claude-code-session-manager 0.39.1 → 0.39.2

package/src/main/promptSessionEvents.cjs

@@ -0,0 +1,87 @@
+'use strict';
+
+/**
+ * Main-process counterpart to promptSessions.ts's event chain, used ONLY by
+ * the scheduler's PRD-finished notification path (notifyOriginatingTab,
+ * scheduler.cjs). The renderer owns the live in-memory PromptSession store
+ * and its own persistActiveIndex; this module never touches that store — it
+ * reads/writes the SAME on-disk active-index.json directly, read-modify-
+ * write, so a scheduler job (which runs in the main process, with no
+ * renderer store to append to) can chain a 'response' event onto a known
+ * session's tail without routing a synthetic prompt into an unrelated tab
+ * (PRD 814).
+ */
+
+const config = require('./config.cjs');
+
+function promptSessionActiveIndexPath(cwd) {
+  return `${String(cwd).replace(/\/+$/, '')}/session-manager-operations/prompt-sessions/active-index.json`;
+}
+
+let seq = 0;
+function mintEventId() {
+  seq += 1;
+  return `pevt-${Date.now().toString(36)}-${seq}`;
+}
+
+// Serializes read-modify-write cycles per active-index.json path so two
+// PRDs finishing back-to-back for sessions in the same cwd chain onto the
+// tail in issue order instead of racing two independent read-then-write
+// round trips (mirrors promptSessions.ts's own pendingWritesByPath).
+const pendingWritesByPath = new Map();
+
+function withPathLock(path, task) {
+  const prior = pendingWritesByPath.get(path) || Promise.resolve();
+  const settle = () => task();
+  const run = prior.then(settle, settle);
+  pendingWritesByPath.set(
+    path,
+    run.then(
+      () => undefined,
+      () => undefined,
+    ),
+  );
+  return run;
+}
+
+/**
+ * If `sourcePromptId` resolves to a known, still-active PromptSession under
+ * `cwd`'s active-index.json, appends a 'response' event chained to that
+ * session's current tail and returns true. Returns false (never throws) for
+ * every case the caller must fall back on: missing cwd/id, no index file,
+ * unknown id, a completed session, an empty event chain, or any I/O error —
+ * so notifyOriginatingTab's existing tab-external-ticket path stays the
+ * safety net, not a special case.
+ */
+async function appendResponseEventIfKnown(cwd, sourcePromptId, text) {
+  if (!cwd || !sourcePromptId) return false;
+  const path = promptSessionActiveIndexPath(cwd);
+  try {
+    return await withPathLock(path, async () => {
+      const result = await config.readJson(path);
+      if (!result.exists || !result.data) return false;
+      const data = result.data;
+      const session = data.sessions && data.sessions[sourcePromptId];
+      if (!session || session.status !== 'active') return false;
+      const events = (data.events && data.events[sourcePromptId]) || [];
+      const tail = events.length > 0 ? events[events.length - 1] : null;
+      if (!tail) return false;
+      const event = {
+        id: mintEventId(),
+        promptSessionId: sourcePromptId,
+        kind: 'response',
+        causedByEventId: tail.id,
+        at: new Date().toISOString(),
+        text,
+      };
+      data.events[sourcePromptId] = [...events, event];
+      await config.writeJson(path, data);
+      return true;
+    });
+  } catch (e) {
+    console.error('[promptSessionEvents] appendResponseEventIfKnown error', cwd, sourcePromptId, e);
+    return false;
+  }
+}
+
+module.exports = { appendResponseEventIfKnown, promptSessionActiveIndexPath };

package/src/main/runVerify.cjs

@@ -260,16 +260,34 @@ function hasInstallRecovery(events, fromSeq) {
   return false;
 }
 
+// Matches a leading `sleep <N> &&` or `sleep <N> ;` wrapper (the shell idiom
+// used to poll a still-pending remote job) so a retry that only drops/changes
+// its own timing wrapper still counts as the same underlying command. Narrow
+// on purpose: it strips nothing else, so two genuinely different commands
+// never collapse into a false pairing (incident: RCA 745-pr188-ci-lint-docs-integrity).
+const SLEEP_PREFIX_RE = /^\s*sleep\s+\d+\s*(&&|;)\s*/;
+
+/**
+ * Strip a leading `sleep <N> (&&|;)` wrapper from a tool_use description so
+ * self-recovery comparisons ignore only that timing-poll idiom.
+ */
+function normalizeDescForRecovery(desc) {
+  return (desc ?? '').replace(SLEEP_PREFIX_RE, '');
+}
+
 /**
  * Check whether the error at `errorSeq` is self-recovered within the next 30
  * events.
  *
  * Recovery heuristic: another tool_use with the same non-empty `description`
+ * (after stripping a leading `sleep N &&`/`sleep N;` wrapper from both sides)
  * appears within 30 events of the error, AND its corresponding tool_result is
  * free of error patterns AND is not is_error=true.
  */
 function isSelfRecovered(events, errorSeq, desc) {
   if (!desc) return false;
+  const normalizedDesc = normalizeDescForRecovery(desc);
+  if (!normalizedDesc) return false;
 
   // Build a quick lookup from tool_use_id → tool_result event.
   const resultByUseId = new Map();
@@ -281,7 +299,7 @@ function isSelfRecovered(events, errorSeq, desc) {
   for (const ev of events) {
     if (ev.seq <= errorSeq) continue;
     if (++seen > 30) break;
-    if (ev.kind !== 'tool_use' || ev.description !== desc) continue;
+    if (ev.kind !== 'tool_use' || normalizeDescForRecovery(ev.description) !== normalizedDesc) continue;
     const result = resultByUseId.get(ev.toolUseId);
     if (result && !result.isError && !detectPattern(result.content)) return true;
   }
@@ -512,6 +530,114 @@ function checkMergeablePr({ cwd, prNumber, timeoutMs = GH_CHECK_TIMEOUT_MS, exec
   }
 }
 
+// ─── prior-run-landed-commit postcondition exemption (re-fired same slug) ───
+
+/**
+ * Independently re-check, via real git ancestry, whether a commit a PREVIOUS
+ * run of this same slug landed is reachable from the current HEAD. Used to
+ * distinguish a truthful no-op re-run (the slug's work already shipped in an
+ * earlier run, so this run correctly made no new commit) from a lying PASS
+ * with no substantiating work at all.
+ *
+ * Bounded (15s) and fully fail-safe: ANY error (bad SHA, non-git cwd, timeout,
+ * `sha` not an ancestor) resolves `false` rather than throwing, so a failure
+ * here only ever falls back to today's pass_no_commit behavior — it can never
+ * turn a real failure into a false "verified".
+ *
+ * `execImpl` is injectable (defaults to `child_process.execFileSync`) so unit
+ * tests can stub the subprocess call without shelling out to real git.
+ */
+function isAncestorCommit({ cwd, sha, timeoutMs = GH_CHECK_TIMEOUT_MS, execImpl = execFileSync }) {
+  if (!sha) return false;
+  try {
+    execImpl('git', ['merge-base', '--is-ancestor', sha, 'HEAD'], {
+      cwd: cwd || process.cwd(),
+      timeout: timeoutMs,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// ─── already-shipped postcondition exemption (original PRD re-runs) ─────────
+
+const PRD_DELIVERABLE_PATH_RE = /(?:^|[`\s(])((?:src|scripts|session-manager-operations|test|tests|docs|bin)\/[A-Za-z0-9_./-]*[A-Za-z0-9_-]\.[A-Za-z0-9]+)\b/g;
+
+// Repo-root config files a PRD can legitimately name as its only deliverable.
+// Deliberately an exact-name allowlist, not a general root-file pattern:
+// a loose rule would match prose mentions (README.md, queue.json) and grant
+// false exemptions. Incident: PRD 816 named vitest.config.ts as its primary
+// deliverable and it was silently dropped from extraction.
+const PRD_ROOT_CONFIG_DELIVERABLES = [
+  'package.json',
+  'tsconfig.json',
+  'vitest.config.ts',
+  'vite.config.ts',
+  'playwright.config.ts',
+  'eslint.config.js',
+  'tailwind.config.js',
+  'postcss.config.js',
+];
+
+/**
+ * Extract the deliverable file paths a PRD body names — backticked or bare
+ * paths under a source dir with a file extension (e.g. `src/main/lib/foo.cjs`,
+ * `src/renderer/components/Bar.tsx`, `scripts/baz.cjs`), plus any allowlisted
+ * repo-root config filename named as a whole word (e.g. `vitest.config.ts`).
+ * Deliberately narrow: only repo-relative paths under a known source root or
+ * an exact-name root-config allowlist, no globs, no node_modules, no URLs.
+ * O(n) over the PRD body length.
+ */
+function extractPrdDeliverablePaths(prdBody) {
+  if (typeof prdBody !== 'string' || !prdBody) return [];
+  const seen = new Set();
+  const out = [];
+  let m;
+  PRD_DELIVERABLE_PATH_RE.lastIndex = 0;
+  while ((m = PRD_DELIVERABLE_PATH_RE.exec(prdBody)) !== null) {
+    const p = m[1];
+    if (p.includes('node_modules') || p.includes('..') || seen.has(p)) continue;
+    seen.add(p);
+    out.push(p);
+  }
+  for (const name of PRD_ROOT_CONFIG_DELIVERABLES) {
+    if (seen.has(name)) continue;
+    const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const re = new RegExp(`(?:^|[\`\\s(])${escaped}(?:[\`\\s)]|$)`);
+    if (re.test(prdBody)) {
+      seen.add(name);
+      out.push(name);
+    }
+  }
+  return out;
+}
+
+/**
+ * Materially check whether every deliverable path a PRD names is already
+ * tracked in git — i.e. the PRD's work landed in an EARLIER run/commit and
+ * this run correctly had nothing to do. Uses `git ls-files --error-unmatch`
+ * (bounded, execImpl injectable for tests). Fails safe in every direction:
+ * any error, a non-git cwd, or zero paths returns false, which falls straight
+ * through to today's pass_no_commit behavior.
+ */
+function allDeliverablesAlreadyTracked({ cwd, paths, execImpl = execFileSync, timeoutMs = 15_000 }) {
+  if (!Array.isArray(paths) || paths.length === 0) return false;
+  try {
+    execImpl('git', ['ls-files', '--error-unmatch', '--', ...paths], {
+      cwd: cwd || process.cwd(),
+      timeout: timeoutMs,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 // ─── main verifier ────────────────────────────────────────────────────────────
 
 /**
@@ -538,9 +664,13 @@ function checkMergeablePr({ cwd, prNumber, timeoutMs = GH_CHECK_TIMEOUT_MS, exec
  *                                            subprocess call used by the -merge-main
  *                                            postcondition exemption. Defaults to
  *                                            child_process.execFileSync.
+ * @param {string|null} [params.priorLandedCommit] The commit SHA a PREVIOUS run of this
+ *                                            same slug landed, if any — supplied by the
+ *                                            caller (scheduler.cjs). Used by the
+ *                                            pass_no_commit_prior_run_verified exemption.
  * @returns {Promise<{verdict:string, reason:string, downgradeTo:string|null}>}
  */
-async function verifyRun({ runDir, prdPath, queueEntry, allJobs = [], committedDuringRun = false, allowPreSentinelHeal = false, ghExecImpl }) {
+async function verifyRun({ runDir, prdPath, queueEntry, allJobs = [], committedDuringRun = false, allowPreSentinelHeal = false, ghExecImpl, priorLandedCommit = null }) {
   const { slug } = queueEntry;
   const logPath = path.join(runDir, `${slug}.log`);
   const verdictsPath = path.join(runDir, `${slug}.verdicts.json`);
@@ -758,7 +888,64 @@ async function verifyRun({ runDir, prdPath, queueEntry, allJobs = [], committedD
           }
         }
       }
-      if (!mergeMainVerified) {
+      // EXEMPTION: the SAME slug was already executed by a PRIOR run that
+      // landed a commit, and that commit is still reachable from HEAD. "I
+      // re-checked every AC item, found it all already implemented by an
+      // earlier run of this exact PRD, declined to make a no-op commit, and
+      // printed a truthful PASS" is correct, idempotent behavior — the
+      // systemic false-failure class this exemption exists to catch (distinct
+      // from the already-shipped exemption below, which looks at PRD-named
+      // file paths rather than a specific prior run's SHA).
+      // (Incident: 812-workbench-review-nits-cleanup, 2026-07-31 — re-fired
+      // ~24 min after its own prior run landed 00d891c; re-verified,
+      // re-ran typecheck + 17 green tests, made no new commit, printed a
+      // truthful PASS, and was parked in needs_review anyway.)
+      let priorRunVerified = false;
+      if (!mergeMainVerified && priorLandedCommit
+        && isAncestorCommit({ cwd: queueEntry?.cwd, sha: priorLandedCommit })) {
+        priorRunVerified = true;
+        return conclude(
+          'pass_no_commit_prior_run_verified',
+          `SCHEDULER_VERDICT: PASS with no commit, but a prior run of this slug landed ${priorLandedCommit}, `
+            + 'which is an ancestor of HEAD — the PRD\'s work is already in the tree, so this re-run correctly '
+            + 'made no change',
+          null,
+          {
+            ...(annotations.length ? { annotations } : {}),
+            sentinel,
+            priorLandedCommit,
+          },
+        );
+      }
+      // EXEMPTION: an ORIGINAL PRD re-queued after its deliverables already
+      // landed. "I checked, the work is already committed and green, nothing
+      // to change" is a truthful PASS, not a silent no-op — the same
+      // reasoning that exempts fix-plan slugs above. Materially checked
+      // against real git state, never inferred from the transcript.
+      // (Incident: 655-needs-review-rca-feedback-hook, 2026-07-31 — verified
+      // rcaFeedbackHook.cjs shipped in e13168d, ran typecheck + 23 green
+      // tests, made no commit, printed a truthful PASS, and was parked
+      // anyway.)
+      let alreadyShipped = false;
+      if (!mergeMainVerified && !priorRunVerified) {
+        const deliverablePaths = extractPrdDeliverablePaths(prdBody);
+        if (deliverablePaths.length > 0
+          && allDeliverablesAlreadyTracked({ cwd: queueEntry?.cwd, paths: deliverablePaths })) {
+          alreadyShipped = true;
+          return conclude(
+            'pass_no_commit_already_shipped',
+            `SCHEDULER_VERDICT: PASS with no commit, but every PRD-named deliverable path is already `
+              + `tracked in git (${deliverablePaths.join(', ')}) — this PRD's work landed in an earlier run`,
+            null,
+            {
+              ...(annotations.length ? { annotations } : {}),
+              sentinel,
+              alreadyTrackedPaths: deliverablePaths,
+            },
+          );
+        }
+      }
+      if (!mergeMainVerified && !priorRunVerified && !alreadyShipped) {
         issues.push({
           verdict: 'pass_no_commit',
           reason: 'SCHEDULER_VERDICT: PASS but no commit landed during the run window — the run claims success but produced no code change',
@@ -830,6 +1017,8 @@ module.exports = {
   // Exposed for unit tests.
   detectPattern,
   isHarnessToolError,
+  isSelfRecovered,
+  normalizeDescForRecovery,
   toolUseName,
   extractSoakFromBody,
   parsePrdBodyDepFragments,
@@ -839,4 +1028,7 @@ module.exports = {
   isMergeMainSlug,
   extractMergeMainPrNumber,
   checkMergeablePr,
+  extractPrdDeliverablePaths,
+  allDeliverablesAlreadyTracked,
+  isAncestorCommit,
 };