claude-code-session-manager 0.35.16 → 0.35.18

package/src/main/__tests__/web-remote-e2e-pinning.test.cjs

@@ -0,0 +1,181 @@
+'use strict';
+
+/**
+ * web-remote-e2e-pinning.test.cjs — TOFU pinning for the web-remote E2E handshake.
+ *
+ * Once a browser's SPKI pubkey is manually SAS-confirmed for a paired device,
+ * a later `e2e:hello` presenting the SAME pubkey for that device should
+ * auto-authenticate (no `confirm-sas` needed); a DIFFERENT pubkey must still
+ * fall through to the manual `pending_sas` flow.
+ *
+ * Runs against a tmp HOME (config.cjs / webRemote.cjs both resolve paths off
+ * os.homedir()) and stubs the `electron` module in require.cache, mirroring
+ * the tmp-HOME + require.cache-stub pattern used by exchanges.test.cjs.
+ *
+ * Run: timeout 300 npx vitest run src/main/__tests__/web-remote-e2e-pinning.test.cjs
+ */
+
+import { describe, it, expect, beforeAll, afterAll } from 'vitest'
+
+const fs = require('node:fs')
+const fsp = require('node:fs/promises')
+const path = require('node:path')
+const os = require('node:os')
+const crypto = require('node:crypto')
+
+/** Generate a P-256 keypair in the same encoding webRemote.cjs uses (SPKI/PKCS8, base64url). */
+function genP256KeyPairB64() {
+  const { privateKey, publicKey } = crypto.generateKeyPairSync('ec', {
+    namedCurve: 'P-256',
+    publicKeyEncoding: { type: 'spki', format: 'der' },
+    privateKeyEncoding: { type: 'pkcs8', format: 'der' },
+  })
+  return {
+    priv: privateKey.toString('base64url'),
+    pub: publicKey.toString('base64url'),
+  }
+}
+
+let tmpHome
+let origHome
+let webRemote
+let configPath
+let handlers // captured ipcMain.handle(name, fn) map
+
+function freshRequire(mod) {
+  delete require.cache[require.resolve(mod)]
+  return require(mod)
+}
+
+async function readConfig() {
+  const text = await fsp.readFile(configPath, 'utf8')
+  return JSON.parse(text)
+}
+
+async function writeConfig(cfg) {
+  await fsp.mkdir(path.dirname(configPath), { recursive: true })
+  await fsp.writeFile(configPath, JSON.stringify(cfg, null, 2) + '\n')
+}
+
+beforeAll(async () => {
+  tmpHome = await fsp.mkdtemp(path.join(os.tmpdir(), 'web-remote-e2e-pinning-'))
+  origHome = process.env.HOME
+  process.env.HOME = tmpHome
+
+  // Stub 'electron' before webRemote.cjs (and logs.cjs, transitively) require it —
+  // outside a real Electron process, require('electron') just resolves to a path
+  // string, so destructuring { ipcMain, app } off it would throw at module load.
+  handlers = new Map()
+  const electronPath = require.resolve('electron')
+  require.cache[electronPath] = {
+    id: electronPath,
+    filename: electronPath,
+    loaded: true,
+    exports: {
+      ipcMain: {
+        handle: (name, fn) => handlers.set(name, fn),
+        on: () => {},
+      },
+      app: {
+        getPath: () => tmpHome,
+        getVersion: () => '0.0.0-test',
+      },
+    },
+  }
+
+  // Clear anything already cached under the real HOME so paths re-resolve under tmpHome.
+  for (const mod of ['../webRemote.cjs', '../config.cjs', '../logs.cjs', './e2eStateMachine.cjs']) {
+    try { delete require.cache[require.resolve(mod)] } catch { /* not yet loaded */ }
+  }
+
+  webRemote = freshRequire('../webRemote.cjs')
+  configPath = path.join(tmpHome, '.claude', 'session-manager', 'web-remote.json')
+
+  webRemote.registerRemoteHandlers()
+})
+
+afterAll(async () => {
+  process.env.HOME = origHome
+  await fsp.rm(tmpHome, { recursive: true, force: true })
+})
+
+describe('web-remote E2E SAS pinning', () => {
+  const deviceKeys = genP256KeyPairB64() // desktop's own E2E keypair
+  const browserA = genP256KeyPairB64() // first browser's keypair
+  const browserB = genP256KeyPairB64() // a different browser's keypair
+  const deviceId = 'device-under-test'
+
+  function baseDeviceRow(overrides = {}) {
+    return {
+      deviceId,
+      deviceToken: 'tok-abc',
+      e2ePrivateKey: deviceKeys.priv,
+      e2ePublicKey: deviceKeys.pub,
+      deviceName: 'Test Device',
+      issuedAt: new Date(0).toISOString(),
+      lastConnectedAt: null,
+      verifiedPeerPubKey: null,
+      ...overrides,
+    }
+  }
+
+  it('1) first e2e:hello for a never-confirmed device lands in pending_sas', async () => {
+    await writeConfig({ remoteEnabled: true, remoteControlEnabled: false, devices: [baseDeviceRow()] })
+
+    const cfg = await readConfig()
+    const device = cfg.devices[0]
+    await webRemote._internal.handleMessage(
+      JSON.stringify({ type: 'e2e:hello', id: 'm1', payload: { pubKey: browserA.pub } }),
+      device
+    )
+
+    expect(webRemote._internal.getE2eState().state).toBe('pending_sas')
+  })
+
+  it('2) a manual confirm-sas persists the connected device\'s verifiedPeerPubKey', async () => {
+    const confirmSas = handlers.get('webRemote:confirm-sas')
+    expect(typeof confirmSas).toBe('function')
+
+    const result = await confirmSas()
+    expect(result.ok).toBe(true)
+    expect(webRemote._internal.getE2eState().state).toBe('authenticated')
+
+    const cfg = await readConfig()
+    const persisted = cfg.devices.find((d) => d.deviceId === deviceId)
+    expect(persisted.verifiedPeerPubKey).toBe(browserA.pub)
+  })
+
+  it('3) a second e2e:hello presenting the SAME browserPubKey auto-authenticates (no confirm-sas)', async () => {
+    // Simulate a fresh reconnect: new WS session resets E2E state, and the device
+    // row is reloaded from disk (as connect() would), now carrying the pinned key.
+    webRemote._internal.resetE2e()
+    expect(webRemote._internal.getE2eState().state).toBe('idle')
+
+    const cfg = await readConfig()
+    const device = cfg.devices.find((d) => d.deviceId === deviceId)
+    expect(device.verifiedPeerPubKey).toBe(browserA.pub)
+
+    await webRemote._internal.handleMessage(
+      JSON.stringify({ type: 'e2e:hello', id: 'm2', payload: { pubKey: browserA.pub } }),
+      device
+    )
+
+    expect(webRemote._internal.getE2eState().state).toBe('authenticated')
+  })
+
+  it('4) a e2e:hello presenting a DIFFERENT browserPubKey still lands in pending_sas', async () => {
+    webRemote._internal.resetE2e()
+    expect(webRemote._internal.getE2eState().state).toBe('idle')
+
+    const cfg = await readConfig()
+    const device = cfg.devices.find((d) => d.deviceId === deviceId)
+    expect(device.verifiedPeerPubKey).toBe(browserA.pub) // still pinned to A, not B
+
+    await webRemote._internal.handleMessage(
+      JSON.stringify({ type: 'e2e:hello', id: 'm3', payload: { pubKey: browserB.pub } }),
+      device
+    )
+
+    expect(webRemote._internal.getE2eState().state).toBe('pending_sas')
+  })
+})

package/src/main/adminServer.cjs

@@ -14,8 +14,17 @@
  *     ~/.claude/session-manager/admin-api.json with 0600 perms.
  *   - Token compared with crypto.timingSafeEqual to avoid a timing
  *     side-channel on the comparison itself.
- *   - Only two routes: reset-job (one narrow mutation) and jobs (read-only
- *     list). writePrd/pause/resume are intentionally NOT exposed here.
+ *   - Three routes: reset-job (flips fields on an already-vetted job),
+ *     jobs (read-only list), and create-prd (PRD 549 — authors a BRAND-NEW
+ *     file that the scheduler will later run as `claude -p
+ *     --dangerously-skip-permissions` in a caller-chosen, home-dir-bounded
+ *     cwd; a materially larger blast radius than reset-job, justified only
+ *     because it unblocks external automation with no other queueing path).
+ *     cwd is validated via config.cjs's validatePath; title/cwd are
+ *     newline-blocked at the zod boundary (ipcSchemas.cjs) to prevent
+ *     frontmatter injection into the hand-rolled PRD serializer
+ *     (prdCreate.cjs). pause/resume/cancel/update remain intentionally NOT
+ *     exposed here.
  */
 
 'use strict';
@@ -26,6 +35,9 @@ const path = require('node:path');
 const crypto = require('node:crypto');
 const fsp = require('node:fs/promises');
 const config = require('./config.cjs');
+const { expandHome } = require('./lib/expandHome.cjs');
+const { schemas } = require('./ipcSchemas.cjs');
+const prdCreate = require('./lib/prdCreate.cjs');
 
 const TOKEN_PATH = path.join(os.homedir(), '.claude', 'session-manager', 'admin-api.json');
 
@@ -123,6 +135,79 @@ function createAdminServer(remote) {
         sendJson(res, 200, result);
         return;
       }
+      if (req.method === 'POST' && req.url === '/admin/scheduler/create-prd') {
+        const raw = await readBody(req);
+        let parsed;
+        try {
+          parsed = raw ? JSON.parse(raw) : {};
+        } catch {
+          sendJson(res, 400, { ok: false, error: 'invalid JSON body' });
+          return;
+        }
+
+        let input;
+        try {
+          input = schemas.schedulerCreatePrd.parse(parsed);
+        } catch (e) {
+          sendJson(res, 400, { ok: false, error: 'invalid PRD payload', details: e?.issues ?? e?.message });
+          return;
+        }
+
+        // cwd is untrusted: this is the first *creating* mutation on a
+        // token-authed API whose product is "a command that will later run
+        // with --dangerously-skip-permissions in a chosen cwd". Route it
+        // through config.cjs's validatePath (allowedRoots = home dir) —
+        // same boundary every other fs-touching IPC handler uses — never a
+        // bespoke check here.
+        try {
+          config.validatePath(expandHome(input.cwd));
+        } catch (e) {
+          sendJson(res, 400, { ok: false, error: `cwd rejected: ${e?.message ?? 'outside allowed roots'}` });
+          return;
+        }
+
+        const slug = input.slug || prdCreate.deriveSlugFromTitle(input.title);
+        if (!slug || !prdCreate.PRD_CREATE_SLUG_RE.test(slug)) {
+          sendJson(res, 400, { ok: false, error: 'could not derive a valid kebab-case slug from title; supply "slug" explicitly' });
+          return;
+        }
+
+        // NN allocation is delegated to allocateParallelGroup() (PRD 548) via
+        // the injected remote — never re-derived here — unless the caller
+        // opted into an existing group explicitly.
+        const nn = input.parallelGroup ?? await remote.allocateParallelGroup();
+        const filenameSlug = `${nn}-${slug}`;
+
+        // An explicit `parallelGroup` bypasses allocateParallelGroup()'s
+        // collision-proof reservation, so re-check for an existing file at
+        // this exact destination before writing — remote.writePrd itself has
+        // no existence guard (by design, it doubles as the edit-in-place
+        // path for Scheduler UI PRD edits), so "create" must not silently
+        // clobber an existing job's PRD.
+        const existing = await remote.readPrd(filenameSlug);
+        if (existing?.ok) {
+          sendJson(res, 409, { ok: false, error: `PRD already exists: ${filenameSlug}.md` });
+          return;
+        }
+
+        let standardsText;
+        try {
+          standardsText = await prdCreate.readStandards();
+        } catch (e) {
+          sendJson(res, 500, { ok: false, error: `could not read engineering standards: ${e?.message}` });
+          return;
+        }
+
+        const body = prdCreate.buildPrdBody(input, standardsText);
+        const writeResult = await remote.writePrd(filenameSlug, body);
+        if (!writeResult?.ok) {
+          sendJson(res, 500, { ok: false, error: writeResult?.error ?? 'write failed' });
+          return;
+        }
+
+        sendJson(res, 200, { nn, filename: `${filenameSlug}.md`, status: 'queued' });
+        return;
+      }
       sendJson(res, 404, { ok: false, error: 'not found' });
     } catch (e) {
       sendJson(res, 500, { ok: false, error: e?.message ?? 'internal error' });

package/src/main/browserCapture.cjs

@@ -656,14 +656,21 @@ async function captureSelection({ viewId, selectors, mode }, getView) {
   }
 
   if (mode === 'a11y') {
-    const selector = selectors[0];
-    const tree = await captureA11y(wc, selector);
-    const text = tree ? formatA11yTree(tree) : '';
+    // captureA11y attaches/detaches the CDP debugger per call, so loop
+    // sequentially rather than firing selectors in parallel (mirrors the
+    // multi-select behavior of the html/selector modes above, which apply to
+    // the whole `selectors` array instead of only the first entry).
+    const trees = [];
+    for (const selector of selectors) {
+      const tree = await captureA11y(wc, selector);
+      if (tree) trees.push(tree);
+    }
+    const text = trees.map((t) => formatA11yTree(t)).join('\n\n');
     return { ok: true, mode, text, meta: {} };
   }
 
   // mode === 'agent'
-  const rawTree = await wc.executeJavaScript(
+  const rawTrees = await wc.executeJavaScript(
     `(function () {
       function serialize(el) {
         if (el.nodeType === 3) {
@@ -683,11 +690,18 @@ async function captureSelection({ viewId, selectors, mode }, getView) {
         }
         return { tag: el.tagName.toLowerCase(), attrs: attrs, style: { display: cs.display, visibility: cs.visibility }, children: children };
       }
-      var el = document.querySelector(${JSON.stringify(selectors[0])});
-      return el ? serialize(el) : null;
+      return (${JSON.stringify(selectors)}).map(function (sel) {
+        var el = document.querySelector(sel);
+        return el ? serialize(el) : null;
+      }).filter(Boolean);
     })()`,
   );
-  const { text, meta } = buildAgentCapture(capRawTree(rawTree));
+  const parts = (Array.isArray(rawTrees) ? rawTrees : []).map((t) => buildAgentCapture(capRawTree(t)));
+  const text = parts.map((p) => p.text).join('\n\n');
+  const meta = {
+    chunks: parts.reduce((a, p) => a + (p.meta.chunks || 0), 0),
+    tokens: parts.reduce((a, p) => a + (p.meta.tokens || 0), 0),
+  };
   return { ok: true, mode, text, meta };
 }
 

package/src/main/chatRunner.cjs

@@ -310,8 +310,12 @@ function pump() {
       .catch(() => { /* executeRun never rejects; defensive */ })
       .finally(() => { activeCount -= 1; pump(); });
   }
-  // Anyone still waiting gets a 1-based position update.
+  // Anyone still waiting gets a 1-based position update. Silent (automated
+  // probe) runs must stay invisible to the renderer, same as every other
+  // broadcast in executeRun — otherwise a queued probe would flip a tab's
+  // `running`/`queuedPosition` UI state for a run the user never initiated.
   waiting.forEach((w, i) => {
+    if (w.silent) return;
     broadcast('chat:run:queued', { tabId: w.tabId, sessionId: w.sessionId, position: i + 1 });
   });
 }

package/src/main/health.cjs

@@ -9,10 +9,27 @@ const fsp = require('node:fs/promises');
 const path = require('node:path');
 const os = require('node:os');
 const { execFileSync } = require('node:child_process');
+const { POLL_INTERVAL_MS } = require('./lib/schedulerConfig.cjs');
 
 const MAX_LOG_AGE_MS = 5 * 60_000; // 5 min — warn if no logs this old
 const PROJECT_ROOT = path.resolve(__dirname, '../..');
 
+// tickQueue() only fires (and updates lastRunAt) when a batch is actually
+// spawned — it does not tick on a fixed cadence — but the poll loop that
+// *invokes* tickQueue backs off starting from POLL_INTERVAL_MS (scheduler.cjs
+// pollLoop). 3x gives the poll loop three chances to notice free capacity +
+// pending work before we call it a stall, absorbing normal jitter (backoff,
+// memory-gate deferrals, boot warmup) without waiting so long that a real
+// outage goes unnoticed for hours (the 2026-07-14 incident sat stalled for
+// 16.5h before anything asserted on it).
+const TICK_STALL_MULTIPLIER = 3;
+const TICK_STALL_THRESHOLD_MS = TICK_STALL_MULTIPLIER * POLL_INTERVAL_MS;
+// A heartbeat line older than this is treated as "the app isn't running /
+// we can't observe live utilization" rather than "utilization is low" —
+// scheduler-heartbeat.log is only appended to while Electron is running, so
+// a stale line here is silent-on-purpose, not evidence of anything.
+const HEARTBEAT_STALE_MS = 5 * 60_000;
+
 function runCheck(cmd, cwd = PROJECT_ROOT) {
   try {
     execFileSync('bash', ['-c', cmd], {
@@ -26,6 +43,80 @@ function runCheck(cmd, cwd = PROJECT_ROOT) {
   }
 }
 
+// Reads the last line of scheduler-heartbeat.log, if fresh enough to trust.
+// Returns null when the file is missing, empty, unparseable, or stale — all
+// of which mean "can't observe live utilization right now", not "utilization
+// is low".
+function readFreshHeartbeat(heartbeatPath) {
+  let lines;
+  try {
+    lines = fs.readFileSync(heartbeatPath, 'utf8').split('\n').filter(Boolean);
+  } catch {
+    return null;
+  }
+  if (lines.length === 0) return null;
+  let entry;
+  try {
+    entry = JSON.parse(lines[lines.length - 1]);
+  } catch {
+    return null;
+  }
+  if (typeof entry.ts !== 'number' || Date.now() - entry.ts > HEARTBEAT_STALE_MS) return null;
+  return entry;
+}
+
+// Evaluates whether the scheduler tick looks stalled: pending work exists,
+// there's free capacity to run it, and nothing about the queue's own state
+// explains why it hasn't. Kept as a pure function of (queueState, heartbeat,
+// now) so it's testable without touching the filesystem.
+function evaluateTickLiveness(queueState, heartbeat, now, runningCount) {
+  const jobs = queueState.jobs || [];
+  const pending = jobs.filter((j) => j.status === 'pending');
+  const running = runningCount ?? jobs.filter((j) => j.status === 'running').length;
+  const config = queueState.config || {};
+  const concurrencyCap = config.concurrencyCap ?? Infinity;
+
+  if (pending.length === 0) return { stalled: false, reason: 'no-pending-jobs' };
+  if (queueState.paused) return { stalled: false, reason: 'paused' };
+  if (config.enabled === false) return { stalled: false, reason: 'disabled' };
+  if (running >= concurrencyCap) return { stalled: false, reason: 'at-capacity' };
+
+  const lastRunAt = queueState.lastRunAt ? Date.parse(queueState.lastRunAt) : null;
+  // No lastRunAt at all (fresh install, never ticked) — nothing to measure
+  // staleness against yet; don't manufacture a false positive.
+  if (lastRunAt == null || Number.isNaN(lastRunAt)) {
+    return { stalled: false, reason: 'no-lastRunAt', caveat: true };
+  }
+  const tickAgeMs = now - lastRunAt;
+  if (tickAgeMs <= TICK_STALL_THRESHOLD_MS) return { stalled: false, reason: 'recent-tick' };
+
+  // Candidate stall. The 'when-available' firePolicy legitimately holds
+  // pending jobs when billing utilization is at/above utilizationThreshold —
+  // rule that out before calling it a stall.
+  if (config.firePolicy === 'when-available' && typeof config.utilizationThreshold === 'number') {
+    if (!heartbeat) {
+      return {
+        stalled: false,
+        caveat: true,
+        reason: 'cannot-verify-utilization',
+        tickAgeMs,
+        oldestPendingSlug: pending[0]?.slug,
+      };
+    }
+    if (typeof heartbeat.utilization === 'number' && heartbeat.utilization >= config.utilizationThreshold) {
+      return { stalled: false, reason: 'utilization-at-threshold', utilization: heartbeat.utilization };
+    }
+  }
+
+  return {
+    stalled: true,
+    reason: 'stalled',
+    tickAgeMs,
+    oldestPendingSlug: pending[0]?.slug,
+    pendingCount: pending.length,
+  };
+}
+
 async function check() {
   const start = Date.now();
   const status = {
@@ -106,13 +197,33 @@ async function check() {
     const failedCount = Object.values(queueState.jobs || {}).filter(
       (j) => j.status === 'failed'
     ).length;
+    const heartbeatPath = path.join(
+      os.homedir(),
+      '.claude/session-manager/scheduler-heartbeat.log'
+    );
+    const heartbeat = readFreshHeartbeat(heartbeatPath);
+    const liveness = evaluateTickLiveness(queueState, heartbeat, Date.now(), runningCount);
     status.components.scheduler_queue = {
-      ok: true,
+      ok: !liveness.stalled,
       path: queuePath,
       jobs: Object.keys(queueState.jobs || {}).length,
       running: runningCount,
       failed: failedCount,
+      tickLiveness: liveness.reason,
     };
+    if (liveness.stalled) {
+      const ageMin = Math.round(liveness.tickAgeMs / 60_000);
+      status.components.scheduler_queue.stalledJob = liveness.oldestPendingSlug;
+      status.components.scheduler_queue.tickAgeMs = liveness.tickAgeMs;
+      status.issues.push(
+        `Scheduler tick appears stalled: "${liveness.oldestPendingSlug}" (and ${liveness.pendingCount - 1} other pending job(s)) has been waiting ~${ageMin}m with free capacity and no tick progress`
+      );
+    } else if (liveness.caveat) {
+      status.components.scheduler_queue.caveat =
+        liveness.reason === 'cannot-verify-utilization'
+          ? `Tick hasn't advanced in a while but scheduler-heartbeat.log is missing/stale, so current billing utilization can't be checked — cannot rule out a legitimate when-available hold`
+          : 'No lastRunAt recorded yet — cannot assess tick liveness';
+    }
   } catch (e) {
     if (e.code !== 'ENOENT') {
       status.issues.push(`Scheduler queue unreadable: ${e.message}`);
@@ -197,7 +308,7 @@ async function check() {
   // Critical: nodejs, config dir, typescript, build artifact, test infrastructure.
   // Non-fatal: scheduler/transcripts dirs may not exist on fresh install.
   // Informational: app log age (shows if app is running, but not blocking).
-  const criticalComponents = ['nodejs', 'config_dir', 'typescript', 'build_artifact', 'test_infrastructure'];
+  const criticalComponents = ['nodejs', 'config_dir', 'typescript', 'build_artifact', 'test_infrastructure', 'scheduler_queue'];
   status.ok = criticalComponents.every((c) => status.components[c]?.ok !== false);
 
   status.elapsedMs = Date.now() - start;
@@ -213,4 +324,4 @@ if (require.main === module) {
   })();
 }
 
-module.exports = { check };
+module.exports = { check, evaluateTickLiveness, readFreshHeartbeat, TICK_STALL_THRESHOLD_MS, HEARTBEAT_STALE_MS };

package/src/main/hives.cjs

@@ -33,6 +33,7 @@ const path = require('node:path');
 const os = require('node:os');
 const { z } = require('zod');
 const config = require('./config.cjs');
+const { kebabCase: sharedKebabCase } = require('./lib/kebabCase.cjs');
 
 // ──────────────────────────────────────────── caps
 const SLUG_RE = /^[a-z0-9-_]{1,64}$/;
@@ -89,7 +90,7 @@ async function ensureRoot() {
 
 // ──────────────────────────────────────────── helpers
 function kebabCase(s) {
-  return s.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 64) || 'agent';
+  return sharedKebabCase(s, { maxLen: 64, fallback: 'agent' });
 }
 
 // ──────────────────────────────────────────── legacy migration

package/src/main/ipcSchemas.cjs

@@ -228,6 +228,33 @@ const scheduleWritePrd = z.object({
   ),
 });
 
+// PRD create (admin API — scheduler_create_prd, PRD 549). This slug is
+// deliberately STRICTER than SCHEDULE_SLUG_RE: it becomes a brand-new
+// filename segment written to disk by the create route, not a lookup key
+// for an existing file, so it excludes '.' and '_' too (matches
+// pluginInstall.cjs's slug precedent, minus '/' — this slug must never
+// introduce a subdirectory).
+const PRD_CREATE_SLUG_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+// title/cwd become frontmatter VALUES (`title: ${title}`) in prdCreate.cjs's
+// hand-rolled `key: value` serializer, which — unlike a real YAML
+// library — has no escaping. A title/cwd containing '\n' could inject a
+// bare `\n---\n` that terminates the frontmatter block early (per
+// prdFrontmatter.cjs's `indexOf('\n---')` parse) and smuggle extra
+// frontmatter-shaped lines into the body. Block newlines at the boundary
+// instead of trying to escape them later.
+const NO_NEWLINE_RE = /^[^\r\n]*$/;
+const schedulerCreatePrd = z.object({
+  title: z.string().min(1).max(200).regex(NO_NEWLINE_RE, 'must not contain newlines'),
+  cwd: z.string().min(1).max(4096).regex(NO_NEWLINE_RE, 'must not contain newlines'),
+  estimateMinutes: z.number().int().min(1).max(100000),
+  goal: z.string().min(1).max(20000),
+  acceptanceCriteria: z.array(z.string().min(1).max(2000)).min(1).max(100),
+  implementationNotes: z.string().min(1).max(20000),
+  outOfScope: z.array(z.string().min(1).max(2000)).max(100).optional(),
+  slug: z.string().min(1).max(60).regex(PRD_CREATE_SLUG_RE).optional(),
+  parallelGroup: z.number().int().min(1).max(999999).optional(),
+});
+
 // Bulk archive: slug list, capped to limit unbounded retag/archive payloads.
 const scheduleArchivePrd = z.object({
   slugs: z.array(z.string().regex(SCHEDULE_SLUG_RE)).min(1).max(500),
@@ -290,11 +317,11 @@ const setConfigSchema = z.object({
 }).strict();
 
 // ──────────────────────────────────────────── Memory tool (Bundle C, cycle 3)
-// Workspace-scoped markdown store at ~/.claude/session-manager/memories/<ws>/.
-// Slug regex must match memoryTool.cjs SLUG_RE; workspace regex matches its
-// encodeWorkspace() output (alphanumeric + dash) plus 'default'.
+// Workspace-scoped markdown store at ~/.claude/projects/<ws>/memory/.
+// Slug regex is shared with memoryTool.cjs/memoryAggregate.cjs via lib/memorySlug.cjs;
+// workspace regex matches encodeWorkspace() output (alphanumeric + dash) plus 'default'.
 const MEMORY_WORKSPACE_RE = /^[a-zA-Z0-9-_]{1,256}$/;
-const MEMORY_SLUG_RE = /^[a-z0-9-_]+\.md$/;
+const { MEMORY_SLUG_RE } = require('./lib/memorySlug.cjs');
 // 1 MiB hard cap — matches MAX_FILE_BYTES in memoryTool.cjs.
 const MEMORY_MAX_BYTES = 1024 * 1024;
 
@@ -613,6 +640,7 @@ module.exports = {
   // direct test()/match() containment checks alongside the zod parses.
   SCHEDULE_SLUG_RE,
   SCHEDULE_RUN_ID_RE,
+  PRD_CREATE_SLUG_RE,
   READ_COMMANDS,
   SAS_GATED_READS,
   MUTATE_COMMANDS,
@@ -651,6 +679,7 @@ module.exports = {
     scheduleSlug,
     scheduleReadLog,
     scheduleWritePrd,
+    schedulerCreatePrd,
     scheduleArchivePrd,
     scheduleRetagPrd,
     setConfigSchema,

package/src/main/lib/kebabCase.cjs

@@ -0,0 +1,12 @@
+/**
+ * kebabCase.cjs — shared lowercase/kebab-case slugify. Extracted from
+ * hives.cjs (private `kebabCase` helper) so prdCreate.cjs doesn't fork a
+ * second, subtly-different copy (API reuse: one concept, one implementation).
+ */
+'use strict';
+
+function kebabCase(s, { maxLen = 64, fallback = '' } = {}) {
+  return s.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').slice(0, maxLen) || fallback;
+}
+
+module.exports = { kebabCase };

package/src/main/lib/memorySlug.cjs

@@ -0,0 +1,10 @@
+'use strict';
+
+/**
+ * Shared workspace-memory filename regex. memoryTool.cjs (CRUD), memoryAggregate.cjs
+ * (clustering), and ipcSchemas.cjs (IPC validation) all gate on the same slug shape —
+ * single source of truth so the three don't drift.
+ */
+const MEMORY_SLUG_RE = /^[a-z0-9-_]+\.md$/;
+
+module.exports = { MEMORY_SLUG_RE };