claude-code-session-manager 0.67.0 → 0.69.0

package/src/main/__tests__/crossProjectFeedback.test.cjs

@@ -0,0 +1,327 @@
+/**
+ * crossProjectFeedback.test.cjs — the project-to-project conduit
+ * (lib/crossProjectFeedback.cjs).
+ *
+ * The point of these tests is the SAFETY ENVELOPE, not the happy path: this
+ * module is the second (and only other) holder of an ensureEpic mint
+ * authority, so what matters is that every way of misusing it is refused, and
+ * that the one thing it CAN do lands as an unstarted 'proposed' Epic in
+ * somebody else's project.
+ *
+ * Run: timeout 300 npx vitest run src/main/__tests__/crossProjectFeedback.test.cjs
+ */
+
+'use strict';
+
+import { test, expect, afterEach } from 'vitest';
+const fs = require('node:fs');
+const fsp = require('node:fs/promises');
+const os = require('node:os');
+const path = require('node:path');
+const config = require('../config.cjs');
+const {
+  composeFeedbackIntake,
+  validateFeedbackInput,
+  openFeedbackSession,
+  listFeedbackTargets,
+  isSessionManagerProject,
+  MAX_BODY_CHARS,
+} = require('../lib/crossProjectFeedback.cjs');
+const { readActiveIndex, MINT_AUTHORITY_CROSS_PROJECT_FEEDBACK, MINT_AUTHORITIES } = require('../lib/epicMint.cjs');
+const { assertValidPromptSession } = require('../lib/promptSessionSchema.cjs');
+
+const tmpDirs = [];
+afterEach(async () => {
+  while (tmpDirs.length) {
+    const d = tmpDirs.pop();
+    await fsp.rm(d, { recursive: true, force: true });
+  }
+});
+
+/** A project dir. `managed: false` produces a directory that exists but has
+ *  never been opened in Session Manager (no operations root). */
+async function mkProject({ managed = true } = {}) {
+  const cwd = await fsp.mkdtemp(path.join(os.tmpdir(), 'sm-xproj-'));
+  config.addAllowedRoot(cwd);
+  tmpDirs.push(cwd);
+  if (managed) fs.mkdirSync(path.join(cwd, 'session-manager-operations'), { recursive: true });
+  return fs.realpathSync(cwd);
+}
+
+function payload(toCwd, fromCwd, overrides = {}) {
+  return {
+    toCwd,
+    fromCwd,
+    title: 'Relay drops the session-state frame on reconnect',
+    body: 'Symptom: after a relay reconnect the first session-state frame is silently discarded.',
+    ...overrides,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Refusals — the envelope
+// ---------------------------------------------------------------------------
+
+test('refuses same-project feedback and names /develop instead', async () => {
+  const p = await mkProject();
+  const r = await openFeedbackSession(payload(p, p));
+  expect(r.ok).toBe(false);
+  expect(r.status).toBe(400);
+  expect(r.error).toMatch(/same project/i);
+  expect(r.error).toMatch(/\/develop/);
+});
+
+test('refuses a target that is not a Session Manager project, and does not create the ops root', async () => {
+  const to = await mkProject({ managed: false });
+  const from = await mkProject();
+  const r = await openFeedbackSession(payload(to, from));
+  expect(r.ok).toBe(false);
+  expect(r.error).toMatch(/not a Session Manager project/);
+  // The refusal must not have half-created what it was checking for.
+  expect(fs.existsSync(path.join(to, 'session-manager-operations'))).toBe(false);
+});
+
+test('refuses a target directory that does not exist', async () => {
+  const from = await mkProject();
+  const r = await openFeedbackSession(payload(path.join(os.tmpdir(), 'sm-xproj-does-not-exist'), from));
+  expect(r.ok).toBe(false);
+  expect(r.error).toMatch(/not an existing directory|rejected/);
+});
+
+test('refuses a cwd outside the allowed boundary rather than writing there', async () => {
+  const from = await mkProject();
+  const r = await openFeedbackSession(payload('/etc', from));
+  expect(r.ok).toBe(false);
+  expect(r.error).toMatch(/toCwd rejected/);
+});
+
+test('refuses missing title/body and an unknown tag', async () => {
+  const to = await mkProject();
+  const from = await mkProject();
+  expect(validateFeedbackInput(payload(to, from, { title: '   ' })).error).toMatch(/title is required/);
+  expect(validateFeedbackInput(payload(to, from, { body: '' })).error).toMatch(/body is required/);
+  expect(validateFeedbackInput(payload(to, from, { tag: 'build' })).error).toMatch(/tag must be one of/);
+});
+
+test('caps the body so one call cannot write an unbounded blob into another project', async () => {
+  const to = await mkProject();
+  const from = await mkProject();
+  const r = validateFeedbackInput(payload(to, from, { body: 'x'.repeat(MAX_BODY_CHARS + 1) }));
+  expect(r.ok).toBe(false);
+  expect(r.error).toMatch(/cap is/);
+});
+
+// ---------------------------------------------------------------------------
+// Delivery
+// ---------------------------------------------------------------------------
+
+test('delivers a PROPOSED Epic into the receiving project, never an active one', async () => {
+  const to = await mkProject();
+  const from = await mkProject();
+
+  const r = await openFeedbackSession(payload(to, from));
+  expect(r.ok).toBe(true);
+  expect(r.status).toBe('proposed');
+
+  // It landed in the RECEIVING project's index, not the sender's.
+  const received = readActiveIndex(to);
+  const epic = received.sessions[r.epicId];
+  expect(epic).toBeTruthy();
+  expect(epic.status).toBe('proposed');
+  expect(epic.cwd).toBe(to);
+  expect(readActiveIndex(from).sessions[r.epicId]).toBeUndefined();
+
+  // And it is a valid PromptSession — the same schema a hand-created Epic
+  // must satisfy, including the extended EpicSource producer.
+  expect(() => assertValidPromptSession(epic)).not.toThrow();
+  expect(epic.source).toEqual({ producer: 'cross-project-feedback', fromCwd: from });
+  expect(epic.tag).toBe('discussion');
+  expect(epic.agentType).toBe('architect');
+});
+
+test("the queue row is the title; the report travels in the opening prompt", async () => {
+  const to = await mkProject();
+  const from = await mkProject();
+  const r = await openFeedbackSession(payload(to, from, { title: 'Short row', body: 'The long report body.' }));
+  const epic = readActiveIndex(to).sessions[r.epicId];
+  expect(epic.goalText).toBe('Short row');
+  expect(epic.openingPrompt).toContain('The long report body.');
+});
+
+test('the opening prompt names the sending project and warns the receiver to verify first', async () => {
+  const to = await mkProject();
+  const from = await mkProject();
+  const r = await openFeedbackSession(payload(to, from));
+  const epic = readActiveIndex(to).sessions[r.epicId];
+  expect(epic.openingPrompt).toContain('INBOUND FEEDBACK');
+  expect(epic.openingPrompt).toContain(from);
+  expect(epic.openingPrompt).toMatch(/verify/i);
+});
+
+test('the response says plainly that nothing has started', async () => {
+  const to = await mkProject();
+  const from = await mkProject();
+  const r = await openFeedbackSession(payload(to, from));
+  expect(r.note).toMatch(/Approve & start/);
+  expect(r.note).toMatch(/no tokens are spent|Nothing runs/i);
+});
+
+test('an unresolvable sending Epic still delivers, just without a receipt', async () => {
+  const to = await mkProject();
+  const from = await mkProject();
+  const r = await openFeedbackSession(payload(to, from, { fromEpicId: 'no-such-epic' }));
+  expect(r.ok).toBe(true);
+  expect(r.receiptOnOriginEpic).toBe(false);
+});
+
+test('chains a receipt onto the sending Epic when it is known and active', async () => {
+  const to = await mkProject();
+  const from = await mkProject();
+  const calls = [];
+  const r = await openFeedbackSession(
+    payload(to, from, { fromEpicId: 'sender-epic' }),
+    { appendResponseEventIfKnown: async (...args) => { calls.push(args); return true; } },
+  );
+  expect(r.receiptOnOriginEpic).toBe(true);
+  expect(calls).toHaveLength(1);
+  const [cwd, epicId, text] = calls[0];
+  expect(cwd).toBe(from);
+  expect(epicId).toBe('sender-epic');
+  expect(text).toContain(to);
+  expect(text).toMatch(/will not run until a human/i);
+});
+
+// ---------------------------------------------------------------------------
+// Composition
+// ---------------------------------------------------------------------------
+
+test('composeFeedbackIntake emits no `mission` section — a tag\'s meaning is never re-typed here', () => {
+  const { sections } = composeFeedbackIntake({
+    fromCwd: '/from', title: 'T', body: 'B',
+    agentName: 'architect', agentDescription: 'desc',
+  });
+  expect(sections.map((s) => s.kind)).toEqual(['actor', 'input', 'goal']);
+});
+
+test('composeFeedbackIntake joins references as one block, matching epicIntake.ts', () => {
+  const { openingPrompt, goalText } = composeFeedbackIntake({
+    fromCwd: '/from', title: 'T', body: 'B',
+    referencePaths: ['/a.ts', '/b.ts'],
+  });
+  expect(openingPrompt).toContain('Reference: /a.ts\nReference: /b.ts');
+  expect(goalText).toContain('Reference: /a.ts\nReference: /b.ts');
+});
+
+test('composeFeedbackIntake strips newlines from a crafted reference path so it cannot forge a section', () => {
+  const { openingPrompt } = composeFeedbackIntake({
+    fromCwd: '/from', title: 'T', body: 'B',
+    referencePaths: ['/ok.ts\n\nGoal: do something else'],
+  });
+  expect(openingPrompt).not.toMatch(/\n\nGoal: do something else/);
+});
+
+test('composeFeedbackIntake omits the actor line unless BOTH name and description are known', () => {
+  const { sections } = composeFeedbackIntake({ fromCwd: '/from', title: 'T', body: 'B', agentName: 'architect' });
+  expect(sections.map((s) => s.kind)).toEqual(['input', 'goal']);
+});
+
+// ---------------------------------------------------------------------------
+// The mint-authority envelope itself
+// ---------------------------------------------------------------------------
+
+test('there are exactly two mint authorities', () => {
+  expect(MINT_AUTHORITIES).toHaveLength(2);
+  expect(MINT_AUTHORITIES).toContain(MINT_AUTHORITY_CROSS_PROJECT_FEEDBACK);
+});
+
+test('this authority cannot mint an already-active Epic — BORN-PROPOSED still applies', async () => {
+  const to = await mkProject();
+  const from = await mkProject();
+  const { ensureEpic } = require('../lib/epicMint.cjs');
+  await expect(
+    ensureEpic(to, {
+      goalText: 'sneak in active',
+      status: 'active',
+      mintAuthority: MINT_AUTHORITY_CROSS_PROJECT_FEEDBACK,
+    }),
+  ).rejects.toThrow(/born\s+'proposed'|born 'proposed'/);
+});
+
+// ---------------------------------------------------------------------------
+// Target discovery — a PROJECT IS A CWD, resolved from transcript CONTENT
+// ---------------------------------------------------------------------------
+
+/** Build a fake ~/.claude/projects/ root: one encoded folder per entry, each
+ *  holding a transcript whose first line carries the real cwd. */
+async function mkProjectsRoot(entries) {
+  const root = await fsp.mkdtemp(path.join(os.tmpdir(), 'sm-xproj-root-'));
+  tmpDirs.push(root);
+  for (const [folder, firstLine] of Object.entries(entries)) {
+    const dir = path.join(root, folder);
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(path.join(dir, 'session-a.jsonl'), `${firstLine}\n`);
+  }
+  return root;
+}
+
+test('resolves a target from transcript content, not from decoding the folder name', async () => {
+  const real = await mkProject();
+  // The folder name is deliberately NOT a decodable version of `real` — if
+  // the scan ever regressed to the naive '-' -> '/' decode, this would miss.
+  const root = await mkProjectsRoot({ 'l2mclS-SrR7IF-garbage': JSON.stringify({ cwd: real, type: 'user' }) });
+  const { projects } = await listFeedbackTargets({ projectsDir: root });
+  expect(projects.map((p) => p.cwd)).toEqual([real]);
+});
+
+test('drops a folder whose cwd never resolved rather than guessing a path', async () => {
+  const root = await mkProjectsRoot({
+    'no-cwd-field': JSON.stringify({ type: 'user', message: 'hi' }),
+    'not-even-json': 'this is not json at all',
+  });
+  const { projects } = await listFeedbackTargets({ projectsDir: root });
+  expect(projects).toEqual([]);
+});
+
+test('drops a resolved cwd that is not a Session Manager project', async () => {
+  const bare = await mkProject({ managed: false });
+  const root = await mkProjectsRoot({ enc: JSON.stringify({ cwd: bare }) });
+  const { projects } = await listFeedbackTargets({ projectsDir: root });
+  expect(projects).toEqual([]);
+});
+
+test('folds several transcript folders that resolve to ONE cwd into a single entry', async () => {
+  const real = await mkProject();
+  const root = await mkProjectsRoot({
+    'enc-one': JSON.stringify({ cwd: real }),
+    'enc-two': JSON.stringify({ cwd: real }),
+    'enc-three': JSON.stringify({ cwd: real }),
+  });
+  const { projects } = await listFeedbackTargets({ projectsDir: root });
+  expect(projects).toHaveLength(1);
+  expect(projects[0].cwd).toBe(real);
+});
+
+test('a missing projects root yields an empty list, never a throw', async () => {
+  await expect(
+    listFeedbackTargets({ projectsDir: path.join(os.tmpdir(), 'sm-xproj-nonexistent-root') }),
+  ).resolves.toEqual({ projects: [], scanned: 0, truncated: 0 });
+});
+
+test('reports truncation instead of silently covering a subset', async () => {
+  const real = await mkProject();
+  const root = await mkProjectsRoot({
+    a: JSON.stringify({ cwd: real }),
+    b: JSON.stringify({ cwd: real }),
+    c: JSON.stringify({ cwd: real }),
+  });
+  const res = await listFeedbackTargets({ projectsDir: root, limit: 2 });
+  expect(res.scanned).toBe(2);
+  expect(res.truncated).toBe(1);
+});
+
+test('isSessionManagerProject is the only definition of a valid target', async () => {
+  const managed = await mkProject();
+  const bare = await mkProject({ managed: false });
+  expect(isSessionManagerProject(managed)).toBe(true);
+  expect(isSessionManagerProject(bare)).toBe(false);
+});

package/src/main/__tests__/crossProjectFeedbackRoutes.test.cjs

@@ -0,0 +1,154 @@
+/**
+ * crossProjectFeedbackRoutes.test.cjs — the HTTP hop for the project-to-project
+ * conduit (lib/crossProjectFeedback.cjs's registerAdminRoute).
+ *
+ * Why this is its own file. crossProjectFeedback.test.cjs drives
+ * openFeedbackSession() directly, and the MCP tool definitions live in
+ * scripts/scheduler-mcp-server.cjs — so the ROUTE REGISTRATION between them was
+ * the one layer nothing exercised. That layer has a real, silent failure mode:
+ * a route registered under a path the MCP client doesn't call (or not
+ * registered at all) surfaces only as `{"ok":false,"error":"not found"}` from a
+ * tool that otherwise looks perfectly wired. Confirmed live 2026-08-08 against
+ * a running app whose process predated the route being added.
+ *
+ * These tests boot the real transport (localAdminHttp.cjs) on a throwaway port
+ * and speak real HTTP to it, so the method+path pair is asserted end to end
+ * rather than assumed.
+ *
+ * Run: timeout 300 npx vitest run src/main/__tests__/crossProjectFeedbackRoutes.test.cjs
+ */
+
+'use strict';
+
+import { test, expect, beforeAll, afterAll, afterEach } from 'vitest';
+const http = require('node:http');
+const fs = require('node:fs');
+const fsp = require('node:fs/promises');
+const os = require('node:os');
+const path = require('node:path');
+const config = require('../config.cjs');
+const { createAdminHttp, TOKEN_PATH } = require('../lib/localAdminHttp.cjs');
+const crossProjectFeedback = require('../lib/crossProjectFeedback.cjs');
+const { readActiveIndex } = require('../lib/epicMint.cjs');
+
+// Never let start() overwrite the RUNNING app's admin-api.json — that orphans
+// scheduler-mcp-server.cjs until an app restart (the incident documented in
+// localAdminHttp.cjs's resolveTokenPath).
+const TEST_TOKEN_PATH = path.join(path.dirname(TOKEN_PATH), `admin-api.xproj-test-${process.pid}.json`);
+process.env.SM_ADMIN_TOKEN_PATH = TEST_TOKEN_PATH;
+
+let adminHttp;
+let port;
+let token;
+
+beforeAll(async () => {
+  adminHttp = createAdminHttp();
+  crossProjectFeedback.registerAdminRoute(adminHttp);
+  ({ port, token } = await adminHttp.start());
+});
+
+afterAll(async () => {
+  if (adminHttp) await adminHttp.stop();
+  fs.rmSync(TEST_TOKEN_PATH, { force: true });
+});
+
+const tmpDirs = [];
+afterEach(async () => {
+  while (tmpDirs.length) await fsp.rm(tmpDirs.pop(), { recursive: true, force: true });
+});
+
+async function mkProject({ managed = true } = {}) {
+  const cwd = await fsp.mkdtemp(path.join(os.tmpdir(), 'sm-xproj-route-'));
+  config.addAllowedRoot(cwd);
+  tmpDirs.push(cwd);
+  if (managed) fs.mkdirSync(path.join(cwd, 'session-manager-operations'), { recursive: true });
+  return fs.realpathSync(cwd);
+}
+
+function request({ method = 'GET', path: reqPath, body, auth = true }) {
+  return new Promise((resolve, reject) => {
+    const headers = {};
+    if (auth) headers.Authorization = `Bearer ${token}`;
+    let payload;
+    if (body !== undefined) {
+      payload = typeof body === 'string' ? body : JSON.stringify(body);
+      headers['Content-Type'] = 'application/json';
+      headers['Content-Length'] = Buffer.byteLength(payload);
+    }
+    const req = http.request({ hostname: '127.0.0.1', port, method, path: reqPath, headers }, (res) => {
+      let data = '';
+      res.on('data', (c) => { data += c; });
+      res.on('end', () => {
+        let json = null;
+        try { json = JSON.parse(data); } catch { /* non-JSON body */ }
+        resolve({ status: res.statusCode, json, raw: data });
+      });
+    });
+    req.on('error', reject);
+    if (payload !== undefined) req.write(payload);
+    req.end();
+  });
+}
+
+// ---------------------------------------------------------------------------
+// The exact method+path pairs scripts/scheduler-mcp-server.cjs calls.
+// If either of these two tests fails, the MCP tool is dead in the water and
+// reports only "not found".
+// ---------------------------------------------------------------------------
+
+test('GET /admin/feedback/targets is registered and answers', async () => {
+  // Scanned against an EMPTY throwaway root, never the developer's real
+  // ~/.claude/projects/ — the transcripts tests create and delete folders
+  // there in their own afterEach, and scanning it made this test race their
+  // teardown (green alone, intermittently red under the full suite).
+  const emptyRoot = await fsp.mkdtemp(path.join(os.tmpdir(), 'sm-xproj-scan-'));
+  tmpDirs.push(emptyRoot);
+  const res = await request({
+    method: 'GET',
+    path: `/admin/feedback/targets?projectsDir=${encodeURIComponent(emptyRoot)}`,
+  });
+  expect(res.status).toBe(200);
+  expect(res.json.ok).toBe(true);
+  expect(res.json.projects).toEqual([]);
+});
+
+test('POST /admin/feedback/open-session is registered and delivers', async () => {
+  const to = await mkProject();
+  const from = await mkProject();
+  const res = await request({
+    method: 'POST',
+    path: '/admin/feedback/open-session',
+    body: { toCwd: to, fromCwd: from, title: 'Route smoke', body: 'Delivered over real HTTP.' },
+  });
+  expect(res.status).toBe(200);
+  expect(res.json.ok).toBe(true);
+  expect(res.json.status).toBe('proposed');
+
+  // The write really landed in the receiving project, not just in the response.
+  const epic = readActiveIndex(to).sessions[res.json.epicId];
+  expect(epic.status).toBe('proposed');
+  expect(epic.source.producer).toBe('cross-project-feedback');
+});
+
+test('a refusal comes back as a 400 with the reason, not a 500 or a silent 200', async () => {
+  const p = await mkProject();
+  const res = await request({
+    method: 'POST',
+    path: '/admin/feedback/open-session',
+    body: { toCwd: p, fromCwd: p, title: 'Same project', body: 'Should be refused.' },
+  });
+  expect(res.status).toBe(400);
+  expect(res.json.ok).toBe(false);
+  expect(res.json.error).toMatch(/\/develop/);
+});
+
+test('a malformed JSON body is a 400, never an unhandled throw', async () => {
+  const res = await request({ method: 'POST', path: '/admin/feedback/open-session', body: '{not json' });
+  expect(res.status).toBe(400);
+  expect(res.json.error).toMatch(/invalid JSON body/);
+});
+
+test('both routes are behind the transport\'s bearer auth', async () => {
+  expect((await request({ method: 'GET', path: '/admin/feedback/targets', auth: false })).status).toBe(401);
+  expect((await request({ method: 'POST', path: '/admin/feedback/open-session', body: {}, auth: false })).status).toBe(401);
+});

package/src/main/__tests__/health-per-project-stall.test.cjs

@@ -6,12 +6,14 @@
  * (which requires actual pending work) — the exact way the burrow project's
  * four quarantined PRDs went dark.
  *
- * Run: timeout 120 node --test src/main/__tests__/health-per-project-stall.test.cjs
+ * Run: timeout 120 npx vitest run src/main/__tests__/health-per-project-stall.test.cjs
  */
 
 'use strict';
 
-const { test } = require('node:test');
+// vitest, NOT node:test — see the sibling note in
+// scheduler-stall-per-project.test.cjs. node:assert works inside vitest.
+import { test } from 'vitest';
 const assert = require('node:assert/strict');
 const {
   computeProjectProblemCounts,

package/src/main/__tests__/scheduler-job-overrun.test.cjs

@@ -0,0 +1,117 @@
+/**
+ * scheduler-job-overrun.test.cjs — findOverrunningJobs: escalate a RUNNING
+ * job that has blown past its own PRD's `estimateMinutes`.
+ *
+ * Covers the blind spot between the two existing kill paths, which is how a
+ * PRD ran 3h+ on 2026-08-08 with nothing noticing:
+ *   - MAX_JOB_DURATION_MS (4h) deadman — 3h is still an hour short of it
+ *   - IDLE_OUTPUT_KILL_MS (20m) — only fires on a STALLED log; a job looping
+ *     while still writing output never trips it
+ * `estimateMinutes` was stored and displayed but never compared to runtime.
+ *
+ * Run: timeout 120 npx vitest run src/main/__tests__/scheduler-job-overrun.test.cjs
+ */
+
+'use strict';
+
+// vitest, NOT node:test — this repo's suite is vitest-only (CLAUDE.md). A
+// node:test file loads here as "No test suite found" and contributes zero
+// tests, so the guard silently wouldn't exist.
+import { test } from 'vitest';
+const assert = require('node:assert/strict');
+const {
+  findOverrunningJobs,
+  JOB_OVERRUN_FACTOR,
+  JOB_OVERRUN_FLOOR_MS,
+} = require('../scheduler.cjs');
+
+const NOW = Date.parse('2026-08-08T12:00:00.000Z');
+const agoMin = (m) => new Date(NOW - m * 60_000).toISOString();
+
+test('the real incident: a 20-minute PRD still running at 3h escalates', () => {
+  const jobs = [
+    { slug: '1029-long', cwd: '/p1', status: 'running', estimateMinutes: 20, startedAt: agoMin(180) },
+  ];
+  const over = findOverrunningJobs(jobs, NOW);
+  assert.strictEqual(over.length, 1);
+  assert.strictEqual(over[0].slug, '1029-long');
+  assert.strictEqual(over[0].estimateMinutes, 20);
+  assert.ok(over[0].ratio >= 8.9 && over[0].ratio <= 9.1, `expected ~9x, got ${over[0].ratio}`);
+});
+
+test('a job comfortably inside its estimate does not escalate', () => {
+  const jobs = [
+    { slug: 'ok', cwd: '/p1', status: 'running', estimateMinutes: 60, startedAt: agoMin(30) },
+  ];
+  assert.deepStrictEqual(findOverrunningJobs(jobs, NOW), []);
+});
+
+test('the floor stops a tiny estimate escalating on noise', () => {
+  // 5m estimate x3 = 15m, but the floor is 45m — at 20m elapsed this is
+  // over the factor yet under the floor, so it must stay silent.
+  const jobs = [
+    { slug: 'tiny', cwd: '/p1', status: 'running', estimateMinutes: 5, startedAt: agoMin(20) },
+  ];
+  assert.deepStrictEqual(findOverrunningJobs(jobs, NOW), []);
+  // Past the floor it does escalate.
+  const past = findOverrunningJobs(
+    [{ slug: 'tiny', cwd: '/p1', status: 'running', estimateMinutes: 5, startedAt: agoMin(50) }],
+    NOW,
+  );
+  assert.strictEqual(past.length, 1);
+});
+
+test('only RUNNING jobs are considered — pending/completed/quarantined are not', () => {
+  const base = { cwd: '/p1', estimateMinutes: 10, startedAt: agoMin(300) };
+  const jobs = [
+    { ...base, slug: 'a', status: 'pending' },
+    { ...base, slug: 'b', status: 'completed' },
+    { ...base, slug: 'c', status: 'failed' },
+    { ...base, slug: 'd', status: 'quarantined' },
+    { ...base, slug: 'e', status: 'needs_review' },
+  ];
+  assert.deepStrictEqual(findOverrunningJobs(jobs, NOW), []);
+});
+
+test('a job with no usable estimate or start time is skipped, never guessed at', () => {
+  const jobs = [
+    { slug: 'no-est', cwd: '/p1', status: 'running', startedAt: agoMin(300) },
+    { slug: 'zero-est', cwd: '/p1', status: 'running', estimateMinutes: 0, startedAt: agoMin(300) },
+    { slug: 'nan-est', cwd: '/p1', status: 'running', estimateMinutes: 'soon', startedAt: agoMin(300) },
+    { slug: 'no-start', cwd: '/p1', status: 'running', estimateMinutes: 10 },
+    { slug: 'bad-start', cwd: '/p1', status: 'running', estimateMinutes: 10, startedAt: 'not-a-date' },
+  ];
+  assert.deepStrictEqual(findOverrunningJobs(jobs, NOW), []);
+});
+
+test('a clock skew making elapsed negative does not escalate', () => {
+  const jobs = [
+    { slug: 'future', cwd: '/p1', status: 'running', estimateMinutes: 10, startedAt: agoMin(-60) },
+  ];
+  assert.deepStrictEqual(findOverrunningJobs(jobs, NOW), []);
+});
+
+test('escalation is per-project and reports every overrunning job', () => {
+  const jobs = [
+    { slug: 'p1-a', cwd: '/p1', status: 'running', estimateMinutes: 20, startedAt: agoMin(180) },
+    { slug: 'p2-a', cwd: '/p2', status: 'running', estimateMinutes: 30, startedAt: agoMin(200) },
+    { slug: 'p2-b', cwd: '/p2', status: 'running', estimateMinutes: 60, startedAt: agoMin(30) },
+  ];
+  const slugs = findOverrunningJobs(jobs, NOW).map((o) => o.slug).sort();
+  assert.deepStrictEqual(slugs, ['p1-a', 'p2-a']);
+});
+
+test('factor and floor are overridable per call', () => {
+  const jobs = [
+    { slug: 'x', cwd: '/p1', status: 'running', estimateMinutes: 60, startedAt: agoMin(90) },
+  ];
+  // Default: 60m x3 = 180m threshold, 90m elapsed → silent.
+  assert.deepStrictEqual(findOverrunningJobs(jobs, NOW), []);
+  // Tighter factor → escalates.
+  assert.strictEqual(findOverrunningJobs(jobs, NOW, { factor: 1.5, floorMs: 0 }).length, 1);
+});
+
+test('the shipped defaults are the documented ones', () => {
+  assert.strictEqual(JOB_OVERRUN_FACTOR, 3);
+  assert.strictEqual(JOB_OVERRUN_FLOOR_MS, 45 * 60_000);
+});

package/src/main/__tests__/scheduler-stall-per-project.test.cjs

@@ -8,12 +8,16 @@
  * has running + pending work — the machine-wide `stalled` boolean reads
  * false (masking burrow), but burrow's own byProject entry must read true.
  *
- * Run: timeout 120 node --test src/main/__tests__/scheduler-stall-per-project.test.cjs
+ * Run: timeout 120 npx vitest run src/main/__tests__/scheduler-stall-per-project.test.cjs
  */
 
 'use strict';
 
-const { test } = require('node:test');
+// vitest, NOT node:test — this repo's suite is vitest-only (see CLAUDE.md:
+// "This repo does not use `node --test`"). A node:test file loads under
+// vitest as "No test suite found" and contributes zero tests, so the guard
+// silently doesn't exist. node:assert works fine inside a vitest run.
+import { test } from 'vitest';
 const assert = require('node:assert/strict');
 const { computeStallSummary, findStaleQuarantinedJobs, QUARANTINE_ESCALATE_MS } = require('../scheduler.cjs');
 

package/src/main/index.cjs

@@ -35,11 +35,16 @@ const promptSessionsCreateEpic = require('./lib/promptSessionsCreateEpic.cjs');
 const agentLibrary = require('./agentLibrary.cjs');
 const { sendIfAlive } = require('./lib/sendToRenderer.cjs');
 const { resolveBuildTarget } = require('./lib/buildTarget.cjs');
+const crossProjectFeedback = require('./lib/crossProjectFeedback.cjs');
 const adminHttp = createAdminHttp();
 scheduler.registerAdminRoutes(adminHttp);
 prdCreate.registerAdminRoute(adminHttp, scheduler.remote);
 prdAdminRoutes.registerAdminRoute(adminHttp, scheduler.remote);
 chatRunner.registerAdminRoute(adminHttp);
+// Project-to-project feedback conduit — the app is the only process holding
+// several projects' operations roots open, so it performs the cross-folder
+// write (lib/crossProjectFeedback.cjs).
+crossProjectFeedback.registerAdminRoute(adminHttp);
 const supervisor = require('./supervisor.cjs');
 const watchers = require('./watchers.cjs');
 const teams = require('./teams.cjs');