claude-code-session-manager 0.53.0 → 0.54.0

package/dist/index.html

@@ -7,10 +7,10 @@
     <link rel="preconnect" href="https://fonts.googleapis.com">
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
     <link href="https://fonts.googleapis.com/css2?family=Newsreader:ital,opsz,wght@0,6..72,400;0,6..72,500;0,6..72,600;0,6..72,700;1,6..72,400&family=Geist:wght@300;400;500;600;700&family=IBM+Plex+Mono:wght@400;500;600&display=swap" rel="stylesheet">
-    <script type="module" crossorigin src="./assets/index-D1v4VU6k.js"></script>
+    <script type="module" crossorigin src="./assets/index-BYOscSQK.js"></script>
     <link rel="modulepreload" crossorigin href="./assets/monaco-editor-BW5C4Iv1.js">
     <link rel="stylesheet" crossorigin href="./assets/monaco-editor-BTnBOi8r.css">
-    <link rel="stylesheet" crossorigin href="./assets/index-BoOiJJOr.css">
+    <link rel="stylesheet" crossorigin href="./assets/index-BEyUC3v9.css">
   </head>
   <body class="bg-bg text-fg font-sans antialiased">
     <div id="root"></div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-code-session-manager",
-  "version": "0.53.0",
+  "version": "0.54.0",
   "description": "Local cockpit for the Claude Code CLI — multi-tab terminal, full config surface, scheduler, voice dictation, and live observability.",
   "type": "module",
   "main": "src/main/index.cjs",

package/src/main/__tests__/activeIndexMerge.test.cjs

@@ -0,0 +1,235 @@
+/**
+ * activeIndexMerge.test.cjs — unit tests for the main-process read-merge-write
+ * of a cwd's prompt-sessions/active-index.json (lib/activeIndexMerge.cjs),
+ * moved here from the renderer (state/promptSessions.ts's old
+ * persistActiveIndex, commit 3d12e19) so the merge runs inside the same
+ * withPathLock instance epicMint.cjs's ensureEpic already serializes through.
+ *
+ * Covers the two holes a purely-renderer merge left open:
+ *  - resurrection: a tombstoned id must never be written back by a later
+ *    merge call whose memory contribution still thinks it's open.
+ *  - TOCTOU: a mint (ensureEpic) interleaved with a merge call must survive,
+ *    since both now go through the same lock.
+ *
+ * Run: timeout 300 npx vitest run src/main/__tests__/activeIndexMerge.test.cjs
+ */
+
+'use strict';
+
+import { test, expect, afterEach } from 'vitest';
+const fsp = require('node:fs/promises');
+const os = require('node:os');
+const path = require('node:path');
+const { mergeActiveIndex } = require('../lib/activeIndexMerge.cjs');
+const { ensureEpic, readActiveIndex } = require('../lib/epicMint.cjs');
+const { appendResponseEventIfKnown } = require('../promptSessionEvents.cjs');
+const config = require('../config.cjs');
+
+const tmpDirs = [];
+afterEach(async () => {
+  while (tmpDirs.length) {
+    const d = tmpDirs.pop();
+    await fsp.rm(d, { recursive: true, force: true });
+  }
+});
+
+async function mkCwd() {
+  const cwd = await fsp.mkdtemp(path.join(os.tmpdir(), 'sm-activeindexmerge-cwd-'));
+  // config.cjs's readJson/writeJson restrict to registered roots (home dir by
+  // default) — register this tmp dir so the merge's config.readJson/writeJson
+  // calls don't reject it as outside the allowed boundary.
+  config.addAllowedRoot(cwd);
+  tmpDirs.push(cwd);
+  return cwd;
+}
+
+function session(id, overrides = {}) {
+  return {
+    id,
+    cwd: overrides.cwd || '/proj',
+    goalText: overrides.goalText || `goal for ${id}`,
+    claudeSessionId: overrides.claudeSessionId || `claude-${id}`,
+    status: overrides.status || 'active',
+    createdAt: overrides.createdAt || '2026-08-02T13:48:00.000Z',
+    completedAt: overrides.completedAt ?? null,
+  };
+}
+
+function promptEvent(id, promptSessionId, at) {
+  return { id, promptSessionId, kind: 'prompt', causedByEventId: null, at, text: 'x' };
+}
+
+// Incident 2026-08-02: two Epics created by another (already-running) window
+// sat on disk. A second window booted empty and, on its first mutation,
+// persisted its own (empty-of-those-two) contribution straight over the file.
+// The main-side merge must still preserve every pre-existing on-disk Epic.
+test('a fresh caller contributing one Epic preserves pre-existing on-disk Epics untouched', async () => {
+  const cwd = await mkCwd();
+  const other = session('psess-other');
+  await mergeActiveIndex(cwd, {
+    sessions: { [other.id]: other },
+    events: { [other.id]: [promptEvent('evt-1', other.id, other.createdAt)] },
+  });
+
+  const fresh = session('psess-fresh', { createdAt: '2026-08-02T13:50:00.000Z' });
+  await mergeActiveIndex(cwd, {
+    sessions: { [fresh.id]: fresh },
+    events: { [fresh.id]: [promptEvent('evt-2', fresh.id, fresh.createdAt)] },
+  });
+
+  const index = readActiveIndex(cwd);
+  expect(index.sessions[other.id]).toEqual(other);
+  expect(index.sessions[fresh.id]).toEqual(fresh);
+  expect(index.events[other.id]).toHaveLength(1);
+});
+
+test('memory wins over disk on id collision', async () => {
+  const cwd = await mkCwd();
+  const original = session('psess-1', { goalText: 'Fresh title' });
+  await mergeActiveIndex(cwd, { sessions: { [original.id]: original }, events: {} });
+
+  const updated = { ...original, goalText: 'Updated title' };
+  await mergeActiveIndex(cwd, { sessions: { [updated.id]: updated }, events: {} });
+
+  const index = readActiveIndex(cwd);
+  expect(index.sessions[original.id].goalText).toBe('Updated title');
+});
+
+test('removedIds drops the row from the merged write and records a removal tombstone', async () => {
+  const cwd = await mkCwd();
+  const s = session('psess-1');
+  await mergeActiveIndex(cwd, { sessions: { [s.id]: s }, events: {} });
+
+  await mergeActiveIndex(cwd, { sessions: {}, events: {}, removedIds: [s.id] });
+
+  const index = readActiveIndex(cwd);
+  expect(index.sessions[s.id]).toBeUndefined();
+  expect(index.tombstones[s.id]).toBeTruthy();
+});
+
+// The resurrection hole this PRD closes: two simulated windows. Window A
+// completes (markCompleted) and persists the removal. Window B never
+// hydrated that removal — its in-memory snapshot still holds the Epic as
+// 'active' — and persists afterward. The tombstone must win: the Epic stays
+// gone, not resurrected.
+test('regression: a later merge whose memory still holds a removed Epic as active does not resurrect it', async () => {
+  const cwd = await mkCwd();
+  const s = session('psess-1', { status: 'active' });
+  await mergeActiveIndex(cwd, { sessions: { [s.id]: s }, events: { [s.id]: [promptEvent('e1', s.id, s.createdAt)] } });
+
+  // Window A: markCompleted removes it.
+  await mergeActiveIndex(cwd, { sessions: {}, events: {}, removedIds: [s.id] });
+  expect(readActiveIndex(cwd).sessions[s.id]).toBeUndefined();
+
+  // Window B: stale in-memory snapshot still has it as 'active', persists
+  // its own (unrelated) mutation — a resurrection-prone merge.
+  const windowBOther = session('psess-2', { status: 'proposed' });
+  await mergeActiveIndex(cwd, {
+    sessions: { [s.id]: s, [windowBOther.id]: windowBOther },
+    events: { [s.id]: [promptEvent('e1', s.id, s.createdAt)] },
+  });
+
+  const index = readActiveIndex(cwd);
+  expect(index.sessions[s.id]).toBeUndefined();
+  expect(index.events[s.id]).toBeUndefined();
+  expect(index.sessions[windowBOther.id]).toEqual(windowBOther);
+});
+
+test('event union: disk-only events are appended and re-sorted chain-aware; memory-only events kept', async () => {
+  const cwd = await mkCwd();
+  const s = session('psess-1');
+  const e1 = promptEvent('e1', s.id, '2026-08-02T13:00:00.000Z');
+  await mergeActiveIndex(cwd, { sessions: { [s.id]: s }, events: { [s.id]: [e1] } });
+
+  // A scheduler job appended a response event directly to disk between our
+  // two merge calls (simulated by mutating the file out of band).
+  const midIndex = readActiveIndex(cwd);
+  const schedulerEvent = { id: 'e2', promptSessionId: s.id, kind: 'response', causedByEventId: 'e1', at: '2026-08-02T13:05:00.000Z', text: 'done' };
+  midIndex.events[s.id] = [e1, schedulerEvent];
+  await config.writeJson(path.join(cwd, 'session-manager-operations', 'prompt-sessions', 'active-index.json'), midIndex, { writer: 'epics' });
+
+  // This caller's memory still only knows about e1 plus its own optimistic
+  // append e3 (not yet on disk).
+  const e3 = { id: 'e3', promptSessionId: s.id, kind: 'prd_created', causedByEventId: 'e2', at: '2026-08-02T13:10:00.000Z', prdSlug: 'x' };
+  await mergeActiveIndex(cwd, { sessions: { [s.id]: s }, events: { [s.id]: [e1, e3] } });
+
+  const finalEvents = readActiveIndex(cwd).events[s.id];
+  expect(finalEvents.map((e) => e.id)).toEqual(['e1', 'e2', 'e3']);
+});
+
+// Electron's structured-clone IPC transport (unlike JSON.parse) can produce
+// an own-enumerable "__proto__" key on a cloned object. A plain-object merge
+// target's bracket assignment with that key would re-link its own prototype
+// instead of storing a normal entry, silently dropping/corrupting the Epic
+// and potentially breaking every later Object.keys/JSON.stringify over it.
+test('a "__proto__"-keyed session id merges as an ordinary entry, not a prototype pollution', async () => {
+  const cwd = await mkCwd();
+  const polluted = session('__proto__', { goalText: 'polluted' });
+  // Computed key, not `{ __proto__: polluted }` — the latter is special-cased
+  // by object-literal syntax to set the prototype rather than create an own
+  // enumerable "__proto__" property, which wouldn't exercise this hazard.
+  await mergeActiveIndex(cwd, { sessions: { ['__proto__']: polluted }, events: {} });
+
+  const index = readActiveIndex(cwd);
+  expect(Object.prototype.hasOwnProperty.call(index.sessions, '__proto__')).toBe(true);
+  expect(index.sessions.__proto__).toEqual(polluted);
+  expect(Object.getPrototypeOf({})).toBe(Object.prototype);
+});
+
+test('falls back to writing memory state alone when the disk index is corrupt JSON', async () => {
+  const cwd = await mkCwd();
+  const filePath = path.join(cwd, 'session-manager-operations', 'prompt-sessions', 'active-index.json');
+  await fsp.mkdir(path.dirname(filePath), { recursive: true });
+  await fsp.writeFile(filePath, '{ not valid json', 'utf8');
+
+  const s = session('psess-1');
+  await mergeActiveIndex(cwd, { sessions: { [s.id]: s }, events: {} });
+
+  const index = readActiveIndex(cwd);
+  expect(index.sessions[s.id]).toEqual(s);
+});
+
+// TOCTOU: a mint interleaved with a merge call must survive, since both now
+// serialize through the same withPathLock (epicMint.cjs exports it; this
+// module requires it via the same module — Node's require cache means one
+// lock instance, not two independent maps that could still interleave).
+test('mint-during-persist: an ensureEpic mint interleaved with a merge call survives', async () => {
+  const cwd = await mkCwd();
+  const existing = session('psess-existing');
+  await mergeActiveIndex(cwd, { sessions: { [existing.id]: existing }, events: {} });
+
+  const [mintResult] = await Promise.all([
+    ensureEpic(cwd, { goalText: 'minted during a concurrent merge' }),
+    mergeActiveIndex(cwd, { sessions: { [existing.id]: existing }, events: {} }),
+  ]);
+
+  const index = readActiveIndex(cwd);
+  expect(index.sessions[mintResult.epicId]).toBeDefined();
+  expect(index.sessions[existing.id]).toBeDefined();
+});
+
+// The third writer: promptSessionEvents.cjs's appendResponseEventIfKnown
+// (the scheduler's narrow 'scheduler'-delegation append) used to hold its
+// OWN independent lock map — a merge call and a response-event append could
+// still race past each other's stale read. It now imports activeIndexPath/
+// withPathLock from epicMint.cjs (same module, same require-cache instance),
+// so a response-event append interleaved with a merge call must survive too.
+test('a scheduler response-event append interleaved with a merge call survives (third writer shares the same lock)', async () => {
+  const cwd = await mkCwd();
+  const s = session('psess-1', { status: 'active' });
+  await mergeActiveIndex(cwd, {
+    sessions: { [s.id]: s },
+    events: { [s.id]: [promptEvent('e1', s.id, s.createdAt)] },
+  });
+
+  const [, appended] = await Promise.all([
+    mergeActiveIndex(cwd, { sessions: { [s.id]: s }, events: { [s.id]: [promptEvent('e1', s.id, s.createdAt)] } }),
+    appendResponseEventIfKnown(cwd, s.id, 'PRD finished'),
+  ]);
+
+  expect(appended).toBe(true);
+  const index = readActiveIndex(cwd);
+  expect(index.sessions[s.id]).toBeDefined();
+  expect(index.events[s.id]).toHaveLength(2);
+  expect(index.events[s.id][1].kind).toBe('response');
+});

package/src/main/__tests__/epicMint.test.cjs

@@ -66,7 +66,7 @@ test('removeEpic deletes a minted Epic from both sessions and events maps', asyn
   const minted = await ensureEpic(cwd, { goalText: 'to be rolled back' });
   expect(readActiveIndex(cwd).sessions[minted.epicId]).toBeDefined();
 
-  const removed = removeEpic(cwd, minted.epicId);
+  const removed = await removeEpic(cwd, minted.epicId);
 
   expect(removed).toBe(true);
   const index = readActiveIndex(cwd);
@@ -78,7 +78,7 @@ test('removeEpic is a no-op (returns false) for an unknown epicId', async () =>
   const cwd = await mkCwd();
   await ensureEpic(cwd, { goalText: 'unrelated epic' });
 
-  const removed = removeEpic(cwd, 'nonexistent-epic-id');
+  const removed = await removeEpic(cwd, 'nonexistent-epic-id');
 
   expect(removed).toBe(false);
   expect(Object.keys(readActiveIndex(cwd).sessions)).toHaveLength(1);
@@ -105,7 +105,7 @@ for (const pollutedKey of ['__proto__', 'constructor', 'toString', 'hasOwnProper
 
 test('removeEpic refuses to report success for the prototype-chain key "__proto__"', async () => {
   const cwd = await mkCwd();
-  const removed = removeEpic(cwd, '__proto__');
+  const removed = await removeEpic(cwd, '__proto__');
   expect(removed).toBe(false);
 });
 

package/src/main/index.cjs

@@ -31,6 +31,7 @@ const prdCreate = require('./lib/prdCreate.cjs');
 const { appendAuditEvent } = require('./lib/auditLog.cjs');
 const chatRunner = require('./chatRunner.cjs');
 const promptSessionEvents = require('./promptSessionEvents.cjs');
+const activeIndexMerge = require('./lib/activeIndexMerge.cjs');
 const agentLibrary = require('./agentLibrary.cjs');
 const { resolveBuildTarget } = require('./lib/buildTarget.cjs');
 const adminHttp = createAdminHttp();
@@ -789,6 +790,7 @@ registerHistoryAggregatorHandlers();
 registerHistoryDashboardHandlers();
 pluginInstall.registerPluginInstallHandlers();
 memoryTool.registerMemoryHandlers();
+activeIndexMerge.registerActiveIndexMergeHandlers();
 registerMemoryAggregateIpc();
 registerProjectBriefIpc();
 registerProjectPagesIpc();

package/src/main/ipcSchemas.cjs

@@ -214,6 +214,39 @@ const configWatch = z.array(z.string().min(1).max(4096));
 
 const configParseImports = z.object({ path: z.string().min(1).max(4096) });
 
+// ──────────────────────────────────────────── PromptSessions (Epics) active-index merge
+// lib/activeIndexMerge.cjs's read-merge-write, invoked over IPC by the
+// renderer's persistActiveIndex (state/promptSessions.ts) instead of that
+// module doing its own config:read-json/config:write-json round trip. Payload
+// carries only the CALLING renderer's in-memory contribution for this cwd —
+// disk is main's truth, merged inside the same withPathLock epicMint.cjs uses.
+//
+// Epic ids are keys here (Electron's structured-clone IPC transport, unlike
+// JSON.parse, can produce an own-enumerable "__proto__" key on a cloned
+// object) — the regex excludes the prototype-pollution trio so a malformed/
+// hostile payload fails validation before it ever reaches activeIndexMerge.cjs
+// (which additionally uses null-prototype merge targets as defense in depth).
+// Real epic ids are `${slugify(goalText)}-${uuid8}` (epicMint.cjs) — max 64
+// mirrors slugify's 48-char cap plus the "-" + 8 hex chars suffix, rounded up.
+const PROMPT_SESSION_ID_RE = /^(?!__proto__$|constructor$|prototype$)[A-Za-z0-9_-]{1,64}$/;
+const promptSessionsMergeActiveIndex = z.object({
+  cwd: z.string().min(1).max(4096),
+  sessions: z.record(z.string().regex(PROMPT_SESSION_ID_RE), z.unknown()).refine(
+    (v) => Object.keys(v).length <= 2000,
+    { message: 'too many sessions in one merge payload' },
+  ),
+  events: z.record(z.string().regex(PROMPT_SESSION_ID_RE), z.array(z.unknown()).max(5000)).refine(
+    (v) => Object.keys(v).length <= 2000,
+    { message: 'too many event chains in one merge payload' },
+  ),
+  removedIds: z.array(z.string().regex(PROMPT_SESSION_ID_RE)).max(500).optional(),
+  // Always the literal 'epics' on the wire — the handler ignores this value
+  // and hardcodes the writer id itself (single-writer law,
+  // lib/opsOwnership.cjs); requiring the literal here just means a
+  // forged/malformed payload fails validation before it reaches the merge.
+  source: z.literal('epics'),
+});
+
 // ──────────────────────────────────────────── Sessions
 const sessionsPayload = z.object({
   tabs: z.array(z.object({
@@ -908,6 +941,7 @@ module.exports = {
     projectBriefUpdate,
     promptSessionTranscriptAppend,
     promptSessionTranscriptRead,
+    promptSessionsMergeActiveIndex,
     auditLogAppend,
     agentMemoryList,
     agentMemoryGet,

package/src/main/lib/activeIndexMerge.cjs

@@ -0,0 +1,168 @@
+'use strict';
+
+/**
+ * activeIndexMerge.cjs — main-process read-merge-write for a cwd's
+ * prompt-sessions/active-index.json, invoked over IPC by the renderer's
+ * persistActiveIndex (state/promptSessions.ts). Moved here from the renderer
+ * (which used to read-merge-write itself over config:read-json/
+ * config:write-json, commit 3d12e19) to close two holes a purely-renderer
+ * merge can't:
+ *
+ *  1. Resurrection: a second window that still holds an archived/deleted
+ *     Epic as 'active'/'proposed' in its stale in-memory snapshot would
+ *     write that row right back on its next persist — "memory wins on id
+ *     collision" doesn't know the row was deliberately removed elsewhere.
+ *     Fixed with a removal tombstone (index.tombstones, id -> removedAt
+ *     ISO): an id present there is dropped from every future merge's memory
+ *     contribution, not just from the write that performed the removal.
+ *  2. TOCTOU: a renderer's own read (config:read-json) and write
+ *     (config:write-json), round-tripped over IPC with no lock in between,
+ *     left a gap where a main-process mint (epicMint.cjs's ensureEpic,
+ *     itself serialized through its own withPathLock) could land and then
+ *     be silently dropped by the renderer's subsequent write. Running the
+ *     merge inside the SAME withPathLock instance epicMint.cjs already
+ *     serializes ensureEpic/appendPrdCreatedEvent through closes the gap:
+ *     every read-modify-write of this file, from either caller, is now one
+ *     lock (epicMint.cjs exports withPathLock; requiring it here shares the
+ *     same module-level Map via Node's require cache, not a second one).
+ *
+ * Tombstones are never auto-cleared: resumeArchived() (state/promptSessions.ts)
+ * always mints a BRAND NEW Epic id + claudeSessionId — it never reuses the
+ * archived id — so a tombstoned id is never legitimately reborn under the
+ * current domain model. If that ever changes, this module would need an
+ * explicit "un-tombstone" path; today one would be dead code.
+ */
+
+const { activeIndexPath, withPathLock } = require('./epicMint.cjs');
+const config = require('../config.cjs');
+
+function hasOwn(obj, key) {
+  return Object.prototype.hasOwnProperty.call(obj, key);
+}
+
+// Mirrors state/promptSessions.ts's compareEventsChainAware exactly. Kept as
+// a separate copy (not a shared module) since one side runs in the renderer
+// and the other in Node — small and stable enough that duplicating it here
+// is cheaper than wiring a cross-boundary shared module for one function.
+function compareEventsChainAware(a, b) {
+  const ta = Date.parse(a.at);
+  const tb = Date.parse(b.at);
+  const aValid = !Number.isNaN(ta);
+  const bValid = !Number.isNaN(tb);
+  if (aValid && bValid && ta !== tb) return ta - tb;
+  if (b.causedByEventId === a.id) return -1;
+  if (a.causedByEventId === b.id) return 1;
+  if (aValid && bValid) return 0;
+  if (aValid) return -1;
+  if (bValid) return 1;
+  return 0;
+}
+
+/**
+ * mergeActiveIndex(cwd, { sessions, events, removedIds }) → Promise<{ sessions, events }>
+ *
+ * `sessions`/`events` are the CALLING renderer's own in-memory contribution
+ * for this cwd only (already filtered to 'active'/'proposed' sessions by
+ * persistActiveIndex) — never a full merged file; disk remains the source of
+ * truth this function reads and reconciles against. Returns the merged
+ * { sessions, events } actually written.
+ */
+async function mergeActiveIndex(cwd, { sessions: rawMemorySessions = {}, events: rawMemoryEvents = {}, removedIds = [] } = {}) {
+  if (!cwd || typeof cwd !== 'string') throw new Error('mergeActiveIndex: cwd is required');
+  const filePath = activeIndexPath(cwd);
+  // Null-prototype copies of the CALLER'S OWN payload too: an Epic id equal
+  // to "__proto__" is a plain string key from the caller's perspective, but
+  // `rawMemoryEvents[id]` on a plain object literal resolves through the
+  // prototype chain to Object.prototype itself (not undefined) rather than
+  // hitting the `?? []` fallback below — same hazard as the disk-side merge
+  // targets, just on the read side instead of the write side.
+  const memorySessions = Object.assign(Object.create(null), rawMemorySessions);
+  const memoryEvents = Object.assign(Object.create(null), rawMemoryEvents);
+  return withPathLock(filePath, async () => {
+    // Null-prototype targets: `sessions`/`events` are keyed by Epic id, which
+    // for an IPC payload delivered via Electron's structured-clone (not
+    // JSON.parse) could legitimately carry an own-enumerable "__proto__" key.
+    // A plain-object target's bracket assignment (`obj[id] = x`) with
+    // id === "__proto__" invokes Object.prototype's accessor and re-links the
+    // object's own prototype instead of storing a normal entry — the same
+    // hazard epicMint.cjs's hasOwn() helper guards reads against (see its
+    // comment ~epicMint.cjs:61). A null-prototype target has no such accessor,
+    // so "__proto__"/"constructor"/etc. behave as ordinary keys.
+    let diskSessions = Object.create(null);
+    let diskEvents = Object.create(null);
+    let tombstones = Object.create(null);
+    const result = await config.readJson(filePath);
+    if (result.exists && result.data) {
+      const disk = result.data;
+      if (disk.sessions && typeof disk.sessions === 'object') Object.assign(diskSessions, disk.sessions);
+      if (disk.events && typeof disk.events === 'object') Object.assign(diskEvents, disk.events);
+      if (disk.tombstones && typeof disk.tombstones === 'object') Object.assign(tombstones, disk.tombstones);
+    } else if (result.error || result.parseError) {
+      // Genuine unreadable/corrupt disk index (fs error, or valid file that
+      // failed JSON.parse) rather than "file legitimately doesn't exist yet".
+      // config.readJson never throws (it reports failure via exists/error/
+      // parseError, not exceptions), so this branch — not a try/catch — is
+      // the only way to detect it. Falling back to this caller's own memory
+      // contribution is still the best-effort choice (matches the old
+      // renderer merge's contract), but silently doing so would recreate the
+      // exact "unlogged data loss" incident this module exists to close —
+      // any on-disk tombstones/other-window sessions get dropped, so log it.
+      console.warn(
+        `[activeIndexMerge] disk index unreadable for ${filePath} (error=${result.error ?? 'none'}, `
+        + `parseError=${result.parseError ?? 'none'}) — falling back to this caller's in-memory contribution alone`,
+      );
+    }
+
+    const now = new Date().toISOString();
+    for (const id of removedIds) tombstones[id] = now;
+
+    const mergedSessions = Object.assign(Object.create(null), diskSessions);
+    for (const [id, session] of Object.entries(memorySessions)) {
+      // Resurrection guard: a caller whose in-memory snapshot still thinks a
+      // tombstoned id is open (it hasn't hydrated the removal yet) must not
+      // write it back into the merged file.
+      if (hasOwn(tombstones, id)) continue;
+      mergedSessions[id] = session;
+    }
+    for (const id of removedIds) delete mergedSessions[id];
+
+    // Events are a per-id UNION (same contract the renderer's own merge used
+    // — PRD 855): a scheduler job appends events to disk under its narrow
+    // delegation, so memory-wins-wholesale would silently drop any event
+    // that landed since this caller's last hydrate. Memory order wins for
+    // events both sides know; disk-only events are appended and re-sorted
+    // chain-aware.
+    const mergedEvents = Object.create(null);
+    for (const id of Object.keys(mergedSessions)) {
+      const memEvts = memoryEvents[id] ?? [];
+      const diskEvts = diskEvents[id] ?? [];
+      if (memEvts.length === 0) {
+        mergedEvents[id] = diskEvts;
+        continue;
+      }
+      const memIds = new Set(memEvts.map((e) => e.id));
+      const missing = diskEvts.filter((e) => !memIds.has(e.id));
+      mergedEvents[id] = missing.length > 0 ? [...memEvts, ...missing].sort(compareEventsChainAware) : memEvts;
+    }
+
+    const index = { sessions: mergedSessions, events: mergedEvents, tombstones };
+    // Single-writer law: prompt-sessions/ is owned by 'epics'
+    // (lib/opsOwnership.cjs) — hardcoded here, never taken from the IPC
+    // payload, so a compromised/forged renderer call can't claim a
+    // different writer id.
+    await config.writeJson(filePath, index, { writer: 'epics' });
+    return { sessions: mergedSessions, events: mergedEvents };
+  });
+}
+
+function registerActiveIndexMergeHandlers() {
+  const { ipcMain } = require('electron');
+  const { schemas: s, validated: v } = require('../ipcSchemas.cjs');
+  ipcMain.handle(
+    'promptSessions:merge-active-index',
+    v(s.promptSessionsMergeActiveIndex, ({ cwd, sessions, events, removedIds }) =>
+      mergeActiveIndex(cwd, { sessions, events, removedIds: removedIds || [] })),
+  );
+}
+
+module.exports = { mergeActiveIndex, registerActiveIndexMergeHandlers };

package/src/main/lib/epicMint.cjs

@@ -34,9 +34,16 @@ function readActiveIndex(cwd) {
     return {
       sessions: parsed && typeof parsed.sessions === 'object' && parsed.sessions ? parsed.sessions : {},
       events: parsed && typeof parsed.events === 'object' && parsed.events ? parsed.events : {},
+      // Passed through untouched — this module never consults tombstones (it
+      // doesn't resurrect completed/deleted Epics on its own), but every
+      // caller here does read-modify-write on the object this returns, so
+      // dropping the field would silently erase the removal tombstones
+      // lib/activeIndexMerge.cjs's mergeActiveIndex records the next time any
+      // of ensureEpic/appendPrdCreatedEvent/removeEpic writes this file.
+      tombstones: parsed && typeof parsed.tombstones === 'object' && parsed.tombstones ? parsed.tombstones : {},
     };
   } catch {
-    return { sessions: {}, events: {} };
+    return { sessions: {}, events: {}, tombstones: {} };
   }
 }
 
@@ -374,12 +381,28 @@ function appendPrdCreatedEvent(cwd, epicId, prdSlug, text) {
  */
 function removeEpic(cwd, epicId) {
   if (!cwd || !epicId) return false;
-  const index = readActiveIndex(cwd);
-  if (!hasOwn(index.sessions, epicId)) return false;
-  delete index.sessions[epicId];
-  delete index.events[epicId];
-  writeActiveIndex(cwd, index);
-  return true;
+  return withPathLock(activeIndexPath(cwd), () => {
+    const index = readActiveIndex(cwd);
+    if (!hasOwn(index.sessions, epicId)) return false;
+    delete index.sessions[epicId];
+    delete index.events[epicId];
+    writeActiveIndex(cwd, index);
+    return true;
+  });
 }
 
-module.exports = { ensureEpic, appendPrdCreatedEvent, removeEpic, activeIndexPath, readActiveIndex, findJoinableEpic, tokenize };
+module.exports = {
+  ensureEpic,
+  appendPrdCreatedEvent,
+  removeEpic,
+  activeIndexPath,
+  readActiveIndex,
+  findJoinableEpic,
+  tokenize,
+  // Exported so lib/activeIndexMerge.cjs's renderer-facing merge IPC handler
+  // serializes through the SAME lock instance as ensureEpic/
+  // appendPrdCreatedEvent (module-level Map, shared via Node's require
+  // cache) — one lock per active-index.json path across both callers, not
+  // two independent lock maps that could still interleave.
+  withPathLock,
+};

package/src/main/promptSessionEvents.cjs

@@ -13,10 +13,13 @@
  */
 
 const config = require('./config.cjs');
-
-function promptSessionActiveIndexPath(cwd) {
-  return `${String(cwd).replace(/\/+$/, '')}/session-manager-operations/prompt-sessions/active-index.json`;
-}
+// activeIndexPath/withPathLock come from epicMint.cjs so this module's
+// read-modify-write of active-index.json (appendResponseEventIfKnown, below)
+// serializes through the EXACT SAME lock instance as ensureEpic/
+// appendPrdCreatedEvent and lib/activeIndexMerge.cjs's mergeActiveIndex — one
+// lock across all three writers of this file, not three independent maps
+// that could still interleave a stale read-modify-write past each other.
+const { activeIndexPath: promptSessionActiveIndexPath, withPathLock } = require('./lib/epicMint.cjs');
 
 // IPC channel broadcast whenever an event is appended to a PromptSession's
 // chain from the main process (currently only the scheduler's response-event
@@ -40,26 +43,6 @@ function mintEventId() {
   return `pevt-${Date.now().toString(36)}-${seq}`;
 }
 
-// Serializes read-modify-write cycles per active-index.json path so two
-// PRDs finishing back-to-back for sessions in the same cwd chain onto the
-// tail in issue order instead of racing two independent read-then-write
-// round trips (mirrors promptSessions.ts's own pendingWritesByPath).
-const pendingWritesByPath = new Map();
-
-function withPathLock(path, task) {
-  const prior = pendingWritesByPath.get(path) || Promise.resolve();
-  const settle = () => task();
-  const run = prior.then(settle, settle);
-  pendingWritesByPath.set(
-    path,
-    run.then(
-      () => undefined,
-      () => undefined,
-    ),
-  );
-  return run;
-}
-
 /**
  * If `sourcePromptId` resolves to a known, still-active PromptSession under
  * `cwd`'s active-index.json, appends a 'response' event chained to that

package/src/preload/api.d.ts

@@ -1653,9 +1653,28 @@ export interface SessionManagerAPI {
      *  from notifyOriginatingTab) — lets an already-hydrated Epic pick it up
      *  live instead of waiting for a restart. */
     onEventAppended: (handler: (e: PromptSessionEventAppendedPayload) => void) => () => void;
+    /** Main-side read-merge-write of a cwd's active-index.json
+     *  (lib/activeIndexMerge.cjs) — persistActiveIndex sends only its own
+     *  in-memory contribution for the cwd; disk stays main's truth, merged
+     *  inside the same lock epicMint.cjs's ensureEpic serializes through. */
+    mergeActiveIndex: (payload: PromptSessionsMergeActiveIndexPayload) => Promise<PromptSessionsMergeActiveIndexResult>;
   };
 }
 
+// ─────────────────────────────────── PromptSessions active-index merge
+export interface PromptSessionsMergeActiveIndexPayload {
+  cwd: string;
+  sessions: Record<string, unknown>;
+  events: Record<string, unknown[]>;
+  removedIds?: string[];
+  source: 'epics';
+}
+
+export interface PromptSessionsMergeActiveIndexResult {
+  sessions: Record<string, unknown>;
+  events: Record<string, unknown[]>;
+}
+
 // ─────────────────────────────────── PromptSession event-appended broadcast
 
 export interface PromptSessionEventAppendedPayload {

package/src/preload/index.cjs

@@ -471,5 +471,10 @@ contextBridge.exposeInMainWorld('api', {
       ipcRenderer.on('promptSession:event-appended', listener);
       return () => ipcRenderer.removeListener('promptSession:event-appended', listener);
     },
+    /** Main-side read-merge-write of a cwd's active-index.json
+     *  (lib/activeIndexMerge.cjs) — replaces persistActiveIndex's old
+     *  renderer-side read-merge-write. Payload carries only this renderer's
+     *  own in-memory contribution for the cwd; disk stays main's truth. */
+    mergeActiveIndex: (payload) => ipcRenderer.invoke('promptSessions:merge-active-index', payload),
   },
 });