claude-code-session-manager 0.41.1 → 0.43.0

package/src/main/lib/localAdminHttp.cjs

@@ -49,6 +49,15 @@ const TOKEN_PATH = path.join(os.homedir(), '.claude', 'session-manager', 'admin-
  * harmless tie-break, since real launches only ever set one or the other.
  */
 function resolveTokenPath() {
+  // Explicit override, highest priority. Exists because the unit tests call
+  // createAdminHttp().start() directly with neither SM_DEV nor SM_E2E set,
+  // which resolved to the PRODUCTION admin-api.json and overwrote the
+  // running app's port+token with a throwaway test server's — silently
+  // orphaning scheduler-mcp-server.cjs's access to the live app until the
+  // next app restart (confirmed live 2026-08-01: `npm run test:unit` made
+  // every scheduler_* MCP tool report "app is not running"). Tests point
+  // this at a tmp file; production never sets it.
+  if (process.env.SM_ADMIN_TOKEN_PATH) return process.env.SM_ADMIN_TOKEN_PATH;
   if (process.env.SM_DEV === '1') {
     return path.join(os.homedir(), '.claude', 'session-manager', 'admin-api.dev.json');
   }

package/src/main/lib/prdCreate.cjs

@@ -24,6 +24,7 @@ const config = require('../config.cjs');
 const { expandHome } = require('./expandHome.cjs');
 const { readBody, sendJson } = require('./localAdminHttp.cjs');
 const { readActiveIndex } = require('./epicMint.cjs');
+const { appendAuditEvent } = require('./auditLog.cjs');
 
 const STANDARDS_PATH = path.join(
   __dirname, '..', '..', '..',
@@ -192,6 +193,17 @@ async function createPrd(input, remote) {
     return { ok: false, status: 500, error: writeResult?.error ?? 'write failed' };
   }
 
+  // Trace-back point for "who/what created this PRD" (auditLog.cjs) — every
+  // PRD write, whether from the admin/MCP route or the renderer's chat:create-prd
+  // IPC handler, lands one record here regardless of outcome path above.
+  appendAuditEvent('prd_create', {
+    cwd: input.cwd,
+    slug: filenameSlug,
+    title: input.title,
+    sourcePromptId: input.sourcePromptId ?? null,
+    sourceTabId: input.sourceTabId ?? null,
+  });
+
   return { ok: true, nn, filename: `${filenameSlug}.md` };
 }
 

package/src/main/lib/schedulerBatch.cjs

@@ -49,10 +49,32 @@ function pickForProject(projectJobs, runningSlugsInProject, slots) {
   // unchanged (lowest-number-first waves), so an in-flight mixed queue keeps
   // its order without migration.
   const rowBySlug = new Map(projectJobs.map((j) => [j.slug, j]));
-  const blockingDep = (j) => (j.dependsOn ?? []).find((slug) => {
-    const dep = rowBySlug.get(slug);
-    return dep && dep.status !== 'completed';
-  });
+  // A PRD's filename slug carries the auto-allocated `NN-` prefix
+  // (prdCreate.cjs builds `${nn}-${slug}`), but a human/agent authoring
+  // `dependsOn:` writes the BARE name it chose — it cannot know the number
+  // the allocator will hand out. Without this, every such dep resolved to
+  // undefined and was silently treated as "already done", turning the whole
+  // dependency gate into a no-op (observed live 2026-08-01: 22 PRDs listing
+  // `leftnav-two-face-framework` while the real row was
+  // `873-leftnav-two-face-framework`, all of them eligible immediately even
+  // though the framework PRD they build on had not landed). Resolve a dep by
+  // exact slug first, then fall back to matching rows whose slug is that dep
+  // with a leading `NN-` stripped.
+  const rowsByBareSlug = new Map();
+  for (const j of projectJobs) {
+    const bare = String(j.slug ?? '').replace(/^\d+-/, '');
+    if (!rowsByBareSlug.has(bare)) rowsByBareSlug.set(bare, []);
+    rowsByBareSlug.get(bare).push(j);
+  }
+  /** Every queue row a dep string refers to (exact match, else bare-name match). */
+  const rowsForDep = (slug) => {
+    const exact = rowBySlug.get(slug);
+    if (exact) return [exact];
+    return rowsByBareSlug.get(String(slug ?? '').replace(/^\d+-/, '')) ?? [];
+  };
+  const blockingDep = (j) => (j.dependsOn ?? []).find((slug) => (
+    rowsForDep(slug).some((dep) => dep.status !== 'completed')
+  ));
 
   const allPending = projectJobs.filter(
     (j) => j.status === 'pending' && !runningSlugsInProject.has(j.slug),
@@ -64,7 +86,7 @@ function pickForProject(projectJobs, runningSlugsInProject, slots) {
   for (const j of allPending) {
     const dep = blockingDep(j);
     if (!dep) { pending.push(j); continue; }
-    if (rowBySlug.get(dep)?.status === 'failed') heldByFailedDep.push({ job: j, dep });
+    if (rowsForDep(dep).some((d) => d.status === 'failed')) heldByFailedDep.push({ job: j, dep });
     // running/pending/needs_review dep — simply not eligible this tick.
   }
   if (pending.length === 0) {

package/src/main/pty.cjs

@@ -147,6 +147,14 @@ class PtyManager {
       FORCE_COLOR: '1',
       // Tag the session so hook server / transcript tail can correlate.
       SESSION_MANAGER_TAB_ID: tabId,
+      // Tab ID = claudeSessionId by design (see CLAUDE.md domain model), and
+      // for an Epic, Terminal/Chat are two views over the SAME session — so
+      // this is exactly the id chatRunner.cjs sets for headless chat runs.
+      // Without it, a PRD queued via scheduler_create_prd from an
+      // interactive Epic terminal (not headless chat) had no way to resolve
+      // back to its originating Epic and minted an unrelated sibling one
+      // instead (prdCreate.cjs's resolveSourcePromptIdFromClaudeSession).
+      SM_CHAT_SESSION_ID: tabId,
     });
 
     const shell = process.env.SHELL || '/bin/bash';

package/src/main/runVerify.cjs

@@ -377,16 +377,43 @@ function parsePrdBodyDepFragments(body) {
  */
 function checkDeps(queueEntry, allJobs, prdBody) {
   const bySlug = new Map(allJobs.map((j) => [j.slug, j]));
+  // A PRD's filename carries the allocator's `NN-` prefix, but `dependsOn:` is
+  // authored with the bare name (the author cannot know the number that will
+  // be issued). Resolve exact slug first, then bare-name — identical rule to
+  // schedulerBatch.pickForProject's rowsForDep, which MUST agree with this
+  // function (see the missing-row note below).
+  const rowsByBareSlug = new Map();
+  for (const j of allJobs) {
+    const bare = String(j.slug ?? '').replace(/^\d+-/, '');
+    if (!rowsByBareSlug.has(bare)) rowsByBareSlug.set(bare, []);
+    rowsByBareSlug.get(bare).push(j);
+  }
+  const rowsForDep = (slug) => {
+    const exact = bySlug.get(slug);
+    if (exact) return [exact];
+    return rowsByBareSlug.get(String(slug ?? '').replace(/^\d+-/, '')) ?? [];
+  };
 
   // 1. Queue-level dependsOn (explicit).
   const queueDeps = Array.isArray(queueEntry.dependsOn) ? queueEntry.dependsOn : [];
   for (const depSlug of queueDeps) {
-    const dep = bySlug.get(depSlug);
-    if (!dep) {
-      return { ok: false, reason: `dependsOn: "${depSlug}" not found in queue` };
-    }
-    if (dep.status !== 'completed') {
-      return { ok: false, reason: `dependsOn: "${depSlug}" is ${dep.status} (need completed)` };
+    const deps = rowsForDep(depSlug);
+    // A dep with NO row is SATISFIED, not unmet. Completed rows are retired to
+    // history shards and their PRD is archived, so absence is the normal
+    // end-state of a finished dependency — exactly how pickForProject reads it.
+    //
+    // This used to return deps_unmet, which put the two halves of the
+    // scheduler in direct contradiction: the picker treated a missing dep as
+    // done and fired the job, then this check treated the same missing dep as
+    // unmet and downgraded the finished run back to pending — an infinite
+    // re-run, one full billed claude -p per cycle. It also silently dropped
+    // real work: PRDs 854 and 857 each ran to exit 0, were downgraded on a
+    // bare dep name that never matched any row, and ended up on disk with no
+    // queue row at all.
+    if (deps.length === 0) continue;
+    const unfinished = deps.find((d) => d.status !== 'completed');
+    if (unfinished) {
+      return { ok: false, reason: `dependsOn: "${depSlug}" is ${unfinished.status} (need completed)` };
     }
   }
 

package/src/main/scheduler.cjs

@@ -1071,6 +1071,11 @@ function reconcileSourcePromptId(job, parsedSourcePromptId) {
  * Status is preserved: pending stays pending, completed stays completed.
  * Newly-discovered PRDs land as `pending`.
  */
+// Epic ids already warned about (PRD-bearing but absent from
+// active-index.json). Module-scoped so the warning is one line per Epic per
+// process rather than one per 60s reconcile tick.
+const warnedUnregisteredEpics = new Set();
+
 async function reconcile(state) {
   // Defence in depth — tickQueue already gates on this, but reconcile is the
   // function that would do the damage (every unmatched PRD .md becomes a
@@ -1163,8 +1168,54 @@ async function reconcile(state) {
   // for them (that row already exists, durably, in history.jsonl).
   const historyArchiveCandidates = [];
 
+  // Cache active-index.json reads per cwd across this reconcile pass — many
+  // unmatched PRDs typically share a project, and readActiveIndex is a
+  // synchronous fs.readFileSync.
+  const epicStatusCache = new Map(); // cwd -> { sessions }
+  function epicStatus(cwd, epicId) {
+    if (!cwd || !epicId) return null;
+    let idx = epicStatusCache.get(cwd);
+    if (!idx) {
+      idx = readActiveIndex(cwd);
+      epicStatusCache.set(cwd, idx);
+    }
+    return idx.sessions[epicId]?.status ?? null;
+  }
+
   for (const [slug, p] of onDisk) {
     if (seen.has(slug)) continue;
+    // Security gate: a PRD's file location IS its Epic membership
+    // (prdLocations.deriveEpicIdFromPrdPath / p.epicId). Before this check,
+    // the scheduler queued ANY .md file it found under an Epic's prds/ dir
+    // regardless of that Epic's status or even whether it was ever properly
+    // minted — so a PRD filed under a 'proposed' Epic (agent-proposed,
+    // awaiting human Approve & start via EpicApprovalBar), or one dropped
+    // straight onto disk under a directory that was never registered via
+    // ensureEpic()/active-index.json at all (bypassing the app entirely),
+    // would still execute as a claude -p job with --dangerously-skip-permissions.
+    // Block ONLY an explicit 'proposed' — the actual human gate. The human's
+    // Approve action flips status to 'active' (state/promptSessions.ts) and
+    // the very next reconcile pass picks the PRD up with no other change.
+    //
+    // This deliberately does NOT require a positive 'active' registration.
+    // That stricter form shipped briefly and caused a 6-hour silent outage
+    // (2026-08-01): 23 real PRDs whose Epic dir existed on disk but had no
+    // active-index.json entry were skipped forever with no log line, so the
+    // scheduler looked simply dead. Absence of an entry is not evidence of a
+    // rogue writer — an Epic archived on completion also leaves active-index,
+    // and other paths can create the dir without registering it. Fail-closed
+    // is right for the approval gate; it is wrong as a blanket requirement,
+    // because the failure mode is invisible and unrecoverable by the user.
+    const ownerStatus = epicStatus(p.cwd, p.epicId);
+    if (p.epicId && ownerStatus === 'proposed') {
+      continue;
+    }
+    // Unregistered Epic dir: allowed, but never silently — this is the only
+    // signal that a PRD's Epic is missing from the index it should be in.
+    if (p.epicId && ownerStatus === null && !warnedUnregisteredEpics.has(p.epicId)) {
+      warnedUnregisteredEpics.add(p.epicId);
+      console.warn(`[scheduler] epic ${p.epicId} (${p.cwd}) has PRDs on disk but no active-index.json entry — queuing anyway; register or archive it to silence this`);
+    }
     const hist = historyBySlug.get(slug);
     if (hist) {
       if (hist.status === 'completed') {