claude-code-session-manager 0.76.0 → 0.77.0

package/src/main/lib/__tests__/delegationReadiness.test.cjs

@@ -14,9 +14,11 @@ const path = require('node:path');
 const {
   checkDelegationReadiness,
   installPrdWriteGuard,
+  installDestructiveGitGuard,
   probeSchedulerMcpLive,
   clearLiveProbeCache,
   PRD_WRITE_GUARD_SCRIPT,
+  DESTRUCTIVE_GIT_GUARD_SCRIPT,
 } = require('../delegationReadiness.cjs');
 
 const REQUIRED_TOOLS = ['scheduler_create_prd', 'session_manager_help'];
@@ -97,6 +99,10 @@ async function makeGreenFixtures() {
           matcher: 'Write|Edit|NotebookEdit',
           hooks: [{ type: 'command', command: `node ${PRD_WRITE_GUARD_SCRIPT}` }],
         },
+        {
+          matcher: 'Bash',
+          hooks: [{ type: 'command', command: `node ${DESTRUCTIVE_GIT_GUARD_SCRIPT}` }],
+        },
       ],
     },
   });
@@ -104,12 +110,12 @@ async function makeGreenFixtures() {
   return { homeDir, cwd, scriptPath };
 }
 
-test('all six checks pass on a fully-configured project', async () => {
+test('all seven checks pass on a fully-configured project', async () => {
   const { homeDir, cwd } = await makeGreenFixtures();
   const result = await checkDelegationReadiness({ cwd, homeDir });
 
   expect(result.ok).toBe(true);
-  expect(result.checks).toHaveLength(6);
+  expect(result.checks).toHaveLength(7);
   expect(result.checks.every((c) => c.ok)).toBe(true);
   expect(result.checks.map((c) => c.id)).toEqual([
     'scheduler-mcp',
@@ -118,6 +124,7 @@ test('all six checks pass on a fully-configured project', async () => {
     'dev-plugin',
     'agent-personas',
     'prd-write-guard',
+    'destructive-git-guard',
   ]);
 }, 15_000);
 
@@ -382,3 +389,146 @@ test('the installed command actually DENIES a scheduler PRD write and allows a n
   const allowed = run({ file_path: path.join(cwd, 'src', 'x.ts'), content: 'x' });
   expect(allowed.hookSpecificOutput?.permissionDecision).not.toBe('deny');
 });
+
+// ─────────────────────────────── destructive-git-guard / installDestructiveGitGuard
+
+test('destructive-git-guard: fails independently when the hook is missing', async () => {
+  const { homeDir, cwd } = await makeGreenFixtures();
+  await writeJson(path.join(cwd, '.claude', 'settings.json'), {
+    hooks: {
+      PreToolUse: [
+        {
+          matcher: 'Write|Edit|NotebookEdit',
+          hooks: [{ type: 'command', command: `node ${PRD_WRITE_GUARD_SCRIPT}` }],
+        },
+      ],
+    },
+  });
+
+  const result = await checkDelegationReadiness({ cwd, homeDir });
+  const check = result.checks.find((c) => c.id === 'destructive-git-guard');
+  expect(check.ok).toBe(false);
+  expect(result.ok).toBe(false);
+  // the other checks still pass independently
+  expect(result.checks.filter((c) => c.id !== 'destructive-git-guard').every((c) => c.ok)).toBe(true);
+}, 15_000);
+
+test('destructive-git-guard: fails when the hook names a script that does not exist', async () => {
+  const { homeDir, cwd } = await makeGreenFixtures();
+  await writeJson(path.join(cwd, '.claude', 'settings.json'), {
+    hooks: {
+      PreToolUse: [
+        {
+          matcher: 'Write|Edit|NotebookEdit',
+          hooks: [{ type: 'command', command: `node ${PRD_WRITE_GUARD_SCRIPT}` }],
+        },
+        {
+          matcher: 'Bash',
+          hooks: [{ type: 'command', command: 'node /does/not/exist/guard-destructive-git.cjs' }],
+        },
+      ],
+    },
+  });
+
+  const result = await checkDelegationReadiness({ cwd, homeDir });
+  const check = result.checks.find((c) => c.id === 'destructive-git-guard');
+  expect(check.ok).toBe(false);
+  expect(check.detail).toMatch(/does not exist/);
+}, 15_000);
+
+test('installDestructiveGitGuard: writes the canonical ABSOLUTE-path entry and turns the check green', async () => {
+  const { homeDir, cwd } = await makeGreenFixtures();
+  await writeJson(path.join(cwd, '.claude', 'settings.json'), {
+    hooks: {
+      PreToolUse: [
+        {
+          matcher: 'Write|Edit|NotebookEdit',
+          hooks: [{ type: 'command', command: `node ${PRD_WRITE_GUARD_SCRIPT}` }],
+        },
+      ],
+    },
+  });
+
+  const r = await installDestructiveGitGuard({ cwd });
+  expect(r.ok).toBe(true);
+  expect(r.action).toBe('installed');
+  expect(r.command).toBe(`node ${DESTRUCTIVE_GIT_GUARD_SCRIPT}`);
+
+  const written = JSON.parse(fs.readFileSync(path.join(cwd, '.claude', 'settings.json'), 'utf8'));
+  // The pre-existing Write|Edit|NotebookEdit matcher (and its hook) survives untouched.
+  expect(written.hooks.PreToolUse).toContainEqual(
+    { matcher: 'Write|Edit|NotebookEdit', hooks: [{ type: 'command', command: `node ${PRD_WRITE_GUARD_SCRIPT}` }] },
+  );
+  expect(written.hooks.PreToolUse).toContainEqual(
+    { matcher: 'Bash', hooks: [{ type: 'command', command: `node ${DESTRUCTIVE_GIT_GUARD_SCRIPT}` }] },
+  );
+
+  const result = await checkDelegationReadiness({ cwd, homeDir });
+  expect(result.checks.find((c) => c.id === 'destructive-git-guard').ok).toBe(true);
+  expect(result.checks.find((c) => c.id === 'prd-write-guard').ok).toBe(true);
+}, 15_000);
+
+test('installDestructiveGitGuard: is idempotent — a healthy guard is a no-op', async () => {
+  const { cwd } = await makeGreenFixtures();
+  const before = fs.readFileSync(path.join(cwd, '.claude', 'settings.json'), 'utf8');
+
+  const again = await installDestructiveGitGuard({ cwd });
+  expect(again.action).toBe('already-installed');
+  expect(fs.readFileSync(path.join(cwd, '.claude', 'settings.json'), 'utf8')).toBe(before);
+});
+
+test('installDestructiveGitGuard: repairs a broken entry in place rather than duplicating it', async () => {
+  const { cwd } = await makeGreenFixtures();
+  await writeJson(path.join(cwd, '.claude', 'settings.json'), {
+    hooks: {
+      PreToolUse: [
+        {
+          matcher: 'Write|Edit|NotebookEdit',
+          hooks: [{ type: 'command', command: `node ${PRD_WRITE_GUARD_SCRIPT}` }],
+        },
+        {
+          matcher: 'Bash',
+          hooks: [{ type: 'command', command: 'node /does/not/exist/guard-destructive-git.cjs' }],
+        },
+      ],
+    },
+  });
+
+  const r = await installDestructiveGitGuard({ cwd });
+  expect(r.action).toBe('repaired');
+
+  const written = JSON.parse(fs.readFileSync(path.join(cwd, '.claude', 'settings.json'), 'utf8'));
+  const bashMatchers = written.hooks.PreToolUse.filter((m) => m.matcher === 'Bash');
+  expect(bashMatchers).toHaveLength(1);
+  expect(bashMatchers[0].hooks).toEqual([{ type: 'command', command: `node ${DESTRUCTIVE_GIT_GUARD_SCRIPT}` }]);
+});
+
+test('installDestructiveGitGuard: refuses on unparseable settings rather than discarding them', async () => {
+  const { cwd } = await makeGreenFixtures();
+  await fsp.writeFile(path.join(cwd, '.claude', 'settings.json'), '{ not valid json', 'utf8');
+
+  const r = await installDestructiveGitGuard({ cwd });
+  expect(r.ok).toBe(false);
+  expect(r.action).toBe('error');
+  expect(fs.readFileSync(path.join(cwd, '.claude', 'settings.json'), 'utf8')).toBe('{ not valid json');
+});
+
+// The guard script is EXERCISED here too, same rationale as the
+// installPrdWriteGuard end-to-end test above.
+test('the installed destructive-git command actually DENIES a shared-tree stash and allows it inside an sm-job/ worktree', async () => {
+  const { cwd } = await makeGreenFixtures();
+  const { execFileSync } = require('node:child_process');
+  const os2 = require('node:os');
+
+  const run = (command, runCwd) => JSON.parse(execFileSync('node', [DESTRUCTIVE_GIT_GUARD_SCRIPT], {
+    input: JSON.stringify({ tool_name: 'Bash', tool_input: { command }, cwd: runCwd }),
+    encoding: 'utf8',
+  }));
+
+  const denied = run('git stash', cwd);
+  expect(denied.hookSpecificOutput?.permissionDecision).toBe('deny');
+
+  const worktreeCwd = path.join(os2.tmpdir(), 'session-manager-job-worktrees', 'somehash', 'some-slug');
+  const allowed = run('git stash', worktreeCwd);
+  expect(allowed.hookSpecificOutput?.permissionDecision).not.toBe('deny');
+});

package/src/main/lib/__tests__/epicWorktreeMint.test.cjs

@@ -80,12 +80,14 @@ test('a non-git cwd resolves to null rather than throwing (Epic proceeds unisola
   expect(result).toBeNull();
 });
 
-test('a dirty base tree resolves to null rather than throwing', async () => {
+test('a dirty base tree still creates the worktree, carrying the uncommitted edit in rather than falling back unisolated', async () => {
   const cwd = await mkRepoCwd();
   fs.writeFileSync(path.join(cwd, 'README.md'), 'uncommitted tracked edit\n', 'utf8');
 
   const result = await handler(null, { cwd, epicId: 'epic-mint-3' });
-  expect(result).toBeNull();
+  expect(result).not.toBeNull();
+  expect(fs.readFileSync(path.join(result.dir, 'README.md'), 'utf8')).toBe('uncommitted tracked edit\n');
+  expect(fs.readFileSync(path.join(cwd, 'README.md'), 'utf8')).toBe('uncommitted tracked edit\n');
 });
 
 test('SM_EPIC_WORKTREE_DISABLE=1 resolves to null rather than throwing', async () => {

package/src/main/lib/__tests__/fixChainDepth.test.cjs

@@ -0,0 +1,40 @@
+/**
+ * fixChainDepth.test.cjs — unit tests for the pure fix-chain depth counter
+ * (PRD 1113). Run: timeout 120 npx vitest run src/main/lib/__tests__/fixChainDepth.test.cjs
+ */
+
+'use strict';
+
+import { test, expect } from 'vitest';
+const { fixChainDepthOf, baseSlugOf } = require('../fixChainDepth.cjs');
+
+test('fixChainDepthOf counts consecutive -fix- segments after the leading NN- prefix', () => {
+  const cases = [
+    // [slug, expected depth]
+    ['113-foo', 0],
+    ['113-fix-foo', 1],
+    ['113-fix-fix-foo', 2],
+    ['113-fix-fix-fix-foo', 3],
+    // false-positive bait: a later segment merely reading 'fix' does not
+    // extend the run once a non-'fix' segment has broken it.
+    ['113-fix-loop-extraction-and-round-trip', 1],
+    ['22-fix-loop-galaxy-round-trip', 1],
+    // false-positive bait: a segment that only contains 'fix' as a substring
+    // (not an exact 'fix' segment) is never counted at all.
+    ['113-prefix-foo', 0],
+    ['113-prefix-fix-foo', 0],
+    // no fix chain, multi-digit NN, single-segment slug.
+    ['1-widget', 0],
+  ];
+  for (const [slug, expected] of cases) {
+    expect(fixChainDepthOf(slug)).toBe(expected);
+  }
+});
+
+test('baseSlugOf strips the leading fix chain, keeping the NN prefix', () => {
+  expect(baseSlugOf('113-foo')).toBe('113-foo');
+  expect(baseSlugOf('113-fix-foo')).toBe('113-foo');
+  expect(baseSlugOf('113-fix-fix-foo')).toBe('113-foo');
+  expect(baseSlugOf('113-fix-fix-fix-foo')).toBe('113-foo');
+  expect(baseSlugOf('113-fix-loop-extraction-and-round-trip')).toBe('113-loop-extraction-and-round-trip');
+});

package/src/main/lib/__tests__/gitWorktree.test.cjs

@@ -11,7 +11,7 @@
 
 'use strict';
 
-import { test, expect, beforeEach, afterEach } from 'vitest';
+import { test, expect, beforeEach, afterEach, vi } from 'vitest';
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
@@ -160,6 +160,90 @@ test('[job] merge-commit message text is byte-for-byte unchanged from the pre-ge
   await gitWorktree.cleanupJobWorktree({ cwd: repoCwd, dir: worktree.dir, branch: worktree.branch });
 });
 
+test('[job] integration is skipped (carried-wip-only) when the branch only commits the carried base WIP, and the base tree stays untouched', async () => {
+  const slug = 'test-slug-carried-wip-only';
+  fs.writeFileSync(path.join(repoCwd, 'README.md'), 'uncommitted tracked edit\n', 'utf8');
+  const worktree = await gitWorktree.createJobWorktree({ cwd: repoCwd, slug });
+  expect(worktree.ok).toBe(true);
+  expect(worktree.carriedPaths).toEqual(['README.md']);
+
+  // The job commits exactly the carried content, doing no other work.
+  git(['add', '-A'], worktree.dir);
+  git(['commit', '-q', '-m', 'commit carried README'], worktree.dir);
+
+  const headBefore = git(['rev-parse', 'HEAD'], repoCwd).trim();
+  const outcome = await gitWorktree.integrateJobBranch({ cwd: repoCwd, branch: worktree.branch, slug, carriedPaths: worktree.carriedPaths });
+  expect(outcome.ok).toBe(true);
+  expect(outcome.integrated).toBe(false);
+  expect(outcome.reason).toBe('carried-wip-only');
+
+  const headAfter = git(['rev-parse', 'HEAD'], repoCwd).trim();
+  expect(headAfter).toBe(headBefore);
+  // The base tree's own uncommitted README edit is untouched — never
+  // discarded, never re-applied.
+  expect(git(['status', '--porcelain'], repoCwd)).toContain('README.md');
+
+  await gitWorktree.cleanupJobWorktree({ cwd: repoCwd, dir: worktree.dir, branch: worktree.branch, keepBranch: !outcome.ok });
+});
+
+test('[job] a branch that commits carried paths ALONGSIDE its own work still attempts integration normally (no silent drop)', async () => {
+  const slug = 'test-slug-carried-plus-own-work';
+  fs.writeFileSync(path.join(repoCwd, 'README.md'), 'uncommitted tracked edit\n', 'utf8');
+  const worktree = await gitWorktree.createJobWorktree({ cwd: repoCwd, slug });
+  expect(worktree.ok).toBe(true);
+  expect(worktree.carriedPaths).toEqual(['README.md']);
+
+  fs.writeFileSync(path.join(worktree.dir, 'new-file.txt'), 'job output\n', 'utf8');
+  git(['add', '-A'], worktree.dir);
+  git(['commit', '-q', '-m', 'job commit touching carried path + own work'], worktree.dir);
+
+  const outcome = await gitWorktree.integrateJobBranch({ cwd: repoCwd, branch: worktree.branch, slug, carriedPaths: worktree.carriedPaths });
+  // The base tree still holds README.md dirty, so a real merge attempt here
+  // is expected to fail exactly like the existing worktreeIntegrationFailure
+  // path — branch preserved, not merged, not silently discarded.
+  expect(outcome.ok).toBe(false);
+  expect(outcome.reason).toBeTruthy();
+
+  const branches = git(['branch', '--list', worktree.branch], repoCwd);
+  expect(branches).toContain(worktree.branch.replace('sm-job/', ''));
+
+  await gitWorktree.cleanupJobWorktree({ cwd: repoCwd, dir: worktree.dir, branch: worktree.branch, keepBranch: true });
+});
+
+test('[job] a branch that ADDS its own edit on top of the carried content on the SAME path is never classified carried-wip-only (content-verify, not path-only)', async () => {
+  const slug = 'test-slug-carried-same-path-plus-edit';
+  fs.writeFileSync(path.join(repoCwd, 'README.md'), 'uncommitted tracked edit\n', 'utf8');
+  const worktree = await gitWorktree.createJobWorktree({ cwd: repoCwd, slug });
+  expect(worktree.ok).toBe(true);
+  expect(worktree.carriedPaths).toEqual(['README.md']);
+
+  // The job's real work lands on the SAME path the base tree had WIP on —
+  // committing MORE than just the carried content. A path-only check would
+  // wrongly see "only README.md changed, and README.md was carried" and
+  // classify this as carried-wip-only, causing the caller to delete this
+  // branch (and the job's real commit with it) instead of attempting a
+  // normal merge.
+  fs.writeFileSync(path.join(worktree.dir, 'README.md'), 'uncommitted tracked edit\njob added this line\n', 'utf8');
+  git(['add', '-A'], worktree.dir);
+  git(['commit', '-q', '-m', 'job extends the carried README further'], worktree.dir);
+
+  const headBefore = git(['rev-parse', 'HEAD'], repoCwd).trim();
+  const outcome = await gitWorktree.integrateJobBranch({ cwd: repoCwd, branch: worktree.branch, slug, carriedPaths: worktree.carriedPaths });
+  // The base tree still holds README.md dirty, so a real merge attempt here
+  // is expected to fail exactly like the existing worktreeIntegrationFailure
+  // path — branch preserved, not merged, not silently discarded.
+  expect(outcome.ok).toBe(false);
+  expect(outcome.reason).toBeTruthy();
+  expect(outcome.reason).not.toBe('carried-wip-only');
+
+  const headAfter = git(['rev-parse', 'HEAD'], repoCwd).trim();
+  expect(headAfter).toBe(headBefore);
+  const branches = git(['branch', '--list', worktree.branch], repoCwd);
+  expect(branches).toContain(worktree.branch.replace('sm-job/', ''));
+
+  await gitWorktree.cleanupJobWorktree({ cwd: repoCwd, dir: worktree.dir, branch: worktree.branch, keepBranch: true });
+});
+
 test('[job] falls back with a reason for a non-git cwd', async () => {
   const nonGitDir = path.join(tmpRoot, 'not-a-repo');
   fs.mkdirSync(nonGitDir, { recursive: true });
@@ -168,11 +252,47 @@ test('[job] falls back with a reason for a non-git cwd', async () => {
   expect(result.reason).toMatch(/not a git repository/);
 });
 
-test('[job] falls back with a reason for a dirty base tree with a modified TRACKED file (never silently drops uncommitted human WIP)', async () => {
+test('[job] a dirty tracked base file is carried into the worktree with identical content, and the base tree is never written to', async () => {
   fs.writeFileSync(path.join(repoCwd, 'README.md'), 'uncommitted tracked edit\n', 'utf8');
+  const statusBefore = git(['status', '--porcelain'], repoCwd);
+  const stashBefore = git(['stash', 'list'], repoCwd);
+
   const result = await gitWorktree.createJobWorktree({ cwd: repoCwd, slug: 'x' });
-  expect(result.ok).toBe(false);
-  expect(result.reason).toMatch(/uncommitted changes/);
+  expect(result.ok).toBe(true);
+  expect(result.carriedPaths).toEqual(['README.md']);
+  expect(fs.readFileSync(path.join(result.dir, 'README.md'), 'utf8')).toBe('uncommitted tracked edit\n');
+
+  const statusAfter = git(['status', '--porcelain'], repoCwd);
+  const stashAfter = git(['stash', 'list'], repoCwd);
+  expect(statusAfter).toBe(statusBefore);
+  expect(stashAfter).toBe(stashBefore);
+
+  await gitWorktree.cleanupJobWorktree({ cwd: repoCwd, dir: result.dir, branch: result.branch });
+});
+
+test('[job] an untracked-only dirty base file is NOT carried and stays on the existing clean-create path', async () => {
+  fs.writeFileSync(path.join(repoCwd, 'scratch.txt'), 'stray scratch file\n', 'utf8');
+  const result = await gitWorktree.createJobWorktree({ cwd: repoCwd, slug: 'x' });
+  expect(result.ok).toBe(true);
+  expect(result.carriedPaths).toEqual([]);
+  expect(fs.existsSync(path.join(result.dir, 'scratch.txt'))).toBe(false);
+  await gitWorktree.cleanupJobWorktree({ cwd: repoCwd, dir: result.dir, branch: result.branch });
+});
+
+test('[job] carry-over failure (git apply cannot apply) degrades cleanly: worktree torn down, ok:false, active count released', async () => {
+  fs.writeFileSync(path.join(repoCwd, 'README.md'), 'uncommitted tracked edit\n', 'utf8');
+  const spy = vi.spyOn(gitWorktree, 'captureAndCarryBaseDiff').mockResolvedValue({ ok: false, reason: 'simulated git apply failure' });
+  try {
+    const before = gitWorktree._getActiveWorktreeCountForTests('job');
+    const result = await gitWorktree.createJobWorktree({ cwd: repoCwd, slug: 'x' });
+    expect(result.ok).toBe(false);
+    expect(result.reason).toMatch(/carry-over of base WIP failed/);
+    expect(gitWorktree._getActiveWorktreeCountForTests('job')).toBe(before);
+    const list = git(['worktree', 'list', '--porcelain'], repoCwd);
+    expect(list).not.toContain('sm-job/x');
+  } finally {
+    spy.mockRestore();
+  }
 });
 
 test('[job] falls back once the concurrency cap is reached, and recovers after cleanup', async () => {
@@ -191,6 +311,46 @@ test('[job] falls back once the concurrency cap is reached, and recovers after c
   await gitWorktree.cleanupJobWorktree({ cwd: repoCwd, dir: third.dir, branch: third.branch });
 });
 
+test('[job] getMaxConcurrentWorktrees floors the job cap at the sessionSlots pool size (PRD 1112)', () => {
+  const originalSlots = process.env.SM_SESSION_SLOTS;
+  try {
+    process.env.SM_SESSION_SLOTS = '10';
+    expect(gitWorktree.getMaxConcurrentWorktrees('job')).toBe(10);
+
+    // The floor never drops BELOW the existing default (4) even when the
+    // slot pool is smaller — this cap only ever widens for isolation, never
+    // narrows it below what already shipped.
+    process.env.SM_SESSION_SLOTS = '3';
+    expect(gitWorktree.getMaxConcurrentWorktrees('job')).toBe(4);
+  } finally {
+    if (originalSlots === undefined) delete process.env.SM_SESSION_SLOTS;
+    else process.env.SM_SESSION_SLOTS = originalSlots;
+  }
+});
+
+test('[job] an explicit SM_JOB_WORKTREE_MAX wins verbatim over the sessionSlots floor', () => {
+  const originalSlots = process.env.SM_SESSION_SLOTS;
+  try {
+    process.env.SM_SESSION_SLOTS = '10';
+    process.env.SM_JOB_WORKTREE_MAX = '2';
+    expect(gitWorktree.getMaxConcurrentWorktrees('job')).toBe(2);
+  } finally {
+    if (originalSlots === undefined) delete process.env.SM_SESSION_SLOTS;
+    else process.env.SM_SESSION_SLOTS = originalSlots;
+  }
+});
+
+test('[epic] getMaxConcurrentWorktrees is unaffected by the sessionSlots pool size', () => {
+  const originalSlots = process.env.SM_SESSION_SLOTS;
+  try {
+    process.env.SM_SESSION_SLOTS = '10';
+    expect(gitWorktree.getMaxConcurrentWorktrees('epic')).toBe(50);
+  } finally {
+    if (originalSlots === undefined) delete process.env.SM_SESSION_SLOTS;
+    else process.env.SM_SESSION_SLOTS = originalSlots;
+  }
+});
+
 test('[job] SM_JOB_WORKTREE_DISABLE=1 restores in-place behaviour', async () => {
   process.env.SM_JOB_WORKTREE_DISABLE = '1';
   const result = await gitWorktree.createJobWorktree({ cwd: repoCwd, slug: 'x' });
@@ -410,3 +570,116 @@ test('isBaseTreeClean still reports dirty for a modified TRACKED file', async ()
   fs.writeFileSync(path.join(repoCwd, 'README.md'), 'modified tracked content\n', 'utf8');
   expect(await gitWorktree.isBaseTreeClean(repoCwd)).toBe(false);
 });
+
+// ──────────────────────────────────────────── orphaned on-disk checkouts (PRD 1108)
+
+test('[job] cleanupWorktree rmdirs the now-empty parent hash dir, but a sibling checkout in the same hash dir survives', async () => {
+  const first = await gitWorktree.createJobWorktree({ cwd: repoCwd, slug: 'sibling-a' });
+  const second = await gitWorktree.createJobWorktree({ cwd: repoCwd, slug: 'sibling-b' });
+  expect(first.ok).toBe(true);
+  expect(second.ok).toBe(true);
+  const hashDir = path.dirname(first.dir);
+  expect(path.dirname(second.dir)).toBe(hashDir);
+
+  await gitWorktree.cleanupJobWorktree({ cwd: repoCwd, dir: first.dir, branch: first.branch });
+  expect(fs.existsSync(first.dir)).toBe(false);
+  // The hash dir must survive — the sibling checkout still lives under it.
+  expect(fs.existsSync(hashDir)).toBe(true);
+  expect(fs.existsSync(second.dir)).toBe(true);
+
+  await gitWorktree.cleanupJobWorktree({ cwd: repoCwd, dir: second.dir, branch: second.branch });
+  expect(fs.existsSync(second.dir)).toBe(false);
+  // Now that the last sibling is gone, the empty hash dir is reclaimed too.
+  expect(fs.existsSync(hashDir)).toBe(false);
+});
+
+test('[job] reconcileWorktreesOnBoot reclaims an orphaned on-disk checkout for a project cwd it was never handed', async () => {
+  const worktree = await gitWorktree.createJobWorktree({ cwd: repoCwd, slug: 'orphan-old' });
+  expect(worktree.ok).toBe(true);
+  gitWorktree._resetActiveWorktreeCountForTests('job', 0);
+  // Simulate age: back-date the checkout dir's mtime well past the 1s
+  // threshold used below, without touching anything about its content.
+  const old = new Date(Date.now() - 60_000);
+  fs.utimesSync(worktree.dir, old, old);
+
+  // No cwd handed in at all — this is the "project no longer tracked" case
+  // the per-cwd loop can never reach on its own.
+  await gitWorktree.reconcileWorktreesOnBoot([], { kind: 'job', staleAgeMs: 1_000 });
+
+  expect(fs.existsSync(worktree.dir)).toBe(false);
+  // The hash dir it lived under is empty now and must be reclaimed too.
+  expect(fs.existsSync(path.dirname(worktree.dir))).toBe(false);
+  // The main tree's own worktree registration must not be left dangling.
+  const list = git(['worktree', 'list', '--porcelain'], repoCwd);
+  expect(list).not.toContain(worktree.dir);
+});
+
+test('[job] reconcileWorktreesOnBoot never reclaims a fresh, in-use checkout younger than the age threshold', async () => {
+  const worktree = await gitWorktree.createJobWorktree({ cwd: repoCwd, slug: 'fresh-in-use' });
+  expect(worktree.ok).toBe(true);
+  gitWorktree._resetActiveWorktreeCountForTests('job', 0);
+
+  await gitWorktree.reconcileWorktreesOnBoot([], { kind: 'job', staleAgeMs: 24 * 60 * 60 * 1000 });
+
+  expect(fs.existsSync(worktree.dir)).toBe(true);
+  await gitWorktree.cleanupJobWorktree({ cwd: repoCwd, dir: worktree.dir, branch: worktree.branch });
+});
+
+test('[epic] the orphan sweep age threshold defaults much higher (7 days) than the job kind (24h)', () => {
+  expect(gitWorktree.getStaleSweepAgeMs('job')).toBe(24 * 60 * 60 * 1000);
+  expect(gitWorktree.getStaleSweepAgeMs('epic')).toBe(7 * 24 * 60 * 60 * 1000);
+});
+
+test('[epic] SM_EPIC_WORKTREE_STALE_MS overrides the epic orphan-sweep age threshold independently of the job env var', () => {
+  const original = process.env.SM_EPIC_WORKTREE_STALE_MS;
+  try {
+    process.env.SM_EPIC_WORKTREE_STALE_MS = '12345';
+    expect(gitWorktree.getStaleSweepAgeMs('epic')).toBe(12345);
+    expect(gitWorktree.getStaleSweepAgeMs('job')).toBe(24 * 60 * 60 * 1000);
+  } finally {
+    if (original === undefined) delete process.env.SM_EPIC_WORKTREE_STALE_MS;
+    else process.env.SM_EPIC_WORKTREE_STALE_MS = original;
+  }
+});
+
+test('[job] sweepStaleWorktreeCheckouts treats staleAgeMs: 0 as "reclaim immediately", not as "unset — use the default"', async () => {
+  const worktree = await gitWorktree.createJobWorktree({ cwd: repoCwd, slug: 'zero-age' });
+  expect(worktree.ok).toBe(true);
+  gitWorktree._resetActiveWorktreeCountForTests('job', 0);
+
+  const result = await gitWorktree.sweepStaleWorktreeCheckouts('job', { staleAgeMs: 0 });
+
+  expect(result.checkoutsRemoved).toBe(1);
+  expect(fs.existsSync(worktree.dir)).toBe(false);
+});
+
+test('[job] sweepStaleWorktreeCheckouts never deletes anything outside its own kind root, even via a symlink shaped like a traversal', async () => {
+  const outsideDir = path.join(tmpRoot, 'outside-root');
+  fs.mkdirSync(outsideDir, { recursive: true });
+  const markerFile = path.join(outsideDir, 'do-not-delete.txt');
+  fs.writeFileSync(markerFile, 'still here\n', 'utf8');
+
+  const root = gitWorktree.worktreeRootFor('job');
+  const hashDir = path.join(root, 'traversal-hash-dir');
+  fs.mkdirSync(hashDir, { recursive: true });
+  const escapePath = path.join(hashDir, 'escape');
+  fs.symlinkSync(outsideDir, escapePath, 'dir');
+
+  const result = await gitWorktree.sweepStaleWorktreeCheckouts('job', { staleAgeMs: 0 });
+
+  expect(fs.existsSync(markerFile)).toBe(true);
+  expect(fs.existsSync(outsideDir)).toBe(true);
+  expect(result.checkoutsRemoved).toBe(0);
+
+  fs.rmSync(hashDir, { recursive: true, force: true });
+});
+
+test('[job] reconcileWorktreesOnBoot logs a one-shot report line with reclaimed counts', async () => {
+  const logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+  try {
+    await gitWorktree.reconcileWorktreesOnBoot([repoCwd], { kind: 'job' });
+    expect(logSpy).toHaveBeenCalledWith(expect.stringMatching(/boot sweep \(kind:job\): reclaimed \d+ checkout\(s\), \d+ empty root dir\(s\)/));
+  } finally {
+    logSpy.mockRestore();
+  }
+});