claude-code-session-manager 0.86.0 → 0.88.0

package/src/main/lib/__tests__/procName.test.cjs

@@ -0,0 +1,92 @@
+// PRD pn-01: procName primitive. HOME is redirected to a temp dir for the whole file
+// (procnamesRoot() resolves lazily from HOME) — never the real ~/.claude.
+import { describe, it, expect, afterAll } from 'vitest';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'procname-'));
+const realHome = process.env.HOME;
+process.env.HOME = tmpHome; // stays redirected: procnamesRoot() resolves lazily
+const { aliasBinFor, smArgv0, procnamesRoot, pruneStaleAliases } = require('../procName.cjs');
+
+afterAll(() => {
+  process.env.HOME = realHome;
+  try { fs.chmodSync(procnamesRoot(), 0o700); } catch { /* absent */ }
+  fs.rmSync(tmpHome, { recursive: true, force: true });
+});
+
+function fakeBin(name) {
+  const p = path.join(tmpHome, name);
+  fs.writeFileSync(p, '#!/bin/sh\nexit 0\n', { mode: 0o755 });
+  return p;
+}
+
+describe('procName', () => {
+  it('procnamesRoot() lives under the temp HOME machine-state root', () => {
+    expect(procnamesRoot()).toBe(path.join(tmpHome, '.claude', 'session-manager', 'procnames'));
+  });
+
+  it('creates a symlink and returns the alias path', () => {
+    const bin = fakeBin('bin-a');
+    const out = aliasBinFor(bin, 'sm-claude-job');
+    expect(out).toBe(path.join(procnamesRoot(), 'sm-claude-job'));
+    expect(fs.readlinkSync(out)).toBe(bin);
+  });
+
+  it('self-repairs a drifted link', () => {
+    const a = fakeBin('bin-b1');
+    const b = fakeBin('bin-b2');
+    aliasBinFor(a, 'sm-claude-chat');
+    const out = aliasBinFor(b, 'sm-claude-chat');
+    expect(fs.readlinkSync(out)).toBe(b);
+  });
+
+  it('throws on an alias longer than 15 chars', () => {
+    expect(() => aliasBinFor(fakeBin('bin-c'), 'sm-claude-toolong-x')).toThrow(/TASK_COMM_LEN/);
+    expect(() => aliasBinFor(fakeBin('bin-c'), 'session-manager')).not.toThrow();
+  });
+
+  it('returns the original bin for an unresolvable bare name', () => {
+    expect(aliasBinFor('definitely-not-a-real-cmd-xyz', 'sm-claude-aux')).toBe('definitely-not-a-real-cmd-xyz');
+  });
+
+  it.skipIf(process.getuid && process.getuid() === 0)('fails open when procnamesRoot() is read-only', () => {
+    const bin = fakeBin('bin-d');
+    fs.mkdirSync(procnamesRoot(), { recursive: true });
+    fs.chmodSync(procnamesRoot(), 0o500);
+    try {
+      expect(aliasBinFor(bin, 'sm-shell')).toBe(bin);
+    } finally {
+      fs.chmodSync(procnamesRoot(), 0o700);
+    }
+  });
+
+  it('smArgv0 shape, sanitisation, and length bound', () => {
+    expect(smArgv0('job', 'prd 12/x!')).toBe('sm-claude-job:prd12x');
+    expect(smArgv0('job', 'a'.repeat(500)).length).toBeLessThanOrEqual(120);
+  });
+
+  it('smArgv0 always matches the live /\\bclaude\\b/ gates for every role', () => {
+    // Replicated verbatim from scheduler.cjs killOrphanClaudePid & reaperHelpers.cjs claudePidAlive.
+    const gate = /\bclaude\b/;
+    for (const role of ['job', 'chat', 'aux', 'helper', '', undefined, '!!!', 'x'.repeat(300)]) {
+      for (const detail of ['abc', '', undefined, null, '///', 'y'.repeat(300)]) {
+        const label = smArgv0(role, detail);
+        expect(gate.test(label)).toBe(true);
+        expect(label.length).toBeLessThanOrEqual(120);
+      }
+    }
+  });
+
+  it('pruneStaleAliases removes dead links and keeps live ones', () => {
+    const live = fakeBin('bin-live');
+    const dead = fakeBin('bin-dead');
+    const liveAlias = aliasBinFor(live, 'sm-live');
+    const deadAlias = aliasBinFor(dead, 'sm-dead');
+    fs.rmSync(dead);
+    expect(() => pruneStaleAliases()).not.toThrow();
+    expect(fs.existsSync(liveAlias)).toBe(true);
+    expect(fs.lstatSync(deadAlias, { throwIfNoEntry: false })).toBeUndefined();
+  });
+});

package/src/main/lib/__tests__/queueStoreMachineStateRecovery.test.cjs

@@ -121,3 +121,70 @@ test('readMerged (async) recovers the same real fixture', async () => {
   expect(state.machineStateRecoveryMode).toBe('prefix');
   expect(state.lastRunAt).toBe('2026-09-11T10:00:14.441Z');
 });
+
+// ---------- per-cwd shard quarantine (never recover, never write) ----------
+
+function makeProject(name, jobs) {
+  const cwd = path.join(tmpHome, 'Projects', name);
+  const stateDir = path.join(cwd, 'session-manager-operations', 'scheduler', 'state');
+  fs.mkdirSync(stateDir, { recursive: true });
+  const file = path.join(stateDir, 'queue.json');
+  if (jobs) fs.writeFileSync(file, JSON.stringify({ jobs }));
+  const slugDir = path.join(tmpHome, '.claude', 'projects', `slug-${name}`);
+  fs.mkdirSync(slugDir, { recursive: true });
+  fs.writeFileSync(path.join(slugDir, 't.jsonl'), JSON.stringify({ cwd }) + '\n');
+  return { cwd, file };
+}
+
+const TORN = '{"jobs":[{"slug":"a","status":"running"}]} {"jobs":[{"slug":"a","stat';
+const goodJob = (slug, cwd) => ({
+  slug, status: 'pending', prdPath: `/x/${slug}.md`, cwd, scheduledFor: null, createdAt: new Date().toISOString(),
+});
+
+test('a torn shard is quarantined per cwd; the machine-level `unreadable` stays unset and the sibling shard still loads', () => {
+  const good = makeProject('good', [goodJob('g1', path.join(tmpHome, 'Projects', 'good'))]);
+  const torn = makeProject('torn');
+  fs.writeFileSync(torn.file, TORN);
+  const opts = { projectsDir: path.join(tmpHome, '.claude', 'projects') };
+
+  const state = queueStore.readMergedSync(opts);
+
+  expect(state.unreadable).toBeUndefined();
+  expect(state.unreadableCwds).toHaveLength(1);
+  expect(state.unreadableCwds[0]).toMatchObject({ cwd: torn.cwd, file: torn.file });
+  expect(typeof state.unreadableCwds[0].error).toBe('string');
+  expect(state.jobs.map((j) => j.slug)).toEqual(['g1']);
+  expect(state.sourceCwds).not.toContain(torn.cwd);
+});
+
+test('readMerged (async) quarantines the same way', async () => {
+  const torn = makeProject('torn2');
+  fs.writeFileSync(torn.file, TORN);
+  const state = await queueStore.readMerged({ projectsDir: path.join(tmpHome, '.claude', 'projects') });
+  expect(state.unreadable).toBeUndefined();
+  expect(state.unreadableCwds.map((u) => u.cwd)).toEqual([torn.cwd]);
+});
+
+test('writeSplit leaves a torn shard byte-identical even when merged rows carry its cwd, and still writes healthy shards', async () => {
+  const good = makeProject('good3', [goodJob('g1', path.join(tmpHome, 'Projects', 'good3'))]);
+  const torn = makeProject('torn3');
+  fs.writeFileSync(torn.file, TORN);
+  const before = fs.readFileSync(torn.file);
+  const opts = { projectsDir: path.join(tmpHome, '.claude', 'projects') };
+
+  const state = await queueStore.readMerged(opts);
+  state.jobs.push(goodJob('intruder', torn.cwd)); // a row that claims the torn cwd
+  state.jobs[0].status = 'running';
+  await queueStore.writeSplit(state, good.cwd);
+
+  expect(fs.readFileSync(torn.file).equals(before)).toBe(true);
+  const written = JSON.parse(fs.readFileSync(good.file, 'utf8'));
+  expect(written.jobs.map((j) => j.status)).toEqual(['running']);
+});
+
+test('writeSplit never re-creates a quarantined shard that has no file at all', async () => {
+  const ghost = makeProject('ghost');
+  const state = { config: {}, jobs: [goodJob('x', ghost.cwd)], sourceCwds: [], unreadableCwds: [{ cwd: ghost.cwd, file: ghost.file, error: 'x' }] };
+  await queueStore.writeSplit(state, ghost.cwd);
+  expect(fs.existsSync(ghost.file)).toBe(false);
+});

package/src/main/lib/__tests__/reaperHelpers.test.cjs

@@ -23,7 +23,8 @@ const { spawn } = require('node:child_process');
 const {
   selectReapableJobs, mapOutcomeToGateOutcome, classifyRunOutcome,
   findLiveProcessForJob, logHasOutput, resolvePidlessGateOutcome,
-  isAlreadySatisfiedOnMain,
+  isAlreadySatisfiedOnMain, resolvePidlessFailureOverride,
+  readSpawnedPidFromLog, isLogFresh,
 } = require('../reaperHelpers.cjs');
 const { detectRateLimitInLog } = require('../rateLimitDetect.cjs');
 
@@ -339,6 +340,28 @@ test('findLiveProcessForJob: no live process anywhere → null', () => {
   assert.strictEqual(pid, null);
 });
 
+// findLiveProcessForJob: runCwd — the 2026-09-13 in-place/shared-tree fix.
+// A run with no dedicated worktree (no worktreeDir) and no slug in argv
+// (dispatch never puts it there) is invisible to both existing matches; the
+// runCwd+cmdline-claude combo match exists for exactly this shape. `sleep`
+// is used as the /proc-visible process here (not a real `claude` binary), so
+// this exercises the cwd-plus-cmdline-substring code path directly rather
+// than depending on a real claude binary being installed.
+test('findLiveProcessForJob: runCwd match requires BOTH cwd AND a claude-looking cmdline — bare cwd match is never sufficient', async () => {
+  if (process.platform !== 'linux' || !fs.existsSync('/proc')) return;
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-reaper-runcwd-'));
+  // Runs in `dir` but its cmdline has no "claude" in it — must NOT match.
+  const child = spawn('sleep', ['5'], { cwd: dir, stdio: 'ignore' });
+  try {
+    await new Promise((resolve) => setTimeout(resolve, 200));
+    const pid = findLiveProcessForJob({ slug: 'unrelated-slug' }, { runCwd: dir });
+    assert.strictEqual(pid, null, 'a bare cwd match without a claude-looking cmdline must never match — shared-tree cross-match hazard');
+  } finally {
+    child.kill('SIGKILL');
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
 // logHasOutput — the literal "did the run dir produce any log output" check
 // that gates whether a pidless reap may assert gateOutcome: 'never_ran'.
 
@@ -397,3 +420,158 @@ test('isAlreadySatisfiedOnMain: no satisfying commits → null — the gate must
   assert.strictEqual(isAlreadySatisfiedOnMain(null), null);
   assert.strictEqual(isAlreadySatisfiedOnMain(undefined), null);
 });
+
+// resolvePidlessFailureOverride — PRD 1173. A pidless reap must never stamp
+// 'failed' on a row that already carries proof (landedCommit) that its work
+// shipped, purely because reproting bookkeeping (runtime.pid) was lost.
+
+test('resolvePidlessFailureOverride: row with a landedCommit → override naming the recorded commit sha', () => {
+  const override = resolvePidlessFailureOverride({ slug: 'shipped-but-pidless', landedCommit: 'f3e35a7f9e49f13a9eb8c338b0d086160e32a87f' });
+  assert.ok(override, 'a row with landedCommit must produce a failure override');
+  assert.strictEqual(override.verdict, 'pidless_reap_with_landed_commit');
+  assert.strictEqual(override.landedCommit, 'f3e35a7f9e49f13a9eb8c338b0d086160e32a87f');
+  assert.match(override.reason, /f3e35a7f9e49f13a9eb8c338b0d086160e32a87f/, 'the reason string must name the recorded commit sha so a human can go straight to `git show <sha>`');
+});
+
+test('resolvePidlessFailureOverride: row with no landedCommit → null, existing failed transition untouched', () => {
+  assert.strictEqual(resolvePidlessFailureOverride({ slug: 'genuinely-never-ran' }), null);
+  assert.strictEqual(resolvePidlessFailureOverride({ slug: 'genuinely-never-ran', landedCommit: null }), null);
+  assert.strictEqual(resolvePidlessFailureOverride({ slug: 'genuinely-never-ran', landedCommit: '' }), null);
+});
+
+// readSpawnedPidFromLog — recovers the pid a pidless row's spawn actually
+// produced from the run's own log (2026-09-13 incident: runId
+// 2026-09-13T16-15-56-818Z spawned pid=3138458, logged it, but the
+// runtime.pid persistence mutate failed silently and the pidless-grace
+// reaper terminalized a live job it could have found here).
+
+test('readSpawnedPidFromLog: parses the scheduler\'s own spawned-pid line', () => {
+  const p = writeTmpLog('some preamble\n[scheduler] spawned pid=3138458 sessionId=345ca5b1-c7a7-4167-9b55-f4905e3afe01 (process group)\n\nmore output\n');
+  assert.strictEqual(readSpawnedPidFromLog(p), 3138458);
+});
+
+test('readSpawnedPidFromLog: missing file → null', () => {
+  assert.strictEqual(readSpawnedPidFromLog('/nonexistent/path/does-not-exist.log'), null);
+});
+
+test('readSpawnedPidFromLog: empty file → null', () => {
+  const p = writeTmpLog('');
+  assert.strictEqual(readSpawnedPidFromLog(p), null);
+});
+
+test('readSpawnedPidFromLog: log with no spawned-pid line → null', () => {
+  const p = writeTmpLog('{"type":"result","subtype":"success","is_error":false,"result":"done"}\n');
+  assert.strictEqual(readSpawnedPidFromLog(p), null);
+});
+
+test('readSpawnedPidFromLog: null path → null', () => {
+  assert.strictEqual(readSpawnedPidFromLog(null), null);
+});
+
+// isLogFresh — pure predicate: a log modified within the window is positive
+// proof of life, independent of runtime.pid bookkeeping.
+
+test('isLogFresh: mtime within window → true', () => {
+  assert.strictEqual(isLogFresh(NOW - 60_000, NOW, 20 * 60_000), true);
+});
+
+test('isLogFresh: mtime outside window → false', () => {
+  assert.strictEqual(isLogFresh(NOW - 30 * 60_000, NOW, 20 * 60_000), false);
+});
+
+test('isLogFresh: missing/invalid mtime or window → false', () => {
+  assert.strictEqual(isLogFresh(null, NOW, 20 * 60_000), false);
+  assert.strictEqual(isLogFresh(NaN, NOW, 20 * 60_000), false);
+  assert.strictEqual(isLogFresh(NOW - 60_000, NOW, null), false);
+});
+
+// selectReapableJobs — Part B wiring: a pidless row past grace now consults
+// the run log for a pid, and a fresh log skips the row entirely, BEFORE
+// falling back to findLiveProcess or the existing terminal reap.
+
+test('selectReapableJobs: pidless + past grace + log yields a LIVE pid → recovered, never reapable, row stays running', () => {
+  const jobs = [{ slug: 'zombie-log-alive', status: 'running', startedAt: agoMin(464) }];
+  const pidAlive = (pid) => pid === 3138458;
+  const getLogPid = () => 3138458;
+  const { reapable, recovered, warnings } = selectReapableJobs(jobs, NOW, {
+    pidAlive, grace: GRACE, getLogPid,
+  });
+  assert.deepStrictEqual(reapable, []);
+  assert.deepStrictEqual(warnings, []);
+  assert.strictEqual(recovered.length, 1);
+  assert.strictEqual(recovered[0].slug, 'zombie-log-alive');
+  assert.strictEqual(recovered[0].pid, 3138458);
+});
+
+test('selectReapableJobs: pidless + past grace + log yields a DEAD pid → still reaps (no regression)', () => {
+  const jobs = [{ slug: 'zombie-log-dead', status: 'running', startedAt: agoMin(464) }];
+  const getLogPid = () => 3138458;
+  const { reapable, recovered } = selectReapableJobs(jobs, NOW, {
+    pidAlive: alwaysDead, grace: GRACE, getLogPid,
+  });
+  assert.deepStrictEqual(recovered, []);
+  assert.strictEqual(reapable.length, 1);
+  assert.strictEqual(reapable[0].pidless, true);
+});
+
+test('selectReapableJobs: pidless + past grace + FRESH log mtime → skipped entirely (neither reapable nor recovered)', () => {
+  const jobs = [{ slug: 'chatty-pidless', status: 'running', startedAt: agoMin(464) }];
+  const getLogMtimeMs = () => NOW - 60_000; // modified 1 minute ago
+  const { reapable, recovered, warnings } = selectReapableJobs(jobs, NOW, {
+    pidAlive: alwaysAlive, grace: GRACE, getLogMtimeMs, logFreshWindowMs: 20 * 60_000,
+  });
+  assert.deepStrictEqual(reapable, []);
+  assert.deepStrictEqual(recovered, []);
+  assert.strictEqual(warnings.length, 1);
+  assert.strictEqual(warnings[0].slug, 'chatty-pidless');
+  assert.match(warnings[0].reason, /log evidence/);
+});
+
+test('selectReapableJobs: pidless + past grace + STALE log mtime + no recoverable pid → reaps with the existing reason string, byte-identical', () => {
+  const jobs = [{ slug: 'zombie', status: 'running', startedAt: agoMin(464) }];
+  const getLogMtimeMs = () => NOW - 25 * 60_000; // stale relative to a 20m window
+  const { reapable } = selectReapableJobs(jobs, NOW, {
+    pidAlive: alwaysAlive, grace: GRACE, getLogMtimeMs, logFreshWindowMs: 20 * 60_000,
+  });
+  assert.strictEqual(reapable.length, 1);
+  assert.strictEqual(reapable[0].reason, 'reaped: no runtime.pid recorded after 10m — spawn never completed');
+});
+
+test('selectReapableJobs: a row WITH a live runtime.pid is untouched by every new code path', () => {
+  const jobs = [{ slug: 'live', status: 'running', runtime: { pid: 1 }, startedAt: agoMin(500) }];
+  const getLogPid = () => { throw new Error('must never be called for a live-pid row'); };
+  const getLogMtimeMs = () => { throw new Error('must never be called for a live-pid row'); };
+  const { reapable, recovered, warnings } = selectReapableJobs(jobs, NOW, {
+    pidAlive: alwaysAlive, grace: GRACE, getLogPid, getLogMtimeMs, logFreshWindowMs: 20 * 60_000,
+  });
+  assert.deepStrictEqual(reapable, []);
+  assert.deepStrictEqual(recovered, []);
+  assert.deepStrictEqual(warnings, []);
+});
+
+test('selectReapableJobs: pidless + past grace + landedCommit on the row → reapable entry carries a failureOverride', () => {
+  const jobs = [{
+    slug: 'shipped-but-pidless',
+    status: 'running',
+    startedAt: agoMin(464),
+    landedCommit: 'f3e35a7f9e49f13a9eb8c338b0d086160e32a87f',
+  }];
+  const { reapable } = selectReapableJobs(jobs, NOW, { pidAlive: alwaysAlive, grace: GRACE });
+  assert.strictEqual(reapable.length, 1);
+  assert.strictEqual(reapable[0].pidless, true);
+  assert.ok(reapable[0].failureOverride, 'the reapable entry must carry the evidence-based override');
+  assert.strictEqual(reapable[0].failureOverride.landedCommit, 'f3e35a7f9e49f13a9eb8c338b0d086160e32a87f');
+  // The existing byte-for-byte reason string is untouched by this PRD — the
+  // override is carried as a separate field, not folded into `reason`.
+  assert.strictEqual(
+    reapable[0].reason,
+    'reaped: no runtime.pid recorded after 10m — spawn never completed',
+  );
+});
+
+test('selectReapableJobs: pidless + past grace + NO landedCommit on the row → failureOverride is null, unchanged from today', () => {
+  const jobs = [{ slug: 'genuinely-never-ran', status: 'running', startedAt: agoMin(464) }];
+  const { reapable } = selectReapableJobs(jobs, NOW, { pidAlive: alwaysAlive, grace: GRACE });
+  assert.strictEqual(reapable.length, 1);
+  assert.strictEqual(reapable[0].failureOverride, null);
+});

package/src/main/lib/__tests__/schedulerMcpServerHelp.test.cjs

@@ -6,11 +6,11 @@
  * when the admin API is unreachable — only the readiness section may report
  * unavailable.
  *
- * TOKEN_PATH (scripts/scheduler-mcp-server.cjs) is computed once, at
- * require-time, from os.homedir(). Since os.homedir() reads process.env.HOME
- * on POSIX, each test temporarily repoints HOME at a fresh tmp dir, clears
- * the require cache, and re-requires the module so TOKEN_PATH resolves under
- * that tmp dir — never touching the real ~/.claude/session-manager/admin-api.json.
+ * The admin token path (schedulerPaths.adminTokenPath) resolves lazily from
+ * os.homedir(). Since os.homedir() reads process.env.HOME on POSIX, each test
+ * repoints HOME at a fresh tmp dir for its duration (restored in afterEach)
+ * so the token path resolves under that tmp dir, never the real
+ * ~/.claude/session-manager/admin-api.json.
  *
  * Run: timeout 120 npx vitest run src/main/lib/__tests__/schedulerMcpServerHelp.test.cjs
  */
@@ -72,8 +72,7 @@ function requireServerWithHome(homeDir) {
   process.env.HOME = homeDir;
   delete require.cache[require.resolve(SERVER_PATH)];
   const mod = require(SERVER_PATH);
-  process.env.HOME = originalHome;
-  originalHome = undefined;
+  // HOME stays redirected until afterEach: admin-token path resolves lazily.
   return mod;
 }