMs: 0, ...SCHEDULER_META_IDENTITY, ...setupMeta });
+      resolve({ exitCode: -1, durationMs: 0, error: errMsg, launchError: 'argv_too_large', sessionId });
+      return;
+    }
+
     const { child } = withChildAndLog({
       fd,
       logPath,
@@ -4702,6 +4768,7 @@ async function executeJob(job, runDir, defaultCwd, onPid, execCwd, resumeTarget
       closeFd,
       spawn: {
         command: jobSpawn.command,
+        stdinText: prompt,
         // Resume mode passes `--resume <sessionId>` (reconnect to the SAME
         // session) INSTEAD of `--session-id <sessionId>` (mint a new one) —
         // never both, see buildClaudeSpawnArgs.
@@ -4737,7 +4804,8 @@ async function executeJob(job, runDir, defaultCwd, onPid, execCwd, resumeTarget
           // Sync write: inside a Promise executor callback; must flush meta
           // before resolve() so the spawnJob mutate() that follows sees it.
           config.writeJsonSync(metaPath, { slug: job.slug, cwd, sessionId, exitCode: -1, error: errMsg, startedAt, finishedAt: Date.now(), durationMs, leakedDescendants: leaked, ...SCHEDULER_META_IDENTITY, ...setupMeta, originSessionId, contextDigestApplied });
-          resolve({ exitCode: -1, durationMs, error: errMsg, leakedDescendants: leaked, sessionId });
+          resolve({ exitCode: -1, durationMs, error: errMsg, leakedDescendants: leaked, sessionId,
+            ...(launchFailure.isArgvTooLargeSpawnError(error?.message) ? { launchError: 'argv_too_large' } : {}) });
           return;
         }
 
@@ -5277,8 +5345,9 @@ async function spawnInvestigation(failedJob, runDir, { deadChild = null } = {})
     closeFd,
     spawn: {
       command: probeSpawn.command,
+      stdinText: prompt,
       args: [
-        '-p', prompt,
+        '-p',
         '--model', 'opus',
         '--dangerously-skip-permissions',
         ...headlessPermissionArgs(),
@@ -6790,7 +6859,7 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null, sib
           // says WHY it ended without anyone opening the transcript.
           s.jobs[i2].terminalReason = launchFailure.deriveTerminalReason({
             effectiveStatus, exitCode: res.exitCode, verifyResult, sigtermOverride, worktreeIntegrationFailure,
-            budgetKill: !!budgetKill,
+            budgetKill: !!budgetKill, launchError: res.launchError,
           });
           delete s.jobs[i2].launchFailure;
           delete s.jobs[i2].heldReason;
@@ -7100,9 +7169,19 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null, sib
         durationMs: res.durationMs,
         transientRetries: retries,
         newlyDirtyCount,
+        launchError: res.launchError,
       });
 
-      if (decision.action === 'retry') {
+      if (decision.action === 'fail-launch') {
+        console.log(`[scheduler] launch failure (${decision.launchError}) for ${job.slug} — run never started; no investigation`);
+        await mutate((s) => {
+          const i = s.jobs.findIndex((x) => x.slug === job.slug);
+          if (i >= 0) {
+            s.jobs[i].error = `launch failure (${decision.launchError}): ${res.error}; the run never started, so no investigation was spawned`;
+          }
+        });
+        await broadcast({ flush: true });
+      } else if (decision.action === 'retry') {
         console.log(`[scheduler] transient failure (${decision.transientKind} dur=${res.durationMs}ms) — auto-retry ${decision.retries + 1}/${TRANSIENT_RETRY_CAP} for ${job.slug}`);
         await mutate((s) => {
           const i = s.jobs.findIndex((x) => x.slug === job.slug);
@@ -11243,6 +11322,8 @@ module.exports = {
   LEFTOVER_PATHS_CAP,
   capDirtyPaths,
   buildForeignWipSection,
+  limitForeignWipPaths,
+  FOREIGN_WIP_SECTION_MAX_BYTES,
   PRE_RUN_DIRTY_PATHS_CAP,
   FOREIGN_WIP_DELIMITER,
   FOREIGN_WIP_END_DELIMITER,

package/src/main/supervisor.cjs

@@ -19,6 +19,7 @@ const { ipcMain } = require('electron');
 const { resolveClaudeBin, claudeSpawnTarget } = require('./lib/claude/claudeBin.cjs');
 const { headlessPermissionArgs, ensureCliCapsProbed } = require('./lib/claude/claudeCliCaps.cjs');
 const { withProcRole } = require('./lib/process/cleanEnv.cjs');
+const { feedChildStdin } = require('./lib/process/childStdin.cjs');
 const schedulerPaths = require('./lib/scheduler/schedulerPaths.cjs');
 
 const HOME = os.homedir();
@@ -247,7 +248,7 @@ async function runProbe(claudeBin, prompt) {
     try {
       const target = claudeSpawnTarget('aux', 'supervisor', claudeBin);
       child = spawn(target.command, [
-        '-p', prompt,
+        '-p',
         '--model', 'claude-haiku-5-5',
         '--no-session-persistence',
         '--output-format', 'json',
@@ -256,7 +257,9 @@ async function runProbe(claudeBin, prompt) {
         ...headlessPermissionArgs(),
         '--strict-mcp-config',
         '--allowedTools', 'Bash',
-      ], { env: withProcRole(process.env, 'aux'), stdio: ['ignore', 'pipe', 'pipe'], ...(target.argv0 ? { argv0: target.argv0 } : {}) });
+      ], { env: withProcRole(process.env, 'aux'), stdio: ['pipe', 'pipe', 'pipe'], ...(target.argv0 ? { argv0: target.argv0 } : {}) });
+      // Prompt on stdin, not argv: a >128 KB argv element fails spawn with E2BIG.
+      feedChildStdin(child, prompt);
     } catch (e) {
       console.error('[supervisor] probe spawn failed:', e?.message);
       resolve({ verdict: 'ok', action: 'none', targetPid: null, reason: `spawn failed: ${e?.message}`, costUsd: null });
@@ -530,4 +533,5 @@ module.exports = {
   applyAction,
   registerHandlers,
   parseProbeOutput,
+  runProbe,
 };