claude-code-session-manager 0.35.4 → 0.35.6

package/src/main/chatRunner.cjs

@@ -5,16 +5,24 @@
  * the terminal chat UI (PRD 319). Each call spawns a fresh process that exits
  * when done; no idle process lives between commands.
  *
- * v0.34: runs are serialized through a FIFO queue — ONE loop at a time by
- * default (SM_CHAT_CONCURRENCY overrides, clamped to [1,3]). Extra submits
- * queue instead of erroring; modeled on the scheduler's serialized queue so a
- * burst of commands across tabs can't fan out into the parallel-`claude -p`
- * OOM that SIGKILLed a job on 2026-06-26.
+ * v0.34: silent (automated) runs are serialized through a FIFO queue capped at
+ * CONCURRENCY_CAP (SM_CHAT_CONCURRENCY overrides, clamped to [1,3]); modeled
+ * on the scheduler's serialized queue so a burst of probes can't fan out into
+ * the parallel-`claude -p` OOM that SIGKILLed a job on 2026-06-26.
+ * PRD 493: manual, user-initiated runs bypass that lane entirely — they always
+ * execute immediately, uncapped, so a foreground send never queues behind
+ * another tab.
  *
  * Public surface:
- *   run({ tabId, sessionId, prompt, cwd, resume }): void  — fire-and-forget enqueue
+ *   run({ tabId, sessionId, prompt, cwd, resume, silent }): void  — fire-and-forget enqueue.
+ *     `silent` (PRD 470) runs still go through the CONCURRENCY_CAP FIFO lane and suppress the
+ *     six turn-affecting broadcasts + recordExchange (see probeContextUsage below). Non-silent
+ *     (manual) runs (PRD 493) execute immediately, uncapped, never entering the FIFO lane.
  *   cancel(tabId): void
  *   parseStopSignal(finalText): { questions: string[] } | null     — exported for reuse
+ *   parseContextUsageMarkdown(text): { usedTokens, totalTokens, usedPct, categories } | null
+ *                                                                    — pure parser for `/context`
+ *   probeContextUsage({ tabId, sessionId, cwd }): void  — fire-and-forget silent `/context` probe
  *   STOP_SENTINEL: string                                           — exported for tests
  *   __setExecutor(fn): void                                         — test seam
  *
@@ -27,6 +35,8 @@
  *   chat:run:needs-input { tabId, sessionId, questions, raw }
  *   chat:run:error      { tabId, sessionId, message }
  *   chat:run:notice     { tabId, sessionId, message }        — informational, not terminal
+ *   chat:context-usage  { tabId, sessionId, usedTokens, totalTokens, usedPct, categories }
+ *                                                             — result of a silent `/context` probe
  */
 
 const { spawn } = require('node:child_process');
@@ -72,6 +82,119 @@ function parseStopSignal(finalText) {
   }
 }
 
+// ─── `/context` probe (PRD 470) ────────────────────────────────────────────
+// `claude -p "/context"` is answered entirely locally by the CLI (zero-cost,
+// no real API call) with markdown containing a summary line and a per-category
+// breakdown table. Parsed here so the app can mirror the CLI's own context-
+// window accounting without re-implementing the estimate itself.
+
+// "9k" -> 9000, "15.1k" -> 15100; bare "207" -> 207. Never throws — returns NaN
+// for genuinely malformed input, which callers treat as a parse failure.
+function parseTokenAmount(str) {
+  const suffixed = /^(\d+(?:\.\d+)?)k$/i.exec(str);
+  if (suffixed) return Math.round(parseFloat(suffixed[1]) * 1000);
+  return Number(str);
+}
+
+/**
+ * Parse the markdown produced by the CLI's own `/context` slash command into
+ * a structured summary. Pure, single line-by-line pass — O(n) over the lines
+ * of a small, bounded response, no nested scans.
+ *
+ * @param {string} text
+ * @returns {{ usedTokens: number, totalTokens: number, usedPct: number, categories: Array<{ category: string, tokens: number, pct: number }> } | null}
+ */
+function parseContextUsageMarkdown(text) {
+  if (typeof text !== 'string' || !text) return null;
+  const lines = text.split('\n');
+
+  let usedTokens = null;
+  let totalTokens = null;
+  let usedPct = null;
+  const tokensLineRe = /\*\*Tokens:\*\*\s*(\S+)\s*\/\s*(\S+)\s*\(([\d.]+)%\)/;
+
+  let inTable = false;
+  let foundHeading = false;
+  const categories = [];
+
+  for (const line of lines) {
+    if (usedTokens === null) {
+      const m = tokensLineRe.exec(line);
+      if (m) {
+        usedTokens = parseTokenAmount(m[1]);
+        totalTokens = parseTokenAmount(m[2]);
+        usedPct = Number(m[3]);
+      }
+    }
+
+    if (!inTable) {
+      if (line.trim() === '### Estimated usage by category') {
+        foundHeading = true;
+        inTable = true;
+      }
+      continue;
+    }
+    const trimmed = line.trim();
+    if (trimmed.startsWith('###')) { inTable = false; continue; }
+    if (!trimmed.startsWith('|')) continue;
+
+    const cells = trimmed.split('|').map((c) => c.trim()).filter((c) => c.length > 0);
+    if (cells.length !== 3) continue;
+    if (cells[0].toLowerCase() === 'category') continue; // header row
+    if (/^:?-+:?$/.test(cells[0])) continue; // separator row
+
+    const tokens = parseTokenAmount(cells[1]);
+    const pctMatch = /^([\d.]+)%$/.exec(cells[2]);
+    if (!pctMatch || Number.isNaN(tokens)) continue;
+    categories.push({ category: cells[0], tokens, pct: Number(pctMatch[1]) });
+  }
+
+  if (
+    usedTokens === null || totalTokens === null || usedPct === null ||
+    Number.isNaN(usedTokens) || Number.isNaN(totalTokens) || Number.isNaN(usedPct) ||
+    !foundHeading || categories.length === 0
+  ) {
+    return null;
+  }
+
+  return { usedTokens, totalTokens, usedPct, categories };
+}
+
+/**
+ * Fire-and-forget silent probe of the resumed session's context usage. Reuses
+ * the normal `run()` queue/lane (resume: true, silent: true) so it can never
+ * race a real chat run against the same `--resume sessionId`. Broadcasts
+ * `chat:context-usage` on success; logs (never throws/broadcasts) on a parse
+ * failure.
+ *
+ * @param {{ tabId: string, sessionId: string, cwd: string }} params
+ */
+function probeContextUsage({ tabId, sessionId, cwd }) {
+  run({
+    tabId,
+    sessionId,
+    prompt: '/context',
+    cwd,
+    resume: true,
+    silent: true,
+    onSilentResult: (text) => {
+      const parsed = parseContextUsageMarkdown(text);
+      if (!parsed) {
+        console.error('[chatRunner] parseContextUsageMarkdown failed to parse /context probe output');
+        return;
+      }
+      broadcast('chat:context-usage', {
+        tabId,
+        sessionId,
+        usedTokens: parsed.usedTokens,
+        totalTokens: parsed.totalTokens,
+        usedPct: parsed.usedPct,
+        categories: parsed.categories,
+      });
+    },
+  });
+}
+
 // ─── MCP consent-denial detection ──────────────────────────────────────────
 // Best-effort substring heuristic over known CLI phrasing — NOT a documented
 // stream-json schema field. Confirmed by extracting strings from the compiled
@@ -108,12 +231,13 @@ const STOP_SIGNAL_INSTRUCTION =
   `Otherwise complete the task and end with a concise summary of what you did.\n\n`;
 
 // ─── Serial run queue (v0.34) ───────────────────────────────────────────────
-// CONCURRENCY_CAP=1 (default) → one loop at a time. The cap is the machine-wide
-// "≤3 concurrent claude -p" ceiling from CLAUDE.md; default 1 is the v0.34
-// guarantee. The waiting list FIFO-queues anything that can't start yet.
+// CONCURRENCY_CAP=2 (default) governs SILENT (automated probe) runs only —
+// two probes can run at once before a 3rd queues. SM_CHAT_CONCURRENCY still
+// overrides, clamped to [1, 3]. PRD 493: manual runs never touch this cap or
+// the `waiting` FIFO — see run() below.
 
-const DEFAULT_CAP = 1;
-// Clamp to [1, 3]; default 1 = "one loop at a time".
+const DEFAULT_CAP = 2;
+// Clamp to [1, 3]; default 2 = "two loops at a time".
 const CONCURRENCY_CAP = Math.min(
   3,
   Math.max(1, parseInt(process.env.SM_CHAT_CONCURRENCY || String(DEFAULT_CAP), 10) || DEFAULT_CAP),
@@ -121,7 +245,7 @@ const CONCURRENCY_CAP = Math.min(
 
 // tabId → cancel() for every ACTIVE run; FIFO list of WAITING runs; live count.
 const inFlight = new Map();
-const waiting = []; // [{ tabId, sessionId, prompt, cwd, resume }]
+const waiting = []; // [{ tabId, sessionId, prompt, cwd, resume, silent, onSilentResult }]
 let activeCount = 0;
 
 // Indirection so tests can stub the spawn without launching claude.
@@ -148,17 +272,35 @@ function broadcast(channel, payload) {
 // ─── Public queue entry ─────────────────────────────────────────────────────
 
 /**
- * Enqueue a chat run for a tab. Fire-and-forget — results arrive via IPC. With
- * CONCURRENCY_CAP=1 (default) runs execute one at a time; extra submits FIFO-
- * queue and are announced via chat:run:queued. De-dupes a tab already in the
- * pipeline (the UI disables input while running, but guard anyway).
+ * Enqueue a chat run for a tab. Fire-and-forget — results arrive via IPC.
+ * Silent (automated probe) runs go through the CONCURRENCY_CAP=2 (default)
+ * FIFO lane — extra submits queue and are announced via chat:run:queued.
+ * Manual (user-initiated) runs (PRD 493) execute immediately and never enter
+ * that lane. De-dupes a tab already in the pipeline (the UI disables input
+ * while running, but guard anyway).
  *
- * @param {{ tabId: string, sessionId: string, prompt: string, cwd: string, resume: boolean }} opts
+ * @param {{ tabId: string, sessionId: string, prompt: string, cwd: string, resume: boolean, silent?: boolean, onSilentResult?: (text: string) => void }} opts
  */
 function run(opts) {
+  // Per-tab exclusivity guard — unrelated to the cross-tab cap; must hold for
+  // BOTH manual and silent runs so a manual send can't race a /context probe
+  // for the same tab against the same --resume sessionId.
   if (inFlight.has(opts.tabId) || waiting.some((w) => w.tabId === opts.tabId)) return;
-  waiting.push(opts);
-  pump();
+
+  if (opts.silent === true) {
+    // Automated probe: keep the CONCURRENCY_CAP FIFO lane machinery (protects
+    // against the 2026-06-10 parallel-claude-p OOM).
+    waiting.push(opts);
+    pump();
+    return;
+  }
+
+  // PRD 493: manual/user-initiated sends are intentionally UNCAPPED — never
+  // queue behind another tab. This means the ≤3-concurrent-claude-p ceiling in
+  // CLAUDE.md no longer strictly holds for foreground sessions (accepted
+  // tradeoff). executeRun still registers in inFlight synchronously, so the
+  // per-tab guard above and cancel() keep working; no activeCount, no pump.
+  executor(opts).catch(() => { /* executeRun never rejects; defensive */ });
 }
 
 // Fill open lanes FIFO up to CONCURRENCY_CAP, then announce queue positions for
@@ -186,10 +328,10 @@ function pump() {
  * for the run's lifetime so cancel() can reach it. Never rejects — the queue
  * pump relies on the returned promise always settling so the lane frees.
  *
- * @param {{ tabId: string, sessionId: string, prompt: string, cwd: string, resume: boolean }} opts
+ * @param {{ tabId: string, sessionId: string, prompt: string, cwd: string, resume: boolean, silent?: boolean, onSilentResult?: (text: string) => void }} opts
  * @returns {Promise<void>}
  */
-function executeRun({ tabId, sessionId, prompt, cwd, resume }) {
+function executeRun({ tabId, sessionId, prompt, cwd, resume, silent, onSilentResult }) {
   return new Promise((resolve) => {
     let settled = false;
     // Frees the lane exactly once: drops the cancel fn and resolves the promise
@@ -212,6 +354,9 @@ function executeRun({ tabId, sessionId, prompt, cwd, resume }) {
     const emitTerminal = (channel, payload) => {
       if (terminalSent) return;
       terminalSent = true;
+      // Silent (probe) runs still need this bookkeeping so the lane frees
+      // correctly, but must never surface on the six turn-affecting channels.
+      if (silent) return;
       broadcast(channel, payload);
     };
 
@@ -254,7 +399,7 @@ function executeRun({ tabId, sessionId, prompt, cwd, resume }) {
       args.push('--session-id', sessionId);
     }
 
-    broadcast('chat:run:started', { tabId, sessionId });
+    if (!silent) broadcast('chat:run:started', { tabId, sessionId });
 
     // Spawn with stdin closed (mirrors scheduler's 'ignore' — prevents the
     // "claude -p stdin must be closed" gotcha from kg.cjs). stdout is piped for
@@ -324,10 +469,10 @@ function executeRun({ tabId, sessionId, prompt, cwd, resume }) {
         for (const block of content) {
           if (block.type === 'text' && typeof block.text === 'string') {
             finalAssistantText += block.text;
-            broadcast('chat:run:output', { tabId, delta: block.text });
+            if (!silent) broadcast('chat:run:output', { tabId, delta: block.text });
           } else if (block.type === 'tool_use' && typeof block.name === 'string') {
             const classified = classifyToolUse(block);
-            broadcast('chat:run:tool-use', { tabId, id: block.id, ...classified });
+            if (!silent) broadcast('chat:run:tool-use', { tabId, id: block.id, ...classified });
           }
         }
       } else if (event.type === 'user') {
@@ -351,20 +496,27 @@ function executeRun({ tabId, sessionId, prompt, cwd, resume }) {
         const text = typeof event.result === 'string' ? event.result : finalAssistantText;
 
         if (event.subtype === 'success') {
-          const signal = parseStopSignal(text);
-          if (signal) {
-            emitTerminal('chat:run:needs-input', {
-              tabId,
-              sessionId,
-              questions: signal.questions,
-              raw: text,
-            });
-          } else {
+          if (silent) {
+            // Silent probe: no turn broadcast, no recordExchange — just hand
+            // the final text to whoever enqueued the probe (e.g. probeContextUsage).
             emitTerminal('chat:run:complete', { tabId, sessionId, finalMessage: text });
-            // Record durable exchange off the hot path — UI must not wait on Haiku
-            recordExchange({ sessionId, cwd, prompt, result: text }).catch((err) => {
-              console.error('[chatRunner] recordExchange failed:', err?.message ?? err);
-            });
+            if (typeof onSilentResult === 'function') onSilentResult(text);
+          } else {
+            const signal = parseStopSignal(text);
+            if (signal) {
+              emitTerminal('chat:run:needs-input', {
+                tabId,
+                sessionId,
+                questions: signal.questions,
+                raw: text,
+              });
+            } else {
+              emitTerminal('chat:run:complete', { tabId, sessionId, finalMessage: text });
+              // Record durable exchange off the hot path — UI must not wait on Haiku
+              recordExchange({ sessionId, cwd, prompt, result: text }).catch((err) => {
+                console.error('[chatRunner] recordExchange failed:', err?.message ?? err);
+              });
+            }
           }
         } else {
           emitTerminal('chat:run:error', {
@@ -470,6 +622,11 @@ function registerChatHandlers() {
     try { tabId = schemas.chatCancel.parse(payload).tabId; } catch { return; }
     cancel(tabId);
   });
+
+  ipcMain.handle('chat:probe-context', validated(schemas.chatProbeContext, async ({ tabId, sessionId, cwd }) => {
+    probeContextUsage({ tabId, sessionId, cwd });
+    return { ok: true };
+  }));
 }
 
 module.exports = {
@@ -478,6 +635,8 @@ module.exports = {
   attachWindow,
   registerChatHandlers,
   parseStopSignal,
+  parseContextUsageMarkdown,
+  probeContextUsage,
   STOP_SENTINEL,
   __setExecutor,
 };

package/src/main/config.cjs

@@ -127,6 +127,13 @@ function validateWrite(realAbs) {
       if (realAbs === e2eSub || realAbs.startsWith(e2eSub + path.sep)) {
         return;
       }
+      // Browser tab scratch saves (DOM captures, screenshots, recorded
+      // flows): narrowly scoped to session-manager-operations/browser/,
+      // this repo's existing per-project artifact-store convention.
+      const browserSub = path.join(realRoot, 'session-manager-operations', 'browser');
+      if (realAbs === browserSub || realAbs.startsWith(browserSub + path.sep)) {
+        return;
+      }
     }
   }
   throw new Error(`Write outside allowed write boundaries: ${realAbs}`);

package/src/main/historyAggregator.cjs

@@ -9,7 +9,12 @@ const { schemas } = require('./ipcSchemas.cjs');
 const PROJECTS_DIR = path.join(os.homedir(), '.claude', 'projects');
 const PARSE_BUDGET_MS = 2_000;
 const MAX_FILE_BYTES = 20 * 1024 * 1024;
-const CACHE_MAX = 500;
+// Cache entries are small scalar aggregates (token counts, per-model buckets, a
+// tool-name histogram) — NOT raw transcript content — so a much larger cap costs
+// little memory. 50k is safely above the observed real-workspace file count
+// (~26,604 .jsonl files on the dev machine), so repeat scans over the same date
+// range hit cache instead of self-evicting mid-scan and spuriously truncating.
+const CACHE_MAX = 50_000;
 
 // Dollars per million tokens (input / output / cache-read). Cache-read
 // tokens are priced far below input because they're served from
@@ -484,4 +489,6 @@ module.exports = {
   scanAggrLines,
   parseJSONL,
   resolvePricingKey,
+  CACHE_MAX,
+  LRUCache,
 };

package/src/main/index.cjs

@@ -455,6 +455,20 @@ ipcMain.handle('clipboard:paste-image', async () => {
   }
 });
 
+// Text paste — same rationale as clipboard:paste-image above: the renderer's
+// navigator.clipboard.readText() requires the 'clipboard-read' permission,
+// which setPermissionRequestHandler denies (MEDIA_PERMS only), so it always
+// rejects. Reading via Electron's main-process clipboard.readText() sidesteps
+// that permission gate entirely — no permission-handler changes needed.
+ipcMain.handle('clipboard:paste-text', async () => {
+  try {
+    const text = clipboard.readText();
+    return { ok: true, text: text || '' };
+  } catch (e) {
+    return { ok: false, error: e && e.message ? e.message : String(e) };
+  }
+});
+
 // PRD 407 Capture panel — write side of paste-image's read. Writes a
 // screenshot capture to the OS clipboard as an image.
 ipcMain.handle('browser:copy-image', validated(schemas.browserCopyImage, ({ dataUrl }) => {

package/src/main/ipcSchemas.cjs

@@ -382,6 +382,12 @@ const chatCancel = z.object({
   tabId: z.string().min(1).max(128),
 });
 
+const chatProbeContext = z.object({
+  tabId: z.string().min(1).max(128),
+  sessionId: z.string().min(1).max(128),
+  cwd: z.string().min(1).max(4096),
+});
+
 // ──────────────────────────────────────────── Web Remote
 // OTP is 8 uppercase alphanumeric chars (case-insensitive entry, normalised to upper in handler).
 const WEB_REMOTE_OTP_RE = /^[A-Z0-9]{8}$/i;
@@ -665,6 +671,7 @@ module.exports = {
     watchersKillTab,
     chatRun,
     chatCancel,
+    chatProbeContext,
     exchangesList,
   },
   validated,

package/src/main/scheduler.cjs

@@ -1164,6 +1164,73 @@ function healTargetForFix(fixSlug, jobs) {
   return jobs.find((x) => x.slug === originalSlug && isPromotableOriginal(x.status)) || null;
 }
 
+/**
+ * Build the Opus investigation prompt. Pure/hermetic so its content can be
+ * unit-tested (no spawn, no fs). Inputs are the already-resolved values that
+ * spawnInvestigation computes.
+ */
+function buildInvestigationPrompt({ failedJob, cwd, failedLogPath, originalBody, logTail, fixPath, group }) {
+  return `You are investigating a failed scheduled job in the session-manager queue. Your ONLY job is to write a fix-plan PRD file. Do NOT attempt the fix yourself.
+
+# Failed job
+- Slug: ${failedJob.slug}
+- Title: ${failedJob.title}
+- cwd: ${cwd}
+- Exit code: ${failedJob.exitCode}
+- Full failure log: ${failedLogPath}
+
+# Original PRD body (this is what the job was trying to do)
+\`\`\`
+${originalBody}
+\`\`\`
+
+# Last ~16KB of the failure log (stream-json format from \`claude -p\`)
+\`\`\`
+${logTail}
+\`\`\`
+
+# Your task
+1. Read the full failure log at ${failedLogPath} if the tail above isn't sufficient.
+2. Read source files in ${cwd} as needed to understand the context.
+3. Identify the root cause of the failure.
+4. Write a NEW fix-plan PRD file at exactly this path:
+
+   ${fixPath}
+
+5. The frontmatter MUST be exactly this format (no extra keys):
+   \`\`\`
+   ---
+   title: Fix: <short summary of the fix>
+   cwd: ${cwd}
+   parallelGroup: ${group}
+   estimateMinutes: <your time estimate>
+   ---
+   \`\`\`
+6. The PRD body MUST be self-contained — \`claude -p\` runs it on a fresh Sonnet session with NO conversation context. Include:
+   - Root-cause analysis (what went wrong and why)
+   - Concrete fix steps (specific files / commands / edits)
+   - Verification command(s) the next agent should run to confirm the fix
+   - Acceptance criteria
+   - Before writing the fix-plan PRD body, read
+     \`plugins/session-manager-dev/skills/develop/standards.md\` (resolve it relative to the failed
+     job's repo root — for session-manager-authored PRDs that is this cwd). Inline its
+     \`## Execution discipline (headless runs)\` section VERBATIM into the new fix-plan PRD under an
+     \`## Engineering standards\` heading, exactly as the \`/develop\` skill's Phase 1 does for normal
+     PRDs. Reuse that convention — do not invent a second, paraphrased set of warnings. The headless
+     Sonnet executor that runs your fix-plan sees no skills and no conversation, so inlining these
+     rules verbatim is the only way they reach it.
+   - Known failure class — "delegated instead of executed": if the failure log tail above shows the
+     failed run invoked the \`Skill\` tool with a \`session-manager-dev:develop\` or
+     \`session-manager-dev:process-feedback\` argument, and/or called \`ScheduleWakeup\`, and then exited
+     0 without producing the diff/tests its PRD demanded, recognize this as a self-delegation failure.
+     In that case LEAD the fix-plan PRD by quoting VERBATIM the canonical rule from standards.md's
+     Execution discipline section — "You ARE the executor — never re-queue or self-schedule" — rather
+     than authoring new prose. Instruct the fix-plan's executor plainly that a queued PRD is the task,
+     not evidence of completion, and that the deliverable is the code diff.
+
+DO NOT attempt the fix. ONLY write the file. When the file exists, exit immediately.`;
+}
+
 /**
  * Spawn an Opus investigation session for a failed job. The investigator's job
  * is to read the failure log + original PRD, identify the root cause, and write
@@ -1236,49 +1303,7 @@ async function spawnInvestigation(failedJob, runDir) {
     console.warn(`[scheduler] investigation cwd missing (${cwd}); falling back to ${DEFAULT_PROJECT_CWD}`);
     cwd = DEFAULT_PROJECT_CWD;
   }
-  const prompt = `You are investigating a failed scheduled job in the session-manager queue. Your ONLY job is to write a fix-plan PRD file. Do NOT attempt the fix yourself.
-
-# Failed job
-- Slug: ${failedJob.slug}
-- Title: ${failedJob.title}
-- cwd: ${cwd}
-- Exit code: ${failedJob.exitCode}
-- Full failure log: ${failedLogPath}
-
-# Original PRD body (this is what the job was trying to do)
-\`\`\`
-${originalBody}
-\`\`\`
-
-# Last ~16KB of the failure log (stream-json format from \`claude -p\`)
-\`\`\`
-${logTail}
-\`\`\`
-
-# Your task
-1. Read the full failure log at ${failedLogPath} if the tail above isn't sufficient.
-2. Read source files in ${cwd} as needed to understand the context.
-3. Identify the root cause of the failure.
-4. Write a NEW fix-plan PRD file at exactly this path:
-
-   ${fixPath}
-
-5. The frontmatter MUST be exactly this format (no extra keys):
-   \`\`\`
-   ---
-   title: Fix: <short summary of the fix>
-   cwd: ${cwd}
-   parallelGroup: ${group}
-   estimateMinutes: <your time estimate>
-   ---
-   \`\`\`
-6. The PRD body MUST be self-contained — \`claude -p\` runs it on a fresh Sonnet session with NO conversation context. Include:
-   - Root-cause analysis (what went wrong and why)
-   - Concrete fix steps (specific files / commands / edits)
-   - Verification command(s) the next agent should run to confirm the fix
-   - Acceptance criteria
-
-DO NOT attempt the fix. ONLY write the file. When the file exists, exit immediately.`;
+  const prompt = buildInvestigationPrompt({ failedJob, cwd, failedLogPath, originalBody, logTail, fixPath, group });
 
   // Phase 1: open log fd for pre-spawn diagnostics.
   const { fd, safeLog, closeFd } = openLog(investigationLogPath);
@@ -2633,4 +2658,4 @@ const remote = {
   },
 };
 
-module.exports = { registerScheduleHandlers, attachWindow, init, ROOT, PRDS_DIR, selectHistoryJobs, parsePorcelain, FINISH_PROTOCOL, remote, pickNextBatch, pickForProject, reapDeadRunningJobs, pollRecoveryClearSource, memoryLimitedBatchSize, availableForJobs, reverifyNeedsReview, isRescanCandidate, isPromotableOriginal, selectAutoFixTargets, resolveRunId, isUnresolvableNeedsReview, healTargetForFix };
+module.exports = { registerScheduleHandlers, attachWindow, init, ROOT, PRDS_DIR, selectHistoryJobs, parsePorcelain, FINISH_PROTOCOL, remote, pickNextBatch, pickForProject, reapDeadRunningJobs, pollRecoveryClearSource, memoryLimitedBatchSize, availableForJobs, reverifyNeedsReview, isRescanCandidate, isPromotableOriginal, selectAutoFixTargets, resolveRunId, isUnresolvableNeedsReview, healTargetForFix, buildInvestigationPrompt };

package/src/preload/api.d.ts

@@ -1079,6 +1079,8 @@ export interface SessionManagerAPI {
       | { ok: true; mode: string; text: string; meta: { chunks?: number; tokens?: number } }
       | { ok: false; error: string }
     >;
+    /** Fired when the embedded page tries to open a new window (target="_blank", window.open, ctrl/cmd-click) — the main process denies the native popup and forwards the URL here. */
+    onOpenTabRequest: (handler: (payload: { url: string }) => void) => () => void;
   };
   transcripts: {
     subscribe: (payload: { tabId: string; cwd: string; sessionUuid: string }) => Promise<SubscribeResult>;
@@ -1250,6 +1252,13 @@ export interface SessionManagerAPI {
       | { ok: true; path: string; bytes: number }
       | { ok: false; empty?: true; error?: string }
     >;
+    /** Ctrl+V text paste — reads OS clipboard text via Electron's native API
+     *  (renderer's navigator.clipboard.readText() is denied by the
+     *  permission-request handler, which only allows media permissions). */
+    pasteText: () => Promise<
+      | { ok: true; text: string }
+      | { ok: false; error?: string }
+    >;
     /** Write side — copies a Capture-panel screenshot data URL to the OS clipboard. */
     copyImage: (dataUrl: string) => Promise<{ ok: boolean; error?: string }>;
   };

package/src/preload/index.cjs

@@ -107,6 +107,11 @@ contextBridge.exposeInMainWorld('api', {
       return () => ipcRenderer.removeListener(channel, listener);
     },
     capture: (payload) => ipcRenderer.invoke('browser:capture', payload),
+    onOpenTabRequest: (handler) => {
+      const listener = (_e, payload) => handler(payload);
+      ipcRenderer.on('browser:open-tab-request', listener);
+      return () => ipcRenderer.removeListener('browser:open-tab-request', listener);
+    },
   },
   transcripts: {
     subscribe: (payload) => ipcRenderer.invoke('transcript:subscribe', payload),
@@ -282,6 +287,7 @@ contextBridge.exposeInMainWorld('api', {
   },
   clipboard: {
     pasteImage: () => ipcRenderer.invoke('clipboard:paste-image'),
+    pasteText: () => ipcRenderer.invoke('clipboard:paste-text'),
     copyImage: (dataUrl) => ipcRenderer.invoke('browser:copy-image', { dataUrl }),
   },
   memory: {