claude-code-session-manager 0.80.0 → 0.81.0

package/src/main/lib/rcaReport.cjs

@@ -52,6 +52,7 @@ const VERDICT_LABELS = {
   pass_no_commit_already_shipped: 'PASS with no commit — deliverables already shipped',
   pass_no_commit_prior_run_verified: 'PASS with no commit — prior run of this slug already landed the work',
   silent_no_op: 'no commit, clean tree — no evidence of work',
+  blocked_by_foreign_wip_streak: 'blocked by a sibling job\'s foreign WIP 3x in a row',
 };
 
 function humanVerdict(verdict) {
@@ -69,14 +70,18 @@ const FAILURE_CLASSES = {
   UNCOMMITTED: 'uncommitted-changes',
   TRANSCRIPT_ERRORS: 'transcript-errors',
   ABANDONED_BACKGROUND_TASK: 'abandoned-background-task',
+  BLOCKED_BY_FOREIGN_WIP: 'blocked-by-foreign-wip',
   UNKNOWN: 'unknown',
 };
 
 // ─── Recovery actions — one per failure class, machine-readable ────────────
 // Closed set the scheduler routes on: 'archive' (stale re-run, do not
-// re-queue), 'resume-and-commit' (PRD 1111's --resume dispatch owns this),
-// 'verify-and-close' (the work likely landed, just missing its sentinel),
-// 'investigate' (the only class that still buys a fix-plan investigation).
+// re-queue — also the closest fit for BLOCKED_BY_FOREIGN_WIP: there is
+// nothing to investigate, and re-queuing is already owned by
+// reconcile()'s requeueForeignWipBlockedJobs, not this action), 'resume-and-commit'
+// (PRD 1111's --resume dispatch owns this), 'verify-and-close' (the work
+// likely landed, just missing its sentinel), 'investigate' (the only class
+// that still buys a fix-plan investigation).
 const RECOVERY_ACTIONS = {
   [FAILURE_CLASSES.ALREADY_SHIPPED]: 'archive',
   [FAILURE_CLASSES.SELF_QUEUE]: 'investigate',
@@ -96,6 +101,7 @@ const RECOVERY_ACTIONS = {
   // carries the "check for salvaged work, commit before re-implementing"
   // guidance into that cold-read investigation.
   [FAILURE_CLASSES.ABANDONED_BACKGROUND_TASK]: 'investigate',
+  [FAILURE_CLASSES.BLOCKED_BY_FOREIGN_WIP]: 'archive',
   [FAILURE_CLASSES.UNKNOWN]: 'investigate',
 };
 
@@ -121,6 +127,8 @@ const PREVENTION_HINTS = {
     'Recover or annotate every error within ~10 lines (e.g. `# expected/handled: <why>`) instead of leaving a bare Traceback near the end of the transcript.',
   [FAILURE_CLASSES.ABANDONED_BACKGROUND_TASK]:
     'A headless run cannot receive a background-task completion notification — never let a long Bash command auto-background past its foreground timeout and then wait for it. Run long commands with an explicit bound (`timeout <N> <cmd>`) so they finish in the foreground, or poll their output file directly instead of waiting on Monitor/notification.',
+  [FAILURE_CLASSES.BLOCKED_BY_FOREIGN_WIP]:
+    'This job correctly reported `SCHEDULER_VERDICT: BLOCKED_BY_FOREIGN_WIP` against a sibling job\'s in-flight, uncommitted files three times in a row — auto-requeue is exhausted (reconcile() only clears this once the blocked paths go clean). This is not a defect in this PRD\'s own work: check on the sibling job/human that owns the still-dirty path(s) named on the job row, and either wait for them to commit or manually reset this job to `pending` once the tree is clear. Do not author a fix-plan PRD against it.',
   [FAILURE_CLASSES.UNKNOWN]:
     'Re-run the acceptance criteria gate locally against the failure log to pin down the specific break before re-queuing.',
 };
@@ -159,6 +167,13 @@ const POST_AC_OVERRUN_MIN_TAIL_FRACTION = 0.3;
 function classifyFailure({ verdict, logTail }) {
   const lines = (logTail || '').split('\n');
 
+  // Checked before every other rule: an unambiguous, materially-checked
+  // verdict (the scheduler itself validated the executor's claimed paths
+  // against the job's disclosed foreign-WIP manifest before ever landing
+  // this verdict — see validateForeignWipBlockClaim in scheduler.cjs) needs
+  // no log-tail heuristics to classify.
+  if (verdict === 'blocked_by_foreign_wip_streak') return FAILURE_CLASSES.BLOCKED_BY_FOREIGN_WIP;
+
   // Checked first, before SELF_QUEUE/STUCK_LOOP: a correct executor that finds
   // its acceptance criteria already satisfied by a prior commit makes no
   // change and truthfully prints a PASS sentinel, so the run lands

package/src/main/lib/reaperHelpers.cjs

@@ -8,6 +8,7 @@
  */
 
 const fs = require('node:fs');
+const path = require('node:path');
 const { readTail } = require('./fileTail.cjs');
 const { detectRateLimitInLog } = require('./rateLimitDetect.cjs');
 
@@ -34,6 +35,90 @@ function claudePidAlive(pid) {
   }
 }
 
+/**
+ * findLiveProcessForJob(job, { worktreeDir }) → pid | null
+ *
+ * Positive liveness scan for a 'running' row whose `runtime.pid` is missing —
+ * the case a missing pid must NOT be read as "the process is gone" (2026-09-06
+ * incident: 234-uranus-eight-tails-ox marked failed/never_ran while PID
+ * 2174739 was a live `claude -p` still writing to that job's own worktree).
+ *
+ * Linux-`/proc` only. Scans every numeric `/proc/<pid>` entry and matches
+ * either: `/proc/<pid>/cwd` resolves to `worktreeDir` (or a path nested under
+ * it), or `/proc/<pid>/cmdline` contains both `claude` and the job's slug
+ * (fallback for a worktree-disabled/in-place run, where there is no dedicated
+ * worktreeDir to match against). Returns the first matching pid, or null if
+ * none is found.
+ *
+ * Safe fallback by construction: on any platform without `/proc` (macOS,
+ * Windows) `fs.readdirSync('/proc')` throws and this returns null immediately
+ * — i.e. exactly today's behaviour (fail toward terminalizing), never a hang
+ * or a thrown error propagating to the caller.
+ */
+function findLiveProcessForJob(job, { worktreeDir } = {}) {
+  const slug = job?.slug;
+  let entries;
+  try {
+    entries = fs.readdirSync('/proc');
+  } catch {
+    return null;
+  }
+  for (const name of entries) {
+    if (!/^\d+$/.test(name)) continue;
+    const pid = Number(name);
+    if (!pid || pid <= 1) continue;
+    if (worktreeDir) {
+      try {
+        const cwdLink = fs.readlinkSync(`/proc/${pid}/cwd`);
+        if (cwdLink === worktreeDir || cwdLink.startsWith(worktreeDir + path.sep)) return pid;
+      } catch {
+        // Process exited mid-scan, or permission denied — try the argv
+        // fallback below before giving up on this pid.
+      }
+    }
+    if (slug) {
+      try {
+        const cmd = fs.readFileSync(`/proc/${pid}/cmdline`, 'utf8').replace(/\0/g, ' ');
+        if (/\bclaude\b/.test(cmd) && cmd.includes(slug)) return pid;
+      } catch {
+        // Same as above — process gone or unreadable, keep scanning.
+      }
+    }
+  }
+  return null;
+}
+
+/**
+ * True when `logPath` exists and has non-zero content — the literal "did the
+ * run dir produce any log output" check that gates whether a pidless reap may
+ * assert `gateOutcome: 'never_ran'`. A run whose log has real bytes in it DID
+ * run, regardless of whether classifyRunOutcome found a clean result event in
+ * it — asserting never_ran in that case would be a false claim (see
+ * resolvePidlessGateOutcome below).
+ */
+function logHasOutput(logPath) {
+  if (!logPath) return false;
+  try {
+    return fs.statSync(logPath).size > 0;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Gate-outcome for a pidless reap, once no live process was found for it.
+ * `never_ran` is asserted ONLY when the run dir produced no log output at
+ * all — mapOutcomeToGateOutcome's own 'no_result' → 'never_ran' mapping is
+ * otherwise too broad here: a log with real content but no clean result event
+ * (e.g. killed mid-turn) proves the job DID run, so that case is reported as
+ * 'failed' instead of the false 'never_ran'.
+ */
+function resolvePidlessGateOutcome(outcome, hasOutput) {
+  if (!hasOutput) return 'never_ran';
+  const mapped = mapOutcomeToGateOutcome(outcome);
+  return mapped === 'never_ran' ? 'failed' : mapped;
+}
+
 /**
  * Classify the terminal outcome of a completed run by reading the last 64 KB
  * of its log file and scanning for the LAST `{"type":"result"}` JSONL event.
@@ -129,10 +214,21 @@ const ORPHAN_REQUEUE_CAP = 5;
  * A pidless row whose `startedAt` is missing or unparseable is neither
  * reaped nor skipped silently — age can't be proven, so it is surfaced in
  * `warnings` instead (the caller logs it) and left alone.
+ *
+ * `findLiveProcess` (optional, `(job) → pid | null`) is consulted for a
+ * pidless row ONLY once its age clears `grace` — i.e. right before it would
+ * otherwise be terminalized. A pid it finds means the process is actually
+ * alive despite the missing runtime.pid record: the row is diverted into
+ * `recovered` (never `reapable`) so the caller can re-stamp the pid and leave
+ * the row `running`, instead of terminalizing a job that is still doing real
+ * work (2026-09-06 incident — see findLiveProcessForJob's header). Omitting
+ * `findLiveProcess` (existing callers/tests) preserves prior behaviour
+ * exactly: every pidless row past grace reaps, none are ever recovered.
  */
-function selectReapableJobs(jobs, now, { pidAlive, grace } = {}) {
+function selectReapableJobs(jobs, now, { pidAlive, grace, findLiveProcess } = {}) {
   const reapable = [];
   const warnings = [];
+  const recovered = [];
   for (const j of jobs ?? []) {
     if (j.status !== 'running') continue;
     const pid = j.runtime?.pid;
@@ -148,6 +244,11 @@ function selectReapableJobs(jobs, now, { pidAlive, grace } = {}) {
     }
     const ageMs = now - startedAt;
     if (ageMs < grace) continue; // spawn may still be mid-flight
+    const livePid = typeof findLiveProcess === 'function' ? findLiveProcess(j) : null;
+    if (livePid) {
+      recovered.push({ slug: j.slug, pid: livePid });
+      continue;
+    }
     reapable.push({
       slug: j.slug,
       pid: null,
@@ -155,7 +256,72 @@ function selectReapableJobs(jobs, now, { pidAlive, grace } = {}) {
       reason: `reaped: no runtime.pid recorded after ${Math.round(grace / 60_000)}m — spawn never completed`,
     });
   }
-  return { reapable, warnings };
+  return { reapable, warnings, recovered };
+}
+
+/**
+ * isAlreadySatisfiedOnMain(commits) → { sha, verdict, reason } | null
+ *
+ * Pure decision layer for the finish-protocol commit-guard's second,
+ * independently-evidenced route to 'completed' (PRD 1136). The commit-guard
+ * in scheduler.cjs parks a clean exit / no-commit / clean-tree run as
+ * `needs_review` ("finish protocol incomplete") because that shape is
+ * normally the strongest signal that nothing happened — but it is also
+ * exactly the shape a run produces when its PRD's work was ALREADY merged to
+ * main before the run dispatched (2026-09-06: 1133-reaper-must-verify-
+ * integration-before-completed and 1134-land-stranded-sm-job-branches, both
+ * false-negatived this way and then auto-fix-minted a redundant `-fix-`
+ * child against a codebase where the change was already present).
+ *
+ * Takes the already-git-queried list of commit SHAs (newest first, caller's
+ * job — see scheduler.cjs's findSatisfyingCommitOnMain) that are reachable
+ * from `main`, newer than the job's `queuedAt`, and touch the PRD's own
+ * declared paths. Returns the winning verdict naming the satisfying sha, or
+ * `null` when there is no such commit — the caller must then leave the
+ * existing 'finish protocol incomplete' → needs_review verdict untouched.
+ * This function never widens what counts as evidence; it only decides what
+ * to do once the caller's git query has already proven a satisfying commit
+ * exists, so it can never turn a genuine no-op into a false 'completed'.
+ */
+function isAlreadySatisfiedOnMain(commits) {
+  if (!Array.isArray(commits) || commits.length === 0) return null;
+  const sha = commits[0];
+  return {
+    sha,
+    verdict: 'already_satisfied_on_main',
+    reason: `already satisfied by ${sha} — a commit on main newer than this run's queuedAt already touches this PRD's declared paths`,
+  };
+}
+
+/**
+ * resolveCommitGuardOutcome(guardVerdict, satisfyingCommits) → verdict | null
+ *
+ * The full finalize-time decision this PRD adds: takes commitGuardVerdict's
+ * own output (scheduler.cjs) plus the already-git-queried satisfying-commit
+ * list (scheduler.cjs's findSatisfyingCommitOnMain) and decides which verdict
+ * actually wins. Only ever touches the 'silent_no_op' shape — a guardVerdict
+ * of null (no violation) or 'uncommitted_changes' (real dirt left behind)
+ * passes through completely untouched, so this can never weaken the
+ * uncommitted-changes guarantee PRD 1133 introduced. Pure — no I/O, no git —
+ * so the whole finalize decision is directly unit-testable without spawning
+ * a real job.
+ */
+function resolveCommitGuardOutcome(guardVerdict, satisfyingCommits) {
+  if (!guardVerdict || guardVerdict.verdict !== 'silent_no_op') return guardVerdict ?? null;
+  const satisfied = isAlreadySatisfiedOnMain(satisfyingCommits);
+  if (!satisfied) return guardVerdict;
+  return { verdict: satisfied.verdict, reason: satisfied.reason, satisfyingSha: satisfied.sha };
 }
 
-module.exports = { claudePidAlive, classifyRunOutcome, mapOutcomeToGateOutcome, ORPHAN_REQUEUE_CAP, selectReapableJobs };
+module.exports = {
+  claudePidAlive,
+  classifyRunOutcome,
+  mapOutcomeToGateOutcome,
+  ORPHAN_REQUEUE_CAP,
+  selectReapableJobs,
+  findLiveProcessForJob,
+  logHasOutput,
+  resolvePidlessGateOutcome,
+  isAlreadySatisfiedOnMain,
+  resolveCommitGuardOutcome,
+};

package/src/main/lib/scheduleJobTransitions.cjs

@@ -41,13 +41,26 @@ const STATUS_HISTORY_CAP = 20;
  * Explicit from->to edges. Every real assignment site in scheduler.cjs maps
  * onto one of these (verified against the 16 sites this module replaces):
  *  - pending->running (dispatch), pending->completed (archived-PRD skip,
- *    manual archive of an already-shipped PRD), pending->failed (admin
- *    cancelJob on a not-yet-started job)
+ *    manual archive of an already-shipped PRD; also source
+ *    'spawnJob:dispatch-sidecar-reconcile' — a pending row about to
+ *    dispatch whose newest run-sidecar already shows a completed-equivalent
+ *    outcome finished at/after this row's own last pending transition is
+ *    finalized from that sidecar instead of spawning a redundant re-run;
+ *    2026-09-06 incident: a silently-dropped finalize left a slug 'pending'
+ *    forever and the dispatcher re-fired it three times), pending->failed
+ *    (admin cancelJob on a not-yet-started job)
  *  - running->completed|failed|needs_review (normal run outcomes, reaper),
  *    running->skipped (spawnJob:skip-archived's 'prd-missing' case — no
  *    executor ever ran; kept distinct from 'completed' so unrun work can't
  *    read as shipped), running->pending (halt/rate-limit reset,
- *    transient-failure retry)
+ *    transient-failure retry). Also reached with verdict
+ *    'reaped_without_integration' (source 'reapDeadRunningJobs', PRD 1133): a
+ *    reaped job whose result event looked successful but whose work cannot
+ *    be shown to have landed — a worktree branch still holding unmerged
+ *    commits, or an in-place run whose HEAD never advanced during the run
+ *    window — is parked here instead of 'completed', naming the branch (or
+ *    the lack of any commit) so the stranded work is never silently treated
+ *    as shipped.
  *  - investigating->failed|needs_review (restore prior status once the
  *    investigation probe exits), investigating->completed (defensive: the
  *    restored prior status could in principle be 'completed' if a caller

package/src/main/runVerify.cjs

@@ -70,6 +70,19 @@ function isHarnessToolError(content) {
     || /\bNo such tool available\b/.test(content);
 }
 
+/**
+ * A PreToolUse hook denial (`guard-destructive-git.cjs`, `guard-prd-writes.cjs`,
+ * `guard-inline-implementation.cjs`, or the harness's own `Blocked: sleep N
+ * followed by: ...` form) never executed the tool it names — it says nothing
+ * about whether the task succeeded, and the model is expected to adapt and
+ * retry. (Incident: PRD 1106, 2026-09-02 — four guard-destructive-git denials
+ * in a fully-implemented, correctly-isolated run.)
+ */
+function isPolicyDenial(content) {
+  if (typeof content !== 'string' || !content) return false;
+  return /^(?:Error:\s*)?Blocked:/.test(content);
+}
+
 function detectPattern(content) {
   if (typeof content !== 'string' || !content) return null;
 
@@ -506,16 +519,17 @@ function checkDeps(queueEntry, allJobs, prdBody) {
 // ─── sentinel scanner ─────────────────────────────────────────────────────────
 
 /**
- * Scan for a `SCHEDULER_VERDICT: PASS|FAIL` sentinel line in the run output.
+ * Scan for a `SCHEDULER_VERDICT: PASS|FAIL|BLOCKED_BY_FOREIGN_WIP` sentinel
+ * line in the run output.
  *
  * Checks `resultEvent.resultText` first (the agent's final message), then the
  * last tool_result content. Anchored to line-start so prose mentioning the
  * string in mid-sentence does not match.
  *
- * Returns 'pass', 'fail', or null.
+ * Returns 'pass', 'fail', 'blocked_by_foreign_wip', or null.
  */
 function scanSentinel(resultEvent, events) {
-  const RE = /^SCHEDULER_VERDICT:\s*(PASS|FAIL)\b/m;
+  const RE = /^SCHEDULER_VERDICT:\s*(PASS|FAIL|BLOCKED_BY_FOREIGN_WIP)\b/m;
 
   if (resultEvent) {
     const m = resultEvent.resultText.match(RE);
@@ -534,6 +548,44 @@ function scanSentinel(resultEvent, events) {
   return null;
 }
 
+/**
+ * Scan for a `FOREIGN_WIP_PATHS: <comma-separated paths>` evidence line —
+ * the mandatory companion to a `SCHEDULER_VERDICT: BLOCKED_BY_FOREIGN_WIP`
+ * sentinel (see FINISH_PROTOCOL in scheduler.cjs). Same two-source scan order
+ * as scanSentinel (resultEvent.resultText, then the last tool_result) so the
+ * two scanners always agree on which "final say" they're reading from.
+ *
+ * Returns a deduplicated array of trimmed path strings (possibly empty — an
+ * executor that emits the verdict with no paths line, or an empty one, gives
+ * the caller nothing to validate, which the caller must treat as an invalid
+ * claim, not an empty-but-valid one).
+ */
+function scanForeignWipPathsClaim(resultEvent, events) {
+  const RE = /^FOREIGN_WIP_PATHS:\s*(.+)$/m;
+
+  const parse = (text) => {
+    const m = typeof text === 'string' ? text.match(RE) : null;
+    if (!m) return null;
+    return [...new Set(m[1].split(',').map((p) => p.trim()).filter(Boolean))];
+  };
+
+  if (resultEvent) {
+    const paths = parse(resultEvent.resultText);
+    if (paths) return paths;
+  }
+
+  let lastToolResult = null;
+  for (const ev of events) {
+    if (ev.kind === 'tool_result') lastToolResult = ev;
+  }
+  if (lastToolResult) {
+    const paths = parse(lastToolResult.content);
+    if (paths) return paths;
+  }
+
+  return [];
+}
+
 // ─── merge-main postcondition exemption ──────────────────────────────────────
 
 /**
@@ -853,6 +905,20 @@ async function verifyRun({ runDir, prdPath, queueEntry, allJobs = [], committedD
       // seen in 58-web-remote-correctness-batch, 2026-06-10).
       if (isHarnessToolError(ev.content)) continue;
 
+      // A PreToolUse policy denial (a guard hook blocked the call before it
+      // ran) is exempt from both the is_error scan and the content-pattern
+      // scan for the same reason as a harness tool error above — the denied
+      // call never executed. Unlike a harness tool error, record it as an
+      // annotation so the denial stays visible in the verdict record instead
+      // of vanishing silently.
+      if (isPolicyDenial(ev.content)) {
+        annotations.push({
+          verdict: 'policy_denial',
+          reason: `PreToolUse policy denial at event ${i}: ${ev.content.slice(0, 200)}`,
+        });
+        continue;
+      }
+
       // A tool_result carrying a non-null parent_tool_use_id happened INSIDE a Task
       // subagent's own execution, not in the main agent's. Subagents do ordinary
       // exploratory work (greps that exit 1 on no-match, ls on a path that may not
@@ -1147,6 +1213,7 @@ module.exports = {
   // Exposed for unit tests.
   detectPattern,
   isHarnessToolError,
+  isPolicyDenial,
   isSelfRecovered,
   normalizeDescForRecovery,
   toolUseName,
@@ -1155,6 +1222,7 @@ module.exports = {
   checkDeps,
   parseLog,
   scanSentinel,
+  scanForeignWipPathsClaim,
   isMergeMainSlug,
   extractMergeMainPrNumber,
   checkMergeablePr,