claude-code-session-manager 0.52.0 → 0.54.0

package/dist/index.html

@@ -7,10 +7,10 @@
     <link rel="preconnect" href="https://fonts.googleapis.com">
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
     <link href="https://fonts.googleapis.com/css2?family=Newsreader:ital,opsz,wght@0,6..72,400;0,6..72,500;0,6..72,600;0,6..72,700;1,6..72,400&family=Geist:wght@300;400;500;600;700&family=IBM+Plex+Mono:wght@400;500;600&display=swap" rel="stylesheet">
-    <script type="module" crossorigin src="./assets/index-hNso_ykJ.js"></script>
+    <script type="module" crossorigin src="./assets/index-BYOscSQK.js"></script>
     <link rel="modulepreload" crossorigin href="./assets/monaco-editor-BW5C4Iv1.js">
     <link rel="stylesheet" crossorigin href="./assets/monaco-editor-BTnBOi8r.css">
-    <link rel="stylesheet" crossorigin href="./assets/index-CKP60_3d.css">
+    <link rel="stylesheet" crossorigin href="./assets/index-BEyUC3v9.css">
   </head>
   <body class="bg-bg text-fg font-sans antialiased">
     <div id="root"></div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-code-session-manager",
-  "version": "0.52.0",
+  "version": "0.54.0",
   "description": "Local cockpit for the Claude Code CLI — multi-tab terminal, full config surface, scheduler, voice dictation, and live observability.",
   "type": "module",
   "main": "src/main/index.cjs",

package/src/main/__tests__/activeIndexMerge.test.cjs

@@ -0,0 +1,235 @@
+/**
+ * activeIndexMerge.test.cjs — unit tests for the main-process read-merge-write
+ * of a cwd's prompt-sessions/active-index.json (lib/activeIndexMerge.cjs),
+ * moved here from the renderer (state/promptSessions.ts's old
+ * persistActiveIndex, commit 3d12e19) so the merge runs inside the same
+ * withPathLock instance epicMint.cjs's ensureEpic already serializes through.
+ *
+ * Covers the two holes a purely-renderer merge left open:
+ *  - resurrection: a tombstoned id must never be written back by a later
+ *    merge call whose memory contribution still thinks it's open.
+ *  - TOCTOU: a mint (ensureEpic) interleaved with a merge call must survive,
+ *    since both now go through the same lock.
+ *
+ * Run: timeout 300 npx vitest run src/main/__tests__/activeIndexMerge.test.cjs
+ */
+
+'use strict';
+
+import { test, expect, afterEach } from 'vitest';
+const fsp = require('node:fs/promises');
+const os = require('node:os');
+const path = require('node:path');
+const { mergeActiveIndex } = require('../lib/activeIndexMerge.cjs');
+const { ensureEpic, readActiveIndex } = require('../lib/epicMint.cjs');
+const { appendResponseEventIfKnown } = require('../promptSessionEvents.cjs');
+const config = require('../config.cjs');
+
+const tmpDirs = [];
+afterEach(async () => {
+  while (tmpDirs.length) {
+    const d = tmpDirs.pop();
+    await fsp.rm(d, { recursive: true, force: true });
+  }
+});
+
+async function mkCwd() {
+  const cwd = await fsp.mkdtemp(path.join(os.tmpdir(), 'sm-activeindexmerge-cwd-'));
+  // config.cjs's readJson/writeJson restrict to registered roots (home dir by
+  // default) — register this tmp dir so the merge's config.readJson/writeJson
+  // calls don't reject it as outside the allowed boundary.
+  config.addAllowedRoot(cwd);
+  tmpDirs.push(cwd);
+  return cwd;
+}
+
+function session(id, overrides = {}) {
+  return {
+    id,
+    cwd: overrides.cwd || '/proj',
+    goalText: overrides.goalText || `goal for ${id}`,
+    claudeSessionId: overrides.claudeSessionId || `claude-${id}`,
+    status: overrides.status || 'active',
+    createdAt: overrides.createdAt || '2026-08-02T13:48:00.000Z',
+    completedAt: overrides.completedAt ?? null,
+  };
+}
+
+function promptEvent(id, promptSessionId, at) {
+  return { id, promptSessionId, kind: 'prompt', causedByEventId: null, at, text: 'x' };
+}
+
+// Incident 2026-08-02: two Epics created by another (already-running) window
+// sat on disk. A second window booted empty and, on its first mutation,
+// persisted its own (empty-of-those-two) contribution straight over the file.
+// The main-side merge must still preserve every pre-existing on-disk Epic.
+test('a fresh caller contributing one Epic preserves pre-existing on-disk Epics untouched', async () => {
+  const cwd = await mkCwd();
+  const other = session('psess-other');
+  await mergeActiveIndex(cwd, {
+    sessions: { [other.id]: other },
+    events: { [other.id]: [promptEvent('evt-1', other.id, other.createdAt)] },
+  });
+
+  const fresh = session('psess-fresh', { createdAt: '2026-08-02T13:50:00.000Z' });
+  await mergeActiveIndex(cwd, {
+    sessions: { [fresh.id]: fresh },
+    events: { [fresh.id]: [promptEvent('evt-2', fresh.id, fresh.createdAt)] },
+  });
+
+  const index = readActiveIndex(cwd);
+  expect(index.sessions[other.id]).toEqual(other);
+  expect(index.sessions[fresh.id]).toEqual(fresh);
+  expect(index.events[other.id]).toHaveLength(1);
+});
+
+test('memory wins over disk on id collision', async () => {
+  const cwd = await mkCwd();
+  const original = session('psess-1', { goalText: 'Fresh title' });
+  await mergeActiveIndex(cwd, { sessions: { [original.id]: original }, events: {} });
+
+  const updated = { ...original, goalText: 'Updated title' };
+  await mergeActiveIndex(cwd, { sessions: { [updated.id]: updated }, events: {} });
+
+  const index = readActiveIndex(cwd);
+  expect(index.sessions[original.id].goalText).toBe('Updated title');
+});
+
+test('removedIds drops the row from the merged write and records a removal tombstone', async () => {
+  const cwd = await mkCwd();
+  const s = session('psess-1');
+  await mergeActiveIndex(cwd, { sessions: { [s.id]: s }, events: {} });
+
+  await mergeActiveIndex(cwd, { sessions: {}, events: {}, removedIds: [s.id] });
+
+  const index = readActiveIndex(cwd);
+  expect(index.sessions[s.id]).toBeUndefined();
+  expect(index.tombstones[s.id]).toBeTruthy();
+});
+
+// The resurrection hole this PRD closes: two simulated windows. Window A
+// completes (markCompleted) and persists the removal. Window B never
+// hydrated that removal — its in-memory snapshot still holds the Epic as
+// 'active' — and persists afterward. The tombstone must win: the Epic stays
+// gone, not resurrected.
+test('regression: a later merge whose memory still holds a removed Epic as active does not resurrect it', async () => {
+  const cwd = await mkCwd();
+  const s = session('psess-1', { status: 'active' });
+  await mergeActiveIndex(cwd, { sessions: { [s.id]: s }, events: { [s.id]: [promptEvent('e1', s.id, s.createdAt)] } });
+
+  // Window A: markCompleted removes it.
+  await mergeActiveIndex(cwd, { sessions: {}, events: {}, removedIds: [s.id] });
+  expect(readActiveIndex(cwd).sessions[s.id]).toBeUndefined();
+
+  // Window B: stale in-memory snapshot still has it as 'active', persists
+  // its own (unrelated) mutation — a resurrection-prone merge.
+  const windowBOther = session('psess-2', { status: 'proposed' });
+  await mergeActiveIndex(cwd, {
+    sessions: { [s.id]: s, [windowBOther.id]: windowBOther },
+    events: { [s.id]: [promptEvent('e1', s.id, s.createdAt)] },
+  });
+
+  const index = readActiveIndex(cwd);
+  expect(index.sessions[s.id]).toBeUndefined();
+  expect(index.events[s.id]).toBeUndefined();
+  expect(index.sessions[windowBOther.id]).toEqual(windowBOther);
+});
+
+test('event union: disk-only events are appended and re-sorted chain-aware; memory-only events kept', async () => {
+  const cwd = await mkCwd();
+  const s = session('psess-1');
+  const e1 = promptEvent('e1', s.id, '2026-08-02T13:00:00.000Z');
+  await mergeActiveIndex(cwd, { sessions: { [s.id]: s }, events: { [s.id]: [e1] } });
+
+  // A scheduler job appended a response event directly to disk between our
+  // two merge calls (simulated by mutating the file out of band).
+  const midIndex = readActiveIndex(cwd);
+  const schedulerEvent = { id: 'e2', promptSessionId: s.id, kind: 'response', causedByEventId: 'e1', at: '2026-08-02T13:05:00.000Z', text: 'done' };
+  midIndex.events[s.id] = [e1, schedulerEvent];
+  await config.writeJson(path.join(cwd, 'session-manager-operations', 'prompt-sessions', 'active-index.json'), midIndex, { writer: 'epics' });
+
+  // This caller's memory still only knows about e1 plus its own optimistic
+  // append e3 (not yet on disk).
+  const e3 = { id: 'e3', promptSessionId: s.id, kind: 'prd_created', causedByEventId: 'e2', at: '2026-08-02T13:10:00.000Z', prdSlug: 'x' };
+  await mergeActiveIndex(cwd, { sessions: { [s.id]: s }, events: { [s.id]: [e1, e3] } });
+
+  const finalEvents = readActiveIndex(cwd).events[s.id];
+  expect(finalEvents.map((e) => e.id)).toEqual(['e1', 'e2', 'e3']);
+});
+
+// Electron's structured-clone IPC transport (unlike JSON.parse) can produce
+// an own-enumerable "__proto__" key on a cloned object. A plain-object merge
+// target's bracket assignment with that key would re-link its own prototype
+// instead of storing a normal entry, silently dropping/corrupting the Epic
+// and potentially breaking every later Object.keys/JSON.stringify over it.
+test('a "__proto__"-keyed session id merges as an ordinary entry, not a prototype pollution', async () => {
+  const cwd = await mkCwd();
+  const polluted = session('__proto__', { goalText: 'polluted' });
+  // Computed key, not `{ __proto__: polluted }` — the latter is special-cased
+  // by object-literal syntax to set the prototype rather than create an own
+  // enumerable "__proto__" property, which wouldn't exercise this hazard.
+  await mergeActiveIndex(cwd, { sessions: { ['__proto__']: polluted }, events: {} });
+
+  const index = readActiveIndex(cwd);
+  expect(Object.prototype.hasOwnProperty.call(index.sessions, '__proto__')).toBe(true);
+  expect(index.sessions.__proto__).toEqual(polluted);
+  expect(Object.getPrototypeOf({})).toBe(Object.prototype);
+});
+
+test('falls back to writing memory state alone when the disk index is corrupt JSON', async () => {
+  const cwd = await mkCwd();
+  const filePath = path.join(cwd, 'session-manager-operations', 'prompt-sessions', 'active-index.json');
+  await fsp.mkdir(path.dirname(filePath), { recursive: true });
+  await fsp.writeFile(filePath, '{ not valid json', 'utf8');
+
+  const s = session('psess-1');
+  await mergeActiveIndex(cwd, { sessions: { [s.id]: s }, events: {} });
+
+  const index = readActiveIndex(cwd);
+  expect(index.sessions[s.id]).toEqual(s);
+});
+
+// TOCTOU: a mint interleaved with a merge call must survive, since both now
+// serialize through the same withPathLock (epicMint.cjs exports it; this
+// module requires it via the same module — Node's require cache means one
+// lock instance, not two independent maps that could still interleave).
+test('mint-during-persist: an ensureEpic mint interleaved with a merge call survives', async () => {
+  const cwd = await mkCwd();
+  const existing = session('psess-existing');
+  await mergeActiveIndex(cwd, { sessions: { [existing.id]: existing }, events: {} });
+
+  const [mintResult] = await Promise.all([
+    ensureEpic(cwd, { goalText: 'minted during a concurrent merge' }),
+    mergeActiveIndex(cwd, { sessions: { [existing.id]: existing }, events: {} }),
+  ]);
+
+  const index = readActiveIndex(cwd);
+  expect(index.sessions[mintResult.epicId]).toBeDefined();
+  expect(index.sessions[existing.id]).toBeDefined();
+});
+
+// The third writer: promptSessionEvents.cjs's appendResponseEventIfKnown
+// (the scheduler's narrow 'scheduler'-delegation append) used to hold its
+// OWN independent lock map — a merge call and a response-event append could
+// still race past each other's stale read. It now imports activeIndexPath/
+// withPathLock from epicMint.cjs (same module, same require-cache instance),
+// so a response-event append interleaved with a merge call must survive too.
+test('a scheduler response-event append interleaved with a merge call survives (third writer shares the same lock)', async () => {
+  const cwd = await mkCwd();
+  const s = session('psess-1', { status: 'active' });
+  await mergeActiveIndex(cwd, {
+    sessions: { [s.id]: s },
+    events: { [s.id]: [promptEvent('e1', s.id, s.createdAt)] },
+  });
+
+  const [, appended] = await Promise.all([
+    mergeActiveIndex(cwd, { sessions: { [s.id]: s }, events: { [s.id]: [promptEvent('e1', s.id, s.createdAt)] } }),
+    appendResponseEventIfKnown(cwd, s.id, 'PRD finished'),
+  ]);
+
+  expect(appended).toBe(true);
+  const index = readActiveIndex(cwd);
+  expect(index.sessions[s.id]).toBeDefined();
+  expect(index.events[s.id]).toHaveLength(2);
+  expect(index.events[s.id][1].kind).toBe('response');
+});

package/src/main/__tests__/epicMint.test.cjs

@@ -66,7 +66,7 @@ test('removeEpic deletes a minted Epic from both sessions and events maps', asyn
   const minted = await ensureEpic(cwd, { goalText: 'to be rolled back' });
   expect(readActiveIndex(cwd).sessions[minted.epicId]).toBeDefined();
 
-  const removed = removeEpic(cwd, minted.epicId);
+  const removed = await removeEpic(cwd, minted.epicId);
 
   expect(removed).toBe(true);
   const index = readActiveIndex(cwd);
@@ -78,7 +78,7 @@ test('removeEpic is a no-op (returns false) for an unknown epicId', async () =>
   const cwd = await mkCwd();
   await ensureEpic(cwd, { goalText: 'unrelated epic' });
 
-  const removed = removeEpic(cwd, 'nonexistent-epic-id');
+  const removed = await removeEpic(cwd, 'nonexistent-epic-id');
 
   expect(removed).toBe(false);
   expect(Object.keys(readActiveIndex(cwd).sessions)).toHaveLength(1);
@@ -105,7 +105,7 @@ for (const pollutedKey of ['__proto__', 'constructor', 'toString', 'hasOwnProper
 
 test('removeEpic refuses to report success for the prototype-chain key "__proto__"', async () => {
   const cwd = await mkCwd();
-  const removed = removeEpic(cwd, '__proto__');
+  const removed = await removeEpic(cwd, '__proto__');
   expect(removed).toBe(false);
 });
 
@@ -200,6 +200,116 @@ test('findJoinableEpic falls through to the similarity check when preferEpicId p
   expect(joined).toEqual({ epicId: sibling.epicId, matchedBy: 'similarity', score: expect.any(Number) });
 });
 
+test('ensureEpic mints with status "proposed" by default', async () => {
+  const cwd = await mkCwd();
+
+  const minted = await ensureEpic(cwd, { goalText: 'default status epic' });
+
+  const index = readActiveIndex(cwd);
+  expect(index.sessions[minted.epicId].status).toBe('proposed');
+});
+
+test('ensureEpic throws when a mint is requested with status "active" (born-proposed law), and appends an audit event', async () => {
+  const cwd = await mkCwd();
+  const auditLog = require('../lib/auditLog.cjs');
+
+  await expect(
+    ensureEpic(cwd, { goalText: 'should never mint active', status: 'active' }),
+  ).rejects.toThrow(/born 'proposed'/);
+
+  const index = readActiveIndex(cwd);
+  expect(Object.keys(index.sessions)).toHaveLength(0);
+
+  const records = fs.readFileSync(auditLog.AUDIT_LOG_PATH, 'utf8')
+    .split('\n')
+    .filter(Boolean)
+    .map((line) => JSON.parse(line))
+    .filter((r) => r.cwd === cwd);
+  expect(records).toHaveLength(1);
+  expect(records[0].kind).toBe('epic_mint_refused');
+  expect(records[0].status).toBe('active');
+});
+
+test('ensureEpic still joins an existing active Epic via preferEpicId even when status:"active" is requested', async () => {
+  const cwd = await mkCwd();
+  const first = await ensureEpic(cwd, { goalText: 'already running epic' });
+  const index = readActiveIndex(cwd);
+  index.sessions[first.epicId].status = 'active';
+  fs.writeFileSync(
+    path.join(cwd, 'session-manager-operations', 'prompt-sessions', 'active-index.json'),
+    JSON.stringify(index, null, 2),
+  );
+
+  const second = await ensureEpic(cwd, { goalText: 'unrelated text', epicId: first.epicId, status: 'active' });
+
+  expect(second.created).toBe(false);
+  expect(second.epicId).toBe(first.epicId);
+});
+
+test('ensureEpic falls through to a "proposed" mint when explicit epicId is archived/completed, never throwing', async () => {
+  const cwd = await mkCwd();
+  const first = await ensureEpic(cwd, { goalText: 'completed epic' });
+  const index = readActiveIndex(cwd);
+  index.sessions[first.epicId].status = 'completed';
+  fs.writeFileSync(
+    path.join(cwd, 'session-manager-operations', 'prompt-sessions', 'active-index.json'),
+    JSON.stringify(index, null, 2),
+  );
+
+  const second = await ensureEpic(cwd, { goalText: 'totally unrelated goal text here', epicId: first.epicId });
+
+  expect(second.created).toBe(true);
+  expect(second.epicId).not.toBe(first.epicId);
+  const after = readActiveIndex(cwd);
+  expect(after.sessions[second.epicId].status).toBe('proposed');
+});
+
+function readAuditRecordsForCwd(auditLog, cwd) {
+  if (!fs.existsSync(auditLog.AUDIT_LOG_PATH)) return [];
+  return fs.readFileSync(auditLog.AUDIT_LOG_PATH, 'utf8')
+    .split('\n')
+    .filter(Boolean)
+    .map((line) => {
+      try {
+        return JSON.parse(line);
+      } catch {
+        return null;
+      }
+    })
+    .filter((record) => record && record.cwd === cwd);
+}
+
+test('mintIfMissing:false refusal appends an epic_mint_refused audit event', async () => {
+  const cwd = await mkCwd();
+  const auditLog = require('../lib/auditLog.cjs');
+
+  await expect(ensureEpic(cwd, { goalText: 'no epic yet', mintIfMissing: false })).rejects.toThrow();
+
+  const records = readAuditRecordsForCwd(auditLog, cwd);
+  expect(records).toHaveLength(1);
+  expect(records[0].kind).toBe('epic_mint_refused');
+  expect(records[0].cwd).toBe(cwd);
+});
+
+test('not-open explicit-epicId fall-through appends an epic_mint_refused audit event', async () => {
+  const cwd = await mkCwd();
+  const first = await ensureEpic(cwd, { goalText: 'to be completed' });
+  const index = readActiveIndex(cwd);
+  index.sessions[first.epicId].status = 'completed';
+  fs.writeFileSync(
+    path.join(cwd, 'session-manager-operations', 'prompt-sessions', 'active-index.json'),
+    JSON.stringify(index, null, 2),
+  );
+  const auditLog = require('../lib/auditLog.cjs');
+
+  await ensureEpic(cwd, { goalText: 'unrelated fresh goal xyz', epicId: first.epicId });
+
+  const records = readAuditRecordsForCwd(auditLog, cwd);
+  const refusal = records.find((r) => r.kind === 'epic_mint_refused');
+  expect(refusal).toBeDefined();
+  expect(refusal.epicId).toBe(first.epicId);
+});
+
 test('ensureEpic with forceNewEpic:true mints even when a near-identical open Epic exists', async () => {
   const cwd = await mkCwd();
 

package/src/main/__tests__/prdCreate.test.cjs

@@ -532,6 +532,11 @@ test('resolveSourcePromptIdFromClaudeSession finds the Epic whose claudeSessionI
   }
 });
 
+// Real-homedir-rooted like the chat-only-epic test above (see its comment at
+// line ~449): validatePath's read boundary is home-dir-wide, and this
+// exercises createPrd's real config.addAllowedRoot/writeTextAtomic path. Safe
+// because the random suffix is never a registered project the live scheduler
+// scans for PRDs, and it's removed in `finally`.
 test('createPrd resolves sourcePromptId from originClaudeSessionId when the caller omitted sourcePromptId', async () => {
   const root = await fsp.mkdtemp(path.join(os.homedir(), '.sm-origin-session-epic-'));
   config.addAllowedRoot(root);
@@ -555,6 +560,7 @@ test('createPrd resolves sourcePromptId from originClaudeSessionId when the call
   }
 });
 
+// Same real-homedir rationale as the two tests above.
 test('createPrd leaves sourcePromptId unset when originClaudeSessionId matches no known Epic (plain SessionTab chat)', async () => {
   const root = await fsp.mkdtemp(path.join(os.homedir(), '.sm-origin-session-no-match-'));
   config.addAllowedRoot(root);

package/src/main/__tests__/prdMigration.test.cjs

@@ -105,6 +105,11 @@ test('migratePrds ignores non-.md and dotfiles, and no-ops on a missing legacy d
 
 test('migratePrds expands a tilde-prefixed cwd and moves the file', async () => {
   const legacyDir = await mkLegacyDir();
+  // Deliberately rooted under the REAL os.homedir() (not os.tmpdir()) — the
+  // assertion under test is tilde-expansion relative to the actual home dir,
+  // so a real homedir path is load-bearing here, not incidental. Still safe:
+  // the random suffix is never a registered project the live scheduler scans
+  // for PRDs, and it's removed in afterEach via tmpDirs/fsp.rm.
   const projectCwd = await fsp.mkdtemp(path.join(os.homedir(), '.sm-prdmigration-tilde-'));
   tmpDirs.push(projectCwd);
   const tildeCwd = path.join('~', path.relative(os.homedir(), projectCwd));

package/src/main/__tests__/scheduler-find-prd-dir.test.cjs

@@ -6,20 +6,53 @@
  * `<cwd>/session-manager-operations/scheduler/prds/`) must still resolve,
  * since findPrdDir's candidatePrdsDirs() searches the legacy dir first.
  *
- * Touches the real legacy PRDS_DIR (scheduler.cjs hard-codes it from
- * os.homedir(), same as other scheduler unit tests that exercise
- * global-path-backed exports) with a unique slug, and cleans up after itself.
+ * HOME-isolated (PRD 812 incident fix): scheduler.cjs derives PRDS_DIR from
+ * os.homedir() at module load. This test used to write straight into the
+ * REAL `~/.claude/session-manager/scheduled-plans/prds/` — the live
+ * scheduler's `reconcile()` scans that dir every 60s and enqueued the
+ * fixture as a phantom job (job 812-test-legacy-only-1975929-233060) before
+ * this test's own cleanup ran. Now HOME is stubbed to a mkdtemp dir BEFORE
+ * scheduler.cjs is first required, so PRDS_DIR resolves under the temp dir
+ * and nothing here can reach the real scheduler root. The
+ * `PRDS_DIR.startsWith(tmpHome)` guard is the regression test for that
+ * incident: if module-load ordering ever changes so the real homedir gets
+ * snapshotted first, this throws loudly instead of silently poisoning the
+ * live queue again.
  *
  * Run: timeout 120 npx vitest run src/main/__tests__/scheduler-find-prd-dir.test.cjs
  */
 
 'use strict';
 
-import { test, expect } from 'vitest';
+import { test, expect, beforeAll, afterAll } from 'vitest';
 const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
-const { findPrdDir, PRDS_DIR } = require('../scheduler.cjs');
+
+let tmpHome;
+let originalHome;
+let findPrdDir;
+let PRDS_DIR;
+
+beforeAll(() => {
+  originalHome = process.env.HOME;
+  tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-find-prd-dir-'));
+  process.env.HOME = tmpHome;
+
+  // Load AFTER HOME is stubbed — scheduler.cjs snapshots os.homedir() into
+  // PRDS_DIR at module load, not lazily.
+  ({ findPrdDir, PRDS_DIR } = require('../scheduler.cjs'));
+
+  // Hard guard: never let this test write into the real scheduler root.
+  if (!PRDS_DIR.startsWith(tmpHome)) {
+    throw new Error(`refusing to run: PRDS_DIR (${PRDS_DIR}) is not under the temp HOME (${tmpHome})`);
+  }
+});
+
+afterAll(() => {
+  process.env.HOME = originalHome;
+  fs.rmSync(tmpHome, { recursive: true, force: true });
+});
 
 test('findPrdDir resolves a slug that exists only in the legacy global PRDs dir', async () => {
   const slug = `812-test-legacy-only-${process.pid}-${Math.floor(Math.random() * 1e6)}`;

package/src/main/__tests__/scheduler-prd-missing-skip.test.cjs

@@ -0,0 +1,89 @@
+/**
+ * scheduler-prd-missing-skip.test.cjs — regression test for PRD 812's
+ * failure-classification fix: a queued job whose PRD source has disappeared
+ * between enqueue and dispatch (e.g. a test fixture that leaked into the
+ * live queue and was cleaned up before the job ran) must be retired as a
+ * stale row (exitCode: 0, skipped: 'prd-missing'), not treated as a hard
+ * job failure (exitCode: -1). A genuinely unreadable/unparseable PRD (a
+ * real, non-ENOENT error) must still fail with exitCode: -1.
+ *
+ * HOME-isolated per the same incident: stub HOME to a mkdtemp dir before
+ * requiring scheduler.cjs, and never write into the real scheduler root.
+ *
+ * Run: timeout 120 npx vitest run src/main/__tests__/scheduler-prd-missing-skip.test.cjs
+ */
+
+'use strict';
+
+import { test, expect, beforeAll, afterAll } from 'vitest';
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+let tmpHome;
+let originalHome;
+let executeJob;
+let PRDS_DIR;
+
+beforeAll(() => {
+  originalHome = process.env.HOME;
+  tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-prd-missing-skip-'));
+  process.env.HOME = tmpHome;
+
+  ({ executeJob, PRDS_DIR } = require('../scheduler.cjs'));
+
+  if (!PRDS_DIR.startsWith(tmpHome)) {
+    throw new Error(`refusing to run: PRDS_DIR (${PRDS_DIR}) is not under the temp HOME (${tmpHome})`);
+  }
+});
+
+afterAll(() => {
+  process.env.HOME = originalHome;
+  fs.rmSync(tmpHome, { recursive: true, force: true });
+});
+
+test('a job whose PRD source is gone everywhere is retired, not failed', async () => {
+  const projectCwd = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-prd-missing-project-'));
+  // config.cjs's writeJsonSync (used for the job's meta.json) restricts
+  // writes to WRITE_PREFIXES, which includes `<home>/.claude` — so runDir
+  // must live under the stubbed tmpHome's .claude/, not the system tmpdir.
+  fs.mkdirSync(path.join(tmpHome, '.claude'), { recursive: true });
+  const runDir = fs.mkdtempSync(path.join(tmpHome, '.claude', 'sm-prd-missing-run-'));
+  try {
+    const slug = `812-test-missing-${process.pid}-${Math.floor(Math.random() * 1e6)}`;
+    const job = { slug, cwd: projectCwd };
+
+    const result = await executeJob(job, runDir, projectCwd, () => {});
+
+    expect(result.exitCode).toBe(0);
+    expect(result.skipped).toBe('prd-missing');
+  } finally {
+    fs.rmSync(projectCwd, { recursive: true, force: true });
+    fs.rmSync(runDir, { recursive: true, force: true });
+  }
+});
+
+test('a job whose PRD source exists but is unreadable for a non-ENOENT reason still fails', async () => {
+  const projectCwd = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-prd-toobig-project-'));
+  fs.mkdirSync(path.join(tmpHome, '.claude'), { recursive: true });
+  const runDir = fs.mkdtempSync(path.join(tmpHome, '.claude', 'sm-prd-toobig-run-'));
+  try {
+    const slug = `812-test-toobig-${process.pid}-${Math.floor(Math.random() * 1e6)}`;
+    const prdsDir = path.join(projectCwd, 'session-manager-operations', 'scheduler', 'prds');
+    fs.mkdirSync(prdsDir, { recursive: true });
+    // parsePrd rejects any PRD over 1MB with a plain Error (no .code) — this
+    // is the "found but unparseable" case, distinct from ENOENT, and must
+    // stay a real failure.
+    const oversized = '---\ntitle: too big\n---\n\n' + 'x'.repeat(1024 * 1024 + 1);
+    fs.writeFileSync(path.join(prdsDir, `${slug}.md`), oversized, 'utf8');
+
+    const job = { slug, cwd: projectCwd };
+    const result = await executeJob(job, runDir, projectCwd, () => {});
+
+    expect(result.exitCode).toBe(-1);
+    expect(result.skipped).toBeUndefined();
+  } finally {
+    fs.rmSync(projectCwd, { recursive: true, force: true });
+    fs.rmSync(runDir, { recursive: true, force: true });
+  }
+});

package/src/main/__tests__/uniquePrdNumbers.test.cjs

@@ -6,6 +6,14 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 
+// HOME stubbed BEFORE requiring scheduler.cjs (PRD 812 fix): the last
+// describe block below calls scheduler.reconcile(), which internally calls
+// ensureDirs() → fs.mkdirSync on PRDS_DIR/RUNS_DIR — paths baked from
+// os.homedir() at require time. Without this stub that mkdirSync lands in
+// the real `~/.claude/session-manager/scheduled-plans/` tree.
+const tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-832-home-'));
+process.env.HOME = tmpHome;
+
 const prdParser = require('../scheduler/prdParser.cjs');
 const { pickForProject } = require('../lib/schedulerBatch.cjs');
 

package/src/main/index.cjs

@@ -28,8 +28,10 @@ const voiceWizard = require('./voiceWizard.cjs');
 const scheduler = require('./scheduler.cjs');
 const { createAdminHttp } = require('./lib/localAdminHttp.cjs');
 const prdCreate = require('./lib/prdCreate.cjs');
+const { appendAuditEvent } = require('./lib/auditLog.cjs');
 const chatRunner = require('./chatRunner.cjs');
 const promptSessionEvents = require('./promptSessionEvents.cjs');
+const activeIndexMerge = require('./lib/activeIndexMerge.cjs');
 const agentLibrary = require('./agentLibrary.cjs');
 const { resolveBuildTarget } = require('./lib/buildTarget.cjs');
 const adminHttp = createAdminHttp();
@@ -788,6 +790,7 @@ registerHistoryAggregatorHandlers();
 registerHistoryDashboardHandlers();
 pluginInstall.registerPluginInstallHandlers();
 memoryTool.registerMemoryHandlers();
+activeIndexMerge.registerActiveIndexMergeHandlers();
 registerMemoryAggregateIpc();
 registerProjectBriefIpc();
 registerProjectPagesIpc();
@@ -799,6 +802,12 @@ ipcMain.handle('promptSessionTranscript:read', validated(schemas.promptSessionTr
   const turns = await promptSessionTranscript.readTurns(cwd, epicId, { limit });
   return { turns };
 }));
+// Renderer Epic lifecycle trace (PRD 940) — append-only, no read/list IPC.
+// Kind allowlist enforced by schemas.auditLogAppend, not here.
+ipcMain.handle('auditLog:append', validated(schemas.auditLogAppend, async ({ kind, cwd, epicId, source }) => {
+  appendAuditEvent(kind, { cwd, epicId, source });
+  return { ok: true };
+}));
 agentMemory.registerAgentMemoryHandlers();
 git.register(ipcMain);
 filesIpc.registerFilesHandlers();