claude-code-session-manager 0.85.0 → 0.86.0

package/src/main/lib/schedulerConfig.cjs

@@ -81,6 +81,19 @@ module.exports = {
   // 1086). Escalation only — warn + audit, never dispatch.
   STARVATION_ESCALATE_MS: 45 * 60_000,
 
+  // A project still meeting findStarvedProjects' STARVED verdict past THIS
+  // (later) threshold gets a bounded, automated consequence beyond the
+  // repeating project_starved WARN above: a one-shot 'project_starve_escalated'
+  // audit event + a user-facing toast naming the project and the last tick's
+  // hold reason (scheduler.cjs's `lastTick`). Escalation only — never
+  // auto-resets, auto-cancels, or bypasses a gate; the queue's own state is
+  // untouched. The 2026-09-12 audit log showed /home/bilko/Projects/Bilko
+  // emit project_starved for 19h straight (ageMs 60.5M → 68.9M) with zero
+  // consequence and no toast — this is the fix. Latched per-cwd so the SAME
+  // starve stretch escalates exactly once; the latch resets the moment that
+  // cwd stops appearing in findStarvedProjects.
+  STARVE_ESCALATION_MS: 60 * 60_000,
+
   // A RUNNING job that has overrun its own PRD's `estimateMinutes` by this
   // factor is escalated. Distinct from MAX_JOB_DURATION_MS (4h), which is a
   // deadman kill: a 20-minute PRD still running at 3h is 9x over estimate but

package/src/main/lib/telemetryBoot.cjs

@@ -38,8 +38,10 @@ function resolveDeps(deps = {}) {
  *     signal that also gates the machine-profile heartbeat below).
  *  3. install upsert — sent once via telemetryClient.reportInstall(profile)
  *     when telemetrySettings.isMachineReportDue() is true (a version bump, OR
- *     the 30-day liveness heartbeat), then lastMachineReportAt/Version are
- *     persisted so a same-version reboot within the window sends nothing.
+ *     the 30-day liveness heartbeat). lastMachineReportAt/Version are only
+ *     persisted when reportInstall() reports success — a failed/dropped
+ *     upsert stays due so the next boot retries, rather than being marked
+ *     done regardless of outcome.
  *     This lands in bilko.run's app_installs table (the sole source for
  *     every install-shaped number on the site). It replaces the former
  *     track('install.machine', profile) call, which duplicated the same
@@ -62,12 +64,13 @@ async function bootSequence({ now = Date.now(), appVersion, installChannel, deps
 
   if (telemetrySettings.isMachineReportDue(settings, { now, appVersion })) {
     const profile = await buildMachineProfile();
-    await telemetryClient.reportInstall(profile);
-    await telemetrySettings.save({
-      ...settings,
-      lastMachineReportAt: new Date(now).toISOString(),
-      lastMachineReportVersion: appVersion,
-    });
+    const reportResult = await telemetryClient.reportInstall(profile);
+    if (reportResult && reportResult.accepted) {
+      await telemetrySettings.save({
+        lastMachineReportAt: new Date(now).toISOString(),
+        lastMachineReportVersion: appVersion,
+      });
+    }
   }
 
   telemetryCounters.trackAppLaunch({ installChannel, appVersion });

package/src/main/lib/telemetryClient.cjs

@@ -91,8 +91,24 @@ const S = {
   lastError: null,
   lastFlushAt: null,
   lastFlushReason: null,
+  logger: null,
 };
 
+/**
+ * Best-effort warn logger for failures this module would otherwise swallow
+ * (e.g. reportInstall()'s bare catch). Lazily requires logs.cjs — which
+ * requires('electron') at module scope — so this stays a no-op under plain
+ * vitest with no Electron runtime, exactly like machineProfile.cjs's
+ * resolveElectronApp(). Injectable via _setLogger so tests can observe it
+ * without an Electron runtime.
+ */
+function logWarn(message, meta) {
+  try {
+    const fn = S.logger || require('../logs.cjs').writeLine;
+    fn({ scope: 'telemetry', level: 'warn', message, meta });
+  } catch { /* logs unavailable outside an Electron runtime */ }
+}
+
 /**
  * SM_TELEMETRY_SPOOL, when set, overrides the spool directory in place of
  * `~/.config/session-manager` — the explicit opt-in a test that genuinely
@@ -130,6 +146,18 @@ function getBeaconToken() {
   return process.env.SM_BEACON_KEY || FALLBACK_BEACON_KEY;
 }
 
+/**
+ * The wire-level `env` discriminator for the currently-running process,
+ * resolved from real signals (never from an appVersion string — see
+ * machineProfile.cjs's resolveEnv header comment for why that matters).
+ */
+function currentEnv() {
+  return machineProfile.resolveEnv({
+    isTestRunner: isTestEnvironment(),
+    installChannel: S.profile && S.profile.installChannel,
+  });
+}
+
 // ─── safe coercion helpers (never throw, regardless of input shape) ───────
 
 function safeObj(v) {
@@ -436,6 +464,7 @@ async function track(name, props) {
       props: meta,
       session_id: S.sessionId,
       visitor_id: S.settings.installId,
+      env: currentEnv(),
     };
     return await appendRecord('event', wire, recordId);
   } catch {
@@ -465,6 +494,7 @@ async function logLine(opts) {
       session_id: S.sessionId,
       fields: meta,
       ts: Date.now(),
+      env: currentEnv(),
     };
     return await appendRecord('log', wire, recordId);
   } catch {
@@ -501,6 +531,7 @@ async function reportError(opts) {
       session_id: S.sessionId,
       context: meta,
       ts: Date.now(),
+      env: currentEnv(),
     };
     return await appendRecord('error', wire, recordId);
   } catch {
@@ -527,6 +558,11 @@ function buildInstallWire(profile, installId) {
     // the numeric UTC offset (see machineProfile.cjs) — so that is what maps
     // onto the server's `timezone` column.
     timezone: safeStr(p.timezoneOffsetMinutes, 20),
+    // Resolved from this passed-in profile's own installChannel (never
+    // S.profile — reportInstall() is always given a freshly-built profile,
+    // not the module-singleton one) plus the current process's test-runner
+    // signal, same three-value contract as the other three channels.
+    env: machineProfile.resolveEnv({ isTestRunner: isTestEnvironment(), installChannel: p.installChannel }),
   };
 }
 
@@ -544,7 +580,8 @@ async function reportInstall(profile) {
     const recordId = crypto.randomUUID();
     const wire = buildInstallWire(profile, S.settings.installId);
     return await appendRecord('install', wire, recordId);
-  } catch {
+  } catch (e) {
+    logWarn('reportInstall failed', { error: e && e.message ? e.message : String(e) });
     return { accepted: false, reason: 'error' };
   }
 }
@@ -684,7 +721,7 @@ async function flushImpl(reason) {
     await persistSent();
 
     if (safeReason === 'daily' && result.failed.length === 0) {
-      S.settings = await telemetrySettings.save({ ...S.settings, lastDailyFlushAt: new Date().toISOString() });
+      S.settings = await telemetrySettings.save({ lastDailyFlushAt: new Date().toISOString() });
     }
   } catch { /* fail-inert */ }
   S.lastFlushAt = Date.now();
@@ -749,6 +786,10 @@ function _setMachineProfileBuilder(fn) {
   S.profileBuilder = typeof fn === 'function' ? fn : machineProfile.buildMachineProfile;
 }
 
+function _setLogger(fn) {
+  S.logger = typeof fn === 'function' ? fn : null;
+}
+
 module.exports = {
   track,
   logLine,
@@ -764,4 +805,5 @@ module.exports = {
   sentPath,
   _setFetchImpl,
   _setMachineProfileBuilder,
+  _setLogger,
 };

package/src/main/lib/telemetrySettings.cjs

@@ -78,11 +78,28 @@ function normalize(cfg) {
   };
 }
 
+/**
+ * Persists `patch` merged onto a FRESHLY-READ copy of the on-disk config —
+ * never onto a caller-held snapshot. Two independent modules (telemetryBoot's
+ * install-report stamp, telemetryClient's own daily-flush stamp) each keep
+ * their own in-memory copy of settings loaded at different times; if save()
+ * blindly wrote a caller's full snapshot, whichever call landed last would
+ * silently revert every field the OTHER caller had just written (a lost
+ * update — the root cause behind lastMachineReportAt never sticking). Calls
+ * are still serialized through the existing writeQueue chain, so the fresh
+ * read for call N+1 always observes call N's write.
+ */
 let writeQueue = Promise.resolve();
-async function save(cfg) {
-  if (!isValid(cfg)) throw new Error('Invalid telemetry config');
-  const next = normalize(cfg);
+async function save(patch) {
+  if (!patch || typeof patch !== 'object' || Array.isArray(patch)) throw new Error('Invalid telemetry config');
+  for (const k of Object.keys(patch)) {
+    if (!KNOWN_KEYS.has(k)) throw new Error('Invalid telemetry config');
+  }
   const run = async () => {
+    const current = await readRaw();
+    const merged = { ...current, ...patch };
+    if (!isValid(merged)) throw new Error('Invalid telemetry config');
+    const next = normalize(merged);
     await config.writeTextAtomic(storePath(), JSON.stringify(next, null, 2) + '\n', { mode: 0o600 });
     return next;
   };

package/src/main/pty.cjs

@@ -109,6 +109,15 @@ class PtyManager {
     // renderer will re-register its data/exit listeners on the same IPC
     // channels. The data stream is live; pre-reattach output is lost, which
     // is acceptable for a dev reload.
+    //
+    // Telemetry: this branch deliberately does NOT call
+    // telemetryCounters.trackSessionOpen() (see below, after the real spawn).
+    // Tab = claudeSessionId is a 1:1 mapping (CLAUDE.md domain model) — a
+    // reattach is the SAME session process still running, not a new one, so
+    // counting it here would double-count every renderer reload and every
+    // switch back to an already-open Epic's Terminal pane within the same
+    // Electron process. `session.open` counts fresh PTY spawns only; see
+    // telemetry.md for the full rationale and its trade-off.
     const existing = this.sessions.get(tabId);
     if (existing) {
       console.log('[pty] reattach to existing session tabId=', tabId, 'pid=', existing.proc.pid);