claude-code-session-manager 0.62.0 → 0.62.1

package/dist/index.html

@@ -7,10 +7,10 @@
     <link rel="preconnect" href="https://fonts.googleapis.com">
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
     <link href="https://fonts.googleapis.com/css2?family=Newsreader:ital,opsz,wght@0,6..72,400;0,6..72,500;0,6..72,600;0,6..72,700;1,6..72,400&family=Geist:wght@300;400;500;600;700&family=IBM+Plex+Mono:wght@400;500;600&display=swap" rel="stylesheet">
-    <script type="module" crossorigin src="./assets/index-BfiMRkln.js"></script>
+    <script type="module" crossorigin src="./assets/index-ZjTDk5b7.js"></script>
     <link rel="modulepreload" crossorigin href="./assets/monaco-editor-BW5C4Iv1.js">
     <link rel="stylesheet" crossorigin href="./assets/monaco-editor-BTnBOi8r.css">
-    <link rel="stylesheet" crossorigin href="./assets/index-DOXvph-Z.css">
+    <link rel="stylesheet" crossorigin href="./assets/index-CVCCMw5o.css">
   </head>
   <body class="bg-bg text-fg font-sans antialiased">
     <div id="root"></div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-code-session-manager",
-  "version": "0.62.0",
+  "version": "0.62.1",
   "description": "Local cockpit for the Claude Code CLI — multi-tab terminal, full config surface, scheduler, voice dictation, and live observability.",
   "type": "module",
   "main": "src/main/index.cjs",

package/src/main/__tests__/runVerify-transcript-commit-evidence.test.cjs

@@ -0,0 +1,215 @@
+/**
+ * runVerify-transcript-commit-evidence.test.cjs — regression tests for the
+ * transcript-commit-evidence fallback added to runVerify.cjs.
+ *
+ * Root cause (99-fix-e2e-needs-review-test, 2026-08-07): a job whose cwd is
+ * not a git repo (e.g. an investigation fix-plan that inherited cwd: /tmp)
+ * can never produce committedDuringRun=true — gitHead()/committedInWindow()
+ * both fail closed there — so the PASS+commit sentinel override could never
+ * fire even when the harness's own transcript recorded a real commit. This
+ * file asserts the fallback fires ONLY when both conditions hold: the cwd is
+ * genuinely not a git repo, AND the transcript itself carries harness-emitted
+ * commit evidence (never inferred from prose the model could fabricate).
+ *
+ * Run standalone: timeout 120 npx vitest run src/main/__tests__/runVerify-transcript-commit-evidence.test.cjs
+ */
+
+import { test } from 'vitest';
+const assert = require('node:assert/strict');
+const os = require('node:os');
+const fs = require('node:fs');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+const { verifyRun } = require('../runVerify.cjs');
+
+// ─── helpers (mirrors runVerify.test.cjs) ─────────────────────────────────────
+
+function makeTmpDir() {
+  return fs.mkdtempSync(path.join(os.tmpdir(), 'run-verify-commit-evidence-test-'));
+}
+
+function rmdir(dir) {
+  try { fs.rmSync(dir, { recursive: true, force: true }); } catch { /* */ }
+}
+
+function writeLog(dir, slug, events) {
+  const lines = ['[scheduler] starting ' + slug + ' at 2026-08-07T02:25:31.453Z'];
+  for (const ev of events) lines.push(JSON.stringify(ev));
+  lines.push('[scheduler] exit code=0 (raw code=0 signal=null) duration=47s');
+  fs.writeFileSync(path.join(dir, `${slug}.log`), lines.join('\n') + '\n');
+}
+
+function writePrd(dir, slug, body) {
+  const text = `---\ntitle: Test PRD\ncwd: /tmp\nestimateMinutes: 30\n---\n${body}\n`;
+  fs.writeFileSync(path.join(dir, `${slug}.md`), text);
+  return path.join(dir, `${slug}.md`);
+}
+
+function makeTmpGitRepo() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'run-verify-commit-evidence-repo-'));
+  execFileSync('git', ['init', '-q'], { cwd: dir });
+  execFileSync('git', ['config', 'user.email', 'test@example.com'], { cwd: dir });
+  execFileSync('git', ['config', 'user.name', 'Test'], { cwd: dir });
+  fs.writeFileSync(path.join(dir, 'README.md'), 'init\n');
+  execFileSync('git', ['add', 'README.md'], { cwd: dir });
+  execFileSync('git', ['commit', '-q', '-m', 'init'], { cwd: dir });
+  return dir;
+}
+
+/**
+ * Build a run log with:
+ *   - padding events so a late is_error lands in the final 20%
+ *   - a late is_error tool_result (main-agent, no self-recovery)
+ *   - optionally a harness-emitted commit-evidence line
+ *   - a SCHEDULER_VERDICT: PASS result event
+ */
+function buildRunEvents({ includeCommitEvidence, evidenceForm = 'vcs_state_changed' }) {
+  const events = [];
+  for (let k = 0; k < 8; k++) {
+    events.push({ type: 'assistant', message: { role: 'assistant', content: [
+      { type: 'tool_use', id: `t${k}`, name: 'Read', input: { description: `read ${k}` } }] } });
+    events.push({ type: 'user', message: { role: 'user', content: [
+      { type: 'tool_result', tool_use_id: `t${k}`, content: 'ok', is_error: false }] } });
+  }
+  events.push({ type: 'assistant', message: { role: 'assistant', content: [
+    { type: 'tool_use', id: 'tbad', name: 'Agent', input: { description: 'run code review agent' } }] } });
+  events.push({ type: 'user', message: { role: 'user', content: [
+    { type: 'tool_result', tool_use_id: 'tbad',
+      content: "Agent type 'code-reviewer' not found. Available agents: architect, …", is_error: true }] } });
+
+  if (includeCommitEvidence) {
+    if (evidenceForm === 'vcs_state_changed') {
+      events.push({ type: 'system', subtype: 'vcs_state_changed', kind: 'commit', cwd: '/tmp' });
+    } else {
+      events.push({
+        type: 'user',
+        message: { role: 'user', content: [
+          { type: 'tool_result', tool_use_id: 'tcommit', content: 'committed', is_error: false }] },
+        tool_use_result: { gitOperation: { commit: { sha: '6ecbd40', kind: 'committed' } } },
+      });
+    }
+  }
+
+  events.push({ type: 'result', subtype: 'success', result: 'All acceptance criteria verified.\nSCHEDULER_VERDICT: PASS' });
+  return events;
+}
+
+// ─── (1) regression case: non-git cwd + transcript evidence → clean ──────────
+
+test('PASS + late is_error + transcript commit evidence + non-git cwd → clean (fallback fires)', async () => {
+  const tmp = makeTmpDir();
+  try {
+    const slug = '99-fix-e2e-needs-review-test';
+    writeLog(tmp, slug, buildRunEvents({ includeCommitEvidence: true }));
+    const prdPath = writePrd(tmp, slug, '# Fix scheduler skip guard');
+    const nonGitCwd = fs.mkdtempSync(path.join(os.tmpdir(), 'run-verify-nongit-cwd-'));
+    try {
+      const verdict = await verifyRun({
+        runDir: tmp,
+        prdPath,
+        queueEntry: { slug, status: 'running', cwd: nonGitCwd },
+        allJobs: [],
+        committedDuringRun: false,
+      });
+      assert.equal(verdict.verdict, 'clean', `expected clean via transcript fallback, got ${verdict.verdict}: ${verdict.reason}`);
+      assert.equal(verdict.downgradeTo, null);
+      const sidecar = JSON.parse(fs.readFileSync(path.join(tmp, `${slug}.verdicts.json`), 'utf8'));
+      assert.equal(sidecar.commitEvidenceSource, 'transcript', 'sidecar should record the fallback source');
+    } finally { rmdir(nonGitCwd); }
+  } finally { rmdir(tmp); }
+});
+
+test('PASS + late is_error + gitOperation.commit evidence + non-git cwd → clean (fallback fires)', async () => {
+  const tmp = makeTmpDir();
+  try {
+    const slug = '99-fix-e2e-needs-review-test-alt';
+    writeLog(tmp, slug, buildRunEvents({ includeCommitEvidence: true, evidenceForm: 'gitOperation' }));
+    const prdPath = writePrd(tmp, slug, '# Fix scheduler skip guard');
+    const nonGitCwd = fs.mkdtempSync(path.join(os.tmpdir(), 'run-verify-nongit-cwd-'));
+    try {
+      const verdict = await verifyRun({
+        runDir: tmp,
+        prdPath,
+        queueEntry: { slug, status: 'running', cwd: nonGitCwd },
+        allJobs: [],
+        committedDuringRun: false,
+      });
+      assert.equal(verdict.verdict, 'clean', `expected clean via transcript fallback, got ${verdict.verdict}: ${verdict.reason}`);
+    } finally { rmdir(nonGitCwd); }
+  } finally { rmdir(tmp); }
+});
+
+// ─── (2) no evidence lines → fallback must not fire, still transcript_errors ──
+
+test('PASS + late is_error + NO transcript evidence + non-git cwd → transcript_errors (no fallback)', async () => {
+  const tmp = makeTmpDir();
+  try {
+    const slug = '99-fix-no-evidence';
+    writeLog(tmp, slug, buildRunEvents({ includeCommitEvidence: false }));
+    const prdPath = writePrd(tmp, slug, '# Fix scheduler skip guard');
+    const nonGitCwd = fs.mkdtempSync(path.join(os.tmpdir(), 'run-verify-nongit-cwd-'));
+    try {
+      const verdict = await verifyRun({
+        runDir: tmp,
+        prdPath,
+        queueEntry: { slug, status: 'running', cwd: nonGitCwd },
+        allJobs: [],
+        committedDuringRun: false,
+      });
+      assert.equal(verdict.verdict, 'transcript_errors', `expected transcript_errors without evidence, got ${verdict.verdict}: ${verdict.reason}`);
+      assert.equal(verdict.downgradeTo, 'needs_review');
+    } finally { rmdir(nonGitCwd); }
+  } finally { rmdir(tmp); }
+});
+
+// ─── (3) git-repo cwd + evidence + committedDuringRun:false → fallback must not apply ──
+
+test('PASS + late is_error + transcript evidence + GIT-REPO cwd + committedDuringRun:false → transcript_errors (false-PASS guard)', async () => {
+  const tmp = makeTmpDir();
+  const repo = makeTmpGitRepo();
+  try {
+    const slug = '99-fix-git-repo-cwd';
+    writeLog(tmp, slug, buildRunEvents({ includeCommitEvidence: true }));
+    const prdPath = writePrd(tmp, slug, '# Fix scheduler skip guard');
+    const verdict = await verifyRun({
+      runDir: tmp,
+      prdPath,
+      queueEntry: { slug, status: 'running', cwd: repo },
+      allJobs: [],
+      committedDuringRun: false,
+    });
+    assert.equal(verdict.verdict, 'transcript_errors', `fallback must not apply when git ancestry is observable, got ${verdict.verdict}: ${verdict.reason}`);
+    assert.equal(verdict.downgradeTo, 'needs_review');
+  } finally { rmdir(tmp); rmdir(repo); }
+});
+
+// ─── (4) PASS + transcript evidence + non-git cwd must not be pass_no_commit ──
+
+test('PASS (no error) + transcript evidence + non-git cwd → clean, not pass_no_commit', async () => {
+  const tmp = makeTmpDir();
+  try {
+    const slug = '99-fix-clean-pass';
+    const events = [
+      { type: 'assistant', message: { role: 'assistant', content: [
+        { type: 'tool_use', id: 't0', name: 'Bash', input: { description: 'run tests' } }] } },
+      { type: 'user', message: { role: 'user', content: [
+        { type: 'tool_result', tool_use_id: 't0', content: '535 passed', is_error: false }] } },
+      { type: 'system', subtype: 'vcs_state_changed', kind: 'commit', cwd: '/tmp' },
+      { type: 'result', subtype: 'success', result: 'All acceptance criteria verified.\nSCHEDULER_VERDICT: PASS' },
+    ];
+    writeLog(tmp, slug, events);
+    const prdPath = writePrd(tmp, slug, '# Fix scheduler skip guard');
+    const nonGitCwd = fs.mkdtempSync(path.join(os.tmpdir(), 'run-verify-nongit-cwd-'));
+    try {
+      const verdict = await verifyRun({
+        runDir: tmp,
+        prdPath,
+        queueEntry: { slug, status: 'running', cwd: nonGitCwd },
+        allJobs: [],
+        committedDuringRun: false,
+      });
+      assert.equal(verdict.verdict, 'clean', `expected clean, got ${verdict.verdict}: ${verdict.reason}`);
+      assert.notEqual(verdict.verdict, 'pass_no_commit');
+    } finally { rmdir(nonGitCwd); }
+  } finally { rmdir(tmp); }
+});

package/src/main/__tests__/scheduler-investigation-prompt.test.cjs

@@ -8,7 +8,11 @@
 
 const { test } = require('node:test');
 const assert = require('node:assert/strict');
-const { buildInvestigationPrompt } = require('../scheduler.cjs');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { execFileSync } = require('node:child_process');
+const { buildInvestigationPrompt, isGitRepoSync } = require('../scheduler.cjs');
 
 function makeArgs(overrides = {}) {
   return {
@@ -49,3 +53,40 @@ test('prompt includes the resolved job fields', () => {
   assert.match(prompt, /some log tail output/);
   assert.match(prompt, /05-fix-my-feature\.md/);
 });
+
+// ─── cwd-must-be-git-repo-root guidance (99-fix-e2e-needs-review-test) ────────
+
+test('prompt instructs that cwd must be the git repo root where the fix will land', () => {
+  const prompt = buildInvestigationPrompt(makeArgs());
+  assert.match(prompt, /cwd.*must be the git repo root/);
+  assert.match(prompt, /needs_review/);
+});
+
+test('prompt frontmatter block still declares exactly the four expected keys', () => {
+  const prompt = buildInvestigationPrompt(makeArgs());
+  const fenceMatch = prompt.match(/```\s*\n\s*---\n([\s\S]*?)\n\s*---\n\s*```/);
+  assert.ok(fenceMatch, 'expected a fenced frontmatter block in the prompt');
+  const keys = fenceMatch[1]
+    .split('\n')
+    .filter((line) => line.trim().length > 0)
+    .map((line) => line.split(':')[0].trim());
+  assert.deepEqual(keys, ['title', 'cwd', 'parallelGroup', 'estimateMinutes']);
+});
+
+// ─── isGitRepoSync (scheduler.cjs) ─────────────────────────────────────────────
+
+test('isGitRepoSync: true for a real git repo, false for a non-repo dir, false for missing/undefined', () => {
+  const repo = fs.mkdtempSync(path.join(os.tmpdir(), 'scheduler-isgitrepo-repo-'));
+  const nonRepo = fs.mkdtempSync(path.join(os.tmpdir(), 'scheduler-isgitrepo-plain-'));
+  try {
+    execFileSync('git', ['init', '-q'], { cwd: repo });
+    assert.equal(isGitRepoSync(repo), true);
+    assert.equal(isGitRepoSync(nonRepo), false);
+    assert.equal(isGitRepoSync(undefined), false);
+    assert.equal(isGitRepoSync(''), false);
+    assert.equal(isGitRepoSync('/definitely/does/not/exist'), false);
+  } finally {
+    fs.rmSync(repo, { recursive: true, force: true });
+    fs.rmSync(nonRepo, { recursive: true, force: true });
+  }
+});

package/src/main/__tests__/scheduler-prd-missing-skip.test.cjs

@@ -23,6 +23,7 @@ const path = require('node:path');
 let tmpHome;
 let originalHome;
 let executeJob;
+let spawnJob;
 let PRDS_DIR;
 
 beforeAll(() => {
@@ -30,7 +31,7 @@ beforeAll(() => {
   tmpHome = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-prd-missing-skip-'));
   process.env.HOME = tmpHome;
 
-  ({ executeJob, PRDS_DIR } = require('../scheduler.cjs'));
+  ({ executeJob, spawnJob, PRDS_DIR } = require('../scheduler.cjs'));
 
   if (!PRDS_DIR.startsWith(tmpHome)) {
     throw new Error(`refusing to run: PRDS_DIR (${PRDS_DIR}) is not under the temp HOME (${tmpHome})`);
@@ -87,3 +88,55 @@ test('a job whose PRD source exists but is unreadable for a non-ENOENT reason st
     fs.rmSync(runDir, { recursive: true, force: true });
   }
 });
+
+function registerActiveProject(cwd) {
+  const projectsDir = path.join(tmpHome, '.claude', 'projects');
+  const slugDir = path.join(projectsDir, `fake-project-slug-${path.basename(cwd)}`);
+  fs.mkdirSync(slugDir, { recursive: true });
+  fs.writeFileSync(path.join(slugDir, 'transcript.jsonl'), JSON.stringify({ cwd }) + '\n');
+}
+
+function writeProjectQueue(cwd, jobs) {
+  const stateDir = path.join(cwd, 'session-manager-operations', 'scheduler', 'state');
+  fs.mkdirSync(stateDir, { recursive: true });
+  fs.writeFileSync(path.join(stateDir, 'queue.json'), JSON.stringify({ jobs }, null, 2));
+  return path.join(stateDir, 'queue.json');
+}
+
+// This is the actual regression case: PRD 812's fix only covered executeJob's
+// own return value. The bug lived one layer up, in spawnJob's post-run
+// handler, which only short-circuited on skipped === 'prd-archived' and let
+// 'prd-missing' fall through into the verify path meant for real runs —
+// downgrading a stale-queue-entry retire into a needs_review with a bogus RCA
+// feedback item. Drive spawnJob itself (not just executeJob) so this covers
+// the actual defect, not just the classification it depends on.
+test("spawnJob's post-run handler retires a prd-missing skip as a plain completion, without running verify", async () => {
+  const projectCwd = fs.mkdtempSync(path.join(os.tmpdir(), 'sm-prd-missing-spawnjob-project-'));
+  registerActiveProject(projectCwd);
+  const runDir = fs.mkdtempSync(path.join(tmpHome, '.claude', 'sm-prd-missing-spawnjob-run-'));
+  try {
+    const slug = `812-test-spawnjob-missing-${process.pid}-${Math.floor(Math.random() * 1e6)}`;
+    const queuePath = writeProjectQueue(projectCwd, [
+      { slug, status: 'pending', cwd: projectCwd },
+    ]);
+
+    const job = { slug, cwd: projectCwd };
+    await spawnJob(job, 'run-spawnjob-missing', runDir, projectCwd);
+
+    const state = JSON.parse(fs.readFileSync(queuePath, 'utf8'));
+    const row = state.jobs.find((j) => j.slug === slug);
+    expect(row).toBeDefined();
+    expect(row.status).toBe('completed');
+    expect(row.exitCode).toBe(0);
+    expect(row.error).toBeNull();
+    // No verify pass ran and no RCA feedback fired: a verified run always
+    // stamps a verify-derived status ('needs_review') or a landedCommit/verify
+    // field onto the row. Neither is present here — the row was completed by
+    // the early-return skip branch, not the verification block further down.
+    expect(row.status).not.toBe('needs_review');
+    expect(row.landedCommit).toBeUndefined();
+  } finally {
+    fs.rmSync(projectCwd, { recursive: true, force: true });
+    fs.rmSync(runDir, { recursive: true, force: true });
+  }
+});

package/src/main/__tests__/transcripts-doFlush-array.test.cjs

@@ -29,6 +29,12 @@ beforeEach(() => {
 
 afterEach(() => {
   fs.rmSync(cwd, { recursive: true, force: true });
+  // writeTranscript mkdir -p's this run's folder under the REAL
+  // ~/.claude/projects (that's where transcriptPath resolves to), so leaving
+  // it behind accumulates one phantom project directory per test run — 1760
+  // of them had piled up before this cleanup existed, and Home counted every
+  // one as a project. Remove it with the tmp cwd it mirrors.
+  fs.rmSync(path.dirname(transcriptPath(cwd, 'x')), { recursive: true, force: true });
 });
 
 function writeTranscript(cwdArg, sessionId, lines) {

package/src/main/__tests__/transcripts-paged-reads.test.cjs

@@ -36,6 +36,12 @@ beforeEach(() => {
 
 afterEach(() => {
   fs.rmSync(cwd, { recursive: true, force: true });
+  // writeTranscript mkdir -p's this run's folder under the REAL
+  // ~/.claude/projects (that's where transcriptPath resolves to), so leaving
+  // it behind accumulates one phantom project directory per test run. Thousands
+  // had piled up before this cleanup existed, and Home counted every one as a
+  // project. Remove it with the tmp cwd it mirrors.
+  fs.rmSync(path.dirname(transcriptPath(cwd, 'x')), { recursive: true, force: true });
 });
 
 function writeTranscript(cwdArg, sessionId, lines) {

package/src/main/__tests__/transcriptsUsageFor.test.cjs

@@ -24,6 +24,12 @@ beforeEach(() => {
 
 afterEach(() => {
   fs.rmSync(cwd, { recursive: true, force: true });
+  // writeTranscript mkdir -p's this run's folder under the REAL
+  // ~/.claude/projects (that's where transcriptPath resolves to), so leaving
+  // it behind accumulates one phantom project directory per test run. Thousands
+  // had piled up before this cleanup existed, and Home counted every one as a
+  // project. Remove it with the tmp cwd it mirrors.
+  fs.rmSync(path.dirname(transcriptPath(cwd, 'x')), { recursive: true, force: true });
 });
 
 function writeTranscript(cwdArg, sessionId, lines) {

package/src/main/config.cjs

@@ -129,10 +129,7 @@ function validateWrite(realAbs) {
     (p) => realAbs === p || realAbs.startsWith(p + path.sep)
   );
   if (inWritePrefix) return;
-  // Also allowed inside a registered project root's .claude/ subtree, OR its
-  // tests/fixtures/browser-capture/ subtree (PRD 407 "PRD fixture" capture
-  // destination — narrowly scoped to that one path segment, not a general
-  // project-root write grant).
+  // Also allowed inside a registered project root's .claude/ subtree.
   for (const root of allowedRoots) {
     if (root === os.homedir()) continue;
     let realRoot;
@@ -142,24 +139,6 @@ function validateWrite(realAbs) {
       if (realAbs === claudeSub || realAbs.startsWith(claudeSub + path.sep)) {
         return;
       }
-      const fixturesSub = path.join(realRoot, 'tests', 'fixtures', 'browser-capture');
-      if (realAbs === fixturesSub || realAbs.startsWith(fixturesSub + path.sep)) {
-        return;
-      }
-      // PRD 410 Recorder → Playwright-spec export: narrowly scoped to
-      // tests/e2e/ (matches the repo's existing e2e spec location), not a
-      // general project-root write grant.
-      const e2eSub = path.join(realRoot, 'tests', 'e2e');
-      if (realAbs === e2eSub || realAbs.startsWith(e2eSub + path.sep)) {
-        return;
-      }
-      // Browser tab scratch saves (DOM captures, screenshots, recorded
-      // flows): narrowly scoped to session-manager-operations/browser/,
-      // this repo's existing per-project artifact-store convention.
-      const browserSub = path.join(realRoot, 'session-manager-operations', 'browser');
-      if (realAbs === browserSub || realAbs.startsWith(browserSub + path.sep)) {
-        return;
-      }
       // PromptSession persistence (active-index.json + per-session archives,
       // promptSessions.ts) and the scheduler's own read-modify-write of that
       // same active index (promptSessionEvents.cjs, PRD 814) — narrowly

package/src/main/files.cjs

@@ -318,6 +318,21 @@ async function deleteEntry(filePath) {
   }
 }
 
+/**
+ * Binary-safe atomic write (formerly browser:save-binary). Routes through
+ * config.cjs's writeBinaryAtomic so the single-writer law still applies to
+ * ops-root destinations; `writer` is the renderer's declared owner id.
+ */
+async function saveBinary(filePath, base64, writer) {
+  const { writeBinaryAtomic } = require('./config.cjs');
+  try {
+    await writeBinaryAtomic(filePath, Buffer.from(base64, 'base64'), { writer });
+    return { ok: true };
+  } catch (e) {
+    return { ok: false, error: e && e.message ? e.message : String(e) };
+  }
+}
+
 async function openExternal(filePath) {
   let resolved;
   try { resolved = validateHomePath(filePath); }
@@ -385,6 +400,10 @@ function registerFilesHandlers() {
     const { path: p } = filesPath.parse(payload);
     return deleteEntry(p);
   });
+  ipcMain.handle('files:save-binary', (_e, payload) => {
+    const { path: p, base64, writer } = schemas.filesSaveBinary.parse(payload);
+    return saveBinary(p, base64, writer);
+  });
   // files:open-external / files:show-in-finder consolidated into shell:open
   // (index.cjs, as: 'openPath' / 'revealPath'). The openExternal/showInFinder
   // functions are exported for that handler to call.
@@ -406,4 +425,5 @@ module.exports = {
   deleteEntry,
   duplicateEntry,
   duplicateNameFor,
+  saveBinary,
 };

package/src/main/index.cjs

@@ -1,4 +1,4 @@
-const { app, BrowserWindow, ipcMain, dialog, Menu, session, systemPreferences, globalShortcut, shell, clipboard, nativeImage, powerSaveBlocker, protocol } = require('electron');
+const { app, BrowserWindow, ipcMain, dialog, Menu, session, systemPreferences, globalShortcut, shell, clipboard, powerSaveBlocker, protocol } = require('electron');
 const { spawn, execFile, execFileSync } = require('node:child_process');
 const path = require('node:path');
 const fs = require('node:fs');
@@ -9,8 +9,6 @@ const { cleanChildEnv } = require('./lib/cleanEnv.cjs');
 const { terminateLosingInstance } = require('./lib/singleInstanceGuard.cjs');
 const { acquireSchedulerOwnership, releaseSchedulerOwnership } = require('./lib/instanceLock.cjs');
 const { manager: ptyManager, registerPtyHandlers } = require('./pty.cjs');
-const browserView = require('./browserView.cjs');
-const browserCapture = require('./browserCapture.cjs');
 const configMgr = require('./config.cjs');
 const transcripts = require('./transcripts.cjs');
 const sessionsStore = require('./sessionsStore.cjs');
@@ -40,13 +38,6 @@ const adminHttp = createAdminHttp();
 scheduler.registerAdminRoutes(adminHttp);
 prdCreate.registerAdminRoute(adminHttp, scheduler.remote);
 chatRunner.registerAdminRoute(adminHttp);
-const { createBrowserAgentServer } = require('./browserAgentServer.cjs');
-const browserAgentServer = createBrowserAgentServer({
-  listTabs: () => browserView.listViews(),
-  screenshot: ({ viewId }) => browserView.captureShotForAgent({ viewId }),
-  action: (params) => browserView.dispatchViewAction(params),
-  dom: ({ viewId }) => browserView.captureAgentDom({ viewId }),
-});
 const supervisor = require('./supervisor.cjs');
 const watchers = require('./watchers.cjs');
 const teams = require('./teams.cjs');
@@ -69,7 +60,6 @@ const agentMemory = require('./agentMemory.cjs');
 const git = require('./git.cjs');
 const filesIpc = require('./files.cjs');
 const { registerDocEditHandlers, attachWindow: attachDocEditWindow } = require('./docEdit.cjs');
-const webRemote = require('./webRemote.cjs');
 const { listExchanges } = require('./exchanges.cjs');
 const { resolveClaudeBin } = require('./lib/claudeBin.cjs');
 const { checkInsideHome, assertInsideHome } = require('./lib/insideHome.cjs');
@@ -306,8 +296,6 @@ async function rebootApp() {
     ptyManager.attachWindow(mainWindow);
     configMgr.attachWindow(mainWindow);
     transcripts.attachWindow(mainWindow);
-    browserView.attachWindow(mainWindow);
-    browserCapture.attachWindow(mainWindow);
     voiceHotkey.init(mainWindow).catch((e) => {
       logs.writeLine({ scope: 'voice-hotkey', level: 'error', message: 'reinit failed', meta: { error: e?.message } });
     });
@@ -506,25 +494,6 @@ ipcMain.handle('app:pick-directory', async () => {
 
 ipcMain.on('app:reboot-app', () => rebootApp());
 
-// Recorder export "Save to file…" (PRD 412) — native Save As dialog, written
-// directly since the path is user-chosen, not renderer input.
-ipcMain.handle('browser:save-recording', validated(schemas.browserSaveRecording, async ({ defaultName, text }) => {
-  try {
-    const result = await dialog.showSaveDialog(mainWindow, {
-      defaultPath: defaultName,
-      filters: [
-        { name: 'Markdown', extensions: ['md'] },
-        { name: 'All Files', extensions: ['*'] },
-      ],
-    });
-    if (result.canceled || !result.filePath) return { ok: false, canceled: true };
-    await fsp.writeFile(result.filePath, text, 'utf8');
-    return { ok: true, path: result.filePath };
-  } catch (e) {
-    return { ok: false, error: e && e.message ? e.message : String(e) };
-  }
-}));
-
 // Image paste — Ctrl+V in the Terminal pane. Reads the OS clipboard via
 // Electron's native API (renderer's navigator.clipboard.read() doesn't expose
 // raw image MIME types under contextIsolation), saves the bitmap to a temp
@@ -570,19 +539,6 @@ ipcMain.handle('clipboard:write-text', validated(schemas.clipboardWriteText, ({
   }
 }));
 
-// PRD 407 Capture panel — write side of paste-image's read. Writes a
-// screenshot capture to the OS clipboard as an image.
-ipcMain.handle('browser:copy-image', validated(schemas.browserCopyImage, ({ dataUrl }) => {
-  try {
-    const img = nativeImage.createFromDataURL(dataUrl);
-    if (!img || img.isEmpty()) return { ok: false, error: 'empty image' };
-    clipboard.writeImage(img);
-    return { ok: true };
-  } catch (e) {
-    return { ok: false, error: e && e.message ? e.message : String(e) };
-  }
-}));
-
 // Hooks tab "Test fire": run a hook command with a fake event payload piped
 // to stdin. shell:true is intentional — Claude Code's hook field is a shell
 // string. Timeout is enforced via SIGKILL on a timer because spawn's built-in
@@ -841,7 +797,6 @@ agentMemory.registerAgentMemoryHandlers();
 git.register(ipcMain);
 filesIpc.registerFilesHandlers();
 registerDocEditHandlers();
-webRemote.registerRemoteHandlers();
 chatRunner.registerChatHandlers();
 
 // Direct in-process PRD authoring for a queued PromptTicket classified
@@ -943,11 +898,6 @@ app.on('web-contents-created', (_e, wc) => {
   });
 
   wc.on('will-navigate', (event, url) => {
-    // The embedded Browser tab's WebContentsView is a real browser — it must
-    // be able to navigate anywhere. Exempt ONLY webContents registered by
-    // browserView.cjs; the main window's lock below is unchanged.
-    if (browserView.isBrowserViewContents(wc.id)) return;
-
     const allowed = useDevServer
       ? ['http://localhost:5173', 'http://127.0.0.1:5173']
       : [];
@@ -1144,16 +1094,12 @@ app.whenReady().then(async () => {
   ptyManager.attachWindow(mainWindow);
   configMgr.attachWindow(mainWindow);
   transcripts.attachWindow(mainWindow);
-  browserView.registerBrowserView({ mainWindow, ipcMain });
-  browserCapture.attachWindow(mainWindow);
-  browserCapture.registerBrowserCapture({ ipcMain, getView: browserView.getView });
   voiceHotkey.init(mainWindow).catch((e) => {
     logs.writeLine({ scope: 'voice-hotkey', level: 'error', message: 'init failed', meta: { error: e?.message } });
   });
   scheduler.attachWindow(mainWindow);
   watchers.attachWindow(mainWindow);
   pluginInstall.attachWindow(mainWindow);
-  webRemote.attachWindow(mainWindow);
   chatRunner.attachWindow(mainWindow);
   promptSessionEvents.attachWindow(mainWindow);
   attachDocEditWindow(mainWindow);
@@ -1177,18 +1123,12 @@ app.whenReady().then(async () => {
     console.log(`[main] scheduler ownership held by pid ${ownership.holderPid} — running scheduler-passive (no reconciliation, no admin server)`);
     logs.writeLine({ scope: 'scheduler', level: 'info', message: 'scheduler-passive: ownership held by another instance', meta: { holderPid: ownership.holderPid } });
   }
-  browserAgentServer.start().catch((e) => {
-    logs.writeLine({ scope: 'browser-agent-server', level: 'error', message: 'init failed', meta: { error: e?.message } });
-  });
   // First-boot default: install the bundled session-manager-dev plugin (its 10
   // dev skills) from the app's own marketplace. One-shot + idempotent; never
   // throws. SM_SEED_DEV_PLUGIN_DISABLE=1 to opt out.
   seedDevPlugin({ logger: console }).catch((e) => {
     logs.writeLine({ scope: 'seed-dev-plugin', level: 'error', message: 'seed failed', meta: { error: e?.message } });
   });
-  webRemote.init().catch((e) => {
-    logs.writeLine({ scope: 'webRemote', level: 'error', message: 'init failed', meta: { error: e?.message } });
-  });
   // History rollup finalize pass: deferred 30s past boot so it never competes
   // with first-paint, fire-and-forget (cron/offline refresh is PRD 651 — this
   // is just the one-shot in-app pass).
@@ -1249,7 +1189,6 @@ let teardownDone = false;
 function runShutdownCleanup() {
   if (teardownDone) return;          // idempotent — will-quit may still fire after an app.exit path
   teardownDone = true;
-  webRemote.destroy();
   // Mark a clean exit so the next boot can distinguish a graceful quit from an
   // OOM-kill / native crash (which leaves the sentinel `open`).
   crashDiagnostics.markCleanShutdown();
@@ -1287,7 +1226,6 @@ app.on('before-quit', () => {
   transcripts.closeAll();
   watchers.manager.killAll();
   adminHttp.stop().catch(() => {});
-  browserAgentServer.stop().catch(() => {});
   // Best-effort flush of any pending OTEL spans. shutdown() has its own 2s
   // ceiling so a wedged exporter can't hold quit.
   otel.shutdown().catch(() => {});