claude-code-session-manager 0.17.0 → 0.17.2

package/src/main/crashDiagnostics.cjs

@@ -0,0 +1,217 @@
+// Crash & OOM diagnostics for the main process.
+//
+// WHY THIS EXISTS: the app has been dying "silently" — its own logs end
+// mid-stream with no error line. That signature is a *native* termination
+// (kernel OOM-kill / SIGKILL / renderer segfault), which `process.on
+// ('uncaughtException')` can NEVER catch because no JS exception is thrown;
+// the process just disappears. System journal confirmed repeated
+// `oom-kill` events against the Electron renderer (Chromium tags renderers
+// with oom_score_adj:300, making them the kernel's first victim under
+// memory pressure). Because the app holds a `powerSaveBlocker` suspend
+// inhibitor, its death releases the org.freedesktop.login1 inhibitor and
+// Pop!_OS idle-suspends — hence "app crashes -> machine falls asleep".
+//
+// This module adds the four things needed to catch the next occurrence:
+//   1. Chromium crash-reason hooks — render-process-gone / child-process-gone
+//      surface `reason: 'oom' | 'crashed' | 'killed'` and the dead process type.
+//   2. A memory heartbeat — per-process working-set sampled on an interval and
+//      persisted to a sentinel file, so the LAST sample before a SIGKILL
+//      survives the crash and is logged at next boot.
+//   3. An unclean-shutdown sentinel — if the previous run never marked a clean
+//      exit, we log a WARN at boot with that last memory sample (the OOM
+//      postmortem the app could not write while dying).
+//   4. powerMonitor + blocker-state logging — ties suspend/resume events and
+//      the inhibitor's health to the crash timeline.
+
+const { app, powerSaveBlocker, powerMonitor, crashReporter } = require('electron');
+const fs = require('node:fs');
+const path = require('node:path');
+
+let logs = null;
+let getPowerBlockerId = () => -1;
+let heartbeatTimer = null;
+let sentinelPath = null;
+let startedAtIso = null;
+let lastSample = null;
+
+// Warn threshold for total working set across all Electron processes. The OOM
+// journal showed a single renderer hitting ~900 MB anon-rss before the kernel
+// stepped in; warning at 1.5 GB total gives an early signal in the app's own
+// log BEFORE the kill, turning a silent death into a visible ramp. Override
+// with SM_MEM_WARN_MB.
+const MEM_WARN_MB = Number(process.env.SM_MEM_WARN_MB) || 1500;
+// Heartbeat cadence. 30s is fine-grained enough to catch the last sample
+// before an OOM yet cheap (getAppMetrics is O(numProcesses), ~5-10 procs).
+const HEARTBEAT_MS = Number(process.env.SM_MEM_HEARTBEAT_MS) || 30_000;
+
+function sentinelFile() {
+  return path.join(app.getPath('userData'), 'logs', 'last-run.json');
+}
+
+// crashReporter collects local minidumps for renderer/GPU SIGSEGV/SIGABRT
+// crashes (NOT OOM — a SIGKILL leaves no dump). Local-only, never uploaded.
+// Must run before the app is ready, so call this at module require time from
+// index.cjs's top level.
+function startCrashReporter() {
+  try {
+    crashReporter.start({
+      productName: 'claude-code-session-manager',
+      companyName: 'session-manager',
+      uploadToServer: false,
+      compress: true,
+    });
+  } catch { /* best-effort: diagnostics must never break boot */ }
+}
+
+// Snapshot per-process memory. app.getAppMetrics() returns one entry per
+// Electron process (Browser/GPU/Tab/Utility) with workingSetSize in KB.
+function sampleMemory() {
+  let metrics = [];
+  try { metrics = app.getAppMetrics(); } catch { /* not ready yet */ }
+  const procs = metrics.map((m) => ({
+    pid: m.pid,
+    type: m.type,
+    name: m.name || m.serviceName || undefined,
+    // workingSetSize is in KB; normalize to MB for readability.
+    mb: Math.round((m.memory?.workingSetSize || 0) / 1024),
+  }));
+  const totalMb = procs.reduce((s, p) => s + p.mb, 0);
+  const mu = process.memoryUsage();
+  return {
+    ts: new Date().toISOString(),
+    totalMb,
+    main: {
+      rssMb: Math.round(mu.rss / 1048576),
+      heapUsedMb: Math.round(mu.heapUsed / 1048576),
+      externalMb: Math.round(mu.external / 1048576),
+    },
+    powerBlockerHeld: (() => {
+      try { return powerSaveBlocker.isStarted(getPowerBlockerId()); } catch { return null; }
+    })(),
+    procs,
+  };
+}
+
+function persistSentinel(clean) {
+  if (!sentinelPath) return;
+  const payload = {
+    open: !clean,            // true while running; flipped false on clean quit
+    pid: process.pid,
+    startedAt: startedAtIso,
+    closedAt: clean ? new Date().toISOString() : undefined,
+    lastSample,
+  };
+  try {
+    fs.writeFileSync(sentinelPath, JSON.stringify(payload), { mode: 0o600 });
+  } catch { /* best-effort */ }
+}
+
+function heartbeat() {
+  lastSample = sampleMemory();
+  // Persist every tick so the final pre-crash sample survives a SIGKILL.
+  persistSentinel(false);
+  const top = [...lastSample.procs].sort((a, b) => b.mb - a.mb).slice(0, 4);
+  const level = lastSample.totalMb >= MEM_WARN_MB ? 'warn' : 'debug';
+  logs?.writeLine({
+    scope: 'crash-diag',
+    level,
+    message: level === 'warn' ? 'memory high' : 'memory heartbeat',
+    meta: {
+      totalMb: lastSample.totalMb,
+      mainRssMb: lastSample.main.rssMb,
+      powerBlockerHeld: lastSample.powerBlockerHeld,
+      top: top.map((p) => `${p.type}:${p.mb}MB`),
+    },
+  });
+}
+
+// Read the previous run's sentinel. If it was still `open`, the app died
+// without a clean quit — almost certainly the OOM-kill we're hunting. Log it
+// as the postmortem the dying process couldn't write, including its last
+// memory sample so we can see the footprint at time of death.
+function checkPreviousRun() {
+  let prev = null;
+  try { prev = JSON.parse(fs.readFileSync(sentinelPath, 'utf8')); } catch { return; }
+  if (!prev || prev.open !== true) return;
+  const s = prev.lastSample;
+  logs?.writeLine({
+    scope: 'crash-diag',
+    level: 'error',
+    message: 'previous session ended UNCLEANLY (likely OOM-kill / native crash — no graceful quit)',
+    meta: {
+      prevPid: prev.pid,
+      startedAt: prev.startedAt,
+      lastSampleTs: s?.ts,
+      lastTotalMb: s?.totalMb,
+      lastMainRssMb: s?.main?.rssMb,
+      lastTop: s ? [...s.procs].sort((a, b) => b.mb - a.mb).slice(0, 4).map((p) => `${p.type}:${p.mb}MB`) : undefined,
+      powerBlockerHeldAtDeath: s?.powerBlockerHeld,
+      hint: 'Check `journalctl -k | grep -i oom` around lastSampleTs to confirm the kernel OOM-killer.',
+    },
+  });
+}
+
+function registerCrashHooks() {
+  // Renderer death — reason is the prize: 'oom' | 'crashed' | 'killed' |
+  // 'launch-failed' | 'integrity-failure'. This fires even when the kernel
+  // OOM-kills only the renderer (main process survives to log it).
+  app.on('render-process-gone', (_e, _wc, details) => {
+    logs?.writeLine({
+      scope: 'crash-diag',
+      level: 'error',
+      message: 'render-process-gone',
+      meta: { reason: details?.reason, exitCode: details?.exitCode, lastTotalMb: lastSample?.totalMb },
+    });
+  });
+
+  // GPU / Utility / Pepper / network-service child death.
+  app.on('child-process-gone', (_e, details) => {
+    logs?.writeLine({
+      scope: 'crash-diag',
+      level: 'error',
+      message: 'child-process-gone',
+      meta: {
+        type: details?.type,
+        name: details?.name || details?.serviceName,
+        reason: details?.reason,
+        exitCode: details?.exitCode,
+        lastTotalMb: lastSample?.totalMb,
+      },
+    });
+  });
+
+  // powerMonitor ties the suspend story to the crash timeline. If we ever log
+  // a 'suspend' while the app is alive, the inhibitor failed; if the app dies
+  // first, the unclean-shutdown postmortem at next boot is the trail instead.
+  try {
+    powerMonitor.on('suspend', () => {
+      logs?.writeLine({ scope: 'crash-diag', level: 'warn', message: 'system suspend (powerMonitor) — inhibitor did NOT hold while app alive', meta: { powerBlockerHeld: lastSample?.powerBlockerHeld } });
+    });
+    powerMonitor.on('resume', () => {
+      logs?.writeLine({ scope: 'crash-diag', level: 'info', message: 'system resume (powerMonitor)' });
+    });
+  } catch { /* powerMonitor needs a ready app on some platforms */ }
+}
+
+function init(opts) {
+  logs = opts.logs;
+  if (typeof opts.getPowerBlockerId === 'function') getPowerBlockerId = opts.getPowerBlockerId;
+  sentinelPath = sentinelFile();
+  startedAtIso = new Date().toISOString();
+
+  checkPreviousRun();       // postmortem for the previous (possibly OOM'd) run
+  persistSentinel(false);   // mark this run as open
+  registerCrashHooks();
+
+  heartbeat();              // immediate baseline sample
+  heartbeatTimer = setInterval(heartbeat, HEARTBEAT_MS);
+  if (heartbeatTimer.unref) heartbeatTimer.unref(); // don't keep the loop alive
+}
+
+// Call from will-quit so a graceful exit is distinguishable from an OOM-kill.
+function markCleanShutdown() {
+  if (heartbeatTimer) { clearInterval(heartbeatTimer); heartbeatTimer = null; }
+  persistSentinel(true);
+}
+
+module.exports = { startCrashReporter, init, markCleanShutdown };

package/src/main/index.cjs

@@ -13,6 +13,11 @@ const usageMatrix = require('./usageMatrix.cjs');
 const sessionsStore = require('./sessionsStore.cjs');
 const billing = require('./usage.cjs');
 const logs = require('./logs.cjs');
+const crashDiagnostics = require('./crashDiagnostics.cjs');
+// Start the local minidump collector before app-ready (required by Electron).
+// Catches renderer/GPU SIGSEGV/SIGABRT; OOM-kills leave no dump but are caught
+// by the sentinel + render-process-gone hooks in crashDiagnostics.init().
+crashDiagnostics.startCrashReporter();
 const voiceHotkey = require('./voiceHotkey.cjs');
 const voiceWizard = require('./voiceWizard.cjs');
 const scheduler = require('./scheduler.cjs');
@@ -43,6 +48,52 @@ let rebooting = false;
 // powerSaveBlocker handle — keeps the system from suspending while the app runs
 // so the scheduler's polling and jobs aren't frozen. -1 = not held.
 let powerBlockerId = -1;
+// Linux-only backstop. Electron's `powerSaveBlocker('prevent-app-suspension')`
+// leans on org.gnome.SessionManager, which COSMIC (Pop!_OS 24.04+) doesn't
+// implement — under COSMIC it silently registers only a *delay*-mode logind
+// lock, which postpones suspend by seconds instead of blocking it, so the
+// machine idle-suspends with the app open. We spawn our own block-mode
+// `systemd-inhibit` child, which talks straight to logind and is
+// desktop-agnostic. Handle to the child so we can release it on quit.
+let systemdInhibitChild = null;
+
+function startSystemdInhibit() {
+  if (process.platform !== 'linux') return;
+  // Idempotent: if a live child already holds the lock, don't spawn a second.
+  if (systemdInhibitChild && systemdInhibitChild.exitCode === null && !systemdInhibitChild.killed) return;
+  try {
+    // `sleep:idle` blocks both explicit suspend and the idle-action timer.
+    // The holder is a poll on OUR pid rather than `sleep infinity`: when the
+    // main process dies — graceful quit, SIGKILL, OR an OOM crash — `kill -0`
+    // fails within one tick and the holder exits, releasing the lock. Without
+    // this the child reparents to init on a hard kill and the inhibitor leaks
+    // forever (one stranded lock per crash). 5s tick = worst-case 5s of stale
+    // lock after death, which errs toward "stay awake" — the safe direction.
+    const child = spawn('systemd-inhibit', [
+      '--what=sleep:idle',
+      '--who=Claude Session Manager',
+      '--why=Scheduler polling and claude -p jobs must survive idle',
+      '--mode=block',
+      'sh', '-c', `while kill -0 ${process.pid} 2>/dev/null; do sleep 5; done`,
+    ], { stdio: 'ignore', detached: false });
+    child.on('error', (e) => {
+      logs.writeLine({ scope: 'main', level: 'warn', message: 'systemd-inhibit spawn failed', meta: { error: e?.message } });
+    });
+    if (child.pid) {
+      systemdInhibitChild = child;
+      logs.writeLine({ scope: 'main', level: 'info', message: 'systemd-inhibit block lock held', meta: { pid: child.pid } });
+    }
+  } catch (e) {
+    logs.writeLine({ scope: 'main', level: 'warn', message: 'systemd-inhibit unavailable', meta: { error: e?.message } });
+  }
+}
+
+function stopSystemdInhibit() {
+  if (systemdInhibitChild) {
+    try { systemdInhibitChild.kill('SIGTERM'); } catch { /* */ }
+    systemdInhibitChild = null;
+  }
+}
 
 // Boot diagnostics — populated at app.whenReady so the renderer can poll their
 // state via IPC and surface toasts on the failure paths. The first-paint
@@ -617,7 +668,7 @@ protocol.registerSchemesAsPrivileged([
 const SMFILE_MIME = {
   '.html': 'text/html', '.htm': 'text/html',
   '.css': 'text/css', '.js': 'text/javascript', '.mjs': 'text/javascript',
-  '.json': 'application/json', '.svg': 'image/svg+xml',
+  '.json': 'application/json', '.jsonl': 'application/jsonl', '.ndjson': 'application/x-ndjson', '.svg': 'image/svg+xml',
   '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg',
   '.gif': 'image/gif', '.webp': 'image/webp', '.ico': 'image/x-icon',
   '.avif': 'image/avif', '.bmp': 'image/bmp',
@@ -677,6 +728,12 @@ app.whenReady().then(async () => {
   logs.pruneOld();
   logs.writeLine({ scope: 'main', level: 'info', message: 'app start', meta: { version: app.getVersion(), platform: process.platform } });
 
+  // Crash/OOM diagnostics: logs a postmortem if the PREVIOUS run died
+  // uncleanly (the silent OOM-kill we've been chasing), then starts the memory
+  // heartbeat + render/child-process-gone hooks for this run. See
+  // crashDiagnostics.cjs for the full rationale.
+  crashDiagnostics.init({ logs, getPowerBlockerId: () => powerBlockerId });
+
   // Boot-time detection 1: surface `claude` binary resolution so a missing
   // install becomes visible to the renderer instead of failing silently on
   // first spawn attempt.
@@ -867,6 +924,8 @@ app.whenReady().then(async () => {
   } catch (e) {
     logs.writeLine({ scope: 'main', level: 'warn', message: 'powerSaveBlocker failed', meta: { error: e?.message } });
   }
+  // Linux backstop — Electron's blocker no-ops under COSMIC (see above).
+  startSystemdInhibit();
 
   // OTEL: load persisted config and start the exporter only if `enabled`.
   // Failures are non-fatal — the app must keep working without telemetry.
@@ -883,6 +942,9 @@ app.whenReady().then(async () => {
 });
 
 app.on('will-quit', () => {
+  // Mark a clean exit so the next boot can distinguish a graceful quit from an
+  // OOM-kill / native crash (which leaves the sentinel `open`).
+  crashDiagnostics.markCleanShutdown();
   // PRD F1 v2 §IPC plumbing: must unregisterAll on will-quit.
   try { globalShortcut.unregisterAll(); } catch { /* */ }
   voiceHotkey.disposeOnQuit();
@@ -890,6 +952,7 @@ app.on('will-quit', () => {
     try { powerSaveBlocker.stop(powerBlockerId); } catch { /* */ }
     powerBlockerId = -1;
   }
+  stopSystemdInhibit();
 });
 
 app.on('window-all-closed', () => {

package/src/main/lib/sendToRenderer.cjs

@@ -9,12 +9,25 @@
 'use strict';
 
 /**
- * Send a payload on a channel iff the BrowserWindow is alive.
+ * Send a payload on a channel iff the BrowserWindow AND its render frame are alive.
  * No-ops on null/destroyed windows so callers don't need their own guards.
+ *
+ * `window.isDestroyed()` alone is insufficient: during a reload/navigation the
+ * BrowserWindow stays alive while its underlying render frame (WebFrameMain) is
+ * disposed and recreated. In that window, `webContents.send` throws
+ * "Render frame was disposed before WebFrameMain could be accessed". The frame
+ * can also vanish between our check and the send (TOCTOU), so we both probe the
+ * webContents state and wrap the send in try/catch.
  */
 function sendIfAlive(window, channel, payload) {
-  if (window && !window.isDestroyed()) {
-    window.webContents.send(channel, payload);
+  if (!window || window.isDestroyed()) return;
+  const wc = window.webContents;
+  if (!wc || wc.isDestroyed() || wc.isCrashed()) return;
+  try {
+    wc.send(channel, payload);
+  } catch {
+    // Render frame disposed mid-send (reload/teardown race). Drop the message —
+    // a stale frame has no listener anyway.
   }
 }