claude-code-session-manager 0.51.0 → 0.53.0

package/src/main/ipcSchemas.cjs

@@ -313,7 +313,7 @@ const schedulerCreatePrd = z.object({
   originClaudeSessionId: z.string().min(1).max(128).regex(NO_NEWLINE_RE, 'must not contain newlines').optional(),
   // User-selected Feature/Bug tag (PRD 774) carried from the originating
   // PromptTicket — deterministic, never LLM-classified.
-  tag: z.enum(['feature', 'bug', 'discussion', 'build']).optional(),
+  tag: z.enum(['feature', 'bug', 'discussion', 'build', 'project-home-builder']).optional(),
 });
 
 // Bulk archive: slug list, capped to limit unbounded retag/archive payloads.
@@ -446,6 +446,13 @@ const PROJECT_BRIEF_BLOCK = z.enum(['what', 'conventions']);
 const projectBriefCwd = z.object({
   cwd: z.string().min(1).max(4096),
 }).strict();
+
+// ──────────────────────────────────────────── Project Pages (PRD 932)
+// Same validation split as projectBriefCwd above: real path validation is
+// config.cjs's validatePath at first fs access in projectPages.cjs.
+const projectPagesCwd = z.object({
+  cwd: z.string().min(1).max(4096),
+}).strict();
 const projectBriefSetPin = z.object({
   cwd: z.string().min(1).max(4096),
   block: PROJECT_BRIEF_BLOCK,
@@ -486,6 +493,25 @@ const promptSessionTranscriptRead = z.object({
   limit: z.number().int().positive().max(10_000).optional(),
 }).strict();
 
+// ──────────────────────────────────────────── Audit log (renderer Epic
+// lifecycle trace, PRD 940). Kind allowlist is enforced HERE, main-side — the
+// renderer cannot write arbitrary kinds through this channel, only the six
+// Epic lifecycle transitions it emits from promptSessions.ts.
+const AUDIT_LOG_KIND = z.enum([
+  'epic_create',
+  'epic_approve',
+  'epic_complete',
+  'epic_delete',
+  'epic_resume',
+  'epic_duplicate',
+]);
+const auditLogAppend = z.object({
+  kind: AUDIT_LOG_KIND,
+  cwd: z.string().min(1).max(4096),
+  epicId: z.string().min(1).max(256),
+  source: z.string().min(1).max(256),
+}).strict();
+
 // ──────────────────────────────────────────── Per-subagent memory
 // Distinct from the workspace-scoped Memory tool: agentMemory is keyed by
 // subagent name (the .md filename in ~/.claude/agents/, e.g. "code-reviewer"),
@@ -877,10 +903,12 @@ module.exports = {
     memoryAggregate,
     memoryStale,
     projectBriefCwd,
+    projectPagesCwd,
     projectBriefSetPin,
     projectBriefUpdate,
     promptSessionTranscriptAppend,
     promptSessionTranscriptRead,
+    auditLogAppend,
     agentMemoryList,
     agentMemoryGet,
     agentMemorySet,

package/src/main/lib/epicMint.cjs

@@ -182,9 +182,13 @@ function withPathLock(lockPath, task) {
  *
  * `status` defaults to 'proposed' — a fail-safe default so any caller that
  * forgets to pass it files an Epic that waits for human approval rather than
- * one that starts running immediately. Pass 'active' explicitly only for the
- * one legitimate immediate-start path (the New Epic UI's own proposed→active
- * transition, `promptSessions.ts`'s `approveProposed`).
+ * one that starts running immediately. Every Epic is BORN 'proposed' — the
+ * mint branch below ignores/rejects any other requested status; it is
+ * fail-closed, mirroring opsOwnership.cjs's assertOpsWrite. Activation
+ * ('proposed' → 'active') happens exactly once, entirely in the renderer
+ * store's `approveProposed` (`state/promptSessions.ts`) — that code path
+ * never calls ensureEpic(). Joining an already-'active' Epic (this function's
+ * join branches, above the mint branch) remains legal and unchanged.
  *
  * `mintIfMissing` defaults to true for the small set of callers that are
  * themselves the human-intent gate (propose-epic, the RCA hook, the feedback
@@ -208,11 +212,27 @@ function ensureEpic(cwd, { goalText, tag, reuseByGoal = false, epicId: explicitE
     const index = readActiveIndex(cwd);
 
     // A dispatch that already knows its Epic (sourcePromptId frontmatter from
-    // an Epic-conversation dispatch) joins it rather than minting a sibling.
+    // an Epic-conversation dispatch) joins it rather than minting a sibling —
+    // but only while that Epic is still open. Joining unconditionally here
+    // let a stale/hallucinated sourcePromptId silently attach a PRD (and its
+    // follow-on events/chat activity) to an unrelated or even completed
+    // Epic — the "this session ran again without my knowledge, and it was
+    // really another Epic's prompt" cross-contamination bug. Mirrors
+    // findJoinableEpicInIndex()'s preferEpicId open-check (line ~124).
     if (explicitEpicId && hasOwn(index.sessions, explicitEpicId)) {
-      const prdDir = resolveEpicPrdWriteDir(cwd, explicitEpicId);
-      fs.mkdirSync(prdDir, { recursive: true });
-      return { epicId: explicitEpicId, prdDir, created: false };
+      const preferred = index.sessions[explicitEpicId];
+      if (preferred && (preferred.status === 'proposed' || preferred.status === 'active')) {
+        const prdDir = resolveEpicPrdWriteDir(cwd, explicitEpicId);
+        fs.mkdirSync(prdDir, { recursive: true });
+        return { epicId: explicitEpicId, prdDir, created: false };
+      }
+      console.warn(`[epicMint] ensureEpic: explicit epicId ${explicitEpicId} exists but is not open (status=${preferred?.status ?? 'unknown'}) — refusing to join, falling through`);
+      appendAuditEvent('epic_mint_refused', {
+        cwd,
+        epicId: explicitEpicId,
+        status,
+        reason: `explicit epicId exists but is not open (status=${preferred?.status ?? 'unknown'}) — refusing to join, falling through to mint`,
+      });
     }
 
     if (reuseByGoal) {
@@ -241,11 +261,11 @@ function ensureEpic(cwd, { goalText, tag, reuseByGoal = false, epicId: explicitE
     }
 
     if (!mintIfMissing) {
-      throw new Error(
-        `ensureEpic: no existing Epic found (epicId=${explicitEpicId ?? 'none'}) and mintIfMissing is false — `
-        + 'a new Epic can only be created by explicit human intent (New Epic UI, or /propose-epic + Approve & start), '
-        + 'never implicitly by a PRD-authoring path',
-      );
+      const reason = 'no existing Epic found and mintIfMissing is false — a new Epic can only be created by '
+        + 'explicit human intent (New Epic UI, or /propose-epic + Approve & start), never implicitly by a '
+        + 'PRD-authoring path';
+      appendAuditEvent('epic_mint_refused', { cwd, epicId: explicitEpicId ?? null, status, reason });
+      throw new Error(`ensureEpic: ${reason} (epicId=${explicitEpicId ?? 'none'})`);
     }
 
     if (!forceNewEpic) {
@@ -257,6 +277,20 @@ function ensureEpic(cwd, { goalText, tag, reuseByGoal = false, epicId: explicitE
       }
     }
 
+    // BORN-PROPOSED LAW (fail-closed, mirrors opsOwnership.cjs's
+    // assertOpsWrite): a mint always writes 'proposed', regardless of what
+    // status the caller requested. A caller explicitly asking to mint
+    // 'active' is refused outright rather than silently downgraded — that
+    // shape (mint + already-active) should never occur, so it is treated as
+    // a bug in the caller, not a normal fallback path.
+    if (status !== 'proposed') {
+      const reason = `ensureEpic: refusing to mint a new Epic with status '${status}' — every Epic is born `
+        + "'proposed' (CLAUDE.md domain model); activation happens only via the renderer store's "
+        + 'approveProposed, never through ensureEpic()';
+      appendAuditEvent('epic_mint_refused', { cwd, epicId: explicitEpicId ?? null, status, reason });
+      throw new Error(reason);
+    }
+
     const epicId = `${slugify(goalText)}-${crypto.randomUUID().slice(0, 8)}`;
     const now = new Date().toISOString();
     const session = {

package/src/main/lib/prdLocations.cjs

@@ -145,6 +145,39 @@ function resolvePrdsDirs(maxAgeMin, opts) {
   return dirs;
 }
 
+/**
+ * resolveArchivedPrdsDirs(maxAgeMin?, opts?) → string[]
+ *
+ * The `prds-archived/` counterpart of resolvePrdsDirs — every archive dir
+ * (the flat per-project sibling plus each Epic's own sibling, per
+ * listArchivedPrdDirs) that exists on disk, across every historical AND
+ * currently-active project. Same "not recency-filtered" rationale as
+ * resolvePrdsDirs: a quiet project's completed-PRD history is still real
+ * history, not something list-prds should stop counting.
+ */
+function resolveArchivedPrdsDirs(maxAgeMin, opts) {
+  const dirs = [];
+  const seen = new Set();
+  const add = (dir) => {
+    if (seen.has(dir)) return;
+    seen.add(dir);
+    dirs.push(dir);
+  };
+
+  for (const cwd of allProjectCwds(opts)) {
+    for (const dir of listArchivedPrdDirs(cwd)) {
+      if (fs.existsSync(dir)) add(dir);
+    }
+  }
+  for (const cwd of activeProjectCwds(maxAgeMin, opts)) {
+    for (const dir of listArchivedPrdDirs(cwd)) {
+      if (fs.existsSync(dir)) add(dir);
+    }
+  }
+
+  return dirs;
+}
+
 /**
  * deriveEpicIdFromPrdPath(filePath) → epicId | null
  *
@@ -160,7 +193,11 @@ function resolvePrdsDirs(maxAgeMin, opts) {
 function deriveEpicIdFromPrdPath(filePath) {
   if (!filePath || typeof filePath !== 'string') return null;
   const prdsDir = path.dirname(filePath);
-  if (path.basename(prdsDir) !== 'prds') return null;
+  // Accept both an Epic's live `prds/` dir and its sibling `prds-archived/`
+  // dir — archived PRDs still belong to the Epic they were dispatched from,
+  // and callers (parsePrdRaw, list-prds) need epicId for archived files too.
+  const dirName = path.basename(prdsDir);
+  if (dirName !== 'prds' && dirName !== 'prds-archived') return null;
   const epicDir = path.dirname(prdsDir);
   const epicId = path.basename(epicDir);
   if (!epicId || epicId === '.' || epicId === path.sep) return null;
@@ -168,13 +205,14 @@ function deriveEpicIdFromPrdPath(filePath) {
   for (let i = 0; i < EPICS_SUBPATH.length; i++) projectCwd = path.dirname(projectCwd);
   let epicsRoot;
   try { epicsRoot = resolveEpicsRoot(projectCwd); } catch { return null; }
-  if (path.join(epicsRoot, epicId, 'prds') !== prdsDir) return null;
+  if (path.join(epicsRoot, epicId, dirName) !== prdsDir) return null;
   return epicId;
 }
 
 module.exports = {
   resolvePrdWriteDir,
   resolvePrdsDirs,
+  resolveArchivedPrdsDirs,
   resolveEpicsRoot,
   resolveEpicPrdWriteDir,
   listEpicPrdDirs,

package/src/main/projectPages.cjs

@@ -0,0 +1,65 @@
+'use strict';
+
+/**
+ * projectPages.cjs — read-only backend for Project Home's Project Pages
+ * display (PRD 932). Reads what the `project-home-builder` Epic's own
+ * session writes directly with its Write tool
+ * (`session-manager-operations/project-pages/output/*.html` + manifest.json)
+ * — this module never writes anything, matching the corrected "not an
+ * OWNERS namespace" storage/ownership note in
+ * session-manager-operations/architecture/project-pages-pipeline.md and
+ * session-manager-operations/project-pages/README.md. Structure mirrors
+ * projectBrief.cjs's `get()`: validatePath first, config.cjs read helpers,
+ * one ipcMain.handle registered from index.cjs's registerXHandlers() pattern.
+ */
+
+const { ipcMain } = require('electron');
+const path = require('node:path');
+const config = require('./config.cjs');
+
+function outputDir(cwd) {
+  return path.join(cwd, 'session-manager-operations', 'project-pages', 'output');
+}
+
+const LENSES = ['marketing', 'feature', 'architecture'];
+
+async function get({ cwd }) {
+  const realCwd = config.validatePath(cwd);
+  const dir = outputDir(realCwd);
+  const manifestResult = await config.readJson(path.join(dir, 'manifest.json'));
+  if (!manifestResult.exists || !manifestResult.data || manifestResult.parseError) {
+    return { output: null };
+  }
+
+  const htmlResults = await Promise.all(
+    LENSES.map((lens) => config.readText(path.join(dir, `${lens}.html`))),
+  );
+  if (htmlResults.some((r) => !r.exists)) {
+    return { output: null };
+  }
+
+  const [marketing, feature, architecture] = htmlResults;
+  const generatedAt = typeof manifestResult.data.generatedAt === 'string' ? manifestResult.data.generatedAt : null;
+  if (!generatedAt) {
+    return { output: null };
+  }
+
+  return {
+    output: {
+      marketing: marketing.text,
+      feature: feature.text,
+      architecture: architecture.text,
+      generatedAt,
+    },
+  };
+}
+
+function registerProjectPagesIpc() {
+  const { schemas: s, validated: v } = require('./ipcSchemas.cjs');
+  ipcMain.handle('project-pages:get', v(s.projectPagesCwd, get));
+}
+
+module.exports = {
+  registerProjectPagesIpc,
+  get,
+};

package/src/main/scheduler.cjs

@@ -85,7 +85,7 @@ const queueOps = require('./queueOps.cjs');
 // Plain Node module, no Electron dependency; queuePath/prdsDir defaults already
 // match ROOT/QUEUE_PATH below since both resolve the same ~/.claude/session-manager
 // home-dir layout.
-const { resolvePrdsDirs, resolvePrdWriteDir, listEpicPrdDirs, listArchivedPrdDirs } = require('./lib/prdLocations.cjs');
+const { resolvePrdsDirs, resolveArchivedPrdsDirs, resolvePrdWriteDir, listEpicPrdDirs, listArchivedPrdDirs } = require('./lib/prdLocations.cjs');
 const { ensureEpic, appendPrdCreatedEvent, readActiveIndex } = require('./lib/epicMint.cjs');
 
 // ---------- origin session resolution (PRD 832) ----------
@@ -486,6 +486,35 @@ function candidatePrdsDirs() {
   return [PRDS_DIR, ...resolvePrdsDirs()];
 }
 
+/**
+ * Every `prds-archived/` dir across every project (the sibling-of-source
+ * layout archiveCompletedPrd writes into — see that function's comment).
+ * Used only by list-prds so the PRDs/Runs tabs can show an Epic's REAL
+ * historical PRD count, not just its currently-pending one. Deliberately
+ * excludes the flat legacy PRDS_ARCHIVE_DIR (manual `schedule:archive-prd`
+ * timestamped-subdir layout) — that path is for a different, unused-by-
+ * any-renderer manual archive flow, not Epic-scoped completion archiving.
+ */
+function candidateArchivedPrdsDirs() {
+  return resolveArchivedPrdsDirs();
+}
+
+/**
+ * Resolve an archived PRD's real terminal outcome for `schedule:list-prds`:
+ * its live queue.json row (if the job hasn't aged out yet), else its
+ * history.jsonl row, else 'completed' — archiveCompletedPrd only ever
+ * archives a job whose effective status is 'completed' (a 'failed' job's
+ * PRD source stays in the live prds/ dir), so 'completed' is a safe
+ * default, not a guess; the live/history lookups are defensive in case
+ * that archiving invariant ever changes. Exported as a pure function (no
+ * IPC/fs) so this fallback chain is unit-testable without an Electron
+ * harness.
+ */
+function resolveArchivedPrdStatus(slug, liveStatusBySlug, histBySlug) {
+  const resolved = liveStatusBySlug.get(slug) ?? histBySlug.get(slug)?.status ?? 'completed';
+  return resolved === 'failed' ? 'failed' : 'completed';
+}
+
 /** The PRD-source directory for a given job cwd (falls back to DEFAULT_PROJECT_CWD). */
 function prdDirForCwd(cwd) {
   return resolvePrdWriteDir(cwd || DEFAULT_PROJECT_CWD);
@@ -536,22 +565,33 @@ async function archivedTwinExists(job) {
 }
 
 /**
- * Build the non-failure result + run meta for a job whose PRD has already
- * been archived (work shipped, queue entry is stale). Shared by both
- * PRD-read failure exits in executeJob so the stale-skip logic isn't
- * duplicated.
+ * Build the non-failure result + run meta for a queued job whose PRD source
+ * is gone. Shared by both PRD-read failure exits in executeJob so the
+ * stale-skip logic isn't duplicated. Two reasons, both exitCode: 0 (no RCA
+ * feedback item, since neither is a real work failure):
+ *   - 'prd-archived': the source was archived — archivedTwinExists found it
+ *     under a prds-archived/ dir. The work already shipped.
+ *   - 'prd-missing': the source is gone everywhere (ENOENT on every
+ *     candidate dir, no archived twin either) — most commonly a PRD that
+ *     existed at enqueue time and was deleted before dispatch (e.g. a test
+ *     fixture that leaked into the live queue and was cleaned up by its own
+ *     `finally` block). Retire the row rather than fail it.
  */
-function prdArchivedSkipResult(job, cwd, sessionId, startedAt, safeLog, closeFd, metaPath) {
-  const archivedTwin = archivedPrdPathForJob(job);
-  const msg = `PRD already archived (${archivedTwin}) — work shipped; retiring stale queue entry`;
+function prdArchivedSkipResult(job, cwd, sessionId, startedAt, safeLog, closeFd, metaPath, reason = 'prd-archived') {
+  const msg = reason === 'prd-missing'
+    ? 'PRD source no longer exists on disk — retiring stale queue entry'
+    : (() => {
+        const archivedTwin = archivedPrdPathForJob(job);
+        return `PRD already archived (${archivedTwin}) — work shipped; retiring stale queue entry`;
+      })();
   safeLog(`[scheduler] ${msg}\n`);
   closeFd();
   const finishedAt = Date.now();
   config.writeJsonSync(metaPath, {
-    slug: job.slug, cwd, sessionId, exitCode: 0, skipped: 'prd-archived',
+    slug: job.slug, cwd, sessionId, exitCode: 0, skipped: reason,
     note: msg, startedAt, finishedAt, durationMs: 0,
   });
-  return { exitCode: 0, durationMs: 0, skipped: 'prd-archived', note: msg, sessionId };
+  return { exitCode: 0, durationMs: 0, skipped: reason, note: msg, sessionId };
 }
 
 /**
@@ -2003,16 +2043,34 @@ async function executeJob(job, runDir, defaultCwd, onPid) {
         prompt = parsed.body + FINISH_PROTOCOL;
         prdPath = fallbackPath;
       } catch (e2) {
+        // Found the dir a moment ago but the read still failed. Case A: the
+        // source has since been archived — stale-skip as usual. Case B: it
+        // was deleted out from under us in the window between findPrdDir and
+        // parsePrd (ENOENT) with no archived twin — also a stale row, not a
+        // real failure. Anything else (malformed/unreadable PRD) is a real
+        // failure and keeps exitCode: -1.
         if (await archivedTwinExists(job)) {
-          return prdArchivedSkipResult(job, cwd, sessionId, startedAt, safeLog, closeFd, metaPath);
+          return prdArchivedSkipResult(job, cwd, sessionId, startedAt, safeLog, closeFd, metaPath, 'prd-archived');
+        }
+        if (e2 && e2.code === 'ENOENT') {
+          return prdArchivedSkipResult(job, cwd, sessionId, startedAt, safeLog, closeFd, metaPath, 'prd-missing');
         }
         safeLog(`[scheduler] failed to read PRD: ${e2?.message}\n`);
         closeFd();
         return { exitCode: -1, durationMs: 0, error: e2?.message };
       }
     } else {
+      // No candidate dir has the slug at all. Case A: it was archived —
+      // stale-skip. Case B: the read error is ENOENT (the common case: a
+      // source that existed at enqueue time and is gone by dispatch, e.g. a
+      // leaked test fixture) with no archived twin — retire as stale rather
+      // than a hard failure. Anything else (a real read/parse error) still
+      // fails the job.
       if (await archivedTwinExists(job)) {
-        return prdArchivedSkipResult(job, cwd, sessionId, startedAt, safeLog, closeFd, metaPath);
+        return prdArchivedSkipResult(job, cwd, sessionId, startedAt, safeLog, closeFd, metaPath, 'prd-archived');
+      }
+      if (e && e.code === 'ENOENT') {
+        return prdArchivedSkipResult(job, cwd, sessionId, startedAt, safeLog, closeFd, metaPath, 'prd-missing');
       }
       safeLog(`[scheduler] failed to read PRD: ${e?.message}\n`);
       closeFd();
@@ -2458,6 +2516,16 @@ async function spawnInvestigation(failedJob, runDir) {
     return { deferred: false };
   }
 
+  // Mark the job 'investigating' so the Queue UI shows an active status for
+  // the whole probe duration — previously this left the job's persisted
+  // status frozen at 'failed'/'needs_review' the entire time, which read as
+  // "nothing is happening" even though an Opus process was actively running.
+  await mutate((s) => {
+    const j = s.jobs.find((x) => x.slug === failedJob.slug);
+    if (j) j.status = 'investigating';
+  });
+  await broadcast({ flush: true });
+
   const claudeBin = resolveClaudeBin();
   const childEnv = cleanChildEnv({ PATH: pathWithUserBins() }); // Homebrew/user bins for macOS
 
@@ -2495,6 +2563,14 @@ async function spawnInvestigation(failedJob, runDir) {
     watchdogs: [deadmanWatchdog],
     onExit({ exitCode, error, spawnFailed, safeLog: sl }) {
       releaseSlot();
+      // Restore the pre-investigation status now that the probe has exited —
+      // 'investigating' must never be the job's resting state.
+      mutate((s) => {
+        const j = s.jobs.find((x) => x.slug === failedJob.slug);
+        if (j && j.status === 'investigating') j.status = failedJob.status || 'failed';
+      })
+        .then(() => broadcast({ flush: true }))
+        .catch(() => {});
       if (error) {
         const errMsg = spawnFailed
           ? `investigation spawn failed: ${error?.message ?? String(error)}`
@@ -2541,8 +2617,15 @@ async function spawnInvestigation(failedJob, runDir) {
   return { deferred: false };
   } catch (e) {
     // A synchronous throw before onExit is wired (e.g. resolveClaudeBin not found,
-    // openLog failure, spawn setup) must not strand the reserved slot.
+    // openLog failure, spawn setup) must not strand the reserved slot, and must
+    // not strand the job on the transient 'investigating' status either.
     releaseSlot();
+    mutate((s) => {
+      const j = s.jobs.find((x) => x.slug === failedJob.slug);
+      if (j && j.status === 'investigating') j.status = failedJob.status || 'failed';
+    })
+      .then(() => broadcast({ flush: true }))
+      .catch(() => {});
     throw e;
   }
 }
@@ -3167,7 +3250,11 @@ async function maybeLaunchWhenAvailable(state) {
  */
 async function reapDeadRunningJobs() {
   try {
-    if (runningSet.size === 0) return; // fast path: no in-flight jobs
+    // Do NOT gate on runningSet: spawnJob()'s finally block unconditionally
+    // deletes a job's slug from runningSet even when the preceding completion
+    // mutate() threw and was swallowed, leaving queue.json stuck at
+    // status:"running" with no slug left in runningSet to trigger reconciliation.
+    // queue.json is the source of truth for which jobs are actually running.
     const state = await readQueue();
     const dead = [];
     for (const j of state.jobs) {
@@ -3925,7 +4012,9 @@ function registerScheduleHandlers() {
   ipcMain.handle('schedule:list-prds', async () => {
     ensureDirs();
     const out = [];
-    for (const dir of candidatePrdsDirs()) {
+    const seenSlugs = new Set();
+
+    async function readDirInto(dir, { archived }) {
       let entries;
       try {
         entries = await fsp.readdir(dir);
@@ -3933,15 +4022,21 @@ function registerScheduleHandlers() {
         if (e?.code !== 'ENOENT') {
           logs.writeLine({ level: 'warn', scope: 'scheduler', message: 'list-prds: readdir failed', meta: { dir, error: e?.message } });
         }
-        continue;
+        return;
       }
       for (const name of entries) {
         if (!name.endsWith('.md') || name.startsWith('.')) continue;
         const filePath = path.join(dir, name);
         try {
           const parsed = await parsePrd(filePath);
+          // A slug can't be both live and archived at once, but a duplicate
+          // slug found in two archive dirs (shouldn't happen — archiving is
+          // a single rename — but is cheap to guard) is skipped rather than
+          // double-counted.
+          if (seenSlugs.has(parsed.slug)) continue;
+          seenSlugs.add(parsed.slug);
           const stat = await fsp.stat(filePath);
-          out.push({
+          const entry = {
             slug: parsed.slug,
             parallelGroup: parsed.parallelGroup,
             title: parsed.title,
@@ -3950,12 +4045,46 @@ function registerScheduleHandlers() {
             sourcePromptId: parsed.sourcePromptId,
             epicId: parsed.epicId ?? null,
             mtimeMs: stat.mtimeMs,
-          });
+            archived,
+          };
+          out.push(entry);
         } catch (e) {
           logs.writeLine({ level: 'warn', scope: 'scheduler', message: 'list-prds: skipping unparseable file', meta: { name, error: e?.message } });
         }
       }
     }
+
+    // Live PRDs first, so an archived duplicate (shouldn't exist, but a
+    // stale rename copy is possible) never shadows the still-runnable live
+    // entry.
+    for (const dir of candidatePrdsDirs()) {
+      await readDirInto(dir, { archived: false });
+    }
+
+    const archivedStart = out.length;
+    for (const dir of candidateArchivedPrdsDirs()) {
+      await readDirInto(dir, { archived: true });
+    }
+
+    // Archived PRDs need a status: archiveCompletedPrd (scheduler.cjs) only
+    // ever archives a job whose effective status is 'completed' — a 'failed'
+    // job's PRD source stays in the live prds/ dir (still visible/countable
+    // there already). Still resolve the real job status defensively (live
+    // queue row, falling back to history.jsonl) rather than hard-coding
+    // 'completed', so this stays correct if that archiving invariant ever
+    // changes.
+    if (out.length > archivedStart) {
+      const [state, histBySlug] = await Promise.all([
+        readQueue(),
+        queueHistory.historyTerminalBySlug().catch(() => new Map()),
+      ]);
+      const liveStatusBySlug = new Map(state.jobs.map((j) => [j.slug, j.status]));
+      for (let i = archivedStart; i < out.length; i++) {
+        const entry = out[i];
+        entry.archivedStatus = resolveArchivedPrdStatus(entry.slug, liveStatusBySlug, histBySlug);
+      }
+    }
+
     out.sort((a, b) => a.slug.localeCompare(b.slug, undefined, { numeric: true }));
     return out;
   });
@@ -4380,4 +4509,4 @@ function registerAdminRoutes(adminHttp, remoteObj = remote) {
   });
 }
 
-module.exports = { registerScheduleHandlers, attachWindow, init, ROOT, PRDS_DIR, writeQueue, reconcile, reconcileSourcePromptId, allocateParallelGroup, selectHistoryJobs, parsePorcelain, FINISH_PROTOCOL, remote, pickNextBatch, pickForProject, reapDeadRunningJobs, pollRecoveryClearSource, memoryLimitedBatchSize, availableForJobs, reverifyNeedsReview, isRescanCandidate, isPromotableOriginal, selectAutoFixTargets, isEligibleForImmediateAutoFix, resolveRunId, isUnresolvableNeedsReview, healTargetForFix, buildInvestigationPrompt, committedInWindow, computeCommittedDuringRun, classifySigtermWithCommit, isFixPlanSlug, isFixPlanBeyondDepthCap, MAX_INVESTIGATION_DEPTH, forceTickOutcome, applyPauseCleared, detectNetworkErrorInLog, detectRateLimitInLog, classifyFailureOutcome, commitGuardVerdict, TRANSIENT_RETRY_CAP, buildScheduleStatePayload, partitionBootOrphans, applyOrphanOutcome, BOOT_ORPHAN_KILL_GRACE_MS, registerAdminRoutes, notifyOriginatingTab, isNotifiableTerminalStatus, extractResultTextFromLog, candidatePrdsDirs, prdDirForCwd, prdPathForJob, archivedPrdPathForJob, archivedTwinExists, findPrdDir, runPrdMigration, shouldSkipInvestigationForCleanRun, archiveCompletedPrd, retireCompletedSlugs, SCHEDULER_BOOTED_AT, SCHEDULER_CODE_SHA, resetJobFields };
+module.exports = { registerScheduleHandlers, attachWindow, init, ROOT, PRDS_DIR, writeQueue, reconcile, reconcileSourcePromptId, allocateParallelGroup, selectHistoryJobs, parsePorcelain, FINISH_PROTOCOL, remote, pickNextBatch, pickForProject, reapDeadRunningJobs, pollRecoveryClearSource, memoryLimitedBatchSize, availableForJobs, reverifyNeedsReview, isRescanCandidate, isPromotableOriginal, selectAutoFixTargets, isEligibleForImmediateAutoFix, resolveRunId, isUnresolvableNeedsReview, healTargetForFix, buildInvestigationPrompt, committedInWindow, computeCommittedDuringRun, classifySigtermWithCommit, isFixPlanSlug, isFixPlanBeyondDepthCap, MAX_INVESTIGATION_DEPTH, forceTickOutcome, applyPauseCleared, detectNetworkErrorInLog, detectRateLimitInLog, classifyFailureOutcome, commitGuardVerdict, TRANSIENT_RETRY_CAP, buildScheduleStatePayload, partitionBootOrphans, applyOrphanOutcome, BOOT_ORPHAN_KILL_GRACE_MS, registerAdminRoutes, notifyOriginatingTab, isNotifiableTerminalStatus, extractResultTextFromLog, candidatePrdsDirs, candidateArchivedPrdsDirs, resolveArchivedPrdStatus, prdDirForCwd, prdPathForJob, archivedPrdPathForJob, archivedTwinExists, findPrdDir, runPrdMigration, shouldSkipInvestigationForCleanRun, archiveCompletedPrd, retireCompletedSlugs, SCHEDULER_BOOTED_AT, SCHEDULER_CODE_SHA, resetJobFields, executeJob, prdArchivedSkipResult };

package/src/preload/api.d.ts

@@ -385,7 +385,7 @@ export interface ScheduleConfig {
   schemaVersion: 1;
 }
 
-export type ScheduleJobStatus = 'pending' | 'running' | 'completed' | 'failed' | 'needs_review';
+export type ScheduleJobStatus = 'pending' | 'running' | 'investigating' | 'completed' | 'failed' | 'needs_review';
 
 export interface ScheduleJobRuntime {
   pid: number;
@@ -490,6 +490,15 @@ export interface PrdListItem {
   sourcePromptId?: string | null;
   /** Owning Epic id, derived from the PRD's directory. See ScheduleJob.epicId. */
   epicId?: string | null;
+  /** True when this PRD's source .md was found in a `prds-archived/` dir
+   *  (its scheduler job already ran to completion) rather than the live
+   *  `prds/` dir. Archived PRDs have no matching queue.json job row (the
+   *  row may have aged out into history.jsonl), so consumers must read
+   *  `archivedStatus` instead of joining on a job to know the outcome. */
+  archived?: boolean;
+  /** Only present when `archived` is true — the resolved terminal outcome
+   *  ('completed' vs 'failed') of the job that produced this archived PRD. */
+  archivedStatus?: 'completed' | 'failed';
 }
 
 export interface SupervisorConfig {
@@ -959,6 +968,19 @@ export type ProjectBriefUpdateResult =
   | { ok: true; brief: ProjectBrief }
   | { ok: false; error: string };
 
+// ────────────────────────────────────────────── Project Pages (PRD 929-932)
+export interface ProjectPagesOutput {
+  marketing: string;
+  feature: string;
+  architecture: string;
+  generatedAt: string;
+}
+
+export interface ProjectPagesGetResult {
+  /** null when no manifest/output files exist yet — the empty-state signal. */
+  output: ProjectPagesOutput | null;
+}
+
 // ────────────────────────────────────────────── Per-subagent memory
 // Stored at ~/.claude/session-manager/agent-memory/<agentId>.json. Keyed by
 // agent name (the .md filename in ~/.claude/agents/), not by workspace cwd.
@@ -1109,7 +1131,7 @@ export interface ChatCreatePrdPayload {
   /** Originating tab id — used at job completion to route a status prompt back into the tab. */
   sourceTabId?: string;
   /** User-selected Feature/Bug tag (PRD 774) carried from the originating PromptTicket. */
-  tag?: 'feature' | 'bug' | 'discussion' | 'build';
+  tag?: 'feature' | 'bug' | 'discussion' | 'build' | 'project-home-builder';
 }
 
 export type ChatCreatePrdResult =
@@ -1520,6 +1542,10 @@ export interface SessionManagerAPI {
     /** Hand-edit brief.json in place — no LLM cost. Edited pinnable blocks are auto-pinned so the next refresh preserves them. */
     update: (cwd: string, patch: ProjectBriefPatch) => Promise<ProjectBriefUpdateResult>;
   };
+  projectPages: {
+    /** Read output/*.html + manifest.json (or `{output: null}` if none exist yet). Never fires an LLM call. */
+    get: (cwd: string) => Promise<ProjectPagesGetResult>;
+  };
   promptSessionTranscript: {
     /** Append one full-text turn to an Epic's durable JSONL transcript. Best-effort — resolves `{ok:false}` rather than throwing on failure. */
     append: (
@@ -1530,6 +1556,15 @@ export interface SessionManagerAPI {
     /** Read back an Epic's full-text turns (optionally capped to the last `limit`). Skips corrupt lines rather than throwing. */
     read: (cwd: string, epicId: string, limit?: number) => Promise<{ turns: PromptSessionTranscriptTurn[] }>;
   };
+  auditLog: {
+    /** Append one Epic-lifecycle audit event to ~/.claude/session-manager/audit-log.jsonl.
+     *  Kind allowlist is enforced main-side (ipcSchemas.cjs) — this channel is
+     *  append-only, no read/list IPC exists. */
+    append: (
+      kind: 'epic_create' | 'epic_approve' | 'epic_complete' | 'epic_delete' | 'epic_resume' | 'epic_duplicate',
+      fields: { cwd: string; epicId: string; source: string },
+    ) => Promise<{ ok: boolean }>;
+  };
   agentMemory: {
     /** List all memory entries for one subagent. Sorted newest first. */
     list: (agentId: string) => Promise<AgentMemoryListResult>;

package/src/preload/index.cjs

@@ -330,12 +330,18 @@ contextBridge.exposeInMainWorld('api', {
     setPin: (cwd, block, pinned) => ipcRenderer.invoke('project-brief:set-pin', { cwd, block, pinned }),
     update: (cwd, patch) => ipcRenderer.invoke('project-brief:update', { cwd, patch }),
   },
+  projectPages: {
+    get: (cwd) => ipcRenderer.invoke('project-pages:get', { cwd }),
+  },
   promptSessionTranscript: {
     append: (cwd, epicId, turn) =>
       ipcRenderer.invoke('promptSessionTranscript:append', { cwd, epicId, ...turn }),
     read: (cwd, epicId, limit) =>
       ipcRenderer.invoke('promptSessionTranscript:read', { cwd, epicId, ...(limit ? { limit } : {}) }),
   },
+  auditLog: {
+    append: (kind, fields) => ipcRenderer.invoke('auditLog:append', { kind, ...fields }),
+  },
   agentMemory: {
     list: (agentId) => ipcRenderer.invoke('agent-memory:list', { agentId }),
     get: (agentId, entryId) => ipcRenderer.invoke('agent-memory:get', { agentId, entryId }),