claude-code-session-manager 0.104.2 → 0.106.0

package/src/main/pty.cjs

@@ -20,6 +20,7 @@ const { addAllowedRoot } = require('./config.cjs');
 const { aliasedShellBin } = require('./lib/smProcNames.cjs');
 const { cleanChildEnv, pathWithUserBins } = require('./lib/cleanEnv.cjs');
 const { checkInsideHome } = require('./lib/insideHome.cjs');
+const { defaultShell } = require('./lib/defaultShell.cjs');
 const { sendIfAlive } = require('./lib/sendToRenderer.cjs');
 const opsErrorLog = require('./lib/opsErrorLog.cjs');
 const { planEpicSpawn } = require('./lib/epicSpawnPlan.cjs');
@@ -51,20 +52,39 @@ const PTY_FLUSH_MAX_BYTES = 64 * 1024;
  */
 function nativeModuleHelp(reason) {
   const mac = process.platform === 'darwin';
-  const lines = [
+  const head = [
     '',
     `\x1b[1;33m[session-manager] Terminal could not start.\x1b[0m`,
     `\x1b[33m${reason}\x1b[0m`,
     '',
-    `This is almost always the node-pty native module not matching this`,
-    `Electron build. Rebuild it once:`,
+  ];
+  if (process.platform === 'win32') {
+    return (
+      [
+        ...head,
+        `This is almost always a damaged install (the node-pty native module`,
+        `is missing or does not match this build). Reinstall session-manager:`,
+        '',
+        `  - Installed app: run the latest installer again.`,
+        `  - npm package:   \x1b[36mnpm install -g claude-code-session-manager@latest\x1b[0m`,
+        '',
+        `Then quit and reopen session-manager.`,
+        '',
+      ].join('\r\n') + '\r\n'
+    );
+  }
+  const lines = [
+    ...head,
+    `node-pty ships prebuilt binaries for macOS, Linux and Windows on x64 and`,
+    `arm64. This machine is \x1b[36m${process.platform}-${process.arch}\x1b[0m. If the module failed to load, the`,
+    `install is probably damaged. Reinstall session-manager:`,
+    '',
+    `  \x1b[36mnpm i -g claude-code-session-manager@latest\x1b[0m`,
+    `  (or re-run the npx command)`,
     '',
-    `  \x1b[36mcd ${PKG_DIR}\x1b[0m`,
-    `  \x1b[36mnpx electron-rebuild -f -w node-pty\x1b[0m`,
+    `On any other platform node-pty compiles from source and needs build tools:`,
+    mac ? `  macOS: \x1b[36mxcode-select --install\x1b[0m` : `  Linux: build-essential + python3`,
     '',
-    mac ? `macOS: if the rebuild fails, install the compiler first:` : '',
-    mac ? `  \x1b[36mxcode-select --install\x1b[0m` : '',
-    mac ? '' : '',
     `Then quit and reopen session-manager.`,
     '',
   ].filter((l) => l !== '');
@@ -210,8 +230,8 @@ class PtyManager {
       SM_PROJECT_ROOT: cwd,
     });
 
-    const shell = process.env.SHELL || '/bin/bash';
-    console.log('[pty] spawning shell', shell);
+    const shell = defaultShell({ platform: process.platform, env: process.env, exists: fs.existsSync });
+    console.log('[pty] spawning shell', shell.file);
     // Tab ID = claudeSessionId (see CLAUDE.md), and Chat/Terminal are two views over ONE session,
     // so this asks the same decision function chatRunner.cjs does (epicSpawnPlan.cjs). `cwd`
     // itself is NEVER repointed; only this actual PTY spawn option is (epicSpawnCwd.cjs's
@@ -255,7 +275,8 @@ class PtyManager {
       // job's descendants; no shell in a job's process tree is ever spawned
       // through here, so that detection is unaffected. Non-bash/zsh shells and
       // any alias failure fall back to the real path.
-      proc = pty.spawn(aliasedShellBin(shell), ['-il'], {
+      const shellFile = process.platform === 'win32' ? shell.file : aliasedShellBin(shell.file);
+      proc = pty.spawn(shellFile, shell.args, {
         name: 'xterm-256color',
         cols,
         rows,

package/src/main/runVerify.cjs

@@ -168,13 +168,14 @@ function parseLog(logPath) {
   try {
     text = fs.readFileSync(logPath, 'utf8');
   } catch (e) {
-    return { events: [], resultEvent: null, error: e.message };
+    return { events: [], resultEvent: null, error: e.message, transcriptCommitShas: [] };
   }
 
   const events = [];
   let resultEvent = null;
   let seq = 0;
   let transcriptCommitLanded = false;
+  const transcriptCommitShaSet = new Set();
 
   for (const line of text.split('\n')) {
     const trimmed = line.trim();
@@ -194,6 +195,8 @@ function parseLog(logPath) {
     }
     if (obj.tool_use_result?.gitOperation?.commit?.kind === 'committed') {
       transcriptCommitLanded = true;
+      const sha = obj.tool_use_result.gitOperation.commit.sha;
+      if (typeof sha === 'string' && sha) transcriptCommitShaSet.add(sha);
     }
 
     // Final result event.
@@ -245,7 +248,7 @@ function parseLog(logPath) {
     }
   }
 
-  return { events, resultEvent, error: null, transcriptCommitLanded };
+  return { events, resultEvent, error: null, transcriptCommitLanded, transcriptCommitShas: [...transcriptCommitShaSet] };
 }
 
 // Stable, narrow substrings of the harness's auto-background tool_result text
@@ -549,6 +552,28 @@ function scanSentinel(resultEvent, events) {
   return null;
 }
 
+/**
+ * One-line reason after `SCHEDULER_VERDICT: FAIL` (same two-source scan order
+ * as scanSentinel). Trimmed, capped at 300 chars; '' when absent.
+ */
+function scanSentinelReason(resultEvent, events) {
+  const RE = /^SCHEDULER_VERDICT:\s*FAIL\b[ \t]*([^\n]*)/m;
+  const clip = (m) => m[1].trim().slice(0, 300);
+  if (resultEvent && resultEvent.resultText) {
+    const m = resultEvent.resultText.match(RE);
+    if (m) return clip(m);
+  }
+  let lastToolResult = null;
+  for (const ev of events) {
+    if (ev.kind === 'tool_result') lastToolResult = ev;
+  }
+  if (lastToolResult && lastToolResult.content) {
+    const m = lastToolResult.content.match(RE);
+    if (m) return clip(m);
+  }
+  return '';
+}
+
 /**
  * Scan for a `FOREIGN_WIP_PATHS: <comma-separated paths>` evidence line —
  * the mandatory companion to a `SCHEDULER_VERDICT: BLOCKED_BY_FOREIGN_WIP`
@@ -1079,6 +1104,20 @@ async function verifyRun({
     // Scan for the SCHEDULER_VERDICT sentinel emitted by the finish protocol.
     const sentinel = scanSentinel(resultEvent, events);
 
+    // An explicit executor FAIL is always blocking — outranks every other
+    // verdict and every override below (early return). Transcript issues are
+    // kept as annotations so nothing is lost.
+    if (sentinel === 'fail') {
+      const failReason = scanSentinelReason(resultEvent, events);
+      const kept = [...annotations, ...issues.map((i) => ({ verdict: i.verdict, reason: i.reason }))];
+      return conclude(
+        'sentinel_fail',
+        'executor reported SCHEDULER_VERDICT: FAIL' + (failReason ? ': ' + failReason : ''),
+        'needs_review',
+        { sentinel, ...(kept.length ? { annotations: kept } : {}) },
+      );
+    }
+
     // Ground truth outranks heuristics: an exit-0 run that landed a commit
     // ATTRIBUTABLE TO THIS RUN (spawnJob's own guardHeadBefore/headAtExit
     // delta, or the repo-wide committedDuringRun window scan) and never
@@ -1377,6 +1416,7 @@ module.exports = {
   checkDeps,
   parseLog,
   scanSentinel,
+  scanSentinelReason,
   scanForeignWipPathsClaim,
   isMergeMainSlug,
   extractMergeMainPrNumber,

package/src/main/scheduler.cjs

@@ -82,6 +82,7 @@ const { isResetFresh, bindingWindow, degradedBudget } = require('./lib/usageCirc
 const { computeQueueHealth } = require('./lib/queueHealth.cjs');
 const { createLoadGate, topCpuConsumers } = require('./lib/loadGate.cjs');
 const { openLog, withChildAndLog } = require('./lib/childWithLog.cjs');
+const { killTree, detachedSpawnOpts } = require('./lib/killTree.cjs');
 const { sendIfAlive } = require('./lib/sendToRenderer.cjs');
 const { createBroadcastCoalescer } = require('./lib/broadcastCoalescer.cjs');
 const prdParser = require('./scheduler/prdParser.cjs');
@@ -846,6 +847,51 @@ async function computeCommittedDuringRun(cwd, headBefore, headAfter, startedAt,
   return module.exports.committedInWindow(cwd, startedAt, untilIso);
 }
 
+/**
+ * Which commit does this run get credit for? A worktree-isolated run shares the
+ * main checkout with concurrent jobs, so a HEAD move there may be someone else's
+ * integration — credit comes only from this run's own integration result. An
+ * in-place run keeps the HEAD-delta / time-window behaviour.
+ */
+function resolveRunCommitAttribution({
+  ranInWorktree, integratedSha, headBefore, headAtExit, committedInWindow,
+  rangeCommits, transcriptCommitShas, siblingOverlap,
+}) {
+  if (ranInWorktree) {
+    const landedCommit = integratedSha || null;
+    return { landedCommit, committedDuringRun: Boolean(landedCommit) };
+  }
+  const shas = Array.isArray(transcriptCommitShas) ? transcriptCommitShas.filter(Boolean) : [];
+  if (shas.length === 0 && !siblingOverlap) {
+    const headMoved = Boolean(headBefore && headAtExit && headBefore !== headAtExit);
+    return {
+      landedCommit: headMoved ? headAtExit : null,
+      committedDuringRun: headMoved || Boolean(committedInWindow),
+    };
+  }
+  // Shared tree with possible siblings (or transcript evidence): credit only a
+  // commit in the range that this run's own transcript reported.
+  const own = (Array.isArray(rangeCommits) ? rangeCommits : [])
+    .find((c) => shas.some((sha) => c.startsWith(sha)));
+  const landedCommit = own || null;
+  return { landedCommit, committedDuringRun: Boolean(landedCommit) };
+}
+
+/** Full shas in `before..after` (newest first); [] on any error. Never throws. */
+function gitRangeCommits(cwd, before, after) {
+  return new Promise((resolve) => {
+    if (!cwd || !before || !after || before === after) { resolve([]); return; }
+    execFile(
+      'git', ['-C', cwd, 'rev-list', `${before}..${after}`],
+      { timeout: 10_000, windowsHide: true },
+      (err, out) => {
+        if (err) { resolve([]); return; }
+        resolve(String(out || '').split('\n').map((l) => l.trim()).filter(Boolean));
+      },
+    );
+  });
+}
+
 /**
  * Read-only check: is a job's `sm-job/<slug>` worktree branch already fully
  * integrated into `cwd`'s current HEAD — i.e. every commit on the branch is
@@ -2769,6 +2815,8 @@ function killOrphanClaudePid(pid, recordedIdentity = null) {
     && isDifferentProcess(recordedIdentity, procIdentityOf(pid))) {
     return 'mismatch';
   }
+  // win32 has no /proc or `ps`: the identity heuristic can't run, so never reap.
+  if (process.platform === 'win32') return 'unknown';
   let cmdline = '';
   try {
     cmdline = fs.readFileSync(`/proc/${pid}/cmdline`, 'utf8').replace(/\0/g, ' ');
@@ -2779,12 +2827,10 @@ function killOrphanClaudePid(pid, recordedIdentity = null) {
     } catch { return 'unknown'; }
   }
   if (!/\bclaude\b/.test(cmdline)) return 'mismatch';
-  try { process.kill(-pid, 'SIGTERM'); }
-  catch { try { process.kill(pid, 'SIGTERM'); } catch { /* race: died between checks */ } }
+  killTree(pid, 'SIGTERM');
   setTimeout(() => {
     try { process.kill(pid, 0); } catch { return; /* already gone */ }
-    try { process.kill(-pid, 'SIGKILL'); }
-    catch { try { process.kill(pid, 'SIGKILL'); } catch { /* race */ } }
+    killTree(pid, 'SIGKILL');
   }, 5000).unref?.();
   return 'killed';
 }
@@ -6276,7 +6322,15 @@ async function executeJob(job, runDir, defaultCwd, onPid, execCwd, resumeTarget
 
     // Distinct comm (`sm-claude-job`) + slug-labelled argv0 for System Monitor.
     // Both keep the word `claude`, which the /\bclaude\b/ reaper gates need.
-    const jobSpawn = claudeSpawnTarget('job', job.slug, claudeBin);
+    const jobArgs = buildClaudeSpawnArgs({
+      prompt,
+      model: personaResolution.model,
+      effort: personaEffort,
+      sessionId,
+      resume: !!resumeTarget,
+      systemPrompt: personaResolution.systemPrompt,
+    });
+    const jobSpawn = claudeSpawnTarget('job', job.slug, claudeBin, jobArgs);
 
     const { child } = withChildAndLog({
       fd,
@@ -6288,24 +6342,18 @@ async function executeJob(job, runDir, defaultCwd, onPid, execCwd, resumeTarget
         // Resume mode passes `--resume <sessionId>` (reconnect to the SAME
         // session) INSTEAD of `--session-id <sessionId>` (mint a new one) —
         // never both, see buildClaudeSpawnArgs.
-        args: buildClaudeSpawnArgs({
-          prompt,
-          model: personaResolution.model,
-          effort: personaEffort,
-          sessionId,
-          resume: !!resumeTarget,
-          systemPrompt: personaResolution.systemPrompt,
-        }),
+        args: jobSpawn.args || jobArgs,
         options: {
           cwd: spawnCwd,
           env: childEnv,
           ...(jobSpawn.argv0 ? { argv0: jobSpawn.argv0 } : {}),
+          ...(jobSpawn.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
           // detached:true puts the child in its own process group so we can kill
           // the entire descendant tree (including any stray background bashes the
-          // agent spawned) with `process.kill(-pid)`. Without this, child.kill()
+          // agent spawned) with killTree(pid). Without this, child.kill()
           // only kills the immediate `claude` process, leaving orphaned subprocs
           // that keep the parent alive (the 2026-05-10 cellar-publish hang).
-          detached: true,
+          ...detachedSpawnOpts(),
         },
       },
       watchdogs: [resultTailWatchdog, deadmanWatchdog, idleTailWatchdog, budgetWatchdog],
@@ -7249,6 +7297,7 @@ async function finalizeJobWorktree({ job, runDir, worktree, guardCwd, carriedPat
   let worktreeIntegrationDetail = null;
   let mergeAutoResolved = null;
   let mergeAutoResolvedPaths = null;
+  let integratedSha = null;
   try {
     worktreeLeftoverDirty = (await uncommitted(worktree.dir)) || [];
     // Salvage the worktree's full diff (tracked + untracked) to the run
@@ -7273,6 +7322,7 @@ async function finalizeJobWorktree({ job, runDir, worktree, guardCwd, carriedPat
       worktreeIntegrationDetail = integration;
       console.error(`[scheduler] ${job.slug}: worktree branch integration FAILED (${integration.reason}) — branch ${worktree.branch} preserved in ${guardCwd} for manual recovery`);
     } else if (integration.integrated) {
+      integratedSha = integration.sha || null;
       console.log(`[scheduler] ${job.slug}: worktree branch ${worktree.branch} integrated into ${guardCwd}${integration.mergeCommit ? ' (merge commit)' : ' (fast-forward)'}`);
       if (integration.autoResolved) {
         mergeAutoResolved = integration.autoResolved;
@@ -7294,7 +7344,7 @@ async function finalizeJobWorktree({ job, runDir, worktree, guardCwd, carriedPat
       await jw.cleanupJobWorktree({ cwd: guardCwd, dir: worktree.dir, branch: worktree.branch, keepBranch: true });
     } catch { /* already reported above */ }
   }
-  return { worktreeLeftoverDirty, salvagePatch, worktreeIntegrationFailure, worktreeIntegrationDetail, mergeAutoResolved, mergeAutoResolvedPaths };
+  return { worktreeLeftoverDirty, salvagePatch, worktreeIntegrationFailure, worktreeIntegrationDetail, mergeAutoResolved, mergeAutoResolvedPaths, integratedSha };
 }
 
 /**
@@ -7686,6 +7736,7 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null, sib
     // self-healed rather than silently looking like an ordinary merge.
     let mergeAutoResolved = null;
     let mergeAutoResolvedPaths = null;
+    let integratedSha = null;
     // A job's uncommitted-work patch, whichever isolation mode produced it —
     // set by EITHER branch below, never both (worktree.ok picks exactly one
     // shape for the whole run). Named generically (not "worktree...") because
@@ -7721,7 +7772,7 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null, sib
       }, reviewInRun);
     } finally {
       if (worktree.ok) {
-        ({ worktreeLeftoverDirty, salvagePatch, worktreeIntegrationFailure, worktreeIntegrationDetail, mergeAutoResolved, mergeAutoResolvedPaths } =
+        ({ worktreeLeftoverDirty, salvagePatch, worktreeIntegrationFailure, worktreeIntegrationDetail, mergeAutoResolved, mergeAutoResolvedPaths, integratedSha } =
           await finalizeJobWorktree({ job, runDir, worktree, guardCwd, carriedPaths }));
       } else {
         // In-place run (non-git cwd, cap reached, env-disabled, or a carry-over
@@ -7873,15 +7924,50 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null, sib
       // Used by the sentinel override: SCHEDULER_VERDICT: PASS + a landed
       // commit together override incidental transcript noise verdicts.
       const headAtExit = await gitHead(guardCwd);
-      const committedDuringRun = await computeCommittedDuringRun(
-        guardCwd,
-        guardHeadBefore,
+      // Worktree runs: attribution comes only from this run's own integration
+      // (a concurrent job's commit moving shared HEAD must not count).
+      const committedInWindow = worktree.ok
+        ? false
+        : await computeCommittedDuringRun(
+          guardCwd,
+          guardHeadBefore,
+          headAtExit,
+          job.startedAt,
+          new Date().toISOString(),
+        );
+      let rangeCommits = [];
+      let transcriptCommitShas = [];
+      let siblingOverlap = false;
+      if (!worktree.ok) {
+        rangeCommits = await gitRangeCommits(guardCwd, guardHeadBefore, headAtExit);
+        transcriptCommitShas = parseLog(path.join(runDir, `${job.slug}.log`)).transcriptCommitShas || [];
+        const overlapState = await readQueue().catch(() => ({ jobs: [] }));
+        const myStart = Date.parse(job.startedAt) || 0;
+        const myEnd = Date.now();
+        siblingOverlap = (overlapState.jobs || []).some((j) => {
+          if (j.slug === job.slug || (j.cwd || defaultCwd) !== guardCwd) return false;
+          if (j.status === 'running') return true;
+          const jStart = Date.parse(j.startedAt);
+          const jEnd = Date.parse(j.finishedAt);
+          if (!Number.isFinite(jStart) && !Number.isFinite(jEnd)) return false;
+          const s0 = Number.isFinite(jStart) ? jStart : jEnd;
+          const e0 = Number.isFinite(jEnd) ? jEnd : jStart;
+          return s0 <= myEnd && e0 >= myStart;
+        });
+      }
+      const attribution = resolveRunCommitAttribution({
+        ranInWorktree: Boolean(worktree.ok),
+        integratedSha,
+        headBefore: guardHeadBefore,
         headAtExit,
-        job.startedAt,
-        new Date().toISOString(),
-      );
-      if (guardHeadBefore && headAtExit && headAtExit !== guardHeadBefore) {
-        jobLandedCommitThisRun = headAtExit;
+        committedInWindow,
+        rangeCommits,
+        transcriptCommitShas,
+        siblingOverlap,
+      });
+      const committedDuringRun = attribution.committedDuringRun;
+      if (attribution.landedCommit) {
+        jobLandedCommitThisRun = attribution.landedCommit;
       }
 
       const prdPath = (await resolveVerifyPrdPath(job)) ?? archivedPrdPathForJob(job);
@@ -7955,7 +8041,9 @@ async function spawnJob(job, runId, runDir, defaultCwd, resumeTarget = null, sib
           (j) => j.slug !== job.slug && j.status === 'running' && (j.cwd || defaultCwd) === guardCwd,
         );
         const guardHeadAfter = await gitHead(guardCwd);
-        const jobSelfCommitted = guardHeadBefore && guardHeadAfter && guardHeadAfter !== guardHeadBefore;
+        const jobSelfCommitted = worktree.ok
+          ? Boolean(jobLandedCommitThisRun)
+          : guardHeadBefore && guardHeadAfter && guardHeadAfter !== guardHeadBefore;
         const guardVerdict = commitGuardVerdict({
           newlyDirty,
           siblingRunning,
@@ -9703,9 +9791,7 @@ function bootRowPid(j, logPathOf) {
 }
 
 function signalAdoptedGroup(pgid, signal, pid) {
-  try { process.kill(-pgid, signal); } catch {
-    try { process.kill(pid, signal); } catch { /* already dead */ }
-  }
+  if (!killTree(pgid, signal)) killTree(pid, signal);
 }
 
 async function superviseAdoptedRunsPass(jobs) {
@@ -13595,6 +13681,7 @@ function registerAdminRoutes(adminHttp, remoteObj = remote) {
 module.exports = {
   reportSchedulerError,
   finalizeJobWorktree,
+  resolveRunCommitAttribution,
   worktreeIntegrationVerdict,
   guardedTick,
   rescheduleIntervalTick,

package/src/main/seedSchedulerMcp.cjs

@@ -38,6 +38,7 @@ const { spawn } = require('node:child_process');
 const { resolveClaudeBin, claudeSpawnTarget } = require('./lib/claudeBin.cjs');
 const { cleanChildEnv, pathWithUserBins } = require('./lib/cleanEnv.cjs');
 const { writeJsonSync } = require('./config.cjs');
+const { nodeSpawnSpec } = require('./lib/appRuntime.cjs');
 
 const SERVER_NAME = 'session-manager-scheduler';
 const MAX_ATTEMPTS = 3; // give a transient first-boot failure a few chances
@@ -102,6 +103,14 @@ function scriptPathMissing() {
   }
 }
 
+/** argv for `claude mcp add`: system `node` in dev/npx, the app binary with
+ *  ELECTRON_RUN_AS_NODE=1 when packaged (an installer user may have no Node). */
+function mcpAddArgv(serverPath) {
+  const spec = nodeSpawnSpec(serverPath);
+  const envFlags = Object.entries(spec.env).flatMap(([k, v]) => ['-e', `${k}=${v}`]);
+  return ['mcp', 'add', SERVER_NAME, '--scope', 'user', ...envFlags, '--', spec.command, ...spec.args];
+}
+
 /** Run `claude mcp add session-manager-scheduler --scope user -- node <serverPath>`.
  *  No shell:true — argv array passed directly to spawn. */
 function runClaudeMcpAdd(serverPath) {
@@ -111,7 +120,7 @@ function runClaudeMcpAdd(serverPath) {
     try {
       proc = spawn(
         target.command,
-        ['mcp', 'add', SERVER_NAME, '--scope', 'user', '--', 'node', serverPath],
+        mcpAddArgv(serverPath),
         {
           ...(target.argv0 ? { argv0: target.argv0 } : {}),
           cwd: os.homedir(),
@@ -200,4 +209,4 @@ async function seedSchedulerMcp({ logger = console, addFn = runClaudeMcpAdd, rem
   }
 }
 
-module.exports = { seedSchedulerMcp, markerPath, MAX_ATTEMPTS, serverScriptPath, SERVER_NAME };
+module.exports = { seedSchedulerMcp, mcpAddArgv, markerPath, MAX_ATTEMPTS, serverScriptPath, SERVER_NAME };

package/src/preload/api.d.ts

@@ -1,5 +1,15 @@
 import type { PromptSession } from '../renderer/state/promptSessions';
 
+/** Mirrors the item shape returned by main/lib/prereqs.cjs checkPrereqs(). */
+export interface PrereqItem {
+  id: string;
+  label: string;
+  ok: boolean;
+  version: string | null;
+  detail: string | null;
+  fix: { command: string; shell: 'sh' | 'powershell'; url?: string } | null;
+}
+
 export interface ActionOutcome {
   ok: boolean;
   kind?: 'info' | 'warn' | 'error';
@@ -464,6 +474,44 @@ export interface OtelSetConfigResult {
   status: OtelStatus;
 }
 
+// Customer feedback — client submissions + owner inbox. Shapes mirror
+// src/main/lib/customerFeedbackClient.cjs and customerFeedbackInbox.cjs.
+export type CustomerFeedbackTag = 'bug' | 'feature' | 'discussion';
+export type CustomerFeedbackStatus = 'open' | 'in_progress' | 'resolved' | 'wontfix';
+
+export interface CustomerFeedbackItem {
+  id: string;
+  receipt: string | null;
+  tag: CustomerFeedbackTag;
+  title: string;
+  body: string;
+  submittedAt: number;
+  status: CustomerFeedbackStatus;
+  statusNote: string | null;
+  statusAt: number | string | null;
+  seenStatusAt: number | string | null;
+}
+
+export interface CustomerFeedbackInboxItem {
+  id: string;
+  receivedAt: string | number | null;
+  tag: CustomerFeedbackTag;
+  title: string;
+  body: string;
+  clientVersion: string | null;
+  clientPlatform: string | null;
+  moderation: string | null;
+  status: CustomerFeedbackStatus;
+  statusNote: string | null;
+  statusAt: string | number | null;
+  epicId: string | null;
+}
+
+export interface CustomerFeedbackOwnerInfo {
+  ownerMode: boolean;
+  projectCwd: string | null;
+}
+
 // Product telemetry (bilko.run) — anonymous, on-by-default, opt-out. See
 // session-manager-operations/architecture/telemetry.md for the data model.
 export interface TelemetryConfig {
@@ -1530,6 +1578,10 @@ export interface ChatExternalSendEvent {
   prompt: string;
 }
 
+export type CreateProjectFolderResult =
+  | { ok: true; path: string }
+  | { ok: false; code: 'invalid-name' | 'invalid-parent' | 'exists' | 'io'; error: string; path?: string };
+
 export interface SessionManagerAPI {
   app: {
     version: () => Promise<string>;
@@ -1539,6 +1591,8 @@ export interface SessionManagerAPI {
     cwd: () => Promise<string>;
     engageRulesPath: () => Promise<string | null>;
     pickDirectory: () => Promise<string | null>;
+    /** Create `<parentDir>/<name>` for a new project; main validates the name. */
+    createProjectFolder: (parentDir: string, name: string) => Promise<CreateProjectFolderResult>;
     gitBranch: (cwd: string) => Promise<string | null>;
     /** Default: request a drain-first restart. `force: true` restarts immediately, killing running jobs. */
     rebootApp: (opts?: { force?: boolean }) => void;
@@ -1550,6 +1604,10 @@ export interface SessionManagerAPI {
     /** Boot diagnostic — resolved claude binary path + whether it was found
      *  on disk (false means spawn will rely on PATH and may ENOENT). */
     claudeBinStatus: () => Promise<{ resolved: string; foundOnDisk: boolean }>;
+    /** Fresh prerequisite probe (git, claude CLI, auth, Git Bash on Windows). */
+    prereqs: () => Promise<PrereqItem[]>;
+    /** Opens the OS terminal running the item's official install command (looked up main-side by id). */
+    prereqsRunFix: (id: string) => Promise<{ ok: true; opener: string } | { ok: false; error: string }>;
     /** Boot diagnostic — assertCwdInsideHome(os.homedir()) result. ok=false
      *  on macOS symlinked-/Users mismatch and blocks all session spawns. */
     homeSelfCheck: () => Promise<{ ok: boolean; error?: string; realCwd?: string }>;
@@ -1752,6 +1810,30 @@ export interface SessionManagerAPI {
     status: () => Promise<OtelStatus>;
     configPath: () => Promise<string>;
   };
+  customerFeedback: {
+    submit: (p: { title: string; body: string; tag: CustomerFeedbackTag }) => Promise<
+      { ok: true; item: CustomerFeedbackItem } | { ok: false; error: string }
+    >;
+    list: () => Promise<CustomerFeedbackItem[]>;
+    refreshStatus: () => Promise<
+      { ok: true; updated: number; unsupported?: true } | { ok: false; error: string }
+    >;
+    /** Omit `ids` to mark everything seen. Resolves to the updated items. */
+    markSeen: (p: { ids?: string[] }) => Promise<CustomerFeedbackItem[]>;
+    ownerInfo: () => Promise<CustomerFeedbackOwnerInfo>;
+    inboxPull: () => Promise<
+      { ok: true; fetched: number; pages: number } | { ok: false; error: string }
+    >;
+    inboxList: (p: { includeHidden?: boolean }) => Promise<
+      { ok: true; items: CustomerFeedbackInboxItem[] } | { ok: false; error: string }
+    >;
+    inboxSetStatus: (p: { id: string; status: CustomerFeedbackStatus; note?: string }) => Promise<
+      { ok: true; item: CustomerFeedbackInboxItem | null } | { ok: false; error: string }
+    >;
+    inboxLinkEpic: (p: { id: string; epicId: string }) => Promise<
+      { ok: true } | { ok: false; error: string }
+    >;
+  };
   telemetry: {
     getConfig: () => Promise<TelemetryConfig>;
     setConfig: (cfg: TelemetryConfig) => Promise<TelemetrySetConfigResult>;

package/src/preload/index.cjs

@@ -8,6 +8,7 @@ contextBridge.exposeInMainWorld('api', {
     cwd: () => ipcRenderer.invoke('app:cwd'),
     engageRulesPath: () => ipcRenderer.invoke('app:engage-rules-path'),
     pickDirectory: () => ipcRenderer.invoke('app:pick-directory'),
+    createProjectFolder: (parentDir, name) => ipcRenderer.invoke('app:create-project-folder', { parentDir, name }),
     gitBranch: (cwd) => ipcRenderer.invoke('app:git-branch', { cwd }),
     rebootApp: (opts) => ipcRenderer.send('app:reboot-app', opts),
     archiveProject: (encoded) => ipcRenderer.invoke('app:archive-project', { encoded }),
@@ -20,6 +21,8 @@ contextBridge.exposeInMainWorld('api', {
     // Boot diagnostics (v0.10.1) — renderer polls at mount to surface
     // missing-claude-bin / home-symlink-mismatch as toasts.
     claudeBinStatus: () => ipcRenderer.invoke('app:claude-bin-status'),
+    prereqs: () => ipcRenderer.invoke('app:prereqs'),
+    prereqsRunFix: (id) => ipcRenderer.invoke('app:prereqs-run-fix', id),
     homeSelfCheck: () => ipcRenderer.invoke('app:home-self-check'),
     seedStatus: () => ipcRenderer.invoke('app:seed-status'),
     delegationReadiness: (cwd) => ipcRenderer.invoke('app:delegation-readiness', { cwd }),
@@ -211,6 +214,17 @@ contextBridge.exposeInMainWorld('api', {
     recentRecords: () => ipcRenderer.invoke('telemetry:recent-records'),
     flushNow: () => ipcRenderer.invoke('telemetry:flush-now'),
   },
+  customerFeedback: {
+    submit: (p) => ipcRenderer.invoke('customerFeedback:submit', p),
+    list: () => ipcRenderer.invoke('customerFeedback:list'),
+    refreshStatus: () => ipcRenderer.invoke('customerFeedback:refresh-status'),
+    markSeen: (p) => ipcRenderer.invoke('customerFeedback:mark-seen', p),
+    ownerInfo: () => ipcRenderer.invoke('customerFeedback:owner-info'),
+    inboxPull: () => ipcRenderer.invoke('customerFeedback:inbox-pull'),
+    inboxList: (p) => ipcRenderer.invoke('customerFeedback:inbox-list', p),
+    inboxSetStatus: (p) => ipcRenderer.invoke('customerFeedback:inbox-set-status', p),
+    inboxLinkEpic: (p) => ipcRenderer.invoke('customerFeedback:inbox-link-epic', p),
+  },
   // Diagnostic only — no handler is registered unless the main process was
   // launched with SM_HEAP_SNAPSHOT=1, so this rejects by default.
   diagnostics: {

package/src/seed/agents/validator.md

@@ -4,14 +4,14 @@ description: Validates a finished PLAN (the PRDs its validate PRD lists) once, a
 tools: Read, Grep, Glob, Bash
 model: sonnet
 title: Engineering — Plan Validator
-seedVersion: 2
+seedVersion: 3
 ---
 
 You are validator. You judge whether a plan's PRDs actually landed what they promised. You do not fix anything, you do not re-implement, you do not queue PRDs — your output is evidence and verdicts, read by the architect who owns the plan.
 
 ## Inputs
 
-Your PRD's `# Acceptance criteria` lists the plan's PRD slugs and where each PRD file lives (`session-manager-operations/scheduler/epics/<epic>/prds/` while queued, `prds-archived/` once terminal — locate by slug in either). Everything else comes from the working tree and `git log`.
+Your PRD's `# Acceptance criteria` lists the plan's PRD slugs. PRD files live under `$SM_PROJECT_ROOT/session-manager-operations/scheduler/epics/<epic>/` — `prds/` while queued, `prds-archived/` (or a timestamped subfolder of it) once terminal; find by slug, e.g. `find "$SM_PROJECT_ROOT/session-manager-operations/scheduler/epics/<epic>" -name '*<slug>.md'`. This folder is gitignored, so it is never present in the job worktree — don't look for it there. If a PRD file is missing, fall back to `$SM_PROJECT_ROOT/session-manager-operations/scheduler/state/queue.json` / `history.jsonl` for that slug's `landedCommit`, and record the missing file as a Minor (not Important) finding. Everything else comes from the working tree and `git log`.
 
 ## Procedure (in this order)