claude-code-session-manager 0.92.1 → 0.94.0

package/src/main/lib/promptSessionSchema.cjs

@@ -1,3 +1,4 @@
+// @ts-check
 /**
  * Canonical runtime schema for a PromptSession (Epic) record, mirroring the
  * TS `PromptSession` interface at src/renderer/state/promptSessions.ts:29-76
@@ -72,6 +73,9 @@ const PromptSessionSchema = z.object({
   openingPrompt: z.string().nullable().optional(),
   source: EpicSourceSchema.optional(),
   agentType: z.string().optional(),
+  // Per-Epic runtime overrides chosen on the New Session card; absent = the persona's own value.
+  model: z.string().optional(),
+  effort: z.string().optional(),
   // Absent on Epics minted before this field existed — those fall back to
   // rendering the flat `openingPrompt` as a single block (see
   // ChatTranscriptTurn.tsx's EpicIntakeCard).
@@ -93,6 +97,7 @@ const PromptSessionSchema = z.object({
  * doesn't match PromptSessionSchema. Callers that want fail-closed
  * enforcement before persisting a session object call this immediately
  * before their write.
+ * @param {unknown} session
  */
 function assertValidPromptSession(session) {
   const result = PromptSessionSchema.safeParse(session);

package/src/main/lib/promptSessionsCreateEpic.cjs

@@ -41,12 +41,14 @@ const { validatePath } = require('../config.cjs');
  * IPC (config:read-json/write-json, lib/activeIndexMerge.cjs's own merge) is
  * already required to pass through.
  */
-async function createEpicViaIpc(cwd, { goalText, tag, agentType, source, openingPrompt, sections } = {}) {
+async function createEpicViaIpc(cwd, { goalText, tag, agentType, model, effort, source, openingPrompt, sections } = {}) {
   validatePath(cwd);
   const { epicId } = await ensureEpic(cwd, {
     goalText,
     tag,
     agentType,
+    model,
+    effort,
     source,
     openingPrompt,
     sections,
@@ -62,8 +64,8 @@ function registerPromptSessionsCreateEpicHandlers() {
   const { schemas: s, validated: v } = require('../ipcSchemas.cjs');
   ipcMain.handle(
     'promptSessions:create-epic',
-    v(s.promptSessionsCreateEpic, ({ cwd, goalText, tag, agentType, source, openingPrompt, sections }) =>
-      createEpicViaIpc(cwd, { goalText, tag, agentType, source, openingPrompt, sections })),
+    v(s.promptSessionsCreateEpic, ({ cwd, goalText, tag, agentType, model, effort, source, openingPrompt, sections }) =>
+      createEpicViaIpc(cwd, { goalText, tag, agentType, model, effort, source, openingPrompt, sections })),
   );
 }
 

package/src/main/lib/rendererRecovery.cjs

@@ -0,0 +1,141 @@
+'use strict';
+
+// Bounded automatic recovery for a dead / hung / failed-to-load renderer.
+// Without it an OOM-killed renderer leaves a permanently white window while
+// scheduler jobs keep running headless with no UI to pause them.
+//
+// `createReloadPolicy` is the pure cap/timing unit (injected clock);
+// `attachRendererRecovery` wires it to one webContents (= one window).
+
+const MAX_RELOADS = 3;
+const WINDOW_MS = 10 * 60 * 1000;
+const UNRESPONSIVE_GRACE_MS = 30 * 1000;
+const LOAD_RETRY_DELAY_MS = 2000;
+const ERR_ABORTED = -3;
+
+/** Sliding-window cap: at most `max` reloads per `windowMs`. O(max) per call. */
+function createReloadPolicy({ now = Date.now, max = MAX_RELOADS, windowMs = WINDOW_MS } = {}) {
+  let stamps = [];
+  return {
+    /** Record a reload if the cap allows it. Returns true when allowed. */
+    tryReload() {
+      const t = now();
+      stamps = stamps.filter((s) => t - s < windowMs);
+      if (stamps.length >= max) return false;
+      stamps.push(t);
+      return true;
+    },
+    /** Would tryReload() succeed right now? Pure — consumes no slot. */
+    canReload() {
+      const t = now();
+      return stamps.filter((s) => t - s < windowMs).length < max;
+    },
+    /** Should a render-process-gone reason trigger recovery? */
+    shouldRecoverFromGone(reason) {
+      return reason !== 'clean-exit';
+    },
+    /** Should a did-fail-load trigger a retry? Main frame only, not ERR_ABORTED. */
+    shouldRetryLoad(errorCode, isMainFrame) {
+      return isMainFrame !== false && errorCode !== ERR_ABORTED;
+    },
+  };
+}
+
+function attachRendererRecovery(wc, {
+  logs,
+  policy = createReloadPolicy(),
+  setTimer = setTimeout,
+  clearTimer = clearTimeout,
+} = {}) {
+  let unresponsiveTimer = null;
+  let loadRetryTimer = null;
+  let capLogged = false;
+
+  const log = (level, message, meta) => {
+    try { logs?.writeLine({ scope: 'crash-diag', level, message, meta }); } catch { /* logging must never break recovery */ }
+  };
+  const alive = () => !wc.isDestroyed();
+
+  function logCapReached(reason) {
+    if (capLogged) return;
+    capLogged = true;
+    log('error', 'renderer auto-reload cap reached — giving up', { reason, max: MAX_RELOADS, windowMs: WINDOW_MS });
+  }
+
+  function reload(reason) {
+    if (!alive()) return;
+    if (!policy.tryReload()) {
+      logCapReached(reason);
+      return;
+    }
+    capLogged = false;
+    log('warn', 'renderer auto-reload', { reason });
+    try { wc.reload(); } catch (e) { log('error', 'renderer reload threw', { reason, error: e?.message }); }
+  }
+
+  // A hung main thread cannot commit a same-process reload, so kill the renderer
+  // and let the render-process-gone handler do the single cap-counted reload
+  // (in a new process). No slot is consumed here.
+  function recoverFromHang() {
+    if (!alive()) return;
+    if (!policy.canReload()) {
+      // A hung-but-visible window beats a dead white one.
+      logCapReached('unresponsive');
+      return;
+    }
+    try {
+      if (typeof wc.forcefullyCrashRenderer !== 'function') throw new Error('forcefullyCrashRenderer unavailable');
+      log('warn', 'renderer unresponsive — forcefully crashing for recovery');
+      wc.forcefullyCrashRenderer();
+    } catch (e) {
+      log('warn', 'forcefullyCrashRenderer failed — falling back to reload', { error: e?.message });
+      reload('unresponsive');
+    }
+  }
+
+  wc.on('render-process-gone', (_e, details) => {
+    const reason = details?.reason;
+    if (!policy.shouldRecoverFromGone(reason)) return;
+    reload(`render-process-gone:${reason}`);
+  });
+
+  wc.on('unresponsive', () => {
+    log('warn', 'renderer unresponsive');
+    if (unresponsiveTimer) return;
+    unresponsiveTimer = setTimer(() => {
+      unresponsiveTimer = null;
+      recoverFromHang();
+    }, UNRESPONSIVE_GRACE_MS);
+  });
+
+  wc.on('responsive', () => {
+    if (unresponsiveTimer) { clearTimer(unresponsiveTimer); unresponsiveTimer = null; }
+    log('info', 'renderer responsive again');
+  });
+
+  wc.on('did-fail-load', (_e, errorCode, errorDescription, _url, isMainFrame) => {
+    if (!policy.shouldRetryLoad(errorCode, isMainFrame)) return;
+    log('warn', 'main-frame did-fail-load', { errorCode, errorDescription });
+    if (loadRetryTimer) return;
+    loadRetryTimer = setTimer(() => {
+      loadRetryTimer = null;
+      reload(`did-fail-load:${errorCode}`);
+    }, LOAD_RETRY_DELAY_MS);
+  });
+
+  wc.once('destroyed', () => {
+    if (unresponsiveTimer) clearTimer(unresponsiveTimer);
+    if (loadRetryTimer) clearTimer(loadRetryTimer);
+    unresponsiveTimer = loadRetryTimer = null;
+  });
+}
+
+module.exports = {
+  createReloadPolicy,
+  attachRendererRecovery,
+  MAX_RELOADS,
+  WINDOW_MS,
+  UNRESPONSIVE_GRACE_MS,
+  LOAD_RETRY_DELAY_MS,
+  ERR_ABORTED,
+};

package/src/main/lib/scheduleJobSchema.cjs

@@ -1,3 +1,4 @@
+// @ts-check
 /**
  * Canonical runtime schema for a ScheduleJob record, mirroring the TS
  * `ScheduleJob` interface (`ScheduleJob` in src/preload/api.d.ts) field-for-field.
@@ -24,6 +25,7 @@
 
 const { z } = require('zod');
 
+/** @type {[string, ...string[]]} */
 const JOB_STATUSES = ['pending', 'running', 'investigating', 'completed', 'skipped', 'failed', 'needs_review', 'quarantined'];
 
 const ScheduleJobStatusSchema = z.enum(JOB_STATUSES);
@@ -138,6 +140,7 @@ const ScheduleJobSchema = z
 /**
  * Throws a clear, descriptive error (not a raw ZodError dump) when `job`
  * doesn't match ScheduleJobSchema. Mirrors assertValidPromptSession's shape.
+ * @param {unknown} job
  */
 function assertValidScheduleJob(job) {
   const result = ScheduleJobSchema.safeParse(job);

package/src/main/runVerify.cjs

@@ -898,7 +898,9 @@ async function verifyRun({
       scannedAt: new Date().toISOString(),
       ...(extras ?? {}),
     };
-    try { fs.writeFileSync(verdictsPath, JSON.stringify(record, null, 2)); } catch { /* best-effort */ }
+    // Atomic (tmp+rename) — scheduler.cjs reads this sidecar to decide completed-equivalence,
+    // so a torn write must never be observable. Lazy require keeps this module electron-free at load.
+    try { require('./config.cjs').writeJsonSync(verdictsPath, record); } catch { /* best-effort */ }
     return { verdict, reason, downgradeTo, ...(extras ?? {}) };
   }
 

package/src/main/scheduler/prdParser.cjs

@@ -126,6 +126,8 @@ async function parsePrdRaw(filePath) {
     // the decision (first-ever PRD in its Epic, or one with its own explicit
     // dependsOn).
     disposition: (fm.disposition === 'append' || fm.disposition === 'new-head') ? fm.disposition : null,
+    // Durable wave identity (createPrd-stamped); malformed values read as absent.
+    planId: (typeof fm.planId === 'string' && /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(fm.planId)) ? fm.planId : null,
     // Opt-in exclusive-lease flag (PRD 1107, quietMachineLease.cjs +
     // schedulerBatch.cjs's pickNextBatch). Only a literal `true` opts in —
     // matches prdFrontmatter.cjs's applyKey semantics for this field.