claude-code-session-manager 0.87.0 → 0.88.1

package/src/main/lib/adoptedRunSupervisor.cjs

@@ -0,0 +1,136 @@
+'use strict';
+
+/**
+ * adoptedRunSupervisor.cjs — re-arms the budget watchdog, idle-tail kill and
+ * deadman for an executor the boot SPARED (scheduler.cjs stamps
+ * `adoptedAtBoot`), from the durable `<slug>.supervisor.json` record.
+ *
+ * executeJob attaches those three timers to the child it spawned; an adopted
+ * executor belongs to a dead app process, so nothing supervised it (and a
+ * quietMachine row held no lease). Here the same three conditions are polled
+ * against the record's own numbers (budgetMs / startedAt, idleKillMs vs the
+ * log mtime, maxDurationMs) by the app process that owns the row. The
+ * signal goes to the recorded process group only after the pid is proven to
+ * still be the recorded process (procIdentity, fail-closed). It never mints
+ * a slot token: the adopted row stays `untrackedRunning` in pickNextBatch.
+ *
+ * Plain Node, no electron — every effect is injected so it is unit-testable
+ * with fake timers and without scheduler.cjs.
+ */
+
+/**
+ * evaluateAdoptedRun(record, { now, logMtimeMs, defaultMaxDurationMs })
+ *   → { kind: 'deadman'|'budget'|'idle-tail', reason } | null
+ * Pure. Precedence deadman > budget > idle-tail (hardest kill first).
+ */
+function evaluateAdoptedRun(record, { now, logMtimeMs, defaultMaxDurationMs = 0 }) {
+  const started = Number.isFinite(record.startedAt) ? record.startedAt : null;
+  const elapsed = started === null ? null : now - started;
+  const deadmanMs = record.maxDurationMs > 0 ? record.maxDurationMs : defaultMaxDurationMs;
+  if (elapsed !== null && deadmanMs > 0 && elapsed >= deadmanMs) {
+    return { kind: 'deadman', reason: `deadman: ran ${Math.round(elapsed / 60_000)}m (>= ${Math.round(deadmanMs / 60_000)}m)` };
+  }
+  if (elapsed !== null && record.budgetMs > 0 && elapsed >= record.budgetMs) {
+    return {
+      kind: 'budget',
+      reason: `wall-clock budget exceeded: ran ${Math.round(elapsed / 60_000)}m against a ${Math.round(record.budgetMs / 60_000)}m budget (adopted after app restart)`,
+    };
+  }
+  if (record.idleKillMs > 0 && Number.isFinite(logMtimeMs) && now - logMtimeMs > record.idleKillMs) {
+    return { kind: 'idle-tail', reason: `idle-output: log mtime stalled ${Math.round((now - logMtimeMs) / 1000)}s (> ${Math.round(record.idleKillMs / 1000)}s)` };
+  }
+  return null;
+}
+
+/**
+ * superviseAdoptedRun(record, deps) → { cancel(), check() }
+ * One poll timer per adopted run; `check()` runs once immediately so a run
+ * already past its budget at boot is killed without waiting a full interval.
+ * deps: { logPath, now, statLogMtimeMs, pidAlive, identityOf, isDifferentProcess,
+ *   killGroup(pid, signal), stampKill(kind, reason) → Promise, log(msg),
+ *   checkIntervalMs, sigkillAfterMs, defaultMaxDurationMs }
+ */
+function superviseAdoptedRun(record, deps) {
+  const {
+    logPath, now = Date.now, statLogMtimeMs, pidAlive, identityOf, isDifferentProcess, killGroup,
+    stampKill, log = () => {}, checkIntervalMs, sigkillAfterMs, defaultMaxDurationMs = 0,
+  } = deps;
+  let done = false;
+  let timer = null;
+  let killTimer = null;
+
+  const isOurs = () => pidAlive(record.pid) && !isDifferentProcess(record.identity, identityOf(record.pid));
+  const cancel = () => {
+    done = true;
+    if (timer) clearInterval(timer);
+  };
+
+  async function check() {
+    if (done) return null;
+    if (!isOurs()) { cancel(); return 'gone'; } // exited (reaper finalizes) or pid recycled — never signal
+    const verdict = evaluateAdoptedRun(record, {
+      now: now(), logMtimeMs: statLogMtimeMs(logPath), defaultMaxDurationMs,
+    });
+    if (!verdict) return null;
+    cancel();
+    try { await stampKill(verdict.kind, verdict.reason); } catch (e) { log(`stampKill failed: ${e?.message ?? e}`); }
+    if (!isOurs()) return 'gone'; // exited while the stamp was in flight
+    const first = verdict.kind === 'deadman' ? 'SIGKILL' : 'SIGTERM';
+    log(`adopted-run ${verdict.kind} watchdog: ${verdict.reason} — ${first} process group`);
+    killGroup(record.pgid || record.pid, first, record.pid);
+    if (first === 'SIGTERM') {
+      killTimer = setTimeout(() => {
+        if (isOurs()) killGroup(record.pgid || record.pid, 'SIGKILL', record.pid);
+      }, sigkillAfterMs);
+      if (killTimer.unref) killTimer.unref();
+    }
+    return verdict.kind;
+  }
+
+  timer = setInterval(() => { check().catch((e) => log(`check failed: ${e?.message ?? e}`)); }, checkIntervalMs);
+  if (timer.unref) timer.unref();
+  return {
+    cancel() { cancel(); if (killTimer) clearTimeout(killTimer); },
+    check,
+  };
+}
+
+/**
+ * superviseAdoptedRuns(jobs, ctx) → Promise<string[]> (slugs newly armed)
+ * Arms a supervisor for every `running` row stamped adoptedAtBoot that has
+ * none in `ctx.registry` (Map key `slug|runId`), drops registry entries whose
+ * row is no longer that run, re-acquires the quietMachine lease and stamps
+ * supervisedAt. ctx: { registry, runDir(row), readRecord(runDir, slug),
+ *   lease: { acquire, holder }, markSupervised(row), makeDeps(row, record) }
+ * Complexity: O(jobs).
+ */
+async function superviseAdoptedRuns(jobs, ctx) {
+  const { registry, runDir, readRecord, lease, markSupervised, makeDeps } = ctx;
+  const live = new Set();
+  const armed = [];
+  for (const j of jobs) {
+    if (j.status !== 'running' || !j.adoptedAtBoot) continue;
+    const key = `${j.slug}|${j.runId ?? ''}`;
+    live.add(key);
+    if (registry.has(key)) continue;
+    const dir = runDir(j);
+    const record = dir ? readRecord(dir, j.slug) : null;
+    if (!record || !record.pid) continue; // no durable record → nothing to re-arm from
+    if (j.quietMachine === true && !lease.acquire(j.slug) && lease.holder() !== j.slug) {
+      console.warn(`[scheduler] adopted quietMachine run ${j.slug}: lease held by ${lease.holder()} — not re-acquired`);
+    }
+    const handle = superviseAdoptedRun(record, makeDeps(j, record));
+    registry.set(key, handle);
+    armed.push(j.slug);
+    await markSupervised(j);
+    handle.check().catch(() => {});
+  }
+  for (const [key, handle] of registry) {
+    if (live.has(key)) continue;
+    handle.cancel();
+    registry.delete(key);
+  }
+  return armed;
+}
+
+module.exports = { evaluateAdoptedRun, superviseAdoptedRun, superviseAdoptedRuns };

package/src/main/lib/agentModelResolve.cjs

@@ -27,6 +27,7 @@ const path = require('node:path');
 const os = require('node:os');
 const { splitFrontmatter } = require('./prdFrontmatter.cjs');
 const { readActiveIndex, resolvePersonaPaths } = require('./epicMint.cjs');
+const { PERSONA_NAME_RE } = require('../agentLibrary.cjs');
 const configMgr = require('../config.cjs');
 
 /** The hardcoded floor every branch of resolveEpicModel falls back to — --model must never be omitted (CLAUDE.md "Automation model pinning"). */
@@ -125,12 +126,42 @@ function readModelFromCandidatePaths(candidates, agentType, deps) {
  * — never throws.
  */
 function readOverlayAwarePersonaModel(agentType, deps = {}) {
-  if (!agentType) return null;
+  // Same guard agentLibrary.cjs's getPersonaBody applies before it joins
+  // `name` into a path: without it, a caller-supplied agentType like
+  // "../../other-project/CLAUDE" survives resolvePersonaPaths' plain
+  // path.join and validatePath's allowed-roots check (which only confirms
+  // the resolved path stays under the home dir / an opened project), letting
+  // any readable .md under those roots be read on this --model spawn path.
+  if (!agentType || !PERSONA_NAME_RE.test(agentType)) return null;
   const resolvePaths = deps.resolvePersonaPaths || resolvePersonaPaths;
   const { projectPath, globalPath } = resolvePaths(deps.cwd, agentType, deps);
   return readModelFromCandidatePaths([projectPath, globalPath], agentType, deps);
 }
 
+/**
+ * True when `personaPath` (an already-resolved persona file path, e.g. from
+ * agentLibrary.cjs's getPersonaBody) is the PROJECT overlay candidate rather
+ * than the global one — the same "which of resolvePersonaPaths' two
+ * candidates won" question readModelFromCandidatePaths above answers
+ * structurally by trying the project path first. Exported so a caller that
+ * already has a resolved persona path from a DIFFERENT reader (one that
+ * needs async I/O or richer provenance than this module's sync
+ * readOverlayAwarePersonaModel returns — e.g. effectiveModelInfo.cjs) can
+ * ask this module the overlay question instead of re-deriving its own
+ * resolvePersonaPaths-based comparison. Never throws; a resolution failure
+ * conservatively answers "not overlay" (assume global).
+ */
+function isProjectOverlayPersonaPath(cwd, agentType, personaPath, deps = {}) {
+  if (!personaPath) return false;
+  try {
+    const resolvePaths = deps.resolvePersonaPaths || resolvePersonaPaths;
+    const { projectPath } = resolvePaths(cwd, agentType, deps);
+    return Boolean(projectPath) && path.resolve(projectPath) === path.resolve(personaPath);
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Resolves the `--model` value for an Epic-backed session launch. Never
  * throws — any lookup failure (missing Epic, missing persona, unreadable
@@ -220,5 +251,6 @@ module.exports = {
   resolveEpicModel,
   findAgentTypeByClaudeSessionId,
   readOverlayAwarePersonaModel,
+  isProjectOverlayPersonaPath,
   resolvePrdPersonaForSpawn,
 };

package/src/main/lib/agentPersonaSchema.cjs

@@ -1,6 +1,6 @@
 /**
  * Canonical runtime schema for an Agent persona WRITE payload, mirroring the
- * TS `AgentPersonaSaveInput` interface at src/preload/api.d.ts:229-246
+ * TS `AgentPersonaSaveInput` interface in src/preload/api.d.ts
  * field-for-field.
  *
  * Modelled on promptSessionSchema.cjs / scheduleJobSchema.cjs's "zod schema
@@ -39,7 +39,7 @@ const ProjectEntrySchema = z.string().refine(
   `must be "${ALL_PROJECTS}" or an absolute path`,
 );
 
-// Mirrors AgentPersonaSaveInput (src/preload/api.d.ts:229-246). `tags` is the
+// Mirrors AgentPersonaSaveInput (src/preload/api.d.ts). `tags` is the
 // Epic-mission WorkType union, NOT a free-form string list — the same
 // concept as PromptSessionSchema's `tag` / scheduleRetagPrd's `tag`, just
 // plural here since a persona can be associated with more than one mission.

package/src/main/lib/auditLog.cjs

@@ -16,10 +16,9 @@
 'use strict';
 
 const fs = require('node:fs');
-const os = require('node:os');
 const path = require('node:path');
 
-const AUDIT_LOG_PATH = path.join(os.homedir(), '.claude', 'session-manager', 'audit-log.jsonl');
+const { auditLogPath } = require('./schedulerPaths.cjs');
 
 /**
  * Best-effort identity of the process making this call — there is no
@@ -50,11 +49,37 @@ function appendAuditEvent(kind, fields = {}) {
       ...fields,
       caller: callerContext(),
     };
-    fs.mkdirSync(path.dirname(AUDIT_LOG_PATH), { recursive: true });
-    fs.appendFileSync(AUDIT_LOG_PATH, `${JSON.stringify(record)}\n`);
+    const target = auditLogPath();
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    fs.appendFileSync(target, `${JSON.stringify(record)}\n`);
   } catch (e) {
     console.error('[auditLog] failed to append audit event', e?.message ?? String(e));
   }
 }
 
-module.exports = { appendAuditEvent, AUDIT_LOG_PATH };
+/**
+ * readTail(maxBytes, target?) → string[] — the complete JSONL lines within the
+ * last `maxBytes` of the log, oldest first. O(maxBytes), never O(file): the
+ * audit log is a never-rotated provenance record and grows without bound. A
+ * line cut by the window's start is dropped. Missing/unreadable file → [].
+ */
+function readTail(maxBytes, target = auditLogPath()) {
+  let fd;
+  try {
+    fd = fs.openSync(target, 'r');
+    const { size } = fs.fstatSync(fd);
+    const readSize = Math.min(Math.max(0, maxBytes), size);
+    if (readSize === 0) return [];
+    const buf = Buffer.alloc(readSize);
+    fs.readSync(fd, buf, 0, readSize, size - readSize);
+    const lines = buf.toString('utf8').split('\n');
+    if (readSize < size) lines.shift(); // first element is a partial line
+    return lines.filter(Boolean);
+  } catch {
+    return [];
+  } finally {
+    if (fd !== undefined) { try { fs.closeSync(fd); } catch { /* */ } }
+  }
+}
+
+module.exports = { appendAuditEvent, auditLogPath, readTail };

package/src/main/lib/buildIdentity.cjs

@@ -0,0 +1,113 @@
+'use strict';
+
+/**
+ * buildIdentity.cjs — answers "which code produced this run" for both a
+ * published npx install (no .git shipped) and a dev checkout / job worktree
+ * (a real .git, but never the source of truth once a build has been baked).
+ *
+ * Resolution order, memoized after first call:
+ *   1. src/main/build-info.json (written by scripts/write-build-info.cjs at
+ *      `prepack`/`prepublishOnly` time, from the PUBLISHING checkout) — the
+ *      only artifact that is honest in production, since the npx cache the
+ *      app actually runs from ships no .git directory at all.
+ *   2. `git rev-parse` against the package root, but ONLY when a .git
+ *      directory exists AT that exact root — never git's own upward walk.
+ *      Without this guard, a relocated/nested install whose npm cache
+ *      happens to sit under an ancestor .git would silently stamp a FOREIGN
+ *      sha (git -C only sets the starting point; it still searches upward
+ *      for the nearest .git by default). Checking existence at the package
+ *      root ourselves, and only then invoking git, means the first (and
+ *      only) .git git can find IS the one we already verified.
+ *   3. null.
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+const { resolveInstallChannel } = require('./machineProfile.cjs');
+
+// src/main/lib -> src/main -> src -> package root (repo root in dev, or the
+// npx-cached package dir in production).
+const PACKAGE_ROOT = path.resolve(__dirname, '..', '..', '..');
+
+function loadBuildInfoJson(packageRoot) {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(path.join(packageRoot, 'src', 'main', 'build-info.json'), 'utf8'));
+    return parsed && typeof parsed === 'object' ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+function resolvePackageVersion(packageRoot) {
+  try {
+    const pkg = JSON.parse(fs.readFileSync(path.join(packageRoot, 'package.json'), 'utf8'));
+    return typeof pkg.version === 'string' ? pkg.version : null;
+  } catch {
+    return null;
+  }
+}
+
+function resolveGitCodeSha(packageRoot) {
+  if (!fs.existsSync(path.join(packageRoot, '.git'))) return null;
+  try {
+    return execFileSync('git', ['-C', packageRoot, 'rev-parse', '--short', 'HEAD'], {
+      timeout: 5000,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+
+function computeBuildIdentity(packageRoot) {
+  const buildInfo = loadBuildInfoJson(packageRoot);
+  const version = (buildInfo && typeof buildInfo.version === 'string') ? buildInfo.version : resolvePackageVersion(packageRoot);
+  const codeSha = buildInfo
+    ? ((typeof buildInfo.gitShortSha === 'string') ? buildInfo.gitShortSha : null)
+    : resolveGitCodeSha(packageRoot);
+  const builtAt = (buildInfo && typeof buildInfo.builtAt === 'string') ? buildInfo.builtAt : null;
+  return {
+    version,
+    codeSha,
+    builtAt,
+    appPath: packageRoot,
+    installChannel: resolveInstallChannel({ appPath: packageRoot, devFlag: !!process.env.SM_DEV }),
+  };
+}
+
+// Keyed by resolved root: a real process only ever resolves ONE root (this
+// module's own package root), so in production/dev this behaves as a plain
+// singleton memo — the Map only grows past size 1 under test, where each
+// case injects a distinct fixture packageRoot.
+const identityCache = new Map();
+
+/**
+ * @param {object} [opts]
+ * @param {string|null} [opts.bootedAt] - the caller's OWN already-captured
+ *   process-boot timestamp (e.g. scheduler.cjs's SCHEDULER_BOOTED_AT). Never
+ *   re-captured here — a memoized resolver that stamped its own "now" would
+ *   drift from what SCHEDULER_BOOTED_AT was introduced to expose (PRD 812:
+ *   process staleness relative to on-disk source).
+ * @param {string} [opts.packageRoot] - test-only override; production/dev
+ *   callers never pass this, so it always resolves to this module's own
+ *   package root.
+ */
+function resolveBuildIdentity(opts = {}) {
+  const packageRoot = opts.packageRoot || PACKAGE_ROOT;
+  if (!identityCache.has(packageRoot)) identityCache.set(packageRoot, computeBuildIdentity(packageRoot));
+  return { ...identityCache.get(packageRoot), bootedAt: opts.bootedAt ?? null };
+}
+
+/**
+ * readInstalledBuildInfo() → the build-info.json currently ON DISK at this
+ * package root (fresh read, never the boot-time memo), or null. Compared with
+ * the running identity's codeSha to detect that an install/update already
+ * replaced the files under a live process.
+ */
+function readInstalledBuildInfo(packageRoot = PACKAGE_ROOT) {
+  return loadBuildInfoJson(packageRoot);
+}
+
+module.exports = { resolveBuildIdentity, readInstalledBuildInfo };

package/src/main/lib/classifyPromptTicket.cjs

@@ -16,7 +16,7 @@
  */
 
 const { spawn } = require('node:child_process');
-const { resolveClaudeBin } = require('./claudeBin.cjs');
+const { resolveClaudeBin, claudeSpawnTarget } = require('./claudeBin.cjs');
 const { cleanChildEnv, pathWithUserBins } = require('./cleanEnv.cjs');
 
 const CLASSIFY_TIMEOUT_MS = 30_000;
@@ -78,7 +78,8 @@ function classifyPromptTicket(text) {
 
     try {
       // stdin closed — `claude -p` otherwise blocks waiting for piped stdin.
-      child = spawnImpl(claudeBin, args, { env: childEnv, stdio: ['ignore', 'pipe', 'pipe'] });
+      const target = claudeSpawnTarget('aux', 'classify', claudeBin);
+      child = spawnImpl(target.command, args, { env: childEnv, stdio: ['ignore', 'pipe', 'pipe'], ...(target.argv0 ? { argv0: target.argv0 } : {}) });
     } catch {
       finish('inline');
       return;

package/src/main/lib/claudeBin.cjs

@@ -39,6 +39,40 @@ function resolveClaudeBin() {
   return cached;
 }
 
+// ---------- process naming ----------
+//
+// Every `claude` spawn goes through claudeSpawnTarget so GNOME System Monitor
+// shows a distinct comm per role (sm-claude-job / -chat / -aux) and a labelled
+// argv0. See lib/procName.cjs for the mechanics. Invariants:
+//  - SM_CLAUDE_BIN set → aliasing SKIPPED, raw value used verbatim (tests point
+//    it at self-locating stubs; it must stay ONE binary, no path splitting).
+//  - aliasBinFor fails open (returns realBin) → no argv0 is set either, so the
+//    fallback is byte-identical to the pre-naming spawn.
+//  - Every alias and argv0 label contains the word `claude`, which the four
+//    /\bclaude\b/ cmdline gates (killOrphanClaudePid, claudePidAlive,
+//    findLiveProcessForJob x2) depend on.
+const ROLE_ALIASES = { job: 'sm-claude-job', chat: 'sm-claude-chat', aux: 'sm-claude-aux' };
+
+/**
+ * @param {'job'|'chat'|'aux'} role
+ * @param {string} [detail] argv0 label detail (job slug / epic session id)
+ * @param {string} [realBin] defaults to resolveClaudeBin()
+ * @returns {{ command: string, argv0?: string }} spread `argv0` into spawn options
+ */
+function claudeSpawnTarget(role, detail, realBin = resolveClaudeBin()) {
+  if (process.env.SM_CLAUDE_BIN) return { command: realBin };
+  const alias = ROLE_ALIASES[role];
+  if (!alias) return { command: realBin };
+  try {
+    const { aliasBinFor, smArgv0 } = require('./procName.cjs');
+    const command = aliasBinFor(realBin, alias);
+    if (command === realBin) return { command: realBin };
+    return { command, argv0: smArgv0(role, detail) };
+  } catch {
+    return { command: realBin };
+  }
+}
+
 // ---------- version probe ----------
 //
 // `claude --version`, cached. The scheduler's launch circuit breaker
@@ -75,7 +109,8 @@ function probeClaudeVersion({ now = Date.now(), execFileImpl } = {}) {
       // it, and the binary must never be handed the caller's working tree —
       // a stub `claude` (tests point SM_CLAUDE_BIN at one) that writes
       // markers or commits into process.cwd() once did so in the real repo.
-      execFile(bin, ['--version'], { timeout: VERSION_PROBE_TIMEOUT_MS, windowsHide: true, cwd: os.tmpdir() }, (err, stdout) => {
+      const target = claudeSpawnTarget('aux', 'version', bin);
+      execFile(target.command, ['--version'], { timeout: VERSION_PROBE_TIMEOUT_MS, windowsHide: true, cwd: os.tmpdir(), ...(target.argv0 ? { argv0: target.argv0 } : {}) }, (err, stdout) => {
         if (err) return done(null);
         const m = /(\d+\.\d+\.\d+[^\s]*)/.exec(String(stdout || ''));
         done(m ? m[1] : (String(stdout || '').trim() || null));
@@ -92,4 +127,4 @@ function resetClaudeVersionCache() {
   versionCache = { at: 0, value: null, inflight: null };
 }
 
-module.exports = { resolveClaudeBin, probeClaudeVersion, resetClaudeVersionCache };
+module.exports = { resolveClaudeBin, claudeSpawnTarget, probeClaudeVersion, resetClaudeVersionCache };

package/src/main/lib/cleanEnv.cjs

@@ -35,8 +35,34 @@ function pathWithUserBins() {
   return base ? `${base}:${userBinDirs().join(':')}` : userBinDirs().join(':');
 }
 
+/**
+ * SM_PROC_ROLE attributes a child (and, by inheritance, every MCP server the
+ * `claude` child spawns — we cannot rename those) via /proc/<pid>/environ.
+ * Read by scripts/sm-ps.cjs. NOT SM_PROC_ROOT (procIdentity.cjs's /proc-root
+ * test override) — unrelated variable.
+ */
+const PROC_ROLE_ENV = 'SM_PROC_ROLE';
+
+/** Explicit `SM_PROC_ROLE` in `extra` wins; else inferred from the attribution
+ *  vars each spawn site already sets (job slug → job, tab id → shell, chat
+ *  session → chat); else `aux`. Inference keeps role stamping in ONE place. */
+function inferProcRole(extra) {
+  if (extra[PROC_ROLE_ENV]) return String(extra[PROC_ROLE_ENV]);
+  if (extra.SM_SCHEDULER_JOB_SLUG) return 'job';
+  if (extra.SESSION_MANAGER_TAB_ID) return 'shell';
+  if (extra.SM_CHAT_SESSION_ID) return 'chat';
+  return 'aux';
+}
+
+/** Stamp SM_PROC_ROLE onto a raw env object (for sites that deliberately do not
+ *  use cleanChildEnv's secret stripping, e.g. runClaudeP/docEdit). Returns a copy. */
+function withProcRole(env, role) {
+  return { ...env, [PROC_ROLE_ENV]: role };
+}
+
 function cleanChildEnv(extra = {}) {
   const env = { ...process.env, ...extra };
+  env[PROC_ROLE_ENV] = inferProcRole(extra);
   for (const k of Object.keys(env)) {
     if (
       k === 'CLAUDE_EFFORT' ||
@@ -52,4 +78,4 @@ function cleanChildEnv(extra = {}) {
   return env;
 }
 
-module.exports = { cleanChildEnv, userBinDirs, pathWithUserBins };
+module.exports = { cleanChildEnv, withProcRole, inferProcRole, PROC_ROLE_ENV, userBinDirs, pathWithUserBins };

package/src/main/lib/credentials.cjs

@@ -6,7 +6,7 @@ const path = require('node:path');
 const os = require('node:os');
 const { spawn, execFileSync } = require('node:child_process');
 const { cleanChildEnv, pathWithUserBins } = require('./cleanEnv.cjs');
-const { resolveClaudeBin } = require('./claudeBin.cjs');
+const { resolveClaudeBin, claudeSpawnTarget } = require('./claudeBin.cjs');
 
 const CREDS_PATH = path.join(os.homedir(), '.claude', '.credentials.json');
 
@@ -188,7 +188,9 @@ function tryCliFallback() {
     try {
       // Resolve the absolute binary + inject Homebrew/user bins so this works
       // even when Electron launched from Finder/Dock with a stripped PATH (mac).
-      child = spawn(resolveClaudeBin(), ['--version'], {
+      const target = claudeSpawnTarget('aux', 'credcheck');
+      child = spawn(target.command, ['--version'], {
+        ...(target.argv0 ? { argv0: target.argv0 } : {}),
         stdio: 'ignore',
         env: cleanChildEnv({ PATH: pathWithUserBins() }),
       });