claude-code-session-manager 0.80.0 → 0.81.0

package/src/main/__tests__/scheduler-looks-done.test.cjs

@@ -33,7 +33,7 @@ const { execFileSync } = require('node:child_process');
 const tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'looks-done-test-'));
 process.env.HOME = tmpHome;
 
-const { reverifyNeedsReview, computeLooksDone } = require('../scheduler.cjs');
+const { reverifyNeedsReview, computeLooksDone, findSatisfyingCommitOnMain } = require('../scheduler.cjs');
 const { resolvePrdWriteDir } = require('../lib/prdLocations.cjs');
 const { bustCwdCache } = require('../lib/queueStore.cjs');
 
@@ -51,6 +51,18 @@ function initRepo(dir) {
   git(['commit', '-q', '-m', 'initial'], dir);
 }
 
+// -b main pins the branch name regardless of the host's init.defaultBranch
+// config — findSatisfyingCommitOnMain's tests need a deterministic 'main' ref.
+function initRepoOnMain(dir) {
+  fs.mkdirSync(dir, { recursive: true });
+  git(['init', '-q', '-b', 'main'], dir);
+  git(['config', 'user.email', 'test@example.com'], dir);
+  git(['config', 'user.name', 'Test'], dir);
+  fs.writeFileSync(path.join(dir, 'README.md'), 'hello\n', 'utf8');
+  git(['add', '-A'], dir);
+  git(['commit', '-q', '-m', 'initial'], dir);
+}
+
 function commitFile(dir, relPath, content, message) {
   const abs = path.join(dir, relPath);
   fs.mkdirSync(path.dirname(abs), { recursive: true });
@@ -228,6 +240,134 @@ test('computeLooksDone: no declared paths on the PRD → null, never fabricates
   assert.equal(looksDone, null);
 });
 
+test('needs_review row with autoFixAttempted:true is never also stamped looksDone (PRD 1136 — mutually exclusive)', async () => {
+  const projectCwd = path.join(tmpHome, 'proj-already-fix-planned');
+  initRepo(projectCwd);
+  registerActiveProject(projectCwd, 'proj-already-fix-planned-slug');
+  writePrd(projectCwd, '30-example', [
+    '# Implementation notes',
+    'Edit `src/thing.js`.',
+  ].join('\n'));
+
+  // startedAt/finishedAt are fixed well in the past so the real-time commit
+  // below lands outside committedInWindow's [startedAt, finishedAt+60s]
+  // window — otherwise the pre-existing heal pass would auto-complete the
+  // row before ever reaching the stillOpen/looksDone branch this test
+  // targets (committedInWindow, unlike computeLooksDone's landedSinceRun,
+  // has no upper bound skip).
+  const startedAt = '2020-01-01T00:00:00.000Z';
+  const queuePath = writeProjectQueue(projectCwd, [
+    {
+      slug: '30-example',
+      status: 'needs_review',
+      cwd: projectCwd,
+      runId: 'run-30',
+      startedAt,
+      finishedAt: '2020-01-01T00:05:00.000Z',
+      verifierVerdict: 'transcript_errors',
+      error: 'transcript_errors: stale verdict',
+      // A fix-plan child was already minted for this row at finalize time —
+      // the exact ordering that always precedes a later reverifyNeedsReview
+      // pass, since autoFixAttempted is stamped synchronously in the same
+      // mutate() as the needs_review transition itself.
+      autoFixAttempted: true,
+    },
+  ]);
+  writeRunLog('run-30', '30-example', [
+    '[scheduler] starting 30-example',
+    JSON.stringify({ type: 'result', subtype: 'error_during_execution', is_error: true, result: 'still broken' }),
+  ]);
+
+  commitFile(projectCwd, 'src/thing.js', 'hello', 'later commit touching the declared path');
+
+  await reverifyNeedsReview();
+
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  assert.equal(jobs.length, 1);
+  assert.equal(jobs[0].status, 'needs_review');
+  assert.equal(jobs[0].looksDone, undefined, 'a row already fix-planned must never also be stamped looksDone');
+  assert.equal(jobs[0].error, 'transcript_errors: stale verdict', 'the looksDone annotation must not overwrite the original error');
+});
+
+// findSatisfyingCommitOnMain — PRD 1136's already-satisfied-on-main evidence
+// query. Requires EVERY declared path to have landed on main since
+// queuedAt, not just one — a code-review finding (2026-09-07) confirmed
+// that a PRD citing both its real target file and a second file purely as
+// context (e.g. a `path/to/file.js:123` reference) would otherwise
+// auto-complete unattended off any unrelated commit touching only that
+// second, incidental file.
+
+test('findSatisfyingCommitOnMain: single declared path, satisfying commit lands on main → returns the sha', async () => {
+  const projectCwd = path.join(tmpHome, 'proj-satisfied-single-path');
+  initRepoOnMain(projectCwd);
+  registerActiveProject(projectCwd, 'proj-satisfied-single-path-slug');
+  writePrd(projectCwd, '40-single-path', [
+    '# Implementation notes',
+    'Edit `src/real-work.js`.',
+  ].join('\n'));
+
+  const queuedAt = new Date().toISOString();
+  await wait(1100);
+  commitFile(projectCwd, 'src/real-work.js', 'hello', 'fix real-work');
+
+  const job = { slug: '40-single-path', cwd: projectCwd, queuedAt };
+  const commits = await findSatisfyingCommitOnMain(job);
+  assert.equal(commits.length, 1);
+});
+
+test('findSatisfyingCommitOnMain: two declared paths but only ONE lands → [] (not satisfied — no false completion off an incidental context citation)', async () => {
+  const projectCwd = path.join(tmpHome, 'proj-satisfied-partial-path');
+  initRepoOnMain(projectCwd);
+  registerActiveProject(projectCwd, 'proj-satisfied-partial-path-slug');
+  writePrd(projectCwd, '41-partial-path', [
+    '# Implementation notes',
+    'Edit `src/real-work.js`. See `src/main/hotfile.js:123` for context.',
+  ].join('\n'));
+
+  const queuedAt = new Date().toISOString();
+  await wait(1100);
+  // Only the incidentally-cited context file gets a later, UNRELATED commit
+  // — the actual target path (src/real-work.js) never lands.
+  commitFile(projectCwd, 'src/main/hotfile.js', 'unrelated change', 'unrelated commit');
+
+  const job = { slug: '41-partial-path', cwd: projectCwd, queuedAt };
+  const commits = await findSatisfyingCommitOnMain(job);
+  assert.deepEqual(commits, [], 'partial path coverage must never be treated as satisfied');
+});
+
+test('findSatisfyingCommitOnMain: two declared paths, BOTH land → returns satisfying commits', async () => {
+  const projectCwd = path.join(tmpHome, 'proj-satisfied-both-paths');
+  initRepoOnMain(projectCwd);
+  registerActiveProject(projectCwd, 'proj-satisfied-both-paths-slug');
+  writePrd(projectCwd, '42-both-paths', [
+    '# Implementation notes',
+    'Edit `src/real-work.js` and `src/main/hotfile.js`.',
+  ].join('\n'));
+
+  const queuedAt = new Date().toISOString();
+  await wait(1100);
+  commitFile(projectCwd, 'src/real-work.js', 'hello', 'fix real-work');
+  commitFile(projectCwd, 'src/main/hotfile.js', 'hello', 'fix hotfile too');
+
+  const job = { slug: '42-both-paths', cwd: projectCwd, queuedAt };
+  const commits = await findSatisfyingCommitOnMain(job);
+  assert.ok(commits.length >= 1, 'full path coverage must be treated as satisfied');
+});
+
+test('findSatisfyingCommitOnMain: no queuedAt on the job → [] without querying git', async () => {
+  const projectCwd = path.join(tmpHome, 'proj-no-queued-at');
+  initRepoOnMain(projectCwd);
+  registerActiveProject(projectCwd, 'proj-no-queued-at-slug');
+  writePrd(projectCwd, '43-no-queued-at', [
+    '# Implementation notes',
+    'Edit `src/thing.js`.',
+  ].join('\n'));
+
+  const job = { slug: '43-no-queued-at', cwd: projectCwd };
+  const commits = await findSatisfyingCommitOnMain(job);
+  assert.deepEqual(commits, []);
+});
+
 test('computeLooksDone: non-git cwd → null without throwing (git-unavailable)', async () => {
   const notARepo = fs.mkdtempSync(path.join(tmpHome, 'not-a-repo-'));
   writePrd(notARepo, '11-no-repo', [

package/src/main/__tests__/scheduler-rate-limit-pause.test.cjs

@@ -0,0 +1,81 @@
+/**
+ * scheduler-rate-limit-pause.test.cjs — PRD 1118: pause against the BINDING
+ * rate-limit window read off a run's own log, not refreshNextReset()'s
+ * five_hour-only assumption, and never leave an indefinite pause with no
+ * resume timer when both the log and the billing endpoint come up empty
+ * (the live failure mode: the usage endpoint itself 429s).
+ *
+ * These test the PURE decision functions scheduler.cjs's setPaused() and the
+ * spawnJob() rateLimited branch delegate to — never the real setPaused/mutate
+ * path, which writes the machine's live scheduler queue.json at a fixed
+ * homedir path (~/.claude/session-manager/scheduled-plans) and must not be
+ * touched by a test run.
+ *
+ * Run: timeout 120 npx vitest run src/main/__tests__/scheduler-rate-limit-pause.test.cjs
+ */
+
+'use strict';
+
+import { test } from 'vitest';
+const assert = require('node:assert/strict');
+const path = require('node:path');
+const {
+  resolveRateLimitPauseReset,
+  computeEffectiveResumeAt,
+  computeResumeDelay,
+} = require('../scheduler.cjs');
+
+// Repo-tracked, byte-for-byte copy of the real 2026-09-05 starry-night-ships
+// incident log (see src/main/lib/__tests__/rateLimitWindow.test.cjs for the
+// live-path parity check) — kept hermetic rather than pointed at the
+// machine-local live path directly.
+const FIXTURE = path.join(__dirname, '..', 'lib', '__tests__', 'fixtures', '204-mercury-steam-horse.log.txt');
+const FIVE_HOUR_ISO = new Date(1788643800 * 1000).toISOString(); // what refreshNextReset() would have returned
+const SEVEN_DAY_ISO = new Date(1789059600 * 1000).toISOString(); // the actually-binding window
+
+test('resolveRateLimitPauseReset: prefers the log-derived seven-day reset over the billing five_hour reset', () => {
+  const resetIso = resolveRateLimitPauseReset(FIXTURE, FIVE_HOUR_ISO);
+  assert.strictEqual(resetIso, SEVEN_DAY_ISO);
+  assert.notStrictEqual(resetIso, FIVE_HOUR_ISO);
+});
+
+test('resolveRateLimitPauseReset: falls back to the billing reset when the log yields none', () => {
+  const resetIso = resolveRateLimitPauseReset('/nonexistent/path/job.log', FIVE_HOUR_ISO);
+  assert.strictEqual(resetIso, FIVE_HOUR_ISO);
+});
+
+test('resolveRateLimitPauseReset: null when BOTH the log and the billing endpoint are unavailable', () => {
+  assert.strictEqual(resolveRateLimitPauseReset('/nonexistent/path/job.log', null), null);
+});
+
+test('computeEffectiveResumeAt: rate_limit with no resumeAt gets the same bounded 30-minute fallback as network', () => {
+  const now = Date.parse('2026-09-05T16:32:00.000Z');
+  const resumeAt = computeEffectiveResumeAt('rate_limit', null, now);
+  assert.strictEqual(resumeAt, new Date(now + 30 * 60_000).toISOString());
+});
+
+test('computeEffectiveResumeAt: an explicit resumeAt (the log-derived reset) is never overridden', () => {
+  const resumeAt = computeEffectiveResumeAt('rate_limit', SEVEN_DAY_ISO, Date.now());
+  assert.strictEqual(resumeAt, SEVEN_DAY_ISO);
+});
+
+test('computeEffectiveResumeAt: other reasons (e.g. auth) get no fallback — stays indefinite', () => {
+  assert.strictEqual(computeEffectiveResumeAt('auth', null, Date.now()), null);
+});
+
+test('computeResumeDelay: a seven-day-out reset (~5 days from now) is armed, not treated as too-far', () => {
+  const now = Date.parse('2026-09-05T16:32:00.000Z');
+  // ~5 days out — comfortably under the 0x7fffffff (~24.8 day) setTimeout cap.
+  const fiveDaysOut = new Date(now + 5 * 24 * 60 * 60_000).toISOString();
+  const { delayMs, tooFar } = computeResumeDelay(fiveDaysOut, now);
+  assert.strictEqual(tooFar, false);
+  assert.ok(delayMs < 0x7fffffff, `expected delay under setTimeout cap, got ${delayMs}`);
+  assert.ok(delayMs > 400_000_000, `expected ~5 days in ms, got ${delayMs}`);
+});
+
+test('computeResumeDelay: a reset far enough out DOES trip the overflow guard', () => {
+  const now = Date.parse('2026-09-05T16:32:00.000Z');
+  const thirtyDaysOut = new Date(now + 30 * 24 * 60 * 60_000).toISOString();
+  const { tooFar } = computeResumeDelay(thirtyDaysOut, now);
+  assert.strictEqual(tooFar, true);
+});

package/src/main/__tests__/scheduler-reap-dead-running-jobs.test.cjs

@@ -223,7 +223,11 @@ test('reapDeadRunningJobs salvages a delta-scoped in-place patch (PRD 1098) when
 
   const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
   const row = jobs.find((j) => j.slug === 'vanished-inplace');
-  assert.equal(row.status, 'completed');
+  // PRD 1133: a successful-looking reap that left everything uncommitted
+  // (no branch, HEAD never moved) must never read as 'completed' — this is
+  // exactly the dangerous shape the reaper now proves against.
+  assert.equal(row.status, 'needs_review');
+  assert.equal(row.verifierVerdict, 'reaped_without_integration');
   assert.ok(row.salvagePatch, 'a salvage patch must be recorded on the row');
   assert.ok(fs.existsSync(row.salvagePatch));
   const patch = fs.readFileSync(row.salvagePatch, 'utf8');
@@ -332,8 +336,207 @@ test('reapDeadRunningJobs skips in-place salvage (no whole-tree dump) when the r
 
   const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
   const row = jobs.find((j) => j.slug === 'vanished-no-baseline');
-  assert.equal(row.status, 'completed');
+  // PRD 1133: no commit landed (HEAD never moved) — must not read as 'completed'
+  // just because the log's own result event looked clean.
+  assert.equal(row.status, 'needs_review');
+  assert.equal(row.verifierVerdict, 'reaped_without_integration');
   assert.equal(row.salvagePatch, undefined, 'must skip salvage entirely rather than ever dumping the whole tree');
   assert.equal(row.leftoverPaths, undefined, 'no baseline means no safe attribution — must not guess');
   assert.equal(row.leftoverCount, undefined);
 });
+
+// ---------- PRD 1133: reaper must prove integration before 'completed' ----------
+
+test('reapDeadRunningJobs: a worktree job shaped like PRD 1118 (branch un-integrated, landedCommit absent) comes out needs_review, naming the branch, and never merges it', async () => {
+  const projectCwd = path.join(tmpHome, 'i-project-1118-shape');
+  initRepo(projectCwd);
+  registerActiveProject(projectCwd);
+
+  const headBefore = git(['rev-parse', 'HEAD'], projectCwd).trim();
+  const slug = '1118-pause-until-the-binding-rate-limit-window';
+  const branch = `sm-job/${slug}`;
+  // Simulate the job's own worktree branch: one real commit, never merged
+  // back into the main tree (exactly the live 1118 shape — "one real commit,
+  // +301", stranded on sm-job/1118-... with landedCommit undefined).
+  git(['checkout', '-b', branch], projectCwd);
+  fs.writeFileSync(path.join(projectCwd, 'rateLimitWindow.cjs'), 'module.exports = {};\n', 'utf8');
+  git(['add', '-A'], projectCwd);
+  git(['commit', '-q', '-m', 'add rateLimitWindow.cjs'], projectCwd);
+  // Back to the original tip (detached is fine — reap only reads guardCwd's
+  // current HEAD, it never needs a named branch checked out).
+  git(['checkout', headBefore], projectCwd);
+
+  const runId = `run-${slug}`;
+  const queuePath = writeProjectQueue(projectCwd, [
+    {
+      slug,
+      status: 'running',
+      cwd: projectCwd,
+      runId,
+      runtime: { pid: 999999 }, // guaranteed-dead pid
+      guardHeadBefore: headBefore,
+      startedAt: new Date(Date.now() - 60_000).toISOString(),
+    },
+  ]);
+  writeRunLog(runId, slug, ['{"type":"result","subtype":"success","result":"done","is_error":false}']);
+
+  bustCwdCache();
+  await reapDeadRunningJobs();
+
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  const row = jobs.find((j) => j.slug === slug);
+  assert.equal(row.status, 'needs_review', 'a successful-looking result event must not be enough on its own');
+  assert.equal(row.verifierVerdict, 'reaped_without_integration');
+  assert.match(row.error, new RegExp(branch.replace('/', '\\/')), 'the parked reason must name the branch that still holds the work');
+  assert.equal(row.landedCommit, undefined, 'nothing was actually merged, so landedCommit must stay unset');
+
+  // The branch itself must survive untouched — this reap must never attempt
+  // (let alone perform) the merge.
+  const branchStillExists = git(['rev-parse', '--verify', branch], projectCwd).trim();
+  assert.ok(branchStillExists, 'the un-integrated branch must be preserved, not merged or deleted, by a mere reap');
+  assert.equal(git(['rev-parse', 'HEAD'], projectCwd).trim(), headBefore, 'guardCwd HEAD must not have moved — no merge was performed');
+});
+
+test('reapDeadRunningJobs: a worktree job whose branch is already fully integrated into HEAD comes out completed, with landedCommit stamped', async () => {
+  const projectCwd = path.join(tmpHome, 'j-project-real-success');
+  initRepo(projectCwd);
+  registerActiveProject(projectCwd);
+
+  const headBefore = git(['rev-parse', 'HEAD'], projectCwd).trim();
+  const slug = 'real-successful-worktree-run';
+  const branch = `sm-job/${slug}`;
+  git(['checkout', '-b', branch], projectCwd);
+  fs.writeFileSync(path.join(projectCwd, 'feature.txt'), 'shipped\n', 'utf8');
+  git(['add', '-A'], projectCwd);
+  git(['commit', '-q', '-m', 'ship feature'], projectCwd);
+  git(['checkout', headBefore], projectCwd); // back to the pre-branch tip (detached)
+  // Simulate a normal completion pass having already integrated the branch
+  // (integrateJobBranch's own fast-forward path) BEFORE the process vanished
+  // between that merge and the queue write landing.
+  git(['merge', '--ff-only', branch], projectCwd);
+  const headAfterMerge = git(['rev-parse', 'HEAD'], projectCwd).trim();
+
+  const runId = `run-${slug}`;
+  const queuePath = writeProjectQueue(projectCwd, [
+    {
+      slug,
+      status: 'running',
+      cwd: projectCwd,
+      runId,
+      runtime: { pid: 999999 },
+      guardHeadBefore: headBefore,
+      startedAt: new Date(Date.now() - 60_000).toISOString(),
+    },
+  ]);
+  writeRunLog(runId, slug, ['{"type":"result","subtype":"success","result":"done","is_error":false}']);
+
+  bustCwdCache();
+  await reapDeadRunningJobs();
+
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  const row = jobs.find((j) => j.slug === slug);
+  assert.equal(row.status, 'completed', 'the branch is already an ancestor of HEAD — the work genuinely landed');
+  assert.equal(row.verifierVerdict, undefined);
+  assert.equal(row.landedCommit, headAfterMerge, 'HEAD advanced during the run window — landedCommit must be stamped');
+});
+
+test('reapDeadRunningJobs: a worktree job whose branch never diverged from its base (legitimate no-op) still completes, not punished', async () => {
+  const projectCwd = path.join(tmpHome, 'k-project-noop-worktree');
+  initRepo(projectCwd);
+  registerActiveProject(projectCwd);
+
+  const headBefore = git(['rev-parse', 'HEAD'], projectCwd).trim();
+  const slug = 'noop-worktree-job';
+  const branch = `sm-job/${slug}`;
+  // Branch created but nothing ever committed on it — a genuine no-op run.
+  git(['branch', branch], projectCwd);
+
+  const runId = `run-${slug}`;
+  const queuePath = writeProjectQueue(projectCwd, [
+    {
+      slug,
+      status: 'running',
+      cwd: projectCwd,
+      runId,
+      runtime: { pid: 999999 },
+      guardHeadBefore: headBefore,
+      startedAt: new Date(Date.now() - 60_000).toISOString(),
+    },
+  ]);
+  writeRunLog(runId, slug, ['{"type":"result","subtype":"success","result":"done","is_error":false}']);
+
+  bustCwdCache();
+  await reapDeadRunningJobs();
+
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  const row = jobs.find((j) => j.slug === slug);
+  assert.equal(row.status, 'completed', 'a branch with no new commits is a legitimate no-op, not a finish-protocol violation');
+  assert.equal(row.verifierVerdict, undefined);
+  assert.equal(row.landedCommit, undefined, 'HEAD never moved — nothing to stamp');
+});
+
+test('reapDeadRunningJobs: an in-place run in a git repo whose HEAD genuinely advanced during the run window completes, with landedCommit stamped', async () => {
+  const projectCwd = path.join(tmpHome, 'l-project-inplace-success');
+  initRepo(projectCwd);
+  registerActiveProject(projectCwd);
+
+  const headBefore = git(['rev-parse', 'HEAD'], projectCwd).trim();
+  const startedAt = new Date(Date.now() - 60_000).toISOString();
+  fs.writeFileSync(path.join(projectCwd, 'shipped.txt'), 'done\n', 'utf8');
+  git(['add', '-A'], projectCwd);
+  git(['commit', '-q', '-m', 'in-place job commit'], projectCwd);
+  const headAfter = git(['rev-parse', 'HEAD'], projectCwd).trim();
+
+  const slug = 'inplace-job-real-commit';
+  const runId = `run-${slug}`;
+  const queuePath = writeProjectQueue(projectCwd, [
+    {
+      slug,
+      status: 'running',
+      cwd: projectCwd,
+      runId,
+      runtime: { pid: 999999 },
+      guardHeadBefore: headBefore,
+      startedAt,
+    },
+  ]);
+  writeRunLog(runId, slug, ['{"type":"result","subtype":"success","result":"done","is_error":false}']);
+
+  bustCwdCache();
+  await reapDeadRunningJobs();
+
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  const row = jobs.find((j) => j.slug === slug);
+  assert.equal(row.status, 'completed');
+  assert.equal(row.verifierVerdict, undefined);
+  assert.equal(row.landedCommit, headAfter);
+});
+
+test('reapDeadRunningJobs: a non-git cwd skips the integration check entirely, preserving today\'s behaviour', async () => {
+  const projectCwd = path.join(tmpHome, 'm-project-non-git');
+  fs.mkdirSync(projectCwd, { recursive: true });
+  registerActiveProject(projectCwd);
+
+  const slug = 'non-git-cwd-job';
+  const runId = `run-${slug}`;
+  const queuePath = writeProjectQueue(projectCwd, [
+    {
+      slug,
+      status: 'running',
+      cwd: projectCwd,
+      runId,
+      runtime: { pid: 999999 },
+      // No git repo at all — the integration/HEAD-advance check must be
+      // skipped, never treated as a failure to prove landing.
+    },
+  ]);
+  writeRunLog(runId, slug, ['{"type":"result","subtype":"success","result":"done","is_error":false}']);
+
+  bustCwdCache();
+  await reapDeadRunningJobs();
+
+  const jobs = JSON.parse(fs.readFileSync(queuePath, 'utf8')).jobs;
+  const row = jobs.find((j) => j.slug === slug);
+  assert.equal(row.status, 'completed', 'a non-git cwd must keep today\'s behaviour — the check is meaningless there');
+  assert.equal(row.verifierVerdict, undefined);
+});

package/src/main/lib/__tests__/branchSweep.test.cjs

@@ -0,0 +1,164 @@
+/**
+ * branchSweep.test.cjs — PRD 1135: recovering `sm-job/<slug>` branches left
+ * stranded (unmerged, owning job row terminal or gone) never gets swept away
+ * by hand months later.
+ *
+ * Exercises the real `git` plumbing against throwaway repos under
+ * os.tmpdir() (fast — no network, no Electron).
+ *
+ * Run: timeout 120 npx vitest run src/main/lib/__tests__/branchSweep.test.cjs
+ */
+'use strict';
+
+import { test, expect, beforeEach, afterEach } from 'vitest';
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+const { sweepStrandedJobBranches } = require('../branchSweep.cjs');
+
+let tmpRoot;
+let repoCwd;
+let worktreeDir;
+
+function git(args, cwd) {
+  return execFileSync('git', args, { cwd, encoding: 'utf8' });
+}
+
+function initRepo(dir) {
+  fs.mkdirSync(dir, { recursive: true });
+  git(['init', '-q'], dir);
+  git(['config', 'user.email', 'test@example.com'], dir);
+  git(['config', 'user.name', 'Test'], dir);
+  fs.writeFileSync(path.join(dir, 'README.md'), 'hello\n', 'utf8');
+  git(['add', '-A'], dir);
+  git(['commit', '-q', '-m', 'initial'], dir);
+}
+
+beforeEach(() => {
+  tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-branchsweep-'));
+  repoCwd = path.join(tmpRoot, 'repo');
+  initRepo(repoCwd);
+  delete process.env.SM_BRANCH_SWEEP_DISABLE;
+});
+
+afterEach(() => {
+  if (worktreeDir && fs.existsSync(worktreeDir)) {
+    try { git(['worktree', 'remove', '--force', worktreeDir], repoCwd); } catch { /* best effort */ }
+  }
+  worktreeDir = undefined;
+  delete process.env.SM_BRANCH_SWEEP_DISABLE;
+  fs.rmSync(tmpRoot, { recursive: true, force: true });
+});
+
+/** Create an `sm-job/<slug>` branch with one commit beyond HEAD, without checking it out. */
+function makeStrandedBranch(cwd, slug, fileContents = 'stranded work\n') {
+  const branch = `sm-job/${slug}`;
+  git(['branch', branch], cwd);
+  const tmpCheckout = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-branchsweep-checkout-'));
+  git(['worktree', 'add', '-q', tmpCheckout, branch], cwd);
+  fs.writeFileSync(path.join(tmpCheckout, `${slug}.txt`), fileContents, 'utf8');
+  git(['add', '-A'], tmpCheckout);
+  git(['commit', '-q', '-m', `job ${slug} work`], tmpCheckout);
+  git(['worktree', 'remove', '--force', tmpCheckout], cwd);
+  return branch;
+}
+
+test('stranded branch with a terminal job row is integrated', async () => {
+  const branch = makeStrandedBranch(repoCwd, 'alpha');
+  const jobs = [{ slug: 'alpha', status: 'completed' }];
+  const { results } = await sweepStrandedJobBranches({ cwd: repoCwd, jobs, attemptedBranches: new Set() });
+  const r = results.find((x) => x.branch === branch);
+  expect(r.action).toBe('integrated');
+  expect(fs.existsSync(path.join(repoCwd, 'alpha.txt'))).toBe(true);
+});
+
+test('stranded branch with NO job row at all is also integrated', async () => {
+  const branch = makeStrandedBranch(repoCwd, 'ghost');
+  const { results } = await sweepStrandedJobBranches({ cwd: repoCwd, jobs: [], attemptedBranches: new Set() });
+  const r = results.find((x) => x.branch === branch);
+  expect(r.action).toBe('integrated');
+});
+
+test('branch already merged into HEAD is a silent no-op', async () => {
+  const branch = makeStrandedBranch(repoCwd, 'bravo');
+  git(['merge', '--no-ff', '--no-edit', branch], repoCwd);
+  const jobs = [{ slug: 'bravo', status: 'completed' }];
+  const { results } = await sweepStrandedJobBranches({ cwd: repoCwd, jobs, attemptedBranches: new Set() });
+  const r = results.find((x) => x.branch === branch);
+  expect(r.action).toBe('no-op-merged');
+});
+
+test('branch checked out in a live worktree is skipped entirely', async () => {
+  const branch = makeStrandedBranch(repoCwd, 'charlie');
+  worktreeDir = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-branchsweep-live-'));
+  git(['worktree', 'add', '-q', worktreeDir, branch], repoCwd);
+  const jobs = [{ slug: 'charlie', status: 'running' }];
+  const { results } = await sweepStrandedJobBranches({ cwd: repoCwd, jobs, attemptedBranches: new Set() });
+  const r = results.find((x) => x.branch === branch);
+  expect(r.action).toBe('skip-checked-out');
+});
+
+test('branch owned by a NON-terminal job row is left alone, never integrated', async () => {
+  const branch = makeStrandedBranch(repoCwd, 'delta');
+  const jobs = [{ slug: 'delta', status: 'needs_review' }];
+  const { results } = await sweepStrandedJobBranches({ cwd: repoCwd, jobs, attemptedBranches: new Set() });
+  const r = results.find((x) => x.branch === branch);
+  expect(r.action).toBe('skip-active-row');
+  expect(fs.existsSync(path.join(repoCwd, 'delta.txt'))).toBe(false);
+});
+
+test('conflicting branch is flagged, never forced, and the branch is never deleted', async () => {
+  // Same path committed differently on both HEAD and the branch → real conflict.
+  fs.writeFileSync(path.join(repoCwd, 'shared.txt'), 'main tree version\n', 'utf8');
+  git(['add', '-A'], repoCwd);
+  git(['commit', '-q', '-m', 'main tree edits shared.txt'], repoCwd);
+
+  const branch = 'sm-job/echo';
+  git(['branch', branch, 'HEAD~1'], repoCwd);
+  const tmpCheckout = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-branchsweep-conflict-'));
+  git(['worktree', 'add', '-q', tmpCheckout, branch], repoCwd);
+  fs.writeFileSync(path.join(tmpCheckout, 'shared.txt'), 'branch version — conflicts\n', 'utf8');
+  git(['add', '-A'], tmpCheckout);
+  git(['commit', '-q', '-m', 'job echo edits shared.txt'], tmpCheckout);
+  git(['worktree', 'remove', '--force', tmpCheckout], repoCwd);
+
+  const jobs = [{ slug: 'echo', status: 'failed' }];
+  const { results } = await sweepStrandedJobBranches({ cwd: repoCwd, jobs, attemptedBranches: new Set() });
+  const r = results.find((x) => x.branch === branch);
+  expect(r.action).toBe('conflict');
+  expect(r.integration.ok).toBe(false);
+  // Branch itself must survive a conflict, untouched.
+  const stillExists = git(['rev-parse', '--verify', branch], repoCwd).trim();
+  expect(stillExists.length).toBe(40);
+});
+
+test('a branch is retried at most once per process lifetime via the shared attempted set', async () => {
+  fs.writeFileSync(path.join(repoCwd, 'shared2.txt'), 'main\n', 'utf8');
+  git(['add', '-A'], repoCwd);
+  git(['commit', '-q', '-m', 'main edits shared2'], repoCwd);
+  const branch = 'sm-job/foxtrot';
+  git(['branch', branch, 'HEAD~1'], repoCwd);
+  const tmpCheckout = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-branchsweep-retry-'));
+  git(['worktree', 'add', '-q', tmpCheckout, branch], repoCwd);
+  fs.writeFileSync(path.join(tmpCheckout, 'shared2.txt'), 'branch — conflicts\n', 'utf8');
+  git(['add', '-A'], tmpCheckout);
+  git(['commit', '-q', '-m', 'job foxtrot edits shared2'], tmpCheckout);
+  git(['worktree', 'remove', '--force', tmpCheckout], repoCwd);
+
+  const jobs = [{ slug: 'foxtrot', status: 'failed' }];
+  const attemptedBranches = new Set();
+  const first = await sweepStrandedJobBranches({ cwd: repoCwd, jobs, attemptedBranches });
+  expect(first.results.find((x) => x.branch === branch).action).toBe('conflict');
+  const second = await sweepStrandedJobBranches({ cwd: repoCwd, jobs, attemptedBranches });
+  expect(second.results.find((x) => x.branch === branch).action).toBe('skip-already-attempted');
+});
+
+test('SM_BRANCH_SWEEP_DISABLE=1 restores today\'s behaviour exactly — no scan, no integration', async () => {
+  makeStrandedBranch(repoCwd, 'golf');
+  process.env.SM_BRANCH_SWEEP_DISABLE = '1';
+  const jobs = [{ slug: 'golf', status: 'completed' }];
+  const { results } = await sweepStrandedJobBranches({ cwd: repoCwd, jobs, attemptedBranches: new Set() });
+  expect(results).toEqual([]);
+  expect(fs.existsSync(path.join(repoCwd, 'golf.txt'))).toBe(false);
+});