claude-code-session-manager 0.87.0 → 0.88.1

package/src/main/lib/__tests__/schedulerMcpServerProjectHome.test.cjs

@@ -1,11 +1,10 @@
 /**
- * schedulerMcpServerProjectHome.test.cjs — the four project_home_* MCP
- * tools (PRD: project-home-mcp-tools) that wrap PRD 1089's admin routes.
+ * schedulerMcpServerProjectHome.test.cjs — the single project_home_write MCP
+ * tool that wraps POST /admin/project-home/write.
  * Covers: presence in TOOLS, catalog-composed descriptions, correct
  * route/payload dispatch via a stubbed admin HTTP server, cwd defaulting to
- * SM_PROJECT_ROOT/process.cwd() when omitted, the app-not-running failure
- * shape, and that project_home_get_contract's composed response is
- * self-sufficient (mentions all 5 lens ids, no repo-relative path).
+ * SM_PROJECT_ROOT/process.cwd() when omitted, and the app-not-running failure
+ * shape.
  *
  * Same HOME-repointing pattern as schedulerMcpServerHelp.test.cjs — see that
  * file's header for why.
@@ -23,7 +22,8 @@ const path = require('node:path');
 const SERVER_PATH = path.join(__dirname, '../../../../scripts/scheduler-mcp-server.cjs');
 const { MCP_TOOL_CATALOG, composeDescription } = require('../mcpToolCatalog.cjs');
 
-const PROJECT_HOME_TOOL_NAMES = [
+const TOOL_NAME = 'project_home_write';
+const OLD_TOOL_NAMES = [
   'project_home_get_contract',
   'project_home_validate_summary',
   'project_home_render',
@@ -94,8 +94,7 @@ function requireServerWithHome(homeDir) {
   process.env.HOME = homeDir;
   delete require.cache[require.resolve(SERVER_PATH)];
   const mod = require(SERVER_PATH);
-  process.env.HOME = originalHome;
-  originalHome = undefined;
+  // HOME stays redirected until afterEach: admin-token path resolves lazily.
   return mod;
 }
 
@@ -109,223 +108,60 @@ function callTool(handleCallTool, name, args) {
   return handleCallTool({ params: { name, arguments: args } });
 }
 
-test('all four project_home_* tools are present in TOOLS with correct input schemas', async () => {
+test('project_home_write is the only project_home_* tool, with html required and cwd optional', async () => {
   const homeDir = await mkTmp();
   const { TOOLS } = requireServerWithHome(homeDir);
-  for (const name of PROJECT_HOME_TOOL_NAMES) {
-    const tool = TOOLS.find((t) => t.name === name);
-    expect(tool).toBeTruthy();
-    expect(tool.inputSchema.type).toBe('object');
-    expect(tool.inputSchema.properties.cwd).toBeTruthy();
-    // cwd is never required on any of the four
-    expect(tool.inputSchema.required ?? []).not.toContain('cwd');
-  }
-  const validate = TOOLS.find((t) => t.name === 'project_home_validate_summary');
-  expect(validate.inputSchema.required).toContain('summary');
-  const render = TOOLS.find((t) => t.name === 'project_home_render');
-  expect(render.inputSchema.required).toEqual(expect.arrayContaining(['summary', 'picks']));
+  expect(TOOLS.filter((t) => t.name.startsWith('project_home_')).map((t) => t.name)).toEqual([TOOL_NAME]);
+  for (const old of OLD_TOOL_NAMES) expect(TOOLS.find((t) => t.name === old)).toBeUndefined();
+  const tool = TOOLS.find((t) => t.name === TOOL_NAME);
+  expect(tool.inputSchema.type).toBe('object');
+  expect(tool.inputSchema.properties.cwd).toBeTruthy();
+  expect(tool.inputSchema.properties.html).toBeTruthy();
+  expect(tool.inputSchema.required).toEqual(['html']);
 });
 
-test.each(PROJECT_HOME_TOOL_NAMES)('%s description equals the catalog-composed string', async (name) => {
+test('project_home_write description equals the catalog-composed string; old entries are gone', async () => {
   const homeDir = await mkTmp();
   const { TOOLS } = requireServerWithHome(homeDir);
-  const tool = TOOLS.find((t) => t.name === name);
-  const entry = MCP_TOOL_CATALOG.find((e) => e.name === name);
+  const tool = TOOLS.find((t) => t.name === TOOL_NAME);
+  const entry = MCP_TOOL_CATALOG.find((e) => e.name === TOOL_NAME);
   expect(entry).toBeTruthy();
   expect(entry.group).toBe('project-home');
   expect(tool.description).toBe(composeDescription(entry));
+  for (const old of OLD_TOOL_NAMES) expect(MCP_TOOL_CATALOG.find((e) => e.name === old)).toBeUndefined();
 });
 
-test('project_home_get_contract dispatches GET /admin/project-home/contract with cwd query param', async () => {
-  const homeDir = await mkTmp();
-  const token = 'test-token';
-  const { server, requests } = await startFakeAdminServer(token, {
-    ok: true,
-    protocol: ['step one'],
-    catalog: { lenses: [{ id: 'home' }, { id: 'marketing' }, { id: 'feature' }, { id: 'architecture' }, { id: 'brief' }] },
-    paths: { summaryPath: '/abs/summary.json', picksPath: '/abs/picks.json', outputDir: '/abs/output' },
-    spec: { text: 'spec text', path: '/abs/spec.md' },
-  });
-  servers.push(server);
-  await writeAdminConfig(homeDir, { port: server.address().port, token });
-
-  const { handleCallTool } = requireServerWithHome(homeDir);
-  const result = await callTool(handleCallTool, 'project_home_get_contract', { cwd: '/home/bilko/Projects/session-manager' });
-  expect(result.isError).toBeFalsy();
-  expect(requests).toHaveLength(1);
-  expect(requests[0].method).toBe('GET');
-  expect(requests[0].url).toBe('/admin/project-home/contract?cwd=%2Fhome%2Fbilko%2FProjects%2Fsession-manager');
-});
-
-test('project_home_get_contract composed response mentions all 5 lens ids and no repo-relative path', async () => {
-  const homeDir = await mkTmp();
-  const token = 'test-token';
-  const { server } = await startFakeAdminServer(token, {
-    ok: true,
-    protocol: [
-      'Call GET /admin/project-home/status?cwd=<abs> first.',
-      'Compose a ProjectPageSummary matching summarySchema.',
-      'For each lens in catalog.lenses, pick a variant per slot.',
-      'POST /admin/project-home/validate-summary with {cwd, summary}.',
-      'POST /admin/project-home/render with {cwd, summary, picks}.',
-    ],
-    summarySchema: { type: 'object' },
-    picksSchema: { type: 'object' },
-    catalog: {
-      lenses: [
-        { id: 'home', slots: [] },
-        { id: 'marketing', slots: [] },
-        { id: 'feature', slots: [] },
-        { id: 'architecture', slots: [] },
-        { id: 'brief', slots: [] },
-      ],
-    },
-    paths: { summaryPath: '/abs/project-pages/summary.json', picksPath: '/abs/project-pages/picks.json', outputDir: '/abs/project-pages/output' },
-    spec: { text: 'This project uses absolute paths only, never repo-relative ones.', path: '/abs/project-pages-pipeline.md' },
-  });
-  servers.push(server);
-  await writeAdminConfig(homeDir, { port: server.address().port, token });
-
-  const { handleCallTool } = requireServerWithHome(homeDir);
-  const result = await callTool(handleCallTool, 'project_home_get_contract', {});
-  expect(result.isError).toBeFalsy();
-  const text = result.content[0].text;
-  for (const lens of ['home', 'marketing', 'feature', 'architecture', 'brief']) {
-    expect(text).toContain(lens);
-  }
-  expect(text).not.toMatch(/session-manager-operations\/architecture\//);
-  expect(text).not.toMatch(/\.claude\/agents\//);
-});
-
-test('project_home_validate_summary dispatches POST /admin/project-home/validate-summary with cwd+summary', async () => {
-  const homeDir = await mkTmp();
-  const token = 'test-token';
-  const { server, requests } = await startFakeAdminServer(token, { ok: true, valid: true, errors: [] });
-  servers.push(server);
-  await writeAdminConfig(homeDir, { port: server.address().port, token });
-
-  const { handleCallTool } = requireServerWithHome(homeDir);
-  const summary = { title: 'Example Project' };
-  const result = await callTool(handleCallTool, 'project_home_validate_summary', {
-    cwd: '/home/bilko/Projects/session-manager',
-    summary,
-  });
-  expect(result.isError).toBeFalsy();
-  expect(requests).toHaveLength(1);
-  expect(requests[0].method).toBe('POST');
-  expect(requests[0].url).toBe('/admin/project-home/validate-summary');
-  expect(requests[0].body).toEqual({ cwd: '/home/bilko/Projects/session-manager', summary });
-});
-
-test('project_home_validate_summary surfaces per-field errors from the route, not a generic failure', async () => {
-  const homeDir = await mkTmp();
-  const token = 'test-token';
-  const { server } = await startFakeAdminServer(token, {
-    ok: true,
-    valid: false,
-    errors: [{ field: 'quotes[0].attribution', message: 'quotes[0].attribution must not be a placeholder value' }],
-  });
-  servers.push(server);
-  await writeAdminConfig(homeDir, { port: server.address().port, token });
-
-  const { handleCallTool } = requireServerWithHome(homeDir);
-  const result = await callTool(handleCallTool, 'project_home_validate_summary', {
-    cwd: '/home/bilko/Projects/session-manager',
-    summary: { title: 'x', quotes: [{ attribution: 'TODO' }] },
-  });
-  expect(result.isError).toBeFalsy();
-  const body = JSON.parse(result.content[0].text);
-  expect(body.valid).toBe(false);
-  expect(body.errors).toEqual([
-    { field: 'quotes[0].attribution', message: 'quotes[0].attribution must not be a placeholder value' },
-  ]);
-});
-
-test('project_home_validate_summary requires summary', async () => {
-  const homeDir = await mkTmp();
-  const { handleCallTool } = requireServerWithHome(homeDir);
-  const result = await callTool(handleCallTool, 'project_home_validate_summary', { cwd: '/x' });
-  expect(result.isError).toBe(true);
-  expect(result.content[0].text).toContain('summary');
-});
-
-test('project_home_render dispatches POST /admin/project-home/render with cwd+summary+picks', async () => {
+test('project_home_write dispatches POST /admin/project-home/write with cwd+html', async () => {
   const homeDir = await mkTmp();
   const token = 'test-token';
-  const { server, requests } = await startFakeAdminServer(token, {
-    ok: true,
-    filesWritten: ['/abs/summary.json'],
-    generatedAt: '2026-09-01T00:00:00.000Z',
-  });
+  const { server, requests } = await startFakeAdminServer(token, { ok: true, path: '/abs/home.html', bytes: 12 });
   servers.push(server);
   await writeAdminConfig(homeDir, { port: server.address().port, token });
 
   const { handleCallTool } = requireServerWithHome(homeDir);
-  const summary = { title: 'Example Project' };
-  const picks = { home: { hero: 'variant-a' } };
-  const result = await callTool(handleCallTool, 'project_home_render', {
-    cwd: '/home/bilko/Projects/session-manager',
-    summary,
-    picks,
-  });
+  const html = '<!DOCTYPE html><html></html>';
+  const result = await callTool(handleCallTool, TOOL_NAME, { cwd: '/home/bilko/Projects/session-manager', html });
   expect(result.isError).toBeFalsy();
   expect(requests).toHaveLength(1);
   expect(requests[0].method).toBe('POST');
-  expect(requests[0].url).toBe('/admin/project-home/render');
-  expect(requests[0].body).toEqual({ cwd: '/home/bilko/Projects/session-manager', summary, picks });
+  expect(requests[0].url).toBe('/admin/project-home/write');
+  expect(requests[0].body).toEqual({ cwd: '/home/bilko/Projects/session-manager', html });
 });
 
-test('project_home_render requires both summary and picks', async () => {
+test('project_home_write requires a non-empty html', async () => {
   const homeDir = await mkTmp();
   const { handleCallTool } = requireServerWithHome(homeDir);
-
-  const missingSummary = await callTool(handleCallTool, 'project_home_render', { picks: {} });
-  expect(missingSummary.isError).toBe(true);
-  expect(missingSummary.content[0].text).toContain('summary');
-
-  const missingPicks = await callTool(handleCallTool, 'project_home_render', { summary: {} });
-  expect(missingPicks.isError).toBe(true);
-  expect(missingPicks.content[0].text).toContain('picks');
-});
-
-test('project_home_status dispatches GET /admin/project-home/status with cwd query param', async () => {
-  const homeDir = await mkTmp();
-  const token = 'test-token';
-  const { server, requests } = await startFakeAdminServer(token, {
-    ok: true,
-    summary: { exists: false, mtimeMs: null },
-    picks: { exists: false, mtimeMs: null },
-    output: {
-      home: { exists: false, mtimeMs: null },
-      marketing: { exists: false, mtimeMs: null },
-      feature: { exists: false, mtimeMs: null },
-      architecture: { exists: false, mtimeMs: null },
-      brief: { exists: false, mtimeMs: null },
-    },
-    manifest: { exists: false, generatedAt: null },
-  });
-  servers.push(server);
-  await writeAdminConfig(homeDir, { port: server.address().port, token });
-
-  const { handleCallTool } = requireServerWithHome(homeDir);
-  const result = await callTool(handleCallTool, 'project_home_status', { cwd: '/home/bilko/Projects/session-manager' });
-  expect(result.isError).toBeFalsy();
-  expect(requests).toHaveLength(1);
-  expect(requests[0].method).toBe('GET');
-  expect(requests[0].url).toBe('/admin/project-home/status?cwd=%2Fhome%2Fbilko%2FProjects%2Fsession-manager');
-
-  // Never-generated project: well-formed all-absent result, not an error.
-  const body = JSON.parse(result.content[0].text);
-  expect(body.ok).toBe(true);
-  expect(body.summary.exists).toBe(false);
-  expect(body.manifest.exists).toBe(false);
-  expect(body.output.brief.exists).toBe(false);
+  for (const args of [{ cwd: '/x' }, { cwd: '/x', html: '' }]) {
+    const result = await callTool(handleCallTool, TOOL_NAME, args);
+    expect(result.isError).toBe(true);
+    expect(result.content[0].text).toContain('html');
+  }
 });
 
-test.each(PROJECT_HOME_TOOL_NAMES)('%s defaults cwd to SM_PROJECT_ROOT when omitted', async (name) => {
+test('project_home_write defaults cwd to SM_PROJECT_ROOT when omitted', async () => {
   const homeDir = await mkTmp();
   const token = 'test-token';
-  const { server, requests } = await startFakeAdminServer(token, { ok: true, valid: true, errors: [] });
+  const { server, requests } = await startFakeAdminServer(token, { ok: true });
   servers.push(server);
   await writeAdminConfig(homeDir, { port: server.address().port, token });
 
@@ -333,18 +169,15 @@ test.each(PROJECT_HOME_TOOL_NAMES)('%s defaults cwd to SM_PROJECT_ROOT when omit
   process.env.SM_PROJECT_ROOT = '/home/bilko/Projects/session-manager/session-manager-operations/scheduler/epics/some-epic/worktree';
 
   const { handleCallTool } = requireServerWithHome(homeDir);
-  const args = name === 'project_home_render' ? { summary: {}, picks: {} } : name === 'project_home_validate_summary' ? { summary: {} } : {};
-  await callTool(handleCallTool, name, args);
+  await callTool(handleCallTool, TOOL_NAME, { html: '<p>x</p>' });
   expect(requests).toHaveLength(1);
-  const encoded = requests[0].body?.cwd ?? new URLSearchParams(requests[0].url.split('?')[1]).get('cwd');
-  expect(encoded).toBe(process.env.SM_PROJECT_ROOT);
+  expect(requests[0].body.cwd).toBe(process.env.SM_PROJECT_ROOT);
 });
 
-test.each(PROJECT_HOME_TOOL_NAMES)('%s returns the app-not-running error when the admin API is unreachable', async (name) => {
+test('project_home_write returns the app-not-running error when the admin API is unreachable', async () => {
   const homeDir = await mkTmp();
   const { handleCallTool, NOT_RUNNING_ERROR } = requireServerWithHome(homeDir);
-  const args = name === 'project_home_render' ? { summary: {}, picks: {} } : name === 'project_home_validate_summary' ? { summary: {} } : {};
-  const result = await callTool(handleCallTool, name, args);
+  const result = await callTool(handleCallTool, TOOL_NAME, { html: '<p>x</p>' });
   expect(result.isError).toBe(true);
   expect(result.content[0].text).toBe(NOT_RUNNING_ERROR);
 });

package/src/main/lib/__tests__/schedulerPaths.test.cjs

@@ -0,0 +1,226 @@
+/**
+ * schedulerPaths.test.cjs — every machine-wide scheduler root resolves lazily
+ * through lib/schedulerPaths.cjs, so SM_SCHEDULER_HOME redirects ALL of them.
+ *
+ * SM_SCHEDULER_HOME is set to a temp dir BEFORE the modules under test are
+ * required; nothing here touches ~/.claude/session-manager.
+ *
+ * Run: timeout 120 npx vitest run src/main/lib/__tests__/schedulerPaths.test.cjs
+ */
+
+'use strict';
+
+import { test, expect, beforeAll, afterAll } from 'vitest';
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const REPO = path.resolve(__dirname, '..', '..', '..', '..');
+// Every module the PRD routes through the resolver — a half-redirect in any of
+// them fails the source scan below.
+const ROUTED_MODULES = [
+  'src/main/scheduler.cjs',
+  'src/main/queueOps.cjs',
+  'src/main/lib/queueStore.cjs',
+  'src/main/lib/sessionSlots.cjs',
+  'src/main/lib/localAdminHttp.cjs',
+  'src/main/lib/watchdogHelpers.cjs',
+  'src/main/health.cjs',
+  'scripts/scheduler-watchdog.cjs',
+  'src/main/lib/auditLog.cjs',
+  'src/main/lib/historyRollup.cjs',
+  'src/main/lib/queueHistory.cjs',
+  'src/main/lib/instanceLock.cjs',
+  'src/main/lib/procName.cjs',
+  'src/main/heapSnapshot.cjs',
+  'scripts/scheduler-mcp-server.cjs',
+  'scripts/replay-verdicts.cjs',
+  'scripts/audit-ops-hygiene.cjs',
+];
+
+const ENV_KEYS = ['SM_SCHEDULER_HOME', 'SM_SCHEDULER_LOG_CWD', 'SM_ADMIN_TOKEN_PATH', 'SM_DEV', 'SM_E2E'];
+const savedEnv = {};
+let tmpHome;
+let sp;
+
+beforeAll(() => {
+  for (const k of ENV_KEYS) savedEnv[k] = process.env[k];
+  for (const k of ['SM_SCHEDULER_LOG_CWD', 'SM_ADMIN_TOKEN_PATH', 'SM_DEV', 'SM_E2E']) delete process.env[k];
+  tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-scheduler-home-'));
+  process.env.SM_SCHEDULER_HOME = tmpHome;
+  sp = require('../schedulerPaths.cjs');
+});
+
+afterAll(() => {
+  for (const k of ENV_KEYS) {
+    if (savedEnv[k] === undefined) delete process.env[k]; else process.env[k] = savedEnv[k];
+  }
+  fs.rmSync(tmpHome, { recursive: true, force: true });
+});
+
+test('every resolver lands under SM_SCHEDULER_HOME', () => {
+  expect(sp.schedulerHome()).toBe(tmpHome);
+  const plans = path.join(tmpHome, 'scheduled-plans');
+  expect(sp.scheduledPlansRoot()).toBe(plans);
+  expect(sp.runsDir()).toBe(path.join(plans, 'runs'));
+  expect(sp.prdsRoot()).toBe(path.join(plans, 'prds'));
+  expect(sp.legacyQueuePath()).toBe(path.join(plans, 'queue.json'));
+  expect(sp.machineStatePath()).toBe(path.join(tmpHome, 'scheduler-machine.json'));
+  expect(sp.schedulerStatePath()).toBe(path.join(tmpHome, 'scheduler-state.json'));
+  expect(sp.heartbeatPath()).toBe(path.join(tmpHome, 'scheduler-heartbeat.log'));
+  expect(sp.sessionSlotsConfigPath()).toBe(path.join(tmpHome, 'session-slots-config.json'));
+  expect(sp.adminTokenPath()).toBe(path.join(tmpHome, 'admin-api.json'));
+  expect(sp.watchdogLogsDir()).toBe(path.join(tmpHome, 'logs'));
+});
+
+test('resolvers are lazy: changing the env changes the result without re-requiring', () => {
+  const other = path.join(tmpHome, 'other');
+  process.env.SM_SCHEDULER_HOME = other;
+  try {
+    expect(sp.runsDir()).toBe(path.join(other, 'scheduled-plans', 'runs'));
+  } finally {
+    process.env.SM_SCHEDULER_HOME = tmpHome;
+  }
+});
+
+test('default home is ~/.claude/session-manager', () => {
+  delete process.env.SM_SCHEDULER_HOME;
+  try {
+    expect(sp.schedulerHome()).toBe(path.join(os.homedir(), '.claude', 'session-manager'));
+  } finally {
+    process.env.SM_SCHEDULER_HOME = tmpHome;
+  }
+});
+
+test('adminTokenPath keeps the SM_ADMIN_TOKEN_PATH > SM_DEV > SM_E2E ladder', () => {
+  try {
+    process.env.SM_E2E = '1';
+    expect(sp.adminTokenPath()).toBe(path.join(tmpHome, 'admin-api.e2e.json'));
+    process.env.SM_DEV = '1';
+    expect(sp.adminTokenPath()).toBe(path.join(tmpHome, 'admin-api.dev.json'));
+    process.env.SM_ADMIN_TOKEN_PATH = path.join(os.tmpdir(), 'explicit-token.json');
+    expect(sp.adminTokenPath()).toBe(path.join(os.tmpdir(), 'explicit-token.json'));
+  } finally {
+    delete process.env.SM_E2E; delete process.env.SM_DEV; delete process.env.SM_ADMIN_TOKEN_PATH;
+  }
+});
+
+test('machineStateLogCwd is the literal ~/Projects/session-manager unless overridden (never process.cwd())', () => {
+  expect(sp.machineStateLogCwd()).toBe(path.join(os.homedir(), 'Projects', 'session-manager'));
+  process.env.SM_SCHEDULER_LOG_CWD = path.join(os.tmpdir(), 'log-cwd');
+  try {
+    expect(sp.machineStateLogCwd()).toBe(path.join(os.tmpdir(), 'log-cwd'));
+  } finally {
+    delete process.env.SM_SCHEDULER_LOG_CWD;
+  }
+});
+
+test('queueStore: paths and readMergedSync resolve under the override', () => {
+  const queueStore = require('../queueStore.cjs');
+  expect(queueStore.MACHINE_STATE_PATH).toBe(sp.machineStatePath());
+  expect(queueStore.LEGACY_QUEUE_PATH).toBe(sp.legacyQueuePath());
+  fs.writeFileSync(sp.machineStatePath(), JSON.stringify({ paused: null, lastRunAt: 4242 }));
+  const merged = queueStore.readMergedSync();
+  expect(merged.unreadable).toBeUndefined();
+  expect(merged.lastRunAt).toBe(4242);
+});
+
+test('sessionSlots: persisted cap is read from and written under the override', () => {
+  const slots = require('../sessionSlots.cjs');
+  slots.setCap(7);
+  const cfg = sp.sessionSlotsConfigPath();
+  expect(JSON.parse(fs.readFileSync(cfg, 'utf8')).cap).toBe(7);
+  expect(slots.totalSlots()).toBe(7);
+  slots.__resetForTests?.();
+});
+
+test('localAdminHttp: TOKEN_PATH / resolveTokenPath follow the resolver', () => {
+  const admin = require('../localAdminHttp.cjs');
+  expect(admin.TOKEN_PATH).toBe(path.join(tmpHome, 'admin-api.json'));
+  expect(admin.resolveTokenPath()).toBe(admin.TOKEN_PATH);
+});
+
+test('scheduler / queueOps / watchdogHelpers path exports follow the override', () => {
+  const scheduler = require('../../scheduler.cjs');
+  expect(scheduler.ROOT).toBe(sp.scheduledPlansRoot());
+  expect(scheduler.PRDS_DIR).toBe(sp.prdsRoot());
+  expect(scheduler.RUNS_DIR).toBe(sp.runsDir());
+  expect(scheduler.SCHEDULER_STATE_PATH).toBe(sp.schedulerStatePath());
+  const queueOps = require('../../queueOps.cjs');
+  expect(queueOps.PRDS_DIR).toBe(sp.prdsRoot());
+  expect(queueOps.PRDS_ARCHIVE_DIR).toBe(path.join(sp.scheduledPlansRoot(), 'prds-archived'));
+  const wd = require('../watchdogHelpers.cjs');
+  expect(wd.DEFAULT_HEARTBEAT_PATH).toBe(sp.heartbeatPath());
+  expect(wd.DEFAULT_LOCK_PATH).toBe(sp.historyRollupLockPath());
+  expect(wd.DEFAULT_STAMP_PATH).toBe(sp.historyRollupStampPath());
+  expect(wd.DEFAULT_RELAUNCH_STATE_PATH).toBe(sp.watchdogRelaunchStatePath());
+});
+
+test('auditLog, historyRollup, queueHistory, instanceLock, procName, heapSnapshot land under SM_SCHEDULER_HOME', () => {
+  const saved = {};
+  for (const k of ['SM_HISTORY_PATH_OVERRIDE', 'SM_SCHEDULER_LOCK_PATH']) { saved[k] = process.env[k]; delete process.env[k]; }
+  try {
+    const auditLog = require('../auditLog.cjs');
+    expect(auditLog.auditLogPath()).toBe(path.join(tmpHome, 'audit-log.jsonl'));
+    auditLog.appendAuditEvent('schedulerPaths_test', {});
+    expect(fs.existsSync(path.join(tmpHome, 'audit-log.jsonl'))).toBe(true);
+    expect(require('../historyRollup.cjs').historyRollupPath()).toBe(path.join(tmpHome, 'history-rollup.jsonl'));
+    expect(require('../queueHistory.cjs').historyPath()).toBe(path.join(tmpHome, 'scheduled-plans', 'history.jsonl'));
+    expect(require('../instanceLock.cjs').lockPath()).toBe(path.join(tmpHome, 'scheduler-owner.lock'));
+    expect(require('../procName.cjs').procnamesRoot()).toBe(path.join(tmpHome, 'procnames'));
+    expect(sp.heapSnapshotDir()).toBe(tmpHome);
+  } finally {
+    for (const k of Object.keys(saved)) { if (saved[k] === undefined) delete process.env[k]; else process.env[k] = saved[k]; }
+  }
+});
+
+test.each(ROUTED_MODULES)('%s derives no home-rooted path from os.homedir() itself', (rel) => {
+  const src = fs.readFileSync(path.join(REPO, rel), 'utf8');
+  const offenders = src.split('\n').filter((l) => {
+    const t = l.trim();
+    if (t.startsWith('*') || t.startsWith('//')) return false;
+    return /os\.homedir\(\).*(\.claude|session-manager|scheduled-plans)/.test(l)
+      || (/os\.homedir\(\)/.test(l) && /Projects/.test(l));
+  });
+  expect(offenders).toEqual([]);
+  expect(src).toMatch(/schedulerPaths\.cjs/);
+});
+
+test('assertNotLiveRoot throws under vitest for a path outside the override roots and os.tmpdir(), naming resolver + path', () => {
+  const live = path.join(path.parse(os.homedir()).root, 'definitely-not-tmp', 'live-root');
+  // os.tmpdir() may itself be "/", so only assert the throw when the path is really outside it.
+  const rel = path.relative(os.tmpdir(), live);
+  if (rel.startsWith('..') || path.isAbsolute(rel)) {
+    expect(() => sp.assertNotLiveRoot(live, 'someResolver')).toThrow(/someResolver.*live-root|live-root.*someResolver/s);
+  }
+  const ok = path.join(os.tmpdir(), 'fine');
+  expect(sp.assertNotLiveRoot(ok, 'someResolver')).toBe(ok);
+});
+
+test('an empty SM_SCHEDULER_HOME falls through to the real ~/.claude and the guard fires', () => {
+  const { spawnSync } = require('node:child_process');
+  const r = spawnSync(process.execPath, ['-e', "require('./src/main/lib/schedulerPaths.cjs').schedulerHome()"], {
+    cwd: REPO,
+    env: { ...process.env, SM_SCHEDULER_HOME: '', VITEST: '1', HOME: '/home/definitely-live-user' },
+    encoding: 'utf8',
+  });
+  expect(r.status).not.toBe(0);
+  expect(r.stderr).toMatch(/schedulerHome\(\) resolved to live root/);
+});
+
+// 2026-09-18 defaultCwd leak: the guard's allow-list is env-derived, so a live SM_SCHEDULER_HOME
+// (inherited from the app) or a mid-test HOME swap let a test write the LIVE machine file.
+// The passwd-home anchor must refuse the live root no matter what the env says.
+test('under VITEST the passwd-home live root is refused even when SM_SCHEDULER_HOME names it', async () => {
+  const liveHome = path.join(os.userInfo().homedir, '.claude', 'session-manager');
+  process.env.SM_SCHEDULER_HOME = liveHome;
+  try {
+    expect(() => sp.machineStatePath()).toThrow(/live root/);
+    // the path the leak wrote through: the machine-state read/write refuses instead of touching it
+    const queueStore = require('../queueStore.cjs');
+    expect(() => queueStore.MACHINE_STATE_PATH).toThrow(/live root/);
+    await expect(queueStore.writeSplit({ jobs: [], config: {} }, os.tmpdir())).rejects.toThrow(/live root/);
+  } finally {
+    process.env.SM_SCHEDULER_HOME = tmpHome;
+  }
+});

package/src/main/lib/__tests__/schedulerPathsWorktree.test.cjs

@@ -0,0 +1,94 @@
+/**
+ * schedulerPathsWorktree.test.cjs — SM_WORKTREE_ROOT moves the job + epic
+ * worktree roots (and isEphemeralCwd) as a unit; the real os.tmpdir() roots are
+ * never touched.
+ *
+ * Run: timeout 120 npx vitest run src/main/lib/__tests__/schedulerPathsWorktree.test.cjs
+ */
+
+'use strict';
+
+import { test, expect, beforeEach, afterEach } from 'vitest';
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+const gitWorktree = require('../gitWorktree.cjs');
+const schedulerPaths = require('../schedulerPaths.cjs');
+const { isEphemeralCwd } = require('../ephemeralCwd.cjs');
+
+let scratch;
+let override;
+let repo;
+let prevRoot;
+let prevDisable;
+
+function git(args, cwd) { return execFileSync('git', args, { cwd, encoding: 'utf8' }); }
+// Probe checkouts (keys starting wtroot-probe) found anywhere under a root. Other
+// suites in the same worker pool share the real root, so a whole-listing
+// comparison would be flaky; the probe key is unique to this file.
+function probesUnder(root) {
+  const found = [];
+  let hashes = [];
+  try { hashes = fs.readdirSync(root); } catch { return found; }
+  for (const h of hashes) {
+    try {
+      for (const k of fs.readdirSync(path.join(root, h))) if (k.startsWith('wtroot-probe')) found.push(`${h}/${k}`);
+    } catch { /* not a dir */ }
+  }
+  return found;
+}
+
+beforeEach(() => {
+  prevRoot = process.env.SM_WORKTREE_ROOT;
+  prevDisable = process.env.SM_JOB_WORKTREE_DISABLE;
+  delete process.env.SM_JOB_WORKTREE_DISABLE;
+  scratch = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-wtroot-test-'));
+  override = path.join(scratch, 'override');
+  repo = path.join(scratch, 'repo');
+  fs.mkdirSync(override, { recursive: true });
+  fs.mkdirSync(repo, { recursive: true });
+  git(['init', '-q'], repo);
+  git(['config', 'user.email', 't@example.com'], repo);
+  git(['config', 'user.name', 'T'], repo);
+  fs.writeFileSync(path.join(repo, 'README.md'), 'hi\n');
+  git(['add', '-A'], repo);
+  git(['commit', '-q', '-m', 'init'], repo);
+  process.env.SM_WORKTREE_ROOT = override;
+});
+
+afterEach(() => {
+  if (prevRoot === undefined) delete process.env.SM_WORKTREE_ROOT; else process.env.SM_WORKTREE_ROOT = prevRoot;
+  if (prevDisable === undefined) delete process.env.SM_JOB_WORKTREE_DISABLE; else process.env.SM_JOB_WORKTREE_DISABLE = prevDisable;
+  fs.rmSync(scratch, { recursive: true, force: true });
+});
+
+test('resolver and KIND_CONFIG roots follow SM_WORKTREE_ROOT together', () => {
+  expect(schedulerPaths.worktreeRoot('job')).toBe(path.join(override, 'session-manager-job-worktrees'));
+  expect(schedulerPaths.worktreeRoot('epic')).toBe(path.join(override, 'session-manager-epic-worktrees'));
+  expect(gitWorktree.KIND_CONFIG.job.root).toBe(schedulerPaths.worktreeRoot('job'));
+  expect(gitWorktree.KIND_CONFIG.epic.root).toBe(schedulerPaths.worktreeRoot('epic'));
+  delete process.env.SM_WORKTREE_ROOT;
+  expect(schedulerPaths.worktreeRoot('job')).toBe(path.join(os.tmpdir(), 'session-manager-job-worktrees'));
+});
+
+test('create / sweep / isEphemeralCwd operate under the override, never the real root', async () => {
+  const realJobRoot = path.join(os.tmpdir(), 'session-manager-job-worktrees');
+  expect(probesUnder(realJobRoot)).toEqual([]);
+
+  const res = await gitWorktree.createJobWorktree({ cwd: repo, slug: 'wtroot-probe' });
+  expect(res.ok).toBe(true);
+  expect(res.dir.startsWith(path.join(override, 'session-manager-job-worktrees') + path.sep)).toBe(true);
+  expect(isEphemeralCwd(res.dir)).toBe(true);
+
+  const sweep = await gitWorktree.sweepStaleWorktreeCheckouts('job', { staleAgeMs: 0, holders: new Set() });
+  expect(sweep.checkoutsRemoved).toBeGreaterThanOrEqual(1);
+  expect(fs.existsSync(res.dir)).toBe(false);
+
+  const again = await gitWorktree.createJobWorktree({ cwd: repo, slug: 'wtroot-probe-2' });
+  expect(again.ok).toBe(true);
+  await gitWorktree.cleanupJobWorktree({ cwd: repo, dir: again.dir, branch: again.branch });
+  expect(fs.existsSync(override)).toBe(true); // the guard never rmdir's the base
+
+  expect(probesUnder(realJobRoot)).toEqual([]);
+});