claude-code-session-manager 0.92.1 → 0.94.0

package/src/main/chatRunner.cjs

@@ -53,8 +53,14 @@ const { classifyPromptTicket } = require('./lib/classifyPromptTicket.cjs');
 const sessionSlots = require('./lib/sessionSlots.cjs');
 const opsErrorLog = require('./lib/opsErrorLog.cjs');
 const agentModelResolve = require('./lib/agentModelResolve.cjs');
+const { resolveEpicEffort, effortArgs } = require('./lib/agentEffortResolve.cjs');
 const { planEpicSpawn } = require('./lib/epicSpawnPlan.cjs');
 const logs = require('./logs.cjs');
+const { createHeadTailBuffer } = require('./lib/headTailBuffer.cjs');
+
+// Caps on per-run stream buffers (a run can last hours).
+const STDERR_TAIL_MAX = 64 * 1024;
+const LINE_BUFFER_MAX = 8 * 1024 * 1024;
 
 // The only two CLI errors that mean "wrong session flag" (verified against the
 // real CLI). "in use" → the transcript exists, so resume; "no conversation" →
@@ -316,6 +322,13 @@ const waiting = []; // [{ tabId, sessionId, prompt, cwd, resume, silent, onSilen
 // Closes the microtask-wide window in which per-tab exclusivity would
 // otherwise not hold. See pump().
 const dispatching = new Set();
+// sessionIds with a live CLI child: added when pump() dispatches a run, dropped
+// in the same .finally() that frees the lane — i.e. only after executeRun has
+// settled from `close`/`error`/spawn failure. A cancelled child still exiting
+// therefore keeps holding it. Two `claude -p` against one sessionId die with
+// "Session ID … is already in use", so pump() refuses to start a second run
+// for a held sessionId (it waits in `waiting` like any other blocked run).
+const liveSessions = new Set();
 let activeCount = 0;
 
 // Indirection so tests can stub the spawn without launching claude.
@@ -331,6 +344,7 @@ function __setExecutor(fn) { executor = fn || executeRun; }
 function __resetQueueForTests() {
   inFlight.clear();
   dispatching.clear();
+  liveSessions.clear();
   waiting.length = 0;
   activeCount = 0;
   sessionSlots.__resetForTests();
@@ -379,6 +393,7 @@ function run(opts) {
   // visible in `inFlight` — the same window pump() guards against.
   const tabBusy = inFlight.has(opts.tabId)
     || dispatching.has(opts.tabId)
+    || liveSessions.has(opts.sessionId)
     || waiting.some((w) => w.tabId === opts.tabId);
   if (tabBusy && opts.silent) {
     // Silent probes stay best-effort and invisible: a probe that collides is
@@ -401,7 +416,8 @@ function pump() {
     // it in `inFlight` (which happens a microtask later) — without it, one
     // synchronous sweep of this loop could start two runs for the same tab and
     // race two --resume processes against a single sessionId.
-    const idx = waiting.findIndex((w) => !inFlight.has(w.tabId) && !dispatching.has(w.tabId));
+    const idx = waiting.findIndex((w) => !inFlight.has(w.tabId) && !dispatching.has(w.tabId)
+      && !liveSessions.has(w.sessionId));
     // Everything queued is blocked behind its own tab's live run; the settle()
     // of that run re-pumps.
     if (idx === -1) break;
@@ -414,6 +430,7 @@ function pump() {
     const [job] = waiting.splice(idx, 1);
     activeCount += 1;
     dispatching.add(job.tabId);
+    liveSessions.add(job.sessionId);
     Promise.resolve()
       .then(() => {
         const donePromise = executor(job);
@@ -424,6 +441,7 @@ function pump() {
       .catch(() => { /* executeRun never rejects; defensive */ })
       .finally(() => {
         dispatching.delete(job.tabId);
+        liveSessions.delete(job.sessionId);
         sessionSlots.release(slotToken);
         activeCount -= 1;
         pump();
@@ -477,6 +495,7 @@ function executeRun({ tabId, sessionId, prompt, cwd, resume, silent, onSilentRes
     // funnels through here so the exit path can emit a fallback only when the
     // run settled without one.
     let terminalSent = false;
+    let lineOverflowLogged = false;
     const emitTerminal = (channel, payload) => {
       if (terminalSent) return;
       terminalSent = true;
@@ -546,6 +565,9 @@ function executeRun({ tabId, sessionId, prompt, cwd, resume, silent, onSilentRes
     // Epic, no agentType, or the persona has no model/'inherit' — --model
     // must never be left unpinned (CLAUDE.md model-pinning rule).
     const model = agentModelResolve.resolveEpicModel({ cwd, claudeSessionId: sessionId });
+    // Persona `effort:` (same overlay-aware persona, agentEffortResolve.cjs);
+    // effortArgs() yields NO tokens for inherit/absent/dangling.
+    const effortFlags = effortArgs(resolveEpicEffort({ cwd, claudeSessionId: sessionId }).effort);
 
     // Main is authoritative about --resume vs --session-id AND the spawn cwd, and it decides
     // them TOGETHER (epicSpawnPlan.cjs): a transcript under an encoding the spawn cwd cannot see
@@ -579,6 +601,7 @@ function executeRun({ tabId, sessionId, prompt, cwd, resume, silent, onSilentRes
       const a = [
         '-p', fullPrompt,
         '--model', model,
+        ...effortFlags,
         '--dangerously-skip-permissions',
         '--output-format', 'stream-json',
         '--verbose',
@@ -695,7 +718,9 @@ function executeRun({ tabId, sessionId, prompt, cwd, resume, silent, onSilentRes
     // Per-attempt state — a retry starts from empty buffers.
     let lineBuffer = '';
     let finalAssistantText = '';
-    let stderrBuffer = '';
+    const stderrBuffer = createHeadTailBuffer(STDERR_TAIL_MAX);
+
+    const stderrText = () => stderrBuffer.matchText();
 
     const processLine = (line) => {
       if (!line) return;
@@ -787,10 +812,25 @@ function executeRun({ tabId, sessionId, prompt, cwd, resume, silent, onSilentRes
         processLine(lineBuffer.slice(0, nl).trim());
         lineBuffer = lineBuffer.slice(nl + 1);
       }
+      if (lineBuffer.length > LINE_BUFFER_MAX) {
+        // Un-terminated line past the cap: drop it rather than grow forever.
+        lineBuffer = '';
+        if (!lineOverflowLogged) {
+          lineOverflowLogged = true;
+          opsErrorLog.appendError({
+            cwd,
+            scope: 'chatRunner',
+            tabId,
+            tags: silent ? ['silent-probe'] : [],
+            message: `stdout line exceeded ${LINE_BUFFER_MAX} bytes without a newline; buffer dropped`,
+            meta: { sessionId, silent },
+          });
+        }
+      }
     });
 
     thisChild.stderr.on('data', (chunk) => {
-      stderrBuffer += chunk.toString('utf8');
+      stderrBuffer.append(chunk.toString('utf8'));
     });
 
     thisChild.on('error', (err) => {
@@ -819,10 +859,10 @@ function executeRun({ tabId, sessionId, prompt, cwd, resume, silent, onSilentRes
       // terminal latch stay at executeRun level, so this is still one turn.
       if (!terminalSent && !killed && code !== 0 && attemptNo === 1
           && finalAssistantText === '' && recentToolUses.length === 0
-          && !/rate.?limit/i.test(stderrBuffer)) {
+          && !/rate.?limit/i.test(stderrText())) {
         const swapTo = resumeFlag
-          ? (NO_CONVERSATION_RE.test(stderrBuffer) ? false : null)
-          : (SESSION_IN_USE_RE.test(stderrBuffer) ? true : null);
+          ? (NO_CONVERSATION_RE.test(stderrText()) ? false : null)
+          : (SESSION_IN_USE_RE.test(stderrText()) ? true : null);
         if (swapTo !== null) {
           if (!silent) {
             broadcast('chat:run:notice', {
@@ -851,7 +891,7 @@ function executeRun({ tabId, sessionId, prompt, cwd, resume, silent, onSilentRes
             sessionId,
             message: 'run cancelled',
           });
-        } else if (SESSION_IN_USE_RE.test(stderrBuffer) || NO_CONVERSATION_RE.test(stderrBuffer)) {
+        } else if (SESSION_IN_USE_RE.test(stderrText()) || NO_CONVERSATION_RE.test(stderrText())) {
           // A session-flag rejection that survived the one-shot swap (or was
           // not eligible for it). The raw stderr dump names neither the flag,
           // the cwd nor the transcript — a real report cost a full diagnostic
@@ -870,9 +910,8 @@ function executeRun({ tabId, sessionId, prompt, cwd, resume, silent, onSilentRes
               + 'the session-flag resolution logic lives in main, and a stale build resolves it with older rules.',
           });
         } else {
-          const errDetail = stderrBuffer.trim()
-            ? `: ${stderrBuffer.trim().slice(0, 300)}`
-            : '';
+          const preview = stderrBuffer.preview();
+          const errDetail = preview ? `: ${preview}` : '';
           emitTerminal('chat:run:error', {
             tabId,
             sessionId,
@@ -991,6 +1030,7 @@ module.exports = {
   run,
   cancel,
   __resetQueueForTests,
+  __liveSessionCount: () => liveSessions.size,
   attachWindow,
   registerChatHandlers,
   parseStopSignal,

package/src/main/git.cjs

@@ -23,6 +23,7 @@ const { spawn } = require('node:child_process');
 const path = require('node:path');
 const { schemas } = require('./ipcSchemas.cjs');
 const { validatePath } = require('./config.cjs');
+const { LRUCache } = require('./lib/lruCache.cjs');
 
 const GIT_TIMEOUT_MS = 5_000;
 const CACHE_TTL_MS = 5_000;
@@ -30,8 +31,11 @@ const MAX_BUFFER = 10 * 1024 * 1024; // 10 MiB — same cap Unleashed uses
 
 // Per-cwd in-memory caches. Keyed by the realpath-validated cwd so symlinks
 // to the same repo dedupe. Each entry: { value, expiresAt }.
-const statusCache = new Map();
-const fileStatusCache = new Map();
+// Bounded LRU: worktree cwds are unique per Epic/job, so an unbounded Map grew
+// for the app's lifetime and pinned every files[] array.
+const CACHE_MAX_CWDS = 16;
+const statusCache = new LRUCache(CACHE_MAX_CWDS);
+const fileStatusCache = new LRUCache(CACHE_MAX_CWDS);
 
 /**
  * Run `git <args>` in cwd with a hard 5s SIGKILL ceiling. Resolves
@@ -241,6 +245,7 @@ async function getStatus(cwd) {
   const now = Date.now();
   const cached = statusCache.get(realCwd);
   if (cached && cached.expiresAt > now) return cached.value;
+  if (cached) statusCache.delete(realCwd);
 
   // Single porcelain call gets us branch + ahead/behind + files in one shot.
   const result = await runGit(
@@ -281,6 +286,7 @@ async function getFileStatus(cwd) {
   const now = Date.now();
   const cached = fileStatusCache.get(realCwd);
   if (cached && cached.expiresAt > now) return cached.value;
+  if (cached) fileStatusCache.delete(realCwd);
 
   const result = await runGit(
     ['status', '--porcelain=v1', '-u', '-z'],
@@ -330,4 +336,5 @@ module.exports = {
   parsePorcelain,
   mapStatus,
   clearCache,
+  _caches: { statusCache, fileStatusCache, CACHE_MAX_CWDS },
 };

package/src/main/historyAggregator.cjs

@@ -49,25 +49,8 @@ function resolvePricingKey(modelId) {
 }
 
 // ── LRU cache ─────────────────────────────────────────────────────────────────
-// Backed by an insertion-order Map: delete+re-insert on access = O(1) LRU.
-class LRUCache {
-  constructor(max) {
-    this._max = max;
-    this._m = new Map();
-  }
-  get(k) {
-    if (!this._m.has(k)) return undefined;
-    const v = this._m.get(k);
-    this._m.delete(k);
-    this._m.set(k, v);
-    return v;
-  }
-  set(k, v) {
-    this._m.delete(k);
-    this._m.set(k, v);
-    if (this._m.size > this._max) this._m.delete(this._m.keys().next().value);
-  }
-}
+// Shared implementation: lib/lruCache.cjs (re-exported below for existing callers).
+const { LRUCache } = require('./lib/lruCache.cjs');
 
 /**
  * Cache for parseJSONL results.

package/src/main/index.cjs

@@ -43,7 +43,9 @@ const epicWorktreeMerge = require('./lib/epicWorktreeMerge.cjs');
 const epicWorktreeProjectConfig = require('./lib/epicWorktreeProjectConfig.cjs');
 const agentLibrary = require('./agentLibrary.cjs');
 const agentModelResolve = require('./lib/agentModelResolve.cjs');
+const agentEffortResolve = require('./lib/agentEffortResolve.cjs');
 const { resolveEffectiveModelInfo } = require('./lib/effectiveModelInfo.cjs');
+const { resolveModelCatalog } = require('./lib/modelCatalog.cjs');
 const { checkDelegationReadiness, ensureGuardsInstalled, installPrdWriteGuard, installDestructiveGitGuard, installInlineImplementationGuard, installSelfScheduleGuard } = require('./lib/delegationReadiness.cjs');
 const { resolveProjectContext } = require('./lib/projectRootResolve.cjs');
 const upgradeDrain = require('./lib/upgradeDrain.cjs');
@@ -80,6 +82,7 @@ const { registerHistoryAggregatorHandlers, finalizeClosedDays, refreshIntradayTo
 const runLogRetention = require('./lib/runLogRetention.cjs');
 const { registerHistoryDashboardHandlers } = require('./historyDashboard.cjs');
 const { tryAcquireLock, releaseLock, DEFAULT_LOCK_PATH } = require('./lib/watchdogHelpers.cjs');
+const { createIntradayRefresh } = require('./lib/intradayRefresh.cjs');
 const schedulerConfig = require('./lib/schedulerConfig.cjs');
 const memoryTool = require('./memoryTool.cjs');
 const { registerMemoryAggregateIpc } = require('./memoryAggregate.cjs');
@@ -202,14 +205,9 @@ const REBOOT_LOG = path.join(os.homedir(), '.claude', 'session-manager-reboot.lo
 // finalize pass never interleave writes to the rollup file. A contended lock
 // just means this tick is skipped — the next timer tick (or the next boot)
 // retries, so skipping is always safe.
-function runIntradayRefresh() {
-  if (!tryAcquireLock(DEFAULT_LOCK_PATH)) return;
-  refreshIntradayToday()
-    .catch((e) => {
-      logs.writeLine({ scope: 'history-rollup', level: 'error', message: 'refreshIntradayToday failed', meta: { error: e?.message } });
-    })
-    .finally(() => releaseLock(DEFAULT_LOCK_PATH));
-}
+const runIntradayRefresh = createIntradayRefresh({
+  tryAcquireLock, releaseLock, lockPath: DEFAULT_LOCK_PATH, refresh: refreshIntradayToday, logs,
+});
 
 function logReboot(line) {
   try {
@@ -442,6 +440,9 @@ function createWindow() {
       });
   });
 
+  // Bounded auto-recovery for a crashed / hung / failed-to-load renderer.
+  require('./lib/rendererRecovery.cjs').attachRendererRecovery(mainWindow.webContents, { logs });
+
   // Native right-click menu — Copy / Paste / Select All everywhere. Roles
   // hook into Electron's built-in clipboard/selection plumbing, which xterm.js
   // (and Monaco, and Tiptap) all participate in via the standard DOM
@@ -565,6 +566,10 @@ ipcMain.handle('agents:get-persona-body', validated(schemas.agentsGetPersonaBody
 // is merely supposed to. Never throws (resolveEpicModel's own contract).
 ipcMain.handle('agents:resolve-epic-model', validated(schemas.agentsResolveEpicModel, (payload) =>
   agentModelResolve.resolveEpicModel(payload)));
+// Effort twin of the above (agentEffortResolve.cjs): Terminal appends
+// `--effort <level>` only when `effort` is non-null. Never throws.
+ipcMain.handle('agents:resolve-epic-effort', validated(schemas.agentsResolveEpicEffort, (payload) =>
+  agentEffortResolve.resolveEpicEffort(payload)));
 
 // "What will this Epic actually run as?" (PRD: effective-model-resolver) —
 // persona alias + evidence-based concrete model id + provenance, for a given
@@ -572,6 +577,10 @@ ipcMain.handle('agents:resolve-epic-model', validated(schemas.agentsResolveEpicM
 ipcMain.handle('agents:resolve-model-info', validated(schemas.agentsResolveModelInfo, (payload) =>
   resolveEffectiveModelInfo(payload)));
 
+// Live model/effort catalog (modelCatalog.cjs) — never throws; `force` bypasses its cache.
+ipcMain.handle('models:catalog', validated(schemas.modelsCatalog, (payload) =>
+  resolveModelCatalog(payload)));
+
 // "Can this project actually delegate?" probe (PRD: delegation-readiness).
 // Structured data over the preconditions for scheduler_create_prd being in an
 // agent's tool list at all — surfacing it in the UI is a sibling PRD.

package/src/main/ipcSchemas.cjs

@@ -1,3 +1,4 @@
+// @ts-check
 /**
  * Zod schemas for all IPC handler payloads. Applied at the boundary between
  * renderer and main — rejects malformed data before it reaches any business
@@ -152,20 +153,22 @@ const PROMPT_SESSION_ID_RE = /^(?!__proto__$|constructor$|prototype$)[A-Za-z0-9_
 // renderer only logs the failure). Dropping just the offending row matches how
 // the rest of this pipeline already fails: per-id (activeIndexMerge.cjs's
 // tombstone/resurrection handling), never per-batch.
+/** @param {unknown} raw */
 const dropInvalidSessions = (raw) => {
   if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return raw;
+  const rec = /** @type {Record<string, unknown>} */ (raw);
   const kept = Object.create(null);
-  for (const id of Object.keys(raw)) {
+  for (const id of Object.keys(rec)) {
     if (!PROMPT_SESSION_ID_RE.test(id)) {
       console.warn(`[ipc] merge-active-index: dropping session with invalid id ${JSON.stringify(id)}`);
       continue;
     }
-    const parsed = PromptSessionSchema.safeParse(raw[id]);
+    const parsed = PromptSessionSchema.safeParse(rec[id]);
     if (!parsed.success) {
       console.warn(`[ipc] merge-active-index: dropping malformed session ${id} — ${parsed.error.issues.map((i) => `${i.path.join('.')}: ${i.message}`).join('; ')}`);
       continue;
     }
-    kept[id] = raw[id];
+    kept[id] = rec[id];
   }
   return kept;
 };
@@ -198,6 +201,9 @@ const promptSessionsCreateEpic = z.object({
   goalText: z.string().min(1).max(20000),
   tag: EpicTagSchema.optional(),
   agentType: z.string().min(1).max(256).optional(),
+  // Per-Epic runtime overrides (New Session card) — absent = use the persona's own value.
+  model: z.string().min(1).max(256).optional(),
+  effort: z.string().min(1).max(64).optional(),
   source: EpicSourceSchema.optional(),
   // The full first-prompt body + its labeled sections (epicIntake.ts's
   // composeEpicIntake) — both optional, since not every mint caller (e.g. a
@@ -661,6 +667,12 @@ const agentsResolveModelInfo = z.object({
   agentType: z.string().min(1).max(200),
 }).strict();
 
+// ──────────────────────────────────────────── Live model/effort catalog (modelCatalog.cjs)
+const modelsCatalog = z.object({
+  cwd: z.string().optional(),
+  force: z.boolean().optional(),
+}).strict();
+
 // ──────────────────────────────────────────── Epic launch model (PRD: unify-epic-model-resolution)
 // Terminal's (EpicTerminalPane.tsx) call into agentModelResolve.cjs's
 // resolveEpicModel — the same launch-model authority chatRunner.cjs's Chat
@@ -669,6 +681,7 @@ const agentsResolveEpicModel = z.object({
   cwd: z.string().min(1).max(4096),
   claudeSessionId: z.string().min(1).max(200),
 }).strict();
+const agentsResolveEpicEffort = agentsResolveEpicModel;
 
 // ──────────────────────────────────────────── Project Pages (PRD 932)
 // Same validation split as projectBriefCwd above: real path validation is
@@ -1036,6 +1049,13 @@ const telemetrySetConfig = z.object({
  * call sites already rely on throw semantics for malformed input, so we keep
  * that behavior for backwards compatibility.
  */
+/**
+ * @template T
+ * @template R
+ * @param {{ parse: (payload: unknown) => T }} schema
+ * @param {(parsed: T) => R} handler
+ * @returns {(_event: unknown, payload: unknown) => R}
+ */
 function validated(schema, handler) {
   return (_event, payload) => {
     const parsed = schema.parse(payload);
@@ -1146,7 +1166,9 @@ module.exports = {
     agentsSavePersona,
     agentsGetPersonaBody,
     agentsResolveModelInfo,
+    modelsCatalog,
     agentsResolveEpicModel,
+    agentsResolveEpicEffort,
     delegationReadinessCwd,
     telemetrySetConfig,
   },

package/src/main/lib/__tests__/childWithLog.test.cjs

@@ -139,3 +139,183 @@ describe('childWithLog onExit leakedDescendants reporting (PRD 1110)', () => {
     15000,
   );
 });
+
+// PRD 1353 — async enumeration must never block/alter the kill cascade, and a
+// throwing watchdog must not break the wall-clock kill path.
+describe('childWithLog async enumeration + guarded watchdog (PRD 1353)', () => {
+  const { _deps } = require('../childWithLog.cjs');
+  const realExecFile = _deps.execFile;
+  afterEach(() => { _deps.execFile = realExecFile; });
+
+  it.skipIf(process.platform !== 'linux')(
+    'enumeration failure omits the report, logs, and still kills the group',
+    async () => {
+      dir = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-child-enumfail-'));
+      const logPath = path.join(dir, 'job.log');
+      const pidFile = path.join(dir, 'grandchild.pid');
+      const { fd, safeLog, closeFd } = openLog(logPath);
+      _deps.execFile = (_c, _a, _o, cb) => { setImmediate(() => cb(new Error('ps boom'))); };
+
+      const exitInfo = await new Promise((resolve) => {
+        withChildAndLog({
+          fd, logPath, safeLog, closeFd,
+          spawn: {
+            command: 'sh',
+            args: ['-c', `sleep 30 & echo $! > ${pidFile}; exec sleep 0.2`],
+            options: { detached: true },
+          },
+          onExit: (info) => { info.safeLog('onExit-ran\n'); resolve(info); },
+        });
+      });
+      expect(exitInfo.leakedDescendants).toEqual([]);
+      for (let i = 0; i < 20 && !fs.existsSync(pidFile); i++) await new Promise((r) => setTimeout(r, 50));
+      const gc = Number(fs.readFileSync(pidFile, 'utf8').trim());
+      await new Promise((r) => setTimeout(r, 500)); // SIGTERM lands immediately, no grace wait
+      expect(() => process.kill(gc, 0)).toThrow();
+      expect(fs.readFileSync(logPath, 'utf8')).toContain('enumeration failed');
+    },
+    15000,
+  );
+
+  function runWatchdog(wd) {
+    dir = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-child-wd-'));
+    const logPath = path.join(dir, 'job.log');
+    const { fd, safeLog, closeFd } = openLog(logPath);
+    let handle;
+    const done = new Promise((resolve) => {
+      handle = withChildAndLog({
+        fd, logPath, safeLog, closeFd,
+        spawn: { command: 'sleep', args: ['5'], options: {} },
+        watchdogs: [{ label: 'w', intervalMs: 20, ...wd }],
+        onExit: resolve,
+      });
+    });
+    return { logPath, handle, done };
+  }
+
+  it('a throwing shouldFire does not stop a later tick firing the action', async () => {
+    let calls = 0;
+    let fired = 0;
+    const { handle, logPath, done } = runWatchdog({
+      shouldFire: () => { calls++; if (calls < 3) throw new Error('sf boom'); return true; },
+      action: (ctx) => { fired++; ctx.killedByWatchdog = 'w'; ctx.killTree('SIGTERM'); },
+    });
+    const info = await done;
+    expect(fired).toBe(1);
+    expect(info.killedByWatchdog).toBe('w');
+    expect(fs.readFileSync(logPath, 'utf8')).toContain('watchdog "w" threw: sf boom');
+    handle.cancel();
+  }, 10000);
+
+  it('a throwing action clears its interval and is logged', async () => {
+    let should = 0;
+    let acts = 0;
+    const { handle, logPath, done } = runWatchdog({
+      shouldFire: () => { should++; return true; },
+      action: () => { acts++; throw new Error('act boom'); },
+    });
+    await new Promise((r) => setTimeout(r, 200));
+    expect(acts).toBe(1);
+    expect(should).toBe(1);
+    expect(fs.readFileSync(logPath, 'utf8')).toContain('watchdog "w" threw: act boom');
+    handle.cancel();
+    await done;
+  }, 10000);
+});
+
+// PRD 1370 — enumerate BEFORE SIGTERM; no-enumeration paths stay synchronous.
+describe('childWithLog sweep ordering + sync paths (PRD 1370)', () => {
+  const { _deps } = require('../childWithLog.cjs');
+  const realExecFile = _deps.execFile;
+  const realKill = process.kill;
+  afterEach(() => { _deps.execFile = realExecFile; process.kill = realKill; });
+
+  function setup(name) {
+    dir = fs.mkdtempSync(path.join(os.tmpdir(), name));
+    const logPath = path.join(dir, 'job.log');
+    return { logPath, ...openLog(logPath) };
+  }
+
+  it.skipIf(process.platform !== 'linux').each([
+    ['successful', (cb) => cb(null, 'PID PGRP %CPU ELAPSED COMMAND\n')],
+    ['failing', (cb) => cb(new Error('ps boom'))],
+  ])('SIGTERM waits for the %s enumeration', async (label, respond) => {
+    const { logPath, fd, safeLog, closeFd } = setup('sm-child-order-');
+    let psCb;
+    _deps.execFile = (_c, _a, _o, cb) => { psCb = cb; };
+    const groupKills = [];
+    process.kill = (pid, sig) => {
+      if (pid < -1 && sig === 'SIGTERM') { groupKills.push(pid); return true; }
+      return realKill.call(process, pid, sig);
+    };
+    let info;
+    const done = new Promise((resolve) => {
+      withChildAndLog({
+        fd, logPath, safeLog, closeFd,
+        spawn: { command: 'sh', args: ['-c', 'exit 0'], options: { detached: true } },
+        onExit: (i) => { info = i; resolve(); },
+      });
+    });
+    for (let i = 0; i < 100 && !psCb; i++) await new Promise((r) => setTimeout(r, 20));
+    expect(psCb).toBeTruthy();
+    await new Promise((r) => setTimeout(r, 100));
+    expect(groupKills).toEqual([]);
+    respond(psCb);
+    await done; // onExit runs only after the kill was issued
+    expect(groupKills.length).toBe(1);
+    expect(info.leakedDescendants).toEqual([]);
+    if (label === 'failing') expect(fs.readFileSync(logPath, 'utf8')).toContain('enumeration failed');
+  }, 15000);
+
+  it('runs onExit synchronously when the spawn throws', () => {
+    const { logPath, fd, safeLog, closeFd } = setup('sm-child-spawnfail-');
+    let ran = false;
+    const r = withChildAndLog({
+      fd, logPath, safeLog, closeFd,
+      spawn: { command: 'sh', args: [], options: { cwd: '/nonexistent\0bad', detached: true } },
+      onExit: (i) => { ran = i.spawnFailed === true; },
+    });
+    expect(r.child).toBeNull();
+    expect(ran).toBe(true);
+  });
+
+  it.skipIf(process.platform !== 'linux')('a throwing deferred onExit is logged and still closes the fd', async () => {
+    const { logPath, fd, safeLog, closeFd } = setup('sm-child-throw-');
+    _deps.execFile = (_c, _a, _o, cb) => { setImmediate(() => cb(null, 'h\n')); };
+    const unhandled = [];
+    const h = (e) => unhandled.push(e);
+    process.on('unhandledRejection', h);
+    let closed = false;
+    const wrapClose = () => { closed = true; closeFd(); };
+    await new Promise((resolve) => {
+      withChildAndLog({
+        fd, logPath, safeLog, closeFd: wrapClose,
+        spawn: { command: 'sh', args: ['-c', 'exit 0'], options: { detached: true } },
+        onExit: () => { setImmediate(resolve); throw new Error('exit boom'); },
+      });
+    });
+    await new Promise((r) => setTimeout(r, 50));
+    process.off('unhandledRejection', h);
+    expect(unhandled).toEqual([]);
+    expect(closed).toBe(true);
+    expect(fs.readFileSync(logPath, 'utf8')).toContain('onExit threw: exit boom');
+  }, 15000);
+
+  it('a throwing synchronous onExit is logged, closes the fd, and is re-thrown', async () => {
+    const { logPath, fd, safeLog, closeFd } = setup('sm-child-throw-sync-');
+    let closed = false;
+    const wrapClose = () => { closed = true; closeFd(); };
+    const thrown = await new Promise((resolve) => {
+      const onUncaught = (e) => { process.off('uncaughtException', onUncaught); resolve(e); };
+      process.on('uncaughtException', onUncaught);
+      withChildAndLog({
+        fd, logPath, safeLog, closeFd: wrapClose,
+        spawn: { command: 'sh', args: ['-c', 'exit 0'] },
+        onExit: () => { throw new Error('exit boom'); },
+      });
+    });
+    expect(thrown.message).toBe('exit boom');
+    expect(closed).toBe(true);
+    expect(fs.readFileSync(logPath, 'utf8')).toContain('onExit threw: exit boom');
+  }, 15000);
+});

package/src/main/lib/__tests__/delegationReadiness.test.cjs

@@ -1154,3 +1154,22 @@ test('ensureGuardsInstalled: records every auto-install attempt in the ops error
   expect(delegationLines.every((l) => l.level === 'info')).toBe(true);
   expect(delegationLines.every((l) => l.meta?.action === 'installed')).toBe(true);
 }, 15_000);
+
+test('ensureGuardsInstalled: an already-installed re-run writes no new ops error-log rows', async () => {
+  const cwd = await mkTmp('sm-ensure-guards-noop-');
+  const homeDir = await mkTmp('sm-ensure-guards-noop-home-');
+
+  await ensureGuardsInstalled(cwd, { homeDir });
+  const logFile = opsErrorLogTodayFile(cwd);
+  const before = fs.readFileSync(logFile, 'utf8');
+
+  clearGuardsInstalledCache();
+  const again = await ensureGuardsInstalled(cwd, { homeDir });
+  expect(Object.values(again.guards).every((g) => g.action === 'already-installed')).toBe(true);
+  expect(fs.readFileSync(logFile, 'utf8')).toBe(before);
+}, 15_000);
+
+test('delegationReadiness.cjs source contains no raw NUL byte', () => {
+  const src = fs.readFileSync(path.join(__dirname, '..', 'delegationReadiness.cjs'));
+  expect(src.includes(0)).toBe(false);
+});

package/src/main/lib/__tests__/effectiveModelInfo.test.cjs

@@ -18,7 +18,7 @@ const fs = require('node:fs');
 const path = require('node:path');
 const os = require('node:os');
 const { encodeCwd } = require('../encodeCwd.cjs');
-const { resolveEffectiveModelInfo, isConcreteModelId, computeEffortReachable } = require('../effectiveModelInfo.cjs');
+const { resolveEffectiveModelInfo, isConcreteModelId, computeEffortEnvReachable } = require('../effectiveModelInfo.cjs');
 // config.cjs's `allowedRoots` is a module-level singleton seeded from
 // os.homedir() at FIRST require — since this test's HOME changes every test
 // (fresh mkdtemp), a persona lookup (getPersonaBody -> validatePath) would
@@ -223,17 +223,22 @@ test('isConcreteModelId treats known CLI aliases as non-concrete and everything
   expect(isConcreteModelId('opus')).toBe(false);
   expect(isConcreteModelId('sonnet')).toBe(false);
   expect(isConcreteModelId('haiku')).toBe(false);
+  expect(isConcreteModelId('opus[1m]')).toBe(false);
+  expect(isConcreteModelId('best')).toBe(false);
+  expect(isConcreteModelId('opusplan')).toBe(false);
+  expect(isConcreteModelId('default')).toBe(false);
+  expect(isConcreteModelId('claude-opus-4-7[1m]')).toBe(true);
   expect(isConcreteModelId('fable')).toBe(false);
   expect(isConcreteModelId(null)).toBe(false);
   expect(isConcreteModelId('claude-opus-5')).toBe(true);
 });
 
-test('effortReachable is always false for an app-launched session — cleanChildEnv strips CLAUDE_EFFORT and CLAUDE_CODE_* before a child ever sees them', () => {
-  expect(computeEffortReachable({})).toBe(false);
+test('effortEnvReachable is always false for an app-launched session — cleanChildEnv strips CLAUDE_EFFORT and CLAUDE_CODE_* before a child ever sees them', () => {
+  expect(computeEffortEnvReachable({})).toBe(false);
 });
 
-test('resolveEffectiveModelInfo surfaces effortReachable alongside the model fields', async () => {
+test('resolveEffectiveModelInfo surfaces effortEnvReachable alongside the model fields', async () => {
   writeGlobalPersona('any', ['model: sonnet']);
   const info = await resolveEffectiveModelInfo({ cwd, agentType: 'any' });
-  expect(info.effortReachable).toBe(false);
+  expect(info.effortEnvReachable).toBe(false);
 });