claude-code-session-manager 0.40.3 → 0.41.1

package/src/main/__tests__/scheduler-notify-originating-tab-transcript.test.cjs

@@ -0,0 +1,86 @@
+/**
+ * scheduler-notify-originating-tab-transcript.test.cjs — unit tests for the
+ * PRD 863 addition to notifyOriginatingTab: persisting the job's real
+ * result text (read from the run's log) to the durable per-Epic transcript
+ * store, independent of the existing short-status-chip notification.
+ *
+ * Run: timeout 300 npx vitest run src/main/__tests__/scheduler-notify-originating-tab-transcript.test.cjs
+ */
+
+'use strict';
+
+import { test, expect, vi } from 'vitest';
+const { notifyOriginatingTab, extractResultTextFromLog } = require('../scheduler.cjs');
+
+test('extractResultTextFromLog returns null for a missing log path', () => {
+  expect(extractResultTextFromLog(null)).toBeNull();
+  expect(extractResultTextFromLog('/does/not/exist.log')).toBeNull();
+});
+
+test('appends the job result text to the transcript store when sourcePromptId is known', async () => {
+  const appendTranscriptTurn = vi.fn(async () => true);
+  const readResultFromLog = vi.fn(() => 'the real agent result text');
+  const appendResponseEvent = vi.fn(async () => true);
+  const parsePrdRaw = vi.fn(async () => ({ sourcePromptId: 'psess-abc' }));
+
+  await notifyOriginatingTab(
+    { slug: '863-transcript', status: 'completed', cwd: '/some/cwd', runId: 'run-1' },
+    { parsePrdRaw, appendResponseEvent, appendTranscriptTurn, readResultFromLog },
+  );
+
+  expect(appendTranscriptTurn).toHaveBeenCalledTimes(1);
+  expect(appendTranscriptTurn).toHaveBeenCalledWith('/some/cwd', 'psess-abc', {
+    role: 'assistant',
+    text: 'the real agent result text',
+  });
+});
+
+test('falls back to the short status message when the run log has no result text', async () => {
+  const appendTranscriptTurn = vi.fn(async () => true);
+  const readResultFromLog = vi.fn(() => null);
+  const appendResponseEvent = vi.fn(async () => true);
+  const parsePrdRaw = vi.fn(async () => ({ sourcePromptId: 'psess-abc' }));
+
+  await notifyOriginatingTab(
+    { slug: '863-fallback', status: 'completed', cwd: '/some/cwd', runId: 'run-1' },
+    { parsePrdRaw, appendResponseEvent, appendTranscriptTurn, readResultFromLog },
+  );
+
+  expect(appendTranscriptTurn).toHaveBeenCalledWith(
+    '/some/cwd',
+    'psess-abc',
+    expect.objectContaining({ text: expect.stringContaining('863-fallback') }),
+  );
+});
+
+test('a throwing transcript append never breaks the existing notification path', async () => {
+  const appendTranscriptTurn = vi.fn(async () => {
+    throw new Error('disk full');
+  });
+  const readResultFromLog = vi.fn(() => 'result text');
+  const appendResponseEvent = vi.fn(async () => true);
+  const parsePrdRaw = vi.fn(async () => ({ sourcePromptId: 'psess-abc' }));
+
+  await expect(
+    notifyOriginatingTab(
+      { slug: '863-safe', status: 'completed', cwd: '/some/cwd', runId: 'run-1' },
+      { parsePrdRaw, appendResponseEvent, appendTranscriptTurn, readResultFromLog },
+    ),
+  ).resolves.toBeUndefined();
+
+  expect(appendResponseEvent).toHaveBeenCalledTimes(1);
+});
+
+test('no cwd on the job skips the transcript append but does not throw', async () => {
+  const appendTranscriptTurn = vi.fn(async () => true);
+  const readResultFromLog = vi.fn(() => 'result text');
+  const appendResponseEvent = vi.fn(async () => true);
+  const parsePrdRaw = vi.fn(async () => ({ sourcePromptId: 'psess-abc' }));
+
+  await notifyOriginatingTab(
+    { slug: '863-nocwd', status: 'completed', cwd: null, runId: 'run-1' },
+    { parsePrdRaw, appendResponseEvent, appendTranscriptTurn, readResultFromLog },
+  );
+
+  expect(appendTranscriptTurn).not.toHaveBeenCalled();
+});

package/src/main/__tests__/scheduler-notify-originating-tab.test.cjs

@@ -150,6 +150,27 @@ test('falls back to the tab-external-ticket path when the PRD has no sourcePromp
   expect(sendPrompt).toHaveBeenCalledWith('tab-x', expect.stringContaining('814-notify'));
 });
 
+// PRD 854: a PRD dispatched straight from an Epic's own composer
+// (dispatchPromptSessionToPrd) never sets sourceTabId — only sourcePromptId.
+// If the Epic has since gone completed (appendResponseEvent returns false),
+// the fallback must still target sourcePromptId itself as the chat:external-
+// send id, since the renderer now resolves that id against known Epics too.
+test('falls back to sourcePromptId as the external-send target when sourceTabId is absent', async () => {
+  const sendPrompt = vi.fn();
+  const appendResponseEvent = vi.fn(async () => false);
+  const parsePrdRaw = vi.fn(async () => ({ sourcePromptId: 'epic-1', sourceTabId: null }));
+  const loadSessions = vi.fn(async () => ({ tabs: [] }));
+
+  await notifyOriginatingTab(
+    { slug: '854-notify', status: 'completed', cwd: '/some/cwd' },
+    { parsePrdRaw, loadSessions, sendPrompt, appendResponseEvent },
+  );
+
+  expect(appendResponseEvent).toHaveBeenCalled();
+  expect(loadSessions).not.toHaveBeenCalled();
+  expect(sendPrompt).toHaveBeenCalledWith('epic-1', expect.stringContaining('854-notify'));
+});
+
 test('falls back to the tab-external-ticket path when appendResponseEvent itself throws', async () => {
   const sendPrompt = vi.fn();
   const appendResponseEvent = vi.fn(async () => { throw new Error('disk error'); });

package/src/main/__tests__/scheduler-writeprd-epic-rollback.test.cjs

@@ -0,0 +1,78 @@
+/**
+ * scheduler-writeprd-epic-rollback.test.cjs — PRD 851: when remote.writePrd
+ * mints a brand-new Epic via ensureEpic (epicMint.cjs) but the PRD file write
+ * itself then fails, cleanupEmptyMintedEpic must roll back BOTH the on-disk
+ * empty epic dir AND the Epic's active-index.json entry (sessions/events) —
+ * otherwise an orphaned seed-prompt-only Epic lingers forever in the Epics
+ * nav with no PRDs and no cleanup path.
+ *
+ * The rollback must only fire for a call that minted a FRESH Epic
+ * (ensureEpic's `created: true`); a PRD write that joins an existing Epic
+ * and then fails must leave that Epic's history untouched.
+ *
+ * Run: timeout 120 npx vitest run src/main/__tests__/scheduler-writeprd-epic-rollback.test.cjs
+ */
+
+'use strict';
+
+import { test, expect, afterEach } from 'vitest';
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { remote } = require('../scheduler.cjs');
+const { ensureEpic, readActiveIndex } = require('../lib/epicMint.cjs');
+
+const tmpDirs = [];
+
+function makeFixtureCwd() {
+  const cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-writeprd-epic-rollback-'));
+  tmpDirs.push(cwd);
+  return cwd;
+}
+
+afterEach(() => {
+  while (tmpDirs.length) {
+    const dir = tmpDirs.pop();
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+// A slug that escapes safeSlugPathIn's containment check, tripping the
+// "invalid slug" branch of writePrd (scheduler.cjs ~4188-4191) after
+// ensureEpic has already minted+persisted the Epic.
+const ESCAPING_SLUG = '../escape-attempt';
+
+test('writePrd: invalid-slug failure after a fresh Epic mint leaves zero residual active-index.json entries', async () => {
+  const cwd = makeFixtureCwd();
+  const body = '---\ntitle: Freshly minted epic goal\n---\n\nbody text\n';
+
+  const result = await remote.writePrd(ESCAPING_SLUG, body, cwd);
+
+  expect(result.ok).toBe(false);
+  expect(result.error).toBe('invalid slug');
+
+  const index = readActiveIndex(cwd);
+  expect(Object.keys(index.sessions)).toHaveLength(0);
+  expect(Object.keys(index.events)).toHaveLength(0);
+});
+
+test('writePrd: invalid-slug failure when joining a pre-existing Epic leaves that Epic untouched', async () => {
+  const cwd = makeFixtureCwd();
+
+  const preexisting = await ensureEpic(cwd, { goalText: 'pre-existing epic goal' });
+  expect(preexisting.created).toBe(true);
+
+  const beforeIndex = readActiveIndex(cwd);
+  expect(Object.keys(beforeIndex.sessions)).toEqual([preexisting.epicId]);
+
+  const body = `---\ntitle: Joins the existing epic\nsourcePromptId: ${preexisting.epicId}\n---\n\nbody text\n`;
+  const result = await remote.writePrd(ESCAPING_SLUG, body, cwd);
+
+  expect(result.ok).toBe(false);
+  expect(result.error).toBe('invalid slug');
+
+  const afterIndex = readActiveIndex(cwd);
+  expect(Object.keys(afterIndex.sessions)).toEqual([preexisting.epicId]);
+  expect(afterIndex.sessions[preexisting.epicId]).toEqual(beforeIndex.sessions[preexisting.epicId]);
+  expect(afterIndex.events[preexisting.epicId]).toEqual(beforeIndex.events[preexisting.epicId]);
+});

package/src/main/browserView.cjs

@@ -836,7 +836,7 @@ function registerBrowserView({ mainWindow, ipcMain }) {
   ipcMain.handle('browser:stop-find', validated(schemas.browserViewId, (payload) => stopFind(payload)));
   ipcMain.handle('browser:save-binary', validated(schemas.browserSaveBinary, (payload) => {
     const { writeBinaryAtomic } = require('./config.cjs');
-    return writeBinaryAtomic(payload.path, Buffer.from(payload.base64, 'base64'))
+    return writeBinaryAtomic(payload.path, Buffer.from(payload.base64, 'base64'), { writer: payload.writer })
       .then(() => ({ ok: true }))
       .catch((e) => ({ ok: false, error: e && e.message ? e.message : String(e) }));
   }));

package/src/main/chatRunner.cjs

@@ -18,13 +18,11 @@
  * Public surface:
  *   run({ tabId, sessionId, prompt, cwd, resume, silent }): void  — fire-and-forget enqueue.
  *     Both silent (PRD 470) and manual runs go through the same CONCURRENCY_CAP FIFO lane.
- *     Silent runs additionally suppress the six turn-affecting broadcasts + recordExchange
- *     (see probeContextUsage below).
+ *     Silent runs additionally suppress the six turn-affecting broadcasts + recordExchange.
  *   cancel(tabId): Promise<void>  — resolves once the cancelled run fully settles
  *   parseStopSignal(finalText): { questions: string[] } | null     — exported for reuse
  *   parseContextUsageMarkdown(text): { usedTokens, totalTokens, usedPct, categories } | null
  *                                                                    — pure parser for `/context`
- *   probeContextUsage({ tabId, sessionId, cwd }): void  — fire-and-forget silent `/context` probe
  *   STOP_SENTINEL: string                                           — exported for tests
  *   __setExecutor(fn): void                                         — test seam
  *
@@ -42,8 +40,6 @@
  *                           landed before verifying/retrying
  *   chat:run:notice     { tabId, sessionId, message }        — informational, not terminal
  *                         (also fires at 80% of the kill ceiling as a wrap-up nudge)
- *   chat:context-usage  { tabId, sessionId, usedTokens, totalTokens, usedPct, categories }
- *                                                             — result of a silent `/context` probe
  */
 
 const { spawn } = require('node:child_process');
@@ -55,6 +51,7 @@ const { classifyToolUse } = require('./lib/toolUseClassify.cjs');
 const { extractJson } = require('./lib/extractJson.cjs');
 const { classifyPromptTicket } = require('./lib/classifyPromptTicket.cjs');
 const sessionSlots = require('./lib/sessionSlots.cjs');
+const opsErrorLog = require('./lib/opsErrorLog.cjs');
 
 // ─── Stop-signal protocol ──────────────────────────────────────────────────
 // Single source of truth for the sentinel and parser. The renderer (PRD 320)
@@ -184,41 +181,6 @@ function parseContextUsageMarkdown(text) {
   return { usedTokens, totalTokens, usedPct, categories };
 }
 
-/**
- * Fire-and-forget silent probe of the resumed session's context usage. Reuses
- * the normal `run()` queue/lane (resume: true, silent: true) so it can never
- * race a real chat run against the same `--resume sessionId`. Broadcasts
- * `chat:context-usage` on success; logs (never throws/broadcasts) on a parse
- * failure.
- *
- * @param {{ tabId: string, sessionId: string, cwd: string }} params
- */
-function probeContextUsage({ tabId, sessionId, cwd }) {
-  run({
-    tabId,
-    sessionId,
-    prompt: '/context',
-    cwd,
-    resume: true,
-    silent: true,
-    onSilentResult: (text) => {
-      const parsed = parseContextUsageMarkdown(text);
-      if (!parsed) {
-        console.error('[chatRunner] parseContextUsageMarkdown failed to parse /context probe output');
-        return;
-      }
-      broadcast('chat:context-usage', {
-        tabId,
-        sessionId,
-        usedTokens: parsed.usedTokens,
-        totalTokens: parsed.totalTokens,
-        usedPct: parsed.usedPct,
-        categories: parsed.categories,
-      });
-    },
-  });
-}
-
 // ─── MCP consent-denial detection ──────────────────────────────────────────
 // Best-effort substring heuristic over known CLI phrasing — NOT a documented
 // stream-json schema field. Confirmed by extracting strings from the compiled
@@ -509,6 +471,19 @@ function executeRun({ tabId, sessionId, prompt, cwd, resume, silent, onSilentRes
     const emitTerminal = (channel, payload) => {
       if (terminalSent) return;
       terminalSent = true;
+      // Every terminal error for this tab, logged once, regardless of the
+      // `silent` gate below — a probe run's failure is still real signal for
+      // tracing even though it never reaches the visible chat UI.
+      if (channel === 'chat:run:error') {
+        opsErrorLog.appendError({
+          cwd,
+          scope: 'chatRunner',
+          tabId,
+          tags: silent ? ['silent-probe'] : [],
+          message: payload?.message ?? 'chat run failed',
+          meta: { sessionId, silent },
+        });
+      }
       // Silent (probe) runs still need this bookkeeping so the lane frees
       // correctly, but must never surface on the six turn-affecting channels.
       if (silent) return;
@@ -534,7 +509,14 @@ function executeRun({ tabId, sessionId, prompt, cwd, resume, silent, onSilentRes
     };
 
     const claudeBin = resolveClaudeBin();
-    const childEnv = cleanChildEnv({ PATH: pathWithUserBins() });
+    // Carried down to any MCP server this run spawns (e.g.
+    // scripts/scheduler-mcp-server.cjs, inherited via the claude CLI's own
+    // child env) so scheduler_create_prd can auto-resolve sourcePromptId
+    // when the model forgets to pass it — see prdCreate.cjs's
+    // resolveSourcePromptIdFromClaudeSession. sessionId IS the Epic's
+    // claudeSessionId for an Epic-backed tab (domain model: Epic:claude-session
+    // 1:1); for a non-Epic tab, resolution below simply finds no match.
+    const childEnv = cleanChildEnv({ PATH: pathWithUserBins(), SM_CHAT_SESSION_ID: sessionId });
 
     // Prepend the stop-signal protocol instruction and the chat-mode truth
     // instruction to every prompt
@@ -686,7 +668,7 @@ function executeRun({ tabId, sessionId, prompt, cwd, resume, silent, onSilentRes
         if (event.subtype === 'success') {
           if (silent) {
             // Silent probe: no turn broadcast, no recordExchange — just hand
-            // the final text to whoever enqueued the probe (e.g. probeContextUsage).
+            // the final text to whoever enqueued the probe.
             emitTerminal('chat:run:complete', { tabId, sessionId, finalMessage: text });
             if (typeof onSilentResult === 'function') onSilentResult(text);
           } else {
@@ -888,10 +870,6 @@ function registerChatHandlers() {
     await cancel(tabId);
   });
 
-  ipcMain.handle('chat:probe-context', validated(schemas.chatProbeContext, async ({ tabId, sessionId, cwd }) => {
-    probeContextUsage({ tabId, sessionId, cwd });
-    return { ok: true };
-  }));
 }
 
 module.exports = {
@@ -903,7 +881,6 @@ module.exports = {
   parseStopSignal,
   splitStopSignal,
   parseContextUsageMarkdown,
-  probeContextUsage,
   STOP_SENTINEL,
   CHAT_MODE_TRUTH_INSTRUCTION,
   KILL_CEILING_MS,

package/src/main/config.cjs

@@ -19,6 +19,7 @@ const fs = require('node:fs');
 const fsp = require('node:fs/promises');
 const path = require('node:path');
 const os = require('node:os');
+const { assertOpsWrite } = require('./lib/opsOwnership.cjs');
 const chokidar = require('chokidar');
 const logs = require('./logs.cjs');
 const { sendIfAlive } = require('./lib/sendToRenderer.cjs');
@@ -219,6 +220,7 @@ async function readText(abs) {
 async function writeTextAtomic(abs, text, opts = {}) {
   const real = validatePath(expandHome(abs));
   validateWrite(real);
+  assertOpsWrite(real, opts.writer);
   const dir = path.dirname(real);
   await fsp.mkdir(dir, { recursive: true });
   const tmp = `${real}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
@@ -242,9 +244,10 @@ async function writeTextAtomic(abs, text, opts = {}) {
  * Binary-safe sibling of writeTextAtomic — same validate + tmp+rename flow,
  * for callers (screenshot capture) whose payload is a Buffer, not utf8 text.
  */
-async function writeBinaryAtomic(abs, buffer) {
+async function writeBinaryAtomic(abs, buffer, opts = {}) {
   const real = validatePath(expandHome(abs));
   validateWrite(real);
+  assertOpsWrite(real, opts.writer);
   const dir = path.dirname(real);
   await fsp.mkdir(dir, { recursive: true });
   const tmp = `${real}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
@@ -259,9 +262,9 @@ async function writeBinaryAtomic(abs, buffer) {
   return { ok: true, mtimeMs: stat.mtimeMs };
 }
 
-async function writeJson(abs, data) {
+async function writeJson(abs, data, opts = {}) {
   const pretty = JSON.stringify(data, null, 2) + '\n';
-  return writeTextAtomic(abs, pretty);
+  return writeTextAtomic(abs, pretty, opts);
 }
 
 /**
@@ -269,9 +272,10 @@ async function writeJson(abs, data) {
  * an event-loop yield would deadlock the caller. Use writeJson/writeTextAtomic
  * for everything else.
  */
-function writeJsonSync(abs, data) {
+function writeJsonSync(abs, data, opts = {}) {
   const real = validatePath(expandHome(abs));
   validateWrite(real);
+  assertOpsWrite(real, opts.writer);
   const dir = path.dirname(real);
   fs.mkdirSync(dir, { recursive: true });
   const tmp = `${real}.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
@@ -432,8 +436,10 @@ function registerConfigHandlers() {
   const { schemas: s, validated: v } = require('./ipcSchemas.cjs');
   ipcMain.handle('config:read-json', v(s.configPath, ({ path: p }) => readJson(p)));
   ipcMain.handle('config:read-text', v(s.configPath, ({ path: p }) => readText(p)));
-  ipcMain.handle('config:write-json', v(s.configWriteJson, ({ path: p, data }) => writeJson(p, data)));
-  ipcMain.handle('config:write-text', v(s.configWriteText, ({ path: p, text }) => writeTextAtomic(p, text)));
+  // `writer` is the renderer's declared owner id for the single-writer law
+  // (lib/opsOwnership.cjs). Ignored outside the ops root; required inside it.
+  ipcMain.handle('config:write-json', v(s.configWriteJson, ({ path: p, data, writer }) => writeJson(p, data, { writer })));
+  ipcMain.handle('config:write-text', v(s.configWriteText, ({ path: p, text, writer }) => writeTextAtomic(p, text, { writer })));
   ipcMain.handle('config:list-dir', v(s.configListDir, ({ path: p, opts }) => listDir(p, opts || {})));
   ipcMain.handle('config:exists', v(s.configPath, ({ path: p }) => exists(p)));
   ipcMain.handle('config:parse-imports', v(s.configParseImports, async ({ path: p }) => {

package/src/main/docEdit.cjs

@@ -169,13 +169,12 @@ const SESSION_EDIT_TIMEOUT_MS = 120_000;
 /**
  * Route a doc edit into an already-open, currently-idle chat session (PRD 680)
  * instead of an isolated one-shot `claude -p`. Reuses chatRunner.cjs's silent/
- * resumed run path verbatim (the same mechanism `probeContextUsage` uses) so
- * the edit lands as one more turn of the session's own transcript.
+ * resumed run path verbatim so the edit lands as one more turn of the
+ * session's own transcript.
  *
  * Fire-and-forget: the result reaches the renderer via a `docedit:session-result`
  * broadcast (tagged with `requestId`) once chatRunner's onSilentResult fires, or
- * once SESSION_EDIT_TIMEOUT_MS elapses without one (see above) — the same
- * indirection probeContextUsage uses for `chat:context-usage`, plus the bound.
+ * once SESSION_EDIT_TIMEOUT_MS elapses without one (see above).
  *
  * @param {{ tabId: string, sessionId: string, cwd: string, before: string, instruction: string, documentText?: string, requestId: string }} params
  */

package/src/main/index.cjs

@@ -29,6 +29,7 @@ const scheduler = require('./scheduler.cjs');
 const { createAdminHttp } = require('./lib/localAdminHttp.cjs');
 const prdCreate = require('./lib/prdCreate.cjs');
 const chatRunner = require('./chatRunner.cjs');
+const promptSessionEvents = require('./promptSessionEvents.cjs');
 const adminHttp = createAdminHttp();
 scheduler.registerAdminRoutes(adminHttp);
 prdCreate.registerAdminRoute(adminHttp, scheduler.remote);
@@ -55,6 +56,7 @@ const schedulerConfig = require('./lib/schedulerConfig.cjs');
 const memoryTool = require('./memoryTool.cjs');
 const { registerMemoryAggregateIpc } = require('./memoryAggregate.cjs');
 const { registerProjectBriefIpc } = require('./projectBrief.cjs');
+const promptSessionTranscript = require('./promptSessionTranscript.cjs');
 const agentMemory = require('./agentMemory.cjs');
 const git = require('./git.cjs');
 const filesIpc = require('./files.cjs');
@@ -307,6 +309,7 @@ async function rebootApp() {
     watchers.attachWindow(mainWindow);
     pluginInstall.attachWindow(mainWindow);
     chatRunner.attachWindow(mainWindow);
+    promptSessionEvents.attachWindow(mainWindow);
     attachDocEditWindow(mainWindow);
     rebooting = false;
     return;
@@ -772,6 +775,14 @@ pluginInstall.registerPluginInstallHandlers();
 memoryTool.registerMemoryHandlers();
 registerMemoryAggregateIpc();
 registerProjectBriefIpc();
+ipcMain.handle('promptSessionTranscript:append', validated(schemas.promptSessionTranscriptAppend, async ({ cwd, epicId, role, text, at, eventId }) => {
+  const ok = await promptSessionTranscript.appendTurn(cwd, epicId, { role, text, at, eventId });
+  return { ok };
+}));
+ipcMain.handle('promptSessionTranscript:read', validated(schemas.promptSessionTranscriptRead, async ({ cwd, epicId, limit }) => {
+  const turns = await promptSessionTranscript.readTurns(cwd, epicId, { limit });
+  return { turns };
+}));
 agentMemory.registerAgentMemoryHandlers();
 git.register(ipcMain);
 filesIpc.registerFilesHandlers();
@@ -1092,6 +1103,7 @@ app.whenReady().then(async () => {
   pluginInstall.attachWindow(mainWindow);
   webRemote.attachWindow(mainWindow);
   chatRunner.attachWindow(mainWindow);
+  promptSessionEvents.attachWindow(mainWindow);
   attachDocEditWindow(mainWindow);
   // Scheduler ownership (PRD 834): exactly one instance machine-wide runs
   // scheduler mutation (boot reconciliation, ticking, sweep, supervisor) and

package/src/main/ipcSchemas.cjs

@@ -118,6 +118,8 @@ const browserSaveRecording = z.object({
 const browserSaveBinary = z.object({
   path: z.string().min(1).max(4096),
   base64: z.string().min(1).max(50_000_000),
+  // Single-writer law (lib/opsOwnership.cjs) — required for ops-root paths.
+  writer: z.string().min(1).max(64).optional(),
 });
 
 // PRD 410: replay a recorded step list against a live view. The renderer
@@ -183,14 +185,20 @@ const transcriptUsageFor = z.object({
 // ──────────────────────────────────────────── Config
 const configPath = z.object({ path: z.string().min(1).max(4096) });
 
+// `writer` carries the renderer's declared owner id for the single-writer law
+// (lib/opsOwnership.cjs). Optional on the wire because most writes target
+// ~/.claude, not a project ops root; writes INSIDE the ops root are refused
+// when it is absent or wrong.
 const configWriteJson = z.object({
   path: z.string().min(1).max(4096),
   data: z.unknown(),
+  writer: z.string().min(1).max(64).optional(),
 });
 
 const configWriteText = z.object({
   path: z.string().min(1).max(4096),
   text: z.string(),
+  writer: z.string().min(1).max(64).optional(),
 });
 
 const configListDir = z.object({
@@ -284,15 +292,25 @@ const schedulerCreatePrd = z.object({
   // Explicit ordering (PRD 832): slugs that must complete before this PRD
   // becomes eligible. Written to frontmatter as `dependsOn: [a, b]`.
   dependsOn: z.array(z.string().min(1).max(160).regex(/^[A-Za-z0-9][\w.-]*$/)).max(20).optional(),
-  // Originating PromptTicket.id (PRD 748) when this PRD was authored from a
-  // ticket classified 'develop' (PRD 749) — traces the PRD back to the
-  // prompt that spawned it. Same newline-injection guard as title/cwd since
-  // it also becomes a frontmatter value.
+  // An EXISTING Epic's promptSessionId (PRD 748) — NOT a PromptTicket.id.
+  // ensureEpic() (epicMint.cjs) joins the Epic whose active-index.json
+  // sessions key literally equals this value; the renderer only ever sends
+  // PromptTicket.promptSessionId here (see state/chat.ts), never
+  // PromptTicket.id — those are distinct fields. Same newline-injection
+  // guard as title/cwd since it also becomes a frontmatter value.
   sourcePromptId: z.string().min(1).max(128).regex(NO_NEWLINE_RE, 'must not contain newlines').optional(),
   // Originating tab id (PRD 761) — used at job completion to route a status
   // prompt back into the chat tab that queued this PRD, via
   // enqueueExternalPrompt (PRD 753). Same newline-injection guard.
   sourceTabId: z.string().min(1).max(128).regex(NO_NEWLINE_RE, 'must not contain newlines').optional(),
+  // The calling MCP process's own claude session id (scheduler-mcp-server.cjs
+  // forwards its inherited SM_CHAT_SESSION_ID env var here when the model
+  // omitted sourcePromptId) — never written to frontmatter itself; prdCreate.cjs's
+  // createPrd() resolves it against active-index.json to fill sourcePromptId
+  // when it matches an existing Epic's claudeSessionId, so a PRD queued from
+  // within an Epic's own chat session joins that Epic even if the tool call
+  // forgot to pass sourcePromptId explicitly.
+  originClaudeSessionId: z.string().min(1).max(128).regex(NO_NEWLINE_RE, 'must not contain newlines').optional(),
   // User-selected Feature/Bug tag (PRD 774) carried from the originating
   // PromptTicket — deterministic, never LLM-classified.
   tag: z.enum(['feature', 'bug', 'discussion']).optional(),
@@ -425,6 +443,40 @@ const projectBriefSetPin = z.object({
   block: PROJECT_BRIEF_BLOCK,
   pinned: z.boolean(),
 }).strict();
+// Hand-edit patch. Only bounds the wire shape (sizes + which keys exist);
+// per-field shape is enforced by projectBriefCore.validateUpdateField so the
+// rule lives in one unit-tested place. At least one key is required.
+const PROJECT_BRIEF_TEXT = z.string().max(20_000);
+const projectBriefUpdate = z.object({
+  cwd: z.string().min(1).max(4096),
+  patch: z.object({
+    purpose: PROJECT_BRIEF_TEXT.optional(),
+    what: z.array(PROJECT_BRIEF_TEXT).max(50).optional(),
+    conventions: z.array(PROJECT_BRIEF_TEXT).max(100).optional(),
+    areas: z.array(z.record(z.unknown())).max(100).optional(),
+    scope: z.array(z.record(z.unknown())).max(200).optional(),
+  }).strict().refine((p) => Object.keys(p).length > 0, { message: 'patch is empty' }),
+}).strict();
+
+// ──────────────────────────────────────────── Prompt session transcript
+// (durable full-text turn store, PRD 863). cwd/epicId are only bounded for
+// wire shape here — real path safety is config.cjs's validatePath/
+// validateWrite inside promptSessionTranscript.cjs.
+const PROMPT_SESSION_EPIC_ID_RE = /^[A-Za-z0-9._-]{1,128}$/;
+const PROMPT_SESSION_TRANSCRIPT_ROLE = z.enum(['user', 'assistant']);
+const promptSessionTranscriptAppend = z.object({
+  cwd: z.string().min(1).max(4096),
+  epicId: z.string().regex(PROMPT_SESSION_EPIC_ID_RE),
+  role: PROMPT_SESSION_TRANSCRIPT_ROLE,
+  text: z.string().max(2_000_000),
+  at: z.string().max(64).optional(),
+  eventId: z.string().max(128).optional(),
+}).strict();
+const promptSessionTranscriptRead = z.object({
+  cwd: z.string().min(1).max(4096),
+  epicId: z.string().regex(PROMPT_SESSION_EPIC_ID_RE),
+  limit: z.number().int().positive().max(10_000).optional(),
+}).strict();
 
 // ──────────────────────────────────────────── Per-subagent memory
 // Distinct from the workspace-scoped Memory tool: agentMemory is keyed by
@@ -516,12 +568,6 @@ const chatCancel = z.object({
   tabId: z.string().min(1).max(128),
 });
 
-const chatProbeContext = z.object({
-  tabId: z.string().min(1).max(128),
-  sessionId: z.string().min(1).max(128),
-  cwd: z.string().min(1).max(4096),
-});
-
 const chatClassifyTicket = z.object({
   text: z.string().min(1).refine(
     (s) => Buffer.byteLength(s, 'utf8') <= CHAT_PROMPT_MAX_BYTES,
@@ -817,6 +863,9 @@ module.exports = {
     memoryStale,
     projectBriefCwd,
     projectBriefSetPin,
+    projectBriefUpdate,
+    promptSessionTranscriptAppend,
+    promptSessionTranscriptRead,
     agentMemoryList,
     agentMemoryGet,
     agentMemorySet,
@@ -830,7 +879,6 @@ module.exports = {
     docEditRunInSession,
     chatRun,
     chatCancel,
-    chatProbeContext,
     chatClassifyTicket,
     chatExternalSend,
     exchangesList,