claude-code-session-manager 0.86.0 → 0.88.0

package/src/main/lib/gitWorktree.cjs

@@ -54,6 +54,8 @@ const path = require('node:path');
 const os = require('node:os');
 const crypto = require('node:crypto');
 const { execFile } = require('node:child_process');
+const { OPS_ROOT_DIR } = require('./opsOwnership.cjs');
+const schedulerPaths = require('./schedulerPaths.cjs');
 
 // Per-kind configuration. Roots are kept OUTSIDE any project's own tree
 // (os.tmpdir(), not `<cwd>/.git/...`) so a managed worktree never shows up in
@@ -85,7 +87,7 @@ const { execFile } = require('node:child_process');
 // days, same rationale as defaultMax above.
 const KIND_CONFIG = {
   job: {
-    root: path.join(os.tmpdir(), 'session-manager-job-worktrees'),
+    get root() { return schedulerPaths.worktreeRoot('job'); },
     branchPrefix: 'sm-job/',
     disableEnv: 'SM_JOB_WORKTREE_DISABLE',
     maxEnv: 'SM_JOB_WORKTREE_MAX',
@@ -94,7 +96,7 @@ const KIND_CONFIG = {
     defaultStaleSweepAgeMs: 24 * 60 * 60 * 1000,
   },
   epic: {
-    root: path.join(os.tmpdir(), 'session-manager-epic-worktrees'),
+    get root() { return schedulerPaths.worktreeRoot('epic'); },
     branchPrefix: 'sm-epic/',
     disableEnv: 'SM_EPIC_WORKTREE_DISABLE',
     maxEnv: 'SM_EPIC_WORKTREE_MAX',
@@ -183,6 +185,13 @@ function isUnderRoot(p, root) {
 // corrected down to match reality when it's proven to have leaked.
 const activeWorktreeCount = { job: 0, epic: 0 };
 
+// Registered checkouts this process created and has not yet cleaned up:
+// dir -> { kind, branch }. Lets `expireDeadWorktreeRegistrations` prove a
+// counted checkout is dead (no cwd holder + terminal row) and release its
+// count — accounting only, never a kill or an rm.
+const registeredCheckouts = new Map();
+const expiredCheckoutDirs = new Set(); // released by expiry, awaiting their (late) cleanupWorktree
+
 // Per-kind promise chain used as a simple async mutex (see `withKindLock`)
 // so the cap-check-and-reserve decision in `reserveWorktreeSlot` — which now
 // sometimes needs to `await` a fresh on-disk observation — stays a single
@@ -215,6 +224,46 @@ function execGit(args, { cwd, timeout = 20_000 } = {}) {
   });
 }
 
+// Unquote a single git porcelain v1 path token. Git wraps a path in double
+// quotes and C-style-escapes it (\", \\, \t, \n, and \NNN octal per raw UTF-8
+// byte) whenever it contains a double quote, backslash, control character, or
+// any byte >= 0x80 (core.quotepath's default "ASCII-safe" behavior) — a plain
+// path with none of those passes through untouched. Pure. Lives here (not
+// scheduler.cjs, which also parses porcelain output) because scheduler.cjs
+// requires this module — the reverse would be circular — and every porcelain
+// consumer in either file must unquote a path before treating it as a real
+// on-disk path (fs.existsSync, a pathspec, a Set membership check).
+function unquotePorcelainPath(raw) {
+  if (raw.length < 2 || raw[0] !== '"' || raw[raw.length - 1] !== '"') return raw;
+  const inner = raw.slice(1, -1);
+  const bytes = [];
+  const simpleEscapes = { '"': 0x22, '\\': 0x5c, n: 0x0a, t: 0x09, r: 0x0d, a: 0x07, b: 0x08, f: 0x0c, v: 0x0b };
+  for (let i = 0; i < inner.length; i += 1) {
+    const c = inner[i];
+    if (c === '\\' && i + 1 < inner.length) {
+      const next = inner[i + 1];
+      if (Object.prototype.hasOwnProperty.call(simpleEscapes, next)) {
+        bytes.push(simpleEscapes[next]);
+        i += 1;
+      } else if (next >= '0' && next <= '7') {
+        let octal = '';
+        let j = i + 1;
+        while (j < inner.length && octal.length < 3 && inner[j] >= '0' && inner[j] <= '7') {
+          octal += inner[j];
+          j += 1;
+        }
+        bytes.push(parseInt(octal, 8) & 0xff);
+        i = j - 1;
+      } else {
+        bytes.push(c.charCodeAt(0));
+      }
+    } else {
+      for (const b of Buffer.from(c, 'utf8')) bytes.push(b);
+    }
+  }
+  return Buffer.from(bytes).toString('utf8');
+}
+
 async function isGitRepo(cwd) {
   if (!cwd) return false;
   try {
@@ -281,11 +330,11 @@ async function removeWorktreeDir(cwd, dir) {
     /* best-effort */
   }
   const parentDir = path.dirname(dir);
-  // Guard against ever rmdir-ing os.tmpdir() itself — every real caller's
+  // Guard against ever rmdir-ing the worktree base (os.tmpdir() or SM_WORKTREE_ROOT) itself — every real caller's
   // `dir` is `<kind root>/<hash>/<key>`, so `parentDir` is always the hash
   // dir, never the tmpdir root, but this keeps the guarantee explicit rather
   // than relying solely on call-site discipline.
-  if (parentDir === os.tmpdir()) return;
+  if (parentDir === schedulerPaths.worktreeBase()) return;
   try {
     const remaining = await fsp.readdir(parentDir);
     if (remaining.length === 0) await fsp.rmdir(parentDir);
@@ -304,7 +353,7 @@ async function removeWorktreeDir(cwd, dir) {
  * <name>` segment stripped off.
  *
  * Round-trip verified before being trusted, mirroring the same defense
- * `scripts/lib/activeSessions.cjs`'s `worktreeMainRootOf` already applies: a
+ * `src/main/lib/activeSessions.cjs`'s `worktreeMainRootOf` already applies: a
  * `.git` pointer file is a plain text file, so its content must not be
  * trusted to redirect `git worktree remove --force` at an arbitrary path
  * without the candidate main tree's OWN admin dir
@@ -481,29 +530,62 @@ async function sweepStaleWorktreeCheckouts(kind, opts = {}) {
  * copy of the human's WIP stays in `cwd` the whole time. Nothing here ever
  * `git add`s or commits the carried paths on the job's behalf, and nothing
  * ever restores them back into `cwd` — they were never removed from it.
+ *
+ * The diff itself is captured via `git diff --output=<file>` so git writes
+ * the patch straight to disk — never through Node's stdout buffer. A prior
+ * version piped the patch through `execFile`'s default-`maxBuffer` stdout
+ * capture, which overflowed on a real dirty tree of ~240 changed paths
+ * (`stdout maxBuffer length exceeded`, job 1192) and silently fell back to
+ * running the job in the SHARED working tree — the exact moment isolation
+ * matters most. `--output` removes the buffer ceiling entirely regardless of
+ * how large the tree's outstanding diff is. The temp patch file lives
+ * inside `dir` (the job's own fresh worktree checkout, not a bare
+ * `os.tmpdir()` path) so it is guaranteed to be cleaned up either by the
+ * explicit `fsp.rm` below or, on any earlier failure, by the caller tearing
+ * the whole `dir` down.
  */
 async function captureAndCarryBaseDiff({ cwd, dir }) {
   let paths = [];
-  let patch = '';
   try {
     const nameOut = await execGit(['diff', 'HEAD', '--name-only'], { cwd, timeout: 15_000 });
     paths = nameOut.split('\n').map((l) => l.trim()).filter(Boolean);
-    patch = await execGit(['diff', 'HEAD', '--binary'], { cwd, timeout: 30_000 });
   } catch (e) {
-    return { ok: false, reason: `capturing base diff failed: ${(e && (e.stderrText || e.message)) || e}` };
+    return { ok: false, reason: `listing changed paths failed: ${(e && (e.stderrText || e.message)) || e}` };
   }
-  if (!patch || !patch.trim()) return { ok: true, paths: [] };
 
-  const patchFile = path.join(os.tmpdir(), `sm-worktree-carry-${crypto.randomBytes(8).toString('hex')}.patch`);
+  // Everything from here on operates on a real (or attempted) file at
+  // `patchFile` — wrapped in one try/finally so the temp file is removed on
+  // EVERY exit path, including a `git diff` that errors after partially
+  // writing it, not just the clean-success path.
+  const patchFile = path.join(dir, `.sm-worktree-carry-${crypto.randomBytes(8).toString('hex')}.patch`);
   try {
-    await fsp.writeFile(patchFile, patch, 'utf8');
-    await execGit(['apply', '--binary', patchFile], { cwd: dir, timeout: 30_000 });
-  } catch (e) {
-    return { ok: false, reason: `git apply failed: ${(e && (e.stderrText || e.message)) || e}` };
+    try {
+      await execGit(['diff', 'HEAD', '--binary', `--output=${patchFile}`], { cwd, timeout: 120_000 });
+    } catch (e) {
+      return { ok: false, reason: `capturing base diff failed: ${(e && (e.stderrText || e.message)) || e}` };
+    }
+
+    let stat;
+    try {
+      stat = await fsp.stat(patchFile);
+    } catch (e) {
+      return { ok: false, reason: `reading captured diff file failed: ${(e && e.message) || e}` };
+    }
+    if (stat.size === 0) return { ok: true, paths: [] };
+
+    try {
+      // Same 120s ceiling as the capture step above: applying a patch large
+      // enough to need that long to generate can just as easily need that
+      // long to apply — leaving this at the old 30s reintroduces the same
+      // large-dirty-tree degrade-to-shared-tree failure one call later.
+      await execGit(['apply', '--binary', patchFile], { cwd: dir, timeout: 120_000 });
+    } catch (e) {
+      return { ok: false, reason: `git apply failed: ${(e && (e.stderrText || e.message)) || e}` };
+    }
+    return { ok: true, paths };
   } finally {
     try { await fsp.rm(patchFile, { force: true }); } catch { /* best-effort */ }
   }
-  return { ok: true, paths };
 }
 
 /**
@@ -770,9 +852,31 @@ async function createWorktree({ kind, cwd, key }) {
     carriedPaths = carry.paths;
   }
 
+  registeredCheckouts.set(dir, { kind, branch });
   return { ok: true, dir, branch, baseCwd: cwd, carriedPaths };
 }
 
+/**
+ * Release the count of any registered checkout whose branch has no live
+ * holder (no process cwd under its dir) AND whose row is terminal
+ * (`isTerminalBranch(branch)`). Fail-closed: an unknown/live row or a live
+ * holder keeps the count. Returns the expired dirs. O(registered) plus one
+ * /proc scan.
+ */
+function expireDeadWorktreeRegistrations({ isTerminalBranch, holders = listCwdHolders() } = {}) {
+  const expired = [];
+  if (typeof isTerminalBranch !== 'function') return expired;
+  for (const [dir, reg] of [...registeredCheckouts]) {
+    if (hasLiveHolder(dir, holders)) continue;
+    if (!isTerminalBranch(reg.branch)) continue;
+    registeredCheckouts.delete(dir);
+    expiredCheckoutDirs.add(dir);
+    activeWorktreeCount[reg.kind] = Math.max(0, activeWorktreeCount[reg.kind] - 1);
+    expired.push(dir);
+  }
+  return expired;
+}
+
 /**
  * True iff every path in `paths` has working-tree content in `cwd`
  * byte-identical to its committed blob on `branch`. Used both by the
@@ -1034,7 +1138,10 @@ async function cleanupWorktree({ kind, cwd, dir, branch, keepBranch }) {
     try { await execGit(['branch', '-D', branch], { cwd, timeout: 10_000 }); } catch { /* already gone */ }
   }
   try { await execGit(['worktree', 'prune'], { cwd, timeout: 10_000 }); } catch { /* best effort */ }
-  activeWorktreeCount[kind] = Math.max(0, activeWorktreeCount[kind] - 1);
+  // A checkout the expiry pass already released must not be counted down twice.
+  const alreadyExpired = dir ? expiredCheckoutDirs.delete(dir) : false;
+  if (dir) registeredCheckouts.delete(dir);
+  if (!alreadyExpired) activeWorktreeCount[kind] = Math.max(0, activeWorktreeCount[kind] - 1);
 }
 
 /**
@@ -1113,7 +1220,12 @@ async function salvageDirtyDelta({ cwd, paths, outFile }) {
     for (const line of String(statusOut || '').split('\n')) {
       if (!line) continue;
       const code = line.slice(0, 2);
-      const p = line.slice(3);
+      // Unquote before use: a raw quoted+C-escaped token (any path with a
+      // quote, backslash, control char, or non-ASCII byte) is not a real
+      // on-disk path — passing it straight through as a pathspec to the
+      // `git diff` calls below silently fails to match the real file,
+      // dropping that path's content out of the salvaged patch entirely.
+      const p = unquotePorcelainPath(line.slice(3));
       if (!p) continue;
       if (code === '??') untrackedPaths.push(p);
       else trackedPaths.push(p);
@@ -1271,9 +1383,12 @@ async function reclaimTerminalJobOrphans({ cwd, terminalSlugs, isLive }) {
     } catch {
       continue; // can't prove the checkout is clean-of-real-work — never assume
     }
-    const dirtyPaths = statusOut.split('\n').map((l) => l.slice(3).trim()).filter(Boolean);
+    const dirtyPaths = statusOut.split('\n')
+      .filter((l) => l.length > 0)
+      .map((l) => unquotePorcelainPath(l.slice(3).trim()))
+      .filter(Boolean);
     const opsOnly = dirtyPaths.every(
-      (p) => p === 'session-manager-operations' || p.startsWith('session-manager-operations/')
+      (p) => p === OPS_ROOT_DIR || p.startsWith(`${OPS_ROOT_DIR}/`)
     );
     if (!opsOnly) continue; // real non-ops dirty content present — leave for a human
 
@@ -1402,6 +1517,7 @@ module.exports = {
   getMaxConcurrentWorktrees,
   getStaleSweepAgeMs,
   isGitRepo,
+  unquotePorcelainPath,
   isBaseTreeClean,
   worktreeDirFor,
   branchNameFor,
@@ -1424,6 +1540,7 @@ module.exports = {
   mainTreeFromWorktreeGitFile,
   getObservedWorktreeCount,
   reserveWorktreeSlot,
+  expireDeadWorktreeRegistrations,
   reclaimTerminalJobOrphans,
   // Job-kind convenience wrappers — same call shape jobWorktree.cjs has
   // always exposed.

package/src/main/lib/guardShims.cjs

@@ -0,0 +1,156 @@
+/**
+ * guardShims.cjs — stable, app-upgrade-proof indirection for every
+ * PreToolUse guard hook (each name in GUARD_NAMES) that delegationReadiness.cjs installs into an
+ * adopting project's `.claude/settings.json`.
+ *
+ * Why this exists: those installers used to bake
+ * `path.resolve(__dirname, '../../../scripts/hooks/guard-*.cjs')` — THIS
+ * app's own copy of the script — directly into the hook command. Run via
+ * `npx claude-code-session-manager@latest` (the normal install path), that
+ * resolves under `~/.npm/_npx/<hash>/node_modules/claude-code-session-manager/`
+ * — a directory scoped to ONE npx resolution. The next `npx ...@latest` (a
+ * new release) or an npm cache prune creates/removes a different hash dir, so
+ * every previously-installed hook decays into a dead path. A PreToolUse
+ * command pointing at a missing script exits non-zero WITHOUT exit code 2 (a
+ * non-blocking error to the harness), so it silently guards nothing — while
+ * checkPrdWriteGuard correctly flips the readiness banner back to red. That
+ * decay is why "Delegation not ready" reappears across projects even after a
+ * successful install.
+ *
+ * Fix: install a STABLE shim under the user's home
+ * (`~/.claude/session-manager/hooks/guard-<name>.cjs`) that never moves
+ * across app upgrades. The shim contains no guard logic of its own — CLAUDE.md's
+ * "adopt by REFERENCE, never vendor" law — it reads a pointer file
+ * (`app-root.json`, rewritten on every app boot with the CURRENTLY running
+ * app's root) and `require()`s the real `scripts/hooks/guard-<name>.cjs` from
+ * there. An app upgrade (a new npx hash dir) just rewrites the pointer on the
+ * next boot; every already-installed project hook keeps resolving through
+ * the same shim path with no re-install.
+ *
+ * The guard scripts run their logic as a require-time side effect (stdin ->
+ * decision -> process.exit, not gated on `require.main === module`), so a
+ * plain `require()` from the shim is enough to invoke them.
+ */
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const os = require('node:os');
+const { writeJson, writeTextAtomic, addAllowedRoot } = require('../config.cjs');
+
+// src/main/lib -> app root (three levels up) — the same resolution
+// delegationReadiness.cjs's *_GUARD_SCRIPT constants use.
+const APP_ROOT = path.resolve(__dirname, '..', '..', '..');
+
+const GUARD_NAMES = ['guard-prd-writes.cjs', 'guard-destructive-git.cjs', 'guard-inline-implementation.cjs', 'guard-self-schedule.cjs'];
+
+function hooksDir(homeDir = os.homedir()) {
+  return path.join(homeDir, '.claude', 'session-manager', 'hooks');
+}
+
+function pointerPath(homeDir = os.homedir()) {
+  return path.join(hooksDir(homeDir), 'app-root.json');
+}
+
+function shimPath(guardName, homeDir = os.homedir()) {
+  return path.join(hooksDir(homeDir), guardName);
+}
+
+function shimBody(guardName) {
+  return `'use strict';
+const fs = require('node:fs');
+const path = require('node:path');
+const ptr = JSON.parse(fs.readFileSync(path.join(__dirname, 'app-root.json'), 'utf8'));
+require(path.join(ptr.appRoot, 'scripts', 'hooks', '${guardName}'));
+`;
+}
+
+/**
+ * Write the pointer file + every shim in GUARD_NAMES under `homeDir`. Idempotent: a
+ * re-run with the same `appRoot` produces byte-identical files; a re-run with
+ * a DIFFERENT `appRoot` (an app upgrade) rewrites only the pointer, which is
+ * exactly what lets already-installed project hooks follow the upgrade with
+ * no re-install. Never throws — returns `{ ok, error }` so a boot-time caller
+ * can fire-and-forget and an installer can refuse cleanly rather than writing
+ * a hook command that points at a shim that doesn't exist.
+ */
+async function writeGuardShims({ homeDir = os.homedir(), appRoot = APP_ROOT } = {}) {
+  try {
+    addAllowedRoot(homeDir);
+    await writeJson(pointerPath(homeDir), { appRoot });
+    for (const name of GUARD_NAMES) {
+      await writeTextAtomic(shimPath(name, homeDir), shimBody(name));
+    }
+    return { ok: true };
+  } catch (err) {
+    return { ok: false, error: err?.message ?? String(err) };
+  }
+}
+
+/** True when every shim + the pointer file already exist on disk under `homeDir`. */
+function guardShimsExist(homeDir = os.homedir()) {
+  return fs.existsSync(pointerPath(homeDir)) && GUARD_NAMES.every((name) => fs.existsSync(shimPath(name, homeDir)));
+}
+
+/**
+ * Given an absolute script path a hook command resolved to, determine
+ * whether it's actually a guard SHIM (its directory carries a sibling
+ * `app-root.json`) rather than a direct app-root script. A direct script has
+ * no pointer and is trivially "real" once `fs.existsSync` is true — the
+ * caller doesn't need this function for that case.
+ *
+ * For a shim, existence of the shim FILE is not enough: the shim's own
+ * require() target is `ptr.appRoot/scripts/hooks/<name>.cjs`, resolved only
+ * at hook-invocation time. If the pointer is missing, unparseable, or now
+ * names a script that's gone, the shim silently guards nothing the next time
+ * a hook actually fires — decay one hop downstream of the hook command
+ * itself. Returns `null` when `scriptAbsPath` is not a shim (no sibling
+ * pointer) — the caller's plain existence check already covers that case.
+ * Throws when it IS a shim and the pointer has decayed.
+ */
+function resolveShimTarget(scriptAbsPath) {
+  const dir = path.dirname(scriptAbsPath);
+  const ptrFile = path.join(dir, 'app-root.json');
+  if (!fs.existsSync(ptrFile)) return null;
+
+  const guardName = path.basename(scriptAbsPath);
+  let appRoot;
+  try {
+    appRoot = JSON.parse(fs.readFileSync(ptrFile, 'utf8'))?.appRoot;
+  } catch (err) {
+    throw new Error(`guard shim pointer ${ptrFile} is unparseable: ${err?.message ?? err}`);
+  }
+  if (typeof appRoot !== 'string' || !appRoot) {
+    throw new Error(`guard shim pointer ${ptrFile} has no appRoot`);
+  }
+  const real = path.join(appRoot, 'scripts', 'hooks', guardName);
+  if (!fs.existsSync(real)) {
+    throw new Error(`guard shim pointer ${ptrFile} resolves to a script that no longer exists: ${real}`);
+  }
+  return real;
+}
+
+/**
+ * `writeGuardShims({ homeDir })`, but returns `null` on success and an
+ * install-function-shaped error object (`{ ok:false, action:'error', error }`)
+ * on failure — the one call every `install*Guard` in delegationReadiness.cjs
+ * needs before it can safely write a hook command pointing at the shim.
+ */
+async function ensureGuardShimsOrError(homeDir) {
+  const result = await writeGuardShims({ homeDir });
+  if (result.ok) return null;
+  return { ok: false, action: 'error', error: `could not write the stable guard shim under ${hooksDir(homeDir)}: ${result.error}` };
+}
+
+module.exports = {
+  APP_ROOT,
+  GUARD_NAMES,
+  hooksDir,
+  pointerPath,
+  shimPath,
+  shimBody,
+  writeGuardShims,
+  guardShimsExist,
+  resolveShimTarget,
+  ensureGuardShimsOrError,
+};

package/src/main/lib/historyRollup.cjs

@@ -26,10 +26,9 @@
 'use strict';
 
 const path = require('node:path');
-const os = require('node:os');
 const config = require('../config.cjs');
 
-const ROLLUP_PATH = path.join(os.homedir(), '.claude', 'session-manager', 'history-rollup.jsonl');
+const { historyRollupPath } = require('./schedulerPaths.cjs');
 const COMPACT_THRESHOLD_BYTES = 5 * 1024 * 1024;
 
 const TOTALS_MODEL_ID = '';
@@ -75,7 +74,7 @@ function mergeRollupLines(lines) {
  * only want data lines should filter on modelId/projectDir.
  */
 async function readRollup(fromDate, toDate) {
-  const { exists, text } = await config.readText(ROLLUP_PATH);
+  const { exists, text } = await config.readText(historyRollupPath());
   if (!exists || !text) return new Map();
   const merged = mergeRollupLines(text.split('\n'));
   const filtered = new Map();
@@ -108,7 +107,7 @@ function isDateFinalized(mergedMap, date) {
 async function appendRollupDays(entries) {
   if (!entries || entries.length === 0) return;
 
-  const real = config.validatePath(ROLLUP_PATH);
+  const real = config.validatePath(historyRollupPath());
   config.validateWrite(real);
   const fsp = require('node:fs/promises');
   await fsp.mkdir(path.dirname(real), { recursive: true });
@@ -125,15 +124,15 @@ async function appendRollupDays(entries) {
 
 /** Dedupe the rollup file down to its last-write-wins merged lines. */
 async function compact() {
-  const { exists, text } = await config.readText(ROLLUP_PATH);
+  const { exists, text } = await config.readText(historyRollupPath());
   if (!exists || !text) return;
   const merged = mergeRollupLines(text.split('\n'));
   const rewritten = Array.from(merged.values()).map((b) => JSON.stringify(b)).join('\n') + '\n';
-  await config.writeTextAtomic(ROLLUP_PATH, rewritten);
+  await config.writeTextAtomic(historyRollupPath(), rewritten);
 }
 
 module.exports = {
-  ROLLUP_PATH,
+  historyRollupPath,
   COMPACT_THRESHOLD_BYTES,
   TOTALS_MODEL_ID,
   FINALIZED_MODEL_ID,

package/src/main/lib/instanceLock.cjs

@@ -26,14 +26,16 @@
 'use strict';
 
 const fs = require('node:fs');
-const os = require('node:os');
 const path = require('node:path');
+const { identity, isDifferentProcess } = require('./procIdentity.cjs');
+const { instanceLockPath } = require('./schedulerPaths.cjs');
+const { appendAuditEvent } = require('./auditLog.cjs');
 
 // Env override is for unit tests only (isolates the lock from the real
 // ~/.claude of the machine running the suite).
 function lockPath() {
   return process.env.SM_SCHEDULER_LOCK_PATH
-    || path.join(os.homedir(), '.claude', 'session-manager', 'scheduler-owner.lock');
+    || instanceLockPath();
 }
 
 function pidAlive(pid) {
@@ -58,7 +60,11 @@ function readLock() {
 }
 
 function writeLockExclusive() {
-  const body = JSON.stringify({ pid: process.pid, startedAt: new Date().toISOString() });
+  const body = JSON.stringify({
+    pid: process.pid,
+    startedAt: new Date().toISOString(),
+    identity: identity(process.pid),
+  });
   fs.mkdirSync(path.dirname(lockPath()), { recursive: true });
   // 'wx' = atomic create-or-fail — two racing instances cannot both win.
   fs.writeFileSync(lockPath(), body, { flag: 'wx', mode: 0o600 });
@@ -67,14 +73,35 @@ function writeLockExclusive() {
 /**
  * Try to become the machine's scheduler owner.
  * Returns { owner: true } or { owner: false, holderPid } — never throws.
+ *
+ * A holder pid that is alive is normally respected — but if the lock body
+ * carries a COMPLETE recorded identity that provably differs from the live
+ * process now holding that pid (procIdentity.isDifferentProcess), the pid
+ * was recycled after a hard crash: today's bare pidAlive() check would pin
+ * ownership on that unrelated live process forever. That case is treated as
+ * stale and the lock is broken (audited as `stale_lock_broken`). A missing
+ * identity (legacy lock body, or an unreadable /proc on either side) is
+ * fail-closed to "not different" — i.e. today's pid-only behaviour.
  */
 function acquireSchedulerOwnership() {
   for (let attempt = 0; attempt < 2; attempt++) {
     const existing = readLock();
     if (existing && existing.pid !== process.pid && pidAlive(existing.pid)) {
-      return { owner: false, holderPid: existing.pid };
+      const liveIdentity = identity(existing.pid);
+      if (!isDifferentProcess(existing.identity, liveIdentity)) {
+        return { owner: false, holderPid: existing.pid };
+      }
+      appendAuditEvent('stale_lock_broken', {
+        path: lockPath(),
+        recordedPid: existing.pid,
+        recordedStartedAt: existing.startedAt ?? null,
+        recordedIdentity: existing.identity ?? null,
+        liveIdentity,
+      });
     }
-    // Missing, unreadable, our own, or stale (holder pid dead) — take it.
+    // Missing, unreadable, our own, stale (holder pid dead), or a recorded
+    // identity proven different from the live process at that recycled pid
+    // — take it.
     try {
       if (existing || fs.existsSync(lockPath())) fs.unlinkSync(lockPath());
     } catch { /* raced with another breaker — retry loop below settles it */ }

package/src/main/lib/jobDirtFilter.cjs

@@ -27,8 +27,13 @@
  * must still park.
  */
 
-/** The one app-owned root. Matches at any depth, and only as a path segment. */
-const OPS_ROOT_SEGMENT = 'session-manager-operations';
+/**
+ * The one app-owned root. Matches at any depth, and only as a path segment.
+ * Sourced from opsOwnership.cjs (the single-writer law's own root name)
+ * rather than a second hardcoded literal — this file matches git-porcelain
+ * RELATIVE paths, never builds an fs path, so opsPath() itself doesn't apply.
+ */
+const { OPS_ROOT_DIR: OPS_ROOT_SEGMENT } = require('./opsOwnership.cjs');
 
 /** True when `p` lives under an app-owned operations root. Pure. */
 function isAppOwnedChurn(p) {