claude-code-session-manager 0.87.0 → 0.88.1

package/src/main/lib/__tests__/gitWorktree.test.cjs

@@ -24,6 +24,7 @@ let originalJobDisable;
 let originalJobMax;
 let originalEpicDisable;
 let originalEpicMax;
+let originalWorktreeRoot;
 
 function git(args, cwd) {
   return execFileSync('git', args, { cwd, encoding: 'utf8' });
@@ -43,6 +44,9 @@ beforeEach(() => {
   tmpRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-gitworktree-'));
   repoCwd = path.join(tmpRoot, 'repo');
   initRepo(repoCwd);
+  // Every sweep below runs against THIS throwaway root, never the live job-worktree root.
+  originalWorktreeRoot = process.env.SM_WORKTREE_ROOT;
+  process.env.SM_WORKTREE_ROOT = path.join(tmpRoot, 'worktrees');
   originalJobDisable = process.env.SM_JOB_WORKTREE_DISABLE;
   originalJobMax = process.env.SM_JOB_WORKTREE_MAX;
   originalEpicDisable = process.env.SM_EPIC_WORKTREE_DISABLE;
@@ -65,6 +69,7 @@ afterEach(async () => {
   // Best-effort: prune any worktree either kind's tests created before removing the repo.
   try { await gitWorktree.reconcileWorktreesOnBoot([repoCwd], { kind: 'job' }); } catch { /* ignore */ }
   try { await gitWorktree.reconcileWorktreesOnBoot([repoCwd], { kind: 'epic' }); } catch { /* ignore */ }
+  restore('SM_WORKTREE_ROOT', originalWorktreeRoot);
   fs.rmSync(tmpRoot, { recursive: true, force: true });
 });
 
@@ -1043,7 +1048,9 @@ test('[job] sweepStaleWorktreeCheckouts does NOT remove an old-mtime checkout wi
 test('[job] sweepStaleWorktreeCheckouts removes an old-mtime checkout when there is no live holder', async () => {
   const worktree = await gitWorktree.createJobWorktree({ cwd: repoCwd, slug: 'stale-and-dead' });
   expect(worktree.ok).toBe(true);
-  const holders = new Set(); // nothing holds it
+  // A populated holders set (some unrelated live cwd) that does not cover this checkout —
+  // exercises the liveness gate for real instead of defeating it with an empty set.
+  const holders = new Set([path.resolve(tmpRoot, 'unrelated-live-holder')]);
 
   const result = await gitWorktree.sweepStaleWorktreeCheckouts('job', { staleAgeMs: 0, holders });
 

package/src/main/lib/__tests__/instanceLock.test.cjs

@@ -1,17 +1,49 @@
 // PRD 834 — machine-wide scheduler-ownership lock. Secondary instances must
 // go scheduler-passive instead of running boot reconciliation / admin server
 // against the owner's queue state (live incident 2026-07-31).
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+//
+// HOME is stubbed to a mkdtemp dir BEFORE requiring instanceLock.cjs (mirrors
+// scheduler-reconcile-invalid-repair.test.cjs): instanceLock.cjs pulls in
+// auditLog.cjs, whose audit log path resolves from
+// os.homedir() — so real ~/.claude/session-manager state must never be
+// touched by this suite.
+import { describe, it, expect, beforeAll, afterAll, beforeEach, afterEach } from 'vitest';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 
-const {
-  acquireSchedulerOwnership,
-  releaseSchedulerOwnership,
-  pidAlive,
-  lockPath,
-} = require('../instanceLock.cjs');
+let originalHome;
+let tmpHome;
+let instanceLock;
+let auditLogPath;
+
+beforeAll(() => {
+  originalHome = process.env.HOME;
+  tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-instance-lock-home-'));
+  process.env.HOME = tmpHome;
+  instanceLock = require('../instanceLock.cjs');
+  ({ auditLogPath } = require('../auditLog.cjs'));
+  if (!auditLogPath().startsWith(tmpHome)) {
+    throw new Error(`refusing to run: auditLogPath() (${auditLogPath()}) is not under the temp HOME (${tmpHome})`);
+  }
+});
+
+afterAll(() => {
+  process.env.HOME = originalHome;
+  fs.rmSync(tmpHome, { recursive: true, force: true });
+});
+
+// Thin pass-throughs so every test body below can keep calling these as
+// bare names, resolved lazily against the module loaded in beforeAll.
+const acquireSchedulerOwnership = (...args) => instanceLock.acquireSchedulerOwnership(...args);
+const releaseSchedulerOwnership = (...args) => instanceLock.releaseSchedulerOwnership(...args);
+const pidAlive = (...args) => instanceLock.pidAlive(...args);
+const lockPath = (...args) => instanceLock.lockPath(...args);
+
+function readAuditEvents() {
+  if (!fs.existsSync(auditLogPath())) return [];
+  return fs.readFileSync(auditLogPath(), 'utf8').trim().split('\n').filter(Boolean).map((l) => JSON.parse(l));
+}
 
 let dir;
 
@@ -22,7 +54,9 @@ beforeEach(() => {
 
 afterEach(() => {
   delete process.env.SM_SCHEDULER_LOCK_PATH;
+  delete process.env.SM_PROC_ROOT;
   fs.rmSync(dir, { recursive: true, force: true });
+  if (fs.existsSync(auditLogPath())) fs.rmSync(auditLogPath(), { force: true });
 });
 
 describe('instanceLock (PRD 834)', () => {
@@ -84,4 +118,56 @@ describe('instanceLock (PRD 834)', () => {
     expect(pidAlive(-5)).toBe(false);
     expect(pidAlive(0)).toBe(false);
   });
+
+  it('a legacy lock ({pid, startedAt} only, no identity) is respected while its pid is alive', () => {
+    // Mirrors the on-disk shape of every lock written before this PRD.
+    fs.mkdirSync(path.dirname(lockPath()), { recursive: true });
+    fs.writeFileSync(lockPath(), JSON.stringify({ pid: 1, startedAt: 'x' }));
+    const res = acquireSchedulerOwnership();
+    expect(res.owner).toBe(false);
+    expect(res.holderPid).toBe(1);
+    expect(JSON.parse(fs.readFileSync(lockPath(), 'utf8')).pid).toBe(1);
+    // No identity information to compare, so no stale-lock-broken audit event.
+    expect(readAuditEvents().some((e) => e.kind === 'stale_lock_broken')).toBe(false);
+  });
+
+  it('a recorded identity that no longer matches the live process at that (recycled) pid is broken, and audited', () => {
+    // process.ppid is guaranteed alive for the lifetime of this test (the
+    // vitest worker's own parent) — stand-in for "a hard crash left a lock
+    // whose pid was later reused by an unrelated live process".
+    const recycledPid = process.ppid;
+    const procRoot = path.join(dir, 'proc');
+    fs.mkdirSync(path.join(procRoot, String(recycledPid)), { recursive: true });
+    fs.writeFileSync(
+      path.join(procRoot, String(recycledPid), 'stat'),
+      `${recycledPid} (bash) S 1 ${recycledPid} ${recycledPid} 0 -1 4194304 0 0 0 0 0 0 0 0 20 0 1 0 222222 0 0 0 0 0 0 0 0 0 0 0 0 0 17 0 0 0 0 0 0 0 0 0 0 0 0\n`,
+    );
+    fs.writeFileSync(path.join(procRoot, String(recycledPid), 'cmdline'), 'bash\0');
+    process.env.SM_PROC_ROOT = procRoot;
+
+    fs.mkdirSync(path.dirname(lockPath()), { recursive: true });
+    fs.writeFileSync(lockPath(), JSON.stringify({
+      pid: recycledPid,
+      startedAt: 'x',
+      // The identity the crashed scheduler instance actually recorded — a
+      // different cmdline/startTicks than the process now holding this pid.
+      identity: { pid: recycledPid, startTicks: 111111, cmdline: 'claude --session-id old', complete: true },
+    }));
+
+    const res = acquireSchedulerOwnership();
+    expect(res.owner).toBe(true);
+    expect(JSON.parse(fs.readFileSync(lockPath(), 'utf8')).pid).toBe(process.pid);
+
+    const auditEvents = readAuditEvents().filter((e) => e.kind === 'stale_lock_broken');
+    expect(auditEvents.length).toBe(1);
+    expect(auditEvents[0].recordedPid).toBe(recycledPid);
+  });
+
+  it('writeLockExclusive (via acquire) records a complete identity for this process', () => {
+    acquireSchedulerOwnership();
+    const onDisk = JSON.parse(fs.readFileSync(lockPath(), 'utf8'));
+    expect(onDisk.identity).toBeTruthy();
+    expect(onDisk.identity.pid).toBe(process.pid);
+    expect(onDisk.identity.complete).toBe(true);
+  });
 });

package/src/main/lib/__tests__/jobSupervisorRecord.test.cjs

@@ -0,0 +1,78 @@
+/**
+ * jobSupervisorRecord.test.cjs — record round-trip, live listing, retention
+ * claim, and the pure classifyAdoption matrix.
+ *
+ * Run: timeout 120 npx vitest run src/main/lib/__tests__/jobSupervisorRecord.test.cjs
+ */
+'use strict';
+
+import { test, expect, beforeEach, afterEach } from 'vitest';
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const rec = require('../jobSupervisorRecord.cjs');
+
+let root;
+beforeEach(() => { root = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-supervisor-')); });
+afterEach(() => { fs.rmSync(root, { recursive: true, force: true }); });
+
+const base = (over = {}) => ({
+  runDir: path.join(root, 'run-1'), slug: 'p1', cwd: '/x', runId: 'run-1', pid: 42, pgid: 42,
+  identity: { pid: 42, startTicks: 7, cmdline: 'claude -p', complete: true },
+  execCwd: '/wt', worktreeDir: '/wt', worktreeBranch: 'sm-job/p1', sessionId: 's',
+  startedAt: 1_000, budgetMs: 10_000, maxDurationMs: null, idleKillMs: 5_000, schedulerPid: 1, codeSha: 'abc', ...over,
+});
+
+test('write → read round-trips every field at <runDir>/<slug>.supervisor.json', () => {
+  const input = base();
+  rec.writeSupervisorRecord(input);
+  expect(fs.existsSync(path.join(input.runDir, 'p1.supervisor.json'))).toBe(true);
+  const back = rec.readSupervisorRecord(input.runDir, 'p1');
+  const { runDir, ...persisted } = input;
+  expect(back).toMatchObject({ ...persisted, kind: 'job' });
+  expect(back.runDir).toBeUndefined();
+});
+
+test('readSupervisorRecord returns null for absent or torn files', () => {
+  expect(rec.readSupervisorRecord(path.join(root, 'nope'), 'p1')).toBeNull();
+  fs.mkdirSync(path.join(root, 'r'));
+  fs.writeFileSync(path.join(root, 'r', 'p1.supervisor.json'), '{"pid":');
+  expect(rec.readSupervisorRecord(path.join(root, 'r'), 'p1')).toBeNull();
+});
+
+test('listLiveSupervisorRecords skips exited (meta.json) and stale records', () => {
+  rec.writeSupervisorRecord(base({ slug: 'live' }));
+  rec.writeSupervisorRecord(base({ slug: 'done' }));
+  fs.writeFileSync(path.join(root, 'run-1', 'done.meta.json'), '{}');
+  const live = rec.listLiveSupervisorRecords(root, { maxAgeMs: 60_000 });
+  expect(live.map((r) => r.slug)).toEqual(['live']);
+  expect(live[0].runDir).toBe(path.join(root, 'run-1'));
+  expect(rec.listLiveSupervisorRecords(root, { maxAgeMs: 1, now: Date.now() + 10_000 })).toEqual([]);
+  expect(rec.listLiveSupervisorRecords(path.join(root, 'missing'), { maxAgeMs: 1 })).toEqual([]);
+});
+
+test('investigation records use the .investigation.log exit line as their marker', () => {
+  const runDir = path.join(root, 'run-1');
+  rec.writeSupervisorRecord(base({ slug: 'p1.investigation', kind: 'investigation' }));
+  fs.writeFileSync(path.join(runDir, 'p1.investigation.log'), 'working\n');
+  expect(rec.listLiveSupervisorRecords(root, { maxAgeMs: 60_000 })).toHaveLength(1);
+  fs.appendFileSync(path.join(runDir, 'p1.investigation.log'), '\n[scheduler] investigation exit code=0\n');
+  expect(rec.listLiveSupervisorRecords(root, { maxAgeMs: 60_000 })).toEqual([]);
+});
+
+test('classifyAdoption matrix', () => {
+  const r = base();
+  const same = { pid: 42, startTicks: 7, cmdline: 'claude -p', complete: true };
+  const other = { pid: 42, startTicks: 99, cmdline: 'claude -p', complete: true };
+  const now = 2_000;
+  const c = (o) => rec.classifyAdoption(r, { identity: same, pidAlive: true, logMtimeMs: now, exitMarker: false, now, ...o });
+  expect(c({})).toBe('adopt');
+  expect(c({ pidAlive: false })).toBe('dead');
+  expect(c({ pidAlive: false, exitMarker: true })).toBe('exited');
+  expect(c({ identity: other })).toBe('foreign-pid');
+  expect(c({ identity: { pid: 42, startTicks: null, cmdline: null, complete: false } })).toBe('adopt'); // fail-closed
+  expect(c({ now: 1_000 + 10_001, logMtimeMs: 1_000 + 10_000 })).toBe('over-budget');
+  expect(c({ now: 1_000 + 5_001, logMtimeMs: 1_000 })).toBe('over-budget'); // log stalled past idleKillMs
+  expect(rec.classifyAdoption(base({ budgetMs: null, maxDurationMs: 100 }), { identity: same, pidAlive: true, logMtimeMs: 1_050, now: 1_200 })).toBe('over-budget');
+  expect(rec.classifyAdoption(base({ budgetMs: null, idleKillMs: null }), { identity: same, pidAlive: true, now: 9e9 })).toBe('adopt');
+});

package/src/main/lib/__tests__/jobWorktreeBootLive.test.cjs

@@ -69,3 +69,14 @@ test('a precomputed cwdHolders set is forwarded through to hasLiveHolder unchang
   isLive('job-d', { worktree: '/tmp/checkout-d' });
   expect(hasLiveHolder).toHaveBeenCalledWith('/tmp/checkout-d', holders);
 });
+
+test('rowPid (the record/log ladder) is consulted instead of runtime.pid alone', () => {
+  const claudePidAlive = vi.fn((pid) => pid === 777);
+  const isLive = buildJobWorktreeIsLive({
+    bootJobs: [{ slug: 'job-e', status: 'running' }],
+    claudePidAlive,
+    hasLiveHolder: () => false,
+    rowPid: () => 777,
+  });
+  expect(isLive('job-e', { worktree: '/tmp/checkout-e' })).toBe(true);
+});

package/src/main/lib/__tests__/localAdminHttp.test.cjs

@@ -173,7 +173,7 @@ test('with neither SM_DEV nor SM_E2E set, resolves to the original admin-api.jso
   delete process.env.SM_E2E;
   delete process.env.SM_ADMIN_TOKEN_PATH;
   try {
-    expect(resolveTokenPath()).toBe(TOKEN_PATH);
+    expect(resolveTokenPath()).toBe(path.join(require('../schedulerPaths.cjs').schedulerHome(), 'admin-api.json'));
   } finally {
     if (prevDev === undefined) delete process.env.SM_DEV; else process.env.SM_DEV = prevDev;
     if (prevE2e === undefined) delete process.env.SM_E2E; else process.env.SM_E2E = prevE2e;

package/src/main/lib/__tests__/mcpToolCatalog.test.cjs

@@ -78,12 +78,17 @@ test.each(MCP_TOOL_CATALOG)('$name composeDescription joins purpose/whenToUse/wh
   expect(composeDescription(entry).length).toBeGreaterThan(0);
 });
 
+test('project-home group is exactly the single project_home_write tool', () => {
+  expect(MCP_TOOL_CATALOG.filter((e) => e.group === 'project-home').map((e) => e.name)).toEqual(['project_home_write']);
+});
+
 test('MCP_RECIPES covers queue-work, unstick-needs-review, and hand-off-to-another-project', () => {
   const ids = MCP_RECIPES.map((r) => r.id);
   expect(ids).toContain('queue-work-via-develop');
   expect(ids).toContain('unstick-needs-review-job');
   expect(ids).toContain('hand-finding-to-another-project');
-  expect(ids).toContain('generate-project-home');
+  // the single-tool project_home_write needs no recipe; the old 4-step one is gone
+  expect(ids).not.toContain('generate-project-home');
   for (const recipe of MCP_RECIPES) {
     expect(recipe.title).toBeTruthy();
     expect(Array.isArray(recipe.steps)).toBe(true);

package/src/main/lib/__tests__/procIdentity.test.cjs

@@ -0,0 +1,119 @@
+// PRD: fail-closed process identity so a recycled pid can never pin
+// instanceLock ownership or dodge killOrphanClaudePid's veto. Stat parsing is
+// exercised against fixture files under SM_PROC_ROOT (never real /proc) so a
+// synthetic `comm` containing parens/spaces can be asserted precisely.
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const { identity, isDifferentProcess } = require('../procIdentity.cjs');
+
+let dir;
+
+function writeProcEntry(root, pid, { stat, cmdline }) {
+  const entryDir = path.join(root, String(pid));
+  fs.mkdirSync(entryDir, { recursive: true });
+  if (stat !== undefined) fs.writeFileSync(path.join(entryDir, 'stat'), stat);
+  if (cmdline !== undefined) fs.writeFileSync(path.join(entryDir, 'cmdline'), cmdline);
+}
+
+// Real /proc/<pid>/stat line, comm replaced with one containing a space and
+// an embedded ')' — field 22 (starttime) is `124686`, at the position AFTER
+// the LAST ')', not the first.
+function statLine(comm, startTicks) {
+  return `12345 (${comm}) R 1 12345 12345 0 -1 4194304 118 0 0 0 0 0 0 0 32 12 1 0 ${startTicks} 18698240 440 0 0 0 0 0 0 0 0 0 0 0 17 7 0 0 0 0 0 0 0 0 0 0 0 0\n`;
+}
+
+beforeEach(() => {
+  dir = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-proc-identity-'));
+  process.env.SM_PROC_ROOT = dir;
+});
+
+afterEach(() => {
+  delete process.env.SM_PROC_ROOT;
+  fs.rmSync(dir, { recursive: true, force: true });
+});
+
+describe('procIdentity.identity — /proc parsing', () => {
+  it('parses field 22 located after the LAST ")" when comm contains a paren and a space', () => {
+    writeProcEntry(dir, 4242, {
+      stat: statLine('claude (worker)', 999888),
+      cmdline: 'node\0claude\0--session-id\0abc\0',
+    });
+    const id = identity(4242);
+    expect(id.pid).toBe(4242);
+    expect(id.startTicks).toBe(999888);
+    expect(id.cmdline).toBe('node claude --session-id abc');
+    expect(id.complete).toBe(true);
+  });
+
+  it('reads the live node process itself from real /proc (sanity check against production code path)', () => {
+    delete process.env.SM_PROC_ROOT;
+    const id = identity(process.pid);
+    expect(id.pid).toBe(process.pid);
+    expect(typeof id.startTicks).toBe('number');
+    expect(id.startTicks).toBeGreaterThan(0);
+    expect(typeof id.cmdline).toBe('string');
+    expect(id.cmdline.length).toBeGreaterThan(0);
+    expect(id.complete).toBe(true);
+    process.env.SM_PROC_ROOT = dir; // restore for afterEach
+  });
+
+  it('tri-state: missing stat file → incomplete (startTicks null) even though cmdline is readable', () => {
+    writeProcEntry(dir, 5001, { cmdline: 'node\0claude\0' });
+    const id = identity(5001);
+    expect(id.startTicks).toBeNull();
+    expect(id.cmdline).toBe('node claude');
+    expect(id.complete).toBe(false);
+  });
+
+  it('tri-state: missing cmdline file → incomplete (cmdline null) even though stat is readable', () => {
+    writeProcEntry(dir, 5002, { stat: statLine('claude', 111) });
+    const id = identity(5002);
+    expect(id.startTicks).toBe(111);
+    expect(id.cmdline).toBeNull();
+    expect(id.complete).toBe(false);
+  });
+
+  it('tri-state: neither file exists (pid never existed / already reaped) → incomplete, never throws', () => {
+    const id = identity(999999);
+    expect(id.startTicks).toBeNull();
+    expect(id.cmdline).toBeNull();
+    expect(id.complete).toBe(false);
+  });
+
+  it('rejects a non-positive-integer pid without touching the filesystem', () => {
+    expect(identity(-1).complete).toBe(false);
+    expect(identity(0).complete).toBe(false);
+    expect(identity(NaN).complete).toBe(false);
+  });
+});
+
+describe('procIdentity.isDifferentProcess — fail-closed decision', () => {
+  const complete = (over = {}) => ({ pid: 100, startTicks: 555, cmdline: 'node claude', complete: true, ...over });
+
+  it('true only when both sides are complete AND a field differs', () => {
+    expect(isDifferentProcess(complete(), complete({ startTicks: 999 }))).toBe(true);
+    expect(isDifferentProcess(complete(), complete({ cmdline: 'node other' }))).toBe(true);
+    expect(isDifferentProcess(complete(), complete())).toBe(false);
+  });
+
+  it('an incomplete recorded or live side never reads as different (fail closed)', () => {
+    const incomplete = { pid: 100, startTicks: null, cmdline: null, complete: false };
+    expect(isDifferentProcess(incomplete, complete())).toBe(false);
+    expect(isDifferentProcess(complete(), incomplete)).toBe(false);
+    expect(isDifferentProcess(incomplete, incomplete)).toBe(false);
+  });
+
+  it('a null/undefined probe (unreadable /proc, process gone) never reads as different', () => {
+    expect(isDifferentProcess(complete(), null)).toBe(false);
+    expect(isDifferentProcess(null, complete())).toBe(false);
+    expect(isDifferentProcess(undefined, undefined)).toBe(false);
+  });
+
+  it('a legacy record with no identity fields at all never reads as different', () => {
+    const legacy = { pid: 100 }; // e.g. an old {pid, startedAt}-only lock body
+    expect(isDifferentProcess(legacy, complete())).toBe(false);
+  });
+});

package/src/main/lib/__tests__/procName.test.cjs

@@ -0,0 +1,92 @@
+// PRD pn-01: procName primitive. HOME is redirected to a temp dir for the whole file
+// (procnamesRoot() resolves lazily from HOME) — never the real ~/.claude.
+import { describe, it, expect, afterAll } from 'vitest';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'procname-'));
+const realHome = process.env.HOME;
+process.env.HOME = tmpHome; // stays redirected: procnamesRoot() resolves lazily
+const { aliasBinFor, smArgv0, procnamesRoot, pruneStaleAliases } = require('../procName.cjs');
+
+afterAll(() => {
+  process.env.HOME = realHome;
+  try { fs.chmodSync(procnamesRoot(), 0o700); } catch { /* absent */ }
+  fs.rmSync(tmpHome, { recursive: true, force: true });
+});
+
+function fakeBin(name) {
+  const p = path.join(tmpHome, name);
+  fs.writeFileSync(p, '#!/bin/sh\nexit 0\n', { mode: 0o755 });
+  return p;
+}
+
+describe('procName', () => {
+  it('procnamesRoot() lives under the temp HOME machine-state root', () => {
+    expect(procnamesRoot()).toBe(path.join(tmpHome, '.claude', 'session-manager', 'procnames'));
+  });
+
+  it('creates a symlink and returns the alias path', () => {
+    const bin = fakeBin('bin-a');
+    const out = aliasBinFor(bin, 'sm-claude-job');
+    expect(out).toBe(path.join(procnamesRoot(), 'sm-claude-job'));
+    expect(fs.readlinkSync(out)).toBe(bin);
+  });
+
+  it('self-repairs a drifted link', () => {
+    const a = fakeBin('bin-b1');
+    const b = fakeBin('bin-b2');
+    aliasBinFor(a, 'sm-claude-chat');
+    const out = aliasBinFor(b, 'sm-claude-chat');
+    expect(fs.readlinkSync(out)).toBe(b);
+  });
+
+  it('throws on an alias longer than 15 chars', () => {
+    expect(() => aliasBinFor(fakeBin('bin-c'), 'sm-claude-toolong-x')).toThrow(/TASK_COMM_LEN/);
+    expect(() => aliasBinFor(fakeBin('bin-c'), 'session-manager')).not.toThrow();
+  });
+
+  it('returns the original bin for an unresolvable bare name', () => {
+    expect(aliasBinFor('definitely-not-a-real-cmd-xyz', 'sm-claude-aux')).toBe('definitely-not-a-real-cmd-xyz');
+  });
+
+  it.skipIf(process.getuid && process.getuid() === 0)('fails open when procnamesRoot() is read-only', () => {
+    const bin = fakeBin('bin-d');
+    fs.mkdirSync(procnamesRoot(), { recursive: true });
+    fs.chmodSync(procnamesRoot(), 0o500);
+    try {
+      expect(aliasBinFor(bin, 'sm-shell')).toBe(bin);
+    } finally {
+      fs.chmodSync(procnamesRoot(), 0o700);
+    }
+  });
+
+  it('smArgv0 shape, sanitisation, and length bound', () => {
+    expect(smArgv0('job', 'prd 12/x!')).toBe('sm-claude-job:prd12x');
+    expect(smArgv0('job', 'a'.repeat(500)).length).toBeLessThanOrEqual(120);
+  });
+
+  it('smArgv0 always matches the live /\\bclaude\\b/ gates for every role', () => {
+    // Replicated verbatim from scheduler.cjs killOrphanClaudePid & reaperHelpers.cjs claudePidAlive.
+    const gate = /\bclaude\b/;
+    for (const role of ['job', 'chat', 'aux', 'helper', '', undefined, '!!!', 'x'.repeat(300)]) {
+      for (const detail of ['abc', '', undefined, null, '///', 'y'.repeat(300)]) {
+        const label = smArgv0(role, detail);
+        expect(gate.test(label)).toBe(true);
+        expect(label.length).toBeLessThanOrEqual(120);
+      }
+    }
+  });
+
+  it('pruneStaleAliases removes dead links and keeps live ones', () => {
+    const live = fakeBin('bin-live');
+    const dead = fakeBin('bin-dead');
+    const liveAlias = aliasBinFor(live, 'sm-live');
+    const deadAlias = aliasBinFor(dead, 'sm-dead');
+    fs.rmSync(dead);
+    expect(() => pruneStaleAliases()).not.toThrow();
+    expect(fs.existsSync(liveAlias)).toBe(true);
+    expect(fs.lstatSync(deadAlias, { throwIfNoEntry: false })).toBeUndefined();
+  });
+});

package/src/main/lib/__tests__/queueStoreMachineStateRecovery.test.cjs

@@ -121,3 +121,70 @@ test('readMerged (async) recovers the same real fixture', async () => {
   expect(state.machineStateRecoveryMode).toBe('prefix');
   expect(state.lastRunAt).toBe('2026-09-11T10:00:14.441Z');
 });
+
+// ---------- per-cwd shard quarantine (never recover, never write) ----------
+
+function makeProject(name, jobs) {
+  const cwd = path.join(tmpHome, 'Projects', name);
+  const stateDir = path.join(cwd, 'session-manager-operations', 'scheduler', 'state');
+  fs.mkdirSync(stateDir, { recursive: true });
+  const file = path.join(stateDir, 'queue.json');
+  if (jobs) fs.writeFileSync(file, JSON.stringify({ jobs }));
+  const slugDir = path.join(tmpHome, '.claude', 'projects', `slug-${name}`);
+  fs.mkdirSync(slugDir, { recursive: true });
+  fs.writeFileSync(path.join(slugDir, 't.jsonl'), JSON.stringify({ cwd }) + '\n');
+  return { cwd, file };
+}
+
+const TORN = '{"jobs":[{"slug":"a","status":"running"}]} {"jobs":[{"slug":"a","stat';
+const goodJob = (slug, cwd) => ({
+  slug, status: 'pending', prdPath: `/x/${slug}.md`, cwd, scheduledFor: null, createdAt: new Date().toISOString(),
+});
+
+test('a torn shard is quarantined per cwd; the machine-level `unreadable` stays unset and the sibling shard still loads', () => {
+  const good = makeProject('good', [goodJob('g1', path.join(tmpHome, 'Projects', 'good'))]);
+  const torn = makeProject('torn');
+  fs.writeFileSync(torn.file, TORN);
+  const opts = { projectsDir: path.join(tmpHome, '.claude', 'projects') };
+
+  const state = queueStore.readMergedSync(opts);
+
+  expect(state.unreadable).toBeUndefined();
+  expect(state.unreadableCwds).toHaveLength(1);
+  expect(state.unreadableCwds[0]).toMatchObject({ cwd: torn.cwd, file: torn.file });
+  expect(typeof state.unreadableCwds[0].error).toBe('string');
+  expect(state.jobs.map((j) => j.slug)).toEqual(['g1']);
+  expect(state.sourceCwds).not.toContain(torn.cwd);
+});
+
+test('readMerged (async) quarantines the same way', async () => {
+  const torn = makeProject('torn2');
+  fs.writeFileSync(torn.file, TORN);
+  const state = await queueStore.readMerged({ projectsDir: path.join(tmpHome, '.claude', 'projects') });
+  expect(state.unreadable).toBeUndefined();
+  expect(state.unreadableCwds.map((u) => u.cwd)).toEqual([torn.cwd]);
+});
+
+test('writeSplit leaves a torn shard byte-identical even when merged rows carry its cwd, and still writes healthy shards', async () => {
+  const good = makeProject('good3', [goodJob('g1', path.join(tmpHome, 'Projects', 'good3'))]);
+  const torn = makeProject('torn3');
+  fs.writeFileSync(torn.file, TORN);
+  const before = fs.readFileSync(torn.file);
+  const opts = { projectsDir: path.join(tmpHome, '.claude', 'projects') };
+
+  const state = await queueStore.readMerged(opts);
+  state.jobs.push(goodJob('intruder', torn.cwd)); // a row that claims the torn cwd
+  state.jobs[0].status = 'running';
+  await queueStore.writeSplit(state, good.cwd);
+
+  expect(fs.readFileSync(torn.file).equals(before)).toBe(true);
+  const written = JSON.parse(fs.readFileSync(good.file, 'utf8'));
+  expect(written.jobs.map((j) => j.status)).toEqual(['running']);
+});
+
+test('writeSplit never re-creates a quarantined shard that has no file at all', async () => {
+  const ghost = makeProject('ghost');
+  const state = { config: {}, jobs: [goodJob('x', ghost.cwd)], sourceCwds: [], unreadableCwds: [{ cwd: ghost.cwd, file: ghost.file, error: 'x' }] };
+  await queueStore.writeSplit(state, ghost.cwd);
+  expect(fs.existsSync(ghost.file)).toBe(false);
+});

package/src/main/lib/__tests__/schedulerMcpServerHelp.test.cjs

@@ -6,11 +6,11 @@
  * when the admin API is unreachable — only the readiness section may report
  * unavailable.
  *
- * TOKEN_PATH (scripts/scheduler-mcp-server.cjs) is computed once, at
- * require-time, from os.homedir(). Since os.homedir() reads process.env.HOME
- * on POSIX, each test temporarily repoints HOME at a fresh tmp dir, clears
- * the require cache, and re-requires the module so TOKEN_PATH resolves under
- * that tmp dir — never touching the real ~/.claude/session-manager/admin-api.json.
+ * The admin token path (schedulerPaths.adminTokenPath) resolves lazily from
+ * os.homedir(). Since os.homedir() reads process.env.HOME on POSIX, each test
+ * repoints HOME at a fresh tmp dir for its duration (restored in afterEach)
+ * so the token path resolves under that tmp dir, never the real
+ * ~/.claude/session-manager/admin-api.json.
  *
  * Run: timeout 120 npx vitest run src/main/lib/__tests__/schedulerMcpServerHelp.test.cjs
  */
@@ -72,8 +72,7 @@ function requireServerWithHome(homeDir) {
   process.env.HOME = homeDir;
   delete require.cache[require.resolve(SERVER_PATH)];
   const mod = require(SERVER_PATH);
-  process.env.HOME = originalHome;
-  originalHome = undefined;
+  // HOME stays redirected until afterEach: admin-token path resolves lazily.
   return mod;
 }