claude-code-session-manager 0.87.0 → 0.88.1

package/src/main/index.cjs

@@ -1,3 +1,8 @@
+const { PROC_NAMES, setProcessTitle, inhibitHolderShell } = require('./lib/smProcNames.cjs');
+// Self-describing `comm` in System Monitor (pn-03). process.argv is a JS copy
+// made at startup, so the argv-memory overwrite below never affects the
+// `process.argv.includes('--simple')` read further down.
+setProcessTitle(PROC_NAMES.main);
 const { app, BrowserWindow, ipcMain, dialog, Menu, session, systemPreferences, globalShortcut, shell, clipboard, powerSaveBlocker, protocol } = require('electron');
 const { spawn, execFile, execFileSync } = require('node:child_process');
 const path = require('node:path');
@@ -39,8 +44,9 @@ const epicWorktreeProjectConfig = require('./lib/epicWorktreeProjectConfig.cjs')
 const agentLibrary = require('./agentLibrary.cjs');
 const agentModelResolve = require('./lib/agentModelResolve.cjs');
 const { resolveEffectiveModelInfo } = require('./lib/effectiveModelInfo.cjs');
-const { checkDelegationReadiness, ensureGuardsInstalled, installPrdWriteGuard, installDestructiveGitGuard, installInlineImplementationGuard } = require('./lib/delegationReadiness.cjs');
+const { checkDelegationReadiness, ensureGuardsInstalled, installPrdWriteGuard, installDestructiveGitGuard, installInlineImplementationGuard, installSelfScheduleGuard } = require('./lib/delegationReadiness.cjs');
 const { resolveProjectContext } = require('./lib/projectRootResolve.cjs');
+const upgradeDrain = require('./lib/upgradeDrain.cjs');
 const { writeGuardShims } = require('./lib/guardShims.cjs');
 const { MCP_TOOL_CATALOG, MCP_RECIPES } = require('./lib/mcpToolCatalog.cjs');
 const { sendIfAlive } = require('./lib/sendToRenderer.cjs');
@@ -58,7 +64,6 @@ chatRunner.registerAdminRoute(adminHttp);
 crossProjectFeedback.registerAdminRoute(adminHttp);
 const supervisor = require('./supervisor.cjs');
 const watchers = require('./watchers.cjs');
-const teams = require('./teams.cjs');
 const queueOps = require('./queueOps.cjs');
 const pluginInstall = require('./pluginInstall.cjs');
 const { seedDevPlugin } = require('./seedDevPlugin.cjs');
@@ -135,7 +140,10 @@ function startSystemdInhibit() {
       '--who=Claude Session Manager',
       '--why=Scheduler polling and claude -p jobs must survive idle',
       '--mode=block',
-      'sh', '-c', `while kill -0 ${process.pid} 2>/dev/null; do sleep 5; done`,
+      // sm-inhibit-hold: aliased shell so the permanent holder is attributable
+      // in System Monitor (its `sleep 5` child stays a bare `sleep`, parented
+      // under it). Falls back to plain /bin/sh if the alias can't be made.
+      inhibitHolderShell(), '-c', `while kill -0 ${process.pid} 2>/dev/null; do sleep 5; done`,
     ], { stdio: 'ignore', detached: false });
     child.on('error', (e) => {
       logs.writeLine({ scope: 'main', level: 'warn', message: 'systemd-inhibit spawn failed', meta: { error: e?.message } });
@@ -308,7 +316,26 @@ function relaunchViaNpx() {
   return child;
 }
 
-async function rebootApp() {
+/**
+ * rebootApp({force}) — restart is a REQUEST that drains first and never kills
+ * (lib/upgradeDrain.cjs): dispatch pauses, running jobs finish, then the
+ * scheduler's heartbeat-driven drain calls performReboot(). `force: true`
+ * keeps the old immediate behaviour (kills running executors) for humans who
+ * accept the cost.
+ */
+async function rebootApp({ force = false } = {}) {
+  if (force) {
+    logReboot('force reboot requested — immediate, not draining');
+    return performReboot();
+  }
+  const request = upgradeDrain.requestRestart({ reason: 'user-reboot', requestedBy: 'user' });
+  logReboot(`restart requested (drain first): ${request.requestedAt}`);
+}
+
+// Registered as the scheduler's drain-complete exit path (zero running jobs).
+scheduler.setRestartHandler(() => performReboot());
+
+async function performReboot() {
   ptyManager.killAll();
   configMgr.closeAllWatchers();
   closeAllProjectPagesWatchers();
@@ -343,6 +370,9 @@ async function rebootApp() {
     return;
   }
 
+  // Bounded-lifetime marker: the watchdog must not relaunch a second instance
+  // during this deliberate exit window (single-instance-lock race).
+  upgradeDrain.markRestarting();
   let childOk = false;
   try {
     const child = relaunchViaNpx();
@@ -588,12 +618,22 @@ function logGuardInstallAttempt(guard, cwd, outcome) {
 }
 
 async function handleGuardInstall(guard, installFn, payload) {
+  // Normalized the SAME way the sibling app:delegation-readiness handler
+  // above normalizes cwd, before either installing or logging — without
+  // this, a worktree/ops-internal cwd installs the guard into an ephemeral
+  // `.claude/settings.json` that vanishes with the worktree (this repo's
+  // "Worktree cwd ops-root hazard" incident class), diverging from the
+  // main-tree root the readiness banner (and its own auto-heal path,
+  // ensureGuardsInstalled) actually reads.
+  const resolved = resolveProjectContext({ cwd: payload.cwd });
+  const cwd = resolved.cwd || payload.cwd;
+  const normalizedPayload = { ...payload, cwd };
   try {
-    const result = await installFn(payload);
-    logGuardInstallAttempt(guard, payload.cwd, result);
+    const result = await installFn(normalizedPayload);
+    logGuardInstallAttempt(guard, cwd, result);
     return result;
   } catch (err) {
-    logGuardInstallAttempt(guard, payload.cwd, { ok: false, action: 'error', error: err?.message ?? String(err) });
+    logGuardInstallAttempt(guard, cwd, { ok: false, action: 'error', error: err?.message ?? String(err) });
     throw err;
   }
 }
@@ -615,6 +655,9 @@ ipcMain.handle('app:install-destructive-git-guard', validated(schemas.delegation
 ipcMain.handle('app:install-inline-implementation-guard', validated(schemas.delegationReadinessCwd, (payload) =>
   handleGuardInstall('inline-implementation-guard', installInlineImplementationGuard, payload)
 ));
+ipcMain.handle('app:install-self-schedule-guard', validated(schemas.delegationReadinessCwd, (payload) =>
+  handleGuardInstall('self-schedule-guard', installSelfScheduleGuard, payload)
+));
 
 ipcMain.handle('app:engage-rules-path', () => process.env.SESSION_MANAGER_ENGAGE_RULES || null);
 
@@ -641,7 +684,7 @@ ipcMain.handle('app:pick-directory', async () => {
   return result.filePaths[0];
 });
 
-ipcMain.on('app:reboot-app', () => rebootApp());
+ipcMain.on('app:reboot-app', (_e, opts) => { rebootApp({ force: opts?.force === true }).catch((e) => logReboot(`reboot failed: ${e?.message}`)); });
 
 // Image paste — Ctrl+V in the Terminal pane. Reads the OS clipboard via
 // Electron's native API (renderer's navigator.clipboard.read() doesn't expose
@@ -916,7 +959,6 @@ voiceHotkey.registerHotkeyHandlers();
 voiceWizard.registerWizardHandlers();
 scheduler.registerScheduleHandlers();
 watchers.registerWatcherHandlers();
-teams.registerTeamsHandlers();
 queueOps.registerQueueOpsHandlers({ retireCompletedSlugs: scheduler.retireCompletedSlugs });
 registerHistoryAggregatorHandlers();
 registerHistoryDashboardHandlers();
@@ -1235,6 +1277,7 @@ app.whenReady().then(async () => {
 
   const heapSnapshotMenuItem = heapSnapshot.buildMenuItem(() => mainWindow);
 
+  // Application menu rules + rationale: session-manager-operations/architecture/application-menu.md
   const template = [
     {
       label: 'Session Manager',
@@ -1251,7 +1294,7 @@ app.whenReady().then(async () => {
         {
           label: 'Restart Session Manager App',
           accelerator: 'CmdOrCtrl+Shift+R',
-          click: rebootApp,
+          click: () => { rebootApp().catch((e) => logReboot(`reboot failed: ${e?.message}`)); },
         },
         {
           label: 'Restart Terminal in Active Tab',
@@ -1443,6 +1486,14 @@ function runShutdownCleanup() {
   // Mark a clean exit so the next boot can distinguish a graceful quit from an
   // OOM-kill / native crash (which leaves the sentinel `open`).
   crashDiagnostics.markCleanShutdown();
+  // Release scheduler ownership on every teardown path, not just before-quit
+  // — the app.exit() sites (in-app reboot, dist-missing abort) bypass
+  // before-quit entirely and previously left a stale lock behind (fail-closed
+  // proc-identity recovery covers a hard crash, but a clean app.exit() should
+  // never need it). Pid-scoped and idempotent, so a redundant call from a
+  // later before-quit/will-quit firing is a safe no-op.
+  releaseSchedulerOwnership();
+  try { scheduler.stop(); } catch { /* */ }
   // PRD F1 v2 §IPC plumbing: must unregisterAll on will-quit.
   try { globalShortcut.unregisterAll(); } catch { /* */ }
   voiceHotkey.disposeOnQuit();

package/src/main/ipcSchemas.cjs

@@ -674,21 +674,12 @@ const projectPagesCwd = z.object({
   cwd: z.string().min(1).max(4096),
 }).strict();
 
-// ──────────────────────────────────────────── Project Home admin routes
-// (PRD: project-home-admin-routes). Same validation split as
-// projectPagesCwd above: real path validation is projectRootResolve.cjs +
-// config.cjs's validatePath at first fs access.
-const projectHomeAdminCwdQuery = z.object({
+// ──────────────────────────────────────────── Project Home admin route
+// Real path validation is projectRootResolve.cjs + config.cjs's validatePath;
+// html content limits live in projectHomeAdminRoutes.cjs's validateHomeHtml.
+const projectHomeAdminWriteBody = z.object({
   cwd: z.string().min(1).max(4096),
-}).strict();
-const projectHomeAdminValidateSummaryBody = z.object({
-  cwd: z.string().min(1).max(4096),
-  summary: z.unknown(),
-}).strict();
-const projectHomeAdminRenderBody = z.object({
-  cwd: z.string().min(1).max(4096),
-  summary: z.unknown(),
-  picks: z.unknown(),
+  html: z.string(),
 }).strict();
 
 // ──────────────────────────────────────────── Host on Bilko.run
@@ -1115,9 +1106,7 @@ module.exports = {
     memoryStale,
     projectBriefCwd,
     projectPagesCwd,
-    projectHomeAdminCwdQuery,
-    projectHomeAdminValidateSummaryBody,
-    projectHomeAdminRenderBody,
+    projectHomeAdminWriteBody,
     bilkoHostCwd,
     bilkoHostPrepareBundle,
     bilkoHostAddDocument,

package/src/main/lib/__tests__/auditLog.test.cjs

@@ -0,0 +1,38 @@
+/**
+ * auditLog.test.cjs — readTail returns a bounded reverse tail of complete lines.
+ *
+ * Run: timeout 120 npx vitest run src/main/lib/__tests__/auditLog.test.cjs
+ */
+'use strict';
+
+import { test, expect, beforeAll, afterAll } from 'vitest';
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { readTail } = require('../auditLog.cjs');
+
+let dir;
+beforeAll(() => { dir = fs.mkdtempSync(path.join(os.tmpdir(), 'auditlog-tail-')); });
+afterAll(() => { fs.rmSync(dir, { recursive: true, force: true }); });
+
+test('missing file → []', () => {
+  expect(readTail(1024, path.join(dir, 'nope.jsonl'))).toEqual([]);
+});
+
+test('window larger than file → every line', () => {
+  const f = path.join(dir, 'small.jsonl');
+  fs.writeFileSync(f, '{"n":1}\n{"n":2}\n');
+  expect(readTail(1_000_000, f)).toEqual(['{"n":1}', '{"n":2}']);
+});
+
+test('bounded window drops the partial leading line and keeps the newest', () => {
+  const f = path.join(dir, 'big.jsonl');
+  const lines = Array.from({ length: 1000 }, (_, i) => JSON.stringify({ n: i, pad: 'x'.repeat(50) }));
+  fs.writeFileSync(f, lines.join('\n') + '\n');
+  const tail = readTail(500, f);
+  expect(tail.length).toBeGreaterThan(0);
+  expect(tail.length).toBeLessThan(20);
+  expect(tail[tail.length - 1]).toBe(lines[999]);
+  for (const l of tail) expect(() => JSON.parse(l)).not.toThrow();
+  expect(readTail(0, f)).toEqual([]);
+});

package/src/main/lib/__tests__/buildIdentity.test.cjs

@@ -0,0 +1,121 @@
+/**
+ * buildIdentity.test.cjs — resolveBuildIdentity() resolution order:
+ * build-info.json first, git fallback only when a real .git sits AT the
+ * package root (never walking up), else null.
+ *
+ * Each test injects a distinct fixture `packageRoot` (see buildIdentity.cjs's
+ * `opts.packageRoot`), which also keeps memoization scoped per-root so the
+ * three cases don't clobber each other's cached result in one process.
+ *
+ * Run: timeout 120 npx vitest run src/main/lib/__tests__/buildIdentity.test.cjs
+ */
+
+'use strict';
+
+import { test, expect, afterEach } from 'vitest';
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+const { resolveBuildIdentity } = require('../buildIdentity.cjs');
+
+const cleanupDirs = [];
+
+function mkFixtureRoot(prefix) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+  cleanupDirs.push(dir);
+  fs.mkdirSync(path.join(dir, 'src', 'main'), { recursive: true });
+  return dir;
+}
+
+function writePackageJson(root, version) {
+  fs.writeFileSync(path.join(root, 'package.json'), JSON.stringify({ name: 'fixture-pkg', version }));
+}
+
+function mkRealGitRepo(root) {
+  execFileSync('git', ['-C', root, 'init', '-q']);
+  execFileSync('git', ['-C', root, 'config', 'user.email', 'test@test.com']);
+  execFileSync('git', ['-C', root, 'config', 'user.name', 'Test']);
+  fs.writeFileSync(path.join(root, 'README.md'), 'fixture\n');
+  execFileSync('git', ['-C', root, 'add', 'README.md']);
+  execFileSync('git', ['-C', root, 'commit', '-q', '-m', 'init']);
+  return execFileSync('git', ['-C', root, 'rev-parse', '--short', 'HEAD'], { encoding: 'utf8' }).trim();
+}
+
+afterEach(() => {
+  while (cleanupDirs.length) {
+    const dir = cleanupDirs.pop();
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('build-info.json present: its fields win over both git and package.json', () => {
+  const root = mkFixtureRoot('sm-buildid-present-');
+  writePackageJson(root, '0.1.0');
+  fs.writeFileSync(path.join(root, 'src', 'main', 'build-info.json'), JSON.stringify({
+    version: '9.9.9',
+    gitSha: 'deadbeefdeadbeefdeadbeefdeadbeefdeadbeef',
+    gitShortSha: 'deadbee',
+    gitBranch: 'main',
+    builtAt: '2026-01-01T00:00:00.000Z',
+    dirty: false,
+  }));
+
+  const identity = resolveBuildIdentity({ packageRoot: root, bootedAt: '2026-02-02T00:00:00.000Z' });
+
+  expect(identity.version).toBe('9.9.9');
+  expect(identity.codeSha).toBe('deadbee');
+  expect(identity.builtAt).toBe('2026-01-01T00:00:00.000Z');
+  expect(identity.appPath).toBe(root);
+  expect(identity.bootedAt).toBe('2026-02-02T00:00:00.000Z');
+});
+
+test('build-info.json absent, real .git at the package root: codeSha falls back to git, builtAt stays null', () => {
+  const root = mkFixtureRoot('sm-buildid-git-');
+  writePackageJson(root, '1.2.3');
+  const sha = mkRealGitRepo(root);
+
+  const identity = resolveBuildIdentity({ packageRoot: root });
+
+  expect(identity.version).toBe('1.2.3');
+  expect(identity.codeSha).toBe(sha);
+  expect(identity.builtAt).toBeNull();
+});
+
+test('build-info.json absent, no .git at the package root: codeSha is null, never walks up to an ancestor .git', () => {
+  const ancestor = mkFixtureRoot('sm-buildid-ancestor-');
+  mkRealGitRepo(ancestor); // a real repo one level UP from the fixture root — must never be found
+  const root = path.join(ancestor, 'nested-pkg');
+  fs.mkdirSync(path.join(root, 'src', 'main'), { recursive: true });
+  writePackageJson(root, '2.0.0');
+
+  const identity = resolveBuildIdentity({ packageRoot: root });
+
+  expect(identity.version).toBe('2.0.0');
+  expect(identity.codeSha).toBeNull();
+  expect(identity.builtAt).toBeNull();
+});
+
+test('bootedAt is echoed back verbatim, never re-captured, and defaults to null', () => {
+  const root = mkFixtureRoot('sm-buildid-bootedat-');
+  writePackageJson(root, '1.0.0');
+
+  expect(resolveBuildIdentity({ packageRoot: root }).bootedAt).toBeNull();
+  expect(resolveBuildIdentity({ packageRoot: root, bootedAt: 'fixed-value' }).bootedAt).toBe('fixed-value');
+});
+
+test('installChannel is reused from machineProfile.resolveInstallChannel, keyed off appPath', () => {
+  const root = mkFixtureRoot('sm-buildid-channel-');
+  writePackageJson(root, '1.0.0');
+  const prevSmDev = process.env.SM_DEV;
+  delete process.env.SM_DEV;
+  try {
+    const identity = resolveBuildIdentity({ packageRoot: root });
+    // fixture root lives under os.tmpdir(), not an .npm/_npx cache path, and
+    // SM_DEV is unset here, so resolveInstallChannel falls through to 'unknown'.
+    expect(identity.installChannel).toBe('unknown');
+  } finally {
+    if (prevSmDev === undefined) delete process.env.SM_DEV;
+    else process.env.SM_DEV = prevSmDev;
+  }
+});

package/src/main/lib/__tests__/cwdClassify.test.cjs

@@ -0,0 +1,111 @@
+// cwdClassify.cjs — one classifier for "what project is this path", failing
+// CLOSED on the unprovable worktree case. Fixtures live under a per-run
+// mkdtemp sandbox, never the live roots.
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { classifyCwd, nearestGitEntry, worktreeMainRootOf } = require('../cwdClassify.cjs');
+const { assertOpsWrite, resolveOpsRoot } = require('../opsOwnership.cjs');
+const { isEphemeralCwd } = require('../ephemeralCwd.cjs');
+const { projectRootOf } = require('../activeSessions.cjs');
+
+const OPS = 'session-manager-operations';
+let sandbox;
+const real = (p) => fs.realpathSync(p);
+
+beforeEach(() => { sandbox = real(fs.mkdtempSync(path.join(os.tmpdir(), 'sm-cwdclassify-'))); });
+afterEach(() => { fs.rmSync(sandbox, { recursive: true, force: true }); });
+
+function mkWorktree({ backRef = true } = {}) {
+  const main = path.join(sandbox, 'main');
+  const wt = path.join(sandbox, 'wt');
+  const admin = path.join(main, '.git', 'worktrees', 'wt1');
+  fs.mkdirSync(admin, { recursive: true });
+  fs.mkdirSync(wt, { recursive: true });
+  fs.writeFileSync(path.join(wt, '.git'), `gitdir: ${admin}\n`);
+  if (backRef) fs.writeFileSync(path.join(admin, 'gitdir'), `${path.join(wt, '.git')}\n`);
+  return { main, wt };
+}
+
+test('healthy worktree → worktree, projectRoot is the main tree', () => {
+  const { main, wt } = mkWorktree();
+  const c = classifyCwd(wt);
+  assert.equal(c.kind, 'worktree');
+  assert.equal(c.projectRoot, main);
+  assert.equal(projectRootOf(wt), main);
+  assert.equal(isEphemeralCwd(wt), true);
+  assert.equal(worktreeMainRootOf(wt), main);
+});
+
+test('broken back-reference → unknown; ops writes refused, resolution and dispatch stay open', () => {
+  const { wt } = mkWorktree({ backRef: false });
+  const c = classifyCwd(wt);
+  assert.equal(c.kind, 'unknown');
+  assert.equal(c.projectRoot, wt);
+  assert.match(c.reason, /back-reference/);
+  assert.equal(projectRootOf(wt), wt); // total — never throws
+  assert.equal(resolveOpsRoot(wt), path.join(wt, OPS)); // reads/dispatch unaffected
+  assert.throws(
+    () => assertOpsWrite(path.join(wt, OPS, 'scheduler', 'state', 'queue.json'), 'scheduler'),
+    (e) => e.unknownCwd === true && /back-reference/.test(e.message),
+  );
+});
+
+test('garbled .git file → unknown', () => {
+  const dir = path.join(sandbox, 'garbled');
+  fs.mkdirSync(dir);
+  fs.writeFileSync(path.join(dir, '.git'), 'not a pointer\n');
+  assert.equal(classifyCwd(dir).kind, 'unknown');
+});
+
+test('separate-git-dir → project (gitdir not under worktrees/)', () => {
+  const dir = path.join(sandbox, 'sep');
+  fs.mkdirSync(dir);
+  fs.writeFileSync(path.join(dir, '.git'), `gitdir: ${path.join(sandbox, 'elsewhere.git')}\n`);
+  const c = classifyCwd(dir);
+  assert.equal(c.kind, 'project');
+  assert.equal(c.projectRoot, dir);
+  assert.doesNotThrow(() => assertOpsWrite(path.join(dir, OPS, 'scheduler', 'state', 'queue.json'), 'scheduler'));
+});
+
+test('submodule (relative gitdir) → project rooted at the submodule', () => {
+  const sup = path.join(sandbox, 'super');
+  const sub = path.join(sup, 'libs', 'sub');
+  fs.mkdirSync(path.join(sup, '.git', 'modules', 'sub'), { recursive: true });
+  fs.mkdirSync(path.join(sub, 'src'), { recursive: true });
+  fs.writeFileSync(path.join(sub, '.git'), 'gitdir: ../../.git/modules/sub\n');
+  const c = classifyCwd(path.join(sub, 'src'));
+  assert.equal(c.kind, 'project');
+  assert.equal(c.projectRoot, sub);
+});
+
+test('plain project (.git dir, and no git at all) → project', () => {
+  const proj = path.join(sandbox, 'proj');
+  fs.mkdirSync(path.join(proj, '.git'), { recursive: true });
+  fs.mkdirSync(path.join(proj, 'src'));
+  assert.deepEqual(
+    { k: classifyCwd(path.join(proj, 'src')).kind, r: classifyCwd(path.join(proj, 'src')).projectRoot },
+    { k: 'project', r: proj },
+  );
+  const bare = path.join(sandbox, 'nogit');
+  fs.mkdirSync(bare);
+  assert.equal(classifyCwd(bare).projectRoot, bare);
+  assert.equal(nearestGitEntry(bare), null);
+});
+
+test('nested ops root: outermost (indexOf) and innermost (lastIndexOf) are both reported, neither unified', () => {
+  const proj = path.join(sandbox, 'proj');
+  fs.mkdirSync(path.join(proj, '.git'), { recursive: true });
+  const nested = path.join(proj, OPS, 'scheduler', 'prds', OPS, 'scheduler', 'state');
+  const c = classifyCwd(nested);
+  assert.equal(c.projectRoot, proj);
+  assert.equal(c.outermostOpsRoot, path.join(proj, OPS));
+  assert.equal(c.innermostOpsRoot, path.join(proj, OPS, 'scheduler', 'prds', OPS));
+  assert.equal(classifyCwd(proj).outermostOpsRoot, null);
+});
+
+test('ephemeral: os.tmpdir() itself', () => {
+  assert.equal(classifyCwd(path.resolve(os.tmpdir())).kind, 'ephemeral');
+  assert.equal(isEphemeralCwd(os.tmpdir()), true);
+});

package/src/main/lib/__tests__/definitionOfDoneSequence.test.cjs

@@ -0,0 +1,95 @@
+/**
+ * definitionOfDoneSequence.test.cjs — extractAcSequence / resolveGate parsing
+ * matrix plus real gate lines lifted from archived PRDs (gateFixtures.json).
+ *
+ * Run: timeout 120 npx vitest run src/main/lib/__tests__/definitionOfDoneSequence.test.cjs
+ */
+'use strict';
+
+const assert = require('node:assert/strict');
+const { extractAcSequence, extractAcCommand, resolveGate } = require('../definitionOfDone.cjs');
+const fixtures = require('./gateFixtures.json');
+
+const ac = (...lines) => ['# Acceptance criteria', '', ...lines, '', '# Out of scope', ''].join('\n');
+const argvs = (seq) => seq.map((c) => c.argv);
+
+test('splits a && chain, honouring a leading timeout N per command', () => {
+  const seq = extractAcSequence(ac('- [ ] Gate: `timeout 300 npm run typecheck && timeout 60 npm run lint`'));
+  assert.deepEqual(argvs(seq), [['npm', 'run', 'typecheck'], ['npm', 'run', 'lint']]);
+  assert.deepEqual(seq.map((c) => c.timeoutMs), [300_000, 60_000]);
+});
+
+test('a command with no timeout token gets the default timeout', () => {
+  const seq = extractAcSequence(ac('- [ ] `timeout 5 npm run a && npm run b`'));
+  assert.equal(seq[0].timeoutMs, 5_000);
+  assert.equal(seq[1].timeoutMs, 300_000);
+});
+
+test('&& inside quotes is never a split point', () => {
+  const seq = extractAcSequence(ac('- [ ] `timeout 30 node -e "a && b" && timeout 30 echo \'x && y\'`'));
+  assert.deepEqual(argvs(seq), [['node', '-e', 'a && b'], ['echo', 'x && y']]);
+});
+
+test('a leading TMPDIR=$(mktemp -d) is dropped, other literal env is kept', () => {
+  const seq = extractAcSequence(ac('- [ ] `TMPDIR=$(mktemp -d) timeout 900 npm run test:unit && FOO=bar timeout 10 npm run x`'));
+  assert.deepEqual(argvs(seq), [['npm', 'run', 'test:unit'], ['npm', 'run', 'x']]);
+  assert.deepEqual(seq[0].env, {});
+  assert.deepEqual(seq[1].env, { FOO: 'bar' });
+});
+
+test('any surviving shell metacharacter makes the whole gate unparseable (no shell)', () => {
+  for (const bad of [
+    '`timeout 60 npm run a | tail -5`', '`timeout 60 npm run a > out.txt`', '`timeout 60 npm run a; rm x`',
+    '`timeout 60 npm run a & echo`', '`timeout 60 echo $(whoami)`', '`timeout 60 npm run a && timeout 60 npm run b || true`',
+  ]) {
+    assert.deepEqual(extractAcSequence(ac(`- [ ] ${bad}`)), [], bad);
+  }
+});
+
+test('an empty segment (dangling &&) is unparseable', () => {
+  assert.deepEqual(extractAcSequence(ac('- [ ] `timeout 60 npm run a &&`')), []);
+});
+
+test('frontmatter gate: list takes priority over the AC line', () => {
+  const text = '---\ntitle: t\ngate:\n  - timeout 10 npm run one\n  - "timeout 20 npm run two && timeout 30 npm run three"\n---\n' +
+    ac('- [ ] `timeout 999 npm run ignored`');
+  const g = resolveGate(text);
+  assert.equal(g.source, 'explicit');
+  assert.deepEqual(argvs(g.sequence), [['npm', 'run', 'one'], ['npm', 'run', 'two'], ['npm', 'run', 'three']]);
+});
+
+test('frontmatter inline gate list', () => {
+  const g = resolveGate('---\ngate: [timeout 10 npm run one, timeout 20 npm run two]\n---\nbody');
+  assert.deepEqual(argvs(g.sequence), [['npm', 'run', 'one'], ['npm', 'run', 'two']]);
+});
+
+test('a fenced ```gate block takes priority', () => {
+  const text = ac('- [ ] `timeout 999 npm run ignored`', '', '```gate', 'timeout 10 npm run a && timeout 20 npm run b', '```');
+  const g = resolveGate(text);
+  assert.equal(g.source, 'explicit');
+  assert.deepEqual(argvs(g.sequence), [['npm', 'run', 'a'], ['npm', 'run', 'b']]);
+});
+
+test('gate: none is an explicit opt-out, distinct from absent', () => {
+  const none = resolveGate('---\ngate: none\n---\n' + ac('- [ ] `timeout 60 npm test`'));
+  assert.equal(none.source, 'none');
+  assert.deepEqual(none.sequence, []);
+  assert.equal(resolveGate(ac('- [ ] prose only')).source, 'absent');
+});
+
+test('extractAcCommand delegates: single command → original string, chain → null', () => {
+  assert.equal(extractAcCommand(ac('- [ ] `timeout 60 npm test`')), 'timeout 60 npm test');
+  assert.equal(extractAcCommand(ac('- [ ] `timeout 60 npm a && timeout 60 npm b`')), null);
+});
+
+test('real archived gate lines: count how many now parse', () => {
+  const parsed = fixtures.filter((line) => extractAcSequence(ac(line)).length > 0);
+  console.log(`[gate-fixtures] ${parsed.length}/${fixtures.length} real gate lines now parse`);
+  const chains = fixtures.filter((l) => l.includes('&&') && /^- \[ \] (Gate|Locally)/.test(l));
+  for (const line of chains) assert.ok(extractAcSequence(ac(line)).length >= 2, line);
+  // The three deliberately un-runnable fixtures (shell loop, pipe, prose) stay empty.
+  const unparseable = fixtures.filter((l) => /for i in|\| tail|Prose only/.test(l));
+  assert.equal(unparseable.length, 3);
+  for (const line of unparseable) assert.deepEqual(extractAcSequence(ac(line)), [], line);
+  assert.equal(parsed.length, fixtures.length - 3);
+});

package/src/main/lib/__tests__/delegationReadiness.test.cjs

@@ -694,7 +694,7 @@ test('the installed destructive-git command actually DENIES a shared-tree stash
   const denied = run('git stash', cwd);
   expect(denied.hookSpecificOutput?.permissionDecision).toBe('deny');
 
-  const worktreeCwd = path.join(os2.tmpdir(), 'session-manager-job-worktrees', 'somehash', 'some-slug');
+  const worktreeCwd = path.join(process.env.SM_WORKTREE_ROOT || os2.tmpdir(), 'session-manager-job-worktrees', 'somehash', 'some-slug');
   const allowed = run('git stash', worktreeCwd);
   expect(allowed.hookSpecificOutput?.permissionDecision).not.toBe('deny');
 });

package/src/main/lib/__tests__/dispatchLoop.test.cjs

@@ -0,0 +1,63 @@
+/**
+ * dispatchLoop.test.cjs — interval clamping, no overlap, throw isolation, stop(), kill switch.
+ * Run: timeout 120 npx vitest run src/main/lib/__tests__/dispatchLoop.test.cjs
+ */
+'use strict';
+
+import { test, expect, vi, beforeEach, afterEach } from 'vitest';
+const { startDispatchLoop, resolveIntervalMs } = require('../dispatchLoop.cjs');
+
+beforeEach(() => { vi.useFakeTimers(); delete process.env.SM_DISPATCH_LOOP_DISABLE; delete process.env.SM_DISPATCH_LOOP_INTERVAL_MS; });
+afterEach(() => { vi.useRealTimers(); delete process.env.SM_DISPATCH_LOOP_DISABLE; delete process.env.SM_DISPATCH_LOOP_INTERVAL_MS; });
+
+test('interval defaults to 30s and clamps to [10s, 300s]', () => {
+  expect(resolveIntervalMs(undefined, {})).toBe(30_000);
+  expect(resolveIntervalMs(undefined, { SM_DISPATCH_LOOP_INTERVAL_MS: '1' })).toBe(10_000);
+  expect(resolveIntervalMs(undefined, { SM_DISPATCH_LOOP_INTERVAL_MS: '9999999' })).toBe(300_000);
+  expect(resolveIntervalMs(undefined, { SM_DISPATCH_LOOP_INTERVAL_MS: 'abc' })).toBe(30_000);
+  expect(resolveIntervalMs(45_000, {})).toBe(45_000);
+});
+
+test('ticks on the interval and stop() clears the timer', async () => {
+  const tick = vi.fn(async () => {});
+  const h = startDispatchLoop({ tick });
+  await vi.advanceTimersByTimeAsync(90_000);
+  expect(tick).toHaveBeenCalledTimes(3);
+  h.stop();
+  expect(vi.getTimerCount()).toBe(0);
+  await vi.advanceTimersByTimeAsync(90_000);
+  expect(tick).toHaveBeenCalledTimes(3);
+});
+
+test('skips a pass while the previous one is still running', async () => {
+  let release;
+  const tick = vi.fn(() => new Promise((r) => { release = r; }));
+  const h = startDispatchLoop({ tick, intervalMs: 10_000 });
+  await vi.advanceTimersByTimeAsync(50_000);
+  expect(tick).toHaveBeenCalledTimes(1);
+  release();
+  await vi.advanceTimersByTimeAsync(10_000);
+  expect(tick).toHaveBeenCalledTimes(2);
+  h.stop();
+});
+
+test('a throwing/rejecting tick is isolated, reported, and the loop keeps running', async () => {
+  const onError = vi.fn();
+  let n = 0;
+  const tick = vi.fn(async () => { n++; if (n === 1) throw new Error('boom'); if (n === 2) throw new Error('boom2'); });
+  const h = startDispatchLoop({ tick, intervalMs: 10_000, onError });
+  await vi.advanceTimersByTimeAsync(40_000);
+  expect(tick).toHaveBeenCalledTimes(4);
+  expect(onError).toHaveBeenCalledTimes(2);
+  h.stop();
+});
+
+test('SM_DISPATCH_LOOP_DISABLE=1 never arms the loop', async () => {
+  process.env.SM_DISPATCH_LOOP_DISABLE = '1';
+  const tick = vi.fn();
+  const h = startDispatchLoop({ tick });
+  expect(vi.getTimerCount()).toBe(0);
+  await vi.advanceTimersByTimeAsync(600_000);
+  expect(tick).not.toHaveBeenCalled();
+  h.stop();
+});

package/src/main/lib/__tests__/gateFixtures.json

@@ -0,0 +1,20 @@
+[
+  "- [ ] Gate (last thing the run does, must be green): `timeout 300 npm run typecheck && timeout 300 npm run lint && timeout 600 npm run test:unit`.",
+  "- [ ] Gate (last thing the run does, must be green): `timeout 300 npm run typecheck && timeout 300 npm run lint && TMPDIR=$(mktemp -d) timeout 900 npm run test:unit`.",
+  "- [ ] Gate (last thing the run does, must be green): `timeout 300 npm run typecheck && timeout 300 npm run lint && TMPDIR=$(mktemp -d) timeout 900 npm run test:unit` — run the unit suite with a scratch TMPDIR so gitWorktree.test.cjs sweeps a throwaway root, never the live job-worktree root.",
+  "- [ ] Gate (last thing the run does, must be green): `timeout 300 npm run typecheck && timeout 300 npm run lint && TMPDIR=$(mktemp -d) timeout 900 npm run test:unit` — scratch TMPDIR so gitWorktree.test.cjs sweeps a throwaway root, never the live job-worktree root.",
+  "- [ ] No zustand selector returns a freshly-built value; `timeout 300 npm run lint:selectors` passes.",
+  "- [ ] No hook is declared below a top-level early return — `timeout 300 npm run lint:hooks` exits 0.",
+  "- [ ] Tests: `timeout 300 npm run typecheck` and `timeout 300 npm run lint` pass.",
+  "- [ ] Tests: `TMPDIR=$(mktemp -d) timeout 300 npx vitest run src/main/__tests__/activeIndexMerge.test.cjs` passes.",
+  "- [ ] Both tests pass: `timeout 900 npm run test:unit` and `TMPDIR=$(mktemp -d) timeout 900 npm run test:unit`.",
+  "- [ ] All 16 tests in `timeout 120 npx vitest run tests/unit/chatRunner.spec.ts` pass.",
+  "- [ ] `SM_CHAT_CONCURRENCY=3 timeout 120 npx vitest run tests/unit/chatRunner.spec.ts` passes",
+  "- [ ] Each handled basename is removed from the ALLOWLIST map; `timeout 120 node scripts/check-unregistered-tests.cjs` exits 0.",
+  "- [ ] `timeout 120 npm run lint:docs` exits 0 on the current tree.",
+  "- [ ] Locally, the same sequence passes: `timeout 300 npm run typecheck && timeout 300 npm run lint && timeout 600 npm run build:project-pages`.",
+  "- [ ] After the commit lands, `timeout 60 gh run list --branch main --limit 1` prints the newest run without error.",
+  "- [ ] `for i in 1 2 3; do TMPDIR=$(mktemp -d) timeout 180 npx vitest run src/main/__tests__/scheduler-tick-wedge.test.cjs; done` is green 3/3 (shell loop — not a no-shell gate).",
+  "- [ ] The gate is `timeout 300 npm run typecheck | tail -5` (pipe — needs a shell).",
+  "- [ ] Prose only, no command at all."
+]