claude-code-session-manager 0.43.0 → 0.44.0

package/dist/index.html

@@ -7,7 +7,7 @@
     <link rel="preconnect" href="https://fonts.googleapis.com">
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
     <link href="https://fonts.googleapis.com/css2?family=Newsreader:ital,opsz,wght@0,6..72,400;0,6..72,500;0,6..72,600;0,6..72,700;1,6..72,400&family=Geist:wght@300;400;500;600;700&family=IBM+Plex+Mono:wght@400;500;600&display=swap" rel="stylesheet">
-    <script type="module" crossorigin src="./assets/index-6w1gIeyB.js"></script>
+    <script type="module" crossorigin src="./assets/index-BGEZVIeo.js"></script>
     <link rel="modulepreload" crossorigin href="./assets/monaco-editor-BW5C4Iv1.js">
     <link rel="stylesheet" crossorigin href="./assets/monaco-editor-BTnBOi8r.css">
     <link rel="stylesheet" crossorigin href="./assets/index-CxGY-V5G.css">

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-code-session-manager",
-  "version": "0.43.0",
+  "version": "0.44.0",
   "description": "Local cockpit for the Claude Code CLI — multi-tab terminal, full config surface, scheduler, voice dictation, and live observability.",
   "type": "module",
   "main": "src/main/index.cjs",

package/plugins/session-manager-dev/skills/develop/SKILL.md

@@ -19,9 +19,23 @@ description: >-
 
 **Role:** `/develop` owns the *pipeline*: it turns a development request into one or more
 self-contained PRDs, queues them, and tracks them to completion. It is the convergence point
-for both entry paths — an interactive human prompt comes straight here; an agent feedback file
-arrives as an approved Epic proposal (`/propose-epic`), which the user approves and then calls this skill. Everything from
-here on is identical regardless of who asked.
+for both entry paths — an interactive human prompt inside an Epic's own conversation comes
+straight here; an agent feedback file arrives as an approved Epic proposal (`/propose-epic`),
+which the user approves and then calls this skill. Everything from here on is identical
+regardless of who asked.
+
+**Epic-gated — non-negotiable.** `/develop` may only run inside an already-existing,
+already-human-approved Epic's own conversation (Chat or Terminal — the two views over one Epic
+session, per the domain model). It never creates an Epic itself and never writes a PRD against
+one it had to guess at. Before doing anything else:
+1. Resolve `<epic-id>`: this conversation's own claudeSessionId must already match an Epic's
+   `claudeSessionId` in `<cwd>/session-manager-operations/prompt-sessions/active-index.json` —
+   that Epic's `id` is `<epic-id>` for every PRD authored in this pass.
+2. If it doesn't match any Epic — this was invoked as a bare standalone command outside any
+   Epic context — **stop and say so**. Tell the human to create the Epic first (the New Epic
+   card in the app, or `/propose-epic` + **Approve & start**), then re-run `/develop` from
+   inside that Epic. Do not mint one yourself, do not fall back to writing an epicless PRD, and
+   do not proceed with authoring.
 
 **Never** hand-implement the work inline in chat, and never restate rules that live elsewhere:
 the engineering rules belong to `standards.md`. Reference it; don't fork it.
@@ -184,7 +198,11 @@ can't load skills.
    **Prefer creating each PRD via the `scheduler_create_prd` MCP tool**
    (`mcp__session-manager-scheduler__scheduler_create_prd`) over hand-writing the file. Its input
    (`title`, `cwd`, `estimateMinutes`, `goal`, `acceptanceCriteria[]`, `implementationNotes`,
-   `outOfScope[]`) maps directly onto the sections below — pass them straight through. It
+   `outOfScope[]`) maps directly onto the sections below — pass them straight through. **Always
+   pass `sourcePromptId` explicitly, set to the `<epic-id>` resolved in the Epic-gated step
+   above** — never omit it and rely on the server-side session-id fallback; that fallback exists
+   only to cover a model that forgot, not as this skill's normal path, and the server refuses to
+   write the PRD at all if no existing Epic resolves. It
    allocates a strictly-unique `NN` atomically (no read-then-write race against another
    concurrent `/develop` invocation, never reused across the project — PRD
    832), derives and collision-checks the slug, and embeds the standards pointer for you.
@@ -220,17 +238,21 @@ can't load skills.
    token-window resets, with auto-pause on rate-limit and auto-resume.
 
    **Canonical location — non-negotiable.** Every PRD belongs to an **Epic** (the TAB → EPIC →
-   PRD domain model in the project CLAUDE.md). PRDs MUST be written to, inside the target repo:
+   PRD domain model in the project CLAUDE.md) — specifically the `<epic-id>` resolved in the
+   Epic-gated step above. PRDs MUST be written to, inside the target repo:
    ```
    <cwd>/session-manager-operations/scheduler/epics/<epic-id>/prds/<NN>-<kebab-slug>.md
    ```
-   Get `<epic-id>`'s prds/ directory by minting (or joining) an Epic first:
+   Always pass that `<epic-id>` as `sourcePromptId` when creating each PRD — via the MCP
+   `scheduler_create_prd` tool's `sourcePromptId` input, or, for the manual-write fallback, by
+   resolving the directory with:
    ```bash
-   node <session-manager-repo>/scripts/mint-epic.cjs <cwd> "<one-line goal for this work>" [feature|bug|discussion]
+   node <session-manager-repo>/scripts/mint-epic.cjs <cwd> <epic-id>
    ```
-   The last stdout line is the exact directory to write into. Reuse-by-goal makes it idempotent —
-   all PRDs of one /develop ask share one Epic. (The MCP `scheduler_create_prd` tool does all of
-   this automatically; the mint step is only for the manual-write fallback.)
+   This only JOINS an existing Epic and prints its prds/ directory on the last stdout line — it
+   never creates one. If `<epic-id>` doesn't exist yet, that means the Epic-gated step above
+   wasn't satisfied; go back and get a human to create/approve the Epic first, don't work around
+   this by minting one.
 
    **Anywhere else doesn't get scheduled or gets retired.** `data/prds/`, `docs/prds/`, and the
    old global `prds/` dir under `~/.claude/session-manager/scheduled-plans/` are invisible to

package/scripts/lib/watchdogHelpers.cjs

@@ -324,6 +324,7 @@ async function emitFeedbackPRD(cwd, {
       tag: 'discussion',
       status: 'proposed',
       reuseByGoal: true,
+      source: { producer: 'feedback-sweep' },
     });
     epicId = epic.epicId;
     prdsDir = epic.prdDir;

package/scripts/mint-epic.cjs

@@ -1,28 +1,41 @@
 #!/usr/bin/env node
 /**
- * mint-epic.cjs — CLI wrapper over lib/epicMint.cjs for PRD authors working
- * without the app's admin API (the /develop skill's manual-write fallback).
+ * mint-epic.cjs — CLI wrapper over lib/epicMint.cjs's JOIN path, for PRD
+ * authors working without the app's admin API (the /develop skill's
+ * manual-write fallback).
+ *
+ * This script never creates an Epic. It only resolves an EXISTING Epic's
+ * prds/ write directory. An Epic may only come into existence through
+ * explicit human intent — the New Epic UI, or /propose-epic followed by a
+ * human pressing Approve & start — never implicitly from a PRD-authoring
+ * path. /develop must already be running inside that Epic's own
+ * conversation (or have the approved Epic's id in hand) before it calls this.
  *
  * Usage:
- *   node scripts/mint-epic.cjs <cwd> "<goal text>" [feature|bug|discussion]
+ *   node scripts/mint-epic.cjs <cwd> <epic-id>
  *
- * Prints the Epic's prds/ write directory on stdout (last line), minting the
- * Epic (and registering it in prompt-sessions/active-index.json) if no active
- * Epic with the same goal text exists — reuse-by-goal, so re-running for the
- * same goal is idempotent and returns the same directory.
+ * Prints the Epic's prds/ write directory on stdout (last line). Exits 1
+ * with no stdout output if <epic-id> does not exist in
+ * <cwd>/session-manager-operations/prompt-sessions/active-index.json.
  */
 'use strict';
 
 const { ensureEpic } = require('../src/main/lib/epicMint.cjs');
 
-const [cwd, goalText, tag] = process.argv.slice(2);
-if (!cwd || !goalText) {
-  process.stderr.write('usage: mint-epic.cjs <cwd> "<goal text>" [feature|bug|discussion]\n');
+const [cwd, epicId] = process.argv.slice(2);
+if (!cwd || !epicId) {
+  process.stderr.write('usage: mint-epic.cjs <cwd> <epic-id>\n');
+  process.stderr.write('(epic-id must already exist — this script only joins, never creates)\n');
   process.exit(1);
 }
 
 (async () => {
-  const { epicId, prdDir, created } = await ensureEpic(cwd, { goalText, tag, reuseByGoal: true });
-  process.stderr.write(`${created ? 'minted' : 'joined'} epic ${epicId}\n`);
-  process.stdout.write(`${prdDir}\n`);
+  try {
+    const { prdDir } = await ensureEpic(cwd, { epicId, mintIfMissing: false });
+    process.stderr.write(`joined epic ${epicId}\n`);
+    process.stdout.write(`${prdDir}\n`);
+  } catch (e) {
+    process.stderr.write(`${e?.message ?? 'no such Epic'}\n`);
+    process.exit(1);
+  }
 })();

package/scripts/propose-epic.cjs

@@ -49,6 +49,7 @@ function readStdin() {
     status: 'proposed',
     reuseByGoal: true,
     openingPrompt: body || title,
+    source: { producer: 'propose-epic' },
   });
   process.stderr.write(`${created ? 'proposed' : 'joined existing proposal'} epic ${epicId}\n`);
   process.stdout.write(`${epicId}\n`);

package/src/main/__tests__/chat-dead-channels.test.cjs

@@ -0,0 +1,63 @@
+/**
+ * chat-dead-channels.test.cjs — regression guard for the removed
+ * chat:probe-context / chat:context-usage channels (PRD 897).
+ *
+ * These IPC channels were deliberately deleted (handler, broadcast, preload
+ * and zod schema all removed) rather than left half-wired. This test walks
+ * the source tree and fails if either literal string reappears anywhere
+ * under src/main, src/preload, or src/renderer — such a reintroduction must
+ * be wired end-to-end (handler + preload + zod schema + broadcast) or not
+ * added at all.
+ *
+ * Run: timeout 120 npx vitest run src/main/__tests__/chat-dead-channels.test.cjs
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+import { test, expect } from 'vitest';
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..', '..');
+const SCAN_DIRS = ['src/main', 'src/preload', 'src/renderer'];
+const FORBIDDEN_STRINGS = ['chat:probe-context', 'chat:context-usage'];
+const SELF_PATH = path.resolve(__filename);
+
+function walk(dir, files) {
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (entry.name === 'node_modules') continue;
+    if (entry.isSymbolicLink()) continue;
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      walk(full, files);
+    } else {
+      files.push(full);
+    }
+  }
+}
+
+test('chat:probe-context / chat:context-usage channels stay removed', () => {
+  const files = [];
+  for (const dir of SCAN_DIRS) {
+    walk(path.join(REPO_ROOT, dir), files);
+  }
+
+  const hits = [];
+  for (const file of files) {
+    if (path.resolve(file) === SELF_PATH) continue;
+    const contents = fs.readFileSync(file, 'utf8');
+    for (const needle of FORBIDDEN_STRINGS) {
+      if (contents.includes(needle)) {
+        hits.push(`${path.relative(REPO_ROOT, file)}: contains "${needle}"`);
+      }
+    }
+  }
+
+  expect(
+    hits,
+    'chat:probe-context / chat:context-usage were deliberately removed as a dead/half-wired ' +
+      'channel (PRD 897). If reintroducing this feature, wire it end-to-end (handler, preload, ' +
+      'zod schema, broadcast) in the same change — do not add just one side.\n' + hits.join('\n'),
+  ).toEqual([]);
+});

package/src/main/__tests__/epicMint.test.cjs

@@ -14,7 +14,7 @@ const fs = require('node:fs');
 const fsp = require('node:fs/promises');
 const os = require('node:os');
 const path = require('node:path');
-const { ensureEpic, removeEpic, readActiveIndex } = require('../lib/epicMint.cjs');
+const { ensureEpic, removeEpic, readActiveIndex, findJoinableEpic } = require('../lib/epicMint.cjs');
 
 const tmpDirs = [];
 afterEach(async () => {
@@ -83,3 +83,134 @@ test('removeEpic is a no-op (returns false) for an unknown epicId', async () =>
   expect(removed).toBe(false);
   expect(Object.keys(readActiveIndex(cwd).sessions)).toHaveLength(1);
 });
+
+// A plain object's bracket lookup with a prototype-chain key like
+// "__proto__"/"constructor" returns a truthy Object.prototype member even
+// when no such Epic was ever written — without an own-property check, this
+// would make mintIfMissing:false's "join an existing Epic" gate falsely
+// report a match, defeating the restriction that a PRD write may only join
+// a real, already-approved Epic.
+for (const pollutedKey of ['__proto__', 'constructor', 'toString', 'hasOwnProperty']) {
+  test(`ensureEpic refuses to "join" the prototype-chain key "${pollutedKey}" (mintIfMissing:false)`, async () => {
+    const cwd = await mkCwd();
+
+    await expect(
+      ensureEpic(cwd, { epicId: pollutedKey, mintIfMissing: false }),
+    ).rejects.toThrow(/no existing Epic found/);
+
+    const index = readActiveIndex(cwd);
+    expect(Object.keys(index.sessions)).toHaveLength(0);
+  });
+}
+
+test('removeEpic refuses to report success for the prototype-chain key "__proto__"', async () => {
+  const cwd = await mkCwd();
+  const removed = removeEpic(cwd, '__proto__');
+  expect(removed).toBe(false);
+});
+
+test('ensureEpic persists the passed source onto the written active-index.json session record', async () => {
+  const cwd = await mkCwd();
+  const source = { producer: 'rca-hook', prdSlug: 'x', runId: 'y' };
+
+  const minted = await ensureEpic(cwd, { goalText: 'auto-filed epic', source });
+
+  const index = readActiveIndex(cwd);
+  expect(index.sessions[minted.epicId].source).toEqual(source);
+});
+
+test('ensureEpic omits source from the written record when not passed', async () => {
+  const cwd = await mkCwd();
+
+  const minted = await ensureEpic(cwd, { goalText: 'human-filed epic' });
+
+  const index = readActiveIndex(cwd);
+  expect('source' in index.sessions[minted.epicId]).toBe(false);
+});
+
+test('ensureEpic joins an existing open Epic when goalText is a near-identical paraphrase (no preferEpicId)', async () => {
+  const cwd = await mkCwd();
+
+  const first = await ensureEpic(cwd, { goalText: 'Fix the login button color' });
+  expect(first.created).toBe(true);
+
+  const second = await ensureEpic(cwd, { goalText: 'Fix login button colour issue' });
+
+  expect(second.created).toBe(false);
+  expect(second.epicId).toBe(first.epicId);
+
+  const index = readActiveIndex(cwd);
+  expect(Object.keys(index.sessions)).toHaveLength(1);
+});
+
+test('ensureEpic mints a distinct Epic when goalText is genuinely unrelated', async () => {
+  const cwd = await mkCwd();
+
+  const first = await ensureEpic(cwd, { goalText: 'Fix the login button color' });
+  expect(first.created).toBe(true);
+
+  const second = await ensureEpic(cwd, { goalText: 'Add CSV export to History tab' });
+
+  expect(second.created).toBe(true);
+  expect(second.epicId).not.toBe(first.epicId);
+
+  const index = readActiveIndex(cwd);
+  expect(Object.keys(index.sessions)).toHaveLength(2);
+});
+
+test('findJoinableEpic joins the preferEpicId Epic even when goalText similarity is near-zero', async () => {
+  const cwd = await mkCwd();
+
+  const first = await ensureEpic(cwd, { goalText: 'Fix the login button color' });
+  expect(first.created).toBe(true);
+
+  const joined = findJoinableEpic(cwd, {
+    goalText: 'Completely unrelated topic about database migrations',
+    preferEpicId: first.epicId,
+  });
+
+  expect(joined).toEqual({ epicId: first.epicId, matchedBy: 'preferEpicId' });
+});
+
+test('findJoinableEpic falls through to the similarity check when preferEpicId points at a completed Epic', async () => {
+  const cwd = await mkCwd();
+
+  const first = await ensureEpic(cwd, { goalText: 'Fix the login button color' });
+  const index = readActiveIndex(cwd);
+  index.sessions[first.epicId].status = 'completed';
+  fs.writeFileSync(
+    path.join(cwd, 'session-manager-operations', 'prompt-sessions', 'active-index.json'),
+    JSON.stringify(index, null, 2),
+  );
+
+  // No other open Epic shares tokens with the completed one, so the
+  // fall-through similarity check finds nothing rather than joining the
+  // dead (completed) preferEpicId Epic.
+  const joined = findJoinableEpic(cwd, { goalText: 'Fix login button colour issue', preferEpicId: first.epicId });
+
+  expect(joined).toBeNull();
+});
+
+test('findJoinableEpic falls through to the similarity check when preferEpicId points at a nonexistent Epic, and can still find a match there', async () => {
+  const cwd = await mkCwd();
+  const sibling = await ensureEpic(cwd, { goalText: 'Fix the login button color' });
+
+  const joined = findJoinableEpic(cwd, { goalText: 'Fix login button colour issue', preferEpicId: 'nonexistent-epic-id' });
+
+  expect(joined).toEqual({ epicId: sibling.epicId, matchedBy: 'similarity', score: expect.any(Number) });
+});
+
+test('ensureEpic with forceNewEpic:true mints even when a near-identical open Epic exists', async () => {
+  const cwd = await mkCwd();
+
+  const first = await ensureEpic(cwd, { goalText: 'Fix the login button color' });
+  expect(first.created).toBe(true);
+
+  const second = await ensureEpic(cwd, { goalText: 'Fix login button colour issue', forceNewEpic: true });
+
+  expect(second.created).toBe(true);
+  expect(second.epicId).not.toBe(first.epicId);
+
+  const index = readActiveIndex(cwd);
+  expect(Object.keys(index.sessions)).toHaveLength(2);
+});

package/src/main/__tests__/rcaFeedbackHook.test.cjs

@@ -147,6 +147,87 @@ test('fileRcaFeedback: files into the job\'s own project, no feedback dir requir
   expect(readSessions(cwd)[res.epicId].status).toBe('proposed');
 });
 
+// ─── epic targeting (job.epicId → preferred join target) ───────────────────
+
+function writeActiveIndex(cwd, sessions) {
+  const dir = path.join(cwd, 'session-manager-operations', 'prompt-sessions');
+  fs.mkdirSync(dir, { recursive: true });
+  const events = {};
+  for (const id of Object.keys(sessions)) {
+    events[id] = [{ id: `${id}-e0`, promptSessionId: id, kind: 'prompt', causedByEventId: null, at: new Date(0).toISOString(), text: sessions[id].goalText }];
+  }
+  fs.writeFileSync(path.join(dir, 'active-index.json'), JSON.stringify({ sessions, events }));
+}
+
+test('fileRcaFeedback: joins the job\'s known origin Epic when it is still open, and tags source', async () => {
+  const cwd = makeProjectWithInbox();
+  const runDir = path.join(tmpHome, 'run1');
+  writeRun(runDir, 'testslug');
+  writePrd(cwd, 'testslug');
+
+  writeActiveIndex(cwd, {
+    'origin-epic-1': { id: 'origin-epic-1', cwd, goalText: 'Unrelated title text', status: 'proposed', createdAt: new Date(0).toISOString(), completedAt: null },
+  });
+
+  const res = await rcaFeedbackHook.fileRcaFeedback({
+    job: baseJob({ cwd, epicId: 'origin-epic-1' }), runDir, verdict: 'transcript_errors',
+  });
+
+  expect(res.filed).toBe(true);
+  expect(res.epicId).toBe('origin-epic-1');
+  expect(res.created).toBe(false);
+  expect(Object.keys(readSessions(cwd)).length).toBe(1);
+});
+
+test('fileRcaFeedback: does not join a completed origin Epic, falls through to mint', async () => {
+  const cwd = makeProjectWithInbox();
+  const runDir = path.join(tmpHome, 'run1');
+  writeRun(runDir, 'testslug');
+  writePrd(cwd, 'testslug');
+
+  writeActiveIndex(cwd, {
+    'origin-epic-1': { id: 'origin-epic-1', cwd, goalText: 'Unrelated title text', status: 'completed', createdAt: new Date(0).toISOString(), completedAt: new Date(0).toISOString() },
+  });
+
+  const res = await rcaFeedbackHook.fileRcaFeedback({
+    job: baseJob({ cwd, epicId: 'origin-epic-1' }), runDir, verdict: 'transcript_errors',
+  });
+
+  expect(res.filed).toBe(true);
+  expect(res.epicId).not.toBe('origin-epic-1');
+  expect(res.created).toBe(true);
+  const sessions = readSessions(cwd);
+  expect(sessions[res.epicId].source).toEqual({ producer: 'rca-hook', prdSlug: 'testslug', runId: baseJob().runId });
+});
+
+test('fileRcaFeedback: a nonexistent job.epicId falls through to mint without erroring', async () => {
+  const cwd = makeProjectWithInbox();
+  const runDir = path.join(tmpHome, 'run1');
+  writeRun(runDir, 'testslug');
+  writePrd(cwd, 'testslug');
+
+  const res = await rcaFeedbackHook.fileRcaFeedback({
+    job: baseJob({ cwd, epicId: 'does-not-exist' }), runDir, verdict: 'transcript_errors',
+  });
+
+  expect(res.filed).toBe(true);
+  expect(res.epicId).not.toBe('does-not-exist');
+  expect(res.created).toBe(true);
+});
+
+test('fileRcaFeedback: no job.epicId preserves current mint-or-reuseByGoal behavior', async () => {
+  const cwd = makeProjectWithInbox();
+  const runDir = path.join(tmpHome, 'run1');
+  writeRun(runDir, 'testslug');
+  writePrd(cwd, 'testslug');
+
+  const res = await rcaFeedbackHook.fileRcaFeedback({ job: baseJob({ cwd }), runDir, verdict: 'transcript_errors' });
+  expect(res.filed).toBe(true);
+  expect(res.created).toBe(true);
+  const sessions = readSessions(cwd);
+  expect(sessions[res.epicId].source).toEqual({ producer: 'rca-hook', prdSlug: 'testslug', runId: baseJob().runId });
+});
+
 test('fileRcaFeedback: rejects a slug containing path-traversal segments', async () => {
   const cwd = makeProjectWithInbox();
   const runDir = path.join(tmpHome, 'run1');

package/src/main/__tests__/scheduler-writeprd-epic-rollback.test.cjs

@@ -1,14 +1,13 @@
 /**
- * scheduler-writeprd-epic-rollback.test.cjs — PRD 851: when remote.writePrd
- * mints a brand-new Epic via ensureEpic (epicMint.cjs) but the PRD file write
- * itself then fails, cleanupEmptyMintedEpic must roll back BOTH the on-disk
- * empty epic dir AND the Epic's active-index.json entry (sessions/events) —
- * otherwise an orphaned seed-prompt-only Epic lingers forever in the Epics
- * nav with no PRDs and no cleanup path.
+ * scheduler-writeprd-epic-rollback.test.cjs — remote.writePrd may only JOIN
+ * an existing, already-human-approved Epic (via `sourcePromptId`); it must
+ * never mint a new one (mintIfMissing:false, see epicMint.cjs's ensureEpic).
+ * A write with no resolvable Epic fails outright with zero residual
+ * active-index.json entries — no orphaned Epic can ever be left behind by
+ * this path because none is ever created by it.
  *
- * The rollback must only fire for a call that minted a FRESH Epic
- * (ensureEpic's `created: true`); a PRD write that joins an existing Epic
- * and then fails must leave that Epic's history untouched.
+ * A PRD write that joins a pre-existing Epic and then fails (e.g. an invalid
+ * slug) must leave that Epic's history untouched.
  *
  * Run: timeout 120 npx vitest run src/main/__tests__/scheduler-writeprd-epic-rollback.test.cjs
  */
@@ -21,6 +20,7 @@ const os = require('node:os');
 const path = require('node:path');
 const { remote } = require('../scheduler.cjs');
 const { ensureEpic, readActiveIndex } = require('../lib/epicMint.cjs');
+const config = require('../config.cjs');
 
 const tmpDirs = [];
 
@@ -38,18 +38,20 @@ afterEach(() => {
 });
 
 // A slug that escapes safeSlugPathIn's containment check, tripping the
-// "invalid slug" branch of writePrd (scheduler.cjs ~4188-4191) after
-// ensureEpic has already minted+persisted the Epic.
+// "invalid slug" branch of writePrd (scheduler.cjs's writePrd). Only the
+// second test below (joining a pre-existing Epic) actually reaches this
+// check — the first test fails earlier, at Epic resolution, before the slug
+// is ever considered.
 const ESCAPING_SLUG = '../escape-attempt';
 
-test('writePrd: invalid-slug failure after a fresh Epic mint leaves zero residual active-index.json entries', async () => {
+test('writePrd: no sourcePromptId refuses to write (no Epic to join) and mints nothing', async () => {
   const cwd = makeFixtureCwd();
-  const body = '---\ntitle: Freshly minted epic goal\n---\n\nbody text\n';
+  const body = '---\ntitle: No epic given\n---\n\nbody text\n';
 
   const result = await remote.writePrd(ESCAPING_SLUG, body, cwd);
 
   expect(result.ok).toBe(false);
-  expect(result.error).toBe('invalid slug');
+  expect(result.error).toMatch(/no existing Epic to join/);
 
   const index = readActiveIndex(cwd);
   expect(Object.keys(index.sessions)).toHaveLength(0);
@@ -76,3 +78,28 @@ test('writePrd: invalid-slug failure when joining a pre-existing Epic leaves tha
   expect(afterIndex.sessions[preexisting.epicId]).toEqual(beforeIndex.sessions[preexisting.epicId]);
   expect(afterIndex.events[preexisting.epicId]).toEqual(beforeIndex.events[preexisting.epicId]);
 });
+
+// Provenance (PRD 905): writePrd's ensureEpic call passes
+// source: { producer: 'scheduler-dispatch', prdSlug }, but this call is
+// join-only (mintIfMissing:false, explicit epicId) — ensureEpic's
+// explicitEpicId branch returns before ever reading `source`, so a
+// successful join must NOT write/alter the joined Epic's `source` field.
+test('writePrd: successful join does not write a source field onto the pre-existing Epic (join-only no-op)', async () => {
+  // Must live under the home dir — config.cjs's writeTextAtomic validates
+  // paths against allowedRoots=home dir, unlike the failure-path tests above
+  // (which never reach the write) os.tmpdir() is not sufficient here.
+  const cwd = fs.mkdtempSync(path.join(os.homedir(), '.sm-writeprd-epic-source-'));
+  tmpDirs.push(cwd);
+  config.addAllowedRoot(cwd);
+
+  const preexisting = await ensureEpic(cwd, { goalText: 'pre-existing epic goal for join' });
+  expect(preexisting.created).toBe(true);
+
+  const body = `---\ntitle: Joins the existing epic\nsourcePromptId: ${preexisting.epicId}\n---\n\nbody text\n`;
+  const result = await remote.writePrd('valid-slug', body, cwd);
+
+  expect(result.ok).toBe(true);
+
+  const index = readActiveIndex(cwd);
+  expect('source' in index.sessions[preexisting.epicId]).toBe(false);
+});

package/src/main/ipcSchemas.cjs

@@ -377,6 +377,14 @@ const setConfigSchema = z.object({
   }).optional(),
 }).strict();
 
+// Machine-wide claude -p slot pool cap (sessionSlots.cjs) — deliberately its own
+// schema/channel rather than folded into setConfigSchema: it governs the shared
+// process pool, not any one project's scheduler config, and its range (0-10, 0
+// pauses new launches) differs from concurrencyCap's (1-20).
+const setSessionSlotsSchema = z.object({
+  cap: z.number().int().min(0).max(10),
+}).strict();
+
 // ──────────────────────────────────────────── Memory tool (Bundle C, cycle 3)
 // Workspace-scoped markdown store at ~/.claude/projects/<ws>/memory/.
 // Slug regex is shared with memoryTool.cjs/memoryAggregate.cjs via lib/memorySlug.cjs;
@@ -754,9 +762,6 @@ const READ_COMMANDS = new Set([
 // Sensitive reads — return user data; require SAS confirmation same as MUTATE.
 const SAS_GATED_READS = new Set([
   'cmd:sessions:load',
-  'cmd:schedule:state',
-  'cmd:schedule:read-prd',
-  'cmd:schedule:read-log',
   'cmd:history:aggregate',
   // subscribe initiates a live stream of session state/summary — sensitive.
   'cmd:session:subscribe',
@@ -764,6 +769,12 @@ const SAS_GATED_READS = new Set([
   // no dispatch handler for it, so an allowlist entry would only fail closed with
   // an opaque reject. Re-add here together with the handler when remote exchanges
   // are wired, so the allowlist always mirrors an actual capability.
+  //
+  // Scheduler/Epics commands (cmd:schedule:*) were removed here deliberately
+  // (core scheduler/Epics redesign) — Remote no longer reaches into scheduler
+  // internals at all; a future Remote rebuild will talk to Scheduler/Epics
+  // through whatever higher-level surface that redesign lands on, not this
+  // per-command allowlist.
 ]);
 
 const MUTATE_COMMANDS = new Set([
@@ -776,10 +787,6 @@ const MUTATE_COMMANDS = new Set([
   // mobile mirror has no business killing or resizing the desktop's session.
   'cmd:pty:kill',
   'cmd:pty:resize',
-  'cmd:schedule:write-prd',
-  'cmd:schedule:reset-job',
-  'cmd:schedule:run-now',
-  'cmd:schedule:set-config',
   // Pushes a prompt into an open tab's chat queue — a real mutation of that
   // tab's session, same tier as pty:write.
   'cmd:chat:send',
@@ -839,6 +846,7 @@ module.exports = {
     scheduleArchivePrd,
     scheduleRetagPrd,
     setConfigSchema,
+    setSessionSlotsSchema,
     shellOpen,
     archiveProject,
     historyAggregate,