claude-code-session-manager 0.35.3 → 0.35.5

package/src/main/__tests__/scheduler-autofix-select.test.cjs

@@ -8,9 +8,10 @@
 
 const { test } = require('node:test');
 const assert = require('node:assert/strict');
-const { selectAutoFixTargets } = require('../scheduler.cjs');
+const { selectAutoFixTargets, isUnresolvableNeedsReview } = require('../scheduler.cjs');
 
 const noSiblingOnDisk = () => false;
+const noRunDir = () => null;
 
 function makeJob(overrides = {}) {
   return {
@@ -53,8 +54,55 @@ test('excludes a completed job', () => {
   assert.strictEqual(result.length, 0);
 });
 
-test('excludes a job missing runId', () => {
+test('excludes a job missing runId when no run dir resolves', () => {
   const jobs = [makeJob({ runId: null })];
+  const result = selectAutoFixTargets(jobs, { fixSlugExists: noSiblingOnDisk, resolveJobRunId: noRunDir });
+  assert.strictEqual(result.length, 0);
+});
+
+test('selects a job missing runId when a run dir resolves (gap 1: runId backfill)', () => {
+  const jobs = [makeJob({ runId: null })];
+  const result = selectAutoFixTargets(jobs, {
+    fixSlugExists: noSiblingOnDisk,
+    resolveJobRunId: () => '2026-06-16T10-00-00-000Z',
+  });
+  assert.strictEqual(result.length, 1);
+});
+
+test('isUnresolvableNeedsReview: needs_review + no runId + no run dir → true', () => {
+  const job = makeJob({ runId: null });
+  assert.strictEqual(isUnresolvableNeedsReview(job, { hasRunDir: false }), true);
+});
+
+test('isUnresolvableNeedsReview: needs_review + no runId + has run dir → false', () => {
+  const job = makeJob({ runId: null });
+  assert.strictEqual(isUnresolvableNeedsReview(job, { hasRunDir: true }), false);
+});
+
+test('isUnresolvableNeedsReview: needs_review + runId present → false', () => {
+  const job = makeJob();
+  assert.strictEqual(isUnresolvableNeedsReview(job, { hasRunDir: false }), false);
+});
+
+test('isUnresolvableNeedsReview: non needs_review status → false', () => {
+  const job = makeJob({ runId: null, status: 'failed' });
+  assert.strictEqual(isUnresolvableNeedsReview(job, { hasRunDir: false }), false);
+});
+
+test('autoFixOutcome no-plan with retries=0 is retried', () => {
+  const jobs = [makeJob({ autoFixAttempted: true, autoFixOutcome: 'no-plan', autoFixRetries: 0 })];
+  const result = selectAutoFixTargets(jobs, { fixSlugExists: noSiblingOnDisk });
+  assert.strictEqual(result.length, 1);
+});
+
+test('autoFixOutcome no-plan with retries=1 is exhausted (not selected)', () => {
+  const jobs = [makeJob({ autoFixAttempted: true, autoFixOutcome: 'no-plan', autoFixRetries: 1 })];
+  const result = selectAutoFixTargets(jobs, { fixSlugExists: noSiblingOnDisk });
+  assert.strictEqual(result.length, 0);
+});
+
+test('autoFixAttempted true with no outcome recorded stays excluded (existing 1-attempt cap)', () => {
+  const jobs = [makeJob({ autoFixAttempted: true })];
   const result = selectAutoFixTargets(jobs, { fixSlugExists: noSiblingOnDisk });
   assert.strictEqual(result.length, 0);
 });

package/src/main/__tests__/scheduler-autopromote.test.cjs

@@ -8,7 +8,7 @@
 
 const { test } = require('node:test');
 const assert = require('node:assert/strict');
-const { isPromotableOriginal } = require('../scheduler.cjs');
+const { isPromotableOriginal, healTargetForFix } = require('../scheduler.cjs');
 
 test('isPromotableOriginal: failed → true', () => {
   assert.strictEqual(isPromotableOriginal('failed'), true);
@@ -30,4 +30,22 @@ test('isPromotableOriginal: pending → false', () => {
   assert.strictEqual(isPromotableOriginal('pending'), false);
 });
 
+test('healTargetForFix: matches the specific original by full numeric-prefixed slug, not just base', () => {
+  const jobs = [
+    { slug: '451-foo', status: 'needs_review' },
+    { slug: '453-foo', status: 'needs_review' },
+  ];
+  const target = healTargetForFix('451-fix-foo', jobs);
+  assert.strictEqual(target.slug, '451-foo');
+});
+
+test('healTargetForFix: returns null when no promotable original matches', () => {
+  const jobs = [
+    { slug: '451-foo', status: 'completed' },
+    { slug: '453-foo', status: 'needs_review' },
+  ];
+  const target = healTargetForFix('451-fix-foo', jobs);
+  assert.strictEqual(target, null);
+});
+
 console.log('scheduler-autopromote tests: PASS');

package/src/main/__tests__/scheduler-investigation-prompt.test.cjs

@@ -0,0 +1,51 @@
+/**
+ * scheduler-investigation-prompt.test.cjs — unit tests for buildInvestigationPrompt.
+ *
+ * Run: timeout 120 node --test src/main/__tests__/scheduler-investigation-prompt.test.cjs
+ */
+
+'use strict';
+
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const { buildInvestigationPrompt } = require('../scheduler.cjs');
+
+function makeArgs(overrides = {}) {
+  return {
+    failedJob: { slug: '05-my-feature', title: 'My feature', exitCode: 1 },
+    cwd: '/home/bilko/Projects/session-manager',
+    failedLogPath: '/tmp/05-my-feature.log',
+    originalBody: 'Original PRD body.',
+    logTail: 'some log tail output',
+    fixPath: '/tmp/05-fix-my-feature.md',
+    group: 5,
+    ...overrides,
+  };
+}
+
+test('prompt references the canonical standards.md file', () => {
+  const prompt = buildInvestigationPrompt(makeArgs());
+  assert.match(prompt, /standards\.md/);
+  assert.match(prompt, /plugins\/session-manager-dev\/skills\/develop\/standards\.md/);
+});
+
+test('prompt instructs inlining the Execution discipline section under Engineering standards', () => {
+  const prompt = buildInvestigationPrompt(makeArgs());
+  assert.match(prompt, /Engineering standards/);
+  assert.match(prompt, /Execution discipline \(headless runs\)/);
+});
+
+test('prompt contains the named "delegated instead of executed" detection check', () => {
+  const prompt = buildInvestigationPrompt(makeArgs());
+  assert.match(prompt, /ScheduleWakeup/);
+  assert.match(prompt, /session-manager-dev:develop/);
+  assert.match(prompt, /never re-queue or self-schedule|delegated instead of executed/);
+});
+
+test('prompt includes the resolved job fields', () => {
+  const prompt = buildInvestigationPrompt(makeArgs());
+  assert.match(prompt, /05-my-feature/);
+  assert.match(prompt, /Original PRD body\./);
+  assert.match(prompt, /some log tail output/);
+  assert.match(prompt, /05-fix-my-feature\.md/);
+});

package/src/main/browserView.cjs

@@ -18,7 +18,7 @@ const path = require('path');
 const os = require('os');
 const fs = require('fs');
 const crypto = require('crypto');
-const { WebContentsView, shell } = require('electron');
+const { WebContentsView } = require('electron');
 const { sendIfAlive } = require('./lib/sendToRenderer.cjs');
 const { readJson, writeJson } = require('./config.cjs');
 
@@ -181,7 +181,7 @@ function wireNavEvents(viewId, view) {
 
   wc.setWindowOpenHandler(({ url }) => {
     if (/^https?:\/\//i.test(url)) {
-      shell.openExternal(url).catch(() => {});
+      sendIfAlive(win, 'browser:open-tab-request', { url });
     }
     return { action: 'deny' };
   });

package/src/main/chatRunner.cjs

@@ -12,9 +12,14 @@
  * OOM that SIGKILLed a job on 2026-06-26.
  *
  * Public surface:
- *   run({ tabId, sessionId, prompt, cwd, resume }): void  — fire-and-forget enqueue
+ *   run({ tabId, sessionId, prompt, cwd, resume, silent }): void  — fire-and-forget enqueue.
+ *     `silent` (PRD 470) still goes through the same per-tab FIFO lane, but suppresses the
+ *     six turn-affecting broadcasts + recordExchange (see probeContextUsage below).
  *   cancel(tabId): void
  *   parseStopSignal(finalText): { questions: string[] } | null     — exported for reuse
+ *   parseContextUsageMarkdown(text): { usedTokens, totalTokens, usedPct, categories } | null
+ *                                                                    — pure parser for `/context`
+ *   probeContextUsage({ tabId, sessionId, cwd }): void  — fire-and-forget silent `/context` probe
  *   STOP_SENTINEL: string                                           — exported for tests
  *   __setExecutor(fn): void                                         — test seam
  *
@@ -26,6 +31,9 @@
  *   chat:run:complete   { tabId, sessionId, finalMessage }
  *   chat:run:needs-input { tabId, sessionId, questions, raw }
  *   chat:run:error      { tabId, sessionId, message }
+ *   chat:run:notice     { tabId, sessionId, message }        — informational, not terminal
+ *   chat:context-usage  { tabId, sessionId, usedTokens, totalTokens, usedPct, categories }
+ *                                                             — result of a silent `/context` probe
  */
 
 const { spawn } = require('node:child_process');
@@ -71,6 +79,145 @@ function parseStopSignal(finalText) {
   }
 }
 
+// ─── `/context` probe (PRD 470) ────────────────────────────────────────────
+// `claude -p "/context"` is answered entirely locally by the CLI (zero-cost,
+// no real API call) with markdown containing a summary line and a per-category
+// breakdown table. Parsed here so the app can mirror the CLI's own context-
+// window accounting without re-implementing the estimate itself.
+
+// "9k" -> 9000, "15.1k" -> 15100; bare "207" -> 207. Never throws — returns NaN
+// for genuinely malformed input, which callers treat as a parse failure.
+function parseTokenAmount(str) {
+  const suffixed = /^(\d+(?:\.\d+)?)k$/i.exec(str);
+  if (suffixed) return Math.round(parseFloat(suffixed[1]) * 1000);
+  return Number(str);
+}
+
+/**
+ * Parse the markdown produced by the CLI's own `/context` slash command into
+ * a structured summary. Pure, single line-by-line pass — O(n) over the lines
+ * of a small, bounded response, no nested scans.
+ *
+ * @param {string} text
+ * @returns {{ usedTokens: number, totalTokens: number, usedPct: number, categories: Array<{ category: string, tokens: number, pct: number }> } | null}
+ */
+function parseContextUsageMarkdown(text) {
+  if (typeof text !== 'string' || !text) return null;
+  const lines = text.split('\n');
+
+  let usedTokens = null;
+  let totalTokens = null;
+  let usedPct = null;
+  const tokensLineRe = /\*\*Tokens:\*\*\s*(\S+)\s*\/\s*(\S+)\s*\(([\d.]+)%\)/;
+
+  let inTable = false;
+  let foundHeading = false;
+  const categories = [];
+
+  for (const line of lines) {
+    if (usedTokens === null) {
+      const m = tokensLineRe.exec(line);
+      if (m) {
+        usedTokens = parseTokenAmount(m[1]);
+        totalTokens = parseTokenAmount(m[2]);
+        usedPct = Number(m[3]);
+      }
+    }
+
+    if (!inTable) {
+      if (line.trim() === '### Estimated usage by category') {
+        foundHeading = true;
+        inTable = true;
+      }
+      continue;
+    }
+    const trimmed = line.trim();
+    if (trimmed.startsWith('###')) { inTable = false; continue; }
+    if (!trimmed.startsWith('|')) continue;
+
+    const cells = trimmed.split('|').map((c) => c.trim()).filter((c) => c.length > 0);
+    if (cells.length !== 3) continue;
+    if (cells[0].toLowerCase() === 'category') continue; // header row
+    if (/^:?-+:?$/.test(cells[0])) continue; // separator row
+
+    const tokens = parseTokenAmount(cells[1]);
+    const pctMatch = /^([\d.]+)%$/.exec(cells[2]);
+    if (!pctMatch || Number.isNaN(tokens)) continue;
+    categories.push({ category: cells[0], tokens, pct: Number(pctMatch[1]) });
+  }
+
+  if (
+    usedTokens === null || totalTokens === null || usedPct === null ||
+    Number.isNaN(usedTokens) || Number.isNaN(totalTokens) || Number.isNaN(usedPct) ||
+    !foundHeading || categories.length === 0
+  ) {
+    return null;
+  }
+
+  return { usedTokens, totalTokens, usedPct, categories };
+}
+
+/**
+ * Fire-and-forget silent probe of the resumed session's context usage. Reuses
+ * the normal `run()` queue/lane (resume: true, silent: true) so it can never
+ * race a real chat run against the same `--resume sessionId`. Broadcasts
+ * `chat:context-usage` on success; logs (never throws/broadcasts) on a parse
+ * failure.
+ *
+ * @param {{ tabId: string, sessionId: string, cwd: string }} params
+ */
+function probeContextUsage({ tabId, sessionId, cwd }) {
+  run({
+    tabId,
+    sessionId,
+    prompt: '/context',
+    cwd,
+    resume: true,
+    silent: true,
+    onSilentResult: (text) => {
+      const parsed = parseContextUsageMarkdown(text);
+      if (!parsed) {
+        console.error('[chatRunner] parseContextUsageMarkdown failed to parse /context probe output');
+        return;
+      }
+      broadcast('chat:context-usage', {
+        tabId,
+        sessionId,
+        usedTokens: parsed.usedTokens,
+        totalTokens: parsed.totalTokens,
+        usedPct: parsed.usedPct,
+        categories: parsed.categories,
+      });
+    },
+  });
+}
+
+// ─── MCP consent-denial detection ──────────────────────────────────────────
+// Best-effort substring heuristic over known CLI phrasing — NOT a documented
+// stream-json schema field. Confirmed by extracting strings from the compiled
+// `claude` CLI binary (2.1.207): a non-interactive/`-p` run that hits an
+// MCP server requiring first-party consent (e.g. `claude_design`) throws a
+// tool error whose message is exactly:
+//   "<tool label> The user hasn't granted this — run /design consent to
+//   grant it (it can't be approved automatically in this permission mode)."
+// which surfaces to stdout as a `tool_result` block (is_error: true) inside a
+// `type: "user"` stream-json event. Since consent flows exist for MCP servers
+// beyond `claude_design`, match on the generic phrasing rather than the
+// design-specific slash command.
+const MCP_CONSENT_DENIAL_MARKERS = [
+  "hasn't granted this",
+  'run /design consent',
+  'connect to claude design',
+  'requires consent',
+  'needs a claude.ai credential',
+];
+
+function hasMcpConsentDenial(text) {
+  if (typeof text !== 'string' || !text) return false;
+  const lower = text.toLowerCase();
+  return MCP_CONSENT_DENIAL_MARKERS.some((marker) => lower.includes(marker));
+}
+
 // Instruction prepended to every prompt. Tells the agent how to signal that
 // it needs clarification vs. having completed the task.
 const STOP_SIGNAL_INSTRUCTION =
@@ -94,7 +241,7 @@ const CONCURRENCY_CAP = Math.min(
 
 // tabId → cancel() for every ACTIVE run; FIFO list of WAITING runs; live count.
 const inFlight = new Map();
-const waiting = []; // [{ tabId, sessionId, prompt, cwd, resume }]
+const waiting = []; // [{ tabId, sessionId, prompt, cwd, resume, silent, onSilentResult }]
 let activeCount = 0;
 
 // Indirection so tests can stub the spawn without launching claude.
@@ -126,7 +273,7 @@ function broadcast(channel, payload) {
  * queue and are announced via chat:run:queued. De-dupes a tab already in the
  * pipeline (the UI disables input while running, but guard anyway).
  *
- * @param {{ tabId: string, sessionId: string, prompt: string, cwd: string, resume: boolean }} opts
+ * @param {{ tabId: string, sessionId: string, prompt: string, cwd: string, resume: boolean, silent?: boolean, onSilentResult?: (text: string) => void }} opts
  */
 function run(opts) {
   if (inFlight.has(opts.tabId) || waiting.some((w) => w.tabId === opts.tabId)) return;
@@ -159,10 +306,10 @@ function pump() {
  * for the run's lifetime so cancel() can reach it. Never rejects — the queue
  * pump relies on the returned promise always settling so the lane frees.
  *
- * @param {{ tabId: string, sessionId: string, prompt: string, cwd: string, resume: boolean }} opts
+ * @param {{ tabId: string, sessionId: string, prompt: string, cwd: string, resume: boolean, silent?: boolean, onSilentResult?: (text: string) => void }} opts
  * @returns {Promise<void>}
  */
-function executeRun({ tabId, sessionId, prompt, cwd, resume }) {
+function executeRun({ tabId, sessionId, prompt, cwd, resume, silent, onSilentResult }) {
   return new Promise((resolve) => {
     let settled = false;
     // Frees the lane exactly once: drops the cancel fn and resolves the promise
@@ -185,9 +332,30 @@ function executeRun({ tabId, sessionId, prompt, cwd, resume }) {
     const emitTerminal = (channel, payload) => {
       if (terminalSent) return;
       terminalSent = true;
+      // Silent (probe) runs still need this bookkeeping so the lane frees
+      // correctly, but must never surface on the six turn-affecting channels.
+      if (silent) return;
       broadcast(channel, payload);
     };
 
+    // Separate one-shot guard for the MCP-consent notice (orthogonal to
+    // terminalSent — a run can hit this mid-stream and still legitimately
+    // finish with a normal complete/error afterward).
+    let noticeSent = false;
+    const emitNoticeOnce = () => {
+      if (noticeSent) return;
+      noticeSent = true;
+      broadcast('chat:run:notice', {
+        tabId,
+        sessionId,
+        message:
+          'This run needs interactive consent for an MCP server (e.g. Claude Design), which ' +
+          "can't be granted in chat mode because stdin is closed for headless runs. Open a " +
+          'raw terminal session for this tab ("Back to chat" toggle) and grant consent there, ' +
+          'then retry.',
+      });
+    };
+
     const claudeBin = resolveClaudeBin();
     const childEnv = cleanChildEnv({ PATH: pathWithUserBins() });
 
@@ -209,7 +377,7 @@ function executeRun({ tabId, sessionId, prompt, cwd, resume }) {
       args.push('--session-id', sessionId);
     }
 
-    broadcast('chat:run:started', { tabId, sessionId });
+    if (!silent) broadcast('chat:run:started', { tabId, sessionId });
 
     // Spawn with stdin closed (mirrors scheduler's 'ignore' — prevents the
     // "claude -p stdin must be closed" gotcha from kg.cjs). stdout is piped for
@@ -279,32 +447,54 @@ function executeRun({ tabId, sessionId, prompt, cwd, resume }) {
         for (const block of content) {
           if (block.type === 'text' && typeof block.text === 'string') {
             finalAssistantText += block.text;
-            broadcast('chat:run:output', { tabId, delta: block.text });
+            if (!silent) broadcast('chat:run:output', { tabId, delta: block.text });
           } else if (block.type === 'tool_use' && typeof block.name === 'string') {
             const classified = classifyToolUse(block);
-            broadcast('chat:run:tool-use', { tabId, id: block.id, ...classified });
+            if (!silent) broadcast('chat:run:tool-use', { tabId, id: block.id, ...classified });
           }
         }
+      } else if (event.type === 'user') {
+        // Tool results come back as content blocks on a synthetic "user" event.
+        // An MCP consent-denial surfaces here as an is_error tool_result whose
+        // text carries one of MCP_CONSENT_DENIAL_MARKERS.
+        const content = Array.isArray(event.message?.content) ? event.message.content : [];
+        for (const block of content) {
+          if (block.type !== 'tool_result') continue;
+          const inner = block.content;
+          const text = typeof inner === 'string'
+            ? inner
+            : Array.isArray(inner)
+              ? inner.filter((c) => c?.type === 'text' && typeof c.text === 'string').map((c) => c.text).join('\n')
+              : '';
+          if (hasMcpConsentDenial(text)) emitNoticeOnce();
+        }
       } else if (event.type === 'result') {
         // Use the authoritative `result` field when available; fall back to
         // accumulated assistant text (same content, different source).
         const text = typeof event.result === 'string' ? event.result : finalAssistantText;
 
         if (event.subtype === 'success') {
-          const signal = parseStopSignal(text);
-          if (signal) {
-            emitTerminal('chat:run:needs-input', {
-              tabId,
-              sessionId,
-              questions: signal.questions,
-              raw: text,
-            });
-          } else {
+          if (silent) {
+            // Silent probe: no turn broadcast, no recordExchange — just hand
+            // the final text to whoever enqueued the probe (e.g. probeContextUsage).
             emitTerminal('chat:run:complete', { tabId, sessionId, finalMessage: text });
-            // Record durable exchange off the hot path — UI must not wait on Haiku
-            recordExchange({ sessionId, cwd, prompt, result: text }).catch((err) => {
-              console.error('[chatRunner] recordExchange failed:', err?.message ?? err);
-            });
+            if (typeof onSilentResult === 'function') onSilentResult(text);
+          } else {
+            const signal = parseStopSignal(text);
+            if (signal) {
+              emitTerminal('chat:run:needs-input', {
+                tabId,
+                sessionId,
+                questions: signal.questions,
+                raw: text,
+              });
+            } else {
+              emitTerminal('chat:run:complete', { tabId, sessionId, finalMessage: text });
+              // Record durable exchange off the hot path — UI must not wait on Haiku
+              recordExchange({ sessionId, cwd, prompt, result: text }).catch((err) => {
+                console.error('[chatRunner] recordExchange failed:', err?.message ?? err);
+              });
+            }
           }
         } else {
           emitTerminal('chat:run:error', {
@@ -410,6 +600,11 @@ function registerChatHandlers() {
     try { tabId = schemas.chatCancel.parse(payload).tabId; } catch { return; }
     cancel(tabId);
   });
+
+  ipcMain.handle('chat:probe-context', validated(schemas.chatProbeContext, async ({ tabId, sessionId, cwd }) => {
+    probeContextUsage({ tabId, sessionId, cwd });
+    return { ok: true };
+  }));
 }
 
 module.exports = {
@@ -418,6 +613,8 @@ module.exports = {
   attachWindow,
   registerChatHandlers,
   parseStopSignal,
+  parseContextUsageMarkdown,
+  probeContextUsage,
   STOP_SENTINEL,
   __setExecutor,
 };

package/src/main/index.cjs

@@ -14,6 +14,7 @@ const transcripts = require('./transcripts.cjs');
 const usageMatrix = require('./usageMatrix.cjs');
 const sessionsStore = require('./sessionsStore.cjs');
 const billing = require('./usage.cjs');
+const { probeMcpStatus } = require('./mcpStatus.cjs');
 const logs = require('./logs.cjs');
 const crashDiagnostics = require('./crashDiagnostics.cjs');
 // Start the local minidump collector before app-ready (required by Electron).
@@ -408,6 +409,10 @@ ipcMain.handle('app:launch-mode', () => ({
   cwd: process.cwd(),
 }));
 
+// MCP Servers tab (PRD 456 consumes this): probes live connection status via
+// `claude mcp list`. Read-only, single in-flight call — no polling.
+ipcMain.handle('mcp:status', () => probeMcpStatus());
+
 ipcMain.handle('app:engage-rules-path', () => process.env.SESSION_MANAGER_ENGAGE_RULES || null);
 
 // Boot diagnostics — renderer polls these to surface toasts when `claude` isn't
@@ -450,6 +455,20 @@ ipcMain.handle('clipboard:paste-image', async () => {
   }
 });
 
+// Text paste — same rationale as clipboard:paste-image above: the renderer's
+// navigator.clipboard.readText() requires the 'clipboard-read' permission,
+// which setPermissionRequestHandler denies (MEDIA_PERMS only), so it always
+// rejects. Reading via Electron's main-process clipboard.readText() sidesteps
+// that permission gate entirely — no permission-handler changes needed.
+ipcMain.handle('clipboard:paste-text', async () => {
+  try {
+    const text = clipboard.readText();
+    return { ok: true, text: text || '' };
+  } catch (e) {
+    return { ok: false, error: e && e.message ? e.message : String(e) };
+  }
+});
+
 // PRD 407 Capture panel — write side of paste-image's read. Writes a
 // screenshot capture to the OS clipboard as an image.
 ipcMain.handle('browser:copy-image', validated(schemas.browserCopyImage, ({ dataUrl }) => {

package/src/main/ipcSchemas.cjs

@@ -382,6 +382,12 @@ const chatCancel = z.object({
   tabId: z.string().min(1).max(128),
 });
 
+const chatProbeContext = z.object({
+  tabId: z.string().min(1).max(128),
+  sessionId: z.string().min(1).max(128),
+  cwd: z.string().min(1).max(4096),
+});
+
 // ──────────────────────────────────────────── Web Remote
 // OTP is 8 uppercase alphanumeric chars (case-insensitive entry, normalised to upper in handler).
 const WEB_REMOTE_OTP_RE = /^[A-Z0-9]{8}$/i;
@@ -665,6 +671,7 @@ module.exports = {
     watchersKillTab,
     chatRun,
     chatCancel,
+    chatProbeContext,
     exchangesList,
   },
   validated,

package/src/main/mcpStatus.cjs

@@ -0,0 +1,93 @@
+'use strict';
+
+/**
+ * mcpStatus.cjs — probes live MCP server connection status by shelling out to
+ * `claude mcp list` (a plain subcommand, no LLM call — no --model pin needed).
+ *
+ * Read-only, non-polling: only runs on explicit renderer request (mcp:status
+ * IPC). Coalesces concurrent callers onto a single in-flight probe so bursts
+ * don't fan out into parallel `claude` processes.
+ */
+
+const { spawn } = require('node:child_process');
+const { resolveClaudeBin } = require('./lib/claudeBin.cjs');
+
+const PROBE_TIMEOUT_MS = 30_000;
+
+// One server line: "<name>: <target> - <glyph> <status text>"
+const LINE_RE = /^(.+?):\s(.+?)\s-\s(\S+)\s*(.*)$/;
+
+/**
+ * Pure parser — no I/O. Extracts { name, target, transport, status } per
+ * server line. Ignores the "Checking MCP server health…" header and blank
+ * lines. Never throws: unparseable input yields [].
+ */
+function parseMcpList(stdout) {
+  if (!stdout || typeof stdout !== 'string') return [];
+  const servers = [];
+  for (const rawLine of stdout.split('\n')) {
+    const line = rawLine.trim();
+    if (!line) continue;
+    if (line.toLowerCase().startsWith('checking mcp server health')) continue;
+    const m = LINE_RE.exec(line);
+    if (!m) continue;
+    const [, name, target, glyph, statusText] = m;
+    const transport = /\(HTTP\)$/.test(target) || /^https?:\/\//i.test(target) ? 'http' : 'stdio';
+    let status;
+    if (glyph === '✔') status = 'connected';
+    else if (glyph === '✘') status = 'failed';
+    else if (glyph === '!') status = 'needs-auth';
+    else if (glyph === '⏸') status = 'pending';
+    else status = 'unknown';
+    servers.push({ name: name.trim(), target: target.trim(), transport, status, statusText: statusText.trim() });
+  }
+  return servers;
+}
+
+let inFlight = null;
+
+/** Spawns `claude mcp list`, parses it. Resolves — never rejects. */
+function runProbe() {
+  return new Promise((resolve) => {
+    let bin;
+    try { bin = resolveClaudeBin(); } catch (e) {
+      resolve({ ok: false, servers: [], error: `claude not found: ${e?.message}`, checkedAt: Date.now() });
+      return;
+    }
+    let child;
+    try {
+      child = spawn(bin, ['mcp', 'list'], { env: process.env, stdio: ['ignore', 'pipe', 'pipe'] });
+    } catch (e) {
+      resolve({ ok: false, servers: [], error: e?.message || 'spawn error', checkedAt: Date.now() });
+      return;
+    }
+    let out = '';
+    let err = '';
+    const MAX_OUT_BYTES = 1 * 1024 * 1024;
+    let settled = false;
+    const finish = (result) => { if (!settled) { settled = true; clearTimeout(timer); resolve(result); } };
+    const timer = setTimeout(() => {
+      try { child.kill('SIGKILL'); } catch { /* */ }
+      finish({ ok: false, servers: [], error: 'timeout', checkedAt: Date.now() });
+    }, PROBE_TIMEOUT_MS);
+    child.stdout.on('data', (d) => { if (out.length < MAX_OUT_BYTES) out += d; });
+    child.stderr.on('data', (d) => { if (err.length < MAX_OUT_BYTES) err += d; });
+    child.on('error', (e) => { finish({ ok: false, servers: [], error: e?.message || 'spawn error', checkedAt: Date.now() }); });
+    child.on('close', (code) => {
+      if (code !== 0 && !out) {
+        finish({ ok: false, servers: [], error: err.slice(0, 500) || `exit ${code}`, checkedAt: Date.now() });
+        return;
+      }
+      finish({ ok: true, servers: parseMcpList(out), checkedAt: Date.now() });
+    });
+  });
+}
+
+/** Public entry point. Coalesces concurrent callers onto one in-flight probe. */
+function probeMcpStatus() {
+  if (inFlight) return inFlight;
+  inFlight = runProbe().finally(() => { inFlight = null; });
+  return inFlight;
+}
+
+module.exports = { probeMcpStatus, parseMcpList };