claude-code-session-manager 0.87.0 → 0.88.1

package/src/main/projectPages.cjs

@@ -1,27 +1,12 @@
 'use strict';
 
 /**
- * projectPages.cjs — read-only backend for Project Home's Project Pages
- * display (PRD 932). Reads what the `project-home-builder` Epic's own
- * session writes directly with its Write tool
- * (`session-manager-operations/project-pages/output/*.html` + manifest.json)
- * — this module never writes any CONTENT (the one exception, watchOutput()'s
- * `fs.mkdirSync` to ensure the output dir exists before attaching a watcher,
- * creates an empty directory only), matching the corrected "not an
- * OWNERS namespace" storage/ownership note in
- * session-manager-operations/architecture/project-pages-pipeline.md and
- * session-manager-operations/project-pages/README.md. Structure mirrors
- * projectBrief.cjs's `get()`: validatePath first, config.cjs read helpers,
- * one ipcMain.handle registered from index.cjs's registerXHandlers() pattern.
- *
- * Shipped default (PRD "project-home-hosted-html-spec"): when a project has
- * never generated its own output, `get()` no longer returns the bare
- * `{ output: null }` empty-state signal — it falls back to a build-time
- * default `home.html` shipped with the app (`templates/`), returned with
- * `isDefault: true` and `generatedAt: null` so the renderer can label
- * provenance. That default is read from a fixed app-relative path, never
- * written into any project's own `session-manager-operations/` tree — this
- * module stays read-only.
+ * projectPages.cjs — read-only backend for Project Home. The whole feature is
+ * ONE self-contained HTML file, `session-manager-operations/project-pages/
+ * home.html`, written by the `project_home_write` admin route
+ * (lib/projectHomeAdminRoutes.cjs). This module only reads it: get() plus a
+ * refcounted per-cwd watcher that pushes `project-pages:changed`. It never
+ * writes content (watch()'s mkdir creates an empty directory only).
  */
 
 const { ipcMain } = require('electron');
@@ -37,128 +22,49 @@ function attachWindow(window) {
   mainWindow = window;
 }
 
-function outputDir(cwd) {
-  return opsPath(cwd, 'project-pages', 'output');
+function homePath(cwd) {
+  return opsPath(cwd, 'project-pages', 'home.html');
 }
 
 /**
- * Resolve `cwd`'s output dir, treating the opsOwnership "ephemeral cwd"
- * throw (a tmpdir/linked-worktree project root — see opsOwnership.cjs's
- * resolveProjectRoot) as "no output dir available" rather than letting it
- * propagate. Both get() and the watcher below go through this so a builder
- * Epic running in a worktree can never crash either path.
+ * Resolve `cwd`'s home.html path, treating the opsOwnership "ephemeral cwd"
+ * throw (a tmpdir/linked-worktree project root) as "no path available"
+ * rather than letting it propagate.
  */
-function tryOutputDir(realCwd) {
+function tryHomePath(realCwd) {
   try {
-    return { dir: outputDir(realCwd), ephemeral: false };
+    return { file: homePath(realCwd), ephemeral: false };
   } catch (e) {
-    if (e.ephemeral) return { dir: null, ephemeral: true };
+    if (e.ephemeral) return { file: null, ephemeral: true };
     throw e;
   }
 }
 
-// Shipped build-time asset (see PRD "project-home-hosted-html-spec"'s
-// default-document requirement) — a fixed app-relative path with no
-// user-controlled segment, so it deliberately does NOT go through
-// config.cjs's validatePath (whose allowedRoots is the user's home dir and
-// would reject/mis-resolve a path under the app's own install directory,
-// e.g. when installed via npx/global npm outside $HOME). Read once and
-// cached in-process; this file never changes at runtime.
-const DEFAULT_HOME_PATH = path.join(__dirname, 'templates', 'project-pages-default-home.html');
-let cachedDefaultHomeHtml = null;
-function readDefaultHomeHtml() {
-  if (cachedDefaultHomeHtml === null) {
-    cachedDefaultHomeHtml = fs.readFileSync(DEFAULT_HOME_PATH, 'utf8');
-  }
-  return cachedDefaultHomeHtml;
-}
-function defaultOutput() {
-  return { home: readDefaultHomeHtml(), generatedAt: null, isDefault: true };
-}
-
-// The original 4 lenses stay required — their absence still means "no
-// Project Pages generated yet" (now the shipped-default fallback rather
-// than a bare null). 'brief' was added later (5th lens): a project that
-// generated its output BEFORE 'brief'
-// existed has home/marketing/feature/architecture.html but no brief.html, and
-// that must keep reading as "has output" rather than suddenly regressing to
-// the empty state for every pre-existing project. So brief.html is read
-// tolerantly — present, its text is returned; absent, the field is simply
-// omitted from the payload rather than failing the whole read.
-// Partial-output strategy (see this file's module doc + PRD
-// "project-home-generate-preflight-and-push"): the render route
-// (projectHomeAdminRoutes.cjs's doRender) writes every lens file
-// concurrently and writes manifest.json ONLY AFTER all of them have landed.
-// So manifest.json's existence is already an all-or-nothing commit signal —
-// gating get() on it (below) means a reader can never observe a lens file
-// that arrived without its siblings. No second partial-state representation
-// is needed; this file just relies on that write order.
-const REQUIRED_LENSES = ['home', 'marketing', 'feature', 'architecture'];
-const OPTIONAL_LENSES = ['brief'];
-const LENSES = [...REQUIRED_LENSES, ...OPTIONAL_LENSES];
-
+/** -> { html: string|null, mtimeMs: number|null } */
 async function get({ cwd }) {
   const realCwd = config.validatePath(cwd);
-  const { dir, ephemeral } = tryOutputDir(realCwd);
-  if (ephemeral) {
-    return { output: defaultOutput() };
-  }
-  const manifestResult = await config.readJson(path.join(dir, 'manifest.json'));
-  if (!manifestResult.exists || !manifestResult.data || manifestResult.parseError) {
-    return { output: defaultOutput() };
-  }
-
-  const htmlResults = await Promise.all(
-    LENSES.map((lens) => config.readText(path.join(dir, `${lens}.html`))),
-  );
-  const byLens = Object.fromEntries(LENSES.map((lens, i) => [lens, htmlResults[i]]));
-  if (REQUIRED_LENSES.some((lens) => !byLens[lens].exists)) {
-    return { output: defaultOutput() };
-  }
-
-  const generatedAt = typeof manifestResult.data.generatedAt === 'string' ? manifestResult.data.generatedAt : null;
-  if (!generatedAt) {
-    return { output: defaultOutput() };
-  }
-
-  const output = {
-    home: byLens.home.text,
-    marketing: byLens.marketing.text,
-    feature: byLens.feature.text,
-    architecture: byLens.architecture.text,
-    generatedAt,
-    isDefault: false,
-  };
-  if (byLens.brief.exists) {
-    output.brief = byLens.brief.text;
-  }
-
-  return { output };
+  const { file, ephemeral } = tryHomePath(realCwd);
+  if (ephemeral) return { html: null, mtimeMs: null };
+  const res = await config.readText(file);
+  if (!res.exists) return { html: null, mtimeMs: null };
+  return { html: res.text, mtimeMs: res.mtimeMs };
 }
 
-// ─── Push channel (PRD "project-home-generate-preflight-and-push") ────────
-//
-// project-pages:get above is a one-shot pull, fetched once at mount by
-// ProjectHome.tsx. That leaves a finished (or stuck) builder Epic invisible
-// until the next manual refresh/app restart. This section adds a per-cwd
-// chokidar watcher on the output dir (the same debounced-write library
-// config.cjs already uses for its generic file watcher) that recomputes
-// get() and pushes it to the renderer whenever the dir changes.
+// ─── Push channel ─────────────────────────────────────────────────────────
 //
-// Map<realCwd, { watcher, refCount }> — refcounted like config.cjs's own
-// watchers Map so more than one mounted component watching the same cwd
-// doesn't spawn a second chokidar instance, and doesn't get torn down by
-// the first component's unmount while a second is still watching.
+// project-pages:get is a one-shot pull; this adds a per-cwd chokidar watcher
+// on the project-pages dir that recomputes get() and pushes it to the
+// renderer when home.html is added/changed/removed. Map<realCwd, { watcher,
+// refCount }> — refcounted so several mounted components watching the same
+// cwd share one chokidar instance.
 const outputWatchers = new Map();
 
 /**
- * Watch `cwd`'s output dir. Resolves `{ ok: true }` once watching is actually
- * live (or already watching), or `{ ok: false, reason: 'ephemeral' |
- * 'invalid-cwd' }` when there is nothing safe to watch — callers must not
- * treat that as an error, just as "no live updates for this cwd" (e.g. a
- * worktree cwd). Async: waits for chokidar's own 'ready' before resolving so
- * a write landing immediately after the call is never missed in the window
- * before the underlying fs watch handle is actually registered.
+ * Watch `cwd`'s home.html. Resolves `{ ok: true }` once watching is live (or
+ * already watching), or `{ ok: false, reason: 'ephemeral' | 'invalid-cwd' }`
+ * when there is nothing safe to watch — not an error, just "no live updates
+ * for this cwd". Waits for chokidar's 'ready' so a write landing right after
+ * the call is never missed.
  */
 async function watchOutput(cwd) {
   let realCwd;
@@ -174,40 +80,32 @@ async function watchOutput(cwd) {
     return { ok: true };
   }
 
-  const { dir, ephemeral } = tryOutputDir(realCwd);
+  const { file, ephemeral } = tryHomePath(realCwd);
   if (ephemeral) {
     return { ok: false, reason: 'ephemeral' };
   }
-  // Ensure the (possibly not-yet-generated) output dir exists before
-  // chokidar attaches: watching a path 3 levels deep that doesn't exist yet
-  // does not reliably pick up files later written into it (verified — the
-  // watcher silently misses the first write without this). This creates an
-  // EMPTY directory only, no content, so it does not conflict with this
-  // module's read-only contract or the single-writer law (opsOwnership.cjs)
-  // — it bypasses config.cjs's writer-tracked write path deliberately,
-  // exactly like a project-home-builder Epic's own untracked Write-tool
-  // calls into this same folder (see opsOwnership.cjs's 'project-pages'
-  // entry).
+  // Watch the parent dir (chokidar silently misses the first write of a file
+  // in a not-yet-existing dir). mkdir creates an EMPTY directory only — no
+  // content, so the single-writer law (opsOwnership.cjs) is not involved.
+  const dir = path.dirname(file);
   fs.mkdirSync(dir, { recursive: true });
 
-  const push = async () => {
+  const push = async (changedPath) => {
+    if (changedPath && path.resolve(changedPath) !== path.resolve(file)) return; // only home.html
     let result;
     try {
       result = await get({ cwd: realCwd });
     } catch {
       return; // best-effort; the renderer keeps its last-known output
     }
-    sendIfAlive(mainWindow, 'project-pages:changed', { cwd: realCwd, output: result.output });
+    sendIfAlive(mainWindow, 'project-pages:changed', { cwd: realCwd, html: result.html, mtimeMs: result.mtimeMs });
   };
 
   const watcher = chokidar.watch(dir, {
     ignoreInitial: true,
     persistent: true,
-    // manifest.json is the LAST file doRender writes (see REQUIRED_LENSES's
-    // comment above) — but the burst of per-lens writes leading up to it
-    // still fires several fs events in quick succession. awaitWriteFinish
-    // (same 50ms/25ms shape config.cjs's generic watcher uses) collapses
-    // that burst into one push instead of flapping the UI once per file.
+    depth: 0,
+    // Same 50ms/25ms shape config.cjs's generic watcher uses.
     awaitWriteFinish: { stabilityThreshold: 50, pollInterval: 25 },
   });
   watcher.on('add', push);
@@ -264,8 +162,6 @@ module.exports = {
   watchOutput,
   unwatchOutput,
   closeAllOutputWatchers,
-  DEFAULT_HOME_PATH,
-  readDefaultHomeHtml,
   // Test-only introspection of the refcounted watcher map.
   _outputWatchers: outputWatchers,
 };

package/src/main/pty.cjs

@@ -17,6 +17,7 @@ const path = require('node:path');
 const os = require('node:os');
 const fs = require('node:fs');
 const { addAllowedRoot } = require('./config.cjs');
+const { aliasedShellBin } = require('./lib/smProcNames.cjs');
 const { cleanChildEnv, pathWithUserBins } = require('./lib/cleanEnv.cjs');
 const { checkInsideHome } = require('./lib/insideHome.cjs');
 const { sendIfAlive } = require('./lib/sendToRenderer.cjs');
@@ -187,7 +188,13 @@ class PtyManager {
     let proc;
     try {
       // Interactive login shell so aliases / nvm / PATH resolve correctly.
-      proc = pty.spawn(shell, ['-il'], {
+      // `sm-shell` comm (pn-03) via symlink — node-pty has no argv0 option.
+      // ONLY interactive terminal tabs get this alias. supervisor.cjs
+      // getChildBashCmdlines matches comm === 'bash' EXACTLY over a scheduler
+      // job's descendants; no shell in a job's process tree is ever spawned
+      // through here, so that detection is unaffected. Non-bash/zsh shells and
+      // any alias failure fall back to the real path.
+      proc = pty.spawn(aliasedShellBin(shell), ['-il'], {
         name: 'xterm-256color',
         cols,
         rows,

package/src/main/queueOps.cjs

@@ -32,18 +32,16 @@
 const fs = require('node:fs');
 const fsp = require('node:fs/promises');
 const path = require('node:path');
-const os = require('node:os');
 const { ipcMain } = require('electron');
 const { SCHEDULE_SLUG_RE: SLUG_RE, schemas } = require('./ipcSchemas.cjs');
 const logs = require('./logs.cjs');
 const config = require('./config.cjs');
 const { expandHome } = require('./lib/expandHome.cjs');
 const { HISTORY_RETENTION_MS } = require('./lib/schedulerConfig.cjs');
+const schedulerPaths = require('./lib/schedulerPaths.cjs');
 
-const ROOT = path.join(os.homedir(), '.claude', 'session-manager', 'scheduled-plans');
-const PRDS_DIR = path.join(ROOT, 'prds');
-const PRDS_ARCHIVE_DIR = path.join(ROOT, 'prds-archived');
-const RETAG_LOG = path.join(ROOT, 'retag-log.jsonl');
+// Lazy: resolved via lib/schedulerPaths.cjs at each use (SM_SCHEDULER_HOME).
+const prdsArchiveDir = () => path.join(schedulerPaths.scheduledPlansRoot(), 'prds-archived');
 
 // ────────────────────────────────────────────── lint rules
 
@@ -136,7 +134,7 @@ const { resolvePrdsDirs, resolvePrdWriteDir, listEpicPrdDirs } = require('./lib/
 // aggregates both so the linter/archive/retag operations still see every
 // PRD regardless of which dir it currently lives in.
 function candidatePrdsDirs() {
-  return [PRDS_DIR, ...resolvePrdsDirs()];
+  return [schedulerPaths.prdsRoot(), ...resolvePrdsDirs()];
 }
 
 /**
@@ -574,9 +572,9 @@ async function retagOne({ slug, parallelGroup, estimateMinutes }) {
 async function appendRetagLog(entries) {
   if (entries.length === 0) return;
   try {
-    await fsp.mkdir(ROOT, { recursive: true });
+    await fsp.mkdir(schedulerPaths.scheduledPlansRoot(), { recursive: true });
     const lines = entries.map((e) => JSON.stringify({ ts: new Date().toISOString(), ...e }) + '\n').join('');
-    await fsp.appendFile(RETAG_LOG, lines);
+    await fsp.appendFile(path.join(schedulerPaths.scheduledPlansRoot(), 'retag-log.jsonl'), lines);
   } catch (e) {
     logs.writeLine({ level: 'warn', scope: 'queueOps', message: 'retag log append failed', meta: { error: e?.message } });
   }
@@ -629,9 +627,11 @@ module.exports = {
   selectAutoArchivable,
   autoArchiveCompleted,
   retagMany,
-  PRDS_DIR,
-  PRDS_ARCHIVE_DIR,
   archiveDirForSource,
   candidatePrdsDirs,
   findPrdDir,
 };
+
+// Lazy path getters (SM_SCHEDULER_HOME resolved at read, never at require).
+Object.defineProperty(module.exports, 'PRDS_DIR', { get: schedulerPaths.prdsRoot, enumerable: true });
+Object.defineProperty(module.exports, 'PRDS_ARCHIVE_DIR', { get: prdsArchiveDir, enumerable: true });

package/src/main/runVerify.cjs

@@ -808,9 +808,30 @@ function allDeliverablesAlreadyTracked({ cwd, paths, execImpl = execFileSync, ti
  *                                            same slug landed, if any — supplied by the
  *                                            caller (scheduler.cjs). Used by the
  *                                            pass_no_commit_prior_run_verified exemption.
+ * @param {string|null} [params.jobLandedCommitThisRun] The commit SHA THIS run's own
+ *                                            guard cwd HEAD advanced to (spawnJob's
+ *                                            `headAtExit` when it differs from
+ *                                            `guardHeadBefore`), or the equivalent
+ *                                            already-persisted `job.landedCommit` when
+ *                                            re-verifying a stale needs_review row. This
+ *                                            is a HEAD delta observed for THIS job's own
+ *                                            dispatch — strictly stronger attribution than
+ *                                            `committedDuringRun`'s repo-wide window scan —
+ *                                            and, unlike the now-deleted `sm-job/<slug>`
+ *                                            branch tip, it survives `cleanupWorktree`.
+ *                                            Used by the ground-truth-outranks-heuristics
+ *                                            rule below. Default null for back-compat.
+ * @param {number|null} [params.exitCode]     The run's process exit code. The
+ *                                            ground-truth-outranks-heuristics rule only
+ *                                            ever applies when this is exactly 0 — default
+ *                                            null so callers that don't pass it keep
+ *                                            today's behavior byte-for-byte.
  * @returns {Promise<{verdict:string, reason:string, downgradeTo:string|null}>}
  */
-async function verifyRun({ runDir, prdPath, queueEntry, allJobs = [], committedDuringRun = false, allowPreSentinelHeal = false, ghExecImpl, priorLandedCommit = null }) {
+async function verifyRun({
+  runDir, prdPath, queueEntry, allJobs = [], committedDuringRun = false, allowPreSentinelHeal = false,
+  ghExecImpl, priorLandedCommit = null, jobLandedCommitThisRun = null, exitCode = null,
+}) {
   const { slug } = queueEntry;
   const logPath = path.join(runDir, `${slug}.log`);
   const verdictsPath = path.join(runDir, `${slug}.verdicts.json`);
@@ -865,9 +886,22 @@ async function verifyRun({ runDir, prdPath, queueEntry, allJobs = [], committedD
     // gitHead()/committedInWindow() both fail closed there. In that case
     // ONLY, fall back to the harness-emitted commit evidence in the
     // transcript, which git itself produced and the model cannot fabricate.
+    //
+    // jobLandedCommitThisRun (spawnJob's own guardHeadBefore/headAtExit delta,
+    // or the equivalent already-persisted job.landedCommit on a re-verify
+    // pass) is folded into the SAME commitEvidence signal used everywhere in
+    // this function — a HEAD delta observed for THIS job's own dispatch is at
+    // least as strong as the repo-wide committedDuringRun window scan, so
+    // every exemption below that already trusts commitEvidence (no_verdict_
+    // sentinel, pass_no_commit, the PASS+commitEvidence sentinel override)
+    // should trust this evidence too, not just the new ground-truth rule.
     const cwdIsGitRepo = isGitRepo(queueEntry?.cwd);
-    const commitEvidence = committedDuringRun || (!cwdIsGitRepo && transcriptCommitLanded);
-    const commitEvidenceSource = (!committedDuringRun && commitEvidence) ? 'transcript' : null;
+    const commitEvidence = committedDuringRun || Boolean(jobLandedCommitThisRun) || (!cwdIsGitRepo && transcriptCommitLanded);
+    let commitEvidenceSource = null;
+    if (!committedDuringRun) {
+      if (jobLandedCommitThisRun) commitEvidenceSource = 'jobLandedCommitThisRun';
+      else if (commitEvidence) commitEvidenceSource = 'transcript';
+    }
 
     // ── 3. HALT detection ─────────────────────────────────────────────────
     // Primary: check the final `{"type":"result"}` event's `result` text.
@@ -990,6 +1024,38 @@ async function verifyRun({ runDir, prdPath, queueEntry, allJobs = [], committedD
 
     // Scan for the SCHEDULER_VERDICT sentinel emitted by the finish protocol.
     const sentinel = scanSentinel(resultEvent, events);
+
+    // Ground truth outranks heuristics: an exit-0 run that landed a commit
+    // ATTRIBUTABLE TO THIS RUN (spawnJob's own guardHeadBefore/headAtExit
+    // delta, or the repo-wide committedDuringRun window scan) and never
+    // printed an explicit SCHEDULER_VERDICT: FAIL demotes every
+    // transcript_errors/verify_unavailable hit from `issues` to `annotations`
+    // — a tool error the agent already recovered from three calls later, or
+    // an environment probe, says nothing once the work is materially proven
+    // to have landed. Deliberately narrower than the sentinel-override below:
+    // it needs no PASS claim at all, only the ABSENCE of an explicit FAIL, so
+    // it also catches the majority no-sentinel-at-all park class that the
+    // PASS+commitEvidence override (further below) can never reach. Never
+    // demotes pass_no_commit/no_verdict_sentinel/abandoned_background_task —
+    // those are added below this point and are about the ABSENCE of a
+    // sentinel/commit, which this same evidence does not resolve.
+    // (Incident: 1218-fo-01 — a `git apply` "patch does not apply" tool error
+    // at event 179/209 was retried and succeeded 3 events later, the run
+    // landed commit d1edf15, and the row was parked needs_review anyway,
+    // spawning a $3.74 fix-plan investigation into work that needed no fix.)
+    const groundTruthOutranksHeuristics = exitCode === 0 && commitEvidence && sentinel !== 'fail';
+    if (groundTruthOutranksHeuristics) {
+      for (let k = issues.length - 1; k >= 0; k--) {
+        if (issues[k].verdict === 'transcript_errors' || issues[k].verdict === 'verify_unavailable') {
+          annotations.push({
+            verdict: issues[k].verdict,
+            reason: `${issues[k].reason} (demoted: exit 0 + commit landed this run outranks transcript heuristics)`,
+          });
+          issues.splice(k, 1);
+        }
+      }
+    }
+
     const sentinelFields = sentinel ? { sentinel } : {};
     const extras = (annotations.length || sentinel)
       ? { ...(annotations.length ? { annotations } : {}), ...sentinelFields }