claude-code-session-manager 0.62.0 → 0.62.1

package/src/main/ipcSchemas.cjs

@@ -25,17 +25,6 @@ const ptyTabId = z.object({ tabId: z.string().min(1).max(128) });
 // have a live PTY? Bounded so the renderer can't ask about unbounded lists.
 const ptyAlive = z.object({ tabIds: z.array(z.string().min(1).max(128)).max(500) });
 
-// v2 mobile: subscribe to a session's live state + summary. cwd is needed to
-// locate the transcript JSONL (transcriptPath); validated against home-dir boundary
-// in webRemote before any fs access.
-const sessionSubscribe = z.object({
-  // tabId becomes a transcript FILENAME (`<tabId>.jsonl`) — restrict to a
-  // session-id charset (no '/', no '.', so it can't traverse out of the project
-  // transcript dir). sessionId is a UUID, which satisfies this.
-  tabId: z.string().min(1).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9_-]*$/),
-  cwd: z.string().min(1).max(4096),
-});
-
 // 64 KiB cap per pty:write — typewriter input is bounded; a renderer firing
 // megabytes per call is either a bug or an attack. Block it at the boundary.
 const PTY_WRITE_MAX_BYTES = 64 * 1024;
@@ -50,115 +39,12 @@ const ptyResize = z.object({
   rows: z.number().int().min(3).max(1000),
 });
 
-// ──────────────────────────────────────────── Browser (WebContentsView embed)
-// viewId is a renderer-generated identifier; restrict to a safe charset (no
-// '/', no '.') since it keys the in-process Map<viewId, WebContentsView> —
-// not used as a filesystem path, but kept consistent with tabId conventions.
-const BROWSER_VIEW_ID_RE = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
-const browserViewId = z.object({
-  viewId: z.string().min(1).max(128).regex(BROWSER_VIEW_ID_RE),
-});
-
-const browserCreate = z.object({
-  viewId: z.string().min(1).max(128).regex(BROWSER_VIEW_ID_RE),
-  // Non-persistent partition string (PRD 400 run-mode isolation). No leading
-  // 'persist:' enforced here — callers choose persistence explicitly.
-  partition: z.string().min(1).max(256),
-});
-
-const BOUNDS_INT = z.number().int().min(0).max(100000);
-const browserSetBounds = z.object({
-  viewId: z.string().min(1).max(128).regex(BROWSER_VIEW_ID_RE),
-  x: BOUNDS_INT,
-  y: BOUNDS_INT,
-  width: BOUNDS_INT,
-  height: BOUNDS_INT,
-});
-
-const browserNavigate = z.object({
-  viewId: z.string().min(1).max(128).regex(BROWSER_VIEW_ID_RE),
-  url: z.string().min(1).max(8192),
-});
-
-// PRD 407: DOM/text capture from the active browser sub-tab.
-const browserCaptureDom = z.object({
-  viewId: z.string().min(1).max(128).regex(BROWSER_VIEW_ID_RE),
-  kind: z.enum(['text', 'html']),
-});
-
-// PRD 404: filter -> prune -> summarize -> chunk capture of a picked
-// selection (browser:capture). selectors comes from the PRD 403 picker.
-const browserCaptureSelection = z.object({
-  viewId: z.string().min(1).max(128).regex(BROWSER_VIEW_ID_RE),
-  selectors: z.array(z.string().min(1).max(2048)).min(1).max(50),
-  mode: z.enum(['agent', 'html', 'a11y', 'selector']),
-});
-
-// PRD 407: clipboard image write (browser:copy-image). dataUrl is a PNG data
-// URL from webContents.capturePage() — capped well above any realistic
-// screenshot so a malformed/huge payload can't wedge the IPC channel.
-const browserCopyImage = z.object({
-  dataUrl: z.string().min(1).max(50_000_000),
-});
-
 // Recorder export (PRD 412): write arbitrary recorded-flow text to the OS
-// clipboard, separate from the image-only browserCopyImage above.
+// clipboard.
 const clipboardWriteText = z.object({
   text: z.string().max(1_000_000),
 });
 
-// Recorder export (PRD 412): native "Save As" dialog write, bypassing the
-// config.cjs write-boundary since the path is user-chosen via OS dialog.
-const browserSaveRecording = z.object({
-  defaultName: z.string().min(1).max(255),
-  text: z.string().max(1_000_000),
-});
-
-// PRD 407: binary-safe atomic write (browser:save-binary) for screenshot
-// captures — config:write-text is utf8-only.
-const browserSaveBinary = z.object({
-  path: z.string().min(1).max(4096),
-  base64: z.string().min(1).max(50_000_000),
-  // Single-writer law (lib/opsOwnership.cjs) — required for ops-root paths.
-  writer: z.string().min(1).max(64).optional(),
-});
-
-// PRD 410: replay a recorded step list against a live view. The renderer
-// owns the step list (main never persists recorded steps), so every call is
-// self-contained. `select` is accepted for forward-compat even though the
-// live recorder engine doesn't emit it yet.
-const browserReplayStep = z.object({
-  n: z.number().int().min(1),
-  verb: z.enum(['navigate', 'click', 'type', 'select', 'wait-for']),
-  target: z.string().max(2000),
-  value: z.string().max(2000).optional(),
-  variable: z.string().max(64).nullable().optional(),
-  kind: z.enum(['nav', 'assert']).optional(),
-  masked: z.boolean().optional(),
-  variableSuggestion: z.string().max(64).optional(),
-});
-
-const browserReplay = z.object({
-  viewId: z.string().min(1).max(128).regex(BROWSER_VIEW_ID_RE),
-  steps: z.array(browserReplayStep).max(500),
-  values: z.record(z.string().max(64), z.string().max(2000)).optional(),
-  continueOnError: z.boolean().optional(),
-});
-
-// PRD 402: address-bar zoom control. factor is clamped again in
-// browserView.cjs's setZoom — this just bounds the wire payload.
-const browserSetZoom = z.object({
-  viewId: z.string().min(1).max(128).regex(BROWSER_VIEW_ID_RE),
-  factor: z.number().min(0.1).max(10),
-});
-
-// PRD 402: Cmd/Ctrl+F find bar.
-const browserFind = z.object({
-  viewId: z.string().min(1).max(128).regex(BROWSER_VIEW_ID_RE),
-  text: z.string().max(2000),
-  forward: z.boolean().optional(),
-});
-
 // ──────────────────────────────────────────── Transcripts
 const SESSION_UUID_RE = /^[a-zA-Z0-9-]{1,64}$/;
 
@@ -680,6 +566,15 @@ const exchangesList = z.object({
 // this one lives here per PRD 638 so it's reusable without importing files.cjs.
 const filesDuplicate = z.object({ path: z.string().min(1).max(4096) });
 
+// files:save-binary — binary-safe atomic write (formerly browser:save-binary,
+// re-homed off the Browser tab). Mirrors the retired browserSaveBinary shape.
+const filesSaveBinary = z.object({
+  path: z.string().min(1).max(4096),
+  base64: z.string().min(1).max(50_000_000),
+  // Single-writer law (lib/opsOwnership.cjs) — required for ops-root paths.
+  writer: z.string().min(1).max(64).optional(),
+});
+
 // ──────────────────────────────────────────── Doc Edit (PRD 638 rewrite runner)
 // docedit:run — consumed by docEdit.cjs's registerDocEditHandlers.
 const docEditRun = z.object({
@@ -744,23 +639,6 @@ const chatExternalSend = z.object({
   ),
 });
 
-// ──────────────────────────────────────────── Web Remote
-// OTP is 8 uppercase alphanumeric chars (case-insensitive entry, normalised to upper in handler).
-const WEB_REMOTE_OTP_RE = /^[A-Z0-9]{8}$/i;
-const DEVICE_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-
-const webRemotePair = z.object({
-  otp: z.string().regex(WEB_REMOTE_OTP_RE),
-}).strict();
-
-const webRemoteRevokeDevice = z.object({
-  deviceId: z.string().regex(DEVICE_ID_RE),
-}).strict();
-
-const webRemoteAuditTail = z.object({
-  lines: z.number().int().min(1).max(500).optional(),
-}).strict();
-
 // ──────────────────────────────────────────── History
 const DATE_YYYY_MM_DD = /^\d{4}-\d{2}-\d{2}$/;
 
@@ -892,96 +770,19 @@ function validated(schema, handler) {
   };
 }
 
-// ──────────────────────────────────────────── Web Remote command allowlist
-// Commands are split into three tiers:
-//   READ_COMMANDS      — return data; allowed when remoteEnabled=true.
-//   SAS_GATED_READS    — return sensitive user data (sessions, PRDs, logs,
-//                        transcript summaries); additionally require
-//                        _e2eAuthenticated=true (SAS confirmed by user).
-//                        A compromised relay cannot exfiltrate this data from
-//                        a session that has not been SAS-confirmed.
-//   MUTATE_COMMANDS    — write files, spawn processes, or mutate persisted
-//                        state; gated behind remoteControlEnabled=true AND
-//                        _e2eAuthenticated=true.
-// ALLOWED_COMMANDS is the union, kept for existing import compatibility.
-//
-// Ungated READ_COMMANDS (justify each):
-//   cmd:app:version      — exposes only the app semver string; no user data.
-//   cmd:session:unsubscribe — teardown lifecycle; returns nothing sensitive.
-const READ_COMMANDS = new Set([
-  'cmd:app:version',
-  // v2 mobile: unsubscribe is a teardown lifecycle call with no data payload.
-  'cmd:session:unsubscribe',
-]);
-
-// Sensitive reads — return user data; require SAS confirmation same as MUTATE.
-const SAS_GATED_READS = new Set([
-  'cmd:sessions:load',
-  'cmd:history:aggregate',
-  // subscribe initiates a live stream of session state/summary — sensitive.
-  'cmd:session:subscribe',
-  // NOTE: cmd:exchanges:list is intentionally NOT allowlisted — webRemote.cjs has
-  // no dispatch handler for it, so an allowlist entry would only fail closed with
-  // an opaque reject. Re-add here together with the handler when remote exchanges
-  // are wired, so the allowlist always mirrors an actual capability.
-  //
-  // Scheduler/Epics commands (cmd:schedule:*) were removed here deliberately
-  // (core scheduler/Epics redesign) — Remote no longer reaches into scheduler
-  // internals at all; a future Remote rebuild will talk to Scheduler/Epics
-  // through whatever higher-level surface that redesign lands on, not this
-  // per-command allowlist.
-]);
-
-const MUTATE_COMMANDS = new Set([
-  'cmd:sessions:save',
-  'cmd:pty:spawn',
-  'cmd:pty:write',
-  // pty:kill terminates a live session; pty:resize drives the geometry of the
-  // user's interactive PTY — both write live process state, so they are gated
-  // behind remoteControlEnabled + SAS like every other mutation. A read-only
-  // mobile mirror has no business killing or resizing the desktop's session.
-  'cmd:pty:kill',
-  'cmd:pty:resize',
-  // Pushes a prompt into an open tab's chat queue — a real mutation of that
-  // tab's session, same tier as pty:write.
-  'cmd:chat:send',
-]);
-
-const ALLOWED_COMMANDS = new Set([...READ_COMMANDS, ...SAS_GATED_READS, ...MUTATE_COMMANDS]);
-
 module.exports = {
   // Centralized slug regex — used by scheduler.cjs and queueOps.cjs for
   // direct test()/match() containment checks alongside the zod parses.
   SCHEDULE_SLUG_RE,
   SCHEDULE_RUN_ID_RE,
   PRD_CREATE_SLUG_RE,
-  READ_COMMANDS,
-  SAS_GATED_READS,
-  MUTATE_COMMANDS,
-  ALLOWED_COMMANDS,
   schemas: {
-    webRemotePair,
-    webRemoteRevokeDevice,
-    webRemoteAuditTail,
     ptySpawn,
     ptyTabId,
     ptyAlive,
     ptyWrite,
     ptyResize,
-    sessionSubscribe,
-    browserViewId,
-    browserCreate,
-    browserSetBounds,
-    browserNavigate,
-    browserCaptureDom,
-    browserCaptureSelection,
-    browserCopyImage,
-    browserSaveBinary,
     clipboardWriteText,
-    browserSaveRecording,
-    browserReplay,
-    browserSetZoom,
-    browserFind,
     transcriptSubscribe,
     transcriptTabId,
     transcriptPath,
@@ -1049,6 +850,7 @@ module.exports = {
     watchersRemove,
     watchersKillTab,
     filesDuplicate,
+    filesSaveBinary,
     docEditRun,
     docEditRunInSession,
     chatRun,

package/src/main/lib/opsOwnership.cjs

@@ -48,8 +48,6 @@ const OWNERS = Object.freeze({
   'scheduler': 'scheduler',
   // Project Home owns the synthesized Brief (generate + hand-edit).
   'project-brief': 'project-home',
-  // Browser tab scratch saves (DOM captures, screenshots, recorded flows).
-  'browser': 'browser',
   // Structured per-tab error log lines (JSONL), tagged for tracing/analysis.
   'logs': 'logs',
   // Host on Bilko.run tab's deterministic bundle prep (dist/index.html +

package/src/main/lib/summarize.cjs

@@ -5,7 +5,6 @@
  *
  * Single source of truth for the Anthropic summarization call. Used by:
  *   - exchanges.cjs (records durable per-exchange summaries)
- *   - webRemote.cjs (mobile summary push — refactored to import from here)
  *
  * Degrade contracts (never throw — always return a record):
  *   no API key → { summary: text.slice(0,600), model:'raw', degraded:'no_api_key' }

package/src/main/runVerify.cjs

@@ -157,6 +157,7 @@ function parseLog(logPath) {
   const events = [];
   let resultEvent = null;
   let seq = 0;
+  let transcriptCommitLanded = false;
 
   for (const line of text.split('\n')) {
     const trimmed = line.trim();
@@ -166,6 +167,18 @@ function parseLog(logPath) {
     try { obj = JSON.parse(trimmed); } catch { continue; }
     if (!obj || typeof obj !== 'object') continue;
 
+    // Harness-emitted commit evidence: git itself produced these lines (a
+    // `vcs_state_changed` system event, or a tool_use_result carrying a
+    // gitOperation), so the model cannot fabricate them. Detected here as a
+    // plain boolean scan — never pushed into `events`, so the index-based
+    // final-20% math elsewhere is unaffected.
+    if (obj.type === 'system' && obj.subtype === 'vcs_state_changed' && obj.kind === 'commit') {
+      transcriptCommitLanded = true;
+    }
+    if (obj.tool_use_result?.gitOperation?.commit?.kind === 'committed') {
+      transcriptCommitLanded = true;
+    }
+
     // Final result event.
     if (obj.type === 'result') {
       const ev = {
@@ -215,7 +228,7 @@ function parseLog(logPath) {
     }
   }
 
-  return { events, resultEvent, error: null };
+  return { events, resultEvent, error: null, transcriptCommitLanded };
 }
 
 // ─── self-recovery helpers ────────────────────────────────────────────────────
@@ -591,6 +604,27 @@ function isAncestorCommit({ cwd, sha, timeoutMs = GH_CHECK_TIMEOUT_MS, execImpl
   }
 }
 
+/**
+ * True when `cwd` is inside a git repository. Used to gate the transcript
+ * commit-evidence fallback below: a job whose cwd is not a git repo can never
+ * produce committedDuringRun=true (gitHead()/committedInWindow() fail closed
+ * there), so the fallback must only apply in that narrow case — never when
+ * git ancestry is actually observable.
+ */
+function isGitRepo(cwd) {
+  if (!cwd) return false;
+  try {
+    execFileSync('git', ['-C', cwd, 'rev-parse', '--git-dir'], {
+      timeout: 10_000,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 // ─── already-shipped postcondition exemption (original PRD re-runs) ─────────
 
 const PRD_DELIVERABLE_PATH_RE = /(?:^|[`\s(])((?:src|scripts|session-manager-operations|test|tests|docs|bin)\/[A-Za-z0-9_./-]*[A-Za-z0-9_-]\.[A-Za-z0-9]+)\b/g;
@@ -743,12 +777,21 @@ async function verifyRun({ runDir, prdPath, queueEntry, allJobs = [], committedD
     }
 
     // ── 2. Parse log ───────────────────────────────────────────────────────
-    const { events, resultEvent, error: parseError } = parseLog(logPath);
+    const { events, resultEvent, error: parseError, transcriptCommitLanded } = parseLog(logPath);
 
     if (parseError) {
       return conclude('verify_unavailable', `log unreadable: ${parseError}`, 'needs_review');
     }
 
+    // A job whose cwd is not a git repo (e.g. an investigation fix-plan that
+    // inherited cwd: /tmp) can never produce committedDuringRun=true —
+    // gitHead()/committedInWindow() both fail closed there. In that case
+    // ONLY, fall back to the harness-emitted commit evidence in the
+    // transcript, which git itself produced and the model cannot fabricate.
+    const cwdIsGitRepo = isGitRepo(queueEntry?.cwd);
+    const commitEvidence = committedDuringRun || (!cwdIsGitRepo && transcriptCommitLanded);
+    const commitEvidenceSource = (!committedDuringRun && commitEvidence) ? 'transcript' : null;
+
     // ── 3. HALT detection ─────────────────────────────────────────────────
     // Primary: check the final `{"type":"result"}` event's `result` text.
     if (resultEvent) {
@@ -865,7 +908,7 @@ async function verifyRun({ runDir, prdPath, queueEntry, allJobs = [], committedD
     // committed anything nor ever emitted the finish-protocol sentinel likely
     // ended before doing real work (e.g. stopped on a clarifying question).
     // Weaker evidence than a caught transcript error, but still not clean.
-    if (sentinel === null && !committedDuringRun) {
+    if (sentinel === null && !commitEvidence) {
       issues.push({
         verdict: 'no_verdict_sentinel',
         reason: 'run made no commit and emitted no SCHEDULER_VERDICT sentinel — likely ended before the finish protocol (e.g. stopped on a clarifying question)',
@@ -894,7 +937,7 @@ async function verifyRun({ runDir, prdPath, queueEntry, allJobs = [], committedD
     // bare PASS with no commit from one is still a strong silent-failure
     // signal and stays covered by this check.
     const isFixPlanJob = /^\d+-fix-/.test(queueEntry?.slug || '');
-    if (sentinel === 'pass' && !committedDuringRun && !isFixPlanJob) {
+    if (sentinel === 'pass' && !commitEvidence && !isFixPlanJob) {
       // EXEMPTION: `-merge-main` PRDs (see isMergeMainSlug) can genuinely and
       // correctly find nothing left to do when an out-of-band actor (a human,
       // another agent, a sibling scheduler job) already merged/updated the
@@ -1015,13 +1058,18 @@ async function verifyRun({ runDir, prdPath, queueEntry, allJobs = [], committedD
     // MUST NOT apply to halt or deps_unmet — those keep their existing semantics.
     if (
       sentinel === 'pass'
-      && committedDuringRun
+      && commitEvidence
       && (top.verdict === 'transcript_errors' || top.verdict === 'verify_unavailable')
     ) {
       return conclude('clean',
         `SCHEDULER_VERDICT: PASS + commit landed overrides ${top.verdict}`,
         null,
-        { ...(annotations.length ? { annotations } : {}), sentinel, sentinelOverride: top.verdict },
+        {
+          ...(annotations.length ? { annotations } : {}),
+          sentinel,
+          sentinelOverride: top.verdict,
+          ...(commitEvidenceSource ? { commitEvidenceSource } : {}),
+        },
       );
     }
 
@@ -1073,4 +1121,5 @@ module.exports = {
   extractPrdDeliverablePaths,
   allDeliverablesAlreadyTracked,
   isAncestorCommit,
+  isGitRepo,
 };

package/src/main/scheduler.cjs

@@ -271,6 +271,28 @@ function gitHead(cwd) {
   });
 }
 
+// True when cwd is inside a git repository. Used to keep a non-git cwd (e.g.
+// a scratch dir like /tmp) from ever being handed to an investigation's
+// fix-plan as its cwd — the commit guard, worktree isolation, and
+// runVerify's PASS+commit sentinel override all read git state from job.cwd,
+// so a fix plan rooted at a non-repo path gets parked in needs_review even
+// when its commit really landed (Incident: 99-fix-e2e-needs-review-test,
+// 2026-08-07 — green, committed 6ecbd40, PASS sentinel, still needs_review).
+// Bounded and never throws.
+function isGitRepoSync(cwd) {
+  if (!cwd) return false;
+  try {
+    execFileSync('git', ['-C', cwd, 'rev-parse', '--git-dir'], {
+      timeout: 10_000,
+      windowsHide: true,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 // Best-effort `git fetch --all --prune` in cwd, bounded and never throwing.
 // A PRD that does its work in a separate `git worktree add` checkout (per
 // standards.md's own recommended pattern for shared repos) commits and pushes
@@ -2666,6 +2688,10 @@ ${logTail}
    estimateMinutes: <your time estimate>
    ---
    \`\`\`
+   \`cwd\` must be the git repo root where the fix will actually land. If the failed job's cwd is
+   not that repo (e.g. a scratch dir like \`/tmp\`), set \`cwd:\` to the correct repo root instead —
+   the scheduler's commit guard and post-run verifier read git state from this path, and a
+   non-repo cwd parks even a fully green, committed run in \`needs_review\`.
 6. The PRD body MUST be self-contained — \`claude -p\` runs it on a fresh Sonnet session with NO conversation context. Include:
    - Root-cause analysis (what went wrong and why)
    - Concrete fix steps (specific files / commands / edits)
@@ -2803,6 +2829,16 @@ async function spawnInvestigation(failedJob, runDir) {
     console.warn(`[scheduler] investigation cwd missing (${cwd}); falling back to ${DEFAULT_PROJECT_CWD}`);
     cwd = DEFAULT_PROJECT_CWD;
   }
+  // A non-git cwd is unusable as a fix-plan cwd: the commit guard, worktree
+  // isolation, and runVerify's PASS+commit sentinel override all read git
+  // state from job.cwd, so a fix plan rooted at e.g. /tmp gets parked in
+  // needs_review even when its commit really landed. (Incident:
+  // 99-fix-e2e-needs-review-test, 2026-08-07 — green, committed 6ecbd40,
+  // PASS sentinel, still needs_review.)
+  if (!isGitRepoSync(cwd)) {
+    console.warn(`[scheduler] investigation cwd is not a git repo (${cwd}); falling back to ${DEFAULT_PROJECT_CWD}`);
+    cwd = DEFAULT_PROJECT_CWD;
+  }
   const prompt = buildInvestigationPrompt({ failedJob, cwd, failedLogPath, originalBody, logTail, fixPath, group });
 
   // Phase 1: open log fd for pre-spawn diagnostics.
@@ -3024,11 +3060,12 @@ async function spawnJob(job, runId, runDir, defaultCwd) {
       await setPaused('rate_limit', resetIso);
     }
 
-    // Stale queue entry: the PRD already shipped and was archived before this
-    // run fired (see archivedTwinExists in executeJob). Treat it as a plain
-    // completion — no verify pass, no commit guard, no RCA feedback — since
-    // there is no real transcript/commit to check.
-    if (res.skipped === 'prd-archived') {
+    // Stale queue entry: the PRD was archived (already shipped) or is gone
+    // from disk entirely (deleted before dispatch). Both are retire-not-fail
+    // results from prdArchivedSkipResult with exitCode 0 and no transcript —
+    // treat any truthy skip reason as a plain completion: no verify pass, no
+    // commit guard, no RCA feedback item.
+    if (res.skipped) {
       await mutate((s) => {
         const idx = s.jobs.findIndex((x) => x.slug === job.slug);
         if (idx >= 0) {
@@ -4765,7 +4802,9 @@ async function init() {
   }
 }
 
-// remote — callable from webRemote.cjs without going through IPC.
+// remote — in-process (non-IPC) scheduler accessors, used by prdCreate.cjs
+// and other main-process callers. (Named for the retired web-remote relay,
+// its original consumer; kept because it still has in-process callers.)
 const remote = {
   // `cwd` is optional: prdCreate.cjs's create flow passes the target
   // project's cwd explicitly (the file may not exist yet, so there's
@@ -4956,4 +4995,4 @@ function registerAdminRoutes(adminHttp, remoteObj = remote) {
   });
 }
 
-module.exports = { registerScheduleHandlers, attachWindow, init, ROOT, PRDS_DIR, healRefusalReason, writeQueue, reconcile, reconcileSourcePromptId, allocateParallelGroup, selectHistoryJobs, parsePorcelain, FINISH_PROTOCOL, remote, pickNextBatch, pickForProject, reapDeadRunningJobs, pollRecoveryClearSource, memoryLimitedBatchSize, availableForJobs, reverifyNeedsReview, isRescanCandidate, isPromotableOriginal, selectAutoFixTargets, isEligibleForImmediateAutoFix, resolveRunId, isUnresolvableNeedsReview, healTargetForFix, buildInvestigationPrompt, committedInWindow, computeCommittedDuringRun, classifySigtermWithCommit, isFixPlanSlug, isFixPlanBeyondDepthCap, MAX_INVESTIGATION_DEPTH, forceTickOutcome, applyPauseCleared, detectNetworkErrorInLog, detectRateLimitInLog, classifyFailureOutcome, commitGuardVerdict, TRANSIENT_RETRY_CAP, buildScheduleStatePayload, partitionBootOrphans, applyOrphanOutcome, BOOT_ORPHAN_KILL_GRACE_MS, registerAdminRoutes, notifyOriginatingTab, notifyNeedsReview, isNotifiableTerminalStatus, extractResultTextFromLog, candidatePrdsDirs, candidateArchivedPrdsDirs, resolveArchivedPrdStatus, prdDirForCwd, prdPathForJob, archivedPrdPathForJob, archivedTwinExists, findPrdDir, resolveVerifyPrdPath, resolveNotifyPrd, runPrdMigration, shouldSkipInvestigationForCleanRun, archiveCompletedPrd, retireCompletedSlugs, SCHEDULER_BOOTED_AT, SCHEDULER_CODE_SHA, resetJobFields, executeJob, prdArchivedSkipResult };
+module.exports = { registerScheduleHandlers, attachWindow, init, ROOT, PRDS_DIR, healRefusalReason, writeQueue, reconcile, reconcileSourcePromptId, allocateParallelGroup, selectHistoryJobs, parsePorcelain, FINISH_PROTOCOL, remote, pickNextBatch, pickForProject, reapDeadRunningJobs, pollRecoveryClearSource, memoryLimitedBatchSize, availableForJobs, reverifyNeedsReview, isRescanCandidate, isPromotableOriginal, selectAutoFixTargets, isEligibleForImmediateAutoFix, resolveRunId, isUnresolvableNeedsReview, healTargetForFix, buildInvestigationPrompt, isGitRepoSync, committedInWindow, computeCommittedDuringRun, classifySigtermWithCommit, isFixPlanSlug, isFixPlanBeyondDepthCap, MAX_INVESTIGATION_DEPTH, forceTickOutcome, applyPauseCleared, detectNetworkErrorInLog, detectRateLimitInLog, classifyFailureOutcome, commitGuardVerdict, TRANSIENT_RETRY_CAP, buildScheduleStatePayload, partitionBootOrphans, applyOrphanOutcome, BOOT_ORPHAN_KILL_GRACE_MS, registerAdminRoutes, notifyOriginatingTab, notifyNeedsReview, isNotifiableTerminalStatus, extractResultTextFromLog, candidatePrdsDirs, candidateArchivedPrdsDirs, resolveArchivedPrdStatus, prdDirForCwd, prdPathForJob, archivedPrdPathForJob, archivedTwinExists, findPrdDir, resolveVerifyPrdPath, resolveNotifyPrd, runPrdMigration, shouldSkipInvestigationForCleanRun, archiveCompletedPrd, retireCompletedSlugs, SCHEDULER_BOOTED_AT, SCHEDULER_CODE_SHA, resetJobFields, executeJob, prdArchivedSkipResult, spawnJob };