claude-code-session-manager 0.35.15 → 0.35.17

package/src/main/scheduler.cjs

@@ -500,6 +500,17 @@ async function listPrdFiles() {
   return prdParser.listPrdFiles(PRDS_DIR);
 }
 
+/**
+ * Atomically mint a brand-new parallel-group NN for a PRD about to be
+ * authored under PRDS_DIR. See prdParser.allocateParallelGroup for the
+ * collision-proof mechanics. Callers wanting to join an EXISTING group
+ * (deliberate parallel siblings) skip this and just reuse the NN prefix.
+ */
+async function allocateParallelGroup() {
+  ensureDirs();
+  return prdParser.allocateParallelGroup(PRDS_DIR);
+}
+
 /**
  * Best-effort kill of a child claude PID that the previous app instance spawned
  * but never reaped. Used by init() to clean up the orphan tree on boot.
@@ -709,6 +720,37 @@ let cancelToken = { cancelled: false };
 // Last memory-gate observation; included in snapshot for renderer visibility.
 let lastMemGate = null;
 
+/**
+ * Pure: applies clearPause()'s effect on the tick cancel-token.
+ *
+ * ROOT CAUSE (2026-07-14 stall, PRD 543/544): setPaused() cancels the
+ * in-flight tick batch by setting cancelToken.cancelled = true (e.g. when a
+ * job's run is rate-limited). That flag was previously only ever reset back
+ * to false inside runDueJobs() (used by the force-tick/run-now IPC handlers
+ * and the resume-timer callback). clearPause() itself — the function the
+ * poll-loop's auth/network auto-recovery and the manual "Resume" button
+ * actually call — never reset it. So once ANY pause fired and was later
+ * cleared through one of THOSE paths instead of runDueJobs(), cancelToken
+ * .cancelled stayed permanently true, and tickQueue()'s very first guard
+ * (`if (cancelToken.cancelled) return {fired:false, reason:'cancelled'}`)
+ * silently short-circuited every future tick — from spawnJob's own
+ * post-completion tick, from the when-available poll, and from the
+ * dead-process reaper — forever, even though queue.json's `paused` field
+ * was correctly null and every other gate (enabled, concurrency, memory)
+ * said go. This explains the full incident: lastRunAt froze at the last
+ * tick that got past the guard, new PRDs kept appearing as `pending`
+ * because reconcile() also runs independently from the `schedule:state` IPC
+ * read (unrelated to tickQueue), and only a manual force-tick (which goes
+ * through runDueJobs()) could ever unwedge it.
+ *
+ * Exported so this regression is unit-testable without touching the real
+ * scheduler's fs-backed queue.json.
+ */
+function applyPauseCleared(wasPaused, token) {
+  if (wasPaused) token.cancelled = false;
+  return token;
+}
+
 function attachWindow(w) { mainWindow = w; }
 
 /**
@@ -839,6 +881,8 @@ async function clearPause(source) {
     s.paused = null;
     return true;
   });
+  // Un-cancel the tick guard on every recovery path, not just runDueJobs().
+  applyPauseCleared(wasPaused, cancelToken);
   // Track manual clears for the auto-pause cooldown.
   if (source === 'manual' || source === 'run-now') {
     pauseClearedManuallyAt = Date.now();
@@ -883,6 +927,69 @@ function detectRateLimitInLog(logPath) {
   }
 }
 
+/** Scan the tail of a job's log for a network-outage signal: the structured
+ *  `terminal_reason":"api_error"` field alongside a network-class error
+ *  string. This is NOT a real code defect — spawning an auto-fix
+ *  investigation for it just burns a second run diagnosing an outage (PRD
+ *  543's ENOTFOUND incident, 2026-07-14). Deliberately narrow: only fires on
+ *  the structured terminal_reason field, never on ad-hoc "error" text that
+ *  legitimately appears in TDD red-phase transcripts. */
+function detectNetworkErrorInLog(logPath) {
+  try {
+    const text = readTail(logPath, 16384);
+    if (!text) return false;
+    if (!/"terminal_reason":"api_error"/.test(text)) return false;
+    return /ENOTFOUND/.test(text)
+      || /ECONNREFUSED/.test(text)
+      || /ETIMEDOUT/.test(text)
+      || /EAI_AGAIN/.test(text)
+      || /network is unreachable/i.test(text);
+  } catch {
+    return false;
+  }
+}
+
+// Bounded retry cap for transient (signal-kill or network-outage) failures.
+// A small constant, not a config knob: the point is that it is impossible to
+// loop unboundedly (queueOps.cjs lints for unbounded loops; see the fizzpop
+// poll-hang in PRD_AUTHORING.md for why an unbounded retry is a real hazard).
+const TRANSIENT_RETRY_CAP = 2;
+
+/**
+ * Classify a failed job's outcome as one of: retry it (transient, bounded),
+ * fail it without auto-fix (transient but unsafe to retry, or the retry cap
+ * is exhausted), or investigate it (a genuine code failure). Pure/no I/O so
+ * the transient-vs-terminal boundary can be unit-tested directly rather than
+ * only through a live spawnJob run.
+ *
+ * A 143/137 exit within the idle-watchdog window is a signal-kill transient
+ * (external kill, not a real failure — see the call site's long-form
+ * rationale). A `terminal_reason:"api_error"` + network-class error
+ * (ENOTFOUND etc., detected by detectNetworkErrorInLog) is an outage
+ * transient (PRD 543/545 incident) — same bounded-retry treatment, not a
+ * second parallel classifier.
+ */
+function classifyFailureOutcome({ exitCode, networkError, durationMs, transientRetries, newlyDirtyCount }) {
+  const signalTransient = (exitCode === 143 || exitCode === 137) && durationMs < IDLE_OUTPUT_KILL_MS;
+  const networkTransient = networkError === true;
+  const transient = signalTransient || networkTransient;
+  if (!transient) return { action: 'investigate' };
+
+  const transientKind = networkTransient ? 'network' : `exit=${exitCode}`;
+  const retries = transientRetries ?? 0;
+  // A transient failure can still leave partial work on disk (the 543
+  // ENOTFOUND run wrote its renderer, then died before committing). Requeuing
+  // over that dirt would either re-implement on top of it or conflict with
+  // it — refuse and fail instead of silently re-running over orphaned edits.
+  if (newlyDirtyCount > 0) {
+    return { action: 'fail-dirty', transientKind, newlyDirtyCount };
+  }
+  if (retries >= TRANSIENT_RETRY_CAP) {
+    return { action: 'fail-cap', transientKind, retries };
+  }
+  return { action: 'retry', transientKind, retries };
+}
+
 // ---------- execution ----------
 
 function pickRunDir() {
@@ -1119,14 +1226,15 @@ async function executeJob(job, runDir, defaultCwd, onPid) {
         sl(`\n[scheduler] exit code=${effectiveCode} (raw code=${exitCode} signal=${signal}) ` +
           `duration=${Math.round(durationMs / 1000)}s\n`);
         const rateLimited = effectiveCode !== 0 && detectRateLimitInLog(logPath);
+        const networkError = effectiveCode !== 0 && !rateLimited && detectNetworkErrorInLog(logPath);
         // Sync write: child 'exit' handler must flush meta before resolve()
         // so the spawnJob mutate() that follows sees the persisted exit code.
         config.writeJsonSync(metaPath, {
-          slug: job.slug, cwd, sessionId, exitCode: effectiveCode, rateLimited,
+          slug: job.slug, cwd, sessionId, exitCode: effectiveCode, rateLimited, networkError,
           startedAt, finishedAt: Date.now(), durationMs,
           agentResultSubtype, mappedFromSignal: mappedToSuccess ? signal || `code=${exitCode}` : null,
         });
-        resolve({ exitCode: effectiveCode, durationMs, rateLimited, sessionId });
+        resolve({ exitCode: effectiveCode, durationMs, rateLimited, networkError, sessionId });
       },
     });
 
@@ -1538,7 +1646,14 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
           let effectiveStatus;
           if (res.exitCode !== 0) {
             effectiveStatus = 'failed';
-          } else if (!verifyResult || verifyResult.verdict === 'clean') {
+          } else if (
+            !verifyResult
+            || verifyResult.verdict === 'clean'
+            // pass_no_commit_target_verified: -merge-main postcondition exemption
+            // (runVerify.cjs) — an independently gh-confirmed clean merge target,
+            // not a plain unsubstantiated PASS. Completed, same as 'clean'.
+            || verifyResult.verdict === 'pass_no_commit_target_verified'
+          ) {
             effectiveStatus = 'completed';
           } else if (verifyResult.downgradeTo === 'pending') {
             // HALT or deps_unmet: reset to pending so the job re-fires.
@@ -1641,15 +1756,58 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
       // 67 s.) Genuine watchdog kills (idle ≥20 min, deadman 4 h) run longer than
       // the threshold and still fall through to investigation.
       const ec = failedJobSnapshot.exitCode;
-      const transient = (ec === 143 || ec === 137) && res.durationMs < IDLE_OUTPUT_KILL_MS;
       const retries = failedJobSnapshot.transientRetries ?? 0;
-      if (transient && retries < 2) {
-        console.log(`[scheduler] transient failure (exit=${ec} dur=${res.durationMs}ms) — auto-retry ${retries + 1}/2 for ${job.slug}`);
+      // Only pay for the extra git status call when the failure is plausibly
+      // transient — a real code failure never needs the dirty-tree check.
+      const maybeTransient = (ec === 143 || ec === 137) || res.networkError === true;
+      let newlyDirtyCount = 0;
+      let dirtySample = '';
+      if (maybeTransient) {
+        const afterFailure = await uncommittedChanges(guardCwd);
+        const baseSet = new Set(guardBaseline || []);
+        const newlyDirty = (afterFailure || []).filter((p) => !baseSet.has(p));
+        newlyDirtyCount = newlyDirty.length;
+        dirtySample = newlyDirty.slice(0, 3).join(', ');
+      }
+      const decision = classifyFailureOutcome({
+        exitCode: ec,
+        networkError: res.networkError,
+        durationMs: res.durationMs,
+        transientRetries: retries,
+        newlyDirtyCount,
+      });
+
+      if (decision.action === 'retry') {
+        console.log(`[scheduler] transient failure (${decision.transientKind} dur=${res.durationMs}ms) — auto-retry ${decision.retries + 1}/${TRANSIENT_RETRY_CAP} for ${job.slug}`);
         await mutate((s) => {
           const i = s.jobs.findIndex((x) => x.slug === job.slug);
           if (i >= 0) {
             resetJobFields(s.jobs[i], null);
-            s.jobs[i].transientRetries = retries + 1;
+            s.jobs[i].transientRetries = decision.retries + 1;
+          }
+        });
+        await broadcast();
+      } else if (decision.action === 'fail-dirty') {
+        console.log(`[scheduler] transient failure (${decision.transientKind}) for ${job.slug} left ${newlyDirtyCount} uncommitted file(s) (e.g. ${dirtySample}) — not auto-requeuing`);
+        await mutate((s) => {
+          const i = s.jobs.findIndex((x) => x.slug === job.slug);
+          if (i >= 0) {
+            s.jobs[i].status = 'failed';
+            s.jobs[i].error = `transient failure (${decision.transientKind}) left ${newlyDirtyCount} uncommitted file(s) in working tree (e.g. ${dirtySample}) — not auto-requeued to avoid overwriting partial work; review and commit or discard manually`;
+          }
+        });
+        await broadcast();
+        // No auto-fix investigation: this isn't a code defect, and the
+        // dirty tree needs a human, not a diagnosis run.
+      } else if (decision.action === 'fail-cap') {
+        // Retry cap exhausted: fail terminally, but a transient classification
+        // never spawns an auto-fix investigation — there is no code defect to
+        // diagnose, only a recurring outage.
+        console.log(`[scheduler] transient failure (${decision.transientKind}) for ${job.slug} exhausted retry cap (${decision.retries}/${TRANSIENT_RETRY_CAP}) — failing without auto-fix`);
+        await mutate((s) => {
+          const i = s.jobs.findIndex((x) => x.slug === job.slug);
+          if (i >= 0) {
+            s.jobs[i].error = `transient failure (${decision.transientKind}) exhausted retry cap (${decision.retries}/${TRANSIENT_RETRY_CAP}) — marking failed without auto-fix investigation`;
           }
         });
         await broadcast();
@@ -2184,7 +2342,10 @@ async function reverifyNeedsReview() {
         allowPreSentinelHeal: true,
       });
     } catch { leftForReview.push({ slug: job.slug, reason: 'verifyRun threw' }); continue; }
-    if (v && v.verdict === 'clean') {
+    // pass_no_commit_target_verified: -merge-main postcondition exemption
+    // (runVerify.cjs) — same "heal it" treatment as 'clean', see spawnJob's
+    // effectiveStatus branch above for the primary-path equivalent.
+    if (v && (v.verdict === 'clean' || v.verdict === 'pass_no_commit_target_verified')) {
       healed.push(job.slug);
     } else {
       leftForReview.push({ slug: job.slug, reason: v ? `${v.verdict}: ${v.reason}` : 'null verdict' });
@@ -2818,6 +2979,12 @@ const remote = {
     return state.jobs.map((j) => ({ slug: j.slug, title: j.title, status: j.status, cwd: j.cwd }));
   },
 
+  // Exposes the module-level allocateParallelGroup (PRD 548) to callers that
+  // only hold the `remote` object (adminServer.cjs's create-prd route) —
+  // reuses the same allocator the file-based /develop authoring path relies
+  // on implicitly, rather than re-deriving NN here.
+  allocateParallelGroup,
+
   async runNow() {
     await clearPause('run-now');
     runDueJobs().catch((e) => logs.writeLine({
@@ -2841,4 +3008,4 @@ const remote = {
   },
 };
 
-module.exports = { registerScheduleHandlers, attachWindow, init, ROOT, PRDS_DIR, selectHistoryJobs, parsePorcelain, FINISH_PROTOCOL, remote, pickNextBatch, pickForProject, reapDeadRunningJobs, pollRecoveryClearSource, memoryLimitedBatchSize, availableForJobs, reverifyNeedsReview, isRescanCandidate, isPromotableOriginal, selectAutoFixTargets, isEligibleForImmediateAutoFix, resolveRunId, isUnresolvableNeedsReview, healTargetForFix, buildInvestigationPrompt, committedInWindow, isFixPlanSlug, isFixPlanBeyondDepthCap, MAX_INVESTIGATION_DEPTH, forceTickOutcome };
+module.exports = { registerScheduleHandlers, attachWindow, init, ROOT, PRDS_DIR, allocateParallelGroup, selectHistoryJobs, parsePorcelain, FINISH_PROTOCOL, remote, pickNextBatch, pickForProject, reapDeadRunningJobs, pollRecoveryClearSource, memoryLimitedBatchSize, availableForJobs, reverifyNeedsReview, isRescanCandidate, isPromotableOriginal, selectAutoFixTargets, isEligibleForImmediateAutoFix, resolveRunId, isUnresolvableNeedsReview, healTargetForFix, buildInvestigationPrompt, committedInWindow, isFixPlanSlug, isFixPlanBeyondDepthCap, MAX_INVESTIGATION_DEPTH, forceTickOutcome, applyPauseCleared, detectNetworkErrorInLog, detectRateLimitInLog, classifyFailureOutcome, TRANSIENT_RETRY_CAP };

package/src/main/templates/PRD_AUTHORING.md

@@ -314,3 +314,129 @@ bounded number of times (§1) rather than capping the foreground command.
 `timeout`-capped full-universe EDGAR ingest. Both committed correct, green, AC-complete work
 (77's cursor-hold fix; 80's 6 EDGAR rows + installed cron) yet were downgraded to `needs_review`
 on the incidental middle-of-run markers. 13a/13b keep the middle of the transcript clean.
+
+## §14 Queueing PRDs from external automation
+
+**Summary:** A downstream project (Connector Atlas, `gh-issue-5`) wanted a Slack-feedback → PRD
+loop but had no documented programmatic queueing path. This section is that path.
+
+**Decision, up front:** Is the session-manager Electron app running on this machine right now?
+- **Yes** → call the `scheduler_create_prd` MCP tool.
+- **No** → write the PRD file by hand into the prds directory, and accept the collision risk
+  described below.
+
+### The `scheduler_create_prd` MCP tool
+
+Wraps `POST /admin/scheduler/create-prd` on the loopback admin API
+(`src/main/adminServer.cjs`, PRD 549) via `scripts/scheduler-mcp-server.cjs`, registered in this
+repo's `.mcp.json` as the `session-manager-scheduler` MCP server. An external project wanting to
+call it from its own automation needs the equivalent MCP server registration pointing at this
+repo's `scripts/scheduler-mcp-server.cjs`, or can call the admin HTTP route directly (same
+request/response shape) using the token at `~/.claude/session-manager/admin-api.json`.
+
+**Input** (validated server-side by `ipcSchemas.cjs`'s `schemas.schedulerCreatePrd`):
+
+| field | type | required | notes |
+|---|---|---|---|
+| `title` | string | yes | one-line title, no newlines |
+| `cwd` | string | yes | absolute path to the target project; validated via `config.cjs`'s `validatePath` (allowedRoots = home dir) |
+| `estimateMinutes` | number | yes | integer wall-clock estimate |
+| `goal` | string | yes | 2–4 sentences: what the executor builds and why |
+| `acceptanceCriteria` | string[] | yes | 1–100 entries, each one verifiable checklist line |
+| `implementationNotes` | string | yes | file paths, patterns, constraints the executor needs |
+| `outOfScope` | string[] | no | what NOT to build |
+| `slug` | string | no | kebab-case; derived from `title` if omitted |
+| `parallelGroup` | number | no | opt into an existing `NN` group instead of allocating a new one |
+
+**Return** (`{nn, filename, status}`, per `adminServer.cjs`):
+```json
+{ "nn": 550, "filename": "550-my-feature.md", "status": "queued" }
+```
+On failure the tool returns `{ ok: false, error: "..." }` (e.g. `409` if `filename` already
+exists, `400` if `cwd` is rejected by `validatePath` or the payload fails schema validation).
+
+**Worked example** (MCP tool call, e.g. from Claude Code or any MCP client):
+```json
+{
+  "tool": "scheduler_create_prd",
+  "arguments": {
+    "title": "Sync Slack #feedback channel into feedback intake",
+    "cwd": "~/Projects/connector-atlas",
+    "estimateMinutes": 20,
+    "goal": "Pull unread messages from the #feedback Slack channel and materialize each as a feedback file, deduped against already-tracked message ts.",
+    "acceptanceCriteria": [
+      "New feedback files land in connector-atlas's own feedback intake folder, one per undeduped message",
+      "Each file's `source` field is `slack-<channel>-<ts>` for future dedup",
+      "timeout 300 npm run typecheck passes"
+    ],
+    "implementationNotes": "Use the Slack Web API conversations.history endpoint; token lives in connector-atlas's own secrets store, not session-manager's."
+  }
+}
+```
+Server-side, this atomically allocates the `NN` prefix (`allocateParallelGroup()`, PRD 548),
+appends the engineering standards block, and writes the PRD file — the same shape `/develop`
+produces by hand.
+
+### The app-must-be-running caveat (read this first)
+
+**`scheduler_create_prd` only works while the session-manager Electron app is running on this
+machine.** The admin server it depends on (`src/main/adminServer.cjs`) is hosted *inside* the
+Electron process — it binds a loopback port and writes its token to
+`~/.claude/session-manager/admin-api.json` on app boot (see `CLAUDE.md`'s `adminServer.cjs`
+architecture entry) and stops existing the moment the app quits — it is not a standalone daemon.
+If the app is closed, `scheduler-mcp-server.cjs` cannot read a live port/token and every call
+returns the error `session-manager app is not running (admin API unreachable) — start it first`.
+This is the single most likely point of confusion for an automation author who assumes the tool
+is a normal always-on API — it is not; it is a convenience surface hosted by a desktop app that
+the user may or may not have open.
+
+### Fallback: writing the PRD file directly
+
+When the app is not running, write `<NN>-<slug>.md` by hand into
+`~/.claude/session-manager/scheduled-plans/prds/` following the frontmatter rules in §6 and the
+body conventions the rest of this guide describes (`# Goal`, `# Acceptance criteria`,
+`# Implementation notes`, `## Engineering standards` inlined verbatim — see `/develop`'s output
+for the exact shape). **Trade-off:** this path has no atomic `NN` allocation. The tool's
+`allocateParallelGroup()` (PRD 548) exists specifically to close a race where two writers pick
+the same `NN` at once; a hand-written file bypasses that reservation entirely, so if another
+writer (a human, `/develop`, or another automation) picks the same `NN` around the same time, one
+file silently shadows or is shadowed by the other's parallel-group slot. Pick an `NN` by scanning
+the existing prds directory for the current max and incrementing, and treat a collision as
+possible, not merely theoretical.
+
+### Ownership boundary
+
+Projects own their own source adapters — Slack, GitHub, Linear, email, whatever inbound channel
+they read. Session-manager owns the queueing API (`scheduler_create_prd` / the admin route) and
+nothing upstream of it. Session-manager does not host, run, or import another project's adapter
+code; the adapter runs entirely inside the calling project (its own cron, its own credentials,
+its own filtering/triage logic) and only reaches into session-manager at the single, narrow
+`scheduler_create_prd` call.
+
+### Why project-supplied `automation-hooks.js` was declined
+
+Connector Atlas's third ask was a mechanism to drop a project-supplied `automation-hooks.js` file
+that session-manager would load and execute in-process on a timer. This was declined, and should
+not be re-proposed:
+
+- It would grant main-process privileges (full filesystem access, IPC, the admin server's own
+  token) to arbitrary code from any project directory, invoked on a schedule the *project*
+  controls rather than the *user*.
+- It inverts this project's core invariants: `config.cjs`'s `validatePath` gate on every
+  filesystem path, `ipcSchemas.cjs`'s zod-validated IPC boundary, and `CLAUDE.md`'s Avoid-list
+  ban on `shell: true` outside the two features that legitimately need it. A loaded-and-executed
+  project JS file has no equivalent boundary to pass through — it *is* the process.
+- The supported extension point is the MCP tool described above, called from *outside* the
+  session-manager process by the project's own cron/automation. That keeps the privilege boundary
+  where it already is (the loopback admin server, token-authed, narrow three-route surface) rather
+  than dissolving it.
+
+### Reference implementation of this exact loop
+
+`/process-feedback`'s step 0b (source → triage → `/develop` → queue) is a working example of this
+shape, landed 2026-07-14 (`feat(process-feedback): sync open GitHub issues into the feedback
+intake`, commit `352b89c`). It syncs open GitHub issues into `session-manager-operations/feedback/`
+(deduped on a `gh-issue-<N>` token), then processes each item through the same triage → `/develop`
+→ queue path the rest of this guide documents. An external project building a Slack (or any
+other) adapter should follow the same source → triage → queue shape, ending at
+`scheduler_create_prd` (app running) or a hand-written PRD file (app closed) as described above.

package/src/main/usage.cjs

@@ -240,6 +240,10 @@ function registerBillingHandlers() {
       if (cache) return { kind: 'ok-stale', data: cache.data, staleSince: cache.fetchedAt, lastError: r.message };
       return r;
     }
+    if (r.kind === 'meter_rate_limited') {
+      if (cache) return { kind: 'meter_rate_limited', message: r.message, httpStatus: r.httpStatus, cached: cache.data, staleSince: cache.fetchedAt };
+      return r;
+    }
     return r; // config
   });
 }

package/src/main/webRemote.cjs

@@ -321,11 +321,12 @@ function resetE2e(state = 'idle') {
 
 // ─── WebSocket lifecycle ──────────────────────────────────────────────────────
 
-function broadcastStatus() {
-  if (!_window || _window.isDestroyed()) return;
-  const cfg = loadConfigSync();
+// Single source of truth for the status payload shape shared by the
+// broadcast push (webRemote:status) and the get-status IPC pull — both must
+// report the same connected/e2e/device view of `cfg` + `_ws`/`_e2e` module state.
+function computeStatus(cfg) {
   const connected = _ws !== null && _ws.readyState === WebSocket.OPEN;
-  sendIfAlive(_window, 'webRemote:status', {
+  return {
     enabled: cfg.remoteEnabled,
     remoteControlEnabled: cfg.remoteControlEnabled ?? false,
     connected,
@@ -336,7 +337,13 @@ function broadcastStatus() {
     devices: (cfg.devices || []).map(({ deviceId, deviceName, issuedAt, lastConnectedAt }) => ({
       deviceId, deviceName, issuedAt, lastConnectedAt,
     })),
-  });
+  };
+}
+
+function broadcastStatus() {
+  if (!_window || _window.isDestroyed()) return;
+  const cfg = loadConfigSync();
+  sendIfAlive(_window, 'webRemote:status', computeStatus(cfg));
 }
 
 function stopHeartbeat() {
@@ -1214,19 +1221,7 @@ function registerRemoteHandlers() {
   // Returns current status without tokens — safe to expose to renderer.
   ipcMain.handle('webRemote:get-status', async () => {
     const cfg = await loadConfig();
-    const connected = _ws !== null && _ws.readyState === WebSocket.OPEN;
-    return {
-      enabled: cfg.remoteEnabled,
-      remoteControlEnabled: cfg.remoteControlEnabled ?? false,
-      connected,
-      e2eActive: connected && _e2e.sessionKey !== null,
-      e2eAuthenticated: connected && _e2e.state === 'authenticated',
-      e2eState: connected ? _e2e.state : 'idle',
-      pendingSas: connected && _e2e.state === 'pending_sas' ? _e2e.pendingSas : null,
-      devices: (cfg.devices || []).map(({ deviceId, deviceName, issuedAt, lastConnectedAt }) => ({
-        deviceId, deviceName, issuedAt, lastConnectedAt,
-      })),
-    };
+    return computeStatus(cfg);
   });
 
   // User confirmed that the SAS shown on both desktop and browser match.

package/src/preload/api.d.ts

@@ -212,6 +212,7 @@ export type BillingFetchResult =
   | { kind: 'ok-stale'; data: BillingData; staleSince: number; lastError: string }
   | { kind: 'auth'; message: string; httpStatus: number; expiredAt?: number | null; cached?: BillingData; staleSince?: number }
   | { kind: 'transient'; message: string; httpStatus: number | null }
+  | { kind: 'meter_rate_limited'; message: string; httpStatus: number; cached?: BillingData; staleSince?: number }
   | { kind: 'config'; message: string };
 
 // ── MCP server live connection probe (`claude mcp list`)