claude-code-session-manager 0.57.0 → 0.58.0

package/src/main/__tests__/scheduler-epic-digest.test.cjs

@@ -0,0 +1,214 @@
+/**
+ * scheduler-epic-digest.test.cjs — PRD 958: prepend the Epic context digest
+ * (PRD 950's epicContextDigest.cjs) to a job's prompt when job.epicId
+ * resolves to a known Epic (same resolution resolveOriginSessionId already
+ * performs). Additive only: the PRD's own body + FINISH_PROTOCOL must remain
+ * byte-for-byte unchanged, and a digest build failure must never block
+ * dispatch.
+ *
+ * Drives the REAL spawn path via SM_CLAUDE_BIN pointing at a stub process
+ * that captures the '-p' prompt argv to a file, so the assertions inspect
+ * exactly what would have been sent to `claude -p`.
+ *
+ * Run: timeout 300 npx vitest run src/main/__tests__/scheduler-epic-digest.test.cjs
+ */
+
+'use strict';
+
+import { test, expect, beforeAll, afterAll, afterEach } from 'vitest';
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+let tmpHome;
+let originalHome;
+let originalClaudeBin;
+let executeJob;
+let FINISH_PROTOCOL;
+let buildContextDigest;
+
+beforeAll(() => {
+  originalHome = process.env.HOME;
+  originalClaudeBin = process.env.SM_CLAUDE_BIN;
+  tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-epic-digest-'));
+  process.env.HOME = tmpHome;
+
+  ({ executeJob, FINISH_PROTOCOL } = require('../scheduler.cjs'));
+  ({ buildContextDigest } = require('../lib/epicContextDigest.cjs'));
+});
+
+afterAll(() => {
+  process.env.HOME = originalHome;
+  if (originalClaudeBin === undefined) delete process.env.SM_CLAUDE_BIN;
+  else process.env.SM_CLAUDE_BIN = originalClaudeBin;
+  fs.rmSync(tmpHome, { recursive: true, force: true });
+});
+
+afterEach(() => {
+  delete process.env.SM_CLAUDE_BIN;
+});
+
+// Stub `claude` binary: captures the '-p' prompt argv to `capturePath`, then
+// emits one stream-json result line and exits 0.
+function writeClaudeStub(capturePath) {
+  const stubPath = path.join(os.tmpdir(), `sm-claude-stub-${process.pid}-${Math.floor(Math.random() * 1e9)}.cjs`);
+  const body = `
+    const fs = require('fs');
+    const idx = process.argv.indexOf('-p');
+    const prompt = idx >= 0 ? process.argv[idx + 1] : '';
+    fs.writeFileSync(${JSON.stringify(capturePath)}, prompt, 'utf8');
+    process.stdout.write(JSON.stringify({ type: 'result', subtype: 'success', result: 'ok' }) + '\\n');
+    process.exit(0);
+  `;
+  fs.writeFileSync(stubPath, `#!${process.execPath}\n${body}\n`, { mode: 0o755 });
+  return stubPath;
+}
+
+function setupProject(prefix) {
+  const projectCwd = fs.mkdtempSync(path.join(os.tmpdir(), `${prefix}-project-`));
+  fs.mkdirSync(path.join(tmpHome, '.claude'), { recursive: true });
+  const runDir = fs.mkdtempSync(path.join(tmpHome, '.claude', `${prefix}-run-`));
+  return { projectCwd, runDir };
+}
+
+function writeLegacyPrd(projectCwd, slug, bodyText) {
+  const prdsDir = path.join(projectCwd, 'session-manager-operations', 'scheduler', 'prds');
+  fs.mkdirSync(prdsDir, { recursive: true });
+  fs.writeFileSync(path.join(prdsDir, `${slug}.md`), bodyText, 'utf8');
+  return path.join(prdsDir, `${slug}.md`);
+}
+
+function writeActiveIndex(projectCwd, sessions) {
+  const idxPath = path.join(projectCwd, 'session-manager-operations', 'prompt-sessions', 'active-index.json');
+  fs.mkdirSync(path.dirname(idxPath), { recursive: true });
+  fs.writeFileSync(idxPath, JSON.stringify({ sessions, events: {} }, null, 2), 'utf8');
+}
+
+test('prepends the Epic context digest when job.epicId resolves to a known Epic', async () => {
+  const { projectCwd, runDir } = setupProject('sm-epic-digest-hit');
+  try {
+    const epicId = 'epic-hit-1';
+    writeActiveIndex(projectCwd, {
+      [epicId]: { claudeSessionId: 'sess-abc-123', goalText: 'Ship the digest feature.' },
+    });
+
+    const slug = `958-test-hit-${process.pid}-${Math.floor(Math.random() * 1e6)}`;
+    const bodyText = 'Do the thing described in this PRD body.';
+    writeLegacyPrd(projectCwd, slug, bodyText);
+
+    const capturePath = path.join(runDir, 'captured-prompt.txt');
+    process.env.SM_CLAUDE_BIN = writeClaudeStub(capturePath);
+
+    const job = { slug, cwd: projectCwd, epicId };
+    const result = await executeJob(job, runDir, projectCwd, () => Promise.resolve());
+
+    expect(result.exitCode).toBe(0);
+    const capturedPrompt = fs.readFileSync(capturePath, 'utf8');
+
+    const digestText = await buildContextDigest({ cwd: projectCwd, epicId });
+    expect(digestText.length).toBeGreaterThan(0);
+    expect(capturedPrompt.startsWith(digestText)).toBe(true);
+    expect(capturedPrompt.endsWith(bodyText + FINISH_PROTOCOL)).toBe(true);
+
+    // The PRD source on disk must never be rewritten with the digest merged in.
+    const onDiskPrd = fs.readFileSync(path.join(projectCwd, 'session-manager-operations', 'scheduler', 'prds', `${slug}.md`), 'utf8');
+    expect(onDiskPrd).toBe(bodyText);
+
+    const metaPath = path.join(runDir, `${slug}.meta.json`);
+    const meta = JSON.parse(fs.readFileSync(metaPath, 'utf8'));
+    expect(meta.contextDigestApplied).toBe(true);
+    expect(meta.originSessionId).toBe('sess-abc-123');
+  } finally {
+    fs.rmSync(projectCwd, { recursive: true, force: true });
+    fs.rmSync(runDir, { recursive: true, force: true });
+  }
+});
+
+test('is a silent no-op when job.epicId does not resolve to a known Epic', async () => {
+  const { projectCwd, runDir } = setupProject('sm-epic-digest-miss');
+  try {
+    const slug = `958-test-miss-${process.pid}-${Math.floor(Math.random() * 1e6)}`;
+    const bodyText = 'Do the thing described in this PRD body, unaccompanied.';
+    writeLegacyPrd(projectCwd, slug, bodyText);
+
+    const capturePath = path.join(runDir, 'captured-prompt.txt');
+    process.env.SM_CLAUDE_BIN = writeClaudeStub(capturePath);
+
+    // epicId is absent entirely — no active-index.json even exists for this project.
+    const job = { slug, cwd: projectCwd };
+    const result = await executeJob(job, runDir, projectCwd, () => Promise.resolve());
+
+    expect(result.exitCode).toBe(0);
+    const capturedPrompt = fs.readFileSync(capturePath, 'utf8');
+    expect(capturedPrompt).toBe(bodyText + FINISH_PROTOCOL);
+
+    const metaPath = path.join(runDir, `${slug}.meta.json`);
+    const meta = JSON.parse(fs.readFileSync(metaPath, 'utf8'));
+    expect(meta.contextDigestApplied).toBe(false);
+    expect(meta.originSessionId).toBe(null);
+  } finally {
+    fs.rmSync(projectCwd, { recursive: true, force: true });
+    fs.rmSync(runDir, { recursive: true, force: true });
+  }
+});
+
+test('a digest build failure is caught and never blocks dispatch', async () => {
+  const { projectCwd, runDir } = setupProject('sm-epic-digest-fail');
+  try {
+    const epicId = 'epic-fail-1';
+    writeActiveIndex(projectCwd, {
+      [epicId]: { claudeSessionId: 'sess-def-456', goalText: 'This Epic exists and resolves fine.' },
+    });
+
+    const slug = `958-test-fail-${process.pid}-${Math.floor(Math.random() * 1e6)}`;
+    const bodyText = 'Do the thing even if the digest build blows up.';
+    writeLegacyPrd(projectCwd, slug, bodyText);
+
+    const capturePath = path.join(runDir, 'captured-prompt.txt');
+    process.env.SM_CLAUDE_BIN = writeClaudeStub(capturePath);
+
+    // Stub epicContextDigest.cjs's export to reject, then force scheduler.cjs
+    // to re-require it so it picks up the stub (mirrors exchanges.test.cjs's
+    // summarize.cjs stubbing pattern) — only scheduler.cjs's own cache entry
+    // is cleared, not its whole dependency tree.
+    const digestPath = require.resolve('../lib/epicContextDigest.cjs');
+    const realDigestModule = require.cache[digestPath];
+    require.cache[digestPath] = {
+      id: digestPath,
+      filename: digestPath,
+      loaded: true,
+      exports: {
+        buildContextDigest: async () => {
+          throw new Error('boom: digest build exploded');
+        },
+      },
+    };
+    const schedulerPath = require.resolve('../scheduler.cjs');
+    delete require.cache[schedulerPath];
+    const freshScheduler = require('../scheduler.cjs');
+
+    try {
+      const job = { slug, cwd: projectCwd, epicId };
+      const result = await freshScheduler.executeJob(job, runDir, projectCwd, () => Promise.resolve());
+
+      expect(result.exitCode).toBe(0);
+      const capturedPrompt = fs.readFileSync(capturePath, 'utf8');
+      // Digest failed to build — prompt falls back to the un-prefixed PRD body.
+      expect(capturedPrompt).toBe(bodyText + FINISH_PROTOCOL);
+
+      const metaPath = path.join(runDir, `${slug}.meta.json`);
+      const meta = JSON.parse(fs.readFileSync(metaPath, 'utf8'));
+      expect(meta.contextDigestApplied).toBe(false);
+      expect(meta.originSessionId).toBe('sess-def-456');
+    } finally {
+      // Restore real modules for any later test in this file/process.
+      if (realDigestModule) require.cache[digestPath] = realDigestModule;
+      else delete require.cache[digestPath];
+      delete require.cache[schedulerPath];
+      ({ executeJob, FINISH_PROTOCOL } = require('../scheduler.cjs'));
+    }
+  } finally {
+    fs.rmSync(projectCwd, { recursive: true, force: true });
+    fs.rmSync(runDir, { recursive: true, force: true });
+  }
+});

package/src/main/__tests__/scheduler-writeprd-epic-rollback.test.cjs

@@ -1,7 +1,7 @@
 /**
  * scheduler-writeprd-epic-rollback.test.cjs — remote.writePrd may only JOIN
  * an existing, already-human-approved Epic (via `sourcePromptId`); it must
- * never mint a new one (mintIfMissing:false, see epicMint.cjs's ensureEpic).
+ * never mint a new one (no mintAuthority, see epicMint.cjs's ensureEpic).
  * A write with no resolvable Epic fails outright with zero residual
  * active-index.json entries — no orphaned Epic can ever be left behind by
  * this path because none is ever created by it.
@@ -19,7 +19,7 @@ const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
 const { remote } = require('../scheduler.cjs');
-const { ensureEpic, readActiveIndex } = require('../lib/epicMint.cjs');
+const { ensureEpic, readActiveIndex, MINT_AUTHORITY_NEW_EPIC_UI } = require('../lib/epicMint.cjs');
 const config = require('../config.cjs');
 
 const tmpDirs = [];
@@ -61,7 +61,7 @@ test('writePrd: no sourcePromptId refuses to write (no Epic to join) and mints n
 test('writePrd: invalid-slug failure when joining a pre-existing Epic leaves that Epic untouched', async () => {
   const cwd = makeFixtureCwd();
 
-  const preexisting = await ensureEpic(cwd, { goalText: 'pre-existing epic goal' });
+  const preexisting = await ensureEpic(cwd, { goalText: 'pre-existing epic goal', mintAuthority: MINT_AUTHORITY_NEW_EPIC_UI });
   expect(preexisting.created).toBe(true);
 
   const beforeIndex = readActiveIndex(cwd);
@@ -81,7 +81,7 @@ test('writePrd: invalid-slug failure when joining a pre-existing Epic leaves tha
 
 // Provenance (PRD 905): writePrd's ensureEpic call passes
 // source: { producer: 'scheduler-dispatch', prdSlug }, but this call is
-// join-only (mintIfMissing:false, explicit epicId) — ensureEpic's
+// join-only (no mintAuthority, explicit epicId) — ensureEpic's
 // explicitEpicId branch returns before ever reading `source`, so a
 // successful join must NOT write/alter the joined Epic's `source` field.
 test('writePrd: successful join does not write a source field onto the pre-existing Epic (join-only no-op)', async () => {
@@ -92,7 +92,7 @@ test('writePrd: successful join does not write a source field onto the pre-exist
   tmpDirs.push(cwd);
   config.addAllowedRoot(cwd);
 
-  const preexisting = await ensureEpic(cwd, { goalText: 'pre-existing epic goal for join' });
+  const preexisting = await ensureEpic(cwd, { goalText: 'pre-existing epic goal for join', mintAuthority: MINT_AUTHORITY_NEW_EPIC_UI });
   expect(preexisting.created).toBe(true);
 
   const body = `---\ntitle: Joins the existing epic\nsourcePromptId: ${preexisting.epicId}\n---\n\nbody text\n`;

package/src/main/chatRunner.cjs

@@ -52,6 +52,7 @@ const { extractJson } = require('./lib/extractJson.cjs');
 const { classifyPromptTicket } = require('./lib/classifyPromptTicket.cjs');
 const sessionSlots = require('./lib/sessionSlots.cjs');
 const opsErrorLog = require('./lib/opsErrorLog.cjs');
+const agentModelResolve = require('./lib/agentModelResolve.cjs');
 
 // ─── Stop-signal protocol ──────────────────────────────────────────────────
 // Single source of truth for the sentinel and parser. The renderer (PRD 320)
@@ -522,10 +523,18 @@ function executeRun({ tabId, sessionId, prompt, cwd, resume, silent, onSilentRes
     // instruction to every prompt
     const fullPrompt = STOP_SIGNAL_INSTRUCTION + CHAT_MODE_TRUTH_INSTRUCTION + prompt;
 
+    // sessionId is the Epic's claudeSessionId for an Epic-backed tab (see
+    // comment above childEnv) — resolve that Epic's agentType persona model
+    // so Chat and Terminal views of the same Epic launch with the same
+    // model. Never throws; falls back to the hardcoded 'sonnet' literal when
+    // there's no Epic, no agentType, or the persona has no model/'inherit' —
+    // --model must never be left unpinned (CLAUDE.md model-pinning rule).
+    const model = agentModelResolve.resolveEpicModel({ cwd, claudeSessionId: sessionId });
+
     // Build argv as an array — no shell: true, no string interpolation
     const args = [
       '-p', fullPrompt,
-      '--model', 'sonnet',           // pinned per "claude -p model pinning" rule
+      '--model', model,
       '--dangerously-skip-permissions',
       '--output-format', 'stream-json',
       '--verbose',

package/src/main/index.cjs

@@ -32,6 +32,7 @@ const { appendAuditEvent } = require('./lib/auditLog.cjs');
 const chatRunner = require('./chatRunner.cjs');
 const promptSessionEvents = require('./promptSessionEvents.cjs');
 const activeIndexMerge = require('./lib/activeIndexMerge.cjs');
+const promptSessionsCreateEpic = require('./lib/promptSessionsCreateEpic.cjs');
 const agentLibrary = require('./agentLibrary.cjs');
 const { sendIfAlive } = require('./lib/sendToRenderer.cjs');
 const { resolveBuildTarget } = require('./lib/buildTarget.cjs');
@@ -68,8 +69,6 @@ const agentMemory = require('./agentMemory.cjs');
 const git = require('./git.cjs');
 const filesIpc = require('./files.cjs');
 const { registerDocEditHandlers, attachWindow: attachDocEditWindow } = require('./docEdit.cjs');
-const searchIpc = require('./search.cjs');
-const repoAnalyzer = require('./repoAnalyzer.cjs');
 const webRemote = require('./webRemote.cjs');
 const { listExchanges } = require('./exchanges.cjs');
 const { resolveClaudeBin } = require('./lib/claudeBin.cjs');
@@ -819,6 +818,7 @@ registerHistoryDashboardHandlers();
 pluginInstall.registerPluginInstallHandlers();
 memoryTool.registerMemoryHandlers();
 activeIndexMerge.registerActiveIndexMergeHandlers();
+promptSessionsCreateEpic.registerPromptSessionsCreateEpicHandlers();
 registerMemoryAggregateIpc();
 registerProjectBriefIpc();
 registerProjectPagesIpc();
@@ -841,8 +841,6 @@ agentMemory.registerAgentMemoryHandlers();
 git.register(ipcMain);
 filesIpc.registerFilesHandlers();
 registerDocEditHandlers();
-searchIpc.registerSearchHandlers();
-repoAnalyzer.register(ipcMain);
 webRemote.registerRemoteHandlers();
 chatRunner.registerChatHandlers();
 

package/src/main/ipcSchemas.cjs

@@ -8,6 +8,7 @@
 const { z } = require('zod');
 const os = require('node:os');
 const path = require('node:path');
+const { PromptSessionSchema, EpicTagSchema, EpicSourceSchema } = require('./lib/promptSessionSchema.cjs');
 
 // ──────────────────────────────────────────── PTY
 const ptySpawn = z.object({
@@ -229,9 +230,35 @@ const configParseImports = z.object({ path: z.string().min(1).max(4096) });
 // Real epic ids are `${slugify(goalText)}-${uuid8}` (epicMint.cjs) — max 64
 // mirrors slugify's 48-char cap plus the "-" + 8 hex chars suffix, rounded up.
 const PROMPT_SESSION_ID_RE = /^(?!__proto__$|constructor$|prototype$)[A-Za-z0-9_-]{1,64}$/;
+
+// Per-ROW validation, not per-BATCH. persistActiveIndex (state/promptSessions.ts)
+// sends every open Epic for a cwd in ONE call, so validating the map with a
+// single parse meant one malformed/legacy row rejected the whole payload —
+// every other legitimate Epic for that cwd silently stopped persisting (the
+// renderer only logs the failure). Dropping just the offending row matches how
+// the rest of this pipeline already fails: per-id (activeIndexMerge.cjs's
+// tombstone/resurrection handling), never per-batch.
+const dropInvalidSessions = (raw) => {
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return raw;
+  const kept = Object.create(null);
+  for (const id of Object.keys(raw)) {
+    if (!PROMPT_SESSION_ID_RE.test(id)) {
+      console.warn(`[ipc] merge-active-index: dropping session with invalid id ${JSON.stringify(id)}`);
+      continue;
+    }
+    const parsed = PromptSessionSchema.safeParse(raw[id]);
+    if (!parsed.success) {
+      console.warn(`[ipc] merge-active-index: dropping malformed session ${id} — ${parsed.error.issues.map((i) => `${i.path.join('.')}: ${i.message}`).join('; ')}`);
+      continue;
+    }
+    kept[id] = raw[id];
+  }
+  return kept;
+};
+
 const promptSessionsMergeActiveIndex = z.object({
   cwd: z.string().min(1).max(4096),
-  sessions: z.record(z.string().regex(PROMPT_SESSION_ID_RE), z.unknown()).refine(
+  sessions: z.preprocess(dropInvalidSessions, z.record(z.string().regex(PROMPT_SESSION_ID_RE), PromptSessionSchema)).refine(
     (v) => Object.keys(v).length <= 2000,
     { message: 'too many sessions in one merge payload' },
   ),
@@ -247,6 +274,19 @@ const promptSessionsMergeActiveIndex = z.object({
   source: z.literal('epics'),
 });
 
+// Renderer entry point for main's ensureEpic() (lib/promptSessionsCreateEpic.cjs)
+// — additive step 1 of a two-PRD chain; unused by the app until the next PRD
+// routes state/promptSessions.ts's createPromptSession through it. `tag`/
+// `source` reuse promptSessionSchema.cjs's own enums rather than retyping
+// the value lists a third time.
+const promptSessionsCreateEpic = z.object({
+  cwd: z.string().min(1).max(4096),
+  goalText: z.string().min(1).max(20000),
+  tag: EpicTagSchema.optional(),
+  agentType: z.string().min(1).max(256).optional(),
+  source: EpicSourceSchema.optional(),
+});
+
 // ──────────────────────────────────────────── Sessions
 const sessionsPayload = z.object({
   tabs: z.array(z.object({
@@ -345,7 +385,11 @@ const schedulerCreatePrd = z.object({
   // forgot to pass sourcePromptId explicitly.
   originClaudeSessionId: z.string().min(1).max(128).regex(NO_NEWLINE_RE, 'must not contain newlines').optional(),
   // User-selected Feature/Bug tag (PRD 774) carried from the originating
-  // PromptTicket — deterministic, never LLM-classified.
+  // PromptTicket — deterministic, never LLM-classified. NOT the same value
+  // set as PromptSession's Epic-mission `tag` (lib/promptSessionSchema.cjs's
+  // EpicTagSchema) — that one also includes 'bilko-host-publisher'. Keep
+  // these two enums in sync deliberately if their meanings ever converge;
+  // don't assume editing one updates the other.
   tag: z.enum(['feature', 'bug', 'discussion', 'build', 'project-home-builder']).optional(),
 });
 
@@ -971,6 +1015,7 @@ module.exports = {
     promptSessionTranscriptAppend,
     promptSessionTranscriptRead,
     promptSessionsMergeActiveIndex,
+    promptSessionsCreateEpic,
     auditLogAppend,
     agentMemoryList,
     agentMemoryGet,

package/src/main/lib/agentModelResolve.cjs

@@ -0,0 +1,97 @@
+'use strict';
+
+/**
+ * agentModelResolve.cjs — resolves the `--model` an Epic's session should
+ * launch a headless `claude -p` (or Terminal `claude`) process with: its
+ * agentType persona's own `model` field (Agent Library) when the Epic has
+ * one set and it isn't 'inherit', else `fallbackModel`.
+ *
+ * Extracted from PRD agent-model-default-terminal (which wired this for the
+ * Terminal-view launch in EpicTerminalPane.tsx) so chatRunner.cjs's headless
+ * Chat-view launch resolves the SAME persona-derived model — Chat and
+ * Terminal are two VIEWS over one Epic session (CLAUDE.md) and must agree on
+ * which model that session launches with.
+ *
+ * Plain Node module (sync fs) — no Electron deps, mirrors epicMint.cjs's
+ * readActiveIndex so this can be called from chatRunner.cjs's synchronous
+ * executeRun() without restructuring it into an async flow.
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+const os = require('node:os');
+const { splitFrontmatter } = require('./prdFrontmatter.cjs');
+const { readActiveIndex } = require('./epicMint.cjs');
+const configMgr = require('../config.cjs');
+
+/** The hardcoded floor every branch of resolveEpicModel falls back to — --model must never be omitted (CLAUDE.md "Automation model pinning"). */
+const FALLBACK_MODEL = 'sonnet';
+
+/**
+ * Looks up the agentType an Epic (PromptSession) was created with, by the
+ * Epic's own claudeSessionId — the same domain-model join `prdCreate.cjs`'s
+ * resolveSourcePromptIdFromClaudeSession uses (Epic:claude-session is 1:1).
+ * Returns null if no matching Epic is found or it has no agentType set.
+ */
+function findAgentTypeByClaudeSessionId(cwd, claudeSessionId, deps = {}) {
+  if (!cwd || !claudeSessionId) return null;
+  const load = deps.readActiveIndex || readActiveIndex;
+  const { sessions } = load(cwd);
+  for (const session of Object.values(sessions)) {
+    if (session && session.claudeSessionId === claudeSessionId) return session.agentType || null;
+  }
+  return null;
+}
+
+/**
+ * Reads a global agent persona's `model` frontmatter field by name
+ * (`~/.claude/agents/<agentType>.md`), sync. Returns null on any miss
+ * (no such file, unreadable, no `model` key) — never throws.
+ */
+function readPersonaModel(agentType, deps = {}) {
+  if (!agentType) return null;
+  const globalDir = deps.globalDir || path.join(os.homedir(), '.claude', 'agents');
+  const validatePath = deps.validatePath || configMgr.validatePath;
+  let real;
+  try {
+    real = validatePath(path.join(globalDir, `${agentType}.md`));
+  } catch {
+    return null;
+  }
+  let text;
+  try {
+    text = fs.readFileSync(real, 'utf8');
+  } catch {
+    return null;
+  }
+  const { fm } = splitFrontmatter(text);
+  return fm.model || null;
+}
+
+/**
+ * Resolves the `--model` value for an Epic-backed session launch. Never
+ * throws — any lookup failure (missing Epic, missing persona, unreadable
+ * file) falls back to `fallbackModel` (default: 'sonnet', the same literal
+ * every claude -p call site pins per CLAUDE.md's model-pinning rule).
+ *
+ * @param {{ cwd: string, claudeSessionId: string, fallbackModel?: string, deps?: object }} opts
+ * @returns {string}
+ */
+function resolveEpicModel({ cwd, claudeSessionId, fallbackModel = FALLBACK_MODEL, deps = {} } = {}) {
+  try {
+    const agentType = findAgentTypeByClaudeSessionId(cwd, claudeSessionId, deps);
+    if (!agentType) return fallbackModel;
+    const model = readPersonaModel(agentType, deps);
+    if (!model || model === 'inherit') return fallbackModel;
+    return model;
+  } catch {
+    return fallbackModel;
+  }
+}
+
+module.exports = {
+  FALLBACK_MODEL,
+  resolveEpicModel,
+  findAgentTypeByClaudeSessionId,
+  readPersonaModel,
+};

package/src/main/lib/auditLog.cjs

@@ -8,10 +8,10 @@
  * survive even if the project's ops root doesn't exist yet.
  *
  * Best-effort only: a logging failure must never block the mint/create it is
- * observing (same posture as rcaFeedbackHook.cjs / dodDrainHook.cjs).
+ * observing (same posture as rcaReport.cjs / dodDrainHook.cjs).
  *
  * Plain Node module (no Electron deps) so scripts/mint-epic.cjs and
- * scripts/propose-epic.cjs (which run outside Electron) can require it too.
+ * scripts/mint-epic.cjs (which runs outside Electron) can require it too.
  */
 'use strict';
 

package/src/main/lib/epicContextDigest.cjs

@@ -0,0 +1,78 @@
+'use strict';
+
+/**
+ * epicContextDigest.cjs — condensed, real (never fabricated) digest of an
+ * Epic's own session, for later injection into a scheduled PRD job's opening
+ * prompt (wiring is a separate, dependent PRD — this module is groundwork
+ * only). Composes the Epic's goalText (active-index.json, via epicMint.cjs's
+ * readActiveIndex) with its most-recent turns (the JSONL transcript, via
+ * promptSessionTranscript.cjs's readTurns) — never reimplements either read.
+ *
+ * Plain Node module (no Electron deps), matching sessionSlots.cjs's and
+ * promptSessionTranscript.cjs's own posture, so it is callable from
+ * scheduler.cjs.
+ */
+
+const { readTurns } = require('../promptSessionTranscript.cjs');
+const { readActiveIndex } = require('./epicMint.cjs');
+
+const DEFAULT_MAX_CHARS = 4000;
+const TURN_LIMIT = 40;
+
+function formatTurn(turn) {
+  return `[${turn.role}] ${turn.text}`;
+}
+
+/**
+ * buildContextDigest({ cwd, epicId, maxChars }) → Promise<string>
+ *
+ * Best-effort: every internal call is wrapped so a failure here can never
+ * propagate to a caller — returns '' on any error, missing epicId, an epicId
+ * absent from the cwd's active-index.json, or an empty transcript.
+ */
+async function buildContextDigest({ cwd, epicId, maxChars } = {}) {
+  try {
+    if (!cwd || !epicId) return '';
+    const limit = typeof maxChars === 'number' && maxChars > 0 ? maxChars : DEFAULT_MAX_CHARS;
+
+    const index = readActiveIndex(cwd);
+    if (!Object.prototype.hasOwnProperty.call(index.sessions, epicId)) return '';
+    const session = index.sessions[epicId];
+    const goalText = session && typeof session.goalText === 'string' ? session.goalText.trim() : '';
+
+    const turns = await readTurns(cwd, epicId, { limit: TURN_LIMIT });
+
+    const header = goalText;
+    const headerChars = header ? header.length + 1 : 0; // +1 for trailing newline before turns
+
+    // Drop whole turns from the oldest first until the joined digest fits —
+    // never a hard mid-string slice that could cut a turn's text in half.
+    let kept = turns.slice();
+    while (kept.length > 0) {
+      const lines = kept.map(formatTurn);
+      const bodyChars = lines.length > 0 ? lines.join('\n').length : 0;
+      const total = headerChars + bodyChars;
+      if (total <= limit) break;
+      kept = kept.slice(1);
+    }
+
+    const parts = [];
+    if (header) parts.push(header);
+    if (kept.length > 0) parts.push(kept.map(formatTurn).join('\n'));
+
+    let digest = parts.join('\n');
+    if (digest.length > limit) {
+      // Header alone (no turns fit) can still exceed maxChars — clip the
+      // header itself rather than exceeding the caller's bound.
+      digest = digest.slice(0, limit);
+    }
+    return digest;
+  } catch (e) {
+    console.error('[epicContextDigest] buildContextDigest error', cwd, epicId, e);
+    return '';
+  }
+}
+
+module.exports = {
+  buildContextDigest,
+};