claude-code-session-manager 0.37.1 → 0.38.0

package/scripts/lib/watchdogHelpers.cjs

@@ -9,11 +9,6 @@ const path = require('node:path');
 
 const { activeProjectCwds } = require('./activeSessions.cjs');
 
-// Relative path into src/main/lib/ — the watchdog is external to the app, so
-// we re-use the helpers without importing any Electron code.
-// (Same claudePidAlive + classifyRunOutcome used by scheduler.cjs boot reconciliation.)
-const { claudePidAlive, classifyRunOutcome, ORPHAN_REQUEUE_CAP } = require('../../src/main/lib/reaperHelpers.cjs');
-
 // Mirrors scheduler.cjs:215 (single source of truth there; kept in sync here).
 const DEFAULT_HEARTBEAT_PATH = path.join(
   os.homedir(), '.claude', 'session-manager', 'scheduler-heartbeat.log',
@@ -44,7 +39,7 @@ const TAIL_BYTES = 4096;
  * Returns null on missing / empty / unparseable file.
  *
  * Single source of truth for the file-read + reverse-scan logic; used by
- * readLastHeartbeatTs(), heartbeatFresh(), and reconcileQueueOffline().
+ * readLastHeartbeatTs() and heartbeatFresh().
  */
 function readLastHeartbeat(heartbeatPath = DEFAULT_HEARTBEAT_PATH) {
   let buf;
@@ -106,175 +101,117 @@ function heartbeatFresh(heartbeatPath = DEFAULT_HEARTBEAT_PATH, maxAgeMs = DEFAU
 const DEFAULT_QUEUE_PATH = path.join(
   os.homedir(), '.claude', 'session-manager', 'scheduled-plans', 'queue.json',
 );
-const DEFAULT_RUNS_DIR = path.join(
-  os.homedir(), '.claude', 'session-manager', 'scheduled-plans', 'runs',
-);
 const DEFAULT_PRDS_DIR = path.join(
   os.homedir(), '.claude', 'session-manager', 'scheduled-plans', 'prds',
 );
-const DEFAULT_SKILL_PATH = path.join(
-  os.homedir(), '.claude', 'skills', 'process-feedback', 'SKILL.md',
-);
-const DEFAULT_STANDARDS_PATH = path.join(
-  os.homedir(), '.claude', 'skills', 'develop', 'standards.md',
+const PLUGIN_CACHE_ROOT = path.join(
+  os.homedir(), '.claude', 'plugins', 'cache', 'session-manager', 'session-manager-dev',
 );
 
 /**
- * reconcileQueueOffline(opts?) → { reconciled: boolean, reapedCount: number, errors: string[] }
- *
- * Safe offline reconciliation of queue.json when the in-app scheduler is down.
+ * compareVersionsDesc(a, b) → number
  *
- * Guard: re-checks heartbeatFresh() at the top and returns a no-op result if the
- * app is alive — the app owns the mutate lock and concurrent writes corrupt the queue.
- *
- * When stale: for each running job whose PID is dead (or whose app is dead):
- *   success    → completed
- *   failed     → failed
- *   no_result / unknown → re-queue to pending (bounded by ORPHAN_REQUEUE_CAP)
+ * Numeric per-segment version compare (descending) for plugin-cache version
+ * dirs like "0.1.0" / "0.2.0" / "0.10.0". Plain lexicographic sort is wrong
+ * here — "0.10.0" < "0.2.0" as strings even though 10 > 2 numerically. Falls
+ * back to a string compare for any non-numeric segment (e.g. a stray dir name
+ * that isn't a version) so listSkillCandidates never throws on garbage input.
+ */
+function compareVersionsDesc(a, b) {
+  const as = a.split('.');
+  const bs = b.split('.');
+  const len = Math.max(as.length, bs.length);
+  for (let i = 0; i < len; i++) {
+    const an = Number(as[i]);
+    const bn = Number(bs[i]);
+    if (Number.isFinite(an) && Number.isFinite(bn)) {
+      if (an !== bn) return bn - an;
+    } else if (as[i] !== bs[i]) {
+      return (as[i] ?? '') < (bs[i] ?? '') ? 1 : -1;
+    }
+  }
+  return 0;
+}
+
+/**
+ * listSkillCandidates(cwd, skillName, fileName, pluginCacheRoot?) → string[]
  *
- * If the PID is still alive but the app is dead, SIGTERM it before classifying.
+ * Ordered candidate paths for an inlined skill/standards file, most-specific
+ * first — the process-feedback SKILL.md and develop standards.md moved out of
+ * the legacy ~/.claude/skills/ location into the session-manager-dev plugin:
  *
- * Atomic write: queue.json.tmp-<pid>-<ts> → rename (mirrors config.cjs writeJsonSync).
+ *   1. <cwd>/plugins/session-manager-dev/skills/<skillName>/<fileName>  — repo-local
+ *      copy, correct when the swept project vendors the plugin (e.g. session-manager itself).
+ *   2. <pluginCacheRoot>/<newest-version>/skills/<skillName>/<fileName> — the installed
+ *      plugin cache (default ~/.claude/plugins/cache/session-manager/session-manager-dev).
+ *      Enumerates every version dir present, newest (lexicographically-highest) first.
+ *   3. ~/.claude/skills/<skillName>/<fileName> — legacy location, kept last so an
+ *      old install still works.
  *
- * O(n) in number of running jobs; classifyRunOutcome tails up to 64 KB per job.
+ * pluginCacheRoot is overridable for tests; defaults to the real plugin cache.
  */
-function reconcileQueueOffline({
-  heartbeatPath = DEFAULT_HEARTBEAT_PATH,
-  maxAgeMs = DEFAULT_MAX_AGE_MS,
-  queuePath = DEFAULT_QUEUE_PATH,
-  runsDir = DEFAULT_RUNS_DIR,
-} = {}) {
-  // Safety guard: never touch queue.json while the app is alive.
-  if (heartbeatFresh(heartbeatPath, maxAgeMs)) {
-    return { reconciled: false, reapedCount: 0, errors: [] };
-  }
-
-  // Second guard: stale heartbeat may just mean the app is under load.
-  // If the heartbeat carries a pid and that process is still alive, the app
-  // is running — do not reap. Backward-compat: if no pid field, fall through
-  // to the classic age-only behavior so pre-existing orphan cleanup still works.
-  const lastHeartbeat = readLastHeartbeat(heartbeatPath);
-  if (lastHeartbeat !== null && typeof lastHeartbeat.pid === 'number') {
-    try {
-      process.kill(lastHeartbeat.pid, 0); // liveness check only — no signal
-      // pid is alive → app is running; abort reap.
-      return { reconciled: false, reapedCount: 0, errors: [] };
-    } catch {
-      // ESRCH → process is gone; proceed with reap.
-    }
-  }
+function listSkillCandidates(cwd, skillName, fileName, pluginCacheRoot = PLUGIN_CACHE_ROOT) {
+  const candidates = [
+    path.join(cwd, 'plugins', 'session-manager-dev', 'skills', skillName, fileName),
+  ];
 
-  let state;
+  let entries = [];
   try {
-    state = JSON.parse(fs.readFileSync(queuePath, 'utf8'));
-  } catch (e) {
-    return { reconciled: false, reapedCount: 0, errors: [`read queue.json: ${e?.message}`] };
-  }
-
-  const errors = [];
-  let reapedCount = 0;
-  let changed = false;
-  // Stamp once so all jobs reapedQueue in the same watchdog run share a finishedAt.
-  const reconciledAt = new Date().toISOString();
-
-  for (const j of (state.jobs ?? [])) {
-    if (j.status !== 'running') continue;
-
-    const logPath = j.runId ? path.join(runsDir, j.runId, `${j.slug}.log`) : null;
-    const pid = j.runtime?.pid;
-
-    // If the orphan is still alive we must NOT classify its log this tick — the
-    // process is still running/flushing, so a partial or in-flight log would be
-    // misread (e.g. a job about to emit result:success gets read as no_result and
-    // re-queued, double-running the same PRD while the original still edits the
-    // repo). Instead escalate across ticks (SIGTERM → SIGKILL), matching the
-    // scheduler's kill discipline (process group first, then the pid).
-    //
-    // Bounded so a job can't wedge in 'running' forever: after we've sent BOTH
-    // SIGTERM and SIGKILL on prior ticks, the real claude process is gone. A pid
-    // still reported "alive" here is an unkillable defunct — or, on macOS (no
-    // /proc, so claudePidAlive can't verify identity), a REUSED pid we must stop
-    // signalling. Either way we fall through to finalize from the now-settled log.
-    if (pid && claudePidAlive(pid)) {
-      if (!j.runtime.watchdogSigtermAt) {
-        try { process.kill(-pid, 'SIGTERM'); }
-        catch { try { process.kill(pid, 'SIGTERM'); } catch { /* ESRCH — died between checks */ } }
-        j.runtime.watchdogSigtermAt = reconciledAt;
-        changed = true;
-        continue; // leave status 'running'; revisit next tick
-      }
-      if (!j.runtime.watchdogSigkillAt) {
-        try { process.kill(-pid, 'SIGKILL'); }
-        catch { try { process.kill(pid, 'SIGKILL'); } catch { /* ESRCH */ } }
-        j.runtime.watchdogSigkillAt = reconciledAt;
-        changed = true;
-        continue; // give SIGKILL a tick to land before finalizing
-      }
-      // SIGTERM + SIGKILL already sent on earlier ticks → stop deferring; the
-      // original process is dead. Fall through to classify + finalize.
-    }
-
-    const outcome = logPath ? classifyRunOutcome(logPath) : 'unknown';
-
-    if (outcome === 'success') {
-      j.status = 'completed';
-      j.exitCode = 0;
-      j.error = null;
-      j.finishedAt = reconciledAt;
-      delete j.runtime;
-      delete j.verifierVerdict;
-    } else if (outcome === 'failed') {
-      j.status = 'failed';
-      j.exitCode = j.exitCode ?? 1;
-      j.error = 'orphaned: watchdog found failed result while app was down';
-      j.finishedAt = reconciledAt;
-      delete j.runtime;
-      delete j.verifierVerdict;
-    } else {
-      // no_result / unknown: interrupted with no evidence of merit failure — re-queue bounded.
-      const tries = j.orphanRetries ?? 0;
-      if (tries < ORPHAN_REQUEUE_CAP) {
-        j.status = 'pending';
-        j.runId = null;
-        j.startedAt = null;
-        j.finishedAt = null;
-        j.exitCode = null;
-        j.error = `orphaned: watchdog re-queued (attempt ${tries + 1}/${ORPHAN_REQUEUE_CAP})`;
-        j.orphanRetries = tries + 1;
-        delete j.runtime;
-        delete j.verifierVerdict;
-      } else {
-        j.status = 'failed';
-        j.exitCode = j.exitCode ?? 1;
-        j.error = `orphaned: watchdog exhausted ${ORPHAN_REQUEUE_CAP} re-queue attempts`;
-        j.finishedAt = reconciledAt;
-        delete j.runtime;
-        delete j.verifierVerdict;
-      }
-    }
-
-    reapedCount++;
-    changed = true;
+    entries = fs.readdirSync(pluginCacheRoot, { withFileTypes: true });
+  } catch { /* plugin cache not installed */ }
+  const versions = entries.filter((e) => e.isDirectory()).map((e) => e.name).sort(compareVersionsDesc);
+  for (const version of versions) {
+    candidates.push(path.join(pluginCacheRoot, version, 'skills', skillName, fileName));
   }
 
-  if (!changed) {
-    return { reconciled: false, reapedCount: 0, errors };
+  candidates.push(path.join(os.homedir(), '.claude', 'skills', skillName, fileName));
+  return candidates;
+}
+
+/**
+ * resolveSkillFile(cwd, skillName, fileName, pluginCacheRoot?) → string | null
+ *
+ * Returns the first candidate from listSkillCandidates() that is a readable
+ * file, or null if none resolve.
+ */
+function resolveSkillFile(cwd, skillName, fileName, pluginCacheRoot = PLUGIN_CACHE_ROOT) {
+  for (const candidate of listSkillCandidates(cwd, skillName, fileName, pluginCacheRoot)) {
+    try {
+      if (fs.statSync(candidate).isFile()) return candidate;
+    } catch { /* try next candidate */ }
   }
+  return null;
+}
 
-  // Atomic write: tmp-<pid>-<ts> → rename (mirrors config.cjs writeJsonSync).
-  const tmpPath = `${queuePath}.tmp-${process.pid}-${Date.now()}`;
+/**
+ * isPidAlive(pid) → boolean
+ *
+ * Plain liveness check via process.kill(pid, 0) (no signal sent). Single
+ * source of truth for the "is this recorded pid still alive" check used by
+ * checkAppLiveness's defense-in-depth relaunch gate.
+ *
+ * EPERM (pid exists, owned by another user) counts as alive — only ESRCH
+ * (no such process) means dead. Watchdog and app run as the same user in
+ * practice, so this distinction rarely matters here, but treating EPERM as
+ * "dead" would be wrong on its face (the process demonstrably exists).
+ */
+function isPidAlive(pid) {
+  if (typeof pid !== 'number' || !Number.isFinite(pid)) return false;
   try {
-    fs.writeFileSync(tmpPath, JSON.stringify(state, null, 2) + '\n', 'utf8');
-    fs.renameSync(tmpPath, queuePath);
+    process.kill(pid, 0);
+    return true;
   } catch (e) {
-    errors.push(`write queue.json: ${e?.message}`);
-    try { fs.unlinkSync(tmpPath); } catch { /* best-effort cleanup */ }
-    return { reconciled: false, reapedCount: 0, errors };
+    return e?.code === 'EPERM';
   }
-
-  return { reconciled: true, reapedCount, errors };
 }
 
+// Offline queue.json reconciliation (orphaned 'running' jobs whose pid died
+// while Electron wasn't running) used to live here as reconcileQueueOffline().
+// PRD 686 moved that responsibility into src/main/scheduler.cjs's own boot
+// path (partitionBootOrphans/applyOrphanOutcome) now that PRD 685's watchdog
+// relaunch means the app is never down long enough to need an external
+// reconciler — the in-app scheduler is queue.json's single owner again.
+
 // ── slugify ──────────────────────────────────────────────────────────────────
 
 /** Lowercase, non-alphanumeric runs → single `-`, strip leading/trailing `-`. */
@@ -360,9 +297,21 @@ function hasOpenFeedback(cwd) {
 function emitFeedbackPRD(cwd, {
   prdsDir = DEFAULT_PRDS_DIR,
   queuePath = DEFAULT_QUEUE_PATH,
-  skillPath = DEFAULT_SKILL_PATH,
-  standardsPath = DEFAULT_STANDARDS_PATH,
+  skillPath,
+  standardsPath,
+  pluginCacheRoot = PLUGIN_CACHE_ROOT,
 } = {}) {
+  // Explicit overrides (used by tests) are honored verbatim and skip the
+  // candidate search entirely — only resolve via candidates when the caller
+  // didn't pass a path.
+  const skillPathExplicit = skillPath !== undefined;
+  const standardsPathExplicit = standardsPath !== undefined;
+  if (!skillPathExplicit) {
+    skillPath = resolveSkillFile(cwd, 'process-feedback', 'SKILL.md', pluginCacheRoot);
+  }
+  if (!standardsPathExplicit) {
+    standardsPath = resolveSkillFile(cwd, 'develop', 'standards.md', pluginCacheRoot);
+  }
   const project = slugify(path.basename(cwd));
 
   // De-dup: check queue.json for pending/running feedback job for this project.
@@ -407,22 +356,40 @@ function emitFeedbackPRD(cwd, {
 
   // Read and inline skill content.
   let rawSkill = '';
-  try {
-    rawSkill = fs.readFileSync(skillPath, 'utf8');
-  } catch {
-    process.stderr.write(`[emitFeedbackPRD] warning: skill file not readable: ${skillPath}\n`);
+  if (skillPath) {
+    try {
+      rawSkill = fs.readFileSync(skillPath, 'utf8');
+    } catch { /* handled by the empty-body guard below */ }
   }
   const skillBody = stripFrontmatter(rawSkill).trim();
 
   // Read and inline standards — strip H1 so our ## heading is the section anchor.
   let rawStandards = '';
-  try {
-    rawStandards = fs.readFileSync(standardsPath, 'utf8');
-  } catch {
-    process.stderr.write(`[emitFeedbackPRD] warning: standards file not readable: ${standardsPath}\n`);
+  if (standardsPath) {
+    try {
+      rawStandards = fs.readFileSync(standardsPath, 'utf8');
+    } catch { /* handled by the empty-body guard below */ }
   }
   const standardsBody = stripLeadingH1(stripFrontmatter(rawStandards)).trim();
 
+  // Hard-fail rather than silently ship a hollow PRD: if either inline is
+  // empty/unreadable, refuse to write anything and name every candidate tried
+  // so a future relocation shows up loudly in the watchdog log instead of
+  // queueing a template with no procedure and no standards in it.
+  if (!skillBody || !standardsBody) {
+    const missing = [];
+    if (!skillBody) {
+      const tried = skillPathExplicit ? [skillPath] : listSkillCandidates(cwd, 'process-feedback', 'SKILL.md', pluginCacheRoot);
+      missing.push(`process-feedback SKILL.md (tried: ${tried.join(', ')})`);
+    }
+    if (!standardsBody) {
+      const tried = standardsPathExplicit ? [standardsPath] : listSkillCandidates(cwd, 'develop', 'standards.md', pluginCacheRoot);
+      missing.push(`develop standards.md (tried: ${tried.join(', ')})`);
+    }
+    process.stderr.write(`[emitFeedbackPRD] refusing to emit for ${cwd}: missing inline(s) — ${missing.join('; ')}\n`);
+    return { emitted: false, reason: 'missing-inline' };
+  }
+
   const projectName = path.basename(cwd);
   const body = [
     '---',
@@ -476,6 +443,158 @@ function emitFeedbackPRD(cwd, {
   return { emitted: true, slug, prdPath };
 }
 
+// ── app liveness + auto-relaunch ─────────────────────────────────────────────
+//
+// The watchdog's one supervision job: is session-manager itself running, and
+// if not, start it. Reuses the existing scheduler heartbeat (written every
+// 60 s by scheduler.cjs's heartbeatInterval regardless of pause state) as the
+// liveness signal — no second heartbeat file.
+
+const DEFAULT_RELAUNCH_STATE_PATH = path.join(
+  os.homedir(), '.claude', 'session-manager', 'watchdog-relaunch-state.json',
+);
+const DEFAULT_RELAUNCH_LOG_PATH = path.join(
+  os.homedir(), '.claude', 'logs', 'scheduler-watchdog-relaunch.log',
+);
+const DEFAULT_RELAUNCH_DEBOUNCE_MS = 90_000;
+const DEFAULT_MAX_RELAUNCH_ATTEMPTS = 3;
+
+/**
+ * checkAppLiveness(opts?) → { alive: boolean, reason: string }
+ *
+ * Primary signal: heartbeatFresh() within the existing max-age window.
+ * Defense-in-depth: if the heartbeat is stale, but the pid it last recorded
+ * is still alive (app under heavy load, tick just missed), treat as alive
+ * rather than relaunching on top of a live process.
+ */
+function checkAppLiveness({
+  heartbeatPath = DEFAULT_HEARTBEAT_PATH,
+  maxAgeMs = DEFAULT_MAX_AGE_MS,
+} = {}) {
+  if (heartbeatFresh(heartbeatPath, maxAgeMs)) {
+    return { alive: true, reason: 'heartbeat-fresh' };
+  }
+  const last = readLastHeartbeat(heartbeatPath);
+  if (last !== null && typeof last.pid === 'number' && isPidAlive(last.pid)) {
+    return { alive: true, reason: 'pid-alive-heartbeat-stale' };
+  }
+  return { alive: false, reason: 'stale-and-dead' };
+}
+
+/** Default { lastAttemptTs: null, attemptCount: 0 } on missing/unparseable state file. */
+function readRelaunchState(statePath = DEFAULT_RELAUNCH_STATE_PATH) {
+  try {
+    const raw = JSON.parse(fs.readFileSync(statePath, 'utf8'));
+    return {
+      lastAttemptTs: typeof raw.lastAttemptTs === 'number' ? raw.lastAttemptTs : null,
+      attemptCount: typeof raw.attemptCount === 'number' ? raw.attemptCount : 0,
+    };
+  } catch {
+    return { lastAttemptTs: null, attemptCount: 0 };
+  }
+}
+
+/** Atomic write: tmp-<pid>-<ts> → rename (mirrors config.cjs writeJsonSync). */
+function writeRelaunchState(statePath, state) {
+  fs.mkdirSync(path.dirname(statePath), { recursive: true });
+  const tmpPath = `${statePath}.tmp-${process.pid}-${Date.now()}`;
+  fs.writeFileSync(tmpPath, JSON.stringify(state, null, 2) + '\n', 'utf8');
+  fs.renameSync(tmpPath, statePath);
+}
+
+function logRelaunchLine(logPath, message) {
+  try {
+    fs.mkdirSync(path.dirname(logPath), { recursive: true });
+    fs.appendFileSync(logPath, `${new Date().toISOString()} ${message}\n`);
+  } catch (e) {
+    process.stderr.write(`[watchdog-relaunch] log write failed: ${e?.message}\n`);
+  }
+}
+
+/**
+ * defaultSpawnRelaunch(opts?) — launches a new session-manager instance the
+ * same way a user would: `npx claude-code-session-manager@latest` (the
+ * documented distribution method — CLAUDE.md's "Distribution" section), so
+ * this keeps working across npm publishes with no local path to maintain.
+ *
+ * Detached + stdio redirected to logPath + unref()'d so the watchdog's own
+ * (short-lived) process doesn't block on the launched app and the app
+ * survives the watchdog exiting.
+ */
+function defaultSpawnRelaunch({ logPath = DEFAULT_RELAUNCH_LOG_PATH } = {}) {
+  const { spawn } = require('node:child_process');
+  fs.mkdirSync(path.dirname(logPath), { recursive: true });
+  const fd = fs.openSync(logPath, 'a');
+  try {
+    const child = spawn('npx', ['claude-code-session-manager@latest'], {
+      detached: true,
+      stdio: ['ignore', fd, fd],
+    });
+    child.on('error', (e) => {
+      logRelaunchLine(logPath, `spawn error: ${e?.message}`);
+    });
+    child.unref();
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+/**
+ * maybeRelaunchApp(opts?) → { relaunched: boolean, reason: string, attemptCount: number }
+ *
+ * Debounced, capped auto-relaunch:
+ *   - alive (heartbeat fresh or pid alive)             → no-op, reset attempt state.
+ *   - dead + attemptCount already at maxAttempts         → skip, log diagnostic (give up).
+ *   - dead + last attempt < debounceMs ago                → skip (still booting).
+ *   - dead + debounce elapsed + under cap               → spawn, bump attemptCount, log.
+ *
+ * attemptCount only resets to 0 once a fresh heartbeat is observed (i.e. a
+ * relaunch actually succeeded), so 3 relaunch attempts that each fail to
+ * produce a fresh heartbeat permanently cap further attempts until a human
+ * intervenes or the app comes up some other way.
+ */
+function maybeRelaunchApp({
+  heartbeatPath = DEFAULT_HEARTBEAT_PATH,
+  maxAgeMs = DEFAULT_MAX_AGE_MS,
+  statePath = DEFAULT_RELAUNCH_STATE_PATH,
+  logPath = DEFAULT_RELAUNCH_LOG_PATH,
+  debounceMs = DEFAULT_RELAUNCH_DEBOUNCE_MS,
+  maxAttempts = DEFAULT_MAX_RELAUNCH_ATTEMPTS,
+  now = Date.now(),
+  spawnFn = defaultSpawnRelaunch,
+} = {}) {
+  const liveness = checkAppLiveness({ heartbeatPath, maxAgeMs });
+  const state = readRelaunchState(statePath);
+
+  if (liveness.alive) {
+    if (state.attemptCount !== 0 || state.lastAttemptTs !== null) {
+      writeRelaunchState(statePath, { lastAttemptTs: null, attemptCount: 0 });
+    }
+    return { relaunched: false, reason: 'alive', attemptCount: 0 };
+  }
+
+  if (state.attemptCount >= maxAttempts) {
+    logRelaunchLine(
+      logPath,
+      `giving up: ${state.attemptCount} relaunch attempt(s) already made and heartbeat is still stale — manual intervention required`,
+    );
+    return { relaunched: false, reason: 'capped', attemptCount: state.attemptCount };
+  }
+
+  if (state.lastAttemptTs !== null && (now - state.lastAttemptTs) < debounceMs) {
+    return { relaunched: false, reason: 'debounce', attemptCount: state.attemptCount };
+  }
+
+  const attemptCount = state.attemptCount + 1;
+  spawnFn({ logPath });
+  writeRelaunchState(statePath, { lastAttemptTs: now, attemptCount });
+  logRelaunchLine(
+    logPath,
+    `relaunch attempt ${attemptCount}/${maxAttempts}: spawning "npx claude-code-session-manager@latest" (heartbeat stale, last-known pid dead)`,
+  );
+  return { relaunched: true, reason: 'launched', attemptCount };
+}
+
 // ── sweep ─────────────────────────────────────────────────────────────────────
 
 /**
@@ -499,8 +618,8 @@ function sweep({
   projectsDir,
   prdsDir = DEFAULT_PRDS_DIR,
   queuePath = DEFAULT_QUEUE_PATH,
-  skillPath = DEFAULT_SKILL_PATH,
-  standardsPath = DEFAULT_STANDARDS_PATH,
+  skillPath,
+  standardsPath,
 } = {}) {
   const activeOpts = {};
   if (projectsDir !== undefined) activeOpts.projectsDir = projectsDir;
@@ -682,18 +801,29 @@ module.exports = {
   readLastHeartbeat,
   readLastHeartbeatTs,
   heartbeatFresh,
-  reconcileQueueOffline,
+  isPidAlive,
   hasOpenFeedback,
+  resolveSkillFile,
+  listSkillCandidates,
   emitFeedbackPRD,
   sweep,
   localDateStr,
   maybeFinalizeHistory,
   tryAcquireLock,
   releaseLock,
+  checkAppLiveness,
+  readRelaunchState,
+  writeRelaunchState,
+  defaultSpawnRelaunch,
+  maybeRelaunchApp,
   DEFAULT_HEARTBEAT_PATH,
   DEFAULT_MAX_AGE_MS,
   DEFAULT_STAMP_PATH,
   DEFAULT_LOCK_PATH,
   DEFAULT_LOCK_STALE_MS,
   DEFAULT_FINALIZE_BUDGET_MS,
+  DEFAULT_RELAUNCH_STATE_PATH,
+  DEFAULT_RELAUNCH_LOG_PATH,
+  DEFAULT_RELAUNCH_DEBOUNCE_MS,
+  DEFAULT_MAX_RELAUNCH_ATTEMPTS,
 };

package/src/main/__tests__/chat-cancel-terminal.test.cjs

@@ -75,6 +75,37 @@ test('cancelling an ACTIVE run broadcasts a terminal event (unsticks the UI)', a
   assert.match(terminal[0].payload.message, /cancel/i, 'message names the cancellation');
 });
 
+test('cancel() resolves only AFTER the terminal broadcast fires, not immediately on SIGTERM (PRD 718)', async () => {
+  // Order-of-events assertion (not timing-based — a real SIGTERM can be fast
+  // enough on a lightweight stub child that a fixed-delay race would flake).
+  const order = [];
+  cr.attachWindow({
+    isDestroyed: () => false,
+    webContents: {
+      isDestroyed: () => false,
+      send: (channel, payload) => {
+        if (isTerminal(channel) && payload.tabId === 'T2') order.push('terminal');
+      },
+    },
+  });
+
+  cr.run({ tabId: 'T2', sessionId: 'S2', prompt: 'hello', cwd: process.cwd(), resume: false });
+
+  for (let i = 0; i < 6; i++) await tick();
+
+  await cr.cancel('T2').then(() => order.push('resolved'));
+
+  assert.deepEqual(order, ['terminal', 'resolved'], 'cancel() resolves strictly after the terminal broadcast');
+});
+
+test('cancel() on a tab with no in-flight or waiting run resolves immediately (no-op)', async () => {
+  cr.attachWindow({
+    isDestroyed: () => false,
+    webContents: { isDestroyed: () => false, send: () => {} },
+  });
+  await cr.cancel('no-such-tab'); // must resolve, not hang
+});
+
 function isTerminal(channel) {
   return (
     channel === 'chat:run:complete' ||