claude-code-session-manager 0.81.0 → 0.82.0

package/src/main/lib/machineProfile.cjs

@@ -0,0 +1,144 @@
+/**
+ * machineProfile — builds the "once per machine" telemetry payload: which
+ * build (appVersion) this install id is running, plus basic hardware/OS specs.
+ *
+ * Deliberately anonymous: no hostname, no OS username, no homedir, no MAC
+ * address, no hardware serial, no absolute filesystem path, no IANA timezone
+ * name (offset only). machineDigest is a coarse hash of stable spec fields —
+ * a hardware-CLASS fingerprint, never a device id — so individual records
+ * can be joined back to a machine class without repeating the whole profile.
+ *
+ * Pure data plumbing: no network code, no call sites. Later PRDs consume it.
+ */
+'use strict';
+
+const os = require('node:os');
+const crypto = require('node:crypto');
+const path = require('node:path');
+const claudeBin = require('./claudeBin.cjs');
+
+function resolveElectronApp() {
+  try {
+    // eslint-disable-next-line global-require
+    const electron = require('electron');
+    if (electron && typeof electron === 'object' && typeof electron.app === 'object') {
+      return electron.app;
+    }
+  } catch { /* no electron runtime (plain vitest, or electron require resolved to a path string) */ }
+  return null;
+}
+
+function resolvePackageVersion() {
+  try {
+    // src/main/lib/machineProfile.cjs -> src/main/lib -> src/main -> src -> repo root
+    const pkg = require(path.join(__dirname, '..', '..', '..', 'package.json'));
+    return (pkg && typeof pkg.version === 'string') ? pkg.version : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * 'npx' when the app path lives inside an npm/npx cache dir, 'dev' when
+ * SM_DEV is set, else 'unknown'. Injectable so tests never depend on real
+ * process state.
+ */
+function resolveInstallChannel({ appPath = null, devFlag = !!process.env.SM_DEV } = {}) {
+  if (devFlag) return 'dev';
+  if (typeof appPath === 'string' && /[\\/](\.npm|_npx|npm-cache|npx-cache)[\\/]/i.test(appPath)) {
+    return 'npx';
+  }
+  return 'unknown';
+}
+
+/** sha256 of the concatenated stable spec fields, truncated to 12 hex chars. */
+function computeMachineDigest(specs) {
+  const material = [
+    specs.platform,
+    specs.osRelease,
+    specs.arch,
+    specs.cpuModel || '',
+    String(specs.cpuCount),
+    String(specs.totalMemMb),
+  ].join('|');
+  return crypto.createHash('sha256').update(material).digest('hex').slice(0, 12);
+}
+
+/** Reads basic, non-identifying specs from node:os. Null-safe when os.cpus() is empty. */
+function readSpecs(osModule) {
+  const cpus = osModule.cpus() || [];
+  const cpu0 = cpus[0] || null;
+  return {
+    platform: osModule.platform(),
+    osRelease: osModule.release(),
+    arch: osModule.arch(),
+    cpuModel: cpu0 && typeof cpu0.model === 'string' ? cpu0.model.trim() : null,
+    cpuSpeedMhz: cpu0 && typeof cpu0.speed === 'number' ? cpu0.speed : null,
+    cpuCount: cpus.length,
+    totalMemMb: Math.round(osModule.totalmem() / 1048576),
+  };
+}
+
+/**
+ * Builds the machine profile. All external dependencies are injectable so
+ * this is fully testable under plain vitest with no Electron runtime and no
+ * real Claude CLI.
+ *
+ * @param {object} [opts]
+ * @param {object} [opts.osModule] - defaults to node:os
+ * @param {function} [opts.probeClaudeVersion] - defaults to claudeBin.probeClaudeVersion; must resolve to a string or null and never block startup
+ * @param {object|null} [opts.electronApp] - override for tests; when omitted, 'electron' is required lazily
+ * @param {string} [opts.firstSeenAt] - ISO timestamp; defaults to now (callers that track a persisted first-seen value should pass it)
+ */
+async function buildMachineProfile(opts = {}) {
+  const osModule = opts.osModule || os;
+  const probeClaudeVersion = opts.probeClaudeVersion || claudeBin.probeClaudeVersion;
+  const electronApp = Object.prototype.hasOwnProperty.call(opts, 'electronApp')
+    ? opts.electronApp
+    : resolveElectronApp();
+
+  let appVersion = null;
+  let appPath = null;
+  if (electronApp) {
+    try { appVersion = electronApp.getVersion(); } catch { /* not ready / not a real app object */ }
+    try { appPath = electronApp.getAppPath(); } catch { /* not ready / not a real app object */ }
+  }
+  if (!appVersion) appVersion = resolvePackageVersion();
+
+  const specs = readSpecs(osModule);
+  const machineDigest = computeMachineDigest(specs);
+
+  let claudeCliVersion = null;
+  try {
+    claudeCliVersion = await probeClaudeVersion();
+  } catch {
+    claudeCliVersion = null;
+  }
+
+  return {
+    appVersion,
+    installChannel: resolveInstallChannel({ appPath, devFlag: !!process.env.SM_DEV }),
+    machineDigest,
+    platform: specs.platform,
+    osRelease: specs.osRelease,
+    arch: specs.arch,
+    cpuModel: specs.cpuModel,
+    cpuCount: specs.cpuCount,
+    cpuSpeedMhz: specs.cpuSpeedMhz,
+    totalMemMb: specs.totalMemMb,
+    nodeVersion: process.versions.node || null,
+    electronVersion: process.versions.electron || null,
+    chromeVersion: process.versions.chrome || null,
+    v8Version: process.versions.v8 || null,
+    claudeCliVersion,
+    locale: Intl.DateTimeFormat().resolvedOptions().locale || null,
+    timezoneOffsetMinutes: new Date().getTimezoneOffset(),
+    firstSeenAt: opts.firstSeenAt || new Date().toISOString(),
+  };
+}
+
+module.exports = {
+  buildMachineProfile,
+  computeMachineDigest,
+  resolveInstallChannel,
+};

package/src/main/lib/telemetrySettings.cjs

@@ -0,0 +1,171 @@
+/**
+ * telemetrySettings — persists product-telemetry consent/config + install identity.
+ *
+ * Storage: ~/.config/session-manager/telemetry.json
+ * Shape: {
+ *   enabled: boolean,                // ON by default — hard kill switch is SM_TELEMETRY=0
+ *   installId: string,               // crypto.randomUUID(), minted once, the only identity
+ *   endpoint: string,                // bilko.run ingest base URL
+ *   noticeAckedAt: string|null,      // ISO timestamp the first-run disclosure was shown
+ *   lastMachineReportAt: string|null,
+ *   lastMachineReportVersion: string,
+ *   lastDailyFlushAt: string|null,
+ *   schemaVersion: 1
+ * }
+ *
+ * Modeled directly on ../otelSettings.cjs — same atomic tmp+rename write via config.cjs,
+ * same schemaVersion + isValid() + frozen DEFAULTS shape. Deliberately has NO identity
+ * field beyond installId — no email, no username, no hostname. isValid() rejects any
+ * unknown key so a future accidental PII field can never silently round-trip through load/save.
+ *
+ * This module is pure data plumbing: no network code, no call sites. Later PRDs consume it.
+ */
+'use strict';
+
+const fsp = require('node:fs/promises');
+const path = require('node:path');
+const os = require('node:os');
+const crypto = require('node:crypto');
+const config = require('../config.cjs');
+
+const SCHEMA_VERSION = 1;
+const DAY_MS = 24 * 60 * 60 * 1000;
+const THIRTY_DAYS_MS = 30 * DAY_MS;
+
+const DEFAULTS = Object.freeze({
+  enabled: true,
+  installId: '',
+  endpoint: 'https://bilko.run',
+  noticeAckedAt: null,
+  lastMachineReportAt: null,
+  lastMachineReportVersion: '',
+  lastDailyFlushAt: null,
+  schemaVersion: SCHEMA_VERSION,
+});
+
+const KNOWN_KEYS = new Set(Object.keys(DEFAULTS));
+
+function storePath() {
+  return path.join(os.homedir(), '.config', 'session-manager', 'telemetry.json');
+}
+
+function isValid(cfg) {
+  if (!cfg || typeof cfg !== 'object' || Array.isArray(cfg)) return false;
+  for (const k of Object.keys(cfg)) {
+    if (!KNOWN_KEYS.has(k)) return false;
+  }
+  if (typeof cfg.enabled !== 'boolean') return false;
+  if (typeof cfg.installId !== 'string') return false;
+  if (typeof cfg.endpoint !== 'string' || !cfg.endpoint.trim()) return false;
+  if (cfg.noticeAckedAt !== null && typeof cfg.noticeAckedAt !== 'string') return false;
+  if (cfg.lastMachineReportAt !== null && typeof cfg.lastMachineReportAt !== 'string') return false;
+  if (typeof cfg.lastMachineReportVersion !== 'string') return false;
+  if (cfg.lastDailyFlushAt !== null && typeof cfg.lastDailyFlushAt !== 'string') return false;
+  if (cfg.schemaVersion !== SCHEMA_VERSION) return false;
+  return true;
+}
+
+function normalize(cfg) {
+  return {
+    enabled: !!cfg.enabled,
+    installId: typeof cfg.installId === 'string' ? cfg.installId : '',
+    endpoint: typeof cfg.endpoint === 'string' && cfg.endpoint.trim() ? cfg.endpoint.trim() : DEFAULTS.endpoint,
+    noticeAckedAt: typeof cfg.noticeAckedAt === 'string' ? cfg.noticeAckedAt : null,
+    lastMachineReportAt: typeof cfg.lastMachineReportAt === 'string' ? cfg.lastMachineReportAt : null,
+    lastMachineReportVersion: typeof cfg.lastMachineReportVersion === 'string' ? cfg.lastMachineReportVersion : '',
+    lastDailyFlushAt: typeof cfg.lastDailyFlushAt === 'string' ? cfg.lastDailyFlushAt : null,
+    schemaVersion: SCHEMA_VERSION,
+  };
+}
+
+let writeQueue = Promise.resolve();
+async function save(cfg) {
+  if (!isValid(cfg)) throw new Error('Invalid telemetry config');
+  const next = normalize(cfg);
+  const run = async () => {
+    await config.writeTextAtomic(storePath(), JSON.stringify(next, null, 2) + '\n', { mode: 0o600 });
+    return next;
+  };
+  const tail = writeQueue.then(run, run);
+  writeQueue = tail.catch(() => {});
+  return tail;
+}
+
+async function readRaw() {
+  try {
+    const raw = await fsp.readFile(storePath(), 'utf8');
+    const data = JSON.parse(raw);
+    if (data && typeof data === 'object') {
+      return normalize({ ...DEFAULTS, ...data });
+    }
+  } catch (e) {
+    if (e.code !== 'ENOENT') {
+      console.warn('[telemetrySettings] load failed:', e.message);
+    }
+  }
+  return { ...DEFAULTS };
+}
+
+/**
+ * Loads the persisted config, minting and persisting installId on first read
+ * when absent. A second in-process load() and a fresh load() from disk both
+ * observe the same minted id, since the mint result is written to disk
+ * before this resolves.
+ */
+async function load() {
+  const cfg = await readRaw();
+  if (!cfg.installId) {
+    return save({ ...cfg, installId: crypto.randomUUID() });
+  }
+  return cfg;
+}
+
+/** Hard kill switch (SM_TELEMETRY=0) always wins over the persisted value. */
+function isEnabled(cfg) {
+  if (process.env.SM_TELEMETRY === '0') return false;
+  return !!(cfg && cfg.enabled);
+}
+
+/** Env override always wins over the persisted endpoint. */
+function resolveEndpoint(cfg) {
+  if (process.env.SM_TELEMETRY_ENDPOINT) return process.env.SM_TELEMETRY_ENDPOINT;
+  return (cfg && typeof cfg.endpoint === 'string' && cfg.endpoint.trim()) ? cfg.endpoint : DEFAULTS.endpoint;
+}
+
+/** True when lastDailyFlushAt is null or more than 24h before `now`. `now` is injected, never read internally. */
+function isDailyFlushDue(cfg, now) {
+  const last = cfg && cfg.lastDailyFlushAt;
+  if (!last) return true;
+  const lastMs = new Date(last).getTime();
+  if (Number.isNaN(lastMs)) return true;
+  return (now - lastMs) > DAY_MS;
+}
+
+/**
+ * True when the install has changed app version since its last report, OR
+ * lastMachineReportAt is null / more than 30 days before `now` (periodic
+ * liveness heartbeat — what turns the data into an active-install count
+ * rather than an ever-installed count). `now` is injected, never read internally.
+ */
+function isMachineReportDue(cfg, { now, appVersion }) {
+  if (!cfg) return true;
+  if (cfg.lastMachineReportVersion !== appVersion) return true;
+  const last = cfg.lastMachineReportAt;
+  if (!last) return true;
+  const lastMs = new Date(last).getTime();
+  if (Number.isNaN(lastMs)) return true;
+  return (now - lastMs) > THIRTY_DAYS_MS;
+}
+
+module.exports = {
+  load,
+  save,
+  storePath,
+  isValid,
+  isEnabled,
+  resolveEndpoint,
+  isDailyFlushDue,
+  isMachineReportDue,
+  DEFAULTS,
+  SCHEMA_VERSION,
+};

package/src/main/scheduler.cjs

@@ -7410,6 +7410,27 @@ function isRescanCandidate(job) {
   return false;
 }
 
+/**
+ * Cheap-guard for the 10-minute periodic reverify tick. MUST be expressed in
+ * terms of isRescanCandidate — not a hand-written status test — because the
+ * two drifted once already: the guard only looked for a `needs_review` row
+ * while isRescanCandidate had grown a `failed`/isFailedUnverifiedShaped arm,
+ * so reverifyNeedsReview's failed → needs_review looksDone branch was
+ * unreachable from the periodic path on any queue holding zero needs_review
+ * rows. A `failed` row with no run log sat wedged for five days with the
+ * self-heal that exists to inspect it never firing (only an app restart, via
+ * the unguarded boot call, could reach it). Reported 2026-09-10 from
+ * social-signals-trader.
+ *
+ * Cost: one extra classifyRunOutcome() log stat per `failed` row, and only
+ * for rows that reach isFailedUnverifiedShaped's log check — bounded by the
+ * failed-row count, and strictly cheaper than firing the whole pass (which
+ * does git fetches via computeLooksDone) on every tick.
+ */
+function shouldRunPeriodicReverify(jobs) {
+  return Array.isArray(jobs) && jobs.some((j) => isRescanCandidate(j));
+}
+
 /**
  * Self-healing pass over needs_review jobs. The verifier runs in-process, so a
  * fix to runVerify.cjs only takes effect for jobs verified AFTER an app
@@ -8356,14 +8377,16 @@ async function init() {
     const s = readQueueSync();
     // Periodic self-heal: re-run the verifier over stale needs_review jobs so a
     // job whose work actually landed (committed in-window, no FAIL sentinel)
-    // auto-clears WITHOUT waiting for the next app restart. Cheap-guarded — the
-    // log scan only runs when something is actually flagged. Kill-switch:
+    // auto-clears WITHOUT waiting for the next app restart. Cheap-guarded by
+    // shouldRunPeriodicReverify, which reuses isRescanCandidate so the guard
+    // and the candidate filter can never drift apart again (they did once —
+    // see that function's comment). Kill-switch:
     // SM_REVERIFY_PERIODIC_DISABLE=1 (boot reverify above stays always-on).
     // reverifyNeedsReview's auto-fix loop is capped downstream by
     // MAX_CONCURRENT_INVESTIGATIONS (spawnInvestigation queues/early-returns
     // past it), so this interval firing cannot fan out investigations.
     if (process.env.SM_REVERIFY_PERIODIC_DISABLE !== '1') {
-      if (s.jobs.some((j) => j.status === 'needs_review')) {
+      if (shouldRunPeriodicReverify(s.jobs)) {
         reverifyNeedsReview().catch(() => {});
       }
       // A quarantined row only ever promotes to 'pending' through
@@ -9146,6 +9169,7 @@ module.exports = {
   memoryLimitedBatchSize,
   availableForJobs,
   reverifyNeedsReview,
+  shouldRunPeriodicReverify,
   isRescanCandidate,
   isFailedUnverifiedShaped,
   computeLooksDone,