claude-code-session-manager 0.111.0 → 0.113.0

package/src/main/index.cjs

@@ -10,7 +10,7 @@ if (process.env.SM_BOOT_DIAG === '1') {
     process.stderr.write(`[boot-diag] failed: ${err && err.message}\n`);
   }
 }
-const { PROC_NAMES, setProcessTitle, inhibitHolderShell } = require('./lib/smProcNames.cjs');
+const { PROC_NAMES, setProcessTitle, inhibitHolderShell } = require('./lib/process/smProcNames.cjs');
 // Self-describing `comm` in System Monitor (pn-03). process.argv is a JS copy
 // made at startup, so the argv-memory overwrite below never affects the
 // `process.argv.includes('--simple')` read further down.
@@ -23,10 +23,10 @@ const fsp = require('node:fs/promises');
 const os = require('node:os');
 const { schemas, validated } = require('./ipcSchemas.cjs');
 const { createProjectFolder } = require('./lib/projectFolder.cjs');
-const { cleanChildEnv } = require('./lib/cleanEnv.cjs');
-const { applyLoginShellPath } = require('./lib/loginShellPath.cjs');
-const { terminateLosingInstance } = require('./lib/singleInstanceGuard.cjs');
-const { acquireSchedulerOwnership, releaseSchedulerOwnership } = require('./lib/instanceLock.cjs');
+const { cleanChildEnv } = require('./lib/process/cleanEnv.cjs');
+const { applyLoginShellPath } = require('./lib/process/loginShellPath.cjs');
+const { terminateLosingInstance } = require('./lib/process/singleInstanceGuard.cjs');
+const { acquireSchedulerOwnership, releaseSchedulerOwnership } = require('./lib/process/instanceLock.cjs');
 const { manager: ptyManager, registerPtyHandlers } = require('./pty.cjs');
 const configMgr = require('./config.cjs');
 const transcripts = require('./transcripts.cjs');
@@ -57,34 +57,30 @@ crashDiagnostics.startCrashReporter();
 const voiceHotkey = require('./voiceHotkey.cjs');
 const voiceWizard = require('./voiceWizard.cjs');
 const scheduler = require('./scheduler.cjs');
-const { createAdminHttp } = require('./lib/localAdminHttp.cjs');
-const prdCreate = require('./lib/prdCreate.cjs');
-const prdAdminRoutes = require('./lib/prdAdminRoutes.cjs');
-const projectHomeAdminRoutes = require('./lib/projectHomeAdminRoutes.cjs');
-const macroAdminRoutes = require('./lib/macroAdminRoutes.cjs');
+const { createAdminHttp } = require('./lib/feedback-remote/localAdminHttp.cjs');
+const prdCreate = require('./lib/prd/prdCreate.cjs');
+const prdAdminRoutes = require('./lib/prd/prdAdminRoutes.cjs');
+const projectHomeAdminRoutes = require('./lib/feedback-remote/projectHomeAdminRoutes.cjs');
+const macroAdminRoutes = require('./lib/feedback-remote/macroAdminRoutes.cjs');
 const { smfileResponseHeaders, shouldBlockFrameNavigation } = require('./lib/smfileHeaders.cjs');
-const { appendAuditEvent } = require('./lib/auditLog.cjs');
+const { appendAuditEvent } = require('./lib/telemetry/auditLog.cjs');
 const chatRunner = require('./chatRunner.cjs');
 const promptSessionEvents = require('./promptSessionEvents.cjs');
-const activeIndexMerge = require('./lib/activeIndexMerge.cjs');
-const promptSessionsCreateEpic = require('./lib/promptSessionsCreateEpic.cjs');
-const customerFeedbackIpc = require('./lib/customerFeedbackIpc.cjs');
-const epicWorktreeMint = require('./lib/epicWorktreeMint.cjs');
-const epicWorktreeMerge = require('./lib/epicWorktreeMerge.cjs');
-const epicWorktreeProjectConfig = require('./lib/epicWorktreeProjectConfig.cjs');
-const agentLibrary = require('./agentLibrary.cjs');
-const macroLibrary = require('./lib/macroLibrary.cjs');
-const agentModelResolve = require('./lib/agentModelResolve.cjs');
-const agentEffortResolve = require('./lib/agentEffortResolve.cjs');
-const { resolveEffectiveModelInfo } = require('./lib/effectiveModelInfo.cjs');
-const { resolveModelCatalog } = require('./lib/modelCatalog.cjs');
-const { checkDelegationReadiness, ensureGuardsInstalled, installPrdWriteGuard, installDestructiveGitGuard, installInlineImplementationGuard, installSelfScheduleGuard } = require('./lib/delegationReadiness.cjs');
+const activeIndexMerge = require('./lib/epic/activeIndexMerge.cjs');
+const promptSessionsCreateEpic = require('./lib/epic/promptSessionsCreateEpic.cjs');
+const customerFeedbackIpc = require('./lib/feedback-remote/customerFeedbackIpc.cjs');
+const epicWorktreeMint = require('./lib/epic/epicWorktreeMint.cjs');
+const epicWorktreeMerge = require('./lib/epic/epicWorktreeMerge.cjs');
+const epicWorktreeProjectConfig = require('./lib/epic/epicWorktreeProjectConfig.cjs');
+const macroLibrary = require('./lib/persona-macro/macroLibrary.cjs');
+const { resolveModelCatalog } = require('./lib/claude/modelCatalog.cjs');
+const { checkDelegationReadiness, ensureGuardsInstalled, installPrdWriteGuard, installDestructiveGitGuard, installInlineImplementationGuard, installSelfScheduleGuard } = require('./lib/epic/delegationReadiness.cjs');
 const { resolveProjectContext } = require('./lib/projectRootResolve.cjs');
-const upgradeDrain = require('./lib/upgradeDrain.cjs');
+const upgradeDrain = require('./lib/scheduler/upgradeDrain.cjs');
 const { writeGuardShims } = require('./lib/guardShims.cjs');
 const { MCP_TOOL_CATALOG, MCP_RECIPES } = require('./lib/mcpToolCatalog.cjs');
 const { sendIfAlive } = require('./lib/sendToRenderer.cjs');
-const crossProjectFeedback = require('./lib/crossProjectFeedback.cjs');
+const crossProjectFeedback = require('./lib/feedback-remote/crossProjectFeedback.cjs');
 const adminHttp = createAdminHttp();
 scheduler.registerAdminRoutes(adminHttp);
 prdCreate.registerAdminRoute(adminHttp, scheduler.remote);
@@ -94,9 +90,9 @@ macroAdminRoutes.registerAdminRoute(adminHttp, { onChanged: () => broadcastMacro
 chatRunner.registerAdminRoute(adminHttp);
 // Project-to-project feedback conduit — the app is the only process holding
 // several projects' operations roots open, so it performs the cross-folder
-// write (lib/crossProjectFeedback.cjs).
+// write (lib/feedback-remote/crossProjectFeedback.cjs).
 crossProjectFeedback.registerAdminRoute(adminHttp);
-require('./lib/customerFeedbackAdminRoutes.cjs').registerAdminRoute(adminHttp);
+require('./lib/feedback-remote/customerFeedbackAdminRoutes.cjs').registerAdminRoute(adminHttp);
 const supervisor = require('./supervisor.cjs');
 const watchers = require('./watchers.cjs');
 const queueOps = require('./queueOps.cjs');
@@ -107,22 +103,18 @@ const { seedSchedulerMcp } = require('./seedSchedulerMcp.cjs');
 const { getSeedStatus } = require('./seedStatus.cjs');
 const otel = require('./otel.cjs');
 const otelSettings = require('./otelSettings.cjs');
-const telemetrySettings = require('./lib/telemetrySettings.cjs');
-const telemetryClient = require('./lib/telemetryClient.cjs');
-const telemetryBacklog = require('./lib/telemetryBacklog.cjs');
-const telemetryConsent = require('./lib/telemetryConsent.cjs');
 const { registerHistoryAggregatorHandlers, finalizeClosedDays, refreshIntradayToday } = require('./historyAggregator.cjs');
-const runLogRetention = require('./lib/runLogRetention.cjs');
+const runLogRetention = require('./lib/scheduler/runLogRetention.cjs');
 const { registerHistoryDashboardHandlers } = require('./historyDashboard.cjs');
-const { tryAcquireLock, releaseLock, DEFAULT_LOCK_PATH } = require('./lib/watchdogHelpers.cjs');
+const { tryAcquireLock, releaseLock, DEFAULT_LOCK_PATH } = require('./lib/scheduler/watchdogHelpers.cjs');
 const { createIntradayRefresh } = require('./lib/intradayRefresh.cjs');
-const schedulerConfig = require('./lib/schedulerConfig.cjs');
+const schedulerConfig = require('./lib/scheduler/schedulerConfig.cjs');
 const memoryTool = require('./memoryTool.cjs');
 const { registerMemoryAggregateIpc } = require('./memoryAggregate.cjs');
 const { registerProjectBriefIpc } = require('./projectBrief.cjs');
 const { registerProjectPagesIpc, attachWindow: attachProjectPagesWindow, closeAllOutputWatchers: closeAllProjectPagesWatchers } = require('./projectPages.cjs');
 const promptSessionTranscript = require('./promptSessionTranscript.cjs');
-const { computeEpicDelegationStats } = require('./lib/epicDelegationStats.cjs');
+const { computeEpicDelegationStats } = require('./lib/epic/epicDelegationStats.cjs');
 const agentMemory = require('./agentMemory.cjs');
 const git = require('./git.cjs');
 const heapSnapshot = require('./heapSnapshot.cjs');
@@ -130,14 +122,16 @@ const filesIpc = require('./files.cjs');
 const { registerDocEditHandlers, attachWindow: attachDocEditWindow } = require('./docEdit.cjs');
 const webRemote = require('./webRemote.cjs');
 const { registerRemoteClientHandlers } = require('./remoteClientIpc.cjs');
+const { registerAgentsHandlers } = require('./agentsIpc.cjs');
+const { registerTelemetryHandlers } = require('./telemetryIpc.cjs');
 const { registerUpdaterIpc } = require('./updaterIpc.cjs');
 const { listExchanges } = require('./exchanges.cjs');
-const { resolveClaudeBin } = require('./lib/claudeBin.cjs');
+const { resolveClaudeBin } = require('./lib/claude/claudeBin.cjs');
 const { checkInsideHome, assertInsideHome } = require('./lib/insideHome.cjs');
 const { openInEditor, openFileInEditor, openInFinder, openInTerminal, runInTerminal } = require('./lib/openExternalApp.cjs');
 const { checkPrereqs } = require('./lib/prereqs.cjs');
-const { rebuildActiveIndex } = require('./lib/activeIndexRebuild.cjs');
-const { activeIndexPath: promptSessionsActiveIndexPath } = require('./lib/epicMint.cjs');
+const { rebuildActiveIndex } = require('./lib/epic/activeIndexRebuild.cjs');
+const { activeIndexPath: promptSessionsActiveIndexPath } = require('./lib/epic/epicMint.cjs');
 const { allProjectCwds } = require('./lib/activeSessions.cjs');
 const { scheduleBootSelfHeal } = require('./lib/bootSelfHeal.cjs');
 
@@ -354,7 +348,7 @@ function relaunchViaNpx() {
 
 /**
  * rebootApp({force}) — restart is a REQUEST that drains first and never kills
- * (lib/upgradeDrain.cjs): dispatch pauses, running jobs finish, then the
+ * (lib/scheduler/upgradeDrain.cjs): dispatch pauses, running jobs finish, then the
  * scheduler's heartbeat-driven drain calls performReboot(). `force: true`
  * keeps the old immediate behaviour (kills running executors) for humans who
  * accept the cost.
@@ -480,7 +474,7 @@ function createWindow() {
     // known project has already accumulated, marking exactly what's
     // CONFIRMED delivered. Fired after the window is shown (never blocks
     // startup) and yields between files internally. See telemetryBacklog.cjs.
-    require('./lib/telemetryBacklog.cjs')
+    require('./lib/telemetry/telemetryBacklog.cjs')
       .bootDrain({ appVersion: app.getVersion() })
       .catch((e) => {
         logs.writeLine({ scope: 'telemetry', level: 'warn', message: 'telemetryBacklog.bootDrain failed', meta: { error: e?.message } });
@@ -583,36 +577,6 @@ ipcMain.handle('mcp:status', () => probeMcpStatus());
 // the renderer never makes a direct HTTP call. Static data, no cwd needed.
 ipcMain.handle('mcp:catalog', () => ({ ok: true, tools: MCP_TOOL_CATALOG, recipes: MCP_RECIPES }));
 
-// Agent Library nav page (Home face only): global `~/.claude/agents/*.md`
-// personas plus, per currently-open project tab, whether that project
-// overlays the same agent name at `<cwd>/.claude/agents/<name>.md`. Read-only.
-ipcMain.handle('agents:list-personas', () => agentLibrary.listPersonas());
-// Agent Library CRUD — global personas only (`~/.claude/agents/*.md`); a
-// project's local overlay can only be removed here (removeOverride), never
-// created, since Agent Library is a Home-face, machine-wide surface with no
-// per-tab cwd context of its own. Each mutation broadcasts `agents:changed`
-// so Agent Library and Tag Library — two independently-mounted dockview
-// panels, each with its own component-local `listPersonas()` snapshot —
-// both refresh off the one file on disk instead of one panel going stale
-// after the other edits the agent<->tag relationship.
-function broadcastAgentsChanged() {
-  sendIfAlive(mainWindow, 'agents:changed', {});
-}
-ipcMain.handle('agents:save-persona', validated(schemas.agentsSavePersona, async (payload) => {
-  const result = await agentLibrary.savePersona(payload);
-  broadcastAgentsChanged();
-  return result;
-}));
-ipcMain.handle('agents:delete-persona', async (_e, payload) => {
-  const result = await agentLibrary.deletePersona(payload);
-  broadcastAgentsChanged();
-  return result;
-});
-ipcMain.handle('agents:remove-override', async (_e, payload) => {
-  const result = await agentLibrary.removeOverride(payload);
-  broadcastAgentsChanged();
-  return result;
-});
 // Macro library (macroLibrary.cjs): global machine-local one-click sidebar
 // macros (agent + tag + prompt). Store path is fixed in-module; the renderer
 // never supplies it. Mutations broadcast `macros:changed`.
@@ -635,31 +599,6 @@ ipcMain.handle('macros:set-project', validated(schemas.macrosSetProject, async (
   if (result.ok) broadcastMacrosChanged();
   return result;
 }));
-// New Epic AIM composer (epicIntake.ts's `agentBody`/`agentPath`): unlike
-// list-personas above (global dir only), this honors the project-overlay-
-// then-global precedence so an Epic's opening prompt carries the persona
-// body that actually applies to its cwd. Read-only.
-ipcMain.handle('agents:get-persona-body', validated(schemas.agentsGetPersonaBody, (payload) =>
-  agentLibrary.getPersonaBody(payload)));
-
-// "What will this Epic's launch actually use for --model?" — the SAME
-// resolver chatRunner.cjs's Chat-view launch calls in-process
-// (agentModelResolve.cjs's resolveEpicModel), reached here so Terminal's
-// launch (EpicTerminalPane.tsx, a renderer module with no fs access) agrees
-// with Chat by calling the identical function rather than a second one that
-// is merely supposed to. Never throws (resolveEpicModel's own contract).
-ipcMain.handle('agents:resolve-epic-model', validated(schemas.agentsResolveEpicModel, (payload) =>
-  agentModelResolve.resolveEpicModel(payload)));
-// Effort twin of the above (agentEffortResolve.cjs): Terminal appends
-// `--effort <level>` only when `effort` is non-null. Never throws.
-ipcMain.handle('agents:resolve-epic-effort', validated(schemas.agentsResolveEpicEffort, (payload) =>
-  agentEffortResolve.resolveEpicEffort(payload)));
-
-// "What will this Epic actually run as?" (PRD: effective-model-resolver) —
-// persona alias + evidence-based concrete model id + provenance, for a given
-// (cwd, agentType). Read-only observer; never affects what a launch resolves.
-ipcMain.handle('agents:resolve-model-info', validated(schemas.agentsResolveModelInfo, (payload) =>
-  resolveEffectiveModelInfo(payload)));
 
 // Live model/effort catalog (modelCatalog.cjs) — never throws; `force` bypasses its cache.
 ipcMain.handle('models:catalog', validated(schemas.modelsCatalog, (payload) =>
@@ -700,7 +639,7 @@ ipcMain.handle('app:delegation-readiness', validated(schemas.delegationReadiness
 // session-manager-operations/logs/errors-<date>.jsonl, same shape as every
 // other structured error line.
 function logGuardInstallAttempt(guard, cwd, outcome) {
-  const opsErrorLog = require('./lib/opsErrorLog.cjs');
+  const opsErrorLog = require('./lib/telemetry/opsErrorLog.cjs');
   opsErrorLog.appendError({
     cwd,
     scope: 'delegationReadinessGuardInstall',
@@ -1101,6 +1040,7 @@ filesIpc.registerFilesHandlers();
 registerDocEditHandlers();
 webRemote.registerRemoteHandlers();
 registerRemoteClientHandlers(() => mainWindow);
+registerAgentsHandlers({ ipcMain, getWindow: () => mainWindow });
 try {
   registerUpdaterIpc({ ipcMain, getWindow: () => mainWindow, ptyManager });
 } catch (e) {
@@ -1126,35 +1066,7 @@ ipcMain.handle('exchanges:list', validated(schemas.exchangesList, async (payload
   }
 }));
 
-// OTEL telemetry export (opt-in via ~/.claude/session-manager/otel.json).
-ipcMain.handle('otel:get-config', async () => otelSettings.load());
-ipcMain.handle('otel:set-config', async (_e, cfg) => {
-  if (!otelSettings.isValid(cfg)) {
-    return { ok: false, error: 'invalid config' };
-  }
-  const saved = await otelSettings.save(cfg);
-  const result = await otel.applyConfig(saved);
-  return { ok: !!result?.ok, error: result?.error ?? null, config: saved, status: otel.status() };
-});
-ipcMain.handle('otel:status', () => otel.status());
-ipcMain.handle('otel:config-path', () => otelSettings.storePath());
-
-// Product telemetry (bilko.run) — anonymous, on-by-default, opt-out consent
-// UX + inspector over the client PRDs above wired. Settings > Telemetry's
-// "Product telemetry" section is the sole UI surface for this; see
-// session-manager-operations/architecture/telemetry.md for the data model.
-ipcMain.handle('telemetry:get-config', async () => telemetrySettings.load());
-ipcMain.handle('telemetry:set-config', validated(schemas.telemetrySetConfig, async (cfg) => {
-  const saved = await telemetryConsent.applyConsentUpdate(cfg, { telemetrySettings, telemetryClient });
-  return { ok: true, config: saved, status: telemetryClient.status() };
-}));
-ipcMain.handle('telemetry:status', () => ({
-  ...telemetryClient.status(),
-  backlog: telemetryBacklog.lastRunSummary(),
-}));
-ipcMain.handle('telemetry:config-path', () => telemetrySettings.storePath());
-ipcMain.handle('telemetry:recent-records', () => telemetryClient.recentRecords());
-ipcMain.handle('telemetry:flush-now', () => telemetryClient.flush('manual'));
+registerTelemetryHandlers({ ipcMain });
 
 // Diagnostic-only renderer heap snapshot. No-op unless SM_HEAP_SNAPSHOT=1 —
 // see heapSnapshot.cjs for why this stays off by default.
@@ -1292,14 +1204,14 @@ app.whenReady().then(async () => {
 
   process.on('uncaughtException', (err) => {
     try {
-      require('./lib/telemetryClient.cjs').reportError({ name: 'uncaughtException', msg: err?.message, stack: err?.stack });
+      require('./lib/telemetry/telemetryClient.cjs').reportError({ name: 'uncaughtException', msg: err?.message, stack: err?.stack });
     } catch { /* telemetry must never break the existing handling below */ }
     logs.writeLine({ scope: 'main', level: 'error', message: 'uncaughtException', meta: { error: err?.message, stack: err?.stack } });
   });
   process.on('unhandledRejection', (reason) => {
     const r = reason instanceof Error ? { error: reason.message, stack: reason.stack } : { reason: String(reason) };
     try {
-      require('./lib/telemetryClient.cjs').reportError({ name: 'unhandledRejection', msg: r.error || r.reason, stack: r.stack });
+      require('./lib/telemetry/telemetryClient.cjs').reportError({ name: 'unhandledRejection', msg: r.error || r.reason, stack: r.stack });
     } catch { /* telemetry must never break the existing handling below */ }
     logs.writeLine({ scope: 'main', level: 'error', message: 'unhandledRejection', meta: r });
   });
@@ -1307,7 +1219,7 @@ app.whenReady().then(async () => {
   // Telemetry boot sequence: flush('boot') always, flush('version-change')
   // when detected, and the once-per-machine install upsert (app_installs) when
   // due (version bump or 30-day liveness heartbeat). See telemetryBoot.cjs.
-  require('./lib/telemetryBoot.cjs')
+  require('./lib/telemetry/telemetryBoot.cjs')
     .bootSequence({
       appVersion: app.getVersion(),
       installChannel: require('./lib/machineProfile.cjs').resolveInstallChannel({ appPath: app.getAppPath() }),
@@ -1490,7 +1402,13 @@ app.whenReady().then(async () => {
     console.log(`[main] scheduler ownership held by pid ${ownership.holderPid} — running scheduler-passive (no reconciliation, no admin server)`);
     logs.writeLine({ scope: 'scheduler', level: 'info', message: 'scheduler-passive: ownership held by another instance', meta: { holderPid: ownership.holderPid } });
   }
-  // First-boot default: install the bundled session-manager-dev plugin (its 10
+  // Sweep orphaned `<file>.tmp-<pid>-…` files from crashed atomic writers in the
+  // machine-global state dir (per-project dirs belong to reconcile).
+  try {
+    const { removed } = require('./lib/util/atomicFs.cjs').sweepStaleTmpFiles(path.join(os.homedir(), '.claude', 'session-manager'));
+    logs.writeLine({ scope: 'main', level: 'info', message: 'stale tmp sweep', meta: { removed: removed.length } });
+  } catch { /* sweep is best-effort */ }
+  // First-boot default: install the bundled session-manager-dev plugin (its 3
   // dev skills) from the app's own marketplace. One-shot + idempotent; never
   // throws. SM_SEED_DEV_PLUGIN_DISABLE=1 to opt out.
   seedDevPlugin({ logger: console, writeLog: logs.writeLine }).catch((e) => {
@@ -1560,7 +1478,7 @@ app.whenReady().then(async () => {
   }, 30_000);
   // Keep TODAY's rollup line current so the History dashboard never needs to
   // fall back to a live transcript scan. Shares the same O_EXCL lock file as
-  // the external watchdog's finalize pass (src/main/lib/watchdogHelpers.cjs)
+  // the external watchdog's finalize pass (src/main/lib/scheduler/watchdogHelpers.cjs)
   // so the two never interleave writes to the rollup; a contended lock just
   // means this tick's refresh is skipped (harmless — the next tick retries).
   const intradayTimer = setInterval(runIntradayRefresh, schedulerConfig.HISTORY_INTRADAY_REFRESH_MS);
@@ -1663,5 +1581,5 @@ app.on('before-quit', () => {
   // Best-effort delivery attempt for whatever telemetry accumulated this run.
   // flush() only removes records it actually delivered — an interrupted or
   // failed attempt leaves the queue file intact for the next boot's flush.
-  require('./lib/telemetryClient.cjs').flush('quit').catch(() => {});
+  require('./lib/telemetry/telemetryClient.cjs').flush('quit').catch(() => {});
 });

package/src/main/ipcSchemas.cjs

@@ -10,10 +10,10 @@ const { z } = require('zod');
 const os = require('node:os');
 const path = require('node:path');
 const { PromptSessionSchema, EpicTagSchema, EpicSourceSchema, EpicIntakeSectionSchema } = require('./lib/promptSessionSchema.cjs');
-const { PrdWorkTypeSchema } = require('./lib/workTypeLibrary.cjs');
+const { PrdWorkTypeSchema } = require('./lib/prd/workTypeLibrary.cjs');
 const { PERSONA_NAME_RE } = require('./agentLibrary.cjs');
-const { AgentPersonaSaveSchema } = require('./lib/agentPersonaSchema.cjs');
-const { MacroSaveSchema, MacroDeleteSchema, MacroSetProjectSchema } = require('./lib/macroLibrary.cjs');
+const { AgentPersonaSaveSchema } = require('./lib/persona-macro/agentPersonaSchema.cjs');
+const { MacroSaveSchema, MacroDeleteSchema, MacroSetProjectSchema } = require('./lib/persona-macro/macroLibrary.cjs');
 
 // ──────────────────────────────────────────── PTY
 const ptySpawn = z.object({
@@ -144,7 +144,7 @@ const configWatchOpts = z.object({ depth: z.number().int().min(0).max(2) }).stri
 const configParseImports = z.object({ path: z.string().min(1).max(4096) });
 
 // ──────────────────────────────────────────── PromptSessions (Epics) active-index merge
-// lib/activeIndexMerge.cjs's read-merge-write, invoked over IPC by the
+// lib/epic/activeIndexMerge.cjs's read-merge-write, invoked over IPC by the
 // renderer's persistActiveIndex (state/promptSessions.ts) instead of that
 // module doing its own config:read-json/config:write-json round trip. Payload
 // carries only the CALLING renderer's in-memory contribution for this cwd —
@@ -204,7 +204,7 @@ const promptSessionsMergeActiveIndex = z.object({
   source: z.literal('epics'),
 });
 
-// Renderer entry point for main's ensureEpic() (lib/promptSessionsCreateEpic.cjs)
+// Renderer entry point for main's ensureEpic() (lib/epic/promptSessionsCreateEpic.cjs)
 // — additive step 1 of a two-PRD chain; unused by the app until the next PRD
 // routes state/promptSessions.ts's createPromptSession through it. `tag`/
 // `source` reuse promptSessionSchema.cjs's own enums rather than retyping
@@ -226,14 +226,14 @@ const promptSessionsCreateEpic = z.object({
 });
 
 // Renderer entry point for creating an Epic's isolated git worktree
-// (lib/epicWorktreeMint.cjs) at the proposed->active transition — PRD 1033.
+// (lib/epic/epicWorktreeMint.cjs) at the proposed->active transition — PRD 1033.
 const promptSessionsCreateWorktree = z.object({
   cwd: z.string().min(1).max(4096),
   epicId: z.string().regex(PROMPT_SESSION_ID_RE),
 });
 
 // Renderer entry point for folding an Epic's isolated git worktree branch
-// back into its owning project's main tree (lib/epicWorktreeMerge.cjs) — PRD
+// back into its owning project's main tree (lib/epic/epicWorktreeMerge.cjs) — PRD
 // 1034, the ONLY point where the per-Epic isolation PRD 1033 wires resolves.
 // `branch`/`dir` are supplied by the caller (the renderer's own in-memory
 // `session.worktree`) rather than re-derived from active-index.json, since
@@ -253,7 +253,7 @@ const promptSessionsMergeToMain = z.object({
 });
 
 // Renderer entry points for the per-project "disable Epic worktree
-// isolation" UI toggle (lib/epicWorktreeProjectConfig.cjs) — PRD 1035.
+// isolation" UI toggle (lib/epic/epicWorktreeProjectConfig.cjs) — PRD 1035.
 const promptSessionsGetWorktreeDisabled = z.object({
   cwd: z.string().min(1).max(4096),
 });
@@ -415,7 +415,7 @@ const schedulerCreatePrd = z.object({
   // User-selected work-type tag (PRD 774; independence from the parent
   // Epic's own tag confirmed PRD 1041) — deterministic, never LLM-classified.
   // Epic tag and PRD tag draw on the same WorkType vocabulary
-  // (lib/workTypeLibrary.cjs) but are independent values; 'discussion' is
+  // (lib/prd/workTypeLibrary.cjs) but are independent values; 'discussion' is
   // excluded here for the same reason adminPrdFrontmatterPatch excludes it
   // below — a discussion-tagged Epic never reaches PRD authoring.
   tag: PrdWorkTypeSchema.optional(),
@@ -618,7 +618,7 @@ const setSessionSlotsSchema = z.object({
 // agents:save-persona — the Agent entity (Agent/WorkType/Epic/PRD/Job ERD)
 // had no boundary validation until this schema; Epic and Job each got theirs
 // only after a production incident (see scheduleJobSchema.cjs's header).
-// Full field-level rules live in lib/agentPersonaSchema.cjs, mirroring
+// Full field-level rules live in lib/persona-macro/agentPersonaSchema.cjs, mirroring
 // AgentPersonaSaveInput (src/preload/api.d.ts) field-for-field.
 const agentsSavePersona = AgentPersonaSaveSchema;
 const macrosSave = MacroSaveSchema;
@@ -919,6 +919,9 @@ const chatRun = z.object({
   // Originating PromptTicket.id (PRD 748) when this run was dequeued from a
   // tab's prompt queue — absent for a fresh manual send with no ticket.
   promptId: z.string().min(1).max(128).optional(),
+  // Who authored this send. Only 'human' is auto-approve evidence for
+  // crossProjectFeedback; absent or any other value is treated as not-human.
+  origin: z.enum(['human', 'external', 'inbound-proposal']).optional(),
 });
 
 const chatCancel = z.object({

package/src/main/lib/CLAUDE.md

@@ -0,0 +1,48 @@
+# src/main/lib/ — scoped context
+
+Shared main-process helpers (CommonJS `.cjs`). Layout source of truth: `scripts/lib-layout.json`.
+
+## What's here
+
+- `claude/` — claude CLI binary, caps, model/effort resolution.
+- `epic/` — Epic mint, worktrees, active index, spawn plan/cwd, transcripts.
+- `feedback-remote/` — cross-project and customer feedback conduits.
+- `git/` — git exec, worktrees, branch sweeps, job worktrees.
+- `persona-macro/` — agent persona schema/merge, macro library, builtin macros.
+- `prd/` — PRD parsing helpers, admin routes, dep-slug resolution, plan validation.
+- `process/` — child processes, kill tree, env cleaning, pid liveness, instance lock.
+- `scheduler/` — dispatch loop, session slots, gates, supervisors, queue helpers.
+- `telemetry/` — audit/ops error logs, crash and OTLP telemetry.
+- `util/` — generic pure helpers (atomic fs, kebab, home/cwd encoding, JSON extract, tail).
+- top-level files — cross-cutting modules that fit no domain (`opsOwnership`, `activeSessions`, `projectRootResolve`, `cwdClassify`).
+- `__tests__/` — tests for top-level modules; subfolders carry their own.
+
+## Where a new module goes
+
+Put it in the subfolder whose domain it serves; pure and domain-free goes in `util/`.
+A new top-level `lib/` module needs a stated reason (no domain fits) in its header comment,
+and a `scripts/lib-layout.json` entry. Never add a subfolder for one file.
+
+## Reuse before writing
+
+Each of these was found duplicated once. Grep first; extend the canonical one.
+
+| Need | Canonical | Function |
+| --- | --- | --- |
+| Atomic write (tmp+rename) | `util/atomicFs.cjs` | `writeTextAtomic[Sync]`, `writeJsonAtomic[Sync]` |
+| JSON read with fallback | `util/atomicFs.cjs` | `readJsonOr`, `readJsonOrSync` |
+| PID liveness | `process/pidAlive.cjs` | `pidAlive` |
+| Kebab / slug | `util/kebabCase.cjs` | `kebabCase` |
+| Project root, read-only/total (never throws) | `activeSessions.cjs` | `projectRootOf` |
+| Project root, validated; `opsInternal:'refuse'` for writers | `opsOwnership.cjs` | `resolveProjectRoot` |
+| Project root + Epic from session/epic hints | `projectRootResolve.cjs` | `resolveProjectContext` |
+| Ops-root path (single-writer law) | `opsOwnership.cjs` | `opsPath` |
+| Run git | `git/gitExec.cjs` | `execGit` |
+| Spawn `claude -p` (only machine-wide cap) | `scheduler/sessionSlots.cjs` | `acquire`, `release` |
+
+Pin `--model` on every `claude -p` spawn.
+
+## What must NOT be assumed
+
+- Never `path.join` an agent cwd to build an ops path — use `opsPath`.
+- No private process caps, no hand-rolled tmp+rename, no new `JSON.parse(readFileSync)` fallbacks.

package/src/main/lib/activeSessions.cjs

@@ -12,7 +12,7 @@ const fs = require('node:fs');
 const fsp = require('node:fs/promises');
 const os = require('node:os');
 const path = require('node:path');
-const { KIND_CONFIG: WORKTREE_KIND_CONFIG } = require('./gitWorktree.cjs');
+const { KIND_CONFIG: WORKTREE_KIND_CONFIG } = require('./git/gitWorktree.cjs');
 const { OPS_ROOT_DIR } = require('./opsOwnership.cjs');
 const { classifyCwd, worktreeMainRootOf } = require('./cwdClassify.cjs');
 
@@ -37,6 +37,17 @@ const TMP_DROP_ROOTS = {
   get prefixDropRoots() { return [WORKTREE_KIND_CONFIG.job.root, WORKTREE_KIND_CONFIG.epic.root]; },
 };
 
+// Test-harness project cwds live at <tmpdir>/sst-*/…. They are never real
+// projects, and leaking them into the active list made the renderer's batched
+// config:watch hit 618 "Path outside allowed boundaries" rejects. Only the
+// `sst-` first segment is matched, so test-stubbed HOMEs that are not sst-*
+// dirs (see the exactDropCwds note above) are still kept.
+function isSstHarnessCwd(cwd) {
+  const rel = path.relative(TMPDIR, cwd);
+  if (rel === '' || rel.startsWith('..') || path.isAbsolute(rel)) return false;
+  return rel.split(path.sep)[0].startsWith('sst-');
+}
+
 // Transcript reads only need the last line with a `cwd` field — a few dozen
 // lines is always enough. 64 KB keeps peak RSS proportionate.
 const TAIL_BYTES = 64 * 1024;
@@ -389,6 +400,7 @@ function deriveCwds(records, maxAgeMin, maxCwds, tmpDropRoots) {
       return rel !== '' && !rel.startsWith('..') && !path.isAbsolute(rel);
     });
     if (isUnderPrefixDropRoot) return;
+    if (isSstHarnessCwd(cwd)) return;
     if (seen.has(cwd) || result.length >= maxCwds) return;
     // Must exist AND be a directory — a transcript naming a since-deleted
     // path, or a file, is not a project.
@@ -456,6 +468,7 @@ module.exports = {
   allProjectCwds,
   projectRootOf,
   worktreeMainRootOf,
+  isSstHarnessCwd,
   bustProjectCwdCache,
   __waitForPendingRefresh,
 };

package/src/main/lib/classifyPromptTicket.cjs

@@ -16,8 +16,8 @@
  */
 
 const { spawn } = require('node:child_process');
-const { resolveClaudeBin, claudeSpawnTarget } = require('./claudeBin.cjs');
-const { cleanChildEnv, pathWithUserBins } = require('./cleanEnv.cjs');
+const { resolveClaudeBin, claudeSpawnTarget } = require('./claude/claudeBin.cjs');
+const { cleanChildEnv, pathWithUserBins } = require('./process/cleanEnv.cjs');
 
 const CLASSIFY_TIMEOUT_MS = 30_000;
 const CLASSIFY_MODEL = 'sonnet';

package/src/main/lib/{agentModelResolve.cjs → claude/agentModelResolve.cjs}

@@ -29,10 +29,10 @@
 
 const path = require('node:path');
 const os = require('node:os');
-const { splitFrontmatter } = require('./prdFrontmatter.cjs');
-const { readActiveIndex, resolvePersonaPaths } = require('./epicMint.cjs');
-const { resolveMergedPersona, PERSONA_NAME_RE } = require('./personaMerge.cjs');
-const configMgr = require('../config.cjs');
+const { splitFrontmatter } = require('../prd/prdFrontmatter.cjs');
+const { readActiveIndex, resolvePersonaPaths } = require('../epic/epicMint.cjs');
+const { resolveMergedPersona, PERSONA_NAME_RE } = require('../persona-macro/personaMerge.cjs');
+const configMgr = require('../../config.cjs');
 
 /** The hardcoded floor every branch of resolveEpicModel falls back to — --model must never be omitted (CLAUDE.md "Automation model pinning"). */
 const FALLBACK_MODEL = 'sonnet';
@@ -55,7 +55,7 @@ function logDanglingPersonaOnce(cwd, agentType) {
     // Required lazily: opsErrorLog.cjs is a leaf module with no Electron
     // dependency, but keeping this require inside the miss path avoids
     // paying for it on the (overwhelmingly common) hit path.
-    const { appendError } = require('./opsErrorLog.cjs');
+    const { appendError } = require('../telemetry/opsErrorLog.cjs');
     appendError({
       cwd,
       scope: 'agentModelResolve',
@@ -218,10 +218,10 @@ async function resolvePrdPersonaForSpawn({ cwd, agentType, fallbackModel = FALLB
   const miss = { model: fallbackModel, systemPrompt: null, personaPath: null };
   if (!agentType) return miss;
   try {
-    const getBody = deps.getPersonaBody || require('../agentLibrary.cjs').getPersonaBody;
+    const getBody = deps.getPersonaBody || require('../../agentLibrary.cjs').getPersonaBody;
     const persona = await getBody({ cwd, name: agentType });
     if (!persona) {
-      const reportOnce = deps.reportDanglingAgentTypeOnce || require('./prdAgentType.cjs').reportDanglingAgentTypeOnce;
+      const reportOnce = deps.reportDanglingAgentTypeOnce || require('../prd/prdAgentType.cjs').reportDanglingAgentTypeOnce;
       reportOnce(cwd, agentType, deps);
       return miss;
     }

package/src/main/lib/{claudeBin.cjs → claude/claudeBin.cjs}

@@ -68,7 +68,7 @@ function __resetForTests() { cached = null; }
 //
 // Every `claude` spawn goes through claudeSpawnTarget so GNOME System Monitor
 // shows a distinct comm per role (sm-claude-job / -chat / -aux) and a labelled
-// argv0. See lib/procName.cjs for the mechanics. Invariants:
+// argv0. See lib/process/procName.cjs for the mechanics. Invariants:
 //  - SM_CLAUDE_BIN set → aliasing SKIPPED, raw value used verbatim (tests point
 //    it at self-locating stubs; it must stay ONE binary, no path splitting).
 //  - aliasBinFor fails open (returns realBin) → no argv0 is set either, so the
@@ -92,7 +92,7 @@ function claudeSpawnTarget(role, detail, realBin = resolveClaudeBin(), args = []
   const platform = winOpts.platform || process.platform;
   if (platform !== 'win32' || !/\.(cmd|bat)$/i.test(base.command)) return base;
   // Node refuses to spawn a .cmd/.bat without a shell (EINVAL) — wrap in cmd.exe argv.
-  const { resolveSpawn } = require('./winSpawn.cjs');
+  const { resolveSpawn } = require('../process/winSpawn.cjs');
   const wrapped = resolveSpawn(base.command, args, { platform, ...(winOpts.env ? { env: winOpts.env } : {}), ...(winOpts.exists ? { exists: winOpts.exists } : {}) });
   return { ...base, ...wrapped };
 }
@@ -102,7 +102,7 @@ function baseSpawnTarget(role, detail, realBin) {
   const alias = ROLE_ALIASES[role];
   if (!alias) return { command: realBin };
   try {
-    const { aliasBinFor, smArgv0 } = require('./procName.cjs');
+    const { aliasBinFor, smArgv0 } = require('../process/procName.cjs');
     const command = aliasBinFor(realBin, alias);
     if (command === realBin) return { command: realBin };
     return { command, argv0: smArgv0(role, detail) };
@@ -114,7 +114,7 @@ function baseSpawnTarget(role, detail, realBin) {
 // ---------- version probe ----------
 //
 // `claude --version`, cached. The scheduler's launch circuit breaker
-// (lib/launchFailure.cjs) records the CLI version a launch block was armed
+// (lib/scheduler/launchFailure.cjs) records the CLI version a launch block was armed
 // under and drops the block the moment the version changes — the incident
 // behind it (issue #11: an outdated CLI sending a thinking parameter the
 // model rejects) is fixed by `claude update`, and the queue must notice