claude-code-session-manager 0.93.0 → 0.95.0

package/src/main/lib/rendererRecovery.cjs

@@ -0,0 +1,141 @@
+'use strict';
+
+// Bounded automatic recovery for a dead / hung / failed-to-load renderer.
+// Without it an OOM-killed renderer leaves a permanently white window while
+// scheduler jobs keep running headless with no UI to pause them.
+//
+// `createReloadPolicy` is the pure cap/timing unit (injected clock);
+// `attachRendererRecovery` wires it to one webContents (= one window).
+
+const MAX_RELOADS = 3;
+const WINDOW_MS = 10 * 60 * 1000;
+const UNRESPONSIVE_GRACE_MS = 30 * 1000;
+const LOAD_RETRY_DELAY_MS = 2000;
+const ERR_ABORTED = -3;
+
+/** Sliding-window cap: at most `max` reloads per `windowMs`. O(max) per call. */
+function createReloadPolicy({ now = Date.now, max = MAX_RELOADS, windowMs = WINDOW_MS } = {}) {
+  let stamps = [];
+  return {
+    /** Record a reload if the cap allows it. Returns true when allowed. */
+    tryReload() {
+      const t = now();
+      stamps = stamps.filter((s) => t - s < windowMs);
+      if (stamps.length >= max) return false;
+      stamps.push(t);
+      return true;
+    },
+    /** Would tryReload() succeed right now? Pure — consumes no slot. */
+    canReload() {
+      const t = now();
+      return stamps.filter((s) => t - s < windowMs).length < max;
+    },
+    /** Should a render-process-gone reason trigger recovery? */
+    shouldRecoverFromGone(reason) {
+      return reason !== 'clean-exit';
+    },
+    /** Should a did-fail-load trigger a retry? Main frame only, not ERR_ABORTED. */
+    shouldRetryLoad(errorCode, isMainFrame) {
+      return isMainFrame !== false && errorCode !== ERR_ABORTED;
+    },
+  };
+}
+
+function attachRendererRecovery(wc, {
+  logs,
+  policy = createReloadPolicy(),
+  setTimer = setTimeout,
+  clearTimer = clearTimeout,
+} = {}) {
+  let unresponsiveTimer = null;
+  let loadRetryTimer = null;
+  let capLogged = false;
+
+  const log = (level, message, meta) => {
+    try { logs?.writeLine({ scope: 'crash-diag', level, message, meta }); } catch { /* logging must never break recovery */ }
+  };
+  const alive = () => !wc.isDestroyed();
+
+  function logCapReached(reason) {
+    if (capLogged) return;
+    capLogged = true;
+    log('error', 'renderer auto-reload cap reached — giving up', { reason, max: MAX_RELOADS, windowMs: WINDOW_MS });
+  }
+
+  function reload(reason) {
+    if (!alive()) return;
+    if (!policy.tryReload()) {
+      logCapReached(reason);
+      return;
+    }
+    capLogged = false;
+    log('warn', 'renderer auto-reload', { reason });
+    try { wc.reload(); } catch (e) { log('error', 'renderer reload threw', { reason, error: e?.message }); }
+  }
+
+  // A hung main thread cannot commit a same-process reload, so kill the renderer
+  // and let the render-process-gone handler do the single cap-counted reload
+  // (in a new process). No slot is consumed here.
+  function recoverFromHang() {
+    if (!alive()) return;
+    if (!policy.canReload()) {
+      // A hung-but-visible window beats a dead white one.
+      logCapReached('unresponsive');
+      return;
+    }
+    try {
+      if (typeof wc.forcefullyCrashRenderer !== 'function') throw new Error('forcefullyCrashRenderer unavailable');
+      log('warn', 'renderer unresponsive — forcefully crashing for recovery');
+      wc.forcefullyCrashRenderer();
+    } catch (e) {
+      log('warn', 'forcefullyCrashRenderer failed — falling back to reload', { error: e?.message });
+      reload('unresponsive');
+    }
+  }
+
+  wc.on('render-process-gone', (_e, details) => {
+    const reason = details?.reason;
+    if (!policy.shouldRecoverFromGone(reason)) return;
+    reload(`render-process-gone:${reason}`);
+  });
+
+  wc.on('unresponsive', () => {
+    log('warn', 'renderer unresponsive');
+    if (unresponsiveTimer) return;
+    unresponsiveTimer = setTimer(() => {
+      unresponsiveTimer = null;
+      recoverFromHang();
+    }, UNRESPONSIVE_GRACE_MS);
+  });
+
+  wc.on('responsive', () => {
+    if (unresponsiveTimer) { clearTimer(unresponsiveTimer); unresponsiveTimer = null; }
+    log('info', 'renderer responsive again');
+  });
+
+  wc.on('did-fail-load', (_e, errorCode, errorDescription, _url, isMainFrame) => {
+    if (!policy.shouldRetryLoad(errorCode, isMainFrame)) return;
+    log('warn', 'main-frame did-fail-load', { errorCode, errorDescription });
+    if (loadRetryTimer) return;
+    loadRetryTimer = setTimer(() => {
+      loadRetryTimer = null;
+      reload(`did-fail-load:${errorCode}`);
+    }, LOAD_RETRY_DELAY_MS);
+  });
+
+  wc.once('destroyed', () => {
+    if (unresponsiveTimer) clearTimer(unresponsiveTimer);
+    if (loadRetryTimer) clearTimer(loadRetryTimer);
+    unresponsiveTimer = loadRetryTimer = null;
+  });
+}
+
+module.exports = {
+  createReloadPolicy,
+  attachRendererRecovery,
+  MAX_RELOADS,
+  WINDOW_MS,
+  UNRESPONSIVE_GRACE_MS,
+  LOAD_RETRY_DELAY_MS,
+  ERR_ABORTED,
+};

package/src/main/lib/scheduleJobSchema.cjs

@@ -1,3 +1,4 @@
+// @ts-check
 /**
  * Canonical runtime schema for a ScheduleJob record, mirroring the TS
  * `ScheduleJob` interface (`ScheduleJob` in src/preload/api.d.ts) field-for-field.
@@ -24,6 +25,7 @@
 
 const { z } = require('zod');
 
+/** @type {[string, ...string[]]} */
 const JOB_STATUSES = ['pending', 'running', 'investigating', 'completed', 'skipped', 'failed', 'needs_review', 'quarantined'];
 
 const ScheduleJobStatusSchema = z.enum(JOB_STATUSES);
@@ -138,6 +140,7 @@ const ScheduleJobSchema = z
 /**
  * Throws a clear, descriptive error (not a raw ZodError dump) when `job`
  * doesn't match ScheduleJobSchema. Mirrors assertValidPromptSession's shape.
+ * @param {unknown} job
  */
 function assertValidScheduleJob(job) {
   const result = ScheduleJobSchema.safeParse(job);

package/src/main/lib/usageCircuit.cjs

@@ -50,19 +50,44 @@ function isResetFresh(iso, now) {
   return resetMs > nowMs;
 }
 
+/** Flat sibling window that mirrors a `limits[]` entry's `kind`, for resets_at backfill. */
+const FLAT_WINDOW_BY_KIND = { session: 'five_hour', weekly_all: 'seven_day' };
+
+/** An entry's utilization: real `percent`, else the flat-shape `utilization`. */
+function entryPercent(l) {
+  return Number.isFinite(l.percent) ? l.percent : l.utilization;
+}
+
 /**
- * Which window is actually binding dispatch. Prefers `payload.limits[]`'s
- * `is_active` entry (the richer per-window shape); falls back to the flat
- * `five_hour` field when `limits[]` is absent, matching usage.cjs's shape.
+ * Which window is actually binding dispatch. The real /api/oauth/usage
+ * `limits[]` entries carry `kind` / `group` / `percent` / `severity` /
+ * `resets_at` / `scope` / `is_active` (percent is 0-100, may exceed 100).
+ * Only UNSCOPED entries (`scope == null`) are candidates — a scoped entry
+ * (e.g. `weekly_scoped` for one model) does not bind dispatch generally. Among
+ * them the HIGHEST finite percent wins ("binding" = closest to blocking us);
+ * `is_active` only breaks ties, because the API sets it on group precedence
+ * and trusting it alone would pick weekly_all 64 over session 95. With no
+ * usable unscoped entry, falls back to the flat `five_hour`. Pure, no I/O.
  */
 function bindingWindow(payload) {
-  if (payload && Array.isArray(payload.limits) && payload.limits.length) {
-    const active = payload.limits.find((l) => l && l.is_active);
-    if (active) {
+  if (payload && Array.isArray(payload.limits)) {
+    let best = null;
+    let bestPct = -Infinity;
+    for (const l of payload.limits) {
+      if (!l || l.scope != null) continue;
+      const pct = entryPercent(l);
+      if (!Number.isFinite(pct)) continue;
+      if (pct > bestPct || (pct === bestPct && l.is_active === true && !(best && best.is_active === true))) {
+        best = l;
+        bestPct = pct;
+      }
+    }
+    if (best) {
+      const flat = payload[FLAT_WINDOW_BY_KIND[best.kind]];
       return {
-        name: active.type || active.name || 'unknown',
-        utilization: active.utilization,
-        resets_at: active.resets_at ?? null,
+        name: best.kind || best.type || best.name || 'unknown',
+        utilization: bestPct,
+        resets_at: best.resets_at ?? (flat ? flat.resets_at ?? null : null),
       };
     }
   }
@@ -88,15 +113,18 @@ function degradedConcurrencyCap(configuredCap) {
 
 /**
  * Conservative budget to run on while the meter is down. utilization is
- * carried forward from the last known-good BINDING window — never 0, which
- * would read as "plenty of headroom" instead of "we don't know." A fresh
+ * carried forward from the last known-good BINDING window (a genuine 0% stays
+ * 0); with no payload ever received it is 100, never a blind 0 that would read
+ * as "plenty of headroom" instead of "we don't know." A fresh
  * executor-observed 429 (its own window not yet passed) pins utilization to
  * 100 regardless of the stale cached value. concurrencyCap never exceeds 2
  * (or SM_USAGE_DEGRADED_CAP, if set).
  */
 function degradedBudget(lastGoodPayload, executorEvidence = {}) {
+  // "Never a blind 0" means NO payload ever received -> 100. A payload whose
+  // binding window genuinely reads 0% carries forward as 0.
   const window = bindingWindow(lastGoodPayload);
-  let utilization = Number.isFinite(window.utilization) && window.utilization > 0
+  let utilization = lastGoodPayload && Number.isFinite(window.utilization)
     ? window.utilization
     : 100;
 

package/src/main/runVerify.cjs

@@ -898,7 +898,9 @@ async function verifyRun({
       scannedAt: new Date().toISOString(),
       ...(extras ?? {}),
     };
-    try { fs.writeFileSync(verdictsPath, JSON.stringify(record, null, 2)); } catch { /* best-effort */ }
+    // Atomic (tmp+rename) — scheduler.cjs reads this sidecar to decide completed-equivalence,
+    // so a torn write must never be observable. Lazy require keeps this module electron-free at load.
+    try { require('./config.cjs').writeJsonSync(verdictsPath, record); } catch { /* best-effort */ }
     return { verdict, reason, downgradeTo, ...(extras ?? {}) };
   }