claude-code-session-manager 0.93.0 → 0.95.0

package/src/main/lib/childWithLog.cjs

@@ -21,7 +21,7 @@
  *       shouldFire(ctx) returns true, then calls action(ctx).
  *     - action() may call ctx.addTimer(t) to register secondary timers
  *       (e.g. SIGTERM → SIGKILL cascades) so they are also cleared on exit.
- *   Calls onExit() synchronously inside the child 'exit'/'error' handler,
+ *   Calls onExit() inside the child 'exit'/'error' handler,
  *   before calling closeFd(). Caller may call ctx.safeLog() inside onExit.
  *
  * WatchdogContext:
@@ -51,7 +51,10 @@
  */
 
 const fs = require('node:fs');
-const { spawn, execFileSync } = require('node:child_process');
+const { spawn, execFile } = require('node:child_process');
+
+// Injectable for tests (enumeration-failure coverage).
+const deps = { execFile };
 
 // Grace period between the post-exit SIGTERM sweep and the follow-up SIGKILL
 // sweep of a detached child's process group. See sweepChildProcessGroup below.
@@ -144,44 +147,58 @@ function openLog(logPath) {
 // Read-only — never throws, never blocks the caller's exit path. Used to
 // report what sweepChildProcessGroup is about to kill, since the kill itself
 // is silent (ESRCH on the normal empty-group case).
+// Async: resolves to the survivors list, rejects on ps failure/timeout. O(P) in
+// the process table, off the main event loop.
 function enumerateProcessGroupSurvivors(pgid) {
-  if (process.platform !== 'linux') return [];
-  if (!pgid || pgid <= 1) return [];
-  try {
-    const out = execFileSync('ps', ['-eo', 'pid,pgrp,pcpu,etimes,comm'], { encoding: 'utf8', timeout: 2000 });
-    const survivors = [];
-    for (const line of out.split('\n').slice(1)) {
-      const m = line.trim().match(/^(\d+)\s+(\d+)\s+([\d.]+)\s+(\d+)\s+(.+)$/);
-      if (!m) continue;
-      const [, pidStr, pgrpStr, pcpuStr, etimesStr, comm] = m;
-      if (Number(pgrpStr) !== pgid) continue;
-      survivors.push({ pid: Number(pidStr), pcpu: Number(pcpuStr), etimes: Number(etimesStr), comm });
-    }
-    return survivors;
-  } catch {
-    return [];
-  }
+  if (process.platform !== 'linux') return Promise.resolve([]);
+  if (!pgid || pgid <= 1) return Promise.resolve([]);
+  return new Promise((resolve, reject) => {
+    try {
+      deps.execFile('ps', ['-eo', 'pid,pgrp,pcpu,etimes,comm'], { encoding: 'utf8', timeout: 2000 }, (err, out) => {
+        if (err) { reject(err); return; }
+        const survivors = [];
+        for (const line of String(out).split('\n').slice(1)) {
+          const m = line.trim().match(/^(\d+)\s+(\d+)\s+([\d.]+)\s+(\d+)\s+(.+)$/);
+          if (!m) continue;
+          const [, pidStr, pgrpStr, pcpuStr, etimesStr, comm] = m;
+          if (Number(pgrpStr) !== pgid) continue;
+          survivors.push({ pid: Number(pidStr), pcpu: Number(pcpuStr), etimes: Number(etimesStr), comm });
+        }
+        resolve(survivors);
+      });
+    } catch (e) { reject(e); }
+  });
 }
 
-// Returns the leaked descendants found (see enumerateProcessGroupSurvivors),
-// having enumerated them BEFORE issuing SIGTERM so the report reflects what
-// was actually swept, not what happened to still be running afterward.
-function sweepChildProcessGroup(child, detached) {
-  if (!detached) return [];
-  if (!child || !child.pid || child.pid <= 1) return [];
+// Returns null when there is nothing to enumerate/sweep (non-detached, missing or
+// invalid pid, our own group) so the caller can finish synchronously. Otherwise
+// returns a promise for the leaked descendants: enumeration runs FIRST so the
+// report reflects what the sweep is about to reap, and SIGTERM (+ the delayed
+// SIGKILL) is issued only once it has SETTLED — resolved or rejected. The 2 s ps
+// timeout bounds that wait. The promise never rejects: a failed enumeration
+// resolves [] after a safeLog line, and the group is still killed.
+function sweepChildProcessGroup(child, detached, safeLog) {
+  if (!detached) return null;
+  if (!child || !child.pid || child.pid <= 1) return null;
   // Defensive: never target the Session Manager process's own group.
-  if (child.pid === process.pid) return [];
-
-  const leaked = enumerateProcessGroupSurvivors(child.pid).filter((p) => p.pid !== child.pid);
+  if (child.pid === process.pid) return null;
 
-  try { process.kill(-child.pid, 'SIGTERM'); } catch { /* ESRCH: empty group, the normal case */ }
-
-  const t = setTimeout(() => {
-    try { process.kill(-child.pid, 'SIGKILL'); } catch { /* ESRCH: empty group, the normal case */ }
-  }, POST_EXIT_GROUP_SWEEP_GRACE_MS);
-  if (t.unref) t.unref();
+  const pid = child.pid;
+  const kill = () => {
+    try { process.kill(-pid, 'SIGTERM'); } catch { /* ESRCH: empty group, the normal case */ }
+    const t = setTimeout(() => {
+      try { process.kill(-pid, 'SIGKILL'); } catch { /* ESRCH: empty group, the normal case */ }
+    }, POST_EXIT_GROUP_SWEEP_GRACE_MS);
+    if (t.unref) t.unref();
+  };
 
-  return leaked;
+  return enumerateProcessGroupSurvivors(pid)
+    .then((all) => all.filter((p) => p.pid !== pid))
+    .catch((e) => {
+      safeLog(`[childWithLog] process-group enumeration failed; leak report omitted: ${e && e.message}\n`);
+      return [];
+    })
+    .then((leaked) => { kill(); return leaked; });
 }
 
 function withChildAndLog({ fd, logPath, safeLog, closeFd, spawn: spawnSpec, watchdogs = [], onExit }) {
@@ -220,9 +237,15 @@ function withChildAndLog({ fd, logPath, safeLog, closeFd, spawn: spawnSpec, watc
   // O(|watchdogs|) setup, O(1) per poll tick.
   const clearFns = watchdogs.map((wd) => {
     const t = setInterval(() => {
-      if (wd.shouldFire(ctx)) {
-        clearInterval(t);
-        wd.action(ctx);
+      try {
+        if (wd.shouldFire(ctx)) {
+          clearInterval(t);
+          wd.action(ctx);
+        }
+      } catch (e) {
+        // A throwing shouldFire is retried next tick; a throwing action has
+        // already cleared its interval. Never let it escape the timer.
+        safeLog(`[childWithLog] watchdog "${wd.label}" threw: ${e && e.message}\n`);
       }
     }, wd.intervalMs);
     if (t.unref) t.unref();
@@ -238,19 +261,37 @@ function withChildAndLog({ fd, logPath, safeLog, closeFd, spawn: spawnSpec, watc
   // calls onExit (caller may still safeLog inside), then closes the fd.
   const handleDone = (exitCode, signal, error, spawnFailed) => {
     clearAllTimers();
-    const leakedDescendants = sweepChildProcessGroup(ctx.child, !!spawnSpec.options?.detached);
-    if (onExit) {
-      onExit({
-        exitCode,
-        signal: signal ?? null,
-        killedByWatchdog: ctx.killedByWatchdog,
-        error,
-        spawnFailed: spawnFailed ?? false,
-        leakedDescendants,
-        safeLog,
-      });
-    }
-    closeFd();
+    const finish = (leakedDescendants) => {
+      try {
+        if (onExit) {
+          onExit({
+            exitCode,
+            signal: signal ?? null,
+            killedByWatchdog: ctx.killedByWatchdog,
+            error,
+            spawnFailed: spawnFailed ?? false,
+            leakedDescendants,
+            safeLog,
+          });
+        }
+      } catch (e) {
+        // Log while the fd is still open (closeFd below makes safeLog a no-op),
+        // then rethrow: sync callers see the throw as before PRD 1353; the
+        // deferred path contains it below.
+        const stack = e && e.stack ? String(e.stack).split('\n').slice(0, 3).join('\n') : '';
+        safeLog(`[childWithLog] onExit threw: ${e && e.message}${stack ? `\n${stack}` : ''}\n`);
+        throw e;
+      } finally {
+        closeFd();
+      }
+    };
+    const pending = sweepChildProcessGroup(ctx.child, !!spawnSpec.options?.detached, safeLog);
+    // Nothing to enumerate: stay synchronous. Otherwise onExit + closeFd wait
+    // (bounded by the 2 s ps timeout) for the leak report; a throwing onExit
+    // must not become an unhandled rejection.
+    if (!pending) { finish([]); return; }
+    // finish() already logged the throw and closed the fd; just contain it.
+    pending.then(finish).catch(() => {});
   };
 
   // Attempt synchronous spawn. On failure, call handleDone immediately so the
@@ -282,4 +323,4 @@ function withChildAndLog({ fd, logPath, safeLog, closeFd, spawn: spawnSpec, watc
   return { child, cancel };
 }
 
-module.exports = { openLog, withChildAndLog, POST_EXIT_GROUP_SWEEP_GRACE_MS };
+module.exports = { openLog, withChildAndLog, POST_EXIT_GROUP_SWEEP_GRACE_MS, _deps: deps };

package/src/main/lib/delegationReadiness.cjs

@@ -662,6 +662,8 @@ async function checkDelegationReadiness({ cwd, homeDir = os.homedir() }) {
  * failure must not prevent the guard install it's reporting on.
  */
 function logAutoInstallEvent({ cwd, guard, action, error }) {
+  // A no-op outcome is not an event worth an error-log row (24 rows/3 days of boot noise).
+  if (action === 'already-installed') return;
   try {
     const opsErrorLog = require('./opsErrorLog.cjs');
     opsErrorLog.appendError({
@@ -743,7 +745,7 @@ async function ensureGuardsInstalled(cwd, { homeDir = os.homedir() } = {}) {
     return { ok: false, root: null, guards: {}, error: err?.message ?? String(err) };
   }
 
-  const cacheKey = `${root}${homeDir}`;
+  const cacheKey = `${root}\0${homeDir}`;
   const cached = guardsInstalledCache.get(cacheKey);
   if (cached) return cached;
 

package/src/main/lib/epicSpawnPlan.cjs

@@ -28,6 +28,7 @@ const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
 const { encodeCwd } = require('./encodeCwd.cjs');
+const { projectRootOf } = require('./activeSessions.cjs');
 const { readActiveIndex } = require('./epicMint.cjs');
 const { resolveEpicSpawnCwd } = require('./epicSpawnCwd.cjs');
 const { resolveEpicTranscriptPath } = require('./epicTranscriptPath.cjs');
@@ -71,7 +72,7 @@ function findEpic(cwd, claudeSessionId, deps) {
 /**
  * @param {{ cwd: string, claudeSessionId: string, fallbackResume?: boolean, deps?: object }} opts
  * @returns {{ ok: true, execCwd: string, useResume: boolean, transcriptPath: string|null }
- *   | { ok: false, code: 'epic_closed'|'session_unreachable', message: string }}
+ *   | { ok: false, code: 'epic_closed'|'session_unreachable'|'spawn_cwd_missing', message: string }}
  */
 function planEpicSpawn({ cwd, claudeSessionId, fallbackResume = false, deps = {} } = {}) {
   const statSync = deps.statSync || fs.statSync;
@@ -107,14 +108,24 @@ function planEpicSpawn({ cwd, claudeSessionId, fallbackResume = false, deps = {}
       const home = path.join(projectsDir, encodeCwd(dir));
       return resolved.existingPaths.find((p) => path.dirname(p) === home) || null;
     };
-    let hit = findReachable(execCwd);
-    if (!hit && execCwd !== cwd) {
-      // The transcript may already live under the project encoding; spawning there writes back to
-      // the directory it occupies, so nothing forks.
-      hit = findReachable(cwd);
-      if (hit) execCwd = cwd;
+    // The transcript may already live under the project encoding; spawning there writes back to
+    // the directory it occupies, so nothing forks. `projectRootOf(cwd)` only contributes for a LIVE
+    // worktree caller cwd (it returns a vanished worktree path unchanged, so it adds nothing there);
+    // `epic.cwd`/`worktree.baseCwd` are not probed — the Epic is only found via the caller cwd, which
+    // is already a candidate, so they could never change an outcome.
+    let projectRoot = null;
+    try { projectRoot = projectRootOf(cwd); } catch { /* unresolvable → skip */ }
+    const candidates = [...new Set([execCwd, cwd, projectRoot].filter((d) => typeof d === 'string' && d))];
+    let reachableDir = null;
+    for (const dir of candidates) {
+      if (findReachable(dir)) { reachableDir = dir; break; }
     }
-    if (!hit) {
+    if (reachableDir) {
+      execCwd = reachableDir;
+      unreachable.delete(claudeSessionId);
+    } else {
+      // Name a directory that would actually work: an existing candidate is only worth naming if
+      // its encoding owns a transcript, which none did — so name the recorded worktree checkout.
       const missing = brokenDir || execCwd;
       const wt = epic?.worktree;
       const recovery = wt?.status === 'merged'
@@ -128,6 +139,14 @@ function planEpicSpawn({ cwd, claudeSessionId, fallbackResume = false, deps = {}
     }
   }
 
+  if (!isDir(execCwd, statSync)) {
+    return {
+      ok: false,
+      code: 'spawn_cwd_missing',
+      message: `Cannot spawn session ${claudeSessionId}: directory ${execCwd} does not exist. Pass the Epic's project cwd (the project root, not a removed worktree path) as the caller cwd.`,
+    };
+  }
+
   return { ok: true, execCwd, useResume, transcriptPath: resolved?.path ?? null };
 }
 

package/src/main/lib/epicTranscriptPath.cjs

@@ -140,12 +140,16 @@ function resolveEpicTranscriptPath({ cwd, claudeSessionId, deps = {} } = {}) {
   const file = (dir) => path.join(projectsDir, encodeCwd(dir), `${claudeSessionId}.jsonl`);
 
   const worktreeDirs = [];
+  // Project cwd recorded on the Epic — the caller's `cwd` may itself be the vanished worktree
+  // path, whose encoding is not where a merged/swept Epic's transcript lives.
+  const recordedCwds = [];
   try {
     const sessions = cachedSessions(cwd, deps, statSync);
     let inIndex = false;
     for (const s of Object.values(sessions)) {
       if (s && s.claudeSessionId === claudeSessionId) {
         inIndex = true;
+        if (typeof s.cwd === 'string' && s.cwd) recordedCwds.push(s.cwd);
         if (typeof s.worktree?.dir === 'string' && s.worktree.dir) worktreeDirs.push(s.worktree.dir);
       }
     }
@@ -161,7 +165,7 @@ function resolveEpicTranscriptPath({ cwd, claudeSessionId, deps = {} } = {}) {
     spawnCwd = cwd;
   }
 
-  const candidates = [...new Set([file(spawnCwd), ...worktreeDirs.map(file), file(cwd)])];
+  const candidates = [...new Set([file(spawnCwd), ...worktreeDirs.map(file), file(cwd), ...recordedCwds.map(file)])];
 
   const existing = [];
   for (const p of candidates) {

package/src/main/lib/headTailBuffer.cjs

@@ -0,0 +1,43 @@
+'use strict';
+
+// Bounded text accumulator: keeps the first HEAD chars (for error-detail
+// previews) plus a ring of the last `tailMax` chars (for regex matching).
+// Same trim-oldest idiom as pty.cjs `#appendReplay`. Memory is O(head + tailMax)
+// regardless of input size; append is O(tailMax) per chunk.
+
+const HEAD_PREVIEW_CHARS = 300;
+// One extra char lets preview() tell "exactly 300" from "longer than 300".
+const HEAD_KEEP = HEAD_PREVIEW_CHARS + 1;
+
+function createHeadTailBuffer(tailMax) {
+  let head = '';
+  let tail = '';
+  let truncated = false;
+  return {
+    append(str) {
+      if (!str) return;
+      if (head.length < HEAD_KEEP) {
+        // Skip leading whitespace so the head equals `text.trim().slice(0, …)`.
+        const s = head.length === 0 ? str.replace(/^\s+/, '') : str;
+        head += s.slice(0, HEAD_KEEP - head.length);
+      }
+      tail += str;
+      if (tail.length > tailMax) {
+        tail = tail.slice(tail.length - tailMax);
+        truncated = true;
+      }
+    },
+    /** Text to run regexes over: the tail, plus the head once the middle was dropped. */
+    matchText() {
+      return truncated ? `${head}\n${tail}` : tail;
+    },
+    /** Equivalent to `fullText.trim().slice(0, 300)`. */
+    preview() {
+      return head.length > HEAD_PREVIEW_CHARS ? head.slice(0, HEAD_PREVIEW_CHARS) : head.trimEnd();
+    },
+    /** Retained char count (head + tail). */
+    get size() { return head.length + tail.length; },
+  };
+}
+
+module.exports = { createHeadTailBuffer, HEAD_PREVIEW_CHARS };

package/src/main/lib/intradayRefresh.cjs

@@ -0,0 +1,33 @@
+/**
+ * intradayRefresh.cjs — lock-guarded runner for the in-app intraday rollup tick.
+ *
+ * Extracted from index.cjs so the failure paths are unit-testable. Guarantees:
+ * a lock-acquire throw is logged (never escapes the interval callback), and a
+ * synchronous OR asynchronous throw from `refresh` always releases the lock.
+ */
+'use strict';
+
+function createIntradayRefresh({ tryAcquireLock, releaseLock, lockPath, refresh, logs }) {
+  const logError = (message, e) =>
+    logs.writeLine({ scope: 'history-rollup', level: 'error', message, meta: { error: e?.message } });
+
+  return function runIntradayRefresh() {
+    let acquired;
+    try {
+      acquired = tryAcquireLock(lockPath);
+    } catch (e) {
+      logError('intraday lock acquire failed', e);
+      return;
+    }
+    if (!acquired) return;
+    // Promise.resolve().then would defer the call; use an async IIFE so a sync
+    // throw from refresh() lands in the same catch as a rejection.
+    (async () => { await refresh(); })()
+      .catch((e) => logError('refreshIntradayToday failed', e))
+      .finally(() => {
+        try { releaseLock(lockPath); } catch (e) { logError('intraday lock release failed', e); }
+      });
+  };
+}
+
+module.exports = { createIntradayRefresh };

package/src/main/lib/loopDelay.cjs

@@ -0,0 +1,44 @@
+'use strict';
+
+/**
+ * Event-loop delay probe for the main-process memory heartbeat. Wraps a
+ * perf_hooks IntervalHistogram (injectable for tests): enable() at init,
+ * snapshot() once per heartbeat returns the interval just ended in ms and
+ * reset()s, disable() rides the heartbeat teardown. No timer of its own.
+ */
+
+const { monitorEventLoopDelay } = require('node:perf_hooks');
+
+const LOOP_DELAY_RESOLUTION_MS = 20;
+// A single beat whose worst loop delay exceeds this is a visible main-thread stall.
+const LOOP_STALL_WARN_MS = 250;
+
+const NS_PER_MS = 1e6;
+const toMs = (ns) => Math.round(ns / NS_PER_MS * 10) / 10;
+
+function createLoopDelayMonitor(createHistogram = monitorEventLoopDelay) {
+  const h = createHistogram({ resolution: LOOP_DELAY_RESOLUTION_MS });
+  return {
+    enable() { h.enable(); },
+    disable() { h.disable(); },
+    /** Percentiles for the interval since the last snapshot; resets the histogram. */
+    snapshot() {
+      const out = {
+        loopDelayP50Ms: toMs(h.percentile(50)),
+        loopDelayP99Ms: toMs(h.percentile(99)),
+        loopDelayMaxMs: toMs(h.max),
+      };
+      h.reset();
+      return out;
+    },
+  };
+}
+
+/** Log level + message for a heartbeat given its loop-delay snapshot. */
+function stallVerdict(snap) {
+  return snap.loopDelayMaxMs > LOOP_STALL_WARN_MS
+    ? { level: 'warn', message: 'main loop stall' }
+    : null;
+}
+
+module.exports = { createLoopDelayMonitor, stallVerdict, LOOP_STALL_WARN_MS, LOOP_DELAY_RESOLUTION_MS };

package/src/main/lib/lruCache.cjs

@@ -0,0 +1,39 @@
+'use strict';
+
+/**
+ * Bounded LRU cache backed by an insertion-order Map: delete+re-insert on
+ * access = O(1) get/set/evict. Single implementation shared by
+ * historyAggregator.cjs and transcripts.cjs.
+ */
+class LRUCache {
+  constructor(max) {
+    this._max = max;
+    this._m = new Map();
+  }
+  get size() {
+    return this._m.size;
+  }
+  has(k) {
+    return this._m.has(k);
+  }
+  delete(k) {
+    return this._m.delete(k);
+  }
+  clear() {
+    this._m.clear();
+  }
+  get(k) {
+    if (!this._m.has(k)) return undefined;
+    const v = this._m.get(k);
+    this._m.delete(k);
+    this._m.set(k, v);
+    return v;
+  }
+  set(k, v) {
+    this._m.delete(k);
+    this._m.set(k, v);
+    if (this._m.size > this._max) this._m.delete(this._m.keys().next().value);
+  }
+}
+
+module.exports = { LRUCache };

package/src/main/lib/openExternalApp.cjs

@@ -41,6 +41,28 @@ function findCommand(name) {
   return null;
 }
 
+/**
+ * Spawn a detached opener and resolve once the OS reports the outcome.
+ * A missing/unexecutable binary emits an async 'error' (ENOENT/EACCES); without
+ * a listener that is an uncaught exception and the caller would see ok:true.
+ * Races 'spawn' against 'error' — never uses shell:true.
+ *
+ * @returns {Promise<{ ok: true, opener: string } | { ok: false, error: string }>}
+ */
+function spawnDetached(cmd, args, opener = cmd) {
+  return new Promise((resolve) => {
+    let child;
+    try {
+      child = spawn(cmd, args, { detached: true, stdio: 'ignore', env: cleanChildEnv() });
+    } catch (e) {
+      resolve({ ok: false, error: `failed to launch ${opener}: ${e?.message ?? e}` });
+      return;
+    }
+    child.once('error', (e) => resolve({ ok: false, error: `failed to launch ${opener}: ${e?.message ?? e}` }));
+    child.once('spawn', () => { child.unref(); resolve({ ok: true, opener }); });
+  });
+}
+
 /**
  * Open a project root directory in the user's editor.
  *
@@ -51,8 +73,7 @@ async function openInEditor({ cwd, editor }) {
   const candidates = (editor && editor !== 'auto') ? [editor] : editorCandidates();
   for (const cmd of candidates) {
     if (!findCommand(cmd)) continue;
-    spawn(cmd, [cwd], { detached: true, stdio: 'ignore', env: cleanChildEnv() }).unref();
-    return { ok: true, opener: cmd };
+    return spawnDetached(cmd, [cwd]);
   }
   return { ok: false, error: 'no editor found' };
 }
@@ -89,8 +110,7 @@ async function openFileInEditor({ path: abs, line, col, editor }) {
     const supportsGoto = /^(code|cursor|subl)$/.test(cmd);
     const target = (supportsGoto && line) ? `${abs}:${line}${col ? `:${col}` : ''}` : abs;
     const args = supportsGoto ? ['-g', target] : [abs];
-    spawn(cmd, args, { detached: true, stdio: 'ignore', env: cleanChildEnv() }).unref();
-    return { ok: true, opener: cmd };
+    return spawnDetached(cmd, args);
   }
   return { ok: false, error: 'no editor found' };
 }
@@ -128,14 +148,12 @@ async function openInTerminal({ cwd }) {
       const args = t === 'gnome-terminal'
         ? ['--working-directory=' + cwd]
         : ['-e', `bash -c "cd '${cwd.replace(/'/g, "'\\''")}' && exec bash"`];
-      spawn(t, args, { detached: true, stdio: 'ignore', env: cleanChildEnv() }).unref();
-      return { ok: true, opener: t };
+      return spawnDetached(t, args);
     }
   } else if (process.platform === 'darwin') {
-    spawn('open', ['-a', 'Terminal', cwd], { detached: true, stdio: 'ignore', env: cleanChildEnv() }).unref();
-    return { ok: true, opener: 'Terminal.app' };
+    return spawnDetached('open', ['-a', 'Terminal', cwd], 'Terminal.app');
   }
   return { ok: false, error: 'no terminal found' };
 }
 
-module.exports = { findCommand, openInEditor, openFileInEditor, openInFinder, openInTerminal };
+module.exports = { spawnDetached, findCommand, openInEditor, openFileInEditor, openInFinder, openInTerminal };

package/src/main/lib/opsErrorLog.cjs

@@ -12,6 +12,7 @@
  */
 
 const fs = require('node:fs');
+const os = require('node:os');
 const path = require('node:path');
 const { assertOpsWrite } = require('./opsOwnership.cjs');
 const { isEphemeralCwd } = require('./ephemeralCwd.cjs');
@@ -125,6 +126,23 @@ function reportToTelemetry({ cwd, scope, level, tabId, epicId, tags, message })
   } catch { /* telemetry must never break the caller — this is the sole error funnel */ }
 }
 
+function realOrResolved(p) {
+  const abs = path.resolve(p);
+  try { return fs.realpathSync(abs); } catch { return abs; }
+}
+
+function isInside(child, parent) {
+  const rel = path.relative(parent, child);
+  return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));
+}
+
+/** True when `cwd` resolves inside os.tmpdir() or SM_SANDBOX_DIR. O(roots). */
+function isInsideTestScratch(cwd) {
+  const target = realOrResolved(cwd);
+  const roots = [os.tmpdir(), process.env.SM_SANDBOX_DIR].filter(Boolean);
+  return roots.some((r) => isInside(target, realOrResolved(r)));
+}
+
 /**
  * Append one structured error line, tagged for tracing/analysis.
  *
@@ -142,6 +160,10 @@ function reportToTelemetry({ cwd, scope, level, tabId, epicId, tags, message })
 function appendError({ cwd, scope, level = 'error', tabId, epicId, tags = [], message, meta }) {
   if (!cwd || typeof cwd !== 'string') return; // no project to attribute this line to — skip
 
+  // Test-process guard: a vitest fixture passing a real project root must never
+  // write to that project's logs/ NOR ship a fake event to production telemetry.
+  if (process.env.VITEST && !isInsideTestScratch(cwd)) return;
+
   if (isEphemeralCwd(cwd)) {
     // A worktree is torn down when its Epic/job ends and os.tmpdir() is
     // scratch space either way — never materialize logs there. See

package/src/main/lib/promptSessionSchema.cjs

@@ -1,3 +1,4 @@
+// @ts-check
 /**
  * Canonical runtime schema for a PromptSession (Epic) record, mirroring the
  * TS `PromptSession` interface at src/renderer/state/promptSessions.ts:29-76
@@ -96,6 +97,7 @@ const PromptSessionSchema = z.object({
  * doesn't match PromptSessionSchema. Callers that want fail-closed
  * enforcement before persisting a session object call this immediately
  * before their write.
+ * @param {unknown} session
  */
 function assertValidPromptSession(session) {
   const result = PromptSessionSchema.safeParse(session);