claude-code-session-manager 0.75.2 → 0.76.0

package/src/main/__tests__/scheduler-autofix-select.test.cjs

@@ -267,12 +267,18 @@ test('depth-1 (ordinary, no investigationDepth field) needs_review job is eligib
   assert.strictEqual(result.length, 1);
 });
 
-test('fix-plan job with investigationDepth: 2 is now ALSO eligible', () => {
-  const jobs = [makeJob({ slug: '05-fix-foo', investigationDepth: 2 })];
+test('fix-plan job with investigationDepth: 1 is still eligible (its first -fix follow-up)', () => {
+  const jobs = [makeJob({ slug: '05-fix-foo', investigationDepth: 1 })];
   const result = selectAutoFixTargets(jobs, { fixSlugExists: noSiblingOnDisk });
   assert.strictEqual(result.length, 1);
 });
 
+test('fix-plan job with investigationDepth: 2 is now NOT eligible (cap lowered to permit at most -fix-fix)', () => {
+  const jobs = [makeJob({ slug: '05-fix-foo', investigationDepth: 2 })];
+  const result = selectAutoFixTargets(jobs, { fixSlugExists: noSiblingOnDisk });
+  assert.strictEqual(result.length, 0);
+});
+
 test('fix-plan job with investigationDepth: 3 is NOT eligible (bound holds)', () => {
   const jobs = [makeJob({ slug: '05-fix-foo', investigationDepth: 3 })];
   const result = selectAutoFixTargets(jobs, { fixSlugExists: noSiblingOnDisk });
@@ -289,7 +295,7 @@ test('isFixPlanBeyondDepthCap: non-fix-plan slug is never capped regardless of d
   assert.strictEqual(isFixPlanBeyondDepthCap('05-my-feature', 99), false);
 });
 
-test('isFixPlanBeyondDepthCap: fix-plan at depth 1 or 2 is not capped, depth 3 is', () => {
+test('isFixPlanBeyondDepthCap: fix-plan at depth 1 is not capped, depth 2 is', () => {
   assert.strictEqual(isFixPlanBeyondDepthCap('05-fix-foo', 1), false);
   assert.strictEqual(isFixPlanBeyondDepthCap('05-fix-foo', MAX_INVESTIGATION_DEPTH), false);
   assert.strictEqual(isFixPlanBeyondDepthCap('05-fix-foo', MAX_INVESTIGATION_DEPTH + 1), true);
@@ -349,6 +355,12 @@ test('isEligibleForImmediateAutoFix: fix-plan job beyond the depth cap is exclud
   assert.strictEqual(result, false);
 });
 
+test('isEligibleForImmediateAutoFix: fix-plan job at investigationDepth 2 is now excluded (previously eligible under the old cap)', () => {
+  const job = makeJob({ slug: '05-fix-foo', investigationDepth: 2 });
+  const result = isEligibleForImmediateAutoFix(job, [job], noSiblingOnDisk);
+  assert.strictEqual(result, false);
+});
+
 test('isEligibleForImmediateAutoFix: a different job in the same queue does not affect this job\'s eligibility', () => {
   const job = makeJob();
   const other = { slug: '05-fix-my-feature', status: 'pending', runId: null };

package/src/main/__tests__/scheduler-commit-guard-noop.test.cjs

@@ -165,6 +165,47 @@ test('commitGuardVerdict: self-commit skip still works (regression check)', () =
   expect(verdict).toBeNull();
 });
 
+test('commitGuardVerdict: ranInWorktree=true defeats siblingRunning — clean tree, no self-commit → silent_no_op (PRD 109 shape)', () => {
+  const verdict = commitGuardVerdict({
+    newlyDirty: [],
+    siblingRunning: true,
+    ranInWorktree: true,
+    jobSelfCommitted: false,
+    legitimateNoOp: false,
+    isFixPlanJob: false,
+    verifyResult: null,
+  });
+  expect(verdict).not.toBeNull();
+  expect(verdict.verdict).toBe('silent_no_op');
+  expect(verdict.downgradeTo).toBe('needs_review');
+});
+
+test('commitGuardVerdict: identical inputs with ranInWorktree=false → no flag (legacy shared-tree behaviour unchanged)', () => {
+  const verdict = commitGuardVerdict({
+    newlyDirty: [],
+    siblingRunning: true,
+    ranInWorktree: false,
+    jobSelfCommitted: false,
+    legitimateNoOp: false,
+    isFixPlanJob: false,
+    verifyResult: null,
+  });
+  expect(verdict).toBeNull();
+});
+
+test('commitGuardVerdict: ranInWorktree=true + siblingRunning=true but jobSelfCommitted=true → no flag (self-commit carve-out still applies)', () => {
+  const verdict = commitGuardVerdict({
+    newlyDirty: [],
+    siblingRunning: true,
+    ranInWorktree: true,
+    jobSelfCommitted: true,
+    legitimateNoOp: false,
+    isFixPlanJob: false,
+    verifyResult: null,
+  });
+  expect(verdict).toBeNull();
+});
+
 test('commitGuardVerdict: carries forward a non-clean prior verdict as an annotation', () => {
   const verifyResult = {
     verdict: 'transcript_errors',

package/src/main/__tests__/scheduler-reap-dead-running-jobs.test.cjs

@@ -36,7 +36,8 @@ const path = require('node:path');
 const tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'reap-dead-running-jobs-test-'));
 process.env.HOME = tmpHome;
 
-const { reapDeadRunningJobs } = require('../scheduler.cjs');
+const { reapDeadRunningJobs, PIDLESS_SPAWN_GRACE_MS } = require('../scheduler.cjs');
+const { AUDIT_LOG_PATH } = require('../lib/auditLog.cjs');
 
 function registerActiveProject(cwd) {
   const projectsDir = path.join(tmpHome, '.claude', 'projects');
@@ -87,6 +88,64 @@ test('reapDeadRunningJobs reconciles a queue.json row stuck at status:running wi
   assert.equal(jobs[0].runtime, undefined);
 });
 
+test('reapDeadRunningJobs reaps a pidless row older than PIDLESS_SPAWN_GRACE_MS with an empty run dir as failed, not completed, and audits it', async () => {
+  const projectCwd = path.join(tmpHome, 'c-project');
+  fs.mkdirSync(projectCwd, { recursive: true });
+  registerActiveProject(projectCwd);
+
+  const staleStartedAt = new Date(Date.now() - PIDLESS_SPAWN_GRACE_MS - 60_000).toISOString();
+  const queuePath = writeProjectQueue(projectCwd, [
+    {
+      slug: 'pidless-zombie',
+      status: 'running',
+      cwd: projectCwd,
+      runId: 'run-pidless-zombie',
+      startedAt: staleStartedAt,
+      estimateMinutes: 24,
+      // no runtime key at all — the spawn never got far enough to record one
+    },
+  ]);
+  // Empty run dir: created, but never written to (the exact 2026-09-01 repro).
+  fs.mkdirSync(path.join(tmpHome, '.claude', 'session-manager', 'scheduled-plans', 'runs', 'run-pidless-zombie'), { recursive: true });
+
+  const auditSizeBefore = fs.existsSync(AUDIT_LOG_PATH) ? fs.statSync(AUDIT_LOG_PATH).size : 0;
+
+  await reapDeadRunningJobs();
+
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  assert.equal(jobs.length, 1);
+  assert.equal(jobs[0].status, 'failed', 'an empty run dir must never be reaped as completed');
+  assert.match(jobs[0].error, /no runtime\.pid recorded/);
+  assert.equal(jobs[0].runtime, undefined);
+
+  const auditText = fs.readFileSync(AUDIT_LOG_PATH, 'utf8').slice(auditSizeBefore);
+  const auditLines = auditText.trim().split('\n').filter(Boolean).map((l) => JSON.parse(l));
+  const pidlessEvent = auditLines.find((e) => e.kind === 'job_reaped_pidless' && e.slug === 'pidless-zombie');
+  assert.ok(pidlessEvent, 'reaping a pidless row must leave an audit trace');
+});
+
+test('reapDeadRunningJobs leaves a pidless row alone while it is still within the grace window', async () => {
+  const projectCwd = path.join(tmpHome, 'd-project');
+  fs.mkdirSync(projectCwd, { recursive: true });
+  registerActiveProject(projectCwd);
+
+  const freshStartedAt = new Date(Date.now() - 60_000).toISOString(); // 1 minute ago
+  const queuePath = writeProjectQueue(projectCwd, [
+    {
+      slug: 'mid-flight-spawn',
+      status: 'running',
+      cwd: projectCwd,
+      runId: 'run-mid-flight',
+      startedAt: freshStartedAt,
+    },
+  ]);
+
+  await reapDeadRunningJobs();
+
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  assert.equal(jobs[0].status, 'running', 'a genuinely mid-flight spawn must not be reaped');
+});
+
 test('reapDeadRunningJobs is a no-op when no job is actually running in queue.json', async () => {
   const projectCwd = path.join(tmpHome, 'b-project');
   fs.mkdirSync(projectCwd, { recursive: true });

package/src/main/__tests__/scheduler-stranded-investigation.test.cjs

@@ -0,0 +1,185 @@
+/**
+ * scheduler-stranded-investigation.test.cjs — findStrandedInvestigations: a
+ * job left 'investigating' with nothing to restore it once the process that
+ * spawned its probe is gone.
+ *
+ * spawnInvestigation's own restore (onExit / synchronous-throw catch) runs
+ * ONLY inside the live process that spawned the probe. An app restart (or
+ * crash) mid-probe leaves the row frozen at 'investigating' forever — the
+ * comment at spawnInvestigation's onExit already asserts "'investigating'
+ * must never be the job's resting state", but nothing enforced that across a
+ * restart. Live repro (burrow, 2026-09-01): 834-session-summary-... sat
+ * 'investigating' for 1653 minutes even though finishedAt+exitCode were
+ * already recorded 27h earlier.
+ *
+ * Run: timeout 120 npx vitest run src/main/__tests__/scheduler-stranded-investigation.test.cjs
+ */
+
+'use strict';
+
+// vitest, NOT node:test — this repo's suite is vitest-only (CLAUDE.md).
+import { test } from 'vitest';
+const assert = require('node:assert/strict');
+const { findStrandedInvestigations, INVESTIGATION_MAX_MS } = require('../scheduler.cjs');
+
+const NOW = Date.parse('2026-09-01T12:00:00.000Z');
+const agoMin = (m) => new Date(NOW - m * 60_000).toISOString();
+const neverAlive = () => false;
+const alwaysAlive = () => true;
+
+test('stranded past the window is selected, with the pre-probe status as restoreStatus', () => {
+  const jobs = [
+    {
+      slug: 'a',
+      cwd: '/p1',
+      status: 'investigating',
+      statusHistory: [
+        { from: 'failed', to: 'investigating', at: agoMin(120), reason: 'spawning investigation probe' },
+      ],
+    },
+  ];
+  const out = findStrandedInvestigations(jobs, NOW, INVESTIGATION_MAX_MS, neverAlive);
+  assert.strictEqual(out.length, 1);
+  assert.strictEqual(out[0].slug, 'a');
+  assert.strictEqual(out[0].restoreStatus, 'failed');
+  assert.ok(out[0].ageMs >= 119 * 60_000);
+});
+
+test('within the window is left alone — a live probe must not be yanked mid-flight', () => {
+  const jobs = [
+    {
+      slug: 'b',
+      cwd: '/p1',
+      status: 'investigating',
+      statusHistory: [{ from: 'needs_review', to: 'investigating', at: agoMin(10) }],
+    },
+  ];
+  assert.deepStrictEqual(findStrandedInvestigations(jobs, NOW, INVESTIGATION_MAX_MS, neverAlive), []);
+});
+
+test('a live probe process (pid alive) is never restored, even past the window', () => {
+  const jobs = [
+    {
+      slug: 'c',
+      cwd: '/p1',
+      status: 'investigating',
+      runtime: { pid: 4242 },
+      statusHistory: [{ from: 'failed', to: 'investigating', at: agoMin(120) }],
+    },
+  ];
+  assert.deepStrictEqual(findStrandedInvestigations(jobs, NOW, INVESTIGATION_MAX_MS, alwaysAlive), []);
+});
+
+test('a row with no runtime.pid past the window is still selected (dead-process default)', () => {
+  const jobs = [
+    {
+      slug: 'd',
+      cwd: '/p1',
+      status: 'investigating',
+      statusHistory: [{ from: 'failed', to: 'investigating', at: agoMin(120) }],
+    },
+  ];
+  const out = findStrandedInvestigations(jobs, NOW, INVESTIGATION_MAX_MS, alwaysAlive);
+  assert.strictEqual(out.length, 1);
+  assert.strictEqual(out[0].slug, 'd');
+});
+
+test('missing statusHistory transition is warn-logged and not restored — cannot prove age', () => {
+  const jobs = [{ slug: 'e', cwd: '/p1', status: 'investigating', statusHistory: [] }];
+  const warnSpy = [];
+  const origWarn = console.warn;
+  console.warn = (...args) => warnSpy.push(args.join(' '));
+  try {
+    const out = findStrandedInvestigations(jobs, NOW, INVESTIGATION_MAX_MS, neverAlive);
+    assert.deepStrictEqual(out, []);
+    assert.ok(warnSpy.some((line) => line.includes('e') && line.includes('no statusHistory entry')), `expected a warn mentioning slug 'e', got: ${JSON.stringify(warnSpy)}`);
+  } finally {
+    console.warn = origWarn;
+  }
+});
+
+test('unparseable transition timestamp is warn-logged and not restored', () => {
+  const jobs = [
+    {
+      slug: 'f',
+      cwd: '/p1',
+      status: 'investigating',
+      statusHistory: [{ from: 'failed', to: 'investigating', at: 'not-a-date' }],
+    },
+  ];
+  const warnSpy = [];
+  const origWarn = console.warn;
+  console.warn = (...args) => warnSpy.push(args.join(' '));
+  try {
+    const out = findStrandedInvestigations(jobs, NOW, INVESTIGATION_MAX_MS, neverAlive);
+    assert.deepStrictEqual(out, []);
+    assert.ok(warnSpy.some((line) => line.includes('f') && line.includes('unparseable')), `expected a warn mentioning slug 'f', got: ${JSON.stringify(warnSpy)}`);
+  } finally {
+    console.warn = origWarn;
+  }
+});
+
+test('the burrow-834 shape: finishedAt + non-null exitCode already recorded is restored using that recorded outcome, not re-run', () => {
+  const jobs = [
+    {
+      slug: '834-session-summary-reports-planner-intent-as-outcome',
+      cwd: '/home/bilko/Projects/burrow',
+      status: 'investigating',
+      finishedAt: '2026-08-31T15:13:15.181Z',
+      exitCode: 0,
+      error: 'is_error=true in final 20% of transcript (event 91/101)',
+      estimateMinutes: 60,
+      statusHistory: [
+        { from: 'needs_review', to: 'investigating', at: '2026-08-31T15:20:00.000Z', reason: 'spawning investigation probe' },
+      ],
+    },
+  ];
+  const out = findStrandedInvestigations(jobs, NOW, INVESTIGATION_MAX_MS, neverAlive);
+  assert.strictEqual(out.length, 1);
+  assert.strictEqual(out[0].restoreStatus, 'needs_review');
+  assert.ok(out[0].ageMs / 60_000 > 1200, `expected well past the 60m threshold, got ${out[0].ageMs / 60_000}m`);
+});
+
+test('only the most recent investigating transition is used when a job was investigated more than once', () => {
+  const jobs = [
+    {
+      slug: 'g',
+      cwd: '/p1',
+      status: 'investigating',
+      statusHistory: [
+        { from: 'failed', to: 'investigating', at: agoMin(500) },
+        { from: 'investigating', to: 'failed', at: agoMin(400) },
+        { from: 'failed', to: 'investigating', at: agoMin(10) }, // recent retry — still within the window
+      ],
+    },
+  ];
+  assert.deepStrictEqual(findStrandedInvestigations(jobs, NOW, INVESTIGATION_MAX_MS, neverAlive), []);
+});
+
+test('non-investigating rows are never considered', () => {
+  const base = { cwd: '/p1', statusHistory: [{ from: 'x', to: 'investigating', at: agoMin(500) }] };
+  const jobs = [
+    { ...base, slug: 'h', status: 'failed' },
+    { ...base, slug: 'i', status: 'running' },
+    { ...base, slug: 'j', status: 'needs_review' },
+  ];
+  assert.deepStrictEqual(findStrandedInvestigations(jobs, NOW, INVESTIGATION_MAX_MS, neverAlive), []);
+});
+
+test('a corrupted/illegal statusHistory `from` value falls back to failed rather than being handed to transitionJob unvalidated', () => {
+  const jobs = [
+    {
+      slug: 'k',
+      cwd: '/p1',
+      status: 'investigating',
+      statusHistory: [{ from: 'quarantined', to: 'investigating', at: agoMin(120) }],
+    },
+  ];
+  const out = findStrandedInvestigations(jobs, NOW, INVESTIGATION_MAX_MS, neverAlive);
+  assert.strictEqual(out.length, 1);
+  assert.strictEqual(out[0].restoreStatus, 'failed');
+});
+
+test('the shipped default is the documented one (60 minutes)', () => {
+  assert.strictEqual(INVESTIGATION_MAX_MS, 60 * 60_000);
+});

package/src/main/__tests__/seedSchedulerMcp.test.cjs

@@ -143,3 +143,69 @@ test('a failed attempt bumps the counter and stops after MAX_ATTEMPTS', async ()
   expect(called).toBe(false);
   expect(readMarker()).toMatchObject({ done: false, attempts: 3 });
 });
+
+// ─────────────────────────────── repair: marker done, script path stale
+
+test('marker done + user-scope script path missing -> removes then re-adds, marker stays done', async () => {
+  fs.mkdirSync(path.dirname(markerPath()), { recursive: true });
+  fs.writeFileSync(markerPath(), JSON.stringify({ done: true, attempts: 0, ts: '2026-01-01T00:00:00.000Z' }));
+  fs.writeFileSync(
+    claudeJsonPath(),
+    JSON.stringify({
+      mcpServers: {
+        'session-manager-scheduler': { type: 'stdio', command: 'node', args: ['/definitely/does/not/exist.cjs'] },
+      },
+    })
+  );
+
+  const removeCalls = [];
+  const removeFn = async () => { removeCalls.push(1); return { ok: true }; };
+  const addCalls = [];
+  const addFn = async (serverPath) => { addCalls.push(serverPath); return { ok: true, exitCode: 0 }; };
+
+  await seedSchedulerMcp({ logger: silentLogger(), addFn, removeFn });
+
+  expect(removeCalls).toHaveLength(1);
+  expect(addCalls).toHaveLength(1);
+  expect(path.isAbsolute(addCalls[0])).toBe(true);
+  expect(readMarker().done).toBe(true);
+});
+
+test('marker done + user-scope entry ABSENT (deliberate remove) stays removed, no repair attempted', async () => {
+  fs.mkdirSync(path.dirname(markerPath()), { recursive: true });
+  fs.writeFileSync(markerPath(), JSON.stringify({ done: true, attempts: 0, ts: '2026-01-01T00:00:00.000Z' }));
+  // No ~/.claude.json at all — same as a deliberate `claude mcp remove`.
+
+  let removeCalled = false;
+  let addCalled = false;
+  const removeFn = async () => { removeCalled = true; return { ok: true }; };
+  const addFn = async () => { addCalled = true; return { ok: true }; };
+
+  await seedSchedulerMcp({ logger: silentLogger(), addFn, removeFn });
+
+  expect(removeCalled).toBe(false);
+  expect(addCalled).toBe(false);
+});
+
+test('marker done + user-scope script path exists -> healthy, no repair attempted', async () => {
+  fs.mkdirSync(path.dirname(markerPath()), { recursive: true });
+  fs.writeFileSync(markerPath(), JSON.stringify({ done: true, attempts: 0, ts: '2026-01-01T00:00:00.000Z' }));
+  fs.writeFileSync(
+    claudeJsonPath(),
+    JSON.stringify({
+      mcpServers: {
+        'session-manager-scheduler': { type: 'stdio', command: 'node', args: [markerPath()] }, // any existing file
+      },
+    })
+  );
+
+  let removeCalled = false;
+  let addCalled = false;
+  const removeFn = async () => { removeCalled = true; return { ok: true }; };
+  const addFn = async () => { addCalled = true; return { ok: true }; };
+
+  await seedSchedulerMcp({ logger: silentLogger(), addFn, removeFn });
+
+  expect(removeCalled).toBe(false);
+  expect(addCalled).toBe(false);
+});

package/src/main/__tests__/uniquePrdNumbers.test.cjs

@@ -101,11 +101,20 @@ describe('pickForProject dependsOn eligibility (PRD 832)', () => {
   // like anything else with no blocking dependsOn — the 828 row is no longer
   // held back merely for carrying a higher number.
   it('legacy same-NN pending jobs are eligible alongside higher-numbered ones', () => {
-    const a = job('827-one', 'pending', 827);
-    const b = job('827-two', 'pending', 827);
-    const later = job('828-three', 'pending', 828);
-    const res = pickForProject([a, b, later], new Set(), 3);
-    expect(res.batch.map((j) => j.slug).sort()).toEqual(['827-one', '827-two', '828-three']);
+    // Predates the per-project job cap (PRD 1066, default 2); raise it so
+    // this test keeps exercising parallelGroup semantics, not the cap.
+    const prevCap = process.env.SM_PROJECT_JOB_CAP;
+    process.env.SM_PROJECT_JOB_CAP = '10';
+    try {
+      const a = job('827-one', 'pending', 827);
+      const b = job('827-two', 'pending', 827);
+      const later = job('828-three', 'pending', 828);
+      const res = pickForProject([a, b, later], new Set(), 3);
+      expect(res.batch.map((j) => j.slug).sort()).toEqual(['827-one', '827-two', '828-three']);
+    } finally {
+      if (prevCap === undefined) delete process.env.SM_PROJECT_JOB_CAP;
+      else process.env.SM_PROJECT_JOB_CAP = prevCap;
+    }
   });
 });
 

package/src/main/bilkoHost.cjs

@@ -29,6 +29,7 @@
  */
 
 const { ipcMain } = require('electron');
+const { opsPath } = require('./lib/opsOwnership.cjs');
 const fsp = require('node:fs/promises');
 const path = require('node:path');
 const crypto = require('node:crypto');
@@ -46,7 +47,7 @@ const WRITER = 'bilko-host';
 const PROJECT_PAGE_LENSES = new Set(['home', 'marketing', 'feature', 'architecture']);
 
 function bilkoHostDir(cwd) {
-  return path.join(cwd, 'session-manager-operations', 'bilko-host');
+  return opsPath(cwd, 'bilko-host');
 }
 
 function distDir(cwd) {
@@ -103,7 +104,7 @@ async function get({ cwd }) {
   const realCwd = config.validatePath(cwd);
 
   const marketingResult = await config.readText(
-    path.join(realCwd, 'session-manager-operations', 'project-pages', 'output', 'marketing.html'),
+    opsPath(realCwd, 'project-pages', 'output', 'marketing.html'),
   );
   const pkgResult = await config.readJson(path.join(realCwd, 'package.json'));
   const pkg = pkgResult.exists && !pkgResult.parseError ? pkgResult.data : null;
@@ -215,7 +216,7 @@ async function removeDocument({ cwd, id }) {
 async function resolveDocumentHtml(cwd, doc) {
   if (doc.source.kind === 'project-page-lens') {
     const result = await config.readText(
-      path.join(cwd, 'session-manager-operations', 'project-pages', 'output', `${doc.source.lens}.html`),
+      opsPath(cwd, 'project-pages', 'output', `${doc.source.lens}.html`),
     );
     if (!result.exists) {
       throw new Error(`document "${doc.title}" points at the ${doc.source.lens} Project Page, but it hasn't been generated yet`);

package/src/main/chatRunner.cjs

@@ -518,7 +518,12 @@ function executeRun({ tabId, sessionId, prompt, cwd, resume, silent, onSilentRes
     // resolveSourcePromptIdFromClaudeSession. sessionId IS the Epic's
     // claudeSessionId for an Epic-backed tab (domain model: Epic:claude-session
     // 1:1); for a non-Epic tab, resolution below simply finds no match.
-    const childEnv = cleanChildEnv({ PATH: pathWithUserBins(), SM_CHAT_SESSION_ID: sessionId });
+    // SM_PROJECT_ROOT is the real project cwd (never the worktree spawn cwd
+    // resolved below) — scheduler-mcp-server.cjs forwards it as
+    // originProjectRoot on create-prd/open-session/readiness calls so those
+    // routes can resolve the right project even from a worktree pwd. See
+    // projectRootResolve.cjs.
+    const childEnv = cleanChildEnv({ PATH: pathWithUserBins(), SM_CHAT_SESSION_ID: sessionId, SM_PROJECT_ROOT: cwd });
 
     // Prepend the stop-signal protocol instruction and the chat-mode truth
     // instruction to every prompt

package/src/main/config.cjs

@@ -19,7 +19,7 @@ const fs = require('node:fs');
 const fsp = require('node:fs/promises');
 const path = require('node:path');
 const os = require('node:os');
-const { assertOpsWrite } = require('./lib/opsOwnership.cjs');
+const { assertOpsWrite, opsPath } = require('./lib/opsOwnership.cjs');
 const chokidar = require('chokidar');
 const logs = require('./logs.cjs');
 const { sendIfAlive } = require('./lib/sendToRenderer.cjs');
@@ -139,39 +139,28 @@ function validateWrite(realAbs) {
       if (realAbs === claudeSub || realAbs.startsWith(claudeSub + path.sep)) {
         return;
       }
-      // PromptSession persistence (active-index.json + per-session archives,
-      // promptSessions.ts) and the scheduler's own read-modify-write of that
-      // same active index (promptSessionEvents.cjs, PRD 814) — narrowly
-      // scoped to session-manager-operations/prompt-sessions/, this repo's
-      // existing per-project artifact-store convention.
-      const promptSessionsSub = path.join(realRoot, 'session-manager-operations', 'prompt-sessions');
-      if (realAbs === promptSessionsSub || realAbs.startsWith(promptSessionsSub + path.sep)) {
-        return;
-      }
-      // Scheduler PRD sources (PRD 825 — per-project Epic PRD dirs under
-      // scheduler/epics/<id>/prds/, plus the legacy flat scheduler/prds/ and
-      // scheduler/state/ shards): narrowly scoped to
-      // session-manager-operations/scheduler/, this repo's existing
-      // per-project artifact-store convention (scheduler.cjs's remote.writePrd
-      // writes here via config.writeTextAtomic).
-      const schedulerSub = path.join(realRoot, 'session-manager-operations', 'scheduler');
-      if (realAbs === schedulerSub || realAbs.startsWith(schedulerSub + path.sep)) {
-        return;
-      }
-      // Project Brief persistence (PRD 837 — projectBrief.cjs's writeJson of
-      // brief.json): narrowly scoped to session-manager-operations/project-brief/,
-      // this repo's existing per-project artifact-store convention.
-      const briefSub = path.join(realRoot, 'session-manager-operations', 'project-brief');
-      if (realAbs === briefSub || realAbs.startsWith(briefSub + path.sep)) {
-        return;
+      // Writable ops namespaces under a registered project root — this
+      // repo's per-project artifact-store convention:
+      //   prompt-sessions  PromptSession persistence (promptSessions.ts) and
+      //                    the scheduler's read-modify-write of active-index
+      //                    (promptSessionEvents.cjs, PRD 814)
+      //   scheduler        PRD sources + Epic PRD dirs + state shards
+      //                    (PRD 825; scheduler.cjs remote.writePrd)
+      //   project-brief    projectBrief.cjs's brief.json (PRD 837)
+      //   bilko-host       bilkoHost.cjs's bundle prep
+      // Paths come from opsOwnership.opsPath (PRD 1082) — the one ops-root
+      // resolver — which THROWS for an ephemeral root (a linked worktree that
+      // pty.cjs registered as an allowed root for its spawn cwd, or
+      // os.tmpdir()). That throw is the point: a worktree's ops subtree is
+      // never a writable destination, so its exemptions simply do not exist.
+      let opsSubs;
+      try {
+        opsSubs = ['prompt-sessions', 'scheduler', 'project-brief', 'bilko-host'].map((ns) => opsPath(realRoot, ns));
+      } catch {
+        opsSubs = [];
       }
-      // Host on Bilko.run bundle prep (bilkoHost.cjs's prepareBundle/
-      // addDocument/removeDocument): narrowly scoped to
-      // session-manager-operations/bilko-host/, this repo's existing
-      // per-project artifact-store convention.
-      const bilkoHostSub = path.join(realRoot, 'session-manager-operations', 'bilko-host');
-      if (realAbs === bilkoHostSub || realAbs.startsWith(bilkoHostSub + path.sep)) {
-        return;
+      for (const sub of opsSubs) {
+        if (realAbs === sub || realAbs.startsWith(sub + path.sep)) return;
       }
     }
   }