claude-code-session-manager 0.79.0 → 0.81.0

package/src/main/lib/gitWorktree.cjs

@@ -544,6 +544,69 @@ async function createWorktree({ kind, cwd, key }) {
   return { ok: true, dir, branch, baseCwd: cwd, carriedPaths };
 }
 
+/**
+ * True iff every path in `paths` has working-tree content in `cwd`
+ * byte-identical to its committed blob on `branch`. Used both by the
+ * carried-wip-only shortcut above and by integrateBranch's auto-resolve of a
+ * "would be overwritten by merge" refusal below — in both cases discarding a
+ * working-tree copy is only safe BECAUSE identity with the incoming commit is
+ * proven, never assumed. Fails toward false (not identical) on ANY read
+ * error — a `git show` failure or an unreadable working-tree file is never
+ * proof of identity.
+ */
+async function pathsIdenticalToBranch({ cwd, branch, paths }) {
+  if (!Array.isArray(paths) || !paths.length) return false;
+  for (const p of paths) {
+    try {
+      const branchContent = await execGit(['show', `${branch}:${p}`], { cwd, timeout: 10_000 });
+      const baseContent = await fsp.readFile(path.join(cwd, p), 'utf8');
+      if (branchContent !== baseContent) return false;
+    } catch {
+      return false;
+    }
+  }
+  return true;
+}
+
+/**
+ * Parses the path lists out of git's refusal to merge over dirty working-tree
+ * files. Git emits up to two distinct blocks — tracked paths under "local
+ * changes ... would be overwritten" (restorable via `git checkout --`, which
+ * needs an index entry) and untracked paths under "untracked working tree
+ * files ... would be overwritten" (no index entry, so `git checkout --`
+ * cannot touch them — they must be removed instead). Each block is a run of
+ * TAB-indented path lines terminated by the next non-indented line (a
+ * "Please ..." sentence or the next block's own header). Returns null when
+ * neither block is present — stderr from a genuine content conflict has no
+ * such block.
+ */
+function parseBlockingMergePaths(stderrText) {
+  if (!stderrText) return null;
+  const tracked = [];
+  const untracked = [];
+  let mode = null;
+  for (const rawLine of stderrText.split('\n')) {
+    if (/would be overwritten by merge:\s*$/.test(rawLine) && /local changes/.test(rawLine)) {
+      mode = 'tracked';
+      continue;
+    }
+    if (/would be overwritten by merge:\s*$/.test(rawLine) && /untracked working tree files/.test(rawLine)) {
+      mode = 'untracked';
+      continue;
+    }
+    if (mode) {
+      if (/^\t/.test(rawLine)) {
+        const p = rawLine.trim();
+        if (p) (mode === 'tracked' ? tracked : untracked).push(p);
+        continue;
+      }
+      mode = null;
+    }
+  }
+  if (!tracked.length && !untracked.length) return null;
+  return { tracked: Array.from(new Set(tracked)), untracked: Array.from(new Set(untracked)) };
+}
+
 /**
  * Integrate a branch back into `cwd`'s current HEAD — fast-forward when
  * possible, a real merge commit when the main tree advanced underneath (a
@@ -600,17 +663,7 @@ async function integrateBranch({ cwd, branch, key, kind, carriedPaths }) {
         // committed exactly the carried WIP and nothing more. Any mismatch
         // (including a read failure — fail toward the safer default) falls
         // through to the normal merge attempt below instead of skipping.
-        let allIdentical = true;
-        for (const p of changed) {
-          try {
-            const branchContent = await execGit(['show', `${branch}:${p}`], { cwd, timeout: 10_000 });
-            const baseContent = await fsp.readFile(path.join(cwd, p), 'utf8');
-            if (branchContent !== baseContent) { allIdentical = false; break; }
-          } catch {
-            allIdentical = false;
-            break;
-          }
-        }
+        const allIdentical = await pathsIdenticalToBranch({ cwd, branch, paths: changed });
         if (allIdentical) {
           return { ok: true, integrated: false, reason: 'carried-wip-only' };
         }
@@ -637,9 +690,40 @@ async function integrateBranch({ cwd, branch, key, kind, carriedPaths }) {
     await execGit(['merge', '--no-ff', '--no-edit', '-m', mergeMessage, branch], { cwd, timeout: 30_000 });
     return { ok: true, integrated: true, mergeCommit: true };
   } catch (e) {
+    const stderrText = (e && (e.stderrText || e.message)) || String(e);
+    // git refuses this class of merge before ever touching MERGE_HEAD, so
+    // there is nothing yet to abort here — only the retry below (if it also
+    // fails) can leave a half-applied merge behind.
+    const blocking = parseBlockingMergePaths(stderrText);
+    if (blocking) {
+      const allPaths = [...blocking.tracked, ...blocking.untracked];
+      const identical = await pathsIdenticalToBranch({ cwd, branch, paths: allPaths });
+      if (identical) {
+        try {
+          if (blocking.tracked.length) {
+            await execGit(['checkout', '--', ...blocking.tracked], { cwd, timeout: 30_000 });
+          }
+          for (const p of blocking.untracked) {
+            await fsp.rm(path.join(cwd, p), { force: true });
+          }
+          await execGit(['merge', '--no-ff', '--no-edit', '-m', mergeMessage, branch], { cwd, timeout: 30_000 });
+          return {
+            ok: true,
+            integrated: true,
+            mergeCommit: true,
+            autoResolved: 'identical_working_tree_duplicates',
+            resolvedPaths: allPaths,
+          };
+        } catch (retryErr) {
+          try { await execGit(['merge', '--abort'], { cwd, timeout: 10_000 }); } catch { /* nothing to abort */ }
+          const retryText = (retryErr && (retryErr.stderrText || retryErr.message)) || String(retryErr);
+          return { ok: false, reason: `merge failed (likely a real content conflict): ${retryText}` };
+        }
+      }
+    }
     // Abort a half-applied merge so `cwd` isn't left in a mid-merge state.
     try { await execGit(['merge', '--abort'], { cwd, timeout: 10_000 }); } catch { /* nothing to abort */ }
-    return { ok: false, reason: `merge failed (likely a real content conflict): ${(e && (e.stderrText || e.message)) || e}` };
+    return { ok: false, reason: `merge failed (likely a real content conflict): ${stderrText}` };
   }
 }
 
@@ -775,6 +859,25 @@ async function salvageDirtyDelta({ cwd, paths, outFile }) {
   }
 }
 
+/**
+ * True when every commit on `branch` is already an ancestor of (or equal to)
+ * `cwd`'s current HEAD — i.e. the branch holds no work that isn't already
+ * landed. Used by the stranded-branch sweep (branchSweep.cjs) to tell a
+ * genuinely stranded `sm-job/*` branch from one that's already a no-op.
+ * Never throws; a branch that doesn't exist, or any other git failure, is
+ * conservatively reported as NOT merged so a caller never treats an
+ * unreadable branch as safe to skip.
+ */
+async function isBranchMergedIntoHead(cwd, branch) {
+  try {
+    const branchHead = (await execGit(['rev-parse', '--verify', branch], { cwd, timeout: 10_000 })).trim();
+    const mergeBase = (await execGit(['merge-base', 'HEAD', branch], { cwd, timeout: 10_000 })).trim();
+    return mergeBase !== '' && mergeBase === branchHead;
+  } catch {
+    return false;
+  }
+}
+
 /** Parse `git worktree list --porcelain` into `[{ worktree, branch }]`. */
 function parseWorktreeListPorcelain(text) {
   const entries = [];
@@ -914,10 +1017,12 @@ module.exports = {
   keyFromBranch,
   createWorktree,
   captureAndCarryBaseDiff,
+  pathsIdenticalToBranch,
   integrateBranch,
   cleanupWorktree,
   salvageWorktreeDiff,
   salvageDirtyDelta,
+  isBranchMergedIntoHead,
   parseWorktreeListPorcelain,
   reconcileWorktreesOnBoot,
   sweepStaleWorktreeCheckouts,

package/src/main/lib/landedSinceRun.cjs

@@ -52,4 +52,44 @@ function landedSinceRun(cwd, sinceIso, paths, { timeoutMs = LANDED_SINCE_RUN_TIM
   });
 }
 
-module.exports = { landedSinceRun, LANDED_SINCE_RUN_TIMEOUT_MS };
+/**
+ * Commits reachable from `main` in `cwd` since `sinceIso` that touch any of
+ * `paths` — the evidence query behind PRD 1136's already-satisfied-on-main
+ * commit-guard exemption. Deliberately narrower than landedSinceRun in one
+ * axis (scoped to `main`, not `--all` — a commit on a stray branch is not
+ * "satisfied") and identical in the other (path-scoped, so an unrelated
+ * commit elsewhere in the repo is never credited to this job).
+ *
+ * Falls back from local `main` to `origin/main` when the local branch ref
+ * doesn't exist (a worktree/CI checkout that never checked main out
+ * locally) — never throws either way; git-unavailable, a non-repo cwd, an
+ * unresolvable ref, or an empty `paths` list all resolve to `[]`.
+ *
+ * @param {string} cwd
+ * @param {string} sinceIso
+ * @param {string[]} paths
+ * @param {{ timeoutMs?: number }} [opts]
+ * @returns {Promise<string[]>} full commit SHAs, newest first
+ */
+function landedOnMainSince(cwd, sinceIso, paths, { timeoutMs = LANDED_SINCE_RUN_TIMEOUT_MS } = {}) {
+  const runLog = (ref) => new Promise((resolve) => {
+    execFile(
+      'git',
+      ['-C', cwd, 'log', ref, `--since=${sinceIso}`, '--format=%H', '--', ...paths],
+      { timeout: timeoutMs, windowsHide: true },
+      (err, stdout) => {
+        if (err) { resolve(null); return; }
+        resolve(String(stdout || '').trim().split('\n').filter(Boolean));
+      },
+    );
+  });
+  return (async () => {
+    if (!cwd || !sinceIso || !Array.isArray(paths) || paths.length === 0) return [];
+    const viaLocal = await runLog('main');
+    if (viaLocal !== null) return viaLocal;
+    const viaRemote = await runLog('origin/main');
+    return viaRemote ?? [];
+  })();
+}
+
+module.exports = { landedSinceRun, landedOnMainSince, LANDED_SINCE_RUN_TIMEOUT_MS };

package/src/main/lib/mcpToolCatalog.cjs

@@ -133,7 +133,10 @@ const MCP_TOOL_CATALOG = [
       + 'app\'s admin API. Refuses once a queue row exists for the slug and its status is anything but "pending" '
       + '(running/completed/failed/needs_review) — editing the spec under a live or already-finished executor is refused, '
       + 'not silently applied. Only recognized frontmatter keys (title, cwd, estimateMinutes, parallelGroup, '
-      + 'sourcePromptId, sourceTabId, tag) may be patched; unrecognized keys (e.g. dependsOn) round-trip unchanged.',
+      + 'sourcePromptId, sourceTabId, tag, dependsOn) may be patched; unrecognized keys round-trip unchanged. '
+      + 'Patching dependsOn to a non-empty array replaces it wholesale (validated against existing PRD slugs, '
+      + 'same resolver scheduler_create_prd uses); patching it to an explicit empty array CLEARS the dependency — '
+      + 'the safe way to fix a wrong dependsOn without archiving (which marks the PRD completed and wrongly frees its dependents).',
     whenToUse: 'Use to correct a PRD scope/estimate/tag before it starts running — e.g. before resetting a needs_review job whose spec needs to change.',
     whenNotToUse: 'Do not use once the job is running or terminal (completed/failed/needs_review) without first resetting it back to pending — the route refuses the edit.',
     exampleArgs: { slug: 'add-mcp-tool-catalog', frontmatter: { estimateMinutes: 45 } },

package/src/main/lib/prdCreate.cjs

@@ -28,6 +28,17 @@ const { appendAuditEvent } = require('./auditLog.cjs');
 const { resolveProjectContext } = require('./projectRootResolve.cjs');
 const { fixChainDepthOf, baseSlugOf } = require('./fixChainDepth.cjs');
 const { DEFAULT_PRD_AGENT_TYPE, assertAgentTypeWritable } = require('./prdAgentType.cjs');
+const { resolveDepSlug, findNearMatches } = require('./depSlugResolve.cjs');
+const { isFixPlanSlug } = require('./fixPlanSlug.cjs');
+
+// A caller-supplied slug that already starts with its own `NN-` (e.g.
+// "254-perf-x") used to silently become the double-prefixed row
+// "254-254-perf-x" once allocateParallelGroup() prepended the REAL
+// allocated NN — PRD_CREATE_SLUG_RE only enforces kebab-case shape, so it
+// never caught this. Refused outright rather than auto-stripped: silently
+// rewriting the caller's slug would hide the same mistake the old behavior
+// hid, just one layer further down.
+const SLUG_HAS_NN_PREFIX_RE = /^(\d+)-/;
 
 // Fix-chain depth cap (PRD 1113): a fix-of-a-fix (depth >= 2) is refused at
 // this shared write path rather than caught later — scheduler.cjs's
@@ -157,7 +168,7 @@ function resolveSourcePromptIdFromClaudeSession(cwd, claudeSessionId) {
  * the renderer-facing IPC handler (chat:create-prd, index.cjs) so the
  * validation/write logic lives in exactly one place (API-reuse standard).
  * `input` must already be schema-validated by the caller (schemas.schedulerCreatePrd).
- * `remote` is scheduler.cjs's remote object (allocateParallelGroup/readPrd/writePrd).
+ * `remote` is scheduler.cjs's remote object (allocateParallelGroup/readPrd/writePrd/listPrds).
  *
  * Returns `{ ok: true, nn, filename }` on success, or `{ ok: false, status, error }`
  * on failure — `status` is the HTTP status code the caller should map errors to
@@ -226,6 +237,18 @@ async function createPrd(input, remote) {
     if (fallback) input = { ...input, sourcePromptId: fallback };
   }
 
+  if (input.slug) {
+    const nnMatch = SLUG_HAS_NN_PREFIX_RE.exec(input.slug);
+    if (nnMatch) {
+      return {
+        ok: false,
+        status: 400,
+        error: `slug "${input.slug}" already starts with a numeric prefix "${nnMatch[1]}-" — the allocator ` +
+          `owns the NN- prefix, not the caller. Pass the bare name instead (e.g. "${input.slug.slice(nnMatch[0].length)}").`,
+      };
+    }
+  }
+
   const slug = input.slug || deriveSlugFromTitle(input.title);
   if (!slug || !PRD_CREATE_SLUG_RE.test(slug)) {
     return { ok: false, status: 400, error: 'could not derive a valid kebab-case slug from title; supply "slug" explicitly' };
@@ -243,10 +266,10 @@ async function createPrd(input, remote) {
   const filenameSlug = `${nn}-${slug}`;
 
   // Fix-chain depth guard (PRD 1113): refuse a fix-of-a-fix before it's ever
-  // written. depth 0/1 pass through unchanged (an ordinary PRD, or a first
-  // fix-plan, is never blocked); depth >= 2 means the base job has already
-  // failed to close via at least one prior fix attempt for reasons a repeat
-  // attempt won't resolve.
+  // written. depth >= 2 means the base job has already failed to close via
+  // at least one prior fix attempt for reasons a repeat attempt won't
+  // resolve — checked first so this distinct, human-escalation error still
+  // wins over the more general fix-plan-slug guard below for that shape.
   const chainDepth = fixChainDepthOf(filenameSlug);
   if (chainDepth > FIX_CHAIN_DEPTH_CAP) {
     const base = baseSlugOf(filenameSlug);
@@ -259,6 +282,29 @@ async function createPrd(input, remote) {
     };
   }
 
+  // Fix-plan-slug collision guard (PRD 1131): a caller-supplied or
+  // title-derived slug that happens to start with "fix-" collides with the
+  // scheduler's own NN-fix-... naming convention for fix plans it authors
+  // itself (spawnInvestigation) — and that shape carries real special-case
+  // semantics (depth-capped auto-investigation eligibility,
+  // commitGuardVerdict's zero-edit exemption) that a PRD authored through
+  // this API never asked for. Refused outright, not silently renamed, same
+  // fail-closed posture as the SLUG_HAS_NN_PREFIX_RE check above (PRD 1126:
+  // "126-fix-plan-death-reopens-parent" was wrongly stamped
+  // investigationDepth before it ever ran and had to be withdrawn). This
+  // subsumes the depth-1 case the chain-depth guard above deliberately let
+  // through (MAX_INVESTIGATION_DEPTH=1 means a first fix-plan is legitimate
+  // — but only when spawnInvestigation authors it, never through this API).
+  if (isFixPlanSlug(filenameSlug)) {
+    return {
+      ok: false,
+      status: 400,
+      error: `slug "${filenameSlug}" collides with the reserved NN-fix-... fix-plan naming convention ` +
+        '(reserved for PRDs the scheduler\'s own investigation loop authors itself). Reword the title/slug ' +
+        'so it does not start with "fix-" — e.g. "resolve-x" or "repair-x" instead of "fix-x".',
+    };
+  }
+
   // An explicit `parallelGroup` bypasses allocateParallelGroup()'s
   // collision-proof reservation, so re-check for an existing file at
   // this exact destination before writing — remote.writePrd itself has
@@ -284,6 +330,39 @@ async function createPrd(input, remote) {
     }
   }
 
+  // Write-time FK check for dependsOn (report on read / throw on write — see
+  // prdAgentType.cjs's header): every entry must resolve to a PRD that
+  // actually exists in this project, using the SAME resolution rule
+  // schedulerBatch.cjs's findBlockingDep applies at run time (exact slug,
+  // else bare-name after stripping one leading `NN-`) — a dep that
+  // validates here is guaranteed to be a dep findBlockingDep can actually
+  // see later. A listPrds() read failure is skipped-with-a-warning, never a
+  // write outage: an I/O hiccup on the read side must not block every PRD
+  // write in the project.
+  if (input.dependsOn && input.dependsOn.length) {
+    let listing;
+    try {
+      listing = await remote.listPrds({ cwd: input.cwd, limit: Number.MAX_SAFE_INTEGER });
+    } catch (e) {
+      console.warn(`[prdCreate] dependsOn validation skipped (listPrds failed): ${e?.message ?? e}`);
+      listing = null;
+    }
+    if (listing) {
+      const candidateSlugs = (listing.prds ?? []).map((p) => p.slug);
+      for (const dep of input.dependsOn) {
+        if (resolveDepSlug(dep, candidateSlugs).length > 0) continue;
+        const near = findNearMatches(dep, candidateSlugs);
+        const suggestion = near.length ? ` Closest existing slug(s): ${near.join(', ')}.` : '';
+        return {
+          ok: false,
+          status: 400,
+          error: `dependsOn entry "${dep}" does not resolve to any existing PRD in this project.${suggestion} ` +
+            'Pass the bare name (preferred) or the exact NN-prefixed slug of an existing PRD.',
+        };
+      }
+    }
+  }
+
   const body = buildPrdBody(input);
   const writeResult = await remote.writePrd(filenameSlug, body, input.cwd);
   if (!writeResult?.ok) {

package/src/main/lib/prdFrontmatter.cjs

@@ -62,7 +62,7 @@ function splitFrontmatter(raw) {
  * either surface never reorders or drops a key it didn't touch. Recognized
  * key set intentionally mirrors the TS module exactly (title, cwd,
  * estimateMinutes, parallelGroup, sourcePromptId, sourceTabId, tag,
- * agentType, createdVia, issuedAt); every other frontmatter key (e.g. dependsOn)
+ * agentType, createdVia, issuedAt, dependsOn); every other frontmatter key
  * round-trips via `extras`, same as the renderer's editor today.
  *
  * `createdVia`/`issuedAt` (PRD provenance-lockdown) are recognized here so
@@ -70,10 +70,15 @@ function splitFrontmatter(raw) {
  * after creation — see prdCreate.cjs's buildPrdBody for the create-time
  * stamp) round-trips them like any other known key rather than shunting them
  * into `extras`.
+ *
+ * `dependsOn` (PRD 1124) is the first ARRAY-valued recognized key — parsed/
+ * emitted only in its inline `[a, b]` list form (the sole form prdCreate.cjs
+ * ever writes; block-style YAML lists are out of scope). An empty array is
+ * never emitted, which is how `scheduler_update_prd` clears a dependency.
  */
 
-const RECOGNIZED_KEYS = new Set(['title', 'cwd', 'estimateMinutes', 'parallelGroup', 'sourcePromptId', 'sourceTabId', 'tag', 'agentType', 'createdVia', 'issuedAt', 'quietMachine']);
-const EMIT_ORDER = ['title', 'cwd', 'estimateMinutes', 'parallelGroup', 'sourcePromptId', 'sourceTabId', 'tag', 'agentType', 'createdVia', 'issuedAt', 'quietMachine'];
+const RECOGNIZED_KEYS = new Set(['title', 'cwd', 'estimateMinutes', 'parallelGroup', 'sourcePromptId', 'sourceTabId', 'tag', 'agentType', 'createdVia', 'issuedAt', 'dependsOn', 'quietMachine']);
+const EMIT_ORDER = ['title', 'cwd', 'estimateMinutes', 'parallelGroup', 'sourcePromptId', 'sourceTabId', 'tag', 'agentType', 'createdVia', 'issuedAt', 'dependsOn', 'quietMachine'];
 const FRONTMATTER_RE = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/;
 
 function indentOf(line) {
@@ -99,6 +104,28 @@ function parseScalar(raw) {
   return v;
 }
 
+/**
+ * Parse the inline `[a, b]` list form used by `dependsOn` — the sole form
+ * prdCreate.cjs's buildPrdBody ever writes. Returns null (not recognized as
+ * a list) when `raw` isn't bracketed, so a hand-edited non-list value is
+ * left unset rather than mis-parsed.
+ */
+function parseInlineList(raw) {
+  const v = raw.trim();
+  if (!v.startsWith('[') || !v.endsWith(']')) return null;
+  const inner = v.slice(1, -1).trim();
+  if (inner === '') return [];
+  return inner
+    .split(',')
+    .map((s) => s.trim().replace(/^(['"])(.*)\1$/, '$2'))
+    .filter((s) => s.length > 0);
+}
+
+function arraysEqual(a, b) {
+  if (!Array.isArray(a) || !Array.isArray(b)) return false;
+  return a.length === b.length && a.every((v, i) => v === b[i]);
+}
+
 function applyKey(fm, key, after) {
   const v = parseScalar(after);
   if (v === null) return;
@@ -138,6 +165,13 @@ function applyKey(fm, key, after) {
     case 'issuedAt':
       fm.issuedAt = String(v);
       return;
+    case 'dependsOn': {
+      // Only the inline `[a, b]` list form is recognized (see parseInlineList's
+      // header) — a malformed/hand-edited non-list value is left unset.
+      const list = parseInlineList(after);
+      if (list) fm.dependsOn = list;
+      return;
+    }
     case 'quietMachine':
       // Opt-in exclusive-lease flag (PRD 1107) — only a literal `true`
       // frontmatter value opts in; anything else (including an explicit
@@ -180,10 +214,17 @@ function parsePrdFile(text) {
 
     if (RECOGNIZED_KEYS.has(key)) {
       applyKey(fm, key, after);
-      const parsed = parseScalar(after);
-      if (parsed !== null && (typeof parsed === 'string' || typeof parsed === 'number')) {
-        if (!fm._raw) fm._raw = {};
-        fm._raw[key] = { line, parsed };
+      if (key === 'dependsOn') {
+        if (fm.dependsOn) {
+          if (!fm._raw) fm._raw = {};
+          fm._raw[key] = { line, parsed: fm.dependsOn };
+        }
+      } else {
+        const parsed = parseScalar(after);
+        if (parsed !== null && (typeof parsed === 'string' || typeof parsed === 'number')) {
+          if (!fm._raw) fm._raw = {};
+          fm._raw[key] = { line, parsed };
+        }
       }
     } else {
       extras[key] = { lines: band };
@@ -218,8 +259,11 @@ function serializePrdFile(fm, body) {
   for (const key of EMIT_ORDER) {
     const v = fm[key];
     if (v === undefined || v === null || v === '') continue;
+    // An empty dependsOn array is how scheduler_update_prd CLEARS the
+    // dependency — never emitted, same as an absent key.
+    if (Array.isArray(v) && v.length === 0) continue;
     const cached = fm._raw?.[key];
-    if (cached && cached.parsed === v) {
+    if (cached && (Array.isArray(v) ? arraysEqual(cached.parsed, v) : cached.parsed === v)) {
       out.push(cached.line);
       continue;
     }
@@ -227,6 +271,10 @@ function serializePrdFile(fm, body) {
       out.push(`${key}: ${v}`);
       continue;
     }
+    if (Array.isArray(v)) {
+      out.push(`${key}: [${v.join(', ')}]`);
+      continue;
+    }
     out.push(`${key}: ${serializeScalar(v)}`);
   }
   if (fm.extras) {

package/src/main/lib/queueHistory.cjs

@@ -15,6 +15,7 @@ const path = require('path');
 const fsp = require('fs').promises;
 const { HISTORY_RETENTION_MS } = require('./schedulerConfig.cjs');
 const { projectHistoryPath, stateCwds } = require('./queueStore.cjs');
+const { resolveIsFixPlan } = require('./fixPlanSlug.cjs');
 
 // Legacy global sidecar — READ-ONLY since 2026-07-31 (federated per-project
 // history under <cwd>/session-manager-operations/scheduler/state/history.jsonl,
@@ -52,10 +53,6 @@ function historyPathFor(entry) {
   return HISTORY_PATH;
 }
 
-function isFixPlanSlug(slug) {
-  return /^\d+-fix-/.test(slug);
-}
-
 function jobKey(job) {
   return `${job?.slug ?? ''}|${job?.runId ?? ''}`;
 }
@@ -79,9 +76,13 @@ function partitionJobs(jobs, nowMs, opts = {}) {
 
   // Slugs of jobs that a still-pending/running fix-plan is going to try to
   // heal (see healTargetForFix in scheduler.cjs — same regex, kept in sync).
+  // Honors the job's own persisted `isFixPlan` provenance stamp (PRD 1131)
+  // over the slug shape, same as every other fix-plan consumer in
+  // scheduler.cjs — a slug that merely starts with "fix-" but was classified
+  // isFixPlan:false must not get treated as a real fix-plan here either.
   const protectedSlugs = new Set();
   for (const j of list) {
-    if (!j || !isFixPlanSlug(j.slug)) continue;
+    if (!j || !resolveIsFixPlan(j.slug, j.isFixPlan)) continue;
     if (j.status !== 'pending' && j.status !== 'running') continue;
     protectedSlugs.add(j.slug.replace(/^(\d+)-fix-/, '$1-'));
   }
@@ -269,10 +270,54 @@ async function historyTerminalBySlug() {
   return map;
 }
 
+/**
+ * completedSlugsForCwd(cwd) → Set<string> of every slug whose most recent
+ * appended record in THIS project's own history shard
+ * (`<cwd>/session-manager-operations/scheduler/state/history.jsonl`, via
+ * projectHistoryPath) has status 'completed'. Scoped to one project's shard
+ * — unlike historyTerminalBySlug's federated, machine-wide map — because
+ * this feeds PRD 1122's dependsOn history lookup, where a same-named PRD in
+ * an unrelated project must never count as satisfying a dep. Missing file
+ * (ENOENT) returns an empty Set, not an error — a project with no history
+ * yet is not a read failure.
+ */
+async function completedSlugsForCwd(cwd) {
+  let text = '';
+  try {
+    text = await fsp.readFile(projectHistoryPath(cwd), 'utf8');
+  } catch (e) {
+    if (e.code === 'ENOENT') return new Set();
+    throw e;
+  }
+  // Last-line-wins per slug (file is append-only chronological) — same
+  // pattern as historyTerminalBySlug above. A slug can legitimately appear
+  // more than once (scheduler_reset_job resets a completed row back to
+  // pending, it runs again, and eventually re-retires to history) — unioning
+  // every 'completed' line ever seen, without letting a LATER 'failed' line
+  // for the same slug revoke it, would keep a since-refailed dep permanently
+  // satisfied for its dependents.
+  const statusBySlug = new Map();
+  for (const line of text.split('\n')) {
+    if (!line.trim()) continue;
+    try {
+      const j = JSON.parse(line);
+      if (j?.slug) statusBySlug.set(j.slug, j.status);
+    } catch {
+      // corrupt/partial line — ignore
+    }
+  }
+  const slugs = new Set();
+  for (const [slug, status] of statusBySlug) {
+    if (status === 'completed') slugs.add(slug);
+  }
+  return slugs;
+}
+
 module.exports = {
   HISTORY_PATH,
   partitionJobs,
   appendHistory,
   readHistory,
   historyTerminalBySlug,
+  completedSlugsForCwd,
 };

package/src/main/lib/rateLimitWindow.cjs

@@ -0,0 +1,62 @@
+'use strict';
+
+/**
+ * rateLimitWindow.cjs — reads the BINDING rate-limit window's reset time
+ * straight off a run's own log, instead of trusting the billing usage
+ * endpoint's five_hour window (PRD 1118). A run can be 429'd by a
+ * different window than five_hour (seven_day, seven_day_overage_included)
+ * while five_hour utilization is still 0 — pausing against five_hour's
+ * reset in that case arms the resume timer against the wrong clock, and
+ * the billing endpoint can itself be 429'ing when this is needed most.
+ *
+ * Pure: log path in, reset value out. No electron import, so it is
+ * unit-testable without scheduler.cjs (mirrors reaperHelpers.cjs's split).
+ */
+
+const { readTail } = require('./fileTail.cjs');
+
+// Authoritative window block rides on the LAST rate_limit_event in the log
+// (often the one attached to the final result), so mirror classifyRunOutcome's
+// 64 KB tail rather than detectRateLimitInLog's smaller 16 KB one.
+const TAIL_BYTES = 64 * 1024;
+
+/**
+ * Scans a run log's tail for rate_limit_event entries and returns the
+ * UNIX-seconds resetsAt of the window that actually bound (utilization >= 1.0)
+ * in the LAST such event. When multiple windows bind in that event, the
+ * latest resetsAt wins. Returns null when no rate_limit_event is found, or
+ * none of its windows are at/above 1.0 utilization.
+ */
+function resolveBindingRateLimitReset(logPath) {
+  const text = readTail(logPath, TAIL_BYTES);
+  if (!text) return null;
+
+  let lastWindows = null;
+  for (const line of text.split('\n')) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed[0] !== '{') continue;
+    let event;
+    try {
+      event = JSON.parse(trimmed);
+    } catch {
+      continue;
+    }
+    const windows = event?.rate_limit_info?.unifiedWindows;
+    if (event?.type === 'rate_limit_event' && windows && typeof windows === 'object') {
+      lastWindows = windows;
+    }
+  }
+  if (!lastWindows) return null;
+
+  let latestBoundReset = null;
+  for (const window of Object.values(lastWindows)) {
+    if (!window || typeof window.utilization !== 'number' || typeof window.resetsAt !== 'number') continue;
+    if (window.utilization < 1.0) continue;
+    if (latestBoundReset === null || window.resetsAt > latestBoundReset) {
+      latestBoundReset = window.resetsAt;
+    }
+  }
+  return latestBoundReset;
+}
+
+module.exports = { resolveBindingRateLimitReset };