claude-code-session-manager 0.97.0 → 0.100.0

package/src/main/__tests__/scheduler-rate-limit-cooldown-freshness.test.cjs

@@ -1,123 +0,0 @@
-/**
- * scheduler-rate-limit-cooldown-freshness.test.cjs — PRD 1119.
- *
- * setPaused()'s manual-override cooldown used to suppress WRITING any pause
- * for 5 minutes after a human Resume/Run now, unconditionally — even when
- * the triggering rate-limit observation came from a run that started AFTER
- * the manual clear (i.e. brand-new evidence, not the stale auto-detection
- * the cooldown exists to ignore). Combined with the halt-reset that resets a
- * rate-limited job straight back to 'pending', this produced a hot dispatch
- * loop: dispatch -> 429 in seconds -> reset to pending -> pause suppressed
- * -> dispatch again, on a ~12s cadence, until the cooldown itself expired.
- *
- * isCooldownSuppressed() is the pure predicate this PRD extracts so both
- * directions of the fix (fresh observation bypasses the cooldown; stale one
- * stays suppressed) are directly unit-testable without touching queue.json,
- * mutate(), or any fs state. nextRapidRateLimitCount() is the pure reducer
- * behind the independent rapid-repeat hard-pause cap (a second circuit
- * breaker for when the computed resumeAt is itself stale/wrong and would
- * otherwise let the resume timer keep re-clearing the pause every ~30s,
- * with every subsequent dispatch genuinely "fresh").
- *
- * Run: timeout 60 npx vitest run src/main/__tests__/scheduler-rate-limit-cooldown-freshness.test.cjs
- */
-
-'use strict';
-
-import { test, expect } from 'vitest';
-const {
-  isCooldownSuppressed,
-  nextRapidRateLimitCount,
-  CONSECUTIVE_RAPID_RATE_LIMIT_THRESHOLD,
-  RAPID_RATE_LIMIT_WINDOW_MS,
-  MANUAL_PAUSE_COOLDOWN_MS,
-} = require('../scheduler.cjs');
-
-const clearedAt = 1_000_000;
-
-test('a rate_limit pause triggered by a run that STARTED AFTER the manual clear engages regardless of the cooldown', () => {
-  const now = clearedAt + 60_000; // well inside the 5-minute cooldown window
-  const observedAt = clearedAt + 5_000; // the triggering run started after the clear
-  const suppressed = isCooldownSuppressed({ pauseClearedManuallyAt: clearedAt, now, observedAt, force: false });
-  expect(suppressed).toBe(false);
-});
-
-test('a rate_limit pause triggered by an observation OLDER than the manual clear stays suppressed', () => {
-  const now = clearedAt + 60_000;
-  const observedAt = clearedAt - 5_000; // stale: this run started before the human cleared the pause
-  const suppressed = isCooldownSuppressed({ pauseClearedManuallyAt: clearedAt, now, observedAt, force: false });
-  expect(suppressed).toBe(true);
-});
-
-test('no observedAt at all (unrelated pause reasons, e.g. auth/network) is treated as stale — unchanged prior behavior', () => {
-  const now = clearedAt + 60_000;
-  const suppressed = isCooldownSuppressed({ pauseClearedManuallyAt: clearedAt, now, observedAt: null, force: false });
-  expect(suppressed).toBe(true);
-});
-
-test('once the cooldown window itself has elapsed, suppression lifts regardless of freshness', () => {
-  const now = clearedAt + MANUAL_PAUSE_COOLDOWN_MS + 1;
-  const suppressed = isCooldownSuppressed({ pauseClearedManuallyAt: clearedAt, now, observedAt: null, force: false });
-  expect(suppressed).toBe(false);
-});
-
-test('no manual clear on record never suppresses', () => {
-  const suppressed = isCooldownSuppressed({ pauseClearedManuallyAt: null, now: Date.now(), observedAt: null, force: false });
-  expect(suppressed).toBe(false);
-});
-
-test('force always bypasses the cooldown, fresh or not', () => {
-  const now = clearedAt + 1_000;
-  const staleObservedAt = clearedAt - 5_000;
-  const suppressed = isCooldownSuppressed({ pauseClearedManuallyAt: clearedAt, now, observedAt: staleObservedAt, force: true });
-  expect(suppressed).toBe(false);
-});
-
-// ---------- rapid-repeat consecutive counter ----------
-
-test('a rate-limited run under the rapid window increments the counter', () => {
-  expect(nextRapidRateLimitCount(0, { rateLimited: true, durationMs: 4_000 })).toBe(1);
-  expect(nextRapidRateLimitCount(1, { rateLimited: true, durationMs: 4_000 })).toBe(2);
-});
-
-test('a rate-limited run that ran for >= the rapid window does not increment the counter', () => {
-  expect(nextRapidRateLimitCount(1, { rateLimited: true, durationMs: RAPID_RATE_LIMIT_WINDOW_MS })).toBe(1);
-});
-
-test('any non-rate-limited outcome resets the counter to 0', () => {
-  expect(nextRapidRateLimitCount(2, { rateLimited: false, durationMs: 999_999 })).toBe(0);
-});
-
-test('driving the counter to the documented threshold engages the hard-pause condition', () => {
-  let count = 0;
-  for (let i = 0; i < CONSECUTIVE_RAPID_RATE_LIMIT_THRESHOLD; i += 1) {
-    count = nextRapidRateLimitCount(count, { rateLimited: true, durationMs: 3_000 });
-  }
-  expect(count).toBe(CONSECUTIVE_RAPID_RATE_LIMIT_THRESHOLD);
-  expect(count >= CONSECUTIVE_RAPID_RATE_LIMIT_THRESHOLD).toBe(true);
-});
-
-test('reaching the threshold forces the pause through even against a STALE observation still inside the cooldown window', () => {
-  // This is the scenario the hard cap exists for: freshness alone is not
-  // enough when the computed resumeAt is itself stale/wrong and the resume
-  // timer keeps re-clearing the pause, so a LATER dispatch's observation can
-  // legitimately look "stale" relative to the most recent clear. The
-  // rapid-repeat counter is an independent, unconditional circuit breaker.
-  let count = 0;
-  for (let i = 0; i < CONSECUTIVE_RAPID_RATE_LIMIT_THRESHOLD; i += 1) {
-    count = nextRapidRateLimitCount(count, { rateLimited: true, durationMs: 3_000 });
-  }
-  const force = count >= CONSECUTIVE_RAPID_RATE_LIMIT_THRESHOLD;
-  const staleObservedAt = clearedAt - 999_999;
-  const suppressed = isCooldownSuppressed({ pauseClearedManuallyAt: clearedAt, now: clearedAt + 1_000, observedAt: staleObservedAt, force });
-  expect(suppressed).toBe(false);
-});
-
-test('one non-rate-limited run in between resets the streak so the hard pause never engages', () => {
-  let count = 0;
-  count = nextRapidRateLimitCount(count, { rateLimited: true, durationMs: 3_000 });
-  count = nextRapidRateLimitCount(count, { rateLimited: true, durationMs: 3_000 });
-  count = nextRapidRateLimitCount(count, { rateLimited: false, durationMs: 60_000 }); // job actually ran fine
-  count = nextRapidRateLimitCount(count, { rateLimited: true, durationMs: 3_000 });
-  expect(count).toBeLessThan(CONSECUTIVE_RAPID_RATE_LIMIT_THRESHOLD);
-});

package/src/main/__tests__/scheduler-rate-limit-pause.test.cjs

@@ -1,152 +0,0 @@
-/**
- * scheduler-rate-limit-pause.test.cjs — PRD 1118: pause against the BINDING
- * rate-limit window read off a run's own log, not refreshNextReset()'s
- * five_hour-only assumption, and never leave an indefinite pause with no
- * resume timer when both the log and the billing endpoint come up empty
- * (the live failure mode: the usage endpoint itself 429s).
- *
- * Also (usage-meter circuit PRD): neither function may arm a PAST reset —
- * resolveRateLimitPauseReset/computeEffectiveResumeAt now reject a stale ISO
- * via usageCircuit.isResetFresh and fall back to the bounded 30-MINUTE pause
- * instead. A stale reset used to survive straight into computeResumeDelay's
- * `Math.max(30_000, <negative>)`, arming a 30-SECOND nap that spun the queue
- * right back into the same still-active rate limit.
- *
- * These test the PURE decision functions scheduler.cjs's setPaused() and the
- * spawnJob() rateLimited branch delegate to — never the real setPaused/mutate
- * path, which writes the machine's live scheduler queue.json at a fixed
- * homedir path (~/.claude/session-manager/scheduled-plans) and must not be
- * touched by a test run.
- *
- * Run: timeout 120 npx vitest run src/main/__tests__/scheduler-rate-limit-pause.test.cjs
- */
-
-'use strict';
-
-import { test } from 'vitest';
-const assert = require('node:assert/strict');
-const path = require('node:path');
-const {
-  resolveRateLimitPauseReset,
-  billingResetForPause,
-  computeEffectiveResumeAt,
-  computeResumeDelay,
-  computeDegradedBudget,
-} = require('../scheduler.cjs');
-const billing = require('../usage.cjs');
-
-// Repo-tracked, byte-for-byte copy of the real 2026-09-05 starry-night-ships
-// incident log (see src/main/lib/__tests__/rateLimitWindow.test.cjs for the
-// live-path parity check) — kept hermetic rather than pointed at the
-// machine-local live path directly.
-const FIXTURE = path.join(__dirname, '..', 'lib', '__tests__', 'fixtures', '204-mercury-steam-horse.log.txt');
-const FIVE_HOUR_ISO = new Date(1788643800 * 1000).toISOString(); // what refreshNextReset() would have returned
-const SEVEN_DAY_ISO = new Date(1789059600 * 1000).toISOString(); // the actually-binding window
-// Fixed "now" contemporaneous with the fixture's own timestamps (BEFORE both
-// resets above), so freshness checks read the fixture the way it looked at
-// incident time — not relative to whenever this suite happens to run.
-const FIXTURE_NOW = Date.parse('2026-09-05T16:32:00.000Z');
-
-test('resolveRateLimitPauseReset: prefers the log-derived seven-day reset over the billing five_hour reset', () => {
-  const resetIso = resolveRateLimitPauseReset(FIXTURE, FIVE_HOUR_ISO, FIXTURE_NOW);
-  assert.strictEqual(resetIso, SEVEN_DAY_ISO);
-  assert.notStrictEqual(resetIso, FIVE_HOUR_ISO);
-});
-
-test('resolveRateLimitPauseReset: falls back to the billing reset when the log yields none', () => {
-  const resetIso = resolveRateLimitPauseReset('/nonexistent/path/job.log', FIVE_HOUR_ISO, FIXTURE_NOW);
-  assert.strictEqual(resetIso, FIVE_HOUR_ISO);
-});
-
-test('resolveRateLimitPauseReset: null when BOTH the log and the billing endpoint are unavailable', () => {
-  assert.strictEqual(resolveRateLimitPauseReset('/nonexistent/path/job.log', null, FIXTURE_NOW), null);
-});
-
-test('resolveRateLimitPauseReset: a PAST log-derived reset is rejected, not returned stale', () => {
-  // "now" is AFTER both fixture resets have already elapsed.
-  const longAfter = Date.parse('2026-09-15T00:00:00.000Z');
-  const resetIso = resolveRateLimitPauseReset(FIXTURE, FIVE_HOUR_ISO, longAfter);
-  assert.strictEqual(resetIso, null);
-});
-
-test('resolveRateLimitPauseReset: log yields nothing and the billing reset has already passed -> null, not the stale value', () => {
-  const longAfter = Date.parse('2026-09-15T00:00:00.000Z');
-  const resetIso = resolveRateLimitPauseReset('/nonexistent/path/job.log', FIVE_HOUR_ISO, longAfter);
-  assert.strictEqual(resetIso, null);
-});
-
-test('computeEffectiveResumeAt: rate_limit with no resumeAt gets the same bounded 30-minute fallback as network', () => {
-  const now = FIXTURE_NOW;
-  const resumeAt = computeEffectiveResumeAt('rate_limit', null, now);
-  assert.strictEqual(resumeAt, new Date(now + 30 * 60_000).toISOString());
-});
-
-test('computeEffectiveResumeAt: a FRESH explicit resumeAt (the log-derived reset) is never overridden', () => {
-  const resumeAt = computeEffectiveResumeAt('rate_limit', SEVEN_DAY_ISO, FIXTURE_NOW);
-  assert.strictEqual(resumeAt, SEVEN_DAY_ISO);
-});
-
-test('computeEffectiveResumeAt: a PAST resumeAt gets the 30-minute fallback, not a ~30-second nap', () => {
-  // now is well AFTER SEVEN_DAY_ISO has already elapsed — the exact shape of
-  // the bug: Math.max(30_000, <negative>) used to arm a 30-second resume.
-  const longAfter = Date.parse('2026-09-15T00:00:00.000Z');
-  const resumeAt = computeEffectiveResumeAt('rate_limit', SEVEN_DAY_ISO, longAfter);
-  assert.strictEqual(resumeAt, new Date(longAfter + 30 * 60_000).toISOString());
-  assert.notStrictEqual(resumeAt, SEVEN_DAY_ISO);
-  const { delayMs } = computeResumeDelay(resumeAt, longAfter);
-  assert.ok(delayMs >= 30 * 60_000, `expected >= 30 minutes, got ${delayMs}ms`);
-});
-
-test('computeEffectiveResumeAt: other reasons (e.g. auth) get no fallback — stays indefinite', () => {
-  assert.strictEqual(computeEffectiveResumeAt('auth', null, Date.now()), null);
-});
-
-test('billingResetForPause: skips refreshNextReset() (no billing.fetchUsage call) while the shared circuit is OPEN', async () => {
-  const originalFetchUsage = billing.fetchUsage;
-  let fetchCalls = 0;
-  billing.fetchUsage = async () => { fetchCalls++; return { kind: 'ok', data: { usage: {} } }; };
-  try {
-    // Force the shared circuit open (3 consecutive failures), same threshold usageCircuit.cjs uses.
-    billing.usageCircuit.recordFailure('a');
-    billing.usageCircuit.recordFailure('a');
-    billing.usageCircuit.recordFailure('a');
-    assert.strictEqual(billing.usageCircuit.state(), 'open');
-
-    await billingResetForPause();
-    assert.strictEqual(fetchCalls, 0, 'refreshNextReset() must not call billing.fetchUsage() while the circuit is open');
-  } finally {
-    billing.usageCircuit.recordSuccess({}); // close the shared circuit back up for later tests/files
-    billing.fetchUsage = originalFetchUsage;
-  }
-});
-
-test('computeResumeDelay: a seven-day-out reset (~5 days from now) is armed, not treated as too-far', () => {
-  const now = Date.parse('2026-09-05T16:32:00.000Z');
-  // ~5 days out — comfortably under the 0x7fffffff (~24.8 day) setTimeout cap.
-  const fiveDaysOut = new Date(now + 5 * 24 * 60 * 60_000).toISOString();
-  const { delayMs, tooFar } = computeResumeDelay(fiveDaysOut, now);
-  assert.strictEqual(tooFar, false);
-  assert.ok(delayMs < 0x7fffffff, `expected delay under setTimeout cap, got ${delayMs}`);
-  assert.ok(delayMs > 400_000_000, `expected ~5 days in ms, got ${delayMs}`);
-});
-
-test('computeResumeDelay: a reset far enough out DOES trip the overflow guard', () => {
-  const now = Date.parse('2026-09-05T16:32:00.000Z');
-  const thirtyDaysOut = new Date(now + 30 * 24 * 60 * 60_000).toISOString();
-  const { tooFar } = computeResumeDelay(thirtyDaysOut, now);
-  assert.strictEqual(tooFar, true);
-});
-
-test('refreshNextReset (via billingResetForPause) seeds lastGoodUsagePayload: a following degraded cycle yields the fetched percent, not 100', async () => {
-  const originalFetchUsage = billing.fetchUsage;
-  billing.fetchUsage = async () => ({
-    kind: 'ok',
-    data: { usage: { limits: [{ kind: 'weekly_all', percent: 64, resets_at: '2026-09-24T17:00:00Z', scope: null, is_active: true }] } },
-  });
-  try {
-    await billingResetForPause();
-    assert.strictEqual(computeDegradedBudget().utilization, 64);
-  } finally {
-    billing.fetchUsage = originalFetchUsage;
-  }
-});

package/src/main/__tests__/scheduler-rate-limit-spin-guard.test.cjs

@@ -1,156 +0,0 @@
-/**
- * scheduler-rate-limit-spin-guard.test.cjs — PRD 1119 end-to-end repro of the
- * 2026-09-05 incident: a human pressed Resume/Run now on job 204, and for the
- * next hour the scheduler dispatched it, watched it 429 in seconds, reset it
- * to pending (halt-reset), and dispatched it again — 291 times, one every
- * ~12s — because setPaused()'s manual-override cooldown suppressed WRITING
- * the rate_limit pause for the whole 5-minute window, even though every one
- * of those 429s was a brand-new observation from a run that started AFTER
- * the human's clear.
- *
- * This drives the REAL dispatch path (spawnJob, via a stub `claude` binary
- * that always 429s in well under a second) repeatedly, immediately after a
- * simulated manual Resume, and asserts the scheduler engages a genuine pause
- * almost immediately — never anywhere near the 291-dispatch runaway, and
- * never past the documented CONSECUTIVE_RAPID_RATE_LIMIT_THRESHOLD hard cap
- * even in the worst case. Compressed in wall-clock time (a stub exits in
- * milliseconds, not the ~12s a real `claude -p` round trip took) — the
- * assertion is on DISPATCH COUNT, which is what the fix actually bounds,
- * not on wall-clock duration.
- *
- * Run: timeout 60 npx vitest run src/main/__tests__/scheduler-rate-limit-spin-guard.test.cjs
- */
-
-'use strict';
-
-import { test, expect, beforeAll, afterAll, afterEach } from 'vitest';
-const fs = require('node:fs');
-const os = require('node:os');
-const path = require('node:path');
-const claudeStub = require('../../../tests/helpers/claudeStub.cjs');
-const { execFileSync } = require('node:child_process');
-
-let tmpHome;
-let originalHome;
-let scheduler;
-let queueStore;
-
-beforeAll(() => {
-  originalHome = process.env.HOME;
-  tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-rate-limit-spin-guard-'));
-  process.env.HOME = tmpHome;
-  // Worktree isolation is irrelevant to this repro (it's about pause
-  // suppression, not tree isolation) and each real `git worktree add` adds
-  // real wall-clock overhead this test does not need to pay 40 times over.
-  process.env.SM_JOB_WORKTREE_DISABLE = '1';
-  scheduler = require('../scheduler.cjs');
-  queueStore = require('../lib/queueStore.cjs');
-});
-
-afterAll(() => {
-  process.env.HOME = originalHome;
-  delete process.env.SM_JOB_WORKTREE_DISABLE;
-  fs.rmSync(tmpHome, { recursive: true, force: true });
-});
-
-afterEach(() => {
-  delete process.env.SM_CLAUDE_BIN;
-});
-
-function git(args, cwd) {
-  return execFileSync('git', args, { cwd, encoding: 'utf8' });
-}
-
-function initRepo(dir) {
-  fs.mkdirSync(dir, { recursive: true });
-  git(['init', '-q'], dir);
-  git(['config', 'user.email', 'test@example.com'], dir);
-  git(['config', 'user.name', 'Test'], dir);
-  fs.writeFileSync(path.join(dir, 'README.md'), 'hello\n', 'utf8');
-  git(['add', '-A'], dir);
-  git(['commit', '-q', '-m', 'initial'], dir);
-}
-
-function registerActiveProject(cwd) {
-  const projectsDir = path.join(tmpHome, '.claude', 'projects');
-  const slugDir = path.join(projectsDir, 'spin-guard-project-slug');
-  fs.mkdirSync(slugDir, { recursive: true });
-  fs.writeFileSync(path.join(slugDir, 'transcript.jsonl'), JSON.stringify({ cwd }) + '\n');
-  queueStore.bustCwdCache();
-}
-
-function writeProjectQueue(cwd, jobs) {
-  const stateDir = path.join(cwd, 'session-manager-operations', 'scheduler', 'state');
-  fs.mkdirSync(stateDir, { recursive: true });
-  const queuePath = path.join(stateDir, 'queue.json');
-  fs.writeFileSync(queuePath, JSON.stringify({ jobs }, null, 2));
-  return queuePath;
-}
-
-// Stub `claude` binary: always dies as a rate limit, in well under 30s (same
-// technique as scheduler-prd-persona-spawn.test.cjs's argv-marker stub) —
-// emits the canonical 429 signal detectRateLimitInLog looks for, then exits
-// non-zero almost instantly, and bumps a counter file each invocation so the
-// test can assert exactly how many times it was actually spawned.
-function writeAlways429ClaudeStub(counterPath) {
-  return claudeStub.writeClaudeStub({ body: `
-    const fs = require('fs');
-    fs.appendFileSync(${JSON.stringify(counterPath)}, 'x');
-    process.stdout.write(JSON.stringify({ type: 'result', subtype: 'error', is_error: true, api_error_status: 429 }) + '\\n');
-    process.exit(1);
-  ` });
-}
-
-test('a manual Resume immediately followed by a permanently-429ing job never produces a runaway dispatch loop', async () => {
-  const projectCwd = fs.mkdtempSync(path.join(tmpHome, 'spin-guard-project-'));
-  initRepo(projectCwd);
-  registerActiveProject(projectCwd);
-  const slug = `1119-spin-guard-${process.pid}`;
-  const prdsDir = path.join(projectCwd, 'session-manager-operations', 'scheduler', 'prds');
-  fs.mkdirSync(prdsDir, { recursive: true });
-  fs.writeFileSync(path.join(prdsDir, `${slug}.md`), 'Do the thing.', 'utf8');
-
-  const counterPath = path.join(tmpHome, 'dispatch-count.txt');
-  fs.writeFileSync(counterPath, '');
-  process.env.SM_CLAUDE_BIN = writeAlways429ClaudeStub(counterPath);
-
-  writeProjectQueue(projectCwd, [
-    { slug, status: 'pending', cwd: projectCwd },
-  ]);
-
-  // The human just pressed Resume/Run now — this is the exact call clearPause
-  // makes from the IPC handlers, and it starts the 5-minute cooldown window.
-  await scheduler.clearPause('manual');
-
-  const job = { slug, cwd: projectCwd };
-
-  // Simulate the tick loop's dispatch decision being driven repeatedly "over
-  // ten minutes" — compressed here to however many cycles a permanently-429
-  // job can actually complete, since each cycle is a real (fast) subprocess
-  // spawn rather than a real 12s `claude -p` round trip. tickQueue()'s own
-  // paused early-return (unchanged by this PRD) is exactly what this loop
-  // reproduces by hand: stop dispatching the moment the queue is paused.
-  const MAX_TICKS = 40;
-  for (let i = 0; i < MAX_TICKS; i += 1) {
-    // eslint-disable-next-line no-await-in-loop
-    const state = await queueStore.readMerged();
-    if (state.paused) break;
-    const row = state.jobs.find((j) => j.slug === slug);
-    if (!row || row.status !== 'pending') break;
-    const runId = `run-${i}`;
-    const runDir = path.join(scheduler.RUNS_DIR, runId);
-    fs.mkdirSync(runDir, { recursive: true });
-    // eslint-disable-next-line no-await-in-loop
-    await scheduler.spawnJob(job, runId, runDir, projectCwd);
-  }
-
-  const dispatchCount = fs.readFileSync(counterPath, 'utf8').length;
-  expect(dispatchCount).toBeLessThanOrEqual(scheduler.CONSECUTIVE_RAPID_RATE_LIMIT_THRESHOLD);
-  expect(dispatchCount).toBeGreaterThan(0);
-  expect(dispatchCount).toBeLessThan(10); // nowhere near the 291-dispatch incident
-
-  const finalState = await queueStore.readMerged();
-  expect(finalState.paused).toBeTruthy();
-  expect(finalState.paused.reason).toBe('rate_limit');
-  expect(finalState.jobs.find((j) => j.slug === slug).status).toBe('pending');
-});