claude-code-session-manager 0.80.0 → 0.82.0

package/src/main/lib/reaperHelpers.cjs

@@ -8,6 +8,7 @@
  */
 
 const fs = require('node:fs');
+const path = require('node:path');
 const { readTail } = require('./fileTail.cjs');
 const { detectRateLimitInLog } = require('./rateLimitDetect.cjs');
 
@@ -34,6 +35,90 @@ function claudePidAlive(pid) {
   }
 }
 
+/**
+ * findLiveProcessForJob(job, { worktreeDir }) → pid | null
+ *
+ * Positive liveness scan for a 'running' row whose `runtime.pid` is missing —
+ * the case a missing pid must NOT be read as "the process is gone" (2026-09-06
+ * incident: 234-uranus-eight-tails-ox marked failed/never_ran while PID
+ * 2174739 was a live `claude -p` still writing to that job's own worktree).
+ *
+ * Linux-`/proc` only. Scans every numeric `/proc/<pid>` entry and matches
+ * either: `/proc/<pid>/cwd` resolves to `worktreeDir` (or a path nested under
+ * it), or `/proc/<pid>/cmdline` contains both `claude` and the job's slug
+ * (fallback for a worktree-disabled/in-place run, where there is no dedicated
+ * worktreeDir to match against). Returns the first matching pid, or null if
+ * none is found.
+ *
+ * Safe fallback by construction: on any platform without `/proc` (macOS,
+ * Windows) `fs.readdirSync('/proc')` throws and this returns null immediately
+ * — i.e. exactly today's behaviour (fail toward terminalizing), never a hang
+ * or a thrown error propagating to the caller.
+ */
+function findLiveProcessForJob(job, { worktreeDir } = {}) {
+  const slug = job?.slug;
+  let entries;
+  try {
+    entries = fs.readdirSync('/proc');
+  } catch {
+    return null;
+  }
+  for (const name of entries) {
+    if (!/^\d+$/.test(name)) continue;
+    const pid = Number(name);
+    if (!pid || pid <= 1) continue;
+    if (worktreeDir) {
+      try {
+        const cwdLink = fs.readlinkSync(`/proc/${pid}/cwd`);
+        if (cwdLink === worktreeDir || cwdLink.startsWith(worktreeDir + path.sep)) return pid;
+      } catch {
+        // Process exited mid-scan, or permission denied — try the argv
+        // fallback below before giving up on this pid.
+      }
+    }
+    if (slug) {
+      try {
+        const cmd = fs.readFileSync(`/proc/${pid}/cmdline`, 'utf8').replace(/\0/g, ' ');
+        if (/\bclaude\b/.test(cmd) && cmd.includes(slug)) return pid;
+      } catch {
+        // Same as above — process gone or unreadable, keep scanning.
+      }
+    }
+  }
+  return null;
+}
+
+/**
+ * True when `logPath` exists and has non-zero content — the literal "did the
+ * run dir produce any log output" check that gates whether a pidless reap may
+ * assert `gateOutcome: 'never_ran'`. A run whose log has real bytes in it DID
+ * run, regardless of whether classifyRunOutcome found a clean result event in
+ * it — asserting never_ran in that case would be a false claim (see
+ * resolvePidlessGateOutcome below).
+ */
+function logHasOutput(logPath) {
+  if (!logPath) return false;
+  try {
+    return fs.statSync(logPath).size > 0;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Gate-outcome for a pidless reap, once no live process was found for it.
+ * `never_ran` is asserted ONLY when the run dir produced no log output at
+ * all — mapOutcomeToGateOutcome's own 'no_result' → 'never_ran' mapping is
+ * otherwise too broad here: a log with real content but no clean result event
+ * (e.g. killed mid-turn) proves the job DID run, so that case is reported as
+ * 'failed' instead of the false 'never_ran'.
+ */
+function resolvePidlessGateOutcome(outcome, hasOutput) {
+  if (!hasOutput) return 'never_ran';
+  const mapped = mapOutcomeToGateOutcome(outcome);
+  return mapped === 'never_ran' ? 'failed' : mapped;
+}
+
 /**
  * Classify the terminal outcome of a completed run by reading the last 64 KB
  * of its log file and scanning for the LAST `{"type":"result"}` JSONL event.
@@ -129,10 +214,21 @@ const ORPHAN_REQUEUE_CAP = 5;
  * A pidless row whose `startedAt` is missing or unparseable is neither
  * reaped nor skipped silently — age can't be proven, so it is surfaced in
  * `warnings` instead (the caller logs it) and left alone.
+ *
+ * `findLiveProcess` (optional, `(job) → pid | null`) is consulted for a
+ * pidless row ONLY once its age clears `grace` — i.e. right before it would
+ * otherwise be terminalized. A pid it finds means the process is actually
+ * alive despite the missing runtime.pid record: the row is diverted into
+ * `recovered` (never `reapable`) so the caller can re-stamp the pid and leave
+ * the row `running`, instead of terminalizing a job that is still doing real
+ * work (2026-09-06 incident — see findLiveProcessForJob's header). Omitting
+ * `findLiveProcess` (existing callers/tests) preserves prior behaviour
+ * exactly: every pidless row past grace reaps, none are ever recovered.
  */
-function selectReapableJobs(jobs, now, { pidAlive, grace } = {}) {
+function selectReapableJobs(jobs, now, { pidAlive, grace, findLiveProcess } = {}) {
   const reapable = [];
   const warnings = [];
+  const recovered = [];
   for (const j of jobs ?? []) {
     if (j.status !== 'running') continue;
     const pid = j.runtime?.pid;
@@ -148,6 +244,11 @@ function selectReapableJobs(jobs, now, { pidAlive, grace } = {}) {
     }
     const ageMs = now - startedAt;
     if (ageMs < grace) continue; // spawn may still be mid-flight
+    const livePid = typeof findLiveProcess === 'function' ? findLiveProcess(j) : null;
+    if (livePid) {
+      recovered.push({ slug: j.slug, pid: livePid });
+      continue;
+    }
     reapable.push({
       slug: j.slug,
       pid: null,
@@ -155,7 +256,72 @@ function selectReapableJobs(jobs, now, { pidAlive, grace } = {}) {
       reason: `reaped: no runtime.pid recorded after ${Math.round(grace / 60_000)}m — spawn never completed`,
     });
   }
-  return { reapable, warnings };
+  return { reapable, warnings, recovered };
+}
+
+/**
+ * isAlreadySatisfiedOnMain(commits) → { sha, verdict, reason } | null
+ *
+ * Pure decision layer for the finish-protocol commit-guard's second,
+ * independently-evidenced route to 'completed' (PRD 1136). The commit-guard
+ * in scheduler.cjs parks a clean exit / no-commit / clean-tree run as
+ * `needs_review` ("finish protocol incomplete") because that shape is
+ * normally the strongest signal that nothing happened — but it is also
+ * exactly the shape a run produces when its PRD's work was ALREADY merged to
+ * main before the run dispatched (2026-09-06: 1133-reaper-must-verify-
+ * integration-before-completed and 1134-land-stranded-sm-job-branches, both
+ * false-negatived this way and then auto-fix-minted a redundant `-fix-`
+ * child against a codebase where the change was already present).
+ *
+ * Takes the already-git-queried list of commit SHAs (newest first, caller's
+ * job — see scheduler.cjs's findSatisfyingCommitOnMain) that are reachable
+ * from `main`, newer than the job's `queuedAt`, and touch the PRD's own
+ * declared paths. Returns the winning verdict naming the satisfying sha, or
+ * `null` when there is no such commit — the caller must then leave the
+ * existing 'finish protocol incomplete' → needs_review verdict untouched.
+ * This function never widens what counts as evidence; it only decides what
+ * to do once the caller's git query has already proven a satisfying commit
+ * exists, so it can never turn a genuine no-op into a false 'completed'.
+ */
+function isAlreadySatisfiedOnMain(commits) {
+  if (!Array.isArray(commits) || commits.length === 0) return null;
+  const sha = commits[0];
+  return {
+    sha,
+    verdict: 'already_satisfied_on_main',
+    reason: `already satisfied by ${sha} — a commit on main newer than this run's queuedAt already touches this PRD's declared paths`,
+  };
+}
+
+/**
+ * resolveCommitGuardOutcome(guardVerdict, satisfyingCommits) → verdict | null
+ *
+ * The full finalize-time decision this PRD adds: takes commitGuardVerdict's
+ * own output (scheduler.cjs) plus the already-git-queried satisfying-commit
+ * list (scheduler.cjs's findSatisfyingCommitOnMain) and decides which verdict
+ * actually wins. Only ever touches the 'silent_no_op' shape — a guardVerdict
+ * of null (no violation) or 'uncommitted_changes' (real dirt left behind)
+ * passes through completely untouched, so this can never weaken the
+ * uncommitted-changes guarantee PRD 1133 introduced. Pure — no I/O, no git —
+ * so the whole finalize decision is directly unit-testable without spawning
+ * a real job.
+ */
+function resolveCommitGuardOutcome(guardVerdict, satisfyingCommits) {
+  if (!guardVerdict || guardVerdict.verdict !== 'silent_no_op') return guardVerdict ?? null;
+  const satisfied = isAlreadySatisfiedOnMain(satisfyingCommits);
+  if (!satisfied) return guardVerdict;
+  return { verdict: satisfied.verdict, reason: satisfied.reason, satisfyingSha: satisfied.sha };
 }
 
-module.exports = { claudePidAlive, classifyRunOutcome, mapOutcomeToGateOutcome, ORPHAN_REQUEUE_CAP, selectReapableJobs };
+module.exports = {
+  claudePidAlive,
+  classifyRunOutcome,
+  mapOutcomeToGateOutcome,
+  ORPHAN_REQUEUE_CAP,
+  selectReapableJobs,
+  findLiveProcessForJob,
+  logHasOutput,
+  resolvePidlessGateOutcome,
+  isAlreadySatisfiedOnMain,
+  resolveCommitGuardOutcome,
+};

package/src/main/lib/scheduleJobTransitions.cjs

@@ -41,13 +41,26 @@ const STATUS_HISTORY_CAP = 20;
  * Explicit from->to edges. Every real assignment site in scheduler.cjs maps
  * onto one of these (verified against the 16 sites this module replaces):
  *  - pending->running (dispatch), pending->completed (archived-PRD skip,
- *    manual archive of an already-shipped PRD), pending->failed (admin
- *    cancelJob on a not-yet-started job)
+ *    manual archive of an already-shipped PRD; also source
+ *    'spawnJob:dispatch-sidecar-reconcile' — a pending row about to
+ *    dispatch whose newest run-sidecar already shows a completed-equivalent
+ *    outcome finished at/after this row's own last pending transition is
+ *    finalized from that sidecar instead of spawning a redundant re-run;
+ *    2026-09-06 incident: a silently-dropped finalize left a slug 'pending'
+ *    forever and the dispatcher re-fired it three times), pending->failed
+ *    (admin cancelJob on a not-yet-started job)
  *  - running->completed|failed|needs_review (normal run outcomes, reaper),
  *    running->skipped (spawnJob:skip-archived's 'prd-missing' case — no
  *    executor ever ran; kept distinct from 'completed' so unrun work can't
  *    read as shipped), running->pending (halt/rate-limit reset,
- *    transient-failure retry)
+ *    transient-failure retry). Also reached with verdict
+ *    'reaped_without_integration' (source 'reapDeadRunningJobs', PRD 1133): a
+ *    reaped job whose result event looked successful but whose work cannot
+ *    be shown to have landed — a worktree branch still holding unmerged
+ *    commits, or an in-place run whose HEAD never advanced during the run
+ *    window — is parked here instead of 'completed', naming the branch (or
+ *    the lack of any commit) so the stranded work is never silently treated
+ *    as shipped.
  *  - investigating->failed|needs_review (restore prior status once the
  *    investigation probe exits), investigating->completed (defensive: the
  *    restored prior status could in principle be 'completed' if a caller

package/src/main/lib/telemetrySettings.cjs

@@ -0,0 +1,171 @@
+/**
+ * telemetrySettings — persists product-telemetry consent/config + install identity.
+ *
+ * Storage: ~/.config/session-manager/telemetry.json
+ * Shape: {
+ *   enabled: boolean,                // ON by default — hard kill switch is SM_TELEMETRY=0
+ *   installId: string,               // crypto.randomUUID(), minted once, the only identity
+ *   endpoint: string,                // bilko.run ingest base URL
+ *   noticeAckedAt: string|null,      // ISO timestamp the first-run disclosure was shown
+ *   lastMachineReportAt: string|null,
+ *   lastMachineReportVersion: string,
+ *   lastDailyFlushAt: string|null,
+ *   schemaVersion: 1
+ * }
+ *
+ * Modeled directly on ../otelSettings.cjs — same atomic tmp+rename write via config.cjs,
+ * same schemaVersion + isValid() + frozen DEFAULTS shape. Deliberately has NO identity
+ * field beyond installId — no email, no username, no hostname. isValid() rejects any
+ * unknown key so a future accidental PII field can never silently round-trip through load/save.
+ *
+ * This module is pure data plumbing: no network code, no call sites. Later PRDs consume it.
+ */
+'use strict';
+
+const fsp = require('node:fs/promises');
+const path = require('node:path');
+const os = require('node:os');
+const crypto = require('node:crypto');
+const config = require('../config.cjs');
+
+const SCHEMA_VERSION = 1;
+const DAY_MS = 24 * 60 * 60 * 1000;
+const THIRTY_DAYS_MS = 30 * DAY_MS;
+
+const DEFAULTS = Object.freeze({
+  enabled: true,
+  installId: '',
+  endpoint: 'https://bilko.run',
+  noticeAckedAt: null,
+  lastMachineReportAt: null,
+  lastMachineReportVersion: '',
+  lastDailyFlushAt: null,
+  schemaVersion: SCHEMA_VERSION,
+});
+
+const KNOWN_KEYS = new Set(Object.keys(DEFAULTS));
+
+function storePath() {
+  return path.join(os.homedir(), '.config', 'session-manager', 'telemetry.json');
+}
+
+function isValid(cfg) {
+  if (!cfg || typeof cfg !== 'object' || Array.isArray(cfg)) return false;
+  for (const k of Object.keys(cfg)) {
+    if (!KNOWN_KEYS.has(k)) return false;
+  }
+  if (typeof cfg.enabled !== 'boolean') return false;
+  if (typeof cfg.installId !== 'string') return false;
+  if (typeof cfg.endpoint !== 'string' || !cfg.endpoint.trim()) return false;
+  if (cfg.noticeAckedAt !== null && typeof cfg.noticeAckedAt !== 'string') return false;
+  if (cfg.lastMachineReportAt !== null && typeof cfg.lastMachineReportAt !== 'string') return false;
+  if (typeof cfg.lastMachineReportVersion !== 'string') return false;
+  if (cfg.lastDailyFlushAt !== null && typeof cfg.lastDailyFlushAt !== 'string') return false;
+  if (cfg.schemaVersion !== SCHEMA_VERSION) return false;
+  return true;
+}
+
+function normalize(cfg) {
+  return {
+    enabled: !!cfg.enabled,
+    installId: typeof cfg.installId === 'string' ? cfg.installId : '',
+    endpoint: typeof cfg.endpoint === 'string' && cfg.endpoint.trim() ? cfg.endpoint.trim() : DEFAULTS.endpoint,
+    noticeAckedAt: typeof cfg.noticeAckedAt === 'string' ? cfg.noticeAckedAt : null,
+    lastMachineReportAt: typeof cfg.lastMachineReportAt === 'string' ? cfg.lastMachineReportAt : null,
+    lastMachineReportVersion: typeof cfg.lastMachineReportVersion === 'string' ? cfg.lastMachineReportVersion : '',
+    lastDailyFlushAt: typeof cfg.lastDailyFlushAt === 'string' ? cfg.lastDailyFlushAt : null,
+    schemaVersion: SCHEMA_VERSION,
+  };
+}
+
+let writeQueue = Promise.resolve();
+async function save(cfg) {
+  if (!isValid(cfg)) throw new Error('Invalid telemetry config');
+  const next = normalize(cfg);
+  const run = async () => {
+    await config.writeTextAtomic(storePath(), JSON.stringify(next, null, 2) + '\n', { mode: 0o600 });
+    return next;
+  };
+  const tail = writeQueue.then(run, run);
+  writeQueue = tail.catch(() => {});
+  return tail;
+}
+
+async function readRaw() {
+  try {
+    const raw = await fsp.readFile(storePath(), 'utf8');
+    const data = JSON.parse(raw);
+    if (data && typeof data === 'object') {
+      return normalize({ ...DEFAULTS, ...data });
+    }
+  } catch (e) {
+    if (e.code !== 'ENOENT') {
+      console.warn('[telemetrySettings] load failed:', e.message);
+    }
+  }
+  return { ...DEFAULTS };
+}
+
+/**
+ * Loads the persisted config, minting and persisting installId on first read
+ * when absent. A second in-process load() and a fresh load() from disk both
+ * observe the same minted id, since the mint result is written to disk
+ * before this resolves.
+ */
+async function load() {
+  const cfg = await readRaw();
+  if (!cfg.installId) {
+    return save({ ...cfg, installId: crypto.randomUUID() });
+  }
+  return cfg;
+}
+
+/** Hard kill switch (SM_TELEMETRY=0) always wins over the persisted value. */
+function isEnabled(cfg) {
+  if (process.env.SM_TELEMETRY === '0') return false;
+  return !!(cfg && cfg.enabled);
+}
+
+/** Env override always wins over the persisted endpoint. */
+function resolveEndpoint(cfg) {
+  if (process.env.SM_TELEMETRY_ENDPOINT) return process.env.SM_TELEMETRY_ENDPOINT;
+  return (cfg && typeof cfg.endpoint === 'string' && cfg.endpoint.trim()) ? cfg.endpoint : DEFAULTS.endpoint;
+}
+
+/** True when lastDailyFlushAt is null or more than 24h before `now`. `now` is injected, never read internally. */
+function isDailyFlushDue(cfg, now) {
+  const last = cfg && cfg.lastDailyFlushAt;
+  if (!last) return true;
+  const lastMs = new Date(last).getTime();
+  if (Number.isNaN(lastMs)) return true;
+  return (now - lastMs) > DAY_MS;
+}
+
+/**
+ * True when the install has changed app version since its last report, OR
+ * lastMachineReportAt is null / more than 30 days before `now` (periodic
+ * liveness heartbeat — what turns the data into an active-install count
+ * rather than an ever-installed count). `now` is injected, never read internally.
+ */
+function isMachineReportDue(cfg, { now, appVersion }) {
+  if (!cfg) return true;
+  if (cfg.lastMachineReportVersion !== appVersion) return true;
+  const last = cfg.lastMachineReportAt;
+  if (!last) return true;
+  const lastMs = new Date(last).getTime();
+  if (Number.isNaN(lastMs)) return true;
+  return (now - lastMs) > THIRTY_DAYS_MS;
+}
+
+module.exports = {
+  load,
+  save,
+  storePath,
+  isValid,
+  isEnabled,
+  resolveEndpoint,
+  isDailyFlushDue,
+  isMachineReportDue,
+  DEFAULTS,
+  SCHEMA_VERSION,
+};

package/src/main/runVerify.cjs

@@ -70,6 +70,19 @@ function isHarnessToolError(content) {
     || /\bNo such tool available\b/.test(content);
 }
 
+/**
+ * A PreToolUse hook denial (`guard-destructive-git.cjs`, `guard-prd-writes.cjs`,
+ * `guard-inline-implementation.cjs`, or the harness's own `Blocked: sleep N
+ * followed by: ...` form) never executed the tool it names — it says nothing
+ * about whether the task succeeded, and the model is expected to adapt and
+ * retry. (Incident: PRD 1106, 2026-09-02 — four guard-destructive-git denials
+ * in a fully-implemented, correctly-isolated run.)
+ */
+function isPolicyDenial(content) {
+  if (typeof content !== 'string' || !content) return false;
+  return /^(?:Error:\s*)?Blocked:/.test(content);
+}
+
 function detectPattern(content) {
   if (typeof content !== 'string' || !content) return null;
 
@@ -506,16 +519,17 @@ function checkDeps(queueEntry, allJobs, prdBody) {
 // ─── sentinel scanner ─────────────────────────────────────────────────────────
 
 /**
- * Scan for a `SCHEDULER_VERDICT: PASS|FAIL` sentinel line in the run output.
+ * Scan for a `SCHEDULER_VERDICT: PASS|FAIL|BLOCKED_BY_FOREIGN_WIP` sentinel
+ * line in the run output.
  *
  * Checks `resultEvent.resultText` first (the agent's final message), then the
  * last tool_result content. Anchored to line-start so prose mentioning the
  * string in mid-sentence does not match.
  *
- * Returns 'pass', 'fail', or null.
+ * Returns 'pass', 'fail', 'blocked_by_foreign_wip', or null.
  */
 function scanSentinel(resultEvent, events) {
-  const RE = /^SCHEDULER_VERDICT:\s*(PASS|FAIL)\b/m;
+  const RE = /^SCHEDULER_VERDICT:\s*(PASS|FAIL|BLOCKED_BY_FOREIGN_WIP)\b/m;
 
   if (resultEvent) {
     const m = resultEvent.resultText.match(RE);
@@ -534,6 +548,44 @@ function scanSentinel(resultEvent, events) {
   return null;
 }
 
+/**
+ * Scan for a `FOREIGN_WIP_PATHS: <comma-separated paths>` evidence line —
+ * the mandatory companion to a `SCHEDULER_VERDICT: BLOCKED_BY_FOREIGN_WIP`
+ * sentinel (see FINISH_PROTOCOL in scheduler.cjs). Same two-source scan order
+ * as scanSentinel (resultEvent.resultText, then the last tool_result) so the
+ * two scanners always agree on which "final say" they're reading from.
+ *
+ * Returns a deduplicated array of trimmed path strings (possibly empty — an
+ * executor that emits the verdict with no paths line, or an empty one, gives
+ * the caller nothing to validate, which the caller must treat as an invalid
+ * claim, not an empty-but-valid one).
+ */
+function scanForeignWipPathsClaim(resultEvent, events) {
+  const RE = /^FOREIGN_WIP_PATHS:\s*(.+)$/m;
+
+  const parse = (text) => {
+    const m = typeof text === 'string' ? text.match(RE) : null;
+    if (!m) return null;
+    return [...new Set(m[1].split(',').map((p) => p.trim()).filter(Boolean))];
+  };
+
+  if (resultEvent) {
+    const paths = parse(resultEvent.resultText);
+    if (paths) return paths;
+  }
+
+  let lastToolResult = null;
+  for (const ev of events) {
+    if (ev.kind === 'tool_result') lastToolResult = ev;
+  }
+  if (lastToolResult) {
+    const paths = parse(lastToolResult.content);
+    if (paths) return paths;
+  }
+
+  return [];
+}
+
 // ─── merge-main postcondition exemption ──────────────────────────────────────
 
 /**
@@ -853,6 +905,20 @@ async function verifyRun({ runDir, prdPath, queueEntry, allJobs = [], committedD
       // seen in 58-web-remote-correctness-batch, 2026-06-10).
       if (isHarnessToolError(ev.content)) continue;
 
+      // A PreToolUse policy denial (a guard hook blocked the call before it
+      // ran) is exempt from both the is_error scan and the content-pattern
+      // scan for the same reason as a harness tool error above — the denied
+      // call never executed. Unlike a harness tool error, record it as an
+      // annotation so the denial stays visible in the verdict record instead
+      // of vanishing silently.
+      if (isPolicyDenial(ev.content)) {
+        annotations.push({
+          verdict: 'policy_denial',
+          reason: `PreToolUse policy denial at event ${i}: ${ev.content.slice(0, 200)}`,
+        });
+        continue;
+      }
+
       // A tool_result carrying a non-null parent_tool_use_id happened INSIDE a Task
       // subagent's own execution, not in the main agent's. Subagents do ordinary
       // exploratory work (greps that exit 1 on no-match, ls on a path that may not
@@ -1147,6 +1213,7 @@ module.exports = {
   // Exposed for unit tests.
   detectPattern,
   isHarnessToolError,
+  isPolicyDenial,
   isSelfRecovered,
   normalizeDescForRecovery,
   toolUseName,
@@ -1155,6 +1222,7 @@ module.exports = {
   checkDeps,
   parseLog,
   scanSentinel,
+  scanForeignWipPathsClaim,
   isMergeMainSlug,
   extractMergeMainPrNumber,
   checkMergeablePr,